Waraxe IT Security Portal

erg0t · Valuable expert

I post this to discuss methods of getting something like an interactive shell via php.
It?ll very usefull for servers with very restrictive firewalls that don?t allow you to use any kind of backdoor (either reverse, or non TCP backdoors), so the only way to do sometihing is via the php shell.

The method I use to get root and make some things is the following:

echo "cd /dir_of_the_xpl" > commands
echo "./xpl" >> commands
# And here the commands, for example...
echo "id" >> commands
echo "ls /root" >> commands
# And then
cat commands | /bin/bash -i

is a very uncomfortable way, but works for me
It?ll nice if you have any ideas to try to make an interactive shell in php (the only place I could put an interactive shell was in an irc bot y made in C, forking and using pipes, but in php you are more restricted). Is a good proyect to try...?any ideas?

shai-tan · Valuable expert

I dont have any ideas but I must admit its a firken cool idea.
C you have more options but I truely like php more.

y3dips · Valuable expert

LINUX · Moderator

yes is very good method for root servers whit firewall or not possible for reverse shell

in one file .txt add this content
-------------------------------------------------
echo "cd /dir_of_the_xpl" > commands
echo "./xpl" >> commands
# And here the commands, for example...
echo "id" >> commands
echo "ls /root" >> commands
-----------------------------------------------------
final command is: cat commands | /bin/bash -i

whit line run all commands in txt file, for what ergot run this ? simple for this server have firewall not is possible exec one backdoor and not possible exec reverse shell is very good method

good ergot and me , need more ideas for develop one irc bot or similar

PD: normal irc bot or phpshell not is possible get root in one server, for get root need linux shell

if one waraxe member need share ideas for this theme connect in IPV6.GIGACHAT.NET 6667 #uruguay
or SSL connection /server -e irc.gigachat.net 6697 ou /server irc.gigachat.net +6697 #Gigachat
channel #uruguay or contact whit me in channels #asc #infektion #simiens

erg0t · Valuable expert

y3dips · Valuable expert

erg0t · Valuable expert

Are you saying to run a backdoor and connect to it with a client runing from the same machine and doing the client in php?
So, locally bypass the firewall?
Is a good Idea but in this case better using UNIX sockets, or fifos or something else.
I think the better choice is UNIX sockets because they are bidirectional so with one socket you can do the same that with 2 pipes or fifos.

So the way that you propose to follow is to make an server in other language, and the client only in php.
Is a very good idea but it?ll REALY COOL to try to make all in php. Very Happy

y3dips · Valuable expert

erg0t · Valuable expert

But we are talking about firewalled servers, we can?t use backdoors, this is why this thread Smile

Heintz · Valuable expert

its quite hard to understand what you try to achive here, but at first i made a
usual tcp backdoor in php5 (if you're interested i still have it). but then (i think)
i understood what you needed. a shell thorught php (web security hole) which would not dissappear. but you cant put a backdoor because of firewalls and only thing you got is that security hole.
anyway heres code:

erg0t · Valuable expert

I THINK YOU MAKE IT MAN!
I don?t know php but i think I understood your code and I?m sure that it?s what I was looking for.
Congratulations and thankyou!
salu2

y3dips · Valuable expert

y3dips · Valuable expert

Heintz : i understand your script , n i already try it, but it wont work

here the scenario :
1. i copy your script to bd.php
2. i make in.txt and out.txt with permission 777 (????? <-- koz, web server will write to this file , insecurity ???? )
3. i make some command n put into in.txt ? (am i right ?)
for example
//in.txt---
echo "pwd" > out.txt

4. i run my web browser , point the url to http://loclahost/~y3dips/bd.php
5. what i got here ?
- the page are stalled (bd.php are processing without any output in browser , i understand about this )
- script running
#ps -axf

4320 ? S 0:00 \_ /usr/sbin/httpd
4398 ? S 0:00 | \_ sh -c bash > out.txt
4399 ? S 0:00 | \_ bash

but, nothing output when i tail to out.txt
# tail -f public_html/out.txt

CMIIW

give me some short n real scenario , so i can try
sorry for my dumb question

Heintz · Valuable expert

heres how you should use it

lets say you got a vulnearability in site "a", which lets you execute commands through one of php program execution programs lets say system().
but the site "a" got firewall which doesn't allow anything other than webserver connect to server or from server. so you cant create a backdoor.
this is where this script comes in handy. lets say you echo or wadeva get this thing up to site a/script.php and manage to execute it (either from command line or by visiting it from web). now you start giveing it commands "through" that vulnearability. like system('echo "pwd" > in.txt'); this script reads the command from in.txt and executes it and returns output to out.txt. and you could then read out.txt like system('cat out.txt'); but the script runs all the time so your shell "stays". so now you can give it manually commands.

edit:
this script is not supposed to be a all-platform ready to use app. there may be php safe mode which i have not tested and so on. this is where your own skills come in. i just showed one way to make a solution to this kind of problem.