Control Web Panel Rootkit: Detecting and Eradicating Stealth Backdoors in CWP Web Servers

---
title: CWP Web Server Process Anomaly - Suspicious Child Process Execution
id: 7f3a9b2c-4e8d-4f1a-9c6b-2d5e8a1f3c4d
status: experimental
description: Detects CWP web server processes spawning unexpected shell interpreters or command-line tools, indicative of web-based command execution backdoor activity.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.persistence
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/cwp'
      - '/cwpsrv'
      - '/nginx'
      - '/apache'
      - '/httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
      - '/php'
      - '/wget'
      - '/curl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate CWP administrative scripts
  - Backup operations initiated through panel
level: high
---
title: CWP Binary Modification - Hash Mismatch
id: 3b8f1a9c-2e7d-4c5b-8a3f-1d9e6c2b5a4f
status: experimental
description: Identifies modified CWP web server binaries by comparing current file hashes against known-good baseline or package manager checksums.
references:
  - https://attack.mitre.org/techniques/T1554/
  - https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1554
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/usr/local/cwpsrv/bin/'
      - '/usr/local/cwp/'
      - '/usr/local/apache/bin/httpd'
  condition: selection
falsepositives:
  - Legitimate CWP updates
  - Custom compiled modules
level: medium
---
title: Network Beaconing from CWP Server - Unusual Outbound Connections
id: 9c4d2e8f-1a6b-4d3c-9e5a-7f2b8d4c1a6e
status: experimental
description: Detects CWP web server processes establishing outbound network connections to unusual destinations, potentially indicating C2 traffic or data exfiltration following command execution.
references:
  - https://attack.mitre.org/techniques/T1071.001/
  - https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/cwp'
      - '/cwpsrv'
      - '/httpd'
      - '/nginx'
    DestinationPort:
      - 443
      - 80
      - 8080
  filter_rfc1918:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_rfc1918
falsepositives:
  - Legitimate updates to CWP repositories
  - License validation checks
level: medium

// Hunt for CWP-related processes executing shell commands
// Focus on process lineage anomalies where web server spawns unexpected children
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("cwpsrv", "cwp", "httpd", "nginx", "apache")
| where FileName has_any ("sh", "bash", "dash", "python", "perl", "wget", "curl", "nc", "netcat")
| where ProcessCommandLine !contains "cron" and ProcessCommandLine !contains "backup"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, InitiatingProcessId
| order by TimeGenerated desc

// Alternative: Syslog-based hunt for CWP process anomalies
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName contains "cwp" or ProcessName contains "httpd"
| where SyslogMessage contains "executed" or SyslogMessage contains "command"
| where SyslogMessage !contains "GET" and SyslogMessage !contains "POST"  // Look for gaps in expected logging
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for modified CWP binaries and suspicious processes
-- Check CWP binary integrity and look for web server spawning shells

SELECT 
    Pid,
    Name,
    Exe,
    Cmdline,
    Username,
    CreateTime,
    PPid,
    PName as ParentName
FROM pslist()
WHERE 
    (PName =~ 'cwp|httpd|nginx|apache' AND Name =~ 'sh|bash|dash|python|perl|php|wget|curl|nc')
    OR (Exe =~ '/usr/local/cwp/' OR Exe =~ '/usr/local/cwpsrv/')

-- Check for recently modified CWP binaries (potential backdoor installation)
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    hash(path=FullPath) as FileHash
FROM glob(globs='/usr/local/cwpsrv/bin/*')
WHERE Mtime > now() - 86400*7  // Modified in last 7 days
ORDER BY Mtime DESC

#!/bin/bash
# CWP Backdoor Detection and Remediation Script
# Run with root privileges on suspected CWP servers

set -euo pipefail

LOG_FILE="/var/log/cwp_integrity_check_$(date +%Y%m%d_%H%M%S).log"
echo "[+] CWP Security Audit Started: $(date)" | tee -a "$LOG_FILE"

# Function to check binary integrity against package manager
check_binary_integrity() {
    echo "[+] Checking CWP binary integrity..." | tee -a "$LOG_FILE"
    
    # Check if CWP binaries match package checksums (RPM-based systems)
    if command -v rpm &> /dev/null; then
        rpm -Va | grep -E "cwp|cwpsrv" | tee -a "$LOG_FILE" || echo "No RPM discrepancies found" | tee -a "$LOG_FILE"
    fi
    
    # Check for recently modified critical binaries
    echo "[+] Checking for recently modified web server binaries..." | tee -a "$LOG_FILE"
    find /usr/local/cwpsrv/bin/ -type f -mtime -7 -exec ls -la {} \; 2>/dev/null | tee -a "$LOG_FILE" || echo "CWP path not found" | tee -a "$LOG_FILE"
    
    # Verify process trees
    echo "[+] Analyzing process tree for web server spawning shells..." | tee -a "$LOG_FILE"
    ps auxf | grep -E "(cwpsrv|httpd|nginx)" | grep -v grep | tee -a "$LOG_FILE"
}

# Function to detect log tampering
check_log_integrity() {
    echo "[+] Checking for log gaps or anomalies..." | tee -a "$LOG_FILE"
    
    # Check if web server is running but not logging
    if pgrep -x "cwpsrv" > /dev/null || pgrep -x "httpd" > /dev/null; then
        LOG_COUNT=$(wc -l < /usr/local/cwpsrv/logs/access_log 2>/dev/null || echo "0")
        if [ "$LOG_COUNT" -lt 10 ]; then
            echo "[!] WARNING: Web server running but access log has only $LOG_COUNT entries (possible log suppression)" | tee -a "$LOG_FILE"
        fi
    fi
    
    # Check for timestamp inconsistencies
    echo "[+] Checking log file timestamps..." | tee -a "$LOG_FILE"
    ls -la /usr/local/cwpsrv/logs/ 2>/dev/null | tee -a "$LOG_FILE" || echo "Log directory not accessible" | tee -a "$LOG_FILE"
}

# Function to hunt for persistence mechanisms
check_persistence() {
    echo "[+] Checking for unauthorized persistence mechanisms..." | tee -a "$LOG_FILE"
    
    # Check cron jobs
    echo "--- Crontab entries ---" | tee -a "$LOG_FILE"
    crontab -l 2>/dev/null | tee -a "$LOG_FILE" || echo "No root crontab" | tee -a "$LOG_FILE"
    ls -la /etc/cron.d/ 2>/dev/null | grep -v "^total" | tee -a "$LOG_FILE"
    
    # Check systemd services
    echo "--- Suspicious systemd services ---" | tee -a "$LOG_FILE"
    systemctl list-units --type=service --state=running | grep -E "cwp|httpd|nginx" | tee -a "$LOG_FILE"
    
    # Check for LD_PRELOAD rootkits
    echo "--- Checking for LD_PRELOAD hijacking ---" | tee -a "$LOG_FILE"
    cat /etc/ld.so.preload 2>/dev/null | tee -a "$LOG_FILE" || echo "No ld.so.preload found" | tee -a "$LOG_FILE"
}

# Function to check network connections
check_network() {
    echo "[+] Checking for suspicious network connections..." | tee -a "$LOG_FILE"
    
    # Look for web server processes with unexpected outbound connections
    netstat -tulpn 2>/dev/null | grep -E "(cwpsrv|httpd|nginx)" | tee -a "$LOG_FILE" || ss -tulpn | grep -E "(cwpsrv|httpd|nginx)" | tee -a "$LOG_FILE"
    
    # Check for listening ports on unusual interfaces
    echo "--- Listening ports ---" | tee -a "$LOG_FILE"
    netstat -tuln 2>/dev/null | grep LISTEN | tee -a "$LOG_FILE" || ss -tuln | grep LISTEN | tee -a "$LOG_FILE"
}

# Function to perform memory analysis prep
capture_memory_artifacts() {
    echo "[+] Capturing volatile artifacts for forensic analysis..." | tee -a "$LOG_FILE"
    
    # Capture process memory maps for web server processes
    for pid in $(pgrep -x "cwpsrv" 2>/dev/null); do
        echo "--- Memory maps for PID $pid ---" | tee -a "$LOG_FILE"
        cat "/proc/$pid/maps" 2>/dev/null | grep -E "(deleted|\.so)" | tee -a "$LOG_FILE" || true
    done
    
    # Capture loaded kernel modules
    echo "--- Loaded kernel modules ---" | tee -a "$LOG_FILE"
    lsmod | tee -a "$LOG_FILE"
}

# Remediation recommendations
remediate() {
    echo "" | tee -a "$LOG_FILE"
    echo "[!] REMEDIATION RECOMMENDATIONS:" | tee -a "$LOG_FILE"
    echo "1. If binary integrity checks fail or suspicious processes found: ISOLATE the system immediately" | tee -a "$LOG_FILE"
    echo "2. Capture full memory dump before remediation: dd if=/dev/mem of=/mnt/forensics/memory.img" | tee -a "$LOG_FILE"
    echo "3. Reinstall CWP from official sources or restore from known-good backup" | tee -a "$LOG_FILE"
    echo "4. Rotate ALL credentials (root, MySQL, CWP admin, API keys)" | tee -a "$LOG_FILE"
    echo "5. Audit for lateral movement - check SSH keys, authorized_keys, and authentication logs" | tee -a "$LOG_FILE"
    echo "6. Implement file integrity monitoring (AIDE, Tripwire) on /usr/local/cwpsrv/" | tee -a "$LOG_FILE"
    echo "7. Deploy network monitoring to detect outbound connections from web server processes" | tee -a "$LOG_FILE"
}

# Main execution
main() {
    check_binary_integrity
    check_log_integrity
    check_persistence
    check_network
    capture_memory_artifacts
    remediate
    
    echo "" | tee -a "$LOG_FILE"
    echo "[+] Audit complete. Log saved to: $LOG_FILE"
    echo "[+] Review $LOG_FILE for indicators of compromise"
}

main