Added shell access key command-line option

[111a5ab1]

Hi,

First thanks for creating pyshell. I had need to use it during a recent web app pentest for $CLIENT. However, as $CLIENT's server was public facing I didn't want to throw a shell on there that was open to the world. So I've added a simple command line option to specify an access key to use to "authenticate" to the web shell. You set the access key in your web shell PHP code, and then pass the key to pyshell via -k (or --key). I've also updated the README.md to reflect the new command line option.

Cheers,

Wasabi

[ojensen5115]

Glad it was helpful, and thank you for the contribution! Does prefixing the parameter name with a random value in this manner differ significantly from simply placing your script at a similarly randomized URL, given that you would not target the script in a web-browser?

[111a5ab1]

Placing the script at a randomized URL would be another method to protect the shell. In my instance though I only had access to modify and inject into an existing PHP file, so "security through obscurity" wasn't really an option in this case. While it was unlikely someone would discover the shell, it wasn't really much effort to add in the protection and the extra peace of mind for $CLIENT and self. So, I guess that's one use case where the ability to prefix would be beneficial.

Where you do have arbitrary write it would still add an additional layer of security, than relying soley on obscurity. The key is also optional, so those who don't need it can just leave off '-k' and it will function as it presently does. But for those who want or need the additional functionality the option would be there; so a win/win situation as far as I see it.

[ojensen5115]

I only had access to modify and inject into an existing PHP file

That's a fair point. I don't have write access to this repo, so lets pull in @amlweems / @kelbyludwig to review.