Detecting execution of a web shell

1 . A system, comprising:

a memory, configured to store a page-executing function, which is configured to execute a web page on a web server, and one or more sensitive functions; and

a processor, configured to:

place, on the page-executing function, a first hook configured to:

ascertain whether the page-executing function is called to execute a server-side script, and

in response to the page-executing function being called to execute a server-side script, associate with a current execution thread, which begins execution of the page-executing function, data associated with the calling of the page-executing function and indicating that the page-executing function is called to execute the server-side script, and place, on at least one of the sensitive functions, a second hook configured to:

ascertain whether the sensitive function is called from an execution thread associated with the data, and

in response to the sensitive function being called from an execution thread associated with the data, output a message including the data.

2 . The system according to claim 1 , wherein the first hook is configured to associate the data with the current execution thread using thread-local storage (TLS).

3 . The system according to claim 1 , wherein the memory is further configured to store a thread-starting function configured to start a new execution thread in response to being called by the current execution thread, and wherein the processor is further configured to place, on the thread-starting function, a third hook configured to:

ascertain whether the current execution thread is associated with the data, and

in response to the current execution thread being associated with the data, associate the data with the new execution thread.

4 . The system according to claim 1 , wherein the memory is further configured to store a queuing function configured add a callback to a queue for assignment to another execution thread in a thread pool in response to being called by the current execution thread, and wherein the processor is further configured to place, on the queuing function, a third hook configured to:

ascertain whether the current execution thread is associated with the data,

in response to the current execution thread being associated with the data, define a wrapper function configured to:

associate the data with the other execution thread, and

subsequently to associating the data with the other execution thread, call the callback, and

add the wrapper function to the queue.

5 . The system according to claim 1 , wherein the second hook is configured to output the message to a security service configured to analyze the data.

6 . The system according to claim 1 , wherein the message further includes any arguments with which the sensitive function is called.

7 . A method, comprising:

placing a first hook on a page-executing function configured to execute a web page on a web server, the first hook being configured to:

ascertain whether the page-executing function is called to execute a server-side script, and

in response to the page-executing function being called to execute a server-side script, associate with a current execution thread, which begins execution of the page-executing function, data associated with the calling of the page-executing function and indicating that the page-executing function is called to execute the server-side script; and

placing a second hook on at least one sensitive function, the second hook being configured to:

ascertain whether the sensitive function is called from an execution thread associated with the data, and

in response to the sensitive function being called from an execution thread associated with the data, output a message including the data.

8 . The method according to claim 7 , wherein the first hook is configured to associate the data with the current execution thread using thread-local storage (TLS).

9 . The method according to claim 7 , further comprising placing a third hook on a thread-starting function configured to start a new execution thread in response to being called by the current execution thread, the third hook being configured to:

ascertain whether the current execution thread is associated with the data, and

in response to the current execution thread being associated with the data, associate the data with the new execution thread.

10 . The method according to claim 7 , further comprising placing a third hook on a queuing function configured to add a callback to a queue for assignment to another execution thread in a thread pool in response to being called by the current execution thread, the third hook being configured to:

ascertain whether the current execution thread is associated with the data,

in response to the current execution thread being associated with the data, define a wrapper function configured to:

associate the data with the other execution thread, and

subsequently to associating the data with the other execution thread, call the callback, and

add the wrapper function to the queue.

11 . The method according to claim 7 , wherein the second hook is configured to output the message to a security service configured to analyze the data.

12 . The method according to claim 7 , wherein the message further includes any arguments with which the sensitive function is called.

13 . A computer software product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a processor, cause the processor to:

place a first hook on a page-executing function configured to execute a web page on a web server, the first hook being configured to:

ascertain whether the page-executing function is called to execute a server-side script, and

in response to the page-executing function being called to execute a server-side script, associate with a current execution thread, which begins execution of the page-executing function, data associated with the calling of the page-executing function and indicating that the page-executing function is called to execute the server-side script, and

place a second hook on at least one sensitive function, the second hook being configured to:

ascertain whether the sensitive function is called from an execution thread associated with the data, and

in response to the sensitive function being called from an execution thread associated with the data, output a message including the data.

14 . The computer software product according to claim 13 , wherein the first hook is configured to associate the data with the current execution thread using thread-local storage (TLS).

15 . The computer software product according to claim 13 , wherein the instructions further cause the processor to place a third hook on a thread-starting function configured to start a new execution thread in response to being called by the current execution thread, the third hook being configured to:

ascertain whether the current execution thread is associated with the data, and

in response to the current execution thread being associated with the data, associate the data with the new execution thread.

16 . The computer software product according to claim 13 , wherein the instructions further cause the processor to place a third hook on a queuing function configured to add a callback to a queue for assignment to another execution thread in a thread pool in response to being called by the current execution thread, the third hook being configured to:

ascertain whether the current execution thread is associated with the data,

in response to the current execution thread being associated with the data, define a wrapper function configured to:

associate the data with the other execution thread, and

subsequently to associating the data with the other execution thread, call the callback, and

add the wrapper function to the queue.

17 . The computer software product according to claim 13 , wherein the second hook is configured to output the message to a security service configured to analyze the data.

18 . The computer software product according to claim 13 , wherein the message further includes any arguments with which the sensitive function is called.

19 . A system, comprising:

a memory, configured to store a page-executing function, which is configured to execute a web page on a web server, and at least one sensitive function; and

a processor, configured to:

ascertain, upon the page-executing function being called, whether the page-executing function is called to execute a server-side script,

in response to the page-executing function being called to execute a server-side script, associate with a current execution thread, which begins execution of the page-executing function, data associated with the calling of the page-executing function and indicating that the page-executing function is called to execute the server-side script,

ascertain, upon the sensitive function being called, whether the sensitive function is called from an execution thread associated with the data, and

in response to the sensitive function being called from an execution thread associated with the data, output a message including the data.

20 . The system according to claim 19 , wherein the processor is configured to associate the data with the current execution thread using thread-local storage (TLS).

21 . The system according to claim 19 , wherein the memory is further configured to store a thread-starting function configured to start a new execution thread in response to being called by the current execution thread, and wherein the processor is further configured to:

ascertain, upon the thread-starting function being called, whether the current execution thread is associated with the data, and

in response to the current execution thread being associated with the data, associate the data with the new execution thread.

22 . The system according to claim 19 , wherein the memory is further configured to store a queuing function configured add a callback to a queue for assignment to another execution thread in a thread pool in response to being called by the current execution thread, and wherein the processor is further configured to:

ascertain, upon the queuing function being called, whether the current execution thread is associated with the data,

in response to the current execution thread being associated with the data, define a wrapper function configured to:

associate the data with the other execution thread, and

subsequently to associating the data with the other execution thread, call the callback, and

add the wrapper function to the queue.

23 . The system according to claim 19 , wherein the processor is configured to output the message to a security service configured to analyze the data.

24 . The system according to claim 19 , wherein the message further includes any arguments with which the sensitive function is called.

25 . A method, comprising:

upon a page-executing function, which is configured to execute a web page on a web server, being called, ascertaining whether the page-executing function is called to execute a server-side script;

in response to the page-executing function being called to execute a server-side script, associating with a current execution thread, which begins execution of the page-executing function, data associated with the calling of the page-executing function and indicating that the page-executing function is called to execute the server-side script;

upon a sensitive function being called, ascertaining whether the sensitive function is called from an execution thread associated with the data; and

in response to the sensitive function being called from an execution thread associated with the data, outputting a message including the data.

26 . The method according to claim 25 , wherein associating the data with the current execution thread comprises associating the data with the current execution thread using thread-local storage (TLS).

27 . The method according to claim 25 , further comprising:

upon a thread-starting function, which is configured to start a new execution thread in response to being called by the current execution thread, being called, ascertaining whether the current execution thread is associated with the data; and

in response to the current execution thread being associated with the data, associating the data with the new execution thread.

28 . The method according to claim 25 , further comprising:

upon a queuing function, which is configured to add a callback to a queue for assignment to another execution thread in a thread pool in response to being called by the current execution thread, being called, ascertaining whether the current execution thread is associated with the data;

in response to the current execution thread being associated with the data, defining a wrapper function configured to:

associate the data with the other execution thread, and

subsequently to associating the data with the other execution thread, call the callback; and

adding the wrapper function to the queue.

29 . The method according to claim 25 , wherein outputting the message comprises outputting the message to a security service configured to analyze the data.

30 . The method according to claim 25 , wherein the message further includes any arguments with which the sensitive function is called.