security testing tools or development environments may upload files with php code in the filename. review the request headers, destination application, and any follow-on requests or server-side execution evidence.

splunk

Techniques

Sample rules

PHP Session Upload Progress with PHP Code in Upload Filename

source: splunk
technicques:

Description

This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag. When observed with “PHP_SESSION_UPLOAD_PROGRESS” behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.

Detection logic

`zeek_http`
method="POST"
request_headers="*"


| eval src=coalesce(src, src_ip, 'id.orig_h'),
       dest=coalesce(dest, dest_ip, 'id.resp_h'),
       dest_port=coalesce(dest_port, 'id.resp_p')


| eval has_phpsessid_field=if(match(request_headers, "(?im)\s*form-data;[^\\r\\n]*\\bname\\s*=\\s*\\\"?PHPSESSID\\\"?(?:;
|[\\r\\n]
|$)"), 1, 0)


| rex max_match=0 field=request_headers "(?im)\s*form-data;(?<part_disposition>[^\\r\\n]*)"


| eval php_open_tag_filenames=mvfilter(match(part_disposition, "(?i)\\bfilename\\s*=.*(?:<\\?php\\b
|<\\?=)"))


| where has_phpsessid_field=1 AND mvcount(php_open_tag_filenames)>0


| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(status_code) as status_code
              values(user_agent) as user_agent
              values(php_open_tag_filenames) as php_open_tag_filenames

  by src dest dest_port uri


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `php_session_upload_progress_with_php_code_in_upload_filename_filter`