Hey,
I have been trying to upload different shells to a site through cpanel. The problem is that the antivirus immediately detects the file as a shell and deletes it (unfortunately). I have tried with encrypted shells but still no luck. Opening remote urls is also disabled. Any ideas?
(Sep 30, 2010 11:42 AM)iPwnage Wrote: Hey,
I have been trying to upload different shells to a site through cpanel. The problem is that the antivirus immediately detects the file as a shell and deletes it (unfortunately). I have tried with encrypted shells but still no luck. Opening remote urls is also disabled. Any ideas?
Are you talking about PC's antivirus or cPanel 'antivirus'?
(Sep 30, 2010 12:19 PM)nigganigganigga Wrote: Are you talking about PC's antivirus or cPanel 'antivirus'?
That's what I'd like to know. If it's just your PC antivirus, don't save the shell.php, just click on 'New File', rename it to 'Shell.php', then paste the shell php source into 'Shell.php'.
I don't know much about cPanel Antiviruses, I didn't even know they existed.
@Mark, can you tell us more about those ?
(Sep 30, 2010 12:20 PM)Tate Wrote: That's what I'd like to know. If it's just your PC antivirus, don't save the shell.php, just click on 'New File', rename it to 'Shell.php', then paste the shell php source into 'Shell.php'.
I don't know much about cPanel Antiviruses, I didn't even know they existed.
@Mark, can you tell us more about those ?
You can upload the shell as {shell.txt} then rename it to {shell.php}
OR
Make an external uploader in php and upload the shell.
Tell me if these 2 solutions works.
Hey, it is not my PC's antivirus, it is on a remote server where I have access to cpanel (with root). When I upload any shell using the uploader, I get an error saying "Virus (c99 900)" or "(PHP Shell)" detected. I have tried pasting the source into a new file, also uploading as text, it detects both. :/ Whats a good alternative uploade
(I tried another cpanel uploader, but that one didnt even give an error, it just failed to upload)
Here is a screenshot:
[img]http://img705.imageshack.us/img705/3664/infodo.png[/img]
Find a source on internet of an uploader and upload your shell.
Yeah upload an uploader php file, and then use it to upload the shell.
If you need help PM me with your teamviewer details I'll do it for you. ;)
convert the shell into ASCII undetectable it happned to me when i try to upload a shell through cpanel ftp i face this problem so the only solutin i think is to convert.
Most webhosts have ClamAV but they dont have it monitoring. You may just try to enter a 4 line rce script to see if it detects that.
Just encode in base64 or other.
(Sep 30, 2010 11:42 AM)iPwnage Wrote: Hey,
I have been trying to upload different shells to a site through cpanel. The problem is that the antivirus immediately detects the file as a shell and deletes it (unfortunately). I have tried with encrypted shells but still no luck. Opening remote urls is also disabled. Any ideas?
(Sep 30, 2010 04:16 PM)nazariy Wrote: Just encode in base64 or other.
Learn to Read lmao.
Clearly said its already encrypted.
Try a simple rce script and if it doesn't work try a cgi shell.
(Sep 30, 2010 07:51 PM)hacc Wrote: (Sep 30, 2010 04:16 PM)nazariy Wrote: Just encode in base64 or other.
Learn to Read lmao.
Clearly said its already encrypted. Encoding just once may be not enough.
And it's signature gets recognized.
Encode Unique Shells Multiple times.
Or Just use a very simple shell.
Idiot.
Hey, after uploading a couple of shells yesterday, the servers were shutdown. (:P) So I will have to wait until they come back up until I can test with more shells. Thanks for all the useful replies :)
Could you please explain a bit more about CGI shells? Some of the sites have a CGI directory, but the tutorials that I saw about CGI shells seem to need to use a perl script (which I cannot execute since I don't have access to a shell or SSH [i get closed off as soon as i login]).
If the above paragraph is completely N00BY I apologize, since I have only worked with PHP shells until now, and I have never actually come across CGI shells.
|
