# WTA: A Static Taint Analysis Framework for PHP Webshell
## 3 Motivation
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Opline** & **Type** & **SinkFuncFlag** & **TaintVarFlag** & **Sink** \\ \hline \(INIT\_FCALL\) & INIT & \(\bullet\) & – & – \\ \(INIT\_FCALL\_BY\_NAME\) & INIT & \(\bullet\) & – & – \\ \(INIT\_METHOD\_CALL\) & INIT & \(\bullet\) & – & – \\ \(INIT\_USER\_CALL\) & INIT & \(\bullet\) & – & – \\ \(INIT\_DY\_NAME\_CALL\) & INIT & \(\bullet\) & – & – \\ \(\mathit{SEND\_VAL\_}\) & Param & – & \(\bullet\) & – \\ \(\mathit{SEND\_VAL\_EX}\) & Param & – & \(\bullet\) & – \\ \(\mathit{SEND\_VAR\_}\) & Param & – & \(\bullet\) & – \\ \(\mathit{SEND\_VAR\_}\) & Param & – & \(\bullet\) & – \\ \(\mathit{SEND\_VAR\_EX}\) & Param & – & \(\bullet\) & – \\ \(\mathit{SEND\_USER\_}\) & Param & – & \(\bullet\) & – \\ \(\mathit{SEND\_ARRAY\_}\) & Param & – & \(\bullet\) & – \\ \(\mathit{SEND\_ARRAY\_}\) & Param & – & \(\bullet\) & – \\ \(\mathit{D\_ISA\_}\) & CALL & – & – & \(\mathit{BinFuncFlag\In the phase of Param, when the corresponding operand of the Opline is found to be a taint variable, it is determined that the taint variable is imported by the function call, and the value of TaintVarFlag is set to one, indicating that the taint variable is passed as a parameter. Finally, in the phase of CALL, when \(\text{SinkFuncFlag}=1\&\&\text{TaintVarFlag}=1\) is found, it is the taint sink, and the sample is determined to be a webshell. It is worth noting that Opline Eval itself represents a dangerous function call, so it only needs to meet TaintVarFlag = 1 to qualify as a webshell. In addition, \(\text{SinkFuncFlag}\) and \(\text{TaintVarFlag}\) always appear in pairs, and both Flag values are reset to zero after the judgment is completed. ### Example Illustration

Reviewing the include-type webshell example named webshell-1.php in Section 3 and analyzing it using the method proposed in this paper, the sample code is transformed into Opline sequences, as shown in Figure 4. In this example, hello.txt is the file included in the webshell-1.php. The Opline sequences of hello.txt are obtained by file inclusion recursion detection, which is shown in Figure 5.

In Figure 5, it is observed that Line 8 is in accordance with the taint propagation rule of \(\text{FETCH\_R}v_{A},\text{C},\) and C is the super global variable _POST, so Variable 4 is added to the taint variable list and a taint propagation chain is created at the same time, with Variable 4 as the head node of this chain. Then, the Opline in Line 9 conforms to the taint propagation rule of \(\text{FETCH\_DIM\_R}v_{A},\text{C},\) so the return value of Variable 6 is tainted, added to the taint variable list, and inserted into the taint propagation chain with Variable 4 as the previous node. On Line 10, the extended_value of Opline is EVAL, and op1 is Variable 6, which is a taint variable. Therefore, it meets the taint sink rules, and the sample file is determined to be a webshell file. The method proposed in this paper can be used to easily determine that the sample code is a webshell. We will further verify the advantages of our method in the next section. Figure 4: The Opline sequences of webshell1.php. Columns 5 (op) and 8 (return) represent op-code and opline return values. Column 9 (operands) has three values, oprands1, oprands2, and extended_value. Figure 5: The Opline sequences of hello.txt. ## 6 Evaluation

In order to evaluate the webshell static detection method based on taint analysis proposed in this paper, a series of experiments is designed on the real program in this section and compared with relevant technologies. The experiments are described below. ### Evaluation Setup

We designed the experiments to answer the following research questions:

**RQ1**: Is the interprocedural analysis module based on taint analysis effective at the detection of user-defined function-type webshells and include-type webshells? **RQ2**: Does the webshell detection method based on taint analysis have a better effect against unknown webshells? **RQ3**: Does WTA have better performance than well-known webshell detection tools?