Skip to content
Nuclei Templates

AntSword Backdoor Detection

ID: antsword-backdoor

Severity: critical

Author: ffffffff0x

Tags: backdoor,antsword

Description

Section titled “Description”

An AntSword application backdoor shell was discovered.

YAML Source

Section titled “YAML Source”
id: antsword-backdoor


info:
  name: AntSword Backdoor Detection
  author: ffffffff0x
  severity: critical
  description: An AntSword application backdoor shell was discovered.
  remediation: Reinstall AnstSword on a new system due to the target system's compromise. Follow best practices for securing PHP servers/applications via the php.ini and other mechanisms.
  reference:
    - https://github.com/AntSwordProject/AntSword-Labs/tree/master/bypass_disable_functions/9
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cwe-id: CWE-553
  metadata:
    max-request: 1
  tags: backdoor,antsword


http:
  - method: POST
    path:
      - "{{BaseURL}}/.antproxy.php"


    headers:
      Content-Type: application/x-www-form-urlencoded


    body: 'ant=echo md5("antproxy.php");'


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "951d11e51392117311602d0c25435d7f"


      - type: status
        status:
          - 200
# digest: 4a0a00473045022100aa41e72b1dbd454c4410002bb54b3583a9e601fce55b0c7b5455f31a9d8f5bae02204de1a9b2bf400ae45d526d4f086e59b39eba1fc50a779707aa5c33b2c5151282:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/vulnerabilities/backdoor/antsword-backdoor.yaml"

View on Github