Live
← all projects
ShardShell
PHP post-exploitation web shell for authorized red teams.
About
Refined PHP post-exploitation shell for authorized red team engagements, with separate Linux and Windows variants tuned to OS-native recon, priv-esc, and log-clearing. Ships with a Python build-time obfuscator and self-decrypting loader for AV evasion.
Features
Dual OS variants: Linux/macOS and Windows/IIS-tailored
File Manager, Terminal, Recon, DB Access (MySQL/SQLite/MSSQL)
Privilege escalation: SUID, capabilities, token privs, AlwaysInstallElevated
Python build system: 3 obfuscation levels + self-decrypting XOR loader
Anti-forensics: timestomping, log rotation, in-memory execution
Web-based UI with file editor, hex viewer, and network pivot tools
Tech Stack
PHP Python Linux Windows
Modules
File Manager
Browse, upload, download, edit, and delete files with hex viewer support
Terminal
Interactive command execution with output streaming and history
Recon
System info, network config, process list, installed software enumeration
DB Access
MySQL, SQLite, and MSSQL query interface with table browser
Priv-Esc
SUID scan, capabilities audit, token privileges, AlwaysInstallElevated check
Obfuscation
3-level Python build system with self-decrypting XOR loader for AV evasion