WSO (Web Shell by Orb)

WSO is the most dangerous shell in the corpus. Not because of sophistication — because of surface area. Five independent attack vectors, all firing before or bypassing authentication entirely. Combined with the W0rm supply-chain injection, any WSO deployment is compromised-on-deploy: the operator gives W0rm persistent unauthenticated access to every host they touch.

Default charset: Windows-1251 (Cyrillic). 69 KB delivers full functionality.

Capabilities

File browser. Command execution. SQL client (MySQL). FTP brute-force. PHP eval. Windows + Linux support. Self-rename. CLI mode — can be invoked as php wso.php <base64_POST> <base64_SERVER> with serialized arguments, enabling persistence even if web access is removed.

Authentication: none by default. The $auth_pass variable is never declared. !empty($auth_pass) evaluates to false — no login prompt, direct access to all shell functions for any visitor.

W0rm Supply-Chain Backdoor

Injected at the file-manager dispatch (fires when FilesMan action loads). Three covert mechanisms:

The W0rm ?cmd= handler executes before any shell logic — it is prepended code, not integrated. The operator deploying WSO has no visibility into these vectors. The shell functions as expected for the operator while simultaneously serving W0rm.

IOC markers: errors_log file written to webroot. Pastebin payload URL: pastebin[.]com/raw/yTXtLFyx (rotatable). Exfil mailbox: md5[.]undersociety[@]gmail[.]com. Campaign tag: 8987RM.

W0rm infects 4 out of 10 Tier 1 shells in the corpus (40% infection rate): WSO, b374k, r57, IndoXploit. The redistributor backdoors the buyers.

Vulnerabilities

Additional Attack Surfaces

Beyond W0rm, WSO carries four independent vulnerability classes:

All four fire independently of the W0rm injection. Combined severity: any WSO copy is exploitable from five different angles simultaneously, none requiring authentication.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rules

rule webshell_wso {
    meta:
        description = "WSO (Web Shell by Orb) v2.x"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/wso/"
        status      = "validated"

    strings:
        $auth_pass    = "$auth_pass" ascii
        $wso_cookie   = "WSOsetcookie" ascii
        $eval_p1      = "eval($_POST['p1'])" ascii
        $md5_host     = "md5($_SERVER['HTTP_HOST'])" ascii
        $globals_auth = "$GLOBALS['auth_pass']" ascii
        $post_pass    = "$_POST['pass']" ascii
        $filesman     = "FilesMan" ascii

    condition:
        filesize < 100KB
        and $auth_pass
        and ($wso_cookie or $md5_host or $globals_auth)
        and ($eval_p1 or $filesman or $post_pass)
}

W0rm supply-chain rule (generic — catches any W0rm-infected tool):

rule webshell_w0rm_prepend {
    meta:
        description = "W0rm supply-chain prepend (cleartext or base64)"
        author      = "OHIIHO Threat Research"
        status      = "validated"

    strings:
        $w0rm_cmd   = "$_GET[\"cmd\"]" ascii
        $w0rm_xsec  = "$_GET[\"xsec\"]" ascii
        $w0rm_mail  = "md5.undersociety" ascii
        $w0rm_pb    = "pastebin.com/raw/" ascii
        $w0rm_block = "xsec=blocker" ascii
        $w0rm_log   = "errors_log" ascii
        $w0rm_b64pb = "aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3" ascii
        $w0rm_from  = "RnJvbTogVzBybQ" ascii

    condition:
        filesize < 500KB and 3 of them
}

MITRE ATT&CK

OHIIHO Threat Research.