+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Antivirus Detects Shell (/showthread.php?tid=711311)
Pages: Pages
1
2
Antivirus Detects Shell - iPwnage - Sep 30, 2010
Hey,
I have been trying to upload different shells to a site through cpanel. The problem is that the antivirus immediately detects the file as a shell and deletes it (unfortunately). I have tried with encrypted shells but still no luck. Opening remote urls is also disabled. Any ideas?
* - nigganigganigga - Sep 30, 2010
(Sep 30, 2010 11:42 AM)iPwnage Wrote: Hey,
I have been trying to upload different shells to a site through cpanel. The problem is that the antivirus immediately detects the file as a shell and deletes it (unfortunately). I have tried with encrypted shells but still no luck. Opening remote urls is also disabled. Any ideas?
Are you talking about PC's antivirus or cPanel 'antivirus'?
* - Tate - Sep 30, 2010
(Sep 30, 2010 12:19 PM)MarkuzZ Wrote: Are you talking about PC's antivirus or cPanel 'antivirus'?
That's what I'd like to know. If it's just your PC antivirus, don't save the shell.php, just click on 'New File', rename it to 'Shell.php', then paste the shell php source into 'Shell.php'.
I don't know much about cPanel Antiviruses, I didn't even know they existed.
@Mark, can you tell us more about those ?
* - nigganigganigga - Sep 30, 2010
(Sep 30, 2010 12:20 PM)Tate Wrote: That's what I'd like to know. If it's just your PC antivirus, don't save the shell.php, just click on 'New File', rename it to 'Shell.php', then paste the shell php source into 'Shell.php'.
I don't know much about cPanel Antiviruses, I didn't even know they existed.
@Mark, can you tell us more about those ?
You can upload the shell as {shell.txt} then rename it to {shell.php}
OR
Make an external uploader in php and upload the shell.
Tell me if these 2 solutions works.
* - iPwnage - Sep 30, 2010
Hey, it is not my PC's antivirus, it is on a remote server where I have access to cpanel (with root). When I upload any shell using the uploader, I get an error saying "Virus (c99 900)" or "(PHP Shell)" detected. I have tried pasting the source into a new file, also uploading as text, it detects both. :/ Whats a good alternative uploade
(I tried another cpanel uploader, but that one didnt even give an error, it just failed to upload)
Here is a screenshot:
[img]http://img705.imageshack.us/img705/3664/infodo.png[/img]
* - nigganigganigga - Sep 30, 2010
Find a source on internet of an uploader and upload your shell.
* - hacc - Sep 30, 2010
Yeah upload an uploader php file, and then use it to upload the shell.
* - nigganigganigga - Sep 30, 2010
If you need help PM me with your teamviewer details I'll do it for you. ;)
* - hamza-net - Sep 30, 2010
convert the shell into ASCII undetectable it happned to me when i try to upload a shell through cpanel ftp i face this problem so the only solutin i think is to convert.
* - cale - Sep 30, 2010
Most webhosts have ClamAV but they dont have it monitoring. You may just try to enter a 4 line rce script to see if it detects that.
* - nazariy - Sep 30, 2010
Just encode in base64 or other.
* - hacc - Sep 30, 2010
(Sep 30, 2010 11:42 AM)iPwnage Wrote: Hey,
I have been trying to upload different shells to a site through cpanel. The problem is that the antivirus immediately detects the file as a shell and deletes it (unfortunately). I have tried with encrypted shells but still no luck. Opening remote urls is also disabled. Any ideas?
(Sep 30, 2010 04:16 PM)nazariy Wrote: Just encode in base64 or other.
Learn to Read lmao.
Clearly said its already encrypted.
* - cale - Sep 30, 2010
Try a simple rce script and if it doesn't work try a cgi shell.
* - nazariy - Oct 1, 2010
(Sep 30, 2010 07:51 PM)hac Wrote:Encoding just once may be not enough.(Sep 30, 2010 04:16 PM)nazariy Wrote: Just encode in base64 or other.
Learn to Read lmao.
Clearly said its already encrypted.
And it's signature gets recognized.
Encode Unique Shells Multiple times.
Or Just use a very simple shell.
Idiot.
* - iPwnage - Oct 1, 2010
Hey, after uploading a couple of shells yesterday, the servers were shutdown. (:P) So I will have to wait until they come back up until I can test with more shells. Thanks for all the useful replies :)
Could you please explain a bit more about CGI shells? Some of the sites have a CGI directory, but the tutorials that I saw about CGI shells seem to need to use a perl script (which I cannot execute since I don't have access to a shell or SSH [i get closed off as soon as i login]).
If the above paragraph is completely N00BY I apologize, since I have only worked with PHP shells until now, and I have never actually come across CGI shells.