COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-650

Upload a Web Shell to a Web Server

By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The web server is susceptible to one of the various web application exploits that allows for uploading a shell file.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Execute Unauthorized Commands

Etkilenen alanlar: Confidentiality, Integrity, Availability

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Make sure your web server is up-to-date with all patches to protect against known vulnerabilities.
2
Ensure that the file permissions in directories on the web server from which files can be execute is set to the "least privilege" settings, and that those directories contents is controlled by an allowlist.
CAPEC-650: Upload a Web Shell to a Web Server — DayBreach Saldırı Sözlüğü · DayBreach