How to Detect Hidden Webshells on Windows Using Python

0X01 NTFS Alternate Data Streams Hidden Webshell

NTFS alternate data streams (ADS) allow a file to contain multiple data streams. Attackers can hide one‑line webshells in ADS, making them invisible to normal traversal. The following Python script scans a directory, lists all ADS files, maps included .asp files, and reports matches.

# -*- coding: cp936 -*-
import os, os.path
import re

def searchNTFS(catalog):
    resultL = []
    for root, dirs, files in os.walk(catalog):
        line = ''
        command = 'cd ' + root + '&' + 'dir /r'
        r = os.popen(command)
        info = r.readlines()
        for l in info:
            line += l
        reN = r'\s(\S+):\$DATA'
        res = re.findall(reN, line)
        for re1 in res:
            if re1 != '':
                resultL.append(root + '\\' + re1)
    return resultL

def searchInclude(catalog):
    resultD = {}
    for root, dirs, files in os.walk(catalog):
        for f in files:
            path = os.path.join(root, f)
            if path[-4:].lower() == '.asp':
                try:
                    with open(path, 'r') as fp:
                        for line in fp.readlines():
                            reN = r'<!--#include\S+="(\S+)"-->'
                            for inc in re.findall(reN, line):
                                if inc:
                                    resultD[root + '\\' + inc] = path
                except:
                    print "File :" + path + " can't be read"
    return resultD

if __name__ == "__main__":
    inc_map = searchInclude('C:\\inetpub\\wwwroot')
    ads_list = set(searchNTFS('C:\\inetpub\\wwwroot'))
    suspicious = set(inc_map.keys()).intersection(ads_list)
    if suspicious:
        for file in suspicious:
            print "[+] Suspicious ADS file: " + file
            print "[+] Included by: " + inc_map[file]
    else:
        print "[+] No suspicious ADS files found."

0X02 Malformed and Reserved Filenames Hidden Webshell

Windows allows filenames with multiple dots (malformed) and reserved names (aux, prn, con, etc.) that are inaccessible via normal UI but can be created using the \.\