FREE THOUGHT · FREE SOFTWARE · FREE WORLD

Home  »  Hacking  »  PHP and AJAX shell console

by 17 comments

Ever wanted to execute commands on your server through php to mimick a shell login? Now you can. I'm calling this file (see below) shell.php and it allows you to run commands on your web server with the same permissions that your php executable has.

Loading Video

PHP for shell.php

Substitue 1.1.1.1 for your IP address.. or see below for password authentication methods.

<?php
 if ($_SERVER['REMOTE_ADDR'] !== '1.1.1.1') die();
 ob_start();
 if (!empty($_GET['cmd'])){
 $ff=$_GET['cmd'];
 #shell_exec($ff);
 system($ff);
 #exec($ff);
 #passthru($ff);
 }
 else {
?>




PHP AJAX Shell



:->
<?php } ?>

Read this

Note: The history feature works by remembering the last commands that you typed.. Access them by pressing the up or down arrows on your keyboard.

This is not an interactive session, so you cannot cd to a directory and then do stuff in that directory.. You may however be able to do stuff like /bin/bash -c "cd ../../;mv this there;ls -la;" or you could try exporting your current dir or something..

Writing shell scripts and serving them on your web server works by renaming the file.sh to file.cgi and chmodding it to 750 or +x. Also make sure you try dos2unix -dv file.cgi If you can't get it to work..

Example shell script as cgi

#!/bin/sh
export MYBNAME=`date +%mx%dx%y-%Hx%M.tgz`
tar -czf ${HOME}/backups/${MYBNAME} ${HOME}/site1/
exit 0;

Locking Down Access to your shell.php

Thanks to the comment by Andrew Ramsden, Here are a couple ways to secure your shell.php file so that only you can run this script.

Secure your remote shell by adding this to your shell.php

Add this line to the very top of your shell.php file to make sure that only you can access this script. Everyone else sees a blank screen.

if ($_SERVER['REMOTE_ADDR'] !== '1.1.1.1') die();

Secure your remote shell with htaccess

This only allows access from IP 1.1.1.1 and redirects everyone else. See Using the Allow Directive in Apache htaccess for more info.

Order deny,allow
Deny from all
Allow from 1.1.1.1
ErrorDocument 403 http://www.askapache.com

Secure your remote shell with mod_rewrite and htaccess

Based on the code from htaccess article This only allows access from user with IP of 1.1.1.1 and redirects everyone else.

RewriteEngine On
RewriteBase /
RewriteCond %{REMOTE_HOST} !^1.1.1.1
RewriteRule .* http://www.askapache.com [R=302,L]

Tags

June 13th, 2009

Comments Welcome

  • Andrew Ramsden

    Great idea. It would be a really good idea to put this file in a password protected directory ;)

  • Jake Jones

    Too bad the script doesn't work. Let me know when you finish debugging it.

  • AskApache

    @ Jake Jones

    If it doesn't work than how do you suppose I got that video showing it working? :)

    What kind of error or problem are you getting?

  • Fugitif

    that script works very good,but not always !

  • Andrew

    Works great! Too bad it's not interactive, though...

  • Mgccl

    it's possible to extend this script and fix the "can not cd and work in that directory bug" by using the PHP function chdir.

  • Mgccl

    chdir() choses the current working directory. I only used it on windows, don't know what it's like on linux. let's suppose, in PHP, start with checking the current working directory getcwd(), and it returns c:
    I run this command in PHP
    cd cool
    which suppose make me go into c:cool
    and then I run
    dir
    in a interactive session, it should show all the files inside the c:cool, but no, instead, it shows everything in c:
    I could insert some code that captures user's command, like cd, then use chdir() to change the current working dir. for example
    chdir('c:cool');
    then, run dir will show everything in c:cool.

  • zTriker360°

    nice work, really nice script! i use it nearly every day :O

    btw, @Mgccl,

    you can use cd c:cool && dir instead.

  • syh

    Script doesn't work, getting white screen without any error. What's the problem ?

  • fiouji

    please tell me how this work!!!
    I couldn't run this ajax console!
    thank you

  • crich

    nice script :D thanks!!
    would be cool too have a real interactive console probably with a XMLHttpRequest Server backend and such a client :D

  • anibal

    Does not work, any command outputs a blank line.

  • xit

    Thank you, good script!

    Note: if you want to see errors in *nix systems:

     system($ff.' 2>&1');
  • Really Doesn’t Work! BUG IN THIS PAGE!!!

    I can't see the dates of the other comments, but this page, here, on this site, is messed up...it's including the php from shell.php, but everything after...

    ---Begin---

    ---End---

    ...is displaying literally, not escaped...so we can't see/download the full/real shell.php code...

    Instead of including the code plz link to shell.php or shell.phps so we can see/download the code...also your "video" is not displaying either, probably cuz of the literal code making it not show up...

    dupe comment override!

  • Jojo Maquiling

    Thanks, your script is working nicely..its been a great help especially that I dont have an ssh access to the website i'm using. More power to you!!

    :)

  • Jacob Walker

    What is the license for this script? MIT? LGPL?

  • Jacob Walker

    What is the license for this script? MIT? LGPL?


Related Articles


My Online Tools
Popular Articles


Hacking and Hackers

The use of "hacker" to mean "security breaker" is a confusion on the part of the mass media. We hackers refuse to recognize that meaning, and continue using the word to mean someone who loves to program, someone who enjoys playful cleverness, or the combination of the two. See my article, On Hacking.
-- Richard M. Stallman









[hide]

It's very simple - you read the protocol and write the code. -Bill Joy

Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution 3.0 License, just credit with a link.
This site is not supported or endorsed by The Apache Software Foundation (ASF). All software and documentation produced by The ASF is licensed. "Apache" is a trademark of The ASF. NCSA HTTPd.
UNIX ® is a registered Trademark of The Open Group. POSIX ® is a registered Trademark of The IEEE.

+Askapache | askapache

Site Map | Contact Webmaster | License and Disclaimer | Terms of Service

↑ TOPMain