whmcs-killer-v3

whmcs-killer-v3 is a webshell purpose-built to target WHMCS, the dominant billing and hosting automation platform. Attributed to RAB3OUN (Arabic/international scene).

Capabilities

WHMCS databases contain the highest-value data on any hosting infrastructure: client personal information, payment details, hosting account credentials, domain registrations, and support tickets. A single successful deployment yields the complete client database of a hosting provider.

Six Pre-Auth Attack Vectors

The shell presents six independent attack surfaces, all exploitable without authentication. The redundancy is not accidental — it reflects both deliberate multi-vector design and supply-chain contamination layered on top.

W0rm supply-chain backdoor. A global-scope command dispatch injected by the W0rm supply chain fires before any authentication check. Any visitor who knows the trigger parameter gets unauthenticated remote code execution. The operator deploying whmcs-killer is simultaneously deploying a backdoor for W0rm.

Client-side session forgery. The authentication mechanism relies on a trivial client-side session check that can be forged with a single crafted HTTP header. No credentials required — the check is cosmetic, not cryptographic. Any visitor who understands the mechanism has full panel access.

File inclusion with eval. A form handler accepts unsanitized input that is passed directly to both a file-read function and an eval() call. An unauthenticated visitor can read arbitrary files on the host and execute arbitrary PHP code through a single request parameter. No upload or write access needed.

Arbitrary file upload. A separate upload handler writes files directly to the web root with no extension filtering, no size limit, and no authentication check. Any unauthenticated visitor can drop a secondary webshell or binary payload.

SQL injection. Multiple database query paths concatenate user input directly into SQL strings without parameterization or escaping. Exploitable against the WHMCS database — the highest-value target on the server.

Stored XSS. The shell injects content into WHMCS configuration fields that persists across page loads, enabling session hijacking against legitimate WHMCS administrators who visit the panel.

Vulnerabilities

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_whmcs_killer {
    meta:
        description = "whmcs-killer-v3 billing system exploitation tool (RAB3OUN)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/whmcs-killer/"
        status      = "validated"

    strings:
        $tbladmins  = "tbladmins" ascii
        $reset_pw   = "e10adc3949ba59abbe56e057f20f883e" ascii
        $rab3oun    = "rab3oun" ascii nocase
        $erreur_sql = "Erreur SQL !" ascii
        $post_f     = "$_POST[\"f\"]" ascii
        $c0de_var   = "$c0de" ascii
        $f0p3n_var  = "$f0p3n" ascii
        $dropper1   = "downloads/rab3oun.php" ascii
        $dropper2   = "attachments/rab3oun.php" ascii

    condition:
        filesize < 200KB
        and (
            ($tbladmins and ($reset_pw or $erreur_sql or $post_f))
            or ($rab3oun and ($c0de_var or $f0p3n_var))
            or ($dropper1 or $dropper2)
        )
}

W0rm-infected variants are also caught by the generic W0rm supply-chain rule — see the W0rm supply-chain detection applicable to all infected tools.

MITRE ATT&CK

OHIIHO Threat Research.