---
title: Hunt: signs of the PHP2Shell + Fragnesia firewall chain: huge multipart POSTs to the management UI, /etc/pam.d/su rewritten to pam_permit, a tiny PHP webshell, and a reverse SSH tunnel in systemd and rc.local | ctxsec
url: https://ctxsec.com/items/hunt-php2shell-fragnesia-firewall-root-artifacts
description: ""
status: "vendor research (Dream Research, Oct 26)"
published: 2026-10-28
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-php2shell-fragnesia-firewall-root-artifacts.md)

vendor research (Dream Research, Oct 26)

2026-10-28

### Hunt: signs of the PHP2Shell + Fragnesia firewall chain: huge multipart POSTs to the management UI, /etc/pam.d/su rewritten to pam_permit, a tiny PHP webshell, and a reverse SSH tunnel in systemd and rc.local

Things Dream says the chain in the [firewall campaign](/items/dream-php2shell-fragnesia-chain-roots-24-firewalls-us-gov) leaves behind:

- **Network:** bursts of crafted multipart POSTs with very long filenames and `session.upload_progress` data to the appliance's PHP management server, about 900 MB in total across two memory-exhaustion stages. A leaked pointer comes back in a `Set-Cookie` header. Crashes or reboots of the management process after such traffic are themselves a signal.
- **Privilege escalation:** Fragnesia (CVE-2026-46300, XFRM ESP-in-TCP page-cache write) overwrites `/etc/pam.d/su` so it uses `pam_permit.so`, which lets `su root` work without a password. Compare that file against a known-good copy.
- **Persistence:** a 103-byte PHP webshell in a publicly reachable web directory, verified with `id`, plus an 8-port reverse SSH tunnel wrapped in a systemd service and an `rc.local` hook, forwarding LDAP, LDAPS, RDP, the firewall manager, VPN and a SOCKS5 proxy.
- **Identity:** LDAP enumeration of every user and group, password spraying and new user or machine accounts coming from a firewall management server, and access to Keycloak signing material. Check `lockoutThreshold` and `ms-DS-MachineAccountQuota` on the domain.

The attacker also ran about 240 automated probes over two hours against a crashed device, so repeated health checks to a management interface from one external source are worth a look.

Sources: [Dream Research: Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers (Oct 26)](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers)