First step is to investigate whether your php service bans the functions to execute a process or not. I’m talking about the exec and system and popen function series. You may write your own test or install a php script called “PHP Shell”. PHP Shell receives the shell commands through the web browser and executes them and finally delivers the output right at the browser window. There are lots of php shells out there. I used this one developed by Martin Geisler. Download one of them and upload it using your ftp account.

For simple operations, you can get an interactive shell using GNU netcat (Note the GNU word, there are lots of other versions and most of them do not support executing commands). If you run the following command on your machine, it would create a simple tcp listener on an specific port :

netcat -l -p 8999 -v

As you see, we have provided the verbose option to get notified when some one connects to your listener. Then by running the following line, we can the simply connect from the phpshell to our local listener and receive a shell :

netcat my.pc.ip.address 8999 -e “/bin/bash -i”

The above netcat command will connect to your pc at home and execute an interactive bash shell. At this stage you have a command and see the resulting shell (i call it semi interactive). Soon you’ll notice that special terminal commands such as Ctrl+D, Ctrl+C and arrow keys don’t work as expected.

We’ll use socat to overcome this problem. socat can connect almost every two streams you find in the world. From files to sockets, Terminals to udp connections, process output to tcp connection and it supports SSL connections too. But it is not installed on most distributions by default. So the first step is to get the source and compile it. We need it both on our local pc and on the web server. Well, the pc part is easy, but for the web server side you should first find out that whether the build tools (compiler, make, etc) are installed on the web server or not. Test it simply by running g++ and make in your php shell. If yes, you’re all set and follow these steps to get it running :

1. run wget http://www.dest-unreach.org/socat/download/socat-1.7.1.3.tar.gz
2. extract the file using tar -xf socat-1.7.1.3.tar.gz
3. cd socat-1.7.13
4. ./configure
5. make

if everything went smoothly and fine, you would have the socat binary right under the socat-1.7.13 folder. Note that if your web host doesn’t have the build tools installed, you should compile the package locally and upload the binary file. The final part is to setup the listener, this time using socat and connect to it from the webhost, run the following command to get the listener :

socat file:`tty`,raw,echo=0 tcp-listen:8999

and run this one from the php-shell to get the terminal.

./socat tcp-connect:my.pc.ip.address:80 exec:’bash -li’,pty,stderr,setsid,sigint,sane

The first socat command, connected a tcp socket (which is yet listening) to your current TTY and second one, connects the bash process to your tcp listener. Now, you have a fully functional TTY Terminal connected to your account in the web-host. Almost all terminal commands work and you can run vim, nano, screen and Midnight commander . There are few differences between an SSH session and this reverse shell. The most  important ones are :

1. Your session is not encrypted, you may use SSL capabilities of socat
2. SSH automatically forwards some of useful shell variables, you may set them your self or put them in the .bash_profile or .bash_rc of the web hosting account, such as
   export TERM=”xterm-color”

• For simplicity purposes, you may put the second socat command line in a new php script to avoid using php shell each time. Note that you should either secure your php shell or delete it when everything finished to avoid others, access your account.
• Some web servers run using a different user id than your current account. It would cause that you don’t have permission to create and edit files using the php shell. In such situations, creating a world wide writable directory (Enable All Permissions for All) would do the job.

I recently discovered an open source project called “fuse-ext2” which is an implementation of Ext2/Ext3/Ext4 filesystem driver in userspace. Before this one, there was an ext2-only native kernel extension (kext) implementation. So I had no write access to my Ext3 and no read access to Ext4 file-system at all.

To use and enable experimental write support for your Ext2 partition, follow these steps :

1. Download and install NTFS-3G Package which includes FUSE libraries.
   AFAIK NTFS-3G has been renamed into Tuxera NTFS and is a shareware now. But any way you can download the old GPL version here. it works in both Leopard and Snow Leopard.
   .
2. Download fuse-ext2 package
   .
3. Use Disk Utility to un-mount current Ext2 filesystems if there are any
   .
4. Remove any old filesystem drivers for ext2 from /System/Library/FileSystems (it was ext2.fs for me)
   .
5. Install fuse-ext2 package
   .
6. Since write support is experimental, it is not enabled by default. To enable it, open /System/Library/Filesystems/fuse-ext2.fs/fuse-ext2.util for edit while having super user privileges.
   .
7. Edit the OPTIONS variable at line 207 from
   OPTIONS="auto_xattr,defer_permissions"
   to
   OPTIONS="auto_xattr,defer_permissions,rw+"
   .
8. Open Disk Utility and choose Mount for your filesystem and have fun !