symlink.php

symlink.php is a privilege escalation utility designed for shared hosting environments running cPanel. It exploits the symlink() function in PHP to create symbolic links that traverse account boundaries, allowing the operator to read files belonging to other users on the same physical server.

Capabilities

Symlink creation across cPanel account boundaries. Cross-account file read via symbolic link traversal — targets home directories, configuration files, database credentials of co-hosted accounts. Cookie-based authentication for database operation features. Designed for shared hosting where PHP’s open_basedir and symlink restrictions are not properly hardened.

W0rm Supply-Chain Injection

The version circulating in underground channels carries the standard W0rm supply-chain injection. A GET parameter handler at global scope (early in the file, before any authentication logic) provides pre-auth remote code execution on every request. The tool’s own cookie-based authentication is irrelevant — the W0rm payload fires unconditionally before those checks are ever reached.

The same W0rm infrastructure is present: the xsec/blocker file upload backdoor for persistent secondary access, and the Pastebin C2 beacon exfiltrating the server URL and installation path. The pattern is identical to the injections in dbkiss, unzipper, and the major webshells — same operator, same toolchain, same pre-auth execution model.

symlink.php occupies a specific niche: it is deployed alongside a webshell and used to escalate from a single compromised hosting account to reading the entire server’s configuration files (database credentials, API keys, mail configs). On the majority of shared hosting configurations that have not explicitly blocked cross-account symlinks, it is effective. The W0rm injection means the tool’s own operator is also compromised — using symlink.php backdoors the attacker’s own infrastructure as much as the target’s.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_symlink_privesc {
    meta:
        description = "symlink.php cPanel privilege escalation with W0rm injection"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/symlink/"
        status      = "validated"

    strings:
        $symlink     = "symlink(" ascii
        $passwd      = "/etc/passwd" ascii
        $cookie_auth = "$_COOKIE" ascii
        $conf1       = "wp-config.php" ascii
        $conf2       = "configuration.php" ascii
        $htaccess    = ".htaccess" ascii
        $w0rm_cmd    = "$_GET[\"cmd\"]" ascii

    condition:
        filesize < 60KB
        and $symlink
        and ($cookie_auth or $passwd)
        and ($conf1 or $conf2)
        and ($w0rm_cmd or $htaccess)
}

W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.

MITRE ATT&CK

OHIIHO Threat Research.