search

vulncheck-oss / go-exploit

A Go-based Exploit Framework
https://pkg.go.dev/github.com/vulncheck-oss/go-exploit
Apache License 2.0
304 stars 29 forks source link

Randomize the parameter used in the minimal webshell #246

Closed j-baines closed 1 month ago

j-baines commented 1 month ago

At @terrorbyte's suggestion, added a loose scheme to ensure that randos can't use the webshell. Usage is basically the same except the parameter to use is also spit out. E.g. Usage example:

webshellPayload, cmdParam := webshell.PHP.MinimalGet()

Downstream that looks like:

url = protocol.GenerateURL(conf.Rhost, conf.Rport, conf.SSL, "/"+webshellName)
output.PrintfSuccess("Minimal webshell dropped to %s", url)
output.PrintfSuccess("Example usage: curl -kv %s?%s=id", url, cmdParam)