Sweep a web root for a PHP web shell

Run two YARA rules over a WordPress-style web root. The broad one finds every eval, the strict one finds the shell. Learn why both results matter before you trust a rule.

Terminal mission
Intermediate
4 objectives
0 of 4 solved

Briefing

A WAF alert showed a POST to /wp-content/uploads/2026/03/thumb.php. You have a read-only copy of the web root at /srv/www and two rules in ~/rules.

yara RULES TARGET scans a file. -r walks a directory. -s prints each matched string with its offset, which shows why a rule fired.

analyst@ir-ws

ir-ws · YARA triage

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@ir-ws:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.