r57

r57shell 1.24 is one of the foundational Russian webshells, widely distributed across underground forums since the mid-2000s. This variant carries Cyrillic comments, evilc0ders attribution, and modification credits to #!physx^.

Capabilities

Full control panel with file management, command execution, database access, server enumeration, and network tools. The codebase has been forked and rebadged countless times, making it a common ancestor for dozens of derivative shells still deployed today.

Pre-Auth Local File Inclusion

The very first line of executable code contains an unvalidated include that accepts a user-controlled GET parameter with no sanitization. Any unauthenticated visitor can use this to read arbitrary files on the host or, if allow_url_include is enabled, achieve remote code execution. This vulnerability fires before any authentication check — the shell is exploitable the instant it is deployed, regardless of whether auth is enabled.

Authentication (or Lack Thereof)

Authentication ships disabled by default ($auth=0). Even when enabled, the credentials are hardcoded in cleartext in the source header — r57 / r57 — readable by anyone with file access on the host. The authentication mechanism is a gate against casual discovery, not a security boundary.

W0rm Supply-Chain Backdoor

Redistributed copies carry a W0rm injection near the end of the file. The backdoor provides unauthenticated remote code execution, mail-based exfiltration, and arbitrary file upload. Combined with the pre-auth LFI on line 1, r57 presents two independent unauthenticated attack surfaces — one from the original codebase, one from the supply chain.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule webshell_r57 {
    meta:
        description = "r57 webshell v1.24 (Russian scene, physx variant)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/r57/"
        status      = "validated"

    strings:
        $title       = "r57shell" ascii nocase
        $curl_lfi    = "curl_init(\"file://\"" ascii
        $test1_file  = "$_POST['test1_file']" ascii
        $name_var    = "$name=" ascii
        $pass_var    = "$pass=" ascii
        $md5_auth1   = "ec371748dc2da624b35a4f8f685dd122" ascii
        $hexdtime    = "$hexdtime" ascii
        $cfe_exec    = "@shell_exec($cfe)" ascii
        $auth0       = "$auth=0" ascii

    condition:
        filesize < 200KB
        and (
            ($title and ($name_var or $pass_var or $auth0))
            or ($curl_lfi and $test1_file)
            or ($hexdtime and $cfe_exec)
            or $md5_auth1
        )
}

W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.

MITRE ATT&CK

Weakness classes (CWE)

The pre-auth file inclusion is a software weakness, not an adversary behaviour — it is classified by CWE rather than forced into an ATT&CK technique.

OHIIHO Threat Research.