Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is there a PHP HTTP reverse shell? I haven't been able to find one, only ones that transmit using TCP packets (not HTTP).
Note, I mean actually using HTTP packets as the C2, not just transmitting TCP packets over port 80.
Metasploit just has: payload/php/meterpreter/reverse_tcp and a few variations of that.
For Windows, Metasploit has windows/meterpreter/reverse_http but again, nothing for PHP.
What you're looking for is a proper implant written in PHP which uses HTTP for it's C2, which as you correctly state isn't one of the Meterpreter options - and I'm not sure if anyone has bothered writing one.
Depending on your use case and how good your target's network detection is, you might be better off using your PHP exploit to execute a binary Mettle stageless payload such as linux/x86/meterpreter_reverse_http.
