Zploit 0-Day Shell

:: Editing File: server.inc

<?php

ini_set("log_errors", true);
ini_set("error_log", __DIR__."/server.log");

function logger() {
	if (!ini_get("date.timezone")) {
		date_default_timezone_set(@date_default_timezone_get());
	}
	error_log(sprintf("%s(%s): %s",
		basename(getenv("SCRIPT_FILENAME"), ".php"),
		basename(current(get_included_files()), ".inc"),
		call_user_func_array("sprintf", func_get_args())
	));
}

$php = getenv('TEST_PHP_EXECUTABLE');
if ($php) {
	define('PHP_BIN', $php);
} else if (defined('PHP_BINARY')) {
	define('PHP_BIN', PHP_BINARY);
} else {
	// PHP-5.3
	define("PHP_BIN", PHP_BINDIR.DIRECTORY_SEPARATOR."php");
}

foreach (array("raphf", "http") as $ext) {
	if (!extension_loaded($ext)) {
		dl(ext_lib_name($ext));
	}
}

function get_extension_load_arg($bin, $args, $ext) {
	$bin = escapeshellcmd($bin);
	$args = implode(' ', array_map('escapeshellarg', $args));

// check if php will load the extension with the existing args
	exec(sprintf('%s %s -m', $bin, $args), $output);

foreach ($output as $line ) {
		if (trim($line) === $ext) {
			return null;
		}
	}

// try to load the extension with an arg
	$arg = '-dextension=' . ini_get('extension_dir') . '/' . ext_lib_name($ext);
	exec(sprintf('%s %s %s -m', $bin, $args, escapeshellarg($arg)), $output);

foreach ($output as $line ) {
		if (trim($line) === $ext) {
			return $arg;
		}
	}

// check if the child will be able to dl() the extension
	$success = shell_exec(sprintf('%s %s -r "echo (int)dl(%s);', $bin, $args, var_export(ext_lib_name($ext), true)));
	if ($success) {
		return null;
	}

echo "Unable to load extension '{$ext}' in child process";
	exit(1);
}

function ext_lib_name($ext) {
	if (PHP_SHLIB_SUFFIX === 'dll') {
		return "php_{$ext}.dll";
	}

return $ext . "." . PHP_SHLIB_SUFFIX;
}

function nghttpd($cb) {
	$spec = array(array("pipe","r"), array("pipe","w"), array("pipe","w"));
	$offset = rand(0,2000);
	foreach (range(8000+$offset, 9000+$offset) as $port) {
		$comm = "exec nghttpd -d html $port http2.key http2.crt";
		if (($proc = proc_open($comm, $spec, $pipes, __DIR__))) {
			$stdin = $pipes[0];
			$stdout = $pipes[1];
			$stderr = $pipes[2];

sleep(1);
			$status = proc_get_status($proc);
			logger("nghttpd: %s", new http\Params($status));
			if (!$status["running"]) {
				continue;
			}

try {
				$cb($port, $stdin, $stdout, $stderr);
			} catch (Exception $e) {
				echo $e,"\n";
			}

proc_terminate($proc);

fpassthru($stderr);
			fpassthru($stdout);
			return;
		}
	}

}

function proc($bin, $args, $cb) {
	$spec = array(array("pipe","r"), array("pipe","w"), array("pipe","w"));
	$comm = escapeshellcmd($bin) . " ". implode(" ", array_map("escapeshellarg", $args));
	logger("proc: %s %s", $bin, implode(" ", $args));
	if (($proc = proc_open($comm, $spec, $pipes, __DIR__))) {
		$stdin = $pipes[0];
		$stdout = $pipes[1];
		$stderr = $pipes[2];

do {
			$port = trim(fgets($stderr));
			$R = array($stderr); $W = array(); $E = array();
		} while (is_numeric($port) && stream_select($R, $W, $E, 0, 10000));

if (is_numeric($port)) {
			try {
				$cb($port, $stdin, $stdout, $stderr);
			} catch (Exception $e) {
				echo $e,"\n";
			}
		}

proc_terminate($proc);

fpassthru($stderr);
		fpassthru($stdout);
	}
}