php_shell_hunter.py

Features

• Hunts basic unobfuscated PHP shell files to a target directory
• Can be ran locally or to a remote linux server
• If PHP shell is found, it will notify on specified slack channel
• This script leverages Slack Incoming Webhooks App

Installation

git clone https://github.com/meliodaaf/threat-hunting-php-shell.git
pip3 install -r requirements.txt

Running the script against a remote server

Usage: python3 php_shell_hunter.py --remote-host 192.168.100.1 --directory /var/www/html

Running the script locally

Usage: python3 php_shell_hunter.py --directory /var/www/html

Setting up SSH passwordless connection to a remote server

ssh-key-gen -t rsa # There's no need for this command if you already have one
ssh-copy-id user@serverip

Sample

1. Sample files on a remote host
2. Run the script againts the remote host and directory
3. Slack notification

References

• IppSec Slack Webhook Setup
• Paramiko Setup