IndoXploit

IndoXploit is the flagship shell of the Indonesian defacement scene, designed for volume operations — compromise many, deface fast, claim credit.

Capabilities

Full-featured panel with file management, command execution, mass deface tools, cPanel exploitation modules, WordPress scanner, FTP brute-forcer, and zone-h submission integration. Distinctive ASCII art banner (root@indoxploit) in the source.

W0rm Inside the Login Function

The W0rm supply-chain injection in IndoXploit is uniquely positioned: it is placed inside login_shell(), the function that handles unauthenticated requests. This means the backdoor fires on every unauthenticated visit to the shell — not just on authenticated sessions. Any visitor, any scanner, any bot that hits the URL triggers the W0rm payload before the login form is even rendered. The operator has no visibility into this execution path.

TLS Disabled on All Outbound Connections

Ten separate instances of TLS verification being explicitly disabled across the codebase. Every outbound cURL request — cPanel attack module, WordPress scanner, FTP credential checker — runs with certificate validation turned off. Any on-path observer between the compromised server and the target can present a forged certificate to intercept, modify, or inject responses. The operator’s attack traffic is MITM-able by design — and fully cleartext wherever the targeted endpoint is plain HTTP rather than HTTPS.

Authentication

MD5 hash of a numeric string with no salt. Trivially crackable with any rainbow table or brute-force tool. The anti-bot filter blocks search engine crawlers (Googlebot, Slurp, YahooSeeker, bingbot) but does not block curl or custom HTTP clients — it protects the shell from indexing, not from exploitation.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule webshell_indoxploit {
    meta:
        description = "IndoXploit webshell (Indonesian scene)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/indoxploit/"
        status      = "validated"

    strings:
        $title         = "IndoXploit" ascii nocase
        $auth_pass     = "$auth_pass" ascii
        $default_hash  = "db315f48b0388b77d7f0fe45ec8d8e2f" ascii
        $zone_h        = "zone-h.com/notify/single" ascii
        $yougetsignal  = "yougetsignal.com/domains.php" ascii
        $ssl_verify    = "CURLOPT_SSL_VERIFYPEER" ascii
        $wp_upload     = "wp-admin/update.php?action=upload-theme" ascii
        $magic_quotes  = "set_magic_quotes_runtime" ascii

    condition:
        filesize < 150KB
        and $title
        and ($auth_pass or $default_hash)
        and ($zone_h or $yougetsignal or $wp_upload or $ssl_verify or $magic_quotes)
}

W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.

MITRE ATT&CK

OHIIHO Threat Research.