Failed to open stream: via PHP shell in file_get_contents

[duraki]

msf5 exploit(multi/handler) > run

[*] Started bind TCP handler against 127.0.0.1:10000
[*] Sending stage (36 bytes) to 127.0.0.1
[*] Command shell session 4 opened (127.0.0.1:38407 -> 127.0.0.1:10000) at 2020-08-09 19:56:29 +0000

<br />
<b>Warning</b>:  file_get_contents(compress.zlib://php://input) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: Success in <b>/var/www/conn.php</b> on line <b>192</b><br />
<br />
<b>Warning</b>:  file_get_contents(compress.zlib://php://input) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: Success in <b>/var/www/conn.php</b> on line <b>192</b><br />
<br />
<b>Warning</b>:  file_get_contents(compress.zlib://php://input) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: Success in <b>/var/www/conn.php</b> on line <b>192</b><br />
<br />
^C
Abort session 4? [y/N]  y

[duraki]

Target is a bit old fo' sho:

$ php --version
PHP 5.1.6 (cli) (built: Mar 18 2014 20:48:55) 
Copyright (c) 1997-2006 The PHP Group
Zend Engine v2.1.0, Copyright (c) 1998-2006 Zend Technologies

[duraki]

I suspect it's due: https://github.com/SECFORCE/Tunna/blob/master/webshells/conn.php#L192

You can apply this patch for hotfix:

diff --git a/webshells/conn.php b/webshells/conn.php
index 301d400..56b8eee 100644
--- a/webshells/conn.php
+++ b/webshells/conn.php
@@ -189,7 +189,7 @@ if(!empty($_GET)){
                         */
                                header('Content-Type: application/octet-stream');
                                #write to buffer for server
-                               $_SESSION['handler_data'] .= file_get_contents("compress.zlib://php://input");
+                               $_SESSION['handler_data'] .= file_get_contents("php://input");
                                #read buffer for client
                                echo $_SESSION['met_data'];
                                $_SESSION['met_data'] = "";     //clear variable

[nvssks]

Thanks duraki, you're right, it's the zlib library that is missing in some deployments that creates this error. Also, the metasploit module it's quite old at this point, I'm surprised it still works :)

[duraki]

Always :) Yup, I was reading up some blog mentioning this tool. Just wanted to give it a try, although a bit old, nothing really changed that much, and guess what; it worked. The only thing that I was unable to get is proper tty, only tunneled one - which weevely3 from Kali already provides. Anyway, hope it will help someone if they stumble upon here.

Thanks for quick response and the tool.