Skip to content

Commit 182544c

Browse files
franckfermanfranckferman
committed
p0wnyShellX — polymorphic PHP webshell generator
0 parents  commit 182544c

9 files changed

Lines changed: 3213 additions & 0 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: ['**']
6+
pull_request:
7+
8+
jobs:
9+
test:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Set up Python
16+
uses: actions/setup-python@v5
17+
with:
18+
python-version: '3.11'
19+
20+
- name: Set up PHP
21+
uses: shivammathur/setup-php@v2
22+
with:
23+
php-version: '8.3'
24+
25+
- name: Generate shells (all themes + option combinations)
26+
run: |
27+
python3 p0wnyShellX.py -p "CITestPass42!" -o /tmp/s1.php
28+
python3 p0wnyShellX.py -p "CITestPass42!" -t matrix -j 5 -o /tmp/s2.php
29+
python3 p0wnyShellX.py -p "CITestPass42!" -t corporate-blue --no-junk -o /tmp/s3.php
30+
python3 p0wnyShellX.py -p "CITestPass42!" -t infra-dark -j 80 -u operator -o /tmp/s4.php
31+
python3 p0wnyShellX.py -p "CITestPass42!" --seed 1337 -o /tmp/s5.php
32+
python3 p0wnyShellX.py -p "CITestPass42!" --transport mimic -o /tmp/s6.php
33+
python3 p0wnyShellX.py -p "CITestPass42!" --transport rc4 -o /tmp/s7.php
34+
35+
- name: PHP syntax check
36+
run: |
37+
for f in /tmp/s1.php /tmp/s2.php /tmp/s3.php /tmp/s4.php /tmp/s5.php /tmp/s6.php /tmp/s7.php; do
38+
php -l "$f" || exit 1
39+
done
40+
41+
- name: Check no static signatures present
42+
run: |
43+
SIGNATURES=(
44+
"fetchContentBlock"
45+
"_resolveTask"
46+
"SESSION_ACTIVE"
47+
"feature=shell"
48+
"pipeCall-cmd"
49+
"panel-stream"
50+
"getPassword"
51+
"suggestEntry"
52+
"featurePwd"
53+
)
54+
for f in /tmp/s1.php /tmp/s2.php /tmp/s3.php /tmp/s4.php /tmp/s5.php /tmp/s6.php /tmp/s7.php; do
55+
for sig in "${SIGNATURES[@]}"; do
56+
if grep -q "$sig" "$f"; then
57+
echo "FAIL: static signature '$sig' found in $f"
58+
exit 1
59+
fi
60+
done
61+
done
62+
echo "All static signature checks passed."
63+
64+
- name: Verify polymorphism (two runs must differ)
65+
run: |
66+
python3 p0wnyShellX.py -p "CITestPass42!" -o /tmp/poly_a.php 2>/dev/null
67+
python3 p0wnyShellX.py -p "CITestPass42!" -o /tmp/poly_b.php 2>/dev/null
68+
if diff -q /tmp/poly_a.php /tmp/poly_b.php > /dev/null 2>&1; then
69+
echo "FAIL: two consecutive runs produced identical output."
70+
exit 1
71+
fi
72+
echo "Polymorphism verified."
73+
74+
- name: Verify seed reproducibility (same seed must produce same output)
75+
run: |
76+
python3 p0wnyShellX.py -p "CITestPass42!" --seed 9999 -o /tmp/seed_a.php 2>/dev/null
77+
python3 p0wnyShellX.py -p "CITestPass42!" --seed 9999 -o /tmp/seed_b.php 2>/dev/null
78+
diff /tmp/seed_a.php /tmp/seed_b.php || (echo "FAIL: same seed produced different output." && exit 1)
79+
echo "Seed reproducibility verified."
80+
81+
- name: Verify mimic transport (param names must not be cmd/cwd)
82+
run: |
83+
for param in cmd cwd filename type path file; do
84+
if grep -q "POST\['${param}'\]" /tmp/s6.php; then
85+
echo "FAIL: plain param name '${param}' found in mimic shell"
86+
exit 1
87+
fi
88+
done
89+
echo "Mimic transport: no plain param names found."
90+
91+
- name: Verify rc4 transport (tEnc/tDec must be present, no plain params)
92+
run: |
93+
if ! grep -q "function tEnc" /tmp/s7.php; then
94+
echo "FAIL: tEnc not found in rc4 shell"
95+
exit 1
96+
fi
97+
for param in cmd cwd filename type path file; do
98+
if grep -q "POST\['${param}'\]" /tmp/s7.php; then
99+
echo "FAIL: plain param name '${param}' found in rc4 shell"
100+
exit 1
101+
fi
102+
done
103+
echo "RC4 transport: tEnc present, no plain param names."
104+
105+
- name: Verify bcrypt hash is present and valid
106+
run: |
107+
php -r "
108+
\$f = file_get_contents('/tmp/s1.php');
109+
preg_match('/define\(.*?,\s*\'(\\\$2y\\\$[^\']+)\'\)/m', \$f, \$m);
110+
if (empty(\$m[1])) { echo 'FAIL: bcrypt hash not found\n'; exit(1); }
111+
if (!password_verify('CITestPass42!', \$m[1])) { echo 'FAIL: password_verify returned false\n'; exit(1); }
112+
echo 'Bcrypt verification passed.\n';
113+
"

‎.github/workflows/release.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*.*.*'
7+
8+
jobs:
9+
release:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: write
13+
14+
steps:
15+
- uses: actions/checkout@v4
16+
17+
- name: Set up Python
18+
uses: actions/setup-python@v5
19+
with:
20+
python-version: '3.11'
21+
22+
- name: Set up PHP
23+
uses: shivammathur/setup-php@v2
24+
with:
25+
php-version: '8.3'
26+
27+
- name: Generate example shells (one per theme)
28+
run: |
29+
python3 p0wnyShellX.py -p "changeme666" -u sysadmin -t infra-dark -j 40 -o example_infra-dark.php
30+
python3 p0wnyShellX.py -p "changeme666" -u sysadmin -t corporate-blue -j 40 -o example_corporate-blue.php
31+
python3 p0wnyShellX.py -p "changeme666" -u sysadmin -t matrix -j 40 -o example_matrix.php
32+
33+
- name: PHP syntax validation
34+
run: |
35+
php -l example_infra-dark.php
36+
php -l example_corporate-blue.php
37+
php -l example_matrix.php
38+
39+
- name: Verify no static signatures in examples
40+
run: |
41+
SIGNATURES=("fetchContentBlock" "_resolveTask" "SESSION_ACTIVE" "feature=shell" "pipeCall-cmd" "panel-stream")
42+
for f in example_infra-dark.php example_corporate-blue.php example_matrix.php; do
43+
for sig in "${SIGNATURES[@]}"; do
44+
if grep -q "$sig" "$f"; then
45+
echo "FAIL: static signature '$sig' in $f"
46+
exit 1
47+
fi
48+
done
49+
done
50+
51+
- name: Extract tag version
52+
id: version
53+
run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
54+
55+
- name: Create GitHub Release
56+
uses: softprops/action-gh-release@v2
57+
with:
58+
tag_name: ${{ steps.version.outputs.VERSION }}
59+
name: p0wnyShellX ${{ steps.version.outputs.VERSION }}
60+
body: |
61+
## p0wnyShellX ${{ steps.version.outputs.VERSION }}
62+
63+
### Assets
64+
65+
| File | Description |
66+
|---|---|
67+
| `p0wnyShellX.py` | Polymorphic generator — requires Python 3.8+ and PHP 8.x CLI |
68+
| `example_infra-dark.php` | Pre-generated shell — infra-dark theme |
69+
| `example_corporate-blue.php` | Pre-generated shell — corporate-blue theme |
70+
| `example_matrix.php` | Pre-generated shell — matrix theme |
71+
72+
### Example shell credentials
73+
> These examples use default credentials. **Change them before any deployment.**
74+
75+
- **Username:** `sysadmin`
76+
- **Password:** `changeme666`
77+
78+
### Generate your own
79+
80+
```bash
81+
python3 p0wnyShellX.py -p "YourPassword!" -u youruser -o shell.php
82+
```
83+
84+
### Requirements
85+
- Python 3.8+
86+
- PHP 8.x CLI (for bcrypt hash computation at build time)
87+
files: |
88+
p0wnyShellX.py
89+
example_infra-dark.php
90+
example_corporate-blue.php
91+
example_matrix.php

‎.github/workflows/static.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Deploy static content to Pages
2+
3+
on:
4+
push:
5+
branches: ["stable"]
6+
paths:
7+
- 'docs/**'
8+
- '.github/workflows/static.yml'
9+
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read
14+
pages: write
15+
id-token: write
16+
17+
concurrency:
18+
group: "pages"
19+
cancel-in-progress: false
20+
21+
jobs:
22+
deploy:
23+
environment:
24+
name: github-pages
25+
url: ${{ steps.deployment.outputs.page_url }}
26+
runs-on: ubuntu-latest
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v4
30+
31+
- name: Setup Pages
32+
uses: actions/configure-pages@v5
33+
34+
- name: Upload artifact
35+
uses: actions/upload-pages-artifact@v3
36+
with:
37+
path: 'docs'
38+
39+
- name: Deploy to GitHub Pages
40+
id: deployment
41+
uses: actions/deploy-pages@v5

‎.gitignore‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# ==============================
2+
# 🐘 PHP
3+
# ==============================
4+
5+
# Vendor directory (Composer)
6+
vendor/
7+
8+
# Composer dependencies
9+
composer.lock
10+
composer.phar
11+
12+
# IDE / Editor specific
13+
.phpunit.result.cache
14+
.php_cs.cache
15+
16+
# PHPUnit coverage & logs
17+
coverage/
18+
tests/_output/
19+
20+
# Common cache/log/temp
21+
cache/
22+
logs/
23+
tmp/
24+
.cache/
25+
*.cache
26+
27+
# Environment files
28+
.env
29+
.env.*
30+
31+
# ==============================
32+
# 🖥️ Shell/Bash Scripts
33+
# ==============================
34+
35+
# Temporary and backup scripts
36+
*.bak
37+
*.swp
38+
*.swo
39+
*.swn
40+
*.orig
41+
*.tmp
42+
*.old
43+
44+
# Log and debug files
45+
*.log
46+
*.log.*
47+
*.out
48+
*.err
49+
*.trace
50+
nohup.out
51+
52+
# Generated files
53+
*.pid
54+
*.lock
55+
*.sock
56+
*.history
57+
58+
# ==============================
59+
# 🛠️ Compilation & Binaries
60+
# ==============================
61+
62+
# Binary files (compiled)
63+
bin/
64+
obj/
65+
*.o
66+
*.so
67+
*.a
68+
*.la
69+
*.lo
70+
*.dylib
71+
*.exe
72+
*.dll
73+
*.com
74+
75+
# Results for `make`
76+
Makefile~
77+
*.d
78+
79+
# ==============================
80+
# 📝 Text editors
81+
# ==============================
82+
83+
# Vim
84+
*.swp
85+
*.swo
86+
*.swn
87+
*.viminfo
88+
89+
# Nano
90+
.nanorc
91+
*.save
92+
93+
# VSCode
94+
.vscode/
95+
*.code-workspace
96+
97+
# Sublime Text
98+
*.sublime-project
99+
*.sublime-workspace
100+
101+
# JetBrains (PyCharm, IntelliJ, WebStorm)
102+
.idea/
103+
*.iml
104+
105+
# Emacs
106+
*~
107+
# Spacemacs
108+
*.spacemacs
109+
110+
# ==============================
111+
# 💾 Operating systems
112+
# ==============================
113+
114+
# macOS
115+
.DS_Store
116+
.AppleDouble
117+
.LSOverride
118+
.Spotlight-V100/
119+
.Trashes/
120+
._*
121+
122+
# Windows
123+
Thumbs.db
124+
ehthumbs.db
125+
*.lnk
126+
Desktop.ini
127+
$RECYCLE.BIN/
128+
129+
# Linux
130+
*.lock
131+
*~
132+
133+
*.php
134+
135+
# Python
136+
__pycache__/
137+
*.pyc
138+
*.pyo

0 commit comments

Comments
 (0)