m4r5-sh3ll is the most user-friendly webshell in the Tier 1 corpus — closer to a legitimate admin panel than the utilitarian grey tables of classic Russian-scene shells.
Capabilities
A modern Bootstrap 4 dark-themed interface with responsive layout, clean navigation, and polished UX. Built for the Indonesian bigsecc hacker community (t.me/bigsecID, bigsec.in domain), it ships at 176 KB and runs on both PHP 5.6 and PHP 7.4.
Authentication and Credentials
Default credentials are community-public: username and password printed in a cleartext comment on the very first line of the source file. Every copy in circulation ships with the same credentials. There is no password-change UI — operators who do not manually edit the source file before deployment are running with credentials known to the entire bigsecc community.
Obfuscated Core
The core logic is wrapped in eval(base64_decode()), a classic PHP obfuscation pattern. The base64 layer hides the functional code from casual source inspection but is trivially reversible. The obfuscation does not protect against automated analysis — it primarily prevents other scene actors from easily rebadging the shell without understanding the codebase.
No Scanner Resistance
Unlike b374k (anti-bot 404) or Alfa (session-based auth returning HTTP 403), m4r5-sh3ll implements no bot-blocking or scanner evasion. Automated crawlers and webshell scanners can discover and fingerprint the shell via its distinctive Bootstrap page title in the HTML response. The shell relies entirely on URL obscurity for survival.
Vulnerabilities
| # | Class | Impact | Status |
|---|---|---|---|
| 1 | Cleartext default credentials in source comment | Credential exposure (community-public) | Confirmed |
| 2 | eval(base64_decode()) obfuscated core | Trivially reversible obfuscation | Confirmed |
| 3 | No bot-blocking — fingerprint via distinctive page title | Scanner-discoverable | Confirmed |
Detection Surface
File-system indicators
| Indicator | Type | Detail |
|---|---|---|
| Expected size | ~176 KB | |
bigsecc / bigsec.in | Strings | Community attribution |
| Bootstrap 4 dark UI | Response pattern | Modern dark-theme with Bootstrap framework |
| Cleartext default credentials | Auth | Community-public in first line comment |
eval(base64_decode( | Code pattern | Obfuscated core |
| Runtime | PHP 5.6 + PHP 7.4 | Both work |
HTTP access-log indicators
| Log pattern | What it means |
|---|---|
| Response: Bootstrap 4 dark UI | Modern dark-theme interface — distinctive visual fingerprint |
| Default credentials in first-line comment | Community-public, cleartext |
eval(base64_decode( | Obfuscated core |
Response: m4r5 or bigsecc in page | Shell and community identification |
YARA rule
rule webshell_m4r5_sh3ll {
meta:
description = "m4r5-sh3ll webshell (bigsecc community)"
author = "OHIIHO Threat Research"
reference = "https://research.ohiiho.com/arsenal/m4r5-sh3ll/"
status = "validated"
strings:
$title = "M4R5 SH3LL" ascii
$subtitle = "B1G53C C0MMUN17Y" ascii
$themes = "D4RK" ascii
$bigsecc = "bigsecc" ascii nocase
$bigsec_in = "bigsec.in" ascii
$bigsec_tg = "t.me/bigsecID" ascii
$eval_b64 = "eval(base64_decode(" ascii
$func_b64e = "function B64E(" ascii
$func_b64d = "function B64D(" ascii
condition:
filesize < 200KB
and ($title or $subtitle or $bigsecc or $bigsec_in or $bigsec_tg or $themes)
and ($eval_b64 or $func_b64e or $func_b64d)
}
MITRE ATT&CK
| Technique | Context |
|---|---|
| T1505.003 | Web Shell |
| T1059.004 | Command and Scripting Interpreter: Unix Shell |
OHIIHO Threat Research.