Skip to content

TODO.md

Latest commit

 

History

History
39 lines (32 loc) · 3.82 KB

TODO.md

File metadata and controls

39 lines (32 loc) · 3.82 KB
Raw

TODO / Roadmap

Project goal: full Weevely parity — one generator that covers both the browser-terminal and the CLI-framework use cases, so the two tools no longer have to be combined.

Planned (Weevely parity gaps)

  • Obfuscated HTTP protocol — XOR+gzip+base64 for request and response payloads (à la Weevely), making POST body opaque to WAF inspection
  • Full SOCKS proxy through the target (à la :net_proxy) — fetch already covers single-shot reads through the target; a persistent proxy channel is a larger piece of work

Low priority / won't implement soon

  • disable_functions bypass via mod_cgi — requires Apache + mod_cgi enabled + AllowOverride FileInfo + a web-writable directory. All four conditions are rarely met simultaneously in production environments, making this bypass mostly theoretical in practice.

Done

  • Polymorphic generator — unique PHP file on every run (function names, routing tokens, junk, exec order)
  • bcrypt password hashing at generation time — no plaintext ever stored in the output file
  • Seed reproducibility — deterministic builds with --seed
  • Random routing tokens — replaces static ?feature=shell
  • Random PHP/JS/HTML function and variable names — 250+ business name pool
  • Dynamic junk functions — 20–80 decoy PHP functions per run, 20 body templates
  • Shuffled exec fallback chain — exec/shell_exec/system/passthru/popen order varies per run
  • CSS camouflage themes — infra-dark, corporate-blue, matrix
  • CI — polymorphism validation, bcrypt verification, PHP lint, static signature detection
  • GitHub Releases — auto-generate 3 example shells (one per theme) on version tag push
  • GitHub Pages — interactive command builder at franckferman.github.io/p0wnyShellX
  • Built-in reverse shell — revshell <IP> <PORT> command, multi-method (bash, python3, perl, php) fallback chain
  • Log clearing — clearlog <file> <pattern> strips matching lines in-place from any readable/writable file
  • Internal port scan — portscan <ip[-range]> <port[s]> TCP scan via fsockopen from the target host
  • UTF-8 output — b64u() helper using decodeURIComponent(escape(atob(s))) fixes mojibake on non-ASCII command output
  • Optional LLM pool augmentation (v3.0.0) — --llm provider[:model] (ollama local, or anthropic/openai/deepseek/kimi via env keys): fresh function names, app names, mimic params and junk words per build; atoms-only validation + denylist; silent static-pool fallback
  • Target-context camouflage (v3.0.0) — --company / --context: names generated in the target organization's vocabulary
  • Per-build session cookie name (v3.0.0) — random plausible name instead of PHPSESSID
  • Offline pytest suite (v3.0.0) — 40 tests: generation invariants, seed determinism, theme/transport matrix, php -l, full LLM layer with mocked HTTP
  • Runtime end-to-end suite (v3.1.0) — real builds served by php -S and driven over the actual protocol: auth, exec, cd, all transports, feature commands, fetch (both HTTP paths), sql against sqlite. Caught and fixed a real bug: cd was broken by a greedy 2>&1 regex in resolve_task
  • Non-interactive CLI client (v3.1.0) — tools/shellx_client.py: scriptable command execution, replicates plain/mimic/rc4, protocol from --client-config sidecar or parsed from the shell file
  • SQL console module (v3.1.0) — --sql compiles sql <dsn> [user pass] <query> (PDO: sqlite, mysql, pgsql…), aligned table output, 100-row cap
  • Fetch-through-target module (v3.1.0) — --fetch compiles fetch <url> (pivot recon): curl → fopen → raw fsockopen fallback, 128 KB cap
  • LLM parser hardening (v3.1.0) — strips <think> blocks (reasoning models), tolerates single-quoted and //-commented arrays, normalizes PascalCase to camelCase