b374k 3.2.3 is the gold standard of compact webshells — a polished, Indonesian-scene codebase with gzip+base64 embedded resources and a modular single-page application architecture.
Capabilities
Full-featured file manager, command execution, database browser, process viewer, and network tools — all packed into 225 KB. The payload is self-contained: no external resource loads, no CDN dependencies, everything embedded.
Anti-Bot Evasion
The dominant design feature is User-Agent masquerading. The shell inspects the incoming request’s User-Agent string and returns a convincing HTTP 404 page to any request matching common automated tools — curl, wget, python, spider, and similar scanner signatures. Only requests with a browser-class User-Agent receive the real control panel. This makes b374k invisible to most automated webshell scanners and incident response scripts that use command-line HTTP clients.
The default password b374k is stored as a sha1(md5()) hash in the source — recoverable by anyone with read access to the PHP file on disk.
W0rm Supply-Chain Backdoor
Redistributed copies carry a W0rm prepend injection that fires before any authentication check. The backdoor provides unauthenticated remote code execution, mail-based exfiltration, and arbitrary file upload to any visitor who knows the trigger — no password required. The anti-bot evasion that protects the shell from defenders also masks the supply-chain backdoor from cursory inspection: the operator’s own security-through-obscurity works against them.
Vulnerabilities
| # | Class | Impact | Status |
|---|---|---|---|
| 1 | W0rm prepend — unauthenticated RCE + exfil at global scope | Pre-auth RCE | Live-proven |
| 2 | Auth hash (sha1(md5())) exposed in plaintext source | Credential exposure | Confirmed |
Detection Surface
File-system indicators
| Indicator | Type | Detail |
|---|---|---|
| Single PHP file ≈ 225 KB | Size | Self-contained SPA — unusually large for a single PHP script |
$GLOBALS['resources'] | Variable | Resource embedding for CSS/JS/images (unique to b374k) |
sha1(md5($password)) | Auth hash | Default hash: 7d8aeb6aa919f46e398885e338abbcdba143eb93 |
$packetHost, $packetPort | Variables | Network module (unique to b374k) |
block_bot() | Function | Anti-bot 404 evasion |
@system($code) + @shell_exec($code) + @passthru($code) + @proc_open($code + @popen($code | Exec chain | 5-method execution using $code variable |
errors_log in webroot | Marker file | W0rm drops this on first execution (W0rm variant only) |
HTTP access-log indicators
| Log pattern | What it means |
|---|---|
GET /path/shell.php?cmd=<command> | W0rm backdoor — unauthenticated OS command execution |
GET /path/shell.php?xsec=blocker | W0rm file upload trigger — drops arbitrary files to webroot |
| HTTP 404 response with body > 10 KB | Anti-bot evasion — real 404 pages are < 500 bytes |
POST to single PHP file with response > 100 KB | SPA architecture — all shell actions are AJAX to one endpoint |
Multiple POST requests to same PHP file within seconds | SPA file browse / command exec / DB queries |
YARA rules
rule webshell_b374k {
meta:
description = "b374k webshell v3.x (source or packed)"
author = "OHIIHO Threat Research"
reference = "https://research.ohiiho.com/arsenal/b374k/"
status = "validated"
strings:
$title = "b374k" ascii nocase
$packer = "gzinflate(base64_decode(" ascii
$auth = "sha1(md5($" ascii
$res = "$GLOBALS['resources']" ascii
$ua_check = "HTTP_USER_AGENT" ascii
$ua_bot1 = "\"curl\"" ascii
$ua_bot2 = "\"wget\"" ascii
$ua_bot3 = "\"python\"" ascii
$ua_bot4 = "\"spider\"" ascii
$proc_open = "proc_open($code" ascii
$fsock = "fsockopen($packetHost" ascii
condition:
filesize < 300KB and $title
and ($packer
or $res or $proc_open or $fsock
or ($ua_check and 2 of ($ua_bot*))
or $auth)
}
W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.
MITRE ATT&CK
| Technique | Context |
|---|---|
| T1505.003 | Web Shell |
| T1059.004 | Command and Scripting Interpreter: Unix Shell |
| T1041 | Exfiltration Over C2 Channel (W0rm mail exfil) |
| T1036 | Masquerading (anti-bot 404 evasion) |
OHIIHO Threat Research.