Warning: The provided code is a PHP-based web shell, often used for malicious purposes. It allows users to execute commands on a server, manage files, and gather server information.
The script is designed to provide a web interface for interacting with the server's file system and executing commands. It includes several features that can be exploited if the script is deployed on a vulnerable server.
The document begins with standard HTML declarations, including a <head> section that contains metadata and styles. The body contains a user interface for interacting with the shell.
The interface includes buttons for various functionalities:
- Server Info: Displays server details such as OS, server software, and user information.
- File Manager: Allows users to navigate the file system, view files, and perform operations like delete, rename, and edit.
- PHP Info: Displays detailed information about the PHP environment.
- Code Injector: A feature that allows users to inject and execute arbitrary PHP code.
- Uploader: Enables file uploads to the server.
- Domains: Lists domains configured on the server.
- Back Connecter: A feature that can be used to establish a reverse shell connection.
The script uses inline CSS to style the interface, making it visually appealing but also obscuring its malicious intent.
The file manager section allows users to view directories and files, along with their permissions. Users can perform actions such as:
- Delete: Remove files or directories.
- Chmod: Change file permissions.
- Rename: Rename files or directories.
- Edit: Modify the contents of files.
The code injector allows users to execute arbitrary commands on the server, which can lead to severe security breaches.
The presence of such a script on a server poses significant security risks:
- Unauthorized Access: If an attacker gains access to this shell, they can manipulate the server, access sensitive data, and potentially take control of the entire system.
- Data Loss: The ability to delete files and directories can lead to data loss or corruption.
- Malware Deployment: Attackers can upload malicious files or scripts, further compromising the server and its data.
- Reverse Shells: The back connecter feature can be used to create a reverse shell, allowing attackers to execute commands remotely.
The Mini Shell PHP script is a powerful tool that can be used for both legitimate and malicious purposes. Its presence on a server should be treated as a critical security threat. It is essential for server administrators to regularly audit their systems, remove unauthorized scripts, and implement security measures to prevent such vulnerabilities.
- Remove Unauthorized Scripts: Regularly check for and remove any unauthorized web shells or scripts.
- Implement Security Measures: Use firewalls, intrusion detection systems, and regular security audits to protect the server.
- Keep Software Updated: Ensure that all server software, including PHP and web servers, are up to date with the latest security patches.
- Limit Permissions: Restrict file and directory permissions to minimize the impact of potential exploits.
Developed By R00t