shell-checker (selmasker)

shell-checker (branded “selmasker — Webshell Mass Checker 1.0”) presents itself as a utility to validate whether uploaded webshells are still alive and accessible. The operator pastes a list of shell URLs, the tool checks connectivity, and reports which are still live. Attributed to JExCoders / XploitSec-ID from the Indonesian scene, with an Asia/Jakarta timezone hardcoded in the source. The stated function is real — the tool does check shells. But it does something else entirely in a hidden code path.

Capabilities

The stated function is a webshell mass checker: the operator pastes a list of shell URLs, the tool checks connectivity via HTTP requests, and reports which are still live. Total string obfuscation — every string literal in the 9 KB file is wrapped in base64_decode() calls — defeats the most common static-analysis approach to webshell detection: pattern-matching on known dangerous function names and parameters.

Hidden Backdoor

The real payload is a hidden backdoor in the GET branch. When the checker form is not submitted — that is, when the page is loaded without the POST parameters that trigger the checker function — the tool executes a separate code path that decodes to an unauthenticated file upload handler. Any visitor who sends the right request can write arbitrary files directly to the web server’s document root. No authentication, no file-type validation, no size limits. This was confirmed live on a deployed instance. The checker is the shell.

The tool also contains a config-trap pattern: a mail() function with a placeholder recipient (“put_your_email_here”) that the operator is expected to fill in with their own address. Once configured, every hit to the checker sends a notification to that email — effectively doxing the operator to anyone who reads the source code. This is the same “backdoor-the-buyer” pattern seen across the supply-chain infection theme in the corpus: the tool incentivizes the operator to leave a trail.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_shell_checker {
    meta:
        description = "shell-checker (selmasker) — disguised webshell validator (JExCoders)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/shell-checker/"
        status      = "validated"

    strings:
        $selmasker  = "selmasker" ascii nocase
        $jexcoders  = "JExCoders" ascii nocase
        $xploitsec  = "XploitSec" ascii nocase
        $version    = "Webshell Mass Checker 1.0" ascii
        $b64_decode = "base64_decode" ascii
        $ua_qt      = "QtWebEngine" ascii
        $upload_b64 = "bW92ZV91cGxvYWRlZF9maWxl" ascii
        $shell_mail = "Ada shell masuk" ascii

    condition:
        filesize < 15KB
        and ($selmasker or $jexcoders or $xploitsec or $version or $shell_mail or $ua_qt)
        and ($b64_decode or $upload_b64)
}

MITRE ATT&CK

OHIIHO Threat Research.