A single-file PHP web shell — a teaching/lab proof of concept. Run shell commands, change directory, list files, download/preview files, through a minimal web UI.
A web shell is post-exploitation tooling. This is here as a proof of concept for learning, CTF, and authorized testing on systems you own or are explicitly permitted to test. Deploying it on a host you don't own is illegal. It has no obfuscation, no persistence, no auth — it is intentionally simple, not stealthy or "production".
flowchart LR
B["browser → web_shell.php"] -->|"GET / POST (cmd · cwd · file)"| WS
subgraph WS["web_shell.php (one file, on the PHP server)"]
ROUTE{"which action?"}
ROUTE -->|cmd| EXEC["shell_exec(cmd) in cwd"]
ROUTE -->|cd| CHDIR["change cwd (kept across requests)"]
ROUTE -->|ls| LIST["list files / folders"]
ROUTE -->|file| DL["download / preview a file"]
end
EXEC & CHDIR & LIST & DL --> OUT["HTML page (output + file listing + the form)"]
OUT --> B
- execute shell commands (output rendered in the page)
- change the working directory
- list files and folders
- download / preview files
Drop web_shell.php somewhere a PHP server you control will serve it, browse to it, and
use the form. That's it — it's one file.
To understand what a web shell actually is: how little code it takes, what it can do, and therefore what to look for when hunting for one. Pair it with the Metasploitable write-up for context.