Adversaries may backdoor an openly accessible web server with a server-side script to maintain persistent access and use the server as a gateway into a network. Depending on its implementation, a web shell may provide command execution, file operations, or protocol tunneling, and may have a separate client interface.
Check before starting: RESTRICTED_ACCESS_BLUR_MARKER
Variant:
Full outcome coverage
reg.exe · Save SYSTEM Registry Hive for Offline Analysis
Save SYSTEM Registry Hive for Offline Analysis
powershell
RESTRICTED_ACCESS_BLUR_MARKER
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: ALL(RESTRICTED_ACCESS_BLUR_MARKER)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.Shell: RESTRICTED_ACCESS_BLUR_MARKER. Privileges: RESTRICTED_ACCESS_BLUR_MARKER.preconditions: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKERcleanup: RESTRICTED_ACCESS_BLUR_MARKER