flozz / p0wny-shell

Single-file PHP shell

p0wny@shell:~# -- Single-file PHP Shell

p0wny@shell:~# is a very basic, single-file, PHP shell. It can be used to quickly execute commands on a server when pentesting a PHP application. Use it with caution: this script represents a security risk for the server.

Features:

• Command history (using arrow keys ↑ ↓)
• Auto-completion of command and file names (using Tab key)
• Navigate on the remote file-system (using cd command)
• Upload a file to the server (using upload <destination_file_name> command)
• Download a file from the server (using download <file_name> command)

WARNING: THIS SCRIPT IS A SECURITY HOLE. DO NOT UPLOAD IT ON A SERVER UNLESS YOU KNOW WHAT YOU ARE DOING!

Demo with Docker:

    docker build -t p0wny .
    docker run -it -p 8080:80 -d p0wny
    # open with your browser http://127.0.0.1:8080/shell.php

Contributing

Questions

If you have any question, you can:

• Open an issue on GitHub
• Ask on Discord (I am not always available to chat, but I try to answer to everyone)

Bugs

Please open an issue on GitHub with as much information as possible if you found a bug:

• Your operating system / Linux distribution (and its version)
• The PHP version you are using (example: PHP-FPM 8.1, Apache mod_php 7.4,...)
• The Web server you are using and its version (example: Nginx 1.23, Apache 2.4.55,...)
• All the logs and message outputted by the software
• etc.

Pull requests

Please consider filing a bug before starting to work on a new feature; it will allow us to discuss the best way to do it. It is obviously unnecessary if you just want to fix a typo or small errors in the code.

Support this project

Want to support this project?

• ☕️ Buy me a coffee
• 💵️ Give me a tip on PayPal
• ❤️ Sponsor me on GitHub

Changelog

• v2023.08.10:
  • Make p0wny@shell compatible with PHP 5.3 (@FrancoisCapon, #38)
• v2023.05.28:
  • Encode all data fields as base64 to avoid encoding errors, especially on Windows (@cli-ish, #8, #35)
• v2023.05.22:
  • Display the username and the hostname in the prompt (@cli-ish, #33, #7)
• v2023.05.10:
  • Try different execution functions (exec, shell_exec, system, passthru, popen, proc_open) to run commands to bypass disabled functions (@cli-ish, #31, #32)
• v2023.02.27:
  • Make terminal window resizable (@FrancoisCapon, #27)
• v2023.02.13:
  • Larger terminal size on large screens (@psyray, #26)
  • No more horozontal scrolling on small screens (@flozz)
• v2022.09.19:
  • Expand path in cd command (cd ~, cd ~username,...)
  • Go home when running cd withoud argument.
  • → Thanks @FrancoisCapon for the suggestion (#25)
• v2021.01.24:
  • Style improvements:
    • Better-looking scrollbar on webkit (@nakamuraos)
    • Display a smaller logo on mobile (@nakamuraos)
  • Ergonomic improvements:
    • Focus the command field when clicking the page (@nakamuraos)
    • Put the cursor at the end of the command field while navigating the history (@nakamuraos)
• v2019.06.07:
  • Adds the clear command to clear the terminal (@izharaazmi #12)
• v2018.12.15:
  • File upload and download feature (@Oshawk #5)
• v2018.06.01:
  • Auto-completion of command and file names (@lo001 #2)
  • Adaptation to mobile devices (responsive) (@lo001 #2)
  • Improved handling of stderr (@lo001 #2)
• v2018.05.30:
  • ES5 compatibility (@lo00l #1)
  • Dependency to JQuery removed (@lo00l #1)
  • Command history using arrow keys (@lo00l #1)
  • Keep the command field focused when pressing the tab key
• v2017.10.30:
  • CSS: invalid color fixed
• v2016.11.10:
  • Initial release

p0wny-shell's Issues

Non-Ascii Characters

Found non-ASCII characters in the UI during file upload. Would replace to ASCII equivalence.

Current:

After:

terminal window size

Is it possible to increase the size of the terminal window?

Password protection

It would be a cool little feature that allows the shell user to define a password/username for the shell to prevent unauthorized access to it.

I would implement it as follows:

1. add 3 new variables to SHELL_CONFIG: authentication_needed (bool), login_username (string), login_password (sha256 or md5 of the password).
2. if authentication_needed = true, then add a "WWW-Authenticate" header and exit().
3. check if the user's credentials are correct and let him in.

Is this something that can be implemented?

Error while parsing response: SyntaxError: Unexpected end of JSON input

I tried to input tasklist to view running process but it shows error

for remote server

can you make it use for remote server. so i can place it in external server and i can remote with this to internal server

Replace prompt "separator" on windows

Would be nice to have ">" instead of "#" on windows.

Add this around line 100:

var cmdPrompt = <?php echo defined('PHP_WINDOWS_VERSION_BUILD') ? "'>';\n" : "'#';\n";?>

then replace line 334 with this:

return "<span title=\"" + cwd + "\">" + shortCwd + "</span>" + cmdPrompt;

Vi support?

will vi be supported?

Select a working execution function if disabled functions are present

I just read the README.md file which says that every PR should have a issue before it is created. Since I have already created the PR, I will still explain why this is a good improvement.

Some servers disable functions for security reasons, but leave some open because they don`t know them or use only certain functions.
For these cases, the exec function could be blocked, but shell_exec could be allowed. So the idea would be to go through a list of possible aqiuvalente so that we can still execute commands.

My PR
#31

Again i am sorry, that i did the order wrong :)

An error is thrown if a file contains non UTF-8 characters

File and directory names on Windows might not be UTF-8 encoded and json_encode() fails. This is what I have come up with (around line 100):

    $encoded = json_encode($response);
    if(!$encoded) {
        //replace "unknown" charaters with ?
        $i = 0;
        foreach($response['stdout'] as $v) {
            $response['stdout'][$i] = preg_replace('/[\x00-\x1F\x80-\xFF]/', '?', $v);
            $i++;
        }
      $encoded = json_encode($response);
    }

    header("Content-Type: application/json");
    echo $encoded;
    die();

Dorks for Google

GitHub should remove this type of useless "educational purpose" stuff.

thanks i hacked my school with it xD

everyone thinks im a hacker now lol. i guess i really am

Error while parsing response: SyntaxError: Unexpected end of JSON input

error json

Error while parsing response: SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data popup firefox

Error while parsing response: SyntaxError: JSON.parse: unexpected end of data at line 1 column 1 of the JSON data

Hi, i have error what can be wrong?

Add username@hostname

@flozz - what do you think about implementing this:

That screenshot shows how it looks using https://github.com/Arrexel/phpbash

If you're interested, I could put together a PR.