PHP has provided a function to view, create and change the directory or folder. With open this PHP file you can do all mentioned above without need to do manually. Hacker usually use this PHP function to create a PHP SHELL file for uploading to a victim webserver, and with accessing this file they can monitor all directory or all file in the victim webserver. For more detail lets follow steps bellow:
Reactive your webserver
Create a new folder in xampp/htdocs if you use xampp. While you use Linux create it at var/www.
Open the previous folder from your text editor. and create new php file save as index.php
Add HTML element as usual
<html>
<head>
<title>Directory</title>
</head>
<body>
</body>
</html>
Direktory : <input type="text" name="folder">
<input type="submit" value="Create">
<?php
?>
$path=".";
$dir=opendir($path) or die ("can't open directory");
while($file=readdir($dir)){
echo "$file ";
}
while($file=readdir($dir)){
echo "$file DELETE
";
}
while($file=readdir($dir)){
if($file=="."||$file==".."|| $file=="index.php"|| $file=="create.php" || $file=="delete.php")
continue;
echo "$file DELETE
";
}
closedir($dir);
create.phpindex.php$dir=$_POST['folder'];
mkdir($dir, 777);
index.phpheader("location: index.php");
delete.php$folder=$_GET['dir'];
rmdir($folder);
index.phpheader("location: index.php")
Save all file and try to run
Create new directory
You can see the directory just created by you under the input element
To Delete the directory click delete button
Full code you can get bellow:
index.php
<html>
<head></head>
<body>
<form action="create.php" method="POST">
Direktory : <input type="text" name="folder">
<input type="submit" value="Create">
</form>
</body>
</html>
<?php
$path=".";
$dir=opendir($path) or die ("can't open directory");
while($file=readdir($dir)){
if($file=="."||$file==".."|| $file=="index.php"|| $file=="create.php" || $file=="delete.php")
continue;
echo "$file DELETE
";
}
closedir($dir);
?>
Create.php
<?php
$dir=$_POST['folder'];
mkdir($dir, 777);
header("location: index.php");
?>
delete.php
<?php
$folder=$_GET['dir'];
rmdir($folder);
header("location: index.php")
?>