Ninja

Ninja is not the compact utility shell its minimal interface suggests — at 100 KB it embeds a complete copy of PHPMailer (1000+ lines), turning every compromised server into a fully functional phishing mail relay.

Capabilities

The shell works on both PHP 5.6 and PHP 7.4 — one of the few in the corpus that survives modern PHP runtimes. File management, command execution, and a full PHPMailer library bundled directly into the source.

Embedded PHPMailer

The dominant finding is the embedded mail infrastructure. A full PHPMailer library is bundled directly into the shell source, giving the operator SMTP-authenticated email sending from the compromised host. This is not a convenience feature — it is a phishing platform. Any operator with access can send mail from the victim’s host. Routed through the victim’s own infrastructure it can pass SPF — the sending IP is authorised for the domain — while DKIM is only bypassed if the message also passes through the domain’s signing MTA, which is not automatic. Either way, mail from the legitimate domain is far harder for recipients to flag than an external spoof.

JavaScript Tracking Beacon

A redistributor-injected JavaScript beacon loads from an external ad/tracking network on every page load of the shell. The operator’s every interaction — login, file browse, command execution — generates an event visible to the tracking network. The redistributor who injected this beacon has passive visibility into every Ninja deployment’s activity without any active exploitation. The operator is the product.

Authentication

The password is hardcoded in plaintext at the top of the source — trivially recoverable by anyone with file read access. A secondary password variable later in the file may be set to an empty string, potentially clearing authentication depending on PHP execution order. The authentication is a gate against casual URL discovery, not a security boundary.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule webshell_ninja {
    meta:
        description = "Ninja webshell with embedded PHPMailer and tracking beacon (strong anchor: globe.moreforme.net)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/ninja/"
        status      = "validated"

    strings:
        $phpmailer_class = "class PHPMailer" ascii
        $smtp_class      = "class SMTP" ascii
        $smtp_version    = "const VERSION='6.0.7'" ascii
        $from_root       = "$From='root@localhost'" ascii
        $fromname        = "$FromName='Root User'" ascii
        $sendmail_path   = "$Sendmail='/usr/sbin/sendmail'" ascii
        $tracking        = "globe.moreforme.net" ascii
        $password_123    = "$password = \"123\"" ascii

    condition:
        filesize < 150KB
        and $phpmailer_class
        and $smtp_class
        and (
            $tracking                                            // unique Ninja IOC
            or $from_root or $fromname or $password_123
            or $smtp_version or $sendmail_path
        )
}

MITRE ATT&CK

OHIIHO Threat Research.