PHP Webshells - Cookie-Controlled Tactics in Linux Hosting

What Happened

Threat actors are increasingly using HTTP cookies as a control channel for PHP-based webshells on Linux servers. Instead of exposing command execution through visible parameters, these webshells rely on cookie values to gate execution and pass instructions. This method allows malicious code to remain dormant during normal application behavior, activating only under specific conditions.

Who's Affected

This technique primarily targets users and administrators of Linux hosting environments, particularly those utilizing PHP applications. Shared hosting scenarios are especially vulnerable, as they often allow sufficient permissions for attackers to deploy and maintain webshells without raising alarms.

How It Works

The core of this attack involves the use of cookies to trigger malicious execution. When specific cookie values are present, the webshell logic activates, executing threat actor-controlled behavior. This method reduces visibility, as the malicious activity blends into normal web traffic. The PHP environment allows immediate access to cookie data, making it easy for attackers to utilize this input without complex parsing.

Observed Variants

Several implementations of cookie-controlled PHP webshells have been noted:

• Loader with Execution Gating: This variant evaluates request context and reconstructs PHP functions dynamically, complicating detection.
• Direct Cookie-Driven Payload Stager: This simpler variant uses cookie data to directly control file handling and execution.
• Cookie-Gated Interactive Webshell: Here, a single cookie acts as an execution key, enabling direct execution of commands.

Persistence Through Scheduled Tasks

A notable tactic involves using cron jobs for persistence. After gaining access, attackers register scheduled tasks that recreate malicious PHP loaders in web-accessible locations. This method allows them to maintain a foothold in the environment, even after cleanup attempts, as the cron job continuously restores the webshell.

Common Delivery Methods

Attackers often leverage legitimate execution paths, such as php-fpm or control panel components, to stage and preserve malicious code. They use base64 encoding to reconstruct PHP files, allowing the code to blend into normal operations while remaining ready for activation.

Why Persistence Matters

Persistence is key for long-term remote code execution (RCE). By combining scheduled tasks with obfuscated PHP loaders, attackers can execute commands and deploy additional payloads without needing to re-trigger initial exploits. This approach minimizes operational noise and reduces the risk of detection.

Mitigation and Protection Guidance

To combat these threats, organizations should enforce multi-factor authentication for hosting control panels and monitor for unusual login patterns. Regular audits of hosted environments can help identify and mitigate potential webshell activity. Additionally, implementing robust logging and monitoring solutions can enhance visibility into web traffic and detect anomalies related to cookie usage.