0byt3m1n1-V2

0byt3m1n1-V2 is a file-manager webshell (version 2.2) from the Indonesian underground scene, attributed to the zerobyte-id group. The shell is wrapped in a fake WordPress admin interface — a social-engineering layer designed to survive a casual glance from a sysadmin reviewing open browser tabs. But the WordPress skin is not the headline finding. The headline is that the entire shell ships with zero authentication. No password, no session token, no access control of any kind. Every function — browse, upload, download, edit, chmod — is immediately available to any visitor who reaches the URL.

Capabilities

Full bidirectional filesystem access: browse, upload, download, edit, chmod. The upload handler performs no extension filtering, no MIME-type validation, and no path sanitization — an attacker (or any passerby) can write arbitrary files anywhere the web server user can reach. A GET-parameter file-read function returns any file within the server process permissions. The fake WordPress dashboard is a social-engineering layer — most shells in the corpus display their author handle proudly, while 0byt3m1n1 attempts to blend in by mimicking the most common CMS admin panel on the internet.

Supply-Chain Dropper

The supply-chain angle elevates 0byt3m1n1 beyond a standard webshell. On every page load, the tool fetches its own PHP source code from a hardcoded GitHub URL under the zerobyte-id account and writes it into the webroot. This means the tool is not self-contained — it depends on a live external repository at runtime. If that GitHub account is compromised or the repository content is swapped, every deployed instance of 0byt3m1n1 will silently pull and execute the replacement code. A single GitHub account takeover would grant arbitrary code execution on every host running this dropper worldwide.

Vulnerabilities

The combination of zero authentication and a runtime remote-fetch dropper makes this shell dangerous to its operators as much as to its targets.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule webshell_0byt3m1n1 {
    meta:
        description = "0byt3m1n1-V2 file manager webshell (zerobyte-id)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/0byt3m1n1/"
        status      = "validated"

    strings:
        $title     = "0byt3m1n1" ascii nocase
        $title2    = "zerobyte" ascii nocase
        $sname_hex = "\\x30\\x62\\x79\\x74\\x33\\x6d\\x31\\x6e\\x31" ascii
        $github    = "zerobyte-id.github.io" ascii
        $doevil    = "_doEvil" ascii
        $filesrc   = "$_GET['filesrc']" ascii
        $option    = "$_GET['option']" ascii

    condition:
        filesize < 200KB
        and ($title or $title2 or $sname_hex)
        and ($github or $doevil or $filesrc or $option)
}

MITRE ATT&CK

OHIIHO Threat Research.