[dotcppfile]

Hello everyone,




About:

There's multiple things that makes DAws better than every Web Shell out there:

1. Supports CGI by dropping Bash Shells (for Linux) and Batch Shells (for Windows).
   
2. Bypasses WAFs, Disablers and Protection Systems; DAws isn't just about using a particular function to get the job done, it uses up to 6 functions if needed, for example, if shell_exec was disabled it would automatically use exec or passthru or system or popen or proc_open instead, same for Downloading a File from a Link, if Curl was disabled then file_get_content is used instead and this Feature is widely used in every section and fucntion of the shell. (Yes, it bypasses Suhosin too)
   
3. Automatic Encoding; DAws randomly and automatically encodes most of your GET and POST data using XOR(Randomized key for every session) + Base64(We created our own Base64 encoding functions instead of using the PHP ones to bypass Disablers) which will allow your shell to Bypass pretty much every WAF out there.
   
4. Advanced File Manager; DAws's File Manager contains everything a File Manager needs and even more but the main Feature is that everything is dynamically printed; the permissions of every File and Folder are checked, now, the functions that can be used will be available based on these permissions, this will save time and make life much easier.
   
5. Tools: DAws holds bunch of useful tools such as "bpscan" which can identify useable and unblocked ports on the server within few minutes which can later on allow you to go for a bind shell for example.
   
6. Everything that can't be used at all will be simply removed so Users do not have to waste their time. We're for example mentioning the execution of c++ scripts when there's no c++ compilers on the server(DAws would have checked for multiple compilers in the first place) in this case, the function would be automatically removed and the User would know.
   
7. Supports Windows and Linux.
   
8. Openned Source.
   

Extra Info:

1. Directory Romaing:
   
   1. DAws checks, within the `web` directory, for a Writable and Readable Directory which will then be used to Drop and Execute needed scripts which will guarantee their success.
      
   
   
2. Eval Form:
   
   1. `include`, `include_once`, `require` or `require_once` are being used instead PHP `eval` to bypass Protection Systems.
      
   
   
3. Download from Link - Methods:
   
   1. PHP Curl
      
   2. File_put_content
      
   
   
4. Zip - Methods:
   
   1. Linux:
      
      1. Zip
         
   2. Windows:
      
      1. Vbs Script
         
   
   
5. Shells and Tools:
   
   1. Extra:
      
      1. `nohup`, if installed, is automatically used for background processing.
         

Updates:

DAws and its tools are always being Updated, you can check it all on Github.


Credits:

1. dotcppfile
   
2. Aces
   

[Dyme]

1. Bypasses WAFs, Disablers and Protection Systems; DAws isn't just about using a particular function to get the job done, it uses up to 6 functions if needed, for example, if shell_exec was disabled it would automatically use exec or passthru or system or popen or proc_open instead, same for Downloading a File from a Link, if Curl was disabled then file_get_content is used instead and this Feature is widely used in every section and fucntion of the shell. (Yes, it bypasses Suhosin too)
   

A pretty bold claim, but it's very circumstantial...

While yes, this tool is able to drop and utilize a cgi shell, it is still dependent on the use of a .htaccess file. This matters because the default configuration for apache does not allow the use of .htaccess. In order for this to work, AllowOverride has to be explicitly set by the administrator for a directory you have write access to. This is rare to begin with, and as you can assume, it's even more rare on systems utilizing disable_functions or Suhosin.

Therefore, this particular "feature" isn't really anything new or innovative, as it's been seen in 2 year old fuhosin and even older shells. Don't take this as a criticism, I just thought I would explain to others why this probably won't bypass a lot of servers using disable_functions or Suhosin. Nevertheless, I'm glad you're working on something that could be productive.

If you're looking for another way to get sh/bash execution, I would suggest adding CVE-2014-6271 support. Let me know if you need help with anything.

[TheGodM9]

This actually looks pretty dope, shit. All the fail options are great to make sure the most can be done with the shell.

[dotcppfile]

Yes Dyme, you're completely right and I tried to mention that this requires .htaccess to be enabled in the first place: https://github.com/dotcppfile/DAws/relea...2F2%2F2015 now I do believe that when it comes to it, the .htaccess file has to be enabled in most public sources out there such as wordpress.
About the feature itself, you're right, it's not something new but I think the way it's implemented in DAws makes it kinda better since the cgi shell gets dropped in a proper place where it communicates completely with DAws, every feature in the shell would work even if every system command was disabled; the cgi shell is never independent.
Thanks for replying, I do appreciate a good reply after all the gay ass shit I've seen on HF. We're ready to fix, update or add anything needed.

[Dyme]

Yes Dyme, you're completely right and I tried to mention that this requires .htaccess to be enabled in the first place: https://github.com/dotcppfile/DAws/relea...2F2%2F2015 now I do believe that when it comes to it, the .htaccess file has to be enabled in most public sources out there such as wordpress.
About the feature itself, you're right, it's not something new but I think the way it's implemented in DAws makes it kinda better since the cgi shell gets dropped in a proper place where it communicates completely with DAws, every feature in the shell would work even if every system command was disabled; the cgi shell is never independent.
Thanks for replying, I do appreciate a good reply after all the gay ass shit I've seen on HF. We're ready to fix, update or add anything needed.

I've submitted a pull request that will add support for getting bash execution via Shellshock. It works well, but may need some cleaning up; I did it relatively quickly. Review the changes and decide what you want to do with it.

https://github.com/dotcppfile/DAws/pull/2

Also, any recent version of wordpress doesn't need .htaccess. I have had both 3.9.1 and 4.1 installed on my box for some time now, and they work perfectly fine with AllowOverride set to none for all dirs. Maybe this was the case with older versions?

[Reiko]

https://github.com/dotcppfile/DAws/pull/2

Glad to see my work being put to use.. I'm too lazy to do it myself anymore.

I've got a small fix to contribute but I hate public git repos. You call shellshock() twice even if it failed once already when you test if it works.
Change your check to something like this:

PHP Code:

is_callable("mail")? $sstest = @shellshock("pwd") : $sstest = "Er 1"; $shellshock = ($sstest != "Er 1" && $sstest != "Er 2");

edit2: this is just a POC. Make sure you do better checking if mail is dis/blacklisted

[Yani]

CVE-2014-6271 would be a good addition as the others said.
Besides that it looks pretty good.

[dotcppfile]

I've submitted a pull request that will add support for getting bash execution via Shellshock. It works well, but may need some cleaning up; I did it relatively quickly. Review the changes and decide what you want to do with it.

https://github.com/dotcppfile/DAws/pull/2

Also, any recent version of wordpress doesn't need .htaccess. I have had both 3.9.1 and 4.1 installed on my box for some time now, and they work perfectly fine with AllowOverride set to none for all dirs. Maybe this was the case with older versions?

Thank for the Pull Request mate, appreciated, also, am not sure about it but I think I've seen .htaccess files related to Wordpress dropped on multiple servers.

---

Glad to see my work being put to use.. I'm too lazy to do it myself anymore.

I've got a small fix to contribute but I hate public git repos. You call shellshock() twice even if it failed once already when you test if it works.
Change your check to something like this:

PHP Code:

is_callable("mail")? $sstest = @shellshock("pwd") : $sstest = "Er 1"; $shellshock = ($sstest != "Er 1" && $sstest != "Er 2");

edit2: this is just a POC. Make sure you do better checking if mail is dis/blacklisted

I think that it was all dealt with properly in the release, thanks for sharing your work in the first place.

---

CVE-2014-6271 would be a good addition as the others said.
Besides that it looks pretty good.

Great you liked it and thanks for supporting the project.

---

New Release: https://github.com/dotcppfile/DAws/relea...2F2%2F2015

[blackhatcat]

Not too shabby, but nothing special, how about open_basedir? And "bypasses suhosin" sure..maybe a poorly configured suhosin, lol. Suppose it has potential if you put in actual effort and be more innovative.

[dotcppfile]

Not too shabby, but nothing special, how about open_basedir? And "bypasses suhosin" sure..maybe a poorly configured suhosin, lol. Suppose it has potential if you put in actual effort and be more innovative.

Elaborate mate, I do take criticism in a good way but your reply is just one of these lame ones Lol.